From 1e0e901ea0ebb3522b8f33e55f78731da45b6b7d Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Thu, 16 Jan 2020 13:26:38 +0100 Subject: [PATCH] Add upstream patches, need proper testing. --- ...h-5.4.1-2.patch => 02-patch-5.4.1-2.patch} | 0 ...h-5.4.2-3.patch => 02-patch-5.4.2-3.patch} | 0 ...h-5.4.3-4.patch => 02-patch-5.4.3-4.patch} | 0 ...h-5.4.4-5.patch => 02-patch-5.4.4-4.patch} | 0 ...h-5.4.5-6.patch => 02-patch-5.4.5-6.patch} | 0 .../meson64-current/02-patch-5.4.6-7.patch | 12219 ++++++++++++++ .../meson64-current/02-patch-5.4.7-8.patch | 7703 +++++++++ .../meson64-current/02-patch-5.4.8-9.patch | 7432 +++++++++ .../meson64-current/02-patch-5.4.9-10.patch | 26 + .../meson64-current/03-patch-5.4.10-11.patch | 5850 +++++++ .../meson64-current/03-patch-5.4.11-12.patch | 2421 +++ .../drm_bridge_reuse_DDC.patch | 71 - ..._use_the_correct_G12A_frac_max_value.patch | 53 - .../odroidxu4-current/02-patch-5.4.3-4.patch | 6257 +++++++ .../odroidxu4-current/02-patch-5.4.4-5.patch | 2510 +++ .../odroidxu4-current/02-patch-5.4.5-6.patch | 3420 ++++ .../odroidxu4-current/02-patch-5.4.6-7.patch | 13537 ++++++++++++++++ .../odroidxu4-current/02-patch-5.4.7-8.patch | 7703 +++++++++ .../odroidxu4-current/02-patch-5.4.8-9.patch | 7489 +++++++++ .../odroidxu4-current/02-patch-5.4.9-10.patch | 26 + .../03-patch-5.4.10-11.patch | 5959 +++++++ patch/kernel/odroidxu4-current/7.patch | 333 + .../odroidxu4-legacy/patch-4.14.164-165.patch | 1239 ++ .../rk3399-legacy/patch-4.4.208-209.patch | 1715 ++ .../rk3399-legacy/patch-4.4.209-210.patch | 810 + .../rockchip-legacy/patch-4.4.209-210.patch | 810 + .../sunxi-current/patch-5.4.11-12.patch | 2421 +++ 27 files changed, 89880 insertions(+), 124 deletions(-) rename patch/kernel/meson64-current/{patch-5.4.1-2.patch => 02-patch-5.4.1-2.patch} (100%) rename patch/kernel/meson64-current/{patch-5.4.2-3.patch => 02-patch-5.4.2-3.patch} (100%) rename patch/kernel/meson64-current/{patch-5.4.3-4.patch => 02-patch-5.4.3-4.patch} (100%) rename patch/kernel/meson64-current/{patch-5.4.4-5.patch => 02-patch-5.4.4-4.patch} (100%) rename patch/kernel/meson64-current/{patch-5.4.5-6.patch => 02-patch-5.4.5-6.patch} (100%) create mode 100644 patch/kernel/meson64-current/02-patch-5.4.6-7.patch create mode 100644 patch/kernel/meson64-current/02-patch-5.4.7-8.patch create mode 100644 patch/kernel/meson64-current/02-patch-5.4.8-9.patch create mode 100644 patch/kernel/meson64-current/02-patch-5.4.9-10.patch create mode 100644 patch/kernel/meson64-current/03-patch-5.4.10-11.patch create mode 100644 patch/kernel/meson64-current/03-patch-5.4.11-12.patch delete mode 100644 patch/kernel/meson64-current/drm_bridge_reuse_DDC.patch delete mode 100644 patch/kernel/meson64-current/vclk_use_the_correct_G12A_frac_max_value.patch create mode 100644 patch/kernel/odroidxu4-current/02-patch-5.4.3-4.patch create mode 100644 patch/kernel/odroidxu4-current/02-patch-5.4.4-5.patch create mode 100644 patch/kernel/odroidxu4-current/02-patch-5.4.5-6.patch create mode 100644 patch/kernel/odroidxu4-current/02-patch-5.4.6-7.patch create mode 100644 patch/kernel/odroidxu4-current/02-patch-5.4.7-8.patch create mode 100644 patch/kernel/odroidxu4-current/02-patch-5.4.8-9.patch create mode 100644 patch/kernel/odroidxu4-current/02-patch-5.4.9-10.patch create mode 100644 patch/kernel/odroidxu4-current/03-patch-5.4.10-11.patch create mode 100644 patch/kernel/odroidxu4-current/7.patch create mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.164-165.patch create mode 100644 patch/kernel/rk3399-legacy/patch-4.4.208-209.patch create mode 100644 patch/kernel/rk3399-legacy/patch-4.4.209-210.patch create mode 100644 patch/kernel/rockchip-legacy/patch-4.4.209-210.patch create mode 100644 patch/kernel/sunxi-current/patch-5.4.11-12.patch diff --git a/patch/kernel/meson64-current/patch-5.4.1-2.patch b/patch/kernel/meson64-current/02-patch-5.4.1-2.patch similarity index 100% rename from patch/kernel/meson64-current/patch-5.4.1-2.patch rename to patch/kernel/meson64-current/02-patch-5.4.1-2.patch diff --git a/patch/kernel/meson64-current/patch-5.4.2-3.patch b/patch/kernel/meson64-current/02-patch-5.4.2-3.patch similarity index 100% rename from patch/kernel/meson64-current/patch-5.4.2-3.patch rename to patch/kernel/meson64-current/02-patch-5.4.2-3.patch diff --git a/patch/kernel/meson64-current/patch-5.4.3-4.patch b/patch/kernel/meson64-current/02-patch-5.4.3-4.patch similarity index 100% rename from patch/kernel/meson64-current/patch-5.4.3-4.patch rename to patch/kernel/meson64-current/02-patch-5.4.3-4.patch diff --git a/patch/kernel/meson64-current/patch-5.4.4-5.patch b/patch/kernel/meson64-current/02-patch-5.4.4-4.patch similarity index 100% rename from patch/kernel/meson64-current/patch-5.4.4-5.patch rename to patch/kernel/meson64-current/02-patch-5.4.4-4.patch diff --git a/patch/kernel/meson64-current/patch-5.4.5-6.patch b/patch/kernel/meson64-current/02-patch-5.4.5-6.patch similarity index 100% rename from patch/kernel/meson64-current/patch-5.4.5-6.patch rename to patch/kernel/meson64-current/02-patch-5.4.5-6.patch diff --git a/patch/kernel/meson64-current/02-patch-5.4.6-7.patch b/patch/kernel/meson64-current/02-patch-5.4.6-7.patch new file mode 100644 index 0000000000..ded5ffc184 --- /dev/null +++ b/patch/kernel/meson64-current/02-patch-5.4.6-7.patch @@ -0,0 +1,12219 @@ +diff --git a/Makefile b/Makefile +index 20ec7c20279e..0e2e0a034064 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 6 ++SUBLEVEL = 7 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +index d1eae47b83f6..82f7ae030600 100644 +--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi ++++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +@@ -160,12 +160,12 @@ + regulator-enable-ramp-delay = <1000>; + }; + +- /* Used by DSS */ ++ /* Used by DSS and is the "zerov_regulator" trigger for SoC off mode */ + vcsi: VCSI { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-enable-ramp-delay = <1000>; +- regulator-boot-on; ++ regulator-always-on; + }; + + vdac: VDAC { +diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c +index c9f72b2665f1..43ae4e0c968f 100644 +--- a/arch/arm64/kernel/psci.c ++++ b/arch/arm64/kernel/psci.c +@@ -81,7 +81,8 @@ static void cpu_psci_cpu_die(unsigned int cpu) + + static int cpu_psci_cpu_kill(unsigned int cpu) + { +- int err, i; ++ int err; ++ unsigned long start, end; + + if (!psci_ops.affinity_info) + return 0; +@@ -91,16 +92,18 @@ static int cpu_psci_cpu_kill(unsigned int cpu) + * while it is dying. So, try again a few times. + */ + +- for (i = 0; i < 10; i++) { ++ start = jiffies; ++ end = start + msecs_to_jiffies(100); ++ do { + err = psci_ops.affinity_info(cpu_logical_map(cpu), 0); + if (err == PSCI_0_2_AFFINITY_LEVEL_OFF) { +- pr_info("CPU%d killed.\n", cpu); ++ pr_info("CPU%d killed (polled %d ms)\n", cpu, ++ jiffies_to_msecs(jiffies - start)); + return 0; + } + +- msleep(10); +- pr_info("Retrying again to check for CPU kill\n"); +- } ++ usleep_range(100, 1000); ++ } while (time_before(jiffies, end)); + + pr_warn("CPU%d may not have shut down cleanly (AFFINITY_INFO reports %d)\n", + cpu, err); +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index 46822afc57e0..01a515e0171e 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -2360,8 +2360,11 @@ static const struct sys_reg_desc *index_to_sys_reg_desc(struct kvm_vcpu *vcpu, + if ((id & KVM_REG_ARM_COPROC_MASK) != KVM_REG_ARM64_SYSREG) + return NULL; + ++ if (!index_to_params(id, ¶ms)) ++ return NULL; ++ + table = get_target_table(vcpu->arch.target, true, &num); +- r = find_reg_by_id(id, ¶ms, table, num); ++ r = find_reg(¶ms, table, num); + if (!r) + r = find_reg(¶ms, sys_reg_descs, ARRAY_SIZE(sys_reg_descs)); + +diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h +index 9228f7386220..fb842965d541 100644 +--- a/arch/mips/include/asm/barrier.h ++++ b/arch/mips/include/asm/barrier.h +@@ -218,13 +218,14 @@ + * ordering will be done by smp_llsc_mb() and friends. + */ + #if defined(CONFIG_WEAK_REORDERING_BEYOND_LLSC) && defined(CONFIG_SMP) +-#define __WEAK_LLSC_MB " sync \n" +-#define smp_llsc_mb() __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory") +-#define __LLSC_CLOBBER ++# define __WEAK_LLSC_MB sync ++# define smp_llsc_mb() \ ++ __asm__ __volatile__(__stringify(__WEAK_LLSC_MB) : : :"memory") ++# define __LLSC_CLOBBER + #else +-#define __WEAK_LLSC_MB " \n" +-#define smp_llsc_mb() do { } while (0) +-#define __LLSC_CLOBBER "memory" ++# define __WEAK_LLSC_MB ++# define smp_llsc_mb() do { } while (0) ++# define __LLSC_CLOBBER "memory" + #endif + + #ifdef CONFIG_CPU_CAVIUM_OCTEON +diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h +index b83b0397462d..110220705e97 100644 +--- a/arch/mips/include/asm/futex.h ++++ b/arch/mips/include/asm/futex.h +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + + #define __futex_atomic_op(insn, ret, oldval, uaddr, oparg) \ +@@ -32,7 +33,7 @@ + " .set arch=r4000 \n" \ + "2: sc $1, %2 \n" \ + " beqzl $1, 1b \n" \ +- __WEAK_LLSC_MB \ ++ __stringify(__WEAK_LLSC_MB) " \n" \ + "3: \n" \ + " .insn \n" \ + " .set pop \n" \ +@@ -50,19 +51,19 @@ + "i" (-EFAULT) \ + : "memory"); \ + } else if (cpu_has_llsc) { \ +- loongson_llsc_mb(); \ + __asm__ __volatile__( \ + " .set push \n" \ + " .set noat \n" \ + " .set push \n" \ + " .set "MIPS_ISA_ARCH_LEVEL" \n" \ ++ " " __SYNC(full, loongson3_war) " \n" \ + "1: "user_ll("%1", "%4")" # __futex_atomic_op\n" \ + " .set pop \n" \ + " " insn " \n" \ + " .set "MIPS_ISA_ARCH_LEVEL" \n" \ + "2: "user_sc("$1", "%2")" \n" \ + " beqz $1, 1b \n" \ +- __WEAK_LLSC_MB \ ++ __stringify(__WEAK_LLSC_MB) " \n" \ + "3: \n" \ + " .insn \n" \ + " .set pop \n" \ +@@ -147,7 +148,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + " .set arch=r4000 \n" + "2: sc $1, %2 \n" + " beqzl $1, 1b \n" +- __WEAK_LLSC_MB ++ __stringify(__WEAK_LLSC_MB) " \n" + "3: \n" + " .insn \n" + " .set pop \n" +@@ -164,13 +165,13 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + "i" (-EFAULT) + : "memory"); + } else if (cpu_has_llsc) { +- loongson_llsc_mb(); + __asm__ __volatile__( + "# futex_atomic_cmpxchg_inatomic \n" + " .set push \n" + " .set noat \n" + " .set push \n" + " .set "MIPS_ISA_ARCH_LEVEL" \n" ++ " " __SYNC(full, loongson3_war) " \n" + "1: "user_ll("%1", "%3")" \n" + " bne %1, %z4, 3f \n" + " .set pop \n" +@@ -178,8 +179,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + " .set "MIPS_ISA_ARCH_LEVEL" \n" + "2: "user_sc("$1", "%2")" \n" + " beqz $1, 1b \n" +- __WEAK_LLSC_MB +- "3: \n" ++ "3: " __SYNC_ELSE(full, loongson3_war, __WEAK_LLSC_MB) "\n" + " .insn \n" + " .set pop \n" + " .section .fixup,\"ax\" \n" +@@ -194,7 +194,6 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + : GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval), + "i" (-EFAULT) + : "memory"); +- loongson_llsc_mb(); + } else + return -ENOSYS; + +diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h +index 93a9dce31f25..813dfe5f45a5 100644 +--- a/arch/mips/include/asm/pgtable-64.h ++++ b/arch/mips/include/asm/pgtable-64.h +@@ -18,10 +18,12 @@ + #include + + #define __ARCH_USE_5LEVEL_HACK +-#if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48) ++#if CONFIG_PGTABLE_LEVELS == 2 + #include +-#elif !(defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_MIPS_VA_BITS_48)) ++#elif CONFIG_PGTABLE_LEVELS == 3 + #include ++#else ++#include + #endif + + /* +@@ -216,6 +218,9 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd) + return pgd_val(pgd); + } + ++#define pgd_phys(pgd) virt_to_phys((void *)pgd_val(pgd)) ++#define pgd_page(pgd) (pfn_to_page(pgd_phys(pgd) >> PAGE_SHIFT)) ++ + static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address) + { + return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(address); +diff --git a/arch/mips/ralink/Kconfig b/arch/mips/ralink/Kconfig +index 1434fa60f3db..94e9ce994494 100644 +--- a/arch/mips/ralink/Kconfig ++++ b/arch/mips/ralink/Kconfig +@@ -51,6 +51,7 @@ choice + select MIPS_GIC + select COMMON_CLK + select CLKSRC_MIPS_GIC ++ select HAVE_PCI if PCI_MT7621 + endchoice + + choice +diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h +index e9a960e28f3c..cac95a3f30c2 100644 +--- a/arch/powerpc/include/asm/spinlock.h ++++ b/arch/powerpc/include/asm/spinlock.h +@@ -36,10 +36,12 @@ + #endif + + #ifdef CONFIG_PPC_PSERIES ++DECLARE_STATIC_KEY_FALSE(shared_processor); ++ + #define vcpu_is_preempted vcpu_is_preempted + static inline bool vcpu_is_preempted(int cpu) + { +- if (!firmware_has_feature(FW_FEATURE_SPLPAR)) ++ if (!static_branch_unlikely(&shared_processor)) + return false; + return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1); + } +diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c +index 5645bc9cbc09..add67498c126 100644 +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -619,8 +619,6 @@ void __do_irq(struct pt_regs *regs) + + trace_irq_entry(regs); + +- check_stack_overflow(); +- + /* + * Query the platform PIC for the interrupt & ack it. + * +@@ -652,6 +650,8 @@ void do_IRQ(struct pt_regs *regs) + irqsp = hardirq_ctx[raw_smp_processor_id()]; + sirqsp = softirq_ctx[raw_smp_processor_id()]; + ++ check_stack_overflow(); ++ + /* Already there ? */ + if (unlikely(cursp == irqsp || cursp == sirqsp)) { + __do_irq(regs); +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +index 0496e66aaa56..c6fbbd29bd87 100644 +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -1117,7 +1117,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) + ld r7, VCPU_GPR(R7)(r4) + bne ret_to_ultra + +- lwz r0, VCPU_CR(r4) ++ ld r0, VCPU_CR(r4) + mtcr r0 + + ld r0, VCPU_GPR(R0)(r4) +@@ -1137,7 +1137,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) + * R3 = UV_RETURN + */ + ret_to_ultra: +- lwz r0, VCPU_CR(r4) ++ ld r0, VCPU_CR(r4) + mtcr r0 + + ld r0, VCPU_GPR(R3)(r4) +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 0a40201f315f..0c8421dd01ab 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -74,6 +74,9 @@ + #include "pseries.h" + #include "../../../../drivers/pci/pci.h" + ++DEFINE_STATIC_KEY_FALSE(shared_processor); ++EXPORT_SYMBOL_GPL(shared_processor); ++ + int CMO_PrPSP = -1; + int CMO_SecPSP = -1; + unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K); +@@ -758,6 +761,10 @@ static void __init pSeries_setup_arch(void) + + if (firmware_has_feature(FW_FEATURE_LPAR)) { + vpa_init(boot_cpuid); ++ ++ if (lppaca_shared_proc(get_lppaca())) ++ static_branch_enable(&shared_processor); ++ + ppc_md.power_save = pseries_lpar_idle; + ppc_md.enable_pmcs = pseries_lpar_enable_pmcs; + #ifdef CONFIG_PCI_IOV +diff --git a/arch/s390/crypto/sha_common.c b/arch/s390/crypto/sha_common.c +index d39e0f079217..686fe7aa192f 100644 +--- a/arch/s390/crypto/sha_common.c ++++ b/arch/s390/crypto/sha_common.c +@@ -74,14 +74,17 @@ int s390_sha_final(struct shash_desc *desc, u8 *out) + struct s390_sha_ctx *ctx = shash_desc_ctx(desc); + unsigned int bsize = crypto_shash_blocksize(desc->tfm); + u64 bits; +- unsigned int n, mbl_offset; ++ unsigned int n; ++ int mbl_offset; + + n = ctx->count % bsize; + bits = ctx->count * 8; +- mbl_offset = s390_crypto_shash_parmsize(ctx->func) / sizeof(u32); ++ mbl_offset = s390_crypto_shash_parmsize(ctx->func); + if (mbl_offset < 0) + return -EINVAL; + ++ mbl_offset = mbl_offset / sizeof(u32); ++ + /* set total msg bit length (mbl) in CPACF parmblock */ + switch (ctx->func) { + case CPACF_KLMD_SHA_1: +diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h +index bccb8f4a63e2..77606c4acd58 100644 +--- a/arch/s390/include/asm/pgalloc.h ++++ b/arch/s390/include/asm/pgalloc.h +@@ -56,7 +56,12 @@ static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION2_ENTRY_EMPTY); + return (p4d_t *) table; + } +-#define p4d_free(mm, p4d) crst_table_free(mm, (unsigned long *) p4d) ++ ++static inline void p4d_free(struct mm_struct *mm, p4d_t *p4d) ++{ ++ if (!mm_p4d_folded(mm)) ++ crst_table_free(mm, (unsigned long *) p4d); ++} + + static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + { +@@ -65,7 +70,12 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION3_ENTRY_EMPTY); + return (pud_t *) table; + } +-#define pud_free(mm, pud) crst_table_free(mm, (unsigned long *) pud) ++ ++static inline void pud_free(struct mm_struct *mm, pud_t *pud) ++{ ++ if (!mm_pud_folded(mm)) ++ crst_table_free(mm, (unsigned long *) pud); ++} + + static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + { +@@ -83,6 +93,8 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + + static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd) + { ++ if (mm_pmd_folded(mm)) ++ return; + pgtable_pmd_page_dtor(virt_to_page(pmd)); + crst_table_free(mm, (unsigned long *) pmd); + } +diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h +index 64539c221672..2dc9eb4e1acc 100644 +--- a/arch/s390/include/asm/timex.h ++++ b/arch/s390/include/asm/timex.h +@@ -10,8 +10,9 @@ + #ifndef _ASM_S390_TIMEX_H + #define _ASM_S390_TIMEX_H + +-#include ++#include + #include ++#include + + /* The value of the TOD clock for 1.1.1970. */ + #define TOD_UNIX_EPOCH 0x7d91048bca000000ULL +@@ -186,15 +187,18 @@ extern unsigned char tod_clock_base[16] __aligned(8); + /** + * get_clock_monotonic - returns current time in clock rate units + * +- * The caller must ensure that preemption is disabled. + * The clock and tod_clock_base get changed via stop_machine. +- * Therefore preemption must be disabled when calling this +- * function, otherwise the returned value is not guaranteed to +- * be monotonic. ++ * Therefore preemption must be disabled, otherwise the returned ++ * value is not guaranteed to be monotonic. + */ + static inline unsigned long long get_tod_clock_monotonic(void) + { +- return get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ unsigned long long tod; ++ ++ preempt_disable_notrace(); ++ tod = get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ preempt_enable_notrace(); ++ return tod; + } + + /** +diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c +index 7abe6ae261b4..f304802ecf7b 100644 +--- a/arch/s390/kernel/dis.c ++++ b/arch/s390/kernel/dis.c +@@ -461,10 +461,11 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr) + ptr += sprintf(ptr, "%%c%i", value); + else if (operand->flags & OPERAND_VR) + ptr += sprintf(ptr, "%%v%i", value); +- else if (operand->flags & OPERAND_PCREL) +- ptr += sprintf(ptr, "%lx", (signed int) value +- + addr); +- else if (operand->flags & OPERAND_SIGNED) ++ else if (operand->flags & OPERAND_PCREL) { ++ void *pcrel = (void *)((int)value + addr); ++ ++ ptr += sprintf(ptr, "%px", pcrel); ++ } else if (operand->flags & OPERAND_SIGNED) + ptr += sprintf(ptr, "%i", value); + else + ptr += sprintf(ptr, "%u", value); +@@ -536,7 +537,7 @@ void show_code(struct pt_regs *regs) + else + *ptr++ = ' '; + addr = regs->psw.addr + start - 32; +- ptr += sprintf(ptr, "%016lx: ", addr); ++ ptr += sprintf(ptr, "%px: ", (void *)addr); + if (start + opsize >= end) + break; + for (i = 0; i < opsize; i++) +@@ -564,7 +565,7 @@ void print_fn_code(unsigned char *code, unsigned long len) + opsize = insn_length(*code); + if (opsize > len) + break; +- ptr += sprintf(ptr, "%p: ", code); ++ ptr += sprintf(ptr, "%px: ", code); + for (i = 0; i < opsize; i++) + ptr += sprintf(ptr, "%02x", code[i]); + *ptr++ = '\t'; +diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c +index 48d48b6187c0..0eb1d1cc53a8 100644 +--- a/arch/s390/kernel/perf_cpum_cf.c ++++ b/arch/s390/kernel/perf_cpum_cf.c +@@ -199,7 +199,7 @@ static const int cpumf_generic_events_user[] = { + [PERF_COUNT_HW_BUS_CYCLES] = -1, + }; + +-static int __hw_perf_event_init(struct perf_event *event) ++static int __hw_perf_event_init(struct perf_event *event, unsigned int type) + { + struct perf_event_attr *attr = &event->attr; + struct hw_perf_event *hwc = &event->hw; +@@ -207,7 +207,7 @@ static int __hw_perf_event_init(struct perf_event *event) + int err = 0; + u64 ev; + +- switch (attr->type) { ++ switch (type) { + case PERF_TYPE_RAW: + /* Raw events are used to access counters directly, + * hence do not permit excludes */ +@@ -294,17 +294,16 @@ static int __hw_perf_event_init(struct perf_event *event) + + static int cpumf_pmu_event_init(struct perf_event *event) + { ++ unsigned int type = event->attr.type; + int err; + +- switch (event->attr.type) { +- case PERF_TYPE_HARDWARE: +- case PERF_TYPE_HW_CACHE: +- case PERF_TYPE_RAW: +- err = __hw_perf_event_init(event); +- break; +- default: ++ if (type == PERF_TYPE_HARDWARE || type == PERF_TYPE_RAW) ++ err = __hw_perf_event_init(event, type); ++ else if (event->pmu->type == type) ++ /* Registered as unknown PMU */ ++ err = __hw_perf_event_init(event, PERF_TYPE_RAW); ++ else + return -ENOENT; +- } + + if (unlikely(err) && event->destroy) + event->destroy(event); +@@ -553,7 +552,7 @@ static int __init cpumf_pmu_init(void) + return -ENODEV; + + cpumf_pmu.attr_groups = cpumf_cf_event_group(); +- rc = perf_pmu_register(&cpumf_pmu, "cpum_cf", PERF_TYPE_RAW); ++ rc = perf_pmu_register(&cpumf_pmu, "cpum_cf", -1); + if (rc) + pr_err("Registering the cpum_cf PMU failed with rc=%i\n", rc); + return rc; +diff --git a/arch/s390/kernel/perf_cpum_cf_diag.c b/arch/s390/kernel/perf_cpum_cf_diag.c +index 2654e348801a..e949ab832ed7 100644 +--- a/arch/s390/kernel/perf_cpum_cf_diag.c ++++ b/arch/s390/kernel/perf_cpum_cf_diag.c +@@ -243,13 +243,13 @@ static int cf_diag_event_init(struct perf_event *event) + int err = -ENOENT; + + debug_sprintf_event(cf_diag_dbg, 5, +- "%s event %p cpu %d config %#llx " ++ "%s event %p cpu %d config %#llx type:%u " + "sample_type %#llx cf_diag_events %d\n", __func__, +- event, event->cpu, attr->config, attr->sample_type, +- atomic_read(&cf_diag_events)); ++ event, event->cpu, attr->config, event->pmu->type, ++ attr->sample_type, atomic_read(&cf_diag_events)); + + if (event->attr.config != PERF_EVENT_CPUM_CF_DIAG || +- event->attr.type != PERF_TYPE_RAW) ++ event->attr.type != event->pmu->type) + goto out; + + /* Raw events are used to access counters directly, +@@ -693,7 +693,7 @@ static int __init cf_diag_init(void) + } + debug_register_view(cf_diag_dbg, &debug_sprintf_view); + +- rc = perf_pmu_register(&cf_diag, "cpum_cf_diag", PERF_TYPE_RAW); ++ rc = perf_pmu_register(&cf_diag, "cpum_cf_diag", -1); + if (rc) { + debug_unregister_view(cf_diag_dbg, &debug_sprintf_view); + debug_unregister(cf_diag_dbg); +diff --git a/arch/s390/kernel/perf_event.c b/arch/s390/kernel/perf_event.c +index fcb6c2e92b07..1e75cc983546 100644 +--- a/arch/s390/kernel/perf_event.c ++++ b/arch/s390/kernel/perf_event.c +@@ -224,9 +224,13 @@ void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, + struct pt_regs *regs) + { + struct unwind_state state; ++ unsigned long addr; + +- unwind_for_each_frame(&state, current, regs, 0) +- perf_callchain_store(entry, state.ip); ++ unwind_for_each_frame(&state, current, regs, 0) { ++ addr = unwind_get_return_address(&state); ++ if (!addr || perf_callchain_store(entry, addr)) ++ return; ++ } + } + + /* Perf definitions for PMU event attributes in sysfs */ +diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c +index 1864a8bb9622..59ad7997fed1 100644 +--- a/arch/s390/mm/maccess.c ++++ b/arch/s390/mm/maccess.c +@@ -70,7 +70,7 @@ void notrace s390_kernel_write(void *dst, const void *src, size_t size) + spin_unlock_irqrestore(&s390_kernel_write_lock, flags); + } + +-static int __memcpy_real(void *dest, void *src, size_t count) ++static int __no_sanitize_address __memcpy_real(void *dest, void *src, size_t count) + { + register unsigned long _dest asm("2") = (unsigned long) dest; + register unsigned long _len1 asm("3") = (unsigned long) count; +@@ -91,19 +91,23 @@ static int __memcpy_real(void *dest, void *src, size_t count) + return rc; + } + +-static unsigned long _memcpy_real(unsigned long dest, unsigned long src, +- unsigned long count) ++static unsigned long __no_sanitize_address _memcpy_real(unsigned long dest, ++ unsigned long src, ++ unsigned long count) + { + int irqs_disabled, rc; + unsigned long flags; + + if (!count) + return 0; +- flags = __arch_local_irq_stnsm(0xf8UL); ++ flags = arch_local_irq_save(); + irqs_disabled = arch_irqs_disabled_flags(flags); + if (!irqs_disabled) + trace_hardirqs_off(); ++ __arch_local_irq_stnsm(0xf8); // disable DAT + rc = __memcpy_real((void *) dest, (void *) src, (size_t) count); ++ if (flags & PSW_MASK_DAT) ++ __arch_local_irq_stosm(0x04); // enable DAT + if (!irqs_disabled) + trace_hardirqs_on(); + __arch_local_irq_ssm(flags); +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index ce88211b9c6c..c8c16b5eed6b 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1369,7 +1370,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + } + + memset(&jit, 0, sizeof(jit)); +- jit.addrs = kcalloc(fp->len + 1, sizeof(*jit.addrs), GFP_KERNEL); ++ jit.addrs = kvcalloc(fp->len + 1, sizeof(*jit.addrs), GFP_KERNEL); + if (jit.addrs == NULL) { + fp = orig_fp; + goto out; +@@ -1422,7 +1423,7 @@ skip_init_ctx: + if (!fp->is_func || extra_pass) { + bpf_prog_fill_jited_linfo(fp, jit.addrs + 1); + free_addrs: +- kfree(jit.addrs); ++ kvfree(jit.addrs); + kfree(jit_data); + fp->aux->jit_data = NULL; + } +diff --git a/arch/sh/include/cpu-sh4/cpu/sh7734.h b/arch/sh/include/cpu-sh4/cpu/sh7734.h +index 96f0246ad2f2..82b63208135a 100644 +--- a/arch/sh/include/cpu-sh4/cpu/sh7734.h ++++ b/arch/sh/include/cpu-sh4/cpu/sh7734.h +@@ -134,7 +134,7 @@ enum { + GPIO_FN_EX_WAIT1, GPIO_FN_SD1_DAT0_A, GPIO_FN_DREQ2, GPIO_FN_CAN1_TX_C, + GPIO_FN_ET0_LINK_C, GPIO_FN_ET0_ETXD5_A, + GPIO_FN_EX_WAIT0, GPIO_FN_TCLK1_B, +- GPIO_FN_RD_WR, GPIO_FN_TCLK0, ++ GPIO_FN_RD_WR, GPIO_FN_TCLK0, GPIO_FN_CAN_CLK_B, GPIO_FN_ET0_ETXD4, + GPIO_FN_EX_CS5, GPIO_FN_SD1_CMD_A, GPIO_FN_ATADIR, GPIO_FN_QSSL_B, + GPIO_FN_ET0_ETXD3_A, + GPIO_FN_EX_CS4, GPIO_FN_SD1_WP_A, GPIO_FN_ATAWR, GPIO_FN_QMI_QIO1_B, +diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h +index 0acf5ee45a21..ef5638f641f2 100644 +--- a/arch/x86/include/asm/crash.h ++++ b/arch/x86/include/asm/crash.h +@@ -2,6 +2,8 @@ + #ifndef _ASM_X86_CRASH_H + #define _ASM_X86_CRASH_H + ++struct kimage; ++ + int crash_load_segments(struct kimage *image); + int crash_copy_backup_region(struct kimage *image); + int crash_setup_memmap_entries(struct kimage *image, +diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h +index 0c47aa82e2e2..28183ee3cc42 100644 +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -156,7 +156,7 @@ extern pte_t *kmap_pte; + extern pte_t *pkmap_page_table; + + void __native_set_fixmap(enum fixed_addresses idx, pte_t pte); +-void native_set_fixmap(enum fixed_addresses idx, ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, + phys_addr_t phys, pgprot_t flags); + + #ifndef CONFIG_PARAVIRT_XXL +diff --git a/arch/x86/include/asm/syscall_wrapper.h b/arch/x86/include/asm/syscall_wrapper.h +index e046a405743d..90eb70df0b18 100644 +--- a/arch/x86/include/asm/syscall_wrapper.h ++++ b/arch/x86/include/asm/syscall_wrapper.h +@@ -48,12 +48,13 @@ + * To keep the naming coherent, re-define SYSCALL_DEFINE0 to create an alias + * named __ia32_sys_*() + */ +-#define SYSCALL_DEFINE0(sname) \ +- SYSCALL_METADATA(_##sname, 0); \ +- asmlinkage long __x64_sys_##sname(void); \ +- ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ +- SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname); \ +- asmlinkage long __x64_sys_##sname(void) ++ ++#define SYSCALL_DEFINE0(sname) \ ++ SYSCALL_METADATA(_##sname, 0); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\ ++ ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ ++ SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused) + + #define COND_SYSCALL(name) \ + cond_syscall(__x64_sys_##name); \ +@@ -181,11 +182,11 @@ + * macros to work correctly. + */ + #ifndef SYSCALL_DEFINE0 +-#define SYSCALL_DEFINE0(sname) \ +- SYSCALL_METADATA(_##sname, 0); \ +- asmlinkage long __x64_sys_##sname(void); \ +- ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ +- asmlinkage long __x64_sys_##sname(void) ++#define SYSCALL_DEFINE0(sname) \ ++ SYSCALL_METADATA(_##sname, 0); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\ ++ ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused) + #endif + + #ifndef COND_SYSCALL +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index d6af97fd170a..f0262cb5657a 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -1727,9 +1727,10 @@ static bool io_apic_level_ack_pending(struct mp_chip_data *data) + + static inline bool ioapic_irqd_mask(struct irq_data *data) + { +- /* If we are moving the irq we need to mask it */ ++ /* If we are moving the IRQ we need to mask it */ + if (unlikely(irqd_is_setaffinity_pending(data))) { +- mask_ioapic_irq(data); ++ if (!irqd_irq_masked(data)) ++ mask_ioapic_irq(data); + return true; + } + return false; +@@ -1766,7 +1767,9 @@ static inline void ioapic_irqd_unmask(struct irq_data *data, bool masked) + */ + if (!io_apic_level_ack_pending(data->chip_data)) + irq_move_masked_irq(data); +- unmask_ioapic_irq(data); ++ /* If the IRQ is masked in the core, leave it: */ ++ if (!irqd_irq_masked(data)) ++ unmask_ioapic_irq(data); + } + } + #else +diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c +index 6ea7fdc82f3c..259f3f4e2e5f 100644 +--- a/arch/x86/kernel/cpu/mce/amd.c ++++ b/arch/x86/kernel/cpu/mce/amd.c +@@ -266,10 +266,10 @@ static void smca_configure(unsigned int bank, unsigned int cpu) + smca_set_misc_banks_map(bank, cpu); + + /* Return early if this bank was already initialized. */ +- if (smca_banks[bank].hwid) ++ if (smca_banks[bank].hwid && smca_banks[bank].hwid->hwid_mcatype != 0) + return; + +- if (rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { ++ if (rdmsr_safe(MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { + pr_warn("Failed to read MCA_IPID for bank %d\n", bank); + return; + } +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index 743370ee4983..aecb15ba66cd 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -814,8 +814,8 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp, + if (quirk_no_way_out) + quirk_no_way_out(i, m, regs); + ++ m->bank = i; + if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) { +- m->bank = i; + mce_read_aux(m, i); + *msg = tmp; + return 1; +diff --git a/arch/x86/kernel/cpu/mce/therm_throt.c b/arch/x86/kernel/cpu/mce/therm_throt.c +index 6e2becf547c5..bc441d68d060 100644 +--- a/arch/x86/kernel/cpu/mce/therm_throt.c ++++ b/arch/x86/kernel/cpu/mce/therm_throt.c +@@ -188,7 +188,7 @@ static void therm_throt_process(bool new_event, int event, int level) + /* if we just entered the thermal event */ + if (new_event) { + if (event == THERMAL_THROTTLING_EVENT) +- pr_crit("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", ++ pr_warn("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", + this_cpu, + level == CORE_LEVEL ? "Core" : "Package", + state->count); +diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c +index 4cba91ec8049..606711f5ebf8 100644 +--- a/arch/x86/kernel/early-quirks.c ++++ b/arch/x86/kernel/early-quirks.c +@@ -710,6 +710,8 @@ static struct chipset early_qrk[] __initdata = { + */ + { PCI_VENDOR_ID_INTEL, 0x0f00, + PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, ++ { PCI_VENDOR_ID_INTEL, 0x3e20, ++ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, + { PCI_VENDOR_ID_INTEL, 0x3ec4, + PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, + { PCI_VENDOR_ID_BROADCOM, 0x4331, +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 53dbcca9af09..b1d5a8c94a57 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -402,7 +402,8 @@ static inline void do_cpuid_7_mask(struct kvm_cpuid_entry2 *entry, int index) + entry->edx |= F(SPEC_CTRL); + if (boot_cpu_has(X86_FEATURE_STIBP)) + entry->edx |= F(INTEL_STIBP); +- if (boot_cpu_has(X86_FEATURE_SSBD)) ++ if (boot_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) || ++ boot_cpu_has(X86_FEATURE_AMD_SSBD)) + entry->edx |= F(SPEC_CTRL_SSBD); + /* + * We emulate ARCH_CAPABILITIES in software even +@@ -759,7 +760,8 @@ static inline int __do_cpuid_func(struct kvm_cpuid_entry2 *entry, u32 function, + entry->ebx |= F(AMD_IBRS); + if (boot_cpu_has(X86_FEATURE_STIBP)) + entry->ebx |= F(AMD_STIBP); +- if (boot_cpu_has(X86_FEATURE_SSBD)) ++ if (boot_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) || ++ boot_cpu_has(X86_FEATURE_AMD_SSBD)) + entry->ebx |= F(AMD_SSBD); + if (!boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS)) + entry->ebx |= F(AMD_SSB_NO); +diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/arch/x86/lib/x86-opcode-map.txt ++++ b/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +diff --git a/arch/x86/math-emu/fpu_system.h b/arch/x86/math-emu/fpu_system.h +index f98a0c956764..9b41391867dc 100644 +--- a/arch/x86/math-emu/fpu_system.h ++++ b/arch/x86/math-emu/fpu_system.h +@@ -107,6 +107,8 @@ static inline bool seg_writable(struct desc_struct *d) + #define FPU_access_ok(y,z) if ( !access_ok(y,z) ) \ + math_abort(FPU_info,SIGSEGV) + #define FPU_abort math_abort(FPU_info, SIGSEGV) ++#define FPU_copy_from_user(to, from, n) \ ++ do { if (copy_from_user(to, from, n)) FPU_abort; } while (0) + + #undef FPU_IGNORE_CODE_SEGV + #ifdef FPU_IGNORE_CODE_SEGV +@@ -122,7 +124,7 @@ static inline bool seg_writable(struct desc_struct *d) + #define FPU_code_access_ok(z) FPU_access_ok((void __user *)FPU_EIP,z) + #endif + +-#define FPU_get_user(x,y) get_user((x),(y)) +-#define FPU_put_user(x,y) put_user((x),(y)) ++#define FPU_get_user(x,y) do { if (get_user((x),(y))) FPU_abort; } while (0) ++#define FPU_put_user(x,y) do { if (put_user((x),(y))) FPU_abort; } while (0) + + #endif +diff --git a/arch/x86/math-emu/reg_ld_str.c b/arch/x86/math-emu/reg_ld_str.c +index f3779743d15e..fe6246ff9887 100644 +--- a/arch/x86/math-emu/reg_ld_str.c ++++ b/arch/x86/math-emu/reg_ld_str.c +@@ -85,7 +85,7 @@ int FPU_load_extended(long double __user *s, int stnr) + + RE_ENTRANT_CHECK_OFF; + FPU_access_ok(s, 10); +- __copy_from_user(sti_ptr, s, 10); ++ FPU_copy_from_user(sti_ptr, s, 10); + RE_ENTRANT_CHECK_ON; + + return FPU_tagof(sti_ptr); +@@ -1126,9 +1126,9 @@ void frstor(fpu_addr_modes addr_modes, u_char __user *data_address) + /* Copy all registers in stack order. */ + RE_ENTRANT_CHECK_OFF; + FPU_access_ok(s, 80); +- __copy_from_user(register_base + offset, s, other); ++ FPU_copy_from_user(register_base + offset, s, other); + if (offset) +- __copy_from_user(register_base, s + other, offset); ++ FPU_copy_from_user(register_base, s + other, offset); + RE_ENTRANT_CHECK_ON; + + for (i = 0; i < 8; i++) { +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index 3e4b9035bb9a..7bd2c3a52297 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -643,8 +643,8 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) + fixmaps_set++; + } + +-void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys, +- pgprot_t flags) ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, ++ phys_addr_t phys, pgprot_t flags) + { + /* Sanitize 'prot' against any unsupported bits: */ + pgprot_val(flags) &= __default_kernel_pte_mask; +diff --git a/block/blk-iocost.c b/block/blk-iocost.c +index e01267f99183..27ca68621137 100644 +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -1212,7 +1212,7 @@ static enum hrtimer_restart iocg_waitq_timer_fn(struct hrtimer *timer) + return HRTIMER_NORESTART; + } + +-static void iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now, u64 cost) ++static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now, u64 cost) + { + struct ioc *ioc = iocg->ioc; + struct blkcg_gq *blkg = iocg_to_blkg(iocg); +@@ -1229,11 +1229,11 @@ static void iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now, u64 cost) + /* clear or maintain depending on the overage */ + if (time_before_eq64(vtime, now->vnow)) { + blkcg_clear_delay(blkg); +- return; ++ return false; + } + if (!atomic_read(&blkg->use_delay) && + time_before_eq64(vtime, now->vnow + vmargin)) +- return; ++ return false; + + /* use delay */ + if (cost) { +@@ -1250,10 +1250,11 @@ static void iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now, u64 cost) + oexpires = ktime_to_ns(hrtimer_get_softexpires(&iocg->delay_timer)); + if (hrtimer_is_queued(&iocg->delay_timer) && + abs(oexpires - expires) <= margin_ns / 4) +- return; ++ return true; + + hrtimer_start_range_ns(&iocg->delay_timer, ns_to_ktime(expires), + margin_ns / 4, HRTIMER_MODE_ABS); ++ return true; + } + + static enum hrtimer_restart iocg_delay_timer_fn(struct hrtimer *timer) +@@ -1739,7 +1740,9 @@ static void ioc_rqos_throttle(struct rq_qos *rqos, struct bio *bio) + */ + if (bio_issue_as_root_blkg(bio) || fatal_signal_pending(current)) { + atomic64_add(abs_cost, &iocg->abs_vdebt); +- iocg_kick_delay(iocg, &now, cost); ++ if (iocg_kick_delay(iocg, &now, cost)) ++ blkcg_schedule_throttle(rqos->q, ++ (bio->bi_opf & REQ_SWAP) == REQ_SWAP); + return; + } + +diff --git a/crypto/Kconfig b/crypto/Kconfig +index 9e524044d312..29472fb795f3 100644 +--- a/crypto/Kconfig ++++ b/crypto/Kconfig +@@ -309,6 +309,7 @@ config CRYPTO_AEGIS128 + config CRYPTO_AEGIS128_SIMD + bool "Support SIMD acceleration for AEGIS-128" + depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON) ++ depends on !ARM || CC_IS_CLANG || GCC_VERSION >= 40800 + default y + + config CRYPTO_AEGIS128_AESNI_SSE2 +diff --git a/crypto/Makefile b/crypto/Makefile +index fcb1ee679782..aa740c8492b9 100644 +--- a/crypto/Makefile ++++ b/crypto/Makefile +@@ -93,7 +93,7 @@ obj-$(CONFIG_CRYPTO_AEGIS128) += aegis128.o + aegis128-y := aegis128-core.o + + ifeq ($(ARCH),arm) +-CFLAGS_aegis128-neon-inner.o += -ffreestanding -march=armv7-a -mfloat-abi=softfp ++CFLAGS_aegis128-neon-inner.o += -ffreestanding -march=armv8-a -mfloat-abi=softfp + CFLAGS_aegis128-neon-inner.o += -mfpu=crypto-neon-fp-armv8 + aegis128-$(CONFIG_CRYPTO_AEGIS128_SIMD) += aegis128-neon.o aegis128-neon-inner.o + endif +diff --git a/crypto/asymmetric_keys/asym_tpm.c b/crypto/asymmetric_keys/asym_tpm.c +index 76d2ce3a1b5b..5154e280ada2 100644 +--- a/crypto/asymmetric_keys/asym_tpm.c ++++ b/crypto/asymmetric_keys/asym_tpm.c +@@ -486,6 +486,7 @@ static int tpm_key_encrypt(struct tpm_key *tk, + if (ret < 0) + goto error_free_tfm; + ++ ret = -ENOMEM; + req = akcipher_request_alloc(tfm, GFP_KERNEL); + if (!req) + goto error_free_tfm; +diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c +index 364b9df9d631..d7f43d4ea925 100644 +--- a/crypto/asymmetric_keys/public_key.c ++++ b/crypto/asymmetric_keys/public_key.c +@@ -184,6 +184,7 @@ static int software_key_eds_op(struct kernel_pkey_params *params, + if (IS_ERR(tfm)) + return PTR_ERR(tfm); + ++ ret = -ENOMEM; + req = akcipher_request_alloc(tfm, GFP_KERNEL); + if (!req) + goto error_free_tfm; +diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c +index 4a2cde2c536a..ce93a355bd1c 100644 +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -78,6 +78,17 @@ static const struct dmi_system_id lid_blacklst[] = { + DMI_MATCH(DMI_BIOS_VERSION, "BYT70A.YNCHENG.WIN.007"), + }, + }, ++ { ++ /* ++ * Medion Akoya E2215T, notification of the LID device only ++ * happens on close, not on open and _LID always returns closed. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "E2215T MD60198"), ++ }, ++ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN, ++ }, + {} + }; + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 28c492be0a57..74c9b3032d46 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6708,6 +6708,9 @@ void ata_host_detach(struct ata_host *host) + { + int i; + ++ /* Ensure ata_port probe has completed */ ++ async_synchronize_full(); ++ + for (i = 0; i < host->n_ports; i++) + ata_port_detach(host->ports[i]); + +diff --git a/drivers/base/firmware_loader/builtin/Makefile b/drivers/base/firmware_loader/builtin/Makefile +index 37e5ae387400..4a66888e7253 100644 +--- a/drivers/base/firmware_loader/builtin/Makefile ++++ b/drivers/base/firmware_loader/builtin/Makefile +@@ -8,7 +8,8 @@ fwdir := $(addprefix $(srctree)/,$(filter-out /%,$(fwdir)))$(filter /%,$(fwdir)) + obj-y := $(addsuffix .gen.o, $(subst $(quote),,$(CONFIG_EXTRA_FIRMWARE))) + + FWNAME = $(patsubst $(obj)/%.gen.S,%,$@) +-FWSTR = $(subst /,_,$(subst .,_,$(subst -,_,$(FWNAME)))) ++comma := , ++FWSTR = $(subst $(comma),_,$(subst /,_,$(subst .,_,$(subst -,_,$(FWNAME))))) + ASM_WORD = $(if $(CONFIG_64BIT),.quad,.long) + ASM_ALIGN = $(if $(CONFIG_64BIT),3,2) + PROGBITS = $(if $(CONFIG_ARM),%,@)progbits +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index f6f77eaa7217..ef6e251857c8 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -417,18 +417,20 @@ out_free_page: + return ret; + } + +-static int lo_discard(struct loop_device *lo, struct request *rq, loff_t pos) ++static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos, ++ int mode) + { + /* +- * We use punch hole to reclaim the free space used by the +- * image a.k.a. discard. However we do not support discard if +- * encryption is enabled, because it may give an attacker +- * useful information. ++ * We use fallocate to manipulate the space mappings used by the image ++ * a.k.a. discard/zerorange. However we do not support this if ++ * encryption is enabled, because it may give an attacker useful ++ * information. + */ + struct file *file = lo->lo_backing_file; +- int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE; + int ret; + ++ mode |= FALLOC_FL_KEEP_SIZE; ++ + if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) { + ret = -EOPNOTSUPP; + goto out; +@@ -596,9 +598,17 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq) + switch (req_op(rq)) { + case REQ_OP_FLUSH: + return lo_req_flush(lo, rq); +- case REQ_OP_DISCARD: + case REQ_OP_WRITE_ZEROES: +- return lo_discard(lo, rq, pos); ++ /* ++ * If the caller doesn't want deallocation, call zeroout to ++ * write zeroes the range. Otherwise, punch them out. ++ */ ++ return lo_fallocate(lo, rq, pos, ++ (rq->cmd_flags & REQ_NOUNMAP) ? ++ FALLOC_FL_ZERO_RANGE : ++ FALLOC_FL_PUNCH_HOLE); ++ case REQ_OP_DISCARD: ++ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE); + case REQ_OP_WRITE: + if (lo->transfer) + return lo_write_transfer(lo, rq, pos); +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 57532465fb83..b4607dd96185 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1296,10 +1296,10 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b + mutex_unlock(&nbd->config_lock); + ret = wait_event_interruptible(config->recv_wq, + atomic_read(&config->recv_threads) == 0); +- if (ret) { ++ if (ret) + sock_shutdown(nbd); +- flush_workqueue(nbd->recv_workq); +- } ++ flush_workqueue(nbd->recv_workq); ++ + mutex_lock(&nbd->config_lock); + nbd_bdev_reset(bdev); + /* user requested, ignore socket errors */ +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index a9c35ebb30f8..23e606aaaea4 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3807,8 +3807,8 @@ static int btusb_probe(struct usb_interface *intf, + btusb_check_needs_reset_resume(intf); + } + +-#ifdef CONFIG_BT_HCIBTUSB_RTL +- if (id->driver_info & BTUSB_REALTEK) { ++ if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) && ++ (id->driver_info & BTUSB_REALTEK)) { + hdev->setup = btrtl_setup_realtek; + hdev->shutdown = btrtl_shutdown_realtek; + hdev->cmd_timeout = btusb_rtl_cmd_timeout; +@@ -3819,7 +3819,6 @@ static int btusb_probe(struct usb_interface *intf, + */ + set_bit(BTUSB_WAKEUP_DISABLE, &data->flags); + } +-#endif + + if (id->driver_info & BTUSB_AMP) { + /* AMP controllers do not support SCO packets */ +diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c +index 38b719017186..648e39ce6bd9 100644 +--- a/drivers/char/hw_random/omap3-rom-rng.c ++++ b/drivers/char/hw_random/omap3-rom-rng.c +@@ -121,7 +121,8 @@ static int omap3_rom_rng_remove(struct platform_device *pdev) + { + cancel_delayed_work_sync(&idle_work); + hwrng_unregister(&omap3_rom_rng_ops); +- clk_disable_unprepare(rng_clk); ++ if (!rng_idle) ++ clk_disable_unprepare(rng_clk); + return 0; + } + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 2aab80e19ae0..3c8a559506e8 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -448,6 +448,8 @@ enum ipmi_stat_indexes { + + #define IPMI_IPMB_NUM_SEQ 64 + struct ipmi_smi { ++ struct module *owner; ++ + /* What interface number are we? */ + int intf_num; + +@@ -1220,6 +1222,11 @@ int ipmi_create_user(unsigned int if_num, + if (rv) + goto out_kfree; + ++ if (!try_module_get(intf->owner)) { ++ rv = -ENODEV; ++ goto out_kfree; ++ } ++ + /* Note that each existing user holds a refcount to the interface. */ + kref_get(&intf->refcount); + +@@ -1349,6 +1356,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user) + } + + kref_put(&intf->refcount, intf_free); ++ module_put(intf->owner); + } + + int ipmi_destroy_user(struct ipmi_user *user) +@@ -2459,7 +2467,7 @@ static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc) + * been recently fetched, this will just use the cached data. Otherwise + * it will run a new fetch. + * +- * Except for the first time this is called (in ipmi_register_smi()), ++ * Except for the first time this is called (in ipmi_add_smi()), + * this will always return good data; + */ + static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, +@@ -3377,10 +3385,11 @@ static void redo_bmc_reg(struct work_struct *work) + kref_put(&intf->refcount, intf_free); + } + +-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, +- void *send_info, +- struct device *si_dev, +- unsigned char slave_addr) ++int ipmi_add_smi(struct module *owner, ++ const struct ipmi_smi_handlers *handlers, ++ void *send_info, ++ struct device *si_dev, ++ unsigned char slave_addr) + { + int i, j; + int rv; +@@ -3406,7 +3415,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, + return rv; + } + +- ++ intf->owner = owner; + intf->bmc = &intf->tmp_bmc; + INIT_LIST_HEAD(&intf->bmc->intfs); + mutex_init(&intf->bmc->dyn_mutex); +@@ -3514,7 +3523,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, + + return rv; + } +-EXPORT_SYMBOL(ipmi_register_smi); ++EXPORT_SYMBOL(ipmi_add_smi); + + static void deliver_smi_err_response(struct ipmi_smi *intf, + struct ipmi_smi_msg *msg, +diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c +index 2ec47a69a2a6..b23b0b999232 100644 +--- a/drivers/char/tpm/tpm-dev-common.c ++++ b/drivers/char/tpm/tpm-dev-common.c +@@ -61,6 +61,12 @@ static void tpm_dev_async_work(struct work_struct *work) + + mutex_lock(&priv->buffer_mutex); + priv->command_enqueued = false; ++ ret = tpm_try_get_ops(priv->chip); ++ if (ret) { ++ priv->response_length = ret; ++ goto out; ++ } ++ + ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, + sizeof(priv->data_buffer)); + tpm_put_ops(priv->chip); +@@ -68,6 +74,7 @@ static void tpm_dev_async_work(struct work_struct *work) + priv->response_length = ret; + mod_timer(&priv->user_read_timer, jiffies + (120 * HZ)); + } ++out: + mutex_unlock(&priv->buffer_mutex); + wake_up_interruptible(&priv->async_wait); + } +@@ -204,6 +211,7 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf, + if (file->f_flags & O_NONBLOCK) { + priv->command_enqueued = true; + queue_work(tpm_dev_wq, &priv->async_work); ++ tpm_put_ops(priv->chip); + mutex_unlock(&priv->buffer_mutex); + return size; + } +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 270f43acbb77..f528fc39ea6b 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -899,13 +899,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + + if (wait_startup(chip, 0) != 0) { + rc = -ENODEV; +- goto out_err; ++ goto err_start; + } + + /* Take control of the TPM's interrupt hardware and shut it off */ + rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask); + if (rc < 0) +- goto out_err; ++ goto err_start; + + intmask |= TPM_INTF_CMD_READY_INT | TPM_INTF_LOCALITY_CHANGE_INT | + TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; +@@ -914,21 +914,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + + rc = tpm_chip_start(chip); + if (rc) +- goto out_err; ++ goto err_start; ++ + rc = tpm2_probe(chip); +- tpm_chip_stop(chip); + if (rc) +- goto out_err; ++ goto err_probe; + + rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor); + if (rc < 0) +- goto out_err; ++ goto err_probe; + + priv->manufacturer_id = vendor; + + rc = tpm_tis_read8(priv, TPM_RID(0), &rid); + if (rc < 0) +- goto out_err; ++ goto err_probe; + + dev_info(dev, "%s TPM (device-id 0x%X, rev-id %d)\n", + (chip->flags & TPM_CHIP_FLAG_TPM2) ? "2.0" : "1.2", +@@ -937,13 +937,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + probe = probe_itpm(chip); + if (probe < 0) { + rc = -ENODEV; +- goto out_err; ++ goto err_probe; + } + + /* Figure out the capabilities */ + rc = tpm_tis_read32(priv, TPM_INTF_CAPS(priv->locality), &intfcaps); + if (rc < 0) +- goto out_err; ++ goto err_probe; + + dev_dbg(dev, "TPM interface capabilities (0x%x):\n", + intfcaps); +@@ -977,10 +977,9 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + if (tpm_get_timeouts(chip)) { + dev_err(dev, "Could not get TPM timeouts and durations\n"); + rc = -ENODEV; +- goto out_err; ++ goto err_probe; + } + +- tpm_chip_start(chip); + chip->flags |= TPM_CHIP_FLAG_IRQ; + if (irq) { + tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED, +@@ -991,18 +990,20 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + } else { + tpm_tis_probe_irq(chip, intmask); + } +- tpm_chip_stop(chip); + } + ++ tpm_chip_stop(chip); ++ + rc = tpm_chip_register(chip); + if (rc) +- goto out_err; +- +- if (chip->ops->clk_enable != NULL) +- chip->ops->clk_enable(chip, false); ++ goto err_start; + + return 0; +-out_err: ++ ++err_probe: ++ tpm_chip_stop(chip); ++ ++err_start: + if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL)) + chip->ops->clk_enable(chip, false); + +diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c +index 388bdb94f841..d3486ee79ab5 100644 +--- a/drivers/clk/imx/clk-composite-8m.c ++++ b/drivers/clk/imx/clk-composite-8m.c +@@ -142,6 +142,7 @@ struct clk *imx8m_clk_composite_flags(const char *name, + mux->reg = reg; + mux->shift = PCG_PCS_SHIFT; + mux->mask = PCG_PCS_MASK; ++ mux->lock = &imx_ccm_lock; + + div = kzalloc(sizeof(*div), GFP_KERNEL); + if (!div) +@@ -161,6 +162,7 @@ struct clk *imx8m_clk_composite_flags(const char *name, + gate_hw = &gate->hw; + gate->reg = reg; + gate->bit_idx = PCG_CGC_SHIFT; ++ gate->lock = &imx_ccm_lock; + + hw = clk_hw_register_composite(NULL, name, parent_names, num_parents, + mux_hw, &clk_mux_ops, div_hw, +diff --git a/drivers/clk/imx/clk-imx7ulp.c b/drivers/clk/imx/clk-imx7ulp.c +index 2022d9bead91..a0f650150367 100644 +--- a/drivers/clk/imx/clk-imx7ulp.c ++++ b/drivers/clk/imx/clk-imx7ulp.c +@@ -40,6 +40,7 @@ static const struct clk_div_table ulp_div_table[] = { + { .val = 5, .div = 16, }, + { .val = 6, .div = 32, }, + { .val = 7, .div = 64, }, ++ { /* sentinel */ }, + }; + + static const int pcc2_uart_clk_ids[] __initconst = { +diff --git a/drivers/clk/imx/clk-pll14xx.c b/drivers/clk/imx/clk-pll14xx.c +index 7a815ec76aa5..d43b4a3c0de8 100644 +--- a/drivers/clk/imx/clk-pll14xx.c ++++ b/drivers/clk/imx/clk-pll14xx.c +@@ -153,7 +153,7 @@ static int clk_pll14xx_wait_lock(struct clk_pll14xx *pll) + { + u32 val; + +- return readl_poll_timeout(pll->base, val, val & LOCK_TIMEOUT_US, 0, ++ return readl_poll_timeout(pll->base, val, val & LOCK_STATUS, 0, + LOCK_TIMEOUT_US); + } + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index bc19d6c16aaa..a7db4f22a077 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -2634,6 +2634,13 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) + if (cpufreq_disabled()) + return -ENODEV; + ++ /* ++ * The cpufreq core depends heavily on the availability of device ++ * structure, make sure they are available before proceeding further. ++ */ ++ if (!get_cpu_device(0)) ++ return -EPROBE_DEFER; ++ + if (!driver_data || !driver_data->verify || !driver_data->init || + !(driver_data->setpolicy || driver_data->target_index || + driver_data->target) || +diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +index eca32e443716..9907a165135b 100644 +--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c ++++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +@@ -25,7 +25,7 @@ + static struct platform_device *cpufreq_dt_pdev, *sun50i_cpufreq_pdev; + + /** +- * sun50i_cpufreq_get_efuse() - Parse and return efuse value present on SoC ++ * sun50i_cpufreq_get_efuse() - Determine speed grade from efuse value + * @versions: Set to the value parsed from efuse + * + * Returns 0 if success. +@@ -69,21 +69,16 @@ static int sun50i_cpufreq_get_efuse(u32 *versions) + return PTR_ERR(speedbin); + + efuse_value = (*speedbin >> NVMEM_SHIFT) & NVMEM_MASK; +- switch (efuse_value) { +- case 0b0001: +- *versions = 1; +- break; +- case 0b0011: +- *versions = 2; +- break; +- default: +- /* +- * For other situations, we treat it as bin0. +- * This vf table can be run for any good cpu. +- */ ++ ++ /* ++ * We treat unexpected efuse values as if the SoC was from ++ * the slowest bin. Expected efuse values are 1-3, slowest ++ * to fastest. ++ */ ++ if (efuse_value >= 1 && efuse_value <= 3) ++ *versions = efuse_value - 1; ++ else + *versions = 0; +- break; +- } + + kfree(speedbin); + return 0; +diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c +index 00920a2b95ce..db99cee1991c 100644 +--- a/drivers/crypto/atmel-aes.c ++++ b/drivers/crypto/atmel-aes.c +@@ -145,7 +145,7 @@ struct atmel_aes_xts_ctx { + u32 key2[AES_KEYSIZE_256 / sizeof(u32)]; + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + struct atmel_aes_authenc_ctx { + struct atmel_aes_base_ctx base; + struct atmel_sha_authenc_ctx *auth; +@@ -157,7 +157,7 @@ struct atmel_aes_reqctx { + u32 lastc[AES_BLOCK_SIZE / sizeof(u32)]; + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + struct atmel_aes_authenc_reqctx { + struct atmel_aes_reqctx base; + +@@ -486,7 +486,7 @@ static inline bool atmel_aes_is_encrypt(const struct atmel_aes_dev *dd) + return (dd->flags & AES_FLAGS_ENCRYPT); + } + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + static void atmel_aes_authenc_complete(struct atmel_aes_dev *dd, int err); + #endif + +@@ -515,7 +515,7 @@ static void atmel_aes_set_iv_as_last_ciphertext_block(struct atmel_aes_dev *dd) + + static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err) + { +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (dd->ctx->is_aead) + atmel_aes_authenc_complete(dd, err); + #endif +@@ -1980,7 +1980,7 @@ static struct crypto_alg aes_xts_alg = { + } + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + /* authenc aead functions */ + + static int atmel_aes_authenc_start(struct atmel_aes_dev *dd); +@@ -2467,7 +2467,7 @@ static void atmel_aes_unregister_algs(struct atmel_aes_dev *dd) + { + int i; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (dd->caps.has_authenc) + for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++) + crypto_unregister_aead(&aes_authenc_algs[i]); +@@ -2514,7 +2514,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd) + goto err_aes_xts_alg; + } + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (dd->caps.has_authenc) { + for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++) { + err = crypto_register_aead(&aes_authenc_algs[i]); +@@ -2526,7 +2526,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd) + + return 0; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + /* i = ARRAY_SIZE(aes_authenc_algs); */ + err_aes_authenc_alg: + for (j = 0; j < i; j++) +@@ -2716,7 +2716,7 @@ static int atmel_aes_probe(struct platform_device *pdev) + + atmel_aes_get_cap(aes_dd); + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (aes_dd->caps.has_authenc && !atmel_sha_authenc_is_ready()) { + err = -EPROBE_DEFER; + goto iclk_unprepare; +diff --git a/drivers/crypto/atmel-authenc.h b/drivers/crypto/atmel-authenc.h +index cbd37a2edada..d6de810df44f 100644 +--- a/drivers/crypto/atmel-authenc.h ++++ b/drivers/crypto/atmel-authenc.h +@@ -12,7 +12,7 @@ + #ifndef __ATMEL_AUTHENC_H__ + #define __ATMEL_AUTHENC_H__ + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + + #include + #include +diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c +index 84cb8748a795..d32626458e67 100644 +--- a/drivers/crypto/atmel-sha.c ++++ b/drivers/crypto/atmel-sha.c +@@ -2212,7 +2212,7 @@ static struct ahash_alg sha_hmac_algs[] = { + }, + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + /* authenc functions */ + + static int atmel_sha_authenc_init2(struct atmel_sha_dev *dd); +diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c +index 294debd435b6..991a4425f006 100644 +--- a/drivers/crypto/inside-secure/safexcel.c ++++ b/drivers/crypto/inside-secure/safexcel.c +@@ -1120,6 +1120,8 @@ static int safexcel_request_ring_irq(void *pdev, int irqid, + irq_name, irq); + return irq; + } ++ } else { ++ return -ENXIO; + } + + ret = devm_request_threaded_irq(dev, irq, handler, +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +index 6536fd4bee65..7e5e092a23b3 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +@@ -72,7 +72,8 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq) + oi = 0; + oo = 0; + do { +- todo = min3(rx_cnt, ileft, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo) { + ileft -= todo; + writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo); +@@ -87,7 +88,8 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq) + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); + +- todo = min3(tx_cnt, oleft, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + oleft -= todo; + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); +@@ -239,7 +241,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * todo is the number of consecutive 4byte word that we + * can read from current SG + */ +- todo = min3(rx_cnt, ileft / 4, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft / 4); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo && !ob) { + writesl(ss->base + SS_RXFIFO, mi.addr + oi, + todo); +@@ -253,8 +256,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * we need to be able to write all buf in one + * pass, so it is why we min() with rx_cnt + */ +- todo = min3(rx_cnt * 4 - ob, ileft, +- mi.length - oi); ++ todo = min(rx_cnt * 4 - ob, ileft); ++ todo = min_t(size_t, todo, mi.length - oi); + memcpy(buf + ob, mi.addr + oi, todo); + ileft -= todo; + oi += todo; +@@ -274,7 +277,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + spaces = readl(ss->base + SS_FCSR); + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); +- dev_dbg(ss->dev, "%x %u/%u %u/%u cnt=%u %u/%u %u/%u cnt=%u %u\n", ++ dev_dbg(ss->dev, ++ "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n", + mode, + oi, mi.length, ileft, areq->cryptlen, rx_cnt, + oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob); +@@ -282,7 +286,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + if (!tx_cnt) + continue; + /* todo in 4bytes word */ +- todo = min3(tx_cnt, oleft / 4, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft / 4); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); + oleft -= todo * 4; +@@ -308,7 +313,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * no more than remaining buffer + * no need to test against oleft + */ +- todo = min(mo.length - oo, obl - obo); ++ todo = min_t(size_t, ++ mo.length - oo, obl - obo); + memcpy(mo.addr + oo, bufo + obo, todo); + oleft -= todo; + obo += todo; +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +index fcffba5ef927..1369c5fa3087 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +@@ -272,8 +272,8 @@ static int sun4i_hash(struct ahash_request *areq) + */ + while (op->len < 64 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, end - i, +- 64 - op->len); ++ in_r = min(end - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +@@ -293,8 +293,8 @@ static int sun4i_hash(struct ahash_request *areq) + } + if (mi.length - in_i > 3 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- ((mi.length - in_i) / 4) * 4); ++ in_r = min_t(size_t, mi.length - in_i, areq->nbytes - i); ++ in_r = min_t(size_t, ((mi.length - in_i) / 4) * 4, in_r); + /* how many bytes we can write in the device*/ + todo = min3((u32)(end - i) / 4, rx_cnt, (u32)in_r / 4); + writesl(ss->base + SS_RXFIFO, mi.addr + in_i, todo); +@@ -320,8 +320,8 @@ static int sun4i_hash(struct ahash_request *areq) + if ((areq->nbytes - i) < 64) { + while (i < areq->nbytes && in_i < mi.length && op->len < 64) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- 64 - op->len); ++ in_r = min(areq->nbytes - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c +index 42d19205166b..673fb29fda53 100644 +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -105,8 +105,6 @@ virtio_crypto_alg_validate_key(int key_len, uint32_t *alg) + *alg = VIRTIO_CRYPTO_CIPHER_AES_CBC; + break; + default: +- pr_err("virtio_crypto: Unsupported key length: %d\n", +- key_len); + return -EINVAL; + } + return 0; +@@ -484,6 +482,11 @@ static int virtio_crypto_ablkcipher_encrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +@@ -504,6 +507,11 @@ static int virtio_crypto_ablkcipher_decrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +diff --git a/drivers/crypto/vmx/Makefile b/drivers/crypto/vmx/Makefile +index cab32cfec9c4..709670d2b553 100644 +--- a/drivers/crypto/vmx/Makefile ++++ b/drivers/crypto/vmx/Makefile +@@ -3,13 +3,13 @@ obj-$(CONFIG_CRYPTO_DEV_VMX_ENCRYPT) += vmx-crypto.o + vmx-crypto-objs := vmx.o aesp8-ppc.o ghashp8-ppc.o aes.o aes_cbc.o aes_ctr.o aes_xts.o ghash.o + + ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) +-TARGET := linux-ppc64le ++override flavour := linux-ppc64le + else +-TARGET := linux-ppc64 ++override flavour := linux-ppc64 + endif + + quiet_cmd_perl = PERL $@ +- cmd_perl = $(PERL) $(<) $(TARGET) > $(@) ++ cmd_perl = $(PERL) $(<) $(flavour) > $(@) + + targets += aesp8-ppc.S ghashp8-ppc.S + +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index c1d4536ae466..cc5e56d752c8 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -2936,6 +2936,7 @@ static int init_csrows_df(struct mem_ctl_info *mci) + dimm->mtype = pvt->dram_type; + dimm->edac_mode = edac_mode; + dimm->dtype = dev_type; ++ dimm->grain = 64; + } + } + +@@ -3012,6 +3013,7 @@ static int init_csrows(struct mem_ctl_info *mci) + dimm = csrow->channels[j]->dimm; + dimm->mtype = pvt->dram_type; + dimm->edac_mode = edac_mode; ++ dimm->grain = 64; + } + } + +diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c +index 296e714bf553..523dd56a798c 100644 +--- a/drivers/edac/ghes_edac.c ++++ b/drivers/edac/ghes_edac.c +@@ -231,6 +231,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + /* Cleans the error report buffer */ + memset(e, 0, sizeof (*e)); + e->error_count = 1; ++ e->grain = 1; + strcpy(e->label, "unknown label"); + e->msg = pvt->msg; + e->other_detail = pvt->other_detail; +@@ -326,7 +327,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + + /* Error grain */ + if (mem_err->validation_bits & CPER_MEM_VALID_PA_MASK) +- e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK); ++ e->grain = ~mem_err->physical_addr_mask + 1; + + /* Memory error location, mapped on e->location */ + p = e->location; +@@ -442,8 +443,13 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + if (p > pvt->other_detail) + *(p - 1) = '\0'; + ++ /* Sanity-check driver-supplied grain value. */ ++ if (WARN_ON_ONCE(!e->grain)) ++ e->grain = 1; ++ ++ grain_bits = fls_long(e->grain - 1); ++ + /* Generate the trace event */ +- grain_bits = fls_long(e->grain); + snprintf(pvt->detail_location, sizeof(pvt->detail_location), + "APEI location: %s %s", e->location, e->other_detail); + trace_mc_event(type, e->msg, e->label, e->error_count, +diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c +index dc43847ad2b0..b3d93baf4fc5 100644 +--- a/drivers/extcon/extcon-sm5502.c ++++ b/drivers/extcon/extcon-sm5502.c +@@ -65,6 +65,10 @@ struct sm5502_muic_info { + /* Default value of SM5502 register to bring up MUIC device. */ + static struct reg_data sm5502_reg_data[] = { + { ++ .reg = SM5502_REG_RESET, ++ .val = SM5502_REG_RESET_MASK, ++ .invert = true, ++ }, { + .reg = SM5502_REG_CONTROL, + .val = SM5502_REG_CONTROL_MASK_INT_MASK, + .invert = false, +diff --git a/drivers/extcon/extcon-sm5502.h b/drivers/extcon/extcon-sm5502.h +index 9dbb634d213b..ce1f1ec310c4 100644 +--- a/drivers/extcon/extcon-sm5502.h ++++ b/drivers/extcon/extcon-sm5502.h +@@ -237,6 +237,8 @@ enum sm5502_reg { + #define DM_DP_SWITCH_UART ((DM_DP_CON_SWITCH_UART <name = "reserved"; ++ res->flags = IORESOURCE_MEM; ++ res->start = addr; ++ res->end = addr + size - 1; ++ ++ /* we expect a conflict with a 'System RAM' region */ ++ parent = request_resource_conflict(&iomem_resource, res); ++ return parent ? request_resource(parent, res) : 0; ++} ++ + int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + { + struct linux_efi_memreserve *rsv; +@@ -994,7 +1012,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + rsv->entry[index].size = size; + + memunmap(rsv); +- return 0; ++ return efi_mem_reserve_iomem(addr, size); + } + memunmap(rsv); + } +@@ -1004,6 +1022,12 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + if (!rsv) + return -ENOMEM; + ++ rc = efi_mem_reserve_iomem(__pa(rsv), SZ_4K); ++ if (rc) { ++ free_page((unsigned long)rsv); ++ return rc; ++ } ++ + /* + * The memremap() call above assumes that a linux_efi_memreserve entry + * never crosses a page boundary, so let's ensure that this remains true +@@ -1020,7 +1044,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + efi_memreserve_root->next = __pa(rsv); + spin_unlock(&efi_mem_reserve_persistent_lock); + +- return 0; ++ return efi_mem_reserve_iomem(addr, size); + } + + static int __init efi_memreserve_root_init(void) +diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c +index 1f76740f33b6..9282239b4d95 100644 +--- a/drivers/fsi/fsi-core.c ++++ b/drivers/fsi/fsi-core.c +@@ -544,6 +544,31 @@ static int fsi_slave_scan(struct fsi_slave *slave) + return 0; + } + ++static unsigned long aligned_access_size(size_t offset, size_t count) ++{ ++ unsigned long offset_unit, count_unit; ++ ++ /* Criteria: ++ * ++ * 1. Access size must be less than or equal to the maximum access ++ * width or the highest power-of-two factor of offset ++ * 2. Access size must be less than or equal to the amount specified by ++ * count ++ * ++ * The access width is optimal if we can calculate 1 to be strictly ++ * equal while still satisfying 2. ++ */ ++ ++ /* Find 1 by the bottom bit of offset (with a 4 byte access cap) */ ++ offset_unit = BIT(__builtin_ctzl(offset | 4)); ++ ++ /* Find 2 by the top bit of count */ ++ count_unit = BIT(8 * sizeof(unsigned long) - 1 - __builtin_clzl(count)); ++ ++ /* Constrain the maximum access width to the minimum of both criteria */ ++ return BIT(__builtin_ctzl(offset_unit | count_unit)); ++} ++ + static ssize_t fsi_slave_sysfs_raw_read(struct file *file, + struct kobject *kobj, struct bin_attribute *attr, char *buf, + loff_t off, size_t count) +@@ -559,8 +584,7 @@ static ssize_t fsi_slave_sysfs_raw_read(struct file *file, + return -EINVAL; + + for (total_len = 0; total_len < count; total_len += read_len) { +- read_len = min_t(size_t, count, 4); +- read_len -= off & 0x3; ++ read_len = aligned_access_size(off, count - total_len); + + rc = fsi_slave_read(slave, off, buf + total_len, read_len); + if (rc) +@@ -587,8 +611,7 @@ static ssize_t fsi_slave_sysfs_raw_write(struct file *file, + return -EINVAL; + + for (total_len = 0; total_len < count; total_len += write_len) { +- write_len = min_t(size_t, count, 4); +- write_len -= off & 0x3; ++ write_len = aligned_access_size(off, count - total_len); + + rc = fsi_slave_write(slave, off, buf + total_len, write_len); + if (rc) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index 5652cc72ed3a..81842ba8cd75 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -859,6 +859,9 @@ static int amdgpu_debugfs_test_ib(struct seq_file *m, void *data) + struct amdgpu_device *adev = dev->dev_private; + int r = 0, i; + ++ /* Avoid accidently unparking the sched thread during GPU reset */ ++ mutex_lock(&adev->lock_reset); ++ + /* hold on the scheduler */ + for (i = 0; i < AMDGPU_MAX_RINGS; i++) { + struct amdgpu_ring *ring = adev->rings[i]; +@@ -884,6 +887,8 @@ static int amdgpu_debugfs_test_ib(struct seq_file *m, void *data) + kthread_unpark(ring->sched.thread); + } + ++ mutex_unlock(&adev->lock_reset); ++ + return 0; + } + +@@ -1036,6 +1041,9 @@ static int amdgpu_debugfs_ib_preempt(void *data, u64 val) + if (!fences) + return -ENOMEM; + ++ /* Avoid accidently unparking the sched thread during GPU reset */ ++ mutex_lock(&adev->lock_reset); ++ + /* stop the scheduler */ + kthread_park(ring->sched.thread); + +@@ -1075,6 +1083,8 @@ failure: + /* restart the scheduler */ + kthread_unpark(ring->sched.thread); + ++ mutex_unlock(&adev->lock_reset); ++ + ttm_bo_unlock_delayed_workqueue(&adev->mman.bdev, resched); + + if (fences) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +index b66d29d5ffa2..b158230af8db 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +@@ -138,6 +138,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(vram_obj, &vram_map); + if (r) { +@@ -183,6 +184,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(gtt_obj[i], >t_map); + if (r) { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h +index 77674a7b9616..91899d28fa72 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h +@@ -170,7 +170,7 @@ TRACE_EVENT(amdgpu_cs_ioctl, + __field(unsigned int, context) + __field(unsigned int, seqno) + __field(struct dma_fence *, fence) +- __field(char *, ring_name) ++ __string(ring, to_amdgpu_ring(job->base.sched)->name) + __field(u32, num_ibs) + ), + +@@ -179,12 +179,12 @@ TRACE_EVENT(amdgpu_cs_ioctl, + __assign_str(timeline, AMDGPU_JOB_GET_TIMELINE_NAME(job)) + __entry->context = job->base.s_fence->finished.context; + __entry->seqno = job->base.s_fence->finished.seqno; +- __entry->ring_name = to_amdgpu_ring(job->base.sched)->name; ++ __assign_str(ring, to_amdgpu_ring(job->base.sched)->name) + __entry->num_ibs = job->num_ibs; + ), + TP_printk("sched_job=%llu, timeline=%s, context=%u, seqno=%u, ring_name=%s, num_ibs=%u", + __entry->sched_job_id, __get_str(timeline), __entry->context, +- __entry->seqno, __entry->ring_name, __entry->num_ibs) ++ __entry->seqno, __get_str(ring), __entry->num_ibs) + ); + + TRACE_EVENT(amdgpu_sched_run_job, +@@ -195,7 +195,7 @@ TRACE_EVENT(amdgpu_sched_run_job, + __string(timeline, AMDGPU_JOB_GET_TIMELINE_NAME(job)) + __field(unsigned int, context) + __field(unsigned int, seqno) +- __field(char *, ring_name) ++ __string(ring, to_amdgpu_ring(job->base.sched)->name) + __field(u32, num_ibs) + ), + +@@ -204,12 +204,12 @@ TRACE_EVENT(amdgpu_sched_run_job, + __assign_str(timeline, AMDGPU_JOB_GET_TIMELINE_NAME(job)) + __entry->context = job->base.s_fence->finished.context; + __entry->seqno = job->base.s_fence->finished.seqno; +- __entry->ring_name = to_amdgpu_ring(job->base.sched)->name; ++ __assign_str(ring, to_amdgpu_ring(job->base.sched)->name) + __entry->num_ibs = job->num_ibs; + ), + TP_printk("sched_job=%llu, timeline=%s, context=%u, seqno=%u, ring_name=%s, num_ibs=%u", + __entry->sched_job_id, __get_str(timeline), __entry->context, +- __entry->seqno, __entry->ring_name, __entry->num_ibs) ++ __entry->seqno, __get_str(ring), __entry->num_ibs) + ); + + +@@ -468,7 +468,7 @@ TRACE_EVENT(amdgpu_ib_pipe_sync, + TP_PROTO(struct amdgpu_job *sched_job, struct dma_fence *fence), + TP_ARGS(sched_job, fence), + TP_STRUCT__entry( +- __field(const char *,name) ++ __string(ring, sched_job->base.sched->name); + __field(uint64_t, id) + __field(struct dma_fence *, fence) + __field(uint64_t, ctx) +@@ -476,14 +476,14 @@ TRACE_EVENT(amdgpu_ib_pipe_sync, + ), + + TP_fast_assign( +- __entry->name = sched_job->base.sched->name; ++ __assign_str(ring, sched_job->base.sched->name) + __entry->id = sched_job->base.id; + __entry->fence = fence; + __entry->ctx = fence->context; + __entry->seqno = fence->seqno; + ), + TP_printk("job ring=%s, id=%llu, need pipe sync to fence=%p, context=%llu, seq=%u", +- __entry->name, __entry->id, ++ __get_str(ring), __entry->id, + __entry->fence, __entry->ctx, + __entry->seqno) + ); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 5251352f5922..c7514f743409 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -1034,10 +1034,8 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + id->oa_base != job->oa_base || + id->oa_size != job->oa_size); + bool vm_flush_needed = job->vm_needs_flush; +- bool pasid_mapping_needed = id->pasid != job->pasid || +- !id->pasid_mapping || +- !dma_fence_is_signaled(id->pasid_mapping); + struct dma_fence *fence = NULL; ++ bool pasid_mapping_needed = false; + unsigned patch_offset = 0; + int r; + +@@ -1047,6 +1045,12 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + pasid_mapping_needed = true; + } + ++ mutex_lock(&id_mgr->lock); ++ if (id->pasid != job->pasid || !id->pasid_mapping || ++ !dma_fence_is_signaled(id->pasid_mapping)) ++ pasid_mapping_needed = true; ++ mutex_unlock(&id_mgr->lock); ++ + gds_switch_needed &= !!ring->funcs->emit_gds_switch; + vm_flush_needed &= !!ring->funcs->emit_vm_flush && + job->vm_pd_addr != AMDGPU_BO_INVALID_OFFSET; +@@ -1086,9 +1090,11 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + } + + if (pasid_mapping_needed) { ++ mutex_lock(&id_mgr->lock); + id->pasid = job->pasid; + dma_fence_put(id->pasid_mapping); + id->pasid_mapping = dma_fence_get(fence); ++ mutex_unlock(&id_mgr->lock); + } + dma_fence_put(fence); + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 97cf0b536873..c9ba2ec6d038 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -2930,7 +2930,8 @@ static void gfx_v9_0_init_pg(struct amdgpu_device *adev) + * And it's needed by gfxoff feature. + */ + if (adev->gfx.rlc.is_rlc_v2_1) { +- gfx_v9_1_init_rlc_save_restore_list(adev); ++ if (adev->asic_type == CHIP_VEGA12) ++ gfx_v9_1_init_rlc_save_restore_list(adev); + gfx_v9_0_enable_save_restore_machine(adev); + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c +index 10166104b8a3..d483684db95b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c +@@ -398,6 +398,34 @@ static bool psp_v11_0_support_vmr_ring(struct psp_context *psp) + return false; + } + ++static int psp_v11_0_ring_stop(struct psp_context *psp, ++ enum psp_ring_type ring_type) ++{ ++ int ret = 0; ++ struct amdgpu_device *adev = psp->adev; ++ ++ /* Write the ring destroy command*/ ++ if (psp_v11_0_support_vmr_ring(psp)) ++ WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101, ++ GFX_CTRL_CMD_ID_DESTROY_GPCOM_RING); ++ else ++ WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_64, ++ GFX_CTRL_CMD_ID_DESTROY_RINGS); ++ ++ /* there might be handshake issue with hardware which needs delay */ ++ mdelay(20); ++ ++ /* Wait for response flag (bit 31) */ ++ if (psp_v11_0_support_vmr_ring(psp)) ++ ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_101), ++ 0x80000000, 0x80000000, false); ++ else ++ ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_64), ++ 0x80000000, 0x80000000, false); ++ ++ return ret; ++} ++ + static int psp_v11_0_ring_create(struct psp_context *psp, + enum psp_ring_type ring_type) + { +@@ -407,6 +435,12 @@ static int psp_v11_0_ring_create(struct psp_context *psp, + struct amdgpu_device *adev = psp->adev; + + if (psp_v11_0_support_vmr_ring(psp)) { ++ ret = psp_v11_0_ring_stop(psp, ring_type); ++ if (ret) { ++ DRM_ERROR("psp_v11_0_ring_stop_sriov failed!\n"); ++ return ret; ++ } ++ + /* Write low address of the ring to C2PMSG_102 */ + psp_ring_reg = lower_32_bits(ring->ring_mem_mc_addr); + WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102, psp_ring_reg); +@@ -451,33 +485,6 @@ static int psp_v11_0_ring_create(struct psp_context *psp, + return ret; + } + +-static int psp_v11_0_ring_stop(struct psp_context *psp, +- enum psp_ring_type ring_type) +-{ +- int ret = 0; +- struct amdgpu_device *adev = psp->adev; +- +- /* Write the ring destroy command*/ +- if (psp_v11_0_support_vmr_ring(psp)) +- WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101, +- GFX_CTRL_CMD_ID_DESTROY_GPCOM_RING); +- else +- WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_64, +- GFX_CTRL_CMD_ID_DESTROY_RINGS); +- +- /* there might be handshake issue with hardware which needs delay */ +- mdelay(20); +- +- /* Wait for response flag (bit 31) */ +- if (psp_v11_0_support_vmr_ring(psp)) +- ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_101), +- 0x80000000, 0x80000000, false); +- else +- ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_64), +- 0x80000000, 0x80000000, false); +- +- return ret; +-} + + static int psp_v11_0_ring_destroy(struct psp_context *psp, + enum psp_ring_type ring_type) +diff --git a/drivers/gpu/drm/amd/amdgpu/si_ih.c b/drivers/gpu/drm/amd/amdgpu/si_ih.c +index 57bb5f9e08b2..88ae27a5a03d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_ih.c +@@ -64,7 +64,8 @@ static int si_ih_irq_init(struct amdgpu_device *adev) + u32 interrupt_cntl, ih_cntl, ih_rb_cntl; + + si_ih_disable_interrupts(adev); +- WREG32(INTERRUPT_CNTL2, adev->irq.ih.gpu_addr >> 8); ++ /* set dummy read address to dummy page address */ ++ WREG32(INTERRUPT_CNTL2, adev->dummy_page_addr >> 8); + interrupt_cntl = RREG32(INTERRUPT_CNTL); + interrupt_cntl &= ~IH_DUMMY_RD_OVERRIDE; + interrupt_cntl &= ~IH_REQ_NONSNOOP_EN; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +index d985e31fcc1e..f335f73919d1 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -1676,7 +1676,8 @@ static int allocate_hiq_sdma_mqd(struct device_queue_manager *dqm) + struct kfd_dev *dev = dqm->dev; + struct kfd_mem_obj *mem_obj = &dqm->hiq_sdma_mqd; + uint32_t size = dqm->mqd_mgrs[KFD_MQD_TYPE_SDMA]->mqd_size * +- dev->device_info->num_sdma_engines * ++ (dev->device_info->num_sdma_engines + ++ dev->device_info->num_xgmi_sdma_engines) * + dev->device_info->num_sdma_queues_per_engine + + dqm->mqd_mgrs[KFD_MQD_TYPE_HIQ]->mqd_size; + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c +index c56ac47cd318..bc47f6a44456 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c +@@ -62,6 +62,11 @@ int kfd_interrupt_init(struct kfd_dev *kfd) + } + + kfd->ih_wq = alloc_workqueue("KFD IH", WQ_HIGHPRI, 1); ++ if (unlikely(!kfd->ih_wq)) { ++ kfifo_free(&kfd->ih_fifo); ++ dev_err(kfd_chardev(), "Failed to allocate KFD IH workqueue\n"); ++ return -ENOMEM; ++ } + spin_lock_init(&kfd->interrupt_lock); + + INIT_WORK(&kfd->interrupt_work, interrupt_wq); +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 4139f129eafb..4e9c15c409ba 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -940,6 +940,11 @@ static int dm_late_init(void *handle) + params.backlight_lut_array_size = 16; + params.backlight_lut_array = linear_lut; + ++ /* Min backlight level after ABM reduction, Don't allow below 1% ++ * 0xFFFF x 0.01 = 0x28F ++ */ ++ params.min_abm_backlight = 0x28F; ++ + /* todo will enable for navi10 */ + if (adev->asic_type <= CHIP_RAVEN) { + ret = dmcu_load_iram(dmcu, params); +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c +index 3e8ac303bd52..23ec283eb07b 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c +@@ -320,6 +320,8 @@ void dcn2_update_clocks_fpga(struct clk_mgr *clk_mgr, + struct dc_state *context, + bool safe_to_lower) + { ++ struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr); ++ + struct dc_clocks *new_clocks = &context->bw_ctx.bw.dcn.clk; + /* Min fclk = 1.2GHz since all the extra scemi logic seems to run off of it */ + int fclk_adj = new_clocks->fclk_khz > 1200000 ? new_clocks->fclk_khz : 1200000; +@@ -357,14 +359,18 @@ void dcn2_update_clocks_fpga(struct clk_mgr *clk_mgr, + clk_mgr->clks.dispclk_khz = new_clocks->dispclk_khz; + } + +- /* Both fclk and dppclk ref are run on the same scemi clock so we +- * need to keep the same value for both ++ /* Both fclk and ref_dppclk run on the same scemi clock. ++ * So take the higher value since the DPP DTO is typically programmed ++ * such that max dppclk is 1:1 with ref_dppclk. + */ + if (clk_mgr->clks.fclk_khz > clk_mgr->clks.dppclk_khz) + clk_mgr->clks.dppclk_khz = clk_mgr->clks.fclk_khz; + if (clk_mgr->clks.dppclk_khz > clk_mgr->clks.fclk_khz) + clk_mgr->clks.fclk_khz = clk_mgr->clks.dppclk_khz; + ++ // Both fclk and ref_dppclk run on the same scemi clock. ++ clk_mgr_int->dccg->ref_dppclk = clk_mgr->clks.fclk_khz; ++ + dm_set_dcn_clocks(clk_mgr->ctx, &clk_mgr->clks); + } + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c +index 50984c1811bb..468c6bb0e311 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c +@@ -33,7 +33,7 @@ + #include "mp/mp_12_0_0_sh_mask.h" + + #define REG(reg_name) \ +- (MP1_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name) ++ (MP0_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name) + + #define FN(reg_name, field) \ + FD(reg_name##__##field) +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index ca20b150afcc..067f5579f452 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -2169,8 +2169,10 @@ static void disable_link(struct dc_link *link, enum signal_type signal) + dp_set_fec_ready(link, false); + } + #endif +- } else +- link->link_enc->funcs->disable_output(link->link_enc, signal); ++ } else { ++ if (signal != SIGNAL_TYPE_VIRTUAL) ++ link->link_enc->funcs->disable_output(link->link_enc, signal); ++ } + + if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST) { + /* MST disable link only when no stream use the link */ +@@ -2217,7 +2219,7 @@ static bool dp_active_dongle_validate_timing( + break; + } + +- if (dongle_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER || ++ if (dpcd_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER || + dongle_caps->extendedCapValid == false) + return true; + +@@ -2767,6 +2769,15 @@ void core_link_enable_stream( + CONTROLLER_DP_TEST_PATTERN_VIDEOMODE, + COLOR_DEPTH_UNDEFINED); + ++ /* This second call is needed to reconfigure the DIG ++ * as a workaround for the incorrect value being applied ++ * from transmitter control. ++ */ ++ if (!dc_is_virtual_signal(pipe_ctx->stream->signal)) ++ stream->link->link_enc->funcs->setup( ++ stream->link->link_enc, ++ pipe_ctx->stream->signal); ++ + #ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT + if (pipe_ctx->stream->timing.flags.DSC) { + if (dc_is_dp_signal(pipe_ctx->stream->signal) || +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index f5742719b5d9..5a583707d198 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -2545,6 +2545,7 @@ static void get_active_converter_info( + uint8_t data, struct dc_link *link) + { + union dp_downstream_port_present ds_port = { .byte = data }; ++ memset(&link->dpcd_caps.dongle_caps, 0, sizeof(link->dpcd_caps.dongle_caps)); + + /* decode converter info*/ + if (!ds_port.fields.PORT_PRESENT) { +@@ -2691,6 +2692,7 @@ static void dp_wa_power_up_0010FA(struct dc_link *link, uint8_t *dpcd_data, + * keep receiver powered all the time.*/ + case DP_BRANCH_DEVICE_ID_0010FA: + case DP_BRANCH_DEVICE_ID_0080E1: ++ case DP_BRANCH_DEVICE_ID_00E04C: + link->wa_flags.dp_keep_receiver_powered = true; + break; + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c +index 79438c4f1e20..a519dbc5ecb6 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c +@@ -277,7 +277,8 @@ void dp_retrain_link_dp_test(struct dc_link *link, + if (pipes[i].stream != NULL && + !pipes[i].top_pipe && !pipes[i].prev_odm_pipe && + pipes[i].stream->link != NULL && +- pipes[i].stream_res.stream_enc != NULL) { ++ pipes[i].stream_res.stream_enc != NULL && ++ pipes[i].stream->link == link) { + udelay(100); + + pipes[i].stream_res.stream_enc->funcs->dp_blank( +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +index bf1d7bb90e0f..bb09243758fe 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +@@ -423,10 +423,10 @@ bool dc_stream_add_writeback(struct dc *dc, + + if (dwb->funcs->is_enabled(dwb)) { + /* writeback pipe already enabled, only need to update */ +- dc->hwss.update_writeback(dc, stream_status, wb_info); ++ dc->hwss.update_writeback(dc, stream_status, wb_info, dc->current_state); + } else { + /* Enable writeback pipe from scratch*/ +- dc->hwss.enable_writeback(dc, stream_status, wb_info); ++ dc->hwss.enable_writeback(dc, stream_status, wb_info, dc->current_state); + } + } + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c +index 58bd131d5b48..7700a855d77c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c +@@ -77,6 +77,9 @@ static bool dce_abm_set_pipe(struct abm *abm, uint32_t controller_id) + /* notifyDMCUMsg */ + REG_UPDATE(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 1); + ++ REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 0, ++ 1, 80000); ++ + return true; + } + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +index b3ae1c41fc69..937a8ba81160 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +@@ -1356,7 +1356,8 @@ bool dcn20_update_bandwidth( + static void dcn20_enable_writeback( + struct dc *dc, + const struct dc_stream_status *stream_status, +- struct dc_writeback_info *wb_info) ++ struct dc_writeback_info *wb_info, ++ struct dc_state *context) + { + struct dwbc *dwb; + struct mcif_wb *mcif_wb; +@@ -1373,7 +1374,7 @@ static void dcn20_enable_writeback( + optc->funcs->set_dwb_source(optc, wb_info->dwb_pipe_inst); + /* set MCIF_WB buffer and arbitration configuration */ + mcif_wb->funcs->config_mcif_buf(mcif_wb, &wb_info->mcif_buf_params, wb_info->dwb_params.dest_height); +- mcif_wb->funcs->config_mcif_arb(mcif_wb, &dc->current_state->bw_ctx.bw.dcn.bw_writeback.mcif_wb_arb[wb_info->dwb_pipe_inst]); ++ mcif_wb->funcs->config_mcif_arb(mcif_wb, &context->bw_ctx.bw.dcn.bw_writeback.mcif_wb_arb[wb_info->dwb_pipe_inst]); + /* Enable MCIF_WB */ + mcif_wb->funcs->enable_mcif(mcif_wb); + /* Enable DWB */ +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c +index 2137e2be2140..dda90995ba93 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c +@@ -287,6 +287,10 @@ void optc2_get_optc_source(struct timing_generator *optc, + *num_of_src_opp = 2; + else + *num_of_src_opp = 1; ++ ++ /* Work around VBIOS not updating OPTC_NUM_OF_INPUT_SEGMENT */ ++ if (*src_opp_id_1 == 0xf) ++ *num_of_src_opp = 1; + } + + void optc2_set_dwb_source(struct timing_generator *optc, +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index 6b2f2f1a1c9c..78b2cc2e122f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -1765,7 +1765,7 @@ int dcn20_populate_dml_pipes_from_context( + pipe_cnt = i; + continue; + } +- if (!resource_are_streams_timing_synchronizable( ++ if (dc->debug.disable_timing_sync || !resource_are_streams_timing_synchronizable( + res_ctx->pipe_ctx[pipe_cnt].stream, + res_ctx->pipe_ctx[i].stream)) { + synchronized_vblank = false; +@@ -2474,6 +2474,7 @@ bool dcn20_fast_validate_bw( + &context->res_ctx, dc->res_pool, + pipe, hsplit_pipe)) + goto validate_fail; ++ dcn20_build_mapped_resource(dc, context, pipe->stream); + } else + dcn20_split_stream_for_mpc( + &context->res_ctx, dc->res_pool, +@@ -3040,7 +3041,7 @@ static void cap_soc_clocks( + static void update_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_st *bb, + struct pp_smu_nv_clock_table *max_clocks, unsigned int *uclk_states, unsigned int num_states) + { +- struct _vcs_dpi_voltage_scaling_st calculated_states[MAX_CLOCK_LIMIT_STATES] = {0}; ++ struct _vcs_dpi_voltage_scaling_st calculated_states[MAX_CLOCK_LIMIT_STATES]; + int i; + int num_calculated_states = 0; + int min_dcfclk = 0; +@@ -3048,6 +3049,8 @@ static void update_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_ + if (num_states == 0) + return; + ++ memset(calculated_states, 0, sizeof(calculated_states)); ++ + if (dc->bb_overrides.min_dcfclk_mhz > 0) + min_dcfclk = dc->bb_overrides.min_dcfclk_mhz; + else +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c +index d1266741763b..f5f6b4a0f0aa 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c +@@ -22,6 +22,7 @@ + * Authors: AMD + * + */ ++#include + #include "dm_services.h" + #include "dcn20/dcn20_hubbub.h" + #include "dcn21_hubbub.h" +@@ -71,30 +72,39 @@ static uint32_t convert_and_clamp( + void dcn21_dchvm_init(struct hubbub *hubbub) + { + struct dcn20_hubbub *hubbub1 = TO_DCN20_HUBBUB(hubbub); ++ uint32_t riommu_active; ++ int i; + + //Init DCHVM block + REG_UPDATE(DCHVM_CTRL0, HOSTVM_INIT_REQ, 1); + + //Poll until RIOMMU_ACTIVE = 1 +- //TODO: Figure out interval us and retry count +- REG_WAIT(DCHVM_RIOMMU_STAT0, RIOMMU_ACTIVE, 1, 5, 100); ++ for (i = 0; i < 100; i++) { ++ REG_GET(DCHVM_RIOMMU_STAT0, RIOMMU_ACTIVE, &riommu_active); + +- //Reflect the power status of DCHUBBUB +- REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_POWERSTATUS, 1); ++ if (riommu_active) ++ break; ++ else ++ udelay(5); ++ } ++ ++ if (riommu_active) { ++ //Reflect the power status of DCHUBBUB ++ REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_POWERSTATUS, 1); + +- //Start rIOMMU prefetching +- REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_PREFETCH_REQ, 1); ++ //Start rIOMMU prefetching ++ REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_PREFETCH_REQ, 1); + +- // Enable dynamic clock gating +- REG_UPDATE_4(DCHVM_CLK_CTRL, +- HVM_DISPCLK_R_GATE_DIS, 0, +- HVM_DISPCLK_G_GATE_DIS, 0, +- HVM_DCFCLK_R_GATE_DIS, 0, +- HVM_DCFCLK_G_GATE_DIS, 0); ++ // Enable dynamic clock gating ++ REG_UPDATE_4(DCHVM_CLK_CTRL, ++ HVM_DISPCLK_R_GATE_DIS, 0, ++ HVM_DISPCLK_G_GATE_DIS, 0, ++ HVM_DCFCLK_R_GATE_DIS, 0, ++ HVM_DCFCLK_G_GATE_DIS, 0); + +- //Poll until HOSTVM_PREFETCH_DONE = 1 +- //TODO: Figure out interval us and retry count +- REG_WAIT(DCHVM_RIOMMU_STAT0, HOSTVM_PREFETCH_DONE, 1, 5, 100); ++ //Poll until HOSTVM_PREFETCH_DONE = 1 ++ REG_WAIT(DCHVM_RIOMMU_STAT0, HOSTVM_PREFETCH_DONE, 1, 5, 100); ++ } + } + + static int hubbub21_init_dchub(struct hubbub *hubbub, +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h +index 3a938cd414ea..f6cc2d6f576d 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h +@@ -321,10 +321,12 @@ struct hw_sequencer_funcs { + struct dc_state *context); + void (*update_writeback)(struct dc *dc, + const struct dc_stream_status *stream_status, +- struct dc_writeback_info *wb_info); ++ struct dc_writeback_info *wb_info, ++ struct dc_state *context); + void (*enable_writeback)(struct dc *dc, + const struct dc_stream_status *stream_status, +- struct dc_writeback_info *wb_info); ++ struct dc_writeback_info *wb_info, ++ struct dc_state *context); + void (*disable_writeback)(struct dc *dc, + unsigned int dwb_pipe_inst); + #endif +diff --git a/drivers/gpu/drm/amd/display/include/ddc_service_types.h b/drivers/gpu/drm/amd/display/include/ddc_service_types.h +index 18961707db23..9ad49da50a17 100644 +--- a/drivers/gpu/drm/amd/display/include/ddc_service_types.h ++++ b/drivers/gpu/drm/amd/display/include/ddc_service_types.h +@@ -31,6 +31,8 @@ + #define DP_BRANCH_DEVICE_ID_0022B9 0x0022B9 + #define DP_BRANCH_DEVICE_ID_00001A 0x00001A + #define DP_BRANCH_DEVICE_ID_0080E1 0x0080e1 ++#define DP_BRANCH_DEVICE_ID_90CC24 0x90CC24 ++#define DP_BRANCH_DEVICE_ID_00E04C 0x00E04C + + enum ddc_result { + DDC_RESULT_UNKNOWN = 0, +diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c +index ec70c9b12e1a..0978c698f0f8 100644 +--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c ++++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c +@@ -743,6 +743,10 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync, + nominal_field_rate_in_uhz = + mod_freesync_calc_nominal_field_rate(stream); + ++ /* Rounded to the nearest Hz */ ++ nominal_field_rate_in_uhz = 1000000ULL * ++ div_u64(nominal_field_rate_in_uhz + 500000, 1000000); ++ + min_refresh_in_uhz = in_config->min_refresh_in_uhz; + max_refresh_in_uhz = in_config->max_refresh_in_uhz; + +@@ -996,14 +1000,13 @@ unsigned long long mod_freesync_calc_nominal_field_rate( + const struct dc_stream_state *stream) + { + unsigned long long nominal_field_rate_in_uhz = 0; ++ unsigned int total = stream->timing.h_total * stream->timing.v_total; + +- /* Calculate nominal field rate for stream */ ++ /* Calculate nominal field rate for stream, rounded up to nearest integer */ + nominal_field_rate_in_uhz = stream->timing.pix_clk_100hz / 10; + nominal_field_rate_in_uhz *= 1000ULL * 1000ULL * 1000ULL; +- nominal_field_rate_in_uhz = div_u64(nominal_field_rate_in_uhz, +- stream->timing.h_total); +- nominal_field_rate_in_uhz = div_u64(nominal_field_rate_in_uhz, +- stream->timing.v_total); ++ ++ nominal_field_rate_in_uhz = div_u64(nominal_field_rate_in_uhz, total); + + return nominal_field_rate_in_uhz; + } +diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c +index 05e2be856037..ba1aafe40512 100644 +--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c ++++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c +@@ -115,7 +115,7 @@ static const struct abm_parameters * const abm_settings[] = { + /* NOTE: iRAM is 256B in size */ + struct iram_table_v_2 { + /* flags */ +- uint16_t flags; /* 0x00 U16 */ ++ uint16_t min_abm_backlight; /* 0x00 U16 */ + + /* parameters for ABM2.0 algorithm */ + uint8_t min_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; /* 0x02 U0.8 */ +@@ -140,10 +140,10 @@ struct iram_table_v_2 { + + /* For reading PSR State directly from IRAM */ + uint8_t psr_state; /* 0xf0 */ +- uint8_t dmcu_mcp_interface_version; /* 0xf1 */ +- uint8_t dmcu_abm_feature_version; /* 0xf2 */ +- uint8_t dmcu_psr_feature_version; /* 0xf3 */ +- uint16_t dmcu_version; /* 0xf4 */ ++ uint8_t dmcu_mcp_interface_version; /* 0xf1 */ ++ uint8_t dmcu_abm_feature_version; /* 0xf2 */ ++ uint8_t dmcu_psr_feature_version; /* 0xf3 */ ++ uint16_t dmcu_version; /* 0xf4 */ + uint8_t dmcu_state; /* 0xf6 */ + + uint16_t blRampReduction; /* 0xf7 */ +@@ -164,42 +164,43 @@ struct iram_table_v_2_2 { + uint8_t max_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; /* 0x16 U0.8 */ + uint8_t bright_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; /* 0x2a U2.6 */ + uint8_t dark_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; /* 0x3e U2.6 */ +- uint8_t hybrid_factor[NUM_AGGR_LEVEL]; /* 0x52 U0.8 */ +- uint8_t contrast_factor[NUM_AGGR_LEVEL]; /* 0x56 U0.8 */ +- uint8_t deviation_gain[NUM_AGGR_LEVEL]; /* 0x5a U0.8 */ +- uint8_t iir_curve[NUM_AMBI_LEVEL]; /* 0x5e U0.8 */ +- uint8_t min_knee[NUM_AGGR_LEVEL]; /* 0x63 U0.8 */ +- uint8_t max_knee[NUM_AGGR_LEVEL]; /* 0x67 U0.8 */ +- uint8_t pad[21]; /* 0x6b U0.8 */ ++ uint8_t hybrid_factor[NUM_AGGR_LEVEL]; /* 0x52 U0.8 */ ++ uint8_t contrast_factor[NUM_AGGR_LEVEL]; /* 0x56 U0.8 */ ++ uint8_t deviation_gain[NUM_AGGR_LEVEL]; /* 0x5a U0.8 */ ++ uint8_t iir_curve[NUM_AMBI_LEVEL]; /* 0x5e U0.8 */ ++ uint8_t min_knee[NUM_AGGR_LEVEL]; /* 0x63 U0.8 */ ++ uint8_t max_knee[NUM_AGGR_LEVEL]; /* 0x67 U0.8 */ ++ uint16_t min_abm_backlight; /* 0x6b U16 */ ++ uint8_t pad[19]; /* 0x6d U0.8 */ + + /* parameters for crgb conversion */ +- uint16_t crgb_thresh[NUM_POWER_FN_SEGS]; /* 0x80 U3.13 */ +- uint16_t crgb_offset[NUM_POWER_FN_SEGS]; /* 0x90 U1.15 */ +- uint16_t crgb_slope[NUM_POWER_FN_SEGS]; /* 0xa0 U4.12 */ ++ uint16_t crgb_thresh[NUM_POWER_FN_SEGS]; /* 0x80 U3.13 */ ++ uint16_t crgb_offset[NUM_POWER_FN_SEGS]; /* 0x90 U1.15 */ ++ uint16_t crgb_slope[NUM_POWER_FN_SEGS]; /* 0xa0 U4.12 */ + + /* parameters for custom curve */ + /* thresholds for brightness --> backlight */ +- uint16_t backlight_thresholds[NUM_BL_CURVE_SEGS]; /* 0xb0 U16.0 */ ++ uint16_t backlight_thresholds[NUM_BL_CURVE_SEGS]; /* 0xb0 U16.0 */ + /* offsets for brightness --> backlight */ +- uint16_t backlight_offsets[NUM_BL_CURVE_SEGS]; /* 0xd0 U16.0 */ ++ uint16_t backlight_offsets[NUM_BL_CURVE_SEGS]; /* 0xd0 U16.0 */ + + /* For reading PSR State directly from IRAM */ +- uint8_t psr_state; /* 0xf0 */ +- uint8_t dmcu_mcp_interface_version; /* 0xf1 */ +- uint8_t dmcu_abm_feature_version; /* 0xf2 */ +- uint8_t dmcu_psr_feature_version; /* 0xf3 */ +- uint16_t dmcu_version; /* 0xf4 */ +- uint8_t dmcu_state; /* 0xf6 */ +- +- uint8_t dummy1; /* 0xf7 */ +- uint8_t dummy2; /* 0xf8 */ +- uint8_t dummy3; /* 0xf9 */ +- uint8_t dummy4; /* 0xfa */ +- uint8_t dummy5; /* 0xfb */ +- uint8_t dummy6; /* 0xfc */ +- uint8_t dummy7; /* 0xfd */ +- uint8_t dummy8; /* 0xfe */ +- uint8_t dummy9; /* 0xff */ ++ uint8_t psr_state; /* 0xf0 */ ++ uint8_t dmcu_mcp_interface_version; /* 0xf1 */ ++ uint8_t dmcu_abm_feature_version; /* 0xf2 */ ++ uint8_t dmcu_psr_feature_version; /* 0xf3 */ ++ uint16_t dmcu_version; /* 0xf4 */ ++ uint8_t dmcu_state; /* 0xf6 */ ++ ++ uint8_t dummy1; /* 0xf7 */ ++ uint8_t dummy2; /* 0xf8 */ ++ uint8_t dummy3; /* 0xf9 */ ++ uint8_t dummy4; /* 0xfa */ ++ uint8_t dummy5; /* 0xfb */ ++ uint8_t dummy6; /* 0xfc */ ++ uint8_t dummy7; /* 0xfd */ ++ uint8_t dummy8; /* 0xfe */ ++ uint8_t dummy9; /* 0xff */ + }; + #pragma pack(pop) + +@@ -271,7 +272,8 @@ void fill_iram_v_2(struct iram_table_v_2 *ram_table, struct dmcu_iram_parameters + { + unsigned int set = params.set; + +- ram_table->flags = 0x0; ++ ram_table->min_abm_backlight = ++ cpu_to_be16(params.min_abm_backlight); + ram_table->deviation_gain = 0xb3; + + ram_table->blRampReduction = +@@ -445,6 +447,9 @@ void fill_iram_v_2_2(struct iram_table_v_2_2 *ram_table, struct dmcu_iram_parame + + ram_table->flags = 0x0; + ++ ram_table->min_abm_backlight = ++ cpu_to_be16(params.min_abm_backlight); ++ + ram_table->deviation_gain[0] = 0xb3; + ram_table->deviation_gain[1] = 0xa8; + ram_table->deviation_gain[2] = 0x98; +@@ -588,6 +593,10 @@ void fill_iram_v_2_3(struct iram_table_v_2_2 *ram_table, struct dmcu_iram_parame + unsigned int set = params.set; + + ram_table->flags = 0x0; ++ ++ ram_table->min_abm_backlight = ++ cpu_to_be16(params.min_abm_backlight); ++ + for (i = 0; i < NUM_AGGR_LEVEL; i++) { + ram_table->hybrid_factor[i] = abm_settings[set][i].brightness_gain; + ram_table->contrast_factor[i] = abm_settings[set][i].contrast_factor; +diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.h b/drivers/gpu/drm/amd/display/modules/power/power_helpers.h +index da5df00fedce..e54157026330 100644 +--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.h ++++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.h +@@ -38,6 +38,7 @@ struct dmcu_iram_parameters { + unsigned int backlight_lut_array_size; + unsigned int backlight_ramping_reduction; + unsigned int backlight_ramping_start; ++ unsigned int min_abm_backlight; + unsigned int set; + }; + +diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c +index 4acf139ea014..58c091ab67b2 100644 +--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c +@@ -1344,7 +1344,10 @@ static int smu_suspend(void *handle) + int ret; + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + struct smu_context *smu = &adev->smu; +- bool baco_feature_is_enabled = smu_feature_is_enabled(smu, SMU_FEATURE_BACO_BIT); ++ bool baco_feature_is_enabled = false; ++ ++ if(!(adev->flags & AMD_IS_APU)) ++ baco_feature_is_enabled = smu_feature_is_enabled(smu, SMU_FEATURE_BACO_BIT); + + ret = smu_system_features_control(smu, false); + if (ret) +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c +index df6ff9252401..b068d1c7b44d 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c +@@ -29,7 +29,7 @@ + #include "vega20_baco.h" + #include "vega20_smumgr.h" + +- ++#include "amdgpu_ras.h" + + static const struct soc15_baco_cmd_entry clean_baco_tbl[] = + { +@@ -74,6 +74,7 @@ int vega20_baco_get_state(struct pp_hwmgr *hwmgr, enum BACO_STATE *state) + int vega20_baco_set_state(struct pp_hwmgr *hwmgr, enum BACO_STATE state) + { + struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); ++ struct amdgpu_ras *ras = amdgpu_ras_get_context(adev); + enum BACO_STATE cur_state; + uint32_t data; + +@@ -84,10 +85,11 @@ int vega20_baco_set_state(struct pp_hwmgr *hwmgr, enum BACO_STATE state) + return 0; + + if (state == BACO_STATE_IN) { +- data = RREG32_SOC15(THM, 0, mmTHM_BACO_CNTL); +- data |= 0x80000000; +- WREG32_SOC15(THM, 0, mmTHM_BACO_CNTL, data); +- ++ if (!ras || !ras->supported) { ++ data = RREG32_SOC15(THM, 0, mmTHM_BACO_CNTL); ++ data |= 0x80000000; ++ WREG32_SOC15(THM, 0, mmTHM_BACO_CNTL, data); ++ } + + if(smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_EnterBaco, 0)) + return -EINVAL; +diff --git a/drivers/gpu/drm/amd/powerplay/renoir_ppt.c b/drivers/gpu/drm/amd/powerplay/renoir_ppt.c +index e62bfba51562..e5283dafc414 100644 +--- a/drivers/gpu/drm/amd/powerplay/renoir_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/renoir_ppt.c +@@ -183,11 +183,13 @@ static int renoir_print_clk_levels(struct smu_context *smu, + int i, size = 0, ret = 0; + uint32_t cur_value = 0, value = 0, count = 0, min = 0, max = 0; + DpmClocks_t *clk_table = smu->smu_table.clocks_table; +- SmuMetrics_t metrics = {0}; ++ SmuMetrics_t metrics; + + if (!clk_table || clk_type >= SMU_CLK_COUNT) + return -EINVAL; + ++ memset(&metrics, 0, sizeof(metrics)); ++ + ret = smu_update_table(smu, SMU_TABLE_SMU_METRICS, 0, + (void *)&metrics, false); + if (ret) +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c +index 624d257da20f..52c42569a111 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c +@@ -250,6 +250,7 @@ komeda_crtc_atomic_enable(struct drm_crtc *crtc, + { + komeda_crtc_prepare(to_kcrtc(crtc)); + drm_crtc_vblank_on(crtc); ++ WARN_ON(drm_crtc_vblank_get(crtc)); + komeda_crtc_do_flush(crtc, old); + } + +@@ -319,6 +320,7 @@ komeda_crtc_atomic_disable(struct drm_crtc *crtc, + } + } + ++ drm_crtc_vblank_put(crtc); + drm_crtc_vblank_off(crtc); + komeda_crtc_unprepare(kcrtc); + } +diff --git a/drivers/gpu/drm/bridge/analogix-anx78xx.c b/drivers/gpu/drm/bridge/analogix-anx78xx.c +index 3c7cc5af735c..56df07cdab68 100644 +--- a/drivers/gpu/drm/bridge/analogix-anx78xx.c ++++ b/drivers/gpu/drm/bridge/analogix-anx78xx.c +@@ -715,7 +715,9 @@ static int anx78xx_init_pdata(struct anx78xx *anx78xx) + /* 1.0V digital core power regulator */ + pdata->dvdd10 = devm_regulator_get(dev, "dvdd10"); + if (IS_ERR(pdata->dvdd10)) { +- DRM_ERROR("DVDD10 regulator not found\n"); ++ if (PTR_ERR(pdata->dvdd10) != -EPROBE_DEFER) ++ DRM_ERROR("DVDD10 regulator not found\n"); ++ + return PTR_ERR(pdata->dvdd10); + } + +@@ -1332,7 +1334,9 @@ static int anx78xx_i2c_probe(struct i2c_client *client, + + err = anx78xx_init_pdata(anx78xx); + if (err) { +- DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ if (err != -EPROBE_DEFER) ++ DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ + return err; + } + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index 521d689413c8..1326f2c734bf 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -36,6 +36,7 @@ + #include "dw-hdmi-cec.h" + #include "dw-hdmi.h" + ++#define DDC_CI_ADDR 0x37 + #define DDC_SEGMENT_ADDR 0x30 + + #define HDMI_EDID_LEN 512 +@@ -398,6 +399,15 @@ static int dw_hdmi_i2c_xfer(struct i2c_adapter *adap, + u8 addr = msgs[0].addr; + int i, ret = 0; + ++ if (addr == DDC_CI_ADDR) ++ /* ++ * The internal I2C controller does not support the multi-byte ++ * read and write operations needed for DDC/CI. ++ * TOFIX: Blacklist the DDC/CI address until we filter out ++ * unsupported I2C operations. ++ */ ++ return -EOPNOTSUPP; ++ + dev_dbg(hdmi->dev, "xfer: num: %d, addr: %#x\n", num, addr); + + for (i = 0; i < num; i++) { +@@ -2023,7 +2033,7 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode) + + /* HDMI Initialization Step E - Configure audio */ + hdmi_clk_regenerator_update_pixel_clock(hdmi); +- hdmi_enable_audio_clk(hdmi, true); ++ hdmi_enable_audio_clk(hdmi, hdmi->audio_enable); + } + + /* not for DVI mode */ +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 6b0177112e18..3f50b8865db4 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -3722,7 +3722,7 @@ cea_db_offsets(const u8 *cea, int *start, int *end) + if (*end < 4 || *end > 127) + return -ERANGE; + } else { +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + } + + return 0; +@@ -4191,7 +4191,7 @@ int drm_edid_to_sad(struct edid *edid, struct cea_sad **sads) + + if (cea_revision(cea) < 3) { + DRM_DEBUG_KMS("SAD: wrong CEA revision\n"); +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + } + + if (cea_db_offsets(cea, &start, &end)) { +@@ -4252,7 +4252,7 @@ int drm_edid_to_speaker_allocation(struct edid *edid, u8 **sadb) + + if (cea_revision(cea) < 3) { + DRM_DEBUG_KMS("SAD: wrong CEA revision\n"); +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + } + + if (cea_db_offsets(cea, &start, &end)) { +diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c +index 1961f713aaab..f8154316a3b0 100644 +--- a/drivers/gpu/drm/drm_mipi_dbi.c ++++ b/drivers/gpu/drm/drm_mipi_dbi.c +@@ -955,7 +955,7 @@ static int mipi_dbi_typec1_command(struct mipi_dbi *dbi, u8 *cmd, + int ret; + + if (mipi_dbi_command_is_read(dbi, *cmd)) +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + + MIPI_DBI_DEBUG_COMMAND(*cmd, parameters, num); + +@@ -1187,8 +1187,7 @@ static ssize_t mipi_dbi_debugfs_command_write(struct file *file, + struct mipi_dbi_dev *dbidev = m->private; + u8 val, cmd = 0, parameters[64]; + char *buf, *pos, *token; +- unsigned int i; +- int ret, idx; ++ int i, ret, idx; + + if (!drm_dev_enter(&dbidev->drm, &idx)) + return -ENODEV; +diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c +index fd1fbc77871f..552ec82e9bc5 100644 +--- a/drivers/gpu/drm/drm_vblank.c ++++ b/drivers/gpu/drm/drm_vblank.c +@@ -1581,7 +1581,7 @@ int drm_wait_vblank_ioctl(struct drm_device *dev, void *data, + unsigned int flags, pipe, high_pipe; + + if (!dev->irq_enabled) +- return -EINVAL; ++ return -EOPNOTSUPP; + + if (vblwait->request.type & _DRM_VBLANK_SIGNAL) + return -EINVAL; +@@ -1838,7 +1838,7 @@ int drm_crtc_get_sequence_ioctl(struct drm_device *dev, void *data, + return -EOPNOTSUPP; + + if (!dev->irq_enabled) +- return -EINVAL; ++ return -EOPNOTSUPP; + + crtc = drm_crtc_find(dev, file_priv, get_seq->crtc_id); + if (!crtc) +@@ -1896,7 +1896,7 @@ int drm_crtc_queue_sequence_ioctl(struct drm_device *dev, void *data, + return -EOPNOTSUPP; + + if (!dev->irq_enabled) +- return -EINVAL; ++ return -EOPNOTSUPP; + + crtc = drm_crtc_find(dev, file_priv, queue_seq->crtc_id); + if (!crtc) +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index bc1565f1822a..09aa73c0f2ad 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -852,6 +852,10 @@ static enum drm_connector_status hdmi_detect(struct drm_connector *connector, + + static void hdmi_connector_destroy(struct drm_connector *connector) + { ++ struct hdmi_context *hdata = connector_to_hdmi(connector); ++ ++ cec_notifier_conn_unregister(hdata->notifier); ++ + drm_connector_unregister(connector); + drm_connector_cleanup(connector); + } +@@ -935,6 +939,7 @@ static int hdmi_create_connector(struct drm_encoder *encoder) + { + struct hdmi_context *hdata = encoder_to_hdmi(encoder); + struct drm_connector *connector = &hdata->connector; ++ struct cec_connector_info conn_info; + int ret; + + connector->interlace_allowed = true; +@@ -957,6 +962,15 @@ static int hdmi_create_connector(struct drm_encoder *encoder) + DRM_DEV_ERROR(hdata->dev, "Failed to attach bridge\n"); + } + ++ cec_fill_conn_info_from_drm(&conn_info, connector); ++ ++ hdata->notifier = cec_notifier_conn_register(hdata->dev, NULL, ++ &conn_info); ++ if (!hdata->notifier) { ++ ret = -ENOMEM; ++ DRM_DEV_ERROR(hdata->dev, "Failed to allocate CEC notifier\n"); ++ } ++ + return ret; + } + +@@ -1528,8 +1542,8 @@ static void hdmi_disable(struct drm_encoder *encoder) + */ + mutex_unlock(&hdata->mutex); + cancel_delayed_work(&hdata->hotplug_work); +- cec_notifier_set_phys_addr(hdata->notifier, +- CEC_PHYS_ADDR_INVALID); ++ if (hdata->notifier) ++ cec_notifier_phys_addr_invalidate(hdata->notifier); + return; + } + +@@ -2006,12 +2020,6 @@ static int hdmi_probe(struct platform_device *pdev) + } + } + +- hdata->notifier = cec_notifier_get(&pdev->dev); +- if (hdata->notifier == NULL) { +- ret = -ENOMEM; +- goto err_hdmiphy; +- } +- + pm_runtime_enable(dev); + + audio_infoframe = &hdata->audio.infoframe; +@@ -2023,7 +2031,7 @@ static int hdmi_probe(struct platform_device *pdev) + + ret = hdmi_register_audio_device(hdata); + if (ret) +- goto err_notifier_put; ++ goto err_rpm_disable; + + ret = component_add(&pdev->dev, &hdmi_component_ops); + if (ret) +@@ -2034,8 +2042,7 @@ static int hdmi_probe(struct platform_device *pdev) + err_unregister_audio: + platform_device_unregister(hdata->audio.pdev); + +-err_notifier_put: +- cec_notifier_put(hdata->notifier); ++err_rpm_disable: + pm_runtime_disable(dev); + + err_hdmiphy: +@@ -2054,12 +2061,10 @@ static int hdmi_remove(struct platform_device *pdev) + struct hdmi_context *hdata = platform_get_drvdata(pdev); + + cancel_delayed_work_sync(&hdata->hotplug_work); +- cec_notifier_set_phys_addr(hdata->notifier, CEC_PHYS_ADDR_INVALID); + + component_del(&pdev->dev, &hdmi_component_ops); + platform_device_unregister(hdata->audio.pdev); + +- cec_notifier_put(hdata->notifier); + pm_runtime_disable(&pdev->dev); + + if (!IS_ERR(hdata->reg_hdmi_en)) +diff --git a/drivers/gpu/drm/gma500/oaktrail_crtc.c b/drivers/gpu/drm/gma500/oaktrail_crtc.c +index 167c10767dd4..900e5499249d 100644 +--- a/drivers/gpu/drm/gma500/oaktrail_crtc.c ++++ b/drivers/gpu/drm/gma500/oaktrail_crtc.c +@@ -129,6 +129,7 @@ static bool mrst_sdvo_find_best_pll(const struct gma_limit_t *limit, + s32 freq_error, min_error = 100000; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.n = limit->n.min; clock.n <= limit->n.max; +@@ -185,6 +186,7 @@ static bool mrst_lvds_find_best_pll(const struct gma_limit_t *limit, + int err = target; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.p1 = limit->p1.min; clock.p1 <= limit->p1.max; +diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c +index ac491a781952..f690793ae2d5 100644 +--- a/drivers/gpu/drm/meson/meson_vclk.c ++++ b/drivers/gpu/drm/meson/meson_vclk.c +@@ -638,13 +638,18 @@ static bool meson_hdmi_pll_validate_params(struct meson_drm *priv, + if (frac >= HDMI_FRAC_MAX_GXBB) + return false; + } else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXM) || +- meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXL) || +- meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { ++ meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXL)) { + /* Empiric supported min/max dividers */ + if (m < 106 || m > 247) + return false; + if (frac >= HDMI_FRAC_MAX_GXL) + return false; ++ } else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { ++ /* Empiric supported min/max dividers */ ++ if (m < 106 || m > 247) ++ return false; ++ if (frac >= HDMI_FRAC_MAX_G12A) ++ return false; + } + + return true; +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +index e686331fa089..691c1a277d91 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +@@ -352,26 +352,26 @@ static void a6xx_get_debugbus(struct msm_gpu *gpu, + cxdbg = ioremap(res->start, resource_size(res)); + + if (cxdbg) { +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_CNTLT, ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_CNTLT, + A6XX_DBGC_CFG_DBGBUS_CNTLT_SEGT(0xf)); + +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_CNTLM, ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_CNTLM, + A6XX_DBGC_CFG_DBGBUS_CNTLM_ENABLE(0xf)); + +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_0, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_1, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_2, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_3, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_0, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_1, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_2, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_3, 0); + +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_BYTEL_0, ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_0, + 0x76543210); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_BYTEL_1, ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_1, + 0xFEDCBA98); + +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_0, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_1, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_2, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_3, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_0, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_1, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_2, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_3, 0); + } + + a6xx_state->debugbus = state_kcalloc(a6xx_state, +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 94dfa2e5a9ab..a442a955f98c 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -1131,6 +1131,16 @@ nouveau_connector_hotplug(struct nvif_notify *notify) + const char *name = connector->name; + struct nouveau_encoder *nv_encoder; + int ret; ++ bool plugged = (rep->mask != NVIF_NOTIFY_CONN_V0_UNPLUG); ++ ++ if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) { ++ NV_DEBUG(drm, "service %s\n", name); ++ drm_dp_cec_irq(&nv_connector->aux); ++ if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) ++ nv50_mstm_service(nv_encoder->dp.mstm); ++ ++ return NVIF_NOTIFY_KEEP; ++ } + + ret = pm_runtime_get(drm->dev->dev); + if (ret == 0) { +@@ -1151,25 +1161,16 @@ nouveau_connector_hotplug(struct nvif_notify *notify) + return NVIF_NOTIFY_DROP; + } + +- if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) { +- NV_DEBUG(drm, "service %s\n", name); +- drm_dp_cec_irq(&nv_connector->aux); +- if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) +- nv50_mstm_service(nv_encoder->dp.mstm); +- } else { +- bool plugged = (rep->mask != NVIF_NOTIFY_CONN_V0_UNPLUG); +- ++ if (!plugged) ++ drm_dp_cec_unset_edid(&nv_connector->aux); ++ NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name); ++ if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) { + if (!plugged) +- drm_dp_cec_unset_edid(&nv_connector->aux); +- NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name); +- if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) { +- if (!plugged) +- nv50_mstm_remove(nv_encoder->dp.mstm); +- } +- +- drm_helper_hpd_irq_event(connector->dev); ++ nv50_mstm_remove(nv_encoder->dp.mstm); + } + ++ drm_helper_hpd_irq_event(connector->dev); ++ + pm_runtime_mark_last_busy(drm->dev->dev); + pm_runtime_put_autosuspend(drm->dev->dev); + return NVIF_NOTIFY_KEEP; +diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +index b5b14aa059ea..2aa89eaecf6f 100644 +--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c ++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +@@ -426,6 +426,7 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c, + return PTR_ERR(ts->dsi); + } + ++ drm_panel_init(&ts->base); + ts->base.dev = dev; + ts->base.funcs = &rpi_touchscreen_funcs; + +diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c +index 5e3e92ea9ea6..3b2612ae931e 100644 +--- a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c ++++ b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c +@@ -381,6 +381,7 @@ static int st7789v_probe(struct spi_device *spi) + spi_set_drvdata(spi, ctx); + ctx->spi = spi; + ++ drm_panel_init(&ctx->panel); + ctx->panel.dev = &spi->dev; + ctx->panel.funcs = &st7789v_drm_funcs; + +diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c +index f39b97ed4ade..2af64459b3d7 100644 +--- a/drivers/gpu/drm/scheduler/sched_main.c ++++ b/drivers/gpu/drm/scheduler/sched_main.c +@@ -632,43 +632,41 @@ static void drm_sched_process_job(struct dma_fence *f, struct dma_fence_cb *cb) + } + + /** +- * drm_sched_cleanup_jobs - destroy finished jobs ++ * drm_sched_get_cleanup_job - fetch the next finished job to be destroyed + * + * @sched: scheduler instance + * +- * Remove all finished jobs from the mirror list and destroy them. ++ * Returns the next finished job from the mirror list (if there is one) ++ * ready for it to be destroyed. + */ +-static void drm_sched_cleanup_jobs(struct drm_gpu_scheduler *sched) ++static struct drm_sched_job * ++drm_sched_get_cleanup_job(struct drm_gpu_scheduler *sched) + { ++ struct drm_sched_job *job; + unsigned long flags; + + /* Don't destroy jobs while the timeout worker is running */ + if (sched->timeout != MAX_SCHEDULE_TIMEOUT && + !cancel_delayed_work(&sched->work_tdr)) +- return; +- ++ return NULL; + +- while (!list_empty(&sched->ring_mirror_list)) { +- struct drm_sched_job *job; ++ spin_lock_irqsave(&sched->job_list_lock, flags); + +- job = list_first_entry(&sched->ring_mirror_list, ++ job = list_first_entry_or_null(&sched->ring_mirror_list, + struct drm_sched_job, node); +- if (!dma_fence_is_signaled(&job->s_fence->finished)) +- break; + +- spin_lock_irqsave(&sched->job_list_lock, flags); ++ if (job && dma_fence_is_signaled(&job->s_fence->finished)) { + /* remove job from ring_mirror_list */ + list_del_init(&job->node); +- spin_unlock_irqrestore(&sched->job_list_lock, flags); +- +- sched->ops->free_job(job); ++ } else { ++ job = NULL; ++ /* queue timeout for next job */ ++ drm_sched_start_timeout(sched); + } + +- /* queue timeout for next job */ +- spin_lock_irqsave(&sched->job_list_lock, flags); +- drm_sched_start_timeout(sched); + spin_unlock_irqrestore(&sched->job_list_lock, flags); + ++ return job; + } + + /** +@@ -708,12 +706,19 @@ static int drm_sched_main(void *param) + struct drm_sched_fence *s_fence; + struct drm_sched_job *sched_job; + struct dma_fence *fence; ++ struct drm_sched_job *cleanup_job = NULL; + + wait_event_interruptible(sched->wake_up_worker, +- (drm_sched_cleanup_jobs(sched), ++ (cleanup_job = drm_sched_get_cleanup_job(sched)) || + (!drm_sched_blocked(sched) && + (entity = drm_sched_select_entity(sched))) || +- kthread_should_stop())); ++ kthread_should_stop()); ++ ++ if (cleanup_job) { ++ sched->ops->free_job(cleanup_job); ++ /* queue timeout for next job */ ++ drm_sched_start_timeout(sched); ++ } + + if (!entity) + continue; +diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +index 1636344ba9ec..f83522717488 100644 +--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c ++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +@@ -437,9 +437,9 @@ static void sun6i_dsi_setup_burst(struct sun6i_dsi *dsi, + SUN6I_DSI_BURST_LINE_SYNC_POINT(SUN6I_DSI_SYNC_POINT)); + + val = SUN6I_DSI_TCON_DRQ_ENABLE_MODE; +- } else if ((mode->hsync_end - mode->hdisplay) > 20) { ++ } else if ((mode->hsync_start - mode->hdisplay) > 20) { + /* Maaaaaagic */ +- u16 drq = (mode->hsync_end - mode->hdisplay) - 20; ++ u16 drq = (mode->hsync_start - mode->hdisplay) - 20; + + drq *= mipi_dsi_pixel_format_to_bpp(device->format); + drq /= 32; +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index e1669ada0a40..75e65d9536d5 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -3200,6 +3200,11 @@ static int tegra_sor_parse_dt(struct tegra_sor *sor) + * earlier + */ + sor->pad = TEGRA_IO_PAD_HDMI_DP0 + sor->index; ++ } else { ++ if (sor->soc->supports_edp) ++ sor->index = 0; ++ else ++ sor->index = 1; + } + + err = of_property_read_u32_array(np, "nvidia,xbar-cfg", xbar_cfg, 5); +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index 98819462f025..f07803699809 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -926,7 +926,8 @@ EXPORT_SYMBOL(ttm_bo_mem_put); + */ + static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo, + struct ttm_mem_type_manager *man, +- struct ttm_mem_reg *mem) ++ struct ttm_mem_reg *mem, ++ bool no_wait_gpu) + { + struct dma_fence *fence; + int ret; +@@ -935,19 +936,22 @@ static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo, + fence = dma_fence_get(man->move); + spin_unlock(&man->move_lock); + +- if (fence) { +- dma_resv_add_shared_fence(bo->base.resv, fence); ++ if (!fence) ++ return 0; + +- ret = dma_resv_reserve_shared(bo->base.resv, 1); +- if (unlikely(ret)) { +- dma_fence_put(fence); +- return ret; +- } ++ if (no_wait_gpu) ++ return -EBUSY; ++ ++ dma_resv_add_shared_fence(bo->base.resv, fence); + +- dma_fence_put(bo->moving); +- bo->moving = fence; ++ ret = dma_resv_reserve_shared(bo->base.resv, 1); ++ if (unlikely(ret)) { ++ dma_fence_put(fence); ++ return ret; + } + ++ dma_fence_put(bo->moving); ++ bo->moving = fence; + return 0; + } + +@@ -978,7 +982,7 @@ static int ttm_bo_mem_force_space(struct ttm_buffer_object *bo, + return ret; + } while (1); + +- return ttm_bo_add_move_fence(bo, man, mem); ++ return ttm_bo_add_move_fence(bo, man, mem, ctx->no_wait_gpu); + } + + static uint32_t ttm_bo_select_caching(struct ttm_mem_type_manager *man, +@@ -1120,14 +1124,18 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo, + if (unlikely(ret)) + goto error; + +- if (mem->mm_node) { +- ret = ttm_bo_add_move_fence(bo, man, mem); +- if (unlikely(ret)) { +- (*man->func->put_node)(man, mem); +- goto error; +- } +- return 0; ++ if (!mem->mm_node) ++ continue; ++ ++ ret = ttm_bo_add_move_fence(bo, man, mem, ctx->no_wait_gpu); ++ if (unlikely(ret)) { ++ (*man->func->put_node)(man, mem); ++ if (ret == -EBUSY) ++ continue; ++ ++ goto error; + } ++ return 0; + } + + for (i = 0; i < placement->num_busy_placement; ++i) { +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index ee7d4e7b0ee3..0853b980bcb3 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -1285,6 +1285,9 @@ static const struct cec_adap_ops vc4_hdmi_cec_adap_ops = { + + static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data) + { ++#ifdef CONFIG_DRM_VC4_HDMI_CEC ++ struct cec_connector_info conn_info; ++#endif + struct platform_device *pdev = to_platform_device(dev); + struct drm_device *drm = dev_get_drvdata(master); + struct vc4_dev *vc4 = drm->dev_private; +@@ -1403,13 +1406,15 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data) + #ifdef CONFIG_DRM_VC4_HDMI_CEC + hdmi->cec_adap = cec_allocate_adapter(&vc4_hdmi_cec_adap_ops, + vc4, "vc4", +- CEC_CAP_TRANSMIT | +- CEC_CAP_LOG_ADDRS | +- CEC_CAP_PASSTHROUGH | +- CEC_CAP_RC, 1); ++ CEC_CAP_DEFAULTS | ++ CEC_CAP_CONNECTOR_INFO, 1); + ret = PTR_ERR_OR_ZERO(hdmi->cec_adap); + if (ret < 0) + goto err_destroy_conn; ++ ++ cec_fill_conn_info_from_drm(&conn_info, hdmi->connector); ++ cec_s_conn_info(hdmi->cec_adap, &conn_info); ++ + HDMI_WRITE(VC4_HDMI_CPU_MASK_SET, 0xffffffff); + value = HDMI_READ(VC4_HDMI_CEC_CNTRL_1); + value &= ~VC4_HDMI_CEC_DIV_CLK_CNT_MASK; +diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c +index 0a88ef11b9d3..a662394f6892 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c ++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c +@@ -463,25 +463,29 @@ out: + } + + static int virtio_gpu_wait_ioctl(struct drm_device *dev, void *data, +- struct drm_file *file) ++ struct drm_file *file) + { + struct drm_virtgpu_3d_wait *args = data; +- struct drm_gem_object *gobj = NULL; +- struct virtio_gpu_object *qobj = NULL; ++ struct drm_gem_object *obj; ++ long timeout = 15 * HZ; + int ret; +- bool nowait = false; + +- gobj = drm_gem_object_lookup(file, args->handle); +- if (gobj == NULL) ++ obj = drm_gem_object_lookup(file, args->handle); ++ if (obj == NULL) + return -ENOENT; + +- qobj = gem_to_virtio_gpu_obj(gobj); +- +- if (args->flags & VIRTGPU_WAIT_NOWAIT) +- nowait = true; +- ret = virtio_gpu_object_wait(qobj, nowait); ++ if (args->flags & VIRTGPU_WAIT_NOWAIT) { ++ ret = dma_resv_test_signaled_rcu(obj->resv, true); ++ } else { ++ ret = dma_resv_wait_timeout_rcu(obj->resv, true, true, ++ timeout); ++ } ++ if (ret == 0) ++ ret = -EBUSY; ++ else if (ret > 0) ++ ret = 0; + +- drm_gem_object_put_unlocked(gobj); ++ drm_gem_object_put_unlocked(obj); + return ret; + } + +diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c +index eaa5c3352c13..22559670faee 100644 +--- a/drivers/gpu/host1x/job.c ++++ b/drivers/gpu/host1x/job.c +@@ -436,7 +436,8 @@ out: + return err; + } + +-static inline int copy_gathers(struct host1x_job *job, struct device *dev) ++static inline int copy_gathers(struct device *host, struct host1x_job *job, ++ struct device *dev) + { + struct host1x_firewall fw; + size_t size = 0; +@@ -459,12 +460,12 @@ static inline int copy_gathers(struct host1x_job *job, struct device *dev) + * Try a non-blocking allocation from a higher priority pools first, + * as awaiting for the allocation here is a major performance hit. + */ +- job->gather_copy_mapped = dma_alloc_wc(dev, size, &job->gather_copy, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, &job->gather_copy, + GFP_NOWAIT); + + /* the higher priority allocation failed, try the generic-blocking */ + if (!job->gather_copy_mapped) +- job->gather_copy_mapped = dma_alloc_wc(dev, size, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, + &job->gather_copy, + GFP_KERNEL); + if (!job->gather_copy_mapped) +@@ -512,7 +513,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev) + goto out; + + if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) { +- err = copy_gathers(job, dev); ++ err = copy_gathers(host->dev, job, dev); + if (err) + goto out; + } +@@ -573,7 +574,7 @@ void host1x_job_unpin(struct host1x_job *job) + job->num_unpins = 0; + + if (job->gather_copy_size) +- dma_free_wc(job->channel->dev, job->gather_copy_size, ++ dma_free_wc(host->dev, job->gather_copy_size, + job->gather_copy_mapped, job->gather_copy); + } + EXPORT_SYMBOL(host1x_job_unpin); +diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c +index 0dfd97bbde9e..ca232ec565e8 100644 +--- a/drivers/hwtracing/intel_th/core.c ++++ b/drivers/hwtracing/intel_th/core.c +@@ -834,9 +834,6 @@ static irqreturn_t intel_th_irq(int irq, void *data) + ret |= d->irq(th->thdev[i]); + } + +- if (ret == IRQ_NONE) +- pr_warn_ratelimited("nobody cared for irq\n"); +- + return ret; + } + +@@ -887,6 +884,7 @@ intel_th_alloc(struct device *dev, struct intel_th_drvdata *drvdata, + + if (th->irq == -1) + th->irq = devres[r].start; ++ th->num_irqs++; + break; + default: + dev_warn(dev, "Unknown resource type %lx\n", +@@ -940,6 +938,9 @@ void intel_th_free(struct intel_th *th) + + th->num_thdevs = 0; + ++ for (i = 0; i < th->num_irqs; i++) ++ devm_free_irq(th->dev, th->irq + i, th); ++ + pm_runtime_get_sync(th->dev); + pm_runtime_forbid(th->dev); + +diff --git a/drivers/hwtracing/intel_th/intel_th.h b/drivers/hwtracing/intel_th/intel_th.h +index 0df480072b6c..6f4f5486fe6d 100644 +--- a/drivers/hwtracing/intel_th/intel_th.h ++++ b/drivers/hwtracing/intel_th/intel_th.h +@@ -261,6 +261,7 @@ enum th_mmio_idx { + * @num_thdevs: number of devices in the @thdev array + * @num_resources: number of resources in the @resource array + * @irq: irq number ++ * @num_irqs: number of IRQs is use + * @id: this Intel TH controller's device ID in the system + * @major: device node major for output devices + */ +@@ -277,6 +278,7 @@ struct intel_th { + unsigned int num_thdevs; + unsigned int num_resources; + int irq; ++ int num_irqs; + + int id; + int major; +diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c +index 6d240dfae9d9..8e48c7458aa3 100644 +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -1676,10 +1676,13 @@ static int intel_th_msc_init(struct msc *msc) + return 0; + } + +-static void msc_win_switch(struct msc *msc) ++static int msc_win_switch(struct msc *msc) + { + struct msc_window *first; + ++ if (list_empty(&msc->win_list)) ++ return -EINVAL; ++ + first = list_first_entry(&msc->win_list, struct msc_window, entry); + + if (msc_is_last_win(msc->cur_win)) +@@ -1691,6 +1694,8 @@ static void msc_win_switch(struct msc *msc) + msc->base_addr = msc_win_base_dma(msc->cur_win); + + intel_th_trace_switch(msc->thdev); ++ ++ return 0; + } + + /** +@@ -2025,16 +2030,15 @@ win_switch_store(struct device *dev, struct device_attribute *attr, + if (val != 1) + return -EINVAL; + ++ ret = -EINVAL; + mutex_lock(&msc->buf_mutex); + /* + * Window switch can only happen in the "multi" mode. + * If a external buffer is engaged, they have the full + * control over window switching. + */ +- if (msc->mode != MSC_MODE_MULTI || msc->mbuf) +- ret = -ENOTSUPP; +- else +- msc_win_switch(msc); ++ if (msc->mode == MSC_MODE_MULTI && !msc->mbuf) ++ ret = msc_win_switch(msc); + mutex_unlock(&msc->buf_mutex); + + return ret ? ret : size; +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index ebf3e30e989a..e9d90b53bbc4 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -204,6 +204,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x06a6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Comet Lake PCH-V */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa3a6), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { + /* Ice Lake NNPI */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5), +@@ -229,6 +234,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Elkhart Lake */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { 0 }, + }; + +diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c +index 5fa78c273a25..65c7c9329b1c 100644 +--- a/drivers/iio/adc/dln2-adc.c ++++ b/drivers/iio/adc/dln2-adc.c +@@ -524,6 +524,10 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + u16 conflict; + unsigned int trigger_chan; + ++ ret = iio_triggered_buffer_postenable(indio_dev); ++ if (ret) ++ return ret; ++ + mutex_lock(&dln2->mutex); + + /* Enable ADC */ +@@ -537,6 +541,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + (int)conflict); + ret = -EBUSY; + } ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + +@@ -550,6 +555,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + if (ret < 0) { + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + } else { +@@ -557,12 +563,12 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + } + +- return iio_triggered_buffer_postenable(indio_dev); ++ return 0; + } + + static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + { +- int ret; ++ int ret, ret2; + struct dln2_adc *dln2 = iio_priv(indio_dev); + + mutex_lock(&dln2->mutex); +@@ -577,12 +583,14 @@ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + ret = dln2_adc_set_port_enabled(dln2, false, NULL); + + mutex_unlock(&dln2->mutex); +- if (ret < 0) { ++ if (ret < 0) + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); +- return ret; +- } + +- return iio_triggered_buffer_predisable(indio_dev); ++ ret2 = iio_triggered_buffer_predisable(indio_dev); ++ if (ret == 0) ++ ret = ret2; ++ ++ return ret; + } + + static const struct iio_buffer_setup_ops dln2_adc_buffer_setup_ops = { +diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c +index 214883458582..e3be8eedd773 100644 +--- a/drivers/iio/adc/max1027.c ++++ b/drivers/iio/adc/max1027.c +@@ -458,6 +458,14 @@ static int max1027_probe(struct spi_device *spi) + return ret; + } + ++ /* Internal reset */ ++ st->reg = MAX1027_RST_REG; ++ ret = spi_write(st->spi, &st->reg, 1); ++ if (ret < 0) { ++ dev_err(&indio_dev->dev, "Failed to reset the ADC\n"); ++ return ret; ++ } ++ + /* Disable averaging */ + st->reg = MAX1027_AVG_REG; + ret = spi_write(st->spi, &st->reg, 1); +diff --git a/drivers/iio/dac/Kconfig b/drivers/iio/dac/Kconfig +index cc42219a64f7..979070196da9 100644 +--- a/drivers/iio/dac/Kconfig ++++ b/drivers/iio/dac/Kconfig +@@ -60,8 +60,8 @@ config AD5446 + help + Say yes here to build support for Analog Devices AD5300, AD5301, AD5310, + AD5311, AD5320, AD5321, AD5444, AD5446, AD5450, AD5451, AD5452, AD5453, +- AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5601, AD5602, AD5611, AD5612, +- AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs ++ AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5600, AD5601, AD5602, AD5611, ++ AD5612, AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs + as well as Texas Instruments DAC081S101, DAC101S101, DAC121S101. + + To compile this driver as a module, choose M here: the +diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c +index 7df8b4cc295d..61c670f7fc5f 100644 +--- a/drivers/iio/dac/ad5446.c ++++ b/drivers/iio/dac/ad5446.c +@@ -327,6 +327,7 @@ enum ad5446_supported_spi_device_ids { + ID_AD5541A, + ID_AD5512A, + ID_AD5553, ++ ID_AD5600, + ID_AD5601, + ID_AD5611, + ID_AD5621, +@@ -381,6 +382,10 @@ static const struct ad5446_chip_info ad5446_spi_chip_info[] = { + .channel = AD5446_CHANNEL(14, 16, 0), + .write = ad5446_write, + }, ++ [ID_AD5600] = { ++ .channel = AD5446_CHANNEL(16, 16, 0), ++ .write = ad5446_write, ++ }, + [ID_AD5601] = { + .channel = AD5446_CHANNEL_POWERDOWN(8, 16, 6), + .write = ad5446_write, +@@ -448,6 +453,7 @@ static const struct spi_device_id ad5446_spi_ids[] = { + {"ad5542a", ID_AD5541A}, /* ad5541a and ad5542a are compatible */ + {"ad5543", ID_AD5541A}, /* ad5541a and ad5543 are compatible */ + {"ad5553", ID_AD5553}, ++ {"ad5600", ID_AD5600}, + {"ad5601", ID_AD5601}, + {"ad5611", ID_AD5611}, + {"ad5621", ID_AD5621}, +diff --git a/drivers/iio/light/bh1750.c b/drivers/iio/light/bh1750.c +index 28347df78cff..adb5ab9e3439 100644 +--- a/drivers/iio/light/bh1750.c ++++ b/drivers/iio/light/bh1750.c +@@ -59,9 +59,9 @@ struct bh1750_chip_info { + + u16 int_time_low_mask; + u16 int_time_high_mask; +-} ++}; + +-static const bh1750_chip_info_tbl[] = { ++static const struct bh1750_chip_info bh1750_chip_info_tbl[] = { + [BH1710] = { 140, 1022, 300, 400, 250000000, 2, 0x001F, 0x03E0 }, + [BH1721] = { 140, 1020, 300, 400, 250000000, 2, 0x0010, 0x03E0 }, + [BH1750] = { 31, 254, 69, 1740, 57500000, 1, 0x001F, 0x00E0 }, +diff --git a/drivers/iio/pressure/cros_ec_baro.c b/drivers/iio/pressure/cros_ec_baro.c +index 2354302375de..52f53f3123b1 100644 +--- a/drivers/iio/pressure/cros_ec_baro.c ++++ b/drivers/iio/pressure/cros_ec_baro.c +@@ -114,6 +114,7 @@ static int cros_ec_baro_write(struct iio_dev *indio_dev, + static const struct iio_info cros_ec_baro_info = { + .read_raw = &cros_ec_baro_read, + .write_raw = &cros_ec_baro_write, ++ .read_avail = &cros_ec_sensors_core_read_avail, + }; + + static int cros_ec_baro_probe(struct platform_device *pdev) +@@ -149,6 +150,8 @@ static int cros_ec_baro_probe(struct platform_device *pdev) + BIT(IIO_CHAN_INFO_SCALE) | + BIT(IIO_CHAN_INFO_SAMP_FREQ) | + BIT(IIO_CHAN_INFO_FREQUENCY); ++ channel->info_mask_shared_by_all_available = ++ BIT(IIO_CHAN_INFO_SAMP_FREQ); + channel->scan_type.realbits = CROS_EC_SENSOR_BITS; + channel->scan_type.storagebits = CROS_EC_SENSOR_BITS; + channel->scan_type.shift = 0; +diff --git a/drivers/iio/temperature/max31856.c b/drivers/iio/temperature/max31856.c +index f184ba5601d9..73ed550e3fc9 100644 +--- a/drivers/iio/temperature/max31856.c ++++ b/drivers/iio/temperature/max31856.c +@@ -284,6 +284,8 @@ static int max31856_probe(struct spi_device *spi) + spi_set_drvdata(spi, indio_dev); + + indio_dev->info = &max31856_info; ++ indio_dev->dev.parent = &spi->dev; ++ indio_dev->dev.of_node = spi->dev.of_node; + indio_dev->name = id->name; + indio_dev->modes = INDIO_DIRECT_MODE; + indio_dev->channels = max31856_channels; +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index 50a92442c4f7..2b5bd7206fc6 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -1199,9 +1199,21 @@ static void setup_dma_device(struct ib_device *device) + WARN_ON_ONCE(!parent); + device->dma_device = parent; + } +- /* Setup default max segment size for all IB devices */ +- dma_set_max_seg_size(device->dma_device, SZ_2G); + ++ if (!device->dev.dma_parms) { ++ if (parent) { ++ /* ++ * The caller did not provide DMA parameters, so ++ * 'parent' probably represents a PCI device. The PCI ++ * core sets the maximum segment size to 64 ++ * KB. Increase this parameter to 2 GB. ++ */ ++ device->dev.dma_parms = parent->dma_parms; ++ dma_set_max_seg_size(device->dma_device, SZ_2G); ++ } else { ++ WARN_ON_ONCE(true); ++ } ++ } + } + + /* +@@ -2397,8 +2409,12 @@ int ib_modify_port(struct ib_device *device, + rc = device->ops.modify_port(device, port_num, + port_modify_mask, + port_modify); ++ else if (rdma_protocol_roce(device, port_num) && ++ ((port_modify->set_port_cap_mask & ~IB_PORT_CM_SUP) == 0 || ++ (port_modify->clr_port_cap_mask & ~IB_PORT_CM_SUP) == 0)) ++ rc = 0; + else +- rc = rdma_protocol_roce(device, port_num) ? 0 : -ENOSYS; ++ rc = -EOPNOTSUPP; + return rc; + } + EXPORT_SYMBOL(ib_modify_port); +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 30a54f8aa42c..27e2df44d043 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -477,6 +477,7 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev, + bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_STAT_CTX_ALLOC, -1, -1); + req.update_period_ms = cpu_to_le32(1000); + req.stats_dma_addr = cpu_to_le64(dma_map); ++ req.stats_dma_length = cpu_to_le16(sizeof(struct ctx_hw_stats_ext)); + req.stat_ctx_flags = STAT_CTX_ALLOC_REQ_STAT_CTX_FLAGS_ROCE; + bnxt_re_fill_fw_msg(&fw_msg, (void *)&req, sizeof(req), (void *)&resp, + sizeof(resp), DFLT_HWRM_CMD_TIMEOUT); +@@ -1270,10 +1271,10 @@ static void bnxt_re_query_hwrm_intf_version(struct bnxt_re_dev *rdev) + return; + } + rdev->qplib_ctx.hwrm_intf_ver = +- (u64)resp.hwrm_intf_major << 48 | +- (u64)resp.hwrm_intf_minor << 32 | +- (u64)resp.hwrm_intf_build << 16 | +- resp.hwrm_intf_patch; ++ (u64)le16_to_cpu(resp.hwrm_intf_major) << 48 | ++ (u64)le16_to_cpu(resp.hwrm_intf_minor) << 32 | ++ (u64)le16_to_cpu(resp.hwrm_intf_build) << 16 | ++ le16_to_cpu(resp.hwrm_intf_patch); + } + + static void bnxt_re_ib_unreg(struct bnxt_re_dev *rdev) +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h +index fbda11a7ab1a..aaa76d792185 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h +@@ -186,7 +186,9 @@ struct bnxt_qplib_chip_ctx { + u8 chip_metal; + }; + +-#define CHIP_NUM_57500 0x1750 ++#define CHIP_NUM_57508 0x1750 ++#define CHIP_NUM_57504 0x1751 ++#define CHIP_NUM_57502 0x1752 + + struct bnxt_qplib_res { + struct pci_dev *pdev; +@@ -203,7 +205,9 @@ struct bnxt_qplib_res { + + static inline bool bnxt_qplib_is_chip_gen_p5(struct bnxt_qplib_chip_ctx *cctx) + { +- return (cctx->chip_num == CHIP_NUM_57500); ++ return (cctx->chip_num == CHIP_NUM_57508 || ++ cctx->chip_num == CHIP_NUM_57504 || ++ cctx->chip_num == CHIP_NUM_57502); + } + + static inline u8 bnxt_qplib_get_hwq_type(struct bnxt_qplib_res *res) +diff --git a/drivers/infiniband/hw/efa/efa_com.c b/drivers/infiniband/hw/efa/efa_com.c +index 3c412bc5b94f..0778f4f7dccd 100644 +--- a/drivers/infiniband/hw/efa/efa_com.c ++++ b/drivers/infiniband/hw/efa/efa_com.c +@@ -317,6 +317,7 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queu + struct efa_admin_acq_entry *comp, + size_t comp_size_in_bytes) + { ++ struct efa_admin_aq_entry *aqe; + struct efa_comp_ctx *comp_ctx; + u16 queue_size_mask; + u16 cmd_id; +@@ -350,7 +351,9 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queu + + reinit_completion(&comp_ctx->wait_event); + +- memcpy(&aq->sq.entries[pi], cmd, cmd_size_in_bytes); ++ aqe = &aq->sq.entries[pi]; ++ memset(aqe, 0, sizeof(*aqe)); ++ memcpy(aqe, cmd, cmd_size_in_bytes); + + aq->sq.pc++; + atomic64_inc(&aq->stats.submitted_cmd); +diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c +index 0a31d0a3d657..06871731ac43 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_restrack.c ++++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c +@@ -98,11 +98,15 @@ static int hns_roce_fill_res_cq_entry(struct sk_buff *msg, + goto err; + + table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER); +- if (!table_attr) ++ if (!table_attr) { ++ ret = -EMSGSIZE; + goto err; ++ } + +- if (hns_roce_fill_cq(msg, context)) ++ if (hns_roce_fill_cq(msg, context)) { ++ ret = -EMSGSIZE; + goto err_cancel_table; ++ } + + nla_nest_end(msg, table_attr); + kfree(context); +@@ -113,7 +117,7 @@ err_cancel_table: + nla_nest_cancel(msg, table_attr); + err: + kfree(context); +- return -EMSGSIZE; ++ return ret; + } + + int hns_roce_fill_res_entry(struct sk_buff *msg, +diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c +index 43ea2c13b212..108667ae6b14 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_srq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c +@@ -180,8 +180,7 @@ static int create_user_srq(struct hns_roce_srq *srq, struct ib_udata *udata, + { + struct hns_roce_dev *hr_dev = to_hr_dev(srq->ibsrq.device); + struct hns_roce_ib_create_srq ucmd; +- u32 page_shift; +- u32 npages; ++ struct hns_roce_buf *buf; + int ret; + + if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) +@@ -191,11 +190,13 @@ static int create_user_srq(struct hns_roce_srq *srq, struct ib_udata *udata, + if (IS_ERR(srq->umem)) + return PTR_ERR(srq->umem); + +- npages = (ib_umem_page_count(srq->umem) + +- (1 << hr_dev->caps.srqwqe_buf_pg_sz) - 1) / +- (1 << hr_dev->caps.srqwqe_buf_pg_sz); +- page_shift = PAGE_SHIFT + hr_dev->caps.srqwqe_buf_pg_sz; +- ret = hns_roce_mtt_init(hr_dev, npages, page_shift, &srq->mtt); ++ buf = &srq->buf; ++ buf->npages = (ib_umem_page_count(srq->umem) + ++ (1 << hr_dev->caps.srqwqe_buf_pg_sz) - 1) / ++ (1 << hr_dev->caps.srqwqe_buf_pg_sz); ++ buf->page_shift = PAGE_SHIFT + hr_dev->caps.srqwqe_buf_pg_sz; ++ ret = hns_roce_mtt_init(hr_dev, buf->npages, buf->page_shift, ++ &srq->mtt); + if (ret) + goto err_user_buf; + +@@ -212,9 +213,12 @@ static int create_user_srq(struct hns_roce_srq *srq, struct ib_udata *udata, + goto err_user_srq_mtt; + } + +- ret = hns_roce_mtt_init(hr_dev, ib_umem_page_count(srq->idx_que.umem), +- PAGE_SHIFT, &srq->idx_que.mtt); +- ++ buf = &srq->idx_que.idx_buf; ++ buf->npages = DIV_ROUND_UP(ib_umem_page_count(srq->idx_que.umem), ++ 1 << hr_dev->caps.idx_buf_pg_sz); ++ buf->page_shift = PAGE_SHIFT + hr_dev->caps.idx_buf_pg_sz; ++ ret = hns_roce_mtt_init(hr_dev, buf->npages, buf->page_shift, ++ &srq->idx_que.mtt); + if (ret) { + dev_err(hr_dev->dev, "hns_roce_mtt_init error for idx que\n"); + goto err_user_idx_mtt; +diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c +index dc71b6e16a07..b462eaca1ee3 100644 +--- a/drivers/infiniband/hw/qedr/main.c ++++ b/drivers/infiniband/hw/qedr/main.c +@@ -357,6 +357,7 @@ static int qedr_alloc_resources(struct qedr_dev *dev) + return -ENOMEM; + + spin_lock_init(&dev->sgid_lock); ++ xa_init_flags(&dev->srqs, XA_FLAGS_LOCK_IRQ); + + if (IS_IWARP(dev)) { + xa_init_flags(&dev->qps, XA_FLAGS_LOCK_IRQ); +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 6f3ce86019b7..a7ccca3c4f89 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1577,6 +1577,14 @@ static void qedr_cleanup_user(struct qedr_dev *dev, struct qedr_qp *qp) + + ib_umem_release(qp->urq.umem); + qp->urq.umem = NULL; ++ ++ if (rdma_protocol_roce(&dev->ibdev, 1)) { ++ qedr_free_pbl(dev, &qp->usq.pbl_info, qp->usq.pbl_tbl); ++ qedr_free_pbl(dev, &qp->urq.pbl_info, qp->urq.pbl_tbl); ++ } else { ++ kfree(qp->usq.pbl_tbl); ++ kfree(qp->urq.pbl_tbl); ++ } + } + + static int qedr_create_user_qp(struct qedr_dev *dev, +@@ -2673,8 +2681,8 @@ int qedr_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata) + + dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid); + +- if ((mr->type != QEDR_MR_DMA) && (mr->type != QEDR_MR_FRMR)) +- qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table); ++ if (mr->type != QEDR_MR_DMA) ++ free_mr_info(dev, &mr->info); + + /* it could be user registered memory. */ + ib_umem_release(mr->umem); +diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c +index 05a92f997f60..fb01407a310f 100644 +--- a/drivers/infiniband/sw/siw/siw_main.c ++++ b/drivers/infiniband/sw/siw/siw_main.c +@@ -248,24 +248,6 @@ static struct ib_qp *siw_get_base_qp(struct ib_device *base_dev, int id) + return NULL; + } + +-static void siw_verbs_sq_flush(struct ib_qp *base_qp) +-{ +- struct siw_qp *qp = to_siw_qp(base_qp); +- +- down_write(&qp->state_lock); +- siw_sq_flush(qp); +- up_write(&qp->state_lock); +-} +- +-static void siw_verbs_rq_flush(struct ib_qp *base_qp) +-{ +- struct siw_qp *qp = to_siw_qp(base_qp); +- +- down_write(&qp->state_lock); +- siw_rq_flush(qp); +- up_write(&qp->state_lock); +-} +- + static const struct ib_device_ops siw_device_ops = { + .owner = THIS_MODULE, + .uverbs_abi_ver = SIW_ABI_VERSION, +@@ -284,8 +266,6 @@ static const struct ib_device_ops siw_device_ops = { + .destroy_cq = siw_destroy_cq, + .destroy_qp = siw_destroy_qp, + .destroy_srq = siw_destroy_srq, +- .drain_rq = siw_verbs_rq_flush, +- .drain_sq = siw_verbs_sq_flush, + .get_dma_mr = siw_get_dma_mr, + .get_port_immutable = siw_get_port_immutable, + .iw_accept = siw_accept, +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index b18a677832e1..1b1a40db529c 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -685,6 +685,47 @@ static int siw_copy_inline_sgl(const struct ib_send_wr *core_wr, + return bytes; + } + ++/* Complete SQ WR's without processing */ ++static int siw_sq_flush_wr(struct siw_qp *qp, const struct ib_send_wr *wr, ++ const struct ib_send_wr **bad_wr) ++{ ++ struct siw_sqe sqe = {}; ++ int rv = 0; ++ ++ while (wr) { ++ sqe.id = wr->wr_id; ++ sqe.opcode = wr->opcode; ++ rv = siw_sqe_complete(qp, &sqe, 0, SIW_WC_WR_FLUSH_ERR); ++ if (rv) { ++ if (bad_wr) ++ *bad_wr = wr; ++ break; ++ } ++ wr = wr->next; ++ } ++ return rv; ++} ++ ++/* Complete RQ WR's without processing */ ++static int siw_rq_flush_wr(struct siw_qp *qp, const struct ib_recv_wr *wr, ++ const struct ib_recv_wr **bad_wr) ++{ ++ struct siw_rqe rqe = {}; ++ int rv = 0; ++ ++ while (wr) { ++ rqe.id = wr->wr_id; ++ rv = siw_rqe_complete(qp, &rqe, 0, 0, SIW_WC_WR_FLUSH_ERR); ++ if (rv) { ++ if (bad_wr) ++ *bad_wr = wr; ++ break; ++ } ++ wr = wr->next; ++ } ++ return rv; ++} ++ + /* + * siw_post_send() + * +@@ -703,26 +744,54 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + unsigned long flags; + int rv = 0; + ++ if (wr && !qp->kernel_verbs) { ++ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); ++ *bad_wr = wr; ++ return -EINVAL; ++ } ++ + /* + * Try to acquire QP state lock. Must be non-blocking + * to accommodate kernel clients needs. + */ + if (!down_read_trylock(&qp->state_lock)) { +- *bad_wr = wr; +- siw_dbg_qp(qp, "QP locked, state %d\n", qp->attrs.state); +- return -ENOTCONN; ++ if (qp->attrs.state == SIW_QP_STATE_ERROR) { ++ /* ++ * ERROR state is final, so we can be sure ++ * this state will not change as long as the QP ++ * exists. ++ * ++ * This handles an ib_drain_sq() call with ++ * a concurrent request to set the QP state ++ * to ERROR. ++ */ ++ rv = siw_sq_flush_wr(qp, wr, bad_wr); ++ } else { ++ siw_dbg_qp(qp, "QP locked, state %d\n", ++ qp->attrs.state); ++ *bad_wr = wr; ++ rv = -ENOTCONN; ++ } ++ return rv; + } + if (unlikely(qp->attrs.state != SIW_QP_STATE_RTS)) { ++ if (qp->attrs.state == SIW_QP_STATE_ERROR) { ++ /* ++ * Immediately flush this WR to CQ, if QP ++ * is in ERROR state. SQ is guaranteed to ++ * be empty, so WR complets in-order. ++ * ++ * Typically triggered by ib_drain_sq(). ++ */ ++ rv = siw_sq_flush_wr(qp, wr, bad_wr); ++ } else { ++ siw_dbg_qp(qp, "QP out of state %d\n", ++ qp->attrs.state); ++ *bad_wr = wr; ++ rv = -ENOTCONN; ++ } + up_read(&qp->state_lock); +- *bad_wr = wr; +- siw_dbg_qp(qp, "QP out of state %d\n", qp->attrs.state); +- return -ENOTCONN; +- } +- if (wr && !qp->kernel_verbs) { +- siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +- up_read(&qp->state_lock); +- *bad_wr = wr; +- return -EINVAL; ++ return rv; + } + spin_lock_irqsave(&qp->sq_lock, flags); + +@@ -917,24 +986,54 @@ int siw_post_receive(struct ib_qp *base_qp, const struct ib_recv_wr *wr, + *bad_wr = wr; + return -EOPNOTSUPP; /* what else from errno.h? */ + } ++ if (!qp->kernel_verbs) { ++ siw_dbg_qp(qp, "no kernel post_recv for user mapped sq\n"); ++ *bad_wr = wr; ++ return -EINVAL; ++ } ++ + /* + * Try to acquire QP state lock. Must be non-blocking + * to accommodate kernel clients needs. + */ + if (!down_read_trylock(&qp->state_lock)) { +- *bad_wr = wr; +- return -ENOTCONN; +- } +- if (!qp->kernel_verbs) { +- siw_dbg_qp(qp, "no kernel post_recv for user mapped sq\n"); +- up_read(&qp->state_lock); +- *bad_wr = wr; +- return -EINVAL; ++ if (qp->attrs.state == SIW_QP_STATE_ERROR) { ++ /* ++ * ERROR state is final, so we can be sure ++ * this state will not change as long as the QP ++ * exists. ++ * ++ * This handles an ib_drain_rq() call with ++ * a concurrent request to set the QP state ++ * to ERROR. ++ */ ++ rv = siw_rq_flush_wr(qp, wr, bad_wr); ++ } else { ++ siw_dbg_qp(qp, "QP locked, state %d\n", ++ qp->attrs.state); ++ *bad_wr = wr; ++ rv = -ENOTCONN; ++ } ++ return rv; + } + if (qp->attrs.state > SIW_QP_STATE_RTS) { ++ if (qp->attrs.state == SIW_QP_STATE_ERROR) { ++ /* ++ * Immediately flush this WR to CQ, if QP ++ * is in ERROR state. RQ is guaranteed to ++ * be empty, so WR complets in-order. ++ * ++ * Typically triggered by ib_drain_rq(). ++ */ ++ rv = siw_rq_flush_wr(qp, wr, bad_wr); ++ } else { ++ siw_dbg_qp(qp, "QP out of state %d\n", ++ qp->attrs.state); ++ *bad_wr = wr; ++ rv = -ENOTCONN; ++ } + up_read(&qp->state_lock); +- *bad_wr = wr; +- return -EINVAL; ++ return rv; + } + /* + * Serialize potentially multiple producers. +diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c +index 2e72fc5af157..c4c015c60446 100644 +--- a/drivers/infiniband/ulp/iser/iscsi_iser.c ++++ b/drivers/infiniband/ulp/iser/iscsi_iser.c +@@ -646,6 +646,7 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, + if (ib_conn->pi_support) { + u32 sig_caps = ib_dev->attrs.sig_prot_cap; + ++ shost->sg_prot_tablesize = shost->sg_tablesize; + scsi_host_set_prot(shost, iser_dif_prot_caps(sig_caps)); + scsi_host_set_guard(shost, SHOST_DIX_GUARD_IP | + SHOST_DIX_GUARD_CRC); +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 6db6d969e31c..4ce797d4259f 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -5447,9 +5447,6 @@ static int intel_iommu_map(struct iommu_domain *domain, + int prot = 0; + int ret; + +- if (dmar_domain->flags & DOMAIN_FLAG_LOSE_CHILDREN) +- return -EINVAL; +- + if (iommu_prot & IOMMU_READ) + prot |= DMA_PTE_READ; + if (iommu_prot & IOMMU_WRITE) +@@ -5492,8 +5489,6 @@ static size_t intel_iommu_unmap(struct iommu_domain *domain, + /* Cope with horrid API which requires us to unmap more than the + size argument if it happens to be a large-page mapping. */ + BUG_ON(!pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level)); +- if (dmar_domain->flags & DOMAIN_FLAG_LOSE_CHILDREN) +- return 0; + + if (size < VTD_PAGE_SIZE << level_to_offset_bits(level)) + size = VTD_PAGE_SIZE << level_to_offset_bits(level); +@@ -5525,9 +5520,6 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain, + int level = 0; + u64 phys = 0; + +- if (dmar_domain->flags & DOMAIN_FLAG_LOSE_CHILDREN) +- return 0; +- + pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level); + if (pte) + phys = dma_pte_addr(pte); +@@ -5705,8 +5697,8 @@ static void intel_iommu_get_resv_regions(struct device *device, + struct pci_dev *pdev = to_pci_dev(device); + + if ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA) { +- reg = iommu_alloc_resv_region(0, 1UL << 24, 0, +- IOMMU_RESV_DIRECT); ++ reg = iommu_alloc_resv_region(0, 1UL << 24, prot, ++ IOMMU_RESV_DIRECT_RELAXABLE); + if (reg) + list_add_tail(®->list, head); + } +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index d658c7c6a2ab..24248aa8a7e5 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -312,8 +312,8 @@ int iommu_insert_resv_region(struct iommu_resv_region *new, + list_for_each_entry_safe(iter, tmp, regions, list) { + phys_addr_t top_end, iter_end = iter->start + iter->length - 1; + +- /* no merge needed on elements of different types than @nr */ +- if (iter->type != nr->type) { ++ /* no merge needed on elements of different types than @new */ ++ if (iter->type != new->type) { + list_move_tail(&iter->list, &stack); + continue; + } +@@ -2221,13 +2221,13 @@ request_default_domain_for_dev(struct device *dev, unsigned long type) + goto out; + } + +- iommu_group_create_direct_mappings(group, dev); +- + /* Make the domain the default for this group */ + if (group->default_domain) + iommu_domain_free(group->default_domain); + group->default_domain = domain; + ++ iommu_group_create_direct_mappings(group, dev); ++ + dev_info(dev, "Using iommu %s mapping\n", + type == IOMMU_DOMAIN_DMA ? "dma" : "direct"); + +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c +index 6f776823b9ba..a1df0d95151c 100644 +--- a/drivers/md/bcache/alloc.c ++++ b/drivers/md/bcache/alloc.c +@@ -377,7 +377,10 @@ retry_invalidate: + if (!fifo_full(&ca->free_inc)) + goto retry_invalidate; + +- bch_prio_write(ca); ++ if (bch_prio_write(ca, false) < 0) { ++ ca->invalidate_needs_gc = 1; ++ wake_up_gc(ca->set); ++ } + } + } + out: +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h +index 013e35a9e317..deb924e1d790 100644 +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -977,7 +977,7 @@ bool bch_cached_dev_error(struct cached_dev *dc); + __printf(2, 3) + bool bch_cache_set_error(struct cache_set *c, const char *fmt, ...); + +-void bch_prio_write(struct cache *ca); ++int bch_prio_write(struct cache *ca, bool wait); + void bch_write_bdev_super(struct cached_dev *dc, struct closure *parent); + + extern struct workqueue_struct *bcache_wq; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 20ed838e9413..64999c7a8033 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -529,12 +529,29 @@ static void prio_io(struct cache *ca, uint64_t bucket, int op, + closure_sync(cl); + } + +-void bch_prio_write(struct cache *ca) ++int bch_prio_write(struct cache *ca, bool wait) + { + int i; + struct bucket *b; + struct closure cl; + ++ pr_debug("free_prio=%zu, free_none=%zu, free_inc=%zu", ++ fifo_used(&ca->free[RESERVE_PRIO]), ++ fifo_used(&ca->free[RESERVE_NONE]), ++ fifo_used(&ca->free_inc)); ++ ++ /* ++ * Pre-check if there are enough free buckets. In the non-blocking ++ * scenario it's better to fail early rather than starting to allocate ++ * buckets and do a cleanup later in case of failure. ++ */ ++ if (!wait) { ++ size_t avail = fifo_used(&ca->free[RESERVE_PRIO]) + ++ fifo_used(&ca->free[RESERVE_NONE]); ++ if (prio_buckets(ca) > avail) ++ return -ENOMEM; ++ } ++ + closure_init_stack(&cl); + + lockdep_assert_held(&ca->set->bucket_lock); +@@ -544,9 +561,6 @@ void bch_prio_write(struct cache *ca) + atomic_long_add(ca->sb.bucket_size * prio_buckets(ca), + &ca->meta_sectors_written); + +- //pr_debug("free %zu, free_inc %zu, unused %zu", fifo_used(&ca->free), +- // fifo_used(&ca->free_inc), fifo_used(&ca->unused)); +- + for (i = prio_buckets(ca) - 1; i >= 0; --i) { + long bucket; + struct prio_set *p = ca->disk_buckets; +@@ -564,7 +578,7 @@ void bch_prio_write(struct cache *ca) + p->magic = pset_magic(&ca->sb); + p->csum = bch_crc64(&p->magic, bucket_bytes(ca) - 8); + +- bucket = bch_bucket_alloc(ca, RESERVE_PRIO, true); ++ bucket = bch_bucket_alloc(ca, RESERVE_PRIO, wait); + BUG_ON(bucket == -1); + + mutex_unlock(&ca->set->bucket_lock); +@@ -593,6 +607,7 @@ void bch_prio_write(struct cache *ca) + + ca->prio_last_buckets[i] = ca->prio_buckets[i]; + } ++ return 0; + } + + static void prio_read(struct cache *ca, uint64_t bucket) +@@ -761,20 +776,28 @@ static inline int idx_to_first_minor(int idx) + + static void bcache_device_free(struct bcache_device *d) + { ++ struct gendisk *disk = d->disk; ++ + lockdep_assert_held(&bch_register_lock); + +- pr_info("%s stopped", d->disk->disk_name); ++ if (disk) ++ pr_info("%s stopped", disk->disk_name); ++ else ++ pr_err("bcache device (NULL gendisk) stopped"); + + if (d->c) + bcache_device_detach(d); +- if (d->disk && d->disk->flags & GENHD_FL_UP) +- del_gendisk(d->disk); +- if (d->disk && d->disk->queue) +- blk_cleanup_queue(d->disk->queue); +- if (d->disk) { ++ ++ if (disk) { ++ if (disk->flags & GENHD_FL_UP) ++ del_gendisk(disk); ++ ++ if (disk->queue) ++ blk_cleanup_queue(disk->queue); ++ + ida_simple_remove(&bcache_device_idx, +- first_minor_to_idx(d->disk->first_minor)); +- put_disk(d->disk); ++ first_minor_to_idx(disk->first_minor)); ++ put_disk(disk); + } + + bioset_exit(&d->bio_split); +@@ -1954,7 +1977,7 @@ static int run_cache_set(struct cache_set *c) + + mutex_lock(&c->bucket_lock); + for_each_cache(ca, c, i) +- bch_prio_write(ca); ++ bch_prio_write(ca, true); + mutex_unlock(&c->bucket_lock); + + err = "cannot allocate new UUID bucket"; +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index b092c7b5282f..3ad18246fcb3 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2139,6 +2139,7 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks, + memcpy(page_address(store.sb_page), + page_address(bitmap->storage.sb_page), + sizeof(bitmap_super_t)); ++ spin_lock_irq(&bitmap->counts.lock); + md_bitmap_file_unmap(&bitmap->storage); + bitmap->storage = store; + +@@ -2154,7 +2155,6 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks, + blocks = min(old_counts.chunks << old_counts.chunkshift, + chunks << chunkshift); + +- spin_lock_irq(&bitmap->counts.lock); + /* For cluster raid, need to pre-allocate bitmap */ + if (mddev_is_clustered(bitmap->mddev)) { + unsigned long page; +diff --git a/drivers/md/md.c b/drivers/md/md.c +index b8dd56b746da..805b33e27496 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1105,6 +1105,7 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor + char b[BDEVNAME_SIZE], b2[BDEVNAME_SIZE]; + mdp_super_t *sb; + int ret; ++ bool spare_disk = true; + + /* + * Calculate the position of the superblock (512byte sectors), +@@ -1155,8 +1156,18 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor + else + rdev->desc_nr = sb->this_disk.number; + ++ /* not spare disk, or LEVEL_MULTIPATH */ ++ if (sb->level == LEVEL_MULTIPATH || ++ (rdev->desc_nr >= 0 && ++ sb->disks[rdev->desc_nr].state & ++ ((1<sb_page); +@@ -1172,7 +1183,8 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor + } + ev1 = md_event(sb); + ev2 = md_event(refsb); +- if (ev1 > ev2) ++ ++ if (!spare_disk && ev1 > ev2) + ret = 1; + else + ret = 0; +@@ -1532,6 +1544,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ + sector_t sectors; + char b[BDEVNAME_SIZE], b2[BDEVNAME_SIZE]; + int bmask; ++ bool spare_disk = true; + + /* + * Calculate the position of the superblock in 512byte sectors. +@@ -1665,8 +1678,19 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ + sb->level != 0) + return -EINVAL; + ++ /* not spare disk, or LEVEL_MULTIPATH */ ++ if (sb->level == cpu_to_le32(LEVEL_MULTIPATH) || ++ (rdev->desc_nr >= 0 && ++ rdev->desc_nr < le32_to_cpu(sb->max_dev) && ++ (le16_to_cpu(sb->dev_roles[rdev->desc_nr]) < MD_DISK_ROLE_MAX || ++ le16_to_cpu(sb->dev_roles[rdev->desc_nr]) == MD_DISK_ROLE_JOURNAL))) ++ spare_disk = false; ++ + if (!refdev) { +- ret = 1; ++ if (!spare_disk) ++ ret = 1; ++ else ++ ret = 0; + } else { + __u64 ev1, ev2; + struct mdp_superblock_1 *refsb = page_address(refdev->sb_page); +@@ -1683,7 +1707,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ + ev1 = le64_to_cpu(sb->events); + ev2 = le64_to_cpu(refsb->events); + +- if (ev1 > ev2) ++ if (!spare_disk && ev1 > ev2) + ret = 1; + else + ret = 0; +@@ -3604,7 +3628,7 @@ abort_free: + * Check a full RAID array for plausibility + */ + +-static void analyze_sbs(struct mddev *mddev) ++static int analyze_sbs(struct mddev *mddev) + { + int i; + struct md_rdev *rdev, *freshest, *tmp; +@@ -3625,6 +3649,12 @@ static void analyze_sbs(struct mddev *mddev) + md_kick_rdev_from_array(rdev); + } + ++ /* Cannot find a valid fresh disk */ ++ if (!freshest) { ++ pr_warn("md: cannot find a valid disk\n"); ++ return -EINVAL; ++ } ++ + super_types[mddev->major_version]. + validate_super(mddev, freshest); + +@@ -3659,6 +3689,8 @@ static void analyze_sbs(struct mddev *mddev) + clear_bit(In_sync, &rdev->flags); + } + } ++ ++ return 0; + } + + /* Read a fixed-point number. +@@ -5577,7 +5609,9 @@ int md_run(struct mddev *mddev) + if (!mddev->raid_disks) { + if (!mddev->persistent) + return -EINVAL; +- analyze_sbs(mddev); ++ err = analyze_sbs(mddev); ++ if (err) ++ return -EINVAL; + } + + if (mddev->level != LEVEL_NONE) +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 1b1a794d639d..842f2210dc7e 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1430,8 +1430,8 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) + return -ENOMEM; + + data->miscdev.minor = MISC_DYNAMIC_MINOR; +- data->miscdev.name = kasprintf(GFP_KERNEL, "fastrpc-%s", +- domains[domain_id]); ++ data->miscdev.name = devm_kasprintf(rdev, GFP_KERNEL, "fastrpc-%s", ++ domains[domain_id]); + data->miscdev.fops = &fastrpc_fops; + err = misc_register(&data->miscdev); + if (err) +diff --git a/drivers/misc/ocxl/file.c b/drivers/misc/ocxl/file.c +index 2870c25da166..4d1b44de1492 100644 +--- a/drivers/misc/ocxl/file.c ++++ b/drivers/misc/ocxl/file.c +@@ -18,18 +18,15 @@ static struct class *ocxl_class; + static struct mutex minors_idr_lock; + static struct idr minors_idr; + +-static struct ocxl_file_info *find_file_info(dev_t devno) ++static struct ocxl_file_info *find_and_get_file_info(dev_t devno) + { + struct ocxl_file_info *info; + +- /* +- * We don't declare an RCU critical section here, as our AFU +- * is protected by a reference counter on the device. By the time the +- * info reference is removed from the idr, the ref count of +- * the device is already at 0, so no user API will access that AFU and +- * this function can't return it. +- */ ++ mutex_lock(&minors_idr_lock); + info = idr_find(&minors_idr, MINOR(devno)); ++ if (info) ++ get_device(&info->dev); ++ mutex_unlock(&minors_idr_lock); + return info; + } + +@@ -58,14 +55,16 @@ static int afu_open(struct inode *inode, struct file *file) + + pr_debug("%s for device %x\n", __func__, inode->i_rdev); + +- info = find_file_info(inode->i_rdev); ++ info = find_and_get_file_info(inode->i_rdev); + if (!info) + return -ENODEV; + + rc = ocxl_context_alloc(&ctx, info->afu, inode->i_mapping); +- if (rc) ++ if (rc) { ++ put_device(&info->dev); + return rc; +- ++ } ++ put_device(&info->dev); + file->private_data = ctx; + return 0; + } +@@ -487,7 +486,6 @@ static void info_release(struct device *dev) + { + struct ocxl_file_info *info = container_of(dev, struct ocxl_file_info, dev); + +- free_minor(info); + ocxl_afu_put(info->afu); + kfree(info); + } +@@ -577,6 +575,7 @@ void ocxl_file_unregister_afu(struct ocxl_afu *afu) + + ocxl_file_make_invisible(info); + ocxl_sysfs_unregister_afu(info); ++ free_minor(info); + device_unregister(&info->dev); + } + +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index 189e42674d85..010fe29a4888 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -228,6 +228,7 @@ + #define MSDC_PATCH_BIT_SPCPUSH (0x1 << 29) /* RW */ + #define MSDC_PATCH_BIT_DECRCTMO (0x1 << 30) /* RW */ + ++#define MSDC_PATCH_BIT1_CMDTA (0x7 << 3) /* RW */ + #define MSDC_PATCH_BIT1_STOP_DLY (0xf << 8) /* RW */ + + #define MSDC_PATCH_BIT2_CFGRESP (0x1 << 15) /* RW */ +@@ -1881,6 +1882,7 @@ static int hs400_tune_response(struct mmc_host *mmc, u32 opcode) + + /* select EMMC50 PAD CMD tune */ + sdr_set_bits(host->base + PAD_CMD_TUNE, BIT(0)); ++ sdr_set_field(host->base + MSDC_PATCH_BIT1, MSDC_PATCH_BIT1_CMDTA, 2); + + if (mmc->ios.timing == MMC_TIMING_MMC_HS200 || + mmc->ios.timing == MMC_TIMING_UHS_SDR104) +diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c +index b75c82d8d6c1..3d0bb5e2e09b 100644 +--- a/drivers/mmc/host/sdhci-msm.c ++++ b/drivers/mmc/host/sdhci-msm.c +@@ -99,7 +99,7 @@ + + #define CORE_PWRSAVE_DLL BIT(3) + +-#define DDR_CONFIG_POR_VAL 0x80040853 ++#define DDR_CONFIG_POR_VAL 0x80040873 + + + #define INVALID_TUNING_PHASE -1 +@@ -148,8 +148,9 @@ struct sdhci_msm_offset { + u32 core_ddr_200_cfg; + u32 core_vendor_spec3; + u32 core_dll_config_2; ++ u32 core_dll_config_3; ++ u32 core_ddr_config_old; /* Applicable to sdcc minor ver < 0x49 */ + u32 core_ddr_config; +- u32 core_ddr_config_2; + }; + + static const struct sdhci_msm_offset sdhci_msm_v5_offset = { +@@ -177,8 +178,8 @@ static const struct sdhci_msm_offset sdhci_msm_v5_offset = { + .core_ddr_200_cfg = 0x224, + .core_vendor_spec3 = 0x250, + .core_dll_config_2 = 0x254, +- .core_ddr_config = 0x258, +- .core_ddr_config_2 = 0x25c, ++ .core_dll_config_3 = 0x258, ++ .core_ddr_config = 0x25c, + }; + + static const struct sdhci_msm_offset sdhci_msm_mci_offset = { +@@ -207,8 +208,8 @@ static const struct sdhci_msm_offset sdhci_msm_mci_offset = { + .core_ddr_200_cfg = 0x184, + .core_vendor_spec3 = 0x1b0, + .core_dll_config_2 = 0x1b4, +- .core_ddr_config = 0x1b8, +- .core_ddr_config_2 = 0x1bc, ++ .core_ddr_config_old = 0x1b8, ++ .core_ddr_config = 0x1bc, + }; + + struct sdhci_msm_variant_ops { +@@ -253,6 +254,7 @@ struct sdhci_msm_host { + const struct sdhci_msm_offset *offset; + bool use_cdr; + u32 transfer_mode; ++ bool updated_ddr_cfg; + }; + + static const struct sdhci_msm_offset *sdhci_priv_msm_offset(struct sdhci_host *host) +@@ -924,8 +926,10 @@ out: + static int sdhci_msm_cm_dll_sdc4_calibration(struct sdhci_host *host) + { + struct mmc_host *mmc = host->mmc; +- u32 dll_status, config; ++ u32 dll_status, config, ddr_cfg_offset; + int ret; ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host); + const struct sdhci_msm_offset *msm_offset = + sdhci_priv_msm_offset(host); + +@@ -938,8 +942,11 @@ static int sdhci_msm_cm_dll_sdc4_calibration(struct sdhci_host *host) + * bootloaders. In the future, if this changes, then the desired + * values will need to be programmed appropriately. + */ +- writel_relaxed(DDR_CONFIG_POR_VAL, host->ioaddr + +- msm_offset->core_ddr_config); ++ if (msm_host->updated_ddr_cfg) ++ ddr_cfg_offset = msm_offset->core_ddr_config; ++ else ++ ddr_cfg_offset = msm_offset->core_ddr_config_old; ++ writel_relaxed(DDR_CONFIG_POR_VAL, host->ioaddr + ddr_cfg_offset); + + if (mmc->ios.enhanced_strobe) { + config = readl_relaxed(host->ioaddr + +@@ -1899,6 +1906,9 @@ static int sdhci_msm_probe(struct platform_device *pdev) + msm_offset->core_vendor_spec_capabilities0); + } + ++ if (core_major == 1 && core_minor >= 0x49) ++ msm_host->updated_ddr_cfg = true; ++ + /* + * Power on reset state may trigger power irq if previous status of + * PWRCTL was either BUS_ON or IO_HIGH_V. So before enabling pwr irq +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 1d1953dfc54b..889ed98ec0e7 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -710,9 +710,6 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask) + sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); + sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE); + +- if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) +- mdelay(5); +- + if (mask & SDHCI_RESET_ALL) { + val = sdhci_readl(host, ESDHC_TBCTL); + val &= ~ESDHC_TB_EN; +@@ -1126,8 +1123,8 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) + host->quirks &= ~SDHCI_QUIRK_NO_BUSY_IRQ; + + if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) { +- host->quirks2 |= SDHCI_QUIRK_RESET_AFTER_REQUEST; +- host->quirks2 |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; ++ host->quirks |= SDHCI_QUIRK_RESET_AFTER_REQUEST; ++ host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; + } + + if (of_device_is_compatible(np, "fsl,p5040-esdhc") || +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index eaffa85bc728..642a9667db4d 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #ifdef CONFIG_X86 + #include +@@ -782,11 +783,18 @@ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) + return 0; + } + ++static bool glk_broken_cqhci(struct sdhci_pci_slot *slot) ++{ ++ return slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC && ++ dmi_match(DMI_BIOS_VENDOR, "LENOVO"); ++} ++ + static int glk_emmc_probe_slot(struct sdhci_pci_slot *slot) + { + int ret = byt_emmc_probe_slot(slot); + +- slot->host->mmc->caps2 |= MMC_CAP2_CQE; ++ if (!glk_broken_cqhci(slot)) ++ slot->host->mmc->caps2 |= MMC_CAP2_CQE; + + if (slot->chip->pdev->device != PCI_DEVICE_ID_INTEL_GLK_EMMC) { + slot->host->mmc->caps2 |= MMC_CAP2_HS400_ES, +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index b056400e34b1..5f9df2dbde06 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1871,9 +1871,7 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing) + ctrl_2 |= SDHCI_CTRL_UHS_SDR104; + else if (timing == MMC_TIMING_UHS_SDR12) + ctrl_2 |= SDHCI_CTRL_UHS_SDR12; +- else if (timing == MMC_TIMING_SD_HS || +- timing == MMC_TIMING_MMC_HS || +- timing == MMC_TIMING_UHS_SDR25) ++ else if (timing == MMC_TIMING_UHS_SDR25) + ctrl_2 |= SDHCI_CTRL_UHS_SDR25; + else if (timing == MMC_TIMING_UHS_SDR50) + ctrl_2 |= SDHCI_CTRL_UHS_SDR50; +@@ -2408,8 +2406,8 @@ static int __sdhci_execute_tuning(struct sdhci_host *host, u32 opcode) + sdhci_send_tuning(host, opcode); + + if (!host->tuning_done) { +- pr_info("%s: Tuning timeout, falling back to fixed sampling clock\n", +- mmc_hostname(host->mmc)); ++ pr_debug("%s: Tuning timeout, falling back to fixed sampling clock\n", ++ mmc_hostname(host->mmc)); + sdhci_abort_tuning(host, opcode); + return -ETIMEDOUT; + } +@@ -3758,6 +3756,9 @@ int sdhci_setup_host(struct sdhci_host *host) + mmc_hostname(mmc), host->version); + } + ++ if (host->quirks & SDHCI_QUIRK_BROKEN_CQE) ++ mmc->caps2 &= ~MMC_CAP2_CQE; ++ + if (host->quirks & SDHCI_QUIRK_FORCE_DMA) + host->flags |= SDHCI_USE_SDMA; + else if (!(host->caps & SDHCI_CAN_DO_SDMA)) +diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h +index 0ed3e0eaef5f..fe83ece6965b 100644 +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -409,6 +409,8 @@ struct sdhci_host { + #define SDHCI_QUIRK_BROKEN_CARD_DETECTION (1<<15) + /* Controller reports inverted write-protect state */ + #define SDHCI_QUIRK_INVERTED_WRITE_PROTECT (1<<16) ++/* Controller has unusable command queue engine */ ++#define SDHCI_QUIRK_BROKEN_CQE (1<<17) + /* Controller does not like fast PIO transfers */ + #define SDHCI_QUIRK_PIO_NEEDS_DELAY (1<<18) + /* Controller does not have a LED */ +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index 9b6e1001e77c..dec5a99f52cf 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -1184,7 +1184,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host) + if (ret == -EPROBE_DEFER) + return ret; + +- mmc->caps |= MMC_CAP_4_BIT_DATA | pdata->capabilities; ++ mmc->caps |= MMC_CAP_ERASE | MMC_CAP_4_BIT_DATA | pdata->capabilities; + mmc->caps2 |= pdata->capabilities2; + mmc->max_segs = pdata->max_segs ? : 32; + mmc->max_blk_size = TMIO_MAX_BLK_SIZE; +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 62f65573eb04..face00c622ed 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3612,32 +3612,35 @@ static int bond_neigh_init(struct neighbour *n) + const struct net_device_ops *slave_ops; + struct neigh_parms parms; + struct slave *slave; +- int ret; ++ int ret = 0; + +- slave = bond_first_slave(bond); ++ rcu_read_lock(); ++ slave = bond_first_slave_rcu(bond); + if (!slave) +- return 0; ++ goto out; + slave_ops = slave->dev->netdev_ops; + if (!slave_ops->ndo_neigh_setup) +- return 0; +- +- parms.neigh_setup = NULL; +- parms.neigh_cleanup = NULL; +- ret = slave_ops->ndo_neigh_setup(slave->dev, &parms); +- if (ret) +- return ret; ++ goto out; + +- /* Assign slave's neigh_cleanup to neighbour in case cleanup is called +- * after the last slave has been detached. Assumes that all slaves +- * utilize the same neigh_cleanup (true at this writing as only user +- * is ipoib). ++ /* TODO: find another way [1] to implement this. ++ * Passing a zeroed structure is fragile, ++ * but at least we do not pass garbage. ++ * ++ * [1] One way would be that ndo_neigh_setup() never touch ++ * struct neigh_parms, but propagate the new neigh_setup() ++ * back to ___neigh_create() / neigh_parms_alloc() + */ +- n->parms->neigh_cleanup = parms.neigh_cleanup; ++ memset(&parms, 0, sizeof(parms)); ++ ret = slave_ops->ndo_neigh_setup(slave->dev, &parms); + +- if (!parms.neigh_setup) +- return 0; ++ if (ret) ++ goto out; + +- return parms.neigh_setup(n); ++ if (parms.neigh_setup) ++ ret = parms.neigh_setup(n); ++out: ++ rcu_read_unlock(); ++ return ret; + } + + /* The bonding ndo_neigh_setup is called at init time beofre any +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 57f9a2f51085..e5c207ad3c77 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -389,6 +389,34 @@ static struct flexcan_mb __iomem *flexcan_get_mb(const struct flexcan_priv *priv + (&priv->regs->mb[bank][priv->mb_size * mb_index]); + } + ++static int flexcan_low_power_enter_ack(struct flexcan_priv *priv) ++{ ++ struct flexcan_regs __iomem *regs = priv->regs; ++ unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; ++ ++ while (timeout-- && !(priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) ++ udelay(10); ++ ++ if (!(priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) ++ return -ETIMEDOUT; ++ ++ return 0; ++} ++ ++static int flexcan_low_power_exit_ack(struct flexcan_priv *priv) ++{ ++ struct flexcan_regs __iomem *regs = priv->regs; ++ unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; ++ ++ while (timeout-- && (priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) ++ udelay(10); ++ ++ if (priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK) ++ return -ETIMEDOUT; ++ ++ return 0; ++} ++ + static void flexcan_enable_wakeup_irq(struct flexcan_priv *priv, bool enable) + { + struct flexcan_regs __iomem *regs = priv->regs; +@@ -407,7 +435,6 @@ static void flexcan_enable_wakeup_irq(struct flexcan_priv *priv, bool enable) + static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int ackval; + u32 reg_mcr; + + reg_mcr = priv->read(®s->mcr); +@@ -418,36 +445,24 @@ static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv) + regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, + 1 << priv->stm.req_bit, 1 << priv->stm.req_bit); + +- /* get stop acknowledgment */ +- if (regmap_read_poll_timeout(priv->stm.gpr, priv->stm.ack_gpr, +- ackval, ackval & (1 << priv->stm.ack_bit), +- 0, FLEXCAN_TIMEOUT_US)) +- return -ETIMEDOUT; +- +- return 0; ++ return flexcan_low_power_enter_ack(priv); + } + + static inline int flexcan_exit_stop_mode(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int ackval; + u32 reg_mcr; + + /* remove stop request */ + regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, + 1 << priv->stm.req_bit, 0); + +- /* get stop acknowledgment */ +- if (regmap_read_poll_timeout(priv->stm.gpr, priv->stm.ack_gpr, +- ackval, !(ackval & (1 << priv->stm.ack_bit)), +- 0, FLEXCAN_TIMEOUT_US)) +- return -ETIMEDOUT; + + reg_mcr = priv->read(®s->mcr); + reg_mcr &= ~FLEXCAN_MCR_SLF_WAK; + priv->write(reg_mcr, ®s->mcr); + +- return 0; ++ return flexcan_low_power_exit_ack(priv); + } + + static inline void flexcan_error_irq_enable(const struct flexcan_priv *priv) +@@ -506,39 +521,25 @@ static inline int flexcan_transceiver_disable(const struct flexcan_priv *priv) + static int flexcan_chip_enable(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; + u32 reg; + + reg = priv->read(®s->mcr); + reg &= ~FLEXCAN_MCR_MDIS; + priv->write(reg, ®s->mcr); + +- while (timeout-- && (priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) +- udelay(10); +- +- if (priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK) +- return -ETIMEDOUT; +- +- return 0; ++ return flexcan_low_power_exit_ack(priv); + } + + static int flexcan_chip_disable(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; + u32 reg; + + reg = priv->read(®s->mcr); + reg |= FLEXCAN_MCR_MDIS; + priv->write(reg, ®s->mcr); + +- while (timeout-- && !(priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) +- udelay(10); +- +- if (!(priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) +- return -ETIMEDOUT; +- +- return 0; ++ return flexcan_low_power_enter_ack(priv); + } + + static int flexcan_chip_freeze(struct flexcan_priv *priv) +@@ -1703,6 +1704,9 @@ static int __maybe_unused flexcan_resume(struct device *device) + netif_start_queue(dev); + if (device_may_wakeup(device)) { + disable_irq_wake(dev->irq); ++ err = flexcan_exit_stop_mode(priv); ++ if (err) ++ return err; + } else { + err = pm_runtime_force_resume(device); + if (err) +@@ -1748,14 +1752,9 @@ static int __maybe_unused flexcan_noirq_resume(struct device *device) + { + struct net_device *dev = dev_get_drvdata(device); + struct flexcan_priv *priv = netdev_priv(dev); +- int err; + +- if (netif_running(dev) && device_may_wakeup(device)) { ++ if (netif_running(dev) && device_may_wakeup(device)) + flexcan_enable_wakeup_irq(priv, false); +- err = flexcan_exit_stop_mode(priv); +- if (err) +- return err; +- } + + return 0; + } +diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c +index 3db619209fe1..d5d4bfa9c8fd 100644 +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -354,6 +354,8 @@ static int tcan4x5x_parse_config(struct m_can_classdev *cdev) + if (IS_ERR(tcan4x5x->reset_gpio)) + tcan4x5x->reset_gpio = NULL; + ++ usleep_range(700, 1000); ++ + tcan4x5x->device_state_gpio = devm_gpiod_get_optional(cdev->dev, + "device-state", + GPIOD_IN); +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 07d2f3aa2c02..ae4c37e1bb75 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -608,7 +608,7 @@ static int kvaser_usb_leaf_simple_cmd_async(struct kvaser_usb_net_priv *priv, + struct kvaser_cmd *cmd; + int err; + +- cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC); ++ cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC); + if (!cmd) + return -ENOMEM; + +@@ -1140,7 +1140,7 @@ static int kvaser_usb_leaf_set_opt_mode(const struct kvaser_usb_net_priv *priv) + struct kvaser_cmd *cmd; + int rc; + +- cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; + +@@ -1206,7 +1206,7 @@ static int kvaser_usb_leaf_flush_queue(struct kvaser_usb_net_priv *priv) + struct kvaser_cmd *cmd; + int rc; + +- cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; + +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index 7c482b2d78d2..2be846ee627d 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -60,6 +60,8 @@ enum xcan_reg { + XCAN_TXMSG_BASE_OFFSET = 0x0100, /* TX Message Space */ + XCAN_RXMSG_BASE_OFFSET = 0x1100, /* RX Message Space */ + XCAN_RXMSG_2_BASE_OFFSET = 0x2100, /* RX Message Space */ ++ XCAN_AFR_2_MASK_OFFSET = 0x0A00, /* Acceptance Filter MASK */ ++ XCAN_AFR_2_ID_OFFSET = 0x0A04, /* Acceptance Filter ID */ + }; + + #define XCAN_FRAME_ID_OFFSET(frame_base) ((frame_base) + 0x00) +@@ -1803,6 +1805,11 @@ static int xcan_probe(struct platform_device *pdev) + + pm_runtime_put(&pdev->dev); + ++ if (priv->devtype.flags & XCAN_FLAG_CANFD_2) { ++ priv->write_reg(priv, XCAN_AFR_2_ID_OFFSET, 0x00000000); ++ priv->write_reg(priv, XCAN_AFR_2_MASK_OFFSET, 0x00000000); ++ } ++ + netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx buffers: actual %d, using %d\n", + priv->reg_base, ndev->irq, priv->can.clock.freq, + hw_tx_max, priv->tx_max); +diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig +index f6232ce8481f..685e12b05a7c 100644 +--- a/drivers/net/dsa/Kconfig ++++ b/drivers/net/dsa/Kconfig +@@ -77,6 +77,7 @@ config NET_DSA_REALTEK_SMI + config NET_DSA_SMSC_LAN9303 + tristate + select NET_DSA_TAG_LAN9303 ++ select REGMAP + ---help--- + This enables support for the SMSC/Microchip LAN9303 3 port ethernet + switch chips. +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index cc3536315eff..a7132c1593c3 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -347,7 +347,7 @@ static void b53_set_forwarding(struct b53_device *dev, int enable) + * frames should be flooded or not. + */ + b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt); +- mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN; ++ mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN; + b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt); + } + +@@ -526,6 +526,8 @@ int b53_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy) + + cpu_port = ds->ports[port].cpu_dp->index; + ++ b53_br_egress_floods(ds, port, true, true); ++ + if (dev->ops->irq_enable) + ret = dev->ops->irq_enable(dev, port); + if (ret) +@@ -641,6 +643,8 @@ static void b53_enable_cpu_port(struct b53_device *dev, int port) + b53_write8(dev, B53_CTRL_PAGE, B53_PORT_CTRL(port), port_ctrl); + + b53_brcm_hdr_setup(dev->ds, port); ++ ++ b53_br_egress_floods(dev->ds, port, true, true); + } + + static void b53_enable_mib(struct b53_device *dev) +@@ -1766,19 +1770,26 @@ int b53_br_egress_floods(struct dsa_switch *ds, int port, + struct b53_device *dev = ds->priv; + u16 uc, mc; + +- b53_read16(dev, B53_CTRL_PAGE, B53_UC_FWD_EN, &uc); ++ b53_read16(dev, B53_CTRL_PAGE, B53_UC_FLOOD_MASK, &uc); + if (unicast) + uc |= BIT(port); + else + uc &= ~BIT(port); +- b53_write16(dev, B53_CTRL_PAGE, B53_UC_FWD_EN, uc); ++ b53_write16(dev, B53_CTRL_PAGE, B53_UC_FLOOD_MASK, uc); ++ ++ b53_read16(dev, B53_CTRL_PAGE, B53_MC_FLOOD_MASK, &mc); ++ if (multicast) ++ mc |= BIT(port); ++ else ++ mc &= ~BIT(port); ++ b53_write16(dev, B53_CTRL_PAGE, B53_MC_FLOOD_MASK, mc); + +- b53_read16(dev, B53_CTRL_PAGE, B53_MC_FWD_EN, &mc); ++ b53_read16(dev, B53_CTRL_PAGE, B53_IPMC_FLOOD_MASK, &mc); + if (multicast) + mc |= BIT(port); + else + mc &= ~BIT(port); +- b53_write16(dev, B53_CTRL_PAGE, B53_MC_FWD_EN, mc); ++ b53_write16(dev, B53_CTRL_PAGE, B53_IPMC_FLOOD_MASK, mc); + + return 0; + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index aa140662c7c2..4e5a428ab1a4 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -1389,6 +1389,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv) + int speed_mbps[SJA1105_NUM_PORTS]; + int rc, i; + ++ mutex_lock(&priv->mgmt_lock); ++ + mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG].entries; + + /* Back up the dynamic link speed changed by sja1105_adjust_port_config +@@ -1420,6 +1422,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv) + goto out; + } + out: ++ mutex_unlock(&priv->mgmt_lock); ++ + return rc; + } + +diff --git a/drivers/net/ethernet/amazon/ena/ena_com.h b/drivers/net/ethernet/amazon/ena/ena_com.h +index 7c941eba0bc9..0ce37d54ed10 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_com.h ++++ b/drivers/net/ethernet/amazon/ena/ena_com.h +@@ -72,7 +72,7 @@ + /*****************************************************************************/ + /* ENA adaptive interrupt moderation settings */ + +-#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 196 ++#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 64 + #define ENA_INTR_INITIAL_RX_INTERVAL_USECS 0 + #define ENA_DEFAULT_INTR_DELAY_RESOLUTION 1 + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index 16553d92fad2..8c1c73b0ced7 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -315,10 +315,9 @@ static int ena_get_coalesce(struct net_device *net_dev, + ena_com_get_nonadaptive_moderation_interval_tx(ena_dev) * + ena_dev->intr_delay_resolution; + +- if (!ena_com_get_adaptive_moderation_enabled(ena_dev)) +- coalesce->rx_coalesce_usecs = +- ena_com_get_nonadaptive_moderation_interval_rx(ena_dev) +- * ena_dev->intr_delay_resolution; ++ coalesce->rx_coalesce_usecs = ++ ena_com_get_nonadaptive_moderation_interval_rx(ena_dev) ++ * ena_dev->intr_delay_resolution; + + coalesce->use_adaptive_rx_coalesce = + ena_com_get_adaptive_moderation_enabled(ena_dev); +@@ -367,12 +366,6 @@ static int ena_set_coalesce(struct net_device *net_dev, + + ena_update_tx_rings_intr_moderation(adapter); + +- if (coalesce->use_adaptive_rx_coalesce) { +- if (!ena_com_get_adaptive_moderation_enabled(ena_dev)) +- ena_com_enable_adaptive_moderation(ena_dev); +- return 0; +- } +- + rc = ena_com_update_nonadaptive_moderation_interval_rx(ena_dev, + coalesce->rx_coalesce_usecs); + if (rc) +@@ -380,10 +373,13 @@ static int ena_set_coalesce(struct net_device *net_dev, + + ena_update_rx_rings_intr_moderation(adapter); + +- if (!coalesce->use_adaptive_rx_coalesce) { +- if (ena_com_get_adaptive_moderation_enabled(ena_dev)) +- ena_com_disable_adaptive_moderation(ena_dev); +- } ++ if (coalesce->use_adaptive_rx_coalesce && ++ !ena_com_get_adaptive_moderation_enabled(ena_dev)) ++ ena_com_enable_adaptive_moderation(ena_dev); ++ ++ if (!coalesce->use_adaptive_rx_coalesce && ++ ena_com_get_adaptive_moderation_enabled(ena_dev)) ++ ena_com_disable_adaptive_moderation(ena_dev); + + return 0; + } +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +index 0edbb0a76847..5097a44686b3 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +@@ -2397,15 +2397,21 @@ static int bnx2x_set_pf_tx_switching(struct bnx2x *bp, bool enable) + /* send the ramrod on all the queues of the PF */ + for_each_eth_queue(bp, i) { + struct bnx2x_fastpath *fp = &bp->fp[i]; ++ int tx_idx; + + /* Set the appropriate Queue object */ + q_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj; + +- /* Update the Queue state */ +- rc = bnx2x_queue_state_change(bp, &q_params); +- if (rc) { +- BNX2X_ERR("Failed to configure Tx switching\n"); +- return rc; ++ for (tx_idx = FIRST_TX_COS_INDEX; ++ tx_idx < fp->max_cos; tx_idx++) { ++ q_params.params.update.cid_index = tx_idx; ++ ++ /* Update the Queue state */ ++ rc = bnx2x_queue_state_change(bp, &q_params); ++ if (rc) { ++ BNX2X_ERR("Failed to configure Tx switching\n"); ++ return rc; ++ } + } + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 04ec909e06df..527e1bf93116 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1767,8 +1767,12 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + + rc = -EIO; + if (rx_err & RX_CMPL_ERRORS_BUFFER_ERROR_MASK) { +- netdev_warn(bp->dev, "RX buffer error %x\n", rx_err); +- bnxt_sched_reset(bp, rxr); ++ bnapi->cp_ring.rx_buf_errors++; ++ if (!(bp->flags & BNXT_FLAG_CHIP_P5)) { ++ netdev_warn(bp->dev, "RX buffer error %x\n", ++ rx_err); ++ bnxt_sched_reset(bp, rxr); ++ } + } + goto next_rx_no_len; + } +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index d333589811a5..5163bb848618 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -927,6 +927,7 @@ struct bnxt_cp_ring_info { + dma_addr_t hw_stats_map; + u32 hw_stats_ctx_id; + u64 rx_l4_csum_errors; ++ u64 rx_buf_errors; + u64 missed_irqs; + + struct bnxt_ring_struct cp_ring_struct; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +index 7151244f8c7d..7d2cfea05737 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -311,10 +311,17 @@ static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg, + } else { + rc = hwrm_send_message_silent(bp, msg, msg_len, + HWRM_CMD_TIMEOUT); +- if (!rc) ++ if (!rc) { + bnxt_copy_from_nvm_data(val, data, + nvm_param.nvm_num_bits, + nvm_param.dl_num_bytes); ++ } else { ++ struct hwrm_err_output *resp = bp->hwrm_cmd_resp_addr; ++ ++ if (resp->cmd_err == ++ NVM_GET_VARIABLE_CMD_ERR_CODE_VAR_NOT_EXIST) ++ rc = -EOPNOTSUPP; ++ } + } + dma_free_coherent(&bp->pdev->dev, sizeof(*data), data, data_dma_addr); + if (rc == -EACCES) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 51c140476717..89f95428556e 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -173,6 +173,7 @@ static const char * const bnxt_ring_tpa2_stats_str[] = { + + static const char * const bnxt_ring_sw_stats_str[] = { + "rx_l4_csum_errors", ++ "rx_buf_errors", + "missed_irqs", + }; + +@@ -552,6 +553,7 @@ static void bnxt_get_ethtool_stats(struct net_device *dev, + for (k = 0; k < stat_fields; j++, k++) + buf[j] = le64_to_cpu(hw_stats[k]); + buf[j++] = cpr->rx_l4_csum_errors; ++ buf[j++] = cpr->rx_buf_errors; + buf[j++] = cpr->missed_irqs; + + bnxt_sw_func_stats[RX_TOTAL_DISCARDS].counter += +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index a8f4c69252ff..2814b96751b4 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -576,6 +576,8 @@ static int gmac_setup_txqs(struct net_device *netdev) + + if (port->txq_dma_base & ~DMA_Q_BASE_MASK) { + dev_warn(geth->dev, "TX queue base is not aligned\n"); ++ dma_free_coherent(geth->dev, len * sizeof(*desc_ring), ++ desc_ring, port->txq_dma_base); + kfree(skb_tab); + return -ENOMEM; + } +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +index a9503aea527f..6437fe6b9abf 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +@@ -160,10 +160,10 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev) + irq = mc_dev->irqs[0]; + ptp_qoriq->irq = irq->msi_desc->irq; + +- err = devm_request_threaded_irq(dev, ptp_qoriq->irq, NULL, +- dpaa2_ptp_irq_handler_thread, +- IRQF_NO_SUSPEND | IRQF_ONESHOT, +- dev_name(dev), ptp_qoriq); ++ err = request_threaded_irq(ptp_qoriq->irq, NULL, ++ dpaa2_ptp_irq_handler_thread, ++ IRQF_NO_SUSPEND | IRQF_ONESHOT, ++ dev_name(dev), ptp_qoriq); + if (err < 0) { + dev_err(dev, "devm_request_threaded_irq(): %d\n", err); + goto err_free_mc_irq; +@@ -173,18 +173,20 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev) + DPRTC_IRQ_INDEX, 1); + if (err < 0) { + dev_err(dev, "dprtc_set_irq_enable(): %d\n", err); +- goto err_free_mc_irq; ++ goto err_free_threaded_irq; + } + + err = ptp_qoriq_init(ptp_qoriq, base, &dpaa2_ptp_caps); + if (err) +- goto err_free_mc_irq; ++ goto err_free_threaded_irq; + + dpaa2_phc_index = ptp_qoriq->phc_index; + dev_set_drvdata(dev, ptp_qoriq); + + return 0; + ++err_free_threaded_irq: ++ free_irq(ptp_qoriq->irq, ptp_qoriq); + err_free_mc_irq: + fsl_mc_free_irqs(mc_dev); + err_unmap: +diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c +index 4606a7e4a6d1..2ffe035e96d6 100644 +--- a/drivers/net/ethernet/hisilicon/hip04_eth.c ++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c +@@ -543,9 +543,9 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + skb_tx_timestamp(skb); + + hip04_set_xmit_desc(priv, phys); +- priv->tx_head = TX_NEXT(tx_head); + count++; + netdev_sent_queue(ndev, skb->len); ++ priv->tx_head = TX_NEXT(tx_head); + + stats->tx_bytes += skb->len; + stats->tx_packets++; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 616cad0faa21..84d8816c8681 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1692,6 +1692,9 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev) + time_after(jiffies, + (trans_start + ndev->watchdog_timeo))) { + timeout_queue = i; ++ netdev_info(ndev, "queue state: 0x%lx, delta msecs: %u\n", ++ q->state, ++ jiffies_to_msecs(jiffies - trans_start)); + break; + } + } +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index c052bb33b3d3..162881005a6d 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -9443,6 +9443,9 @@ static int hclge_reset_ae_dev(struct hnae3_ae_dev *ae_dev) + return ret; + } + ++ /* Log and clear the hw errors those already occurred */ ++ hclge_handle_all_hns_hw_errors(ae_dev); ++ + /* Re-enable the hw error interrupts because + * the interrupts get disabled on global reset. + */ +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 0686ded7ad3a..e1ab2feeae53 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -176,7 +176,7 @@ static int alloc_long_term_buff(struct ibmvnic_adapter *adapter, + ltb->map_id = adapter->map_id; + adapter->map_id++; + +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + rc = send_request_map(adapter, ltb->addr, + ltb->size, ltb->map_id); + if (rc) { +@@ -215,7 +215,7 @@ static int reset_long_term_buff(struct ibmvnic_adapter *adapter, + + memset(ltb->buff, 0, ltb->size); + +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + rc = send_request_map(adapter, ltb->addr, ltb->size, ltb->map_id); + if (rc) + return rc; +@@ -943,7 +943,7 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter) + if (adapter->vpd->buff) + len = adapter->vpd->len; + +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + crq.get_vpd_size.first = IBMVNIC_CRQ_CMD; + crq.get_vpd_size.cmd = GET_VPD_SIZE; + rc = ibmvnic_send_crq(adapter, &crq); +@@ -1689,7 +1689,7 @@ static int __ibmvnic_set_mac(struct net_device *netdev, u8 *dev_addr) + crq.change_mac_addr.cmd = CHANGE_MAC_ADDR; + ether_addr_copy(&crq.change_mac_addr.mac_addr[0], dev_addr); + +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + rc = ibmvnic_send_crq(adapter, &crq); + if (rc) { + rc = -EIO; +@@ -2316,7 +2316,7 @@ static int wait_for_reset(struct ibmvnic_adapter *adapter) + adapter->fallback.rx_entries = adapter->req_rx_add_entries_per_subcrq; + adapter->fallback.tx_entries = adapter->req_tx_entries_per_subcrq; + +- init_completion(&adapter->reset_done); ++ reinit_completion(&adapter->reset_done); + adapter->wait_for_reset = true; + rc = ibmvnic_reset(adapter, VNIC_RESET_CHANGE_PARAM); + if (rc) +@@ -2332,7 +2332,7 @@ static int wait_for_reset(struct ibmvnic_adapter *adapter) + adapter->desired.rx_entries = adapter->fallback.rx_entries; + adapter->desired.tx_entries = adapter->fallback.tx_entries; + +- init_completion(&adapter->reset_done); ++ reinit_completion(&adapter->reset_done); + adapter->wait_for_reset = true; + rc = ibmvnic_reset(adapter, VNIC_RESET_CHANGE_PARAM); + if (rc) +@@ -2603,7 +2603,7 @@ static void ibmvnic_get_ethtool_stats(struct net_device *dev, + cpu_to_be32(sizeof(struct ibmvnic_statistics)); + + /* Wait for data to be written */ +- init_completion(&adapter->stats_done); ++ reinit_completion(&adapter->stats_done); + rc = ibmvnic_send_crq(adapter, &crq); + if (rc) + return; +@@ -4408,7 +4408,7 @@ static int send_query_phys_parms(struct ibmvnic_adapter *adapter) + memset(&crq, 0, sizeof(crq)); + crq.query_phys_parms.first = IBMVNIC_CRQ_CMD; + crq.query_phys_parms.cmd = QUERY_PHYS_PARMS; +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + rc = ibmvnic_send_crq(adapter, &crq); + if (rc) + return rc; +@@ -4960,6 +4960,9 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id) + INIT_LIST_HEAD(&adapter->rwi_list); + spin_lock_init(&adapter->rwi_lock); + init_completion(&adapter->init_done); ++ init_completion(&adapter->fw_done); ++ init_completion(&adapter->reset_done); ++ init_completion(&adapter->stats_done); + clear_bit(0, &adapter->resetting); + + do { +diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c +index 7560f06768e0..3160b5bbe672 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -2571,9 +2571,16 @@ noinline_for_stack i40e_status i40e_update_link_info(struct i40e_hw *hw) + if (status) + return status; + +- hw->phy.link_info.req_fec_info = +- abilities.fec_cfg_curr_mod_ext_info & +- (I40E_AQ_REQUEST_FEC_KR | I40E_AQ_REQUEST_FEC_RS); ++ if (abilities.fec_cfg_curr_mod_ext_info & ++ I40E_AQ_ENABLE_FEC_AUTO) ++ hw->phy.link_info.req_fec_info = ++ (I40E_AQ_REQUEST_FEC_KR | ++ I40E_AQ_REQUEST_FEC_RS); ++ else ++ hw->phy.link_info.req_fec_info = ++ abilities.fec_cfg_curr_mod_ext_info & ++ (I40E_AQ_REQUEST_FEC_KR | ++ I40E_AQ_REQUEST_FEC_RS); + + memcpy(hw->phy.link_info.module_type, &abilities.module_type, + sizeof(hw->phy.link_info.module_type)); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 41e1240acaea..b577e6adf3bf 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -722,7 +722,14 @@ static void i40e_get_settings_link_up_fec(u8 req_fec_info, + ethtool_link_ksettings_add_link_mode(ks, supported, FEC_RS); + ethtool_link_ksettings_add_link_mode(ks, supported, FEC_BASER); + +- if (I40E_AQ_SET_FEC_REQUEST_RS & req_fec_info) { ++ if ((I40E_AQ_SET_FEC_REQUEST_RS & req_fec_info) && ++ (I40E_AQ_SET_FEC_REQUEST_KR & req_fec_info)) { ++ ethtool_link_ksettings_add_link_mode(ks, advertising, ++ FEC_NONE); ++ ethtool_link_ksettings_add_link_mode(ks, advertising, ++ FEC_BASER); ++ ethtool_link_ksettings_add_link_mode(ks, advertising, FEC_RS); ++ } else if (I40E_AQ_SET_FEC_REQUEST_RS & req_fec_info) { + ethtool_link_ksettings_add_link_mode(ks, advertising, FEC_RS); + } else if (I40E_AQ_SET_FEC_REQUEST_KR & req_fec_info) { + ethtool_link_ksettings_add_link_mode(ks, advertising, +@@ -730,12 +737,6 @@ static void i40e_get_settings_link_up_fec(u8 req_fec_info, + } else { + ethtool_link_ksettings_add_link_mode(ks, advertising, + FEC_NONE); +- if (I40E_AQ_SET_FEC_AUTO & req_fec_info) { +- ethtool_link_ksettings_add_link_mode(ks, advertising, +- FEC_RS); +- ethtool_link_ksettings_add_link_mode(ks, advertising, +- FEC_BASER); +- } + } + } + +@@ -1437,6 +1438,7 @@ static int i40e_get_fec_param(struct net_device *netdev, + struct i40e_hw *hw = &pf->hw; + i40e_status status = 0; + int err = 0; ++ u8 fec_cfg; + + /* Get the current phy config */ + memset(&abilities, 0, sizeof(abilities)); +@@ -1448,18 +1450,16 @@ static int i40e_get_fec_param(struct net_device *netdev, + } + + fecparam->fec = 0; +- if (abilities.fec_cfg_curr_mod_ext_info & I40E_AQ_SET_FEC_AUTO) ++ fec_cfg = abilities.fec_cfg_curr_mod_ext_info; ++ if (fec_cfg & I40E_AQ_SET_FEC_AUTO) + fecparam->fec |= ETHTOOL_FEC_AUTO; +- if ((abilities.fec_cfg_curr_mod_ext_info & +- I40E_AQ_SET_FEC_REQUEST_RS) || +- (abilities.fec_cfg_curr_mod_ext_info & +- I40E_AQ_SET_FEC_ABILITY_RS)) ++ else if (fec_cfg & (I40E_AQ_SET_FEC_REQUEST_RS | ++ I40E_AQ_SET_FEC_ABILITY_RS)) + fecparam->fec |= ETHTOOL_FEC_RS; +- if ((abilities.fec_cfg_curr_mod_ext_info & +- I40E_AQ_SET_FEC_REQUEST_KR) || +- (abilities.fec_cfg_curr_mod_ext_info & I40E_AQ_SET_FEC_ABILITY_KR)) ++ else if (fec_cfg & (I40E_AQ_SET_FEC_REQUEST_KR | ++ I40E_AQ_SET_FEC_ABILITY_KR)) + fecparam->fec |= ETHTOOL_FEC_BASER; +- if (abilities.fec_cfg_curr_mod_ext_info == 0) ++ if (fec_cfg == 0) + fecparam->fec |= ETHTOOL_FEC_OFF; + + if (hw->phy.link_info.fec_info & I40E_AQ_CONFIG_FEC_KR_ENA) +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 6031223eafab..339925af0206 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -3534,14 +3534,14 @@ static void i40e_vsi_configure_msix(struct i40e_vsi *vsi) + q_vector->rx.target_itr = + ITR_TO_REG(vsi->rx_rings[i]->itr_setting); + wr32(hw, I40E_PFINT_ITRN(I40E_RX_ITR, vector - 1), +- q_vector->rx.target_itr); ++ q_vector->rx.target_itr >> 1); + q_vector->rx.current_itr = q_vector->rx.target_itr; + + q_vector->tx.next_update = jiffies + 1; + q_vector->tx.target_itr = + ITR_TO_REG(vsi->tx_rings[i]->itr_setting); + wr32(hw, I40E_PFINT_ITRN(I40E_TX_ITR, vector - 1), +- q_vector->tx.target_itr); ++ q_vector->tx.target_itr >> 1); + q_vector->tx.current_itr = q_vector->tx.target_itr; + + wr32(hw, I40E_PFINT_RATEN(vector - 1), +@@ -3646,11 +3646,11 @@ static void i40e_configure_msi_and_legacy(struct i40e_vsi *vsi) + /* set the ITR configuration */ + q_vector->rx.next_update = jiffies + 1; + q_vector->rx.target_itr = ITR_TO_REG(vsi->rx_rings[0]->itr_setting); +- wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr); ++ wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr >> 1); + q_vector->rx.current_itr = q_vector->rx.target_itr; + q_vector->tx.next_update = jiffies + 1; + q_vector->tx.target_itr = ITR_TO_REG(vsi->tx_rings[0]->itr_setting); +- wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr); ++ wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr >> 1); + q_vector->tx.current_itr = q_vector->tx.target_itr; + + i40e_enable_misc_int_causes(pf); +@@ -11396,7 +11396,7 @@ static int i40e_setup_misc_vector(struct i40e_pf *pf) + + /* associate no queues to the misc vector */ + wr32(hw, I40E_PFINT_LNKLST0, I40E_QUEUE_END_OF_LIST); +- wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K); ++ wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K >> 1); + + i40e_flush(hw); + +diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c +index 2353166c654e..c68709c7ef81 100644 +--- a/drivers/net/ethernet/intel/ice/ice_controlq.c ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c +@@ -948,7 +948,7 @@ ice_sq_send_cmd(struct ice_hw *hw, struct ice_ctl_q_info *cq, + if (ice_sq_done(hw, cq)) + break; + +- mdelay(1); ++ udelay(ICE_CTL_Q_SQ_CMD_USEC); + total_delay++; + } while (total_delay < cq->sq_cmd_timeout); + +diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.h b/drivers/net/ethernet/intel/ice/ice_controlq.h +index 44945c2165d8..4df9da359135 100644 +--- a/drivers/net/ethernet/intel/ice/ice_controlq.h ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.h +@@ -31,8 +31,9 @@ enum ice_ctl_q { + ICE_CTL_Q_MAILBOX, + }; + +-/* Control Queue default settings */ +-#define ICE_CTL_Q_SQ_CMD_TIMEOUT 250 /* msecs */ ++/* Control Queue timeout settings - max delay 250ms */ ++#define ICE_CTL_Q_SQ_CMD_TIMEOUT 2500 /* Count 2500 times */ ++#define ICE_CTL_Q_SQ_CMD_USEC 100 /* Check every 100usec */ + + struct ice_ctl_q_ring { + void *dma_head; /* Virtual address to DMA head */ +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index 7e23034df955..1fe9f6050635 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -3368,10 +3368,17 @@ __ice_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *ec, + struct ice_vsi *vsi = np->vsi; + + if (q_num < 0) { +- int i; ++ int v_idx; ++ ++ ice_for_each_q_vector(vsi, v_idx) { ++ /* In some cases if DCB is configured the num_[rx|tx]q ++ * can be less than vsi->num_q_vectors. This check ++ * accounts for that so we don't report a false failure ++ */ ++ if (v_idx >= vsi->num_rxq && v_idx >= vsi->num_txq) ++ goto set_complete; + +- ice_for_each_q_vector(vsi, i) { +- if (ice_set_q_coalesce(vsi, ec, i)) ++ if (ice_set_q_coalesce(vsi, ec, v_idx)) + return -EINVAL; + } + goto set_complete; +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 214cd6eca405..2408f0de95fc 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -3970,8 +3970,13 @@ int ice_vsi_setup_tx_rings(struct ice_vsi *vsi) + } + + ice_for_each_txq(vsi, i) { +- vsi->tx_rings[i]->netdev = vsi->netdev; +- err = ice_setup_tx_ring(vsi->tx_rings[i]); ++ struct ice_ring *ring = vsi->tx_rings[i]; ++ ++ if (!ring) ++ return -EINVAL; ++ ++ ring->netdev = vsi->netdev; ++ err = ice_setup_tx_ring(ring); + if (err) + break; + } +@@ -3996,8 +4001,13 @@ int ice_vsi_setup_rx_rings(struct ice_vsi *vsi) + } + + ice_for_each_rxq(vsi, i) { +- vsi->rx_rings[i]->netdev = vsi->netdev; +- err = ice_setup_rx_ring(vsi->rx_rings[i]); ++ struct ice_ring *ring = vsi->rx_rings[i]; ++ ++ if (!ring) ++ return -EINVAL; ++ ++ ring->netdev = vsi->netdev; ++ err = ice_setup_rx_ring(ring); + if (err) + break; + } +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +index b45797f39b2f..c0637a0cbfe8 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +@@ -317,8 +317,9 @@ void ice_free_vfs(struct ice_pf *pf) + pf->num_alloc_vfs = 0; + for (i = 0; i < tmp; i++) { + if (test_bit(ICE_VF_STATE_INIT, pf->vf[i].vf_states)) { +- /* disable VF qp mappings */ ++ /* disable VF qp mappings and set VF disable state */ + ice_dis_vf_mappings(&pf->vf[i]); ++ set_bit(ICE_VF_STATE_DIS, pf->vf[i].vf_states); + ice_free_vf_res(&pf->vf[i]); + } + } +@@ -1287,9 +1288,12 @@ static void ice_vc_notify_vf_reset(struct ice_vf *vf) + if (!vf || vf->vf_id >= vf->pf->num_alloc_vfs) + return; + +- /* verify if the VF is in either init or active before proceeding */ +- if (!test_bit(ICE_VF_STATE_INIT, vf->vf_states) && +- !test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) ++ /* Bail out if VF is in disabled state, neither initialized, nor active ++ * state - otherwise proceed with notifications ++ */ ++ if ((!test_bit(ICE_VF_STATE_INIT, vf->vf_states) && ++ !test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) || ++ test_bit(ICE_VF_STATE_DIS, vf->vf_states)) + return; + + pfe.event = VIRTCHNL_EVENT_RESET_IMPENDING; +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 91b3780ddb04..1a7203fede12 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8639,7 +8639,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, + + if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && + adapter->ptp_clock) { +- if (!test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, ++ if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON && ++ !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, + &adapter->state)) { + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; + tx_flags |= IXGBE_TX_FLAGS_TSTAMP; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index c2c7f214a56a..814a4ba4e7fa 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -3443,6 +3443,12 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, + attr->action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; + } + ++ if (!(attr->action & ++ (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP))) { ++ NL_SET_ERR_MSG(extack, "Rule must have at least one forward/drop action"); ++ return -EOPNOTSUPP; ++ } ++ + if (attr->split_count > 0 && !mlx5_esw_has_fwd_fdb(priv->mdev)) { + NL_SET_ERR_MSG_MOD(extack, + "current firmware doesn't support split rule for port mirroring"); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 39d600c8b92d..210ebc91d3d6 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -5637,8 +5637,13 @@ static void mlxsw_sp_router_fib6_del(struct mlxsw_sp *mlxsw_sp, + if (mlxsw_sp_fib6_rt_should_ignore(rt)) + return; + ++ /* Multipath routes are first added to the FIB trie and only then ++ * notified. If we vetoed the addition, we will get a delete ++ * notification for a route we do not have. Therefore, do not warn if ++ * route was not found. ++ */ + fib6_entry = mlxsw_sp_fib6_entry_lookup(mlxsw_sp, rt); +- if (WARN_ON(!fib6_entry)) ++ if (!fib6_entry) + return; + + /* If not all the nexthops are deleted, then only reduce the nexthop +diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +index 7c4a15e967df..5defd31d481c 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +@@ -65,17 +65,17 @@ static int nfp_get_stats_entry(struct nfp_app *app, u32 *stats_context_id) + freed_stats_id = priv->stats_ring_size; + /* Check for unallocated entries first. */ + if (priv->stats_ids.init_unalloc > 0) { +- if (priv->active_mem_unit == priv->total_mem_units) { +- priv->stats_ids.init_unalloc--; +- priv->active_mem_unit = 0; +- } +- + *stats_context_id = + FIELD_PREP(NFP_FL_STAT_ID_STAT, + priv->stats_ids.init_unalloc - 1) | + FIELD_PREP(NFP_FL_STAT_ID_MU_NUM, + priv->active_mem_unit); +- priv->active_mem_unit++; ++ ++ if (++priv->active_mem_unit == priv->total_mem_units) { ++ priv->stats_ids.init_unalloc--; ++ priv->active_mem_unit = 0; ++ } ++ + return 0; + } + +diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c +index 9a6a9a008714..c8bdbf057d5a 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c +@@ -1230,7 +1230,7 @@ qede_configure_mcast_filtering(struct net_device *ndev, + netif_addr_lock_bh(ndev); + + mc_count = netdev_mc_count(ndev); +- if (mc_count < 64) { ++ if (mc_count <= 64) { + netdev_for_each_mc_addr(ha, ndev) { + ether_addr_copy(temp, ha->addr); + temp += ETH_ALEN; +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index a220cc7c947a..ba53612ae0df 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -1406,6 +1406,7 @@ static int qede_alloc_mem_rxq(struct qede_dev *edev, struct qede_rx_queue *rxq) + rxq->rx_buf_seg_size = roundup_pow_of_two(size); + } else { + rxq->rx_buf_seg_size = PAGE_SIZE; ++ edev->ndev->features &= ~NETIF_F_GRO_HW; + } + + /* Allocate the parallel driver ring for Rx buffers */ +@@ -1450,6 +1451,7 @@ static int qede_alloc_mem_rxq(struct qede_dev *edev, struct qede_rx_queue *rxq) + } + } + ++ edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW); + if (!edev->gro_disable) + qede_set_tpa_param(rxq); + err: +@@ -1702,8 +1704,6 @@ static void qede_init_fp(struct qede_dev *edev) + snprintf(fp->name, sizeof(fp->name), "%s-fp-%d", + edev->ndev->name, queue_id); + } +- +- edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW); + } + + static int qede_set_real_num_queues(struct qede_dev *edev) +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index b4b8ba00ee01..986f26578d34 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -2756,6 +2756,9 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + int err; + + for (i = 0; i < qdev->num_large_buffers; i++) { ++ lrg_buf_cb = &qdev->lrg_buf[i]; ++ memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); ++ + skb = netdev_alloc_skb(qdev->ndev, + qdev->lrg_buffer_len); + if (unlikely(!skb)) { +@@ -2766,11 +2769,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + ql_free_large_buffers(qdev); + return -ENOMEM; + } else { +- +- lrg_buf_cb = &qdev->lrg_buf[i]; +- memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); + lrg_buf_cb->index = i; +- lrg_buf_cb->skb = skb; + /* + * We save some space to copy the ethhdr from first + * buffer +@@ -2792,6 +2791,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + return -ENOMEM; + } + ++ lrg_buf_cb->skb = skb; + dma_unmap_addr_set(lrg_buf_cb, mapaddr, map); + dma_unmap_len_set(lrg_buf_cb, maplen, + qdev->lrg_buffer_len - +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 4fe0977d01fa..5ae0b5663d54 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -680,6 +680,7 @@ struct rtl8169_private { + struct rtl8169_counters *counters; + struct rtl8169_tc_offsets tc_offset; + u32 saved_wolopts; ++ int eee_adv; + + const char *fw_name; + struct rtl_fw *rtl_fw; +@@ -2075,6 +2076,10 @@ static int rtl8169_set_eee(struct net_device *dev, struct ethtool_eee *data) + } + + ret = phy_ethtool_set_eee(tp->phydev, data); ++ ++ if (!ret) ++ tp->eee_adv = phy_read_mmd(dev->phydev, MDIO_MMD_AN, ++ MDIO_AN_EEE_ADV); + out: + pm_runtime_put_noidle(d); + return ret; +@@ -2105,10 +2110,16 @@ static const struct ethtool_ops rtl8169_ethtool_ops = { + static void rtl_enable_eee(struct rtl8169_private *tp) + { + struct phy_device *phydev = tp->phydev; +- int supported = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE); ++ int adv; ++ ++ /* respect EEE advertisement the user may have set */ ++ if (tp->eee_adv >= 0) ++ adv = tp->eee_adv; ++ else ++ adv = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE); + +- if (supported > 0) +- phy_write_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV, supported); ++ if (adv >= 0) ++ phy_write_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV, adv); + } + + static void rtl8169_get_mac_version(struct rtl8169_private *tp) +@@ -7064,6 +7075,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + tp->pci_dev = pdev; + tp->msg_enable = netif_msg_init(debug.msg_enable, R8169_MSG_DEFAULT); + tp->supports_gmii = ent->driver_data == RTL_CFG_NO_GBIT ? 0 : 1; ++ tp->eee_adv = -1; + + /* Get the *optional* external "ether_clk" used on some boards */ + rc = rtl_get_ether_clk(tp); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 170c3a052b14..1f230bd854c4 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -320,7 +320,7 @@ out: + static int stmmac_dt_phy(struct plat_stmmacenet_data *plat, + struct device_node *np, struct device *dev) + { +- bool mdio = true; ++ bool mdio = false; + static const struct of_device_id need_mdio_ids[] = { + { .compatible = "snps,dwc-qos-ethernet-4.10" }, + {}, +diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig +index 834afca3a019..137632b09c72 100644 +--- a/drivers/net/ethernet/ti/Kconfig ++++ b/drivers/net/ethernet/ti/Kconfig +@@ -22,6 +22,7 @@ config TI_DAVINCI_EMAC + depends on ARM && ( ARCH_DAVINCI || ARCH_OMAP3 ) || COMPILE_TEST + select TI_DAVINCI_MDIO + select PHYLIB ++ select GENERIC_ALLOCATOR + ---help--- + This driver supports TI's DaVinci Ethernet . + +diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c +index 84025dcc78d5..e7c24396933e 100644 +--- a/drivers/net/ethernet/ti/cpsw_ale.c ++++ b/drivers/net/ethernet/ti/cpsw_ale.c +@@ -779,6 +779,7 @@ void cpsw_ale_start(struct cpsw_ale *ale) + void cpsw_ale_stop(struct cpsw_ale *ale) + { + del_timer_sync(&ale->timer); ++ cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1); + cpsw_ale_control_set(ale, 0, ALE_ENABLE, 0); + } + +@@ -862,6 +863,7 @@ struct cpsw_ale *cpsw_ale_create(struct cpsw_ale_params *params) + ALE_UNKNOWNVLAN_FORCE_UNTAG_EGRESS; + } + ++ cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1); + return ale; + } + +diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c +index 37ba708ac781..6614fa3089b2 100644 +--- a/drivers/net/ethernet/ti/davinci_cpdma.c ++++ b/drivers/net/ethernet/ti/davinci_cpdma.c +@@ -1018,7 +1018,6 @@ static int cpdma_chan_submit_si(struct submit_info *si) + struct cpdma_chan *chan = si->chan; + struct cpdma_ctlr *ctlr = chan->ctlr; + int len = si->len; +- int swlen = len; + struct cpdma_desc __iomem *desc; + dma_addr_t buffer; + u32 mode; +@@ -1046,7 +1045,6 @@ static int cpdma_chan_submit_si(struct submit_info *si) + if (si->data_dma) { + buffer = si->data_dma; + dma_sync_single_for_device(ctlr->dev, buffer, len, chan->dir); +- swlen |= CPDMA_DMA_EXT_MAP; + } else { + buffer = dma_map_single(ctlr->dev, si->data_virt, len, chan->dir); + ret = dma_mapping_error(ctlr->dev, buffer); +@@ -1065,7 +1063,8 @@ static int cpdma_chan_submit_si(struct submit_info *si) + writel_relaxed(mode | len, &desc->hw_mode); + writel_relaxed((uintptr_t)si->token, &desc->sw_token); + writel_relaxed(buffer, &desc->sw_buffer); +- writel_relaxed(swlen, &desc->sw_len); ++ writel_relaxed(si->data_dma ? len | CPDMA_DMA_EXT_MAP : len, ++ &desc->sw_len); + desc_read(desc, sw_len); + + __cpdma_chan_submit(chan, desc); +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index b517c1af9de0..91a1059517f5 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -166,6 +166,9 @@ static int fjes_acpi_add(struct acpi_device *device) + /* create platform_device */ + plat_dev = platform_device_register_simple(DRV_NAME, 0, fjes_resource, + ARRAY_SIZE(fjes_resource)); ++ if (IS_ERR(plat_dev)) ++ return PTR_ERR(plat_dev); ++ + device->driver_data = plat_dev; + + return 0; +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index 37fceaf9fa10..cf4455bbf888 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -95,6 +95,10 @@ + #define DP83867_IO_MUX_CFG_CLK_O_SEL_MASK (0x1f << 8) + #define DP83867_IO_MUX_CFG_CLK_O_SEL_SHIFT 8 + ++/* CFG3 bits */ ++#define DP83867_CFG3_INT_OE BIT(7) ++#define DP83867_CFG3_ROBUST_AUTO_MDIX BIT(9) ++ + /* CFG4 bits */ + #define DP83867_CFG4_PORT_MIRROR_EN BIT(0) + +@@ -410,12 +414,13 @@ static int dp83867_config_init(struct phy_device *phydev) + phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_SGMIICTL, val); + } + ++ val = phy_read(phydev, DP83867_CFG3); + /* Enable Interrupt output INT_OE in CFG3 register */ +- if (phy_interrupt_is_valid(phydev)) { +- val = phy_read(phydev, DP83867_CFG3); +- val |= BIT(7); +- phy_write(phydev, DP83867_CFG3, val); +- } ++ if (phy_interrupt_is_valid(phydev)) ++ val |= DP83867_CFG3_INT_OE; ++ ++ val |= DP83867_CFG3_ROBUST_AUTO_MDIX; ++ phy_write(phydev, DP83867_CFG3, val); + + if (dp83867->port_mirroring != DP83867_PORT_MIRROING_KEEP) + dp83867_config_port_mirroring(phydev); +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index adb66a2fae18..2bf0fda209a8 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -488,7 +488,7 @@ static int phy_bus_match(struct device *dev, struct device_driver *drv) + + if (phydev->is_c45) { + for (i = 1; i < num_ids; i++) { +- if (!(phydev->c45_ids.devices_in_package & (1 << i))) ++ if (phydev->c45_ids.device_ids[i] == 0xffffffff) + continue; + + if ((phydrv->phy_id & phydrv->phy_id_mask) == +@@ -552,7 +552,7 @@ static const struct device_type mdio_bus_phy_type = { + .pm = MDIO_BUS_PHY_PM_OPS, + }; + +-static int phy_request_driver_module(struct phy_device *dev, int phy_id) ++static int phy_request_driver_module(struct phy_device *dev, u32 phy_id) + { + int ret; + +@@ -564,15 +564,15 @@ static int phy_request_driver_module(struct phy_device *dev, int phy_id) + * then modprobe isn't available. + */ + if (IS_ENABLED(CONFIG_MODULES) && ret < 0 && ret != -ENOENT) { +- phydev_err(dev, "error %d loading PHY driver module for ID 0x%08x\n", +- ret, phy_id); ++ phydev_err(dev, "error %d loading PHY driver module for ID 0x%08lx\n", ++ ret, (unsigned long)phy_id); + return ret; + } + + return 0; + } + +-struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, ++struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + bool is_c45, + struct phy_c45_device_ids *c45_ids) + { +@@ -596,8 +596,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, + mdiodev->device_free = phy_mdio_device_free; + mdiodev->device_remove = phy_mdio_device_remove; + +- dev->speed = 0; +- dev->duplex = -1; ++ dev->speed = SPEED_UNKNOWN; ++ dev->duplex = DUPLEX_UNKNOWN; + dev->pause = 0; + dev->asym_pause = 0; + dev->link = 0; +@@ -632,7 +632,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, + int i; + + for (i = 1; i < num_ids; i++) { +- if (!(c45_ids->devices_in_package & (1 << i))) ++ if (c45_ids->device_ids[i] == 0xffffffff) + continue; + + ret = phy_request_driver_module(dev, +@@ -812,10 +812,13 @@ static int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id, + */ + struct phy_device *get_phy_device(struct mii_bus *bus, int addr, bool is_c45) + { +- struct phy_c45_device_ids c45_ids = {0}; ++ struct phy_c45_device_ids c45_ids; + u32 phy_id = 0; + int r; + ++ c45_ids.devices_in_package = 0; ++ memset(c45_ids.device_ids, 0xff, sizeof(c45_ids.device_ids)); ++ + r = get_phy_id(bus, addr, &phy_id, is_c45, &c45_ids); + if (r) + return ERR_PTR(r); +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 8156b33ee3e7..ca70a1d840eb 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -2074,7 +2074,8 @@ static int team_ethtool_get_link_ksettings(struct net_device *dev, + cmd->base.duplex = DUPLEX_UNKNOWN; + cmd->base.port = PORT_OTHER; + +- list_for_each_entry(port, &team->port_list, list) { ++ rcu_read_lock(); ++ list_for_each_entry_rcu(port, &team->port_list, list) { + if (team_port_txable(port)) { + if (port->state.speed != SPEED_UNKNOWN) + speed += port->state.speed; +@@ -2083,6 +2084,8 @@ static int team_ethtool_get_link_ksettings(struct net_device *dev, + cmd->base.duplex = port->state.duplex; + } + } ++ rcu_read_unlock(); ++ + cmd->base.speed = speed ? : SPEED_UNKNOWN; + + return 0; +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index a8d3141582a5..16564ebcde50 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -313,8 +313,8 @@ static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile, + tfile->napi_enabled = napi_en; + tfile->napi_frags_enabled = napi_en && napi_frags; + if (napi_en) { +- netif_napi_add(tun->dev, &tfile->napi, tun_napi_poll, +- NAPI_POLL_WEIGHT); ++ netif_tx_napi_add(tun->dev, &tfile->napi, tun_napi_poll, ++ NAPI_POLL_WEIGHT); + napi_enable(&tfile->napi); + } + } +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index f24a1b0b801f..0becc79fd431 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1808,6 +1808,7 @@ static int lan78xx_mdio_init(struct lan78xx_net *dev) + dev->mdiobus->read = lan78xx_mdiobus_read; + dev->mdiobus->write = lan78xx_mdiobus_write; + dev->mdiobus->name = "lan78xx-mdiobus"; ++ dev->mdiobus->parent = &dev->udev->dev; + + snprintf(dev->mdiobus->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", + dev->udev->bus->busnum, dev->udev->devnum); +diff --git a/drivers/net/wireless/ath/ath10k/coredump.c b/drivers/net/wireless/ath/ath10k/coredump.c +index b6d2932383cf..1cfe75a2d0c3 100644 +--- a/drivers/net/wireless/ath/ath10k/coredump.c ++++ b/drivers/net/wireless/ath/ath10k/coredump.c +@@ -1208,9 +1208,11 @@ static struct ath10k_dump_file_data *ath10k_coredump_build(struct ath10k *ar) + dump_tlv = (struct ath10k_tlv_dump_data *)(buf + sofar); + dump_tlv->type = cpu_to_le32(ATH10K_FW_CRASH_DUMP_RAM_DATA); + dump_tlv->tlv_len = cpu_to_le32(crash_data->ramdump_buf_len); +- memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf, +- crash_data->ramdump_buf_len); +- sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len; ++ if (crash_data->ramdump_buf_len) { ++ memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf, ++ crash_data->ramdump_buf_len); ++ sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len; ++ } + } + + mutex_unlock(&ar->dump_mutex); +@@ -1257,6 +1259,9 @@ int ath10k_coredump_register(struct ath10k *ar) + if (test_bit(ATH10K_FW_CRASH_DUMP_RAM_DATA, &ath10k_coredump_mask)) { + crash_data->ramdump_buf_len = ath10k_coredump_get_ramdump_size(ar); + ++ if (!crash_data->ramdump_buf_len) ++ return 0; ++ + crash_data->ramdump_buf = vzalloc(crash_data->ramdump_buf_len); + if (!crash_data->ramdump_buf) + return -ENOMEM; +diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c +index 53f1095de8ff..9f0e7b4943ec 100644 +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -2726,7 +2726,7 @@ static void ath10k_htt_rx_tx_compl_ind(struct ath10k *ar, + spin_lock_bh(&ar->data_lock); + + peer = ath10k_peer_find_by_id(ar, peer_id); +- if (!peer) { ++ if (!peer || !peer->sta) { + spin_unlock_bh(&ar->data_lock); + rcu_read_unlock(); + continue; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index a6d21856b7e7..36d24ea126a2 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3708,7 +3708,7 @@ static int ath10k_mac_tx(struct ath10k *ar, + struct ieee80211_vif *vif, + enum ath10k_hw_txrx_mode txmode, + enum ath10k_mac_tx_path txpath, +- struct sk_buff *skb) ++ struct sk_buff *skb, bool noque_offchan) + { + struct ieee80211_hw *hw = ar->hw; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); +@@ -3738,10 +3738,10 @@ static int ath10k_mac_tx(struct ath10k *ar, + } + } + +- if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { ++ if (!noque_offchan && info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { + if (!ath10k_mac_tx_frm_has_freq(ar)) { +- ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac queued offchannel skb %pK len %d\n", ++ skb, skb->len); + + skb_queue_tail(&ar->offchan_tx_queue, skb); + ieee80211_queue_work(hw, &ar->offchan_tx_work); +@@ -3803,8 +3803,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + + mutex_lock(&ar->conf_mutex); + +- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK len %d\n", ++ skb, skb->len); + + hdr = (struct ieee80211_hdr *)skb->data; + peer_addr = ieee80211_get_DA(hdr); +@@ -3850,7 +3850,7 @@ void ath10k_offchan_tx_work(struct work_struct *work) + txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb); + txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode); + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, true); + if (ret) { + ath10k_warn(ar, "failed to transmit offchannel frame: %d\n", + ret); +@@ -3860,8 +3860,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + time_left = + wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ); + if (time_left == 0) +- ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n", +- skb); ++ ath10k_warn(ar, "timed out waiting for offchannel skb %pK, len: %d\n", ++ skb, skb->len); + + if (!peer && tmp_peer_created) { + ret = ath10k_peer_delete(ar, vdev_id, peer_addr); +@@ -3903,8 +3903,10 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work) + ar->running_fw->fw_file.fw_features)) { + paddr = dma_map_single(ar->dev, skb->data, + skb->len, DMA_TO_DEVICE); +- if (!paddr) ++ if (dma_mapping_error(ar->dev, paddr)) { ++ ieee80211_free_txskb(ar->hw, skb); + continue; ++ } + ret = ath10k_wmi_mgmt_tx_send(ar, skb, paddr); + if (ret) { + ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n", +@@ -4097,7 +4099,7 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (unlikely(ret)) { + ath10k_warn(ar, "failed to push frame: %d\n", ret); + +@@ -4378,7 +4380,7 @@ static void ath10k_mac_op_tx(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (ret) { + ath10k_warn(ar, "failed to transmit frame: %d\n", ret); + if (is_htt) { +diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c +index 4102df016931..39abf8b12903 100644 +--- a/drivers/net/wireless/ath/ath10k/txrx.c ++++ b/drivers/net/wireless/ath/ath10k/txrx.c +@@ -95,6 +95,8 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, + + info = IEEE80211_SKB_CB(msdu); + memset(&info->status, 0, sizeof(info->status)); ++ info->status.rates[0].idx = -1; ++ + trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id); + + if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index 406b367c284c..85cf96461dde 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -1350,6 +1350,11 @@ void brcmf_detach(struct device *dev) + brcmf_fweh_detach(drvr); + brcmf_proto_detach(drvr); + ++ if (drvr->mon_if) { ++ brcmf_net_detach(drvr->mon_if->ndev, false); ++ drvr->mon_if = NULL; ++ } ++ + /* make sure primary interface removed last */ + for (i = BRCMF_MAX_IFS - 1; i > -1; i--) { + if (drvr->iflist[i]) +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/led.c b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +index dd387aba3317..e8a4d604b910 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +@@ -171,6 +171,9 @@ void iwl_leds_init(struct iwl_priv *priv) + + priv->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(priv->hw->wiphy)); ++ if (!priv->led.name) ++ return; ++ + priv->led.brightness_set = iwl_led_brightness_set; + priv->led.blink_set = iwl_led_blink_set; + priv->led.max_brightness = 1; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +index d104da9170ca..72c4b2b8399d 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +@@ -129,6 +129,9 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm) + + mvm->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(mvm->hw->wiphy)); ++ if (!mvm->led.name) ++ return -ENOMEM; ++ + mvm->led.brightness_set = iwl_led_brightness_set; + mvm->led.max_brightness = 1; + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +index 0ad8ed23a455..5ee33c8ae9d2 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +@@ -60,6 +60,7 @@ + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + *****************************************************************************/ ++#include + #include + #include + #include "iwl-trans.h" +@@ -357,7 +358,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi, + rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data; + hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res)); + len = le16_to_cpu(rx_res->byte_count); +- rx_pkt_status = le32_to_cpup((__le32 *) ++ rx_pkt_status = get_unaligned_le32((__le32 *) + (pkt->data + sizeof(*rx_res) + len)); + + /* Dont use dev_alloc_skb(), we'll have enough headroom once +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index 19dd075f2f63..041dd75ac72b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -1429,6 +1429,7 @@ out_err: + static void iwl_pcie_rx_handle(struct iwl_trans *trans, int queue) + { + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); ++ struct napi_struct *napi; + struct iwl_rxq *rxq; + u32 r, i, count = 0; + bool emergency = false; +@@ -1534,8 +1535,16 @@ out: + if (unlikely(emergency && count)) + iwl_pcie_rxq_alloc_rbs(trans, GFP_ATOMIC, rxq); + +- if (rxq->napi.poll) +- napi_gro_flush(&rxq->napi, false); ++ napi = &rxq->napi; ++ if (napi->poll) { ++ if (napi->rx_count) { ++ netif_receive_skb_list(&napi->rx_list); ++ INIT_LIST_HEAD(&napi->rx_list); ++ napi->rx_count = 0; ++ } ++ ++ napi_gro_flush(napi, false); ++ } + + iwl_pcie_rxq_restock(trans, rxq); + } +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c +index ca3bb4d65b00..df8455f14e4d 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c +@@ -57,24 +57,6 @@ + #include "internal.h" + #include "fw/dbg.h" + +-static int iwl_pcie_gen2_force_power_gating(struct iwl_trans *trans) +-{ +- iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG, +- HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE); +- udelay(20); +- iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG, +- HPM_HIPM_GEN_CFG_CR_PG_EN | +- HPM_HIPM_GEN_CFG_CR_SLP_EN); +- udelay(20); +- iwl_clear_bits_prph(trans, HPM_HIPM_GEN_CFG, +- HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE); +- +- iwl_trans_sw_reset(trans); +- iwl_clear_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE); +- +- return 0; +-} +- + /* + * Start up NIC's basic functionality after it has been reset + * (e.g. after platform boot, or shutdown via iwl_pcie_apm_stop()) +@@ -110,13 +92,6 @@ int iwl_pcie_gen2_apm_init(struct iwl_trans *trans) + + iwl_pcie_apm_config(trans); + +- if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 && +- trans->cfg->integrated) { +- ret = iwl_pcie_gen2_force_power_gating(trans); +- if (ret) +- return ret; +- } +- + ret = iwl_finish_nic_init(trans, trans->trans_cfg); + if (ret) + return ret; +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 6961f00ff812..d3db38c3095b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -1783,6 +1783,29 @@ static int iwl_trans_pcie_clear_persistence_bit(struct iwl_trans *trans) + return 0; + } + ++static int iwl_pcie_gen2_force_power_gating(struct iwl_trans *trans) ++{ ++ int ret; ++ ++ ret = iwl_finish_nic_init(trans, trans->trans_cfg); ++ if (ret < 0) ++ return ret; ++ ++ iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG, ++ HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE); ++ udelay(20); ++ iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG, ++ HPM_HIPM_GEN_CFG_CR_PG_EN | ++ HPM_HIPM_GEN_CFG_CR_SLP_EN); ++ udelay(20); ++ iwl_clear_bits_prph(trans, HPM_HIPM_GEN_CFG, ++ HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE); ++ ++ iwl_trans_pcie_sw_reset(trans); ++ ++ return 0; ++} ++ + static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans) + { + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); +@@ -1802,6 +1825,13 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans) + + iwl_trans_pcie_sw_reset(trans); + ++ if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 && ++ trans->cfg->integrated) { ++ err = iwl_pcie_gen2_force_power_gating(trans); ++ if (err) ++ return err; ++ } ++ + err = iwl_pcie_apm_init(trans); + if (err) + return err; +diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c +index 242d8845da3f..30f1025ecb9b 100644 +--- a/drivers/net/wireless/marvell/libertas/if_sdio.c ++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c +@@ -1179,6 +1179,10 @@ static int if_sdio_probe(struct sdio_func *func, + + spin_lock_init(&card->lock); + card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0); ++ if (unlikely(!card->workqueue)) { ++ ret = -ENOMEM; ++ goto err_queue; ++ } + INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker); + init_waitqueue_head(&card->pwron_waitq); + +@@ -1230,6 +1234,7 @@ err_activate_card: + lbs_remove_card(priv); + free: + destroy_workqueue(card->workqueue); ++err_queue: + while (card->packets) { + packet = card->packets; + card->packets = card->packets->next; +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index eff06d59e9df..096334e941a1 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -687,8 +687,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + skb_put(skb, MAX_EVENT_SIZE); + + if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); ++ kfree(card->evtbd_ring_vbase); + return -1; ++ } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c +index c328192307c4..ff3f3d98b625 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c +@@ -1032,8 +1032,10 @@ mt7603_fill_txs(struct mt7603_dev *dev, struct mt7603_sta *sta, + if (idx && (cur_rate->idx != info->status.rates[i].idx || + cur_rate->flags != info->status.rates[i].flags)) { + i++; +- if (i == ARRAY_SIZE(info->status.rates)) ++ if (i == ARRAY_SIZE(info->status.rates)) { ++ i--; + break; ++ } + + info->status.rates[i] = *cur_rate; + info->status.rates[i].count = 0; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index e07ce2c10013..111e38ff954a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -914,8 +914,10 @@ static bool mt7615_fill_txs(struct mt7615_dev *dev, struct mt7615_sta *sta, + if (idx && (cur_rate->idx != info->status.rates[i].idx || + cur_rate->flags != info->status.rates[i].flags)) { + i++; +- if (i == ARRAY_SIZE(info->status.rates)) ++ if (i == ARRAY_SIZE(info->status.rates)) { ++ i--; + break; ++ } + + info->status.rates[i] = *cur_rate; + info->status.rates[i].count = 0; +diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c +index dc0c7244b60e..c0c32805fb8d 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c +@@ -83,6 +83,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus, + struct qlink_cmd *cmd; + struct qlink_resp *resp = NULL; + struct sk_buff *resp_skb = NULL; ++ int resp_res = 0; + u16 cmd_id; + u8 mac_id; + u8 vif_id; +@@ -113,6 +114,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus, + } + + resp = (struct qlink_resp *)resp_skb->data; ++ resp_res = le16_to_cpu(resp->result); + ret = qtnf_cmd_check_reply_header(resp, cmd_id, mac_id, vif_id, + const_resp_size); + if (ret) +@@ -128,8 +130,8 @@ out: + else + consume_skb(resp_skb); + +- if (!ret && resp) +- return qtnf_cmd_resp_result_decode(le16_to_cpu(resp->result)); ++ if (!ret) ++ return qtnf_cmd_resp_result_decode(resp_res); + + pr_warn("VIF%u.%u: cmd 0x%.4X failed: %d\n", + mac_id, vif_id, cmd_id, ret); +diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/wireless/quantenna/qtnfmac/event.c +index b57c8c18a8d0..7846383c8828 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/event.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/event.c +@@ -171,8 +171,9 @@ qtnf_event_handle_bss_join(struct qtnf_vif *vif, + return -EPROTO; + } + +- pr_debug("VIF%u.%u: BSSID:%pM status:%u\n", +- vif->mac->macid, vif->vifid, join_info->bssid, status); ++ pr_debug("VIF%u.%u: BSSID:%pM chan:%u status:%u\n", ++ vif->mac->macid, vif->vifid, join_info->bssid, ++ le16_to_cpu(join_info->chan.chan.center_freq), status); + + if (status != WLAN_STATUS_SUCCESS) + goto done; +@@ -181,7 +182,7 @@ qtnf_event_handle_bss_join(struct qtnf_vif *vif, + if (!cfg80211_chandef_valid(&chandef)) { + pr_warn("MAC%u.%u: bad channel freq=%u cf1=%u cf2=%u bw=%u\n", + vif->mac->macid, vif->vifid, +- chandef.chan->center_freq, ++ chandef.chan ? chandef.chan->center_freq : 0, + chandef.center_freq1, + chandef.center_freq2, + chandef.width); +diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c +index 8ae318b5fe54..4824be0c6231 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c +@@ -130,6 +130,8 @@ static int qtnf_dbg_shm_stats(struct seq_file *s, void *data) + + int qtnf_pcie_fw_boot_done(struct qtnf_bus *bus) + { ++ struct qtnf_pcie_bus_priv *priv = get_bus_priv(bus); ++ char card_id[64]; + int ret; + + bus->fw_state = QTNF_FW_STATE_BOOT_DONE; +@@ -137,7 +139,9 @@ int qtnf_pcie_fw_boot_done(struct qtnf_bus *bus) + if (ret) { + pr_err("failed to attach core\n"); + } else { +- qtnf_debugfs_init(bus, DRV_NAME); ++ snprintf(card_id, sizeof(card_id), "%s:%s", ++ DRV_NAME, pci_name(priv->pdev)); ++ qtnf_debugfs_init(bus, card_id); + qtnf_debugfs_add_entry(bus, "mps", qtnf_dbg_mps_show); + qtnf_debugfs_add_entry(bus, "msi_enabled", qtnf_dbg_msi_show); + qtnf_debugfs_add_entry(bus, "shm_stats", qtnf_dbg_shm_stats); +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index ade057d868f7..5e9ce03067de 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -1341,6 +1341,7 @@ struct rtl8xxxu_fileops { + u8 has_s0s1:1; + u8 has_tx_report:1; + u8 gen2_thermal_meter:1; ++ u8 needs_full_init:1; + u32 adda_1t_init; + u32 adda_1t_path_on; + u32 adda_2t_path_on_a; +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +index ceffe05bd65b..f3cd314d1a9c 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +@@ -1670,6 +1670,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops = { + .has_s0s1 = 1, + .has_tx_report = 1, + .gen2_thermal_meter = 1, ++ .needs_full_init = 1, + .adda_1t_init = 0x01c00014, + .adda_1t_path_on = 0x01c00014, + .adda_2t_path_on_a = 0x01c00014, +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index c6c41fb962ff..361248e97568 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -3902,6 +3902,9 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) + else + macpower = true; + ++ if (fops->needs_full_init) ++ macpower = false; ++ + ret = fops->power_on(priv); + if (ret < 0) { + dev_warn(dev, "%s: Failed power on\n", __func__); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +index 56cc3bc30860..f070f25bb735 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +@@ -1540,6 +1540,8 @@ static bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb) + * This is maybe necessary: + * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb); + */ ++ dev_kfree_skb(skb); ++ + return true; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 4b59f3b46b28..348b0072cdd6 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1021,8 +1021,10 @@ int rtl_usb_probe(struct usb_interface *intf, + rtlpriv->hw = hw; + rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32), + GFP_KERNEL); +- if (!rtlpriv->usb_data) ++ if (!rtlpriv->usb_data) { ++ ieee80211_free_hw(hw); + return -ENOMEM; ++ } + + /* this spin lock must be initialized early */ + spin_lock_init(&rtlpriv->locks.usb_lock); +@@ -1083,6 +1085,7 @@ error_out2: + _rtl_usb_io_handler_release(hw); + usb_put_dev(udev); + complete(&rtlpriv->firmware_loading_complete); ++ kfree(rtlpriv->usb_data); + return -ENODEV; + } + EXPORT_SYMBOL(rtl_usb_probe); +diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c +index 793b40bdbf7c..3e95ad198912 100644 +--- a/drivers/net/wireless/realtek/rtw88/coex.c ++++ b/drivers/net/wireless/realtek/rtw88/coex.c +@@ -1308,6 +1308,7 @@ static void rtw_coex_action_bt_inquiry(struct rtw_dev *rtwdev) + struct rtw_chip_info *chip = rtwdev->chip; + bool wl_hi_pri = false; + u8 table_case, tdma_case; ++ u32 slot_type = 0; + + if (coex_stat->wl_linkscan_proc || coex_stat->wl_hi_pri_task1 || + coex_stat->wl_hi_pri_task2) +@@ -1318,14 +1319,16 @@ static void rtw_coex_action_bt_inquiry(struct rtw_dev *rtwdev) + if (wl_hi_pri) { + table_case = 15; + if (coex_stat->bt_a2dp_exist && +- !coex_stat->bt_pan_exist) ++ !coex_stat->bt_pan_exist) { ++ slot_type = TDMA_4SLOT; + tdma_case = 11; +- else if (coex_stat->wl_hi_pri_task1) ++ } else if (coex_stat->wl_hi_pri_task1) { + tdma_case = 6; +- else if (!coex_stat->bt_page) ++ } else if (!coex_stat->bt_page) { + tdma_case = 8; +- else ++ } else { + tdma_case = 9; ++ } + } else if (coex_stat->wl_connected) { + table_case = 10; + tdma_case = 10; +@@ -1361,7 +1364,7 @@ static void rtw_coex_action_bt_inquiry(struct rtw_dev *rtwdev) + rtw_coex_set_ant_path(rtwdev, false, COEX_SET_ANT_2G); + rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]); + rtw_coex_table(rtwdev, table_case); +- rtw_coex_tdma(rtwdev, false, tdma_case); ++ rtw_coex_tdma(rtwdev, false, tdma_case | slot_type); + } + + static void rtw_coex_action_bt_hfp(struct rtw_dev *rtwdev) +@@ -1475,13 +1478,13 @@ static void rtw_coex_action_bt_a2dp(struct rtw_dev *rtwdev) + + if (efuse->share_ant) { + /* Shared-Ant */ ++ slot_type = TDMA_4SLOT; ++ + if (coex_stat->wl_gl_busy && coex_stat->wl_noisy_level == 0) + table_case = 10; + else + table_case = 9; + +- slot_type = TDMA_4SLOT; +- + if (coex_stat->wl_gl_busy) + tdma_case = 13; + else +@@ -1585,13 +1588,14 @@ static void rtw_coex_action_bt_a2dp_hid(struct rtw_dev *rtwdev) + + if (efuse->share_ant) { + /* Shared-Ant */ ++ slot_type = TDMA_4SLOT; ++ + if (coex_stat->bt_ble_exist) + table_case = 26; + else + table_case = 9; + + if (coex_stat->wl_gl_busy) { +- slot_type = TDMA_4SLOT; + tdma_case = 13; + } else { + tdma_case = 14; +@@ -1794,10 +1798,12 @@ static void rtw_coex_action_wl_linkscan(struct rtw_dev *rtwdev) + struct rtw_efuse *efuse = &rtwdev->efuse; + struct rtw_chip_info *chip = rtwdev->chip; + u8 table_case, tdma_case; ++ u32 slot_type = 0; + + if (efuse->share_ant) { + /* Shared-Ant */ + if (coex_stat->bt_a2dp_exist) { ++ slot_type = TDMA_4SLOT; + table_case = 9; + tdma_case = 11; + } else { +@@ -1818,7 +1824,7 @@ static void rtw_coex_action_wl_linkscan(struct rtw_dev *rtwdev) + rtw_coex_set_ant_path(rtwdev, true, COEX_SET_ANT_2G); + rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]); + rtw_coex_table(rtwdev, table_case); +- rtw_coex_tdma(rtwdev, false, tdma_case); ++ rtw_coex_tdma(rtwdev, false, tdma_case | slot_type); + } + + static void rtw_coex_action_wl_not_connected(struct rtw_dev *rtwdev) +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 6dd457741b15..7a3a4911bde2 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1020,7 +1020,8 @@ static int rtw_dump_hw_feature(struct rtw_dev *rtwdev) + + rtw_hw_config_rf_ant_num(rtwdev, efuse->hw_cap.ant_num); + +- if (efuse->hw_cap.nss == EFUSE_HW_CAP_IGNORE) ++ if (efuse->hw_cap.nss == EFUSE_HW_CAP_IGNORE || ++ efuse->hw_cap.nss > rtwdev->hal.rf_path_num) + efuse->hw_cap.nss = rtwdev->hal.rf_path_num; + + rtw_dbg(rtwdev, RTW_DBG_EFUSE, +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 4d1909aecd6c..9f60e4dc5a90 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -278,7 +278,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client, + + r = devm_acpi_dev_add_driver_gpios(dev, acpi_nxp_nci_gpios); + if (r) +- return r; ++ dev_dbg(dev, "Unable to add GPIO mapping table\n"); + + phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW); + if (IS_ERR(phy->gpiod_en)) { +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index af3212aec871..a6b7b242d516 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -313,7 +313,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved) + if (blk_mq_request_completed(req)) + return true; + +- nvme_req(req)->status = NVME_SC_HOST_PATH_ERROR; ++ nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD; + blk_mq_complete_request(req); + return true; + } +@@ -611,8 +611,14 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req, + struct nvme_dsm_range *range; + struct bio *bio; + +- range = kmalloc_array(segments, sizeof(*range), +- GFP_ATOMIC | __GFP_NOWARN); ++ /* ++ * Some devices do not consider the DSM 'Number of Ranges' field when ++ * determining how much data to DMA. Always allocate memory for maximum ++ * number of segments to prevent device reading beyond end of buffer. ++ */ ++ static const size_t alloc_size = sizeof(*range) * NVME_DSM_MAX_RANGES; ++ ++ range = kzalloc(alloc_size, GFP_ATOMIC | __GFP_NOWARN); + if (!range) { + /* + * If we fail allocation our range, fallback to the controller +@@ -652,7 +658,7 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req, + + req->special_vec.bv_page = virt_to_page(range); + req->special_vec.bv_offset = offset_in_page(range); +- req->special_vec.bv_len = sizeof(*range) * segments; ++ req->special_vec.bv_len = alloc_size; + req->rq_flags |= RQF_SPECIAL_PAYLOAD; + + return BLK_STS_OK; +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index e0f064dcbd02..132ade51ee87 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -95,6 +95,7 @@ void nvme_failover_req(struct request *req) + } + break; + case NVME_SC_HOST_PATH_ERROR: ++ case NVME_SC_HOST_ABORTED_CMD: + /* + * Temporary transport disruption in talking to the controller. + * Try to send on a new path. +diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c +index dff2f3c357f5..fc40555ca4cd 100644 +--- a/drivers/nvmem/imx-ocotp.c ++++ b/drivers/nvmem/imx-ocotp.c +@@ -521,6 +521,10 @@ static int imx_ocotp_probe(struct platform_device *pdev) + if (IS_ERR(priv->clk)) + return PTR_ERR(priv->clk); + ++ clk_prepare_enable(priv->clk); ++ imx_ocotp_clr_err_if_set(priv->base); ++ clk_disable_unprepare(priv->clk); ++ + priv->params = of_device_get_match_data(&pdev->dev); + imx_ocotp_nvmem_config.size = 4 * priv->params->nregs; + imx_ocotp_nvmem_config.dev = dev; +diff --git a/drivers/parport/share.c b/drivers/parport/share.c +index 7b4ee33c1935..15c81cffd2de 100644 +--- a/drivers/parport/share.c ++++ b/drivers/parport/share.c +@@ -230,6 +230,18 @@ static int port_check(struct device *dev, void *dev_drv) + return 0; + } + ++/* ++ * Iterates through all the devices connected to the bus and return 1 ++ * if the device is a parallel port. ++ */ ++ ++static int port_detect(struct device *dev, void *dev_drv) ++{ ++ if (is_parport(dev)) ++ return 1; ++ return 0; ++} ++ + /** + * parport_register_driver - register a parallel port device driver + * @drv: structure describing the driver +@@ -282,6 +294,15 @@ int __parport_register_driver(struct parport_driver *drv, struct module *owner, + if (ret) + return ret; + ++ /* ++ * check if bus has any parallel port registered, if ++ * none is found then load the lowlevel driver. ++ */ ++ ret = bus_for_each_dev(&parport_bus_type, NULL, NULL, ++ port_detect); ++ if (!ret) ++ get_lowlevel_driver(); ++ + mutex_lock(®istration_lock); + if (drv->match_port) + bus_for_each_dev(&parport_bus_type, NULL, drv, +diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hs.c b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +index b163b3a1558d..61054272a7c8 100644 +--- a/drivers/phy/qualcomm/phy-qcom-usb-hs.c ++++ b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +@@ -158,8 +158,8 @@ static int qcom_usb_hs_phy_power_on(struct phy *phy) + /* setup initial state */ + qcom_usb_hs_phy_vbus_notifier(&uphy->vbus_notify, state, + uphy->vbus_edev); +- ret = devm_extcon_register_notifier(&ulpi->dev, uphy->vbus_edev, +- EXTCON_USB, &uphy->vbus_notify); ++ ret = extcon_register_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + if (ret) + goto err_ulpi; + } +@@ -180,6 +180,9 @@ static int qcom_usb_hs_phy_power_off(struct phy *phy) + { + struct qcom_usb_hs_phy *uphy = phy_get_drvdata(phy); + ++ if (uphy->vbus_edev) ++ extcon_unregister_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + regulator_disable(uphy->v3p3); + regulator_disable(uphy->v1p8); + clk_disable_unprepare(uphy->sleep_clk); +diff --git a/drivers/phy/renesas/phy-rcar-gen2.c b/drivers/phy/renesas/phy-rcar-gen2.c +index 2926e4937301..2e279ac0fa4d 100644 +--- a/drivers/phy/renesas/phy-rcar-gen2.c ++++ b/drivers/phy/renesas/phy-rcar-gen2.c +@@ -71,6 +71,7 @@ struct rcar_gen2_phy_driver { + struct rcar_gen2_phy_data { + const struct phy_ops *gen2_phy_ops; + const u32 (*select_value)[PHYS_PER_CHANNEL]; ++ const u32 num_channels; + }; + + static int rcar_gen2_phy_init(struct phy *p) +@@ -271,11 +272,13 @@ static const u32 usb20_select_value[][PHYS_PER_CHANNEL] = { + static const struct rcar_gen2_phy_data rcar_gen2_usb_phy_data = { + .gen2_phy_ops = &rcar_gen2_phy_ops, + .select_value = pci_select_value, ++ .num_channels = ARRAY_SIZE(pci_select_value), + }; + + static const struct rcar_gen2_phy_data rz_g1c_usb_phy_data = { + .gen2_phy_ops = &rz_g1c_phy_ops, + .select_value = usb20_select_value, ++ .num_channels = ARRAY_SIZE(usb20_select_value), + }; + + static const struct of_device_id rcar_gen2_phy_match_table[] = { +@@ -389,7 +392,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev) + channel->selected_phy = -1; + + error = of_property_read_u32(np, "reg", &channel_num); +- if (error || channel_num > 2) { ++ if (error || channel_num >= data->num_channels) { + dev_err(dev, "Invalid \"reg\" property\n"); + of_node_put(np); + return error; +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index 5d6d8b1e9062..dbaacde1b36a 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -29,6 +29,13 @@ struct pinctrl_dt_map { + static void dt_free_map(struct pinctrl_dev *pctldev, + struct pinctrl_map *map, unsigned num_maps) + { ++ int i; ++ ++ for (i = 0; i < num_maps; ++i) { ++ kfree_const(map[i].dev_name); ++ map[i].dev_name = NULL; ++ } ++ + if (pctldev) { + const struct pinctrl_ops *ops = pctldev->desc->pctlops; + if (ops->dt_free_map) +@@ -63,7 +70,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Initialize common mapping table entry fields */ + for (i = 0; i < num_maps; i++) { +- map[i].dev_name = dev_name(p->dev); ++ const char *devname; ++ ++ devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL); ++ if (!devname) ++ goto err_free_map; ++ ++ map[i].dev_name = devname; + map[i].name = statename; + if (pctldev) + map[i].ctrl_dev_name = dev_name(pctldev->dev); +@@ -71,10 +84,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Remember the converted mapping table entries */ + dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL); +- if (!dt_map) { +- dt_free_map(pctldev, map, num_maps); +- return -ENOMEM; +- } ++ if (!dt_map) ++ goto err_free_map; + + dt_map->pctldev = pctldev; + dt_map->map = map; +@@ -82,6 +93,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + list_add_tail(&dt_map->node, &p->dt_maps); + + return pinctrl_register_map(map, num_maps, false); ++ ++err_free_map: ++ dt_free_map(pctldev, map, num_maps); ++ return -ENOMEM; + } + + struct pinctrl_dev *of_pinctrl_get(struct device_node *np) +diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c +index 9ffb22211d2b..7d658e6627e7 100644 +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -110,7 +110,6 @@ struct byt_gpio { + struct platform_device *pdev; + struct pinctrl_dev *pctl_dev; + struct pinctrl_desc pctl_desc; +- raw_spinlock_t lock; + const struct intel_pinctrl_soc_data *soc_data; + struct intel_community *communities_copy; + struct byt_gpio_pin_context *saved_context; +@@ -549,6 +548,8 @@ static const struct intel_pinctrl_soc_data *byt_soc_data[] = { + NULL + }; + ++static DEFINE_RAW_SPINLOCK(byt_lock); ++ + static struct intel_community *byt_get_community(struct byt_gpio *vg, + unsigned int pin) + { +@@ -658,7 +659,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg, + unsigned long flags; + int i; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + for (i = 0; i < group.npins; i++) { + void __iomem *padcfg0; +@@ -678,7 +679,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg, + writel(value, padcfg0); + } + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static void byt_set_group_mixed_mux(struct byt_gpio *vg, +@@ -688,7 +689,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg, + unsigned long flags; + int i; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + for (i = 0; i < group.npins; i++) { + void __iomem *padcfg0; +@@ -708,7 +709,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg, + writel(value, padcfg0); + } + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static int byt_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector, +@@ -749,11 +750,11 @@ static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned int offset) + unsigned long flags; + u32 value; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + value = readl(reg); + value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL); + writel(value, reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev, +@@ -765,7 +766,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev, + u32 value, gpio_mux; + unsigned long flags; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + /* + * In most cases, func pin mux 000 means GPIO function. +@@ -787,7 +788,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev, + "pin %u forcibly re-configured as GPIO\n", offset); + } + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + pm_runtime_get(&vg->pdev->dev); + +@@ -815,7 +816,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, + unsigned long flags; + u32 value; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + value = readl(val_reg); + value &= ~BYT_DIR_MASK; +@@ -832,7 +833,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, + "Potential Error: Setting GPIO with direct_irq_en to output"); + writel(value, val_reg); + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + return 0; + } +@@ -901,11 +902,11 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset, + u32 conf, pull, val, debounce; + u16 arg = 0; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + conf = readl(conf_reg); + pull = conf & BYT_PULL_ASSIGN_MASK; + val = readl(val_reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + switch (param) { + case PIN_CONFIG_BIAS_DISABLE: +@@ -932,9 +933,9 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset, + if (!(conf & BYT_DEBOUNCE_EN)) + return -EINVAL; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + debounce = readl(db_reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + switch (debounce & BYT_DEBOUNCE_PULSE_MASK) { + case BYT_DEBOUNCE_PULSE_375US: +@@ -986,7 +987,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, + u32 conf, val, debounce; + int i, ret = 0; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + conf = readl(conf_reg); + val = readl(val_reg); +@@ -1094,7 +1095,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, + if (!ret) + writel(conf, conf_reg); + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + return ret; + } +@@ -1119,9 +1120,9 @@ static int byt_gpio_get(struct gpio_chip *chip, unsigned int offset) + unsigned long flags; + u32 val; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + val = readl(reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + return !!(val & BYT_LEVEL); + } +@@ -1136,13 +1137,13 @@ static void byt_gpio_set(struct gpio_chip *chip, unsigned int offset, int value) + if (!reg) + return; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + old_val = readl(reg); + if (value) + writel(old_val | BYT_LEVEL, reg); + else + writel(old_val & ~BYT_LEVEL, reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) +@@ -1155,9 +1156,9 @@ static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) + if (!reg) + return -EINVAL; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + value = readl(reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + if (!(value & BYT_OUTPUT_EN)) + return 0; +@@ -1200,14 +1201,14 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip) + const char *label; + unsigned int pin; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + pin = vg->soc_data->pins[i].number; + reg = byt_gpio_reg(vg, pin, BYT_CONF0_REG); + if (!reg) { + seq_printf(s, + "Could not retrieve pin %i conf0 reg\n", + pin); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + continue; + } + conf0 = readl(reg); +@@ -1216,11 +1217,11 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip) + if (!reg) { + seq_printf(s, + "Could not retrieve pin %i val reg\n", pin); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + continue; + } + val = readl(reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + comm = byt_get_community(vg, pin); + if (!comm) { +@@ -1304,9 +1305,9 @@ static void byt_irq_ack(struct irq_data *d) + if (!reg) + return; + +- raw_spin_lock(&vg->lock); ++ raw_spin_lock(&byt_lock); + writel(BIT(offset % 32), reg); +- raw_spin_unlock(&vg->lock); ++ raw_spin_unlock(&byt_lock); + } + + static void byt_irq_mask(struct irq_data *d) +@@ -1330,7 +1331,7 @@ static void byt_irq_unmask(struct irq_data *d) + if (!reg) + return; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + value = readl(reg); + + switch (irqd_get_trigger_type(d)) { +@@ -1353,7 +1354,7 @@ static void byt_irq_unmask(struct irq_data *d) + + writel(value, reg); + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static int byt_irq_type(struct irq_data *d, unsigned int type) +@@ -1367,7 +1368,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type) + if (!reg || offset >= vg->chip.ngpio) + return -EINVAL; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + value = readl(reg); + + WARN(value & BYT_DIRECT_IRQ_EN, +@@ -1389,7 +1390,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type) + else if (type & IRQ_TYPE_LEVEL_MASK) + irq_set_handler_locked(d, handle_level_irq); + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + return 0; + } +@@ -1425,9 +1426,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc) + continue; + } + +- raw_spin_lock(&vg->lock); ++ raw_spin_lock(&byt_lock); + pending = readl(reg); +- raw_spin_unlock(&vg->lock); ++ raw_spin_unlock(&byt_lock); + for_each_set_bit(pin, &pending, 32) { + virq = irq_find_mapping(vg->chip.irq.domain, base + pin); + generic_handle_irq(virq); +@@ -1638,8 +1639,6 @@ static int byt_pinctrl_probe(struct platform_device *pdev) + return PTR_ERR(vg->pctl_dev); + } + +- raw_spin_lock_init(&vg->lock); +- + ret = byt_gpio_probe(vg); + if (ret) + return ret; +@@ -1654,8 +1653,11 @@ static int byt_pinctrl_probe(struct platform_device *pdev) + static int byt_gpio_suspend(struct device *dev) + { + struct byt_gpio *vg = dev_get_drvdata(dev); ++ unsigned long flags; + int i; + ++ raw_spin_lock_irqsave(&byt_lock, flags); ++ + for (i = 0; i < vg->soc_data->npins; i++) { + void __iomem *reg; + u32 value; +@@ -1676,14 +1678,18 @@ static int byt_gpio_suspend(struct device *dev) + vg->saved_context[i].val = value; + } + ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + return 0; + } + + static int byt_gpio_resume(struct device *dev) + { + struct byt_gpio *vg = dev_get_drvdata(dev); ++ unsigned long flags; + int i; + ++ raw_spin_lock_irqsave(&byt_lock, flags); ++ + for (i = 0; i < vg->soc_data->npins; i++) { + void __iomem *reg; + u32 value; +@@ -1721,6 +1727,7 @@ static int byt_gpio_resume(struct device *dev) + } + } + ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + return 0; + } + #endif +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 2c61141519f8..eab078244a4c 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -540,7 +540,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id) + irqreturn_t ret = IRQ_NONE; + unsigned int i, irqnr; + unsigned long flags; +- u32 *regs, regval; ++ u32 __iomem *regs; ++ u32 regval; + u64 status, mask; + + /* Read the wake status */ +diff --git a/drivers/pinctrl/qcom/pinctrl-sc7180.c b/drivers/pinctrl/qcom/pinctrl-sc7180.c +index 6399c8a2bc22..d6cfad7417b1 100644 +--- a/drivers/pinctrl/qcom/pinctrl-sc7180.c ++++ b/drivers/pinctrl/qcom/pinctrl-sc7180.c +@@ -77,6 +77,7 @@ enum { + .intr_cfg_reg = 0, \ + .intr_status_reg = 0, \ + .intr_target_reg = 0, \ ++ .tile = SOUTH, \ + .mux_bit = -1, \ + .pull_bit = pull, \ + .drv_bit = drv, \ +@@ -102,6 +103,7 @@ enum { + .intr_cfg_reg = 0, \ + .intr_status_reg = 0, \ + .intr_target_reg = 0, \ ++ .tile = SOUTH, \ + .mux_bit = -1, \ + .pull_bit = 3, \ + .drv_bit = 0, \ +@@ -1087,14 +1089,14 @@ static const struct msm_pingroup sc7180_groups[] = { + [116] = PINGROUP(116, WEST, qup04, qup04, _, _, _, _, _, _, _), + [117] = PINGROUP(117, WEST, dp_hot, _, _, _, _, _, _, _, _), + [118] = PINGROUP(118, WEST, _, _, _, _, _, _, _, _, _), +- [119] = UFS_RESET(ufs_reset, 0x97f000), +- [120] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x97a000, 15, 0), +- [121] = SDC_QDSD_PINGROUP(sdc1_clk, 0x97a000, 13, 6), +- [122] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x97a000, 11, 3), +- [123] = SDC_QDSD_PINGROUP(sdc1_data, 0x97a000, 9, 0), +- [124] = SDC_QDSD_PINGROUP(sdc2_clk, 0x97b000, 14, 6), +- [125] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x97b000, 11, 3), +- [126] = SDC_QDSD_PINGROUP(sdc2_data, 0x97b000, 9, 0), ++ [119] = UFS_RESET(ufs_reset, 0x7f000), ++ [120] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x7a000, 15, 0), ++ [121] = SDC_QDSD_PINGROUP(sdc1_clk, 0x7a000, 13, 6), ++ [122] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x7a000, 11, 3), ++ [123] = SDC_QDSD_PINGROUP(sdc1_data, 0x7a000, 9, 0), ++ [124] = SDC_QDSD_PINGROUP(sdc2_clk, 0x7b000, 14, 6), ++ [125] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x7b000, 11, 3), ++ [126] = SDC_QDSD_PINGROUP(sdc2_data, 0x7b000, 9, 0), + }; + + static const struct msm_pinctrl_soc_data sc7180_pinctrl = { +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c +index 2dfb8d9cfda1..5200dadd6b3e 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c +@@ -448,6 +448,8 @@ FM(IP12_31_28) IP12_31_28 FM(IP13_31_28) IP13_31_28 FM(IP14_31_28) IP14_31_28 FM + #define MOD_SEL0_1_0 REV4(FM(SEL_SPEED_PULSE_IF_0), FM(SEL_SPEED_PULSE_IF_1), FM(SEL_SPEED_PULSE_IF_2), F_(0, 0)) + + /* MOD_SEL1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 */ /* 4 */ /* 5 */ /* 6 */ /* 7 */ ++#define MOD_SEL1_31 FM(SEL_SIMCARD_0) FM(SEL_SIMCARD_1) ++#define MOD_SEL1_30 FM(SEL_SSI2_0) FM(SEL_SSI2_1) + #define MOD_SEL1_29 FM(SEL_TIMER_TMU_0) FM(SEL_TIMER_TMU_1) + #define MOD_SEL1_28 FM(SEL_USB_20_CH0_0) FM(SEL_USB_20_CH0_1) + #define MOD_SEL1_26 FM(SEL_DRIF2_0) FM(SEL_DRIF2_1) +@@ -468,7 +470,8 @@ FM(IP12_31_28) IP12_31_28 FM(IP13_31_28) IP13_31_28 FM(IP14_31_28) IP14_31_28 FM + + #define PINMUX_MOD_SELS \ + \ +-MOD_SEL0_30_29 \ ++ MOD_SEL1_31 \ ++MOD_SEL0_30_29 MOD_SEL1_30 \ + MOD_SEL1_29 \ + MOD_SEL0_28 MOD_SEL1_28 \ + MOD_SEL0_27_26 \ +@@ -1058,7 +1061,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP10_27_24, RIF0_CLK_B, SEL_DRIF0_1), + PINMUX_IPSR_MSEL(IP10_27_24, SCL2_B, SEL_I2C2_1), + PINMUX_IPSR_MSEL(IP10_27_24, TCLK1_A, SEL_TIMER_TMU_0), +- PINMUX_IPSR_GPSR(IP10_27_24, SSI_SCK2_B), ++ PINMUX_IPSR_MSEL(IP10_27_24, SSI_SCK2_B, SEL_SSI2_1), + PINMUX_IPSR_GPSR(IP10_27_24, TS_SCK0), + + PINMUX_IPSR_GPSR(IP10_31_28, SD0_WP), +@@ -1067,7 +1070,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP10_31_28, RIF0_D0_B, SEL_DRIF0_1), + PINMUX_IPSR_MSEL(IP10_31_28, SDA2_B, SEL_I2C2_1), + PINMUX_IPSR_MSEL(IP10_31_28, TCLK2_A, SEL_TIMER_TMU_0), +- PINMUX_IPSR_GPSR(IP10_31_28, SSI_WS2_B), ++ PINMUX_IPSR_MSEL(IP10_31_28, SSI_WS2_B, SEL_SSI2_1), + PINMUX_IPSR_GPSR(IP10_31_28, TS_SDAT0), + + /* IPSR11 */ +@@ -1085,13 +1088,13 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_MSEL(IP11_11_8, RX0_A, SEL_SCIF0_0), + PINMUX_IPSR_MSEL(IP11_11_8, HRX1_A, SEL_HSCIF1_0), +- PINMUX_IPSR_GPSR(IP11_11_8, SSI_SCK2_A), ++ PINMUX_IPSR_MSEL(IP11_11_8, SSI_SCK2_A, SEL_SSI2_0), + PINMUX_IPSR_GPSR(IP11_11_8, RIF1_SYNC), + PINMUX_IPSR_GPSR(IP11_11_8, TS_SCK1), + + PINMUX_IPSR_MSEL(IP11_15_12, TX0_A, SEL_SCIF0_0), + PINMUX_IPSR_GPSR(IP11_15_12, HTX1_A), +- PINMUX_IPSR_GPSR(IP11_15_12, SSI_WS2_A), ++ PINMUX_IPSR_MSEL(IP11_15_12, SSI_WS2_A, SEL_SSI2_0), + PINMUX_IPSR_GPSR(IP11_15_12, RIF1_D0), + PINMUX_IPSR_GPSR(IP11_15_12, TS_SDAT1), + +@@ -1196,7 +1199,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP13_19_16, RIF0_D1_A, SEL_DRIF0_0), + PINMUX_IPSR_MSEL(IP13_19_16, SDA1_B, SEL_I2C1_1), + PINMUX_IPSR_MSEL(IP13_19_16, TCLK2_B, SEL_TIMER_TMU_1), +- PINMUX_IPSR_GPSR(IP13_19_16, SIM0_D_A), ++ PINMUX_IPSR_MSEL(IP13_19_16, SIM0_D_A, SEL_SIMCARD_0), + + PINMUX_IPSR_GPSR(IP13_23_20, MLB_DAT), + PINMUX_IPSR_MSEL(IP13_23_20, TX0_B, SEL_SCIF0_1), +@@ -1264,7 +1267,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP15_15_12, TPU0TO2), + PINMUX_IPSR_MSEL(IP15_15_12, SDA1_D, SEL_I2C1_3), + PINMUX_IPSR_MSEL(IP15_15_12, FSO_CFE_1_N_B, SEL_FSO_1), +- PINMUX_IPSR_GPSR(IP15_15_12, SIM0_D_B), ++ PINMUX_IPSR_MSEL(IP15_15_12, SIM0_D_B, SEL_SIMCARD_1), + + PINMUX_IPSR_GPSR(IP15_19_16, SSI_SDATA6), + PINMUX_IPSR_MSEL(IP15_19_16, HRTS2_N_A, SEL_HSCIF2_0), +@@ -4957,11 +4960,11 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + MOD_SEL0_1_0 )) + }, + { PINMUX_CFG_REG_VAR("MOD_SEL1", 0xe6060504, 32, +- GROUP(2, 1, 1, 1, 1, 1, 3, 3, 1, 1, 1, 1, +- 2, 2, 2, 1, 1, 2, 1, 4), ++ GROUP(1, 1, 1, 1, 1, 1, 1, 3, 3, 1, 1, 1, ++ 1, 2, 2, 2, 1, 1, 2, 1, 4), + GROUP( +- /* RESERVED 31, 30 */ +- 0, 0, 0, 0, ++ MOD_SEL1_31 ++ MOD_SEL1_30 + MOD_SEL1_29 + MOD_SEL1_28 + /* RESERVED 27 */ +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +index 5dfd991ffdaa..dbc36079c381 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +@@ -1450,7 +1450,7 @@ static const struct pinmux_func pinmux_func_gpios[] = { + GPIO_FN(ET0_ETXD2_A), + GPIO_FN(EX_CS5), GPIO_FN(SD1_CMD_A), GPIO_FN(ATADIR), GPIO_FN(QSSL_B), + GPIO_FN(ET0_ETXD3_A), +- GPIO_FN(RD_WR), GPIO_FN(TCLK1_B), ++ GPIO_FN(RD_WR), GPIO_FN(TCLK0), GPIO_FN(CAN_CLK_B), GPIO_FN(ET0_ETXD4), + GPIO_FN(EX_WAIT0), GPIO_FN(TCLK1_B), + GPIO_FN(EX_WAIT1), GPIO_FN(SD1_DAT0_A), GPIO_FN(DREQ2), + GPIO_FN(CAN1_TX_C), GPIO_FN(ET0_LINK_C), GPIO_FN(ET0_ETXD5_A), +@@ -1949,7 +1949,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + /* IP3_20 [1] */ + FN_EX_WAIT0, FN_TCLK1_B, + /* IP3_19_18 [2] */ +- FN_RD_WR, FN_TCLK1_B, 0, 0, ++ FN_RD_WR, FN_TCLK0, FN_CAN_CLK_B, FN_ET0_ETXD4, + /* IP3_17_15 [3] */ + FN_EX_CS5, FN_SD1_CMD_A, FN_ATADIR, FN_QSSL_B, + FN_ET0_ETXD3_A, 0, 0, 0, +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index 9579a706fc08..a881b709af25 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -300,7 +300,7 @@ static int __init hp_wmi_bios_2008_later(void) + + static int __init hp_wmi_bios_2009_later(void) + { +- int state = 0; ++ u8 state[128]; + int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, HPWMI_READ, &state, + sizeof(state), sizeof(state)); + if (!ret) +diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c +index 61d6447d1966..00a96e4a1cdc 100644 +--- a/drivers/power/supply/cpcap-battery.c ++++ b/drivers/power/supply/cpcap-battery.c +@@ -562,12 +562,14 @@ static irqreturn_t cpcap_battery_irq_thread(int irq, void *data) + switch (d->action) { + case CPCAP_BATTERY_IRQ_ACTION_BATTERY_LOW: + if (latest->current_ua >= 0) +- dev_warn(ddata->dev, "Battery low at 3.3V!\n"); ++ dev_warn(ddata->dev, "Battery low at %imV!\n", ++ latest->voltage / 1000); + break; + case CPCAP_BATTERY_IRQ_ACTION_POWEROFF: +- if (latest->current_ua >= 0) { ++ if (latest->current_ua >= 0 && latest->voltage <= 3200000) { + dev_emerg(ddata->dev, +- "Battery empty at 3.1V, powering off\n"); ++ "Battery empty at %imV, powering off\n", ++ latest->voltage / 1000); + orderly_poweroff(true); + } + break; +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index a46be221dbdc..87bc06b386a0 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1403,7 +1403,9 @@ static int set_machine_constraints(struct regulator_dev *rdev, + rdev_err(rdev, "failed to enable\n"); + return ret; + } +- rdev->use_count++; ++ ++ if (rdev->constraints->always_on) ++ rdev->use_count++; + } + + print_constraints(rdev); +@@ -5198,6 +5200,7 @@ unset_supplies: + regulator_remove_coupling(rdev); + mutex_unlock(®ulator_list_mutex); + wash: ++ kfree(rdev->coupling_desc.coupled_rdevs); + kfree(rdev->constraints); + mutex_lock(®ulator_list_mutex); + regulator_ena_gpio_free(rdev); +diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c +index 76152aaa330b..96dc0eea7659 100644 +--- a/drivers/regulator/max8907-regulator.c ++++ b/drivers/regulator/max8907-regulator.c +@@ -296,7 +296,10 @@ static int max8907_regulator_probe(struct platform_device *pdev) + memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc)); + + /* Backwards compatibility with MAX8907B; SD1 uses different voltages */ +- regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ ret = regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_II2RR_VERSION_MASK) == + MAX8907_II2RR_VERSION_REV_B) { + pmic->desc[MAX8907_SD1].min_uV = 637500; +@@ -333,14 +336,20 @@ static int max8907_regulator_probe(struct platform_device *pdev) + } + + if (pmic->desc[i].ops == &max8907_ldo_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_MASK_LDO_SEQ) != + MAX8907_MASK_LDO_SEQ) + pmic->desc[i].ops = &max8907_ldo_hwctl_ops; + } else if (pmic->desc[i].ops == &max8907_out5v_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & (MAX8907_MASK_OUT5V_VINEN | + MAX8907_MASK_OUT5V_ENSRC)) != + MAX8907_MASK_OUT5V_ENSRC) +diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c +index 13c54eac0cc3..d1839707128a 100644 +--- a/drivers/soundwire/intel.c ++++ b/drivers/soundwire/intel.c +@@ -479,7 +479,10 @@ intel_pdi_shim_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi) + unsigned int link_id = sdw->instance; + int pdi_conf = 0; + +- pdi->intel_alh_id = (link_id * 16) + pdi->num + 5; ++ /* the Bulk and PCM streams are not contiguous */ ++ pdi->intel_alh_id = (link_id * 16) + pdi->num + 3; ++ if (pdi->num >= 2) ++ pdi->intel_alh_id += 2; + + /* + * Program stream parameters to stream SHIM register +@@ -508,7 +511,10 @@ intel_pdi_alh_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi) + unsigned int link_id = sdw->instance; + unsigned int conf; + +- pdi->intel_alh_id = (link_id * 16) + pdi->num + 5; ++ /* the Bulk and PCM streams are not contiguous */ ++ pdi->intel_alh_id = (link_id * 16) + pdi->num + 3; ++ if (pdi->num >= 2) ++ pdi->intel_alh_id += 2; + + /* Program Stream config ALH register */ + conf = intel_readl(alh, SDW_ALH_STRMZCFG(pdi->intel_alh_id)); +diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c +index c36587b42e95..82a0ee09cbe1 100644 +--- a/drivers/spi/spi-cadence.c ++++ b/drivers/spi/spi-cadence.c +@@ -168,16 +168,16 @@ static void cdns_spi_init_hw(struct cdns_spi *xspi) + /** + * cdns_spi_chipselect - Select or deselect the chip select line + * @spi: Pointer to the spi_device structure +- * @enable: Select (1) or deselect (0) the chip select line ++ * @is_high: Select(0) or deselect (1) the chip select line + */ +-static void cdns_spi_chipselect(struct spi_device *spi, bool enable) ++static void cdns_spi_chipselect(struct spi_device *spi, bool is_high) + { + struct cdns_spi *xspi = spi_master_get_devdata(spi->master); + u32 ctrl_reg; + + ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR); + +- if (!enable) { ++ if (is_high) { + /* Deselect the slave */ + ctrl_reg |= CDNS_SPI_CR_SSCTRL; + } else { +diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c +index 9a49e073e8b7..45972056ed8c 100644 +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -129,10 +129,11 @@ void dw_spi_set_cs(struct spi_device *spi, bool enable) + struct dw_spi *dws = spi_controller_get_devdata(spi->controller); + struct chip_data *chip = spi_get_ctldata(spi); + ++ /* Chip select logic is inverted from spi_set_cs() */ + if (chip && chip->cs_control) +- chip->cs_control(enable); ++ chip->cs_control(!enable); + +- if (enable) ++ if (!enable) + dw_writel(dws, DW_SPI_SER, BIT(spi->chip_select)); + else if (dws->cs_override) + dw_writel(dws, DW_SPI_SER, 0); +@@ -308,7 +309,8 @@ static int dw_spi_transfer_one(struct spi_controller *master, + cr0 = (transfer->bits_per_word - 1) + | (chip->type << SPI_FRF_OFFSET) + | ((((spi->mode & SPI_CPOL) ? 1 : 0) << SPI_SCOL_OFFSET) | +- (((spi->mode & SPI_CPHA) ? 1 : 0) << SPI_SCPH_OFFSET)) ++ (((spi->mode & SPI_CPHA) ? 1 : 0) << SPI_SCPH_OFFSET) | ++ (((spi->mode & SPI_LOOP) ? 1 : 0) << SPI_SRL_OFFSET)) + | (chip->tmode << SPI_TMOD_OFFSET); + + /* +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index 4b80ace1d137..2d563874b4ac 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -736,9 +736,9 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) + if (ret) + goto err; + +- irq = irq_of_parse_and_map(np, 0); +- if (!irq) { +- ret = -EINVAL; ++ irq = platform_get_irq(ofdev, 0); ++ if (irq < 0) { ++ ret = irq; + goto err; + } + +@@ -751,7 +751,6 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) + return 0; + + err: +- irq_dispose_mapping(irq); + return ret; + } + +diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c +index 1d3e23ec20a6..f9c5bbb74714 100644 +--- a/drivers/spi/spi-gpio.c ++++ b/drivers/spi/spi-gpio.c +@@ -371,8 +371,10 @@ static int spi_gpio_probe(struct platform_device *pdev) + return -ENOMEM; + + status = devm_add_action_or_reset(&pdev->dev, spi_gpio_put, master); +- if (status) ++ if (status) { ++ spi_master_put(master); + return status; ++ } + + if (of_id) + status = spi_gpio_probe_dt(pdev, master); +diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c +index 439b01e4a2c8..f4a8f470aecc 100644 +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -673,6 +673,8 @@ static int img_spfi_probe(struct platform_device *pdev) + dma_release_channel(spfi->tx_ch); + if (spfi->rx_ch) + dma_release_channel(spfi->rx_ch); ++ spfi->tx_ch = NULL; ++ spfi->rx_ch = NULL; + dev_warn(spfi->dev, "Failed to get DMA channels, falling back to PIO mode\n"); + } else { + master->dma_tx = spfi->tx_ch; +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index bb6a14d1ab0f..2e73d75a6ac5 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1565,7 +1565,13 @@ pxa2xx_spi_init_pdata(struct platform_device *pdev) + #endif + + ssp->clk = devm_clk_get(&pdev->dev, NULL); ++ if (IS_ERR(ssp->clk)) ++ return NULL; ++ + ssp->irq = platform_get_irq(pdev, 0); ++ if (ssp->irq < 0) ++ return NULL; ++ + ssp->type = type; + ssp->pdev = pdev; + ssp->port_id = pxa2xx_spi_get_port_id(adev); +diff --git a/drivers/spi/spi-sifive.c b/drivers/spi/spi-sifive.c +index 35254bdc42c4..f7c1e20432e0 100644 +--- a/drivers/spi/spi-sifive.c ++++ b/drivers/spi/spi-sifive.c +@@ -357,14 +357,14 @@ static int sifive_spi_probe(struct platform_device *pdev) + if (!cs_bits) { + dev_err(&pdev->dev, "Could not auto probe CS lines\n"); + ret = -EINVAL; +- goto put_master; ++ goto disable_clk; + } + + num_cs = ilog2(cs_bits) + 1; + if (num_cs > SIFIVE_SPI_MAX_CS) { + dev_err(&pdev->dev, "Invalid number of spi slaves\n"); + ret = -EINVAL; +- goto put_master; ++ goto disable_clk; + } + + /* Define our master */ +@@ -393,7 +393,7 @@ static int sifive_spi_probe(struct platform_device *pdev) + dev_name(&pdev->dev), spi); + if (ret) { + dev_err(&pdev->dev, "Unable to bind to interrupt\n"); +- goto put_master; ++ goto disable_clk; + } + + dev_info(&pdev->dev, "mapped; irq=%d, cs=%d\n", +@@ -402,11 +402,13 @@ static int sifive_spi_probe(struct platform_device *pdev) + ret = devm_spi_register_master(&pdev->dev, master); + if (ret < 0) { + dev_err(&pdev->dev, "spi_register_master failed\n"); +- goto put_master; ++ goto disable_clk; + } + + return 0; + ++disable_clk: ++ clk_disable_unprepare(spi->clk); + put_master: + spi_master_put(master); + +@@ -420,6 +422,7 @@ static int sifive_spi_remove(struct platform_device *pdev) + + /* Disable all the interrupts just in case */ + sifive_spi_write(spi, SIFIVE_SPI_REG_IE, 0); ++ clk_disable_unprepare(spi->clk); + + return 0; + } +diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c +index 9a051286f120..9613cfe3c0a2 100644 +--- a/drivers/spi/spi-sprd-adi.c ++++ b/drivers/spi/spi-sprd-adi.c +@@ -393,6 +393,9 @@ static int sprd_adi_restart_handler(struct notifier_block *this, + val |= BIT_WDG_RUN | BIT_WDG_RST; + sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_CTRL, val); + ++ /* Lock the watchdog */ ++ sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOCK, ~WDG_UNLOCK_KEY); ++ + mdelay(1000); + + dev_emerg(sadi->dev, "Unable to restart system\n"); +diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c +index 0c24c494f386..77d26d64541a 100644 +--- a/drivers/spi/spi-st-ssc4.c ++++ b/drivers/spi/spi-st-ssc4.c +@@ -381,6 +381,7 @@ static int spi_st_probe(struct platform_device *pdev) + return 0; + + clk_disable: ++ pm_runtime_disable(&pdev->dev); + clk_disable_unprepare(spi_st->clk); + put_master: + spi_master_put(master); +@@ -392,6 +393,8 @@ static int spi_st_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct spi_st *spi_st = spi_master_get_devdata(master); + ++ pm_runtime_disable(&pdev->dev); ++ + clk_disable_unprepare(spi_st->clk); + + pinctrl_pm_select_sleep_state(&pdev->dev); +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 111fffc91435..374a2a32edcd 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1073,7 +1073,7 @@ static int tegra_slink_probe(struct platform_device *pdev) + ret = clk_enable(tspi->clk); + if (ret < 0) { + dev_err(&pdev->dev, "Clock enable failed %d\n", ret); +- goto exit_free_master; ++ goto exit_clk_unprepare; + } + + spi_irq = platform_get_irq(pdev, 0); +@@ -1146,6 +1146,8 @@ exit_free_irq: + free_irq(spi_irq, tspi); + exit_clk_disable: + clk_disable(tspi->clk); ++exit_clk_unprepare: ++ clk_unprepare(tspi->clk); + exit_free_master: + spi_master_put(master); + return ret; +@@ -1159,6 +1161,7 @@ static int tegra_slink_remove(struct platform_device *pdev) + free_irq(tspi->irq, tspi); + + clk_disable(tspi->clk); ++ clk_unprepare(tspi->clk); + + if (tspi->tx_dma_chan) + tegra_slink_deinit_dma_param(tspi, false); +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 255786f2e844..3ea9d8a3e6e8 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -627,6 +627,9 @@ static int spidev_release(struct inode *inode, struct file *filp) + if (dofree) + kfree(spidev); + } ++#ifdef CONFIG_SPI_SLAVE ++ spi_slave_abort(spidev->spi); ++#endif + mutex_unlock(&device_list_lock); + + return 0; +diff --git a/drivers/staging/comedi/drivers/gsc_hpdi.c b/drivers/staging/comedi/drivers/gsc_hpdi.c +index 4bdf44d82879..dc62db1ee1dd 100644 +--- a/drivers/staging/comedi/drivers/gsc_hpdi.c ++++ b/drivers/staging/comedi/drivers/gsc_hpdi.c +@@ -623,6 +623,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, + dma_alloc_coherent(&pcidev->dev, DMA_BUFFER_SIZE, + &devpriv->dio_buffer_phys_addr[i], + GFP_KERNEL); ++ if (!devpriv->dio_buffer[i]) { ++ dev_warn(dev->class_dev, ++ "failed to allocate DMA buffer\n"); ++ return -ENOMEM; ++ } + } + /* allocate dma descriptors */ + devpriv->dma_desc = dma_alloc_coherent(&pcidev->dev, +@@ -630,6 +635,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, + NUM_DMA_DESCRIPTORS, + &devpriv->dma_desc_phys_addr, + GFP_KERNEL); ++ if (!devpriv->dma_desc) { ++ dev_warn(dev->class_dev, ++ "failed to allocate DMA descriptors\n"); ++ return -ENOMEM; ++ } + if (devpriv->dma_desc_phys_addr & 0xf) { + dev_warn(dev->class_dev, + " dma descriptors not quad-word aligned (bug)\n"); +diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c +index a0a67aa517f0..61f0286fb157 100644 +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -666,7 +666,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, + fbdefio->deferred_io = fbtft_deferred_io; + fb_deferred_io_init(info); + +- strncpy(info->fix.id, dev->driver->name, 16); ++ snprintf(info->fix.id, sizeof(info->fix.id), "%s", dev->driver->name); + info->fix.type = FB_TYPE_PACKED_PIXELS; + info->fix.visual = FB_VISUAL_TRUECOLOR; + info->fix.xpanstep = 0; +diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c +index 038d6732c3fd..23026978a5a5 100644 +--- a/drivers/staging/iio/frequency/ad9834.c ++++ b/drivers/staging/iio/frequency/ad9834.c +@@ -417,6 +417,10 @@ static int ad9834_probe(struct spi_device *spi) + st = iio_priv(indio_dev); + mutex_init(&st->lock); + st->mclk = devm_clk_get(&spi->dev, NULL); ++ if (IS_ERR(st->mclk)) { ++ ret = PTR_ERR(st->mclk); ++ goto error_disable_reg; ++ } + + ret = clk_prepare_enable(st->mclk); + if (ret) { +diff --git a/drivers/staging/mt7621-pci/Kconfig b/drivers/staging/mt7621-pci/Kconfig +index af928b75a940..ce58042f2f21 100644 +--- a/drivers/staging/mt7621-pci/Kconfig ++++ b/drivers/staging/mt7621-pci/Kconfig +@@ -2,7 +2,6 @@ + config PCI_MT7621 + tristate "MediaTek MT7621 PCI Controller" + depends on RALINK +- depends on PCI + select PCI_DRIVERS_GENERIC + help + This selects a driver for the MediaTek MT7621 PCI Controller. +diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c +index 952f2ab51347..c37591657bac 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c ++++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c +@@ -776,7 +776,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN); + memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || + check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { +@@ -784,7 +784,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN); + memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else { + RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv))); +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index 2821411878ce..511136dce3a4 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -1422,7 +1422,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + (struct tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN); + struct usb_device *udev = priv->udev; + int pend; +- int status; ++ int status, rt = -1; + struct urb *tx_urb = NULL, *tx_urb_zero = NULL; + unsigned int idx_pipe; + +@@ -1566,8 +1566,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + } + if (bSend0Byte) { + tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC); +- if (!tx_urb_zero) +- return -ENOMEM; ++ if (!tx_urb_zero) { ++ rt = -ENOMEM; ++ goto error; ++ } + usb_fill_bulk_urb(tx_urb_zero, udev, + usb_sndbulkpipe(udev, idx_pipe), + &zero, 0, tx_zero_isr, dev); +@@ -1577,7 +1579,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + "Error TX URB for zero byte %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ goto error; + } + } + netif_trans_update(dev); +@@ -1588,7 +1590,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + RT_TRACE(COMP_ERR, "Error TX URB %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ ++error: ++ dev_kfree_skb_any(skb); ++ usb_free_urb(tx_urb); ++ usb_free_urb(tx_urb_zero); ++ return rt; + } + + static short rtl8192_usb_initendpoints(struct net_device *dev) +diff --git a/drivers/staging/wilc1000/wilc_hif.c b/drivers/staging/wilc1000/wilc_hif.c +index d3d9ea284816..77d0732f451b 100644 +--- a/drivers/staging/wilc1000/wilc_hif.c ++++ b/drivers/staging/wilc1000/wilc_hif.c +@@ -473,6 +473,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, + rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len); + if (rates_ie) { + rates_len = rates_ie[1]; ++ if (rates_len > WILC_MAX_RATES_SUPPORTED) ++ rates_len = WILC_MAX_RATES_SUPPORTED; + param->supp_rates[0] = rates_len; + memcpy(¶m->supp_rates[1], rates_ie + 2, rates_len); + } +diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c +index 22f21831649b..c3cd6f389a98 100644 +--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c ++++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c +@@ -1419,8 +1419,10 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev, + if (vif->iftype == WILC_AP_MODE || vif->iftype == WILC_GO_MODE) + wilc_wfi_deinit_mon_interface(wl, true); + vif->iftype = WILC_STATION_MODE; +- wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), +- WILC_STATION_MODE, vif->idx); ++ ++ if (wl->initialized) ++ wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), ++ WILC_STATION_MODE, vif->idx); + + memset(priv->assoc_stainfo.sta_associated_bss, 0, + WILC_MAX_NUM_STA * ETH_ALEN); +@@ -1432,8 +1434,10 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev, + priv->wdev.iftype = type; + vif->monitor_flag = 0; + vif->iftype = WILC_CLIENT_MODE; +- wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), +- WILC_STATION_MODE, vif->idx); ++ ++ if (wl->initialized) ++ wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), ++ WILC_STATION_MODE, vif->idx); + break; + + case NL80211_IFTYPE_AP: +@@ -1450,8 +1454,10 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev, + dev->ieee80211_ptr->iftype = type; + priv->wdev.iftype = type; + vif->iftype = WILC_GO_MODE; +- wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), +- WILC_AP_MODE, vif->idx); ++ ++ if (wl->initialized) ++ wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), ++ WILC_AP_MODE, vif->idx); + break; + + default: +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index a8dc8af83f39..1ba9bc667e13 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -2270,27 +2270,6 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + mode |= ATMEL_US_USMODE_NORMAL; + } + +- /* set the mode, clock divisor, parity, stop bits and data size */ +- atmel_uart_writel(port, ATMEL_US_MR, mode); +- +- /* +- * when switching the mode, set the RTS line state according to the +- * new mode, otherwise keep the former state +- */ +- if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) { +- unsigned int rts_state; +- +- if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) { +- /* let the hardware control the RTS line */ +- rts_state = ATMEL_US_RTSDIS; +- } else { +- /* force RTS line to low level */ +- rts_state = ATMEL_US_RTSEN; +- } +- +- atmel_uart_writel(port, ATMEL_US_CR, rts_state); +- } +- + /* + * Set the baud rate: + * Fractional baudrate allows to setup output frequency more +@@ -2317,6 +2296,28 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + + if (!(port->iso7816.flags & SER_ISO7816_ENABLED)) + atmel_uart_writel(port, ATMEL_US_BRGR, quot); ++ ++ /* set the mode, clock divisor, parity, stop bits and data size */ ++ atmel_uart_writel(port, ATMEL_US_MR, mode); ++ ++ /* ++ * when switching the mode, set the RTS line state according to the ++ * new mode, otherwise keep the former state ++ */ ++ if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) { ++ unsigned int rts_state; ++ ++ if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) { ++ /* let the hardware control the RTS line */ ++ rts_state = ATMEL_US_RTSDIS; ++ } else { ++ /* force RTS line to low level */ ++ rts_state = ATMEL_US_RTSEN; ++ } ++ ++ atmel_uart_writel(port, ATMEL_US_CR, rts_state); ++ } ++ + atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA | ATMEL_US_RSTRX); + atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN | ATMEL_US_RXEN); + atmel_port->tx_stopped = false; +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 771d11196523..494e2672ebd7 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -679,6 +679,9 @@ static irqreturn_t sprd_handle_irq(int irq, void *dev_id) + if (ims & SPRD_IMSR_TIMEOUT) + serial_out(port, SPRD_ICLR, SPRD_ICLR_TIMEOUT); + ++ if (ims & SPRD_IMSR_BREAK_DETECT) ++ serial_out(port, SPRD_ICLR, SPRD_IMSR_BREAK_DETECT); ++ + if (ims & (SPRD_IMSR_RX_FIFO_FULL | SPRD_IMSR_BREAK_DETECT | + SPRD_IMSR_TIMEOUT)) + sprd_rx(port); +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 3f899552f6e3..6ca40d135430 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -764,8 +764,15 @@ static int claimintf(struct usb_dev_state *ps, unsigned int ifnum) + intf = usb_ifnum_to_if(dev, ifnum); + if (!intf) + err = -ENOENT; +- else ++ else { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while claiming interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + err = usb_driver_claim_interface(&usbfs_driver, intf, ps); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); ++ } + if (err == 0) + set_bit(ifnum, &ps->ifclaimed); + return err; +@@ -785,7 +792,13 @@ static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum) + if (!intf) + err = -ENOENT; + else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while releasing interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + usb_driver_release_interface(&usbfs_driver, intf); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); + err = 0; + } + return err; +diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c +index aa2f77f1506d..8a5c9b3ebe1e 100644 +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -27,6 +27,10 @@ + + /*-------------------------------------------------------------------------*/ + ++/* PID Codes that are used here, from EHCI specification, Table 3-16. */ ++#define PID_CODE_IN 1 ++#define PID_CODE_SETUP 2 ++ + /* fill a qtd, returning how much of the buffer we were able to queue up */ + + static int +@@ -190,7 +194,7 @@ static int qtd_copy_status ( + int status = -EINPROGRESS; + + /* count IN/OUT bytes, not SETUP (even short packets) */ +- if (likely (QTD_PID (token) != 2)) ++ if (likely(QTD_PID(token) != PID_CODE_SETUP)) + urb->actual_length += length - QTD_LENGTH (token); + + /* don't modify error codes */ +@@ -206,6 +210,13 @@ static int qtd_copy_status ( + if (token & QTD_STS_BABBLE) { + /* FIXME "must" disable babbling device's port too */ + status = -EOVERFLOW; ++ /* ++ * When MMF is active and PID Code is IN, queue is halted. ++ * EHCI Specification, Table 4-13. ++ */ ++ } else if ((token & QTD_STS_MMF) && ++ (QTD_PID(token) == PID_CODE_IN)) { ++ status = -EPROTO; + /* CERR nonzero + halt --> stall */ + } else if (QTD_CERR(token)) { + status = -EPIPE; +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 1904ef56f61c..4917c5b033fa 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -48,6 +48,7 @@ + #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_2C_XHCI 0x15e9 + #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_4C_XHCI 0x15ec + #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI 0x15f0 ++#define PCI_DEVICE_ID_INTEL_ICE_LAKE_XHCI 0x8a13 + + #define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 + #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba +@@ -212,7 +213,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + pdev->device == PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_4C_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_2C_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_4C_XHCI || +- pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI)) ++ pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_ICE_LAKE_XHCI)) + xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; + + if (pdev->vendor == PCI_VENDOR_ID_ETRON && +@@ -517,7 +519,6 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + retval = xhci_resume(xhci, hibernated); + return retval; + } +-#endif /* CONFIG_PM */ + + static void xhci_pci_shutdown(struct usb_hcd *hcd) + { +@@ -530,6 +531,7 @@ static void xhci_pci_shutdown(struct usb_hcd *hcd) + if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) + pci_set_power_state(pdev, PCI_D3hot); + } ++#endif /* CONFIG_PM */ + + /*-------------------------------------------------------------------------*/ + +diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h +index 0824099b905e..ef1735d014da 100644 +--- a/drivers/usb/renesas_usbhs/common.h ++++ b/drivers/usb/renesas_usbhs/common.h +@@ -161,11 +161,12 @@ struct usbhs_priv; + #define VBSTS (1 << 7) /* VBUS_0 and VBUSIN_0 Input Status */ + #define VALID (1 << 3) /* USB Request Receive */ + +-#define DVSQ_MASK (0x3 << 4) /* Device State */ ++#define DVSQ_MASK (0x7 << 4) /* Device State */ + #define POWER_STATE (0 << 4) + #define DEFAULT_STATE (1 << 4) + #define ADDRESS_STATE (2 << 4) + #define CONFIGURATION_STATE (3 << 4) ++#define SUSPENDED_STATE (4 << 4) + + #define CTSQ_MASK (0x7) /* Control Transfer Stage */ + #define IDLE_SETUP_STAGE 0 /* Idle stage or setup stage */ +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index cd38d74b3223..53489cafecc1 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -457,12 +457,18 @@ static int usbhsg_irq_dev_state(struct usbhs_priv *priv, + { + struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv); + struct device *dev = usbhsg_gpriv_to_dev(gpriv); ++ int state = usbhs_status_get_device_state(irq_state); + + gpriv->gadget.speed = usbhs_bus_get_speed(priv); + +- dev_dbg(dev, "state = %x : speed : %d\n", +- usbhs_status_get_device_state(irq_state), +- gpriv->gadget.speed); ++ dev_dbg(dev, "state = %x : speed : %d\n", state, gpriv->gadget.speed); ++ ++ if (gpriv->gadget.speed != USB_SPEED_UNKNOWN && ++ (state & SUSPENDED_STATE)) { ++ if (gpriv->driver && gpriv->driver->suspend) ++ gpriv->driver->suspend(&gpriv->gadget); ++ usb_gadget_set_state(&gpriv->gadget, USB_STATE_SUSPENDED); ++ } + + return 0; + } +diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c +index 6532d68e8808..e4b96674c405 100644 +--- a/drivers/usb/usbip/usbip_common.c ++++ b/drivers/usb/usbip/usbip_common.c +@@ -727,6 +727,9 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) + + copy -= recv; + ret += recv; ++ ++ if (!copy) ++ break; + } + + if (ret != size) +diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c +index 33f8972ba842..00fc98741c5d 100644 +--- a/drivers/usb/usbip/vhci_rx.c ++++ b/drivers/usb/usbip/vhci_rx.c +@@ -77,16 +77,21 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, + usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0); + + /* recv transfer buffer */ +- if (usbip_recv_xbuff(ud, urb) < 0) +- return; ++ if (usbip_recv_xbuff(ud, urb) < 0) { ++ urb->status = -EPROTO; ++ goto error; ++ } + + /* recv iso_packet_descriptor */ +- if (usbip_recv_iso(ud, urb) < 0) +- return; ++ if (usbip_recv_iso(ud, urb) < 0) { ++ urb->status = -EPROTO; ++ goto error; ++ } + + /* restore the padding in iso packets */ + usbip_pad_iso(ud, urb); + ++error: + if (usbip_dbg_flag_vhci_rx) + usbip_dump_urb(urb); + +diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig +index 79cc75096f42..a50dadd01093 100644 +--- a/drivers/xen/Kconfig ++++ b/drivers/xen/Kconfig +@@ -141,7 +141,8 @@ config XEN_GNTDEV + + config XEN_GNTDEV_DMABUF + bool "Add support for dma-buf grant access device driver extension" +- depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC && DMA_SHARED_BUFFER ++ depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC ++ select DMA_SHARED_BUFFER + help + Allows userspace processes and kernel modules to use Xen backed + dma-buf implementation. With this extension grant references to +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index 2e9e13ffbd08..10a04b99798a 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -252,16 +252,17 @@ out: + } + } + +-static void run_ordered_work(struct __btrfs_workqueue *wq) ++static void run_ordered_work(struct __btrfs_workqueue *wq, ++ struct btrfs_work *self) + { + struct list_head *list = &wq->ordered_list; + struct btrfs_work *work; + spinlock_t *lock = &wq->list_lock; + unsigned long flags; ++ void *wtag; ++ bool free_self = false; + + while (1) { +- void *wtag; +- + spin_lock_irqsave(lock, flags); + if (list_empty(list)) + break; +@@ -287,16 +288,47 @@ static void run_ordered_work(struct __btrfs_workqueue *wq) + list_del(&work->ordered_list); + spin_unlock_irqrestore(lock, flags); + +- /* +- * We don't want to call the ordered free functions with the +- * lock held though. Save the work as tag for the trace event, +- * because the callback could free the structure. +- */ +- wtag = work; +- work->ordered_free(work); +- trace_btrfs_all_work_done(wq->fs_info, wtag); ++ if (work == self) { ++ /* ++ * This is the work item that the worker is currently ++ * executing. ++ * ++ * The kernel workqueue code guarantees non-reentrancy ++ * of work items. I.e., if a work item with the same ++ * address and work function is queued twice, the second ++ * execution is blocked until the first one finishes. A ++ * work item may be freed and recycled with the same ++ * work function; the workqueue code assumes that the ++ * original work item cannot depend on the recycled work ++ * item in that case (see find_worker_executing_work()). ++ * ++ * Note that the work of one Btrfs filesystem may depend ++ * on the work of another Btrfs filesystem via, e.g., a ++ * loop device. Therefore, we must not allow the current ++ * work item to be recycled until we are really done, ++ * otherwise we break the above assumption and can ++ * deadlock. ++ */ ++ free_self = true; ++ } else { ++ /* ++ * We don't want to call the ordered free functions with ++ * the lock held though. Save the work as tag for the ++ * trace event, because the callback could free the ++ * structure. ++ */ ++ wtag = work; ++ work->ordered_free(work); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + spin_unlock_irqrestore(lock, flags); ++ ++ if (free_self) { ++ wtag = self; ++ self->ordered_free(self); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + + static void normal_work_helper(struct btrfs_work *work) +@@ -324,7 +356,7 @@ static void normal_work_helper(struct btrfs_work *work) + work->func(work); + if (need_order) { + set_bit(WORK_DONE_BIT, &work->flags); +- run_ordered_work(wq); ++ run_ordered_work(wq, work); + } + if (!need_order) + trace_btrfs_all_work_done(wq->fs_info, wtag); +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index e59cde204b2f..da9b0f060a9d 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -383,7 +383,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info, + for (node = rb_first(tm_root); node; node = next) { + next = rb_next(node); + tm = rb_entry(node, struct tree_mod_elem, node); +- if (tm->seq > min_seq) ++ if (tm->seq >= min_seq) + continue; + rb_erase(node, tm_root); + kfree(tm); +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index fe2b8765d9e6..5e9f80b28fcf 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -2785,7 +2785,7 @@ struct btrfs_inode_extref *btrfs_find_name_in_ext_backref( + /* file-item.c */ + struct btrfs_dio_private; + int btrfs_del_csums(struct btrfs_trans_handle *trans, +- struct btrfs_fs_info *fs_info, u64 bytenr, u64 len); ++ struct btrfs_root *root, u64 bytenr, u64 len); + blk_status_t btrfs_lookup_bio_sums(struct inode *inode, struct bio *bio, + u8 *dst); + blk_status_t btrfs_lookup_bio_sums_dio(struct inode *inode, struct bio *bio, +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 402b61bf345c..3895c21853cc 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1657,8 +1657,8 @@ static void end_workqueue_fn(struct btrfs_work *work) + bio->bi_status = end_io_wq->status; + bio->bi_private = end_io_wq->private; + bio->bi_end_io = end_io_wq->end_io; +- kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + bio_endio(bio); ++ kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + } + + static int cleaner_kthread(void *arg) +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 49cb26fa7c63..eb95ed78a18e 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -1848,8 +1848,8 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans, + btrfs_pin_extent(fs_info, head->bytenr, + head->num_bytes, 1); + if (head->is_data) { +- ret = btrfs_del_csums(trans, fs_info, head->bytenr, +- head->num_bytes); ++ ret = btrfs_del_csums(trans, fs_info->csum_root, ++ head->bytenr, head->num_bytes); + } + } + +@@ -3155,7 +3155,8 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans, + btrfs_release_path(path); + + if (is_data) { +- ret = btrfs_del_csums(trans, info, bytenr, num_bytes); ++ ret = btrfs_del_csums(trans, info->csum_root, bytenr, ++ num_bytes); + if (ret) { + btrfs_abort_transaction(trans, ret); + goto out; +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 4905f48587df..be9dc78aa727 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -5066,12 +5066,14 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, + return eb; + eb = alloc_dummy_extent_buffer(fs_info, start); + if (!eb) +- return NULL; ++ return ERR_PTR(-ENOMEM); + eb->fs_info = fs_info; + again: + ret = radix_tree_preload(GFP_NOFS); +- if (ret) ++ if (ret) { ++ exists = ERR_PTR(ret); + goto free_eb; ++ } + spin_lock(&fs_info->buffer_lock); + ret = radix_tree_insert(&fs_info->buffer_radix, + start >> PAGE_SHIFT, eb); +diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c +index 1a599f50837b..c878bc25d046 100644 +--- a/fs/btrfs/file-item.c ++++ b/fs/btrfs/file-item.c +@@ -590,9 +590,9 @@ static noinline void truncate_one_csum(struct btrfs_fs_info *fs_info, + * range of bytes. + */ + int btrfs_del_csums(struct btrfs_trans_handle *trans, +- struct btrfs_fs_info *fs_info, u64 bytenr, u64 len) ++ struct btrfs_root *root, u64 bytenr, u64 len) + { +- struct btrfs_root *root = fs_info->csum_root; ++ struct btrfs_fs_info *fs_info = trans->fs_info; + struct btrfs_path *path; + struct btrfs_key key; + u64 end_byte = bytenr + len; +@@ -602,6 +602,9 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans, + u16 csum_size = btrfs_super_csum_size(fs_info->super_copy); + int blocksize_bits = fs_info->sb->s_blocksize_bits; + ++ ASSERT(root == fs_info->csum_root || ++ root->root_key.objectid == BTRFS_TREE_LOG_OBJECTID); ++ + path = btrfs_alloc_path(); + if (!path) + return -ENOMEM; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 10a01dd0c4e6..e5758f62e8d8 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5697,7 +5697,6 @@ static void inode_tree_add(struct inode *inode) + + static void inode_tree_del(struct inode *inode) + { +- struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_root *root = BTRFS_I(inode)->root; + int empty = 0; + +@@ -5710,7 +5709,6 @@ static void inode_tree_del(struct inode *inode) + spin_unlock(&root->inode_lock); + + if (empty && btrfs_root_refs(&root->root_item) == 0) { +- synchronize_srcu(&fs_info->subvol_srcu); + spin_lock(&root->inode_lock); + empty = RB_EMPTY_ROOT(&root->inode_tree); + spin_unlock(&root->inode_lock); +@@ -9535,9 +9533,8 @@ static int btrfs_rename_exchange(struct inode *old_dir, + btrfs_init_log_ctx(&ctx_dest, new_inode); + + /* close the race window with snapshot create/destroy ioctl */ +- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) +- down_read(&fs_info->subvol_sem); +- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) ++ if (old_ino == BTRFS_FIRST_FREE_OBJECTID || ++ new_ino == BTRFS_FIRST_FREE_OBJECTID) + down_read(&fs_info->subvol_sem); + + /* +@@ -9771,9 +9768,8 @@ out_fail: + ret = ret ? ret : ret2; + } + out_notrans: +- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) +- up_read(&fs_info->subvol_sem); +- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) ++ if (new_ino == BTRFS_FIRST_FREE_OBJECTID || ++ old_ino == BTRFS_FIRST_FREE_OBJECTID) + up_read(&fs_info->subvol_sem); + + ASSERT(list_empty(&ctx_root.list)); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 23272d9154f3..a56dcc0c9c2a 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -705,11 +705,17 @@ static noinline int create_subvol(struct inode *dir, + + btrfs_i_size_write(BTRFS_I(dir), dir->i_size + namelen * 2); + ret = btrfs_update_inode(trans, root, dir); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + + ret = btrfs_add_root_ref(trans, objectid, root->root_key.objectid, + btrfs_ino(BTRFS_I(dir)), index, name, namelen); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + + ret = btrfs_uuid_tree_add(trans, root_item->uuid, + BTRFS_UUID_KEY_SUBVOL, objectid); +diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c +index ee6f60547a8d..dd4f9c2b7107 100644 +--- a/fs/btrfs/reada.c ++++ b/fs/btrfs/reada.c +@@ -752,21 +752,19 @@ static int reada_start_machine_dev(struct btrfs_device *dev) + static void reada_start_machine_worker(struct btrfs_work *work) + { + struct reada_machine_work *rmw; +- struct btrfs_fs_info *fs_info; + int old_ioprio; + + rmw = container_of(work, struct reada_machine_work, work); +- fs_info = rmw->fs_info; +- +- kfree(rmw); + + old_ioprio = IOPRIO_PRIO_VALUE(task_nice_ioclass(current), + task_nice_ioprio(current)); + set_task_ioprio(current, BTRFS_IOPRIO_READA); +- __reada_start_machine(fs_info); ++ __reada_start_machine(rmw->fs_info); + set_task_ioprio(current, old_ioprio); + +- atomic_dec(&fs_info->reada_works_cnt); ++ atomic_dec(&rmw->fs_info->reada_works_cnt); ++ ++ kfree(rmw); + } + + static void __reada_start_machine(struct btrfs_fs_info *fs_info) +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 5cd42b66818c..fd0f4c1696c8 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4555,6 +4555,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) + fs_root = read_fs_root(fs_info, reloc_root->root_key.offset); + if (IS_ERR(fs_root)) { + err = PTR_ERR(fs_root); ++ list_add_tail(&reloc_root->root_list, &reloc_roots); + goto out_free; + } + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index f7d4e03f4c5d..a0770a6aee00 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -2149,14 +2149,13 @@ static void scrub_missing_raid56_worker(struct btrfs_work *work) + scrub_write_block_to_dev_replace(sblock); + } + +- scrub_block_put(sblock); +- + if (sctx->is_dev_replace && sctx->flush_all_writes) { + mutex_lock(&sctx->wr_lock); + scrub_wr_submit(sctx); + mutex_unlock(&sctx->wr_lock); + } + ++ scrub_block_put(sblock); + scrub_pending_bio_dec(sctx); + } + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 518ec1265a0c..3eb0fec2488a 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -7075,12 +7075,6 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg) + send_root->send_in_progress++; + spin_unlock(&send_root->root_item_lock); + +- /* +- * This is done when we lookup the root, it should already be complete +- * by the time we get here. +- */ +- WARN_ON(send_root->orphan_cleanup_state != ORPHAN_CLEANUP_DONE); +- + /* + * Userspace tools do the checks and warn the user if it's + * not RO. +diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c +index bc92df977630..6e774d055402 100644 +--- a/fs/btrfs/tests/free-space-tree-tests.c ++++ b/fs/btrfs/tests/free-space-tree-tests.c +@@ -463,9 +463,9 @@ static int run_test(test_func_t test_func, int bitmaps, u32 sectorsize, + root->fs_info->tree_root = root; + + root->node = alloc_test_extent_buffer(root->fs_info, nodesize); +- if (!root->node) { ++ if (IS_ERR(root->node)) { + test_std_err(TEST_ALLOC_EXTENT_BUFFER); +- ret = -ENOMEM; ++ ret = PTR_ERR(root->node); + goto out; + } + btrfs_set_header_level(root->node, 0); +diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c +index 09aaca1efd62..ac035a6fa003 100644 +--- a/fs/btrfs/tests/qgroup-tests.c ++++ b/fs/btrfs/tests/qgroup-tests.c +@@ -484,9 +484,9 @@ int btrfs_test_qgroups(u32 sectorsize, u32 nodesize) + * *cough*backref walking code*cough* + */ + root->node = alloc_test_extent_buffer(root->fs_info, nodesize); +- if (!root->node) { ++ if (IS_ERR(root->node)) { + test_err("couldn't allocate dummy buffer"); +- ret = -ENOMEM; ++ ret = PTR_ERR(root->node); + goto out; + } + btrfs_set_header_level(root->node, 0); +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index 076d5b8014fb..0e44db066641 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -243,7 +243,7 @@ static int check_extent_data_item(struct extent_buffer *leaf, + } + + static int check_csum_item(struct extent_buffer *leaf, struct btrfs_key *key, +- int slot) ++ int slot, struct btrfs_key *prev_key) + { + struct btrfs_fs_info *fs_info = leaf->fs_info; + u32 sectorsize = fs_info->sectorsize; +@@ -267,6 +267,20 @@ static int check_csum_item(struct extent_buffer *leaf, struct btrfs_key *key, + btrfs_item_size_nr(leaf, slot), csumsize); + return -EUCLEAN; + } ++ if (slot > 0 && prev_key->type == BTRFS_EXTENT_CSUM_KEY) { ++ u64 prev_csum_end; ++ u32 prev_item_size; ++ ++ prev_item_size = btrfs_item_size_nr(leaf, slot - 1); ++ prev_csum_end = (prev_item_size / csumsize) * sectorsize; ++ prev_csum_end += prev_key->offset; ++ if (prev_csum_end > key->offset) { ++ generic_err(leaf, slot - 1, ++"csum end range (%llu) goes beyond the start range (%llu) of the next csum item", ++ prev_csum_end, key->offset); ++ return -EUCLEAN; ++ } ++ } + return 0; + } + +@@ -1239,7 +1253,7 @@ static int check_leaf_item(struct extent_buffer *leaf, + ret = check_extent_data_item(leaf, key, slot, prev_key); + break; + case BTRFS_EXTENT_CSUM_KEY: +- ret = check_csum_item(leaf, key, slot); ++ ret = check_csum_item(leaf, key, slot, prev_key); + break; + case BTRFS_DIR_ITEM_KEY: + case BTRFS_DIR_INDEX_KEY: +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 8a6cc600bf18..ab27e6cd9b3e 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -808,7 +808,8 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans, + struct btrfs_ordered_sum, + list); + if (!ret) +- ret = btrfs_del_csums(trans, fs_info, ++ ret = btrfs_del_csums(trans, ++ fs_info->csum_root, + sums->bytenr, + sums->len); + if (!ret) +@@ -3927,6 +3928,28 @@ static int log_inode_item(struct btrfs_trans_handle *trans, + return 0; + } + ++static int log_csums(struct btrfs_trans_handle *trans, ++ struct btrfs_root *log_root, ++ struct btrfs_ordered_sum *sums) ++{ ++ int ret; ++ ++ /* ++ * Due to extent cloning, we might have logged a csum item that covers a ++ * subrange of a cloned extent, and later we can end up logging a csum ++ * item for a larger subrange of the same extent or the entire range. ++ * This would leave csum items in the log tree that cover the same range ++ * and break the searches for checksums in the log tree, resulting in ++ * some checksums missing in the fs/subvolume tree. So just delete (or ++ * trim and adjust) any existing csum items in the log for this range. ++ */ ++ ret = btrfs_del_csums(trans, log_root, sums->bytenr, sums->len); ++ if (ret) ++ return ret; ++ ++ return btrfs_csum_file_blocks(trans, log_root, sums); ++} ++ + static noinline int copy_items(struct btrfs_trans_handle *trans, + struct btrfs_inode *inode, + struct btrfs_path *dst_path, +@@ -4072,7 +4095,7 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, + struct btrfs_ordered_sum, + list); + if (!ret) +- ret = btrfs_csum_file_blocks(trans, log, sums); ++ ret = log_csums(trans, log, sums); + list_del(&sums->list); + kfree(sums); + } +@@ -4292,7 +4315,7 @@ static int log_extent_csums(struct btrfs_trans_handle *trans, + struct btrfs_ordered_sum, + list); + if (!ret) +- ret = btrfs_csum_file_blocks(trans, log_root, sums); ++ ret = log_csums(trans, log_root, sums); + list_del(&sums->list); + kfree(sums); + } +@@ -6314,9 +6337,28 @@ again: + wc.replay_dest = btrfs_read_fs_root_no_name(fs_info, &tmp_key); + if (IS_ERR(wc.replay_dest)) { + ret = PTR_ERR(wc.replay_dest); ++ ++ /* ++ * We didn't find the subvol, likely because it was ++ * deleted. This is ok, simply skip this log and go to ++ * the next one. ++ * ++ * We need to exclude the root because we can't have ++ * other log replays overwriting this log as we'll read ++ * it back in a few more times. This will keep our ++ * block from being modified, and we'll just bail for ++ * each subsequent pass. ++ */ ++ if (ret == -ENOENT) ++ ret = btrfs_pin_extent_for_log_replay(fs_info, ++ log->node->start, ++ log->node->len); + free_extent_buffer(log->node); + free_extent_buffer(log->commit_root); + kfree(log); ++ ++ if (!ret) ++ goto next; + btrfs_handle_fs_error(fs_info, ret, + "Couldn't read target root for tree log recovery."); + goto error; +@@ -6348,7 +6390,6 @@ again: + &root->highest_objectid); + } + +- key.offset = found_key.offset - 1; + wc.replay_dest->log_root = NULL; + free_extent_buffer(log->node); + free_extent_buffer(log->commit_root); +@@ -6356,9 +6397,10 @@ again: + + if (ret) + goto error; +- ++next: + if (found_key.offset == 0) + break; ++ key.offset = found_key.offset - 1; + } + btrfs_release_path(path); + +diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c +index 91caab63bdf5..76b84f2397b1 100644 +--- a/fs/btrfs/uuid-tree.c ++++ b/fs/btrfs/uuid-tree.c +@@ -324,6 +324,8 @@ again_search_slot: + } + if (ret < 0 && ret != -ENOENT) + goto out; ++ key.offset++; ++ goto again_search_slot; + } + item_size -= sizeof(subid_le); + offset += sizeof(subid_le); +diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c +index 9fdd2b269d61..6305d5ec25af 100644 +--- a/fs/ext4/dir.c ++++ b/fs/ext4/dir.c +@@ -81,6 +81,11 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, + error_msg = "rec_len is too small for name_len"; + else if (unlikely(((char *) de - buf) + rlen > size)) + error_msg = "directory entry overrun"; ++ else if (unlikely(((char *) de - buf) + rlen > ++ size - EXT4_DIR_REC_LEN(1) && ++ ((char *) de - buf) + rlen != size)) { ++ error_msg = "directory entry too close to block end"; ++ } + else if (unlikely(le32_to_cpu(de->inode) > + le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) + error_msg = "inode out of bounds"; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 91da21890360..53134e4509b8 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -6035,7 +6035,7 @@ int ext4_expand_extra_isize(struct inode *inode, + error = ext4_journal_get_write_access(handle, iloc->bh); + if (error) { + brelse(iloc->bh); +- goto out_stop; ++ goto out_unlock; + } + + error = __ext4_expand_extra_isize(inode, new_extra_isize, iloc, +@@ -6045,8 +6045,8 @@ int ext4_expand_extra_isize(struct inode *inode, + if (!error) + error = rc; + ++out_unlock: + ext4_write_unlock_xattr(inode, &no_expand); +-out_stop: + ext4_journal_stop(handle); + return error; + } +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 923476e3aefb..f56402e9c11c 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2808,7 +2808,7 @@ bool ext4_empty_dir(struct inode *inode) + { + unsigned int offset; + struct buffer_head *bh; +- struct ext4_dir_entry_2 *de, *de1; ++ struct ext4_dir_entry_2 *de; + struct super_block *sb; + + if (ext4_has_inline_data(inode)) { +@@ -2833,19 +2833,25 @@ bool ext4_empty_dir(struct inode *inode) + return true; + + de = (struct ext4_dir_entry_2 *) bh->b_data; +- de1 = ext4_next_entry(de, sb->s_blocksize); +- if (le32_to_cpu(de->inode) != inode->i_ino || +- le32_to_cpu(de1->inode) == 0 || +- strcmp(".", de->name) || strcmp("..", de1->name)) { +- ext4_warning_inode(inode, "directory missing '.' and/or '..'"); ++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, ++ 0) || ++ le32_to_cpu(de->inode) != inode->i_ino || strcmp(".", de->name)) { ++ ext4_warning_inode(inode, "directory missing '.'"); ++ brelse(bh); ++ return true; ++ } ++ offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); ++ de = ext4_next_entry(de, sb->s_blocksize); ++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, ++ offset) || ++ le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) { ++ ext4_warning_inode(inode, "directory missing '..'"); + brelse(bh); + return true; + } +- offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize) + +- ext4_rec_len_from_disk(de1->rec_len, sb->s_blocksize); +- de = ext4_next_entry(de1, sb->s_blocksize); ++ offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); + while (offset < inode->i_size) { +- if ((void *) de >= (void *) (bh->b_data+sb->s_blocksize)) { ++ if (!(offset & (sb->s_blocksize - 1))) { + unsigned int lblock; + brelse(bh); + lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb); +@@ -2856,12 +2862,11 @@ bool ext4_empty_dir(struct inode *inode) + } + if (IS_ERR(bh)) + return true; +- de = (struct ext4_dir_entry_2 *) bh->b_data; + } ++ de = (struct ext4_dir_entry_2 *) (bh->b_data + ++ (offset & (sb->s_blocksize - 1))); + if (ext4_check_dir_entry(inode, NULL, de, bh, + bh->b_data, bh->b_size, offset)) { +- de = (struct ext4_dir_entry_2 *)(bh->b_data + +- sb->s_blocksize); + offset = (offset | (sb->s_blocksize - 1)) + 1; + continue; + } +@@ -2870,7 +2875,6 @@ bool ext4_empty_dir(struct inode *inode) + return false; + } + offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); +- de = ext4_next_entry(de, sb->s_blocksize); + } + brelse(bh); + return true; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 98d37b8d0050..66162b430edc 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1887,6 +1887,13 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token, + } + sbi->s_commit_interval = HZ * arg; + } else if (token == Opt_debug_want_extra_isize) { ++ if ((arg & 1) || ++ (arg < 4) || ++ (arg > (sbi->s_inode_size - EXT4_GOOD_OLD_INODE_SIZE))) { ++ ext4_msg(sb, KERN_ERR, ++ "Invalid want_extra_isize %d", arg); ++ return -1; ++ } + sbi->s_want_extra_isize = arg; + } else if (token == Opt_max_batch_time) { + sbi->s_max_batch_time = arg; +@@ -3551,40 +3558,6 @@ int ext4_calculate_overhead(struct super_block *sb) + return 0; + } + +-static void ext4_clamp_want_extra_isize(struct super_block *sb) +-{ +- struct ext4_sb_info *sbi = EXT4_SB(sb); +- struct ext4_super_block *es = sbi->s_es; +- unsigned def_extra_isize = sizeof(struct ext4_inode) - +- EXT4_GOOD_OLD_INODE_SIZE; +- +- if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) { +- sbi->s_want_extra_isize = 0; +- return; +- } +- if (sbi->s_want_extra_isize < 4) { +- sbi->s_want_extra_isize = def_extra_isize; +- if (ext4_has_feature_extra_isize(sb)) { +- if (sbi->s_want_extra_isize < +- le16_to_cpu(es->s_want_extra_isize)) +- sbi->s_want_extra_isize = +- le16_to_cpu(es->s_want_extra_isize); +- if (sbi->s_want_extra_isize < +- le16_to_cpu(es->s_min_extra_isize)) +- sbi->s_want_extra_isize = +- le16_to_cpu(es->s_min_extra_isize); +- } +- } +- /* Check if enough inode space is available */ +- if ((sbi->s_want_extra_isize > sbi->s_inode_size) || +- (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize > +- sbi->s_inode_size)) { +- sbi->s_want_extra_isize = def_extra_isize; +- ext4_msg(sb, KERN_INFO, +- "required extra inode space not available"); +- } +-} +- + static void ext4_set_resv_clusters(struct super_block *sb) + { + ext4_fsblk_t resv_clusters; +@@ -3792,6 +3765,68 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + */ + sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT; + ++ if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { ++ sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; ++ sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO; ++ } else { ++ sbi->s_inode_size = le16_to_cpu(es->s_inode_size); ++ sbi->s_first_ino = le32_to_cpu(es->s_first_ino); ++ if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) { ++ ext4_msg(sb, KERN_ERR, "invalid first ino: %u", ++ sbi->s_first_ino); ++ goto failed_mount; ++ } ++ if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) || ++ (!is_power_of_2(sbi->s_inode_size)) || ++ (sbi->s_inode_size > blocksize)) { ++ ext4_msg(sb, KERN_ERR, ++ "unsupported inode size: %d", ++ sbi->s_inode_size); ++ goto failed_mount; ++ } ++ /* ++ * i_atime_extra is the last extra field available for ++ * [acm]times in struct ext4_inode. Checking for that ++ * field should suffice to ensure we have extra space ++ * for all three. ++ */ ++ if (sbi->s_inode_size >= offsetof(struct ext4_inode, i_atime_extra) + ++ sizeof(((struct ext4_inode *)0)->i_atime_extra)) { ++ sb->s_time_gran = 1; ++ sb->s_time_max = EXT4_EXTRA_TIMESTAMP_MAX; ++ } else { ++ sb->s_time_gran = NSEC_PER_SEC; ++ sb->s_time_max = EXT4_NON_EXTRA_TIMESTAMP_MAX; ++ } ++ sb->s_time_min = EXT4_TIMESTAMP_MIN; ++ } ++ if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE) { ++ sbi->s_want_extra_isize = sizeof(struct ext4_inode) - ++ EXT4_GOOD_OLD_INODE_SIZE; ++ if (ext4_has_feature_extra_isize(sb)) { ++ unsigned v, max = (sbi->s_inode_size - ++ EXT4_GOOD_OLD_INODE_SIZE); ++ ++ v = le16_to_cpu(es->s_want_extra_isize); ++ if (v > max) { ++ ext4_msg(sb, KERN_ERR, ++ "bad s_want_extra_isize: %d", v); ++ goto failed_mount; ++ } ++ if (sbi->s_want_extra_isize < v) ++ sbi->s_want_extra_isize = v; ++ ++ v = le16_to_cpu(es->s_min_extra_isize); ++ if (v > max) { ++ ext4_msg(sb, KERN_ERR, ++ "bad s_min_extra_isize: %d", v); ++ goto failed_mount; ++ } ++ if (sbi->s_want_extra_isize < v) ++ sbi->s_want_extra_isize = v; ++ } ++ } ++ + if (sbi->s_es->s_mount_opts[0]) { + char *s_mount_opts = kstrndup(sbi->s_es->s_mount_opts, + sizeof(sbi->s_es->s_mount_opts), +@@ -4030,42 +4065,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + has_huge_files); + sb->s_maxbytes = ext4_max_size(sb->s_blocksize_bits, has_huge_files); + +- if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { +- sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; +- sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO; +- } else { +- sbi->s_inode_size = le16_to_cpu(es->s_inode_size); +- sbi->s_first_ino = le32_to_cpu(es->s_first_ino); +- if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) { +- ext4_msg(sb, KERN_ERR, "invalid first ino: %u", +- sbi->s_first_ino); +- goto failed_mount; +- } +- if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) || +- (!is_power_of_2(sbi->s_inode_size)) || +- (sbi->s_inode_size > blocksize)) { +- ext4_msg(sb, KERN_ERR, +- "unsupported inode size: %d", +- sbi->s_inode_size); +- goto failed_mount; +- } +- /* +- * i_atime_extra is the last extra field available for [acm]times in +- * struct ext4_inode. Checking for that field should suffice to ensure +- * we have extra space for all three. +- */ +- if (sbi->s_inode_size >= offsetof(struct ext4_inode, i_atime_extra) + +- sizeof(((struct ext4_inode *)0)->i_atime_extra)) { +- sb->s_time_gran = 1; +- sb->s_time_max = EXT4_EXTRA_TIMESTAMP_MAX; +- } else { +- sb->s_time_gran = NSEC_PER_SEC; +- sb->s_time_max = EXT4_NON_EXTRA_TIMESTAMP_MAX; +- } +- +- sb->s_time_min = EXT4_TIMESTAMP_MIN; +- } +- + sbi->s_desc_size = le16_to_cpu(es->s_desc_size); + if (ext4_has_feature_64bit(sb)) { + if (sbi->s_desc_size < EXT4_MIN_DESC_SIZE_64BIT || +@@ -4521,8 +4520,6 @@ no_journal: + } else if (ret) + goto failed_mount4a; + +- ext4_clamp_want_extra_isize(sb); +- + ext4_set_resv_clusters(sb); + + err = ext4_setup_system_zone(sb); +@@ -5310,8 +5307,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + goto restore_opts; + } + +- ext4_clamp_want_extra_isize(sb); +- + if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^ + test_opt(sb, JOURNAL_CHECKSUM)) { + ext4_msg(sb, KERN_ERR, "changing journal_checksum " +diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h +index 2ba6253ea6d3..fc349204a71b 100644 +--- a/include/drm/drm_dp_mst_helper.h ++++ b/include/drm/drm_dp_mst_helper.h +@@ -334,7 +334,7 @@ struct drm_dp_resource_status_notify { + + struct drm_dp_query_payload_ack_reply { + u8 port_number; +- u8 allocated_pbn; ++ u16 allocated_pbn; + }; + + struct drm_dp_sideband_msg_req_body { +diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h +index 92d5fdc8154e..31b1b0e03df8 100644 +--- a/include/linux/cpufreq.h ++++ b/include/linux/cpufreq.h +@@ -595,17 +595,6 @@ struct governor_attr { + size_t count); + }; + +-static inline bool cpufreq_this_cpu_can_update(struct cpufreq_policy *policy) +-{ +- /* +- * Allow remote callbacks if: +- * - dvfs_possible_from_any_cpu flag is set +- * - the local and remote CPUs share cpufreq policy +- */ +- return policy->dvfs_possible_from_any_cpu || +- cpumask_test_cpu(smp_processor_id(), policy->cpus); +-} +- + /********************************************************************* + * FREQUENCY TABLE HELPERS * + *********************************************************************/ +diff --git a/include/linux/ipmi_smi.h b/include/linux/ipmi_smi.h +index 4dc66157d872..deec18b8944a 100644 +--- a/include/linux/ipmi_smi.h ++++ b/include/linux/ipmi_smi.h +@@ -224,10 +224,14 @@ static inline int ipmi_demangle_device_id(uint8_t netfn, uint8_t cmd, + * is called, and the lower layer must get the interface from that + * call. + */ +-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, +- void *send_info, +- struct device *dev, +- unsigned char slave_addr); ++int ipmi_add_smi(struct module *owner, ++ const struct ipmi_smi_handlers *handlers, ++ void *send_info, ++ struct device *dev, ++ unsigned char slave_addr); ++ ++#define ipmi_register_smi(handlers, send_info, dev, slave_addr) \ ++ ipmi_add_smi(THIS_MODULE, handlers, send_info, dev, slave_addr) + + /* + * Remove a low-level interface from the IPMI driver. This will +diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h +index 5714fd35a83c..e3596db077dc 100644 +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -587,9 +587,9 @@ struct platform_device_id { + #define MDIO_NAME_SIZE 32 + #define MDIO_MODULE_PREFIX "mdio:" + +-#define MDIO_ID_FMT "%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d" ++#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u" + #define MDIO_ID_ARGS(_id) \ +- (_id)>>31, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ ++ ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ + ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \ + ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \ + ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \ +diff --git a/include/linux/nvme.h b/include/linux/nvme.h +index f61d6906e59d..a260cd754f28 100644 +--- a/include/linux/nvme.h ++++ b/include/linux/nvme.h +@@ -1368,6 +1368,7 @@ enum { + NVME_SC_ANA_INACCESSIBLE = 0x302, + NVME_SC_ANA_TRANSITION = 0x303, + NVME_SC_HOST_PATH_ERROR = 0x370, ++ NVME_SC_HOST_ABORTED_CMD = 0x371, + + NVME_SC_CRD = 0x1800, + NVME_SC_DNR = 0x4000, +diff --git a/include/linux/nvmem-consumer.h b/include/linux/nvmem-consumer.h +index 8f8be5b00060..5c17cb733224 100644 +--- a/include/linux/nvmem-consumer.h ++++ b/include/linux/nvmem-consumer.h +@@ -118,7 +118,7 @@ static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len) + } + + static inline int nvmem_cell_write(struct nvmem_cell *cell, +- const char *buf, size_t len) ++ void *buf, size_t len) + { + return -EOPNOTSUPP; + } +diff --git a/include/linux/phy.h b/include/linux/phy.h +index 9a0e981df502..3d5d53313e6c 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -993,7 +993,7 @@ int phy_modify_paged_changed(struct phy_device *phydev, int page, u32 regnum, + int phy_modify_paged(struct phy_device *phydev, int page, u32 regnum, + u16 mask, u16 set); + +-struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, ++struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + bool is_c45, + struct phy_c45_device_ids *c45_ids); + #if IS_ENABLED(CONFIG_PHYLIB) +diff --git a/include/linux/sched/cpufreq.h b/include/linux/sched/cpufreq.h +index afa940cd50dc..cc6bcc1e96bc 100644 +--- a/include/linux/sched/cpufreq.h ++++ b/include/linux/sched/cpufreq.h +@@ -12,6 +12,8 @@ + #define SCHED_CPUFREQ_MIGRATION (1U << 1) + + #ifdef CONFIG_CPU_FREQ ++struct cpufreq_policy; ++ + struct update_util_data { + void (*func)(struct update_util_data *data, u64 time, unsigned int flags); + }; +@@ -20,6 +22,7 @@ void cpufreq_add_update_util_hook(int cpu, struct update_util_data *data, + void (*func)(struct update_util_data *data, u64 time, + unsigned int flags)); + void cpufreq_remove_update_util_hook(int cpu); ++bool cpufreq_this_cpu_can_update(struct cpufreq_policy *policy); + + static inline unsigned long map_util_freq(unsigned long util, + unsigned long freq, unsigned long cap) +diff --git a/include/net/arp.h b/include/net/arp.h +index c8f580a0e6b1..4950191f6b2b 100644 +--- a/include/net/arp.h ++++ b/include/net/arp.h +@@ -57,8 +57,8 @@ static inline void __ipv4_confirm_neigh(struct net_device *dev, u32 key) + unsigned long now = jiffies; + + /* avoid dirtying neighbour */ +- if (n->confirmed != now) +- n->confirmed = now; ++ if (READ_ONCE(n->confirmed) != now) ++ WRITE_ONCE(n->confirmed, now); + } + rcu_read_unlock_bh(); + } +diff --git a/include/net/dst.h b/include/net/dst.h +index fe62fe2eb781..8224dad2ae94 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -82,7 +82,7 @@ struct dst_entry { + struct dst_metrics { + u32 metrics[RTAX_MAX]; + refcount_t refcnt; +-}; ++} __aligned(4); /* Low pointer bits contain DST_METRICS_FLAGS */ + extern const struct dst_metrics dst_default_metrics; + + u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old); +diff --git a/include/net/ndisc.h b/include/net/ndisc.h +index b2f715ca0567..b5ebeb3b0de0 100644 +--- a/include/net/ndisc.h ++++ b/include/net/ndisc.h +@@ -414,8 +414,8 @@ static inline void __ipv6_confirm_neigh(struct net_device *dev, + unsigned long now = jiffies; + + /* avoid dirtying neighbour */ +- if (n->confirmed != now) +- n->confirmed = now; ++ if (READ_ONCE(n->confirmed) != now) ++ WRITE_ONCE(n->confirmed, now); + } + rcu_read_unlock_bh(); + } +@@ -431,8 +431,8 @@ static inline void __ipv6_confirm_neigh_stub(struct net_device *dev, + unsigned long now = jiffies; + + /* avoid dirtying neighbour */ +- if (n->confirmed != now) +- n->confirmed = now; ++ if (READ_ONCE(n->confirmed) != now) ++ WRITE_ONCE(n->confirmed, now); + } + rcu_read_unlock_bh(); + } +diff --git a/include/net/neighbour.h b/include/net/neighbour.h +index b8452cc0e059..5e679c8dae0b 100644 +--- a/include/net/neighbour.h ++++ b/include/net/neighbour.h +@@ -72,7 +72,6 @@ struct neigh_parms { + struct net_device *dev; + struct list_head list; + int (*neigh_setup)(struct neighbour *); +- void (*neigh_cleanup)(struct neighbour *); + struct neigh_table *tbl; + + void *sysctl_table; +diff --git a/include/net/sock.h b/include/net/sock.h +index 718e62fbe869..013396e50b91 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1940,8 +1940,8 @@ struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie); + + static inline void sk_dst_confirm(struct sock *sk) + { +- if (!sk->sk_dst_pending_confirm) +- sk->sk_dst_pending_confirm = 1; ++ if (!READ_ONCE(sk->sk_dst_pending_confirm)) ++ WRITE_ONCE(sk->sk_dst_pending_confirm, 1); + } + + static inline void sock_confirm_neigh(struct sk_buff *skb, struct neighbour *n) +@@ -1951,10 +1951,10 @@ static inline void sock_confirm_neigh(struct sk_buff *skb, struct neighbour *n) + unsigned long now = jiffies; + + /* avoid dirtying neighbour */ +- if (n->confirmed != now) +- n->confirmed = now; +- if (sk && sk->sk_dst_pending_confirm) +- sk->sk_dst_pending_confirm = 0; ++ if (READ_ONCE(n->confirmed) != now) ++ WRITE_ONCE(n->confirmed, now); ++ if (sk && READ_ONCE(sk->sk_dst_pending_confirm)) ++ WRITE_ONCE(sk->sk_dst_pending_confirm, 0); + } + } + +diff --git a/include/trace/events/wbt.h b/include/trace/events/wbt.h +index b048694070e2..37342a13c9cb 100644 +--- a/include/trace/events/wbt.h ++++ b/include/trace/events/wbt.h +@@ -33,7 +33,8 @@ TRACE_EVENT(wbt_stat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->rmean = stat[0].mean; + __entry->rmin = stat[0].min; + __entry->rmax = stat[0].max; +@@ -67,7 +68,8 @@ TRACE_EVENT(wbt_lat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->lat = div_u64(lat, 1000); + ), + +@@ -103,7 +105,8 @@ TRACE_EVENT(wbt_step, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->msg = msg; + __entry->step = step; + __entry->window = div_u64(window, 1000); +@@ -138,7 +141,8 @@ TRACE_EVENT(wbt_timer, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->status = status; + __entry->step = step; + __entry->inflight = inflight; +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 052580c33d26..173e983619d7 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -287,7 +287,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + bool irq_work_busy = false; + struct stack_map_irq_work *work = NULL; + +- if (in_nmi()) { ++ if (irqs_disabled()) { + work = this_cpu_ptr(&up_read_work); + if (work->irq_work.flags & IRQ_WORK_BUSY) + /* cannot queue more up_read, fallback */ +@@ -295,8 +295,9 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + } + + /* +- * We cannot do up_read() in nmi context. To do build_id lookup +- * in nmi context, we need to run up_read() in irq_work. We use ++ * We cannot do up_read() when the irq is disabled, because of ++ * risk to deadlock with rq_lock. To do build_id lookup when the ++ * irqs are disabled, we need to run up_read() in irq_work. We use + * a percpu variable to do the irq_work. If the irq_work is + * already used by another lookup, we fall back to report ips. + * +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index ffc3e53f5300..9e7cee5307e0 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -978,6 +978,17 @@ static void __reg_bound_offset(struct bpf_reg_state *reg) + reg->umax_value)); + } + ++static void __reg_bound_offset32(struct bpf_reg_state *reg) ++{ ++ u64 mask = 0xffffFFFF; ++ struct tnum range = tnum_range(reg->umin_value & mask, ++ reg->umax_value & mask); ++ struct tnum lo32 = tnum_cast(reg->var_off, 4); ++ struct tnum hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32); ++ ++ reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range)); ++} ++ + /* Reset the min/max bounds of a register */ + static void __mark_reg_unbounded(struct bpf_reg_state *reg) + { +@@ -5433,6 +5444,10 @@ static void reg_set_min_max(struct bpf_reg_state *true_reg, + /* We might have learned some bits from the bounds. */ + __reg_bound_offset(false_reg); + __reg_bound_offset(true_reg); ++ if (is_jmp32) { ++ __reg_bound_offset32(false_reg); ++ __reg_bound_offset32(true_reg); ++ } + /* Intersecting with the old var_off might have improved our bounds + * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), + * then new var_off is (0; 0x7f...fc) which improves our umax. +@@ -5542,6 +5557,10 @@ static void reg_set_min_max_inv(struct bpf_reg_state *true_reg, + /* We might have learned some bits from the bounds. */ + __reg_bound_offset(false_reg); + __reg_bound_offset(true_reg); ++ if (is_jmp32) { ++ __reg_bound_offset32(false_reg); ++ __reg_bound_offset32(true_reg); ++ } + /* Intersecting with the old var_off might have improved our bounds + * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), + * then new var_off is (0; 0x7f...fc) which improves our umax. +diff --git a/kernel/cgroup/freezer.c b/kernel/cgroup/freezer.c +index 8cf010680678..3984dd6b8ddb 100644 +--- a/kernel/cgroup/freezer.c ++++ b/kernel/cgroup/freezer.c +@@ -230,6 +230,15 @@ void cgroup_freezer_migrate_task(struct task_struct *task, + if (task->flags & PF_KTHREAD) + return; + ++ /* ++ * It's not necessary to do changes if both of the src and dst cgroups ++ * are not freezing and task is not frozen. ++ */ ++ if (!test_bit(CGRP_FREEZE, &src->flags) && ++ !test_bit(CGRP_FREEZE, &dst->flags) && ++ !task->frozen) ++ return; ++ + /* + * Adjust counters of freezing and frozen tasks. + * Note, that if the task is frozen, but the destination cgroup is not +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 00a014670ed0..8f66a4833ded 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5607,10 +5607,8 @@ static void perf_mmap_close(struct vm_area_struct *vma) + perf_pmu_output_stop(event); + + /* now it's safe to free the pages */ +- if (!rb->aux_mmap_locked) +- atomic_long_sub(rb->aux_nr_pages, &mmap_user->locked_vm); +- else +- atomic64_sub(rb->aux_mmap_locked, &vma->vm_mm->pinned_vm); ++ atomic_long_sub(rb->aux_nr_pages - rb->aux_mmap_locked, &mmap_user->locked_vm); ++ atomic64_sub(rb->aux_mmap_locked, &vma->vm_mm->pinned_vm); + + /* this has to be the last one */ + rb_free_aux(rb); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 44123b4d14e8..8dacda4b0362 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -810,7 +810,7 @@ static inline unsigned int uclamp_bucket_base_value(unsigned int clamp_value) + return UCLAMP_BUCKET_DELTA * uclamp_bucket_id(clamp_value); + } + +-static inline enum uclamp_id uclamp_none(enum uclamp_id clamp_id) ++static inline unsigned int uclamp_none(enum uclamp_id clamp_id) + { + if (clamp_id == UCLAMP_MIN) + return 0; +@@ -853,7 +853,7 @@ static inline void uclamp_idle_reset(struct rq *rq, enum uclamp_id clamp_id, + } + + static inline +-enum uclamp_id uclamp_rq_max_value(struct rq *rq, enum uclamp_id clamp_id, ++unsigned int uclamp_rq_max_value(struct rq *rq, enum uclamp_id clamp_id, + unsigned int clamp_value) + { + struct uclamp_bucket *bucket = rq->uclamp[clamp_id].bucket; +@@ -918,7 +918,7 @@ uclamp_eff_get(struct task_struct *p, enum uclamp_id clamp_id) + return uc_req; + } + +-enum uclamp_id uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id) ++unsigned int uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id) + { + struct uclamp_se uc_eff; + +diff --git a/kernel/sched/cpufreq.c b/kernel/sched/cpufreq.c +index b5dcd1d83c7f..7c2fe50fd76d 100644 +--- a/kernel/sched/cpufreq.c ++++ b/kernel/sched/cpufreq.c +@@ -5,6 +5,8 @@ + * Copyright (C) 2016, Intel Corporation + * Author: Rafael J. Wysocki + */ ++#include ++ + #include "sched.h" + + DEFINE_PER_CPU(struct update_util_data __rcu *, cpufreq_update_util_data); +@@ -57,3 +59,19 @@ void cpufreq_remove_update_util_hook(int cpu) + rcu_assign_pointer(per_cpu(cpufreq_update_util_data, cpu), NULL); + } + EXPORT_SYMBOL_GPL(cpufreq_remove_update_util_hook); ++ ++/** ++ * cpufreq_this_cpu_can_update - Check if cpufreq policy can be updated. ++ * @policy: cpufreq policy to check. ++ * ++ * Return 'true' if: ++ * - the local and remote CPUs share @policy, ++ * - dvfs_possible_from_any_cpu is set in @policy and the local CPU is not going ++ * offline (in which case it is not expected to run cpufreq updates any more). ++ */ ++bool cpufreq_this_cpu_can_update(struct cpufreq_policy *policy) ++{ ++ return cpumask_test_cpu(smp_processor_id(), policy->cpus) || ++ (policy->dvfs_possible_from_any_cpu && ++ rcu_dereference_sched(*this_cpu_ptr(&cpufreq_update_util_data))); ++} +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index 86800b4d5453..b6f56e7c8dd1 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -82,12 +82,10 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) + * by the hardware, as calculating the frequency is pointless if + * we cannot in fact act on it. + * +- * For the slow switching platforms, the kthread is always scheduled on +- * the right set of CPUs and any CPU can find the next frequency and +- * schedule the kthread. ++ * This is needed on the slow switching platforms too to prevent CPUs ++ * going offline from leaving stale IRQ work items behind. + */ +- if (sg_policy->policy->fast_switch_enabled && +- !cpufreq_this_cpu_can_update(sg_policy->policy)) ++ if (!cpufreq_this_cpu_can_update(sg_policy->policy)) + return false; + + if (unlikely(sg_policy->limits_changed)) { +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index c8870c5bd7df..49ed949f850c 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -2309,7 +2309,7 @@ static inline void cpufreq_update_util(struct rq *rq, unsigned int flags) {} + #endif /* CONFIG_CPU_FREQ */ + + #ifdef CONFIG_UCLAMP_TASK +-enum uclamp_id uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id); ++unsigned int uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id); + + static __always_inline + unsigned int uclamp_util_with(struct rq *rq, unsigned int util, +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 6a0ee9178365..2fa72419bbd7 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4609,7 +4609,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) + + if (mask == TRACE_ITER_RECORD_TGID) { + if (!tgid_map) +- tgid_map = kcalloc(PID_MAX_DEFAULT + 1, ++ tgid_map = kvcalloc(PID_MAX_DEFAULT + 1, + sizeof(*tgid_map), + GFP_KERNEL); + if (!tgid_map) { +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 1552a95c743b..7f890262c8a3 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -435,11 +435,10 @@ static int disable_trace_kprobe(struct trace_event_call *call, + + #if defined(CONFIG_KPROBES_ON_FTRACE) && \ + !defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE) +-static bool within_notrace_func(struct trace_kprobe *tk) ++static bool __within_notrace_func(unsigned long addr) + { +- unsigned long offset, size, addr; ++ unsigned long offset, size; + +- addr = trace_kprobe_address(tk); + if (!addr || !kallsyms_lookup_size_offset(addr, &size, &offset)) + return false; + +@@ -452,6 +451,28 @@ static bool within_notrace_func(struct trace_kprobe *tk) + */ + return !ftrace_location_range(addr, addr + size - 1); + } ++ ++static bool within_notrace_func(struct trace_kprobe *tk) ++{ ++ unsigned long addr = addr = trace_kprobe_address(tk); ++ char symname[KSYM_NAME_LEN], *p; ++ ++ if (!__within_notrace_func(addr)) ++ return false; ++ ++ /* Check if the address is on a suffixed-symbol */ ++ if (!lookup_symbol_name(addr, symname)) { ++ p = strchr(symname, '.'); ++ if (!p) ++ return true; ++ *p = '\0'; ++ addr = (unsigned long)kprobe_lookup_name(symname, 0); ++ if (addr) ++ return __within_notrace_func(addr); ++ } ++ ++ return true; ++} + #else + #define within_notrace_func(tk) (false) + #endif +diff --git a/lib/ubsan.c b/lib/ubsan.c +index e7d31735950d..0c4681118fcd 100644 +--- a/lib/ubsan.c ++++ b/lib/ubsan.c +@@ -374,9 +374,10 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + struct type_descriptor *lhs_type = data->lhs_type; + char rhs_str[VALUE_LENGTH]; + char lhs_str[VALUE_LENGTH]; ++ unsigned long ua_flags = user_access_save(); + + if (suppress_report(&data->location)) +- return; ++ goto out; + + ubsan_prologue(&data->location, &flags); + +@@ -402,6 +403,8 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + lhs_type->type_name); + + ubsan_epilogue(&flags); ++out: ++ user_access_restore(ua_flags); + } + EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); + +diff --git a/mm/vmscan.c b/mm/vmscan.c +index ee4eecc7e1c2..e7f10c4b40f0 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -422,7 +422,7 @@ void register_shrinker_prepared(struct shrinker *shrinker) + { + down_write(&shrinker_rwsem); + list_add_tail(&shrinker->list, &shrinker_list); +-#ifdef CONFIG_MEMCG_KMEM ++#ifdef CONFIG_MEMCG + if (shrinker->flags & SHRINKER_MEMCG_AWARE) + idr_replace(&shrinker_idr, shrinker, shrinker->id); + #endif +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index ad5b0ac1f9ce..7ff92dd4c53c 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -934,6 +934,14 @@ static void hci_req_directed_advertising(struct hci_request *req, + return; + + memset(&cp, 0, sizeof(cp)); ++ ++ /* Some controllers might reject command if intervals are not ++ * within range for undirected advertising. ++ * BCM20702A0 is known to be affected by this. ++ */ ++ cp.min_interval = cpu_to_le16(0x0020); ++ cp.max_interval = cpu_to_le16(0x0020); ++ + cp.type = LE_ADV_DIRECT_IND; + cp.own_address_type = own_addr_type; + cp.direct_addr_type = conn->dst_type; +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 04bc79359a17..0cc9ce917222 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -842,8 +842,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt) + if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) { + struct hci_cp_le_write_def_data_len cp; + +- cp.tx_len = hdev->le_max_tx_len; +- cp.tx_time = hdev->le_max_tx_time; ++ cp.tx_len = cpu_to_le16(hdev->le_max_tx_len); ++ cp.tx_time = cpu_to_le16(hdev->le_max_tx_time); + hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp); + } + +@@ -4440,7 +4440,14 @@ static void hci_rx_work(struct work_struct *work) + hci_send_to_sock(hdev, skb); + } + +- if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { ++ /* If the device has been opened in HCI_USER_CHANNEL, ++ * the userspace has exclusive access to device. ++ * When device is HCI_INIT, we still need to process ++ * the data packets to the driver in order ++ * to complete its setup(). ++ */ ++ if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && ++ !test_bit(HCI_INIT, &hdev->flags)) { + kfree_skb(skb); + continue; + } +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 7f6a581b5b7e..3d25dbf10b26 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -1273,6 +1273,14 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + + instance_flags = get_adv_instance_flags(hdev, instance); + ++ /* If instance already has the flags set skip adding it once ++ * again. ++ */ ++ if (adv_instance && eir_get_data(adv_instance->adv_data, ++ adv_instance->adv_data_len, EIR_FLAGS, ++ NULL)) ++ goto skip_flags; ++ + /* The Add Advertising command allows userspace to set both the general + * and limited discoverable flags. + */ +@@ -1305,6 +1313,7 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + } + } + ++skip_flags: + if (adv_instance) { + memcpy(ptr, adv_instance->adv_data, + adv_instance->adv_data_len); +diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c +index de09b0a65791..f7587428febd 100644 +--- a/net/can/j1939/socket.c ++++ b/net/can/j1939/socket.c +@@ -423,9 +423,9 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) + { + struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; + struct j1939_sock *jsk = j1939_sk(sock->sk); +- struct j1939_priv *priv = jsk->priv; +- struct sock *sk = sock->sk; +- struct net *net = sock_net(sk); ++ struct j1939_priv *priv; ++ struct sock *sk; ++ struct net *net; + int ret = 0; + + ret = j1939_sk_sanity_check(addr, len); +@@ -434,6 +434,10 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) + + lock_sock(sock->sk); + ++ priv = jsk->priv; ++ sk = sock->sk; ++ net = sock_net(sk); ++ + /* Already bound to an interface? */ + if (jsk->state & J1939_SOCK_BOUND) { + /* A re-bind() to a different interface is not +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 5480edff0c86..08ebc3ac5343 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -98,9 +98,6 @@ static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb) + + static void neigh_cleanup_and_release(struct neighbour *neigh) + { +- if (neigh->parms->neigh_cleanup) +- neigh->parms->neigh_cleanup(neigh); +- + trace_neigh_cleanup_and_release(neigh, 0); + __neigh_notify(neigh, RTM_DELNEIGH, 0, 0); + call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh); +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index ae3bcb1540ec..b4db68e5caa9 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -919,14 +919,17 @@ static int rx_queue_add_kobject(struct net_device *dev, int index) + struct kobject *kobj = &queue->kobj; + int error = 0; + ++ /* Kobject_put later will trigger rx_queue_release call which ++ * decreases dev refcount: Take that reference here ++ */ ++ dev_hold(queue->dev); ++ + kobj->kset = dev->queues_kset; + error = kobject_init_and_add(kobj, &rx_queue_ktype, NULL, + "rx-%u", index); + if (error) + goto err; + +- dev_hold(queue->dev); +- + if (dev->sysfs_rx_queue_group) { + error = sysfs_create_group(kobj, dev->sysfs_rx_queue_group); + if (error) +diff --git a/net/mac80211/status.c b/net/mac80211/status.c +index ab8ba5835ca0..5a3d645fe1bc 100644 +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -1030,7 +1030,8 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw, + I802_DEBUG_INC(local->dot11FailedCount); + } + +- if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) && ++ if ((ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) && ++ ieee80211_has_pm(fc) && + ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) && + !(info->flags & IEEE80211_TX_CTL_INJECTED) && + local->ps_sdata && !(local->scanning)) { +diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c +index 78fe622eba65..11b554ce07ff 100644 +--- a/net/nfc/nci/uart.c ++++ b/net/nfc/nci/uart.c +@@ -346,7 +346,7 @@ static int nci_uart_default_recv_buf(struct nci_uart *nu, const u8 *data, + nu->rx_packet_len = -1; + nu->rx_skb = nci_skb_alloc(nu->ndev, + NCI_MAX_PACKET_SIZE, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!nu->rx_skb) + return -ENOMEM; + } +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 82a50e850245..529d4ce945db 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -544,7 +544,8 @@ static int prb_calc_retire_blk_tmo(struct packet_sock *po, + msec = 1; + div = ecmd.base.speed / 1000; + } +- } ++ } else ++ return DEFAULT_PRB_RETIRE_TOV; + + mbits = (blk_size_in_bytes * 8) / (1024 * 1024); + +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index 08d14d86ecfb..681ffb3545db 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -227,6 +227,7 @@ static void sctp_v4_from_skb(union sctp_addr *addr, struct sk_buff *skb, + sa->sin_port = sh->dest; + sa->sin_addr.s_addr = ip_hdr(skb)->daddr; + } ++ memset(sa->sin_zero, 0, sizeof(sa->sin_zero)); + } + + /* Initialize an sctp_addr from a socket. */ +@@ -235,6 +236,7 @@ static void sctp_v4_from_sk(union sctp_addr *addr, struct sock *sk) + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = 0; + addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize sk->sk_rcv_saddr from sctp_addr. */ +@@ -257,6 +259,7 @@ static void sctp_v4_from_addr_param(union sctp_addr *addr, + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = port; + addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize an address parameter from a sctp_addr and return the length +@@ -281,6 +284,7 @@ static void sctp_v4_dst_saddr(union sctp_addr *saddr, struct flowi4 *fl4, + saddr->v4.sin_family = AF_INET; + saddr->v4.sin_port = port; + saddr->v4.sin_addr.s_addr = fl4->saddr; ++ memset(saddr->v4.sin_zero, 0, sizeof(saddr->v4.sin_zero)); + } + + /* Compare two addresses exactly. */ +@@ -303,6 +307,7 @@ static void sctp_v4_inaddr_any(union sctp_addr *addr, __be16 port) + addr->v4.sin_family = AF_INET; + addr->v4.sin_addr.s_addr = htonl(INADDR_ANY); + addr->v4.sin_port = port; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Is this a wildcard address? */ +diff --git a/net/sctp/stream.c b/net/sctp/stream.c +index e83cdaa2ab76..6a30392068a0 100644 +--- a/net/sctp/stream.c ++++ b/net/sctp/stream.c +@@ -84,8 +84,10 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt, + return 0; + + ret = genradix_prealloc(&stream->out, outcnt, gfp); +- if (ret) ++ if (ret) { ++ genradix_free(&stream->out); + return ret; ++ } + + stream->outcnt = outcnt; + return 0; +@@ -100,8 +102,10 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt, + return 0; + + ret = genradix_prealloc(&stream->in, incnt, gfp); +- if (ret) ++ if (ret) { ++ genradix_free(&stream->in); + return ret; ++ } + + stream->incnt = incnt; + return 0; +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 2ba97ff325a5..0c5fcb8ed404 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -231,10 +231,12 @@ static int smc_lgr_create(struct smc_sock *smc, struct smc_init_info *ini) + lgr->conns_all = RB_ROOT; + if (ini->is_smcd) { + /* SMC-D specific settings */ ++ get_device(&ini->ism_dev->dev); + lgr->peer_gid = ini->ism_gid; + lgr->smcd = ini->ism_dev; + } else { + /* SMC-R specific settings */ ++ get_device(&ini->ib_dev->ibdev->dev); + lgr->role = smc->listen_smc ? SMC_SERV : SMC_CLNT; + memcpy(lgr->peer_systemid, ini->ib_lcl->id_for_peer, + SMC_SYSTEMID_LEN); +@@ -433,10 +435,13 @@ static void smc_lgr_free_bufs(struct smc_link_group *lgr) + static void smc_lgr_free(struct smc_link_group *lgr) + { + smc_lgr_free_bufs(lgr); +- if (lgr->is_smcd) ++ if (lgr->is_smcd) { + smc_ism_put_vlan(lgr->smcd, lgr->vlan_id); +- else ++ put_device(&lgr->smcd->dev); ++ } else { + smc_link_clear(&lgr->lnk[SMC_SINGLE_LINK]); ++ put_device(&lgr->lnk[SMC_SINGLE_LINK].smcibdev->ibdev->dev); ++ } + kfree(lgr); + } + +diff --git a/samples/pktgen/functions.sh b/samples/pktgen/functions.sh +index 4af4046d71be..40873a5d1461 100644 +--- a/samples/pktgen/functions.sh ++++ b/samples/pktgen/functions.sh +@@ -5,6 +5,8 @@ + # Author: Jesper Dangaaard Brouer + # License: GPL + ++set -o errexit ++ + ## -- General shell logging cmds -- + function err() { + local exitcode=$1 +@@ -58,6 +60,7 @@ function pg_set() { + function proc_cmd() { + local result + local proc_file=$1 ++ local status=0 + # after shift, the remaining args are contained in $@ + shift + local proc_ctrl=${PROC_DIR}/$proc_file +@@ -73,13 +76,13 @@ function proc_cmd() { + echo "cmd: $@ > $proc_ctrl" + fi + # Quoting of "$@" is important for space expansion +- echo "$@" > "$proc_ctrl" +- local status=$? ++ echo "$@" > "$proc_ctrl" || status=$? + +- result=$(grep "Result: OK:" $proc_ctrl) +- # Due to pgctrl, cannot use exit code $? from grep +- if [[ "$result" == "" ]]; then +- grep "Result:" $proc_ctrl >&2 ++ if [[ "$proc_file" != "pgctrl" ]]; then ++ result=$(grep "Result: OK:" $proc_ctrl) || true ++ if [[ "$result" == "" ]]; then ++ grep "Result:" $proc_ctrl >&2 ++ fi + fi + if (( $status != 0 )); then + err 5 "Write error($status) occurred cmd: \"$@ > $proc_ctrl\"" +@@ -105,6 +108,8 @@ function pgset() { + fi + } + ++[[ $EUID -eq 0 ]] && trap 'pg_ctrl "reset"' EXIT ++ + ## -- General shell tricks -- + + function root_check_run_with_sudo() { +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 91c6ad58729f..d4280568a41e 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -222,7 +222,8 @@ static bool hw_support_mmap(struct snd_pcm_substream *substream) + return false; + + if (substream->ops->mmap || +- substream->dma_buffer.dev.type != SNDRV_DMA_TYPE_DEV) ++ (substream->dma_buffer.dev.type != SNDRV_DMA_TYPE_DEV && ++ substream->dma_buffer.dev.type != SNDRV_DMA_TYPE_DEV_UC)) + return true; + + return dma_can_mmap(substream->dma_buffer.dev.dev); +@@ -705,6 +706,10 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, + while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size) + runtime->boundary *= 2; + ++ /* clear the buffer for avoiding possible kernel info leaks */ ++ if (runtime->dma_area && !substream->ops->copy_user) ++ memset(runtime->dma_area, 0, runtime->dma_bytes); ++ + snd_pcm_timer_resolution_change(substream); + snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP); + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 59ae21b0bb93..013f0e69ff0f 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -74,6 +74,9 @@ static LIST_HEAD(snd_timer_slave_list); + /* lock for slave active lists */ + static DEFINE_SPINLOCK(slave_active_lock); + ++#define MAX_SLAVE_INSTANCES 1000 ++static int num_slaves; ++ + static DEFINE_MUTEX(register_mutex); + + static int snd_timer_free(struct snd_timer *timer); +@@ -252,6 +255,10 @@ int snd_timer_open(struct snd_timer_instance **ti, + err = -EINVAL; + goto unlock; + } ++ if (num_slaves >= MAX_SLAVE_INSTANCES) { ++ err = -EBUSY; ++ goto unlock; ++ } + timeri = snd_timer_instance_new(owner, NULL); + if (!timeri) { + err = -ENOMEM; +@@ -261,6 +268,7 @@ int snd_timer_open(struct snd_timer_instance **ti, + timeri->slave_id = tid->device; + timeri->flags |= SNDRV_TIMER_IFLG_SLAVE; + list_add_tail(&timeri->open_list, &snd_timer_slave_list); ++ num_slaves++; + err = snd_timer_check_slave(timeri); + if (err < 0) { + snd_timer_close_locked(timeri, &card_dev_to_put); +@@ -356,6 +364,8 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri, + } + + list_del(&timeri->open_list); ++ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) ++ num_slaves--; + + /* force to stop the timer */ + snd_timer_stop(timeri); +diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c +index 6c1497d9f52b..ce07ea0d4e71 100644 +--- a/sound/firewire/bebob/bebob_stream.c ++++ b/sound/firewire/bebob/bebob_stream.c +@@ -415,15 +415,16 @@ static int make_both_connections(struct snd_bebob *bebob) + return 0; + } + +-static void +-break_both_connections(struct snd_bebob *bebob) ++static void break_both_connections(struct snd_bebob *bebob) + { + cmp_connection_break(&bebob->in_conn); + cmp_connection_break(&bebob->out_conn); + +- /* These models seems to be in transition state for a longer time. */ +- if (bebob->maudio_special_quirk != NULL) +- msleep(200); ++ // These models seem to be in transition state for a longer time. When ++ // accessing in the state, any transactions is corrupted. In the worst ++ // case, the device is going to reboot. ++ if (bebob->version < 2) ++ msleep(600); + } + + static int +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index b7a1abb3e231..32ed46464af7 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -1809,13 +1809,14 @@ struct scp_msg { + + static void dspio_clear_response_queue(struct hda_codec *codec) + { ++ unsigned long timeout = jiffies + msecs_to_jiffies(1000); + unsigned int dummy = 0; +- int status = -1; ++ int status; + + /* clear all from the response queue */ + do { + status = dspio_read(codec, &dummy); +- } while (status == 0); ++ } while (status == 0 && time_before(jiffies, timeout)); + } + + static int dspio_get_response_data(struct hda_codec *codec) +@@ -7588,12 +7589,14 @@ static void ca0132_process_dsp_response(struct hda_codec *codec, + struct ca0132_spec *spec = codec->spec; + + codec_dbg(codec, "ca0132_process_dsp_response\n"); ++ snd_hda_power_up_pm(codec); + if (spec->wait_scp) { + if (dspio_get_response_data(codec) >= 0) + spec->wait_scp = 0; + } + + dspio_clear_response_queue(codec); ++ snd_hda_power_down_pm(codec); + } + + static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb) +@@ -7604,11 +7607,10 @@ static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb) + /* Delay enabling the HP amp, to let the mic-detection + * state machine run. + */ +- cancel_delayed_work(&spec->unsol_hp_work); +- schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500)); + tbl = snd_hda_jack_tbl_get(codec, cb->nid); + if (tbl) + tbl->block_report = 1; ++ schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500)); + } + + static void amic_callback(struct hda_codec *codec, struct hda_jack_callback *cb) +@@ -8454,12 +8456,25 @@ static void ca0132_reboot_notify(struct hda_codec *codec) + codec->patch_ops.free(codec); + } + ++#ifdef CONFIG_PM ++static int ca0132_suspend(struct hda_codec *codec) ++{ ++ struct ca0132_spec *spec = codec->spec; ++ ++ cancel_delayed_work_sync(&spec->unsol_hp_work); ++ return 0; ++} ++#endif ++ + static const struct hda_codec_ops ca0132_patch_ops = { + .build_controls = ca0132_build_controls, + .build_pcms = ca0132_build_pcms, + .init = ca0132_init, + .free = ca0132_free, + .unsol_event = snd_hda_jack_unsol_event, ++#ifdef CONFIG_PM ++ .suspend = ca0132_suspend, ++#endif + .reboot_notify = ca0132_reboot_notify, + }; + +diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c +index 315a3d39bc09..8bc9450da79c 100644 +--- a/sound/soc/codecs/rt5677.c ++++ b/sound/soc/codecs/rt5677.c +@@ -298,6 +298,7 @@ static bool rt5677_volatile_register(struct device *dev, unsigned int reg) + case RT5677_I2C_MASTER_CTRL7: + case RT5677_I2C_MASTER_CTRL8: + case RT5677_HAP_GENE_CTRL2: ++ case RT5677_PWR_ANLG2: /* Modified by DSP firmware */ + case RT5677_PWR_DSP_ST: + case RT5677_PRIV_DATA: + case RT5677_ASRC_22: +diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c +index cf64e109c658..7b087d94141b 100644 +--- a/sound/soc/codecs/wm2200.c ++++ b/sound/soc/codecs/wm2200.c +@@ -2410,6 +2410,8 @@ static int wm2200_i2c_probe(struct i2c_client *i2c, + + err_pm_runtime: + pm_runtime_disable(&i2c->dev); ++ if (i2c->irq) ++ free_irq(i2c->irq, wm2200); + err_reset: + if (wm2200->pdata.reset) + gpio_set_value_cansleep(wm2200->pdata.reset, 0); +@@ -2426,12 +2428,15 @@ static int wm2200_i2c_remove(struct i2c_client *i2c) + { + struct wm2200_priv *wm2200 = i2c_get_clientdata(i2c); + ++ pm_runtime_disable(&i2c->dev); + if (i2c->irq) + free_irq(i2c->irq, wm2200); + if (wm2200->pdata.reset) + gpio_set_value_cansleep(wm2200->pdata.reset, 0); + if (wm2200->pdata.ldo_ena) + gpio_set_value_cansleep(wm2200->pdata.ldo_ena, 0); ++ regulator_bulk_disable(ARRAY_SIZE(wm2200->core_supplies), ++ wm2200->core_supplies); + + return 0; + } +diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c +index 4af0e519e623..91cc63c5a51f 100644 +--- a/sound/soc/codecs/wm5100.c ++++ b/sound/soc/codecs/wm5100.c +@@ -2617,6 +2617,7 @@ static int wm5100_i2c_probe(struct i2c_client *i2c, + return ret; + + err_reset: ++ pm_runtime_disable(&i2c->dev); + if (i2c->irq) + free_irq(i2c->irq, wm5100); + wm5100_free_gpio(i2c); +@@ -2640,6 +2641,7 @@ static int wm5100_i2c_remove(struct i2c_client *i2c) + { + struct wm5100_priv *wm5100 = i2c_get_clientdata(i2c); + ++ pm_runtime_disable(&i2c->dev); + if (i2c->irq) + free_irq(i2c->irq, wm5100); + wm5100_free_gpio(i2c); +diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c +index bcb3c9d5abf0..9e8c564f6e9c 100644 +--- a/sound/soc/codecs/wm8904.c ++++ b/sound/soc/codecs/wm8904.c +@@ -1917,6 +1917,7 @@ static int wm8904_set_bias_level(struct snd_soc_component *component, + snd_soc_component_update_bits(component, WM8904_BIAS_CONTROL_0, + WM8904_BIAS_ENA, 0); + ++ snd_soc_component_write(component, WM8904_SW_RESET_AND_ID, 0); + regcache_cache_only(wm8904->regmap, true); + regcache_mark_dirty(wm8904->regmap); + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 9c1aa4ec9cba..dd2b5ad08659 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -405,10 +405,12 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"), + }, +- .driver_data = (void *)(BYT_RT5640_IN1_MAP | +- BYT_RT5640_MCLK_EN | +- BYT_RT5640_SSP0_AIF1), +- ++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), + }, + { + .matches = { +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index 74dda8784f1a..67b276a65a8d 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -400,6 +400,9 @@ static int kabylake_dmic_startup(struct snd_pcm_substream *substream) + snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS, + dmic_constraints); + ++ runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16); ++ + return snd_pcm_hw_constraint_list(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_RATE, &constraints_rates); + } +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index b600d3eaaf5c..a6e96cf1d8ff 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -877,6 +877,11 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream, + int i, ret = 0; + + mutex_lock_nested(&rtd->card->pcm_mutex, rtd->card->pcm_subclass); ++ ++ ret = soc_pcm_params_symmetry(substream, params); ++ if (ret) ++ goto out; ++ + if (rtd->dai_link->ops->hw_params) { + ret = rtd->dai_link->ops->hw_params(substream, params); + if (ret < 0) { +@@ -958,9 +963,6 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream, + } + component = NULL; + +- ret = soc_pcm_params_symmetry(substream, params); +- if (ret) +- goto component_err; + out: + mutex_unlock(&rtd->card->pcm_mutex); + return ret; +@@ -1385,6 +1387,7 @@ static int dpcm_prune_paths(struct snd_soc_pcm_runtime *fe, int stream, + struct snd_soc_dapm_widget *widget; + struct snd_soc_dai *dai; + int prune = 0; ++ int do_prune; + + /* Destroy any old FE <--> BE connections */ + for_each_dpcm_be(fe, stream, dpcm) { +@@ -1398,13 +1401,16 @@ static int dpcm_prune_paths(struct snd_soc_pcm_runtime *fe, int stream, + continue; + + /* is there a valid CODEC DAI widget for this BE */ ++ do_prune = 1; + for_each_rtd_codec_dai(dpcm->be, i, dai) { + widget = dai_get_widget(dai, stream); + + /* prune the BE if it's no longer in our active list */ + if (widget && widget_in_list(list, widget)) +- continue; ++ do_prune = 0; + } ++ if (!do_prune) ++ continue; + + dev_dbg(fe->dev, "ASoC: pruning %s BE %s for %s\n", + stream ? "capture" : "playback", +diff --git a/sound/soc/sof/imx/Kconfig b/sound/soc/sof/imx/Kconfig +index 5acae75f5750..71f318bc2c74 100644 +--- a/sound/soc/sof/imx/Kconfig ++++ b/sound/soc/sof/imx/Kconfig +@@ -11,8 +11,8 @@ config SND_SOC_SOF_IMX_TOPLEVEL + + if SND_SOC_SOF_IMX_TOPLEVEL + +-config SND_SOC_SOF_IMX8 +- tristate "SOF support for i.MX8" ++config SND_SOC_SOF_IMX8_SUPPORT ++ bool "SOF support for i.MX8" + depends on IMX_SCU + depends on IMX_DSP + help +@@ -20,4 +20,8 @@ config SND_SOC_SOF_IMX8 + Say Y if you have such a device. + If unsure select "N". + ++config SND_SOC_SOF_IMX8 ++ def_tristate SND_SOC_SOF_OF ++ depends on SND_SOC_SOF_IMX8_SUPPORT ++ + endif ## SND_SOC_SOF_IMX_IMX_TOPLEVEL +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index 06e84679087b..5a5163eef2ef 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -268,6 +268,7 @@ static int hda_init(struct snd_sof_dev *sdev) + + bus->use_posbuf = 1; + bus->bdl_pos_adj = 0; ++ bus->sync_write = 1; + + mutex_init(&hbus->prepare_mutex); + hbus->pci = pci; +diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c +index 4452594c2e17..fa299e078156 100644 +--- a/sound/soc/sof/topology.c ++++ b/sound/soc/sof/topology.c +@@ -2828,6 +2828,10 @@ static int sof_link_load(struct snd_soc_component *scomp, int index, + if (!link->no_pcm) { + link->nonatomic = true; + ++ /* set trigger order */ ++ link->trigger[0] = SND_SOC_DPCM_TRIGGER_POST; ++ link->trigger[1] = SND_SOC_DPCM_TRIGGER_POST; ++ + /* nothing more to do for FE dai links */ + return 0; + } +diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/tools/arch/x86/lib/x86-opcode-map.txt ++++ b/tools/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile +index 5d1995fd369c..5535650800ab 100644 +--- a/tools/bpf/Makefile ++++ b/tools/bpf/Makefile +@@ -16,7 +16,13 @@ CFLAGS += -D__EXPORTED_HEADERS__ -I$(srctree)/include/uapi -I$(srctree)/include + # isn't set and when invoked from selftests build, where srctree + # is set to ".". building_out_of_srctree is undefined for in srctree + # builds ++ifeq ($(srctree),) ++update_srctree := 1 ++endif + ifndef building_out_of_srctree ++update_srctree := 1 ++endif ++ifeq ($(update_srctree),1) + srctree := $(patsubst %/,%,$(dir $(CURDIR))) + srctree := $(patsubst %/,%,$(dir $(srctree))) + endif +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index ede55fec3618..87f27e2664c5 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -876,7 +876,6 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + __u16 vlen = btf_vlen(t); + + packed = is_struct ? btf_is_struct_packed(d->btf, id, t) : 0; +- align = packed ? 1 : btf_align_of(d->btf, id); + + btf_dump_printf(d, "%s%s%s {", + is_struct ? "struct" : "union", +@@ -906,6 +905,13 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + btf_dump_printf(d, ";"); + } + ++ /* pad at the end, if necessary */ ++ if (is_struct) { ++ align = packed ? 1 : btf_align_of(d->btf, id); ++ btf_dump_emit_bit_padding(d, off, t->size * 8, 0, align, ++ lvl + 1); ++ } ++ + if (vlen) + btf_dump_printf(d, "\n"); + btf_dump_printf(d, "%s}", pfx(lvl)); +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index e0276520171b..a267cd0c0ce2 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1897,16 +1897,22 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd) + return -errno; + + new_fd = open("/", O_RDONLY | O_CLOEXEC); +- if (new_fd < 0) ++ if (new_fd < 0) { ++ err = -errno; + goto err_free_new_name; ++ } + + new_fd = dup3(fd, new_fd, O_CLOEXEC); +- if (new_fd < 0) ++ if (new_fd < 0) { ++ err = -errno; + goto err_close_new_fd; ++ } + + err = zclose(map->fd); +- if (err) ++ if (err) { ++ err = -errno; + goto err_close_new_fd; ++ } + free(map->name); + + map->fd = new_fd; +@@ -1925,7 +1931,7 @@ err_close_new_fd: + close(new_fd); + err_free_new_name: + free(new_name); +- return -errno; ++ return err; + } + + int bpf_map__resize(struct bpf_map *map, __u32 max_entries) +diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c +index a902838f9fcc..70f9e10de286 100644 +--- a/tools/lib/bpf/xsk.c ++++ b/tools/lib/bpf/xsk.c +@@ -163,6 +163,7 @@ int xsk_umem__create_v0_0_4(struct xsk_umem **umem_ptr, void *umem_area, + umem->umem_area = umem_area; + xsk_set_umem_config(&umem->config, usr_config); + ++ memset(&mr, 0, sizeof(mr)); + mr.addr = (uintptr_t)umem_area; + mr.len = size; + mr.chunk_size = umem->config.frame_size; +@@ -343,13 +344,18 @@ static int xsk_get_max_queues(struct xsk_socket *xsk) + goto out; + } + +- if (err || channels.max_combined == 0) ++ if (err) { + /* If the device says it has no channels, then all traffic + * is sent to a single stream, so max queues = 1. + */ + ret = 1; +- else +- ret = channels.max_combined; ++ } else { ++ /* Take the max of rx, tx, combined. Drivers return ++ * the number of channels in different ways. ++ */ ++ ret = max(channels.max_rx, channels.max_tx); ++ ret = max(ret, (int)channels.max_combined); ++ } + + out: + close(fd); +@@ -465,6 +471,8 @@ static int xsk_setup_xdp_prog(struct xsk_socket *xsk) + } + } else { + xsk->prog_fd = bpf_prog_get_fd_by_id(prog_id); ++ if (xsk->prog_fd < 0) ++ return -errno; + err = xsk_lookup_bpf_maps(xsk); + if (err) { + close(xsk->prog_fd); +diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile +index 5b2cd5e58df0..5dbb0dde208c 100644 +--- a/tools/lib/subcmd/Makefile ++++ b/tools/lib/subcmd/Makefile +@@ -28,7 +28,9 @@ ifeq ($(DEBUG),0) + endif + endif + +-ifeq ($(CC_NO_CLANG), 0) ++ifeq ($(DEBUG),1) ++ CFLAGS += -O0 ++else ifeq ($(CC_NO_CLANG), 0) + CFLAGS += -O3 + else + CFLAGS += -O6 +diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c +index 552592d153fb..f3cbf86e51ac 100644 +--- a/tools/lib/traceevent/parse-filter.c ++++ b/tools/lib/traceevent/parse-filter.c +@@ -1473,8 +1473,10 @@ static int copy_filter_type(struct tep_event_filter *filter, + if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) { + /* Add trivial event */ + arg = allocate_arg(); +- if (arg == NULL) ++ if (arg == NULL) { ++ free(str); + return -1; ++ } + + arg->type = TEP_FILTER_ARG_BOOLEAN; + if (strcmp(str, "TRUE") == 0) +@@ -1483,8 +1485,11 @@ static int copy_filter_type(struct tep_event_filter *filter, + arg->boolean.value = 0; + + filter_type = add_filter_type(filter, event->id); +- if (filter_type == NULL) ++ if (filter_type == NULL) { ++ free(str); ++ free_arg(arg); + return -1; ++ } + + filter_type->filter = arg; + +diff --git a/tools/memory-model/linux-kernel.cat b/tools/memory-model/linux-kernel.cat +index ea2ff4b94074..2a9b4fe4a84e 100644 +--- a/tools/memory-model/linux-kernel.cat ++++ b/tools/memory-model/linux-kernel.cat +@@ -197,7 +197,7 @@ empty (wr-incoh | rw-incoh | ww-incoh) as plain-coherence + (* Actual races *) + let ww-nonrace = ww-vis & ((Marked * W) | rw-xbstar) & ((W * Marked) | wr-vis) + let ww-race = (pre-race & co) \ ww-nonrace +-let wr-race = (pre-race & (co? ; rf)) \ wr-vis ++let wr-race = (pre-race & (co? ; rf)) \ wr-vis \ rw-xbstar^-1 + let rw-race = (pre-race & fr) \ rw-xbstar + + flag ~empty (ww-race | wr-race | rw-race) as data-race +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 044c9a3cb247..f53d3c515cdc 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -481,6 +481,7 @@ static const char *uaccess_safe_builtin[] = { + "ubsan_type_mismatch_common", + "__ubsan_handle_type_mismatch", + "__ubsan_handle_type_mismatch_v1", ++ "__ubsan_handle_shift_out_of_bounds", + /* misc */ + "csum_partial_copy_generic", + "__memcpy_mcsafe", +diff --git a/tools/perf/arch/arm64/util/sym-handling.c b/tools/perf/arch/arm64/util/sym-handling.c +index 5df788985130..8dfa3e5229f1 100644 +--- a/tools/perf/arch/arm64/util/sym-handling.c ++++ b/tools/perf/arch/arm64/util/sym-handling.c +@@ -6,9 +6,10 @@ + + #include "symbol.h" // for the elf__needs_adjust_symbols() prototype + #include +-#include + + #ifdef HAVE_LIBELF_SUPPORT ++#include ++ + bool elf__needs_adjust_symbols(GElf_Ehdr ehdr) + { + return ehdr.e_type == ET_EXEC || +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index aae0e57c60fb..7accaf8ef689 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -399,6 +399,13 @@ static int report__setup_sample_type(struct report *rep) + PERF_SAMPLE_BRANCH_ANY)) + rep->nonany_branch_mode = true; + ++#ifndef HAVE_LIBUNWIND_SUPPORT ++ if (dwarf_callchain_users) { ++ ui__warning("Please install libunwind development packages " ++ "during the perf build.\n"); ++ } ++#endif ++ + return 0; + } + +diff --git a/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json +index 0d1556fcdffe..99f4fc425564 100644 +--- a/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json ++++ b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json +@@ -15,7 +15,7 @@ + }, + { + "EventCode": "0x04", +- "EventName": "uncore_hisi_ddrc.flux_wr", ++ "EventName": "uncore_hisi_ddrc.pre_cmd", + "BriefDescription": "DDRC precharge commands", + "PublicDescription": "DDRC precharge commands", + "Unit": "hisi_sccl,ddrc", +diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c +index e2837260ca4d..99e3fd04a5cb 100644 +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -758,6 +758,7 @@ static int process_mapfile(FILE *outfp, char *fpath) + char *line, *p; + int line_num; + char *tblname; ++ int ret = 0; + + pr_info("%s: Processing mapfile %s\n", prog, fpath); + +@@ -769,6 +770,7 @@ static int process_mapfile(FILE *outfp, char *fpath) + if (!mapfp) { + pr_info("%s: Error %s opening %s\n", prog, strerror(errno), + fpath); ++ free(line); + return -1; + } + +@@ -795,7 +797,8 @@ static int process_mapfile(FILE *outfp, char *fpath) + /* TODO Deal with lines longer than 16K */ + pr_info("%s: Mapfile %s: line %d too long, aborting\n", + prog, fpath, line_num); +- return -1; ++ ret = -1; ++ goto out; + } + line[strlen(line)-1] = '\0'; + +@@ -825,7 +828,9 @@ static int process_mapfile(FILE *outfp, char *fpath) + + out: + print_mapping_table_suffix(outfp); +- return 0; ++ fclose(mapfp); ++ free(line); ++ return ret; + } + + /* +@@ -1122,6 +1127,7 @@ int main(int argc, char *argv[]) + goto empty_map; + } else if (rc < 0) { + /* Make build fail */ ++ fclose(eventsfp); + free_arch_std_events(); + return 1; + } else if (rc) { +@@ -1134,6 +1140,7 @@ int main(int argc, char *argv[]) + goto empty_map; + } else if (rc < 0) { + /* Make build fail */ ++ fclose(eventsfp); + free_arch_std_events(); + return 1; + } else if (rc) { +@@ -1151,6 +1158,8 @@ int main(int argc, char *argv[]) + if (process_mapfile(eventsfp, mapfile)) { + pr_info("%s: Error processing mapfile %s\n", prog, mapfile); + /* Make build fail */ ++ fclose(eventsfp); ++ free_arch_std_events(); + return 1; + } + +diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c +index c1c2c13de254..166f411568a5 100644 +--- a/tools/perf/tests/bp_signal.c ++++ b/tools/perf/tests/bp_signal.c +@@ -49,14 +49,6 @@ asm ( + "__test_function:\n" + "incq (%rdi)\n" + "ret\n"); +-#elif defined (__aarch64__) +-extern void __test_function(volatile long *ptr); +-asm ( +- ".globl __test_function\n" +- "__test_function:\n" +- "str x30, [x0]\n" +- "ret\n"); +- + #else + static void __test_function(volatile long *ptr) + { +@@ -302,10 +294,15 @@ bool test__bp_signal_is_supported(void) + * stepping into the SIGIO handler and getting stuck on the + * breakpointed instruction. + * ++ * Since arm64 has the same issue with arm for the single-step ++ * handling, this case also gets suck on the breakpointed ++ * instruction. ++ * + * Just disable the test for these architectures until these + * issues are resolved. + */ +-#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__) ++#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__) || \ ++ defined(__aarch64__) + return false; + #else + return true; +diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c +index bce3a4cb4c89..d85c9f608564 100644 +--- a/tools/perf/tests/task-exit.c ++++ b/tools/perf/tests/task-exit.c +@@ -53,6 +53,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused + struct perf_cpu_map *cpus; + struct perf_thread_map *threads; + struct mmap *md; ++ int retry_count = 0; + + signal(SIGCHLD, sig_handler); + +@@ -110,6 +111,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused + if (evlist__mmap(evlist, 128) < 0) { + pr_debug("failed to mmap events: %d (%s)\n", errno, + str_error_r(errno, sbuf, sizeof(sbuf))); ++ err = -1; + goto out_delete_evlist; + } + +@@ -131,6 +133,13 @@ retry: + out_init: + if (!exited || !nr_exit) { + evlist__poll(evlist, -1); ++ ++ if (retry_count++ > 1000) { ++ pr_debug("Failed after retrying 1000 times\n"); ++ err = -1; ++ goto out_free_maps; ++ } ++ + goto retry; + } + +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index 4ba0f871f086..f5f855fff412 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -110,7 +110,7 @@ static int cs_etm__decode_data_block(struct cs_etm_queue *etmq); + * encode the etm queue number as the upper 16 bit and the channel as + * the lower 16 bit. + */ +-#define TO_CS_QUEUE_NR(queue_nr, trace_id_chan) \ ++#define TO_CS_QUEUE_NR(queue_nr, trace_chan_id) \ + (queue_nr << 16 | trace_chan_id) + #define TO_QUEUE_NR(cs_queue_nr) (cs_queue_nr >> 16) + #define TO_TRACE_CHAN_ID(cs_queue_nr) (cs_queue_nr & 0x0000ffff) +@@ -819,7 +819,7 @@ static int cs_etm__setup_queue(struct cs_etm_auxtrace *etm, + * Note that packets decoded above are still in the traceID's packet + * queue and will be processed in cs_etm__process_queues(). + */ +- cs_queue_nr = TO_CS_QUEUE_NR(queue_nr, trace_id_chan); ++ cs_queue_nr = TO_CS_QUEUE_NR(queue_nr, trace_chan_id); + ret = auxtrace_heap__add(&etm->heap, cs_queue_nr, timestamp); + out: + return ret; +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index df6cee5c071f..5544bfbd0f6c 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -307,21 +307,51 @@ bool die_is_func_def(Dwarf_Die *dw_die) + dwarf_attr(dw_die, DW_AT_declaration, &attr) == NULL); + } + ++/** ++ * die_entrypc - Returns entry PC (the lowest address) of a DIE ++ * @dw_die: a DIE ++ * @addr: where to store entry PC ++ * ++ * Since dwarf_entrypc() does not return entry PC if the DIE has only address ++ * range, we have to use this to retrieve the lowest address from the address ++ * range attribute. ++ */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) ++{ ++ Dwarf_Addr base, end; ++ ++ if (!addr) ++ return -EINVAL; ++ ++ if (dwarf_entrypc(dw_die, addr) == 0) ++ return 0; ++ ++ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; ++} ++ + /** + * die_is_func_instance - Ensure that this DIE is an instance of a subprogram + * @dw_die: a DIE + * + * Ensure that this DIE is an instance (which has an entry address). +- * This returns true if @dw_die is a function instance. If not, you need to +- * call die_walk_instances() to find actual instances. ++ * This returns true if @dw_die is a function instance. If not, the @dw_die ++ * must be a prototype. You can use die_walk_instances() to find actual ++ * instances. + **/ + bool die_is_func_instance(Dwarf_Die *dw_die) + { + Dwarf_Addr tmp; ++ Dwarf_Attribute attr_mem; ++ int tag = dwarf_tag(dw_die); + +- /* Actually gcc optimizes non-inline as like as inlined */ +- return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0; ++ if (tag != DW_TAG_subprogram && ++ tag != DW_TAG_inlined_subroutine) ++ return false; ++ ++ return dwarf_entrypc(dw_die, &tmp) == 0 || ++ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL; + } ++ + /** + * die_get_data_member_location - Get the data-member offset + * @mb_die: a DIE of a member of a data structure +@@ -598,6 +628,9 @@ static int __die_walk_instances_cb(Dwarf_Die *inst, void *data) + Dwarf_Die *origin; + int tmp; + ++ if (!die_is_func_instance(inst)) ++ return DIE_FIND_CB_CONTINUE; ++ + attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem); + if (attr == NULL) + return DIE_FIND_CB_CONTINUE; +@@ -669,15 +702,14 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data) + if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) { + fname = die_get_call_file(in_die); + lineno = die_get_call_lineno(in_die); +- if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) { ++ if (fname && lineno > 0 && die_entrypc(in_die, &addr) == 0) { + lw->retval = lw->callback(fname, lineno, addr, lw->data); + if (lw->retval != 0) + return DIE_FIND_CB_END; + } ++ if (!lw->recursive) ++ return DIE_FIND_CB_SIBLING; + } +- if (!lw->recursive) +- /* Don't need to search recursively */ +- return DIE_FIND_CB_SIBLING; + + if (addr) { + fname = dwarf_decl_file(in_die); +@@ -710,7 +742,7 @@ static int __die_walk_funclines(Dwarf_Die *sp_die, bool recursive, + /* Handle function declaration line */ + fname = dwarf_decl_file(sp_die); + if (fname && dwarf_decl_line(sp_die, &lineno) == 0 && +- dwarf_entrypc(sp_die, &addr) == 0) { ++ die_entrypc(sp_die, &addr) == 0) { + lw.retval = callback(fname, lineno, addr, data); + if (lw.retval != 0) + goto done; +@@ -724,6 +756,10 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data) + { + struct __line_walk_param *lw = data; + ++ /* ++ * Since inlined function can include another inlined function in ++ * the same file, we need to walk in it recursively. ++ */ + lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data); + if (lw->retval != 0) + return DWARF_CB_ABORT; +@@ -748,11 +784,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + Dwarf_Lines *lines; + Dwarf_Line *line; + Dwarf_Addr addr; +- const char *fname, *decf = NULL; ++ const char *fname, *decf = NULL, *inf = NULL; + int lineno, ret = 0; + int decl = 0, inl; + Dwarf_Die die_mem, *cu_die; + size_t nlines, i; ++ bool flag; + + /* Get the CU die */ + if (dwarf_tag(rt_die) != DW_TAG_compile_unit) { +@@ -783,6 +820,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + "Possible error in debuginfo.\n"); + continue; + } ++ /* Skip end-of-sequence */ ++ if (dwarf_lineendsequence(line, &flag) != 0 || flag) ++ continue; ++ /* Skip Non statement line-info */ ++ if (dwarf_linebeginstatement(line, &flag) != 0 || !flag) ++ continue; + /* Filter lines based on address */ + if (rt_die != cu_die) { + /* +@@ -792,13 +835,21 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (!dwarf_haspc(rt_die, addr)) + continue; ++ + if (die_find_inlinefunc(rt_die, addr, &die_mem)) { ++ /* Call-site check */ ++ inf = die_get_call_file(&die_mem); ++ if ((inf && !strcmp(inf, decf)) && ++ die_get_call_lineno(&die_mem) == lineno) ++ goto found; ++ + dwarf_decl_line(&die_mem, &inl); + if (inl != decl || + decf != dwarf_decl_file(&die_mem)) + continue; + } + } ++found: + /* Get source line */ + fname = dwarf_linesrc(line, NULL, NULL); + +@@ -813,8 +864,9 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (rt_die != cu_die) + /* +- * Don't need walk functions recursively, because nested +- * inlined functions don't have lines of the specified DIE. ++ * Don't need walk inlined functions recursively, because ++ * inner inlined functions don't have the lines of the ++ * specified function. + */ + ret = __die_walk_funclines(rt_die, false, callback, data); + else { +@@ -989,7 +1041,7 @@ static int die_get_var_innermost_scope(Dwarf_Die *sp_die, Dwarf_Die *vr_die, + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +@@ -1052,7 +1104,7 @@ int die_get_var_range(Dwarf_Die *sp_die, Dwarf_Die *vr_die, struct strbuf *buf) + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h +index f204e5892403..506006e0cf66 100644 +--- a/tools/perf/util/dwarf-aux.h ++++ b/tools/perf/util/dwarf-aux.h +@@ -29,6 +29,9 @@ int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr, + /* Get DW_AT_linkage_name (should be NULL for C binary) */ + const char *die_get_linkage_name(Dwarf_Die *dw_die); + ++/* Get the lowest PC in DIE (including range list) */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr); ++ + /* Ensure that this DIE is a subprogram and definition (not declaration) */ + bool die_is_func_def(Dwarf_Die *dw_die); + +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index b5e2adef49de..422ad1888e74 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -1365,8 +1365,15 @@ int parse_events_add_pmu(struct parse_events_state *parse_state, + if (get_config_terms(head_config, &config_terms)) + return -ENOMEM; + +- if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) ++ if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) { ++ struct perf_evsel_config_term *pos, *tmp; ++ ++ list_for_each_entry_safe(pos, tmp, &config_terms, list) { ++ list_del_init(&pos->list); ++ free(pos); ++ } + return -EINVAL; ++ } + + evsel = __add_event(list, &parse_state->idx, &attr, + get_config_name(head_config), pmu, +@@ -1927,15 +1934,20 @@ int parse_events(struct evlist *evlist, const char *str, + + ret = parse_events__scanner(str, &parse_state, PE_START_EVENTS); + perf_pmu__parse_cleanup(); ++ ++ if (!ret && list_empty(&parse_state.list)) { ++ WARN_ONCE(true, "WARNING: event parser found nothing\n"); ++ return -1; ++ } ++ ++ /* ++ * Add list to the evlist even with errors to allow callers to clean up. ++ */ ++ perf_evlist__splice_list_tail(evlist, &parse_state.list); ++ + if (!ret) { + struct evsel *last; + +- if (list_empty(&parse_state.list)) { +- WARN_ONCE(true, "WARNING: event parser found nothing\n"); +- return -1; +- } +- +- perf_evlist__splice_list_tail(evlist, &parse_state.list); + evlist->nr_groups += parse_state.nr_groups; + last = evlist__last(evlist); + last->cmdline_group_boundary = true; +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index cd9f95e5044e..08cccd86447c 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -756,6 +756,16 @@ static int find_best_scope_cb(Dwarf_Die *fn_die, void *data) + return 0; + } + ++/* Return innermost DIE */ ++static int find_inner_scope_cb(Dwarf_Die *fn_die, void *data) ++{ ++ struct find_scope_param *fsp = data; ++ ++ memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die)); ++ fsp->found = true; ++ return 1; ++} ++ + /* Find an appropriate scope fits to given conditions */ + static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + { +@@ -767,8 +777,13 @@ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + .die_mem = die_mem, + .found = false, + }; ++ int ret; + +- cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp); ++ ret = cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, ++ &fsp); ++ if (!ret && !fsp.found) ++ cu_walk_functions_at(&pf->cu_die, pf->addr, ++ find_inner_scope_cb, &fsp); + + return fsp.found ? die_mem : NULL; + } +@@ -942,7 +957,7 @@ static int probe_point_inline_cb(Dwarf_Die *in_die, void *data) + ret = find_probe_point_lazy(in_die, pf); + else { + /* Get probe address */ +- if (dwarf_entrypc(in_die, &addr) != 0) { ++ if (die_entrypc(in_die, &addr) != 0) { + pr_warning("Failed to get entry address of %s.\n", + dwarf_diename(in_die)); + return -ENOENT; +@@ -994,7 +1009,7 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data) + param->retval = find_probe_point_by_line(pf); + } else if (die_is_func_instance(sp_die)) { + /* Instances always have the entry address */ +- dwarf_entrypc(sp_die, &pf->addr); ++ die_entrypc(sp_die, &pf->addr); + /* But in some case the entry address is 0 */ + if (pf->addr == 0) { + pr_debug("%s has no entry PC. Skipped\n", +@@ -1425,6 +1440,18 @@ error: + return DIE_FIND_CB_END; + } + ++static bool available_var_finder_overlap(struct available_var_finder *af) ++{ ++ int i; ++ ++ for (i = 0; i < af->nvls; i++) { ++ if (af->pf.addr == af->vls[i].point.address) ++ return true; ++ } ++ return false; ++ ++} ++ + /* Add a found vars into available variables list */ + static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + { +@@ -1435,6 +1462,14 @@ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + Dwarf_Die die_mem; + int ret; + ++ /* ++ * For some reason (e.g. different column assigned to same address), ++ * this callback can be called with the address which already passed. ++ * Ignore it first. ++ */ ++ if (available_var_finder_overlap(af)) ++ return 0; ++ + /* Check number of tevs */ + if (af->nvls == af->max_vls) { + pr_warning("Too many( > %d) probe point found.\n", af->max_vls); +@@ -1578,7 +1613,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + /* Get function entry information */ + func = basefunc = dwarf_diename(&spdie); + if (!func || +- dwarf_entrypc(&spdie, &baseaddr) != 0 || ++ die_entrypc(&spdie, &baseaddr) != 0 || + dwarf_decl_line(&spdie, &baseline) != 0) { + lineno = 0; + goto post; +@@ -1595,7 +1630,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr, + &indie)) { + /* There is an inline function */ +- if (dwarf_entrypc(&indie, &_addr) == 0 && ++ if (die_entrypc(&indie, &_addr) == 0 && + _addr == addr) { + /* + * addr is at an inline function entry. +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 061bb4d6a3f5..5c172845fa5a 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1954,8 +1954,8 @@ out_err: + } + + static union perf_event * +-fetch_mmaped_event(struct perf_session *session, +- u64 head, size_t mmap_size, char *buf) ++prefetch_event(char *buf, u64 head, size_t mmap_size, ++ bool needs_swap, union perf_event *error) + { + union perf_event *event; + +@@ -1967,20 +1967,32 @@ fetch_mmaped_event(struct perf_session *session, + return NULL; + + event = (union perf_event *)(buf + head); ++ if (needs_swap) ++ perf_event_header__bswap(&event->header); + +- if (session->header.needs_swap) ++ if (head + event->header.size <= mmap_size) ++ return event; ++ ++ /* We're not fetching the event so swap back again */ ++ if (needs_swap) + perf_event_header__bswap(&event->header); + +- if (head + event->header.size > mmap_size) { +- /* We're not fetching the event so swap back again */ +- if (session->header.needs_swap) +- perf_event_header__bswap(&event->header); +- pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx: fuzzed perf.data?\n", +- __func__, head, event->header.size, mmap_size); +- return ERR_PTR(-EINVAL); +- } ++ pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx:" ++ " fuzzed or compressed perf.data?\n",__func__, head, event->header.size, mmap_size); + +- return event; ++ return error; ++} ++ ++static union perf_event * ++fetch_mmaped_event(u64 head, size_t mmap_size, char *buf, bool needs_swap) ++{ ++ return prefetch_event(buf, head, mmap_size, needs_swap, ERR_PTR(-EINVAL)); ++} ++ ++static union perf_event * ++fetch_decomp_event(u64 head, size_t mmap_size, char *buf, bool needs_swap) ++{ ++ return prefetch_event(buf, head, mmap_size, needs_swap, NULL); + } + + static int __perf_session__process_decomp_events(struct perf_session *session) +@@ -1993,10 +2005,8 @@ static int __perf_session__process_decomp_events(struct perf_session *session) + return 0; + + while (decomp->head < decomp->size && !session_done()) { +- union perf_event *event = fetch_mmaped_event(session, decomp->head, decomp->size, decomp->data); +- +- if (IS_ERR(event)) +- return PTR_ERR(event); ++ union perf_event *event = fetch_decomp_event(decomp->head, decomp->size, decomp->data, ++ session->header.needs_swap); + + if (!event) + break; +@@ -2096,7 +2106,7 @@ remap: + } + + more: +- event = fetch_mmaped_event(session, head, mmap_size, buf); ++ event = fetch_mmaped_event(head, mmap_size, buf, session->header.needs_swap); + if (IS_ERR(event)) + return PTR_ERR(event); + +diff --git a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +index 7c7451d3f494..58dbdfd4fa13 100644 +--- a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c ++++ b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +@@ -39,7 +39,6 @@ static cstate_t hsw_ext_cstates[HSW_EXT_CSTATE_COUNT] = { + { + .name = "PC9", + .desc = N_("Processor Package C9"), +- .desc = N_("Processor Package C2"), + .id = PC9, + .range = RANGE_PACKAGE, + .get_count_percent = hsw_ext_get_count_percent, +diff --git a/tools/testing/selftests/bpf/cgroup_helpers.c b/tools/testing/selftests/bpf/cgroup_helpers.c +index e95c33e333a4..b29a73fe64db 100644 +--- a/tools/testing/selftests/bpf/cgroup_helpers.c ++++ b/tools/testing/selftests/bpf/cgroup_helpers.c +@@ -98,7 +98,7 @@ int enable_all_controllers(char *cgroup_path) + */ + int setup_cgroup_environment(void) + { +- char cgroup_workdir[PATH_MAX + 1]; ++ char cgroup_workdir[PATH_MAX - 24]; + + format_cgroup_path(cgroup_workdir, ""); + +diff --git a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c +index 3a62119c7498..35c512818a56 100644 +--- a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c ++++ b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c +@@ -62,6 +62,10 @@ struct padded_a_lot { + * long: 64; + * long: 64; + * int b; ++ * long: 32; ++ * long: 64; ++ * long: 64; ++ * long: 64; + *}; + * + */ +@@ -95,7 +99,6 @@ struct zone_padding { + struct zone { + int a; + short b; +- short: 16; + struct zone_padding __pad__; + }; + +diff --git a/tools/testing/selftests/bpf/progs/test_seg6_loop.c b/tools/testing/selftests/bpf/progs/test_seg6_loop.c +index c4d104428643..69880c1e7700 100644 +--- a/tools/testing/selftests/bpf/progs/test_seg6_loop.c ++++ b/tools/testing/selftests/bpf/progs/test_seg6_loop.c +@@ -132,8 +132,10 @@ static __always_inline int is_valid_tlv_boundary(struct __sk_buff *skb, + *pad_off = 0; + + // we can only go as far as ~10 TLVs due to the BPF max stack size ++ // workaround: define induction variable "i" as "long" instead ++ // of "int" to prevent alu32 sub-register spilling. + #pragma clang loop unroll(disable) +- for (int i = 0; i < 100; i++) { ++ for (long i = 0; i < 100; i++) { + struct sr6_tlv_t tlv; + + if (cur_off == *tlv_off) +diff --git a/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c b/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c +index 608a06871572..d22e438198cf 100644 +--- a/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c ++++ b/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c +@@ -44,7 +44,10 @@ int sysctl_tcp_mem(struct bpf_sysctl *ctx) + unsigned long tcp_mem[TCP_MEM_LOOPS] = {}; + char value[MAX_VALUE_STR_LEN]; + unsigned char i, off = 0; +- int ret; ++ /* a workaround to prevent compiler from generating ++ * codes verifier cannot handle yet. ++ */ ++ volatile int ret; + + if (ctx->write) + return 0; +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index af75a1c7a458..3bf18364c67c 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -20,7 +20,7 @@ struct prog_test_def { + bool tested; + bool need_cgroup_cleanup; + +- const char *subtest_name; ++ char *subtest_name; + int subtest_num; + + /* store counts before subtest started */ +@@ -81,16 +81,17 @@ void test__end_subtest() + fprintf(env.stdout, "#%d/%d %s:%s\n", + test->test_num, test->subtest_num, + test->subtest_name, sub_error_cnt ? "FAIL" : "OK"); ++ ++ free(test->subtest_name); ++ test->subtest_name = NULL; + } + + bool test__start_subtest(const char *name) + { + struct prog_test_def *test = env.test; + +- if (test->subtest_name) { ++ if (test->subtest_name) + test__end_subtest(); +- test->subtest_name = NULL; +- } + + test->subtest_num++; + +@@ -104,7 +105,13 @@ bool test__start_subtest(const char *name) + if (!should_run(&env.subtest_selector, test->subtest_num, name)) + return false; + +- test->subtest_name = name; ++ test->subtest_name = strdup(name); ++ if (!test->subtest_name) { ++ fprintf(env.stderr, ++ "Subtest #%d: failed to copy subtest name!\n", ++ test->subtest_num); ++ return false; ++ } + env.test->old_error_cnt = env.test->error_cnt; + + return true; +diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh +index ff0d31d38061..7c76b841b17b 100755 +--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh ++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh +@@ -62,6 +62,10 @@ cleanup() { + if [[ -f "${infile}" ]]; then + rm "${infile}" + fi ++ ++ if [[ -n $server_pid ]]; then ++ kill $server_pid 2> /dev/null ++ fi + } + + server_listen() { +@@ -77,6 +81,7 @@ client_connect() { + + verify_data() { + wait "${server_pid}" ++ server_pid= + # sha1sum returns two fields [sha1] [filepath] + # convert to bash array and access first elem + insum=($(sha1sum ${infile})) +diff --git a/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh b/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh +index fef88eb4b873..fa6a88c50750 100755 +--- a/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh ++++ b/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh +@@ -36,7 +36,7 @@ h2_destroy() + { + ip -6 route del 2001:db8:1::/64 vrf v$h2 + ip -4 route del 192.0.2.0/28 vrf v$h2 +- simple_if_fini $h2 192.0.2.130/28 ++ simple_if_fini $h2 192.0.2.130/28 2001:db8:2::2/64 + } + + router_create() +diff --git a/tools/testing/selftests/net/so_txtime.c b/tools/testing/selftests/net/so_txtime.c +index 53f598f06647..34df4c8882af 100644 +--- a/tools/testing/selftests/net/so_txtime.c ++++ b/tools/testing/selftests/net/so_txtime.c +@@ -105,8 +105,8 @@ static void do_recv_one(int fdr, struct timed_send *ts) + tstop = (gettime_ns() - glob_tstart) / 1000; + texpect = ts->delay_us >= 0 ? ts->delay_us : 0; + +- fprintf(stderr, "payload:%c delay:%ld expected:%ld (us)\n", +- rbuf[0], tstop, texpect); ++ fprintf(stderr, "payload:%c delay:%lld expected:%lld (us)\n", ++ rbuf[0], (long long)tstop, (long long)texpect); + + if (rbuf[0] != ts->data) + error(1, 0, "payload mismatch. expected %c", ts->data); +diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c +index 13e5ef615026..0ea44d975b6c 100644 +--- a/tools/testing/selftests/net/tls.c ++++ b/tools/testing/selftests/net/tls.c +@@ -722,34 +722,6 @@ TEST_F(tls, recv_lowat) + EXPECT_EQ(memcmp(send_mem, recv_mem + 10, 5), 0); + } + +-TEST_F(tls, recv_rcvbuf) +-{ +- char send_mem[4096]; +- char recv_mem[4096]; +- int rcv_buf = 1024; +- +- memset(send_mem, 0x1c, sizeof(send_mem)); +- +- EXPECT_EQ(setsockopt(self->cfd, SOL_SOCKET, SO_RCVBUF, +- &rcv_buf, sizeof(rcv_buf)), 0); +- +- EXPECT_EQ(send(self->fd, send_mem, 512, 0), 512); +- memset(recv_mem, 0, sizeof(recv_mem)); +- EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), 512); +- EXPECT_EQ(memcmp(send_mem, recv_mem, 512), 0); +- +- if (self->notls) +- return; +- +- EXPECT_EQ(send(self->fd, send_mem, 4096, 0), 4096); +- memset(recv_mem, 0, sizeof(recv_mem)); +- EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), -1); +- EXPECT_EQ(errno, EMSGSIZE); +- +- EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), -1); +- EXPECT_EQ(errno, EMSGSIZE); +-} +- + TEST_F(tls, bidir) + { + char const *test_str = "test_read"; +diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c +index 614b31aad168..c66da6ffd6d8 100644 +--- a/tools/testing/selftests/net/udpgso.c ++++ b/tools/testing/selftests/net/udpgso.c +@@ -440,7 +440,8 @@ static bool __send_one(int fd, struct msghdr *msg, int flags) + if (ret == -1) + error(1, errno, "sendmsg"); + if (ret != msg->msg_iov->iov_len) +- error(1, 0, "sendto: %d != %lu", ret, msg->msg_iov->iov_len); ++ error(1, 0, "sendto: %d != %llu", ret, ++ (unsigned long long)msg->msg_iov->iov_len); + if (msg->msg_flags) + error(1, 0, "sendmsg: return flags 0x%x\n", msg->msg_flags); + +diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c +index ada99496634a..17512a43885e 100644 +--- a/tools/testing/selftests/net/udpgso_bench_tx.c ++++ b/tools/testing/selftests/net/udpgso_bench_tx.c +@@ -405,7 +405,8 @@ static int send_udp_segment(int fd, char *data) + if (ret == -1) + error(1, errno, "sendmsg"); + if (ret != iov.iov_len) +- error(1, 0, "sendmsg: %u != %lu\n", ret, iov.iov_len); ++ error(1, 0, "sendmsg: %u != %llu\n", ret, ++ (unsigned long long)iov.iov_len); + + return 1; + } +diff --git a/tools/testing/selftests/proc/proc-self-map-files-002.c b/tools/testing/selftests/proc/proc-self-map-files-002.c +index 47b7473dedef..e6aa00a183bc 100644 +--- a/tools/testing/selftests/proc/proc-self-map-files-002.c ++++ b/tools/testing/selftests/proc/proc-self-map-files-002.c +@@ -47,7 +47,11 @@ static void fail(const char *fmt, unsigned long a, unsigned long b) + int main(void) + { + const int PAGE_SIZE = sysconf(_SC_PAGESIZE); +- const unsigned long va_max = 1UL << 32; ++ /* ++ * va_max must be enough bigger than vm.mmap_min_addr, which is ++ * 64KB/32KB by default. (depends on CONFIG_LSM_MMAP_MIN_ADDR) ++ */ ++ const unsigned long va_max = 1UL << 20; + unsigned long va; + void *p; + int fd; +diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c +index 38b4c910b6c3..f23c9cd5684f 100644 +--- a/virt/kvm/arm/mmu.c ++++ b/virt/kvm/arm/mmu.c +@@ -38,6 +38,11 @@ static unsigned long io_map_base; + #define KVM_S2PTE_FLAG_IS_IOMAP (1UL << 0) + #define KVM_S2_FLAG_LOGGING_ACTIVE (1UL << 1) + ++static bool is_iomap(unsigned long flags) ++{ ++ return flags & KVM_S2PTE_FLAG_IS_IOMAP; ++} ++ + static bool memslot_is_logging(struct kvm_memory_slot *memslot) + { + return memslot->dirty_bitmap && !(memslot->flags & KVM_MEM_READONLY); +@@ -1698,6 +1703,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + + vma_pagesize = vma_kernel_pagesize(vma); + if (logging_active || ++ (vma->vm_flags & VM_PFNMAP) || + !fault_supports_stage2_huge_mapping(memslot, hva, vma_pagesize)) { + force_pte = true; + vma_pagesize = PAGE_SIZE; +@@ -1760,6 +1766,9 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + writable = false; + } + ++ if (exec_fault && is_iomap(flags)) ++ return -ENOEXEC; ++ + spin_lock(&kvm->mmu_lock); + if (mmu_notifier_retry(kvm, mmu_seq)) + goto out_unlock; +@@ -1781,7 +1790,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + if (writable) + kvm_set_pfn_dirty(pfn); + +- if (fault_status != FSC_PERM) ++ if (fault_status != FSC_PERM && !is_iomap(flags)) + clean_dcache_guest_page(pfn, vma_pagesize); + + if (exec_fault) +@@ -1948,9 +1957,8 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run) + if (kvm_is_error_hva(hva) || (write_fault && !writable)) { + if (is_iabt) { + /* Prefetch Abort on I/O address */ +- kvm_inject_pabt(vcpu, kvm_vcpu_get_hfar(vcpu)); +- ret = 1; +- goto out_unlock; ++ ret = -ENOEXEC; ++ goto out; + } + + /* +@@ -1992,6 +2000,11 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run) + ret = user_mem_abort(vcpu, fault_ipa, memslot, hva, fault_status); + if (ret == 0) + ret = 1; ++out: ++ if (ret == -ENOEXEC) { ++ kvm_inject_pabt(vcpu, kvm_vcpu_get_hfar(vcpu)); ++ ret = 1; ++ } + out_unlock: + srcu_read_unlock(&vcpu->kvm->srcu, idx); + return ret; diff --git a/patch/kernel/meson64-current/02-patch-5.4.7-8.patch b/patch/kernel/meson64-current/02-patch-5.4.7-8.patch new file mode 100644 index 0000000000..80c6bbc371 --- /dev/null +++ b/patch/kernel/meson64-current/02-patch-5.4.7-8.patch @@ -0,0 +1,7703 @@ +diff --git a/Documentation/devicetree/bindings/Makefile b/Documentation/devicetree/bindings/Makefile +index 5138a2f6232a..646cb3525373 100644 +--- a/Documentation/devicetree/bindings/Makefile ++++ b/Documentation/devicetree/bindings/Makefile +@@ -12,7 +12,6 @@ $(obj)/%.example.dts: $(src)/%.yaml FORCE + $(call if_changed,chk_binding) + + DT_TMP_SCHEMA := processed-schema.yaml +-extra-y += $(DT_TMP_SCHEMA) + + quiet_cmd_mk_schema = SCHEMA $@ + cmd_mk_schema = $(DT_MK_SCHEMA) $(DT_MK_SCHEMA_FLAGS) -o $@ $(real-prereqs) +@@ -26,8 +25,12 @@ DT_DOCS = $(shell \ + + DT_SCHEMA_FILES ?= $(addprefix $(src)/,$(DT_DOCS)) + ++ifeq ($(CHECK_DTBS),) + extra-y += $(patsubst $(src)/%.yaml,%.example.dts, $(DT_SCHEMA_FILES)) + extra-y += $(patsubst $(src)/%.yaml,%.example.dt.yaml, $(DT_SCHEMA_FILES)) ++endif + + $(obj)/$(DT_TMP_SCHEMA): $(DT_SCHEMA_FILES) FORCE + $(call if_changed,mk_schema) ++ ++extra-y += $(DT_TMP_SCHEMA) +diff --git a/Documentation/devicetree/writing-schema.rst b/Documentation/devicetree/writing-schema.rst +index f4a638072262..83e04e5c342d 100644 +--- a/Documentation/devicetree/writing-schema.rst ++++ b/Documentation/devicetree/writing-schema.rst +@@ -130,11 +130,13 @@ binding schema. All of the DT binding documents can be validated using the + + make dt_binding_check + +-In order to perform validation of DT source files, use the `dtbs_check` target:: ++In order to perform validation of DT source files, use the ``dtbs_check`` target:: + + make dtbs_check + +-This will first run the `dt_binding_check` which generates the processed schema. ++Note that ``dtbs_check`` will skip any binding schema files with errors. It is ++necessary to use ``dt_binding_check`` to get all the validation errors in the ++binding schema files. + + It is also possible to run checks with a single schema file by setting the + ``DT_SCHEMA_FILES`` variable to a specific schema file. +diff --git a/Makefile b/Makefile +index 0e2e0a034064..1adee1b06f3d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 7 ++SUBLEVEL = 8 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h +index b36c0289a308..6a0f1f524466 100644 +--- a/arch/arm/boot/compressed/libfdt_env.h ++++ b/arch/arm/boot/compressed/libfdt_env.h +@@ -2,11 +2,13 @@ + #ifndef _ARM_LIBFDT_ENV_H + #define _ARM_LIBFDT_ENV_H + ++#include + #include + #include + #include + +-#define INT_MAX ((int)(~0U>>1)) ++#define INT32_MAX S32_MAX ++#define UINT32_MAX U32_MAX + + typedef __be16 fdt16_t; + typedef __be32 fdt32_t; +diff --git a/arch/arm/mm/dma-mapping-nommu.c b/arch/arm/mm/dma-mapping-nommu.c +index db9247898300..287ef898a55e 100644 +--- a/arch/arm/mm/dma-mapping-nommu.c ++++ b/arch/arm/mm/dma-mapping-nommu.c +@@ -35,7 +35,7 @@ static void *arm_nommu_dma_alloc(struct device *dev, size_t size, + unsigned long attrs) + + { +- void *ret = dma_alloc_from_global_coherent(size, dma_handle); ++ void *ret = dma_alloc_from_global_coherent(dev, size, dma_handle); + + /* + * dma_alloc_from_global_coherent() may fail because: +diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c +index 9a07916af8dd..a6554fdb56c5 100644 +--- a/arch/arm/mm/proc-v7-bugs.c ++++ b/arch/arm/mm/proc-v7-bugs.c +@@ -65,6 +65,9 @@ static void cpu_v7_spectre_init(void) + break; + + #ifdef CONFIG_ARM_PSCI ++ case ARM_CPU_PART_BRAHMA_B53: ++ /* Requires no workaround */ ++ break; + default: + /* Other ARM CPUs require no workaround */ + if (read_cpuid_implementor() == ARM_CPU_IMP_ARM) +diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h +index fb842965d541..9228f7386220 100644 +--- a/arch/mips/include/asm/barrier.h ++++ b/arch/mips/include/asm/barrier.h +@@ -218,14 +218,13 @@ + * ordering will be done by smp_llsc_mb() and friends. + */ + #if defined(CONFIG_WEAK_REORDERING_BEYOND_LLSC) && defined(CONFIG_SMP) +-# define __WEAK_LLSC_MB sync +-# define smp_llsc_mb() \ +- __asm__ __volatile__(__stringify(__WEAK_LLSC_MB) : : :"memory") +-# define __LLSC_CLOBBER ++#define __WEAK_LLSC_MB " sync \n" ++#define smp_llsc_mb() __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory") ++#define __LLSC_CLOBBER + #else +-# define __WEAK_LLSC_MB +-# define smp_llsc_mb() do { } while (0) +-# define __LLSC_CLOBBER "memory" ++#define __WEAK_LLSC_MB " \n" ++#define smp_llsc_mb() do { } while (0) ++#define __LLSC_CLOBBER "memory" + #endif + + #ifdef CONFIG_CPU_CAVIUM_OCTEON +diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h +index 110220705e97..b83b0397462d 100644 +--- a/arch/mips/include/asm/futex.h ++++ b/arch/mips/include/asm/futex.h +@@ -16,7 +16,6 @@ + #include + #include + #include +-#include + #include + + #define __futex_atomic_op(insn, ret, oldval, uaddr, oparg) \ +@@ -33,7 +32,7 @@ + " .set arch=r4000 \n" \ + "2: sc $1, %2 \n" \ + " beqzl $1, 1b \n" \ +- __stringify(__WEAK_LLSC_MB) " \n" \ ++ __WEAK_LLSC_MB \ + "3: \n" \ + " .insn \n" \ + " .set pop \n" \ +@@ -51,19 +50,19 @@ + "i" (-EFAULT) \ + : "memory"); \ + } else if (cpu_has_llsc) { \ ++ loongson_llsc_mb(); \ + __asm__ __volatile__( \ + " .set push \n" \ + " .set noat \n" \ + " .set push \n" \ + " .set "MIPS_ISA_ARCH_LEVEL" \n" \ +- " " __SYNC(full, loongson3_war) " \n" \ + "1: "user_ll("%1", "%4")" # __futex_atomic_op\n" \ + " .set pop \n" \ + " " insn " \n" \ + " .set "MIPS_ISA_ARCH_LEVEL" \n" \ + "2: "user_sc("$1", "%2")" \n" \ + " beqz $1, 1b \n" \ +- __stringify(__WEAK_LLSC_MB) " \n" \ ++ __WEAK_LLSC_MB \ + "3: \n" \ + " .insn \n" \ + " .set pop \n" \ +@@ -148,7 +147,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + " .set arch=r4000 \n" + "2: sc $1, %2 \n" + " beqzl $1, 1b \n" +- __stringify(__WEAK_LLSC_MB) " \n" ++ __WEAK_LLSC_MB + "3: \n" + " .insn \n" + " .set pop \n" +@@ -165,13 +164,13 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + "i" (-EFAULT) + : "memory"); + } else if (cpu_has_llsc) { ++ loongson_llsc_mb(); + __asm__ __volatile__( + "# futex_atomic_cmpxchg_inatomic \n" + " .set push \n" + " .set noat \n" + " .set push \n" + " .set "MIPS_ISA_ARCH_LEVEL" \n" +- " " __SYNC(full, loongson3_war) " \n" + "1: "user_ll("%1", "%3")" \n" + " bne %1, %z4, 3f \n" + " .set pop \n" +@@ -179,7 +178,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + " .set "MIPS_ISA_ARCH_LEVEL" \n" + "2: "user_sc("$1", "%2")" \n" + " beqz $1, 1b \n" +- "3: " __SYNC_ELSE(full, loongson3_war, __WEAK_LLSC_MB) "\n" ++ __WEAK_LLSC_MB ++ "3: \n" + " .insn \n" + " .set pop \n" + " .section .fixup,\"ax\" \n" +@@ -194,6 +194,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + : GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval), + "i" (-EFAULT) + : "memory"); ++ loongson_llsc_mb(); + } else + return -ENOSYS; + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 83522c9fc7b6..37ac731a556b 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -91,11 +91,13 @@ MULTIPLEWORD := -mmultiple + endif + + ifdef CONFIG_PPC64 ++ifndef CONFIG_CC_IS_CLANG + cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) + cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mcall-aixdesc) + aflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) + aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mabi=elfv2 + endif ++endif + + ifndef CONFIG_CC_IS_CLANG + cflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mno-strict-align +@@ -141,6 +143,7 @@ endif + endif + + CFLAGS-$(CONFIG_PPC64) := $(call cc-option,-mtraceback=no) ++ifndef CONFIG_CC_IS_CLANG + ifdef CONFIG_CPU_LITTLE_ENDIAN + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2,$(call cc-option,-mcall-aixdesc)) + AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2) +@@ -149,6 +152,7 @@ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcall-aixdesc) + AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) + endif ++endif + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc)) + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mno-pointers-to-nested-functions) + +diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h +index 2abc8e83b95e..9757d4f6331e 100644 +--- a/arch/powerpc/boot/libfdt_env.h ++++ b/arch/powerpc/boot/libfdt_env.h +@@ -6,6 +6,8 @@ + #include + + #define INT_MAX ((int)(~0U>>1)) ++#define UINT32_MAX ((u32)~0U) ++#define INT32_MAX ((s32)(UINT32_MAX >> 1)) + + #include "of.h" + +diff --git a/arch/powerpc/include/asm/fixmap.h b/arch/powerpc/include/asm/fixmap.h +index 0cfc365d814b..722289a1d000 100644 +--- a/arch/powerpc/include/asm/fixmap.h ++++ b/arch/powerpc/include/asm/fixmap.h +@@ -77,7 +77,12 @@ enum fixed_addresses { + static inline void __set_fixmap(enum fixed_addresses idx, + phys_addr_t phys, pgprot_t flags) + { +- map_kernel_page(fix_to_virt(idx), phys, flags); ++ if (__builtin_constant_p(idx)) ++ BUILD_BUG_ON(idx >= __end_of_fixed_addresses); ++ else if (WARN_ON(idx >= __end_of_fixed_addresses)) ++ return; ++ ++ map_kernel_page(__fix_to_virt(idx), phys, flags); + } + + #endif /* !__ASSEMBLY__ */ +diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h +index cac95a3f30c2..e9a960e28f3c 100644 +--- a/arch/powerpc/include/asm/spinlock.h ++++ b/arch/powerpc/include/asm/spinlock.h +@@ -36,12 +36,10 @@ + #endif + + #ifdef CONFIG_PPC_PSERIES +-DECLARE_STATIC_KEY_FALSE(shared_processor); +- + #define vcpu_is_preempted vcpu_is_preempted + static inline bool vcpu_is_preempted(int cpu) + { +- if (!static_branch_unlikely(&shared_processor)) ++ if (!firmware_has_feature(FW_FEATURE_SPLPAR)) + return false; + return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1); + } +diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h +index 15002b51ff18..c92fe7fe9692 100644 +--- a/arch/powerpc/include/asm/uaccess.h ++++ b/arch/powerpc/include/asm/uaccess.h +@@ -401,7 +401,7 @@ copy_to_user_mcsafe(void __user *to, const void *from, unsigned long n) + return n; + } + +-extern unsigned long __clear_user(void __user *addr, unsigned long size); ++unsigned long __arch_clear_user(void __user *addr, unsigned long size); + + static inline unsigned long clear_user(void __user *addr, unsigned long size) + { +@@ -409,12 +409,17 @@ static inline unsigned long clear_user(void __user *addr, unsigned long size) + might_fault(); + if (likely(access_ok(addr, size))) { + allow_write_to_user(addr, size); +- ret = __clear_user(addr, size); ++ ret = __arch_clear_user(addr, size); + prevent_write_to_user(addr, size); + } + return ret; + } + ++static inline unsigned long __clear_user(void __user *addr, unsigned long size) ++{ ++ return clear_user(addr, size); ++} ++ + extern long strncpy_from_user(char *dst, const char __user *src, long count); + extern __must_check long strnlen_user(const char __user *str, long n); + +diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c +index d9279d0ee9f5..c031be8d41ff 100644 +--- a/arch/powerpc/kernel/eeh_driver.c ++++ b/arch/powerpc/kernel/eeh_driver.c +@@ -897,12 +897,12 @@ void eeh_handle_normal_event(struct eeh_pe *pe) + + /* Log the event */ + if (pe->type & EEH_PE_PHB) { +- pr_err("EEH: PHB#%x failure detected, location: %s\n", ++ pr_err("EEH: Recovering PHB#%x, location: %s\n", + pe->phb->global_number, eeh_pe_loc_get(pe)); + } else { + struct eeh_pe *phb_pe = eeh_phb_pe_get(pe->phb); + +- pr_err("EEH: Frozen PHB#%x-PE#%x detected\n", ++ pr_err("EEH: Recovering PHB#%x-PE#%x\n", + pe->phb->global_number, pe->addr); + pr_err("EEH: PE location: %s, PHB location: %s\n", + eeh_pe_loc_get(pe), eeh_pe_loc_get(phb_pe)); +diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c +index bd91dceb7010..d341b464f23c 100644 +--- a/arch/powerpc/kernel/security.c ++++ b/arch/powerpc/kernel/security.c +@@ -142,32 +142,33 @@ ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, cha + + thread_priv = security_ftr_enabled(SEC_FTR_L1D_THREAD_PRIV); + +- if (rfi_flush || thread_priv) { ++ if (rfi_flush) { + struct seq_buf s; + seq_buf_init(&s, buf, PAGE_SIZE - 1); + +- seq_buf_printf(&s, "Mitigation: "); +- +- if (rfi_flush) +- seq_buf_printf(&s, "RFI Flush"); +- +- if (rfi_flush && thread_priv) +- seq_buf_printf(&s, ", "); +- ++ seq_buf_printf(&s, "Mitigation: RFI Flush"); + if (thread_priv) +- seq_buf_printf(&s, "L1D private per thread"); ++ seq_buf_printf(&s, ", L1D private per thread"); + + seq_buf_printf(&s, "\n"); + + return s.len; + } + ++ if (thread_priv) ++ return sprintf(buf, "Vulnerable: L1D private per thread\n"); ++ + if (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) && + !security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)) + return sprintf(buf, "Not affected\n"); + + return sprintf(buf, "Vulnerable\n"); + } ++ ++ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ return cpu_show_meltdown(dev, attr, buf); ++} + #endif + + ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf) +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index 619447b1b797..11301a1187f3 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -232,7 +232,7 @@ static u64 scan_dispatch_log(u64 stop_tb) + * Accumulate stolen time by scanning the dispatch trace log. + * Called on entry from user mode. + */ +-void accumulate_stolen_time(void) ++void notrace accumulate_stolen_time(void) + { + u64 sst, ust; + unsigned long save_irq_soft_mask = irq_soft_mask_return(); +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index 82f43535e686..014ff0701f24 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -250,15 +250,22 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, + } + NOKPROBE_SYMBOL(oops_end); + ++static char *get_mmu_str(void) ++{ ++ if (early_radix_enabled()) ++ return " MMU=Radix"; ++ if (early_mmu_has_feature(MMU_FTR_HPTE_TABLE)) ++ return " MMU=Hash"; ++ return ""; ++} ++ + static int __die(const char *str, struct pt_regs *regs, long err) + { + printk("Oops: %s, sig: %ld [#%d]\n", str, err, ++die_counter); + +- printk("%s PAGE_SIZE=%luK%s%s%s%s%s%s%s %s\n", ++ printk("%s PAGE_SIZE=%luK%s%s%s%s%s%s %s\n", + IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN) ? "LE" : "BE", +- PAGE_SIZE / 1024, +- early_radix_enabled() ? " MMU=Radix" : "", +- early_mmu_has_feature(MMU_FTR_HPTE_TABLE) ? " MMU=Hash" : "", ++ PAGE_SIZE / 1024, get_mmu_str(), + IS_ENABLED(CONFIG_PREEMPT) ? " PREEMPT" : "", + IS_ENABLED(CONFIG_SMP) ? " SMP" : "", + IS_ENABLED(CONFIG_SMP) ? (" NR_CPUS=" __stringify(NR_CPUS)) : "", +diff --git a/arch/powerpc/lib/string_32.S b/arch/powerpc/lib/string_32.S +index f69a6aab7bfb..1ddb26394e8a 100644 +--- a/arch/powerpc/lib/string_32.S ++++ b/arch/powerpc/lib/string_32.S +@@ -17,7 +17,7 @@ CACHELINE_BYTES = L1_CACHE_BYTES + LG_CACHELINE_BYTES = L1_CACHE_SHIFT + CACHELINE_MASK = (L1_CACHE_BYTES-1) + +-_GLOBAL(__clear_user) ++_GLOBAL(__arch_clear_user) + /* + * Use dcbz on the complete cache lines in the destination + * to set them to zero. This requires that the destination +@@ -87,4 +87,4 @@ _GLOBAL(__clear_user) + EX_TABLE(8b, 91b) + EX_TABLE(9b, 91b) + +-EXPORT_SYMBOL(__clear_user) ++EXPORT_SYMBOL(__arch_clear_user) +diff --git a/arch/powerpc/lib/string_64.S b/arch/powerpc/lib/string_64.S +index 507b18b1660e..169872bc0892 100644 +--- a/arch/powerpc/lib/string_64.S ++++ b/arch/powerpc/lib/string_64.S +@@ -17,7 +17,7 @@ PPC64_CACHES: + .section ".text" + + /** +- * __clear_user: - Zero a block of memory in user space, with less checking. ++ * __arch_clear_user: - Zero a block of memory in user space, with less checking. + * @to: Destination address, in user space. + * @n: Number of bytes to zero. + * +@@ -58,7 +58,7 @@ err3; stb r0,0(r3) + mr r3,r4 + blr + +-_GLOBAL_TOC(__clear_user) ++_GLOBAL_TOC(__arch_clear_user) + cmpdi r4,32 + neg r6,r3 + li r0,0 +@@ -181,4 +181,4 @@ err1; dcbz 0,r3 + cmpdi r4,32 + blt .Lshort_clear + b .Lmedium_clear +-EXPORT_SYMBOL(__clear_user) ++EXPORT_SYMBOL(__arch_clear_user) +diff --git a/arch/powerpc/mm/book3s64/hash_utils.c b/arch/powerpc/mm/book3s64/hash_utils.c +index 6c123760164e..83c51a7d7eee 100644 +--- a/arch/powerpc/mm/book3s64/hash_utils.c ++++ b/arch/powerpc/mm/book3s64/hash_utils.c +@@ -294,10 +294,18 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend, + ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot, + HPTE_V_BOLTED, psize, psize, + ssize); +- ++ if (ret == -1) { ++ /* Try to remove a non bolted entry */ ++ ret = mmu_hash_ops.hpte_remove(hpteg); ++ if (ret != -1) ++ ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot, ++ HPTE_V_BOLTED, psize, psize, ++ ssize); ++ } + if (ret < 0) + break; + ++ cond_resched(); + #ifdef CONFIG_DEBUG_PAGEALLOC + if (debug_pagealloc_enabled() && + (paddr >> PAGE_SHIFT) < linear_map_hash_count) +diff --git a/arch/powerpc/platforms/pseries/cmm.c b/arch/powerpc/platforms/pseries/cmm.c +index b33251d75927..572651a5c87b 100644 +--- a/arch/powerpc/platforms/pseries/cmm.c ++++ b/arch/powerpc/platforms/pseries/cmm.c +@@ -411,6 +411,10 @@ static struct bus_type cmm_subsys = { + .dev_name = "cmm", + }; + ++static void cmm_release_device(struct device *dev) ++{ ++} ++ + /** + * cmm_sysfs_register - Register with sysfs + * +@@ -426,6 +430,7 @@ static int cmm_sysfs_register(struct device *dev) + + dev->id = 0; + dev->bus = &cmm_subsys; ++ dev->release = cmm_release_device; + + if ((rc = device_register(dev))) + goto subsys_unregister; +diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c +index 61883291defc..ee07d0718bf1 100644 +--- a/arch/powerpc/platforms/pseries/papr_scm.c ++++ b/arch/powerpc/platforms/pseries/papr_scm.c +@@ -152,7 +152,7 @@ static int papr_scm_meta_get(struct papr_scm_priv *p, + int len, read; + int64_t ret; + +- if ((hdr->in_offset + hdr->in_length) >= p->metadata_size) ++ if ((hdr->in_offset + hdr->in_length) > p->metadata_size) + return -EINVAL; + + for (len = hdr->in_length; len; len -= read) { +@@ -206,7 +206,7 @@ static int papr_scm_meta_set(struct papr_scm_priv *p, + __be64 data_be; + int64_t ret; + +- if ((hdr->in_offset + hdr->in_length) >= p->metadata_size) ++ if ((hdr->in_offset + hdr->in_length) > p->metadata_size) + return -EINVAL; + + for (len = hdr->in_length; len; len -= wrote) { +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 0c8421dd01ab..0a40201f315f 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -74,9 +74,6 @@ + #include "pseries.h" + #include "../../../../drivers/pci/pci.h" + +-DEFINE_STATIC_KEY_FALSE(shared_processor); +-EXPORT_SYMBOL_GPL(shared_processor); +- + int CMO_PrPSP = -1; + int CMO_SecPSP = -1; + unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K); +@@ -761,10 +758,6 @@ static void __init pSeries_setup_arch(void) + + if (firmware_has_feature(FW_FEATURE_LPAR)) { + vpa_init(boot_cpuid); +- +- if (lppaca_shared_proc(get_lppaca())) +- static_branch_enable(&shared_processor); +- + ppc_md.power_save = pseries_lpar_idle; + ppc_md.enable_pmcs = pseries_lpar_enable_pmcs; + #ifdef CONFIG_PCI_IOV +diff --git a/arch/powerpc/tools/relocs_check.sh b/arch/powerpc/tools/relocs_check.sh +index 2b4e959caa36..7b9fe0a567cf 100755 +--- a/arch/powerpc/tools/relocs_check.sh ++++ b/arch/powerpc/tools/relocs_check.sh +@@ -20,7 +20,7 @@ objdump="$1" + vmlinux="$2" + + bad_relocs=$( +-"$objdump" -R "$vmlinux" | ++$objdump -R "$vmlinux" | + # Only look at relocation lines. + grep -E '\:' | + awk '{print $1}' + ) + + BRANCHES=$( +-"$objdump" -R "$vmlinux" -D --start-address=0xc000000000000000 \ ++$objdump -R "$vmlinux" -D --start-address=0xc000000000000000 \ + --stop-address=${end_intr} | + grep -e "^c[0-9a-f]*:[[:space:]]*\([0-9a-f][0-9a-f][[:space:]]\)\{4\}[[:space:]]*b" | + grep -v '\<__start_initialization_multiplatform>' | +diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c +index d402ced7f7c3..cb8b1cc285c9 100644 +--- a/arch/s390/kernel/machine_kexec.c ++++ b/arch/s390/kernel/machine_kexec.c +@@ -164,7 +164,9 @@ static bool kdump_csum_valid(struct kimage *image) + #ifdef CONFIG_CRASH_DUMP + int rc; + ++ preempt_disable(); + rc = CALL_ON_STACK(do_start_kdump, S390_lowcore.nodat_stack, 1, image); ++ preempt_enable(); + return rc == 0; + #else + return false; +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 3d8b12a9a6ff..7511b71d2931 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -193,7 +193,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, + unsigned long num_sdb, gfp_t gfp_flags) + { + int i, rc; +- unsigned long *new, *tail; ++ unsigned long *new, *tail, *tail_prev = NULL; + + if (!sfb->sdbt || !sfb->tail) + return -EINVAL; +@@ -232,6 +232,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, + sfb->num_sdbt++; + /* Link current page to tail of chain */ + *tail = (unsigned long)(void *) new + 1; ++ tail_prev = tail; + tail = new; + } + +@@ -241,10 +242,22 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, + * issue, a new realloc call (if required) might succeed. + */ + rc = alloc_sample_data_block(tail, gfp_flags); +- if (rc) ++ if (rc) { ++ /* Undo last SDBT. An SDBT with no SDB at its first ++ * entry but with an SDBT entry instead can not be ++ * handled by the interrupt handler code. ++ * Avoid this situation. ++ */ ++ if (tail_prev) { ++ sfb->num_sdbt--; ++ free_page((unsigned long) new); ++ tail = tail_prev; ++ } + break; ++ } + sfb->num_sdb++; + tail++; ++ tail_prev = new = NULL; /* Allocated at least one SBD */ + } + + /* Link sampling buffer to its origin */ +diff --git a/arch/s390/kernel/unwind_bc.c b/arch/s390/kernel/unwind_bc.c +index a8204f952315..6e609b13c0ce 100644 +--- a/arch/s390/kernel/unwind_bc.c ++++ b/arch/s390/kernel/unwind_bc.c +@@ -60,6 +60,11 @@ bool unwind_next_frame(struct unwind_state *state) + ip = READ_ONCE_NOCHECK(sf->gprs[8]); + reliable = false; + regs = NULL; ++ if (!__kernel_text_address(ip)) { ++ /* skip bogus %r14 */ ++ state->regs = NULL; ++ return unwind_next_frame(state); ++ } + } else { + sf = (struct stack_frame *) state->sp; + sp = READ_ONCE_NOCHECK(sf->back_chain); +diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c +index 59ad7997fed1..de7ca4b6718f 100644 +--- a/arch/s390/mm/maccess.c ++++ b/arch/s390/mm/maccess.c +@@ -119,9 +119,15 @@ static unsigned long __no_sanitize_address _memcpy_real(unsigned long dest, + */ + int memcpy_real(void *dest, void *src, size_t count) + { +- if (S390_lowcore.nodat_stack != 0) +- return CALL_ON_STACK(_memcpy_real, S390_lowcore.nodat_stack, +- 3, dest, src, count); ++ int rc; ++ ++ if (S390_lowcore.nodat_stack != 0) { ++ preempt_disable(); ++ rc = CALL_ON_STACK(_memcpy_real, S390_lowcore.nodat_stack, 3, ++ dest, src, count); ++ preempt_enable(); ++ return rc; ++ } + /* + * This is a really early memcpy_real call, the stacks are + * not set up yet. Just call _memcpy_real on the early boot +diff --git a/arch/um/drivers/virtio_uml.c b/arch/um/drivers/virtio_uml.c +index fc8c52cff5aa..c5643a59a8c7 100644 +--- a/arch/um/drivers/virtio_uml.c ++++ b/arch/um/drivers/virtio_uml.c +@@ -83,7 +83,7 @@ static int full_sendmsg_fds(int fd, const void *buf, unsigned int len, + return 0; + } + +-static int full_read(int fd, void *buf, int len) ++static int full_read(int fd, void *buf, int len, bool abortable) + { + int rc; + +@@ -93,7 +93,7 @@ static int full_read(int fd, void *buf, int len) + buf += rc; + len -= rc; + } +- } while (len && (rc > 0 || rc == -EINTR)); ++ } while (len && (rc > 0 || rc == -EINTR || (!abortable && rc == -EAGAIN))); + + if (rc < 0) + return rc; +@@ -104,7 +104,7 @@ static int full_read(int fd, void *buf, int len) + + static int vhost_user_recv_header(int fd, struct vhost_user_msg *msg) + { +- return full_read(fd, msg, sizeof(msg->header)); ++ return full_read(fd, msg, sizeof(msg->header), true); + } + + static int vhost_user_recv(int fd, struct vhost_user_msg *msg, +@@ -118,7 +118,7 @@ static int vhost_user_recv(int fd, struct vhost_user_msg *msg, + size = msg->header.size; + if (size > max_payload_size) + return -EPROTO; +- return full_read(fd, &msg->payload, size); ++ return full_read(fd, &msg->payload, size, false); + } + + static int vhost_user_recv_resp(struct virtio_uml_device *vu_dev, +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index ac42ae4651ce..eebdcbef0578 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -996,6 +996,12 @@ static void cdrom_count_tracks(struct cdrom_device_info *cdi, tracktype *tracks) + tracks->xa = 0; + tracks->error = 0; + cd_dbg(CD_COUNT_TRACKS, "entering cdrom_count_tracks\n"); ++ ++ if (!CDROM_CAN(CDC_PLAY_AUDIO)) { ++ tracks->error = CDS_NO_INFO; ++ return; ++ } ++ + /* Grab the TOC header so we can see how many tracks there are */ + ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCHDR, &header); + if (ret) { +@@ -1162,7 +1168,8 @@ int cdrom_open(struct cdrom_device_info *cdi, struct block_device *bdev, + ret = open_for_data(cdi); + if (ret) + goto err; +- cdrom_mmc3_profile(cdi); ++ if (CDROM_CAN(CDC_GENERIC_PACKET)) ++ cdrom_mmc3_profile(cdi); + if (mode & FMODE_WRITE) { + ret = -EROFS; + if (cdrom_open_write(cdi)) +@@ -2882,6 +2889,9 @@ int cdrom_get_last_written(struct cdrom_device_info *cdi, long *last_written) + it doesn't give enough information or fails. then we return + the toc contents. */ + use_toc: ++ if (!CDROM_CAN(CDC_PLAY_AUDIO)) ++ return -ENOSYS; ++ + toc.cdte_format = CDROM_MSF; + toc.cdte_track = CDROM_LEADOUT; + if ((ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCENTRY, &toc))) +diff --git a/drivers/clk/clk-gpio.c b/drivers/clk/clk-gpio.c +index 9d930edd6516..13304cf5f2a8 100644 +--- a/drivers/clk/clk-gpio.c ++++ b/drivers/clk/clk-gpio.c +@@ -280,7 +280,7 @@ static int gpio_clk_driver_probe(struct platform_device *pdev) + else + clk = clk_register_gpio_gate(&pdev->dev, node->name, + parent_names ? parent_names[0] : NULL, gpiod, +- 0); ++ CLK_SET_RATE_PARENT); + if (IS_ERR(clk)) + return PTR_ERR(clk); + +diff --git a/drivers/clk/pxa/clk-pxa27x.c b/drivers/clk/pxa/clk-pxa27x.c +index 287fdeae7c7c..7b123105b5de 100644 +--- a/drivers/clk/pxa/clk-pxa27x.c ++++ b/drivers/clk/pxa/clk-pxa27x.c +@@ -459,6 +459,7 @@ struct dummy_clk { + }; + static struct dummy_clk dummy_clks[] __initdata = { + DUMMY_CLK(NULL, "pxa27x-gpio", "osc_32_768khz"), ++ DUMMY_CLK(NULL, "pxa-rtc", "osc_32_768khz"), + DUMMY_CLK(NULL, "sa1100-rtc", "osc_32_768khz"), + DUMMY_CLK("UARTCLK", "pxa2xx-ir", "STUART"), + }; +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index b98b81ef43a1..5a89ed88cc27 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -220,6 +220,8 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f, + if (clk_flags & CLK_SET_RATE_PARENT) { + rate = f->freq; + if (f->pre_div) { ++ if (!rate) ++ rate = req->rate; + rate /= 2; + rate *= f->pre_div + 1; + } +diff --git a/drivers/clk/qcom/clk-smd-rpm.c b/drivers/clk/qcom/clk-smd-rpm.c +index fef5e8157061..930fa4a4c52a 100644 +--- a/drivers/clk/qcom/clk-smd-rpm.c ++++ b/drivers/clk/qcom/clk-smd-rpm.c +@@ -648,6 +648,7 @@ static const struct rpm_smd_clk_desc rpm_clk_qcs404 = { + }; + + /* msm8998 */ ++DEFINE_CLK_SMD_RPM(msm8998, pcnoc_clk, pcnoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 0); + DEFINE_CLK_SMD_RPM(msm8998, snoc_clk, snoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 1); + DEFINE_CLK_SMD_RPM(msm8998, cnoc_clk, cnoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 2); + DEFINE_CLK_SMD_RPM(msm8998, ce1_clk, ce1_a_clk, QCOM_SMD_RPM_CE_CLK, 0); +@@ -670,6 +671,8 @@ DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL(msm8998, rf_clk2_pin, rf_clk2_a_pin, 5); + DEFINE_CLK_SMD_RPM_XO_BUFFER(msm8998, rf_clk3, rf_clk3_a, 6); + DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL(msm8998, rf_clk3_pin, rf_clk3_a_pin, 6); + static struct clk_smd_rpm *msm8998_clks[] = { ++ [RPM_SMD_PCNOC_CLK] = &msm8998_pcnoc_clk, ++ [RPM_SMD_PCNOC_A_CLK] = &msm8998_pcnoc_a_clk, + [RPM_SMD_SNOC_CLK] = &msm8998_snoc_clk, + [RPM_SMD_SNOC_A_CLK] = &msm8998_snoc_a_clk, + [RPM_SMD_CNOC_CLK] = &msm8998_cnoc_clk, +diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c +index 28ddc747d703..bdeacebbf0e4 100644 +--- a/drivers/clk/qcom/common.c ++++ b/drivers/clk/qcom/common.c +@@ -29,6 +29,9 @@ struct freq_tbl *qcom_find_freq(const struct freq_tbl *f, unsigned long rate) + if (!f) + return NULL; + ++ if (!f->freq) ++ return f; ++ + for (; f->freq; f++) + if (rate <= f->freq) + return f; +diff --git a/drivers/clocksource/asm9260_timer.c b/drivers/clocksource/asm9260_timer.c +index 9f09a59161e7..5b39d3701fa3 100644 +--- a/drivers/clocksource/asm9260_timer.c ++++ b/drivers/clocksource/asm9260_timer.c +@@ -194,6 +194,10 @@ static int __init asm9260_timer_init(struct device_node *np) + } + + clk = of_clk_get(np, 0); ++ if (IS_ERR(clk)) { ++ pr_err("Failed to get clk!\n"); ++ return PTR_ERR(clk); ++ } + + ret = clk_prepare_enable(clk); + if (ret) { +diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c +index 11ff701ff4bb..a3c73e972fce 100644 +--- a/drivers/clocksource/timer-of.c ++++ b/drivers/clocksource/timer-of.c +@@ -192,7 +192,7 @@ int __init timer_of_init(struct device_node *np, struct timer_of *to) + } + + if (!to->clkevt.name) +- to->clkevt.name = np->name; ++ to->clkevt.name = np->full_name; + + to->np = np; + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 06664fbd2d91..89792083d62c 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -1155,6 +1155,9 @@ static int fsl_qdma_probe(struct platform_device *pdev) + return ret; + + fsl_qdma->irq_base = platform_get_irq_byname(pdev, "qdma-queue0"); ++ if (fsl_qdma->irq_base < 0) ++ return fsl_qdma->irq_base; ++ + fsl_qdma->feature = of_property_read_bool(np, "big-endian"); + INIT_LIST_HEAD(&fsl_qdma->dma_dev.channels); + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 5d56f1e4d332..43acba2a1c0e 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -1433,6 +1433,7 @@ static int xilinx_dma_reset(struct xilinx_dma_chan *chan) + + chan->err = false; + chan->idle = true; ++ chan->desc_pendingcount = 0; + chan->desc_submitcount = 0; + + return err; +diff --git a/drivers/gpio/gpio-lynxpoint.c b/drivers/gpio/gpio-lynxpoint.c +index e9e47c0d5be7..490ce7bae25e 100644 +--- a/drivers/gpio/gpio-lynxpoint.c ++++ b/drivers/gpio/gpio-lynxpoint.c +@@ -164,6 +164,12 @@ static int lp_irq_type(struct irq_data *d, unsigned type) + value |= TRIG_SEL_BIT | INT_INV_BIT; + + outl(value, reg); ++ ++ if (type & IRQ_TYPE_EDGE_BOTH) ++ irq_set_handler_locked(d, handle_edge_irq); ++ else if (type & IRQ_TYPE_LEVEL_MASK) ++ irq_set_handler_locked(d, handle_level_irq); ++ + spin_unlock_irqrestore(&lg->lock, flags); + + return 0; +diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c +index 16a47de29c94..a031cbcdf6ef 100644 +--- a/drivers/gpio/gpio-mpc8xxx.c ++++ b/drivers/gpio/gpio-mpc8xxx.c +@@ -377,7 +377,8 @@ static int mpc8xxx_probe(struct platform_device *pdev) + * It's assumed that only a single type of gpio controller is available + * on the current machine, so overwriting global data is fine. + */ +- mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type; ++ if (devtype->irq_set_type) ++ mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type; + + if (devtype->gpio_dir_out) + gc->direction_output = devtype->gpio_dir_out; +@@ -386,6 +387,9 @@ static int mpc8xxx_probe(struct platform_device *pdev) + + gc->to_irq = mpc8xxx_gpio_to_irq; + ++ if (of_device_is_compatible(np, "fsl,qoriq-gpio")) ++ gc->write_reg(mpc8xxx_gc->regs + GPIO_IBE, 0xffffffff); ++ + ret = gpiochip_add_data(gc, mpc8xxx_gc); + if (ret) { + pr_err("%pOF: GPIO chip registration failed with status %d\n", +diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c +index 7907a8755866..c77d474185f3 100644 +--- a/drivers/gpio/gpio-mxc.c ++++ b/drivers/gpio/gpio-mxc.c +@@ -411,6 +411,7 @@ static int mxc_gpio_probe(struct platform_device *pdev) + { + struct device_node *np = pdev->dev.of_node; + struct mxc_gpio_port *port; ++ int irq_count; + int irq_base; + int err; + +@@ -426,9 +427,15 @@ static int mxc_gpio_probe(struct platform_device *pdev) + if (IS_ERR(port->base)) + return PTR_ERR(port->base); + +- port->irq_high = platform_get_irq(pdev, 1); +- if (port->irq_high < 0) +- port->irq_high = 0; ++ irq_count = platform_irq_count(pdev); ++ if (irq_count < 0) ++ return irq_count; ++ ++ if (irq_count > 1) { ++ port->irq_high = platform_get_irq(pdev, 1); ++ if (port->irq_high < 0) ++ port->irq_high = 0; ++ } + + port->irq = platform_get_irq(pdev, 0); + if (port->irq < 0) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index dff41d0a85fe..c0e41f1f0c23 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -788,7 +789,7 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages) + struct hmm_mirror *mirror = bo->mn ? &bo->mn->mirror : NULL; + struct ttm_tt *ttm = bo->tbo.ttm; + struct amdgpu_ttm_tt *gtt = (void *)ttm; +- struct mm_struct *mm = gtt->usertask->mm; ++ struct mm_struct *mm; + unsigned long start = gtt->userptr; + struct vm_area_struct *vma; + struct hmm_range *range; +@@ -796,25 +797,14 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages) + uint64_t *pfns; + int r = 0; + +- if (!mm) /* Happens during process shutdown */ +- return -ESRCH; +- + if (unlikely(!mirror)) { + DRM_DEBUG_DRIVER("Failed to get hmm_mirror\n"); +- r = -EFAULT; +- goto out; ++ return -EFAULT; + } + +- vma = find_vma(mm, start); +- if (unlikely(!vma || start < vma->vm_start)) { +- r = -EFAULT; +- goto out; +- } +- if (unlikely((gtt->userflags & AMDGPU_GEM_USERPTR_ANONONLY) && +- vma->vm_file)) { +- r = -EPERM; +- goto out; +- } ++ mm = mirror->hmm->mmu_notifier.mm; ++ if (!mmget_not_zero(mm)) /* Happens during process shutdown */ ++ return -ESRCH; + + range = kzalloc(sizeof(*range), GFP_KERNEL); + if (unlikely(!range)) { +@@ -847,6 +837,17 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages) + hmm_range_wait_until_valid(range, HMM_RANGE_DEFAULT_TIMEOUT); + + down_read(&mm->mmap_sem); ++ vma = find_vma(mm, start); ++ if (unlikely(!vma || start < vma->vm_start)) { ++ r = -EFAULT; ++ goto out_unlock; ++ } ++ if (unlikely((gtt->userflags & AMDGPU_GEM_USERPTR_ANONONLY) && ++ vma->vm_file)) { ++ r = -EPERM; ++ goto out_unlock; ++ } ++ + r = hmm_range_fault(range, 0); + up_read(&mm->mmap_sem); + +@@ -865,15 +866,19 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages) + } + + gtt->range = range; ++ mmput(mm); + + return 0; + ++out_unlock: ++ up_read(&mm->mmap_sem); + out_free_pfns: + hmm_range_unregister(range); + kvfree(pfns); + out_free_ranges: + kfree(range); + out: ++ mmput(mm); + return r; + } + +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index 892ce636ef72..6ee04803c362 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + struct drm_property_blob *blob; + int ret; + +- if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob)) ++ if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + + blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 2fa3587d974f..e0b241bd3070 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -781,6 +781,10 @@ static void hid_scan_feature_usage(struct hid_parser *parser, u32 usage) + if (usage == 0xff0000c5 && parser->global.report_count == 256 && + parser->global.report_size == 8) + parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8; ++ ++ if (usage == 0xff0000c6 && parser->global.report_count == 1 && ++ parser->global.report_size == 8) ++ parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8; + } + + static void hid_scan_collection(struct hid_parser *parser, unsigned type) +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 447e8db21174..6273e7178e78 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -573,6 +573,7 @@ + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941 0x0941 + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641 ++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a 0x1f4a + + #define USB_VENDOR_ID_HUION 0x256c + #define USB_DEVICE_ID_HUION_TABLET 0x006e +@@ -959,6 +960,7 @@ + + #define I2C_VENDOR_ID_RAYDIUM 0x2386 + #define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33 ++#define I2C_PRODUCT_ID_RAYDIUM_3118 0x3118 + + #define USB_VENDOR_ID_RAZER 0x1532 + #define USB_DEVICE_ID_RAZER_BLADE_14 0x011D +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 8e91e2f06cb4..cd9193078525 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -1102,6 +1102,9 @@ static int hidpp20_batterylevel_get_battery_capacity(struct hidpp_device *hidpp, + ret = hidpp_send_fap_command_sync(hidpp, feature_index, + CMD_BATTERY_LEVEL_STATUS_GET_BATTERY_LEVEL_STATUS, + NULL, 0, &response); ++ /* Ignore these intermittent errors */ ++ if (ret == HIDPP_ERROR_RESOURCE_ERROR) ++ return -EIO; + if (ret > 0) { + hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n", + __func__, ret); +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index c50bcd967d99..9a35af1e2662 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -94,6 +94,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X), HID_QUIRK_MULTI_INPUT }, +diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c +index 7c6abd7e0979..9ce22acdfaca 100644 +--- a/drivers/hid/hid-rmi.c ++++ b/drivers/hid/hid-rmi.c +@@ -744,7 +744,8 @@ static void rmi_remove(struct hid_device *hdev) + { + struct rmi_data *hdata = hid_get_drvdata(hdev); + +- if (hdata->device_flags & RMI_DEVICE) { ++ if ((hdata->device_flags & RMI_DEVICE) ++ && test_bit(RMI_STARTED, &hdata->flags)) { + clear_bit(RMI_STARTED, &hdata->flags); + cancel_work_sync(&hdata->reset_work); + rmi_unregister_transport_device(&hdata->xport); +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 04c088131e04..7608ee053114 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -170,6 +170,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV }, + { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, ++ { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118, ++ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { USB_VENDOR_ID_ELAN, HID_ANY_ID, + I2C_HID_QUIRK_BOGUS_IRQ }, + { 0, 0 } +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 53a60c81e220..05ead1735c6e 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2308,7 +2308,7 @@ static void hv_crash_handler(struct pt_regs *regs) + vmbus_connection.conn_state = DISCONNECTED; + cpu = smp_processor_id(); + hv_stimer_cleanup(cpu); +- hv_synic_cleanup(cpu); ++ hv_synic_disable_regs(cpu); + hyperv_cleanup(); + }; + +diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c +index b24e7b937f21..84cfed17ff4f 100644 +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -1985,6 +1985,11 @@ pm_disable: + pm_runtime_set_suspended(i2c_dev->dev); + pm_runtime_dont_use_autosuspend(i2c_dev->dev); + ++ if (i2c_dev->dma) { ++ stm32_i2c_dma_free(i2c_dev->dma); ++ i2c_dev->dma = NULL; ++ } ++ + clk_free: + clk_disable_unprepare(i2c_dev->clk); + +@@ -1995,21 +2000,21 @@ static int stm32f7_i2c_remove(struct platform_device *pdev) + { + struct stm32f7_i2c_dev *i2c_dev = platform_get_drvdata(pdev); + +- if (i2c_dev->dma) { +- stm32_i2c_dma_free(i2c_dev->dma); +- i2c_dev->dma = NULL; +- } +- + i2c_del_adapter(&i2c_dev->adap); + pm_runtime_get_sync(i2c_dev->dev); + +- clk_disable_unprepare(i2c_dev->clk); +- + pm_runtime_put_noidle(i2c_dev->dev); + pm_runtime_disable(i2c_dev->dev); + pm_runtime_set_suspended(i2c_dev->dev); + pm_runtime_dont_use_autosuspend(i2c_dev->dev); + ++ if (i2c_dev->dma) { ++ stm32_i2c_dma_free(i2c_dev->dma); ++ i2c_dev->dma = NULL; ++ } ++ ++ clk_disable_unprepare(i2c_dev->clk); ++ + return 0; + } + +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 24c4b691b1c9..ae60442efda0 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -3156,6 +3156,8 @@ static int __maybe_unused mxt_suspend(struct device *dev) + + mutex_unlock(&input_dev->mutex); + ++ disable_irq(data->irq); ++ + return 0; + } + +@@ -3168,6 +3170,8 @@ static int __maybe_unused mxt_resume(struct device *dev) + if (!input_dev) + return 0; + ++ enable_irq(data->irq); ++ + mutex_lock(&input_dev->mutex); + + if (input_dev->users) +diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c +index e9006407c9bc..f4ebdab06280 100644 +--- a/drivers/input/touchscreen/ili210x.c ++++ b/drivers/input/touchscreen/ili210x.c +@@ -334,7 +334,12 @@ static int ili210x_i2c_probe(struct i2c_client *client, + input_set_abs_params(input, ABS_MT_POSITION_X, 0, 0xffff, 0, 0); + input_set_abs_params(input, ABS_MT_POSITION_Y, 0, 0xffff, 0, 0); + touchscreen_parse_properties(input, true, &priv->prop); +- input_mt_init_slots(input, priv->max_touches, INPUT_MT_DIRECT); ++ ++ error = input_mt_init_slots(input, priv->max_touches, INPUT_MT_DIRECT); ++ if (error) { ++ dev_err(dev, "Unable to set up slots, err: %d\n", error); ++ return error; ++ } + + error = devm_add_action(dev, ili210x_cancel_work, priv); + if (error) +diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c +index 1139714e72e2..1c5f8875cb79 100644 +--- a/drivers/input/touchscreen/st1232.c ++++ b/drivers/input/touchscreen/st1232.c +@@ -149,6 +149,11 @@ static void st1232_ts_power(struct st1232_ts_data *ts, bool poweron) + gpiod_set_value_cansleep(ts->reset_gpio, !poweron); + } + ++static void st1232_ts_power_off(void *data) ++{ ++ st1232_ts_power(data, false); ++} ++ + static const struct st_chip_info st1232_chip_info = { + .have_z = true, + .max_x = 0x31f, /* 800 - 1 */ +@@ -229,6 +234,13 @@ static int st1232_ts_probe(struct i2c_client *client, + + st1232_ts_power(ts, true); + ++ error = devm_add_action_or_reset(&client->dev, st1232_ts_power_off, ts); ++ if (error) { ++ dev_err(&client->dev, ++ "Failed to install power off action: %d\n", error); ++ return error; ++ } ++ + input_dev->name = "st1232-touchscreen"; + input_dev->id.bustype = BUS_I2C; + input_dev->dev.parent = &client->dev; +@@ -271,15 +283,6 @@ static int st1232_ts_probe(struct i2c_client *client, + return 0; + } + +-static int st1232_ts_remove(struct i2c_client *client) +-{ +- struct st1232_ts_data *ts = i2c_get_clientdata(client); +- +- st1232_ts_power(ts, false); +- +- return 0; +-} +- + static int __maybe_unused st1232_ts_suspend(struct device *dev) + { + struct i2c_client *client = to_i2c_client(dev); +@@ -329,7 +332,6 @@ MODULE_DEVICE_TABLE(of, st1232_ts_dt_ids); + + static struct i2c_driver st1232_ts_driver = { + .probe = st1232_ts_probe, +- .remove = st1232_ts_remove, + .id_table = st1232_ts_id, + .driver = { + .name = ST1232_TS_NAME, +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 8da93e730d6f..ed90361b84dc 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -3611,19 +3611,19 @@ static int arm_smmu_device_probe(struct platform_device *pdev) + + /* Interrupt lines */ + +- irq = platform_get_irq_byname(pdev, "combined"); ++ irq = platform_get_irq_byname_optional(pdev, "combined"); + if (irq > 0) + smmu->combined_irq = irq; + else { +- irq = platform_get_irq_byname(pdev, "eventq"); ++ irq = platform_get_irq_byname_optional(pdev, "eventq"); + if (irq > 0) + smmu->evtq.q.irq = irq; + +- irq = platform_get_irq_byname(pdev, "priq"); ++ irq = platform_get_irq_byname_optional(pdev, "priq"); + if (irq > 0) + smmu->priq.q.irq = irq; + +- irq = platform_get_irq_byname(pdev, "gerror"); ++ irq = platform_get_irq_byname_optional(pdev, "gerror"); + if (irq > 0) + smmu->gerr_irq = irq; + } +diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c +index 4dcbf68dfda4..0df091934361 100644 +--- a/drivers/iommu/rockchip-iommu.c ++++ b/drivers/iommu/rockchip-iommu.c +@@ -980,13 +980,13 @@ static struct iommu_domain *rk_iommu_domain_alloc(unsigned type) + if (!dma_dev) + return NULL; + +- rk_domain = devm_kzalloc(dma_dev, sizeof(*rk_domain), GFP_KERNEL); ++ rk_domain = kzalloc(sizeof(*rk_domain), GFP_KERNEL); + if (!rk_domain) + return NULL; + + if (type == IOMMU_DOMAIN_DMA && + iommu_get_dma_cookie(&rk_domain->domain)) +- return NULL; ++ goto err_free_domain; + + /* + * rk32xx iommus use a 2 level pagetable. +@@ -1021,6 +1021,8 @@ err_free_dt: + err_put_cookie: + if (type == IOMMU_DOMAIN_DMA) + iommu_put_dma_cookie(&rk_domain->domain); ++err_free_domain: ++ kfree(rk_domain); + + return NULL; + } +@@ -1049,6 +1051,7 @@ static void rk_iommu_domain_free(struct iommu_domain *domain) + + if (domain->type == IOMMU_DOMAIN_DMA) + iommu_put_dma_cookie(&rk_domain->domain); ++ kfree(rk_domain); + } + + static int rk_iommu_add_device(struct device *dev) +diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c +index 7293fc3f796d..dd486233e282 100644 +--- a/drivers/iommu/tegra-smmu.c ++++ b/drivers/iommu/tegra-smmu.c +@@ -159,9 +159,9 @@ static bool smmu_dma_addr_valid(struct tegra_smmu *smmu, dma_addr_t addr) + return (addr & smmu->pfn_mask) == addr; + } + +-static dma_addr_t smmu_pde_to_dma(u32 pde) ++static dma_addr_t smmu_pde_to_dma(struct tegra_smmu *smmu, u32 pde) + { +- return pde << 12; ++ return (dma_addr_t)(pde & smmu->pfn_mask) << 12; + } + + static void smmu_flush_ptc_all(struct tegra_smmu *smmu) +@@ -549,6 +549,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova, + dma_addr_t *dmap) + { + unsigned int pd_index = iova_pd_index(iova); ++ struct tegra_smmu *smmu = as->smmu; + struct page *pt_page; + u32 *pd; + +@@ -557,7 +558,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova, + return NULL; + + pd = page_address(as->pd); +- *dmap = smmu_pde_to_dma(pd[pd_index]); ++ *dmap = smmu_pde_to_dma(smmu, pd[pd_index]); + + return tegra_smmu_pte_offset(pt_page, iova); + } +@@ -599,7 +600,7 @@ static u32 *as_get_pte(struct tegra_smmu_as *as, dma_addr_t iova, + } else { + u32 *pd = page_address(as->pd); + +- *dmap = smmu_pde_to_dma(pd[pde]); ++ *dmap = smmu_pde_to_dma(smmu, pd[pde]); + } + + return tegra_smmu_pte_offset(as->pts[pde], iova); +@@ -624,7 +625,7 @@ static void tegra_smmu_pte_put_use(struct tegra_smmu_as *as, unsigned long iova) + if (--as->count[pde] == 0) { + struct tegra_smmu *smmu = as->smmu; + u32 *pd = page_address(as->pd); +- dma_addr_t pte_dma = smmu_pde_to_dma(pd[pde]); ++ dma_addr_t pte_dma = smmu_pde_to_dma(smmu, pd[pde]); + + tegra_smmu_set_pde(as, iova, 0); + +diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c +index fc75c61233aa..58bec2126966 100644 +--- a/drivers/irqchip/irq-bcm7038-l1.c ++++ b/drivers/irqchip/irq-bcm7038-l1.c +@@ -281,6 +281,10 @@ static int __init bcm7038_l1_init_one(struct device_node *dn, + pr_err("failed to map parent interrupt %d\n", parent_irq); + return -EINVAL; + } ++ ++ if (of_property_read_bool(dn, "brcm,irq-can-wake")) ++ enable_irq_wake(parent_irq); ++ + irq_set_chained_handler_and_data(parent_irq, bcm7038_l1_irq_handle, + intc); + +diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c +index f126255b3260..dda512dfe2c1 100644 +--- a/drivers/irqchip/irq-ingenic.c ++++ b/drivers/irqchip/irq-ingenic.c +@@ -108,6 +108,14 @@ static int __init ingenic_intc_of_init(struct device_node *node, + goto out_unmap_irq; + } + ++ domain = irq_domain_add_legacy(node, num_chips * 32, ++ JZ4740_IRQ_BASE, 0, ++ &irq_domain_simple_ops, NULL); ++ if (!domain) { ++ err = -ENOMEM; ++ goto out_unmap_base; ++ } ++ + for (i = 0; i < num_chips; i++) { + /* Mask all irqs */ + writel(0xffffffff, intc->base + (i * CHIP_SIZE) + +@@ -134,14 +142,11 @@ static int __init ingenic_intc_of_init(struct device_node *node, + IRQ_NOPROBE | IRQ_LEVEL); + } + +- domain = irq_domain_add_legacy(node, num_chips * 32, JZ4740_IRQ_BASE, 0, +- &irq_domain_simple_ops, NULL); +- if (!domain) +- pr_warn("unable to register IRQ domain\n"); +- + setup_irq(parent_irq, &intc_cascade_action); + return 0; + ++out_unmap_base: ++ iounmap(intc->base); + out_unmap_irq: + irq_dispose_mapping(parent_irq); + out_free: +diff --git a/drivers/leds/leds-an30259a.c b/drivers/leds/leds-an30259a.c +index 250dc9d6f635..82350a28a564 100644 +--- a/drivers/leds/leds-an30259a.c ++++ b/drivers/leds/leds-an30259a.c +@@ -305,6 +305,13 @@ static int an30259a_probe(struct i2c_client *client) + + chip->regmap = devm_regmap_init_i2c(client, &an30259a_regmap_config); + ++ if (IS_ERR(chip->regmap)) { ++ err = PTR_ERR(chip->regmap); ++ dev_err(&client->dev, "Failed to allocate register map: %d\n", ++ err); ++ goto exit; ++ } ++ + for (i = 0; i < chip->num_leds; i++) { + struct led_init_data init_data = {}; + +diff --git a/drivers/leds/leds-lm3692x.c b/drivers/leds/leds-lm3692x.c +index 3d381f2f73d0..1ac9a44570ee 100644 +--- a/drivers/leds/leds-lm3692x.c ++++ b/drivers/leds/leds-lm3692x.c +@@ -334,9 +334,18 @@ static int lm3692x_probe_dt(struct lm3692x_led *led) + return ret; + } + +- led->regulator = devm_regulator_get(&led->client->dev, "vled"); +- if (IS_ERR(led->regulator)) ++ led->regulator = devm_regulator_get_optional(&led->client->dev, "vled"); ++ if (IS_ERR(led->regulator)) { ++ ret = PTR_ERR(led->regulator); ++ if (ret != -ENODEV) { ++ if (ret != -EPROBE_DEFER) ++ dev_err(&led->client->dev, ++ "Failed to get vled regulator: %d\n", ++ ret); ++ return ret; ++ } + led->regulator = NULL; ++ } + + child = device_get_next_child_node(&led->client->dev, child); + if (!child) { +diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c +index 136f86a1627d..d5e774d83021 100644 +--- a/drivers/leds/trigger/ledtrig-netdev.c ++++ b/drivers/leds/trigger/ledtrig-netdev.c +@@ -302,10 +302,12 @@ static int netdev_trig_notify(struct notifier_block *nb, + container_of(nb, struct led_netdev_data, notifier); + + if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE +- && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER) ++ && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER ++ && evt != NETDEV_CHANGENAME) + return NOTIFY_DONE; + + if (!(dev == trigger_data->net_dev || ++ (evt == NETDEV_CHANGENAME && !strcmp(dev->name, trigger_data->device_name)) || + (evt == NETDEV_REGISTER && !strcmp(dev->name, trigger_data->device_name)))) + return NOTIFY_DONE; + +@@ -315,6 +317,7 @@ static int netdev_trig_notify(struct notifier_block *nb, + + clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode); + switch (evt) { ++ case NETDEV_CHANGENAME: + case NETDEV_REGISTER: + if (trigger_data->net_dev) + dev_put(trigger_data->net_dev); +diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c +index 9f74dee1a58c..afe625e88a5c 100644 +--- a/drivers/mailbox/imx-mailbox.c ++++ b/drivers/mailbox/imx-mailbox.c +@@ -214,11 +214,24 @@ static void imx_mu_shutdown(struct mbox_chan *chan) + struct imx_mu_priv *priv = to_imx_mu_priv(chan->mbox); + struct imx_mu_con_priv *cp = chan->con_priv; + +- if (cp->type == IMX_MU_TYPE_TXDB) ++ if (cp->type == IMX_MU_TYPE_TXDB) { + tasklet_kill(&cp->txdb_tasklet); ++ return; ++ } + +- imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_TIEn(cp->idx) | +- IMX_MU_xCR_RIEn(cp->idx) | IMX_MU_xCR_GIEn(cp->idx)); ++ switch (cp->type) { ++ case IMX_MU_TYPE_TX: ++ imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_TIEn(cp->idx)); ++ break; ++ case IMX_MU_TYPE_RX: ++ imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_RIEn(cp->idx)); ++ break; ++ case IMX_MU_TYPE_RXDB: ++ imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_GIEn(cp->idx)); ++ break; ++ default: ++ break; ++ } + + free_irq(priv->irq, chan); + } +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index ba434d9ac720..46a8b5a91c38 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -723,6 +723,8 @@ static unsigned long bch_mca_scan(struct shrinker *shrink, + * IO can always make forward progress: + */ + nr /= c->btree_pages; ++ if (nr == 0) ++ nr = 1; + nr = min_t(unsigned long, nr, mca_can_free(c)); + + i = 0; +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 805b33e27496..4e7c9f398bc6 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1159,6 +1159,7 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor + /* not spare disk, or LEVEL_MULTIPATH */ + if (sb->level == LEVEL_MULTIPATH || + (rdev->desc_nr >= 0 && ++ rdev->desc_nr < MD_SB_DISKS && + sb->disks[rdev->desc_nr].state & + ((1<hdev; + struct hl_vm_phys_pg_pack *phys_pg_pack = NULL; + struct hl_vm_hash_node *hnode = NULL; + struct hl_userptr *userptr = NULL; ++ struct hl_va_range *va_range; + enum vm_type_t *vm_type; + u64 next_vaddr, i; + u32 page_size; +@@ -1003,6 +1005,7 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr) + + if (*vm_type == VM_TYPE_USERPTR) { + is_userptr = true; ++ va_range = &ctx->host_va_range; + userptr = hnode->ptr; + rc = init_phys_pg_pack_from_userptr(ctx, userptr, + &phys_pg_pack); +@@ -1014,6 +1017,7 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr) + } + } else if (*vm_type == VM_TYPE_PHYS_PACK) { + is_userptr = false; ++ va_range = &ctx->dram_va_range; + phys_pg_pack = hnode->ptr; + } else { + dev_warn(hdev->dev, +@@ -1052,12 +1056,18 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr) + + mutex_unlock(&ctx->mmu_lock); + +- if (add_va_block(hdev, +- is_userptr ? &ctx->host_va_range : &ctx->dram_va_range, +- vaddr, +- vaddr + phys_pg_pack->total_size - 1)) +- dev_warn(hdev->dev, "add va block failed for vaddr: 0x%llx\n", +- vaddr); ++ /* ++ * No point in maintaining the free VA block list if the context is ++ * closing as the list will be freed anyway ++ */ ++ if (!ctx_free) { ++ rc = add_va_block(hdev, va_range, vaddr, ++ vaddr + phys_pg_pack->total_size - 1); ++ if (rc) ++ dev_warn(hdev->dev, ++ "add va block failed for vaddr: 0x%llx\n", ++ vaddr); ++ } + + atomic_dec(&phys_pg_pack->mapping_cnt); + kfree(hnode); +@@ -1189,8 +1199,8 @@ int hl_mem_ioctl(struct hl_fpriv *hpriv, void *data) + break; + + case HL_MEM_OP_UNMAP: +- rc = unmap_device_va(ctx, +- args->in.unmap.device_virt_addr); ++ rc = unmap_device_va(ctx, args->in.unmap.device_virt_addr, ++ false); + break; + + default: +@@ -1620,7 +1630,7 @@ void hl_vm_ctx_fini(struct hl_ctx *ctx) + dev_dbg(hdev->dev, + "hl_mem_hash_node of vaddr 0x%llx of asid %d is still alive\n", + hnode->vaddr, ctx->asid); +- unmap_device_va(ctx, hnode->vaddr); ++ unmap_device_va(ctx, hnode->vaddr, true); + } + + spin_lock(&vm->idr_lock); +diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h +index 57b582bf73d9..9289bb4d633e 100644 +--- a/drivers/mmc/host/sdhci-esdhc.h ++++ b/drivers/mmc/host/sdhci-esdhc.h +@@ -51,6 +51,11 @@ + #define ESDHC_CLOCK_HCKEN 0x00000002 + #define ESDHC_CLOCK_IPGEN 0x00000001 + ++/* System Control 2 Register */ ++#define ESDHC_SYSTEM_CONTROL_2 0x3c ++#define ESDHC_SMPCLKSEL 0x00800000 ++#define ESDHC_EXTN 0x00400000 ++ + /* Host Controller Capabilities Register 2 */ + #define ESDHC_CAPABILITIES_1 0x114 + +@@ -59,7 +64,16 @@ + #define ESDHC_HS400_WNDW_ADJUST 0x00000040 + #define ESDHC_HS400_MODE 0x00000010 + #define ESDHC_TB_EN 0x00000004 ++#define ESDHC_TB_MODE_MASK 0x00000003 ++#define ESDHC_TB_MODE_SW 0x00000003 ++#define ESDHC_TB_MODE_3 0x00000002 ++ ++#define ESDHC_TBSTAT 0x124 ++ + #define ESDHC_TBPTR 0x128 ++#define ESDHC_WNDW_STRT_PTR_SHIFT 8 ++#define ESDHC_WNDW_STRT_PTR_MASK (0x7f << 8) ++#define ESDHC_WNDW_END_PTR_MASK 0x7f + + /* SD Clock Control Register */ + #define ESDHC_SDCLKCTL 0x144 +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 889ed98ec0e7..fcfb50f84c8b 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -77,8 +77,11 @@ struct sdhci_esdhc { + bool quirk_incorrect_hostver; + bool quirk_limited_clk_division; + bool quirk_unreliable_pulse_detection; +- bool quirk_fixup_tuning; ++ bool quirk_tuning_erratum_type1; ++ bool quirk_tuning_erratum_type2; + bool quirk_ignore_data_inhibit; ++ bool quirk_delay_before_data_reset; ++ bool in_sw_tuning; + unsigned int peripheral_clock; + const struct esdhc_clk_fixup *clk_fixup; + u32 div_ratio; +@@ -408,6 +411,8 @@ static void esdhc_le_writel(struct sdhci_host *host, u32 val, int reg) + + static void esdhc_be_writew(struct sdhci_host *host, u16 val, int reg) + { ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); + int base = reg & ~0x3; + u32 value; + u32 ret; +@@ -416,10 +421,24 @@ static void esdhc_be_writew(struct sdhci_host *host, u16 val, int reg) + ret = esdhc_writew_fixup(host, reg, val, value); + if (reg != SDHCI_TRANSFER_MODE) + iowrite32be(ret, host->ioaddr + base); ++ ++ /* Starting SW tuning requires ESDHC_SMPCLKSEL to be set ++ * 1us later after ESDHC_EXTN is set. ++ */ ++ if (base == ESDHC_SYSTEM_CONTROL_2) { ++ if (!(value & ESDHC_EXTN) && (ret & ESDHC_EXTN) && ++ esdhc->in_sw_tuning) { ++ udelay(1); ++ ret |= ESDHC_SMPCLKSEL; ++ iowrite32be(ret, host->ioaddr + base); ++ } ++ } + } + + static void esdhc_le_writew(struct sdhci_host *host, u16 val, int reg) + { ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); + int base = reg & ~0x3; + u32 value; + u32 ret; +@@ -428,6 +447,18 @@ static void esdhc_le_writew(struct sdhci_host *host, u16 val, int reg) + ret = esdhc_writew_fixup(host, reg, val, value); + if (reg != SDHCI_TRANSFER_MODE) + iowrite32(ret, host->ioaddr + base); ++ ++ /* Starting SW tuning requires ESDHC_SMPCLKSEL to be set ++ * 1us later after ESDHC_EXTN is set. ++ */ ++ if (base == ESDHC_SYSTEM_CONTROL_2) { ++ if (!(value & ESDHC_EXTN) && (ret & ESDHC_EXTN) && ++ esdhc->in_sw_tuning) { ++ udelay(1); ++ ret |= ESDHC_SMPCLKSEL; ++ iowrite32(ret, host->ioaddr + base); ++ } ++ } + } + + static void esdhc_be_writeb(struct sdhci_host *host, u8 val, int reg) +@@ -705,6 +736,11 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask) + struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); + u32 val; + ++ if (esdhc->quirk_delay_before_data_reset && ++ (mask & SDHCI_RESET_DATA) && ++ (host->flags & SDHCI_REQ_USE_DMA)) ++ mdelay(5); ++ + sdhci_reset(host, mask); + + sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); +@@ -793,16 +829,21 @@ static int esdhc_signal_voltage_switch(struct mmc_host *mmc, + } + } + +-static struct soc_device_attribute soc_fixup_tuning[] = { ++static struct soc_device_attribute soc_tuning_erratum_type1[] = { ++ { .family = "QorIQ T1023", .revision = "1.0", }, + { .family = "QorIQ T1040", .revision = "1.0", }, + { .family = "QorIQ T2080", .revision = "1.0", }, +- { .family = "QorIQ T1023", .revision = "1.0", }, + { .family = "QorIQ LS1021A", .revision = "1.0", }, +- { .family = "QorIQ LS1080A", .revision = "1.0", }, +- { .family = "QorIQ LS2080A", .revision = "1.0", }, ++ { }, ++}; ++ ++static struct soc_device_attribute soc_tuning_erratum_type2[] = { + { .family = "QorIQ LS1012A", .revision = "1.0", }, + { .family = "QorIQ LS1043A", .revision = "1.*", }, + { .family = "QorIQ LS1046A", .revision = "1.0", }, ++ { .family = "QorIQ LS1080A", .revision = "1.0", }, ++ { .family = "QorIQ LS2080A", .revision = "1.0", }, ++ { .family = "QorIQ LA1575A", .revision = "1.0", }, + { }, + }; + +@@ -826,15 +867,97 @@ static void esdhc_tuning_block_enable(struct sdhci_host *host, bool enable) + esdhc_clock_enable(host, true); + } + ++static void esdhc_prepare_sw_tuning(struct sdhci_host *host, u8 *window_start, ++ u8 *window_end) ++{ ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); ++ u8 tbstat_15_8, tbstat_7_0; ++ u32 val; ++ ++ if (esdhc->quirk_tuning_erratum_type1) { ++ *window_start = 5 * esdhc->div_ratio; ++ *window_end = 3 * esdhc->div_ratio; ++ return; ++ } ++ ++ /* Write TBCTL[11:8]=4'h8 */ ++ val = sdhci_readl(host, ESDHC_TBCTL); ++ val &= ~(0xf << 8); ++ val |= 8 << 8; ++ sdhci_writel(host, val, ESDHC_TBCTL); ++ ++ mdelay(1); ++ ++ /* Read TBCTL[31:0] register and rewrite again */ ++ val = sdhci_readl(host, ESDHC_TBCTL); ++ sdhci_writel(host, val, ESDHC_TBCTL); ++ ++ mdelay(1); ++ ++ /* Read the TBSTAT[31:0] register twice */ ++ val = sdhci_readl(host, ESDHC_TBSTAT); ++ val = sdhci_readl(host, ESDHC_TBSTAT); ++ ++ /* Reset data lines by setting ESDHCCTL[RSTD] */ ++ sdhci_reset(host, SDHCI_RESET_DATA); ++ /* Write 32'hFFFF_FFFF to IRQSTAT register */ ++ sdhci_writel(host, 0xFFFFFFFF, SDHCI_INT_STATUS); ++ ++ /* If TBSTAT[15:8]-TBSTAT[7:0] > 4 * div_ratio ++ * or TBSTAT[7:0]-TBSTAT[15:8] > 4 * div_ratio, ++ * then program TBPTR[TB_WNDW_END_PTR] = 4 * div_ratio ++ * and program TBPTR[TB_WNDW_START_PTR] = 8 * div_ratio. ++ */ ++ tbstat_7_0 = val & 0xff; ++ tbstat_15_8 = (val >> 8) & 0xff; ++ ++ if (abs(tbstat_15_8 - tbstat_7_0) > (4 * esdhc->div_ratio)) { ++ *window_start = 8 * esdhc->div_ratio; ++ *window_end = 4 * esdhc->div_ratio; ++ } else { ++ *window_start = 5 * esdhc->div_ratio; ++ *window_end = 3 * esdhc->div_ratio; ++ } ++} ++ ++static int esdhc_execute_sw_tuning(struct mmc_host *mmc, u32 opcode, ++ u8 window_start, u8 window_end) ++{ ++ struct sdhci_host *host = mmc_priv(mmc); ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); ++ u32 val; ++ int ret; ++ ++ /* Program TBPTR[TB_WNDW_END_PTR] and TBPTR[TB_WNDW_START_PTR] */ ++ val = ((u32)window_start << ESDHC_WNDW_STRT_PTR_SHIFT) & ++ ESDHC_WNDW_STRT_PTR_MASK; ++ val |= window_end & ESDHC_WNDW_END_PTR_MASK; ++ sdhci_writel(host, val, ESDHC_TBPTR); ++ ++ /* Program the software tuning mode by setting TBCTL[TB_MODE]=2'h3 */ ++ val = sdhci_readl(host, ESDHC_TBCTL); ++ val &= ~ESDHC_TB_MODE_MASK; ++ val |= ESDHC_TB_MODE_SW; ++ sdhci_writel(host, val, ESDHC_TBCTL); ++ ++ esdhc->in_sw_tuning = true; ++ ret = sdhci_execute_tuning(mmc, opcode); ++ esdhc->in_sw_tuning = false; ++ return ret; ++} ++ + static int esdhc_execute_tuning(struct mmc_host *mmc, u32 opcode) + { + struct sdhci_host *host = mmc_priv(mmc); + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); ++ u8 window_start, window_end; ++ int ret, retries = 1; + bool hs400_tuning; + unsigned int clk; + u32 val; +- int ret; + + /* For tuning mode, the sd clock divisor value + * must be larger than 3 according to reference manual. +@@ -843,39 +966,73 @@ static int esdhc_execute_tuning(struct mmc_host *mmc, u32 opcode) + if (host->clock > clk) + esdhc_of_set_clock(host, clk); + +- if (esdhc->quirk_limited_clk_division && +- host->flags & SDHCI_HS400_TUNING) +- esdhc_of_set_clock(host, host->clock); +- + esdhc_tuning_block_enable(host, true); + + hs400_tuning = host->flags & SDHCI_HS400_TUNING; +- ret = sdhci_execute_tuning(mmc, opcode); + +- if (hs400_tuning) { +- val = sdhci_readl(host, ESDHC_SDTIMNGCTL); +- val |= ESDHC_FLW_CTL_BG; +- sdhci_writel(host, val, ESDHC_SDTIMNGCTL); +- } ++ do { ++ if (esdhc->quirk_limited_clk_division && ++ hs400_tuning) ++ esdhc_of_set_clock(host, host->clock); + +- if (host->tuning_err == -EAGAIN && esdhc->quirk_fixup_tuning) { ++ /* Do HW tuning */ ++ val = sdhci_readl(host, ESDHC_TBCTL); ++ val &= ~ESDHC_TB_MODE_MASK; ++ val |= ESDHC_TB_MODE_3; ++ sdhci_writel(host, val, ESDHC_TBCTL); + +- /* program TBPTR[TB_WNDW_END_PTR] = 3*DIV_RATIO and +- * program TBPTR[TB_WNDW_START_PTR] = 5*DIV_RATIO +- */ +- val = sdhci_readl(host, ESDHC_TBPTR); +- val = (val & ~((0x7f << 8) | 0x7f)) | +- (3 * esdhc->div_ratio) | ((5 * esdhc->div_ratio) << 8); +- sdhci_writel(host, val, ESDHC_TBPTR); ++ ret = sdhci_execute_tuning(mmc, opcode); ++ if (ret) ++ break; + +- /* program the software tuning mode by setting +- * TBCTL[TB_MODE]=2'h3 ++ /* If HW tuning fails and triggers erratum, ++ * try workaround. + */ +- val = sdhci_readl(host, ESDHC_TBCTL); +- val |= 0x3; +- sdhci_writel(host, val, ESDHC_TBCTL); +- sdhci_execute_tuning(mmc, opcode); ++ ret = host->tuning_err; ++ if (ret == -EAGAIN && ++ (esdhc->quirk_tuning_erratum_type1 || ++ esdhc->quirk_tuning_erratum_type2)) { ++ /* Recover HS400 tuning flag */ ++ if (hs400_tuning) ++ host->flags |= SDHCI_HS400_TUNING; ++ pr_info("%s: Hold on to use fixed sampling clock. Try SW tuning!\n", ++ mmc_hostname(mmc)); ++ /* Do SW tuning */ ++ esdhc_prepare_sw_tuning(host, &window_start, ++ &window_end); ++ ret = esdhc_execute_sw_tuning(mmc, opcode, ++ window_start, ++ window_end); ++ if (ret) ++ break; ++ ++ /* Retry both HW/SW tuning with reduced clock. */ ++ ret = host->tuning_err; ++ if (ret == -EAGAIN && retries) { ++ /* Recover HS400 tuning flag */ ++ if (hs400_tuning) ++ host->flags |= SDHCI_HS400_TUNING; ++ ++ clk = host->max_clk / (esdhc->div_ratio + 1); ++ esdhc_of_set_clock(host, clk); ++ pr_info("%s: Hold on to use fixed sampling clock. Try tuning with reduced clock!\n", ++ mmc_hostname(mmc)); ++ } else { ++ break; ++ } ++ } else { ++ break; ++ } ++ } while (retries--); ++ ++ if (ret) { ++ esdhc_tuning_block_enable(host, false); ++ } else if (hs400_tuning) { ++ val = sdhci_readl(host, ESDHC_SDTIMNGCTL); ++ val |= ESDHC_FLW_CTL_BG; ++ sdhci_writel(host, val, ESDHC_SDTIMNGCTL); + } ++ + return ret; + } + +@@ -1046,6 +1203,10 @@ static void esdhc_init(struct platform_device *pdev, struct sdhci_host *host) + if (match) + esdhc->clk_fixup = match->data; + np = pdev->dev.of_node; ++ ++ if (of_device_is_compatible(np, "fsl,p2020-esdhc")) ++ esdhc->quirk_delay_before_data_reset = true; ++ + clk = of_clk_get(np, 0); + if (!IS_ERR(clk)) { + /* +@@ -1111,10 +1272,15 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) + + pltfm_host = sdhci_priv(host); + esdhc = sdhci_pltfm_priv(pltfm_host); +- if (soc_device_match(soc_fixup_tuning)) +- esdhc->quirk_fixup_tuning = true; ++ if (soc_device_match(soc_tuning_erratum_type1)) ++ esdhc->quirk_tuning_erratum_type1 = true; ++ else ++ esdhc->quirk_tuning_erratum_type1 = false; ++ ++ if (soc_device_match(soc_tuning_erratum_type2)) ++ esdhc->quirk_tuning_erratum_type2 = true; + else +- esdhc->quirk_fixup_tuning = false; ++ esdhc->quirk_tuning_erratum_type2 = false; + + if (esdhc->vendor_ver == VENDOR_V_22) + host->quirks2 |= SDHCI_QUIRK2_HOST_NO_CMD23; +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index face00c622ed..7dcd709f4ac3 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2225,9 +2225,6 @@ static void bond_miimon_commit(struct bonding *bond) + } else if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) { + /* make it immediately active */ + bond_set_active_slave(slave); +- } else if (slave != primary) { +- /* prevent it from being the active one */ +- bond_set_backup_slave(slave); + } + + slave_info(bond->dev, slave->dev, "link status definitely up, %u Mbps %s duplex\n", +diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c +index d264776a95a3..471837cf0b21 100644 +--- a/drivers/net/dsa/bcm_sf2_cfp.c ++++ b/drivers/net/dsa/bcm_sf2_cfp.c +@@ -358,7 +358,7 @@ static int bcm_sf2_cfp_ipv4_rule_set(struct bcm_sf2_priv *priv, int port, + return -EINVAL; + } + +- ip_frag = be32_to_cpu(fs->m_ext.data[0]); ++ ip_frag = !!(be32_to_cpu(fs->h_ext.data[0]) & 1); + + /* Locate the first rule available */ + if (fs->location == RX_CLS_LOC_ANY) +@@ -569,7 +569,7 @@ static int bcm_sf2_cfp_rule_cmp(struct bcm_sf2_priv *priv, int port, + + if (rule->fs.flow_type != fs->flow_type || + rule->fs.ring_cookie != fs->ring_cookie || +- rule->fs.m_ext.data[0] != fs->m_ext.data[0]) ++ rule->fs.h_ext.data[0] != fs->h_ext.data[0]) + continue; + + switch (fs->flow_type & ~FLOW_EXT) { +@@ -621,7 +621,7 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port, + return -EINVAL; + } + +- ip_frag = be32_to_cpu(fs->m_ext.data[0]); ++ ip_frag = !!(be32_to_cpu(fs->h_ext.data[0]) & 1); + + layout = &udf_tcpip6_layout; + slice_num = bcm_sf2_get_slice_number(layout, 0); +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 4e5a428ab1a4..7763221286d4 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -1560,8 +1560,8 @@ static int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled) + + if (enabled) { + /* Enable VLAN filtering. */ +- tpid = ETH_P_8021AD; +- tpid2 = ETH_P_8021Q; ++ tpid = ETH_P_8021Q; ++ tpid2 = ETH_P_8021AD; + } else { + /* Disable VLAN filtering. */ + tpid = ETH_P_SJA1105; +@@ -1570,9 +1570,9 @@ static int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled) + + table = &priv->static_config.tables[BLK_IDX_GENERAL_PARAMS]; + general_params = table->entries; +- /* EtherType used to identify outer tagged (S-tag) VLAN traffic */ +- general_params->tpid = tpid; + /* EtherType used to identify inner tagged (C-tag) VLAN traffic */ ++ general_params->tpid = tpid; ++ /* EtherType used to identify outer tagged (S-tag) VLAN traffic */ + general_params->tpid2 = tpid2; + /* When VLAN filtering is on, we need to at least be able to + * decode management traffic through the "backup plan". +diff --git a/drivers/net/dsa/sja1105/sja1105_static_config.c b/drivers/net/dsa/sja1105/sja1105_static_config.c +index 0d03e13e9909..63d2311817c4 100644 +--- a/drivers/net/dsa/sja1105/sja1105_static_config.c ++++ b/drivers/net/dsa/sja1105/sja1105_static_config.c +@@ -142,6 +142,9 @@ static size_t sja1105et_general_params_entry_packing(void *buf, void *entry_ptr, + return size; + } + ++/* TPID and TPID2 are intentionally reversed so that semantic ++ * compatibility with E/T is kept. ++ */ + static size_t + sja1105pqrs_general_params_entry_packing(void *buf, void *entry_ptr, + enum packing_op op) +@@ -166,9 +169,9 @@ sja1105pqrs_general_params_entry_packing(void *buf, void *entry_ptr, + sja1105_packing(buf, &entry->mirr_port, 141, 139, size, op); + sja1105_packing(buf, &entry->vlmarker, 138, 107, size, op); + sja1105_packing(buf, &entry->vlmask, 106, 75, size, op); +- sja1105_packing(buf, &entry->tpid, 74, 59, size, op); ++ sja1105_packing(buf, &entry->tpid2, 74, 59, size, op); + sja1105_packing(buf, &entry->ignore2stf, 58, 58, size, op); +- sja1105_packing(buf, &entry->tpid2, 57, 42, size, op); ++ sja1105_packing(buf, &entry->tpid, 57, 42, size, op); + sja1105_packing(buf, &entry->queue_ts, 41, 41, size, op); + sja1105_packing(buf, &entry->egrmirrvid, 40, 29, size, op); + sja1105_packing(buf, &entry->egrmirrpcp, 28, 26, size, op); +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index c487d2a7d6dd..b4a145220aba 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1238,8 +1238,8 @@ static int ena_io_poll(struct napi_struct *napi, int budget) + struct ena_napi *ena_napi = container_of(napi, struct ena_napi, napi); + struct ena_ring *tx_ring, *rx_ring; + +- u32 tx_work_done; +- u32 rx_work_done; ++ int tx_work_done; ++ int rx_work_done = 0; + int tx_budget; + int napi_comp_call = 0; + int ret; +@@ -1256,7 +1256,11 @@ static int ena_io_poll(struct napi_struct *napi, int budget) + } + + tx_work_done = ena_clean_tx_irq(tx_ring, tx_budget); +- rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget); ++ /* On netpoll the budget is zero and the handler should only clean the ++ * tx completions. ++ */ ++ if (likely(budget)) ++ rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget); + + /* If the device is about to reset or down, avoid unmask + * the interrupt and return 0 so NAPI won't reschedule +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 527e1bf93116..5c75b061243f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1995,6 +1995,9 @@ static int bnxt_async_event_process(struct bnxt *bp, + case ASYNC_EVENT_CMPL_EVENT_ID_RESET_NOTIFY: { + u32 data1 = le32_to_cpu(cmpl->event_data1); + ++ if (!bp->fw_health) ++ goto async_event_process_exit; ++ + bp->fw_reset_timestamp = jiffies; + bp->fw_reset_min_dsecs = cmpl->timestamp_lo; + if (!bp->fw_reset_min_dsecs) +@@ -4438,8 +4441,9 @@ static int bnxt_hwrm_func_drv_rgtr(struct bnxt *bp) + FUNC_DRV_RGTR_REQ_ENABLES_VER); + + req.os_type = cpu_to_le16(FUNC_DRV_RGTR_REQ_OS_TYPE_LINUX); +- flags = FUNC_DRV_RGTR_REQ_FLAGS_16BIT_VER_MODE | +- FUNC_DRV_RGTR_REQ_FLAGS_HOT_RESET_SUPPORT; ++ flags = FUNC_DRV_RGTR_REQ_FLAGS_16BIT_VER_MODE; ++ if (bp->fw_cap & BNXT_FW_CAP_HOT_RESET) ++ flags |= FUNC_DRV_RGTR_REQ_FLAGS_HOT_RESET_SUPPORT; + if (bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY) + flags |= FUNC_DRV_RGTR_REQ_FLAGS_ERROR_RECOVERY_SUPPORT; + req.flags = cpu_to_le32(flags); +@@ -6174,7 +6178,7 @@ static void bnxt_hwrm_set_coal_params(struct bnxt *bp, + tmr = bnxt_usec_to_coal_tmr(bp, hw_coal->coal_ticks_irq); + val = clamp_t(u16, tmr, 1, + coal_cap->cmpl_aggr_dma_tmr_during_int_max); +- req->cmpl_aggr_dma_tmr_during_int = cpu_to_le16(tmr); ++ req->cmpl_aggr_dma_tmr_during_int = cpu_to_le16(val); + req->enables |= + cpu_to_le16(BNXT_COAL_CMPL_AGGR_TMR_DURING_INT_ENABLE); + } +@@ -7096,14 +7100,6 @@ static int bnxt_hwrm_error_recovery_qcfg(struct bnxt *bp) + rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); + if (rc) + goto err_recovery_out; +- if (!fw_health) { +- fw_health = kzalloc(sizeof(*fw_health), GFP_KERNEL); +- bp->fw_health = fw_health; +- if (!fw_health) { +- rc = -ENOMEM; +- goto err_recovery_out; +- } +- } + fw_health->flags = le32_to_cpu(resp->flags); + if ((fw_health->flags & ERROR_RECOVERY_QCFG_RESP_FLAGS_CO_CPU) && + !(bp->fw_cap & BNXT_FW_CAP_KONG_MB_CHNL)) { +@@ -8766,6 +8762,9 @@ static int bnxt_hwrm_if_change(struct bnxt *bp, bool up) + } + if (resc_reinit || fw_reset) { + if (fw_reset) { ++ bnxt_free_ctx_mem(bp); ++ kfree(bp->ctx); ++ bp->ctx = NULL; + rc = bnxt_fw_init_one(bp); + if (rc) { + set_bit(BNXT_STATE_ABORT_ERR, &bp->state); +@@ -9954,8 +9953,7 @@ static void bnxt_fw_health_check(struct bnxt *bp) + struct bnxt_fw_health *fw_health = bp->fw_health; + u32 val; + +- if (!fw_health || !fw_health->enabled || +- test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) ++ if (!fw_health->enabled || test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) + return; + + if (fw_health->tmr_counter) { +@@ -10416,6 +10414,23 @@ static void bnxt_init_dflt_coal(struct bnxt *bp) + bp->stats_coal_ticks = BNXT_DEF_STATS_COAL_TICKS; + } + ++static void bnxt_alloc_fw_health(struct bnxt *bp) ++{ ++ if (bp->fw_health) ++ return; ++ ++ if (!(bp->fw_cap & BNXT_FW_CAP_HOT_RESET) && ++ !(bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY)) ++ return; ++ ++ bp->fw_health = kzalloc(sizeof(*bp->fw_health), GFP_KERNEL); ++ if (!bp->fw_health) { ++ netdev_warn(bp->dev, "Failed to allocate fw_health\n"); ++ bp->fw_cap &= ~BNXT_FW_CAP_HOT_RESET; ++ bp->fw_cap &= ~BNXT_FW_CAP_ERROR_RECOVERY; ++ } ++} ++ + static int bnxt_fw_init_one_p1(struct bnxt *bp) + { + int rc; +@@ -10462,6 +10477,7 @@ static int bnxt_fw_init_one_p2(struct bnxt *bp) + netdev_warn(bp->dev, "hwrm query adv flow mgnt failure rc: %d\n", + rc); + ++ bnxt_alloc_fw_health(bp); + rc = bnxt_hwrm_error_recovery_qcfg(bp); + if (rc) + netdev_warn(bp->dev, "hwrm query error recovery failure rc: %d\n", +@@ -10547,6 +10563,12 @@ static int bnxt_fw_init_one(struct bnxt *bp) + rc = bnxt_approve_mac(bp, bp->dev->dev_addr, false); + if (rc) + return rc; ++ ++ /* In case fw capabilities have changed, destroy the unneeded ++ * reporters and create newly capable ones. ++ */ ++ bnxt_dl_fw_reporters_destroy(bp, false); ++ bnxt_dl_fw_reporters_create(bp); + bnxt_fw_init_one_p3(bp); + return 0; + } +@@ -10680,8 +10702,7 @@ static void bnxt_fw_reset_task(struct work_struct *work) + bnxt_queue_fw_reset_work(bp, bp->fw_reset_min_dsecs * HZ / 10); + return; + case BNXT_FW_RESET_STATE_ENABLE_DEV: +- if (test_bit(BNXT_STATE_FW_FATAL_COND, &bp->state) && +- bp->fw_health) { ++ if (test_bit(BNXT_STATE_FW_FATAL_COND, &bp->state)) { + u32 val; + + val = bnxt_fw_health_readl(bp, +@@ -11322,11 +11343,11 @@ static void bnxt_remove_one(struct pci_dev *pdev) + struct net_device *dev = pci_get_drvdata(pdev); + struct bnxt *bp = netdev_priv(dev); + +- if (BNXT_PF(bp)) { ++ if (BNXT_PF(bp)) + bnxt_sriov_disable(bp); +- bnxt_dl_unregister(bp); +- } + ++ bnxt_dl_fw_reporters_destroy(bp, true); ++ bnxt_dl_unregister(bp); + pci_disable_pcie_error_reporting(pdev); + unregister_netdev(dev); + bnxt_shutdown_tc(bp); +@@ -11341,6 +11362,8 @@ static void bnxt_remove_one(struct pci_dev *pdev) + bnxt_dcb_free(bp); + kfree(bp->edev); + bp->edev = NULL; ++ kfree(bp->fw_health); ++ bp->fw_health = NULL; + bnxt_cleanup_pci(bp); + bnxt_free_ctx_mem(bp); + kfree(bp->ctx); +@@ -11820,8 +11843,8 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + if (rc) + goto init_err_cleanup_tc; + +- if (BNXT_PF(bp)) +- bnxt_dl_register(bp); ++ bnxt_dl_register(bp); ++ bnxt_dl_fw_reporters_create(bp); + + netdev_info(dev, "%s found at mem %lx, node addr %pM\n", + board_info[ent->driver_data].name, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 5163bb848618..dc26e3ace43f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1658,6 +1658,7 @@ struct bnxt { + #define BNXT_FW_CAP_PCIE_STATS_SUPPORTED 0x00020000 + #define BNXT_FW_CAP_EXT_STATS_SUPPORTED 0x00040000 + #define BNXT_FW_CAP_ERR_RECOVER_RELOAD 0x00100000 ++ #define BNXT_FW_CAP_HOT_RESET 0x00200000 + + #define BNXT_NEW_RM(bp) ((bp)->fw_cap & BNXT_FW_CAP_NEW_RM) + u32 hwrm_spec_code; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +index 7d2cfea05737..1e236e74ff2f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -19,11 +19,10 @@ static int bnxt_fw_reporter_diagnose(struct devlink_health_reporter *reporter, + struct devlink_fmsg *fmsg) + { + struct bnxt *bp = devlink_health_reporter_priv(reporter); +- struct bnxt_fw_health *health = bp->fw_health; + u32 val, health_status; + int rc; + +- if (!health || test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) ++ if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) + return 0; + + val = bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG); +@@ -103,21 +102,15 @@ struct devlink_health_reporter_ops bnxt_dl_fw_fatal_reporter_ops = { + .recover = bnxt_fw_fatal_recover, + }; + +-static void bnxt_dl_fw_reporters_create(struct bnxt *bp) ++void bnxt_dl_fw_reporters_create(struct bnxt *bp) + { + struct bnxt_fw_health *health = bp->fw_health; + +- if (!health) ++ if (!bp->dl || !health) + return; + +- health->fw_reporter = +- devlink_health_reporter_create(bp->dl, &bnxt_dl_fw_reporter_ops, +- 0, false, bp); +- if (IS_ERR(health->fw_reporter)) { +- netdev_warn(bp->dev, "Failed to create FW health reporter, rc = %ld\n", +- PTR_ERR(health->fw_reporter)); +- health->fw_reporter = NULL; +- } ++ if (!(bp->fw_cap & BNXT_FW_CAP_HOT_RESET) || health->fw_reset_reporter) ++ goto err_recovery; + + health->fw_reset_reporter = + devlink_health_reporter_create(bp->dl, +@@ -127,8 +120,30 @@ static void bnxt_dl_fw_reporters_create(struct bnxt *bp) + netdev_warn(bp->dev, "Failed to create FW fatal health reporter, rc = %ld\n", + PTR_ERR(health->fw_reset_reporter)); + health->fw_reset_reporter = NULL; ++ bp->fw_cap &= ~BNXT_FW_CAP_HOT_RESET; ++ } ++ ++err_recovery: ++ if (!(bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY)) ++ return; ++ ++ if (!health->fw_reporter) { ++ health->fw_reporter = ++ devlink_health_reporter_create(bp->dl, ++ &bnxt_dl_fw_reporter_ops, ++ 0, false, bp); ++ if (IS_ERR(health->fw_reporter)) { ++ netdev_warn(bp->dev, "Failed to create FW health reporter, rc = %ld\n", ++ PTR_ERR(health->fw_reporter)); ++ health->fw_reporter = NULL; ++ bp->fw_cap &= ~BNXT_FW_CAP_ERROR_RECOVERY; ++ return; ++ } + } + ++ if (health->fw_fatal_reporter) ++ return; ++ + health->fw_fatal_reporter = + devlink_health_reporter_create(bp->dl, + &bnxt_dl_fw_fatal_reporter_ops, +@@ -137,24 +152,35 @@ static void bnxt_dl_fw_reporters_create(struct bnxt *bp) + netdev_warn(bp->dev, "Failed to create FW fatal health reporter, rc = %ld\n", + PTR_ERR(health->fw_fatal_reporter)); + health->fw_fatal_reporter = NULL; ++ bp->fw_cap &= ~BNXT_FW_CAP_ERROR_RECOVERY; + } + } + +-static void bnxt_dl_fw_reporters_destroy(struct bnxt *bp) ++void bnxt_dl_fw_reporters_destroy(struct bnxt *bp, bool all) + { + struct bnxt_fw_health *health = bp->fw_health; + +- if (!health) ++ if (!bp->dl || !health) + return; + +- if (health->fw_reporter) +- devlink_health_reporter_destroy(health->fw_reporter); +- +- if (health->fw_reset_reporter) ++ if ((all || !(bp->fw_cap & BNXT_FW_CAP_HOT_RESET)) && ++ health->fw_reset_reporter) { + devlink_health_reporter_destroy(health->fw_reset_reporter); ++ health->fw_reset_reporter = NULL; ++ } + +- if (health->fw_fatal_reporter) ++ if ((bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY) && !all) ++ return; ++ ++ if (health->fw_reporter) { ++ devlink_health_reporter_destroy(health->fw_reporter); ++ health->fw_reporter = NULL; ++ } ++ ++ if (health->fw_fatal_reporter) { + devlink_health_reporter_destroy(health->fw_fatal_reporter); ++ health->fw_fatal_reporter = NULL; ++ } + } + + void bnxt_devlink_health_report(struct bnxt *bp, unsigned long event) +@@ -162,9 +188,6 @@ void bnxt_devlink_health_report(struct bnxt *bp, unsigned long event) + struct bnxt_fw_health *fw_health = bp->fw_health; + struct bnxt_fw_reporter_ctx fw_reporter_ctx; + +- if (!fw_health) +- return; +- + fw_reporter_ctx.sp_event = event; + switch (event) { + case BNXT_FW_RESET_NOTIFY_SP_EVENT: +@@ -203,6 +226,8 @@ static const struct devlink_ops bnxt_dl_ops = { + #endif /* CONFIG_BNXT_SRIOV */ + }; + ++static const struct devlink_ops bnxt_vf_dl_ops; ++ + enum bnxt_dl_param_id { + BNXT_DEVLINK_PARAM_ID_BASE = DEVLINK_PARAM_GENERIC_ID_MAX, + BNXT_DEVLINK_PARAM_ID_GRE_VER_CHECK, +@@ -416,7 +441,10 @@ int bnxt_dl_register(struct bnxt *bp) + return -ENOTSUPP; + } + +- dl = devlink_alloc(&bnxt_dl_ops, sizeof(struct bnxt_dl)); ++ if (BNXT_PF(bp)) ++ dl = devlink_alloc(&bnxt_dl_ops, sizeof(struct bnxt_dl)); ++ else ++ dl = devlink_alloc(&bnxt_vf_dl_ops, sizeof(struct bnxt_dl)); + if (!dl) { + netdev_warn(bp->dev, "devlink_alloc failed"); + return -ENOMEM; +@@ -435,6 +463,9 @@ int bnxt_dl_register(struct bnxt *bp) + goto err_dl_free; + } + ++ if (!BNXT_PF(bp)) ++ return 0; ++ + rc = devlink_params_register(dl, bnxt_dl_params, + ARRAY_SIZE(bnxt_dl_params)); + if (rc) { +@@ -462,8 +493,6 @@ int bnxt_dl_register(struct bnxt *bp) + + devlink_params_publish(dl); + +- bnxt_dl_fw_reporters_create(bp); +- + return 0; + + err_dl_port_unreg: +@@ -486,12 +515,14 @@ void bnxt_dl_unregister(struct bnxt *bp) + if (!dl) + return; + +- bnxt_dl_fw_reporters_destroy(bp); +- devlink_port_params_unregister(&bp->dl_port, bnxt_dl_port_params, +- ARRAY_SIZE(bnxt_dl_port_params)); +- devlink_port_unregister(&bp->dl_port); +- devlink_params_unregister(dl, bnxt_dl_params, +- ARRAY_SIZE(bnxt_dl_params)); ++ if (BNXT_PF(bp)) { ++ devlink_port_params_unregister(&bp->dl_port, ++ bnxt_dl_port_params, ++ ARRAY_SIZE(bnxt_dl_port_params)); ++ devlink_port_unregister(&bp->dl_port); ++ devlink_params_unregister(dl, bnxt_dl_params, ++ ARRAY_SIZE(bnxt_dl_params)); ++ } + devlink_unregister(dl); + devlink_free(dl); + } +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h +index 2f4fd0a7d04b..689c47ab2155 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h +@@ -57,6 +57,8 @@ struct bnxt_dl_nvm_param { + }; + + void bnxt_devlink_health_report(struct bnxt *bp, unsigned long event); ++void bnxt_dl_fw_reporters_create(struct bnxt *bp); ++void bnxt_dl_fw_reporters_destroy(struct bnxt *bp, bool all); + int bnxt_dl_register(struct bnxt *bp); + void bnxt_dl_unregister(struct bnxt *bp); + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 89f95428556e..ece70f61c89a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -3064,8 +3064,15 @@ static int bnxt_hwrm_dbg_dma_data(struct bnxt *bp, void *msg, int msg_len, + } + } + +- if (info->dest_buf) +- memcpy(info->dest_buf + off, dma_buf, len); ++ if (info->dest_buf) { ++ if ((info->seg_start + off + len) <= ++ BNXT_COREDUMP_BUF_LEN(info->buf_len)) { ++ memcpy(info->dest_buf + off, dma_buf, len); ++ } else { ++ rc = -ENOBUFS; ++ break; ++ } ++ } + + if (cmn_req->req_type == + cpu_to_le16(HWRM_DBG_COREDUMP_RETRIEVE)) +@@ -3119,7 +3126,7 @@ static int bnxt_hwrm_dbg_coredump_initiate(struct bnxt *bp, u16 component_id, + + static int bnxt_hwrm_dbg_coredump_retrieve(struct bnxt *bp, u16 component_id, + u16 segment_id, u32 *seg_len, +- void *buf, u32 offset) ++ void *buf, u32 buf_len, u32 offset) + { + struct hwrm_dbg_coredump_retrieve_input req = {0}; + struct bnxt_hwrm_dbg_dma_info info = {NULL}; +@@ -3134,8 +3141,11 @@ static int bnxt_hwrm_dbg_coredump_retrieve(struct bnxt *bp, u16 component_id, + seq_no); + info.data_len_off = offsetof(struct hwrm_dbg_coredump_retrieve_output, + data_len); +- if (buf) ++ if (buf) { + info.dest_buf = buf + offset; ++ info.buf_len = buf_len; ++ info.seg_start = offset; ++ } + + rc = bnxt_hwrm_dbg_dma_data(bp, &req, sizeof(req), &info); + if (!rc) +@@ -3225,14 +3235,17 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record, + static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len) + { + u32 ver_get_resp_len = sizeof(struct hwrm_ver_get_output); ++ u32 offset = 0, seg_hdr_len, seg_record_len, buf_len = 0; + struct coredump_segment_record *seg_record = NULL; +- u32 offset = 0, seg_hdr_len, seg_record_len; + struct bnxt_coredump_segment_hdr seg_hdr; + struct bnxt_coredump coredump = {NULL}; + time64_t start_time; + u16 start_utc; + int rc = 0, i; + ++ if (buf) ++ buf_len = *dump_len; ++ + start_time = ktime_get_real_seconds(); + start_utc = sys_tz.tz_minuteswest * 60; + seg_hdr_len = sizeof(seg_hdr); +@@ -3265,6 +3278,12 @@ static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len) + u32 duration = 0, seg_len = 0; + unsigned long start, end; + ++ if (buf && ((offset + seg_hdr_len) > ++ BNXT_COREDUMP_BUF_LEN(buf_len))) { ++ rc = -ENOBUFS; ++ goto err; ++ } ++ + start = jiffies; + + rc = bnxt_hwrm_dbg_coredump_initiate(bp, comp_id, seg_id); +@@ -3277,9 +3296,11 @@ static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len) + + /* Write segment data into the buffer */ + rc = bnxt_hwrm_dbg_coredump_retrieve(bp, comp_id, seg_id, +- &seg_len, buf, ++ &seg_len, buf, buf_len, + offset + seg_hdr_len); +- if (rc) ++ if (rc && rc == -ENOBUFS) ++ goto err; ++ else if (rc) + netdev_err(bp->dev, + "Failed to retrieve coredump for seg = %d\n", + seg_record->segment_id); +@@ -3309,7 +3330,8 @@ err: + rc); + kfree(coredump.data); + *dump_len += sizeof(struct bnxt_coredump_record); +- ++ if (rc == -ENOBUFS) ++ netdev_err(bp->dev, "Firmware returned large coredump buffer"); + return rc; + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h +index b5b65b3f8534..3998f6e809a9 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h +@@ -31,6 +31,8 @@ struct bnxt_coredump { + u16 total_segs; + }; + ++#define BNXT_COREDUMP_BUF_LEN(len) ((len) - sizeof(struct bnxt_coredump_record)) ++ + struct bnxt_hwrm_dbg_dma_info { + void *dest_buf; + int dest_buf_size; +@@ -38,6 +40,8 @@ struct bnxt_hwrm_dbg_dma_info { + u16 seq_off; + u16 data_len_off; + u16 segs; ++ u32 seg_start; ++ u32 buf_len; + }; + + struct hwrm_dbg_cmn_input { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +index b2c160947fc8..30816ec4fa91 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +@@ -113,8 +113,10 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id, + { + struct net_device *dev = edev->net; + struct bnxt *bp = netdev_priv(dev); ++ struct bnxt_hw_resc *hw_resc; + int max_idx, max_cp_rings; + int avail_msix, idx; ++ int total_vecs; + int rc = 0; + + ASSERT_RTNL(); +@@ -142,7 +144,10 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id, + } + edev->ulp_tbl[ulp_id].msix_base = idx; + edev->ulp_tbl[ulp_id].msix_requested = avail_msix; +- if (bp->total_irqs < (idx + avail_msix)) { ++ hw_resc = &bp->hw_resc; ++ total_vecs = idx + avail_msix; ++ if (bp->total_irqs < total_vecs || ++ (BNXT_NEW_RM(bp) && hw_resc->resv_irqs < total_vecs)) { + if (netif_running(dev)) { + bnxt_close_nic(bp, true, false); + rc = bnxt_open_nic(bp, true, false); +@@ -156,7 +161,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id, + } + + if (BNXT_NEW_RM(bp)) { +- struct bnxt_hw_resc *hw_resc = &bp->hw_resc; + int resv_msix; + + resv_msix = hw_resc->resv_irqs - bp->cp_nr_rings; +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h +index 1fbb640e896a..4025a683fa7d 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h +@@ -503,6 +503,7 @@ struct link_config { + + enum cc_pause requested_fc; /* flow control user has requested */ + enum cc_pause fc; /* actual link flow control */ ++ enum cc_pause advertised_fc; /* actual advertised flow control */ + + enum cc_fec requested_fec; /* Forward Error Correction: */ + enum cc_fec fec; /* requested and actual in use */ +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c +index 76538f4cd595..f537be9cb315 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c +@@ -793,8 +793,8 @@ static void get_pauseparam(struct net_device *dev, + struct port_info *p = netdev_priv(dev); + + epause->autoneg = (p->link_cfg.requested_fc & PAUSE_AUTONEG) != 0; +- epause->rx_pause = (p->link_cfg.fc & PAUSE_RX) != 0; +- epause->tx_pause = (p->link_cfg.fc & PAUSE_TX) != 0; ++ epause->rx_pause = (p->link_cfg.advertised_fc & PAUSE_RX) != 0; ++ epause->tx_pause = (p->link_cfg.advertised_fc & PAUSE_TX) != 0; + } + + static int set_pauseparam(struct net_device *dev, +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index f2a7824da42b..3f6813daf3c1 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -4089,7 +4089,8 @@ static inline fw_port_cap32_t cc_to_fwcap_pause(enum cc_pause cc_pause) + if (cc_pause & PAUSE_TX) + fw_pause |= FW_PORT_CAP32_802_3_PAUSE; + else +- fw_pause |= FW_PORT_CAP32_802_3_ASM_DIR; ++ fw_pause |= FW_PORT_CAP32_802_3_ASM_DIR | ++ FW_PORT_CAP32_802_3_PAUSE; + } else if (cc_pause & PAUSE_TX) { + fw_pause |= FW_PORT_CAP32_802_3_ASM_DIR; + } +@@ -8563,17 +8564,17 @@ static fw_port_cap32_t lstatus_to_fwcap(u32 lstatus) + void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl) + { + const struct fw_port_cmd *cmd = (const void *)rpl; +- int action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); +- struct adapter *adapter = pi->adapter; ++ fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; + struct link_config *lc = &pi->link_cfg; +- int link_ok, linkdnrc; +- enum fw_port_type port_type; ++ struct adapter *adapter = pi->adapter; ++ unsigned int speed, fc, fec, adv_fc; + enum fw_port_module_type mod_type; +- unsigned int speed, fc, fec; +- fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; ++ int action, link_ok, linkdnrc; ++ enum fw_port_type port_type; + + /* Extract the various fields from the Port Information message. + */ ++ action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); + switch (action) { + case FW_PORT_ACTION_GET_PORT_INFO: { + u32 lstatus = be32_to_cpu(cmd->u.info.lstatus_to_modtype); +@@ -8611,6 +8612,7 @@ void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl) + } + + fec = fwcap_to_cc_fec(acaps); ++ adv_fc = fwcap_to_cc_pause(acaps); + fc = fwcap_to_cc_pause(linkattr); + speed = fwcap_to_speed(linkattr); + +@@ -8667,7 +8669,9 @@ void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl) + } + + if (link_ok != lc->link_ok || speed != lc->speed || +- fc != lc->fc || fec != lc->fec) { /* something changed */ ++ fc != lc->fc || adv_fc != lc->advertised_fc || ++ fec != lc->fec) { ++ /* something changed */ + if (!link_ok && lc->link_ok) { + lc->link_down_rc = linkdnrc; + dev_warn_ratelimited(adapter->pdev_dev, +@@ -8677,6 +8681,7 @@ void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl) + } + lc->link_ok = link_ok; + lc->speed = speed; ++ lc->advertised_fc = adv_fc; + lc->fc = fc; + lc->fec = fec; + +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +index f6fc0875d5b0..f4d41f968afa 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +@@ -1690,8 +1690,8 @@ static void cxgb4vf_get_pauseparam(struct net_device *dev, + struct port_info *pi = netdev_priv(dev); + + pauseparam->autoneg = (pi->link_cfg.requested_fc & PAUSE_AUTONEG) != 0; +- pauseparam->rx_pause = (pi->link_cfg.fc & PAUSE_RX) != 0; +- pauseparam->tx_pause = (pi->link_cfg.fc & PAUSE_TX) != 0; ++ pauseparam->rx_pause = (pi->link_cfg.advertised_fc & PAUSE_RX) != 0; ++ pauseparam->tx_pause = (pi->link_cfg.advertised_fc & PAUSE_TX) != 0; + } + + /* +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h +index ccca67cf4487..57cfd10a99ec 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h +@@ -135,6 +135,7 @@ struct link_config { + + enum cc_pause requested_fc; /* flow control user has requested */ + enum cc_pause fc; /* actual link flow control */ ++ enum cc_pause advertised_fc; /* actual advertised flow control */ + + enum cc_fec auto_fec; /* Forward Error Correction: */ + enum cc_fec requested_fec; /* "automatic" (IEEE 802.3), */ +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c +index 8a389d617a23..9d49ff211cc1 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c +@@ -1913,16 +1913,16 @@ static const char *t4vf_link_down_rc_str(unsigned char link_down_rc) + static void t4vf_handle_get_port_info(struct port_info *pi, + const struct fw_port_cmd *cmd) + { +- int action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); +- struct adapter *adapter = pi->adapter; ++ fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; + struct link_config *lc = &pi->link_cfg; +- int link_ok, linkdnrc; +- enum fw_port_type port_type; ++ struct adapter *adapter = pi->adapter; ++ unsigned int speed, fc, fec, adv_fc; + enum fw_port_module_type mod_type; +- unsigned int speed, fc, fec; +- fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; ++ int action, link_ok, linkdnrc; ++ enum fw_port_type port_type; + + /* Extract the various fields from the Port Information message. */ ++ action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); + switch (action) { + case FW_PORT_ACTION_GET_PORT_INFO: { + u32 lstatus = be32_to_cpu(cmd->u.info.lstatus_to_modtype); +@@ -1982,6 +1982,7 @@ static void t4vf_handle_get_port_info(struct port_info *pi, + } + + fec = fwcap_to_cc_fec(acaps); ++ adv_fc = fwcap_to_cc_pause(acaps); + fc = fwcap_to_cc_pause(linkattr); + speed = fwcap_to_speed(linkattr); + +@@ -2012,7 +2013,9 @@ static void t4vf_handle_get_port_info(struct port_info *pi, + } + + if (link_ok != lc->link_ok || speed != lc->speed || +- fc != lc->fc || fec != lc->fec) { /* something changed */ ++ fc != lc->fc || adv_fc != lc->advertised_fc || ++ fec != lc->fec) { ++ /* something changed */ + if (!link_ok && lc->link_ok) { + lc->link_down_rc = linkdnrc; + dev_warn_ratelimited(adapter->pdev_dev, +@@ -2022,6 +2025,7 @@ static void t4vf_handle_get_port_info(struct port_info *pi, + } + lc->link_ok = link_ok; + lc->speed = speed; ++ lc->advertised_fc = adv_fc; + lc->fc = fc; + lc->fec = fec; + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 111b3b8239e1..ef44c6979a31 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -3674,7 +3674,7 @@ static int mvpp2_open(struct net_device *dev) + valid = true; + } + +- if (priv->hw_version == MVPP22 && port->link_irq && !port->phylink) { ++ if (priv->hw_version == MVPP22 && port->link_irq) { + err = request_irq(port->link_irq, mvpp2_link_status_isr, 0, + dev->name, port); + if (err) { +diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c +index 544344ac4894..79057af4fe99 100644 +--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c ++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include "mlxfw_mfa2.h" + #include "mlxfw_mfa2_file.h" +@@ -548,7 +549,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file, + comp_size = be32_to_cpu(comp->size); + comp_buf_size = comp_size + mlxfw_mfa2_comp_magic_len; + +- comp_data = kmalloc(sizeof(*comp_data) + comp_buf_size, GFP_KERNEL); ++ comp_data = vzalloc(sizeof(*comp_data) + comp_buf_size); + if (!comp_data) + return ERR_PTR(-ENOMEM); + comp_data->comp.data_size = comp_size; +@@ -570,7 +571,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file, + comp_data->comp.data = comp_data->buff + mlxfw_mfa2_comp_magic_len; + return &comp_data->comp; + err_out: +- kfree(comp_data); ++ vfree(comp_data); + return ERR_PTR(err); + } + +@@ -579,7 +580,7 @@ void mlxfw_mfa2_file_component_put(struct mlxfw_mfa2_component *comp) + const struct mlxfw_mfa2_comp_data *comp_data; + + comp_data = container_of(comp, struct mlxfw_mfa2_comp_data, comp); +- kfree(comp_data); ++ vfree(comp_data); + } + + void mlxfw_mfa2_file_fini(struct mlxfw_mfa2_file *mfa2_file) +diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h +index 5494cf93f34c..8e42ebdbd487 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h +@@ -5421,6 +5421,7 @@ enum mlxsw_reg_htgt_trap_group { + MLXSW_REG_HTGT_TRAP_GROUP_SP_LBERROR, + MLXSW_REG_HTGT_TRAP_GROUP_SP_PTP0, + MLXSW_REG_HTGT_TRAP_GROUP_SP_PTP1, ++ MLXSW_REG_HTGT_TRAP_GROUP_SP_VRRP, + + __MLXSW_REG_HTGT_TRAP_GROUP_MAX, + MLXSW_REG_HTGT_TRAP_GROUP_MAX = __MLXSW_REG_HTGT_TRAP_GROUP_MAX - 1 +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index dcf9562bce8a..3ec18fb0d479 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -4398,8 +4398,8 @@ static const struct mlxsw_listener mlxsw_sp_listener[] = { + MLXSW_SP_RXL_MARK(ROUTER_ALERT_IPV6, TRAP_TO_CPU, ROUTER_EXP, false), + MLXSW_SP_RXL_MARK(IPIP_DECAP_ERROR, TRAP_TO_CPU, ROUTER_EXP, false), + MLXSW_SP_RXL_MARK(DECAP_ECN0, TRAP_TO_CPU, ROUTER_EXP, false), +- MLXSW_SP_RXL_MARK(IPV4_VRRP, TRAP_TO_CPU, ROUTER_EXP, false), +- MLXSW_SP_RXL_MARK(IPV6_VRRP, TRAP_TO_CPU, ROUTER_EXP, false), ++ MLXSW_SP_RXL_MARK(IPV4_VRRP, TRAP_TO_CPU, VRRP, false), ++ MLXSW_SP_RXL_MARK(IPV6_VRRP, TRAP_TO_CPU, VRRP, false), + /* PKT Sample trap */ + MLXSW_RXL(mlxsw_sp_rx_listener_sample_func, PKT_SAMPLE, MIRROR_TO_CPU, + false, SP_IP2ME, DISCARD), +@@ -4483,6 +4483,10 @@ static int mlxsw_sp_cpu_policers_set(struct mlxsw_core *mlxsw_core) + rate = 19 * 1024; + burst_size = 12; + break; ++ case MLXSW_REG_HTGT_TRAP_GROUP_SP_VRRP: ++ rate = 360; ++ burst_size = 7; ++ break; + default: + continue; + } +@@ -4522,6 +4526,7 @@ static int mlxsw_sp_trap_groups_set(struct mlxsw_core *mlxsw_core) + case MLXSW_REG_HTGT_TRAP_GROUP_SP_OSPF: + case MLXSW_REG_HTGT_TRAP_GROUP_SP_PIM: + case MLXSW_REG_HTGT_TRAP_GROUP_SP_PTP0: ++ case MLXSW_REG_HTGT_TRAP_GROUP_SP_VRRP: + priority = 5; + tc = 5; + break; +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 210ebc91d3d6..efdf8cb5114c 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -6985,6 +6985,9 @@ static int mlxsw_sp_router_port_check_rif_addr(struct mlxsw_sp *mlxsw_sp, + + for (i = 0; i < MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_RIFS); i++) { + rif = mlxsw_sp->router->rifs[i]; ++ if (rif && rif->ops && ++ rif->ops->type == MLXSW_SP_RIF_TYPE_IPIP_LB) ++ continue; + if (rif && rif->dev && rif->dev != dev && + !ether_addr_equal_masked(rif->dev->dev_addr, dev_addr, + mlxsw_sp->mac_mask)) { +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +index 306da8f6b7d5..33ce139f090f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +@@ -112,6 +112,14 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac) + struct device *dev = dwmac->dev; + const char *parent_name, *mux_parent_names[MUX_CLK_NUM_PARENTS]; + struct meson8b_dwmac_clk_configs *clk_configs; ++ static const struct clk_div_table div_table[] = { ++ { .div = 2, .val = 2, }, ++ { .div = 3, .val = 3, }, ++ { .div = 4, .val = 4, }, ++ { .div = 5, .val = 5, }, ++ { .div = 6, .val = 6, }, ++ { .div = 7, .val = 7, }, ++ }; + + clk_configs = devm_kzalloc(dev, sizeof(*clk_configs), GFP_KERNEL); + if (!clk_configs) +@@ -146,9 +154,9 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac) + clk_configs->m250_div.reg = dwmac->regs + PRG_ETH0; + clk_configs->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT; + clk_configs->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH; +- clk_configs->m250_div.flags = CLK_DIVIDER_ONE_BASED | +- CLK_DIVIDER_ALLOW_ZERO | +- CLK_DIVIDER_ROUND_CLOSEST; ++ clk_configs->m250_div.table = div_table; ++ clk_configs->m250_div.flags = CLK_DIVIDER_ALLOW_ZERO | ++ CLK_DIVIDER_ROUND_CLOSEST; + clk = meson8b_dwmac_register_clk(dwmac, "m250_div", &parent_name, 1, + &clk_divider_ops, + &clk_configs->m250_div.hw); +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index ecfe26215935..fca471e27f39 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -38,7 +38,6 @@ struct pdp_ctx { + struct hlist_node hlist_addr; + + union { +- u64 tid; + struct { + u64 tid; + u16 flow; +@@ -541,7 +540,7 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev, + mtu = dst_mtu(&rt->dst); + } + +- rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu); ++ rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu, false); + + if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) && + mtu < ntohs(iph->tot_len)) { +@@ -641,9 +640,16 @@ static void gtp_link_setup(struct net_device *dev) + } + + static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize); +-static void gtp_hashtable_free(struct gtp_dev *gtp); + static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]); + ++static void gtp_destructor(struct net_device *dev) ++{ ++ struct gtp_dev *gtp = netdev_priv(dev); ++ ++ kfree(gtp->addr_hash); ++ kfree(gtp->tid_hash); ++} ++ + static int gtp_newlink(struct net *src_net, struct net_device *dev, + struct nlattr *tb[], struct nlattr *data[], + struct netlink_ext_ack *extack) +@@ -661,10 +667,13 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, + if (err < 0) + return err; + +- if (!data[IFLA_GTP_PDP_HASHSIZE]) ++ if (!data[IFLA_GTP_PDP_HASHSIZE]) { + hashsize = 1024; +- else ++ } else { + hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]); ++ if (!hashsize) ++ hashsize = 1024; ++ } + + err = gtp_hashtable_new(gtp, hashsize); + if (err < 0) +@@ -678,13 +687,15 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, + + gn = net_generic(dev_net(dev), gtp_net_id); + list_add_rcu(>p->list, &gn->gtp_dev_list); ++ dev->priv_destructor = gtp_destructor; + + netdev_dbg(dev, "registered new GTP interface\n"); + + return 0; + + out_hashtable: +- gtp_hashtable_free(gtp); ++ kfree(gtp->addr_hash); ++ kfree(gtp->tid_hash); + out_encap: + gtp_encap_disable(gtp); + return err; +@@ -693,8 +704,13 @@ out_encap: + static void gtp_dellink(struct net_device *dev, struct list_head *head) + { + struct gtp_dev *gtp = netdev_priv(dev); ++ struct pdp_ctx *pctx; ++ int i; ++ ++ for (i = 0; i < gtp->hash_size; i++) ++ hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) ++ pdp_context_delete(pctx); + +- gtp_hashtable_free(gtp); + list_del_rcu(>p->list); + unregister_netdevice_queue(dev, head); + } +@@ -772,20 +788,6 @@ err1: + return -ENOMEM; + } + +-static void gtp_hashtable_free(struct gtp_dev *gtp) +-{ +- struct pdp_ctx *pctx; +- int i; +- +- for (i = 0; i < gtp->hash_size; i++) +- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) +- pdp_context_delete(pctx); +- +- synchronize_rcu(); +- kfree(gtp->addr_hash); +- kfree(gtp->tid_hash); +-} +- + static struct sock *gtp_encap_enable_socket(int fd, int type, + struct gtp_dev *gtp) + { +@@ -926,24 +928,31 @@ static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info) + } + } + +-static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, +- struct genl_info *info) ++static int gtp_pdp_add(struct gtp_dev *gtp, struct sock *sk, ++ struct genl_info *info) + { ++ struct pdp_ctx *pctx, *pctx_tid = NULL; + struct net_device *dev = gtp->dev; + u32 hash_ms, hash_tid = 0; +- struct pdp_ctx *pctx; ++ unsigned int version; + bool found = false; + __be32 ms_addr; + + ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]); + hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size; ++ version = nla_get_u32(info->attrs[GTPA_VERSION]); + +- hlist_for_each_entry_rcu(pctx, >p->addr_hash[hash_ms], hlist_addr) { +- if (pctx->ms_addr_ip4.s_addr == ms_addr) { +- found = true; +- break; +- } +- } ++ pctx = ipv4_pdp_find(gtp, ms_addr); ++ if (pctx) ++ found = true; ++ if (version == GTP_V0) ++ pctx_tid = gtp0_pdp_find(gtp, ++ nla_get_u64(info->attrs[GTPA_TID])); ++ else if (version == GTP_V1) ++ pctx_tid = gtp1_pdp_find(gtp, ++ nla_get_u32(info->attrs[GTPA_I_TEI])); ++ if (pctx_tid) ++ found = true; + + if (found) { + if (info->nlhdr->nlmsg_flags & NLM_F_EXCL) +@@ -951,6 +960,11 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, + if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE) + return -EOPNOTSUPP; + ++ if (pctx && pctx_tid) ++ return -EEXIST; ++ if (!pctx) ++ pctx = pctx_tid; ++ + ipv4_pdp_fill(pctx, info); + + if (pctx->gtp_version == GTP_V0) +@@ -1074,7 +1088,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) + goto out_unlock; + } + +- err = ipv4_pdp_add(gtp, sk, info); ++ err = gtp_pdp_add(gtp, sk, info); + + out_unlock: + rcu_read_unlock(); +@@ -1232,43 +1246,46 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb, + struct netlink_callback *cb) + { + struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp; ++ int i, j, bucket = cb->args[0], skip = cb->args[1]; + struct net *net = sock_net(skb->sk); +- struct gtp_net *gn = net_generic(net, gtp_net_id); +- unsigned long tid = cb->args[1]; +- int i, k = cb->args[0], ret; + struct pdp_ctx *pctx; ++ struct gtp_net *gn; ++ ++ gn = net_generic(net, gtp_net_id); + + if (cb->args[4]) + return 0; + ++ rcu_read_lock(); + list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) { + if (last_gtp && last_gtp != gtp) + continue; + else + last_gtp = NULL; + +- for (i = k; i < gtp->hash_size; i++) { +- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) { +- if (tid && tid != pctx->u.tid) +- continue; +- else +- tid = 0; +- +- ret = gtp_genl_fill_info(skb, +- NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- cb->nlh->nlmsg_type, pctx); +- if (ret < 0) { ++ for (i = bucket; i < gtp->hash_size; i++) { ++ j = 0; ++ hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], ++ hlist_tid) { ++ if (j >= skip && ++ gtp_genl_fill_info(skb, ++ NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ cb->nlh->nlmsg_type, pctx)) { + cb->args[0] = i; +- cb->args[1] = pctx->u.tid; ++ cb->args[1] = j; + cb->args[2] = (unsigned long)gtp; + goto out; + } ++ j++; + } ++ skip = 0; + } ++ bucket = 0; + } + cb->args[4] = 1; + out: ++ rcu_read_unlock(); + return skb->len; + } + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index 23281aeeb222..71d6629e65c9 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -654,10 +654,10 @@ static void sixpack_close(struct tty_struct *tty) + { + struct sixpack *sp; + +- write_lock_bh(&disc_data_lock); ++ write_lock_irq(&disc_data_lock); + sp = tty->disc_data; + tty->disc_data = NULL; +- write_unlock_bh(&disc_data_lock); ++ write_unlock_irq(&disc_data_lock); + if (!sp) + return; + +diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c +index c5bfa19ddb93..deef14215110 100644 +--- a/drivers/net/hamradio/mkiss.c ++++ b/drivers/net/hamradio/mkiss.c +@@ -773,10 +773,10 @@ static void mkiss_close(struct tty_struct *tty) + { + struct mkiss *ax; + +- write_lock_bh(&disc_data_lock); ++ write_lock_irq(&disc_data_lock); + ax = tty->disc_data; + tty->disc_data = NULL; +- write_unlock_bh(&disc_data_lock); ++ write_unlock_irq(&disc_data_lock); + + if (!ax) + return; +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index abaf8156d19d..e3d3c9097ff1 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -1165,6 +1165,9 @@ int rndis_set_subchannel(struct net_device *ndev, + wait_event(nvdev->subchan_open, + atomic_read(&nvdev->open_chn) == nvdev->num_chn); + ++ for (i = 0; i < VRSS_SEND_TAB_SIZE; i++) ++ ndev_ctx->tx_table[i] = i % nvdev->num_chn; ++ + /* ignore failures from setting rss parameters, still have channels */ + if (dev_info) + rndis_filter_set_rss_param(rdev, dev_info->rss_key); +@@ -1174,9 +1177,6 @@ int rndis_set_subchannel(struct net_device *ndev, + netif_set_real_num_tx_queues(ndev, nvdev->num_chn); + netif_set_real_num_rx_queues(ndev, nvdev->num_chn); + +- for (i = 0; i < VRSS_SEND_TAB_SIZE; i++) +- ndev_ctx->tx_table[i] = i % nvdev->num_chn; +- + return 0; + } + +diff --git a/drivers/net/phy/aquantia_main.c b/drivers/net/phy/aquantia_main.c +index 3b29d381116f..975789d9349d 100644 +--- a/drivers/net/phy/aquantia_main.c ++++ b/drivers/net/phy/aquantia_main.c +@@ -627,6 +627,8 @@ static struct phy_driver aqr_driver[] = { + .config_intr = aqr_config_intr, + .ack_interrupt = aqr_ack_interrupt, + .read_status = aqr_read_status, ++ .suspend = aqr107_suspend, ++ .resume = aqr107_resume, + }, + { + PHY_ID_MATCH_MODEL(PHY_ID_AQR106), +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 536236fdb232..bf5bbb565cf5 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -444,8 +444,7 @@ static void phylink_mac_link_up(struct phylink *pl, + + pl->cur_interface = link_state.interface; + pl->ops->mac_link_up(pl->config, pl->link_an_mode, +- pl->phy_state.interface, +- pl->phydev); ++ pl->cur_interface, pl->phydev); + + if (ndev) + netif_carrier_on(ndev); +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 040cec17d3ad..b0b7eca1754e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -1111,18 +1111,18 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + /* same thing for QuZ... */ + if (iwl_trans->hw_rev == CSR_HW_REV_TYPE_QUZ) { +- if (iwl_trans->cfg == &iwl_ax101_cfg_qu_hr) +- iwl_trans->cfg = &iwl_ax101_cfg_quz_hr; +- else if (iwl_trans->cfg == &iwl_ax201_cfg_qu_hr) +- iwl_trans->cfg = &iwl_ax201_cfg_quz_hr; +- else if (iwl_trans->cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0) +- iwl_trans->cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc; +- else if (iwl_trans->cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0) +- iwl_trans->cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc; +- else if (iwl_trans->cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0) +- iwl_trans->cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc; +- else if (iwl_trans->cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0) +- iwl_trans->cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc; ++ if (cfg == &iwl_ax101_cfg_qu_hr) ++ cfg = &iwl_ax101_cfg_quz_hr; ++ else if (cfg == &iwl_ax201_cfg_qu_hr) ++ cfg = &iwl_ax201_cfg_quz_hr; ++ else if (cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0) ++ cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc; ++ else if (cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0) ++ cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc; ++ else if (cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0) ++ cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc; ++ else if (cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0) ++ cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc; + } + + #endif +diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c +index 3e9f45aec8d1..5129543a0473 100644 +--- a/drivers/nvdimm/btt.c ++++ b/drivers/nvdimm/btt.c +@@ -1261,11 +1261,11 @@ static int btt_read_pg(struct btt *btt, struct bio_integrity_payload *bip, + + ret = btt_data_read(arena, page, off, postmap, cur_len); + if (ret) { +- int rc; +- + /* Media error - set the e_flag */ +- rc = btt_map_write(arena, premap, postmap, 0, 1, +- NVDIMM_IO_ATOMIC); ++ if (btt_map_write(arena, premap, postmap, 0, 1, NVDIMM_IO_ATOMIC)) ++ dev_warn_ratelimited(to_dev(arena), ++ "Error persistently tracking bad blocks at %#x\n", ++ premap); + goto out_rtt; + } + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 92e895d86458..ca7823eef2b4 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -1146,8 +1146,10 @@ static void attach_node_and_children(struct device_node *np) + full_name = kasprintf(GFP_KERNEL, "%pOF", np); + + if (!strcmp(full_name, "/__local_fixups__") || +- !strcmp(full_name, "/__fixups__")) ++ !strcmp(full_name, "/__fixups__")) { ++ kfree(full_name); + return; ++ } + + dup = of_find_node_by_path(full_name); + kfree(full_name); +diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c +index 18627bb21e9e..32eab1776cfe 100644 +--- a/drivers/pci/hotplug/rpaphp_core.c ++++ b/drivers/pci/hotplug/rpaphp_core.c +@@ -154,11 +154,11 @@ static enum pci_bus_speed get_max_bus_speed(struct slot *slot) + return speed; + } + +-static int get_children_props(struct device_node *dn, const int **drc_indexes, +- const int **drc_names, const int **drc_types, +- const int **drc_power_domains) ++static int get_children_props(struct device_node *dn, const __be32 **drc_indexes, ++ const __be32 **drc_names, const __be32 **drc_types, ++ const __be32 **drc_power_domains) + { +- const int *indexes, *names, *types, *domains; ++ const __be32 *indexes, *names, *types, *domains; + + indexes = of_get_property(dn, "ibm,drc-indexes", NULL); + names = of_get_property(dn, "ibm,drc-names", NULL); +@@ -194,8 +194,8 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name, + char *drc_type, unsigned int my_index) + { + char *name_tmp, *type_tmp; +- const int *indexes, *names; +- const int *types, *domains; ++ const __be32 *indexes, *names; ++ const __be32 *types, *domains; + int i, rc; + + rc = get_children_props(dn->parent, &indexes, &names, &types, &domains); +@@ -208,7 +208,7 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name, + + /* Iterate through parent properties, looking for my-drc-index */ + for (i = 0; i < be32_to_cpu(indexes[0]); i++) { +- if ((unsigned int) indexes[i + 1] == my_index) ++ if (be32_to_cpu(indexes[i + 1]) == my_index) + break; + + name_tmp += (strlen(name_tmp) + 1); +@@ -239,6 +239,8 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name, + value = of_prop_next_u32(info, NULL, &entries); + if (!value) + return -EINVAL; ++ else ++ value++; + + for (j = 0; j < entries; j++) { + of_read_drc_info_cell(&info, &value, &drc); +@@ -246,9 +248,10 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name, + /* Should now know end of current entry */ + + /* Found it */ +- if (my_index <= drc.last_drc_index) { ++ if (my_index >= drc.drc_index_start && my_index <= drc.last_drc_index) { ++ int index = my_index - drc.drc_index_start; + sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix, +- my_index); ++ drc.drc_name_suffix_start + index); + break; + } + } +@@ -265,7 +268,7 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name, + int rpaphp_check_drc_props(struct device_node *dn, char *drc_name, + char *drc_type) + { +- const unsigned int *my_index; ++ const __be32 *my_index; + + my_index = of_get_property(dn, "ibm,my-drc-index", NULL); + if (!my_index) { +@@ -273,12 +276,12 @@ int rpaphp_check_drc_props(struct device_node *dn, char *drc_name, + return -EINVAL; + } + +- if (firmware_has_feature(FW_FEATURE_DRC_INFO)) ++ if (of_find_property(dn->parent, "ibm,drc-info", NULL)) + return rpaphp_check_drc_props_v2(dn, drc_name, drc_type, +- *my_index); ++ be32_to_cpu(*my_index)); + else + return rpaphp_check_drc_props_v1(dn, drc_name, drc_type, +- *my_index); ++ be32_to_cpu(*my_index)); + } + EXPORT_SYMBOL_GPL(rpaphp_check_drc_props); + +@@ -309,10 +312,11 @@ static int is_php_type(char *drc_type) + * for built-in pci slots (even when the built-in slots are + * dlparable.) + */ +-static int is_php_dn(struct device_node *dn, const int **indexes, +- const int **names, const int **types, const int **power_domains) ++static int is_php_dn(struct device_node *dn, const __be32 **indexes, ++ const __be32 **names, const __be32 **types, ++ const __be32 **power_domains) + { +- const int *drc_types; ++ const __be32 *drc_types; + int rc; + + rc = get_children_props(dn, indexes, names, &drc_types, power_domains); +@@ -347,7 +351,7 @@ int rpaphp_add_slot(struct device_node *dn) + struct slot *slot; + int retval = 0; + int i; +- const int *indexes, *names, *types, *power_domains; ++ const __be32 *indexes, *names, *types, *power_domains; + char *name, *type; + + if (!dn->name || strcmp(dn->name, "pci")) +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index ae21d08c65e8..1cab99320514 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -806,7 +806,6 @@ config PEAQ_WMI + tristate "PEAQ 2-in-1 WMI hotkey driver" + depends on ACPI_WMI + depends on INPUT +- select INPUT_POLLDEV + help + Say Y here if you want to support WMI-based hotkeys on PEAQ 2-in-1s. + +diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c +index 94a008efb09b..571b4754477c 100644 +--- a/drivers/platform/x86/intel_pmc_core.c ++++ b/drivers/platform/x86/intel_pmc_core.c +@@ -158,8 +158,9 @@ static const struct pmc_reg_map spt_reg_map = { + .pm_vric1_offset = SPT_PMC_VRIC1_OFFSET, + }; + +-/* Cannonlake: PGD PFET Enable Ack Status Register(s) bitmap */ ++/* Cannon Lake: PGD PFET Enable Ack Status Register(s) bitmap */ + static const struct pmc_bit_map cnp_pfear_map[] = { ++ /* Reserved for Cannon Lake but valid for Comet Lake */ + {"PMC", BIT(0)}, + {"OPI-DMI", BIT(1)}, + {"SPI/eSPI", BIT(2)}, +@@ -185,7 +186,7 @@ static const struct pmc_bit_map cnp_pfear_map[] = { + {"SDX", BIT(4)}, + {"SPE", BIT(5)}, + {"Fuse", BIT(6)}, +- /* Reserved for Cannonlake but valid for Icelake */ ++ /* Reserved for Cannon Lake but valid for Ice Lake and Comet Lake */ + {"SBR8", BIT(7)}, + + {"CSME_FSC", BIT(0)}, +@@ -229,12 +230,12 @@ static const struct pmc_bit_map cnp_pfear_map[] = { + {"HDA_PGD4", BIT(2)}, + {"HDA_PGD5", BIT(3)}, + {"HDA_PGD6", BIT(4)}, +- /* Reserved for Cannonlake but valid for Icelake */ ++ /* Reserved for Cannon Lake but valid for Ice Lake and Comet Lake */ + {"PSF6", BIT(5)}, + {"PSF7", BIT(6)}, + {"PSF8", BIT(7)}, + +- /* Icelake generation onwards only */ ++ /* Ice Lake generation onwards only */ + {"RES_65", BIT(0)}, + {"RES_66", BIT(1)}, + {"RES_67", BIT(2)}, +@@ -324,7 +325,7 @@ static const struct pmc_bit_map cnp_ltr_show_map[] = { + {"ISH", CNP_PMC_LTR_ISH}, + {"UFSX2", CNP_PMC_LTR_UFSX2}, + {"EMMC", CNP_PMC_LTR_EMMC}, +- /* Reserved for Cannonlake but valid for Icelake */ ++ /* Reserved for Cannon Lake but valid for Ice Lake */ + {"WIGIG", ICL_PMC_LTR_WIGIG}, + /* Below two cannot be used for LTR_IGNORE */ + {"CURRENT_PLATFORM", CNP_PMC_LTR_CUR_PLT}, +@@ -813,6 +814,8 @@ static const struct x86_cpu_id intel_pmc_core_ids[] = { + INTEL_CPU_FAM6(CANNONLAKE_L, cnp_reg_map), + INTEL_CPU_FAM6(ICELAKE_L, icl_reg_map), + INTEL_CPU_FAM6(ICELAKE_NNPI, icl_reg_map), ++ INTEL_CPU_FAM6(COMETLAKE, cnp_reg_map), ++ INTEL_CPU_FAM6(COMETLAKE_L, cnp_reg_map), + {} + }; + +@@ -871,8 +874,8 @@ static int pmc_core_probe(struct platform_device *pdev) + pmcdev->map = (struct pmc_reg_map *)cpu_id->driver_data; + + /* +- * Coffeelake has CPU ID of Kabylake and Cannonlake PCH. So here +- * Sunrisepoint PCH regmap can't be used. Use Cannonlake PCH regmap ++ * Coffee Lake has CPU ID of Kaby Lake and Cannon Lake PCH. So here ++ * Sunrisepoint PCH regmap can't be used. Use Cannon Lake PCH regmap + * in this case. + */ + if (pmcdev->map == &spt_reg_map && !pci_dev_present(pmc_pci_ids)) +diff --git a/drivers/platform/x86/peaq-wmi.c b/drivers/platform/x86/peaq-wmi.c +index fdeb3624c529..cf9c44c20a82 100644 +--- a/drivers/platform/x86/peaq-wmi.c ++++ b/drivers/platform/x86/peaq-wmi.c +@@ -6,7 +6,7 @@ + + #include + #include +-#include ++#include + #include + #include + +@@ -18,8 +18,7 @@ + + MODULE_ALIAS("wmi:"PEAQ_DOLBY_BUTTON_GUID); + +-static unsigned int peaq_ignore_events_counter; +-static struct input_polled_dev *peaq_poll_dev; ++static struct input_dev *peaq_poll_dev; + + /* + * The Dolby button (yes really a Dolby button) causes an ACPI variable to get +@@ -28,8 +27,10 @@ static struct input_polled_dev *peaq_poll_dev; + * (if polling after the release) or twice (polling between press and release). + * We ignore events for 0.5s after the first event to avoid reporting 2 presses. + */ +-static void peaq_wmi_poll(struct input_polled_dev *dev) ++static void peaq_wmi_poll(struct input_dev *input_dev) + { ++ static unsigned long last_event_time; ++ static bool had_events; + union acpi_object obj; + acpi_status status; + u32 dummy = 0; +@@ -44,22 +45,25 @@ static void peaq_wmi_poll(struct input_polled_dev *dev) + return; + + if (obj.type != ACPI_TYPE_INTEGER) { +- dev_err(&peaq_poll_dev->input->dev, ++ dev_err(&input_dev->dev, + "Error WMBC did not return an integer\n"); + return; + } + +- if (peaq_ignore_events_counter && peaq_ignore_events_counter--) ++ if (!obj.integer.value) + return; + +- if (obj.integer.value) { +- input_event(peaq_poll_dev->input, EV_KEY, KEY_SOUND, 1); +- input_sync(peaq_poll_dev->input); +- input_event(peaq_poll_dev->input, EV_KEY, KEY_SOUND, 0); +- input_sync(peaq_poll_dev->input); +- peaq_ignore_events_counter = max(1u, +- PEAQ_POLL_IGNORE_MS / peaq_poll_dev->poll_interval); +- } ++ if (had_events && time_before(jiffies, last_event_time + ++ msecs_to_jiffies(PEAQ_POLL_IGNORE_MS))) ++ return; ++ ++ input_event(input_dev, EV_KEY, KEY_SOUND, 1); ++ input_sync(input_dev); ++ input_event(input_dev, EV_KEY, KEY_SOUND, 0); ++ input_sync(input_dev); ++ ++ last_event_time = jiffies; ++ had_events = true; + } + + /* Some other devices (Shuttle XS35) use the same WMI GUID for other purposes */ +@@ -75,6 +79,8 @@ static const struct dmi_system_id peaq_dmi_table[] __initconst = { + + static int __init peaq_wmi_init(void) + { ++ int err; ++ + /* WMI GUID is not unique, also check for a DMI match */ + if (!dmi_check_system(peaq_dmi_table)) + return -ENODEV; +@@ -82,24 +88,36 @@ static int __init peaq_wmi_init(void) + if (!wmi_has_guid(PEAQ_DOLBY_BUTTON_GUID)) + return -ENODEV; + +- peaq_poll_dev = input_allocate_polled_device(); ++ peaq_poll_dev = input_allocate_device(); + if (!peaq_poll_dev) + return -ENOMEM; + +- peaq_poll_dev->poll = peaq_wmi_poll; +- peaq_poll_dev->poll_interval = PEAQ_POLL_INTERVAL_MS; +- peaq_poll_dev->poll_interval_max = PEAQ_POLL_MAX_MS; +- peaq_poll_dev->input->name = "PEAQ WMI hotkeys"; +- peaq_poll_dev->input->phys = "wmi/input0"; +- peaq_poll_dev->input->id.bustype = BUS_HOST; +- input_set_capability(peaq_poll_dev->input, EV_KEY, KEY_SOUND); ++ peaq_poll_dev->name = "PEAQ WMI hotkeys"; ++ peaq_poll_dev->phys = "wmi/input0"; ++ peaq_poll_dev->id.bustype = BUS_HOST; ++ input_set_capability(peaq_poll_dev, EV_KEY, KEY_SOUND); ++ ++ err = input_setup_polling(peaq_poll_dev, peaq_wmi_poll); ++ if (err) ++ goto err_out; ++ ++ input_set_poll_interval(peaq_poll_dev, PEAQ_POLL_INTERVAL_MS); ++ input_set_max_poll_interval(peaq_poll_dev, PEAQ_POLL_MAX_MS); ++ ++ err = input_register_device(peaq_poll_dev); ++ if (err) ++ goto err_out; ++ ++ return 0; + +- return input_register_polled_device(peaq_poll_dev); ++err_out: ++ input_free_device(peaq_poll_dev); ++ return err; + } + + static void __exit peaq_wmi_exit(void) + { +- input_unregister_polled_device(peaq_poll_dev); ++ input_unregister_device(peaq_poll_dev); + } + + module_init(peaq_wmi_init); +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c +index e60eab7f8a61..61fafe0374ce 100644 +--- a/drivers/ptp/ptp_clock.c ++++ b/drivers/ptp/ptp_clock.c +@@ -166,9 +166,9 @@ static struct posix_clock_operations ptp_clock_ops = { + .read = ptp_read, + }; + +-static void delete_ptp_clock(struct posix_clock *pc) ++static void ptp_clock_release(struct device *dev) + { +- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); ++ struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev); + + mutex_destroy(&ptp->tsevq_mux); + mutex_destroy(&ptp->pincfg_mux); +@@ -213,7 +213,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + } + + ptp->clock.ops = ptp_clock_ops; +- ptp->clock.release = delete_ptp_clock; + ptp->info = info; + ptp->devid = MKDEV(major, index); + ptp->index = index; +@@ -236,15 +235,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + if (err) + goto no_pin_groups; + +- /* Create a new device in our class. */ +- ptp->dev = device_create_with_groups(ptp_class, parent, ptp->devid, +- ptp, ptp->pin_attr_groups, +- "ptp%d", ptp->index); +- if (IS_ERR(ptp->dev)) { +- err = PTR_ERR(ptp->dev); +- goto no_device; +- } +- + /* Register a new PPS source. */ + if (info->pps) { + struct pps_source_info pps; +@@ -260,8 +250,18 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + } + } + +- /* Create a posix clock. */ +- err = posix_clock_register(&ptp->clock, ptp->devid); ++ /* Initialize a new device of our class in our clock structure. */ ++ device_initialize(&ptp->dev); ++ ptp->dev.devt = ptp->devid; ++ ptp->dev.class = ptp_class; ++ ptp->dev.parent = parent; ++ ptp->dev.groups = ptp->pin_attr_groups; ++ ptp->dev.release = ptp_clock_release; ++ dev_set_drvdata(&ptp->dev, ptp); ++ dev_set_name(&ptp->dev, "ptp%d", ptp->index); ++ ++ /* Create a posix clock and link it to the device. */ ++ err = posix_clock_register(&ptp->clock, &ptp->dev); + if (err) { + pr_err("failed to create posix clock\n"); + goto no_clock; +@@ -273,8 +273,6 @@ no_clock: + if (ptp->pps_source) + pps_unregister_source(ptp->pps_source); + no_pps: +- device_destroy(ptp_class, ptp->devid); +-no_device: + ptp_cleanup_pin_groups(ptp); + no_pin_groups: + if (ptp->kworker) +@@ -304,7 +302,6 @@ int ptp_clock_unregister(struct ptp_clock *ptp) + if (ptp->pps_source) + pps_unregister_source(ptp->pps_source); + +- device_destroy(ptp_class, ptp->devid); + ptp_cleanup_pin_groups(ptp); + + posix_clock_unregister(&ptp->clock); +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h +index 9171d42468fd..6b97155148f1 100644 +--- a/drivers/ptp/ptp_private.h ++++ b/drivers/ptp/ptp_private.h +@@ -28,7 +28,7 @@ struct timestamp_event_queue { + + struct ptp_clock { + struct posix_clock clock; +- struct device *dev; ++ struct device dev; + struct ptp_clock_info *info; + dev_t devid; + int index; /* index into clocks.map */ +diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h +index f34ee41cbed8..4f4dd9d727c9 100644 +--- a/drivers/s390/crypto/zcrypt_error.h ++++ b/drivers/s390/crypto/zcrypt_error.h +@@ -61,6 +61,7 @@ struct error_hdr { + #define REP82_ERROR_EVEN_MOD_IN_OPND 0x85 + #define REP82_ERROR_RESERVED_FIELD 0x88 + #define REP82_ERROR_INVALID_DOMAIN_PENDING 0x8A ++#define REP82_ERROR_FILTERED_BY_HYPERVISOR 0x8B + #define REP82_ERROR_TRANSPORT_FAIL 0x90 + #define REP82_ERROR_PACKET_TRUNCATED 0xA0 + #define REP82_ERROR_ZERO_BUFFER_LEN 0xB0 +@@ -91,6 +92,7 @@ static inline int convert_error(struct zcrypt_queue *zq, + case REP82_ERROR_INVALID_DOMAIN_PRECHECK: + case REP82_ERROR_INVALID_DOMAIN_PENDING: + case REP82_ERROR_INVALID_SPECIAL_CMD: ++ case REP82_ERROR_FILTERED_BY_HYPERVISOR: + // REP88_ERROR_INVALID_KEY // '82' CEX2A + // REP88_ERROR_OPERAND // '84' CEX2A + // REP88_ERROR_OPERAND_EVEN_MOD // '85' CEX2A +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index 536426f25e86..d4401c768a0c 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -129,6 +129,9 @@ + #define NCR5380_release_dma_irq(x) + #endif + ++static unsigned int disconnect_mask = ~0; ++module_param(disconnect_mask, int, 0444); ++ + static int do_abort(struct Scsi_Host *); + static void do_reset(struct Scsi_Host *); + static void bus_reset_cleanup(struct Scsi_Host *); +@@ -954,7 +957,8 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd) + int err; + bool ret = true; + bool can_disconnect = instance->irq != NO_IRQ && +- cmd->cmnd[0] != REQUEST_SENSE; ++ cmd->cmnd[0] != REQUEST_SENSE && ++ (disconnect_mask & BIT(scmd_id(cmd))); + + NCR5380_dprint(NDEBUG_ARBITRATION, instance); + dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n", +diff --git a/drivers/scsi/atari_scsi.c b/drivers/scsi/atari_scsi.c +index e809493d0d06..a82b63a66635 100644 +--- a/drivers/scsi/atari_scsi.c ++++ b/drivers/scsi/atari_scsi.c +@@ -742,7 +742,7 @@ static int __init atari_scsi_probe(struct platform_device *pdev) + atari_scsi_template.sg_tablesize = SG_ALL; + } else { + atari_scsi_template.can_queue = 1; +- atari_scsi_template.sg_tablesize = SG_NONE; ++ atari_scsi_template.sg_tablesize = 1; + } + + if (setup_can_queue > 0) +@@ -751,8 +751,8 @@ static int __init atari_scsi_probe(struct platform_device *pdev) + if (setup_cmd_per_lun > 0) + atari_scsi_template.cmd_per_lun = setup_cmd_per_lun; + +- /* Leave sg_tablesize at 0 on a Falcon! */ +- if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize >= 0) ++ /* Don't increase sg_tablesize on Falcon! */ ++ if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize > 0) + atari_scsi_template.sg_tablesize = setup_sg_tablesize; + + if (setup_hostid >= 0) { +diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c +index 66e58f0a75dc..23cbe4cda760 100644 +--- a/drivers/scsi/csiostor/csio_lnode.c ++++ b/drivers/scsi/csiostor/csio_lnode.c +@@ -301,6 +301,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + struct fc_fdmi_port_name *port_name; + uint8_t buf[64]; + uint8_t *fc4_type; ++ unsigned long flags; + + if (fdmi_req->wr_status != FW_SUCCESS) { + csio_ln_dbg(ln, "WR error:%x in processing fdmi rhba cmd\n", +@@ -385,13 +386,13 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + len = (uint32_t)(pld - (uint8_t *)cmd); + + /* Submit FDMI RPA request */ +- spin_lock_irq(&hw->lock); ++ spin_lock_irqsave(&hw->lock, flags); + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_done, + FCOE_CT, &fdmi_req->dma_buf, len)) { + CSIO_INC_STATS(ln, n_fdmi_err); + csio_ln_dbg(ln, "Failed to issue fdmi rpa req\n"); + } +- spin_unlock_irq(&hw->lock); ++ spin_unlock_irqrestore(&hw->lock, flags); + } + + /* +@@ -412,6 +413,7 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + struct fc_fdmi_rpl *reg_pl; + struct fs_fdmi_attrs *attrib_blk; + uint8_t buf[64]; ++ unsigned long flags; + + if (fdmi_req->wr_status != FW_SUCCESS) { + csio_ln_dbg(ln, "WR error:%x in processing fdmi dprt cmd\n", +@@ -491,13 +493,13 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + attrib_blk->numattrs = htonl(numattrs); + + /* Submit FDMI RHBA request */ +- spin_lock_irq(&hw->lock); ++ spin_lock_irqsave(&hw->lock, flags); + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_rhba_cbfn, + FCOE_CT, &fdmi_req->dma_buf, len)) { + CSIO_INC_STATS(ln, n_fdmi_err); + csio_ln_dbg(ln, "Failed to issue fdmi rhba req\n"); + } +- spin_unlock_irq(&hw->lock); ++ spin_unlock_irqrestore(&hw->lock, flags); + } + + /* +@@ -512,6 +514,7 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + void *cmd; + struct fc_fdmi_port_name *port_name; + uint32_t len; ++ unsigned long flags; + + if (fdmi_req->wr_status != FW_SUCCESS) { + csio_ln_dbg(ln, "WR error:%x in processing fdmi dhba cmd\n", +@@ -542,13 +545,13 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + len += sizeof(*port_name); + + /* Submit FDMI request */ +- spin_lock_irq(&hw->lock); ++ spin_lock_irqsave(&hw->lock, flags); + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_dprt_cbfn, + FCOE_CT, &fdmi_req->dma_buf, len)) { + CSIO_INC_STATS(ln, n_fdmi_err); + csio_ln_dbg(ln, "Failed to issue fdmi dprt req\n"); + } +- spin_unlock_irq(&hw->lock); ++ spin_unlock_irqrestore(&hw->lock, flags); + } + + /** +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index 0847e682797b..633effb09c9c 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -587,7 +587,13 @@ static int hisi_sas_task_exec(struct sas_task *task, gfp_t gfp_flags, + dev = hisi_hba->dev; + + if (unlikely(test_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags))) { +- if (in_softirq()) ++ /* ++ * For IOs from upper layer, it may already disable preempt ++ * in the IO path, if disable preempt again in down(), ++ * function schedule() will report schedule_bug(), so check ++ * preemptible() before goto down(). ++ */ ++ if (!preemptible()) + return -EINVAL; + + down(&hisi_hba->sem); +@@ -2676,6 +2682,7 @@ int hisi_sas_probe(struct platform_device *pdev, + err_out_register_ha: + scsi_remove_host(shost); + err_out_ha: ++ hisi_sas_debugfs_exit(hisi_hba); + hisi_sas_free(hisi_hba); + scsi_host_put(shost); + return rc; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index cb8d087762db..ef32ee12f606 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -3259,6 +3259,7 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) + err_out_register_ha: + scsi_remove_host(shost); + err_out_ha: ++ hisi_sas_debugfs_exit(hisi_hba); + scsi_host_put(shost); + err_out_regions: + pci_release_regions(pdev); +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c +index 7bedbe877704..0bc63a7ab41c 100644 +--- a/drivers/scsi/iscsi_tcp.c ++++ b/drivers/scsi/iscsi_tcp.c +@@ -369,8 +369,16 @@ static int iscsi_sw_tcp_pdu_xmit(struct iscsi_task *task) + { + struct iscsi_conn *conn = task->conn; + unsigned int noreclaim_flag; ++ struct iscsi_tcp_conn *tcp_conn = conn->dd_data; ++ struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; + int rc = 0; + ++ if (!tcp_sw_conn->sock) { ++ iscsi_conn_printk(KERN_ERR, conn, ++ "Transport not bound to socket!\n"); ++ return -EINVAL; ++ } ++ + noreclaim_flag = memalloc_noreclaim_save(); + + while (iscsi_sw_tcp_xmit_qlen(conn)) { +diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c +index 25e86706e207..f883fac2d2b1 100644 +--- a/drivers/scsi/lpfc/lpfc_ct.c ++++ b/drivers/scsi/lpfc/lpfc_ct.c +@@ -1868,6 +1868,12 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + if (irsp->ulpStatus == IOSTAT_LOCAL_REJECT) { + switch ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK)) { + case IOERR_SLI_ABORTED: ++ case IOERR_SLI_DOWN: ++ /* Driver aborted this IO. No retry as error ++ * is likely Offline->Online or some adapter ++ * error. Recovery will try again. ++ */ ++ break; + case IOERR_ABORT_IN_PROGRESS: + case IOERR_SEQUENCE_TIMEOUT: + case IOERR_ILLEGAL_FRAME: +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index d5303994bfd6..66f8867dd837 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -2236,6 +2236,7 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + struct Scsi_Host *shost = lpfc_shost_from_vport(vport); + IOCB_t *irsp; + struct lpfc_nodelist *ndlp; ++ char *mode; + + /* we pass cmdiocb to state machine which needs rspiocb as well */ + cmdiocb->context_un.rsp_iocb = rspiocb; +@@ -2273,8 +2274,17 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + goto out; + } + ++ /* If we don't send GFT_ID to Fabric, a PRLI error ++ * could be expected. ++ */ ++ if ((vport->fc_flag & FC_FABRIC) || ++ (vport->cfg_enable_fc4_type != LPFC_ENABLE_BOTH)) ++ mode = KERN_ERR; ++ else ++ mode = KERN_INFO; ++ + /* PRLI failed */ +- lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS, ++ lpfc_printf_vlog(vport, mode, LOG_ELS, + "2754 PRLI failure DID:%06X Status:x%x/x%x, " + "data: x%x\n", + ndlp->nlp_DID, irsp->ulpStatus, +@@ -4430,7 +4440,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + mempool_free(mbox, phba->mbox_mem_pool); + } + out: +- if (ndlp && NLP_CHK_NODE_ACT(ndlp)) { ++ if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) { + spin_lock_irq(shost->host_lock); + ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI); + spin_unlock_irq(shost->host_lock); +@@ -6455,7 +6465,7 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, + uint32_t payload_len, length, nportid, *cmd; + int rscn_cnt; + int rscn_id = 0, hba_id = 0; +- int i; ++ int i, tmo; + + pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; + lp = (uint32_t *) pcmd->virt; +@@ -6561,6 +6571,13 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, + + spin_lock_irq(shost->host_lock); + vport->fc_flag |= FC_RSCN_DEFERRED; ++ ++ /* Restart disctmo if its already running */ ++ if (vport->fc_flag & FC_DISC_TMO) { ++ tmo = ((phba->fc_ratov * 3) + 3); ++ mod_timer(&vport->fc_disctmo, ++ jiffies + msecs_to_jiffies(1000 * tmo)); ++ } + if ((rscn_cnt < FC_MAX_HOLD_RSCN) && + !(vport->fc_flag & FC_RSCN_DISCOVERY)) { + vport->fc_flag |= FC_RSCN_MODE; +@@ -7986,20 +8003,22 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport) + struct lpfc_sli_ring *pring; + struct lpfc_iocbq *tmp_iocb, *piocb; + IOCB_t *cmd = NULL; ++ unsigned long iflags = 0; + + lpfc_fabric_abort_vport(vport); ++ + /* + * For SLI3, only the hbalock is required. But SLI4 needs to coordinate + * with the ring insert operation. Because lpfc_sli_issue_abort_iotag + * ultimately grabs the ring_lock, the driver must splice the list into + * a working list and release the locks before calling the abort. + */ +- spin_lock_irq(&phba->hbalock); ++ spin_lock_irqsave(&phba->hbalock, iflags); + pring = lpfc_phba_elsring(phba); + + /* Bail out if we've no ELS wq, like in PCI error recovery case. */ + if (unlikely(!pring)) { +- spin_unlock_irq(&phba->hbalock); ++ spin_unlock_irqrestore(&phba->hbalock, iflags); + return; + } + +@@ -8014,6 +8033,9 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport) + if (piocb->vport != vport) + continue; + ++ if (piocb->iocb_flag & LPFC_DRIVER_ABORTED) ++ continue; ++ + /* On the ELS ring we can have ELS_REQUESTs or + * GEN_REQUESTs waiting for a response. + */ +@@ -8037,21 +8059,21 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport) + + if (phba->sli_rev == LPFC_SLI_REV4) + spin_unlock(&pring->ring_lock); +- spin_unlock_irq(&phba->hbalock); ++ spin_unlock_irqrestore(&phba->hbalock, iflags); + + /* Abort each txcmpl iocb on aborted list and remove the dlist links. */ + list_for_each_entry_safe(piocb, tmp_iocb, &abort_list, dlist) { +- spin_lock_irq(&phba->hbalock); ++ spin_lock_irqsave(&phba->hbalock, iflags); + list_del_init(&piocb->dlist); + lpfc_sli_issue_abort_iotag(phba, pring, piocb); +- spin_unlock_irq(&phba->hbalock); ++ spin_unlock_irqrestore(&phba->hbalock, iflags); + } + if (!list_empty(&abort_list)) + lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS, + "3387 abort list for txq not empty\n"); + INIT_LIST_HEAD(&abort_list); + +- spin_lock_irq(&phba->hbalock); ++ spin_lock_irqsave(&phba->hbalock, iflags); + if (phba->sli_rev == LPFC_SLI_REV4) + spin_lock(&pring->ring_lock); + +@@ -8091,7 +8113,7 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport) + + if (phba->sli_rev == LPFC_SLI_REV4) + spin_unlock(&pring->ring_lock); +- spin_unlock_irq(&phba->hbalock); ++ spin_unlock_irqrestore(&phba->hbalock, iflags); + + /* Cancel all the IOCBs from the completions list */ + lpfc_sli_cancel_iocbs(phba, &abort_list, +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index 749286acdc17..1286c658ba34 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -700,7 +700,10 @@ lpfc_work_done(struct lpfc_hba *phba) + if (!(phba->hba_flag & HBA_SP_QUEUE_EVT)) + set_bit(LPFC_DATA_READY, &phba->data_flags); + } else { +- if (phba->link_state >= LPFC_LINK_UP || ++ /* Driver could have abort request completed in queue ++ * when link goes down. Allow for this transition. ++ */ ++ if (phba->link_state >= LPFC_LINK_DOWN || + phba->link_flag & LS_MDS_LOOPBACK) { + pring->flag &= ~LPFC_DEFERRED_RING_EVENT; + lpfc_sli_handle_slow_ring_event(phba, pring, +@@ -5405,9 +5408,14 @@ lpfc_setup_disc_node(struct lpfc_vport *vport, uint32_t did) + /* If we've already received a PLOGI from this NPort + * we don't need to try to discover it again. + */ +- if (ndlp->nlp_flag & NLP_RCV_PLOGI) ++ if (ndlp->nlp_flag & NLP_RCV_PLOGI && ++ !(ndlp->nlp_type & ++ (NLP_FCP_TARGET | NLP_NVME_TARGET))) + return NULL; + ++ ndlp->nlp_prev_state = ndlp->nlp_state; ++ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE); ++ + spin_lock_irq(shost->host_lock); + ndlp->nlp_flag |= NLP_NPR_2B_DISC; + spin_unlock_irq(shost->host_lock); +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index fc6e4546d738..696171382558 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -484,8 +484,10 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + * single discovery thread, this will cause a huge delay in + * discovery. Also this will cause multiple state machines + * running in parallel for this node. ++ * This only applies to a fabric environment. + */ +- if (ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) { ++ if ((ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) && ++ (vport->fc_flag & FC_FABRIC)) { + /* software abort outstanding PLOGI */ + lpfc_els_abort(phba, ndlp); + } +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index ad8ef67a1db3..aa82d538a18a 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -4846,20 +4846,21 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd) + ret_val = __lpfc_sli_issue_iocb(phba, LPFC_FCP_RING, + abtsiocb, 0); + } +- /* no longer need the lock after this point */ +- spin_unlock_irqrestore(&phba->hbalock, flags); + + if (ret_val == IOCB_ERROR) { + /* Indicate the IO is not being aborted by the driver. */ + iocb->iocb_flag &= ~LPFC_DRIVER_ABORTED; + lpfc_cmd->waitq = NULL; + spin_unlock(&lpfc_cmd->buf_lock); ++ spin_unlock_irqrestore(&phba->hbalock, flags); + lpfc_sli_release_iocbq(phba, abtsiocb); + ret = FAILED; + goto out; + } + ++ /* no longer need the lock after this point */ + spin_unlock(&lpfc_cmd->buf_lock); ++ spin_unlock_irqrestore(&phba->hbalock, flags); + + if (phba->cfg_poll & DISABLE_FCP_RING_INT) + lpfc_sli_handle_fast_ring_event(phba, +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 5ed4219675eb..2b0e7b32c2df 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -11050,9 +11050,6 @@ lpfc_sli_abort_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + irsp->ulpStatus, irsp->un.ulpWord[4]); + + spin_unlock_irq(&phba->hbalock); +- if (irsp->ulpStatus == IOSTAT_LOCAL_REJECT && +- irsp->un.ulpWord[4] == IOERR_SLI_ABORTED) +- lpfc_sli_release_iocbq(phba, abort_iocb); + } + release_iocb: + lpfc_sli_release_iocbq(phba, cmdiocb); +@@ -13161,13 +13158,19 @@ send_current_mbox: + phba->sli.sli_flag &= ~LPFC_SLI_MBOX_ACTIVE; + /* Setting active mailbox pointer need to be in sync to flag clear */ + phba->sli.mbox_active = NULL; ++ if (bf_get(lpfc_trailer_consumed, mcqe)) ++ lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq); + spin_unlock_irqrestore(&phba->hbalock, iflags); + /* Wake up worker thread to post the next pending mailbox command */ + lpfc_worker_wake_up(phba); ++ return workposted; ++ + out_no_mqe_complete: ++ spin_lock_irqsave(&phba->hbalock, iflags); + if (bf_get(lpfc_trailer_consumed, mcqe)) + lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq); +- return workposted; ++ spin_unlock_irqrestore(&phba->hbalock, iflags); ++ return false; + } + + /** +@@ -18184,6 +18187,13 @@ lpfc_sli4_alloc_rpi(struct lpfc_hba *phba) + static void + __lpfc_sli4_free_rpi(struct lpfc_hba *phba, int rpi) + { ++ /* ++ * if the rpi value indicates a prior unreg has already ++ * been done, skip the unreg. ++ */ ++ if (rpi == LPFC_RPI_ALLOC_ERROR) ++ return; ++ + if (test_and_clear_bit(rpi, phba->sli4_hba.rpi_bmask)) { + phba->sli4_hba.rpi_count--; + phba->sli4_hba.max_cfg_param.rpi_used--; +diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c +index 9c5566217ef6..b5dde9d0d054 100644 +--- a/drivers/scsi/mac_scsi.c ++++ b/drivers/scsi/mac_scsi.c +@@ -464,7 +464,7 @@ static int __init mac_scsi_probe(struct platform_device *pdev) + mac_scsi_template.can_queue = setup_can_queue; + if (setup_cmd_per_lun > 0) + mac_scsi_template.cmd_per_lun = setup_cmd_per_lun; +- if (setup_sg_tablesize >= 0) ++ if (setup_sg_tablesize > 0) + mac_scsi_template.sg_tablesize = setup_sg_tablesize; + if (setup_hostid >= 0) + mac_scsi_template.this_id = setup_hostid & 7; +diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c +index 7d696952b376..b95f7d062ea4 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c +@@ -778,6 +778,18 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + case MPI2_FUNCTION_NVME_ENCAPSULATED: + { + nvme_encap_request = (Mpi26NVMeEncapsulatedRequest_t *)request; ++ if (!ioc->pcie_sg_lookup) { ++ dtmprintk(ioc, ioc_info(ioc, ++ "HBA doesn't support NVMe. Rejecting NVMe Encapsulated request.\n" ++ )); ++ ++ if (ioc->logging_level & MPT_DEBUG_TM) ++ _debug_dump_mf(nvme_encap_request, ++ ioc->request_sz/4); ++ mpt3sas_base_free_smid(ioc, smid); ++ ret = -EINVAL; ++ goto out; ++ } + /* + * Get the Physical Address of the sense buffer. + * Use Error Response buffer address field to hold the sense +@@ -1584,7 +1596,8 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc, + ioc_err(ioc, "%s: failed allocating memory for diag buffers, requested size(%d)\n", + __func__, request_data_sz); + mpt3sas_base_free_smid(ioc, smid); +- return -ENOMEM; ++ rc = -ENOMEM; ++ goto out; + } + ioc->diag_buffer[buffer_type] = request_data; + ioc->diag_buffer_sz[buffer_type] = request_data_sz; +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index 73261902d75d..161bf4760eac 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -2382,6 +2382,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb) + pm8001_printk("task 0x%p done with io_status 0x%x" + " resp 0x%x stat 0x%x but aborted by upper layer!\n", + t, status, ts->resp, ts->stat)); ++ if (t->slow_task) ++ complete(&t->slow_task->completion); + pm8001_ccb_task_free(pm8001_ha, t, ccb, tag); + } else { + spin_unlock_irqrestore(&t->task_state_lock, flags); +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index d323523f5f9d..32965ec76965 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -5263,6 +5263,11 @@ static int __init scsi_debug_init(void) + return -EINVAL; + } + ++ if (sdebug_num_tgts < 0) { ++ pr_err("num_tgts must be >= 0\n"); ++ return -EINVAL; ++ } ++ + if (sdebug_guard > 1) { + pr_err("guard must be 0 or 1\n"); + return -EINVAL; +diff --git a/drivers/scsi/scsi_trace.c b/drivers/scsi/scsi_trace.c +index 0f17e7dac1b0..07a2425ffa2c 100644 +--- a/drivers/scsi/scsi_trace.c ++++ b/drivers/scsi/scsi_trace.c +@@ -18,15 +18,18 @@ static const char * + scsi_trace_rw6(struct trace_seq *p, unsigned char *cdb, int len) + { + const char *ret = trace_seq_buffer_ptr(p); +- sector_t lba = 0, txlen = 0; ++ u32 lba = 0, txlen; + + lba |= ((cdb[1] & 0x1F) << 16); + lba |= (cdb[2] << 8); + lba |= cdb[3]; +- txlen = cdb[4]; ++ /* ++ * From SBC-2: a TRANSFER LENGTH field set to zero specifies that 256 ++ * logical blocks shall be read (READ(6)) or written (WRITE(6)). ++ */ ++ txlen = cdb[4] ? cdb[4] : 256; + +- trace_seq_printf(p, "lba=%llu txlen=%llu", +- (unsigned long long)lba, (unsigned long long)txlen); ++ trace_seq_printf(p, "lba=%u txlen=%u", lba, txlen); + trace_seq_putc(p, 0); + + return ret; +diff --git a/drivers/scsi/sun3_scsi.c b/drivers/scsi/sun3_scsi.c +index 955e4c938d49..701b842296f0 100644 +--- a/drivers/scsi/sun3_scsi.c ++++ b/drivers/scsi/sun3_scsi.c +@@ -501,7 +501,7 @@ static struct scsi_host_template sun3_scsi_template = { + .eh_host_reset_handler = sun3scsi_host_reset, + .can_queue = 16, + .this_id = 7, +- .sg_tablesize = SG_NONE, ++ .sg_tablesize = 1, + .cmd_per_lun = 2, + .dma_boundary = PAGE_SIZE - 1, + .cmd_size = NCR5380_CMD_SIZE, +@@ -523,7 +523,7 @@ static int __init sun3_scsi_probe(struct platform_device *pdev) + sun3_scsi_template.can_queue = setup_can_queue; + if (setup_cmd_per_lun > 0) + sun3_scsi_template.cmd_per_lun = setup_cmd_per_lun; +- if (setup_sg_tablesize >= 0) ++ if (setup_sg_tablesize > 0) + sun3_scsi_template.sg_tablesize = setup_sg_tablesize; + if (setup_hostid >= 0) + sun3_scsi_template.this_id = setup_hostid & 7; +diff --git a/drivers/scsi/ufs/ufs-sysfs.c b/drivers/scsi/ufs/ufs-sysfs.c +index 969a36b15897..ad2abc96c0f1 100644 +--- a/drivers/scsi/ufs/ufs-sysfs.c ++++ b/drivers/scsi/ufs/ufs-sysfs.c +@@ -126,13 +126,16 @@ static void ufshcd_auto_hibern8_update(struct ufs_hba *hba, u32 ahit) + return; + + spin_lock_irqsave(hba->host->host_lock, flags); +- if (hba->ahit == ahit) +- goto out_unlock; +- hba->ahit = ahit; +- if (!pm_runtime_suspended(hba->dev)) +- ufshcd_writel(hba, hba->ahit, REG_AUTO_HIBERNATE_IDLE_TIMER); +-out_unlock: ++ if (hba->ahit != ahit) ++ hba->ahit = ahit; + spin_unlock_irqrestore(hba->host->host_lock, flags); ++ if (!pm_runtime_suspended(hba->dev)) { ++ pm_runtime_get_sync(hba->dev); ++ ufshcd_hold(hba, false); ++ ufshcd_auto_hibern8_enable(hba); ++ ufshcd_release(hba); ++ pm_runtime_put(hba->dev); ++ } + } + + /* Convert Auto-Hibernate Idle Timer register value to microseconds */ +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 11a87f51c442..25a6a25b17a2 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -2986,10 +2986,10 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba, + goto out_unlock; + } + +- hba->dev_cmd.query.descriptor = NULL; + *buf_len = be16_to_cpu(response->upiu_res.length); + + out_unlock: ++ hba->dev_cmd.query.descriptor = NULL; + mutex_unlock(&hba->dev_cmd.lock); + out: + ufshcd_release(hba); +@@ -3885,15 +3885,24 @@ static int __ufshcd_uic_hibern8_enter(struct ufs_hba *hba) + ktime_to_us(ktime_sub(ktime_get(), start)), ret); + + if (ret) { ++ int err; ++ + dev_err(hba->dev, "%s: hibern8 enter failed. ret = %d\n", + __func__, ret); + + /* +- * If link recovery fails then return error so that caller +- * don't retry the hibern8 enter again. ++ * If link recovery fails then return error code returned from ++ * ufshcd_link_recovery(). ++ * If link recovery succeeds then return -EAGAIN to attempt ++ * hibern8 enter retry again. + */ +- if (ufshcd_link_recovery(hba)) +- ret = -ENOLINK; ++ err = ufshcd_link_recovery(hba); ++ if (err) { ++ dev_err(hba->dev, "%s: link recovery failed", __func__); ++ ret = err; ++ } else { ++ ret = -EAGAIN; ++ } + } else + ufshcd_vops_hibern8_notify(hba, UIC_CMD_DME_HIBER_ENTER, + POST_CHANGE); +@@ -3907,7 +3916,7 @@ static int ufshcd_uic_hibern8_enter(struct ufs_hba *hba) + + for (retries = UIC_HIBERN8_ENTER_RETRIES; retries > 0; retries--) { + ret = __ufshcd_uic_hibern8_enter(hba); +- if (!ret || ret == -ENOLINK) ++ if (!ret) + goto out; + } + out: +@@ -3941,7 +3950,7 @@ static int ufshcd_uic_hibern8_exit(struct ufs_hba *hba) + return ret; + } + +-static void ufshcd_auto_hibern8_enable(struct ufs_hba *hba) ++void ufshcd_auto_hibern8_enable(struct ufs_hba *hba) + { + unsigned long flags; + +@@ -6881,9 +6890,6 @@ static int ufshcd_probe_hba(struct ufs_hba *hba) + /* UniPro link is active now */ + ufshcd_set_link_active(hba); + +- /* Enable Auto-Hibernate if configured */ +- ufshcd_auto_hibern8_enable(hba); +- + ret = ufshcd_verify_dev_init(hba); + if (ret) + goto out; +@@ -6934,6 +6940,9 @@ static int ufshcd_probe_hba(struct ufs_hba *hba) + /* set the state as operational after switching to desired gear */ + hba->ufshcd_state = UFSHCD_STATE_OPERATIONAL; + ++ /* Enable Auto-Hibernate if configured */ ++ ufshcd_auto_hibern8_enable(hba); ++ + /* + * If we are in error handling context or in power management callbacks + * context, no need to scan the host +@@ -7950,12 +7959,12 @@ static int ufshcd_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) + if (hba->clk_scaling.is_allowed) + ufshcd_resume_clkscaling(hba); + +- /* Schedule clock gating in case of no access to UFS device yet */ +- ufshcd_release(hba); +- + /* Enable Auto-Hibernate if configured */ + ufshcd_auto_hibern8_enable(hba); + ++ /* Schedule clock gating in case of no access to UFS device yet */ ++ ufshcd_release(hba); ++ + goto out; + + set_old_link_state: +diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h +index c94cfda52829..52c9676a1242 100644 +--- a/drivers/scsi/ufs/ufshcd.h ++++ b/drivers/scsi/ufs/ufshcd.h +@@ -916,6 +916,8 @@ int ufshcd_query_attr(struct ufs_hba *hba, enum query_opcode opcode, + int ufshcd_query_flag(struct ufs_hba *hba, enum query_opcode opcode, + enum flag_idn idn, bool *flag_res); + ++void ufshcd_auto_hibern8_enable(struct ufs_hba *hba); ++ + #define SD_ASCII_STD true + #define SD_RAW false + int ufshcd_read_string_desc(struct ufs_hba *hba, u8 desc_index, +diff --git a/drivers/scsi/zorro_esp.c b/drivers/scsi/zorro_esp.c +index ca8e3abeb2c7..a23a8e5794f5 100644 +--- a/drivers/scsi/zorro_esp.c ++++ b/drivers/scsi/zorro_esp.c +@@ -218,7 +218,14 @@ static int fastlane_esp_irq_pending(struct esp *esp) + static u32 zorro_esp_dma_length_limit(struct esp *esp, u32 dma_addr, + u32 dma_len) + { +- return dma_len > 0xFFFF ? 0xFFFF : dma_len; ++ return dma_len > (1U << 16) ? (1U << 16) : dma_len; ++} ++ ++static u32 fastlane_esp_dma_length_limit(struct esp *esp, u32 dma_addr, ++ u32 dma_len) ++{ ++ /* The old driver used 0xfffc as limit, so do that here too */ ++ return dma_len > 0xfffc ? 0xfffc : dma_len; + } + + static void zorro_esp_reset_dma(struct esp *esp) +@@ -604,7 +611,7 @@ static const struct esp_driver_ops fastlane_esp_ops = { + .esp_write8 = zorro_esp_write8, + .esp_read8 = zorro_esp_read8, + .irq_pending = fastlane_esp_irq_pending, +- .dma_length_limit = zorro_esp_dma_length_limit, ++ .dma_length_limit = fastlane_esp_dma_length_limit, + .reset_dma = zorro_esp_reset_dma, + .dma_drain = zorro_esp_dma_drain, + .dma_invalidate = fastlane_esp_dma_invalidate, +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index d19e051f2bc2..f194ffc4699e 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1165,7 +1165,9 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, + hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length, + conn->cid); + +- target_get_sess_cmd(&cmd->se_cmd, true); ++ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0) ++ return iscsit_add_reject_cmd(cmd, ++ ISCSI_REASON_WAITING_FOR_LOGOUT, buf); + + cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd, + scsilun_to_int(&hdr->lun)); +@@ -2002,7 +2004,9 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, + conn->sess->se_sess, 0, DMA_NONE, + TCM_SIMPLE_TAG, cmd->sense_buffer + 2); + +- target_get_sess_cmd(&cmd->se_cmd, true); ++ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0) ++ return iscsit_add_reject_cmd(cmd, ++ ISCSI_REASON_WAITING_FOR_LOGOUT, buf); + + /* + * TASK_REASSIGN for ERL=2 / connection stays inside of +@@ -4232,6 +4236,8 @@ int iscsit_close_connection( + * must wait until they have completed. + */ + iscsit_check_conn_usage_count(conn); ++ target_sess_cmd_list_set_waiting(sess->se_sess); ++ target_wait_for_sess_cmds(sess->se_sess); + + ahash_request_free(conn->conn_tx_hash); + if (conn->conn_rx_hash) { +diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c +index 51ddca2033e0..8fe9b12a07a4 100644 +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -70,7 +70,7 @@ static int chap_check_algorithm(const char *a_str) + if (!token) + goto out; + +- if (!strncmp(token, "5", 1)) { ++ if (!strcmp(token, "5")) { + pr_debug("Selected MD5 Algorithm\n"); + kfree(orig); + return CHAP_DIGEST_MD5; +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 7f06a62f8661..eda8b4736c15 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -584,6 +584,15 @@ void transport_free_session(struct se_session *se_sess) + } + EXPORT_SYMBOL(transport_free_session); + ++static int target_release_res(struct se_device *dev, void *data) ++{ ++ struct se_session *sess = data; ++ ++ if (dev->reservation_holder == sess) ++ target_release_reservation(dev); ++ return 0; ++} ++ + void transport_deregister_session(struct se_session *se_sess) + { + struct se_portal_group *se_tpg = se_sess->se_tpg; +@@ -600,6 +609,12 @@ void transport_deregister_session(struct se_session *se_sess) + se_sess->fabric_sess_ptr = NULL; + spin_unlock_irqrestore(&se_tpg->session_lock, flags); + ++ /* ++ * Since the session is being removed, release SPC-2 ++ * reservations held by the session that is disappearing. ++ */ ++ target_for_each_device(target_release_res, se_sess); ++ + pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n", + se_tpg->se_tpg_tfo->fabric_name); + /* +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 9f57736fe15e..88a5aa6624b4 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -437,7 +437,9 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) + virtio_transport_deliver_tap_pkt(pkt); + + /* Only accept correctly addressed packets */ +- if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid) ++ if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid && ++ le64_to_cpu(pkt->hdr.dst_cid) == ++ vhost_transport_get_local_cid()) + virtio_transport_recv_pkt(pkt); + else + virtio_transport_free_pkt(pkt); +diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c +index 5ce51026989a..ba5d535a6db2 100644 +--- a/drivers/watchdog/imx7ulp_wdt.c ++++ b/drivers/watchdog/imx7ulp_wdt.c +@@ -106,12 +106,28 @@ static int imx7ulp_wdt_set_timeout(struct watchdog_device *wdog, + return 0; + } + ++static int imx7ulp_wdt_restart(struct watchdog_device *wdog, ++ unsigned long action, void *data) ++{ ++ struct imx7ulp_wdt_device *wdt = watchdog_get_drvdata(wdog); ++ ++ imx7ulp_wdt_enable(wdt->base, true); ++ imx7ulp_wdt_set_timeout(&wdt->wdd, 1); ++ ++ /* wait for wdog to fire */ ++ while (true) ++ ; ++ ++ return NOTIFY_DONE; ++} ++ + static const struct watchdog_ops imx7ulp_wdt_ops = { + .owner = THIS_MODULE, + .start = imx7ulp_wdt_start, + .stop = imx7ulp_wdt_stop, + .ping = imx7ulp_wdt_ping, + .set_timeout = imx7ulp_wdt_set_timeout, ++ .restart = imx7ulp_wdt_restart, + }; + + static const struct watchdog_info imx7ulp_wdt_info = { +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index dbd2ad4c9294..62483a99105c 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -34,7 +34,6 @@ + #include /* For __init/__exit/... */ + #include /* For hrtimers */ + #include /* For printk/panic/... */ +-#include /* For data references */ + #include /* For kthread_work */ + #include /* For handling misc devices */ + #include /* For module stuff/... */ +@@ -52,14 +51,14 @@ + + /* + * struct watchdog_core_data - watchdog core internal data +- * @kref: Reference count. ++ * @dev: The watchdog's internal device + * @cdev: The watchdog's Character device. + * @wdd: Pointer to watchdog device. + * @lock: Lock for watchdog core. + * @status: Watchdog core internal status bits. + */ + struct watchdog_core_data { +- struct kref kref; ++ struct device dev; + struct cdev cdev; + struct watchdog_device *wdd; + struct mutex lock; +@@ -158,7 +157,8 @@ static inline void watchdog_update_worker(struct watchdog_device *wdd) + ktime_t t = watchdog_next_keepalive(wdd); + + if (t > 0) +- hrtimer_start(&wd_data->timer, t, HRTIMER_MODE_REL); ++ hrtimer_start(&wd_data->timer, t, ++ HRTIMER_MODE_REL_HARD); + } else { + hrtimer_cancel(&wd_data->timer); + } +@@ -177,7 +177,7 @@ static int __watchdog_ping(struct watchdog_device *wdd) + if (ktime_after(earliest_keepalive, now)) { + hrtimer_start(&wd_data->timer, + ktime_sub(earliest_keepalive, now), +- HRTIMER_MODE_REL); ++ HRTIMER_MODE_REL_HARD); + return 0; + } + +@@ -839,7 +839,7 @@ static int watchdog_open(struct inode *inode, struct file *file) + file->private_data = wd_data; + + if (!hw_running) +- kref_get(&wd_data->kref); ++ get_device(&wd_data->dev); + + /* + * open_timeout only applies for the first open from +@@ -860,11 +860,11 @@ out_clear: + return err; + } + +-static void watchdog_core_data_release(struct kref *kref) ++static void watchdog_core_data_release(struct device *dev) + { + struct watchdog_core_data *wd_data; + +- wd_data = container_of(kref, struct watchdog_core_data, kref); ++ wd_data = container_of(dev, struct watchdog_core_data, dev); + + kfree(wd_data); + } +@@ -924,7 +924,7 @@ done: + */ + if (!running) { + module_put(wd_data->cdev.owner); +- kref_put(&wd_data->kref, watchdog_core_data_release); ++ put_device(&wd_data->dev); + } + return 0; + } +@@ -943,17 +943,22 @@ static struct miscdevice watchdog_miscdev = { + .fops = &watchdog_fops, + }; + ++static struct class watchdog_class = { ++ .name = "watchdog", ++ .owner = THIS_MODULE, ++ .dev_groups = wdt_groups, ++}; ++ + /* + * watchdog_cdev_register: register watchdog character device + * @wdd: watchdog device +- * @devno: character device number + * + * Register a watchdog character device including handling the legacy + * /dev/watchdog node. /dev/watchdog is actually a miscdevice and + * thus we set it up like that. + */ + +-static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) ++static int watchdog_cdev_register(struct watchdog_device *wdd) + { + struct watchdog_core_data *wd_data; + int err; +@@ -961,7 +966,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + wd_data = kzalloc(sizeof(struct watchdog_core_data), GFP_KERNEL); + if (!wd_data) + return -ENOMEM; +- kref_init(&wd_data->kref); + mutex_init(&wd_data->lock); + + wd_data->wdd = wdd; +@@ -971,7 +975,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + return -ENODEV; + + kthread_init_work(&wd_data->work, watchdog_ping_work); +- hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); ++ hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD); + wd_data->timer.function = watchdog_timer_expired; + + if (wdd->id == 0) { +@@ -990,23 +994,33 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + } + } + ++ device_initialize(&wd_data->dev); ++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); ++ wd_data->dev.class = &watchdog_class; ++ wd_data->dev.parent = wdd->parent; ++ wd_data->dev.groups = wdd->groups; ++ wd_data->dev.release = watchdog_core_data_release; ++ dev_set_drvdata(&wd_data->dev, wdd); ++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); ++ + /* Fill in the data structures */ + cdev_init(&wd_data->cdev, &watchdog_fops); +- wd_data->cdev.owner = wdd->ops->owner; + + /* Add the device */ +- err = cdev_add(&wd_data->cdev, devno, 1); ++ err = cdev_device_add(&wd_data->cdev, &wd_data->dev); + if (err) { + pr_err("watchdog%d unable to add device %d:%d\n", + wdd->id, MAJOR(watchdog_devt), wdd->id); + if (wdd->id == 0) { + misc_deregister(&watchdog_miscdev); + old_wd_data = NULL; +- kref_put(&wd_data->kref, watchdog_core_data_release); ++ put_device(&wd_data->dev); + } + return err; + } + ++ wd_data->cdev.owner = wdd->ops->owner; ++ + /* Record time of most recent heartbeat as 'just before now'. */ + wd_data->last_hw_keepalive = ktime_sub(ktime_get(), 1); + watchdog_set_open_deadline(wd_data); +@@ -1017,9 +1031,10 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + */ + if (watchdog_hw_running(wdd)) { + __module_get(wdd->ops->owner); +- kref_get(&wd_data->kref); ++ get_device(&wd_data->dev); + if (handle_boot_enabled) +- hrtimer_start(&wd_data->timer, 0, HRTIMER_MODE_REL); ++ hrtimer_start(&wd_data->timer, 0, ++ HRTIMER_MODE_REL_HARD); + else + pr_info("watchdog%d running and kernel based pre-userspace handler disabled\n", + wdd->id); +@@ -1040,7 +1055,7 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd) + { + struct watchdog_core_data *wd_data = wdd->wd_data; + +- cdev_del(&wd_data->cdev); ++ cdev_device_del(&wd_data->cdev, &wd_data->dev); + if (wdd->id == 0) { + misc_deregister(&watchdog_miscdev); + old_wd_data = NULL; +@@ -1059,15 +1074,9 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd) + hrtimer_cancel(&wd_data->timer); + kthread_cancel_work_sync(&wd_data->work); + +- kref_put(&wd_data->kref, watchdog_core_data_release); ++ put_device(&wd_data->dev); + } + +-static struct class watchdog_class = { +- .name = "watchdog", +- .owner = THIS_MODULE, +- .dev_groups = wdt_groups, +-}; +- + static int watchdog_reboot_notifier(struct notifier_block *nb, + unsigned long code, void *data) + { +@@ -1098,27 +1107,14 @@ static int watchdog_reboot_notifier(struct notifier_block *nb, + + int watchdog_dev_register(struct watchdog_device *wdd) + { +- struct device *dev; +- dev_t devno; + int ret; + +- devno = MKDEV(MAJOR(watchdog_devt), wdd->id); +- +- ret = watchdog_cdev_register(wdd, devno); ++ ret = watchdog_cdev_register(wdd); + if (ret) + return ret; + +- dev = device_create_with_groups(&watchdog_class, wdd->parent, +- devno, wdd, wdd->groups, +- "watchdog%d", wdd->id); +- if (IS_ERR(dev)) { +- watchdog_cdev_unregister(wdd); +- return PTR_ERR(dev); +- } +- + ret = watchdog_register_pretimeout(wdd); + if (ret) { +- device_destroy(&watchdog_class, devno); + watchdog_cdev_unregister(wdd); + return ret; + } +@@ -1126,7 +1122,8 @@ int watchdog_dev_register(struct watchdog_device *wdd) + if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) { + wdd->reboot_nb.notifier_call = watchdog_reboot_notifier; + +- ret = devm_register_reboot_notifier(dev, &wdd->reboot_nb); ++ ret = devm_register_reboot_notifier(&wdd->wd_data->dev, ++ &wdd->reboot_nb); + if (ret) { + pr_err("watchdog%d: Cannot register reboot notifier (%d)\n", + wdd->id, ret); +@@ -1148,7 +1145,6 @@ int watchdog_dev_register(struct watchdog_device *wdd) + void watchdog_dev_unregister(struct watchdog_device *wdd) + { + watchdog_unregister_pretimeout(wdd); +- device_destroy(&watchdog_class, wdd->wd_data->cdev.dev); + watchdog_cdev_unregister(wdd); + } + +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 1a135d1b85bd..07d8ace61f77 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -119,6 +119,7 @@ extern mempool_t *cifs_mid_poolp; + + struct workqueue_struct *cifsiod_wq; + struct workqueue_struct *decrypt_wq; ++struct workqueue_struct *fileinfo_put_wq; + struct workqueue_struct *cifsoplockd_wq; + __u32 cifs_lock_secret; + +@@ -1554,11 +1555,18 @@ init_cifs(void) + goto out_destroy_cifsiod_wq; + } + ++ fileinfo_put_wq = alloc_workqueue("cifsfileinfoput", ++ WQ_UNBOUND|WQ_FREEZABLE|WQ_MEM_RECLAIM, 0); ++ if (!fileinfo_put_wq) { ++ rc = -ENOMEM; ++ goto out_destroy_decrypt_wq; ++ } ++ + cifsoplockd_wq = alloc_workqueue("cifsoplockd", + WQ_FREEZABLE|WQ_MEM_RECLAIM, 0); + if (!cifsoplockd_wq) { + rc = -ENOMEM; +- goto out_destroy_decrypt_wq; ++ goto out_destroy_fileinfo_put_wq; + } + + rc = cifs_fscache_register(); +@@ -1624,6 +1632,8 @@ out_unreg_fscache: + cifs_fscache_unregister(); + out_destroy_cifsoplockd_wq: + destroy_workqueue(cifsoplockd_wq); ++out_destroy_fileinfo_put_wq: ++ destroy_workqueue(fileinfo_put_wq); + out_destroy_decrypt_wq: + destroy_workqueue(decrypt_wq); + out_destroy_cifsiod_wq: +@@ -1653,6 +1663,7 @@ exit_cifs(void) + cifs_fscache_unregister(); + destroy_workqueue(cifsoplockd_wq); + destroy_workqueue(decrypt_wq); ++ destroy_workqueue(fileinfo_put_wq); + destroy_workqueue(cifsiod_wq); + cifs_proc_clean(); + } +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 5d2dd04b55a6..f55e53486e74 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1265,6 +1265,7 @@ struct cifsFileInfo { + struct mutex fh_mutex; /* prevents reopen race after dead ses*/ + struct cifs_search_info srch_inf; + struct work_struct oplock_break; /* work for oplock breaks */ ++ struct work_struct put; /* work for the final part of _put */ + }; + + struct cifs_io_parms { +@@ -1370,7 +1371,8 @@ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file) + } + + struct cifsFileInfo *cifsFileInfo_get(struct cifsFileInfo *cifs_file); +-void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr); ++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr, ++ bool offload); + void cifsFileInfo_put(struct cifsFileInfo *cifs_file); + + #define CIFS_CACHE_READ_FLG 1 +@@ -1908,6 +1910,7 @@ void cifs_queue_oplock_break(struct cifsFileInfo *cfile); + extern const struct slow_work_ops cifs_oplock_break_ops; + extern struct workqueue_struct *cifsiod_wq; + extern struct workqueue_struct *decrypt_wq; ++extern struct workqueue_struct *fileinfo_put_wq; + extern struct workqueue_struct *cifsoplockd_wq; + extern __u32 cifs_lock_secret; + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 20c70cbab1ad..02451d085ddd 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -387,7 +387,7 @@ static inline int reconn_set_ipaddr(struct TCP_Server_Info *server) + #ifdef CONFIG_CIFS_DFS_UPCALL + struct super_cb_data { + struct TCP_Server_Info *server; +- struct cifs_sb_info *cifs_sb; ++ struct super_block *sb; + }; + + /* These functions must be called with server->srv_mutex held */ +@@ -398,25 +398,39 @@ static void super_cb(struct super_block *sb, void *arg) + struct cifs_sb_info *cifs_sb; + struct cifs_tcon *tcon; + +- if (d->cifs_sb) ++ if (d->sb) + return; + + cifs_sb = CIFS_SB(sb); + tcon = cifs_sb_master_tcon(cifs_sb); + if (tcon->ses->server == d->server) +- d->cifs_sb = cifs_sb; ++ d->sb = sb; + } + +-static inline struct cifs_sb_info * +-find_super_by_tcp(struct TCP_Server_Info *server) ++static struct super_block *get_tcp_super(struct TCP_Server_Info *server) + { + struct super_cb_data d = { + .server = server, +- .cifs_sb = NULL, ++ .sb = NULL, + }; + + iterate_supers_type(&cifs_fs_type, super_cb, &d); +- return d.cifs_sb ? d.cifs_sb : ERR_PTR(-ENOENT); ++ ++ if (unlikely(!d.sb)) ++ return ERR_PTR(-ENOENT); ++ /* ++ * Grab an active reference in order to prevent automounts (DFS links) ++ * of expiring and then freeing up our cifs superblock pointer while ++ * we're doing failover. ++ */ ++ cifs_sb_active(d.sb); ++ return d.sb; ++} ++ ++static inline void put_tcp_super(struct super_block *sb) ++{ ++ if (!IS_ERR_OR_NULL(sb)) ++ cifs_sb_deactive(sb); + } + + static void reconn_inval_dfs_target(struct TCP_Server_Info *server, +@@ -480,6 +494,7 @@ cifs_reconnect(struct TCP_Server_Info *server) + struct mid_q_entry *mid_entry; + struct list_head retry_list; + #ifdef CONFIG_CIFS_DFS_UPCALL ++ struct super_block *sb = NULL; + struct cifs_sb_info *cifs_sb = NULL; + struct dfs_cache_tgt_list tgt_list = {0}; + struct dfs_cache_tgt_iterator *tgt_it = NULL; +@@ -489,13 +504,15 @@ cifs_reconnect(struct TCP_Server_Info *server) + server->nr_targets = 1; + #ifdef CONFIG_CIFS_DFS_UPCALL + spin_unlock(&GlobalMid_Lock); +- cifs_sb = find_super_by_tcp(server); +- if (IS_ERR(cifs_sb)) { +- rc = PTR_ERR(cifs_sb); ++ sb = get_tcp_super(server); ++ if (IS_ERR(sb)) { ++ rc = PTR_ERR(sb); + cifs_dbg(FYI, "%s: will not do DFS failover: rc = %d\n", + __func__, rc); +- cifs_sb = NULL; ++ sb = NULL; + } else { ++ cifs_sb = CIFS_SB(sb); ++ + rc = reconn_setup_dfs_targets(cifs_sb, &tgt_list, &tgt_it); + if (rc && (rc != -EOPNOTSUPP)) { + cifs_server_dbg(VFS, "%s: no target servers for DFS failover\n", +@@ -512,6 +529,10 @@ cifs_reconnect(struct TCP_Server_Info *server) + /* the demux thread will exit normally + next time through the loop */ + spin_unlock(&GlobalMid_Lock); ++#ifdef CONFIG_CIFS_DFS_UPCALL ++ dfs_cache_free_tgts(&tgt_list); ++ put_tcp_super(sb); ++#endif + return rc; + } else + server->tcpStatus = CifsNeedReconnect; +@@ -638,7 +659,10 @@ cifs_reconnect(struct TCP_Server_Info *server) + __func__, rc); + } + dfs_cache_free_tgts(&tgt_list); ++ + } ++ ++ put_tcp_super(sb); + #endif + if (server->tcpStatus == CifsNeedNegotiate) + mod_delayed_work(cifsiod_wq, &server->echo, 0); +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index c32650f14c9b..969543034b4d 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -288,6 +288,8 @@ cifs_down_write(struct rw_semaphore *sem) + msleep(10); + } + ++static void cifsFileInfo_put_work(struct work_struct *work); ++ + struct cifsFileInfo * + cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + struct tcon_link *tlink, __u32 oplock) +@@ -322,6 +324,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + cfile->invalidHandle = false; + cfile->tlink = cifs_get_tlink(tlink); + INIT_WORK(&cfile->oplock_break, cifs_oplock_break); ++ INIT_WORK(&cfile->put, cifsFileInfo_put_work); + mutex_init(&cfile->fh_mutex); + spin_lock_init(&cfile->file_info_lock); + +@@ -376,6 +379,41 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file) + return cifs_file; + } + ++static void cifsFileInfo_put_final(struct cifsFileInfo *cifs_file) ++{ ++ struct inode *inode = d_inode(cifs_file->dentry); ++ struct cifsInodeInfo *cifsi = CIFS_I(inode); ++ struct cifsLockInfo *li, *tmp; ++ struct super_block *sb = inode->i_sb; ++ ++ /* ++ * Delete any outstanding lock records. We'll lose them when the file ++ * is closed anyway. ++ */ ++ cifs_down_write(&cifsi->lock_sem); ++ list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { ++ list_del(&li->llist); ++ cifs_del_lock_waiters(li); ++ kfree(li); ++ } ++ list_del(&cifs_file->llist->llist); ++ kfree(cifs_file->llist); ++ up_write(&cifsi->lock_sem); ++ ++ cifs_put_tlink(cifs_file->tlink); ++ dput(cifs_file->dentry); ++ cifs_sb_deactive(sb); ++ kfree(cifs_file); ++} ++ ++static void cifsFileInfo_put_work(struct work_struct *work) ++{ ++ struct cifsFileInfo *cifs_file = container_of(work, ++ struct cifsFileInfo, put); ++ ++ cifsFileInfo_put_final(cifs_file); ++} ++ + /** + * cifsFileInfo_put - release a reference of file priv data + * +@@ -383,15 +421,15 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file) + */ + void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + { +- _cifsFileInfo_put(cifs_file, true); ++ _cifsFileInfo_put(cifs_file, true, true); + } + + /** + * _cifsFileInfo_put - release a reference of file priv data + * + * This may involve closing the filehandle @cifs_file out on the +- * server. Must be called without holding tcon->open_file_lock and +- * cifs_file->file_info_lock. ++ * server. Must be called without holding tcon->open_file_lock, ++ * cinode->open_file_lock and cifs_file->file_info_lock. + * + * If @wait_for_oplock_handler is true and we are releasing the last + * reference, wait for any running oplock break handler of the file +@@ -399,7 +437,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + * oplock break handler, you need to pass false. + * + */ +-void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler) ++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, ++ bool wait_oplock_handler, bool offload) + { + struct inode *inode = d_inode(cifs_file->dentry); + struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink); +@@ -407,7 +446,6 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler) + struct cifsInodeInfo *cifsi = CIFS_I(inode); + struct super_block *sb = inode->i_sb; + struct cifs_sb_info *cifs_sb = CIFS_SB(sb); +- struct cifsLockInfo *li, *tmp; + struct cifs_fid fid; + struct cifs_pending_open open; + bool oplock_break_cancelled; +@@ -468,24 +506,10 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler) + + cifs_del_pending_open(&open); + +- /* +- * Delete any outstanding lock records. We'll lose them when the file +- * is closed anyway. +- */ +- cifs_down_write(&cifsi->lock_sem); +- list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { +- list_del(&li->llist); +- cifs_del_lock_waiters(li); +- kfree(li); +- } +- list_del(&cifs_file->llist->llist); +- kfree(cifs_file->llist); +- up_write(&cifsi->lock_sem); +- +- cifs_put_tlink(cifs_file->tlink); +- dput(cifs_file->dentry); +- cifs_sb_deactive(sb); +- kfree(cifs_file); ++ if (offload) ++ queue_work(fileinfo_put_wq, &cifs_file->put); ++ else ++ cifsFileInfo_put_final(cifs_file); + } + + int cifs_open(struct inode *inode, struct file *file) +@@ -816,7 +840,7 @@ reopen_error_exit: + int cifs_close(struct inode *inode, struct file *file) + { + if (file->private_data != NULL) { +- cifsFileInfo_put(file->private_data); ++ _cifsFileInfo_put(file->private_data, true, false); + file->private_data = NULL; + } + +@@ -4688,7 +4712,7 @@ void cifs_oplock_break(struct work_struct *work) + cinode); + cifs_dbg(FYI, "Oplock release rc = %d\n", rc); + } +- _cifsFileInfo_put(cfile, false /* do not wait for ourself */); ++ _cifsFileInfo_put(cfile, false /* do not wait for ourself */, false); + cifs_done_oplock_break(cinode); + } + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 53134e4509b8..8bba6cd5e870 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3532,8 +3532,14 @@ retry: + return ret; + } + ++ /* ++ * Writes that span EOF might trigger an I/O size update on completion, ++ * so consider them to be dirty for the purposes of O_DSYNC, even if ++ * there is no other metadata changes being made or are pending here. ++ */ + iomap->flags = 0; +- if (ext4_inode_datasync_dirty(inode)) ++ if (ext4_inode_datasync_dirty(inode) || ++ offset + length > i_size_read(inode)) + iomap->flags |= IOMAP_F_DIRTY; + iomap->bdev = inode->i_sb->s_bdev; + iomap->dax_dev = sbi->s_daxdev; +@@ -3836,7 +3842,13 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter) + * writes & truncates and since we take care of writing back page cache, + * we are protected against page writeback as well. + */ +- inode_lock_shared(inode); ++ if (iocb->ki_flags & IOCB_NOWAIT) { ++ if (!inode_trylock_shared(inode)) ++ return -EAGAIN; ++ } else { ++ inode_lock_shared(inode); ++ } ++ + ret = filemap_write_and_wait_range(mapping, iocb->ki_pos, + iocb->ki_pos + count - 1); + if (ret) +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 4024790028aa..9046432b87c2 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -1289,6 +1289,7 @@ struct f2fs_sb_info { + unsigned int gc_mode; /* current GC state */ + unsigned int next_victim_seg[2]; /* next segment in victim section */ + /* for skip statistic */ ++ unsigned int atomic_files; /* # of opened atomic file */ + unsigned long long skipped_atomic_files[2]; /* FG_GC and BG_GC */ + unsigned long long skipped_gc_rwsem; /* FG_GC only */ + +@@ -2704,6 +2705,20 @@ static inline void clear_file(struct inode *inode, int type) + f2fs_mark_inode_dirty_sync(inode, true); + } + ++static inline bool f2fs_is_time_consistent(struct inode *inode) ++{ ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &inode->i_atime)) ++ return false; ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &inode->i_ctime)) ++ return false; ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &inode->i_mtime)) ++ return false; ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 3, ++ &F2FS_I(inode)->i_crtime)) ++ return false; ++ return true; ++} ++ + static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync) + { + bool ret; +@@ -2721,14 +2736,7 @@ static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync) + i_size_read(inode) & ~PAGE_MASK) + return false; + +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &inode->i_atime)) +- return false; +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &inode->i_ctime)) +- return false; +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &inode->i_mtime)) +- return false; +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 3, +- &F2FS_I(inode)->i_crtime)) ++ if (!f2fs_is_time_consistent(inode)) + return false; + + down_read(&F2FS_I(inode)->i_sem); +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 29bc0a542759..8ed8e4328bd1 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1890,6 +1890,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp) + spin_lock(&sbi->inode_lock[ATOMIC_FILE]); + if (list_empty(&fi->inmem_ilist)) + list_add_tail(&fi->inmem_ilist, &sbi->inode_list[ATOMIC_FILE]); ++ sbi->atomic_files++; + spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); + + /* add inode in inmem_list first and set atomic_file */ +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index db4fec30c30d..386ad54c13c3 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -615,7 +615,11 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) + inode->i_ino == F2FS_META_INO(sbi)) + return 0; + +- if (!is_inode_flag_set(inode, FI_DIRTY_INODE)) ++ /* ++ * atime could be updated without dirtying f2fs inode in lazytime mode ++ */ ++ if (f2fs_is_time_consistent(inode) && ++ !is_inode_flag_set(inode, FI_DIRTY_INODE)) + return 0; + + if (!f2fs_is_checkpoint_ready(sbi)) +diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c +index 4faf06e8bf89..a1c507b0b4ac 100644 +--- a/fs/f2fs/namei.c ++++ b/fs/f2fs/namei.c +@@ -981,7 +981,8 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, + if (!old_dir_entry || whiteout) + file_lost_pino(old_inode); + else +- F2FS_I(old_inode)->i_pino = new_dir->i_ino; ++ /* adjust dir's i_pino to pass fsck check */ ++ f2fs_i_pino_write(old_inode, new_dir->i_ino); + up_write(&F2FS_I(old_inode)->i_sem); + + old_inode->i_ctime = current_time(old_inode); +@@ -1141,7 +1142,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry, + f2fs_set_link(old_dir, old_entry, old_page, new_inode); + + down_write(&F2FS_I(old_inode)->i_sem); +- file_lost_pino(old_inode); ++ if (!old_dir_entry) ++ file_lost_pino(old_inode); ++ else ++ /* adjust dir's i_pino to pass fsck check */ ++ f2fs_i_pino_write(old_inode, new_dir->i_ino); + up_write(&F2FS_I(old_inode)->i_sem); + + old_dir->i_ctime = current_time(old_dir); +@@ -1156,7 +1161,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry, + f2fs_set_link(new_dir, new_entry, new_page, old_inode); + + down_write(&F2FS_I(new_inode)->i_sem); +- file_lost_pino(new_inode); ++ if (!new_dir_entry) ++ file_lost_pino(new_inode); ++ else ++ /* adjust dir's i_pino to pass fsck check */ ++ f2fs_i_pino_write(new_inode, old_dir->i_ino); + up_write(&F2FS_I(new_inode)->i_sem); + + new_dir->i_ctime = current_time(new_dir); +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 808709581481..7d8578401267 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -288,6 +288,8 @@ void f2fs_drop_inmem_pages_all(struct f2fs_sb_info *sbi, bool gc_failure) + struct list_head *head = &sbi->inode_list[ATOMIC_FILE]; + struct inode *inode; + struct f2fs_inode_info *fi; ++ unsigned int count = sbi->atomic_files; ++ unsigned int looped = 0; + next: + spin_lock(&sbi->inode_lock[ATOMIC_FILE]); + if (list_empty(head)) { +@@ -296,22 +298,26 @@ next: + } + fi = list_first_entry(head, struct f2fs_inode_info, inmem_ilist); + inode = igrab(&fi->vfs_inode); ++ if (inode) ++ list_move_tail(&fi->inmem_ilist, head); + spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); + + if (inode) { + if (gc_failure) { +- if (fi->i_gc_failures[GC_FAILURE_ATOMIC]) +- goto drop; +- goto skip; ++ if (!fi->i_gc_failures[GC_FAILURE_ATOMIC]) ++ goto skip; + } +-drop: + set_inode_flag(inode, FI_ATOMIC_REVOKE_REQUEST); + f2fs_drop_inmem_pages(inode); ++skip: + iput(inode); + } +-skip: + congestion_wait(BLK_RW_ASYNC, HZ/50); + cond_resched(); ++ if (gc_failure) { ++ if (++looped >= count) ++ return; ++ } + goto next; + } + +@@ -327,13 +333,16 @@ void f2fs_drop_inmem_pages(struct inode *inode) + mutex_unlock(&fi->inmem_lock); + } + +- clear_inode_flag(inode, FI_ATOMIC_FILE); + fi->i_gc_failures[GC_FAILURE_ATOMIC] = 0; + stat_dec_atomic_write(inode); + + spin_lock(&sbi->inode_lock[ATOMIC_FILE]); + if (!list_empty(&fi->inmem_ilist)) + list_del_init(&fi->inmem_ilist); ++ if (f2fs_is_atomic_file(inode)) { ++ clear_inode_flag(inode, FI_ATOMIC_FILE); ++ sbi->atomic_files--; ++ } + spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); + } + +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index a478df035651..40306c1eab07 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -1461,28 +1461,43 @@ static int __init init_hugetlbfs_fs(void) + sizeof(struct hugetlbfs_inode_info), + 0, SLAB_ACCOUNT, init_once); + if (hugetlbfs_inode_cachep == NULL) +- goto out2; ++ goto out; + + error = register_filesystem(&hugetlbfs_fs_type); + if (error) +- goto out; ++ goto out_free; + ++ /* default hstate mount is required */ ++ mnt = mount_one_hugetlbfs(&hstates[default_hstate_idx]); ++ if (IS_ERR(mnt)) { ++ error = PTR_ERR(mnt); ++ goto out_unreg; ++ } ++ hugetlbfs_vfsmount[default_hstate_idx] = mnt; ++ ++ /* other hstates are optional */ + i = 0; + for_each_hstate(h) { +- mnt = mount_one_hugetlbfs(h); +- if (IS_ERR(mnt) && i == 0) { +- error = PTR_ERR(mnt); +- goto out; ++ if (i == default_hstate_idx) { ++ i++; ++ continue; + } +- hugetlbfs_vfsmount[i] = mnt; ++ ++ mnt = mount_one_hugetlbfs(h); ++ if (IS_ERR(mnt)) ++ hugetlbfs_vfsmount[i] = NULL; ++ else ++ hugetlbfs_vfsmount[i] = mnt; + i++; + } + + return 0; + +- out: ++ out_unreg: ++ (void)unregister_filesystem(&hugetlbfs_fs_type); ++ out_free: + kmem_cache_destroy(hugetlbfs_inode_cachep); +- out2: ++ out: + return error; + } + fs_initcall(init_hugetlbfs_fs) +diff --git a/fs/io_uring.c b/fs/io_uring.c +index a340147387ec..74e786578c77 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -3773,12 +3773,18 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx, + ctx->cq_entries = rings->cq_ring_entries; + + size = array_size(sizeof(struct io_uring_sqe), p->sq_entries); +- if (size == SIZE_MAX) ++ if (size == SIZE_MAX) { ++ io_mem_free(ctx->rings); ++ ctx->rings = NULL; + return -EOVERFLOW; ++ } + + ctx->sq_sqes = io_mem_alloc(size); +- if (!ctx->sq_sqes) ++ if (!ctx->sq_sqes) { ++ io_mem_free(ctx->rings); ++ ctx->rings = NULL; + return -ENOMEM; ++ } + + return 0; + } +diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c +index fd46ec83cb04..7b5f76efef02 100644 +--- a/fs/iomap/direct-io.c ++++ b/fs/iomap/direct-io.c +@@ -318,7 +318,9 @@ zero_tail: + if (pad) + iomap_dio_zero(dio, iomap, pos, fs_block_size - pad); + } +- return copied ? copied : ret; ++ if (copied) ++ return copied; ++ return ret; + } + + static loff_t +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index 132fb92098c7..c43591cd70f1 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -727,7 +727,6 @@ start_journal_io: + submit_bh(REQ_OP_WRITE, REQ_SYNC, bh); + } + cond_resched(); +- stats.run.rs_blocks_logged += bufs; + + /* Force a new descriptor to be generated next + time round the loop. */ +@@ -814,6 +813,7 @@ start_journal_io: + if (unlikely(!buffer_uptodate(bh))) + err = -EIO; + jbd2_unfile_log_bh(bh); ++ stats.run.rs_blocks_logged++; + + /* + * The list contains temporary buffer heads created by +@@ -859,6 +859,7 @@ start_journal_io: + BUFFER_TRACE(bh, "ph5: control buffer writeout done: unfile"); + clear_buffer_jwrite(bh); + jbd2_unfile_log_bh(bh); ++ stats.run.rs_blocks_logged++; + __brelse(bh); /* One for getblk */ + /* AKPM: bforget here */ + } +@@ -880,6 +881,7 @@ start_journal_io: + } + if (cbh) + err = journal_wait_on_commit_record(journal, cbh); ++ stats.run.rs_blocks_logged++; + if (jbd2_has_feature_async_commit(journal) && + journal->j_flags & JBD2_BARRIER) { + blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL); +diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c +index 3e7da392aa6f..bb981ec76456 100644 +--- a/fs/ocfs2/acl.c ++++ b/fs/ocfs2/acl.c +@@ -327,8 +327,8 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) + down_read(&OCFS2_I(inode)->ip_xattr_sem); + acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); + up_read(&OCFS2_I(inode)->ip_xattr_sem); +- if (IS_ERR(acl) || !acl) +- return PTR_ERR(acl); ++ if (IS_ERR_OR_NULL(acl)) ++ return PTR_ERR_OR_ZERO(acl); + ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); + if (ret) + return ret; +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 7f0b39da5022..9b96243de081 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -2861,68 +2861,73 @@ EXPORT_SYMBOL(dquot_quotactl_sysfile_ops); + static int do_proc_dqstats(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { +- unsigned int type = (int *)table->data - dqstats.stat; ++ unsigned int type = (unsigned long *)table->data - dqstats.stat; ++ s64 value = percpu_counter_sum(&dqstats.counter[type]); ++ ++ /* Filter negative values for non-monotonic counters */ ++ if (value < 0 && (type == DQST_ALLOC_DQUOTS || ++ type == DQST_FREE_DQUOTS)) ++ value = 0; + + /* Update global table */ +- dqstats.stat[type] = +- percpu_counter_sum_positive(&dqstats.counter[type]); +- return proc_dointvec(table, write, buffer, lenp, ppos); ++ dqstats.stat[type] = value; ++ return proc_doulongvec_minmax(table, write, buffer, lenp, ppos); + } + + static struct ctl_table fs_dqstats_table[] = { + { + .procname = "lookups", + .data = &dqstats.stat[DQST_LOOKUPS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "drops", + .data = &dqstats.stat[DQST_DROPS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "reads", + .data = &dqstats.stat[DQST_READS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "writes", + .data = &dqstats.stat[DQST_WRITES], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "cache_hits", + .data = &dqstats.stat[DQST_CACHE_HITS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "allocated_dquots", + .data = &dqstats.stat[DQST_ALLOC_DQUOTS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "free_dquots", + .data = &dqstats.stat[DQST_FREE_DQUOTS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "syncs", + .data = &dqstats.stat[DQST_SYNCS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, +diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c +index f9fd18670e22..d99d166fd892 100644 +--- a/fs/userfaultfd.c ++++ b/fs/userfaultfd.c +@@ -1834,13 +1834,12 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, + if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api))) + goto out; + features = uffdio_api.features; +- if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) { +- memset(&uffdio_api, 0, sizeof(uffdio_api)); +- if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api))) +- goto out; +- ret = -EINVAL; +- goto out; +- } ++ ret = -EINVAL; ++ if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) ++ goto err_out; ++ ret = -EPERM; ++ if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE)) ++ goto err_out; + /* report all available features and ioctls to userland */ + uffdio_api.features = UFFD_API_FEATURES; + uffdio_api.ioctls = UFFD_API_IOCTLS; +@@ -1853,6 +1852,11 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, + ret = 0; + out: + return ret; ++err_out: ++ memset(&uffdio_api, 0, sizeof(uffdio_api)); ++ if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api))) ++ ret = -EFAULT; ++ goto out; + } + + static long userfaultfd_ioctl(struct file *file, unsigned cmd, +diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c +index 641d07f30a27..7b0d9ad8cb1a 100644 +--- a/fs/xfs/xfs_log.c ++++ b/fs/xfs/xfs_log.c +@@ -1495,6 +1495,8 @@ out_free_iclog: + prev_iclog = iclog->ic_next; + kmem_free(iclog->ic_data); + kmem_free(iclog); ++ if (prev_iclog == log->l_iclog) ++ break; + } + out_free_log: + kmem_free(log); +diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h +index adf993a3bd58..6a18a97b76a8 100644 +--- a/include/linux/dma-direct.h ++++ b/include/linux/dma-direct.h +@@ -3,8 +3,11 @@ + #define _LINUX_DMA_DIRECT_H 1 + + #include ++#include /* for min_low_pfn */ + #include + ++static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr); ++ + #ifdef CONFIG_ARCH_HAS_PHYS_TO_DMA + #include + #else +@@ -24,11 +27,16 @@ static inline phys_addr_t __dma_to_phys(struct device *dev, dma_addr_t dev_addr) + + static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size) + { ++ dma_addr_t end = addr + size - 1; ++ + if (!dev->dma_mask) + return false; + +- return addr + size - 1 <= +- min_not_zero(*dev->dma_mask, dev->bus_dma_mask); ++ if (!IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT) && ++ min(addr, end) < phys_to_dma(dev, PFN_PHYS(min_low_pfn))) ++ return false; ++ ++ return end <= min_not_zero(*dev->dma_mask, dev->bus_dma_mask); + } + #endif /* !CONFIG_ARCH_HAS_PHYS_TO_DMA */ + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 4a1c4fca475a..4d450672b7d6 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -162,7 +162,7 @@ int dma_release_from_dev_coherent(struct device *dev, int order, void *vaddr); + int dma_mmap_from_dev_coherent(struct device *dev, struct vm_area_struct *vma, + void *cpu_addr, size_t size, int *ret); + +-void *dma_alloc_from_global_coherent(ssize_t size, dma_addr_t *dma_handle); ++void *dma_alloc_from_global_coherent(struct device *dev, ssize_t size, dma_addr_t *dma_handle); + int dma_release_from_global_coherent(int order, void *vaddr); + int dma_mmap_from_global_coherent(struct vm_area_struct *vma, void *cpu_addr, + size_t size, int *ret); +@@ -172,7 +172,7 @@ int dma_mmap_from_global_coherent(struct vm_area_struct *vma, void *cpu_addr, + #define dma_release_from_dev_coherent(dev, order, vaddr) (0) + #define dma_mmap_from_dev_coherent(dev, vma, vaddr, order, ret) (0) + +-static inline void *dma_alloc_from_global_coherent(ssize_t size, ++static inline void *dma_alloc_from_global_coherent(struct device *dev, ssize_t size, + dma_addr_t *dma_handle) + { + return NULL; +@@ -583,6 +583,10 @@ static inline unsigned long dma_get_merge_boundary(struct device *dev) + static inline dma_addr_t dma_map_single_attrs(struct device *dev, void *ptr, + size_t size, enum dma_data_direction dir, unsigned long attrs) + { ++ /* DMA must never operate on areas that might be remapped. */ ++ if (dev_WARN_ONCE(dev, is_vmalloc_addr(ptr), ++ "rejecting DMA map of vmalloc memory\n")) ++ return DMA_MAPPING_ERROR; + debug_dma_map_single(dev, ptr, size); + return dma_map_page_attrs(dev, virt_to_page(ptr), offset_in_page(ptr), + size, dir, attrs); +diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h +index 1b9a51a1bccb..1f98b52118f0 100644 +--- a/include/linux/hrtimer.h ++++ b/include/linux/hrtimer.h +@@ -456,12 +456,18 @@ extern u64 hrtimer_next_event_without(const struct hrtimer *exclude); + + extern bool hrtimer_active(const struct hrtimer *timer); + +-/* +- * Helper function to check, whether the timer is on one of the queues ++/** ++ * hrtimer_is_queued = check, whether the timer is on one of the queues ++ * @timer: Timer to check ++ * ++ * Returns: True if the timer is queued, false otherwise ++ * ++ * The function can be used lockless, but it gives only a current snapshot. + */ +-static inline int hrtimer_is_queued(struct hrtimer *timer) ++static inline bool hrtimer_is_queued(struct hrtimer *timer) + { +- return timer->state & HRTIMER_STATE_ENQUEUED; ++ /* The READ_ONCE pairs with the update functions of timer->state */ ++ return !!(READ_ONCE(timer->state) & HRTIMER_STATE_ENQUEUED); + } + + /* +diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h +index edb0f0c30904..1adf54aad2df 100644 +--- a/include/linux/libfdt_env.h ++++ b/include/linux/libfdt_env.h +@@ -7,6 +7,9 @@ + + #include + ++#define INT32_MAX S32_MAX ++#define UINT32_MAX U32_MAX ++ + typedef __be16 fdt16_t; + typedef __be32 fdt32_t; + typedef __be64 fdt64_t; +diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h +index fe6cfdcfbc26..468328b1e1dd 100644 +--- a/include/linux/posix-clock.h ++++ b/include/linux/posix-clock.h +@@ -69,29 +69,32 @@ struct posix_clock_operations { + * + * @ops: Functional interface to the clock + * @cdev: Character device instance for this clock +- * @kref: Reference count. ++ * @dev: Pointer to the clock's device. + * @rwsem: Protects the 'zombie' field from concurrent access. + * @zombie: If 'zombie' is true, then the hardware has disappeared. +- * @release: A function to free the structure when the reference count reaches +- * zero. May be NULL if structure is statically allocated. + * + * Drivers should embed their struct posix_clock within a private + * structure, obtaining a reference to it during callbacks using + * container_of(). ++ * ++ * Drivers should supply an initialized but not exposed struct device ++ * to posix_clock_register(). It is used to manage lifetime of the ++ * driver's private structure. It's 'release' field should be set to ++ * a release function for this private structure. + */ + struct posix_clock { + struct posix_clock_operations ops; + struct cdev cdev; +- struct kref kref; ++ struct device *dev; + struct rw_semaphore rwsem; + bool zombie; +- void (*release)(struct posix_clock *clk); + }; + + /** + * posix_clock_register() - register a new clock +- * @clk: Pointer to the clock. Caller must provide 'ops' and 'release' +- * @devid: Allocated device id ++ * @clk: Pointer to the clock. Caller must provide 'ops' field ++ * @dev: Pointer to the initialized device. Caller must provide ++ * 'release' field + * + * A clock driver calls this function to register itself with the + * clock device subsystem. If 'clk' points to dynamically allocated +@@ -100,7 +103,7 @@ struct posix_clock { + * + * Returns zero on success, non-zero otherwise. + */ +-int posix_clock_register(struct posix_clock *clk, dev_t devid); ++int posix_clock_register(struct posix_clock *clk, struct device *dev); + + /** + * posix_clock_unregister() - unregister a clock +diff --git a/include/linux/quota.h b/include/linux/quota.h +index f32dd270b8e3..27aab84fcbaa 100644 +--- a/include/linux/quota.h ++++ b/include/linux/quota.h +@@ -263,7 +263,7 @@ enum { + }; + + struct dqstats { +- int stat[_DQST_DQSTAT_LAST]; ++ unsigned long stat[_DQST_DQSTAT_LAST]; + struct percpu_counter counter[_DQST_DQSTAT_LAST]; + }; + +diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h +index bc8206a8f30e..61974c4c566b 100644 +--- a/include/linux/rculist_nulls.h ++++ b/include/linux/rculist_nulls.h +@@ -100,6 +100,43 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n, + first->pprev = &n->next; + } + ++/** ++ * hlist_nulls_add_tail_rcu ++ * @n: the element to add to the hash list. ++ * @h: the list to add to. ++ * ++ * Description: ++ * Adds the specified element to the specified hlist_nulls, ++ * while permitting racing traversals. ++ * ++ * The caller must take whatever precautions are necessary ++ * (such as holding appropriate locks) to avoid racing ++ * with another list-mutation primitive, such as hlist_nulls_add_head_rcu() ++ * or hlist_nulls_del_rcu(), running on this same list. ++ * However, it is perfectly legal to run concurrently with ++ * the _rcu list-traversal primitives, such as ++ * hlist_nulls_for_each_entry_rcu(), used to prevent memory-consistency ++ * problems on Alpha CPUs. Regardless of the type of CPU, the ++ * list-traversal primitive must be guarded by rcu_read_lock(). ++ */ ++static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n, ++ struct hlist_nulls_head *h) ++{ ++ struct hlist_nulls_node *i, *last = NULL; ++ ++ /* Note: write side code, so rcu accessors are not needed. */ ++ for (i = h->first; !is_a_nulls(i); i = i->next) ++ last = i; ++ ++ if (last) { ++ n->next = last->next; ++ n->pprev = &last->next; ++ rcu_assign_pointer(hlist_next_rcu(last), n); ++ } else { ++ hlist_nulls_add_head_rcu(n, h); ++ } ++} ++ + /** + * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type + * @tpos: the type * to use as a loop cursor. +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 1ba6e2cc2725..6ae88b0c1c31 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -1795,7 +1795,7 @@ static inline struct sk_buff *skb_peek_next(struct sk_buff *skb, + */ + static inline struct sk_buff *skb_peek_tail(const struct sk_buff_head *list_) + { +- struct sk_buff *skb = list_->prev; ++ struct sk_buff *skb = READ_ONCE(list_->prev); + + if (skb == (struct sk_buff *)list_) + skb = NULL; +@@ -1861,7 +1861,9 @@ static inline void __skb_insert(struct sk_buff *newsk, + struct sk_buff *prev, struct sk_buff *next, + struct sk_buff_head *list) + { +- /* see skb_queue_empty_lockless() for the opposite READ_ONCE() */ ++ /* See skb_queue_empty_lockless() and skb_peek_tail() ++ * for the opposite READ_ONCE() ++ */ + WRITE_ONCE(newsk->next, next); + WRITE_ONCE(newsk->prev, prev); + WRITE_ONCE(next->prev, newsk); +diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h +index 659a4400517b..e93e249a4e9b 100644 +--- a/include/linux/thread_info.h ++++ b/include/linux/thread_info.h +@@ -147,6 +147,8 @@ check_copy_size(const void *addr, size_t bytes, bool is_source) + __bad_copy_to(); + return false; + } ++ if (WARN_ON_ONCE(bytes > INT_MAX)) ++ return false; + check_object_size(addr, bytes, is_source); + return true; + } +diff --git a/include/net/dst.h b/include/net/dst.h +index 8224dad2ae94..3448cf865ede 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -516,7 +516,16 @@ static inline void skb_dst_update_pmtu(struct sk_buff *skb, u32 mtu) + struct dst_entry *dst = skb_dst(skb); + + if (dst && dst->ops->update_pmtu) +- dst->ops->update_pmtu(dst, NULL, skb, mtu); ++ dst->ops->update_pmtu(dst, NULL, skb, mtu, true); ++} ++ ++/* update dst pmtu but not do neighbor confirm */ ++static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu) ++{ ++ struct dst_entry *dst = skb_dst(skb); ++ ++ if (dst && dst->ops->update_pmtu) ++ dst->ops->update_pmtu(dst, NULL, skb, mtu, false); + } + + static inline void skb_tunnel_check_pmtu(struct sk_buff *skb, +@@ -526,7 +535,7 @@ static inline void skb_tunnel_check_pmtu(struct sk_buff *skb, + u32 encap_mtu = dst_mtu(encap_dst); + + if (skb->len > encap_mtu - headroom) +- skb_dst_update_pmtu(skb, encap_mtu - headroom); ++ skb_dst_update_pmtu_no_confirm(skb, encap_mtu - headroom); + } + + #endif /* _NET_DST_H */ +diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h +index 5ec645f27ee3..443863c7b8da 100644 +--- a/include/net/dst_ops.h ++++ b/include/net/dst_ops.h +@@ -27,7 +27,8 @@ struct dst_ops { + struct dst_entry * (*negative_advice)(struct dst_entry *); + void (*link_failure)(struct sk_buff *); + void (*update_pmtu)(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu); ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh); + void (*redirect)(struct dst_entry *dst, struct sock *sk, + struct sk_buff *skb); + int (*local_out)(struct net *net, struct sock *sk, struct sk_buff *skb); +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h +index af2b4c065a04..d0019d3395cf 100644 +--- a/include/net/inet_hashtables.h ++++ b/include/net/inet_hashtables.h +@@ -103,13 +103,19 @@ struct inet_bind_hashbucket { + struct hlist_head chain; + }; + +-/* +- * Sockets can be hashed in established or listening table ++/* Sockets can be hashed in established or listening table. ++ * We must use different 'nulls' end-of-chain value for all hash buckets : ++ * A socket might transition from ESTABLISH to LISTEN state without ++ * RCU grace period. A lookup in ehash table needs to handle this case. + */ ++#define LISTENING_NULLS_BASE (1U << 29) + struct inet_listen_hashbucket { + spinlock_t lock; + unsigned int count; +- struct hlist_head head; ++ union { ++ struct hlist_head head; ++ struct hlist_nulls_head nulls_head; ++ }; + }; + + /* This is for listening sockets, thus all sockets which possess wildcards. */ +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index d80acda231ae..47e61956168d 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -308,6 +308,7 @@ struct tcf_proto_ops { + int (*delete)(struct tcf_proto *tp, void *arg, + bool *last, bool rtnl_held, + struct netlink_ext_ack *); ++ bool (*delete_empty)(struct tcf_proto *tp); + void (*walk)(struct tcf_proto *tp, + struct tcf_walker *arg, bool rtnl_held); + int (*reoffload)(struct tcf_proto *tp, bool add, +@@ -336,6 +337,10 @@ struct tcf_proto_ops { + int flags; + }; + ++/* Classifiers setting TCF_PROTO_OPS_DOIT_UNLOCKED in tcf_proto_ops->flags ++ * are expected to implement tcf_proto_ops->delete_empty(), otherwise race ++ * conditions can occur when filters are inserted/deleted simultaneously. ++ */ + enum tcf_proto_ops_flags { + TCF_PROTO_OPS_DOIT_UNLOCKED = 1, + }; +diff --git a/include/net/sock.h b/include/net/sock.h +index 013396e50b91..e09e2886a836 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -723,6 +723,11 @@ static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_h + hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); + } + ++static inline void __sk_nulls_add_node_tail_rcu(struct sock *sk, struct hlist_nulls_head *list) ++{ ++ hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list); ++} ++ + static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) + { + sock_hold(sk); +diff --git a/include/scsi/iscsi_proto.h b/include/scsi/iscsi_proto.h +index b71b5c4f418c..533f56733ba8 100644 +--- a/include/scsi/iscsi_proto.h ++++ b/include/scsi/iscsi_proto.h +@@ -627,6 +627,7 @@ struct iscsi_reject { + #define ISCSI_REASON_BOOKMARK_INVALID 9 + #define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10 + #define ISCSI_REASON_NEGOTIATION_RESET 11 ++#define ISCSI_REASON_WAITING_FOR_LOGOUT 12 + + /* Max. number of Key=Value pairs in a text message */ + #define MAX_KEY_VALUE_PAIRS 8192 +diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c +index 545e3869b0e3..551b0eb7028a 100644 +--- a/kernel/dma/coherent.c ++++ b/kernel/dma/coherent.c +@@ -123,8 +123,9 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr, + return ret; + } + +-static void *__dma_alloc_from_coherent(struct dma_coherent_mem *mem, +- ssize_t size, dma_addr_t *dma_handle) ++static void *__dma_alloc_from_coherent(struct device *dev, ++ struct dma_coherent_mem *mem, ++ ssize_t size, dma_addr_t *dma_handle) + { + int order = get_order(size); + unsigned long flags; +@@ -143,7 +144,7 @@ static void *__dma_alloc_from_coherent(struct dma_coherent_mem *mem, + /* + * Memory was found in the coherent area. + */ +- *dma_handle = mem->device_base + (pageno << PAGE_SHIFT); ++ *dma_handle = dma_get_device_base(dev, mem) + (pageno << PAGE_SHIFT); + ret = mem->virt_base + (pageno << PAGE_SHIFT); + spin_unlock_irqrestore(&mem->spinlock, flags); + memset(ret, 0, size); +@@ -175,17 +176,18 @@ int dma_alloc_from_dev_coherent(struct device *dev, ssize_t size, + if (!mem) + return 0; + +- *ret = __dma_alloc_from_coherent(mem, size, dma_handle); ++ *ret = __dma_alloc_from_coherent(dev, mem, size, dma_handle); + return 1; + } + +-void *dma_alloc_from_global_coherent(ssize_t size, dma_addr_t *dma_handle) ++void *dma_alloc_from_global_coherent(struct device *dev, ssize_t size, ++ dma_addr_t *dma_handle) + { + if (!dma_coherent_default_memory) + return NULL; + +- return __dma_alloc_from_coherent(dma_coherent_default_memory, size, +- dma_handle); ++ return __dma_alloc_from_coherent(dev, dma_coherent_default_memory, size, ++ dma_handle); + } + + static int __dma_release_from_coherent(struct dma_coherent_mem *mem, +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index 099002d84f46..4ad74f5987ea 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -420,6 +420,7 @@ void debug_dma_dump_mappings(struct device *dev) + } + + spin_unlock_irqrestore(&bucket->lock, flags); ++ cond_resched(); + } + } + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index b6f2f35d0bcf..70665934d53e 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1466,7 +1466,7 @@ static struct ctl_table vm_table[] = { + .procname = "drop_caches", + .data = &sysctl_drop_caches, + .maxlen = sizeof(int), +- .mode = 0644, ++ .mode = 0200, + .proc_handler = drop_caches_sysctl_handler, + .extra1 = SYSCTL_ONE, + .extra2 = &four, +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 65605530ee34..7f31932216a1 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -966,7 +966,8 @@ static int enqueue_hrtimer(struct hrtimer *timer, + + base->cpu_base->active_bases |= 1 << base->index; + +- timer->state = HRTIMER_STATE_ENQUEUED; ++ /* Pairs with the lockless read in hrtimer_is_queued() */ ++ WRITE_ONCE(timer->state, HRTIMER_STATE_ENQUEUED); + + return timerqueue_add(&base->active, &timer->node); + } +@@ -988,7 +989,8 @@ static void __remove_hrtimer(struct hrtimer *timer, + struct hrtimer_cpu_base *cpu_base = base->cpu_base; + u8 state = timer->state; + +- timer->state = newstate; ++ /* Pairs with the lockless read in hrtimer_is_queued() */ ++ WRITE_ONCE(timer->state, newstate); + if (!(state & HRTIMER_STATE_ENQUEUED)) + return; + +@@ -1013,8 +1015,9 @@ static void __remove_hrtimer(struct hrtimer *timer, + static inline int + remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart) + { +- if (hrtimer_is_queued(timer)) { +- u8 state = timer->state; ++ u8 state = timer->state; ++ ++ if (state & HRTIMER_STATE_ENQUEUED) { + int reprogram; + + /* +diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c +index ec960bb939fd..200fb2d3be99 100644 +--- a/kernel/time/posix-clock.c ++++ b/kernel/time/posix-clock.c +@@ -14,8 +14,6 @@ + + #include "posix-timers.h" + +-static void delete_clock(struct kref *kref); +- + /* + * Returns NULL if the posix_clock instance attached to 'fp' is old and stale. + */ +@@ -125,7 +123,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp) + err = 0; + + if (!err) { +- kref_get(&clk->kref); ++ get_device(clk->dev); + fp->private_data = clk; + } + out: +@@ -141,7 +139,7 @@ static int posix_clock_release(struct inode *inode, struct file *fp) + if (clk->ops.release) + err = clk->ops.release(clk); + +- kref_put(&clk->kref, delete_clock); ++ put_device(clk->dev); + + fp->private_data = NULL; + +@@ -161,38 +159,35 @@ static const struct file_operations posix_clock_file_operations = { + #endif + }; + +-int posix_clock_register(struct posix_clock *clk, dev_t devid) ++int posix_clock_register(struct posix_clock *clk, struct device *dev) + { + int err; + +- kref_init(&clk->kref); + init_rwsem(&clk->rwsem); + + cdev_init(&clk->cdev, &posix_clock_file_operations); ++ err = cdev_device_add(&clk->cdev, dev); ++ if (err) { ++ pr_err("%s unable to add device %d:%d\n", ++ dev_name(dev), MAJOR(dev->devt), MINOR(dev->devt)); ++ return err; ++ } + clk->cdev.owner = clk->ops.owner; +- err = cdev_add(&clk->cdev, devid, 1); ++ clk->dev = dev; + +- return err; ++ return 0; + } + EXPORT_SYMBOL_GPL(posix_clock_register); + +-static void delete_clock(struct kref *kref) +-{ +- struct posix_clock *clk = container_of(kref, struct posix_clock, kref); +- +- if (clk->release) +- clk->release(clk); +-} +- + void posix_clock_unregister(struct posix_clock *clk) + { +- cdev_del(&clk->cdev); ++ cdev_device_del(&clk->cdev, clk->dev); + + down_write(&clk->rwsem); + clk->zombie = true; + up_write(&clk->rwsem); + +- kref_put(&clk->kref, delete_clock); ++ put_device(clk->dev); + } + EXPORT_SYMBOL_GPL(posix_clock_unregister); + +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index af7800103e51..59980ecfc962 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -662,6 +662,9 @@ static unsigned int br_nf_forward_arp(void *priv, + nf_bridge_pull_encap_header(skb); + } + ++ if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr)))) ++ return NF_DROP; ++ + if (arp_hdr(skb)->ar_pln != 4) { + if (is_vlan_arp(skb, state->net)) + nf_bridge_push_encap_header(skb); +diff --git a/net/bridge/br_nf_core.c b/net/bridge/br_nf_core.c +index 2cdfc5d6c25d..8c69f0c95a8e 100644 +--- a/net/bridge/br_nf_core.c ++++ b/net/bridge/br_nf_core.c +@@ -22,7 +22,8 @@ + #endif + + static void fake_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + } + +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 4096d8a74a2b..e1256e03a9a8 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1867,7 +1867,7 @@ static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz) + } + + static int ebt_buf_add(struct ebt_entries_buf_state *state, +- void *data, unsigned int sz) ++ const void *data, unsigned int sz) + { + if (state->buf_kern_start == NULL) + goto count_only; +@@ -1901,7 +1901,7 @@ enum compat_mwt { + EBT_COMPAT_TARGET, + }; + +-static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, ++static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt, + enum compat_mwt compat_mwt, + struct ebt_entries_buf_state *state, + const unsigned char *base) +@@ -1979,22 +1979,23 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, + /* return size of all matches, watchers or target, including necessary + * alignment and padding. + */ +-static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, ++static int ebt_size_mwt(const struct compat_ebt_entry_mwt *match32, + unsigned int size_left, enum compat_mwt type, + struct ebt_entries_buf_state *state, const void *base) + { ++ const char *buf = (const char *)match32; + int growth = 0; +- char *buf; + + if (size_left == 0) + return 0; + +- buf = (char *) match32; +- +- while (size_left >= sizeof(*match32)) { ++ do { + struct ebt_entry_match *match_kern; + int ret; + ++ if (size_left < sizeof(*match32)) ++ return -EINVAL; ++ + match_kern = (struct ebt_entry_match *) state->buf_kern_start; + if (match_kern) { + char *tmp; +@@ -2031,22 +2032,18 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, + if (match_kern) + match_kern->match_size = ret; + +- /* rule should have no remaining data after target */ +- if (type == EBT_COMPAT_TARGET && size_left) +- return -EINVAL; +- + match32 = (struct compat_ebt_entry_mwt *) buf; +- } ++ } while (size_left); + + return growth; + } + + /* called for all ebt_entry structures. */ +-static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, ++static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *base, + unsigned int *total, + struct ebt_entries_buf_state *state) + { +- unsigned int i, j, startoff, new_offset = 0; ++ unsigned int i, j, startoff, next_expected_off, new_offset = 0; + /* stores match/watchers/targets & offset of next struct ebt_entry: */ + unsigned int offsets[4]; + unsigned int *offsets_update = NULL; +@@ -2132,11 +2129,13 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, + return ret; + } + +- startoff = state->buf_user_offset - startoff; ++ next_expected_off = state->buf_user_offset - startoff; ++ if (next_expected_off != entry->next_offset) ++ return -EINVAL; + +- if (WARN_ON(*total < startoff)) ++ if (*total < entry->next_offset) + return -EINVAL; +- *total -= startoff; ++ *total -= entry->next_offset; + return 0; + } + +diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c +index aea918135ec3..08c3dc45f1a4 100644 +--- a/net/decnet/dn_route.c ++++ b/net/decnet/dn_route.c +@@ -110,7 +110,8 @@ static void dn_dst_ifdown(struct dst_entry *, struct net_device *dev, int how); + static struct dst_entry *dn_dst_negative_advice(struct dst_entry *); + static void dn_dst_link_failure(struct sk_buff *); + static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb , u32 mtu); ++ struct sk_buff *skb , u32 mtu, ++ bool confirm_neigh); + static void dn_dst_redirect(struct dst_entry *dst, struct sock *sk, + struct sk_buff *skb); + static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst, +@@ -251,7 +252,8 @@ static int dn_dst_gc(struct dst_ops *ops) + * advertise to the other end). + */ + static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + struct dn_route *rt = (struct dn_route *) dst; + struct neighbour *n = rt->n; +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 4298aae74e0e..ac95ba78b903 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -249,10 +249,11 @@ bool icmp_global_allow(void) + bool rc = false; + + /* Check if token bucket is empty and cannot be refilled +- * without taking the spinlock. ++ * without taking the spinlock. The READ_ONCE() are paired ++ * with the following WRITE_ONCE() in this same function. + */ +- if (!icmp_global.credit) { +- delta = min_t(u32, now - icmp_global.stamp, HZ); ++ if (!READ_ONCE(icmp_global.credit)) { ++ delta = min_t(u32, now - READ_ONCE(icmp_global.stamp), HZ); + if (delta < HZ / 50) + return false; + } +@@ -262,14 +263,14 @@ bool icmp_global_allow(void) + if (delta >= HZ / 50) { + incr = sysctl_icmp_msgs_per_sec * delta / HZ ; + if (incr) +- icmp_global.stamp = now; ++ WRITE_ONCE(icmp_global.stamp, now); + } + credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); + if (credit) { + credit--; + rc = true; + } +- icmp_global.credit = credit; ++ WRITE_ONCE(icmp_global.credit, credit); + spin_unlock(&icmp_global.lock); + return rc; + } +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index eb30fc1770de..ac05e273bc66 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -1086,7 +1086,7 @@ struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu) + if (!dst) + goto out; + } +- dst->ops->update_pmtu(dst, sk, NULL, mtu); ++ dst->ops->update_pmtu(dst, sk, NULL, mtu, true); + + dst = __sk_dst_check(sk, 0); + if (!dst) +diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c +index 7dc79b973e6e..6a4c82f96e78 100644 +--- a/net/ipv4/inet_diag.c ++++ b/net/ipv4/inet_diag.c +@@ -914,11 +914,12 @@ void inet_diag_dump_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *skb, + + for (i = s_i; i < INET_LHTABLE_SIZE; i++) { + struct inet_listen_hashbucket *ilb; ++ struct hlist_nulls_node *node; + + num = 0; + ilb = &hashinfo->listening_hash[i]; + spin_lock(&ilb->lock); +- sk_for_each(sk, &ilb->head) { ++ sk_nulls_for_each(sk, node, &ilb->nulls_head) { + struct inet_sock *inet = inet_sk(sk); + + if (!net_eq(sock_net(sk), net)) +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 83fb00153018..2bbaaf0c7176 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -516,10 +516,11 @@ static int inet_reuseport_add_sock(struct sock *sk, + struct inet_listen_hashbucket *ilb) + { + struct inet_bind_bucket *tb = inet_csk(sk)->icsk_bind_hash; ++ const struct hlist_nulls_node *node; + struct sock *sk2; + kuid_t uid = sock_i_uid(sk); + +- sk_for_each_rcu(sk2, &ilb->head) { ++ sk_nulls_for_each_rcu(sk2, node, &ilb->nulls_head) { + if (sk2 != sk && + sk2->sk_family == sk->sk_family && + ipv6_only_sock(sk2) == ipv6_only_sock(sk) && +@@ -555,9 +556,9 @@ int __inet_hash(struct sock *sk, struct sock *osk) + } + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport && + sk->sk_family == AF_INET6) +- hlist_add_tail_rcu(&sk->sk_node, &ilb->head); ++ __sk_nulls_add_node_tail_rcu(sk, &ilb->nulls_head); + else +- hlist_add_head_rcu(&sk->sk_node, &ilb->head); ++ __sk_nulls_add_node_rcu(sk, &ilb->nulls_head); + inet_hash2(hashinfo, sk); + ilb->count++; + sock_set_flag(sk, SOCK_RCU_FREE); +@@ -606,11 +607,9 @@ void inet_unhash(struct sock *sk) + reuseport_detach_sock(sk); + if (ilb) { + inet_unhash2(hashinfo, sk); +- __sk_del_node_init(sk); +- ilb->count--; +- } else { +- __sk_nulls_del_node_init_rcu(sk); ++ ilb->count--; + } ++ __sk_nulls_del_node_init_rcu(sk); + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); + unlock: + spin_unlock_bh(lock); +@@ -750,7 +749,8 @@ void inet_hashinfo_init(struct inet_hashinfo *h) + + for (i = 0; i < INET_LHTABLE_SIZE; i++) { + spin_lock_init(&h->listening_hash[i].lock); +- INIT_HLIST_HEAD(&h->listening_hash[i].head); ++ INIT_HLIST_NULLS_HEAD(&h->listening_hash[i].nulls_head, ++ i + LISTENING_NULLS_BASE); + h->listening_hash[i].count = 0; + } + +diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c +index be778599bfed..ff327a62c9ce 100644 +--- a/net/ipv4/inetpeer.c ++++ b/net/ipv4/inetpeer.c +@@ -160,7 +160,12 @@ static void inet_peer_gc(struct inet_peer_base *base, + base->total / inet_peer_threshold * HZ; + for (i = 0; i < gc_cnt; i++) { + p = gc_stack[i]; +- delta = (__u32)jiffies - p->dtime; ++ ++ /* The READ_ONCE() pairs with the WRITE_ONCE() ++ * in inet_putpeer() ++ */ ++ delta = (__u32)jiffies - READ_ONCE(p->dtime); ++ + if (delta < ttl || !refcount_dec_if_one(&p->refcnt)) + gc_stack[i] = NULL; + } +@@ -237,7 +242,10 @@ EXPORT_SYMBOL_GPL(inet_getpeer); + + void inet_putpeer(struct inet_peer *p) + { +- p->dtime = (__u32)jiffies; ++ /* The WRITE_ONCE() pairs with itself (we run lockless) ++ * and the READ_ONCE() in inet_peer_gc() ++ */ ++ WRITE_ONCE(p->dtime, (__u32)jiffies); + + if (refcount_dec_and_test(&p->refcnt)) + call_rcu(&p->rcu, inetpeer_free_rcu); +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 38c02bb62e2c..0fe2a5d3e258 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -505,7 +505,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + mtu = skb_valid_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu; + + if (skb_valid_dst(skb)) +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + + if (skb->protocol == htons(ETH_P_IP)) { + if (!skb_is_gso(skb) && +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index cfb025606793..fb9f6d60c27c 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -214,7 +214,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, + + mtu = dst_mtu(dst); + if (skb->len > mtu) { +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + if (skb->protocol == htons(ETH_P_IP)) { + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(mtu)); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 621f83434b24..fe34e9e0912a 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -139,7 +139,8 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst); + static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst); + static void ipv4_link_failure(struct sk_buff *skb); + static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu); ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh); + static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, + struct sk_buff *skb); + static void ipv4_dst_destroy(struct dst_entry *dst); +@@ -1043,7 +1044,8 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) + } + + static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + struct rtable *rt = (struct rtable *) dst; + struct flowi4 fl4; +@@ -2648,7 +2650,8 @@ static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst) + } + + static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + } + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 67b2dc7a1727..eda64871f983 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -2149,13 +2149,14 @@ static void *listening_get_next(struct seq_file *seq, void *cur) + struct tcp_iter_state *st = seq->private; + struct net *net = seq_file_net(seq); + struct inet_listen_hashbucket *ilb; ++ struct hlist_nulls_node *node; + struct sock *sk = cur; + + if (!sk) { + get_head: + ilb = &tcp_hashinfo.listening_hash[st->bucket]; + spin_lock(&ilb->lock); +- sk = sk_head(&ilb->head); ++ sk = sk_nulls_head(&ilb->nulls_head); + st->offset = 0; + goto get_sk; + } +@@ -2163,9 +2164,9 @@ get_head: + ++st->num; + ++st->offset; + +- sk = sk_next(sk); ++ sk = sk_nulls_next(sk); + get_sk: +- sk_for_each_from(sk) { ++ sk_nulls_for_each_from(sk, node) { + if (!net_eq(sock_net(sk), net)) + continue; + if (sk->sk_family == afinfo->family) +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 762edd800d78..0269584e9cf7 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -72,6 +72,9 @@ static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb) + __skb_unlink(skb, &sk->sk_write_queue); + tcp_rbtree_insert(&sk->tcp_rtx_queue, skb); + ++ if (tp->highest_sack == NULL) ++ tp->highest_sack = skb; ++ + tp->packets_out += tcp_skb_pcount(skb); + if (!prior_packets || icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) + tcp_rearm_rto(sk); +@@ -2438,6 +2441,14 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, + if (tcp_small_queue_check(sk, skb, 0)) + break; + ++ /* Argh, we hit an empty skb(), presumably a thread ++ * is sleeping in sendmsg()/sk_stream_wait_memory(). ++ * We do not want to send a pure-ack packet and have ++ * a strange looking rtx queue with empty packet(s). ++ */ ++ if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) ++ break; ++ + if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp))) + break; + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 447defbfccdd..7aa4e77161f6 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1475,7 +1475,7 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb) + * queue contains some other skb + */ + rmem = atomic_add_return(size, &sk->sk_rmem_alloc); +- if (rmem > (size + sk->sk_rcvbuf)) ++ if (rmem > (size + (unsigned int)sk->sk_rcvbuf)) + goto uncharge_drop; + + spin_lock(&list->lock); +diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c +index 35b84b52b702..9ebd54752e03 100644 +--- a/net/ipv4/xfrm4_policy.c ++++ b/net/ipv4/xfrm4_policy.c +@@ -100,12 +100,13 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, + } + + static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + struct xfrm_dst *xdst = (struct xfrm_dst *)dst; + struct dst_entry *path = xdst->route; + +- path->ops->update_pmtu(path, sk, skb, mtu); ++ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh); + } + + static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk, +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 34ccef18b40e..f9b5690e94fd 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -5231,16 +5231,16 @@ static int inet6_rtm_valid_getaddr_req(struct sk_buff *skb, + return -EINVAL; + } + ++ if (!netlink_strict_get_check(skb)) ++ return nlmsg_parse_deprecated(nlh, sizeof(*ifm), tb, IFA_MAX, ++ ifa_ipv6_policy, extack); ++ + ifm = nlmsg_data(nlh); + if (ifm->ifa_prefixlen || ifm->ifa_flags || ifm->ifa_scope) { + NL_SET_ERR_MSG_MOD(extack, "Invalid values in header for get address request"); + return -EINVAL; + } + +- if (!netlink_strict_get_check(skb)) +- return nlmsg_parse_deprecated(nlh, sizeof(*ifm), tb, IFA_MAX, +- ifa_ipv6_policy, extack); +- + err = nlmsg_parse_deprecated_strict(nlh, sizeof(*ifm), tb, IFA_MAX, + ifa_ipv6_policy, extack); + if (err) +diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c +index fe9cb8d1adca..e315526fa244 100644 +--- a/net/ipv6/inet6_connection_sock.c ++++ b/net/ipv6/inet6_connection_sock.c +@@ -146,7 +146,7 @@ struct dst_entry *inet6_csk_update_pmtu(struct sock *sk, u32 mtu) + + if (IS_ERR(dst)) + return NULL; +- dst->ops->update_pmtu(dst, sk, NULL, mtu); ++ dst->ops->update_pmtu(dst, sk, NULL, mtu, true); + + dst = inet6_csk_route_socket(sk, &fl6); + return IS_ERR(dst) ? NULL : dst; +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 923034c52ce4..189de56f5e36 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1040,7 +1040,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + + /* TooBig packet may have updated dst->dev's mtu */ + if (!t->parms.collect_md && dst && dst_mtu(dst) > dst->dev->mtu) +- dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu); ++ dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu, false); + + err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu, + NEXTHDR_GRE); +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 754a484d35df..2f376dbc37d5 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -640,7 +640,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + if (rel_info > dst_mtu(skb_dst(skb2))) + goto out; + +- skb_dst_update_pmtu(skb2, rel_info); ++ skb_dst_update_pmtu_no_confirm(skb2, rel_info); + } + + icmp_send(skb2, rel_type, rel_code, htonl(rel_info)); +@@ -1132,7 +1132,7 @@ route_lookup: + mtu = max(mtu, skb->protocol == htons(ETH_P_IPV6) ? + IPV6_MIN_MTU : IPV4_MIN_MTU); + +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { + *pmtu = mtu; + err = -EMSGSIZE; +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 024db17386d2..6f08b760c2a7 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -479,7 +479,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + + mtu = dst_mtu(dst); + if (skb->len > mtu) { +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + + if (skb->protocol == htons(ETH_P_IPV6)) { + if (mtu < IPV6_MIN_MTU) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 3f83ea851ebf..e4ed9c7b43b0 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -95,7 +95,8 @@ static int ip6_pkt_prohibit(struct sk_buff *skb); + static int ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb); + static void ip6_link_failure(struct sk_buff *skb); + static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu); ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh); + static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, + struct sk_buff *skb); + static int rt6_score_route(const struct fib6_nh *nh, u32 fib6_flags, int oif, +@@ -264,7 +265,8 @@ static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst) + } + + static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + } + +@@ -2695,7 +2697,8 @@ static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) + } + + static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, +- const struct ipv6hdr *iph, u32 mtu) ++ const struct ipv6hdr *iph, u32 mtu, ++ bool confirm_neigh) + { + const struct in6_addr *daddr, *saddr; + struct rt6_info *rt6 = (struct rt6_info *)dst; +@@ -2713,7 +2716,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, + daddr = NULL; + saddr = NULL; + } +- dst_confirm_neigh(dst, daddr); ++ ++ if (confirm_neigh) ++ dst_confirm_neigh(dst, daddr); ++ + mtu = max_t(u32, mtu, IPV6_MIN_MTU); + if (mtu >= dst_mtu(dst)) + return; +@@ -2767,9 +2773,11 @@ out_unlock: + } + + static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { +- __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu); ++ __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu, ++ confirm_neigh); + } + + void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu, +@@ -2788,7 +2796,7 @@ void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu, + + dst = ip6_route_output(net, NULL, &fl6); + if (!dst->error) +- __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu)); ++ __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu), true); + dst_release(dst); + } + EXPORT_SYMBOL_GPL(ip6_update_pmtu); +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index b2ccbc473127..98954830c40b 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -944,7 +944,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, + } + + if (tunnel->parms.iph.daddr) +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + + if (skb->len > mtu && !skb_is_gso(skb)) { + icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); +diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c +index 699e0730ce8e..af7a4b8b1e9c 100644 +--- a/net/ipv6/xfrm6_policy.c ++++ b/net/ipv6/xfrm6_policy.c +@@ -98,12 +98,13 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, + } + + static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + struct xfrm_dst *xdst = (struct xfrm_dst *)dst; + struct dst_entry *path = xdst->route; + +- path->ops->update_pmtu(path, sk, skb, mtu); ++ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh); + } + + static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk, +diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c +index 888d3068a492..c62a131a6094 100644 +--- a/net/netfilter/ipvs/ip_vs_xmit.c ++++ b/net/netfilter/ipvs/ip_vs_xmit.c +@@ -208,7 +208,7 @@ static inline void maybe_update_pmtu(int skb_af, struct sk_buff *skb, int mtu) + struct rtable *ort = skb_rtable(skb); + + if (!skb->dev && sk && sk_fullsock(sk)) +- ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu); ++ ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu, true); + } + + static inline bool ensure_mtu_is_adequate(struct netns_ipvs *ipvs, int skb_af, +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 08923b21e566..f0df0d90b8bd 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -219,8 +219,10 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + bool use_reinsert; + bool want_ingress; + bool is_redirect; ++ bool expects_nh; + int m_eaction; + int mac_len; ++ bool at_nh; + + rec_level = __this_cpu_inc_return(mirred_rec_level); + if (unlikely(rec_level > MIRRED_RECURSION_LIMIT)) { +@@ -261,19 +263,19 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + goto out; + } + +- /* If action's target direction differs than filter's direction, +- * and devices expect a mac header on xmit, then mac push/pull is +- * needed. +- */ + want_ingress = tcf_mirred_act_wants_ingress(m_eaction); +- if (skb_at_tc_ingress(skb) != want_ingress && m_mac_header_xmit) { +- if (!skb_at_tc_ingress(skb)) { +- /* caught at egress, act ingress: pull mac */ +- mac_len = skb_network_header(skb) - skb_mac_header(skb); ++ ++ expects_nh = want_ingress || !m_mac_header_xmit; ++ at_nh = skb->data == skb_network_header(skb); ++ if (at_nh != expects_nh) { ++ mac_len = skb_at_tc_ingress(skb) ? skb->mac_len : ++ skb_network_header(skb) - skb_mac_header(skb); ++ if (expects_nh) { ++ /* target device/action expect data at nh */ + skb_pull_rcsum(skb2, mac_len); + } else { +- /* caught at ingress, act egress: push mac */ +- skb_push_rcsum(skb2, skb->mac_len); ++ /* target device/action expect data at mac */ ++ skb_push_rcsum(skb2, mac_len); + } + } + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 6a0eacafdb19..76e0d122616a 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -308,33 +308,12 @@ static void tcf_proto_put(struct tcf_proto *tp, bool rtnl_held, + tcf_proto_destroy(tp, rtnl_held, true, extack); + } + +-static int walker_check_empty(struct tcf_proto *tp, void *fh, +- struct tcf_walker *arg) ++static bool tcf_proto_check_delete(struct tcf_proto *tp) + { +- if (fh) { +- arg->nonempty = true; +- return -1; +- } +- return 0; +-} +- +-static bool tcf_proto_is_empty(struct tcf_proto *tp, bool rtnl_held) +-{ +- struct tcf_walker walker = { .fn = walker_check_empty, }; +- +- if (tp->ops->walk) { +- tp->ops->walk(tp, &walker, rtnl_held); +- return !walker.nonempty; +- } +- return true; +-} ++ if (tp->ops->delete_empty) ++ return tp->ops->delete_empty(tp); + +-static bool tcf_proto_check_delete(struct tcf_proto *tp, bool rtnl_held) +-{ +- spin_lock(&tp->lock); +- if (tcf_proto_is_empty(tp, rtnl_held)) +- tp->deleting = true; +- spin_unlock(&tp->lock); ++ tp->deleting = true; + return tp->deleting; + } + +@@ -1751,7 +1730,7 @@ static void tcf_chain_tp_delete_empty(struct tcf_chain *chain, + * concurrently. + * Mark tp for deletion if it is empty. + */ +- if (!tp_iter || !tcf_proto_check_delete(tp, rtnl_held)) { ++ if (!tp_iter || !tcf_proto_check_delete(tp)) { + mutex_unlock(&chain->filter_chain_lock); + return; + } +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 4ac110bf19c5..5cf8163710c8 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -2519,6 +2519,17 @@ static void fl_bind_class(void *fh, u32 classid, unsigned long cl) + f->res.class = cl; + } + ++static bool fl_delete_empty(struct tcf_proto *tp) ++{ ++ struct cls_fl_head *head = fl_head_dereference(tp); ++ ++ spin_lock(&tp->lock); ++ tp->deleting = idr_is_empty(&head->handle_idr); ++ spin_unlock(&tp->lock); ++ ++ return tp->deleting; ++} ++ + static struct tcf_proto_ops cls_fl_ops __read_mostly = { + .kind = "flower", + .classify = fl_classify, +@@ -2528,6 +2539,7 @@ static struct tcf_proto_ops cls_fl_ops __read_mostly = { + .put = fl_put, + .change = fl_change, + .delete = fl_delete, ++ .delete_empty = fl_delete_empty, + .walk = fl_walk, + .reoffload = fl_reoffload, + .hw_add = fl_hw_add, +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 98dd87ce1510..78ecdf146882 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -301,6 +301,9 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q) + f->socket_hash != sk->sk_hash)) { + f->credit = q->initial_quantum; + f->socket_hash = sk->sk_hash; ++ if (q->rate_enable) ++ smp_store_release(&sk->sk_pacing_status, ++ SK_PACING_FQ); + if (fq_flow_is_throttled(f)) + fq_flow_unset_throttled(q, f); + f->time_next_packet = 0ULL; +@@ -322,8 +325,12 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q) + + fq_flow_set_detached(f); + f->sk = sk; +- if (skb->sk == sk) ++ if (skb->sk == sk) { + f->socket_hash = sk->sk_hash; ++ if (q->rate_enable) ++ smp_store_release(&sk->sk_pacing_status, ++ SK_PACING_FQ); ++ } + f->credit = q->initial_quantum; + + rb_link_node(&f->fq_node, parent, p); +@@ -428,17 +435,9 @@ static int fq_enqueue(struct sk_buff *skb, struct Qdisc *sch, + f->qlen++; + qdisc_qstats_backlog_inc(sch, skb); + if (fq_flow_is_detached(f)) { +- struct sock *sk = skb->sk; +- + fq_flow_add_tail(&q->new_flows, f); + if (time_after(jiffies, f->age + q->flow_refill_delay)) + f->credit = max_t(u32, f->credit, q->quantum); +- if (sk && q->rate_enable) { +- if (unlikely(smp_load_acquire(&sk->sk_pacing_status) != +- SK_PACING_FQ)) +- smp_store_release(&sk->sk_pacing_status, +- SK_PACING_FQ); +- } + q->inactive_flows--; + } + +diff --git a/net/sctp/stream.c b/net/sctp/stream.c +index 6a30392068a0..c1a100d2fed3 100644 +--- a/net/sctp/stream.c ++++ b/net/sctp/stream.c +@@ -84,10 +84,8 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt, + return 0; + + ret = genradix_prealloc(&stream->out, outcnt, gfp); +- if (ret) { +- genradix_free(&stream->out); ++ if (ret) + return ret; +- } + + stream->outcnt = outcnt; + return 0; +@@ -102,10 +100,8 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt, + return 0; + + ret = genradix_prealloc(&stream->in, incnt, gfp); +- if (ret) { +- genradix_free(&stream->in); ++ if (ret) + return ret; +- } + + stream->incnt = incnt; + return 0; +@@ -123,7 +119,7 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt, + * a new one with new outcnt to save memory if needed. + */ + if (outcnt == stream->outcnt) +- goto in; ++ goto handle_in; + + /* Filter out chunks queued on streams that won't exist anymore */ + sched->unsched_all(stream); +@@ -132,24 +128,28 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt, + + ret = sctp_stream_alloc_out(stream, outcnt, gfp); + if (ret) +- goto out; ++ goto out_err; + + for (i = 0; i < stream->outcnt; i++) + SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN; + +-in: ++handle_in: + sctp_stream_interleave_init(stream); + if (!incnt) + goto out; + + ret = sctp_stream_alloc_in(stream, incnt, gfp); +- if (ret) { +- sched->free(stream); +- genradix_free(&stream->out); +- stream->outcnt = 0; +- goto out; +- } ++ if (ret) ++ goto in_err; ++ ++ goto out; + ++in_err: ++ sched->free(stream); ++ genradix_free(&stream->in); ++out_err: ++ genradix_free(&stream->out); ++ stream->outcnt = 0; + out: + return ret; + } +diff --git a/net/sctp/transport.c b/net/sctp/transport.c +index 7235a6032671..3bbe1a58ec87 100644 +--- a/net/sctp/transport.c ++++ b/net/sctp/transport.c +@@ -263,7 +263,7 @@ bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu) + + pf->af->from_sk(&addr, sk); + pf->to_sk_daddr(&t->ipaddr, sk); +- dst->ops->update_pmtu(dst, sk, NULL, pmtu); ++ dst->ops->update_pmtu(dst, sk, NULL, pmtu, true); + pf->to_sk_daddr(&addr, sk); + + dst = sctp_transport_dst_check(t); +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 737b49909a7a..6a6d3b2aa5a9 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -854,6 +854,8 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr, + goto out; + + sock_hold(&smc->sk); /* sock put in passive closing */ ++ if (smc->use_fallback) ++ goto out; + if (flags & O_NONBLOCK) { + if (schedule_work(&smc->connect_work)) + smc->connect_nonblock = 1; +@@ -1716,8 +1718,6 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + sk->sk_err = smc->clcsock->sk->sk_err; + sk->sk_error_report(sk); + } +- if (rc) +- return rc; + + if (optlen < sizeof(int)) + return -EINVAL; +@@ -1725,6 +1725,8 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + return -EFAULT; + + lock_sock(sk); ++ if (rc || smc->use_fallback) ++ goto out; + switch (optname) { + case TCP_ULP: + case TCP_FASTOPEN: +@@ -1736,15 +1738,14 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + smc_switch_to_fallback(smc); + smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP; + } else { +- if (!smc->use_fallback) +- rc = -EINVAL; ++ rc = -EINVAL; + } + break; + case TCP_NODELAY: + if (sk->sk_state != SMC_INIT && + sk->sk_state != SMC_LISTEN && + sk->sk_state != SMC_CLOSED) { +- if (val && !smc->use_fallback) ++ if (val) + mod_delayed_work(system_wq, &smc->conn.tx_work, + 0); + } +@@ -1753,7 +1754,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + if (sk->sk_state != SMC_INIT && + sk->sk_state != SMC_LISTEN && + sk->sk_state != SMC_CLOSED) { +- if (!val && !smc->use_fallback) ++ if (!val) + mod_delayed_work(system_wq, &smc->conn.tx_work, + 0); + } +@@ -1764,6 +1765,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + default: + break; + } ++out: + release_sock(sk); + + return rc; +diff --git a/scripts/dtc/Makefile b/scripts/dtc/Makefile +index 82160808765c..b5a5b1c548c9 100644 +--- a/scripts/dtc/Makefile ++++ b/scripts/dtc/Makefile +@@ -11,7 +11,7 @@ dtc-objs += dtc-lexer.lex.o dtc-parser.tab.o + # Source files need to get at the userspace version of libfdt_env.h to compile + HOST_EXTRACFLAGS := -I $(srctree)/$(src)/libfdt + +-ifeq ($(wildcard /usr/include/yaml.h),) ++ifeq ($(shell pkg-config --exists yaml-0.1 2>/dev/null && echo yes),) + ifneq ($(CHECK_DTBS),) + $(error dtc needs libyaml for DT schema validation support. \ + Install the necessary libyaml development package.) +@@ -19,7 +19,7 @@ endif + HOST_EXTRACFLAGS += -DNO_YAML + else + dtc-objs += yamltree.o +-HOSTLDLIBS_dtc := -lyaml ++HOSTLDLIBS_dtc := $(shell pkg-config yaml-0.1 --libs) + endif + + # Generated files need one more search path to include headers in source tree +diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c +index ae6504d07fd6..fb15f09e0e38 100644 +--- a/scripts/kallsyms.c ++++ b/scripts/kallsyms.c +@@ -489,6 +489,8 @@ static void build_initial_tok_table(void) + table[pos] = table[i]; + learn_symbol(table[pos].sym, table[pos].len); + pos++; ++ } else { ++ free(table[i].sym); + } + } + table_cnt = pos; +diff --git a/security/apparmor/label.c b/security/apparmor/label.c +index 59f1cc2557a7..470693239e64 100644 +--- a/security/apparmor/label.c ++++ b/security/apparmor/label.c +@@ -1458,11 +1458,13 @@ static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label, + /* helper macro for snprint routines */ + #define update_for_len(total, len, size, str) \ + do { \ ++ size_t ulen = len; \ ++ \ + AA_BUG(len < 0); \ +- total += len; \ +- len = min(len, size); \ +- size -= len; \ +- str += len; \ ++ total += ulen; \ ++ ulen = min(ulen, size); \ ++ size -= ulen; \ ++ str += ulen; \ + } while (0) + + /** +@@ -1597,7 +1599,7 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, + struct aa_ns *prev_ns = NULL; + struct label_it i; + int count = 0, total = 0; +- size_t len; ++ ssize_t len; + + AA_BUG(!str && size != 0); + AA_BUG(!label); +diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c +index e7832448d721..bf38fc1b59b2 100644 +--- a/security/tomoyo/realpath.c ++++ b/security/tomoyo/realpath.c +@@ -217,31 +217,6 @@ out: + return ERR_PTR(-ENOMEM); + } + +-/** +- * tomoyo_get_socket_name - Get the name of a socket. +- * +- * @path: Pointer to "struct path". +- * @buffer: Pointer to buffer to return value in. +- * @buflen: Sizeof @buffer. +- * +- * Returns the buffer. +- */ +-static char *tomoyo_get_socket_name(const struct path *path, char * const buffer, +- const int buflen) +-{ +- struct inode *inode = d_backing_inode(path->dentry); +- struct socket *sock = inode ? SOCKET_I(inode) : NULL; +- struct sock *sk = sock ? sock->sk : NULL; +- +- if (sk) { +- snprintf(buffer, buflen, "socket:[family=%u:type=%u:protocol=%u]", +- sk->sk_family, sk->sk_type, sk->sk_protocol); +- } else { +- snprintf(buffer, buflen, "socket:[unknown]"); +- } +- return buffer; +-} +- + /** + * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root. + * +@@ -279,12 +254,7 @@ char *tomoyo_realpath_from_path(const struct path *path) + break; + /* To make sure that pos is '\0' terminated. */ + buf[buf_len - 1] = '\0'; +- /* Get better name for socket. */ +- if (sb->s_magic == SOCKFS_MAGIC) { +- pos = tomoyo_get_socket_name(path, buf, buf_len - 1); +- goto encode; +- } +- /* For "pipe:[\$]". */ ++ /* For "pipe:[\$]" and "socket:[\$]". */ + if (dentry->d_op && dentry->d_op->d_dname) { + pos = dentry->d_op->d_dname(dentry, buf, buf_len - 1); + goto encode; +diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c +index c37a78677955..265682296836 100644 +--- a/tools/perf/builtin-diff.c ++++ b/tools/perf/builtin-diff.c +@@ -575,8 +575,8 @@ static int64_t block_cycles_diff_cmp(struct hist_entry *left, + if (!pairs_left && !pairs_right) + return 0; + +- l = labs(left->diff.cycles); +- r = labs(right->diff.cycles); ++ l = llabs(left->diff.cycles); ++ r = llabs(right->diff.cycles); + return r - l; + } + +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 6dba8b728d23..3983d6ccd14d 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -448,7 +448,7 @@ static int perf_evsel__check_attr(struct evsel *evsel, + "selected. Hence, no address to lookup the source line number.\n"); + return -EINVAL; + } +- if (PRINT_FIELD(BRSTACKINSN) && ++ if (PRINT_FIELD(BRSTACKINSN) && !allow_user_set && + !(perf_evlist__combined_branch_type(session->evlist) & + PERF_SAMPLE_BRANCH_ANY)) { + pr_err("Display of branch stack assembler requested, but non all-branch filter set\n" +diff --git a/tools/perf/util/perf_regs.h b/tools/perf/util/perf_regs.h +index 47fe34e5f7d5..ec7640cc4c91 100644 +--- a/tools/perf/util/perf_regs.h ++++ b/tools/perf/util/perf_regs.h +@@ -41,7 +41,7 @@ int perf_reg_value(u64 *valp, struct regs_dump *regs, int id); + + static inline const char *perf_reg_name(int id __maybe_unused) + { +- return NULL; ++ return "unknown"; + } + + static inline int perf_reg_value(u64 *valp __maybe_unused, +diff --git a/tools/power/x86/intel-speed-select/isst-config.c b/tools/power/x86/intel-speed-select/isst-config.c +index 2a9890c8395a..21fcfe621d3a 100644 +--- a/tools/power/x86/intel-speed-select/isst-config.c ++++ b/tools/power/x86/intel-speed-select/isst-config.c +@@ -169,7 +169,7 @@ int get_topo_max_cpus(void) + static void set_cpu_online_offline(int cpu, int state) + { + char buffer[128]; +- int fd; ++ int fd, ret; + + snprintf(buffer, sizeof(buffer), + "/sys/devices/system/cpu/cpu%d/online", cpu); +@@ -179,9 +179,12 @@ static void set_cpu_online_offline(int cpu, int state) + err(-1, "%s open failed", buffer); + + if (state) +- write(fd, "1\n", 2); ++ ret = write(fd, "1\n", 2); + else +- write(fd, "0\n", 2); ++ ret = write(fd, "0\n", 2); ++ ++ if (ret == -1) ++ perror("Online/Offline: Operation failed\n"); + + close(fd); + } +diff --git a/tools/power/x86/intel-speed-select/isst-core.c b/tools/power/x86/intel-speed-select/isst-core.c +index 6dee5332c9d3..fde3f9cefc6d 100644 +--- a/tools/power/x86/intel-speed-select/isst-core.c ++++ b/tools/power/x86/intel-speed-select/isst-core.c +@@ -553,7 +553,6 @@ int isst_get_process_ctdp(int cpu, int tdp_level, struct isst_pkg_ctdp *pkg_dev) + i); + ctdp_level = &pkg_dev->ctdp_level[i]; + +- ctdp_level->processed = 1; + ctdp_level->level = i; + ctdp_level->control_cpu = cpu; + ctdp_level->pkg_id = get_physical_package_id(cpu); +@@ -561,7 +560,10 @@ int isst_get_process_ctdp(int cpu, int tdp_level, struct isst_pkg_ctdp *pkg_dev) + + ret = isst_get_ctdp_control(cpu, i, ctdp_level); + if (ret) +- return ret; ++ continue; ++ ++ pkg_dev->processed = 1; ++ ctdp_level->processed = 1; + + ret = isst_get_tdp_info(cpu, i, ctdp_level); + if (ret) +@@ -614,8 +616,6 @@ int isst_get_process_ctdp(int cpu, int tdp_level, struct isst_pkg_ctdp *pkg_dev) + } + } + +- pkg_dev->processed = 1; +- + return 0; + } + +diff --git a/tools/power/x86/intel-speed-select/isst-display.c b/tools/power/x86/intel-speed-select/isst-display.c +index 40346d534f78..b11575c3e886 100644 +--- a/tools/power/x86/intel-speed-select/isst-display.c ++++ b/tools/power/x86/intel-speed-select/isst-display.c +@@ -314,7 +314,8 @@ void isst_ctdp_display_information(int cpu, FILE *outf, int tdp_level, + char value[256]; + int i, base_level = 1; + +- print_package_info(cpu, outf); ++ if (pkg_dev->processed) ++ print_package_info(cpu, outf); + + for (i = 0; i <= pkg_dev->levels; ++i) { + struct isst_pkg_ctdp_level_info *ctdp_level; +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c +index 25e23e73c72e..2ecfa1158e2b 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c +@@ -73,7 +73,7 @@ trans: + [sprn_texasr]"i"(SPRN_TEXASR), [tar_1]"i"(TAR_1), + [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), [dscr_2]"i"(DSCR_2), + [tar_3]"i"(TAR_3), [dscr_3]"i"(DSCR_3) +- : "memory", "r0", "r1", "r3", "r4", "r5", "r6" ++ : "memory", "r0", "r3", "r4", "r5", "r6", "lr" + ); + + /* TM failed, analyse */ +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c +index f603fe5a445b..6f7fb51f0809 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c +@@ -74,8 +74,8 @@ trans: + "3: ;" + : [res] "=r" (result), [texasr] "=r" (texasr) + : [sprn_texasr] "i" (SPRN_TEXASR) +- : "memory", "r0", "r1", "r3", "r4", +- "r7", "r8", "r9", "r10", "r11" ++ : "memory", "r0", "r3", "r4", ++ "r7", "r8", "r9", "r10", "r11", "lr" + ); + + if (result) { +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c +index e0d37f07bdeb..46ef378a15ec 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c +@@ -62,7 +62,7 @@ trans: + [sprn_ppr]"i"(SPRN_PPR), [sprn_texasr]"i"(SPRN_TEXASR), + [tar_1]"i"(TAR_1), [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), + [dscr_2]"i"(DSCR_2), [cptr1] "b" (&cptr[1]) +- : "memory", "r0", "r1", "r3", "r4", "r5", "r6" ++ : "memory", "r0", "r3", "r4", "r5", "r6" + ); + + /* TM failed, analyse */ +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c +index 8027457b97b7..70ca01234f79 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c +@@ -62,8 +62,8 @@ trans: + "3: ;" + : [res] "=r" (result), [texasr] "=r" (texasr) + : [sprn_texasr] "i" (SPRN_TEXASR), [cptr1] "b" (&cptr[1]) +- : "memory", "r0", "r1", "r3", "r4", +- "r7", "r8", "r9", "r10", "r11" ++ : "memory", "r0", "r3", "r4", ++ "r7", "r8", "r9", "r10", "r11", "lr" + ); + + if (result) { +diff --git a/tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c b/tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c +index 56fbf9f6bbf3..07c388147b75 100644 +--- a/tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c ++++ b/tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c +@@ -10,10 +10,12 @@ + */ + + #define _GNU_SOURCE ++#include + #include + #include + + #include "utils.h" ++#include "tm.h" + + void trap_signal_handler(int signo, siginfo_t *si, void *uc) + { +@@ -29,6 +31,8 @@ int tm_signal_sigreturn_nt(void) + { + struct sigaction trap_sa; + ++ SKIP_IF(!have_htm()); ++ + trap_sa.sa_flags = SA_SIGINFO; + trap_sa.sa_sigaction = trap_signal_handler; + +diff --git a/tools/testing/selftests/vm/config b/tools/testing/selftests/vm/config +index 1c0d76cb5adf..93b90a9b1eeb 100644 +--- a/tools/testing/selftests/vm/config ++++ b/tools/testing/selftests/vm/config +@@ -1,2 +1,3 @@ + CONFIG_SYSVIPC=y + CONFIG_USERFAULTFD=y ++CONFIG_TEST_VMALLOC=m diff --git a/patch/kernel/meson64-current/02-patch-5.4.8-9.patch b/patch/kernel/meson64-current/02-patch-5.4.8-9.patch new file mode 100644 index 0000000000..38b8796303 --- /dev/null +++ b/patch/kernel/meson64-current/02-patch-5.4.8-9.patch @@ -0,0 +1,7432 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index f5a551e4332d..5594c8bf1dcd 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -113,7 +113,7 @@ + the GPE dispatcher. + This facility can be used to prevent such uncontrolled + GPE floodings. +- Format: ++ Format: + + acpi_no_auto_serialize [HW,ACPI] + Disable auto-serialization of AML methods +diff --git a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt +index e96e085271c1..83f6c6a7c41c 100644 +--- a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt ++++ b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt +@@ -46,7 +46,7 @@ Required properties: + Example (R-Car H3): + + usb2_clksel: clock-controller@e6590630 { +- compatible = "renesas,r8a77950-rcar-usb2-clock-sel", ++ compatible = "renesas,r8a7795-rcar-usb2-clock-sel", + "renesas,rcar-gen3-usb2-clock-sel"; + reg = <0 0xe6590630 0 0x02>; + clocks = <&cpg CPG_MOD 703>, <&usb_extal>, <&usb_xtal>; +diff --git a/Makefile b/Makefile +index 1adee1b06f3d..3ba15c3528c8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 8 ++SUBLEVEL = 9 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +index 6039adda12ee..b0b12e389835 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +@@ -296,7 +296,7 @@ + }; + + &usb0_phy { +- status = "okay"; ++ status = "disabled"; + phy-supply = <&usb_otg_pwr>; + }; + +@@ -306,7 +306,7 @@ + }; + + &usb0 { +- status = "okay"; ++ status = "disabled"; + }; + + &usb1 { +diff --git a/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi b/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi +index 9682d4dd7496..1bae90705746 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi +@@ -23,6 +23,43 @@ + }; + }; + ++/* ++ * The laptop FW does not appear to support the retention state as it is ++ * not advertised as enabled in ACPI, and enabling it in DT can cause boot ++ * hangs. ++ */ ++&CPU0 { ++ cpu-idle-states = <&LITTLE_CPU_SLEEP_1>; ++}; ++ ++&CPU1 { ++ cpu-idle-states = <&LITTLE_CPU_SLEEP_1>; ++}; ++ ++&CPU2 { ++ cpu-idle-states = <&LITTLE_CPU_SLEEP_1>; ++}; ++ ++&CPU3 { ++ cpu-idle-states = <&LITTLE_CPU_SLEEP_1>; ++}; ++ ++&CPU4 { ++ cpu-idle-states = <&BIG_CPU_SLEEP_1>; ++}; ++ ++&CPU5 { ++ cpu-idle-states = <&BIG_CPU_SLEEP_1>; ++}; ++ ++&CPU6 { ++ cpu-idle-states = <&BIG_CPU_SLEEP_1>; ++}; ++ ++&CPU7 { ++ cpu-idle-states = <&BIG_CPU_SLEEP_1>; ++}; ++ + &qusb2phy { + status = "okay"; + +diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h +index 8dc6c5cdabe6..baf52baaa2a5 100644 +--- a/arch/arm64/include/asm/pgtable-prot.h ++++ b/arch/arm64/include/asm/pgtable-prot.h +@@ -85,13 +85,12 @@ + #define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE) + #define PAGE_READONLY __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN) + #define PAGE_READONLY_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN) +-#define PAGE_EXECONLY __pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN) + + #define __P000 PAGE_NONE + #define __P001 PAGE_READONLY + #define __P010 PAGE_READONLY + #define __P011 PAGE_READONLY +-#define __P100 PAGE_EXECONLY ++#define __P100 PAGE_READONLY_EXEC + #define __P101 PAGE_READONLY_EXEC + #define __P110 PAGE_READONLY_EXEC + #define __P111 PAGE_READONLY_EXEC +@@ -100,7 +99,7 @@ + #define __S001 PAGE_READONLY + #define __S010 PAGE_SHARED + #define __S011 PAGE_SHARED +-#define __S100 PAGE_EXECONLY ++#define __S100 PAGE_READONLY_EXEC + #define __S101 PAGE_READONLY_EXEC + #define __S110 PAGE_SHARED_EXEC + #define __S111 PAGE_SHARED_EXEC +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 565aa45ef134..13ebe2bad79f 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -96,12 +96,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; + #define pte_dirty(pte) (pte_sw_dirty(pte) || pte_hw_dirty(pte)) + + #define pte_valid(pte) (!!(pte_val(pte) & PTE_VALID)) +-/* +- * Execute-only user mappings do not have the PTE_USER bit set. All valid +- * kernel mappings have the PTE_UXN bit set. +- */ + #define pte_valid_not_user(pte) \ +- ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN)) ++ ((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID) + #define pte_valid_young(pte) \ + ((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF)) + #define pte_valid_user(pte) \ +@@ -117,8 +113,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; + + /* + * p??_access_permitted() is true for valid user mappings (subject to the +- * write permission check) other than user execute-only which do not have the +- * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set. ++ * write permission check). PROT_NONE mappings do not have the PTE_VALID bit ++ * set. + */ + #define pte_access_permitted(pte, write) \ + (pte_valid_user(pte) && (!(write) || pte_write(pte))) +diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c +index 9fc6db0bcbad..d26e6cd28953 100644 +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -454,7 +454,7 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, + const struct fault_info *inf; + struct mm_struct *mm = current->mm; + vm_fault_t fault, major = 0; +- unsigned long vm_flags = VM_READ | VM_WRITE; ++ unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC; + unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; + + if (kprobe_page_fault(regs, esr)) +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 60c929f3683b..d10247fab0fd 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -1069,7 +1069,6 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + + /* + * FIXME: Cleanup page tables (also in arch_add_memory() in case +@@ -1078,7 +1077,6 @@ void arch_remove_memory(int nid, u64 start, u64 size, + * unplug. ARCH_ENABLE_MEMORY_HOTREMOVE must not be + * unlocked yet. + */ +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + } + #endif +diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c +index bf9df2625bc8..a6dd80a2c939 100644 +--- a/arch/ia64/mm/init.c ++++ b/arch/ia64/mm/init.c +@@ -689,9 +689,7 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + } + #endif +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index a0bd9bdb5f83..e5c2d47608fe 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -46,7 +46,7 @@ config MIPS + select HAVE_ARCH_TRACEHOOK + select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES + select HAVE_ASM_MODVERSIONS +- select HAVE_EBPF_JIT if (!CPU_MICROMIPS) ++ select HAVE_EBPF_JIT if 64BIT && !CPU_MICROMIPS && TARGET_ISA_REV >= 2 + select HAVE_CONTEXT_TRACKING + select HAVE_COPY_THREAD_TLS + select HAVE_C_RECORDMCOUNT +diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h +index 4993db40482c..ee26f9a4575d 100644 +--- a/arch/mips/include/asm/thread_info.h ++++ b/arch/mips/include/asm/thread_info.h +@@ -49,8 +49,26 @@ struct thread_info { + .addr_limit = KERNEL_DS, \ + } + +-/* How to get the thread information struct from C. */ ++/* ++ * A pointer to the struct thread_info for the currently executing thread is ++ * held in register $28/$gp. ++ * ++ * We declare __current_thread_info as a global register variable rather than a ++ * local register variable within current_thread_info() because clang doesn't ++ * support explicit local register variables. ++ * ++ * When building the VDSO we take care not to declare the global register ++ * variable because this causes GCC to not preserve the value of $28/$gp in ++ * functions that change its value (which is common in the PIC VDSO when ++ * accessing the GOT). Since the VDSO shouldn't be accessing ++ * __current_thread_info anyway we declare it extern in order to cause a link ++ * failure if it's referenced. ++ */ ++#ifdef __VDSO__ ++extern struct thread_info *__current_thread_info; ++#else + register struct thread_info *__current_thread_info __asm__("$28"); ++#endif + + static inline struct thread_info *current_thread_info(void) + { +diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c +index 46b76751f3a5..a2405d5f7d1e 100644 +--- a/arch/mips/net/ebpf_jit.c ++++ b/arch/mips/net/ebpf_jit.c +@@ -1803,7 +1803,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + unsigned int image_size; + u8 *image_ptr; + +- if (!prog->jit_requested || MIPS_ISA_REV < 2) ++ if (!prog->jit_requested) + return prog; + + tmp = bpf_jit_blind_constants(prog); +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index be941d382c8d..460afa415434 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -104,6 +104,27 @@ int __weak remove_section_mapping(unsigned long start, unsigned long end) + return -ENODEV; + } + ++#define FLUSH_CHUNK_SIZE SZ_1G ++/** ++ * flush_dcache_range_chunked(): Write any modified data cache blocks out to ++ * memory and invalidate them, in chunks of up to FLUSH_CHUNK_SIZE ++ * Does not invalidate the corresponding instruction cache blocks. ++ * ++ * @start: the start address ++ * @stop: the stop address (exclusive) ++ * @chunk: the max size of the chunks ++ */ ++static void flush_dcache_range_chunked(unsigned long start, unsigned long stop, ++ unsigned long chunk) ++{ ++ unsigned long i; ++ ++ for (i = start; i < stop; i += chunk) { ++ flush_dcache_range(i, min(stop, start + chunk)); ++ cond_resched(); ++ } ++} ++ + int __ref arch_add_memory(int nid, u64 start, u64 size, + struct mhp_restrictions *restrictions) + { +@@ -120,7 +141,8 @@ int __ref arch_add_memory(int nid, u64 start, u64 size, + start, start + size, rc); + return -EFAULT; + } +- flush_dcache_range(start, start + size); ++ ++ flush_dcache_range_chunked(start, start + size, FLUSH_CHUNK_SIZE); + + return __add_pages(nid, start_pfn, nr_pages, restrictions); + } +@@ -130,14 +152,14 @@ void __ref arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct page *page = pfn_to_page(start_pfn) + vmem_altmap_offset(altmap); + int ret; + +- __remove_pages(page_zone(page), start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + + /* Remove htab bolted mappings for this section of memory */ + start = (unsigned long)__va(start); +- flush_dcache_range(start, start + size); ++ flush_dcache_range_chunked(start, start + size, FLUSH_CHUNK_SIZE); ++ + ret = remove_section_mapping(start, start + size); + WARN_ON_ONCE(ret); + +diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c +index 42bbcd47cc85..dffe1a45b6ed 100644 +--- a/arch/powerpc/mm/slice.c ++++ b/arch/powerpc/mm/slice.c +@@ -50,7 +50,7 @@ static void slice_print_mask(const char *label, const struct slice_mask *mask) { + + #endif + +-static inline bool slice_addr_is_low(unsigned long addr) ++static inline notrace bool slice_addr_is_low(unsigned long addr) + { + u64 tmp = (u64)addr; + +@@ -659,7 +659,7 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp, + mm_ctx_user_psize(¤t->mm->context), 1); + } + +-unsigned int get_slice_psize(struct mm_struct *mm, unsigned long addr) ++unsigned int notrace get_slice_psize(struct mm_struct *mm, unsigned long addr) + { + unsigned char *psizes; + int index, mask_index; +diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c +index b94d8db5ddcc..c40fdcdeb950 100644 +--- a/arch/riscv/kernel/ftrace.c ++++ b/arch/riscv/kernel/ftrace.c +@@ -142,7 +142,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr, + */ + old = *parent; + +- if (function_graph_enter(old, self_addr, frame_pointer, parent)) ++ if (!function_graph_enter(old, self_addr, frame_pointer, parent)) + *parent = return_hooker; + } + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 7511b71d2931..fdb8083e7870 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -1313,18 +1313,28 @@ static void hw_perf_event_update(struct perf_event *event, int flush_all) + */ + if (flush_all && done) + break; +- +- /* If an event overflow happened, discard samples by +- * processing any remaining sample-data-blocks. +- */ +- if (event_overflow) +- flush_all = 1; + } + + /* Account sample overflows in the event hardware structure */ + if (sampl_overflow) + OVERFLOW_REG(hwc) = DIV_ROUND_UP(OVERFLOW_REG(hwc) + + sampl_overflow, 1 + num_sdb); ++ ++ /* Perf_event_overflow() and perf_event_account_interrupt() limit ++ * the interrupt rate to an upper limit. Roughly 1000 samples per ++ * task tick. ++ * Hitting this limit results in a large number ++ * of throttled REF_REPORT_THROTTLE entries and the samples ++ * are dropped. ++ * Slightly increase the interval to avoid hitting this limit. ++ */ ++ if (event_overflow) { ++ SAMPL_RATE(hwc) += DIV_ROUND_UP(SAMPL_RATE(hwc), 10); ++ debug_sprintf_event(sfdbg, 1, "%s: rate adjustment %ld\n", ++ __func__, ++ DIV_ROUND_UP(SAMPL_RATE(hwc), 10)); ++ } ++ + if (sampl_overflow || event_overflow) + debug_sprintf_event(sfdbg, 4, "hw_perf_event_update: " + "overflow stats: sample=%llu event=%llu\n", +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index d95c85780e07..06dddd7c4290 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -727,39 +727,67 @@ static void __ref smp_get_core_info(struct sclp_core_info *info, int early) + + static int smp_add_present_cpu(int cpu); + +-static int __smp_rescan_cpus(struct sclp_core_info *info, int sysfs_add) ++static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail, ++ bool configured, bool early) + { + struct pcpu *pcpu; +- cpumask_t avail; +- int cpu, nr, i, j; ++ int cpu, nr, i; + u16 address; + + nr = 0; +- cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask); +- cpu = cpumask_first(&avail); +- for (i = 0; (i < info->combined) && (cpu < nr_cpu_ids); i++) { +- if (sclp.has_core_type && info->core[i].type != boot_core_type) ++ if (sclp.has_core_type && core->type != boot_core_type) ++ return nr; ++ cpu = cpumask_first(avail); ++ address = core->core_id << smp_cpu_mt_shift; ++ for (i = 0; (i <= smp_cpu_mtid) && (cpu < nr_cpu_ids); i++) { ++ if (pcpu_find_address(cpu_present_mask, address + i)) + continue; +- address = info->core[i].core_id << smp_cpu_mt_shift; +- for (j = 0; j <= smp_cpu_mtid; j++) { +- if (pcpu_find_address(cpu_present_mask, address + j)) +- continue; +- pcpu = pcpu_devices + cpu; +- pcpu->address = address + j; +- pcpu->state = +- (cpu >= info->configured*(smp_cpu_mtid + 1)) ? +- CPU_STATE_STANDBY : CPU_STATE_CONFIGURED; +- smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN); +- set_cpu_present(cpu, true); +- if (sysfs_add && smp_add_present_cpu(cpu) != 0) +- set_cpu_present(cpu, false); +- else +- nr++; +- cpu = cpumask_next(cpu, &avail); +- if (cpu >= nr_cpu_ids) ++ pcpu = pcpu_devices + cpu; ++ pcpu->address = address + i; ++ if (configured) ++ pcpu->state = CPU_STATE_CONFIGURED; ++ else ++ pcpu->state = CPU_STATE_STANDBY; ++ smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN); ++ set_cpu_present(cpu, true); ++ if (!early && smp_add_present_cpu(cpu) != 0) ++ set_cpu_present(cpu, false); ++ else ++ nr++; ++ cpumask_clear_cpu(cpu, avail); ++ cpu = cpumask_next(cpu, avail); ++ } ++ return nr; ++} ++ ++static int __smp_rescan_cpus(struct sclp_core_info *info, bool early) ++{ ++ struct sclp_core_entry *core; ++ cpumask_t avail; ++ bool configured; ++ u16 core_id; ++ int nr, i; ++ ++ nr = 0; ++ cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask); ++ /* ++ * Add IPL core first (which got logical CPU number 0) to make sure ++ * that all SMT threads get subsequent logical CPU numbers. ++ */ ++ if (early) { ++ core_id = pcpu_devices[0].address >> smp_cpu_mt_shift; ++ for (i = 0; i < info->configured; i++) { ++ core = &info->core[i]; ++ if (core->core_id == core_id) { ++ nr += smp_add_core(core, &avail, true, early); + break; ++ } + } + } ++ for (i = 0; i < info->combined; i++) { ++ configured = i < info->configured; ++ nr += smp_add_core(&info->core[i], &avail, configured, early); ++ } + return nr; + } + +@@ -808,7 +836,7 @@ void __init smp_detect_cpus(void) + + /* Add CPUs present at boot */ + get_online_cpus(); +- __smp_rescan_cpus(info, 0); ++ __smp_rescan_cpus(info, true); + put_online_cpus(); + memblock_free_early((unsigned long)info, sizeof(*info)); + } +@@ -1153,7 +1181,7 @@ int __ref smp_rescan_cpus(void) + smp_get_core_info(info, 0); + get_online_cpus(); + mutex_lock(&smp_cpu_state_mutex); +- nr = __smp_rescan_cpus(info, 1); ++ nr = __smp_rescan_cpus(info, false); + mutex_unlock(&smp_cpu_state_mutex); + put_online_cpus(); + kfree(info); +diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c +index a124f19f7b3c..c1d96e588152 100644 +--- a/arch/s390/mm/init.c ++++ b/arch/s390/mm/init.c +@@ -291,10 +291,8 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + vmem_remove_mapping(start, size); + } + #endif /* CONFIG_MEMORY_HOTPLUG */ +diff --git a/arch/sh/mm/init.c b/arch/sh/mm/init.c +index dfdbaa50946e..d1b1ff2be17a 100644 +--- a/arch/sh/mm/init.c ++++ b/arch/sh/mm/init.c +@@ -434,9 +434,7 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = PFN_DOWN(start); + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + } + #endif /* CONFIG_MEMORY_HOTPLUG */ +diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c +index 5ee3fed881d3..741540d849f3 100644 +--- a/arch/x86/events/intel/bts.c ++++ b/arch/x86/events/intel/bts.c +@@ -63,9 +63,17 @@ struct bts_buffer { + + static struct pmu bts_pmu; + ++static int buf_nr_pages(struct page *page) ++{ ++ if (!PagePrivate(page)) ++ return 1; ++ ++ return 1 << page_private(page); ++} ++ + static size_t buf_size(struct page *page) + { +- return 1 << (PAGE_SHIFT + page_private(page)); ++ return buf_nr_pages(page) * PAGE_SIZE; + } + + static void * +@@ -83,9 +91,7 @@ bts_buffer_setup_aux(struct perf_event *event, void **pages, + /* count all the high order buffers */ + for (pg = 0, nbuf = 0; pg < nr_pages;) { + page = virt_to_page(pages[pg]); +- if (WARN_ON_ONCE(!PagePrivate(page) && nr_pages > 1)) +- return NULL; +- pg += 1 << page_private(page); ++ pg += buf_nr_pages(page); + nbuf++; + } + +@@ -109,7 +115,7 @@ bts_buffer_setup_aux(struct perf_event *event, void **pages, + unsigned int __nr_pages; + + page = virt_to_page(pages[pg]); +- __nr_pages = PagePrivate(page) ? 1 << page_private(page) : 1; ++ __nr_pages = buf_nr_pages(page); + buf->buf[nbuf].page = page; + buf->buf[nbuf].offset = offset; + buf->buf[nbuf].displacement = (pad ? BTS_RECORD_SIZE - pad : 0); +diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c +index 930edeb41ec3..0a74407ef92e 100644 +--- a/arch/x86/mm/init_32.c ++++ b/arch/x86/mm/init_32.c +@@ -865,10 +865,8 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + } + #endif + +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index a6b5c653727b..b8541d77452c 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -1212,10 +1212,8 @@ void __ref arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct page *page = pfn_to_page(start_pfn) + vmem_altmap_offset(altmap); +- struct zone *zone = page_zone(page); + +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + kernel_physical_mapping_remove(start, start + size); + } + #endif /* CONFIG_MEMORY_HOTPLUG */ +diff --git a/block/bio.c b/block/bio.c +index 43df756b68c4..c822ceb7c4de 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -535,6 +535,45 @@ void zero_fill_bio_iter(struct bio *bio, struct bvec_iter start) + } + EXPORT_SYMBOL(zero_fill_bio_iter); + ++void bio_truncate(struct bio *bio, unsigned new_size) ++{ ++ struct bio_vec bv; ++ struct bvec_iter iter; ++ unsigned int done = 0; ++ bool truncated = false; ++ ++ if (new_size >= bio->bi_iter.bi_size) ++ return; ++ ++ if (bio_data_dir(bio) != READ) ++ goto exit; ++ ++ bio_for_each_segment(bv, bio, iter) { ++ if (done + bv.bv_len > new_size) { ++ unsigned offset; ++ ++ if (!truncated) ++ offset = new_size - done; ++ else ++ offset = 0; ++ zero_user(bv.bv_page, offset, bv.bv_len - offset); ++ truncated = true; ++ } ++ done += bv.bv_len; ++ } ++ ++ exit: ++ /* ++ * Don't touch bvec table here and make it really immutable, since ++ * fs bio user has to retrieve all pages via bio_for_each_segment_all ++ * in its .end_bio() callback. ++ * ++ * It is enough to truncate bio by updating .bi_size since we can make ++ * correct bvec with the updated .bi_size for drivers. ++ */ ++ bio->bi_iter.bi_size = new_size; ++} ++ + /** + * bio_put - release a reference to a bio + * @bio: bio to release reference to +diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c +index 6ca015f92766..7f053468b50d 100644 +--- a/block/compat_ioctl.c ++++ b/block/compat_ioctl.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -354,6 +355,10 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg) + * but we call blkdev_ioctl, which gets the lock for us + */ + case BLKRRPART: ++ case BLKREPORTZONE: ++ case BLKRESETZONE: ++ case BLKGETZONESZ: ++ case BLKGETNRZONES: + return blkdev_ioctl(bdev, mode, cmd, + (unsigned long)compat_ptr(arg)); + case BLKBSZSET_32: +@@ -401,6 +406,14 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg) + case BLKTRACETEARDOWN: /* compatible */ + ret = blk_trace_ioctl(bdev, cmd, compat_ptr(arg)); + return ret; ++ case IOC_PR_REGISTER: ++ case IOC_PR_RESERVE: ++ case IOC_PR_RELEASE: ++ case IOC_PR_PREEMPT: ++ case IOC_PR_PREEMPT_ABORT: ++ case IOC_PR_CLEAR: ++ return blkdev_ioctl(bdev, mode, cmd, ++ (unsigned long)compat_ptr(arg)); + default: + if (disk->fops->compat_ioctl) + ret = disk->fops->compat_ioctl(bdev, mode, cmd, arg); +diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c +index 75948a3f1a20..c60d2c6d31d6 100644 +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -819,14 +819,14 @@ end: + * interface: + * echo unmask > /sys/firmware/acpi/interrupts/gpe00 + */ +-#define ACPI_MASKABLE_GPE_MAX 0xFF ++#define ACPI_MASKABLE_GPE_MAX 0x100 + static DECLARE_BITMAP(acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) __initdata; + + static int __init acpi_gpe_set_masked_gpes(char *val) + { + u8 gpe; + +- if (kstrtou8(val, 0, &gpe) || gpe > ACPI_MASKABLE_GPE_MAX) ++ if (kstrtou8(val, 0, &gpe)) + return -EINVAL; + set_bit(gpe, acpi_masked_gpes_map); + +@@ -838,7 +838,7 @@ void __init acpi_gpe_apply_masked_gpes(void) + { + acpi_handle handle; + acpi_status status; +- u8 gpe; ++ u16 gpe; + + for_each_set_bit(gpe, acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) { + status = acpi_get_gpe_device(gpe, &handle); +diff --git a/drivers/ata/ahci_brcm.c b/drivers/ata/ahci_brcm.c +index f41744b9b38a..66a570d0da83 100644 +--- a/drivers/ata/ahci_brcm.c ++++ b/drivers/ata/ahci_brcm.c +@@ -76,8 +76,7 @@ enum brcm_ahci_version { + }; + + enum brcm_ahci_quirks { +- BRCM_AHCI_QUIRK_NO_NCQ = BIT(0), +- BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE = BIT(1), ++ BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE = BIT(0), + }; + + struct brcm_ahci_priv { +@@ -213,19 +212,12 @@ static void brcm_sata_phys_disable(struct brcm_ahci_priv *priv) + brcm_sata_phy_disable(priv, i); + } + +-static u32 brcm_ahci_get_portmask(struct platform_device *pdev, ++static u32 brcm_ahci_get_portmask(struct ahci_host_priv *hpriv, + struct brcm_ahci_priv *priv) + { +- void __iomem *ahci; +- struct resource *res; + u32 impl; + +- res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "ahci"); +- ahci = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(ahci)) +- return 0; +- +- impl = readl(ahci + HOST_PORTS_IMPL); ++ impl = readl(hpriv->mmio + HOST_PORTS_IMPL); + + if (fls(impl) > SATA_TOP_MAX_PHYS) + dev_warn(priv->dev, "warning: more ports than PHYs (%#x)\n", +@@ -233,9 +225,6 @@ static u32 brcm_ahci_get_portmask(struct platform_device *pdev, + else if (!impl) + dev_info(priv->dev, "no ports found\n"); + +- devm_iounmap(&pdev->dev, ahci); +- devm_release_mem_region(&pdev->dev, res->start, resource_size(res)); +- + return impl; + } + +@@ -285,6 +274,13 @@ static unsigned int brcm_ahci_read_id(struct ata_device *dev, + /* Perform the SATA PHY reset sequence */ + brcm_sata_phy_disable(priv, ap->port_no); + ++ /* Reset the SATA clock */ ++ ahci_platform_disable_clks(hpriv); ++ msleep(10); ++ ++ ahci_platform_enable_clks(hpriv); ++ msleep(10); ++ + /* Bring the PHY back on */ + brcm_sata_phy_enable(priv, ap->port_no); + +@@ -347,11 +343,10 @@ static int brcm_ahci_suspend(struct device *dev) + struct ata_host *host = dev_get_drvdata(dev); + struct ahci_host_priv *hpriv = host->private_data; + struct brcm_ahci_priv *priv = hpriv->plat_data; +- int ret; + +- ret = ahci_platform_suspend(dev); + brcm_sata_phys_disable(priv); +- return ret; ++ ++ return ahci_platform_suspend(dev); + } + + static int brcm_ahci_resume(struct device *dev) +@@ -359,11 +354,44 @@ static int brcm_ahci_resume(struct device *dev) + struct ata_host *host = dev_get_drvdata(dev); + struct ahci_host_priv *hpriv = host->private_data; + struct brcm_ahci_priv *priv = hpriv->plat_data; ++ int ret; ++ ++ /* Make sure clocks are turned on before re-configuration */ ++ ret = ahci_platform_enable_clks(hpriv); ++ if (ret) ++ return ret; + + brcm_sata_init(priv); + brcm_sata_phys_enable(priv); + brcm_sata_alpm_init(hpriv); +- return ahci_platform_resume(dev); ++ ++ /* Since we had to enable clocks earlier on, we cannot use ++ * ahci_platform_resume() as-is since a second call to ++ * ahci_platform_enable_resources() would bump up the resources ++ * (regulators, clocks, PHYs) count artificially so we copy the part ++ * after ahci_platform_enable_resources(). ++ */ ++ ret = ahci_platform_enable_phys(hpriv); ++ if (ret) ++ goto out_disable_phys; ++ ++ ret = ahci_platform_resume_host(dev); ++ if (ret) ++ goto out_disable_platform_phys; ++ ++ /* We resumed so update PM runtime state */ ++ pm_runtime_disable(dev); ++ pm_runtime_set_active(dev); ++ pm_runtime_enable(dev); ++ ++ return 0; ++ ++out_disable_platform_phys: ++ ahci_platform_disable_phys(hpriv); ++out_disable_phys: ++ brcm_sata_phys_disable(priv); ++ ahci_platform_disable_clks(hpriv); ++ return ret; + } + #endif + +@@ -410,44 +438,71 @@ static int brcm_ahci_probe(struct platform_device *pdev) + if (!IS_ERR_OR_NULL(priv->rcdev)) + reset_control_deassert(priv->rcdev); + +- if ((priv->version == BRCM_SATA_BCM7425) || +- (priv->version == BRCM_SATA_NSP)) { +- priv->quirks |= BRCM_AHCI_QUIRK_NO_NCQ; ++ hpriv = ahci_platform_get_resources(pdev, 0); ++ if (IS_ERR(hpriv)) { ++ ret = PTR_ERR(hpriv); ++ goto out_reset; ++ } ++ ++ hpriv->plat_data = priv; ++ hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP | AHCI_HFLAG_NO_WRITE_TO_RO; ++ ++ switch (priv->version) { ++ case BRCM_SATA_BCM7425: ++ hpriv->flags |= AHCI_HFLAG_DELAY_ENGINE; ++ /* fall through */ ++ case BRCM_SATA_NSP: ++ hpriv->flags |= AHCI_HFLAG_NO_NCQ; + priv->quirks |= BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE; ++ break; ++ default: ++ break; + } + ++ ret = ahci_platform_enable_clks(hpriv); ++ if (ret) ++ goto out_reset; ++ ++ /* Must be first so as to configure endianness including that ++ * of the standard AHCI register space. ++ */ + brcm_sata_init(priv); + +- priv->port_mask = brcm_ahci_get_portmask(pdev, priv); +- if (!priv->port_mask) +- return -ENODEV; ++ /* Initializes priv->port_mask which is used below */ ++ priv->port_mask = brcm_ahci_get_portmask(hpriv, priv); ++ if (!priv->port_mask) { ++ ret = -ENODEV; ++ goto out_disable_clks; ++ } + ++ /* Must be done before ahci_platform_enable_phys() */ + brcm_sata_phys_enable(priv); + +- hpriv = ahci_platform_get_resources(pdev, 0); +- if (IS_ERR(hpriv)) +- return PTR_ERR(hpriv); +- hpriv->plat_data = priv; +- hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP; +- + brcm_sata_alpm_init(hpriv); + +- ret = ahci_platform_enable_resources(hpriv); ++ ret = ahci_platform_enable_phys(hpriv); + if (ret) +- return ret; +- +- if (priv->quirks & BRCM_AHCI_QUIRK_NO_NCQ) +- hpriv->flags |= AHCI_HFLAG_NO_NCQ; +- hpriv->flags |= AHCI_HFLAG_NO_WRITE_TO_RO; ++ goto out_disable_phys; + + ret = ahci_platform_init_host(pdev, hpriv, &ahci_brcm_port_info, + &ahci_platform_sht); + if (ret) +- return ret; ++ goto out_disable_platform_phys; + + dev_info(dev, "Broadcom AHCI SATA3 registered\n"); + + return 0; ++ ++out_disable_platform_phys: ++ ahci_platform_disable_phys(hpriv); ++out_disable_phys: ++ brcm_sata_phys_disable(priv); ++out_disable_clks: ++ ahci_platform_disable_clks(hpriv); ++out_reset: ++ if (!IS_ERR_OR_NULL(priv->rcdev)) ++ reset_control_assert(priv->rcdev); ++ return ret; + } + + static int brcm_ahci_remove(struct platform_device *pdev) +@@ -457,12 +512,12 @@ static int brcm_ahci_remove(struct platform_device *pdev) + struct brcm_ahci_priv *priv = hpriv->plat_data; + int ret; + ++ brcm_sata_phys_disable(priv); ++ + ret = ata_platform_remove_one(pdev); + if (ret) + return ret; + +- brcm_sata_phys_disable(priv); +- + return 0; + } + +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index 8befce036af8..129556fcf6be 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -43,7 +43,7 @@ EXPORT_SYMBOL_GPL(ahci_platform_ops); + * RETURNS: + * 0 on success otherwise a negative error code + */ +-static int ahci_platform_enable_phys(struct ahci_host_priv *hpriv) ++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv) + { + int rc, i; + +@@ -74,6 +74,7 @@ disable_phys: + } + return rc; + } ++EXPORT_SYMBOL_GPL(ahci_platform_enable_phys); + + /** + * ahci_platform_disable_phys - Disable PHYs +@@ -81,7 +82,7 @@ disable_phys: + * + * This function disables all PHYs found in hpriv->phys. + */ +-static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv) ++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv) + { + int i; + +@@ -90,6 +91,7 @@ static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv) + phy_exit(hpriv->phys[i]); + } + } ++EXPORT_SYMBOL_GPL(ahci_platform_disable_phys); + + /** + * ahci_platform_enable_clks - Enable platform clocks +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 74c9b3032d46..84b183a6424e 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5325,6 +5325,30 @@ void ata_qc_complete(struct ata_queued_cmd *qc) + } + } + ++/** ++ * ata_qc_get_active - get bitmask of active qcs ++ * @ap: port in question ++ * ++ * LOCKING: ++ * spin_lock_irqsave(host lock) ++ * ++ * RETURNS: ++ * Bitmask of active qcs ++ */ ++u64 ata_qc_get_active(struct ata_port *ap) ++{ ++ u64 qc_active = ap->qc_active; ++ ++ /* ATA_TAG_INTERNAL is sent to hw as tag 0 */ ++ if (qc_active & (1ULL << ATA_TAG_INTERNAL)) { ++ qc_active |= (1 << 0); ++ qc_active &= ~(1ULL << ATA_TAG_INTERNAL); ++ } ++ ++ return qc_active; ++} ++EXPORT_SYMBOL_GPL(ata_qc_get_active); ++ + /** + * ata_qc_complete_multiple - Complete multiple qcs successfully + * @ap: port in question +diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c +index 8e9cb198fcd1..ca6c706e9c25 100644 +--- a/drivers/ata/sata_fsl.c ++++ b/drivers/ata/sata_fsl.c +@@ -1278,7 +1278,7 @@ static void sata_fsl_host_intr(struct ata_port *ap) + i, ioread32(hcr_base + CC), + ioread32(hcr_base + CA)); + } +- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask); ++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask); + return; + + } else if ((ap->qc_active & (1ULL << ATA_TAG_INTERNAL))) { +diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c +index ad385a113391..bde695a32097 100644 +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -2827,7 +2827,7 @@ static void mv_process_crpb_entries(struct ata_port *ap, struct mv_port_priv *pp + } + + if (work_done) { +- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask); ++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask); + + /* Update the software queue position index in hardware */ + writelfl((pp->crpb_dma & EDMA_RSP_Q_BASE_LO_MASK) | +diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c +index 56946012d113..7510303111fa 100644 +--- a/drivers/ata/sata_nv.c ++++ b/drivers/ata/sata_nv.c +@@ -984,7 +984,7 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance) + check_commands = 0; + check_commands &= ~(1 << pos); + } +- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask); ++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask); + } + } + +diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c +index fd1e19f1a49f..3666afa639d1 100644 +--- a/drivers/block/xen-blkback/blkback.c ++++ b/drivers/block/xen-blkback/blkback.c +@@ -936,6 +936,8 @@ next: + out_of_memory: + pr_alert("%s: out of memory\n", __func__); + put_free_pages(ring, pages_to_gnt, segs_to_map); ++ for (i = last_map; i < num; i++) ++ pages[i]->handle = BLKBACK_INVALID_HANDLE; + return -ENOMEM; + } + +diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c +index b90dbcd99c03..c4cd68116e7f 100644 +--- a/drivers/block/xen-blkback/xenbus.c ++++ b/drivers/block/xen-blkback/xenbus.c +@@ -171,6 +171,15 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid) + blkif->domid = domid; + atomic_set(&blkif->refcnt, 1); + init_completion(&blkif->drain_complete); ++ ++ /* ++ * Because freeing back to the cache may be deferred, it is not ++ * safe to unload the module (and hence destroy the cache) until ++ * this has completed. To prevent premature unloading, take an ++ * extra module reference here and release only when the object ++ * has been freed back to the cache. ++ */ ++ __module_get(THIS_MODULE); + INIT_WORK(&blkif->free_work, xen_blkif_deferred_free); + + return blkif; +@@ -320,6 +329,7 @@ static void xen_blkif_free(struct xen_blkif *blkif) + + /* Make sure everything is drained before shutting down */ + kmem_cache_free(xen_blkif_cachep, blkif); ++ module_put(THIS_MODULE); + } + + int __init xen_blkif_interface_init(void) +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 23e606aaaea4..04cf767d0708 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1200,7 +1200,7 @@ static int btusb_open(struct hci_dev *hdev) + if (data->setup_on_usb) { + err = data->setup_on_usb(hdev); + if (err < 0) +- return err; ++ goto setup_fail; + } + + data->intf->needs_remote_wakeup = 1; +@@ -1239,6 +1239,7 @@ done: + + failed: + clear_bit(BTUSB_INTR_RUNNING, &data->flags); ++setup_fail: + usb_autopm_put_interface(data->intf); + return err; + } +diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c +index 470c7ef02ea4..4b04ffbe5e7e 100644 +--- a/drivers/clocksource/timer-riscv.c ++++ b/drivers/clocksource/timer-riscv.c +@@ -41,7 +41,7 @@ static unsigned long long riscv_clocksource_rdtime(struct clocksource *cs) + return get_cycles64(); + } + +-static u64 riscv_sched_clock(void) ++static u64 notrace riscv_sched_clock(void) + { + return get_cycles64(); + } +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 3a1484e7a3ae..c64d20fdc187 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -551,26 +551,30 @@ static int devfreq_notifier_call(struct notifier_block *nb, unsigned long type, + void *devp) + { + struct devfreq *devfreq = container_of(nb, struct devfreq, nb); +- int ret; ++ int err = -EINVAL; + + mutex_lock(&devfreq->lock); + + devfreq->scaling_min_freq = find_available_min_freq(devfreq); +- if (!devfreq->scaling_min_freq) { +- mutex_unlock(&devfreq->lock); +- return -EINVAL; +- } ++ if (!devfreq->scaling_min_freq) ++ goto out; + + devfreq->scaling_max_freq = find_available_max_freq(devfreq); + if (!devfreq->scaling_max_freq) { +- mutex_unlock(&devfreq->lock); +- return -EINVAL; ++ devfreq->scaling_max_freq = ULONG_MAX; ++ goto out; + } + +- ret = update_devfreq(devfreq); ++ err = update_devfreq(devfreq); ++ ++out: + mutex_unlock(&devfreq->lock); ++ if (err) ++ dev_err(devfreq->dev.parent, ++ "failed to update frequency from OPP notifier (%d)\n", ++ err); + +- return ret; ++ return NOTIFY_OK; + } + + /** +@@ -584,11 +588,6 @@ static void devfreq_dev_release(struct device *dev) + struct devfreq *devfreq = to_devfreq(dev); + + mutex_lock(&devfreq_list_lock); +- if (IS_ERR(find_device_devfreq(devfreq->dev.parent))) { +- mutex_unlock(&devfreq_list_lock); +- dev_warn(&devfreq->dev, "releasing devfreq which doesn't exist\n"); +- return; +- } + list_del(&devfreq->node); + mutex_unlock(&devfreq_list_lock); + +@@ -643,6 +642,7 @@ struct devfreq *devfreq_add_device(struct device *dev, + devfreq->dev.parent = dev; + devfreq->dev.class = devfreq_class; + devfreq->dev.release = devfreq_dev_release; ++ INIT_LIST_HEAD(&devfreq->node); + devfreq->profile = profile; + strncpy(devfreq->governor_name, governor_name, DEVFREQ_NAME_LEN); + devfreq->previous_freq = profile->initial_freq; +@@ -1196,7 +1196,7 @@ static ssize_t available_governors_show(struct device *d, + * The devfreq with immutable governor (e.g., passive) shows + * only own governor. + */ +- if (df->governor->immutable) { ++ if (df->governor && df->governor->immutable) { + count = scnprintf(&buf[count], DEVFREQ_NAME_LEN, + "%s ", df->governor_name); + /* +diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c +index cafb1cc065bb..bf95f1d551c5 100644 +--- a/drivers/dma/dma-jz4780.c ++++ b/drivers/dma/dma-jz4780.c +@@ -1004,7 +1004,8 @@ static const struct jz4780_dma_soc_data jz4740_dma_soc_data = { + static const struct jz4780_dma_soc_data jz4725b_dma_soc_data = { + .nb_channels = 6, + .transfer_ord_max = 5, +- .flags = JZ_SOC_DATA_PER_CHAN_PM | JZ_SOC_DATA_NO_DCKES_DCKEC, ++ .flags = JZ_SOC_DATA_PER_CHAN_PM | JZ_SOC_DATA_NO_DCKES_DCKEC | ++ JZ_SOC_DATA_BREAK_LINKS, + }; + + static const struct jz4780_dma_soc_data jz4770_dma_soc_data = { +diff --git a/drivers/dma/virt-dma.c b/drivers/dma/virt-dma.c +index ec4adf4260a0..256fc662c500 100644 +--- a/drivers/dma/virt-dma.c ++++ b/drivers/dma/virt-dma.c +@@ -104,9 +104,8 @@ static void vchan_complete(unsigned long arg) + dmaengine_desc_get_callback(&vd->tx, &cb); + + list_del(&vd->node); +- vchan_vdesc_fini(vd); +- + dmaengine_desc_callback_invoke(&cb, &vd->tx_result); ++ vchan_vdesc_fini(vd); + } + } + +diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c +index b132ab9ad607..715e491dfbc3 100644 +--- a/drivers/firewire/net.c ++++ b/drivers/firewire/net.c +@@ -250,7 +250,11 @@ static int fwnet_header_cache(const struct neighbour *neigh, + h = (struct fwnet_header *)((u8 *)hh->hh_data + HH_DATA_OFF(sizeof(*h))); + h->h_proto = type; + memcpy(h->h_dest, neigh->ha, net->addr_len); +- hh->hh_len = FWNET_HLEN; ++ ++ /* Pairs with the READ_ONCE() in neigh_resolve_output(), ++ * neigh_hh_output() and neigh_update_hhs(). ++ */ ++ smp_store_release(&hh->hh_len, FWNET_HLEN); + + return 0; + } +diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c +index 92f843eaf1e0..7a30952b463d 100644 +--- a/drivers/firmware/arm_scmi/bus.c ++++ b/drivers/firmware/arm_scmi/bus.c +@@ -135,8 +135,10 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol) + return NULL; + + id = ida_simple_get(&scmi_bus_id, 1, 0, GFP_KERNEL); +- if (id < 0) +- goto free_mem; ++ if (id < 0) { ++ kfree(scmi_dev); ++ return NULL; ++ } + + scmi_dev->id = id; + scmi_dev->protocol_id = protocol; +@@ -154,8 +156,6 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol) + put_dev: + put_device(&scmi_dev->dev); + ida_simple_remove(&scmi_bus_id, id); +-free_mem: +- kfree(scmi_dev); + return NULL; + } + +diff --git a/drivers/firmware/efi/rci2-table.c b/drivers/firmware/efi/rci2-table.c +index 76b0c354a027..de1a9a1f9f14 100644 +--- a/drivers/firmware/efi/rci2-table.c ++++ b/drivers/firmware/efi/rci2-table.c +@@ -81,6 +81,9 @@ static int __init efi_rci2_sysfs_init(void) + struct kobject *tables_kobj; + int ret = -ENOMEM; + ++ if (rci2_table_phys == EFI_INVALID_TABLE_ADDR) ++ return 0; ++ + rci2_base = memremap(rci2_table_phys, + sizeof(struct rci2_table_global_hdr), + MEMREMAP_WB); +diff --git a/drivers/gpio/gpio-xtensa.c b/drivers/gpio/gpio-xtensa.c +index 43d3fa5f511a..0fb2211f9573 100644 +--- a/drivers/gpio/gpio-xtensa.c ++++ b/drivers/gpio/gpio-xtensa.c +@@ -44,15 +44,14 @@ static inline unsigned long enable_cp(unsigned long *cpenable) + unsigned long flags; + + local_irq_save(flags); +- RSR_CPENABLE(*cpenable); +- WSR_CPENABLE(*cpenable | BIT(XCHAL_CP_ID_XTIOP)); +- ++ *cpenable = xtensa_get_sr(cpenable); ++ xtensa_set_sr(*cpenable | BIT(XCHAL_CP_ID_XTIOP), cpenable); + return flags; + } + + static inline void disable_cp(unsigned long flags, unsigned long cpenable) + { +- WSR_CPENABLE(cpenable); ++ xtensa_set_sr(cpenable, cpenable); + local_irq_restore(flags); + } + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 104ed299d5ea..99d19f80440e 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -220,6 +220,14 @@ int gpiod_get_direction(struct gpio_desc *desc) + chip = gpiod_to_chip(desc); + offset = gpio_chip_hwgpio(desc); + ++ /* ++ * Open drain emulation using input mode may incorrectly report ++ * input here, fix that up. ++ */ ++ if (test_bit(FLAG_OPEN_DRAIN, &desc->flags) && ++ test_bit(FLAG_IS_OUT, &desc->flags)) ++ return 0; ++ + if (!chip->get_direction) + return -ENOTSUPP; + +diff --git a/drivers/gpu/drm/amd/amdgpu/df_v3_6.c b/drivers/gpu/drm/amd/amdgpu/df_v3_6.c +index 5850c8e34caa..97d11d792351 100644 +--- a/drivers/gpu/drm/amd/amdgpu/df_v3_6.c ++++ b/drivers/gpu/drm/amd/amdgpu/df_v3_6.c +@@ -261,23 +261,29 @@ static void df_v3_6_update_medium_grain_clock_gating(struct amdgpu_device *adev, + { + u32 tmp; + +- /* Put DF on broadcast mode */ +- adev->df_funcs->enable_broadcast_mode(adev, true); +- +- if (enable && (adev->cg_flags & AMD_CG_SUPPORT_DF_MGCG)) { +- tmp = RREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater); +- tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK; +- tmp |= DF_V3_6_MGCG_ENABLE_15_CYCLE_DELAY; +- WREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater, tmp); +- } else { +- tmp = RREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater); +- tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK; +- tmp |= DF_V3_6_MGCG_DISABLE; +- WREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater, tmp); +- } ++ if (adev->cg_flags & AMD_CG_SUPPORT_DF_MGCG) { ++ /* Put DF on broadcast mode */ ++ adev->df_funcs->enable_broadcast_mode(adev, true); ++ ++ if (enable) { ++ tmp = RREG32_SOC15(DF, 0, ++ mmDF_PIE_AON0_DfGlobalClkGater); ++ tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK; ++ tmp |= DF_V3_6_MGCG_ENABLE_15_CYCLE_DELAY; ++ WREG32_SOC15(DF, 0, ++ mmDF_PIE_AON0_DfGlobalClkGater, tmp); ++ } else { ++ tmp = RREG32_SOC15(DF, 0, ++ mmDF_PIE_AON0_DfGlobalClkGater); ++ tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK; ++ tmp |= DF_V3_6_MGCG_DISABLE; ++ WREG32_SOC15(DF, 0, ++ mmDF_PIE_AON0_DfGlobalClkGater, tmp); ++ } + +- /* Exit broadcast mode */ +- adev->df_funcs->enable_broadcast_mode(adev, false); ++ /* Exit broadcast mode */ ++ adev->df_funcs->enable_broadcast_mode(adev, false); ++ } + } + + static void df_v3_6_get_clockgating_state(struct amdgpu_device *adev, +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index 87dd55e9d72b..cc88ba76a8d4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -6184,7 +6184,23 @@ static void gfx_v8_0_ring_emit_fence_gfx(struct amdgpu_ring *ring, u64 addr, + bool write64bit = flags & AMDGPU_FENCE_FLAG_64BIT; + bool int_sel = flags & AMDGPU_FENCE_FLAG_INT; + +- /* EVENT_WRITE_EOP - flush caches, send int */ ++ /* Workaround for cache flush problems. First send a dummy EOP ++ * event down the pipe with seq one below. ++ */ ++ amdgpu_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4)); ++ amdgpu_ring_write(ring, (EOP_TCL1_ACTION_EN | ++ EOP_TC_ACTION_EN | ++ EOP_TC_WB_ACTION_EN | ++ EVENT_TYPE(CACHE_FLUSH_AND_INV_TS_EVENT) | ++ EVENT_INDEX(5))); ++ amdgpu_ring_write(ring, addr & 0xfffffffc); ++ amdgpu_ring_write(ring, (upper_32_bits(addr) & 0xffff) | ++ DATA_SEL(1) | INT_SEL(0)); ++ amdgpu_ring_write(ring, lower_32_bits(seq - 1)); ++ amdgpu_ring_write(ring, upper_32_bits(seq - 1)); ++ ++ /* Then send the real EOP event down the pipe: ++ * EVENT_WRITE_EOP - flush caches, send int */ + amdgpu_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4)); + amdgpu_ring_write(ring, (EOP_TCL1_ACTION_EN | + EOP_TC_ACTION_EN | +@@ -6926,7 +6942,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_gfx = { + 5 + /* COND_EXEC */ + 7 + /* PIPELINE_SYNC */ + VI_FLUSH_GPU_TLB_NUM_WREG * 5 + 9 + /* VM_FLUSH */ +- 8 + /* FENCE for VM_FLUSH */ ++ 12 + /* FENCE for VM_FLUSH */ + 20 + /* GDS switch */ + 4 + /* double SWITCH_BUFFER, + the first COND_EXEC jump to the place just +@@ -6938,7 +6954,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_gfx = { + 31 + /* DE_META */ + 3 + /* CNTX_CTRL */ + 5 + /* HDP_INVL */ +- 8 + 8 + /* FENCE x2 */ ++ 12 + 12 + /* FENCE x2 */ + 2, /* SWITCH_BUFFER */ + .emit_ib_size = 4, /* gfx_v8_0_ring_emit_ib_gfx */ + .emit_ib = gfx_v8_0_ring_emit_ib_gfx, +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 067f5579f452..793aa8e8ec9a 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -373,7 +373,7 @@ bool dc_link_is_dp_sink_present(struct dc_link *link) + + if (GPIO_RESULT_OK != dal_ddc_open( + ddc, GPIO_MODE_INPUT, GPIO_DDC_CONFIG_TYPE_MODE_I2C)) { +- dal_gpio_destroy_ddc(&ddc); ++ dal_ddc_close(ddc); + + return present; + } +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index 5a583707d198..0ab890c927ec 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -3492,7 +3492,14 @@ void dp_set_fec_enable(struct dc_link *link, bool enable) + if (link_enc->funcs->fec_set_enable && + link->dpcd_caps.fec_cap.bits.FEC_CAPABLE) { + if (link->fec_state == dc_link_fec_ready && enable) { +- msleep(1); ++ /* Accord to DP spec, FEC enable sequence can first ++ * be transmitted anytime after 1000 LL codes have ++ * been transmitted on the link after link training ++ * completion. Using 1 lane RBR should have the maximum ++ * time for transmitting 1000 LL codes which is 6.173 us. ++ * So use 7 microseconds delay instead. ++ */ ++ udelay(7); + link_enc->funcs->fec_set_enable(link_enc, true); + link->fec_state = dc_link_fec_enabled; + } else if (link->fec_state == dc_link_fec_enabled && !enable) { +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index 78b2cc2e122f..3b7769a3e67e 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -1419,13 +1419,20 @@ enum dc_status dcn20_build_mapped_resource(const struct dc *dc, struct dc_state + + static void acquire_dsc(struct resource_context *res_ctx, + const struct resource_pool *pool, +- struct display_stream_compressor **dsc) ++ struct display_stream_compressor **dsc, ++ int pipe_idx) + { + int i; + + ASSERT(*dsc == NULL); + *dsc = NULL; + ++ if (pool->res_cap->num_dsc == pool->res_cap->num_opp) { ++ *dsc = pool->dscs[pipe_idx]; ++ res_ctx->is_dsc_acquired[pipe_idx] = true; ++ return; ++ } ++ + /* Find first free DSC */ + for (i = 0; i < pool->res_cap->num_dsc; i++) + if (!res_ctx->is_dsc_acquired[i]) { +@@ -1468,7 +1475,7 @@ static enum dc_status add_dsc_to_stream_resource(struct dc *dc, + if (pipe_ctx->stream != dc_stream) + continue; + +- acquire_dsc(&dc_ctx->res_ctx, pool, &pipe_ctx->stream_res.dsc); ++ acquire_dsc(&dc_ctx->res_ctx, pool, &pipe_ctx->stream_res.dsc, i); + + /* The number of DSCs can be less than the number of pipes */ + if (!pipe_ctx->stream_res.dsc) { +@@ -1669,7 +1676,7 @@ static bool dcn20_split_stream_for_odm( + next_odm_pipe->stream_res.opp = pool->opps[next_odm_pipe->pipe_idx]; + #ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT + if (next_odm_pipe->stream->timing.flags.DSC == 1) { +- acquire_dsc(res_ctx, pool, &next_odm_pipe->stream_res.dsc); ++ acquire_dsc(res_ctx, pool, &next_odm_pipe->stream_res.dsc, next_odm_pipe->pipe_idx); + ASSERT(next_odm_pipe->stream_res.dsc); + if (next_odm_pipe->stream_res.dsc == NULL) + return false; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.c +index 5ab9d6240498..e95025b1d14d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.c +@@ -492,15 +492,23 @@ void enc2_stream_encoder_dp_unblank( + DP_VID_N_MUL, n_multiply); + } + +- /* set DIG_START to 0x1 to reset FIFO */ ++ /* make sure stream is disabled before resetting steer fifo */ ++ REG_UPDATE(DP_VID_STREAM_CNTL, DP_VID_STREAM_ENABLE, false); ++ REG_WAIT(DP_VID_STREAM_CNTL, DP_VID_STREAM_STATUS, 0, 10, 5000); + ++ /* set DIG_START to 0x1 to reset FIFO */ + REG_UPDATE(DIG_FE_CNTL, DIG_START, 1); ++ udelay(1); + + /* write 0 to take the FIFO out of reset */ + + REG_UPDATE(DIG_FE_CNTL, DIG_START, 0); + +- /* switch DP encoder to CRTC data */ ++ /* switch DP encoder to CRTC data, but reset it the fifo first. It may happen ++ * that it overflows during mode transition, and sometimes doesn't recover. ++ */ ++ REG_UPDATE(DP_STEER_FIFO, DP_STEER_FIFO_RESET, 1); ++ udelay(10); + + REG_UPDATE(DP_STEER_FIFO, DP_STEER_FIFO_RESET, 0); + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +index de182185fe1f..b0e5e64df212 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +@@ -258,7 +258,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = { + .vmm_page_size_bytes = 4096, + .dram_clock_change_latency_us = 23.84, + .return_bus_width_bytes = 64, +- .dispclk_dppclk_vco_speed_mhz = 3550, ++ .dispclk_dppclk_vco_speed_mhz = 3600, + .xfc_bus_transport_time_us = 4, + .xfc_xbuf_latency_tolerance_us = 4, + .use_urgent_burst_bw = 1, +diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c +index 58c091ab67b2..a066e9297777 100644 +--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c +@@ -844,6 +844,7 @@ static int smu_sw_init(void *handle) + smu->smu_baco.platform_support = false; + + mutex_init(&smu->sensor_lock); ++ mutex_init(&smu->metrics_lock); + + smu->watermarks_bitmap = 0; + smu->power_profile_mode = PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT; +diff --git a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c +index d493a3f8c07a..08a717a34bd6 100644 +--- a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c +@@ -910,18 +910,21 @@ static int arcturus_get_metrics_table(struct smu_context *smu, + struct smu_table_context *smu_table= &smu->smu_table; + int ret = 0; + ++ mutex_lock(&smu->metrics_lock); + if (!smu_table->metrics_time || + time_after(jiffies, smu_table->metrics_time + HZ / 1000)) { + ret = smu_update_table(smu, SMU_TABLE_SMU_METRICS, 0, + (void *)smu_table->metrics_table, false); + if (ret) { + pr_info("Failed to export SMU metrics table!\n"); ++ mutex_unlock(&smu->metrics_lock); + return ret; + } + smu_table->metrics_time = jiffies; + } + + memcpy(metrics_table, smu_table->metrics_table, sizeof(SmuMetrics_t)); ++ mutex_unlock(&smu->metrics_lock); + + return ret; + } +@@ -1388,12 +1391,17 @@ static int arcturus_get_power_profile_mode(struct smu_context *smu, + "VR", + "COMPUTE", + "CUSTOM"}; ++ static const char *title[] = { ++ "PROFILE_INDEX(NAME)"}; + uint32_t i, size = 0; + int16_t workload_type = 0; + + if (!smu->pm_enabled || !buf) + return -EINVAL; + ++ size += sprintf(buf + size, "%16s\n", ++ title[0]); ++ + for (i = 0; i <= PP_SMC_POWER_PROFILE_CUSTOM; i++) { + /* + * Conv PP_SMC_POWER_PROFILE* to WORKLOAD_PPLIB_*_BIT +diff --git a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h +index 23171a4d9a31..5ad9a7878f6b 100644 +--- a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h ++++ b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h +@@ -345,6 +345,7 @@ struct smu_context + const struct pptable_funcs *ppt_funcs; + struct mutex mutex; + struct mutex sensor_lock; ++ struct mutex metrics_lock; + uint64_t pool_size; + + struct smu_table_context smu_table; +diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c +index 328e258a6895..7d913a06ebac 100644 +--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c +@@ -547,17 +547,20 @@ static int navi10_get_metrics_table(struct smu_context *smu, + struct smu_table_context *smu_table= &smu->smu_table; + int ret = 0; + ++ mutex_lock(&smu->metrics_lock); + if (!smu_table->metrics_time || time_after(jiffies, smu_table->metrics_time + msecs_to_jiffies(100))) { + ret = smu_update_table(smu, SMU_TABLE_SMU_METRICS, 0, + (void *)smu_table->metrics_table, false); + if (ret) { + pr_info("Failed to export SMU metrics table!\n"); ++ mutex_unlock(&smu->metrics_lock); + return ret; + } + smu_table->metrics_time = jiffies; + } + + memcpy(metrics_table, smu_table->metrics_table, sizeof(SmuMetrics_t)); ++ mutex_unlock(&smu->metrics_lock); + + return ret; + } +diff --git a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c +index 92c393f613d3..3c3f719971f7 100644 +--- a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c +@@ -1691,17 +1691,20 @@ static int vega20_get_metrics_table(struct smu_context *smu, + struct smu_table_context *smu_table= &smu->smu_table; + int ret = 0; + ++ mutex_lock(&smu->metrics_lock); + if (!smu_table->metrics_time || time_after(jiffies, smu_table->metrics_time + HZ / 1000)) { + ret = smu_update_table(smu, SMU_TABLE_SMU_METRICS, 0, + (void *)smu_table->metrics_table, false); + if (ret) { + pr_info("Failed to export SMU metrics table!\n"); ++ mutex_unlock(&smu->metrics_lock); + return ret; + } + smu_table->metrics_time = jiffies; + } + + memcpy(metrics_table, smu_table->metrics_table, sizeof(SmuMetrics_t)); ++ mutex_unlock(&smu->metrics_lock); + + return ret; + } +diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c +index 06a506c29463..d564bfcab6a3 100644 +--- a/drivers/gpu/drm/i915/gt/intel_lrc.c ++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c +@@ -525,7 +525,8 @@ __unwind_incomplete_requests(struct intel_engine_cs *engine) + */ + if (test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, + &rq->fence.flags)) { +- spin_lock(&rq->lock); ++ spin_lock_nested(&rq->lock, ++ SINGLE_DEPTH_NESTING); + i915_request_cancel_breadcrumb(rq); + spin_unlock(&rq->lock); + } +diff --git a/drivers/gpu/drm/mcde/mcde_dsi.c b/drivers/gpu/drm/mcde/mcde_dsi.c +index f9c9e32b299c..35bb825d1918 100644 +--- a/drivers/gpu/drm/mcde/mcde_dsi.c ++++ b/drivers/gpu/drm/mcde/mcde_dsi.c +@@ -935,11 +935,13 @@ static int mcde_dsi_bind(struct device *dev, struct device *master, + for_each_available_child_of_node(dev->of_node, child) { + panel = of_drm_find_panel(child); + if (IS_ERR(panel)) { +- dev_err(dev, "failed to find panel try bridge (%lu)\n", ++ dev_err(dev, "failed to find panel try bridge (%ld)\n", + PTR_ERR(panel)); ++ panel = NULL; ++ + bridge = of_drm_find_bridge(child); + if (IS_ERR(bridge)) { +- dev_err(dev, "failed to find bridge (%lu)\n", ++ dev_err(dev, "failed to find bridge (%ld)\n", + PTR_ERR(bridge)); + return PTR_ERR(bridge); + } +diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c +index a052364a5d74..edd45f434ccd 100644 +--- a/drivers/gpu/drm/msm/msm_gpu.c ++++ b/drivers/gpu/drm/msm/msm_gpu.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + /* + * Power Management: +diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c +index b5b1a34f896f..d735ea7e2d88 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c +@@ -326,9 +326,9 @@ nv50_outp_atomic_check_view(struct drm_encoder *encoder, + * same size as the native one (e.g. different + * refresh rate) + */ +- if (adjusted_mode->hdisplay == native_mode->hdisplay && +- adjusted_mode->vdisplay == native_mode->vdisplay && +- adjusted_mode->type & DRM_MODE_TYPE_DRIVER) ++ if (mode->hdisplay == native_mode->hdisplay && ++ mode->vdisplay == native_mode->vdisplay && ++ mode->type & DRM_MODE_TYPE_DRIVER) + break; + mode = native_mode; + asyc->scaler.full = true; +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index a442a955f98c..eb31c5b6c8e9 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -245,14 +245,22 @@ nouveau_conn_atomic_duplicate_state(struct drm_connector *connector) + void + nouveau_conn_reset(struct drm_connector *connector) + { ++ struct nouveau_connector *nv_connector = nouveau_connector(connector); + struct nouveau_conn_atom *asyc; + +- if (WARN_ON(!(asyc = kzalloc(sizeof(*asyc), GFP_KERNEL)))) +- return; ++ if (drm_drv_uses_atomic_modeset(connector->dev)) { ++ if (WARN_ON(!(asyc = kzalloc(sizeof(*asyc), GFP_KERNEL)))) ++ return; ++ ++ if (connector->state) ++ nouveau_conn_atomic_destroy_state(connector, ++ connector->state); ++ ++ __drm_atomic_helper_connector_reset(connector, &asyc->state); ++ } else { ++ asyc = &nv_connector->properties_state; ++ } + +- if (connector->state) +- nouveau_conn_atomic_destroy_state(connector, connector->state); +- __drm_atomic_helper_connector_reset(connector, &asyc->state); + asyc->dither.mode = DITHERING_MODE_AUTO; + asyc->dither.depth = DITHERING_DEPTH_AUTO; + asyc->scaler.mode = DRM_MODE_SCALE_NONE; +@@ -276,8 +284,14 @@ void + nouveau_conn_attach_properties(struct drm_connector *connector) + { + struct drm_device *dev = connector->dev; +- struct nouveau_conn_atom *armc = nouveau_conn_atom(connector->state); + struct nouveau_display *disp = nouveau_display(dev); ++ struct nouveau_connector *nv_connector = nouveau_connector(connector); ++ struct nouveau_conn_atom *armc; ++ ++ if (drm_drv_uses_atomic_modeset(connector->dev)) ++ armc = nouveau_conn_atom(connector->state); ++ else ++ armc = &nv_connector->properties_state; + + /* Init DVI-I specific properties. */ + if (connector->connector_type == DRM_MODE_CONNECTOR_DVII) +@@ -749,9 +763,9 @@ static int + nouveau_connector_set_property(struct drm_connector *connector, + struct drm_property *property, uint64_t value) + { +- struct nouveau_conn_atom *asyc = nouveau_conn_atom(connector->state); + struct nouveau_connector *nv_connector = nouveau_connector(connector); + struct nouveau_encoder *nv_encoder = nv_connector->detected_encoder; ++ struct nouveau_conn_atom *asyc = &nv_connector->properties_state; + struct drm_encoder *encoder = to_drm_encoder(nv_encoder); + int ret; + +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h +index f43a8d63aef8..de84fb4708c7 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.h ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.h +@@ -29,6 +29,7 @@ + + #include + ++#include + #include + #include + #include +@@ -44,6 +45,60 @@ struct dcb_output; + struct nouveau_backlight; + #endif + ++#define nouveau_conn_atom(p) \ ++ container_of((p), struct nouveau_conn_atom, state) ++ ++struct nouveau_conn_atom { ++ struct drm_connector_state state; ++ ++ struct { ++ /* The enum values specifically defined here match nv50/gf119 ++ * hw values, and the code relies on this. ++ */ ++ enum { ++ DITHERING_MODE_OFF = 0x00, ++ DITHERING_MODE_ON = 0x01, ++ DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON, ++ DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON, ++ DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON, ++ DITHERING_MODE_AUTO ++ } mode; ++ enum { ++ DITHERING_DEPTH_6BPC = 0x00, ++ DITHERING_DEPTH_8BPC = 0x02, ++ DITHERING_DEPTH_AUTO ++ } depth; ++ } dither; ++ ++ struct { ++ int mode; /* DRM_MODE_SCALE_* */ ++ struct { ++ enum { ++ UNDERSCAN_OFF, ++ UNDERSCAN_ON, ++ UNDERSCAN_AUTO, ++ } mode; ++ u32 hborder; ++ u32 vborder; ++ } underscan; ++ bool full; ++ } scaler; ++ ++ struct { ++ int color_vibrance; ++ int vibrant_hue; ++ } procamp; ++ ++ union { ++ struct { ++ bool dither:1; ++ bool scaler:1; ++ bool procamp:1; ++ }; ++ u8 mask; ++ } set; ++}; ++ + struct nouveau_connector { + struct drm_connector base; + enum dcb_connector_type type; +@@ -63,6 +118,12 @@ struct nouveau_connector { + #ifdef CONFIG_DRM_NOUVEAU_BACKLIGHT + struct nouveau_backlight *backlight; + #endif ++ /* ++ * Our connector property code expects a nouveau_conn_atom struct ++ * even on pre-nv50 where we do not support atomic. This embedded ++ * version gets used in the non atomic modeset case. ++ */ ++ struct nouveau_conn_atom properties_state; + }; + + static inline struct nouveau_connector *nouveau_connector( +@@ -121,61 +182,6 @@ extern int nouveau_ignorelid; + extern int nouveau_duallink; + extern int nouveau_hdmimhz; + +-#include +-#define nouveau_conn_atom(p) \ +- container_of((p), struct nouveau_conn_atom, state) +- +-struct nouveau_conn_atom { +- struct drm_connector_state state; +- +- struct { +- /* The enum values specifically defined here match nv50/gf119 +- * hw values, and the code relies on this. +- */ +- enum { +- DITHERING_MODE_OFF = 0x00, +- DITHERING_MODE_ON = 0x01, +- DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON, +- DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON, +- DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON, +- DITHERING_MODE_AUTO +- } mode; +- enum { +- DITHERING_DEPTH_6BPC = 0x00, +- DITHERING_DEPTH_8BPC = 0x02, +- DITHERING_DEPTH_AUTO +- } depth; +- } dither; +- +- struct { +- int mode; /* DRM_MODE_SCALE_* */ +- struct { +- enum { +- UNDERSCAN_OFF, +- UNDERSCAN_ON, +- UNDERSCAN_AUTO, +- } mode; +- u32 hborder; +- u32 vborder; +- } underscan; +- bool full; +- } scaler; +- +- struct { +- int color_vibrance; +- int vibrant_hue; +- } procamp; +- +- union { +- struct { +- bool dither:1; +- bool scaler:1; +- bool procamp:1; +- }; +- u8 mask; +- } set; +-}; +- + void nouveau_conn_attach_properties(struct drm_connector *); + void nouveau_conn_reset(struct drm_connector *); + struct drm_connector_state * +diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +index eb8071a4d6d0..9c3bdfd20337 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c ++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +@@ -683,8 +683,6 @@ static void sun4i_hdmi_unbind(struct device *dev, struct device *master, + struct sun4i_hdmi *hdmi = dev_get_drvdata(dev); + + cec_unregister_adapter(hdmi->cec_adap); +- drm_connector_cleanup(&hdmi->connector); +- drm_encoder_cleanup(&hdmi->encoder); + i2c_del_adapter(hdmi->i2c); + i2c_put_adapter(hdmi->ddc_i2c); + clk_disable_unprepare(hdmi->mod_clk); +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 7608ee053114..ac44bf752ff1 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -48,6 +48,7 @@ + #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV BIT(0) + #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1) + #define I2C_HID_QUIRK_BOGUS_IRQ BIT(4) ++#define I2C_HID_QUIRK_RESET_ON_RESUME BIT(5) + + /* flags */ + #define I2C_HID_STARTED 0 +@@ -174,6 +175,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { USB_VENDOR_ID_ELAN, HID_ANY_ID, + I2C_HID_QUIRK_BOGUS_IRQ }, ++ { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID, ++ I2C_HID_QUIRK_RESET_ON_RESUME }, + { 0, 0 } + }; + +@@ -1214,8 +1217,15 @@ static int i2c_hid_resume(struct device *dev) + * solves "incomplete reports" on Raydium devices 2386:3118 and + * 2386:4B33 and fixes various SIS touchscreens no longer sending + * data after a suspend/resume. ++ * ++ * However some ALPS touchpads generate IRQ storm without reset, so ++ * let's still reset them here. + */ +- ret = i2c_hid_set_power(client, I2C_HID_PWR_ON); ++ if (ihid->quirks & I2C_HID_QUIRK_RESET_ON_RESUME) ++ ret = i2c_hid_hwreset(client); ++ else ++ ret = i2c_hid_set_power(client, I2C_HID_PWR_ON); ++ + if (ret) + return ret; + +diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c +index 2e37f8a6d8cf..be661396095c 100644 +--- a/drivers/iio/accel/st_accel_core.c ++++ b/drivers/iio/accel/st_accel_core.c +@@ -993,6 +993,7 @@ static const struct iio_trigger_ops st_accel_trigger_ops = { + #define ST_ACCEL_TRIGGER_OPS NULL + #endif + ++#ifdef CONFIG_ACPI + static const struct iio_mount_matrix * + get_mount_matrix(const struct iio_dev *indio_dev, + const struct iio_chan_spec *chan) +@@ -1013,7 +1014,6 @@ static const struct iio_chan_spec_ext_info mount_matrix_ext_info[] = { + static int apply_acpi_orientation(struct iio_dev *indio_dev, + struct iio_chan_spec *channels) + { +-#ifdef CONFIG_ACPI + struct st_sensor_data *adata = iio_priv(indio_dev); + struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; + struct acpi_device *adev; +@@ -1141,10 +1141,14 @@ static int apply_acpi_orientation(struct iio_dev *indio_dev, + out: + kfree(buffer.pointer); + return ret; ++} + #else /* !CONFIG_ACPI */ ++static int apply_acpi_orientation(struct iio_dev *indio_dev, ++ struct iio_chan_spec *channels) ++{ + return 0; +-#endif + } ++#endif + + /* + * st_accel_get_settings() - get sensor settings from device name +diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c +index da073d72f649..e480529b3f04 100644 +--- a/drivers/iio/adc/max9611.c ++++ b/drivers/iio/adc/max9611.c +@@ -89,6 +89,12 @@ + #define MAX9611_TEMP_SCALE_NUM 1000000 + #define MAX9611_TEMP_SCALE_DIV 2083 + ++/* ++ * Conversion time is 2 ms (typically) at Ta=25 degreeC ++ * No maximum value is known, so play it safe. ++ */ ++#define MAX9611_CONV_TIME_US_RANGE 3000, 3300 ++ + struct max9611_dev { + struct device *dev; + struct i2c_client *i2c_client; +@@ -236,11 +242,9 @@ static int max9611_read_single(struct max9611_dev *max9611, + return ret; + } + +- /* +- * need a delay here to make register configuration +- * stabilize. 1 msec at least, from empirical testing. +- */ +- usleep_range(1000, 2000); ++ /* need a delay here to make register configuration stabilize. */ ++ ++ usleep_range(MAX9611_CONV_TIME_US_RANGE); + + ret = i2c_smbus_read_word_swapped(max9611->i2c_client, reg_addr); + if (ret < 0) { +@@ -507,7 +511,7 @@ static int max9611_init(struct max9611_dev *max9611) + MAX9611_REG_CTRL2, 0); + return ret; + } +- usleep_range(1000, 2000); ++ usleep_range(MAX9611_CONV_TIME_US_RANGE); + + return 0; + } +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index d78f67623f24..50052e9a1731 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -4736,6 +4736,7 @@ err_ib: + err: + unregister_netdevice_notifier(&cma_nb); + ib_sa_unregister_client(&sa_client); ++ unregister_pernet_subsys(&cma_pernet_operations); + err_wq: + destroy_workqueue(cma_wq); + return ret; +diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c +index 680ad27f497d..023478107f0e 100644 +--- a/drivers/infiniband/core/counters.c ++++ b/drivers/infiniband/core/counters.c +@@ -282,6 +282,9 @@ int rdma_counter_bind_qp_auto(struct ib_qp *qp, u8 port) + struct rdma_counter *counter; + int ret; + ++ if (!qp->res.valid) ++ return 0; ++ + if (!rdma_is_port_valid(dev, port)) + return -EINVAL; + +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 8d2f1e38b891..907d99822bf0 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -3008,16 +3008,17 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr) + ibdev->ib_active = false; + flush_workqueue(wq); + +- mlx4_ib_close_sriov(ibdev); +- mlx4_ib_mad_cleanup(ibdev); +- ib_unregister_device(&ibdev->ib_dev); +- mlx4_ib_diag_cleanup(ibdev); + if (ibdev->iboe.nb.notifier_call) { + if (unregister_netdevice_notifier(&ibdev->iboe.nb)) + pr_warn("failure unregistering notifier\n"); + ibdev->iboe.nb.notifier_call = NULL; + } + ++ mlx4_ib_close_sriov(ibdev); ++ mlx4_ib_mad_cleanup(ibdev); ++ ib_unregister_device(&ibdev->ib_dev); ++ mlx4_ib_diag_cleanup(ibdev); ++ + mlx4_qp_release_range(dev, ibdev->steer_qpn_base, + ibdev->steer_qpn_count); + kfree(ibdev->ib_uc_qpns_bitmap); +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 831539419c30..e1cfbedefcbc 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -3548,10 +3548,6 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev, + } + + INIT_LIST_HEAD(&handler->list); +- if (dst) { +- memcpy(&dest_arr[0], dst, sizeof(*dst)); +- dest_num++; +- } + + for (spec_index = 0; spec_index < flow_attr->num_of_specs; spec_index++) { + err = parse_flow_attr(dev->mdev, spec, +@@ -3564,6 +3560,11 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev, + ib_flow += ((union ib_flow_spec *)ib_flow)->size; + } + ++ if (dst && !(flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DROP)) { ++ memcpy(&dest_arr[0], dst, sizeof(*dst)); ++ dest_num++; ++ } ++ + if (!flow_is_multicast_only(flow_attr)) + set_underlay_qp(dev, spec, underlay_qpn); + +@@ -3604,10 +3605,8 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev, + } + + if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DROP) { +- if (!(flow_act.action & MLX5_FLOW_CONTEXT_ACTION_COUNT)) { ++ if (!dest_num) + rule_dst = NULL; +- dest_num = 0; +- } + } else { + if (is_egress) + flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_ALLOW; +diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c +index f9a492ed900b..831ad578a7b2 100644 +--- a/drivers/infiniband/sw/rxe/rxe_recv.c ++++ b/drivers/infiniband/sw/rxe/rxe_recv.c +@@ -389,7 +389,7 @@ void rxe_rcv(struct sk_buff *skb) + + calc_icrc = rxe_icrc_hdr(pkt, skb); + calc_icrc = rxe_crc32(rxe, calc_icrc, (u8 *)payload_addr(pkt), +- payload_size(pkt)); ++ payload_size(pkt) + bth_pad(pkt)); + calc_icrc = (__force u32)cpu_to_be32(~calc_icrc); + if (unlikely(calc_icrc != pack_icrc)) { + if (skb->protocol == htons(ETH_P_IPV6)) +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index c5d9b558fa90..e5031172c019 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -500,6 +500,12 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + if (err) + return err; + } ++ if (bth_pad(pkt)) { ++ u8 *pad = payload_addr(pkt) + paylen; ++ ++ memset(pad, 0, bth_pad(pkt)); ++ crc = rxe_crc32(rxe, crc, pad, bth_pad(pkt)); ++ } + } + p = payload_addr(pkt) + paylen + bth_pad(pkt); + +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index 1cbfbd98eb22..c4a8195bf670 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -732,6 +732,13 @@ static enum resp_states read_reply(struct rxe_qp *qp, + if (err) + pr_err("Failed copying memory\n"); + ++ if (bth_pad(&ack_pkt)) { ++ struct rxe_dev *rxe = to_rdev(qp->ibqp.device); ++ u8 *pad = payload_addr(&ack_pkt) + payload; ++ ++ memset(pad, 0, bth_pad(&ack_pkt)); ++ icrc = rxe_crc32(rxe, icrc, pad, bth_pad(&ack_pkt)); ++ } + p = payload_addr(&ack_pkt) + payload + bth_pad(&ack_pkt); + *p = ~icrc; + +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index 9b159132405d..dca88f9fdf29 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -104,11 +104,7 @@ static void intel_flush_svm_range_dev (struct intel_svm *svm, struct intel_svm_d + { + struct qi_desc desc; + +- /* +- * Do PASID granu IOTLB invalidation if page selective capability is +- * not available. +- */ +- if (pages == -1 || !cap_pgsel_inv(svm->iommu->cap)) { ++ if (pages == -1) { + desc.qw0 = QI_EIOTLB_PASID(svm->pasid) | + QI_EIOTLB_DID(sdev->did) | + QI_EIOTLB_GRAN(QI_GRAN_NONG_PASID) | +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index bb29aeefcbd0..c7137f50bd1d 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2781,7 +2781,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr, + write_targets++; + } + } +- if (bio->bi_end_io) { ++ if (rdev && bio->bi_end_io) { + atomic_inc(&rdev->nr_pending); + bio->bi_iter.bi_sector = sector_nr + rdev->data_offset; + bio_set_dev(bio, rdev->bdev); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 12a8ce83786e..36cd7c2fbf40 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5726,7 +5726,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) + do_flush = false; + } + +- if (!sh->batch_head) ++ if (!sh->batch_head || sh == sh->batch_head) + set_bit(STRIPE_HANDLE, &sh->state); + clear_bit(STRIPE_DELAYED, &sh->state); + if ((!sh->batch_head || sh == sh->batch_head) && +diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c +index 5ef7daeb8cbd..b14c09cd9593 100644 +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -378,7 +378,8 @@ static void cec_data_cancel(struct cec_data *data, u8 tx_status) + } else { + list_del_init(&data->list); + if (!(data->msg.tx_status & CEC_TX_STATUS_OK)) +- data->adap->transmit_queue_sz--; ++ if (!WARN_ON(!data->adap->transmit_queue_sz)) ++ data->adap->transmit_queue_sz--; + } + + if (data->msg.tx_status & CEC_TX_STATUS_OK) { +@@ -430,6 +431,14 @@ static void cec_flush(struct cec_adapter *adap) + * need to do anything special in that case. + */ + } ++ /* ++ * If something went wrong and this counter isn't what it should ++ * be, then this will reset it back to 0. Warn if it is not 0, ++ * since it indicates a bug, either in this framework or in a ++ * CEC driver. ++ */ ++ if (WARN_ON(adap->transmit_queue_sz)) ++ adap->transmit_queue_sz = 0; + } + + /* +@@ -454,7 +463,7 @@ int cec_thread_func(void *_adap) + bool timeout = false; + u8 attempts; + +- if (adap->transmitting) { ++ if (adap->transmit_in_progress) { + int err; + + /* +@@ -489,7 +498,7 @@ int cec_thread_func(void *_adap) + goto unlock; + } + +- if (adap->transmitting && timeout) { ++ if (adap->transmit_in_progress && timeout) { + /* + * If we timeout, then log that. Normally this does + * not happen and it is an indication of a faulty CEC +@@ -498,14 +507,18 @@ int cec_thread_func(void *_adap) + * so much traffic on the bus that the adapter was + * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s). + */ +- //pr_warn("cec-%s: message %*ph timed out\n", adap->name, +- // adap->transmitting->msg.len, +- // adap->transmitting->msg.msg); ++ if (adap->transmitting) { ++ pr_warn("cec-%s: message %*ph timed out\n", adap->name, ++ adap->transmitting->msg.len, ++ adap->transmitting->msg.msg); ++ /* Just give up on this. */ ++ cec_data_cancel(adap->transmitting, ++ CEC_TX_STATUS_TIMEOUT); ++ } else { ++ pr_warn("cec-%s: transmit timed out\n", adap->name); ++ } + adap->transmit_in_progress = false; + adap->tx_timeouts++; +- /* Just give up on this. */ +- cec_data_cancel(adap->transmitting, +- CEC_TX_STATUS_TIMEOUT); + goto unlock; + } + +@@ -520,7 +533,8 @@ int cec_thread_func(void *_adap) + data = list_first_entry(&adap->transmit_queue, + struct cec_data, list); + list_del_init(&data->list); +- adap->transmit_queue_sz--; ++ if (!WARN_ON(!data->adap->transmit_queue_sz)) ++ adap->transmit_queue_sz--; + + /* Make this the current transmitting message */ + adap->transmitting = data; +@@ -1083,11 +1097,11 @@ void cec_received_msg_ts(struct cec_adapter *adap, + valid_la = false; + else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED)) + valid_la = false; +- else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4)) ++ else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST)) + valid_la = false; + else if (cec_msg_is_broadcast(msg) && +- adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 && +- !(dir_fl & BCAST2_0)) ++ adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0 && ++ !(dir_fl & BCAST1_4)) + valid_la = false; + } + if (valid_la && min_len) { +diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c +index ac88ade94cda..59609556d969 100644 +--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c ++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c +@@ -116,6 +116,7 @@ struct pulse8 { + unsigned int vers; + struct completion cmd_done; + struct work_struct work; ++ u8 work_result; + struct delayed_work ping_eeprom_work; + struct cec_msg rx_msg; + u8 data[DATA_SIZE]; +@@ -137,8 +138,10 @@ static void pulse8_irq_work_handler(struct work_struct *work) + { + struct pulse8 *pulse8 = + container_of(work, struct pulse8, work); ++ u8 result = pulse8->work_result; + +- switch (pulse8->data[0] & 0x3f) { ++ pulse8->work_result = 0; ++ switch (result & 0x3f) { + case MSGCODE_FRAME_DATA: + cec_received_msg(pulse8->adap, &pulse8->rx_msg); + break; +@@ -172,12 +175,12 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data, + pulse8->escape = false; + } else if (data == MSGEND) { + struct cec_msg *msg = &pulse8->rx_msg; ++ u8 msgcode = pulse8->buf[0]; + + if (debug) + dev_info(pulse8->dev, "received: %*ph\n", + pulse8->idx, pulse8->buf); +- pulse8->data[0] = pulse8->buf[0]; +- switch (pulse8->buf[0] & 0x3f) { ++ switch (msgcode & 0x3f) { + case MSGCODE_FRAME_START: + msg->len = 1; + msg->msg[0] = pulse8->buf[1]; +@@ -186,14 +189,20 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data, + if (msg->len == CEC_MAX_MSG_SIZE) + break; + msg->msg[msg->len++] = pulse8->buf[1]; +- if (pulse8->buf[0] & MSGCODE_FRAME_EOM) ++ if (msgcode & MSGCODE_FRAME_EOM) { ++ WARN_ON(pulse8->work_result); ++ pulse8->work_result = msgcode; + schedule_work(&pulse8->work); ++ break; ++ } + break; + case MSGCODE_TRANSMIT_SUCCEEDED: + case MSGCODE_TRANSMIT_FAILED_LINE: + case MSGCODE_TRANSMIT_FAILED_ACK: + case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA: + case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE: ++ WARN_ON(pulse8->work_result); ++ pulse8->work_result = msgcode; + schedule_work(&pulse8->work); + break; + case MSGCODE_HIGH_ERROR: +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +index 4e8e80ac8341..9cec5c216e1f 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -973,6 +973,8 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + struct ath_htc_rx_status *rxstatus; + struct ath_rx_status rx_stats; + bool decrypt_error = false; ++ __be16 rs_datalen; ++ bool is_phyerr; + + if (skb->len < HTC_RX_FRAME_HEADER_SIZE) { + ath_err(common, "Corrupted RX frame, dropping (len: %d)\n", +@@ -982,11 +984,24 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + + rxstatus = (struct ath_htc_rx_status *)skb->data; + +- if (be16_to_cpu(rxstatus->rs_datalen) - +- (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0) { ++ rs_datalen = be16_to_cpu(rxstatus->rs_datalen); ++ if (unlikely(rs_datalen - ++ (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) { + ath_err(common, + "Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n", +- rxstatus->rs_datalen, skb->len); ++ rs_datalen, skb->len); ++ goto rx_next; ++ } ++ ++ is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY; ++ /* ++ * Discard zero-length packets and packets smaller than an ACK ++ * which are not PHY_ERROR (short radar pulses have a length of 3) ++ */ ++ if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) { ++ ath_warn(common, ++ "Short RX data len, dropping (dlen: %d)\n", ++ rs_datalen); + goto rx_next; + } + +@@ -1011,7 +1026,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + * Process PHY errors and return so that the packet + * can be dropped. + */ +- if (rx_stats.rs_status & ATH9K_RXERR_PHY) { ++ if (unlikely(is_phyerr)) { + /* TODO: Not using DFS processing now. */ + if (ath_cmn_process_fft(&priv->spec_priv, hdr, + &rx_stats, rx_status->mactime)) { +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 265f89e11d8b..59474bd0c728 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -342,7 +342,8 @@ nvme_fc_register_localport(struct nvme_fc_port_info *pinfo, + !template->ls_req || !template->fcp_io || + !template->ls_abort || !template->fcp_abort || + !template->max_hw_queues || !template->max_sgl_segments || +- !template->max_dif_sgl_segments || !template->dma_boundary) { ++ !template->max_dif_sgl_segments || !template->dma_boundary || ++ !template->module) { + ret = -EINVAL; + goto out_reghost_failed; + } +@@ -2015,6 +2016,7 @@ nvme_fc_ctrl_free(struct kref *ref) + { + struct nvme_fc_ctrl *ctrl = + container_of(ref, struct nvme_fc_ctrl, ref); ++ struct nvme_fc_lport *lport = ctrl->lport; + unsigned long flags; + + if (ctrl->ctrl.tagset) { +@@ -2041,6 +2043,7 @@ nvme_fc_ctrl_free(struct kref *ref) + if (ctrl->ctrl.opts) + nvmf_free_options(ctrl->ctrl.opts); + kfree(ctrl); ++ module_put(lport->ops->module); + } + + static void +@@ -2907,10 +2910,22 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status) + static void + __nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl) + { +- nvme_stop_keep_alive(&ctrl->ctrl); ++ /* ++ * if state is connecting - the error occurred as part of a ++ * reconnect attempt. The create_association error paths will ++ * clean up any outstanding io. ++ * ++ * if it's a different state - ensure all pending io is ++ * terminated. Given this can delay while waiting for the ++ * aborted io to return, we recheck adapter state below ++ * before changing state. ++ */ ++ if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) { ++ nvme_stop_keep_alive(&ctrl->ctrl); + +- /* will block will waiting for io to terminate */ +- nvme_fc_delete_association(ctrl); ++ /* will block will waiting for io to terminate */ ++ nvme_fc_delete_association(ctrl); ++ } + + if (ctrl->ctrl.state != NVME_CTRL_CONNECTING && + !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) +@@ -3056,10 +3071,15 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, + goto out_fail; + } + ++ if (!try_module_get(lport->ops->module)) { ++ ret = -EUNATCH; ++ goto out_free_ctrl; ++ } ++ + idx = ida_simple_get(&nvme_fc_ctrl_cnt, 0, 0, GFP_KERNEL); + if (idx < 0) { + ret = -ENOSPC; +- goto out_free_ctrl; ++ goto out_mod_put; + } + + ctrl->ctrl.opts = opts; +@@ -3212,6 +3232,8 @@ out_free_queues: + out_free_ida: + put_device(ctrl->dev); + ida_simple_remove(&nvme_fc_ctrl_cnt, ctrl->cnum); ++out_mod_put: ++ module_put(lport->ops->module); + out_free_ctrl: + kfree(ctrl); + out_fail: +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 869f462e6b6e..14d513087a14 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -68,14 +68,14 @@ static int io_queue_depth = 1024; + module_param_cb(io_queue_depth, &io_queue_depth_ops, &io_queue_depth, 0644); + MODULE_PARM_DESC(io_queue_depth, "set io queue depth, should >= 2"); + +-static int write_queues; +-module_param(write_queues, int, 0644); ++static unsigned int write_queues; ++module_param(write_queues, uint, 0644); + MODULE_PARM_DESC(write_queues, + "Number of queues to use for writes. If not set, reads and writes " + "will share a queue set."); + +-static int poll_queues; +-module_param(poll_queues, int, 0644); ++static unsigned int poll_queues; ++module_param(poll_queues, uint, 0644); + MODULE_PARM_DESC(poll_queues, "Number of queues to use for polled IO."); + + struct nvme_dev; +@@ -2060,7 +2060,6 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues) + .priv = dev, + }; + unsigned int irq_queues, this_p_queues; +- unsigned int nr_cpus = num_possible_cpus(); + + /* + * Poll queues don't need interrupts, but we need at least one IO +@@ -2071,10 +2070,7 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues) + this_p_queues = nr_io_queues - 1; + irq_queues = 1; + } else { +- if (nr_cpus < nr_io_queues - this_p_queues) +- irq_queues = nr_cpus + 1; +- else +- irq_queues = nr_io_queues - this_p_queues + 1; ++ irq_queues = nr_io_queues - this_p_queues + 1; + } + dev->io_queues[HCTX_TYPE_POLL] = this_p_queues; + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index b50b53db3746..1c50af6219f3 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -850,6 +850,7 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport) + #define FCLOOP_DMABOUND_4G 0xFFFFFFFF + + static struct nvme_fc_port_template fctemplate = { ++ .module = THIS_MODULE, + .localport_delete = fcloop_localport_delete, + .remoteport_delete = fcloop_remoteport_delete, + .create_queue = fcloop_create_queue, +diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c +index c423e94baf0f..9617b7df7c4d 100644 +--- a/drivers/of/overlay.c ++++ b/drivers/of/overlay.c +@@ -305,7 +305,6 @@ static int add_changeset_property(struct overlay_changeset *ovcs, + { + struct property *new_prop = NULL, *prop; + int ret = 0; +- bool check_for_non_overlay_node = false; + + if (target->in_livetree) + if (!of_prop_cmp(overlay_prop->name, "name") || +@@ -318,6 +317,25 @@ static int add_changeset_property(struct overlay_changeset *ovcs, + else + prop = NULL; + ++ if (prop) { ++ if (!of_prop_cmp(prop->name, "#address-cells")) { ++ if (!of_prop_val_eq(prop, overlay_prop)) { ++ pr_err("ERROR: changing value of #address-cells is not allowed in %pOF\n", ++ target->np); ++ ret = -EINVAL; ++ } ++ return ret; ++ ++ } else if (!of_prop_cmp(prop->name, "#size-cells")) { ++ if (!of_prop_val_eq(prop, overlay_prop)) { ++ pr_err("ERROR: changing value of #size-cells is not allowed in %pOF\n", ++ target->np); ++ ret = -EINVAL; ++ } ++ return ret; ++ } ++ } ++ + if (is_symbols_prop) { + if (prop) + return -EINVAL; +@@ -330,33 +348,18 @@ static int add_changeset_property(struct overlay_changeset *ovcs, + return -ENOMEM; + + if (!prop) { +- check_for_non_overlay_node = true; + if (!target->in_livetree) { + new_prop->next = target->np->deadprops; + target->np->deadprops = new_prop; + } + ret = of_changeset_add_property(&ovcs->cset, target->np, + new_prop); +- } else if (!of_prop_cmp(prop->name, "#address-cells")) { +- if (!of_prop_val_eq(prop, new_prop)) { +- pr_err("ERROR: changing value of #address-cells is not allowed in %pOF\n", +- target->np); +- ret = -EINVAL; +- } +- } else if (!of_prop_cmp(prop->name, "#size-cells")) { +- if (!of_prop_val_eq(prop, new_prop)) { +- pr_err("ERROR: changing value of #size-cells is not allowed in %pOF\n", +- target->np); +- ret = -EINVAL; +- } + } else { +- check_for_non_overlay_node = true; + ret = of_changeset_update_property(&ovcs->cset, target->np, + new_prop); + } + +- if (check_for_non_overlay_node && +- !of_node_check_flag(target->np, OF_OVERLAY)) ++ if (!of_node_check_flag(target->np, OF_OVERLAY)) + pr_err("WARNING: memory leak will occur if overlay removed, property: %pOF/%s\n", + target->np, new_prop->name); + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index a97e2571a527..fcfaadc774ee 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5854,6 +5854,24 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode, + return 0; + } + ++#ifdef CONFIG_ACPI ++bool pci_pr3_present(struct pci_dev *pdev) ++{ ++ struct acpi_device *adev; ++ ++ if (acpi_disabled) ++ return false; ++ ++ adev = ACPI_COMPANION(&pdev->dev); ++ if (!adev) ++ return false; ++ ++ return adev->power.flags.power_resources && ++ acpi_has_method(adev->handle, "_PR3"); ++} ++EXPORT_SYMBOL_GPL(pci_pr3_present); ++#endif ++ + /** + * pci_add_dma_alias - Add a DMA devfn alias for a device + * @dev: the PCI device for which alias is added +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index 6fd1390fd06e..bfb22f868857 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -615,7 +615,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + return PTR_ERR(channel->base); + + /* call request_irq for OTG */ +- irq = platform_get_irq(pdev, 0); ++ irq = platform_get_irq_optional(pdev, 0); + if (irq >= 0) { + INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work); + irq = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq, +diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c +index 07d1b911e72f..52ef1419b671 100644 +--- a/drivers/platform/x86/pmc_atom.c ++++ b/drivers/platform/x86/pmc_atom.c +@@ -429,6 +429,14 @@ static const struct dmi_system_id critclk_systems[] = { + DMI_MATCH(DMI_PRODUCT_VERSION, "6AV7882-0"), + }, + }, ++ { ++ .ident = "CONNECT X300", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SIEMENS AG"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "A5E45074588"), ++ }, ++ }, ++ + { /*sentinel*/ } + }; + +diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c +index efb2f01a9101..f60e1b26c2d2 100644 +--- a/drivers/regulator/ab8500.c ++++ b/drivers/regulator/ab8500.c +@@ -953,23 +953,6 @@ static struct ab8500_regulator_info + .update_val_idle = 0x82, + .update_val_normal = 0x02, + }, +- [AB8505_LDO_USB] = { +- .desc = { +- .name = "LDO-USB", +- .ops = &ab8500_regulator_mode_ops, +- .type = REGULATOR_VOLTAGE, +- .id = AB8505_LDO_USB, +- .owner = THIS_MODULE, +- .n_voltages = 1, +- .volt_table = fixed_3300000_voltage, +- }, +- .update_bank = 0x03, +- .update_reg = 0x82, +- .update_mask = 0x03, +- .update_val = 0x01, +- .update_val_idle = 0x03, +- .update_val_normal = 0x01, +- }, + [AB8505_LDO_AUDIO] = { + .desc = { + .name = "LDO-AUDIO", +diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c +index 989506bd90b1..16f0c8570036 100644 +--- a/drivers/regulator/axp20x-regulator.c ++++ b/drivers/regulator/axp20x-regulator.c +@@ -413,10 +413,13 @@ static int axp20x_set_ramp_delay(struct regulator_dev *rdev, int ramp) + int i; + + for (i = 0; i < rate_count; i++) { +- if (ramp <= slew_rates[i]) +- cfg = AXP20X_DCDC2_LDO3_V_RAMP_LDO3_RATE(i); +- else ++ if (ramp > slew_rates[i]) + break; ++ ++ if (id == AXP20X_DCDC2) ++ cfg = AXP20X_DCDC2_LDO3_V_RAMP_DCDC2_RATE(i); ++ else ++ cfg = AXP20X_DCDC2_LDO3_V_RAMP_LDO3_RATE(i); + } + + if (cfg == 0xff) { +@@ -605,7 +608,7 @@ static const struct regulator_desc axp22x_regulators[] = { + AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO1_MASK), + AXP_DESC(AXP22X, ELDO2, "eldo2", "eldoin", 700, 3300, 100, + AXP22X_ELDO2_V_OUT, AXP22X_ELDO2_V_OUT_MASK, +- AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO1_MASK), ++ AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO2_MASK), + AXP_DESC(AXP22X, ELDO3, "eldo3", "eldoin", 700, 3300, 100, + AXP22X_ELDO3_V_OUT, AXP22X_ELDO3_V_OUT_MASK, + AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO3_MASK), +diff --git a/drivers/regulator/bd70528-regulator.c b/drivers/regulator/bd70528-regulator.c +index 0248a61f1006..6041839ec38c 100644 +--- a/drivers/regulator/bd70528-regulator.c ++++ b/drivers/regulator/bd70528-regulator.c +@@ -101,7 +101,6 @@ static const struct regulator_ops bd70528_ldo_ops = { + .set_voltage_sel = regulator_set_voltage_sel_regmap, + .get_voltage_sel = regulator_get_voltage_sel_regmap, + .set_voltage_time_sel = regulator_set_voltage_time_sel, +- .set_ramp_delay = bd70528_set_ramp_delay, + }; + + static const struct regulator_ops bd70528_led_ops = { +diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c +index f47b4b281b14..d7302c2052f9 100644 +--- a/drivers/scsi/libsas/sas_discover.c ++++ b/drivers/scsi/libsas/sas_discover.c +@@ -81,12 +81,21 @@ static int sas_get_port_device(struct asd_sas_port *port) + else + dev->dev_type = SAS_SATA_DEV; + dev->tproto = SAS_PROTOCOL_SATA; +- } else { ++ } else if (port->oob_mode == SAS_OOB_MODE) { + struct sas_identify_frame *id = + (struct sas_identify_frame *) dev->frame_rcvd; + dev->dev_type = id->dev_type; + dev->iproto = id->initiator_bits; + dev->tproto = id->target_bits; ++ } else { ++ /* If the oob mode is OOB_NOT_CONNECTED, the port is ++ * disconnected due to race with PHY down. We cannot ++ * continue to discover this port ++ */ ++ sas_put_device(dev); ++ pr_warn("Port %016llx is disconnected when discovering\n", ++ SAS_ADDR(port->attached_sas_addr)); ++ return -ENODEV; + } + + sas_init_dev(dev); +diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c +index 39a736b887b1..6c2b03415a2c 100644 +--- a/drivers/scsi/lpfc/lpfc_bsg.c ++++ b/drivers/scsi/lpfc/lpfc_bsg.c +@@ -4489,12 +4489,6 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, + phba->mbox_ext_buf_ctx.seqNum++; + nemb_tp = phba->mbox_ext_buf_ctx.nembType; + +- dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL); +- if (!dd_data) { +- rc = -ENOMEM; +- goto job_error; +- } +- + pbuf = (uint8_t *)dmabuf->virt; + size = job->request_payload.payload_len; + sg_copy_to_buffer(job->request_payload.sg_list, +@@ -4531,6 +4525,13 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, + "2968 SLI_CONFIG ext-buffer wr all %d " + "ebuffers received\n", + phba->mbox_ext_buf_ctx.numBuf); ++ ++ dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL); ++ if (!dd_data) { ++ rc = -ENOMEM; ++ goto job_error; ++ } ++ + /* mailbox command structure for base driver */ + pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); + if (!pmboxq) { +@@ -4579,6 +4580,8 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, + return SLI_CONFIG_HANDLED; + + job_error: ++ if (pmboxq) ++ mempool_free(pmboxq, phba->mbox_mem_pool); + lpfc_bsg_dma_page_free(phba, dmabuf); + kfree(dd_data); + +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index 1286c658ba34..ee70d14e7a9d 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -4843,6 +4843,44 @@ lpfc_nlp_logo_unreg(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) + } + } + ++/* ++ * Sets the mailbox completion handler to be used for the ++ * unreg_rpi command. The handler varies based on the state of ++ * the port and what will be happening to the rpi next. ++ */ ++static void ++lpfc_set_unreg_login_mbx_cmpl(struct lpfc_hba *phba, struct lpfc_vport *vport, ++ struct lpfc_nodelist *ndlp, LPFC_MBOXQ_t *mbox) ++{ ++ unsigned long iflags; ++ ++ if (ndlp->nlp_flag & NLP_ISSUE_LOGO) { ++ mbox->ctx_ndlp = ndlp; ++ mbox->mbox_cmpl = lpfc_nlp_logo_unreg; ++ ++ } else if (phba->sli_rev == LPFC_SLI_REV4 && ++ (!(vport->load_flag & FC_UNLOADING)) && ++ (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >= ++ LPFC_SLI_INTF_IF_TYPE_2) && ++ (kref_read(&ndlp->kref) > 0)) { ++ mbox->ctx_ndlp = lpfc_nlp_get(ndlp); ++ mbox->mbox_cmpl = lpfc_sli4_unreg_rpi_cmpl_clr; ++ } else { ++ if (vport->load_flag & FC_UNLOADING) { ++ if (phba->sli_rev == LPFC_SLI_REV4) { ++ spin_lock_irqsave(&vport->phba->ndlp_lock, ++ iflags); ++ ndlp->nlp_flag |= NLP_RELEASE_RPI; ++ spin_unlock_irqrestore(&vport->phba->ndlp_lock, ++ iflags); ++ } ++ lpfc_nlp_get(ndlp); ++ } ++ mbox->ctx_ndlp = ndlp; ++ mbox->mbox_cmpl = lpfc_sli_def_mbox_cmpl; ++ } ++} ++ + /* + * Free rpi associated with LPFC_NODELIST entry. + * This routine is called from lpfc_freenode(), when we are removing +@@ -4893,33 +4931,12 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + + lpfc_unreg_login(phba, vport->vpi, rpi, mbox); + mbox->vport = vport; +- if (ndlp->nlp_flag & NLP_ISSUE_LOGO) { +- mbox->ctx_ndlp = ndlp; +- mbox->mbox_cmpl = lpfc_nlp_logo_unreg; +- } else { +- if (phba->sli_rev == LPFC_SLI_REV4 && +- (!(vport->load_flag & FC_UNLOADING)) && +- (bf_get(lpfc_sli_intf_if_type, +- &phba->sli4_hba.sli_intf) >= +- LPFC_SLI_INTF_IF_TYPE_2) && +- (kref_read(&ndlp->kref) > 0)) { +- mbox->ctx_ndlp = lpfc_nlp_get(ndlp); +- mbox->mbox_cmpl = +- lpfc_sli4_unreg_rpi_cmpl_clr; +- /* +- * accept PLOGIs after unreg_rpi_cmpl +- */ +- acc_plogi = 0; +- } else if (vport->load_flag & FC_UNLOADING) { +- mbox->ctx_ndlp = NULL; +- mbox->mbox_cmpl = +- lpfc_sli_def_mbox_cmpl; +- } else { +- mbox->ctx_ndlp = ndlp; +- mbox->mbox_cmpl = +- lpfc_sli_def_mbox_cmpl; +- } +- } ++ lpfc_set_unreg_login_mbx_cmpl(phba, vport, ndlp, mbox); ++ if (mbox->mbox_cmpl == lpfc_sli4_unreg_rpi_cmpl_clr) ++ /* ++ * accept PLOGIs after unreg_rpi_cmpl ++ */ ++ acc_plogi = 0; + if (((ndlp->nlp_DID & Fabric_DID_MASK) != + Fabric_DID_MASK) && + (!(vport->fc_flag & FC_OFFLINE_MODE))) +@@ -5060,6 +5077,7 @@ lpfc_cleanup_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + struct lpfc_hba *phba = vport->phba; + LPFC_MBOXQ_t *mb, *nextmb; + struct lpfc_dmabuf *mp; ++ unsigned long iflags; + + /* Cleanup node for NPort */ + lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE, +@@ -5141,8 +5159,20 @@ lpfc_cleanup_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + lpfc_cleanup_vports_rrqs(vport, ndlp); + if (phba->sli_rev == LPFC_SLI_REV4) + ndlp->nlp_flag |= NLP_RELEASE_RPI; +- lpfc_unreg_rpi(vport, ndlp); +- ++ if (!lpfc_unreg_rpi(vport, ndlp)) { ++ /* Clean up unregistered and non freed rpis */ ++ if ((ndlp->nlp_flag & NLP_RELEASE_RPI) && ++ !(ndlp->nlp_rpi == LPFC_RPI_ALLOC_ERROR)) { ++ lpfc_sli4_free_rpi(vport->phba, ++ ndlp->nlp_rpi); ++ spin_lock_irqsave(&vport->phba->ndlp_lock, ++ iflags); ++ ndlp->nlp_flag &= ~NLP_RELEASE_RPI; ++ ndlp->nlp_rpi = LPFC_RPI_ALLOC_ERROR; ++ spin_unlock_irqrestore(&vport->phba->ndlp_lock, ++ iflags); ++ } ++ } + return 0; + } + +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index a227e36cbdc2..8e0f03ef346b 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -1976,6 +1976,8 @@ out_unlock: + + /* Declare and initialization an instance of the FC NVME template. */ + static struct nvme_fc_port_template lpfc_nvme_template = { ++ .module = THIS_MODULE, ++ + /* initiator-based functions */ + .localport_delete = lpfc_nvme_localport_delete, + .remoteport_delete = lpfc_nvme_remoteport_delete, +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 2b0e7b32c2df..8860f41af3ff 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -2526,6 +2526,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) + } else { + __lpfc_sli_rpi_release(vport, ndlp); + } ++ if (vport->load_flag & FC_UNLOADING) ++ lpfc_nlp_put(ndlp); + pmb->ctx_ndlp = NULL; + } + } +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index d5386edddaf6..1eb3fe281cc3 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -2401,6 +2401,7 @@ typedef struct fc_port { + unsigned int id_changed:1; + unsigned int scan_needed:1; + unsigned int n2n_flag:1; ++ unsigned int explicit_logout:1; + + struct completion nvme_del_done; + uint32_t nvme_prli_service_param; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 5d31e3d52b6b..80f276d67c14 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -4927,14 +4927,8 @@ qla2x00_configure_loop(scsi_qla_host_t *vha) + set_bit(RSCN_UPDATE, &flags); + clear_bit(LOCAL_LOOP_UPDATE, &flags); + +- } else if (ha->current_topology == ISP_CFG_N) { +- clear_bit(RSCN_UPDATE, &flags); +- if (qla_tgt_mode_enabled(vha)) { +- /* allow the other side to start the login */ +- clear_bit(LOCAL_LOOP_UPDATE, &flags); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); +- } +- } else if (ha->current_topology == ISP_CFG_NL) { ++ } else if (ha->current_topology == ISP_CFG_NL || ++ ha->current_topology == ISP_CFG_N) { + clear_bit(RSCN_UPDATE, &flags); + set_bit(LOCAL_LOOP_UPDATE, &flags); + } else if (!vha->flags.online || +@@ -5051,7 +5045,6 @@ qla2x00_configure_local_loop(scsi_qla_host_t *vha) + memcpy(&ha->plogi_els_payld.data, + (void *)ha->init_cb, + sizeof(ha->plogi_els_payld.data)); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); + } else { + ql_dbg(ql_dbg_init, vha, 0x00d1, + "PLOGI ELS param read fail.\n"); +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 518eb954cf42..bdf1994251b9 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -2405,11 +2405,19 @@ qla2x00_login_iocb(srb_t *sp, struct mbx_entry *mbx) + static void + qla24xx_logout_iocb(srb_t *sp, struct logio_entry_24xx *logio) + { ++ u16 control_flags = LCF_COMMAND_LOGO; + logio->entry_type = LOGINOUT_PORT_IOCB_TYPE; +- logio->control_flags = +- cpu_to_le16(LCF_COMMAND_LOGO|LCF_IMPL_LOGO); +- if (!sp->fcport->keep_nport_handle) +- logio->control_flags |= cpu_to_le16(LCF_FREE_NPORT); ++ ++ if (sp->fcport->explicit_logout) { ++ control_flags |= LCF_EXPL_LOGO|LCF_FREE_NPORT; ++ } else { ++ control_flags |= LCF_IMPL_LOGO; ++ ++ if (!sp->fcport->keep_nport_handle) ++ control_flags |= LCF_FREE_NPORT; ++ } ++ ++ logio->control_flags = cpu_to_le16(control_flags); + logio->nport_handle = cpu_to_le16(sp->fcport->loop_id); + logio->port_id[0] = sp->fcport->d_id.b.al_pa; + logio->port_id[1] = sp->fcport->d_id.b.area; +@@ -2676,7 +2684,8 @@ qla24xx_els_logo_iocb(srb_t *sp, struct els_entry_24xx *els_iocb) + ql_dbg(ql_dbg_io + ql_dbg_buffer, vha, 0x3073, + "PLOGI ELS IOCB:\n"); + ql_dump_buffer(ql_log_info, vha, 0x0109, +- (uint8_t *)els_iocb, 0x70); ++ (uint8_t *)els_iocb, ++ sizeof(*els_iocb)); + } else { + els_iocb->control_flags = 1 << 13; + els_iocb->tx_byte_count = +@@ -2842,7 +2851,8 @@ qla24xx_els_dcmd2_iocb(scsi_qla_host_t *vha, int els_opcode, + + ql_dbg(ql_dbg_disc + ql_dbg_buffer, vha, 0x3073, "PLOGI buffer:\n"); + ql_dump_buffer(ql_dbg_disc + ql_dbg_buffer, vha, 0x0109, +- (uint8_t *)elsio->u.els_plogi.els_plogi_pyld, 0x70); ++ (uint8_t *)elsio->u.els_plogi.els_plogi_pyld, ++ sizeof(*elsio->u.els_plogi.els_plogi_pyld)); + + rval = qla2x00_start_sp(sp); + if (rval != QLA_SUCCESS) { +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 9204e8467a4e..b3766b1879e3 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1061,8 +1061,6 @@ global_port_update: + ql_dbg(ql_dbg_async, vha, 0x5011, + "Asynchronous PORT UPDATE ignored %04x/%04x/%04x.\n", + mb[1], mb[2], mb[3]); +- +- qlt_async_event(mb[0], vha, mb); + break; + } + +@@ -1079,8 +1077,6 @@ global_port_update: + set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags); + set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags); + set_bit(VP_CONFIG_OK, &vha->vp_flags); +- +- qlt_async_event(mb[0], vha, mb); + break; + + case MBA_RSCN_UPDATE: /* State Change Registration */ +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 4d90cf101f5f..eac76e934cbe 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -3920,6 +3920,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + vha->d_id.b24 = 0; + vha->d_id.b.al_pa = 1; + ha->flags.n2n_bigger = 1; ++ ha->flags.n2n_ae = 0; + + id.b.al_pa = 2; + ql_dbg(ql_dbg_async, vha, 0x5075, +@@ -3930,6 +3931,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + "Format 1: Remote login - Waiting for WWPN %8phC.\n", + rptid_entry->u.f1.port_name); + ha->flags.n2n_bigger = 0; ++ ha->flags.n2n_ae = 1; + } + qla24xx_post_newsess_work(vha, &id, + rptid_entry->u.f1.port_name, +@@ -3941,7 +3943,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + /* if our portname is higher then initiate N2N login */ + + set_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags); +- ha->flags.n2n_ae = 1; + return; + break; + case TOPO_FL: +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 941aa53363f5..bfcd02fdf2b8 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -610,6 +610,7 @@ static void qla_nvme_remoteport_delete(struct nvme_fc_remote_port *rport) + } + + static struct nvme_fc_port_template qla_nvme_fc_transport = { ++ .module = THIS_MODULE, + .localport_delete = qla_nvme_localport_delete, + .remoteport_delete = qla_nvme_remoteport_delete, + .create_queue = qla_nvme_alloc_queue, +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index a9bd0f513316..74a378a91b71 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1104,6 +1104,7 @@ void qlt_free_session_done(struct work_struct *work) + } + } + ++ sess->explicit_logout = 0; + spin_unlock_irqrestore(&ha->tgt.sess_lock, flags); + sess->free_pending = 0; + +@@ -1264,7 +1265,6 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess) + "Scheduling sess %p for deletion %8phC\n", + sess, sess->port_name); + +- INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn); + WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work)); + } + +@@ -4803,6 +4803,7 @@ static int qlt_handle_login(struct scsi_qla_host *vha, + + switch (sess->disc_state) { + case DSC_DELETED: ++ case DSC_LOGIN_PEND: + qlt_plogi_ack_unref(vha, pla); + break; + +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index bab2073c1f72..abe7f79bb789 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -350,6 +350,7 @@ static void tcm_qla2xxx_close_session(struct se_session *se_sess) + target_sess_cmd_list_set_waiting(se_sess); + spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); + ++ sess->explicit_logout = 1; + tcm_qla2xxx_put_sess(sess); + } + +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 8c674eca09f1..2323432a0edb 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -4275,7 +4275,6 @@ static int qla4xxx_mem_alloc(struct scsi_qla_host *ha) + return QLA_SUCCESS; + + mem_alloc_error_exit: +- qla4xxx_mem_free(ha); + return QLA_ERROR; + } + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 417b868d8735..ed8d9709b9b9 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -24,6 +24,8 @@ + + #define ISCSI_TRANSPORT_VERSION "2.0-870" + ++#define ISCSI_SEND_MAX_ALLOWED 10 ++ + #define CREATE_TRACE_POINTS + #include + +@@ -3682,6 +3684,7 @@ iscsi_if_rx(struct sk_buff *skb) + struct nlmsghdr *nlh; + struct iscsi_uevent *ev; + uint32_t group; ++ int retries = ISCSI_SEND_MAX_ALLOWED; + + nlh = nlmsg_hdr(skb); + if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) || +@@ -3712,6 +3715,10 @@ iscsi_if_rx(struct sk_buff *skb) + break; + err = iscsi_if_send_reply(portid, nlh->nlmsg_type, + ev, sizeof(*ev)); ++ if (err == -EAGAIN && --retries < 0) { ++ printk(KERN_WARNING "Send reply failed, error %d\n", err); ++ break; ++ } + } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH); + skb_pull(skb, rlen); + } +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index bec758e978fb..d47bd26577b3 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -583,21 +583,14 @@ static void dspi_tcfq_write(struct fsl_dspi *dspi) + dspi->tx_cmd |= SPI_PUSHR_CMD_CTCNT; + + if (dspi->devtype_data->xspi_mode && dspi->bits_per_word > 16) { +- /* Write two TX FIFO entries first, and then the corresponding +- * CMD FIFO entry. ++ /* Write the CMD FIFO entry first, and then the two ++ * corresponding TX FIFO entries. + */ + u32 data = dspi_pop_tx(dspi); + +- if (dspi->cur_chip->ctar_val & SPI_CTAR_LSBFE) { +- /* LSB */ +- tx_fifo_write(dspi, data & 0xFFFF); +- tx_fifo_write(dspi, data >> 16); +- } else { +- /* MSB */ +- tx_fifo_write(dspi, data >> 16); +- tx_fifo_write(dspi, data & 0xFFFF); +- } + cmd_fifo_write(dspi); ++ tx_fifo_write(dspi, data & 0xFFFF); ++ tx_fifo_write(dspi, data >> 16); + } else { + /* Write one entry to both TX FIFO and CMD FIFO + * simultaneously. +diff --git a/drivers/spi/spi-uniphier.c b/drivers/spi/spi-uniphier.c +index 47cde1864630..ce9b30112e26 100644 +--- a/drivers/spi/spi-uniphier.c ++++ b/drivers/spi/spi-uniphier.c +@@ -290,25 +290,32 @@ static void uniphier_spi_recv(struct uniphier_spi_priv *priv) + } + } + +-static void uniphier_spi_fill_tx_fifo(struct uniphier_spi_priv *priv) ++static void uniphier_spi_set_fifo_threshold(struct uniphier_spi_priv *priv, ++ unsigned int threshold) + { +- unsigned int fifo_threshold, fill_bytes; + u32 val; + +- fifo_threshold = DIV_ROUND_UP(priv->rx_bytes, +- bytes_per_word(priv->bits_per_word)); +- fifo_threshold = min(fifo_threshold, SSI_FIFO_DEPTH); +- +- fill_bytes = fifo_threshold - (priv->rx_bytes - priv->tx_bytes); +- +- /* set fifo threshold */ + val = readl(priv->base + SSI_FC); + val &= ~(SSI_FC_TXFTH_MASK | SSI_FC_RXFTH_MASK); +- val |= FIELD_PREP(SSI_FC_TXFTH_MASK, fifo_threshold); +- val |= FIELD_PREP(SSI_FC_RXFTH_MASK, fifo_threshold); ++ val |= FIELD_PREP(SSI_FC_TXFTH_MASK, SSI_FIFO_DEPTH - threshold); ++ val |= FIELD_PREP(SSI_FC_RXFTH_MASK, threshold); + writel(val, priv->base + SSI_FC); ++} ++ ++static void uniphier_spi_fill_tx_fifo(struct uniphier_spi_priv *priv) ++{ ++ unsigned int fifo_threshold, fill_words; ++ unsigned int bpw = bytes_per_word(priv->bits_per_word); ++ ++ fifo_threshold = DIV_ROUND_UP(priv->rx_bytes, bpw); ++ fifo_threshold = min(fifo_threshold, SSI_FIFO_DEPTH); ++ ++ uniphier_spi_set_fifo_threshold(priv, fifo_threshold); ++ ++ fill_words = fifo_threshold - ++ DIV_ROUND_UP(priv->rx_bytes - priv->tx_bytes, bpw); + +- while (fill_bytes--) ++ while (fill_words--) + uniphier_spi_send(priv); + } + +diff --git a/drivers/staging/wlan-ng/Kconfig b/drivers/staging/wlan-ng/Kconfig +index ac136663fa8e..082c16a31616 100644 +--- a/drivers/staging/wlan-ng/Kconfig ++++ b/drivers/staging/wlan-ng/Kconfig +@@ -4,6 +4,7 @@ config PRISM2_USB + depends on WLAN && USB && CFG80211 + select WIRELESS_EXT + select WEXT_PRIV ++ select CRC32 + help + This is the wlan-ng prism 2.5/3 USB driver for a wide range of + old USB wireless devices. +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index 00964b6e4ac1..e0718ee5d42a 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -1580,6 +1580,7 @@ static void __msm_console_write(struct uart_port *port, const char *s, + int num_newlines = 0; + bool replaced = false; + void __iomem *tf; ++ int locked = 1; + + if (is_uartdm) + tf = port->membase + UARTDM_TF; +@@ -1592,7 +1593,13 @@ static void __msm_console_write(struct uart_port *port, const char *s, + num_newlines++; + count += num_newlines; + +- spin_lock(&port->lock); ++ if (port->sysrq) ++ locked = 0; ++ else if (oops_in_progress) ++ locked = spin_trylock(&port->lock); ++ else ++ spin_lock(&port->lock); ++ + if (is_uartdm) + msm_reset_dm_count(port, count); + +@@ -1628,7 +1635,9 @@ static void __msm_console_write(struct uart_port *port, const char *s, + iowrite32_rep(tf, buf, 1); + i += num_chars; + } +- spin_unlock(&port->lock); ++ ++ if (locked) ++ spin_unlock(&port->lock); + } + + static void msm_console_write(struct console *co, const char *s, +diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c +index 6ce044008cf6..460d5d7c984f 100644 +--- a/drivers/usb/gadget/function/f_ecm.c ++++ b/drivers/usb/gadget/function/f_ecm.c +@@ -621,8 +621,12 @@ static void ecm_disable(struct usb_function *f) + + DBG(cdev, "ecm deactivated\n"); + +- if (ecm->port.in_ep->enabled) ++ if (ecm->port.in_ep->enabled) { + gether_disconnect(&ecm->port); ++ } else { ++ ecm->port.in_ep->desc = NULL; ++ ecm->port.out_ep->desc = NULL; ++ } + + usb_ep_disable(ecm->notify); + ecm->notify->desc = NULL; +diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c +index d48df36622b7..0d8e4a364ca6 100644 +--- a/drivers/usb/gadget/function/f_rndis.c ++++ b/drivers/usb/gadget/function/f_rndis.c +@@ -618,6 +618,7 @@ static void rndis_disable(struct usb_function *f) + gether_disconnect(&rndis->port); + + usb_ep_disable(rndis->notify); ++ rndis->notify->desc = NULL; + } + + /*-------------------------------------------------------------------------*/ +diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig +index 58e7c100b6ad..4c761abc5688 100644 +--- a/drivers/watchdog/Kconfig ++++ b/drivers/watchdog/Kconfig +@@ -1444,6 +1444,7 @@ config SMSC37B787_WDT + config TQMX86_WDT + tristate "TQ-Systems TQMX86 Watchdog Timer" + depends on X86 ++ select WATCHDOG_CORE + help + This is the driver for the hardware watchdog timer in the TQMX86 IO + controller found on some of their ComExpress Modules. +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index 5bae515c8e25..bed90d612e48 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -395,7 +395,8 @@ static struct notifier_block xen_memory_nb = { + #else + static enum bp_state reserve_additional_memory(void) + { +- balloon_stats.target_pages = balloon_stats.current_pages; ++ balloon_stats.target_pages = balloon_stats.current_pages + ++ balloon_stats.target_unpopulated; + return BP_ECANCELED; + } + #endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */ +diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c +index 4150280509ff..7503899c0a1b 100644 +--- a/fs/afs/dynroot.c ++++ b/fs/afs/dynroot.c +@@ -136,6 +136,9 @@ static struct dentry *afs_dynroot_lookup(struct inode *dir, struct dentry *dentr + + ASSERTCMP(d_inode(dentry), ==, NULL); + ++ if (flags & LOOKUP_CREATE) ++ return ERR_PTR(-EOPNOTSUPP); ++ + if (dentry->d_name.len >= AFSNAMEMAX) { + _leave(" = -ENAMETOOLONG"); + return ERR_PTR(-ENAMETOOLONG); +diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c +index f532d6d3bd28..79bc5f1338ed 100644 +--- a/fs/afs/mntpt.c ++++ b/fs/afs/mntpt.c +@@ -126,7 +126,7 @@ static int afs_mntpt_set_params(struct fs_context *fc, struct dentry *mntpt) + if (src_as->cell) + ctx->cell = afs_get_cell(src_as->cell); + +- if (size > PAGE_SIZE - 1) ++ if (size < 2 || size > PAGE_SIZE - 1) + return -EINVAL; + + page = read_mapping_page(d_inode(mntpt)->i_mapping, 0, NULL); +@@ -140,7 +140,9 @@ static int afs_mntpt_set_params(struct fs_context *fc, struct dentry *mntpt) + } + + buf = kmap(page); +- ret = vfs_parse_fs_string(fc, "source", buf, size); ++ ret = -EINVAL; ++ if (buf[size - 1] == '.') ++ ret = vfs_parse_fs_string(fc, "source", buf, size - 1); + kunmap(page); + put_page(page); + if (ret < 0) +diff --git a/fs/afs/server.c b/fs/afs/server.c +index 64d440aaabc0..ca8115ba1724 100644 +--- a/fs/afs/server.c ++++ b/fs/afs/server.c +@@ -32,18 +32,11 @@ static void afs_dec_servers_outstanding(struct afs_net *net) + struct afs_server *afs_find_server(struct afs_net *net, + const struct sockaddr_rxrpc *srx) + { +- const struct sockaddr_in6 *a = &srx->transport.sin6, *b; + const struct afs_addr_list *alist; + struct afs_server *server = NULL; + unsigned int i; +- bool ipv6 = true; + int seq = 0, diff; + +- if (srx->transport.sin6.sin6_addr.s6_addr32[0] == 0 || +- srx->transport.sin6.sin6_addr.s6_addr32[1] == 0 || +- srx->transport.sin6.sin6_addr.s6_addr32[2] == htonl(0xffff)) +- ipv6 = false; +- + rcu_read_lock(); + + do { +@@ -52,7 +45,8 @@ struct afs_server *afs_find_server(struct afs_net *net, + server = NULL; + read_seqbegin_or_lock(&net->fs_addr_lock, &seq); + +- if (ipv6) { ++ if (srx->transport.family == AF_INET6) { ++ const struct sockaddr_in6 *a = &srx->transport.sin6, *b; + hlist_for_each_entry_rcu(server, &net->fs_addresses6, addr6_link) { + alist = rcu_dereference(server->addresses); + for (i = alist->nr_ipv4; i < alist->nr_addrs; i++) { +@@ -68,15 +62,16 @@ struct afs_server *afs_find_server(struct afs_net *net, + } + } + } else { ++ const struct sockaddr_in *a = &srx->transport.sin, *b; + hlist_for_each_entry_rcu(server, &net->fs_addresses4, addr4_link) { + alist = rcu_dereference(server->addresses); + for (i = 0; i < alist->nr_ipv4; i++) { +- b = &alist->addrs[i].transport.sin6; +- diff = ((u16 __force)a->sin6_port - +- (u16 __force)b->sin6_port); ++ b = &alist->addrs[i].transport.sin; ++ diff = ((u16 __force)a->sin_port - ++ (u16 __force)b->sin_port); + if (diff == 0) +- diff = ((u32 __force)a->sin6_addr.s6_addr32[3] - +- (u32 __force)b->sin6_addr.s6_addr32[3]); ++ diff = ((u32 __force)a->sin_addr.s_addr - ++ (u32 __force)b->sin_addr.s_addr); + if (diff == 0) + goto found; + } +diff --git a/fs/afs/super.c b/fs/afs/super.c +index 488641b1a418..d9a6036b70b9 100644 +--- a/fs/afs/super.c ++++ b/fs/afs/super.c +@@ -448,7 +448,6 @@ static int afs_fill_super(struct super_block *sb, struct afs_fs_context *ctx) + /* allocate the root inode and dentry */ + if (as->dyn_root) { + inode = afs_iget_pseudo_dir(sb, true); +- sb->s_flags |= SB_RDONLY; + } else { + sprintf(sb->s_id, "%llu", as->volume->vid); + afs_activate_volume(as->volume); +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index 10a04b99798a..3f3110975f88 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -53,16 +53,6 @@ struct btrfs_workqueue { + struct __btrfs_workqueue *high; + }; + +-static void normal_work_helper(struct btrfs_work *work); +- +-#define BTRFS_WORK_HELPER(name) \ +-noinline_for_stack void btrfs_##name(struct work_struct *arg) \ +-{ \ +- struct btrfs_work *work = container_of(arg, struct btrfs_work, \ +- normal_work); \ +- normal_work_helper(work); \ +-} +- + struct btrfs_fs_info * + btrfs_workqueue_owner(const struct __btrfs_workqueue *wq) + { +@@ -89,29 +79,6 @@ bool btrfs_workqueue_normal_congested(const struct btrfs_workqueue *wq) + return atomic_read(&wq->normal->pending) > wq->normal->thresh * 2; + } + +-BTRFS_WORK_HELPER(worker_helper); +-BTRFS_WORK_HELPER(delalloc_helper); +-BTRFS_WORK_HELPER(flush_delalloc_helper); +-BTRFS_WORK_HELPER(cache_helper); +-BTRFS_WORK_HELPER(submit_helper); +-BTRFS_WORK_HELPER(fixup_helper); +-BTRFS_WORK_HELPER(endio_helper); +-BTRFS_WORK_HELPER(endio_meta_helper); +-BTRFS_WORK_HELPER(endio_meta_write_helper); +-BTRFS_WORK_HELPER(endio_raid56_helper); +-BTRFS_WORK_HELPER(endio_repair_helper); +-BTRFS_WORK_HELPER(rmw_helper); +-BTRFS_WORK_HELPER(endio_write_helper); +-BTRFS_WORK_HELPER(freespace_write_helper); +-BTRFS_WORK_HELPER(delayed_meta_helper); +-BTRFS_WORK_HELPER(readahead_helper); +-BTRFS_WORK_HELPER(qgroup_rescan_helper); +-BTRFS_WORK_HELPER(extent_refs_helper); +-BTRFS_WORK_HELPER(scrub_helper); +-BTRFS_WORK_HELPER(scrubwrc_helper); +-BTRFS_WORK_HELPER(scrubnc_helper); +-BTRFS_WORK_HELPER(scrubparity_helper); +- + static struct __btrfs_workqueue * + __btrfs_alloc_workqueue(struct btrfs_fs_info *fs_info, const char *name, + unsigned int flags, int limit_active, int thresh) +@@ -302,12 +269,13 @@ static void run_ordered_work(struct __btrfs_workqueue *wq, + * original work item cannot depend on the recycled work + * item in that case (see find_worker_executing_work()). + * +- * Note that the work of one Btrfs filesystem may depend +- * on the work of another Btrfs filesystem via, e.g., a +- * loop device. Therefore, we must not allow the current +- * work item to be recycled until we are really done, +- * otherwise we break the above assumption and can +- * deadlock. ++ * Note that different types of Btrfs work can depend on ++ * each other, and one type of work on one Btrfs ++ * filesystem may even depend on the same type of work ++ * on another Btrfs filesystem via, e.g., a loop device. ++ * Therefore, we must not allow the current work item to ++ * be recycled until we are really done, otherwise we ++ * break the above assumption and can deadlock. + */ + free_self = true; + } else { +@@ -331,8 +299,10 @@ static void run_ordered_work(struct __btrfs_workqueue *wq, + } + } + +-static void normal_work_helper(struct btrfs_work *work) ++static void btrfs_work_helper(struct work_struct *normal_work) + { ++ struct btrfs_work *work = container_of(normal_work, struct btrfs_work, ++ normal_work); + struct __btrfs_workqueue *wq; + void *wtag; + int need_order = 0; +@@ -362,15 +332,13 @@ static void normal_work_helper(struct btrfs_work *work) + trace_btrfs_all_work_done(wq->fs_info, wtag); + } + +-void btrfs_init_work(struct btrfs_work *work, btrfs_work_func_t uniq_func, +- btrfs_func_t func, +- btrfs_func_t ordered_func, +- btrfs_func_t ordered_free) ++void btrfs_init_work(struct btrfs_work *work, btrfs_func_t func, ++ btrfs_func_t ordered_func, btrfs_func_t ordered_free) + { + work->func = func; + work->ordered_func = ordered_func; + work->ordered_free = ordered_free; +- INIT_WORK(&work->normal_work, uniq_func); ++ INIT_WORK(&work->normal_work, btrfs_work_helper); + INIT_LIST_HEAD(&work->ordered_list); + work->flags = 0; + } +diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h +index 7861c9feba5f..c5bf2b117c05 100644 +--- a/fs/btrfs/async-thread.h ++++ b/fs/btrfs/async-thread.h +@@ -29,42 +29,13 @@ struct btrfs_work { + unsigned long flags; + }; + +-#define BTRFS_WORK_HELPER_PROTO(name) \ +-void btrfs_##name(struct work_struct *arg) +- +-BTRFS_WORK_HELPER_PROTO(worker_helper); +-BTRFS_WORK_HELPER_PROTO(delalloc_helper); +-BTRFS_WORK_HELPER_PROTO(flush_delalloc_helper); +-BTRFS_WORK_HELPER_PROTO(cache_helper); +-BTRFS_WORK_HELPER_PROTO(submit_helper); +-BTRFS_WORK_HELPER_PROTO(fixup_helper); +-BTRFS_WORK_HELPER_PROTO(endio_helper); +-BTRFS_WORK_HELPER_PROTO(endio_meta_helper); +-BTRFS_WORK_HELPER_PROTO(endio_meta_write_helper); +-BTRFS_WORK_HELPER_PROTO(endio_raid56_helper); +-BTRFS_WORK_HELPER_PROTO(endio_repair_helper); +-BTRFS_WORK_HELPER_PROTO(rmw_helper); +-BTRFS_WORK_HELPER_PROTO(endio_write_helper); +-BTRFS_WORK_HELPER_PROTO(freespace_write_helper); +-BTRFS_WORK_HELPER_PROTO(delayed_meta_helper); +-BTRFS_WORK_HELPER_PROTO(readahead_helper); +-BTRFS_WORK_HELPER_PROTO(qgroup_rescan_helper); +-BTRFS_WORK_HELPER_PROTO(extent_refs_helper); +-BTRFS_WORK_HELPER_PROTO(scrub_helper); +-BTRFS_WORK_HELPER_PROTO(scrubwrc_helper); +-BTRFS_WORK_HELPER_PROTO(scrubnc_helper); +-BTRFS_WORK_HELPER_PROTO(scrubparity_helper); +- +- + struct btrfs_workqueue *btrfs_alloc_workqueue(struct btrfs_fs_info *fs_info, + const char *name, + unsigned int flags, + int limit_active, + int thresh); +-void btrfs_init_work(struct btrfs_work *work, btrfs_work_func_t helper, +- btrfs_func_t func, +- btrfs_func_t ordered_func, +- btrfs_func_t ordered_free); ++void btrfs_init_work(struct btrfs_work *work, btrfs_func_t func, ++ btrfs_func_t ordered_func, btrfs_func_t ordered_free); + void btrfs_queue_work(struct btrfs_workqueue *wq, + struct btrfs_work *work); + void btrfs_destroy_workqueue(struct btrfs_workqueue *wq); +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 0d2da2366869..7dcfa7d7632a 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -695,8 +695,7 @@ int btrfs_cache_block_group(struct btrfs_block_group_cache *cache, + caching_ctl->block_group = cache; + caching_ctl->progress = cache->key.objectid; + refcount_set(&caching_ctl->count, 1); +- btrfs_init_work(&caching_ctl->work, btrfs_cache_helper, +- caching_thread, NULL, NULL); ++ btrfs_init_work(&caching_ctl->work, caching_thread, NULL, NULL); + + spin_lock(&cache->lock); + /* +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 57a9ad3e8c29..c7a53e79c66d 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1367,8 +1367,8 @@ static int btrfs_wq_run_delayed_node(struct btrfs_delayed_root *delayed_root, + return -ENOMEM; + + async_work->delayed_root = delayed_root; +- btrfs_init_work(&async_work->work, btrfs_delayed_meta_helper, +- btrfs_async_run_delayed_root, NULL, NULL); ++ btrfs_init_work(&async_work->work, btrfs_async_run_delayed_root, NULL, ++ NULL); + async_work->nr = nr; + + btrfs_queue_work(fs_info->delayed_workers, &async_work->work); +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 3895c21853cc..bae334212ee2 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -706,43 +706,31 @@ static void end_workqueue_bio(struct bio *bio) + struct btrfs_end_io_wq *end_io_wq = bio->bi_private; + struct btrfs_fs_info *fs_info; + struct btrfs_workqueue *wq; +- btrfs_work_func_t func; + + fs_info = end_io_wq->info; + end_io_wq->status = bio->bi_status; + + if (bio_op(bio) == REQ_OP_WRITE) { +- if (end_io_wq->metadata == BTRFS_WQ_ENDIO_METADATA) { ++ if (end_io_wq->metadata == BTRFS_WQ_ENDIO_METADATA) + wq = fs_info->endio_meta_write_workers; +- func = btrfs_endio_meta_write_helper; +- } else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_FREE_SPACE) { ++ else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_FREE_SPACE) + wq = fs_info->endio_freespace_worker; +- func = btrfs_freespace_write_helper; +- } else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) { ++ else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) + wq = fs_info->endio_raid56_workers; +- func = btrfs_endio_raid56_helper; +- } else { ++ else + wq = fs_info->endio_write_workers; +- func = btrfs_endio_write_helper; +- } + } else { +- if (unlikely(end_io_wq->metadata == +- BTRFS_WQ_ENDIO_DIO_REPAIR)) { ++ if (unlikely(end_io_wq->metadata == BTRFS_WQ_ENDIO_DIO_REPAIR)) + wq = fs_info->endio_repair_workers; +- func = btrfs_endio_repair_helper; +- } else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) { ++ else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) + wq = fs_info->endio_raid56_workers; +- func = btrfs_endio_raid56_helper; +- } else if (end_io_wq->metadata) { ++ else if (end_io_wq->metadata) + wq = fs_info->endio_meta_workers; +- func = btrfs_endio_meta_helper; +- } else { ++ else + wq = fs_info->endio_workers; +- func = btrfs_endio_helper; +- } + } + +- btrfs_init_work(&end_io_wq->work, func, end_workqueue_fn, NULL, NULL); ++ btrfs_init_work(&end_io_wq->work, end_workqueue_fn, NULL, NULL); + btrfs_queue_work(wq, &end_io_wq->work); + } + +@@ -835,8 +823,8 @@ blk_status_t btrfs_wq_submit_bio(struct btrfs_fs_info *fs_info, struct bio *bio, + async->mirror_num = mirror_num; + async->submit_bio_start = submit_bio_start; + +- btrfs_init_work(&async->work, btrfs_worker_helper, run_one_async_start, +- run_one_async_done, run_one_async_free); ++ btrfs_init_work(&async->work, run_one_async_start, run_one_async_done, ++ run_one_async_free); + + async->bio_offset = bio_offset; + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index be9dc78aa727..33c6b191ca59 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -1899,7 +1899,7 @@ static int __process_pages_contig(struct address_space *mapping, + if (page_ops & PAGE_SET_PRIVATE2) + SetPagePrivate2(pages[i]); + +- if (pages[i] == locked_page) { ++ if (locked_page && pages[i] == locked_page) { + put_page(pages[i]); + pages_locked++; + continue; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index e5758f62e8d8..0b2758961b1c 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -712,10 +712,12 @@ cleanup_and_bail_uncompressed: + * to our extent and set things up for the async work queue to run + * cow_file_range to do the normal delalloc dance. + */ +- if (page_offset(async_chunk->locked_page) >= start && +- page_offset(async_chunk->locked_page) <= end) ++ if (async_chunk->locked_page && ++ (page_offset(async_chunk->locked_page) >= start && ++ page_offset(async_chunk->locked_page)) <= end) { + __set_page_dirty_nobuffers(async_chunk->locked_page); + /* unlocked later on in the async handlers */ ++ } + + if (redirty) + extent_range_redirty_for_io(inode, start, end); +@@ -795,7 +797,7 @@ retry: + async_extent->start + + async_extent->ram_size - 1, + WB_SYNC_ALL); +- else if (ret) ++ else if (ret && async_chunk->locked_page) + unlock_page(async_chunk->locked_page); + kfree(async_extent); + cond_resched(); +@@ -1264,14 +1266,27 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page, + async_chunk[i].inode = inode; + async_chunk[i].start = start; + async_chunk[i].end = cur_end; +- async_chunk[i].locked_page = locked_page; + async_chunk[i].write_flags = write_flags; + INIT_LIST_HEAD(&async_chunk[i].extents); + +- btrfs_init_work(&async_chunk[i].work, +- btrfs_delalloc_helper, +- async_cow_start, async_cow_submit, +- async_cow_free); ++ /* ++ * The locked_page comes all the way from writepage and its ++ * the original page we were actually given. As we spread ++ * this large delalloc region across multiple async_chunk ++ * structs, only the first struct needs a pointer to locked_page ++ * ++ * This way we don't need racey decisions about who is supposed ++ * to unlock it. ++ */ ++ if (locked_page) { ++ async_chunk[i].locked_page = locked_page; ++ locked_page = NULL; ++ } else { ++ async_chunk[i].locked_page = NULL; ++ } ++ ++ btrfs_init_work(&async_chunk[i].work, async_cow_start, ++ async_cow_submit, async_cow_free); + + nr_pages = DIV_ROUND_UP(cur_end - start, PAGE_SIZE); + atomic_add(nr_pages, &fs_info->async_delalloc_pages); +@@ -1439,10 +1454,10 @@ next_slot: + disk_num_bytes = + btrfs_file_extent_disk_num_bytes(leaf, fi); + /* +- * If extent we got ends before our range starts, skip +- * to next extent ++ * If the extent we got ends before our current offset, ++ * skip to the next extent. + */ +- if (extent_end <= start) { ++ if (extent_end <= cur_offset) { + path->slots[0]++; + goto next_slot; + } +@@ -2264,8 +2279,7 @@ int btrfs_writepage_cow_fixup(struct page *page, u64 start, u64 end) + + SetPageChecked(page); + get_page(page); +- btrfs_init_work(&fixup->work, btrfs_fixup_helper, +- btrfs_writepage_fixup_worker, NULL, NULL); ++ btrfs_init_work(&fixup->work, btrfs_writepage_fixup_worker, NULL, NULL); + fixup->page = page; + btrfs_queue_work(fs_info->fixup_workers, &fixup->work); + return -EBUSY; +@@ -3258,7 +3272,6 @@ void btrfs_writepage_endio_finish_ordered(struct page *page, u64 start, + struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_ordered_extent *ordered_extent = NULL; + struct btrfs_workqueue *wq; +- btrfs_work_func_t func; + + trace_btrfs_writepage_end_io_hook(page, start, end, uptodate); + +@@ -3267,16 +3280,12 @@ void btrfs_writepage_endio_finish_ordered(struct page *page, u64 start, + end - start + 1, uptodate)) + return; + +- if (btrfs_is_free_space_inode(BTRFS_I(inode))) { ++ if (btrfs_is_free_space_inode(BTRFS_I(inode))) + wq = fs_info->endio_freespace_worker; +- func = btrfs_freespace_write_helper; +- } else { ++ else + wq = fs_info->endio_write_workers; +- func = btrfs_endio_write_helper; +- } + +- btrfs_init_work(&ordered_extent->work, func, finish_ordered_fn, NULL, +- NULL); ++ btrfs_init_work(&ordered_extent->work, finish_ordered_fn, NULL, NULL); + btrfs_queue_work(wq, &ordered_extent->work); + } + +@@ -8213,18 +8222,14 @@ static void __endio_write_update_ordered(struct inode *inode, + struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_ordered_extent *ordered = NULL; + struct btrfs_workqueue *wq; +- btrfs_work_func_t func; + u64 ordered_offset = offset; + u64 ordered_bytes = bytes; + u64 last_offset; + +- if (btrfs_is_free_space_inode(BTRFS_I(inode))) { ++ if (btrfs_is_free_space_inode(BTRFS_I(inode))) + wq = fs_info->endio_freespace_worker; +- func = btrfs_freespace_write_helper; +- } else { ++ else + wq = fs_info->endio_write_workers; +- func = btrfs_endio_write_helper; +- } + + while (ordered_offset < offset + bytes) { + last_offset = ordered_offset; +@@ -8232,9 +8237,8 @@ static void __endio_write_update_ordered(struct inode *inode, + &ordered_offset, + ordered_bytes, + uptodate)) { +- btrfs_init_work(&ordered->work, func, +- finish_ordered_fn, +- NULL, NULL); ++ btrfs_init_work(&ordered->work, finish_ordered_fn, NULL, ++ NULL); + btrfs_queue_work(wq, &ordered->work); + } + /* +@@ -10119,8 +10123,7 @@ static struct btrfs_delalloc_work *btrfs_alloc_delalloc_work(struct inode *inode + init_completion(&work->completion); + INIT_LIST_HEAD(&work->list); + work->inode = inode; +- btrfs_init_work(&work->work, btrfs_flush_delalloc_helper, +- btrfs_run_delalloc_work, NULL, NULL); ++ btrfs_init_work(&work->work, btrfs_run_delalloc_work, NULL, NULL); + + return work; + } +diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c +index 24b6c72b9a59..6240a5a1f2c0 100644 +--- a/fs/btrfs/ordered-data.c ++++ b/fs/btrfs/ordered-data.c +@@ -547,7 +547,6 @@ u64 btrfs_wait_ordered_extents(struct btrfs_root *root, u64 nr, + spin_unlock(&root->ordered_extent_lock); + + btrfs_init_work(&ordered->flush_work, +- btrfs_flush_delalloc_helper, + btrfs_run_ordered_extent_work, NULL, NULL); + list_add_tail(&ordered->work_list, &works); + btrfs_queue_work(fs_info->flush_workers, &ordered->flush_work); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 3ad151655eb8..27a903aaf43b 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3280,7 +3280,6 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, + memset(&fs_info->qgroup_rescan_work, 0, + sizeof(fs_info->qgroup_rescan_work)); + btrfs_init_work(&fs_info->qgroup_rescan_work, +- btrfs_qgroup_rescan_helper, + btrfs_qgroup_rescan_worker, NULL, NULL); + return 0; + } +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index 57a2ac721985..8f47a85944eb 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -190,7 +190,7 @@ static void scrub_parity_work(struct btrfs_work *work); + + static void start_async_work(struct btrfs_raid_bio *rbio, btrfs_func_t work_func) + { +- btrfs_init_work(&rbio->work, btrfs_rmw_helper, work_func, NULL, NULL); ++ btrfs_init_work(&rbio->work, work_func, NULL, NULL); + btrfs_queue_work(rbio->fs_info->rmw_workers, &rbio->work); + } + +@@ -1743,8 +1743,7 @@ static void btrfs_raid_unplug(struct blk_plug_cb *cb, bool from_schedule) + plug = container_of(cb, struct btrfs_plug_cb, cb); + + if (from_schedule) { +- btrfs_init_work(&plug->work, btrfs_rmw_helper, +- unplug_work, NULL, NULL); ++ btrfs_init_work(&plug->work, unplug_work, NULL, NULL); + btrfs_queue_work(plug->info->rmw_workers, + &plug->work); + return; +diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c +index dd4f9c2b7107..1feaeadc8cf5 100644 +--- a/fs/btrfs/reada.c ++++ b/fs/btrfs/reada.c +@@ -819,8 +819,7 @@ static void reada_start_machine(struct btrfs_fs_info *fs_info) + /* FIXME we cannot handle this properly right now */ + BUG(); + } +- btrfs_init_work(&rmw->work, btrfs_readahead_helper, +- reada_start_machine_worker, NULL, NULL); ++ btrfs_init_work(&rmw->work, reada_start_machine_worker, NULL, NULL); + rmw->fs_info = fs_info; + + btrfs_queue_work(fs_info->readahead_workers, &rmw->work); +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index a0770a6aee00..a7b043fd7a57 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -598,8 +598,8 @@ static noinline_for_stack struct scrub_ctx *scrub_setup_ctx( + sbio->index = i; + sbio->sctx = sctx; + sbio->page_count = 0; +- btrfs_init_work(&sbio->work, btrfs_scrub_helper, +- scrub_bio_end_io_worker, NULL, NULL); ++ btrfs_init_work(&sbio->work, scrub_bio_end_io_worker, NULL, ++ NULL); + + if (i != SCRUB_BIOS_PER_SCTX - 1) + sctx->bios[i]->next_free = i + 1; +@@ -1720,8 +1720,7 @@ static void scrub_wr_bio_end_io(struct bio *bio) + sbio->status = bio->bi_status; + sbio->bio = bio; + +- btrfs_init_work(&sbio->work, btrfs_scrubwrc_helper, +- scrub_wr_bio_end_io_worker, NULL, NULL); ++ btrfs_init_work(&sbio->work, scrub_wr_bio_end_io_worker, NULL, NULL); + btrfs_queue_work(fs_info->scrub_wr_completion_workers, &sbio->work); + } + +@@ -2203,8 +2202,7 @@ static void scrub_missing_raid56_pages(struct scrub_block *sblock) + raid56_add_scrub_pages(rbio, spage->page, spage->logical); + } + +- btrfs_init_work(&sblock->work, btrfs_scrub_helper, +- scrub_missing_raid56_worker, NULL, NULL); ++ btrfs_init_work(&sblock->work, scrub_missing_raid56_worker, NULL, NULL); + scrub_block_get(sblock); + scrub_pending_bio_inc(sctx); + raid56_submit_missing_rbio(rbio); +@@ -2742,8 +2740,8 @@ static void scrub_parity_bio_endio(struct bio *bio) + + bio_put(bio); + +- btrfs_init_work(&sparity->work, btrfs_scrubparity_helper, +- scrub_parity_bio_endio_worker, NULL, NULL); ++ btrfs_init_work(&sparity->work, scrub_parity_bio_endio_worker, NULL, ++ NULL); + btrfs_queue_work(fs_info->scrub_parity_workers, &sparity->work); + } + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index e04409f85063..d8d7b1ee83ca 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -6676,8 +6676,7 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info, + else + generate_random_uuid(dev->uuid); + +- btrfs_init_work(&dev->work, btrfs_submit_helper, +- pending_bios_fn, NULL, NULL); ++ btrfs_init_work(&dev->work, pending_bios_fn, NULL, NULL); + + return dev; + } +diff --git a/fs/buffer.c b/fs/buffer.c +index 86a38b979323..7744488f7bde 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -2994,8 +2994,6 @@ static void end_bio_bh_io_sync(struct bio *bio) + void guard_bio_eod(int op, struct bio *bio) + { + sector_t maxsector; +- struct bio_vec *bvec = bio_last_bvec_all(bio); +- unsigned truncated_bytes; + struct hd_struct *part; + + rcu_read_lock(); +@@ -3021,28 +3019,7 @@ void guard_bio_eod(int op, struct bio *bio) + if (likely((bio->bi_iter.bi_size >> 9) <= maxsector)) + return; + +- /* Uhhuh. We've got a bio that straddles the device size! */ +- truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9); +- +- /* +- * The bio contains more than one segment which spans EOD, just return +- * and let IO layer turn it into an EIO +- */ +- if (truncated_bytes > bvec->bv_len) +- return; +- +- /* Truncate the bio.. */ +- bio->bi_iter.bi_size -= truncated_bytes; +- bvec->bv_len -= truncated_bytes; +- +- /* ..and clear the end of the buffer for reads */ +- if (op == REQ_OP_READ) { +- struct bio_vec bv; +- +- mp_bvec_last_segment(bvec, &bv); +- zero_user(bv.bv_page, bv.bv_offset + bv.bv_len, +- truncated_bytes); +- } ++ bio_truncate(bio, maxsector << 9); + } + + static int submit_bh_wbc(int op, int op_flags, struct buffer_head *bh, +diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c +index 1692c0c6c23a..2faa05860a48 100644 +--- a/fs/cifs/dfs_cache.c ++++ b/fs/cifs/dfs_cache.c +@@ -1317,7 +1317,6 @@ static struct cifs_ses *find_root_ses(struct dfs_cache_vol_info *vi, + int rc; + struct dfs_info3_param ref = {0}; + char *mdata = NULL, *devname = NULL; +- bool is_smb3 = tcon->ses->server->vals->header_preamble_size == 0; + struct TCP_Server_Info *server; + struct cifs_ses *ses; + struct smb_vol vol; +@@ -1344,7 +1343,7 @@ static struct cifs_ses *find_root_ses(struct dfs_cache_vol_info *vi, + goto out; + } + +- rc = cifs_setup_volume_info(&vol, mdata, devname, is_smb3); ++ rc = cifs_setup_volume_info(&vol, mdata, devname, false); + kfree(devname); + + if (rc) { +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index df9377828e2f..ed59e4a8db59 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -163,7 +163,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr) + + spin_lock(&inode->i_lock); + /* we do not want atime to be less than mtime, it broke some apps */ +- if (timespec64_compare(&fattr->cf_atime, &fattr->cf_mtime)) ++ if (timespec64_compare(&fattr->cf_atime, &fattr->cf_mtime) < 0) + inode->i_atime = fattr->cf_mtime; + else + inode->i_atime = fattr->cf_atime; +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index c985caa2d955..e1d8cec6ba2e 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -252,7 +252,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) + if (tcon == NULL) + return 0; + +- if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL) ++ if (smb2_command == SMB2_TREE_CONNECT) + return 0; + + if (tcon->tidStatus == CifsExiting) { +@@ -426,16 +426,9 @@ fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, void *buf, + * SMB information in the SMB header. If the return code is zero, this + * function must have filled in request_buf pointer. + */ +-static int +-smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, +- void **request_buf, unsigned int *total_len) ++static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, ++ void **request_buf, unsigned int *total_len) + { +- int rc; +- +- rc = smb2_reconnect(smb2_command, tcon); +- if (rc) +- return rc; +- + /* BB eventually switch this to SMB2 specific small buf size */ + if (smb2_command == SMB2_SET_INFO) + *request_buf = cifs_buf_get(); +@@ -456,7 +449,31 @@ smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, + cifs_stats_inc(&tcon->num_smbs_sent); + } + +- return rc; ++ return 0; ++} ++ ++static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, ++ void **request_buf, unsigned int *total_len) ++{ ++ int rc; ++ ++ rc = smb2_reconnect(smb2_command, tcon); ++ if (rc) ++ return rc; ++ ++ return __smb2_plain_req_init(smb2_command, tcon, request_buf, ++ total_len); ++} ++ ++static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, ++ void **request_buf, unsigned int *total_len) ++{ ++ /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ ++ if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { ++ return __smb2_plain_req_init(SMB2_IOCTL, tcon, request_buf, ++ total_len); ++ } ++ return smb2_plain_req_init(SMB2_IOCTL, tcon, request_buf, total_len); + } + + /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ +@@ -2661,7 +2678,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst, + int rc; + char *in_data_buf; + +- rc = smb2_plain_req_init(SMB2_IOCTL, tcon, (void **) &req, &total_len); ++ rc = smb2_ioctl_req_init(opcode, tcon, (void **) &req, &total_len); + if (rc) + return rc; + +diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c +index a7ec2d3dff92..e0226b2138d6 100644 +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -1032,10 +1032,11 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, + #endif + + case FICLONE: ++ goto do_ioctl; + case FICLONERANGE: + case FIDEDUPERANGE: + case FS_IOC_FIEMAP: +- goto do_ioctl; ++ goto found_handler; + + case FIBMAP: + case FIGETBSZ: +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 74e786578c77..a60c6315a348 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -239,7 +239,7 @@ struct io_ring_ctx { + + struct user_struct *user; + +- struct cred *creds; ++ const struct cred *creds; + + struct completion ctx_done; + +@@ -3876,7 +3876,7 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p) + ctx->account_mem = account_mem; + ctx->user = user; + +- ctx->creds = prepare_creds(); ++ ctx->creds = get_current_cred(); + if (!ctx->creds) { + ret = -ENOMEM; + goto err; +diff --git a/fs/locks.c b/fs/locks.c +index 6970f55daf54..44b6da032842 100644 +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -2853,7 +2853,7 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl, + } + if (inode) { + /* userspace relies on this representation of dev_t */ +- seq_printf(f, "%d %02x:%02x:%ld ", fl_pid, ++ seq_printf(f, "%d %02x:%02x:%lu ", fl_pid, + MAJOR(inode->i_sb->s_dev), + MINOR(inode->i_sb->s_dev), inode->i_ino); + } else { +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index c65aeaa812d4..08f6eb2b73f8 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3548,12 +3548,17 @@ static bool replay_matches_cache(struct svc_rqst *rqstp, + (bool)seq->cachethis) + return false; + /* +- * If there's an error than the reply can have fewer ops than +- * the call. But if we cached a reply with *more* ops than the +- * call you're sending us now, then this new call is clearly not +- * really a replay of the old one: ++ * If there's an error then the reply can have fewer ops than ++ * the call. + */ +- if (slot->sl_opcnt < argp->opcnt) ++ if (slot->sl_opcnt < argp->opcnt && !slot->sl_status) ++ return false; ++ /* ++ * But if we cached a reply with *more* ops than the call you're ++ * sending us now, then this new call is clearly not really a ++ * replay of the old one: ++ */ ++ if (slot->sl_opcnt > argp->opcnt) + return false; + /* This is the only check explicitly called by spec: */ + if (!same_creds(&rqstp->rq_cred, &slot->sl_cred)) +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c +index 6e774c5ea13b..8a2e284ccfcd 100644 +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -3282,6 +3282,7 @@ static void ocfs2_dlm_init_debug(struct ocfs2_super *osb) + + debugfs_create_u32("locking_filter", 0600, osb->osb_debug_root, + &dlm_debug->d_filter_secs); ++ ocfs2_get_dlm_debug(dlm_debug); + } + + static void ocfs2_dlm_shutdown_debug(struct ocfs2_super *osb) +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index 8caff834f002..487ee39b438a 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -407,6 +407,17 @@ static int notrace ramoops_pstore_write(struct pstore_record *record) + + prz = cxt->dprzs[cxt->dump_write_cnt]; + ++ /* ++ * Since this is a new crash dump, we need to reset the buffer in ++ * case it still has an old dump present. Without this, the new dump ++ * will get appended, which would seriously confuse anything trying ++ * to check dump file contents. Specifically, ramoops_read_kmsg_hdr() ++ * expects to find a dump header in the beginning of buffer data, so ++ * we must to reset the buffer values, in order to ensure that the ++ * header will be written to the beginning of the buffer. ++ */ ++ persistent_ram_zap(prz); ++ + /* Build header and append record contents. */ + hlen = ramoops_write_kmsg_hdr(prz, record); + if (!hlen) +@@ -577,6 +588,7 @@ static int ramoops_init_przs(const char *name, + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, record_size, + (unsigned long long)*paddr, err); ++ kfree(label); + + while (i > 0) { + i--; +@@ -622,6 +634,7 @@ static int ramoops_init_prz(const char *name, + + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, sz, (unsigned long long)*paddr, err); ++ kfree(label); + return err; + } + +diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c +index a384a0f9ff32..234be1c4dc87 100644 +--- a/fs/ubifs/tnc_commit.c ++++ b/fs/ubifs/tnc_commit.c +@@ -212,7 +212,7 @@ static int is_idx_node_in_use(struct ubifs_info *c, union ubifs_key *key, + /** + * layout_leb_in_gaps - layout index nodes using in-the-gaps method. + * @c: UBIFS file-system description object +- * @p: return LEB number here ++ * @p: return LEB number in @c->gap_lebs[p] + * + * This function lays out new index nodes for dirty znodes using in-the-gaps + * method of TNC commit. +@@ -221,7 +221,7 @@ static int is_idx_node_in_use(struct ubifs_info *c, union ubifs_key *key, + * This function returns the number of index nodes written into the gaps, or a + * negative error code on failure. + */ +-static int layout_leb_in_gaps(struct ubifs_info *c, int *p) ++static int layout_leb_in_gaps(struct ubifs_info *c, int p) + { + struct ubifs_scan_leb *sleb; + struct ubifs_scan_node *snod; +@@ -236,7 +236,7 @@ static int layout_leb_in_gaps(struct ubifs_info *c, int *p) + * filled, however we do not check there at present. + */ + return lnum; /* Error code */ +- *p = lnum; ++ c->gap_lebs[p] = lnum; + dbg_gc("LEB %d", lnum); + /* + * Scan the index LEB. We use the generic scan for this even though +@@ -355,7 +355,7 @@ static int get_leb_cnt(struct ubifs_info *c, int cnt) + */ + static int layout_in_gaps(struct ubifs_info *c, int cnt) + { +- int err, leb_needed_cnt, written, *p; ++ int err, leb_needed_cnt, written, p = 0, old_idx_lebs, *gap_lebs; + + dbg_gc("%d znodes to write", cnt); + +@@ -364,9 +364,9 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt) + if (!c->gap_lebs) + return -ENOMEM; + +- p = c->gap_lebs; ++ old_idx_lebs = c->lst.idx_lebs; + do { +- ubifs_assert(c, p < c->gap_lebs + c->lst.idx_lebs); ++ ubifs_assert(c, p < c->lst.idx_lebs); + written = layout_leb_in_gaps(c, p); + if (written < 0) { + err = written; +@@ -392,9 +392,29 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt) + leb_needed_cnt = get_leb_cnt(c, cnt); + dbg_gc("%d znodes remaining, need %d LEBs, have %d", cnt, + leb_needed_cnt, c->ileb_cnt); ++ /* ++ * Dynamically change the size of @c->gap_lebs to prevent ++ * oob, because @c->lst.idx_lebs could be increased by ++ * function @get_idx_gc_leb (called by layout_leb_in_gaps-> ++ * ubifs_find_dirty_idx_leb) during loop. Only enlarge ++ * @c->gap_lebs when needed. ++ * ++ */ ++ if (leb_needed_cnt > c->ileb_cnt && p >= old_idx_lebs && ++ old_idx_lebs < c->lst.idx_lebs) { ++ old_idx_lebs = c->lst.idx_lebs; ++ gap_lebs = krealloc(c->gap_lebs, sizeof(int) * ++ (old_idx_lebs + 1), GFP_NOFS); ++ if (!gap_lebs) { ++ kfree(c->gap_lebs); ++ c->gap_lebs = NULL; ++ return -ENOMEM; ++ } ++ c->gap_lebs = gap_lebs; ++ } + } while (leb_needed_cnt > c->ileb_cnt); + +- *p = -1; ++ c->gap_lebs[p] = -1; + return 0; + } + +diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c +index 02469d59c787..3f76da11197c 100644 +--- a/fs/xfs/libxfs/xfs_bmap.c ++++ b/fs/xfs/libxfs/xfs_bmap.c +@@ -5300,7 +5300,7 @@ __xfs_bunmapi( + * Make sure we don't touch multiple AGF headers out of order + * in a single transaction, as that could cause AB-BA deadlocks. + */ +- if (!wasdel) { ++ if (!wasdel && !isrt) { + agno = XFS_FSB_TO_AGNO(mp, del.br_startblock); + if (prev_agno != NULLAGNUMBER && prev_agno > agno) + break; +diff --git a/fs/xfs/scrub/common.h b/fs/xfs/scrub/common.h +index 003a772cd26c..2e50d146105d 100644 +--- a/fs/xfs/scrub/common.h ++++ b/fs/xfs/scrub/common.h +@@ -14,8 +14,15 @@ + static inline bool + xchk_should_terminate( + struct xfs_scrub *sc, +- int *error) ++ int *error) + { ++ /* ++ * If preemption is disabled, we need to yield to the scheduler every ++ * few seconds so that we don't run afoul of the soft lockup watchdog ++ * or RCU stall detector. ++ */ ++ cond_resched(); ++ + if (fatal_signal_pending(current)) { + if (*error == 0) + *error = -EAGAIN; +diff --git a/include/linux/ahci_platform.h b/include/linux/ahci_platform.h +index 6782f0d45ebe..49e5383d4222 100644 +--- a/include/linux/ahci_platform.h ++++ b/include/linux/ahci_platform.h +@@ -19,6 +19,8 @@ struct ahci_host_priv; + struct platform_device; + struct scsi_host_template; + ++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv); ++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv); + int ahci_platform_enable_clks(struct ahci_host_priv *hpriv); + void ahci_platform_disable_clks(struct ahci_host_priv *hpriv); + int ahci_platform_enable_regulators(struct ahci_host_priv *hpriv); +diff --git a/include/linux/bio.h b/include/linux/bio.h +index 3cdb84cdc488..853d92ceee64 100644 +--- a/include/linux/bio.h ++++ b/include/linux/bio.h +@@ -470,6 +470,7 @@ extern struct bio *bio_copy_user_iov(struct request_queue *, + gfp_t); + extern int bio_uncopy_user(struct bio *); + void zero_fill_bio_iter(struct bio *bio, struct bvec_iter iter); ++void bio_truncate(struct bio *bio, unsigned new_size); + + static inline void zero_fill_bio(struct bio *bio) + { +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index 8fcdee1c0cf9..dad4a68fa009 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -1364,8 +1364,11 @@ static inline int dma_get_slave_caps(struct dma_chan *chan, + static inline int dmaengine_desc_set_reuse(struct dma_async_tx_descriptor *tx) + { + struct dma_slave_caps caps; ++ int ret; + +- dma_get_slave_caps(tx->chan, &caps); ++ ret = dma_get_slave_caps(tx->chan, &caps); ++ if (ret) ++ return ret; + + if (caps.descriptor_reuse) { + tx->flags |= DMA_CTRL_REUSE; +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 207e7ee764ce..fa0c3dae2094 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -1174,6 +1174,7 @@ extern unsigned int ata_do_dev_read_id(struct ata_device *dev, + struct ata_taskfile *tf, u16 *id); + extern void ata_qc_complete(struct ata_queued_cmd *qc); + extern int ata_qc_complete_multiple(struct ata_port *ap, u64 qc_active); ++extern u64 ata_qc_get_active(struct ata_port *ap); + extern void ata_scsi_simulate(struct ata_device *dev, struct scsi_cmnd *cmd); + extern int ata_std_bios_param(struct scsi_device *sdev, + struct block_device *bdev, +diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h +index f46ea71b4ffd..451efd4499cc 100644 +--- a/include/linux/memory_hotplug.h ++++ b/include/linux/memory_hotplug.h +@@ -125,8 +125,8 @@ static inline bool movable_node_is_enabled(void) + + extern void arch_remove_memory(int nid, u64 start, u64 size, + struct vmem_altmap *altmap); +-extern void __remove_pages(struct zone *zone, unsigned long start_pfn, +- unsigned long nr_pages, struct vmem_altmap *altmap); ++extern void __remove_pages(unsigned long start_pfn, unsigned long nr_pages, ++ struct vmem_altmap *altmap); + + /* reasonably generic interface to expand the physical pages */ + extern int __add_pages(int nid, unsigned long start_pfn, unsigned long nr_pages, +@@ -345,6 +345,9 @@ extern int add_memory(int nid, u64 start, u64 size); + extern int add_memory_resource(int nid, struct resource *resource); + extern void move_pfn_range_to_zone(struct zone *zone, unsigned long start_pfn, + unsigned long nr_pages, struct vmem_altmap *altmap); ++extern void remove_pfn_range_from_zone(struct zone *zone, ++ unsigned long start_pfn, ++ unsigned long nr_pages); + extern bool is_memblock_offlined(struct memory_block *mem); + extern int sparse_add_section(int nid, unsigned long pfn, + unsigned long nr_pages, struct vmem_altmap *altmap); +diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h +index 10f81629b9ce..6d0d70f3219c 100644 +--- a/include/linux/nvme-fc-driver.h ++++ b/include/linux/nvme-fc-driver.h +@@ -270,6 +270,8 @@ struct nvme_fc_remote_port { + * + * Host/Initiator Transport Entrypoints/Parameters: + * ++ * @module: The LLDD module using the interface ++ * + * @localport_delete: The LLDD initiates deletion of a localport via + * nvme_fc_deregister_localport(). However, the teardown is + * asynchronous. This routine is called upon the completion of the +@@ -383,6 +385,8 @@ struct nvme_fc_remote_port { + * Value is Mandatory. Allowed to be zero. + */ + struct nvme_fc_port_template { ++ struct module *module; ++ + /* initiator-based functions */ + void (*localport_delete)(struct nvme_fc_local_port *); + void (*remoteport_delete)(struct nvme_fc_remote_port *); +diff --git a/include/linux/pci.h b/include/linux/pci.h +index f9088c89a534..be529d311122 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -2310,9 +2310,11 @@ struct irq_domain *pci_host_bridge_acpi_msi_domain(struct pci_bus *bus); + + void + pci_msi_register_fwnode_provider(struct fwnode_handle *(*fn)(struct device *)); ++bool pci_pr3_present(struct pci_dev *pdev); + #else + static inline struct irq_domain * + pci_host_bridge_acpi_msi_domain(struct pci_bus *bus) { return NULL; } ++static inline bool pci_pr3_present(struct pci_dev *pdev) { return false; } + #endif + + #ifdef CONFIG_EEH +diff --git a/include/linux/regulator/ab8500.h b/include/linux/regulator/ab8500.h +index 7cf8f797e13a..505e94a6e3e8 100644 +--- a/include/linux/regulator/ab8500.h ++++ b/include/linux/regulator/ab8500.h +@@ -37,7 +37,6 @@ enum ab8505_regulator_id { + AB8505_LDO_AUX6, + AB8505_LDO_INTCORE, + AB8505_LDO_ADC, +- AB8505_LDO_USB, + AB8505_LDO_AUDIO, + AB8505_LDO_ANAMIC1, + AB8505_LDO_ANAMIC2, +diff --git a/include/net/neighbour.h b/include/net/neighbour.h +index 5e679c8dae0b..8ec77bfdc1a4 100644 +--- a/include/net/neighbour.h ++++ b/include/net/neighbour.h +@@ -467,7 +467,7 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb + + do { + seq = read_seqbegin(&hh->hh_lock); +- hh_len = hh->hh_len; ++ hh_len = READ_ONCE(hh->hh_len); + if (likely(hh_len <= HH_DATA_MOD)) { + hh_alen = HH_DATA_MOD; + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 47e61956168d..32e418dba133 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -149,8 +149,8 @@ static inline bool qdisc_is_percpu_stats(const struct Qdisc *q) + static inline bool qdisc_is_empty(const struct Qdisc *qdisc) + { + if (qdisc_is_percpu_stats(qdisc)) +- return qdisc->empty; +- return !qdisc->q.qlen; ++ return READ_ONCE(qdisc->empty); ++ return !READ_ONCE(qdisc->q.qlen); + } + + static inline bool qdisc_run_begin(struct Qdisc *qdisc) +@@ -158,7 +158,7 @@ static inline bool qdisc_run_begin(struct Qdisc *qdisc) + if (qdisc->flags & TCQ_F_NOLOCK) { + if (!spin_trylock(&qdisc->seqlock)) + return false; +- qdisc->empty = false; ++ WRITE_ONCE(qdisc->empty, false); + } else if (qdisc_is_running(qdisc)) { + return false; + } +diff --git a/include/net/sock.h b/include/net/sock.h +index e09e2886a836..6c5a3809483e 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2589,9 +2589,9 @@ static inline int sk_get_rmem0(const struct sock *sk, const struct proto *proto) + */ + static inline void sk_pacing_shift_update(struct sock *sk, int val) + { +- if (!sk || !sk_fullsock(sk) || sk->sk_pacing_shift == val) ++ if (!sk || !sk_fullsock(sk) || READ_ONCE(sk->sk_pacing_shift) == val) + return; +- sk->sk_pacing_shift = val; ++ WRITE_ONCE(sk->sk_pacing_shift, val); + } + + /* if a socket is bound to a device, check that the given device +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 9e7cee5307e0..5c51021775af 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -852,7 +852,8 @@ static const int caller_saved[CALLER_SAVED_REGS] = { + BPF_REG_0, BPF_REG_1, BPF_REG_2, BPF_REG_3, BPF_REG_4, BPF_REG_5 + }; + +-static void __mark_reg_not_init(struct bpf_reg_state *reg); ++static void __mark_reg_not_init(const struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg); + + /* Mark the unknown part of a register (variable offset or scalar value) as + * known to have the value @imm. +@@ -890,7 +891,7 @@ static void mark_reg_known_zero(struct bpf_verifier_env *env, + verbose(env, "mark_reg_known_zero(regs, %u)\n", regno); + /* Something bad happened, let's kill all regs */ + for (regno = 0; regno < MAX_BPF_REG; regno++) +- __mark_reg_not_init(regs + regno); ++ __mark_reg_not_init(env, regs + regno); + return; + } + __mark_reg_known_zero(regs + regno); +@@ -999,7 +1000,8 @@ static void __mark_reg_unbounded(struct bpf_reg_state *reg) + } + + /* Mark a register as having a completely unknown (scalar) value. */ +-static void __mark_reg_unknown(struct bpf_reg_state *reg) ++static void __mark_reg_unknown(const struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg) + { + /* + * Clear type, id, off, and union(map_ptr, range) and +@@ -1009,6 +1011,8 @@ static void __mark_reg_unknown(struct bpf_reg_state *reg) + reg->type = SCALAR_VALUE; + reg->var_off = tnum_unknown; + reg->frameno = 0; ++ reg->precise = env->subprog_cnt > 1 || !env->allow_ptr_leaks ? ++ true : false; + __mark_reg_unbounded(reg); + } + +@@ -1019,19 +1023,16 @@ static void mark_reg_unknown(struct bpf_verifier_env *env, + verbose(env, "mark_reg_unknown(regs, %u)\n", regno); + /* Something bad happened, let's kill all regs except FP */ + for (regno = 0; regno < BPF_REG_FP; regno++) +- __mark_reg_not_init(regs + regno); ++ __mark_reg_not_init(env, regs + regno); + return; + } +- regs += regno; +- __mark_reg_unknown(regs); +- /* constant backtracking is enabled for root without bpf2bpf calls */ +- regs->precise = env->subprog_cnt > 1 || !env->allow_ptr_leaks ? +- true : false; ++ __mark_reg_unknown(env, regs + regno); + } + +-static void __mark_reg_not_init(struct bpf_reg_state *reg) ++static void __mark_reg_not_init(const struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg) + { +- __mark_reg_unknown(reg); ++ __mark_reg_unknown(env, reg); + reg->type = NOT_INIT; + } + +@@ -1042,10 +1043,10 @@ static void mark_reg_not_init(struct bpf_verifier_env *env, + verbose(env, "mark_reg_not_init(regs, %u)\n", regno); + /* Something bad happened, let's kill all regs except FP */ + for (regno = 0; regno < BPF_REG_FP; regno++) +- __mark_reg_not_init(regs + regno); ++ __mark_reg_not_init(env, regs + regno); + return; + } +- __mark_reg_not_init(regs + regno); ++ __mark_reg_not_init(env, regs + regno); + } + + #define DEF_NOT_SUBREG (0) +@@ -3066,7 +3067,7 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, + } + if (state->stack[spi].slot_type[0] == STACK_SPILL && + state->stack[spi].spilled_ptr.type == SCALAR_VALUE) { +- __mark_reg_unknown(&state->stack[spi].spilled_ptr); ++ __mark_reg_unknown(env, &state->stack[spi].spilled_ptr); + for (j = 0; j < BPF_REG_SIZE; j++) + state->stack[spi].slot_type[j] = STACK_MISC; + goto mark; +@@ -3706,7 +3707,7 @@ static void __clear_all_pkt_pointers(struct bpf_verifier_env *env, + if (!reg) + continue; + if (reg_is_pkt_pointer_any(reg)) +- __mark_reg_unknown(reg); ++ __mark_reg_unknown(env, reg); + } + } + +@@ -3734,7 +3735,7 @@ static void release_reg_references(struct bpf_verifier_env *env, + if (!reg) + continue; + if (reg->ref_obj_id == ref_obj_id) +- __mark_reg_unknown(reg); ++ __mark_reg_unknown(env, reg); + } + } + +@@ -4357,7 +4358,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, + /* Taint dst register if offset had invalid bounds derived from + * e.g. dead branches. + */ +- __mark_reg_unknown(dst_reg); ++ __mark_reg_unknown(env, dst_reg); + return 0; + } + +@@ -4609,13 +4610,13 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, + /* Taint dst register if offset had invalid bounds derived from + * e.g. dead branches. + */ +- __mark_reg_unknown(dst_reg); ++ __mark_reg_unknown(env, dst_reg); + return 0; + } + + if (!src_known && + opcode != BPF_ADD && opcode != BPF_SUB && opcode != BPF_AND) { +- __mark_reg_unknown(dst_reg); ++ __mark_reg_unknown(env, dst_reg); + return 0; + } + +@@ -6746,7 +6747,7 @@ static void clean_func_state(struct bpf_verifier_env *env, + /* since the register is unused, clear its state + * to make further comparison simpler + */ +- __mark_reg_not_init(&st->regs[i]); ++ __mark_reg_not_init(env, &st->regs[i]); + } + + for (i = 0; i < st->allocated_stack / BPF_REG_SIZE; i++) { +@@ -6754,7 +6755,7 @@ static void clean_func_state(struct bpf_verifier_env *env, + /* liveness must not touch this stack slot anymore */ + st->stack[i].spilled_ptr.live |= REG_LIVE_DONE; + if (!(live & REG_LIVE_READ)) { +- __mark_reg_not_init(&st->stack[i].spilled_ptr); ++ __mark_reg_not_init(env, &st->stack[i].spilled_ptr); + for (j = 0; j < BPF_REG_SIZE; j++) + st->stack[i].slot_type[j] = STACK_INVALID; + } +diff --git a/kernel/cred.c b/kernel/cred.c +index c0a4c12d38b2..9ed51b70ed80 100644 +--- a/kernel/cred.c ++++ b/kernel/cred.c +@@ -223,7 +223,7 @@ struct cred *cred_alloc_blank(void) + new->magic = CRED_MAGIC; + #endif + +- if (security_cred_alloc_blank(new, GFP_KERNEL) < 0) ++ if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0) + goto error; + + return new; +@@ -282,7 +282,7 @@ struct cred *prepare_creds(void) + new->security = NULL; + #endif + +- if (security_prepare_creds(new, old, GFP_KERNEL) < 0) ++ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) + goto error; + validate_creds(new); + return new; +@@ -715,7 +715,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon) + #ifdef CONFIG_SECURITY + new->security = NULL; + #endif +- if (security_prepare_creds(new, old, GFP_KERNEL) < 0) ++ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) + goto error; + + put_cred(old); +diff --git a/kernel/exit.c b/kernel/exit.c +index d351fd09e739..22dfaac9e48c 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -517,10 +517,6 @@ static struct task_struct *find_child_reaper(struct task_struct *father, + } + + write_unlock_irq(&tasklist_lock); +- if (unlikely(pid_ns == &init_pid_ns)) { +- panic("Attempted to kill init! exitcode=0x%08x\n", +- father->signal->group_exit_code ?: father->exit_code); +- } + + list_for_each_entry_safe(p, n, dead, ptrace_entry) { + list_del_init(&p->ptrace_entry); +@@ -766,6 +762,14 @@ void __noreturn do_exit(long code) + acct_update_integrals(tsk); + group_dead = atomic_dec_and_test(&tsk->signal->live); + if (group_dead) { ++ /* ++ * If the last thread of global init has exited, panic ++ * immediately to get a useable coredump. ++ */ ++ if (unlikely(is_global_init(tsk))) ++ panic("Attempted to kill init! exitcode=0x%08x\n", ++ tsk->signal->group_exit_code ?: (int)code); ++ + #ifdef CONFIG_POSIX_TIMERS + hrtimer_cancel(&tsk->signal->real_timer); + exit_itimers(tsk->signal); +diff --git a/kernel/module.c b/kernel/module.c +index ff2d7359a418..cb09a5f37a5f 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1033,6 +1033,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, + strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module)); + + free_module(mod); ++ /* someone could wait for the module in add_unformed_module() */ ++ wake_up_all(&module_wq); + return 0; + out: + mutex_unlock(&module_mutex); +diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c +index 83105874f255..26b9168321e7 100644 +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -734,8 +734,15 @@ zone_found: + * We have found the zone. Now walk the radix tree to find the leaf node + * for our PFN. + */ ++ ++ /* ++ * If the zone we wish to scan is the the current zone and the ++ * pfn falls into the current node then we do not need to walk ++ * the tree. ++ */ + node = bm->cur.node; +- if (((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn) ++ if (zone == bm->cur.zone && ++ ((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn) + goto node_found; + + node = zone->rtree; +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index dba52a7db5e8..614a557a0814 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -1015,6 +1015,13 @@ static long seccomp_notify_recv(struct seccomp_filter *filter, + struct seccomp_notif unotif; + ssize_t ret; + ++ /* Verify that we're not given garbage to keep struct extensible. */ ++ ret = check_zeroed_user(buf, sizeof(unotif)); ++ if (ret < 0) ++ return ret; ++ if (!ret) ++ return -EINVAL; ++ + memset(&unotif, 0, sizeof(unotif)); + + ret = down_interruptible(&filter->notif->request); +diff --git a/kernel/taskstats.c b/kernel/taskstats.c +index 13a0f2e6ebc2..e2ac0e37c4ae 100644 +--- a/kernel/taskstats.c ++++ b/kernel/taskstats.c +@@ -554,25 +554,33 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info) + static struct taskstats *taskstats_tgid_alloc(struct task_struct *tsk) + { + struct signal_struct *sig = tsk->signal; +- struct taskstats *stats; ++ struct taskstats *stats_new, *stats; + +- if (sig->stats || thread_group_empty(tsk)) +- goto ret; ++ /* Pairs with smp_store_release() below. */ ++ stats = smp_load_acquire(&sig->stats); ++ if (stats || thread_group_empty(tsk)) ++ return stats; + + /* No problem if kmem_cache_zalloc() fails */ +- stats = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL); ++ stats_new = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL); + + spin_lock_irq(&tsk->sighand->siglock); +- if (!sig->stats) { +- sig->stats = stats; +- stats = NULL; ++ stats = sig->stats; ++ if (!stats) { ++ /* ++ * Pairs with smp_store_release() above and order the ++ * kmem_cache_zalloc(). ++ */ ++ smp_store_release(&sig->stats, stats_new); ++ stats = stats_new; ++ stats_new = NULL; + } + spin_unlock_irq(&tsk->sighand->siglock); + +- if (stats) +- kmem_cache_free(taskstats_cache, stats); +-ret: +- return sig->stats; ++ if (stats_new) ++ kmem_cache_free(taskstats_cache, stats_new); ++ ++ return stats; + } + + /* Send pid data out on exit */ +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index f296d89be757..0708a41cfe2d 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -524,8 +524,7 @@ static int function_stat_show(struct seq_file *m, void *v) + } + + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +- avg = rec->time; +- do_div(avg, rec->counter); ++ avg = div64_ul(rec->time, rec->counter); + if (tracing_thresh && (avg < tracing_thresh)) + goto out; + #endif +@@ -551,7 +550,8 @@ static int function_stat_show(struct seq_file *m, void *v) + * Divide only 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide 1000 again. + */ +- do_div(stddev, rec->counter * (rec->counter - 1) * 1000); ++ stddev = div64_ul(stddev, ++ rec->counter * (rec->counter - 1) * 1000); + } + + trace_seq_init(&s); +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 2fa72419bbd7..d8bd9b1d8bce 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4590,6 +4590,10 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) + + int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) + { ++ if ((mask == TRACE_ITER_RECORD_TGID) || ++ (mask == TRACE_ITER_RECORD_CMD)) ++ lockdep_assert_held(&event_mutex); ++ + /* do nothing if flag is already set */ + if (!!(tr->trace_flags & mask) == !!enabled) + return 0; +@@ -4657,6 +4661,7 @@ static int trace_set_options(struct trace_array *tr, char *option) + + cmp += len; + ++ mutex_lock(&event_mutex); + mutex_lock(&trace_types_lock); + + ret = match_string(trace_options, -1, cmp); +@@ -4667,6 +4672,7 @@ static int trace_set_options(struct trace_array *tr, char *option) + ret = set_tracer_flag(tr, 1 << ret, !neg); + + mutex_unlock(&trace_types_lock); ++ mutex_unlock(&event_mutex); + + /* + * If the first trailing whitespace is replaced with '\0' by strstrip, +@@ -7972,9 +7978,11 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, + if (val != 0 && val != 1) + return -EINVAL; + ++ mutex_lock(&event_mutex); + mutex_lock(&trace_types_lock); + ret = set_tracer_flag(tr, 1 << index, val); + mutex_unlock(&trace_types_lock); ++ mutex_unlock(&event_mutex); + + if (ret < 0) + return ret; +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index fba87d10f0c1..995061bb2dec 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -320,7 +320,8 @@ void trace_event_enable_cmd_record(bool enable) + struct trace_event_file *file; + struct trace_array *tr; + +- mutex_lock(&event_mutex); ++ lockdep_assert_held(&event_mutex); ++ + do_for_each_event_file(tr, file) { + + if (!(file->flags & EVENT_FILE_FL_ENABLED)) +@@ -334,7 +335,6 @@ void trace_event_enable_cmd_record(bool enable) + clear_bit(EVENT_FILE_FL_RECORDED_CMD_BIT, &file->flags); + } + } while_for_each_event_file(); +- mutex_unlock(&event_mutex); + } + + void trace_event_enable_tgid_record(bool enable) +@@ -342,7 +342,8 @@ void trace_event_enable_tgid_record(bool enable) + struct trace_event_file *file; + struct trace_array *tr; + +- mutex_lock(&event_mutex); ++ lockdep_assert_held(&event_mutex); ++ + do_for_each_event_file(tr, file) { + if (!(file->flags & EVENT_FILE_FL_ENABLED)) + continue; +@@ -356,7 +357,6 @@ void trace_event_enable_tgid_record(bool enable) + &file->flags); + } + } while_for_each_event_file(); +- mutex_unlock(&event_mutex); + } + + static int __ftrace_event_enable_disable(struct trace_event_file *file, +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index c9a74f82b14a..bf44f6bbd0c3 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1662,7 +1662,7 @@ static int process_system_preds(struct trace_subsystem_dir *dir, + parse_error(pe, FILT_ERR_BAD_SUBSYS_FILTER, 0); + return -EINVAL; + fail_mem: +- kfree(filter); ++ __free_filter(filter); + /* If any call succeeded, we still need to sync */ + if (!fail) + tracepoint_synchronize_unregister(); +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 7482a1466ebf..c2783915600c 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -911,7 +911,26 @@ static notrace void trace_event_raw_event_synth(void *__data, + strscpy(str_field, str_val, STR_VAR_LEN_MAX); + n_u64 += STR_VAR_LEN_MAX / sizeof(u64); + } else { +- entry->fields[n_u64] = var_ref_vals[var_ref_idx + i]; ++ struct synth_field *field = event->fields[i]; ++ u64 val = var_ref_vals[var_ref_idx + i]; ++ ++ switch (field->size) { ++ case 1: ++ *(u8 *)&entry->fields[n_u64] = (u8)val; ++ break; ++ ++ case 2: ++ *(u16 *)&entry->fields[n_u64] = (u16)val; ++ break; ++ ++ case 4: ++ *(u32 *)&entry->fields[n_u64] = (u32)val; ++ break; ++ ++ default: ++ entry->fields[n_u64] = val; ++ break; ++ } + n_u64++; + } + } +diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c +index 9a1c22310323..9e31bfc818ff 100644 +--- a/kernel/trace/tracing_map.c ++++ b/kernel/trace/tracing_map.c +@@ -148,8 +148,8 @@ static int tracing_map_cmp_atomic64(void *val_a, void *val_b) + #define DEFINE_TRACING_MAP_CMP_FN(type) \ + static int tracing_map_cmp_##type(void *val_a, void *val_b) \ + { \ +- type a = *(type *)val_a; \ +- type b = *(type *)val_b; \ ++ type a = (type)(*(u64 *)val_a); \ ++ type b = (type)(*(u64 *)val_b); \ + \ + return (a > b) ? 1 : ((a < b) ? -1 : 0); \ + } +diff --git a/lib/ubsan.c b/lib/ubsan.c +index 0c4681118fcd..f007a406f89c 100644 +--- a/lib/ubsan.c ++++ b/lib/ubsan.c +@@ -140,25 +140,21 @@ static void val_to_string(char *str, size_t size, struct type_descriptor *type, + } + } + +-static DEFINE_SPINLOCK(report_lock); +- +-static void ubsan_prologue(struct source_location *location, +- unsigned long *flags) ++static void ubsan_prologue(struct source_location *location) + { + current->in_ubsan++; +- spin_lock_irqsave(&report_lock, *flags); + + pr_err("========================================" + "========================================\n"); + print_source_location("UBSAN: Undefined behaviour in", location); + } + +-static void ubsan_epilogue(unsigned long *flags) ++static void ubsan_epilogue(void) + { + dump_stack(); + pr_err("========================================" + "========================================\n"); +- spin_unlock_irqrestore(&report_lock, *flags); ++ + current->in_ubsan--; + } + +@@ -167,14 +163,13 @@ static void handle_overflow(struct overflow_data *data, void *lhs, + { + + struct type_descriptor *type = data->type; +- unsigned long flags; + char lhs_val_str[VALUE_LENGTH]; + char rhs_val_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs); + val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs); +@@ -186,7 +181,7 @@ static void handle_overflow(struct overflow_data *data, void *lhs, + rhs_val_str, + type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + + void __ubsan_handle_add_overflow(struct overflow_data *data, +@@ -214,20 +209,19 @@ EXPORT_SYMBOL(__ubsan_handle_mul_overflow); + void __ubsan_handle_negate_overflow(struct overflow_data *data, + void *old_val) + { +- unsigned long flags; + char old_val_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val); + + pr_err("negation of %s cannot be represented in type %s:\n", + old_val_str, data->type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + EXPORT_SYMBOL(__ubsan_handle_negate_overflow); + +@@ -235,13 +229,12 @@ EXPORT_SYMBOL(__ubsan_handle_negate_overflow); + void __ubsan_handle_divrem_overflow(struct overflow_data *data, + void *lhs, void *rhs) + { +- unsigned long flags; + char rhs_val_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs); + +@@ -251,58 +244,52 @@ void __ubsan_handle_divrem_overflow(struct overflow_data *data, + else + pr_err("division by zero\n"); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + EXPORT_SYMBOL(__ubsan_handle_divrem_overflow); + + static void handle_null_ptr_deref(struct type_mismatch_data_common *data) + { +- unsigned long flags; +- + if (suppress_report(data->location)) + return; + +- ubsan_prologue(data->location, &flags); ++ ubsan_prologue(data->location); + + pr_err("%s null pointer of type %s\n", + type_check_kinds[data->type_check_kind], + data->type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + + static void handle_misaligned_access(struct type_mismatch_data_common *data, + unsigned long ptr) + { +- unsigned long flags; +- + if (suppress_report(data->location)) + return; + +- ubsan_prologue(data->location, &flags); ++ ubsan_prologue(data->location); + + pr_err("%s misaligned address %p for type %s\n", + type_check_kinds[data->type_check_kind], + (void *)ptr, data->type->type_name); + pr_err("which requires %ld byte alignment\n", data->alignment); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + + static void handle_object_size_mismatch(struct type_mismatch_data_common *data, + unsigned long ptr) + { +- unsigned long flags; +- + if (suppress_report(data->location)) + return; + +- ubsan_prologue(data->location, &flags); ++ ubsan_prologue(data->location); + pr_err("%s address %p with insufficient space\n", + type_check_kinds[data->type_check_kind], + (void *) ptr); + pr_err("for an object of type %s\n", data->type->type_name); +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + + static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data, +@@ -351,25 +338,23 @@ EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1); + + void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) + { +- unsigned long flags; + char index_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(index_str, sizeof(index_str), data->index_type, index); + pr_err("index %s is out of range for type %s\n", index_str, + data->array_type->type_name); +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + EXPORT_SYMBOL(__ubsan_handle_out_of_bounds); + + void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + void *lhs, void *rhs) + { +- unsigned long flags; + struct type_descriptor *rhs_type = data->rhs_type; + struct type_descriptor *lhs_type = data->lhs_type; + char rhs_str[VALUE_LENGTH]; +@@ -379,7 +364,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + if (suppress_report(&data->location)) + goto out; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs); + val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs); +@@ -402,7 +387,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + lhs_str, rhs_str, + lhs_type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + out: + user_access_restore(ua_flags); + } +@@ -411,11 +396,9 @@ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); + + void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) + { +- unsigned long flags; +- +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + pr_err("calling __builtin_unreachable()\n"); +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + panic("can't return from __builtin_unreachable()"); + } + EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable); +@@ -423,19 +406,18 @@ EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable); + void __ubsan_handle_load_invalid_value(struct invalid_value_data *data, + void *val) + { +- unsigned long flags; + char val_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(val_str, sizeof(val_str), data->type, val); + + pr_err("load of value %s is not a valid value for type %s\n", + val_str, data->type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + EXPORT_SYMBOL(__ubsan_handle_load_invalid_value); +diff --git a/mm/filemap.c b/mm/filemap.c +index 85b7d087eb45..1f5731768222 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -2329,27 +2329,6 @@ EXPORT_SYMBOL(generic_file_read_iter); + + #ifdef CONFIG_MMU + #define MMAP_LOTSAMISS (100) +-static struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf, +- struct file *fpin) +-{ +- int flags = vmf->flags; +- +- if (fpin) +- return fpin; +- +- /* +- * FAULT_FLAG_RETRY_NOWAIT means we don't want to wait on page locks or +- * anything, so we only pin the file and drop the mmap_sem if only +- * FAULT_FLAG_ALLOW_RETRY is set. +- */ +- if ((flags & (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT)) == +- FAULT_FLAG_ALLOW_RETRY) { +- fpin = get_file(vmf->vma->vm_file); +- up_read(&vmf->vma->vm_mm->mmap_sem); +- } +- return fpin; +-} +- + /* + * lock_page_maybe_drop_mmap - lock the page, possibly dropping the mmap_sem + * @vmf - the vm_fault for this fault. +diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c +index 7dd602d7f8db..ad9d5b1c4473 100644 +--- a/mm/gup_benchmark.c ++++ b/mm/gup_benchmark.c +@@ -26,6 +26,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd, + unsigned long i, nr_pages, addr, next; + int nr; + struct page **pages; ++ int ret = 0; + + if (gup->size > ULONG_MAX) + return -EINVAL; +@@ -63,7 +64,9 @@ static int __gup_benchmark_ioctl(unsigned int cmd, + NULL); + break; + default: +- return -1; ++ kvfree(pages); ++ ret = -EINVAL; ++ goto out; + } + + if (nr <= 0) +@@ -85,7 +88,8 @@ static int __gup_benchmark_ioctl(unsigned int cmd, + gup->put_delta_usec = ktime_us_delta(end_time, start_time); + + kvfree(pages); +- return 0; ++out: ++ return ret; + } + + static long gup_benchmark_ioctl(struct file *filep, unsigned int cmd, +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index b45a95363a84..e0afd582ca01 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1255,7 +1256,7 @@ static inline void ClearPageHugeTemporary(struct page *page) + page[2].mapping = NULL; + } + +-void free_huge_page(struct page *page) ++static void __free_huge_page(struct page *page) + { + /* + * Can't pass hstate in here because it is called from the +@@ -1318,6 +1319,54 @@ void free_huge_page(struct page *page) + spin_unlock(&hugetlb_lock); + } + ++/* ++ * As free_huge_page() can be called from a non-task context, we have ++ * to defer the actual freeing in a workqueue to prevent potential ++ * hugetlb_lock deadlock. ++ * ++ * free_hpage_workfn() locklessly retrieves the linked list of pages to ++ * be freed and frees them one-by-one. As the page->mapping pointer is ++ * going to be cleared in __free_huge_page() anyway, it is reused as the ++ * llist_node structure of a lockless linked list of huge pages to be freed. ++ */ ++static LLIST_HEAD(hpage_freelist); ++ ++static void free_hpage_workfn(struct work_struct *work) ++{ ++ struct llist_node *node; ++ struct page *page; ++ ++ node = llist_del_all(&hpage_freelist); ++ ++ while (node) { ++ page = container_of((struct address_space **)node, ++ struct page, mapping); ++ node = node->next; ++ __free_huge_page(page); ++ } ++} ++static DECLARE_WORK(free_hpage_work, free_hpage_workfn); ++ ++void free_huge_page(struct page *page) ++{ ++ /* ++ * Defer freeing if in non-task context to avoid hugetlb_lock deadlock. ++ */ ++ if (!in_task()) { ++ /* ++ * Only call schedule_work() if hpage_freelist is previously ++ * empty. Otherwise, schedule_work() had been called but the ++ * workfn hasn't retrieved the list yet. ++ */ ++ if (llist_add((struct llist_node *)&page->mapping, ++ &hpage_freelist)) ++ schedule_work(&free_hpage_work); ++ return; ++ } ++ ++ __free_huge_page(page); ++} ++ + static void prep_new_huge_page(struct hstate *h, struct page *page, int nid) + { + INIT_LIST_HEAD(&page->lru); +diff --git a/mm/internal.h b/mm/internal.h +index 0d5f720c75ab..7dd7fbb577a9 100644 +--- a/mm/internal.h ++++ b/mm/internal.h +@@ -362,6 +362,27 @@ vma_address(struct page *page, struct vm_area_struct *vma) + return max(start, vma->vm_start); + } + ++static inline struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf, ++ struct file *fpin) ++{ ++ int flags = vmf->flags; ++ ++ if (fpin) ++ return fpin; ++ ++ /* ++ * FAULT_FLAG_RETRY_NOWAIT means we don't want to wait on page locks or ++ * anything, so we only pin the file and drop the mmap_sem if only ++ * FAULT_FLAG_ALLOW_RETRY is set. ++ */ ++ if ((flags & (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT)) == ++ FAULT_FLAG_ALLOW_RETRY) { ++ fpin = get_file(vmf->vma->vm_file); ++ up_read(&vmf->vma->vm_mm->mmap_sem); ++ } ++ return fpin; ++} ++ + #else /* !CONFIG_MMU */ + static inline void clear_page_mlock(struct page *page) { } + static inline void mlock_vma_page(struct page *page) { } +diff --git a/mm/memory.c b/mm/memory.c +index b1ca51a079f2..cb7c940cf800 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -2227,10 +2227,11 @@ static vm_fault_t do_page_mkwrite(struct vm_fault *vmf) + * + * The function expects the page to be locked and unlocks it. + */ +-static void fault_dirty_shared_page(struct vm_area_struct *vma, +- struct page *page) ++static vm_fault_t fault_dirty_shared_page(struct vm_fault *vmf) + { ++ struct vm_area_struct *vma = vmf->vma; + struct address_space *mapping; ++ struct page *page = vmf->page; + bool dirtied; + bool page_mkwrite = vma->vm_ops && vma->vm_ops->page_mkwrite; + +@@ -2245,16 +2246,30 @@ static void fault_dirty_shared_page(struct vm_area_struct *vma, + mapping = page_rmapping(page); + unlock_page(page); + ++ if (!page_mkwrite) ++ file_update_time(vma->vm_file); ++ ++ /* ++ * Throttle page dirtying rate down to writeback speed. ++ * ++ * mapping may be NULL here because some device drivers do not ++ * set page.mapping but still dirty their pages ++ * ++ * Drop the mmap_sem before waiting on IO, if we can. The file ++ * is pinning the mapping, as per above. ++ */ + if ((dirtied || page_mkwrite) && mapping) { +- /* +- * Some device drivers do not set page.mapping +- * but still dirty their pages +- */ ++ struct file *fpin; ++ ++ fpin = maybe_unlock_mmap_for_io(vmf, NULL); + balance_dirty_pages_ratelimited(mapping); ++ if (fpin) { ++ fput(fpin); ++ return VM_FAULT_RETRY; ++ } + } + +- if (!page_mkwrite) +- file_update_time(vma->vm_file); ++ return 0; + } + + /* +@@ -2497,6 +2512,7 @@ static vm_fault_t wp_page_shared(struct vm_fault *vmf) + __releases(vmf->ptl) + { + struct vm_area_struct *vma = vmf->vma; ++ vm_fault_t ret = VM_FAULT_WRITE; + + get_page(vmf->page); + +@@ -2520,10 +2536,10 @@ static vm_fault_t wp_page_shared(struct vm_fault *vmf) + wp_page_reuse(vmf); + lock_page(vmf->page); + } +- fault_dirty_shared_page(vma, vmf->page); ++ ret |= fault_dirty_shared_page(vmf); + put_page(vmf->page); + +- return VM_FAULT_WRITE; ++ return ret; + } + + /* +@@ -3567,7 +3583,7 @@ static vm_fault_t do_shared_fault(struct vm_fault *vmf) + return ret; + } + +- fault_dirty_shared_page(vma, vmf->page); ++ ret |= fault_dirty_shared_page(vmf); + return ret; + } + +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index f307bd82d750..fab540685279 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -465,8 +465,9 @@ static void update_pgdat_span(struct pglist_data *pgdat) + pgdat->node_spanned_pages = node_end_pfn - node_start_pfn; + } + +-static void __remove_zone(struct zone *zone, unsigned long start_pfn, +- unsigned long nr_pages) ++void __ref remove_pfn_range_from_zone(struct zone *zone, ++ unsigned long start_pfn, ++ unsigned long nr_pages) + { + struct pglist_data *pgdat = zone->zone_pgdat; + unsigned long flags; +@@ -481,28 +482,30 @@ static void __remove_zone(struct zone *zone, unsigned long start_pfn, + return; + #endif + ++ clear_zone_contiguous(zone); ++ + pgdat_resize_lock(zone->zone_pgdat, &flags); + shrink_zone_span(zone, start_pfn, start_pfn + nr_pages); + update_pgdat_span(pgdat); + pgdat_resize_unlock(zone->zone_pgdat, &flags); ++ ++ set_zone_contiguous(zone); + } + +-static void __remove_section(struct zone *zone, unsigned long pfn, +- unsigned long nr_pages, unsigned long map_offset, +- struct vmem_altmap *altmap) ++static void __remove_section(unsigned long pfn, unsigned long nr_pages, ++ unsigned long map_offset, ++ struct vmem_altmap *altmap) + { + struct mem_section *ms = __nr_to_section(pfn_to_section_nr(pfn)); + + if (WARN_ON_ONCE(!valid_section(ms))) + return; + +- __remove_zone(zone, pfn, nr_pages); + sparse_remove_section(ms, pfn, nr_pages, map_offset, altmap); + } + + /** +- * __remove_pages() - remove sections of pages from a zone +- * @zone: zone from which pages need to be removed ++ * __remove_pages() - remove sections of pages + * @pfn: starting pageframe (must be aligned to start of a section) + * @nr_pages: number of pages to remove (must be multiple of section size) + * @altmap: alternative device page map or %NULL if default memmap is used +@@ -512,16 +515,14 @@ static void __remove_section(struct zone *zone, unsigned long pfn, + * sure that pages are marked reserved and zones are adjust properly by + * calling offline_pages(). + */ +-void __remove_pages(struct zone *zone, unsigned long pfn, +- unsigned long nr_pages, struct vmem_altmap *altmap) ++void __remove_pages(unsigned long pfn, unsigned long nr_pages, ++ struct vmem_altmap *altmap) + { + unsigned long map_offset = 0; + unsigned long nr, start_sec, end_sec; + + map_offset = vmem_altmap_offset(altmap); + +- clear_zone_contiguous(zone); +- + if (check_pfn_span(pfn, nr_pages, "remove")) + return; + +@@ -533,13 +534,11 @@ void __remove_pages(struct zone *zone, unsigned long pfn, + cond_resched(); + pfns = min(nr_pages, PAGES_PER_SECTION + - (pfn & ~PAGE_SECTION_MASK)); +- __remove_section(zone, pfn, pfns, map_offset, altmap); ++ __remove_section(pfn, pfns, map_offset, altmap); + pfn += pfns; + nr_pages -= pfns; + map_offset = 0; + } +- +- set_zone_contiguous(zone); + } + + int set_online_page_callback(online_page_callback_t callback) +@@ -867,6 +866,7 @@ failed_addition: + (unsigned long long) pfn << PAGE_SHIFT, + (((unsigned long long) pfn + nr_pages) << PAGE_SHIFT) - 1); + memory_notify(MEM_CANCEL_ONLINE, &arg); ++ remove_pfn_range_from_zone(zone, pfn, nr_pages); + mem_hotplug_done(); + return ret; + } +@@ -1602,6 +1602,7 @@ static int __ref __offline_pages(unsigned long start_pfn, + writeback_set_ratelimit(); + + memory_notify(MEM_OFFLINE, &arg); ++ remove_pfn_range_from_zone(zone, start_pfn, nr_pages); + mem_hotplug_done(); + return 0; + +diff --git a/mm/memremap.c b/mm/memremap.c +index 03ccbdfeb697..c51c6bd2fe34 100644 +--- a/mm/memremap.c ++++ b/mm/memremap.c +@@ -120,7 +120,7 @@ void memunmap_pages(struct dev_pagemap *pgmap) + + mem_hotplug_begin(); + if (pgmap->type == MEMORY_DEVICE_PRIVATE) { +- __remove_pages(page_zone(first_page), PHYS_PFN(res->start), ++ __remove_pages(PHYS_PFN(res->start), + PHYS_PFN(resource_size(res)), NULL); + } else { + arch_remove_memory(nid, res->start, resource_size(res), +diff --git a/mm/migrate.c b/mm/migrate.c +index 4fe45d1428c8..45d3303e0022 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -1516,9 +1516,11 @@ static int do_move_pages_to_node(struct mm_struct *mm, + /* + * Resolves the given address to a struct page, isolates it from the LRU and + * puts it to the given pagelist. +- * Returns -errno if the page cannot be found/isolated or 0 when it has been +- * queued or the page doesn't need to be migrated because it is already on +- * the target node ++ * Returns: ++ * errno - if the page cannot be found/isolated ++ * 0 - when it doesn't have to be migrated because it is already on the ++ * target node ++ * 1 - when it has been queued + */ + static int add_page_for_migration(struct mm_struct *mm, unsigned long addr, + int node, struct list_head *pagelist, bool migrate_all) +@@ -1557,7 +1559,7 @@ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr, + if (PageHuge(page)) { + if (PageHead(page)) { + isolate_huge_page(page, pagelist); +- err = 0; ++ err = 1; + } + } else { + struct page *head; +@@ -1567,7 +1569,7 @@ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr, + if (err) + goto out_putpage; + +- err = 0; ++ err = 1; + list_add_tail(&head->lru, pagelist); + mod_node_page_state(page_pgdat(head), + NR_ISOLATED_ANON + page_is_file_cache(head), +@@ -1644,8 +1646,17 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes, + */ + err = add_page_for_migration(mm, addr, current_node, + &pagelist, flags & MPOL_MF_MOVE_ALL); +- if (!err) ++ ++ if (!err) { ++ /* The page is already on the target node */ ++ err = store_status(status, i, current_node, 1); ++ if (err) ++ goto out_flush; + continue; ++ } else if (err > 0) { ++ /* The page is successfully queued for migration */ ++ continue; ++ } + + err = store_status(status, i, err, 1); + if (err) +diff --git a/mm/mmap.c b/mm/mmap.c +index a7d8c84d19b7..4390dbea4aa5 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -90,12 +90,6 @@ static void unmap_region(struct mm_struct *mm, + * MAP_PRIVATE r: (no) no r: (yes) yes r: (no) yes r: (no) yes + * w: (no) no w: (no) no w: (copy) copy w: (no) no + * x: (no) no x: (no) yes x: (no) yes x: (yes) yes +- * +- * On arm64, PROT_EXEC has the following behaviour for both MAP_SHARED and +- * MAP_PRIVATE: +- * r: (no) no +- * w: (no) no +- * x: (yes) yes + */ + pgprot_t protection_map[16] __ro_after_init = { + __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111, +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index 71e3acea7817..d58c481b3df8 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -890,7 +890,7 @@ static void __oom_kill_process(struct task_struct *victim, const char *message) + K(get_mm_counter(mm, MM_FILEPAGES)), + K(get_mm_counter(mm, MM_SHMEMPAGES)), + from_kuid(&init_user_ns, task_uid(victim)), +- mm_pgtables_bytes(mm), victim->signal->oom_score_adj); ++ mm_pgtables_bytes(mm) >> 10, victim->signal->oom_score_adj); + task_unlock(victim); + + /* +diff --git a/mm/shmem.c b/mm/shmem.c +index 7a22e3e03d11..6074714fdbd4 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2022,16 +2022,14 @@ static vm_fault_t shmem_fault(struct vm_fault *vmf) + shmem_falloc->waitq && + vmf->pgoff >= shmem_falloc->start && + vmf->pgoff < shmem_falloc->next) { ++ struct file *fpin; + wait_queue_head_t *shmem_falloc_waitq; + DEFINE_WAIT_FUNC(shmem_fault_wait, synchronous_wake_function); + + ret = VM_FAULT_NOPAGE; +- if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) && +- !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) { +- /* It's polite to up mmap_sem if we can */ +- up_read(&vma->vm_mm->mmap_sem); ++ fpin = maybe_unlock_mmap_for_io(vmf, NULL); ++ if (fpin) + ret = VM_FAULT_RETRY; +- } + + shmem_falloc_waitq = shmem_falloc->waitq; + prepare_to_wait(shmem_falloc_waitq, &shmem_fault_wait, +@@ -2049,6 +2047,9 @@ static vm_fault_t shmem_fault(struct vm_fault *vmf) + spin_lock(&inode->i_lock); + finish_wait(shmem_falloc_waitq, &shmem_fault_wait); + spin_unlock(&inode->i_lock); ++ ++ if (fpin) ++ fput(fpin); + return ret; + } + spin_unlock(&inode->i_lock); +diff --git a/mm/sparse.c b/mm/sparse.c +index f6891c1992b1..c2c01b6330af 100644 +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -647,7 +647,7 @@ void offline_mem_sections(unsigned long start_pfn, unsigned long end_pfn) + #endif + + #ifdef CONFIG_SPARSEMEM_VMEMMAP +-static struct page *populate_section_memmap(unsigned long pfn, ++static struct page * __meminit populate_section_memmap(unsigned long pfn, + unsigned long nr_pages, int nid, struct vmem_altmap *altmap) + { + return __populate_section_memmap(pfn, nr_pages, nid, altmap); +@@ -669,7 +669,7 @@ static void free_map_bootmem(struct page *memmap) + vmemmap_free(start, end, NULL); + } + #else +-struct page *populate_section_memmap(unsigned long pfn, ++struct page * __meminit populate_section_memmap(unsigned long pfn, + unsigned long nr_pages, int nid, struct vmem_altmap *altmap) + { + struct page *page, *ret; +diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c +index 2b2b9aae8a3c..22d17ecfe7df 100644 +--- a/mm/zsmalloc.c ++++ b/mm/zsmalloc.c +@@ -2069,6 +2069,11 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage, + zs_pool_dec_isolated(pool); + } + ++ if (page_zone(newpage) != page_zone(page)) { ++ dec_zone_page_state(page, NR_ZSPAGES); ++ inc_zone_page_state(newpage, NR_ZSPAGES); ++ } ++ + reset_page(page); + put_page(page); + page = newpage; +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 7ff92dd4c53c..87691404d0c6 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1176,8 +1176,10 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, + if (!conn) + return ERR_PTR(-ENOMEM); + +- if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) ++ if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) { ++ hci_conn_del(conn); + return ERR_PTR(-EBUSY); ++ } + + conn->state = BT_CONNECT; + set_bit(HCI_CONN_SCANNING, &conn->flags); +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index da7fdbdf9c41..a845786258a0 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4936,10 +4936,8 @@ void __l2cap_physical_cfm(struct l2cap_chan *chan, int result) + BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d", + chan, result, local_amp_id, remote_amp_id); + +- if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) { +- l2cap_chan_unlock(chan); ++ if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) + return; +- } + + if (chan->state != BT_CONNECTED) { + l2cap_do_create(chan, result, local_amp_id, remote_amp_id); +diff --git a/net/core/dev.c b/net/core/dev.c +index 046307445ece..3e11c6bb4dd6 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3386,7 +3386,7 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q, + qdisc_calculate_pkt_len(skb, q); + + if (q->flags & TCQ_F_NOLOCK) { +- if ((q->flags & TCQ_F_CAN_BYPASS) && q->empty && ++ if ((q->flags & TCQ_F_CAN_BYPASS) && READ_ONCE(q->empty) && + qdisc_run_begin(q)) { + if (unlikely(test_bit(__QDISC_STATE_DEACTIVATED, + &q->state))) { +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 08ebc3ac5343..f2452496ad9f 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -1194,7 +1194,7 @@ static void neigh_update_hhs(struct neighbour *neigh) + + if (update) { + hh = &neigh->hh; +- if (hh->hh_len) { ++ if (READ_ONCE(hh->hh_len)) { + write_seqlock_bh(&hh->hh_lock); + update(hh, neigh->dev, neigh->ha); + write_sequnlock_bh(&hh->hh_lock); +@@ -1473,7 +1473,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb) + struct net_device *dev = neigh->dev; + unsigned int seq; + +- if (dev->header_ops->cache && !neigh->hh.hh_len) ++ if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len)) + neigh_hh_init(neigh); + + do { +diff --git a/net/core/sock.c b/net/core/sock.c +index ac78a570e43a..b4d1112174c1 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2918,7 +2918,7 @@ void sock_init_data(struct socket *sock, struct sock *sk) + + sk->sk_max_pacing_rate = ~0UL; + sk->sk_pacing_rate = ~0UL; +- sk->sk_pacing_shift = 10; ++ WRITE_ONCE(sk->sk_pacing_shift, 10); + sk->sk_incoming_cpu = -1; + + sk_rx_queue_clear(sk); +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index eb29e5adc84d..9f9e00ba3ad7 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -288,6 +288,7 @@ static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write, + return ret; + } + ++# ifdef CONFIG_HAVE_EBPF_JIT + static int + proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, +@@ -298,6 +299,7 @@ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write, + + return proc_dointvec_minmax(table, write, buffer, lenp, ppos); + } ++# endif /* CONFIG_HAVE_EBPF_JIT */ + + static int + proc_dolongvec_minmax_bpf_restricted(struct ctl_table *table, int write, +diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c +index 17374afee28f..9040fe55e0f5 100644 +--- a/net/ethernet/eth.c ++++ b/net/ethernet/eth.c +@@ -244,7 +244,12 @@ int eth_header_cache(const struct neighbour *neigh, struct hh_cache *hh, __be16 + eth->h_proto = type; + memcpy(eth->h_source, dev->dev_addr, ETH_ALEN); + memcpy(eth->h_dest, neigh->ha, ETH_ALEN); +- hh->hh_len = ETH_HLEN; ++ ++ /* Pairs with READ_ONCE() in neigh_resolve_output(), ++ * neigh_hh_output() and neigh_update_hhs(). ++ */ ++ smp_store_release(&hh->hh_len, ETH_HLEN); ++ + return 0; + } + EXPORT_SYMBOL(eth_header_cache); +diff --git a/net/hsr/hsr_debugfs.c b/net/hsr/hsr_debugfs.c +index 94447974a3c0..6618a9d8e58e 100644 +--- a/net/hsr/hsr_debugfs.c ++++ b/net/hsr/hsr_debugfs.c +@@ -64,7 +64,6 @@ hsr_node_table_open(struct inode *inode, struct file *filp) + } + + static const struct file_operations hsr_fops = { +- .owner = THIS_MODULE, + .open = hsr_node_table_open, + .read = seq_read, + .llseek = seq_lseek, +@@ -78,15 +77,14 @@ static const struct file_operations hsr_fops = { + * When debugfs is configured this routine sets up the node_table file per + * hsr device for dumping the node_table entries + */ +-int hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev) ++void hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev) + { +- int rc = -1; + struct dentry *de = NULL; + + de = debugfs_create_dir(hsr_dev->name, NULL); +- if (!de) { ++ if (IS_ERR(de)) { + pr_err("Cannot create hsr debugfs root\n"); +- return rc; ++ return; + } + + priv->node_tbl_root = de; +@@ -94,13 +92,13 @@ int hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev) + de = debugfs_create_file("node_table", S_IFREG | 0444, + priv->node_tbl_root, priv, + &hsr_fops); +- if (!de) { ++ if (IS_ERR(de)) { + pr_err("Cannot create hsr node_table directory\n"); +- return rc; ++ debugfs_remove(priv->node_tbl_root); ++ priv->node_tbl_root = NULL; ++ return; + } + priv->node_tbl_file = de; +- +- return 0; + } + + /* hsr_debugfs_term - Tear down debugfs intrastructure +diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c +index b01e1bae4ddc..62c03f0d0079 100644 +--- a/net/hsr/hsr_device.c ++++ b/net/hsr/hsr_device.c +@@ -368,7 +368,7 @@ static void hsr_dev_destroy(struct net_device *hsr_dev) + del_timer_sync(&hsr->prune_timer); + del_timer_sync(&hsr->announce_timer); + +- hsr_del_self_node(&hsr->self_node_db); ++ hsr_del_self_node(hsr); + hsr_del_nodes(&hsr->node_db); + } + +@@ -440,11 +440,12 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], + INIT_LIST_HEAD(&hsr->ports); + INIT_LIST_HEAD(&hsr->node_db); + INIT_LIST_HEAD(&hsr->self_node_db); ++ spin_lock_init(&hsr->list_lock); + + ether_addr_copy(hsr_dev->dev_addr, slave[0]->dev_addr); + + /* Make sure we recognize frames from ourselves in hsr_rcv() */ +- res = hsr_create_self_node(&hsr->self_node_db, hsr_dev->dev_addr, ++ res = hsr_create_self_node(hsr, hsr_dev->dev_addr, + slave[1]->dev_addr); + if (res < 0) + return res; +@@ -477,31 +478,32 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], + + res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER); + if (res) +- goto err_add_port; ++ goto err_add_master; + + res = register_netdevice(hsr_dev); + if (res) +- goto fail; ++ goto err_unregister; + + res = hsr_add_port(hsr, slave[0], HSR_PT_SLAVE_A); + if (res) +- goto fail; ++ goto err_add_slaves; ++ + res = hsr_add_port(hsr, slave[1], HSR_PT_SLAVE_B); + if (res) +- goto fail; ++ goto err_add_slaves; + ++ hsr_debugfs_init(hsr, hsr_dev); + mod_timer(&hsr->prune_timer, jiffies + msecs_to_jiffies(PRUNE_PERIOD)); +- res = hsr_debugfs_init(hsr, hsr_dev); +- if (res) +- goto fail; + + return 0; + +-fail: ++err_add_slaves: ++ unregister_netdevice(hsr_dev); ++err_unregister: + list_for_each_entry_safe(port, tmp, &hsr->ports, port_list) + hsr_del_port(port); +-err_add_port: +- hsr_del_self_node(&hsr->self_node_db); ++err_add_master: ++ hsr_del_self_node(hsr); + + return res; + } +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index 292be446007b..27dc65d7de67 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -75,10 +75,11 @@ static struct hsr_node *find_node_by_addr_A(struct list_head *node_db, + /* Helper for device init; the self_node_db is used in hsr_rcv() to recognize + * frames from self that's been looped over the HSR ring. + */ +-int hsr_create_self_node(struct list_head *self_node_db, ++int hsr_create_self_node(struct hsr_priv *hsr, + unsigned char addr_a[ETH_ALEN], + unsigned char addr_b[ETH_ALEN]) + { ++ struct list_head *self_node_db = &hsr->self_node_db; + struct hsr_node *node, *oldnode; + + node = kmalloc(sizeof(*node), GFP_KERNEL); +@@ -88,33 +89,33 @@ int hsr_create_self_node(struct list_head *self_node_db, + ether_addr_copy(node->macaddress_A, addr_a); + ether_addr_copy(node->macaddress_B, addr_b); + +- rcu_read_lock(); ++ spin_lock_bh(&hsr->list_lock); + oldnode = list_first_or_null_rcu(self_node_db, + struct hsr_node, mac_list); + if (oldnode) { + list_replace_rcu(&oldnode->mac_list, &node->mac_list); +- rcu_read_unlock(); +- synchronize_rcu(); +- kfree(oldnode); ++ spin_unlock_bh(&hsr->list_lock); ++ kfree_rcu(oldnode, rcu_head); + } else { +- rcu_read_unlock(); + list_add_tail_rcu(&node->mac_list, self_node_db); ++ spin_unlock_bh(&hsr->list_lock); + } + + return 0; + } + +-void hsr_del_self_node(struct list_head *self_node_db) ++void hsr_del_self_node(struct hsr_priv *hsr) + { ++ struct list_head *self_node_db = &hsr->self_node_db; + struct hsr_node *node; + +- rcu_read_lock(); ++ spin_lock_bh(&hsr->list_lock); + node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list); +- rcu_read_unlock(); + if (node) { + list_del_rcu(&node->mac_list); +- kfree(node); ++ kfree_rcu(node, rcu_head); + } ++ spin_unlock_bh(&hsr->list_lock); + } + + void hsr_del_nodes(struct list_head *node_db) +@@ -130,30 +131,43 @@ void hsr_del_nodes(struct list_head *node_db) + * seq_out is used to initialize filtering of outgoing duplicate frames + * originating from the newly added node. + */ +-struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[], +- u16 seq_out) ++static struct hsr_node *hsr_add_node(struct hsr_priv *hsr, ++ struct list_head *node_db, ++ unsigned char addr[], ++ u16 seq_out) + { +- struct hsr_node *node; ++ struct hsr_node *new_node, *node; + unsigned long now; + int i; + +- node = kzalloc(sizeof(*node), GFP_ATOMIC); +- if (!node) ++ new_node = kzalloc(sizeof(*new_node), GFP_ATOMIC); ++ if (!new_node) + return NULL; + +- ether_addr_copy(node->macaddress_A, addr); ++ ether_addr_copy(new_node->macaddress_A, addr); + + /* We are only interested in time diffs here, so use current jiffies + * as initialization. (0 could trigger an spurious ring error warning). + */ + now = jiffies; + for (i = 0; i < HSR_PT_PORTS; i++) +- node->time_in[i] = now; ++ new_node->time_in[i] = now; + for (i = 0; i < HSR_PT_PORTS; i++) +- node->seq_out[i] = seq_out; +- +- list_add_tail_rcu(&node->mac_list, node_db); ++ new_node->seq_out[i] = seq_out; + ++ spin_lock_bh(&hsr->list_lock); ++ list_for_each_entry_rcu(node, node_db, mac_list) { ++ if (ether_addr_equal(node->macaddress_A, addr)) ++ goto out; ++ if (ether_addr_equal(node->macaddress_B, addr)) ++ goto out; ++ } ++ list_add_tail_rcu(&new_node->mac_list, node_db); ++ spin_unlock_bh(&hsr->list_lock); ++ return new_node; ++out: ++ spin_unlock_bh(&hsr->list_lock); ++ kfree(new_node); + return node; + } + +@@ -163,6 +177,7 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, + bool is_sup) + { + struct list_head *node_db = &port->hsr->node_db; ++ struct hsr_priv *hsr = port->hsr; + struct hsr_node *node; + struct ethhdr *ethhdr; + u16 seq_out; +@@ -196,7 +211,7 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, + seq_out = HSR_SEQNR_START; + } + +- return hsr_add_node(node_db, ethhdr->h_source, seq_out); ++ return hsr_add_node(hsr, node_db, ethhdr->h_source, seq_out); + } + + /* Use the Supervision frame's info about an eventual macaddress_B for merging +@@ -206,10 +221,11 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, + void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr, + struct hsr_port *port_rcv) + { +- struct ethhdr *ethhdr; +- struct hsr_node *node_real; ++ struct hsr_priv *hsr = port_rcv->hsr; + struct hsr_sup_payload *hsr_sp; ++ struct hsr_node *node_real; + struct list_head *node_db; ++ struct ethhdr *ethhdr; + int i; + + ethhdr = (struct ethhdr *)skb_mac_header(skb); +@@ -231,7 +247,7 @@ void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr, + node_real = find_node_by_addr_A(node_db, hsr_sp->macaddress_A); + if (!node_real) + /* No frame received from AddrA of this node yet */ +- node_real = hsr_add_node(node_db, hsr_sp->macaddress_A, ++ node_real = hsr_add_node(hsr, node_db, hsr_sp->macaddress_A, + HSR_SEQNR_START - 1); + if (!node_real) + goto done; /* No mem */ +@@ -252,7 +268,9 @@ void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr, + } + node_real->addr_B_port = port_rcv->type; + ++ spin_lock_bh(&hsr->list_lock); + list_del_rcu(&node_curr->mac_list); ++ spin_unlock_bh(&hsr->list_lock); + kfree_rcu(node_curr, rcu_head); + + done: +@@ -368,12 +386,13 @@ void hsr_prune_nodes(struct timer_list *t) + { + struct hsr_priv *hsr = from_timer(hsr, t, prune_timer); + struct hsr_node *node; ++ struct hsr_node *tmp; + struct hsr_port *port; + unsigned long timestamp; + unsigned long time_a, time_b; + +- rcu_read_lock(); +- list_for_each_entry_rcu(node, &hsr->node_db, mac_list) { ++ spin_lock_bh(&hsr->list_lock); ++ list_for_each_entry_safe(node, tmp, &hsr->node_db, mac_list) { + /* Don't prune own node. Neither time_in[HSR_PT_SLAVE_A] + * nor time_in[HSR_PT_SLAVE_B], will ever be updated for + * the master port. Thus the master node will be repeatedly +@@ -421,7 +440,7 @@ void hsr_prune_nodes(struct timer_list *t) + kfree_rcu(node, rcu_head); + } + } +- rcu_read_unlock(); ++ spin_unlock_bh(&hsr->list_lock); + + /* Restart timer */ + mod_timer(&hsr->prune_timer, +diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h +index 89a3ce38151d..0f0fa12b4329 100644 +--- a/net/hsr/hsr_framereg.h ++++ b/net/hsr/hsr_framereg.h +@@ -12,10 +12,8 @@ + + struct hsr_node; + +-void hsr_del_self_node(struct list_head *self_node_db); ++void hsr_del_self_node(struct hsr_priv *hsr); + void hsr_del_nodes(struct list_head *node_db); +-struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[], +- u16 seq_out); + struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, + bool is_sup); + void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr, +@@ -33,7 +31,7 @@ int hsr_register_frame_out(struct hsr_port *port, struct hsr_node *node, + + void hsr_prune_nodes(struct timer_list *t); + +-int hsr_create_self_node(struct list_head *self_node_db, ++int hsr_create_self_node(struct hsr_priv *hsr, + unsigned char addr_a[ETH_ALEN], + unsigned char addr_b[ETH_ALEN]); + +diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c +index b9988a662ee1..6deb8fa8d5c8 100644 +--- a/net/hsr/hsr_main.c ++++ b/net/hsr/hsr_main.c +@@ -64,7 +64,7 @@ static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event, + + /* Make sure we recognize frames from ourselves in hsr_rcv() */ + port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_B); +- res = hsr_create_self_node(&hsr->self_node_db, ++ res = hsr_create_self_node(hsr, + master->dev->dev_addr, + port ? + port->dev->dev_addr : +diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h +index 96fac696a1e1..9ec38e33b8b1 100644 +--- a/net/hsr/hsr_main.h ++++ b/net/hsr/hsr_main.h +@@ -160,8 +160,9 @@ struct hsr_priv { + int announce_count; + u16 sequence_nr; + u16 sup_sequence_nr; /* For HSRv1 separate seq_nr for supervision */ +- u8 prot_version; /* Indicate if HSRv0 or HSRv1. */ +- spinlock_t seqnr_lock; /* locking for sequence_nr */ ++ u8 prot_version; /* Indicate if HSRv0 or HSRv1. */ ++ spinlock_t seqnr_lock; /* locking for sequence_nr */ ++ spinlock_t list_lock; /* locking for node list */ + unsigned char sup_multicast_addr[ETH_ALEN]; + #ifdef CONFIG_DEBUG_FS + struct dentry *node_tbl_root; +@@ -184,15 +185,12 @@ static inline u16 hsr_get_skb_sequence_nr(struct sk_buff *skb) + } + + #if IS_ENABLED(CONFIG_DEBUG_FS) +-int hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev); ++void hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev); + void hsr_debugfs_term(struct hsr_priv *priv); + #else +-static inline int hsr_debugfs_init(struct hsr_priv *priv, +- struct net_device *hsr_dev) +-{ +- return 0; +-} +- ++static inline void hsr_debugfs_init(struct hsr_priv *priv, ++ struct net_device *hsr_dev) ++{} + static inline void hsr_debugfs_term(struct hsr_priv *priv) + {} + #endif +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index d8876f0e9672..e537a4b6531b 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1958,8 +1958,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock, + struct sk_buff *skb, *last; + u32 urg_hole = 0; + struct scm_timestamping_internal tss; +- bool has_tss = false; +- bool has_cmsg; ++ int cmsg_flags; + + if (unlikely(flags & MSG_ERRQUEUE)) + return inet_recv_error(sk, msg, len, addr_len); +@@ -1974,7 +1973,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock, + if (sk->sk_state == TCP_LISTEN) + goto out; + +- has_cmsg = tp->recvmsg_inq; ++ cmsg_flags = tp->recvmsg_inq ? 1 : 0; + timeo = sock_rcvtimeo(sk, nonblock); + + /* Urgent data needs to be handled specially. */ +@@ -2157,8 +2156,7 @@ skip_copy: + + if (TCP_SKB_CB(skb)->has_rxtstamp) { + tcp_update_recv_tstamps(skb, &tss); +- has_tss = true; +- has_cmsg = true; ++ cmsg_flags |= 2; + } + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) + goto found_fin_ok; +@@ -2183,10 +2181,10 @@ found_fin_ok: + + release_sock(sk); + +- if (has_cmsg) { +- if (has_tss) ++ if (cmsg_flags) { ++ if (cmsg_flags & 2) + tcp_recv_timestamp(msg, sk, &tss); +- if (tp->recvmsg_inq) { ++ if (cmsg_flags & 1) { + inq = tcp_inq_hint(sk); + put_cmsg(msg, SOL_TCP, TCP_CM_INQ, sizeof(inq), &inq); + } +diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c +index 32772d6ded4e..a6545ef0d27b 100644 +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -306,7 +306,8 @@ static u32 bbr_tso_segs_goal(struct sock *sk) + /* Sort of tcp_tso_autosize() but ignoring + * driver provided sk_gso_max_size. + */ +- bytes = min_t(unsigned long, sk->sk_pacing_rate >> sk->sk_pacing_shift, ++ bytes = min_t(unsigned long, ++ sk->sk_pacing_rate >> READ_ONCE(sk->sk_pacing_shift), + GSO_MAX_SIZE - 1 - MAX_TCP_HEADER); + segs = max_t(u32, bytes / tp->mss_cache, bbr_min_tso_segs(sk)); + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 0269584e9cf7..e4ba915c4bb5 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1728,7 +1728,7 @@ static u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now, + u32 bytes, segs; + + bytes = min_t(unsigned long, +- sk->sk_pacing_rate >> sk->sk_pacing_shift, ++ sk->sk_pacing_rate >> READ_ONCE(sk->sk_pacing_shift), + sk->sk_gso_max_size - 1 - MAX_TCP_HEADER); + + /* Goal is to send at least one packet per ms, +@@ -2263,7 +2263,7 @@ static bool tcp_small_queue_check(struct sock *sk, const struct sk_buff *skb, + + limit = max_t(unsigned long, + 2 * skb->truesize, +- sk->sk_pacing_rate >> sk->sk_pacing_shift); ++ sk->sk_pacing_rate >> READ_ONCE(sk->sk_pacing_shift)); + if (sk->sk_pacing_status == SK_PACING_NONE) + limit = min_t(unsigned long, limit, + sock_net(sk)->ipv4.sysctl_tcp_limit_output_bytes); +diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c +index a2b58de82600..f8f52ff99cfb 100644 +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -189,7 +189,7 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, + goto err; + } + +- if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) { ++ if (skb_dst(skb) && !skb_dst_force(skb)) { + status = -ENETDOWN; + goto err; + } +diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c +index f92a82c73880..95980154ef02 100644 +--- a/net/netfilter/nft_tproxy.c ++++ b/net/netfilter/nft_tproxy.c +@@ -50,7 +50,7 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr, + taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr); + + if (priv->sreg_port) +- tport = regs->data[priv->sreg_port]; ++ tport = nft_reg_load16(®s->data[priv->sreg_port]); + if (!tport) + tport = hp->dest; + +@@ -117,7 +117,7 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr, + taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr); + + if (priv->sreg_port) +- tport = regs->data[priv->sreg_port]; ++ tport = nft_reg_load16(®s->data[priv->sreg_port]); + if (!tport) + tport = hp->dest; + +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 8769b4b8807d..7c3c5fdb82a9 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -657,7 +657,7 @@ static struct sk_buff *pfifo_fast_dequeue(struct Qdisc *qdisc) + if (likely(skb)) { + qdisc_update_stats_at_dequeue(qdisc, skb); + } else { +- qdisc->empty = true; ++ WRITE_ONCE(qdisc->empty, true); + } + + return skb; +diff --git a/net/socket.c b/net/socket.c +index d7a106028f0e..ca8de9e1582d 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -955,7 +955,7 @@ static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to) + .msg_iocb = iocb}; + ssize_t res; + +- if (file->f_flags & O_NONBLOCK) ++ if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT)) + msg.msg_flags = MSG_DONTWAIT; + + if (iocb->ki_pos != 0) +@@ -980,7 +980,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from) + if (iocb->ki_pos != 0) + return -ESPIPE; + +- if (file->f_flags & O_NONBLOCK) ++ if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT)) + msg.msg_flags = MSG_DONTWAIT; + + if (sock->type == SOCK_SEQPACKET) +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index a349094f6fb7..f740cb51802a 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -53,9 +53,6 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) + h->last_refresh = now; + } + +-static inline int cache_is_valid(struct cache_head *h); +-static void cache_fresh_locked(struct cache_head *head, time_t expiry, +- struct cache_detail *detail); + static void cache_fresh_unlocked(struct cache_head *head, + struct cache_detail *detail); + +@@ -105,9 +102,6 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail, + if (cache_is_expired(detail, tmp)) { + hlist_del_init_rcu(&tmp->cache_list); + detail->entries --; +- if (cache_is_valid(tmp) == -EAGAIN) +- set_bit(CACHE_NEGATIVE, &tmp->flags); +- cache_fresh_locked(tmp, 0, detail); + freeme = tmp; + break; + } +diff --git a/samples/seccomp/user-trap.c b/samples/seccomp/user-trap.c +index 6d0125ca8af7..20291ec6489f 100644 +--- a/samples/seccomp/user-trap.c ++++ b/samples/seccomp/user-trap.c +@@ -298,14 +298,14 @@ int main(void) + req = malloc(sizes.seccomp_notif); + if (!req) + goto out_close; +- memset(req, 0, sizeof(*req)); + + resp = malloc(sizes.seccomp_notif_resp); + if (!resp) + goto out_req; +- memset(resp, 0, sizeof(*resp)); ++ memset(resp, 0, sizes.seccomp_notif_resp); + + while (1) { ++ memset(req, 0, sizes.seccomp_notif); + if (ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, req)) { + perror("ioctl recv"); + goto out_resp; +diff --git a/samples/trace_printk/trace-printk.c b/samples/trace_printk/trace-printk.c +index 7affc3b50b61..cfc159580263 100644 +--- a/samples/trace_printk/trace-printk.c ++++ b/samples/trace_printk/trace-printk.c +@@ -36,6 +36,7 @@ static int __init trace_printk_init(void) + + /* Kick off printing in irq context */ + irq_work_queue(&irqwork); ++ irq_work_sync(&irqwork); + + trace_printk("This is a %s that will use trace_bprintk()\n", + "static string"); +diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig +index d33de0b9f4f5..e3569543bdac 100644 +--- a/scripts/gcc-plugins/Kconfig ++++ b/scripts/gcc-plugins/Kconfig +@@ -14,8 +14,8 @@ config HAVE_GCC_PLUGINS + An arch should select this symbol if it supports building with + GCC plugins. + +-config GCC_PLUGINS +- bool ++menuconfig GCC_PLUGINS ++ bool "GCC plugins" + depends on HAVE_GCC_PLUGINS + depends on PLUGIN_HOSTCC != "" + default y +@@ -25,8 +25,7 @@ config GCC_PLUGINS + + See Documentation/core-api/gcc-plugins.rst for details. + +-menu "GCC plugins" +- depends on GCC_PLUGINS ++if GCC_PLUGINS + + config GCC_PLUGIN_CYC_COMPLEXITY + bool "Compute the cyclomatic complexity of a function" if EXPERT +@@ -113,4 +112,4 @@ config GCC_PLUGIN_ARM_SSP_PER_TASK + bool + depends on GCC_PLUGINS && ARM + +-endmenu ++endif +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index 45d13b6462aa..90d21675c3ad 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -593,7 +593,7 @@ static __poll_t ns_revision_poll(struct file *file, poll_table *pt) + + void __aa_bump_ns_revision(struct aa_ns *ns) + { +- ns->revision++; ++ WRITE_ONCE(ns->revision, ns->revision + 1); + wake_up_interruptible(&ns->wait); + } + +diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c +index 9e0492795267..039ca71872ce 100644 +--- a/security/apparmor/domain.c ++++ b/security/apparmor/domain.c +@@ -317,6 +317,7 @@ static int aa_xattrs_match(const struct linux_binprm *bprm, + + if (!bprm || !profile->xattr_count) + return 0; ++ might_sleep(); + + /* transition from exec match to xattr set */ + state = aa_dfa_null_transition(profile->xmatch, state); +@@ -361,10 +362,11 @@ out: + } + + /** +- * __attach_match_ - find an attachment match ++ * find_attach - do attachment search for unconfined processes + * @bprm - binprm structure of transitioning task +- * @name - to match against (NOT NULL) ++ * @ns: the current namespace (NOT NULL) + * @head - profile list to walk (NOT NULL) ++ * @name - to match against (NOT NULL) + * @info - info message if there was an error (NOT NULL) + * + * Do a linear search on the profiles in the list. There is a matching +@@ -374,12 +376,11 @@ out: + * + * Requires: @head not be shared or have appropriate locks held + * +- * Returns: profile or NULL if no match found ++ * Returns: label or NULL if no match found + */ +-static struct aa_profile *__attach_match(const struct linux_binprm *bprm, +- const char *name, +- struct list_head *head, +- const char **info) ++static struct aa_label *find_attach(const struct linux_binprm *bprm, ++ struct aa_ns *ns, struct list_head *head, ++ const char *name, const char **info) + { + int candidate_len = 0, candidate_xattrs = 0; + bool conflict = false; +@@ -388,6 +389,8 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm, + AA_BUG(!name); + AA_BUG(!head); + ++ rcu_read_lock(); ++restart: + list_for_each_entry_rcu(profile, head, base.list) { + if (profile->label.flags & FLAG_NULL && + &profile->label == ns_unconfined(profile->ns)) +@@ -413,16 +416,32 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm, + perm = dfa_user_allow(profile->xmatch, state); + /* any accepting state means a valid match. */ + if (perm & MAY_EXEC) { +- int ret; ++ int ret = 0; + + if (count < candidate_len) + continue; + +- ret = aa_xattrs_match(bprm, profile, state); +- /* Fail matching if the xattrs don't match */ +- if (ret < 0) +- continue; +- ++ if (bprm && profile->xattr_count) { ++ long rev = READ_ONCE(ns->revision); ++ ++ if (!aa_get_profile_not0(profile)) ++ goto restart; ++ rcu_read_unlock(); ++ ret = aa_xattrs_match(bprm, profile, ++ state); ++ rcu_read_lock(); ++ aa_put_profile(profile); ++ if (rev != ++ READ_ONCE(ns->revision)) ++ /* policy changed */ ++ goto restart; ++ /* ++ * Fail matching if the xattrs don't ++ * match ++ */ ++ if (ret < 0) ++ continue; ++ } + /* + * TODO: allow for more flexible best match + * +@@ -445,43 +464,28 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm, + candidate_xattrs = ret; + conflict = false; + } +- } else if (!strcmp(profile->base.name, name)) ++ } else if (!strcmp(profile->base.name, name)) { + /* + * old exact non-re match, without conditionals such + * as xattrs. no more searching required + */ +- return profile; ++ candidate = profile; ++ goto out; ++ } + } + +- if (conflict) { +- *info = "conflicting profile attachments"; ++ if (!candidate || conflict) { ++ if (conflict) ++ *info = "conflicting profile attachments"; ++ rcu_read_unlock(); + return NULL; + } + +- return candidate; +-} +- +-/** +- * find_attach - do attachment search for unconfined processes +- * @bprm - binprm structure of transitioning task +- * @ns: the current namespace (NOT NULL) +- * @list: list to search (NOT NULL) +- * @name: the executable name to match against (NOT NULL) +- * @info: info message if there was an error +- * +- * Returns: label or NULL if no match found +- */ +-static struct aa_label *find_attach(const struct linux_binprm *bprm, +- struct aa_ns *ns, struct list_head *list, +- const char *name, const char **info) +-{ +- struct aa_profile *profile; +- +- rcu_read_lock(); +- profile = aa_get_profile(__attach_match(bprm, name, list, info)); ++out: ++ candidate = aa_get_newest_profile(candidate); + rcu_read_unlock(); + +- return profile ? &profile->label : NULL; ++ return &candidate->label; + } + + static const char *next_name(int xtype, const char *name) +diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c +index ade333074c8e..06355717ee84 100644 +--- a/security/apparmor/policy.c ++++ b/security/apparmor/policy.c +@@ -1124,8 +1124,8 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj, + if (!name) { + /* remove namespace - can only happen if fqname[0] == ':' */ + mutex_lock_nested(&ns->parent->lock, ns->level); +- __aa_remove_ns(ns); + __aa_bump_ns_revision(ns); ++ __aa_remove_ns(ns); + mutex_unlock(&ns->parent->lock); + } else { + /* remove profile */ +@@ -1137,9 +1137,9 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj, + goto fail_ns_lock; + } + name = profile->base.hname; ++ __aa_bump_ns_revision(ns); + __remove_profile(profile); + __aa_labelset_update_subtree(ns); +- __aa_bump_ns_revision(ns); + mutex_unlock(&ns->lock); + } + +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index d4280568a41e..5c74ea2bb44b 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -3408,7 +3408,8 @@ int snd_pcm_lib_default_mmap(struct snd_pcm_substream *substream, + #endif /* CONFIG_GENERIC_ALLOCATOR */ + #ifndef CONFIG_X86 /* for avoiding warnings arch/x86/mm/pat.c */ + if (IS_ENABLED(CONFIG_HAS_DMA) && !substream->ops->page && +- substream->dma_buffer.dev.type == SNDRV_DMA_TYPE_DEV) ++ (substream->dma_buffer.dev.type == SNDRV_DMA_TYPE_DEV || ++ substream->dma_buffer.dev.type == SNDRV_DMA_TYPE_DEV_UC)) + return dma_mmap_coherent(substream->dma_buffer.dev.dev, + area, + substream->runtime->dma_area, +diff --git a/sound/firewire/motu/motu-proc.c b/sound/firewire/motu/motu-proc.c +index ea46fb4c1b5a..126a7bd187bb 100644 +--- a/sound/firewire/motu/motu-proc.c ++++ b/sound/firewire/motu/motu-proc.c +@@ -16,7 +16,7 @@ static const char *const clock_names[] = { + [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT] = "S/PDIF on optical interface", + [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_A] = "S/PDIF on optical interface A", + [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_B] = "S/PDIF on optical interface B", +- [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PCIF on coaxial interface", ++ [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PDIF on coaxial interface", + [SND_MOTU_CLOCK_SOURCE_AESEBU_ON_XLR] = "AESEBU on XLR interface", + [SND_MOTU_CLOCK_SOURCE_WORD_ON_BNC] = "Word clock on BNC interface", + }; +diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c +index 78dd213589b4..fa3c39cff5f8 100644 +--- a/sound/isa/cs423x/cs4236.c ++++ b/sound/isa/cs423x/cs4236.c +@@ -278,7 +278,8 @@ static int snd_cs423x_pnp_init_mpu(int dev, struct pnp_dev *pdev) + } else { + mpu_port[dev] = pnp_port_start(pdev, 0); + if (mpu_irq[dev] >= 0 && +- pnp_irq_valid(pdev, 0) && pnp_irq(pdev, 0) >= 0) { ++ pnp_irq_valid(pdev, 0) && ++ pnp_irq(pdev, 0) != (resource_size_t)-1) { + mpu_irq[dev] = pnp_irq(pdev, 0); + } else { + mpu_irq[dev] = -1; /* disable interrupt */ +diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c +index 6387c7e90918..76b507058cb4 100644 +--- a/sound/pci/hda/hda_controller.c ++++ b/sound/pci/hda/hda_controller.c +@@ -884,7 +884,7 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr, + return -EAGAIN; /* give a chance to retry */ + } + +- dev_WARN(chip->card->dev, ++ dev_err(chip->card->dev, + "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n", + bus->last_cmd[addr]); + chip->single_cmd = 1; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 86a416cdeb29..f6cbb831b86a 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -280,12 +280,13 @@ enum { + + /* quirks for old Intel chipsets */ + #define AZX_DCAPS_INTEL_ICH \ +- (AZX_DCAPS_OLD_SSYNC | AZX_DCAPS_NO_ALIGN_BUFSIZE) ++ (AZX_DCAPS_OLD_SSYNC | AZX_DCAPS_NO_ALIGN_BUFSIZE |\ ++ AZX_DCAPS_SYNC_WRITE) + + /* quirks for Intel PCH */ + #define AZX_DCAPS_INTEL_PCH_BASE \ + (AZX_DCAPS_NO_ALIGN_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY |\ +- AZX_DCAPS_SNOOP_TYPE(SCH)) ++ AZX_DCAPS_SNOOP_TYPE(SCH) | AZX_DCAPS_SYNC_WRITE) + + /* PCH up to IVB; no runtime PM; bind with i915 gfx */ + #define AZX_DCAPS_INTEL_PCH_NOPM \ +@@ -300,13 +301,13 @@ enum { + #define AZX_DCAPS_INTEL_HASWELL \ + (/*AZX_DCAPS_ALIGN_BUFSIZE |*/ AZX_DCAPS_COUNT_LPIB_DELAY |\ + AZX_DCAPS_PM_RUNTIME | AZX_DCAPS_I915_COMPONENT |\ +- AZX_DCAPS_SNOOP_TYPE(SCH)) ++ AZX_DCAPS_SNOOP_TYPE(SCH) | AZX_DCAPS_SYNC_WRITE) + + /* Broadwell HDMI can't use position buffer reliably, force to use LPIB */ + #define AZX_DCAPS_INTEL_BROADWELL \ + (/*AZX_DCAPS_ALIGN_BUFSIZE |*/ AZX_DCAPS_POSFIX_LPIB |\ + AZX_DCAPS_PM_RUNTIME | AZX_DCAPS_I915_COMPONENT |\ +- AZX_DCAPS_SNOOP_TYPE(SCH)) ++ AZX_DCAPS_SNOOP_TYPE(SCH) | AZX_DCAPS_SYNC_WRITE) + + #define AZX_DCAPS_INTEL_BAYTRAIL \ + (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_I915_COMPONENT) +@@ -1280,11 +1281,17 @@ static void init_vga_switcheroo(struct azx *chip) + { + struct hda_intel *hda = container_of(chip, struct hda_intel, chip); + struct pci_dev *p = get_bound_vga(chip->pci); ++ struct pci_dev *parent; + if (p) { + dev_info(chip->card->dev, + "Handle vga_switcheroo audio client\n"); + hda->use_vga_switcheroo = 1; +- chip->bus.keep_power = 1; /* cleared in either gpu_bound op or codec probe */ ++ ++ /* cleared in either gpu_bound op or codec probe, or when its ++ * upstream port has _PR3 (i.e. dGPU). ++ */ ++ parent = pci_upstream_bridge(p); ++ chip->bus.keep_power = parent ? !pci_pr3_present(parent) : 1; + chip->driver_caps |= AZX_DCAPS_PM_RUNTIME; + pci_dev_put(p); + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index e1229dbad6b2..252888f426de 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -501,6 +501,7 @@ static void alc_shutup_pins(struct hda_codec *codec) + struct alc_spec *spec = codec->spec; + + switch (codec->core.vendor_id) { ++ case 0x10ec0283: + case 0x10ec0286: + case 0x10ec0288: + case 0x10ec0298: +@@ -5547,6 +5548,16 @@ static void alc295_fixup_disable_dac3(struct hda_codec *codec, + } + } + ++/* force NID 0x17 (Bass Speaker) to DAC1 to share it with the main speaker */ ++static void alc285_fixup_speaker2_to_dac1(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ hda_nid_t conn[1] = { 0x02 }; ++ snd_hda_override_conn_list(codec, 0x17, 1, conn); ++ } ++} ++ + /* Hook to update amp GPIO4 for automute */ + static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, + struct hda_jack_callback *jack) +@@ -5849,6 +5860,7 @@ enum { + ALC225_FIXUP_DISABLE_MIC_VREF, + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC295_FIXUP_DISABLE_DAC3, ++ ALC285_FIXUP_SPEAKER2_TO_DAC1, + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, +@@ -5893,9 +5905,12 @@ enum { + ALC256_FIXUP_ASUS_HEADSET_MIC, + ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC299_FIXUP_PREDATOR_SPK, +- ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC, + ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, +- ALC294_FIXUP_ASUS_INTSPK_GPIO, ++ ALC289_FIXUP_DELL_SPK2, ++ ALC289_FIXUP_DUAL_SPK, ++ ALC294_FIXUP_SPK2_TO_DAC1, ++ ALC294_FIXUP_ASUS_DUAL_SPK, ++ + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6649,6 +6664,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc295_fixup_disable_dac3, + }, ++ [ALC285_FIXUP_SPEAKER2_TO_DAC1] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_speaker2_to_dac1, ++ }, + [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -6966,33 +6985,45 @@ static const struct hda_fixup alc269_fixups[] = { + { } + } + }, +- [ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC] = { ++ [ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +- { 0x14, 0x411111f0 }, /* disable confusing internal speaker */ +- { 0x19, 0x04a11150 }, /* use as headset mic, without its own jack detect */ ++ { 0x19, 0x04a11040 }, ++ { 0x21, 0x04211020 }, + { } + }, + .chained = true, +- .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE + }, +- [ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = { ++ [ALC289_FIXUP_DELL_SPK2] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +- { 0x19, 0x04a11040 }, +- { 0x21, 0x04211020 }, ++ { 0x17, 0x90170130 }, /* bass spk */ + { } + }, + .chained = true, +- .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE ++ .chain_id = ALC269_FIXUP_DELL4_MIC_NO_PRESENCE + }, +- [ALC294_FIXUP_ASUS_INTSPK_GPIO] = { ++ [ALC289_FIXUP_DUAL_SPK] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_speaker2_to_dac1, ++ .chained = true, ++ .chain_id = ALC289_FIXUP_DELL_SPK2 ++ }, ++ [ALC294_FIXUP_SPK2_TO_DAC1] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_speaker2_to_dac1, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC ++ }, ++ [ALC294_FIXUP_ASUS_DUAL_SPK] = { + .type = HDA_FIXUP_FUNC, + /* The GPIO must be pulled to initialize the AMP */ + .v.func = alc_fixup_gpio4, + .chained = true, +- .chain_id = ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC ++ .chain_id = ALC294_FIXUP_SPK2_TO_DAC1 + }, ++ + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7065,6 +7096,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), ++ SND_PCI_QUIRK(0x1028, 0x097e, "Dell Precision", ALC289_FIXUP_DUAL_SPK), ++ SND_PCI_QUIRK(0x1028, 0x097d, "Dell Precision", ALC289_FIXUP_DUAL_SPK), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), +@@ -7152,7 +7185,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), +- SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_GPIO), ++ SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), +@@ -7224,6 +7257,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), +@@ -7408,6 +7442,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"}, + {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc225-dell1"}, + {.id = ALC295_FIXUP_DISABLE_DAC3, .name = "alc295-disable-dac3"}, ++ {.id = ALC285_FIXUP_SPEAKER2_TO_DAC1, .name = "alc285-speaker2-to-dac1"}, + {.id = ALC280_FIXUP_HP_HEADSET_MIC, .name = "alc280-hp-headset"}, + {.id = ALC221_FIXUP_HP_FRONT_MIC, .name = "alc221-hp-mic"}, + {.id = ALC298_FIXUP_SPK_VOLUME, .name = "alc298-spk-volume"}, +diff --git a/sound/pci/ice1712/ice1724.c b/sound/pci/ice1712/ice1724.c +index e62c11816683..f360b33a1042 100644 +--- a/sound/pci/ice1712/ice1724.c ++++ b/sound/pci/ice1712/ice1724.c +@@ -647,6 +647,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, + unsigned long flags; + unsigned char mclk_change; + unsigned int i, old_rate; ++ bool call_set_rate = false; + + if (rate > ice->hw_rates->list[ice->hw_rates->count - 1]) + return -EINVAL; +@@ -670,7 +671,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, + * setting clock rate for internal clock mode */ + old_rate = ice->get_rate(ice); + if (force || (old_rate != rate)) +- ice->set_rate(ice, rate); ++ call_set_rate = true; + else if (rate == ice->cur_rate) { + spin_unlock_irqrestore(&ice->reg_lock, flags); + return 0; +@@ -678,12 +679,14 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, + } + + ice->cur_rate = rate; ++ spin_unlock_irqrestore(&ice->reg_lock, flags); ++ ++ if (call_set_rate) ++ ice->set_rate(ice, rate); + + /* setting master clock */ + mclk_change = ice->set_mclk(ice, rate); + +- spin_unlock_irqrestore(&ice->reg_lock, flags); +- + if (mclk_change && ice->gpio.i2s_mclk_changed) + ice->gpio.i2s_mclk_changed(ice); + if (ice->gpio.set_pro_rate) +diff --git a/sound/usb/card.h b/sound/usb/card.h +index 2991b9986f66..395403a2d33f 100644 +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -145,6 +145,7 @@ struct snd_usb_substream { + struct snd_usb_endpoint *sync_endpoint; + unsigned long flags; + bool need_setup_ep; /* (re)configure EP at prepare? */ ++ bool need_setup_fmt; /* (re)configure fmt after resume? */ + unsigned int speed; /* USB_SPEED_XXX */ + + u64 formats; /* format bitmasks (all or'ed) */ +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index ff5ab24f3bd1..a04c727dcd19 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -506,15 +506,15 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt) + if (WARN_ON(!iface)) + return -EINVAL; + alts = usb_altnum_to_altsetting(iface, fmt->altsetting); +- altsd = get_iface_desc(alts); +- if (WARN_ON(altsd->bAlternateSetting != fmt->altsetting)) ++ if (WARN_ON(!alts)) + return -EINVAL; ++ altsd = get_iface_desc(alts); + +- if (fmt == subs->cur_audiofmt) ++ if (fmt == subs->cur_audiofmt && !subs->need_setup_fmt) + return 0; + + /* close the old interface */ +- if (subs->interface >= 0 && subs->interface != fmt->iface) { ++ if (subs->interface >= 0 && (subs->interface != fmt->iface || subs->need_setup_fmt)) { + if (!subs->stream->chip->keep_iface) { + err = usb_set_interface(subs->dev, subs->interface, 0); + if (err < 0) { +@@ -528,6 +528,9 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt) + subs->altset_idx = 0; + } + ++ if (subs->need_setup_fmt) ++ subs->need_setup_fmt = false; ++ + /* set interface */ + if (iface->cur_altsetting != alts) { + err = snd_usb_select_mode_quirk(subs, fmt); +@@ -1735,6 +1738,13 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea + subs->data_endpoint->retire_data_urb = retire_playback_urb; + subs->running = 0; + return 0; ++ case SNDRV_PCM_TRIGGER_SUSPEND: ++ if (subs->stream->chip->setup_fmt_after_resume_quirk) { ++ stop_endpoints(subs, true); ++ subs->need_setup_fmt = true; ++ return 0; ++ } ++ break; + } + + return -EINVAL; +@@ -1767,6 +1777,13 @@ static int snd_usb_substream_capture_trigger(struct snd_pcm_substream *substream + subs->data_endpoint->retire_data_urb = retire_capture_urb; + subs->running = 1; + return 0; ++ case SNDRV_PCM_TRIGGER_SUSPEND: ++ if (subs->stream->chip->setup_fmt_after_resume_quirk) { ++ stop_endpoints(subs, true); ++ subs->need_setup_fmt = true; ++ return 0; ++ } ++ break; + } + + return -EINVAL; +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 70c338f3ae24..d187aa6d50db 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3466,7 +3466,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + .vendor_name = "Dell", + .product_name = "WD19 Dock", + .profile_name = "Dell-WD15-Dock", +- .ifnum = QUIRK_NO_INTERFACE ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_SETUP_FMT_AFTER_RESUME + } + }, + /* MOTU Microbook II */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 349e1e52996d..a81c2066499f 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -508,6 +508,16 @@ static int create_standard_mixer_quirk(struct snd_usb_audio *chip, + return snd_usb_create_mixer(chip, quirk->ifnum, 0); + } + ++ ++static int setup_fmt_after_resume_quirk(struct snd_usb_audio *chip, ++ struct usb_interface *iface, ++ struct usb_driver *driver, ++ const struct snd_usb_audio_quirk *quirk) ++{ ++ chip->setup_fmt_after_resume_quirk = 1; ++ return 1; /* Continue with creating streams and mixer */ ++} ++ + /* + * audio-interface quirks + * +@@ -546,6 +556,7 @@ int snd_usb_create_quirk(struct snd_usb_audio *chip, + [QUIRK_AUDIO_EDIROL_UAXX] = create_uaxx_quirk, + [QUIRK_AUDIO_ALIGN_TRANSFER] = create_align_transfer_quirk, + [QUIRK_AUDIO_STANDARD_MIXER] = create_standard_mixer_quirk, ++ [QUIRK_SETUP_FMT_AFTER_RESUME] = setup_fmt_after_resume_quirk, + }; + + if (quirk->type < QUIRK_TYPE_COUNT) { +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index feb30f9c1716..e360680f45f3 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -33,7 +33,7 @@ struct snd_usb_audio { + wait_queue_head_t shutdown_wait; + unsigned int txfr_quirk:1; /* Subframe boundaries on transfers */ + unsigned int tx_length_quirk:1; /* Put length specifier in transfers */ +- ++ unsigned int setup_fmt_after_resume_quirk:1; /* setup the format to interface after resume */ + int num_interfaces; + int num_suspended_intf; + int sample_rate_read_error; +@@ -98,6 +98,7 @@ enum quirk_type { + QUIRK_AUDIO_EDIROL_UAXX, + QUIRK_AUDIO_ALIGN_TRANSFER, + QUIRK_AUDIO_STANDARD_MIXER, ++ QUIRK_SETUP_FMT_AFTER_RESUME, + + QUIRK_TYPE_COUNT + }; +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index 70a9f8716a4b..888814df758d 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -2403,7 +2403,7 @@ static int thread__resolve_callchain_sample(struct thread *thread, + } + + check_calls: +- if (callchain_param.order != ORDER_CALLEE) { ++ if (chain && callchain_param.order != ORDER_CALLEE) { + err = find_prev_cpumode(chain, thread, cursor, parent, root_al, + &cpumode, chain->nr - first_call); + if (err) +diff --git a/tools/testing/selftests/rseq/param_test.c b/tools/testing/selftests/rseq/param_test.c +index eec2663261f2..e8a657a5f48a 100644 +--- a/tools/testing/selftests/rseq/param_test.c ++++ b/tools/testing/selftests/rseq/param_test.c +@@ -15,7 +15,7 @@ + #include + #include + +-static inline pid_t gettid(void) ++static inline pid_t rseq_gettid(void) + { + return syscall(__NR_gettid); + } +@@ -373,11 +373,12 @@ void *test_percpu_spinlock_thread(void *arg) + rseq_percpu_unlock(&data->lock, cpu); + #ifndef BENCHMARK + if (i != 0 && !(i % (reps / 10))) +- printf_verbose("tid %d: count %lld\n", (int) gettid(), i); ++ printf_verbose("tid %d: count %lld\n", ++ (int) rseq_gettid(), i); + #endif + } + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && thread_data->reg && + rseq_unregister_current_thread()) + abort(); +@@ -454,11 +455,12 @@ void *test_percpu_inc_thread(void *arg) + } while (rseq_unlikely(ret)); + #ifndef BENCHMARK + if (i != 0 && !(i % (reps / 10))) +- printf_verbose("tid %d: count %lld\n", (int) gettid(), i); ++ printf_verbose("tid %d: count %lld\n", ++ (int) rseq_gettid(), i); + #endif + } + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && thread_data->reg && + rseq_unregister_current_thread()) + abort(); +@@ -605,7 +607,7 @@ void *test_percpu_list_thread(void *arg) + } + + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && rseq_unregister_current_thread()) + abort(); + +@@ -796,7 +798,7 @@ void *test_percpu_buffer_thread(void *arg) + } + + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && rseq_unregister_current_thread()) + abort(); + +@@ -1011,7 +1013,7 @@ void *test_percpu_memcpy_buffer_thread(void *arg) + } + + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && rseq_unregister_current_thread()) + abort(); + +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index b505bb062d07..96bbda4f10fc 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -3147,7 +3147,18 @@ TEST(user_notification_basic) + EXPECT_GT(poll(&pollfd, 1, -1), 0); + EXPECT_EQ(pollfd.revents, POLLIN); + +- EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); ++ /* Test that we can't pass garbage to the kernel. */ ++ memset(&req, 0, sizeof(req)); ++ req.pid = -1; ++ errno = 0; ++ ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req); ++ EXPECT_EQ(-1, ret); ++ EXPECT_EQ(EINVAL, errno); ++ ++ if (ret) { ++ req.pid = 0; ++ EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); ++ } + + pollfd.fd = listener; + pollfd.events = POLLIN | POLLOUT; +@@ -3267,6 +3278,7 @@ TEST(user_notification_signal) + + close(sk_pair[1]); + ++ memset(&req, 0, sizeof(req)); + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); + + EXPECT_EQ(kill(pid, SIGUSR1), 0); +@@ -3285,6 +3297,7 @@ TEST(user_notification_signal) + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); + EXPECT_EQ(errno, ENOENT); + ++ memset(&req, 0, sizeof(req)); + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); + + resp.id = req.id; +diff --git a/usr/gen_initramfs_list.sh b/usr/gen_initramfs_list.sh +index 0aad760fcd8c..2bbac73e6477 100755 +--- a/usr/gen_initramfs_list.sh ++++ b/usr/gen_initramfs_list.sh +@@ -128,7 +128,7 @@ parse() { + str="${ftype} ${name} ${location} ${str}" + ;; + "nod") +- local dev=`LC_ALL=C ls -l "${location}"` ++ local dev="`LC_ALL=C ls -l "${location}"`" + local maj=`field 5 ${dev}` + local min=`field 6 ${dev}` + maj=${maj%,} diff --git a/patch/kernel/meson64-current/02-patch-5.4.9-10.patch b/patch/kernel/meson64-current/02-patch-5.4.9-10.patch new file mode 100644 index 0000000000..ef48304451 --- /dev/null +++ b/patch/kernel/meson64-current/02-patch-5.4.9-10.patch @@ -0,0 +1,26 @@ +diff --git a/Makefile b/Makefile +index 3ba15c3528c8..726bb3dacd5b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 9 ++SUBLEVEL = 10 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index 460afa415434..d30a2e6e68b4 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -120,7 +120,7 @@ static void flush_dcache_range_chunked(unsigned long start, unsigned long stop, + unsigned long i; + + for (i = start; i < stop; i += chunk) { +- flush_dcache_range(i, min(stop, start + chunk)); ++ flush_dcache_range(i, min(stop, i + chunk)); + cond_resched(); + } + } diff --git a/patch/kernel/meson64-current/03-patch-5.4.10-11.patch b/patch/kernel/meson64-current/03-patch-5.4.10-11.patch new file mode 100644 index 0000000000..8989adcdac --- /dev/null +++ b/patch/kernel/meson64-current/03-patch-5.4.10-11.patch @@ -0,0 +1,5850 @@ +diff --git a/Makefile b/Makefile +index 726bb3dacd5b..e8963f623568 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 10 ++SUBLEVEL = 11 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/am335x-sancloud-bbe.dts b/arch/arm/boot/dts/am335x-sancloud-bbe.dts +index 8678e6e35493..e5fdb7abb0d5 100644 +--- a/arch/arm/boot/dts/am335x-sancloud-bbe.dts ++++ b/arch/arm/boot/dts/am335x-sancloud-bbe.dts +@@ -108,7 +108,7 @@ + + &cpsw_emac0 { + phy-handle = <ðphy0>; +- phy-mode = "rgmii-txid"; ++ phy-mode = "rgmii-id"; + }; + + &i2c0 { +diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts +index cae4500194fe..811c8cae315b 100644 +--- a/arch/arm/boot/dts/am437x-gp-evm.dts ++++ b/arch/arm/boot/dts/am437x-gp-evm.dts +@@ -86,7 +86,7 @@ + }; + + lcd0: display { +- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; ++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; + label = "lcd"; + + backlight = <&lcd_bl>; +diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts +index 95314121d111..078cb473fa7d 100644 +--- a/arch/arm/boot/dts/am43x-epos-evm.dts ++++ b/arch/arm/boot/dts/am43x-epos-evm.dts +@@ -42,7 +42,7 @@ + }; + + lcd0: display { +- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; ++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; + label = "lcd"; + + backlight = <&lcd_bl>; +diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi +index 2dac3efc7640..1bc45cfd5453 100644 +--- a/arch/arm/boot/dts/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi +@@ -174,8 +174,8 @@ + mdio: mdio@18002000 { + compatible = "brcm,iproc-mdio"; + reg = <0x18002000 0x8>; +- #size-cells = <1>; +- #address-cells = <0>; ++ #size-cells = <0>; ++ #address-cells = <1>; + status = "disabled"; + + gphy0: ethernet-phy@0 { +diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi +index 2d191fcbc2cc..90125ce19a1b 100644 +--- a/arch/arm/boot/dts/bcm283x.dtsi ++++ b/arch/arm/boot/dts/bcm283x.dtsi +@@ -40,7 +40,7 @@ + + trips { + cpu-crit { +- temperature = <80000>; ++ temperature = <90000>; + hysteresis = <0>; + type = "critical"; + }; +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 372dc1eb88a0..2d9b4dd05830 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -353,8 +353,8 @@ + mdio: mdio@18003000 { + compatible = "brcm,iproc-mdio"; + reg = <0x18003000 0x8>; +- #size-cells = <1>; +- #address-cells = <0>; ++ #size-cells = <0>; ++ #address-cells = <1>; + }; + + mdio-bus-mux@18003000 { +diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi +index c2a9dd57e56a..aa86341adaaa 100644 +--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi ++++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi +@@ -215,7 +215,7 @@ + flash0: n25q256a@0 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "micron,n25q256a"; ++ compatible = "micron,n25q256a", "jedec,spi-nor"; + spi-max-frequency = <29000000>; + spi-rx-bus-width = <4>; + spi-tx-bus-width = <4>; +diff --git a/arch/arm/configs/exynos_defconfig b/arch/arm/configs/exynos_defconfig +index 08db1c83eb2d..736ed7a7bcf8 100644 +--- a/arch/arm/configs/exynos_defconfig ++++ b/arch/arm/configs/exynos_defconfig +@@ -348,6 +348,7 @@ CONFIG_PRINTK_TIME=y + CONFIG_DYNAMIC_DEBUG=y + CONFIG_DEBUG_INFO=y + CONFIG_MAGIC_SYSRQ=y ++CONFIG_DEBUG_FS=y + CONFIG_DEBUG_KERNEL=y + CONFIG_SOFTLOCKUP_DETECTOR=y + # CONFIG_DETECT_HUNG_TASK is not set +diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig +index 0f7381ee0c37..dabb80453249 100644 +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -460,6 +460,7 @@ CONFIG_FONT_8x8=y + CONFIG_FONT_8x16=y + CONFIG_PRINTK_TIME=y + CONFIG_MAGIC_SYSRQ=y ++CONFIG_DEBUG_FS=y + # CONFIG_SCHED_DEBUG is not set + CONFIG_PROVE_LOCKING=y + # CONFIG_DEBUG_BUGVERBOSE is not set +diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig +index 40d7f1a4fc45..4ec69fb8a698 100644 +--- a/arch/arm/configs/omap2plus_defconfig ++++ b/arch/arm/configs/omap2plus_defconfig +@@ -552,5 +552,6 @@ CONFIG_DEBUG_INFO=y + CONFIG_DEBUG_INFO_SPLIT=y + CONFIG_DEBUG_INFO_DWARF4=y + CONFIG_MAGIC_SYSRQ=y ++CONFIG_DEBUG_FS=y + CONFIG_SCHEDSTATS=y + # CONFIG_DEBUG_BUGVERBOSE is not set +diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c +index 354e0e7025ae..1da11bdb1dfb 100644 +--- a/arch/arm/mach-vexpress/spc.c ++++ b/arch/arm/mach-vexpress/spc.c +@@ -551,8 +551,9 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev) + + static int __init ve_spc_clk_init(void) + { +- int cpu; ++ int cpu, cluster; + struct clk *clk; ++ bool init_opp_table[MAX_CLUSTERS] = { false }; + + if (!info) + return 0; /* Continue only if SPC is initialised */ +@@ -578,8 +579,17 @@ static int __init ve_spc_clk_init(void) + continue; + } + ++ cluster = topology_physical_package_id(cpu_dev->id); ++ if (init_opp_table[cluster]) ++ continue; ++ + if (ve_init_opp_table(cpu_dev)) + pr_warn("failed to initialise cpu%d opp table\n", cpu); ++ else if (dev_pm_opp_set_sharing_cpus(cpu_dev, ++ topology_core_cpumask(cpu_dev->id))) ++ pr_warn("failed to mark OPPs shared for cpu%d\n", cpu); ++ else ++ init_opp_table[cluster] = true; + } + + platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0); +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 72b9a75976a1..bb960fe2bb64 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -102,7 +102,7 @@ + + reboot { + compatible ="syscon-reboot"; +- regmap = <&dcfg>; ++ regmap = <&rst>; + offset = <0xb0>; + mask = <0x02>; + }; +@@ -161,6 +161,12 @@ + big-endian; + }; + ++ rst: syscon@1e60000 { ++ compatible = "syscon"; ++ reg = <0x0 0x1e60000 0x0 0x10000>; ++ little-endian; ++ }; ++ + scfg: syscon@1fc0000 { + compatible = "fsl,ls1028a-scfg", "syscon"; + reg = <0x0 0x1fc0000 0x0 0x10000>; +@@ -567,7 +573,7 @@ + 0x00010004 0x0000003d + 0x00010005 0x00000045 + 0x00010006 0x0000004d +- 0x00010007 0x00000045 ++ 0x00010007 0x00000055 + 0x00010008 0x0000005e + 0x00010009 0x00000066 + 0x0001000a 0x0000006e +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 93f34b4eca25..96f576e9ea46 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -575,6 +575,7 @@ static const struct midr_range spectre_v2_safe_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_A53), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A55), + MIDR_ALL_VERSIONS(MIDR_BRAHMA_B53), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + { /* sentinel */ } + }; + +diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c +index a2405d5f7d1e..561154cbcc40 100644 +--- a/arch/mips/net/ebpf_jit.c ++++ b/arch/mips/net/ebpf_jit.c +@@ -604,6 +604,7 @@ static void emit_const_to_reg(struct jit_ctx *ctx, int dst, u64 value) + static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx) + { + int off, b_off; ++ int tcc_reg; + + ctx->flags |= EBPF_SEEN_TC; + /* +@@ -616,14 +617,14 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx) + b_off = b_imm(this_idx + 1, ctx); + emit_instr(ctx, bne, MIPS_R_AT, MIPS_R_ZERO, b_off); + /* +- * if (--TCC < 0) ++ * if (TCC-- < 0) + * goto out; + */ + /* Delay slot */ +- emit_instr(ctx, daddiu, MIPS_R_T5, +- (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4, -1); ++ tcc_reg = (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4; ++ emit_instr(ctx, daddiu, MIPS_R_T5, tcc_reg, -1); + b_off = b_imm(this_idx + 1, ctx); +- emit_instr(ctx, bltz, MIPS_R_T5, b_off); ++ emit_instr(ctx, bltz, tcc_reg, b_off); + /* + * prog = array->ptrs[index]; + * if (prog == NULL) +diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h +index f627c37dad9c..ab5c215cf46c 100644 +--- a/arch/parisc/include/asm/cmpxchg.h ++++ b/arch/parisc/include/asm/cmpxchg.h +@@ -44,8 +44,14 @@ __xchg(unsigned long x, __volatile__ void *ptr, int size) + ** if (((unsigned long)p & 0xf) == 0) + ** return __ldcw(p); + */ +-#define xchg(ptr, x) \ +- ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) ++#define xchg(ptr, x) \ ++({ \ ++ __typeof__(*(ptr)) __ret; \ ++ __typeof__(*(ptr)) _x_ = (x); \ ++ __ret = (__typeof__(*(ptr))) \ ++ __xchg((unsigned long)_x_, (ptr), sizeof(*(ptr))); \ ++ __ret; \ ++}) + + /* bug catcher for when unsupported size is used - won't link */ + extern void __cmpxchg_called_with_bad_pointer(void); +diff --git a/arch/parisc/include/asm/kexec.h b/arch/parisc/include/asm/kexec.h +index a99ea747d7ed..87e174006995 100644 +--- a/arch/parisc/include/asm/kexec.h ++++ b/arch/parisc/include/asm/kexec.h +@@ -2,8 +2,6 @@ + #ifndef _ASM_PARISC_KEXEC_H + #define _ASM_PARISC_KEXEC_H + +-#ifdef CONFIG_KEXEC +- + /* Maximum physical address we can use pages from */ + #define KEXEC_SOURCE_MEMORY_LIMIT (-1UL) + /* Maximum address we can reach in physical address mode */ +@@ -32,6 +30,4 @@ static inline void crash_setup_regs(struct pt_regs *newregs, + + #endif /* __ASSEMBLY__ */ + +-#endif /* CONFIG_KEXEC */ +- + #endif /* _ASM_PARISC_KEXEC_H */ +diff --git a/arch/parisc/kernel/Makefile b/arch/parisc/kernel/Makefile +index 2663c8f8be11..068d90950d93 100644 +--- a/arch/parisc/kernel/Makefile ++++ b/arch/parisc/kernel/Makefile +@@ -37,5 +37,5 @@ obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o + obj-$(CONFIG_JUMP_LABEL) += jump_label.o + obj-$(CONFIG_KGDB) += kgdb.o + obj-$(CONFIG_KPROBES) += kprobes.o +-obj-$(CONFIG_KEXEC) += kexec.o relocate_kernel.o ++obj-$(CONFIG_KEXEC_CORE) += kexec.o relocate_kernel.o + obj-$(CONFIG_KEXEC_FILE) += kexec_file.o +diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c +index 3b330e58a4f0..a6c9f49c6612 100644 +--- a/arch/parisc/kernel/drivers.c ++++ b/arch/parisc/kernel/drivers.c +@@ -810,7 +810,7 @@ EXPORT_SYMBOL(device_to_hwpath); + static void walk_native_bus(unsigned long io_io_low, unsigned long io_io_high, + struct device *parent); + +-static void walk_lower_bus(struct parisc_device *dev) ++static void __init walk_lower_bus(struct parisc_device *dev) + { + unsigned long io_io_low, io_io_high; + +diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h +index e9a960e28f3c..d6102e34eb21 100644 +--- a/arch/powerpc/include/asm/spinlock.h ++++ b/arch/powerpc/include/asm/spinlock.h +@@ -15,6 +15,7 @@ + * + * (the type definitions are in asm/spinlock_types.h) + */ ++#include + #include + #ifdef CONFIG_PPC64 + #include +@@ -36,10 +37,12 @@ + #endif + + #ifdef CONFIG_PPC_PSERIES ++DECLARE_STATIC_KEY_FALSE(shared_processor); ++ + #define vcpu_is_preempted vcpu_is_preempted + static inline bool vcpu_is_preempted(int cpu) + { +- if (!firmware_has_feature(FW_FEATURE_SPLPAR)) ++ if (!static_branch_unlikely(&shared_processor)) + return false; + return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1); + } +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index d30a2e6e68b4..9f5b32163bda 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -282,6 +282,14 @@ void __init mem_init(void) + BUILD_BUG_ON(MMU_PAGE_COUNT > 16); + + #ifdef CONFIG_SWIOTLB ++ /* ++ * Some platforms (e.g. 85xx) limit DMA-able memory way below ++ * 4G. We force memblock to bottom-up mode to ensure that the ++ * memory allocated in swiotlb_init() is DMA-able. ++ * As it's the last memblock allocation, no need to reset it ++ * back to to-down. ++ */ ++ memblock_set_bottom_up(true); + swiotlb_init(0); + #endif + +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 0a40201f315f..0c8421dd01ab 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -74,6 +74,9 @@ + #include "pseries.h" + #include "../../../../drivers/pci/pci.h" + ++DEFINE_STATIC_KEY_FALSE(shared_processor); ++EXPORT_SYMBOL_GPL(shared_processor); ++ + int CMO_PrPSP = -1; + int CMO_SecPSP = -1; + unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K); +@@ -758,6 +761,10 @@ static void __init pSeries_setup_arch(void) + + if (firmware_has_feature(FW_FEATURE_LPAR)) { + vpa_init(boot_cpuid); ++ ++ if (lppaca_shared_proc(get_lppaca())) ++ static_branch_enable(&shared_processor); ++ + ppc_md.power_save = pseries_lpar_idle; + ppc_md.enable_pmcs = pseries_lpar_enable_pmcs; + #ifdef CONFIG_PCI_IOV +diff --git a/arch/riscv/net/bpf_jit_comp.c b/arch/riscv/net/bpf_jit_comp.c +index 5451ef3845f2..7fbf56aab661 100644 +--- a/arch/riscv/net/bpf_jit_comp.c ++++ b/arch/riscv/net/bpf_jit_comp.c +@@ -631,14 +631,14 @@ static int emit_bpf_tail_call(int insn, struct rv_jit_context *ctx) + return -1; + emit(rv_bgeu(RV_REG_A2, RV_REG_T1, off >> 1), ctx); + +- /* if (--TCC < 0) ++ /* if (TCC-- < 0) + * goto out; + */ + emit(rv_addi(RV_REG_T1, tcc, -1), ctx); + off = (tc_ninsn - (ctx->ninsns - start_insn)) << 2; + if (is_13b_check(off, insn)) + return -1; +- emit(rv_blt(RV_REG_T1, RV_REG_ZERO, off >> 1), ctx); ++ emit(rv_blt(tcc, RV_REG_ZERO, off >> 1), ctx); + + /* prog = array->ptrs[index]; + * if (!prog) +diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile +index bc0d7a0d0394..9de56065f28c 100644 +--- a/arch/s390/purgatory/Makefile ++++ b/arch/s390/purgatory/Makefile +@@ -15,8 +15,10 @@ CFLAGS_sha256.o := -D__DISABLE_EXPORTS + $(obj)/mem.o: $(srctree)/arch/s390/lib/mem.S FORCE + $(call if_changed_rule,as_o_S) + +-$(obj)/string.o: $(srctree)/arch/s390/lib/string.c FORCE +- $(call if_changed_rule,cc_o_c) ++KCOV_INSTRUMENT := n ++GCOV_PROFILE := n ++UBSAN_SANITIZE := n ++KASAN_SANITIZE := n + + KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes + KBUILD_CFLAGS += -Wno-pointer-sign -Wno-sign-compare +diff --git a/arch/s390/purgatory/string.c b/arch/s390/purgatory/string.c +new file mode 100644 +index 000000000000..c98c22a72db7 +--- /dev/null ++++ b/arch/s390/purgatory/string.c +@@ -0,0 +1,3 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#define __HAVE_ARCH_MEMCMP /* arch function */ ++#include "../lib/string.c" +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 7b21455d7504..e622158f5659 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -375,7 +375,7 @@ int x86_add_exclusive(unsigned int what) + * LBR and BTS are still mutually exclusive. + */ + if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt) +- return 0; ++ goto out; + + if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) { + mutex_lock(&pmc_reserve_mutex); +@@ -387,6 +387,7 @@ int x86_add_exclusive(unsigned int what) + mutex_unlock(&pmc_reserve_mutex); + } + ++out: + atomic_inc(&active_events); + return 0; + +@@ -397,11 +398,15 @@ fail_unlock: + + void x86_del_exclusive(unsigned int what) + { ++ atomic_dec(&active_events); ++ ++ /* ++ * See the comment in x86_add_exclusive(). ++ */ + if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt) + return; + + atomic_dec(&x86_pmu.lbr_exclusive[what]); +- atomic_dec(&active_events); + } + + int x86_setup_perfctr(struct perf_event *event) +@@ -1641,9 +1646,12 @@ static struct attribute_group x86_pmu_format_group __ro_after_init = { + + ssize_t events_sysfs_show(struct device *dev, struct device_attribute *attr, char *page) + { +- struct perf_pmu_events_attr *pmu_attr = \ ++ struct perf_pmu_events_attr *pmu_attr = + container_of(attr, struct perf_pmu_events_attr, attr); +- u64 config = x86_pmu.event_map(pmu_attr->id); ++ u64 config = 0; ++ ++ if (pmu_attr->id < x86_pmu.max_events) ++ config = x86_pmu.event_map(pmu_attr->id); + + /* string trumps id */ + if (pmu_attr->event_str) +@@ -1712,6 +1720,9 @@ is_visible(struct kobject *kobj, struct attribute *attr, int idx) + { + struct perf_pmu_events_attr *pmu_attr; + ++ if (idx >= x86_pmu.max_events) ++ return 0; ++ + pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr.attr); + /* str trumps id */ + return pmu_attr->event_str || x86_pmu.event_map(idx) ? attr->mode : 0; +diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c +index 606711f5ebf8..2f9ec14be3b1 100644 +--- a/arch/x86/kernel/early-quirks.c ++++ b/arch/x86/kernel/early-quirks.c +@@ -714,6 +714,8 @@ static struct chipset early_qrk[] __initdata = { + PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, + { PCI_VENDOR_ID_INTEL, 0x3ec4, + PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, ++ { PCI_VENDOR_ID_INTEL, 0x8a12, ++ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, + { PCI_VENDOR_ID_BROADCOM, 0x4331, + PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset}, + {} +diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c +index 3b9fd679cea9..aefe845dff59 100644 +--- a/arch/x86/platform/efi/quirks.c ++++ b/arch/x86/platform/efi/quirks.c +@@ -260,10 +260,6 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size) + return; + } + +- /* No need to reserve regions that will never be freed. */ +- if (md.attribute & EFI_MEMORY_RUNTIME) +- return; +- + size += addr % EFI_PAGE_SIZE; + size = round_up(size, EFI_PAGE_SIZE); + addr = round_down(addr, EFI_PAGE_SIZE); +@@ -293,6 +289,8 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size) + early_memunmap(new, new_size); + + efi_memmap_install(new_phys, num_entries); ++ e820__range_update(addr, size, E820_TYPE_RAM, E820_TYPE_RESERVED); ++ e820__update_table(e820_table); + } + + /* +diff --git a/block/blk-core.c b/block/blk-core.c +index d5e668ec751b..1075aaff606d 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -886,11 +886,14 @@ generic_make_request_checks(struct bio *bio) + } + + /* +- * For a REQ_NOWAIT based request, return -EOPNOTSUPP +- * if queue is not a request based queue. ++ * Non-mq queues do not honor REQ_NOWAIT, so complete a bio ++ * with BLK_STS_AGAIN status in order to catch -EAGAIN and ++ * to give a chance to the caller to repeat request gracefully. + */ +- if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q)) +- goto not_supported; ++ if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q)) { ++ status = BLK_STS_AGAIN; ++ goto end_io; ++ } + + if (should_fail_bio(bio)) + goto end_io; +diff --git a/block/blk-flush.c b/block/blk-flush.c +index 1eec9cbe5a0a..b1f0a1ac505c 100644 +--- a/block/blk-flush.c ++++ b/block/blk-flush.c +@@ -69,6 +69,7 @@ + #include + #include + #include ++#include + + #include "blk.h" + #include "blk-mq.h" +@@ -492,6 +493,9 @@ struct blk_flush_queue *blk_alloc_flush_queue(struct request_queue *q, + INIT_LIST_HEAD(&fq->flush_queue[1]); + INIT_LIST_HEAD(&fq->flush_data_in_flight); + ++ lockdep_register_key(&fq->key); ++ lockdep_set_class(&fq->mq_flush_lock, &fq->key); ++ + return fq; + + fail_rq: +@@ -506,6 +510,7 @@ void blk_free_flush_queue(struct blk_flush_queue *fq) + if (!fq) + return; + ++ lockdep_unregister_key(&fq->key); + kfree(fq->flush_rq); + kfree(fq); + } +diff --git a/block/blk-map.c b/block/blk-map.c +index 3a62e471d81b..b0790268ed9d 100644 +--- a/block/blk-map.c ++++ b/block/blk-map.c +@@ -151,7 +151,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, + return 0; + + unmap_rq: +- __blk_rq_unmap_user(bio); ++ blk_rq_unmap_user(bio); + fail: + rq->bio = NULL; + return ret; +diff --git a/block/blk.h b/block/blk.h +index 47fba9362e60..ffea1691470e 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -30,6 +30,7 @@ struct blk_flush_queue { + * at the same time + */ + struct request *orig_rq; ++ struct lock_class_key key; + spinlock_t mq_flush_lock; + }; + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 2b6670daf7fc..34bd9bf4e68a 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1594,6 +1594,10 @@ static int sysc_reset(struct sysc *ddata) + sysc_val |= sysc_mask; + sysc_write(ddata, sysc_offset, sysc_val); + ++ if (ddata->cfg.srst_udelay) ++ usleep_range(ddata->cfg.srst_udelay, ++ ddata->cfg.srst_udelay * 2); ++ + if (ddata->clk_enable_quirk) + ddata->clk_enable_quirk(ddata); + +diff --git a/drivers/char/tpm/tpm_ftpm_tee.c b/drivers/char/tpm/tpm_ftpm_tee.c +index 6640a14dbe48..22bf553ccf9d 100644 +--- a/drivers/char/tpm/tpm_ftpm_tee.c ++++ b/drivers/char/tpm/tpm_ftpm_tee.c +@@ -32,7 +32,7 @@ static const uuid_t ftpm_ta_uuid = + 0x82, 0xCB, 0x34, 0x3F, 0xB7, 0xF3, 0x78, 0x96); + + /** +- * ftpm_tee_tpm_op_recv - retrieve fTPM response. ++ * ftpm_tee_tpm_op_recv() - retrieve fTPM response. + * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h. + * @buf: the buffer to store data. + * @count: the number of bytes to read. +@@ -61,7 +61,7 @@ static int ftpm_tee_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count) + } + + /** +- * ftpm_tee_tpm_op_send - send TPM commands through the TEE shared memory. ++ * ftpm_tee_tpm_op_send() - send TPM commands through the TEE shared memory. + * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h + * @buf: the buffer to send. + * @len: the number of bytes to send. +@@ -208,7 +208,7 @@ static int ftpm_tee_match(struct tee_ioctl_version_data *ver, const void *data) + } + + /** +- * ftpm_tee_probe - initialize the fTPM ++ * ftpm_tee_probe() - initialize the fTPM + * @pdev: the platform_device description. + * + * Return: +@@ -298,7 +298,7 @@ out_tee_session: + } + + /** +- * ftpm_tee_remove - remove the TPM device ++ * ftpm_tee_remove() - remove the TPM device + * @pdev: the platform_device description. + * + * Return: +@@ -328,6 +328,19 @@ static int ftpm_tee_remove(struct platform_device *pdev) + return 0; + } + ++/** ++ * ftpm_tee_shutdown() - shutdown the TPM device ++ * @pdev: the platform_device description. ++ */ ++static void ftpm_tee_shutdown(struct platform_device *pdev) ++{ ++ struct ftpm_tee_private *pvt_data = dev_get_drvdata(&pdev->dev); ++ ++ tee_shm_free(pvt_data->shm); ++ tee_client_close_session(pvt_data->ctx, pvt_data->session); ++ tee_client_close_context(pvt_data->ctx); ++} ++ + static const struct of_device_id of_ftpm_tee_ids[] = { + { .compatible = "microsoft,ftpm" }, + { } +@@ -341,6 +354,7 @@ static struct platform_driver ftpm_tee_driver = { + }, + .probe = ftpm_tee_probe, + .remove = ftpm_tee_remove, ++ .shutdown = ftpm_tee_shutdown, + }; + + module_platform_driver(ftpm_tee_driver); +diff --git a/drivers/clk/at91/at91sam9260.c b/drivers/clk/at91/at91sam9260.c +index 0aabe49aed09..a9d4234758d7 100644 +--- a/drivers/clk/at91/at91sam9260.c ++++ b/drivers/clk/at91/at91sam9260.c +@@ -348,7 +348,7 @@ static void __init at91sam926x_pmc_setup(struct device_node *np, + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/clk/at91/at91sam9rl.c b/drivers/clk/at91/at91sam9rl.c +index 0ac34cdaa106..77fe83a73bf4 100644 +--- a/drivers/clk/at91/at91sam9rl.c ++++ b/drivers/clk/at91/at91sam9rl.c +@@ -83,7 +83,7 @@ static void __init at91sam9rl_pmc_setup(struct device_node *np) + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/clk/at91/at91sam9x5.c b/drivers/clk/at91/at91sam9x5.c +index 0855f3a80cc7..086cf0b4955c 100644 +--- a/drivers/clk/at91/at91sam9x5.c ++++ b/drivers/clk/at91/at91sam9x5.c +@@ -146,7 +146,7 @@ static void __init at91sam9x5_pmc_setup(struct device_node *np, + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/clk/at91/pmc.c b/drivers/clk/at91/pmc.c +index 0b03cfae3a9d..b71515acdec1 100644 +--- a/drivers/clk/at91/pmc.c ++++ b/drivers/clk/at91/pmc.c +@@ -275,7 +275,7 @@ static int __init pmc_register_ops(void) + + np = of_find_matching_node(NULL, sama5d2_pmc_dt_ids); + +- pmcreg = syscon_node_to_regmap(np); ++ pmcreg = device_node_to_regmap(np); + if (IS_ERR(pmcreg)) + return PTR_ERR(pmcreg); + +diff --git a/drivers/clk/at91/sama5d2.c b/drivers/clk/at91/sama5d2.c +index 0de1108737db..ff7e3f727082 100644 +--- a/drivers/clk/at91/sama5d2.c ++++ b/drivers/clk/at91/sama5d2.c +@@ -162,7 +162,7 @@ static void __init sama5d2_pmc_setup(struct device_node *np) + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/clk/at91/sama5d4.c b/drivers/clk/at91/sama5d4.c +index 25b156d4e645..a6dee4a3b6e4 100644 +--- a/drivers/clk/at91/sama5d4.c ++++ b/drivers/clk/at91/sama5d4.c +@@ -136,7 +136,7 @@ static void __init sama5d4_pmc_setup(struct device_node *np) + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/firmware/efi/earlycon.c b/drivers/firmware/efi/earlycon.c +index c9a0efca17b0..d4077db6dc97 100644 +--- a/drivers/firmware/efi/earlycon.c ++++ b/drivers/firmware/efi/earlycon.c +@@ -13,18 +13,57 @@ + + #include + ++static const struct console *earlycon_console __initdata; + static const struct font_desc *font; + static u32 efi_x, efi_y; + static u64 fb_base; + static pgprot_t fb_prot; ++static void *efi_fb; ++ ++/* ++ * EFI earlycon needs to use early_memremap() to map the framebuffer. ++ * But early_memremap() is not usable for 'earlycon=efifb keep_bootcon', ++ * memremap() should be used instead. memremap() will be available after ++ * paging_init() which is earlier than initcall callbacks. Thus adding this ++ * early initcall function early_efi_map_fb() to map the whole EFI framebuffer. ++ */ ++static int __init efi_earlycon_remap_fb(void) ++{ ++ /* bail if there is no bootconsole or it has been disabled already */ ++ if (!earlycon_console || !(earlycon_console->flags & CON_ENABLED)) ++ return 0; ++ ++ if (pgprot_val(fb_prot) == pgprot_val(PAGE_KERNEL)) ++ efi_fb = memremap(fb_base, screen_info.lfb_size, MEMREMAP_WB); ++ else ++ efi_fb = memremap(fb_base, screen_info.lfb_size, MEMREMAP_WC); ++ ++ return efi_fb ? 0 : -ENOMEM; ++} ++early_initcall(efi_earlycon_remap_fb); ++ ++static int __init efi_earlycon_unmap_fb(void) ++{ ++ /* unmap the bootconsole fb unless keep_bootcon has left it enabled */ ++ if (efi_fb && !(earlycon_console->flags & CON_ENABLED)) ++ memunmap(efi_fb); ++ return 0; ++} ++late_initcall(efi_earlycon_unmap_fb); + + static __ref void *efi_earlycon_map(unsigned long start, unsigned long len) + { ++ if (efi_fb) ++ return efi_fb + start; ++ + return early_memremap_prot(fb_base + start, len, pgprot_val(fb_prot)); + } + + static __ref void efi_earlycon_unmap(void *addr, unsigned long len) + { ++ if (efi_fb) ++ return; ++ + early_memunmap(addr, len); + } + +@@ -201,6 +240,7 @@ static int __init efi_earlycon_setup(struct earlycon_device *device, + efi_earlycon_scroll_up(); + + device->con->write = efi_earlycon_write; ++ earlycon_console = device->con; + return 0; + } + EARLYCON_DECLARE(efifb, efi_earlycon_setup); +diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c +index 0101ca4c13b1..b7bf1e993b8b 100644 +--- a/drivers/firmware/efi/libstub/gop.c ++++ b/drivers/firmware/efi/libstub/gop.c +@@ -83,30 +83,6 @@ setup_pixel_info(struct screen_info *si, u32 pixels_per_scan_line, + } + } + +-static efi_status_t +-__gop_query32(efi_system_table_t *sys_table_arg, +- struct efi_graphics_output_protocol_32 *gop32, +- struct efi_graphics_output_mode_info **info, +- unsigned long *size, u64 *fb_base) +-{ +- struct efi_graphics_output_protocol_mode_32 *mode; +- efi_graphics_output_protocol_query_mode query_mode; +- efi_status_t status; +- unsigned long m; +- +- m = gop32->mode; +- mode = (struct efi_graphics_output_protocol_mode_32 *)m; +- query_mode = (void *)(unsigned long)gop32->query_mode; +- +- status = __efi_call_early(query_mode, (void *)gop32, mode->mode, size, +- info); +- if (status != EFI_SUCCESS) +- return status; +- +- *fb_base = mode->frame_buffer_base; +- return status; +-} +- + static efi_status_t + setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + efi_guid_t *proto, unsigned long size, void **gop_handle) +@@ -119,7 +95,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + u64 fb_base; + struct efi_pixel_bitmask pixel_info; + int pixel_format; +- efi_status_t status = EFI_NOT_FOUND; ++ efi_status_t status; + u32 *handles = (u32 *)(unsigned long)gop_handle; + int i; + +@@ -128,6 +104,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + + nr_gops = size / sizeof(u32); + for (i = 0; i < nr_gops; i++) { ++ struct efi_graphics_output_protocol_mode_32 *mode; + struct efi_graphics_output_mode_info *info = NULL; + efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID; + bool conout_found = false; +@@ -145,9 +122,11 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + if (status == EFI_SUCCESS) + conout_found = true; + +- status = __gop_query32(sys_table_arg, gop32, &info, &size, +- ¤t_fb_base); +- if (status == EFI_SUCCESS && (!first_gop || conout_found) && ++ mode = (void *)(unsigned long)gop32->mode; ++ info = (void *)(unsigned long)mode->info; ++ current_fb_base = mode->frame_buffer_base; ++ ++ if ((!first_gop || conout_found) && + info->pixel_format != PIXEL_BLT_ONLY) { + /* + * Systems that use the UEFI Console Splitter may +@@ -175,7 +154,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + + /* Did we find any GOPs? */ + if (!first_gop) +- goto out; ++ return EFI_NOT_FOUND; + + /* EFI framebuffer */ + si->orig_video_isVGA = VIDEO_TYPE_EFI; +@@ -197,32 +176,8 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + si->lfb_size = si->lfb_linelength * si->lfb_height; + + si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS; +-out: +- return status; +-} +- +-static efi_status_t +-__gop_query64(efi_system_table_t *sys_table_arg, +- struct efi_graphics_output_protocol_64 *gop64, +- struct efi_graphics_output_mode_info **info, +- unsigned long *size, u64 *fb_base) +-{ +- struct efi_graphics_output_protocol_mode_64 *mode; +- efi_graphics_output_protocol_query_mode query_mode; +- efi_status_t status; +- unsigned long m; +- +- m = gop64->mode; +- mode = (struct efi_graphics_output_protocol_mode_64 *)m; +- query_mode = (void *)(unsigned long)gop64->query_mode; +- +- status = __efi_call_early(query_mode, (void *)gop64, mode->mode, size, +- info); +- if (status != EFI_SUCCESS) +- return status; + +- *fb_base = mode->frame_buffer_base; +- return status; ++ return EFI_SUCCESS; + } + + static efi_status_t +@@ -237,7 +192,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + u64 fb_base; + struct efi_pixel_bitmask pixel_info; + int pixel_format; +- efi_status_t status = EFI_NOT_FOUND; ++ efi_status_t status; + u64 *handles = (u64 *)(unsigned long)gop_handle; + int i; + +@@ -246,6 +201,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + + nr_gops = size / sizeof(u64); + for (i = 0; i < nr_gops; i++) { ++ struct efi_graphics_output_protocol_mode_64 *mode; + struct efi_graphics_output_mode_info *info = NULL; + efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID; + bool conout_found = false; +@@ -263,9 +219,11 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + if (status == EFI_SUCCESS) + conout_found = true; + +- status = __gop_query64(sys_table_arg, gop64, &info, &size, +- ¤t_fb_base); +- if (status == EFI_SUCCESS && (!first_gop || conout_found) && ++ mode = (void *)(unsigned long)gop64->mode; ++ info = (void *)(unsigned long)mode->info; ++ current_fb_base = mode->frame_buffer_base; ++ ++ if ((!first_gop || conout_found) && + info->pixel_format != PIXEL_BLT_ONLY) { + /* + * Systems that use the UEFI Console Splitter may +@@ -293,7 +251,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + + /* Did we find any GOPs? */ + if (!first_gop) +- goto out; ++ return EFI_NOT_FOUND; + + /* EFI framebuffer */ + si->orig_video_isVGA = VIDEO_TYPE_EFI; +@@ -315,8 +273,8 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + si->lfb_size = si->lfb_linelength * si->lfb_height; + + si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS; +-out: +- return status; ++ ++ return EFI_SUCCESS; + } + + /* +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index 80ea49f570f4..43ffec3a6fbb 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -23,6 +23,29 @@ + #include "gpiolib.h" + #include "gpiolib-of.h" + ++/** ++ * of_gpio_spi_cs_get_count() - special GPIO counting for SPI ++ * Some elder GPIO controllers need special quirks. Currently we handle ++ * the Freescale GPIO controller with bindings that doesn't use the ++ * established "cs-gpios" for chip selects but instead rely on ++ * "gpios" for the chip select lines. If we detect this, we redirect ++ * the counting of "cs-gpios" to count "gpios" transparent to the ++ * driver. ++ */ ++int of_gpio_spi_cs_get_count(struct device *dev, const char *con_id) ++{ ++ struct device_node *np = dev->of_node; ++ ++ if (!IS_ENABLED(CONFIG_SPI_MASTER)) ++ return 0; ++ if (!con_id || strcmp(con_id, "cs")) ++ return 0; ++ if (!of_device_is_compatible(np, "fsl,spi") && ++ !of_device_is_compatible(np, "aeroflexgaisler,spictrl")) ++ return 0; ++ return of_gpio_named_count(np, "gpios"); ++} ++ + /* + * This is used by external users of of_gpio_count() from + * +@@ -35,6 +58,10 @@ int of_gpio_get_count(struct device *dev, const char *con_id) + char propname[32]; + unsigned int i; + ++ ret = of_gpio_spi_cs_get_count(dev, con_id); ++ if (ret > 0) ++ return ret; ++ + for (i = 0; i < ARRAY_SIZE(gpio_suffixes); i++) { + if (con_id) + snprintf(propname, sizeof(propname), "%s-%s", +diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +index 7ae087b0504d..88b6fcaa20be 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +@@ -1313,6 +1313,7 @@ static int gsc_remove(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + ++ component_del(dev, &gsc_component_ops); + pm_runtime_dont_use_autosuspend(dev); + pm_runtime_disable(dev); + +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index f321279baf9e..51456e7f264f 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -43,7 +44,6 @@ struct iommu_dma_cookie { + dma_addr_t msi_iova; + }; + struct list_head msi_page_list; +- spinlock_t msi_lock; + + /* Domain for flush queue callback; NULL if flush queue not in use */ + struct iommu_domain *fq_domain; +@@ -62,7 +62,6 @@ static struct iommu_dma_cookie *cookie_alloc(enum iommu_dma_cookie_type type) + + cookie = kzalloc(sizeof(*cookie), GFP_KERNEL); + if (cookie) { +- spin_lock_init(&cookie->msi_lock); + INIT_LIST_HEAD(&cookie->msi_page_list); + cookie->type = type; + } +@@ -1150,7 +1149,7 @@ static struct iommu_dma_msi_page *iommu_dma_get_msi_page(struct device *dev, + if (msi_page->phys == msi_addr) + return msi_page; + +- msi_page = kzalloc(sizeof(*msi_page), GFP_ATOMIC); ++ msi_page = kzalloc(sizeof(*msi_page), GFP_KERNEL); + if (!msi_page) + return NULL; + +@@ -1180,7 +1179,7 @@ int iommu_dma_prepare_msi(struct msi_desc *desc, phys_addr_t msi_addr) + struct iommu_domain *domain = iommu_get_domain_for_dev(dev); + struct iommu_dma_cookie *cookie; + struct iommu_dma_msi_page *msi_page; +- unsigned long flags; ++ static DEFINE_MUTEX(msi_prepare_lock); /* see below */ + + if (!domain || !domain->iova_cookie) { + desc->iommu_cookie = NULL; +@@ -1190,13 +1189,13 @@ int iommu_dma_prepare_msi(struct msi_desc *desc, phys_addr_t msi_addr) + cookie = domain->iova_cookie; + + /* +- * We disable IRQs to rule out a possible inversion against +- * irq_desc_lock if, say, someone tries to retarget the affinity +- * of an MSI from within an IPI handler. ++ * In fact the whole prepare operation should already be serialised by ++ * irq_domain_mutex further up the callchain, but that's pretty subtle ++ * on its own, so consider this locking as failsafe documentation... + */ +- spin_lock_irqsave(&cookie->msi_lock, flags); ++ mutex_lock(&msi_prepare_lock); + msi_page = iommu_dma_get_msi_page(dev, msi_addr, domain); +- spin_unlock_irqrestore(&cookie->msi_lock, flags); ++ mutex_unlock(&msi_prepare_lock); + + msi_desc_set_iommu_cookie(desc, msi_page); + +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index 41c605b0058f..c7a914b9bbbc 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -233,7 +233,7 @@ static DEFINE_MUTEX(iova_cache_mutex); + + struct iova *alloc_iova_mem(void) + { +- return kmem_cache_alloc(iova_cache, GFP_ATOMIC); ++ return kmem_cache_zalloc(iova_cache, GFP_ATOMIC); + } + EXPORT_SYMBOL(alloc_iova_mem); + +diff --git a/drivers/misc/habanalabs/command_submission.c b/drivers/misc/habanalabs/command_submission.c +index a9ac045dcfde..447f307ef4d6 100644 +--- a/drivers/misc/habanalabs/command_submission.c ++++ b/drivers/misc/habanalabs/command_submission.c +@@ -777,8 +777,9 @@ int hl_cs_wait_ioctl(struct hl_fpriv *hpriv, void *data) + memset(args, 0, sizeof(*args)); + + if (rc < 0) { +- dev_err(hdev->dev, "Error %ld on waiting for CS handle %llu\n", +- rc, seq); ++ dev_err_ratelimited(hdev->dev, ++ "Error %ld on waiting for CS handle %llu\n", ++ rc, seq); + if (rc == -ERESTARTSYS) { + args->out.status = HL_WAIT_CS_STATUS_INTERRUPTED; + rc = -EINTR; +diff --git a/drivers/misc/habanalabs/context.c b/drivers/misc/habanalabs/context.c +index 17db7b3dfb4c..2df6fb87e7ff 100644 +--- a/drivers/misc/habanalabs/context.c ++++ b/drivers/misc/habanalabs/context.c +@@ -176,7 +176,7 @@ struct dma_fence *hl_ctx_get_fence(struct hl_ctx *ctx, u64 seq) + spin_lock(&ctx->cs_lock); + + if (seq >= ctx->cs_sequence) { +- dev_notice(hdev->dev, ++ dev_notice_ratelimited(hdev->dev, + "Can't wait on seq %llu because current CS is at seq %llu\n", + seq, ctx->cs_sequence); + spin_unlock(&ctx->cs_lock); +diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c +index 6fba14b81f90..fe3574a83b7c 100644 +--- a/drivers/misc/habanalabs/goya/goya.c ++++ b/drivers/misc/habanalabs/goya/goya.c +@@ -2171,7 +2171,7 @@ static int goya_push_linux_to_device(struct hl_device *hdev) + + static int goya_pldm_init_cpu(struct hl_device *hdev) + { +- u32 val, unit_rst_val; ++ u32 unit_rst_val; + int rc; + + /* Must initialize SRAM scrambler before pushing u-boot to SRAM */ +@@ -2179,14 +2179,14 @@ static int goya_pldm_init_cpu(struct hl_device *hdev) + + /* Put ARM cores into reset */ + WREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL, CPU_RESET_ASSERT); +- val = RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL); ++ RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL); + + /* Reset the CA53 MACRO */ + unit_rst_val = RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); + WREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N, CA53_RESET); +- val = RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); ++ RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); + WREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N, unit_rst_val); +- val = RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); ++ RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); + + rc = goya_push_uboot_to_device(hdev); + if (rc) +@@ -2207,7 +2207,7 @@ static int goya_pldm_init_cpu(struct hl_device *hdev) + /* Release ARM core 0 from reset */ + WREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL, + CPU_RESET_CORE0_DEASSERT); +- val = RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL); ++ RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL); + + return 0; + } +@@ -2475,13 +2475,12 @@ err: + static int goya_hw_init(struct hl_device *hdev) + { + struct asic_fixed_properties *prop = &hdev->asic_prop; +- u32 val; + int rc; + + dev_info(hdev->dev, "Starting initialization of H/W\n"); + + /* Perform read from the device to make sure device is up */ +- val = RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG); ++ RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG); + + /* + * Let's mark in the H/W that we have reached this point. We check +@@ -2533,7 +2532,7 @@ static int goya_hw_init(struct hl_device *hdev) + goto disable_queues; + + /* Perform read from the device to flush all MSI-X configuration */ +- val = RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG); ++ RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG); + + return 0; + +diff --git a/drivers/misc/ocxl/context.c b/drivers/misc/ocxl/context.c +index 994563a078eb..de8a66b9d76b 100644 +--- a/drivers/misc/ocxl/context.c ++++ b/drivers/misc/ocxl/context.c +@@ -10,18 +10,17 @@ int ocxl_context_alloc(struct ocxl_context **context, struct ocxl_afu *afu, + int pasid; + struct ocxl_context *ctx; + +- *context = kzalloc(sizeof(struct ocxl_context), GFP_KERNEL); +- if (!*context) ++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); ++ if (!ctx) + return -ENOMEM; + +- ctx = *context; +- + ctx->afu = afu; + mutex_lock(&afu->contexts_lock); + pasid = idr_alloc(&afu->contexts_idr, ctx, afu->pasid_base, + afu->pasid_base + afu->pasid_max, GFP_KERNEL); + if (pasid < 0) { + mutex_unlock(&afu->contexts_lock); ++ kfree(ctx); + return pasid; + } + afu->pasid_count++; +@@ -43,6 +42,7 @@ int ocxl_context_alloc(struct ocxl_context **context, struct ocxl_afu *afu, + * duration of the life of the context + */ + ocxl_afu_get(afu); ++ *context = ctx; + return 0; + } + EXPORT_SYMBOL_GPL(ocxl_context_alloc); +diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c +index 25ec4c0ac589..8a903624fdd7 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.c ++++ b/drivers/net/dsa/mv88e6xxx/global1.c +@@ -332,6 +332,11 @@ int mv88e6390_g1_set_cpu_port(struct mv88e6xxx_chip *chip, int port) + { + u16 ptr = MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST; + ++ /* Use the default high priority for management frames sent to ++ * the CPU. ++ */ ++ port |= MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST_MGMTPRI; ++ + return mv88e6390_g1_monitor_write(chip, ptr, port); + } + +diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h +index 0870fcc8bfc8..0ae96a1e919b 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.h ++++ b/drivers/net/dsa/mv88e6xxx/global1.h +@@ -210,6 +210,7 @@ + #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_INGRESS_DEST 0x2000 + #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_EGRESS_DEST 0x2100 + #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST 0x3000 ++#define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST_MGMTPRI 0x00e0 + #define MV88E6390_G1_MONITOR_MGMT_CTL_DATA_MASK 0x00ff + + /* Offset 0x1C: Global Control 2 */ +diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c +index 15ef81654b67..330c41e87171 100644 +--- a/drivers/net/dsa/mv88e6xxx/port.c ++++ b/drivers/net/dsa/mv88e6xxx/port.c +@@ -393,7 +393,7 @@ phy_interface_t mv88e6390x_port_max_speed_mode(int port) + } + + static int mv88e6xxx_port_set_cmode(struct mv88e6xxx_chip *chip, int port, +- phy_interface_t mode) ++ phy_interface_t mode, bool force) + { + u8 lane; + u16 cmode; +@@ -427,8 +427,8 @@ static int mv88e6xxx_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + cmode = 0; + } + +- /* cmode doesn't change, nothing to do for us */ +- if (cmode == chip->ports[port].cmode) ++ /* cmode doesn't change, nothing to do for us unless forced */ ++ if (cmode == chip->ports[port].cmode && !force) + return 0; + + lane = mv88e6xxx_serdes_get_lane(chip, port); +@@ -484,7 +484,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + if (port != 9 && port != 10) + return -EOPNOTSUPP; + +- return mv88e6xxx_port_set_cmode(chip, port, mode); ++ return mv88e6xxx_port_set_cmode(chip, port, mode, false); + } + + int mv88e6390_port_set_cmode(struct mv88e6xxx_chip *chip, int port, +@@ -504,7 +504,7 @@ int mv88e6390_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + break; + } + +- return mv88e6xxx_port_set_cmode(chip, port, mode); ++ return mv88e6xxx_port_set_cmode(chip, port, mode, false); + } + + static int mv88e6341_port_set_cmode_writable(struct mv88e6xxx_chip *chip, +@@ -555,7 +555,7 @@ int mv88e6341_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + if (err) + return err; + +- return mv88e6xxx_port_set_cmode(chip, port, mode); ++ return mv88e6xxx_port_set_cmode(chip, port, mode, true); + } + + int mv88e6185_port_get_cmode(struct mv88e6xxx_chip *chip, int port, u8 *cmode) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +index 8b08cb18e363..3f63ffd7561b 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +@@ -1109,7 +1109,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp) + for (i = 0; i < E1H_FUNC_MAX / 2; i++) { + u32 func_config = + MF_CFG_RD(bp, +- func_mf_config[BP_PORT(bp) + 2 * i]. ++ func_mf_config[BP_PATH(bp) + 2 * i]. + config); + func_num += + ((func_config & FUNC_MF_CFG_FUNC_HIDE) ? 0 : 1); +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 192ff8d5da32..cff64e43bdd8 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9976,10 +9976,18 @@ static void bnx2x_recovery_failed(struct bnx2x *bp) + */ + static void bnx2x_parity_recover(struct bnx2x *bp) + { +- bool global = false; + u32 error_recovered, error_unrecovered; +- bool is_parity; ++ bool is_parity, global = false; ++#ifdef CONFIG_BNX2X_SRIOV ++ int vf_idx; ++ ++ for (vf_idx = 0; vf_idx < bp->requested_nr_virtfn; vf_idx++) { ++ struct bnx2x_virtf *vf = BP_VF(bp, vf_idx); + ++ if (vf) ++ vf->state = VF_LOST; ++ } ++#endif + DP(NETIF_MSG_HW, "Handling parity\n"); + while (1) { + switch (bp->recovery_state) { +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +index b6ebd92ec565..3a716c015415 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +@@ -139,6 +139,7 @@ struct bnx2x_virtf { + #define VF_ACQUIRED 1 /* VF acquired, but not initialized */ + #define VF_ENABLED 2 /* VF Enabled */ + #define VF_RESET 3 /* VF FLR'd, pending cleanup */ ++#define VF_LOST 4 /* Recovery while VFs are loaded */ + + bool flr_clnup_stage; /* true during flr cleanup */ + bool malicious; /* true if FW indicated so, until FLR */ +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +index 0752b7fa4d9c..ea0e9394f898 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +@@ -2107,6 +2107,18 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf, + { + int i; + ++ if (vf->state == VF_LOST) { ++ /* Just ack the FW and return if VFs are lost ++ * in case of parity error. VFs are supposed to be timedout ++ * on waiting for PF response. ++ */ ++ DP(BNX2X_MSG_IOV, ++ "VF 0x%x lost, not handling the request\n", vf->abs_vfid); ++ ++ storm_memset_vf_mbx_ack(bp, vf->abs_vfid); ++ return; ++ } ++ + /* check if tlv type is known */ + if (bnx2x_tlv_supported(mbx->first_tlv.tl.type)) { + /* Lock the per vf op mutex and note the locker's identity. +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 0f10a272827c..f496b248bda3 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -4027,7 +4027,7 @@ static int fu540_c000_clk_init(struct platform_device *pdev, struct clk **pclk, + mgmt->rate = 0; + mgmt->hw.init = &init; + +- *tx_clk = clk_register(NULL, &mgmt->hw); ++ *tx_clk = devm_clk_register(&pdev->dev, &mgmt->hw); + if (IS_ERR(*tx_clk)) + return PTR_ERR(*tx_clk); + +@@ -4361,7 +4361,6 @@ err_out_free_netdev: + + err_disable_clocks: + clk_disable_unprepare(tx_clk); +- clk_unregister(tx_clk); + clk_disable_unprepare(hclk); + clk_disable_unprepare(pclk); + clk_disable_unprepare(rx_clk); +@@ -4397,7 +4396,6 @@ static int macb_remove(struct platform_device *pdev) + pm_runtime_dont_use_autosuspend(&pdev->dev); + if (!pm_runtime_suspended(&pdev->dev)) { + clk_disable_unprepare(bp->tx_clk); +- clk_unregister(bp->tx_clk); + clk_disable_unprepare(bp->hclk); + clk_disable_unprepare(bp->pclk); + clk_disable_unprepare(bp->rx_clk); +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +index ae6a47dd7dc9..fb8ade9a05a9 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +@@ -2996,6 +2996,9 @@ static int sge_queue_entries(const struct adapter *adap) + int tot_uld_entries = 0; + int i; + ++ if (!is_uld(adap)) ++ goto lld_only; ++ + mutex_lock(&uld_mutex); + for (i = 0; i < CXGB4_TX_MAX; i++) + tot_uld_entries += sge_qinfo_uld_txq_entries(adap, i); +@@ -3006,6 +3009,7 @@ static int sge_queue_entries(const struct adapter *adap) + } + mutex_unlock(&uld_mutex); + ++lld_only: + return DIV_ROUND_UP(adap->sge.ethqsets, 4) + + tot_uld_entries + + DIV_ROUND_UP(MAX_CTRL_QUEUES, 4) + 1; +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 4bb30761abfc..8336f4cbaf95 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -2199,8 +2199,14 @@ static void fec_enet_get_regs(struct net_device *ndev, + { + struct fec_enet_private *fep = netdev_priv(ndev); + u32 __iomem *theregs = (u32 __iomem *)fep->hwp; ++ struct device *dev = &fep->pdev->dev; + u32 *buf = (u32 *)regbuf; + u32 i, off; ++ int ret; ++ ++ ret = pm_runtime_get_sync(dev); ++ if (ret < 0) ++ return; + + regs->version = fec_enet_register_version; + +@@ -2216,6 +2222,9 @@ static void fec_enet_get_regs(struct net_device *ndev, + off >>= 2; + buf[off] = readl(&theregs[off]); + } ++ ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); + } + + static int fec_enet_get_ts_info(struct net_device *ndev, +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 2af9f6308f84..401304d4d553 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -1151,7 +1151,7 @@ void i40e_set_fec_in_flags(u8 fec_cfg, u32 *flags); + + static inline bool i40e_enabled_xdp_vsi(struct i40e_vsi *vsi) + { +- return !!vsi->xdp_prog; ++ return !!READ_ONCE(vsi->xdp_prog); + } + + int i40e_create_queue_channel(struct i40e_vsi *vsi, struct i40e_channel *ch); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 339925af0206..4960c9c3e773 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -6804,8 +6804,8 @@ void i40e_down(struct i40e_vsi *vsi) + for (i = 0; i < vsi->num_queue_pairs; i++) { + i40e_clean_tx_ring(vsi->tx_rings[i]); + if (i40e_enabled_xdp_vsi(vsi)) { +- /* Make sure that in-progress ndo_xdp_xmit +- * calls are completed. ++ /* Make sure that in-progress ndo_xdp_xmit and ++ * ndo_xsk_wakeup calls are completed. + */ + synchronize_rcu(); + i40e_clean_tx_ring(vsi->xdp_rings[i]); +@@ -12526,8 +12526,12 @@ static int i40e_xdp_setup(struct i40e_vsi *vsi, + + old_prog = xchg(&vsi->xdp_prog, prog); + +- if (need_reset) ++ if (need_reset) { ++ if (!prog) ++ /* Wait until ndo_xsk_wakeup completes. */ ++ synchronize_rcu(); + i40e_reset_and_rebuild(pf, true, true); ++ } + + for (i = 0; i < vsi->num_queue_pairs; i++) + WRITE_ONCE(vsi->rx_rings[i]->xdp_prog, vsi->xdp_prog); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +index d07e1a890428..f73cd917c44f 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +@@ -787,8 +787,12 @@ int i40e_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags) + { + struct i40e_netdev_priv *np = netdev_priv(dev); + struct i40e_vsi *vsi = np->vsi; ++ struct i40e_pf *pf = vsi->back; + struct i40e_ring *ring; + ++ if (test_bit(__I40E_CONFIG_BUSY, pf->state)) ++ return -ENETDOWN; ++ + if (test_bit(__I40E_VSI_DOWN, vsi->state)) + return -ENETDOWN; + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 1a7203fede12..c6404abf2dd1 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -10248,7 +10248,12 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog) + + /* If transitioning XDP modes reconfigure rings */ + if (need_reset) { +- int err = ixgbe_setup_tc(dev, adapter->hw_tcs); ++ int err; ++ ++ if (!prog) ++ /* Wait until ndo_xsk_wakeup completes. */ ++ synchronize_rcu(); ++ err = ixgbe_setup_tc(dev, adapter->hw_tcs); + + if (err) { + rcu_assign_pointer(adapter->xdp_prog, old_prog); +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c +index d6feaacfbf89..b43be9f14105 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c +@@ -709,10 +709,14 @@ int ixgbe_xsk_wakeup(struct net_device *dev, u32 qid, u32 flags) + if (qid >= adapter->num_xdp_queues) + return -ENXIO; + +- if (!adapter->xdp_ring[qid]->xsk_umem) ++ ring = adapter->xdp_ring[qid]; ++ ++ if (test_bit(__IXGBE_TX_DISABLED, &ring->state)) ++ return -ENETDOWN; ++ ++ if (!ring->xsk_umem) + return -ENXIO; + +- ring = adapter->xdp_ring[qid]; + if (!napi_if_scheduled_mark_missed(&ring->q_vector->napi)) { + u64 eics = BIT_ULL(ring->q_vector->v_idx); + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index 2c16add0b642..9c8427698238 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -760,7 +760,7 @@ enum { + MLX5E_STATE_OPENED, + MLX5E_STATE_DESTROYING, + MLX5E_STATE_XDP_TX_ENABLED, +- MLX5E_STATE_XDP_OPEN, ++ MLX5E_STATE_XDP_ACTIVE, + }; + + struct mlx5e_rqt { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +index 68d593074f6c..d48292ccda29 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +@@ -122,6 +122,22 @@ enum { + #endif + }; + ++#define MLX5E_TTC_NUM_GROUPS 3 ++#define MLX5E_TTC_GROUP1_SIZE (BIT(3) + MLX5E_NUM_TUNNEL_TT) ++#define MLX5E_TTC_GROUP2_SIZE BIT(1) ++#define MLX5E_TTC_GROUP3_SIZE BIT(0) ++#define MLX5E_TTC_TABLE_SIZE (MLX5E_TTC_GROUP1_SIZE +\ ++ MLX5E_TTC_GROUP2_SIZE +\ ++ MLX5E_TTC_GROUP3_SIZE) ++ ++#define MLX5E_INNER_TTC_NUM_GROUPS 3 ++#define MLX5E_INNER_TTC_GROUP1_SIZE BIT(3) ++#define MLX5E_INNER_TTC_GROUP2_SIZE BIT(1) ++#define MLX5E_INNER_TTC_GROUP3_SIZE BIT(0) ++#define MLX5E_INNER_TTC_TABLE_SIZE (MLX5E_INNER_TTC_GROUP1_SIZE +\ ++ MLX5E_INNER_TTC_GROUP2_SIZE +\ ++ MLX5E_INNER_TTC_GROUP3_SIZE) ++ + #ifdef CONFIG_MLX5_EN_RXNFC + + struct mlx5e_ethtool_table { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c +index 1d6b58860da6..3a975641f902 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c +@@ -197,9 +197,10 @@ int mlx5e_health_report(struct mlx5e_priv *priv, + struct devlink_health_reporter *reporter, char *err_str, + struct mlx5e_err_ctx *err_ctx) + { +- if (!reporter) { +- netdev_err(priv->netdev, err_str); ++ netdev_err(priv->netdev, err_str); ++ ++ if (!reporter) + return err_ctx->recover(&err_ctx->ctx); +- } ++ + return devlink_health_report(reporter, err_str, err_ctx); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h +index 36ac1e3816b9..d7587f40ecae 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h +@@ -75,12 +75,18 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, + static inline void mlx5e_xdp_tx_enable(struct mlx5e_priv *priv) + { + set_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state); ++ ++ if (priv->channels.params.xdp_prog) ++ set_bit(MLX5E_STATE_XDP_ACTIVE, &priv->state); + } + + static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv) + { ++ if (priv->channels.params.xdp_prog) ++ clear_bit(MLX5E_STATE_XDP_ACTIVE, &priv->state); ++ + clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state); +- /* let other device's napi(s) see our new state */ ++ /* Let other device's napi(s) and XSK wakeups see our new state. */ + synchronize_rcu(); + } + +@@ -89,19 +95,9 @@ static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv) + return test_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state); + } + +-static inline void mlx5e_xdp_set_open(struct mlx5e_priv *priv) +-{ +- set_bit(MLX5E_STATE_XDP_OPEN, &priv->state); +-} +- +-static inline void mlx5e_xdp_set_closed(struct mlx5e_priv *priv) +-{ +- clear_bit(MLX5E_STATE_XDP_OPEN, &priv->state); +-} +- +-static inline bool mlx5e_xdp_is_open(struct mlx5e_priv *priv) ++static inline bool mlx5e_xdp_is_active(struct mlx5e_priv *priv) + { +- return test_bit(MLX5E_STATE_XDP_OPEN, &priv->state); ++ return test_bit(MLX5E_STATE_XDP_ACTIVE, &priv->state); + } + + static inline void mlx5e_xmit_xdp_doorbell(struct mlx5e_xdpsq *sq) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +index 631af8dee517..c28cbae42331 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +@@ -144,6 +144,7 @@ void mlx5e_close_xsk(struct mlx5e_channel *c) + { + clear_bit(MLX5E_CHANNEL_STATE_XSK, c->state); + napi_synchronize(&c->napi); ++ synchronize_rcu(); /* Sync with the XSK wakeup. */ + + mlx5e_close_rq(&c->xskrq); + mlx5e_close_cq(&c->xskrq.cq); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c +index 87827477d38c..fe2d596cb361 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c +@@ -14,7 +14,7 @@ int mlx5e_xsk_wakeup(struct net_device *dev, u32 qid, u32 flags) + struct mlx5e_channel *c; + u16 ix; + +- if (unlikely(!mlx5e_xdp_is_open(priv))) ++ if (unlikely(!mlx5e_xdp_is_active(priv))) + return -ENETDOWN; + + if (unlikely(!mlx5e_qid_get_ch_if_in_group(params, qid, MLX5E_RQ_GROUP_XSK, &ix))) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +index 15b7f0f1427c..73d3dc07331f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -904,22 +904,6 @@ del_rules: + return err; + } + +-#define MLX5E_TTC_NUM_GROUPS 3 +-#define MLX5E_TTC_GROUP1_SIZE (BIT(3) + MLX5E_NUM_TUNNEL_TT) +-#define MLX5E_TTC_GROUP2_SIZE BIT(1) +-#define MLX5E_TTC_GROUP3_SIZE BIT(0) +-#define MLX5E_TTC_TABLE_SIZE (MLX5E_TTC_GROUP1_SIZE +\ +- MLX5E_TTC_GROUP2_SIZE +\ +- MLX5E_TTC_GROUP3_SIZE) +- +-#define MLX5E_INNER_TTC_NUM_GROUPS 3 +-#define MLX5E_INNER_TTC_GROUP1_SIZE BIT(3) +-#define MLX5E_INNER_TTC_GROUP2_SIZE BIT(1) +-#define MLX5E_INNER_TTC_GROUP3_SIZE BIT(0) +-#define MLX5E_INNER_TTC_TABLE_SIZE (MLX5E_INNER_TTC_GROUP1_SIZE +\ +- MLX5E_INNER_TTC_GROUP2_SIZE +\ +- MLX5E_INNER_TTC_GROUP3_SIZE) +- + static int mlx5e_create_ttc_table_groups(struct mlx5e_ttc_table *ttc, + bool use_ipv) + { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 6abd4ed5b69b..29a5a8c894e3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3002,12 +3002,9 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv) + int mlx5e_open_locked(struct net_device *netdev) + { + struct mlx5e_priv *priv = netdev_priv(netdev); +- bool is_xdp = priv->channels.params.xdp_prog; + int err; + + set_bit(MLX5E_STATE_OPENED, &priv->state); +- if (is_xdp) +- mlx5e_xdp_set_open(priv); + + err = mlx5e_open_channels(priv, &priv->channels); + if (err) +@@ -3022,8 +3019,6 @@ int mlx5e_open_locked(struct net_device *netdev) + return 0; + + err_clear_state_opened_flag: +- if (is_xdp) +- mlx5e_xdp_set_closed(priv); + clear_bit(MLX5E_STATE_OPENED, &priv->state); + return err; + } +@@ -3055,8 +3050,6 @@ int mlx5e_close_locked(struct net_device *netdev) + if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) + return 0; + +- if (priv->channels.params.xdp_prog) +- mlx5e_xdp_set_closed(priv); + clear_bit(MLX5E_STATE_OPENED, &priv->state); + + netif_carrier_off(priv->netdev); +@@ -4373,16 +4366,6 @@ static int mlx5e_xdp_allowed(struct mlx5e_priv *priv, struct bpf_prog *prog) + return 0; + } + +-static int mlx5e_xdp_update_state(struct mlx5e_priv *priv) +-{ +- if (priv->channels.params.xdp_prog) +- mlx5e_xdp_set_open(priv); +- else +- mlx5e_xdp_set_closed(priv); +- +- return 0; +-} +- + static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog) + { + struct mlx5e_priv *priv = netdev_priv(netdev); +@@ -4422,7 +4405,7 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog) + mlx5e_set_rq_type(priv->mdev, &new_channels.params); + old_prog = priv->channels.params.xdp_prog; + +- err = mlx5e_safe_switch_channels(priv, &new_channels, mlx5e_xdp_update_state); ++ err = mlx5e_safe_switch_channels(priv, &new_channels, NULL); + if (err) + goto unlock; + } else { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 814a4ba4e7fa..947122c68493 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -586,7 +586,7 @@ static void mlx5e_hairpin_set_ttc_params(struct mlx5e_hairpin *hp, + for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) + ttc_params->indir_tirn[tt] = hp->indir_tirn[tt]; + +- ft_attr->max_fte = MLX5E_NUM_TT; ++ ft_attr->max_fte = MLX5E_TTC_TABLE_SIZE; + ft_attr->level = MLX5E_TC_TTC_FT_LEVEL; + ft_attr->prio = MLX5E_TC_PRIO; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 50ab88d80033..051ab845b501 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1197,6 +1197,12 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, bool boot) + if (err) + goto err_load; + ++ if (boot) { ++ err = mlx5_devlink_register(priv_to_devlink(dev), dev->device); ++ if (err) ++ goto err_devlink_reg; ++ } ++ + if (mlx5_device_registered(dev)) { + mlx5_attach_device(dev); + } else { +@@ -1214,6 +1220,9 @@ out: + return err; + + err_reg_dev: ++ if (boot) ++ mlx5_devlink_unregister(priv_to_devlink(dev)); ++err_devlink_reg: + mlx5_unload(dev); + err_load: + if (boot) +@@ -1353,10 +1362,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *id) + + request_module_nowait(MLX5_IB_MOD); + +- err = mlx5_devlink_register(devlink, &pdev->dev); +- if (err) +- goto clean_load; +- + err = mlx5_crdump_enable(dev); + if (err) + dev_err(&pdev->dev, "mlx5_crdump_enable failed with error code %d\n", err); +@@ -1364,9 +1369,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *id) + pci_save_state(pdev); + return 0; + +-clean_load: +- mlx5_unload_one(dev, true); +- + err_load_one: + mlx5_pci_close(dev); + pci_init_err: +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c +index bd1699e62142..e1a647dde978 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c +@@ -209,7 +209,7 @@ static void dr_rule_rehash_copy_ste_ctrl(struct mlx5dr_matcher *matcher, + /* We need to copy the refcount since this ste + * may have been traversed several times + */ +- refcount_set(&new_ste->refcount, refcount_read(&cur_ste->refcount)); ++ new_ste->refcount = cur_ste->refcount; + + /* Link old STEs rule_mem list to the new ste */ + mlx5dr_rule_update_rule_member(cur_ste, new_ste); +@@ -638,6 +638,9 @@ static int dr_rule_add_member(struct mlx5dr_rule_rx_tx *nic_rule, + if (!rule_mem) + return -ENOMEM; + ++ INIT_LIST_HEAD(&rule_mem->list); ++ INIT_LIST_HEAD(&rule_mem->use_ste_list); ++ + rule_mem->ste = ste; + list_add_tail(&rule_mem->list, &nic_rule->rule_members_list); + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c +index 3cbf74b44d1f..2739ed2a2911 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c +@@ -340,7 +340,7 @@ static void dr_ste_replace(struct mlx5dr_ste *dst, struct mlx5dr_ste *src) + if (dst->next_htbl) + dst->next_htbl->pointing_ste = dst; + +- refcount_set(&dst->refcount, refcount_read(&src->refcount)); ++ dst->refcount = src->refcount; + + INIT_LIST_HEAD(&dst->rule_list); + list_splice_tail_init(&src->rule_list, &dst->rule_list); +@@ -557,7 +557,7 @@ bool mlx5dr_ste_is_not_valid_entry(u8 *p_hw_ste) + + bool mlx5dr_ste_not_used_ste(struct mlx5dr_ste *ste) + { +- return !refcount_read(&ste->refcount); ++ return !ste->refcount; + } + + /* Init one ste as a pattern for ste data array */ +@@ -681,14 +681,14 @@ struct mlx5dr_ste_htbl *mlx5dr_ste_htbl_alloc(struct mlx5dr_icm_pool *pool, + htbl->ste_arr = chunk->ste_arr; + htbl->hw_ste_arr = chunk->hw_ste_arr; + htbl->miss_list = chunk->miss_list; +- refcount_set(&htbl->refcount, 0); ++ htbl->refcount = 0; + + for (i = 0; i < chunk->num_of_entries; i++) { + struct mlx5dr_ste *ste = &htbl->ste_arr[i]; + + ste->hw_ste = htbl->hw_ste_arr + i * DR_STE_SIZE_REDUCED; + ste->htbl = htbl; +- refcount_set(&ste->refcount, 0); ++ ste->refcount = 0; + INIT_LIST_HEAD(&ste->miss_list_node); + INIT_LIST_HEAD(&htbl->miss_list[i]); + INIT_LIST_HEAD(&ste->rule_list); +@@ -705,7 +705,7 @@ out_free_htbl: + + int mlx5dr_ste_htbl_free(struct mlx5dr_ste_htbl *htbl) + { +- if (refcount_read(&htbl->refcount)) ++ if (htbl->refcount) + return -EBUSY; + + mlx5dr_icm_free_chunk(htbl->chunk); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h +index 1cb3769d4e3c..31737dfca4ea 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h +@@ -117,7 +117,7 @@ struct mlx5dr_matcher_rx_tx; + struct mlx5dr_ste { + u8 *hw_ste; + /* refcount: indicates the num of rules that using this ste */ +- refcount_t refcount; ++ u32 refcount; + + /* attached to the miss_list head at each htbl entry */ + struct list_head miss_list_node; +@@ -149,7 +149,7 @@ struct mlx5dr_ste_htbl_ctrl { + struct mlx5dr_ste_htbl { + u8 lu_type; + u16 byte_mask; +- refcount_t refcount; ++ u32 refcount; + struct mlx5dr_icm_chunk *chunk; + struct mlx5dr_ste *ste_arr; + u8 *hw_ste_arr; +@@ -200,13 +200,14 @@ int mlx5dr_ste_htbl_free(struct mlx5dr_ste_htbl *htbl); + + static inline void mlx5dr_htbl_put(struct mlx5dr_ste_htbl *htbl) + { +- if (refcount_dec_and_test(&htbl->refcount)) ++ htbl->refcount--; ++ if (!htbl->refcount) + mlx5dr_ste_htbl_free(htbl); + } + + static inline void mlx5dr_htbl_get(struct mlx5dr_ste_htbl *htbl) + { +- refcount_inc(&htbl->refcount); ++ htbl->refcount++; + } + + /* STE utils */ +@@ -248,14 +249,15 @@ static inline void mlx5dr_ste_put(struct mlx5dr_ste *ste, + struct mlx5dr_matcher *matcher, + struct mlx5dr_matcher_rx_tx *nic_matcher) + { +- if (refcount_dec_and_test(&ste->refcount)) ++ ste->refcount--; ++ if (!ste->refcount) + mlx5dr_ste_free(ste, matcher, nic_matcher); + } + + /* initial as 0, increased only when ste appears in a new rule */ + static inline void mlx5dr_ste_get(struct mlx5dr_ste *ste) + { +- refcount_inc(&ste->refcount); ++ ste->refcount++; + } + + void mlx5dr_ste_set_hit_addr_by_next_htbl(u8 *hw_ste, +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c +index bdf53cf350f6..720514b5c006 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c +@@ -650,6 +650,13 @@ mlxsw_sp_qdisc_prio_graft(struct mlxsw_sp_port *mlxsw_sp_port, + mlxsw_sp_port->tclass_qdiscs[tclass_num].handle == p->child_handle) + return 0; + ++ if (!p->child_handle) { ++ /* This is an invisible FIFO replacing the original Qdisc. ++ * Ignore it--the original Qdisc's destroy will follow. ++ */ ++ return 0; ++ } ++ + /* See if the grafted qdisc is already offloaded on any tclass. If so, + * unoffload it. + */ +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +index 6e47be63a43c..e9e0867ec139 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -957,6 +957,9 @@ static int sun8i_dwmac_set_syscon(struct stmmac_priv *priv) + /* default */ + break; + case PHY_INTERFACE_MODE_RGMII: ++ case PHY_INTERFACE_MODE_RGMII_ID: ++ case PHY_INTERFACE_MODE_RGMII_RXID: ++ case PHY_INTERFACE_MODE_RGMII_TXID: + reg |= SYSCON_EPIT | SYSCON_ETCS_INT_GMII; + break; + case PHY_INTERFACE_MODE_RMII: +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +index a299da3971b4..102d637bc84a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +@@ -44,7 +44,7 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + * rate, which then uses the auto-reparenting feature of the + * clock driver, and enabling/disabling the clock. + */ +- if (gmac->interface == PHY_INTERFACE_MODE_RGMII) { ++ if (phy_interface_mode_is_rgmii(gmac->interface)) { + clk_set_rate(gmac->tx_clk, SUN7I_GMAC_GMII_RGMII_RATE); + clk_prepare_enable(gmac->tx_clk); + gmac->clk_enabled = 1; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h +index 9d08a934fe4f..ff751ab3d765 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h +@@ -343,6 +343,8 @@ + #define XGMAC_DMA_CH_RX_CONTROL(x) (0x00003108 + (0x80 * (x))) + #define XGMAC_RxPBL GENMASK(21, 16) + #define XGMAC_RxPBL_SHIFT 16 ++#define XGMAC_RBSZ GENMASK(14, 1) ++#define XGMAC_RBSZ_SHIFT 1 + #define XGMAC_RXST BIT(0) + #define XGMAC_DMA_CH_TxDESC_HADDR(x) (0x00003110 + (0x80 * (x))) + #define XGMAC_DMA_CH_TxDESC_LADDR(x) (0x00003114 + (0x80 * (x))) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +index f70ca5300b82..4af7271cea56 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +@@ -489,7 +489,8 @@ static void dwxgmac2_set_bfsize(void __iomem *ioaddr, int bfsize, u32 chan) + u32 value; + + value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan)); +- value |= bfsize << 1; ++ value &= ~XGMAC_RBSZ; ++ value |= bfsize << XGMAC_RBSZ_SHIFT; + writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan)); + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 271a00f24f45..903c5d8a226e 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -45,7 +45,7 @@ + #include "dwxgmac2.h" + #include "hwif.h" + +-#define STMMAC_ALIGN(x) __ALIGN_KERNEL(x, SMP_CACHE_BYTES) ++#define STMMAC_ALIGN(x) ALIGN(ALIGN(x, SMP_CACHE_BYTES), 16) + #define TSO_MAX_BUFF_SIZE (SZ_16K - 1) + + /* Module parameters */ +@@ -1292,19 +1292,9 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags) + struct stmmac_priv *priv = netdev_priv(dev); + u32 rx_count = priv->plat->rx_queues_to_use; + int ret = -ENOMEM; +- int bfsize = 0; + int queue; + int i; + +- bfsize = stmmac_set_16kib_bfsize(priv, dev->mtu); +- if (bfsize < 0) +- bfsize = 0; +- +- if (bfsize < BUF_SIZE_16KiB) +- bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz); +- +- priv->dma_buf_sz = bfsize; +- + /* RX INITIALIZATION */ + netif_dbg(priv, probe, priv->dev, + "SKB addresses:\nskb\t\tskb data\tdma data\n"); +@@ -1346,8 +1336,6 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags) + } + } + +- buf_sz = bfsize; +- + return 0; + + err_init_rx_buffers: +@@ -2654,6 +2642,7 @@ static void stmmac_hw_teardown(struct net_device *dev) + static int stmmac_open(struct net_device *dev) + { + struct stmmac_priv *priv = netdev_priv(dev); ++ int bfsize = 0; + u32 chan; + int ret; + +@@ -2673,7 +2662,16 @@ static int stmmac_open(struct net_device *dev) + memset(&priv->xstats, 0, sizeof(struct stmmac_extra_stats)); + priv->xstats.threshold = tc; + +- priv->dma_buf_sz = STMMAC_ALIGN(buf_sz); ++ bfsize = stmmac_set_16kib_bfsize(priv, dev->mtu); ++ if (bfsize < 0) ++ bfsize = 0; ++ ++ if (bfsize < BUF_SIZE_16KiB) ++ bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz); ++ ++ priv->dma_buf_sz = bfsize; ++ buf_sz = bfsize; ++ + priv->rx_copybreak = STMMAC_RX_COPYBREAK; + + ret = alloc_dma_desc_resources(priv); +@@ -3103,6 +3101,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) + + tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc)); + stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue); ++ stmmac_tx_timer_arm(priv, queue); + + return NETDEV_TX_OK; + +@@ -3330,6 +3329,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + + tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc)); + stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue); ++ stmmac_tx_timer_arm(priv, queue); + + return NETDEV_TX_OK; + +@@ -3747,12 +3747,24 @@ static void stmmac_set_rx_mode(struct net_device *dev) + static int stmmac_change_mtu(struct net_device *dev, int new_mtu) + { + struct stmmac_priv *priv = netdev_priv(dev); ++ int txfifosz = priv->plat->tx_fifo_size; ++ ++ if (txfifosz == 0) ++ txfifosz = priv->dma_cap.tx_fifo_size; ++ ++ txfifosz /= priv->plat->tx_queues_to_use; + + if (netif_running(dev)) { + netdev_err(priv->dev, "must be stopped to change its MTU\n"); + return -EBUSY; + } + ++ new_mtu = STMMAC_ALIGN(new_mtu); ++ ++ /* If condition true, FIFO is too small or MTU too large */ ++ if ((txfifosz < new_mtu) || (new_mtu > BUF_SIZE_16KiB)) ++ return -EINVAL; ++ + dev->mtu = new_mtu; + + netdev_update_features(dev); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 1f230bd854c4..5150551c28be 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -320,7 +320,7 @@ out: + static int stmmac_dt_phy(struct plat_stmmacenet_data *plat, + struct device_node *np, struct device *dev) + { +- bool mdio = false; ++ bool mdio = !of_phy_is_fixed_link(np); + static const struct of_device_id need_mdio_ids[] = { + { .compatible = "snps,dwc-qos-ethernet-4.10" }, + {}, +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +index ac3f658105c0..a0513deab1a0 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +@@ -624,6 +624,8 @@ static int stmmac_test_mcfilt(struct stmmac_priv *priv) + return -EOPNOTSUPP; + if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries) + return -EOPNOTSUPP; ++ if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins) ++ return -EOPNOTSUPP; + + while (--tries) { + /* We only need to check the mc_addr for collisions */ +@@ -666,6 +668,8 @@ static int stmmac_test_ucfilt(struct stmmac_priv *priv) + + if (stmmac_filter_check(priv)) + return -EOPNOTSUPP; ++ if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries) ++ return -EOPNOTSUPP; + if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins) + return -EOPNOTSUPP; + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index fca471e27f39..f6222ada6818 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -813,7 +813,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, + lock_sock(sock->sk); + if (sock->sk->sk_user_data) { + sk = ERR_PTR(-EBUSY); +- goto out_sock; ++ goto out_rel_sock; + } + + sk = sock->sk; +@@ -826,8 +826,9 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, + + setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); + +-out_sock: ++out_rel_sock: + release_sock(sock->sk); ++out_sock: + sockfd_put(sock); + return sk; + } +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index fb547f37af1e..e74f2d1def80 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -169,7 +169,6 @@ struct rndis_device { + + u8 hw_mac_adr[ETH_ALEN]; + u8 rss_key[NETVSC_HASH_KEYLEN]; +- u16 rx_table[ITAB_NUM]; + }; + + +@@ -938,6 +937,8 @@ struct net_device_context { + + u32 tx_table[VRSS_SEND_TAB_SIZE]; + ++ u16 rx_table[ITAB_NUM]; ++ + /* Ethtool settings */ + u8 duplex; + u32 speed; +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 963509add611..78e3e689a733 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -1659,7 +1659,7 @@ static int netvsc_get_rxfh(struct net_device *dev, u32 *indir, u8 *key, + rndis_dev = ndev->extension; + if (indir) { + for (i = 0; i < ITAB_NUM; i++) +- indir[i] = rndis_dev->rx_table[i]; ++ indir[i] = ndc->rx_table[i]; + } + + if (key) +@@ -1689,7 +1689,7 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir, + return -EINVAL; + + for (i = 0; i < ITAB_NUM; i++) +- rndis_dev->rx_table[i] = indir[i]; ++ ndc->rx_table[i] = indir[i]; + } + + if (!key) { +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index e3d3c9097ff1..f81e58267a6e 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -767,6 +767,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev, + const u8 *rss_key, u16 flag) + { + struct net_device *ndev = rdev->ndev; ++ struct net_device_context *ndc = netdev_priv(ndev); + struct rndis_request *request; + struct rndis_set_request *set; + struct rndis_set_complete *set_complete; +@@ -806,7 +807,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev, + /* Set indirection table entries */ + itab = (u32 *)(rssp + 1); + for (i = 0; i < ITAB_NUM; i++) +- itab[i] = rdev->rx_table[i]; ++ itab[i] = ndc->rx_table[i]; + + /* Set hask key values */ + keyp = (u8 *)((unsigned long)rssp + rssp->hashkey_offset); +@@ -1305,6 +1306,7 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + struct netvsc_device_info *device_info) + { + struct net_device *net = hv_get_drvdata(dev); ++ struct net_device_context *ndc = netdev_priv(net); + struct netvsc_device *net_device; + struct rndis_device *rndis_device; + struct ndis_recv_scale_cap rsscap; +@@ -1391,9 +1393,11 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + /* We will use the given number of channels if available. */ + net_device->num_chn = min(net_device->max_chn, device_info->num_chn); + +- for (i = 0; i < ITAB_NUM; i++) +- rndis_device->rx_table[i] = ethtool_rxfh_indir_default( ++ if (!netif_is_rxfh_configured(net)) { ++ for (i = 0; i < ITAB_NUM; i++) ++ ndc->rx_table[i] = ethtool_rxfh_indir_default( + i, net_device->num_chn); ++ } + + atomic_set(&net_device->open_chn, 1); + vmbus_set_sc_create_callback(dev->channel, netvsc_sc_open); +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 05631d97eeb4..747c0542a53c 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -259,7 +259,7 @@ static void macvlan_broadcast(struct sk_buff *skb, + struct net_device *src, + enum macvlan_mode mode) + { +- const struct ethhdr *eth = eth_hdr(skb); ++ const struct ethhdr *eth = skb_eth_hdr(skb); + const struct macvlan_dev *vlan; + struct sk_buff *nskb; + unsigned int i; +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 0becc79fd431..3e5f2f7a155e 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -511,7 +511,7 @@ static int lan78xx_read_stats(struct lan78xx_net *dev, + } + } else { + netdev_warn(dev->net, +- "Failed to read stat ret = 0x%x", ret); ++ "Failed to read stat ret = %d", ret); + } + + kfree(stats); +@@ -2724,11 +2724,6 @@ static int lan78xx_stop(struct net_device *net) + return 0; + } + +-static int lan78xx_linearize(struct sk_buff *skb) +-{ +- return skb_linearize(skb); +-} +- + static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, + struct sk_buff *skb, gfp_t flags) + { +@@ -2740,8 +2735,10 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, + return NULL; + } + +- if (lan78xx_linearize(skb) < 0) ++ if (skb_linearize(skb)) { ++ dev_kfree_skb_any(skb); + return NULL; ++ } + + tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN_MASK_) | TX_CMD_A_FCS_; + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 404ac3a0d1c3..283dfeb406ad 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2542,7 +2542,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + ndst = &rt->dst; + skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM); + +- tos = ip_tunnel_ecn_encap(tos, old_iph, skb); ++ tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); + ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); + err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr), + vni, md, flags, udp_sum); +@@ -2582,7 +2582,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + + skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM); + +- tos = ip_tunnel_ecn_encap(tos, old_iph, skb); ++ tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); + ttl = ttl ? : ip6_dst_hoplimit(ndst); + skb_scrub_packet(skb, xnet); + err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr), +diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c +index 09313047beed..7caf1d26124a 100644 +--- a/drivers/net/wireless/marvell/mwifiex/tdls.c ++++ b/drivers/net/wireless/marvell/mwifiex/tdls.c +@@ -953,59 +953,117 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv, + + switch (*pos) { + case WLAN_EID_SUPP_RATES: ++ if (pos[1] > 32) ++ return; + sta_ptr->tdls_cap.rates_len = pos[1]; + for (i = 0; i < pos[1]; i++) + sta_ptr->tdls_cap.rates[i] = pos[i + 2]; + break; + + case WLAN_EID_EXT_SUPP_RATES: ++ if (pos[1] > 32) ++ return; + basic = sta_ptr->tdls_cap.rates_len; ++ if (pos[1] > 32 - basic) ++ return; + for (i = 0; i < pos[1]; i++) + sta_ptr->tdls_cap.rates[basic + i] = pos[i + 2]; + sta_ptr->tdls_cap.rates_len += pos[1]; + break; + case WLAN_EID_HT_CAPABILITY: +- memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos, ++ if (pos > end - sizeof(struct ieee80211_ht_cap) - 2) ++ return; ++ if (pos[1] != sizeof(struct ieee80211_ht_cap)) ++ return; ++ /* copy the ie's value into ht_capb*/ ++ memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos + 2, + sizeof(struct ieee80211_ht_cap)); + sta_ptr->is_11n_enabled = 1; + break; + case WLAN_EID_HT_OPERATION: +- memcpy(&sta_ptr->tdls_cap.ht_oper, pos, ++ if (pos > end - ++ sizeof(struct ieee80211_ht_operation) - 2) ++ return; ++ if (pos[1] != sizeof(struct ieee80211_ht_operation)) ++ return; ++ /* copy the ie's value into ht_oper*/ ++ memcpy(&sta_ptr->tdls_cap.ht_oper, pos + 2, + sizeof(struct ieee80211_ht_operation)); + break; + case WLAN_EID_BSS_COEX_2040: ++ if (pos > end - 3) ++ return; ++ if (pos[1] != 1) ++ return; + sta_ptr->tdls_cap.coex_2040 = pos[2]; + break; + case WLAN_EID_EXT_CAPABILITY: ++ if (pos > end - sizeof(struct ieee_types_header)) ++ return; ++ if (pos[1] < sizeof(struct ieee_types_header)) ++ return; ++ if (pos[1] > 8) ++ return; + memcpy((u8 *)&sta_ptr->tdls_cap.extcap, pos, + sizeof(struct ieee_types_header) + + min_t(u8, pos[1], 8)); + break; + case WLAN_EID_RSN: ++ if (pos > end - sizeof(struct ieee_types_header)) ++ return; ++ if (pos[1] < sizeof(struct ieee_types_header)) ++ return; ++ if (pos[1] > IEEE_MAX_IE_SIZE - ++ sizeof(struct ieee_types_header)) ++ return; + memcpy((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos, + sizeof(struct ieee_types_header) + + min_t(u8, pos[1], IEEE_MAX_IE_SIZE - + sizeof(struct ieee_types_header))); + break; + case WLAN_EID_QOS_CAPA: ++ if (pos > end - 3) ++ return; ++ if (pos[1] != 1) ++ return; + sta_ptr->tdls_cap.qos_info = pos[2]; + break; + case WLAN_EID_VHT_OPERATION: +- if (priv->adapter->is_hw_11ac_capable) +- memcpy(&sta_ptr->tdls_cap.vhtoper, pos, ++ if (priv->adapter->is_hw_11ac_capable) { ++ if (pos > end - ++ sizeof(struct ieee80211_vht_operation) - 2) ++ return; ++ if (pos[1] != ++ sizeof(struct ieee80211_vht_operation)) ++ return; ++ /* copy the ie's value into vhtoper*/ ++ memcpy(&sta_ptr->tdls_cap.vhtoper, pos + 2, + sizeof(struct ieee80211_vht_operation)); ++ } + break; + case WLAN_EID_VHT_CAPABILITY: + if (priv->adapter->is_hw_11ac_capable) { +- memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos, ++ if (pos > end - ++ sizeof(struct ieee80211_vht_cap) - 2) ++ return; ++ if (pos[1] != sizeof(struct ieee80211_vht_cap)) ++ return; ++ /* copy the ie's value into vhtcap*/ ++ memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos + 2, + sizeof(struct ieee80211_vht_cap)); + sta_ptr->is_11ac_enabled = 1; + } + break; + case WLAN_EID_AID: +- if (priv->adapter->is_hw_11ac_capable) ++ if (priv->adapter->is_hw_11ac_capable) { ++ if (pos > end - 4) ++ return; ++ if (pos[1] != 2) ++ return; + sta_ptr->tdls_cap.aid = + get_unaligned_le16((pos + 2)); ++ } ++ break; + default: + break; + } +diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c +index abcf54f7d19c..191f410cf35c 100644 +--- a/drivers/perf/arm_smmuv3_pmu.c ++++ b/drivers/perf/arm_smmuv3_pmu.c +@@ -815,7 +815,7 @@ static int smmu_pmu_probe(struct platform_device *pdev) + if (err) { + dev_err(dev, "Error %d registering hotplug, PMU @%pa\n", + err, &res_0->start); +- goto out_cpuhp_err; ++ return err; + } + + err = perf_pmu_register(&smmu_pmu->pmu, name, -1); +@@ -834,8 +834,6 @@ static int smmu_pmu_probe(struct platform_device *pdev) + + out_unregister: + cpuhp_state_remove_instance_nocalls(cpuhp_state_num, &smmu_pmu->node); +-out_cpuhp_err: +- put_cpu(); + return err; + } + +diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +index c6800d220920..bb07024d22ed 100644 +--- a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c ++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +@@ -1088,60 +1088,52 @@ SSSF_PIN_DECL(AF15, GPIOV7, LPCSMI, SIG_DESC_SET(SCU434, 15)); + + #define AB7 176 + SIG_EXPR_LIST_DECL_SESG(AB7, LAD0, LPC, SIG_DESC_SET(SCU434, 16), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AB7, ESPID0, ESPI, SIG_DESC_SET(SCU434, 16), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AB7, ESPID0, ESPI, SIG_DESC_SET(SCU434, 16)); + PIN_DECL_2(AB7, GPIOW0, LAD0, ESPID0); + + #define AB8 177 + SIG_EXPR_LIST_DECL_SESG(AB8, LAD1, LPC, SIG_DESC_SET(SCU434, 17), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AB8, ESPID1, ESPI, SIG_DESC_SET(SCU434, 17), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AB8, ESPID1, ESPI, SIG_DESC_SET(SCU434, 17)); + PIN_DECL_2(AB8, GPIOW1, LAD1, ESPID1); + + #define AC8 178 + SIG_EXPR_LIST_DECL_SESG(AC8, LAD2, LPC, SIG_DESC_SET(SCU434, 18), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AC8, ESPID2, ESPI, SIG_DESC_SET(SCU434, 18), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AC8, ESPID2, ESPI, SIG_DESC_SET(SCU434, 18)); + PIN_DECL_2(AC8, GPIOW2, LAD2, ESPID2); + + #define AC7 179 + SIG_EXPR_LIST_DECL_SESG(AC7, LAD3, LPC, SIG_DESC_SET(SCU434, 19), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AC7, ESPID3, ESPI, SIG_DESC_SET(SCU434, 19), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AC7, ESPID3, ESPI, SIG_DESC_SET(SCU434, 19)); + PIN_DECL_2(AC7, GPIOW3, LAD3, ESPID3); + + #define AE7 180 + SIG_EXPR_LIST_DECL_SESG(AE7, LCLK, LPC, SIG_DESC_SET(SCU434, 20), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AE7, ESPICK, ESPI, SIG_DESC_SET(SCU434, 20), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AE7, ESPICK, ESPI, SIG_DESC_SET(SCU434, 20)); + PIN_DECL_2(AE7, GPIOW4, LCLK, ESPICK); + + #define AF7 181 + SIG_EXPR_LIST_DECL_SESG(AF7, LFRAME, LPC, SIG_DESC_SET(SCU434, 21), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AF7, ESPICS, ESPI, SIG_DESC_SET(SCU434, 21), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AF7, ESPICS, ESPI, SIG_DESC_SET(SCU434, 21)); + PIN_DECL_2(AF7, GPIOW5, LFRAME, ESPICS); + + #define AD7 182 + SIG_EXPR_LIST_DECL_SESG(AD7, LSIRQ, LSIRQ, SIG_DESC_SET(SCU434, 22), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AD7, ESPIALT, ESPIALT, SIG_DESC_SET(SCU434, 22), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AD7, ESPIALT, ESPIALT, SIG_DESC_SET(SCU434, 22)); + PIN_DECL_2(AD7, GPIOW6, LSIRQ, ESPIALT); + FUNC_GROUP_DECL(LSIRQ, AD7); + FUNC_GROUP_DECL(ESPIALT, AD7); + + #define AD8 183 + SIG_EXPR_LIST_DECL_SESG(AD8, LPCRST, LPC, SIG_DESC_SET(SCU434, 23), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AD8, ESPIRST, ESPI, SIG_DESC_SET(SCU434, 23), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AD8, ESPIRST, ESPI, SIG_DESC_SET(SCU434, 23)); + PIN_DECL_2(AD8, GPIOW7, LPCRST, ESPIRST); + + FUNC_GROUP_DECL(LPC, AB7, AB8, AC8, AC7, AE7, AF7, AD8); +diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c +index e914f6efd39e..9503ddf2edc7 100644 +--- a/drivers/pinctrl/pinmux.c ++++ b/drivers/pinctrl/pinmux.c +@@ -85,7 +85,7 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned pin) + const struct pinmux_ops *ops = pctldev->desc->pmxops; + + /* Can't inspect pin, assume it can be used */ +- if (!desc) ++ if (!desc || !ops) + return true; + + if (ops->strict && desc->mux_usecount) +diff --git a/drivers/platform/x86/pcengines-apuv2.c b/drivers/platform/x86/pcengines-apuv2.c +index 48b112b4f0b0..c32daf087640 100644 +--- a/drivers/platform/x86/pcengines-apuv2.c ++++ b/drivers/platform/x86/pcengines-apuv2.c +@@ -95,7 +95,7 @@ static struct gpiod_lookup_table gpios_led_table = { + NULL, 1, GPIO_ACTIVE_LOW), + GPIO_LOOKUP_IDX(AMD_FCH_GPIO_DRIVER_NAME, APU2_GPIO_LINE_LED3, + NULL, 2, GPIO_ACTIVE_LOW), +- GPIO_LOOKUP_IDX(AMD_FCH_GPIO_DRIVER_NAME, APU2_GPIO_REG_SIMSWAP, ++ GPIO_LOOKUP_IDX(AMD_FCH_GPIO_DRIVER_NAME, APU2_GPIO_LINE_SIMSWAP, + NULL, 3, GPIO_ACTIVE_LOW), + } + }; +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 87bc06b386a0..1dba0bdf3762 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1937,8 +1937,8 @@ struct regulator *_regulator_get(struct device *dev, const char *id, + regulator = create_regulator(rdev, dev, id); + if (regulator == NULL) { + regulator = ERR_PTR(-ENOMEM); +- put_device(&rdev->dev); + module_put(rdev->owner); ++ put_device(&rdev->dev); + return regulator; + } + +@@ -2059,13 +2059,13 @@ static void _regulator_put(struct regulator *regulator) + + rdev->open_count--; + rdev->exclusive = 0; +- put_device(&rdev->dev); + regulator_unlock(rdev); + + kfree_const(regulator->supply_name); + kfree(regulator); + + module_put(rdev->owner); ++ put_device(&rdev->dev); + } + + /** +@@ -4992,6 +4992,7 @@ regulator_register(const struct regulator_desc *regulator_desc, + struct regulator_dev *rdev; + bool dangling_cfg_gpiod = false; + bool dangling_of_gpiod = false; ++ bool reg_device_fail = false; + struct device *dev; + int ret, i; + +@@ -5177,7 +5178,7 @@ regulator_register(const struct regulator_desc *regulator_desc, + dev_set_drvdata(&rdev->dev, rdev); + ret = device_register(&rdev->dev); + if (ret != 0) { +- put_device(&rdev->dev); ++ reg_device_fail = true; + goto unset_supplies; + } + +@@ -5208,7 +5209,10 @@ wash: + clean: + if (dangling_of_gpiod) + gpiod_put(config->ena_gpiod); +- kfree(rdev); ++ if (reg_device_fail) ++ put_device(&rdev->dev); ++ else ++ kfree(rdev); + kfree(config); + rinse: + if (dangling_cfg_gpiod) +diff --git a/drivers/regulator/rn5t618-regulator.c b/drivers/regulator/rn5t618-regulator.c +index eb807a059479..aa6e7c5341ce 100644 +--- a/drivers/regulator/rn5t618-regulator.c ++++ b/drivers/regulator/rn5t618-regulator.c +@@ -148,6 +148,7 @@ static struct platform_driver rn5t618_regulator_driver = { + + module_platform_driver(rn5t618_regulator_driver); + ++MODULE_ALIAS("platform:rn5t618-regulator"); + MODULE_AUTHOR("Beniamino Galvani "); + MODULE_DESCRIPTION("RN5T618 regulator driver"); + MODULE_LICENSE("GPL v2"); +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index 3c9a64c1b7a8..f343bd814d32 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -787,7 +787,7 @@ struct reset_control *__devm_reset_control_get(struct device *dev, + return ERR_PTR(-ENOMEM); + + rstc = __reset_control_get(dev, id, index, shared, optional, acquired); +- if (!IS_ERR(rstc)) { ++ if (!IS_ERR_OR_NULL(rstc)) { + *ptr = rstc; + devres_add(dev, ptr); + } else { +@@ -930,7 +930,7 @@ devm_reset_control_array_get(struct device *dev, bool shared, bool optional) + return ERR_PTR(-ENOMEM); + + rstc = of_reset_control_array_get(dev->of_node, shared, optional, true); +- if (IS_ERR(rstc)) { ++ if (IS_ERR_OR_NULL(rstc)) { + devres_free(devres); + return rstc; + } +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index c94184d080f8..a28b9ff82378 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -1128,7 +1128,8 @@ static u32 get_fcx_max_data(struct dasd_device *device) + { + struct dasd_eckd_private *private = device->private; + int fcx_in_css, fcx_in_gneq, fcx_in_features; +- int tpm, mdc; ++ unsigned int mdc; ++ int tpm; + + if (dasd_nofcx) + return 0; +@@ -1142,7 +1143,7 @@ static u32 get_fcx_max_data(struct dasd_device *device) + return 0; + + mdc = ccw_device_get_mdc(device->cdev, 0); +- if (mdc < 0) { ++ if (mdc == 0) { + dev_warn(&device->cdev->dev, "Detecting the maximum supported data size for zHPF requests failed\n"); + return 0; + } else { +@@ -1153,12 +1154,12 @@ static u32 get_fcx_max_data(struct dasd_device *device) + static int verify_fcx_max_data(struct dasd_device *device, __u8 lpm) + { + struct dasd_eckd_private *private = device->private; +- int mdc; ++ unsigned int mdc; + u32 fcx_max_data; + + if (private->fcx_max_data) { + mdc = ccw_device_get_mdc(device->cdev, lpm); +- if ((mdc < 0)) { ++ if (mdc == 0) { + dev_warn(&device->cdev->dev, + "Detecting the maximum data size for zHPF " + "requests failed (rc=%d) for a new path %x\n", +@@ -2073,7 +2074,7 @@ out_err2: + dasd_free_block(device->block); + device->block = NULL; + out_err1: +- kfree(private->conf_data); ++ dasd_eckd_clear_conf_data(device); + kfree(device->private); + device->private = NULL; + return rc; +@@ -2082,7 +2083,6 @@ out_err1: + static void dasd_eckd_uncheck_device(struct dasd_device *device) + { + struct dasd_eckd_private *private = device->private; +- int i; + + if (!private) + return; +@@ -2092,21 +2092,7 @@ static void dasd_eckd_uncheck_device(struct dasd_device *device) + private->sneq = NULL; + private->vdsneq = NULL; + private->gneq = NULL; +- private->conf_len = 0; +- for (i = 0; i < 8; i++) { +- kfree(device->path[i].conf_data); +- if ((__u8 *)device->path[i].conf_data == +- private->conf_data) { +- private->conf_data = NULL; +- private->conf_len = 0; +- } +- device->path[i].conf_data = NULL; +- device->path[i].cssid = 0; +- device->path[i].ssid = 0; +- device->path[i].chpid = 0; +- } +- kfree(private->conf_data); +- private->conf_data = NULL; ++ dasd_eckd_clear_conf_data(device); + } + + static struct dasd_ccw_req * +diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c +index 65841af15748..ccecf6b9504e 100644 +--- a/drivers/s390/cio/device_ops.c ++++ b/drivers/s390/cio/device_ops.c +@@ -635,7 +635,7 @@ EXPORT_SYMBOL(ccw_device_tm_start_timeout); + * @mask: mask of paths to use + * + * Return the number of 64K-bytes blocks all paths at least support +- * for a transport command. Return values <= 0 indicate failures. ++ * for a transport command. Return value 0 indicates failure. + */ + int ccw_device_get_mdc(struct ccw_device *cdev, u8 mask) + { +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 83794d7494d4..9df47421d69c 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -653,17 +653,17 @@ static int qeth_check_idx_response(struct qeth_card *card, + unsigned char *buffer) + { + QETH_DBF_HEX(CTRL, 2, buffer, QETH_DBF_CTRL_LEN); +- if ((buffer[2] & 0xc0) == 0xc0) { ++ if ((buffer[2] & QETH_IDX_TERMINATE_MASK) == QETH_IDX_TERMINATE) { + QETH_DBF_MESSAGE(2, "received an IDX TERMINATE with cause code %#04x\n", + buffer[4]); + QETH_CARD_TEXT(card, 2, "ckidxres"); + QETH_CARD_TEXT(card, 2, " idxterm"); +- QETH_CARD_TEXT_(card, 2, " rc%d", -EIO); +- if (buffer[4] == 0xf6) { ++ QETH_CARD_TEXT_(card, 2, "rc%x", buffer[4]); ++ if (buffer[4] == QETH_IDX_TERM_BAD_TRANSPORT || ++ buffer[4] == QETH_IDX_TERM_BAD_TRANSPORT_VM) { + dev_err(&card->gdev->dev, +- "The qeth device is not configured " +- "for the OSI layer required by z/VM\n"); +- return -EPERM; ++ "The device does not support the configured transport mode\n"); ++ return -EPROTONOSUPPORT; + } + return -EIO; + } +@@ -740,10 +740,10 @@ static void qeth_issue_next_read_cb(struct qeth_card *card, + case 0: + break; + case -EIO: +- qeth_clear_ipacmd_list(card); + qeth_schedule_recovery(card); + /* fall through */ + default: ++ qeth_clear_ipacmd_list(card); + goto out; + } + +diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h +index 6420b58cf42b..b7c17b5c823b 100644 +--- a/drivers/s390/net/qeth_core_mpc.h ++++ b/drivers/s390/net/qeth_core_mpc.h +@@ -912,6 +912,11 @@ extern unsigned char IDX_ACTIVATE_WRITE[]; + #define QETH_IDX_ACT_ERR_AUTH 0x1E + #define QETH_IDX_ACT_ERR_AUTH_USER 0x20 + ++#define QETH_IDX_TERMINATE 0xc0 ++#define QETH_IDX_TERMINATE_MASK 0xc0 ++#define QETH_IDX_TERM_BAD_TRANSPORT 0x41 ++#define QETH_IDX_TERM_BAD_TRANSPORT_VM 0xf6 ++ + #define PDU_ENCAPSULATION(buffer) \ + (buffer + *(buffer + (*(buffer + 0x0b)) + \ + *(buffer + *(buffer + 0x0b) + 0x11) + 0x07)) +diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c +index 9f392497d570..4c3e222e5572 100644 +--- a/drivers/s390/net/qeth_core_sys.c ++++ b/drivers/s390/net/qeth_core_sys.c +@@ -227,7 +227,7 @@ static ssize_t qeth_dev_prioqing_store(struct device *dev, + card->qdio.default_out_queue = QETH_DEFAULT_QUEUE; + } else if (sysfs_streq(buf, "prio_queueing_vlan")) { + if (IS_LAYER3(card)) { +- rc = -ENOTSUPP; ++ rc = -EOPNOTSUPP; + goto out; + } + card->qdio.do_prio_queueing = QETH_PRIO_Q_ING_VLAN; +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 4bccdce19b5a..8b7d911dccd8 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -295,6 +295,7 @@ static void qeth_l2_stop_card(struct qeth_card *card) + + flush_workqueue(card->event_wq); + card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED; ++ card->info.promisc_mode = 0; + } + + static int qeth_l2_process_inbound_buffer(struct qeth_card *card, +diff --git a/drivers/s390/net/qeth_l2_sys.c b/drivers/s390/net/qeth_l2_sys.c +index e2bcb26105a3..fc7101ad84de 100644 +--- a/drivers/s390/net/qeth_l2_sys.c ++++ b/drivers/s390/net/qeth_l2_sys.c +@@ -279,7 +279,8 @@ void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card) + return; + + mutex_lock(&card->sbp_lock); +- if (card->options.sbp.role != QETH_SBP_ROLE_NONE) { ++ if (!card->options.sbp.reflect_promisc && ++ card->options.sbp.role != QETH_SBP_ROLE_NONE) { + /* Conditional to avoid spurious error messages */ + qeth_bridgeport_setrole(card, card->options.sbp.role); + /* Let the callback function refresh the stored role value. */ +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index d7bfc7a0e4c0..32385327539b 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -1433,6 +1433,7 @@ static void qeth_l3_stop_card(struct qeth_card *card) + } + + flush_workqueue(card->event_wq); ++ card->info.promisc_mode = 0; + } + + static void qeth_l3_set_promisc_mode(struct qeth_card *card) +diff --git a/drivers/spi/spi-cavium-thunderx.c b/drivers/spi/spi-cavium-thunderx.c +index d12e149f1a41..fd6b9caffaf0 100644 +--- a/drivers/spi/spi-cavium-thunderx.c ++++ b/drivers/spi/spi-cavium-thunderx.c +@@ -82,6 +82,7 @@ static int thunderx_spi_probe(struct pci_dev *pdev, + + error: + clk_disable_unprepare(p->clk); ++ pci_release_regions(pdev); + spi_master_put(master); + return ret; + } +@@ -96,6 +97,7 @@ static void thunderx_spi_remove(struct pci_dev *pdev) + return; + + clk_disable_unprepare(p->clk); ++ pci_release_regions(pdev); + /* Put everything in a known state. */ + writeq(0, p->register_base + OCTEON_SPI_CFG(p)); + } +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index 2d563874b4ac..be7c6ba73072 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -612,6 +612,7 @@ static struct spi_master * fsl_spi_probe(struct device *dev, + master->setup = fsl_spi_setup; + master->cleanup = fsl_spi_cleanup; + master->transfer_one_message = fsl_spi_do_one_msg; ++ master->use_gpio_descriptors = true; + + mpc8xxx_spi = spi_master_get_devdata(master); + mpc8xxx_spi->max_bits_per_word = 32; +@@ -728,8 +729,18 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) + } + } + #endif +- +- pdata->cs_control = fsl_spi_cs_control; ++ /* ++ * Handle the case where we have one hardwired (always selected) ++ * device on the first "chipselect". Else we let the core code ++ * handle any GPIOs or native chip selects and assign the ++ * appropriate callback for dealing with the CS lines. This isn't ++ * supported on the GRLIB variant. ++ */ ++ ret = gpiod_count(dev, "cs"); ++ if (ret <= 0) ++ pdata->max_chipselect = 1; ++ else ++ pdata->cs_control = fsl_spi_cs_control; + } + + ret = of_address_to_resource(np, 0, &mem); +diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c +index 501b923f2c27..28ae5229f889 100644 +--- a/drivers/spi/spi-nxp-fspi.c ++++ b/drivers/spi/spi-nxp-fspi.c +@@ -439,7 +439,7 @@ static bool nxp_fspi_supports_op(struct spi_mem *mem, + op->data.nbytes > f->devtype_data->txfifo) + return false; + +- return true; ++ return spi_mem_default_supports_op(mem, op); + } + + /* Instead of busy looping invoke readl_poll_timeout functionality. */ +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 2e73d75a6ac5..ae95ec0bc964 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1441,6 +1441,10 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = { + { PCI_VDEVICE(INTEL, 0x4b2a), LPSS_BXT_SSP }, + { PCI_VDEVICE(INTEL, 0x4b2b), LPSS_BXT_SSP }, + { PCI_VDEVICE(INTEL, 0x4b37), LPSS_BXT_SSP }, ++ /* JSL */ ++ { PCI_VDEVICE(INTEL, 0x4daa), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0x4dab), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0x4dfb), LPSS_CNL_SSP }, + /* APL */ + { PCI_VDEVICE(INTEL, 0x5ac2), LPSS_BXT_SSP }, + { PCI_VDEVICE(INTEL, 0x5ac4), LPSS_BXT_SSP }, +diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c +index 3cb65371ae3b..66dcb6128539 100644 +--- a/drivers/spi/spi-ti-qspi.c ++++ b/drivers/spi/spi-ti-qspi.c +@@ -62,6 +62,7 @@ struct ti_qspi { + u32 dc; + + bool mmap_enabled; ++ int current_cs; + }; + + #define QSPI_PID (0x0) +@@ -487,6 +488,7 @@ static void ti_qspi_enable_memory_map(struct spi_device *spi) + MEM_CS_EN(spi->chip_select)); + } + qspi->mmap_enabled = true; ++ qspi->current_cs = spi->chip_select; + } + + static void ti_qspi_disable_memory_map(struct spi_device *spi) +@@ -498,6 +500,7 @@ static void ti_qspi_disable_memory_map(struct spi_device *spi) + regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg, + MEM_CS_MASK, 0); + qspi->mmap_enabled = false; ++ qspi->current_cs = -1; + } + + static void ti_qspi_setup_mmap_read(struct spi_device *spi, u8 opcode, +@@ -543,7 +546,7 @@ static int ti_qspi_exec_mem_op(struct spi_mem *mem, + + mutex_lock(&qspi->list_lock); + +- if (!qspi->mmap_enabled) ++ if (!qspi->mmap_enabled || qspi->current_cs != mem->spi->chip_select) + ti_qspi_enable_memory_map(mem->spi); + ti_qspi_setup_mmap_read(mem->spi, op->cmd.opcode, op->data.buswidth, + op->addr.nbytes, op->dummy.nbytes); +@@ -799,6 +802,7 @@ no_dma: + } + } + qspi->mmap_enabled = false; ++ qspi->current_cs = -1; + + ret = devm_spi_register_master(&pdev->dev, master); + if (!ret) +diff --git a/drivers/staging/axis-fifo/Kconfig b/drivers/staging/axis-fifo/Kconfig +index 3fffe4d6f327..f180a8e9f58a 100644 +--- a/drivers/staging/axis-fifo/Kconfig ++++ b/drivers/staging/axis-fifo/Kconfig +@@ -4,7 +4,7 @@ + # + config XIL_AXIS_FIFO + tristate "Xilinx AXI-Stream FIFO IP core driver" +- depends on OF ++ depends on OF && HAS_IOMEM + help + This adds support for the Xilinx AXI-Stream FIFO IP core driver. + The AXI Streaming FIFO allows memory mapped access to a AXI Streaming +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 1ac1095bfeac..5e92c6abe306 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -203,9 +203,58 @@ static const unsigned short super_speed_maxpacket_maxes[4] = { + [USB_ENDPOINT_XFER_INT] = 1024, + }; + +-static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, +- int asnum, struct usb_host_interface *ifp, int num_ep, +- unsigned char *buffer, int size) ++static bool endpoint_is_duplicate(struct usb_endpoint_descriptor *e1, ++ struct usb_endpoint_descriptor *e2) ++{ ++ if (e1->bEndpointAddress == e2->bEndpointAddress) ++ return true; ++ ++ if (usb_endpoint_xfer_control(e1) || usb_endpoint_xfer_control(e2)) { ++ if (usb_endpoint_num(e1) == usb_endpoint_num(e2)) ++ return true; ++ } ++ ++ return false; ++} ++ ++/* ++ * Check for duplicate endpoint addresses in other interfaces and in the ++ * altsetting currently being parsed. ++ */ ++static bool config_endpoint_is_duplicate(struct usb_host_config *config, ++ int inum, int asnum, struct usb_endpoint_descriptor *d) ++{ ++ struct usb_endpoint_descriptor *epd; ++ struct usb_interface_cache *intfc; ++ struct usb_host_interface *alt; ++ int i, j, k; ++ ++ for (i = 0; i < config->desc.bNumInterfaces; ++i) { ++ intfc = config->intf_cache[i]; ++ ++ for (j = 0; j < intfc->num_altsetting; ++j) { ++ alt = &intfc->altsetting[j]; ++ ++ if (alt->desc.bInterfaceNumber == inum && ++ alt->desc.bAlternateSetting != asnum) ++ continue; ++ ++ for (k = 0; k < alt->desc.bNumEndpoints; ++k) { ++ epd = &alt->endpoint[k].desc; ++ ++ if (endpoint_is_duplicate(epd, d)) ++ return true; ++ } ++ } ++ } ++ ++ return false; ++} ++ ++static int usb_parse_endpoint(struct device *ddev, int cfgno, ++ struct usb_host_config *config, int inum, int asnum, ++ struct usb_host_interface *ifp, int num_ep, ++ unsigned char *buffer, int size) + { + unsigned char *buffer0 = buffer; + struct usb_endpoint_descriptor *d; +@@ -242,13 +291,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, + goto skip_to_next_endpoint_or_interface_descriptor; + + /* Check for duplicate endpoint addresses */ +- for (i = 0; i < ifp->desc.bNumEndpoints; ++i) { +- if (ifp->endpoint[i].desc.bEndpointAddress == +- d->bEndpointAddress) { +- dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", +- cfgno, inum, asnum, d->bEndpointAddress); +- goto skip_to_next_endpoint_or_interface_descriptor; +- } ++ if (config_endpoint_is_duplicate(config, inum, asnum, d)) { ++ dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", ++ cfgno, inum, asnum, d->bEndpointAddress); ++ goto skip_to_next_endpoint_or_interface_descriptor; + } + + endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; +@@ -522,8 +568,8 @@ static int usb_parse_interface(struct device *ddev, int cfgno, + if (((struct usb_descriptor_header *) buffer)->bDescriptorType + == USB_DT_INTERFACE) + break; +- retval = usb_parse_endpoint(ddev, cfgno, inum, asnum, alt, +- num_ep, buffer, size); ++ retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum, ++ alt, num_ep, buffer, size); + if (retval < 0) + return retval; + ++n; +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index dfe9ac8d2375..8b23162e4239 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2691,7 +2691,7 @@ static unsigned hub_is_wusb(struct usb_hub *hub) + #define SET_ADDRESS_TRIES 2 + #define GET_DESCRIPTOR_TRIES 2 + #define SET_CONFIG_TRIES (2 * (use_both_schemes + 1)) +-#define USE_NEW_SCHEME(i, scheme) ((i) / 2 == (int)scheme) ++#define USE_NEW_SCHEME(i, scheme) ((i) / 2 == (int)(scheme)) + + #define HUB_ROOT_RESET_TIME 60 /* times are in msec */ + #define HUB_SHORT_RESET_TIME 10 +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 0c960a97ea02..154f3f3e8cff 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2467,6 +2467,13 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep, + + static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req) + { ++ /* ++ * For OUT direction, host may send less than the setup ++ * length. Return true for all OUT requests. ++ */ ++ if (!req->direction) ++ return true; ++ + return req->request.actual == req->request.length; + } + +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index a8f1e5707c14..4c9d1e49d5ed 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -1321,7 +1321,7 @@ static int dummy_perform_transfer(struct urb *urb, struct dummy_request *req, + u32 this_sg; + bool next_sg; + +- to_host = usb_pipein(urb->pipe); ++ to_host = usb_urb_dir_in(urb); + rbuf = req->req.buf + req->req.actual; + + if (!urb->num_sgs) { +@@ -1409,7 +1409,7 @@ top: + + /* FIXME update emulated data toggle too */ + +- to_host = usb_pipein(urb->pipe); ++ to_host = usb_urb_dir_in(urb); + if (unlikely(len == 0)) + is_short = 1; + else { +@@ -1830,7 +1830,7 @@ restart: + + /* find the gadget's ep for this request (if configured) */ + address = usb_pipeendpoint (urb->pipe); +- if (usb_pipein(urb->pipe)) ++ if (usb_urb_dir_in(urb)) + address |= USB_DIR_IN; + ep = find_endpoint(dum, address); + if (!ep) { +@@ -2385,7 +2385,7 @@ static inline ssize_t show_urb(char *buf, size_t size, struct urb *urb) + s = "?"; + break; + } s; }), +- ep, ep ? (usb_pipein(urb->pipe) ? "in" : "out") : "", ++ ep, ep ? (usb_urb_dir_in(urb) ? "in" : "out") : "", + ({ char *s; \ + switch (usb_pipetype(urb->pipe)) { \ + case PIPE_CONTROL: \ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index e9491d400a24..fea09a3f491f 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1172,6 +1172,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff), /* Telit ME910G1 */ ++ .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), +diff --git a/drivers/usb/typec/tcpm/Kconfig b/drivers/usb/typec/tcpm/Kconfig +index 72481bbb2af3..5b986d6c801d 100644 +--- a/drivers/usb/typec/tcpm/Kconfig ++++ b/drivers/usb/typec/tcpm/Kconfig +@@ -32,6 +32,7 @@ endif # TYPEC_TCPCI + config TYPEC_FUSB302 + tristate "Fairchild FUSB302 Type-C chip driver" + depends on I2C ++ depends on EXTCON || !EXTCON + help + The Fairchild FUSB302 Type-C chip driver that works with + Type-C Port Controller Manager to provide USB PD and USB +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index eb95ed78a18e..dc50605ecbda 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -3781,6 +3781,7 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info, + u64 flags, int delalloc) + { + int ret = 0; ++ int cache_block_group_error = 0; + struct btrfs_free_cluster *last_ptr = NULL; + struct btrfs_block_group_cache *block_group = NULL; + struct find_free_extent_ctl ffe_ctl = {0}; +@@ -3940,7 +3941,20 @@ have_block_group: + if (unlikely(!ffe_ctl.cached)) { + ffe_ctl.have_caching_bg = true; + ret = btrfs_cache_block_group(block_group, 0); +- BUG_ON(ret < 0); ++ ++ /* ++ * If we get ENOMEM here or something else we want to ++ * try other block groups, because it may not be fatal. ++ * However if we can't find anything else we need to ++ * save our return here so that we return the actual ++ * error that caused problems, not ENOSPC. ++ */ ++ if (ret < 0) { ++ if (!cache_block_group_error) ++ cache_block_group_error = ret; ++ ret = 0; ++ goto loop; ++ } + ret = 0; + } + +@@ -4027,7 +4041,7 @@ loop: + if (ret > 0) + goto search; + +- if (ret == -ENOSPC) { ++ if (ret == -ENOSPC && !cache_block_group_error) { + /* + * Use ffe_ctl->total_free_space as fallback if we can't find + * any contiguous hole. +@@ -4038,6 +4052,8 @@ loop: + space_info->max_extent_size = ffe_ctl.max_extent_size; + spin_unlock(&space_info->lock); + ins->offset = ffe_ctl.max_extent_size; ++ } else if (ret == -ENOSPC) { ++ ret = cache_block_group_error; + } + return ret; + } +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index c332968f9056..eaafd00f93d4 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -2601,8 +2601,8 @@ int btrfs_punch_hole_range(struct inode *inode, struct btrfs_path *path, + } + } + +- if (clone_info) { +- u64 clone_len = drop_end - cur_offset; ++ if (clone_info && drop_end > clone_info->file_offset) { ++ u64 clone_len = drop_end - clone_info->file_offset; + + ret = btrfs_insert_clone_extent(trans, inode, path, + clone_info, clone_len); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index a56dcc0c9c2a..5720e450a46f 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3727,24 +3727,18 @@ process_slot: + ret = 0; + + if (last_dest_end < destoff + len) { +- struct btrfs_clone_extent_info clone_info = { 0 }; + /* +- * We have an implicit hole (NO_HOLES feature is enabled) that +- * fully or partially overlaps our cloning range at its end. ++ * We have an implicit hole that fully or partially overlaps our ++ * cloning range at its end. This means that we either have the ++ * NO_HOLES feature enabled or the implicit hole happened due to ++ * mixing buffered and direct IO writes against this file. + */ + btrfs_release_path(path); + path->leave_spinning = 0; + +- /* +- * We are dealing with a hole and our clone_info already has a +- * disk_offset of 0, we only need to fill the data length and +- * file offset. +- */ +- clone_info.data_len = destoff + len - last_dest_end; +- clone_info.file_offset = last_dest_end; + ret = btrfs_punch_hole_range(inode, path, + last_dest_end, destoff + len - 1, +- &clone_info, &trans); ++ NULL, &trans); + if (ret) + goto out; + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 27a903aaf43b..aeb5f2f3cdd7 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3232,12 +3232,12 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, + if (!(fs_info->qgroup_flags & + BTRFS_QGROUP_STATUS_FLAG_RESCAN)) { + btrfs_warn(fs_info, +- "qgroup rescan init failed, qgroup is not enabled"); ++ "qgroup rescan init failed, qgroup rescan is not queued"); + ret = -EINVAL; + } else if (!(fs_info->qgroup_flags & + BTRFS_QGROUP_STATUS_FLAG_ON)) { + btrfs_warn(fs_info, +- "qgroup rescan init failed, qgroup rescan is not queued"); ++ "qgroup rescan init failed, qgroup is not enabled"); + ret = -EINVAL; + } + +diff --git a/fs/drop_caches.c b/fs/drop_caches.c +index d31b6c72b476..dc1a1d5d825b 100644 +--- a/fs/drop_caches.c ++++ b/fs/drop_caches.c +@@ -35,11 +35,11 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused) + spin_unlock(&inode->i_lock); + spin_unlock(&sb->s_inode_list_lock); + +- cond_resched(); + invalidate_mapping_pages(inode->i_mapping, 0, -1); + iput(toput_inode); + toput_inode = inode; + ++ cond_resched(); + spin_lock(&sb->s_inode_list_lock); + } + spin_unlock(&sb->s_inode_list_lock); +diff --git a/fs/inode.c b/fs/inode.c +index fef457a42882..96d62d97694e 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -676,6 +676,7 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty) + struct inode *inode, *next; + LIST_HEAD(dispose); + ++again: + spin_lock(&sb->s_inode_list_lock); + list_for_each_entry_safe(inode, next, &sb->s_inodes, i_sb_list) { + spin_lock(&inode->i_lock); +@@ -698,6 +699,12 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty) + inode_lru_list_del(inode); + spin_unlock(&inode->i_lock); + list_add(&inode->i_lru, &dispose); ++ if (need_resched()) { ++ spin_unlock(&sb->s_inode_list_lock); ++ cond_resched(); ++ dispose_list(&dispose); ++ goto again; ++ } + } + spin_unlock(&sb->s_inode_list_lock); + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index a60c6315a348..709671faaed6 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -3721,6 +3721,9 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, + mutex_lock(&ctx->uring_lock); + submitted = io_ring_submit(ctx, to_submit); + mutex_unlock(&ctx->uring_lock); ++ ++ if (submitted != to_submit) ++ goto out; + } + if (flags & IORING_ENTER_GETEVENTS) { + unsigned nr_events = 0; +@@ -3734,6 +3737,7 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, + } + } + ++out: + percpu_ref_put(&ctx->refs); + out_fput: + fdput(f); +diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c +index 2ecef6155fc0..f44e39c68328 100644 +--- a/fs/notify/fsnotify.c ++++ b/fs/notify/fsnotify.c +@@ -57,6 +57,9 @@ static void fsnotify_unmount_inodes(struct super_block *sb) + * doing an __iget/iput with SB_ACTIVE clear would actually + * evict all inodes with zero i_count from icache which is + * unnecessarily violent and may in fact be illegal to do. ++ * However, we should have been called /after/ evict_inodes ++ * removed all zero refcount inodes, in any case. Test to ++ * be sure. + */ + if (!atomic_read(&inode->i_count)) { + spin_unlock(&inode->i_lock); +@@ -77,6 +80,7 @@ static void fsnotify_unmount_inodes(struct super_block *sb) + + iput_inode = inode; + ++ cond_resched(); + spin_lock(&sb->s_inode_list_lock); + } + spin_unlock(&sb->s_inode_list_lock); +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 9b96243de081..7abc3230c21a 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -986,6 +986,7 @@ static int add_dquot_ref(struct super_block *sb, int type) + * later. + */ + old_inode = inode; ++ cond_resched(); + spin_lock(&sb->s_inode_list_lock); + } + spin_unlock(&sb->s_inode_list_lock); +diff --git a/fs/super.c b/fs/super.c +index cfadab2cbf35..cd352530eca9 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -448,10 +448,12 @@ void generic_shutdown_super(struct super_block *sb) + sync_filesystem(sb); + sb->s_flags &= ~SB_ACTIVE; + +- fsnotify_sb_delete(sb); + cgroup_writeback_umount(); + ++ /* evict all inodes with zero refcount */ + evict_inodes(sb); ++ /* only nonzero refcount inodes can have marks */ ++ fsnotify_sb_delete(sb); + + if (sb->s_dio_done_wq) { + destroy_workqueue(sb->s_dio_done_wq); +diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h +index 76cf11e905e1..8a9792a6427a 100644 +--- a/include/linux/if_ether.h ++++ b/include/linux/if_ether.h +@@ -24,6 +24,14 @@ static inline struct ethhdr *eth_hdr(const struct sk_buff *skb) + return (struct ethhdr *)skb_mac_header(skb); + } + ++/* Prefer this version in TX path, instead of ++ * skb_reset_mac_header() + eth_hdr() ++ */ ++static inline struct ethhdr *skb_eth_hdr(const struct sk_buff *skb) ++{ ++ return (struct ethhdr *)skb->data; ++} ++ + static inline struct ethhdr *inner_eth_hdr(const struct sk_buff *skb) + { + return (struct ethhdr *)skb_inner_mac_header(skb); +diff --git a/include/uapi/linux/netfilter/xt_sctp.h b/include/uapi/linux/netfilter/xt_sctp.h +index 4bc6d1a08781..b4d804a9fccb 100644 +--- a/include/uapi/linux/netfilter/xt_sctp.h ++++ b/include/uapi/linux/netfilter/xt_sctp.h +@@ -41,19 +41,19 @@ struct xt_sctp_info { + #define SCTP_CHUNKMAP_SET(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] |= \ +- 1 << (type % bytes(__u32)); \ ++ 1u << (type % bytes(__u32)); \ + } while (0) + + #define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] &= \ +- ~(1 << (type % bytes(__u32))); \ ++ ~(1u << (type % bytes(__u32))); \ + } while (0) + + #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \ + ({ \ + ((chunkmap)[type / bytes (__u32)] & \ +- (1 << (type % bytes (__u32)))) ? 1: 0; \ ++ (1u << (type % bytes (__u32)))) ? 1: 0; \ + }) + + #define SCTP_CHUNKMAP_RESET(chunkmap) \ +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 5c51021775af..9c74c98f6501 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6039,6 +6039,7 @@ static bool may_access_skb(enum bpf_prog_type type) + static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) + { + struct bpf_reg_state *regs = cur_regs(env); ++ static const int ctx_reg = BPF_REG_6; + u8 mode = BPF_MODE(insn->code); + int i, err; + +@@ -6072,7 +6073,7 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) + } + + /* check whether implicit source operand (register R6) is readable */ +- err = check_reg_arg(env, BPF_REG_6, SRC_OP); ++ err = check_reg_arg(env, ctx_reg, SRC_OP); + if (err) + return err; + +@@ -6091,7 +6092,7 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) + return -EINVAL; + } + +- if (regs[BPF_REG_6].type != PTR_TO_CTX) { ++ if (regs[ctx_reg].type != PTR_TO_CTX) { + verbose(env, + "at the time of BPF_LD_ABS|IND R6 != pointer to skb\n"); + return -EINVAL; +@@ -6104,6 +6105,10 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) + return err; + } + ++ err = check_ctx_reg(env, ®s[ctx_reg], ctx_reg); ++ if (err < 0) ++ return err; ++ + /* reset caller saved regs to unreadable */ + for (i = 0; i < CALLER_SAVED_REGS; i++) { + mark_reg_not_init(env, regs, caller_saved[i]); +diff --git a/kernel/locking/spinlock_debug.c b/kernel/locking/spinlock_debug.c +index 399669f7eba8..472dd462a40c 100644 +--- a/kernel/locking/spinlock_debug.c ++++ b/kernel/locking/spinlock_debug.c +@@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init); + + static void spin_dump(raw_spinlock_t *lock, const char *msg) + { +- struct task_struct *owner = NULL; ++ struct task_struct *owner = READ_ONCE(lock->owner); + +- if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT) +- owner = lock->owner; ++ if (owner == SPINLOCK_OWNER_INIT) ++ owner = NULL; + printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n", + msg, raw_smp_processor_id(), + current->comm, task_pid_nr(current)); + printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, " + ".owner_cpu: %d\n", +- lock, lock->magic, ++ lock, READ_ONCE(lock->magic), + owner ? owner->comm : "", + owner ? task_pid_nr(owner) : -1, +- lock->owner_cpu); ++ READ_ONCE(lock->owner_cpu)); + dump_stack(); + } + +@@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *lock, const char *msg) + static inline void + debug_spin_lock_before(raw_spinlock_t *lock) + { +- SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic"); +- SPIN_BUG_ON(lock->owner == current, lock, "recursion"); +- SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(), ++ SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic"); ++ SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion"); ++ SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(), + lock, "cpu recursion"); + } + + static inline void debug_spin_lock_after(raw_spinlock_t *lock) + { +- lock->owner_cpu = raw_smp_processor_id(); +- lock->owner = current; ++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); ++ WRITE_ONCE(lock->owner, current); + } + + static inline void debug_spin_unlock(raw_spinlock_t *lock) +@@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw_spinlock_t *lock) + SPIN_BUG_ON(lock->owner != current, lock, "wrong owner"); + SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), + lock, "wrong CPU"); +- lock->owner = SPINLOCK_OWNER_INIT; +- lock->owner_cpu = -1; ++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); ++ WRITE_ONCE(lock->owner_cpu, -1); + } + + /* +@@ -187,8 +187,8 @@ static inline void debug_write_lock_before(rwlock_t *lock) + + static inline void debug_write_lock_after(rwlock_t *lock) + { +- lock->owner_cpu = raw_smp_processor_id(); +- lock->owner = current; ++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); ++ WRITE_ONCE(lock->owner, current); + } + + static inline void debug_write_unlock(rwlock_t *lock) +@@ -197,8 +197,8 @@ static inline void debug_write_unlock(rwlock_t *lock) + RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner"); + RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), + lock, "wrong CPU"); +- lock->owner = SPINLOCK_OWNER_INIT; +- lock->owner_cpu = -1; ++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); ++ WRITE_ONCE(lock->owner_cpu, -1); + } + + void do_raw_write_lock(rwlock_t *lock) +diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c +index 517e3719027e..ce8f6748678a 100644 +--- a/kernel/sched/psi.c ++++ b/kernel/sched/psi.c +@@ -185,7 +185,8 @@ static void group_init(struct psi_group *group) + + for_each_possible_cpu(cpu) + seqcount_init(&per_cpu_ptr(group->pcpu, cpu)->seq); +- group->avg_next_update = sched_clock() + psi_period; ++ group->avg_last_update = sched_clock(); ++ group->avg_next_update = group->avg_last_update + psi_period; + INIT_DELAYED_WORK(&group->avgs_work, psi_avgs_work); + mutex_init(&group->avgs_lock); + /* Init trigger-related members */ +@@ -481,7 +482,7 @@ static u64 window_update(struct psi_window *win, u64 now, u64 value) + u32 remaining; + + remaining = win->size - elapsed; +- growth += div_u64(win->prev_growth * remaining, win->size); ++ growth += div64_u64(win->prev_growth * remaining, win->size); + } + + return growth; +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 66358d66c933..4bf050fcfe3b 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include /* for self test */ +@@ -5068,6 +5069,11 @@ static __init int test_ringbuffer(void) + int cpu; + int ret = 0; + ++ if (security_locked_down(LOCKDOWN_TRACEFS)) { ++ pr_warning("Lockdown is enabled, skipping ring buffer tests\n"); ++ return 0; ++ } ++ + pr_info("Running ring buffer tests...\n"); + + buffer = ring_buffer_alloc(RB_TEST_BUFFER_SIZE, RB_FL_OVERWRITE); +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index d8bd9b1d8bce..bcb72f102613 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1804,6 +1804,12 @@ int __init register_tracer(struct tracer *type) + return -1; + } + ++ if (security_locked_down(LOCKDOWN_TRACEFS)) { ++ pr_warning("Can not register tracer %s due to lockdown\n", ++ type->name); ++ return -EPERM; ++ } ++ + mutex_lock(&trace_types_lock); + + tracing_selftest_running = true; +@@ -8647,6 +8653,11 @@ struct dentry *tracing_init_dentry(void) + { + struct trace_array *tr = &global_trace; + ++ if (security_locked_down(LOCKDOWN_TRACEFS)) { ++ pr_warning("Tracing disabled due to lockdown\n"); ++ return ERR_PTR(-EPERM); ++ } ++ + /* The top level trace array uses NULL as parent */ + if (tr->dir) + return NULL; +@@ -9089,6 +9100,12 @@ __init static int tracer_alloc_buffers(void) + int ring_buf_size; + int ret = -ENOMEM; + ++ ++ if (security_locked_down(LOCKDOWN_TRACEFS)) { ++ pr_warning("Tracing disabled due to lockdown\n"); ++ return -EPERM; ++ } ++ + /* + * Make sure we don't accidently add more trace options + * than we have bits for. +diff --git a/lib/sbitmap.c b/lib/sbitmap.c +index 969e5400a615..ee3ce1494568 100644 +--- a/lib/sbitmap.c ++++ b/lib/sbitmap.c +@@ -667,8 +667,8 @@ void sbitmap_add_wait_queue(struct sbitmap_queue *sbq, + if (!sbq_wait->sbq) { + sbq_wait->sbq = sbq; + atomic_inc(&sbq->ws_active); ++ add_wait_queue(&ws->wait, &sbq_wait->wait); + } +- add_wait_queue(&ws->wait, &sbq_wait->wait); + } + EXPORT_SYMBOL_GPL(sbitmap_add_wait_queue); + +diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h +index c46daf09a501..bb7ec1a3915d 100644 +--- a/net/8021q/vlan.h ++++ b/net/8021q/vlan.h +@@ -126,6 +126,7 @@ int vlan_check_real_dev(struct net_device *real_dev, + void vlan_setup(struct net_device *dev); + int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack); + void unregister_vlan_dev(struct net_device *dev, struct list_head *head); ++void vlan_dev_uninit(struct net_device *dev); + bool vlan_dev_inherit_address(struct net_device *dev, + struct net_device *real_dev); + +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index e5bff5cc6f97..2a78da4072de 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -586,7 +586,8 @@ static int vlan_dev_init(struct net_device *dev) + return 0; + } + +-static void vlan_dev_uninit(struct net_device *dev) ++/* Note: this function might be called multiple times for the same device. */ ++void vlan_dev_uninit(struct net_device *dev) + { + struct vlan_priority_tci_mapping *pm; + struct vlan_dev_priv *vlan = vlan_dev_priv(dev); +diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c +index c482a6fe9393..0db85aeb119b 100644 +--- a/net/8021q/vlan_netlink.c ++++ b/net/8021q/vlan_netlink.c +@@ -108,11 +108,13 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[], + struct ifla_vlan_flags *flags; + struct ifla_vlan_qos_mapping *m; + struct nlattr *attr; +- int rem; ++ int rem, err; + + if (data[IFLA_VLAN_FLAGS]) { + flags = nla_data(data[IFLA_VLAN_FLAGS]); +- vlan_dev_change_flags(dev, flags->flags, flags->mask); ++ err = vlan_dev_change_flags(dev, flags->flags, flags->mask); ++ if (err) ++ return err; + } + if (data[IFLA_VLAN_INGRESS_QOS]) { + nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) { +@@ -123,7 +125,9 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[], + if (data[IFLA_VLAN_EGRESS_QOS]) { + nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) { + m = nla_data(attr); +- vlan_dev_set_egress_priority(dev, m->from, m->to); ++ err = vlan_dev_set_egress_priority(dev, m->from, m->to); ++ if (err) ++ return err; + } + } + return 0; +@@ -179,10 +183,11 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev, + return -EINVAL; + + err = vlan_changelink(dev, tb, data, extack); +- if (err < 0) +- return err; +- +- return register_vlan_dev(dev, extack); ++ if (!err) ++ err = register_vlan_dev(dev, extack); ++ if (err) ++ vlan_dev_uninit(dev); ++ return err; + } + + static inline size_t vlan_qos_map_size(unsigned int n) +diff --git a/net/core/filter.c b/net/core/filter.c +index 6d0111bfdb4a..2f76461c120d 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2055,6 +2055,7 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb) + } + + skb->dev = dev; ++ skb->tstamp = 0; + + dev_xmit_recursion_inc(); + ret = dev_queue_xmit(skb); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index a2e52ad7cdab..67e44e6717b0 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -1727,8 +1727,11 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb, + } + + /* Ignore very old stuff early */ +- if (!after(sp[used_sacks].end_seq, prior_snd_una)) ++ if (!after(sp[used_sacks].end_seq, prior_snd_una)) { ++ if (i == 0) ++ first_sack_index = -1; + continue; ++ } + + used_sacks++; + } +diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c +index 204a8351efff..c29170e767a8 100644 +--- a/net/llc/llc_station.c ++++ b/net/llc/llc_station.c +@@ -32,7 +32,7 @@ static int llc_stat_ev_rx_null_dsap_xid_c(struct sk_buff *skb) + return LLC_PDU_IS_CMD(pdu) && /* command PDU */ + LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ + LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID && +- !pdu->dsap ? 0 : 1; /* NULL DSAP value */ ++ !pdu->dsap; /* NULL DSAP value */ + } + + static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) +@@ -42,7 +42,7 @@ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) + return LLC_PDU_IS_CMD(pdu) && /* command PDU */ + LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ + LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST && +- !pdu->dsap ? 0 : 1; /* NULL DSAP */ ++ !pdu->dsap; /* NULL DSAP */ + } + + static int llc_station_ac_send_xid_r(struct sk_buff *skb) +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 1fa422782905..cbd273c0b275 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -2263,6 +2263,15 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb, + payload[7]); + } + ++ /* ++ * Initialize skb->priority for QoS frames. This is put in the TID field ++ * of the frame before passing it to the driver. ++ */ ++ if (ieee80211_is_data_qos(hdr->frame_control)) { ++ u8 *p = ieee80211_get_qos_ctl(hdr); ++ skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK; ++ } ++ + memset(info, 0, sizeof(*info)); + + info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS | +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index e2d13cd18875..aa8adf930b3c 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -3602,6 +3602,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list) + + list_for_each_entry(net, net_exit_list, exit_list) + ctnetlink_net_exit(net); ++ ++ /* wait for other cpus until they are done with ctnl_notifiers */ ++ synchronize_rcu(); + } + + static struct pernet_operations ctnetlink_net_ops = { +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 712a428509ad..67ca47c7ce54 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4252,8 +4252,10 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, + return err; + + err = -EINVAL; +- if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) ++ if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) { ++ nft_data_release(&elem.key.val, desc.type); + return err; ++ } + + priv = set->ops->get(ctx->net, set, &elem, flags); + if (IS_ERR(priv)) +@@ -4489,14 +4491,20 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + if (nla[NFTA_SET_ELEM_DATA] == NULL && + !(flags & NFT_SET_ELEM_INTERVAL_END)) + return -EINVAL; +- if (nla[NFTA_SET_ELEM_DATA] != NULL && +- flags & NFT_SET_ELEM_INTERVAL_END) +- return -EINVAL; + } else { + if (nla[NFTA_SET_ELEM_DATA] != NULL) + return -EINVAL; + } + ++ if ((flags & NFT_SET_ELEM_INTERVAL_END) && ++ (nla[NFTA_SET_ELEM_DATA] || ++ nla[NFTA_SET_ELEM_OBJREF] || ++ nla[NFTA_SET_ELEM_TIMEOUT] || ++ nla[NFTA_SET_ELEM_EXPIRATION] || ++ nla[NFTA_SET_ELEM_USERDATA] || ++ nla[NFTA_SET_ELEM_EXPR])) ++ return -EINVAL; ++ + timeout = 0; + if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { + if (!(set->flags & NFT_SET_TIMEOUT)) +@@ -5209,7 +5217,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, + if (nlh->nlmsg_flags & NLM_F_REPLACE) + return -EOPNOTSUPP; + +- type = nft_obj_type_get(net, objtype); ++ type = __nft_obj_type_get(objtype); + nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + + return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); +diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c +index 5f6037695dee..e743f811245f 100644 +--- a/net/netfilter/nf_tables_offload.c ++++ b/net/netfilter/nf_tables_offload.c +@@ -44,6 +44,9 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, + expr = nft_expr_next(expr); + } + ++ if (num_actions == 0) ++ return ERR_PTR(-EOPNOTSUPP); ++ + flow = nft_flow_rule_alloc(num_actions); + if (!flow) + return ERR_PTR(-ENOMEM); +@@ -446,6 +449,9 @@ static int nft_offload_netdev_event(struct notifier_block *this, + struct net *net = dev_net(dev); + struct nft_chain *chain; + ++ if (event != NETDEV_UNREGISTER) ++ return NOTIFY_DONE; ++ + mutex_lock(&net->nft.commit_mutex); + chain = __nft_offload_get_chain(dev); + if (chain) +diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c +index 02afa752dd2e..10e9d50e4e19 100644 +--- a/net/netfilter/nft_bitwise.c ++++ b/net/netfilter/nft_bitwise.c +@@ -80,7 +80,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, + tb[NFTA_BITWISE_MASK]); + if (err < 0) + return err; +- if (d1.len != priv->len) { ++ if (d1.type != NFT_DATA_VALUE || d1.len != priv->len) { + err = -EINVAL; + goto err1; + } +@@ -89,7 +89,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, + tb[NFTA_BITWISE_XOR]); + if (err < 0) + goto err1; +- if (d2.len != priv->len) { ++ if (d2.type != NFT_DATA_VALUE || d2.len != priv->len) { + err = -EINVAL; + goto err2; + } +diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c +index 0744b2bb46da..ae730dba60c8 100644 +--- a/net/netfilter/nft_cmp.c ++++ b/net/netfilter/nft_cmp.c +@@ -80,6 +80,12 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + if (err < 0) + return err; + ++ if (desc.type != NFT_DATA_VALUE) { ++ err = -EINVAL; ++ nft_data_release(&priv->data, desc.type); ++ return err; ++ } ++ + priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]); + err = nft_validate_register_load(priv->sreg, desc.len); + if (err < 0) +diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c +index 4701fa8a45e7..89efcc5a533d 100644 +--- a/net/netfilter/nft_range.c ++++ b/net/netfilter/nft_range.c +@@ -66,11 +66,21 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr + if (err < 0) + return err; + ++ if (desc_from.type != NFT_DATA_VALUE) { ++ err = -EINVAL; ++ goto err1; ++ } ++ + err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to), + &desc_to, tb[NFTA_RANGE_TO_DATA]); + if (err < 0) + goto err1; + ++ if (desc_to.type != NFT_DATA_VALUE) { ++ err = -EINVAL; ++ goto err2; ++ } ++ + if (desc_from.len != desc_to.len) { + err = -EINVAL; + goto err2; +diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c +index 57123259452f..a9f804f7a04a 100644 +--- a/net/netfilter/nft_set_rbtree.c ++++ b/net/netfilter/nft_set_rbtree.c +@@ -74,8 +74,13 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set + parent = rcu_dereference_raw(parent->rb_left); + continue; + } +- if (nft_rbtree_interval_end(rbe)) +- goto out; ++ if (nft_rbtree_interval_end(rbe)) { ++ if (nft_set_is_anonymous(set)) ++ return false; ++ parent = rcu_dereference_raw(parent->rb_left); ++ interval = NULL; ++ continue; ++ } + + *ext = &rbe->ext; + return true; +@@ -88,7 +93,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set + *ext = &interval->ext; + return true; + } +-out: ++ + return false; + } + +@@ -139,8 +144,10 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, + if (flags & NFT_SET_ELEM_INTERVAL_END) + interval = rbe; + } else { +- if (!nft_set_elem_active(&rbe->ext, genmask)) ++ if (!nft_set_elem_active(&rbe->ext, genmask)) { + parent = rcu_dereference_raw(parent->rb_left); ++ continue; ++ } + + if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) || + (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) == +@@ -148,7 +155,11 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, + *elem = rbe; + return true; + } +- return false; ++ ++ if (nft_rbtree_interval_end(rbe)) ++ interval = NULL; ++ ++ parent = rcu_dereference_raw(parent->rb_left); + } + } + +diff --git a/net/rfkill/core.c b/net/rfkill/core.c +index 0bf9bf1ceb8f..6c089320ae4f 100644 +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -1002,10 +1002,13 @@ static void rfkill_sync_work(struct work_struct *work) + int __must_check rfkill_register(struct rfkill *rfkill) + { + static unsigned long rfkill_no; +- struct device *dev = &rfkill->dev; ++ struct device *dev; + int error; + +- BUG_ON(!rfkill); ++ if (!rfkill) ++ return -EINVAL; ++ ++ dev = &rfkill->dev; + + mutex_lock(&rfkill_global_mutex); + +diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c +index 53a80bc6b13a..dd0e8680b030 100644 +--- a/net/sched/sch_cake.c ++++ b/net/sched/sch_cake.c +@@ -1769,7 +1769,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, + q->avg_window_begin)); + u64 b = q->avg_window_bytes * (u64)NSEC_PER_SEC; + +- do_div(b, window_interval); ++ b = div64_u64(b, window_interval); + q->avg_peak_bandwidth = + cake_ewma(q->avg_peak_bandwidth, b, + b > q->avg_peak_bandwidth ? 2 : 8); +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 78ecdf146882..712ad248d6a7 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -787,10 +787,12 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt, + if (tb[TCA_FQ_QUANTUM]) { + u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]); + +- if (quantum > 0) ++ if (quantum > 0 && quantum <= (1 << 20)) { + q->quantum = quantum; +- else ++ } else { ++ NL_SET_ERR_MSG_MOD(extack, "invalid quantum"); + err = -EINVAL; ++ } + } + + if (tb[TCA_FQ_INITIAL_QUANTUM]) +diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c +index 18b884cfdfe8..647941702f9f 100644 +--- a/net/sched/sch_prio.c ++++ b/net/sched/sch_prio.c +@@ -292,8 +292,14 @@ static int prio_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, + struct tc_prio_qopt_offload graft_offload; + unsigned long band = arg - 1; + +- if (new == NULL) +- new = &noop_qdisc; ++ if (!new) { ++ new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, ++ TC_H_MAKE(sch->handle, arg), extack); ++ if (!new) ++ new = &noop_qdisc; ++ else ++ qdisc_hash_add(new, true); ++ } + + *old = qdisc_replace(sch, new, &q->queues[band]); + +diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c +index e52b2128e43b..b06cae508158 100644 +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -1358,8 +1358,10 @@ static int sctp_cmd_interpreter(enum sctp_event_type event_type, + /* Generate an INIT ACK chunk. */ + new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC, + 0); +- if (!new_obj) +- goto nomem; ++ if (!new_obj) { ++ error = -ENOMEM; ++ break; ++ } + + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, + SCTP_CHUNK(new_obj)); +@@ -1381,7 +1383,8 @@ static int sctp_cmd_interpreter(enum sctp_event_type event_type, + if (!new_obj) { + if (cmd->obj.chunk) + sctp_chunk_free(cmd->obj.chunk); +- goto nomem; ++ error = -ENOMEM; ++ break; + } + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, + SCTP_CHUNK(new_obj)); +@@ -1428,8 +1431,10 @@ static int sctp_cmd_interpreter(enum sctp_event_type event_type, + + /* Generate a SHUTDOWN chunk. */ + new_obj = sctp_make_shutdown(asoc, chunk); +- if (!new_obj) +- goto nomem; ++ if (!new_obj) { ++ error = -ENOMEM; ++ break; ++ } + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, + SCTP_CHUNK(new_obj)); + break; +@@ -1765,11 +1770,17 @@ static int sctp_cmd_interpreter(enum sctp_event_type event_type, + break; + } + +- if (error) ++ if (error) { ++ cmd = sctp_next_cmd(commands); ++ while (cmd) { ++ if (cmd->verb == SCTP_CMD_REPLY) ++ sctp_chunk_free(cmd->obj.chunk); ++ cmd = sctp_next_cmd(commands); ++ } + break; ++ } + } + +-out: + /* If this is in response to a received chunk, wait until + * we are done with the packet to open the queue so that we don't + * send multiple packets in response to a single request. +@@ -1784,7 +1795,4 @@ out: + sp->data_ready_signalled = 0; + + return error; +-nomem: +- error = -ENOMEM; +- goto out; + } +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 350513744575..3e25229a059d 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -1102,6 +1102,7 @@ static void __cfg80211_unregister_wdev(struct wireless_dev *wdev, bool sync) + + #ifdef CONFIG_CFG80211_WEXT + kzfree(wdev->wext.keys); ++ wdev->wext.keys = NULL; + #endif + /* only initialized if we have a netdev */ + if (wdev->netdev) +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 9044073fbf22..d426fc01c529 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -305,12 +305,21 @@ out: + } + EXPORT_SYMBOL(xsk_umem_consume_tx); + +-static int xsk_zc_xmit(struct xdp_sock *xs) ++static int xsk_wakeup(struct xdp_sock *xs, u8 flags) + { + struct net_device *dev = xs->dev; ++ int err; ++ ++ rcu_read_lock(); ++ err = dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, flags); ++ rcu_read_unlock(); ++ ++ return err; ++} + +- return dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, +- XDP_WAKEUP_TX); ++static int xsk_zc_xmit(struct xdp_sock *xs) ++{ ++ return xsk_wakeup(xs, XDP_WAKEUP_TX); + } + + static void xsk_destruct_skb(struct sk_buff *skb) +@@ -424,19 +433,16 @@ static unsigned int xsk_poll(struct file *file, struct socket *sock, + unsigned int mask = datagram_poll(file, sock, wait); + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); +- struct net_device *dev; + struct xdp_umem *umem; + + if (unlikely(!xsk_is_bound(xs))) + return mask; + +- dev = xs->dev; + umem = xs->umem; + + if (umem->need_wakeup) { +- if (dev->netdev_ops->ndo_xsk_wakeup) +- dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, +- umem->need_wakeup); ++ if (xs->zc) ++ xsk_wakeup(xs, umem->need_wakeup); + else + /* Poll needs to drive Tx also in copy mode */ + __xsk_sendmsg(sk); +diff --git a/samples/bpf/syscall_tp_kern.c b/samples/bpf/syscall_tp_kern.c +index 1d78819ffef1..630ce8c4d5a2 100644 +--- a/samples/bpf/syscall_tp_kern.c ++++ b/samples/bpf/syscall_tp_kern.c +@@ -47,13 +47,27 @@ static __always_inline void count(void *map) + SEC("tracepoint/syscalls/sys_enter_open") + int trace_enter_open(struct syscalls_enter_open_args *ctx) + { +- count((void *)&enter_open_map); ++ count(&enter_open_map); ++ return 0; ++} ++ ++SEC("tracepoint/syscalls/sys_enter_openat") ++int trace_enter_open_at(struct syscalls_enter_open_args *ctx) ++{ ++ count(&enter_open_map); + return 0; + } + + SEC("tracepoint/syscalls/sys_exit_open") + int trace_enter_exit(struct syscalls_exit_open_args *ctx) + { +- count((void *)&exit_open_map); ++ count(&exit_open_map); ++ return 0; ++} ++ ++SEC("tracepoint/syscalls/sys_exit_openat") ++int trace_enter_exit_at(struct syscalls_exit_open_args *ctx) ++{ ++ count(&exit_open_map); + return 0; + } +diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c +index 16a16eadd509..749a50f2f9f3 100644 +--- a/samples/bpf/trace_event_user.c ++++ b/samples/bpf/trace_event_user.c +@@ -37,9 +37,9 @@ static void print_ksym(__u64 addr) + } + + printf("%s;", sym->name); +- if (!strcmp(sym->name, "sys_read")) ++ if (!strstr(sym->name, "sys_read")) + sys_read_seen = true; +- else if (!strcmp(sym->name, "sys_write")) ++ else if (!strstr(sym->name, "sys_write")) + sys_write_seen = true; + } + +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c +index 77ffff3a053c..9f1de58e9f0c 100644 +--- a/scripts/kconfig/expr.c ++++ b/scripts/kconfig/expr.c +@@ -254,6 +254,13 @@ static int expr_eq(struct expr *e1, struct expr *e2) + { + int res, old_count; + ++ /* ++ * A NULL expr is taken to be yes, but there's also a different way to ++ * represent yes. expr_is_yes() checks for either representation. ++ */ ++ if (!e1 || !e2) ++ return expr_is_yes(e1) && expr_is_yes(e2); ++ + if (e1->type != e2->type) + return 0; + switch (e1->type) { +diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian +index e0750b70453f..7c230016b08d 100755 +--- a/scripts/package/mkdebian ++++ b/scripts/package/mkdebian +@@ -174,7 +174,7 @@ Source: $sourcename + Section: kernel + Priority: optional + Maintainer: $maintainer +-Build-Depends: bc, kmod, cpio, bison, flex | flex:native $extra_build_depends ++Build-Depends: bc, rsync, kmod, cpio, bison, flex | flex:native $extra_build_depends + Homepage: http://www.kernel.org/ + + Package: $packagename +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index f6bf4cfbea23..45da2b51543e 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -2103,10 +2103,8 @@ static void max98090_pll_det_disable_work(struct work_struct *work) + M98090_IULK_MASK, 0); + } + +-static void max98090_pll_work(struct work_struct *work) ++static void max98090_pll_work(struct max98090_priv *max98090) + { +- struct max98090_priv *max98090 = +- container_of(work, struct max98090_priv, pll_work); + struct snd_soc_component *component = max98090->component; + + if (!snd_soc_component_is_active(component)) +@@ -2259,7 +2257,7 @@ static irqreturn_t max98090_interrupt(int irq, void *data) + + if (active & M98090_ULK_MASK) { + dev_dbg(component->dev, "M98090_ULK_MASK\n"); +- schedule_work(&max98090->pll_work); ++ max98090_pll_work(max98090); + } + + if (active & M98090_JDET_MASK) { +@@ -2422,7 +2420,6 @@ static int max98090_probe(struct snd_soc_component *component) + max98090_pll_det_enable_work); + INIT_WORK(&max98090->pll_det_disable_work, + max98090_pll_det_disable_work); +- INIT_WORK(&max98090->pll_work, max98090_pll_work); + + /* Enable jack detection */ + snd_soc_component_write(component, M98090_REG_JACK_DETECT, +@@ -2475,7 +2472,6 @@ static void max98090_remove(struct snd_soc_component *component) + cancel_delayed_work_sync(&max98090->jack_work); + cancel_delayed_work_sync(&max98090->pll_det_enable_work); + cancel_work_sync(&max98090->pll_det_disable_work); +- cancel_work_sync(&max98090->pll_work); + max98090->component = NULL; + } + +diff --git a/sound/soc/codecs/max98090.h b/sound/soc/codecs/max98090.h +index 57965cd678b4..a197114b0dad 100644 +--- a/sound/soc/codecs/max98090.h ++++ b/sound/soc/codecs/max98090.h +@@ -1530,7 +1530,6 @@ struct max98090_priv { + struct delayed_work jack_work; + struct delayed_work pll_det_enable_work; + struct work_struct pll_det_disable_work; +- struct work_struct pll_work; + struct snd_soc_jack *jack; + unsigned int dai_fmt; + int tdm_slots; +diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c +index c50b75ce82e0..05e883a65d7a 100644 +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -72,6 +72,7 @@ struct rt5682_priv { + static const struct reg_sequence patch_list[] = { + {RT5682_HP_IMP_SENS_CTRL_19, 0x1000}, + {RT5682_DAC_ADC_DIG_VOL1, 0xa020}, ++ {RT5682_I2C_CTRL, 0x000f}, + }; + + static const struct reg_default rt5682_reg[] = { +@@ -2481,6 +2482,7 @@ static void rt5682_calibrate(struct rt5682_priv *rt5682) + mutex_lock(&rt5682->calibrate_mutex); + + rt5682_reset(rt5682->regmap); ++ regmap_write(rt5682->regmap, RT5682_I2C_CTRL, 0x000f); + regmap_write(rt5682->regmap, RT5682_PWR_ANLG_1, 0xa2af); + usleep_range(15000, 20000); + regmap_write(rt5682->regmap, RT5682_PWR_ANLG_1, 0xf2af); +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 3e5c69fbc33a..d9d59f45833f 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2788,7 +2788,7 @@ static int fll_factors(struct _fll_div *fll_div, unsigned int Fref, + + if (target % Fref == 0) { + fll_div->theta = 0; +- fll_div->lambda = 0; ++ fll_div->lambda = 1; + } else { + gcd_fll = gcd(target, fratio * Fref); + +@@ -2858,7 +2858,7 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s + return -EINVAL; + } + +- if (fll_div.theta || fll_div.lambda) ++ if (fll_div.theta) + fll1 |= WM8962_FLL_FRAC; + + /* Stop the FLL while we reconfigure */ +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index dd2b5ad08659..243f683bc02a 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -707,13 +707,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_MCLK_EN), + }, + { ++ /* Teclast X89 */ + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), + DMI_MATCH(DMI_BOARD_NAME, "tPAD"), + }, + .driver_data = (void *)(BYT_RT5640_IN3_MAP | +- BYT_RT5640_MCLK_EN | +- BYT_RT5640_SSP0_AIF1), ++ BYT_RT5640_JD_SRC_JD1_IN4P | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_1P0 | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), + }, + { /* Toshiba Satellite Click Mini L9W-B */ + .matches = { +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 0fd032914a31..fd2d22ddc81b 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -1918,11 +1918,13 @@ static int soc_tplg_fe_link_create(struct soc_tplg *tplg, + ret = soc_tplg_dai_link_load(tplg, link, NULL); + if (ret < 0) { + dev_err(tplg->comp->dev, "ASoC: FE link loading failed\n"); +- kfree(link->name); +- kfree(link->stream_name); +- kfree(link->cpus->dai_name); +- kfree(link); +- return ret; ++ goto err; ++ } ++ ++ ret = snd_soc_add_dai_link(tplg->comp->card, link); ++ if (ret < 0) { ++ dev_err(tplg->comp->dev, "ASoC: adding FE link failed\n"); ++ goto err; + } + + link->dobj.index = tplg->index; +@@ -1930,8 +1932,13 @@ static int soc_tplg_fe_link_create(struct soc_tplg *tplg, + link->dobj.type = SND_SOC_DOBJ_DAI_LINK; + list_add(&link->dobj.list, &tplg->comp->dobj_list); + +- snd_soc_add_dai_link(tplg->comp->card, link); + return 0; ++err: ++ kfree(link->name); ++ kfree(link->stream_name); ++ kfree(link->cpus->dai_name); ++ kfree(link); ++ return ret; + } + + /* create a FE DAI and DAI link from the PCM object */ +@@ -2024,6 +2031,7 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg, + int size; + int i; + bool abi_match; ++ int ret; + + count = le32_to_cpu(hdr->count); + +@@ -2065,7 +2073,12 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg, + } + + /* create the FE DAIs and DAI links */ +- soc_tplg_pcm_create(tplg, _pcm); ++ ret = soc_tplg_pcm_create(tplg, _pcm); ++ if (ret < 0) { ++ if (!abi_match) ++ kfree(_pcm); ++ return ret; ++ } + + /* offset by version-specific struct size and + * real priv data size +diff --git a/sound/soc/sof/intel/byt.c b/sound/soc/sof/intel/byt.c +index a1e514f71739..41008c974ac6 100644 +--- a/sound/soc/sof/intel/byt.c ++++ b/sound/soc/sof/intel/byt.c +@@ -24,7 +24,8 @@ + #define DRAM_OFFSET 0x100000 + #define DRAM_SIZE (160 * 1024) + #define SHIM_OFFSET 0x140000 +-#define SHIM_SIZE 0x100 ++#define SHIM_SIZE_BYT 0x100 ++#define SHIM_SIZE_CHT 0x118 + #define MBOX_OFFSET 0x144000 + #define MBOX_SIZE 0x1000 + #define EXCEPT_OFFSET 0x800 +@@ -75,7 +76,7 @@ static const struct snd_sof_debugfs_map byt_debugfs[] = { + SOF_DEBUGFS_ACCESS_D0_ONLY}, + {"dram", BYT_DSP_BAR, DRAM_OFFSET, DRAM_SIZE, + SOF_DEBUGFS_ACCESS_D0_ONLY}, +- {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE, ++ {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE_BYT, + SOF_DEBUGFS_ACCESS_ALWAYS}, + }; + +@@ -102,7 +103,7 @@ static const struct snd_sof_debugfs_map cht_debugfs[] = { + SOF_DEBUGFS_ACCESS_D0_ONLY}, + {"dram", BYT_DSP_BAR, DRAM_OFFSET, DRAM_SIZE, + SOF_DEBUGFS_ACCESS_D0_ONLY}, +- {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE, ++ {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE_CHT, + SOF_DEBUGFS_ACCESS_ALWAYS}, + }; + +diff --git a/sound/soc/sof/loader.c b/sound/soc/sof/loader.c +index 9a9a381a908d..a041adf0669d 100644 +--- a/sound/soc/sof/loader.c ++++ b/sound/soc/sof/loader.c +@@ -66,6 +66,8 @@ int snd_sof_fw_parse_ext_data(struct snd_sof_dev *sdev, u32 bar, u32 offset) + ret = get_ext_windows(sdev, ext_hdr); + break; + default: ++ dev_warn(sdev->dev, "warning: unknown ext header type %d size 0x%x\n", ++ ext_hdr->type, ext_hdr->hdr.size); + break; + } + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index 43fdbbfe41bb..ea0bcd58bcb9 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -493,7 +493,7 @@ static int do_dump(int argc, char **argv) + + info = &info_linear->info; + if (mode == DUMP_JITED) { +- if (info->jited_prog_len == 0) { ++ if (info->jited_prog_len == 0 || !info->jited_prog_insns) { + p_info("no instructions returned"); + goto err_free; + } +diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c +index 494d7ae3614d..5b91ee65a080 100644 +--- a/tools/bpf/bpftool/xlated_dumper.c ++++ b/tools/bpf/bpftool/xlated_dumper.c +@@ -174,7 +174,7 @@ static const char *print_call(void *private_data, + struct kernel_sym *sym; + + if (insn->src_reg == BPF_PSEUDO_CALL && +- (__u32) insn->imm < dd->nr_jited_ksyms) ++ (__u32) insn->imm < dd->nr_jited_ksyms && dd->jited_ksyms) + address = dd->jited_ksyms[insn->imm]; + + sym = kernel_syms_search(dd, address); +diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile +index 5315f3787f8d..ecf882308d8a 100644 +--- a/tools/lib/traceevent/Makefile ++++ b/tools/lib/traceevent/Makefile +@@ -97,6 +97,7 @@ EVENT_PARSE_VERSION = $(EP_VERSION).$(EP_PATCHLEVEL).$(EP_EXTRAVERSION) + + LIB_TARGET = libtraceevent.a libtraceevent.so.$(EVENT_PARSE_VERSION) + LIB_INSTALL = libtraceevent.a libtraceevent.so* ++LIB_INSTALL := $(addprefix $(OUTPUT),$(LIB_INSTALL)) + + INCLUDES = -I. -I $(srctree)/tools/include $(CONFIG_INCLUDES) + +@@ -207,10 +208,11 @@ define do_install + $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2' + endef + +-PKG_CONFIG_FILE = libtraceevent.pc ++PKG_CONFIG_SOURCE_FILE = libtraceevent.pc ++PKG_CONFIG_FILE := $(addprefix $(OUTPUT),$(PKG_CONFIG_SOURCE_FILE)) + define do_install_pkgconfig_file + if [ -n "${pkgconfig_dir}" ]; then \ +- cp -f ${PKG_CONFIG_FILE}.template ${PKG_CONFIG_FILE}; \ ++ cp -f ${PKG_CONFIG_SOURCE_FILE}.template ${PKG_CONFIG_FILE}; \ + sed -i "s|INSTALL_PREFIX|${1}|g" ${PKG_CONFIG_FILE}; \ + sed -i "s|LIB_VERSION|${EVENT_PARSE_VERSION}|g" ${PKG_CONFIG_FILE}; \ + sed -i "s|LIB_DIR|${libdir}|g" ${PKG_CONFIG_FILE}; \ +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index becc2d109423..d3412f2c0d18 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -1089,21 +1089,18 @@ static void cpu_cache_level__fprintf(FILE *out, struct cpu_cache_level *c) + fprintf(out, "L%d %-15s %8s [%s]\n", c->level, c->type, c->size, c->map); + } + +-static int build_caches(struct cpu_cache_level caches[], u32 size, u32 *cntp) ++#define MAX_CACHE_LVL 4 ++ ++static int build_caches(struct cpu_cache_level caches[], u32 *cntp) + { + u32 i, cnt = 0; +- long ncpus; + u32 nr, cpu; + u16 level; + +- ncpus = sysconf(_SC_NPROCESSORS_CONF); +- if (ncpus < 0) +- return -1; +- +- nr = (u32)(ncpus & UINT_MAX); ++ nr = cpu__max_cpu(); + + for (cpu = 0; cpu < nr; cpu++) { +- for (level = 0; level < 10; level++) { ++ for (level = 0; level < MAX_CACHE_LVL; level++) { + struct cpu_cache_level c; + int err; + +@@ -1123,18 +1120,12 @@ static int build_caches(struct cpu_cache_level caches[], u32 size, u32 *cntp) + caches[cnt++] = c; + else + cpu_cache_level__free(&c); +- +- if (WARN_ONCE(cnt == size, "way too many cpu caches..")) +- goto out; + } + } +- out: + *cntp = cnt; + return 0; + } + +-#define MAX_CACHE_LVL 4 +- + static int write_cache(struct feat_fd *ff, + struct evlist *evlist __maybe_unused) + { +@@ -1143,7 +1134,7 @@ static int write_cache(struct feat_fd *ff, + u32 cnt = 0, i, version = 1; + int ret; + +- ret = build_caches(caches, max_caches, &cnt); ++ ret = build_caches(caches, &cnt); + if (ret) + goto out; + +diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c +index a7c0424dbda3..940a6e7a6854 100644 +--- a/tools/perf/util/metricgroup.c ++++ b/tools/perf/util/metricgroup.c +@@ -103,8 +103,11 @@ static struct evsel *find_evsel_group(struct evlist *perf_evlist, + if (!strcmp(ev->name, ids[i])) { + if (!metric_events[i]) + metric_events[i] = ev; ++ i++; ++ if (i == idnum) ++ break; + } else { +- if (++i == idnum) { ++ if (i + 1 == idnum) { + /* Discard the whole match and start again */ + i = 0; + memset(metric_events, 0, +@@ -124,7 +127,7 @@ static struct evsel *find_evsel_group(struct evlist *perf_evlist, + } + } + +- if (i != idnum - 1) { ++ if (i != idnum) { + /* Not whole match */ + return NULL; + } +diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc +index 36fb59f886ea..1a52f2883fe0 100644 +--- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc ++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc +@@ -3,6 +3,8 @@ + # description: ftrace - stacktrace filter command + # flags: instance + ++[ ! -f set_ftrace_filter ] && exit_unsupported ++ + echo _do_fork:stacktrace >> set_ftrace_filter + + grep -q "_do_fork:stacktrace:unlimited" set_ftrace_filter +diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc +index 86a1f07ef2ca..71fa3f49e35e 100644 +--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc ++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc +@@ -15,6 +15,11 @@ if [ $NP -eq 1 ] ;then + exit_unresolved + fi + ++if ! grep -q "function" available_tracers ; then ++ echo "Function trace is not enabled" ++ exit_unsupported ++fi ++ + ORIG_CPUMASK=`cat tracing_cpumask` + + do_reset() { +diff --git a/tools/testing/selftests/ftrace/test.d/functions b/tools/testing/selftests/ftrace/test.d/functions +index 86986c4bba54..5d4550591ff9 100644 +--- a/tools/testing/selftests/ftrace/test.d/functions ++++ b/tools/testing/selftests/ftrace/test.d/functions +@@ -46,6 +46,9 @@ reset_events_filter() { # reset all current setting filters + } + + reset_ftrace_filter() { # reset all triggers in set_ftrace_filter ++ if [ ! -f set_ftrace_filter ]; then ++ return 0 ++ fi + echo > set_ftrace_filter + grep -v '^#' set_ftrace_filter | while read t; do + tr=`echo $t | cut -d: -f2` +@@ -93,7 +96,7 @@ initialize_ftrace() { # Reset ftrace to initial-state + disable_events + [ -f set_event_pid ] && echo > set_event_pid + [ -f set_ftrace_pid ] && echo > set_ftrace_pid +- [ -f set_ftrace_filter ] && echo | tee set_ftrace_* ++ [ -f set_ftrace_notrace ] && echo > set_ftrace_notrace + [ -f set_graph_function ] && echo | tee set_graph_* + [ -f stack_trace_filter ] && echo > stack_trace_filter + [ -f kprobe_events ] && echo > kprobe_events +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc +index 5862eee91e1d..6e3dbe5f96b7 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc +@@ -20,9 +20,9 @@ while read i; do + test $N -eq 256 && break + done + +-L=`wc -l kprobe_events` +-if [ $L -ne $N ]; then +- echo "The number of kprobes events ($L) is not $N" ++L=`cat kprobe_events | wc -l` ++if [ $L -ne 256 ]; then ++ echo "The number of kprobes events ($L) is not 256" + exit_fail + fi + +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc +index 1221240f8cf6..3f2aee115f6e 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc +@@ -21,10 +21,10 @@ grep -q "snapshot()" README || exit_unsupported # version issue + + echo "Test expected snapshot action failure" + +-echo 'hist:keys=comm:onmatch(sched.sched_wakeup).snapshot()' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger && exit_fail ++echo 'hist:keys=comm:onmatch(sched.sched_wakeup).snapshot()' >> events/sched/sched_waking/trigger && exit_fail + + echo "Test expected save action failure" + +-echo 'hist:keys=comm:onmatch(sched.sched_wakeup).save(comm,prio)' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger && exit_fail ++echo 'hist:keys=comm:onmatch(sched.sched_wakeup).save(comm,prio)' >> events/sched/sched_waking/trigger && exit_fail + + exit_xfail +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc +index 064a284e4e75..c80007aa9f86 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc +@@ -16,7 +16,7 @@ grep -q "onchange(var)" README || exit_unsupported # version issue + + echo "Test onchange action" + +-echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio) if comm=="ping"' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger ++echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio) if comm=="ping"' >> events/sched/sched_waking/trigger + + ping $LOCALHOST -c 3 + nice -n 1 ping $LOCALHOST -c 3 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc +index 18fff69fc433..f546c1b66a9b 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc +@@ -23,9 +23,9 @@ grep -q "snapshot()" README || exit_unsupported # version issue + + echo "Test snapshot action" + +-echo 1 > /sys/kernel/debug/tracing/events/sched/enable ++echo 1 > events/sched/enable + +-echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio):onchange($newprio).snapshot() if comm=="ping"' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger ++echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio):onchange($newprio).snapshot() if comm=="ping"' >> events/sched/sched_waking/trigger + + ping $LOCALHOST -c 3 + nice -n 1 ping $LOCALHOST -c 3 +diff --git a/tools/testing/selftests/kselftest/prefix.pl b/tools/testing/selftests/kselftest/prefix.pl +index ec7e48118183..31f7c2a0a8bd 100755 +--- a/tools/testing/selftests/kselftest/prefix.pl ++++ b/tools/testing/selftests/kselftest/prefix.pl +@@ -3,6 +3,7 @@ + # Prefix all lines with "# ", unbuffered. Command being piped in may need + # to have unbuffering forced with "stdbuf -i0 -o0 -e0 $cmd". + use strict; ++use IO::Handle; + + binmode STDIN; + binmode STDOUT; +diff --git a/tools/testing/selftests/kselftest/runner.sh b/tools/testing/selftests/kselftest/runner.sh +index 84de7bc74f2c..a8d20cbb711c 100644 +--- a/tools/testing/selftests/kselftest/runner.sh ++++ b/tools/testing/selftests/kselftest/runner.sh +@@ -79,6 +79,7 @@ run_one() + if [ $rc -eq $skip_rc ]; then \ + echo "not ok $test_num $TEST_HDR_MSG # SKIP" + elif [ $rc -eq $timeout_rc ]; then \ ++ echo "#" + echo "not ok $test_num $TEST_HDR_MSG # TIMEOUT" + else + echo "not ok $test_num $TEST_HDR_MSG # exit=$rc" +diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh +index d697815d2785..71a62e7e35b1 100755 +--- a/tools/testing/selftests/net/pmtu.sh ++++ b/tools/testing/selftests/net/pmtu.sh +@@ -11,9 +11,9 @@ + # R1 and R2 (also implemented with namespaces), with different MTUs: + # + # segment a_r1 segment b_r1 a_r1: 2000 +-# .--------------R1--------------. a_r2: 1500 +-# A B a_r3: 2000 +-# '--------------R2--------------' a_r4: 1400 ++# .--------------R1--------------. b_r1: 1400 ++# A B a_r2: 2000 ++# '--------------R2--------------' b_r2: 1500 + # segment a_r2 segment b_r2 + # + # Check that PMTU exceptions with the correct PMTU are created. Then +diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh +index 1be55e705780..d7e07f4c3d7f 100755 +--- a/tools/testing/selftests/netfilter/nft_nat.sh ++++ b/tools/testing/selftests/netfilter/nft_nat.sh +@@ -8,9 +8,14 @@ ksft_skip=4 + ret=0 + test_inet_nat=true + ++sfx=$(mktemp -u "XXXXXXXX") ++ns0="ns0-$sfx" ++ns1="ns1-$sfx" ++ns2="ns2-$sfx" ++ + cleanup() + { +- for i in 0 1 2; do ip netns del ns$i;done ++ for i in 0 1 2; do ip netns del ns$i-"$sfx";done + } + + nft --version > /dev/null 2>&1 +@@ -25,40 +30,49 @@ if [ $? -ne 0 ];then + exit $ksft_skip + fi + +-ip netns add ns0 ++ip netns add "$ns0" + if [ $? -ne 0 ];then +- echo "SKIP: Could not create net namespace" ++ echo "SKIP: Could not create net namespace $ns0" + exit $ksft_skip + fi + + trap cleanup EXIT + +-ip netns add ns1 +-ip netns add ns2 ++ip netns add "$ns1" ++if [ $? -ne 0 ];then ++ echo "SKIP: Could not create net namespace $ns1" ++ exit $ksft_skip ++fi ++ ++ip netns add "$ns2" ++if [ $? -ne 0 ];then ++ echo "SKIP: Could not create net namespace $ns2" ++ exit $ksft_skip ++fi + +-ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 > /dev/null 2>&1 ++ip link add veth0 netns "$ns0" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1 + if [ $? -ne 0 ];then + echo "SKIP: No virtual ethernet pair device support in kernel" + exit $ksft_skip + fi +-ip link add veth1 netns ns0 type veth peer name eth0 netns ns2 ++ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns2" + +-ip -net ns0 link set lo up +-ip -net ns0 link set veth0 up +-ip -net ns0 addr add 10.0.1.1/24 dev veth0 +-ip -net ns0 addr add dead:1::1/64 dev veth0 ++ip -net "$ns0" link set lo up ++ip -net "$ns0" link set veth0 up ++ip -net "$ns0" addr add 10.0.1.1/24 dev veth0 ++ip -net "$ns0" addr add dead:1::1/64 dev veth0 + +-ip -net ns0 link set veth1 up +-ip -net ns0 addr add 10.0.2.1/24 dev veth1 +-ip -net ns0 addr add dead:2::1/64 dev veth1 ++ip -net "$ns0" link set veth1 up ++ip -net "$ns0" addr add 10.0.2.1/24 dev veth1 ++ip -net "$ns0" addr add dead:2::1/64 dev veth1 + + for i in 1 2; do +- ip -net ns$i link set lo up +- ip -net ns$i link set eth0 up +- ip -net ns$i addr add 10.0.$i.99/24 dev eth0 +- ip -net ns$i route add default via 10.0.$i.1 +- ip -net ns$i addr add dead:$i::99/64 dev eth0 +- ip -net ns$i route add default via dead:$i::1 ++ ip -net ns$i-$sfx link set lo up ++ ip -net ns$i-$sfx link set eth0 up ++ ip -net ns$i-$sfx addr add 10.0.$i.99/24 dev eth0 ++ ip -net ns$i-$sfx route add default via 10.0.$i.1 ++ ip -net ns$i-$sfx addr add dead:$i::99/64 dev eth0 ++ ip -net ns$i-$sfx route add default via dead:$i::1 + done + + bad_counter() +@@ -66,8 +80,9 @@ bad_counter() + local ns=$1 + local counter=$2 + local expect=$3 ++ local tag=$4 + +- echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2 ++ echo "ERROR: $counter counter in $ns has unexpected value (expected $expect) at $tag" 1>&2 + ip netns exec $ns nft list counter inet filter $counter 1>&2 + } + +@@ -78,24 +93,24 @@ check_counters() + + cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84") + if [ $? -ne 0 ]; then +- bad_counter $ns ns0in "packets 1 bytes 84" ++ bad_counter $ns ns0in "packets 1 bytes 84" "check_counters 1" + lret=1 + fi + cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84") + if [ $? -ne 0 ]; then +- bad_counter $ns ns0out "packets 1 bytes 84" ++ bad_counter $ns ns0out "packets 1 bytes 84" "check_counters 2" + lret=1 + fi + + expect="packets 1 bytes 104" + cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter $ns ns0in6 "$expect" ++ bad_counter $ns ns0in6 "$expect" "check_counters 3" + lret=1 + fi + cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter $ns ns0out6 "$expect" ++ bad_counter $ns ns0out6 "$expect" "check_counters 4" + lret=1 + fi + +@@ -107,41 +122,41 @@ check_ns0_counters() + local ns=$1 + local lret=0 + +- cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0in "packets 0 bytes 0" ++ bad_counter "$ns0" ns0in "packets 0 bytes 0" "check_ns0_counters 1" + lret=1 + fi + +- cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0in6 "packets 0 bytes 0" ++ bad_counter "$ns0" ns0in6 "packets 0 bytes 0" + lret=1 + fi + +- cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0out "packets 0 bytes 0" ++ bad_counter "$ns0" ns0out "packets 0 bytes 0" "check_ns0_counters 2" + lret=1 + fi +- cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0out6 "packets 0 bytes 0" ++ bad_counter "$ns0" ns0out6 "packets 0 bytes 0" "check_ns0_counters3 " + lret=1 + fi + + for dir in "in" "out" ; do + expect="packets 1 bytes 84" +- cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 $ns$dir "$expect" ++ bad_counter "$ns0" $ns$dir "$expect" "check_ns0_counters 4" + lret=1 + fi + + expect="packets 1 bytes 104" +- cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir}6 | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 $ns$dir6 "$expect" ++ bad_counter "$ns0" $ns$dir6 "$expect" "check_ns0_counters 5" + lret=1 + fi + done +@@ -152,7 +167,7 @@ check_ns0_counters() + reset_counters() + { + for i in 0 1 2;do +- ip netns exec ns$i nft reset counters inet > /dev/null ++ ip netns exec ns$i-$sfx nft reset counters inet > /dev/null + done + } + +@@ -166,7 +181,7 @@ test_local_dnat6() + IPF="ip6" + fi + +-ip netns exec ns0 nft -f - < /dev/null ++ ip netns exec "$ns0" ping -q -c 1 dead:1::99 > /dev/null + if [ $? -ne 0 ]; then + lret=1 + echo "ERROR: ping6 failed" +@@ -189,18 +204,18 @@ EOF + + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns1$dir "$expect" ++ bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat6 1" + lret=1 + fi + done + + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns2$dir "$expect" ++ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat6 2" + lret=1 + fi + done +@@ -208,9 +223,9 @@ EOF + # expect 0 count in ns1 + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat6 3" + lret=1 + fi + done +@@ -218,15 +233,15 @@ EOF + # expect 1 packet in ns2 + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns0$dir "$expect" ++ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat6 4" + lret=1 + fi + done + +- test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was $family NATted to ns2" +- ip netns exec ns0 nft flush chain ip6 nat output ++ test $lret -eq 0 && echo "PASS: ipv6 ping to $ns1 was $family NATted to $ns2" ++ ip netns exec "$ns0" nft flush chain ip6 nat output + + return $lret + } +@@ -241,7 +256,7 @@ test_local_dnat() + IPF="ip" + fi + +-ip netns exec ns0 nft -f - </dev/null ++ip netns exec "$ns0" nft -f /dev/stdin </dev/null + table $family nat { + chain output { + type nat hook output priority 0; policy accept; +@@ -260,7 +275,7 @@ EOF + fi + + # ping netns1, expect rewrite to netns2 +- ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null ++ ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null + if [ $? -ne 0 ]; then + lret=1 + echo "ERROR: ping failed" +@@ -269,18 +284,18 @@ EOF + + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns1$dir "$expect" ++ bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat 1" + lret=1 + fi + done + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns2$dir "$expect" ++ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 2" + lret=1 + fi + done +@@ -288,9 +303,9 @@ EOF + # expect 0 count in ns1 + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat 3" + lret=1 + fi + done +@@ -298,19 +313,19 @@ EOF + # expect 1 packet in ns2 + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns0$dir "$expect" ++ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 4" + lret=1 + fi + done + +- test $lret -eq 0 && echo "PASS: ping to ns1 was $family NATted to ns2" ++ test $lret -eq 0 && echo "PASS: ping to $ns1 was $family NATted to $ns2" + +- ip netns exec ns0 nft flush chain $family nat output ++ ip netns exec "$ns0" nft flush chain $family nat output + + reset_counters +- ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null ++ ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null + if [ $? -ne 0 ]; then + lret=1 + echo "ERROR: ping failed" +@@ -319,17 +334,17 @@ EOF + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns1$dir "$expect" ++ bad_counter "$ns1" ns1$dir "$expect" "test_local_dnat 5" + lret=1 + fi + done + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns2$dir "$expect" ++ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 6" + lret=1 + fi + done +@@ -337,9 +352,9 @@ EOF + # expect 1 count in ns1 + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0$dir "$expect" ++ bad_counter "$ns0" ns0$dir "$expect" "test_local_dnat 7" + lret=1 + fi + done +@@ -347,14 +362,14 @@ EOF + # expect 0 packet in ns2 + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns2$dir "$expect" ++ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 8" + lret=1 + fi + done + +- test $lret -eq 0 && echo "PASS: ping to ns1 OK after $family nat output chain flush" ++ test $lret -eq 0 && echo "PASS: ping to $ns1 OK after $family nat output chain flush" + + return $lret + } +@@ -366,26 +381,26 @@ test_masquerade6() + local natflags=$2 + local lret=0 + +- ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null + +- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 via ipv6" ++ echo "ERROR: cannot ping $ns1 from $ns2 via ipv6" + return 1 + lret=1 + fi + + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns2$dir "$expect" ++ bad_counter "$ns1" ns2$dir "$expect" "test_masquerade6 1" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 2" + lret=1 + fi + done +@@ -393,7 +408,7 @@ test_masquerade6() + reset_counters + + # add masquerading rule +-ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags" + lret=1 + fi + + # ns1 should have seen packets from ns0, due to masquerade + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 3" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 4" + lret=1 + fi + done +@@ -431,32 +446,32 @@ EOF + # ns1 should not have seen packets from ns2, due to masquerade + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 5" + lret=1 + fi + +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns0" ns1$dir "$expect" "test_masquerade6 6" + lret=1 + fi + done + +- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags (attempt 2)" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active ipv6 masquerade $natflags (attempt 2)" + lret=1 + fi + +- ip netns exec ns0 nft flush chain $family nat postrouting ++ ip netns exec "$ns0" nft flush chain $family nat postrouting + if [ $? -ne 0 ]; then + echo "ERROR: Could not flush $family nat postrouting" 1>&2 + lret=1 + fi + +- test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for ns2" ++ test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for $ns2" + + return $lret + } +@@ -467,26 +482,26 @@ test_masquerade() + local natflags=$2 + local lret=0 + +- ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null +- ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null + +- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 $natflags" ++ echo "ERROR: cannot ping $ns1 from "$ns2" $natflags" + lret=1 + fi + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns2$dir "$expect" ++ bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 2" + lret=1 + fi + done +@@ -494,7 +509,7 @@ test_masquerade() + reset_counters + + # add masquerading rule +-ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags" + lret=1 + fi + + # ns1 should have seen packets from ns0, due to masquerade + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 3" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 4" + lret=1 + fi + done +@@ -532,32 +547,32 @@ EOF + # ns1 should not have seen packets from ns2, due to masquerade + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 5" + lret=1 + fi + +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns0" ns1$dir "$expect" "test_masquerade 6" + lret=1 + fi + done + +- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active ip masquerade $natflags (attempt 2)" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active ip masquerade $natflags (attempt 2)" + lret=1 + fi + +- ip netns exec ns0 nft flush chain $family nat postrouting ++ ip netns exec "$ns0" nft flush chain $family nat postrouting + if [ $? -ne 0 ]; then + echo "ERROR: Could not flush $family nat postrouting" 1>&2 + lret=1 + fi + +- test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for ns2" ++ test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for $ns2" + + return $lret + } +@@ -567,25 +582,25 @@ test_redirect6() + local family=$1 + local lret=0 + +- ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null + +- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannnot ping ns1 from ns2 via ipv6" ++ echo "ERROR: cannnot ping $ns1 from $ns2 via ipv6" + lret=1 + fi + + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns2$dir "$expect" ++ bad_counter "$ns1" ns2$dir "$expect" "test_redirect6 1" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_redirect6 2" + lret=1 + fi + done +@@ -593,7 +608,7 @@ test_redirect6() + reset_counters + + # add redirect rule +-ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 via ipv6 with active $family redirect" ++ echo "ERROR: cannot ping $ns1 from $ns2 via ipv6 with active $family redirect" + lret=1 + fi + + # ns1 should have seen no packets from ns2, due to redirection + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 3" + lret=1 + fi + done +@@ -625,20 +640,20 @@ EOF + # ns0 should have seen packets from ns2, due to masquerade + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 4" + lret=1 + fi + done + +- ip netns exec ns0 nft delete table $family nat ++ ip netns exec "$ns0" nft delete table $family nat + if [ $? -ne 0 ]; then + echo "ERROR: Could not delete $family nat table" 1>&2 + lret=1 + fi + +- test $lret -eq 0 && echo "PASS: $family IPv6 redirection for ns2" ++ test $lret -eq 0 && echo "PASS: $family IPv6 redirection for $ns2" + + return $lret + } +@@ -648,26 +663,26 @@ test_redirect() + local family=$1 + local lret=0 + +- ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null +- ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null + +- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2" ++ echo "ERROR: cannot ping $ns1 from $ns2" + lret=1 + fi + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns2$dir "$expect" ++ bad_counter "$ns1" $ns2$dir "$expect" "test_redirect 1" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_redirect 2" + lret=1 + fi + done +@@ -675,7 +690,7 @@ test_redirect() + reset_counters + + # add redirect rule +-ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active $family ip redirect" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active $family ip redirect" + lret=1 + fi + +@@ -698,9 +713,9 @@ EOF + expect="packets 0 bytes 0" + for dir in "in" "out" ; do + +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_redirect 3" + lret=1 + fi + done +@@ -708,28 +723,28 @@ EOF + # ns0 should have seen packets from ns2, due to masquerade + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns0" ns0$dir "$expect" "test_redirect 4" + lret=1 + fi + done + +- ip netns exec ns0 nft delete table $family nat ++ ip netns exec "$ns0" nft delete table $family nat + if [ $? -ne 0 ]; then + echo "ERROR: Could not delete $family nat table" 1>&2 + lret=1 + fi + +- test $lret -eq 0 && echo "PASS: $family IP redirection for ns2" ++ test $lret -eq 0 && echo "PASS: $family IP redirection for $ns2" + + return $lret + } + + +-# ip netns exec ns0 ping -c 1 -q 10.0.$i.99 ++# ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 + for i in 0 1 2; do +-ip netns exec ns$i nft -f - < /dev/null ++ ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 > /dev/null + if [ $? -ne 0 ];then + echo "ERROR: Could not reach other namespace(s)" 1>&2 + ret=1 + fi + +- ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null ++ ip netns exec "$ns0" ping -c 1 -q dead:$i::99 > /dev/null + if [ $? -ne 0 ];then + echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2 + ret=1 + fi +- check_counters ns$i ++ check_counters ns$i-$sfx + if [ $? -ne 0 ]; then + ret=1 + fi +@@ -820,7 +835,7 @@ for i in 1 2; do + done + + if [ $ret -eq 0 ];then +- echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2" ++ echo "PASS: netns routing/connectivity: $ns0 can reach $ns1 and $ns2" + fi + + reset_counters +@@ -846,4 +861,9 @@ reset_counters + $test_inet_nat && test_redirect inet + $test_inet_nat && test_redirect6 inet + ++if [ $ret -ne 0 ];then ++ echo -n "FAIL: " ++ nft --version ++fi ++ + exit $ret +diff --git a/tools/testing/selftests/safesetid/Makefile b/tools/testing/selftests/safesetid/Makefile +index 98da7a504737..fa02c4d5ec13 100644 +--- a/tools/testing/selftests/safesetid/Makefile ++++ b/tools/testing/selftests/safesetid/Makefile +@@ -1,8 +1,9 @@ + # SPDX-License-Identifier: GPL-2.0 + # Makefile for mount selftests. +-CFLAGS = -Wall -lcap -O2 ++CFLAGS = -Wall -O2 ++LDLIBS = -lcap + +-TEST_PROGS := run_tests.sh ++TEST_PROGS := safesetid-test.sh + TEST_GEN_FILES := safesetid-test + + include ../lib.mk +diff --git a/tools/testing/selftests/safesetid/safesetid-test.c b/tools/testing/selftests/safesetid/safesetid-test.c +index 8f40c6ecdad1..0c4d50644c13 100644 +--- a/tools/testing/selftests/safesetid/safesetid-test.c ++++ b/tools/testing/selftests/safesetid/safesetid-test.c +@@ -213,7 +213,8 @@ static void test_setuid(uid_t child_uid, bool expect_success) + } + + if (cpid == 0) { /* Code executed by child */ +- setuid(child_uid); ++ if (setuid(child_uid) < 0) ++ exit(EXIT_FAILURE); + if (getuid() == child_uid) + exit(EXIT_SUCCESS); + else +@@ -291,8 +292,10 @@ int main(int argc, char **argv) + + // First test to make sure we can write userns mappings from a user + // that doesn't have any restrictions (as long as it has CAP_SETUID); +- setuid(NO_POLICY_USER); +- setgid(NO_POLICY_USER); ++ if (setuid(NO_POLICY_USER) < 0) ++ die("Error with set uid(%d)\n", NO_POLICY_USER); ++ if (setgid(NO_POLICY_USER) < 0) ++ die("Error with set gid(%d)\n", NO_POLICY_USER); + + // Take away all but setid caps + drop_caps(true); +@@ -306,8 +309,10 @@ int main(int argc, char **argv) + die("test_userns failed when it should work\n"); + } + +- setuid(RESTRICTED_PARENT); +- setgid(RESTRICTED_PARENT); ++ if (setuid(RESTRICTED_PARENT) < 0) ++ die("Error with set uid(%d)\n", RESTRICTED_PARENT); ++ if (setgid(RESTRICTED_PARENT) < 0) ++ die("Error with set gid(%d)\n", RESTRICTED_PARENT); + + test_setuid(ROOT_USER, false); + test_setuid(ALLOWED_CHILD1, true); diff --git a/patch/kernel/meson64-current/03-patch-5.4.11-12.patch b/patch/kernel/meson64-current/03-patch-5.4.11-12.patch new file mode 100644 index 0000000000..e0f4084ba9 --- /dev/null +++ b/patch/kernel/meson64-current/03-patch-5.4.11-12.patch @@ -0,0 +1,2421 @@ +diff --git a/Makefile b/Makefile +index e8963f623568..45c6264f1108 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 11 ++SUBLEVEL = 12 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index 8a50efb559f3..39002d769d95 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -73,6 +73,7 @@ config ARM + select HAVE_ARM_SMCCC if CPU_V7 + select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32 + select HAVE_CONTEXT_TRACKING ++ select HAVE_COPY_THREAD_TLS + select HAVE_C_RECORDMCOUNT + select HAVE_DEBUG_KMEMLEAK + select HAVE_DMA_CONTIGUOUS if MMU +diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c +index 9485acc520a4..e7fac125ea0d 100644 +--- a/arch/arm/kernel/process.c ++++ b/arch/arm/kernel/process.c +@@ -224,8 +224,8 @@ void release_thread(struct task_struct *dead_task) + asmlinkage void ret_from_fork(void) __asm__("ret_from_fork"); + + int +-copy_thread(unsigned long clone_flags, unsigned long stack_start, +- unsigned long stk_sz, struct task_struct *p) ++copy_thread_tls(unsigned long clone_flags, unsigned long stack_start, ++ unsigned long stk_sz, struct task_struct *p, unsigned long tls) + { + struct thread_info *thread = task_thread_info(p); + struct pt_regs *childregs = task_pt_regs(p); +@@ -259,7 +259,7 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start, + clear_ptrace_hw_breakpoint(p); + + if (clone_flags & CLONE_SETTLS) +- thread->tp_value[0] = childregs->ARM_r3; ++ thread->tp_value[0] = tls; + thread->tp_value[1] = get_tpuser(); + + thread_notify(THREAD_NOTIFY_COPY, thread); +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 3f047afb982c..6ccd2ed30963 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -139,6 +139,7 @@ config ARM64 + select HAVE_CMPXCHG_DOUBLE + select HAVE_CMPXCHG_LOCAL + select HAVE_CONTEXT_TRACKING ++ select HAVE_COPY_THREAD_TLS + select HAVE_DEBUG_BUGVERBOSE + select HAVE_DEBUG_KMEMLEAK + select HAVE_DMA_CONTIGUOUS +diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h +index 2629a68b8724..5af82587909e 100644 +--- a/arch/arm64/include/asm/unistd.h ++++ b/arch/arm64/include/asm/unistd.h +@@ -42,7 +42,6 @@ + #endif + + #define __ARCH_WANT_SYS_CLONE +-#define __ARCH_WANT_SYS_CLONE3 + + #ifndef __COMPAT_SYSCALL_NR + #include +diff --git a/arch/arm64/include/uapi/asm/unistd.h b/arch/arm64/include/uapi/asm/unistd.h +index 4703d218663a..f83a70e07df8 100644 +--- a/arch/arm64/include/uapi/asm/unistd.h ++++ b/arch/arm64/include/uapi/asm/unistd.h +@@ -19,5 +19,6 @@ + #define __ARCH_WANT_NEW_STAT + #define __ARCH_WANT_SET_GET_RLIMIT + #define __ARCH_WANT_TIME32_SYSCALLS ++#define __ARCH_WANT_SYS_CLONE3 + + #include +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 71f788cd2b18..d54586d5b031 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -360,8 +360,8 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + + asmlinkage void ret_from_fork(void) asm("ret_from_fork"); + +-int copy_thread(unsigned long clone_flags, unsigned long stack_start, +- unsigned long stk_sz, struct task_struct *p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long stack_start, ++ unsigned long stk_sz, struct task_struct *p, unsigned long tls) + { + struct pt_regs *childregs = task_pt_regs(p); + +@@ -394,11 +394,11 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start, + } + + /* +- * If a TLS pointer was passed to clone (4th argument), use it +- * for the new thread. ++ * If a TLS pointer was passed to clone, use it for the new ++ * thread. + */ + if (clone_flags & CLONE_SETTLS) +- p->thread.uw.tp_value = childregs->regs[3]; ++ p->thread.uw.tp_value = tls; + } else { + memset(childregs, 0, sizeof(struct pt_regs)); + childregs->pstate = PSR_MODE_EL1h; +diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig +index b16237c95ea3..0c29d6cb2c8d 100644 +--- a/arch/parisc/Kconfig ++++ b/arch/parisc/Kconfig +@@ -62,6 +62,7 @@ config PARISC + select HAVE_FTRACE_MCOUNT_RECORD if HAVE_DYNAMIC_FTRACE + select HAVE_KPROBES_ON_FTRACE + select HAVE_DYNAMIC_FTRACE_WITH_REGS ++ select HAVE_COPY_THREAD_TLS + + help + The PA-RISC microprocessor is designed by Hewlett-Packard and used +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index ecc5c2771208..230a6422b99f 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -208,8 +208,8 @@ arch_initcall(parisc_idle_init); + * Copy architecture-specific thread state + */ + int +-copy_thread(unsigned long clone_flags, unsigned long usp, +- unsigned long kthread_arg, struct task_struct *p) ++copy_thread_tls(unsigned long clone_flags, unsigned long usp, ++ unsigned long kthread_arg, struct task_struct *p, unsigned long tls) + { + struct pt_regs *cregs = &(p->thread.regs); + void *stack = task_stack_page(p); +@@ -254,9 +254,9 @@ copy_thread(unsigned long clone_flags, unsigned long usp, + cregs->ksp = (unsigned long)stack + THREAD_SZ_ALGN + FRAME_SIZE; + cregs->kpc = (unsigned long) &child_return; + +- /* Setup thread TLS area from the 4th parameter in clone */ ++ /* Setup thread TLS area */ + if (clone_flags & CLONE_SETTLS) +- cregs->cr27 = cregs->gr[23]; ++ cregs->cr27 = tls; + } + + return 0; +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index 8eebbc8860bb..ade9699aa0dd 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -61,6 +61,7 @@ config RISCV + select SPARSEMEM_STATIC if 32BIT + select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT if MMU + select HAVE_ARCH_MMAP_RND_BITS ++ select HAVE_COPY_THREAD_TLS + + config ARCH_MMAP_RND_BITS_MIN + default 18 if 64BIT +diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c +index 85e3c39bb60b..330b34706aa0 100644 +--- a/arch/riscv/kernel/process.c ++++ b/arch/riscv/kernel/process.c +@@ -99,8 +99,8 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + return 0; + } + +-int copy_thread(unsigned long clone_flags, unsigned long usp, +- unsigned long arg, struct task_struct *p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long usp, ++ unsigned long arg, struct task_struct *p, unsigned long tls) + { + struct pt_regs *childregs = task_pt_regs(p); + +@@ -120,7 +120,7 @@ int copy_thread(unsigned long clone_flags, unsigned long usp, + if (usp) /* User fork */ + childregs->sp = usp; + if (clone_flags & CLONE_SETTLS) +- childregs->tp = childregs->a5; ++ childregs->tp = tls; + childregs->a0 = 0; /* Return value of fork() */ + p->thread.ra = (unsigned long)ret_from_fork; + } +diff --git a/arch/um/Kconfig b/arch/um/Kconfig +index fec6b4ca2b6e..c56d3526a3bd 100644 +--- a/arch/um/Kconfig ++++ b/arch/um/Kconfig +@@ -14,6 +14,7 @@ config UML + select HAVE_FUTEX_CMPXCHG if FUTEX + select HAVE_DEBUG_KMEMLEAK + select HAVE_DEBUG_BUGVERBOSE ++ select HAVE_COPY_THREAD_TLS + select GENERIC_IRQ_SHOW + select GENERIC_CPU_DEVICES + select GENERIC_CLOCKEVENTS +diff --git a/arch/um/include/asm/ptrace-generic.h b/arch/um/include/asm/ptrace-generic.h +index 81c647ef9c6c..adf91ef553ae 100644 +--- a/arch/um/include/asm/ptrace-generic.h ++++ b/arch/um/include/asm/ptrace-generic.h +@@ -36,7 +36,7 @@ extern long subarch_ptrace(struct task_struct *child, long request, + extern unsigned long getreg(struct task_struct *child, int regno); + extern int putreg(struct task_struct *child, int regno, unsigned long value); + +-extern int arch_copy_tls(struct task_struct *new); ++extern int arch_set_tls(struct task_struct *new, unsigned long tls); + extern void clear_flushed_tls(struct task_struct *task); + extern int syscall_trace_enter(struct pt_regs *regs); + extern void syscall_trace_leave(struct pt_regs *regs); +diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c +index 263a8f069133..17045e7211bf 100644 +--- a/arch/um/kernel/process.c ++++ b/arch/um/kernel/process.c +@@ -153,8 +153,8 @@ void fork_handler(void) + userspace(¤t->thread.regs.regs, current_thread_info()->aux_fp_regs); + } + +-int copy_thread(unsigned long clone_flags, unsigned long sp, +- unsigned long arg, struct task_struct * p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long sp, ++ unsigned long arg, struct task_struct * p, unsigned long tls) + { + void (*handler)(void); + int kthread = current->flags & PF_KTHREAD; +@@ -188,7 +188,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, + * Set a new TLS for the child thread? + */ + if (clone_flags & CLONE_SETTLS) +- ret = arch_copy_tls(p); ++ ret = arch_set_tls(p, tls); + } + + return ret; +diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c +index 5bd949da7a4a..ac8eee093f9c 100644 +--- a/arch/x86/um/tls_32.c ++++ b/arch/x86/um/tls_32.c +@@ -215,14 +215,12 @@ static int set_tls_entry(struct task_struct* task, struct user_desc *info, + return 0; + } + +-int arch_copy_tls(struct task_struct *new) ++int arch_set_tls(struct task_struct *new, unsigned long tls) + { + struct user_desc info; + int idx, ret = -EFAULT; + +- if (copy_from_user(&info, +- (void __user *) UPT_SI(&new->thread.regs.regs), +- sizeof(info))) ++ if (copy_from_user(&info, (void __user *) tls, sizeof(info))) + goto out; + + ret = -EINVAL; +diff --git a/arch/x86/um/tls_64.c b/arch/x86/um/tls_64.c +index 3a621e0d3925..ebd3855d9b13 100644 +--- a/arch/x86/um/tls_64.c ++++ b/arch/x86/um/tls_64.c +@@ -6,14 +6,13 @@ void clear_flushed_tls(struct task_struct *task) + { + } + +-int arch_copy_tls(struct task_struct *t) ++int arch_set_tls(struct task_struct *t, unsigned long tls) + { + /* + * If CLONE_SETTLS is set, we need to save the thread id +- * (which is argument 5, child_tid, of clone) so it can be set +- * during context switches. ++ * so it can be set during context switches. + */ +- t->thread.arch.fs = t->thread.regs.regs.gp[R8 / sizeof(long)]; ++ t->thread.arch.fs = tls; + + return 0; + } +diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig +index a8e7beb6b7b5..8352037322df 100644 +--- a/arch/xtensa/Kconfig ++++ b/arch/xtensa/Kconfig +@@ -22,6 +22,7 @@ config XTENSA + select HAVE_ARCH_JUMP_LABEL + select HAVE_ARCH_KASAN if MMU + select HAVE_ARCH_TRACEHOOK ++ select HAVE_COPY_THREAD_TLS + select HAVE_DEBUG_KMEMLEAK + select HAVE_DMA_CONTIGUOUS + select HAVE_EXIT_THREAD +diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c +index db278a9e80c7..7cbf8bd6d922 100644 +--- a/arch/xtensa/kernel/process.c ++++ b/arch/xtensa/kernel/process.c +@@ -202,8 +202,9 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + * involved. Much simpler to just not copy those live frames across. + */ + +-int copy_thread(unsigned long clone_flags, unsigned long usp_thread_fn, +- unsigned long thread_fn_arg, struct task_struct *p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long usp_thread_fn, ++ unsigned long thread_fn_arg, struct task_struct *p, ++ unsigned long tls) + { + struct pt_regs *childregs = task_pt_regs(p); + +@@ -264,9 +265,8 @@ int copy_thread(unsigned long clone_flags, unsigned long usp_thread_fn, + ®s->areg[XCHAL_NUM_AREGS - len/4], len); + } + +- /* The thread pointer is passed in the '4th argument' (= a5) */ + if (clone_flags & CLONE_SETTLS) +- childregs->threadptr = childregs->areg[5]; ++ childregs->threadptr = tls; + } else { + p->thread.ra = MAKE_RA_FOR_CALL( + (unsigned long)ret_from_kernel_thread, 1); +diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c +index b23b0b999232..87f449340202 100644 +--- a/drivers/char/tpm/tpm-dev-common.c ++++ b/drivers/char/tpm/tpm-dev-common.c +@@ -130,7 +130,7 @@ ssize_t tpm_common_read(struct file *file, char __user *buf, + priv->response_read = true; + + ret_size = min_t(ssize_t, size, priv->response_length); +- if (!ret_size) { ++ if (ret_size <= 0) { + priv->response_length = 0; + goto out; + } +diff --git a/drivers/char/tpm/tpm-dev.h b/drivers/char/tpm/tpm-dev.h +index 1089fc0bb290..f3742bcc73e3 100644 +--- a/drivers/char/tpm/tpm-dev.h ++++ b/drivers/char/tpm/tpm-dev.h +@@ -14,7 +14,7 @@ struct file_priv { + struct work_struct timeout_work; + struct work_struct async_work; + wait_queue_head_t async_wait; +- size_t response_length; ++ ssize_t response_length; + bool response_read; + bool command_enqueued; + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index f528fc39ea6b..c3181ea9f271 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -899,13 +899,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + + if (wait_startup(chip, 0) != 0) { + rc = -ENODEV; +- goto err_start; ++ goto out_err; + } + + /* Take control of the TPM's interrupt hardware and shut it off */ + rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask); + if (rc < 0) +- goto err_start; ++ goto out_err; + + intmask |= TPM_INTF_CMD_READY_INT | TPM_INTF_LOCALITY_CHANGE_INT | + TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; +@@ -914,21 +914,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + + rc = tpm_chip_start(chip); + if (rc) +- goto err_start; +- ++ goto out_err; + rc = tpm2_probe(chip); ++ tpm_chip_stop(chip); + if (rc) +- goto err_probe; ++ goto out_err; + + rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor); + if (rc < 0) +- goto err_probe; ++ goto out_err; + + priv->manufacturer_id = vendor; + + rc = tpm_tis_read8(priv, TPM_RID(0), &rid); + if (rc < 0) +- goto err_probe; ++ goto out_err; + + dev_info(dev, "%s TPM (device-id 0x%X, rev-id %d)\n", + (chip->flags & TPM_CHIP_FLAG_TPM2) ? "2.0" : "1.2", +@@ -937,13 +937,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + probe = probe_itpm(chip); + if (probe < 0) { + rc = -ENODEV; +- goto err_probe; ++ goto out_err; + } + + /* Figure out the capabilities */ + rc = tpm_tis_read32(priv, TPM_INTF_CAPS(priv->locality), &intfcaps); + if (rc < 0) +- goto err_probe; ++ goto out_err; + + dev_dbg(dev, "TPM interface capabilities (0x%x):\n", + intfcaps); +@@ -977,10 +977,9 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + if (tpm_get_timeouts(chip)) { + dev_err(dev, "Could not get TPM timeouts and durations\n"); + rc = -ENODEV; +- goto err_probe; ++ goto out_err; + } + +- chip->flags |= TPM_CHIP_FLAG_IRQ; + if (irq) { + tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED, + irq); +@@ -992,18 +991,15 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + } + } + +- tpm_chip_stop(chip); +- + rc = tpm_chip_register(chip); + if (rc) +- goto err_start; +- +- return 0; ++ goto out_err; + +-err_probe: +- tpm_chip_stop(chip); ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, false); + +-err_start: ++ return 0; ++out_err: + if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL)) + chip->ops->clk_enable(chip, false); + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 59ccfd24627d..1f98e988c0d3 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -21,11 +21,19 @@ + #include "gpiolib.h" + #include "gpiolib-acpi.h" + ++#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l ++#define QUIRK_NO_WAKEUP 0x02l ++ + static int run_edge_events_on_boot = -1; + module_param(run_edge_events_on_boot, int, 0444); + MODULE_PARM_DESC(run_edge_events_on_boot, + "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto"); + ++static int honor_wakeup = -1; ++module_param(honor_wakeup, int, 0444); ++MODULE_PARM_DESC(honor_wakeup, ++ "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto"); ++ + /** + * struct acpi_gpio_event - ACPI GPIO event handler data + * +@@ -274,7 +282,7 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, + event->handle = evt_handle; + event->handler = handler; + event->irq = irq; +- event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE; ++ event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE; + event->pin = pin; + event->desc = desc; + +@@ -1302,7 +1310,7 @@ static int acpi_gpio_handle_deferred_request_irqs(void) + /* We must use _sync so that this runs after the first deferred_probe run */ + late_initcall_sync(acpi_gpio_handle_deferred_request_irqs); + +-static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { ++static const struct dmi_system_id gpiolib_acpi_quirks[] = { + { + /* + * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for +@@ -1312,7 +1320,8 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "MINIX"), + DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), +- } ++ }, ++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, + }, + { + /* +@@ -1324,20 +1333,52 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"), + DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"), +- } ++ }, ++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, ++ }, ++ { ++ /* ++ * Various HP X2 10 Cherry Trail models use an external ++ * embedded-controller connected via I2C + an ACPI GPIO ++ * event handler. The embedded controller generates various ++ * spurious wakeup events when suspended. So disable wakeup ++ * for its handler (it uses the only ACPI GPIO event handler). ++ * This breaks wakeup when opening the lid, the user needs ++ * to press the power-button to wakeup the system. The ++ * alternative is suspend simply not working, which is worse. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"), ++ }, ++ .driver_data = (void *)QUIRK_NO_WAKEUP, + }, + {} /* Terminating entry */ + }; + + static int acpi_gpio_setup_params(void) + { ++ const struct dmi_system_id *id; ++ long quirks = 0; ++ ++ id = dmi_first_match(gpiolib_acpi_quirks); ++ if (id) ++ quirks = (long)id->driver_data; ++ + if (run_edge_events_on_boot < 0) { +- if (dmi_check_system(run_edge_events_on_boot_blacklist)) ++ if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT) + run_edge_events_on_boot = 0; + else + run_edge_events_on_boot = 1; + } + ++ if (honor_wakeup < 0) { ++ if (quirks & QUIRK_NO_WAKEUP) ++ honor_wakeup = 0; ++ else ++ honor_wakeup = 1; ++ } ++ + return 0; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index b19157b19fa0..33a1099e2f33 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -145,7 +145,7 @@ int amdgpu_async_gfx_ring = 1; + int amdgpu_mcbp = 0; + int amdgpu_discovery = -1; + int amdgpu_mes = 0; +-int amdgpu_noretry = 1; ++int amdgpu_noretry; + + struct amdgpu_mgpu_info mgpu_info = { + .mutex = __MUTEX_INITIALIZER(mgpu_info.mutex), +@@ -613,7 +613,7 @@ MODULE_PARM_DESC(mes, + module_param_named(mes, amdgpu_mes, int, 0444); + + MODULE_PARM_DESC(noretry, +- "Disable retry faults (0 = retry enabled, 1 = retry disabled (default))"); ++ "Disable retry faults (0 = retry enabled (default), 1 = retry disabled)"); + module_param_named(noretry, amdgpu_noretry, int, 0644); + + #ifdef CONFIG_HSA_AMD +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 86c17896b532..a48a4c21b1b3 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -339,7 +339,7 @@ static void drm_dp_encode_sideband_req(struct drm_dp_sideband_msg_req_body *req, + memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes); + idx += req->u.i2c_read.transactions[i].num_bytes; + +- buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5; ++ buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4; + buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf); + idx++; + } +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index a7ba5b4902d6..8d193a58363d 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -1320,7 +1320,7 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, + * Changes struct fb_var_screeninfo are currently not pushed back + * to KMS, hence fail if different settings are requested. + */ +- if (var->bits_per_pixel != fb->format->cpp[0] * 8 || ++ if (var->bits_per_pixel > fb->format->cpp[0] * 8 || + var->xres > fb->width || var->yres > fb->height || + var->xres_virtual > fb->width || var->yres_virtual > fb->height) { + DRM_DEBUG("fb requested width/height/bpp can't fit in current fb " +@@ -1345,6 +1345,11 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, + drm_fb_helper_fill_pixel_fmt(var, fb->format->depth); + } + ++ /* ++ * Likewise, bits_per_pixel should be rounded up to a supported value. ++ */ ++ var->bits_per_pixel = fb->format->cpp[0] * 8; ++ + /* + * drm fbdev emulation doesn't support changing the pixel format at all, + * so reject all pixel format changing requests. +diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c +index d564bfcab6a3..4949b5ad860f 100644 +--- a/drivers/gpu/drm/i915/gt/intel_lrc.c ++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c +@@ -2132,6 +2132,14 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch) + /* WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk */ + batch = gen8_emit_flush_coherentl3_wa(engine, batch); + ++ /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */ ++ batch = gen8_emit_pipe_control(batch, ++ PIPE_CONTROL_FLUSH_L3 | ++ PIPE_CONTROL_GLOBAL_GTT_IVB | ++ PIPE_CONTROL_CS_STALL | ++ PIPE_CONTROL_QW_WRITE, ++ slm_offset(engine)); ++ + batch = emit_lri(batch, lri, ARRAY_SIZE(lri)); + + /* WaMediaPoolStateCmdInWABB:bxt,glk */ +@@ -3716,9 +3724,11 @@ intel_execlists_create_virtual(struct i915_gem_context *ctx, + ve->base.i915 = ctx->i915; + ve->base.gt = siblings[0]->gt; + ve->base.id = -1; ++ + ve->base.class = OTHER_CLASS; + ve->base.uabi_class = I915_ENGINE_CLASS_INVALID; + ve->base.instance = I915_ENGINE_CLASS_INVALID_VIRTUAL; ++ ve->base.uabi_instance = I915_ENGINE_CLASS_INVALID_VIRTUAL; + + /* + * The decision on whether to submit a request using semaphores +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index f8ee9aba3955..7b6e68f082f8 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -4049,7 +4049,13 @@ enum { + #define GWUNIT_CLKGATE_DIS (1 << 16) + + #define UNSLICE_UNIT_LEVEL_CLKGATE _MMIO(0x9434) +-#define VFUNIT_CLKGATE_DIS (1 << 20) ++#define VFUNIT_CLKGATE_DIS REG_BIT(20) ++#define HSUNIT_CLKGATE_DIS REG_BIT(8) ++#define VSUNIT_CLKGATE_DIS REG_BIT(3) ++ ++#define UNSLICE_UNIT_LEVEL_CLKGATE2 _MMIO(0x94e4) ++#define VSUNIT_CLKGATE_DIS_TGL REG_BIT(19) ++#define PSDUNIT_CLKGATE_DIS REG_BIT(5) + + #define INF_UNIT_LEVEL_CLKGATE _MMIO(0x9560) + #define CGPSF_CLKGATE_DIS (1 << 3) +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 2efe1d12d5a9..3ccfc025fde2 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -9194,6 +9194,17 @@ static void icl_init_clock_gating(struct drm_i915_private *dev_priv) + /* WaEnable32PlaneMode:icl */ + I915_WRITE(GEN9_CSFE_CHICKEN1_RCS, + _MASKED_BIT_ENABLE(GEN11_ENABLE_32_PLANE_MODE)); ++ ++ /* ++ * Wa_1408615072:icl,ehl (vsunit) ++ * Wa_1407596294:icl,ehl (hsunit) ++ */ ++ intel_uncore_rmw(&dev_priv->uncore, UNSLICE_UNIT_LEVEL_CLKGATE, ++ 0, VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS); ++ ++ /* Wa_1407352427:icl,ehl */ ++ intel_uncore_rmw(&dev_priv->uncore, UNSLICE_UNIT_LEVEL_CLKGATE2, ++ 0, PSDUNIT_CLKGATE_DIS); + } + + static void cnp_init_clock_gating(struct drm_i915_private *dev_priv) +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c +index b89439ed210d..27c80c9e2b83 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -488,7 +488,7 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon, + + WARN_ON(!tcon->quirks->has_channel_0); + +- tcon->dclk_min_div = 1; ++ tcon->dclk_min_div = tcon->quirks->dclk_min_div; + tcon->dclk_max_div = 127; + sun4i_tcon0_mode_set_common(tcon, mode); + +@@ -1425,12 +1425,14 @@ static int sun8i_r40_tcon_tv_set_mux(struct sun4i_tcon *tcon, + static const struct sun4i_tcon_quirks sun4i_a10_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, ++ .dclk_min_div = 4, + .set_mux = sun4i_a10_tcon_set_mux, + }; + + static const struct sun4i_tcon_quirks sun5i_a13_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, ++ .dclk_min_div = 4, + .set_mux = sun5i_a13_tcon_set_mux, + }; + +@@ -1439,6 +1441,7 @@ static const struct sun4i_tcon_quirks sun6i_a31_quirks = { + .has_channel_1 = true, + .has_lvds_alt = true, + .needs_de_be_mux = true, ++ .dclk_min_div = 1, + .set_mux = sun6i_tcon_set_mux, + }; + +@@ -1446,11 +1449,13 @@ static const struct sun4i_tcon_quirks sun6i_a31s_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, + .needs_de_be_mux = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun7i_a20_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, ++ .dclk_min_div = 4, + /* Same display pipeline structure as A10 */ + .set_mux = sun4i_a10_tcon_set_mux, + }; +@@ -1458,11 +1463,13 @@ static const struct sun4i_tcon_quirks sun7i_a20_quirks = { + static const struct sun4i_tcon_quirks sun8i_a33_quirks = { + .has_channel_0 = true, + .has_lvds_alt = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun8i_a83t_lcd_quirks = { + .supports_lvds = true, + .has_channel_0 = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = { +@@ -1476,11 +1483,13 @@ static const struct sun4i_tcon_quirks sun8i_r40_tv_quirks = { + + static const struct sun4i_tcon_quirks sun8i_v3s_quirks = { + .has_channel_0 = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun9i_a80_tcon_lcd_quirks = { +- .has_channel_0 = true, +- .needs_edp_reset = true, ++ .has_channel_0 = true, ++ .needs_edp_reset = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun9i_a80_tcon_tv_quirks = { +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h +index f9f1fe80b206..a62ec826ae71 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h +@@ -224,6 +224,7 @@ struct sun4i_tcon_quirks { + bool needs_de_be_mux; /* sun6i needs mux to select backend */ + bool needs_edp_reset; /* a80 edp reset needed for tcon0 access */ + bool supports_lvds; /* Does the TCON support an LVDS output? */ ++ u8 dclk_min_div; /* minimum divider for TCON0 DCLK */ + + /* callback to handle tcon muxing options */ + int (*set_mux)(struct sun4i_tcon *, const struct drm_encoder *); +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index e0b241bd3070..851fe54ea59e 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -288,6 +288,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign + offset = report->size; + report->size += parser->global.report_size * parser->global.report_count; + ++ /* Total size check: Allow for possible report index byte */ ++ if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { ++ hid_err(parser->device, "report is too long\n"); ++ return -1; ++ } ++ + if (!parser->local.usage_index) /* Ignore padding fields */ + return 0; + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 63855f275a38..dea9cc65bf80 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1132,9 +1132,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + } + + mapped: +- if (device->driver->input_mapped && device->driver->input_mapped(device, +- hidinput, field, usage, &bit, &max) < 0) +- goto ignore; ++ if (device->driver->input_mapped && ++ device->driver->input_mapped(device, hidinput, field, usage, ++ &bit, &max) < 0) { ++ /* ++ * The driver indicated that no further generic handling ++ * of the usage is desired. ++ */ ++ return; ++ } + + set_bit(usage->type, input->evbit); + +@@ -1215,9 +1221,11 @@ mapped: + set_bit(MSC_SCAN, input->mscbit); + } + +-ignore: + return; + ++ignore: ++ usage->type = 0; ++ usage->code = 0; + } + + static void hidinput_handle_scroll(struct hid_usage *usage, +diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c +index bbc6ec1aa5cb..c25e95c19cad 100644 +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -252,10 +252,10 @@ static __poll_t hidraw_poll(struct file *file, poll_table *wait) + + poll_wait(file, &list->hidraw->wait, wait); + if (list->head != list->tail) +- return EPOLLIN | EPOLLRDNORM | EPOLLOUT; ++ return EPOLLIN | EPOLLRDNORM; + if (!list->hidraw->exist) + return EPOLLERR | EPOLLHUP; +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static int hidraw_open(struct inode *inode, struct file *file) +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index fa0cc0899827..935c3d0a3b63 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -772,7 +772,7 @@ static __poll_t uhid_char_poll(struct file *file, poll_table *wait) + if (uhid->head != uhid->tail) + return EPOLLIN | EPOLLRDNORM; + +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static const struct file_operations uhid_fops = { +diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c +index 1f9bc4483465..c879b214a479 100644 +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -241,12 +241,51 @@ static int hiddev_release(struct inode * inode, struct file * file) + return 0; + } + ++static int __hiddev_open(struct hiddev *hiddev, struct file *file) ++{ ++ struct hiddev_list *list; ++ int error; ++ ++ lockdep_assert_held(&hiddev->existancelock); ++ ++ list = vzalloc(sizeof(*list)); ++ if (!list) ++ return -ENOMEM; ++ ++ mutex_init(&list->thread_lock); ++ list->hiddev = hiddev; ++ ++ if (!hiddev->open++) { ++ error = hid_hw_power(hiddev->hid, PM_HINT_FULLON); ++ if (error < 0) ++ goto err_drop_count; ++ ++ error = hid_hw_open(hiddev->hid); ++ if (error < 0) ++ goto err_normal_power; ++ } ++ ++ spin_lock_irq(&hiddev->list_lock); ++ list_add_tail(&list->node, &hiddev->list); ++ spin_unlock_irq(&hiddev->list_lock); ++ ++ file->private_data = list; ++ ++ return 0; ++ ++err_normal_power: ++ hid_hw_power(hiddev->hid, PM_HINT_NORMAL); ++err_drop_count: ++ hiddev->open--; ++ vfree(list); ++ return error; ++} ++ + /* + * open file op + */ + static int hiddev_open(struct inode *inode, struct file *file) + { +- struct hiddev_list *list; + struct usb_interface *intf; + struct hid_device *hid; + struct hiddev *hiddev; +@@ -255,66 +294,14 @@ static int hiddev_open(struct inode *inode, struct file *file) + intf = usbhid_find_interface(iminor(inode)); + if (!intf) + return -ENODEV; ++ + hid = usb_get_intfdata(intf); + hiddev = hid->hiddev; + +- if (!(list = vzalloc(sizeof(struct hiddev_list)))) +- return -ENOMEM; +- mutex_init(&list->thread_lock); +- list->hiddev = hiddev; +- file->private_data = list; +- +- /* +- * no need for locking because the USB major number +- * is shared which usbcore guards against disconnect +- */ +- if (list->hiddev->exist) { +- if (!list->hiddev->open++) { +- res = hid_hw_open(hiddev->hid); +- if (res < 0) +- goto bail; +- } +- } else { +- res = -ENODEV; +- goto bail; +- } +- +- spin_lock_irq(&list->hiddev->list_lock); +- list_add_tail(&list->node, &hiddev->list); +- spin_unlock_irq(&list->hiddev->list_lock); +- + mutex_lock(&hiddev->existancelock); +- /* +- * recheck exist with existance lock held to +- * avoid opening a disconnected device +- */ +- if (!list->hiddev->exist) { +- res = -ENODEV; +- goto bail_unlock; +- } +- if (!list->hiddev->open++) +- if (list->hiddev->exist) { +- struct hid_device *hid = hiddev->hid; +- res = hid_hw_power(hid, PM_HINT_FULLON); +- if (res < 0) +- goto bail_unlock; +- res = hid_hw_open(hid); +- if (res < 0) +- goto bail_normal_power; +- } +- mutex_unlock(&hiddev->existancelock); +- return 0; +-bail_normal_power: +- hid_hw_power(hid, PM_HINT_NORMAL); +-bail_unlock: ++ res = hiddev->exist ? __hiddev_open(hiddev, file) : -ENODEV; + mutex_unlock(&hiddev->existancelock); + +- spin_lock_irq(&list->hiddev->list_lock); +- list_del(&list->node); +- spin_unlock_irq(&list->hiddev->list_lock); +-bail: +- file->private_data = NULL; +- vfree(list); + return res; + } + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 5f6a4985f2bc..810a942eaa8e 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -186,10 +186,11 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap) + * If we can set SDA, we will always create a STOP to ensure additional + * pulses will do no harm. This is achieved by letting SDA follow SCL + * half a cycle later. Check the 'incomplete_write_byte' fault injector +- * for details. ++ * for details. Note that we must honour tsu:sto, 4us, but lets use 5us ++ * here for simplicity. + */ + bri->set_scl(adap, scl); +- ndelay(RECOVERY_NDELAY / 2); ++ ndelay(RECOVERY_NDELAY); + if (bri->set_sda) + bri->set_sda(adap, scl); + ndelay(RECOVERY_NDELAY / 2); +@@ -211,7 +212,13 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap) + scl = !scl; + bri->set_scl(adap, scl); + /* Creating STOP again, see above */ +- ndelay(RECOVERY_NDELAY / 2); ++ if (scl) { ++ /* Honour minimum tsu:sto */ ++ ndelay(RECOVERY_NDELAY); ++ } else { ++ /* Honour minimum tf and thd:dat */ ++ ndelay(RECOVERY_NDELAY / 2); ++ } + if (bri->set_sda) + bri->set_sda(adap, scl); + ndelay(RECOVERY_NDELAY / 2); +diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c +index e53f542b60af..8a2e0d9351e9 100644 +--- a/drivers/infiniband/hw/hfi1/tid_rdma.c ++++ b/drivers/infiniband/hw/hfi1/tid_rdma.c +@@ -4633,6 +4633,15 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet) + */ + fpsn = full_flow_psn(flow, flow->flow_state.spsn); + req->r_ack_psn = psn; ++ /* ++ * If resync_psn points to the last flow PSN for a ++ * segment and the new segment (likely from a new ++ * request) starts with a new generation number, we ++ * need to adjust resync_psn accordingly. ++ */ ++ if (flow->flow_state.generation != ++ (resync_psn >> HFI1_KDETH_BTH_SEQ_SHIFT)) ++ resync_psn = mask_psn(fpsn - 1); + flow->resync_npkts += + delta_psn(mask_psn(resync_psn + 1), fpsn); + /* +diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c +index d7dd6fcf2db0..f918fca9ada3 100644 +--- a/drivers/input/evdev.c ++++ b/drivers/input/evdev.c +@@ -224,13 +224,13 @@ static void __pass_event(struct evdev_client *client, + */ + client->tail = (client->head - 2) & (client->bufsize - 1); + +- client->buffer[client->tail].input_event_sec = +- event->input_event_sec; +- client->buffer[client->tail].input_event_usec = +- event->input_event_usec; +- client->buffer[client->tail].type = EV_SYN; +- client->buffer[client->tail].code = SYN_DROPPED; +- client->buffer[client->tail].value = 0; ++ client->buffer[client->tail] = (struct input_event) { ++ .input_event_sec = event->input_event_sec, ++ .input_event_usec = event->input_event_usec, ++ .type = EV_SYN, ++ .code = SYN_DROPPED, ++ .value = 0, ++ }; + + client->packet_head = client->tail; + } +diff --git a/drivers/input/input.c b/drivers/input/input.c +index 55086279d044..ee6c3234df36 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -878,16 +878,18 @@ static int input_default_setkeycode(struct input_dev *dev, + } + } + +- __clear_bit(*old_keycode, dev->keybit); +- __set_bit(ke->keycode, dev->keybit); +- +- for (i = 0; i < dev->keycodemax; i++) { +- if (input_fetch_keycode(dev, i) == *old_keycode) { +- __set_bit(*old_keycode, dev->keybit); +- break; /* Setting the bit twice is useless, so break */ ++ if (*old_keycode <= KEY_MAX) { ++ __clear_bit(*old_keycode, dev->keybit); ++ for (i = 0; i < dev->keycodemax; i++) { ++ if (input_fetch_keycode(dev, i) == *old_keycode) { ++ __set_bit(*old_keycode, dev->keybit); ++ /* Setting the bit twice is useless, so break */ ++ break; ++ } + } + } + ++ __set_bit(ke->keycode, dev->keybit); + return 0; + } + +@@ -943,9 +945,13 @@ int input_set_keycode(struct input_dev *dev, + * Simulate keyup event if keycode is not present + * in the keymap anymore + */ +- if (test_bit(EV_KEY, dev->evbit) && +- !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && +- __test_and_clear_bit(old_keycode, dev->key)) { ++ if (old_keycode > KEY_MAX) { ++ dev_warn(dev->dev.parent ?: &dev->dev, ++ "%s: got too big old keycode %#x\n", ++ __func__, old_keycode); ++ } else if (test_bit(EV_KEY, dev->evbit) && ++ !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && ++ __test_and_clear_bit(old_keycode, dev->key)) { + struct input_value vals[] = { + { EV_KEY, old_keycode, 0 }, + input_value_sync +diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c +index 84051f20b18a..002654ec7040 100644 +--- a/drivers/input/misc/uinput.c ++++ b/drivers/input/misc/uinput.c +@@ -74,12 +74,16 @@ static int uinput_dev_event(struct input_dev *dev, + struct uinput_device *udev = input_get_drvdata(dev); + struct timespec64 ts; + +- udev->buff[udev->head].type = type; +- udev->buff[udev->head].code = code; +- udev->buff[udev->head].value = value; + ktime_get_ts64(&ts); +- udev->buff[udev->head].input_event_sec = ts.tv_sec; +- udev->buff[udev->head].input_event_usec = ts.tv_nsec / NSEC_PER_USEC; ++ ++ udev->buff[udev->head] = (struct input_event) { ++ .input_event_sec = ts.tv_sec, ++ .input_event_usec = ts.tv_nsec / NSEC_PER_USEC, ++ .type = type, ++ .code = code, ++ .value = value, ++ }; ++ + udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE; + + wake_up_interruptible(&udev->waitq); +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 4ce797d4259f..67aa317de6db 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -5786,6 +5786,13 @@ static void intel_iommu_apply_resv_region(struct device *dev, + WARN_ON_ONCE(!reserve_iova(&dmar_domain->iovad, start, end)); + } + ++static struct iommu_group *intel_iommu_device_group(struct device *dev) ++{ ++ if (dev_is_pci(dev)) ++ return pci_device_group(dev); ++ return generic_device_group(dev); ++} ++ + #ifdef CONFIG_INTEL_IOMMU_SVM + struct intel_iommu *intel_svm_device_to_iommu(struct device *dev) + { +@@ -5958,7 +5965,7 @@ const struct iommu_ops intel_iommu_ops = { + .get_resv_regions = intel_iommu_get_resv_regions, + .put_resv_regions = intel_iommu_put_resv_regions, + .apply_resv_region = intel_iommu_apply_resv_region, +- .device_group = pci_device_group, ++ .device_group = intel_iommu_device_group, + .dev_has_feat = intel_iommu_dev_has_feat, + .dev_feat_enabled = intel_iommu_dev_feat_enabled, + .dev_enable_feat = intel_iommu_dev_enable_feat, +diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c +index d5d4bfa9c8fd..d797912e665a 100644 +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -445,6 +445,10 @@ static int tcan4x5x_can_probe(struct spi_device *spi) + + tcan4x5x_power_enable(priv->power, 1); + ++ ret = tcan4x5x_init(mcan_class); ++ if (ret) ++ goto out_power; ++ + ret = m_can_class_register(mcan_class); + if (ret) + goto out_power; +diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c +index 8caf7af0dee2..99101d7027a8 100644 +--- a/drivers/net/can/mscan/mscan.c ++++ b/drivers/net/can/mscan/mscan.c +@@ -381,13 +381,12 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + struct net_device *dev = napi->dev; + struct mscan_regs __iomem *regs = priv->reg_base; + struct net_device_stats *stats = &dev->stats; +- int npackets = 0; +- int ret = 1; ++ int work_done = 0; + struct sk_buff *skb; + struct can_frame *frame; + u8 canrflg; + +- while (npackets < quota) { ++ while (work_done < quota) { + canrflg = in_8(®s->canrflg); + if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF))) + break; +@@ -408,18 +407,18 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + + stats->rx_packets++; + stats->rx_bytes += frame->can_dlc; +- npackets++; ++ work_done++; + netif_receive_skb(skb); + } + +- if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) { +- napi_complete(&priv->napi); +- clear_bit(F_RX_PROGRESS, &priv->flags); +- if (priv->can.state < CAN_STATE_BUS_OFF) +- out_8(®s->canrier, priv->shadow_canrier); +- ret = 0; ++ if (work_done < quota) { ++ if (likely(napi_complete_done(&priv->napi, work_done))) { ++ clear_bit(F_RX_PROGRESS, &priv->flags); ++ if (priv->can.state < CAN_STATE_BUS_OFF) ++ out_8(®s->canrier, priv->shadow_canrier); ++ } + } +- return ret; ++ return work_done; + } + + static irqreturn_t mscan_isr(int irq, void *dev_id) +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index 2f74f6704c12..a4b4b742c80c 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -918,7 +918,7 @@ static int gs_usb_probe(struct usb_interface *intf, + GS_USB_BREQ_HOST_FORMAT, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + hconf, + sizeof(*hconf), + 1000); +@@ -941,7 +941,7 @@ static int gs_usb_probe(struct usb_interface *intf, + GS_USB_BREQ_DEVICE_CONFIG, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + dconf, + sizeof(*dconf), + 1000); +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index 5fc0be564274..7ab87a758754 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -1590,7 +1590,7 @@ static int kvaser_usb_hydra_setup_endpoints(struct kvaser_usb *dev) + struct usb_endpoint_descriptor *ep; + int i; + +- iface_desc = &dev->intf->altsetting[0]; ++ iface_desc = dev->intf->cur_altsetting; + + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + ep = &iface_desc->endpoint[i].desc; +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index ae4c37e1bb75..1b9957f12459 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -1310,7 +1310,7 @@ static int kvaser_usb_leaf_setup_endpoints(struct kvaser_usb *dev) + struct usb_endpoint_descriptor *endpoint; + int i; + +- iface_desc = &dev->intf->altsetting[0]; ++ iface_desc = dev->intf->cur_altsetting; + + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; +diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c +index 9ebe74ee4aef..1e0343081be9 100644 +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -443,6 +443,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id, + ath10k_dbg(ar, ATH10K_DBG_USB_BULK, + "usb bulk transmit failed: %d\n", ret); + usb_unanchor_urb(urb); ++ usb_free_urb(urb); + ret = -EINVAL; + goto err_free_urb_to_pipe; + } +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 096334e941a1..fc1706d0647d 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1032,8 +1032,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) + } + skb_put(skb, MWIFIEX_UPLD_SIZE); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); + return -1; ++ } + + card->cmdrsp_buf = skb; + +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +index 74e50566db1f..6dd835f1efc2 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +@@ -229,6 +229,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv, + "11D: skip setting domain info in FW\n"); + return 0; + } ++ ++ if (country_ie_len > ++ (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "11D: country_ie_len overflow!, deauth AP\n"); ++ return -EINVAL; ++ } ++ + memcpy(priv->adapter->country_code, &country_ie[2], 2); + + domain_info->country_code[0] = country_ie[2]; +@@ -272,8 +280,9 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss, + priv->scan_block = false; + + if (bss) { +- if (adapter->region_code == 0x00) +- mwifiex_process_country_ie(priv, bss); ++ if (adapter->region_code == 0x00 && ++ mwifiex_process_country_ie(priv, bss)) ++ return -EINVAL; + + /* Allocate and fill new bss descriptor */ + bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor), +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 361248e97568..e7d96ac673b7 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5447,6 +5447,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) + ret = usb_submit_urb(urb, GFP_KERNEL); + if (ret) { + usb_unanchor_urb(urb); ++ usb_free_urb(urb); + goto error; + } + +diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c +index ead06c6c2601..9a38741d3546 100644 +--- a/drivers/phy/motorola/phy-cpcap-usb.c ++++ b/drivers/phy/motorola/phy-cpcap-usb.c +@@ -207,6 +207,19 @@ static int cpcap_phy_get_ints_state(struct cpcap_phy_ddata *ddata, + static int cpcap_usb_set_uart_mode(struct cpcap_phy_ddata *ddata); + static int cpcap_usb_set_usb_mode(struct cpcap_phy_ddata *ddata); + ++static void cpcap_usb_try_musb_mailbox(struct cpcap_phy_ddata *ddata, ++ enum musb_vbus_id_status status) ++{ ++ int error; ++ ++ error = musb_mailbox(status); ++ if (!error) ++ return; ++ ++ dev_dbg(ddata->dev, "%s: musb_mailbox failed: %i\n", ++ __func__, error); ++} ++ + static void cpcap_usb_detect(struct work_struct *work) + { + struct cpcap_phy_ddata *ddata; +@@ -226,9 +239,7 @@ static void cpcap_usb_detect(struct work_struct *work) + if (error) + goto out_err; + +- error = musb_mailbox(MUSB_ID_GROUND); +- if (error) +- goto out_err; ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND); + + error = regmap_update_bits(ddata->reg, CPCAP_REG_USBC3, + CPCAP_BIT_VBUSSTBY_EN | +@@ -257,9 +268,7 @@ static void cpcap_usb_detect(struct work_struct *work) + error = cpcap_usb_set_usb_mode(ddata); + if (error) + goto out_err; +- error = musb_mailbox(MUSB_ID_GROUND); +- if (error) +- goto out_err; ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND); + + return; + } +@@ -269,22 +278,18 @@ static void cpcap_usb_detect(struct work_struct *work) + error = cpcap_usb_set_usb_mode(ddata); + if (error) + goto out_err; +- error = musb_mailbox(MUSB_VBUS_VALID); +- if (error) +- goto out_err; ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_VALID); + + return; + } + ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); ++ + /* Default to debug UART mode */ + error = cpcap_usb_set_uart_mode(ddata); + if (error) + goto out_err; + +- error = musb_mailbox(MUSB_VBUS_OFF); +- if (error) +- goto out_err; +- + dev_dbg(ddata->dev, "set UART mode\n"); + + return; +@@ -649,9 +654,7 @@ static int cpcap_usb_phy_remove(struct platform_device *pdev) + if (error) + dev_err(ddata->dev, "could not set UART mode\n"); + +- error = musb_mailbox(MUSB_VBUS_OFF); +- if (error) +- dev_err(ddata->dev, "could not set mailbox\n"); ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); + + usb_remove_phy(&ddata->phy); + cancel_delayed_work_sync(&ddata->detect_work); +diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c +index 94ddd7d659c8..925b0004a0ed 100644 +--- a/drivers/powercap/intel_rapl_common.c ++++ b/drivers/powercap/intel_rapl_common.c +@@ -1293,6 +1293,9 @@ struct rapl_package *rapl_add_package(int cpu, struct rapl_if_priv *priv) + struct cpuinfo_x86 *c = &cpu_data(cpu); + int ret; + ++ if (!rapl_defaults) ++ return ERR_PTR(-ENODEV); ++ + rp = kzalloc(sizeof(struct rapl_package), GFP_KERNEL); + if (!rp) + return ERR_PTR(-ENOMEM); +diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c +index eea5ebbb5119..c655074c07c2 100644 +--- a/drivers/rpmsg/rpmsg_char.c ++++ b/drivers/rpmsg/rpmsg_char.c +@@ -227,8 +227,10 @@ static ssize_t rpmsg_eptdev_write_iter(struct kiocb *iocb, + if (!kbuf) + return -ENOMEM; + +- if (!copy_from_iter_full(kbuf, len, from)) +- return -EFAULT; ++ if (!copy_from_iter_full(kbuf, len, from)) { ++ ret = -EFAULT; ++ goto free_kbuf; ++ } + + if (mutex_lock_interruptible(&eptdev->ept_lock)) { + ret = -ERESTARTSYS; +diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c +index 5e2bd9f1d01e..fc32be687606 100644 +--- a/drivers/rtc/rtc-sun6i.c ++++ b/drivers/rtc/rtc-sun6i.c +@@ -380,6 +380,22 @@ static void __init sun50i_h6_rtc_clk_init(struct device_node *node) + CLK_OF_DECLARE_DRIVER(sun50i_h6_rtc_clk, "allwinner,sun50i-h6-rtc", + sun50i_h6_rtc_clk_init); + ++/* ++ * The R40 user manual is self-conflicting on whether the prescaler is ++ * fixed or configurable. The clock diagram shows it as fixed, but there ++ * is also a configurable divider in the RTC block. ++ */ ++static const struct sun6i_rtc_clk_data sun8i_r40_rtc_data = { ++ .rc_osc_rate = 16000000, ++ .fixed_prescaler = 512, ++}; ++static void __init sun8i_r40_rtc_clk_init(struct device_node *node) ++{ ++ sun6i_rtc_clk_init(node, &sun8i_r40_rtc_data); ++} ++CLK_OF_DECLARE_DRIVER(sun8i_r40_rtc_clk, "allwinner,sun8i-r40-rtc", ++ sun8i_r40_rtc_clk_init); ++ + static const struct sun6i_rtc_clk_data sun8i_v3_rtc_data = { + .rc_osc_rate = 32000, + .has_out_clk = 1, +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index 29ab81df75c0..fbfce02e5b93 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -275,8 +275,10 @@ bfad_im_get_stats(struct Scsi_Host *shost) + rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa), + fcstats, bfad_hcb_comp, &fcomp); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); +- if (rc != BFA_STATUS_OK) ++ if (rc != BFA_STATUS_OK) { ++ kfree(fcstats); + return NULL; ++ } + + wait_for_completion(&fcomp.comp); + +diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c +index dbff0f7e7cf5..ddc0dc93d08b 100644 +--- a/drivers/staging/comedi/drivers/adv_pci1710.c ++++ b/drivers/staging/comedi/drivers/adv_pci1710.c +@@ -46,8 +46,8 @@ + #define PCI171X_RANGE_UNI BIT(4) + #define PCI171X_RANGE_GAIN(x) (((x) & 0x7) << 0) + #define PCI171X_MUX_REG 0x04 /* W: A/D multiplexor control */ +-#define PCI171X_MUX_CHANH(x) (((x) & 0xf) << 8) +-#define PCI171X_MUX_CHANL(x) (((x) & 0xf) << 0) ++#define PCI171X_MUX_CHANH(x) (((x) & 0xff) << 8) ++#define PCI171X_MUX_CHANL(x) (((x) & 0xff) << 0) + #define PCI171X_MUX_CHAN(x) (PCI171X_MUX_CHANH(x) | PCI171X_MUX_CHANL(x)) + #define PCI171X_STATUS_REG 0x06 /* R: status register */ + #define PCI171X_STATUS_IRQ BIT(11) /* 1=IRQ occurred */ +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index a7cac0719b8b..b5d42f411dd8 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -37,6 +37,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = { + {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ + {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ ++ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ + {} /* Terminating entry */ +diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c +index 8d19ae71e7cc..4e651b698617 100644 +--- a/drivers/staging/vt6656/baseband.c ++++ b/drivers/staging/vt6656/baseband.c +@@ -449,8 +449,8 @@ int vnt_vt3184_init(struct vnt_private *priv) + + memcpy(array, addr, length); + +- ret = vnt_control_out(priv, MESSAGE_TYPE_WRITE, 0, +- MESSAGE_REQUEST_BBREG, length, array); ++ ret = vnt_control_out_blocks(priv, VNT_REG_BLOCK_SIZE, ++ MESSAGE_REQUEST_BBREG, length, array); + if (ret) + goto end; + +diff --git a/drivers/staging/vt6656/card.c b/drivers/staging/vt6656/card.c +index 56cd77fd9ea0..7958fc165462 100644 +--- a/drivers/staging/vt6656/card.c ++++ b/drivers/staging/vt6656/card.c +@@ -719,7 +719,7 @@ end: + */ + int vnt_radio_power_on(struct vnt_private *priv) + { +- int ret = true; ++ int ret = 0; + + vnt_exit_deep_sleep(priv); + +diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h +index 6074ceda78bf..50e1c8918040 100644 +--- a/drivers/staging/vt6656/device.h ++++ b/drivers/staging/vt6656/device.h +@@ -259,6 +259,7 @@ struct vnt_private { + u8 mac_hw; + /* netdev */ + struct usb_device *usb; ++ struct usb_interface *intf; + + u64 tsf_time; + u8 rx_rate; +diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c +index 856ba97aec4f..c26882e2bb80 100644 +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -950,7 +950,7 @@ static const struct ieee80211_ops vnt_mac_ops = { + + int vnt_init(struct vnt_private *priv) + { +- if (!(vnt_init_registers(priv))) ++ if (vnt_init_registers(priv)) + return -EAGAIN; + + SET_IEEE80211_PERM_ADDR(priv->hw, priv->permanent_net_addr); +@@ -993,6 +993,7 @@ vt6656_probe(struct usb_interface *intf, const struct usb_device_id *id) + priv = hw->priv; + priv->hw = hw; + priv->usb = udev; ++ priv->intf = intf; + + vnt_set_options(priv); + +diff --git a/drivers/staging/vt6656/usbpipe.c b/drivers/staging/vt6656/usbpipe.c +index d3304df6bd53..d977d4777e4f 100644 +--- a/drivers/staging/vt6656/usbpipe.c ++++ b/drivers/staging/vt6656/usbpipe.c +@@ -59,7 +59,9 @@ int vnt_control_out(struct vnt_private *priv, u8 request, u16 value, + + kfree(usb_buffer); + +- if (ret >= 0 && ret < (int)length) ++ if (ret == (int)length) ++ ret = 0; ++ else + ret = -EIO; + + end_unlock: +@@ -74,6 +76,23 @@ int vnt_control_out_u8(struct vnt_private *priv, u8 reg, u8 reg_off, u8 data) + reg_off, reg, sizeof(u8), &data); + } + ++int vnt_control_out_blocks(struct vnt_private *priv, ++ u16 block, u8 reg, u16 length, u8 *data) ++{ ++ int ret = 0, i; ++ ++ for (i = 0; i < length; i += block) { ++ u16 len = min_t(int, length - i, block); ++ ++ ret = vnt_control_out(priv, MESSAGE_TYPE_WRITE, ++ i, reg, len, data + i); ++ if (ret) ++ goto end; ++ } ++end: ++ return ret; ++} ++ + int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, + u16 index, u16 length, u8 *buffer) + { +@@ -103,7 +122,9 @@ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, + + kfree(usb_buffer); + +- if (ret >= 0 && ret < (int)length) ++ if (ret == (int)length) ++ ret = 0; ++ else + ret = -EIO; + + end_unlock: +diff --git a/drivers/staging/vt6656/usbpipe.h b/drivers/staging/vt6656/usbpipe.h +index 95147ec7b96a..b65d9c01a211 100644 +--- a/drivers/staging/vt6656/usbpipe.h ++++ b/drivers/staging/vt6656/usbpipe.h +@@ -18,6 +18,8 @@ + + #include "device.h" + ++#define VNT_REG_BLOCK_SIZE 64 ++ + int vnt_control_out(struct vnt_private *priv, u8 request, u16 value, + u16 index, u16 length, u8 *buffer); + int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, +@@ -26,6 +28,9 @@ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, + int vnt_control_out_u8(struct vnt_private *priv, u8 reg, u8 ref_off, u8 data); + int vnt_control_in_u8(struct vnt_private *priv, u8 reg, u8 reg_off, u8 *data); + ++int vnt_control_out_blocks(struct vnt_private *priv, ++ u16 block, u8 reg, u16 len, u8 *data); ++ + int vnt_start_interrupt_urb(struct vnt_private *priv); + int vnt_submit_rx_urb(struct vnt_private *priv, struct vnt_rcb *rcb); + int vnt_tx_context(struct vnt_private *priv, +diff --git a/drivers/staging/vt6656/wcmd.c b/drivers/staging/vt6656/wcmd.c +index 3eb2f11a5de1..2c5250ca2801 100644 +--- a/drivers/staging/vt6656/wcmd.c ++++ b/drivers/staging/vt6656/wcmd.c +@@ -99,6 +99,7 @@ void vnt_run_command(struct work_struct *work) + if (vnt_init(priv)) { + /* If fail all ends TODO retry */ + dev_err(&priv->usb->dev, "failed to start\n"); ++ usb_set_intfdata(priv->intf, NULL); + ieee80211_free_hw(priv->hw); + return; + } +diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c +index a0ac16ee6575..a9719858c950 100644 +--- a/drivers/tty/serdev/core.c ++++ b/drivers/tty/serdev/core.c +@@ -582,6 +582,12 @@ static acpi_status acpi_serdev_register_device(struct serdev_controller *ctrl, + return AE_OK; + } + ++static const struct acpi_device_id serdev_acpi_devices_blacklist[] = { ++ { "INT3511", 0 }, ++ { "INT3512", 0 }, ++ { }, ++}; ++ + static acpi_status acpi_serdev_add_device(acpi_handle handle, u32 level, + void *data, void **return_value) + { +@@ -591,6 +597,10 @@ static acpi_status acpi_serdev_add_device(acpi_handle handle, u32 level, + if (acpi_bus_get_device(handle, &adev)) + return AE_OK; + ++ /* Skip if black listed */ ++ if (!acpi_match_device_ids(adev, serdev_acpi_devices_blacklist)) ++ return AE_OK; ++ + return acpi_serdev_register_device(ctrl, adev); + } + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index b0a6eb106edb..7c2782785736 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2834,6 +2834,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport) + if (uport->cons && uport->dev) + of_console_check(uport->dev->of_node, uport->cons->name, uport->line); + ++ tty_port_link_device(port, drv->tty_driver, uport->line); + uart_configure_port(drv, state, uport); + + port->console = uart_console(uport); +diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c +index 4c1e75509303..02f6ca2cb1ba 100644 +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -1375,13 +1375,10 @@ static void cdns3_check_usb_interrupt_proceed(struct cdns3_device *priv_dev, + */ + static irqreturn_t cdns3_device_irq_handler(int irq, void *data) + { +- struct cdns3_device *priv_dev; +- struct cdns3 *cdns = data; ++ struct cdns3_device *priv_dev = data; + irqreturn_t ret = IRQ_NONE; + u32 reg; + +- priv_dev = cdns->gadget_dev; +- + /* check USB device interrupt */ + reg = readl(&priv_dev->regs->usb_ists); + if (reg) { +@@ -1419,14 +1416,12 @@ static irqreturn_t cdns3_device_irq_handler(int irq, void *data) + */ + static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data) + { +- struct cdns3_device *priv_dev; +- struct cdns3 *cdns = data; ++ struct cdns3_device *priv_dev = data; + irqreturn_t ret = IRQ_NONE; + unsigned long flags; + int bit; + u32 reg; + +- priv_dev = cdns->gadget_dev; + spin_lock_irqsave(&priv_dev->lock, flags); + + reg = readl(&priv_dev->regs->usb_ists); +@@ -2539,7 +2534,7 @@ void cdns3_gadget_exit(struct cdns3 *cdns) + + priv_dev = cdns->gadget_dev; + +- devm_free_irq(cdns->dev, cdns->dev_irq, cdns); ++ devm_free_irq(cdns->dev, cdns->dev_irq, priv_dev); + + pm_runtime_mark_last_busy(cdns->dev); + pm_runtime_put_autosuspend(cdns->dev); +@@ -2710,7 +2705,8 @@ static int __cdns3_gadget_init(struct cdns3 *cdns) + ret = devm_request_threaded_irq(cdns->dev, cdns->dev_irq, + cdns3_device_irq_handler, + cdns3_device_thread_irq_handler, +- IRQF_SHARED, dev_name(cdns->dev), cdns); ++ IRQF_SHARED, dev_name(cdns->dev), ++ cdns->gadget_dev); + + if (ret) + goto err0; +diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c +index b45ceb91c735..48e4a5ca1835 100644 +--- a/drivers/usb/chipidea/host.c ++++ b/drivers/usb/chipidea/host.c +@@ -26,6 +26,7 @@ static int (*orig_bus_suspend)(struct usb_hcd *hcd); + + struct ehci_ci_priv { + struct regulator *reg_vbus; ++ bool enabled; + }; + + static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) +@@ -37,7 +38,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + int ret = 0; + int port = HCS_N_PORTS(ehci->hcs_params); + +- if (priv->reg_vbus) { ++ if (priv->reg_vbus && enable != priv->enabled) { + if (port > 1) { + dev_warn(dev, + "Not support multi-port regulator control\n"); +@@ -53,6 +54,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + enable ? "enable" : "disable", ret); + return ret; + } ++ priv->enabled = enable; + } + + if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) { +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 5e92c6abe306..3e94259406d7 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -392,12 +392,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, + endpoint->desc.wMaxPacketSize = cpu_to_le16(8); + } + +- /* Validate the wMaxPacketSize field */ ++ /* ++ * Validate the wMaxPacketSize field. ++ * Some devices have isochronous endpoints in altsetting 0; ++ * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 ++ * (see the end of section 5.6.3), so don't warn about them. ++ */ + maxp = usb_endpoint_maxp(&endpoint->desc); +- if (maxp == 0) { +- dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n", ++ if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { ++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", + cfgno, inum, asnum, d->bEndpointAddress); +- goto skip_to_next_endpoint_or_interface_descriptor; + } + + /* Find the highest legal maxpacket size for this endpoint */ +diff --git a/drivers/usb/host/ohci-da8xx.c b/drivers/usb/host/ohci-da8xx.c +index 38183ac438c6..1371b0c249ec 100644 +--- a/drivers/usb/host/ohci-da8xx.c ++++ b/drivers/usb/host/ohci-da8xx.c +@@ -415,13 +415,17 @@ static int ohci_da8xx_probe(struct platform_device *pdev) + } + + da8xx_ohci->oc_gpio = devm_gpiod_get_optional(dev, "oc", GPIOD_IN); +- if (IS_ERR(da8xx_ohci->oc_gpio)) ++ if (IS_ERR(da8xx_ohci->oc_gpio)) { ++ error = PTR_ERR(da8xx_ohci->oc_gpio); + goto err; ++ } + + if (da8xx_ohci->oc_gpio) { + oc_irq = gpiod_to_irq(da8xx_ohci->oc_gpio); +- if (oc_irq < 0) ++ if (oc_irq < 0) { ++ error = oc_irq; + goto err; ++ } + + error = devm_request_threaded_irq(dev, oc_irq, NULL, + ohci_da8xx_oc_thread, IRQF_TRIGGER_RISING | +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index bd63450af76a..bf083c1f997f 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1840,6 +1840,9 @@ ATTRIBUTE_GROUPS(musb); + #define MUSB_QUIRK_B_INVALID_VBUS_91 (MUSB_DEVCTL_BDEVICE | \ + (2 << MUSB_DEVCTL_VBUS_SHIFT) | \ + MUSB_DEVCTL_SESSION) ++#define MUSB_QUIRK_B_DISCONNECT_99 (MUSB_DEVCTL_BDEVICE | \ ++ (3 << MUSB_DEVCTL_VBUS_SHIFT) | \ ++ MUSB_DEVCTL_SESSION) + #define MUSB_QUIRK_A_DISCONNECT_19 ((3 << MUSB_DEVCTL_VBUS_SHIFT) | \ + MUSB_DEVCTL_SESSION) + +@@ -1862,6 +1865,11 @@ static void musb_pm_runtime_check_session(struct musb *musb) + s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV | + MUSB_DEVCTL_HR; + switch (devctl & ~s) { ++ case MUSB_QUIRK_B_DISCONNECT_99: ++ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); ++ schedule_delayed_work(&musb->irq_work, ++ msecs_to_jiffies(1000)); ++ break; + case MUSB_QUIRK_B_INVALID_VBUS_91: + if (musb->quirk_retries && !musb->flush_irq_work) { + musb_dbg(musb, +@@ -2310,6 +2318,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl) + musb_disable_interrupts(musb); + musb_writeb(musb->mregs, MUSB_DEVCTL, 0); + ++ /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */ ++ musb_writeb(musb->mregs, MUSB_POWER, 0); ++ + /* Init IRQ workqueue before request_irq */ + INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work); + INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset); +diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c +index 5fc6825745f2..2d3751d885b4 100644 +--- a/drivers/usb/musb/musbhsdma.c ++++ b/drivers/usb/musb/musbhsdma.c +@@ -425,7 +425,7 @@ struct dma_controller *musbhs_dma_controller_create(struct musb *musb, + controller->controller.channel_abort = dma_channel_abort; + + if (request_irq(irq, dma_controller_irq, 0, +- dev_name(musb->controller), &controller->controller)) { ++ dev_name(musb->controller), controller)) { + dev_err(dev, "request_irq %d failed!\n", irq); + musb_dma_controller_destroy(&controller->controller); + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index fea09a3f491f..2d919d0e6e45 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -567,6 +567,9 @@ static void option_instat_callback(struct urb *urb); + /* Interface must have two endpoints */ + #define NUMEP2 BIT(16) + ++/* Device needs ZLP */ ++#define ZLP BIT(17) ++ + + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, +@@ -1198,6 +1201,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, +@@ -2099,6 +2104,9 @@ static int option_attach(struct usb_serial *serial) + if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) + data->use_send_setup = 1; + ++ if (device_flags & ZLP) ++ data->use_zlp = 1; ++ + spin_lock_init(&data->susp_lock); + + usb_set_serial_data(serial, data); +diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h +index 1c120eaf4091..934e9361cf6b 100644 +--- a/drivers/usb/serial/usb-wwan.h ++++ b/drivers/usb/serial/usb-wwan.h +@@ -38,6 +38,7 @@ struct usb_wwan_intf_private { + spinlock_t susp_lock; + unsigned int suspended:1; + unsigned int use_send_setup:1; ++ unsigned int use_zlp:1; + int in_flight; + unsigned int open_ports; + void *private; +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index 7e855c87e4f7..13be21aad2f4 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -461,6 +461,7 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + void (*callback) (struct urb *)) + { + struct usb_serial *serial = port->serial; ++ struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial); + struct urb *urb; + + urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */ +@@ -471,6 +472,9 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + usb_sndbulkpipe(serial->dev, endpoint) | dir, + buf, len, callback, ctx); + ++ if (intfdata->use_zlp && dir == USB_DIR_OUT) ++ urb->transfer_flags |= URB_ZERO_PACKET; ++ + return urb; + } + +diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c +index c1f7073a56de..8b4ff9fff340 100644 +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -432,20 +432,30 @@ irqreturn_t tcpci_irq(struct tcpci *tcpci) + + if (status & TCPC_ALERT_RX_STATUS) { + struct pd_message msg; +- unsigned int cnt; ++ unsigned int cnt, payload_cnt; + u16 header; + + regmap_read(tcpci->regmap, TCPC_RX_BYTE_CNT, &cnt); ++ /* ++ * 'cnt' corresponds to READABLE_BYTE_COUNT in section 4.4.14 ++ * of the TCPCI spec [Rev 2.0 Ver 1.0 October 2017] and is ++ * defined in table 4-36 as one greater than the number of ++ * bytes received. And that number includes the header. So: ++ */ ++ if (cnt > 3) ++ payload_cnt = cnt - (1 + sizeof(msg.header)); ++ else ++ payload_cnt = 0; + + tcpci_read16(tcpci, TCPC_RX_HDR, &header); + msg.header = cpu_to_le16(header); + +- if (WARN_ON(cnt > sizeof(msg.payload))) +- cnt = sizeof(msg.payload); ++ if (WARN_ON(payload_cnt > sizeof(msg.payload))) ++ payload_cnt = sizeof(msg.payload); + +- if (cnt > 0) ++ if (payload_cnt > 0) + regmap_raw_read(tcpci->regmap, TCPC_RX_DATA, +- &msg.payload, cnt); ++ &msg.payload, payload_cnt); + + /* Read complete, clear RX status alert bit */ + tcpci_write16(tcpci, TCPC_ALERT, TCPC_ALERT_RX_STATUS); +diff --git a/fs/char_dev.c b/fs/char_dev.c +index 00dfe17871ac..c5e6eff5a381 100644 +--- a/fs/char_dev.c ++++ b/fs/char_dev.c +@@ -352,7 +352,7 @@ static struct kobject *cdev_get(struct cdev *p) + + if (owner && !try_module_get(owner)) + return NULL; +- kobj = kobject_get(&p->kobj); ++ kobj = kobject_get_unless_zero(&p->kobj); + if (!kobj) + module_put(owner); + return kobj; +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index 487ee39b438a..013486b5125e 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -583,12 +583,12 @@ static int ramoops_init_przs(const char *name, + prz_ar[i] = persistent_ram_new(*paddr, zone_sz, sig, + &cxt->ecc_info, + cxt->memtype, flags, label); ++ kfree(label); + if (IS_ERR(prz_ar[i])) { + err = PTR_ERR(prz_ar[i]); + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, record_size, + (unsigned long long)*paddr, err); +- kfree(label); + + while (i > 0) { + i--; +@@ -629,12 +629,12 @@ static int ramoops_init_prz(const char *name, + label = kasprintf(GFP_KERNEL, "ramoops:%s", name); + *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, + cxt->memtype, PRZ_FLAG_ZAP_OLD, label); ++ kfree(label); + if (IS_ERR(*prz)) { + int err = PTR_ERR(*prz); + + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, sz, (unsigned long long)*paddr, err); +- kfree(label); + return err; + } + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 8823f65888f0..1f4d8c06f9be 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -574,7 +574,7 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size, + /* Initialize general buffer state. */ + raw_spin_lock_init(&prz->buffer_lock); + prz->flags = flags; +- prz->label = label; ++ prz->label = kstrdup(label, GFP_KERNEL); + + ret = persistent_ram_buffer_map(start, size, prz, memtype); + if (ret) +diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h +index 9b3c720a31b1..5e3d45525bd3 100644 +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -91,6 +92,36 @@ struct can_priv { + #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC)) + #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC)) + ++/* Check for outgoing skbs that have not been created by the CAN subsystem */ ++static inline bool can_skb_headroom_valid(struct net_device *dev, ++ struct sk_buff *skb) ++{ ++ /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */ ++ if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv))) ++ return false; ++ ++ /* af_packet does not apply CAN skb specific settings */ ++ if (skb->ip_summed == CHECKSUM_NONE) { ++ /* init headroom */ ++ can_skb_prv(skb)->ifindex = dev->ifindex; ++ can_skb_prv(skb)->skbcnt = 0; ++ ++ skb->ip_summed = CHECKSUM_UNNECESSARY; ++ ++ /* preform proper loopback on capable devices */ ++ if (dev->flags & IFF_ECHO) ++ skb->pkt_type = PACKET_LOOPBACK; ++ else ++ skb->pkt_type = PACKET_HOST; ++ ++ skb_reset_mac_header(skb); ++ skb_reset_network_header(skb); ++ skb_reset_transport_header(skb); ++ } ++ ++ return true; ++} ++ + /* Drop a given socketbuffer if it does not contain a valid CAN frame. */ + static inline bool can_dropped_invalid_skb(struct net_device *dev, + struct sk_buff *skb) +@@ -108,6 +139,9 @@ static inline bool can_dropped_invalid_skb(struct net_device *dev, + } else + goto inval_skb; + ++ if (!can_skb_headroom_valid(dev, skb)) ++ goto inval_skb; ++ + return false; + + inval_skb: +diff --git a/include/trace/events/preemptirq.h b/include/trace/events/preemptirq.h +index 95fba0471e5b..3f249e150c0c 100644 +--- a/include/trace/events/preemptirq.h ++++ b/include/trace/events/preemptirq.h +@@ -18,13 +18,13 @@ DECLARE_EVENT_CLASS(preemptirq_template, + TP_ARGS(ip, parent_ip), + + TP_STRUCT__entry( +- __field(u32, caller_offs) +- __field(u32, parent_offs) ++ __field(s32, caller_offs) ++ __field(s32, parent_offs) + ), + + TP_fast_assign( +- __entry->caller_offs = (u32)(ip - (unsigned long)_stext); +- __entry->parent_offs = (u32)(parent_ip - (unsigned long)_stext); ++ __entry->caller_offs = (s32)(ip - (unsigned long)_stext); ++ __entry->parent_offs = (s32)(parent_ip - (unsigned long)_stext); + ), + + TP_printk("caller=%pS parent=%pS", +diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h +index f056b2a00d5c..9a61c28ed3ae 100644 +--- a/include/uapi/linux/input.h ++++ b/include/uapi/linux/input.h +@@ -34,6 +34,7 @@ struct input_event { + __kernel_ulong_t __sec; + #if defined(__sparc__) && defined(__arch64__) + unsigned int __usec; ++ unsigned int __pad; + #else + __kernel_ulong_t __usec; + #endif +diff --git a/kernel/fork.c b/kernel/fork.c +index 6cabc124378c..755d8160e001 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2513,6 +2513,16 @@ SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp, + #endif + + #ifdef __ARCH_WANT_SYS_CLONE3 ++ ++/* ++ * copy_thread implementations handle CLONE_SETTLS by reading the TLS value from ++ * the registers containing the syscall arguments for clone. This doesn't work ++ * with clone3 since the TLS value is passed in clone_args instead. ++ */ ++#ifndef CONFIG_HAVE_COPY_THREAD_TLS ++#error clone3 requires copy_thread_tls support in arch ++#endif ++ + noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, + struct clone_args __user *uargs, + size_t usize) +diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c +index 5e43b9664eca..617e297f46dc 100644 +--- a/kernel/trace/trace_sched_wakeup.c ++++ b/kernel/trace/trace_sched_wakeup.c +@@ -630,7 +630,7 @@ static void start_wakeup_tracer(struct trace_array *tr) + if (ret) { + pr_info("wakeup trace: Couldn't activate tracepoint" + " probe to kernel_sched_migrate_task\n"); +- return; ++ goto fail_deprobe_sched_switch; + } + + wakeup_reset(tr); +@@ -648,6 +648,8 @@ static void start_wakeup_tracer(struct trace_array *tr) + printk(KERN_ERR "failed to start wakeup tracer\n"); + + return; ++fail_deprobe_sched_switch: ++ unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); + fail_deprobe_wake_new: + unregister_trace_sched_wakeup_new(probe_wakeup, NULL); + fail_deprobe: +diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c +index 4df9a209f7ca..c557f42a9397 100644 +--- a/kernel/trace/trace_stack.c ++++ b/kernel/trace/trace_stack.c +@@ -283,6 +283,11 @@ static void check_stack(unsigned long ip, unsigned long *stack) + local_irq_restore(flags); + } + ++/* Some archs may not define MCOUNT_INSN_SIZE */ ++#ifndef MCOUNT_INSN_SIZE ++# define MCOUNT_INSN_SIZE 0 ++#endif ++ + static void + stack_trace_call(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *op, struct pt_regs *pt_regs) +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 214154b47d56..069f72edb264 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -384,10 +384,11 @@ next: ; + return 1; + } + +-static inline int check_target(struct arpt_entry *e, const char *name) ++static int check_target(struct arpt_entry *e, struct net *net, const char *name) + { + struct xt_entry_target *t = arpt_get_target(e); + struct xt_tgchk_param par = { ++ .net = net, + .table = name, + .entryinfo = e, + .target = t->u.kernel.target, +@@ -399,8 +400,9 @@ static inline int check_target(struct arpt_entry *e, const char *name) + return xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false); + } + +-static inline int +-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, ++static int ++find_check_entry(struct arpt_entry *e, struct net *net, const char *name, ++ unsigned int size, + struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; +@@ -419,7 +421,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, + } + t->u.kernel.target = target; + +- ret = check_target(e, name); ++ ret = check_target(e, net, name); + if (ret) + goto err; + return 0; +@@ -512,7 +514,9 @@ static inline void cleanup_entry(struct arpt_entry *e) + /* Checks and translates the user-supplied table segment (held in + * newinfo). + */ +-static int translate_table(struct xt_table_info *newinfo, void *entry0, ++static int translate_table(struct net *net, ++ struct xt_table_info *newinfo, ++ void *entry0, + const struct arpt_replace *repl) + { + struct xt_percpu_counter_alloc_state alloc_state = { 0 }; +@@ -569,7 +573,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, repl->name, repl->size, ++ ret = find_check_entry(iter, net, repl->name, repl->size, + &alloc_state); + if (ret != 0) + break; +@@ -974,7 +978,7 @@ static int do_replace(struct net *net, const void __user *user, + goto free_newinfo; + } + +- ret = translate_table(newinfo, loc_cpu_entry, &tmp); ++ ret = translate_table(net, newinfo, loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1149,7 +1153,8 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr, + } + } + +-static int translate_compat_table(struct xt_table_info **pinfo, ++static int translate_compat_table(struct net *net, ++ struct xt_table_info **pinfo, + void **pentry0, + const struct compat_arpt_replace *compatr) + { +@@ -1217,7 +1222,7 @@ static int translate_compat_table(struct xt_table_info **pinfo, + repl.num_counters = 0; + repl.counters = NULL; + repl.size = newinfo->size; +- ret = translate_table(newinfo, entry1, &repl); ++ ret = translate_table(net, newinfo, entry1, &repl); + if (ret) + goto free_newinfo; + +@@ -1270,7 +1275,7 @@ static int compat_do_replace(struct net *net, void __user *user, + goto free_newinfo; + } + +- ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp); ++ ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1546,7 +1551,7 @@ int arpt_register_table(struct net *net, + loc_cpu_entry = newinfo->entries; + memcpy(loc_cpu_entry, repl->entries, repl->size); + +- ret = translate_table(newinfo, loc_cpu_entry, repl); ++ ret = translate_table(net, newinfo, loc_cpu_entry, repl); + if (ret != 0) + goto out_free; + +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index d73d1828216a..d8143a8c034d 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -1658,6 +1658,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, + struct ip_set *set; + struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {}; + int ret = 0; ++ u32 lineno; + + if (unlikely(protocol_min_failed(attr) || + !attr[IPSET_ATTR_SETNAME] || +@@ -1674,7 +1675,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, + return -IPSET_ERR_PROTOCOL; + + rcu_read_lock_bh(); +- ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0); ++ ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0); + rcu_read_unlock_bh(); + /* Userspace can't trigger element to be re-added */ + if (ret == -EAGAIN) +diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c +index b6b14db3955b..b3f4a334f9d7 100644 +--- a/net/netfilter/nf_conntrack_proto_dccp.c ++++ b/net/netfilter/nf_conntrack_proto_dccp.c +@@ -677,6 +677,9 @@ static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[], + unsigned int *timeouts = data; + int i; + ++ if (!timeouts) ++ timeouts = dn->dccp_timeout; ++ + /* set default DCCP timeouts. */ + for (i=0; idccp_timeout[i]; +diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c +index fce3d93f1541..0399ae8f1188 100644 +--- a/net/netfilter/nf_conntrack_proto_sctp.c ++++ b/net/netfilter/nf_conntrack_proto_sctp.c +@@ -594,6 +594,9 @@ static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[], + struct nf_sctp_net *sn = nf_sctp_pernet(net); + int i; + ++ if (!timeouts) ++ timeouts = sn->timeouts; ++ + /* set default SCTP timeouts. */ + for (i=0; itimeouts[i]; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 252888f426de..d293488dc3dd 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -412,6 +412,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0672: + alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */ + break; ++ case 0x10ec0222: + case 0x10ec0623: + alc_update_coef_idx(codec, 0x19, 1<<13, 0); + break; +@@ -430,6 +431,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + break; + case 0x10ec0899: + case 0x10ec0900: ++ case 0x10ec0b00: + case 0x10ec1168: + case 0x10ec1220: + alc_update_coef_idx(codec, 0x7, 1<<1, 0); +@@ -2526,6 +2528,7 @@ static int patch_alc882(struct hda_codec *codec) + case 0x10ec0882: + case 0x10ec0885: + case 0x10ec0900: ++ case 0x10ec0b00: + case 0x10ec1220: + break; + default: +@@ -7257,6 +7260,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x17aa, 0x2292, "Thinkpad X1 Yoga 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1), + SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), +@@ -9295,6 +9299,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { + HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662), + HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882), + HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882), ++ HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882), + {} /* terminator */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index a81c2066499f..82184036437b 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1397,6 +1397,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ + case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ + case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ ++ case USB_ID(0x05a7, 0x1020): /* Bose Companion 5 */ + case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ + case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */ + case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */ diff --git a/patch/kernel/meson64-current/drm_bridge_reuse_DDC.patch b/patch/kernel/meson64-current/drm_bridge_reuse_DDC.patch deleted file mode 100644 index 0d1305a165..0000000000 --- a/patch/kernel/meson64-current/drm_bridge_reuse_DDC.patch +++ /dev/null @@ -1,71 +0,0 @@ -From patchwork Wed Oct 2 19:44:06 2019 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Subject: [v2] drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controller -From: Matthias Kaehlcke -X-Patchwork-Id: 334046 -Message-Id: <20191002124354.v2.1.I709dfec496f5f0b44a7b61dcd4937924da8d8382@changeid> -To: Archit Taneja , Andrzej Hajda , - Laurent Pinchart , - David Airlie -Cc: Jernej Skrabec , - Tzung-Bi Shih , - Neil Armstrong , - Sean Paul , Douglas Anderson , - dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, - Matthias Kaehlcke , Cheng-Yi Chiang , - Yakir Yang , Jerome Brunet -Date: Wed, 2 Oct 2019 12:44:06 -0700 - -The DDC/CI protocol involves sending a multi-byte request to the -display via I2C, which is typically followed by a multi-byte -response. The internal I2C controller only allows single byte -reads/writes or reads of 8 sequential bytes, hence DDC/CI is not -supported when the internal I2C controller is used. The I2C -transfers complete without errors, however the data in the response -is garbage. Abort transfers to/from slave address 0x37 (DDC) with --EOPNOTSUPP, to make it evident that the communication is failing. - -Signed-off-by: Matthias Kaehlcke -Reviewed-by: Douglas Anderson -Reviewed-by: Sean Paul -Acked-by: Neil Armstrong ---- -Sorry for the delay with sending v2, I completely forgot about this patch ... - -Changes in v2: -- updated comment with 'TOFIX' entry as requested by Neil -- added Neil's 'Acked-by' tag - - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index 52d220a70362..ac24bceaf415 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -41,6 +41,7 @@ - - #include - -+#define DDC_CI_ADDR 0x37 - #define DDC_SEGMENT_ADDR 0x30 - - #define HDMI_EDID_LEN 512 -@@ -439,6 +440,15 @@ static int dw_hdmi_i2c_xfer(struct i2c_adapter *adap, - u8 addr = msgs[0].addr; - int i, ret = 0; - -+ if (addr == DDC_CI_ADDR) -+ /* -+ * The internal I2C controller does not support the multi-byte -+ * read and write operations needed for DDC/CI. -+ * TOFIX: Blacklist the DDC/CI address until we filter out -+ * unsupported I2C operations. -+ */ -+ return -EOPNOTSUPP; -+ - dev_dbg(hdmi->dev, "xfer: num: %d, addr: %#x\n", num, addr); - - for (i = 0; i < num; i++) { diff --git a/patch/kernel/meson64-current/vclk_use_the_correct_G12A_frac_max_value.patch b/patch/kernel/meson64-current/vclk_use_the_correct_G12A_frac_max_value.patch deleted file mode 100644 index 32e079b63a..0000000000 --- a/patch/kernel/meson64-current/vclk_use_the_correct_G12A_frac_max_value.patch +++ /dev/null @@ -1,53 +0,0 @@ -From patchwork Wed Aug 28 13:23:11 2019 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Subject: [RESEND] drm/meson: vclk: use the correct G12A frac max value -From: Neil Armstrong -X-Patchwork-Id: 327555 -Message-Id: <20190828132311.23881-1-narmstrong@baylibre.com> -To: dri-devel@lists.freedesktop.org -Cc: linux-amlogic@lists.infradead.org, linux-kernel@vger.kernel.org, - linux-arm-kernel@lists.infradead.org, - Neil Armstrong -Date: Wed, 28 Aug 2019 15:23:11 +0200 - -When calculating the HDMI PLL settings for a DMT mode PHY frequency, -use the correct max fractional PLL value for G12A VPU. - -With this fix, we can finally setup the 1024x768-60 mode. - -Fixes: 202b9808f8ed ("drm/meson: Add G12A Video Clock setup") -Signed-off-by: Neil Armstrong -Reviewed-by: Kevin Hilman ---- -Fixed typo in commit log, 1024x76 => 1024x768 - - drivers/gpu/drm/meson/meson_vclk.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c -index ac491a781952..f690793ae2d5 100644 ---- a/drivers/gpu/drm/meson/meson_vclk.c -+++ b/drivers/gpu/drm/meson/meson_vclk.c -@@ -638,13 +638,18 @@ static bool meson_hdmi_pll_validate_params(struct meson_drm *priv, - if (frac >= HDMI_FRAC_MAX_GXBB) - return false; - } else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXM) || -- meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXL) || -- meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { -+ meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXL)) { - /* Empiric supported min/max dividers */ - if (m < 106 || m > 247) - return false; - if (frac >= HDMI_FRAC_MAX_GXL) - return false; -+ } else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { -+ /* Empiric supported min/max dividers */ -+ if (m < 106 || m > 247) -+ return false; -+ if (frac >= HDMI_FRAC_MAX_G12A) -+ return false; - } - - return true; diff --git a/patch/kernel/odroidxu4-current/02-patch-5.4.3-4.patch b/patch/kernel/odroidxu4-current/02-patch-5.4.3-4.patch new file mode 100644 index 0000000000..125f3454e8 --- /dev/null +++ b/patch/kernel/odroidxu4-current/02-patch-5.4.3-4.patch @@ -0,0 +1,6257 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 9983ac73b66d..f5a551e4332d 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -5101,13 +5101,13 @@ + Flags is a set of characters, each corresponding + to a common usb-storage quirk flag as follows: + a = SANE_SENSE (collect more than 18 bytes +- of sense data); ++ of sense data, not on uas); + b = BAD_SENSE (don't collect more than 18 +- bytes of sense data); ++ bytes of sense data, not on uas); + c = FIX_CAPACITY (decrease the reported + device capacity by one sector); + d = NO_READ_DISC_INFO (don't use +- READ_DISC_INFO command); ++ READ_DISC_INFO command, not on uas); + e = NO_READ_CAPACITY_16 (don't use + READ_CAPACITY_16 command); + f = NO_REPORT_OPCODES (don't use report opcodes +@@ -5122,17 +5122,18 @@ + j = NO_REPORT_LUNS (don't use report luns + command, uas only); + l = NOT_LOCKABLE (don't try to lock and +- unlock ejectable media); ++ unlock ejectable media, not on uas); + m = MAX_SECTORS_64 (don't transfer more +- than 64 sectors = 32 KB at a time); ++ than 64 sectors = 32 KB at a time, ++ not on uas); + n = INITIAL_READ10 (force a retry of the +- initial READ(10) command); ++ initial READ(10) command, not on uas); + o = CAPACITY_OK (accept the capacity +- reported by the device); ++ reported by the device, not on uas); + p = WRITE_CACHE (the device cache is ON +- by default); ++ by default, not on uas); + r = IGNORE_RESIDUE (the device reports +- bogus residue values); ++ bogus residue values, not on uas); + s = SINGLE_LUN (the device has only one + Logical Unit); + t = NO_ATA_1X (don't allow ATA(12) and ATA(16) +@@ -5141,7 +5142,8 @@ + w = NO_WP_DETECT (don't test whether the + medium is write-protected). + y = ALWAYS_SYNC (issue a SYNCHRONIZE_CACHE +- even if the device claims no cache) ++ even if the device claims no cache, ++ not on uas) + Example: quirks=0419:aaf5:rl,0421:0433:rc + + user_debug= [KNL,ARM] +diff --git a/Makefile b/Makefile +index 07998b60d56c..144daf02c78a 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 3 ++SUBLEVEL = 4 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/omap3-pandora-common.dtsi b/arch/arm/boot/dts/omap3-pandora-common.dtsi +index ec5891718ae6..150d5be42d27 100644 +--- a/arch/arm/boot/dts/omap3-pandora-common.dtsi ++++ b/arch/arm/boot/dts/omap3-pandora-common.dtsi +@@ -226,6 +226,17 @@ + gpio = <&gpio6 4 GPIO_ACTIVE_HIGH>; /* GPIO_164 */ + }; + ++ /* wl1251 wifi+bt module */ ++ wlan_en: fixed-regulator-wg7210_en { ++ compatible = "regulator-fixed"; ++ regulator-name = "vwlan"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ startup-delay-us = <50000>; ++ enable-active-high; ++ gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>; ++ }; ++ + /* wg7210 (wifi+bt module) 32k clock buffer */ + wg7210_32k: fixed-regulator-wg7210_32k { + compatible = "regulator-fixed"; +@@ -522,9 +533,30 @@ + /*wp-gpios = <&gpio4 31 GPIO_ACTIVE_HIGH>;*/ /* GPIO_127 */ + }; + +-/* mmc3 is probed using pdata-quirks to pass wl1251 card data */ + &mmc3 { +- status = "disabled"; ++ vmmc-supply = <&wlan_en>; ++ ++ bus-width = <4>; ++ non-removable; ++ ti,non-removable; ++ cap-power-off-card; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&mmc3_pins>; ++ ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ wlan: wifi@1 { ++ compatible = "ti,wl1251"; ++ ++ reg = <1>; ++ ++ interrupt-parent = <&gpio1>; ++ interrupts = <21 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_21 */ ++ ++ ti,wl1251-has-eeprom; ++ }; + }; + + /* bluetooth*/ +diff --git a/arch/arm/boot/dts/omap3-tao3530.dtsi b/arch/arm/boot/dts/omap3-tao3530.dtsi +index a7a04d78deeb..f24e2326cfa7 100644 +--- a/arch/arm/boot/dts/omap3-tao3530.dtsi ++++ b/arch/arm/boot/dts/omap3-tao3530.dtsi +@@ -222,7 +222,7 @@ + pinctrl-0 = <&mmc1_pins>; + vmmc-supply = <&vmmc1>; + vqmmc-supply = <&vsim>; +- cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_HIGH>; ++ cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>; + bus-width = <8>; + }; + +diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c +index 2efd18e8824c..1b7cf81ff035 100644 +--- a/arch/arm/mach-omap2/pdata-quirks.c ++++ b/arch/arm/mach-omap2/pdata-quirks.c +@@ -7,7 +7,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -311,118 +310,15 @@ static void __init omap3_logicpd_torpedo_init(void) + } + + /* omap3pandora legacy devices */ +-#define PANDORA_WIFI_IRQ_GPIO 21 +-#define PANDORA_WIFI_NRESET_GPIO 23 + + static struct platform_device pandora_backlight = { + .name = "pandora-backlight", + .id = -1, + }; + +-static struct regulator_consumer_supply pandora_vmmc3_supply[] = { +- REGULATOR_SUPPLY("vmmc", "omap_hsmmc.2"), +-}; +- +-static struct regulator_init_data pandora_vmmc3 = { +- .constraints = { +- .valid_ops_mask = REGULATOR_CHANGE_STATUS, +- }, +- .num_consumer_supplies = ARRAY_SIZE(pandora_vmmc3_supply), +- .consumer_supplies = pandora_vmmc3_supply, +-}; +- +-static struct fixed_voltage_config pandora_vwlan = { +- .supply_name = "vwlan", +- .microvolts = 1800000, /* 1.8V */ +- .startup_delay = 50000, /* 50ms */ +- .init_data = &pandora_vmmc3, +-}; +- +-static struct platform_device pandora_vwlan_device = { +- .name = "reg-fixed-voltage", +- .id = 1, +- .dev = { +- .platform_data = &pandora_vwlan, +- }, +-}; +- +-static struct gpiod_lookup_table pandora_vwlan_gpiod_table = { +- .dev_id = "reg-fixed-voltage.1", +- .table = { +- /* +- * As this is a low GPIO number it should be at the first +- * GPIO bank. +- */ +- GPIO_LOOKUP("gpio-0-31", PANDORA_WIFI_NRESET_GPIO, +- NULL, GPIO_ACTIVE_HIGH), +- { }, +- }, +-}; +- +-static void pandora_wl1251_init_card(struct mmc_card *card) +-{ +- /* +- * We have TI wl1251 attached to MMC3. Pass this information to +- * SDIO core because it can't be probed by normal methods. +- */ +- if (card->type == MMC_TYPE_SDIO || card->type == MMC_TYPE_SD_COMBO) { +- card->quirks |= MMC_QUIRK_NONSTD_SDIO; +- card->cccr.wide_bus = 1; +- card->cis.vendor = 0x104c; +- card->cis.device = 0x9066; +- card->cis.blksize = 512; +- card->cis.max_dtr = 24000000; +- card->ocr = 0x80; +- } +-} +- +-static struct omap2_hsmmc_info pandora_mmc3[] = { +- { +- .mmc = 3, +- .caps = MMC_CAP_4_BIT_DATA | MMC_CAP_POWER_OFF_CARD, +- .init_card = pandora_wl1251_init_card, +- }, +- {} /* Terminator */ +-}; +- +-static void __init pandora_wl1251_init(void) +-{ +- struct wl1251_platform_data pandora_wl1251_pdata; +- int ret; +- +- memset(&pandora_wl1251_pdata, 0, sizeof(pandora_wl1251_pdata)); +- +- pandora_wl1251_pdata.power_gpio = -1; +- +- ret = gpio_request_one(PANDORA_WIFI_IRQ_GPIO, GPIOF_IN, "wl1251 irq"); +- if (ret < 0) +- goto fail; +- +- pandora_wl1251_pdata.irq = gpio_to_irq(PANDORA_WIFI_IRQ_GPIO); +- if (pandora_wl1251_pdata.irq < 0) +- goto fail_irq; +- +- pandora_wl1251_pdata.use_eeprom = true; +- ret = wl1251_set_platform_data(&pandora_wl1251_pdata); +- if (ret < 0) +- goto fail_irq; +- +- return; +- +-fail_irq: +- gpio_free(PANDORA_WIFI_IRQ_GPIO); +-fail: +- pr_err("wl1251 board initialisation failed\n"); +-} +- + static void __init omap3_pandora_legacy_init(void) + { + platform_device_register(&pandora_backlight); +- gpiod_add_lookup_table(&pandora_vwlan_gpiod_table); +- platform_device_register(&pandora_vwlan_device); +- omap_hsmmc_init(pandora_mmc3); +- omap_hsmmc_late_init(pandora_mmc3); +- pandora_wl1251_init(); + } + #endif /* CONFIG_ARCH_OMAP3 */ + +diff --git a/arch/powerpc/include/asm/sections.h b/arch/powerpc/include/asm/sections.h +index 5a9b6eb651b6..d19871763ed4 100644 +--- a/arch/powerpc/include/asm/sections.h ++++ b/arch/powerpc/include/asm/sections.h +@@ -5,8 +5,22 @@ + + #include + #include ++ ++#define arch_is_kernel_initmem_freed arch_is_kernel_initmem_freed ++ + #include + ++extern bool init_mem_is_free; ++ ++static inline int arch_is_kernel_initmem_freed(unsigned long addr) ++{ ++ if (!init_mem_is_free) ++ return 0; ++ ++ return addr >= (unsigned long)__init_begin && ++ addr < (unsigned long)__init_end; ++} ++ + extern char __head_end[]; + + #ifdef __powerpc64__ +diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h +index c61d59ed3b45..2ccb938d8544 100644 +--- a/arch/powerpc/include/asm/vdso_datapage.h ++++ b/arch/powerpc/include/asm/vdso_datapage.h +@@ -82,6 +82,7 @@ struct vdso_data { + __s32 wtom_clock_nsec; /* Wall to monotonic clock nsec */ + __s64 wtom_clock_sec; /* Wall to monotonic clock sec */ + struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ ++ __u32 hrtimer_res; /* hrtimer resolution */ + __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + }; +@@ -103,6 +104,7 @@ struct vdso_data { + __s32 wtom_clock_nsec; + struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ + __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __u32 hrtimer_res; /* hrtimer resolution */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 dcache_block_size; /* L1 d-cache block size */ + __u32 icache_block_size; /* L1 i-cache block size */ +diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile +index a7ca8fe62368..3c02445cf086 100644 +--- a/arch/powerpc/kernel/Makefile ++++ b/arch/powerpc/kernel/Makefile +@@ -5,8 +5,8 @@ + + CFLAGS_ptrace.o += -DUTS_MACHINE='"$(UTS_MACHINE)"' + +-# Disable clang warning for using setjmp without setjmp.h header +-CFLAGS_crash.o += $(call cc-disable-warning, builtin-requires-header) ++# Avoid clang warnings around longjmp/setjmp declarations ++CFLAGS_crash.o += -ffreestanding + + ifdef CONFIG_PPC64 + CFLAGS_prom_init.o += $(NO_MINIMAL_TOC) +diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c +index 484f54dab247..5c0a1e17219b 100644 +--- a/arch/powerpc/kernel/asm-offsets.c ++++ b/arch/powerpc/kernel/asm-offsets.c +@@ -387,6 +387,7 @@ int main(void) + OFFSET(WTOM_CLOCK_NSEC, vdso_data, wtom_clock_nsec); + OFFSET(STAMP_XTIME, vdso_data, stamp_xtime); + OFFSET(STAMP_SEC_FRAC, vdso_data, stamp_sec_fraction); ++ OFFSET(CLOCK_HRTIMER_RES, vdso_data, hrtimer_res); + OFFSET(CFG_ICACHE_BLOCKSZ, vdso_data, icache_block_size); + OFFSET(CFG_DCACHE_BLOCKSZ, vdso_data, dcache_block_size); + OFFSET(CFG_ICACHE_LOGBLOCKSZ, vdso_data, icache_log_block_size); +@@ -417,7 +418,6 @@ int main(void) + DEFINE(CLOCK_REALTIME_COARSE, CLOCK_REALTIME_COARSE); + DEFINE(CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_COARSE); + DEFINE(NSEC_PER_SEC, NSEC_PER_SEC); +- DEFINE(CLOCK_REALTIME_RES, MONOTONIC_RES_NSEC); + + #ifdef CONFIG_BUG + DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry)); +diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S +index b55a7b4cb543..9bc0aa9aeb65 100644 +--- a/arch/powerpc/kernel/misc_64.S ++++ b/arch/powerpc/kernel/misc_64.S +@@ -82,7 +82,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 /* ensure we get enough */ + lwz r9,DCACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of cache block size */ +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + beqlr /* nothing to do? */ + mtctr r8 + 1: dcbst 0,r6 +@@ -98,7 +98,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 + lwz r9,ICACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of Icache block size */ +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + beqlr /* nothing to do? */ + mtctr r8 + 2: icbi 0,r6 +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index 694522308cd5..619447b1b797 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -959,6 +959,7 @@ void update_vsyscall(struct timekeeper *tk) + vdso_data->wtom_clock_nsec = tk->wall_to_monotonic.tv_nsec; + vdso_data->stamp_xtime = xt; + vdso_data->stamp_sec_fraction = frac_sec; ++ vdso_data->hrtimer_res = hrtimer_resolution; + smp_wmb(); + ++(vdso_data->tb_update_count); + } +diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S +index becd9f8767ed..a967e795b96d 100644 +--- a/arch/powerpc/kernel/vdso32/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S +@@ -156,12 +156,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + cror cr0*4+eq,cr0*4+eq,cr1*4+eq + bne cr0,99f + ++ mflr r12 ++ .cfi_register lr,r12 ++ bl __get_datapage@local /* get data page */ ++ lwz r5, CLOCK_HRTIMER_RES(r3) ++ mtlr r12 + li r3,0 + cmpli cr0,r4,0 + crclr cr0*4+so + beqlr +- lis r5,CLOCK_REALTIME_RES@h +- ori r5,r5,CLOCK_REALTIME_RES@l + stw r3,TSPC32_TV_SEC(r4) + stw r5,TSPC32_TV_NSEC(r4) + blr +diff --git a/arch/powerpc/kernel/vdso64/cacheflush.S b/arch/powerpc/kernel/vdso64/cacheflush.S +index 3f92561a64c4..526f5ba2593e 100644 +--- a/arch/powerpc/kernel/vdso64/cacheflush.S ++++ b/arch/powerpc/kernel/vdso64/cacheflush.S +@@ -35,7 +35,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 /* ensure we get enough */ + lwz r9,CFG_DCACHE_LOGBLOCKSZ(r10) +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + crclr cr0*4+so + beqlr /* nothing to do? */ + mtctr r8 +@@ -52,7 +52,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 + lwz r9,CFG_ICACHE_LOGBLOCKSZ(r10) +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + crclr cr0*4+so + beqlr /* nothing to do? */ + mtctr r8 +diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S +index 07bfe33fe874..81757f06bbd7 100644 +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -186,12 +186,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + cror cr0*4+eq,cr0*4+eq,cr1*4+eq + bne cr0,99f + ++ mflr r12 ++ .cfi_register lr,r12 ++ bl V_LOCAL_FUNC(__get_datapage) ++ lwz r5, CLOCK_HRTIMER_RES(r3) ++ mtlr r12 + li r3,0 + cmpldi cr0,r4,0 + crclr cr0*4+so + beqlr +- lis r5,CLOCK_REALTIME_RES@h +- ori r5,r5,CLOCK_REALTIME_RES@l + std r3,TSPC64_TV_SEC(r4) + std r5,TSPC64_TV_NSEC(r4) + blr +diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c +index e04b20625cb9..7ccc5c85c74e 100644 +--- a/arch/powerpc/platforms/powernv/opal-imc.c ++++ b/arch/powerpc/platforms/powernv/opal-imc.c +@@ -285,7 +285,14 @@ static int opal_imc_counters_probe(struct platform_device *pdev) + domain = IMC_DOMAIN_THREAD; + break; + case IMC_TYPE_TRACE: +- domain = IMC_DOMAIN_TRACE; ++ /* ++ * FIXME. Using trace_imc events to monitor application ++ * or KVM thread performance can cause a checkstop ++ * (system crash). ++ * Disable it for now. ++ */ ++ pr_info_once("IMC: disabling trace_imc PMU\n"); ++ domain = -1; + break; + default: + pr_warn("IMC Unknown Device type \n"); +diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c +index df832b09e3e9..f5fadbd2533a 100644 +--- a/arch/powerpc/sysdev/xive/common.c ++++ b/arch/powerpc/sysdev/xive/common.c +@@ -1035,6 +1035,15 @@ static int xive_irq_alloc_data(unsigned int virq, irq_hw_number_t hw) + xd->target = XIVE_INVALID_TARGET; + irq_set_handler_data(virq, xd); + ++ /* ++ * Turn OFF by default the interrupt being mapped. A side ++ * effect of this check is the mapping the ESB page of the ++ * interrupt in the Linux address space. This prevents page ++ * fault issues in the crash handler which masks all ++ * interrupts. ++ */ ++ xive_esb_read(xd, XIVE_ESB_SET_PQ_01); ++ + return 0; + } + +diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c +index 33c10749edec..55dc61cb4867 100644 +--- a/arch/powerpc/sysdev/xive/spapr.c ++++ b/arch/powerpc/sysdev/xive/spapr.c +@@ -392,20 +392,28 @@ static int xive_spapr_populate_irq_data(u32 hw_irq, struct xive_irq_data *data) + data->esb_shift = esb_shift; + data->trig_page = trig_page; + ++ data->hw_irq = hw_irq; ++ + /* + * No chip-id for the sPAPR backend. This has an impact how we + * pick a target. See xive_pick_irq_target(). + */ + data->src_chip = XIVE_INVALID_CHIP_ID; + ++ /* ++ * When the H_INT_ESB flag is set, the H_INT_ESB hcall should ++ * be used for interrupt management. Skip the remapping of the ++ * ESB pages which are not available. ++ */ ++ if (data->flags & XIVE_IRQ_FLAG_H_INT_ESB) ++ return 0; ++ + data->eoi_mmio = ioremap(data->eoi_page, 1u << data->esb_shift); + if (!data->eoi_mmio) { + pr_err("Failed to map EOI page for irq 0x%x\n", hw_irq); + return -ENOMEM; + } + +- data->hw_irq = hw_irq; +- + /* Full function page supports trigger */ + if (flags & XIVE_SRC_TRIGGER) { + data->trig_mmio = data->eoi_mmio; +diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile +index f142570ad860..c3842dbeb1b7 100644 +--- a/arch/powerpc/xmon/Makefile ++++ b/arch/powerpc/xmon/Makefile +@@ -1,8 +1,8 @@ + # SPDX-License-Identifier: GPL-2.0 + # Makefile for xmon + +-# Disable clang warning for using setjmp without setjmp.h header +-subdir-ccflags-y := $(call cc-disable-warning, builtin-requires-header) ++# Avoid clang warnings around longjmp/setjmp declarations ++subdir-ccflags-y := -ffreestanding + + GCOV_PROFILE := n + KCOV_INSTRUMENT := n +diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c +index 5367950510f6..fa0150285d38 100644 +--- a/arch/s390/boot/startup.c ++++ b/arch/s390/boot/startup.c +@@ -170,6 +170,11 @@ void startup_kernel(void) + handle_relocs(__kaslr_offset); + + if (__kaslr_offset) { ++ /* ++ * Save KASLR offset for early dumps, before vmcore_info is set. ++ * Mark as uneven to distinguish from real vmcore_info pointer. ++ */ ++ S390_lowcore.vmcore_info = __kaslr_offset | 0x1UL; + /* Clear non-relocated kernel */ + if (IS_ENABLED(CONFIG_KERNEL_UNCOMPRESSED)) + memset(img, 0, vmlinux.image_size); +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index 5ff98d76a66c..a9e46b83c536 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -1173,8 +1173,6 @@ void gmap_pmdp_idte_global(struct mm_struct *mm, unsigned long vmaddr); + static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, + pte_t *ptep, pte_t entry) + { +- if (!MACHINE_HAS_NX) +- pte_val(entry) &= ~_PAGE_NOEXEC; + if (pte_present(entry)) + pte_val(entry) &= ~_PAGE_UNUSED; + if (mm_has_pgste(mm)) +@@ -1191,6 +1189,8 @@ static inline pte_t mk_pte_phys(unsigned long physpage, pgprot_t pgprot) + { + pte_t __pte; + pte_val(__pte) = physpage + pgprot_val(pgprot); ++ if (!MACHINE_HAS_NX) ++ pte_val(__pte) &= ~_PAGE_NOEXEC; + return pte_mkyoung(__pte); + } + +diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c +index 444a19125a81..d402ced7f7c3 100644 +--- a/arch/s390/kernel/machine_kexec.c ++++ b/arch/s390/kernel/machine_kexec.c +@@ -254,10 +254,10 @@ void arch_crash_save_vmcoreinfo(void) + VMCOREINFO_SYMBOL(lowcore_ptr); + VMCOREINFO_SYMBOL(high_memory); + VMCOREINFO_LENGTH(lowcore_ptr, NR_CPUS); +- mem_assign_absolute(S390_lowcore.vmcore_info, paddr_vmcoreinfo_note()); + vmcoreinfo_append_str("SDMA=%lx\n", __sdma); + vmcoreinfo_append_str("EDMA=%lx\n", __edma); + vmcoreinfo_append_str("KERNELOFFSET=%lx\n", kaslr_offset()); ++ mem_assign_absolute(S390_lowcore.vmcore_info, paddr_vmcoreinfo_note()); + } + + void machine_shutdown(void) +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 44974654cbd0..d95c85780e07 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -262,10 +262,13 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu) + lc->spinlock_index = 0; + lc->percpu_offset = __per_cpu_offset[cpu]; + lc->kernel_asce = S390_lowcore.kernel_asce; ++ lc->user_asce = S390_lowcore.kernel_asce; + lc->machine_flags = S390_lowcore.machine_flags; + lc->user_timer = lc->system_timer = + lc->steal_timer = lc->avg_steal_timer = 0; + __ctl_store(lc->cregs_save_area, 0, 15); ++ lc->cregs_save_area[1] = lc->kernel_asce; ++ lc->cregs_save_area[7] = lc->vdso_asce; + save_access_regs((unsigned int *) lc->access_regs_save_area); + memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list, + sizeof(lc->stfle_fac_list)); +@@ -816,6 +819,8 @@ static void smp_init_secondary(void) + + S390_lowcore.last_update_clock = get_tod_clock(); + restore_access_regs(S390_lowcore.access_regs_save_area); ++ set_cpu_flag(CIF_ASCE_PRIMARY); ++ set_cpu_flag(CIF_ASCE_SECONDARY); + cpu_init(); + preempt_disable(); + init_cpu_timer(); +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index a0d3ce30fa08..a09ab0c3d074 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -166,20 +166,25 @@ static ssize_t blk_mq_hw_sysfs_nr_reserved_tags_show(struct blk_mq_hw_ctx *hctx, + + static ssize_t blk_mq_hw_sysfs_cpus_show(struct blk_mq_hw_ctx *hctx, char *page) + { ++ const size_t size = PAGE_SIZE - 1; + unsigned int i, first = 1; +- ssize_t ret = 0; ++ int ret = 0, pos = 0; + + for_each_cpu(i, hctx->cpumask) { + if (first) +- ret += sprintf(ret + page, "%u", i); ++ ret = snprintf(pos + page, size - pos, "%u", i); + else +- ret += sprintf(ret + page, ", %u", i); ++ ret = snprintf(pos + page, size - pos, ", %u", i); ++ ++ if (ret >= size - pos) ++ break; + + first = 0; ++ pos += ret; + } + +- ret += sprintf(ret + page, "\n"); +- return ret; ++ ret = snprintf(pos + page, size + 1 - pos, "\n"); ++ return pos + ret; + } + + static struct blk_mq_hw_ctx_sysfs_entry blk_mq_hw_sysfs_nr_tags = { +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 60bbc5090abe..751ed38f2a10 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -463,6 +464,18 @@ struct lpss_device_links { + const char *consumer_hid; + const char *consumer_uid; + u32 flags; ++ const struct dmi_system_id *dep_missing_ids; ++}; ++ ++/* Please keep this list sorted alphabetically by vendor and model */ ++static const struct dmi_system_id i2c1_dep_missing_dmi_ids[] = { ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "T200TA"), ++ }, ++ }, ++ {} + }; + + /* +@@ -473,9 +486,17 @@ struct lpss_device_links { + * the supplier is not enumerated until after the consumer is probed. + */ + static const struct lpss_device_links lpss_device_links[] = { ++ /* CHT External sdcard slot controller depends on PMIC I2C ctrl */ + {"808622C1", "7", "80860F14", "3", DL_FLAG_PM_RUNTIME}, ++ /* CHT iGPU depends on PMIC I2C controller */ + {"808622C1", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, ++ /* BYT iGPU depends on the Embedded Controller I2C controller (UID 1) */ ++ {"80860F41", "1", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME, ++ i2c1_dep_missing_dmi_ids}, ++ /* BYT CR iGPU depends on PMIC I2C controller (UID 5 on CR) */ + {"80860F41", "5", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, ++ /* BYT iGPU depends on PMIC I2C controller (UID 7 on non CR) */ ++ {"80860F41", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + }; + + static bool hid_uid_match(struct acpi_device *adev, +@@ -570,7 +591,8 @@ static void acpi_lpss_link_consumer(struct device *dev1, + if (!dev2) + return; + +- if (acpi_lpss_dep(ACPI_COMPANION(dev2), ACPI_HANDLE(dev1))) ++ if ((link->dep_missing_ids && dmi_check_system(link->dep_missing_ids)) ++ || acpi_lpss_dep(ACPI_COMPANION(dev2), ACPI_HANDLE(dev1))) + device_link_add(dev2, dev1, link->flags); + + put_device(dev2); +@@ -585,7 +607,8 @@ static void acpi_lpss_link_supplier(struct device *dev1, + if (!dev2) + return; + +- if (acpi_lpss_dep(ACPI_COMPANION(dev1), ACPI_HANDLE(dev2))) ++ if ((link->dep_missing_ids && dmi_check_system(link->dep_missing_ids)) ++ || acpi_lpss_dep(ACPI_COMPANION(dev1), ACPI_HANDLE(dev2))) + device_link_add(dev1, dev2, link->flags); + + put_device(dev2); +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index 48bc96d45bab..54002670cb7a 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -153,7 +153,7 @@ int acpi_bus_get_private_data(acpi_handle handle, void **data) + { + acpi_status status; + +- if (!*data) ++ if (!data) + return -EINVAL; + + status = acpi_get_data(handle, acpi_bus_private_data_handler, data); +diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c +index 08bb9f2f2d23..5e4a8860a9c0 100644 +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -1314,9 +1314,19 @@ static void acpi_dev_pm_detach(struct device *dev, bool power_off) + */ + int acpi_dev_pm_attach(struct device *dev, bool power_on) + { ++ /* ++ * Skip devices whose ACPI companions match the device IDs below, ++ * because they require special power management handling incompatible ++ * with the generic ACPI PM domain. ++ */ ++ static const struct acpi_device_id special_pm_ids[] = { ++ {"PNP0C0B", }, /* Generic ACPI fan */ ++ {"INT3404", }, /* Fan */ ++ {} ++ }; + struct acpi_device *adev = ACPI_COMPANION(dev); + +- if (!adev) ++ if (!adev || !acpi_match_device_ids(adev, special_pm_ids)) + return 0; + + /* +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index da1e5c5ce150..bd75caff8322 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -525,26 +525,10 @@ static void acpi_ec_enable_event(struct acpi_ec *ec) + } + + #ifdef CONFIG_PM_SLEEP +-static bool acpi_ec_query_flushed(struct acpi_ec *ec) ++static void __acpi_ec_flush_work(void) + { +- bool flushed; +- unsigned long flags; +- +- spin_lock_irqsave(&ec->lock, flags); +- flushed = !ec->nr_pending_queries; +- spin_unlock_irqrestore(&ec->lock, flags); +- return flushed; +-} +- +-static void __acpi_ec_flush_event(struct acpi_ec *ec) +-{ +- /* +- * When ec_freeze_events is true, we need to flush events in +- * the proper position before entering the noirq stage. +- */ +- wait_event(ec->wait, acpi_ec_query_flushed(ec)); +- if (ec_query_wq) +- flush_workqueue(ec_query_wq); ++ flush_scheduled_work(); /* flush ec->work */ ++ flush_workqueue(ec_query_wq); /* flush queries */ + } + + static void acpi_ec_disable_event(struct acpi_ec *ec) +@@ -554,15 +538,21 @@ static void acpi_ec_disable_event(struct acpi_ec *ec) + spin_lock_irqsave(&ec->lock, flags); + __acpi_ec_disable_event(ec); + spin_unlock_irqrestore(&ec->lock, flags); +- __acpi_ec_flush_event(ec); ++ ++ /* ++ * When ec_freeze_events is true, we need to flush events in ++ * the proper position before entering the noirq stage. ++ */ ++ __acpi_ec_flush_work(); + } + + void acpi_ec_flush_work(void) + { +- if (first_ec) +- __acpi_ec_flush_event(first_ec); ++ /* Without ec_query_wq there is nothing to flush. */ ++ if (!ec_query_wq) ++ return; + +- flush_scheduled_work(); ++ __acpi_ec_flush_work(); + } + #endif /* CONFIG_PM_SLEEP */ + +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index a2e844a8e9ed..41168c027a5a 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -374,19 +374,21 @@ void *__ref acpi_os_map_memory(acpi_physical_address phys, acpi_size size) + } + EXPORT_SYMBOL_GPL(acpi_os_map_memory); + +-static void acpi_os_drop_map_ref(struct acpi_ioremap *map) ++/* Must be called with mutex_lock(&acpi_ioremap_lock) */ ++static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map) + { +- if (!--map->refcount) ++ unsigned long refcount = --map->refcount; ++ ++ if (!refcount) + list_del_rcu(&map->list); ++ return refcount; + } + + static void acpi_os_map_cleanup(struct acpi_ioremap *map) + { +- if (!map->refcount) { +- synchronize_rcu_expedited(); +- acpi_unmap(map->phys, map->virt); +- kfree(map); +- } ++ synchronize_rcu_expedited(); ++ acpi_unmap(map->phys, map->virt); ++ kfree(map); + } + + /** +@@ -406,6 +408,7 @@ static void acpi_os_map_cleanup(struct acpi_ioremap *map) + void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) + { + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (!acpi_permanent_mmap) { + __acpi_unmap_table(virt, size); +@@ -419,10 +422,11 @@ void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) + WARN(true, PREFIX "%s: bad address %p\n", __func__, virt); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem); + +@@ -457,6 +461,7 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) + { + u64 addr; + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY) + return; +@@ -472,10 +477,11 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) + mutex_unlock(&acpi_ioremap_lock); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL(acpi_os_unmap_generic_address); + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 265d9dd46a5e..976a69420c16 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -3314,7 +3314,7 @@ static void binder_transaction(struct binder_proc *proc, + binder_size_t parent_offset; + struct binder_fd_array_object *fda = + to_binder_fd_array_object(hdr); +- size_t num_valid = (buffer_offset - off_start_offset) * ++ size_t num_valid = (buffer_offset - off_start_offset) / + sizeof(binder_size_t); + struct binder_buffer_object *parent = + binder_validate_ptr(target_proc, t->buffer, +@@ -3388,7 +3388,7 @@ static void binder_transaction(struct binder_proc *proc, + t->buffer->user_data + sg_buf_offset; + sg_buf_offset += ALIGN(bp->length, sizeof(u64)); + +- num_valid = (buffer_offset - off_start_offset) * ++ num_valid = (buffer_offset - off_start_offset) / + sizeof(binder_size_t); + ret = binder_fixup_parent(t, thread, bp, + off_start_offset, +diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c +index b27f39688b5e..e329f82c0467 100644 +--- a/drivers/char/hw_random/omap-rng.c ++++ b/drivers/char/hw_random/omap-rng.c +@@ -66,6 +66,13 @@ + #define OMAP4_RNG_OUTPUT_SIZE 0x8 + #define EIP76_RNG_OUTPUT_SIZE 0x10 + ++/* ++ * EIP76 RNG takes approx. 700us to produce 16 bytes of output data ++ * as per testing results. And to account for the lack of udelay()'s ++ * reliability, we keep the timeout as 1000us. ++ */ ++#define RNG_DATA_FILL_TIMEOUT 100 ++ + enum { + RNG_OUTPUT_0_REG = 0, + RNG_OUTPUT_1_REG, +@@ -176,7 +183,7 @@ static int omap_rng_do_read(struct hwrng *rng, void *data, size_t max, + if (max < priv->pdata->data_size) + return 0; + +- for (i = 0; i < 20; i++) { ++ for (i = 0; i < RNG_DATA_FILL_TIMEOUT; i++) { + present = priv->pdata->data_present(priv); + if (present || !wait) + break; +diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c +index c86f18aa8985..34bb88fe0b0a 100644 +--- a/drivers/char/ppdev.c ++++ b/drivers/char/ppdev.c +@@ -619,20 +619,27 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + if (copy_from_user(time32, argp, sizeof(time32))) + return -EFAULT; + ++ if ((time32[0] < 0) || (time32[1] < 0)) ++ return -EINVAL; ++ + return pp_set_timeout(pp->pdev, time32[0], time32[1]); + + case PPSETTIME64: + if (copy_from_user(time64, argp, sizeof(time64))) + return -EFAULT; + ++ if ((time64[0] < 0) || (time64[1] < 0)) ++ return -EINVAL; ++ ++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) ++ time64[1] >>= 32; ++ + return pp_set_timeout(pp->pdev, time64[0], time64[1]); + + case PPGETTIME32: + jiffies_to_timespec64(pp->pdev->timeout, &ts); + time32[0] = ts.tv_sec; + time32[1] = ts.tv_nsec / NSEC_PER_USEC; +- if ((time32[0] < 0) || (time32[1] < 0)) +- return -EINVAL; + + if (copy_to_user(argp, time32, sizeof(time32))) + return -EFAULT; +@@ -643,8 +650,9 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + jiffies_to_timespec64(pp->pdev->timeout, &ts); + time64[0] = ts.tv_sec; + time64[1] = ts.tv_nsec / NSEC_PER_USEC; +- if ((time64[0] < 0) || (time64[1] < 0)) +- return -EINVAL; ++ ++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) ++ time64[1] <<= 32; + + if (copy_to_user(argp, time64, sizeof(time64))) + return -EFAULT; +diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c +index ba9acae83bff..5817dfe5c5d2 100644 +--- a/drivers/char/tpm/tpm2-cmd.c ++++ b/drivers/char/tpm/tpm2-cmd.c +@@ -939,6 +939,10 @@ static int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip) + + chip->cc_attrs_tbl = devm_kcalloc(&chip->dev, 4, nr_commands, + GFP_KERNEL); ++ if (!chip->cc_attrs_tbl) { ++ rc = -ENOMEM; ++ goto out; ++ } + + rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY); + if (rc) +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index e4fdde93ed4c..e7df342a317d 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -286,7 +286,7 @@ static int tpm_tis_plat_probe(struct platform_device *pdev) + } + tpm_info.res = *res; + +- tpm_info.irq = platform_get_irq(pdev, 0); ++ tpm_info.irq = platform_get_irq_optional(pdev, 0); + if (tpm_info.irq <= 0) { + if (pdev != force_pdev) + tpm_info.irq = -1; +diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c +index 6061850e59c9..56f4bc0d209e 100644 +--- a/drivers/cpufreq/powernv-cpufreq.c ++++ b/drivers/cpufreq/powernv-cpufreq.c +@@ -1041,9 +1041,14 @@ static struct cpufreq_driver powernv_cpufreq_driver = { + + static int init_chip_info(void) + { +- unsigned int chip[256]; ++ unsigned int *chip; + unsigned int cpu, i; + unsigned int prev_chip_id = UINT_MAX; ++ int ret = 0; ++ ++ chip = kcalloc(num_possible_cpus(), sizeof(*chip), GFP_KERNEL); ++ if (!chip) ++ return -ENOMEM; + + for_each_possible_cpu(cpu) { + unsigned int id = cpu_to_chip_id(cpu); +@@ -1055,8 +1060,10 @@ static int init_chip_info(void) + } + + chips = kcalloc(nr_chips, sizeof(struct chip), GFP_KERNEL); +- if (!chips) +- return -ENOMEM; ++ if (!chips) { ++ ret = -ENOMEM; ++ goto free_and_return; ++ } + + for (i = 0; i < nr_chips; i++) { + chips[i].id = chip[i]; +@@ -1066,7 +1073,9 @@ static int init_chip_info(void) + per_cpu(chip_info, cpu) = &chips[i]; + } + +- return 0; ++free_and_return: ++ kfree(chip); ++ return ret; + } + + static inline void clean_chip_info(void) +diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c +index 0895b988fa92..29d2d7a21bd7 100644 +--- a/drivers/cpuidle/cpuidle.c ++++ b/drivers/cpuidle/cpuidle.c +@@ -384,6 +384,7 @@ u64 cpuidle_poll_time(struct cpuidle_driver *drv, + continue; + + limit_ns = (u64)drv->states[i].target_residency * NSEC_PER_USEC; ++ break; + } + + dev->poll_limit_ns = limit_ns; +diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c +index 80c1a830d991..9db154224999 100644 +--- a/drivers/cpuidle/driver.c ++++ b/drivers/cpuidle/driver.c +@@ -62,24 +62,23 @@ static inline void __cpuidle_unset_driver(struct cpuidle_driver *drv) + * __cpuidle_set_driver - set per CPU driver variables for the given driver. + * @drv: a valid pointer to a struct cpuidle_driver + * +- * For each CPU in the driver's cpumask, unset the registered driver per CPU +- * to @drv. +- * +- * Returns 0 on success, -EBUSY if the CPUs have driver(s) already. ++ * Returns 0 on success, -EBUSY if any CPU in the cpumask have a driver ++ * different from drv already. + */ + static inline int __cpuidle_set_driver(struct cpuidle_driver *drv) + { + int cpu; + + for_each_cpu(cpu, drv->cpumask) { ++ struct cpuidle_driver *old_drv; + +- if (__cpuidle_get_cpu_driver(cpu)) { +- __cpuidle_unset_driver(drv); ++ old_drv = __cpuidle_get_cpu_driver(cpu); ++ if (old_drv && old_drv != drv) + return -EBUSY; +- } ++ } + ++ for_each_cpu(cpu, drv->cpumask) + per_cpu(cpuidle_drivers, cpu) = drv; +- } + + return 0; + } +diff --git a/drivers/cpuidle/governors/teo.c b/drivers/cpuidle/governors/teo.c +index b5a0e498f798..b9b9156618e6 100644 +--- a/drivers/cpuidle/governors/teo.c ++++ b/drivers/cpuidle/governors/teo.c +@@ -233,7 +233,7 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + { + struct teo_cpu *cpu_data = per_cpu_ptr(&teo_cpus, dev->cpu); + int latency_req = cpuidle_governor_latency_req(dev->cpu); +- unsigned int duration_us, count; ++ unsigned int duration_us, hits, misses, early_hits; + int max_early_idx, constraint_idx, idx, i; + ktime_t delta_tick; + +@@ -247,7 +247,9 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + cpu_data->sleep_length_ns = tick_nohz_get_sleep_length(&delta_tick); + duration_us = ktime_to_us(cpu_data->sleep_length_ns); + +- count = 0; ++ hits = 0; ++ misses = 0; ++ early_hits = 0; + max_early_idx = -1; + constraint_idx = drv->state_count; + idx = -1; +@@ -258,23 +260,61 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + + if (s->disabled || su->disable) { + /* +- * If the "early hits" metric of a disabled state is +- * greater than the current maximum, it should be taken +- * into account, because it would be a mistake to select +- * a deeper state with lower "early hits" metric. The +- * index cannot be changed to point to it, however, so +- * just increase the max count alone and let the index +- * still point to a shallower idle state. ++ * Ignore disabled states with target residencies beyond ++ * the anticipated idle duration. + */ +- if (max_early_idx >= 0 && +- count < cpu_data->states[i].early_hits) +- count = cpu_data->states[i].early_hits; ++ if (s->target_residency > duration_us) ++ continue; ++ ++ /* ++ * This state is disabled, so the range of idle duration ++ * values corresponding to it is covered by the current ++ * candidate state, but still the "hits" and "misses" ++ * metrics of the disabled state need to be used to ++ * decide whether or not the state covering the range in ++ * question is good enough. ++ */ ++ hits = cpu_data->states[i].hits; ++ misses = cpu_data->states[i].misses; ++ ++ if (early_hits >= cpu_data->states[i].early_hits || ++ idx < 0) ++ continue; ++ ++ /* ++ * If the current candidate state has been the one with ++ * the maximum "early hits" metric so far, the "early ++ * hits" metric of the disabled state replaces the ++ * current "early hits" count to avoid selecting a ++ * deeper state with lower "early hits" metric. ++ */ ++ if (max_early_idx == idx) { ++ early_hits = cpu_data->states[i].early_hits; ++ continue; ++ } ++ ++ /* ++ * The current candidate state is closer to the disabled ++ * one than the current maximum "early hits" state, so ++ * replace the latter with it, but in case the maximum ++ * "early hits" state index has not been set so far, ++ * check if the current candidate state is not too ++ * shallow for that role. ++ */ ++ if (!(tick_nohz_tick_stopped() && ++ drv->states[idx].target_residency < TICK_USEC)) { ++ early_hits = cpu_data->states[i].early_hits; ++ max_early_idx = idx; ++ } + + continue; + } + +- if (idx < 0) ++ if (idx < 0) { + idx = i; /* first enabled state */ ++ hits = cpu_data->states[i].hits; ++ misses = cpu_data->states[i].misses; ++ } + + if (s->target_residency > duration_us) + break; +@@ -283,11 +323,13 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + constraint_idx = i; + + idx = i; ++ hits = cpu_data->states[i].hits; ++ misses = cpu_data->states[i].misses; + +- if (count < cpu_data->states[i].early_hits && ++ if (early_hits < cpu_data->states[i].early_hits && + !(tick_nohz_tick_stopped() && + drv->states[i].target_residency < TICK_USEC)) { +- count = cpu_data->states[i].early_hits; ++ early_hits = cpu_data->states[i].early_hits; + max_early_idx = i; + } + } +@@ -300,8 +342,7 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + * "early hits" metric, but if that cannot be determined, just use the + * state selected so far. + */ +- if (cpu_data->states[idx].hits <= cpu_data->states[idx].misses && +- max_early_idx >= 0) { ++ if (hits <= misses && max_early_idx >= 0) { + idx = max_early_idx; + duration_us = drv->states[idx].target_residency; + } +@@ -316,10 +357,9 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + if (idx < 0) { + idx = 0; /* No states enabled. Must use 0. */ + } else if (idx > 0) { ++ unsigned int count = 0; + u64 sum = 0; + +- count = 0; +- + /* + * Count and sum the most recent idle duration values less than + * the current expected idle duration value. +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 446490c9d635..3a1484e7a3ae 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -160,6 +160,7 @@ int devfreq_update_status(struct devfreq *devfreq, unsigned long freq) + int lev, prev_lev, ret = 0; + unsigned long cur_time; + ++ lockdep_assert_held(&devfreq->lock); + cur_time = jiffies; + + /* Immediately exit if previous_freq is not initialized yet. */ +@@ -1397,12 +1398,17 @@ static ssize_t trans_stat_show(struct device *dev, + int i, j; + unsigned int max_state = devfreq->profile->max_state; + +- if (!devfreq->stop_polling && +- devfreq_update_status(devfreq, devfreq->previous_freq)) +- return 0; + if (max_state == 0) + return sprintf(buf, "Not Supported.\n"); + ++ mutex_lock(&devfreq->lock); ++ if (!devfreq->stop_polling && ++ devfreq_update_status(devfreq, devfreq->previous_freq)) { ++ mutex_unlock(&devfreq->lock); ++ return 0; ++ } ++ mutex_unlock(&devfreq->lock); ++ + len = sprintf(buf, " From : To\n"); + len += sprintf(buf + len, " :"); + for (i = 0; i < max_state; i++) +diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c +index fbda4b876afd..0be3d1b17f03 100644 +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -560,6 +560,7 @@ static const struct regmap_config s10_sdram_regmap_cfg = { + .reg_write = s10_protected_reg_write, + .use_single_read = true, + .use_single_write = true, ++ .fast_io = true, + }; + + /************** ***********/ +diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c +index f6f6a688c009..296e714bf553 100644 +--- a/drivers/edac/ghes_edac.c ++++ b/drivers/edac/ghes_edac.c +@@ -566,8 +566,8 @@ int ghes_edac_register(struct ghes *ghes, struct device *dev) + ghes_pvt = pvt; + spin_unlock_irqrestore(&ghes_lock, flags); + +- /* only increment on success */ +- refcount_inc(&ghes_refcount); ++ /* only set on success */ ++ refcount_set(&ghes_refcount, 1); + + unlock: + mutex_unlock(&ghes_reg_mutex); +diff --git a/drivers/firmware/qcom_scm-64.c b/drivers/firmware/qcom_scm-64.c +index 91d5ad7cf58b..25e0f60c759a 100644 +--- a/drivers/firmware/qcom_scm-64.c ++++ b/drivers/firmware/qcom_scm-64.c +@@ -150,7 +150,7 @@ static int qcom_scm_call(struct device *dev, u32 svc_id, u32 cmd_id, + kfree(args_virt); + } + +- if (res->a0 < 0) ++ if ((long)res->a0 < 0) + return qcom_scm_remap_error(res->a0); + + return 0; +diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c +index f21bc8a7ee3a..bdf91b75328e 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_drv.c ++++ b/drivers/gpu/drm/panfrost/panfrost_drv.c +@@ -443,7 +443,7 @@ panfrost_postclose(struct drm_device *dev, struct drm_file *file) + { + struct panfrost_file_priv *panfrost_priv = file->driver_priv; + +- panfrost_perfcnt_close(panfrost_priv); ++ panfrost_perfcnt_close(file); + panfrost_job_close(panfrost_priv); + + panfrost_mmu_pgtable_free(panfrost_priv); +diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.c b/drivers/gpu/drm/panfrost/panfrost_gem.c +index acb07fe06580..bc3ff22e5e85 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gem.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c +@@ -41,7 +41,7 @@ static void panfrost_gem_free_object(struct drm_gem_object *obj) + drm_gem_shmem_free_object(obj); + } + +-static int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv) ++int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv) + { + int ret; + size_t size = obj->size; +@@ -80,7 +80,7 @@ static int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_p + return ret; + } + +-static void panfrost_gem_close(struct drm_gem_object *obj, struct drm_file *file_priv) ++void panfrost_gem_close(struct drm_gem_object *obj, struct drm_file *file_priv) + { + struct panfrost_gem_object *bo = to_panfrost_bo(obj); + struct panfrost_file_priv *priv = file_priv->driver_priv; +diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.h b/drivers/gpu/drm/panfrost/panfrost_gem.h +index 50920819cc16..4b17e7308764 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gem.h ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.h +@@ -45,6 +45,10 @@ panfrost_gem_create_with_handle(struct drm_file *file_priv, + u32 flags, + uint32_t *handle); + ++int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv); ++void panfrost_gem_close(struct drm_gem_object *obj, ++ struct drm_file *file_priv); ++ + void panfrost_gem_shrinker_init(struct drm_device *dev); + void panfrost_gem_shrinker_cleanup(struct drm_device *dev); + +diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c +index 2dba192bf198..2c04e858c50a 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c ++++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c +@@ -67,9 +67,10 @@ static int panfrost_perfcnt_dump_locked(struct panfrost_device *pfdev) + } + + static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev, +- struct panfrost_file_priv *user, ++ struct drm_file *file_priv, + unsigned int counterset) + { ++ struct panfrost_file_priv *user = file_priv->driver_priv; + struct panfrost_perfcnt *perfcnt = pfdev->perfcnt; + struct drm_gem_shmem_object *bo; + u32 cfg; +@@ -91,14 +92,14 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev, + perfcnt->bo = to_panfrost_bo(&bo->base); + + /* Map the perfcnt buf in the address space attached to file_priv. */ +- ret = panfrost_mmu_map(perfcnt->bo); ++ ret = panfrost_gem_open(&perfcnt->bo->base.base, file_priv); + if (ret) + goto err_put_bo; + + perfcnt->buf = drm_gem_shmem_vmap(&bo->base); + if (IS_ERR(perfcnt->buf)) { + ret = PTR_ERR(perfcnt->buf); +- goto err_put_bo; ++ goto err_close_bo; + } + + /* +@@ -157,14 +158,17 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev, + + err_vunmap: + drm_gem_shmem_vunmap(&perfcnt->bo->base.base, perfcnt->buf); ++err_close_bo: ++ panfrost_gem_close(&perfcnt->bo->base.base, file_priv); + err_put_bo: + drm_gem_object_put_unlocked(&bo->base); + return ret; + } + + static int panfrost_perfcnt_disable_locked(struct panfrost_device *pfdev, +- struct panfrost_file_priv *user) ++ struct drm_file *file_priv) + { ++ struct panfrost_file_priv *user = file_priv->driver_priv; + struct panfrost_perfcnt *perfcnt = pfdev->perfcnt; + + if (user != perfcnt->user) +@@ -180,6 +184,7 @@ static int panfrost_perfcnt_disable_locked(struct panfrost_device *pfdev, + perfcnt->user = NULL; + drm_gem_shmem_vunmap(&perfcnt->bo->base.base, perfcnt->buf); + perfcnt->buf = NULL; ++ panfrost_gem_close(&perfcnt->bo->base.base, file_priv); + drm_gem_object_put_unlocked(&perfcnt->bo->base.base); + perfcnt->bo = NULL; + pm_runtime_mark_last_busy(pfdev->dev); +@@ -191,7 +196,6 @@ static int panfrost_perfcnt_disable_locked(struct panfrost_device *pfdev, + int panfrost_ioctl_perfcnt_enable(struct drm_device *dev, void *data, + struct drm_file *file_priv) + { +- struct panfrost_file_priv *pfile = file_priv->driver_priv; + struct panfrost_device *pfdev = dev->dev_private; + struct panfrost_perfcnt *perfcnt = pfdev->perfcnt; + struct drm_panfrost_perfcnt_enable *req = data; +@@ -207,10 +211,10 @@ int panfrost_ioctl_perfcnt_enable(struct drm_device *dev, void *data, + + mutex_lock(&perfcnt->lock); + if (req->enable) +- ret = panfrost_perfcnt_enable_locked(pfdev, pfile, ++ ret = panfrost_perfcnt_enable_locked(pfdev, file_priv, + req->counterset); + else +- ret = panfrost_perfcnt_disable_locked(pfdev, pfile); ++ ret = panfrost_perfcnt_disable_locked(pfdev, file_priv); + mutex_unlock(&perfcnt->lock); + + return ret; +@@ -248,15 +252,16 @@ out: + return ret; + } + +-void panfrost_perfcnt_close(struct panfrost_file_priv *pfile) ++void panfrost_perfcnt_close(struct drm_file *file_priv) + { ++ struct panfrost_file_priv *pfile = file_priv->driver_priv; + struct panfrost_device *pfdev = pfile->pfdev; + struct panfrost_perfcnt *perfcnt = pfdev->perfcnt; + + pm_runtime_get_sync(pfdev->dev); + mutex_lock(&perfcnt->lock); + if (perfcnt->user == pfile) +- panfrost_perfcnt_disable_locked(pfdev, pfile); ++ panfrost_perfcnt_disable_locked(pfdev, file_priv); + mutex_unlock(&perfcnt->lock); + pm_runtime_mark_last_busy(pfdev->dev); + pm_runtime_put_autosuspend(pfdev->dev); +diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.h b/drivers/gpu/drm/panfrost/panfrost_perfcnt.h +index 13b8fdaa1b43..8bbcf5f5fb33 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.h ++++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.h +@@ -9,7 +9,7 @@ void panfrost_perfcnt_sample_done(struct panfrost_device *pfdev); + void panfrost_perfcnt_clean_cache_done(struct panfrost_device *pfdev); + int panfrost_perfcnt_init(struct panfrost_device *pfdev); + void panfrost_perfcnt_fini(struct panfrost_device *pfdev); +-void panfrost_perfcnt_close(struct panfrost_file_priv *pfile); ++void panfrost_perfcnt_close(struct drm_file *file_priv); + int panfrost_ioctl_perfcnt_enable(struct drm_device *dev, void *data, + struct drm_file *file_priv); + int panfrost_ioctl_perfcnt_dump(struct drm_device *dev, void *data, +diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c +index 05f7896c3a01..b605889b507a 100644 +--- a/drivers/hwtracing/coresight/coresight-funnel.c ++++ b/drivers/hwtracing/coresight/coresight-funnel.c +@@ -38,12 +38,14 @@ DEFINE_CORESIGHT_DEVLIST(funnel_devs, "funnel"); + * @atclk: optional clock for the core parts of the funnel. + * @csdev: component vitals needed by the framework. + * @priority: port selection order. ++ * @spinlock: serialize enable/disable operations. + */ + struct funnel_drvdata { + void __iomem *base; + struct clk *atclk; + struct coresight_device *csdev; + unsigned long priority; ++ spinlock_t spinlock; + }; + + static int dynamic_funnel_enable_hw(struct funnel_drvdata *drvdata, int port) +@@ -76,11 +78,21 @@ static int funnel_enable(struct coresight_device *csdev, int inport, + { + int rc = 0; + struct funnel_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); +- +- if (drvdata->base) +- rc = dynamic_funnel_enable_hw(drvdata, inport); +- ++ unsigned long flags; ++ bool first_enable = false; ++ ++ spin_lock_irqsave(&drvdata->spinlock, flags); ++ if (atomic_read(&csdev->refcnt[inport]) == 0) { ++ if (drvdata->base) ++ rc = dynamic_funnel_enable_hw(drvdata, inport); ++ if (!rc) ++ first_enable = true; ++ } + if (!rc) ++ atomic_inc(&csdev->refcnt[inport]); ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); ++ ++ if (first_enable) + dev_dbg(&csdev->dev, "FUNNEL inport %d enabled\n", inport); + return rc; + } +@@ -107,11 +119,19 @@ static void funnel_disable(struct coresight_device *csdev, int inport, + int outport) + { + struct funnel_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ unsigned long flags; ++ bool last_disable = false; ++ ++ spin_lock_irqsave(&drvdata->spinlock, flags); ++ if (atomic_dec_return(&csdev->refcnt[inport]) == 0) { ++ if (drvdata->base) ++ dynamic_funnel_disable_hw(drvdata, inport); ++ last_disable = true; ++ } ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); + +- if (drvdata->base) +- dynamic_funnel_disable_hw(drvdata, inport); +- +- dev_dbg(&csdev->dev, "FUNNEL inport %d disabled\n", inport); ++ if (last_disable) ++ dev_dbg(&csdev->dev, "FUNNEL inport %d disabled\n", inport); + } + + static const struct coresight_ops_link funnel_link_ops = { +diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c +index b29ba640eb25..43304196a1a6 100644 +--- a/drivers/hwtracing/coresight/coresight-replicator.c ++++ b/drivers/hwtracing/coresight/coresight-replicator.c +@@ -31,11 +31,13 @@ DEFINE_CORESIGHT_DEVLIST(replicator_devs, "replicator"); + * whether this one is programmable or not. + * @atclk: optional clock for the core parts of the replicator. + * @csdev: component vitals needed by the framework ++ * @spinlock: serialize enable/disable operations. + */ + struct replicator_drvdata { + void __iomem *base; + struct clk *atclk; + struct coresight_device *csdev; ++ spinlock_t spinlock; + }; + + static void dynamic_replicator_reset(struct replicator_drvdata *drvdata) +@@ -97,10 +99,22 @@ static int replicator_enable(struct coresight_device *csdev, int inport, + { + int rc = 0; + struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); +- +- if (drvdata->base) +- rc = dynamic_replicator_enable(drvdata, inport, outport); ++ unsigned long flags; ++ bool first_enable = false; ++ ++ spin_lock_irqsave(&drvdata->spinlock, flags); ++ if (atomic_read(&csdev->refcnt[outport]) == 0) { ++ if (drvdata->base) ++ rc = dynamic_replicator_enable(drvdata, inport, ++ outport); ++ if (!rc) ++ first_enable = true; ++ } + if (!rc) ++ atomic_inc(&csdev->refcnt[outport]); ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); ++ ++ if (first_enable) + dev_dbg(&csdev->dev, "REPLICATOR enabled\n"); + return rc; + } +@@ -137,10 +151,19 @@ static void replicator_disable(struct coresight_device *csdev, int inport, + int outport) + { + struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ unsigned long flags; ++ bool last_disable = false; ++ ++ spin_lock_irqsave(&drvdata->spinlock, flags); ++ if (atomic_dec_return(&csdev->refcnt[outport]) == 0) { ++ if (drvdata->base) ++ dynamic_replicator_disable(drvdata, inport, outport); ++ last_disable = true; ++ } ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); + +- if (drvdata->base) +- dynamic_replicator_disable(drvdata, inport, outport); +- dev_dbg(&csdev->dev, "REPLICATOR disabled\n"); ++ if (last_disable) ++ dev_dbg(&csdev->dev, "REPLICATOR disabled\n"); + } + + static const struct coresight_ops_link replicator_link_ops = { +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c +index 807416b75ecc..d0cc3985b72a 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -334,9 +334,10 @@ static int tmc_disable_etf_sink(struct coresight_device *csdev) + static int tmc_enable_etf_link(struct coresight_device *csdev, + int inport, int outport) + { +- int ret; ++ int ret = 0; + unsigned long flags; + struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ bool first_enable = false; + + spin_lock_irqsave(&drvdata->spinlock, flags); + if (drvdata->reading) { +@@ -344,12 +345,18 @@ static int tmc_enable_etf_link(struct coresight_device *csdev, + return -EBUSY; + } + +- ret = tmc_etf_enable_hw(drvdata); ++ if (atomic_read(&csdev->refcnt[0]) == 0) { ++ ret = tmc_etf_enable_hw(drvdata); ++ if (!ret) { ++ drvdata->mode = CS_MODE_SYSFS; ++ first_enable = true; ++ } ++ } + if (!ret) +- drvdata->mode = CS_MODE_SYSFS; ++ atomic_inc(&csdev->refcnt[0]); + spin_unlock_irqrestore(&drvdata->spinlock, flags); + +- if (!ret) ++ if (first_enable) + dev_dbg(&csdev->dev, "TMC-ETF enabled\n"); + return ret; + } +@@ -359,6 +366,7 @@ static void tmc_disable_etf_link(struct coresight_device *csdev, + { + unsigned long flags; + struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ bool last_disable = false; + + spin_lock_irqsave(&drvdata->spinlock, flags); + if (drvdata->reading) { +@@ -366,11 +374,15 @@ static void tmc_disable_etf_link(struct coresight_device *csdev, + return; + } + +- tmc_etf_disable_hw(drvdata); +- drvdata->mode = CS_MODE_DISABLED; ++ if (atomic_dec_return(&csdev->refcnt[0]) == 0) { ++ tmc_etf_disable_hw(drvdata); ++ drvdata->mode = CS_MODE_DISABLED; ++ last_disable = true; ++ } + spin_unlock_irqrestore(&drvdata->spinlock, flags); + +- dev_dbg(&csdev->dev, "TMC-ETF disabled\n"); ++ if (last_disable) ++ dev_dbg(&csdev->dev, "TMC-ETF disabled\n"); + } + + static void *tmc_alloc_etf_buffer(struct coresight_device *csdev, +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index 6453c67a4d01..0bbce0d29158 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -253,9 +253,9 @@ static int coresight_enable_link(struct coresight_device *csdev, + struct coresight_device *parent, + struct coresight_device *child) + { +- int ret; ++ int ret = 0; + int link_subtype; +- int refport, inport, outport; ++ int inport, outport; + + if (!parent || !child) + return -EINVAL; +@@ -264,29 +264,17 @@ static int coresight_enable_link(struct coresight_device *csdev, + outport = coresight_find_link_outport(csdev, child); + link_subtype = csdev->subtype.link_subtype; + +- if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG) +- refport = inport; +- else if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_SPLIT) +- refport = outport; +- else +- refport = 0; +- +- if (refport < 0) +- return refport; ++ if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG && inport < 0) ++ return inport; ++ if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_SPLIT && outport < 0) ++ return outport; + +- if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { +- if (link_ops(csdev)->enable) { +- ret = link_ops(csdev)->enable(csdev, inport, outport); +- if (ret) { +- atomic_dec(&csdev->refcnt[refport]); +- return ret; +- } +- } +- } +- +- csdev->enable = true; ++ if (link_ops(csdev)->enable) ++ ret = link_ops(csdev)->enable(csdev, inport, outport); ++ if (!ret) ++ csdev->enable = true; + +- return 0; ++ return ret; + } + + static void coresight_disable_link(struct coresight_device *csdev, +@@ -295,7 +283,7 @@ static void coresight_disable_link(struct coresight_device *csdev, + { + int i, nr_conns; + int link_subtype; +- int refport, inport, outport; ++ int inport, outport; + + if (!parent || !child) + return; +@@ -305,20 +293,15 @@ static void coresight_disable_link(struct coresight_device *csdev, + link_subtype = csdev->subtype.link_subtype; + + if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG) { +- refport = inport; + nr_conns = csdev->pdata->nr_inport; + } else if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_SPLIT) { +- refport = outport; + nr_conns = csdev->pdata->nr_outport; + } else { +- refport = 0; + nr_conns = 1; + } + +- if (atomic_dec_return(&csdev->refcnt[refport]) == 0) { +- if (link_ops(csdev)->disable) +- link_ops(csdev)->disable(csdev, inport, outport); +- } ++ if (link_ops(csdev)->disable) ++ link_ops(csdev)->disable(csdev, inport, outport); + + for (i = 0; i < nr_conns; i++) + if (atomic_read(&csdev->refcnt[i]) != 0) +diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c +index d5c1821b31c6..0dfd97bbde9e 100644 +--- a/drivers/hwtracing/intel_th/core.c ++++ b/drivers/hwtracing/intel_th/core.c +@@ -649,10 +649,8 @@ intel_th_subdevice_alloc(struct intel_th *th, + } + + err = intel_th_device_add_resources(thdev, res, subdev->nres); +- if (err) { +- put_device(&thdev->dev); ++ if (err) + goto fail_put_device; +- } + + if (subdev->type == INTEL_TH_OUTPUT) { + if (subdev->mknode) +@@ -667,10 +665,8 @@ intel_th_subdevice_alloc(struct intel_th *th, + } + + err = device_add(&thdev->dev); +- if (err) { +- put_device(&thdev->dev); ++ if (err) + goto fail_free_res; +- } + + /* need switch driver to be loaded to enumerate the rest */ + if (subdev->type == INTEL_TH_SWITCH && !req) { +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index 03ca5b1bef9f..ebf3e30e989a 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -209,6 +209,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Ice Lake CPU */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8a29), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { ++ /* Tiger Lake CPU */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9a33), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { + /* Tiger Lake PCH */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6), +diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c +index 4b9e44b227d8..4f932a419752 100644 +--- a/drivers/hwtracing/stm/policy.c ++++ b/drivers/hwtracing/stm/policy.c +@@ -345,7 +345,11 @@ void stp_policy_unbind(struct stp_policy *policy) + stm->policy = NULL; + policy->stm = NULL; + ++ /* ++ * Drop the reference on the protocol driver and lose the link. ++ */ + stm_put_protocol(stm->pdrv); ++ stm->pdrv = NULL; + stm_put_device(stm); + } + +diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c +index edc6f1cc90b2..3f03abf100b5 100644 +--- a/drivers/iio/adc/ad7124.c ++++ b/drivers/iio/adc/ad7124.c +@@ -39,6 +39,8 @@ + #define AD7124_STATUS_POR_FLAG_MSK BIT(4) + + /* AD7124_ADC_CONTROL */ ++#define AD7124_ADC_CTRL_REF_EN_MSK BIT(8) ++#define AD7124_ADC_CTRL_REF_EN(x) FIELD_PREP(AD7124_ADC_CTRL_REF_EN_MSK, x) + #define AD7124_ADC_CTRL_PWR_MSK GENMASK(7, 6) + #define AD7124_ADC_CTRL_PWR(x) FIELD_PREP(AD7124_ADC_CTRL_PWR_MSK, x) + #define AD7124_ADC_CTRL_MODE_MSK GENMASK(5, 2) +@@ -424,7 +426,10 @@ static int ad7124_init_channel_vref(struct ad7124_state *st, + break; + case AD7124_INT_REF: + st->channel_config[channel_number].vref_mv = 2500; +- break; ++ st->adc_control &= ~AD7124_ADC_CTRL_REF_EN_MSK; ++ st->adc_control |= AD7124_ADC_CTRL_REF_EN(1); ++ return ad_sd_write_reg(&st->sd, AD7124_ADC_CONTROL, ++ 2, st->adc_control); + default: + dev_err(&st->sd.spi->dev, "Invalid reference %d\n", refsel); + return -EINVAL; +diff --git a/drivers/iio/adc/ad7606.c b/drivers/iio/adc/ad7606.c +index f5ba94c03a8d..e4683a68522a 100644 +--- a/drivers/iio/adc/ad7606.c ++++ b/drivers/iio/adc/ad7606.c +@@ -85,7 +85,7 @@ err_unlock: + + static int ad7606_read_samples(struct ad7606_state *st) + { +- unsigned int num = st->chip_info->num_channels; ++ unsigned int num = st->chip_info->num_channels - 1; + u16 *data = st->data; + int ret; + +diff --git a/drivers/iio/adc/ad7949.c b/drivers/iio/adc/ad7949.c +index ac0ffff6c5ae..6b51bfcad0d0 100644 +--- a/drivers/iio/adc/ad7949.c ++++ b/drivers/iio/adc/ad7949.c +@@ -57,29 +57,11 @@ struct ad7949_adc_chip { + u32 buffer ____cacheline_aligned; + }; + +-static bool ad7949_spi_cfg_is_read_back(struct ad7949_adc_chip *ad7949_adc) +-{ +- if (!(ad7949_adc->cfg & AD7949_CFG_READ_BACK)) +- return true; +- +- return false; +-} +- +-static int ad7949_spi_bits_per_word(struct ad7949_adc_chip *ad7949_adc) +-{ +- int ret = ad7949_adc->resolution; +- +- if (ad7949_spi_cfg_is_read_back(ad7949_adc)) +- ret += AD7949_CFG_REG_SIZE_BITS; +- +- return ret; +-} +- + static int ad7949_spi_write_cfg(struct ad7949_adc_chip *ad7949_adc, u16 val, + u16 mask) + { + int ret; +- int bits_per_word = ad7949_spi_bits_per_word(ad7949_adc); ++ int bits_per_word = ad7949_adc->resolution; + int shift = bits_per_word - AD7949_CFG_REG_SIZE_BITS; + struct spi_message msg; + struct spi_transfer tx[] = { +@@ -107,7 +89,8 @@ static int ad7949_spi_read_channel(struct ad7949_adc_chip *ad7949_adc, int *val, + unsigned int channel) + { + int ret; +- int bits_per_word = ad7949_spi_bits_per_word(ad7949_adc); ++ int i; ++ int bits_per_word = ad7949_adc->resolution; + int mask = GENMASK(ad7949_adc->resolution, 0); + struct spi_message msg; + struct spi_transfer tx[] = { +@@ -118,12 +101,23 @@ static int ad7949_spi_read_channel(struct ad7949_adc_chip *ad7949_adc, int *val, + }, + }; + +- ret = ad7949_spi_write_cfg(ad7949_adc, +- channel << AD7949_OFFSET_CHANNEL_SEL, +- AD7949_MASK_CHANNEL_SEL); +- if (ret) +- return ret; ++ /* ++ * 1: write CFG for sample N and read old data (sample N-2) ++ * 2: if CFG was not changed since sample N-1 then we'll get good data ++ * at the next xfer, so we bail out now, otherwise we write something ++ * and we read garbage (sample N-1 configuration). ++ */ ++ for (i = 0; i < 2; i++) { ++ ret = ad7949_spi_write_cfg(ad7949_adc, ++ channel << AD7949_OFFSET_CHANNEL_SEL, ++ AD7949_MASK_CHANNEL_SEL); ++ if (ret) ++ return ret; ++ if (channel == ad7949_adc->current_channel) ++ break; ++ } + ++ /* 3: write something and read actual data */ + ad7949_adc->buffer = 0; + spi_message_init_with_transfers(&msg, tx, 1); + ret = spi_sync(ad7949_adc->spi, &msg); +@@ -138,10 +132,7 @@ static int ad7949_spi_read_channel(struct ad7949_adc_chip *ad7949_adc, int *val, + + ad7949_adc->current_channel = channel; + +- if (ad7949_spi_cfg_is_read_back(ad7949_adc)) +- *val = (ad7949_adc->buffer >> AD7949_CFG_REG_SIZE_BITS) & mask; +- else +- *val = ad7949_adc->buffer & mask; ++ *val = ad7949_adc->buffer & mask; + + return 0; + } +diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c +index bfe1cdb16846..dcf5a5bdfaa8 100644 +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -229,7 +229,7 @@ static int hdc100x_read_raw(struct iio_dev *indio_dev, + *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } else { +- *val = 100; ++ *val = 100000; + *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } +diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c +index 8743b2f376e2..7b966a41d623 100644 +--- a/drivers/iio/imu/adis16480.c ++++ b/drivers/iio/imu/adis16480.c +@@ -623,9 +623,13 @@ static int adis16480_read_raw(struct iio_dev *indio_dev, + *val2 = (st->chip_info->temp_scale % 1000) * 1000; + return IIO_VAL_INT_PLUS_MICRO; + case IIO_PRESSURE: +- *val = 0; +- *val2 = 4000; /* 40ubar = 0.004 kPa */ +- return IIO_VAL_INT_PLUS_MICRO; ++ /* ++ * max scale is 1310 mbar ++ * max raw value is 32767 shifted for 32bits ++ */ ++ *val = 131; /* 1310mbar = 131 kPa */ ++ *val2 = 32767 << 16; ++ return IIO_VAL_FRACTIONAL; + default: + return -EINVAL; + } +@@ -786,13 +790,14 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), + /* +- * storing the value in rad/degree and the scale in degree +- * gives us the result in rad and better precession than +- * storing the scale directly in rad. ++ * Typically we do IIO_RAD_TO_DEGREE in the denominator, which ++ * is exactly the same as IIO_DEGREE_TO_RAD in numerator, since ++ * it gives better approximation. However, in this case we ++ * cannot do it since it would not fit in a 32bit variable. + */ +- .gyro_max_val = IIO_RAD_TO_DEGREE(22887), +- .gyro_max_scale = 300, +- .accel_max_val = IIO_M_S_2_TO_G(21973), ++ .gyro_max_val = 22887 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(300), ++ .accel_max_val = IIO_M_S_2_TO_G(21973 << 16), + .accel_max_scale = 18, + .temp_scale = 5650, /* 5.65 milli degree Celsius */ + .int_clk = 2460000, +@@ -802,9 +807,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + [ADIS16480] = { + .channels = adis16480_channels, + .num_channels = ARRAY_SIZE(adis16480_channels), +- .gyro_max_val = IIO_RAD_TO_DEGREE(22500), +- .gyro_max_scale = 450, +- .accel_max_val = IIO_M_S_2_TO_G(12500), ++ .gyro_max_val = 22500 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(450), ++ .accel_max_val = IIO_M_S_2_TO_G(12500 << 16), + .accel_max_scale = 10, + .temp_scale = 5650, /* 5.65 milli degree Celsius */ + .int_clk = 2460000, +@@ -814,9 +819,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + [ADIS16485] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), +- .gyro_max_val = IIO_RAD_TO_DEGREE(22500), +- .gyro_max_scale = 450, +- .accel_max_val = IIO_M_S_2_TO_G(20000), ++ .gyro_max_val = 22500 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(450), ++ .accel_max_val = IIO_M_S_2_TO_G(20000 << 16), + .accel_max_scale = 5, + .temp_scale = 5650, /* 5.65 milli degree Celsius */ + .int_clk = 2460000, +@@ -826,9 +831,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + [ADIS16488] = { + .channels = adis16480_channels, + .num_channels = ARRAY_SIZE(adis16480_channels), +- .gyro_max_val = IIO_RAD_TO_DEGREE(22500), +- .gyro_max_scale = 450, +- .accel_max_val = IIO_M_S_2_TO_G(22500), ++ .gyro_max_val = 22500 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(450), ++ .accel_max_val = IIO_M_S_2_TO_G(22500 << 16), + .accel_max_scale = 18, + .temp_scale = 5650, /* 5.65 milli degree Celsius */ + .int_clk = 2460000, +@@ -838,9 +843,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + [ADIS16495_1] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), +- .gyro_max_val = IIO_RAD_TO_DEGREE(20000), +- .gyro_max_scale = 125, +- .accel_max_val = IIO_M_S_2_TO_G(32000), ++ .gyro_max_val = 20000 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(125), ++ .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), + .accel_max_scale = 8, + .temp_scale = 12500, /* 12.5 milli degree Celsius */ + .int_clk = 4250000, +@@ -851,9 +856,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + [ADIS16495_2] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), +- .gyro_max_val = IIO_RAD_TO_DEGREE(18000), +- .gyro_max_scale = 450, +- .accel_max_val = IIO_M_S_2_TO_G(32000), ++ .gyro_max_val = 18000 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(450), ++ .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), + .accel_max_scale = 8, + .temp_scale = 12500, /* 12.5 milli degree Celsius */ + .int_clk = 4250000, +@@ -864,9 +869,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + [ADIS16495_3] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), +- .gyro_max_val = IIO_RAD_TO_DEGREE(20000), +- .gyro_max_scale = 2000, +- .accel_max_val = IIO_M_S_2_TO_G(32000), ++ .gyro_max_val = 20000 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(2000), ++ .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), + .accel_max_scale = 8, + .temp_scale = 12500, /* 12.5 milli degree Celsius */ + .int_clk = 4250000, +@@ -877,9 +882,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + [ADIS16497_1] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), +- .gyro_max_val = IIO_RAD_TO_DEGREE(20000), +- .gyro_max_scale = 125, +- .accel_max_val = IIO_M_S_2_TO_G(32000), ++ .gyro_max_val = 20000 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(125), ++ .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), + .accel_max_scale = 40, + .temp_scale = 12500, /* 12.5 milli degree Celsius */ + .int_clk = 4250000, +@@ -890,9 +895,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + [ADIS16497_2] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), +- .gyro_max_val = IIO_RAD_TO_DEGREE(18000), +- .gyro_max_scale = 450, +- .accel_max_val = IIO_M_S_2_TO_G(32000), ++ .gyro_max_val = 18000 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(450), ++ .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), + .accel_max_scale = 40, + .temp_scale = 12500, /* 12.5 milli degree Celsius */ + .int_clk = 4250000, +@@ -903,9 +908,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + [ADIS16497_3] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), +- .gyro_max_val = IIO_RAD_TO_DEGREE(20000), +- .gyro_max_scale = 2000, +- .accel_max_val = IIO_M_S_2_TO_G(32000), ++ .gyro_max_val = 20000 << 16, ++ .gyro_max_scale = IIO_DEGREE_TO_RAD(2000), ++ .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), + .accel_max_scale = 40, + .temp_scale = 12500, /* 12.5 milli degree Celsius */ + .int_clk = 4250000, +@@ -919,6 +924,7 @@ static const struct iio_info adis16480_info = { + .read_raw = &adis16480_read_raw, + .write_raw = &adis16480_write_raw, + .update_scan_mode = adis_update_scan_mode, ++ .debugfs_reg_access = adis_debugfs_reg_access, + }; + + static int adis16480_stop_device(struct iio_dev *indio_dev) +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +index 868281b8adb0..2261c6c4ac65 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +@@ -115,6 +115,7 @@ static const struct inv_mpu6050_hw hw_info[] = { + .reg = ®_set_6050, + .config = &chip_config_6050, + .fifo_size = 1024, ++ .temp = {INV_MPU6050_TEMP_OFFSET, INV_MPU6050_TEMP_SCALE}, + }, + { + .whoami = INV_MPU6500_WHOAMI_VALUE, +@@ -122,6 +123,7 @@ static const struct inv_mpu6050_hw hw_info[] = { + .reg = ®_set_6500, + .config = &chip_config_6050, + .fifo_size = 512, ++ .temp = {INV_MPU6500_TEMP_OFFSET, INV_MPU6500_TEMP_SCALE}, + }, + { + .whoami = INV_MPU6515_WHOAMI_VALUE, +@@ -129,6 +131,7 @@ static const struct inv_mpu6050_hw hw_info[] = { + .reg = ®_set_6500, + .config = &chip_config_6050, + .fifo_size = 512, ++ .temp = {INV_MPU6500_TEMP_OFFSET, INV_MPU6500_TEMP_SCALE}, + }, + { + .whoami = INV_MPU6000_WHOAMI_VALUE, +@@ -136,6 +139,7 @@ static const struct inv_mpu6050_hw hw_info[] = { + .reg = ®_set_6050, + .config = &chip_config_6050, + .fifo_size = 1024, ++ .temp = {INV_MPU6050_TEMP_OFFSET, INV_MPU6050_TEMP_SCALE}, + }, + { + .whoami = INV_MPU9150_WHOAMI_VALUE, +@@ -143,6 +147,7 @@ static const struct inv_mpu6050_hw hw_info[] = { + .reg = ®_set_6050, + .config = &chip_config_6050, + .fifo_size = 1024, ++ .temp = {INV_MPU6050_TEMP_OFFSET, INV_MPU6050_TEMP_SCALE}, + }, + { + .whoami = INV_MPU9250_WHOAMI_VALUE, +@@ -150,6 +155,7 @@ static const struct inv_mpu6050_hw hw_info[] = { + .reg = ®_set_6500, + .config = &chip_config_6050, + .fifo_size = 512, ++ .temp = {INV_MPU6500_TEMP_OFFSET, INV_MPU6500_TEMP_SCALE}, + }, + { + .whoami = INV_MPU9255_WHOAMI_VALUE, +@@ -157,6 +163,7 @@ static const struct inv_mpu6050_hw hw_info[] = { + .reg = ®_set_6500, + .config = &chip_config_6050, + .fifo_size = 512, ++ .temp = {INV_MPU6500_TEMP_OFFSET, INV_MPU6500_TEMP_SCALE}, + }, + { + .whoami = INV_ICM20608_WHOAMI_VALUE, +@@ -164,6 +171,7 @@ static const struct inv_mpu6050_hw hw_info[] = { + .reg = ®_set_6500, + .config = &chip_config_6050, + .fifo_size = 512, ++ .temp = {INV_ICM20608_TEMP_OFFSET, INV_ICM20608_TEMP_SCALE}, + }, + { + .whoami = INV_ICM20602_WHOAMI_VALUE, +@@ -171,6 +179,7 @@ static const struct inv_mpu6050_hw hw_info[] = { + .reg = ®_set_icm20602, + .config = &chip_config_6050, + .fifo_size = 1008, ++ .temp = {INV_ICM20608_TEMP_OFFSET, INV_ICM20608_TEMP_SCALE}, + }, + }; + +@@ -471,12 +480,8 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev, + + return IIO_VAL_INT_PLUS_MICRO; + case IIO_TEMP: +- *val = 0; +- if (st->chip_type == INV_ICM20602) +- *val2 = INV_ICM20602_TEMP_SCALE; +- else +- *val2 = INV_MPU6050_TEMP_SCALE; +- ++ *val = st->hw->temp.scale / 1000000; ++ *val2 = st->hw->temp.scale % 1000000; + return IIO_VAL_INT_PLUS_MICRO; + default: + return -EINVAL; +@@ -484,11 +489,7 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev, + case IIO_CHAN_INFO_OFFSET: + switch (chan->type) { + case IIO_TEMP: +- if (st->chip_type == INV_ICM20602) +- *val = INV_ICM20602_TEMP_OFFSET; +- else +- *val = INV_MPU6050_TEMP_OFFSET; +- ++ *val = st->hw->temp.offset; + return IIO_VAL_INT; + default: + return -EINVAL; +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h +index 51235677c534..c32bd0c012b5 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h +@@ -101,6 +101,7 @@ struct inv_mpu6050_chip_config { + * @reg: register map of the chip. + * @config: configuration of the chip. + * @fifo_size: size of the FIFO in bytes. ++ * @temp: offset and scale to apply to raw temperature. + */ + struct inv_mpu6050_hw { + u8 whoami; +@@ -108,6 +109,10 @@ struct inv_mpu6050_hw { + const struct inv_mpu6050_reg_map *reg; + const struct inv_mpu6050_chip_config *config; + size_t fifo_size; ++ struct { ++ int offset; ++ int scale; ++ } temp; + }; + + /* +@@ -218,16 +223,19 @@ struct inv_mpu6050_state { + #define INV_MPU6050_REG_UP_TIME_MIN 5000 + #define INV_MPU6050_REG_UP_TIME_MAX 10000 + +-#define INV_MPU6050_TEMP_OFFSET 12421 +-#define INV_MPU6050_TEMP_SCALE 2941 ++#define INV_MPU6050_TEMP_OFFSET 12420 ++#define INV_MPU6050_TEMP_SCALE 2941176 + #define INV_MPU6050_MAX_GYRO_FS_PARAM 3 + #define INV_MPU6050_MAX_ACCL_FS_PARAM 3 + #define INV_MPU6050_THREE_AXIS 3 + #define INV_MPU6050_GYRO_CONFIG_FSR_SHIFT 3 + #define INV_MPU6050_ACCL_CONFIG_FSR_SHIFT 3 + +-#define INV_ICM20602_TEMP_OFFSET 8170 +-#define INV_ICM20602_TEMP_SCALE 3060 ++#define INV_MPU6500_TEMP_OFFSET 7011 ++#define INV_MPU6500_TEMP_SCALE 2995178 ++ ++#define INV_ICM20608_TEMP_OFFSET 8170 ++#define INV_ICM20608_TEMP_SCALE 3059976 + + /* 6 + 6 round up and plus 8 */ + #define INV_MPU6050_OUTPUT_DATA_SIZE 24 +diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +index fd5ebe1e1594..28e011b35f21 100644 +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +@@ -985,8 +985,7 @@ int st_lsm6dsx_check_odr(struct st_lsm6dsx_sensor *sensor, u16 odr, u8 *val) + return -EINVAL; + + *val = odr_table->odr_avl[i].val; +- +- return 0; ++ return odr_table->odr_avl[i].hz; + } + + static u16 st_lsm6dsx_check_odr_dependency(struct st_lsm6dsx_hw *hw, u16 odr, +@@ -1149,8 +1148,10 @@ static int st_lsm6dsx_write_raw(struct iio_dev *iio_dev, + case IIO_CHAN_INFO_SAMP_FREQ: { + u8 data; + +- err = st_lsm6dsx_check_odr(sensor, val, &data); +- if (!err) ++ val = st_lsm6dsx_check_odr(sensor, val, &data); ++ if (val < 0) ++ err = val; ++ else + sensor->odr = val; + break; + } +diff --git a/drivers/interconnect/qcom/qcs404.c b/drivers/interconnect/qcom/qcs404.c +index b4966d8f3348..8e0735a87040 100644 +--- a/drivers/interconnect/qcom/qcs404.c ++++ b/drivers/interconnect/qcom/qcs404.c +@@ -414,7 +414,7 @@ static int qnoc_probe(struct platform_device *pdev) + struct icc_provider *provider; + struct qcom_icc_node **qnodes; + struct qcom_icc_provider *qp; +- struct icc_node *node; ++ struct icc_node *node, *tmp; + size_t num_nodes, i; + int ret; + +@@ -494,7 +494,7 @@ static int qnoc_probe(struct platform_device *pdev) + + return 0; + err: +- list_for_each_entry(node, &provider->nodes, node_list) { ++ list_for_each_entry_safe(node, tmp, &provider->nodes, node_list) { + icc_node_del(node); + icc_node_destroy(node->id); + } +@@ -508,9 +508,9 @@ static int qnoc_remove(struct platform_device *pdev) + { + struct qcom_icc_provider *qp = platform_get_drvdata(pdev); + struct icc_provider *provider = &qp->provider; +- struct icc_node *n; ++ struct icc_node *n, *tmp; + +- list_for_each_entry(n, &provider->nodes, node_list) { ++ list_for_each_entry_safe(n, tmp, &provider->nodes, node_list) { + icc_node_del(n); + icc_node_destroy(n->id); + } +diff --git a/drivers/interconnect/qcom/sdm845.c b/drivers/interconnect/qcom/sdm845.c +index 502a6c22b41e..387267ee9648 100644 +--- a/drivers/interconnect/qcom/sdm845.c ++++ b/drivers/interconnect/qcom/sdm845.c +@@ -868,9 +868,9 @@ static int qnoc_remove(struct platform_device *pdev) + { + struct qcom_icc_provider *qp = platform_get_drvdata(pdev); + struct icc_provider *provider = &qp->provider; +- struct icc_node *n; ++ struct icc_node *n, *tmp; + +- list_for_each_entry(n, &provider->nodes, node_list) { ++ list_for_each_entry_safe(n, tmp, &provider->nodes, node_list) { + icc_node_del(n); + icc_node_destroy(n->id); + } +diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c +index d06b8aa41e26..43d1af1d8173 100644 +--- a/drivers/md/dm-writecache.c ++++ b/drivers/md/dm-writecache.c +@@ -1218,7 +1218,8 @@ bio_copy: + } + } while (bio->bi_iter.bi_size); + +- if (unlikely(wc->uncommitted_blocks >= wc->autocommit_blocks)) ++ if (unlikely(bio->bi_opf & REQ_FUA || ++ wc->uncommitted_blocks >= wc->autocommit_blocks)) + writecache_flush(wc); + else + writecache_schedule_autocommit(wc); +diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c +index 595a73110e17..ac1179ca80d9 100644 +--- a/drivers/md/dm-zoned-metadata.c ++++ b/drivers/md/dm-zoned-metadata.c +@@ -554,6 +554,7 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd, + TASK_UNINTERRUPTIBLE); + if (test_bit(DMZ_META_ERROR, &mblk->state)) { + dmz_release_mblock(zmd, mblk); ++ dmz_check_bdev(zmd->dev); + return ERR_PTR(-EIO); + } + +@@ -625,6 +626,8 @@ static int dmz_rdwr_block(struct dmz_metadata *zmd, int op, sector_t block, + ret = submit_bio_wait(bio); + bio_put(bio); + ++ if (ret) ++ dmz_check_bdev(zmd->dev); + return ret; + } + +@@ -691,6 +694,7 @@ static int dmz_write_dirty_mblocks(struct dmz_metadata *zmd, + TASK_UNINTERRUPTIBLE); + if (test_bit(DMZ_META_ERROR, &mblk->state)) { + clear_bit(DMZ_META_ERROR, &mblk->state); ++ dmz_check_bdev(zmd->dev); + ret = -EIO; + } + nr_mblks_submitted--; +@@ -768,7 +772,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) + /* If there are no dirty metadata blocks, just flush the device cache */ + if (list_empty(&write_list)) { + ret = blkdev_issue_flush(zmd->dev->bdev, GFP_NOIO, NULL); +- goto out; ++ goto err; + } + + /* +@@ -778,7 +782,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) + */ + ret = dmz_log_dirty_mblocks(zmd, &write_list); + if (ret) +- goto out; ++ goto err; + + /* + * The log is on disk. It is now safe to update in place +@@ -786,11 +790,11 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) + */ + ret = dmz_write_dirty_mblocks(zmd, &write_list, zmd->mblk_primary); + if (ret) +- goto out; ++ goto err; + + ret = dmz_write_sb(zmd, zmd->mblk_primary); + if (ret) +- goto out; ++ goto err; + + while (!list_empty(&write_list)) { + mblk = list_first_entry(&write_list, struct dmz_mblock, link); +@@ -805,16 +809,20 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) + + zmd->sb_gen++; + out: +- if (ret && !list_empty(&write_list)) { +- spin_lock(&zmd->mblk_lock); +- list_splice(&write_list, &zmd->mblk_dirty_list); +- spin_unlock(&zmd->mblk_lock); +- } +- + dmz_unlock_flush(zmd); + up_write(&zmd->mblk_sem); + + return ret; ++ ++err: ++ if (!list_empty(&write_list)) { ++ spin_lock(&zmd->mblk_lock); ++ list_splice(&write_list, &zmd->mblk_dirty_list); ++ spin_unlock(&zmd->mblk_lock); ++ } ++ if (!dmz_check_bdev(zmd->dev)) ++ ret = -EIO; ++ goto out; + } + + /* +@@ -1244,6 +1252,7 @@ static int dmz_update_zone(struct dmz_metadata *zmd, struct dm_zone *zone) + if (ret) { + dmz_dev_err(zmd->dev, "Get zone %u report failed", + dmz_id(zmd, zone)); ++ dmz_check_bdev(zmd->dev); + return ret; + } + +diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c +index d240d7ca8a8a..e7ace908a9b7 100644 +--- a/drivers/md/dm-zoned-reclaim.c ++++ b/drivers/md/dm-zoned-reclaim.c +@@ -82,6 +82,7 @@ static int dmz_reclaim_align_wp(struct dmz_reclaim *zrc, struct dm_zone *zone, + "Align zone %u wp %llu to %llu (wp+%u) blocks failed %d", + dmz_id(zmd, zone), (unsigned long long)wp_block, + (unsigned long long)block, nr_blocks, ret); ++ dmz_check_bdev(zrc->dev); + return ret; + } + +@@ -489,12 +490,7 @@ static void dmz_reclaim_work(struct work_struct *work) + ret = dmz_do_reclaim(zrc); + if (ret) { + dmz_dev_debug(zrc->dev, "Reclaim error %d\n", ret); +- if (ret == -EIO) +- /* +- * LLD might be performing some error handling sequence +- * at the underlying device. To not interfere, do not +- * attempt to schedule the next reclaim run immediately. +- */ ++ if (!dmz_check_bdev(zrc->dev)) + return; + } + +diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c +index d3bcc4197f5d..4574e0dedbd6 100644 +--- a/drivers/md/dm-zoned-target.c ++++ b/drivers/md/dm-zoned-target.c +@@ -80,6 +80,8 @@ static inline void dmz_bio_endio(struct bio *bio, blk_status_t status) + + if (status != BLK_STS_OK && bio->bi_status == BLK_STS_OK) + bio->bi_status = status; ++ if (bio->bi_status != BLK_STS_OK) ++ bioctx->target->dev->flags |= DMZ_CHECK_BDEV; + + if (refcount_dec_and_test(&bioctx->ref)) { + struct dm_zone *zone = bioctx->zone; +@@ -565,31 +567,51 @@ out: + } + + /* +- * Check the backing device availability. If it's on the way out, ++ * Check if the backing device is being removed. If it's on the way out, + * start failing I/O. Reclaim and metadata components also call this + * function to cleanly abort operation in the event of such failure. + */ + bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev) + { +- struct gendisk *disk; ++ if (dmz_dev->flags & DMZ_BDEV_DYING) ++ return true; + +- if (!(dmz_dev->flags & DMZ_BDEV_DYING)) { +- disk = dmz_dev->bdev->bd_disk; +- if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) { +- dmz_dev_warn(dmz_dev, "Backing device queue dying"); +- dmz_dev->flags |= DMZ_BDEV_DYING; +- } else if (disk->fops->check_events) { +- if (disk->fops->check_events(disk, 0) & +- DISK_EVENT_MEDIA_CHANGE) { +- dmz_dev_warn(dmz_dev, "Backing device offline"); +- dmz_dev->flags |= DMZ_BDEV_DYING; +- } +- } ++ if (dmz_dev->flags & DMZ_CHECK_BDEV) ++ return !dmz_check_bdev(dmz_dev); ++ ++ if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) { ++ dmz_dev_warn(dmz_dev, "Backing device queue dying"); ++ dmz_dev->flags |= DMZ_BDEV_DYING; + } + + return dmz_dev->flags & DMZ_BDEV_DYING; + } + ++/* ++ * Check the backing device availability. This detects such events as ++ * backing device going offline due to errors, media removals, etc. ++ * This check is less efficient than dmz_bdev_is_dying() and should ++ * only be performed as a part of error handling. ++ */ ++bool dmz_check_bdev(struct dmz_dev *dmz_dev) ++{ ++ struct gendisk *disk; ++ ++ dmz_dev->flags &= ~DMZ_CHECK_BDEV; ++ ++ if (dmz_bdev_is_dying(dmz_dev)) ++ return false; ++ ++ disk = dmz_dev->bdev->bd_disk; ++ if (disk->fops->check_events && ++ disk->fops->check_events(disk, 0) & DISK_EVENT_MEDIA_CHANGE) { ++ dmz_dev_warn(dmz_dev, "Backing device offline"); ++ dmz_dev->flags |= DMZ_BDEV_DYING; ++ } ++ ++ return !(dmz_dev->flags & DMZ_BDEV_DYING); ++} ++ + /* + * Process a new BIO. + */ +@@ -902,8 +924,8 @@ static int dmz_prepare_ioctl(struct dm_target *ti, struct block_device **bdev) + { + struct dmz_target *dmz = ti->private; + +- if (dmz_bdev_is_dying(dmz->dev)) +- return -ENODEV; ++ if (!dmz_check_bdev(dmz->dev)) ++ return -EIO; + + *bdev = dmz->dev->bdev; + +diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h +index d8e70b0ade35..5b5e493d479c 100644 +--- a/drivers/md/dm-zoned.h ++++ b/drivers/md/dm-zoned.h +@@ -72,6 +72,7 @@ struct dmz_dev { + + /* Device flags. */ + #define DMZ_BDEV_DYING (1 << 0) ++#define DMZ_CHECK_BDEV (2 << 0) + + /* + * Zone descriptor. +@@ -255,5 +256,6 @@ void dmz_schedule_reclaim(struct dmz_reclaim *zrc); + * Functions defined in dm-zoned-target.c + */ + bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev); ++bool dmz_check_bdev(struct dmz_dev *dmz_dev); + + #endif /* DM_ZONED_H */ +diff --git a/drivers/md/md-linear.c b/drivers/md/md-linear.c +index c766c559d36d..26c75c0199fa 100644 +--- a/drivers/md/md-linear.c ++++ b/drivers/md/md-linear.c +@@ -244,10 +244,9 @@ static bool linear_make_request(struct mddev *mddev, struct bio *bio) + sector_t start_sector, end_sector, data_offset; + sector_t bio_sector = bio->bi_iter.bi_sector; + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + tmp_dev = which_dev(mddev, bio_sector); + start_sector = tmp_dev->end_sector - tmp_dev->rdev->sectors; +diff --git a/drivers/md/md-multipath.c b/drivers/md/md-multipath.c +index 6780938d2991..152f9e65a226 100644 +--- a/drivers/md/md-multipath.c ++++ b/drivers/md/md-multipath.c +@@ -104,10 +104,9 @@ static bool multipath_make_request(struct mddev *mddev, struct bio * bio) + struct multipath_bh * mp_bh; + struct multipath_info *multipath; + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + mp_bh = mempool_alloc(&conf->pool, GFP_NOIO); + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 1be7abeb24fd..b8dd56b746da 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -550,7 +550,13 @@ static void md_submit_flush_data(struct work_struct *ws) + } + } + +-void md_flush_request(struct mddev *mddev, struct bio *bio) ++/* ++ * Manages consolidation of flushes and submitting any flushes needed for ++ * a bio with REQ_PREFLUSH. Returns true if the bio is finished or is ++ * being finished in another context. Returns false if the flushing is ++ * complete but still needs the I/O portion of the bio to be processed. ++ */ ++bool md_flush_request(struct mddev *mddev, struct bio *bio) + { + ktime_t start = ktime_get_boottime(); + spin_lock_irq(&mddev->lock); +@@ -575,9 +581,10 @@ void md_flush_request(struct mddev *mddev, struct bio *bio) + bio_endio(bio); + else { + bio->bi_opf &= ~REQ_PREFLUSH; +- mddev->pers->make_request(mddev, bio); ++ return false; + } + } ++ return true; + } + EXPORT_SYMBOL(md_flush_request); + +diff --git a/drivers/md/md.h b/drivers/md/md.h +index c5e3ff398b59..5f86f8adb0a4 100644 +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -550,7 +550,7 @@ struct md_personality + int level; + struct list_head list; + struct module *owner; +- bool (*make_request)(struct mddev *mddev, struct bio *bio); ++ bool __must_check (*make_request)(struct mddev *mddev, struct bio *bio); + /* + * start up works that do NOT require md_thread. tasks that + * requires md_thread should go into start() +@@ -703,7 +703,7 @@ extern void md_error(struct mddev *mddev, struct md_rdev *rdev); + extern void md_finish_reshape(struct mddev *mddev); + + extern int mddev_congested(struct mddev *mddev, int bits); +-extern void md_flush_request(struct mddev *mddev, struct bio *bio); ++extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio); + extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev, + sector_t sector, int size, struct page *page); + extern int md_super_wait(struct mddev *mddev); +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index aa88bdeb9978..b7c20979bd19 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -575,10 +575,9 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) + unsigned chunk_sects; + unsigned sectors; + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + if (unlikely((bio_op(bio) == REQ_OP_DISCARD))) { + raid0_handle_discard(mddev, bio); +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 0466ee2453b4..bb29aeefcbd0 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1567,10 +1567,9 @@ static bool raid1_make_request(struct mddev *mddev, struct bio *bio) + { + sector_t sectors; + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + /* + * There is a limit to the maximum size, but +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 8a62c920bb65..ec136e44aef7 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1525,10 +1525,9 @@ static bool raid10_make_request(struct mddev *mddev, struct bio *bio) + int chunk_sects = chunk_mask + 1; + int sectors = bio_sectors(bio); + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + if (!md_write_start(mddev, bio)) + return false; +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 223e97ab27e6..12a8ce83786e 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5592,8 +5592,8 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) + if (ret == 0) + return true; + if (ret == -ENODEV) { +- md_flush_request(mddev, bi); +- return true; ++ if (md_flush_request(mddev, bi)) ++ return true; + } + /* ret == -EAGAIN, fallback */ + /* +diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c +index 7f4660555ddb..59ae7a1e63bc 100644 +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -1412,9 +1412,6 @@ static const struct v4l2_file_operations vdec_fops = { + .unlocked_ioctl = video_ioctl2, + .poll = v4l2_m2m_fop_poll, + .mmap = v4l2_m2m_fop_mmap, +-#ifdef CONFIG_COMPAT +- .compat_ioctl32 = v4l2_compat_ioctl32, +-#endif + }; + + static int vdec_probe(struct platform_device *pdev) +diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c +index 1b7fb2d5887c..30028ceb548b 100644 +--- a/drivers/media/platform/qcom/venus/venc.c ++++ b/drivers/media/platform/qcom/venus/venc.c +@@ -1235,9 +1235,6 @@ static const struct v4l2_file_operations venc_fops = { + .unlocked_ioctl = video_ioctl2, + .poll = v4l2_m2m_fop_poll, + .mmap = v4l2_m2m_fop_mmap, +-#ifdef CONFIG_COMPAT +- .compat_ioctl32 = v4l2_compat_ioctl32, +-#endif + }; + + static int venc_probe(struct platform_device *pdev) +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +index e90f1ba30574..675b5f2b4c2e 100644 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +@@ -651,8 +651,7 @@ static int bdisp_release(struct file *file) + + dev_dbg(bdisp->dev, "%s\n", __func__); + +- if (mutex_lock_interruptible(&bdisp->lock)) +- return -ERESTARTSYS; ++ mutex_lock(&bdisp->lock); + + v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); + +diff --git a/drivers/media/platform/vimc/vimc-sensor.c b/drivers/media/platform/vimc/vimc-sensor.c +index 6c53b9fc1617..4a6a7e8e66c2 100644 +--- a/drivers/media/platform/vimc/vimc-sensor.c ++++ b/drivers/media/platform/vimc/vimc-sensor.c +@@ -25,7 +25,6 @@ struct vimc_sen_device { + struct v4l2_subdev sd; + struct device *dev; + struct tpg_data tpg; +- struct task_struct *kthread_sen; + u8 *frame; + /* The active format */ + struct v4l2_mbus_framefmt mbus_format; +@@ -208,10 +207,6 @@ static int vimc_sen_s_stream(struct v4l2_subdev *sd, int enable) + const struct vimc_pix_map *vpix; + unsigned int frame_size; + +- if (vsen->kthread_sen) +- /* tpg is already executing */ +- return 0; +- + /* Calculate the frame size */ + vpix = vimc_pix_map_by_code(vsen->mbus_format.code); + frame_size = vsen->mbus_format.width * vpix->bpp * +diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c +index 104ac41c6f96..112376873167 100644 +--- a/drivers/media/radio/radio-wl1273.c ++++ b/drivers/media/radio/radio-wl1273.c +@@ -1148,8 +1148,7 @@ static int wl1273_fm_fops_release(struct file *file) + if (radio->rds_users > 0) { + radio->rds_users--; + if (radio->rds_users == 0) { +- if (mutex_lock_interruptible(&core->lock)) +- return -EINTR; ++ mutex_lock(&core->lock); + + radio->irq_flags &= ~WL1273_RDS_EVENT; + +diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c +index 952fa4063ff8..d0df054b0b47 100644 +--- a/drivers/mmc/host/omap_hsmmc.c ++++ b/drivers/mmc/host/omap_hsmmc.c +@@ -1512,6 +1512,36 @@ static void omap_hsmmc_init_card(struct mmc_host *mmc, struct mmc_card *card) + + if (mmc_pdata(host)->init_card) + mmc_pdata(host)->init_card(card); ++ else if (card->type == MMC_TYPE_SDIO || ++ card->type == MMC_TYPE_SD_COMBO) { ++ struct device_node *np = mmc_dev(mmc)->of_node; ++ ++ /* ++ * REVISIT: should be moved to sdio core and made more ++ * general e.g. by expanding the DT bindings of child nodes ++ * to provide a mechanism to provide this information: ++ * Documentation/devicetree/bindings/mmc/mmc-card.txt ++ */ ++ ++ np = of_get_compatible_child(np, "ti,wl1251"); ++ if (np) { ++ /* ++ * We have TI wl1251 attached to MMC3. Pass this ++ * information to the SDIO core because it can't be ++ * probed by normal methods. ++ */ ++ ++ dev_info(host->dev, "found wl1251\n"); ++ card->quirks |= MMC_QUIRK_NONSTD_SDIO; ++ card->cccr.wide_bus = 1; ++ card->cis.vendor = 0x104c; ++ card->cis.device = 0x9066; ++ card->cis.blksize = 512; ++ card->cis.max_dtr = 24000000; ++ card->ocr = 0x80; ++ of_node_put(np); ++ } ++ } + } + + static void omap_hsmmc_enable_sdio_irq(struct mmc_host *mmc, int enable) +diff --git a/drivers/mtd/devices/spear_smi.c b/drivers/mtd/devices/spear_smi.c +index 986f81d2f93e..47ad0766affa 100644 +--- a/drivers/mtd/devices/spear_smi.c ++++ b/drivers/mtd/devices/spear_smi.c +@@ -592,6 +592,26 @@ static int spear_mtd_read(struct mtd_info *mtd, loff_t from, size_t len, + return 0; + } + ++/* ++ * The purpose of this function is to ensure a memcpy_toio() with byte writes ++ * only. Its structure is inspired from the ARM implementation of _memcpy_toio() ++ * which also does single byte writes but cannot be used here as this is just an ++ * implementation detail and not part of the API. Not mentioning the comment ++ * stating that _memcpy_toio() should be optimized. ++ */ ++static void spear_smi_memcpy_toio_b(volatile void __iomem *dest, ++ const void *src, size_t len) ++{ ++ const unsigned char *from = src; ++ ++ while (len) { ++ len--; ++ writeb(*from, dest); ++ from++; ++ dest++; ++ } ++} ++ + static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank, + void __iomem *dest, const void *src, size_t len) + { +@@ -614,7 +634,23 @@ static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank, + ctrlreg1 = readl(dev->io_base + SMI_CR1); + writel((ctrlreg1 | WB_MODE) & ~SW_MODE, dev->io_base + SMI_CR1); + +- memcpy_toio(dest, src, len); ++ /* ++ * In Write Burst mode (WB_MODE), the specs states that writes must be: ++ * - incremental ++ * - of the same size ++ * The ARM implementation of memcpy_toio() will optimize the number of ++ * I/O by using as much 4-byte writes as possible, surrounded by ++ * 2-byte/1-byte access if: ++ * - the destination is not 4-byte aligned ++ * - the length is not a multiple of 4-byte. ++ * Avoid this alternance of write access size by using our own 'byte ++ * access' helper if at least one of the two conditions above is true. ++ */ ++ if (IS_ALIGNED(len, sizeof(u32)) && ++ IS_ALIGNED((uintptr_t)dest, sizeof(u32))) ++ memcpy_toio(dest, src, len); ++ else ++ spear_smi_memcpy_toio_b(dest, src, len); + + writel(ctrlreg1, dev->io_base + SMI_CR1); + +diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c +index 5c2c30a7dffa..f64e3b6605c6 100644 +--- a/drivers/mtd/nand/raw/nand_base.c ++++ b/drivers/mtd/nand/raw/nand_base.c +@@ -292,12 +292,16 @@ int nand_bbm_get_next_page(struct nand_chip *chip, int page) + struct mtd_info *mtd = nand_to_mtd(chip); + int last_page = ((mtd->erasesize - mtd->writesize) >> + chip->page_shift) & chip->pagemask; ++ unsigned int bbm_flags = NAND_BBM_FIRSTPAGE | NAND_BBM_SECONDPAGE ++ | NAND_BBM_LASTPAGE; + ++ if (page == 0 && !(chip->options & bbm_flags)) ++ return 0; + if (page == 0 && chip->options & NAND_BBM_FIRSTPAGE) + return 0; +- else if (page <= 1 && chip->options & NAND_BBM_SECONDPAGE) ++ if (page <= 1 && chip->options & NAND_BBM_SECONDPAGE) + return 1; +- else if (page <= last_page && chip->options & NAND_BBM_LASTPAGE) ++ if (page <= last_page && chip->options & NAND_BBM_LASTPAGE) + return last_page; + + return -EINVAL; +diff --git a/drivers/mtd/nand/raw/nand_micron.c b/drivers/mtd/nand/raw/nand_micron.c +index 8ca9fad6e6ad..56654030ec7f 100644 +--- a/drivers/mtd/nand/raw/nand_micron.c ++++ b/drivers/mtd/nand/raw/nand_micron.c +@@ -446,8 +446,10 @@ static int micron_nand_init(struct nand_chip *chip) + if (ret) + goto err_free_manuf_data; + ++ chip->options |= NAND_BBM_FIRSTPAGE; ++ + if (mtd->writesize == 2048) +- chip->options |= NAND_BBM_FIRSTPAGE | NAND_BBM_SECONDPAGE; ++ chip->options |= NAND_BBM_SECONDPAGE; + + ondie = micron_supports_on_die_ecc(chip); + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 1d67eeeab79d..235d51ea4d39 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4145,7 +4145,7 @@ static void rtl_hw_jumbo_disable(struct rtl8169_private *tp) + case RTL_GIGA_MAC_VER_27 ... RTL_GIGA_MAC_VER_28: + r8168dp_hw_jumbo_disable(tp); + break; +- case RTL_GIGA_MAC_VER_31 ... RTL_GIGA_MAC_VER_34: ++ case RTL_GIGA_MAC_VER_31 ... RTL_GIGA_MAC_VER_33: + r8168e_hw_jumbo_disable(tp); + break; + default: +diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c +index b94759daeacc..da2d179430ca 100644 +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata, + + if (flags & AR5523_CMD_FLAG_MAGIC) + hdr->magic = cpu_to_be32(1 << 24); +- memcpy(hdr + 1, idata, ilen); ++ if (ilen) ++ memcpy(hdr + 1, idata, ilen); + + cmd->odata = odata; + cmd->olen = olen; +diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c +index 153b84447e40..41389c1eb252 100644 +--- a/drivers/net/wireless/ath/wil6210/wmi.c ++++ b/drivers/net/wireless/ath/wil6210/wmi.c +@@ -2505,7 +2505,8 @@ int wmi_set_ie(struct wil6210_vif *vif, u8 type, u16 ie_len, const void *ie) + cmd->mgmt_frm_type = type; + /* BUG: FW API define ieLen as u8. Will fix FW */ + cmd->ie_len = cpu_to_le16(ie_len); +- memcpy(cmd->ie_info, ie, ie_len); ++ if (ie_len) ++ memcpy(cmd->ie_info, ie, ie_len); + rc = wmi_send(wil, WMI_SET_APPIE_CMDID, vif->mid, cmd, len); + kfree(cmd); + out: +@@ -2541,7 +2542,8 @@ int wmi_update_ft_ies(struct wil6210_vif *vif, u16 ie_len, const void *ie) + } + + cmd->ie_len = cpu_to_le16(ie_len); +- memcpy(cmd->ie_info, ie, ie_len); ++ if (ie_len) ++ memcpy(cmd->ie_info, ie, ie_len); + rc = wmi_send(wil, WMI_UPDATE_FT_IES_CMDID, vif->mid, cmd, len); + kfree(cmd); + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index 6c463475e90b..3be60aef5465 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -1427,6 +1427,8 @@ static int brcmf_pcie_reset(struct device *dev) + struct brcmf_fw_request *fwreq; + int err; + ++ brcmf_pcie_intr_disable(devinfo); ++ + brcmf_pcie_bus_console_read(devinfo, true); + + brcmf_detach(dev); +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +index d80f71f82a6d..97cb3a8d505c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +@@ -468,6 +468,7 @@ iwl_tfh_tfd *iwl_pcie_gen2_build_tx(struct iwl_trans *trans, + dma_addr_t tb_phys; + int len, tb1_len, tb2_len; + void *tb1_addr; ++ struct sk_buff *frag; + + tb_phys = iwl_pcie_get_first_tb_dma(txq, idx); + +@@ -516,6 +517,19 @@ iwl_tfh_tfd *iwl_pcie_gen2_build_tx(struct iwl_trans *trans, + if (iwl_pcie_gen2_tx_add_frags(trans, skb, tfd, out_meta)) + goto out_err; + ++ skb_walk_frags(skb, frag) { ++ tb_phys = dma_map_single(trans->dev, frag->data, ++ skb_headlen(frag), DMA_TO_DEVICE); ++ if (unlikely(dma_mapping_error(trans->dev, tb_phys))) ++ goto out_err; ++ iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, skb_headlen(frag)); ++ trace_iwlwifi_dev_tx_tb(trans->dev, skb, ++ frag->data, ++ skb_headlen(frag)); ++ if (iwl_pcie_gen2_tx_add_frags(trans, frag, tfd, out_meta)) ++ goto out_err; ++ } ++ + return tfd; + + out_err: +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c +index c7f29a9be50d..146fe144f5f5 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c +@@ -1176,6 +1176,7 @@ void rtl92de_enable_interrupt(struct ieee80211_hw *hw) + + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); ++ rtlpci->irq_enabled = true; + } + + void rtl92de_disable_interrupt(struct ieee80211_hw *hw) +@@ -1185,7 +1186,7 @@ void rtl92de_disable_interrupt(struct ieee80211_hw *hw) + + rtl_write_dword(rtlpriv, REG_HIMR, IMR8190_DISABLED); + rtl_write_dword(rtlpriv, REG_HIMRE, IMR8190_DISABLED); +- synchronize_irq(rtlpci->pdev->irq); ++ rtlpci->irq_enabled = false; + } + + static void _rtl92de_poweroff_adapter(struct ieee80211_hw *hw) +@@ -1351,7 +1352,7 @@ void rtl92de_set_beacon_related_registers(struct ieee80211_hw *hw) + + bcn_interval = mac->beacon_interval; + atim_window = 2; +- /*rtl92de_disable_interrupt(hw); */ ++ rtl92de_disable_interrupt(hw); + rtl_write_word(rtlpriv, REG_ATIMWND, atim_window); + rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval); + rtl_write_word(rtlpriv, REG_BCNTCFG, 0x660f); +@@ -1371,9 +1372,9 @@ void rtl92de_set_beacon_interval(struct ieee80211_hw *hw) + + RT_TRACE(rtlpriv, COMP_BEACON, DBG_DMESG, + "beacon_interval:%d\n", bcn_interval); +- /* rtl92de_disable_interrupt(hw); */ ++ rtl92de_disable_interrupt(hw); + rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval); +- /* rtl92de_enable_interrupt(hw); */ ++ rtl92de_enable_interrupt(hw); + } + + void rtl92de_update_interrupt_mask(struct ieee80211_hw *hw, +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c +index 99e5cd9a5c86..1dbdddce0823 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c +@@ -216,6 +216,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = { + .led_control = rtl92de_led_control, + .set_desc = rtl92de_set_desc, + .get_desc = rtl92de_get_desc, ++ .is_tx_desc_closed = rtl92de_is_tx_desc_closed, + .tx_polling = rtl92de_tx_polling, + .enable_hw_sec = rtl92de_enable_hw_security_config, + .set_key = rtl92de_set_key, +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c +index 2494e1f118f8..92c9fb45f800 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c +@@ -804,13 +804,15 @@ u64 rtl92de_get_desc(struct ieee80211_hw *hw, + break; + } + } else { +- struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc; + switch (desc_name) { + case HW_DESC_OWN: +- ret = GET_RX_DESC_OWN(pdesc); ++ ret = GET_RX_DESC_OWN(p_desc); + break; + case HW_DESC_RXPKT_LEN: +- ret = GET_RX_DESC_PKT_LEN(pdesc); ++ ret = GET_RX_DESC_PKT_LEN(p_desc); ++ break; ++ case HW_DESC_RXBUFF_ADDR: ++ ret = GET_RX_DESC_BUFF_ADDR(p_desc); + break; + default: + WARN_ONCE(true, "rtl8192de: ERR rxdesc :%d not processed\n", +@@ -821,6 +823,23 @@ u64 rtl92de_get_desc(struct ieee80211_hw *hw, + return ret; + } + ++bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw, ++ u8 hw_queue, u16 index) ++{ ++ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); ++ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue]; ++ u8 *entry = (u8 *)(&ring->desc[ring->idx]); ++ u8 own = (u8)rtl92de_get_desc(hw, entry, true, HW_DESC_OWN); ++ ++ /* a beacon packet will only use the first ++ * descriptor by defaut, and the own bit may not ++ * be cleared by the hardware ++ */ ++ if (own) ++ return false; ++ return true; ++} ++ + void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h +index 36820070fd76..635989e15282 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h +@@ -715,6 +715,8 @@ void rtl92de_set_desc(struct ieee80211_hw *hw, u8 *pdesc, bool istx, + u8 desc_name, u8 *val); + u64 rtl92de_get_desc(struct ieee80211_hw *hw, + u8 *p_desc, bool istx, u8 desc_name); ++bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw, ++ u8 hw_queue, u16 index); + void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue); + void rtl92de_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc, + bool b_firstseg, bool b_lastseg, +diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c +index 7997cc6de334..01305ba2d3aa 100644 +--- a/drivers/net/wireless/virt_wifi.c ++++ b/drivers/net/wireless/virt_wifi.c +@@ -450,7 +450,6 @@ static void virt_wifi_net_device_destructor(struct net_device *dev) + */ + kfree(dev->ieee80211_ptr); + dev->ieee80211_ptr = NULL; +- free_netdev(dev); + } + + /* No lock interaction. */ +@@ -458,7 +457,7 @@ static void virt_wifi_setup(struct net_device *dev) + { + ether_setup(dev); + dev->netdev_ops = &virt_wifi_ops; +- dev->priv_destructor = virt_wifi_net_device_destructor; ++ dev->needs_free_netdev = true; + } + + /* Called in a RCU read critical section from netif_receive_skb */ +@@ -544,6 +543,7 @@ static int virt_wifi_newlink(struct net *src_net, struct net_device *dev, + goto unregister_netdev; + } + ++ dev->priv_destructor = virt_wifi_net_device_destructor; + priv->being_deleted = false; + priv->is_connected = false; + priv->is_up = false; +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index fa7ba09dca77..af3212aec871 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1727,6 +1727,8 @@ static int nvme_report_ns_ids(struct nvme_ctrl *ctrl, unsigned int nsid, + if (ret) + dev_warn(ctrl->device, + "Identify Descriptors failed (%d)\n", ret); ++ if (ret > 0) ++ ret = 0; + } + return ret; + } +@@ -2404,16 +2406,6 @@ static const struct nvme_core_quirk_entry core_quirks[] = { + .vid = 0x14a4, + .fr = "22301111", + .quirks = NVME_QUIRK_SIMPLE_SUSPEND, +- }, +- { +- /* +- * This Kingston E8FK11.T firmware version has no interrupt +- * after resume with actions related to suspend to idle +- * https://bugzilla.kernel.org/show_bug.cgi?id=204887 +- */ +- .vid = 0x2646, +- .fr = "E8FK11.T", +- .quirks = NVME_QUIRK_SIMPLE_SUSPEND, + } + }; + +diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c +index e4c46637f32f..b3869951c0eb 100644 +--- a/drivers/pci/hotplug/acpiphp_glue.c ++++ b/drivers/pci/hotplug/acpiphp_glue.c +@@ -449,8 +449,15 @@ static void acpiphp_native_scan_bridge(struct pci_dev *bridge) + + /* Scan non-hotplug bridges that need to be reconfigured */ + for_each_pci_bridge(dev, bus) { +- if (!hotplug_is_native(dev)) +- max = pci_scan_bridge(bus, dev, max, 1); ++ if (hotplug_is_native(dev)) ++ continue; ++ ++ max = pci_scan_bridge(bus, dev, max, 1); ++ if (dev->subordinate) { ++ pcibios_resource_survey_bus(dev->subordinate); ++ pci_bus_size_bridges(dev->subordinate); ++ pci_bus_assign_resources(dev->subordinate); ++ } + } + } + +@@ -480,7 +487,6 @@ static void enable_slot(struct acpiphp_slot *slot, bool bridge) + if (PCI_SLOT(dev->devfn) == slot->device) + acpiphp_native_scan_bridge(dev); + } +- pci_assign_unassigned_bridge_resources(bus->self); + } else { + LIST_HEAD(add_list); + int max, pass; +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index b7f6b1324395..6fd1390fd06e 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -320,9 +321,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr, + if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch)) + return -EIO; + +- if (!strncmp(buf, "host", strlen("host"))) ++ if (sysfs_streq(buf, "host")) + new_mode = PHY_MODE_USB_HOST; +- else if (!strncmp(buf, "peripheral", strlen("peripheral"))) ++ else if (sysfs_streq(buf, "peripheral")) + new_mode = PHY_MODE_USB_DEVICE; + else + return -EINVAL; +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index f2f5fcd9a237..83e585c5a613 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -595,10 +595,10 @@ static int armada_37xx_irq_set_type(struct irq_data *d, unsigned int type) + regmap_read(info->regmap, in_reg, &in_val); + + /* Set initial polarity based on current input level. */ +- if (in_val & d->mask) +- val |= d->mask; /* falling */ ++ if (in_val & BIT(d->hwirq % GPIO_PER_REG)) ++ val |= BIT(d->hwirq % GPIO_PER_REG); /* falling */ + else +- val &= ~d->mask; /* rising */ ++ val &= ~(BIT(d->hwirq % GPIO_PER_REG)); /* rising */ + break; + } + default: +diff --git a/drivers/pinctrl/pinctrl-rza2.c b/drivers/pinctrl/pinctrl-rza2.c +index 3be1d833bf25..eda88cdf870d 100644 +--- a/drivers/pinctrl/pinctrl-rza2.c ++++ b/drivers/pinctrl/pinctrl-rza2.c +@@ -213,8 +213,8 @@ static const char * const rza2_gpio_names[] = { + "PC_0", "PC_1", "PC_2", "PC_3", "PC_4", "PC_5", "PC_6", "PC_7", + "PD_0", "PD_1", "PD_2", "PD_3", "PD_4", "PD_5", "PD_6", "PD_7", + "PE_0", "PE_1", "PE_2", "PE_3", "PE_4", "PE_5", "PE_6", "PE_7", +- "PF_0", "PF_1", "PF_2", "PF_3", "P0_4", "PF_5", "PF_6", "PF_7", +- "PG_0", "PG_1", "PG_2", "P0_3", "PG_4", "PG_5", "PG_6", "PG_7", ++ "PF_0", "PF_1", "PF_2", "PF_3", "PF_4", "PF_5", "PF_6", "PF_7", ++ "PG_0", "PG_1", "PG_2", "PG_3", "PG_4", "PG_5", "PG_6", "PG_7", + "PH_0", "PH_1", "PH_2", "PH_3", "PH_4", "PH_5", "PH_6", "PH_7", + /* port I does not exist */ + "PJ_0", "PJ_1", "PJ_2", "PJ_3", "PJ_4", "PJ_5", "PJ_6", "PJ_7", +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index c93ef33b01d3..5c1378d2fab3 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -125,7 +125,7 @@ EXPORT_SYMBOL_GPL(rtc_read_time); + + int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm) + { +- int err; ++ int err, uie; + + err = rtc_valid_tm(tm); + if (err != 0) +@@ -137,6 +137,17 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm) + + rtc_subtract_offset(rtc, tm); + ++#ifdef CONFIG_RTC_INTF_DEV_UIE_EMUL ++ uie = rtc->uie_rtctimer.enabled || rtc->uie_irq_active; ++#else ++ uie = rtc->uie_rtctimer.enabled; ++#endif ++ if (uie) { ++ err = rtc_update_irq_enable(rtc, 0); ++ if (err) ++ return err; ++ } ++ + err = mutex_lock_interruptible(&rtc->ops_lock); + if (err) + return err; +@@ -153,6 +164,12 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm) + /* A timer might have just expired */ + schedule_work(&rtc->irqwork); + ++ if (uie) { ++ err = rtc_update_irq_enable(rtc, 1); ++ if (err) ++ return err; ++ } ++ + trace_rtc_set_time(rtc_tm_to_time64(tm), err); + return err; + } +diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c +index dccdb41bed8c..1234294700c4 100644 +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -95,11 +95,9 @@ void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req) + memcpy(rec->u.res.fsf_status_qual, &q_head->fsf_status_qual, + FSF_STATUS_QUALIFIER_SIZE); + +- if (q_head->fsf_command != FSF_QTCB_FCP_CMND) { +- rec->pl_len = q_head->log_length; +- zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, +- rec->pl_len, "fsf_res", req->req_id); +- } ++ rec->pl_len = q_head->log_length; ++ zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, ++ rec->pl_len, "fsf_res", req->req_id); + + debug_event(dbf->hba, level, rec, sizeof(*rec)); + spin_unlock_irqrestore(&dbf->hba_lock, flags); +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index 6822cd9ff8f1..ad8ef67a1db3 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -526,7 +526,7 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba *phba, + &qp->lpfc_abts_io_buf_list, list) { + if (psb->cur_iocbq.sli4_xritag == xri) { + list_del_init(&psb->list); +- psb->exch_busy = 0; ++ psb->flags &= ~LPFC_SBUF_XBUSY; + psb->status = IOSTAT_SUCCESS; + if (psb->cur_iocbq.iocb_flag == LPFC_IO_NVME) { + qp->abts_nvme_io_bufs--; +@@ -566,7 +566,7 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba *phba, + if (iocbq->sli4_xritag != xri) + continue; + psb = container_of(iocbq, struct lpfc_io_buf, cur_iocbq); +- psb->exch_busy = 0; ++ psb->flags &= ~LPFC_SBUF_XBUSY; + spin_unlock_irqrestore(&phba->hbalock, iflag); + if (!list_empty(&pring->txq)) + lpfc_worker_wake_up(phba); +@@ -786,7 +786,7 @@ lpfc_release_scsi_buf_s4(struct lpfc_hba *phba, struct lpfc_io_buf *psb) + psb->prot_seg_cnt = 0; + + qp = psb->hdwq; +- if (psb->exch_busy) { ++ if (psb->flags & LPFC_SBUF_XBUSY) { + spin_lock_irqsave(&qp->abts_io_buf_list_lock, iflag); + psb->pCmd = NULL; + list_add_tail(&psb->list, &qp->lpfc_abts_io_buf_list); +@@ -3835,7 +3835,10 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn, + lpfc_cmd->result = (pIocbOut->iocb.un.ulpWord[4] & IOERR_PARAM_MASK); + lpfc_cmd->status = pIocbOut->iocb.ulpStatus; + /* pick up SLI4 exhange busy status from HBA */ +- lpfc_cmd->exch_busy = pIocbOut->iocb_flag & LPFC_EXCHANGE_BUSY; ++ if (pIocbOut->iocb_flag & LPFC_EXCHANGE_BUSY) ++ lpfc_cmd->flags |= LPFC_SBUF_XBUSY; ++ else ++ lpfc_cmd->flags &= ~LPFC_SBUF_XBUSY; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + if (lpfc_cmd->prot_data_type) { +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 614f78dddafe..5ed4219675eb 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -11736,7 +11736,10 @@ lpfc_sli_wake_iocb_wait(struct lpfc_hba *phba, + !(cmdiocbq->iocb_flag & LPFC_IO_LIBDFC)) { + lpfc_cmd = container_of(cmdiocbq, struct lpfc_io_buf, + cur_iocbq); +- lpfc_cmd->exch_busy = rspiocbq->iocb_flag & LPFC_EXCHANGE_BUSY; ++ if (rspiocbq && (rspiocbq->iocb_flag & LPFC_EXCHANGE_BUSY)) ++ lpfc_cmd->flags |= LPFC_SBUF_XBUSY; ++ else ++ lpfc_cmd->flags &= ~LPFC_SBUF_XBUSY; + } + + pdone_q = cmdiocbq->context_un.wait_queue; +diff --git a/drivers/scsi/lpfc/lpfc_sli.h b/drivers/scsi/lpfc/lpfc_sli.h +index 37fbcb46387e..7bcf922a8be2 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.h ++++ b/drivers/scsi/lpfc/lpfc_sli.h +@@ -384,14 +384,13 @@ struct lpfc_io_buf { + + struct lpfc_nodelist *ndlp; + uint32_t timeout; +- uint16_t flags; /* TBD convert exch_busy to flags */ ++ uint16_t flags; + #define LPFC_SBUF_XBUSY 0x1 /* SLI4 hba reported XB on WCQE cmpl */ + #define LPFC_SBUF_BUMP_QDEPTH 0x2 /* bumped queue depth counter */ + /* External DIF device IO conversions */ + #define LPFC_SBUF_NORMAL_DIF 0x4 /* normal mode to insert/strip */ + #define LPFC_SBUF_PASS_DIF 0x8 /* insert/strip mode to passthru */ + #define LPFC_SBUF_NOT_POSTED 0x10 /* SGL failed post to FW. */ +- uint16_t exch_busy; /* SLI4 hba reported XB on complete WCQE */ + uint16_t status; /* From IOCB Word 7- ulpStatus */ + uint32_t result; /* From IOCB Word 4. */ + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index 6ffa9877c28b..d5386edddaf6 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -591,19 +591,23 @@ typedef struct srb { + */ + uint8_t cmd_type; + uint8_t pad[3]; +- atomic_t ref_count; + struct kref cmd_kref; /* need to migrate ref_count over to this */ + void *priv; + wait_queue_head_t nvme_ls_waitq; + struct fc_port *fcport; + struct scsi_qla_host *vha; + unsigned int start_timer:1; ++ unsigned int abort:1; ++ unsigned int aborted:1; ++ unsigned int completed:1; ++ + uint32_t handle; + uint16_t flags; + uint16_t type; + const char *name; + int iocbs; + struct qla_qpair *qpair; ++ struct srb *cmd_sp; + struct list_head elem; + u32 gen1; /* scratch */ + u32 gen2; /* scratch */ +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index 5298ed10059f..84bb4a048016 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3005,7 +3005,7 @@ static void qla24xx_async_gpsc_sp_done(srb_t *sp, int res) + fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE); + + if (res == QLA_FUNCTION_TIMEOUT) +- return; ++ goto done; + + if (res == (DID_ERROR << 16)) { + /* entry status error */ +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 1d041313ec52..d400b51929a6 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -101,8 +101,22 @@ static void qla24xx_abort_iocb_timeout(void *data) + u32 handle; + unsigned long flags; + ++ if (sp->cmd_sp) ++ ql_dbg(ql_dbg_async, sp->vha, 0x507c, ++ "Abort timeout - cmd hdl=%x, cmd type=%x hdl=%x, type=%x\n", ++ sp->cmd_sp->handle, sp->cmd_sp->type, ++ sp->handle, sp->type); ++ else ++ ql_dbg(ql_dbg_async, sp->vha, 0x507c, ++ "Abort timeout 2 - hdl=%x, type=%x\n", ++ sp->handle, sp->type); ++ + spin_lock_irqsave(qpair->qp_lock_ptr, flags); + for (handle = 1; handle < qpair->req->num_outstanding_cmds; handle++) { ++ if (sp->cmd_sp && (qpair->req->outstanding_cmds[handle] == ++ sp->cmd_sp)) ++ qpair->req->outstanding_cmds[handle] = NULL; ++ + /* removing the abort */ + if (qpair->req->outstanding_cmds[handle] == sp) { + qpair->req->outstanding_cmds[handle] = NULL; +@@ -111,6 +125,9 @@ static void qla24xx_abort_iocb_timeout(void *data) + } + spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); + ++ if (sp->cmd_sp) ++ sp->cmd_sp->done(sp->cmd_sp, QLA_OS_TIMER_EXPIRED); ++ + abt->u.abt.comp_status = CS_TIMEOUT; + sp->done(sp, QLA_OS_TIMER_EXPIRED); + } +@@ -142,6 +159,7 @@ static int qla24xx_async_abort_cmd(srb_t *cmd_sp, bool wait) + sp->type = SRB_ABT_CMD; + sp->name = "abort"; + sp->qpair = cmd_sp->qpair; ++ sp->cmd_sp = cmd_sp; + if (wait) + sp->flags = SRB_WAKEUP_ON_COMP; + +@@ -1135,19 +1153,18 @@ static void qla24xx_async_gpdb_sp_done(srb_t *sp, int res) + "Async done-%s res %x, WWPN %8phC mb[1]=%x mb[2]=%x \n", + sp->name, res, fcport->port_name, mb[1], mb[2]); + +- if (res == QLA_FUNCTION_TIMEOUT) { +- dma_pool_free(sp->vha->hw->s_dma_pool, sp->u.iocb_cmd.u.mbx.in, +- sp->u.iocb_cmd.u.mbx.in_dma); +- return; +- } +- + fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE); ++ ++ if (res == QLA_FUNCTION_TIMEOUT) ++ goto done; ++ + memset(&ea, 0, sizeof(ea)); + ea.fcport = fcport; + ea.sp = sp; + + qla24xx_handle_gpdb_event(vha, &ea); + ++done: + dma_pool_free(ha->s_dma_pool, sp->u.iocb_cmd.u.mbx.in, + sp->u.iocb_cmd.u.mbx.in_dma); + +@@ -9003,8 +9020,6 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair) + struct qla_hw_data *ha = qpair->hw; + + qpair->delete_in_progress = 1; +- while (atomic_read(&qpair->ref_count)) +- msleep(500); + + ret = qla25xx_delete_req_que(vha, qpair->req); + if (ret != QLA_SUCCESS) +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 009fd5a33fcd..9204e8467a4e 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -2466,6 +2466,11 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) + return; + } + ++ if (sp->abort) ++ sp->aborted = 1; ++ else ++ sp->completed = 1; ++ + if (sp->cmd_type != TYPE_SRB) { + req->outstanding_cmds[handle] = NULL; + ql_dbg(ql_dbg_io, vha, 0x3015, +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 4a1f21c11758..4d90cf101f5f 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -6287,17 +6287,13 @@ int qla24xx_send_mb_cmd(struct scsi_qla_host *vha, mbx_cmd_t *mcp) + case QLA_SUCCESS: + ql_dbg(ql_dbg_mbx, vha, 0x119d, "%s: %s done.\n", + __func__, sp->name); +- sp->free(sp); + break; + default: + ql_dbg(ql_dbg_mbx, vha, 0x119e, "%s: %s Failed. %x.\n", + __func__, sp->name, rval); +- sp->free(sp); + break; + } + +- return rval; +- + done_free_sp: + sp->free(sp); + done: +diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c +index 238240984bc1..eabc5127174e 100644 +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -946,7 +946,7 @@ int qla24xx_control_vp(scsi_qla_host_t *vha, int cmd) + + sp = qla2x00_get_sp(base_vha, NULL, GFP_KERNEL); + if (!sp) +- goto done; ++ return rval; + + sp->type = SRB_CTRL_VP; + sp->name = "ctrl_vp"; +@@ -962,7 +962,7 @@ int qla24xx_control_vp(scsi_qla_host_t *vha, int cmd) + ql_dbg(ql_dbg_async, vha, 0xffff, + "%s: %s Failed submission. %x.\n", + __func__, sp->name, rval); +- goto done_free_sp; ++ goto done; + } + + ql_dbg(ql_dbg_vport, vha, 0x113f, "%s hndl %x submitted\n", +@@ -980,16 +980,13 @@ int qla24xx_control_vp(scsi_qla_host_t *vha, int cmd) + case QLA_SUCCESS: + ql_dbg(ql_dbg_vport, vha, 0xffff, "%s: %s done.\n", + __func__, sp->name); +- goto done_free_sp; ++ break; + default: + ql_dbg(ql_dbg_vport, vha, 0xffff, "%s: %s Failed. %x.\n", + __func__, sp->name, rval); +- goto done_free_sp; ++ break; + } + done: +- return rval; +- +-done_free_sp: + sp->free(sp); + return rval; + } +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 6cc19e060afc..941aa53363f5 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -224,8 +224,8 @@ static void qla_nvme_abort_work(struct work_struct *work) + + if (ha->flags.host_shutting_down) { + ql_log(ql_log_info, sp->fcport->vha, 0xffff, +- "%s Calling done on sp: %p, type: 0x%x, sp->ref_count: 0x%x\n", +- __func__, sp, sp->type, atomic_read(&sp->ref_count)); ++ "%s Calling done on sp: %p, type: 0x%x\n", ++ __func__, sp, sp->type); + sp->done(sp, 0); + goto out; + } +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 726ad4cbf4a6..06037e3c7854 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -698,11 +698,6 @@ void qla2x00_sp_compl(srb_t *sp, int res) + struct scsi_cmnd *cmd = GET_CMD_SP(sp); + struct completion *comp = sp->comp; + +- if (WARN_ON_ONCE(atomic_read(&sp->ref_count) == 0)) +- return; +- +- atomic_dec(&sp->ref_count); +- + sp->free(sp); + cmd->result = res; + CMD_SP(cmd) = NULL; +@@ -794,11 +789,6 @@ void qla2xxx_qpair_sp_compl(srb_t *sp, int res) + struct scsi_cmnd *cmd = GET_CMD_SP(sp); + struct completion *comp = sp->comp; + +- if (WARN_ON_ONCE(atomic_read(&sp->ref_count) == 0)) +- return; +- +- atomic_dec(&sp->ref_count); +- + sp->free(sp); + cmd->result = res; + CMD_SP(cmd) = NULL; +@@ -903,7 +893,7 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd) + + sp->u.scmd.cmd = cmd; + sp->type = SRB_SCSI_CMD; +- atomic_set(&sp->ref_count, 1); ++ + CMD_SP(cmd) = (void *)sp; + sp->free = qla2x00_sp_free_dma; + sp->done = qla2x00_sp_compl; +@@ -985,18 +975,16 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd, + + sp->u.scmd.cmd = cmd; + sp->type = SRB_SCSI_CMD; +- atomic_set(&sp->ref_count, 1); + CMD_SP(cmd) = (void *)sp; + sp->free = qla2xxx_qpair_sp_free_dma; + sp->done = qla2xxx_qpair_sp_compl; +- sp->qpair = qpair; + + rval = ha->isp_ops->start_scsi_mq(sp); + if (rval != QLA_SUCCESS) { + ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x3078, + "Start scsi failed rval=%d for cmd=%p.\n", rval, cmd); + if (rval == QLA_INTERFACE_ERROR) +- goto qc24_fail_command; ++ goto qc24_free_sp_fail_command; + goto qc24_host_busy_free_sp; + } + +@@ -1008,6 +996,11 @@ qc24_host_busy_free_sp: + qc24_target_busy: + return SCSI_MLQUEUE_TARGET_BUSY; + ++qc24_free_sp_fail_command: ++ sp->free(sp); ++ CMD_SP(cmd) = NULL; ++ qla2xxx_rel_qpair_sp(sp->qpair, sp); ++ + qc24_fail_command: + cmd->scsi_done(cmd); + +@@ -1184,16 +1177,6 @@ qla2x00_wait_for_chip_reset(scsi_qla_host_t *vha) + return return_status; + } + +-static int +-sp_get(struct srb *sp) +-{ +- if (!refcount_inc_not_zero((refcount_t *)&sp->ref_count)) +- /* kref get fail */ +- return ENXIO; +- else +- return 0; +-} +- + #define ISP_REG_DISCONNECT 0xffffffffU + /************************************************************************** + * qla2x00_isp_reg_stat +@@ -1249,6 +1232,9 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd) + uint64_t lun; + int rval; + struct qla_hw_data *ha = vha->hw; ++ uint32_t ratov_j; ++ struct qla_qpair *qpair; ++ unsigned long flags; + + if (qla2x00_isp_reg_stat(ha)) { + ql_log(ql_log_info, vha, 0x8042, +@@ -1261,13 +1247,26 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd) + return ret; + + sp = scsi_cmd_priv(cmd); ++ qpair = sp->qpair; + +- if (sp->fcport && sp->fcport->deleted) ++ if ((sp->fcport && sp->fcport->deleted) || !qpair) + return SUCCESS; + +- /* Return if the command has already finished. */ +- if (sp_get(sp)) ++ spin_lock_irqsave(qpair->qp_lock_ptr, flags); ++ if (sp->completed) { ++ spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); + return SUCCESS; ++ } ++ ++ if (sp->abort || sp->aborted) { ++ spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); ++ return FAILED; ++ } ++ ++ sp->abort = 1; ++ sp->comp = ∁ ++ spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); ++ + + id = cmd->device->id; + lun = cmd->device->lun; +@@ -1276,47 +1275,37 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd) + "Aborting from RISC nexus=%ld:%d:%llu sp=%p cmd=%p handle=%x\n", + vha->host_no, id, lun, sp, cmd, sp->handle); + ++ /* ++ * Abort will release the original Command/sp from FW. Let the ++ * original command call scsi_done. In return, he will wakeup ++ * this sleeping thread. ++ */ + rval = ha->isp_ops->abort_command(sp); ++ + ql_dbg(ql_dbg_taskm, vha, 0x8003, + "Abort command mbx cmd=%p, rval=%x.\n", cmd, rval); + ++ /* Wait for the command completion. */ ++ ratov_j = ha->r_a_tov/10 * 4 * 1000; ++ ratov_j = msecs_to_jiffies(ratov_j); + switch (rval) { + case QLA_SUCCESS: +- /* +- * The command has been aborted. That means that the firmware +- * won't report a completion. +- */ +- sp->done(sp, DID_ABORT << 16); +- ret = SUCCESS; +- break; +- case QLA_FUNCTION_PARAMETER_ERROR: { +- /* Wait for the command completion. */ +- uint32_t ratov = ha->r_a_tov/10; +- uint32_t ratov_j = msecs_to_jiffies(4 * ratov * 1000); +- +- WARN_ON_ONCE(sp->comp); +- sp->comp = ∁ + if (!wait_for_completion_timeout(&comp, ratov_j)) { + ql_dbg(ql_dbg_taskm, vha, 0xffff, + "%s: Abort wait timer (4 * R_A_TOV[%d]) expired\n", +- __func__, ha->r_a_tov); ++ __func__, ha->r_a_tov/10); + ret = FAILED; + } else { + ret = SUCCESS; + } + break; +- } + default: +- /* +- * Either abort failed or abort and completion raced. Let +- * the SCSI core retry the abort in the former case. +- */ + ret = FAILED; + break; + } + + sp->comp = NULL; +- atomic_dec(&sp->ref_count); ++ + ql_log(ql_log_info, vha, 0x801c, + "Abort command issued nexus=%ld:%d:%llu -- %x.\n", + vha->host_no, id, lun, ret); +@@ -1708,32 +1697,53 @@ static void qla2x00_abort_srb(struct qla_qpair *qp, srb_t *sp, const int res, + scsi_qla_host_t *vha = qp->vha; + struct qla_hw_data *ha = vha->hw; + int rval; ++ bool ret_cmd; ++ uint32_t ratov_j; + +- if (sp_get(sp)) ++ if (qla2x00_chip_is_down(vha)) { ++ sp->done(sp, res); + return; ++ } + + if (sp->type == SRB_NVME_CMD || sp->type == SRB_NVME_LS || + (sp->type == SRB_SCSI_CMD && !ha->flags.eeh_busy && + !test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) && + !qla2x00_isp_reg_stat(ha))) { ++ if (sp->comp) { ++ sp->done(sp, res); ++ return; ++ } ++ + sp->comp = ∁ ++ sp->abort = 1; + spin_unlock_irqrestore(qp->qp_lock_ptr, *flags); +- rval = ha->isp_ops->abort_command(sp); + ++ rval = ha->isp_ops->abort_command(sp); ++ /* Wait for command completion. */ ++ ret_cmd = false; ++ ratov_j = ha->r_a_tov/10 * 4 * 1000; ++ ratov_j = msecs_to_jiffies(ratov_j); + switch (rval) { + case QLA_SUCCESS: +- sp->done(sp, res); ++ if (wait_for_completion_timeout(&comp, ratov_j)) { ++ ql_dbg(ql_dbg_taskm, vha, 0xffff, ++ "%s: Abort wait timer (4 * R_A_TOV[%d]) expired\n", ++ __func__, ha->r_a_tov/10); ++ ret_cmd = true; ++ } ++ /* else FW return SP to driver */ + break; +- case QLA_FUNCTION_PARAMETER_ERROR: +- wait_for_completion(&comp); ++ default: ++ ret_cmd = true; + break; + } + + spin_lock_irqsave(qp->qp_lock_ptr, *flags); +- sp->comp = NULL; ++ if (ret_cmd && (!sp->completed || !sp->aborted)) ++ sp->done(sp, res); ++ } else { ++ sp->done(sp, res); + } +- +- atomic_dec(&sp->ref_count); + } + + static void +@@ -1755,7 +1765,6 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res) + for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) { + sp = req->outstanding_cmds[cnt]; + if (sp) { +- req->outstanding_cmds[cnt] = NULL; + switch (sp->cmd_type) { + case TYPE_SRB: + qla2x00_abort_srb(qp, sp, res, &flags); +@@ -1777,6 +1786,7 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res) + default: + break; + } ++ req->outstanding_cmds[cnt] = NULL; + } + } + spin_unlock_irqrestore(qp->qp_lock_ptr, flags); +@@ -4666,7 +4676,8 @@ qla2x00_mem_free(struct qla_hw_data *ha) + ha->sfp_data = NULL; + + if (ha->flt) +- dma_free_coherent(&ha->pdev->dev, SFP_DEV_SIZE, ++ dma_free_coherent(&ha->pdev->dev, ++ sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE, + ha->flt, ha->flt_dma); + ha->flt = NULL; + ha->flt_dma = 0; +diff --git a/drivers/staging/exfat/exfat.h b/drivers/staging/exfat/exfat.h +index 3abab33e932c..4973c9edc26e 100644 +--- a/drivers/staging/exfat/exfat.h ++++ b/drivers/staging/exfat/exfat.h +@@ -943,8 +943,8 @@ s32 create_dir(struct inode *inode, struct chain_t *p_dir, + s32 create_file(struct inode *inode, struct chain_t *p_dir, + struct uni_name_t *p_uniname, u8 mode, struct file_id_t *fid); + void remove_file(struct inode *inode, struct chain_t *p_dir, s32 entry); +-s32 rename_file(struct inode *inode, struct chain_t *p_dir, s32 old_entry, +- struct uni_name_t *p_uniname, struct file_id_t *fid); ++s32 exfat_rename_file(struct inode *inode, struct chain_t *p_dir, s32 old_entry, ++ struct uni_name_t *p_uniname, struct file_id_t *fid); + s32 move_file(struct inode *inode, struct chain_t *p_olddir, s32 oldentry, + struct chain_t *p_newdir, struct uni_name_t *p_uniname, + struct file_id_t *fid); +diff --git a/drivers/staging/exfat/exfat_core.c b/drivers/staging/exfat/exfat_core.c +index 79174e5c4145..f3774a1912d1 100644 +--- a/drivers/staging/exfat/exfat_core.c ++++ b/drivers/staging/exfat/exfat_core.c +@@ -3381,8 +3381,8 @@ void remove_file(struct inode *inode, struct chain_t *p_dir, s32 entry) + fs_func->delete_dir_entry(sb, p_dir, entry, 0, num_entries); + } + +-s32 rename_file(struct inode *inode, struct chain_t *p_dir, s32 oldentry, +- struct uni_name_t *p_uniname, struct file_id_t *fid) ++s32 exfat_rename_file(struct inode *inode, struct chain_t *p_dir, s32 oldentry, ++ struct uni_name_t *p_uniname, struct file_id_t *fid) + { + s32 ret, newentry = -1, num_old_entries, num_new_entries; + sector_t sector_old, sector_new; +diff --git a/drivers/staging/exfat/exfat_super.c b/drivers/staging/exfat/exfat_super.c +index 3b2b0ceb7297..58c7d66060f7 100644 +--- a/drivers/staging/exfat/exfat_super.c ++++ b/drivers/staging/exfat/exfat_super.c +@@ -1308,8 +1308,8 @@ static int ffsMoveFile(struct inode *old_parent_inode, struct file_id_t *fid, + fs_set_vol_flags(sb, VOL_DIRTY); + + if (olddir.dir == newdir.dir) +- ret = rename_file(new_parent_inode, &olddir, dentry, &uni_name, +- fid); ++ ret = exfat_rename_file(new_parent_inode, &olddir, dentry, ++ &uni_name, fid); + else + ret = move_file(new_parent_inode, &olddir, dentry, &newdir, + &uni_name, fid); +diff --git a/drivers/staging/isdn/gigaset/usb-gigaset.c b/drivers/staging/isdn/gigaset/usb-gigaset.c +index 1b9b43659bdf..a20c0bfa68f3 100644 +--- a/drivers/staging/isdn/gigaset/usb-gigaset.c ++++ b/drivers/staging/isdn/gigaset/usb-gigaset.c +@@ -571,8 +571,7 @@ static int gigaset_initcshw(struct cardstate *cs) + { + struct usb_cardstate *ucs; + +- cs->hw.usb = ucs = +- kmalloc(sizeof(struct usb_cardstate), GFP_KERNEL); ++ cs->hw.usb = ucs = kzalloc(sizeof(struct usb_cardstate), GFP_KERNEL); + if (!ucs) { + pr_err("out of memory\n"); + return -ENOMEM; +@@ -584,9 +583,6 @@ static int gigaset_initcshw(struct cardstate *cs) + ucs->bchars[3] = 0; + ucs->bchars[4] = 0x11; + ucs->bchars[5] = 0x13; +- ucs->bulk_out_buffer = NULL; +- ucs->bulk_out_urb = NULL; +- ucs->read_urb = NULL; + tasklet_init(&cs->write_tasklet, + gigaset_modem_fill, (unsigned long) cs); + +@@ -685,6 +681,11 @@ static int gigaset_probe(struct usb_interface *interface, + return -ENODEV; + } + ++ if (hostif->desc.bNumEndpoints < 2) { ++ dev_err(&interface->dev, "missing endpoints\n"); ++ return -ENODEV; ++ } ++ + dev_info(&udev->dev, "%s: Device matched ... !\n", __func__); + + /* allocate memory for our device state and initialize it */ +@@ -704,6 +705,12 @@ static int gigaset_probe(struct usb_interface *interface, + + endpoint = &hostif->endpoint[0].desc; + ++ if (!usb_endpoint_is_bulk_out(endpoint)) { ++ dev_err(&interface->dev, "missing bulk-out endpoint\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ + buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); + ucs->bulk_out_size = buffer_size; + ucs->bulk_out_epnum = usb_endpoint_num(endpoint); +@@ -723,6 +730,12 @@ static int gigaset_probe(struct usb_interface *interface, + + endpoint = &hostif->endpoint[1].desc; + ++ if (!usb_endpoint_is_int_in(endpoint)) { ++ dev_err(&interface->dev, "missing int-in endpoint\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ + ucs->busy = 0; + + ucs->read_urb = usb_alloc_urb(0, GFP_KERNEL); +diff --git a/drivers/staging/media/hantro/hantro_g1_h264_dec.c b/drivers/staging/media/hantro/hantro_g1_h264_dec.c +index 7ab534936843..636bf972adcf 100644 +--- a/drivers/staging/media/hantro/hantro_g1_h264_dec.c ++++ b/drivers/staging/media/hantro/hantro_g1_h264_dec.c +@@ -34,9 +34,11 @@ static void set_params(struct hantro_ctx *ctx) + reg = G1_REG_DEC_CTRL0_DEC_AXI_WR_ID(0x0); + if (sps->flags & V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD) + reg |= G1_REG_DEC_CTRL0_SEQ_MBAFF_E; +- reg |= G1_REG_DEC_CTRL0_PICORD_COUNT_E; +- if (dec_param->nal_ref_idc) +- reg |= G1_REG_DEC_CTRL0_WRITE_MVS_E; ++ if (sps->profile_idc > 66) { ++ reg |= G1_REG_DEC_CTRL0_PICORD_COUNT_E; ++ if (dec_param->nal_ref_idc) ++ reg |= G1_REG_DEC_CTRL0_WRITE_MVS_E; ++ } + + if (!(sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY) && + (sps->flags & V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD || +@@ -246,7 +248,7 @@ static void set_buffers(struct hantro_ctx *ctx) + vdpu_write_relaxed(vpu, dst_dma, G1_REG_ADDR_DST); + + /* Higher profiles require DMV buffer appended to reference frames. */ +- if (ctrls->sps->profile_idc > 66) { ++ if (ctrls->sps->profile_idc > 66 && ctrls->decode->nal_ref_idc) { + size_t pic_size = ctx->h264_dec.pic_size; + size_t mv_offset = round_up(pic_size, 8); + +diff --git a/drivers/staging/media/hantro/hantro_v4l2.c b/drivers/staging/media/hantro/hantro_v4l2.c +index 3dae52abb96c..fcf95c1d39ca 100644 +--- a/drivers/staging/media/hantro/hantro_v4l2.c ++++ b/drivers/staging/media/hantro/hantro_v4l2.c +@@ -367,19 +367,26 @@ vidioc_s_fmt_out_mplane(struct file *file, void *priv, struct v4l2_format *f) + { + struct v4l2_pix_format_mplane *pix_mp = &f->fmt.pix_mp; + struct hantro_ctx *ctx = fh_to_ctx(priv); ++ struct vb2_queue *vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type); + const struct hantro_fmt *formats; + unsigned int num_fmts; +- struct vb2_queue *vq; + int ret; + +- /* Change not allowed if queue is busy. */ +- vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type); +- if (vb2_is_busy(vq)) +- return -EBUSY; ++ ret = vidioc_try_fmt_out_mplane(file, priv, f); ++ if (ret) ++ return ret; + + if (!hantro_is_encoder_ctx(ctx)) { + struct vb2_queue *peer_vq; + ++ /* ++ * In order to support dynamic resolution change, ++ * the decoder admits a resolution change, as long ++ * as the pixelformat remains. Can't be done if streaming. ++ */ ++ if (vb2_is_streaming(vq) || (vb2_is_busy(vq) && ++ pix_mp->pixelformat != ctx->src_fmt.pixelformat)) ++ return -EBUSY; + /* + * Since format change on the OUTPUT queue will reset + * the CAPTURE queue, we can't allow doing so +@@ -389,12 +396,15 @@ vidioc_s_fmt_out_mplane(struct file *file, void *priv, struct v4l2_format *f) + V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); + if (vb2_is_busy(peer_vq)) + return -EBUSY; ++ } else { ++ /* ++ * The encoder doesn't admit a format change if ++ * there are OUTPUT buffers allocated. ++ */ ++ if (vb2_is_busy(vq)) ++ return -EBUSY; + } + +- ret = vidioc_try_fmt_out_mplane(file, priv, f); +- if (ret) +- return ret; +- + formats = hantro_get_formats(ctx, &num_fmts); + ctx->vpu_src_fmt = hantro_find_format(formats, num_fmts, + pix_mp->pixelformat); +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index 4fac9dca798e..a7cac0719b8b 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -70,7 +70,7 @@ static struct dvobj_priv *usb_dvobj_init(struct usb_interface *usb_intf) + phost_conf = pusbd->actconfig; + pconf_desc = &phost_conf->desc; + +- phost_iface = &usb_intf->altsetting[0]; ++ phost_iface = usb_intf->cur_altsetting; + piface_desc = &phost_iface->desc; + + pdvobjpriv->NumInterfaces = pconf_desc->bNumInterfaces; +diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c +index ba1288297ee4..a87562f632a7 100644 +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -247,7 +247,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter) + + pdvobjpriv->padapter = padapter; + padapter->eeprom_address_size = 6; +- phost_iface = &pintf->altsetting[0]; ++ phost_iface = pintf->cur_altsetting; + piface_desc = &phost_iface->desc; + pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints; + if (pusbd->speed == USB_SPEED_HIGH) { +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +index b1595b13dea8..af6bf0736b52 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +@@ -3299,7 +3299,7 @@ static int __init vchiq_driver_init(void) + return 0; + + region_unregister: +- platform_driver_unregister(&vchiq_driver); ++ unregister_chrdev_region(vchiq_devid, 1); + + class_destroy: + class_destroy(vchiq_class); +diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c +index 8b0ea8c70d73..635cf0466b59 100644 +--- a/drivers/usb/atm/ueagle-atm.c ++++ b/drivers/usb/atm/ueagle-atm.c +@@ -2124,10 +2124,11 @@ resubmit: + /* + * Start the modem : init the data and start kernel thread + */ +-static int uea_boot(struct uea_softc *sc) ++static int uea_boot(struct uea_softc *sc, struct usb_interface *intf) + { +- int ret, size; + struct intr_pkt *intr; ++ int ret = -ENOMEM; ++ int size; + + uea_enters(INS_TO_USBDEV(sc)); + +@@ -2152,6 +2153,11 @@ static int uea_boot(struct uea_softc *sc) + if (UEA_CHIP_VERSION(sc) == ADI930) + load_XILINX_firmware(sc); + ++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) { ++ ret = -ENODEV; ++ goto err0; ++ } ++ + intr = kmalloc(size, GFP_KERNEL); + if (!intr) + goto err0; +@@ -2163,8 +2169,7 @@ static int uea_boot(struct uea_softc *sc) + usb_fill_int_urb(sc->urb_int, sc->usb_dev, + usb_rcvintpipe(sc->usb_dev, UEA_INTR_PIPE), + intr, size, uea_intr, sc, +- sc->usb_dev->actconfig->interface[0]->altsetting[0]. +- endpoint[0].desc.bInterval); ++ intf->cur_altsetting->endpoint[0].desc.bInterval); + + ret = usb_submit_urb(sc->urb_int, GFP_KERNEL); + if (ret < 0) { +@@ -2179,6 +2184,7 @@ static int uea_boot(struct uea_softc *sc) + sc->kthread = kthread_create(uea_kthread, sc, "ueagle-atm"); + if (IS_ERR(sc->kthread)) { + uea_err(INS_TO_USBDEV(sc), "failed to create thread\n"); ++ ret = PTR_ERR(sc->kthread); + goto err2; + } + +@@ -2193,7 +2199,7 @@ err1: + kfree(intr); + err0: + uea_leaves(INS_TO_USBDEV(sc)); +- return -ENOMEM; ++ return ret; + } + + /* +@@ -2548,7 +2554,7 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf, + } + } + +- ret = uea_boot(sc); ++ ret = uea_boot(sc, intf); + if (ret < 0) + goto error; + +diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c +index 87338f9eb5be..ed204cbb63ea 100644 +--- a/drivers/usb/common/usb-conn-gpio.c ++++ b/drivers/usb/common/usb-conn-gpio.c +@@ -156,7 +156,8 @@ static int usb_conn_probe(struct platform_device *pdev) + + info->vbus = devm_regulator_get(dev, "vbus"); + if (IS_ERR(info->vbus)) { +- dev_err(dev, "failed to get vbus\n"); ++ if (PTR_ERR(info->vbus) != -EPROBE_DEFER) ++ dev_err(dev, "failed to get vbus\n"); + return PTR_ERR(info->vbus); + } + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 236313f41f4a..dfe9ac8d2375 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5814,7 +5814,7 @@ re_enumerate_no_bos: + + /** + * usb_reset_device - warn interface drivers and perform a USB port reset +- * @udev: device to reset (not in SUSPENDED or NOTATTACHED state) ++ * @udev: device to reset (not in NOTATTACHED state) + * + * Warns all drivers bound to registered interfaces (using their pre_reset + * method), performs the port reset, and then lets the drivers know that +@@ -5842,8 +5842,7 @@ int usb_reset_device(struct usb_device *udev) + struct usb_host_config *config = udev->actconfig; + struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); + +- if (udev->state == USB_STATE_NOTATTACHED || +- udev->state == USB_STATE_SUSPENDED) { ++ if (udev->state == USB_STATE_NOTATTACHED) { + dev_dbg(&udev->dev, "device reset not allowed in state %d\n", + udev->state); + return -EINVAL; +diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c +index 0eab79f82ce4..da923ec17612 100644 +--- a/drivers/usb/core/urb.c ++++ b/drivers/usb/core/urb.c +@@ -45,6 +45,7 @@ void usb_init_urb(struct urb *urb) + if (urb) { + memset(urb, 0, sizeof(*urb)); + kref_init(&urb->kref); ++ INIT_LIST_HEAD(&urb->urb_list); + INIT_LIST_HEAD(&urb->anchor_list); + } + } +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 023f0357efd7..294276f7deb9 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -29,7 +29,8 @@ + #define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa + #define PCI_DEVICE_ID_INTEL_APL 0x5aaa + #define PCI_DEVICE_ID_INTEL_KBP 0xa2b0 +-#define PCI_DEVICE_ID_INTEL_CMLH 0x02ee ++#define PCI_DEVICE_ID_INTEL_CMLLP 0x02ee ++#define PCI_DEVICE_ID_INTEL_CMLH 0x06ee + #define PCI_DEVICE_ID_INTEL_GLK 0x31aa + #define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee + #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e +@@ -308,6 +309,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MRFLD), + (kernel_ulong_t) &dwc3_pci_mrfld_properties, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLLP), ++ (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLH), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index 3996b9c4ff8d..fd1b100d2927 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -1117,6 +1117,9 @@ static void dwc3_ep0_xfernotready(struct dwc3 *dwc, + void dwc3_ep0_interrupt(struct dwc3 *dwc, + const struct dwc3_event_depevt *event) + { ++ struct dwc3_ep *dep = dwc->eps[event->endpoint_number]; ++ u8 cmd; ++ + switch (event->endpoint_event) { + case DWC3_DEPEVT_XFERCOMPLETE: + dwc3_ep0_xfer_complete(dwc, event); +@@ -1129,7 +1132,12 @@ void dwc3_ep0_interrupt(struct dwc3 *dwc, + case DWC3_DEPEVT_XFERINPROGRESS: + case DWC3_DEPEVT_RXTXFIFOEVT: + case DWC3_DEPEVT_STREAMEVT: ++ break; + case DWC3_DEPEVT_EPCMDCMPLT: ++ cmd = DEPEVT_PARAMETER_CMD(event->parameters); ++ ++ if (cmd == DWC3_DEPCMD_ENDTRANSFER) ++ dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + break; + } + } +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index a9aba716bf80..0c960a97ea02 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2491,7 +2491,7 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep, + + req->request.actual = req->request.length - req->remaining; + +- if (!dwc3_gadget_ep_request_completed(req) && ++ if (!dwc3_gadget_ep_request_completed(req) || + req->num_pending_sgs) { + __dwc3_gadget_kick_transfer(dep); + goto out; +@@ -2719,6 +2719,9 @@ static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, + WARN_ON_ONCE(ret); + dep->resource_index = 0; + ++ if (!interrupt) ++ dep->flags &= ~DWC3_EP_TRANSFER_STARTED; ++ + if (dwc3_is_usb31(dwc) || dwc->revision < DWC3_REVISION_310A) + udelay(100); + } +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 33852c2b29d1..ab9ac48a751a 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1544,6 +1544,7 @@ static struct config_group *gadgets_make( + gi->composite.resume = NULL; + gi->composite.max_speed = USB_SPEED_SUPER; + ++ spin_lock_init(&gi->spinlock); + mutex_init(&gi->lock); + INIT_LIST_HEAD(&gi->string_list); + INIT_LIST_HEAD(&gi->available_func); +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index 3d499d93c083..a8f1e5707c14 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -2725,7 +2725,7 @@ static struct platform_driver dummy_hcd_driver = { + }; + + /*-------------------------------------------------------------------------*/ +-#define MAX_NUM_UDC 2 ++#define MAX_NUM_UDC 32 + static struct platform_device *the_udc_pdev[MAX_NUM_UDC]; + static struct platform_device *the_hcd_pdev[MAX_NUM_UDC]; + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 265dab2bbfac..3344fb8c4181 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -1519,7 +1519,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev, + td = phys_to_virt(addr); + addr2 = (dma_addr_t)td->next; + dma_pool_free(dev->data_requests, td, addr); +- td->next = 0x00; + addr = addr2; + } + req->chain_len = 1; +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index b7d23c438756..7a3a29e5e9d2 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -806,7 +806,7 @@ static void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, + + static int xhci_handle_usb2_port_link_resume(struct xhci_port *port, + u32 *status, u32 portsc, +- unsigned long flags) ++ unsigned long *flags) + { + struct xhci_bus_state *bus_state; + struct xhci_hcd *xhci; +@@ -860,11 +860,11 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port, + xhci_test_and_clear_bit(xhci, port, PORT_PLC); + xhci_set_link_state(xhci, port, XDEV_U0); + +- spin_unlock_irqrestore(&xhci->lock, flags); ++ spin_unlock_irqrestore(&xhci->lock, *flags); + time_left = wait_for_completion_timeout( + &bus_state->rexit_done[wIndex], + msecs_to_jiffies(XHCI_MAX_REXIT_TIMEOUT_MS)); +- spin_lock_irqsave(&xhci->lock, flags); ++ spin_lock_irqsave(&xhci->lock, *flags); + + if (time_left) { + slot_id = xhci_find_slot_id_by_port(hcd, xhci, +@@ -920,11 +920,13 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status, + { + struct xhci_bus_state *bus_state; + struct xhci_hcd *xhci; ++ struct usb_hcd *hcd; + u32 link_state; + u32 portnum; + + bus_state = &port->rhub->bus_state; + xhci = hcd_to_xhci(port->rhub->hcd); ++ hcd = port->rhub->hcd; + link_state = portsc & PORT_PLS_MASK; + portnum = port->hcd_portnum; + +@@ -952,12 +954,20 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status, + bus_state->suspended_ports &= ~(1 << portnum); + } + ++ /* remote wake resume signaling complete */ ++ if (bus_state->port_remote_wakeup & (1 << portnum) && ++ link_state != XDEV_RESUME && ++ link_state != XDEV_RECOVERY) { ++ bus_state->port_remote_wakeup &= ~(1 << portnum); ++ usb_hcd_end_port_resume(&hcd->self, portnum); ++ } ++ + xhci_hub_report_usb3_link_state(xhci, status, portsc); + xhci_del_comp_mod_timer(xhci, portsc, portnum); + } + + static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status, +- u32 portsc, unsigned long flags) ++ u32 portsc, unsigned long *flags) + { + struct xhci_bus_state *bus_state; + u32 link_state; +@@ -1007,7 +1017,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status, + static u32 xhci_get_port_status(struct usb_hcd *hcd, + struct xhci_bus_state *bus_state, + u16 wIndex, u32 raw_port_status, +- unsigned long flags) ++ unsigned long *flags) + __releases(&xhci->lock) + __acquires(&xhci->lock) + { +@@ -1130,7 +1140,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + } + trace_xhci_get_port_status(wIndex, temp); + status = xhci_get_port_status(hcd, bus_state, wIndex, temp, +- flags); ++ &flags); + if (status == 0xffffffff) + goto error; + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index e16eda6e2b8b..3b1388fa2f36 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1909,13 +1909,17 @@ no_bw: + xhci->usb3_rhub.num_ports = 0; + xhci->num_active_eps = 0; + kfree(xhci->usb2_rhub.ports); ++ kfree(xhci->usb2_rhub.psi); + kfree(xhci->usb3_rhub.ports); ++ kfree(xhci->usb3_rhub.psi); + kfree(xhci->hw_ports); + kfree(xhci->rh_bw); + kfree(xhci->ext_caps); + + xhci->usb2_rhub.ports = NULL; ++ xhci->usb2_rhub.psi = NULL; + xhci->usb3_rhub.ports = NULL; ++ xhci->usb3_rhub.psi = NULL; + xhci->hw_ports = NULL; + xhci->rh_bw = NULL; + xhci->ext_caps = NULL; +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 1e0236e90687..1904ef56f61c 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -519,6 +519,18 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + } + #endif /* CONFIG_PM */ + ++static void xhci_pci_shutdown(struct usb_hcd *hcd) ++{ ++ struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ struct pci_dev *pdev = to_pci_dev(hcd->self.controller); ++ ++ xhci_shutdown(hcd); ++ ++ /* Yet another workaround for spurious wakeups at shutdown with HSW */ ++ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) ++ pci_set_power_state(pdev, PCI_D3hot); ++} ++ + /*-------------------------------------------------------------------------*/ + + /* PCI driver selection metadata; PCI hotplugging uses this */ +@@ -554,6 +566,7 @@ static int __init xhci_pci_init(void) + #ifdef CONFIG_PM + xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend; + xhci_pci_hc_driver.pci_resume = xhci_pci_resume; ++ xhci_pci_hc_driver.shutdown = xhci_pci_shutdown; + #endif + return pci_register_driver(&xhci_pci_driver); + } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index e7aab31fd9a5..4a2fe56940bd 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1624,7 +1624,6 @@ static void handle_port_status(struct xhci_hcd *xhci, + slot_id = xhci_find_slot_id_by_port(hcd, xhci, hcd_portnum + 1); + if (slot_id && xhci->devs[slot_id]) + xhci->devs[slot_id]->flags |= VDEV_PORT_ERROR; +- bus_state->port_remote_wakeup &= ~(1 << hcd_portnum); + } + + if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_RESUME) { +@@ -1644,6 +1643,7 @@ static void handle_port_status(struct xhci_hcd *xhci, + */ + bus_state->port_remote_wakeup |= 1 << hcd_portnum; + xhci_test_and_clear_bit(xhci, port, PORT_PLC); ++ usb_hcd_start_port_resume(&hcd->self, hcd_portnum); + xhci_set_link_state(xhci, port, XDEV_U0); + /* Need to wait until the next link state change + * indicates the device is actually in U0. +@@ -1684,7 +1684,6 @@ static void handle_port_status(struct xhci_hcd *xhci, + if (slot_id && xhci->devs[slot_id]) + xhci_ring_device(xhci, slot_id); + if (bus_state->port_remote_wakeup & (1 << hcd_portnum)) { +- bus_state->port_remote_wakeup &= ~(1 << hcd_portnum); + xhci_test_and_clear_bit(xhci, port, PORT_PLC); + usb_wakeup_notification(hcd->self.root_hub, + hcd_portnum + 1); +@@ -2378,7 +2377,8 @@ static int handle_tx_event(struct xhci_hcd *xhci, + case COMP_SUCCESS: + if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) + break; +- if (xhci->quirks & XHCI_TRUST_TX_LENGTH) ++ if (xhci->quirks & XHCI_TRUST_TX_LENGTH || ++ ep_ring->last_td_was_short) + trb_comp_code = COMP_SHORT_PACKET; + else + xhci_warn_ratelimited(xhci, +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index 2ff7c911fbd0..dc172513a4aa 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -755,7 +755,6 @@ static int tegra_xusb_runtime_suspend(struct device *dev) + { + struct tegra_xusb *tegra = dev_get_drvdata(dev); + +- tegra_xusb_phy_disable(tegra); + regulator_bulk_disable(tegra->soc->num_supplies, tegra->supplies); + tegra_xusb_clk_disable(tegra); + +@@ -779,16 +778,8 @@ static int tegra_xusb_runtime_resume(struct device *dev) + goto disable_clk; + } + +- err = tegra_xusb_phy_enable(tegra); +- if (err < 0) { +- dev_err(dev, "failed to enable PHYs: %d\n", err); +- goto disable_regulator; +- } +- + return 0; + +-disable_regulator: +- regulator_bulk_disable(tegra->soc->num_supplies, tegra->supplies); + disable_clk: + tegra_xusb_clk_disable(tegra); + return err; +@@ -1181,6 +1172,12 @@ static int tegra_xusb_probe(struct platform_device *pdev) + */ + platform_set_drvdata(pdev, tegra); + ++ err = tegra_xusb_phy_enable(tegra); ++ if (err < 0) { ++ dev_err(&pdev->dev, "failed to enable PHYs: %d\n", err); ++ goto put_hcd; ++ } ++ + pm_runtime_enable(&pdev->dev); + if (pm_runtime_enabled(&pdev->dev)) + err = pm_runtime_get_sync(&pdev->dev); +@@ -1189,7 +1186,7 @@ static int tegra_xusb_probe(struct platform_device *pdev) + + if (err < 0) { + dev_err(&pdev->dev, "failed to enable device: %d\n", err); +- goto disable_rpm; ++ goto disable_phy; + } + + tegra_xusb_config(tegra, regs); +@@ -1275,9 +1272,11 @@ remove_usb2: + put_rpm: + if (!pm_runtime_status_suspended(&pdev->dev)) + tegra_xusb_runtime_suspend(&pdev->dev); +-disable_rpm: +- pm_runtime_disable(&pdev->dev); ++put_hcd: + usb_put_hcd(tegra->hcd); ++disable_phy: ++ tegra_xusb_phy_disable(tegra); ++ pm_runtime_disable(&pdev->dev); + put_powerdomains: + if (!of_property_read_bool(pdev->dev.of_node, "power-domains")) { + tegra_powergate_power_off(TEGRA_POWERGATE_XUSBC); +@@ -1314,6 +1313,8 @@ static int tegra_xusb_remove(struct platform_device *pdev) + tegra_xusb_powerdomain_remove(&pdev->dev, tegra); + } + ++ tegra_xusb_phy_disable(tegra); ++ + tegra_xusb_padctl_put(tegra->padctl); + + return 0; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 6c17e3fe181a..9b3b1b16eafb 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -770,7 +770,7 @@ static void xhci_stop(struct usb_hcd *hcd) + * + * This will only ever be called with the main usb_hcd (the USB3 roothub). + */ +-static void xhci_shutdown(struct usb_hcd *hcd) ++void xhci_shutdown(struct usb_hcd *hcd) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + +@@ -789,11 +789,8 @@ static void xhci_shutdown(struct usb_hcd *hcd) + xhci_dbg_trace(xhci, trace_xhci_dbg_init, + "xhci_shutdown completed - status = %x", + readl(&xhci->op_regs->status)); +- +- /* Yet another workaround for spurious wakeups at shutdown with HSW */ +- if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) +- pci_set_power_state(to_pci_dev(hcd->self.sysdev), PCI_D3hot); + } ++EXPORT_SYMBOL_GPL(xhci_shutdown); + + #ifdef CONFIG_PM + static void xhci_save_registers(struct xhci_hcd *xhci) +@@ -973,7 +970,7 @@ static bool xhci_pending_portevent(struct xhci_hcd *xhci) + int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) + { + int rc = 0; +- unsigned int delay = XHCI_MAX_HALT_USEC; ++ unsigned int delay = XHCI_MAX_HALT_USEC * 2; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + u32 command; + u32 res; +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index f9f88626a57a..973d665052a2 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -2050,6 +2050,7 @@ int xhci_start(struct xhci_hcd *xhci); + int xhci_reset(struct xhci_hcd *xhci); + int xhci_run(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); ++void xhci_shutdown(struct usb_hcd *hcd); + void xhci_init_driver(struct hc_driver *drv, + const struct xhci_driver_overrides *over); + int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); +diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c +index 6f5edb9fc61e..d8d157c4c271 100644 +--- a/drivers/usb/misc/adutux.c ++++ b/drivers/usb/misc/adutux.c +@@ -669,7 +669,7 @@ static int adu_probe(struct usb_interface *interface, + init_waitqueue_head(&dev->read_wait); + init_waitqueue_head(&dev->write_wait); + +- res = usb_find_common_endpoints_reverse(&interface->altsetting[0], ++ res = usb_find_common_endpoints_reverse(interface->cur_altsetting, + NULL, NULL, + &dev->interrupt_in_endpoint, + &dev->interrupt_out_endpoint); +diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c +index 20b0f91a5d9b..bb24527f3c70 100644 +--- a/drivers/usb/misc/idmouse.c ++++ b/drivers/usb/misc/idmouse.c +@@ -337,7 +337,7 @@ static int idmouse_probe(struct usb_interface *interface, + int result; + + /* check if we have gotten the data or the hid interface */ +- iface_desc = &interface->altsetting[0]; ++ iface_desc = interface->cur_altsetting; + if (iface_desc->desc.bInterfaceClass != 0x0A) + return -ENODEV; + +diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c +index ac2b4fcc265f..f48a23adbc35 100644 +--- a/drivers/usb/mon/mon_bin.c ++++ b/drivers/usb/mon/mon_bin.c +@@ -1039,12 +1039,18 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg + + mutex_lock(&rp->fetch_lock); + spin_lock_irqsave(&rp->b_lock, flags); +- mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE); +- kfree(rp->b_vec); +- rp->b_vec = vec; +- rp->b_size = size; +- rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0; +- rp->cnt_lost = 0; ++ if (rp->mmap_active) { ++ mon_free_buff(vec, size/CHUNK_SIZE); ++ kfree(vec); ++ ret = -EBUSY; ++ } else { ++ mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE); ++ kfree(rp->b_vec); ++ rp->b_vec = vec; ++ rp->b_size = size; ++ rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0; ++ rp->cnt_lost = 0; ++ } + spin_unlock_irqrestore(&rp->b_lock, flags); + mutex_unlock(&rp->fetch_lock); + } +@@ -1216,13 +1222,21 @@ mon_bin_poll(struct file *file, struct poll_table_struct *wait) + static void mon_bin_vma_open(struct vm_area_struct *vma) + { + struct mon_reader_bin *rp = vma->vm_private_data; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&rp->b_lock, flags); + rp->mmap_active++; ++ spin_unlock_irqrestore(&rp->b_lock, flags); + } + + static void mon_bin_vma_close(struct vm_area_struct *vma) + { ++ unsigned long flags; ++ + struct mon_reader_bin *rp = vma->vm_private_data; ++ spin_lock_irqsave(&rp->b_lock, flags); + rp->mmap_active--; ++ spin_unlock_irqrestore(&rp->b_lock, flags); + } + + /* +@@ -1234,16 +1248,12 @@ static vm_fault_t mon_bin_vma_fault(struct vm_fault *vmf) + unsigned long offset, chunk_idx; + struct page *pageptr; + +- mutex_lock(&rp->fetch_lock); + offset = vmf->pgoff << PAGE_SHIFT; +- if (offset >= rp->b_size) { +- mutex_unlock(&rp->fetch_lock); ++ if (offset >= rp->b_size) + return VM_FAULT_SIGBUS; +- } + chunk_idx = offset / CHUNK_SIZE; + pageptr = rp->b_vec[chunk_idx].pg; + get_page(pageptr); +- mutex_unlock(&rp->fetch_lock); + vmf->page = pageptr; + return 0; + } +diff --git a/drivers/usb/roles/class.c b/drivers/usb/roles/class.c +index 94b4e7db2b94..97e3d75b19a3 100644 +--- a/drivers/usb/roles/class.c ++++ b/drivers/usb/roles/class.c +@@ -169,8 +169,8 @@ EXPORT_SYMBOL_GPL(fwnode_usb_role_switch_get); + void usb_role_switch_put(struct usb_role_switch *sw) + { + if (!IS_ERR_OR_NULL(sw)) { +- put_device(&sw->dev); + module_put(sw->dev.parent->driver->owner); ++ put_device(&sw->dev); + } + } + EXPORT_SYMBOL_GPL(usb_role_switch_put); +diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c +index 48a439298a68..9690a5f4b9d6 100644 +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2901,16 +2901,18 @@ static int edge_startup(struct usb_serial *serial) + response = 0; + + if (edge_serial->is_epic) { ++ struct usb_host_interface *alt; ++ ++ alt = serial->interface->cur_altsetting; ++ + /* EPIC thing, set up our interrupt polling now and our read + * urb, so that the device knows it really is connected. */ + interrupt_in_found = bulk_in_found = bulk_out_found = false; +- for (i = 0; i < serial->interface->altsetting[0] +- .desc.bNumEndpoints; ++i) { ++ for (i = 0; i < alt->desc.bNumEndpoints; ++i) { + struct usb_endpoint_descriptor *endpoint; + int buffer_size; + +- endpoint = &serial->interface->altsetting[0]. +- endpoint[i].desc; ++ endpoint = &alt->endpoint[i].desc; + buffer_size = usb_endpoint_maxp(endpoint); + if (!interrupt_in_found && + (usb_endpoint_is_int_in(endpoint))) { +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 34538253f12c..475b9c692827 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -825,6 +825,10 @@ static int uas_slave_configure(struct scsi_device *sdev) + sdev->wce_default_on = 1; + } + ++ /* Some disks cannot handle READ_CAPACITY_16 */ ++ if (devinfo->flags & US_FL_NO_READ_CAPACITY_16) ++ sdev->no_read_capacity_16 = 1; ++ + /* + * Some disks return the total number of blocks in response + * to READ CAPACITY rather than the highest block number. +@@ -833,6 +837,12 @@ static int uas_slave_configure(struct scsi_device *sdev) + if (devinfo->flags & US_FL_FIX_CAPACITY) + sdev->fix_capacity = 1; + ++ /* ++ * in some cases we have to guess ++ */ ++ if (devinfo->flags & US_FL_CAPACITY_HEURISTICS) ++ sdev->guess_capacity = 1; ++ + /* + * Some devices don't like MODE SENSE with page=0x3f, + * which is the command used for checking if a device +diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c +index 94a3eda62add..a400b65cf17b 100644 +--- a/drivers/usb/typec/class.c ++++ b/drivers/usb/typec/class.c +@@ -1592,14 +1592,16 @@ struct typec_port *typec_register_port(struct device *parent, + + port->sw = typec_switch_get(&port->dev); + if (IS_ERR(port->sw)) { ++ ret = PTR_ERR(port->sw); + put_device(&port->dev); +- return ERR_CAST(port->sw); ++ return ERR_PTR(ret); + } + + port->mux = typec_mux_get(&port->dev, NULL); + if (IS_ERR(port->mux)) { ++ ret = PTR_ERR(port->mux); + put_device(&port->dev); +- return ERR_CAST(port->mux); ++ return ERR_PTR(ret); + } + + ret = device_add(&port->dev); +diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c +index b939bc28d886..9c82e2a0a411 100644 +--- a/drivers/video/hdmi.c ++++ b/drivers/video/hdmi.c +@@ -1576,12 +1576,12 @@ static int hdmi_avi_infoframe_unpack(struct hdmi_avi_infoframe *frame, + if (ptr[0] & 0x10) + frame->active_aspect = ptr[1] & 0xf; + if (ptr[0] & 0x8) { +- frame->top_bar = (ptr[5] << 8) + ptr[6]; +- frame->bottom_bar = (ptr[7] << 8) + ptr[8]; ++ frame->top_bar = (ptr[6] << 8) | ptr[5]; ++ frame->bottom_bar = (ptr[8] << 8) | ptr[7]; + } + if (ptr[0] & 0x4) { +- frame->left_bar = (ptr[9] << 8) + ptr[10]; +- frame->right_bar = (ptr[11] << 8) + ptr[12]; ++ frame->left_bar = (ptr[10] << 8) | ptr[9]; ++ frame->right_bar = (ptr[12] << 8) | ptr[11]; + } + frame->scan_mode = ptr[0] & 0x3; + +diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c +index e05679c478e2..9f4117766bb1 100644 +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -721,6 +721,17 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, + + get_page(newpage); /* balloon reference */ + ++ /* ++ * When we migrate a page to a different zone and adjusted the ++ * managed page count when inflating, we have to fixup the count of ++ * both involved zones. ++ */ ++ if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM) && ++ page_zone(page) != page_zone(newpage)) { ++ adjust_managed_page_count(page, 1); ++ adjust_managed_page_count(newpage, -1); ++ } ++ + /* balloon's page migration 1st step -- inflate "newpage" */ + spin_lock_irqsave(&vb_dev_info->pages_lock, flags); + balloon_page_insert(vb_dev_info, newpage); +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 670700cb1110..0d2da2366869 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -2662,7 +2662,7 @@ int btrfs_update_block_group(struct btrfs_trans_handle *trans, + * is because we need the unpinning stage to actually add the + * space back to the block group, otherwise we will leak space. + */ +- if (!alloc && cache->cached == BTRFS_CACHE_NO) ++ if (!alloc && !btrfs_block_group_cache_done(cache)) + btrfs_cache_block_group(cache, 1); + + byte_in_group = bytenr - cache->key.objectid; +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 1f7f39b10bd0..57a9ad3e8c29 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1949,12 +1949,19 @@ void btrfs_kill_all_delayed_nodes(struct btrfs_root *root) + } + + inode_id = delayed_nodes[n - 1]->inode_id + 1; +- +- for (i = 0; i < n; i++) +- refcount_inc(&delayed_nodes[i]->refs); ++ for (i = 0; i < n; i++) { ++ /* ++ * Don't increase refs in case the node is dead and ++ * about to be removed from the tree in the loop below ++ */ ++ if (!refcount_inc_not_zero(&delayed_nodes[i]->refs)) ++ delayed_nodes[i] = NULL; ++ } + spin_unlock(&root->inode_lock); + + for (i = 0; i < n; i++) { ++ if (!delayed_nodes[i]) ++ continue; + __btrfs_kill_delayed_node(delayed_nodes[i]); + btrfs_release_delayed_node(delayed_nodes[i]); + } +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index cceaf05aada2..4905f48587df 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4121,7 +4121,7 @@ retry: + for (i = 0; i < nr_pages; i++) { + struct page *page = pvec.pages[i]; + +- done_index = page->index; ++ done_index = page->index + 1; + /* + * At this point we hold neither the i_pages lock nor + * the page lock: the page may be truncated or +@@ -4156,16 +4156,6 @@ retry: + + ret = __extent_writepage(page, wbc, epd); + if (ret < 0) { +- /* +- * done_index is set past this page, +- * so media errors will not choke +- * background writeout for the entire +- * file. This has consequences for +- * range_cyclic semantics (ie. it may +- * not be suitable for data integrity +- * writeout). +- */ +- done_index = page->index + 1; + done = 1; + break; + } +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 435a502a3226..c332968f9056 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -1636,6 +1636,7 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb, + break; + } + ++ only_release_metadata = false; + sector_offset = pos & (fs_info->sectorsize - 1); + reserve_bytes = round_up(write_bytes + sector_offset, + fs_info->sectorsize); +@@ -1791,7 +1792,6 @@ again: + set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, + lockend, EXTENT_NORESERVE, NULL, + NULL, GFP_NOFS); +- only_release_metadata = false; + } + + btrfs_drop_pages(pages, num_pages); +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index d54dcd0ab230..d86ada9c3c54 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -385,6 +385,12 @@ static int io_ctl_prepare_pages(struct btrfs_io_ctl *io_ctl, struct inode *inode + if (uptodate && !PageUptodate(page)) { + btrfs_readpage(NULL, page); + lock_page(page); ++ if (page->mapping != inode->i_mapping) { ++ btrfs_err(BTRFS_I(inode)->root->fs_info, ++ "free space cache page truncated"); ++ io_ctl_drop_pages(io_ctl); ++ return -EIO; ++ } + if (!PageUptodate(page)) { + btrfs_err(BTRFS_I(inode)->root->fs_info, + "error reading free space cache"); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 015910079e73..10a01dd0c4e6 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2214,12 +2214,16 @@ again: + mapping_set_error(page->mapping, ret); + end_extent_writepage(page, ret, page_start, page_end); + ClearPageChecked(page); +- goto out; ++ goto out_reserved; + } + + ClearPageChecked(page); + set_page_dirty(page); ++out_reserved: + btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE); ++ if (ret) ++ btrfs_delalloc_release_space(inode, data_reserved, page_start, ++ PAGE_SIZE, true); + out: + unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end, + &cached_state); +@@ -9550,6 +9554,9 @@ static int btrfs_rename_exchange(struct inode *old_dir, + goto out_notrans; + } + ++ if (dest != root) ++ btrfs_record_root_in_trans(trans, dest); ++ + /* + * We need to find a free sequence number both in the source and + * in the destination directory for the exchange. +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 123ac54af071..518ec1265a0c 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -24,6 +24,14 @@ + #include "transaction.h" + #include "compression.h" + ++/* ++ * Maximum number of references an extent can have in order for us to attempt to ++ * issue clone operations instead of write operations. This currently exists to ++ * avoid hitting limitations of the backreference walking code (taking a lot of ++ * time and using too much memory for extents with large number of references). ++ */ ++#define SEND_MAX_EXTENT_REFS 64 ++ + /* + * A fs_path is a helper to dynamically build path names with unknown size. + * It reallocates the internal buffer on demand. +@@ -1302,6 +1310,7 @@ static int find_extent_clone(struct send_ctx *sctx, + struct clone_root *cur_clone_root; + struct btrfs_key found_key; + struct btrfs_path *tmp_path; ++ struct btrfs_extent_item *ei; + int compressed; + u32 i; + +@@ -1349,7 +1358,6 @@ static int find_extent_clone(struct send_ctx *sctx, + ret = extent_from_logical(fs_info, disk_byte, tmp_path, + &found_key, &flags); + up_read(&fs_info->commit_root_sem); +- btrfs_release_path(tmp_path); + + if (ret < 0) + goto out; +@@ -1358,6 +1366,21 @@ static int find_extent_clone(struct send_ctx *sctx, + goto out; + } + ++ ei = btrfs_item_ptr(tmp_path->nodes[0], tmp_path->slots[0], ++ struct btrfs_extent_item); ++ /* ++ * Backreference walking (iterate_extent_inodes() below) is currently ++ * too expensive when an extent has a large number of references, both ++ * in time spent and used memory. So for now just fallback to write ++ * operations instead of clone operations when an extent has more than ++ * a certain amount of references. ++ */ ++ if (btrfs_extent_refs(tmp_path->nodes[0], ei) > SEND_MAX_EXTENT_REFS) { ++ ret = -ENOENT; ++ goto out; ++ } ++ btrfs_release_path(tmp_path); ++ + /* + * Setup the clone roots. + */ +diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h +index a7da1f3e3627..5acf5c507ec2 100644 +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -330,7 +330,6 @@ struct btrfs_bio { + u64 map_type; /* get from map_lookup->type */ + bio_end_io_t *end_io; + struct bio *orig_bio; +- unsigned long flags; + void *private; + atomic_t error; + int max_errors; +diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c +index d17a789fd856..2e4764fd1872 100644 +--- a/fs/ceph/dir.c ++++ b/fs/ceph/dir.c +@@ -1809,6 +1809,7 @@ const struct file_operations ceph_dir_fops = { + .open = ceph_open, + .release = ceph_release, + .unlocked_ioctl = ceph_ioctl, ++ .compat_ioctl = compat_ptr_ioctl, + .fsync = ceph_fsync, + .lock = ceph_lock, + .flock = ceph_flock, +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 8de633964dc3..11929d2bb594 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -2188,7 +2188,7 @@ const struct file_operations ceph_file_fops = { + .splice_read = generic_file_splice_read, + .splice_write = iter_file_splice_write, + .unlocked_ioctl = ceph_ioctl, +- .compat_ioctl = ceph_ioctl, ++ .compat_ioctl = compat_ptr_ioctl, + .fallocate = ceph_fallocate, + .copy_file_range = ceph_copy_file_range, + }; +diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c +index a13a78725c57..b766c3ee5fa8 100644 +--- a/fs/erofs/xattr.c ++++ b/fs/erofs/xattr.c +@@ -649,6 +649,8 @@ ssize_t erofs_listxattr(struct dentry *dentry, + struct listxattr_iter it; + + ret = init_inode_xattrs(d_inode(dentry)); ++ if (ret == -ENOATTR) ++ return 0; + if (ret) + return ret; + +diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c +index 7004ce581a32..a16c53655e77 100644 +--- a/fs/ext2/inode.c ++++ b/fs/ext2/inode.c +@@ -701,10 +701,13 @@ static int ext2_get_blocks(struct inode *inode, + if (!partial) { + count++; + mutex_unlock(&ei->truncate_mutex); +- if (err) +- goto cleanup; + goto got_it; + } ++ ++ if (err) { ++ mutex_unlock(&ei->truncate_mutex); ++ goto cleanup; ++ } + } + + /* +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 764ff4c56233..564e2ceb8417 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -265,13 +265,8 @@ void ext4_free_inode(handle_t *handle, struct inode *inode) + ext4_debug("freeing inode %lu\n", ino); + trace_ext4_free_inode(inode); + +- /* +- * Note: we must free any quota before locking the superblock, +- * as writing the quota to disk may need the lock as well. +- */ + dquot_initialize(inode); + dquot_free_inode(inode); +- dquot_drop(inode); + + is_directory = S_ISDIR(inode->i_mode); + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index d691d1783ed6..91da21890360 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -196,7 +196,12 @@ void ext4_evict_inode(struct inode *inode) + { + handle_t *handle; + int err; +- int extra_credits = 3; ++ /* ++ * Credits for final inode cleanup and freeing: ++ * sb + inode (ext4_orphan_del()), block bitmap, group descriptor ++ * (xattr block freeing), bitmap, group descriptor (inode freeing) ++ */ ++ int extra_credits = 6; + struct ext4_xattr_inode_array *ea_inode_array = NULL; + + trace_ext4_evict_inode(inode); +@@ -252,8 +257,12 @@ void ext4_evict_inode(struct inode *inode) + if (!IS_NOQUOTA(inode)) + extra_credits += EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb); + ++ /* ++ * Block bitmap, group descriptor, and inode are accounted in both ++ * ext4_blocks_for_truncate() and extra_credits. So subtract 3. ++ */ + handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, +- ext4_blocks_for_truncate(inode)+extra_credits); ++ ext4_blocks_for_truncate(inode) + extra_credits - 3); + if (IS_ERR(handle)) { + ext4_std_error(inode->i_sb, PTR_ERR(handle)); + /* +@@ -5450,11 +5459,15 @@ static void ext4_wait_for_tail_page_commit(struct inode *inode) + + offset = inode->i_size & (PAGE_SIZE - 1); + /* +- * All buffers in the last page remain valid? Then there's nothing to +- * do. We do the check mainly to optimize the common PAGE_SIZE == +- * blocksize case ++ * If the page is fully truncated, we don't need to wait for any commit ++ * (and we even should not as __ext4_journalled_invalidatepage() may ++ * strip all buffers from the page but keep the page dirty which can then ++ * confuse e.g. concurrent ext4_writepage() seeing dirty page without ++ * buffers). Also we don't need to wait for any commit if all buffers in ++ * the page remain valid. This is most beneficial for the common case of ++ * blocksize == PAGESIZE. + */ +- if (offset > PAGE_SIZE - i_blocksize(inode)) ++ if (!offset || offset > (PAGE_SIZE - i_blocksize(inode))) + return; + while (1) { + page = find_lock_page(inode->i_mapping, +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index a427d2031a8d..923476e3aefb 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -3182,18 +3182,17 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry) + if (IS_DIRSYNC(dir)) + ext4_handle_sync(handle); + +- if (inode->i_nlink == 0) { +- ext4_warning_inode(inode, "Deleting file '%.*s' with no links", +- dentry->d_name.len, dentry->d_name.name); +- set_nlink(inode, 1); +- } + retval = ext4_delete_entry(handle, dir, de, bh); + if (retval) + goto end_unlink; + dir->i_ctime = dir->i_mtime = current_time(dir); + ext4_update_dx_flag(dir); + ext4_mark_inode_dirty(handle, dir); +- drop_nlink(inode); ++ if (inode->i_nlink == 0) ++ ext4_warning_inode(inode, "Deleting file '%.*s' with no links", ++ dentry->d_name.len, dentry->d_name.name); ++ else ++ drop_nlink(inode); + if (!inode->i_nlink) + ext4_orphan_add(handle, inode); + inode->i_ctime = current_time(inode); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 73578359d451..98d37b8d0050 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1172,9 +1172,9 @@ void ext4_clear_inode(struct inode *inode) + { + invalidate_inode_buffers(inode); + clear_inode(inode); +- dquot_drop(inode); + ext4_discard_preallocations(inode); + ext4_es_remove_extent(inode, 0, EXT_MAX_BLOCKS); ++ dquot_drop(inode); + if (EXT4_I(inode)->jinode) { + jbd2_journal_release_jbd_inode(EXT4_JOURNAL(inode), + EXT4_I(inode)->jinode); +diff --git a/fs/ioctl.c b/fs/ioctl.c +index fef3a6bf7c78..3118da0de158 100644 +--- a/fs/ioctl.c ++++ b/fs/ioctl.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -719,3 +720,37 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, unsigned long, arg) + { + return ksys_ioctl(fd, cmd, arg); + } ++ ++#ifdef CONFIG_COMPAT ++/** ++ * compat_ptr_ioctl - generic implementation of .compat_ioctl file operation ++ * ++ * This is not normally called as a function, but instead set in struct ++ * file_operations as ++ * ++ * .compat_ioctl = compat_ptr_ioctl, ++ * ++ * On most architectures, the compat_ptr_ioctl() just passes all arguments ++ * to the corresponding ->ioctl handler. The exception is arch/s390, where ++ * compat_ptr() clears the top bit of a 32-bit pointer value, so user space ++ * pointers to the second 2GB alias the first 2GB, as is the case for ++ * native 32-bit s390 user space. ++ * ++ * The compat_ptr_ioctl() function must therefore be used only with ioctl ++ * functions that either ignore the argument or pass a pointer to a ++ * compatible data type. ++ * ++ * If any ioctl command handled by fops->unlocked_ioctl passes a plain ++ * integer instead of a pointer, or any of the passed data types ++ * is incompatible between 32-bit and 64-bit architectures, a proper ++ * handler is required instead of compat_ptr_ioctl. ++ */ ++long compat_ptr_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ++{ ++ if (!file->f_op->unlocked_ioctl) ++ return -ENOIOCTLCMD; ++ ++ return file->f_op->unlocked_ioctl(file, cmd, (unsigned long)compat_ptr(arg)); ++} ++EXPORT_SYMBOL(compat_ptr_ioctl); ++#endif +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index 7a922190a8c7..eda83487c9ec 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -728,7 +728,7 @@ static int ocfs2_release_dquot(struct dquot *dquot) + + mutex_lock(&dquot->dq_lock); + /* Check whether we are not racing with some other dqget() */ +- if (atomic_read(&dquot->dq_count) > 1) ++ if (dquot_is_busy(dquot)) + goto out; + /* Running from downconvert thread? Postpone quota processing to wq */ + if (current == osb->dc_task) { +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index 702aa63f6774..29abdb1d3b5c 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -1170,7 +1170,7 @@ static int ovl_rename(struct inode *olddir, struct dentry *old, + if (newdentry == trap) + goto out_dput; + +- if (WARN_ON(olddentry->d_inode == newdentry->d_inode)) ++ if (olddentry->d_inode == newdentry->d_inode) + goto out_dput; + + err = 0; +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index bc14781886bf..b045cf1826fc 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -200,8 +200,14 @@ int ovl_getattr(const struct path *path, struct kstat *stat, + if (ovl_test_flag(OVL_INDEX, d_inode(dentry)) || + (!ovl_verify_lower(dentry->d_sb) && + (is_dir || lowerstat.nlink == 1))) { +- stat->ino = lowerstat.ino; + lower_layer = ovl_layer_lower(dentry); ++ /* ++ * Cannot use origin st_dev;st_ino because ++ * origin inode content may differ from overlay ++ * inode content. ++ */ ++ if (samefs || lower_layer->fsid) ++ stat->ino = lowerstat.ino; + } + + /* +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index e9717c2f7d45..f47c591402d7 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -325,6 +325,14 @@ int ovl_check_origin_fh(struct ovl_fs *ofs, struct ovl_fh *fh, bool connected, + int i; + + for (i = 0; i < ofs->numlower; i++) { ++ /* ++ * If lower fs uuid is not unique among lower fs we cannot match ++ * fh->uuid to layer. ++ */ ++ if (ofs->lower_layers[i].fsid && ++ ofs->lower_layers[i].fs->bad_uuid) ++ continue; ++ + origin = ovl_decode_real_fh(fh, ofs->lower_layers[i].mnt, + connected); + if (origin) +diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h +index a8279280e88d..28348c44ea5b 100644 +--- a/fs/overlayfs/ovl_entry.h ++++ b/fs/overlayfs/ovl_entry.h +@@ -22,6 +22,8 @@ struct ovl_config { + struct ovl_sb { + struct super_block *sb; + dev_t pseudo_dev; ++ /* Unusable (conflicting) uuid */ ++ bool bad_uuid; + }; + + struct ovl_layer { +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index afbcb116a7f1..7621ff176d15 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -1255,7 +1255,7 @@ static bool ovl_lower_uuid_ok(struct ovl_fs *ofs, const uuid_t *uuid) + { + unsigned int i; + +- if (!ofs->config.nfs_export && !(ofs->config.index && ofs->upper_mnt)) ++ if (!ofs->config.nfs_export && !ofs->upper_mnt) + return true; + + for (i = 0; i < ofs->numlowerfs; i++) { +@@ -1263,9 +1263,13 @@ static bool ovl_lower_uuid_ok(struct ovl_fs *ofs, const uuid_t *uuid) + * We use uuid to associate an overlay lower file handle with a + * lower layer, so we can accept lower fs with null uuid as long + * as all lower layers with null uuid are on the same fs. ++ * if we detect multiple lower fs with the same uuid, we ++ * disable lower file handle decoding on all of them. + */ +- if (uuid_equal(&ofs->lower_fs[i].sb->s_uuid, uuid)) ++ if (uuid_equal(&ofs->lower_fs[i].sb->s_uuid, uuid)) { ++ ofs->lower_fs[i].bad_uuid = true; + return false; ++ } + } + return true; + } +@@ -1277,6 +1281,7 @@ static int ovl_get_fsid(struct ovl_fs *ofs, const struct path *path) + unsigned int i; + dev_t dev; + int err; ++ bool bad_uuid = false; + + /* fsid 0 is reserved for upper fs even with non upper overlay */ + if (ofs->upper_mnt && ofs->upper_mnt->mnt_sb == sb) +@@ -1288,11 +1293,15 @@ static int ovl_get_fsid(struct ovl_fs *ofs, const struct path *path) + } + + if (!ovl_lower_uuid_ok(ofs, &sb->s_uuid)) { +- ofs->config.index = false; +- ofs->config.nfs_export = false; +- pr_warn("overlayfs: %s uuid detected in lower fs '%pd2', falling back to index=off,nfs_export=off.\n", +- uuid_is_null(&sb->s_uuid) ? "null" : "conflicting", +- path->dentry); ++ bad_uuid = true; ++ if (ofs->config.index || ofs->config.nfs_export) { ++ ofs->config.index = false; ++ ofs->config.nfs_export = false; ++ pr_warn("overlayfs: %s uuid detected in lower fs '%pd2', falling back to index=off,nfs_export=off.\n", ++ uuid_is_null(&sb->s_uuid) ? "null" : ++ "conflicting", ++ path->dentry); ++ } + } + + err = get_anon_bdev(&dev); +@@ -1303,6 +1312,7 @@ static int ovl_get_fsid(struct ovl_fs *ofs, const struct path *path) + + ofs->lower_fs[ofs->numlowerfs].sb = sb; + ofs->lower_fs[ofs->numlowerfs].pseudo_dev = dev; ++ ofs->lower_fs[ofs->numlowerfs].bad_uuid = bad_uuid; + ofs->numlowerfs++; + + return ofs->numlowerfs; +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 6e826b454082..7f0b39da5022 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -497,7 +497,7 @@ int dquot_release(struct dquot *dquot) + + mutex_lock(&dquot->dq_lock); + /* Check whether we are not racing with some other dqget() */ +- if (atomic_read(&dquot->dq_count) > 1) ++ if (dquot_is_busy(dquot)) + goto out_dqlock; + if (dqopt->ops[dquot->dq_id.type]->release_dqblk) { + ret = dqopt->ops[dquot->dq_id.type]->release_dqblk(dquot); +@@ -623,7 +623,7 @@ EXPORT_SYMBOL(dquot_scan_active); + /* Write all dquot structures to quota files */ + int dquot_writeback_dquots(struct super_block *sb, int type) + { +- struct list_head *dirty; ++ struct list_head dirty; + struct dquot *dquot; + struct quota_info *dqopt = sb_dqopt(sb); + int cnt; +@@ -637,9 +637,10 @@ int dquot_writeback_dquots(struct super_block *sb, int type) + if (!sb_has_quota_active(sb, cnt)) + continue; + spin_lock(&dq_list_lock); +- dirty = &dqopt->info[cnt].dqi_dirty_list; +- while (!list_empty(dirty)) { +- dquot = list_first_entry(dirty, struct dquot, ++ /* Move list away to avoid livelock. */ ++ list_replace_init(&dqopt->info[cnt].dqi_dirty_list, &dirty); ++ while (!list_empty(&dirty)) { ++ dquot = list_first_entry(&dirty, struct dquot, + dq_dirty); + + WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)); +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c +index 132ec4406ed0..6419e6dacc39 100644 +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -2097,6 +2097,15 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th, + goto out_inserted_sd; + } + ++ /* ++ * Mark it private if we're creating the privroot ++ * or something under it. ++ */ ++ if (IS_PRIVATE(dir) || dentry == REISERFS_SB(sb)->priv_root) { ++ inode->i_flags |= S_PRIVATE; ++ inode->i_opflags &= ~IOP_XATTR; ++ } ++ + if (reiserfs_posixacl(inode->i_sb)) { + reiserfs_write_unlock(inode->i_sb); + retval = reiserfs_inherit_default_acl(th, dir, dentry, inode); +@@ -2111,8 +2120,7 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th, + reiserfs_warning(inode->i_sb, "jdm-13090", + "ACLs aren't enabled in the fs, " + "but vfs thinks they are!"); +- } else if (IS_PRIVATE(dir)) +- inode->i_flags |= S_PRIVATE; ++ } + + if (security->name) { + reiserfs_write_unlock(inode->i_sb); +diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c +index 97f3fc4fdd79..959a066b7bb0 100644 +--- a/fs/reiserfs/namei.c ++++ b/fs/reiserfs/namei.c +@@ -377,10 +377,13 @@ static struct dentry *reiserfs_lookup(struct inode *dir, struct dentry *dentry, + + /* + * Propagate the private flag so we know we're +- * in the priv tree ++ * in the priv tree. Also clear IOP_XATTR ++ * since we don't have xattrs on xattr files. + */ +- if (IS_PRIVATE(dir)) ++ if (IS_PRIVATE(dir)) { + inode->i_flags |= S_PRIVATE; ++ inode->i_opflags &= ~IOP_XATTR; ++ } + } + reiserfs_write_unlock(dir->i_sb); + if (retval == IO_ERROR) { +diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h +index e5ca9ed79e54..726580114d55 100644 +--- a/fs/reiserfs/reiserfs.h ++++ b/fs/reiserfs/reiserfs.h +@@ -1168,6 +1168,8 @@ static inline int bmap_would_wrap(unsigned bmap_nr) + return bmap_nr > ((1LL << 16) - 1); + } + ++extern const struct xattr_handler *reiserfs_xattr_handlers[]; ++ + /* + * this says about version of key of all items (but stat data) the + * object consists of +diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c +index d69b4ac0ae2f..3244037b1286 100644 +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -2049,6 +2049,8 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent) + if (replay_only(s)) + goto error_unlocked; + ++ s->s_xattr = reiserfs_xattr_handlers; ++ + if (bdev_read_only(s->s_bdev) && !sb_rdonly(s)) { + SWARN(silent, s, "clm-7000", + "Detected readonly device, marking FS readonly"); +diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c +index b5b26d8a192c..62b40df36c98 100644 +--- a/fs/reiserfs/xattr.c ++++ b/fs/reiserfs/xattr.c +@@ -122,13 +122,13 @@ static struct dentry *open_xa_root(struct super_block *sb, int flags) + struct dentry *xaroot; + + if (d_really_is_negative(privroot)) +- return ERR_PTR(-ENODATA); ++ return ERR_PTR(-EOPNOTSUPP); + + inode_lock_nested(d_inode(privroot), I_MUTEX_XATTR); + + xaroot = dget(REISERFS_SB(sb)->xattr_root); + if (!xaroot) +- xaroot = ERR_PTR(-ENODATA); ++ xaroot = ERR_PTR(-EOPNOTSUPP); + else if (d_really_is_negative(xaroot)) { + int err = -ENODATA; + +@@ -619,6 +619,10 @@ int reiserfs_xattr_set(struct inode *inode, const char *name, + int error, error2; + size_t jbegin_count = reiserfs_xattr_nblocks(inode, buffer_size); + ++ /* Check before we start a transaction and then do nothing. */ ++ if (!d_really_is_positive(REISERFS_SB(inode->i_sb)->priv_root)) ++ return -EOPNOTSUPP; ++ + if (!(flags & XATTR_REPLACE)) + jbegin_count += reiserfs_xattr_jcreate_nblocks(inode); + +@@ -841,8 +845,7 @@ ssize_t reiserfs_listxattr(struct dentry * dentry, char *buffer, size_t size) + if (d_really_is_negative(dentry)) + return -EINVAL; + +- if (!dentry->d_sb->s_xattr || +- get_inode_sd_version(d_inode(dentry)) == STAT_DATA_V1) ++ if (get_inode_sd_version(d_inode(dentry)) == STAT_DATA_V1) + return -EOPNOTSUPP; + + dir = open_xa_dir(d_inode(dentry), XATTR_REPLACE); +@@ -882,6 +885,7 @@ static int create_privroot(struct dentry *dentry) + } + + d_inode(dentry)->i_flags |= S_PRIVATE; ++ d_inode(dentry)->i_opflags &= ~IOP_XATTR; + reiserfs_info(dentry->d_sb, "Created %s - reserved for xattr " + "storage.\n", PRIVROOT_NAME); + +@@ -895,7 +899,7 @@ static int create_privroot(struct dentry *dentry) { return 0; } + #endif + + /* Actual operations that are exported to VFS-land */ +-static const struct xattr_handler *reiserfs_xattr_handlers[] = { ++const struct xattr_handler *reiserfs_xattr_handlers[] = { + #ifdef CONFIG_REISERFS_FS_XATTR + &reiserfs_xattr_user_handler, + &reiserfs_xattr_trusted_handler, +@@ -966,8 +970,10 @@ int reiserfs_lookup_privroot(struct super_block *s) + if (!IS_ERR(dentry)) { + REISERFS_SB(s)->priv_root = dentry; + d_set_d_op(dentry, &xattr_lookup_poison_ops); +- if (d_really_is_positive(dentry)) ++ if (d_really_is_positive(dentry)) { + d_inode(dentry)->i_flags |= S_PRIVATE; ++ d_inode(dentry)->i_opflags &= ~IOP_XATTR; ++ } + } else + err = PTR_ERR(dentry); + inode_unlock(d_inode(s->s_root)); +@@ -996,7 +1002,6 @@ int reiserfs_xattr_init(struct super_block *s, int mount_flags) + } + + if (d_really_is_positive(privroot)) { +- s->s_xattr = reiserfs_xattr_handlers; + inode_lock(d_inode(privroot)); + if (!REISERFS_SB(s)->xattr_root) { + struct dentry *dentry; +diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c +index aa9380bac196..05f666794561 100644 +--- a/fs/reiserfs/xattr_acl.c ++++ b/fs/reiserfs/xattr_acl.c +@@ -320,10 +320,8 @@ reiserfs_inherit_default_acl(struct reiserfs_transaction_handle *th, + * would be useless since permissions are ignored, and a pain because + * it introduces locking cycles + */ +- if (IS_PRIVATE(dir)) { +- inode->i_flags |= S_PRIVATE; ++ if (IS_PRIVATE(inode)) + goto apply_umask; +- } + + err = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl); + if (err) +diff --git a/fs/splice.c b/fs/splice.c +index 98412721f056..e509239d7e06 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -945,12 +945,13 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, + WARN_ON_ONCE(pipe->nrbufs != 0); + + while (len) { ++ unsigned int pipe_pages; + size_t read_len; + loff_t pos = sd->pos, prev_pos = pos; + + /* Don't try to read more the pipe has space for. */ +- read_len = min_t(size_t, len, +- (pipe->buffers - pipe->nrbufs) << PAGE_SHIFT); ++ pipe_pages = pipe->buffers - pipe->nrbufs; ++ read_len = min(len, (size_t)pipe_pages << PAGE_SHIFT); + ret = do_splice_to(in, &pos, pipe, read_len, flags); + if (unlikely(ret <= 0)) + goto out_release; +@@ -1180,8 +1181,15 @@ static long do_splice(struct file *in, loff_t __user *off_in, + + pipe_lock(opipe); + ret = wait_for_space(opipe, flags); +- if (!ret) ++ if (!ret) { ++ unsigned int pipe_pages; ++ ++ /* Don't try to read more the pipe has space for. */ ++ pipe_pages = opipe->buffers - opipe->nrbufs; ++ len = min(len, (size_t)pipe_pages << PAGE_SHIFT); ++ + ret = do_splice_to(in, &offset, opipe, len, flags); ++ } + pipe_unlock(opipe); + if (ret > 0) + wakeup_pipe_readers(opipe); +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index 175f7b40c585..3f6fddeb7519 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -78,9 +78,6 @@ acpi_evaluate_dsm_typed(acpi_handle handle, const guid_t *guid, u64 rev, + bool acpi_dev_found(const char *hid); + bool acpi_dev_present(const char *hid, const char *uid, s64 hrv); + +-struct acpi_device * +-acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv); +- + #ifdef CONFIG_ACPI + + #include +@@ -683,6 +680,9 @@ static inline bool acpi_device_can_poweroff(struct acpi_device *adev) + adev->power.states[ACPI_STATE_D3_HOT].flags.explicit_set); + } + ++struct acpi_device * ++acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv); ++ + static inline void acpi_dev_put(struct acpi_device *adev) + { + put_device(&adev->dev); +diff --git a/include/linux/fs.h b/include/linux/fs.h +index e0d909d35763..0b4d8fc79e0f 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1727,6 +1727,13 @@ int vfs_mkobj(struct dentry *, umode_t, + + extern long vfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg); + ++#ifdef CONFIG_COMPAT ++extern long compat_ptr_ioctl(struct file *file, unsigned int cmd, ++ unsigned long arg); ++#else ++#define compat_ptr_ioctl NULL ++#endif ++ + /* + * VFS file helper functions. + */ +diff --git a/include/linux/mfd/rk808.h b/include/linux/mfd/rk808.h +index 7cfd2b0504df..a59bf323f713 100644 +--- a/include/linux/mfd/rk808.h ++++ b/include/linux/mfd/rk808.h +@@ -610,7 +610,7 @@ enum { + RK808_ID = 0x0000, + RK809_ID = 0x8090, + RK817_ID = 0x8170, +- RK818_ID = 0x8181, ++ RK818_ID = 0x8180, + }; + + struct rk808 { +diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h +index 185d94829701..91e0b7624053 100644 +--- a/include/linux/quotaops.h ++++ b/include/linux/quotaops.h +@@ -54,6 +54,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot) + atomic_inc(&dquot->dq_count); + return dquot; + } ++ ++static inline bool dquot_is_busy(struct dquot *dquot) ++{ ++ if (test_bit(DQ_MOD_B, &dquot->dq_flags)) ++ return true; ++ if (atomic_read(&dquot->dq_count) > 1) ++ return true; ++ return false; ++} ++ + void dqput(struct dquot *dquot); + int dquot_scan_active(struct super_block *sb, + int (*fn)(struct dquot *dquot, unsigned long priv), +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index e7e733add99f..44c52639db55 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -4043,9 +4043,7 @@ static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev, + */ + static inline unsigned int ib_dma_max_seg_size(struct ib_device *dev) + { +- struct device_dma_parameters *p = dev->dma_device->dma_parms; +- +- return p ? p->max_segment_size : UINT_MAX; ++ return dma_get_max_seg_size(dev->dma_device); + } + + /** +diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h +index 5704fa0292b5..423859e489c7 100644 +--- a/include/uapi/linux/cec.h ++++ b/include/uapi/linux/cec.h +@@ -768,8 +768,8 @@ struct cec_event { + #define CEC_MSG_SELECT_DIGITAL_SERVICE 0x93 + #define CEC_MSG_TUNER_DEVICE_STATUS 0x07 + /* Recording Flag Operand (rec_flag) */ +-#define CEC_OP_REC_FLAG_USED 0 +-#define CEC_OP_REC_FLAG_NOT_USED 1 ++#define CEC_OP_REC_FLAG_NOT_USED 0 ++#define CEC_OP_REC_FLAG_USED 1 + /* Tuner Display Info Operand (tuner_display_info) */ + #define CEC_OP_TUNER_DISPLAY_INFO_DIGITAL 0 + #define CEC_OP_TUNER_DISPLAY_INFO_NONE 1 +diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c +index 8e513a573fe9..138059eb730d 100644 +--- a/kernel/cgroup/pids.c ++++ b/kernel/cgroup/pids.c +@@ -45,7 +45,7 @@ struct pids_cgroup { + * %PIDS_MAX = (%PID_MAX_LIMIT + 1). + */ + atomic64_t counter; +- int64_t limit; ++ atomic64_t limit; + + /* Handle for "pids.events" */ + struct cgroup_file events_file; +@@ -73,8 +73,8 @@ pids_css_alloc(struct cgroup_subsys_state *parent) + if (!pids) + return ERR_PTR(-ENOMEM); + +- pids->limit = PIDS_MAX; + atomic64_set(&pids->counter, 0); ++ atomic64_set(&pids->limit, PIDS_MAX); + atomic64_set(&pids->events_limit, 0); + return &pids->css; + } +@@ -146,13 +146,14 @@ static int pids_try_charge(struct pids_cgroup *pids, int num) + + for (p = pids; parent_pids(p); p = parent_pids(p)) { + int64_t new = atomic64_add_return(num, &p->counter); ++ int64_t limit = atomic64_read(&p->limit); + + /* + * Since new is capped to the maximum number of pid_t, if + * p->limit is %PIDS_MAX then we know that this test will never + * fail. + */ +- if (new > p->limit) ++ if (new > limit) + goto revert; + } + +@@ -277,7 +278,7 @@ set_limit: + * Limit updates don't need to be mutex'd, since it isn't + * critical that any racing fork()s follow the new limit. + */ +- pids->limit = limit; ++ atomic64_set(&pids->limit, limit); + return nbytes; + } + +@@ -285,7 +286,7 @@ static int pids_max_show(struct seq_file *sf, void *v) + { + struct cgroup_subsys_state *css = seq_css(sf); + struct pids_cgroup *pids = css_pids(css); +- int64_t limit = pids->limit; ++ int64_t limit = atomic64_read(&pids->limit); + + if (limit >= PIDS_MAX) + seq_printf(sf, "%s\n", PIDS_MAX_STR); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index bc2e09a8ea61..649687622654 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -2532,8 +2532,14 @@ repeat: + */ + if (need_to_create_worker(pool)) { + spin_lock(&wq_mayday_lock); +- get_pwq(pwq); +- list_move_tail(&pwq->mayday_node, &wq->maydays); ++ /* ++ * Queue iff we aren't racing destruction ++ * and somebody else hasn't queued it already. ++ */ ++ if (wq->rescuer && list_empty(&pwq->mayday_node)) { ++ get_pwq(pwq); ++ list_add_tail(&pwq->mayday_node, &wq->maydays); ++ } + spin_unlock(&wq_mayday_lock); + } + } +@@ -4325,9 +4331,29 @@ void destroy_workqueue(struct workqueue_struct *wq) + struct pool_workqueue *pwq; + int node; + ++ /* ++ * Remove it from sysfs first so that sanity check failure doesn't ++ * lead to sysfs name conflicts. ++ */ ++ workqueue_sysfs_unregister(wq); ++ + /* drain it before proceeding with destruction */ + drain_workqueue(wq); + ++ /* kill rescuer, if sanity checks fail, leave it w/o rescuer */ ++ if (wq->rescuer) { ++ struct worker *rescuer = wq->rescuer; ++ ++ /* this prevents new queueing */ ++ spin_lock_irq(&wq_mayday_lock); ++ wq->rescuer = NULL; ++ spin_unlock_irq(&wq_mayday_lock); ++ ++ /* rescuer will empty maydays list before exiting */ ++ kthread_stop(rescuer->task); ++ kfree(rescuer); ++ } ++ + /* sanity checks */ + mutex_lock(&wq->mutex); + for_each_pwq(pwq, wq) { +@@ -4359,11 +4385,6 @@ void destroy_workqueue(struct workqueue_struct *wq) + list_del_rcu(&wq->list); + mutex_unlock(&wq_pool_mutex); + +- workqueue_sysfs_unregister(wq); +- +- if (wq->rescuer) +- kthread_stop(wq->rescuer->task); +- + if (!(wq->flags & WQ_UNBOUND)) { + wq_unregister_lockdep(wq); + /* +@@ -4638,7 +4659,8 @@ static void show_pwq(struct pool_workqueue *pwq) + pr_info(" pwq %d:", pool->id); + pr_cont_pool_info(pool); + +- pr_cont(" active=%d/%d%s\n", pwq->nr_active, pwq->max_active, ++ pr_cont(" active=%d/%d refcnt=%d%s\n", ++ pwq->nr_active, pwq->max_active, pwq->refcnt, + !list_empty(&pwq->mayday_node) ? " MAYDAY" : ""); + + hash_for_each(pool->busy_hash, bkt, worker, hentry) { +diff --git a/lib/raid6/unroll.awk b/lib/raid6/unroll.awk +index c6aa03631df8..0809805a7e23 100644 +--- a/lib/raid6/unroll.awk ++++ b/lib/raid6/unroll.awk +@@ -13,7 +13,7 @@ BEGIN { + for (i = 0; i < rep; ++i) { + tmp = $0 + gsub(/\$\$/, i, tmp) +- gsub(/\$\#/, n, tmp) ++ gsub(/\$#/, n, tmp) + gsub(/\$\*/, "$", tmp) + print tmp + } +diff --git a/mm/shmem.c b/mm/shmem.c +index 220be9fa2c41..7a22e3e03d11 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2213,11 +2213,14 @@ static int shmem_mmap(struct file *file, struct vm_area_struct *vma) + return -EPERM; + + /* +- * Since the F_SEAL_FUTURE_WRITE seals allow for a MAP_SHARED +- * read-only mapping, take care to not allow mprotect to revert +- * protections. ++ * Since an F_SEAL_FUTURE_WRITE sealed memfd can be mapped as ++ * MAP_SHARED and read-only, take care to not allow mprotect to ++ * revert protections on such mappings. Do this only for shared ++ * mappings. For private mappings, don't need to mask ++ * VM_MAYWRITE as we still want them to be COW-writable. + */ +- vma->vm_flags &= ~(VM_MAYWRITE); ++ if (vma->vm_flags & VM_SHARED) ++ vma->vm_flags &= ~(VM_MAYWRITE); + } + + file_accessed(file); +@@ -2742,7 +2745,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset, + } + + shmem_falloc.waitq = &shmem_falloc_waitq; +- shmem_falloc.start = unmap_start >> PAGE_SHIFT; ++ shmem_falloc.start = (u64)unmap_start >> PAGE_SHIFT; + shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT; + spin_lock(&inode->i_lock); + inode->i_private = &shmem_falloc; +diff --git a/mm/slab_common.c b/mm/slab_common.c +index f9fb27b4c843..78402b362df9 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -904,6 +904,18 @@ static void flush_memcg_workqueue(struct kmem_cache *s) + * previous workitems on workqueue are processed. + */ + flush_workqueue(memcg_kmem_cache_wq); ++ ++ /* ++ * If we're racing with children kmem_cache deactivation, it might ++ * take another rcu grace period to complete their destruction. ++ * At this moment the corresponding percpu_ref_kill() call should be ++ * done, but it might take another rcu grace period to complete ++ * switching to the atomic mode. ++ * Please, note that we check without grabbing the slab_mutex. It's safe ++ * because at this moment the children list can't grow. ++ */ ++ if (!list_empty(&s->memcg_params.children)) ++ rcu_barrier(); + } + #else + static inline int shutdown_memcg_caches(struct kmem_cache *s) +diff --git a/sound/firewire/fireface/ff-pcm.c b/sound/firewire/fireface/ff-pcm.c +index 9eab3ad283ce..df6ff2df0124 100644 +--- a/sound/firewire/fireface/ff-pcm.c ++++ b/sound/firewire/fireface/ff-pcm.c +@@ -219,7 +219,7 @@ static int pcm_hw_params(struct snd_pcm_substream *substream, + mutex_unlock(&ff->mutex); + } + +- return 0; ++ return err; + } + + static int pcm_hw_free(struct snd_pcm_substream *substream) +diff --git a/sound/firewire/oxfw/oxfw-pcm.c b/sound/firewire/oxfw/oxfw-pcm.c +index 7c6d1c277d4d..78d906af9c00 100644 +--- a/sound/firewire/oxfw/oxfw-pcm.c ++++ b/sound/firewire/oxfw/oxfw-pcm.c +@@ -255,7 +255,7 @@ static int pcm_playback_hw_params(struct snd_pcm_substream *substream, + mutex_unlock(&oxfw->mutex); + } + +- return 0; ++ return err; + } + + static int pcm_capture_hw_free(struct snd_pcm_substream *substream) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index ed3e314b5233..e1229dbad6b2 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7672,11 +7672,6 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x1a, 0x90a70130}, + {0x1b, 0x90170110}, + {0x21, 0x03211020}), +- SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, +- {0x12, 0xb7a60130}, +- {0x13, 0xb8a61140}, +- {0x16, 0x90170110}, +- {0x21, 0x04211020}), + SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, + {0x12, 0x90a60130}, + {0x14, 0x90170110}, +@@ -7864,6 +7859,9 @@ static const struct snd_hda_pin_quirk alc269_fallback_pin_fixup_tbl[] = { + SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE, + {0x19, 0x40000000}, + {0x1b, 0x40000000}), ++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, ++ {0x19, 0x40000000}, ++ {0x1a, 0x40000000}), + {} + }; + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 1c06b3b9218c..19662ee330d6 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3270,6 +3270,9 @@ static void rt5645_jack_detect_work(struct work_struct *work) + snd_soc_jack_report(rt5645->mic_jack, + report, SND_JACK_MICROPHONE); + return; ++ case 4: ++ val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x0020; ++ break; + default: /* read rt5645 jd1_1 status */ + val = snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x1000; + break; +@@ -3603,7 +3606,7 @@ static const struct rt5645_platform_data intel_braswell_platform_data = { + static const struct rt5645_platform_data buddy_platform_data = { + .dmic1_data_pin = RT5645_DMIC_DATA_GPIO5, + .dmic2_data_pin = RT5645_DMIC_DATA_IN2P, +- .jd_mode = 3, ++ .jd_mode = 4, + .level_trigger_irq = true, + }; + +@@ -3999,6 +4002,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, + RT5645_JD1_MODE_1); + break; + case 3: ++ case 4: + regmap_update_bits(rt5645->regmap, RT5645_A_JD_CTRL1, + RT5645_JD1_MODE_MASK, + RT5645_JD1_MODE_2); +diff --git a/sound/soc/fsl/fsl_audmix.c b/sound/soc/fsl/fsl_audmix.c +index c7e4e9757dce..a1db1bce330f 100644 +--- a/sound/soc/fsl/fsl_audmix.c ++++ b/sound/soc/fsl/fsl_audmix.c +@@ -286,6 +286,7 @@ static int fsl_audmix_dai_trigger(struct snd_pcm_substream *substream, int cmd, + struct snd_soc_dai *dai) + { + struct fsl_audmix *priv = snd_soc_dai_get_drvdata(dai); ++ unsigned long lock_flags; + + /* Capture stream shall not be handled */ + if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) +@@ -295,12 +296,16 @@ static int fsl_audmix_dai_trigger(struct snd_pcm_substream *substream, int cmd, + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: ++ spin_lock_irqsave(&priv->lock, lock_flags); + priv->tdms |= BIT(dai->driver->id); ++ spin_unlock_irqrestore(&priv->lock, lock_flags); + break; + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: ++ spin_lock_irqsave(&priv->lock, lock_flags); + priv->tdms &= ~BIT(dai->driver->id); ++ spin_unlock_irqrestore(&priv->lock, lock_flags); + break; + default: + return -EINVAL; +@@ -491,6 +496,7 @@ static int fsl_audmix_probe(struct platform_device *pdev) + return PTR_ERR(priv->ipg_clk); + } + ++ spin_lock_init(&priv->lock); + platform_set_drvdata(pdev, priv); + pm_runtime_enable(dev); + +diff --git a/sound/soc/fsl/fsl_audmix.h b/sound/soc/fsl/fsl_audmix.h +index 7812ffec45c5..479f05695d53 100644 +--- a/sound/soc/fsl/fsl_audmix.h ++++ b/sound/soc/fsl/fsl_audmix.h +@@ -96,6 +96,7 @@ struct fsl_audmix { + struct platform_device *pdev; + struct regmap *regmap; + struct clk *ipg_clk; ++ spinlock_t lock; /* Protect tdms */ + u8 tdms; + }; + +diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c +index a71d2340eb05..b5748dcd490f 100644 +--- a/sound/soc/soc-jack.c ++++ b/sound/soc/soc-jack.c +@@ -82,10 +82,9 @@ void snd_soc_jack_report(struct snd_soc_jack *jack, int status, int mask) + unsigned int sync = 0; + int enable; + +- trace_snd_soc_jack_report(jack, mask, status); +- + if (!jack) + return; ++ trace_snd_soc_jack_report(jack, mask, status); + + dapm = &jack->card->dapm; + +diff --git a/tools/perf/tests/backward-ring-buffer.c b/tools/perf/tests/backward-ring-buffer.c +index 338cd9faa835..5128f727c0ef 100644 +--- a/tools/perf/tests/backward-ring-buffer.c ++++ b/tools/perf/tests/backward-ring-buffer.c +@@ -147,6 +147,15 @@ int test__backward_ring_buffer(struct test *test __maybe_unused, int subtest __m + goto out_delete_evlist; + } + ++ evlist__close(evlist); ++ ++ err = evlist__open(evlist); ++ if (err < 0) { ++ pr_debug("perf_evlist__open: %s\n", ++ str_error_r(errno, sbuf, sizeof(sbuf))); ++ goto out_delete_evlist; ++ } ++ + err = do_test(evlist, 1, &sample_count, &comm_count); + if (err != TEST_OK) + goto out_delete_evlist; +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 7f8b5c8982e3..b505bb062d07 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -3077,7 +3078,7 @@ static int user_trap_syscall(int nr, unsigned int flags) + return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog); + } + +-#define USER_NOTIF_MAGIC 116983961184613L ++#define USER_NOTIF_MAGIC INT_MAX + TEST(user_notification_basic) + { + pid_t pid; diff --git a/patch/kernel/odroidxu4-current/02-patch-5.4.4-5.patch b/patch/kernel/odroidxu4-current/02-patch-5.4.4-5.patch new file mode 100644 index 0000000000..491146c981 --- /dev/null +++ b/patch/kernel/odroidxu4-current/02-patch-5.4.4-5.patch @@ -0,0 +1,2510 @@ +diff --git a/Makefile b/Makefile +index 144daf02c78a..0f6e72d5e4f1 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 4 ++SUBLEVEL = 5 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index 6d7ec371e7b2..606fa6d86685 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -421,16 +421,15 @@ static int addr6_resolve(struct sockaddr *src_sock, + (const struct sockaddr_in6 *)dst_sock; + struct flowi6 fl6; + struct dst_entry *dst; +- int ret; + + memset(&fl6, 0, sizeof fl6); + fl6.daddr = dst_in->sin6_addr; + fl6.saddr = src_in->sin6_addr; + fl6.flowi6_oif = addr->bound_dev_if; + +- ret = ipv6_stub->ipv6_dst_lookup(addr->net, NULL, &dst, &fl6); +- if (ret < 0) +- return ret; ++ dst = ipv6_stub->ipv6_dst_lookup_flow(addr->net, NULL, &fl6, NULL); ++ if (IS_ERR(dst)) ++ return PTR_ERR(dst); + + if (ipv6_addr_any(&src_in->sin6_addr)) + src_in->sin6_addr = fl6.saddr; +diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c +index 5a3474f9351b..312c2fc961c0 100644 +--- a/drivers/infiniband/sw/rxe/rxe_net.c ++++ b/drivers/infiniband/sw/rxe/rxe_net.c +@@ -117,10 +117,12 @@ static struct dst_entry *rxe_find_route6(struct net_device *ndev, + memcpy(&fl6.daddr, daddr, sizeof(*daddr)); + fl6.flowi6_proto = IPPROTO_UDP; + +- if (unlikely(ipv6_stub->ipv6_dst_lookup(sock_net(recv_sockets.sk6->sk), +- recv_sockets.sk6->sk, &ndst, &fl6))) { ++ ndst = ipv6_stub->ipv6_dst_lookup_flow(sock_net(recv_sockets.sk6->sk), ++ recv_sockets.sk6->sk, &fl6, ++ NULL); ++ if (unlikely(IS_ERR(ndst))) { + pr_err_ratelimited("no route to %pI6\n", daddr); +- goto put; ++ return NULL; + } + + if (unlikely(ndst->error)) { +diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c +index acb016834f04..6cc100e7d5c0 100644 +--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c ++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c +@@ -1115,7 +1115,7 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid) + phy_interface_mode(lmac->lmac_type))) + return -ENODEV; + +- phy_start_aneg(lmac->phydev); ++ phy_start(lmac->phydev); + return 0; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index f1a7bc46f1c0..2c16add0b642 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -816,7 +816,7 @@ struct mlx5e_xsk { + struct mlx5e_priv { + /* priv data path fields - start */ + struct mlx5e_txqsq *txq2sq[MLX5E_MAX_NUM_CHANNELS * MLX5E_MAX_NUM_TC]; +- int channel_tc2txq[MLX5E_MAX_NUM_CHANNELS][MLX5E_MAX_NUM_TC]; ++ int channel_tc2realtxq[MLX5E_MAX_NUM_CHANNELS][MLX5E_MAX_NUM_TC]; + #ifdef CONFIG_MLX5_CORE_EN_DCB + struct mlx5e_dcbx_dp dcbx_dp; + #endif +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c +index f777994f3005..fce6eccdcf8b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c +@@ -73,6 +73,7 @@ static const u32 mlx5e_ext_link_speed[MLX5E_EXT_LINK_MODES_NUMBER] = { + [MLX5E_50GAUI_2_LAUI_2_50GBASE_CR2_KR2] = 50000, + [MLX5E_50GAUI_1_LAUI_1_50GBASE_CR_KR] = 50000, + [MLX5E_CAUI_4_100GBASE_CR4_KR4] = 100000, ++ [MLX5E_100GAUI_2_100GBASE_CR2_KR2] = 100000, + [MLX5E_200GAUI_4_200GBASE_CR4_KR4] = 200000, + [MLX5E_400GAUI_8] = 400000, + }; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +index 633b117eb13e..99c7cdd0404a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +@@ -155,8 +155,11 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer, + } + + if (port_buffer->buffer[i].size < +- (xoff + max_mtu + (1 << MLX5E_BUFFER_CELL_SHIFT))) ++ (xoff + max_mtu + (1 << MLX5E_BUFFER_CELL_SHIFT))) { ++ pr_err("buffer_size[%d]=%d is not enough for lossless buffer\n", ++ i, port_buffer->buffer[i].size); + return -ENOMEM; ++ } + + port_buffer->buffer[i].xoff = port_buffer->buffer[i].size - xoff; + port_buffer->buffer[i].xon = +@@ -232,6 +235,26 @@ static int update_buffer_lossy(unsigned int max_mtu, + return 0; + } + ++static int fill_pfc_en(struct mlx5_core_dev *mdev, u8 *pfc_en) ++{ ++ u32 g_rx_pause, g_tx_pause; ++ int err; ++ ++ err = mlx5_query_port_pause(mdev, &g_rx_pause, &g_tx_pause); ++ if (err) ++ return err; ++ ++ /* If global pause enabled, set all active buffers to lossless. ++ * Otherwise, check PFC setting. ++ */ ++ if (g_rx_pause || g_tx_pause) ++ *pfc_en = 0xff; ++ else ++ err = mlx5_query_port_pfc(mdev, pfc_en, NULL); ++ ++ return err; ++} ++ + #define MINIMUM_MAX_MTU 9216 + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, +@@ -277,7 +300,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + + if (change & MLX5E_PORT_BUFFER_PRIO2BUFFER) { + update_prio2buffer = true; +- err = mlx5_query_port_pfc(priv->mdev, &curr_pfc_en, NULL); ++ err = fill_pfc_en(priv->mdev, &curr_pfc_en); + if (err) + return err; + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +index 745ab6cd7c30..362f01bc8372 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +@@ -144,10 +144,10 @@ static int mlx5e_route_lookup_ipv6(struct mlx5e_priv *priv, + #if IS_ENABLED(CONFIG_INET) && IS_ENABLED(CONFIG_IPV6) + int ret; + +- ret = ipv6_stub->ipv6_dst_lookup(dev_net(mirred_dev), NULL, &dst, +- fl6); +- if (ret < 0) +- return ret; ++ dst = ipv6_stub->ipv6_dst_lookup_flow(dev_net(mirred_dev), NULL, fl6, ++ NULL); ++ if (IS_ERR(dst)) ++ return PTR_ERR(dst); + + if (!(*out_ttl)) + *out_ttl = ip6_dst_hoplimit(dst); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index 95601269fa2e..c6776f308d5e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1027,18 +1027,11 @@ static bool ext_link_mode_requested(const unsigned long *adver) + return bitmap_intersects(modes, adver, __ETHTOOL_LINK_MODE_MASK_NBITS); + } + +-static bool ext_speed_requested(u32 speed) +-{ +-#define MLX5E_MAX_PTYS_LEGACY_SPEED 100000 +- return !!(speed > MLX5E_MAX_PTYS_LEGACY_SPEED); +-} +- +-static bool ext_requested(u8 autoneg, const unsigned long *adver, u32 speed) ++static bool ext_requested(u8 autoneg, const unsigned long *adver, bool ext_supported) + { + bool ext_link_mode = ext_link_mode_requested(adver); +- bool ext_speed = ext_speed_requested(speed); + +- return autoneg == AUTONEG_ENABLE ? ext_link_mode : ext_speed; ++ return autoneg == AUTONEG_ENABLE ? ext_link_mode : ext_supported; + } + + int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv, +@@ -1065,8 +1058,8 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv, + autoneg = link_ksettings->base.autoneg; + speed = link_ksettings->base.speed; + +- ext = ext_requested(autoneg, adver, speed), + ext_supported = MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet); ++ ext = ext_requested(autoneg, adver, ext_supported); + if (!ext_supported && ext) + return -EOPNOTSUPP; + +@@ -1643,7 +1636,7 @@ static int mlx5e_get_module_info(struct net_device *netdev, + break; + case MLX5_MODULE_ID_SFP: + modinfo->type = ETH_MODULE_SFF_8472; +- modinfo->eeprom_len = MLX5_EEPROM_PAGE_LENGTH; ++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN; + break; + default: + netdev_err(priv->netdev, "%s: cable type not recognized:0x%x\n", +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 2a56e66f58d8..6abd4ed5b69b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -1693,11 +1693,10 @@ static int mlx5e_open_sqs(struct mlx5e_channel *c, + struct mlx5e_params *params, + struct mlx5e_channel_param *cparam) + { +- struct mlx5e_priv *priv = c->priv; + int err, tc; + + for (tc = 0; tc < params->num_tc; tc++) { +- int txq_ix = c->ix + tc * priv->max_nch; ++ int txq_ix = c->ix + tc * params->num_channels; + + err = mlx5e_open_txqsq(c, c->priv->tisn[c->lag_port][tc], txq_ix, + params, &cparam->sq, &c->sq[tc], tc); +@@ -2878,26 +2877,21 @@ static void mlx5e_netdev_set_tcs(struct net_device *netdev) + netdev_set_tc_queue(netdev, tc, nch, 0); + } + +-static void mlx5e_build_tc2txq_maps(struct mlx5e_priv *priv) ++static void mlx5e_build_txq_maps(struct mlx5e_priv *priv) + { +- int i, tc; ++ int i, ch; + +- for (i = 0; i < priv->max_nch; i++) +- for (tc = 0; tc < priv->profile->max_tc; tc++) +- priv->channel_tc2txq[i][tc] = i + tc * priv->max_nch; +-} ++ ch = priv->channels.num; + +-static void mlx5e_build_tx2sq_maps(struct mlx5e_priv *priv) +-{ +- struct mlx5e_channel *c; +- struct mlx5e_txqsq *sq; +- int i, tc; ++ for (i = 0; i < ch; i++) { ++ int tc; ++ ++ for (tc = 0; tc < priv->channels.params.num_tc; tc++) { ++ struct mlx5e_channel *c = priv->channels.c[i]; ++ struct mlx5e_txqsq *sq = &c->sq[tc]; + +- for (i = 0; i < priv->channels.num; i++) { +- c = priv->channels.c[i]; +- for (tc = 0; tc < c->num_tc; tc++) { +- sq = &c->sq[tc]; + priv->txq2sq[sq->txq_ix] = sq; ++ priv->channel_tc2realtxq[i][tc] = i + tc * ch; + } + } + } +@@ -2912,7 +2906,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv) + netif_set_real_num_tx_queues(netdev, num_txqs); + netif_set_real_num_rx_queues(netdev, num_rxqs); + +- mlx5e_build_tx2sq_maps(priv); ++ mlx5e_build_txq_maps(priv); + mlx5e_activate_channels(&priv->channels); + mlx5e_xdp_tx_enable(priv); + netif_tx_start_all_queues(priv->netdev); +@@ -5028,7 +5022,6 @@ static int mlx5e_nic_init(struct mlx5_core_dev *mdev, + if (err) + mlx5_core_err(mdev, "TLS initialization failed, %d\n", err); + mlx5e_build_nic_netdev(netdev); +- mlx5e_build_tc2txq_maps(priv); + mlx5e_health_create_reporters(priv); + + return 0; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +index 7e6ebd0505cc..9f09253f9f46 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +@@ -1601,7 +1601,7 @@ static int mlx5e_grp_channels_fill_strings(struct mlx5e_priv *priv, u8 *data, + for (j = 0; j < NUM_SQ_STATS; j++) + sprintf(data + (idx++) * ETH_GSTRING_LEN, + sq_stats_desc[j].format, +- priv->channel_tc2txq[i][tc]); ++ i + tc * max_nch); + + for (i = 0; i < max_nch; i++) { + for (j = 0; j < NUM_XSKSQ_STATS * is_xsk; j++) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index f90a9f8e0fc6..c2c7f214a56a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -1616,7 +1616,7 @@ static void __mlx5e_tc_del_fdb_peer_flow(struct mlx5e_tc_flow *flow) + flow_flag_clear(flow, DUP); + + mlx5e_tc_del_fdb_flow(flow->peer_flow->priv, flow->peer_flow); +- kvfree(flow->peer_flow); ++ kfree(flow->peer_flow); + flow->peer_flow = NULL; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +index 67dc4f0921b6..dee12f17f9c2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -93,7 +93,7 @@ u16 mlx5e_select_queue(struct net_device *dev, struct sk_buff *skb, + if (txq_ix >= num_channels) + txq_ix = priv->txq2sq[txq_ix]->ch_ix; + +- return priv->channel_tc2txq[txq_ix][up]; ++ return priv->channel_tc2realtxq[txq_ix][up]; + } + + static inline int mlx5e_skb_l2_header_offset(struct sk_buff *skb) +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index 672ea1342add..da1fd0e08c36 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -1979,14 +1979,18 @@ static struct ptp_clock_info ocelot_ptp_clock_info = { + + static int ocelot_init_timestamp(struct ocelot *ocelot) + { ++ struct ptp_clock *ptp_clock; ++ + ocelot->ptp_info = ocelot_ptp_clock_info; +- ocelot->ptp_clock = ptp_clock_register(&ocelot->ptp_info, ocelot->dev); +- if (IS_ERR(ocelot->ptp_clock)) +- return PTR_ERR(ocelot->ptp_clock); ++ ptp_clock = ptp_clock_register(&ocelot->ptp_info, ocelot->dev); ++ if (IS_ERR(ptp_clock)) ++ return PTR_ERR(ptp_clock); + /* Check if PHC support is missing at the configuration level */ +- if (!ocelot->ptp_clock) ++ if (!ptp_clock) + return 0; + ++ ocelot->ptp_clock = ptp_clock; ++ + ocelot_write(ocelot, SYS_PTP_CFG_PTP_STAMP_WID(30), SYS_PTP_CFG); + ocelot_write(ocelot, 0xffffffff, ANA_TABLES_PTP_ID_LOW); + ocelot_write(ocelot, 0xffffffff, ANA_TABLES_PTP_ID_HIGH); +@@ -2213,6 +2217,8 @@ void ocelot_deinit(struct ocelot *ocelot) + destroy_workqueue(ocelot->stats_queue); + mutex_destroy(&ocelot->stats_lock); + ocelot_ace_deinit(); ++ if (ocelot->ptp_clock) ++ ptp_clock_unregister(ocelot->ptp_clock); + + for (i = 0; i < ocelot->num_phys_ports; i++) { + port = ocelot->ports[i]; +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 20faa8d24c9f..134640412d7b 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -1364,12 +1364,9 @@ int ionic_lif_rss_config(struct ionic_lif *lif, const u16 types, + + static int ionic_lif_rss_init(struct ionic_lif *lif) + { +- u8 rss_key[IONIC_RSS_HASH_KEY_SIZE]; + unsigned int tbl_sz; + unsigned int i; + +- netdev_rss_key_fill(rss_key, IONIC_RSS_HASH_KEY_SIZE); +- + lif->rss_types = IONIC_RSS_TYPE_IPV4 | + IONIC_RSS_TYPE_IPV4_TCP | + IONIC_RSS_TYPE_IPV4_UDP | +@@ -1382,12 +1379,18 @@ static int ionic_lif_rss_init(struct ionic_lif *lif) + for (i = 0; i < tbl_sz; i++) + lif->rss_ind_tbl[i] = ethtool_rxfh_indir_default(i, lif->nxqs); + +- return ionic_lif_rss_config(lif, lif->rss_types, rss_key, NULL); ++ return ionic_lif_rss_config(lif, lif->rss_types, NULL, NULL); + } + +-static int ionic_lif_rss_deinit(struct ionic_lif *lif) ++static void ionic_lif_rss_deinit(struct ionic_lif *lif) + { +- return ionic_lif_rss_config(lif, 0x0, NULL, NULL); ++ int tbl_sz; ++ ++ tbl_sz = le16_to_cpu(lif->ionic->ident.lif.eth.rss_ind_tbl_sz); ++ memset(lif->rss_ind_tbl, 0, tbl_sz); ++ memset(lif->rss_hash_key, 0, IONIC_RSS_HASH_KEY_SIZE); ++ ++ ionic_lif_rss_config(lif, 0x0, NULL, NULL); + } + + static void ionic_txrx_disable(struct ionic_lif *lif) +@@ -1710,6 +1713,7 @@ static struct ionic_lif *ionic_lif_alloc(struct ionic *ionic, unsigned int index + dev_err(dev, "Failed to allocate rss indirection table, aborting\n"); + goto err_out_free_qcqs; + } ++ netdev_rss_key_fill(lif->rss_hash_key, IONIC_RSS_HASH_KEY_SIZE); + + list_add_tail(&lif->list, &ionic->lifs); + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 235d51ea4d39..4fe0977d01fa 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -3920,7 +3920,7 @@ static void rtl_wol_suspend_quirk(struct rtl8169_private *tp) + case RTL_GIGA_MAC_VER_32: + case RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_34: +- case RTL_GIGA_MAC_VER_37 ... RTL_GIGA_MAC_VER_51: ++ case RTL_GIGA_MAC_VER_37 ... RTL_GIGA_MAC_VER_61: + RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) | + AcceptBroadcast | AcceptMulticast | AcceptMyPhys); + break; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index f826365c979d..271a00f24f45 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1502,10 +1502,8 @@ static void free_dma_rx_desc_resources(struct stmmac_priv *priv) + rx_q->dma_erx, rx_q->dma_rx_phy); + + kfree(rx_q->buf_pool); +- if (rx_q->page_pool) { +- page_pool_request_shutdown(rx_q->page_pool); ++ if (rx_q->page_pool) + page_pool_destroy(rx_q->page_pool); +- } + } + } + +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index f298d714efd6..d7a953c647b4 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -890,8 +890,8 @@ static irqreturn_t cpsw_rx_interrupt(int irq, void *dev_id) + { + struct cpsw_common *cpsw = dev_id; + +- cpdma_ctlr_eoi(cpsw->dma, CPDMA_EOI_RX); + writel(0, &cpsw->wr_regs->rx_en); ++ cpdma_ctlr_eoi(cpsw->dma, CPDMA_EOI_RX); + + if (cpsw->quirk_irq) { + disable_irq_nosync(cpsw->irqs_table[0]); +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 3ab24fdccd3b..5c6b7fc04ea6 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -853,7 +853,9 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, + if (dst) + return dst; + } +- if (ipv6_stub->ipv6_dst_lookup(geneve->net, gs6->sock->sk, &dst, fl6)) { ++ dst = ipv6_stub->ipv6_dst_lookup_flow(geneve->net, gs6->sock->sk, fl6, ++ NULL); ++ if (IS_ERR(dst)) { + netdev_dbg(dev, "no route to %pI6\n", &fl6->daddr); + return ERR_PTR(-ENETUNREACH); + } +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 8869154fad88..404ac3a0d1c3 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2276,7 +2276,6 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan, + bool use_cache = ip_tunnel_dst_cache_usable(skb, info); + struct dst_entry *ndst; + struct flowi6 fl6; +- int err; + + if (!sock6) + return ERR_PTR(-EIO); +@@ -2299,10 +2298,9 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan, + fl6.fl6_dport = dport; + fl6.fl6_sport = sport; + +- err = ipv6_stub->ipv6_dst_lookup(vxlan->net, +- sock6->sock->sk, +- &ndst, &fl6); +- if (unlikely(err < 0)) { ++ ndst = ipv6_stub->ipv6_dst_lookup_flow(vxlan->net, sock6->sock->sk, ++ &fl6, NULL); ++ if (unlikely(IS_ERR(ndst))) { + netdev_dbg(dev, "no route to %pI6\n", daddr); + return ERR_PTR(-ENETUNREACH); + } +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index c20f190b4c18..76d952aeb0fc 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1867,6 +1867,11 @@ struct net_device { + unsigned char if_port; + unsigned char dma; + ++ /* Note : dev->mtu is often read without holding a lock. ++ * Writers usually hold RTNL. ++ * It is recommended to use READ_ONCE() to annotate the reads, ++ * and to use WRITE_ONCE() to annotate the writes. ++ */ + unsigned int mtu; + unsigned int min_mtu; + unsigned int max_mtu; +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 8688f7adfda7..1ba6e2cc2725 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -3527,8 +3527,9 @@ int __skb_vlan_pop(struct sk_buff *skb, u16 *vlan_tci); + int skb_vlan_pop(struct sk_buff *skb); + int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci); + int skb_mpls_push(struct sk_buff *skb, __be32 mpls_lse, __be16 mpls_proto, +- int mac_len); +-int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto, int mac_len); ++ int mac_len, bool ethernet); ++int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto, int mac_len, ++ bool ethernet); + int skb_mpls_update_lse(struct sk_buff *skb, __be32 mpls_lse); + int skb_mpls_dec_ttl(struct sk_buff *skb); + struct sk_buff *pskb_extract(struct sk_buff *skb, int off, int to_copy, +diff --git a/include/linux/time.h b/include/linux/time.h +index 27d83fd2ae61..5f3e49978837 100644 +--- a/include/linux/time.h ++++ b/include/linux/time.h +@@ -96,4 +96,17 @@ static inline bool itimerspec64_valid(const struct itimerspec64 *its) + */ + #define time_after32(a, b) ((s32)((u32)(b) - (u32)(a)) < 0) + #define time_before32(b, a) time_after32(a, b) ++ ++/** ++ * time_between32 - check if a 32-bit timestamp is within a given time range ++ * @t: the time which may be within [l,h] ++ * @l: the lower bound of the range ++ * @h: the higher bound of the range ++ * ++ * time_before32(t, l, h) returns true if @l <= @t <= @h. All operands are ++ * treated as 32-bit integers. ++ * ++ * Equivalent to !(time_before32(@t, @l) || time_after32(@t, @h)). ++ */ ++#define time_between32(t, l, h) ((u32)(h) - (u32)(l) >= (u32)(t) - (u32)(l)) + #endif +diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h +index 5cd12276ae21..e5fc8db1f783 100644 +--- a/include/net/flow_dissector.h ++++ b/include/net/flow_dissector.h +@@ -229,6 +229,7 @@ enum flow_dissector_key_id { + FLOW_DISSECTOR_KEY_IPV4_ADDRS, /* struct flow_dissector_key_ipv4_addrs */ + FLOW_DISSECTOR_KEY_IPV6_ADDRS, /* struct flow_dissector_key_ipv6_addrs */ + FLOW_DISSECTOR_KEY_PORTS, /* struct flow_dissector_key_ports */ ++ FLOW_DISSECTOR_KEY_PORTS_RANGE, /* struct flow_dissector_key_ports */ + FLOW_DISSECTOR_KEY_ICMP, /* struct flow_dissector_key_icmp */ + FLOW_DISSECTOR_KEY_ETH_ADDRS, /* struct flow_dissector_key_eth_addrs */ + FLOW_DISSECTOR_KEY_TIPC, /* struct flow_dissector_key_tipc */ +diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h +index 86c567f531f3..c6f7bd22db60 100644 +--- a/include/net/flow_offload.h ++++ b/include/net/flow_offload.h +@@ -380,19 +380,18 @@ static inline void flow_block_init(struct flow_block *flow_block) + typedef int flow_indr_block_bind_cb_t(struct net_device *dev, void *cb_priv, + enum tc_setup_type type, void *type_data); + +-typedef void flow_indr_block_ing_cmd_t(struct net_device *dev, +- flow_indr_block_bind_cb_t *cb, +- void *cb_priv, +- enum flow_block_command command); ++typedef void flow_indr_block_cmd_t(struct net_device *dev, ++ flow_indr_block_bind_cb_t *cb, void *cb_priv, ++ enum flow_block_command command); + +-struct flow_indr_block_ing_entry { +- flow_indr_block_ing_cmd_t *cb; ++struct flow_indr_block_entry { ++ flow_indr_block_cmd_t *cb; + struct list_head list; + }; + +-void flow_indr_add_block_ing_cb(struct flow_indr_block_ing_entry *entry); ++void flow_indr_add_block_cb(struct flow_indr_block_entry *entry); + +-void flow_indr_del_block_ing_cb(struct flow_indr_block_ing_entry *entry); ++void flow_indr_del_block_cb(struct flow_indr_block_entry *entry); + + int __flow_indr_block_cb_register(struct net_device *dev, void *cb_priv, + flow_indr_block_bind_cb_t *cb, +diff --git a/include/net/ip.h b/include/net/ip.h +index a2c61c36dc4a..4b15cc1c224c 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -760,4 +760,9 @@ int ip_misc_proc_init(void); + int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto, u8 family, + struct netlink_ext_ack *extack); + ++static inline bool inetdev_valid_mtu(unsigned int mtu) ++{ ++ return likely(mtu >= IPV4_MIN_MTU); ++} ++ + #endif /* _IP_H */ +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 009605c56f20..b59b3dae0f71 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -1017,7 +1017,7 @@ static inline struct sk_buff *ip6_finish_skb(struct sock *sk) + + int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst, + struct flowi6 *fl6); +-struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6, ++struct dst_entry *ip6_dst_lookup_flow(struct net *net, const struct sock *sk, struct flowi6 *fl6, + const struct in6_addr *final_dst); + struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6, + const struct in6_addr *final_dst, +diff --git a/include/net/ipv6_stubs.h b/include/net/ipv6_stubs.h +index 5c93e942c50b..3e7d2c0e79ca 100644 +--- a/include/net/ipv6_stubs.h ++++ b/include/net/ipv6_stubs.h +@@ -24,8 +24,10 @@ struct ipv6_stub { + const struct in6_addr *addr); + int (*ipv6_sock_mc_drop)(struct sock *sk, int ifindex, + const struct in6_addr *addr); +- int (*ipv6_dst_lookup)(struct net *net, struct sock *sk, +- struct dst_entry **dst, struct flowi6 *fl6); ++ struct dst_entry *(*ipv6_dst_lookup_flow)(struct net *net, ++ const struct sock *sk, ++ struct flowi6 *fl6, ++ const struct in6_addr *final_dst); + int (*ipv6_route_input)(struct sk_buff *skb); + + struct fib6_table *(*fib6_get_table)(struct net *net, u32 id); +diff --git a/include/net/page_pool.h b/include/net/page_pool.h +index 2cbcdbdec254..1121faa99c12 100644 +--- a/include/net/page_pool.h ++++ b/include/net/page_pool.h +@@ -70,7 +70,12 @@ struct page_pool_params { + struct page_pool { + struct page_pool_params p; + +- u32 pages_state_hold_cnt; ++ struct delayed_work release_dw; ++ void (*disconnect)(void *); ++ unsigned long defer_start; ++ unsigned long defer_warn; ++ ++ u32 pages_state_hold_cnt; + + /* + * Data structure for allocation side +@@ -129,25 +134,19 @@ inline enum dma_data_direction page_pool_get_dma_dir(struct page_pool *pool) + + struct page_pool *page_pool_create(const struct page_pool_params *params); + +-void __page_pool_free(struct page_pool *pool); +-static inline void page_pool_free(struct page_pool *pool) +-{ +- /* When page_pool isn't compiled-in, net/core/xdp.c doesn't +- * allow registering MEM_TYPE_PAGE_POOL, but shield linker. +- */ + #ifdef CONFIG_PAGE_POOL +- __page_pool_free(pool); +-#endif +-} +- +-/* Drivers use this instead of page_pool_free */ ++void page_pool_destroy(struct page_pool *pool); ++void page_pool_use_xdp_mem(struct page_pool *pool, void (*disconnect)(void *)); ++#else + static inline void page_pool_destroy(struct page_pool *pool) + { +- if (!pool) +- return; ++} + +- page_pool_free(pool); ++static inline void page_pool_use_xdp_mem(struct page_pool *pool, ++ void (*disconnect)(void *)) ++{ + } ++#endif + + /* Never call this directly, use helpers below */ + void __page_pool_put_page(struct page_pool *pool, +@@ -170,24 +169,6 @@ static inline void page_pool_recycle_direct(struct page_pool *pool, + __page_pool_put_page(pool, page, true); + } + +-/* API user MUST have disconnected alloc-side (not allowed to call +- * page_pool_alloc_pages()) before calling this. The free-side can +- * still run concurrently, to handle in-flight packet-pages. +- * +- * A request to shutdown can fail (with false) if there are still +- * in-flight packet-pages. +- */ +-bool __page_pool_request_shutdown(struct page_pool *pool); +-static inline bool page_pool_request_shutdown(struct page_pool *pool) +-{ +- bool safe_to_remove = false; +- +-#ifdef CONFIG_PAGE_POOL +- safe_to_remove = __page_pool_request_shutdown(pool); +-#endif +- return safe_to_remove; +-} +- + /* Disconnects a page (from a page_pool). API users can have a need + * to disconnect a page (from a page_pool), to allow it to be used as + * a regular page (that will eventually be returned to the normal +@@ -216,11 +197,6 @@ static inline bool is_page_pool_compiled_in(void) + #endif + } + +-static inline void page_pool_get(struct page_pool *pool) +-{ +- refcount_inc(&pool->user_cnt); +-} +- + static inline bool page_pool_put(struct page_pool *pool) + { + return refcount_dec_and_test(&pool->user_cnt); +diff --git a/include/net/tcp.h b/include/net/tcp.h +index ab4eb5eb5d07..b2367cfe0bda 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -494,15 +494,16 @@ static inline void tcp_synq_overflow(const struct sock *sk) + reuse = rcu_dereference(sk->sk_reuseport_cb); + if (likely(reuse)) { + last_overflow = READ_ONCE(reuse->synq_overflow_ts); +- if (time_after32(now, last_overflow + HZ)) ++ if (!time_between32(now, last_overflow, ++ last_overflow + HZ)) + WRITE_ONCE(reuse->synq_overflow_ts, now); + return; + } + } + +- last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; +- if (time_after32(now, last_overflow + HZ)) +- tcp_sk(sk)->rx_opt.ts_recent_stamp = now; ++ last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); ++ if (!time_between32(now, last_overflow, last_overflow + HZ)) ++ WRITE_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp, now); + } + + /* syncookies: no recent synqueue overflow on this listening socket? */ +@@ -517,13 +518,23 @@ static inline bool tcp_synq_no_recent_overflow(const struct sock *sk) + reuse = rcu_dereference(sk->sk_reuseport_cb); + if (likely(reuse)) { + last_overflow = READ_ONCE(reuse->synq_overflow_ts); +- return time_after32(now, last_overflow + +- TCP_SYNCOOKIE_VALID); ++ return !time_between32(now, last_overflow - HZ, ++ last_overflow + ++ TCP_SYNCOOKIE_VALID); + } + } + +- last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; +- return time_after32(now, last_overflow + TCP_SYNCOOKIE_VALID); ++ last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); ++ ++ /* If last_overflow <= jiffies <= last_overflow + TCP_SYNCOOKIE_VALID, ++ * then we're under synflood. However, we have to use ++ * 'last_overflow - HZ' as lower bound. That's because a concurrent ++ * tcp_synq_overflow() could update .ts_recent_stamp after we read ++ * jiffies but before we store .ts_recent_stamp into last_overflow, ++ * which could lead to rejecting a valid syncookie. ++ */ ++ return !time_between32(now, last_overflow - HZ, ++ last_overflow + TCP_SYNCOOKIE_VALID); + } + + static inline u32 tcp_cookie_time(void) +diff --git a/include/net/xdp_priv.h b/include/net/xdp_priv.h +index 6a8cba6ea79a..a9d5b7603b89 100644 +--- a/include/net/xdp_priv.h ++++ b/include/net/xdp_priv.h +@@ -12,12 +12,8 @@ struct xdp_mem_allocator { + struct page_pool *page_pool; + struct zero_copy_allocator *zc_alloc; + }; +- int disconnect_cnt; +- unsigned long defer_start; + struct rhash_head node; + struct rcu_head rcu; +- struct delayed_work defer_wq; +- unsigned long defer_warn; + }; + + #endif /* __LINUX_NET_XDP_PRIV_H__ */ +diff --git a/include/trace/events/xdp.h b/include/trace/events/xdp.h +index 8c8420230a10..c79943e82a54 100644 +--- a/include/trace/events/xdp.h ++++ b/include/trace/events/xdp.h +@@ -317,19 +317,15 @@ __MEM_TYPE_MAP(__MEM_TYPE_TP_FN) + + TRACE_EVENT(mem_disconnect, + +- TP_PROTO(const struct xdp_mem_allocator *xa, +- bool safe_to_remove, bool force), ++ TP_PROTO(const struct xdp_mem_allocator *xa), + +- TP_ARGS(xa, safe_to_remove, force), ++ TP_ARGS(xa), + + TP_STRUCT__entry( + __field(const struct xdp_mem_allocator *, xa) + __field(u32, mem_id) + __field(u32, mem_type) + __field(const void *, allocator) +- __field(bool, safe_to_remove) +- __field(bool, force) +- __field(int, disconnect_cnt) + ), + + TP_fast_assign( +@@ -337,19 +333,12 @@ TRACE_EVENT(mem_disconnect, + __entry->mem_id = xa->mem.id; + __entry->mem_type = xa->mem.type; + __entry->allocator = xa->allocator; +- __entry->safe_to_remove = safe_to_remove; +- __entry->force = force; +- __entry->disconnect_cnt = xa->disconnect_cnt; + ), + +- TP_printk("mem_id=%d mem_type=%s allocator=%p" +- " safe_to_remove=%s force=%s disconnect_cnt=%d", ++ TP_printk("mem_id=%d mem_type=%s allocator=%p", + __entry->mem_id, + __print_symbolic(__entry->mem_type, __MEM_TYPE_SYM_TAB), +- __entry->allocator, +- __entry->safe_to_remove ? "true" : "false", +- __entry->force ? "true" : "false", +- __entry->disconnect_cnt ++ __entry->allocator + ) + ); + +diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c +index e804a3016902..022dc6e504c4 100644 +--- a/net/bridge/br_device.c ++++ b/net/bridge/br_device.c +@@ -245,6 +245,12 @@ static int br_set_mac_address(struct net_device *dev, void *p) + if (!is_valid_ether_addr(addr->sa_data)) + return -EADDRNOTAVAIL; + ++ /* dev_set_mac_addr() can be called by a master device on bridge's ++ * NETDEV_UNREGISTER, but since it's being destroyed do nothing ++ */ ++ if (dev->reg_state != NETREG_REGISTERED) ++ return -EBUSY; ++ + spin_lock_bh(&br->lock); + if (!ether_addr_equal(dev->dev_addr, addr->sa_data)) { + /* Mac address will be changed in br_stp_change_bridge_id(). */ +diff --git a/net/core/dev.c b/net/core/dev.c +index 99ac84ff398f..046307445ece 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -7967,7 +7967,8 @@ int __dev_set_mtu(struct net_device *dev, int new_mtu) + if (ops->ndo_change_mtu) + return ops->ndo_change_mtu(dev, new_mtu); + +- dev->mtu = new_mtu; ++ /* Pairs with all the lockless reads of dev->mtu in the stack */ ++ WRITE_ONCE(dev->mtu, new_mtu); + return 0; + } + EXPORT_SYMBOL(__dev_set_mtu); +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index 68eda10d0680..1292f3f0f93f 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -683,6 +683,31 @@ __skb_flow_dissect_tcp(const struct sk_buff *skb, + key_tcp->flags = (*(__be16 *) &tcp_flag_word(th) & htons(0x0FFF)); + } + ++static void ++__skb_flow_dissect_ports(const struct sk_buff *skb, ++ struct flow_dissector *flow_dissector, ++ void *target_container, void *data, int nhoff, ++ u8 ip_proto, int hlen) ++{ ++ enum flow_dissector_key_id dissector_ports = FLOW_DISSECTOR_KEY_MAX; ++ struct flow_dissector_key_ports *key_ports; ++ ++ if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS)) ++ dissector_ports = FLOW_DISSECTOR_KEY_PORTS; ++ else if (dissector_uses_key(flow_dissector, ++ FLOW_DISSECTOR_KEY_PORTS_RANGE)) ++ dissector_ports = FLOW_DISSECTOR_KEY_PORTS_RANGE; ++ ++ if (dissector_ports == FLOW_DISSECTOR_KEY_MAX) ++ return; ++ ++ key_ports = skb_flow_dissector_target(flow_dissector, ++ dissector_ports, ++ target_container); ++ key_ports->ports = __skb_flow_get_ports(skb, nhoff, ip_proto, ++ data, hlen); ++} ++ + static void + __skb_flow_dissect_ipv4(const struct sk_buff *skb, + struct flow_dissector *flow_dissector, +@@ -852,7 +877,6 @@ bool __skb_flow_dissect(const struct net *net, + struct flow_dissector_key_control *key_control; + struct flow_dissector_key_basic *key_basic; + struct flow_dissector_key_addrs *key_addrs; +- struct flow_dissector_key_ports *key_ports; + struct flow_dissector_key_icmp *key_icmp; + struct flow_dissector_key_tags *key_tags; + struct flow_dissector_key_vlan *key_vlan; +@@ -870,9 +894,10 @@ bool __skb_flow_dissect(const struct net *net, + nhoff = skb_network_offset(skb); + hlen = skb_headlen(skb); + #if IS_ENABLED(CONFIG_NET_DSA) +- if (unlikely(skb->dev && netdev_uses_dsa(skb->dev))) { ++ if (unlikely(skb->dev && netdev_uses_dsa(skb->dev) && ++ proto == htons(ETH_P_XDSA))) { + const struct dsa_device_ops *ops; +- int offset; ++ int offset = 0; + + ops = skb->dev->dsa_ptr->tag_ops; + if (ops->flow_dissect && +@@ -1299,14 +1324,9 @@ ip_proto_again: + break; + } + +- if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS) && +- !(key_control->flags & FLOW_DIS_IS_FRAGMENT)) { +- key_ports = skb_flow_dissector_target(flow_dissector, +- FLOW_DISSECTOR_KEY_PORTS, +- target_container); +- key_ports->ports = __skb_flow_get_ports(skb, nhoff, ip_proto, +- data, hlen); +- } ++ if (!(key_control->flags & FLOW_DIS_IS_FRAGMENT)) ++ __skb_flow_dissect_ports(skb, flow_dissector, target_container, ++ data, nhoff, ip_proto, hlen); + + if (dissector_uses_key(flow_dissector, + FLOW_DISSECTOR_KEY_ICMP)) { +diff --git a/net/core/flow_offload.c b/net/core/flow_offload.c +index cf52d9c422fa..45b6a59ac124 100644 +--- a/net/core/flow_offload.c ++++ b/net/core/flow_offload.c +@@ -283,7 +283,7 @@ int flow_block_cb_setup_simple(struct flow_block_offload *f, + } + EXPORT_SYMBOL(flow_block_cb_setup_simple); + +-static LIST_HEAD(block_ing_cb_list); ++static LIST_HEAD(block_cb_list); + + static struct rhashtable indr_setup_block_ht; + +@@ -391,20 +391,19 @@ static void flow_indr_block_cb_del(struct flow_indr_block_cb *indr_block_cb) + kfree(indr_block_cb); + } + +-static DEFINE_MUTEX(flow_indr_block_ing_cb_lock); ++static DEFINE_MUTEX(flow_indr_block_cb_lock); + +-static void flow_block_ing_cmd(struct net_device *dev, +- flow_indr_block_bind_cb_t *cb, +- void *cb_priv, +- enum flow_block_command command) ++static void flow_block_cmd(struct net_device *dev, ++ flow_indr_block_bind_cb_t *cb, void *cb_priv, ++ enum flow_block_command command) + { +- struct flow_indr_block_ing_entry *entry; ++ struct flow_indr_block_entry *entry; + +- mutex_lock(&flow_indr_block_ing_cb_lock); +- list_for_each_entry(entry, &block_ing_cb_list, list) { ++ mutex_lock(&flow_indr_block_cb_lock); ++ list_for_each_entry(entry, &block_cb_list, list) { + entry->cb(dev, cb, cb_priv, command); + } +- mutex_unlock(&flow_indr_block_ing_cb_lock); ++ mutex_unlock(&flow_indr_block_cb_lock); + } + + int __flow_indr_block_cb_register(struct net_device *dev, void *cb_priv, +@@ -424,8 +423,8 @@ int __flow_indr_block_cb_register(struct net_device *dev, void *cb_priv, + if (err) + goto err_dev_put; + +- flow_block_ing_cmd(dev, indr_block_cb->cb, indr_block_cb->cb_priv, +- FLOW_BLOCK_BIND); ++ flow_block_cmd(dev, indr_block_cb->cb, indr_block_cb->cb_priv, ++ FLOW_BLOCK_BIND); + + return 0; + +@@ -464,8 +463,8 @@ void __flow_indr_block_cb_unregister(struct net_device *dev, + if (!indr_block_cb) + return; + +- flow_block_ing_cmd(dev, indr_block_cb->cb, indr_block_cb->cb_priv, +- FLOW_BLOCK_UNBIND); ++ flow_block_cmd(dev, indr_block_cb->cb, indr_block_cb->cb_priv, ++ FLOW_BLOCK_UNBIND); + + flow_indr_block_cb_del(indr_block_cb); + flow_indr_block_dev_put(indr_dev); +@@ -499,21 +498,21 @@ void flow_indr_block_call(struct net_device *dev, + } + EXPORT_SYMBOL_GPL(flow_indr_block_call); + +-void flow_indr_add_block_ing_cb(struct flow_indr_block_ing_entry *entry) ++void flow_indr_add_block_cb(struct flow_indr_block_entry *entry) + { +- mutex_lock(&flow_indr_block_ing_cb_lock); +- list_add_tail(&entry->list, &block_ing_cb_list); +- mutex_unlock(&flow_indr_block_ing_cb_lock); ++ mutex_lock(&flow_indr_block_cb_lock); ++ list_add_tail(&entry->list, &block_cb_list); ++ mutex_unlock(&flow_indr_block_cb_lock); + } +-EXPORT_SYMBOL_GPL(flow_indr_add_block_ing_cb); ++EXPORT_SYMBOL_GPL(flow_indr_add_block_cb); + +-void flow_indr_del_block_ing_cb(struct flow_indr_block_ing_entry *entry) ++void flow_indr_del_block_cb(struct flow_indr_block_entry *entry) + { +- mutex_lock(&flow_indr_block_ing_cb_lock); ++ mutex_lock(&flow_indr_block_cb_lock); + list_del(&entry->list); +- mutex_unlock(&flow_indr_block_ing_cb_lock); ++ mutex_unlock(&flow_indr_block_cb_lock); + } +-EXPORT_SYMBOL_GPL(flow_indr_del_block_ing_cb); ++EXPORT_SYMBOL_GPL(flow_indr_del_block_cb); + + static int __init init_flow_indr_rhashtable(void) + { +diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c +index 74cfb8b5ab33..99a6de52b21d 100644 +--- a/net/core/lwt_bpf.c ++++ b/net/core/lwt_bpf.c +@@ -230,9 +230,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) + fl6.daddr = iph6->daddr; + fl6.saddr = iph6->saddr; + +- err = ipv6_stub->ipv6_dst_lookup(net, skb->sk, &dst, &fl6); +- if (unlikely(err)) +- goto err; ++ dst = ipv6_stub->ipv6_dst_lookup_flow(net, skb->sk, &fl6, NULL); + if (IS_ERR(dst)) { + err = PTR_ERR(dst); + goto err; +diff --git a/net/core/page_pool.c b/net/core/page_pool.c +index 5bc65587f1c4..dfc2501c35d9 100644 +--- a/net/core/page_pool.c ++++ b/net/core/page_pool.c +@@ -18,6 +18,9 @@ + + #include + ++#define DEFER_TIME (msecs_to_jiffies(1000)) ++#define DEFER_WARN_INTERVAL (60 * HZ) ++ + static int page_pool_init(struct page_pool *pool, + const struct page_pool_params *params) + { +@@ -193,22 +196,14 @@ static s32 page_pool_inflight(struct page_pool *pool) + { + u32 release_cnt = atomic_read(&pool->pages_state_release_cnt); + u32 hold_cnt = READ_ONCE(pool->pages_state_hold_cnt); +- s32 distance; +- +- distance = _distance(hold_cnt, release_cnt); +- +- trace_page_pool_inflight(pool, distance, hold_cnt, release_cnt); +- return distance; +-} ++ s32 inflight; + +-static bool __page_pool_safe_to_destroy(struct page_pool *pool) +-{ +- s32 inflight = page_pool_inflight(pool); ++ inflight = _distance(hold_cnt, release_cnt); + +- /* The distance should not be able to become negative */ ++ trace_page_pool_inflight(pool, inflight, hold_cnt, release_cnt); + WARN(inflight < 0, "Negative(%d) inflight packet-pages", inflight); + +- return (inflight == 0); ++ return inflight; + } + + /* Cleanup page_pool state from page */ +@@ -216,6 +211,7 @@ static void __page_pool_clean_page(struct page_pool *pool, + struct page *page) + { + dma_addr_t dma; ++ int count; + + if (!(pool->p.flags & PP_FLAG_DMA_MAP)) + goto skip_dma_unmap; +@@ -227,9 +223,11 @@ static void __page_pool_clean_page(struct page_pool *pool, + DMA_ATTR_SKIP_CPU_SYNC); + page->dma_addr = 0; + skip_dma_unmap: +- atomic_inc(&pool->pages_state_release_cnt); +- trace_page_pool_state_release(pool, page, +- atomic_read(&pool->pages_state_release_cnt)); ++ /* This may be the last page returned, releasing the pool, so ++ * it is not safe to reference pool afterwards. ++ */ ++ count = atomic_inc_return(&pool->pages_state_release_cnt); ++ trace_page_pool_state_release(pool, page, count); + } + + /* unmap the page and clean our state */ +@@ -338,31 +336,10 @@ static void __page_pool_empty_ring(struct page_pool *pool) + } + } + +-static void __warn_in_flight(struct page_pool *pool) ++static void page_pool_free(struct page_pool *pool) + { +- u32 release_cnt = atomic_read(&pool->pages_state_release_cnt); +- u32 hold_cnt = READ_ONCE(pool->pages_state_hold_cnt); +- s32 distance; +- +- distance = _distance(hold_cnt, release_cnt); +- +- /* Drivers should fix this, but only problematic when DMA is used */ +- WARN(1, "Still in-flight pages:%d hold:%u released:%u", +- distance, hold_cnt, release_cnt); +-} +- +-void __page_pool_free(struct page_pool *pool) +-{ +- /* Only last user actually free/release resources */ +- if (!page_pool_put(pool)) +- return; +- +- WARN(pool->alloc.count, "API usage violation"); +- WARN(!ptr_ring_empty(&pool->ring), "ptr_ring is not empty"); +- +- /* Can happen due to forced shutdown */ +- if (!__page_pool_safe_to_destroy(pool)) +- __warn_in_flight(pool); ++ if (pool->disconnect) ++ pool->disconnect(pool); + + ptr_ring_cleanup(&pool->ring, NULL); + +@@ -371,12 +348,8 @@ void __page_pool_free(struct page_pool *pool) + + kfree(pool); + } +-EXPORT_SYMBOL(__page_pool_free); + +-/* Request to shutdown: release pages cached by page_pool, and check +- * for in-flight pages +- */ +-bool __page_pool_request_shutdown(struct page_pool *pool) ++static void page_pool_scrub(struct page_pool *pool) + { + struct page *page; + +@@ -393,7 +366,64 @@ bool __page_pool_request_shutdown(struct page_pool *pool) + * be in-flight. + */ + __page_pool_empty_ring(pool); ++} ++ ++static int page_pool_release(struct page_pool *pool) ++{ ++ int inflight; ++ ++ page_pool_scrub(pool); ++ inflight = page_pool_inflight(pool); ++ if (!inflight) ++ page_pool_free(pool); ++ ++ return inflight; ++} ++ ++static void page_pool_release_retry(struct work_struct *wq) ++{ ++ struct delayed_work *dwq = to_delayed_work(wq); ++ struct page_pool *pool = container_of(dwq, typeof(*pool), release_dw); ++ int inflight; ++ ++ inflight = page_pool_release(pool); ++ if (!inflight) ++ return; ++ ++ /* Periodic warning */ ++ if (time_after_eq(jiffies, pool->defer_warn)) { ++ int sec = (s32)((u32)jiffies - (u32)pool->defer_start) / HZ; ++ ++ pr_warn("%s() stalled pool shutdown %d inflight %d sec\n", ++ __func__, inflight, sec); ++ pool->defer_warn = jiffies + DEFER_WARN_INTERVAL; ++ } ++ ++ /* Still not ready to be disconnected, retry later */ ++ schedule_delayed_work(&pool->release_dw, DEFER_TIME); ++} ++ ++void page_pool_use_xdp_mem(struct page_pool *pool, void (*disconnect)(void *)) ++{ ++ refcount_inc(&pool->user_cnt); ++ pool->disconnect = disconnect; ++} ++ ++void page_pool_destroy(struct page_pool *pool) ++{ ++ if (!pool) ++ return; ++ ++ if (!page_pool_put(pool)) ++ return; ++ ++ if (!page_pool_release(pool)) ++ return; ++ ++ pool->defer_start = jiffies; ++ pool->defer_warn = jiffies + DEFER_WARN_INTERVAL; + +- return __page_pool_safe_to_destroy(pool); ++ INIT_DELAYED_WORK(&pool->release_dw, page_pool_release_retry); ++ schedule_delayed_work(&pool->release_dw, DEFER_TIME); + } +-EXPORT_SYMBOL(__page_pool_request_shutdown); ++EXPORT_SYMBOL(page_pool_destroy); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 867e61df00db..973a71f4bc89 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -5484,7 +5484,7 @@ static void skb_mod_eth_type(struct sk_buff *skb, struct ethhdr *hdr, + * Returns 0 on success, -errno otherwise. + */ + int skb_mpls_push(struct sk_buff *skb, __be32 mpls_lse, __be16 mpls_proto, +- int mac_len) ++ int mac_len, bool ethernet) + { + struct mpls_shim_hdr *lse; + int err; +@@ -5515,7 +5515,7 @@ int skb_mpls_push(struct sk_buff *skb, __be32 mpls_lse, __be16 mpls_proto, + lse->label_stack_entry = mpls_lse; + skb_postpush_rcsum(skb, lse, MPLS_HLEN); + +- if (skb->dev && skb->dev->type == ARPHRD_ETHER) ++ if (ethernet) + skb_mod_eth_type(skb, eth_hdr(skb), mpls_proto); + skb->protocol = mpls_proto; + +@@ -5529,12 +5529,14 @@ EXPORT_SYMBOL_GPL(skb_mpls_push); + * @skb: buffer + * @next_proto: ethertype of header after popped MPLS header + * @mac_len: length of the MAC header ++ * @ethernet: flag to indicate if ethernet header is present in packet + * + * Expects skb->data at mac header. + * + * Returns 0 on success, -errno otherwise. + */ +-int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto, int mac_len) ++int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto, int mac_len, ++ bool ethernet) + { + int err; + +@@ -5553,7 +5555,7 @@ int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto, int mac_len) + skb_reset_mac_header(skb); + skb_set_network_header(skb, mac_len); + +- if (skb->dev && skb->dev->type == ARPHRD_ETHER) { ++ if (ethernet) { + struct ethhdr *hdr; + + /* use mpls_hdr() to get ethertype to account for VLANs. */ +diff --git a/net/core/xdp.c b/net/core/xdp.c +index d7bf62ffbb5e..b3f463c6543f 100644 +--- a/net/core/xdp.c ++++ b/net/core/xdp.c +@@ -70,10 +70,6 @@ static void __xdp_mem_allocator_rcu_free(struct rcu_head *rcu) + + xa = container_of(rcu, struct xdp_mem_allocator, rcu); + +- /* Allocator have indicated safe to remove before this is called */ +- if (xa->mem.type == MEM_TYPE_PAGE_POOL) +- page_pool_free(xa->page_pool); +- + /* Allow this ID to be reused */ + ida_simple_remove(&mem_id_pool, xa->mem.id); + +@@ -85,62 +81,57 @@ static void __xdp_mem_allocator_rcu_free(struct rcu_head *rcu) + kfree(xa); + } + +-static bool __mem_id_disconnect(int id, bool force) ++static void mem_xa_remove(struct xdp_mem_allocator *xa) ++{ ++ trace_mem_disconnect(xa); ++ ++ if (!rhashtable_remove_fast(mem_id_ht, &xa->node, mem_id_rht_params)) ++ call_rcu(&xa->rcu, __xdp_mem_allocator_rcu_free); ++} ++ ++static void mem_allocator_disconnect(void *allocator) + { + struct xdp_mem_allocator *xa; +- bool safe_to_remove = true; ++ struct rhashtable_iter iter; + + mutex_lock(&mem_id_lock); + +- xa = rhashtable_lookup_fast(mem_id_ht, &id, mem_id_rht_params); +- if (!xa) { +- mutex_unlock(&mem_id_lock); +- WARN(1, "Request remove non-existing id(%d), driver bug?", id); +- return true; +- } +- xa->disconnect_cnt++; ++ rhashtable_walk_enter(mem_id_ht, &iter); ++ do { ++ rhashtable_walk_start(&iter); + +- /* Detects in-flight packet-pages for page_pool */ +- if (xa->mem.type == MEM_TYPE_PAGE_POOL) +- safe_to_remove = page_pool_request_shutdown(xa->page_pool); ++ while ((xa = rhashtable_walk_next(&iter)) && !IS_ERR(xa)) { ++ if (xa->allocator == allocator) ++ mem_xa_remove(xa); ++ } + +- trace_mem_disconnect(xa, safe_to_remove, force); ++ rhashtable_walk_stop(&iter); + +- if ((safe_to_remove || force) && +- !rhashtable_remove_fast(mem_id_ht, &xa->node, mem_id_rht_params)) +- call_rcu(&xa->rcu, __xdp_mem_allocator_rcu_free); ++ } while (xa == ERR_PTR(-EAGAIN)); ++ rhashtable_walk_exit(&iter); + + mutex_unlock(&mem_id_lock); +- return (safe_to_remove|force); + } + +-#define DEFER_TIME (msecs_to_jiffies(1000)) +-#define DEFER_WARN_INTERVAL (30 * HZ) +-#define DEFER_MAX_RETRIES 120 +- +-static void mem_id_disconnect_defer_retry(struct work_struct *wq) ++static void mem_id_disconnect(int id) + { +- struct delayed_work *dwq = to_delayed_work(wq); +- struct xdp_mem_allocator *xa = container_of(dwq, typeof(*xa), defer_wq); +- bool force = false; ++ struct xdp_mem_allocator *xa; + +- if (xa->disconnect_cnt > DEFER_MAX_RETRIES) +- force = true; ++ mutex_lock(&mem_id_lock); + +- if (__mem_id_disconnect(xa->mem.id, force)) ++ xa = rhashtable_lookup_fast(mem_id_ht, &id, mem_id_rht_params); ++ if (!xa) { ++ mutex_unlock(&mem_id_lock); ++ WARN(1, "Request remove non-existing id(%d), driver bug?", id); + return; ++ } + +- /* Periodic warning */ +- if (time_after_eq(jiffies, xa->defer_warn)) { +- int sec = (s32)((u32)jiffies - (u32)xa->defer_start) / HZ; ++ trace_mem_disconnect(xa); + +- pr_warn("%s() stalled mem.id=%u shutdown %d attempts %d sec\n", +- __func__, xa->mem.id, xa->disconnect_cnt, sec); +- xa->defer_warn = jiffies + DEFER_WARN_INTERVAL; +- } ++ if (!rhashtable_remove_fast(mem_id_ht, &xa->node, mem_id_rht_params)) ++ call_rcu(&xa->rcu, __xdp_mem_allocator_rcu_free); + +- /* Still not ready to be disconnected, retry later */ +- schedule_delayed_work(&xa->defer_wq, DEFER_TIME); ++ mutex_unlock(&mem_id_lock); + } + + void xdp_rxq_info_unreg_mem_model(struct xdp_rxq_info *xdp_rxq) +@@ -153,38 +144,21 @@ void xdp_rxq_info_unreg_mem_model(struct xdp_rxq_info *xdp_rxq) + return; + } + +- if (xdp_rxq->mem.type != MEM_TYPE_PAGE_POOL && +- xdp_rxq->mem.type != MEM_TYPE_ZERO_COPY) { +- return; +- } +- + if (id == 0) + return; + +- if (__mem_id_disconnect(id, false)) +- return; +- +- /* Could not disconnect, defer new disconnect attempt to later */ +- mutex_lock(&mem_id_lock); ++ if (xdp_rxq->mem.type == MEM_TYPE_ZERO_COPY) ++ return mem_id_disconnect(id); + +- xa = rhashtable_lookup_fast(mem_id_ht, &id, mem_id_rht_params); +- if (!xa) { +- mutex_unlock(&mem_id_lock); +- return; ++ if (xdp_rxq->mem.type == MEM_TYPE_PAGE_POOL) { ++ rcu_read_lock(); ++ xa = rhashtable_lookup(mem_id_ht, &id, mem_id_rht_params); ++ page_pool_destroy(xa->page_pool); ++ rcu_read_unlock(); + } +- xa->defer_start = jiffies; +- xa->defer_warn = jiffies + DEFER_WARN_INTERVAL; +- +- INIT_DELAYED_WORK(&xa->defer_wq, mem_id_disconnect_defer_retry); +- mutex_unlock(&mem_id_lock); +- schedule_delayed_work(&xa->defer_wq, DEFER_TIME); + } + EXPORT_SYMBOL_GPL(xdp_rxq_info_unreg_mem_model); + +-/* This unregister operation will also cleanup and destroy the +- * allocator. The page_pool_free() operation is first called when it's +- * safe to remove, possibly deferred to a workqueue. +- */ + void xdp_rxq_info_unreg(struct xdp_rxq_info *xdp_rxq) + { + /* Simplify driver cleanup code paths, allow unreg "unused" */ +@@ -371,7 +345,7 @@ int xdp_rxq_info_reg_mem_model(struct xdp_rxq_info *xdp_rxq, + } + + if (type == MEM_TYPE_PAGE_POOL) +- page_pool_get(xdp_alloc->page_pool); ++ page_pool_use_xdp_mem(allocator, mem_allocator_disconnect); + + mutex_unlock(&mem_id_lock); + +@@ -402,15 +376,8 @@ static void __xdp_return(void *data, struct xdp_mem_info *mem, bool napi_direct, + /* mem->id is valid, checked in xdp_rxq_info_reg_mem_model() */ + xa = rhashtable_lookup(mem_id_ht, &mem->id, mem_id_rht_params); + page = virt_to_head_page(data); +- if (likely(xa)) { +- napi_direct &= !xdp_return_frame_no_direct(); +- page_pool_put_page(xa->page_pool, page, napi_direct); +- } else { +- /* Hopefully stack show who to blame for late return */ +- WARN_ONCE(1, "page_pool gone mem.id=%d", mem->id); +- trace_mem_return_failed(mem, page); +- put_page(page); +- } ++ napi_direct &= !xdp_return_frame_no_direct(); ++ page_pool_put_page(xa->page_pool, page, napi_direct); + rcu_read_unlock(); + break; + case MEM_TYPE_PAGE_SHARED: +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index 25aab672fc99..1e5e08cc0bfc 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -210,7 +210,7 @@ static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final); + rcu_read_unlock(); + +- dst = ip6_dst_lookup_flow(sk, &fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + err = PTR_ERR(dst); + dst = NULL; +@@ -282,7 +282,7 @@ static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb) + security_skb_classify_flow(rxskb, flowi6_to_flowi(&fl6)); + + /* sk = NULL, but it is safe for now. RST socket required. */ +- dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL); ++ dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL); + if (!IS_ERR(dst)) { + skb_dst_set(skb, dst); + ip6_xmit(ctl_sk, skb, &fl6, 0, NULL, 0, 0); +@@ -912,7 +912,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr, + opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk)); + final_p = fl6_update_dst(&fl6, opt, &final); + +- dst = ip6_dst_lookup_flow(sk, &fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + err = PTR_ERR(dst); + goto failure; +diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c +index f509b495451a..b01e1bae4ddc 100644 +--- a/net/hsr/hsr_device.c ++++ b/net/hsr/hsr_device.c +@@ -227,8 +227,13 @@ static int hsr_dev_xmit(struct sk_buff *skb, struct net_device *dev) + struct hsr_port *master; + + master = hsr_port_get_hsr(hsr, HSR_PT_MASTER); +- skb->dev = master->dev; +- hsr_forward_skb(skb, master); ++ if (master) { ++ skb->dev = master->dev; ++ hsr_forward_skb(skb, master); ++ } else { ++ atomic_long_inc(&dev->tx_dropped); ++ dev_kfree_skb_any(skb); ++ } + return NETDEV_TX_OK; + } + +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index a4b5bd4d2c89..e4632bd2026d 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1496,11 +1496,6 @@ skip: + } + } + +-static bool inetdev_valid_mtu(unsigned int mtu) +-{ +- return mtu >= IPV4_MIN_MTU; +-} +- + static void inetdev_send_gratuitous_arp(struct net_device *dev, + struct in_device *in_dev) + +diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c +index 44bfeecac33e..5fd6e8ed02b5 100644 +--- a/net/ipv4/gre_demux.c ++++ b/net/ipv4/gre_demux.c +@@ -127,7 +127,7 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, + if (!pskb_may_pull(skb, nhs + hdr_len + sizeof(*ershdr))) + return -EINVAL; + +- ershdr = (struct erspan_base_hdr *)options; ++ ershdr = (struct erspan_base_hdr *)(skb->data + nhs + hdr_len); + tpi->key = cpu_to_be32(get_session_id(ershdr)); + } + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 3d8baaaf7086..b268ee1c1b44 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1258,15 +1258,18 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, + cork->addr = ipc->addr; + } + +- /* +- * We steal reference to this route, caller should not release it +- */ +- *rtp = NULL; + cork->fragsize = ip_sk_use_pmtu(sk) ? +- dst_mtu(&rt->dst) : rt->dst.dev->mtu; ++ dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu); ++ ++ if (!inetdev_valid_mtu(cork->fragsize)) ++ return -ENETUNREACH; + + cork->gso_size = ipc->gso_size; ++ + cork->dst = &rt->dst; ++ /* We stole this route, caller should not release it. */ ++ *rtp = NULL; ++ + cork->length = 0; + cork->ttl = ipc->ttl; + cork->tos = ipc->tos; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 0488607c5cd3..762edd800d78 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -755,8 +755,9 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb + min_t(unsigned int, eff_sacks, + (remaining - TCPOLEN_SACK_BASE_ALIGNED) / + TCPOLEN_SACK_PERBLOCK); +- size += TCPOLEN_SACK_BASE_ALIGNED + +- opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; ++ if (likely(opts->num_sack_blocks)) ++ size += TCPOLEN_SACK_BASE_ALIGNED + ++ opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; + } + + return size; +diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c +index 2fc079284ca4..ea00ce3d4117 100644 +--- a/net/ipv6/addrconf_core.c ++++ b/net/ipv6/addrconf_core.c +@@ -129,11 +129,12 @@ int inet6addr_validator_notifier_call_chain(unsigned long val, void *v) + } + EXPORT_SYMBOL(inet6addr_validator_notifier_call_chain); + +-static int eafnosupport_ipv6_dst_lookup(struct net *net, struct sock *u1, +- struct dst_entry **u2, +- struct flowi6 *u3) ++static struct dst_entry *eafnosupport_ipv6_dst_lookup_flow(struct net *net, ++ const struct sock *sk, ++ struct flowi6 *fl6, ++ const struct in6_addr *final_dst) + { +- return -EAFNOSUPPORT; ++ return ERR_PTR(-EAFNOSUPPORT); + } + + static int eafnosupport_ipv6_route_input(struct sk_buff *skb) +@@ -190,7 +191,7 @@ static int eafnosupport_ip6_del_rt(struct net *net, struct fib6_info *rt) + } + + const struct ipv6_stub *ipv6_stub __read_mostly = &(struct ipv6_stub) { +- .ipv6_dst_lookup = eafnosupport_ipv6_dst_lookup, ++ .ipv6_dst_lookup_flow = eafnosupport_ipv6_dst_lookup_flow, + .ipv6_route_input = eafnosupport_ipv6_route_input, + .fib6_get_table = eafnosupport_fib6_get_table, + .fib6_table_lookup = eafnosupport_fib6_table_lookup, +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index ef37e0574f54..14ac1d911287 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -765,7 +765,7 @@ int inet6_sk_rebuild_header(struct sock *sk) + &final); + rcu_read_unlock(); + +- dst = ip6_dst_lookup_flow(sk, &fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + sk->sk_route_caps = 0; + sk->sk_err_soft = -PTR_ERR(dst); +@@ -946,7 +946,7 @@ static int ipv6_route_input(struct sk_buff *skb) + static const struct ipv6_stub ipv6_stub_impl = { + .ipv6_sock_mc_join = ipv6_sock_mc_join, + .ipv6_sock_mc_drop = ipv6_sock_mc_drop, +- .ipv6_dst_lookup = ip6_dst_lookup, ++ .ipv6_dst_lookup_flow = ip6_dst_lookup_flow, + .ipv6_route_input = ipv6_route_input, + .fib6_get_table = fib6_get_table, + .fib6_table_lookup = fib6_table_lookup, +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index 96f939248d2f..390bedde21a5 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -85,7 +85,7 @@ int ip6_datagram_dst_update(struct sock *sk, bool fix_sk_saddr) + final_p = fl6_update_dst(&fl6, opt, &final); + rcu_read_unlock(); + +- dst = ip6_dst_lookup_flow(sk, &fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + err = PTR_ERR(dst); + goto out; +diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c +index 0a0945a5b30d..fe9cb8d1adca 100644 +--- a/net/ipv6/inet6_connection_sock.c ++++ b/net/ipv6/inet6_connection_sock.c +@@ -48,7 +48,7 @@ struct dst_entry *inet6_csk_route_req(const struct sock *sk, + fl6->flowi6_uid = sk->sk_uid; + security_req_classify_flow(req, flowi6_to_flowi(fl6)); + +- dst = ip6_dst_lookup_flow(sk, fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p); + if (IS_ERR(dst)) + return NULL; + +@@ -103,7 +103,7 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk, + + dst = __inet6_csk_dst_check(sk, np->dst_cookie); + if (!dst) { +- dst = ip6_dst_lookup_flow(sk, fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p); + + if (!IS_ERR(dst)) + ip6_dst_store(sk, dst, NULL, NULL); +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 71827b56c006..78d495581d69 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1144,19 +1144,19 @@ EXPORT_SYMBOL_GPL(ip6_dst_lookup); + * It returns a valid dst pointer on success, or a pointer encoded + * error code. + */ +-struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6, ++struct dst_entry *ip6_dst_lookup_flow(struct net *net, const struct sock *sk, struct flowi6 *fl6, + const struct in6_addr *final_dst) + { + struct dst_entry *dst = NULL; + int err; + +- err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6); ++ err = ip6_dst_lookup_tail(net, sk, &dst, fl6); + if (err) + return ERR_PTR(err); + if (final_dst) + fl6->daddr = *final_dst; + +- return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0); ++ return xfrm_lookup_route(net, dst, flowi6_to_flowi(fl6), sk, 0); + } + EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow); + +@@ -1188,7 +1188,7 @@ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6, + if (dst) + return dst; + +- dst = ip6_dst_lookup_flow(sk, fl6, final_dst); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_dst); + if (connected && !IS_ERR(dst)) + ip6_sk_dst_store_flow(sk, dst_clone(dst), fl6); + +diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c +index a77f6b7d3a7c..dfe5e603ffe1 100644 +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -925,7 +925,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel); + +- dst = ip6_dst_lookup_flow(sk, &fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + err = PTR_ERR(dst); + goto out; +diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c +index 16632e02e9b0..30915f6f31e3 100644 +--- a/net/ipv6/syncookies.c ++++ b/net/ipv6/syncookies.c +@@ -235,7 +235,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) + fl6.flowi6_uid = sk->sk_uid; + security_req_classify_flow(req, flowi6_to_flowi(&fl6)); + +- dst = ip6_dst_lookup_flow(sk, &fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) + goto out_free; + } +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 4804b6dc5e65..b42fa41cfceb 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -275,7 +275,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, + + security_sk_classify_flow(sk, flowi6_to_flowi(&fl6)); + +- dst = ip6_dst_lookup_flow(sk, &fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + err = PTR_ERR(dst); + goto failure; +@@ -906,7 +906,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 + * Underlying function will use this to retrieve the network + * namespace + */ +- dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL); ++ dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL); + if (!IS_ERR(dst)) { + skb_dst_set(buff, dst); + ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass, +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index 802f19aba7e3..d148766f40d1 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -615,7 +615,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel); + +- dst = ip6_dst_lookup_flow(sk, &fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + err = PTR_ERR(dst); + goto out; +diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c +index c312741df2ce..4701edffb1f7 100644 +--- a/net/mpls/af_mpls.c ++++ b/net/mpls/af_mpls.c +@@ -617,16 +617,15 @@ static struct net_device *inet6_fib_lookup_dev(struct net *net, + struct net_device *dev; + struct dst_entry *dst; + struct flowi6 fl6; +- int err; + + if (!ipv6_stub) + return ERR_PTR(-EAFNOSUPPORT); + + memset(&fl6, 0, sizeof(fl6)); + memcpy(&fl6.daddr, addr, sizeof(struct in6_addr)); +- err = ipv6_stub->ipv6_dst_lookup(net, NULL, &dst, &fl6); +- if (err) +- return ERR_PTR(err); ++ dst = ipv6_stub->ipv6_dst_lookup_flow(net, NULL, &fl6, NULL); ++ if (IS_ERR(dst)) ++ return ERR_CAST(dst); + + dev = dst->dev; + dev_hold(dev); +diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c +index e25dab8128db..5f6037695dee 100644 +--- a/net/netfilter/nf_tables_offload.c ++++ b/net/netfilter/nf_tables_offload.c +@@ -455,7 +455,7 @@ static int nft_offload_netdev_event(struct notifier_block *this, + return NOTIFY_DONE; + } + +-static struct flow_indr_block_ing_entry block_ing_entry = { ++static struct flow_indr_block_entry block_ing_entry = { + .cb = nft_indr_block_cb, + .list = LIST_HEAD_INIT(block_ing_entry.list), + }; +@@ -472,13 +472,13 @@ int nft_offload_init(void) + if (err < 0) + return err; + +- flow_indr_add_block_ing_cb(&block_ing_entry); ++ flow_indr_add_block_cb(&block_ing_entry); + + return 0; + } + + void nft_offload_exit(void) + { +- flow_indr_del_block_ing_cb(&block_ing_entry); ++ flow_indr_del_block_cb(&block_ing_entry); + unregister_netdevice_notifier(&nft_offload_netdev_notifier); + } +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index 1c77f520f474..99352f09deaa 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -166,7 +166,8 @@ static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key, + int err; + + err = skb_mpls_push(skb, mpls->mpls_lse, mpls->mpls_ethertype, +- skb->mac_len); ++ skb->mac_len, ++ ovs_key_mac_proto(key) == MAC_PROTO_ETHERNET); + if (err) + return err; + +@@ -179,7 +180,8 @@ static int pop_mpls(struct sk_buff *skb, struct sw_flow_key *key, + { + int err; + +- err = skb_mpls_pop(skb, ethertype, skb->mac_len); ++ err = skb_mpls_pop(skb, ethertype, skb->mac_len, ++ ovs_key_mac_proto(key) == MAC_PROTO_ETHERNET); + if (err) + return err; + +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 05249eb45082..283e8f9a5fd2 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -903,6 +903,17 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + } + err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); + ++ if (err == NF_ACCEPT && ++ ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { ++ if (maniptype == NF_NAT_MANIP_SRC) ++ maniptype = NF_NAT_MANIP_DST; ++ else ++ maniptype = NF_NAT_MANIP_SRC; ++ ++ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, ++ maniptype); ++ } ++ + /* Mark NAT done if successful and update the flow key. */ + if (err == NF_ACCEPT) + ovs_nat_update_key(key, skb, maniptype); +diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c +index fcc46025e790..f3232a00970f 100644 +--- a/net/sched/act_ct.c ++++ b/net/sched/act_ct.c +@@ -329,6 +329,7 @@ static int tcf_ct_act_nat(struct sk_buff *skb, + bool commit) + { + #if IS_ENABLED(CONFIG_NF_NAT) ++ int err; + enum nf_nat_manip_type maniptype; + + if (!(ct_action & TCA_CT_ACT_NAT)) +@@ -359,7 +360,17 @@ static int tcf_ct_act_nat(struct sk_buff *skb, + return NF_ACCEPT; + } + +- return ct_nat_execute(skb, ct, ctinfo, range, maniptype); ++ err = ct_nat_execute(skb, ct, ctinfo, range, maniptype); ++ if (err == NF_ACCEPT && ++ ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { ++ if (maniptype == NF_NAT_MANIP_SRC) ++ maniptype = NF_NAT_MANIP_DST; ++ else ++ maniptype = NF_NAT_MANIP_SRC; ++ ++ err = ct_nat_execute(skb, ct, ctinfo, range, maniptype); ++ } ++ return err; + #else + return NF_ACCEPT; + #endif +diff --git a/net/sched/act_mpls.c b/net/sched/act_mpls.c +index 4cf6c553bb0b..db570d2bd0e0 100644 +--- a/net/sched/act_mpls.c ++++ b/net/sched/act_mpls.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) + /* Copyright (C) 2019 Netronome Systems, Inc. */ + ++#include + #include + #include + #include +@@ -76,12 +77,14 @@ static int tcf_mpls_act(struct sk_buff *skb, const struct tc_action *a, + + switch (p->tcfm_action) { + case TCA_MPLS_ACT_POP: +- if (skb_mpls_pop(skb, p->tcfm_proto, mac_len)) ++ if (skb_mpls_pop(skb, p->tcfm_proto, mac_len, ++ skb->dev && skb->dev->type == ARPHRD_ETHER)) + goto drop; + break; + case TCA_MPLS_ACT_PUSH: + new_lse = tcf_mpls_get_lse(NULL, p, !eth_p_mpls(skb->protocol)); +- if (skb_mpls_push(skb, new_lse, p->tcfm_proto, mac_len)) ++ if (skb_mpls_push(skb, new_lse, p->tcfm_proto, mac_len, ++ skb->dev && skb->dev->type == ARPHRD_ETHER)) + goto drop; + break; + case TCA_MPLS_ACT_MODIFY: +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 20d60b8fcb70..6a0eacafdb19 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -626,15 +626,15 @@ static void tcf_chain_flush(struct tcf_chain *chain, bool rtnl_held) + static int tcf_block_setup(struct tcf_block *block, + struct flow_block_offload *bo); + +-static void tc_indr_block_ing_cmd(struct net_device *dev, +- struct tcf_block *block, +- flow_indr_block_bind_cb_t *cb, +- void *cb_priv, +- enum flow_block_command command) ++static void tc_indr_block_cmd(struct net_device *dev, struct tcf_block *block, ++ flow_indr_block_bind_cb_t *cb, void *cb_priv, ++ enum flow_block_command command, bool ingress) + { + struct flow_block_offload bo = { + .command = command, +- .binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS, ++ .binder_type = ingress ? ++ FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS : ++ FLOW_BLOCK_BINDER_TYPE_CLSACT_EGRESS, + .net = dev_net(dev), + .block_shared = tcf_block_non_null_shared(block), + }; +@@ -652,9 +652,10 @@ static void tc_indr_block_ing_cmd(struct net_device *dev, + up_write(&block->cb_lock); + } + +-static struct tcf_block *tc_dev_ingress_block(struct net_device *dev) ++static struct tcf_block *tc_dev_block(struct net_device *dev, bool ingress) + { + const struct Qdisc_class_ops *cops; ++ const struct Qdisc_ops *ops; + struct Qdisc *qdisc; + + if (!dev_ingress_queue(dev)) +@@ -664,24 +665,37 @@ static struct tcf_block *tc_dev_ingress_block(struct net_device *dev) + if (!qdisc) + return NULL; + +- cops = qdisc->ops->cl_ops; ++ ops = qdisc->ops; ++ if (!ops) ++ return NULL; ++ ++ if (!ingress && !strcmp("ingress", ops->id)) ++ return NULL; ++ ++ cops = ops->cl_ops; + if (!cops) + return NULL; + + if (!cops->tcf_block) + return NULL; + +- return cops->tcf_block(qdisc, TC_H_MIN_INGRESS, NULL); ++ return cops->tcf_block(qdisc, ++ ingress ? TC_H_MIN_INGRESS : TC_H_MIN_EGRESS, ++ NULL); + } + +-static void tc_indr_block_get_and_ing_cmd(struct net_device *dev, +- flow_indr_block_bind_cb_t *cb, +- void *cb_priv, +- enum flow_block_command command) ++static void tc_indr_block_get_and_cmd(struct net_device *dev, ++ flow_indr_block_bind_cb_t *cb, ++ void *cb_priv, ++ enum flow_block_command command) + { +- struct tcf_block *block = tc_dev_ingress_block(dev); ++ struct tcf_block *block; ++ ++ block = tc_dev_block(dev, true); ++ tc_indr_block_cmd(dev, block, cb, cb_priv, command, true); + +- tc_indr_block_ing_cmd(dev, block, cb, cb_priv, command); ++ block = tc_dev_block(dev, false); ++ tc_indr_block_cmd(dev, block, cb, cb_priv, command, false); + } + + static void tc_indr_block_call(struct tcf_block *block, +@@ -2721,13 +2735,19 @@ static int tc_chain_tmplt_add(struct tcf_chain *chain, struct net *net, + struct netlink_ext_ack *extack) + { + const struct tcf_proto_ops *ops; ++ char name[IFNAMSIZ]; + void *tmplt_priv; + + /* If kind is not set, user did not specify template. */ + if (!tca[TCA_KIND]) + return 0; + +- ops = tcf_proto_lookup_ops(nla_data(tca[TCA_KIND]), true, extack); ++ if (tcf_proto_check_kind(tca[TCA_KIND], name)) { ++ NL_SET_ERR_MSG(extack, "Specified TC chain template name too long"); ++ return -EINVAL; ++ } ++ ++ ops = tcf_proto_lookup_ops(name, true, extack); + if (IS_ERR(ops)) + return PTR_ERR(ops); + if (!ops->tmplt_create || !ops->tmplt_destroy || !ops->tmplt_dump) { +@@ -3626,9 +3646,9 @@ static struct pernet_operations tcf_net_ops = { + .size = sizeof(struct tcf_net), + }; + +-static struct flow_indr_block_ing_entry block_ing_entry = { +- .cb = tc_indr_block_get_and_ing_cmd, +- .list = LIST_HEAD_INIT(block_ing_entry.list), ++static struct flow_indr_block_entry block_entry = { ++ .cb = tc_indr_block_get_and_cmd, ++ .list = LIST_HEAD_INIT(block_entry.list), + }; + + static int __init tc_filter_init(void) +@@ -3643,7 +3663,7 @@ static int __init tc_filter_init(void) + if (err) + goto err_register_pernet_subsys; + +- flow_indr_add_block_ing_cb(&block_ing_entry); ++ flow_indr_add_block_cb(&block_entry); + + rtnl_register(PF_UNSPEC, RTM_NEWTFILTER, tc_new_tfilter, NULL, + RTNL_FLAG_DOIT_UNLOCKED); +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 74221e3351c3..4ac110bf19c5 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -54,8 +54,13 @@ struct fl_flow_key { + struct flow_dissector_key_ip ip; + struct flow_dissector_key_ip enc_ip; + struct flow_dissector_key_enc_opts enc_opts; +- struct flow_dissector_key_ports tp_min; +- struct flow_dissector_key_ports tp_max; ++ union { ++ struct flow_dissector_key_ports tp; ++ struct { ++ struct flow_dissector_key_ports tp_min; ++ struct flow_dissector_key_ports tp_max; ++ }; ++ } tp_range; + struct flow_dissector_key_ct ct; + } __aligned(BITS_PER_LONG / 8); /* Ensure that we can do comparisons as longs. */ + +@@ -198,19 +203,19 @@ static bool fl_range_port_dst_cmp(struct cls_fl_filter *filter, + { + __be16 min_mask, max_mask, min_val, max_val; + +- min_mask = htons(filter->mask->key.tp_min.dst); +- max_mask = htons(filter->mask->key.tp_max.dst); +- min_val = htons(filter->key.tp_min.dst); +- max_val = htons(filter->key.tp_max.dst); ++ min_mask = htons(filter->mask->key.tp_range.tp_min.dst); ++ max_mask = htons(filter->mask->key.tp_range.tp_max.dst); ++ min_val = htons(filter->key.tp_range.tp_min.dst); ++ max_val = htons(filter->key.tp_range.tp_max.dst); + + if (min_mask && max_mask) { +- if (htons(key->tp.dst) < min_val || +- htons(key->tp.dst) > max_val) ++ if (htons(key->tp_range.tp.dst) < min_val || ++ htons(key->tp_range.tp.dst) > max_val) + return false; + + /* skb does not have min and max values */ +- mkey->tp_min.dst = filter->mkey.tp_min.dst; +- mkey->tp_max.dst = filter->mkey.tp_max.dst; ++ mkey->tp_range.tp_min.dst = filter->mkey.tp_range.tp_min.dst; ++ mkey->tp_range.tp_max.dst = filter->mkey.tp_range.tp_max.dst; + } + return true; + } +@@ -221,19 +226,19 @@ static bool fl_range_port_src_cmp(struct cls_fl_filter *filter, + { + __be16 min_mask, max_mask, min_val, max_val; + +- min_mask = htons(filter->mask->key.tp_min.src); +- max_mask = htons(filter->mask->key.tp_max.src); +- min_val = htons(filter->key.tp_min.src); +- max_val = htons(filter->key.tp_max.src); ++ min_mask = htons(filter->mask->key.tp_range.tp_min.src); ++ max_mask = htons(filter->mask->key.tp_range.tp_max.src); ++ min_val = htons(filter->key.tp_range.tp_min.src); ++ max_val = htons(filter->key.tp_range.tp_max.src); + + if (min_mask && max_mask) { +- if (htons(key->tp.src) < min_val || +- htons(key->tp.src) > max_val) ++ if (htons(key->tp_range.tp.src) < min_val || ++ htons(key->tp_range.tp.src) > max_val) + return false; + + /* skb does not have min and max values */ +- mkey->tp_min.src = filter->mkey.tp_min.src; +- mkey->tp_max.src = filter->mkey.tp_max.src; ++ mkey->tp_range.tp_min.src = filter->mkey.tp_range.tp_min.src; ++ mkey->tp_range.tp_max.src = filter->mkey.tp_range.tp_max.src; + } + return true; + } +@@ -715,23 +720,25 @@ static void fl_set_key_val(struct nlattr **tb, + static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key, + struct fl_flow_key *mask) + { +- fl_set_key_val(tb, &key->tp_min.dst, +- TCA_FLOWER_KEY_PORT_DST_MIN, &mask->tp_min.dst, +- TCA_FLOWER_UNSPEC, sizeof(key->tp_min.dst)); +- fl_set_key_val(tb, &key->tp_max.dst, +- TCA_FLOWER_KEY_PORT_DST_MAX, &mask->tp_max.dst, +- TCA_FLOWER_UNSPEC, sizeof(key->tp_max.dst)); +- fl_set_key_val(tb, &key->tp_min.src, +- TCA_FLOWER_KEY_PORT_SRC_MIN, &mask->tp_min.src, +- TCA_FLOWER_UNSPEC, sizeof(key->tp_min.src)); +- fl_set_key_val(tb, &key->tp_max.src, +- TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_max.src, +- TCA_FLOWER_UNSPEC, sizeof(key->tp_max.src)); +- +- if ((mask->tp_min.dst && mask->tp_max.dst && +- htons(key->tp_max.dst) <= htons(key->tp_min.dst)) || +- (mask->tp_min.src && mask->tp_max.src && +- htons(key->tp_max.src) <= htons(key->tp_min.src))) ++ fl_set_key_val(tb, &key->tp_range.tp_min.dst, ++ TCA_FLOWER_KEY_PORT_DST_MIN, &mask->tp_range.tp_min.dst, ++ TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_min.dst)); ++ fl_set_key_val(tb, &key->tp_range.tp_max.dst, ++ TCA_FLOWER_KEY_PORT_DST_MAX, &mask->tp_range.tp_max.dst, ++ TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.dst)); ++ fl_set_key_val(tb, &key->tp_range.tp_min.src, ++ TCA_FLOWER_KEY_PORT_SRC_MIN, &mask->tp_range.tp_min.src, ++ TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_min.src)); ++ fl_set_key_val(tb, &key->tp_range.tp_max.src, ++ TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_range.tp_max.src, ++ TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src)); ++ ++ if ((mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst && ++ htons(key->tp_range.tp_max.dst) <= ++ htons(key->tp_range.tp_min.dst)) || ++ (mask->tp_range.tp_min.src && mask->tp_range.tp_max.src && ++ htons(key->tp_range.tp_max.src) <= ++ htons(key->tp_range.tp_min.src))) + return -EINVAL; + + return 0; +@@ -1320,9 +1327,10 @@ static void fl_init_dissector(struct flow_dissector *dissector, + FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4); + FL_KEY_SET_IF_MASKED(mask, keys, cnt, + FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6); +- if (FL_KEY_IS_MASKED(mask, tp) || +- FL_KEY_IS_MASKED(mask, tp_min) || FL_KEY_IS_MASKED(mask, tp_max)) +- FL_KEY_SET(keys, cnt, FLOW_DISSECTOR_KEY_PORTS, tp); ++ FL_KEY_SET_IF_MASKED(mask, keys, cnt, ++ FLOW_DISSECTOR_KEY_PORTS, tp); ++ FL_KEY_SET_IF_MASKED(mask, keys, cnt, ++ FLOW_DISSECTOR_KEY_PORTS_RANGE, tp_range); + FL_KEY_SET_IF_MASKED(mask, keys, cnt, + FLOW_DISSECTOR_KEY_IP, ip); + FL_KEY_SET_IF_MASKED(mask, keys, cnt, +@@ -1371,8 +1379,10 @@ static struct fl_flow_mask *fl_create_new_mask(struct cls_fl_head *head, + + fl_mask_copy(newmask, mask); + +- if ((newmask->key.tp_min.dst && newmask->key.tp_max.dst) || +- (newmask->key.tp_min.src && newmask->key.tp_max.src)) ++ if ((newmask->key.tp_range.tp_min.dst && ++ newmask->key.tp_range.tp_max.dst) || ++ (newmask->key.tp_range.tp_min.src && ++ newmask->key.tp_range.tp_max.src)) + newmask->flags |= TCA_FLOWER_MASK_FLAGS_RANGE; + + err = fl_init_mask_hashtable(newmask); +@@ -1970,18 +1980,22 @@ static int fl_dump_key_val(struct sk_buff *skb, + static int fl_dump_key_port_range(struct sk_buff *skb, struct fl_flow_key *key, + struct fl_flow_key *mask) + { +- if (fl_dump_key_val(skb, &key->tp_min.dst, TCA_FLOWER_KEY_PORT_DST_MIN, +- &mask->tp_min.dst, TCA_FLOWER_UNSPEC, +- sizeof(key->tp_min.dst)) || +- fl_dump_key_val(skb, &key->tp_max.dst, TCA_FLOWER_KEY_PORT_DST_MAX, +- &mask->tp_max.dst, TCA_FLOWER_UNSPEC, +- sizeof(key->tp_max.dst)) || +- fl_dump_key_val(skb, &key->tp_min.src, TCA_FLOWER_KEY_PORT_SRC_MIN, +- &mask->tp_min.src, TCA_FLOWER_UNSPEC, +- sizeof(key->tp_min.src)) || +- fl_dump_key_val(skb, &key->tp_max.src, TCA_FLOWER_KEY_PORT_SRC_MAX, +- &mask->tp_max.src, TCA_FLOWER_UNSPEC, +- sizeof(key->tp_max.src))) ++ if (fl_dump_key_val(skb, &key->tp_range.tp_min.dst, ++ TCA_FLOWER_KEY_PORT_DST_MIN, ++ &mask->tp_range.tp_min.dst, TCA_FLOWER_UNSPEC, ++ sizeof(key->tp_range.tp_min.dst)) || ++ fl_dump_key_val(skb, &key->tp_range.tp_max.dst, ++ TCA_FLOWER_KEY_PORT_DST_MAX, ++ &mask->tp_range.tp_max.dst, TCA_FLOWER_UNSPEC, ++ sizeof(key->tp_range.tp_max.dst)) || ++ fl_dump_key_val(skb, &key->tp_range.tp_min.src, ++ TCA_FLOWER_KEY_PORT_SRC_MIN, ++ &mask->tp_range.tp_min.src, TCA_FLOWER_UNSPEC, ++ sizeof(key->tp_range.tp_min.src)) || ++ fl_dump_key_val(skb, &key->tp_range.tp_max.src, ++ TCA_FLOWER_KEY_PORT_SRC_MAX, ++ &mask->tp_range.tp_max.src, TCA_FLOWER_UNSPEC, ++ sizeof(key->tp_range.tp_max.src))) + return -1; + + return 0; +diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c +index 278c0b2dc523..e79f1afe0cfd 100644 +--- a/net/sched/sch_mq.c ++++ b/net/sched/sch_mq.c +@@ -153,6 +153,7 @@ static int mq_dump(struct Qdisc *sch, struct sk_buff *skb) + __gnet_stats_copy_queue(&sch->qstats, + qdisc->cpu_qstats, + &qdisc->qstats, qlen); ++ sch->q.qlen += qlen; + } else { + sch->q.qlen += qdisc->q.qlen; + sch->bstats.bytes += qdisc->bstats.bytes; +diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c +index 0d0113a24962..8766ab5b8788 100644 +--- a/net/sched/sch_mqprio.c ++++ b/net/sched/sch_mqprio.c +@@ -411,6 +411,7 @@ static int mqprio_dump(struct Qdisc *sch, struct sk_buff *skb) + __gnet_stats_copy_queue(&sch->qstats, + qdisc->cpu_qstats, + &qdisc->qstats, qlen); ++ sch->q.qlen += qlen; + } else { + sch->q.qlen += qdisc->q.qlen; + sch->bstats.bytes += qdisc->bstats.bytes; +@@ -433,7 +434,7 @@ static int mqprio_dump(struct Qdisc *sch, struct sk_buff *skb) + opt.offset[tc] = dev->tc_to_txq[tc].offset; + } + +- if (nla_put(skb, TCA_OPTIONS, NLA_ALIGN(sizeof(opt)), &opt)) ++ if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt)) + goto nla_put_failure; + + if ((priv->flags & TC_MQPRIO_F_MODE) && +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index dd860fea0148..bc734cfaa29e 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -275,7 +275,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, + final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); + rcu_read_unlock(); + +- dst = ip6_dst_lookup_flow(sk, fl6, final_p); ++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p); + if (!asoc || saddr) + goto out; + +@@ -328,7 +328,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, + fl6->saddr = laddr->a.v6.sin6_addr; + fl6->fl6_sport = laddr->a.v6.sin6_port; + final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); +- bdst = ip6_dst_lookup_flow(sk, fl6, final_p); ++ bdst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p); + + if (IS_ERR(bdst)) + continue; +diff --git a/net/tipc/core.c b/net/tipc/core.c +index 8f35060a24e1..12192e7f4050 100644 +--- a/net/tipc/core.c ++++ b/net/tipc/core.c +@@ -125,14 +125,6 @@ static int __init tipc_init(void) + sysctl_tipc_rmem[1] = RCVBUF_DEF; + sysctl_tipc_rmem[2] = RCVBUF_MAX; + +- err = tipc_netlink_start(); +- if (err) +- goto out_netlink; +- +- err = tipc_netlink_compat_start(); +- if (err) +- goto out_netlink_compat; +- + err = tipc_register_sysctl(); + if (err) + goto out_sysctl; +@@ -153,8 +145,21 @@ static int __init tipc_init(void) + if (err) + goto out_bearer; + ++ err = tipc_netlink_start(); ++ if (err) ++ goto out_netlink; ++ ++ err = tipc_netlink_compat_start(); ++ if (err) ++ goto out_netlink_compat; ++ + pr_info("Started in single node mode\n"); + return 0; ++ ++out_netlink_compat: ++ tipc_netlink_stop(); ++out_netlink: ++ tipc_bearer_cleanup(); + out_bearer: + unregister_pernet_device(&tipc_topsrv_net_ops); + out_pernet_topsrv: +@@ -164,22 +169,18 @@ out_socket: + out_pernet: + tipc_unregister_sysctl(); + out_sysctl: +- tipc_netlink_compat_stop(); +-out_netlink_compat: +- tipc_netlink_stop(); +-out_netlink: + pr_err("Unable to start in single node mode\n"); + return err; + } + + static void __exit tipc_exit(void) + { ++ tipc_netlink_compat_stop(); ++ tipc_netlink_stop(); + tipc_bearer_cleanup(); + unregister_pernet_device(&tipc_topsrv_net_ops); + tipc_socket_stop(); + unregister_pernet_device(&tipc_net_ops); +- tipc_netlink_stop(); +- tipc_netlink_compat_stop(); + tipc_unregister_sysctl(); + + pr_info("Deactivated\n"); +diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c +index 287df68721df..186c78431217 100644 +--- a/net/tipc/udp_media.c ++++ b/net/tipc/udp_media.c +@@ -195,10 +195,13 @@ static int tipc_udp_xmit(struct net *net, struct sk_buff *skb, + .saddr = src->ipv6, + .flowi6_proto = IPPROTO_UDP + }; +- err = ipv6_stub->ipv6_dst_lookup(net, ub->ubsock->sk, +- &ndst, &fl6); +- if (err) ++ ndst = ipv6_stub->ipv6_dst_lookup_flow(net, ++ ub->ubsock->sk, ++ &fl6, NULL); ++ if (IS_ERR(ndst)) { ++ err = PTR_ERR(ndst); + goto tx_error; ++ } + dst_cache_set_ip6(cache, ndst, &fl6.saddr); + } + ttl = ip6_dst_hoplimit(ndst); +diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c +index 683d00837693..3f5209e2d4ee 100644 +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -417,7 +417,7 @@ static int tls_push_data(struct sock *sk, + + if (flags & + ~(MSG_MORE | MSG_DONTWAIT | MSG_NOSIGNAL | MSG_SENDPAGE_NOTLAST)) +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + + if (sk->sk_err) + return -sk->sk_err; +@@ -560,7 +560,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page, + lock_sock(sk); + + if (flags & MSG_OOB) { +- rc = -ENOTSUPP; ++ rc = -EOPNOTSUPP; + goto out; + } + +@@ -999,7 +999,7 @@ int tls_set_device_offload(struct sock *sk, struct tls_context *ctx) + } + + if (!(netdev->features & NETIF_F_HW_TLS_TX)) { +- rc = -ENOTSUPP; ++ rc = -EOPNOTSUPP; + goto release_netdev; + } + +@@ -1071,7 +1071,7 @@ int tls_set_device_offload_rx(struct sock *sk, struct tls_context *ctx) + } + + if (!(netdev->features & NETIF_F_HW_TLS_RX)) { +- rc = -ENOTSUPP; ++ rc = -EOPNOTSUPP; + goto release_netdev; + } + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index eff444293594..82d0beed8f07 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -482,7 +482,7 @@ static int do_tls_setsockopt_conf(struct sock *sk, char __user *optval, + /* check version */ + if (crypto_info->version != TLS_1_2_VERSION && + crypto_info->version != TLS_1_3_VERSION) { +- rc = -ENOTSUPP; ++ rc = -EINVAL; + goto err_crypto_info; + } + +@@ -778,7 +778,7 @@ static int tls_init(struct sock *sk) + * share the ulp context. + */ + if (sk->sk_state != TCP_ESTABLISHED) +- return -ENOTSUPP; ++ return -ENOTCONN; + + tls_build_proto(sk); + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 5dd0f01913c0..c70cf30c5492 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -900,7 +900,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + int ret = 0; + + if (msg->msg_flags & ~(MSG_MORE | MSG_DONTWAIT | MSG_NOSIGNAL)) +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + + mutex_lock(&tls_ctx->tx_lock); + lock_sock(sk); +@@ -1215,7 +1215,7 @@ int tls_sw_sendpage_locked(struct sock *sk, struct page *page, + if (flags & ~(MSG_MORE | MSG_DONTWAIT | MSG_NOSIGNAL | + MSG_SENDPAGE_NOTLAST | MSG_SENDPAGE_NOPOLICY | + MSG_NO_SHARED_FRAGS)) +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + + return tls_sw_do_sendpage(sk, page, offset, size, flags); + } +@@ -1228,7 +1228,7 @@ int tls_sw_sendpage(struct sock *sk, struct page *page, + + if (flags & ~(MSG_MORE | MSG_DONTWAIT | MSG_NOSIGNAL | + MSG_SENDPAGE_NOTLAST | MSG_SENDPAGE_NOPOLICY)) +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + + mutex_lock(&tls_ctx->tx_lock); + lock_sock(sk); +@@ -1927,7 +1927,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, + + /* splice does not support reading control messages */ + if (ctx->control != TLS_RECORD_TYPE_DATA) { +- err = -ENOTSUPP; ++ err = -EINVAL; + goto splice_read_end; + } + +diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c +index 46abcae47dee..13e5ef615026 100644 +--- a/tools/testing/selftests/net/tls.c ++++ b/tools/testing/selftests/net/tls.c +@@ -25,10 +25,6 @@ + #define TLS_PAYLOAD_MAX_LEN 16384 + #define SOL_TLS 282 + +-#ifndef ENOTSUPP +-#define ENOTSUPP 524 +-#endif +- + FIXTURE(tls_basic) + { + int fd, cfd; +@@ -1205,11 +1201,11 @@ TEST(non_established) { + /* TLS ULP not supported */ + if (errno == ENOENT) + return; +- EXPECT_EQ(errno, ENOTSUPP); ++ EXPECT_EQ(errno, ENOTCONN); + + ret = setsockopt(sfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); + EXPECT_EQ(ret, -1); +- EXPECT_EQ(errno, ENOTSUPP); ++ EXPECT_EQ(errno, ENOTCONN); + + ret = getsockname(sfd, &addr, &len); + ASSERT_EQ(ret, 0); diff --git a/patch/kernel/odroidxu4-current/02-patch-5.4.5-6.patch b/patch/kernel/odroidxu4-current/02-patch-5.4.5-6.patch new file mode 100644 index 0000000000..d35757d8b2 --- /dev/null +++ b/patch/kernel/odroidxu4-current/02-patch-5.4.5-6.patch @@ -0,0 +1,3420 @@ +diff --git a/Makefile b/Makefile +index 0f6e72d5e4f1..20ec7c20279e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 5 ++SUBLEVEL = 6 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts +index 0e159c884f97..1aeac33b0d34 100644 +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -165,6 +165,10 @@ + }; + }; + ++&clocks { ++ clocks = <&fin_pll>; ++}; ++ + &sdhci0 { + pinctrl-names = "default"; + pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; +diff --git a/arch/arm/boot/dts/s3c6410-smdk6410.dts b/arch/arm/boot/dts/s3c6410-smdk6410.dts +index a9a5689dc462..3bf6c450a26e 100644 +--- a/arch/arm/boot/dts/s3c6410-smdk6410.dts ++++ b/arch/arm/boot/dts/s3c6410-smdk6410.dts +@@ -69,6 +69,10 @@ + }; + }; + ++&clocks { ++ clocks = <&fin_pll>; ++}; ++ + &sdhci0 { + pinctrl-names = "default"; + pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; +diff --git a/arch/arm/mach-tegra/reset-handler.S b/arch/arm/mach-tegra/reset-handler.S +index 67b763fea005..e3f34815c9da 100644 +--- a/arch/arm/mach-tegra/reset-handler.S ++++ b/arch/arm/mach-tegra/reset-handler.S +@@ -44,16 +44,16 @@ ENTRY(tegra_resume) + cmp r6, #TEGRA20 + beq 1f @ Yes + /* Clear the flow controller flags for this CPU. */ +- cpu_to_csr_reg r1, r0 ++ cpu_to_csr_reg r3, r0 + mov32 r2, TEGRA_FLOW_CTRL_BASE +- ldr r1, [r2, r1] ++ ldr r1, [r2, r3] + /* Clear event & intr flag */ + orr r1, r1, \ + #FLOW_CTRL_CSR_INTR_FLAG | FLOW_CTRL_CSR_EVENT_FLAG + movw r0, #0x3FFD @ enable, cluster_switch, immed, bitmaps + @ & ext flags for CPU power mgnt + bic r1, r1, r0 +- str r1, [r2] ++ str r1, [r2, r3] + 1: + + mov32 r9, 0xc09 +diff --git a/arch/xtensa/include/asm/syscall.h b/arch/xtensa/include/asm/syscall.h +index 359ab40e935a..c90fb944f9d8 100644 +--- a/arch/xtensa/include/asm/syscall.h ++++ b/arch/xtensa/include/asm/syscall.h +@@ -51,7 +51,7 @@ static inline void syscall_set_return_value(struct task_struct *task, + struct pt_regs *regs, + int error, long val) + { +- regs->areg[0] = (long) error ? error : val; ++ regs->areg[2] = (long) error ? error : val; + } + + #define SYSCALL_MAX_ARGS 6 +diff --git a/arch/xtensa/mm/kasan_init.c b/arch/xtensa/mm/kasan_init.c +index af7152560bc3..b771459778fe 100644 +--- a/arch/xtensa/mm/kasan_init.c ++++ b/arch/xtensa/mm/kasan_init.c +@@ -56,7 +56,9 @@ static void __init populate(void *start, void *end) + + for (k = 0; k < PTRS_PER_PTE; ++k, ++j) { + phys_addr_t phys = +- memblock_phys_alloc(PAGE_SIZE, PAGE_SIZE); ++ memblock_phys_alloc_range(PAGE_SIZE, PAGE_SIZE, ++ 0, ++ MEMBLOCK_ALLOC_ANYWHERE); + + if (!phys) + panic("Failed to allocate page table page\n"); +diff --git a/arch/xtensa/mm/tlb.c b/arch/xtensa/mm/tlb.c +index 59153d0aa890..b43f03620843 100644 +--- a/arch/xtensa/mm/tlb.c ++++ b/arch/xtensa/mm/tlb.c +@@ -216,6 +216,8 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb) + unsigned tlbidx = w | (e << PAGE_SHIFT); + unsigned r0 = dtlb ? + read_dtlb_virtual(tlbidx) : read_itlb_virtual(tlbidx); ++ unsigned r1 = dtlb ? ++ read_dtlb_translation(tlbidx) : read_itlb_translation(tlbidx); + unsigned vpn = (r0 & PAGE_MASK) | (e << PAGE_SHIFT); + unsigned pte = get_pte_for_vaddr(vpn); + unsigned mm_asid = (get_rasid_register() >> 8) & ASID_MASK; +@@ -231,8 +233,6 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb) + } + + if (tlb_asid == mm_asid) { +- unsigned r1 = dtlb ? read_dtlb_translation(tlbidx) : +- read_itlb_translation(tlbidx); + if ((pte ^ r1) & PAGE_MASK) { + pr_err("%cTLB: way: %u, entry: %u, mapping: %08x->%08x, PTE: %08x\n", + dtlb ? 'D' : 'I', w, e, r0, r1, pte); +diff --git a/block/bio.c b/block/bio.c +index b1170ec18464..43df756b68c4 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -751,10 +751,12 @@ bool __bio_try_merge_page(struct bio *bio, struct page *page, + if (WARN_ON_ONCE(bio_flagged(bio, BIO_CLONED))) + return false; + +- if (bio->bi_vcnt > 0 && !bio_full(bio, len)) { ++ if (bio->bi_vcnt > 0) { + struct bio_vec *bv = &bio->bi_io_vec[bio->bi_vcnt - 1]; + + if (page_is_mergeable(bv, page, len, off, same_page)) { ++ if (bio->bi_iter.bi_size > UINT_MAX - len) ++ return false; + bv->bv_len += len; + bio->bi_iter.bi_size += len; + return true; +diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c +index 25c5c071645b..91185db9a952 100644 +--- a/drivers/dma-buf/sync_file.c ++++ b/drivers/dma-buf/sync_file.c +@@ -221,7 +221,7 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a, + a_fences = get_fences(a, &a_num_fences); + b_fences = get_fences(b, &b_num_fences); + if (a_num_fences > INT_MAX - b_num_fences) +- return NULL; ++ goto err; + + num_fences = a_num_fences + b_num_fences; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h +index b6e1d98ef01e..aef6c396bd58 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h +@@ -77,6 +77,7 @@ struct amdgpu_gmc_fault { + struct amdgpu_vmhub { + uint32_t ctx0_ptb_addr_lo32; + uint32_t ctx0_ptb_addr_hi32; ++ uint32_t vm_inv_eng0_sem; + uint32_t vm_inv_eng0_req; + uint32_t vm_inv_eng0_ack; + uint32_t vm_context0_cntl; +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 53090eae0082..596722e79a26 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -1785,27 +1785,52 @@ static void gfx_v10_0_enable_gui_idle_interrupt(struct amdgpu_device *adev, + WREG32_SOC15(GC, 0, mmCP_INT_CNTL_RING0, tmp); + } + +-static void gfx_v10_0_init_csb(struct amdgpu_device *adev) ++static int gfx_v10_0_init_csb(struct amdgpu_device *adev) + { ++ int r; ++ ++ if (adev->in_gpu_reset) { ++ r = amdgpu_bo_reserve(adev->gfx.rlc.clear_state_obj, false); ++ if (r) ++ return r; ++ ++ r = amdgpu_bo_kmap(adev->gfx.rlc.clear_state_obj, ++ (void **)&adev->gfx.rlc.cs_ptr); ++ if (!r) { ++ adev->gfx.rlc.funcs->get_csb_buffer(adev, ++ adev->gfx.rlc.cs_ptr); ++ amdgpu_bo_kunmap(adev->gfx.rlc.clear_state_obj); ++ } ++ ++ amdgpu_bo_unreserve(adev->gfx.rlc.clear_state_obj); ++ if (r) ++ return r; ++ } ++ + /* csib */ + WREG32_SOC15(GC, 0, mmRLC_CSIB_ADDR_HI, + adev->gfx.rlc.clear_state_gpu_addr >> 32); + WREG32_SOC15(GC, 0, mmRLC_CSIB_ADDR_LO, + adev->gfx.rlc.clear_state_gpu_addr & 0xfffffffc); + WREG32_SOC15(GC, 0, mmRLC_CSIB_LENGTH, adev->gfx.rlc.clear_state_size); ++ ++ return 0; + } + +-static void gfx_v10_0_init_pg(struct amdgpu_device *adev) ++static int gfx_v10_0_init_pg(struct amdgpu_device *adev) + { + int i; ++ int r; + +- gfx_v10_0_init_csb(adev); ++ r = gfx_v10_0_init_csb(adev); ++ if (r) ++ return r; + + for (i = 0; i < adev->num_vmhubs; i++) + amdgpu_gmc_flush_gpu_tlb(adev, 0, i, 0); + + /* TODO: init power gating */ +- return; ++ return 0; + } + + void gfx_v10_0_rlc_stop(struct amdgpu_device *adev) +@@ -1907,7 +1932,10 @@ static int gfx_v10_0_rlc_resume(struct amdgpu_device *adev) + r = gfx_v10_0_wait_for_rlc_autoload_complete(adev); + if (r) + return r; +- gfx_v10_0_init_pg(adev); ++ ++ r = gfx_v10_0_init_pg(adev); ++ if (r) ++ return r; + + /* enable RLC SRM */ + gfx_v10_0_rlc_enable_srm(adev); +@@ -1933,7 +1961,10 @@ static int gfx_v10_0_rlc_resume(struct amdgpu_device *adev) + return r; + } + +- gfx_v10_0_init_pg(adev); ++ r = gfx_v10_0_init_pg(adev); ++ if (r) ++ return r; ++ + adev->gfx.rlc.funcs->start(adev); + + if (adev->firmware.load_type == AMDGPU_FW_LOAD_RLC_BACKDOOR_AUTO) { +@@ -2400,7 +2431,7 @@ static int gfx_v10_0_wait_for_rlc_autoload_complete(struct amdgpu_device *adev) + return 0; + } + +-static void gfx_v10_0_cp_gfx_enable(struct amdgpu_device *adev, bool enable) ++static int gfx_v10_0_cp_gfx_enable(struct amdgpu_device *adev, bool enable) + { + int i; + u32 tmp = RREG32_SOC15(GC, 0, mmCP_ME_CNTL); +@@ -2413,7 +2444,17 @@ static void gfx_v10_0_cp_gfx_enable(struct amdgpu_device *adev, bool enable) + adev->gfx.gfx_ring[i].sched.ready = false; + } + WREG32_SOC15(GC, 0, mmCP_ME_CNTL, tmp); +- udelay(50); ++ ++ for (i = 0; i < adev->usec_timeout; i++) { ++ if (RREG32_SOC15(GC, 0, mmCP_STAT) == 0) ++ break; ++ udelay(1); ++ } ++ ++ if (i >= adev->usec_timeout) ++ DRM_ERROR("failed to %s cp gfx\n", enable ? "unhalt" : "halt"); ++ ++ return 0; + } + + static int gfx_v10_0_cp_gfx_load_pfp_microcode(struct amdgpu_device *adev) +diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c +index 6ce37ce77d14..d6fbdc6c0548 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c +@@ -365,6 +365,8 @@ void gfxhub_v1_0_init(struct amdgpu_device *adev) + hub->ctx0_ptb_addr_hi32 = + SOC15_REG_OFFSET(GC, 0, + mmVM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32); ++ hub->vm_inv_eng0_sem = ++ SOC15_REG_OFFSET(GC, 0, mmVM_INVALIDATE_ENG0_SEM); + hub->vm_inv_eng0_req = + SOC15_REG_OFFSET(GC, 0, mmVM_INVALIDATE_ENG0_REQ); + hub->vm_inv_eng0_ack = +diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c +index db10640a3b2f..fbe06c13a09c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c +@@ -350,6 +350,8 @@ void gfxhub_v2_0_init(struct amdgpu_device *adev) + hub->ctx0_ptb_addr_hi32 = + SOC15_REG_OFFSET(GC, 0, + mmGCVM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32); ++ hub->vm_inv_eng0_sem = ++ SOC15_REG_OFFSET(GC, 0, mmGCVM_INVALIDATE_ENG0_SEM); + hub->vm_inv_eng0_req = + SOC15_REG_OFFSET(GC, 0, mmGCVM_INVALIDATE_ENG0_REQ); + hub->vm_inv_eng0_ack = +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c +index 5c7d5f73f54f..a7ba4c6cf7a1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c +@@ -235,6 +235,29 @@ static void gmc_v10_0_flush_vm_hub(struct amdgpu_device *adev, uint32_t vmid, + const unsigned eng = 17; + unsigned int i; + ++ spin_lock(&adev->gmc.invalidate_lock); ++ /* ++ * It may lose gpuvm invalidate acknowldege state across power-gating ++ * off cycle, add semaphore acquire before invalidation and semaphore ++ * release after invalidation to avoid entering power gated state ++ * to WA the Issue ++ */ ++ ++ /* TODO: It needs to continue working on debugging with semaphore for GFXHUB as well. */ ++ if (vmhub == AMDGPU_MMHUB_0 || ++ vmhub == AMDGPU_MMHUB_1) { ++ for (i = 0; i < adev->usec_timeout; i++) { ++ /* a read return value of 1 means semaphore acuqire */ ++ tmp = RREG32_NO_KIQ(hub->vm_inv_eng0_sem + eng); ++ if (tmp & 0x1) ++ break; ++ udelay(1); ++ } ++ ++ if (i >= adev->usec_timeout) ++ DRM_ERROR("Timeout waiting for sem acquire in VM flush!\n"); ++ } ++ + WREG32_NO_KIQ(hub->vm_inv_eng0_req + eng, tmp); + + /* +@@ -254,6 +277,17 @@ static void gmc_v10_0_flush_vm_hub(struct amdgpu_device *adev, uint32_t vmid, + udelay(1); + } + ++ /* TODO: It needs to continue working on debugging with semaphore for GFXHUB as well. */ ++ if (vmhub == AMDGPU_MMHUB_0 || ++ vmhub == AMDGPU_MMHUB_1) ++ /* ++ * add semaphore release after invalidation, ++ * write with 0 means semaphore release ++ */ ++ WREG32_NO_KIQ(hub->vm_inv_eng0_sem + eng, 0); ++ ++ spin_unlock(&adev->gmc.invalidate_lock); ++ + if (i < adev->usec_timeout) + return; + +@@ -338,6 +372,20 @@ static uint64_t gmc_v10_0_emit_flush_gpu_tlb(struct amdgpu_ring *ring, + uint32_t req = gmc_v10_0_get_invalidate_req(vmid, 0); + unsigned eng = ring->vm_inv_eng; + ++ /* ++ * It may lose gpuvm invalidate acknowldege state across power-gating ++ * off cycle, add semaphore acquire before invalidation and semaphore ++ * release after invalidation to avoid entering power gated state ++ * to WA the Issue ++ */ ++ ++ /* TODO: It needs to continue working on debugging with semaphore for GFXHUB as well. */ ++ if (ring->funcs->vmhub == AMDGPU_MMHUB_0 || ++ ring->funcs->vmhub == AMDGPU_MMHUB_1) ++ /* a read return value of 1 means semaphore acuqire */ ++ amdgpu_ring_emit_reg_wait(ring, ++ hub->vm_inv_eng0_sem + eng, 0x1, 0x1); ++ + amdgpu_ring_emit_wreg(ring, hub->ctx0_ptb_addr_lo32 + (2 * vmid), + lower_32_bits(pd_addr)); + +@@ -348,6 +396,15 @@ static uint64_t gmc_v10_0_emit_flush_gpu_tlb(struct amdgpu_ring *ring, + hub->vm_inv_eng0_ack + eng, + req, 1 << vmid); + ++ /* TODO: It needs to continue working on debugging with semaphore for GFXHUB as well. */ ++ if (ring->funcs->vmhub == AMDGPU_MMHUB_0 || ++ ring->funcs->vmhub == AMDGPU_MMHUB_1) ++ /* ++ * add semaphore release after invalidation, ++ * write with 0 means semaphore release ++ */ ++ amdgpu_ring_emit_wreg(ring, hub->vm_inv_eng0_sem + eng, 0); ++ + return pd_addr; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +index f91337030dc0..d7caca042173 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +@@ -448,6 +448,24 @@ static uint32_t gmc_v9_0_get_invalidate_req(unsigned int vmid, + return req; + } + ++/** ++ * gmc_v9_0_use_invalidate_semaphore - judge whether to use semaphore ++ * ++ * @adev: amdgpu_device pointer ++ * @vmhub: vmhub type ++ * ++ */ ++static bool gmc_v9_0_use_invalidate_semaphore(struct amdgpu_device *adev, ++ uint32_t vmhub) ++{ ++ return ((vmhub == AMDGPU_MMHUB_0 || ++ vmhub == AMDGPU_MMHUB_1) && ++ (!amdgpu_sriov_vf(adev)) && ++ (!(adev->asic_type == CHIP_RAVEN && ++ adev->rev_id < 0x8 && ++ adev->pdev->device == 0x15d8))); ++} ++ + /* + * GART + * VMID 0 is the physical GPU addresses as used by the kernel. +@@ -467,6 +485,7 @@ static uint32_t gmc_v9_0_get_invalidate_req(unsigned int vmid, + static void gmc_v9_0_flush_gpu_tlb(struct amdgpu_device *adev, uint32_t vmid, + uint32_t vmhub, uint32_t flush_type) + { ++ bool use_semaphore = gmc_v9_0_use_invalidate_semaphore(adev, vmhub); + const unsigned eng = 17; + u32 j, tmp; + struct amdgpu_vmhub *hub; +@@ -491,6 +510,28 @@ static void gmc_v9_0_flush_gpu_tlb(struct amdgpu_device *adev, uint32_t vmid, + } + + spin_lock(&adev->gmc.invalidate_lock); ++ ++ /* ++ * It may lose gpuvm invalidate acknowldege state across power-gating ++ * off cycle, add semaphore acquire before invalidation and semaphore ++ * release after invalidation to avoid entering power gated state ++ * to WA the Issue ++ */ ++ ++ /* TODO: It needs to continue working on debugging with semaphore for GFXHUB as well. */ ++ if (use_semaphore) { ++ for (j = 0; j < adev->usec_timeout; j++) { ++ /* a read return value of 1 means semaphore acuqire */ ++ tmp = RREG32_NO_KIQ(hub->vm_inv_eng0_sem + eng); ++ if (tmp & 0x1) ++ break; ++ udelay(1); ++ } ++ ++ if (j >= adev->usec_timeout) ++ DRM_ERROR("Timeout waiting for sem acquire in VM flush!\n"); ++ } ++ + WREG32_NO_KIQ(hub->vm_inv_eng0_req + eng, tmp); + + /* +@@ -506,7 +547,17 @@ static void gmc_v9_0_flush_gpu_tlb(struct amdgpu_device *adev, uint32_t vmid, + break; + udelay(1); + } ++ ++ /* TODO: It needs to continue working on debugging with semaphore for GFXHUB as well. */ ++ if (use_semaphore) ++ /* ++ * add semaphore release after invalidation, ++ * write with 0 means semaphore release ++ */ ++ WREG32_NO_KIQ(hub->vm_inv_eng0_sem + eng, 0); ++ + spin_unlock(&adev->gmc.invalidate_lock); ++ + if (j < adev->usec_timeout) + return; + +@@ -516,11 +567,25 @@ static void gmc_v9_0_flush_gpu_tlb(struct amdgpu_device *adev, uint32_t vmid, + static uint64_t gmc_v9_0_emit_flush_gpu_tlb(struct amdgpu_ring *ring, + unsigned vmid, uint64_t pd_addr) + { ++ bool use_semaphore = gmc_v9_0_use_invalidate_semaphore(ring->adev, ring->funcs->vmhub); + struct amdgpu_device *adev = ring->adev; + struct amdgpu_vmhub *hub = &adev->vmhub[ring->funcs->vmhub]; + uint32_t req = gmc_v9_0_get_invalidate_req(vmid, 0); + unsigned eng = ring->vm_inv_eng; + ++ /* ++ * It may lose gpuvm invalidate acknowldege state across power-gating ++ * off cycle, add semaphore acquire before invalidation and semaphore ++ * release after invalidation to avoid entering power gated state ++ * to WA the Issue ++ */ ++ ++ /* TODO: It needs to continue working on debugging with semaphore for GFXHUB as well. */ ++ if (use_semaphore) ++ /* a read return value of 1 means semaphore acuqire */ ++ amdgpu_ring_emit_reg_wait(ring, ++ hub->vm_inv_eng0_sem + eng, 0x1, 0x1); ++ + amdgpu_ring_emit_wreg(ring, hub->ctx0_ptb_addr_lo32 + (2 * vmid), + lower_32_bits(pd_addr)); + +@@ -531,6 +596,14 @@ static uint64_t gmc_v9_0_emit_flush_gpu_tlb(struct amdgpu_ring *ring, + hub->vm_inv_eng0_ack + eng, + req, 1 << vmid); + ++ /* TODO: It needs to continue working on debugging with semaphore for GFXHUB as well. */ ++ if (use_semaphore) ++ /* ++ * add semaphore release after invalidation, ++ * write with 0 means semaphore release ++ */ ++ amdgpu_ring_emit_wreg(ring, hub->vm_inv_eng0_sem + eng, 0); ++ + return pd_addr; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c +index 04cd4b6f95d4..641f1258f08d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c +@@ -418,6 +418,8 @@ void mmhub_v1_0_init(struct amdgpu_device *adev) + hub->ctx0_ptb_addr_hi32 = + SOC15_REG_OFFSET(MMHUB, 0, + mmVM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32); ++ hub->vm_inv_eng0_sem = ++ SOC15_REG_OFFSET(MMHUB, 0, mmVM_INVALIDATE_ENG0_SEM); + hub->vm_inv_eng0_req = + SOC15_REG_OFFSET(MMHUB, 0, mmVM_INVALIDATE_ENG0_REQ); + hub->vm_inv_eng0_ack = +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c +index b39bea6f54e9..096bb883c29d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c +@@ -341,6 +341,8 @@ void mmhub_v2_0_init(struct amdgpu_device *adev) + hub->ctx0_ptb_addr_hi32 = + SOC15_REG_OFFSET(MMHUB, 0, + mmMMVM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32); ++ hub->vm_inv_eng0_sem = ++ SOC15_REG_OFFSET(MMHUB, 0, mmMMVM_INVALIDATE_ENG0_SEM); + hub->vm_inv_eng0_req = + SOC15_REG_OFFSET(MMHUB, 0, mmMMVM_INVALIDATE_ENG0_REQ); + hub->vm_inv_eng0_ack = +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c +index 9ed178fa241c..fb161c83e409 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c +@@ -502,6 +502,10 @@ void mmhub_v9_4_init(struct amdgpu_device *adev) + SOC15_REG_OFFSET(MMHUB, 0, + mmVML2VC0_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32) + + i * MMHUB_INSTANCE_REGISTER_OFFSET; ++ hub[i]->vm_inv_eng0_sem = ++ SOC15_REG_OFFSET(MMHUB, 0, ++ mmVML2VC0_VM_INVALIDATE_ENG0_SEM) + ++ i * MMHUB_INSTANCE_REGISTER_OFFSET; + hub[i]->vm_inv_eng0_req = + SOC15_REG_OFFSET(MMHUB, 0, + mmVML2VC0_VM_INVALIDATE_ENG0_REQ) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.h b/drivers/gpu/drm/amd/amdgpu/soc15.h +index a3dde0c31f57..a1d4ea69a284 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.h ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.h +@@ -28,8 +28,8 @@ + #include "nbio_v7_0.h" + #include "nbio_v7_4.h" + +-#define SOC15_FLUSH_GPU_TLB_NUM_WREG 4 +-#define SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT 1 ++#define SOC15_FLUSH_GPU_TLB_NUM_WREG 6 ++#define SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT 3 + + extern const struct amd_ip_funcs soc15_common_ip_funcs; + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c +index f4cfa0caeba8..785322cd4c6c 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c +@@ -342,7 +342,8 @@ bool dm_pp_get_clock_levels_by_type( + if (adev->powerplay.pp_funcs && adev->powerplay.pp_funcs->get_clock_by_type) { + if (adev->powerplay.pp_funcs->get_clock_by_type(pp_handle, + dc_to_pp_clock_type(clk_type), &pp_clks)) { +- /* Error in pplib. Provide default values. */ ++ /* Error in pplib. Provide default values. */ ++ get_default_clock_levels(clk_type, dc_clks); + return true; + } + } else if (adev->smu.funcs && adev->smu.funcs->get_clock_by_type) { +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +index 1212da12c414..b3ae1c41fc69 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +@@ -1103,6 +1103,25 @@ void dcn20_pipe_control_lock( + if (pipe->plane_state != NULL) + flip_immediate = pipe->plane_state->flip_immediate; + ++ if (flip_immediate && lock) { ++ const int TIMEOUT_FOR_FLIP_PENDING = 100000; ++ int i; ++ ++ for (i = 0; i < TIMEOUT_FOR_FLIP_PENDING; ++i) { ++ if (!pipe->plane_res.hubp->funcs->hubp_is_flip_pending(pipe->plane_res.hubp)) ++ break; ++ udelay(1); ++ } ++ ++ if (pipe->bottom_pipe != NULL) { ++ for (i = 0; i < TIMEOUT_FOR_FLIP_PENDING; ++i) { ++ if (!pipe->bottom_pipe->plane_res.hubp->funcs->hubp_is_flip_pending(pipe->bottom_pipe->plane_res.hubp)) ++ break; ++ udelay(1); ++ } ++ } ++ } ++ + /* In flip immediate and pipe splitting case, we need to use GSL + * for synchronization. Only do setup on locking and on flip type change. + */ +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 82add736e17d..86c17896b532 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -2465,9 +2465,11 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr) + drm_dp_mst_topology_put_port(port); + } + +- for (i = 0; i < mgr->max_payloads; i++) { +- if (mgr->payloads[i].payload_state != DP_PAYLOAD_DELETE_LOCAL) ++ for (i = 0; i < mgr->max_payloads; /* do nothing */) { ++ if (mgr->payloads[i].payload_state != DP_PAYLOAD_DELETE_LOCAL) { ++ i++; + continue; ++ } + + DRM_DEBUG_KMS("removing payload %d\n", i); + for (j = i; j < mgr->max_payloads - 1; j++) { +diff --git a/drivers/gpu/drm/i915/display/intel_fbc.c b/drivers/gpu/drm/i915/display/intel_fbc.c +index 16ed44bfd734..07a038f21619 100644 +--- a/drivers/gpu/drm/i915/display/intel_fbc.c ++++ b/drivers/gpu/drm/i915/display/intel_fbc.c +@@ -1284,7 +1284,7 @@ static int intel_sanitize_fbc_option(struct drm_i915_private *dev_priv) + return 0; + + /* https://bugs.freedesktop.org/show_bug.cgi?id=108085 */ +- if (IS_GEMINILAKE(dev_priv)) ++ if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv)) + return 0; + + if (IS_BROADWELL(dev_priv) || INTEL_GEN(dev_priv) >= 9) +diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c +index e753b1e706e2..fc29a3705354 100644 +--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c ++++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c +@@ -1597,9 +1597,9 @@ static int cmd_handler_mi_op_2f(struct parser_exec_state *s) + if (!(cmd_val(s, 0) & (1 << 22))) + return ret; + +- /* check if QWORD */ +- if (DWORD_FIELD(0, 20, 19) == 1) +- valid_len += 8; ++ /* check inline data */ ++ if (cmd_val(s, 0) & BIT(18)) ++ valid_len = CMD_LEN(9); + ret = gvt_check_valid_cmd_length(cmd_length(s), + valid_len); + if (ret) +diff --git a/drivers/gpu/drm/meson/meson_venc_cvbs.c b/drivers/gpu/drm/meson/meson_venc_cvbs.c +index 9ab27aecfcf3..1bd6b6d15ffb 100644 +--- a/drivers/gpu/drm/meson/meson_venc_cvbs.c ++++ b/drivers/gpu/drm/meson/meson_venc_cvbs.c +@@ -64,6 +64,25 @@ struct meson_cvbs_mode meson_cvbs_modes[MESON_CVBS_MODES_COUNT] = { + }, + }; + ++static const struct meson_cvbs_mode * ++meson_cvbs_get_mode(const struct drm_display_mode *req_mode) ++{ ++ int i; ++ ++ for (i = 0; i < MESON_CVBS_MODES_COUNT; ++i) { ++ struct meson_cvbs_mode *meson_mode = &meson_cvbs_modes[i]; ++ ++ if (drm_mode_match(req_mode, &meson_mode->mode, ++ DRM_MODE_MATCH_TIMINGS | ++ DRM_MODE_MATCH_CLOCK | ++ DRM_MODE_MATCH_FLAGS | ++ DRM_MODE_MATCH_3D_FLAGS)) ++ return meson_mode; ++ } ++ ++ return NULL; ++} ++ + /* Connector */ + + static void meson_cvbs_connector_destroy(struct drm_connector *connector) +@@ -136,14 +155,8 @@ static int meson_venc_cvbs_encoder_atomic_check(struct drm_encoder *encoder, + struct drm_crtc_state *crtc_state, + struct drm_connector_state *conn_state) + { +- int i; +- +- for (i = 0; i < MESON_CVBS_MODES_COUNT; ++i) { +- struct meson_cvbs_mode *meson_mode = &meson_cvbs_modes[i]; +- +- if (drm_mode_equal(&crtc_state->mode, &meson_mode->mode)) +- return 0; +- } ++ if (meson_cvbs_get_mode(&crtc_state->mode)) ++ return 0; + + return -EINVAL; + } +@@ -191,24 +204,17 @@ static void meson_venc_cvbs_encoder_mode_set(struct drm_encoder *encoder, + struct drm_display_mode *mode, + struct drm_display_mode *adjusted_mode) + { ++ const struct meson_cvbs_mode *meson_mode = meson_cvbs_get_mode(mode); + struct meson_venc_cvbs *meson_venc_cvbs = + encoder_to_meson_venc_cvbs(encoder); + struct meson_drm *priv = meson_venc_cvbs->priv; +- int i; + +- for (i = 0; i < MESON_CVBS_MODES_COUNT; ++i) { +- struct meson_cvbs_mode *meson_mode = &meson_cvbs_modes[i]; ++ if (meson_mode) { ++ meson_venci_cvbs_mode_set(priv, meson_mode->enci); + +- if (drm_mode_equal(mode, &meson_mode->mode)) { +- meson_venci_cvbs_mode_set(priv, +- meson_mode->enci); +- +- /* Setup 27MHz vclk2 for ENCI and VDAC */ +- meson_vclk_setup(priv, MESON_VCLK_TARGET_CVBS, +- MESON_VCLK_CVBS, MESON_VCLK_CVBS, +- MESON_VCLK_CVBS, true); +- break; +- } ++ /* Setup 27MHz vclk2 for ENCI and VDAC */ ++ meson_vclk_setup(priv, MESON_VCLK_TARGET_CVBS, MESON_VCLK_CVBS, ++ MESON_VCLK_CVBS, MESON_VCLK_CVBS, true); + } + } + +diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.c b/drivers/gpu/drm/mgag200/mgag200_drv.c +index afd9119b6cf1..c96c4393b124 100644 +--- a/drivers/gpu/drm/mgag200/mgag200_drv.c ++++ b/drivers/gpu/drm/mgag200/mgag200_drv.c +@@ -30,7 +30,8 @@ module_param_named(modeset, mgag200_modeset, int, 0400); + static struct drm_driver driver; + + static const struct pci_device_id pciidlist[] = { +- { PCI_VENDOR_ID_MATROX, 0x522, PCI_ANY_ID, PCI_ANY_ID, 0, 0, G200_SE_A }, ++ { PCI_VENDOR_ID_MATROX, 0x522, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ G200_SE_A | MGAG200_FLAG_HW_BUG_NO_STARTADD}, + { PCI_VENDOR_ID_MATROX, 0x524, PCI_ANY_ID, PCI_ANY_ID, 0, 0, G200_SE_B }, + { PCI_VENDOR_ID_MATROX, 0x530, PCI_ANY_ID, PCI_ANY_ID, 0, 0, G200_EV }, + { PCI_VENDOR_ID_MATROX, 0x532, PCI_ANY_ID, PCI_ANY_ID, 0, 0, G200_WB }, +@@ -63,6 +64,35 @@ static const struct file_operations mgag200_driver_fops = { + DRM_VRAM_MM_FILE_OPERATIONS + }; + ++static bool mgag200_pin_bo_at_0(const struct mga_device *mdev) ++{ ++ return mdev->flags & MGAG200_FLAG_HW_BUG_NO_STARTADD; ++} ++ ++int mgag200_driver_dumb_create(struct drm_file *file, ++ struct drm_device *dev, ++ struct drm_mode_create_dumb *args) ++{ ++ struct mga_device *mdev = dev->dev_private; ++ unsigned long pg_align; ++ ++ if (WARN_ONCE(!dev->vram_mm, "VRAM MM not initialized")) ++ return -EINVAL; ++ ++ pg_align = 0ul; ++ ++ /* ++ * Aligning scanout buffers to the size of the video ram forces ++ * placement at offset 0. Works around a bug where HW does not ++ * respect 'startadd' field. ++ */ ++ if (mgag200_pin_bo_at_0(mdev)) ++ pg_align = PFN_UP(mdev->mc.vram_size); ++ ++ return drm_gem_vram_fill_create_dumb(file, dev, &dev->vram_mm->bdev, ++ pg_align, false, args); ++} ++ + static struct drm_driver driver = { + .driver_features = DRIVER_GEM | DRIVER_MODESET, + .load = mgag200_driver_load, +@@ -74,7 +104,9 @@ static struct drm_driver driver = { + .major = DRIVER_MAJOR, + .minor = DRIVER_MINOR, + .patchlevel = DRIVER_PATCHLEVEL, +- DRM_GEM_VRAM_DRIVER ++ .dumb_create = mgag200_driver_dumb_create, ++ .dumb_map_offset = drm_gem_vram_driver_dumb_mmap_offset, ++ .gem_prime_mmap = drm_gem_prime_mmap, + }; + + static struct pci_driver mgag200_pci_driver = { +diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.h b/drivers/gpu/drm/mgag200/mgag200_drv.h +index 1c93f8dc08c7..7cc1a242df5f 100644 +--- a/drivers/gpu/drm/mgag200/mgag200_drv.h ++++ b/drivers/gpu/drm/mgag200/mgag200_drv.h +@@ -159,6 +159,12 @@ enum mga_type { + G200_EW3, + }; + ++/* HW does not handle 'startadd' field correct. */ ++#define MGAG200_FLAG_HW_BUG_NO_STARTADD (1ul << 8) ++ ++#define MGAG200_TYPE_MASK (0x000000ff) ++#define MGAG200_FLAG_MASK (0x00ffff00) ++ + #define IS_G200_SE(mdev) (mdev->type == G200_SE_A || mdev->type == G200_SE_B) + + struct mga_device { +@@ -188,6 +194,18 @@ struct mga_device { + u32 unique_rev_id; + }; + ++static inline enum mga_type ++mgag200_type_from_driver_data(kernel_ulong_t driver_data) ++{ ++ return (enum mga_type)(driver_data & MGAG200_TYPE_MASK); ++} ++ ++static inline unsigned long ++mgag200_flags_from_driver_data(kernel_ulong_t driver_data) ++{ ++ return driver_data & MGAG200_FLAG_MASK; ++} ++ + /* mgag200_mode.c */ + int mgag200_modeset_init(struct mga_device *mdev); + void mgag200_modeset_fini(struct mga_device *mdev); +diff --git a/drivers/gpu/drm/mgag200/mgag200_main.c b/drivers/gpu/drm/mgag200/mgag200_main.c +index a9773334dedf..388212b2d63f 100644 +--- a/drivers/gpu/drm/mgag200/mgag200_main.c ++++ b/drivers/gpu/drm/mgag200/mgag200_main.c +@@ -94,7 +94,8 @@ static int mgag200_device_init(struct drm_device *dev, + struct mga_device *mdev = dev->dev_private; + int ret, option; + +- mdev->type = flags; ++ mdev->flags = mgag200_flags_from_driver_data(flags); ++ mdev->type = mgag200_type_from_driver_data(flags); + + /* Hardcode the number of CRTCs to 1 */ + mdev->num_crtc = 1; +diff --git a/drivers/gpu/drm/nouveau/dispnv50/atom.h b/drivers/gpu/drm/nouveau/dispnv50/atom.h +index 43df86c38f58..24f7700768da 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/atom.h ++++ b/drivers/gpu/drm/nouveau/dispnv50/atom.h +@@ -114,6 +114,7 @@ struct nv50_head_atom { + u8 nhsync:1; + u8 nvsync:1; + u8 depth:4; ++ u8 bpc; + } or; + + /* Currently only used for MST */ +diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c +index b46be8a091e9..b5b1a34f896f 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c +@@ -353,10 +353,20 @@ nv50_outp_atomic_check(struct drm_encoder *encoder, + struct drm_crtc_state *crtc_state, + struct drm_connector_state *conn_state) + { +- struct nouveau_connector *nv_connector = +- nouveau_connector(conn_state->connector); +- return nv50_outp_atomic_check_view(encoder, crtc_state, conn_state, +- nv_connector->native_mode); ++ struct drm_connector *connector = conn_state->connector; ++ struct nouveau_connector *nv_connector = nouveau_connector(connector); ++ struct nv50_head_atom *asyh = nv50_head_atom(crtc_state); ++ int ret; ++ ++ ret = nv50_outp_atomic_check_view(encoder, crtc_state, conn_state, ++ nv_connector->native_mode); ++ if (ret) ++ return ret; ++ ++ if (crtc_state->mode_changed || crtc_state->connectors_changed) ++ asyh->or.bpc = connector->display_info.bpc; ++ ++ return 0; + } + + /****************************************************************************** +@@ -770,32 +780,54 @@ nv50_msto_atomic_check(struct drm_encoder *encoder, + struct nv50_mstm *mstm = mstc->mstm; + struct nv50_head_atom *asyh = nv50_head_atom(crtc_state); + int slots; ++ int ret; ++ ++ ret = nv50_outp_atomic_check_view(encoder, crtc_state, conn_state, ++ mstc->native); ++ if (ret) ++ return ret; ++ ++ if (!crtc_state->mode_changed && !crtc_state->connectors_changed) ++ return 0; ++ ++ /* ++ * When restoring duplicated states, we need to make sure that the bw ++ * remains the same and avoid recalculating it, as the connector's bpc ++ * may have changed after the state was duplicated ++ */ ++ if (!state->duplicated) { ++ const int clock = crtc_state->adjusted_mode.clock; + +- if (crtc_state->mode_changed || crtc_state->connectors_changed) { + /* +- * When restoring duplicated states, we need to make sure that +- * the bw remains the same and avoid recalculating it, as the +- * connector's bpc may have changed after the state was +- * duplicated ++ * XXX: Since we don't use HDR in userspace quite yet, limit ++ * the bpc to 8 to save bandwidth on the topology. In the ++ * future, we'll want to properly fix this by dynamically ++ * selecting the highest possible bpc that would fit in the ++ * topology + */ +- if (!state->duplicated) { +- const int bpp = connector->display_info.bpc * 3; +- const int clock = crtc_state->adjusted_mode.clock; ++ asyh->or.bpc = min(connector->display_info.bpc, 8U); ++ asyh->dp.pbn = drm_dp_calc_pbn_mode(clock, asyh->or.bpc * 3); ++ } + +- asyh->dp.pbn = drm_dp_calc_pbn_mode(clock, bpp); +- } ++ slots = drm_dp_atomic_find_vcpi_slots(state, &mstm->mgr, mstc->port, ++ asyh->dp.pbn); ++ if (slots < 0) ++ return slots; + +- slots = drm_dp_atomic_find_vcpi_slots(state, &mstm->mgr, +- mstc->port, +- asyh->dp.pbn); +- if (slots < 0) +- return slots; ++ asyh->dp.tu = slots; + +- asyh->dp.tu = slots; +- } ++ return 0; ++} + +- return nv50_outp_atomic_check_view(encoder, crtc_state, conn_state, +- mstc->native); ++static u8 ++nv50_dp_bpc_to_depth(unsigned int bpc) ++{ ++ switch (bpc) { ++ case 6: return 0x2; ++ case 8: return 0x5; ++ case 10: /* fall-through */ ++ default: return 0x6; ++ } + } + + static void +@@ -808,7 +840,7 @@ nv50_msto_enable(struct drm_encoder *encoder) + struct nv50_mstm *mstm = NULL; + struct drm_connector *connector; + struct drm_connector_list_iter conn_iter; +- u8 proto, depth; ++ u8 proto; + bool r; + + drm_connector_list_iter_begin(encoder->dev, &conn_iter); +@@ -837,14 +869,8 @@ nv50_msto_enable(struct drm_encoder *encoder) + else + proto = 0x9; + +- switch (mstc->connector.display_info.bpc) { +- case 6: depth = 0x2; break; +- case 8: depth = 0x5; break; +- case 10: +- default: depth = 0x6; break; +- } +- +- mstm->outp->update(mstm->outp, head->base.index, armh, proto, depth); ++ mstm->outp->update(mstm->outp, head->base.index, armh, proto, ++ nv50_dp_bpc_to_depth(armh->or.bpc)); + + msto->head = head; + msto->mstc = mstc; +@@ -1498,20 +1524,14 @@ nv50_sor_enable(struct drm_encoder *encoder) + lvds.lvds.script |= 0x0200; + } + +- if (nv_connector->base.display_info.bpc == 8) ++ if (asyh->or.bpc == 8) + lvds.lvds.script |= 0x0200; + } + + nvif_mthd(&disp->disp->object, 0, &lvds, sizeof(lvds)); + break; + case DCB_OUTPUT_DP: +- if (nv_connector->base.display_info.bpc == 6) +- depth = 0x2; +- else +- if (nv_connector->base.display_info.bpc == 8) +- depth = 0x5; +- else +- depth = 0x6; ++ depth = nv50_dp_bpc_to_depth(asyh->or.bpc); + + if (nv_encoder->link & 1) + proto = 0x8; +@@ -1662,7 +1682,7 @@ nv50_pior_enable(struct drm_encoder *encoder) + nv50_outp_acquire(nv_encoder); + + nv_connector = nouveau_encoder_connector_get(nv_encoder); +- switch (nv_connector->base.display_info.bpc) { ++ switch (asyh->or.bpc) { + case 10: asyh->or.depth = 0x6; break; + case 8: asyh->or.depth = 0x5; break; + case 6: asyh->or.depth = 0x2; break; +diff --git a/drivers/gpu/drm/nouveau/dispnv50/head.c b/drivers/gpu/drm/nouveau/dispnv50/head.c +index 71c23bf1fe25..c9692df2b76c 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/head.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/head.c +@@ -81,18 +81,17 @@ nv50_head_atomic_check_dither(struct nv50_head_atom *armh, + struct nv50_head_atom *asyh, + struct nouveau_conn_atom *asyc) + { +- struct drm_connector *connector = asyc->state.connector; + u32 mode = 0x00; + + if (asyc->dither.mode == DITHERING_MODE_AUTO) { +- if (asyh->base.depth > connector->display_info.bpc * 3) ++ if (asyh->base.depth > asyh->or.bpc * 3) + mode = DITHERING_MODE_DYNAMIC2X2; + } else { + mode = asyc->dither.mode; + } + + if (asyc->dither.depth == DITHERING_DEPTH_AUTO) { +- if (connector->display_info.bpc >= 8) ++ if (asyh->or.bpc >= 8) + mode |= DITHERING_DEPTH_8BPC; + } else { + mode |= asyc->dither.depth; +diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c +index bdf91b75328e..1c67ac434e10 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_drv.c ++++ b/drivers/gpu/drm/panfrost/panfrost_drv.c +@@ -303,14 +303,17 @@ static int panfrost_ioctl_mmap_bo(struct drm_device *dev, void *data, + } + + /* Don't allow mmapping of heap objects as pages are not pinned. */ +- if (to_panfrost_bo(gem_obj)->is_heap) +- return -EINVAL; ++ if (to_panfrost_bo(gem_obj)->is_heap) { ++ ret = -EINVAL; ++ goto out; ++ } + + ret = drm_gem_create_mmap_offset(gem_obj); + if (ret == 0) + args->offset = drm_vma_node_offset_addr(&gem_obj->vma_node); +- drm_gem_object_put_unlocked(gem_obj); + ++out: ++ drm_gem_object_put_unlocked(gem_obj); + return ret; + } + +@@ -347,20 +350,19 @@ static int panfrost_ioctl_madvise(struct drm_device *dev, void *data, + return -ENOENT; + } + ++ mutex_lock(&pfdev->shrinker_lock); + args->retained = drm_gem_shmem_madvise(gem_obj, args->madv); + + if (args->retained) { + struct panfrost_gem_object *bo = to_panfrost_bo(gem_obj); + +- mutex_lock(&pfdev->shrinker_lock); +- + if (args->madv == PANFROST_MADV_DONTNEED) +- list_add_tail(&bo->base.madv_list, &pfdev->shrinker_list); ++ list_add_tail(&bo->base.madv_list, ++ &pfdev->shrinker_list); + else if (args->madv == PANFROST_MADV_WILLNEED) + list_del_init(&bo->base.madv_list); +- +- mutex_unlock(&pfdev->shrinker_lock); + } ++ mutex_unlock(&pfdev->shrinker_lock); + + drm_gem_object_put_unlocked(gem_obj); + return 0; +diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.c b/drivers/gpu/drm/panfrost/panfrost_gem.c +index bc3ff22e5e85..92a95210a899 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gem.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c +@@ -19,6 +19,16 @@ static void panfrost_gem_free_object(struct drm_gem_object *obj) + struct panfrost_gem_object *bo = to_panfrost_bo(obj); + struct panfrost_device *pfdev = obj->dev->dev_private; + ++ /* ++ * Make sure the BO is no longer inserted in the shrinker list before ++ * taking care of the destruction itself. If we don't do that we have a ++ * race condition between this function and what's done in ++ * panfrost_gem_shrinker_scan(). ++ */ ++ mutex_lock(&pfdev->shrinker_lock); ++ list_del_init(&bo->base.madv_list); ++ mutex_unlock(&pfdev->shrinker_lock); ++ + if (bo->sgts) { + int i; + int n_sgt = bo->base.base.size / SZ_2M; +@@ -33,11 +43,6 @@ static void panfrost_gem_free_object(struct drm_gem_object *obj) + kfree(bo->sgts); + } + +- mutex_lock(&pfdev->shrinker_lock); +- if (!list_empty(&bo->base.madv_list)) +- list_del(&bo->base.madv_list); +- mutex_unlock(&pfdev->shrinker_lock); +- + drm_gem_shmem_free_object(obj); + } + +diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c +index 7089dfc8c2a9..110fb38004b1 100644 +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -1826,8 +1826,8 @@ static int r100_packet0_check(struct radeon_cs_parser *p, + track->textures[i].use_pitch = 1; + } else { + track->textures[i].use_pitch = 0; +- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); +- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); ++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); ++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); + } + if (idx_value & RADEON_TXFORMAT_CUBIC_MAP_ENABLE) + track->textures[i].tex_coord_type = 2; +diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c +index 840401413c58..f5f2ffea5ab2 100644 +--- a/drivers/gpu/drm/radeon/r200.c ++++ b/drivers/gpu/drm/radeon/r200.c +@@ -476,8 +476,8 @@ int r200_packet0_check(struct radeon_cs_parser *p, + track->textures[i].use_pitch = 1; + } else { + track->textures[i].use_pitch = 0; +- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); +- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); ++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); ++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); + } + if (idx_value & R200_TXFORMAT_LOOKUP_DISABLE) + track->textures[i].lookup_disable = true; +diff --git a/drivers/md/dm-clone-metadata.c b/drivers/md/dm-clone-metadata.c +index 6bc8c1d1c351..54e4fdd607e1 100644 +--- a/drivers/md/dm-clone-metadata.c ++++ b/drivers/md/dm-clone-metadata.c +@@ -67,23 +67,34 @@ struct superblock_disk { + * To save constantly doing look ups on disk we keep an in core copy of the + * on-disk bitmap, the region_map. + * +- * To further reduce metadata I/O overhead we use a second bitmap, the dmap +- * (dirty bitmap), which tracks the dirty words, i.e. longs, of the region_map. ++ * In order to track which regions are hydrated during a metadata transaction, ++ * we use a second set of bitmaps, the dmap (dirty bitmap), which includes two ++ * bitmaps, namely dirty_regions and dirty_words. The dirty_regions bitmap ++ * tracks the regions that got hydrated during the current metadata ++ * transaction. The dirty_words bitmap tracks the dirty words, i.e. longs, of ++ * the dirty_regions bitmap. ++ * ++ * This allows us to precisely track the regions that were hydrated during the ++ * current metadata transaction and update the metadata accordingly, when we ++ * commit the current transaction. This is important because dm-clone should ++ * only commit the metadata of regions that were properly flushed to the ++ * destination device beforehand. Otherwise, in case of a crash, we could end ++ * up with a corrupted dm-clone device. + * + * When a region finishes hydrating dm-clone calls + * dm_clone_set_region_hydrated(), or for discard requests + * dm_clone_cond_set_range(), which sets the corresponding bits in region_map + * and dmap. + * +- * During a metadata commit we scan the dmap for dirty region_map words (longs) +- * and update accordingly the on-disk metadata. Thus, we don't have to flush to +- * disk the whole region_map. We can just flush the dirty region_map words. ++ * During a metadata commit we scan dmap->dirty_words and dmap->dirty_regions ++ * and update the on-disk metadata accordingly. Thus, we don't have to flush to ++ * disk the whole region_map. We can just flush the dirty region_map bits. + * +- * We use a dirty bitmap, which is smaller than the original region_map, to +- * reduce the amount of memory accesses during a metadata commit. As dm-bitset +- * accesses the on-disk bitmap in 64-bit word granularity, there is no +- * significant benefit in tracking the dirty region_map bits with a smaller +- * granularity. ++ * We use the helper dmap->dirty_words bitmap, which is smaller than the ++ * original region_map, to reduce the amount of memory accesses during a ++ * metadata commit. Moreover, as dm-bitset also accesses the on-disk bitmap in ++ * 64-bit word granularity, the dirty_words bitmap helps us avoid useless disk ++ * accesses. + * + * We could update directly the on-disk bitmap, when dm-clone calls either + * dm_clone_set_region_hydrated() or dm_clone_cond_set_range(), buts this +@@ -92,12 +103,13 @@ struct superblock_disk { + * e.g., in a hooked overwrite bio's completion routine, and further reduce the + * I/O completion latency. + * +- * We maintain two dirty bitmaps. During a metadata commit we atomically swap +- * the currently used dmap with the unused one. This allows the metadata update +- * functions to run concurrently with an ongoing commit. ++ * We maintain two dirty bitmap sets. During a metadata commit we atomically ++ * swap the currently used dmap with the unused one. This allows the metadata ++ * update functions to run concurrently with an ongoing commit. + */ + struct dirty_map { + unsigned long *dirty_words; ++ unsigned long *dirty_regions; + unsigned int changed; + }; + +@@ -115,6 +127,9 @@ struct dm_clone_metadata { + struct dirty_map dmap[2]; + struct dirty_map *current_dmap; + ++ /* Protected by lock */ ++ struct dirty_map *committing_dmap; ++ + /* + * In core copy of the on-disk bitmap to save constantly doing look ups + * on disk. +@@ -461,34 +476,53 @@ static size_t bitmap_size(unsigned long nr_bits) + return BITS_TO_LONGS(nr_bits) * sizeof(long); + } + +-static int dirty_map_init(struct dm_clone_metadata *cmd) ++static int __dirty_map_init(struct dirty_map *dmap, unsigned long nr_words, ++ unsigned long nr_regions) + { +- cmd->dmap[0].changed = 0; +- cmd->dmap[0].dirty_words = kvzalloc(bitmap_size(cmd->nr_words), GFP_KERNEL); ++ dmap->changed = 0; + +- if (!cmd->dmap[0].dirty_words) { +- DMERR("Failed to allocate dirty bitmap"); ++ dmap->dirty_words = kvzalloc(bitmap_size(nr_words), GFP_KERNEL); ++ if (!dmap->dirty_words) ++ return -ENOMEM; ++ ++ dmap->dirty_regions = kvzalloc(bitmap_size(nr_regions), GFP_KERNEL); ++ if (!dmap->dirty_regions) { ++ kvfree(dmap->dirty_words); + return -ENOMEM; + } + +- cmd->dmap[1].changed = 0; +- cmd->dmap[1].dirty_words = kvzalloc(bitmap_size(cmd->nr_words), GFP_KERNEL); ++ return 0; ++} ++ ++static void __dirty_map_exit(struct dirty_map *dmap) ++{ ++ kvfree(dmap->dirty_words); ++ kvfree(dmap->dirty_regions); ++} ++ ++static int dirty_map_init(struct dm_clone_metadata *cmd) ++{ ++ if (__dirty_map_init(&cmd->dmap[0], cmd->nr_words, cmd->nr_regions)) { ++ DMERR("Failed to allocate dirty bitmap"); ++ return -ENOMEM; ++ } + +- if (!cmd->dmap[1].dirty_words) { ++ if (__dirty_map_init(&cmd->dmap[1], cmd->nr_words, cmd->nr_regions)) { + DMERR("Failed to allocate dirty bitmap"); +- kvfree(cmd->dmap[0].dirty_words); ++ __dirty_map_exit(&cmd->dmap[0]); + return -ENOMEM; + } + + cmd->current_dmap = &cmd->dmap[0]; ++ cmd->committing_dmap = NULL; + + return 0; + } + + static void dirty_map_exit(struct dm_clone_metadata *cmd) + { +- kvfree(cmd->dmap[0].dirty_words); +- kvfree(cmd->dmap[1].dirty_words); ++ __dirty_map_exit(&cmd->dmap[0]); ++ __dirty_map_exit(&cmd->dmap[1]); + } + + static int __load_bitset_in_core(struct dm_clone_metadata *cmd) +@@ -633,21 +667,23 @@ unsigned long dm_clone_find_next_unhydrated_region(struct dm_clone_metadata *cmd + return find_next_zero_bit(cmd->region_map, cmd->nr_regions, start); + } + +-static int __update_metadata_word(struct dm_clone_metadata *cmd, unsigned long word) ++static int __update_metadata_word(struct dm_clone_metadata *cmd, ++ unsigned long *dirty_regions, ++ unsigned long word) + { + int r; + unsigned long index = word * BITS_PER_LONG; + unsigned long max_index = min(cmd->nr_regions, (word + 1) * BITS_PER_LONG); + + while (index < max_index) { +- if (test_bit(index, cmd->region_map)) { ++ if (test_bit(index, dirty_regions)) { + r = dm_bitset_set_bit(&cmd->bitset_info, cmd->bitset_root, + index, &cmd->bitset_root); +- + if (r) { + DMERR("dm_bitset_set_bit failed"); + return r; + } ++ __clear_bit(index, dirty_regions); + } + index++; + } +@@ -721,7 +757,7 @@ static int __flush_dmap(struct dm_clone_metadata *cmd, struct dirty_map *dmap) + if (word == cmd->nr_words) + break; + +- r = __update_metadata_word(cmd, word); ++ r = __update_metadata_word(cmd, dmap->dirty_regions, word); + + if (r) + return r; +@@ -743,16 +779,18 @@ static int __flush_dmap(struct dm_clone_metadata *cmd, struct dirty_map *dmap) + return 0; + } + +-int dm_clone_metadata_commit(struct dm_clone_metadata *cmd) ++int dm_clone_metadata_pre_commit(struct dm_clone_metadata *cmd) + { +- int r = -EPERM; ++ int r = 0; + unsigned long flags; + struct dirty_map *dmap, *next_dmap; + + down_write(&cmd->lock); + +- if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) ++ if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { ++ r = -EPERM; + goto out; ++ } + + /* Get current dirty bitmap */ + dmap = cmd->current_dmap; +@@ -764,7 +802,7 @@ int dm_clone_metadata_commit(struct dm_clone_metadata *cmd) + * The last commit failed, so we don't have a clean dirty-bitmap to + * use. + */ +- if (WARN_ON(next_dmap->changed)) { ++ if (WARN_ON(next_dmap->changed || cmd->committing_dmap)) { + r = -EINVAL; + goto out; + } +@@ -774,11 +812,33 @@ int dm_clone_metadata_commit(struct dm_clone_metadata *cmd) + cmd->current_dmap = next_dmap; + spin_unlock_irqrestore(&cmd->bitmap_lock, flags); + +- /* +- * No one is accessing the old dirty bitmap anymore, so we can flush +- * it. +- */ +- r = __flush_dmap(cmd, dmap); ++ /* Set old dirty bitmap as currently committing */ ++ cmd->committing_dmap = dmap; ++out: ++ up_write(&cmd->lock); ++ ++ return r; ++} ++ ++int dm_clone_metadata_commit(struct dm_clone_metadata *cmd) ++{ ++ int r = -EPERM; ++ ++ down_write(&cmd->lock); ++ ++ if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) ++ goto out; ++ ++ if (WARN_ON(!cmd->committing_dmap)) { ++ r = -EINVAL; ++ goto out; ++ } ++ ++ r = __flush_dmap(cmd, cmd->committing_dmap); ++ if (!r) { ++ /* Clear committing dmap */ ++ cmd->committing_dmap = NULL; ++ } + out: + up_write(&cmd->lock); + +@@ -803,6 +863,7 @@ int dm_clone_set_region_hydrated(struct dm_clone_metadata *cmd, unsigned long re + dmap = cmd->current_dmap; + + __set_bit(word, dmap->dirty_words); ++ __set_bit(region_nr, dmap->dirty_regions); + __set_bit(region_nr, cmd->region_map); + dmap->changed = 1; + +@@ -831,6 +892,7 @@ int dm_clone_cond_set_range(struct dm_clone_metadata *cmd, unsigned long start, + if (!test_bit(region_nr, cmd->region_map)) { + word = region_nr / BITS_PER_LONG; + __set_bit(word, dmap->dirty_words); ++ __set_bit(region_nr, dmap->dirty_regions); + __set_bit(region_nr, cmd->region_map); + dmap->changed = 1; + } +diff --git a/drivers/md/dm-clone-metadata.h b/drivers/md/dm-clone-metadata.h +index 434bff08508b..c7848c49aef8 100644 +--- a/drivers/md/dm-clone-metadata.h ++++ b/drivers/md/dm-clone-metadata.h +@@ -73,7 +73,23 @@ void dm_clone_metadata_close(struct dm_clone_metadata *cmd); + + /* + * Commit dm-clone metadata to disk. ++ * ++ * We use a two phase commit: ++ * ++ * 1. dm_clone_metadata_pre_commit(): Prepare the current transaction for ++ * committing. After this is called, all subsequent metadata updates, done ++ * through either dm_clone_set_region_hydrated() or ++ * dm_clone_cond_set_range(), will be part of the **next** transaction. ++ * ++ * 2. dm_clone_metadata_commit(): Actually commit the current transaction to ++ * disk and start a new transaction. ++ * ++ * This allows dm-clone to flush the destination device after step (1) to ++ * ensure that all freshly hydrated regions, for which we are updating the ++ * metadata, are properly written to non-volatile storage and won't be lost in ++ * case of a crash. + */ ++int dm_clone_metadata_pre_commit(struct dm_clone_metadata *cmd); + int dm_clone_metadata_commit(struct dm_clone_metadata *cmd); + + /* +@@ -110,6 +126,7 @@ int dm_clone_metadata_abort(struct dm_clone_metadata *cmd); + * Switches metadata to a read only mode. Once read-only mode has been entered + * the following functions will return -EPERM: + * ++ * dm_clone_metadata_pre_commit() + * dm_clone_metadata_commit() + * dm_clone_set_region_hydrated() + * dm_clone_cond_set_range() +diff --git a/drivers/md/dm-clone-target.c b/drivers/md/dm-clone-target.c +index 4ca8f1977222..e6e5d24a79f5 100644 +--- a/drivers/md/dm-clone-target.c ++++ b/drivers/md/dm-clone-target.c +@@ -86,6 +86,12 @@ struct clone { + + struct dm_clone_metadata *cmd; + ++ /* ++ * bio used to flush the destination device, before committing the ++ * metadata. ++ */ ++ struct bio flush_bio; ++ + /* Region hydration hash table */ + struct hash_table_bucket *ht; + +@@ -1106,10 +1112,13 @@ static bool need_commit_due_to_time(struct clone *clone) + /* + * A non-zero return indicates read-only or fail mode. + */ +-static int commit_metadata(struct clone *clone) ++static int commit_metadata(struct clone *clone, bool *dest_dev_flushed) + { + int r = 0; + ++ if (dest_dev_flushed) ++ *dest_dev_flushed = false; ++ + mutex_lock(&clone->commit_lock); + + if (!dm_clone_changed_this_transaction(clone->cmd)) +@@ -1120,8 +1129,26 @@ static int commit_metadata(struct clone *clone) + goto out; + } + +- r = dm_clone_metadata_commit(clone->cmd); ++ r = dm_clone_metadata_pre_commit(clone->cmd); ++ if (unlikely(r)) { ++ __metadata_operation_failed(clone, "dm_clone_metadata_pre_commit", r); ++ goto out; ++ } + ++ bio_reset(&clone->flush_bio); ++ bio_set_dev(&clone->flush_bio, clone->dest_dev->bdev); ++ clone->flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH; ++ ++ r = submit_bio_wait(&clone->flush_bio); ++ if (unlikely(r)) { ++ __metadata_operation_failed(clone, "flush destination device", r); ++ goto out; ++ } ++ ++ if (dest_dev_flushed) ++ *dest_dev_flushed = true; ++ ++ r = dm_clone_metadata_commit(clone->cmd); + if (unlikely(r)) { + __metadata_operation_failed(clone, "dm_clone_metadata_commit", r); + goto out; +@@ -1194,6 +1221,7 @@ static void process_deferred_flush_bios(struct clone *clone) + { + struct bio *bio; + unsigned long flags; ++ bool dest_dev_flushed; + struct bio_list bios = BIO_EMPTY_LIST; + struct bio_list bio_completions = BIO_EMPTY_LIST; + +@@ -1213,7 +1241,7 @@ static void process_deferred_flush_bios(struct clone *clone) + !(dm_clone_changed_this_transaction(clone->cmd) && need_commit_due_to_time(clone))) + return; + +- if (commit_metadata(clone)) { ++ if (commit_metadata(clone, &dest_dev_flushed)) { + bio_list_merge(&bios, &bio_completions); + + while ((bio = bio_list_pop(&bios))) +@@ -1227,8 +1255,17 @@ static void process_deferred_flush_bios(struct clone *clone) + while ((bio = bio_list_pop(&bio_completions))) + bio_endio(bio); + +- while ((bio = bio_list_pop(&bios))) +- generic_make_request(bio); ++ while ((bio = bio_list_pop(&bios))) { ++ if ((bio->bi_opf & REQ_PREFLUSH) && dest_dev_flushed) { ++ /* We just flushed the destination device as part of ++ * the metadata commit, so there is no reason to send ++ * another flush. ++ */ ++ bio_endio(bio); ++ } else { ++ generic_make_request(bio); ++ } ++ } + } + + static void do_worker(struct work_struct *work) +@@ -1400,7 +1437,7 @@ static void clone_status(struct dm_target *ti, status_type_t type, + + /* Commit to ensure statistics aren't out-of-date */ + if (!(status_flags & DM_STATUS_NOFLUSH_FLAG) && !dm_suspended(ti)) +- (void) commit_metadata(clone); ++ (void) commit_metadata(clone, NULL); + + r = dm_clone_get_free_metadata_block_count(clone->cmd, &nr_free_metadata_blocks); + +@@ -1834,6 +1871,7 @@ static int clone_ctr(struct dm_target *ti, unsigned int argc, char **argv) + bio_list_init(&clone->deferred_flush_completions); + clone->hydration_offset = 0; + atomic_set(&clone->hydrations_in_flight, 0); ++ bio_init(&clone->flush_bio, NULL, 0); + + clone->wq = alloc_workqueue("dm-" DM_MSG_PREFIX, WQ_MEM_RECLAIM, 0); + if (!clone->wq) { +@@ -1907,6 +1945,7 @@ static void clone_dtr(struct dm_target *ti) + struct clone *clone = ti->private; + + mutex_destroy(&clone->commit_lock); ++ bio_uninit(&clone->flush_bio); + + for (i = 0; i < clone->nr_ctr_args; i++) + kfree(clone->ctr_args[i]); +@@ -1961,7 +2000,7 @@ static void clone_postsuspend(struct dm_target *ti) + wait_event(clone->hydration_stopped, !atomic_read(&clone->hydrations_in_flight)); + flush_workqueue(clone->wq); + +- (void) commit_metadata(clone); ++ (void) commit_metadata(clone, NULL); + } + + static void clone_resume(struct dm_target *ti) +diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c +index dbcc1e41cd57..e0c32793c248 100644 +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -599,45 +599,10 @@ static struct pgpath *__map_bio(struct multipath *m, struct bio *bio) + return pgpath; + } + +-static struct pgpath *__map_bio_fast(struct multipath *m, struct bio *bio) +-{ +- struct pgpath *pgpath; +- unsigned long flags; +- +- /* Do we need to select a new pgpath? */ +- /* +- * FIXME: currently only switching path if no path (due to failure, etc) +- * - which negates the point of using a path selector +- */ +- pgpath = READ_ONCE(m->current_pgpath); +- if (!pgpath) +- pgpath = choose_pgpath(m, bio->bi_iter.bi_size); +- +- if (!pgpath) { +- if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) { +- /* Queue for the daemon to resubmit */ +- spin_lock_irqsave(&m->lock, flags); +- bio_list_add(&m->queued_bios, bio); +- spin_unlock_irqrestore(&m->lock, flags); +- queue_work(kmultipathd, &m->process_queued_bios); +- +- return ERR_PTR(-EAGAIN); +- } +- return NULL; +- } +- +- return pgpath; +-} +- + static int __multipath_map_bio(struct multipath *m, struct bio *bio, + struct dm_mpath_io *mpio) + { +- struct pgpath *pgpath; +- +- if (!m->hw_handler_name) +- pgpath = __map_bio_fast(m, bio); +- else +- pgpath = __map_bio(m, bio); ++ struct pgpath *pgpath = __map_bio(m, bio); + + if (IS_ERR(pgpath)) + return DM_MAPIO_SUBMITTED; +diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c +index 4c68a7b93d5e..b88d6d701f5b 100644 +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -188,6 +188,15 @@ struct dm_pool_metadata { + unsigned long flags; + sector_t data_block_size; + ++ /* ++ * Pre-commit callback. ++ * ++ * This allows the thin provisioning target to run a callback before ++ * the metadata are committed. ++ */ ++ dm_pool_pre_commit_fn pre_commit_fn; ++ void *pre_commit_context; ++ + /* + * We reserve a section of the metadata for commit overhead. + * All reported space does *not* include this. +@@ -826,6 +835,14 @@ static int __commit_transaction(struct dm_pool_metadata *pmd) + if (unlikely(!pmd->in_service)) + return 0; + ++ if (pmd->pre_commit_fn) { ++ r = pmd->pre_commit_fn(pmd->pre_commit_context); ++ if (r < 0) { ++ DMERR("pre-commit callback failed"); ++ return r; ++ } ++ } ++ + r = __write_changed_details(pmd); + if (r < 0) + return r; +@@ -892,6 +909,8 @@ struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev, + pmd->in_service = false; + pmd->bdev = bdev; + pmd->data_block_size = data_block_size; ++ pmd->pre_commit_fn = NULL; ++ pmd->pre_commit_context = NULL; + + r = __create_persistent_data_objects(pmd, format_device); + if (r) { +@@ -2044,6 +2063,16 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd, + return r; + } + ++void dm_pool_register_pre_commit_callback(struct dm_pool_metadata *pmd, ++ dm_pool_pre_commit_fn fn, ++ void *context) ++{ ++ pmd_write_lock_in_core(pmd); ++ pmd->pre_commit_fn = fn; ++ pmd->pre_commit_context = context; ++ pmd_write_unlock(pmd); ++} ++ + int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd) + { + int r = -EINVAL; +diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h +index f6be0d733c20..7ef56bd2a7e3 100644 +--- a/drivers/md/dm-thin-metadata.h ++++ b/drivers/md/dm-thin-metadata.h +@@ -230,6 +230,13 @@ bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd); + */ + void dm_pool_issue_prefetches(struct dm_pool_metadata *pmd); + ++/* Pre-commit callback */ ++typedef int (*dm_pool_pre_commit_fn)(void *context); ++ ++void dm_pool_register_pre_commit_callback(struct dm_pool_metadata *pmd, ++ dm_pool_pre_commit_fn fn, ++ void *context); ++ + /*----------------------------------------------------------------*/ + + #endif +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index fcd887703f95..1696bfd23ad1 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -328,6 +328,7 @@ struct pool_c { + dm_block_t low_water_blocks; + struct pool_features requested_pf; /* Features requested during table load */ + struct pool_features adjusted_pf; /* Features used after adjusting for constituent devices */ ++ struct bio flush_bio; + }; + + /* +@@ -2392,8 +2393,16 @@ static void process_deferred_bios(struct pool *pool) + while ((bio = bio_list_pop(&bio_completions))) + bio_endio(bio); + +- while ((bio = bio_list_pop(&bios))) +- generic_make_request(bio); ++ while ((bio = bio_list_pop(&bios))) { ++ /* ++ * The data device was flushed as part of metadata commit, ++ * so complete redundant flushes immediately. ++ */ ++ if (bio->bi_opf & REQ_PREFLUSH) ++ bio_endio(bio); ++ else ++ generic_make_request(bio); ++ } + } + + static void do_worker(struct work_struct *ws) +@@ -3127,6 +3136,7 @@ static void pool_dtr(struct dm_target *ti) + __pool_dec(pt->pool); + dm_put_device(ti, pt->metadata_dev); + dm_put_device(ti, pt->data_dev); ++ bio_uninit(&pt->flush_bio); + kfree(pt); + + mutex_unlock(&dm_thin_pool_table.mutex); +@@ -3192,6 +3202,29 @@ static void metadata_low_callback(void *context) + dm_table_event(pool->ti->table); + } + ++/* ++ * We need to flush the data device **before** committing the metadata. ++ * ++ * This ensures that the data blocks of any newly inserted mappings are ++ * properly written to non-volatile storage and won't be lost in case of a ++ * crash. ++ * ++ * Failure to do so can result in data corruption in the case of internal or ++ * external snapshots and in the case of newly provisioned blocks, when block ++ * zeroing is enabled. ++ */ ++static int metadata_pre_commit_callback(void *context) ++{ ++ struct pool_c *pt = context; ++ struct bio *flush_bio = &pt->flush_bio; ++ ++ bio_reset(flush_bio); ++ bio_set_dev(flush_bio, pt->data_dev->bdev); ++ flush_bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH; ++ ++ return submit_bio_wait(flush_bio); ++} ++ + static sector_t get_dev_size(struct block_device *bdev) + { + return i_size_read(bdev->bd_inode) >> SECTOR_SHIFT; +@@ -3360,6 +3393,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) + pt->data_dev = data_dev; + pt->low_water_blocks = low_water_blocks; + pt->adjusted_pf = pt->requested_pf = pf; ++ bio_init(&pt->flush_bio, NULL, 0); + ti->num_flush_bios = 1; + + /* +@@ -3386,6 +3420,10 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) + if (r) + goto out_flags_changed; + ++ dm_pool_register_pre_commit_callback(pt->pool->pmd, ++ metadata_pre_commit_callback, ++ pt); ++ + pt->callbacks.congested_fn = pool_is_congested; + dm_table_add_target_callbacks(ti->table, &pt->callbacks); + +diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c +index 21ea537bd55e..eff04fa23dfa 100644 +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -203,7 +203,13 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent, + struct btree_node *right = r->n; + uint32_t nr_left = le32_to_cpu(left->header.nr_entries); + uint32_t nr_right = le32_to_cpu(right->header.nr_entries); +- unsigned threshold = 2 * merge_threshold(left) + 1; ++ /* ++ * Ensure the number of entries in each child will be greater ++ * than or equal to (max_entries / 3 + 1), so no matter which ++ * child is used for removal, the number will still be not ++ * less than (max_entries / 3). ++ */ ++ unsigned int threshold = 2 * (merge_threshold(left) + 1); + + if (nr_left + nr_right < threshold) { + /* +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 2c71a434c915..95b41c0891d0 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -408,38 +408,6 @@ static int mmc_blk_ioctl_copy_to_user(struct mmc_ioc_cmd __user *ic_ptr, + return 0; + } + +-static int ioctl_rpmb_card_status_poll(struct mmc_card *card, u32 *status, +- u32 retries_max) +-{ +- int err; +- u32 retry_count = 0; +- +- if (!status || !retries_max) +- return -EINVAL; +- +- do { +- err = __mmc_send_status(card, status, 5); +- if (err) +- break; +- +- if (!R1_STATUS(*status) && +- (R1_CURRENT_STATE(*status) != R1_STATE_PRG)) +- break; /* RPMB programming operation complete */ +- +- /* +- * Rechedule to give the MMC device a chance to continue +- * processing the previous command without being polled too +- * frequently. +- */ +- usleep_range(1000, 5000); +- } while (++retry_count < retries_max); +- +- if (retry_count == retries_max) +- err = -EPERM; +- +- return err; +-} +- + static int ioctl_do_sanitize(struct mmc_card *card) + { + int err; +@@ -468,6 +436,58 @@ out: + return err; + } + ++static inline bool mmc_blk_in_tran_state(u32 status) ++{ ++ /* ++ * Some cards mishandle the status bits, so make sure to check both the ++ * busy indication and the card state. ++ */ ++ return status & R1_READY_FOR_DATA && ++ (R1_CURRENT_STATE(status) == R1_STATE_TRAN); ++} ++ ++static int card_busy_detect(struct mmc_card *card, unsigned int timeout_ms, ++ u32 *resp_errs) ++{ ++ unsigned long timeout = jiffies + msecs_to_jiffies(timeout_ms); ++ int err = 0; ++ u32 status; ++ ++ do { ++ bool done = time_after(jiffies, timeout); ++ ++ err = __mmc_send_status(card, &status, 5); ++ if (err) { ++ dev_err(mmc_dev(card->host), ++ "error %d requesting status\n", err); ++ return err; ++ } ++ ++ /* Accumulate any response error bits seen */ ++ if (resp_errs) ++ *resp_errs |= status; ++ ++ /* ++ * Timeout if the device never becomes ready for data and never ++ * leaves the program state. ++ */ ++ if (done) { ++ dev_err(mmc_dev(card->host), ++ "Card stuck in wrong state! %s status: %#x\n", ++ __func__, status); ++ return -ETIMEDOUT; ++ } ++ ++ /* ++ * Some cards mishandle the status bits, ++ * so make sure to check both the busy ++ * indication and the card state. ++ */ ++ } while (!mmc_blk_in_tran_state(status)); ++ ++ return err; ++} ++ + static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + struct mmc_blk_ioc_data *idata) + { +@@ -477,7 +497,6 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + struct scatterlist sg; + int err; + unsigned int target_part; +- u32 status = 0; + + if (!card || !md || !idata) + return -EINVAL; +@@ -611,16 +630,12 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + + memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp)); + +- if (idata->rpmb) { ++ if (idata->rpmb || (cmd.flags & MMC_RSP_R1B)) { + /* +- * Ensure RPMB command has completed by polling CMD13 ++ * Ensure RPMB/R1B command has completed by polling CMD13 + * "Send Status". + */ +- err = ioctl_rpmb_card_status_poll(card, &status, 5); +- if (err) +- dev_err(mmc_dev(card->host), +- "%s: Card Status=0x%08X, error %d\n", +- __func__, status, err); ++ err = card_busy_detect(card, MMC_BLK_TIMEOUT_MS, NULL); + } + + return err; +@@ -970,58 +985,6 @@ static unsigned int mmc_blk_data_timeout_ms(struct mmc_host *host, + return ms; + } + +-static inline bool mmc_blk_in_tran_state(u32 status) +-{ +- /* +- * Some cards mishandle the status bits, so make sure to check both the +- * busy indication and the card state. +- */ +- return status & R1_READY_FOR_DATA && +- (R1_CURRENT_STATE(status) == R1_STATE_TRAN); +-} +- +-static int card_busy_detect(struct mmc_card *card, unsigned int timeout_ms, +- struct request *req, u32 *resp_errs) +-{ +- unsigned long timeout = jiffies + msecs_to_jiffies(timeout_ms); +- int err = 0; +- u32 status; +- +- do { +- bool done = time_after(jiffies, timeout); +- +- err = __mmc_send_status(card, &status, 5); +- if (err) { +- pr_err("%s: error %d requesting status\n", +- req->rq_disk->disk_name, err); +- return err; +- } +- +- /* Accumulate any response error bits seen */ +- if (resp_errs) +- *resp_errs |= status; +- +- /* +- * Timeout if the device never becomes ready for data and never +- * leaves the program state. +- */ +- if (done) { +- pr_err("%s: Card stuck in wrong state! %s %s status: %#x\n", +- mmc_hostname(card->host), +- req->rq_disk->disk_name, __func__, status); +- return -ETIMEDOUT; +- } +- +- /* +- * Some cards mishandle the status bits, +- * so make sure to check both the busy +- * indication and the card state. +- */ +- } while (!mmc_blk_in_tran_state(status)); +- +- return err; +-} +- + static int mmc_blk_reset(struct mmc_blk_data *md, struct mmc_host *host, + int type) + { +@@ -1671,7 +1634,7 @@ static int mmc_blk_fix_state(struct mmc_card *card, struct request *req) + + mmc_blk_send_stop(card, timeout); + +- err = card_busy_detect(card, timeout, req, NULL); ++ err = card_busy_detect(card, timeout, NULL); + + mmc_retune_release(card->host); + +@@ -1895,7 +1858,7 @@ static int mmc_blk_card_busy(struct mmc_card *card, struct request *req) + if (mmc_host_is_spi(card->host) || rq_data_dir(req) == READ) + return 0; + +- err = card_busy_detect(card, MMC_BLK_TIMEOUT_MS, req, &status); ++ err = card_busy_detect(card, MMC_BLK_TIMEOUT_MS, &status); + + /* + * Do not assume data transferred correctly if there are any error bits +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 221127324709..abf8f5eb0a1c 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -1469,8 +1469,7 @@ void mmc_detach_bus(struct mmc_host *host) + mmc_bus_put(host); + } + +-static void _mmc_detect_change(struct mmc_host *host, unsigned long delay, +- bool cd_irq) ++void _mmc_detect_change(struct mmc_host *host, unsigned long delay, bool cd_irq) + { + /* + * If the device is configured as wakeup, we prevent a new sleep for +@@ -2129,7 +2128,7 @@ int mmc_hw_reset(struct mmc_host *host) + ret = host->bus_ops->hw_reset(host); + mmc_bus_put(host); + +- if (ret) ++ if (ret < 0) + pr_warn("%s: tried to HW reset card, got error %d\n", + mmc_hostname(host), ret); + +@@ -2297,11 +2296,8 @@ void mmc_rescan(struct work_struct *work) + + mmc_bus_get(host); + +- /* +- * if there is a _removable_ card registered, check whether it is +- * still present +- */ +- if (host->bus_ops && !host->bus_dead && mmc_card_is_removable(host)) ++ /* Verify a registered card to be functional, else remove it. */ ++ if (host->bus_ops && !host->bus_dead) + host->bus_ops->detect(host); + + host->detect_change = 0; +diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h +index 328c78dbee66..575ac0257af2 100644 +--- a/drivers/mmc/core/core.h ++++ b/drivers/mmc/core/core.h +@@ -70,6 +70,8 @@ void mmc_rescan(struct work_struct *work); + void mmc_start_host(struct mmc_host *host); + void mmc_stop_host(struct mmc_host *host); + ++void _mmc_detect_change(struct mmc_host *host, unsigned long delay, ++ bool cd_irq); + int _mmc_detect_card_removed(struct mmc_host *host); + int mmc_detect_card_removed(struct mmc_host *host); + +diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c +index 26cabd53ddc5..ebb387aa5158 100644 +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -1048,9 +1048,35 @@ static int mmc_sdio_runtime_resume(struct mmc_host *host) + return ret; + } + ++/* ++ * SDIO HW reset ++ * ++ * Returns 0 if the HW reset was executed synchronously, returns 1 if the HW ++ * reset was asynchronously scheduled, else a negative error code. ++ */ + static int mmc_sdio_hw_reset(struct mmc_host *host) + { +- mmc_power_cycle(host, host->card->ocr); ++ struct mmc_card *card = host->card; ++ ++ /* ++ * In case the card is shared among multiple func drivers, reset the ++ * card through a rescan work. In this way it will be removed and ++ * re-detected, thus all func drivers becomes informed about it. ++ */ ++ if (atomic_read(&card->sdio_funcs_probed) > 1) { ++ if (mmc_card_removed(card)) ++ return 1; ++ host->rescan_entered = 0; ++ mmc_card_set_removed(card); ++ _mmc_detect_change(host, 0, false); ++ return 1; ++ } ++ ++ /* ++ * A single func driver has been probed, then let's skip the heavy ++ * hotplug dance above and execute the reset immediately. ++ */ ++ mmc_power_cycle(host, card->ocr); + return mmc_sdio_reinit_card(host); + } + +diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c +index 2963e6542958..3cc928282af7 100644 +--- a/drivers/mmc/core/sdio_bus.c ++++ b/drivers/mmc/core/sdio_bus.c +@@ -138,6 +138,8 @@ static int sdio_bus_probe(struct device *dev) + if (ret) + return ret; + ++ atomic_inc(&func->card->sdio_funcs_probed); ++ + /* Unbound SDIO functions are always suspended. + * During probe, the function is set active and the usage count + * is incremented. If the driver supports runtime PM, +@@ -153,7 +155,10 @@ static int sdio_bus_probe(struct device *dev) + /* Set the default block size so the driver is sure it's something + * sensible. */ + sdio_claim_host(func); +- ret = sdio_set_block_size(func, 0); ++ if (mmc_card_removed(func->card)) ++ ret = -ENOMEDIUM; ++ else ++ ret = sdio_set_block_size(func, 0); + sdio_release_host(func); + if (ret) + goto disable_runtimepm; +@@ -165,6 +170,7 @@ static int sdio_bus_probe(struct device *dev) + return 0; + + disable_runtimepm: ++ atomic_dec(&func->card->sdio_funcs_probed); + if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD) + pm_runtime_put_noidle(dev); + dev_pm_domain_detach(dev, false); +@@ -181,6 +187,7 @@ static int sdio_bus_remove(struct device *dev) + pm_runtime_get_sync(dev); + + drv->remove(func); ++ atomic_dec(&func->card->sdio_funcs_probed); + + if (func->irq_handler) { + pr_warn("WARNING: driver %s did not remove its interrupt handler!\n", +diff --git a/drivers/pci/controller/pcie-rcar.c b/drivers/pci/controller/pcie-rcar.c +index f6a669a9af41..1ad0b56f11b4 100644 +--- a/drivers/pci/controller/pcie-rcar.c ++++ b/drivers/pci/controller/pcie-rcar.c +@@ -93,8 +93,11 @@ + #define LINK_SPEED_2_5GTS (1 << 16) + #define LINK_SPEED_5_0GTS (2 << 16) + #define MACCTLR 0x011058 ++#define MACCTLR_NFTS_MASK GENMASK(23, 16) /* The name is from SH7786 */ + #define SPEED_CHANGE BIT(24) + #define SCRAMBLE_DISABLE BIT(27) ++#define LTSMDIS BIT(31) ++#define MACCTLR_INIT_VAL (LTSMDIS | MACCTLR_NFTS_MASK) + #define PMSR 0x01105c + #define MACS2R 0x011078 + #define MACCGSPSETR 0x011084 +@@ -615,6 +618,8 @@ static int rcar_pcie_hw_init(struct rcar_pcie *pcie) + if (IS_ENABLED(CONFIG_PCI_MSI)) + rcar_pci_write_reg(pcie, 0x801f0000, PCIEMSITXR); + ++ rcar_pci_write_reg(pcie, MACCTLR_INIT_VAL, MACCTLR); ++ + /* Finish initialization - establish a PCI Express link */ + rcar_pci_write_reg(pcie, CFINIT, PCIETCTLR); + +@@ -1237,6 +1242,7 @@ static int rcar_pcie_resume_noirq(struct device *dev) + return 0; + + /* Re-establish the PCIe link */ ++ rcar_pci_write_reg(pcie, MACCTLR_INIT_VAL, MACCTLR); + rcar_pci_write_reg(pcie, CFINIT, PCIETCTLR); + return rcar_pcie_wait_for_dl(pcie); + } +diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h +index 654c972b8ea0..882ce82c4699 100644 +--- a/drivers/pci/hotplug/pciehp.h ++++ b/drivers/pci/hotplug/pciehp.h +@@ -72,6 +72,7 @@ extern int pciehp_poll_time; + * @reset_lock: prevents access to the Data Link Layer Link Active bit in the + * Link Status register and to the Presence Detect State bit in the Slot + * Status register during a slot reset which may cause them to flap ++ * @ist_running: flag to keep user request waiting while IRQ thread is running + * @request_result: result of last user request submitted to the IRQ thread + * @requester: wait queue to wake up on completion of user request, + * used for synchronous slot enable/disable request via sysfs +@@ -101,6 +102,7 @@ struct controller { + + struct hotplug_slot hotplug_slot; /* hotplug core interface */ + struct rw_semaphore reset_lock; ++ unsigned int ist_running; + int request_result; + wait_queue_head_t requester; + }; +diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c +index 21af7b16d7a4..dd8e4a5fb282 100644 +--- a/drivers/pci/hotplug/pciehp_ctrl.c ++++ b/drivers/pci/hotplug/pciehp_ctrl.c +@@ -375,7 +375,8 @@ int pciehp_sysfs_enable_slot(struct hotplug_slot *hotplug_slot) + ctrl->request_result = -ENODEV; + pciehp_request(ctrl, PCI_EXP_SLTSTA_PDC); + wait_event(ctrl->requester, +- !atomic_read(&ctrl->pending_events)); ++ !atomic_read(&ctrl->pending_events) && ++ !ctrl->ist_running); + return ctrl->request_result; + case POWERON_STATE: + ctrl_info(ctrl, "Slot(%s): Already in powering on state\n", +@@ -408,7 +409,8 @@ int pciehp_sysfs_disable_slot(struct hotplug_slot *hotplug_slot) + mutex_unlock(&ctrl->state_lock); + pciehp_request(ctrl, DISABLE_SLOT); + wait_event(ctrl->requester, +- !atomic_read(&ctrl->pending_events)); ++ !atomic_read(&ctrl->pending_events) && ++ !ctrl->ist_running); + return ctrl->request_result; + case POWEROFF_STATE: + ctrl_info(ctrl, "Slot(%s): Already in powering off state\n", +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 1a522c1c4177..86d97f3112f0 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -583,6 +583,7 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id) + irqreturn_t ret; + u32 events; + ++ ctrl->ist_running = true; + pci_config_pm_runtime_get(pdev); + + /* rerun pciehp_isr() if the port was inaccessible on interrupt */ +@@ -629,6 +630,7 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id) + up_read(&ctrl->reset_lock); + + pci_config_pm_runtime_put(pdev); ++ ctrl->ist_running = false; + wake_up(&ctrl->requester); + return IRQ_HANDLED; + } +diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c +index 0884bedcfc7a..771041784e64 100644 +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -213,12 +213,13 @@ u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag) + + if (pci_msi_ignore_mask) + return 0; ++ + desc_addr = pci_msix_desc_addr(desc); + if (!desc_addr) + return 0; + + mask_bits &= ~PCI_MSIX_ENTRY_CTRL_MASKBIT; +- if (flag) ++ if (flag & PCI_MSIX_ENTRY_CTRL_MASKBIT) + mask_bits |= PCI_MSIX_ENTRY_CTRL_MASKBIT; + + writel(mask_bits, desc_addr + PCI_MSIX_ENTRY_VECTOR_CTRL); +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index a8124e47bf6e..d4ac8ce8c1f9 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1076,17 +1076,22 @@ static int pci_pm_thaw_noirq(struct device *dev) + return error; + } + +- if (pci_has_legacy_pm_support(pci_dev)) +- return pci_legacy_resume_early(dev); +- + /* +- * pci_restore_state() requires the device to be in D0 (because of MSI +- * restoration among other things), so force it into D0 in case the +- * driver's "freeze" callbacks put it into a low-power state directly. ++ * Both the legacy ->resume_early() and the new pm->thaw_noirq() ++ * callbacks assume the device has been returned to D0 and its ++ * config state has been restored. ++ * ++ * In addition, pci_restore_state() restores MSI-X state in MMIO ++ * space, which requires the device to be in D0, so return it to D0 ++ * in case the driver's "freeze" callbacks put it into a low-power ++ * state. + */ + pci_set_power_state(pci_dev, PCI_D0); + pci_restore_state(pci_dev); + ++ if (pci_has_legacy_pm_support(pci_dev)) ++ return pci_legacy_resume_early(dev); ++ + if (drv && drv->pm && drv->pm->thaw_noirq) + error = drv->pm->thaw_noirq(dev); + +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 3d5271a7a849..64ebe3e5e611 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1089,14 +1089,15 @@ static unsigned int pci_scan_child_bus_extend(struct pci_bus *bus, + * @sec: updated with secondary bus number from EA + * @sub: updated with subordinate bus number from EA + * +- * If @dev is a bridge with EA capability, update @sec and @sub with +- * fixed bus numbers from the capability and return true. Otherwise, +- * return false. ++ * If @dev is a bridge with EA capability that specifies valid secondary ++ * and subordinate bus numbers, return true with the bus numbers in @sec ++ * and @sub. Otherwise return false. + */ + static bool pci_ea_fixed_busnrs(struct pci_dev *dev, u8 *sec, u8 *sub) + { + int ea, offset; + u32 dw; ++ u8 ea_sec, ea_sub; + + if (dev->hdr_type != PCI_HEADER_TYPE_BRIDGE) + return false; +@@ -1108,8 +1109,13 @@ static bool pci_ea_fixed_busnrs(struct pci_dev *dev, u8 *sec, u8 *sub) + + offset = ea + PCI_EA_FIRST_ENT; + pci_read_config_dword(dev, offset, &dw); +- *sec = dw & PCI_EA_SEC_BUS_MASK; +- *sub = (dw & PCI_EA_SUB_BUS_MASK) >> PCI_EA_SUB_BUS_SHIFT; ++ ea_sec = dw & PCI_EA_SEC_BUS_MASK; ++ ea_sub = (dw & PCI_EA_SUB_BUS_MASK) >> PCI_EA_SUB_BUS_SHIFT; ++ if (ea_sec == 0 || ea_sub < ea_sec) ++ return false; ++ ++ *sec = ea_sec; ++ *sub = ea_sub; + return true; + } + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 320255e5e8f8..308f744393eb 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4313,15 +4313,21 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags) + + static bool pci_quirk_cavium_acs_match(struct pci_dev *dev) + { ++ if (!pci_is_pcie(dev) || pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT) ++ return false; ++ ++ switch (dev->device) { + /* +- * Effectively selects all downstream ports for whole ThunderX 1 +- * family by 0xf800 mask (which represents 8 SoCs), while the lower +- * bits of device ID are used to indicate which subdevice is used +- * within the SoC. ++ * Effectively selects all downstream ports for whole ThunderX1 ++ * (which represents 8 SoCs). + */ +- return (pci_is_pcie(dev) && +- (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) && +- ((dev->device & 0xf800) == 0xa000)); ++ case 0xa000 ... 0xa7ff: /* ThunderX1 */ ++ case 0xaf84: /* ThunderX2 */ ++ case 0xb884: /* ThunderX3 */ ++ return true; ++ default: ++ return false; ++ } + } + + static int pci_quirk_cavium_acs(struct pci_dev *dev, u16 acs_flags) +@@ -4706,7 +4712,7 @@ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags) + #define INTEL_BSPR_REG_BPPD (1 << 9) + + /* Upstream Peer Decode Configuration Register */ +-#define INTEL_UPDCR_REG 0x1114 ++#define INTEL_UPDCR_REG 0x1014 + /* 5:0 Peer Decode Enable bits */ + #define INTEL_UPDCR_REG_MASK 0x3f + +diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c +index 8c94cd3fd1f2..465d6afd826e 100644 +--- a/drivers/pci/switch/switchtec.c ++++ b/drivers/pci/switch/switchtec.c +@@ -675,7 +675,7 @@ static int ioctl_event_summary(struct switchtec_dev *stdev, + return -ENOMEM; + + s->global = ioread32(&stdev->mmio_sw_event->global_summary); +- s->part_bitmap = ioread32(&stdev->mmio_sw_event->part_event_bitmap); ++ s->part_bitmap = ioread64(&stdev->mmio_sw_event->part_event_bitmap); + s->local_part = ioread32(&stdev->mmio_part_cfg->part_event_summary); + + for (i = 0; i < stdev->partition_count; i++) { +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 621f1afd4d6b..1995f5b3ea67 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -241,10 +241,31 @@ static void qcom_glink_channel_release(struct kref *ref) + { + struct glink_channel *channel = container_of(ref, struct glink_channel, + refcount); ++ struct glink_core_rx_intent *intent; ++ struct glink_core_rx_intent *tmp; + unsigned long flags; ++ int iid; ++ ++ /* cancel pending rx_done work */ ++ cancel_work_sync(&channel->intent_work); + + spin_lock_irqsave(&channel->intent_lock, flags); ++ /* Free all non-reuse intents pending rx_done work */ ++ list_for_each_entry_safe(intent, tmp, &channel->done_intents, node) { ++ if (!intent->reuse) { ++ kfree(intent->data); ++ kfree(intent); ++ } ++ } ++ ++ idr_for_each_entry(&channel->liids, tmp, iid) { ++ kfree(tmp->data); ++ kfree(tmp); ++ } + idr_destroy(&channel->liids); ++ ++ idr_for_each_entry(&channel->riids, tmp, iid) ++ kfree(tmp); + idr_destroy(&channel->riids); + spin_unlock_irqrestore(&channel->intent_lock, flags); + +@@ -1094,13 +1115,12 @@ static int qcom_glink_create_remote(struct qcom_glink *glink, + close_link: + /* + * Send a close request to "undo" our open-ack. The close-ack will +- * release the last reference. ++ * release qcom_glink_send_open_req() reference and the last reference ++ * will be relesed after receiving remote_close or transport unregister ++ * by calling qcom_glink_native_remove(). + */ + qcom_glink_send_close_req(glink, channel); + +- /* Release qcom_glink_send_open_req() reference */ +- kref_put(&channel->refcount, qcom_glink_channel_release); +- + return ret; + } + +@@ -1415,15 +1435,13 @@ static int qcom_glink_rx_open(struct qcom_glink *glink, unsigned int rcid, + + ret = rpmsg_register_device(rpdev); + if (ret) +- goto free_rpdev; ++ goto rcid_remove; + + channel->rpdev = rpdev; + } + + return 0; + +-free_rpdev: +- kfree(rpdev); + rcid_remove: + spin_lock_irqsave(&glink->idr_lock, flags); + idr_remove(&glink->rcids, channel->rcid); +@@ -1544,6 +1562,18 @@ static void qcom_glink_work(struct work_struct *work) + } + } + ++static void qcom_glink_cancel_rx_work(struct qcom_glink *glink) ++{ ++ struct glink_defer_cmd *dcmd; ++ struct glink_defer_cmd *tmp; ++ ++ /* cancel any pending deferred rx_work */ ++ cancel_work_sync(&glink->rx_work); ++ ++ list_for_each_entry_safe(dcmd, tmp, &glink->rx_queue, node) ++ kfree(dcmd); ++} ++ + struct qcom_glink *qcom_glink_native_probe(struct device *dev, + unsigned long features, + struct qcom_glink_pipe *rx, +@@ -1619,23 +1649,24 @@ void qcom_glink_native_remove(struct qcom_glink *glink) + struct glink_channel *channel; + int cid; + int ret; +- unsigned long flags; + + disable_irq(glink->irq); +- cancel_work_sync(&glink->rx_work); ++ qcom_glink_cancel_rx_work(glink); + + ret = device_for_each_child(glink->dev, NULL, qcom_glink_remove_device); + if (ret) + dev_warn(glink->dev, "Can't remove GLINK devices: %d\n", ret); + +- spin_lock_irqsave(&glink->idr_lock, flags); + /* Release any defunct local channels, waiting for close-ack */ + idr_for_each_entry(&glink->lcids, channel, cid) + kref_put(&channel->refcount, qcom_glink_channel_release); + ++ /* Release any defunct local channels, waiting for close-req */ ++ idr_for_each_entry(&glink->rcids, channel, cid) ++ kref_put(&channel->refcount, qcom_glink_channel_release); ++ + idr_destroy(&glink->lcids); + idr_destroy(&glink->rcids); +- spin_unlock_irqrestore(&glink->idr_lock, flags); + mbox_free_channel(glink->mbox_chan); + } + EXPORT_SYMBOL_GPL(qcom_glink_native_remove); +diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c +index 4238383d8685..579bc4443f6d 100644 +--- a/drivers/rpmsg/qcom_glink_smem.c ++++ b/drivers/rpmsg/qcom_glink_smem.c +@@ -105,7 +105,7 @@ static void glink_smem_rx_advance(struct qcom_glink_pipe *np, + tail = le32_to_cpu(*pipe->tail); + + tail += count; +- if (tail > pipe->native.length) ++ if (tail >= pipe->native.length) + tail -= pipe->native.length; + + *pipe->tail = cpu_to_le32(tail); +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index ebd47c0cf9e9..70b99c0e2e67 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1945,7 +1945,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + + ISCSI_DBG_EH(session, "scsi cmd %p timedout\n", sc); + +- spin_lock(&session->frwd_lock); ++ spin_lock_bh(&session->frwd_lock); + task = (struct iscsi_task *)sc->SCp.ptr; + if (!task) { + /* +@@ -2072,7 +2072,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + done: + if (task) + task->last_timeout = jiffies; +- spin_unlock(&session->frwd_lock); ++ spin_unlock_bh(&session->frwd_lock); + ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ? + "timer reset" : "shutdown or nh"); + return rc; +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 7259bce85e0e..1fbc5c6c6c14 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -176,6 +176,7 @@ qla2x00_sysfs_read_nvram(struct file *filp, struct kobject *kobj, + + faddr = ha->flt_region_nvram; + if (IS_QLA28XX(ha)) { ++ qla28xx_get_aux_images(vha, &active_regions); + if (active_regions.aux.vpd_nvram == QLA27XX_SECONDARY_IMAGE) + faddr = ha->flt_region_nvram_sec; + } +diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c +index 99f0a1a08143..cbaf178fc979 100644 +--- a/drivers/scsi/qla2xxx/qla_bsg.c ++++ b/drivers/scsi/qla2xxx/qla_bsg.c +@@ -2399,7 +2399,7 @@ qla2x00_get_flash_image_status(struct bsg_job *bsg_job) + struct qla_active_regions regions = { }; + struct active_regions active_regions = { }; + +- qla28xx_get_aux_images(vha, &active_regions); ++ qla27xx_get_active_image(vha, &active_regions); + regions.global_image = active_regions.global; + + if (IS_QLA28XX(ha)) { +diff --git a/drivers/scsi/qla2xxx/qla_fw.h b/drivers/scsi/qla2xxx/qla_fw.h +index 732bb871c433..dc2366a29665 100644 +--- a/drivers/scsi/qla2xxx/qla_fw.h ++++ b/drivers/scsi/qla2xxx/qla_fw.h +@@ -1523,6 +1523,10 @@ struct qla_flt_header { + #define FLT_REG_NVRAM_SEC_28XX_1 0x10F + #define FLT_REG_NVRAM_SEC_28XX_2 0x111 + #define FLT_REG_NVRAM_SEC_28XX_3 0x113 ++#define FLT_REG_MPI_PRI_28XX 0xD3 ++#define FLT_REG_MPI_SEC_28XX 0xF0 ++#define FLT_REG_PEP_PRI_28XX 0xD1 ++#define FLT_REG_PEP_SEC_28XX 0xF1 + + struct qla_flt_region { + uint16_t code; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index d400b51929a6..5d31e3d52b6b 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -534,6 +534,7 @@ static int qla_post_els_plogi_work(struct scsi_qla_host *vha, fc_port_t *fcport) + + e->u.fcport.fcport = fcport; + fcport->flags |= FCF_ASYNC_ACTIVE; ++ fcport->disc_state = DSC_LOGIN_PEND; + return qla2x00_post_work(vha, e); + } + +@@ -4847,6 +4848,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags) + } + + INIT_WORK(&fcport->del_work, qla24xx_delete_sess_fn); ++ INIT_WORK(&fcport->free_work, qlt_free_session_done); + INIT_WORK(&fcport->reg_work, qla_register_fcport_fn); + INIT_LIST_HEAD(&fcport->gnl_entry); + INIT_LIST_HEAD(&fcport->list); +diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c +index f2d5115b2d8d..bbe90354f49b 100644 +--- a/drivers/scsi/qla2xxx/qla_sup.c ++++ b/drivers/scsi/qla2xxx/qla_sup.c +@@ -847,15 +847,15 @@ qla2xxx_get_flt_info(scsi_qla_host_t *vha, uint32_t flt_addr) + ha->flt_region_img_status_pri = start; + break; + case FLT_REG_IMG_SEC_27XX: +- if (IS_QLA27XX(ha) && !IS_QLA28XX(ha)) ++ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) + ha->flt_region_img_status_sec = start; + break; + case FLT_REG_FW_SEC_27XX: +- if (IS_QLA27XX(ha) && !IS_QLA28XX(ha)) ++ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) + ha->flt_region_fw_sec = start; + break; + case FLT_REG_BOOTLOAD_SEC_27XX: +- if (IS_QLA27XX(ha) && !IS_QLA28XX(ha)) ++ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) + ha->flt_region_boot_sec = start; + break; + case FLT_REG_AUX_IMG_PRI_28XX: +@@ -2725,8 +2725,11 @@ qla28xx_write_flash_data(scsi_qla_host_t *vha, uint32_t *dwptr, uint32_t faddr, + ql_log(ql_log_warn + ql_dbg_verbose, vha, 0xffff, + "Region %x is secure\n", region.code); + +- if (region.code == FLT_REG_FW || +- region.code == FLT_REG_FW_SEC_27XX) { ++ switch (region.code) { ++ case FLT_REG_FW: ++ case FLT_REG_FW_SEC_27XX: ++ case FLT_REG_MPI_PRI_28XX: ++ case FLT_REG_MPI_SEC_28XX: + fw_array = dwptr; + + /* 1st fw array */ +@@ -2757,9 +2760,23 @@ qla28xx_write_flash_data(scsi_qla_host_t *vha, uint32_t *dwptr, uint32_t faddr, + buf_size_without_sfub += risc_size; + fw_array += risc_size; + } +- } else { +- ql_log(ql_log_warn + ql_dbg_verbose, vha, 0xffff, +- "Secure region %x not supported\n", ++ break; ++ ++ case FLT_REG_PEP_PRI_28XX: ++ case FLT_REG_PEP_SEC_28XX: ++ fw_array = dwptr; ++ ++ /* 1st fw array */ ++ risc_size = be32_to_cpu(fw_array[3]); ++ risc_attr = be32_to_cpu(fw_array[9]); ++ ++ buf_size_without_sfub = risc_size; ++ fw_array += risc_size; ++ break; ++ ++ default: ++ ql_log(ql_log_warn + ql_dbg_verbose, vha, ++ 0xffff, "Secure region %x not supported\n", + region.code); + rval = QLA_COMMAND_ERROR; + goto done; +@@ -2880,7 +2897,7 @@ qla28xx_write_flash_data(scsi_qla_host_t *vha, uint32_t *dwptr, uint32_t faddr, + "Sending Secure Flash MB Cmd\n"); + rval = qla28xx_secure_flash_update(vha, 0, region.code, + buf_size_without_sfub, sfub_dma, +- sizeof(struct secure_flash_update_block)); ++ sizeof(struct secure_flash_update_block) >> 2); + if (rval != QLA_SUCCESS) { + ql_log(ql_log_warn, vha, 0xffff, + "Secure Flash MB Cmd failed %x.", rval); +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index a06e56224a55..a9bd0f513316 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1160,7 +1160,6 @@ void qlt_unreg_sess(struct fc_port *sess) + sess->last_rscn_gen = sess->rscn_gen; + sess->last_login_gen = sess->login_gen; + +- INIT_WORK(&sess->free_work, qlt_free_session_done); + queue_work(sess->vha->hw->wq, &sess->free_work); + } + EXPORT_SYMBOL(qlt_unreg_sess); +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index 042a24314edc..bab2073c1f72 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -246,6 +246,8 @@ static void tcm_qla2xxx_complete_mcmd(struct work_struct *work) + */ + static void tcm_qla2xxx_free_mcmd(struct qla_tgt_mgmt_cmd *mcmd) + { ++ if (!mcmd) ++ return; + INIT_WORK(&mcmd->free_work, tcm_qla2xxx_complete_mcmd); + queue_work(tcm_qla2xxx_free_wq, &mcmd->free_work); + } +diff --git a/drivers/scsi/ufs/cdns-pltfrm.c b/drivers/scsi/ufs/cdns-pltfrm.c +index b2af04c57a39..6feeb0faf123 100644 +--- a/drivers/scsi/ufs/cdns-pltfrm.c ++++ b/drivers/scsi/ufs/cdns-pltfrm.c +@@ -99,6 +99,12 @@ static int cdns_ufs_link_startup_notify(struct ufs_hba *hba, + */ + ufshcd_dme_set(hba, UIC_ARG_MIB(PA_LOCAL_TX_LCC_ENABLE), 0); + ++ /* ++ * Disabling Autohibern8 feature in cadence UFS ++ * to mask unexpected interrupt trigger. ++ */ ++ hba->ahit = 0; ++ + return 0; + } + +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index f225eaa98ff8..d0f45600b669 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1409,7 +1409,17 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, + if (usb_endpoint_xfer_control(&urb->ep->desc)) { + if (hcd->self.uses_pio_for_control) + return ret; +- if (hcd_uses_dma(hcd)) { ++ if (hcd->localmem_pool) { ++ ret = hcd_alloc_coherent( ++ urb->dev->bus, mem_flags, ++ &urb->setup_dma, ++ (void **)&urb->setup_packet, ++ sizeof(struct usb_ctrlrequest), ++ DMA_TO_DEVICE); ++ if (ret) ++ return ret; ++ urb->transfer_flags |= URB_SETUP_MAP_LOCAL; ++ } else if (hcd_uses_dma(hcd)) { + if (is_vmalloc_addr(urb->setup_packet)) { + WARN_ONCE(1, "setup packet is not dma capable\n"); + return -EAGAIN; +@@ -1427,23 +1437,22 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, + urb->setup_dma)) + return -EAGAIN; + urb->transfer_flags |= URB_SETUP_MAP_SINGLE; +- } else if (hcd->localmem_pool) { +- ret = hcd_alloc_coherent( +- urb->dev->bus, mem_flags, +- &urb->setup_dma, +- (void **)&urb->setup_packet, +- sizeof(struct usb_ctrlrequest), +- DMA_TO_DEVICE); +- if (ret) +- return ret; +- urb->transfer_flags |= URB_SETUP_MAP_LOCAL; + } + } + + dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE; + if (urb->transfer_buffer_length != 0 + && !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) { +- if (hcd_uses_dma(hcd)) { ++ if (hcd->localmem_pool) { ++ ret = hcd_alloc_coherent( ++ urb->dev->bus, mem_flags, ++ &urb->transfer_dma, ++ &urb->transfer_buffer, ++ urb->transfer_buffer_length, ++ dir); ++ if (ret == 0) ++ urb->transfer_flags |= URB_MAP_LOCAL; ++ } else if (hcd_uses_dma(hcd)) { + if (urb->num_sgs) { + int n; + +@@ -1497,15 +1506,6 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, + else + urb->transfer_flags |= URB_DMA_MAP_SINGLE; + } +- } else if (hcd->localmem_pool) { +- ret = hcd_alloc_coherent( +- urb->dev->bus, mem_flags, +- &urb->transfer_dma, +- &urb->transfer_buffer, +- urb->transfer_buffer_length, +- dir); +- if (ret == 0) +- urb->transfer_flags |= URB_MAP_LOCAL; + } + if (ret && (urb->transfer_flags & (URB_SETUP_MAP_SINGLE | + URB_SETUP_MAP_LOCAL))) +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index 54a3c8195c96..2adcabe060c5 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -135,7 +135,8 @@ static int slave_configure(struct scsi_device *sdev) + * For such controllers we need to make sure the block layer sets + * up bounce buffers in addressable memory. + */ +- if (!hcd_uses_dma(bus_to_hcd(us->pusb_dev->bus))) ++ if (!hcd_uses_dma(bus_to_hcd(us->pusb_dev->bus)) || ++ (bus_to_hcd(us->pusb_dev->bus)->localmem_pool != NULL)) + blk_queue_bounce_limit(sdev->request_queue, BLK_BOUNCE_HIGH); + + /* +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c +index 3fa3f728fb39..2056f3f85f59 100644 +--- a/drivers/vfio/pci/vfio_pci_intrs.c ++++ b/drivers/vfio/pci/vfio_pci_intrs.c +@@ -294,8 +294,8 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, + irq = pci_irq_vector(pdev, vector); + + if (vdev->ctx[vector].trigger) { +- free_irq(irq, vdev->ctx[vector].trigger); + irq_bypass_unregister_producer(&vdev->ctx[vector].producer); ++ free_irq(irq, vdev->ctx[vector].trigger); + kfree(vdev->ctx[vector].name); + eventfd_ctx_put(vdev->ctx[vector].trigger); + vdev->ctx[vector].trigger = NULL; +diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c +index 0b4eee3bed66..efb2928ff6c8 100644 +--- a/fs/cifs/cifs_debug.c ++++ b/fs/cifs/cifs_debug.c +@@ -256,6 +256,11 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) + if (!server->rdma) + goto skip_rdma; + ++ if (!server->smbd_conn) { ++ seq_printf(m, "\nSMBDirect transport not available"); ++ goto skip_rdma; ++ } ++ + seq_printf(m, "\nSMBDirect (in hex) protocol version: %x " + "transport status: %x", + server->smbd_conn->protocol, +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index d78bfcc19156..5d2dd04b55a6 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1524,6 +1524,7 @@ struct mid_q_entry { + struct TCP_Server_Info *server; /* server corresponding to this mid */ + __u64 mid; /* multiplex id */ + __u16 credits; /* number of credits consumed by this mid */ ++ __u16 credits_received; /* number of credits from the response */ + __u32 pid; /* process id */ + __u32 sequence_number; /* for CIFS signing */ + unsigned long when_alloc; /* when mid was created */ +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index ccaa8bad336f..20c70cbab1ad 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -905,6 +905,20 @@ dequeue_mid(struct mid_q_entry *mid, bool malformed) + spin_unlock(&GlobalMid_Lock); + } + ++static unsigned int ++smb2_get_credits_from_hdr(char *buffer, struct TCP_Server_Info *server) ++{ ++ struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer; ++ ++ /* ++ * SMB1 does not use credits. ++ */ ++ if (server->vals->header_preamble_size) ++ return 0; ++ ++ return le16_to_cpu(shdr->CreditRequest); ++} ++ + static void + handle_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server, + char *buf, int malformed) +@@ -912,6 +926,7 @@ handle_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server, + if (server->ops->check_trans2 && + server->ops->check_trans2(mid, server, buf, malformed)) + return; ++ mid->credits_received = smb2_get_credits_from_hdr(buf, server); + mid->resp_buf = buf; + mid->large_buf = server->large_buf; + /* Was previous buf put in mpx struct for multi-rsp? */ +@@ -1222,12 +1237,6 @@ next_pdu: + for (i = 0; i < num_mids; i++) { + if (mids[i] != NULL) { + mids[i]->resp_buf_size = server->pdu_size; +- if ((mids[i]->mid_flags & MID_WAIT_CANCELLED) && +- mids[i]->mid_state == MID_RESPONSE_RECEIVED && +- server->ops->handle_cancelled_mid) +- server->ops->handle_cancelled_mid( +- mids[i]->resp_buf, +- server); + + if (!mids[i]->multiRsp || mids[i]->multiEnd) + mids[i]->callback(mids[i]); +@@ -4700,6 +4709,17 @@ static int is_path_remote(struct cifs_sb_info *cifs_sb, struct smb_vol *vol, + } + + #ifdef CONFIG_CIFS_DFS_UPCALL ++static inline void set_root_tcon(struct cifs_sb_info *cifs_sb, ++ struct cifs_tcon *tcon, ++ struct cifs_tcon **root) ++{ ++ spin_lock(&cifs_tcp_ses_lock); ++ tcon->tc_count++; ++ tcon->remap = cifs_remap(cifs_sb); ++ spin_unlock(&cifs_tcp_ses_lock); ++ *root = tcon; ++} ++ + int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *vol) + { + int rc = 0; +@@ -4801,18 +4821,10 @@ int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *vol) + /* Cache out resolved root server */ + (void)dfs_cache_find(xid, ses, cifs_sb->local_nls, cifs_remap(cifs_sb), + root_path + 1, NULL, NULL); +- /* +- * Save root tcon for additional DFS requests to update or create a new +- * DFS cache entry, or even perform DFS failover. +- */ +- spin_lock(&cifs_tcp_ses_lock); +- tcon->tc_count++; +- tcon->dfs_path = root_path; ++ kfree(root_path); + root_path = NULL; +- tcon->remap = cifs_remap(cifs_sb); +- spin_unlock(&cifs_tcp_ses_lock); + +- root_tcon = tcon; ++ set_root_tcon(cifs_sb, tcon, &root_tcon); + + for (count = 1; ;) { + if (!rc && tcon) { +@@ -4849,6 +4861,15 @@ int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *vol) + mount_put_conns(cifs_sb, xid, server, ses, tcon); + rc = mount_get_conns(vol, cifs_sb, &xid, &server, &ses, + &tcon); ++ /* ++ * Ensure that DFS referrals go through new root server. ++ */ ++ if (!rc && tcon && ++ (tcon->share_flags & (SHI1005_FLAGS_DFS | ++ SHI1005_FLAGS_DFS_ROOT))) { ++ cifs_put_tcon(root_tcon); ++ set_root_tcon(cifs_sb, tcon, &root_tcon); ++ } + } + if (rc) { + if (rc == -EACCES || rc == -EOPNOTSUPP) +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index a3b6be80f8a9..c32650f14c9b 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -729,6 +729,13 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + if (backup_cred(cifs_sb)) + create_options |= CREATE_OPEN_BACKUP_INTENT; + ++ /* O_SYNC also has bit for O_DSYNC so following check picks up either */ ++ if (cfile->f_flags & O_SYNC) ++ create_options |= CREATE_WRITE_THROUGH; ++ ++ if (cfile->f_flags & O_DIRECT) ++ create_options |= CREATE_NO_BUFFER; ++ + if (server->ops->get_lease_key) + server->ops->get_lease_key(inode, &cfile->fid); + +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 449d1584ff72..766974fe637a 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -743,36 +743,67 @@ smb2_cancelled_close_fid(struct work_struct *work) + kfree(cancelled); + } + ++/* Caller should already has an extra reference to @tcon */ ++static int ++__smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, ++ __u64 volatile_fid) ++{ ++ struct close_cancelled_open *cancelled; ++ ++ cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL); ++ if (!cancelled) ++ return -ENOMEM; ++ ++ cancelled->fid.persistent_fid = persistent_fid; ++ cancelled->fid.volatile_fid = volatile_fid; ++ cancelled->tcon = tcon; ++ INIT_WORK(&cancelled->work, smb2_cancelled_close_fid); ++ WARN_ON(queue_work(cifsiod_wq, &cancelled->work) == false); ++ ++ return 0; ++} ++ ++int ++smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, ++ __u64 volatile_fid) ++{ ++ int rc; ++ ++ cifs_dbg(FYI, "%s: tc_count=%d\n", __func__, tcon->tc_count); ++ spin_lock(&cifs_tcp_ses_lock); ++ tcon->tc_count++; ++ spin_unlock(&cifs_tcp_ses_lock); ++ ++ rc = __smb2_handle_cancelled_close(tcon, persistent_fid, volatile_fid); ++ if (rc) ++ cifs_put_tcon(tcon); ++ ++ return rc; ++} ++ + int + smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server) + { + struct smb2_sync_hdr *sync_hdr = (struct smb2_sync_hdr *)buffer; + struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer; + struct cifs_tcon *tcon; +- struct close_cancelled_open *cancelled; ++ int rc; + + if (sync_hdr->Command != SMB2_CREATE || + sync_hdr->Status != STATUS_SUCCESS) + return 0; + +- cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL); +- if (!cancelled) +- return -ENOMEM; +- + tcon = smb2_find_smb_tcon(server, sync_hdr->SessionId, + sync_hdr->TreeId); +- if (!tcon) { +- kfree(cancelled); ++ if (!tcon) + return -ENOENT; +- } + +- cancelled->fid.persistent_fid = rsp->PersistentFileId; +- cancelled->fid.volatile_fid = rsp->VolatileFileId; +- cancelled->tcon = tcon; +- INIT_WORK(&cancelled->work, smb2_cancelled_close_fid); +- queue_work(cifsiod_wq, &cancelled->work); ++ rc = __smb2_handle_cancelled_close(tcon, rsp->PersistentFileId, ++ rsp->VolatileFileId); ++ if (rc) ++ cifs_put_tcon(tcon); + +- return 0; ++ return rc; + } + + /** +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index cd55af9b7cc5..b5c1cba3e6a1 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -151,13 +151,7 @@ smb2_get_credits_field(struct TCP_Server_Info *server, const int optype) + static unsigned int + smb2_get_credits(struct mid_q_entry *mid) + { +- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)mid->resp_buf; +- +- if (mid->mid_state == MID_RESPONSE_RECEIVED +- || mid->mid_state == MID_RESPONSE_MALFORMED) +- return le16_to_cpu(shdr->CreditRequest); +- +- return 0; ++ return mid->credits_received; + } + + static int +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 05149862aea4..c985caa2d955 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2972,7 +2972,21 @@ int + SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, + u64 persistent_fid, u64 volatile_fid) + { +- return SMB2_close_flags(xid, tcon, persistent_fid, volatile_fid, 0); ++ int rc; ++ int tmp_rc; ++ ++ rc = SMB2_close_flags(xid, tcon, persistent_fid, volatile_fid, 0); ++ ++ /* retry close in a worker thread if this one is interrupted */ ++ if (rc == -EINTR) { ++ tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, ++ volatile_fid); ++ if (tmp_rc) ++ cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", ++ persistent_fid, tmp_rc); ++ } ++ ++ return rc; + } + + int +diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h +index 71b2930b8e0b..2a12a2fa38a2 100644 +--- a/fs/cifs/smb2proto.h ++++ b/fs/cifs/smb2proto.h +@@ -212,6 +212,9 @@ extern int SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, + extern int SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, + const u64 persistent_fid, const u64 volatile_fid, + const __u8 oplock_level); ++extern int smb2_handle_cancelled_close(struct cifs_tcon *tcon, ++ __u64 persistent_fid, ++ __u64 volatile_fid); + extern int smb2_handle_cancelled_mid(char *buffer, + struct TCP_Server_Info *server); + void smb2_cancelled_close_fid(struct work_struct *work); +diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c +index 3c91fa97c9a8..5b1b97e9e0c9 100644 +--- a/fs/cifs/smbdirect.c ++++ b/fs/cifs/smbdirect.c +@@ -1069,7 +1069,7 @@ static int smbd_post_send_data( + + if (n_vec > SMBDIRECT_MAX_SGE) { + cifs_dbg(VFS, "Can't fit data to SGL, n_vec=%d\n", n_vec); +- return -ENOMEM; ++ return -EINVAL; + } + + sg_init_table(sgl, n_vec); +@@ -1476,6 +1476,7 @@ void smbd_destroy(struct TCP_Server_Info *server) + info->transport_status = SMBD_DESTROYED; + + destroy_workqueue(info->workqueue); ++ log_rdma_event(INFO, "rdma session destroyed\n"); + kfree(info); + } + +@@ -1505,8 +1506,9 @@ create_conn: + log_rdma_event(INFO, "creating rdma session\n"); + server->smbd_conn = smbd_get_connection( + server, (struct sockaddr *) &server->dstaddr); +- log_rdma_event(INFO, "created rdma session info=%p\n", +- server->smbd_conn); ++ ++ if (server->smbd_conn) ++ cifs_dbg(VFS, "RDMA transport re-established\n"); + + return server->smbd_conn ? 0 : -ENOENT; + } +@@ -1970,7 +1972,7 @@ read_rfc1002_done: + + if (info->transport_status != SMBD_CONNECTED) { + log_read(ERR, "disconnected\n"); +- return 0; ++ return -ECONNABORTED; + } + + goto again; +@@ -2269,12 +2271,7 @@ static void smbd_mr_recovery_work(struct work_struct *work) + int rc; + + list_for_each_entry(smbdirect_mr, &info->mr_list, list) { +- if (smbdirect_mr->state == MR_INVALIDATED) +- ib_dma_unmap_sg( +- info->id->device, smbdirect_mr->sgl, +- smbdirect_mr->sgl_count, +- smbdirect_mr->dir); +- else if (smbdirect_mr->state == MR_ERROR) { ++ if (smbdirect_mr->state == MR_ERROR) { + + /* recover this MR entry */ + rc = ib_dereg_mr(smbdirect_mr->mr); +@@ -2602,11 +2599,20 @@ int smbd_deregister_mr(struct smbd_mr *smbdirect_mr) + */ + smbdirect_mr->state = MR_INVALIDATED; + +- /* +- * Schedule the work to do MR recovery for future I/Os +- * MR recovery is slow and we don't want it to block the current I/O +- */ +- queue_work(info->workqueue, &info->mr_recovery_work); ++ if (smbdirect_mr->state == MR_INVALIDATED) { ++ ib_dma_unmap_sg( ++ info->id->device, smbdirect_mr->sgl, ++ smbdirect_mr->sgl_count, ++ smbdirect_mr->dir); ++ smbdirect_mr->state = MR_READY; ++ if (atomic_inc_return(&info->mr_ready_count) == 1) ++ wake_up_interruptible(&info->wait_mr); ++ } else ++ /* ++ * Schedule the work to do MR recovery for future I/Os MR ++ * recovery is slow and don't want it to block current I/O ++ */ ++ queue_work(info->workqueue, &info->mr_recovery_work); + + done: + if (atomic_dec_and_test(&info->mr_used_count)) +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index ca3de62688d6..755434d5e4e7 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -93,8 +93,14 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) + __u16 smb_cmd = le16_to_cpu(midEntry->command); + unsigned long now; + unsigned long roundtrip_time; +- struct TCP_Server_Info *server = midEntry->server; + #endif ++ struct TCP_Server_Info *server = midEntry->server; ++ ++ if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && ++ midEntry->mid_state == MID_RESPONSE_RECEIVED && ++ server->ops->handle_cancelled_mid) ++ server->ops->handle_cancelled_mid(midEntry->resp_buf, server); ++ + midEntry->mid_state = MID_FREE; + atomic_dec(&midCount); + if (midEntry->large_buf) +@@ -319,8 +325,11 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + int val = 1; + __be32 rfc1002_marker; + +- if (cifs_rdma_enabled(server) && server->smbd_conn) { +- rc = smbd_send(server, num_rqst, rqst); ++ if (cifs_rdma_enabled(server)) { ++ /* return -EAGAIN when connecting or reconnecting */ ++ rc = -EAGAIN; ++ if (server->smbd_conn) ++ rc = smbd_send(server, num_rqst, rqst); + goto smbd_done; + } + +@@ -1119,8 +1128,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + midQ[i]->mid, le16_to_cpu(midQ[i]->command)); + send_cancel(server, &rqst[i], midQ[i]); + spin_lock(&GlobalMid_Lock); ++ midQ[i]->mid_flags |= MID_WAIT_CANCELLED; + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { +- midQ[i]->mid_flags |= MID_WAIT_CANCELLED; + midQ[i]->callback = cifs_cancelled_callback; + cancelled_mid[i] = true; + credits[i].value = 0; +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index 997b326247e2..c53e3b892210 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -381,27 +381,28 @@ static void gfs2_size_hint(struct file *filep, loff_t offset, size_t size) + /** + * gfs2_allocate_page_backing - Allocate blocks for a write fault + * @page: The (locked) page to allocate backing for ++ * @length: Size of the allocation + * + * We try to allocate all the blocks required for the page in one go. This + * might fail for various reasons, so we keep trying until all the blocks to + * back this page are allocated. If some of the blocks are already allocated, + * that is ok too. + */ +-static int gfs2_allocate_page_backing(struct page *page) ++static int gfs2_allocate_page_backing(struct page *page, unsigned int length) + { + u64 pos = page_offset(page); +- u64 size = PAGE_SIZE; + + do { + struct iomap iomap = { }; + +- if (gfs2_iomap_get_alloc(page->mapping->host, pos, 1, &iomap)) ++ if (gfs2_iomap_get_alloc(page->mapping->host, pos, length, &iomap)) + return -EIO; + +- iomap.length = min(iomap.length, size); +- size -= iomap.length; ++ if (length < iomap.length) ++ iomap.length = length; ++ length -= iomap.length; + pos += iomap.length; +- } while (size > 0); ++ } while (length > 0); + + return 0; + } +@@ -501,7 +502,7 @@ static vm_fault_t gfs2_page_mkwrite(struct vm_fault *vmf) + if (gfs2_is_stuffed(ip)) + ret = gfs2_unstuff_dinode(ip, page); + if (ret == 0) +- ret = gfs2_allocate_page_backing(page); ++ ret = gfs2_allocate_page_backing(page, PAGE_SIZE); + + out_trans_end: + if (ret) +diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c +index 58e237fba565..2aed73666a65 100644 +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -609,6 +609,14 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd) + list_add(&bd->bd_list, &sdp->sd_log_revokes); + } + ++void gfs2_glock_remove_revoke(struct gfs2_glock *gl) ++{ ++ if (atomic_dec_return(&gl->gl_revokes) == 0) { ++ clear_bit(GLF_LFLUSH, &gl->gl_flags); ++ gfs2_glock_queue_put(gl); ++ } ++} ++ + void gfs2_write_revokes(struct gfs2_sbd *sdp) + { + struct gfs2_trans *tr; +diff --git a/fs/gfs2/log.h b/fs/gfs2/log.h +index 2315fca47a2b..c762da494546 100644 +--- a/fs/gfs2/log.h ++++ b/fs/gfs2/log.h +@@ -77,6 +77,7 @@ extern void gfs2_ail1_flush(struct gfs2_sbd *sdp, struct writeback_control *wbc) + extern void gfs2_log_shutdown(struct gfs2_sbd *sdp); + extern int gfs2_logd(void *data); + extern void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd); ++extern void gfs2_glock_remove_revoke(struct gfs2_glock *gl); + extern void gfs2_write_revokes(struct gfs2_sbd *sdp); + + #endif /* __LOG_DOT_H__ */ +diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c +index 5b17979af539..e2437b775456 100644 +--- a/fs/gfs2/lops.c ++++ b/fs/gfs2/lops.c +@@ -882,10 +882,7 @@ static void revoke_lo_after_commit(struct gfs2_sbd *sdp, struct gfs2_trans *tr) + bd = list_entry(head->next, struct gfs2_bufdata, bd_list); + list_del_init(&bd->bd_list); + gl = bd->bd_gl; +- if (atomic_dec_return(&gl->gl_revokes) == 0) { +- clear_bit(GLF_LFLUSH, &gl->gl_flags); +- gfs2_glock_queue_put(gl); +- } ++ gfs2_glock_remove_revoke(gl); + kmem_cache_free(gfs2_bufdata_cachep, bd); + } + } +diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c +index 35e3059255fe..9d4227330de4 100644 +--- a/fs/gfs2/trans.c ++++ b/fs/gfs2/trans.c +@@ -262,6 +262,8 @@ void gfs2_trans_remove_revoke(struct gfs2_sbd *sdp, u64 blkno, unsigned int len) + list_del_init(&bd->bd_list); + gfs2_assert_withdraw(sdp, sdp->sd_log_num_revoke); + sdp->sd_log_num_revoke--; ++ if (bd->bd_gl) ++ gfs2_glock_remove_revoke(bd->bd_gl); + kmem_cache_free(gfs2_bufdata_cachep, bd); + tr->tr_num_revoke--; + if (--n == 0) +diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h +index 9b6336ad3266..e459b38ef33c 100644 +--- a/include/linux/mmc/card.h ++++ b/include/linux/mmc/card.h +@@ -291,6 +291,7 @@ struct mmc_card { + struct sd_switch_caps sw_caps; /* switch (CMD6) caps */ + + unsigned int sdio_funcs; /* number of SDIO functions */ ++ atomic_t sdio_funcs_probed; /* number of probed SDIO funcs */ + struct sdio_cccr cccr; /* common card info */ + struct sdio_cis cis; /* common tuple info */ + struct sdio_func *sdio_func[SDIO_MAX_FUNCS]; /* SDIO functions (devices) */ +diff --git a/include/linux/pm_qos.h b/include/linux/pm_qos.h +index ebf5ef17cc2a..24a6263c9931 100644 +--- a/include/linux/pm_qos.h ++++ b/include/linux/pm_qos.h +@@ -256,7 +256,7 @@ static inline s32 dev_pm_qos_raw_resume_latency(struct device *dev) + #endif + + #define FREQ_QOS_MIN_DEFAULT_VALUE 0 +-#define FREQ_QOS_MAX_DEFAULT_VALUE (-1) ++#define FREQ_QOS_MAX_DEFAULT_VALUE S32_MAX + + enum freq_qos_req_type { + FREQ_QOS_MIN = 1, +diff --git a/sound/hda/hdac_stream.c b/sound/hda/hdac_stream.c +index f9707fb05efe..682ed39f79b0 100644 +--- a/sound/hda/hdac_stream.c ++++ b/sound/hda/hdac_stream.c +@@ -120,10 +120,8 @@ void snd_hdac_stream_clear(struct hdac_stream *azx_dev) + snd_hdac_stream_updateb(azx_dev, SD_CTL, + SD_CTL_DMA_START | SD_INT_MASK, 0); + snd_hdac_stream_writeb(azx_dev, SD_STS, SD_INT_MASK); /* to be sure */ +- if (azx_dev->stripe) { ++ if (azx_dev->stripe) + snd_hdac_stream_updateb(azx_dev, SD_CTL_3B, SD_CTL_STRIPE_MASK, 0); +- azx_dev->stripe = 0; +- } + azx_dev->running = false; + } + EXPORT_SYMBOL_GPL(snd_hdac_stream_clear); +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 4dafc864d765..488c17c9f375 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1983,6 +1983,8 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo, + per_cvt->assigned = 0; + hinfo->nid = 0; + ++ azx_stream(get_azx_dev(substream))->stripe = 0; ++ + mutex_lock(&spec->pcm_lock); + snd_hda_spdif_ctls_unassign(codec, pcm_idx); + clear_bit(pcm_idx, &spec->pcm_in_use); diff --git a/patch/kernel/odroidxu4-current/02-patch-5.4.6-7.patch b/patch/kernel/odroidxu4-current/02-patch-5.4.6-7.patch new file mode 100644 index 0000000000..ef7367f287 --- /dev/null +++ b/patch/kernel/odroidxu4-current/02-patch-5.4.6-7.patch @@ -0,0 +1,13537 @@ +diff --git a/Makefile b/Makefile +index 20ec7c20279e..0e2e0a034064 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 6 ++SUBLEVEL = 7 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +index d1eae47b83f6..82f7ae030600 100644 +--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi ++++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +@@ -160,12 +160,12 @@ + regulator-enable-ramp-delay = <1000>; + }; + +- /* Used by DSS */ ++ /* Used by DSS and is the "zerov_regulator" trigger for SoC off mode */ + vcsi: VCSI { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-enable-ramp-delay = <1000>; +- regulator-boot-on; ++ regulator-always-on; + }; + + vdac: VDAC { +diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c +index c9f72b2665f1..43ae4e0c968f 100644 +--- a/arch/arm64/kernel/psci.c ++++ b/arch/arm64/kernel/psci.c +@@ -81,7 +81,8 @@ static void cpu_psci_cpu_die(unsigned int cpu) + + static int cpu_psci_cpu_kill(unsigned int cpu) + { +- int err, i; ++ int err; ++ unsigned long start, end; + + if (!psci_ops.affinity_info) + return 0; +@@ -91,16 +92,18 @@ static int cpu_psci_cpu_kill(unsigned int cpu) + * while it is dying. So, try again a few times. + */ + +- for (i = 0; i < 10; i++) { ++ start = jiffies; ++ end = start + msecs_to_jiffies(100); ++ do { + err = psci_ops.affinity_info(cpu_logical_map(cpu), 0); + if (err == PSCI_0_2_AFFINITY_LEVEL_OFF) { +- pr_info("CPU%d killed.\n", cpu); ++ pr_info("CPU%d killed (polled %d ms)\n", cpu, ++ jiffies_to_msecs(jiffies - start)); + return 0; + } + +- msleep(10); +- pr_info("Retrying again to check for CPU kill\n"); +- } ++ usleep_range(100, 1000); ++ } while (time_before(jiffies, end)); + + pr_warn("CPU%d may not have shut down cleanly (AFFINITY_INFO reports %d)\n", + cpu, err); +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index 46822afc57e0..01a515e0171e 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -2360,8 +2360,11 @@ static const struct sys_reg_desc *index_to_sys_reg_desc(struct kvm_vcpu *vcpu, + if ((id & KVM_REG_ARM_COPROC_MASK) != KVM_REG_ARM64_SYSREG) + return NULL; + ++ if (!index_to_params(id, ¶ms)) ++ return NULL; ++ + table = get_target_table(vcpu->arch.target, true, &num); +- r = find_reg_by_id(id, ¶ms, table, num); ++ r = find_reg(¶ms, table, num); + if (!r) + r = find_reg(¶ms, sys_reg_descs, ARRAY_SIZE(sys_reg_descs)); + +diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h +index 9228f7386220..fb842965d541 100644 +--- a/arch/mips/include/asm/barrier.h ++++ b/arch/mips/include/asm/barrier.h +@@ -218,13 +218,14 @@ + * ordering will be done by smp_llsc_mb() and friends. + */ + #if defined(CONFIG_WEAK_REORDERING_BEYOND_LLSC) && defined(CONFIG_SMP) +-#define __WEAK_LLSC_MB " sync \n" +-#define smp_llsc_mb() __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory") +-#define __LLSC_CLOBBER ++# define __WEAK_LLSC_MB sync ++# define smp_llsc_mb() \ ++ __asm__ __volatile__(__stringify(__WEAK_LLSC_MB) : : :"memory") ++# define __LLSC_CLOBBER + #else +-#define __WEAK_LLSC_MB " \n" +-#define smp_llsc_mb() do { } while (0) +-#define __LLSC_CLOBBER "memory" ++# define __WEAK_LLSC_MB ++# define smp_llsc_mb() do { } while (0) ++# define __LLSC_CLOBBER "memory" + #endif + + #ifdef CONFIG_CPU_CAVIUM_OCTEON +diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h +index b83b0397462d..110220705e97 100644 +--- a/arch/mips/include/asm/futex.h ++++ b/arch/mips/include/asm/futex.h +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + + #define __futex_atomic_op(insn, ret, oldval, uaddr, oparg) \ +@@ -32,7 +33,7 @@ + " .set arch=r4000 \n" \ + "2: sc $1, %2 \n" \ + " beqzl $1, 1b \n" \ +- __WEAK_LLSC_MB \ ++ __stringify(__WEAK_LLSC_MB) " \n" \ + "3: \n" \ + " .insn \n" \ + " .set pop \n" \ +@@ -50,19 +51,19 @@ + "i" (-EFAULT) \ + : "memory"); \ + } else if (cpu_has_llsc) { \ +- loongson_llsc_mb(); \ + __asm__ __volatile__( \ + " .set push \n" \ + " .set noat \n" \ + " .set push \n" \ + " .set "MIPS_ISA_ARCH_LEVEL" \n" \ ++ " " __SYNC(full, loongson3_war) " \n" \ + "1: "user_ll("%1", "%4")" # __futex_atomic_op\n" \ + " .set pop \n" \ + " " insn " \n" \ + " .set "MIPS_ISA_ARCH_LEVEL" \n" \ + "2: "user_sc("$1", "%2")" \n" \ + " beqz $1, 1b \n" \ +- __WEAK_LLSC_MB \ ++ __stringify(__WEAK_LLSC_MB) " \n" \ + "3: \n" \ + " .insn \n" \ + " .set pop \n" \ +@@ -147,7 +148,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + " .set arch=r4000 \n" + "2: sc $1, %2 \n" + " beqzl $1, 1b \n" +- __WEAK_LLSC_MB ++ __stringify(__WEAK_LLSC_MB) " \n" + "3: \n" + " .insn \n" + " .set pop \n" +@@ -164,13 +165,13 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + "i" (-EFAULT) + : "memory"); + } else if (cpu_has_llsc) { +- loongson_llsc_mb(); + __asm__ __volatile__( + "# futex_atomic_cmpxchg_inatomic \n" + " .set push \n" + " .set noat \n" + " .set push \n" + " .set "MIPS_ISA_ARCH_LEVEL" \n" ++ " " __SYNC(full, loongson3_war) " \n" + "1: "user_ll("%1", "%3")" \n" + " bne %1, %z4, 3f \n" + " .set pop \n" +@@ -178,8 +179,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + " .set "MIPS_ISA_ARCH_LEVEL" \n" + "2: "user_sc("$1", "%2")" \n" + " beqz $1, 1b \n" +- __WEAK_LLSC_MB +- "3: \n" ++ "3: " __SYNC_ELSE(full, loongson3_war, __WEAK_LLSC_MB) "\n" + " .insn \n" + " .set pop \n" + " .section .fixup,\"ax\" \n" +@@ -194,7 +194,6 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + : GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval), + "i" (-EFAULT) + : "memory"); +- loongson_llsc_mb(); + } else + return -ENOSYS; + +diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h +index 93a9dce31f25..813dfe5f45a5 100644 +--- a/arch/mips/include/asm/pgtable-64.h ++++ b/arch/mips/include/asm/pgtable-64.h +@@ -18,10 +18,12 @@ + #include + + #define __ARCH_USE_5LEVEL_HACK +-#if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48) ++#if CONFIG_PGTABLE_LEVELS == 2 + #include +-#elif !(defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_MIPS_VA_BITS_48)) ++#elif CONFIG_PGTABLE_LEVELS == 3 + #include ++#else ++#include + #endif + + /* +@@ -216,6 +218,9 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd) + return pgd_val(pgd); + } + ++#define pgd_phys(pgd) virt_to_phys((void *)pgd_val(pgd)) ++#define pgd_page(pgd) (pfn_to_page(pgd_phys(pgd) >> PAGE_SHIFT)) ++ + static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address) + { + return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(address); +diff --git a/arch/mips/ralink/Kconfig b/arch/mips/ralink/Kconfig +index 1434fa60f3db..94e9ce994494 100644 +--- a/arch/mips/ralink/Kconfig ++++ b/arch/mips/ralink/Kconfig +@@ -51,6 +51,7 @@ choice + select MIPS_GIC + select COMMON_CLK + select CLKSRC_MIPS_GIC ++ select HAVE_PCI if PCI_MT7621 + endchoice + + choice +diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h +index e9a960e28f3c..cac95a3f30c2 100644 +--- a/arch/powerpc/include/asm/spinlock.h ++++ b/arch/powerpc/include/asm/spinlock.h +@@ -36,10 +36,12 @@ + #endif + + #ifdef CONFIG_PPC_PSERIES ++DECLARE_STATIC_KEY_FALSE(shared_processor); ++ + #define vcpu_is_preempted vcpu_is_preempted + static inline bool vcpu_is_preempted(int cpu) + { +- if (!firmware_has_feature(FW_FEATURE_SPLPAR)) ++ if (!static_branch_unlikely(&shared_processor)) + return false; + return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1); + } +diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c +index 5645bc9cbc09..add67498c126 100644 +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -619,8 +619,6 @@ void __do_irq(struct pt_regs *regs) + + trace_irq_entry(regs); + +- check_stack_overflow(); +- + /* + * Query the platform PIC for the interrupt & ack it. + * +@@ -652,6 +650,8 @@ void do_IRQ(struct pt_regs *regs) + irqsp = hardirq_ctx[raw_smp_processor_id()]; + sirqsp = softirq_ctx[raw_smp_processor_id()]; + ++ check_stack_overflow(); ++ + /* Already there ? */ + if (unlikely(cursp == irqsp || cursp == sirqsp)) { + __do_irq(regs); +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +index 0496e66aaa56..c6fbbd29bd87 100644 +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -1117,7 +1117,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) + ld r7, VCPU_GPR(R7)(r4) + bne ret_to_ultra + +- lwz r0, VCPU_CR(r4) ++ ld r0, VCPU_CR(r4) + mtcr r0 + + ld r0, VCPU_GPR(R0)(r4) +@@ -1137,7 +1137,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) + * R3 = UV_RETURN + */ + ret_to_ultra: +- lwz r0, VCPU_CR(r4) ++ ld r0, VCPU_CR(r4) + mtcr r0 + + ld r0, VCPU_GPR(R3)(r4) +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 0a40201f315f..0c8421dd01ab 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -74,6 +74,9 @@ + #include "pseries.h" + #include "../../../../drivers/pci/pci.h" + ++DEFINE_STATIC_KEY_FALSE(shared_processor); ++EXPORT_SYMBOL_GPL(shared_processor); ++ + int CMO_PrPSP = -1; + int CMO_SecPSP = -1; + unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K); +@@ -758,6 +761,10 @@ static void __init pSeries_setup_arch(void) + + if (firmware_has_feature(FW_FEATURE_LPAR)) { + vpa_init(boot_cpuid); ++ ++ if (lppaca_shared_proc(get_lppaca())) ++ static_branch_enable(&shared_processor); ++ + ppc_md.power_save = pseries_lpar_idle; + ppc_md.enable_pmcs = pseries_lpar_enable_pmcs; + #ifdef CONFIG_PCI_IOV +diff --git a/arch/s390/crypto/sha_common.c b/arch/s390/crypto/sha_common.c +index d39e0f079217..686fe7aa192f 100644 +--- a/arch/s390/crypto/sha_common.c ++++ b/arch/s390/crypto/sha_common.c +@@ -74,14 +74,17 @@ int s390_sha_final(struct shash_desc *desc, u8 *out) + struct s390_sha_ctx *ctx = shash_desc_ctx(desc); + unsigned int bsize = crypto_shash_blocksize(desc->tfm); + u64 bits; +- unsigned int n, mbl_offset; ++ unsigned int n; ++ int mbl_offset; + + n = ctx->count % bsize; + bits = ctx->count * 8; +- mbl_offset = s390_crypto_shash_parmsize(ctx->func) / sizeof(u32); ++ mbl_offset = s390_crypto_shash_parmsize(ctx->func); + if (mbl_offset < 0) + return -EINVAL; + ++ mbl_offset = mbl_offset / sizeof(u32); ++ + /* set total msg bit length (mbl) in CPACF parmblock */ + switch (ctx->func) { + case CPACF_KLMD_SHA_1: +diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h +index bccb8f4a63e2..77606c4acd58 100644 +--- a/arch/s390/include/asm/pgalloc.h ++++ b/arch/s390/include/asm/pgalloc.h +@@ -56,7 +56,12 @@ static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION2_ENTRY_EMPTY); + return (p4d_t *) table; + } +-#define p4d_free(mm, p4d) crst_table_free(mm, (unsigned long *) p4d) ++ ++static inline void p4d_free(struct mm_struct *mm, p4d_t *p4d) ++{ ++ if (!mm_p4d_folded(mm)) ++ crst_table_free(mm, (unsigned long *) p4d); ++} + + static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + { +@@ -65,7 +70,12 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION3_ENTRY_EMPTY); + return (pud_t *) table; + } +-#define pud_free(mm, pud) crst_table_free(mm, (unsigned long *) pud) ++ ++static inline void pud_free(struct mm_struct *mm, pud_t *pud) ++{ ++ if (!mm_pud_folded(mm)) ++ crst_table_free(mm, (unsigned long *) pud); ++} + + static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + { +@@ -83,6 +93,8 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + + static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd) + { ++ if (mm_pmd_folded(mm)) ++ return; + pgtable_pmd_page_dtor(virt_to_page(pmd)); + crst_table_free(mm, (unsigned long *) pmd); + } +diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h +index 64539c221672..2dc9eb4e1acc 100644 +--- a/arch/s390/include/asm/timex.h ++++ b/arch/s390/include/asm/timex.h +@@ -10,8 +10,9 @@ + #ifndef _ASM_S390_TIMEX_H + #define _ASM_S390_TIMEX_H + +-#include ++#include + #include ++#include + + /* The value of the TOD clock for 1.1.1970. */ + #define TOD_UNIX_EPOCH 0x7d91048bca000000ULL +@@ -186,15 +187,18 @@ extern unsigned char tod_clock_base[16] __aligned(8); + /** + * get_clock_monotonic - returns current time in clock rate units + * +- * The caller must ensure that preemption is disabled. + * The clock and tod_clock_base get changed via stop_machine. +- * Therefore preemption must be disabled when calling this +- * function, otherwise the returned value is not guaranteed to +- * be monotonic. ++ * Therefore preemption must be disabled, otherwise the returned ++ * value is not guaranteed to be monotonic. + */ + static inline unsigned long long get_tod_clock_monotonic(void) + { +- return get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ unsigned long long tod; ++ ++ preempt_disable_notrace(); ++ tod = get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ preempt_enable_notrace(); ++ return tod; + } + + /** +diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c +index 7abe6ae261b4..f304802ecf7b 100644 +--- a/arch/s390/kernel/dis.c ++++ b/arch/s390/kernel/dis.c +@@ -461,10 +461,11 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr) + ptr += sprintf(ptr, "%%c%i", value); + else if (operand->flags & OPERAND_VR) + ptr += sprintf(ptr, "%%v%i", value); +- else if (operand->flags & OPERAND_PCREL) +- ptr += sprintf(ptr, "%lx", (signed int) value +- + addr); +- else if (operand->flags & OPERAND_SIGNED) ++ else if (operand->flags & OPERAND_PCREL) { ++ void *pcrel = (void *)((int)value + addr); ++ ++ ptr += sprintf(ptr, "%px", pcrel); ++ } else if (operand->flags & OPERAND_SIGNED) + ptr += sprintf(ptr, "%i", value); + else + ptr += sprintf(ptr, "%u", value); +@@ -536,7 +537,7 @@ void show_code(struct pt_regs *regs) + else + *ptr++ = ' '; + addr = regs->psw.addr + start - 32; +- ptr += sprintf(ptr, "%016lx: ", addr); ++ ptr += sprintf(ptr, "%px: ", (void *)addr); + if (start + opsize >= end) + break; + for (i = 0; i < opsize; i++) +@@ -564,7 +565,7 @@ void print_fn_code(unsigned char *code, unsigned long len) + opsize = insn_length(*code); + if (opsize > len) + break; +- ptr += sprintf(ptr, "%p: ", code); ++ ptr += sprintf(ptr, "%px: ", code); + for (i = 0; i < opsize; i++) + ptr += sprintf(ptr, "%02x", code[i]); + *ptr++ = '\t'; +diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c +index 48d48b6187c0..0eb1d1cc53a8 100644 +--- a/arch/s390/kernel/perf_cpum_cf.c ++++ b/arch/s390/kernel/perf_cpum_cf.c +@@ -199,7 +199,7 @@ static const int cpumf_generic_events_user[] = { + [PERF_COUNT_HW_BUS_CYCLES] = -1, + }; + +-static int __hw_perf_event_init(struct perf_event *event) ++static int __hw_perf_event_init(struct perf_event *event, unsigned int type) + { + struct perf_event_attr *attr = &event->attr; + struct hw_perf_event *hwc = &event->hw; +@@ -207,7 +207,7 @@ static int __hw_perf_event_init(struct perf_event *event) + int err = 0; + u64 ev; + +- switch (attr->type) { ++ switch (type) { + case PERF_TYPE_RAW: + /* Raw events are used to access counters directly, + * hence do not permit excludes */ +@@ -294,17 +294,16 @@ static int __hw_perf_event_init(struct perf_event *event) + + static int cpumf_pmu_event_init(struct perf_event *event) + { ++ unsigned int type = event->attr.type; + int err; + +- switch (event->attr.type) { +- case PERF_TYPE_HARDWARE: +- case PERF_TYPE_HW_CACHE: +- case PERF_TYPE_RAW: +- err = __hw_perf_event_init(event); +- break; +- default: ++ if (type == PERF_TYPE_HARDWARE || type == PERF_TYPE_RAW) ++ err = __hw_perf_event_init(event, type); ++ else if (event->pmu->type == type) ++ /* Registered as unknown PMU */ ++ err = __hw_perf_event_init(event, PERF_TYPE_RAW); ++ else + return -ENOENT; +- } + + if (unlikely(err) && event->destroy) + event->destroy(event); +@@ -553,7 +552,7 @@ static int __init cpumf_pmu_init(void) + return -ENODEV; + + cpumf_pmu.attr_groups = cpumf_cf_event_group(); +- rc = perf_pmu_register(&cpumf_pmu, "cpum_cf", PERF_TYPE_RAW); ++ rc = perf_pmu_register(&cpumf_pmu, "cpum_cf", -1); + if (rc) + pr_err("Registering the cpum_cf PMU failed with rc=%i\n", rc); + return rc; +diff --git a/arch/s390/kernel/perf_cpum_cf_diag.c b/arch/s390/kernel/perf_cpum_cf_diag.c +index 2654e348801a..e949ab832ed7 100644 +--- a/arch/s390/kernel/perf_cpum_cf_diag.c ++++ b/arch/s390/kernel/perf_cpum_cf_diag.c +@@ -243,13 +243,13 @@ static int cf_diag_event_init(struct perf_event *event) + int err = -ENOENT; + + debug_sprintf_event(cf_diag_dbg, 5, +- "%s event %p cpu %d config %#llx " ++ "%s event %p cpu %d config %#llx type:%u " + "sample_type %#llx cf_diag_events %d\n", __func__, +- event, event->cpu, attr->config, attr->sample_type, +- atomic_read(&cf_diag_events)); ++ event, event->cpu, attr->config, event->pmu->type, ++ attr->sample_type, atomic_read(&cf_diag_events)); + + if (event->attr.config != PERF_EVENT_CPUM_CF_DIAG || +- event->attr.type != PERF_TYPE_RAW) ++ event->attr.type != event->pmu->type) + goto out; + + /* Raw events are used to access counters directly, +@@ -693,7 +693,7 @@ static int __init cf_diag_init(void) + } + debug_register_view(cf_diag_dbg, &debug_sprintf_view); + +- rc = perf_pmu_register(&cf_diag, "cpum_cf_diag", PERF_TYPE_RAW); ++ rc = perf_pmu_register(&cf_diag, "cpum_cf_diag", -1); + if (rc) { + debug_unregister_view(cf_diag_dbg, &debug_sprintf_view); + debug_unregister(cf_diag_dbg); +diff --git a/arch/s390/kernel/perf_event.c b/arch/s390/kernel/perf_event.c +index fcb6c2e92b07..1e75cc983546 100644 +--- a/arch/s390/kernel/perf_event.c ++++ b/arch/s390/kernel/perf_event.c +@@ -224,9 +224,13 @@ void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, + struct pt_regs *regs) + { + struct unwind_state state; ++ unsigned long addr; + +- unwind_for_each_frame(&state, current, regs, 0) +- perf_callchain_store(entry, state.ip); ++ unwind_for_each_frame(&state, current, regs, 0) { ++ addr = unwind_get_return_address(&state); ++ if (!addr || perf_callchain_store(entry, addr)) ++ return; ++ } + } + + /* Perf definitions for PMU event attributes in sysfs */ +diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c +index 1864a8bb9622..59ad7997fed1 100644 +--- a/arch/s390/mm/maccess.c ++++ b/arch/s390/mm/maccess.c +@@ -70,7 +70,7 @@ void notrace s390_kernel_write(void *dst, const void *src, size_t size) + spin_unlock_irqrestore(&s390_kernel_write_lock, flags); + } + +-static int __memcpy_real(void *dest, void *src, size_t count) ++static int __no_sanitize_address __memcpy_real(void *dest, void *src, size_t count) + { + register unsigned long _dest asm("2") = (unsigned long) dest; + register unsigned long _len1 asm("3") = (unsigned long) count; +@@ -91,19 +91,23 @@ static int __memcpy_real(void *dest, void *src, size_t count) + return rc; + } + +-static unsigned long _memcpy_real(unsigned long dest, unsigned long src, +- unsigned long count) ++static unsigned long __no_sanitize_address _memcpy_real(unsigned long dest, ++ unsigned long src, ++ unsigned long count) + { + int irqs_disabled, rc; + unsigned long flags; + + if (!count) + return 0; +- flags = __arch_local_irq_stnsm(0xf8UL); ++ flags = arch_local_irq_save(); + irqs_disabled = arch_irqs_disabled_flags(flags); + if (!irqs_disabled) + trace_hardirqs_off(); ++ __arch_local_irq_stnsm(0xf8); // disable DAT + rc = __memcpy_real((void *) dest, (void *) src, (size_t) count); ++ if (flags & PSW_MASK_DAT) ++ __arch_local_irq_stosm(0x04); // enable DAT + if (!irqs_disabled) + trace_hardirqs_on(); + __arch_local_irq_ssm(flags); +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index ce88211b9c6c..c8c16b5eed6b 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1369,7 +1370,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + } + + memset(&jit, 0, sizeof(jit)); +- jit.addrs = kcalloc(fp->len + 1, sizeof(*jit.addrs), GFP_KERNEL); ++ jit.addrs = kvcalloc(fp->len + 1, sizeof(*jit.addrs), GFP_KERNEL); + if (jit.addrs == NULL) { + fp = orig_fp; + goto out; +@@ -1422,7 +1423,7 @@ skip_init_ctx: + if (!fp->is_func || extra_pass) { + bpf_prog_fill_jited_linfo(fp, jit.addrs + 1); + free_addrs: +- kfree(jit.addrs); ++ kvfree(jit.addrs); + kfree(jit_data); + fp->aux->jit_data = NULL; + } +diff --git a/arch/sh/include/cpu-sh4/cpu/sh7734.h b/arch/sh/include/cpu-sh4/cpu/sh7734.h +index 96f0246ad2f2..82b63208135a 100644 +--- a/arch/sh/include/cpu-sh4/cpu/sh7734.h ++++ b/arch/sh/include/cpu-sh4/cpu/sh7734.h +@@ -134,7 +134,7 @@ enum { + GPIO_FN_EX_WAIT1, GPIO_FN_SD1_DAT0_A, GPIO_FN_DREQ2, GPIO_FN_CAN1_TX_C, + GPIO_FN_ET0_LINK_C, GPIO_FN_ET0_ETXD5_A, + GPIO_FN_EX_WAIT0, GPIO_FN_TCLK1_B, +- GPIO_FN_RD_WR, GPIO_FN_TCLK0, ++ GPIO_FN_RD_WR, GPIO_FN_TCLK0, GPIO_FN_CAN_CLK_B, GPIO_FN_ET0_ETXD4, + GPIO_FN_EX_CS5, GPIO_FN_SD1_CMD_A, GPIO_FN_ATADIR, GPIO_FN_QSSL_B, + GPIO_FN_ET0_ETXD3_A, + GPIO_FN_EX_CS4, GPIO_FN_SD1_WP_A, GPIO_FN_ATAWR, GPIO_FN_QMI_QIO1_B, +diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h +index 0acf5ee45a21..ef5638f641f2 100644 +--- a/arch/x86/include/asm/crash.h ++++ b/arch/x86/include/asm/crash.h +@@ -2,6 +2,8 @@ + #ifndef _ASM_X86_CRASH_H + #define _ASM_X86_CRASH_H + ++struct kimage; ++ + int crash_load_segments(struct kimage *image); + int crash_copy_backup_region(struct kimage *image); + int crash_setup_memmap_entries(struct kimage *image, +diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h +index 0c47aa82e2e2..28183ee3cc42 100644 +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -156,7 +156,7 @@ extern pte_t *kmap_pte; + extern pte_t *pkmap_page_table; + + void __native_set_fixmap(enum fixed_addresses idx, pte_t pte); +-void native_set_fixmap(enum fixed_addresses idx, ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, + phys_addr_t phys, pgprot_t flags); + + #ifndef CONFIG_PARAVIRT_XXL +diff --git a/arch/x86/include/asm/syscall_wrapper.h b/arch/x86/include/asm/syscall_wrapper.h +index e046a405743d..90eb70df0b18 100644 +--- a/arch/x86/include/asm/syscall_wrapper.h ++++ b/arch/x86/include/asm/syscall_wrapper.h +@@ -48,12 +48,13 @@ + * To keep the naming coherent, re-define SYSCALL_DEFINE0 to create an alias + * named __ia32_sys_*() + */ +-#define SYSCALL_DEFINE0(sname) \ +- SYSCALL_METADATA(_##sname, 0); \ +- asmlinkage long __x64_sys_##sname(void); \ +- ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ +- SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname); \ +- asmlinkage long __x64_sys_##sname(void) ++ ++#define SYSCALL_DEFINE0(sname) \ ++ SYSCALL_METADATA(_##sname, 0); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\ ++ ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ ++ SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused) + + #define COND_SYSCALL(name) \ + cond_syscall(__x64_sys_##name); \ +@@ -181,11 +182,11 @@ + * macros to work correctly. + */ + #ifndef SYSCALL_DEFINE0 +-#define SYSCALL_DEFINE0(sname) \ +- SYSCALL_METADATA(_##sname, 0); \ +- asmlinkage long __x64_sys_##sname(void); \ +- ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ +- asmlinkage long __x64_sys_##sname(void) ++#define SYSCALL_DEFINE0(sname) \ ++ SYSCALL_METADATA(_##sname, 0); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\ ++ ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused) + #endif + + #ifndef COND_SYSCALL +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index d6af97fd170a..f0262cb5657a 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -1727,9 +1727,10 @@ static bool io_apic_level_ack_pending(struct mp_chip_data *data) + + static inline bool ioapic_irqd_mask(struct irq_data *data) + { +- /* If we are moving the irq we need to mask it */ ++ /* If we are moving the IRQ we need to mask it */ + if (unlikely(irqd_is_setaffinity_pending(data))) { +- mask_ioapic_irq(data); ++ if (!irqd_irq_masked(data)) ++ mask_ioapic_irq(data); + return true; + } + return false; +@@ -1766,7 +1767,9 @@ static inline void ioapic_irqd_unmask(struct irq_data *data, bool masked) + */ + if (!io_apic_level_ack_pending(data->chip_data)) + irq_move_masked_irq(data); +- unmask_ioapic_irq(data); ++ /* If the IRQ is masked in the core, leave it: */ ++ if (!irqd_irq_masked(data)) ++ unmask_ioapic_irq(data); + } + } + #else +diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c +index 6ea7fdc82f3c..259f3f4e2e5f 100644 +--- a/arch/x86/kernel/cpu/mce/amd.c ++++ b/arch/x86/kernel/cpu/mce/amd.c +@@ -266,10 +266,10 @@ static void smca_configure(unsigned int bank, unsigned int cpu) + smca_set_misc_banks_map(bank, cpu); + + /* Return early if this bank was already initialized. */ +- if (smca_banks[bank].hwid) ++ if (smca_banks[bank].hwid && smca_banks[bank].hwid->hwid_mcatype != 0) + return; + +- if (rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { ++ if (rdmsr_safe(MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { + pr_warn("Failed to read MCA_IPID for bank %d\n", bank); + return; + } +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index 743370ee4983..aecb15ba66cd 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -814,8 +814,8 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp, + if (quirk_no_way_out) + quirk_no_way_out(i, m, regs); + ++ m->bank = i; + if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) { +- m->bank = i; + mce_read_aux(m, i); + *msg = tmp; + return 1; +diff --git a/arch/x86/kernel/cpu/mce/therm_throt.c b/arch/x86/kernel/cpu/mce/therm_throt.c +index 6e2becf547c5..bc441d68d060 100644 +--- a/arch/x86/kernel/cpu/mce/therm_throt.c ++++ b/arch/x86/kernel/cpu/mce/therm_throt.c +@@ -188,7 +188,7 @@ static void therm_throt_process(bool new_event, int event, int level) + /* if we just entered the thermal event */ + if (new_event) { + if (event == THERMAL_THROTTLING_EVENT) +- pr_crit("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", ++ pr_warn("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", + this_cpu, + level == CORE_LEVEL ? "Core" : "Package", + state->count); +diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c +index 4cba91ec8049..606711f5ebf8 100644 +--- a/arch/x86/kernel/early-quirks.c ++++ b/arch/x86/kernel/early-quirks.c +@@ -710,6 +710,8 @@ static struct chipset early_qrk[] __initdata = { + */ + { PCI_VENDOR_ID_INTEL, 0x0f00, + PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, ++ { PCI_VENDOR_ID_INTEL, 0x3e20, ++ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, + { PCI_VENDOR_ID_INTEL, 0x3ec4, + PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, + { PCI_VENDOR_ID_BROADCOM, 0x4331, +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 53dbcca9af09..b1d5a8c94a57 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -402,7 +402,8 @@ static inline void do_cpuid_7_mask(struct kvm_cpuid_entry2 *entry, int index) + entry->edx |= F(SPEC_CTRL); + if (boot_cpu_has(X86_FEATURE_STIBP)) + entry->edx |= F(INTEL_STIBP); +- if (boot_cpu_has(X86_FEATURE_SSBD)) ++ if (boot_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) || ++ boot_cpu_has(X86_FEATURE_AMD_SSBD)) + entry->edx |= F(SPEC_CTRL_SSBD); + /* + * We emulate ARCH_CAPABILITIES in software even +@@ -759,7 +760,8 @@ static inline int __do_cpuid_func(struct kvm_cpuid_entry2 *entry, u32 function, + entry->ebx |= F(AMD_IBRS); + if (boot_cpu_has(X86_FEATURE_STIBP)) + entry->ebx |= F(AMD_STIBP); +- if (boot_cpu_has(X86_FEATURE_SSBD)) ++ if (boot_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) || ++ boot_cpu_has(X86_FEATURE_AMD_SSBD)) + entry->ebx |= F(AMD_SSBD); + if (!boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS)) + entry->ebx |= F(AMD_SSB_NO); +diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/arch/x86/lib/x86-opcode-map.txt ++++ b/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +diff --git a/arch/x86/math-emu/fpu_system.h b/arch/x86/math-emu/fpu_system.h +index f98a0c956764..9b41391867dc 100644 +--- a/arch/x86/math-emu/fpu_system.h ++++ b/arch/x86/math-emu/fpu_system.h +@@ -107,6 +107,8 @@ static inline bool seg_writable(struct desc_struct *d) + #define FPU_access_ok(y,z) if ( !access_ok(y,z) ) \ + math_abort(FPU_info,SIGSEGV) + #define FPU_abort math_abort(FPU_info, SIGSEGV) ++#define FPU_copy_from_user(to, from, n) \ ++ do { if (copy_from_user(to, from, n)) FPU_abort; } while (0) + + #undef FPU_IGNORE_CODE_SEGV + #ifdef FPU_IGNORE_CODE_SEGV +@@ -122,7 +124,7 @@ static inline bool seg_writable(struct desc_struct *d) + #define FPU_code_access_ok(z) FPU_access_ok((void __user *)FPU_EIP,z) + #endif + +-#define FPU_get_user(x,y) get_user((x),(y)) +-#define FPU_put_user(x,y) put_user((x),(y)) ++#define FPU_get_user(x,y) do { if (get_user((x),(y))) FPU_abort; } while (0) ++#define FPU_put_user(x,y) do { if (put_user((x),(y))) FPU_abort; } while (0) + + #endif +diff --git a/arch/x86/math-emu/reg_ld_str.c b/arch/x86/math-emu/reg_ld_str.c +index f3779743d15e..fe6246ff9887 100644 +--- a/arch/x86/math-emu/reg_ld_str.c ++++ b/arch/x86/math-emu/reg_ld_str.c +@@ -85,7 +85,7 @@ int FPU_load_extended(long double __user *s, int stnr) + + RE_ENTRANT_CHECK_OFF; + FPU_access_ok(s, 10); +- __copy_from_user(sti_ptr, s, 10); ++ FPU_copy_from_user(sti_ptr, s, 10); + RE_ENTRANT_CHECK_ON; + + return FPU_tagof(sti_ptr); +@@ -1126,9 +1126,9 @@ void frstor(fpu_addr_modes addr_modes, u_char __user *data_address) + /* Copy all registers in stack order. */ + RE_ENTRANT_CHECK_OFF; + FPU_access_ok(s, 80); +- __copy_from_user(register_base + offset, s, other); ++ FPU_copy_from_user(register_base + offset, s, other); + if (offset) +- __copy_from_user(register_base, s + other, offset); ++ FPU_copy_from_user(register_base, s + other, offset); + RE_ENTRANT_CHECK_ON; + + for (i = 0; i < 8; i++) { +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index 3e4b9035bb9a..7bd2c3a52297 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -643,8 +643,8 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) + fixmaps_set++; + } + +-void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys, +- pgprot_t flags) ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, ++ phys_addr_t phys, pgprot_t flags) + { + /* Sanitize 'prot' against any unsupported bits: */ + pgprot_val(flags) &= __default_kernel_pte_mask; +diff --git a/block/blk-iocost.c b/block/blk-iocost.c +index e01267f99183..27ca68621137 100644 +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -1212,7 +1212,7 @@ static enum hrtimer_restart iocg_waitq_timer_fn(struct hrtimer *timer) + return HRTIMER_NORESTART; + } + +-static void iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now, u64 cost) ++static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now, u64 cost) + { + struct ioc *ioc = iocg->ioc; + struct blkcg_gq *blkg = iocg_to_blkg(iocg); +@@ -1229,11 +1229,11 @@ static void iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now, u64 cost) + /* clear or maintain depending on the overage */ + if (time_before_eq64(vtime, now->vnow)) { + blkcg_clear_delay(blkg); +- return; ++ return false; + } + if (!atomic_read(&blkg->use_delay) && + time_before_eq64(vtime, now->vnow + vmargin)) +- return; ++ return false; + + /* use delay */ + if (cost) { +@@ -1250,10 +1250,11 @@ static void iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now, u64 cost) + oexpires = ktime_to_ns(hrtimer_get_softexpires(&iocg->delay_timer)); + if (hrtimer_is_queued(&iocg->delay_timer) && + abs(oexpires - expires) <= margin_ns / 4) +- return; ++ return true; + + hrtimer_start_range_ns(&iocg->delay_timer, ns_to_ktime(expires), + margin_ns / 4, HRTIMER_MODE_ABS); ++ return true; + } + + static enum hrtimer_restart iocg_delay_timer_fn(struct hrtimer *timer) +@@ -1739,7 +1740,9 @@ static void ioc_rqos_throttle(struct rq_qos *rqos, struct bio *bio) + */ + if (bio_issue_as_root_blkg(bio) || fatal_signal_pending(current)) { + atomic64_add(abs_cost, &iocg->abs_vdebt); +- iocg_kick_delay(iocg, &now, cost); ++ if (iocg_kick_delay(iocg, &now, cost)) ++ blkcg_schedule_throttle(rqos->q, ++ (bio->bi_opf & REQ_SWAP) == REQ_SWAP); + return; + } + +diff --git a/crypto/Kconfig b/crypto/Kconfig +index 9e524044d312..29472fb795f3 100644 +--- a/crypto/Kconfig ++++ b/crypto/Kconfig +@@ -309,6 +309,7 @@ config CRYPTO_AEGIS128 + config CRYPTO_AEGIS128_SIMD + bool "Support SIMD acceleration for AEGIS-128" + depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON) ++ depends on !ARM || CC_IS_CLANG || GCC_VERSION >= 40800 + default y + + config CRYPTO_AEGIS128_AESNI_SSE2 +diff --git a/crypto/Makefile b/crypto/Makefile +index fcb1ee679782..aa740c8492b9 100644 +--- a/crypto/Makefile ++++ b/crypto/Makefile +@@ -93,7 +93,7 @@ obj-$(CONFIG_CRYPTO_AEGIS128) += aegis128.o + aegis128-y := aegis128-core.o + + ifeq ($(ARCH),arm) +-CFLAGS_aegis128-neon-inner.o += -ffreestanding -march=armv7-a -mfloat-abi=softfp ++CFLAGS_aegis128-neon-inner.o += -ffreestanding -march=armv8-a -mfloat-abi=softfp + CFLAGS_aegis128-neon-inner.o += -mfpu=crypto-neon-fp-armv8 + aegis128-$(CONFIG_CRYPTO_AEGIS128_SIMD) += aegis128-neon.o aegis128-neon-inner.o + endif +diff --git a/crypto/asymmetric_keys/asym_tpm.c b/crypto/asymmetric_keys/asym_tpm.c +index 76d2ce3a1b5b..5154e280ada2 100644 +--- a/crypto/asymmetric_keys/asym_tpm.c ++++ b/crypto/asymmetric_keys/asym_tpm.c +@@ -486,6 +486,7 @@ static int tpm_key_encrypt(struct tpm_key *tk, + if (ret < 0) + goto error_free_tfm; + ++ ret = -ENOMEM; + req = akcipher_request_alloc(tfm, GFP_KERNEL); + if (!req) + goto error_free_tfm; +diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c +index 364b9df9d631..d7f43d4ea925 100644 +--- a/crypto/asymmetric_keys/public_key.c ++++ b/crypto/asymmetric_keys/public_key.c +@@ -184,6 +184,7 @@ static int software_key_eds_op(struct kernel_pkey_params *params, + if (IS_ERR(tfm)) + return PTR_ERR(tfm); + ++ ret = -ENOMEM; + req = akcipher_request_alloc(tfm, GFP_KERNEL); + if (!req) + goto error_free_tfm; +diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c +index 4a2cde2c536a..ce93a355bd1c 100644 +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -78,6 +78,17 @@ static const struct dmi_system_id lid_blacklst[] = { + DMI_MATCH(DMI_BIOS_VERSION, "BYT70A.YNCHENG.WIN.007"), + }, + }, ++ { ++ /* ++ * Medion Akoya E2215T, notification of the LID device only ++ * happens on close, not on open and _LID always returns closed. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "E2215T MD60198"), ++ }, ++ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN, ++ }, + {} + }; + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 28c492be0a57..74c9b3032d46 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6708,6 +6708,9 @@ void ata_host_detach(struct ata_host *host) + { + int i; + ++ /* Ensure ata_port probe has completed */ ++ async_synchronize_full(); ++ + for (i = 0; i < host->n_ports; i++) + ata_port_detach(host->ports[i]); + +diff --git a/drivers/base/firmware_loader/builtin/Makefile b/drivers/base/firmware_loader/builtin/Makefile +index 37e5ae387400..4a66888e7253 100644 +--- a/drivers/base/firmware_loader/builtin/Makefile ++++ b/drivers/base/firmware_loader/builtin/Makefile +@@ -8,7 +8,8 @@ fwdir := $(addprefix $(srctree)/,$(filter-out /%,$(fwdir)))$(filter /%,$(fwdir)) + obj-y := $(addsuffix .gen.o, $(subst $(quote),,$(CONFIG_EXTRA_FIRMWARE))) + + FWNAME = $(patsubst $(obj)/%.gen.S,%,$@) +-FWSTR = $(subst /,_,$(subst .,_,$(subst -,_,$(FWNAME)))) ++comma := , ++FWSTR = $(subst $(comma),_,$(subst /,_,$(subst .,_,$(subst -,_,$(FWNAME))))) + ASM_WORD = $(if $(CONFIG_64BIT),.quad,.long) + ASM_ALIGN = $(if $(CONFIG_64BIT),3,2) + PROGBITS = $(if $(CONFIG_ARM),%,@)progbits +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index f6f77eaa7217..ef6e251857c8 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -417,18 +417,20 @@ out_free_page: + return ret; + } + +-static int lo_discard(struct loop_device *lo, struct request *rq, loff_t pos) ++static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos, ++ int mode) + { + /* +- * We use punch hole to reclaim the free space used by the +- * image a.k.a. discard. However we do not support discard if +- * encryption is enabled, because it may give an attacker +- * useful information. ++ * We use fallocate to manipulate the space mappings used by the image ++ * a.k.a. discard/zerorange. However we do not support this if ++ * encryption is enabled, because it may give an attacker useful ++ * information. + */ + struct file *file = lo->lo_backing_file; +- int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE; + int ret; + ++ mode |= FALLOC_FL_KEEP_SIZE; ++ + if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) { + ret = -EOPNOTSUPP; + goto out; +@@ -596,9 +598,17 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq) + switch (req_op(rq)) { + case REQ_OP_FLUSH: + return lo_req_flush(lo, rq); +- case REQ_OP_DISCARD: + case REQ_OP_WRITE_ZEROES: +- return lo_discard(lo, rq, pos); ++ /* ++ * If the caller doesn't want deallocation, call zeroout to ++ * write zeroes the range. Otherwise, punch them out. ++ */ ++ return lo_fallocate(lo, rq, pos, ++ (rq->cmd_flags & REQ_NOUNMAP) ? ++ FALLOC_FL_ZERO_RANGE : ++ FALLOC_FL_PUNCH_HOLE); ++ case REQ_OP_DISCARD: ++ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE); + case REQ_OP_WRITE: + if (lo->transfer) + return lo_write_transfer(lo, rq, pos); +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 57532465fb83..b4607dd96185 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1296,10 +1296,10 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b + mutex_unlock(&nbd->config_lock); + ret = wait_event_interruptible(config->recv_wq, + atomic_read(&config->recv_threads) == 0); +- if (ret) { ++ if (ret) + sock_shutdown(nbd); +- flush_workqueue(nbd->recv_workq); +- } ++ flush_workqueue(nbd->recv_workq); ++ + mutex_lock(&nbd->config_lock); + nbd_bdev_reset(bdev); + /* user requested, ignore socket errors */ +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index a9c35ebb30f8..23e606aaaea4 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3807,8 +3807,8 @@ static int btusb_probe(struct usb_interface *intf, + btusb_check_needs_reset_resume(intf); + } + +-#ifdef CONFIG_BT_HCIBTUSB_RTL +- if (id->driver_info & BTUSB_REALTEK) { ++ if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) && ++ (id->driver_info & BTUSB_REALTEK)) { + hdev->setup = btrtl_setup_realtek; + hdev->shutdown = btrtl_shutdown_realtek; + hdev->cmd_timeout = btusb_rtl_cmd_timeout; +@@ -3819,7 +3819,6 @@ static int btusb_probe(struct usb_interface *intf, + */ + set_bit(BTUSB_WAKEUP_DISABLE, &data->flags); + } +-#endif + + if (id->driver_info & BTUSB_AMP) { + /* AMP controllers do not support SCO packets */ +diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c +index 38b719017186..648e39ce6bd9 100644 +--- a/drivers/char/hw_random/omap3-rom-rng.c ++++ b/drivers/char/hw_random/omap3-rom-rng.c +@@ -121,7 +121,8 @@ static int omap3_rom_rng_remove(struct platform_device *pdev) + { + cancel_delayed_work_sync(&idle_work); + hwrng_unregister(&omap3_rom_rng_ops); +- clk_disable_unprepare(rng_clk); ++ if (!rng_idle) ++ clk_disable_unprepare(rng_clk); + return 0; + } + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 2aab80e19ae0..3c8a559506e8 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -448,6 +448,8 @@ enum ipmi_stat_indexes { + + #define IPMI_IPMB_NUM_SEQ 64 + struct ipmi_smi { ++ struct module *owner; ++ + /* What interface number are we? */ + int intf_num; + +@@ -1220,6 +1222,11 @@ int ipmi_create_user(unsigned int if_num, + if (rv) + goto out_kfree; + ++ if (!try_module_get(intf->owner)) { ++ rv = -ENODEV; ++ goto out_kfree; ++ } ++ + /* Note that each existing user holds a refcount to the interface. */ + kref_get(&intf->refcount); + +@@ -1349,6 +1356,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user) + } + + kref_put(&intf->refcount, intf_free); ++ module_put(intf->owner); + } + + int ipmi_destroy_user(struct ipmi_user *user) +@@ -2459,7 +2467,7 @@ static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc) + * been recently fetched, this will just use the cached data. Otherwise + * it will run a new fetch. + * +- * Except for the first time this is called (in ipmi_register_smi()), ++ * Except for the first time this is called (in ipmi_add_smi()), + * this will always return good data; + */ + static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, +@@ -3377,10 +3385,11 @@ static void redo_bmc_reg(struct work_struct *work) + kref_put(&intf->refcount, intf_free); + } + +-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, +- void *send_info, +- struct device *si_dev, +- unsigned char slave_addr) ++int ipmi_add_smi(struct module *owner, ++ const struct ipmi_smi_handlers *handlers, ++ void *send_info, ++ struct device *si_dev, ++ unsigned char slave_addr) + { + int i, j; + int rv; +@@ -3406,7 +3415,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, + return rv; + } + +- ++ intf->owner = owner; + intf->bmc = &intf->tmp_bmc; + INIT_LIST_HEAD(&intf->bmc->intfs); + mutex_init(&intf->bmc->dyn_mutex); +@@ -3514,7 +3523,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, + + return rv; + } +-EXPORT_SYMBOL(ipmi_register_smi); ++EXPORT_SYMBOL(ipmi_add_smi); + + static void deliver_smi_err_response(struct ipmi_smi *intf, + struct ipmi_smi_msg *msg, +diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c +index 2ec47a69a2a6..b23b0b999232 100644 +--- a/drivers/char/tpm/tpm-dev-common.c ++++ b/drivers/char/tpm/tpm-dev-common.c +@@ -61,6 +61,12 @@ static void tpm_dev_async_work(struct work_struct *work) + + mutex_lock(&priv->buffer_mutex); + priv->command_enqueued = false; ++ ret = tpm_try_get_ops(priv->chip); ++ if (ret) { ++ priv->response_length = ret; ++ goto out; ++ } ++ + ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, + sizeof(priv->data_buffer)); + tpm_put_ops(priv->chip); +@@ -68,6 +74,7 @@ static void tpm_dev_async_work(struct work_struct *work) + priv->response_length = ret; + mod_timer(&priv->user_read_timer, jiffies + (120 * HZ)); + } ++out: + mutex_unlock(&priv->buffer_mutex); + wake_up_interruptible(&priv->async_wait); + } +@@ -204,6 +211,7 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf, + if (file->f_flags & O_NONBLOCK) { + priv->command_enqueued = true; + queue_work(tpm_dev_wq, &priv->async_work); ++ tpm_put_ops(priv->chip); + mutex_unlock(&priv->buffer_mutex); + return size; + } +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 270f43acbb77..f528fc39ea6b 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -899,13 +899,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + + if (wait_startup(chip, 0) != 0) { + rc = -ENODEV; +- goto out_err; ++ goto err_start; + } + + /* Take control of the TPM's interrupt hardware and shut it off */ + rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask); + if (rc < 0) +- goto out_err; ++ goto err_start; + + intmask |= TPM_INTF_CMD_READY_INT | TPM_INTF_LOCALITY_CHANGE_INT | + TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; +@@ -914,21 +914,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + + rc = tpm_chip_start(chip); + if (rc) +- goto out_err; ++ goto err_start; ++ + rc = tpm2_probe(chip); +- tpm_chip_stop(chip); + if (rc) +- goto out_err; ++ goto err_probe; + + rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor); + if (rc < 0) +- goto out_err; ++ goto err_probe; + + priv->manufacturer_id = vendor; + + rc = tpm_tis_read8(priv, TPM_RID(0), &rid); + if (rc < 0) +- goto out_err; ++ goto err_probe; + + dev_info(dev, "%s TPM (device-id 0x%X, rev-id %d)\n", + (chip->flags & TPM_CHIP_FLAG_TPM2) ? "2.0" : "1.2", +@@ -937,13 +937,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + probe = probe_itpm(chip); + if (probe < 0) { + rc = -ENODEV; +- goto out_err; ++ goto err_probe; + } + + /* Figure out the capabilities */ + rc = tpm_tis_read32(priv, TPM_INTF_CAPS(priv->locality), &intfcaps); + if (rc < 0) +- goto out_err; ++ goto err_probe; + + dev_dbg(dev, "TPM interface capabilities (0x%x):\n", + intfcaps); +@@ -977,10 +977,9 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + if (tpm_get_timeouts(chip)) { + dev_err(dev, "Could not get TPM timeouts and durations\n"); + rc = -ENODEV; +- goto out_err; ++ goto err_probe; + } + +- tpm_chip_start(chip); + chip->flags |= TPM_CHIP_FLAG_IRQ; + if (irq) { + tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED, +@@ -991,18 +990,20 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + } else { + tpm_tis_probe_irq(chip, intmask); + } +- tpm_chip_stop(chip); + } + ++ tpm_chip_stop(chip); ++ + rc = tpm_chip_register(chip); + if (rc) +- goto out_err; +- +- if (chip->ops->clk_enable != NULL) +- chip->ops->clk_enable(chip, false); ++ goto err_start; + + return 0; +-out_err: ++ ++err_probe: ++ tpm_chip_stop(chip); ++ ++err_start: + if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL)) + chip->ops->clk_enable(chip, false); + +diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c +index 388bdb94f841..d3486ee79ab5 100644 +--- a/drivers/clk/imx/clk-composite-8m.c ++++ b/drivers/clk/imx/clk-composite-8m.c +@@ -142,6 +142,7 @@ struct clk *imx8m_clk_composite_flags(const char *name, + mux->reg = reg; + mux->shift = PCG_PCS_SHIFT; + mux->mask = PCG_PCS_MASK; ++ mux->lock = &imx_ccm_lock; + + div = kzalloc(sizeof(*div), GFP_KERNEL); + if (!div) +@@ -161,6 +162,7 @@ struct clk *imx8m_clk_composite_flags(const char *name, + gate_hw = &gate->hw; + gate->reg = reg; + gate->bit_idx = PCG_CGC_SHIFT; ++ gate->lock = &imx_ccm_lock; + + hw = clk_hw_register_composite(NULL, name, parent_names, num_parents, + mux_hw, &clk_mux_ops, div_hw, +diff --git a/drivers/clk/imx/clk-imx7ulp.c b/drivers/clk/imx/clk-imx7ulp.c +index 2022d9bead91..a0f650150367 100644 +--- a/drivers/clk/imx/clk-imx7ulp.c ++++ b/drivers/clk/imx/clk-imx7ulp.c +@@ -40,6 +40,7 @@ static const struct clk_div_table ulp_div_table[] = { + { .val = 5, .div = 16, }, + { .val = 6, .div = 32, }, + { .val = 7, .div = 64, }, ++ { /* sentinel */ }, + }; + + static const int pcc2_uart_clk_ids[] __initconst = { +diff --git a/drivers/clk/imx/clk-pll14xx.c b/drivers/clk/imx/clk-pll14xx.c +index 7a815ec76aa5..d43b4a3c0de8 100644 +--- a/drivers/clk/imx/clk-pll14xx.c ++++ b/drivers/clk/imx/clk-pll14xx.c +@@ -153,7 +153,7 @@ static int clk_pll14xx_wait_lock(struct clk_pll14xx *pll) + { + u32 val; + +- return readl_poll_timeout(pll->base, val, val & LOCK_TIMEOUT_US, 0, ++ return readl_poll_timeout(pll->base, val, val & LOCK_STATUS, 0, + LOCK_TIMEOUT_US); + } + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index bc19d6c16aaa..a7db4f22a077 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -2634,6 +2634,13 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) + if (cpufreq_disabled()) + return -ENODEV; + ++ /* ++ * The cpufreq core depends heavily on the availability of device ++ * structure, make sure they are available before proceeding further. ++ */ ++ if (!get_cpu_device(0)) ++ return -EPROBE_DEFER; ++ + if (!driver_data || !driver_data->verify || !driver_data->init || + !(driver_data->setpolicy || driver_data->target_index || + driver_data->target) || +diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +index eca32e443716..9907a165135b 100644 +--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c ++++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +@@ -25,7 +25,7 @@ + static struct platform_device *cpufreq_dt_pdev, *sun50i_cpufreq_pdev; + + /** +- * sun50i_cpufreq_get_efuse() - Parse and return efuse value present on SoC ++ * sun50i_cpufreq_get_efuse() - Determine speed grade from efuse value + * @versions: Set to the value parsed from efuse + * + * Returns 0 if success. +@@ -69,21 +69,16 @@ static int sun50i_cpufreq_get_efuse(u32 *versions) + return PTR_ERR(speedbin); + + efuse_value = (*speedbin >> NVMEM_SHIFT) & NVMEM_MASK; +- switch (efuse_value) { +- case 0b0001: +- *versions = 1; +- break; +- case 0b0011: +- *versions = 2; +- break; +- default: +- /* +- * For other situations, we treat it as bin0. +- * This vf table can be run for any good cpu. +- */ ++ ++ /* ++ * We treat unexpected efuse values as if the SoC was from ++ * the slowest bin. Expected efuse values are 1-3, slowest ++ * to fastest. ++ */ ++ if (efuse_value >= 1 && efuse_value <= 3) ++ *versions = efuse_value - 1; ++ else + *versions = 0; +- break; +- } + + kfree(speedbin); + return 0; +diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c +index 00920a2b95ce..db99cee1991c 100644 +--- a/drivers/crypto/atmel-aes.c ++++ b/drivers/crypto/atmel-aes.c +@@ -145,7 +145,7 @@ struct atmel_aes_xts_ctx { + u32 key2[AES_KEYSIZE_256 / sizeof(u32)]; + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + struct atmel_aes_authenc_ctx { + struct atmel_aes_base_ctx base; + struct atmel_sha_authenc_ctx *auth; +@@ -157,7 +157,7 @@ struct atmel_aes_reqctx { + u32 lastc[AES_BLOCK_SIZE / sizeof(u32)]; + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + struct atmel_aes_authenc_reqctx { + struct atmel_aes_reqctx base; + +@@ -486,7 +486,7 @@ static inline bool atmel_aes_is_encrypt(const struct atmel_aes_dev *dd) + return (dd->flags & AES_FLAGS_ENCRYPT); + } + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + static void atmel_aes_authenc_complete(struct atmel_aes_dev *dd, int err); + #endif + +@@ -515,7 +515,7 @@ static void atmel_aes_set_iv_as_last_ciphertext_block(struct atmel_aes_dev *dd) + + static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err) + { +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (dd->ctx->is_aead) + atmel_aes_authenc_complete(dd, err); + #endif +@@ -1980,7 +1980,7 @@ static struct crypto_alg aes_xts_alg = { + } + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + /* authenc aead functions */ + + static int atmel_aes_authenc_start(struct atmel_aes_dev *dd); +@@ -2467,7 +2467,7 @@ static void atmel_aes_unregister_algs(struct atmel_aes_dev *dd) + { + int i; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (dd->caps.has_authenc) + for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++) + crypto_unregister_aead(&aes_authenc_algs[i]); +@@ -2514,7 +2514,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd) + goto err_aes_xts_alg; + } + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (dd->caps.has_authenc) { + for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++) { + err = crypto_register_aead(&aes_authenc_algs[i]); +@@ -2526,7 +2526,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd) + + return 0; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + /* i = ARRAY_SIZE(aes_authenc_algs); */ + err_aes_authenc_alg: + for (j = 0; j < i; j++) +@@ -2716,7 +2716,7 @@ static int atmel_aes_probe(struct platform_device *pdev) + + atmel_aes_get_cap(aes_dd); + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (aes_dd->caps.has_authenc && !atmel_sha_authenc_is_ready()) { + err = -EPROBE_DEFER; + goto iclk_unprepare; +diff --git a/drivers/crypto/atmel-authenc.h b/drivers/crypto/atmel-authenc.h +index cbd37a2edada..d6de810df44f 100644 +--- a/drivers/crypto/atmel-authenc.h ++++ b/drivers/crypto/atmel-authenc.h +@@ -12,7 +12,7 @@ + #ifndef __ATMEL_AUTHENC_H__ + #define __ATMEL_AUTHENC_H__ + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + + #include + #include +diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c +index 84cb8748a795..d32626458e67 100644 +--- a/drivers/crypto/atmel-sha.c ++++ b/drivers/crypto/atmel-sha.c +@@ -2212,7 +2212,7 @@ static struct ahash_alg sha_hmac_algs[] = { + }, + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + /* authenc functions */ + + static int atmel_sha_authenc_init2(struct atmel_sha_dev *dd); +diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c +index 294debd435b6..991a4425f006 100644 +--- a/drivers/crypto/inside-secure/safexcel.c ++++ b/drivers/crypto/inside-secure/safexcel.c +@@ -1120,6 +1120,8 @@ static int safexcel_request_ring_irq(void *pdev, int irqid, + irq_name, irq); + return irq; + } ++ } else { ++ return -ENXIO; + } + + ret = devm_request_threaded_irq(dev, irq, handler, +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +index 6536fd4bee65..7e5e092a23b3 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +@@ -72,7 +72,8 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq) + oi = 0; + oo = 0; + do { +- todo = min3(rx_cnt, ileft, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo) { + ileft -= todo; + writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo); +@@ -87,7 +88,8 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq) + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); + +- todo = min3(tx_cnt, oleft, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + oleft -= todo; + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); +@@ -239,7 +241,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * todo is the number of consecutive 4byte word that we + * can read from current SG + */ +- todo = min3(rx_cnt, ileft / 4, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft / 4); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo && !ob) { + writesl(ss->base + SS_RXFIFO, mi.addr + oi, + todo); +@@ -253,8 +256,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * we need to be able to write all buf in one + * pass, so it is why we min() with rx_cnt + */ +- todo = min3(rx_cnt * 4 - ob, ileft, +- mi.length - oi); ++ todo = min(rx_cnt * 4 - ob, ileft); ++ todo = min_t(size_t, todo, mi.length - oi); + memcpy(buf + ob, mi.addr + oi, todo); + ileft -= todo; + oi += todo; +@@ -274,7 +277,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + spaces = readl(ss->base + SS_FCSR); + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); +- dev_dbg(ss->dev, "%x %u/%u %u/%u cnt=%u %u/%u %u/%u cnt=%u %u\n", ++ dev_dbg(ss->dev, ++ "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n", + mode, + oi, mi.length, ileft, areq->cryptlen, rx_cnt, + oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob); +@@ -282,7 +286,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + if (!tx_cnt) + continue; + /* todo in 4bytes word */ +- todo = min3(tx_cnt, oleft / 4, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft / 4); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); + oleft -= todo * 4; +@@ -308,7 +313,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * no more than remaining buffer + * no need to test against oleft + */ +- todo = min(mo.length - oo, obl - obo); ++ todo = min_t(size_t, ++ mo.length - oo, obl - obo); + memcpy(mo.addr + oo, bufo + obo, todo); + oleft -= todo; + obo += todo; +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +index fcffba5ef927..1369c5fa3087 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +@@ -272,8 +272,8 @@ static int sun4i_hash(struct ahash_request *areq) + */ + while (op->len < 64 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, end - i, +- 64 - op->len); ++ in_r = min(end - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +@@ -293,8 +293,8 @@ static int sun4i_hash(struct ahash_request *areq) + } + if (mi.length - in_i > 3 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- ((mi.length - in_i) / 4) * 4); ++ in_r = min_t(size_t, mi.length - in_i, areq->nbytes - i); ++ in_r = min_t(size_t, ((mi.length - in_i) / 4) * 4, in_r); + /* how many bytes we can write in the device*/ + todo = min3((u32)(end - i) / 4, rx_cnt, (u32)in_r / 4); + writesl(ss->base + SS_RXFIFO, mi.addr + in_i, todo); +@@ -320,8 +320,8 @@ static int sun4i_hash(struct ahash_request *areq) + if ((areq->nbytes - i) < 64) { + while (i < areq->nbytes && in_i < mi.length && op->len < 64) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- 64 - op->len); ++ in_r = min(areq->nbytes - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c +index 42d19205166b..673fb29fda53 100644 +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -105,8 +105,6 @@ virtio_crypto_alg_validate_key(int key_len, uint32_t *alg) + *alg = VIRTIO_CRYPTO_CIPHER_AES_CBC; + break; + default: +- pr_err("virtio_crypto: Unsupported key length: %d\n", +- key_len); + return -EINVAL; + } + return 0; +@@ -484,6 +482,11 @@ static int virtio_crypto_ablkcipher_encrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +@@ -504,6 +507,11 @@ static int virtio_crypto_ablkcipher_decrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +diff --git a/drivers/crypto/vmx/Makefile b/drivers/crypto/vmx/Makefile +index cab32cfec9c4..709670d2b553 100644 +--- a/drivers/crypto/vmx/Makefile ++++ b/drivers/crypto/vmx/Makefile +@@ -3,13 +3,13 @@ obj-$(CONFIG_CRYPTO_DEV_VMX_ENCRYPT) += vmx-crypto.o + vmx-crypto-objs := vmx.o aesp8-ppc.o ghashp8-ppc.o aes.o aes_cbc.o aes_ctr.o aes_xts.o ghash.o + + ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) +-TARGET := linux-ppc64le ++override flavour := linux-ppc64le + else +-TARGET := linux-ppc64 ++override flavour := linux-ppc64 + endif + + quiet_cmd_perl = PERL $@ +- cmd_perl = $(PERL) $(<) $(TARGET) > $(@) ++ cmd_perl = $(PERL) $(<) $(flavour) > $(@) + + targets += aesp8-ppc.S ghashp8-ppc.S + +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index c1d4536ae466..cc5e56d752c8 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -2936,6 +2936,7 @@ static int init_csrows_df(struct mem_ctl_info *mci) + dimm->mtype = pvt->dram_type; + dimm->edac_mode = edac_mode; + dimm->dtype = dev_type; ++ dimm->grain = 64; + } + } + +@@ -3012,6 +3013,7 @@ static int init_csrows(struct mem_ctl_info *mci) + dimm = csrow->channels[j]->dimm; + dimm->mtype = pvt->dram_type; + dimm->edac_mode = edac_mode; ++ dimm->grain = 64; + } + } + +diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c +index 296e714bf553..523dd56a798c 100644 +--- a/drivers/edac/ghes_edac.c ++++ b/drivers/edac/ghes_edac.c +@@ -231,6 +231,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + /* Cleans the error report buffer */ + memset(e, 0, sizeof (*e)); + e->error_count = 1; ++ e->grain = 1; + strcpy(e->label, "unknown label"); + e->msg = pvt->msg; + e->other_detail = pvt->other_detail; +@@ -326,7 +327,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + + /* Error grain */ + if (mem_err->validation_bits & CPER_MEM_VALID_PA_MASK) +- e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK); ++ e->grain = ~mem_err->physical_addr_mask + 1; + + /* Memory error location, mapped on e->location */ + p = e->location; +@@ -442,8 +443,13 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + if (p > pvt->other_detail) + *(p - 1) = '\0'; + ++ /* Sanity-check driver-supplied grain value. */ ++ if (WARN_ON_ONCE(!e->grain)) ++ e->grain = 1; ++ ++ grain_bits = fls_long(e->grain - 1); ++ + /* Generate the trace event */ +- grain_bits = fls_long(e->grain); + snprintf(pvt->detail_location, sizeof(pvt->detail_location), + "APEI location: %s %s", e->location, e->other_detail); + trace_mc_event(type, e->msg, e->label, e->error_count, +diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c +index dc43847ad2b0..b3d93baf4fc5 100644 +--- a/drivers/extcon/extcon-sm5502.c ++++ b/drivers/extcon/extcon-sm5502.c +@@ -65,6 +65,10 @@ struct sm5502_muic_info { + /* Default value of SM5502 register to bring up MUIC device. */ + static struct reg_data sm5502_reg_data[] = { + { ++ .reg = SM5502_REG_RESET, ++ .val = SM5502_REG_RESET_MASK, ++ .invert = true, ++ }, { + .reg = SM5502_REG_CONTROL, + .val = SM5502_REG_CONTROL_MASK_INT_MASK, + .invert = false, +diff --git a/drivers/extcon/extcon-sm5502.h b/drivers/extcon/extcon-sm5502.h +index 9dbb634d213b..ce1f1ec310c4 100644 +--- a/drivers/extcon/extcon-sm5502.h ++++ b/drivers/extcon/extcon-sm5502.h +@@ -237,6 +237,8 @@ enum sm5502_reg { + #define DM_DP_SWITCH_UART ((DM_DP_CON_SWITCH_UART <name = "reserved"; ++ res->flags = IORESOURCE_MEM; ++ res->start = addr; ++ res->end = addr + size - 1; ++ ++ /* we expect a conflict with a 'System RAM' region */ ++ parent = request_resource_conflict(&iomem_resource, res); ++ return parent ? request_resource(parent, res) : 0; ++} ++ + int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + { + struct linux_efi_memreserve *rsv; +@@ -994,7 +1012,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + rsv->entry[index].size = size; + + memunmap(rsv); +- return 0; ++ return efi_mem_reserve_iomem(addr, size); + } + memunmap(rsv); + } +@@ -1004,6 +1022,12 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + if (!rsv) + return -ENOMEM; + ++ rc = efi_mem_reserve_iomem(__pa(rsv), SZ_4K); ++ if (rc) { ++ free_page((unsigned long)rsv); ++ return rc; ++ } ++ + /* + * The memremap() call above assumes that a linux_efi_memreserve entry + * never crosses a page boundary, so let's ensure that this remains true +@@ -1020,7 +1044,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + efi_memreserve_root->next = __pa(rsv); + spin_unlock(&efi_mem_reserve_persistent_lock); + +- return 0; ++ return efi_mem_reserve_iomem(addr, size); + } + + static int __init efi_memreserve_root_init(void) +diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c +index 1f76740f33b6..9282239b4d95 100644 +--- a/drivers/fsi/fsi-core.c ++++ b/drivers/fsi/fsi-core.c +@@ -544,6 +544,31 @@ static int fsi_slave_scan(struct fsi_slave *slave) + return 0; + } + ++static unsigned long aligned_access_size(size_t offset, size_t count) ++{ ++ unsigned long offset_unit, count_unit; ++ ++ /* Criteria: ++ * ++ * 1. Access size must be less than or equal to the maximum access ++ * width or the highest power-of-two factor of offset ++ * 2. Access size must be less than or equal to the amount specified by ++ * count ++ * ++ * The access width is optimal if we can calculate 1 to be strictly ++ * equal while still satisfying 2. ++ */ ++ ++ /* Find 1 by the bottom bit of offset (with a 4 byte access cap) */ ++ offset_unit = BIT(__builtin_ctzl(offset | 4)); ++ ++ /* Find 2 by the top bit of count */ ++ count_unit = BIT(8 * sizeof(unsigned long) - 1 - __builtin_clzl(count)); ++ ++ /* Constrain the maximum access width to the minimum of both criteria */ ++ return BIT(__builtin_ctzl(offset_unit | count_unit)); ++} ++ + static ssize_t fsi_slave_sysfs_raw_read(struct file *file, + struct kobject *kobj, struct bin_attribute *attr, char *buf, + loff_t off, size_t count) +@@ -559,8 +584,7 @@ static ssize_t fsi_slave_sysfs_raw_read(struct file *file, + return -EINVAL; + + for (total_len = 0; total_len < count; total_len += read_len) { +- read_len = min_t(size_t, count, 4); +- read_len -= off & 0x3; ++ read_len = aligned_access_size(off, count - total_len); + + rc = fsi_slave_read(slave, off, buf + total_len, read_len); + if (rc) +@@ -587,8 +611,7 @@ static ssize_t fsi_slave_sysfs_raw_write(struct file *file, + return -EINVAL; + + for (total_len = 0; total_len < count; total_len += write_len) { +- write_len = min_t(size_t, count, 4); +- write_len -= off & 0x3; ++ write_len = aligned_access_size(off, count - total_len); + + rc = fsi_slave_write(slave, off, buf + total_len, write_len); + if (rc) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index 5652cc72ed3a..81842ba8cd75 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -859,6 +859,9 @@ static int amdgpu_debugfs_test_ib(struct seq_file *m, void *data) + struct amdgpu_device *adev = dev->dev_private; + int r = 0, i; + ++ /* Avoid accidently unparking the sched thread during GPU reset */ ++ mutex_lock(&adev->lock_reset); ++ + /* hold on the scheduler */ + for (i = 0; i < AMDGPU_MAX_RINGS; i++) { + struct amdgpu_ring *ring = adev->rings[i]; +@@ -884,6 +887,8 @@ static int amdgpu_debugfs_test_ib(struct seq_file *m, void *data) + kthread_unpark(ring->sched.thread); + } + ++ mutex_unlock(&adev->lock_reset); ++ + return 0; + } + +@@ -1036,6 +1041,9 @@ static int amdgpu_debugfs_ib_preempt(void *data, u64 val) + if (!fences) + return -ENOMEM; + ++ /* Avoid accidently unparking the sched thread during GPU reset */ ++ mutex_lock(&adev->lock_reset); ++ + /* stop the scheduler */ + kthread_park(ring->sched.thread); + +@@ -1075,6 +1083,8 @@ failure: + /* restart the scheduler */ + kthread_unpark(ring->sched.thread); + ++ mutex_unlock(&adev->lock_reset); ++ + ttm_bo_unlock_delayed_workqueue(&adev->mman.bdev, resched); + + if (fences) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +index b66d29d5ffa2..b158230af8db 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +@@ -138,6 +138,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(vram_obj, &vram_map); + if (r) { +@@ -183,6 +184,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(gtt_obj[i], >t_map); + if (r) { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h +index 77674a7b9616..91899d28fa72 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h +@@ -170,7 +170,7 @@ TRACE_EVENT(amdgpu_cs_ioctl, + __field(unsigned int, context) + __field(unsigned int, seqno) + __field(struct dma_fence *, fence) +- __field(char *, ring_name) ++ __string(ring, to_amdgpu_ring(job->base.sched)->name) + __field(u32, num_ibs) + ), + +@@ -179,12 +179,12 @@ TRACE_EVENT(amdgpu_cs_ioctl, + __assign_str(timeline, AMDGPU_JOB_GET_TIMELINE_NAME(job)) + __entry->context = job->base.s_fence->finished.context; + __entry->seqno = job->base.s_fence->finished.seqno; +- __entry->ring_name = to_amdgpu_ring(job->base.sched)->name; ++ __assign_str(ring, to_amdgpu_ring(job->base.sched)->name) + __entry->num_ibs = job->num_ibs; + ), + TP_printk("sched_job=%llu, timeline=%s, context=%u, seqno=%u, ring_name=%s, num_ibs=%u", + __entry->sched_job_id, __get_str(timeline), __entry->context, +- __entry->seqno, __entry->ring_name, __entry->num_ibs) ++ __entry->seqno, __get_str(ring), __entry->num_ibs) + ); + + TRACE_EVENT(amdgpu_sched_run_job, +@@ -195,7 +195,7 @@ TRACE_EVENT(amdgpu_sched_run_job, + __string(timeline, AMDGPU_JOB_GET_TIMELINE_NAME(job)) + __field(unsigned int, context) + __field(unsigned int, seqno) +- __field(char *, ring_name) ++ __string(ring, to_amdgpu_ring(job->base.sched)->name) + __field(u32, num_ibs) + ), + +@@ -204,12 +204,12 @@ TRACE_EVENT(amdgpu_sched_run_job, + __assign_str(timeline, AMDGPU_JOB_GET_TIMELINE_NAME(job)) + __entry->context = job->base.s_fence->finished.context; + __entry->seqno = job->base.s_fence->finished.seqno; +- __entry->ring_name = to_amdgpu_ring(job->base.sched)->name; ++ __assign_str(ring, to_amdgpu_ring(job->base.sched)->name) + __entry->num_ibs = job->num_ibs; + ), + TP_printk("sched_job=%llu, timeline=%s, context=%u, seqno=%u, ring_name=%s, num_ibs=%u", + __entry->sched_job_id, __get_str(timeline), __entry->context, +- __entry->seqno, __entry->ring_name, __entry->num_ibs) ++ __entry->seqno, __get_str(ring), __entry->num_ibs) + ); + + +@@ -468,7 +468,7 @@ TRACE_EVENT(amdgpu_ib_pipe_sync, + TP_PROTO(struct amdgpu_job *sched_job, struct dma_fence *fence), + TP_ARGS(sched_job, fence), + TP_STRUCT__entry( +- __field(const char *,name) ++ __string(ring, sched_job->base.sched->name); + __field(uint64_t, id) + __field(struct dma_fence *, fence) + __field(uint64_t, ctx) +@@ -476,14 +476,14 @@ TRACE_EVENT(amdgpu_ib_pipe_sync, + ), + + TP_fast_assign( +- __entry->name = sched_job->base.sched->name; ++ __assign_str(ring, sched_job->base.sched->name) + __entry->id = sched_job->base.id; + __entry->fence = fence; + __entry->ctx = fence->context; + __entry->seqno = fence->seqno; + ), + TP_printk("job ring=%s, id=%llu, need pipe sync to fence=%p, context=%llu, seq=%u", +- __entry->name, __entry->id, ++ __get_str(ring), __entry->id, + __entry->fence, __entry->ctx, + __entry->seqno) + ); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 5251352f5922..c7514f743409 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -1034,10 +1034,8 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + id->oa_base != job->oa_base || + id->oa_size != job->oa_size); + bool vm_flush_needed = job->vm_needs_flush; +- bool pasid_mapping_needed = id->pasid != job->pasid || +- !id->pasid_mapping || +- !dma_fence_is_signaled(id->pasid_mapping); + struct dma_fence *fence = NULL; ++ bool pasid_mapping_needed = false; + unsigned patch_offset = 0; + int r; + +@@ -1047,6 +1045,12 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + pasid_mapping_needed = true; + } + ++ mutex_lock(&id_mgr->lock); ++ if (id->pasid != job->pasid || !id->pasid_mapping || ++ !dma_fence_is_signaled(id->pasid_mapping)) ++ pasid_mapping_needed = true; ++ mutex_unlock(&id_mgr->lock); ++ + gds_switch_needed &= !!ring->funcs->emit_gds_switch; + vm_flush_needed &= !!ring->funcs->emit_vm_flush && + job->vm_pd_addr != AMDGPU_BO_INVALID_OFFSET; +@@ -1086,9 +1090,11 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + } + + if (pasid_mapping_needed) { ++ mutex_lock(&id_mgr->lock); + id->pasid = job->pasid; + dma_fence_put(id->pasid_mapping); + id->pasid_mapping = dma_fence_get(fence); ++ mutex_unlock(&id_mgr->lock); + } + dma_fence_put(fence); + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 97cf0b536873..c9ba2ec6d038 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -2930,7 +2930,8 @@ static void gfx_v9_0_init_pg(struct amdgpu_device *adev) + * And it's needed by gfxoff feature. + */ + if (adev->gfx.rlc.is_rlc_v2_1) { +- gfx_v9_1_init_rlc_save_restore_list(adev); ++ if (adev->asic_type == CHIP_VEGA12) ++ gfx_v9_1_init_rlc_save_restore_list(adev); + gfx_v9_0_enable_save_restore_machine(adev); + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c +index 10166104b8a3..d483684db95b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c +@@ -398,6 +398,34 @@ static bool psp_v11_0_support_vmr_ring(struct psp_context *psp) + return false; + } + ++static int psp_v11_0_ring_stop(struct psp_context *psp, ++ enum psp_ring_type ring_type) ++{ ++ int ret = 0; ++ struct amdgpu_device *adev = psp->adev; ++ ++ /* Write the ring destroy command*/ ++ if (psp_v11_0_support_vmr_ring(psp)) ++ WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101, ++ GFX_CTRL_CMD_ID_DESTROY_GPCOM_RING); ++ else ++ WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_64, ++ GFX_CTRL_CMD_ID_DESTROY_RINGS); ++ ++ /* there might be handshake issue with hardware which needs delay */ ++ mdelay(20); ++ ++ /* Wait for response flag (bit 31) */ ++ if (psp_v11_0_support_vmr_ring(psp)) ++ ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_101), ++ 0x80000000, 0x80000000, false); ++ else ++ ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_64), ++ 0x80000000, 0x80000000, false); ++ ++ return ret; ++} ++ + static int psp_v11_0_ring_create(struct psp_context *psp, + enum psp_ring_type ring_type) + { +@@ -407,6 +435,12 @@ static int psp_v11_0_ring_create(struct psp_context *psp, + struct amdgpu_device *adev = psp->adev; + + if (psp_v11_0_support_vmr_ring(psp)) { ++ ret = psp_v11_0_ring_stop(psp, ring_type); ++ if (ret) { ++ DRM_ERROR("psp_v11_0_ring_stop_sriov failed!\n"); ++ return ret; ++ } ++ + /* Write low address of the ring to C2PMSG_102 */ + psp_ring_reg = lower_32_bits(ring->ring_mem_mc_addr); + WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102, psp_ring_reg); +@@ -451,33 +485,6 @@ static int psp_v11_0_ring_create(struct psp_context *psp, + return ret; + } + +-static int psp_v11_0_ring_stop(struct psp_context *psp, +- enum psp_ring_type ring_type) +-{ +- int ret = 0; +- struct amdgpu_device *adev = psp->adev; +- +- /* Write the ring destroy command*/ +- if (psp_v11_0_support_vmr_ring(psp)) +- WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101, +- GFX_CTRL_CMD_ID_DESTROY_GPCOM_RING); +- else +- WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_64, +- GFX_CTRL_CMD_ID_DESTROY_RINGS); +- +- /* there might be handshake issue with hardware which needs delay */ +- mdelay(20); +- +- /* Wait for response flag (bit 31) */ +- if (psp_v11_0_support_vmr_ring(psp)) +- ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_101), +- 0x80000000, 0x80000000, false); +- else +- ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_64), +- 0x80000000, 0x80000000, false); +- +- return ret; +-} + + static int psp_v11_0_ring_destroy(struct psp_context *psp, + enum psp_ring_type ring_type) +diff --git a/drivers/gpu/drm/amd/amdgpu/si_ih.c b/drivers/gpu/drm/amd/amdgpu/si_ih.c +index 57bb5f9e08b2..88ae27a5a03d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_ih.c +@@ -64,7 +64,8 @@ static int si_ih_irq_init(struct amdgpu_device *adev) + u32 interrupt_cntl, ih_cntl, ih_rb_cntl; + + si_ih_disable_interrupts(adev); +- WREG32(INTERRUPT_CNTL2, adev->irq.ih.gpu_addr >> 8); ++ /* set dummy read address to dummy page address */ ++ WREG32(INTERRUPT_CNTL2, adev->dummy_page_addr >> 8); + interrupt_cntl = RREG32(INTERRUPT_CNTL); + interrupt_cntl &= ~IH_DUMMY_RD_OVERRIDE; + interrupt_cntl &= ~IH_REQ_NONSNOOP_EN; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +index d985e31fcc1e..f335f73919d1 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -1676,7 +1676,8 @@ static int allocate_hiq_sdma_mqd(struct device_queue_manager *dqm) + struct kfd_dev *dev = dqm->dev; + struct kfd_mem_obj *mem_obj = &dqm->hiq_sdma_mqd; + uint32_t size = dqm->mqd_mgrs[KFD_MQD_TYPE_SDMA]->mqd_size * +- dev->device_info->num_sdma_engines * ++ (dev->device_info->num_sdma_engines + ++ dev->device_info->num_xgmi_sdma_engines) * + dev->device_info->num_sdma_queues_per_engine + + dqm->mqd_mgrs[KFD_MQD_TYPE_HIQ]->mqd_size; + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c +index c56ac47cd318..bc47f6a44456 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c +@@ -62,6 +62,11 @@ int kfd_interrupt_init(struct kfd_dev *kfd) + } + + kfd->ih_wq = alloc_workqueue("KFD IH", WQ_HIGHPRI, 1); ++ if (unlikely(!kfd->ih_wq)) { ++ kfifo_free(&kfd->ih_fifo); ++ dev_err(kfd_chardev(), "Failed to allocate KFD IH workqueue\n"); ++ return -ENOMEM; ++ } + spin_lock_init(&kfd->interrupt_lock); + + INIT_WORK(&kfd->interrupt_work, interrupt_wq); +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 4139f129eafb..4e9c15c409ba 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -940,6 +940,11 @@ static int dm_late_init(void *handle) + params.backlight_lut_array_size = 16; + params.backlight_lut_array = linear_lut; + ++ /* Min backlight level after ABM reduction, Don't allow below 1% ++ * 0xFFFF x 0.01 = 0x28F ++ */ ++ params.min_abm_backlight = 0x28F; ++ + /* todo will enable for navi10 */ + if (adev->asic_type <= CHIP_RAVEN) { + ret = dmcu_load_iram(dmcu, params); +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c +index 3e8ac303bd52..23ec283eb07b 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c +@@ -320,6 +320,8 @@ void dcn2_update_clocks_fpga(struct clk_mgr *clk_mgr, + struct dc_state *context, + bool safe_to_lower) + { ++ struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr); ++ + struct dc_clocks *new_clocks = &context->bw_ctx.bw.dcn.clk; + /* Min fclk = 1.2GHz since all the extra scemi logic seems to run off of it */ + int fclk_adj = new_clocks->fclk_khz > 1200000 ? new_clocks->fclk_khz : 1200000; +@@ -357,14 +359,18 @@ void dcn2_update_clocks_fpga(struct clk_mgr *clk_mgr, + clk_mgr->clks.dispclk_khz = new_clocks->dispclk_khz; + } + +- /* Both fclk and dppclk ref are run on the same scemi clock so we +- * need to keep the same value for both ++ /* Both fclk and ref_dppclk run on the same scemi clock. ++ * So take the higher value since the DPP DTO is typically programmed ++ * such that max dppclk is 1:1 with ref_dppclk. + */ + if (clk_mgr->clks.fclk_khz > clk_mgr->clks.dppclk_khz) + clk_mgr->clks.dppclk_khz = clk_mgr->clks.fclk_khz; + if (clk_mgr->clks.dppclk_khz > clk_mgr->clks.fclk_khz) + clk_mgr->clks.fclk_khz = clk_mgr->clks.dppclk_khz; + ++ // Both fclk and ref_dppclk run on the same scemi clock. ++ clk_mgr_int->dccg->ref_dppclk = clk_mgr->clks.fclk_khz; ++ + dm_set_dcn_clocks(clk_mgr->ctx, &clk_mgr->clks); + } + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c +index 50984c1811bb..468c6bb0e311 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c +@@ -33,7 +33,7 @@ + #include "mp/mp_12_0_0_sh_mask.h" + + #define REG(reg_name) \ +- (MP1_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name) ++ (MP0_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name) + + #define FN(reg_name, field) \ + FD(reg_name##__##field) +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index ca20b150afcc..067f5579f452 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -2169,8 +2169,10 @@ static void disable_link(struct dc_link *link, enum signal_type signal) + dp_set_fec_ready(link, false); + } + #endif +- } else +- link->link_enc->funcs->disable_output(link->link_enc, signal); ++ } else { ++ if (signal != SIGNAL_TYPE_VIRTUAL) ++ link->link_enc->funcs->disable_output(link->link_enc, signal); ++ } + + if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST) { + /* MST disable link only when no stream use the link */ +@@ -2217,7 +2219,7 @@ static bool dp_active_dongle_validate_timing( + break; + } + +- if (dongle_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER || ++ if (dpcd_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER || + dongle_caps->extendedCapValid == false) + return true; + +@@ -2767,6 +2769,15 @@ void core_link_enable_stream( + CONTROLLER_DP_TEST_PATTERN_VIDEOMODE, + COLOR_DEPTH_UNDEFINED); + ++ /* This second call is needed to reconfigure the DIG ++ * as a workaround for the incorrect value being applied ++ * from transmitter control. ++ */ ++ if (!dc_is_virtual_signal(pipe_ctx->stream->signal)) ++ stream->link->link_enc->funcs->setup( ++ stream->link->link_enc, ++ pipe_ctx->stream->signal); ++ + #ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT + if (pipe_ctx->stream->timing.flags.DSC) { + if (dc_is_dp_signal(pipe_ctx->stream->signal) || +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index f5742719b5d9..5a583707d198 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -2545,6 +2545,7 @@ static void get_active_converter_info( + uint8_t data, struct dc_link *link) + { + union dp_downstream_port_present ds_port = { .byte = data }; ++ memset(&link->dpcd_caps.dongle_caps, 0, sizeof(link->dpcd_caps.dongle_caps)); + + /* decode converter info*/ + if (!ds_port.fields.PORT_PRESENT) { +@@ -2691,6 +2692,7 @@ static void dp_wa_power_up_0010FA(struct dc_link *link, uint8_t *dpcd_data, + * keep receiver powered all the time.*/ + case DP_BRANCH_DEVICE_ID_0010FA: + case DP_BRANCH_DEVICE_ID_0080E1: ++ case DP_BRANCH_DEVICE_ID_00E04C: + link->wa_flags.dp_keep_receiver_powered = true; + break; + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c +index 79438c4f1e20..a519dbc5ecb6 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c +@@ -277,7 +277,8 @@ void dp_retrain_link_dp_test(struct dc_link *link, + if (pipes[i].stream != NULL && + !pipes[i].top_pipe && !pipes[i].prev_odm_pipe && + pipes[i].stream->link != NULL && +- pipes[i].stream_res.stream_enc != NULL) { ++ pipes[i].stream_res.stream_enc != NULL && ++ pipes[i].stream->link == link) { + udelay(100); + + pipes[i].stream_res.stream_enc->funcs->dp_blank( +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +index bf1d7bb90e0f..bb09243758fe 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +@@ -423,10 +423,10 @@ bool dc_stream_add_writeback(struct dc *dc, + + if (dwb->funcs->is_enabled(dwb)) { + /* writeback pipe already enabled, only need to update */ +- dc->hwss.update_writeback(dc, stream_status, wb_info); ++ dc->hwss.update_writeback(dc, stream_status, wb_info, dc->current_state); + } else { + /* Enable writeback pipe from scratch*/ +- dc->hwss.enable_writeback(dc, stream_status, wb_info); ++ dc->hwss.enable_writeback(dc, stream_status, wb_info, dc->current_state); + } + } + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c +index 58bd131d5b48..7700a855d77c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c +@@ -77,6 +77,9 @@ static bool dce_abm_set_pipe(struct abm *abm, uint32_t controller_id) + /* notifyDMCUMsg */ + REG_UPDATE(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 1); + ++ REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 0, ++ 1, 80000); ++ + return true; + } + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +index b3ae1c41fc69..937a8ba81160 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +@@ -1356,7 +1356,8 @@ bool dcn20_update_bandwidth( + static void dcn20_enable_writeback( + struct dc *dc, + const struct dc_stream_status *stream_status, +- struct dc_writeback_info *wb_info) ++ struct dc_writeback_info *wb_info, ++ struct dc_state *context) + { + struct dwbc *dwb; + struct mcif_wb *mcif_wb; +@@ -1373,7 +1374,7 @@ static void dcn20_enable_writeback( + optc->funcs->set_dwb_source(optc, wb_info->dwb_pipe_inst); + /* set MCIF_WB buffer and arbitration configuration */ + mcif_wb->funcs->config_mcif_buf(mcif_wb, &wb_info->mcif_buf_params, wb_info->dwb_params.dest_height); +- mcif_wb->funcs->config_mcif_arb(mcif_wb, &dc->current_state->bw_ctx.bw.dcn.bw_writeback.mcif_wb_arb[wb_info->dwb_pipe_inst]); ++ mcif_wb->funcs->config_mcif_arb(mcif_wb, &context->bw_ctx.bw.dcn.bw_writeback.mcif_wb_arb[wb_info->dwb_pipe_inst]); + /* Enable MCIF_WB */ + mcif_wb->funcs->enable_mcif(mcif_wb); + /* Enable DWB */ +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c +index 2137e2be2140..dda90995ba93 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c +@@ -287,6 +287,10 @@ void optc2_get_optc_source(struct timing_generator *optc, + *num_of_src_opp = 2; + else + *num_of_src_opp = 1; ++ ++ /* Work around VBIOS not updating OPTC_NUM_OF_INPUT_SEGMENT */ ++ if (*src_opp_id_1 == 0xf) ++ *num_of_src_opp = 1; + } + + void optc2_set_dwb_source(struct timing_generator *optc, +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index 6b2f2f1a1c9c..78b2cc2e122f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -1765,7 +1765,7 @@ int dcn20_populate_dml_pipes_from_context( + pipe_cnt = i; + continue; + } +- if (!resource_are_streams_timing_synchronizable( ++ if (dc->debug.disable_timing_sync || !resource_are_streams_timing_synchronizable( + res_ctx->pipe_ctx[pipe_cnt].stream, + res_ctx->pipe_ctx[i].stream)) { + synchronized_vblank = false; +@@ -2474,6 +2474,7 @@ bool dcn20_fast_validate_bw( + &context->res_ctx, dc->res_pool, + pipe, hsplit_pipe)) + goto validate_fail; ++ dcn20_build_mapped_resource(dc, context, pipe->stream); + } else + dcn20_split_stream_for_mpc( + &context->res_ctx, dc->res_pool, +@@ -3040,7 +3041,7 @@ static void cap_soc_clocks( + static void update_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_st *bb, + struct pp_smu_nv_clock_table *max_clocks, unsigned int *uclk_states, unsigned int num_states) + { +- struct _vcs_dpi_voltage_scaling_st calculated_states[MAX_CLOCK_LIMIT_STATES] = {0}; ++ struct _vcs_dpi_voltage_scaling_st calculated_states[MAX_CLOCK_LIMIT_STATES]; + int i; + int num_calculated_states = 0; + int min_dcfclk = 0; +@@ -3048,6 +3049,8 @@ static void update_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_ + if (num_states == 0) + return; + ++ memset(calculated_states, 0, sizeof(calculated_states)); ++ + if (dc->bb_overrides.min_dcfclk_mhz > 0) + min_dcfclk = dc->bb_overrides.min_dcfclk_mhz; + else +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c +index d1266741763b..f5f6b4a0f0aa 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c +@@ -22,6 +22,7 @@ + * Authors: AMD + * + */ ++#include + #include "dm_services.h" + #include "dcn20/dcn20_hubbub.h" + #include "dcn21_hubbub.h" +@@ -71,30 +72,39 @@ static uint32_t convert_and_clamp( + void dcn21_dchvm_init(struct hubbub *hubbub) + { + struct dcn20_hubbub *hubbub1 = TO_DCN20_HUBBUB(hubbub); ++ uint32_t riommu_active; ++ int i; + + //Init DCHVM block + REG_UPDATE(DCHVM_CTRL0, HOSTVM_INIT_REQ, 1); + + //Poll until RIOMMU_ACTIVE = 1 +- //TODO: Figure out interval us and retry count +- REG_WAIT(DCHVM_RIOMMU_STAT0, RIOMMU_ACTIVE, 1, 5, 100); ++ for (i = 0; i < 100; i++) { ++ REG_GET(DCHVM_RIOMMU_STAT0, RIOMMU_ACTIVE, &riommu_active); + +- //Reflect the power status of DCHUBBUB +- REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_POWERSTATUS, 1); ++ if (riommu_active) ++ break; ++ else ++ udelay(5); ++ } ++ ++ if (riommu_active) { ++ //Reflect the power status of DCHUBBUB ++ REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_POWERSTATUS, 1); + +- //Start rIOMMU prefetching +- REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_PREFETCH_REQ, 1); ++ //Start rIOMMU prefetching ++ REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_PREFETCH_REQ, 1); + +- // Enable dynamic clock gating +- REG_UPDATE_4(DCHVM_CLK_CTRL, +- HVM_DISPCLK_R_GATE_DIS, 0, +- HVM_DISPCLK_G_GATE_DIS, 0, +- HVM_DCFCLK_R_GATE_DIS, 0, +- HVM_DCFCLK_G_GATE_DIS, 0); ++ // Enable dynamic clock gating ++ REG_UPDATE_4(DCHVM_CLK_CTRL, ++ HVM_DISPCLK_R_GATE_DIS, 0, ++ HVM_DISPCLK_G_GATE_DIS, 0, ++ HVM_DCFCLK_R_GATE_DIS, 0, ++ HVM_DCFCLK_G_GATE_DIS, 0); + +- //Poll until HOSTVM_PREFETCH_DONE = 1 +- //TODO: Figure out interval us and retry count +- REG_WAIT(DCHVM_RIOMMU_STAT0, HOSTVM_PREFETCH_DONE, 1, 5, 100); ++ //Poll until HOSTVM_PREFETCH_DONE = 1 ++ REG_WAIT(DCHVM_RIOMMU_STAT0, HOSTVM_PREFETCH_DONE, 1, 5, 100); ++ } + } + + static int hubbub21_init_dchub(struct hubbub *hubbub, +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h +index 3a938cd414ea..f6cc2d6f576d 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h +@@ -321,10 +321,12 @@ struct hw_sequencer_funcs { + struct dc_state *context); + void (*update_writeback)(struct dc *dc, + const struct dc_stream_status *stream_status, +- struct dc_writeback_info *wb_info); ++ struct dc_writeback_info *wb_info, ++ struct dc_state *context); + void (*enable_writeback)(struct dc *dc, + const struct dc_stream_status *stream_status, +- struct dc_writeback_info *wb_info); ++ struct dc_writeback_info *wb_info, ++ struct dc_state *context); + void (*disable_writeback)(struct dc *dc, + unsigned int dwb_pipe_inst); + #endif +diff --git a/drivers/gpu/drm/amd/display/include/ddc_service_types.h b/drivers/gpu/drm/amd/display/include/ddc_service_types.h +index 18961707db23..9ad49da50a17 100644 +--- a/drivers/gpu/drm/amd/display/include/ddc_service_types.h ++++ b/drivers/gpu/drm/amd/display/include/ddc_service_types.h +@@ -31,6 +31,8 @@ + #define DP_BRANCH_DEVICE_ID_0022B9 0x0022B9 + #define DP_BRANCH_DEVICE_ID_00001A 0x00001A + #define DP_BRANCH_DEVICE_ID_0080E1 0x0080e1 ++#define DP_BRANCH_DEVICE_ID_90CC24 0x90CC24 ++#define DP_BRANCH_DEVICE_ID_00E04C 0x00E04C + + enum ddc_result { + DDC_RESULT_UNKNOWN = 0, +diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c +index ec70c9b12e1a..0978c698f0f8 100644 +--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c ++++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c +@@ -743,6 +743,10 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync, + nominal_field_rate_in_uhz = + mod_freesync_calc_nominal_field_rate(stream); + ++ /* Rounded to the nearest Hz */ ++ nominal_field_rate_in_uhz = 1000000ULL * ++ div_u64(nominal_field_rate_in_uhz + 500000, 1000000); ++ + min_refresh_in_uhz = in_config->min_refresh_in_uhz; + max_refresh_in_uhz = in_config->max_refresh_in_uhz; + +@@ -996,14 +1000,13 @@ unsigned long long mod_freesync_calc_nominal_field_rate( + const struct dc_stream_state *stream) + { + unsigned long long nominal_field_rate_in_uhz = 0; ++ unsigned int total = stream->timing.h_total * stream->timing.v_total; + +- /* Calculate nominal field rate for stream */ ++ /* Calculate nominal field rate for stream, rounded up to nearest integer */ + nominal_field_rate_in_uhz = stream->timing.pix_clk_100hz / 10; + nominal_field_rate_in_uhz *= 1000ULL * 1000ULL * 1000ULL; +- nominal_field_rate_in_uhz = div_u64(nominal_field_rate_in_uhz, +- stream->timing.h_total); +- nominal_field_rate_in_uhz = div_u64(nominal_field_rate_in_uhz, +- stream->timing.v_total); ++ ++ nominal_field_rate_in_uhz = div_u64(nominal_field_rate_in_uhz, total); + + return nominal_field_rate_in_uhz; + } +diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c +index 05e2be856037..ba1aafe40512 100644 +--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c ++++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c +@@ -115,7 +115,7 @@ static const struct abm_parameters * const abm_settings[] = { + /* NOTE: iRAM is 256B in size */ + struct iram_table_v_2 { + /* flags */ +- uint16_t flags; /* 0x00 U16 */ ++ uint16_t min_abm_backlight; /* 0x00 U16 */ + + /* parameters for ABM2.0 algorithm */ + uint8_t min_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; /* 0x02 U0.8 */ +@@ -140,10 +140,10 @@ struct iram_table_v_2 { + + /* For reading PSR State directly from IRAM */ + uint8_t psr_state; /* 0xf0 */ +- uint8_t dmcu_mcp_interface_version; /* 0xf1 */ +- uint8_t dmcu_abm_feature_version; /* 0xf2 */ +- uint8_t dmcu_psr_feature_version; /* 0xf3 */ +- uint16_t dmcu_version; /* 0xf4 */ ++ uint8_t dmcu_mcp_interface_version; /* 0xf1 */ ++ uint8_t dmcu_abm_feature_version; /* 0xf2 */ ++ uint8_t dmcu_psr_feature_version; /* 0xf3 */ ++ uint16_t dmcu_version; /* 0xf4 */ + uint8_t dmcu_state; /* 0xf6 */ + + uint16_t blRampReduction; /* 0xf7 */ +@@ -164,42 +164,43 @@ struct iram_table_v_2_2 { + uint8_t max_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; /* 0x16 U0.8 */ + uint8_t bright_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; /* 0x2a U2.6 */ + uint8_t dark_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; /* 0x3e U2.6 */ +- uint8_t hybrid_factor[NUM_AGGR_LEVEL]; /* 0x52 U0.8 */ +- uint8_t contrast_factor[NUM_AGGR_LEVEL]; /* 0x56 U0.8 */ +- uint8_t deviation_gain[NUM_AGGR_LEVEL]; /* 0x5a U0.8 */ +- uint8_t iir_curve[NUM_AMBI_LEVEL]; /* 0x5e U0.8 */ +- uint8_t min_knee[NUM_AGGR_LEVEL]; /* 0x63 U0.8 */ +- uint8_t max_knee[NUM_AGGR_LEVEL]; /* 0x67 U0.8 */ +- uint8_t pad[21]; /* 0x6b U0.8 */ ++ uint8_t hybrid_factor[NUM_AGGR_LEVEL]; /* 0x52 U0.8 */ ++ uint8_t contrast_factor[NUM_AGGR_LEVEL]; /* 0x56 U0.8 */ ++ uint8_t deviation_gain[NUM_AGGR_LEVEL]; /* 0x5a U0.8 */ ++ uint8_t iir_curve[NUM_AMBI_LEVEL]; /* 0x5e U0.8 */ ++ uint8_t min_knee[NUM_AGGR_LEVEL]; /* 0x63 U0.8 */ ++ uint8_t max_knee[NUM_AGGR_LEVEL]; /* 0x67 U0.8 */ ++ uint16_t min_abm_backlight; /* 0x6b U16 */ ++ uint8_t pad[19]; /* 0x6d U0.8 */ + + /* parameters for crgb conversion */ +- uint16_t crgb_thresh[NUM_POWER_FN_SEGS]; /* 0x80 U3.13 */ +- uint16_t crgb_offset[NUM_POWER_FN_SEGS]; /* 0x90 U1.15 */ +- uint16_t crgb_slope[NUM_POWER_FN_SEGS]; /* 0xa0 U4.12 */ ++ uint16_t crgb_thresh[NUM_POWER_FN_SEGS]; /* 0x80 U3.13 */ ++ uint16_t crgb_offset[NUM_POWER_FN_SEGS]; /* 0x90 U1.15 */ ++ uint16_t crgb_slope[NUM_POWER_FN_SEGS]; /* 0xa0 U4.12 */ + + /* parameters for custom curve */ + /* thresholds for brightness --> backlight */ +- uint16_t backlight_thresholds[NUM_BL_CURVE_SEGS]; /* 0xb0 U16.0 */ ++ uint16_t backlight_thresholds[NUM_BL_CURVE_SEGS]; /* 0xb0 U16.0 */ + /* offsets for brightness --> backlight */ +- uint16_t backlight_offsets[NUM_BL_CURVE_SEGS]; /* 0xd0 U16.0 */ ++ uint16_t backlight_offsets[NUM_BL_CURVE_SEGS]; /* 0xd0 U16.0 */ + + /* For reading PSR State directly from IRAM */ +- uint8_t psr_state; /* 0xf0 */ +- uint8_t dmcu_mcp_interface_version; /* 0xf1 */ +- uint8_t dmcu_abm_feature_version; /* 0xf2 */ +- uint8_t dmcu_psr_feature_version; /* 0xf3 */ +- uint16_t dmcu_version; /* 0xf4 */ +- uint8_t dmcu_state; /* 0xf6 */ +- +- uint8_t dummy1; /* 0xf7 */ +- uint8_t dummy2; /* 0xf8 */ +- uint8_t dummy3; /* 0xf9 */ +- uint8_t dummy4; /* 0xfa */ +- uint8_t dummy5; /* 0xfb */ +- uint8_t dummy6; /* 0xfc */ +- uint8_t dummy7; /* 0xfd */ +- uint8_t dummy8; /* 0xfe */ +- uint8_t dummy9; /* 0xff */ ++ uint8_t psr_state; /* 0xf0 */ ++ uint8_t dmcu_mcp_interface_version; /* 0xf1 */ ++ uint8_t dmcu_abm_feature_version; /* 0xf2 */ ++ uint8_t dmcu_psr_feature_version; /* 0xf3 */ ++ uint16_t dmcu_version; /* 0xf4 */ ++ uint8_t dmcu_state; /* 0xf6 */ ++ ++ uint8_t dummy1; /* 0xf7 */ ++ uint8_t dummy2; /* 0xf8 */ ++ uint8_t dummy3; /* 0xf9 */ ++ uint8_t dummy4; /* 0xfa */ ++ uint8_t dummy5; /* 0xfb */ ++ uint8_t dummy6; /* 0xfc */ ++ uint8_t dummy7; /* 0xfd */ ++ uint8_t dummy8; /* 0xfe */ ++ uint8_t dummy9; /* 0xff */ + }; + #pragma pack(pop) + +@@ -271,7 +272,8 @@ void fill_iram_v_2(struct iram_table_v_2 *ram_table, struct dmcu_iram_parameters + { + unsigned int set = params.set; + +- ram_table->flags = 0x0; ++ ram_table->min_abm_backlight = ++ cpu_to_be16(params.min_abm_backlight); + ram_table->deviation_gain = 0xb3; + + ram_table->blRampReduction = +@@ -445,6 +447,9 @@ void fill_iram_v_2_2(struct iram_table_v_2_2 *ram_table, struct dmcu_iram_parame + + ram_table->flags = 0x0; + ++ ram_table->min_abm_backlight = ++ cpu_to_be16(params.min_abm_backlight); ++ + ram_table->deviation_gain[0] = 0xb3; + ram_table->deviation_gain[1] = 0xa8; + ram_table->deviation_gain[2] = 0x98; +@@ -588,6 +593,10 @@ void fill_iram_v_2_3(struct iram_table_v_2_2 *ram_table, struct dmcu_iram_parame + unsigned int set = params.set; + + ram_table->flags = 0x0; ++ ++ ram_table->min_abm_backlight = ++ cpu_to_be16(params.min_abm_backlight); ++ + for (i = 0; i < NUM_AGGR_LEVEL; i++) { + ram_table->hybrid_factor[i] = abm_settings[set][i].brightness_gain; + ram_table->contrast_factor[i] = abm_settings[set][i].contrast_factor; +diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.h b/drivers/gpu/drm/amd/display/modules/power/power_helpers.h +index da5df00fedce..e54157026330 100644 +--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.h ++++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.h +@@ -38,6 +38,7 @@ struct dmcu_iram_parameters { + unsigned int backlight_lut_array_size; + unsigned int backlight_ramping_reduction; + unsigned int backlight_ramping_start; ++ unsigned int min_abm_backlight; + unsigned int set; + }; + +diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c +index 4acf139ea014..58c091ab67b2 100644 +--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c +@@ -1344,7 +1344,10 @@ static int smu_suspend(void *handle) + int ret; + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + struct smu_context *smu = &adev->smu; +- bool baco_feature_is_enabled = smu_feature_is_enabled(smu, SMU_FEATURE_BACO_BIT); ++ bool baco_feature_is_enabled = false; ++ ++ if(!(adev->flags & AMD_IS_APU)) ++ baco_feature_is_enabled = smu_feature_is_enabled(smu, SMU_FEATURE_BACO_BIT); + + ret = smu_system_features_control(smu, false); + if (ret) +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c +index df6ff9252401..b068d1c7b44d 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c +@@ -29,7 +29,7 @@ + #include "vega20_baco.h" + #include "vega20_smumgr.h" + +- ++#include "amdgpu_ras.h" + + static const struct soc15_baco_cmd_entry clean_baco_tbl[] = + { +@@ -74,6 +74,7 @@ int vega20_baco_get_state(struct pp_hwmgr *hwmgr, enum BACO_STATE *state) + int vega20_baco_set_state(struct pp_hwmgr *hwmgr, enum BACO_STATE state) + { + struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); ++ struct amdgpu_ras *ras = amdgpu_ras_get_context(adev); + enum BACO_STATE cur_state; + uint32_t data; + +@@ -84,10 +85,11 @@ int vega20_baco_set_state(struct pp_hwmgr *hwmgr, enum BACO_STATE state) + return 0; + + if (state == BACO_STATE_IN) { +- data = RREG32_SOC15(THM, 0, mmTHM_BACO_CNTL); +- data |= 0x80000000; +- WREG32_SOC15(THM, 0, mmTHM_BACO_CNTL, data); +- ++ if (!ras || !ras->supported) { ++ data = RREG32_SOC15(THM, 0, mmTHM_BACO_CNTL); ++ data |= 0x80000000; ++ WREG32_SOC15(THM, 0, mmTHM_BACO_CNTL, data); ++ } + + if(smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_EnterBaco, 0)) + return -EINVAL; +diff --git a/drivers/gpu/drm/amd/powerplay/renoir_ppt.c b/drivers/gpu/drm/amd/powerplay/renoir_ppt.c +index e62bfba51562..e5283dafc414 100644 +--- a/drivers/gpu/drm/amd/powerplay/renoir_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/renoir_ppt.c +@@ -183,11 +183,13 @@ static int renoir_print_clk_levels(struct smu_context *smu, + int i, size = 0, ret = 0; + uint32_t cur_value = 0, value = 0, count = 0, min = 0, max = 0; + DpmClocks_t *clk_table = smu->smu_table.clocks_table; +- SmuMetrics_t metrics = {0}; ++ SmuMetrics_t metrics; + + if (!clk_table || clk_type >= SMU_CLK_COUNT) + return -EINVAL; + ++ memset(&metrics, 0, sizeof(metrics)); ++ + ret = smu_update_table(smu, SMU_TABLE_SMU_METRICS, 0, + (void *)&metrics, false); + if (ret) +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c +index 624d257da20f..52c42569a111 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c +@@ -250,6 +250,7 @@ komeda_crtc_atomic_enable(struct drm_crtc *crtc, + { + komeda_crtc_prepare(to_kcrtc(crtc)); + drm_crtc_vblank_on(crtc); ++ WARN_ON(drm_crtc_vblank_get(crtc)); + komeda_crtc_do_flush(crtc, old); + } + +@@ -319,6 +320,7 @@ komeda_crtc_atomic_disable(struct drm_crtc *crtc, + } + } + ++ drm_crtc_vblank_put(crtc); + drm_crtc_vblank_off(crtc); + komeda_crtc_unprepare(kcrtc); + } +diff --git a/drivers/gpu/drm/bridge/analogix-anx78xx.c b/drivers/gpu/drm/bridge/analogix-anx78xx.c +index 3c7cc5af735c..56df07cdab68 100644 +--- a/drivers/gpu/drm/bridge/analogix-anx78xx.c ++++ b/drivers/gpu/drm/bridge/analogix-anx78xx.c +@@ -715,7 +715,9 @@ static int anx78xx_init_pdata(struct anx78xx *anx78xx) + /* 1.0V digital core power regulator */ + pdata->dvdd10 = devm_regulator_get(dev, "dvdd10"); + if (IS_ERR(pdata->dvdd10)) { +- DRM_ERROR("DVDD10 regulator not found\n"); ++ if (PTR_ERR(pdata->dvdd10) != -EPROBE_DEFER) ++ DRM_ERROR("DVDD10 regulator not found\n"); ++ + return PTR_ERR(pdata->dvdd10); + } + +@@ -1332,7 +1334,9 @@ static int anx78xx_i2c_probe(struct i2c_client *client, + + err = anx78xx_init_pdata(anx78xx); + if (err) { +- DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ if (err != -EPROBE_DEFER) ++ DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ + return err; + } + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index 521d689413c8..1326f2c734bf 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -36,6 +36,7 @@ + #include "dw-hdmi-cec.h" + #include "dw-hdmi.h" + ++#define DDC_CI_ADDR 0x37 + #define DDC_SEGMENT_ADDR 0x30 + + #define HDMI_EDID_LEN 512 +@@ -398,6 +399,15 @@ static int dw_hdmi_i2c_xfer(struct i2c_adapter *adap, + u8 addr = msgs[0].addr; + int i, ret = 0; + ++ if (addr == DDC_CI_ADDR) ++ /* ++ * The internal I2C controller does not support the multi-byte ++ * read and write operations needed for DDC/CI. ++ * TOFIX: Blacklist the DDC/CI address until we filter out ++ * unsupported I2C operations. ++ */ ++ return -EOPNOTSUPP; ++ + dev_dbg(hdmi->dev, "xfer: num: %d, addr: %#x\n", num, addr); + + for (i = 0; i < num; i++) { +@@ -2023,7 +2033,7 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode) + + /* HDMI Initialization Step E - Configure audio */ + hdmi_clk_regenerator_update_pixel_clock(hdmi); +- hdmi_enable_audio_clk(hdmi, true); ++ hdmi_enable_audio_clk(hdmi, hdmi->audio_enable); + } + + /* not for DVI mode */ +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 6b0177112e18..3f50b8865db4 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -3722,7 +3722,7 @@ cea_db_offsets(const u8 *cea, int *start, int *end) + if (*end < 4 || *end > 127) + return -ERANGE; + } else { +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + } + + return 0; +@@ -4191,7 +4191,7 @@ int drm_edid_to_sad(struct edid *edid, struct cea_sad **sads) + + if (cea_revision(cea) < 3) { + DRM_DEBUG_KMS("SAD: wrong CEA revision\n"); +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + } + + if (cea_db_offsets(cea, &start, &end)) { +@@ -4252,7 +4252,7 @@ int drm_edid_to_speaker_allocation(struct edid *edid, u8 **sadb) + + if (cea_revision(cea) < 3) { + DRM_DEBUG_KMS("SAD: wrong CEA revision\n"); +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + } + + if (cea_db_offsets(cea, &start, &end)) { +diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c +index 1961f713aaab..f8154316a3b0 100644 +--- a/drivers/gpu/drm/drm_mipi_dbi.c ++++ b/drivers/gpu/drm/drm_mipi_dbi.c +@@ -955,7 +955,7 @@ static int mipi_dbi_typec1_command(struct mipi_dbi *dbi, u8 *cmd, + int ret; + + if (mipi_dbi_command_is_read(dbi, *cmd)) +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + + MIPI_DBI_DEBUG_COMMAND(*cmd, parameters, num); + +@@ -1187,8 +1187,7 @@ static ssize_t mipi_dbi_debugfs_command_write(struct file *file, + struct mipi_dbi_dev *dbidev = m->private; + u8 val, cmd = 0, parameters[64]; + char *buf, *pos, *token; +- unsigned int i; +- int ret, idx; ++ int i, ret, idx; + + if (!drm_dev_enter(&dbidev->drm, &idx)) + return -ENODEV; +diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c +index fd1fbc77871f..552ec82e9bc5 100644 +--- a/drivers/gpu/drm/drm_vblank.c ++++ b/drivers/gpu/drm/drm_vblank.c +@@ -1581,7 +1581,7 @@ int drm_wait_vblank_ioctl(struct drm_device *dev, void *data, + unsigned int flags, pipe, high_pipe; + + if (!dev->irq_enabled) +- return -EINVAL; ++ return -EOPNOTSUPP; + + if (vblwait->request.type & _DRM_VBLANK_SIGNAL) + return -EINVAL; +@@ -1838,7 +1838,7 @@ int drm_crtc_get_sequence_ioctl(struct drm_device *dev, void *data, + return -EOPNOTSUPP; + + if (!dev->irq_enabled) +- return -EINVAL; ++ return -EOPNOTSUPP; + + crtc = drm_crtc_find(dev, file_priv, get_seq->crtc_id); + if (!crtc) +@@ -1896,7 +1896,7 @@ int drm_crtc_queue_sequence_ioctl(struct drm_device *dev, void *data, + return -EOPNOTSUPP; + + if (!dev->irq_enabled) +- return -EINVAL; ++ return -EOPNOTSUPP; + + crtc = drm_crtc_find(dev, file_priv, queue_seq->crtc_id); + if (!crtc) +diff --git a/drivers/gpu/drm/gma500/oaktrail_crtc.c b/drivers/gpu/drm/gma500/oaktrail_crtc.c +index 167c10767dd4..900e5499249d 100644 +--- a/drivers/gpu/drm/gma500/oaktrail_crtc.c ++++ b/drivers/gpu/drm/gma500/oaktrail_crtc.c +@@ -129,6 +129,7 @@ static bool mrst_sdvo_find_best_pll(const struct gma_limit_t *limit, + s32 freq_error, min_error = 100000; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.n = limit->n.min; clock.n <= limit->n.max; +@@ -185,6 +186,7 @@ static bool mrst_lvds_find_best_pll(const struct gma_limit_t *limit, + int err = target; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.p1 = limit->p1.min; clock.p1 <= limit->p1.max; +diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c +index ac491a781952..f690793ae2d5 100644 +--- a/drivers/gpu/drm/meson/meson_vclk.c ++++ b/drivers/gpu/drm/meson/meson_vclk.c +@@ -638,13 +638,18 @@ static bool meson_hdmi_pll_validate_params(struct meson_drm *priv, + if (frac >= HDMI_FRAC_MAX_GXBB) + return false; + } else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXM) || +- meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXL) || +- meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { ++ meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXL)) { + /* Empiric supported min/max dividers */ + if (m < 106 || m > 247) + return false; + if (frac >= HDMI_FRAC_MAX_GXL) + return false; ++ } else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { ++ /* Empiric supported min/max dividers */ ++ if (m < 106 || m > 247) ++ return false; ++ if (frac >= HDMI_FRAC_MAX_G12A) ++ return false; + } + + return true; +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +index e686331fa089..691c1a277d91 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +@@ -352,26 +352,26 @@ static void a6xx_get_debugbus(struct msm_gpu *gpu, + cxdbg = ioremap(res->start, resource_size(res)); + + if (cxdbg) { +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_CNTLT, ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_CNTLT, + A6XX_DBGC_CFG_DBGBUS_CNTLT_SEGT(0xf)); + +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_CNTLM, ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_CNTLM, + A6XX_DBGC_CFG_DBGBUS_CNTLM_ENABLE(0xf)); + +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_0, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_1, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_2, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_3, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_0, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_1, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_2, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_3, 0); + +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_BYTEL_0, ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_0, + 0x76543210); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_BYTEL_1, ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_1, + 0xFEDCBA98); + +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_0, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_1, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_2, 0); +- cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_3, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_0, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_1, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_2, 0); ++ cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_3, 0); + } + + a6xx_state->debugbus = state_kcalloc(a6xx_state, +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 94dfa2e5a9ab..a442a955f98c 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -1131,6 +1131,16 @@ nouveau_connector_hotplug(struct nvif_notify *notify) + const char *name = connector->name; + struct nouveau_encoder *nv_encoder; + int ret; ++ bool plugged = (rep->mask != NVIF_NOTIFY_CONN_V0_UNPLUG); ++ ++ if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) { ++ NV_DEBUG(drm, "service %s\n", name); ++ drm_dp_cec_irq(&nv_connector->aux); ++ if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) ++ nv50_mstm_service(nv_encoder->dp.mstm); ++ ++ return NVIF_NOTIFY_KEEP; ++ } + + ret = pm_runtime_get(drm->dev->dev); + if (ret == 0) { +@@ -1151,25 +1161,16 @@ nouveau_connector_hotplug(struct nvif_notify *notify) + return NVIF_NOTIFY_DROP; + } + +- if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) { +- NV_DEBUG(drm, "service %s\n", name); +- drm_dp_cec_irq(&nv_connector->aux); +- if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) +- nv50_mstm_service(nv_encoder->dp.mstm); +- } else { +- bool plugged = (rep->mask != NVIF_NOTIFY_CONN_V0_UNPLUG); +- ++ if (!plugged) ++ drm_dp_cec_unset_edid(&nv_connector->aux); ++ NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name); ++ if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) { + if (!plugged) +- drm_dp_cec_unset_edid(&nv_connector->aux); +- NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name); +- if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) { +- if (!plugged) +- nv50_mstm_remove(nv_encoder->dp.mstm); +- } +- +- drm_helper_hpd_irq_event(connector->dev); ++ nv50_mstm_remove(nv_encoder->dp.mstm); + } + ++ drm_helper_hpd_irq_event(connector->dev); ++ + pm_runtime_mark_last_busy(drm->dev->dev); + pm_runtime_put_autosuspend(drm->dev->dev); + return NVIF_NOTIFY_KEEP; +diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +index b5b14aa059ea..2aa89eaecf6f 100644 +--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c ++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +@@ -426,6 +426,7 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c, + return PTR_ERR(ts->dsi); + } + ++ drm_panel_init(&ts->base); + ts->base.dev = dev; + ts->base.funcs = &rpi_touchscreen_funcs; + +diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c +index 5e3e92ea9ea6..3b2612ae931e 100644 +--- a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c ++++ b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c +@@ -381,6 +381,7 @@ static int st7789v_probe(struct spi_device *spi) + spi_set_drvdata(spi, ctx); + ctx->spi = spi; + ++ drm_panel_init(&ctx->panel); + ctx->panel.dev = &spi->dev; + ctx->panel.funcs = &st7789v_drm_funcs; + +diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c +index f39b97ed4ade..2af64459b3d7 100644 +--- a/drivers/gpu/drm/scheduler/sched_main.c ++++ b/drivers/gpu/drm/scheduler/sched_main.c +@@ -632,43 +632,41 @@ static void drm_sched_process_job(struct dma_fence *f, struct dma_fence_cb *cb) + } + + /** +- * drm_sched_cleanup_jobs - destroy finished jobs ++ * drm_sched_get_cleanup_job - fetch the next finished job to be destroyed + * + * @sched: scheduler instance + * +- * Remove all finished jobs from the mirror list and destroy them. ++ * Returns the next finished job from the mirror list (if there is one) ++ * ready for it to be destroyed. + */ +-static void drm_sched_cleanup_jobs(struct drm_gpu_scheduler *sched) ++static struct drm_sched_job * ++drm_sched_get_cleanup_job(struct drm_gpu_scheduler *sched) + { ++ struct drm_sched_job *job; + unsigned long flags; + + /* Don't destroy jobs while the timeout worker is running */ + if (sched->timeout != MAX_SCHEDULE_TIMEOUT && + !cancel_delayed_work(&sched->work_tdr)) +- return; +- ++ return NULL; + +- while (!list_empty(&sched->ring_mirror_list)) { +- struct drm_sched_job *job; ++ spin_lock_irqsave(&sched->job_list_lock, flags); + +- job = list_first_entry(&sched->ring_mirror_list, ++ job = list_first_entry_or_null(&sched->ring_mirror_list, + struct drm_sched_job, node); +- if (!dma_fence_is_signaled(&job->s_fence->finished)) +- break; + +- spin_lock_irqsave(&sched->job_list_lock, flags); ++ if (job && dma_fence_is_signaled(&job->s_fence->finished)) { + /* remove job from ring_mirror_list */ + list_del_init(&job->node); +- spin_unlock_irqrestore(&sched->job_list_lock, flags); +- +- sched->ops->free_job(job); ++ } else { ++ job = NULL; ++ /* queue timeout for next job */ ++ drm_sched_start_timeout(sched); + } + +- /* queue timeout for next job */ +- spin_lock_irqsave(&sched->job_list_lock, flags); +- drm_sched_start_timeout(sched); + spin_unlock_irqrestore(&sched->job_list_lock, flags); + ++ return job; + } + + /** +@@ -708,12 +706,19 @@ static int drm_sched_main(void *param) + struct drm_sched_fence *s_fence; + struct drm_sched_job *sched_job; + struct dma_fence *fence; ++ struct drm_sched_job *cleanup_job = NULL; + + wait_event_interruptible(sched->wake_up_worker, +- (drm_sched_cleanup_jobs(sched), ++ (cleanup_job = drm_sched_get_cleanup_job(sched)) || + (!drm_sched_blocked(sched) && + (entity = drm_sched_select_entity(sched))) || +- kthread_should_stop())); ++ kthread_should_stop()); ++ ++ if (cleanup_job) { ++ sched->ops->free_job(cleanup_job); ++ /* queue timeout for next job */ ++ drm_sched_start_timeout(sched); ++ } + + if (!entity) + continue; +diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +index 1636344ba9ec..f83522717488 100644 +--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c ++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +@@ -437,9 +437,9 @@ static void sun6i_dsi_setup_burst(struct sun6i_dsi *dsi, + SUN6I_DSI_BURST_LINE_SYNC_POINT(SUN6I_DSI_SYNC_POINT)); + + val = SUN6I_DSI_TCON_DRQ_ENABLE_MODE; +- } else if ((mode->hsync_end - mode->hdisplay) > 20) { ++ } else if ((mode->hsync_start - mode->hdisplay) > 20) { + /* Maaaaaagic */ +- u16 drq = (mode->hsync_end - mode->hdisplay) - 20; ++ u16 drq = (mode->hsync_start - mode->hdisplay) - 20; + + drq *= mipi_dsi_pixel_format_to_bpp(device->format); + drq /= 32; +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index e1669ada0a40..75e65d9536d5 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -3200,6 +3200,11 @@ static int tegra_sor_parse_dt(struct tegra_sor *sor) + * earlier + */ + sor->pad = TEGRA_IO_PAD_HDMI_DP0 + sor->index; ++ } else { ++ if (sor->soc->supports_edp) ++ sor->index = 0; ++ else ++ sor->index = 1; + } + + err = of_property_read_u32_array(np, "nvidia,xbar-cfg", xbar_cfg, 5); +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index 98819462f025..f07803699809 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -926,7 +926,8 @@ EXPORT_SYMBOL(ttm_bo_mem_put); + */ + static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo, + struct ttm_mem_type_manager *man, +- struct ttm_mem_reg *mem) ++ struct ttm_mem_reg *mem, ++ bool no_wait_gpu) + { + struct dma_fence *fence; + int ret; +@@ -935,19 +936,22 @@ static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo, + fence = dma_fence_get(man->move); + spin_unlock(&man->move_lock); + +- if (fence) { +- dma_resv_add_shared_fence(bo->base.resv, fence); ++ if (!fence) ++ return 0; + +- ret = dma_resv_reserve_shared(bo->base.resv, 1); +- if (unlikely(ret)) { +- dma_fence_put(fence); +- return ret; +- } ++ if (no_wait_gpu) ++ return -EBUSY; ++ ++ dma_resv_add_shared_fence(bo->base.resv, fence); + +- dma_fence_put(bo->moving); +- bo->moving = fence; ++ ret = dma_resv_reserve_shared(bo->base.resv, 1); ++ if (unlikely(ret)) { ++ dma_fence_put(fence); ++ return ret; + } + ++ dma_fence_put(bo->moving); ++ bo->moving = fence; + return 0; + } + +@@ -978,7 +982,7 @@ static int ttm_bo_mem_force_space(struct ttm_buffer_object *bo, + return ret; + } while (1); + +- return ttm_bo_add_move_fence(bo, man, mem); ++ return ttm_bo_add_move_fence(bo, man, mem, ctx->no_wait_gpu); + } + + static uint32_t ttm_bo_select_caching(struct ttm_mem_type_manager *man, +@@ -1120,14 +1124,18 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo, + if (unlikely(ret)) + goto error; + +- if (mem->mm_node) { +- ret = ttm_bo_add_move_fence(bo, man, mem); +- if (unlikely(ret)) { +- (*man->func->put_node)(man, mem); +- goto error; +- } +- return 0; ++ if (!mem->mm_node) ++ continue; ++ ++ ret = ttm_bo_add_move_fence(bo, man, mem, ctx->no_wait_gpu); ++ if (unlikely(ret)) { ++ (*man->func->put_node)(man, mem); ++ if (ret == -EBUSY) ++ continue; ++ ++ goto error; + } ++ return 0; + } + + for (i = 0; i < placement->num_busy_placement; ++i) { +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index ee7d4e7b0ee3..0853b980bcb3 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -1285,6 +1285,9 @@ static const struct cec_adap_ops vc4_hdmi_cec_adap_ops = { + + static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data) + { ++#ifdef CONFIG_DRM_VC4_HDMI_CEC ++ struct cec_connector_info conn_info; ++#endif + struct platform_device *pdev = to_platform_device(dev); + struct drm_device *drm = dev_get_drvdata(master); + struct vc4_dev *vc4 = drm->dev_private; +@@ -1403,13 +1406,15 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data) + #ifdef CONFIG_DRM_VC4_HDMI_CEC + hdmi->cec_adap = cec_allocate_adapter(&vc4_hdmi_cec_adap_ops, + vc4, "vc4", +- CEC_CAP_TRANSMIT | +- CEC_CAP_LOG_ADDRS | +- CEC_CAP_PASSTHROUGH | +- CEC_CAP_RC, 1); ++ CEC_CAP_DEFAULTS | ++ CEC_CAP_CONNECTOR_INFO, 1); + ret = PTR_ERR_OR_ZERO(hdmi->cec_adap); + if (ret < 0) + goto err_destroy_conn; ++ ++ cec_fill_conn_info_from_drm(&conn_info, hdmi->connector); ++ cec_s_conn_info(hdmi->cec_adap, &conn_info); ++ + HDMI_WRITE(VC4_HDMI_CPU_MASK_SET, 0xffffffff); + value = HDMI_READ(VC4_HDMI_CEC_CNTRL_1); + value &= ~VC4_HDMI_CEC_DIV_CLK_CNT_MASK; +diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c +index 0a88ef11b9d3..a662394f6892 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c ++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c +@@ -463,25 +463,29 @@ out: + } + + static int virtio_gpu_wait_ioctl(struct drm_device *dev, void *data, +- struct drm_file *file) ++ struct drm_file *file) + { + struct drm_virtgpu_3d_wait *args = data; +- struct drm_gem_object *gobj = NULL; +- struct virtio_gpu_object *qobj = NULL; ++ struct drm_gem_object *obj; ++ long timeout = 15 * HZ; + int ret; +- bool nowait = false; + +- gobj = drm_gem_object_lookup(file, args->handle); +- if (gobj == NULL) ++ obj = drm_gem_object_lookup(file, args->handle); ++ if (obj == NULL) + return -ENOENT; + +- qobj = gem_to_virtio_gpu_obj(gobj); +- +- if (args->flags & VIRTGPU_WAIT_NOWAIT) +- nowait = true; +- ret = virtio_gpu_object_wait(qobj, nowait); ++ if (args->flags & VIRTGPU_WAIT_NOWAIT) { ++ ret = dma_resv_test_signaled_rcu(obj->resv, true); ++ } else { ++ ret = dma_resv_wait_timeout_rcu(obj->resv, true, true, ++ timeout); ++ } ++ if (ret == 0) ++ ret = -EBUSY; ++ else if (ret > 0) ++ ret = 0; + +- drm_gem_object_put_unlocked(gobj); ++ drm_gem_object_put_unlocked(obj); + return ret; + } + +diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c +index eaa5c3352c13..22559670faee 100644 +--- a/drivers/gpu/host1x/job.c ++++ b/drivers/gpu/host1x/job.c +@@ -436,7 +436,8 @@ out: + return err; + } + +-static inline int copy_gathers(struct host1x_job *job, struct device *dev) ++static inline int copy_gathers(struct device *host, struct host1x_job *job, ++ struct device *dev) + { + struct host1x_firewall fw; + size_t size = 0; +@@ -459,12 +460,12 @@ static inline int copy_gathers(struct host1x_job *job, struct device *dev) + * Try a non-blocking allocation from a higher priority pools first, + * as awaiting for the allocation here is a major performance hit. + */ +- job->gather_copy_mapped = dma_alloc_wc(dev, size, &job->gather_copy, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, &job->gather_copy, + GFP_NOWAIT); + + /* the higher priority allocation failed, try the generic-blocking */ + if (!job->gather_copy_mapped) +- job->gather_copy_mapped = dma_alloc_wc(dev, size, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, + &job->gather_copy, + GFP_KERNEL); + if (!job->gather_copy_mapped) +@@ -512,7 +513,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev) + goto out; + + if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) { +- err = copy_gathers(job, dev); ++ err = copy_gathers(host->dev, job, dev); + if (err) + goto out; + } +@@ -573,7 +574,7 @@ void host1x_job_unpin(struct host1x_job *job) + job->num_unpins = 0; + + if (job->gather_copy_size) +- dma_free_wc(job->channel->dev, job->gather_copy_size, ++ dma_free_wc(host->dev, job->gather_copy_size, + job->gather_copy_mapped, job->gather_copy); + } + EXPORT_SYMBOL(host1x_job_unpin); +diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c +index 0dfd97bbde9e..ca232ec565e8 100644 +--- a/drivers/hwtracing/intel_th/core.c ++++ b/drivers/hwtracing/intel_th/core.c +@@ -834,9 +834,6 @@ static irqreturn_t intel_th_irq(int irq, void *data) + ret |= d->irq(th->thdev[i]); + } + +- if (ret == IRQ_NONE) +- pr_warn_ratelimited("nobody cared for irq\n"); +- + return ret; + } + +@@ -887,6 +884,7 @@ intel_th_alloc(struct device *dev, struct intel_th_drvdata *drvdata, + + if (th->irq == -1) + th->irq = devres[r].start; ++ th->num_irqs++; + break; + default: + dev_warn(dev, "Unknown resource type %lx\n", +@@ -940,6 +938,9 @@ void intel_th_free(struct intel_th *th) + + th->num_thdevs = 0; + ++ for (i = 0; i < th->num_irqs; i++) ++ devm_free_irq(th->dev, th->irq + i, th); ++ + pm_runtime_get_sync(th->dev); + pm_runtime_forbid(th->dev); + +diff --git a/drivers/hwtracing/intel_th/intel_th.h b/drivers/hwtracing/intel_th/intel_th.h +index 0df480072b6c..6f4f5486fe6d 100644 +--- a/drivers/hwtracing/intel_th/intel_th.h ++++ b/drivers/hwtracing/intel_th/intel_th.h +@@ -261,6 +261,7 @@ enum th_mmio_idx { + * @num_thdevs: number of devices in the @thdev array + * @num_resources: number of resources in the @resource array + * @irq: irq number ++ * @num_irqs: number of IRQs is use + * @id: this Intel TH controller's device ID in the system + * @major: device node major for output devices + */ +@@ -277,6 +278,7 @@ struct intel_th { + unsigned int num_thdevs; + unsigned int num_resources; + int irq; ++ int num_irqs; + + int id; + int major; +diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c +index 6d240dfae9d9..8e48c7458aa3 100644 +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -1676,10 +1676,13 @@ static int intel_th_msc_init(struct msc *msc) + return 0; + } + +-static void msc_win_switch(struct msc *msc) ++static int msc_win_switch(struct msc *msc) + { + struct msc_window *first; + ++ if (list_empty(&msc->win_list)) ++ return -EINVAL; ++ + first = list_first_entry(&msc->win_list, struct msc_window, entry); + + if (msc_is_last_win(msc->cur_win)) +@@ -1691,6 +1694,8 @@ static void msc_win_switch(struct msc *msc) + msc->base_addr = msc_win_base_dma(msc->cur_win); + + intel_th_trace_switch(msc->thdev); ++ ++ return 0; + } + + /** +@@ -2025,16 +2030,15 @@ win_switch_store(struct device *dev, struct device_attribute *attr, + if (val != 1) + return -EINVAL; + ++ ret = -EINVAL; + mutex_lock(&msc->buf_mutex); + /* + * Window switch can only happen in the "multi" mode. + * If a external buffer is engaged, they have the full + * control over window switching. + */ +- if (msc->mode != MSC_MODE_MULTI || msc->mbuf) +- ret = -ENOTSUPP; +- else +- msc_win_switch(msc); ++ if (msc->mode == MSC_MODE_MULTI && !msc->mbuf) ++ ret = msc_win_switch(msc); + mutex_unlock(&msc->buf_mutex); + + return ret ? ret : size; +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index ebf3e30e989a..e9d90b53bbc4 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -204,6 +204,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x06a6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Comet Lake PCH-V */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa3a6), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { + /* Ice Lake NNPI */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5), +@@ -229,6 +234,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Elkhart Lake */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { 0 }, + }; + +diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c +index 5fa78c273a25..65c7c9329b1c 100644 +--- a/drivers/iio/adc/dln2-adc.c ++++ b/drivers/iio/adc/dln2-adc.c +@@ -524,6 +524,10 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + u16 conflict; + unsigned int trigger_chan; + ++ ret = iio_triggered_buffer_postenable(indio_dev); ++ if (ret) ++ return ret; ++ + mutex_lock(&dln2->mutex); + + /* Enable ADC */ +@@ -537,6 +541,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + (int)conflict); + ret = -EBUSY; + } ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + +@@ -550,6 +555,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + if (ret < 0) { + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + } else { +@@ -557,12 +563,12 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + } + +- return iio_triggered_buffer_postenable(indio_dev); ++ return 0; + } + + static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + { +- int ret; ++ int ret, ret2; + struct dln2_adc *dln2 = iio_priv(indio_dev); + + mutex_lock(&dln2->mutex); +@@ -577,12 +583,14 @@ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + ret = dln2_adc_set_port_enabled(dln2, false, NULL); + + mutex_unlock(&dln2->mutex); +- if (ret < 0) { ++ if (ret < 0) + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); +- return ret; +- } + +- return iio_triggered_buffer_predisable(indio_dev); ++ ret2 = iio_triggered_buffer_predisable(indio_dev); ++ if (ret == 0) ++ ret = ret2; ++ ++ return ret; + } + + static const struct iio_buffer_setup_ops dln2_adc_buffer_setup_ops = { +diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c +index 214883458582..e3be8eedd773 100644 +--- a/drivers/iio/adc/max1027.c ++++ b/drivers/iio/adc/max1027.c +@@ -458,6 +458,14 @@ static int max1027_probe(struct spi_device *spi) + return ret; + } + ++ /* Internal reset */ ++ st->reg = MAX1027_RST_REG; ++ ret = spi_write(st->spi, &st->reg, 1); ++ if (ret < 0) { ++ dev_err(&indio_dev->dev, "Failed to reset the ADC\n"); ++ return ret; ++ } ++ + /* Disable averaging */ + st->reg = MAX1027_AVG_REG; + ret = spi_write(st->spi, &st->reg, 1); +diff --git a/drivers/iio/dac/Kconfig b/drivers/iio/dac/Kconfig +index cc42219a64f7..979070196da9 100644 +--- a/drivers/iio/dac/Kconfig ++++ b/drivers/iio/dac/Kconfig +@@ -60,8 +60,8 @@ config AD5446 + help + Say yes here to build support for Analog Devices AD5300, AD5301, AD5310, + AD5311, AD5320, AD5321, AD5444, AD5446, AD5450, AD5451, AD5452, AD5453, +- AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5601, AD5602, AD5611, AD5612, +- AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs ++ AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5600, AD5601, AD5602, AD5611, ++ AD5612, AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs + as well as Texas Instruments DAC081S101, DAC101S101, DAC121S101. + + To compile this driver as a module, choose M here: the +diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c +index 7df8b4cc295d..61c670f7fc5f 100644 +--- a/drivers/iio/dac/ad5446.c ++++ b/drivers/iio/dac/ad5446.c +@@ -327,6 +327,7 @@ enum ad5446_supported_spi_device_ids { + ID_AD5541A, + ID_AD5512A, + ID_AD5553, ++ ID_AD5600, + ID_AD5601, + ID_AD5611, + ID_AD5621, +@@ -381,6 +382,10 @@ static const struct ad5446_chip_info ad5446_spi_chip_info[] = { + .channel = AD5446_CHANNEL(14, 16, 0), + .write = ad5446_write, + }, ++ [ID_AD5600] = { ++ .channel = AD5446_CHANNEL(16, 16, 0), ++ .write = ad5446_write, ++ }, + [ID_AD5601] = { + .channel = AD5446_CHANNEL_POWERDOWN(8, 16, 6), + .write = ad5446_write, +@@ -448,6 +453,7 @@ static const struct spi_device_id ad5446_spi_ids[] = { + {"ad5542a", ID_AD5541A}, /* ad5541a and ad5542a are compatible */ + {"ad5543", ID_AD5541A}, /* ad5541a and ad5543 are compatible */ + {"ad5553", ID_AD5553}, ++ {"ad5600", ID_AD5600}, + {"ad5601", ID_AD5601}, + {"ad5611", ID_AD5611}, + {"ad5621", ID_AD5621}, +diff --git a/drivers/iio/light/bh1750.c b/drivers/iio/light/bh1750.c +index 28347df78cff..adb5ab9e3439 100644 +--- a/drivers/iio/light/bh1750.c ++++ b/drivers/iio/light/bh1750.c +@@ -59,9 +59,9 @@ struct bh1750_chip_info { + + u16 int_time_low_mask; + u16 int_time_high_mask; +-} ++}; + +-static const bh1750_chip_info_tbl[] = { ++static const struct bh1750_chip_info bh1750_chip_info_tbl[] = { + [BH1710] = { 140, 1022, 300, 400, 250000000, 2, 0x001F, 0x03E0 }, + [BH1721] = { 140, 1020, 300, 400, 250000000, 2, 0x0010, 0x03E0 }, + [BH1750] = { 31, 254, 69, 1740, 57500000, 1, 0x001F, 0x00E0 }, +diff --git a/drivers/iio/pressure/cros_ec_baro.c b/drivers/iio/pressure/cros_ec_baro.c +index 2354302375de..52f53f3123b1 100644 +--- a/drivers/iio/pressure/cros_ec_baro.c ++++ b/drivers/iio/pressure/cros_ec_baro.c +@@ -114,6 +114,7 @@ static int cros_ec_baro_write(struct iio_dev *indio_dev, + static const struct iio_info cros_ec_baro_info = { + .read_raw = &cros_ec_baro_read, + .write_raw = &cros_ec_baro_write, ++ .read_avail = &cros_ec_sensors_core_read_avail, + }; + + static int cros_ec_baro_probe(struct platform_device *pdev) +@@ -149,6 +150,8 @@ static int cros_ec_baro_probe(struct platform_device *pdev) + BIT(IIO_CHAN_INFO_SCALE) | + BIT(IIO_CHAN_INFO_SAMP_FREQ) | + BIT(IIO_CHAN_INFO_FREQUENCY); ++ channel->info_mask_shared_by_all_available = ++ BIT(IIO_CHAN_INFO_SAMP_FREQ); + channel->scan_type.realbits = CROS_EC_SENSOR_BITS; + channel->scan_type.storagebits = CROS_EC_SENSOR_BITS; + channel->scan_type.shift = 0; +diff --git a/drivers/iio/temperature/max31856.c b/drivers/iio/temperature/max31856.c +index f184ba5601d9..73ed550e3fc9 100644 +--- a/drivers/iio/temperature/max31856.c ++++ b/drivers/iio/temperature/max31856.c +@@ -284,6 +284,8 @@ static int max31856_probe(struct spi_device *spi) + spi_set_drvdata(spi, indio_dev); + + indio_dev->info = &max31856_info; ++ indio_dev->dev.parent = &spi->dev; ++ indio_dev->dev.of_node = spi->dev.of_node; + indio_dev->name = id->name; + indio_dev->modes = INDIO_DIRECT_MODE; + indio_dev->channels = max31856_channels; +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index 50a92442c4f7..2b5bd7206fc6 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -1199,9 +1199,21 @@ static void setup_dma_device(struct ib_device *device) + WARN_ON_ONCE(!parent); + device->dma_device = parent; + } +- /* Setup default max segment size for all IB devices */ +- dma_set_max_seg_size(device->dma_device, SZ_2G); + ++ if (!device->dev.dma_parms) { ++ if (parent) { ++ /* ++ * The caller did not provide DMA parameters, so ++ * 'parent' probably represents a PCI device. The PCI ++ * core sets the maximum segment size to 64 ++ * KB. Increase this parameter to 2 GB. ++ */ ++ device->dev.dma_parms = parent->dma_parms; ++ dma_set_max_seg_size(device->dma_device, SZ_2G); ++ } else { ++ WARN_ON_ONCE(true); ++ } ++ } + } + + /* +@@ -2397,8 +2409,12 @@ int ib_modify_port(struct ib_device *device, + rc = device->ops.modify_port(device, port_num, + port_modify_mask, + port_modify); ++ else if (rdma_protocol_roce(device, port_num) && ++ ((port_modify->set_port_cap_mask & ~IB_PORT_CM_SUP) == 0 || ++ (port_modify->clr_port_cap_mask & ~IB_PORT_CM_SUP) == 0)) ++ rc = 0; + else +- rc = rdma_protocol_roce(device, port_num) ? 0 : -ENOSYS; ++ rc = -EOPNOTSUPP; + return rc; + } + EXPORT_SYMBOL(ib_modify_port); +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 30a54f8aa42c..27e2df44d043 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -477,6 +477,7 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev, + bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_STAT_CTX_ALLOC, -1, -1); + req.update_period_ms = cpu_to_le32(1000); + req.stats_dma_addr = cpu_to_le64(dma_map); ++ req.stats_dma_length = cpu_to_le16(sizeof(struct ctx_hw_stats_ext)); + req.stat_ctx_flags = STAT_CTX_ALLOC_REQ_STAT_CTX_FLAGS_ROCE; + bnxt_re_fill_fw_msg(&fw_msg, (void *)&req, sizeof(req), (void *)&resp, + sizeof(resp), DFLT_HWRM_CMD_TIMEOUT); +@@ -1270,10 +1271,10 @@ static void bnxt_re_query_hwrm_intf_version(struct bnxt_re_dev *rdev) + return; + } + rdev->qplib_ctx.hwrm_intf_ver = +- (u64)resp.hwrm_intf_major << 48 | +- (u64)resp.hwrm_intf_minor << 32 | +- (u64)resp.hwrm_intf_build << 16 | +- resp.hwrm_intf_patch; ++ (u64)le16_to_cpu(resp.hwrm_intf_major) << 48 | ++ (u64)le16_to_cpu(resp.hwrm_intf_minor) << 32 | ++ (u64)le16_to_cpu(resp.hwrm_intf_build) << 16 | ++ le16_to_cpu(resp.hwrm_intf_patch); + } + + static void bnxt_re_ib_unreg(struct bnxt_re_dev *rdev) +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h +index fbda11a7ab1a..aaa76d792185 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h +@@ -186,7 +186,9 @@ struct bnxt_qplib_chip_ctx { + u8 chip_metal; + }; + +-#define CHIP_NUM_57500 0x1750 ++#define CHIP_NUM_57508 0x1750 ++#define CHIP_NUM_57504 0x1751 ++#define CHIP_NUM_57502 0x1752 + + struct bnxt_qplib_res { + struct pci_dev *pdev; +@@ -203,7 +205,9 @@ struct bnxt_qplib_res { + + static inline bool bnxt_qplib_is_chip_gen_p5(struct bnxt_qplib_chip_ctx *cctx) + { +- return (cctx->chip_num == CHIP_NUM_57500); ++ return (cctx->chip_num == CHIP_NUM_57508 || ++ cctx->chip_num == CHIP_NUM_57504 || ++ cctx->chip_num == CHIP_NUM_57502); + } + + static inline u8 bnxt_qplib_get_hwq_type(struct bnxt_qplib_res *res) +diff --git a/drivers/infiniband/hw/efa/efa_com.c b/drivers/infiniband/hw/efa/efa_com.c +index 3c412bc5b94f..0778f4f7dccd 100644 +--- a/drivers/infiniband/hw/efa/efa_com.c ++++ b/drivers/infiniband/hw/efa/efa_com.c +@@ -317,6 +317,7 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queu + struct efa_admin_acq_entry *comp, + size_t comp_size_in_bytes) + { ++ struct efa_admin_aq_entry *aqe; + struct efa_comp_ctx *comp_ctx; + u16 queue_size_mask; + u16 cmd_id; +@@ -350,7 +351,9 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queu + + reinit_completion(&comp_ctx->wait_event); + +- memcpy(&aq->sq.entries[pi], cmd, cmd_size_in_bytes); ++ aqe = &aq->sq.entries[pi]; ++ memset(aqe, 0, sizeof(*aqe)); ++ memcpy(aqe, cmd, cmd_size_in_bytes); + + aq->sq.pc++; + atomic64_inc(&aq->stats.submitted_cmd); +diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c +index 0a31d0a3d657..06871731ac43 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_restrack.c ++++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c +@@ -98,11 +98,15 @@ static int hns_roce_fill_res_cq_entry(struct sk_buff *msg, + goto err; + + table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER); +- if (!table_attr) ++ if (!table_attr) { ++ ret = -EMSGSIZE; + goto err; ++ } + +- if (hns_roce_fill_cq(msg, context)) ++ if (hns_roce_fill_cq(msg, context)) { ++ ret = -EMSGSIZE; + goto err_cancel_table; ++ } + + nla_nest_end(msg, table_attr); + kfree(context); +@@ -113,7 +117,7 @@ err_cancel_table: + nla_nest_cancel(msg, table_attr); + err: + kfree(context); +- return -EMSGSIZE; ++ return ret; + } + + int hns_roce_fill_res_entry(struct sk_buff *msg, +diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c +index 43ea2c13b212..108667ae6b14 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_srq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c +@@ -180,8 +180,7 @@ static int create_user_srq(struct hns_roce_srq *srq, struct ib_udata *udata, + { + struct hns_roce_dev *hr_dev = to_hr_dev(srq->ibsrq.device); + struct hns_roce_ib_create_srq ucmd; +- u32 page_shift; +- u32 npages; ++ struct hns_roce_buf *buf; + int ret; + + if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) +@@ -191,11 +190,13 @@ static int create_user_srq(struct hns_roce_srq *srq, struct ib_udata *udata, + if (IS_ERR(srq->umem)) + return PTR_ERR(srq->umem); + +- npages = (ib_umem_page_count(srq->umem) + +- (1 << hr_dev->caps.srqwqe_buf_pg_sz) - 1) / +- (1 << hr_dev->caps.srqwqe_buf_pg_sz); +- page_shift = PAGE_SHIFT + hr_dev->caps.srqwqe_buf_pg_sz; +- ret = hns_roce_mtt_init(hr_dev, npages, page_shift, &srq->mtt); ++ buf = &srq->buf; ++ buf->npages = (ib_umem_page_count(srq->umem) + ++ (1 << hr_dev->caps.srqwqe_buf_pg_sz) - 1) / ++ (1 << hr_dev->caps.srqwqe_buf_pg_sz); ++ buf->page_shift = PAGE_SHIFT + hr_dev->caps.srqwqe_buf_pg_sz; ++ ret = hns_roce_mtt_init(hr_dev, buf->npages, buf->page_shift, ++ &srq->mtt); + if (ret) + goto err_user_buf; + +@@ -212,9 +213,12 @@ static int create_user_srq(struct hns_roce_srq *srq, struct ib_udata *udata, + goto err_user_srq_mtt; + } + +- ret = hns_roce_mtt_init(hr_dev, ib_umem_page_count(srq->idx_que.umem), +- PAGE_SHIFT, &srq->idx_que.mtt); +- ++ buf = &srq->idx_que.idx_buf; ++ buf->npages = DIV_ROUND_UP(ib_umem_page_count(srq->idx_que.umem), ++ 1 << hr_dev->caps.idx_buf_pg_sz); ++ buf->page_shift = PAGE_SHIFT + hr_dev->caps.idx_buf_pg_sz; ++ ret = hns_roce_mtt_init(hr_dev, buf->npages, buf->page_shift, ++ &srq->idx_que.mtt); + if (ret) { + dev_err(hr_dev->dev, "hns_roce_mtt_init error for idx que\n"); + goto err_user_idx_mtt; +diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c +index dc71b6e16a07..b462eaca1ee3 100644 +--- a/drivers/infiniband/hw/qedr/main.c ++++ b/drivers/infiniband/hw/qedr/main.c +@@ -357,6 +357,7 @@ static int qedr_alloc_resources(struct qedr_dev *dev) + return -ENOMEM; + + spin_lock_init(&dev->sgid_lock); ++ xa_init_flags(&dev->srqs, XA_FLAGS_LOCK_IRQ); + + if (IS_IWARP(dev)) { + xa_init_flags(&dev->qps, XA_FLAGS_LOCK_IRQ); +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 6f3ce86019b7..a7ccca3c4f89 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1577,6 +1577,14 @@ static void qedr_cleanup_user(struct qedr_dev *dev, struct qedr_qp *qp) + + ib_umem_release(qp->urq.umem); + qp->urq.umem = NULL; ++ ++ if (rdma_protocol_roce(&dev->ibdev, 1)) { ++ qedr_free_pbl(dev, &qp->usq.pbl_info, qp->usq.pbl_tbl); ++ qedr_free_pbl(dev, &qp->urq.pbl_info, qp->urq.pbl_tbl); ++ } else { ++ kfree(qp->usq.pbl_tbl); ++ kfree(qp->urq.pbl_tbl); ++ } + } + + static int qedr_create_user_qp(struct qedr_dev *dev, +@@ -2673,8 +2681,8 @@ int qedr_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata) + + dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid); + +- if ((mr->type != QEDR_MR_DMA) && (mr->type != QEDR_MR_FRMR)) +- qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table); ++ if (mr->type != QEDR_MR_DMA) ++ free_mr_info(dev, &mr->info); + + /* it could be user registered memory. */ + ib_umem_release(mr->umem); +diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c +index 05a92f997f60..fb01407a310f 100644 +--- a/drivers/infiniband/sw/siw/siw_main.c ++++ b/drivers/infiniband/sw/siw/siw_main.c +@@ -248,24 +248,6 @@ static struct ib_qp *siw_get_base_qp(struct ib_device *base_dev, int id) + return NULL; + } + +-static void siw_verbs_sq_flush(struct ib_qp *base_qp) +-{ +- struct siw_qp *qp = to_siw_qp(base_qp); +- +- down_write(&qp->state_lock); +- siw_sq_flush(qp); +- up_write(&qp->state_lock); +-} +- +-static void siw_verbs_rq_flush(struct ib_qp *base_qp) +-{ +- struct siw_qp *qp = to_siw_qp(base_qp); +- +- down_write(&qp->state_lock); +- siw_rq_flush(qp); +- up_write(&qp->state_lock); +-} +- + static const struct ib_device_ops siw_device_ops = { + .owner = THIS_MODULE, + .uverbs_abi_ver = SIW_ABI_VERSION, +@@ -284,8 +266,6 @@ static const struct ib_device_ops siw_device_ops = { + .destroy_cq = siw_destroy_cq, + .destroy_qp = siw_destroy_qp, + .destroy_srq = siw_destroy_srq, +- .drain_rq = siw_verbs_rq_flush, +- .drain_sq = siw_verbs_sq_flush, + .get_dma_mr = siw_get_dma_mr, + .get_port_immutable = siw_get_port_immutable, + .iw_accept = siw_accept, +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index b18a677832e1..1b1a40db529c 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -685,6 +685,47 @@ static int siw_copy_inline_sgl(const struct ib_send_wr *core_wr, + return bytes; + } + ++/* Complete SQ WR's without processing */ ++static int siw_sq_flush_wr(struct siw_qp *qp, const struct ib_send_wr *wr, ++ const struct ib_send_wr **bad_wr) ++{ ++ struct siw_sqe sqe = {}; ++ int rv = 0; ++ ++ while (wr) { ++ sqe.id = wr->wr_id; ++ sqe.opcode = wr->opcode; ++ rv = siw_sqe_complete(qp, &sqe, 0, SIW_WC_WR_FLUSH_ERR); ++ if (rv) { ++ if (bad_wr) ++ *bad_wr = wr; ++ break; ++ } ++ wr = wr->next; ++ } ++ return rv; ++} ++ ++/* Complete RQ WR's without processing */ ++static int siw_rq_flush_wr(struct siw_qp *qp, const struct ib_recv_wr *wr, ++ const struct ib_recv_wr **bad_wr) ++{ ++ struct siw_rqe rqe = {}; ++ int rv = 0; ++ ++ while (wr) { ++ rqe.id = wr->wr_id; ++ rv = siw_rqe_complete(qp, &rqe, 0, 0, SIW_WC_WR_FLUSH_ERR); ++ if (rv) { ++ if (bad_wr) ++ *bad_wr = wr; ++ break; ++ } ++ wr = wr->next; ++ } ++ return rv; ++} ++ + /* + * siw_post_send() + * +@@ -703,26 +744,54 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + unsigned long flags; + int rv = 0; + ++ if (wr && !qp->kernel_verbs) { ++ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); ++ *bad_wr = wr; ++ return -EINVAL; ++ } ++ + /* + * Try to acquire QP state lock. Must be non-blocking + * to accommodate kernel clients needs. + */ + if (!down_read_trylock(&qp->state_lock)) { +- *bad_wr = wr; +- siw_dbg_qp(qp, "QP locked, state %d\n", qp->attrs.state); +- return -ENOTCONN; ++ if (qp->attrs.state == SIW_QP_STATE_ERROR) { ++ /* ++ * ERROR state is final, so we can be sure ++ * this state will not change as long as the QP ++ * exists. ++ * ++ * This handles an ib_drain_sq() call with ++ * a concurrent request to set the QP state ++ * to ERROR. ++ */ ++ rv = siw_sq_flush_wr(qp, wr, bad_wr); ++ } else { ++ siw_dbg_qp(qp, "QP locked, state %d\n", ++ qp->attrs.state); ++ *bad_wr = wr; ++ rv = -ENOTCONN; ++ } ++ return rv; + } + if (unlikely(qp->attrs.state != SIW_QP_STATE_RTS)) { ++ if (qp->attrs.state == SIW_QP_STATE_ERROR) { ++ /* ++ * Immediately flush this WR to CQ, if QP ++ * is in ERROR state. SQ is guaranteed to ++ * be empty, so WR complets in-order. ++ * ++ * Typically triggered by ib_drain_sq(). ++ */ ++ rv = siw_sq_flush_wr(qp, wr, bad_wr); ++ } else { ++ siw_dbg_qp(qp, "QP out of state %d\n", ++ qp->attrs.state); ++ *bad_wr = wr; ++ rv = -ENOTCONN; ++ } + up_read(&qp->state_lock); +- *bad_wr = wr; +- siw_dbg_qp(qp, "QP out of state %d\n", qp->attrs.state); +- return -ENOTCONN; +- } +- if (wr && !qp->kernel_verbs) { +- siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +- up_read(&qp->state_lock); +- *bad_wr = wr; +- return -EINVAL; ++ return rv; + } + spin_lock_irqsave(&qp->sq_lock, flags); + +@@ -917,24 +986,54 @@ int siw_post_receive(struct ib_qp *base_qp, const struct ib_recv_wr *wr, + *bad_wr = wr; + return -EOPNOTSUPP; /* what else from errno.h? */ + } ++ if (!qp->kernel_verbs) { ++ siw_dbg_qp(qp, "no kernel post_recv for user mapped sq\n"); ++ *bad_wr = wr; ++ return -EINVAL; ++ } ++ + /* + * Try to acquire QP state lock. Must be non-blocking + * to accommodate kernel clients needs. + */ + if (!down_read_trylock(&qp->state_lock)) { +- *bad_wr = wr; +- return -ENOTCONN; +- } +- if (!qp->kernel_verbs) { +- siw_dbg_qp(qp, "no kernel post_recv for user mapped sq\n"); +- up_read(&qp->state_lock); +- *bad_wr = wr; +- return -EINVAL; ++ if (qp->attrs.state == SIW_QP_STATE_ERROR) { ++ /* ++ * ERROR state is final, so we can be sure ++ * this state will not change as long as the QP ++ * exists. ++ * ++ * This handles an ib_drain_rq() call with ++ * a concurrent request to set the QP state ++ * to ERROR. ++ */ ++ rv = siw_rq_flush_wr(qp, wr, bad_wr); ++ } else { ++ siw_dbg_qp(qp, "QP locked, state %d\n", ++ qp->attrs.state); ++ *bad_wr = wr; ++ rv = -ENOTCONN; ++ } ++ return rv; + } + if (qp->attrs.state > SIW_QP_STATE_RTS) { ++ if (qp->attrs.state == SIW_QP_STATE_ERROR) { ++ /* ++ * Immediately flush this WR to CQ, if QP ++ * is in ERROR state. RQ is guaranteed to ++ * be empty, so WR complets in-order. ++ * ++ * Typically triggered by ib_drain_rq(). ++ */ ++ rv = siw_rq_flush_wr(qp, wr, bad_wr); ++ } else { ++ siw_dbg_qp(qp, "QP out of state %d\n", ++ qp->attrs.state); ++ *bad_wr = wr; ++ rv = -ENOTCONN; ++ } + up_read(&qp->state_lock); +- *bad_wr = wr; +- return -EINVAL; ++ return rv; + } + /* + * Serialize potentially multiple producers. +diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c +index 2e72fc5af157..c4c015c60446 100644 +--- a/drivers/infiniband/ulp/iser/iscsi_iser.c ++++ b/drivers/infiniband/ulp/iser/iscsi_iser.c +@@ -646,6 +646,7 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, + if (ib_conn->pi_support) { + u32 sig_caps = ib_dev->attrs.sig_prot_cap; + ++ shost->sg_prot_tablesize = shost->sg_tablesize; + scsi_host_set_prot(shost, iser_dif_prot_caps(sig_caps)); + scsi_host_set_guard(shost, SHOST_DIX_GUARD_IP | + SHOST_DIX_GUARD_CRC); +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 6db6d969e31c..4ce797d4259f 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -5447,9 +5447,6 @@ static int intel_iommu_map(struct iommu_domain *domain, + int prot = 0; + int ret; + +- if (dmar_domain->flags & DOMAIN_FLAG_LOSE_CHILDREN) +- return -EINVAL; +- + if (iommu_prot & IOMMU_READ) + prot |= DMA_PTE_READ; + if (iommu_prot & IOMMU_WRITE) +@@ -5492,8 +5489,6 @@ static size_t intel_iommu_unmap(struct iommu_domain *domain, + /* Cope with horrid API which requires us to unmap more than the + size argument if it happens to be a large-page mapping. */ + BUG_ON(!pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level)); +- if (dmar_domain->flags & DOMAIN_FLAG_LOSE_CHILDREN) +- return 0; + + if (size < VTD_PAGE_SIZE << level_to_offset_bits(level)) + size = VTD_PAGE_SIZE << level_to_offset_bits(level); +@@ -5525,9 +5520,6 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain, + int level = 0; + u64 phys = 0; + +- if (dmar_domain->flags & DOMAIN_FLAG_LOSE_CHILDREN) +- return 0; +- + pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level); + if (pte) + phys = dma_pte_addr(pte); +@@ -5705,8 +5697,8 @@ static void intel_iommu_get_resv_regions(struct device *device, + struct pci_dev *pdev = to_pci_dev(device); + + if ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA) { +- reg = iommu_alloc_resv_region(0, 1UL << 24, 0, +- IOMMU_RESV_DIRECT); ++ reg = iommu_alloc_resv_region(0, 1UL << 24, prot, ++ IOMMU_RESV_DIRECT_RELAXABLE); + if (reg) + list_add_tail(®->list, head); + } +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index d658c7c6a2ab..24248aa8a7e5 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -312,8 +312,8 @@ int iommu_insert_resv_region(struct iommu_resv_region *new, + list_for_each_entry_safe(iter, tmp, regions, list) { + phys_addr_t top_end, iter_end = iter->start + iter->length - 1; + +- /* no merge needed on elements of different types than @nr */ +- if (iter->type != nr->type) { ++ /* no merge needed on elements of different types than @new */ ++ if (iter->type != new->type) { + list_move_tail(&iter->list, &stack); + continue; + } +@@ -2221,13 +2221,13 @@ request_default_domain_for_dev(struct device *dev, unsigned long type) + goto out; + } + +- iommu_group_create_direct_mappings(group, dev); +- + /* Make the domain the default for this group */ + if (group->default_domain) + iommu_domain_free(group->default_domain); + group->default_domain = domain; + ++ iommu_group_create_direct_mappings(group, dev); ++ + dev_info(dev, "Using iommu %s mapping\n", + type == IOMMU_DOMAIN_DMA ? "dma" : "direct"); + +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c +index 6f776823b9ba..a1df0d95151c 100644 +--- a/drivers/md/bcache/alloc.c ++++ b/drivers/md/bcache/alloc.c +@@ -377,7 +377,10 @@ retry_invalidate: + if (!fifo_full(&ca->free_inc)) + goto retry_invalidate; + +- bch_prio_write(ca); ++ if (bch_prio_write(ca, false) < 0) { ++ ca->invalidate_needs_gc = 1; ++ wake_up_gc(ca->set); ++ } + } + } + out: +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h +index 013e35a9e317..deb924e1d790 100644 +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -977,7 +977,7 @@ bool bch_cached_dev_error(struct cached_dev *dc); + __printf(2, 3) + bool bch_cache_set_error(struct cache_set *c, const char *fmt, ...); + +-void bch_prio_write(struct cache *ca); ++int bch_prio_write(struct cache *ca, bool wait); + void bch_write_bdev_super(struct cached_dev *dc, struct closure *parent); + + extern struct workqueue_struct *bcache_wq; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 20ed838e9413..64999c7a8033 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -529,12 +529,29 @@ static void prio_io(struct cache *ca, uint64_t bucket, int op, + closure_sync(cl); + } + +-void bch_prio_write(struct cache *ca) ++int bch_prio_write(struct cache *ca, bool wait) + { + int i; + struct bucket *b; + struct closure cl; + ++ pr_debug("free_prio=%zu, free_none=%zu, free_inc=%zu", ++ fifo_used(&ca->free[RESERVE_PRIO]), ++ fifo_used(&ca->free[RESERVE_NONE]), ++ fifo_used(&ca->free_inc)); ++ ++ /* ++ * Pre-check if there are enough free buckets. In the non-blocking ++ * scenario it's better to fail early rather than starting to allocate ++ * buckets and do a cleanup later in case of failure. ++ */ ++ if (!wait) { ++ size_t avail = fifo_used(&ca->free[RESERVE_PRIO]) + ++ fifo_used(&ca->free[RESERVE_NONE]); ++ if (prio_buckets(ca) > avail) ++ return -ENOMEM; ++ } ++ + closure_init_stack(&cl); + + lockdep_assert_held(&ca->set->bucket_lock); +@@ -544,9 +561,6 @@ void bch_prio_write(struct cache *ca) + atomic_long_add(ca->sb.bucket_size * prio_buckets(ca), + &ca->meta_sectors_written); + +- //pr_debug("free %zu, free_inc %zu, unused %zu", fifo_used(&ca->free), +- // fifo_used(&ca->free_inc), fifo_used(&ca->unused)); +- + for (i = prio_buckets(ca) - 1; i >= 0; --i) { + long bucket; + struct prio_set *p = ca->disk_buckets; +@@ -564,7 +578,7 @@ void bch_prio_write(struct cache *ca) + p->magic = pset_magic(&ca->sb); + p->csum = bch_crc64(&p->magic, bucket_bytes(ca) - 8); + +- bucket = bch_bucket_alloc(ca, RESERVE_PRIO, true); ++ bucket = bch_bucket_alloc(ca, RESERVE_PRIO, wait); + BUG_ON(bucket == -1); + + mutex_unlock(&ca->set->bucket_lock); +@@ -593,6 +607,7 @@ void bch_prio_write(struct cache *ca) + + ca->prio_last_buckets[i] = ca->prio_buckets[i]; + } ++ return 0; + } + + static void prio_read(struct cache *ca, uint64_t bucket) +@@ -761,20 +776,28 @@ static inline int idx_to_first_minor(int idx) + + static void bcache_device_free(struct bcache_device *d) + { ++ struct gendisk *disk = d->disk; ++ + lockdep_assert_held(&bch_register_lock); + +- pr_info("%s stopped", d->disk->disk_name); ++ if (disk) ++ pr_info("%s stopped", disk->disk_name); ++ else ++ pr_err("bcache device (NULL gendisk) stopped"); + + if (d->c) + bcache_device_detach(d); +- if (d->disk && d->disk->flags & GENHD_FL_UP) +- del_gendisk(d->disk); +- if (d->disk && d->disk->queue) +- blk_cleanup_queue(d->disk->queue); +- if (d->disk) { ++ ++ if (disk) { ++ if (disk->flags & GENHD_FL_UP) ++ del_gendisk(disk); ++ ++ if (disk->queue) ++ blk_cleanup_queue(disk->queue); ++ + ida_simple_remove(&bcache_device_idx, +- first_minor_to_idx(d->disk->first_minor)); +- put_disk(d->disk); ++ first_minor_to_idx(disk->first_minor)); ++ put_disk(disk); + } + + bioset_exit(&d->bio_split); +@@ -1954,7 +1977,7 @@ static int run_cache_set(struct cache_set *c) + + mutex_lock(&c->bucket_lock); + for_each_cache(ca, c, i) +- bch_prio_write(ca); ++ bch_prio_write(ca, true); + mutex_unlock(&c->bucket_lock); + + err = "cannot allocate new UUID bucket"; +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index b092c7b5282f..3ad18246fcb3 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2139,6 +2139,7 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks, + memcpy(page_address(store.sb_page), + page_address(bitmap->storage.sb_page), + sizeof(bitmap_super_t)); ++ spin_lock_irq(&bitmap->counts.lock); + md_bitmap_file_unmap(&bitmap->storage); + bitmap->storage = store; + +@@ -2154,7 +2155,6 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks, + blocks = min(old_counts.chunks << old_counts.chunkshift, + chunks << chunkshift); + +- spin_lock_irq(&bitmap->counts.lock); + /* For cluster raid, need to pre-allocate bitmap */ + if (mddev_is_clustered(bitmap->mddev)) { + unsigned long page; +diff --git a/drivers/md/md.c b/drivers/md/md.c +index b8dd56b746da..805b33e27496 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1105,6 +1105,7 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor + char b[BDEVNAME_SIZE], b2[BDEVNAME_SIZE]; + mdp_super_t *sb; + int ret; ++ bool spare_disk = true; + + /* + * Calculate the position of the superblock (512byte sectors), +@@ -1155,8 +1156,18 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor + else + rdev->desc_nr = sb->this_disk.number; + ++ /* not spare disk, or LEVEL_MULTIPATH */ ++ if (sb->level == LEVEL_MULTIPATH || ++ (rdev->desc_nr >= 0 && ++ sb->disks[rdev->desc_nr].state & ++ ((1<sb_page); +@@ -1172,7 +1183,8 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor + } + ev1 = md_event(sb); + ev2 = md_event(refsb); +- if (ev1 > ev2) ++ ++ if (!spare_disk && ev1 > ev2) + ret = 1; + else + ret = 0; +@@ -1532,6 +1544,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ + sector_t sectors; + char b[BDEVNAME_SIZE], b2[BDEVNAME_SIZE]; + int bmask; ++ bool spare_disk = true; + + /* + * Calculate the position of the superblock in 512byte sectors. +@@ -1665,8 +1678,19 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ + sb->level != 0) + return -EINVAL; + ++ /* not spare disk, or LEVEL_MULTIPATH */ ++ if (sb->level == cpu_to_le32(LEVEL_MULTIPATH) || ++ (rdev->desc_nr >= 0 && ++ rdev->desc_nr < le32_to_cpu(sb->max_dev) && ++ (le16_to_cpu(sb->dev_roles[rdev->desc_nr]) < MD_DISK_ROLE_MAX || ++ le16_to_cpu(sb->dev_roles[rdev->desc_nr]) == MD_DISK_ROLE_JOURNAL))) ++ spare_disk = false; ++ + if (!refdev) { +- ret = 1; ++ if (!spare_disk) ++ ret = 1; ++ else ++ ret = 0; + } else { + __u64 ev1, ev2; + struct mdp_superblock_1 *refsb = page_address(refdev->sb_page); +@@ -1683,7 +1707,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ + ev1 = le64_to_cpu(sb->events); + ev2 = le64_to_cpu(refsb->events); + +- if (ev1 > ev2) ++ if (!spare_disk && ev1 > ev2) + ret = 1; + else + ret = 0; +@@ -3604,7 +3628,7 @@ abort_free: + * Check a full RAID array for plausibility + */ + +-static void analyze_sbs(struct mddev *mddev) ++static int analyze_sbs(struct mddev *mddev) + { + int i; + struct md_rdev *rdev, *freshest, *tmp; +@@ -3625,6 +3649,12 @@ static void analyze_sbs(struct mddev *mddev) + md_kick_rdev_from_array(rdev); + } + ++ /* Cannot find a valid fresh disk */ ++ if (!freshest) { ++ pr_warn("md: cannot find a valid disk\n"); ++ return -EINVAL; ++ } ++ + super_types[mddev->major_version]. + validate_super(mddev, freshest); + +@@ -3659,6 +3689,8 @@ static void analyze_sbs(struct mddev *mddev) + clear_bit(In_sync, &rdev->flags); + } + } ++ ++ return 0; + } + + /* Read a fixed-point number. +@@ -5577,7 +5609,9 @@ int md_run(struct mddev *mddev) + if (!mddev->raid_disks) { + if (!mddev->persistent) + return -EINVAL; +- analyze_sbs(mddev); ++ err = analyze_sbs(mddev); ++ if (err) ++ return -EINVAL; + } + + if (mddev->level != LEVEL_NONE) +diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig +index 7eee1812bba3..fcffcc31d168 100644 +--- a/drivers/media/i2c/Kconfig ++++ b/drivers/media/i2c/Kconfig +@@ -1113,6 +1113,7 @@ comment "SDR tuner chips" + config SDR_MAX2175 + tristate "Maxim 2175 RF to Bits tuner" + depends on VIDEO_V4L2 && MEDIA_SDR_SUPPORT && I2C ++ select REGMAP_I2C + help + Support for Maxim 2175 tuner. It is an advanced analog/digital + radio receiver with RF-to-Bits front-end designed for SDR solutions. +diff --git a/drivers/media/i2c/ad5820.c b/drivers/media/i2c/ad5820.c +index 925c171e7797..7a49651f4d1f 100644 +--- a/drivers/media/i2c/ad5820.c ++++ b/drivers/media/i2c/ad5820.c +@@ -309,6 +309,7 @@ static int ad5820_probe(struct i2c_client *client, + v4l2_i2c_subdev_init(&coil->subdev, client, &ad5820_ops); + coil->subdev.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE; + coil->subdev.internal_ops = &ad5820_internal_ops; ++ coil->subdev.entity.function = MEDIA_ENT_F_LENS; + strscpy(coil->subdev.name, "ad5820 focus", sizeof(coil->subdev.name)); + + ret = media_entity_pads_init(&coil->subdev.entity, 0, NULL); +diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c +index f4ded0669ff9..e1ff38009cf0 100644 +--- a/drivers/media/i2c/ov2659.c ++++ b/drivers/media/i2c/ov2659.c +@@ -419,10 +419,14 @@ static struct sensor_register ov2659_720p[] = { + { REG_TIMING_YINC, 0x11 }, + { REG_TIMING_VERT_FORMAT, 0x80 }, + { REG_TIMING_HORIZ_FORMAT, 0x00 }, ++ { 0x370a, 0x12 }, + { 0x3a03, 0xe8 }, + { 0x3a09, 0x6f }, + { 0x3a0b, 0x5d }, + { 0x3a15, 0x9a }, ++ { REG_VFIFO_READ_START_H, 0x00 }, ++ { REG_VFIFO_READ_START_L, 0x80 }, ++ { REG_ISP_CTRL02, 0x00 }, + { REG_NULL, 0x00 }, + }; + +@@ -1201,11 +1205,15 @@ static int ov2659_s_stream(struct v4l2_subdev *sd, int on) + goto unlock; + } + +- ov2659_set_pixel_clock(ov2659); +- ov2659_set_frame_size(ov2659); +- ov2659_set_format(ov2659); +- ov2659_set_streaming(ov2659, 1); +- ov2659->streaming = on; ++ ret = ov2659_set_pixel_clock(ov2659); ++ if (!ret) ++ ret = ov2659_set_frame_size(ov2659); ++ if (!ret) ++ ret = ov2659_set_format(ov2659); ++ if (!ret) { ++ ov2659_set_streaming(ov2659, 1); ++ ov2659->streaming = on; ++ } + + unlock: + mutex_unlock(&ov2659->lock); +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 500d9bbff10b..18dd2d717088 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -1611,6 +1611,11 @@ ov5640_find_mode(struct ov5640_dev *sensor, enum ov5640_frame_rate fr, + !(mode->hact == 640 && mode->vact == 480)) + return NULL; + ++ /* 2592x1944 only works at 15fps max */ ++ if ((mode->hact == 2592 && mode->vact == 1944) && ++ fr > OV5640_15_FPS) ++ return NULL; ++ + return mode; + } + +diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c +index 5b9af5e5b7f1..a5b2448c0abc 100644 +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -130,6 +130,7 @@ + #define CLKRC_24MHz 0xc0 + #define CLKRC_DIV_MASK 0x3f + #define GET_CLKRC_DIV(x) (((x) & CLKRC_DIV_MASK) + 1) ++#define DEF_CLKRC 0x00 + + #define COMA_RESET BIT(7) + #define COMA_QCIF BIT(5) +@@ -465,38 +466,39 @@ static int ov6650_set_selection(struct v4l2_subdev *sd, + { + struct i2c_client *client = v4l2_get_subdevdata(sd); + struct ov6650 *priv = to_ov6650(client); +- struct v4l2_rect rect = sel->r; + int ret; + + if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE || + sel->target != V4L2_SEL_TGT_CROP) + return -EINVAL; + +- v4l_bound_align_image(&rect.width, 2, W_CIF, 1, +- &rect.height, 2, H_CIF, 1, 0); +- v4l_bound_align_image(&rect.left, DEF_HSTRT << 1, +- (DEF_HSTRT << 1) + W_CIF - (__s32)rect.width, 1, +- &rect.top, DEF_VSTRT << 1, +- (DEF_VSTRT << 1) + H_CIF - (__s32)rect.height, 1, +- 0); ++ v4l_bound_align_image(&sel->r.width, 2, W_CIF, 1, ++ &sel->r.height, 2, H_CIF, 1, 0); ++ v4l_bound_align_image(&sel->r.left, DEF_HSTRT << 1, ++ (DEF_HSTRT << 1) + W_CIF - (__s32)sel->r.width, 1, ++ &sel->r.top, DEF_VSTRT << 1, ++ (DEF_VSTRT << 1) + H_CIF - (__s32)sel->r.height, ++ 1, 0); + +- ret = ov6650_reg_write(client, REG_HSTRT, rect.left >> 1); ++ ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1); + if (!ret) { +- priv->rect.left = rect.left; ++ priv->rect.width += priv->rect.left - sel->r.left; ++ priv->rect.left = sel->r.left; + ret = ov6650_reg_write(client, REG_HSTOP, +- (rect.left + rect.width) >> 1); ++ (sel->r.left + sel->r.width) >> 1); + } + if (!ret) { +- priv->rect.width = rect.width; +- ret = ov6650_reg_write(client, REG_VSTRT, rect.top >> 1); ++ priv->rect.width = sel->r.width; ++ ret = ov6650_reg_write(client, REG_VSTRT, sel->r.top >> 1); + } + if (!ret) { +- priv->rect.top = rect.top; ++ priv->rect.height += priv->rect.top - sel->r.top; ++ priv->rect.top = sel->r.top; + ret = ov6650_reg_write(client, REG_VSTOP, +- (rect.top + rect.height) >> 1); ++ (sel->r.top + sel->r.height) >> 1); + } + if (!ret) +- priv->rect.height = rect.height; ++ priv->rect.height = sel->r.height; + + return ret; + } +@@ -610,7 +612,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + dev_err(&client->dev, "Pixel format not handled: 0x%x\n", code); + return -EINVAL; + } +- priv->code = code; + + if (code == MEDIA_BUS_FMT_Y8_1X8 || + code == MEDIA_BUS_FMT_SBGGR8_1X8) { +@@ -636,7 +637,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + dev_dbg(&client->dev, "max resolution: CIF\n"); + coma_mask |= COMA_QCIF; + } +- priv->half_scale = half_scale; + + clkrc = CLKRC_12MHz; + mclk = 12000000; +@@ -654,8 +654,13 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask); + if (!ret) + ret = ov6650_reg_write(client, REG_CLKRC, clkrc); +- if (!ret) ++ if (!ret) { ++ priv->half_scale = half_scale; ++ + ret = ov6650_reg_rmw(client, REG_COML, coml_set, coml_mask); ++ } ++ if (!ret) ++ priv->code = code; + + if (!ret) { + mf->colorspace = priv->colorspace; +@@ -754,19 +759,17 @@ static int ov6650_s_frame_interval(struct v4l2_subdev *sd, + else if (div > GET_CLKRC_DIV(CLKRC_DIV_MASK)) + div = GET_CLKRC_DIV(CLKRC_DIV_MASK); + +- /* +- * Keep result to be used as tpf limit +- * for subsequent clock divider calculations +- */ +- priv->tpf.numerator = div; +- priv->tpf.denominator = FRAME_RATE_MAX; ++ tpf->numerator = div; ++ tpf->denominator = FRAME_RATE_MAX; + +- clkrc = to_clkrc(&priv->tpf, priv->pclk_limit, priv->pclk_max); ++ clkrc = to_clkrc(tpf, priv->pclk_limit, priv->pclk_max); + + ret = ov6650_reg_rmw(client, REG_CLKRC, clkrc, CLKRC_DIV_MASK); + if (!ret) { +- tpf->numerator = GET_CLKRC_DIV(clkrc); +- tpf->denominator = FRAME_RATE_MAX; ++ priv->tpf.numerator = GET_CLKRC_DIV(clkrc); ++ priv->tpf.denominator = FRAME_RATE_MAX; ++ ++ *tpf = priv->tpf; + } + + return ret; +@@ -989,8 +992,10 @@ static int ov6650_probe(struct i2c_client *client, + V4L2_CID_GAMMA, 0, 0xff, 1, 0x12); + + priv->subdev.ctrl_handler = &priv->hdl; +- if (priv->hdl.error) +- return priv->hdl.error; ++ if (priv->hdl.error) { ++ ret = priv->hdl.error; ++ goto ectlhdlfree; ++ } + + v4l2_ctrl_auto_cluster(2, &priv->autogain, 0, true); + v4l2_ctrl_auto_cluster(3, &priv->autowb, 0, true); +@@ -1005,11 +1010,17 @@ static int ov6650_probe(struct i2c_client *client, + priv->code = MEDIA_BUS_FMT_YUYV8_2X8; + priv->colorspace = V4L2_COLORSPACE_JPEG; + ++ /* Hardware default frame interval */ ++ priv->tpf.numerator = GET_CLKRC_DIV(DEF_CLKRC); ++ priv->tpf.denominator = FRAME_RATE_MAX; ++ + priv->subdev.internal_ops = &ov6650_internal_ops; + + ret = v4l2_async_register_subdev(&priv->subdev); +- if (ret) +- v4l2_ctrl_handler_free(&priv->hdl); ++ if (!ret) ++ return 0; ++ectlhdlfree: ++ v4l2_ctrl_handler_free(&priv->hdl); + + return ret; + } +diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c +index 9adf8e034e7d..42805dfbffeb 100644 +--- a/drivers/media/i2c/smiapp/smiapp-core.c ++++ b/drivers/media/i2c/smiapp/smiapp-core.c +@@ -3101,19 +3101,23 @@ static int smiapp_probe(struct i2c_client *client) + if (rval < 0) + goto out_media_entity_cleanup; + +- rval = v4l2_async_register_subdev_sensor_common(&sensor->src->sd); +- if (rval < 0) +- goto out_media_entity_cleanup; +- + pm_runtime_set_active(&client->dev); + pm_runtime_get_noresume(&client->dev); + pm_runtime_enable(&client->dev); ++ ++ rval = v4l2_async_register_subdev_sensor_common(&sensor->src->sd); ++ if (rval < 0) ++ goto out_disable_runtime_pm; ++ + pm_runtime_set_autosuspend_delay(&client->dev, 1000); + pm_runtime_use_autosuspend(&client->dev); + pm_runtime_put_autosuspend(&client->dev); + + return 0; + ++out_disable_runtime_pm: ++ pm_runtime_disable(&client->dev); ++ + out_media_entity_cleanup: + media_entity_cleanup(&sensor->src->sd.entity); + +diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c +index 81285b8d5cfb..003ba22334cd 100644 +--- a/drivers/media/i2c/st-mipid02.c ++++ b/drivers/media/i2c/st-mipid02.c +@@ -971,6 +971,11 @@ static int mipid02_probe(struct i2c_client *client) + bridge->reset_gpio = devm_gpiod_get_optional(dev, "reset", + GPIOD_OUT_HIGH); + ++ if (IS_ERR(bridge->reset_gpio)) { ++ dev_err(dev, "failed to get reset GPIO\n"); ++ return PTR_ERR(bridge->reset_gpio); ++ } ++ + ret = mipid02_get_regulators(bridge); + if (ret) { + dev_err(dev, "failed to get regulators %d", ret); +diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c +index dcc0f02aeb70..b8abcd550604 100644 +--- a/drivers/media/pci/cx88/cx88-video.c ++++ b/drivers/media/pci/cx88/cx88-video.c +@@ -1277,7 +1277,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + core = cx88_core_get(dev->pci); + if (!core) { + err = -EINVAL; +- goto fail_free; ++ goto fail_disable; + } + dev->core = core; + +@@ -1323,7 +1323,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + cc->step, cc->default_value); + if (!vc) { + err = core->audio_hdl.error; +- goto fail_core; ++ goto fail_irq; + } + vc->priv = (void *)cc; + } +@@ -1337,7 +1337,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + cc->step, cc->default_value); + if (!vc) { + err = core->video_hdl.error; +- goto fail_core; ++ goto fail_irq; + } + vc->priv = (void *)cc; + if (vc->id == V4L2_CID_CHROMA_AGC) +@@ -1509,11 +1509,14 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + + fail_unreg: + cx8800_unregister_video(dev); +- free_irq(pci_dev->irq, dev); + mutex_unlock(&core->lock); ++fail_irq: ++ free_irq(pci_dev->irq, dev); + fail_core: + core->v4ldev = NULL; + cx88_core_put(core, dev->pci); ++fail_disable: ++ pci_disable_device(pci_dev); + fail_free: + kfree(dev); + return err; +diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c +index 2b42ba1f5949..e13dbf27a9c2 100644 +--- a/drivers/media/platform/am437x/am437x-vpfe.c ++++ b/drivers/media/platform/am437x/am437x-vpfe.c +@@ -1830,6 +1830,10 @@ static int vpfe_s_std(struct file *file, void *priv, v4l2_std_id std_id) + if (!(sdinfo->inputs[0].capabilities & V4L2_IN_CAP_STD)) + return -ENODATA; + ++ /* if trying to set the same std then nothing to do */ ++ if (vpfe_standards[vpfe->std_index].std_id == std_id) ++ return 0; ++ + /* If streaming is started, return error */ + if (vb2_is_busy(&vpfe->buffer_queue)) { + vpfe_err(vpfe, "%s device busy\n", __func__); +diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c +index eb12f3793062..096a7c9a8963 100644 +--- a/drivers/media/platform/aspeed-video.c ++++ b/drivers/media/platform/aspeed-video.c +@@ -606,6 +606,16 @@ static irqreturn_t aspeed_video_irq(int irq, void *arg) + aspeed_video_start_frame(video); + } + ++ /* ++ * CAPTURE_COMPLETE and FRAME_COMPLETE interrupts come even when these ++ * are disabled in the VE_INTERRUPT_CTRL register so clear them to ++ * prevent unnecessary interrupt calls. ++ */ ++ if (sts & VE_INTERRUPT_CAPTURE_COMPLETE) ++ sts &= ~VE_INTERRUPT_CAPTURE_COMPLETE; ++ if (sts & VE_INTERRUPT_FRAME_COMPLETE) ++ sts &= ~VE_INTERRUPT_FRAME_COMPLETE; ++ + return sts ? IRQ_NONE : IRQ_HANDLED; + } + +@@ -741,6 +751,8 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + } + + set_bit(VIDEO_RES_DETECT, &video->flags); ++ aspeed_video_update(video, VE_CTRL, ++ VE_CTRL_VSYNC_POL | VE_CTRL_HSYNC_POL, 0); + aspeed_video_enable_mode_detect(video); + + rc = wait_event_interruptible_timeout(video->wait, +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c +index a838189d4490..9aaf3b8060d5 100644 +--- a/drivers/media/platform/exynos4-is/media-dev.c ++++ b/drivers/media/platform/exynos4-is/media-dev.c +@@ -1457,12 +1457,12 @@ static int fimc_md_probe(struct platform_device *pdev) + ret = v4l2_device_register(dev, &fmd->v4l2_dev); + if (ret < 0) { + v4l2_err(v4l2_dev, "Failed to register v4l2_device: %d\n", ret); +- return ret; ++ goto err_md; + } + + ret = fimc_md_get_clocks(fmd); + if (ret) +- goto err_md; ++ goto err_v4l2dev; + + ret = fimc_md_get_pinctrl(fmd); + if (ret < 0) { +@@ -1519,9 +1519,10 @@ err_m_ent: + fimc_md_unregister_entities(fmd); + err_clk: + fimc_md_put_clocks(fmd); ++err_v4l2dev: ++ v4l2_device_unregister(&fmd->v4l2_dev); + err_md: + media_device_cleanup(&fmd->media_dev); +- v4l2_device_unregister(&fmd->v4l2_dev); + return ret; + } + +diff --git a/drivers/media/platform/meson/ao-cec-g12a.c b/drivers/media/platform/meson/ao-cec-g12a.c +index 3b39e875292e..3d8fe854feb0 100644 +--- a/drivers/media/platform/meson/ao-cec-g12a.c ++++ b/drivers/media/platform/meson/ao-cec-g12a.c +@@ -662,34 +662,27 @@ static int meson_ao_cec_g12a_probe(struct platform_device *pdev) + if (IS_ERR(ao_cec->adap)) + return PTR_ERR(ao_cec->adap); + +- ao_cec->notify = cec_notifier_cec_adap_register(hdmi_dev, NULL, +- ao_cec->adap); +- if (!ao_cec->notify) { +- ret = -ENOMEM; +- goto out_probe_adapter; +- } +- + ao_cec->adap->owner = THIS_MODULE; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(base)) { + ret = PTR_ERR(base); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + ao_cec->regmap = devm_regmap_init_mmio(&pdev->dev, base, + &meson_ao_cec_g12a_regmap_conf); + if (IS_ERR(ao_cec->regmap)) { + ret = PTR_ERR(ao_cec->regmap); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + ao_cec->regmap_cec = devm_regmap_init(&pdev->dev, NULL, ao_cec, + &meson_ao_cec_g12a_cec_regmap_conf); + if (IS_ERR(ao_cec->regmap_cec)) { + ret = PTR_ERR(ao_cec->regmap_cec); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + irq = platform_get_irq(pdev, 0); +@@ -699,45 +692,52 @@ static int meson_ao_cec_g12a_probe(struct platform_device *pdev) + 0, NULL, ao_cec); + if (ret) { + dev_err(&pdev->dev, "irq request failed\n"); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + ao_cec->oscin = devm_clk_get(&pdev->dev, "oscin"); + if (IS_ERR(ao_cec->oscin)) { + dev_err(&pdev->dev, "oscin clock request failed\n"); + ret = PTR_ERR(ao_cec->oscin); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + ret = meson_ao_cec_g12a_setup_clk(ao_cec); + if (ret) +- goto out_probe_notify; ++ goto out_probe_adapter; + + ret = clk_prepare_enable(ao_cec->core); + if (ret) { + dev_err(&pdev->dev, "core clock enable failed\n"); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + device_reset_optional(&pdev->dev); + + platform_set_drvdata(pdev, ao_cec); + ++ ao_cec->notify = cec_notifier_cec_adap_register(hdmi_dev, NULL, ++ ao_cec->adap); ++ if (!ao_cec->notify) { ++ ret = -ENOMEM; ++ goto out_probe_core_clk; ++ } ++ + ret = cec_register_adapter(ao_cec->adap, &pdev->dev); + if (ret < 0) +- goto out_probe_core_clk; ++ goto out_probe_notify; + + /* Setup Hardware */ + regmap_write(ao_cec->regmap, CECB_GEN_CNTL_REG, CECB_GEN_CNTL_RESET); + + return 0; + +-out_probe_core_clk: +- clk_disable_unprepare(ao_cec->core); +- + out_probe_notify: + cec_notifier_cec_adap_unregister(ao_cec->notify); + ++out_probe_core_clk: ++ clk_disable_unprepare(ao_cec->core); ++ + out_probe_adapter: + cec_delete_adapter(ao_cec->adap); + +diff --git a/drivers/media/platform/meson/ao-cec.c b/drivers/media/platform/meson/ao-cec.c +index 64ed549bf012..03600e8b3ef0 100644 +--- a/drivers/media/platform/meson/ao-cec.c ++++ b/drivers/media/platform/meson/ao-cec.c +@@ -624,20 +624,13 @@ static int meson_ao_cec_probe(struct platform_device *pdev) + if (IS_ERR(ao_cec->adap)) + return PTR_ERR(ao_cec->adap); + +- ao_cec->notify = cec_notifier_cec_adap_register(hdmi_dev, NULL, +- ao_cec->adap); +- if (!ao_cec->notify) { +- ret = -ENOMEM; +- goto out_probe_adapter; +- } +- + ao_cec->adap->owner = THIS_MODULE; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + ao_cec->base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(ao_cec->base)) { + ret = PTR_ERR(ao_cec->base); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + irq = platform_get_irq(pdev, 0); +@@ -647,20 +640,20 @@ static int meson_ao_cec_probe(struct platform_device *pdev) + 0, NULL, ao_cec); + if (ret) { + dev_err(&pdev->dev, "irq request failed\n"); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + ao_cec->core = devm_clk_get(&pdev->dev, "core"); + if (IS_ERR(ao_cec->core)) { + dev_err(&pdev->dev, "core clock request failed\n"); + ret = PTR_ERR(ao_cec->core); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + ret = clk_prepare_enable(ao_cec->core); + if (ret) { + dev_err(&pdev->dev, "core clock enable failed\n"); +- goto out_probe_notify; ++ goto out_probe_adapter; + } + + ret = clk_set_rate(ao_cec->core, CEC_CLK_RATE); +@@ -674,9 +667,16 @@ static int meson_ao_cec_probe(struct platform_device *pdev) + ao_cec->pdev = pdev; + platform_set_drvdata(pdev, ao_cec); + ++ ao_cec->notify = cec_notifier_cec_adap_register(hdmi_dev, NULL, ++ ao_cec->adap); ++ if (!ao_cec->notify) { ++ ret = -ENOMEM; ++ goto out_probe_clk; ++ } ++ + ret = cec_register_adapter(ao_cec->adap, &pdev->dev); + if (ret < 0) +- goto out_probe_clk; ++ goto out_probe_notify; + + /* Setup Hardware */ + writel_relaxed(CEC_GEN_CNTL_RESET, +@@ -684,12 +684,12 @@ static int meson_ao_cec_probe(struct platform_device *pdev) + + return 0; + +-out_probe_clk: +- clk_disable_unprepare(ao_cec->core); +- + out_probe_notify: + cec_notifier_cec_adap_unregister(ao_cec->notify); + ++out_probe_clk: ++ clk_disable_unprepare(ao_cec->core); ++ + out_probe_adapter: + cec_delete_adapter(ao_cec->adap); + +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c +index e6eff512a8a1..84e982f259a0 100644 +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -427,10 +427,11 @@ static const struct venus_resources msm8916_res = { + }; + + static const struct freq_tbl msm8996_freq_table[] = { +- { 1944000, 490000000 }, /* 4k UHD @ 60 */ +- { 972000, 320000000 }, /* 4k UHD @ 30 */ +- { 489600, 150000000 }, /* 1080p @ 60 */ +- { 244800, 75000000 }, /* 1080p @ 30 */ ++ { 1944000, 520000000 }, /* 4k UHD @ 60 (decode only) */ ++ { 972000, 520000000 }, /* 4k UHD @ 30 */ ++ { 489600, 346666667 }, /* 1080p @ 60 */ ++ { 244800, 150000000 }, /* 1080p @ 30 */ ++ { 108000, 75000000 }, /* 720p @ 30 */ + }; + + static const struct reg_val msm8996_reg_preset[] = { +diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c +index 7129a2aea09a..0d8855014ab3 100644 +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -1472,6 +1472,7 @@ static int venus_suspend_3xx(struct venus_core *core) + { + struct venus_hfi_device *hdev = to_hfi_priv(core); + struct device *dev = core->dev; ++ u32 ctrl_status; + bool val; + int ret; + +@@ -1487,6 +1488,10 @@ static int venus_suspend_3xx(struct venus_core *core) + return -EINVAL; + } + ++ ctrl_status = venus_readl(hdev, CPU_CS_SCIACMDARG0); ++ if (ctrl_status & CPU_CS_SCIACMDARG0_PC_READY) ++ goto power_off; ++ + /* + * Power collapse sequence for Venus 3xx and 4xx versions: + * 1. Check for ARM9 and video core to be idle by checking WFI bit +@@ -1511,6 +1516,7 @@ static int venus_suspend_3xx(struct venus_core *core) + if (ret) + return ret; + ++power_off: + mutex_lock(&hdev->lock); + + ret = venus_power_off(hdev); +diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c +index 608e5217ccd5..0f267a237b42 100644 +--- a/drivers/media/platform/rcar_drif.c ++++ b/drivers/media/platform/rcar_drif.c +@@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, + { + struct rcar_drif_sdr *sdr = video_drvdata(file); + ++ memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); + f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; + f->fmt.sdr.buffersize = sdr->fmt->buffersize; + +diff --git a/drivers/media/platform/seco-cec/seco-cec.c b/drivers/media/platform/seco-cec/seco-cec.c +index 9cd60fe1867c..a86b6e8f9196 100644 +--- a/drivers/media/platform/seco-cec/seco-cec.c ++++ b/drivers/media/platform/seco-cec/seco-cec.c +@@ -675,6 +675,7 @@ err_notifier: + err_delete_adapter: + cec_delete_adapter(secocec->cec_adap); + err: ++ release_region(BRA_SMB_BASE_ADDR, 7); + dev_err(dev, "%s device probe failed\n", dev_name(dev)); + + return ret; +diff --git a/drivers/media/platform/ti-vpe/vpdma.h b/drivers/media/platform/ti-vpe/vpdma.h +index 28bc94129348..9bacfd603250 100644 +--- a/drivers/media/platform/ti-vpe/vpdma.h ++++ b/drivers/media/platform/ti-vpe/vpdma.h +@@ -57,6 +57,7 @@ struct vpdma_data_format { + * line stride of source and dest + * buffers should be 16 byte aligned + */ ++#define VPDMA_MAX_STRIDE 65520 /* Max line stride 16 byte aligned */ + #define VPDMA_DTD_DESC_SIZE 32 /* 8 words */ + #define VPDMA_CFD_CTD_DESC_SIZE 16 /* 4 words */ + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index 60b575bb44c4..8b14ba4a3d9e 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -338,20 +338,25 @@ enum { + }; + + /* find our format description corresponding to the passed v4l2_format */ +-static struct vpe_fmt *find_format(struct v4l2_format *f) ++static struct vpe_fmt *__find_format(u32 fourcc) + { + struct vpe_fmt *fmt; + unsigned int k; + + for (k = 0; k < ARRAY_SIZE(vpe_formats); k++) { + fmt = &vpe_formats[k]; +- if (fmt->fourcc == f->fmt.pix.pixelformat) ++ if (fmt->fourcc == fourcc) + return fmt; + } + + return NULL; + } + ++static struct vpe_fmt *find_format(struct v4l2_format *f) ++{ ++ return __find_format(f->fmt.pix.pixelformat); ++} ++ + /* + * there is one vpe_dev structure in the driver, it is shared by + * all instances. +@@ -1013,11 +1018,14 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + dma_addr_t dma_addr; + u32 flags = 0; + u32 offset = 0; ++ u32 stride; + + if (port == VPE_PORT_MV_OUT) { + vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; + dma_addr = ctx->mv_buf_dma[mv_buf_selector]; + q_data = &ctx->q_data[Q_DATA_SRC]; ++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, ++ VPDMA_STRIDE_ALIGN); + } else { + /* to incorporate interleaved formats */ + int plane = fmt->coplanar ? p_data->vb_part : 0; +@@ -1044,6 +1052,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + } + /* Apply the offset */ + dma_addr += offset; ++ stride = q_data->bytesperline[VPE_LUMA]; + } + + if (q_data->flags & Q_DATA_FRAME_1D) +@@ -1055,7 +1064,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + MAX_W, MAX_H); + + vpdma_add_out_dtd(&ctx->desc_list, q_data->width, +- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, ++ stride, &q_data->c_rect, + vpdma_fmt, dma_addr, MAX_OUT_WIDTH_REG1, + MAX_OUT_HEIGHT_REG1, p_data->channel, flags); + } +@@ -1074,10 +1083,13 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + dma_addr_t dma_addr; + u32 flags = 0; + u32 offset = 0; ++ u32 stride; + + if (port == VPE_PORT_MV_IN) { + vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; + dma_addr = ctx->mv_buf_dma[mv_buf_selector]; ++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, ++ VPDMA_STRIDE_ALIGN); + } else { + /* to incorporate interleaved formats */ + int plane = fmt->coplanar ? p_data->vb_part : 0; +@@ -1104,6 +1116,7 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + } + /* Apply the offset */ + dma_addr += offset; ++ stride = q_data->bytesperline[VPE_LUMA]; + + if (q_data->flags & Q_DATA_INTERLACED_SEQ_TB) { + /* +@@ -1139,10 +1152,10 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + if (p_data->vb_part && fmt->fourcc == V4L2_PIX_FMT_NV12) + frame_height /= 2; + +- vpdma_add_in_dtd(&ctx->desc_list, q_data->width, +- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, +- vpdma_fmt, dma_addr, p_data->channel, field, flags, frame_width, +- frame_height, 0, 0); ++ vpdma_add_in_dtd(&ctx->desc_list, q_data->width, stride, ++ &q_data->c_rect, vpdma_fmt, dma_addr, ++ p_data->channel, field, flags, frame_width, ++ frame_height, 0, 0); + } + + /* +@@ -1391,9 +1404,6 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + /* the previous dst mv buffer becomes the next src mv buffer */ + ctx->src_mv_buf_selector = !ctx->src_mv_buf_selector; + +- if (ctx->aborting) +- goto finished; +- + s_vb = ctx->src_vbs[0]; + d_vb = ctx->dst_vb; + +@@ -1404,6 +1414,7 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + d_vb->timecode = s_vb->timecode; + + d_vb->sequence = ctx->sequence; ++ s_vb->sequence = ctx->sequence; + + d_q_data = &ctx->q_data[Q_DATA_DST]; + if (d_q_data->flags & Q_IS_INTERLACED) { +@@ -1457,6 +1468,9 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + ctx->src_vbs[0] = NULL; + ctx->dst_vb = NULL; + ++ if (ctx->aborting) ++ goto finished; ++ + ctx->bufs_completed++; + if (ctx->bufs_completed < ctx->bufs_per_job && job_ready(ctx)) { + device_run(ctx); +@@ -1566,9 +1580,9 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + unsigned int stride = 0; + + if (!fmt || !(fmt->types & type)) { +- vpe_err(ctx->dev, "Fourcc format (0x%08x) invalid.\n", ++ vpe_dbg(ctx->dev, "Fourcc format (0x%08x) invalid.\n", + pix->pixelformat); +- return -EINVAL; ++ fmt = __find_format(V4L2_PIX_FMT_YUYV); + } + + if (pix->field != V4L2_FIELD_NONE && pix->field != V4L2_FIELD_ALTERNATE +@@ -1615,7 +1629,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + &pix->height, MIN_H, MAX_H, H_ALIGN, + S_ALIGN); + +- if (!pix->num_planes) ++ if (!pix->num_planes || pix->num_planes > 2) + pix->num_planes = fmt->coplanar ? 2 : 1; + else if (pix->num_planes > 1 && !fmt->coplanar) + pix->num_planes = 1; +@@ -1654,6 +1668,10 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + if (stride > plane_fmt->bytesperline) + plane_fmt->bytesperline = stride; + ++ plane_fmt->bytesperline = clamp_t(u32, plane_fmt->bytesperline, ++ stride, ++ VPDMA_MAX_STRIDE); ++ + plane_fmt->bytesperline = ALIGN(plane_fmt->bytesperline, + VPDMA_STRIDE_ALIGN); + +@@ -2274,7 +2292,7 @@ static int vpe_open(struct file *file) + v4l2_ctrl_handler_setup(hdl); + + s_q_data = &ctx->q_data[Q_DATA_SRC]; +- s_q_data->fmt = &vpe_formats[2]; ++ s_q_data->fmt = __find_format(V4L2_PIX_FMT_YUYV); + s_q_data->width = 1920; + s_q_data->height = 1080; + s_q_data->nplanes = 1; +@@ -2352,6 +2370,12 @@ static int vpe_release(struct file *file) + + mutex_lock(&dev->dev_mutex); + free_mv_buffers(ctx); ++ ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->desc_list.buf); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->mmr_adb); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_h); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_v); ++ + vpdma_free_desc_list(&ctx->desc_list); + vpdma_free_desc_buf(&ctx->mmr_adb); + +diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c +index 0ee143ae0f6b..82350097503e 100644 +--- a/drivers/media/platform/vicodec/vicodec-core.c ++++ b/drivers/media/platform/vicodec/vicodec-core.c +@@ -2139,6 +2139,9 @@ static void vicodec_v4l2_dev_release(struct v4l2_device *v4l2_dev) + v4l2_m2m_release(dev->stateful_enc.m2m_dev); + v4l2_m2m_release(dev->stateful_dec.m2m_dev); + v4l2_m2m_release(dev->stateless_dec.m2m_dev); ++#ifdef CONFIG_MEDIA_CONTROLLER ++ media_device_cleanup(&dev->mdev); ++#endif + kfree(dev); + } + +@@ -2250,7 +2253,6 @@ static int vicodec_remove(struct platform_device *pdev) + v4l2_m2m_unregister_media_controller(dev->stateful_enc.m2m_dev); + v4l2_m2m_unregister_media_controller(dev->stateful_dec.m2m_dev); + v4l2_m2m_unregister_media_controller(dev->stateless_dec.m2m_dev); +- media_device_cleanup(&dev->mdev); + #endif + + video_unregister_device(&dev->stateful_enc.vfd); +diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c +index acd3bd48c7e2..8d6b09623d88 100644 +--- a/drivers/media/platform/vim2m.c ++++ b/drivers/media/platform/vim2m.c +@@ -1073,6 +1073,9 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned int count) + if (!q_data) + return -EINVAL; + ++ if (V4L2_TYPE_IS_OUTPUT(q->type)) ++ ctx->aborting = 0; ++ + q_data->sequence = 0; + return 0; + } +@@ -1272,6 +1275,9 @@ static void vim2m_device_release(struct video_device *vdev) + + v4l2_device_unregister(&dev->v4l2_dev); + v4l2_m2m_release(dev->m2m_dev); ++#ifdef CONFIG_MEDIA_CONTROLLER ++ media_device_cleanup(&dev->mdev); ++#endif + kfree(dev); + } + +@@ -1343,6 +1349,7 @@ static int vim2m_probe(struct platform_device *pdev) + if (IS_ERR(dev->m2m_dev)) { + v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem device\n"); + ret = PTR_ERR(dev->m2m_dev); ++ dev->m2m_dev = NULL; + goto error_dev; + } + +@@ -1395,7 +1402,6 @@ static int vim2m_remove(struct platform_device *pdev) + #ifdef CONFIG_MEDIA_CONTROLLER + media_device_unregister(&dev->mdev); + v4l2_m2m_unregister_media_controller(dev->m2m_dev); +- media_device_cleanup(&dev->mdev); + #endif + video_unregister_device(&dev->vfd); + +diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c +index 7e1ae0b12f1e..a3120f4f7a90 100644 +--- a/drivers/media/platform/vimc/vimc-common.c ++++ b/drivers/media/platform/vimc/vimc-common.c +@@ -375,7 +375,7 @@ int vimc_ent_sd_register(struct vimc_ent_device *ved, + { + int ret; + +- /* Allocate the pads */ ++ /* Allocate the pads. Should be released from the sd_int_op release */ + ved->pads = vimc_pads_init(num_pads, pads_flag); + if (IS_ERR(ved->pads)) + return PTR_ERR(ved->pads); +@@ -424,7 +424,6 @@ EXPORT_SYMBOL_GPL(vimc_ent_sd_register); + void vimc_ent_sd_unregister(struct vimc_ent_device *ved, struct v4l2_subdev *sd) + { + media_entity_cleanup(ved->ent); +- vimc_pads_cleanup(ved->pads); + v4l2_device_unregister_subdev(sd); + } + EXPORT_SYMBOL_GPL(vimc_ent_sd_unregister); +diff --git a/drivers/media/platform/vimc/vimc-debayer.c b/drivers/media/platform/vimc/vimc-debayer.c +index b72b8385067b..baafd9d7fb2c 100644 +--- a/drivers/media/platform/vimc/vimc-debayer.c ++++ b/drivers/media/platform/vimc/vimc-debayer.c +@@ -484,6 +484,7 @@ static void vimc_deb_release(struct v4l2_subdev *sd) + struct vimc_deb_device *vdeb = + container_of(sd, struct vimc_deb_device, sd); + ++ vimc_pads_cleanup(vdeb->ved.pads); + kfree(vdeb); + } + +diff --git a/drivers/media/platform/vimc/vimc-scaler.c b/drivers/media/platform/vimc/vimc-scaler.c +index 49ab8d9dd9c9..c0d9f43d5777 100644 +--- a/drivers/media/platform/vimc/vimc-scaler.c ++++ b/drivers/media/platform/vimc/vimc-scaler.c +@@ -343,6 +343,7 @@ static void vimc_sca_release(struct v4l2_subdev *sd) + struct vimc_sca_device *vsca = + container_of(sd, struct vimc_sca_device, sd); + ++ vimc_pads_cleanup(vsca->ved.pads); + kfree(vsca); + } + +diff --git a/drivers/media/platform/vimc/vimc-sensor.c b/drivers/media/platform/vimc/vimc-sensor.c +index 4a6a7e8e66c2..420573e5f6d6 100644 +--- a/drivers/media/platform/vimc/vimc-sensor.c ++++ b/drivers/media/platform/vimc/vimc-sensor.c +@@ -292,6 +292,7 @@ static void vimc_sen_release(struct v4l2_subdev *sd) + + v4l2_ctrl_handler_free(&vsen->hdl); + tpg_free(&vsen->tpg); ++ vimc_pads_cleanup(vsen->ved.pads); + kfree(vsen); + } + +diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c +index 53315c8dd2bb..f6a5cdbd74e7 100644 +--- a/drivers/media/platform/vivid/vivid-core.c ++++ b/drivers/media/platform/vivid/vivid-core.c +@@ -616,6 +616,9 @@ static void vivid_dev_release(struct v4l2_device *v4l2_dev) + + vivid_free_controls(dev); + v4l2_device_unregister(&dev->v4l2_dev); ++#ifdef CONFIG_MEDIA_CONTROLLER ++ media_device_cleanup(&dev->mdev); ++#endif + vfree(dev->scaled_line); + vfree(dev->blended_line); + vfree(dev->edid); +@@ -1580,7 +1583,6 @@ static int vivid_remove(struct platform_device *pdev) + + #ifdef CONFIG_MEDIA_CONTROLLER + media_device_unregister(&dev->mdev); +- media_device_cleanup(&dev->mdev); + #endif + + if (dev->has_vid_cap) { +diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c +index 7541698a0be1..f491420d7b53 100644 +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -482,6 +482,8 @@ static int si470x_i2c_remove(struct i2c_client *client) + if (radio->gpio_reset) + gpiod_set_value(radio->gpio_reset, 0); + ++ v4l2_ctrl_handler_free(&radio->hdl); ++ v4l2_device_unregister(&radio->v4l2_dev); + return 0; + } + +diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c +index 1a801dc286f8..d1331f828108 100644 +--- a/drivers/media/usb/b2c2/flexcop-usb.c ++++ b/drivers/media/usb/b2c2/flexcop-usb.c +@@ -504,7 +504,13 @@ urb_error: + static int flexcop_usb_init(struct flexcop_usb *fc_usb) + { + /* use the alternate setting with the larges buffer */ +- usb_set_interface(fc_usb->udev,0,1); ++ int ret = usb_set_interface(fc_usb->udev, 0, 1); ++ ++ if (ret) { ++ err("set interface failed."); ++ return ret; ++ } ++ + switch (fc_usb->udev->speed) { + case USB_SPEED_LOW: + err("cannot handle USB speed because it is too slow."); +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c +index a34717eba409..eaa08c7999d4 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c +@@ -898,8 +898,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp) + pvr2_v4l2_dev_disassociate_parent(vp->dev_video); + pvr2_v4l2_dev_disassociate_parent(vp->dev_radio); + if (!list_empty(&vp->dev_video->devbase.fh_list) || +- !list_empty(&vp->dev_radio->devbase.fh_list)) ++ (vp->dev_radio && ++ !list_empty(&vp->dev_radio->devbase.fh_list))) { ++ pvr2_trace(PVR2_TRACE_STRUCT, ++ "pvr2_v4l2 internal_check exit-empty id=%p", vp); + return; ++ } + pvr2_v4l2_destroy_no_lock(vp); + } + +@@ -935,7 +939,8 @@ static int pvr2_v4l2_release(struct file *file) + kfree(fhp); + if (vp->channel.mc_head->disconnect_flag && + list_empty(&vp->dev_video->devbase.fh_list) && +- list_empty(&vp->dev_radio->devbase.fh_list)) { ++ (!vp->dev_radio || ++ list_empty(&vp->dev_radio->devbase.fh_list))) { + pvr2_v4l2_destroy_no_lock(vp); + } + return 0; +diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c +index 1d8f38824631..cd84dbbf6a89 100644 +--- a/drivers/media/v4l2-core/v4l2-ctrls.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls.c +@@ -3144,6 +3144,7 @@ static void v4l2_ctrl_request_queue(struct media_request_object *obj) + struct v4l2_ctrl_handler *prev_hdl = NULL; + struct v4l2_ctrl_ref *ref_ctrl, *ref_ctrl_prev = NULL; + ++ mutex_lock(main_hdl->lock); + if (list_empty(&main_hdl->requests_queued)) + goto queue; + +@@ -3175,18 +3176,22 @@ static void v4l2_ctrl_request_queue(struct media_request_object *obj) + queue: + list_add_tail(&hdl->requests_queued, &main_hdl->requests_queued); + hdl->request_is_queued = true; ++ mutex_unlock(main_hdl->lock); + } + + static void v4l2_ctrl_request_unbind(struct media_request_object *obj) + { + struct v4l2_ctrl_handler *hdl = + container_of(obj, struct v4l2_ctrl_handler, req_obj); ++ struct v4l2_ctrl_handler *main_hdl = obj->priv; + + list_del_init(&hdl->requests); ++ mutex_lock(main_hdl->lock); + if (hdl->request_is_queued) { + list_del_init(&hdl->requests_queued); + hdl->request_is_queued = false; + } ++ mutex_unlock(main_hdl->lock); + } + + static void v4l2_ctrl_request_release(struct media_request_object *obj) +@@ -4128,9 +4133,11 @@ void v4l2_ctrl_request_complete(struct media_request *req, + v4l2_ctrl_unlock(ctrl); + } + ++ mutex_lock(main_hdl->lock); + WARN_ON(!hdl->request_is_queued); + list_del_init(&hdl->requests_queued); + hdl->request_is_queued = false; ++ mutex_unlock(main_hdl->lock); + media_request_object_complete(obj); + media_request_object_put(obj); + } +diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c +index 51b912743f0f..21bb96ce4cd6 100644 +--- a/drivers/media/v4l2-core/v4l2-ioctl.c ++++ b/drivers/media/v4l2-core/v4l2-ioctl.c +@@ -1466,10 +1466,26 @@ static int v4l_enum_fmt(const struct v4l2_ioctl_ops *ops, + return ret; + } + ++static void v4l_pix_format_touch(struct v4l2_pix_format *p) ++{ ++ /* ++ * The v4l2_pix_format structure contains fields that make no sense for ++ * touch. Set them to default values in this case. ++ */ ++ ++ p->field = V4L2_FIELD_NONE; ++ p->colorspace = V4L2_COLORSPACE_RAW; ++ p->flags = 0; ++ p->ycbcr_enc = 0; ++ p->quantization = 0; ++ p->xfer_func = 0; ++} ++ + static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + struct file *file, void *fh, void *arg) + { + struct v4l2_format *p = arg; ++ struct video_device *vfd = video_devdata(file); + int ret = check_fmt(file, p->type); + + if (ret) +@@ -1507,6 +1523,8 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + ret = ops->vidioc_g_fmt_vid_cap(file, fh, arg); + /* just in case the driver zeroed it again */ + p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC; ++ if (vfd->vfl_type == VFL_TYPE_TOUCH) ++ v4l_pix_format_touch(&p->fmt.pix); + return ret; + case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: + return ops->vidioc_g_fmt_vid_cap_mplane(file, fh, arg); +@@ -1544,21 +1562,6 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + return -EINVAL; + } + +-static void v4l_pix_format_touch(struct v4l2_pix_format *p) +-{ +- /* +- * The v4l2_pix_format structure contains fields that make no sense for +- * touch. Set them to default values in this case. +- */ +- +- p->field = V4L2_FIELD_NONE; +- p->colorspace = V4L2_COLORSPACE_RAW; +- p->flags = 0; +- p->ycbcr_enc = 0; +- p->quantization = 0; +- p->xfer_func = 0; +-} +- + static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops, + struct file *file, void *fh, void *arg) + { +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 1b1a794d639d..842f2210dc7e 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1430,8 +1430,8 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) + return -ENOMEM; + + data->miscdev.minor = MISC_DYNAMIC_MINOR; +- data->miscdev.name = kasprintf(GFP_KERNEL, "fastrpc-%s", +- domains[domain_id]); ++ data->miscdev.name = devm_kasprintf(rdev, GFP_KERNEL, "fastrpc-%s", ++ domains[domain_id]); + data->miscdev.fops = &fastrpc_fops; + err = misc_register(&data->miscdev); + if (err) +diff --git a/drivers/misc/ocxl/file.c b/drivers/misc/ocxl/file.c +index 2870c25da166..4d1b44de1492 100644 +--- a/drivers/misc/ocxl/file.c ++++ b/drivers/misc/ocxl/file.c +@@ -18,18 +18,15 @@ static struct class *ocxl_class; + static struct mutex minors_idr_lock; + static struct idr minors_idr; + +-static struct ocxl_file_info *find_file_info(dev_t devno) ++static struct ocxl_file_info *find_and_get_file_info(dev_t devno) + { + struct ocxl_file_info *info; + +- /* +- * We don't declare an RCU critical section here, as our AFU +- * is protected by a reference counter on the device. By the time the +- * info reference is removed from the idr, the ref count of +- * the device is already at 0, so no user API will access that AFU and +- * this function can't return it. +- */ ++ mutex_lock(&minors_idr_lock); + info = idr_find(&minors_idr, MINOR(devno)); ++ if (info) ++ get_device(&info->dev); ++ mutex_unlock(&minors_idr_lock); + return info; + } + +@@ -58,14 +55,16 @@ static int afu_open(struct inode *inode, struct file *file) + + pr_debug("%s for device %x\n", __func__, inode->i_rdev); + +- info = find_file_info(inode->i_rdev); ++ info = find_and_get_file_info(inode->i_rdev); + if (!info) + return -ENODEV; + + rc = ocxl_context_alloc(&ctx, info->afu, inode->i_mapping); +- if (rc) ++ if (rc) { ++ put_device(&info->dev); + return rc; +- ++ } ++ put_device(&info->dev); + file->private_data = ctx; + return 0; + } +@@ -487,7 +486,6 @@ static void info_release(struct device *dev) + { + struct ocxl_file_info *info = container_of(dev, struct ocxl_file_info, dev); + +- free_minor(info); + ocxl_afu_put(info->afu); + kfree(info); + } +@@ -577,6 +575,7 @@ void ocxl_file_unregister_afu(struct ocxl_afu *afu) + + ocxl_file_make_invisible(info); + ocxl_sysfs_unregister_afu(info); ++ free_minor(info); + device_unregister(&info->dev); + } + +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index 189e42674d85..010fe29a4888 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -228,6 +228,7 @@ + #define MSDC_PATCH_BIT_SPCPUSH (0x1 << 29) /* RW */ + #define MSDC_PATCH_BIT_DECRCTMO (0x1 << 30) /* RW */ + ++#define MSDC_PATCH_BIT1_CMDTA (0x7 << 3) /* RW */ + #define MSDC_PATCH_BIT1_STOP_DLY (0xf << 8) /* RW */ + + #define MSDC_PATCH_BIT2_CFGRESP (0x1 << 15) /* RW */ +@@ -1881,6 +1882,7 @@ static int hs400_tune_response(struct mmc_host *mmc, u32 opcode) + + /* select EMMC50 PAD CMD tune */ + sdr_set_bits(host->base + PAD_CMD_TUNE, BIT(0)); ++ sdr_set_field(host->base + MSDC_PATCH_BIT1, MSDC_PATCH_BIT1_CMDTA, 2); + + if (mmc->ios.timing == MMC_TIMING_MMC_HS200 || + mmc->ios.timing == MMC_TIMING_UHS_SDR104) +diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c +index b75c82d8d6c1..3d0bb5e2e09b 100644 +--- a/drivers/mmc/host/sdhci-msm.c ++++ b/drivers/mmc/host/sdhci-msm.c +@@ -99,7 +99,7 @@ + + #define CORE_PWRSAVE_DLL BIT(3) + +-#define DDR_CONFIG_POR_VAL 0x80040853 ++#define DDR_CONFIG_POR_VAL 0x80040873 + + + #define INVALID_TUNING_PHASE -1 +@@ -148,8 +148,9 @@ struct sdhci_msm_offset { + u32 core_ddr_200_cfg; + u32 core_vendor_spec3; + u32 core_dll_config_2; ++ u32 core_dll_config_3; ++ u32 core_ddr_config_old; /* Applicable to sdcc minor ver < 0x49 */ + u32 core_ddr_config; +- u32 core_ddr_config_2; + }; + + static const struct sdhci_msm_offset sdhci_msm_v5_offset = { +@@ -177,8 +178,8 @@ static const struct sdhci_msm_offset sdhci_msm_v5_offset = { + .core_ddr_200_cfg = 0x224, + .core_vendor_spec3 = 0x250, + .core_dll_config_2 = 0x254, +- .core_ddr_config = 0x258, +- .core_ddr_config_2 = 0x25c, ++ .core_dll_config_3 = 0x258, ++ .core_ddr_config = 0x25c, + }; + + static const struct sdhci_msm_offset sdhci_msm_mci_offset = { +@@ -207,8 +208,8 @@ static const struct sdhci_msm_offset sdhci_msm_mci_offset = { + .core_ddr_200_cfg = 0x184, + .core_vendor_spec3 = 0x1b0, + .core_dll_config_2 = 0x1b4, +- .core_ddr_config = 0x1b8, +- .core_ddr_config_2 = 0x1bc, ++ .core_ddr_config_old = 0x1b8, ++ .core_ddr_config = 0x1bc, + }; + + struct sdhci_msm_variant_ops { +@@ -253,6 +254,7 @@ struct sdhci_msm_host { + const struct sdhci_msm_offset *offset; + bool use_cdr; + u32 transfer_mode; ++ bool updated_ddr_cfg; + }; + + static const struct sdhci_msm_offset *sdhci_priv_msm_offset(struct sdhci_host *host) +@@ -924,8 +926,10 @@ out: + static int sdhci_msm_cm_dll_sdc4_calibration(struct sdhci_host *host) + { + struct mmc_host *mmc = host->mmc; +- u32 dll_status, config; ++ u32 dll_status, config, ddr_cfg_offset; + int ret; ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host); + const struct sdhci_msm_offset *msm_offset = + sdhci_priv_msm_offset(host); + +@@ -938,8 +942,11 @@ static int sdhci_msm_cm_dll_sdc4_calibration(struct sdhci_host *host) + * bootloaders. In the future, if this changes, then the desired + * values will need to be programmed appropriately. + */ +- writel_relaxed(DDR_CONFIG_POR_VAL, host->ioaddr + +- msm_offset->core_ddr_config); ++ if (msm_host->updated_ddr_cfg) ++ ddr_cfg_offset = msm_offset->core_ddr_config; ++ else ++ ddr_cfg_offset = msm_offset->core_ddr_config_old; ++ writel_relaxed(DDR_CONFIG_POR_VAL, host->ioaddr + ddr_cfg_offset); + + if (mmc->ios.enhanced_strobe) { + config = readl_relaxed(host->ioaddr + +@@ -1899,6 +1906,9 @@ static int sdhci_msm_probe(struct platform_device *pdev) + msm_offset->core_vendor_spec_capabilities0); + } + ++ if (core_major == 1 && core_minor >= 0x49) ++ msm_host->updated_ddr_cfg = true; ++ + /* + * Power on reset state may trigger power irq if previous status of + * PWRCTL was either BUS_ON or IO_HIGH_V. So before enabling pwr irq +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 1d1953dfc54b..889ed98ec0e7 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -710,9 +710,6 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask) + sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); + sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE); + +- if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) +- mdelay(5); +- + if (mask & SDHCI_RESET_ALL) { + val = sdhci_readl(host, ESDHC_TBCTL); + val &= ~ESDHC_TB_EN; +@@ -1126,8 +1123,8 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) + host->quirks &= ~SDHCI_QUIRK_NO_BUSY_IRQ; + + if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) { +- host->quirks2 |= SDHCI_QUIRK_RESET_AFTER_REQUEST; +- host->quirks2 |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; ++ host->quirks |= SDHCI_QUIRK_RESET_AFTER_REQUEST; ++ host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; + } + + if (of_device_is_compatible(np, "fsl,p5040-esdhc") || +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index eaffa85bc728..642a9667db4d 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #ifdef CONFIG_X86 + #include +@@ -782,11 +783,18 @@ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) + return 0; + } + ++static bool glk_broken_cqhci(struct sdhci_pci_slot *slot) ++{ ++ return slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC && ++ dmi_match(DMI_BIOS_VENDOR, "LENOVO"); ++} ++ + static int glk_emmc_probe_slot(struct sdhci_pci_slot *slot) + { + int ret = byt_emmc_probe_slot(slot); + +- slot->host->mmc->caps2 |= MMC_CAP2_CQE; ++ if (!glk_broken_cqhci(slot)) ++ slot->host->mmc->caps2 |= MMC_CAP2_CQE; + + if (slot->chip->pdev->device != PCI_DEVICE_ID_INTEL_GLK_EMMC) { + slot->host->mmc->caps2 |= MMC_CAP2_HS400_ES, +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index b056400e34b1..5f9df2dbde06 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1871,9 +1871,7 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing) + ctrl_2 |= SDHCI_CTRL_UHS_SDR104; + else if (timing == MMC_TIMING_UHS_SDR12) + ctrl_2 |= SDHCI_CTRL_UHS_SDR12; +- else if (timing == MMC_TIMING_SD_HS || +- timing == MMC_TIMING_MMC_HS || +- timing == MMC_TIMING_UHS_SDR25) ++ else if (timing == MMC_TIMING_UHS_SDR25) + ctrl_2 |= SDHCI_CTRL_UHS_SDR25; + else if (timing == MMC_TIMING_UHS_SDR50) + ctrl_2 |= SDHCI_CTRL_UHS_SDR50; +@@ -2408,8 +2406,8 @@ static int __sdhci_execute_tuning(struct sdhci_host *host, u32 opcode) + sdhci_send_tuning(host, opcode); + + if (!host->tuning_done) { +- pr_info("%s: Tuning timeout, falling back to fixed sampling clock\n", +- mmc_hostname(host->mmc)); ++ pr_debug("%s: Tuning timeout, falling back to fixed sampling clock\n", ++ mmc_hostname(host->mmc)); + sdhci_abort_tuning(host, opcode); + return -ETIMEDOUT; + } +@@ -3758,6 +3756,9 @@ int sdhci_setup_host(struct sdhci_host *host) + mmc_hostname(mmc), host->version); + } + ++ if (host->quirks & SDHCI_QUIRK_BROKEN_CQE) ++ mmc->caps2 &= ~MMC_CAP2_CQE; ++ + if (host->quirks & SDHCI_QUIRK_FORCE_DMA) + host->flags |= SDHCI_USE_SDMA; + else if (!(host->caps & SDHCI_CAN_DO_SDMA)) +diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h +index 0ed3e0eaef5f..fe83ece6965b 100644 +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -409,6 +409,8 @@ struct sdhci_host { + #define SDHCI_QUIRK_BROKEN_CARD_DETECTION (1<<15) + /* Controller reports inverted write-protect state */ + #define SDHCI_QUIRK_INVERTED_WRITE_PROTECT (1<<16) ++/* Controller has unusable command queue engine */ ++#define SDHCI_QUIRK_BROKEN_CQE (1<<17) + /* Controller does not like fast PIO transfers */ + #define SDHCI_QUIRK_PIO_NEEDS_DELAY (1<<18) + /* Controller does not have a LED */ +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index 9b6e1001e77c..dec5a99f52cf 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -1184,7 +1184,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host) + if (ret == -EPROBE_DEFER) + return ret; + +- mmc->caps |= MMC_CAP_4_BIT_DATA | pdata->capabilities; ++ mmc->caps |= MMC_CAP_ERASE | MMC_CAP_4_BIT_DATA | pdata->capabilities; + mmc->caps2 |= pdata->capabilities2; + mmc->max_segs = pdata->max_segs ? : 32; + mmc->max_blk_size = TMIO_MAX_BLK_SIZE; +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 62f65573eb04..face00c622ed 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3612,32 +3612,35 @@ static int bond_neigh_init(struct neighbour *n) + const struct net_device_ops *slave_ops; + struct neigh_parms parms; + struct slave *slave; +- int ret; ++ int ret = 0; + +- slave = bond_first_slave(bond); ++ rcu_read_lock(); ++ slave = bond_first_slave_rcu(bond); + if (!slave) +- return 0; ++ goto out; + slave_ops = slave->dev->netdev_ops; + if (!slave_ops->ndo_neigh_setup) +- return 0; +- +- parms.neigh_setup = NULL; +- parms.neigh_cleanup = NULL; +- ret = slave_ops->ndo_neigh_setup(slave->dev, &parms); +- if (ret) +- return ret; ++ goto out; + +- /* Assign slave's neigh_cleanup to neighbour in case cleanup is called +- * after the last slave has been detached. Assumes that all slaves +- * utilize the same neigh_cleanup (true at this writing as only user +- * is ipoib). ++ /* TODO: find another way [1] to implement this. ++ * Passing a zeroed structure is fragile, ++ * but at least we do not pass garbage. ++ * ++ * [1] One way would be that ndo_neigh_setup() never touch ++ * struct neigh_parms, but propagate the new neigh_setup() ++ * back to ___neigh_create() / neigh_parms_alloc() + */ +- n->parms->neigh_cleanup = parms.neigh_cleanup; ++ memset(&parms, 0, sizeof(parms)); ++ ret = slave_ops->ndo_neigh_setup(slave->dev, &parms); + +- if (!parms.neigh_setup) +- return 0; ++ if (ret) ++ goto out; + +- return parms.neigh_setup(n); ++ if (parms.neigh_setup) ++ ret = parms.neigh_setup(n); ++out: ++ rcu_read_unlock(); ++ return ret; + } + + /* The bonding ndo_neigh_setup is called at init time beofre any +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 57f9a2f51085..e5c207ad3c77 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -389,6 +389,34 @@ static struct flexcan_mb __iomem *flexcan_get_mb(const struct flexcan_priv *priv + (&priv->regs->mb[bank][priv->mb_size * mb_index]); + } + ++static int flexcan_low_power_enter_ack(struct flexcan_priv *priv) ++{ ++ struct flexcan_regs __iomem *regs = priv->regs; ++ unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; ++ ++ while (timeout-- && !(priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) ++ udelay(10); ++ ++ if (!(priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) ++ return -ETIMEDOUT; ++ ++ return 0; ++} ++ ++static int flexcan_low_power_exit_ack(struct flexcan_priv *priv) ++{ ++ struct flexcan_regs __iomem *regs = priv->regs; ++ unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; ++ ++ while (timeout-- && (priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) ++ udelay(10); ++ ++ if (priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK) ++ return -ETIMEDOUT; ++ ++ return 0; ++} ++ + static void flexcan_enable_wakeup_irq(struct flexcan_priv *priv, bool enable) + { + struct flexcan_regs __iomem *regs = priv->regs; +@@ -407,7 +435,6 @@ static void flexcan_enable_wakeup_irq(struct flexcan_priv *priv, bool enable) + static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int ackval; + u32 reg_mcr; + + reg_mcr = priv->read(®s->mcr); +@@ -418,36 +445,24 @@ static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv) + regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, + 1 << priv->stm.req_bit, 1 << priv->stm.req_bit); + +- /* get stop acknowledgment */ +- if (regmap_read_poll_timeout(priv->stm.gpr, priv->stm.ack_gpr, +- ackval, ackval & (1 << priv->stm.ack_bit), +- 0, FLEXCAN_TIMEOUT_US)) +- return -ETIMEDOUT; +- +- return 0; ++ return flexcan_low_power_enter_ack(priv); + } + + static inline int flexcan_exit_stop_mode(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int ackval; + u32 reg_mcr; + + /* remove stop request */ + regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, + 1 << priv->stm.req_bit, 0); + +- /* get stop acknowledgment */ +- if (regmap_read_poll_timeout(priv->stm.gpr, priv->stm.ack_gpr, +- ackval, !(ackval & (1 << priv->stm.ack_bit)), +- 0, FLEXCAN_TIMEOUT_US)) +- return -ETIMEDOUT; + + reg_mcr = priv->read(®s->mcr); + reg_mcr &= ~FLEXCAN_MCR_SLF_WAK; + priv->write(reg_mcr, ®s->mcr); + +- return 0; ++ return flexcan_low_power_exit_ack(priv); + } + + static inline void flexcan_error_irq_enable(const struct flexcan_priv *priv) +@@ -506,39 +521,25 @@ static inline int flexcan_transceiver_disable(const struct flexcan_priv *priv) + static int flexcan_chip_enable(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; + u32 reg; + + reg = priv->read(®s->mcr); + reg &= ~FLEXCAN_MCR_MDIS; + priv->write(reg, ®s->mcr); + +- while (timeout-- && (priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) +- udelay(10); +- +- if (priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK) +- return -ETIMEDOUT; +- +- return 0; ++ return flexcan_low_power_exit_ack(priv); + } + + static int flexcan_chip_disable(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; + u32 reg; + + reg = priv->read(®s->mcr); + reg |= FLEXCAN_MCR_MDIS; + priv->write(reg, ®s->mcr); + +- while (timeout-- && !(priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) +- udelay(10); +- +- if (!(priv->read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) +- return -ETIMEDOUT; +- +- return 0; ++ return flexcan_low_power_enter_ack(priv); + } + + static int flexcan_chip_freeze(struct flexcan_priv *priv) +@@ -1703,6 +1704,9 @@ static int __maybe_unused flexcan_resume(struct device *device) + netif_start_queue(dev); + if (device_may_wakeup(device)) { + disable_irq_wake(dev->irq); ++ err = flexcan_exit_stop_mode(priv); ++ if (err) ++ return err; + } else { + err = pm_runtime_force_resume(device); + if (err) +@@ -1748,14 +1752,9 @@ static int __maybe_unused flexcan_noirq_resume(struct device *device) + { + struct net_device *dev = dev_get_drvdata(device); + struct flexcan_priv *priv = netdev_priv(dev); +- int err; + +- if (netif_running(dev) && device_may_wakeup(device)) { ++ if (netif_running(dev) && device_may_wakeup(device)) + flexcan_enable_wakeup_irq(priv, false); +- err = flexcan_exit_stop_mode(priv); +- if (err) +- return err; +- } + + return 0; + } +diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c +index 3db619209fe1..d5d4bfa9c8fd 100644 +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -354,6 +354,8 @@ static int tcan4x5x_parse_config(struct m_can_classdev *cdev) + if (IS_ERR(tcan4x5x->reset_gpio)) + tcan4x5x->reset_gpio = NULL; + ++ usleep_range(700, 1000); ++ + tcan4x5x->device_state_gpio = devm_gpiod_get_optional(cdev->dev, + "device-state", + GPIOD_IN); +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 07d2f3aa2c02..ae4c37e1bb75 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -608,7 +608,7 @@ static int kvaser_usb_leaf_simple_cmd_async(struct kvaser_usb_net_priv *priv, + struct kvaser_cmd *cmd; + int err; + +- cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC); ++ cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC); + if (!cmd) + return -ENOMEM; + +@@ -1140,7 +1140,7 @@ static int kvaser_usb_leaf_set_opt_mode(const struct kvaser_usb_net_priv *priv) + struct kvaser_cmd *cmd; + int rc; + +- cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; + +@@ -1206,7 +1206,7 @@ static int kvaser_usb_leaf_flush_queue(struct kvaser_usb_net_priv *priv) + struct kvaser_cmd *cmd; + int rc; + +- cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; + +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index 7c482b2d78d2..2be846ee627d 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -60,6 +60,8 @@ enum xcan_reg { + XCAN_TXMSG_BASE_OFFSET = 0x0100, /* TX Message Space */ + XCAN_RXMSG_BASE_OFFSET = 0x1100, /* RX Message Space */ + XCAN_RXMSG_2_BASE_OFFSET = 0x2100, /* RX Message Space */ ++ XCAN_AFR_2_MASK_OFFSET = 0x0A00, /* Acceptance Filter MASK */ ++ XCAN_AFR_2_ID_OFFSET = 0x0A04, /* Acceptance Filter ID */ + }; + + #define XCAN_FRAME_ID_OFFSET(frame_base) ((frame_base) + 0x00) +@@ -1803,6 +1805,11 @@ static int xcan_probe(struct platform_device *pdev) + + pm_runtime_put(&pdev->dev); + ++ if (priv->devtype.flags & XCAN_FLAG_CANFD_2) { ++ priv->write_reg(priv, XCAN_AFR_2_ID_OFFSET, 0x00000000); ++ priv->write_reg(priv, XCAN_AFR_2_MASK_OFFSET, 0x00000000); ++ } ++ + netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx buffers: actual %d, using %d\n", + priv->reg_base, ndev->irq, priv->can.clock.freq, + hw_tx_max, priv->tx_max); +diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig +index f6232ce8481f..685e12b05a7c 100644 +--- a/drivers/net/dsa/Kconfig ++++ b/drivers/net/dsa/Kconfig +@@ -77,6 +77,7 @@ config NET_DSA_REALTEK_SMI + config NET_DSA_SMSC_LAN9303 + tristate + select NET_DSA_TAG_LAN9303 ++ select REGMAP + ---help--- + This enables support for the SMSC/Microchip LAN9303 3 port ethernet + switch chips. +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index cc3536315eff..a7132c1593c3 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -347,7 +347,7 @@ static void b53_set_forwarding(struct b53_device *dev, int enable) + * frames should be flooded or not. + */ + b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt); +- mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN; ++ mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN; + b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt); + } + +@@ -526,6 +526,8 @@ int b53_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy) + + cpu_port = ds->ports[port].cpu_dp->index; + ++ b53_br_egress_floods(ds, port, true, true); ++ + if (dev->ops->irq_enable) + ret = dev->ops->irq_enable(dev, port); + if (ret) +@@ -641,6 +643,8 @@ static void b53_enable_cpu_port(struct b53_device *dev, int port) + b53_write8(dev, B53_CTRL_PAGE, B53_PORT_CTRL(port), port_ctrl); + + b53_brcm_hdr_setup(dev->ds, port); ++ ++ b53_br_egress_floods(dev->ds, port, true, true); + } + + static void b53_enable_mib(struct b53_device *dev) +@@ -1766,19 +1770,26 @@ int b53_br_egress_floods(struct dsa_switch *ds, int port, + struct b53_device *dev = ds->priv; + u16 uc, mc; + +- b53_read16(dev, B53_CTRL_PAGE, B53_UC_FWD_EN, &uc); ++ b53_read16(dev, B53_CTRL_PAGE, B53_UC_FLOOD_MASK, &uc); + if (unicast) + uc |= BIT(port); + else + uc &= ~BIT(port); +- b53_write16(dev, B53_CTRL_PAGE, B53_UC_FWD_EN, uc); ++ b53_write16(dev, B53_CTRL_PAGE, B53_UC_FLOOD_MASK, uc); ++ ++ b53_read16(dev, B53_CTRL_PAGE, B53_MC_FLOOD_MASK, &mc); ++ if (multicast) ++ mc |= BIT(port); ++ else ++ mc &= ~BIT(port); ++ b53_write16(dev, B53_CTRL_PAGE, B53_MC_FLOOD_MASK, mc); + +- b53_read16(dev, B53_CTRL_PAGE, B53_MC_FWD_EN, &mc); ++ b53_read16(dev, B53_CTRL_PAGE, B53_IPMC_FLOOD_MASK, &mc); + if (multicast) + mc |= BIT(port); + else + mc &= ~BIT(port); +- b53_write16(dev, B53_CTRL_PAGE, B53_MC_FWD_EN, mc); ++ b53_write16(dev, B53_CTRL_PAGE, B53_IPMC_FLOOD_MASK, mc); + + return 0; + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index aa140662c7c2..4e5a428ab1a4 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -1389,6 +1389,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv) + int speed_mbps[SJA1105_NUM_PORTS]; + int rc, i; + ++ mutex_lock(&priv->mgmt_lock); ++ + mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG].entries; + + /* Back up the dynamic link speed changed by sja1105_adjust_port_config +@@ -1420,6 +1422,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv) + goto out; + } + out: ++ mutex_unlock(&priv->mgmt_lock); ++ + return rc; + } + +diff --git a/drivers/net/ethernet/amazon/ena/ena_com.h b/drivers/net/ethernet/amazon/ena/ena_com.h +index 7c941eba0bc9..0ce37d54ed10 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_com.h ++++ b/drivers/net/ethernet/amazon/ena/ena_com.h +@@ -72,7 +72,7 @@ + /*****************************************************************************/ + /* ENA adaptive interrupt moderation settings */ + +-#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 196 ++#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 64 + #define ENA_INTR_INITIAL_RX_INTERVAL_USECS 0 + #define ENA_DEFAULT_INTR_DELAY_RESOLUTION 1 + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index 16553d92fad2..8c1c73b0ced7 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -315,10 +315,9 @@ static int ena_get_coalesce(struct net_device *net_dev, + ena_com_get_nonadaptive_moderation_interval_tx(ena_dev) * + ena_dev->intr_delay_resolution; + +- if (!ena_com_get_adaptive_moderation_enabled(ena_dev)) +- coalesce->rx_coalesce_usecs = +- ena_com_get_nonadaptive_moderation_interval_rx(ena_dev) +- * ena_dev->intr_delay_resolution; ++ coalesce->rx_coalesce_usecs = ++ ena_com_get_nonadaptive_moderation_interval_rx(ena_dev) ++ * ena_dev->intr_delay_resolution; + + coalesce->use_adaptive_rx_coalesce = + ena_com_get_adaptive_moderation_enabled(ena_dev); +@@ -367,12 +366,6 @@ static int ena_set_coalesce(struct net_device *net_dev, + + ena_update_tx_rings_intr_moderation(adapter); + +- if (coalesce->use_adaptive_rx_coalesce) { +- if (!ena_com_get_adaptive_moderation_enabled(ena_dev)) +- ena_com_enable_adaptive_moderation(ena_dev); +- return 0; +- } +- + rc = ena_com_update_nonadaptive_moderation_interval_rx(ena_dev, + coalesce->rx_coalesce_usecs); + if (rc) +@@ -380,10 +373,13 @@ static int ena_set_coalesce(struct net_device *net_dev, + + ena_update_rx_rings_intr_moderation(adapter); + +- if (!coalesce->use_adaptive_rx_coalesce) { +- if (ena_com_get_adaptive_moderation_enabled(ena_dev)) +- ena_com_disable_adaptive_moderation(ena_dev); +- } ++ if (coalesce->use_adaptive_rx_coalesce && ++ !ena_com_get_adaptive_moderation_enabled(ena_dev)) ++ ena_com_enable_adaptive_moderation(ena_dev); ++ ++ if (!coalesce->use_adaptive_rx_coalesce && ++ ena_com_get_adaptive_moderation_enabled(ena_dev)) ++ ena_com_disable_adaptive_moderation(ena_dev); + + return 0; + } +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +index 0edbb0a76847..5097a44686b3 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +@@ -2397,15 +2397,21 @@ static int bnx2x_set_pf_tx_switching(struct bnx2x *bp, bool enable) + /* send the ramrod on all the queues of the PF */ + for_each_eth_queue(bp, i) { + struct bnx2x_fastpath *fp = &bp->fp[i]; ++ int tx_idx; + + /* Set the appropriate Queue object */ + q_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj; + +- /* Update the Queue state */ +- rc = bnx2x_queue_state_change(bp, &q_params); +- if (rc) { +- BNX2X_ERR("Failed to configure Tx switching\n"); +- return rc; ++ for (tx_idx = FIRST_TX_COS_INDEX; ++ tx_idx < fp->max_cos; tx_idx++) { ++ q_params.params.update.cid_index = tx_idx; ++ ++ /* Update the Queue state */ ++ rc = bnx2x_queue_state_change(bp, &q_params); ++ if (rc) { ++ BNX2X_ERR("Failed to configure Tx switching\n"); ++ return rc; ++ } + } + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 04ec909e06df..527e1bf93116 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1767,8 +1767,12 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + + rc = -EIO; + if (rx_err & RX_CMPL_ERRORS_BUFFER_ERROR_MASK) { +- netdev_warn(bp->dev, "RX buffer error %x\n", rx_err); +- bnxt_sched_reset(bp, rxr); ++ bnapi->cp_ring.rx_buf_errors++; ++ if (!(bp->flags & BNXT_FLAG_CHIP_P5)) { ++ netdev_warn(bp->dev, "RX buffer error %x\n", ++ rx_err); ++ bnxt_sched_reset(bp, rxr); ++ } + } + goto next_rx_no_len; + } +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index d333589811a5..5163bb848618 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -927,6 +927,7 @@ struct bnxt_cp_ring_info { + dma_addr_t hw_stats_map; + u32 hw_stats_ctx_id; + u64 rx_l4_csum_errors; ++ u64 rx_buf_errors; + u64 missed_irqs; + + struct bnxt_ring_struct cp_ring_struct; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +index 7151244f8c7d..7d2cfea05737 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -311,10 +311,17 @@ static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg, + } else { + rc = hwrm_send_message_silent(bp, msg, msg_len, + HWRM_CMD_TIMEOUT); +- if (!rc) ++ if (!rc) { + bnxt_copy_from_nvm_data(val, data, + nvm_param.nvm_num_bits, + nvm_param.dl_num_bytes); ++ } else { ++ struct hwrm_err_output *resp = bp->hwrm_cmd_resp_addr; ++ ++ if (resp->cmd_err == ++ NVM_GET_VARIABLE_CMD_ERR_CODE_VAR_NOT_EXIST) ++ rc = -EOPNOTSUPP; ++ } + } + dma_free_coherent(&bp->pdev->dev, sizeof(*data), data, data_dma_addr); + if (rc == -EACCES) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 51c140476717..89f95428556e 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -173,6 +173,7 @@ static const char * const bnxt_ring_tpa2_stats_str[] = { + + static const char * const bnxt_ring_sw_stats_str[] = { + "rx_l4_csum_errors", ++ "rx_buf_errors", + "missed_irqs", + }; + +@@ -552,6 +553,7 @@ static void bnxt_get_ethtool_stats(struct net_device *dev, + for (k = 0; k < stat_fields; j++, k++) + buf[j] = le64_to_cpu(hw_stats[k]); + buf[j++] = cpr->rx_l4_csum_errors; ++ buf[j++] = cpr->rx_buf_errors; + buf[j++] = cpr->missed_irqs; + + bnxt_sw_func_stats[RX_TOTAL_DISCARDS].counter += +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index a8f4c69252ff..2814b96751b4 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -576,6 +576,8 @@ static int gmac_setup_txqs(struct net_device *netdev) + + if (port->txq_dma_base & ~DMA_Q_BASE_MASK) { + dev_warn(geth->dev, "TX queue base is not aligned\n"); ++ dma_free_coherent(geth->dev, len * sizeof(*desc_ring), ++ desc_ring, port->txq_dma_base); + kfree(skb_tab); + return -ENOMEM; + } +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +index a9503aea527f..6437fe6b9abf 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +@@ -160,10 +160,10 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev) + irq = mc_dev->irqs[0]; + ptp_qoriq->irq = irq->msi_desc->irq; + +- err = devm_request_threaded_irq(dev, ptp_qoriq->irq, NULL, +- dpaa2_ptp_irq_handler_thread, +- IRQF_NO_SUSPEND | IRQF_ONESHOT, +- dev_name(dev), ptp_qoriq); ++ err = request_threaded_irq(ptp_qoriq->irq, NULL, ++ dpaa2_ptp_irq_handler_thread, ++ IRQF_NO_SUSPEND | IRQF_ONESHOT, ++ dev_name(dev), ptp_qoriq); + if (err < 0) { + dev_err(dev, "devm_request_threaded_irq(): %d\n", err); + goto err_free_mc_irq; +@@ -173,18 +173,20 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev) + DPRTC_IRQ_INDEX, 1); + if (err < 0) { + dev_err(dev, "dprtc_set_irq_enable(): %d\n", err); +- goto err_free_mc_irq; ++ goto err_free_threaded_irq; + } + + err = ptp_qoriq_init(ptp_qoriq, base, &dpaa2_ptp_caps); + if (err) +- goto err_free_mc_irq; ++ goto err_free_threaded_irq; + + dpaa2_phc_index = ptp_qoriq->phc_index; + dev_set_drvdata(dev, ptp_qoriq); + + return 0; + ++err_free_threaded_irq: ++ free_irq(ptp_qoriq->irq, ptp_qoriq); + err_free_mc_irq: + fsl_mc_free_irqs(mc_dev); + err_unmap: +diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c +index 4606a7e4a6d1..2ffe035e96d6 100644 +--- a/drivers/net/ethernet/hisilicon/hip04_eth.c ++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c +@@ -543,9 +543,9 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + skb_tx_timestamp(skb); + + hip04_set_xmit_desc(priv, phys); +- priv->tx_head = TX_NEXT(tx_head); + count++; + netdev_sent_queue(ndev, skb->len); ++ priv->tx_head = TX_NEXT(tx_head); + + stats->tx_bytes += skb->len; + stats->tx_packets++; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 616cad0faa21..84d8816c8681 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1692,6 +1692,9 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev) + time_after(jiffies, + (trans_start + ndev->watchdog_timeo))) { + timeout_queue = i; ++ netdev_info(ndev, "queue state: 0x%lx, delta msecs: %u\n", ++ q->state, ++ jiffies_to_msecs(jiffies - trans_start)); + break; + } + } +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index c052bb33b3d3..162881005a6d 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -9443,6 +9443,9 @@ static int hclge_reset_ae_dev(struct hnae3_ae_dev *ae_dev) + return ret; + } + ++ /* Log and clear the hw errors those already occurred */ ++ hclge_handle_all_hns_hw_errors(ae_dev); ++ + /* Re-enable the hw error interrupts because + * the interrupts get disabled on global reset. + */ +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 0686ded7ad3a..e1ab2feeae53 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -176,7 +176,7 @@ static int alloc_long_term_buff(struct ibmvnic_adapter *adapter, + ltb->map_id = adapter->map_id; + adapter->map_id++; + +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + rc = send_request_map(adapter, ltb->addr, + ltb->size, ltb->map_id); + if (rc) { +@@ -215,7 +215,7 @@ static int reset_long_term_buff(struct ibmvnic_adapter *adapter, + + memset(ltb->buff, 0, ltb->size); + +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + rc = send_request_map(adapter, ltb->addr, ltb->size, ltb->map_id); + if (rc) + return rc; +@@ -943,7 +943,7 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter) + if (adapter->vpd->buff) + len = adapter->vpd->len; + +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + crq.get_vpd_size.first = IBMVNIC_CRQ_CMD; + crq.get_vpd_size.cmd = GET_VPD_SIZE; + rc = ibmvnic_send_crq(adapter, &crq); +@@ -1689,7 +1689,7 @@ static int __ibmvnic_set_mac(struct net_device *netdev, u8 *dev_addr) + crq.change_mac_addr.cmd = CHANGE_MAC_ADDR; + ether_addr_copy(&crq.change_mac_addr.mac_addr[0], dev_addr); + +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + rc = ibmvnic_send_crq(adapter, &crq); + if (rc) { + rc = -EIO; +@@ -2316,7 +2316,7 @@ static int wait_for_reset(struct ibmvnic_adapter *adapter) + adapter->fallback.rx_entries = adapter->req_rx_add_entries_per_subcrq; + adapter->fallback.tx_entries = adapter->req_tx_entries_per_subcrq; + +- init_completion(&adapter->reset_done); ++ reinit_completion(&adapter->reset_done); + adapter->wait_for_reset = true; + rc = ibmvnic_reset(adapter, VNIC_RESET_CHANGE_PARAM); + if (rc) +@@ -2332,7 +2332,7 @@ static int wait_for_reset(struct ibmvnic_adapter *adapter) + adapter->desired.rx_entries = adapter->fallback.rx_entries; + adapter->desired.tx_entries = adapter->fallback.tx_entries; + +- init_completion(&adapter->reset_done); ++ reinit_completion(&adapter->reset_done); + adapter->wait_for_reset = true; + rc = ibmvnic_reset(adapter, VNIC_RESET_CHANGE_PARAM); + if (rc) +@@ -2603,7 +2603,7 @@ static void ibmvnic_get_ethtool_stats(struct net_device *dev, + cpu_to_be32(sizeof(struct ibmvnic_statistics)); + + /* Wait for data to be written */ +- init_completion(&adapter->stats_done); ++ reinit_completion(&adapter->stats_done); + rc = ibmvnic_send_crq(adapter, &crq); + if (rc) + return; +@@ -4408,7 +4408,7 @@ static int send_query_phys_parms(struct ibmvnic_adapter *adapter) + memset(&crq, 0, sizeof(crq)); + crq.query_phys_parms.first = IBMVNIC_CRQ_CMD; + crq.query_phys_parms.cmd = QUERY_PHYS_PARMS; +- init_completion(&adapter->fw_done); ++ reinit_completion(&adapter->fw_done); + rc = ibmvnic_send_crq(adapter, &crq); + if (rc) + return rc; +@@ -4960,6 +4960,9 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id) + INIT_LIST_HEAD(&adapter->rwi_list); + spin_lock_init(&adapter->rwi_lock); + init_completion(&adapter->init_done); ++ init_completion(&adapter->fw_done); ++ init_completion(&adapter->reset_done); ++ init_completion(&adapter->stats_done); + clear_bit(0, &adapter->resetting); + + do { +diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c +index 7560f06768e0..3160b5bbe672 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -2571,9 +2571,16 @@ noinline_for_stack i40e_status i40e_update_link_info(struct i40e_hw *hw) + if (status) + return status; + +- hw->phy.link_info.req_fec_info = +- abilities.fec_cfg_curr_mod_ext_info & +- (I40E_AQ_REQUEST_FEC_KR | I40E_AQ_REQUEST_FEC_RS); ++ if (abilities.fec_cfg_curr_mod_ext_info & ++ I40E_AQ_ENABLE_FEC_AUTO) ++ hw->phy.link_info.req_fec_info = ++ (I40E_AQ_REQUEST_FEC_KR | ++ I40E_AQ_REQUEST_FEC_RS); ++ else ++ hw->phy.link_info.req_fec_info = ++ abilities.fec_cfg_curr_mod_ext_info & ++ (I40E_AQ_REQUEST_FEC_KR | ++ I40E_AQ_REQUEST_FEC_RS); + + memcpy(hw->phy.link_info.module_type, &abilities.module_type, + sizeof(hw->phy.link_info.module_type)); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 41e1240acaea..b577e6adf3bf 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -722,7 +722,14 @@ static void i40e_get_settings_link_up_fec(u8 req_fec_info, + ethtool_link_ksettings_add_link_mode(ks, supported, FEC_RS); + ethtool_link_ksettings_add_link_mode(ks, supported, FEC_BASER); + +- if (I40E_AQ_SET_FEC_REQUEST_RS & req_fec_info) { ++ if ((I40E_AQ_SET_FEC_REQUEST_RS & req_fec_info) && ++ (I40E_AQ_SET_FEC_REQUEST_KR & req_fec_info)) { ++ ethtool_link_ksettings_add_link_mode(ks, advertising, ++ FEC_NONE); ++ ethtool_link_ksettings_add_link_mode(ks, advertising, ++ FEC_BASER); ++ ethtool_link_ksettings_add_link_mode(ks, advertising, FEC_RS); ++ } else if (I40E_AQ_SET_FEC_REQUEST_RS & req_fec_info) { + ethtool_link_ksettings_add_link_mode(ks, advertising, FEC_RS); + } else if (I40E_AQ_SET_FEC_REQUEST_KR & req_fec_info) { + ethtool_link_ksettings_add_link_mode(ks, advertising, +@@ -730,12 +737,6 @@ static void i40e_get_settings_link_up_fec(u8 req_fec_info, + } else { + ethtool_link_ksettings_add_link_mode(ks, advertising, + FEC_NONE); +- if (I40E_AQ_SET_FEC_AUTO & req_fec_info) { +- ethtool_link_ksettings_add_link_mode(ks, advertising, +- FEC_RS); +- ethtool_link_ksettings_add_link_mode(ks, advertising, +- FEC_BASER); +- } + } + } + +@@ -1437,6 +1438,7 @@ static int i40e_get_fec_param(struct net_device *netdev, + struct i40e_hw *hw = &pf->hw; + i40e_status status = 0; + int err = 0; ++ u8 fec_cfg; + + /* Get the current phy config */ + memset(&abilities, 0, sizeof(abilities)); +@@ -1448,18 +1450,16 @@ static int i40e_get_fec_param(struct net_device *netdev, + } + + fecparam->fec = 0; +- if (abilities.fec_cfg_curr_mod_ext_info & I40E_AQ_SET_FEC_AUTO) ++ fec_cfg = abilities.fec_cfg_curr_mod_ext_info; ++ if (fec_cfg & I40E_AQ_SET_FEC_AUTO) + fecparam->fec |= ETHTOOL_FEC_AUTO; +- if ((abilities.fec_cfg_curr_mod_ext_info & +- I40E_AQ_SET_FEC_REQUEST_RS) || +- (abilities.fec_cfg_curr_mod_ext_info & +- I40E_AQ_SET_FEC_ABILITY_RS)) ++ else if (fec_cfg & (I40E_AQ_SET_FEC_REQUEST_RS | ++ I40E_AQ_SET_FEC_ABILITY_RS)) + fecparam->fec |= ETHTOOL_FEC_RS; +- if ((abilities.fec_cfg_curr_mod_ext_info & +- I40E_AQ_SET_FEC_REQUEST_KR) || +- (abilities.fec_cfg_curr_mod_ext_info & I40E_AQ_SET_FEC_ABILITY_KR)) ++ else if (fec_cfg & (I40E_AQ_SET_FEC_REQUEST_KR | ++ I40E_AQ_SET_FEC_ABILITY_KR)) + fecparam->fec |= ETHTOOL_FEC_BASER; +- if (abilities.fec_cfg_curr_mod_ext_info == 0) ++ if (fec_cfg == 0) + fecparam->fec |= ETHTOOL_FEC_OFF; + + if (hw->phy.link_info.fec_info & I40E_AQ_CONFIG_FEC_KR_ENA) +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 6031223eafab..339925af0206 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -3534,14 +3534,14 @@ static void i40e_vsi_configure_msix(struct i40e_vsi *vsi) + q_vector->rx.target_itr = + ITR_TO_REG(vsi->rx_rings[i]->itr_setting); + wr32(hw, I40E_PFINT_ITRN(I40E_RX_ITR, vector - 1), +- q_vector->rx.target_itr); ++ q_vector->rx.target_itr >> 1); + q_vector->rx.current_itr = q_vector->rx.target_itr; + + q_vector->tx.next_update = jiffies + 1; + q_vector->tx.target_itr = + ITR_TO_REG(vsi->tx_rings[i]->itr_setting); + wr32(hw, I40E_PFINT_ITRN(I40E_TX_ITR, vector - 1), +- q_vector->tx.target_itr); ++ q_vector->tx.target_itr >> 1); + q_vector->tx.current_itr = q_vector->tx.target_itr; + + wr32(hw, I40E_PFINT_RATEN(vector - 1), +@@ -3646,11 +3646,11 @@ static void i40e_configure_msi_and_legacy(struct i40e_vsi *vsi) + /* set the ITR configuration */ + q_vector->rx.next_update = jiffies + 1; + q_vector->rx.target_itr = ITR_TO_REG(vsi->rx_rings[0]->itr_setting); +- wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr); ++ wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr >> 1); + q_vector->rx.current_itr = q_vector->rx.target_itr; + q_vector->tx.next_update = jiffies + 1; + q_vector->tx.target_itr = ITR_TO_REG(vsi->tx_rings[0]->itr_setting); +- wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr); ++ wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr >> 1); + q_vector->tx.current_itr = q_vector->tx.target_itr; + + i40e_enable_misc_int_causes(pf); +@@ -11396,7 +11396,7 @@ static int i40e_setup_misc_vector(struct i40e_pf *pf) + + /* associate no queues to the misc vector */ + wr32(hw, I40E_PFINT_LNKLST0, I40E_QUEUE_END_OF_LIST); +- wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K); ++ wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K >> 1); + + i40e_flush(hw); + +diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c +index 2353166c654e..c68709c7ef81 100644 +--- a/drivers/net/ethernet/intel/ice/ice_controlq.c ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c +@@ -948,7 +948,7 @@ ice_sq_send_cmd(struct ice_hw *hw, struct ice_ctl_q_info *cq, + if (ice_sq_done(hw, cq)) + break; + +- mdelay(1); ++ udelay(ICE_CTL_Q_SQ_CMD_USEC); + total_delay++; + } while (total_delay < cq->sq_cmd_timeout); + +diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.h b/drivers/net/ethernet/intel/ice/ice_controlq.h +index 44945c2165d8..4df9da359135 100644 +--- a/drivers/net/ethernet/intel/ice/ice_controlq.h ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.h +@@ -31,8 +31,9 @@ enum ice_ctl_q { + ICE_CTL_Q_MAILBOX, + }; + +-/* Control Queue default settings */ +-#define ICE_CTL_Q_SQ_CMD_TIMEOUT 250 /* msecs */ ++/* Control Queue timeout settings - max delay 250ms */ ++#define ICE_CTL_Q_SQ_CMD_TIMEOUT 2500 /* Count 2500 times */ ++#define ICE_CTL_Q_SQ_CMD_USEC 100 /* Check every 100usec */ + + struct ice_ctl_q_ring { + void *dma_head; /* Virtual address to DMA head */ +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index 7e23034df955..1fe9f6050635 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -3368,10 +3368,17 @@ __ice_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *ec, + struct ice_vsi *vsi = np->vsi; + + if (q_num < 0) { +- int i; ++ int v_idx; ++ ++ ice_for_each_q_vector(vsi, v_idx) { ++ /* In some cases if DCB is configured the num_[rx|tx]q ++ * can be less than vsi->num_q_vectors. This check ++ * accounts for that so we don't report a false failure ++ */ ++ if (v_idx >= vsi->num_rxq && v_idx >= vsi->num_txq) ++ goto set_complete; + +- ice_for_each_q_vector(vsi, i) { +- if (ice_set_q_coalesce(vsi, ec, i)) ++ if (ice_set_q_coalesce(vsi, ec, v_idx)) + return -EINVAL; + } + goto set_complete; +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 214cd6eca405..2408f0de95fc 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -3970,8 +3970,13 @@ int ice_vsi_setup_tx_rings(struct ice_vsi *vsi) + } + + ice_for_each_txq(vsi, i) { +- vsi->tx_rings[i]->netdev = vsi->netdev; +- err = ice_setup_tx_ring(vsi->tx_rings[i]); ++ struct ice_ring *ring = vsi->tx_rings[i]; ++ ++ if (!ring) ++ return -EINVAL; ++ ++ ring->netdev = vsi->netdev; ++ err = ice_setup_tx_ring(ring); + if (err) + break; + } +@@ -3996,8 +4001,13 @@ int ice_vsi_setup_rx_rings(struct ice_vsi *vsi) + } + + ice_for_each_rxq(vsi, i) { +- vsi->rx_rings[i]->netdev = vsi->netdev; +- err = ice_setup_rx_ring(vsi->rx_rings[i]); ++ struct ice_ring *ring = vsi->rx_rings[i]; ++ ++ if (!ring) ++ return -EINVAL; ++ ++ ring->netdev = vsi->netdev; ++ err = ice_setup_rx_ring(ring); + if (err) + break; + } +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +index b45797f39b2f..c0637a0cbfe8 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +@@ -317,8 +317,9 @@ void ice_free_vfs(struct ice_pf *pf) + pf->num_alloc_vfs = 0; + for (i = 0; i < tmp; i++) { + if (test_bit(ICE_VF_STATE_INIT, pf->vf[i].vf_states)) { +- /* disable VF qp mappings */ ++ /* disable VF qp mappings and set VF disable state */ + ice_dis_vf_mappings(&pf->vf[i]); ++ set_bit(ICE_VF_STATE_DIS, pf->vf[i].vf_states); + ice_free_vf_res(&pf->vf[i]); + } + } +@@ -1287,9 +1288,12 @@ static void ice_vc_notify_vf_reset(struct ice_vf *vf) + if (!vf || vf->vf_id >= vf->pf->num_alloc_vfs) + return; + +- /* verify if the VF is in either init or active before proceeding */ +- if (!test_bit(ICE_VF_STATE_INIT, vf->vf_states) && +- !test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) ++ /* Bail out if VF is in disabled state, neither initialized, nor active ++ * state - otherwise proceed with notifications ++ */ ++ if ((!test_bit(ICE_VF_STATE_INIT, vf->vf_states) && ++ !test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) || ++ test_bit(ICE_VF_STATE_DIS, vf->vf_states)) + return; + + pfe.event = VIRTCHNL_EVENT_RESET_IMPENDING; +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 91b3780ddb04..1a7203fede12 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8639,7 +8639,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, + + if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && + adapter->ptp_clock) { +- if (!test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, ++ if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON && ++ !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, + &adapter->state)) { + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; + tx_flags |= IXGBE_TX_FLAGS_TSTAMP; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index c2c7f214a56a..814a4ba4e7fa 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -3443,6 +3443,12 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, + attr->action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; + } + ++ if (!(attr->action & ++ (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP))) { ++ NL_SET_ERR_MSG(extack, "Rule must have at least one forward/drop action"); ++ return -EOPNOTSUPP; ++ } ++ + if (attr->split_count > 0 && !mlx5_esw_has_fwd_fdb(priv->mdev)) { + NL_SET_ERR_MSG_MOD(extack, + "current firmware doesn't support split rule for port mirroring"); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 39d600c8b92d..210ebc91d3d6 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -5637,8 +5637,13 @@ static void mlxsw_sp_router_fib6_del(struct mlxsw_sp *mlxsw_sp, + if (mlxsw_sp_fib6_rt_should_ignore(rt)) + return; + ++ /* Multipath routes are first added to the FIB trie and only then ++ * notified. If we vetoed the addition, we will get a delete ++ * notification for a route we do not have. Therefore, do not warn if ++ * route was not found. ++ */ + fib6_entry = mlxsw_sp_fib6_entry_lookup(mlxsw_sp, rt); +- if (WARN_ON(!fib6_entry)) ++ if (!fib6_entry) + return; + + /* If not all the nexthops are deleted, then only reduce the nexthop +diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +index 7c4a15e967df..5defd31d481c 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +@@ -65,17 +65,17 @@ static int nfp_get_stats_entry(struct nfp_app *app, u32 *stats_context_id) + freed_stats_id = priv->stats_ring_size; + /* Check for unallocated entries first. */ + if (priv->stats_ids.init_unalloc > 0) { +- if (priv->active_mem_unit == priv->total_mem_units) { +- priv->stats_ids.init_unalloc--; +- priv->active_mem_unit = 0; +- } +- + *stats_context_id = + FIELD_PREP(NFP_FL_STAT_ID_STAT, + priv->stats_ids.init_unalloc - 1) | + FIELD_PREP(NFP_FL_STAT_ID_MU_NUM, + priv->active_mem_unit); +- priv->active_mem_unit++; ++ ++ if (++priv->active_mem_unit == priv->total_mem_units) { ++ priv->stats_ids.init_unalloc--; ++ priv->active_mem_unit = 0; ++ } ++ + return 0; + } + +diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c +index 9a6a9a008714..c8bdbf057d5a 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c +@@ -1230,7 +1230,7 @@ qede_configure_mcast_filtering(struct net_device *ndev, + netif_addr_lock_bh(ndev); + + mc_count = netdev_mc_count(ndev); +- if (mc_count < 64) { ++ if (mc_count <= 64) { + netdev_for_each_mc_addr(ha, ndev) { + ether_addr_copy(temp, ha->addr); + temp += ETH_ALEN; +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index a220cc7c947a..ba53612ae0df 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -1406,6 +1406,7 @@ static int qede_alloc_mem_rxq(struct qede_dev *edev, struct qede_rx_queue *rxq) + rxq->rx_buf_seg_size = roundup_pow_of_two(size); + } else { + rxq->rx_buf_seg_size = PAGE_SIZE; ++ edev->ndev->features &= ~NETIF_F_GRO_HW; + } + + /* Allocate the parallel driver ring for Rx buffers */ +@@ -1450,6 +1451,7 @@ static int qede_alloc_mem_rxq(struct qede_dev *edev, struct qede_rx_queue *rxq) + } + } + ++ edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW); + if (!edev->gro_disable) + qede_set_tpa_param(rxq); + err: +@@ -1702,8 +1704,6 @@ static void qede_init_fp(struct qede_dev *edev) + snprintf(fp->name, sizeof(fp->name), "%s-fp-%d", + edev->ndev->name, queue_id); + } +- +- edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW); + } + + static int qede_set_real_num_queues(struct qede_dev *edev) +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index b4b8ba00ee01..986f26578d34 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -2756,6 +2756,9 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + int err; + + for (i = 0; i < qdev->num_large_buffers; i++) { ++ lrg_buf_cb = &qdev->lrg_buf[i]; ++ memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); ++ + skb = netdev_alloc_skb(qdev->ndev, + qdev->lrg_buffer_len); + if (unlikely(!skb)) { +@@ -2766,11 +2769,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + ql_free_large_buffers(qdev); + return -ENOMEM; + } else { +- +- lrg_buf_cb = &qdev->lrg_buf[i]; +- memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); + lrg_buf_cb->index = i; +- lrg_buf_cb->skb = skb; + /* + * We save some space to copy the ethhdr from first + * buffer +@@ -2792,6 +2791,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + return -ENOMEM; + } + ++ lrg_buf_cb->skb = skb; + dma_unmap_addr_set(lrg_buf_cb, mapaddr, map); + dma_unmap_len_set(lrg_buf_cb, maplen, + qdev->lrg_buffer_len - +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 4fe0977d01fa..5ae0b5663d54 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -680,6 +680,7 @@ struct rtl8169_private { + struct rtl8169_counters *counters; + struct rtl8169_tc_offsets tc_offset; + u32 saved_wolopts; ++ int eee_adv; + + const char *fw_name; + struct rtl_fw *rtl_fw; +@@ -2075,6 +2076,10 @@ static int rtl8169_set_eee(struct net_device *dev, struct ethtool_eee *data) + } + + ret = phy_ethtool_set_eee(tp->phydev, data); ++ ++ if (!ret) ++ tp->eee_adv = phy_read_mmd(dev->phydev, MDIO_MMD_AN, ++ MDIO_AN_EEE_ADV); + out: + pm_runtime_put_noidle(d); + return ret; +@@ -2105,10 +2110,16 @@ static const struct ethtool_ops rtl8169_ethtool_ops = { + static void rtl_enable_eee(struct rtl8169_private *tp) + { + struct phy_device *phydev = tp->phydev; +- int supported = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE); ++ int adv; ++ ++ /* respect EEE advertisement the user may have set */ ++ if (tp->eee_adv >= 0) ++ adv = tp->eee_adv; ++ else ++ adv = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE); + +- if (supported > 0) +- phy_write_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV, supported); ++ if (adv >= 0) ++ phy_write_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV, adv); + } + + static void rtl8169_get_mac_version(struct rtl8169_private *tp) +@@ -7064,6 +7075,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + tp->pci_dev = pdev; + tp->msg_enable = netif_msg_init(debug.msg_enable, R8169_MSG_DEFAULT); + tp->supports_gmii = ent->driver_data == RTL_CFG_NO_GBIT ? 0 : 1; ++ tp->eee_adv = -1; + + /* Get the *optional* external "ether_clk" used on some boards */ + rc = rtl_get_ether_clk(tp); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 170c3a052b14..1f230bd854c4 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -320,7 +320,7 @@ out: + static int stmmac_dt_phy(struct plat_stmmacenet_data *plat, + struct device_node *np, struct device *dev) + { +- bool mdio = true; ++ bool mdio = false; + static const struct of_device_id need_mdio_ids[] = { + { .compatible = "snps,dwc-qos-ethernet-4.10" }, + {}, +diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig +index 834afca3a019..137632b09c72 100644 +--- a/drivers/net/ethernet/ti/Kconfig ++++ b/drivers/net/ethernet/ti/Kconfig +@@ -22,6 +22,7 @@ config TI_DAVINCI_EMAC + depends on ARM && ( ARCH_DAVINCI || ARCH_OMAP3 ) || COMPILE_TEST + select TI_DAVINCI_MDIO + select PHYLIB ++ select GENERIC_ALLOCATOR + ---help--- + This driver supports TI's DaVinci Ethernet . + +diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c +index 84025dcc78d5..e7c24396933e 100644 +--- a/drivers/net/ethernet/ti/cpsw_ale.c ++++ b/drivers/net/ethernet/ti/cpsw_ale.c +@@ -779,6 +779,7 @@ void cpsw_ale_start(struct cpsw_ale *ale) + void cpsw_ale_stop(struct cpsw_ale *ale) + { + del_timer_sync(&ale->timer); ++ cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1); + cpsw_ale_control_set(ale, 0, ALE_ENABLE, 0); + } + +@@ -862,6 +863,7 @@ struct cpsw_ale *cpsw_ale_create(struct cpsw_ale_params *params) + ALE_UNKNOWNVLAN_FORCE_UNTAG_EGRESS; + } + ++ cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1); + return ale; + } + +diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c +index 37ba708ac781..6614fa3089b2 100644 +--- a/drivers/net/ethernet/ti/davinci_cpdma.c ++++ b/drivers/net/ethernet/ti/davinci_cpdma.c +@@ -1018,7 +1018,6 @@ static int cpdma_chan_submit_si(struct submit_info *si) + struct cpdma_chan *chan = si->chan; + struct cpdma_ctlr *ctlr = chan->ctlr; + int len = si->len; +- int swlen = len; + struct cpdma_desc __iomem *desc; + dma_addr_t buffer; + u32 mode; +@@ -1046,7 +1045,6 @@ static int cpdma_chan_submit_si(struct submit_info *si) + if (si->data_dma) { + buffer = si->data_dma; + dma_sync_single_for_device(ctlr->dev, buffer, len, chan->dir); +- swlen |= CPDMA_DMA_EXT_MAP; + } else { + buffer = dma_map_single(ctlr->dev, si->data_virt, len, chan->dir); + ret = dma_mapping_error(ctlr->dev, buffer); +@@ -1065,7 +1063,8 @@ static int cpdma_chan_submit_si(struct submit_info *si) + writel_relaxed(mode | len, &desc->hw_mode); + writel_relaxed((uintptr_t)si->token, &desc->sw_token); + writel_relaxed(buffer, &desc->sw_buffer); +- writel_relaxed(swlen, &desc->sw_len); ++ writel_relaxed(si->data_dma ? len | CPDMA_DMA_EXT_MAP : len, ++ &desc->sw_len); + desc_read(desc, sw_len); + + __cpdma_chan_submit(chan, desc); +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index b517c1af9de0..91a1059517f5 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -166,6 +166,9 @@ static int fjes_acpi_add(struct acpi_device *device) + /* create platform_device */ + plat_dev = platform_device_register_simple(DRV_NAME, 0, fjes_resource, + ARRAY_SIZE(fjes_resource)); ++ if (IS_ERR(plat_dev)) ++ return PTR_ERR(plat_dev); ++ + device->driver_data = plat_dev; + + return 0; +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index 37fceaf9fa10..cf4455bbf888 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -95,6 +95,10 @@ + #define DP83867_IO_MUX_CFG_CLK_O_SEL_MASK (0x1f << 8) + #define DP83867_IO_MUX_CFG_CLK_O_SEL_SHIFT 8 + ++/* CFG3 bits */ ++#define DP83867_CFG3_INT_OE BIT(7) ++#define DP83867_CFG3_ROBUST_AUTO_MDIX BIT(9) ++ + /* CFG4 bits */ + #define DP83867_CFG4_PORT_MIRROR_EN BIT(0) + +@@ -410,12 +414,13 @@ static int dp83867_config_init(struct phy_device *phydev) + phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_SGMIICTL, val); + } + ++ val = phy_read(phydev, DP83867_CFG3); + /* Enable Interrupt output INT_OE in CFG3 register */ +- if (phy_interrupt_is_valid(phydev)) { +- val = phy_read(phydev, DP83867_CFG3); +- val |= BIT(7); +- phy_write(phydev, DP83867_CFG3, val); +- } ++ if (phy_interrupt_is_valid(phydev)) ++ val |= DP83867_CFG3_INT_OE; ++ ++ val |= DP83867_CFG3_ROBUST_AUTO_MDIX; ++ phy_write(phydev, DP83867_CFG3, val); + + if (dp83867->port_mirroring != DP83867_PORT_MIRROING_KEEP) + dp83867_config_port_mirroring(phydev); +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index adb66a2fae18..2bf0fda209a8 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -488,7 +488,7 @@ static int phy_bus_match(struct device *dev, struct device_driver *drv) + + if (phydev->is_c45) { + for (i = 1; i < num_ids; i++) { +- if (!(phydev->c45_ids.devices_in_package & (1 << i))) ++ if (phydev->c45_ids.device_ids[i] == 0xffffffff) + continue; + + if ((phydrv->phy_id & phydrv->phy_id_mask) == +@@ -552,7 +552,7 @@ static const struct device_type mdio_bus_phy_type = { + .pm = MDIO_BUS_PHY_PM_OPS, + }; + +-static int phy_request_driver_module(struct phy_device *dev, int phy_id) ++static int phy_request_driver_module(struct phy_device *dev, u32 phy_id) + { + int ret; + +@@ -564,15 +564,15 @@ static int phy_request_driver_module(struct phy_device *dev, int phy_id) + * then modprobe isn't available. + */ + if (IS_ENABLED(CONFIG_MODULES) && ret < 0 && ret != -ENOENT) { +- phydev_err(dev, "error %d loading PHY driver module for ID 0x%08x\n", +- ret, phy_id); ++ phydev_err(dev, "error %d loading PHY driver module for ID 0x%08lx\n", ++ ret, (unsigned long)phy_id); + return ret; + } + + return 0; + } + +-struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, ++struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + bool is_c45, + struct phy_c45_device_ids *c45_ids) + { +@@ -596,8 +596,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, + mdiodev->device_free = phy_mdio_device_free; + mdiodev->device_remove = phy_mdio_device_remove; + +- dev->speed = 0; +- dev->duplex = -1; ++ dev->speed = SPEED_UNKNOWN; ++ dev->duplex = DUPLEX_UNKNOWN; + dev->pause = 0; + dev->asym_pause = 0; + dev->link = 0; +@@ -632,7 +632,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, + int i; + + for (i = 1; i < num_ids; i++) { +- if (!(c45_ids->devices_in_package & (1 << i))) ++ if (c45_ids->device_ids[i] == 0xffffffff) + continue; + + ret = phy_request_driver_module(dev, +@@ -812,10 +812,13 @@ static int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id, + */ + struct phy_device *get_phy_device(struct mii_bus *bus, int addr, bool is_c45) + { +- struct phy_c45_device_ids c45_ids = {0}; ++ struct phy_c45_device_ids c45_ids; + u32 phy_id = 0; + int r; + ++ c45_ids.devices_in_package = 0; ++ memset(c45_ids.device_ids, 0xff, sizeof(c45_ids.device_ids)); ++ + r = get_phy_id(bus, addr, &phy_id, is_c45, &c45_ids); + if (r) + return ERR_PTR(r); +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 8156b33ee3e7..ca70a1d840eb 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -2074,7 +2074,8 @@ static int team_ethtool_get_link_ksettings(struct net_device *dev, + cmd->base.duplex = DUPLEX_UNKNOWN; + cmd->base.port = PORT_OTHER; + +- list_for_each_entry(port, &team->port_list, list) { ++ rcu_read_lock(); ++ list_for_each_entry_rcu(port, &team->port_list, list) { + if (team_port_txable(port)) { + if (port->state.speed != SPEED_UNKNOWN) + speed += port->state.speed; +@@ -2083,6 +2084,8 @@ static int team_ethtool_get_link_ksettings(struct net_device *dev, + cmd->base.duplex = port->state.duplex; + } + } ++ rcu_read_unlock(); ++ + cmd->base.speed = speed ? : SPEED_UNKNOWN; + + return 0; +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index a8d3141582a5..16564ebcde50 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -313,8 +313,8 @@ static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile, + tfile->napi_enabled = napi_en; + tfile->napi_frags_enabled = napi_en && napi_frags; + if (napi_en) { +- netif_napi_add(tun->dev, &tfile->napi, tun_napi_poll, +- NAPI_POLL_WEIGHT); ++ netif_tx_napi_add(tun->dev, &tfile->napi, tun_napi_poll, ++ NAPI_POLL_WEIGHT); + napi_enable(&tfile->napi); + } + } +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index f24a1b0b801f..0becc79fd431 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1808,6 +1808,7 @@ static int lan78xx_mdio_init(struct lan78xx_net *dev) + dev->mdiobus->read = lan78xx_mdiobus_read; + dev->mdiobus->write = lan78xx_mdiobus_write; + dev->mdiobus->name = "lan78xx-mdiobus"; ++ dev->mdiobus->parent = &dev->udev->dev; + + snprintf(dev->mdiobus->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", + dev->udev->bus->busnum, dev->udev->devnum); +diff --git a/drivers/net/wireless/ath/ath10k/coredump.c b/drivers/net/wireless/ath/ath10k/coredump.c +index b6d2932383cf..1cfe75a2d0c3 100644 +--- a/drivers/net/wireless/ath/ath10k/coredump.c ++++ b/drivers/net/wireless/ath/ath10k/coredump.c +@@ -1208,9 +1208,11 @@ static struct ath10k_dump_file_data *ath10k_coredump_build(struct ath10k *ar) + dump_tlv = (struct ath10k_tlv_dump_data *)(buf + sofar); + dump_tlv->type = cpu_to_le32(ATH10K_FW_CRASH_DUMP_RAM_DATA); + dump_tlv->tlv_len = cpu_to_le32(crash_data->ramdump_buf_len); +- memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf, +- crash_data->ramdump_buf_len); +- sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len; ++ if (crash_data->ramdump_buf_len) { ++ memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf, ++ crash_data->ramdump_buf_len); ++ sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len; ++ } + } + + mutex_unlock(&ar->dump_mutex); +@@ -1257,6 +1259,9 @@ int ath10k_coredump_register(struct ath10k *ar) + if (test_bit(ATH10K_FW_CRASH_DUMP_RAM_DATA, &ath10k_coredump_mask)) { + crash_data->ramdump_buf_len = ath10k_coredump_get_ramdump_size(ar); + ++ if (!crash_data->ramdump_buf_len) ++ return 0; ++ + crash_data->ramdump_buf = vzalloc(crash_data->ramdump_buf_len); + if (!crash_data->ramdump_buf) + return -ENOMEM; +diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c +index 53f1095de8ff..9f0e7b4943ec 100644 +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -2726,7 +2726,7 @@ static void ath10k_htt_rx_tx_compl_ind(struct ath10k *ar, + spin_lock_bh(&ar->data_lock); + + peer = ath10k_peer_find_by_id(ar, peer_id); +- if (!peer) { ++ if (!peer || !peer->sta) { + spin_unlock_bh(&ar->data_lock); + rcu_read_unlock(); + continue; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index a6d21856b7e7..36d24ea126a2 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3708,7 +3708,7 @@ static int ath10k_mac_tx(struct ath10k *ar, + struct ieee80211_vif *vif, + enum ath10k_hw_txrx_mode txmode, + enum ath10k_mac_tx_path txpath, +- struct sk_buff *skb) ++ struct sk_buff *skb, bool noque_offchan) + { + struct ieee80211_hw *hw = ar->hw; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); +@@ -3738,10 +3738,10 @@ static int ath10k_mac_tx(struct ath10k *ar, + } + } + +- if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { ++ if (!noque_offchan && info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { + if (!ath10k_mac_tx_frm_has_freq(ar)) { +- ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac queued offchannel skb %pK len %d\n", ++ skb, skb->len); + + skb_queue_tail(&ar->offchan_tx_queue, skb); + ieee80211_queue_work(hw, &ar->offchan_tx_work); +@@ -3803,8 +3803,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + + mutex_lock(&ar->conf_mutex); + +- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK len %d\n", ++ skb, skb->len); + + hdr = (struct ieee80211_hdr *)skb->data; + peer_addr = ieee80211_get_DA(hdr); +@@ -3850,7 +3850,7 @@ void ath10k_offchan_tx_work(struct work_struct *work) + txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb); + txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode); + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, true); + if (ret) { + ath10k_warn(ar, "failed to transmit offchannel frame: %d\n", + ret); +@@ -3860,8 +3860,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + time_left = + wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ); + if (time_left == 0) +- ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n", +- skb); ++ ath10k_warn(ar, "timed out waiting for offchannel skb %pK, len: %d\n", ++ skb, skb->len); + + if (!peer && tmp_peer_created) { + ret = ath10k_peer_delete(ar, vdev_id, peer_addr); +@@ -3903,8 +3903,10 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work) + ar->running_fw->fw_file.fw_features)) { + paddr = dma_map_single(ar->dev, skb->data, + skb->len, DMA_TO_DEVICE); +- if (!paddr) ++ if (dma_mapping_error(ar->dev, paddr)) { ++ ieee80211_free_txskb(ar->hw, skb); + continue; ++ } + ret = ath10k_wmi_mgmt_tx_send(ar, skb, paddr); + if (ret) { + ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n", +@@ -4097,7 +4099,7 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (unlikely(ret)) { + ath10k_warn(ar, "failed to push frame: %d\n", ret); + +@@ -4378,7 +4380,7 @@ static void ath10k_mac_op_tx(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (ret) { + ath10k_warn(ar, "failed to transmit frame: %d\n", ret); + if (is_htt) { +diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c +index 4102df016931..39abf8b12903 100644 +--- a/drivers/net/wireless/ath/ath10k/txrx.c ++++ b/drivers/net/wireless/ath/ath10k/txrx.c +@@ -95,6 +95,8 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, + + info = IEEE80211_SKB_CB(msdu); + memset(&info->status, 0, sizeof(info->status)); ++ info->status.rates[0].idx = -1; ++ + trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id); + + if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index 406b367c284c..85cf96461dde 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -1350,6 +1350,11 @@ void brcmf_detach(struct device *dev) + brcmf_fweh_detach(drvr); + brcmf_proto_detach(drvr); + ++ if (drvr->mon_if) { ++ brcmf_net_detach(drvr->mon_if->ndev, false); ++ drvr->mon_if = NULL; ++ } ++ + /* make sure primary interface removed last */ + for (i = BRCMF_MAX_IFS - 1; i > -1; i--) { + if (drvr->iflist[i]) +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/led.c b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +index dd387aba3317..e8a4d604b910 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +@@ -171,6 +171,9 @@ void iwl_leds_init(struct iwl_priv *priv) + + priv->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(priv->hw->wiphy)); ++ if (!priv->led.name) ++ return; ++ + priv->led.brightness_set = iwl_led_brightness_set; + priv->led.blink_set = iwl_led_blink_set; + priv->led.max_brightness = 1; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +index d104da9170ca..72c4b2b8399d 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +@@ -129,6 +129,9 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm) + + mvm->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(mvm->hw->wiphy)); ++ if (!mvm->led.name) ++ return -ENOMEM; ++ + mvm->led.brightness_set = iwl_led_brightness_set; + mvm->led.max_brightness = 1; + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +index 0ad8ed23a455..5ee33c8ae9d2 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +@@ -60,6 +60,7 @@ + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + *****************************************************************************/ ++#include + #include + #include + #include "iwl-trans.h" +@@ -357,7 +358,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi, + rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data; + hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res)); + len = le16_to_cpu(rx_res->byte_count); +- rx_pkt_status = le32_to_cpup((__le32 *) ++ rx_pkt_status = get_unaligned_le32((__le32 *) + (pkt->data + sizeof(*rx_res) + len)); + + /* Dont use dev_alloc_skb(), we'll have enough headroom once +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index 19dd075f2f63..041dd75ac72b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -1429,6 +1429,7 @@ out_err: + static void iwl_pcie_rx_handle(struct iwl_trans *trans, int queue) + { + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); ++ struct napi_struct *napi; + struct iwl_rxq *rxq; + u32 r, i, count = 0; + bool emergency = false; +@@ -1534,8 +1535,16 @@ out: + if (unlikely(emergency && count)) + iwl_pcie_rxq_alloc_rbs(trans, GFP_ATOMIC, rxq); + +- if (rxq->napi.poll) +- napi_gro_flush(&rxq->napi, false); ++ napi = &rxq->napi; ++ if (napi->poll) { ++ if (napi->rx_count) { ++ netif_receive_skb_list(&napi->rx_list); ++ INIT_LIST_HEAD(&napi->rx_list); ++ napi->rx_count = 0; ++ } ++ ++ napi_gro_flush(napi, false); ++ } + + iwl_pcie_rxq_restock(trans, rxq); + } +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c +index ca3bb4d65b00..df8455f14e4d 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c +@@ -57,24 +57,6 @@ + #include "internal.h" + #include "fw/dbg.h" + +-static int iwl_pcie_gen2_force_power_gating(struct iwl_trans *trans) +-{ +- iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG, +- HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE); +- udelay(20); +- iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG, +- HPM_HIPM_GEN_CFG_CR_PG_EN | +- HPM_HIPM_GEN_CFG_CR_SLP_EN); +- udelay(20); +- iwl_clear_bits_prph(trans, HPM_HIPM_GEN_CFG, +- HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE); +- +- iwl_trans_sw_reset(trans); +- iwl_clear_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE); +- +- return 0; +-} +- + /* + * Start up NIC's basic functionality after it has been reset + * (e.g. after platform boot, or shutdown via iwl_pcie_apm_stop()) +@@ -110,13 +92,6 @@ int iwl_pcie_gen2_apm_init(struct iwl_trans *trans) + + iwl_pcie_apm_config(trans); + +- if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 && +- trans->cfg->integrated) { +- ret = iwl_pcie_gen2_force_power_gating(trans); +- if (ret) +- return ret; +- } +- + ret = iwl_finish_nic_init(trans, trans->trans_cfg); + if (ret) + return ret; +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 6961f00ff812..d3db38c3095b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -1783,6 +1783,29 @@ static int iwl_trans_pcie_clear_persistence_bit(struct iwl_trans *trans) + return 0; + } + ++static int iwl_pcie_gen2_force_power_gating(struct iwl_trans *trans) ++{ ++ int ret; ++ ++ ret = iwl_finish_nic_init(trans, trans->trans_cfg); ++ if (ret < 0) ++ return ret; ++ ++ iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG, ++ HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE); ++ udelay(20); ++ iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG, ++ HPM_HIPM_GEN_CFG_CR_PG_EN | ++ HPM_HIPM_GEN_CFG_CR_SLP_EN); ++ udelay(20); ++ iwl_clear_bits_prph(trans, HPM_HIPM_GEN_CFG, ++ HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE); ++ ++ iwl_trans_pcie_sw_reset(trans); ++ ++ return 0; ++} ++ + static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans) + { + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); +@@ -1802,6 +1825,13 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans) + + iwl_trans_pcie_sw_reset(trans); + ++ if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 && ++ trans->cfg->integrated) { ++ err = iwl_pcie_gen2_force_power_gating(trans); ++ if (err) ++ return err; ++ } ++ + err = iwl_pcie_apm_init(trans); + if (err) + return err; +diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c +index 242d8845da3f..30f1025ecb9b 100644 +--- a/drivers/net/wireless/marvell/libertas/if_sdio.c ++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c +@@ -1179,6 +1179,10 @@ static int if_sdio_probe(struct sdio_func *func, + + spin_lock_init(&card->lock); + card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0); ++ if (unlikely(!card->workqueue)) { ++ ret = -ENOMEM; ++ goto err_queue; ++ } + INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker); + init_waitqueue_head(&card->pwron_waitq); + +@@ -1230,6 +1234,7 @@ err_activate_card: + lbs_remove_card(priv); + free: + destroy_workqueue(card->workqueue); ++err_queue: + while (card->packets) { + packet = card->packets; + card->packets = card->packets->next; +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index eff06d59e9df..096334e941a1 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -687,8 +687,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + skb_put(skb, MAX_EVENT_SIZE); + + if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); ++ kfree(card->evtbd_ring_vbase); + return -1; ++ } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c +index c328192307c4..ff3f3d98b625 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c +@@ -1032,8 +1032,10 @@ mt7603_fill_txs(struct mt7603_dev *dev, struct mt7603_sta *sta, + if (idx && (cur_rate->idx != info->status.rates[i].idx || + cur_rate->flags != info->status.rates[i].flags)) { + i++; +- if (i == ARRAY_SIZE(info->status.rates)) ++ if (i == ARRAY_SIZE(info->status.rates)) { ++ i--; + break; ++ } + + info->status.rates[i] = *cur_rate; + info->status.rates[i].count = 0; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index e07ce2c10013..111e38ff954a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -914,8 +914,10 @@ static bool mt7615_fill_txs(struct mt7615_dev *dev, struct mt7615_sta *sta, + if (idx && (cur_rate->idx != info->status.rates[i].idx || + cur_rate->flags != info->status.rates[i].flags)) { + i++; +- if (i == ARRAY_SIZE(info->status.rates)) ++ if (i == ARRAY_SIZE(info->status.rates)) { ++ i--; + break; ++ } + + info->status.rates[i] = *cur_rate; + info->status.rates[i].count = 0; +diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c +index dc0c7244b60e..c0c32805fb8d 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c +@@ -83,6 +83,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus, + struct qlink_cmd *cmd; + struct qlink_resp *resp = NULL; + struct sk_buff *resp_skb = NULL; ++ int resp_res = 0; + u16 cmd_id; + u8 mac_id; + u8 vif_id; +@@ -113,6 +114,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus, + } + + resp = (struct qlink_resp *)resp_skb->data; ++ resp_res = le16_to_cpu(resp->result); + ret = qtnf_cmd_check_reply_header(resp, cmd_id, mac_id, vif_id, + const_resp_size); + if (ret) +@@ -128,8 +130,8 @@ out: + else + consume_skb(resp_skb); + +- if (!ret && resp) +- return qtnf_cmd_resp_result_decode(le16_to_cpu(resp->result)); ++ if (!ret) ++ return qtnf_cmd_resp_result_decode(resp_res); + + pr_warn("VIF%u.%u: cmd 0x%.4X failed: %d\n", + mac_id, vif_id, cmd_id, ret); +diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/wireless/quantenna/qtnfmac/event.c +index b57c8c18a8d0..7846383c8828 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/event.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/event.c +@@ -171,8 +171,9 @@ qtnf_event_handle_bss_join(struct qtnf_vif *vif, + return -EPROTO; + } + +- pr_debug("VIF%u.%u: BSSID:%pM status:%u\n", +- vif->mac->macid, vif->vifid, join_info->bssid, status); ++ pr_debug("VIF%u.%u: BSSID:%pM chan:%u status:%u\n", ++ vif->mac->macid, vif->vifid, join_info->bssid, ++ le16_to_cpu(join_info->chan.chan.center_freq), status); + + if (status != WLAN_STATUS_SUCCESS) + goto done; +@@ -181,7 +182,7 @@ qtnf_event_handle_bss_join(struct qtnf_vif *vif, + if (!cfg80211_chandef_valid(&chandef)) { + pr_warn("MAC%u.%u: bad channel freq=%u cf1=%u cf2=%u bw=%u\n", + vif->mac->macid, vif->vifid, +- chandef.chan->center_freq, ++ chandef.chan ? chandef.chan->center_freq : 0, + chandef.center_freq1, + chandef.center_freq2, + chandef.width); +diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c +index 8ae318b5fe54..4824be0c6231 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c +@@ -130,6 +130,8 @@ static int qtnf_dbg_shm_stats(struct seq_file *s, void *data) + + int qtnf_pcie_fw_boot_done(struct qtnf_bus *bus) + { ++ struct qtnf_pcie_bus_priv *priv = get_bus_priv(bus); ++ char card_id[64]; + int ret; + + bus->fw_state = QTNF_FW_STATE_BOOT_DONE; +@@ -137,7 +139,9 @@ int qtnf_pcie_fw_boot_done(struct qtnf_bus *bus) + if (ret) { + pr_err("failed to attach core\n"); + } else { +- qtnf_debugfs_init(bus, DRV_NAME); ++ snprintf(card_id, sizeof(card_id), "%s:%s", ++ DRV_NAME, pci_name(priv->pdev)); ++ qtnf_debugfs_init(bus, card_id); + qtnf_debugfs_add_entry(bus, "mps", qtnf_dbg_mps_show); + qtnf_debugfs_add_entry(bus, "msi_enabled", qtnf_dbg_msi_show); + qtnf_debugfs_add_entry(bus, "shm_stats", qtnf_dbg_shm_stats); +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index ade057d868f7..5e9ce03067de 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -1341,6 +1341,7 @@ struct rtl8xxxu_fileops { + u8 has_s0s1:1; + u8 has_tx_report:1; + u8 gen2_thermal_meter:1; ++ u8 needs_full_init:1; + u32 adda_1t_init; + u32 adda_1t_path_on; + u32 adda_2t_path_on_a; +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +index ceffe05bd65b..f3cd314d1a9c 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +@@ -1670,6 +1670,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops = { + .has_s0s1 = 1, + .has_tx_report = 1, + .gen2_thermal_meter = 1, ++ .needs_full_init = 1, + .adda_1t_init = 0x01c00014, + .adda_1t_path_on = 0x01c00014, + .adda_2t_path_on_a = 0x01c00014, +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index c6c41fb962ff..361248e97568 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -3902,6 +3902,9 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) + else + macpower = true; + ++ if (fops->needs_full_init) ++ macpower = false; ++ + ret = fops->power_on(priv); + if (ret < 0) { + dev_warn(dev, "%s: Failed power on\n", __func__); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +index 56cc3bc30860..f070f25bb735 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +@@ -1540,6 +1540,8 @@ static bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb) + * This is maybe necessary: + * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb); + */ ++ dev_kfree_skb(skb); ++ + return true; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 4b59f3b46b28..348b0072cdd6 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1021,8 +1021,10 @@ int rtl_usb_probe(struct usb_interface *intf, + rtlpriv->hw = hw; + rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32), + GFP_KERNEL); +- if (!rtlpriv->usb_data) ++ if (!rtlpriv->usb_data) { ++ ieee80211_free_hw(hw); + return -ENOMEM; ++ } + + /* this spin lock must be initialized early */ + spin_lock_init(&rtlpriv->locks.usb_lock); +@@ -1083,6 +1085,7 @@ error_out2: + _rtl_usb_io_handler_release(hw); + usb_put_dev(udev); + complete(&rtlpriv->firmware_loading_complete); ++ kfree(rtlpriv->usb_data); + return -ENODEV; + } + EXPORT_SYMBOL(rtl_usb_probe); +diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c +index 793b40bdbf7c..3e95ad198912 100644 +--- a/drivers/net/wireless/realtek/rtw88/coex.c ++++ b/drivers/net/wireless/realtek/rtw88/coex.c +@@ -1308,6 +1308,7 @@ static void rtw_coex_action_bt_inquiry(struct rtw_dev *rtwdev) + struct rtw_chip_info *chip = rtwdev->chip; + bool wl_hi_pri = false; + u8 table_case, tdma_case; ++ u32 slot_type = 0; + + if (coex_stat->wl_linkscan_proc || coex_stat->wl_hi_pri_task1 || + coex_stat->wl_hi_pri_task2) +@@ -1318,14 +1319,16 @@ static void rtw_coex_action_bt_inquiry(struct rtw_dev *rtwdev) + if (wl_hi_pri) { + table_case = 15; + if (coex_stat->bt_a2dp_exist && +- !coex_stat->bt_pan_exist) ++ !coex_stat->bt_pan_exist) { ++ slot_type = TDMA_4SLOT; + tdma_case = 11; +- else if (coex_stat->wl_hi_pri_task1) ++ } else if (coex_stat->wl_hi_pri_task1) { + tdma_case = 6; +- else if (!coex_stat->bt_page) ++ } else if (!coex_stat->bt_page) { + tdma_case = 8; +- else ++ } else { + tdma_case = 9; ++ } + } else if (coex_stat->wl_connected) { + table_case = 10; + tdma_case = 10; +@@ -1361,7 +1364,7 @@ static void rtw_coex_action_bt_inquiry(struct rtw_dev *rtwdev) + rtw_coex_set_ant_path(rtwdev, false, COEX_SET_ANT_2G); + rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]); + rtw_coex_table(rtwdev, table_case); +- rtw_coex_tdma(rtwdev, false, tdma_case); ++ rtw_coex_tdma(rtwdev, false, tdma_case | slot_type); + } + + static void rtw_coex_action_bt_hfp(struct rtw_dev *rtwdev) +@@ -1475,13 +1478,13 @@ static void rtw_coex_action_bt_a2dp(struct rtw_dev *rtwdev) + + if (efuse->share_ant) { + /* Shared-Ant */ ++ slot_type = TDMA_4SLOT; ++ + if (coex_stat->wl_gl_busy && coex_stat->wl_noisy_level == 0) + table_case = 10; + else + table_case = 9; + +- slot_type = TDMA_4SLOT; +- + if (coex_stat->wl_gl_busy) + tdma_case = 13; + else +@@ -1585,13 +1588,14 @@ static void rtw_coex_action_bt_a2dp_hid(struct rtw_dev *rtwdev) + + if (efuse->share_ant) { + /* Shared-Ant */ ++ slot_type = TDMA_4SLOT; ++ + if (coex_stat->bt_ble_exist) + table_case = 26; + else + table_case = 9; + + if (coex_stat->wl_gl_busy) { +- slot_type = TDMA_4SLOT; + tdma_case = 13; + } else { + tdma_case = 14; +@@ -1794,10 +1798,12 @@ static void rtw_coex_action_wl_linkscan(struct rtw_dev *rtwdev) + struct rtw_efuse *efuse = &rtwdev->efuse; + struct rtw_chip_info *chip = rtwdev->chip; + u8 table_case, tdma_case; ++ u32 slot_type = 0; + + if (efuse->share_ant) { + /* Shared-Ant */ + if (coex_stat->bt_a2dp_exist) { ++ slot_type = TDMA_4SLOT; + table_case = 9; + tdma_case = 11; + } else { +@@ -1818,7 +1824,7 @@ static void rtw_coex_action_wl_linkscan(struct rtw_dev *rtwdev) + rtw_coex_set_ant_path(rtwdev, true, COEX_SET_ANT_2G); + rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]); + rtw_coex_table(rtwdev, table_case); +- rtw_coex_tdma(rtwdev, false, tdma_case); ++ rtw_coex_tdma(rtwdev, false, tdma_case | slot_type); + } + + static void rtw_coex_action_wl_not_connected(struct rtw_dev *rtwdev) +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 6dd457741b15..7a3a4911bde2 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1020,7 +1020,8 @@ static int rtw_dump_hw_feature(struct rtw_dev *rtwdev) + + rtw_hw_config_rf_ant_num(rtwdev, efuse->hw_cap.ant_num); + +- if (efuse->hw_cap.nss == EFUSE_HW_CAP_IGNORE) ++ if (efuse->hw_cap.nss == EFUSE_HW_CAP_IGNORE || ++ efuse->hw_cap.nss > rtwdev->hal.rf_path_num) + efuse->hw_cap.nss = rtwdev->hal.rf_path_num; + + rtw_dbg(rtwdev, RTW_DBG_EFUSE, +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 4d1909aecd6c..9f60e4dc5a90 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -278,7 +278,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client, + + r = devm_acpi_dev_add_driver_gpios(dev, acpi_nxp_nci_gpios); + if (r) +- return r; ++ dev_dbg(dev, "Unable to add GPIO mapping table\n"); + + phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW); + if (IS_ERR(phy->gpiod_en)) { +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index af3212aec871..a6b7b242d516 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -313,7 +313,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved) + if (blk_mq_request_completed(req)) + return true; + +- nvme_req(req)->status = NVME_SC_HOST_PATH_ERROR; ++ nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD; + blk_mq_complete_request(req); + return true; + } +@@ -611,8 +611,14 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req, + struct nvme_dsm_range *range; + struct bio *bio; + +- range = kmalloc_array(segments, sizeof(*range), +- GFP_ATOMIC | __GFP_NOWARN); ++ /* ++ * Some devices do not consider the DSM 'Number of Ranges' field when ++ * determining how much data to DMA. Always allocate memory for maximum ++ * number of segments to prevent device reading beyond end of buffer. ++ */ ++ static const size_t alloc_size = sizeof(*range) * NVME_DSM_MAX_RANGES; ++ ++ range = kzalloc(alloc_size, GFP_ATOMIC | __GFP_NOWARN); + if (!range) { + /* + * If we fail allocation our range, fallback to the controller +@@ -652,7 +658,7 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req, + + req->special_vec.bv_page = virt_to_page(range); + req->special_vec.bv_offset = offset_in_page(range); +- req->special_vec.bv_len = sizeof(*range) * segments; ++ req->special_vec.bv_len = alloc_size; + req->rq_flags |= RQF_SPECIAL_PAYLOAD; + + return BLK_STS_OK; +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index e0f064dcbd02..132ade51ee87 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -95,6 +95,7 @@ void nvme_failover_req(struct request *req) + } + break; + case NVME_SC_HOST_PATH_ERROR: ++ case NVME_SC_HOST_ABORTED_CMD: + /* + * Temporary transport disruption in talking to the controller. + * Try to send on a new path. +diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c +index dff2f3c357f5..fc40555ca4cd 100644 +--- a/drivers/nvmem/imx-ocotp.c ++++ b/drivers/nvmem/imx-ocotp.c +@@ -521,6 +521,10 @@ static int imx_ocotp_probe(struct platform_device *pdev) + if (IS_ERR(priv->clk)) + return PTR_ERR(priv->clk); + ++ clk_prepare_enable(priv->clk); ++ imx_ocotp_clr_err_if_set(priv->base); ++ clk_disable_unprepare(priv->clk); ++ + priv->params = of_device_get_match_data(&pdev->dev); + imx_ocotp_nvmem_config.size = 4 * priv->params->nregs; + imx_ocotp_nvmem_config.dev = dev; +diff --git a/drivers/parport/share.c b/drivers/parport/share.c +index 7b4ee33c1935..15c81cffd2de 100644 +--- a/drivers/parport/share.c ++++ b/drivers/parport/share.c +@@ -230,6 +230,18 @@ static int port_check(struct device *dev, void *dev_drv) + return 0; + } + ++/* ++ * Iterates through all the devices connected to the bus and return 1 ++ * if the device is a parallel port. ++ */ ++ ++static int port_detect(struct device *dev, void *dev_drv) ++{ ++ if (is_parport(dev)) ++ return 1; ++ return 0; ++} ++ + /** + * parport_register_driver - register a parallel port device driver + * @drv: structure describing the driver +@@ -282,6 +294,15 @@ int __parport_register_driver(struct parport_driver *drv, struct module *owner, + if (ret) + return ret; + ++ /* ++ * check if bus has any parallel port registered, if ++ * none is found then load the lowlevel driver. ++ */ ++ ret = bus_for_each_dev(&parport_bus_type, NULL, NULL, ++ port_detect); ++ if (!ret) ++ get_lowlevel_driver(); ++ + mutex_lock(®istration_lock); + if (drv->match_port) + bus_for_each_dev(&parport_bus_type, NULL, drv, +diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hs.c b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +index b163b3a1558d..61054272a7c8 100644 +--- a/drivers/phy/qualcomm/phy-qcom-usb-hs.c ++++ b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +@@ -158,8 +158,8 @@ static int qcom_usb_hs_phy_power_on(struct phy *phy) + /* setup initial state */ + qcom_usb_hs_phy_vbus_notifier(&uphy->vbus_notify, state, + uphy->vbus_edev); +- ret = devm_extcon_register_notifier(&ulpi->dev, uphy->vbus_edev, +- EXTCON_USB, &uphy->vbus_notify); ++ ret = extcon_register_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + if (ret) + goto err_ulpi; + } +@@ -180,6 +180,9 @@ static int qcom_usb_hs_phy_power_off(struct phy *phy) + { + struct qcom_usb_hs_phy *uphy = phy_get_drvdata(phy); + ++ if (uphy->vbus_edev) ++ extcon_unregister_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + regulator_disable(uphy->v3p3); + regulator_disable(uphy->v1p8); + clk_disable_unprepare(uphy->sleep_clk); +diff --git a/drivers/phy/renesas/phy-rcar-gen2.c b/drivers/phy/renesas/phy-rcar-gen2.c +index 2926e4937301..2e279ac0fa4d 100644 +--- a/drivers/phy/renesas/phy-rcar-gen2.c ++++ b/drivers/phy/renesas/phy-rcar-gen2.c +@@ -71,6 +71,7 @@ struct rcar_gen2_phy_driver { + struct rcar_gen2_phy_data { + const struct phy_ops *gen2_phy_ops; + const u32 (*select_value)[PHYS_PER_CHANNEL]; ++ const u32 num_channels; + }; + + static int rcar_gen2_phy_init(struct phy *p) +@@ -271,11 +272,13 @@ static const u32 usb20_select_value[][PHYS_PER_CHANNEL] = { + static const struct rcar_gen2_phy_data rcar_gen2_usb_phy_data = { + .gen2_phy_ops = &rcar_gen2_phy_ops, + .select_value = pci_select_value, ++ .num_channels = ARRAY_SIZE(pci_select_value), + }; + + static const struct rcar_gen2_phy_data rz_g1c_usb_phy_data = { + .gen2_phy_ops = &rz_g1c_phy_ops, + .select_value = usb20_select_value, ++ .num_channels = ARRAY_SIZE(usb20_select_value), + }; + + static const struct of_device_id rcar_gen2_phy_match_table[] = { +@@ -389,7 +392,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev) + channel->selected_phy = -1; + + error = of_property_read_u32(np, "reg", &channel_num); +- if (error || channel_num > 2) { ++ if (error || channel_num >= data->num_channels) { + dev_err(dev, "Invalid \"reg\" property\n"); + of_node_put(np); + return error; +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index 5d6d8b1e9062..dbaacde1b36a 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -29,6 +29,13 @@ struct pinctrl_dt_map { + static void dt_free_map(struct pinctrl_dev *pctldev, + struct pinctrl_map *map, unsigned num_maps) + { ++ int i; ++ ++ for (i = 0; i < num_maps; ++i) { ++ kfree_const(map[i].dev_name); ++ map[i].dev_name = NULL; ++ } ++ + if (pctldev) { + const struct pinctrl_ops *ops = pctldev->desc->pctlops; + if (ops->dt_free_map) +@@ -63,7 +70,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Initialize common mapping table entry fields */ + for (i = 0; i < num_maps; i++) { +- map[i].dev_name = dev_name(p->dev); ++ const char *devname; ++ ++ devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL); ++ if (!devname) ++ goto err_free_map; ++ ++ map[i].dev_name = devname; + map[i].name = statename; + if (pctldev) + map[i].ctrl_dev_name = dev_name(pctldev->dev); +@@ -71,10 +84,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Remember the converted mapping table entries */ + dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL); +- if (!dt_map) { +- dt_free_map(pctldev, map, num_maps); +- return -ENOMEM; +- } ++ if (!dt_map) ++ goto err_free_map; + + dt_map->pctldev = pctldev; + dt_map->map = map; +@@ -82,6 +93,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + list_add_tail(&dt_map->node, &p->dt_maps); + + return pinctrl_register_map(map, num_maps, false); ++ ++err_free_map: ++ dt_free_map(pctldev, map, num_maps); ++ return -ENOMEM; + } + + struct pinctrl_dev *of_pinctrl_get(struct device_node *np) +diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c +index 9ffb22211d2b..7d658e6627e7 100644 +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -110,7 +110,6 @@ struct byt_gpio { + struct platform_device *pdev; + struct pinctrl_dev *pctl_dev; + struct pinctrl_desc pctl_desc; +- raw_spinlock_t lock; + const struct intel_pinctrl_soc_data *soc_data; + struct intel_community *communities_copy; + struct byt_gpio_pin_context *saved_context; +@@ -549,6 +548,8 @@ static const struct intel_pinctrl_soc_data *byt_soc_data[] = { + NULL + }; + ++static DEFINE_RAW_SPINLOCK(byt_lock); ++ + static struct intel_community *byt_get_community(struct byt_gpio *vg, + unsigned int pin) + { +@@ -658,7 +659,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg, + unsigned long flags; + int i; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + for (i = 0; i < group.npins; i++) { + void __iomem *padcfg0; +@@ -678,7 +679,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg, + writel(value, padcfg0); + } + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static void byt_set_group_mixed_mux(struct byt_gpio *vg, +@@ -688,7 +689,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg, + unsigned long flags; + int i; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + for (i = 0; i < group.npins; i++) { + void __iomem *padcfg0; +@@ -708,7 +709,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg, + writel(value, padcfg0); + } + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static int byt_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector, +@@ -749,11 +750,11 @@ static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned int offset) + unsigned long flags; + u32 value; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + value = readl(reg); + value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL); + writel(value, reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev, +@@ -765,7 +766,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev, + u32 value, gpio_mux; + unsigned long flags; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + /* + * In most cases, func pin mux 000 means GPIO function. +@@ -787,7 +788,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev, + "pin %u forcibly re-configured as GPIO\n", offset); + } + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + pm_runtime_get(&vg->pdev->dev); + +@@ -815,7 +816,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, + unsigned long flags; + u32 value; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + value = readl(val_reg); + value &= ~BYT_DIR_MASK; +@@ -832,7 +833,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, + "Potential Error: Setting GPIO with direct_irq_en to output"); + writel(value, val_reg); + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + return 0; + } +@@ -901,11 +902,11 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset, + u32 conf, pull, val, debounce; + u16 arg = 0; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + conf = readl(conf_reg); + pull = conf & BYT_PULL_ASSIGN_MASK; + val = readl(val_reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + switch (param) { + case PIN_CONFIG_BIAS_DISABLE: +@@ -932,9 +933,9 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset, + if (!(conf & BYT_DEBOUNCE_EN)) + return -EINVAL; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + debounce = readl(db_reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + switch (debounce & BYT_DEBOUNCE_PULSE_MASK) { + case BYT_DEBOUNCE_PULSE_375US: +@@ -986,7 +987,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, + u32 conf, val, debounce; + int i, ret = 0; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + + conf = readl(conf_reg); + val = readl(val_reg); +@@ -1094,7 +1095,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, + if (!ret) + writel(conf, conf_reg); + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + return ret; + } +@@ -1119,9 +1120,9 @@ static int byt_gpio_get(struct gpio_chip *chip, unsigned int offset) + unsigned long flags; + u32 val; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + val = readl(reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + return !!(val & BYT_LEVEL); + } +@@ -1136,13 +1137,13 @@ static void byt_gpio_set(struct gpio_chip *chip, unsigned int offset, int value) + if (!reg) + return; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + old_val = readl(reg); + if (value) + writel(old_val | BYT_LEVEL, reg); + else + writel(old_val & ~BYT_LEVEL, reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) +@@ -1155,9 +1156,9 @@ static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) + if (!reg) + return -EINVAL; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + value = readl(reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + if (!(value & BYT_OUTPUT_EN)) + return 0; +@@ -1200,14 +1201,14 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip) + const char *label; + unsigned int pin; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + pin = vg->soc_data->pins[i].number; + reg = byt_gpio_reg(vg, pin, BYT_CONF0_REG); + if (!reg) { + seq_printf(s, + "Could not retrieve pin %i conf0 reg\n", + pin); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + continue; + } + conf0 = readl(reg); +@@ -1216,11 +1217,11 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip) + if (!reg) { + seq_printf(s, + "Could not retrieve pin %i val reg\n", pin); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + continue; + } + val = readl(reg); +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + comm = byt_get_community(vg, pin); + if (!comm) { +@@ -1304,9 +1305,9 @@ static void byt_irq_ack(struct irq_data *d) + if (!reg) + return; + +- raw_spin_lock(&vg->lock); ++ raw_spin_lock(&byt_lock); + writel(BIT(offset % 32), reg); +- raw_spin_unlock(&vg->lock); ++ raw_spin_unlock(&byt_lock); + } + + static void byt_irq_mask(struct irq_data *d) +@@ -1330,7 +1331,7 @@ static void byt_irq_unmask(struct irq_data *d) + if (!reg) + return; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + value = readl(reg); + + switch (irqd_get_trigger_type(d)) { +@@ -1353,7 +1354,7 @@ static void byt_irq_unmask(struct irq_data *d) + + writel(value, reg); + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + } + + static int byt_irq_type(struct irq_data *d, unsigned int type) +@@ -1367,7 +1368,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type) + if (!reg || offset >= vg->chip.ngpio) + return -EINVAL; + +- raw_spin_lock_irqsave(&vg->lock, flags); ++ raw_spin_lock_irqsave(&byt_lock, flags); + value = readl(reg); + + WARN(value & BYT_DIRECT_IRQ_EN, +@@ -1389,7 +1390,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type) + else if (type & IRQ_TYPE_LEVEL_MASK) + irq_set_handler_locked(d, handle_level_irq); + +- raw_spin_unlock_irqrestore(&vg->lock, flags); ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + + return 0; + } +@@ -1425,9 +1426,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc) + continue; + } + +- raw_spin_lock(&vg->lock); ++ raw_spin_lock(&byt_lock); + pending = readl(reg); +- raw_spin_unlock(&vg->lock); ++ raw_spin_unlock(&byt_lock); + for_each_set_bit(pin, &pending, 32) { + virq = irq_find_mapping(vg->chip.irq.domain, base + pin); + generic_handle_irq(virq); +@@ -1638,8 +1639,6 @@ static int byt_pinctrl_probe(struct platform_device *pdev) + return PTR_ERR(vg->pctl_dev); + } + +- raw_spin_lock_init(&vg->lock); +- + ret = byt_gpio_probe(vg); + if (ret) + return ret; +@@ -1654,8 +1653,11 @@ static int byt_pinctrl_probe(struct platform_device *pdev) + static int byt_gpio_suspend(struct device *dev) + { + struct byt_gpio *vg = dev_get_drvdata(dev); ++ unsigned long flags; + int i; + ++ raw_spin_lock_irqsave(&byt_lock, flags); ++ + for (i = 0; i < vg->soc_data->npins; i++) { + void __iomem *reg; + u32 value; +@@ -1676,14 +1678,18 @@ static int byt_gpio_suspend(struct device *dev) + vg->saved_context[i].val = value; + } + ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + return 0; + } + + static int byt_gpio_resume(struct device *dev) + { + struct byt_gpio *vg = dev_get_drvdata(dev); ++ unsigned long flags; + int i; + ++ raw_spin_lock_irqsave(&byt_lock, flags); ++ + for (i = 0; i < vg->soc_data->npins; i++) { + void __iomem *reg; + u32 value; +@@ -1721,6 +1727,7 @@ static int byt_gpio_resume(struct device *dev) + } + } + ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + return 0; + } + #endif +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 2c61141519f8..eab078244a4c 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -540,7 +540,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id) + irqreturn_t ret = IRQ_NONE; + unsigned int i, irqnr; + unsigned long flags; +- u32 *regs, regval; ++ u32 __iomem *regs; ++ u32 regval; + u64 status, mask; + + /* Read the wake status */ +diff --git a/drivers/pinctrl/qcom/pinctrl-sc7180.c b/drivers/pinctrl/qcom/pinctrl-sc7180.c +index 6399c8a2bc22..d6cfad7417b1 100644 +--- a/drivers/pinctrl/qcom/pinctrl-sc7180.c ++++ b/drivers/pinctrl/qcom/pinctrl-sc7180.c +@@ -77,6 +77,7 @@ enum { + .intr_cfg_reg = 0, \ + .intr_status_reg = 0, \ + .intr_target_reg = 0, \ ++ .tile = SOUTH, \ + .mux_bit = -1, \ + .pull_bit = pull, \ + .drv_bit = drv, \ +@@ -102,6 +103,7 @@ enum { + .intr_cfg_reg = 0, \ + .intr_status_reg = 0, \ + .intr_target_reg = 0, \ ++ .tile = SOUTH, \ + .mux_bit = -1, \ + .pull_bit = 3, \ + .drv_bit = 0, \ +@@ -1087,14 +1089,14 @@ static const struct msm_pingroup sc7180_groups[] = { + [116] = PINGROUP(116, WEST, qup04, qup04, _, _, _, _, _, _, _), + [117] = PINGROUP(117, WEST, dp_hot, _, _, _, _, _, _, _, _), + [118] = PINGROUP(118, WEST, _, _, _, _, _, _, _, _, _), +- [119] = UFS_RESET(ufs_reset, 0x97f000), +- [120] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x97a000, 15, 0), +- [121] = SDC_QDSD_PINGROUP(sdc1_clk, 0x97a000, 13, 6), +- [122] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x97a000, 11, 3), +- [123] = SDC_QDSD_PINGROUP(sdc1_data, 0x97a000, 9, 0), +- [124] = SDC_QDSD_PINGROUP(sdc2_clk, 0x97b000, 14, 6), +- [125] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x97b000, 11, 3), +- [126] = SDC_QDSD_PINGROUP(sdc2_data, 0x97b000, 9, 0), ++ [119] = UFS_RESET(ufs_reset, 0x7f000), ++ [120] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x7a000, 15, 0), ++ [121] = SDC_QDSD_PINGROUP(sdc1_clk, 0x7a000, 13, 6), ++ [122] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x7a000, 11, 3), ++ [123] = SDC_QDSD_PINGROUP(sdc1_data, 0x7a000, 9, 0), ++ [124] = SDC_QDSD_PINGROUP(sdc2_clk, 0x7b000, 14, 6), ++ [125] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x7b000, 11, 3), ++ [126] = SDC_QDSD_PINGROUP(sdc2_data, 0x7b000, 9, 0), + }; + + static const struct msm_pinctrl_soc_data sc7180_pinctrl = { +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c +index 2dfb8d9cfda1..5200dadd6b3e 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c +@@ -448,6 +448,8 @@ FM(IP12_31_28) IP12_31_28 FM(IP13_31_28) IP13_31_28 FM(IP14_31_28) IP14_31_28 FM + #define MOD_SEL0_1_0 REV4(FM(SEL_SPEED_PULSE_IF_0), FM(SEL_SPEED_PULSE_IF_1), FM(SEL_SPEED_PULSE_IF_2), F_(0, 0)) + + /* MOD_SEL1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 */ /* 4 */ /* 5 */ /* 6 */ /* 7 */ ++#define MOD_SEL1_31 FM(SEL_SIMCARD_0) FM(SEL_SIMCARD_1) ++#define MOD_SEL1_30 FM(SEL_SSI2_0) FM(SEL_SSI2_1) + #define MOD_SEL1_29 FM(SEL_TIMER_TMU_0) FM(SEL_TIMER_TMU_1) + #define MOD_SEL1_28 FM(SEL_USB_20_CH0_0) FM(SEL_USB_20_CH0_1) + #define MOD_SEL1_26 FM(SEL_DRIF2_0) FM(SEL_DRIF2_1) +@@ -468,7 +470,8 @@ FM(IP12_31_28) IP12_31_28 FM(IP13_31_28) IP13_31_28 FM(IP14_31_28) IP14_31_28 FM + + #define PINMUX_MOD_SELS \ + \ +-MOD_SEL0_30_29 \ ++ MOD_SEL1_31 \ ++MOD_SEL0_30_29 MOD_SEL1_30 \ + MOD_SEL1_29 \ + MOD_SEL0_28 MOD_SEL1_28 \ + MOD_SEL0_27_26 \ +@@ -1058,7 +1061,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP10_27_24, RIF0_CLK_B, SEL_DRIF0_1), + PINMUX_IPSR_MSEL(IP10_27_24, SCL2_B, SEL_I2C2_1), + PINMUX_IPSR_MSEL(IP10_27_24, TCLK1_A, SEL_TIMER_TMU_0), +- PINMUX_IPSR_GPSR(IP10_27_24, SSI_SCK2_B), ++ PINMUX_IPSR_MSEL(IP10_27_24, SSI_SCK2_B, SEL_SSI2_1), + PINMUX_IPSR_GPSR(IP10_27_24, TS_SCK0), + + PINMUX_IPSR_GPSR(IP10_31_28, SD0_WP), +@@ -1067,7 +1070,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP10_31_28, RIF0_D0_B, SEL_DRIF0_1), + PINMUX_IPSR_MSEL(IP10_31_28, SDA2_B, SEL_I2C2_1), + PINMUX_IPSR_MSEL(IP10_31_28, TCLK2_A, SEL_TIMER_TMU_0), +- PINMUX_IPSR_GPSR(IP10_31_28, SSI_WS2_B), ++ PINMUX_IPSR_MSEL(IP10_31_28, SSI_WS2_B, SEL_SSI2_1), + PINMUX_IPSR_GPSR(IP10_31_28, TS_SDAT0), + + /* IPSR11 */ +@@ -1085,13 +1088,13 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_MSEL(IP11_11_8, RX0_A, SEL_SCIF0_0), + PINMUX_IPSR_MSEL(IP11_11_8, HRX1_A, SEL_HSCIF1_0), +- PINMUX_IPSR_GPSR(IP11_11_8, SSI_SCK2_A), ++ PINMUX_IPSR_MSEL(IP11_11_8, SSI_SCK2_A, SEL_SSI2_0), + PINMUX_IPSR_GPSR(IP11_11_8, RIF1_SYNC), + PINMUX_IPSR_GPSR(IP11_11_8, TS_SCK1), + + PINMUX_IPSR_MSEL(IP11_15_12, TX0_A, SEL_SCIF0_0), + PINMUX_IPSR_GPSR(IP11_15_12, HTX1_A), +- PINMUX_IPSR_GPSR(IP11_15_12, SSI_WS2_A), ++ PINMUX_IPSR_MSEL(IP11_15_12, SSI_WS2_A, SEL_SSI2_0), + PINMUX_IPSR_GPSR(IP11_15_12, RIF1_D0), + PINMUX_IPSR_GPSR(IP11_15_12, TS_SDAT1), + +@@ -1196,7 +1199,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP13_19_16, RIF0_D1_A, SEL_DRIF0_0), + PINMUX_IPSR_MSEL(IP13_19_16, SDA1_B, SEL_I2C1_1), + PINMUX_IPSR_MSEL(IP13_19_16, TCLK2_B, SEL_TIMER_TMU_1), +- PINMUX_IPSR_GPSR(IP13_19_16, SIM0_D_A), ++ PINMUX_IPSR_MSEL(IP13_19_16, SIM0_D_A, SEL_SIMCARD_0), + + PINMUX_IPSR_GPSR(IP13_23_20, MLB_DAT), + PINMUX_IPSR_MSEL(IP13_23_20, TX0_B, SEL_SCIF0_1), +@@ -1264,7 +1267,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP15_15_12, TPU0TO2), + PINMUX_IPSR_MSEL(IP15_15_12, SDA1_D, SEL_I2C1_3), + PINMUX_IPSR_MSEL(IP15_15_12, FSO_CFE_1_N_B, SEL_FSO_1), +- PINMUX_IPSR_GPSR(IP15_15_12, SIM0_D_B), ++ PINMUX_IPSR_MSEL(IP15_15_12, SIM0_D_B, SEL_SIMCARD_1), + + PINMUX_IPSR_GPSR(IP15_19_16, SSI_SDATA6), + PINMUX_IPSR_MSEL(IP15_19_16, HRTS2_N_A, SEL_HSCIF2_0), +@@ -4957,11 +4960,11 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + MOD_SEL0_1_0 )) + }, + { PINMUX_CFG_REG_VAR("MOD_SEL1", 0xe6060504, 32, +- GROUP(2, 1, 1, 1, 1, 1, 3, 3, 1, 1, 1, 1, +- 2, 2, 2, 1, 1, 2, 1, 4), ++ GROUP(1, 1, 1, 1, 1, 1, 1, 3, 3, 1, 1, 1, ++ 1, 2, 2, 2, 1, 1, 2, 1, 4), + GROUP( +- /* RESERVED 31, 30 */ +- 0, 0, 0, 0, ++ MOD_SEL1_31 ++ MOD_SEL1_30 + MOD_SEL1_29 + MOD_SEL1_28 + /* RESERVED 27 */ +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +index 5dfd991ffdaa..dbc36079c381 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +@@ -1450,7 +1450,7 @@ static const struct pinmux_func pinmux_func_gpios[] = { + GPIO_FN(ET0_ETXD2_A), + GPIO_FN(EX_CS5), GPIO_FN(SD1_CMD_A), GPIO_FN(ATADIR), GPIO_FN(QSSL_B), + GPIO_FN(ET0_ETXD3_A), +- GPIO_FN(RD_WR), GPIO_FN(TCLK1_B), ++ GPIO_FN(RD_WR), GPIO_FN(TCLK0), GPIO_FN(CAN_CLK_B), GPIO_FN(ET0_ETXD4), + GPIO_FN(EX_WAIT0), GPIO_FN(TCLK1_B), + GPIO_FN(EX_WAIT1), GPIO_FN(SD1_DAT0_A), GPIO_FN(DREQ2), + GPIO_FN(CAN1_TX_C), GPIO_FN(ET0_LINK_C), GPIO_FN(ET0_ETXD5_A), +@@ -1949,7 +1949,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + /* IP3_20 [1] */ + FN_EX_WAIT0, FN_TCLK1_B, + /* IP3_19_18 [2] */ +- FN_RD_WR, FN_TCLK1_B, 0, 0, ++ FN_RD_WR, FN_TCLK0, FN_CAN_CLK_B, FN_ET0_ETXD4, + /* IP3_17_15 [3] */ + FN_EX_CS5, FN_SD1_CMD_A, FN_ATADIR, FN_QSSL_B, + FN_ET0_ETXD3_A, 0, 0, 0, +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index 9579a706fc08..a881b709af25 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -300,7 +300,7 @@ static int __init hp_wmi_bios_2008_later(void) + + static int __init hp_wmi_bios_2009_later(void) + { +- int state = 0; ++ u8 state[128]; + int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, HPWMI_READ, &state, + sizeof(state), sizeof(state)); + if (!ret) +diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c +index 61d6447d1966..00a96e4a1cdc 100644 +--- a/drivers/power/supply/cpcap-battery.c ++++ b/drivers/power/supply/cpcap-battery.c +@@ -562,12 +562,14 @@ static irqreturn_t cpcap_battery_irq_thread(int irq, void *data) + switch (d->action) { + case CPCAP_BATTERY_IRQ_ACTION_BATTERY_LOW: + if (latest->current_ua >= 0) +- dev_warn(ddata->dev, "Battery low at 3.3V!\n"); ++ dev_warn(ddata->dev, "Battery low at %imV!\n", ++ latest->voltage / 1000); + break; + case CPCAP_BATTERY_IRQ_ACTION_POWEROFF: +- if (latest->current_ua >= 0) { ++ if (latest->current_ua >= 0 && latest->voltage <= 3200000) { + dev_emerg(ddata->dev, +- "Battery empty at 3.1V, powering off\n"); ++ "Battery empty at %imV, powering off\n", ++ latest->voltage / 1000); + orderly_poweroff(true); + } + break; +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index a46be221dbdc..87bc06b386a0 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1403,7 +1403,9 @@ static int set_machine_constraints(struct regulator_dev *rdev, + rdev_err(rdev, "failed to enable\n"); + return ret; + } +- rdev->use_count++; ++ ++ if (rdev->constraints->always_on) ++ rdev->use_count++; + } + + print_constraints(rdev); +@@ -5198,6 +5200,7 @@ unset_supplies: + regulator_remove_coupling(rdev); + mutex_unlock(®ulator_list_mutex); + wash: ++ kfree(rdev->coupling_desc.coupled_rdevs); + kfree(rdev->constraints); + mutex_lock(®ulator_list_mutex); + regulator_ena_gpio_free(rdev); +diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c +index 76152aaa330b..96dc0eea7659 100644 +--- a/drivers/regulator/max8907-regulator.c ++++ b/drivers/regulator/max8907-regulator.c +@@ -296,7 +296,10 @@ static int max8907_regulator_probe(struct platform_device *pdev) + memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc)); + + /* Backwards compatibility with MAX8907B; SD1 uses different voltages */ +- regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ ret = regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_II2RR_VERSION_MASK) == + MAX8907_II2RR_VERSION_REV_B) { + pmic->desc[MAX8907_SD1].min_uV = 637500; +@@ -333,14 +336,20 @@ static int max8907_regulator_probe(struct platform_device *pdev) + } + + if (pmic->desc[i].ops == &max8907_ldo_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_MASK_LDO_SEQ) != + MAX8907_MASK_LDO_SEQ) + pmic->desc[i].ops = &max8907_ldo_hwctl_ops; + } else if (pmic->desc[i].ops == &max8907_out5v_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & (MAX8907_MASK_OUT5V_VINEN | + MAX8907_MASK_OUT5V_ENSRC)) != + MAX8907_MASK_OUT5V_ENSRC) +diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c +index 13c54eac0cc3..d1839707128a 100644 +--- a/drivers/soundwire/intel.c ++++ b/drivers/soundwire/intel.c +@@ -479,7 +479,10 @@ intel_pdi_shim_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi) + unsigned int link_id = sdw->instance; + int pdi_conf = 0; + +- pdi->intel_alh_id = (link_id * 16) + pdi->num + 5; ++ /* the Bulk and PCM streams are not contiguous */ ++ pdi->intel_alh_id = (link_id * 16) + pdi->num + 3; ++ if (pdi->num >= 2) ++ pdi->intel_alh_id += 2; + + /* + * Program stream parameters to stream SHIM register +@@ -508,7 +511,10 @@ intel_pdi_alh_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi) + unsigned int link_id = sdw->instance; + unsigned int conf; + +- pdi->intel_alh_id = (link_id * 16) + pdi->num + 5; ++ /* the Bulk and PCM streams are not contiguous */ ++ pdi->intel_alh_id = (link_id * 16) + pdi->num + 3; ++ if (pdi->num >= 2) ++ pdi->intel_alh_id += 2; + + /* Program Stream config ALH register */ + conf = intel_readl(alh, SDW_ALH_STRMZCFG(pdi->intel_alh_id)); +diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c +index c36587b42e95..82a0ee09cbe1 100644 +--- a/drivers/spi/spi-cadence.c ++++ b/drivers/spi/spi-cadence.c +@@ -168,16 +168,16 @@ static void cdns_spi_init_hw(struct cdns_spi *xspi) + /** + * cdns_spi_chipselect - Select or deselect the chip select line + * @spi: Pointer to the spi_device structure +- * @enable: Select (1) or deselect (0) the chip select line ++ * @is_high: Select(0) or deselect (1) the chip select line + */ +-static void cdns_spi_chipselect(struct spi_device *spi, bool enable) ++static void cdns_spi_chipselect(struct spi_device *spi, bool is_high) + { + struct cdns_spi *xspi = spi_master_get_devdata(spi->master); + u32 ctrl_reg; + + ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR); + +- if (!enable) { ++ if (is_high) { + /* Deselect the slave */ + ctrl_reg |= CDNS_SPI_CR_SSCTRL; + } else { +diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c +index 9a49e073e8b7..45972056ed8c 100644 +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -129,10 +129,11 @@ void dw_spi_set_cs(struct spi_device *spi, bool enable) + struct dw_spi *dws = spi_controller_get_devdata(spi->controller); + struct chip_data *chip = spi_get_ctldata(spi); + ++ /* Chip select logic is inverted from spi_set_cs() */ + if (chip && chip->cs_control) +- chip->cs_control(enable); ++ chip->cs_control(!enable); + +- if (enable) ++ if (!enable) + dw_writel(dws, DW_SPI_SER, BIT(spi->chip_select)); + else if (dws->cs_override) + dw_writel(dws, DW_SPI_SER, 0); +@@ -308,7 +309,8 @@ static int dw_spi_transfer_one(struct spi_controller *master, + cr0 = (transfer->bits_per_word - 1) + | (chip->type << SPI_FRF_OFFSET) + | ((((spi->mode & SPI_CPOL) ? 1 : 0) << SPI_SCOL_OFFSET) | +- (((spi->mode & SPI_CPHA) ? 1 : 0) << SPI_SCPH_OFFSET)) ++ (((spi->mode & SPI_CPHA) ? 1 : 0) << SPI_SCPH_OFFSET) | ++ (((spi->mode & SPI_LOOP) ? 1 : 0) << SPI_SRL_OFFSET)) + | (chip->tmode << SPI_TMOD_OFFSET); + + /* +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index 4b80ace1d137..2d563874b4ac 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -736,9 +736,9 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) + if (ret) + goto err; + +- irq = irq_of_parse_and_map(np, 0); +- if (!irq) { +- ret = -EINVAL; ++ irq = platform_get_irq(ofdev, 0); ++ if (irq < 0) { ++ ret = irq; + goto err; + } + +@@ -751,7 +751,6 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) + return 0; + + err: +- irq_dispose_mapping(irq); + return ret; + } + +diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c +index 1d3e23ec20a6..f9c5bbb74714 100644 +--- a/drivers/spi/spi-gpio.c ++++ b/drivers/spi/spi-gpio.c +@@ -371,8 +371,10 @@ static int spi_gpio_probe(struct platform_device *pdev) + return -ENOMEM; + + status = devm_add_action_or_reset(&pdev->dev, spi_gpio_put, master); +- if (status) ++ if (status) { ++ spi_master_put(master); + return status; ++ } + + if (of_id) + status = spi_gpio_probe_dt(pdev, master); +diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c +index 439b01e4a2c8..f4a8f470aecc 100644 +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -673,6 +673,8 @@ static int img_spfi_probe(struct platform_device *pdev) + dma_release_channel(spfi->tx_ch); + if (spfi->rx_ch) + dma_release_channel(spfi->rx_ch); ++ spfi->tx_ch = NULL; ++ spfi->rx_ch = NULL; + dev_warn(spfi->dev, "Failed to get DMA channels, falling back to PIO mode\n"); + } else { + master->dma_tx = spfi->tx_ch; +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index bb6a14d1ab0f..2e73d75a6ac5 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1565,7 +1565,13 @@ pxa2xx_spi_init_pdata(struct platform_device *pdev) + #endif + + ssp->clk = devm_clk_get(&pdev->dev, NULL); ++ if (IS_ERR(ssp->clk)) ++ return NULL; ++ + ssp->irq = platform_get_irq(pdev, 0); ++ if (ssp->irq < 0) ++ return NULL; ++ + ssp->type = type; + ssp->pdev = pdev; + ssp->port_id = pxa2xx_spi_get_port_id(adev); +diff --git a/drivers/spi/spi-sifive.c b/drivers/spi/spi-sifive.c +index 35254bdc42c4..f7c1e20432e0 100644 +--- a/drivers/spi/spi-sifive.c ++++ b/drivers/spi/spi-sifive.c +@@ -357,14 +357,14 @@ static int sifive_spi_probe(struct platform_device *pdev) + if (!cs_bits) { + dev_err(&pdev->dev, "Could not auto probe CS lines\n"); + ret = -EINVAL; +- goto put_master; ++ goto disable_clk; + } + + num_cs = ilog2(cs_bits) + 1; + if (num_cs > SIFIVE_SPI_MAX_CS) { + dev_err(&pdev->dev, "Invalid number of spi slaves\n"); + ret = -EINVAL; +- goto put_master; ++ goto disable_clk; + } + + /* Define our master */ +@@ -393,7 +393,7 @@ static int sifive_spi_probe(struct platform_device *pdev) + dev_name(&pdev->dev), spi); + if (ret) { + dev_err(&pdev->dev, "Unable to bind to interrupt\n"); +- goto put_master; ++ goto disable_clk; + } + + dev_info(&pdev->dev, "mapped; irq=%d, cs=%d\n", +@@ -402,11 +402,13 @@ static int sifive_spi_probe(struct platform_device *pdev) + ret = devm_spi_register_master(&pdev->dev, master); + if (ret < 0) { + dev_err(&pdev->dev, "spi_register_master failed\n"); +- goto put_master; ++ goto disable_clk; + } + + return 0; + ++disable_clk: ++ clk_disable_unprepare(spi->clk); + put_master: + spi_master_put(master); + +@@ -420,6 +422,7 @@ static int sifive_spi_remove(struct platform_device *pdev) + + /* Disable all the interrupts just in case */ + sifive_spi_write(spi, SIFIVE_SPI_REG_IE, 0); ++ clk_disable_unprepare(spi->clk); + + return 0; + } +diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c +index 9a051286f120..9613cfe3c0a2 100644 +--- a/drivers/spi/spi-sprd-adi.c ++++ b/drivers/spi/spi-sprd-adi.c +@@ -393,6 +393,9 @@ static int sprd_adi_restart_handler(struct notifier_block *this, + val |= BIT_WDG_RUN | BIT_WDG_RST; + sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_CTRL, val); + ++ /* Lock the watchdog */ ++ sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOCK, ~WDG_UNLOCK_KEY); ++ + mdelay(1000); + + dev_emerg(sadi->dev, "Unable to restart system\n"); +diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c +index 0c24c494f386..77d26d64541a 100644 +--- a/drivers/spi/spi-st-ssc4.c ++++ b/drivers/spi/spi-st-ssc4.c +@@ -381,6 +381,7 @@ static int spi_st_probe(struct platform_device *pdev) + return 0; + + clk_disable: ++ pm_runtime_disable(&pdev->dev); + clk_disable_unprepare(spi_st->clk); + put_master: + spi_master_put(master); +@@ -392,6 +393,8 @@ static int spi_st_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct spi_st *spi_st = spi_master_get_devdata(master); + ++ pm_runtime_disable(&pdev->dev); ++ + clk_disable_unprepare(spi_st->clk); + + pinctrl_pm_select_sleep_state(&pdev->dev); +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 111fffc91435..374a2a32edcd 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1073,7 +1073,7 @@ static int tegra_slink_probe(struct platform_device *pdev) + ret = clk_enable(tspi->clk); + if (ret < 0) { + dev_err(&pdev->dev, "Clock enable failed %d\n", ret); +- goto exit_free_master; ++ goto exit_clk_unprepare; + } + + spi_irq = platform_get_irq(pdev, 0); +@@ -1146,6 +1146,8 @@ exit_free_irq: + free_irq(spi_irq, tspi); + exit_clk_disable: + clk_disable(tspi->clk); ++exit_clk_unprepare: ++ clk_unprepare(tspi->clk); + exit_free_master: + spi_master_put(master); + return ret; +@@ -1159,6 +1161,7 @@ static int tegra_slink_remove(struct platform_device *pdev) + free_irq(tspi->irq, tspi); + + clk_disable(tspi->clk); ++ clk_unprepare(tspi->clk); + + if (tspi->tx_dma_chan) + tegra_slink_deinit_dma_param(tspi, false); +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 255786f2e844..3ea9d8a3e6e8 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -627,6 +627,9 @@ static int spidev_release(struct inode *inode, struct file *filp) + if (dofree) + kfree(spidev); + } ++#ifdef CONFIG_SPI_SLAVE ++ spi_slave_abort(spidev->spi); ++#endif + mutex_unlock(&device_list_lock); + + return 0; +diff --git a/drivers/staging/comedi/drivers/gsc_hpdi.c b/drivers/staging/comedi/drivers/gsc_hpdi.c +index 4bdf44d82879..dc62db1ee1dd 100644 +--- a/drivers/staging/comedi/drivers/gsc_hpdi.c ++++ b/drivers/staging/comedi/drivers/gsc_hpdi.c +@@ -623,6 +623,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, + dma_alloc_coherent(&pcidev->dev, DMA_BUFFER_SIZE, + &devpriv->dio_buffer_phys_addr[i], + GFP_KERNEL); ++ if (!devpriv->dio_buffer[i]) { ++ dev_warn(dev->class_dev, ++ "failed to allocate DMA buffer\n"); ++ return -ENOMEM; ++ } + } + /* allocate dma descriptors */ + devpriv->dma_desc = dma_alloc_coherent(&pcidev->dev, +@@ -630,6 +635,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, + NUM_DMA_DESCRIPTORS, + &devpriv->dma_desc_phys_addr, + GFP_KERNEL); ++ if (!devpriv->dma_desc) { ++ dev_warn(dev->class_dev, ++ "failed to allocate DMA descriptors\n"); ++ return -ENOMEM; ++ } + if (devpriv->dma_desc_phys_addr & 0xf) { + dev_warn(dev->class_dev, + " dma descriptors not quad-word aligned (bug)\n"); +diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c +index a0a67aa517f0..61f0286fb157 100644 +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -666,7 +666,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, + fbdefio->deferred_io = fbtft_deferred_io; + fb_deferred_io_init(info); + +- strncpy(info->fix.id, dev->driver->name, 16); ++ snprintf(info->fix.id, sizeof(info->fix.id), "%s", dev->driver->name); + info->fix.type = FB_TYPE_PACKED_PIXELS; + info->fix.visual = FB_VISUAL_TRUECOLOR; + info->fix.xpanstep = 0; +diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c +index 038d6732c3fd..23026978a5a5 100644 +--- a/drivers/staging/iio/frequency/ad9834.c ++++ b/drivers/staging/iio/frequency/ad9834.c +@@ -417,6 +417,10 @@ static int ad9834_probe(struct spi_device *spi) + st = iio_priv(indio_dev); + mutex_init(&st->lock); + st->mclk = devm_clk_get(&spi->dev, NULL); ++ if (IS_ERR(st->mclk)) { ++ ret = PTR_ERR(st->mclk); ++ goto error_disable_reg; ++ } + + ret = clk_prepare_enable(st->mclk); + if (ret) { +diff --git a/drivers/staging/media/imx/imx-media-capture.c b/drivers/staging/media/imx/imx-media-capture.c +index b33a07bc9105..46576e32581f 100644 +--- a/drivers/staging/media/imx/imx-media-capture.c ++++ b/drivers/staging/media/imx/imx-media-capture.c +@@ -26,6 +26,8 @@ + #include + #include "imx-media.h" + ++#define IMX_CAPTURE_NAME "imx-capture" ++ + struct capture_priv { + struct imx_media_video_dev vdev; + +@@ -69,8 +71,8 @@ static int vidioc_querycap(struct file *file, void *fh, + { + struct capture_priv *priv = video_drvdata(file); + +- strscpy(cap->driver, "imx-media-capture", sizeof(cap->driver)); +- strscpy(cap->card, "imx-media-capture", sizeof(cap->card)); ++ strscpy(cap->driver, IMX_CAPTURE_NAME, sizeof(cap->driver)); ++ strscpy(cap->card, IMX_CAPTURE_NAME, sizeof(cap->card)); + snprintf(cap->bus_info, sizeof(cap->bus_info), + "platform:%s", priv->src_sd->name); + +diff --git a/drivers/staging/media/imx/imx7-mipi-csis.c b/drivers/staging/media/imx/imx7-mipi-csis.c +index 73d8354e618c..e50b1f88e25b 100644 +--- a/drivers/staging/media/imx/imx7-mipi-csis.c ++++ b/drivers/staging/media/imx/imx7-mipi-csis.c +@@ -350,6 +350,8 @@ static void mipi_csis_sw_reset(struct csi_state *state) + static int mipi_csis_phy_init(struct csi_state *state) + { + state->mipi_phy_regulator = devm_regulator_get(state->dev, "phy"); ++ if (IS_ERR(state->mipi_phy_regulator)) ++ return PTR_ERR(state->mipi_phy_regulator); + + return regulator_set_voltage(state->mipi_phy_regulator, 1000000, + 1000000); +@@ -966,7 +968,10 @@ static int mipi_csis_probe(struct platform_device *pdev) + return ret; + } + +- mipi_csis_phy_init(state); ++ ret = mipi_csis_phy_init(state); ++ if (ret < 0) ++ return ret; ++ + mipi_csis_phy_reset(state); + + mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c +index 2d3ea8b74dfd..3439f6ad6338 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -357,6 +357,8 @@ static int cedrus_probe(struct platform_device *pdev) + + dev->mdev.dev = &pdev->dev; + strscpy(dev->mdev.model, CEDRUS_NAME, sizeof(dev->mdev.model)); ++ strscpy(dev->mdev.bus_info, "platform:" CEDRUS_NAME, ++ sizeof(dev->mdev.bus_info)); + + media_device_init(&dev->mdev); + dev->mdev.ops = &cedrus_m2m_media_ops; +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.h b/drivers/staging/media/sunxi/cedrus/cedrus.h +index 2f017a651848..3758a1c4e2d0 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus.h ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.h +@@ -179,12 +179,16 @@ static inline dma_addr_t cedrus_buf_addr(struct vb2_buffer *buf, + static inline dma_addr_t cedrus_dst_buf_addr(struct cedrus_ctx *ctx, + int index, unsigned int plane) + { +- struct vb2_buffer *buf; ++ struct vb2_buffer *buf = NULL; ++ struct vb2_queue *vq; + + if (index < 0) + return 0; + +- buf = ctx->fh.m2m_ctx->cap_q_ctx.q.bufs[index]; ++ vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE); ++ if (vq) ++ buf = vb2_get_buffer(vq, index); ++ + return buf ? cedrus_buf_addr(buf, &ctx->dst_fmt, plane) : 0; + } + +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c +index d6a782703c9b..08c6c9c410cc 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c +@@ -96,7 +96,7 @@ static void cedrus_write_frame_list(struct cedrus_ctx *ctx, + const struct v4l2_ctrl_h264_decode_params *decode = run->h264.decode_params; + const struct v4l2_ctrl_h264_slice_params *slice = run->h264.slice_params; + const struct v4l2_ctrl_h264_sps *sps = run->h264.sps; +- struct vb2_queue *cap_q = &ctx->fh.m2m_ctx->cap_q_ctx.q; ++ struct vb2_queue *cap_q; + struct cedrus_buffer *output_buf; + struct cedrus_dev *dev = ctx->dev; + unsigned long used_dpbs = 0; +@@ -104,6 +104,8 @@ static void cedrus_write_frame_list(struct cedrus_ctx *ctx, + unsigned int output = 0; + unsigned int i; + ++ cap_q = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE); ++ + memset(pic_list, 0, sizeof(pic_list)); + + for (i = 0; i < ARRAY_SIZE(decode->dpb); i++) { +@@ -167,12 +169,14 @@ static void _cedrus_write_ref_list(struct cedrus_ctx *ctx, + enum cedrus_h264_sram_off sram) + { + const struct v4l2_ctrl_h264_decode_params *decode = run->h264.decode_params; +- struct vb2_queue *cap_q = &ctx->fh.m2m_ctx->cap_q_ctx.q; ++ struct vb2_queue *cap_q; + struct cedrus_dev *dev = ctx->dev; + u8 sram_array[CEDRUS_MAX_REF_IDX]; + unsigned int i; + size_t size; + ++ cap_q = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE); ++ + memset(sram_array, 0, sizeof(sram_array)); + + for (i = 0; i < num_ref; i++) { +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_regs.h b/drivers/staging/media/sunxi/cedrus/cedrus_regs.h +index ddd29788d685..f9dd8cbf3458 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus_regs.h ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_regs.h +@@ -10,6 +10,9 @@ + #ifndef _CEDRUS_REGS_H_ + #define _CEDRUS_REGS_H_ + ++#define SHIFT_AND_MASK_BITS(v, h, l) \ ++ (((unsigned long)(v) << (l)) & GENMASK(h, l)) ++ + /* + * Common acronyms and contractions used in register descriptions: + * * VLD : Variable-Length Decoder +@@ -37,8 +40,8 @@ + #define VE_PRIMARY_CHROMA_BUF_LEN 0xc4 + #define VE_PRIMARY_FB_LINE_STRIDE 0xc8 + +-#define VE_PRIMARY_FB_LINE_STRIDE_CHROMA(s) (((s) << 16) & GENMASK(31, 16)) +-#define VE_PRIMARY_FB_LINE_STRIDE_LUMA(s) (((s) << 0) & GENMASK(15, 0)) ++#define VE_PRIMARY_FB_LINE_STRIDE_CHROMA(s) SHIFT_AND_MASK_BITS(s, 31, 16) ++#define VE_PRIMARY_FB_LINE_STRIDE_LUMA(s) SHIFT_AND_MASK_BITS(s, 15, 0) + + #define VE_CHROMA_BUF_LEN 0xe8 + +@@ -46,7 +49,7 @@ + #define VE_SECONDARY_OUT_FMT_EXT (0x01 << 30) + #define VE_SECONDARY_OUT_FMT_YU12 (0x02 << 30) + #define VE_SECONDARY_OUT_FMT_YV12 (0x03 << 30) +-#define VE_CHROMA_BUF_LEN_SDRT(l) ((l) & GENMASK(27, 0)) ++#define VE_CHROMA_BUF_LEN_SDRT(l) SHIFT_AND_MASK_BITS(l, 27, 0) + + #define VE_PRIMARY_OUT_FMT 0xec + +@@ -69,15 +72,15 @@ + + #define VE_DEC_MPEG_MP12HDR (VE_ENGINE_DEC_MPEG + 0x00) + +-#define VE_DEC_MPEG_MP12HDR_SLICE_TYPE(t) (((t) << 28) & GENMASK(30, 28)) ++#define VE_DEC_MPEG_MP12HDR_SLICE_TYPE(t) SHIFT_AND_MASK_BITS(t, 30, 28) + #define VE_DEC_MPEG_MP12HDR_F_CODE_SHIFT(x, y) (24 - 4 * (y) - 8 * (x)) + #define VE_DEC_MPEG_MP12HDR_F_CODE(__x, __y, __v) \ +- (((__v) & GENMASK(3, 0)) << VE_DEC_MPEG_MP12HDR_F_CODE_SHIFT(__x, __y)) ++ (((unsigned long)(__v) & GENMASK(3, 0)) << VE_DEC_MPEG_MP12HDR_F_CODE_SHIFT(__x, __y)) + + #define VE_DEC_MPEG_MP12HDR_INTRA_DC_PRECISION(p) \ +- (((p) << 10) & GENMASK(11, 10)) ++ SHIFT_AND_MASK_BITS(p, 11, 10) + #define VE_DEC_MPEG_MP12HDR_INTRA_PICTURE_STRUCTURE(s) \ +- (((s) << 8) & GENMASK(9, 8)) ++ SHIFT_AND_MASK_BITS(s, 9, 8) + #define VE_DEC_MPEG_MP12HDR_TOP_FIELD_FIRST(v) \ + ((v) ? BIT(7) : 0) + #define VE_DEC_MPEG_MP12HDR_FRAME_PRED_FRAME_DCT(v) \ +@@ -98,19 +101,19 @@ + #define VE_DEC_MPEG_PICCODEDSIZE (VE_ENGINE_DEC_MPEG + 0x08) + + #define VE_DEC_MPEG_PICCODEDSIZE_WIDTH(w) \ +- ((DIV_ROUND_UP((w), 16) << 8) & GENMASK(15, 8)) ++ SHIFT_AND_MASK_BITS(DIV_ROUND_UP((w), 16), 15, 8) + #define VE_DEC_MPEG_PICCODEDSIZE_HEIGHT(h) \ +- ((DIV_ROUND_UP((h), 16) << 0) & GENMASK(7, 0)) ++ SHIFT_AND_MASK_BITS(DIV_ROUND_UP((h), 16), 7, 0) + + #define VE_DEC_MPEG_PICBOUNDSIZE (VE_ENGINE_DEC_MPEG + 0x0c) + +-#define VE_DEC_MPEG_PICBOUNDSIZE_WIDTH(w) (((w) << 16) & GENMASK(27, 16)) +-#define VE_DEC_MPEG_PICBOUNDSIZE_HEIGHT(h) (((h) << 0) & GENMASK(11, 0)) ++#define VE_DEC_MPEG_PICBOUNDSIZE_WIDTH(w) SHIFT_AND_MASK_BITS(w, 27, 16) ++#define VE_DEC_MPEG_PICBOUNDSIZE_HEIGHT(h) SHIFT_AND_MASK_BITS(h, 11, 0) + + #define VE_DEC_MPEG_MBADDR (VE_ENGINE_DEC_MPEG + 0x10) + +-#define VE_DEC_MPEG_MBADDR_X(w) (((w) << 8) & GENMASK(15, 8)) +-#define VE_DEC_MPEG_MBADDR_Y(h) (((h) << 0) & GENMASK(7, 0)) ++#define VE_DEC_MPEG_MBADDR_X(w) SHIFT_AND_MASK_BITS(w, 15, 8) ++#define VE_DEC_MPEG_MBADDR_Y(h) SHIFT_AND_MASK_BITS(h, 7, 0) + + #define VE_DEC_MPEG_CTRL (VE_ENGINE_DEC_MPEG + 0x14) + +@@ -225,7 +228,7 @@ + #define VE_DEC_MPEG_IQMINPUT_FLAG_INTRA (0x01 << 14) + #define VE_DEC_MPEG_IQMINPUT_FLAG_NON_INTRA (0x00 << 14) + #define VE_DEC_MPEG_IQMINPUT_WEIGHT(i, v) \ +- (((v) & GENMASK(7, 0)) | (((i) << 8) & GENMASK(13, 8))) ++ (SHIFT_AND_MASK_BITS(i, 13, 8) | SHIFT_AND_MASK_BITS(v, 7, 0)) + + #define VE_DEC_MPEG_ERROR (VE_ENGINE_DEC_MPEG + 0xc4) + #define VE_DEC_MPEG_CRTMBADDR (VE_ENGINE_DEC_MPEG + 0xc8) +diff --git a/drivers/staging/mt7621-pci/Kconfig b/drivers/staging/mt7621-pci/Kconfig +index af928b75a940..ce58042f2f21 100644 +--- a/drivers/staging/mt7621-pci/Kconfig ++++ b/drivers/staging/mt7621-pci/Kconfig +@@ -2,7 +2,6 @@ + config PCI_MT7621 + tristate "MediaTek MT7621 PCI Controller" + depends on RALINK +- depends on PCI + select PCI_DRIVERS_GENERIC + help + This selects a driver for the MediaTek MT7621 PCI Controller. +diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c +index 952f2ab51347..c37591657bac 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c ++++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c +@@ -776,7 +776,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN); + memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || + check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { +@@ -784,7 +784,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN); + memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else { + RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv))); +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index 2821411878ce..511136dce3a4 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -1422,7 +1422,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + (struct tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN); + struct usb_device *udev = priv->udev; + int pend; +- int status; ++ int status, rt = -1; + struct urb *tx_urb = NULL, *tx_urb_zero = NULL; + unsigned int idx_pipe; + +@@ -1566,8 +1566,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + } + if (bSend0Byte) { + tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC); +- if (!tx_urb_zero) +- return -ENOMEM; ++ if (!tx_urb_zero) { ++ rt = -ENOMEM; ++ goto error; ++ } + usb_fill_bulk_urb(tx_urb_zero, udev, + usb_sndbulkpipe(udev, idx_pipe), + &zero, 0, tx_zero_isr, dev); +@@ -1577,7 +1579,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + "Error TX URB for zero byte %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ goto error; + } + } + netif_trans_update(dev); +@@ -1588,7 +1590,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + RT_TRACE(COMP_ERR, "Error TX URB %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ ++error: ++ dev_kfree_skb_any(skb); ++ usb_free_urb(tx_urb); ++ usb_free_urb(tx_urb_zero); ++ return rt; + } + + static short rtl8192_usb_initendpoints(struct net_device *dev) +diff --git a/drivers/staging/wilc1000/wilc_hif.c b/drivers/staging/wilc1000/wilc_hif.c +index d3d9ea284816..77d0732f451b 100644 +--- a/drivers/staging/wilc1000/wilc_hif.c ++++ b/drivers/staging/wilc1000/wilc_hif.c +@@ -473,6 +473,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, + rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len); + if (rates_ie) { + rates_len = rates_ie[1]; ++ if (rates_len > WILC_MAX_RATES_SUPPORTED) ++ rates_len = WILC_MAX_RATES_SUPPORTED; + param->supp_rates[0] = rates_len; + memcpy(¶m->supp_rates[1], rates_ie + 2, rates_len); + } +diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c +index 22f21831649b..c3cd6f389a98 100644 +--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c ++++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c +@@ -1419,8 +1419,10 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev, + if (vif->iftype == WILC_AP_MODE || vif->iftype == WILC_GO_MODE) + wilc_wfi_deinit_mon_interface(wl, true); + vif->iftype = WILC_STATION_MODE; +- wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), +- WILC_STATION_MODE, vif->idx); ++ ++ if (wl->initialized) ++ wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), ++ WILC_STATION_MODE, vif->idx); + + memset(priv->assoc_stainfo.sta_associated_bss, 0, + WILC_MAX_NUM_STA * ETH_ALEN); +@@ -1432,8 +1434,10 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev, + priv->wdev.iftype = type; + vif->monitor_flag = 0; + vif->iftype = WILC_CLIENT_MODE; +- wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), +- WILC_STATION_MODE, vif->idx); ++ ++ if (wl->initialized) ++ wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), ++ WILC_STATION_MODE, vif->idx); + break; + + case NL80211_IFTYPE_AP: +@@ -1450,8 +1454,10 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev, + dev->ieee80211_ptr->iftype = type; + priv->wdev.iftype = type; + vif->iftype = WILC_GO_MODE; +- wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), +- WILC_AP_MODE, vif->idx); ++ ++ if (wl->initialized) ++ wilc_set_operation_mode(vif, wilc_get_vif_idx(vif), ++ WILC_AP_MODE, vif->idx); + break; + + default: +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index a8dc8af83f39..1ba9bc667e13 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -2270,27 +2270,6 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + mode |= ATMEL_US_USMODE_NORMAL; + } + +- /* set the mode, clock divisor, parity, stop bits and data size */ +- atmel_uart_writel(port, ATMEL_US_MR, mode); +- +- /* +- * when switching the mode, set the RTS line state according to the +- * new mode, otherwise keep the former state +- */ +- if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) { +- unsigned int rts_state; +- +- if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) { +- /* let the hardware control the RTS line */ +- rts_state = ATMEL_US_RTSDIS; +- } else { +- /* force RTS line to low level */ +- rts_state = ATMEL_US_RTSEN; +- } +- +- atmel_uart_writel(port, ATMEL_US_CR, rts_state); +- } +- + /* + * Set the baud rate: + * Fractional baudrate allows to setup output frequency more +@@ -2317,6 +2296,28 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + + if (!(port->iso7816.flags & SER_ISO7816_ENABLED)) + atmel_uart_writel(port, ATMEL_US_BRGR, quot); ++ ++ /* set the mode, clock divisor, parity, stop bits and data size */ ++ atmel_uart_writel(port, ATMEL_US_MR, mode); ++ ++ /* ++ * when switching the mode, set the RTS line state according to the ++ * new mode, otherwise keep the former state ++ */ ++ if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) { ++ unsigned int rts_state; ++ ++ if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) { ++ /* let the hardware control the RTS line */ ++ rts_state = ATMEL_US_RTSDIS; ++ } else { ++ /* force RTS line to low level */ ++ rts_state = ATMEL_US_RTSEN; ++ } ++ ++ atmel_uart_writel(port, ATMEL_US_CR, rts_state); ++ } ++ + atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA | ATMEL_US_RSTRX); + atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN | ATMEL_US_RXEN); + atmel_port->tx_stopped = false; +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 771d11196523..494e2672ebd7 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -679,6 +679,9 @@ static irqreturn_t sprd_handle_irq(int irq, void *dev_id) + if (ims & SPRD_IMSR_TIMEOUT) + serial_out(port, SPRD_ICLR, SPRD_ICLR_TIMEOUT); + ++ if (ims & SPRD_IMSR_BREAK_DETECT) ++ serial_out(port, SPRD_ICLR, SPRD_IMSR_BREAK_DETECT); ++ + if (ims & (SPRD_IMSR_RX_FIFO_FULL | SPRD_IMSR_BREAK_DETECT | + SPRD_IMSR_TIMEOUT)) + sprd_rx(port); +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 3f899552f6e3..6ca40d135430 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -764,8 +764,15 @@ static int claimintf(struct usb_dev_state *ps, unsigned int ifnum) + intf = usb_ifnum_to_if(dev, ifnum); + if (!intf) + err = -ENOENT; +- else ++ else { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while claiming interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + err = usb_driver_claim_interface(&usbfs_driver, intf, ps); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); ++ } + if (err == 0) + set_bit(ifnum, &ps->ifclaimed); + return err; +@@ -785,7 +792,13 @@ static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum) + if (!intf) + err = -ENOENT; + else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while releasing interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + usb_driver_release_interface(&usbfs_driver, intf); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); + err = 0; + } + return err; +diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c +index aa2f77f1506d..8a5c9b3ebe1e 100644 +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -27,6 +27,10 @@ + + /*-------------------------------------------------------------------------*/ + ++/* PID Codes that are used here, from EHCI specification, Table 3-16. */ ++#define PID_CODE_IN 1 ++#define PID_CODE_SETUP 2 ++ + /* fill a qtd, returning how much of the buffer we were able to queue up */ + + static int +@@ -190,7 +194,7 @@ static int qtd_copy_status ( + int status = -EINPROGRESS; + + /* count IN/OUT bytes, not SETUP (even short packets) */ +- if (likely (QTD_PID (token) != 2)) ++ if (likely(QTD_PID(token) != PID_CODE_SETUP)) + urb->actual_length += length - QTD_LENGTH (token); + + /* don't modify error codes */ +@@ -206,6 +210,13 @@ static int qtd_copy_status ( + if (token & QTD_STS_BABBLE) { + /* FIXME "must" disable babbling device's port too */ + status = -EOVERFLOW; ++ /* ++ * When MMF is active and PID Code is IN, queue is halted. ++ * EHCI Specification, Table 4-13. ++ */ ++ } else if ((token & QTD_STS_MMF) && ++ (QTD_PID(token) == PID_CODE_IN)) { ++ status = -EPROTO; + /* CERR nonzero + halt --> stall */ + } else if (QTD_CERR(token)) { + status = -EPIPE; +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 1904ef56f61c..4917c5b033fa 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -48,6 +48,7 @@ + #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_2C_XHCI 0x15e9 + #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_4C_XHCI 0x15ec + #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI 0x15f0 ++#define PCI_DEVICE_ID_INTEL_ICE_LAKE_XHCI 0x8a13 + + #define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 + #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba +@@ -212,7 +213,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + pdev->device == PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_4C_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_2C_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_4C_XHCI || +- pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI)) ++ pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_ICE_LAKE_XHCI)) + xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; + + if (pdev->vendor == PCI_VENDOR_ID_ETRON && +@@ -517,7 +519,6 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + retval = xhci_resume(xhci, hibernated); + return retval; + } +-#endif /* CONFIG_PM */ + + static void xhci_pci_shutdown(struct usb_hcd *hcd) + { +@@ -530,6 +531,7 @@ static void xhci_pci_shutdown(struct usb_hcd *hcd) + if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) + pci_set_power_state(pdev, PCI_D3hot); + } ++#endif /* CONFIG_PM */ + + /*-------------------------------------------------------------------------*/ + +diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h +index 0824099b905e..ef1735d014da 100644 +--- a/drivers/usb/renesas_usbhs/common.h ++++ b/drivers/usb/renesas_usbhs/common.h +@@ -161,11 +161,12 @@ struct usbhs_priv; + #define VBSTS (1 << 7) /* VBUS_0 and VBUSIN_0 Input Status */ + #define VALID (1 << 3) /* USB Request Receive */ + +-#define DVSQ_MASK (0x3 << 4) /* Device State */ ++#define DVSQ_MASK (0x7 << 4) /* Device State */ + #define POWER_STATE (0 << 4) + #define DEFAULT_STATE (1 << 4) + #define ADDRESS_STATE (2 << 4) + #define CONFIGURATION_STATE (3 << 4) ++#define SUSPENDED_STATE (4 << 4) + + #define CTSQ_MASK (0x7) /* Control Transfer Stage */ + #define IDLE_SETUP_STAGE 0 /* Idle stage or setup stage */ +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index cd38d74b3223..53489cafecc1 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -457,12 +457,18 @@ static int usbhsg_irq_dev_state(struct usbhs_priv *priv, + { + struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv); + struct device *dev = usbhsg_gpriv_to_dev(gpriv); ++ int state = usbhs_status_get_device_state(irq_state); + + gpriv->gadget.speed = usbhs_bus_get_speed(priv); + +- dev_dbg(dev, "state = %x : speed : %d\n", +- usbhs_status_get_device_state(irq_state), +- gpriv->gadget.speed); ++ dev_dbg(dev, "state = %x : speed : %d\n", state, gpriv->gadget.speed); ++ ++ if (gpriv->gadget.speed != USB_SPEED_UNKNOWN && ++ (state & SUSPENDED_STATE)) { ++ if (gpriv->driver && gpriv->driver->suspend) ++ gpriv->driver->suspend(&gpriv->gadget); ++ usb_gadget_set_state(&gpriv->gadget, USB_STATE_SUSPENDED); ++ } + + return 0; + } +diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c +index 6532d68e8808..e4b96674c405 100644 +--- a/drivers/usb/usbip/usbip_common.c ++++ b/drivers/usb/usbip/usbip_common.c +@@ -727,6 +727,9 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) + + copy -= recv; + ret += recv; ++ ++ if (!copy) ++ break; + } + + if (ret != size) +diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c +index 33f8972ba842..00fc98741c5d 100644 +--- a/drivers/usb/usbip/vhci_rx.c ++++ b/drivers/usb/usbip/vhci_rx.c +@@ -77,16 +77,21 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, + usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0); + + /* recv transfer buffer */ +- if (usbip_recv_xbuff(ud, urb) < 0) +- return; ++ if (usbip_recv_xbuff(ud, urb) < 0) { ++ urb->status = -EPROTO; ++ goto error; ++ } + + /* recv iso_packet_descriptor */ +- if (usbip_recv_iso(ud, urb) < 0) +- return; ++ if (usbip_recv_iso(ud, urb) < 0) { ++ urb->status = -EPROTO; ++ goto error; ++ } + + /* restore the padding in iso packets */ + usbip_pad_iso(ud, urb); + ++error: + if (usbip_dbg_flag_vhci_rx) + usbip_dump_urb(urb); + +diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig +index 79cc75096f42..a50dadd01093 100644 +--- a/drivers/xen/Kconfig ++++ b/drivers/xen/Kconfig +@@ -141,7 +141,8 @@ config XEN_GNTDEV + + config XEN_GNTDEV_DMABUF + bool "Add support for dma-buf grant access device driver extension" +- depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC && DMA_SHARED_BUFFER ++ depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC ++ select DMA_SHARED_BUFFER + help + Allows userspace processes and kernel modules to use Xen backed + dma-buf implementation. With this extension grant references to +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index 2e9e13ffbd08..10a04b99798a 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -252,16 +252,17 @@ out: + } + } + +-static void run_ordered_work(struct __btrfs_workqueue *wq) ++static void run_ordered_work(struct __btrfs_workqueue *wq, ++ struct btrfs_work *self) + { + struct list_head *list = &wq->ordered_list; + struct btrfs_work *work; + spinlock_t *lock = &wq->list_lock; + unsigned long flags; ++ void *wtag; ++ bool free_self = false; + + while (1) { +- void *wtag; +- + spin_lock_irqsave(lock, flags); + if (list_empty(list)) + break; +@@ -287,16 +288,47 @@ static void run_ordered_work(struct __btrfs_workqueue *wq) + list_del(&work->ordered_list); + spin_unlock_irqrestore(lock, flags); + +- /* +- * We don't want to call the ordered free functions with the +- * lock held though. Save the work as tag for the trace event, +- * because the callback could free the structure. +- */ +- wtag = work; +- work->ordered_free(work); +- trace_btrfs_all_work_done(wq->fs_info, wtag); ++ if (work == self) { ++ /* ++ * This is the work item that the worker is currently ++ * executing. ++ * ++ * The kernel workqueue code guarantees non-reentrancy ++ * of work items. I.e., if a work item with the same ++ * address and work function is queued twice, the second ++ * execution is blocked until the first one finishes. A ++ * work item may be freed and recycled with the same ++ * work function; the workqueue code assumes that the ++ * original work item cannot depend on the recycled work ++ * item in that case (see find_worker_executing_work()). ++ * ++ * Note that the work of one Btrfs filesystem may depend ++ * on the work of another Btrfs filesystem via, e.g., a ++ * loop device. Therefore, we must not allow the current ++ * work item to be recycled until we are really done, ++ * otherwise we break the above assumption and can ++ * deadlock. ++ */ ++ free_self = true; ++ } else { ++ /* ++ * We don't want to call the ordered free functions with ++ * the lock held though. Save the work as tag for the ++ * trace event, because the callback could free the ++ * structure. ++ */ ++ wtag = work; ++ work->ordered_free(work); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + spin_unlock_irqrestore(lock, flags); ++ ++ if (free_self) { ++ wtag = self; ++ self->ordered_free(self); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + + static void normal_work_helper(struct btrfs_work *work) +@@ -324,7 +356,7 @@ static void normal_work_helper(struct btrfs_work *work) + work->func(work); + if (need_order) { + set_bit(WORK_DONE_BIT, &work->flags); +- run_ordered_work(wq); ++ run_ordered_work(wq, work); + } + if (!need_order) + trace_btrfs_all_work_done(wq->fs_info, wtag); +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index e59cde204b2f..da9b0f060a9d 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -383,7 +383,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info, + for (node = rb_first(tm_root); node; node = next) { + next = rb_next(node); + tm = rb_entry(node, struct tree_mod_elem, node); +- if (tm->seq > min_seq) ++ if (tm->seq >= min_seq) + continue; + rb_erase(node, tm_root); + kfree(tm); +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index fe2b8765d9e6..5e9f80b28fcf 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -2785,7 +2785,7 @@ struct btrfs_inode_extref *btrfs_find_name_in_ext_backref( + /* file-item.c */ + struct btrfs_dio_private; + int btrfs_del_csums(struct btrfs_trans_handle *trans, +- struct btrfs_fs_info *fs_info, u64 bytenr, u64 len); ++ struct btrfs_root *root, u64 bytenr, u64 len); + blk_status_t btrfs_lookup_bio_sums(struct inode *inode, struct bio *bio, + u8 *dst); + blk_status_t btrfs_lookup_bio_sums_dio(struct inode *inode, struct bio *bio, +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 402b61bf345c..3895c21853cc 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1657,8 +1657,8 @@ static void end_workqueue_fn(struct btrfs_work *work) + bio->bi_status = end_io_wq->status; + bio->bi_private = end_io_wq->private; + bio->bi_end_io = end_io_wq->end_io; +- kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + bio_endio(bio); ++ kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + } + + static int cleaner_kthread(void *arg) +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 49cb26fa7c63..eb95ed78a18e 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -1848,8 +1848,8 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans, + btrfs_pin_extent(fs_info, head->bytenr, + head->num_bytes, 1); + if (head->is_data) { +- ret = btrfs_del_csums(trans, fs_info, head->bytenr, +- head->num_bytes); ++ ret = btrfs_del_csums(trans, fs_info->csum_root, ++ head->bytenr, head->num_bytes); + } + } + +@@ -3155,7 +3155,8 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans, + btrfs_release_path(path); + + if (is_data) { +- ret = btrfs_del_csums(trans, info, bytenr, num_bytes); ++ ret = btrfs_del_csums(trans, info->csum_root, bytenr, ++ num_bytes); + if (ret) { + btrfs_abort_transaction(trans, ret); + goto out; +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 4905f48587df..be9dc78aa727 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -5066,12 +5066,14 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, + return eb; + eb = alloc_dummy_extent_buffer(fs_info, start); + if (!eb) +- return NULL; ++ return ERR_PTR(-ENOMEM); + eb->fs_info = fs_info; + again: + ret = radix_tree_preload(GFP_NOFS); +- if (ret) ++ if (ret) { ++ exists = ERR_PTR(ret); + goto free_eb; ++ } + spin_lock(&fs_info->buffer_lock); + ret = radix_tree_insert(&fs_info->buffer_radix, + start >> PAGE_SHIFT, eb); +diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c +index 1a599f50837b..c878bc25d046 100644 +--- a/fs/btrfs/file-item.c ++++ b/fs/btrfs/file-item.c +@@ -590,9 +590,9 @@ static noinline void truncate_one_csum(struct btrfs_fs_info *fs_info, + * range of bytes. + */ + int btrfs_del_csums(struct btrfs_trans_handle *trans, +- struct btrfs_fs_info *fs_info, u64 bytenr, u64 len) ++ struct btrfs_root *root, u64 bytenr, u64 len) + { +- struct btrfs_root *root = fs_info->csum_root; ++ struct btrfs_fs_info *fs_info = trans->fs_info; + struct btrfs_path *path; + struct btrfs_key key; + u64 end_byte = bytenr + len; +@@ -602,6 +602,9 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans, + u16 csum_size = btrfs_super_csum_size(fs_info->super_copy); + int blocksize_bits = fs_info->sb->s_blocksize_bits; + ++ ASSERT(root == fs_info->csum_root || ++ root->root_key.objectid == BTRFS_TREE_LOG_OBJECTID); ++ + path = btrfs_alloc_path(); + if (!path) + return -ENOMEM; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 10a01dd0c4e6..e5758f62e8d8 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5697,7 +5697,6 @@ static void inode_tree_add(struct inode *inode) + + static void inode_tree_del(struct inode *inode) + { +- struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_root *root = BTRFS_I(inode)->root; + int empty = 0; + +@@ -5710,7 +5709,6 @@ static void inode_tree_del(struct inode *inode) + spin_unlock(&root->inode_lock); + + if (empty && btrfs_root_refs(&root->root_item) == 0) { +- synchronize_srcu(&fs_info->subvol_srcu); + spin_lock(&root->inode_lock); + empty = RB_EMPTY_ROOT(&root->inode_tree); + spin_unlock(&root->inode_lock); +@@ -9535,9 +9533,8 @@ static int btrfs_rename_exchange(struct inode *old_dir, + btrfs_init_log_ctx(&ctx_dest, new_inode); + + /* close the race window with snapshot create/destroy ioctl */ +- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) +- down_read(&fs_info->subvol_sem); +- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) ++ if (old_ino == BTRFS_FIRST_FREE_OBJECTID || ++ new_ino == BTRFS_FIRST_FREE_OBJECTID) + down_read(&fs_info->subvol_sem); + + /* +@@ -9771,9 +9768,8 @@ out_fail: + ret = ret ? ret : ret2; + } + out_notrans: +- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) +- up_read(&fs_info->subvol_sem); +- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) ++ if (new_ino == BTRFS_FIRST_FREE_OBJECTID || ++ old_ino == BTRFS_FIRST_FREE_OBJECTID) + up_read(&fs_info->subvol_sem); + + ASSERT(list_empty(&ctx_root.list)); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 23272d9154f3..a56dcc0c9c2a 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -705,11 +705,17 @@ static noinline int create_subvol(struct inode *dir, + + btrfs_i_size_write(BTRFS_I(dir), dir->i_size + namelen * 2); + ret = btrfs_update_inode(trans, root, dir); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + + ret = btrfs_add_root_ref(trans, objectid, root->root_key.objectid, + btrfs_ino(BTRFS_I(dir)), index, name, namelen); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + + ret = btrfs_uuid_tree_add(trans, root_item->uuid, + BTRFS_UUID_KEY_SUBVOL, objectid); +diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c +index ee6f60547a8d..dd4f9c2b7107 100644 +--- a/fs/btrfs/reada.c ++++ b/fs/btrfs/reada.c +@@ -752,21 +752,19 @@ static int reada_start_machine_dev(struct btrfs_device *dev) + static void reada_start_machine_worker(struct btrfs_work *work) + { + struct reada_machine_work *rmw; +- struct btrfs_fs_info *fs_info; + int old_ioprio; + + rmw = container_of(work, struct reada_machine_work, work); +- fs_info = rmw->fs_info; +- +- kfree(rmw); + + old_ioprio = IOPRIO_PRIO_VALUE(task_nice_ioclass(current), + task_nice_ioprio(current)); + set_task_ioprio(current, BTRFS_IOPRIO_READA); +- __reada_start_machine(fs_info); ++ __reada_start_machine(rmw->fs_info); + set_task_ioprio(current, old_ioprio); + +- atomic_dec(&fs_info->reada_works_cnt); ++ atomic_dec(&rmw->fs_info->reada_works_cnt); ++ ++ kfree(rmw); + } + + static void __reada_start_machine(struct btrfs_fs_info *fs_info) +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 5cd42b66818c..fd0f4c1696c8 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4555,6 +4555,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) + fs_root = read_fs_root(fs_info, reloc_root->root_key.offset); + if (IS_ERR(fs_root)) { + err = PTR_ERR(fs_root); ++ list_add_tail(&reloc_root->root_list, &reloc_roots); + goto out_free; + } + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index f7d4e03f4c5d..a0770a6aee00 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -2149,14 +2149,13 @@ static void scrub_missing_raid56_worker(struct btrfs_work *work) + scrub_write_block_to_dev_replace(sblock); + } + +- scrub_block_put(sblock); +- + if (sctx->is_dev_replace && sctx->flush_all_writes) { + mutex_lock(&sctx->wr_lock); + scrub_wr_submit(sctx); + mutex_unlock(&sctx->wr_lock); + } + ++ scrub_block_put(sblock); + scrub_pending_bio_dec(sctx); + } + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 518ec1265a0c..3eb0fec2488a 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -7075,12 +7075,6 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg) + send_root->send_in_progress++; + spin_unlock(&send_root->root_item_lock); + +- /* +- * This is done when we lookup the root, it should already be complete +- * by the time we get here. +- */ +- WARN_ON(send_root->orphan_cleanup_state != ORPHAN_CLEANUP_DONE); +- + /* + * Userspace tools do the checks and warn the user if it's + * not RO. +diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c +index bc92df977630..6e774d055402 100644 +--- a/fs/btrfs/tests/free-space-tree-tests.c ++++ b/fs/btrfs/tests/free-space-tree-tests.c +@@ -463,9 +463,9 @@ static int run_test(test_func_t test_func, int bitmaps, u32 sectorsize, + root->fs_info->tree_root = root; + + root->node = alloc_test_extent_buffer(root->fs_info, nodesize); +- if (!root->node) { ++ if (IS_ERR(root->node)) { + test_std_err(TEST_ALLOC_EXTENT_BUFFER); +- ret = -ENOMEM; ++ ret = PTR_ERR(root->node); + goto out; + } + btrfs_set_header_level(root->node, 0); +diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c +index 09aaca1efd62..ac035a6fa003 100644 +--- a/fs/btrfs/tests/qgroup-tests.c ++++ b/fs/btrfs/tests/qgroup-tests.c +@@ -484,9 +484,9 @@ int btrfs_test_qgroups(u32 sectorsize, u32 nodesize) + * *cough*backref walking code*cough* + */ + root->node = alloc_test_extent_buffer(root->fs_info, nodesize); +- if (!root->node) { ++ if (IS_ERR(root->node)) { + test_err("couldn't allocate dummy buffer"); +- ret = -ENOMEM; ++ ret = PTR_ERR(root->node); + goto out; + } + btrfs_set_header_level(root->node, 0); +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index 076d5b8014fb..0e44db066641 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -243,7 +243,7 @@ static int check_extent_data_item(struct extent_buffer *leaf, + } + + static int check_csum_item(struct extent_buffer *leaf, struct btrfs_key *key, +- int slot) ++ int slot, struct btrfs_key *prev_key) + { + struct btrfs_fs_info *fs_info = leaf->fs_info; + u32 sectorsize = fs_info->sectorsize; +@@ -267,6 +267,20 @@ static int check_csum_item(struct extent_buffer *leaf, struct btrfs_key *key, + btrfs_item_size_nr(leaf, slot), csumsize); + return -EUCLEAN; + } ++ if (slot > 0 && prev_key->type == BTRFS_EXTENT_CSUM_KEY) { ++ u64 prev_csum_end; ++ u32 prev_item_size; ++ ++ prev_item_size = btrfs_item_size_nr(leaf, slot - 1); ++ prev_csum_end = (prev_item_size / csumsize) * sectorsize; ++ prev_csum_end += prev_key->offset; ++ if (prev_csum_end > key->offset) { ++ generic_err(leaf, slot - 1, ++"csum end range (%llu) goes beyond the start range (%llu) of the next csum item", ++ prev_csum_end, key->offset); ++ return -EUCLEAN; ++ } ++ } + return 0; + } + +@@ -1239,7 +1253,7 @@ static int check_leaf_item(struct extent_buffer *leaf, + ret = check_extent_data_item(leaf, key, slot, prev_key); + break; + case BTRFS_EXTENT_CSUM_KEY: +- ret = check_csum_item(leaf, key, slot); ++ ret = check_csum_item(leaf, key, slot, prev_key); + break; + case BTRFS_DIR_ITEM_KEY: + case BTRFS_DIR_INDEX_KEY: +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 8a6cc600bf18..ab27e6cd9b3e 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -808,7 +808,8 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans, + struct btrfs_ordered_sum, + list); + if (!ret) +- ret = btrfs_del_csums(trans, fs_info, ++ ret = btrfs_del_csums(trans, ++ fs_info->csum_root, + sums->bytenr, + sums->len); + if (!ret) +@@ -3927,6 +3928,28 @@ static int log_inode_item(struct btrfs_trans_handle *trans, + return 0; + } + ++static int log_csums(struct btrfs_trans_handle *trans, ++ struct btrfs_root *log_root, ++ struct btrfs_ordered_sum *sums) ++{ ++ int ret; ++ ++ /* ++ * Due to extent cloning, we might have logged a csum item that covers a ++ * subrange of a cloned extent, and later we can end up logging a csum ++ * item for a larger subrange of the same extent or the entire range. ++ * This would leave csum items in the log tree that cover the same range ++ * and break the searches for checksums in the log tree, resulting in ++ * some checksums missing in the fs/subvolume tree. So just delete (or ++ * trim and adjust) any existing csum items in the log for this range. ++ */ ++ ret = btrfs_del_csums(trans, log_root, sums->bytenr, sums->len); ++ if (ret) ++ return ret; ++ ++ return btrfs_csum_file_blocks(trans, log_root, sums); ++} ++ + static noinline int copy_items(struct btrfs_trans_handle *trans, + struct btrfs_inode *inode, + struct btrfs_path *dst_path, +@@ -4072,7 +4095,7 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, + struct btrfs_ordered_sum, + list); + if (!ret) +- ret = btrfs_csum_file_blocks(trans, log, sums); ++ ret = log_csums(trans, log, sums); + list_del(&sums->list); + kfree(sums); + } +@@ -4292,7 +4315,7 @@ static int log_extent_csums(struct btrfs_trans_handle *trans, + struct btrfs_ordered_sum, + list); + if (!ret) +- ret = btrfs_csum_file_blocks(trans, log_root, sums); ++ ret = log_csums(trans, log_root, sums); + list_del(&sums->list); + kfree(sums); + } +@@ -6314,9 +6337,28 @@ again: + wc.replay_dest = btrfs_read_fs_root_no_name(fs_info, &tmp_key); + if (IS_ERR(wc.replay_dest)) { + ret = PTR_ERR(wc.replay_dest); ++ ++ /* ++ * We didn't find the subvol, likely because it was ++ * deleted. This is ok, simply skip this log and go to ++ * the next one. ++ * ++ * We need to exclude the root because we can't have ++ * other log replays overwriting this log as we'll read ++ * it back in a few more times. This will keep our ++ * block from being modified, and we'll just bail for ++ * each subsequent pass. ++ */ ++ if (ret == -ENOENT) ++ ret = btrfs_pin_extent_for_log_replay(fs_info, ++ log->node->start, ++ log->node->len); + free_extent_buffer(log->node); + free_extent_buffer(log->commit_root); + kfree(log); ++ ++ if (!ret) ++ goto next; + btrfs_handle_fs_error(fs_info, ret, + "Couldn't read target root for tree log recovery."); + goto error; +@@ -6348,7 +6390,6 @@ again: + &root->highest_objectid); + } + +- key.offset = found_key.offset - 1; + wc.replay_dest->log_root = NULL; + free_extent_buffer(log->node); + free_extent_buffer(log->commit_root); +@@ -6356,9 +6397,10 @@ again: + + if (ret) + goto error; +- ++next: + if (found_key.offset == 0) + break; ++ key.offset = found_key.offset - 1; + } + btrfs_release_path(path); + +diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c +index 91caab63bdf5..76b84f2397b1 100644 +--- a/fs/btrfs/uuid-tree.c ++++ b/fs/btrfs/uuid-tree.c +@@ -324,6 +324,8 @@ again_search_slot: + } + if (ret < 0 && ret != -ENOENT) + goto out; ++ key.offset++; ++ goto again_search_slot; + } + item_size -= sizeof(subid_le); + offset += sizeof(subid_le); +diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c +index 9fdd2b269d61..6305d5ec25af 100644 +--- a/fs/ext4/dir.c ++++ b/fs/ext4/dir.c +@@ -81,6 +81,11 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, + error_msg = "rec_len is too small for name_len"; + else if (unlikely(((char *) de - buf) + rlen > size)) + error_msg = "directory entry overrun"; ++ else if (unlikely(((char *) de - buf) + rlen > ++ size - EXT4_DIR_REC_LEN(1) && ++ ((char *) de - buf) + rlen != size)) { ++ error_msg = "directory entry too close to block end"; ++ } + else if (unlikely(le32_to_cpu(de->inode) > + le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) + error_msg = "inode out of bounds"; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 91da21890360..53134e4509b8 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -6035,7 +6035,7 @@ int ext4_expand_extra_isize(struct inode *inode, + error = ext4_journal_get_write_access(handle, iloc->bh); + if (error) { + brelse(iloc->bh); +- goto out_stop; ++ goto out_unlock; + } + + error = __ext4_expand_extra_isize(inode, new_extra_isize, iloc, +@@ -6045,8 +6045,8 @@ int ext4_expand_extra_isize(struct inode *inode, + if (!error) + error = rc; + ++out_unlock: + ext4_write_unlock_xattr(inode, &no_expand); +-out_stop: + ext4_journal_stop(handle); + return error; + } +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 923476e3aefb..f56402e9c11c 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2808,7 +2808,7 @@ bool ext4_empty_dir(struct inode *inode) + { + unsigned int offset; + struct buffer_head *bh; +- struct ext4_dir_entry_2 *de, *de1; ++ struct ext4_dir_entry_2 *de; + struct super_block *sb; + + if (ext4_has_inline_data(inode)) { +@@ -2833,19 +2833,25 @@ bool ext4_empty_dir(struct inode *inode) + return true; + + de = (struct ext4_dir_entry_2 *) bh->b_data; +- de1 = ext4_next_entry(de, sb->s_blocksize); +- if (le32_to_cpu(de->inode) != inode->i_ino || +- le32_to_cpu(de1->inode) == 0 || +- strcmp(".", de->name) || strcmp("..", de1->name)) { +- ext4_warning_inode(inode, "directory missing '.' and/or '..'"); ++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, ++ 0) || ++ le32_to_cpu(de->inode) != inode->i_ino || strcmp(".", de->name)) { ++ ext4_warning_inode(inode, "directory missing '.'"); ++ brelse(bh); ++ return true; ++ } ++ offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); ++ de = ext4_next_entry(de, sb->s_blocksize); ++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, ++ offset) || ++ le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) { ++ ext4_warning_inode(inode, "directory missing '..'"); + brelse(bh); + return true; + } +- offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize) + +- ext4_rec_len_from_disk(de1->rec_len, sb->s_blocksize); +- de = ext4_next_entry(de1, sb->s_blocksize); ++ offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); + while (offset < inode->i_size) { +- if ((void *) de >= (void *) (bh->b_data+sb->s_blocksize)) { ++ if (!(offset & (sb->s_blocksize - 1))) { + unsigned int lblock; + brelse(bh); + lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb); +@@ -2856,12 +2862,11 @@ bool ext4_empty_dir(struct inode *inode) + } + if (IS_ERR(bh)) + return true; +- de = (struct ext4_dir_entry_2 *) bh->b_data; + } ++ de = (struct ext4_dir_entry_2 *) (bh->b_data + ++ (offset & (sb->s_blocksize - 1))); + if (ext4_check_dir_entry(inode, NULL, de, bh, + bh->b_data, bh->b_size, offset)) { +- de = (struct ext4_dir_entry_2 *)(bh->b_data + +- sb->s_blocksize); + offset = (offset | (sb->s_blocksize - 1)) + 1; + continue; + } +@@ -2870,7 +2875,6 @@ bool ext4_empty_dir(struct inode *inode) + return false; + } + offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); +- de = ext4_next_entry(de, sb->s_blocksize); + } + brelse(bh); + return true; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 98d37b8d0050..66162b430edc 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1887,6 +1887,13 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token, + } + sbi->s_commit_interval = HZ * arg; + } else if (token == Opt_debug_want_extra_isize) { ++ if ((arg & 1) || ++ (arg < 4) || ++ (arg > (sbi->s_inode_size - EXT4_GOOD_OLD_INODE_SIZE))) { ++ ext4_msg(sb, KERN_ERR, ++ "Invalid want_extra_isize %d", arg); ++ return -1; ++ } + sbi->s_want_extra_isize = arg; + } else if (token == Opt_max_batch_time) { + sbi->s_max_batch_time = arg; +@@ -3551,40 +3558,6 @@ int ext4_calculate_overhead(struct super_block *sb) + return 0; + } + +-static void ext4_clamp_want_extra_isize(struct super_block *sb) +-{ +- struct ext4_sb_info *sbi = EXT4_SB(sb); +- struct ext4_super_block *es = sbi->s_es; +- unsigned def_extra_isize = sizeof(struct ext4_inode) - +- EXT4_GOOD_OLD_INODE_SIZE; +- +- if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) { +- sbi->s_want_extra_isize = 0; +- return; +- } +- if (sbi->s_want_extra_isize < 4) { +- sbi->s_want_extra_isize = def_extra_isize; +- if (ext4_has_feature_extra_isize(sb)) { +- if (sbi->s_want_extra_isize < +- le16_to_cpu(es->s_want_extra_isize)) +- sbi->s_want_extra_isize = +- le16_to_cpu(es->s_want_extra_isize); +- if (sbi->s_want_extra_isize < +- le16_to_cpu(es->s_min_extra_isize)) +- sbi->s_want_extra_isize = +- le16_to_cpu(es->s_min_extra_isize); +- } +- } +- /* Check if enough inode space is available */ +- if ((sbi->s_want_extra_isize > sbi->s_inode_size) || +- (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize > +- sbi->s_inode_size)) { +- sbi->s_want_extra_isize = def_extra_isize; +- ext4_msg(sb, KERN_INFO, +- "required extra inode space not available"); +- } +-} +- + static void ext4_set_resv_clusters(struct super_block *sb) + { + ext4_fsblk_t resv_clusters; +@@ -3792,6 +3765,68 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + */ + sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT; + ++ if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { ++ sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; ++ sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO; ++ } else { ++ sbi->s_inode_size = le16_to_cpu(es->s_inode_size); ++ sbi->s_first_ino = le32_to_cpu(es->s_first_ino); ++ if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) { ++ ext4_msg(sb, KERN_ERR, "invalid first ino: %u", ++ sbi->s_first_ino); ++ goto failed_mount; ++ } ++ if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) || ++ (!is_power_of_2(sbi->s_inode_size)) || ++ (sbi->s_inode_size > blocksize)) { ++ ext4_msg(sb, KERN_ERR, ++ "unsupported inode size: %d", ++ sbi->s_inode_size); ++ goto failed_mount; ++ } ++ /* ++ * i_atime_extra is the last extra field available for ++ * [acm]times in struct ext4_inode. Checking for that ++ * field should suffice to ensure we have extra space ++ * for all three. ++ */ ++ if (sbi->s_inode_size >= offsetof(struct ext4_inode, i_atime_extra) + ++ sizeof(((struct ext4_inode *)0)->i_atime_extra)) { ++ sb->s_time_gran = 1; ++ sb->s_time_max = EXT4_EXTRA_TIMESTAMP_MAX; ++ } else { ++ sb->s_time_gran = NSEC_PER_SEC; ++ sb->s_time_max = EXT4_NON_EXTRA_TIMESTAMP_MAX; ++ } ++ sb->s_time_min = EXT4_TIMESTAMP_MIN; ++ } ++ if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE) { ++ sbi->s_want_extra_isize = sizeof(struct ext4_inode) - ++ EXT4_GOOD_OLD_INODE_SIZE; ++ if (ext4_has_feature_extra_isize(sb)) { ++ unsigned v, max = (sbi->s_inode_size - ++ EXT4_GOOD_OLD_INODE_SIZE); ++ ++ v = le16_to_cpu(es->s_want_extra_isize); ++ if (v > max) { ++ ext4_msg(sb, KERN_ERR, ++ "bad s_want_extra_isize: %d", v); ++ goto failed_mount; ++ } ++ if (sbi->s_want_extra_isize < v) ++ sbi->s_want_extra_isize = v; ++ ++ v = le16_to_cpu(es->s_min_extra_isize); ++ if (v > max) { ++ ext4_msg(sb, KERN_ERR, ++ "bad s_min_extra_isize: %d", v); ++ goto failed_mount; ++ } ++ if (sbi->s_want_extra_isize < v) ++ sbi->s_want_extra_isize = v; ++ } ++ } ++ + if (sbi->s_es->s_mount_opts[0]) { + char *s_mount_opts = kstrndup(sbi->s_es->s_mount_opts, + sizeof(sbi->s_es->s_mount_opts), +@@ -4030,42 +4065,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + has_huge_files); + sb->s_maxbytes = ext4_max_size(sb->s_blocksize_bits, has_huge_files); + +- if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { +- sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; +- sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO; +- } else { +- sbi->s_inode_size = le16_to_cpu(es->s_inode_size); +- sbi->s_first_ino = le32_to_cpu(es->s_first_ino); +- if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) { +- ext4_msg(sb, KERN_ERR, "invalid first ino: %u", +- sbi->s_first_ino); +- goto failed_mount; +- } +- if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) || +- (!is_power_of_2(sbi->s_inode_size)) || +- (sbi->s_inode_size > blocksize)) { +- ext4_msg(sb, KERN_ERR, +- "unsupported inode size: %d", +- sbi->s_inode_size); +- goto failed_mount; +- } +- /* +- * i_atime_extra is the last extra field available for [acm]times in +- * struct ext4_inode. Checking for that field should suffice to ensure +- * we have extra space for all three. +- */ +- if (sbi->s_inode_size >= offsetof(struct ext4_inode, i_atime_extra) + +- sizeof(((struct ext4_inode *)0)->i_atime_extra)) { +- sb->s_time_gran = 1; +- sb->s_time_max = EXT4_EXTRA_TIMESTAMP_MAX; +- } else { +- sb->s_time_gran = NSEC_PER_SEC; +- sb->s_time_max = EXT4_NON_EXTRA_TIMESTAMP_MAX; +- } +- +- sb->s_time_min = EXT4_TIMESTAMP_MIN; +- } +- + sbi->s_desc_size = le16_to_cpu(es->s_desc_size); + if (ext4_has_feature_64bit(sb)) { + if (sbi->s_desc_size < EXT4_MIN_DESC_SIZE_64BIT || +@@ -4521,8 +4520,6 @@ no_journal: + } else if (ret) + goto failed_mount4a; + +- ext4_clamp_want_extra_isize(sb); +- + ext4_set_resv_clusters(sb); + + err = ext4_setup_system_zone(sb); +@@ -5310,8 +5307,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + goto restore_opts; + } + +- ext4_clamp_want_extra_isize(sb); +- + if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^ + test_opt(sb, JOURNAL_CHECKSUM)) { + ext4_msg(sb, KERN_ERR, "changing journal_checksum " +diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h +index 2ba6253ea6d3..fc349204a71b 100644 +--- a/include/drm/drm_dp_mst_helper.h ++++ b/include/drm/drm_dp_mst_helper.h +@@ -334,7 +334,7 @@ struct drm_dp_resource_status_notify { + + struct drm_dp_query_payload_ack_reply { + u8 port_number; +- u8 allocated_pbn; ++ u16 allocated_pbn; + }; + + struct drm_dp_sideband_msg_req_body { +diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h +index 92d5fdc8154e..31b1b0e03df8 100644 +--- a/include/linux/cpufreq.h ++++ b/include/linux/cpufreq.h +@@ -595,17 +595,6 @@ struct governor_attr { + size_t count); + }; + +-static inline bool cpufreq_this_cpu_can_update(struct cpufreq_policy *policy) +-{ +- /* +- * Allow remote callbacks if: +- * - dvfs_possible_from_any_cpu flag is set +- * - the local and remote CPUs share cpufreq policy +- */ +- return policy->dvfs_possible_from_any_cpu || +- cpumask_test_cpu(smp_processor_id(), policy->cpus); +-} +- + /********************************************************************* + * FREQUENCY TABLE HELPERS * + *********************************************************************/ +diff --git a/include/linux/ipmi_smi.h b/include/linux/ipmi_smi.h +index 4dc66157d872..deec18b8944a 100644 +--- a/include/linux/ipmi_smi.h ++++ b/include/linux/ipmi_smi.h +@@ -224,10 +224,14 @@ static inline int ipmi_demangle_device_id(uint8_t netfn, uint8_t cmd, + * is called, and the lower layer must get the interface from that + * call. + */ +-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, +- void *send_info, +- struct device *dev, +- unsigned char slave_addr); ++int ipmi_add_smi(struct module *owner, ++ const struct ipmi_smi_handlers *handlers, ++ void *send_info, ++ struct device *dev, ++ unsigned char slave_addr); ++ ++#define ipmi_register_smi(handlers, send_info, dev, slave_addr) \ ++ ipmi_add_smi(THIS_MODULE, handlers, send_info, dev, slave_addr) + + /* + * Remove a low-level interface from the IPMI driver. This will +diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h +index 5714fd35a83c..e3596db077dc 100644 +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -587,9 +587,9 @@ struct platform_device_id { + #define MDIO_NAME_SIZE 32 + #define MDIO_MODULE_PREFIX "mdio:" + +-#define MDIO_ID_FMT "%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d" ++#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u" + #define MDIO_ID_ARGS(_id) \ +- (_id)>>31, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ ++ ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ + ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \ + ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \ + ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \ +diff --git a/include/linux/nvme.h b/include/linux/nvme.h +index f61d6906e59d..a260cd754f28 100644 +--- a/include/linux/nvme.h ++++ b/include/linux/nvme.h +@@ -1368,6 +1368,7 @@ enum { + NVME_SC_ANA_INACCESSIBLE = 0x302, + NVME_SC_ANA_TRANSITION = 0x303, + NVME_SC_HOST_PATH_ERROR = 0x370, ++ NVME_SC_HOST_ABORTED_CMD = 0x371, + + NVME_SC_CRD = 0x1800, + NVME_SC_DNR = 0x4000, +diff --git a/include/linux/nvmem-consumer.h b/include/linux/nvmem-consumer.h +index 8f8be5b00060..5c17cb733224 100644 +--- a/include/linux/nvmem-consumer.h ++++ b/include/linux/nvmem-consumer.h +@@ -118,7 +118,7 @@ static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len) + } + + static inline int nvmem_cell_write(struct nvmem_cell *cell, +- const char *buf, size_t len) ++ void *buf, size_t len) + { + return -EOPNOTSUPP; + } +diff --git a/include/linux/phy.h b/include/linux/phy.h +index 9a0e981df502..3d5d53313e6c 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -993,7 +993,7 @@ int phy_modify_paged_changed(struct phy_device *phydev, int page, u32 regnum, + int phy_modify_paged(struct phy_device *phydev, int page, u32 regnum, + u16 mask, u16 set); + +-struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, ++struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + bool is_c45, + struct phy_c45_device_ids *c45_ids); + #if IS_ENABLED(CONFIG_PHYLIB) +diff --git a/include/linux/sched/cpufreq.h b/include/linux/sched/cpufreq.h +index afa940cd50dc..cc6bcc1e96bc 100644 +--- a/include/linux/sched/cpufreq.h ++++ b/include/linux/sched/cpufreq.h +@@ -12,6 +12,8 @@ + #define SCHED_CPUFREQ_MIGRATION (1U << 1) + + #ifdef CONFIG_CPU_FREQ ++struct cpufreq_policy; ++ + struct update_util_data { + void (*func)(struct update_util_data *data, u64 time, unsigned int flags); + }; +@@ -20,6 +22,7 @@ void cpufreq_add_update_util_hook(int cpu, struct update_util_data *data, + void (*func)(struct update_util_data *data, u64 time, + unsigned int flags)); + void cpufreq_remove_update_util_hook(int cpu); ++bool cpufreq_this_cpu_can_update(struct cpufreq_policy *policy); + + static inline unsigned long map_util_freq(unsigned long util, + unsigned long freq, unsigned long cap) +diff --git a/include/net/arp.h b/include/net/arp.h +index c8f580a0e6b1..4950191f6b2b 100644 +--- a/include/net/arp.h ++++ b/include/net/arp.h +@@ -57,8 +57,8 @@ static inline void __ipv4_confirm_neigh(struct net_device *dev, u32 key) + unsigned long now = jiffies; + + /* avoid dirtying neighbour */ +- if (n->confirmed != now) +- n->confirmed = now; ++ if (READ_ONCE(n->confirmed) != now) ++ WRITE_ONCE(n->confirmed, now); + } + rcu_read_unlock_bh(); + } +diff --git a/include/net/dst.h b/include/net/dst.h +index fe62fe2eb781..8224dad2ae94 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -82,7 +82,7 @@ struct dst_entry { + struct dst_metrics { + u32 metrics[RTAX_MAX]; + refcount_t refcnt; +-}; ++} __aligned(4); /* Low pointer bits contain DST_METRICS_FLAGS */ + extern const struct dst_metrics dst_default_metrics; + + u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old); +diff --git a/include/net/ndisc.h b/include/net/ndisc.h +index b2f715ca0567..b5ebeb3b0de0 100644 +--- a/include/net/ndisc.h ++++ b/include/net/ndisc.h +@@ -414,8 +414,8 @@ static inline void __ipv6_confirm_neigh(struct net_device *dev, + unsigned long now = jiffies; + + /* avoid dirtying neighbour */ +- if (n->confirmed != now) +- n->confirmed = now; ++ if (READ_ONCE(n->confirmed) != now) ++ WRITE_ONCE(n->confirmed, now); + } + rcu_read_unlock_bh(); + } +@@ -431,8 +431,8 @@ static inline void __ipv6_confirm_neigh_stub(struct net_device *dev, + unsigned long now = jiffies; + + /* avoid dirtying neighbour */ +- if (n->confirmed != now) +- n->confirmed = now; ++ if (READ_ONCE(n->confirmed) != now) ++ WRITE_ONCE(n->confirmed, now); + } + rcu_read_unlock_bh(); + } +diff --git a/include/net/neighbour.h b/include/net/neighbour.h +index b8452cc0e059..5e679c8dae0b 100644 +--- a/include/net/neighbour.h ++++ b/include/net/neighbour.h +@@ -72,7 +72,6 @@ struct neigh_parms { + struct net_device *dev; + struct list_head list; + int (*neigh_setup)(struct neighbour *); +- void (*neigh_cleanup)(struct neighbour *); + struct neigh_table *tbl; + + void *sysctl_table; +diff --git a/include/net/sock.h b/include/net/sock.h +index 718e62fbe869..013396e50b91 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1940,8 +1940,8 @@ struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie); + + static inline void sk_dst_confirm(struct sock *sk) + { +- if (!sk->sk_dst_pending_confirm) +- sk->sk_dst_pending_confirm = 1; ++ if (!READ_ONCE(sk->sk_dst_pending_confirm)) ++ WRITE_ONCE(sk->sk_dst_pending_confirm, 1); + } + + static inline void sock_confirm_neigh(struct sk_buff *skb, struct neighbour *n) +@@ -1951,10 +1951,10 @@ static inline void sock_confirm_neigh(struct sk_buff *skb, struct neighbour *n) + unsigned long now = jiffies; + + /* avoid dirtying neighbour */ +- if (n->confirmed != now) +- n->confirmed = now; +- if (sk && sk->sk_dst_pending_confirm) +- sk->sk_dst_pending_confirm = 0; ++ if (READ_ONCE(n->confirmed) != now) ++ WRITE_ONCE(n->confirmed, now); ++ if (sk && READ_ONCE(sk->sk_dst_pending_confirm)) ++ WRITE_ONCE(sk->sk_dst_pending_confirm, 0); + } + } + +diff --git a/include/trace/events/wbt.h b/include/trace/events/wbt.h +index b048694070e2..37342a13c9cb 100644 +--- a/include/trace/events/wbt.h ++++ b/include/trace/events/wbt.h +@@ -33,7 +33,8 @@ TRACE_EVENT(wbt_stat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->rmean = stat[0].mean; + __entry->rmin = stat[0].min; + __entry->rmax = stat[0].max; +@@ -67,7 +68,8 @@ TRACE_EVENT(wbt_lat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->lat = div_u64(lat, 1000); + ), + +@@ -103,7 +105,8 @@ TRACE_EVENT(wbt_step, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->msg = msg; + __entry->step = step; + __entry->window = div_u64(window, 1000); +@@ -138,7 +141,8 @@ TRACE_EVENT(wbt_timer, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->status = status; + __entry->step = step; + __entry->inflight = inflight; +diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h +index 8997d5068c08..4511b85c84df 100644 +--- a/include/uapi/linux/cec-funcs.h ++++ b/include/uapi/linux/cec-funcs.h +@@ -923,7 +923,8 @@ static inline void cec_msg_give_deck_status(struct cec_msg *msg, + msg->len = 3; + msg->msg[1] = CEC_MSG_GIVE_DECK_STATUS; + msg->msg[2] = status_req; +- msg->reply = reply ? CEC_MSG_DECK_STATUS : 0; ++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? ++ CEC_MSG_DECK_STATUS : 0; + } + + static inline void cec_ops_give_deck_status(const struct cec_msg *msg, +@@ -1027,7 +1028,8 @@ static inline void cec_msg_give_tuner_device_status(struct cec_msg *msg, + msg->len = 3; + msg->msg[1] = CEC_MSG_GIVE_TUNER_DEVICE_STATUS; + msg->msg[2] = status_req; +- msg->reply = reply ? CEC_MSG_TUNER_DEVICE_STATUS : 0; ++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? ++ CEC_MSG_TUNER_DEVICE_STATUS : 0; + } + + static inline void cec_ops_give_tuner_device_status(const struct cec_msg *msg, +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 052580c33d26..173e983619d7 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -287,7 +287,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + bool irq_work_busy = false; + struct stack_map_irq_work *work = NULL; + +- if (in_nmi()) { ++ if (irqs_disabled()) { + work = this_cpu_ptr(&up_read_work); + if (work->irq_work.flags & IRQ_WORK_BUSY) + /* cannot queue more up_read, fallback */ +@@ -295,8 +295,9 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + } + + /* +- * We cannot do up_read() in nmi context. To do build_id lookup +- * in nmi context, we need to run up_read() in irq_work. We use ++ * We cannot do up_read() when the irq is disabled, because of ++ * risk to deadlock with rq_lock. To do build_id lookup when the ++ * irqs are disabled, we need to run up_read() in irq_work. We use + * a percpu variable to do the irq_work. If the irq_work is + * already used by another lookup, we fall back to report ips. + * +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index ffc3e53f5300..9e7cee5307e0 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -978,6 +978,17 @@ static void __reg_bound_offset(struct bpf_reg_state *reg) + reg->umax_value)); + } + ++static void __reg_bound_offset32(struct bpf_reg_state *reg) ++{ ++ u64 mask = 0xffffFFFF; ++ struct tnum range = tnum_range(reg->umin_value & mask, ++ reg->umax_value & mask); ++ struct tnum lo32 = tnum_cast(reg->var_off, 4); ++ struct tnum hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32); ++ ++ reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range)); ++} ++ + /* Reset the min/max bounds of a register */ + static void __mark_reg_unbounded(struct bpf_reg_state *reg) + { +@@ -5433,6 +5444,10 @@ static void reg_set_min_max(struct bpf_reg_state *true_reg, + /* We might have learned some bits from the bounds. */ + __reg_bound_offset(false_reg); + __reg_bound_offset(true_reg); ++ if (is_jmp32) { ++ __reg_bound_offset32(false_reg); ++ __reg_bound_offset32(true_reg); ++ } + /* Intersecting with the old var_off might have improved our bounds + * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), + * then new var_off is (0; 0x7f...fc) which improves our umax. +@@ -5542,6 +5557,10 @@ static void reg_set_min_max_inv(struct bpf_reg_state *true_reg, + /* We might have learned some bits from the bounds. */ + __reg_bound_offset(false_reg); + __reg_bound_offset(true_reg); ++ if (is_jmp32) { ++ __reg_bound_offset32(false_reg); ++ __reg_bound_offset32(true_reg); ++ } + /* Intersecting with the old var_off might have improved our bounds + * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), + * then new var_off is (0; 0x7f...fc) which improves our umax. +diff --git a/kernel/cgroup/freezer.c b/kernel/cgroup/freezer.c +index 8cf010680678..3984dd6b8ddb 100644 +--- a/kernel/cgroup/freezer.c ++++ b/kernel/cgroup/freezer.c +@@ -230,6 +230,15 @@ void cgroup_freezer_migrate_task(struct task_struct *task, + if (task->flags & PF_KTHREAD) + return; + ++ /* ++ * It's not necessary to do changes if both of the src and dst cgroups ++ * are not freezing and task is not frozen. ++ */ ++ if (!test_bit(CGRP_FREEZE, &src->flags) && ++ !test_bit(CGRP_FREEZE, &dst->flags) && ++ !task->frozen) ++ return; ++ + /* + * Adjust counters of freezing and frozen tasks. + * Note, that if the task is frozen, but the destination cgroup is not +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 00a014670ed0..8f66a4833ded 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5607,10 +5607,8 @@ static void perf_mmap_close(struct vm_area_struct *vma) + perf_pmu_output_stop(event); + + /* now it's safe to free the pages */ +- if (!rb->aux_mmap_locked) +- atomic_long_sub(rb->aux_nr_pages, &mmap_user->locked_vm); +- else +- atomic64_sub(rb->aux_mmap_locked, &vma->vm_mm->pinned_vm); ++ atomic_long_sub(rb->aux_nr_pages - rb->aux_mmap_locked, &mmap_user->locked_vm); ++ atomic64_sub(rb->aux_mmap_locked, &vma->vm_mm->pinned_vm); + + /* this has to be the last one */ + rb_free_aux(rb); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 44123b4d14e8..8dacda4b0362 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -810,7 +810,7 @@ static inline unsigned int uclamp_bucket_base_value(unsigned int clamp_value) + return UCLAMP_BUCKET_DELTA * uclamp_bucket_id(clamp_value); + } + +-static inline enum uclamp_id uclamp_none(enum uclamp_id clamp_id) ++static inline unsigned int uclamp_none(enum uclamp_id clamp_id) + { + if (clamp_id == UCLAMP_MIN) + return 0; +@@ -853,7 +853,7 @@ static inline void uclamp_idle_reset(struct rq *rq, enum uclamp_id clamp_id, + } + + static inline +-enum uclamp_id uclamp_rq_max_value(struct rq *rq, enum uclamp_id clamp_id, ++unsigned int uclamp_rq_max_value(struct rq *rq, enum uclamp_id clamp_id, + unsigned int clamp_value) + { + struct uclamp_bucket *bucket = rq->uclamp[clamp_id].bucket; +@@ -918,7 +918,7 @@ uclamp_eff_get(struct task_struct *p, enum uclamp_id clamp_id) + return uc_req; + } + +-enum uclamp_id uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id) ++unsigned int uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id) + { + struct uclamp_se uc_eff; + +diff --git a/kernel/sched/cpufreq.c b/kernel/sched/cpufreq.c +index b5dcd1d83c7f..7c2fe50fd76d 100644 +--- a/kernel/sched/cpufreq.c ++++ b/kernel/sched/cpufreq.c +@@ -5,6 +5,8 @@ + * Copyright (C) 2016, Intel Corporation + * Author: Rafael J. Wysocki + */ ++#include ++ + #include "sched.h" + + DEFINE_PER_CPU(struct update_util_data __rcu *, cpufreq_update_util_data); +@@ -57,3 +59,19 @@ void cpufreq_remove_update_util_hook(int cpu) + rcu_assign_pointer(per_cpu(cpufreq_update_util_data, cpu), NULL); + } + EXPORT_SYMBOL_GPL(cpufreq_remove_update_util_hook); ++ ++/** ++ * cpufreq_this_cpu_can_update - Check if cpufreq policy can be updated. ++ * @policy: cpufreq policy to check. ++ * ++ * Return 'true' if: ++ * - the local and remote CPUs share @policy, ++ * - dvfs_possible_from_any_cpu is set in @policy and the local CPU is not going ++ * offline (in which case it is not expected to run cpufreq updates any more). ++ */ ++bool cpufreq_this_cpu_can_update(struct cpufreq_policy *policy) ++{ ++ return cpumask_test_cpu(smp_processor_id(), policy->cpus) || ++ (policy->dvfs_possible_from_any_cpu && ++ rcu_dereference_sched(*this_cpu_ptr(&cpufreq_update_util_data))); ++} +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index 86800b4d5453..b6f56e7c8dd1 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -82,12 +82,10 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) + * by the hardware, as calculating the frequency is pointless if + * we cannot in fact act on it. + * +- * For the slow switching platforms, the kthread is always scheduled on +- * the right set of CPUs and any CPU can find the next frequency and +- * schedule the kthread. ++ * This is needed on the slow switching platforms too to prevent CPUs ++ * going offline from leaving stale IRQ work items behind. + */ +- if (sg_policy->policy->fast_switch_enabled && +- !cpufreq_this_cpu_can_update(sg_policy->policy)) ++ if (!cpufreq_this_cpu_can_update(sg_policy->policy)) + return false; + + if (unlikely(sg_policy->limits_changed)) { +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index c8870c5bd7df..49ed949f850c 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -2309,7 +2309,7 @@ static inline void cpufreq_update_util(struct rq *rq, unsigned int flags) {} + #endif /* CONFIG_CPU_FREQ */ + + #ifdef CONFIG_UCLAMP_TASK +-enum uclamp_id uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id); ++unsigned int uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id); + + static __always_inline + unsigned int uclamp_util_with(struct rq *rq, unsigned int util, +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 6a0ee9178365..2fa72419bbd7 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4609,7 +4609,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) + + if (mask == TRACE_ITER_RECORD_TGID) { + if (!tgid_map) +- tgid_map = kcalloc(PID_MAX_DEFAULT + 1, ++ tgid_map = kvcalloc(PID_MAX_DEFAULT + 1, + sizeof(*tgid_map), + GFP_KERNEL); + if (!tgid_map) { +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 1552a95c743b..7f890262c8a3 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -435,11 +435,10 @@ static int disable_trace_kprobe(struct trace_event_call *call, + + #if defined(CONFIG_KPROBES_ON_FTRACE) && \ + !defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE) +-static bool within_notrace_func(struct trace_kprobe *tk) ++static bool __within_notrace_func(unsigned long addr) + { +- unsigned long offset, size, addr; ++ unsigned long offset, size; + +- addr = trace_kprobe_address(tk); + if (!addr || !kallsyms_lookup_size_offset(addr, &size, &offset)) + return false; + +@@ -452,6 +451,28 @@ static bool within_notrace_func(struct trace_kprobe *tk) + */ + return !ftrace_location_range(addr, addr + size - 1); + } ++ ++static bool within_notrace_func(struct trace_kprobe *tk) ++{ ++ unsigned long addr = addr = trace_kprobe_address(tk); ++ char symname[KSYM_NAME_LEN], *p; ++ ++ if (!__within_notrace_func(addr)) ++ return false; ++ ++ /* Check if the address is on a suffixed-symbol */ ++ if (!lookup_symbol_name(addr, symname)) { ++ p = strchr(symname, '.'); ++ if (!p) ++ return true; ++ *p = '\0'; ++ addr = (unsigned long)kprobe_lookup_name(symname, 0); ++ if (addr) ++ return __within_notrace_func(addr); ++ } ++ ++ return true; ++} + #else + #define within_notrace_func(tk) (false) + #endif +diff --git a/lib/ubsan.c b/lib/ubsan.c +index e7d31735950d..0c4681118fcd 100644 +--- a/lib/ubsan.c ++++ b/lib/ubsan.c +@@ -374,9 +374,10 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + struct type_descriptor *lhs_type = data->lhs_type; + char rhs_str[VALUE_LENGTH]; + char lhs_str[VALUE_LENGTH]; ++ unsigned long ua_flags = user_access_save(); + + if (suppress_report(&data->location)) +- return; ++ goto out; + + ubsan_prologue(&data->location, &flags); + +@@ -402,6 +403,8 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + lhs_type->type_name); + + ubsan_epilogue(&flags); ++out: ++ user_access_restore(ua_flags); + } + EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); + +diff --git a/mm/vmscan.c b/mm/vmscan.c +index ee4eecc7e1c2..e7f10c4b40f0 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -422,7 +422,7 @@ void register_shrinker_prepared(struct shrinker *shrinker) + { + down_write(&shrinker_rwsem); + list_add_tail(&shrinker->list, &shrinker_list); +-#ifdef CONFIG_MEMCG_KMEM ++#ifdef CONFIG_MEMCG + if (shrinker->flags & SHRINKER_MEMCG_AWARE) + idr_replace(&shrinker_idr, shrinker, shrinker->id); + #endif +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index ad5b0ac1f9ce..7ff92dd4c53c 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -934,6 +934,14 @@ static void hci_req_directed_advertising(struct hci_request *req, + return; + + memset(&cp, 0, sizeof(cp)); ++ ++ /* Some controllers might reject command if intervals are not ++ * within range for undirected advertising. ++ * BCM20702A0 is known to be affected by this. ++ */ ++ cp.min_interval = cpu_to_le16(0x0020); ++ cp.max_interval = cpu_to_le16(0x0020); ++ + cp.type = LE_ADV_DIRECT_IND; + cp.own_address_type = own_addr_type; + cp.direct_addr_type = conn->dst_type; +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 04bc79359a17..0cc9ce917222 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -842,8 +842,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt) + if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) { + struct hci_cp_le_write_def_data_len cp; + +- cp.tx_len = hdev->le_max_tx_len; +- cp.tx_time = hdev->le_max_tx_time; ++ cp.tx_len = cpu_to_le16(hdev->le_max_tx_len); ++ cp.tx_time = cpu_to_le16(hdev->le_max_tx_time); + hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp); + } + +@@ -4440,7 +4440,14 @@ static void hci_rx_work(struct work_struct *work) + hci_send_to_sock(hdev, skb); + } + +- if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { ++ /* If the device has been opened in HCI_USER_CHANNEL, ++ * the userspace has exclusive access to device. ++ * When device is HCI_INIT, we still need to process ++ * the data packets to the driver in order ++ * to complete its setup(). ++ */ ++ if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && ++ !test_bit(HCI_INIT, &hdev->flags)) { + kfree_skb(skb); + continue; + } +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 7f6a581b5b7e..3d25dbf10b26 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -1273,6 +1273,14 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + + instance_flags = get_adv_instance_flags(hdev, instance); + ++ /* If instance already has the flags set skip adding it once ++ * again. ++ */ ++ if (adv_instance && eir_get_data(adv_instance->adv_data, ++ adv_instance->adv_data_len, EIR_FLAGS, ++ NULL)) ++ goto skip_flags; ++ + /* The Add Advertising command allows userspace to set both the general + * and limited discoverable flags. + */ +@@ -1305,6 +1313,7 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + } + } + ++skip_flags: + if (adv_instance) { + memcpy(ptr, adv_instance->adv_data, + adv_instance->adv_data_len); +diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c +index de09b0a65791..f7587428febd 100644 +--- a/net/can/j1939/socket.c ++++ b/net/can/j1939/socket.c +@@ -423,9 +423,9 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) + { + struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; + struct j1939_sock *jsk = j1939_sk(sock->sk); +- struct j1939_priv *priv = jsk->priv; +- struct sock *sk = sock->sk; +- struct net *net = sock_net(sk); ++ struct j1939_priv *priv; ++ struct sock *sk; ++ struct net *net; + int ret = 0; + + ret = j1939_sk_sanity_check(addr, len); +@@ -434,6 +434,10 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) + + lock_sock(sock->sk); + ++ priv = jsk->priv; ++ sk = sock->sk; ++ net = sock_net(sk); ++ + /* Already bound to an interface? */ + if (jsk->state & J1939_SOCK_BOUND) { + /* A re-bind() to a different interface is not +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 5480edff0c86..08ebc3ac5343 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -98,9 +98,6 @@ static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb) + + static void neigh_cleanup_and_release(struct neighbour *neigh) + { +- if (neigh->parms->neigh_cleanup) +- neigh->parms->neigh_cleanup(neigh); +- + trace_neigh_cleanup_and_release(neigh, 0); + __neigh_notify(neigh, RTM_DELNEIGH, 0, 0); + call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh); +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index ae3bcb1540ec..b4db68e5caa9 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -919,14 +919,17 @@ static int rx_queue_add_kobject(struct net_device *dev, int index) + struct kobject *kobj = &queue->kobj; + int error = 0; + ++ /* Kobject_put later will trigger rx_queue_release call which ++ * decreases dev refcount: Take that reference here ++ */ ++ dev_hold(queue->dev); ++ + kobj->kset = dev->queues_kset; + error = kobject_init_and_add(kobj, &rx_queue_ktype, NULL, + "rx-%u", index); + if (error) + goto err; + +- dev_hold(queue->dev); +- + if (dev->sysfs_rx_queue_group) { + error = sysfs_create_group(kobj, dev->sysfs_rx_queue_group); + if (error) +diff --git a/net/mac80211/status.c b/net/mac80211/status.c +index ab8ba5835ca0..5a3d645fe1bc 100644 +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -1030,7 +1030,8 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw, + I802_DEBUG_INC(local->dot11FailedCount); + } + +- if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) && ++ if ((ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) && ++ ieee80211_has_pm(fc) && + ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) && + !(info->flags & IEEE80211_TX_CTL_INJECTED) && + local->ps_sdata && !(local->scanning)) { +diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c +index 78fe622eba65..11b554ce07ff 100644 +--- a/net/nfc/nci/uart.c ++++ b/net/nfc/nci/uart.c +@@ -346,7 +346,7 @@ static int nci_uart_default_recv_buf(struct nci_uart *nu, const u8 *data, + nu->rx_packet_len = -1; + nu->rx_skb = nci_skb_alloc(nu->ndev, + NCI_MAX_PACKET_SIZE, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!nu->rx_skb) + return -ENOMEM; + } +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 82a50e850245..529d4ce945db 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -544,7 +544,8 @@ static int prb_calc_retire_blk_tmo(struct packet_sock *po, + msec = 1; + div = ecmd.base.speed / 1000; + } +- } ++ } else ++ return DEFAULT_PRB_RETIRE_TOV; + + mbits = (blk_size_in_bytes * 8) / (1024 * 1024); + +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index 08d14d86ecfb..681ffb3545db 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -227,6 +227,7 @@ static void sctp_v4_from_skb(union sctp_addr *addr, struct sk_buff *skb, + sa->sin_port = sh->dest; + sa->sin_addr.s_addr = ip_hdr(skb)->daddr; + } ++ memset(sa->sin_zero, 0, sizeof(sa->sin_zero)); + } + + /* Initialize an sctp_addr from a socket. */ +@@ -235,6 +236,7 @@ static void sctp_v4_from_sk(union sctp_addr *addr, struct sock *sk) + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = 0; + addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize sk->sk_rcv_saddr from sctp_addr. */ +@@ -257,6 +259,7 @@ static void sctp_v4_from_addr_param(union sctp_addr *addr, + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = port; + addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize an address parameter from a sctp_addr and return the length +@@ -281,6 +284,7 @@ static void sctp_v4_dst_saddr(union sctp_addr *saddr, struct flowi4 *fl4, + saddr->v4.sin_family = AF_INET; + saddr->v4.sin_port = port; + saddr->v4.sin_addr.s_addr = fl4->saddr; ++ memset(saddr->v4.sin_zero, 0, sizeof(saddr->v4.sin_zero)); + } + + /* Compare two addresses exactly. */ +@@ -303,6 +307,7 @@ static void sctp_v4_inaddr_any(union sctp_addr *addr, __be16 port) + addr->v4.sin_family = AF_INET; + addr->v4.sin_addr.s_addr = htonl(INADDR_ANY); + addr->v4.sin_port = port; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Is this a wildcard address? */ +diff --git a/net/sctp/stream.c b/net/sctp/stream.c +index e83cdaa2ab76..6a30392068a0 100644 +--- a/net/sctp/stream.c ++++ b/net/sctp/stream.c +@@ -84,8 +84,10 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt, + return 0; + + ret = genradix_prealloc(&stream->out, outcnt, gfp); +- if (ret) ++ if (ret) { ++ genradix_free(&stream->out); + return ret; ++ } + + stream->outcnt = outcnt; + return 0; +@@ -100,8 +102,10 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt, + return 0; + + ret = genradix_prealloc(&stream->in, incnt, gfp); +- if (ret) ++ if (ret) { ++ genradix_free(&stream->in); + return ret; ++ } + + stream->incnt = incnt; + return 0; +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 2ba97ff325a5..0c5fcb8ed404 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -231,10 +231,12 @@ static int smc_lgr_create(struct smc_sock *smc, struct smc_init_info *ini) + lgr->conns_all = RB_ROOT; + if (ini->is_smcd) { + /* SMC-D specific settings */ ++ get_device(&ini->ism_dev->dev); + lgr->peer_gid = ini->ism_gid; + lgr->smcd = ini->ism_dev; + } else { + /* SMC-R specific settings */ ++ get_device(&ini->ib_dev->ibdev->dev); + lgr->role = smc->listen_smc ? SMC_SERV : SMC_CLNT; + memcpy(lgr->peer_systemid, ini->ib_lcl->id_for_peer, + SMC_SYSTEMID_LEN); +@@ -433,10 +435,13 @@ static void smc_lgr_free_bufs(struct smc_link_group *lgr) + static void smc_lgr_free(struct smc_link_group *lgr) + { + smc_lgr_free_bufs(lgr); +- if (lgr->is_smcd) ++ if (lgr->is_smcd) { + smc_ism_put_vlan(lgr->smcd, lgr->vlan_id); +- else ++ put_device(&lgr->smcd->dev); ++ } else { + smc_link_clear(&lgr->lnk[SMC_SINGLE_LINK]); ++ put_device(&lgr->lnk[SMC_SINGLE_LINK].smcibdev->ibdev->dev); ++ } + kfree(lgr); + } + +diff --git a/samples/pktgen/functions.sh b/samples/pktgen/functions.sh +index 4af4046d71be..40873a5d1461 100644 +--- a/samples/pktgen/functions.sh ++++ b/samples/pktgen/functions.sh +@@ -5,6 +5,8 @@ + # Author: Jesper Dangaaard Brouer + # License: GPL + ++set -o errexit ++ + ## -- General shell logging cmds -- + function err() { + local exitcode=$1 +@@ -58,6 +60,7 @@ function pg_set() { + function proc_cmd() { + local result + local proc_file=$1 ++ local status=0 + # after shift, the remaining args are contained in $@ + shift + local proc_ctrl=${PROC_DIR}/$proc_file +@@ -73,13 +76,13 @@ function proc_cmd() { + echo "cmd: $@ > $proc_ctrl" + fi + # Quoting of "$@" is important for space expansion +- echo "$@" > "$proc_ctrl" +- local status=$? ++ echo "$@" > "$proc_ctrl" || status=$? + +- result=$(grep "Result: OK:" $proc_ctrl) +- # Due to pgctrl, cannot use exit code $? from grep +- if [[ "$result" == "" ]]; then +- grep "Result:" $proc_ctrl >&2 ++ if [[ "$proc_file" != "pgctrl" ]]; then ++ result=$(grep "Result: OK:" $proc_ctrl) || true ++ if [[ "$result" == "" ]]; then ++ grep "Result:" $proc_ctrl >&2 ++ fi + fi + if (( $status != 0 )); then + err 5 "Write error($status) occurred cmd: \"$@ > $proc_ctrl\"" +@@ -105,6 +108,8 @@ function pgset() { + fi + } + ++[[ $EUID -eq 0 ]] && trap 'pg_ctrl "reset"' EXIT ++ + ## -- General shell tricks -- + + function root_check_run_with_sudo() { +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 91c6ad58729f..d4280568a41e 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -222,7 +222,8 @@ static bool hw_support_mmap(struct snd_pcm_substream *substream) + return false; + + if (substream->ops->mmap || +- substream->dma_buffer.dev.type != SNDRV_DMA_TYPE_DEV) ++ (substream->dma_buffer.dev.type != SNDRV_DMA_TYPE_DEV && ++ substream->dma_buffer.dev.type != SNDRV_DMA_TYPE_DEV_UC)) + return true; + + return dma_can_mmap(substream->dma_buffer.dev.dev); +@@ -705,6 +706,10 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, + while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size) + runtime->boundary *= 2; + ++ /* clear the buffer for avoiding possible kernel info leaks */ ++ if (runtime->dma_area && !substream->ops->copy_user) ++ memset(runtime->dma_area, 0, runtime->dma_bytes); ++ + snd_pcm_timer_resolution_change(substream); + snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP); + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 59ae21b0bb93..013f0e69ff0f 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -74,6 +74,9 @@ static LIST_HEAD(snd_timer_slave_list); + /* lock for slave active lists */ + static DEFINE_SPINLOCK(slave_active_lock); + ++#define MAX_SLAVE_INSTANCES 1000 ++static int num_slaves; ++ + static DEFINE_MUTEX(register_mutex); + + static int snd_timer_free(struct snd_timer *timer); +@@ -252,6 +255,10 @@ int snd_timer_open(struct snd_timer_instance **ti, + err = -EINVAL; + goto unlock; + } ++ if (num_slaves >= MAX_SLAVE_INSTANCES) { ++ err = -EBUSY; ++ goto unlock; ++ } + timeri = snd_timer_instance_new(owner, NULL); + if (!timeri) { + err = -ENOMEM; +@@ -261,6 +268,7 @@ int snd_timer_open(struct snd_timer_instance **ti, + timeri->slave_id = tid->device; + timeri->flags |= SNDRV_TIMER_IFLG_SLAVE; + list_add_tail(&timeri->open_list, &snd_timer_slave_list); ++ num_slaves++; + err = snd_timer_check_slave(timeri); + if (err < 0) { + snd_timer_close_locked(timeri, &card_dev_to_put); +@@ -356,6 +364,8 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri, + } + + list_del(&timeri->open_list); ++ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) ++ num_slaves--; + + /* force to stop the timer */ + snd_timer_stop(timeri); +diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c +index 6c1497d9f52b..ce07ea0d4e71 100644 +--- a/sound/firewire/bebob/bebob_stream.c ++++ b/sound/firewire/bebob/bebob_stream.c +@@ -415,15 +415,16 @@ static int make_both_connections(struct snd_bebob *bebob) + return 0; + } + +-static void +-break_both_connections(struct snd_bebob *bebob) ++static void break_both_connections(struct snd_bebob *bebob) + { + cmp_connection_break(&bebob->in_conn); + cmp_connection_break(&bebob->out_conn); + +- /* These models seems to be in transition state for a longer time. */ +- if (bebob->maudio_special_quirk != NULL) +- msleep(200); ++ // These models seem to be in transition state for a longer time. When ++ // accessing in the state, any transactions is corrupted. In the worst ++ // case, the device is going to reboot. ++ if (bebob->version < 2) ++ msleep(600); + } + + static int +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index b7a1abb3e231..32ed46464af7 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -1809,13 +1809,14 @@ struct scp_msg { + + static void dspio_clear_response_queue(struct hda_codec *codec) + { ++ unsigned long timeout = jiffies + msecs_to_jiffies(1000); + unsigned int dummy = 0; +- int status = -1; ++ int status; + + /* clear all from the response queue */ + do { + status = dspio_read(codec, &dummy); +- } while (status == 0); ++ } while (status == 0 && time_before(jiffies, timeout)); + } + + static int dspio_get_response_data(struct hda_codec *codec) +@@ -7588,12 +7589,14 @@ static void ca0132_process_dsp_response(struct hda_codec *codec, + struct ca0132_spec *spec = codec->spec; + + codec_dbg(codec, "ca0132_process_dsp_response\n"); ++ snd_hda_power_up_pm(codec); + if (spec->wait_scp) { + if (dspio_get_response_data(codec) >= 0) + spec->wait_scp = 0; + } + + dspio_clear_response_queue(codec); ++ snd_hda_power_down_pm(codec); + } + + static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb) +@@ -7604,11 +7607,10 @@ static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb) + /* Delay enabling the HP amp, to let the mic-detection + * state machine run. + */ +- cancel_delayed_work(&spec->unsol_hp_work); +- schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500)); + tbl = snd_hda_jack_tbl_get(codec, cb->nid); + if (tbl) + tbl->block_report = 1; ++ schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500)); + } + + static void amic_callback(struct hda_codec *codec, struct hda_jack_callback *cb) +@@ -8454,12 +8456,25 @@ static void ca0132_reboot_notify(struct hda_codec *codec) + codec->patch_ops.free(codec); + } + ++#ifdef CONFIG_PM ++static int ca0132_suspend(struct hda_codec *codec) ++{ ++ struct ca0132_spec *spec = codec->spec; ++ ++ cancel_delayed_work_sync(&spec->unsol_hp_work); ++ return 0; ++} ++#endif ++ + static const struct hda_codec_ops ca0132_patch_ops = { + .build_controls = ca0132_build_controls, + .build_pcms = ca0132_build_pcms, + .init = ca0132_init, + .free = ca0132_free, + .unsol_event = snd_hda_jack_unsol_event, ++#ifdef CONFIG_PM ++ .suspend = ca0132_suspend, ++#endif + .reboot_notify = ca0132_reboot_notify, + }; + +diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c +index 315a3d39bc09..8bc9450da79c 100644 +--- a/sound/soc/codecs/rt5677.c ++++ b/sound/soc/codecs/rt5677.c +@@ -298,6 +298,7 @@ static bool rt5677_volatile_register(struct device *dev, unsigned int reg) + case RT5677_I2C_MASTER_CTRL7: + case RT5677_I2C_MASTER_CTRL8: + case RT5677_HAP_GENE_CTRL2: ++ case RT5677_PWR_ANLG2: /* Modified by DSP firmware */ + case RT5677_PWR_DSP_ST: + case RT5677_PRIV_DATA: + case RT5677_ASRC_22: +diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c +index cf64e109c658..7b087d94141b 100644 +--- a/sound/soc/codecs/wm2200.c ++++ b/sound/soc/codecs/wm2200.c +@@ -2410,6 +2410,8 @@ static int wm2200_i2c_probe(struct i2c_client *i2c, + + err_pm_runtime: + pm_runtime_disable(&i2c->dev); ++ if (i2c->irq) ++ free_irq(i2c->irq, wm2200); + err_reset: + if (wm2200->pdata.reset) + gpio_set_value_cansleep(wm2200->pdata.reset, 0); +@@ -2426,12 +2428,15 @@ static int wm2200_i2c_remove(struct i2c_client *i2c) + { + struct wm2200_priv *wm2200 = i2c_get_clientdata(i2c); + ++ pm_runtime_disable(&i2c->dev); + if (i2c->irq) + free_irq(i2c->irq, wm2200); + if (wm2200->pdata.reset) + gpio_set_value_cansleep(wm2200->pdata.reset, 0); + if (wm2200->pdata.ldo_ena) + gpio_set_value_cansleep(wm2200->pdata.ldo_ena, 0); ++ regulator_bulk_disable(ARRAY_SIZE(wm2200->core_supplies), ++ wm2200->core_supplies); + + return 0; + } +diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c +index 4af0e519e623..91cc63c5a51f 100644 +--- a/sound/soc/codecs/wm5100.c ++++ b/sound/soc/codecs/wm5100.c +@@ -2617,6 +2617,7 @@ static int wm5100_i2c_probe(struct i2c_client *i2c, + return ret; + + err_reset: ++ pm_runtime_disable(&i2c->dev); + if (i2c->irq) + free_irq(i2c->irq, wm5100); + wm5100_free_gpio(i2c); +@@ -2640,6 +2641,7 @@ static int wm5100_i2c_remove(struct i2c_client *i2c) + { + struct wm5100_priv *wm5100 = i2c_get_clientdata(i2c); + ++ pm_runtime_disable(&i2c->dev); + if (i2c->irq) + free_irq(i2c->irq, wm5100); + wm5100_free_gpio(i2c); +diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c +index bcb3c9d5abf0..9e8c564f6e9c 100644 +--- a/sound/soc/codecs/wm8904.c ++++ b/sound/soc/codecs/wm8904.c +@@ -1917,6 +1917,7 @@ static int wm8904_set_bias_level(struct snd_soc_component *component, + snd_soc_component_update_bits(component, WM8904_BIAS_CONTROL_0, + WM8904_BIAS_ENA, 0); + ++ snd_soc_component_write(component, WM8904_SW_RESET_AND_ID, 0); + regcache_cache_only(wm8904->regmap, true); + regcache_mark_dirty(wm8904->regmap); + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 9c1aa4ec9cba..dd2b5ad08659 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -405,10 +405,12 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"), + }, +- .driver_data = (void *)(BYT_RT5640_IN1_MAP | +- BYT_RT5640_MCLK_EN | +- BYT_RT5640_SSP0_AIF1), +- ++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), + }, + { + .matches = { +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index 74dda8784f1a..67b276a65a8d 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -400,6 +400,9 @@ static int kabylake_dmic_startup(struct snd_pcm_substream *substream) + snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS, + dmic_constraints); + ++ runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16); ++ + return snd_pcm_hw_constraint_list(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_RATE, &constraints_rates); + } +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index b600d3eaaf5c..a6e96cf1d8ff 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -877,6 +877,11 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream, + int i, ret = 0; + + mutex_lock_nested(&rtd->card->pcm_mutex, rtd->card->pcm_subclass); ++ ++ ret = soc_pcm_params_symmetry(substream, params); ++ if (ret) ++ goto out; ++ + if (rtd->dai_link->ops->hw_params) { + ret = rtd->dai_link->ops->hw_params(substream, params); + if (ret < 0) { +@@ -958,9 +963,6 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream, + } + component = NULL; + +- ret = soc_pcm_params_symmetry(substream, params); +- if (ret) +- goto component_err; + out: + mutex_unlock(&rtd->card->pcm_mutex); + return ret; +@@ -1385,6 +1387,7 @@ static int dpcm_prune_paths(struct snd_soc_pcm_runtime *fe, int stream, + struct snd_soc_dapm_widget *widget; + struct snd_soc_dai *dai; + int prune = 0; ++ int do_prune; + + /* Destroy any old FE <--> BE connections */ + for_each_dpcm_be(fe, stream, dpcm) { +@@ -1398,13 +1401,16 @@ static int dpcm_prune_paths(struct snd_soc_pcm_runtime *fe, int stream, + continue; + + /* is there a valid CODEC DAI widget for this BE */ ++ do_prune = 1; + for_each_rtd_codec_dai(dpcm->be, i, dai) { + widget = dai_get_widget(dai, stream); + + /* prune the BE if it's no longer in our active list */ + if (widget && widget_in_list(list, widget)) +- continue; ++ do_prune = 0; + } ++ if (!do_prune) ++ continue; + + dev_dbg(fe->dev, "ASoC: pruning %s BE %s for %s\n", + stream ? "capture" : "playback", +diff --git a/sound/soc/sof/imx/Kconfig b/sound/soc/sof/imx/Kconfig +index 5acae75f5750..71f318bc2c74 100644 +--- a/sound/soc/sof/imx/Kconfig ++++ b/sound/soc/sof/imx/Kconfig +@@ -11,8 +11,8 @@ config SND_SOC_SOF_IMX_TOPLEVEL + + if SND_SOC_SOF_IMX_TOPLEVEL + +-config SND_SOC_SOF_IMX8 +- tristate "SOF support for i.MX8" ++config SND_SOC_SOF_IMX8_SUPPORT ++ bool "SOF support for i.MX8" + depends on IMX_SCU + depends on IMX_DSP + help +@@ -20,4 +20,8 @@ config SND_SOC_SOF_IMX8 + Say Y if you have such a device. + If unsure select "N". + ++config SND_SOC_SOF_IMX8 ++ def_tristate SND_SOC_SOF_OF ++ depends on SND_SOC_SOF_IMX8_SUPPORT ++ + endif ## SND_SOC_SOF_IMX_IMX_TOPLEVEL +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index 06e84679087b..5a5163eef2ef 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -268,6 +268,7 @@ static int hda_init(struct snd_sof_dev *sdev) + + bus->use_posbuf = 1; + bus->bdl_pos_adj = 0; ++ bus->sync_write = 1; + + mutex_init(&hbus->prepare_mutex); + hbus->pci = pci; +diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c +index 4452594c2e17..fa299e078156 100644 +--- a/sound/soc/sof/topology.c ++++ b/sound/soc/sof/topology.c +@@ -2828,6 +2828,10 @@ static int sof_link_load(struct snd_soc_component *scomp, int index, + if (!link->no_pcm) { + link->nonatomic = true; + ++ /* set trigger order */ ++ link->trigger[0] = SND_SOC_DPCM_TRIGGER_POST; ++ link->trigger[1] = SND_SOC_DPCM_TRIGGER_POST; ++ + /* nothing more to do for FE dai links */ + return 0; + } +diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/tools/arch/x86/lib/x86-opcode-map.txt ++++ b/tools/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile +index 5d1995fd369c..5535650800ab 100644 +--- a/tools/bpf/Makefile ++++ b/tools/bpf/Makefile +@@ -16,7 +16,13 @@ CFLAGS += -D__EXPORTED_HEADERS__ -I$(srctree)/include/uapi -I$(srctree)/include + # isn't set and when invoked from selftests build, where srctree + # is set to ".". building_out_of_srctree is undefined for in srctree + # builds ++ifeq ($(srctree),) ++update_srctree := 1 ++endif + ifndef building_out_of_srctree ++update_srctree := 1 ++endif ++ifeq ($(update_srctree),1) + srctree := $(patsubst %/,%,$(dir $(CURDIR))) + srctree := $(patsubst %/,%,$(dir $(srctree))) + endif +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index ede55fec3618..87f27e2664c5 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -876,7 +876,6 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + __u16 vlen = btf_vlen(t); + + packed = is_struct ? btf_is_struct_packed(d->btf, id, t) : 0; +- align = packed ? 1 : btf_align_of(d->btf, id); + + btf_dump_printf(d, "%s%s%s {", + is_struct ? "struct" : "union", +@@ -906,6 +905,13 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + btf_dump_printf(d, ";"); + } + ++ /* pad at the end, if necessary */ ++ if (is_struct) { ++ align = packed ? 1 : btf_align_of(d->btf, id); ++ btf_dump_emit_bit_padding(d, off, t->size * 8, 0, align, ++ lvl + 1); ++ } ++ + if (vlen) + btf_dump_printf(d, "\n"); + btf_dump_printf(d, "%s}", pfx(lvl)); +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index e0276520171b..a267cd0c0ce2 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1897,16 +1897,22 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd) + return -errno; + + new_fd = open("/", O_RDONLY | O_CLOEXEC); +- if (new_fd < 0) ++ if (new_fd < 0) { ++ err = -errno; + goto err_free_new_name; ++ } + + new_fd = dup3(fd, new_fd, O_CLOEXEC); +- if (new_fd < 0) ++ if (new_fd < 0) { ++ err = -errno; + goto err_close_new_fd; ++ } + + err = zclose(map->fd); +- if (err) ++ if (err) { ++ err = -errno; + goto err_close_new_fd; ++ } + free(map->name); + + map->fd = new_fd; +@@ -1925,7 +1931,7 @@ err_close_new_fd: + close(new_fd); + err_free_new_name: + free(new_name); +- return -errno; ++ return err; + } + + int bpf_map__resize(struct bpf_map *map, __u32 max_entries) +diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c +index a902838f9fcc..70f9e10de286 100644 +--- a/tools/lib/bpf/xsk.c ++++ b/tools/lib/bpf/xsk.c +@@ -163,6 +163,7 @@ int xsk_umem__create_v0_0_4(struct xsk_umem **umem_ptr, void *umem_area, + umem->umem_area = umem_area; + xsk_set_umem_config(&umem->config, usr_config); + ++ memset(&mr, 0, sizeof(mr)); + mr.addr = (uintptr_t)umem_area; + mr.len = size; + mr.chunk_size = umem->config.frame_size; +@@ -343,13 +344,18 @@ static int xsk_get_max_queues(struct xsk_socket *xsk) + goto out; + } + +- if (err || channels.max_combined == 0) ++ if (err) { + /* If the device says it has no channels, then all traffic + * is sent to a single stream, so max queues = 1. + */ + ret = 1; +- else +- ret = channels.max_combined; ++ } else { ++ /* Take the max of rx, tx, combined. Drivers return ++ * the number of channels in different ways. ++ */ ++ ret = max(channels.max_rx, channels.max_tx); ++ ret = max(ret, (int)channels.max_combined); ++ } + + out: + close(fd); +@@ -465,6 +471,8 @@ static int xsk_setup_xdp_prog(struct xsk_socket *xsk) + } + } else { + xsk->prog_fd = bpf_prog_get_fd_by_id(prog_id); ++ if (xsk->prog_fd < 0) ++ return -errno; + err = xsk_lookup_bpf_maps(xsk); + if (err) { + close(xsk->prog_fd); +diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile +index 5b2cd5e58df0..5dbb0dde208c 100644 +--- a/tools/lib/subcmd/Makefile ++++ b/tools/lib/subcmd/Makefile +@@ -28,7 +28,9 @@ ifeq ($(DEBUG),0) + endif + endif + +-ifeq ($(CC_NO_CLANG), 0) ++ifeq ($(DEBUG),1) ++ CFLAGS += -O0 ++else ifeq ($(CC_NO_CLANG), 0) + CFLAGS += -O3 + else + CFLAGS += -O6 +diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c +index 552592d153fb..f3cbf86e51ac 100644 +--- a/tools/lib/traceevent/parse-filter.c ++++ b/tools/lib/traceevent/parse-filter.c +@@ -1473,8 +1473,10 @@ static int copy_filter_type(struct tep_event_filter *filter, + if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) { + /* Add trivial event */ + arg = allocate_arg(); +- if (arg == NULL) ++ if (arg == NULL) { ++ free(str); + return -1; ++ } + + arg->type = TEP_FILTER_ARG_BOOLEAN; + if (strcmp(str, "TRUE") == 0) +@@ -1483,8 +1485,11 @@ static int copy_filter_type(struct tep_event_filter *filter, + arg->boolean.value = 0; + + filter_type = add_filter_type(filter, event->id); +- if (filter_type == NULL) ++ if (filter_type == NULL) { ++ free(str); ++ free_arg(arg); + return -1; ++ } + + filter_type->filter = arg; + +diff --git a/tools/memory-model/linux-kernel.cat b/tools/memory-model/linux-kernel.cat +index ea2ff4b94074..2a9b4fe4a84e 100644 +--- a/tools/memory-model/linux-kernel.cat ++++ b/tools/memory-model/linux-kernel.cat +@@ -197,7 +197,7 @@ empty (wr-incoh | rw-incoh | ww-incoh) as plain-coherence + (* Actual races *) + let ww-nonrace = ww-vis & ((Marked * W) | rw-xbstar) & ((W * Marked) | wr-vis) + let ww-race = (pre-race & co) \ ww-nonrace +-let wr-race = (pre-race & (co? ; rf)) \ wr-vis ++let wr-race = (pre-race & (co? ; rf)) \ wr-vis \ rw-xbstar^-1 + let rw-race = (pre-race & fr) \ rw-xbstar + + flag ~empty (ww-race | wr-race | rw-race) as data-race +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 044c9a3cb247..f53d3c515cdc 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -481,6 +481,7 @@ static const char *uaccess_safe_builtin[] = { + "ubsan_type_mismatch_common", + "__ubsan_handle_type_mismatch", + "__ubsan_handle_type_mismatch_v1", ++ "__ubsan_handle_shift_out_of_bounds", + /* misc */ + "csum_partial_copy_generic", + "__memcpy_mcsafe", +diff --git a/tools/perf/arch/arm64/util/sym-handling.c b/tools/perf/arch/arm64/util/sym-handling.c +index 5df788985130..8dfa3e5229f1 100644 +--- a/tools/perf/arch/arm64/util/sym-handling.c ++++ b/tools/perf/arch/arm64/util/sym-handling.c +@@ -6,9 +6,10 @@ + + #include "symbol.h" // for the elf__needs_adjust_symbols() prototype + #include +-#include + + #ifdef HAVE_LIBELF_SUPPORT ++#include ++ + bool elf__needs_adjust_symbols(GElf_Ehdr ehdr) + { + return ehdr.e_type == ET_EXEC || +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index aae0e57c60fb..7accaf8ef689 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -399,6 +399,13 @@ static int report__setup_sample_type(struct report *rep) + PERF_SAMPLE_BRANCH_ANY)) + rep->nonany_branch_mode = true; + ++#ifndef HAVE_LIBUNWIND_SUPPORT ++ if (dwarf_callchain_users) { ++ ui__warning("Please install libunwind development packages " ++ "during the perf build.\n"); ++ } ++#endif ++ + return 0; + } + +diff --git a/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json +index 0d1556fcdffe..99f4fc425564 100644 +--- a/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json ++++ b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json +@@ -15,7 +15,7 @@ + }, + { + "EventCode": "0x04", +- "EventName": "uncore_hisi_ddrc.flux_wr", ++ "EventName": "uncore_hisi_ddrc.pre_cmd", + "BriefDescription": "DDRC precharge commands", + "PublicDescription": "DDRC precharge commands", + "Unit": "hisi_sccl,ddrc", +diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c +index e2837260ca4d..99e3fd04a5cb 100644 +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -758,6 +758,7 @@ static int process_mapfile(FILE *outfp, char *fpath) + char *line, *p; + int line_num; + char *tblname; ++ int ret = 0; + + pr_info("%s: Processing mapfile %s\n", prog, fpath); + +@@ -769,6 +770,7 @@ static int process_mapfile(FILE *outfp, char *fpath) + if (!mapfp) { + pr_info("%s: Error %s opening %s\n", prog, strerror(errno), + fpath); ++ free(line); + return -1; + } + +@@ -795,7 +797,8 @@ static int process_mapfile(FILE *outfp, char *fpath) + /* TODO Deal with lines longer than 16K */ + pr_info("%s: Mapfile %s: line %d too long, aborting\n", + prog, fpath, line_num); +- return -1; ++ ret = -1; ++ goto out; + } + line[strlen(line)-1] = '\0'; + +@@ -825,7 +828,9 @@ static int process_mapfile(FILE *outfp, char *fpath) + + out: + print_mapping_table_suffix(outfp); +- return 0; ++ fclose(mapfp); ++ free(line); ++ return ret; + } + + /* +@@ -1122,6 +1127,7 @@ int main(int argc, char *argv[]) + goto empty_map; + } else if (rc < 0) { + /* Make build fail */ ++ fclose(eventsfp); + free_arch_std_events(); + return 1; + } else if (rc) { +@@ -1134,6 +1140,7 @@ int main(int argc, char *argv[]) + goto empty_map; + } else if (rc < 0) { + /* Make build fail */ ++ fclose(eventsfp); + free_arch_std_events(); + return 1; + } else if (rc) { +@@ -1151,6 +1158,8 @@ int main(int argc, char *argv[]) + if (process_mapfile(eventsfp, mapfile)) { + pr_info("%s: Error processing mapfile %s\n", prog, mapfile); + /* Make build fail */ ++ fclose(eventsfp); ++ free_arch_std_events(); + return 1; + } + +diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c +index c1c2c13de254..166f411568a5 100644 +--- a/tools/perf/tests/bp_signal.c ++++ b/tools/perf/tests/bp_signal.c +@@ -49,14 +49,6 @@ asm ( + "__test_function:\n" + "incq (%rdi)\n" + "ret\n"); +-#elif defined (__aarch64__) +-extern void __test_function(volatile long *ptr); +-asm ( +- ".globl __test_function\n" +- "__test_function:\n" +- "str x30, [x0]\n" +- "ret\n"); +- + #else + static void __test_function(volatile long *ptr) + { +@@ -302,10 +294,15 @@ bool test__bp_signal_is_supported(void) + * stepping into the SIGIO handler and getting stuck on the + * breakpointed instruction. + * ++ * Since arm64 has the same issue with arm for the single-step ++ * handling, this case also gets suck on the breakpointed ++ * instruction. ++ * + * Just disable the test for these architectures until these + * issues are resolved. + */ +-#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__) ++#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__) || \ ++ defined(__aarch64__) + return false; + #else + return true; +diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c +index bce3a4cb4c89..d85c9f608564 100644 +--- a/tools/perf/tests/task-exit.c ++++ b/tools/perf/tests/task-exit.c +@@ -53,6 +53,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused + struct perf_cpu_map *cpus; + struct perf_thread_map *threads; + struct mmap *md; ++ int retry_count = 0; + + signal(SIGCHLD, sig_handler); + +@@ -110,6 +111,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused + if (evlist__mmap(evlist, 128) < 0) { + pr_debug("failed to mmap events: %d (%s)\n", errno, + str_error_r(errno, sbuf, sizeof(sbuf))); ++ err = -1; + goto out_delete_evlist; + } + +@@ -131,6 +133,13 @@ retry: + out_init: + if (!exited || !nr_exit) { + evlist__poll(evlist, -1); ++ ++ if (retry_count++ > 1000) { ++ pr_debug("Failed after retrying 1000 times\n"); ++ err = -1; ++ goto out_free_maps; ++ } ++ + goto retry; + } + +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index 4ba0f871f086..f5f855fff412 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -110,7 +110,7 @@ static int cs_etm__decode_data_block(struct cs_etm_queue *etmq); + * encode the etm queue number as the upper 16 bit and the channel as + * the lower 16 bit. + */ +-#define TO_CS_QUEUE_NR(queue_nr, trace_id_chan) \ ++#define TO_CS_QUEUE_NR(queue_nr, trace_chan_id) \ + (queue_nr << 16 | trace_chan_id) + #define TO_QUEUE_NR(cs_queue_nr) (cs_queue_nr >> 16) + #define TO_TRACE_CHAN_ID(cs_queue_nr) (cs_queue_nr & 0x0000ffff) +@@ -819,7 +819,7 @@ static int cs_etm__setup_queue(struct cs_etm_auxtrace *etm, + * Note that packets decoded above are still in the traceID's packet + * queue and will be processed in cs_etm__process_queues(). + */ +- cs_queue_nr = TO_CS_QUEUE_NR(queue_nr, trace_id_chan); ++ cs_queue_nr = TO_CS_QUEUE_NR(queue_nr, trace_chan_id); + ret = auxtrace_heap__add(&etm->heap, cs_queue_nr, timestamp); + out: + return ret; +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index df6cee5c071f..5544bfbd0f6c 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -307,21 +307,51 @@ bool die_is_func_def(Dwarf_Die *dw_die) + dwarf_attr(dw_die, DW_AT_declaration, &attr) == NULL); + } + ++/** ++ * die_entrypc - Returns entry PC (the lowest address) of a DIE ++ * @dw_die: a DIE ++ * @addr: where to store entry PC ++ * ++ * Since dwarf_entrypc() does not return entry PC if the DIE has only address ++ * range, we have to use this to retrieve the lowest address from the address ++ * range attribute. ++ */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) ++{ ++ Dwarf_Addr base, end; ++ ++ if (!addr) ++ return -EINVAL; ++ ++ if (dwarf_entrypc(dw_die, addr) == 0) ++ return 0; ++ ++ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; ++} ++ + /** + * die_is_func_instance - Ensure that this DIE is an instance of a subprogram + * @dw_die: a DIE + * + * Ensure that this DIE is an instance (which has an entry address). +- * This returns true if @dw_die is a function instance. If not, you need to +- * call die_walk_instances() to find actual instances. ++ * This returns true if @dw_die is a function instance. If not, the @dw_die ++ * must be a prototype. You can use die_walk_instances() to find actual ++ * instances. + **/ + bool die_is_func_instance(Dwarf_Die *dw_die) + { + Dwarf_Addr tmp; ++ Dwarf_Attribute attr_mem; ++ int tag = dwarf_tag(dw_die); + +- /* Actually gcc optimizes non-inline as like as inlined */ +- return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0; ++ if (tag != DW_TAG_subprogram && ++ tag != DW_TAG_inlined_subroutine) ++ return false; ++ ++ return dwarf_entrypc(dw_die, &tmp) == 0 || ++ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL; + } ++ + /** + * die_get_data_member_location - Get the data-member offset + * @mb_die: a DIE of a member of a data structure +@@ -598,6 +628,9 @@ static int __die_walk_instances_cb(Dwarf_Die *inst, void *data) + Dwarf_Die *origin; + int tmp; + ++ if (!die_is_func_instance(inst)) ++ return DIE_FIND_CB_CONTINUE; ++ + attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem); + if (attr == NULL) + return DIE_FIND_CB_CONTINUE; +@@ -669,15 +702,14 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data) + if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) { + fname = die_get_call_file(in_die); + lineno = die_get_call_lineno(in_die); +- if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) { ++ if (fname && lineno > 0 && die_entrypc(in_die, &addr) == 0) { + lw->retval = lw->callback(fname, lineno, addr, lw->data); + if (lw->retval != 0) + return DIE_FIND_CB_END; + } ++ if (!lw->recursive) ++ return DIE_FIND_CB_SIBLING; + } +- if (!lw->recursive) +- /* Don't need to search recursively */ +- return DIE_FIND_CB_SIBLING; + + if (addr) { + fname = dwarf_decl_file(in_die); +@@ -710,7 +742,7 @@ static int __die_walk_funclines(Dwarf_Die *sp_die, bool recursive, + /* Handle function declaration line */ + fname = dwarf_decl_file(sp_die); + if (fname && dwarf_decl_line(sp_die, &lineno) == 0 && +- dwarf_entrypc(sp_die, &addr) == 0) { ++ die_entrypc(sp_die, &addr) == 0) { + lw.retval = callback(fname, lineno, addr, data); + if (lw.retval != 0) + goto done; +@@ -724,6 +756,10 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data) + { + struct __line_walk_param *lw = data; + ++ /* ++ * Since inlined function can include another inlined function in ++ * the same file, we need to walk in it recursively. ++ */ + lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data); + if (lw->retval != 0) + return DWARF_CB_ABORT; +@@ -748,11 +784,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + Dwarf_Lines *lines; + Dwarf_Line *line; + Dwarf_Addr addr; +- const char *fname, *decf = NULL; ++ const char *fname, *decf = NULL, *inf = NULL; + int lineno, ret = 0; + int decl = 0, inl; + Dwarf_Die die_mem, *cu_die; + size_t nlines, i; ++ bool flag; + + /* Get the CU die */ + if (dwarf_tag(rt_die) != DW_TAG_compile_unit) { +@@ -783,6 +820,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + "Possible error in debuginfo.\n"); + continue; + } ++ /* Skip end-of-sequence */ ++ if (dwarf_lineendsequence(line, &flag) != 0 || flag) ++ continue; ++ /* Skip Non statement line-info */ ++ if (dwarf_linebeginstatement(line, &flag) != 0 || !flag) ++ continue; + /* Filter lines based on address */ + if (rt_die != cu_die) { + /* +@@ -792,13 +835,21 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (!dwarf_haspc(rt_die, addr)) + continue; ++ + if (die_find_inlinefunc(rt_die, addr, &die_mem)) { ++ /* Call-site check */ ++ inf = die_get_call_file(&die_mem); ++ if ((inf && !strcmp(inf, decf)) && ++ die_get_call_lineno(&die_mem) == lineno) ++ goto found; ++ + dwarf_decl_line(&die_mem, &inl); + if (inl != decl || + decf != dwarf_decl_file(&die_mem)) + continue; + } + } ++found: + /* Get source line */ + fname = dwarf_linesrc(line, NULL, NULL); + +@@ -813,8 +864,9 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (rt_die != cu_die) + /* +- * Don't need walk functions recursively, because nested +- * inlined functions don't have lines of the specified DIE. ++ * Don't need walk inlined functions recursively, because ++ * inner inlined functions don't have the lines of the ++ * specified function. + */ + ret = __die_walk_funclines(rt_die, false, callback, data); + else { +@@ -989,7 +1041,7 @@ static int die_get_var_innermost_scope(Dwarf_Die *sp_die, Dwarf_Die *vr_die, + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +@@ -1052,7 +1104,7 @@ int die_get_var_range(Dwarf_Die *sp_die, Dwarf_Die *vr_die, struct strbuf *buf) + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h +index f204e5892403..506006e0cf66 100644 +--- a/tools/perf/util/dwarf-aux.h ++++ b/tools/perf/util/dwarf-aux.h +@@ -29,6 +29,9 @@ int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr, + /* Get DW_AT_linkage_name (should be NULL for C binary) */ + const char *die_get_linkage_name(Dwarf_Die *dw_die); + ++/* Get the lowest PC in DIE (including range list) */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr); ++ + /* Ensure that this DIE is a subprogram and definition (not declaration) */ + bool die_is_func_def(Dwarf_Die *dw_die); + +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index b5e2adef49de..422ad1888e74 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -1365,8 +1365,15 @@ int parse_events_add_pmu(struct parse_events_state *parse_state, + if (get_config_terms(head_config, &config_terms)) + return -ENOMEM; + +- if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) ++ if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) { ++ struct perf_evsel_config_term *pos, *tmp; ++ ++ list_for_each_entry_safe(pos, tmp, &config_terms, list) { ++ list_del_init(&pos->list); ++ free(pos); ++ } + return -EINVAL; ++ } + + evsel = __add_event(list, &parse_state->idx, &attr, + get_config_name(head_config), pmu, +@@ -1927,15 +1934,20 @@ int parse_events(struct evlist *evlist, const char *str, + + ret = parse_events__scanner(str, &parse_state, PE_START_EVENTS); + perf_pmu__parse_cleanup(); ++ ++ if (!ret && list_empty(&parse_state.list)) { ++ WARN_ONCE(true, "WARNING: event parser found nothing\n"); ++ return -1; ++ } ++ ++ /* ++ * Add list to the evlist even with errors to allow callers to clean up. ++ */ ++ perf_evlist__splice_list_tail(evlist, &parse_state.list); ++ + if (!ret) { + struct evsel *last; + +- if (list_empty(&parse_state.list)) { +- WARN_ONCE(true, "WARNING: event parser found nothing\n"); +- return -1; +- } +- +- perf_evlist__splice_list_tail(evlist, &parse_state.list); + evlist->nr_groups += parse_state.nr_groups; + last = evlist__last(evlist); + last->cmdline_group_boundary = true; +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index cd9f95e5044e..08cccd86447c 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -756,6 +756,16 @@ static int find_best_scope_cb(Dwarf_Die *fn_die, void *data) + return 0; + } + ++/* Return innermost DIE */ ++static int find_inner_scope_cb(Dwarf_Die *fn_die, void *data) ++{ ++ struct find_scope_param *fsp = data; ++ ++ memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die)); ++ fsp->found = true; ++ return 1; ++} ++ + /* Find an appropriate scope fits to given conditions */ + static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + { +@@ -767,8 +777,13 @@ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + .die_mem = die_mem, + .found = false, + }; ++ int ret; + +- cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp); ++ ret = cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, ++ &fsp); ++ if (!ret && !fsp.found) ++ cu_walk_functions_at(&pf->cu_die, pf->addr, ++ find_inner_scope_cb, &fsp); + + return fsp.found ? die_mem : NULL; + } +@@ -942,7 +957,7 @@ static int probe_point_inline_cb(Dwarf_Die *in_die, void *data) + ret = find_probe_point_lazy(in_die, pf); + else { + /* Get probe address */ +- if (dwarf_entrypc(in_die, &addr) != 0) { ++ if (die_entrypc(in_die, &addr) != 0) { + pr_warning("Failed to get entry address of %s.\n", + dwarf_diename(in_die)); + return -ENOENT; +@@ -994,7 +1009,7 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data) + param->retval = find_probe_point_by_line(pf); + } else if (die_is_func_instance(sp_die)) { + /* Instances always have the entry address */ +- dwarf_entrypc(sp_die, &pf->addr); ++ die_entrypc(sp_die, &pf->addr); + /* But in some case the entry address is 0 */ + if (pf->addr == 0) { + pr_debug("%s has no entry PC. Skipped\n", +@@ -1425,6 +1440,18 @@ error: + return DIE_FIND_CB_END; + } + ++static bool available_var_finder_overlap(struct available_var_finder *af) ++{ ++ int i; ++ ++ for (i = 0; i < af->nvls; i++) { ++ if (af->pf.addr == af->vls[i].point.address) ++ return true; ++ } ++ return false; ++ ++} ++ + /* Add a found vars into available variables list */ + static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + { +@@ -1435,6 +1462,14 @@ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + Dwarf_Die die_mem; + int ret; + ++ /* ++ * For some reason (e.g. different column assigned to same address), ++ * this callback can be called with the address which already passed. ++ * Ignore it first. ++ */ ++ if (available_var_finder_overlap(af)) ++ return 0; ++ + /* Check number of tevs */ + if (af->nvls == af->max_vls) { + pr_warning("Too many( > %d) probe point found.\n", af->max_vls); +@@ -1578,7 +1613,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + /* Get function entry information */ + func = basefunc = dwarf_diename(&spdie); + if (!func || +- dwarf_entrypc(&spdie, &baseaddr) != 0 || ++ die_entrypc(&spdie, &baseaddr) != 0 || + dwarf_decl_line(&spdie, &baseline) != 0) { + lineno = 0; + goto post; +@@ -1595,7 +1630,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr, + &indie)) { + /* There is an inline function */ +- if (dwarf_entrypc(&indie, &_addr) == 0 && ++ if (die_entrypc(&indie, &_addr) == 0 && + _addr == addr) { + /* + * addr is at an inline function entry. +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 061bb4d6a3f5..5c172845fa5a 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1954,8 +1954,8 @@ out_err: + } + + static union perf_event * +-fetch_mmaped_event(struct perf_session *session, +- u64 head, size_t mmap_size, char *buf) ++prefetch_event(char *buf, u64 head, size_t mmap_size, ++ bool needs_swap, union perf_event *error) + { + union perf_event *event; + +@@ -1967,20 +1967,32 @@ fetch_mmaped_event(struct perf_session *session, + return NULL; + + event = (union perf_event *)(buf + head); ++ if (needs_swap) ++ perf_event_header__bswap(&event->header); + +- if (session->header.needs_swap) ++ if (head + event->header.size <= mmap_size) ++ return event; ++ ++ /* We're not fetching the event so swap back again */ ++ if (needs_swap) + perf_event_header__bswap(&event->header); + +- if (head + event->header.size > mmap_size) { +- /* We're not fetching the event so swap back again */ +- if (session->header.needs_swap) +- perf_event_header__bswap(&event->header); +- pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx: fuzzed perf.data?\n", +- __func__, head, event->header.size, mmap_size); +- return ERR_PTR(-EINVAL); +- } ++ pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx:" ++ " fuzzed or compressed perf.data?\n",__func__, head, event->header.size, mmap_size); + +- return event; ++ return error; ++} ++ ++static union perf_event * ++fetch_mmaped_event(u64 head, size_t mmap_size, char *buf, bool needs_swap) ++{ ++ return prefetch_event(buf, head, mmap_size, needs_swap, ERR_PTR(-EINVAL)); ++} ++ ++static union perf_event * ++fetch_decomp_event(u64 head, size_t mmap_size, char *buf, bool needs_swap) ++{ ++ return prefetch_event(buf, head, mmap_size, needs_swap, NULL); + } + + static int __perf_session__process_decomp_events(struct perf_session *session) +@@ -1993,10 +2005,8 @@ static int __perf_session__process_decomp_events(struct perf_session *session) + return 0; + + while (decomp->head < decomp->size && !session_done()) { +- union perf_event *event = fetch_mmaped_event(session, decomp->head, decomp->size, decomp->data); +- +- if (IS_ERR(event)) +- return PTR_ERR(event); ++ union perf_event *event = fetch_decomp_event(decomp->head, decomp->size, decomp->data, ++ session->header.needs_swap); + + if (!event) + break; +@@ -2096,7 +2106,7 @@ remap: + } + + more: +- event = fetch_mmaped_event(session, head, mmap_size, buf); ++ event = fetch_mmaped_event(head, mmap_size, buf, session->header.needs_swap); + if (IS_ERR(event)) + return PTR_ERR(event); + +diff --git a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +index 7c7451d3f494..58dbdfd4fa13 100644 +--- a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c ++++ b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +@@ -39,7 +39,6 @@ static cstate_t hsw_ext_cstates[HSW_EXT_CSTATE_COUNT] = { + { + .name = "PC9", + .desc = N_("Processor Package C9"), +- .desc = N_("Processor Package C2"), + .id = PC9, + .range = RANGE_PACKAGE, + .get_count_percent = hsw_ext_get_count_percent, +diff --git a/tools/testing/selftests/bpf/cgroup_helpers.c b/tools/testing/selftests/bpf/cgroup_helpers.c +index e95c33e333a4..b29a73fe64db 100644 +--- a/tools/testing/selftests/bpf/cgroup_helpers.c ++++ b/tools/testing/selftests/bpf/cgroup_helpers.c +@@ -98,7 +98,7 @@ int enable_all_controllers(char *cgroup_path) + */ + int setup_cgroup_environment(void) + { +- char cgroup_workdir[PATH_MAX + 1]; ++ char cgroup_workdir[PATH_MAX - 24]; + + format_cgroup_path(cgroup_workdir, ""); + +diff --git a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c +index 3a62119c7498..35c512818a56 100644 +--- a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c ++++ b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c +@@ -62,6 +62,10 @@ struct padded_a_lot { + * long: 64; + * long: 64; + * int b; ++ * long: 32; ++ * long: 64; ++ * long: 64; ++ * long: 64; + *}; + * + */ +@@ -95,7 +99,6 @@ struct zone_padding { + struct zone { + int a; + short b; +- short: 16; + struct zone_padding __pad__; + }; + +diff --git a/tools/testing/selftests/bpf/progs/test_seg6_loop.c b/tools/testing/selftests/bpf/progs/test_seg6_loop.c +index c4d104428643..69880c1e7700 100644 +--- a/tools/testing/selftests/bpf/progs/test_seg6_loop.c ++++ b/tools/testing/selftests/bpf/progs/test_seg6_loop.c +@@ -132,8 +132,10 @@ static __always_inline int is_valid_tlv_boundary(struct __sk_buff *skb, + *pad_off = 0; + + // we can only go as far as ~10 TLVs due to the BPF max stack size ++ // workaround: define induction variable "i" as "long" instead ++ // of "int" to prevent alu32 sub-register spilling. + #pragma clang loop unroll(disable) +- for (int i = 0; i < 100; i++) { ++ for (long i = 0; i < 100; i++) { + struct sr6_tlv_t tlv; + + if (cur_off == *tlv_off) +diff --git a/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c b/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c +index 608a06871572..d22e438198cf 100644 +--- a/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c ++++ b/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c +@@ -44,7 +44,10 @@ int sysctl_tcp_mem(struct bpf_sysctl *ctx) + unsigned long tcp_mem[TCP_MEM_LOOPS] = {}; + char value[MAX_VALUE_STR_LEN]; + unsigned char i, off = 0; +- int ret; ++ /* a workaround to prevent compiler from generating ++ * codes verifier cannot handle yet. ++ */ ++ volatile int ret; + + if (ctx->write) + return 0; +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index af75a1c7a458..3bf18364c67c 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -20,7 +20,7 @@ struct prog_test_def { + bool tested; + bool need_cgroup_cleanup; + +- const char *subtest_name; ++ char *subtest_name; + int subtest_num; + + /* store counts before subtest started */ +@@ -81,16 +81,17 @@ void test__end_subtest() + fprintf(env.stdout, "#%d/%d %s:%s\n", + test->test_num, test->subtest_num, + test->subtest_name, sub_error_cnt ? "FAIL" : "OK"); ++ ++ free(test->subtest_name); ++ test->subtest_name = NULL; + } + + bool test__start_subtest(const char *name) + { + struct prog_test_def *test = env.test; + +- if (test->subtest_name) { ++ if (test->subtest_name) + test__end_subtest(); +- test->subtest_name = NULL; +- } + + test->subtest_num++; + +@@ -104,7 +105,13 @@ bool test__start_subtest(const char *name) + if (!should_run(&env.subtest_selector, test->subtest_num, name)) + return false; + +- test->subtest_name = name; ++ test->subtest_name = strdup(name); ++ if (!test->subtest_name) { ++ fprintf(env.stderr, ++ "Subtest #%d: failed to copy subtest name!\n", ++ test->subtest_num); ++ return false; ++ } + env.test->old_error_cnt = env.test->error_cnt; + + return true; +diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh +index ff0d31d38061..7c76b841b17b 100755 +--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh ++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh +@@ -62,6 +62,10 @@ cleanup() { + if [[ -f "${infile}" ]]; then + rm "${infile}" + fi ++ ++ if [[ -n $server_pid ]]; then ++ kill $server_pid 2> /dev/null ++ fi + } + + server_listen() { +@@ -77,6 +81,7 @@ client_connect() { + + verify_data() { + wait "${server_pid}" ++ server_pid= + # sha1sum returns two fields [sha1] [filepath] + # convert to bash array and access first elem + insum=($(sha1sum ${infile})) +diff --git a/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh b/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh +index fef88eb4b873..fa6a88c50750 100755 +--- a/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh ++++ b/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh +@@ -36,7 +36,7 @@ h2_destroy() + { + ip -6 route del 2001:db8:1::/64 vrf v$h2 + ip -4 route del 192.0.2.0/28 vrf v$h2 +- simple_if_fini $h2 192.0.2.130/28 ++ simple_if_fini $h2 192.0.2.130/28 2001:db8:2::2/64 + } + + router_create() +diff --git a/tools/testing/selftests/net/so_txtime.c b/tools/testing/selftests/net/so_txtime.c +index 53f598f06647..34df4c8882af 100644 +--- a/tools/testing/selftests/net/so_txtime.c ++++ b/tools/testing/selftests/net/so_txtime.c +@@ -105,8 +105,8 @@ static void do_recv_one(int fdr, struct timed_send *ts) + tstop = (gettime_ns() - glob_tstart) / 1000; + texpect = ts->delay_us >= 0 ? ts->delay_us : 0; + +- fprintf(stderr, "payload:%c delay:%ld expected:%ld (us)\n", +- rbuf[0], tstop, texpect); ++ fprintf(stderr, "payload:%c delay:%lld expected:%lld (us)\n", ++ rbuf[0], (long long)tstop, (long long)texpect); + + if (rbuf[0] != ts->data) + error(1, 0, "payload mismatch. expected %c", ts->data); +diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c +index 13e5ef615026..0ea44d975b6c 100644 +--- a/tools/testing/selftests/net/tls.c ++++ b/tools/testing/selftests/net/tls.c +@@ -722,34 +722,6 @@ TEST_F(tls, recv_lowat) + EXPECT_EQ(memcmp(send_mem, recv_mem + 10, 5), 0); + } + +-TEST_F(tls, recv_rcvbuf) +-{ +- char send_mem[4096]; +- char recv_mem[4096]; +- int rcv_buf = 1024; +- +- memset(send_mem, 0x1c, sizeof(send_mem)); +- +- EXPECT_EQ(setsockopt(self->cfd, SOL_SOCKET, SO_RCVBUF, +- &rcv_buf, sizeof(rcv_buf)), 0); +- +- EXPECT_EQ(send(self->fd, send_mem, 512, 0), 512); +- memset(recv_mem, 0, sizeof(recv_mem)); +- EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), 512); +- EXPECT_EQ(memcmp(send_mem, recv_mem, 512), 0); +- +- if (self->notls) +- return; +- +- EXPECT_EQ(send(self->fd, send_mem, 4096, 0), 4096); +- memset(recv_mem, 0, sizeof(recv_mem)); +- EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), -1); +- EXPECT_EQ(errno, EMSGSIZE); +- +- EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), -1); +- EXPECT_EQ(errno, EMSGSIZE); +-} +- + TEST_F(tls, bidir) + { + char const *test_str = "test_read"; +diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c +index 614b31aad168..c66da6ffd6d8 100644 +--- a/tools/testing/selftests/net/udpgso.c ++++ b/tools/testing/selftests/net/udpgso.c +@@ -440,7 +440,8 @@ static bool __send_one(int fd, struct msghdr *msg, int flags) + if (ret == -1) + error(1, errno, "sendmsg"); + if (ret != msg->msg_iov->iov_len) +- error(1, 0, "sendto: %d != %lu", ret, msg->msg_iov->iov_len); ++ error(1, 0, "sendto: %d != %llu", ret, ++ (unsigned long long)msg->msg_iov->iov_len); + if (msg->msg_flags) + error(1, 0, "sendmsg: return flags 0x%x\n", msg->msg_flags); + +diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c +index ada99496634a..17512a43885e 100644 +--- a/tools/testing/selftests/net/udpgso_bench_tx.c ++++ b/tools/testing/selftests/net/udpgso_bench_tx.c +@@ -405,7 +405,8 @@ static int send_udp_segment(int fd, char *data) + if (ret == -1) + error(1, errno, "sendmsg"); + if (ret != iov.iov_len) +- error(1, 0, "sendmsg: %u != %lu\n", ret, iov.iov_len); ++ error(1, 0, "sendmsg: %u != %llu\n", ret, ++ (unsigned long long)iov.iov_len); + + return 1; + } +diff --git a/tools/testing/selftests/proc/proc-self-map-files-002.c b/tools/testing/selftests/proc/proc-self-map-files-002.c +index 47b7473dedef..e6aa00a183bc 100644 +--- a/tools/testing/selftests/proc/proc-self-map-files-002.c ++++ b/tools/testing/selftests/proc/proc-self-map-files-002.c +@@ -47,7 +47,11 @@ static void fail(const char *fmt, unsigned long a, unsigned long b) + int main(void) + { + const int PAGE_SIZE = sysconf(_SC_PAGESIZE); +- const unsigned long va_max = 1UL << 32; ++ /* ++ * va_max must be enough bigger than vm.mmap_min_addr, which is ++ * 64KB/32KB by default. (depends on CONFIG_LSM_MMAP_MIN_ADDR) ++ */ ++ const unsigned long va_max = 1UL << 20; + unsigned long va; + void *p; + int fd; +diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c +index 38b4c910b6c3..f23c9cd5684f 100644 +--- a/virt/kvm/arm/mmu.c ++++ b/virt/kvm/arm/mmu.c +@@ -38,6 +38,11 @@ static unsigned long io_map_base; + #define KVM_S2PTE_FLAG_IS_IOMAP (1UL << 0) + #define KVM_S2_FLAG_LOGGING_ACTIVE (1UL << 1) + ++static bool is_iomap(unsigned long flags) ++{ ++ return flags & KVM_S2PTE_FLAG_IS_IOMAP; ++} ++ + static bool memslot_is_logging(struct kvm_memory_slot *memslot) + { + return memslot->dirty_bitmap && !(memslot->flags & KVM_MEM_READONLY); +@@ -1698,6 +1703,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + + vma_pagesize = vma_kernel_pagesize(vma); + if (logging_active || ++ (vma->vm_flags & VM_PFNMAP) || + !fault_supports_stage2_huge_mapping(memslot, hva, vma_pagesize)) { + force_pte = true; + vma_pagesize = PAGE_SIZE; +@@ -1760,6 +1766,9 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + writable = false; + } + ++ if (exec_fault && is_iomap(flags)) ++ return -ENOEXEC; ++ + spin_lock(&kvm->mmu_lock); + if (mmu_notifier_retry(kvm, mmu_seq)) + goto out_unlock; +@@ -1781,7 +1790,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + if (writable) + kvm_set_pfn_dirty(pfn); + +- if (fault_status != FSC_PERM) ++ if (fault_status != FSC_PERM && !is_iomap(flags)) + clean_dcache_guest_page(pfn, vma_pagesize); + + if (exec_fault) +@@ -1948,9 +1957,8 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run) + if (kvm_is_error_hva(hva) || (write_fault && !writable)) { + if (is_iabt) { + /* Prefetch Abort on I/O address */ +- kvm_inject_pabt(vcpu, kvm_vcpu_get_hfar(vcpu)); +- ret = 1; +- goto out_unlock; ++ ret = -ENOEXEC; ++ goto out; + } + + /* +@@ -1992,6 +2000,11 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run) + ret = user_mem_abort(vcpu, fault_ipa, memslot, hva, fault_status); + if (ret == 0) + ret = 1; ++out: ++ if (ret == -ENOEXEC) { ++ kvm_inject_pabt(vcpu, kvm_vcpu_get_hfar(vcpu)); ++ ret = 1; ++ } + out_unlock: + srcu_read_unlock(&vcpu->kvm->srcu, idx); + return ret; diff --git a/patch/kernel/odroidxu4-current/02-patch-5.4.7-8.patch b/patch/kernel/odroidxu4-current/02-patch-5.4.7-8.patch new file mode 100644 index 0000000000..80c6bbc371 --- /dev/null +++ b/patch/kernel/odroidxu4-current/02-patch-5.4.7-8.patch @@ -0,0 +1,7703 @@ +diff --git a/Documentation/devicetree/bindings/Makefile b/Documentation/devicetree/bindings/Makefile +index 5138a2f6232a..646cb3525373 100644 +--- a/Documentation/devicetree/bindings/Makefile ++++ b/Documentation/devicetree/bindings/Makefile +@@ -12,7 +12,6 @@ $(obj)/%.example.dts: $(src)/%.yaml FORCE + $(call if_changed,chk_binding) + + DT_TMP_SCHEMA := processed-schema.yaml +-extra-y += $(DT_TMP_SCHEMA) + + quiet_cmd_mk_schema = SCHEMA $@ + cmd_mk_schema = $(DT_MK_SCHEMA) $(DT_MK_SCHEMA_FLAGS) -o $@ $(real-prereqs) +@@ -26,8 +25,12 @@ DT_DOCS = $(shell \ + + DT_SCHEMA_FILES ?= $(addprefix $(src)/,$(DT_DOCS)) + ++ifeq ($(CHECK_DTBS),) + extra-y += $(patsubst $(src)/%.yaml,%.example.dts, $(DT_SCHEMA_FILES)) + extra-y += $(patsubst $(src)/%.yaml,%.example.dt.yaml, $(DT_SCHEMA_FILES)) ++endif + + $(obj)/$(DT_TMP_SCHEMA): $(DT_SCHEMA_FILES) FORCE + $(call if_changed,mk_schema) ++ ++extra-y += $(DT_TMP_SCHEMA) +diff --git a/Documentation/devicetree/writing-schema.rst b/Documentation/devicetree/writing-schema.rst +index f4a638072262..83e04e5c342d 100644 +--- a/Documentation/devicetree/writing-schema.rst ++++ b/Documentation/devicetree/writing-schema.rst +@@ -130,11 +130,13 @@ binding schema. All of the DT binding documents can be validated using the + + make dt_binding_check + +-In order to perform validation of DT source files, use the `dtbs_check` target:: ++In order to perform validation of DT source files, use the ``dtbs_check`` target:: + + make dtbs_check + +-This will first run the `dt_binding_check` which generates the processed schema. ++Note that ``dtbs_check`` will skip any binding schema files with errors. It is ++necessary to use ``dt_binding_check`` to get all the validation errors in the ++binding schema files. + + It is also possible to run checks with a single schema file by setting the + ``DT_SCHEMA_FILES`` variable to a specific schema file. +diff --git a/Makefile b/Makefile +index 0e2e0a034064..1adee1b06f3d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 7 ++SUBLEVEL = 8 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h +index b36c0289a308..6a0f1f524466 100644 +--- a/arch/arm/boot/compressed/libfdt_env.h ++++ b/arch/arm/boot/compressed/libfdt_env.h +@@ -2,11 +2,13 @@ + #ifndef _ARM_LIBFDT_ENV_H + #define _ARM_LIBFDT_ENV_H + ++#include + #include + #include + #include + +-#define INT_MAX ((int)(~0U>>1)) ++#define INT32_MAX S32_MAX ++#define UINT32_MAX U32_MAX + + typedef __be16 fdt16_t; + typedef __be32 fdt32_t; +diff --git a/arch/arm/mm/dma-mapping-nommu.c b/arch/arm/mm/dma-mapping-nommu.c +index db9247898300..287ef898a55e 100644 +--- a/arch/arm/mm/dma-mapping-nommu.c ++++ b/arch/arm/mm/dma-mapping-nommu.c +@@ -35,7 +35,7 @@ static void *arm_nommu_dma_alloc(struct device *dev, size_t size, + unsigned long attrs) + + { +- void *ret = dma_alloc_from_global_coherent(size, dma_handle); ++ void *ret = dma_alloc_from_global_coherent(dev, size, dma_handle); + + /* + * dma_alloc_from_global_coherent() may fail because: +diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c +index 9a07916af8dd..a6554fdb56c5 100644 +--- a/arch/arm/mm/proc-v7-bugs.c ++++ b/arch/arm/mm/proc-v7-bugs.c +@@ -65,6 +65,9 @@ static void cpu_v7_spectre_init(void) + break; + + #ifdef CONFIG_ARM_PSCI ++ case ARM_CPU_PART_BRAHMA_B53: ++ /* Requires no workaround */ ++ break; + default: + /* Other ARM CPUs require no workaround */ + if (read_cpuid_implementor() == ARM_CPU_IMP_ARM) +diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h +index fb842965d541..9228f7386220 100644 +--- a/arch/mips/include/asm/barrier.h ++++ b/arch/mips/include/asm/barrier.h +@@ -218,14 +218,13 @@ + * ordering will be done by smp_llsc_mb() and friends. + */ + #if defined(CONFIG_WEAK_REORDERING_BEYOND_LLSC) && defined(CONFIG_SMP) +-# define __WEAK_LLSC_MB sync +-# define smp_llsc_mb() \ +- __asm__ __volatile__(__stringify(__WEAK_LLSC_MB) : : :"memory") +-# define __LLSC_CLOBBER ++#define __WEAK_LLSC_MB " sync \n" ++#define smp_llsc_mb() __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory") ++#define __LLSC_CLOBBER + #else +-# define __WEAK_LLSC_MB +-# define smp_llsc_mb() do { } while (0) +-# define __LLSC_CLOBBER "memory" ++#define __WEAK_LLSC_MB " \n" ++#define smp_llsc_mb() do { } while (0) ++#define __LLSC_CLOBBER "memory" + #endif + + #ifdef CONFIG_CPU_CAVIUM_OCTEON +diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h +index 110220705e97..b83b0397462d 100644 +--- a/arch/mips/include/asm/futex.h ++++ b/arch/mips/include/asm/futex.h +@@ -16,7 +16,6 @@ + #include + #include + #include +-#include + #include + + #define __futex_atomic_op(insn, ret, oldval, uaddr, oparg) \ +@@ -33,7 +32,7 @@ + " .set arch=r4000 \n" \ + "2: sc $1, %2 \n" \ + " beqzl $1, 1b \n" \ +- __stringify(__WEAK_LLSC_MB) " \n" \ ++ __WEAK_LLSC_MB \ + "3: \n" \ + " .insn \n" \ + " .set pop \n" \ +@@ -51,19 +50,19 @@ + "i" (-EFAULT) \ + : "memory"); \ + } else if (cpu_has_llsc) { \ ++ loongson_llsc_mb(); \ + __asm__ __volatile__( \ + " .set push \n" \ + " .set noat \n" \ + " .set push \n" \ + " .set "MIPS_ISA_ARCH_LEVEL" \n" \ +- " " __SYNC(full, loongson3_war) " \n" \ + "1: "user_ll("%1", "%4")" # __futex_atomic_op\n" \ + " .set pop \n" \ + " " insn " \n" \ + " .set "MIPS_ISA_ARCH_LEVEL" \n" \ + "2: "user_sc("$1", "%2")" \n" \ + " beqz $1, 1b \n" \ +- __stringify(__WEAK_LLSC_MB) " \n" \ ++ __WEAK_LLSC_MB \ + "3: \n" \ + " .insn \n" \ + " .set pop \n" \ +@@ -148,7 +147,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + " .set arch=r4000 \n" + "2: sc $1, %2 \n" + " beqzl $1, 1b \n" +- __stringify(__WEAK_LLSC_MB) " \n" ++ __WEAK_LLSC_MB + "3: \n" + " .insn \n" + " .set pop \n" +@@ -165,13 +164,13 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + "i" (-EFAULT) + : "memory"); + } else if (cpu_has_llsc) { ++ loongson_llsc_mb(); + __asm__ __volatile__( + "# futex_atomic_cmpxchg_inatomic \n" + " .set push \n" + " .set noat \n" + " .set push \n" + " .set "MIPS_ISA_ARCH_LEVEL" \n" +- " " __SYNC(full, loongson3_war) " \n" + "1: "user_ll("%1", "%3")" \n" + " bne %1, %z4, 3f \n" + " .set pop \n" +@@ -179,7 +178,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + " .set "MIPS_ISA_ARCH_LEVEL" \n" + "2: "user_sc("$1", "%2")" \n" + " beqz $1, 1b \n" +- "3: " __SYNC_ELSE(full, loongson3_war, __WEAK_LLSC_MB) "\n" ++ __WEAK_LLSC_MB ++ "3: \n" + " .insn \n" + " .set pop \n" + " .section .fixup,\"ax\" \n" +@@ -194,6 +194,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + : GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval), + "i" (-EFAULT) + : "memory"); ++ loongson_llsc_mb(); + } else + return -ENOSYS; + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 83522c9fc7b6..37ac731a556b 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -91,11 +91,13 @@ MULTIPLEWORD := -mmultiple + endif + + ifdef CONFIG_PPC64 ++ifndef CONFIG_CC_IS_CLANG + cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) + cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mcall-aixdesc) + aflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) + aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mabi=elfv2 + endif ++endif + + ifndef CONFIG_CC_IS_CLANG + cflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mno-strict-align +@@ -141,6 +143,7 @@ endif + endif + + CFLAGS-$(CONFIG_PPC64) := $(call cc-option,-mtraceback=no) ++ifndef CONFIG_CC_IS_CLANG + ifdef CONFIG_CPU_LITTLE_ENDIAN + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2,$(call cc-option,-mcall-aixdesc)) + AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2) +@@ -149,6 +152,7 @@ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcall-aixdesc) + AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) + endif ++endif + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc)) + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mno-pointers-to-nested-functions) + +diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h +index 2abc8e83b95e..9757d4f6331e 100644 +--- a/arch/powerpc/boot/libfdt_env.h ++++ b/arch/powerpc/boot/libfdt_env.h +@@ -6,6 +6,8 @@ + #include + + #define INT_MAX ((int)(~0U>>1)) ++#define UINT32_MAX ((u32)~0U) ++#define INT32_MAX ((s32)(UINT32_MAX >> 1)) + + #include "of.h" + +diff --git a/arch/powerpc/include/asm/fixmap.h b/arch/powerpc/include/asm/fixmap.h +index 0cfc365d814b..722289a1d000 100644 +--- a/arch/powerpc/include/asm/fixmap.h ++++ b/arch/powerpc/include/asm/fixmap.h +@@ -77,7 +77,12 @@ enum fixed_addresses { + static inline void __set_fixmap(enum fixed_addresses idx, + phys_addr_t phys, pgprot_t flags) + { +- map_kernel_page(fix_to_virt(idx), phys, flags); ++ if (__builtin_constant_p(idx)) ++ BUILD_BUG_ON(idx >= __end_of_fixed_addresses); ++ else if (WARN_ON(idx >= __end_of_fixed_addresses)) ++ return; ++ ++ map_kernel_page(__fix_to_virt(idx), phys, flags); + } + + #endif /* !__ASSEMBLY__ */ +diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h +index cac95a3f30c2..e9a960e28f3c 100644 +--- a/arch/powerpc/include/asm/spinlock.h ++++ b/arch/powerpc/include/asm/spinlock.h +@@ -36,12 +36,10 @@ + #endif + + #ifdef CONFIG_PPC_PSERIES +-DECLARE_STATIC_KEY_FALSE(shared_processor); +- + #define vcpu_is_preempted vcpu_is_preempted + static inline bool vcpu_is_preempted(int cpu) + { +- if (!static_branch_unlikely(&shared_processor)) ++ if (!firmware_has_feature(FW_FEATURE_SPLPAR)) + return false; + return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1); + } +diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h +index 15002b51ff18..c92fe7fe9692 100644 +--- a/arch/powerpc/include/asm/uaccess.h ++++ b/arch/powerpc/include/asm/uaccess.h +@@ -401,7 +401,7 @@ copy_to_user_mcsafe(void __user *to, const void *from, unsigned long n) + return n; + } + +-extern unsigned long __clear_user(void __user *addr, unsigned long size); ++unsigned long __arch_clear_user(void __user *addr, unsigned long size); + + static inline unsigned long clear_user(void __user *addr, unsigned long size) + { +@@ -409,12 +409,17 @@ static inline unsigned long clear_user(void __user *addr, unsigned long size) + might_fault(); + if (likely(access_ok(addr, size))) { + allow_write_to_user(addr, size); +- ret = __clear_user(addr, size); ++ ret = __arch_clear_user(addr, size); + prevent_write_to_user(addr, size); + } + return ret; + } + ++static inline unsigned long __clear_user(void __user *addr, unsigned long size) ++{ ++ return clear_user(addr, size); ++} ++ + extern long strncpy_from_user(char *dst, const char __user *src, long count); + extern __must_check long strnlen_user(const char __user *str, long n); + +diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c +index d9279d0ee9f5..c031be8d41ff 100644 +--- a/arch/powerpc/kernel/eeh_driver.c ++++ b/arch/powerpc/kernel/eeh_driver.c +@@ -897,12 +897,12 @@ void eeh_handle_normal_event(struct eeh_pe *pe) + + /* Log the event */ + if (pe->type & EEH_PE_PHB) { +- pr_err("EEH: PHB#%x failure detected, location: %s\n", ++ pr_err("EEH: Recovering PHB#%x, location: %s\n", + pe->phb->global_number, eeh_pe_loc_get(pe)); + } else { + struct eeh_pe *phb_pe = eeh_phb_pe_get(pe->phb); + +- pr_err("EEH: Frozen PHB#%x-PE#%x detected\n", ++ pr_err("EEH: Recovering PHB#%x-PE#%x\n", + pe->phb->global_number, pe->addr); + pr_err("EEH: PE location: %s, PHB location: %s\n", + eeh_pe_loc_get(pe), eeh_pe_loc_get(phb_pe)); +diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c +index bd91dceb7010..d341b464f23c 100644 +--- a/arch/powerpc/kernel/security.c ++++ b/arch/powerpc/kernel/security.c +@@ -142,32 +142,33 @@ ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, cha + + thread_priv = security_ftr_enabled(SEC_FTR_L1D_THREAD_PRIV); + +- if (rfi_flush || thread_priv) { ++ if (rfi_flush) { + struct seq_buf s; + seq_buf_init(&s, buf, PAGE_SIZE - 1); + +- seq_buf_printf(&s, "Mitigation: "); +- +- if (rfi_flush) +- seq_buf_printf(&s, "RFI Flush"); +- +- if (rfi_flush && thread_priv) +- seq_buf_printf(&s, ", "); +- ++ seq_buf_printf(&s, "Mitigation: RFI Flush"); + if (thread_priv) +- seq_buf_printf(&s, "L1D private per thread"); ++ seq_buf_printf(&s, ", L1D private per thread"); + + seq_buf_printf(&s, "\n"); + + return s.len; + } + ++ if (thread_priv) ++ return sprintf(buf, "Vulnerable: L1D private per thread\n"); ++ + if (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) && + !security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)) + return sprintf(buf, "Not affected\n"); + + return sprintf(buf, "Vulnerable\n"); + } ++ ++ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ return cpu_show_meltdown(dev, attr, buf); ++} + #endif + + ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf) +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index 619447b1b797..11301a1187f3 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -232,7 +232,7 @@ static u64 scan_dispatch_log(u64 stop_tb) + * Accumulate stolen time by scanning the dispatch trace log. + * Called on entry from user mode. + */ +-void accumulate_stolen_time(void) ++void notrace accumulate_stolen_time(void) + { + u64 sst, ust; + unsigned long save_irq_soft_mask = irq_soft_mask_return(); +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index 82f43535e686..014ff0701f24 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -250,15 +250,22 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, + } + NOKPROBE_SYMBOL(oops_end); + ++static char *get_mmu_str(void) ++{ ++ if (early_radix_enabled()) ++ return " MMU=Radix"; ++ if (early_mmu_has_feature(MMU_FTR_HPTE_TABLE)) ++ return " MMU=Hash"; ++ return ""; ++} ++ + static int __die(const char *str, struct pt_regs *regs, long err) + { + printk("Oops: %s, sig: %ld [#%d]\n", str, err, ++die_counter); + +- printk("%s PAGE_SIZE=%luK%s%s%s%s%s%s%s %s\n", ++ printk("%s PAGE_SIZE=%luK%s%s%s%s%s%s %s\n", + IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN) ? "LE" : "BE", +- PAGE_SIZE / 1024, +- early_radix_enabled() ? " MMU=Radix" : "", +- early_mmu_has_feature(MMU_FTR_HPTE_TABLE) ? " MMU=Hash" : "", ++ PAGE_SIZE / 1024, get_mmu_str(), + IS_ENABLED(CONFIG_PREEMPT) ? " PREEMPT" : "", + IS_ENABLED(CONFIG_SMP) ? " SMP" : "", + IS_ENABLED(CONFIG_SMP) ? (" NR_CPUS=" __stringify(NR_CPUS)) : "", +diff --git a/arch/powerpc/lib/string_32.S b/arch/powerpc/lib/string_32.S +index f69a6aab7bfb..1ddb26394e8a 100644 +--- a/arch/powerpc/lib/string_32.S ++++ b/arch/powerpc/lib/string_32.S +@@ -17,7 +17,7 @@ CACHELINE_BYTES = L1_CACHE_BYTES + LG_CACHELINE_BYTES = L1_CACHE_SHIFT + CACHELINE_MASK = (L1_CACHE_BYTES-1) + +-_GLOBAL(__clear_user) ++_GLOBAL(__arch_clear_user) + /* + * Use dcbz on the complete cache lines in the destination + * to set them to zero. This requires that the destination +@@ -87,4 +87,4 @@ _GLOBAL(__clear_user) + EX_TABLE(8b, 91b) + EX_TABLE(9b, 91b) + +-EXPORT_SYMBOL(__clear_user) ++EXPORT_SYMBOL(__arch_clear_user) +diff --git a/arch/powerpc/lib/string_64.S b/arch/powerpc/lib/string_64.S +index 507b18b1660e..169872bc0892 100644 +--- a/arch/powerpc/lib/string_64.S ++++ b/arch/powerpc/lib/string_64.S +@@ -17,7 +17,7 @@ PPC64_CACHES: + .section ".text" + + /** +- * __clear_user: - Zero a block of memory in user space, with less checking. ++ * __arch_clear_user: - Zero a block of memory in user space, with less checking. + * @to: Destination address, in user space. + * @n: Number of bytes to zero. + * +@@ -58,7 +58,7 @@ err3; stb r0,0(r3) + mr r3,r4 + blr + +-_GLOBAL_TOC(__clear_user) ++_GLOBAL_TOC(__arch_clear_user) + cmpdi r4,32 + neg r6,r3 + li r0,0 +@@ -181,4 +181,4 @@ err1; dcbz 0,r3 + cmpdi r4,32 + blt .Lshort_clear + b .Lmedium_clear +-EXPORT_SYMBOL(__clear_user) ++EXPORT_SYMBOL(__arch_clear_user) +diff --git a/arch/powerpc/mm/book3s64/hash_utils.c b/arch/powerpc/mm/book3s64/hash_utils.c +index 6c123760164e..83c51a7d7eee 100644 +--- a/arch/powerpc/mm/book3s64/hash_utils.c ++++ b/arch/powerpc/mm/book3s64/hash_utils.c +@@ -294,10 +294,18 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend, + ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot, + HPTE_V_BOLTED, psize, psize, + ssize); +- ++ if (ret == -1) { ++ /* Try to remove a non bolted entry */ ++ ret = mmu_hash_ops.hpte_remove(hpteg); ++ if (ret != -1) ++ ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot, ++ HPTE_V_BOLTED, psize, psize, ++ ssize); ++ } + if (ret < 0) + break; + ++ cond_resched(); + #ifdef CONFIG_DEBUG_PAGEALLOC + if (debug_pagealloc_enabled() && + (paddr >> PAGE_SHIFT) < linear_map_hash_count) +diff --git a/arch/powerpc/platforms/pseries/cmm.c b/arch/powerpc/platforms/pseries/cmm.c +index b33251d75927..572651a5c87b 100644 +--- a/arch/powerpc/platforms/pseries/cmm.c ++++ b/arch/powerpc/platforms/pseries/cmm.c +@@ -411,6 +411,10 @@ static struct bus_type cmm_subsys = { + .dev_name = "cmm", + }; + ++static void cmm_release_device(struct device *dev) ++{ ++} ++ + /** + * cmm_sysfs_register - Register with sysfs + * +@@ -426,6 +430,7 @@ static int cmm_sysfs_register(struct device *dev) + + dev->id = 0; + dev->bus = &cmm_subsys; ++ dev->release = cmm_release_device; + + if ((rc = device_register(dev))) + goto subsys_unregister; +diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c +index 61883291defc..ee07d0718bf1 100644 +--- a/arch/powerpc/platforms/pseries/papr_scm.c ++++ b/arch/powerpc/platforms/pseries/papr_scm.c +@@ -152,7 +152,7 @@ static int papr_scm_meta_get(struct papr_scm_priv *p, + int len, read; + int64_t ret; + +- if ((hdr->in_offset + hdr->in_length) >= p->metadata_size) ++ if ((hdr->in_offset + hdr->in_length) > p->metadata_size) + return -EINVAL; + + for (len = hdr->in_length; len; len -= read) { +@@ -206,7 +206,7 @@ static int papr_scm_meta_set(struct papr_scm_priv *p, + __be64 data_be; + int64_t ret; + +- if ((hdr->in_offset + hdr->in_length) >= p->metadata_size) ++ if ((hdr->in_offset + hdr->in_length) > p->metadata_size) + return -EINVAL; + + for (len = hdr->in_length; len; len -= wrote) { +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 0c8421dd01ab..0a40201f315f 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -74,9 +74,6 @@ + #include "pseries.h" + #include "../../../../drivers/pci/pci.h" + +-DEFINE_STATIC_KEY_FALSE(shared_processor); +-EXPORT_SYMBOL_GPL(shared_processor); +- + int CMO_PrPSP = -1; + int CMO_SecPSP = -1; + unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K); +@@ -761,10 +758,6 @@ static void __init pSeries_setup_arch(void) + + if (firmware_has_feature(FW_FEATURE_LPAR)) { + vpa_init(boot_cpuid); +- +- if (lppaca_shared_proc(get_lppaca())) +- static_branch_enable(&shared_processor); +- + ppc_md.power_save = pseries_lpar_idle; + ppc_md.enable_pmcs = pseries_lpar_enable_pmcs; + #ifdef CONFIG_PCI_IOV +diff --git a/arch/powerpc/tools/relocs_check.sh b/arch/powerpc/tools/relocs_check.sh +index 2b4e959caa36..7b9fe0a567cf 100755 +--- a/arch/powerpc/tools/relocs_check.sh ++++ b/arch/powerpc/tools/relocs_check.sh +@@ -20,7 +20,7 @@ objdump="$1" + vmlinux="$2" + + bad_relocs=$( +-"$objdump" -R "$vmlinux" | ++$objdump -R "$vmlinux" | + # Only look at relocation lines. + grep -E '\:' | + awk '{print $1}' + ) + + BRANCHES=$( +-"$objdump" -R "$vmlinux" -D --start-address=0xc000000000000000 \ ++$objdump -R "$vmlinux" -D --start-address=0xc000000000000000 \ + --stop-address=${end_intr} | + grep -e "^c[0-9a-f]*:[[:space:]]*\([0-9a-f][0-9a-f][[:space:]]\)\{4\}[[:space:]]*b" | + grep -v '\<__start_initialization_multiplatform>' | +diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c +index d402ced7f7c3..cb8b1cc285c9 100644 +--- a/arch/s390/kernel/machine_kexec.c ++++ b/arch/s390/kernel/machine_kexec.c +@@ -164,7 +164,9 @@ static bool kdump_csum_valid(struct kimage *image) + #ifdef CONFIG_CRASH_DUMP + int rc; + ++ preempt_disable(); + rc = CALL_ON_STACK(do_start_kdump, S390_lowcore.nodat_stack, 1, image); ++ preempt_enable(); + return rc == 0; + #else + return false; +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 3d8b12a9a6ff..7511b71d2931 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -193,7 +193,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, + unsigned long num_sdb, gfp_t gfp_flags) + { + int i, rc; +- unsigned long *new, *tail; ++ unsigned long *new, *tail, *tail_prev = NULL; + + if (!sfb->sdbt || !sfb->tail) + return -EINVAL; +@@ -232,6 +232,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, + sfb->num_sdbt++; + /* Link current page to tail of chain */ + *tail = (unsigned long)(void *) new + 1; ++ tail_prev = tail; + tail = new; + } + +@@ -241,10 +242,22 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, + * issue, a new realloc call (if required) might succeed. + */ + rc = alloc_sample_data_block(tail, gfp_flags); +- if (rc) ++ if (rc) { ++ /* Undo last SDBT. An SDBT with no SDB at its first ++ * entry but with an SDBT entry instead can not be ++ * handled by the interrupt handler code. ++ * Avoid this situation. ++ */ ++ if (tail_prev) { ++ sfb->num_sdbt--; ++ free_page((unsigned long) new); ++ tail = tail_prev; ++ } + break; ++ } + sfb->num_sdb++; + tail++; ++ tail_prev = new = NULL; /* Allocated at least one SBD */ + } + + /* Link sampling buffer to its origin */ +diff --git a/arch/s390/kernel/unwind_bc.c b/arch/s390/kernel/unwind_bc.c +index a8204f952315..6e609b13c0ce 100644 +--- a/arch/s390/kernel/unwind_bc.c ++++ b/arch/s390/kernel/unwind_bc.c +@@ -60,6 +60,11 @@ bool unwind_next_frame(struct unwind_state *state) + ip = READ_ONCE_NOCHECK(sf->gprs[8]); + reliable = false; + regs = NULL; ++ if (!__kernel_text_address(ip)) { ++ /* skip bogus %r14 */ ++ state->regs = NULL; ++ return unwind_next_frame(state); ++ } + } else { + sf = (struct stack_frame *) state->sp; + sp = READ_ONCE_NOCHECK(sf->back_chain); +diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c +index 59ad7997fed1..de7ca4b6718f 100644 +--- a/arch/s390/mm/maccess.c ++++ b/arch/s390/mm/maccess.c +@@ -119,9 +119,15 @@ static unsigned long __no_sanitize_address _memcpy_real(unsigned long dest, + */ + int memcpy_real(void *dest, void *src, size_t count) + { +- if (S390_lowcore.nodat_stack != 0) +- return CALL_ON_STACK(_memcpy_real, S390_lowcore.nodat_stack, +- 3, dest, src, count); ++ int rc; ++ ++ if (S390_lowcore.nodat_stack != 0) { ++ preempt_disable(); ++ rc = CALL_ON_STACK(_memcpy_real, S390_lowcore.nodat_stack, 3, ++ dest, src, count); ++ preempt_enable(); ++ return rc; ++ } + /* + * This is a really early memcpy_real call, the stacks are + * not set up yet. Just call _memcpy_real on the early boot +diff --git a/arch/um/drivers/virtio_uml.c b/arch/um/drivers/virtio_uml.c +index fc8c52cff5aa..c5643a59a8c7 100644 +--- a/arch/um/drivers/virtio_uml.c ++++ b/arch/um/drivers/virtio_uml.c +@@ -83,7 +83,7 @@ static int full_sendmsg_fds(int fd, const void *buf, unsigned int len, + return 0; + } + +-static int full_read(int fd, void *buf, int len) ++static int full_read(int fd, void *buf, int len, bool abortable) + { + int rc; + +@@ -93,7 +93,7 @@ static int full_read(int fd, void *buf, int len) + buf += rc; + len -= rc; + } +- } while (len && (rc > 0 || rc == -EINTR)); ++ } while (len && (rc > 0 || rc == -EINTR || (!abortable && rc == -EAGAIN))); + + if (rc < 0) + return rc; +@@ -104,7 +104,7 @@ static int full_read(int fd, void *buf, int len) + + static int vhost_user_recv_header(int fd, struct vhost_user_msg *msg) + { +- return full_read(fd, msg, sizeof(msg->header)); ++ return full_read(fd, msg, sizeof(msg->header), true); + } + + static int vhost_user_recv(int fd, struct vhost_user_msg *msg, +@@ -118,7 +118,7 @@ static int vhost_user_recv(int fd, struct vhost_user_msg *msg, + size = msg->header.size; + if (size > max_payload_size) + return -EPROTO; +- return full_read(fd, &msg->payload, size); ++ return full_read(fd, &msg->payload, size, false); + } + + static int vhost_user_recv_resp(struct virtio_uml_device *vu_dev, +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index ac42ae4651ce..eebdcbef0578 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -996,6 +996,12 @@ static void cdrom_count_tracks(struct cdrom_device_info *cdi, tracktype *tracks) + tracks->xa = 0; + tracks->error = 0; + cd_dbg(CD_COUNT_TRACKS, "entering cdrom_count_tracks\n"); ++ ++ if (!CDROM_CAN(CDC_PLAY_AUDIO)) { ++ tracks->error = CDS_NO_INFO; ++ return; ++ } ++ + /* Grab the TOC header so we can see how many tracks there are */ + ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCHDR, &header); + if (ret) { +@@ -1162,7 +1168,8 @@ int cdrom_open(struct cdrom_device_info *cdi, struct block_device *bdev, + ret = open_for_data(cdi); + if (ret) + goto err; +- cdrom_mmc3_profile(cdi); ++ if (CDROM_CAN(CDC_GENERIC_PACKET)) ++ cdrom_mmc3_profile(cdi); + if (mode & FMODE_WRITE) { + ret = -EROFS; + if (cdrom_open_write(cdi)) +@@ -2882,6 +2889,9 @@ int cdrom_get_last_written(struct cdrom_device_info *cdi, long *last_written) + it doesn't give enough information or fails. then we return + the toc contents. */ + use_toc: ++ if (!CDROM_CAN(CDC_PLAY_AUDIO)) ++ return -ENOSYS; ++ + toc.cdte_format = CDROM_MSF; + toc.cdte_track = CDROM_LEADOUT; + if ((ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCENTRY, &toc))) +diff --git a/drivers/clk/clk-gpio.c b/drivers/clk/clk-gpio.c +index 9d930edd6516..13304cf5f2a8 100644 +--- a/drivers/clk/clk-gpio.c ++++ b/drivers/clk/clk-gpio.c +@@ -280,7 +280,7 @@ static int gpio_clk_driver_probe(struct platform_device *pdev) + else + clk = clk_register_gpio_gate(&pdev->dev, node->name, + parent_names ? parent_names[0] : NULL, gpiod, +- 0); ++ CLK_SET_RATE_PARENT); + if (IS_ERR(clk)) + return PTR_ERR(clk); + +diff --git a/drivers/clk/pxa/clk-pxa27x.c b/drivers/clk/pxa/clk-pxa27x.c +index 287fdeae7c7c..7b123105b5de 100644 +--- a/drivers/clk/pxa/clk-pxa27x.c ++++ b/drivers/clk/pxa/clk-pxa27x.c +@@ -459,6 +459,7 @@ struct dummy_clk { + }; + static struct dummy_clk dummy_clks[] __initdata = { + DUMMY_CLK(NULL, "pxa27x-gpio", "osc_32_768khz"), ++ DUMMY_CLK(NULL, "pxa-rtc", "osc_32_768khz"), + DUMMY_CLK(NULL, "sa1100-rtc", "osc_32_768khz"), + DUMMY_CLK("UARTCLK", "pxa2xx-ir", "STUART"), + }; +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index b98b81ef43a1..5a89ed88cc27 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -220,6 +220,8 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f, + if (clk_flags & CLK_SET_RATE_PARENT) { + rate = f->freq; + if (f->pre_div) { ++ if (!rate) ++ rate = req->rate; + rate /= 2; + rate *= f->pre_div + 1; + } +diff --git a/drivers/clk/qcom/clk-smd-rpm.c b/drivers/clk/qcom/clk-smd-rpm.c +index fef5e8157061..930fa4a4c52a 100644 +--- a/drivers/clk/qcom/clk-smd-rpm.c ++++ b/drivers/clk/qcom/clk-smd-rpm.c +@@ -648,6 +648,7 @@ static const struct rpm_smd_clk_desc rpm_clk_qcs404 = { + }; + + /* msm8998 */ ++DEFINE_CLK_SMD_RPM(msm8998, pcnoc_clk, pcnoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 0); + DEFINE_CLK_SMD_RPM(msm8998, snoc_clk, snoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 1); + DEFINE_CLK_SMD_RPM(msm8998, cnoc_clk, cnoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 2); + DEFINE_CLK_SMD_RPM(msm8998, ce1_clk, ce1_a_clk, QCOM_SMD_RPM_CE_CLK, 0); +@@ -670,6 +671,8 @@ DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL(msm8998, rf_clk2_pin, rf_clk2_a_pin, 5); + DEFINE_CLK_SMD_RPM_XO_BUFFER(msm8998, rf_clk3, rf_clk3_a, 6); + DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL(msm8998, rf_clk3_pin, rf_clk3_a_pin, 6); + static struct clk_smd_rpm *msm8998_clks[] = { ++ [RPM_SMD_PCNOC_CLK] = &msm8998_pcnoc_clk, ++ [RPM_SMD_PCNOC_A_CLK] = &msm8998_pcnoc_a_clk, + [RPM_SMD_SNOC_CLK] = &msm8998_snoc_clk, + [RPM_SMD_SNOC_A_CLK] = &msm8998_snoc_a_clk, + [RPM_SMD_CNOC_CLK] = &msm8998_cnoc_clk, +diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c +index 28ddc747d703..bdeacebbf0e4 100644 +--- a/drivers/clk/qcom/common.c ++++ b/drivers/clk/qcom/common.c +@@ -29,6 +29,9 @@ struct freq_tbl *qcom_find_freq(const struct freq_tbl *f, unsigned long rate) + if (!f) + return NULL; + ++ if (!f->freq) ++ return f; ++ + for (; f->freq; f++) + if (rate <= f->freq) + return f; +diff --git a/drivers/clocksource/asm9260_timer.c b/drivers/clocksource/asm9260_timer.c +index 9f09a59161e7..5b39d3701fa3 100644 +--- a/drivers/clocksource/asm9260_timer.c ++++ b/drivers/clocksource/asm9260_timer.c +@@ -194,6 +194,10 @@ static int __init asm9260_timer_init(struct device_node *np) + } + + clk = of_clk_get(np, 0); ++ if (IS_ERR(clk)) { ++ pr_err("Failed to get clk!\n"); ++ return PTR_ERR(clk); ++ } + + ret = clk_prepare_enable(clk); + if (ret) { +diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c +index 11ff701ff4bb..a3c73e972fce 100644 +--- a/drivers/clocksource/timer-of.c ++++ b/drivers/clocksource/timer-of.c +@@ -192,7 +192,7 @@ int __init timer_of_init(struct device_node *np, struct timer_of *to) + } + + if (!to->clkevt.name) +- to->clkevt.name = np->name; ++ to->clkevt.name = np->full_name; + + to->np = np; + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 06664fbd2d91..89792083d62c 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -1155,6 +1155,9 @@ static int fsl_qdma_probe(struct platform_device *pdev) + return ret; + + fsl_qdma->irq_base = platform_get_irq_byname(pdev, "qdma-queue0"); ++ if (fsl_qdma->irq_base < 0) ++ return fsl_qdma->irq_base; ++ + fsl_qdma->feature = of_property_read_bool(np, "big-endian"); + INIT_LIST_HEAD(&fsl_qdma->dma_dev.channels); + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 5d56f1e4d332..43acba2a1c0e 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -1433,6 +1433,7 @@ static int xilinx_dma_reset(struct xilinx_dma_chan *chan) + + chan->err = false; + chan->idle = true; ++ chan->desc_pendingcount = 0; + chan->desc_submitcount = 0; + + return err; +diff --git a/drivers/gpio/gpio-lynxpoint.c b/drivers/gpio/gpio-lynxpoint.c +index e9e47c0d5be7..490ce7bae25e 100644 +--- a/drivers/gpio/gpio-lynxpoint.c ++++ b/drivers/gpio/gpio-lynxpoint.c +@@ -164,6 +164,12 @@ static int lp_irq_type(struct irq_data *d, unsigned type) + value |= TRIG_SEL_BIT | INT_INV_BIT; + + outl(value, reg); ++ ++ if (type & IRQ_TYPE_EDGE_BOTH) ++ irq_set_handler_locked(d, handle_edge_irq); ++ else if (type & IRQ_TYPE_LEVEL_MASK) ++ irq_set_handler_locked(d, handle_level_irq); ++ + spin_unlock_irqrestore(&lg->lock, flags); + + return 0; +diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c +index 16a47de29c94..a031cbcdf6ef 100644 +--- a/drivers/gpio/gpio-mpc8xxx.c ++++ b/drivers/gpio/gpio-mpc8xxx.c +@@ -377,7 +377,8 @@ static int mpc8xxx_probe(struct platform_device *pdev) + * It's assumed that only a single type of gpio controller is available + * on the current machine, so overwriting global data is fine. + */ +- mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type; ++ if (devtype->irq_set_type) ++ mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type; + + if (devtype->gpio_dir_out) + gc->direction_output = devtype->gpio_dir_out; +@@ -386,6 +387,9 @@ static int mpc8xxx_probe(struct platform_device *pdev) + + gc->to_irq = mpc8xxx_gpio_to_irq; + ++ if (of_device_is_compatible(np, "fsl,qoriq-gpio")) ++ gc->write_reg(mpc8xxx_gc->regs + GPIO_IBE, 0xffffffff); ++ + ret = gpiochip_add_data(gc, mpc8xxx_gc); + if (ret) { + pr_err("%pOF: GPIO chip registration failed with status %d\n", +diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c +index 7907a8755866..c77d474185f3 100644 +--- a/drivers/gpio/gpio-mxc.c ++++ b/drivers/gpio/gpio-mxc.c +@@ -411,6 +411,7 @@ static int mxc_gpio_probe(struct platform_device *pdev) + { + struct device_node *np = pdev->dev.of_node; + struct mxc_gpio_port *port; ++ int irq_count; + int irq_base; + int err; + +@@ -426,9 +427,15 @@ static int mxc_gpio_probe(struct platform_device *pdev) + if (IS_ERR(port->base)) + return PTR_ERR(port->base); + +- port->irq_high = platform_get_irq(pdev, 1); +- if (port->irq_high < 0) +- port->irq_high = 0; ++ irq_count = platform_irq_count(pdev); ++ if (irq_count < 0) ++ return irq_count; ++ ++ if (irq_count > 1) { ++ port->irq_high = platform_get_irq(pdev, 1); ++ if (port->irq_high < 0) ++ port->irq_high = 0; ++ } + + port->irq = platform_get_irq(pdev, 0); + if (port->irq < 0) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index dff41d0a85fe..c0e41f1f0c23 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -788,7 +789,7 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages) + struct hmm_mirror *mirror = bo->mn ? &bo->mn->mirror : NULL; + struct ttm_tt *ttm = bo->tbo.ttm; + struct amdgpu_ttm_tt *gtt = (void *)ttm; +- struct mm_struct *mm = gtt->usertask->mm; ++ struct mm_struct *mm; + unsigned long start = gtt->userptr; + struct vm_area_struct *vma; + struct hmm_range *range; +@@ -796,25 +797,14 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages) + uint64_t *pfns; + int r = 0; + +- if (!mm) /* Happens during process shutdown */ +- return -ESRCH; +- + if (unlikely(!mirror)) { + DRM_DEBUG_DRIVER("Failed to get hmm_mirror\n"); +- r = -EFAULT; +- goto out; ++ return -EFAULT; + } + +- vma = find_vma(mm, start); +- if (unlikely(!vma || start < vma->vm_start)) { +- r = -EFAULT; +- goto out; +- } +- if (unlikely((gtt->userflags & AMDGPU_GEM_USERPTR_ANONONLY) && +- vma->vm_file)) { +- r = -EPERM; +- goto out; +- } ++ mm = mirror->hmm->mmu_notifier.mm; ++ if (!mmget_not_zero(mm)) /* Happens during process shutdown */ ++ return -ESRCH; + + range = kzalloc(sizeof(*range), GFP_KERNEL); + if (unlikely(!range)) { +@@ -847,6 +837,17 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages) + hmm_range_wait_until_valid(range, HMM_RANGE_DEFAULT_TIMEOUT); + + down_read(&mm->mmap_sem); ++ vma = find_vma(mm, start); ++ if (unlikely(!vma || start < vma->vm_start)) { ++ r = -EFAULT; ++ goto out_unlock; ++ } ++ if (unlikely((gtt->userflags & AMDGPU_GEM_USERPTR_ANONONLY) && ++ vma->vm_file)) { ++ r = -EPERM; ++ goto out_unlock; ++ } ++ + r = hmm_range_fault(range, 0); + up_read(&mm->mmap_sem); + +@@ -865,15 +866,19 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages) + } + + gtt->range = range; ++ mmput(mm); + + return 0; + ++out_unlock: ++ up_read(&mm->mmap_sem); + out_free_pfns: + hmm_range_unregister(range); + kvfree(pfns); + out_free_ranges: + kfree(range); + out: ++ mmput(mm); + return r; + } + +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index 892ce636ef72..6ee04803c362 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + struct drm_property_blob *blob; + int ret; + +- if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob)) ++ if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + + blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 2fa3587d974f..e0b241bd3070 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -781,6 +781,10 @@ static void hid_scan_feature_usage(struct hid_parser *parser, u32 usage) + if (usage == 0xff0000c5 && parser->global.report_count == 256 && + parser->global.report_size == 8) + parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8; ++ ++ if (usage == 0xff0000c6 && parser->global.report_count == 1 && ++ parser->global.report_size == 8) ++ parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8; + } + + static void hid_scan_collection(struct hid_parser *parser, unsigned type) +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 447e8db21174..6273e7178e78 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -573,6 +573,7 @@ + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941 0x0941 + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641 ++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a 0x1f4a + + #define USB_VENDOR_ID_HUION 0x256c + #define USB_DEVICE_ID_HUION_TABLET 0x006e +@@ -959,6 +960,7 @@ + + #define I2C_VENDOR_ID_RAYDIUM 0x2386 + #define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33 ++#define I2C_PRODUCT_ID_RAYDIUM_3118 0x3118 + + #define USB_VENDOR_ID_RAZER 0x1532 + #define USB_DEVICE_ID_RAZER_BLADE_14 0x011D +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 8e91e2f06cb4..cd9193078525 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -1102,6 +1102,9 @@ static int hidpp20_batterylevel_get_battery_capacity(struct hidpp_device *hidpp, + ret = hidpp_send_fap_command_sync(hidpp, feature_index, + CMD_BATTERY_LEVEL_STATUS_GET_BATTERY_LEVEL_STATUS, + NULL, 0, &response); ++ /* Ignore these intermittent errors */ ++ if (ret == HIDPP_ERROR_RESOURCE_ERROR) ++ return -EIO; + if (ret > 0) { + hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n", + __func__, ret); +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index c50bcd967d99..9a35af1e2662 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -94,6 +94,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X), HID_QUIRK_MULTI_INPUT }, +diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c +index 7c6abd7e0979..9ce22acdfaca 100644 +--- a/drivers/hid/hid-rmi.c ++++ b/drivers/hid/hid-rmi.c +@@ -744,7 +744,8 @@ static void rmi_remove(struct hid_device *hdev) + { + struct rmi_data *hdata = hid_get_drvdata(hdev); + +- if (hdata->device_flags & RMI_DEVICE) { ++ if ((hdata->device_flags & RMI_DEVICE) ++ && test_bit(RMI_STARTED, &hdata->flags)) { + clear_bit(RMI_STARTED, &hdata->flags); + cancel_work_sync(&hdata->reset_work); + rmi_unregister_transport_device(&hdata->xport); +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 04c088131e04..7608ee053114 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -170,6 +170,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV }, + { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, ++ { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118, ++ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { USB_VENDOR_ID_ELAN, HID_ANY_ID, + I2C_HID_QUIRK_BOGUS_IRQ }, + { 0, 0 } +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 53a60c81e220..05ead1735c6e 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2308,7 +2308,7 @@ static void hv_crash_handler(struct pt_regs *regs) + vmbus_connection.conn_state = DISCONNECTED; + cpu = smp_processor_id(); + hv_stimer_cleanup(cpu); +- hv_synic_cleanup(cpu); ++ hv_synic_disable_regs(cpu); + hyperv_cleanup(); + }; + +diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c +index b24e7b937f21..84cfed17ff4f 100644 +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -1985,6 +1985,11 @@ pm_disable: + pm_runtime_set_suspended(i2c_dev->dev); + pm_runtime_dont_use_autosuspend(i2c_dev->dev); + ++ if (i2c_dev->dma) { ++ stm32_i2c_dma_free(i2c_dev->dma); ++ i2c_dev->dma = NULL; ++ } ++ + clk_free: + clk_disable_unprepare(i2c_dev->clk); + +@@ -1995,21 +2000,21 @@ static int stm32f7_i2c_remove(struct platform_device *pdev) + { + struct stm32f7_i2c_dev *i2c_dev = platform_get_drvdata(pdev); + +- if (i2c_dev->dma) { +- stm32_i2c_dma_free(i2c_dev->dma); +- i2c_dev->dma = NULL; +- } +- + i2c_del_adapter(&i2c_dev->adap); + pm_runtime_get_sync(i2c_dev->dev); + +- clk_disable_unprepare(i2c_dev->clk); +- + pm_runtime_put_noidle(i2c_dev->dev); + pm_runtime_disable(i2c_dev->dev); + pm_runtime_set_suspended(i2c_dev->dev); + pm_runtime_dont_use_autosuspend(i2c_dev->dev); + ++ if (i2c_dev->dma) { ++ stm32_i2c_dma_free(i2c_dev->dma); ++ i2c_dev->dma = NULL; ++ } ++ ++ clk_disable_unprepare(i2c_dev->clk); ++ + return 0; + } + +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 24c4b691b1c9..ae60442efda0 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -3156,6 +3156,8 @@ static int __maybe_unused mxt_suspend(struct device *dev) + + mutex_unlock(&input_dev->mutex); + ++ disable_irq(data->irq); ++ + return 0; + } + +@@ -3168,6 +3170,8 @@ static int __maybe_unused mxt_resume(struct device *dev) + if (!input_dev) + return 0; + ++ enable_irq(data->irq); ++ + mutex_lock(&input_dev->mutex); + + if (input_dev->users) +diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c +index e9006407c9bc..f4ebdab06280 100644 +--- a/drivers/input/touchscreen/ili210x.c ++++ b/drivers/input/touchscreen/ili210x.c +@@ -334,7 +334,12 @@ static int ili210x_i2c_probe(struct i2c_client *client, + input_set_abs_params(input, ABS_MT_POSITION_X, 0, 0xffff, 0, 0); + input_set_abs_params(input, ABS_MT_POSITION_Y, 0, 0xffff, 0, 0); + touchscreen_parse_properties(input, true, &priv->prop); +- input_mt_init_slots(input, priv->max_touches, INPUT_MT_DIRECT); ++ ++ error = input_mt_init_slots(input, priv->max_touches, INPUT_MT_DIRECT); ++ if (error) { ++ dev_err(dev, "Unable to set up slots, err: %d\n", error); ++ return error; ++ } + + error = devm_add_action(dev, ili210x_cancel_work, priv); + if (error) +diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c +index 1139714e72e2..1c5f8875cb79 100644 +--- a/drivers/input/touchscreen/st1232.c ++++ b/drivers/input/touchscreen/st1232.c +@@ -149,6 +149,11 @@ static void st1232_ts_power(struct st1232_ts_data *ts, bool poweron) + gpiod_set_value_cansleep(ts->reset_gpio, !poweron); + } + ++static void st1232_ts_power_off(void *data) ++{ ++ st1232_ts_power(data, false); ++} ++ + static const struct st_chip_info st1232_chip_info = { + .have_z = true, + .max_x = 0x31f, /* 800 - 1 */ +@@ -229,6 +234,13 @@ static int st1232_ts_probe(struct i2c_client *client, + + st1232_ts_power(ts, true); + ++ error = devm_add_action_or_reset(&client->dev, st1232_ts_power_off, ts); ++ if (error) { ++ dev_err(&client->dev, ++ "Failed to install power off action: %d\n", error); ++ return error; ++ } ++ + input_dev->name = "st1232-touchscreen"; + input_dev->id.bustype = BUS_I2C; + input_dev->dev.parent = &client->dev; +@@ -271,15 +283,6 @@ static int st1232_ts_probe(struct i2c_client *client, + return 0; + } + +-static int st1232_ts_remove(struct i2c_client *client) +-{ +- struct st1232_ts_data *ts = i2c_get_clientdata(client); +- +- st1232_ts_power(ts, false); +- +- return 0; +-} +- + static int __maybe_unused st1232_ts_suspend(struct device *dev) + { + struct i2c_client *client = to_i2c_client(dev); +@@ -329,7 +332,6 @@ MODULE_DEVICE_TABLE(of, st1232_ts_dt_ids); + + static struct i2c_driver st1232_ts_driver = { + .probe = st1232_ts_probe, +- .remove = st1232_ts_remove, + .id_table = st1232_ts_id, + .driver = { + .name = ST1232_TS_NAME, +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 8da93e730d6f..ed90361b84dc 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -3611,19 +3611,19 @@ static int arm_smmu_device_probe(struct platform_device *pdev) + + /* Interrupt lines */ + +- irq = platform_get_irq_byname(pdev, "combined"); ++ irq = platform_get_irq_byname_optional(pdev, "combined"); + if (irq > 0) + smmu->combined_irq = irq; + else { +- irq = platform_get_irq_byname(pdev, "eventq"); ++ irq = platform_get_irq_byname_optional(pdev, "eventq"); + if (irq > 0) + smmu->evtq.q.irq = irq; + +- irq = platform_get_irq_byname(pdev, "priq"); ++ irq = platform_get_irq_byname_optional(pdev, "priq"); + if (irq > 0) + smmu->priq.q.irq = irq; + +- irq = platform_get_irq_byname(pdev, "gerror"); ++ irq = platform_get_irq_byname_optional(pdev, "gerror"); + if (irq > 0) + smmu->gerr_irq = irq; + } +diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c +index 4dcbf68dfda4..0df091934361 100644 +--- a/drivers/iommu/rockchip-iommu.c ++++ b/drivers/iommu/rockchip-iommu.c +@@ -980,13 +980,13 @@ static struct iommu_domain *rk_iommu_domain_alloc(unsigned type) + if (!dma_dev) + return NULL; + +- rk_domain = devm_kzalloc(dma_dev, sizeof(*rk_domain), GFP_KERNEL); ++ rk_domain = kzalloc(sizeof(*rk_domain), GFP_KERNEL); + if (!rk_domain) + return NULL; + + if (type == IOMMU_DOMAIN_DMA && + iommu_get_dma_cookie(&rk_domain->domain)) +- return NULL; ++ goto err_free_domain; + + /* + * rk32xx iommus use a 2 level pagetable. +@@ -1021,6 +1021,8 @@ err_free_dt: + err_put_cookie: + if (type == IOMMU_DOMAIN_DMA) + iommu_put_dma_cookie(&rk_domain->domain); ++err_free_domain: ++ kfree(rk_domain); + + return NULL; + } +@@ -1049,6 +1051,7 @@ static void rk_iommu_domain_free(struct iommu_domain *domain) + + if (domain->type == IOMMU_DOMAIN_DMA) + iommu_put_dma_cookie(&rk_domain->domain); ++ kfree(rk_domain); + } + + static int rk_iommu_add_device(struct device *dev) +diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c +index 7293fc3f796d..dd486233e282 100644 +--- a/drivers/iommu/tegra-smmu.c ++++ b/drivers/iommu/tegra-smmu.c +@@ -159,9 +159,9 @@ static bool smmu_dma_addr_valid(struct tegra_smmu *smmu, dma_addr_t addr) + return (addr & smmu->pfn_mask) == addr; + } + +-static dma_addr_t smmu_pde_to_dma(u32 pde) ++static dma_addr_t smmu_pde_to_dma(struct tegra_smmu *smmu, u32 pde) + { +- return pde << 12; ++ return (dma_addr_t)(pde & smmu->pfn_mask) << 12; + } + + static void smmu_flush_ptc_all(struct tegra_smmu *smmu) +@@ -549,6 +549,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova, + dma_addr_t *dmap) + { + unsigned int pd_index = iova_pd_index(iova); ++ struct tegra_smmu *smmu = as->smmu; + struct page *pt_page; + u32 *pd; + +@@ -557,7 +558,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova, + return NULL; + + pd = page_address(as->pd); +- *dmap = smmu_pde_to_dma(pd[pd_index]); ++ *dmap = smmu_pde_to_dma(smmu, pd[pd_index]); + + return tegra_smmu_pte_offset(pt_page, iova); + } +@@ -599,7 +600,7 @@ static u32 *as_get_pte(struct tegra_smmu_as *as, dma_addr_t iova, + } else { + u32 *pd = page_address(as->pd); + +- *dmap = smmu_pde_to_dma(pd[pde]); ++ *dmap = smmu_pde_to_dma(smmu, pd[pde]); + } + + return tegra_smmu_pte_offset(as->pts[pde], iova); +@@ -624,7 +625,7 @@ static void tegra_smmu_pte_put_use(struct tegra_smmu_as *as, unsigned long iova) + if (--as->count[pde] == 0) { + struct tegra_smmu *smmu = as->smmu; + u32 *pd = page_address(as->pd); +- dma_addr_t pte_dma = smmu_pde_to_dma(pd[pde]); ++ dma_addr_t pte_dma = smmu_pde_to_dma(smmu, pd[pde]); + + tegra_smmu_set_pde(as, iova, 0); + +diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c +index fc75c61233aa..58bec2126966 100644 +--- a/drivers/irqchip/irq-bcm7038-l1.c ++++ b/drivers/irqchip/irq-bcm7038-l1.c +@@ -281,6 +281,10 @@ static int __init bcm7038_l1_init_one(struct device_node *dn, + pr_err("failed to map parent interrupt %d\n", parent_irq); + return -EINVAL; + } ++ ++ if (of_property_read_bool(dn, "brcm,irq-can-wake")) ++ enable_irq_wake(parent_irq); ++ + irq_set_chained_handler_and_data(parent_irq, bcm7038_l1_irq_handle, + intc); + +diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c +index f126255b3260..dda512dfe2c1 100644 +--- a/drivers/irqchip/irq-ingenic.c ++++ b/drivers/irqchip/irq-ingenic.c +@@ -108,6 +108,14 @@ static int __init ingenic_intc_of_init(struct device_node *node, + goto out_unmap_irq; + } + ++ domain = irq_domain_add_legacy(node, num_chips * 32, ++ JZ4740_IRQ_BASE, 0, ++ &irq_domain_simple_ops, NULL); ++ if (!domain) { ++ err = -ENOMEM; ++ goto out_unmap_base; ++ } ++ + for (i = 0; i < num_chips; i++) { + /* Mask all irqs */ + writel(0xffffffff, intc->base + (i * CHIP_SIZE) + +@@ -134,14 +142,11 @@ static int __init ingenic_intc_of_init(struct device_node *node, + IRQ_NOPROBE | IRQ_LEVEL); + } + +- domain = irq_domain_add_legacy(node, num_chips * 32, JZ4740_IRQ_BASE, 0, +- &irq_domain_simple_ops, NULL); +- if (!domain) +- pr_warn("unable to register IRQ domain\n"); +- + setup_irq(parent_irq, &intc_cascade_action); + return 0; + ++out_unmap_base: ++ iounmap(intc->base); + out_unmap_irq: + irq_dispose_mapping(parent_irq); + out_free: +diff --git a/drivers/leds/leds-an30259a.c b/drivers/leds/leds-an30259a.c +index 250dc9d6f635..82350a28a564 100644 +--- a/drivers/leds/leds-an30259a.c ++++ b/drivers/leds/leds-an30259a.c +@@ -305,6 +305,13 @@ static int an30259a_probe(struct i2c_client *client) + + chip->regmap = devm_regmap_init_i2c(client, &an30259a_regmap_config); + ++ if (IS_ERR(chip->regmap)) { ++ err = PTR_ERR(chip->regmap); ++ dev_err(&client->dev, "Failed to allocate register map: %d\n", ++ err); ++ goto exit; ++ } ++ + for (i = 0; i < chip->num_leds; i++) { + struct led_init_data init_data = {}; + +diff --git a/drivers/leds/leds-lm3692x.c b/drivers/leds/leds-lm3692x.c +index 3d381f2f73d0..1ac9a44570ee 100644 +--- a/drivers/leds/leds-lm3692x.c ++++ b/drivers/leds/leds-lm3692x.c +@@ -334,9 +334,18 @@ static int lm3692x_probe_dt(struct lm3692x_led *led) + return ret; + } + +- led->regulator = devm_regulator_get(&led->client->dev, "vled"); +- if (IS_ERR(led->regulator)) ++ led->regulator = devm_regulator_get_optional(&led->client->dev, "vled"); ++ if (IS_ERR(led->regulator)) { ++ ret = PTR_ERR(led->regulator); ++ if (ret != -ENODEV) { ++ if (ret != -EPROBE_DEFER) ++ dev_err(&led->client->dev, ++ "Failed to get vled regulator: %d\n", ++ ret); ++ return ret; ++ } + led->regulator = NULL; ++ } + + child = device_get_next_child_node(&led->client->dev, child); + if (!child) { +diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c +index 136f86a1627d..d5e774d83021 100644 +--- a/drivers/leds/trigger/ledtrig-netdev.c ++++ b/drivers/leds/trigger/ledtrig-netdev.c +@@ -302,10 +302,12 @@ static int netdev_trig_notify(struct notifier_block *nb, + container_of(nb, struct led_netdev_data, notifier); + + if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE +- && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER) ++ && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER ++ && evt != NETDEV_CHANGENAME) + return NOTIFY_DONE; + + if (!(dev == trigger_data->net_dev || ++ (evt == NETDEV_CHANGENAME && !strcmp(dev->name, trigger_data->device_name)) || + (evt == NETDEV_REGISTER && !strcmp(dev->name, trigger_data->device_name)))) + return NOTIFY_DONE; + +@@ -315,6 +317,7 @@ static int netdev_trig_notify(struct notifier_block *nb, + + clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode); + switch (evt) { ++ case NETDEV_CHANGENAME: + case NETDEV_REGISTER: + if (trigger_data->net_dev) + dev_put(trigger_data->net_dev); +diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c +index 9f74dee1a58c..afe625e88a5c 100644 +--- a/drivers/mailbox/imx-mailbox.c ++++ b/drivers/mailbox/imx-mailbox.c +@@ -214,11 +214,24 @@ static void imx_mu_shutdown(struct mbox_chan *chan) + struct imx_mu_priv *priv = to_imx_mu_priv(chan->mbox); + struct imx_mu_con_priv *cp = chan->con_priv; + +- if (cp->type == IMX_MU_TYPE_TXDB) ++ if (cp->type == IMX_MU_TYPE_TXDB) { + tasklet_kill(&cp->txdb_tasklet); ++ return; ++ } + +- imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_TIEn(cp->idx) | +- IMX_MU_xCR_RIEn(cp->idx) | IMX_MU_xCR_GIEn(cp->idx)); ++ switch (cp->type) { ++ case IMX_MU_TYPE_TX: ++ imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_TIEn(cp->idx)); ++ break; ++ case IMX_MU_TYPE_RX: ++ imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_RIEn(cp->idx)); ++ break; ++ case IMX_MU_TYPE_RXDB: ++ imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_GIEn(cp->idx)); ++ break; ++ default: ++ break; ++ } + + free_irq(priv->irq, chan); + } +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index ba434d9ac720..46a8b5a91c38 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -723,6 +723,8 @@ static unsigned long bch_mca_scan(struct shrinker *shrink, + * IO can always make forward progress: + */ + nr /= c->btree_pages; ++ if (nr == 0) ++ nr = 1; + nr = min_t(unsigned long, nr, mca_can_free(c)); + + i = 0; +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 805b33e27496..4e7c9f398bc6 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1159,6 +1159,7 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor + /* not spare disk, or LEVEL_MULTIPATH */ + if (sb->level == LEVEL_MULTIPATH || + (rdev->desc_nr >= 0 && ++ rdev->desc_nr < MD_SB_DISKS && + sb->disks[rdev->desc_nr].state & + ((1<hdev; + struct hl_vm_phys_pg_pack *phys_pg_pack = NULL; + struct hl_vm_hash_node *hnode = NULL; + struct hl_userptr *userptr = NULL; ++ struct hl_va_range *va_range; + enum vm_type_t *vm_type; + u64 next_vaddr, i; + u32 page_size; +@@ -1003,6 +1005,7 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr) + + if (*vm_type == VM_TYPE_USERPTR) { + is_userptr = true; ++ va_range = &ctx->host_va_range; + userptr = hnode->ptr; + rc = init_phys_pg_pack_from_userptr(ctx, userptr, + &phys_pg_pack); +@@ -1014,6 +1017,7 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr) + } + } else if (*vm_type == VM_TYPE_PHYS_PACK) { + is_userptr = false; ++ va_range = &ctx->dram_va_range; + phys_pg_pack = hnode->ptr; + } else { + dev_warn(hdev->dev, +@@ -1052,12 +1056,18 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr) + + mutex_unlock(&ctx->mmu_lock); + +- if (add_va_block(hdev, +- is_userptr ? &ctx->host_va_range : &ctx->dram_va_range, +- vaddr, +- vaddr + phys_pg_pack->total_size - 1)) +- dev_warn(hdev->dev, "add va block failed for vaddr: 0x%llx\n", +- vaddr); ++ /* ++ * No point in maintaining the free VA block list if the context is ++ * closing as the list will be freed anyway ++ */ ++ if (!ctx_free) { ++ rc = add_va_block(hdev, va_range, vaddr, ++ vaddr + phys_pg_pack->total_size - 1); ++ if (rc) ++ dev_warn(hdev->dev, ++ "add va block failed for vaddr: 0x%llx\n", ++ vaddr); ++ } + + atomic_dec(&phys_pg_pack->mapping_cnt); + kfree(hnode); +@@ -1189,8 +1199,8 @@ int hl_mem_ioctl(struct hl_fpriv *hpriv, void *data) + break; + + case HL_MEM_OP_UNMAP: +- rc = unmap_device_va(ctx, +- args->in.unmap.device_virt_addr); ++ rc = unmap_device_va(ctx, args->in.unmap.device_virt_addr, ++ false); + break; + + default: +@@ -1620,7 +1630,7 @@ void hl_vm_ctx_fini(struct hl_ctx *ctx) + dev_dbg(hdev->dev, + "hl_mem_hash_node of vaddr 0x%llx of asid %d is still alive\n", + hnode->vaddr, ctx->asid); +- unmap_device_va(ctx, hnode->vaddr); ++ unmap_device_va(ctx, hnode->vaddr, true); + } + + spin_lock(&vm->idr_lock); +diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h +index 57b582bf73d9..9289bb4d633e 100644 +--- a/drivers/mmc/host/sdhci-esdhc.h ++++ b/drivers/mmc/host/sdhci-esdhc.h +@@ -51,6 +51,11 @@ + #define ESDHC_CLOCK_HCKEN 0x00000002 + #define ESDHC_CLOCK_IPGEN 0x00000001 + ++/* System Control 2 Register */ ++#define ESDHC_SYSTEM_CONTROL_2 0x3c ++#define ESDHC_SMPCLKSEL 0x00800000 ++#define ESDHC_EXTN 0x00400000 ++ + /* Host Controller Capabilities Register 2 */ + #define ESDHC_CAPABILITIES_1 0x114 + +@@ -59,7 +64,16 @@ + #define ESDHC_HS400_WNDW_ADJUST 0x00000040 + #define ESDHC_HS400_MODE 0x00000010 + #define ESDHC_TB_EN 0x00000004 ++#define ESDHC_TB_MODE_MASK 0x00000003 ++#define ESDHC_TB_MODE_SW 0x00000003 ++#define ESDHC_TB_MODE_3 0x00000002 ++ ++#define ESDHC_TBSTAT 0x124 ++ + #define ESDHC_TBPTR 0x128 ++#define ESDHC_WNDW_STRT_PTR_SHIFT 8 ++#define ESDHC_WNDW_STRT_PTR_MASK (0x7f << 8) ++#define ESDHC_WNDW_END_PTR_MASK 0x7f + + /* SD Clock Control Register */ + #define ESDHC_SDCLKCTL 0x144 +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 889ed98ec0e7..fcfb50f84c8b 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -77,8 +77,11 @@ struct sdhci_esdhc { + bool quirk_incorrect_hostver; + bool quirk_limited_clk_division; + bool quirk_unreliable_pulse_detection; +- bool quirk_fixup_tuning; ++ bool quirk_tuning_erratum_type1; ++ bool quirk_tuning_erratum_type2; + bool quirk_ignore_data_inhibit; ++ bool quirk_delay_before_data_reset; ++ bool in_sw_tuning; + unsigned int peripheral_clock; + const struct esdhc_clk_fixup *clk_fixup; + u32 div_ratio; +@@ -408,6 +411,8 @@ static void esdhc_le_writel(struct sdhci_host *host, u32 val, int reg) + + static void esdhc_be_writew(struct sdhci_host *host, u16 val, int reg) + { ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); + int base = reg & ~0x3; + u32 value; + u32 ret; +@@ -416,10 +421,24 @@ static void esdhc_be_writew(struct sdhci_host *host, u16 val, int reg) + ret = esdhc_writew_fixup(host, reg, val, value); + if (reg != SDHCI_TRANSFER_MODE) + iowrite32be(ret, host->ioaddr + base); ++ ++ /* Starting SW tuning requires ESDHC_SMPCLKSEL to be set ++ * 1us later after ESDHC_EXTN is set. ++ */ ++ if (base == ESDHC_SYSTEM_CONTROL_2) { ++ if (!(value & ESDHC_EXTN) && (ret & ESDHC_EXTN) && ++ esdhc->in_sw_tuning) { ++ udelay(1); ++ ret |= ESDHC_SMPCLKSEL; ++ iowrite32be(ret, host->ioaddr + base); ++ } ++ } + } + + static void esdhc_le_writew(struct sdhci_host *host, u16 val, int reg) + { ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); + int base = reg & ~0x3; + u32 value; + u32 ret; +@@ -428,6 +447,18 @@ static void esdhc_le_writew(struct sdhci_host *host, u16 val, int reg) + ret = esdhc_writew_fixup(host, reg, val, value); + if (reg != SDHCI_TRANSFER_MODE) + iowrite32(ret, host->ioaddr + base); ++ ++ /* Starting SW tuning requires ESDHC_SMPCLKSEL to be set ++ * 1us later after ESDHC_EXTN is set. ++ */ ++ if (base == ESDHC_SYSTEM_CONTROL_2) { ++ if (!(value & ESDHC_EXTN) && (ret & ESDHC_EXTN) && ++ esdhc->in_sw_tuning) { ++ udelay(1); ++ ret |= ESDHC_SMPCLKSEL; ++ iowrite32(ret, host->ioaddr + base); ++ } ++ } + } + + static void esdhc_be_writeb(struct sdhci_host *host, u8 val, int reg) +@@ -705,6 +736,11 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask) + struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); + u32 val; + ++ if (esdhc->quirk_delay_before_data_reset && ++ (mask & SDHCI_RESET_DATA) && ++ (host->flags & SDHCI_REQ_USE_DMA)) ++ mdelay(5); ++ + sdhci_reset(host, mask); + + sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); +@@ -793,16 +829,21 @@ static int esdhc_signal_voltage_switch(struct mmc_host *mmc, + } + } + +-static struct soc_device_attribute soc_fixup_tuning[] = { ++static struct soc_device_attribute soc_tuning_erratum_type1[] = { ++ { .family = "QorIQ T1023", .revision = "1.0", }, + { .family = "QorIQ T1040", .revision = "1.0", }, + { .family = "QorIQ T2080", .revision = "1.0", }, +- { .family = "QorIQ T1023", .revision = "1.0", }, + { .family = "QorIQ LS1021A", .revision = "1.0", }, +- { .family = "QorIQ LS1080A", .revision = "1.0", }, +- { .family = "QorIQ LS2080A", .revision = "1.0", }, ++ { }, ++}; ++ ++static struct soc_device_attribute soc_tuning_erratum_type2[] = { + { .family = "QorIQ LS1012A", .revision = "1.0", }, + { .family = "QorIQ LS1043A", .revision = "1.*", }, + { .family = "QorIQ LS1046A", .revision = "1.0", }, ++ { .family = "QorIQ LS1080A", .revision = "1.0", }, ++ { .family = "QorIQ LS2080A", .revision = "1.0", }, ++ { .family = "QorIQ LA1575A", .revision = "1.0", }, + { }, + }; + +@@ -826,15 +867,97 @@ static void esdhc_tuning_block_enable(struct sdhci_host *host, bool enable) + esdhc_clock_enable(host, true); + } + ++static void esdhc_prepare_sw_tuning(struct sdhci_host *host, u8 *window_start, ++ u8 *window_end) ++{ ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); ++ u8 tbstat_15_8, tbstat_7_0; ++ u32 val; ++ ++ if (esdhc->quirk_tuning_erratum_type1) { ++ *window_start = 5 * esdhc->div_ratio; ++ *window_end = 3 * esdhc->div_ratio; ++ return; ++ } ++ ++ /* Write TBCTL[11:8]=4'h8 */ ++ val = sdhci_readl(host, ESDHC_TBCTL); ++ val &= ~(0xf << 8); ++ val |= 8 << 8; ++ sdhci_writel(host, val, ESDHC_TBCTL); ++ ++ mdelay(1); ++ ++ /* Read TBCTL[31:0] register and rewrite again */ ++ val = sdhci_readl(host, ESDHC_TBCTL); ++ sdhci_writel(host, val, ESDHC_TBCTL); ++ ++ mdelay(1); ++ ++ /* Read the TBSTAT[31:0] register twice */ ++ val = sdhci_readl(host, ESDHC_TBSTAT); ++ val = sdhci_readl(host, ESDHC_TBSTAT); ++ ++ /* Reset data lines by setting ESDHCCTL[RSTD] */ ++ sdhci_reset(host, SDHCI_RESET_DATA); ++ /* Write 32'hFFFF_FFFF to IRQSTAT register */ ++ sdhci_writel(host, 0xFFFFFFFF, SDHCI_INT_STATUS); ++ ++ /* If TBSTAT[15:8]-TBSTAT[7:0] > 4 * div_ratio ++ * or TBSTAT[7:0]-TBSTAT[15:8] > 4 * div_ratio, ++ * then program TBPTR[TB_WNDW_END_PTR] = 4 * div_ratio ++ * and program TBPTR[TB_WNDW_START_PTR] = 8 * div_ratio. ++ */ ++ tbstat_7_0 = val & 0xff; ++ tbstat_15_8 = (val >> 8) & 0xff; ++ ++ if (abs(tbstat_15_8 - tbstat_7_0) > (4 * esdhc->div_ratio)) { ++ *window_start = 8 * esdhc->div_ratio; ++ *window_end = 4 * esdhc->div_ratio; ++ } else { ++ *window_start = 5 * esdhc->div_ratio; ++ *window_end = 3 * esdhc->div_ratio; ++ } ++} ++ ++static int esdhc_execute_sw_tuning(struct mmc_host *mmc, u32 opcode, ++ u8 window_start, u8 window_end) ++{ ++ struct sdhci_host *host = mmc_priv(mmc); ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); ++ u32 val; ++ int ret; ++ ++ /* Program TBPTR[TB_WNDW_END_PTR] and TBPTR[TB_WNDW_START_PTR] */ ++ val = ((u32)window_start << ESDHC_WNDW_STRT_PTR_SHIFT) & ++ ESDHC_WNDW_STRT_PTR_MASK; ++ val |= window_end & ESDHC_WNDW_END_PTR_MASK; ++ sdhci_writel(host, val, ESDHC_TBPTR); ++ ++ /* Program the software tuning mode by setting TBCTL[TB_MODE]=2'h3 */ ++ val = sdhci_readl(host, ESDHC_TBCTL); ++ val &= ~ESDHC_TB_MODE_MASK; ++ val |= ESDHC_TB_MODE_SW; ++ sdhci_writel(host, val, ESDHC_TBCTL); ++ ++ esdhc->in_sw_tuning = true; ++ ret = sdhci_execute_tuning(mmc, opcode); ++ esdhc->in_sw_tuning = false; ++ return ret; ++} ++ + static int esdhc_execute_tuning(struct mmc_host *mmc, u32 opcode) + { + struct sdhci_host *host = mmc_priv(mmc); + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); ++ u8 window_start, window_end; ++ int ret, retries = 1; + bool hs400_tuning; + unsigned int clk; + u32 val; +- int ret; + + /* For tuning mode, the sd clock divisor value + * must be larger than 3 according to reference manual. +@@ -843,39 +966,73 @@ static int esdhc_execute_tuning(struct mmc_host *mmc, u32 opcode) + if (host->clock > clk) + esdhc_of_set_clock(host, clk); + +- if (esdhc->quirk_limited_clk_division && +- host->flags & SDHCI_HS400_TUNING) +- esdhc_of_set_clock(host, host->clock); +- + esdhc_tuning_block_enable(host, true); + + hs400_tuning = host->flags & SDHCI_HS400_TUNING; +- ret = sdhci_execute_tuning(mmc, opcode); + +- if (hs400_tuning) { +- val = sdhci_readl(host, ESDHC_SDTIMNGCTL); +- val |= ESDHC_FLW_CTL_BG; +- sdhci_writel(host, val, ESDHC_SDTIMNGCTL); +- } ++ do { ++ if (esdhc->quirk_limited_clk_division && ++ hs400_tuning) ++ esdhc_of_set_clock(host, host->clock); + +- if (host->tuning_err == -EAGAIN && esdhc->quirk_fixup_tuning) { ++ /* Do HW tuning */ ++ val = sdhci_readl(host, ESDHC_TBCTL); ++ val &= ~ESDHC_TB_MODE_MASK; ++ val |= ESDHC_TB_MODE_3; ++ sdhci_writel(host, val, ESDHC_TBCTL); + +- /* program TBPTR[TB_WNDW_END_PTR] = 3*DIV_RATIO and +- * program TBPTR[TB_WNDW_START_PTR] = 5*DIV_RATIO +- */ +- val = sdhci_readl(host, ESDHC_TBPTR); +- val = (val & ~((0x7f << 8) | 0x7f)) | +- (3 * esdhc->div_ratio) | ((5 * esdhc->div_ratio) << 8); +- sdhci_writel(host, val, ESDHC_TBPTR); ++ ret = sdhci_execute_tuning(mmc, opcode); ++ if (ret) ++ break; + +- /* program the software tuning mode by setting +- * TBCTL[TB_MODE]=2'h3 ++ /* If HW tuning fails and triggers erratum, ++ * try workaround. + */ +- val = sdhci_readl(host, ESDHC_TBCTL); +- val |= 0x3; +- sdhci_writel(host, val, ESDHC_TBCTL); +- sdhci_execute_tuning(mmc, opcode); ++ ret = host->tuning_err; ++ if (ret == -EAGAIN && ++ (esdhc->quirk_tuning_erratum_type1 || ++ esdhc->quirk_tuning_erratum_type2)) { ++ /* Recover HS400 tuning flag */ ++ if (hs400_tuning) ++ host->flags |= SDHCI_HS400_TUNING; ++ pr_info("%s: Hold on to use fixed sampling clock. Try SW tuning!\n", ++ mmc_hostname(mmc)); ++ /* Do SW tuning */ ++ esdhc_prepare_sw_tuning(host, &window_start, ++ &window_end); ++ ret = esdhc_execute_sw_tuning(mmc, opcode, ++ window_start, ++ window_end); ++ if (ret) ++ break; ++ ++ /* Retry both HW/SW tuning with reduced clock. */ ++ ret = host->tuning_err; ++ if (ret == -EAGAIN && retries) { ++ /* Recover HS400 tuning flag */ ++ if (hs400_tuning) ++ host->flags |= SDHCI_HS400_TUNING; ++ ++ clk = host->max_clk / (esdhc->div_ratio + 1); ++ esdhc_of_set_clock(host, clk); ++ pr_info("%s: Hold on to use fixed sampling clock. Try tuning with reduced clock!\n", ++ mmc_hostname(mmc)); ++ } else { ++ break; ++ } ++ } else { ++ break; ++ } ++ } while (retries--); ++ ++ if (ret) { ++ esdhc_tuning_block_enable(host, false); ++ } else if (hs400_tuning) { ++ val = sdhci_readl(host, ESDHC_SDTIMNGCTL); ++ val |= ESDHC_FLW_CTL_BG; ++ sdhci_writel(host, val, ESDHC_SDTIMNGCTL); + } ++ + return ret; + } + +@@ -1046,6 +1203,10 @@ static void esdhc_init(struct platform_device *pdev, struct sdhci_host *host) + if (match) + esdhc->clk_fixup = match->data; + np = pdev->dev.of_node; ++ ++ if (of_device_is_compatible(np, "fsl,p2020-esdhc")) ++ esdhc->quirk_delay_before_data_reset = true; ++ + clk = of_clk_get(np, 0); + if (!IS_ERR(clk)) { + /* +@@ -1111,10 +1272,15 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) + + pltfm_host = sdhci_priv(host); + esdhc = sdhci_pltfm_priv(pltfm_host); +- if (soc_device_match(soc_fixup_tuning)) +- esdhc->quirk_fixup_tuning = true; ++ if (soc_device_match(soc_tuning_erratum_type1)) ++ esdhc->quirk_tuning_erratum_type1 = true; ++ else ++ esdhc->quirk_tuning_erratum_type1 = false; ++ ++ if (soc_device_match(soc_tuning_erratum_type2)) ++ esdhc->quirk_tuning_erratum_type2 = true; + else +- esdhc->quirk_fixup_tuning = false; ++ esdhc->quirk_tuning_erratum_type2 = false; + + if (esdhc->vendor_ver == VENDOR_V_22) + host->quirks2 |= SDHCI_QUIRK2_HOST_NO_CMD23; +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index face00c622ed..7dcd709f4ac3 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2225,9 +2225,6 @@ static void bond_miimon_commit(struct bonding *bond) + } else if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) { + /* make it immediately active */ + bond_set_active_slave(slave); +- } else if (slave != primary) { +- /* prevent it from being the active one */ +- bond_set_backup_slave(slave); + } + + slave_info(bond->dev, slave->dev, "link status definitely up, %u Mbps %s duplex\n", +diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c +index d264776a95a3..471837cf0b21 100644 +--- a/drivers/net/dsa/bcm_sf2_cfp.c ++++ b/drivers/net/dsa/bcm_sf2_cfp.c +@@ -358,7 +358,7 @@ static int bcm_sf2_cfp_ipv4_rule_set(struct bcm_sf2_priv *priv, int port, + return -EINVAL; + } + +- ip_frag = be32_to_cpu(fs->m_ext.data[0]); ++ ip_frag = !!(be32_to_cpu(fs->h_ext.data[0]) & 1); + + /* Locate the first rule available */ + if (fs->location == RX_CLS_LOC_ANY) +@@ -569,7 +569,7 @@ static int bcm_sf2_cfp_rule_cmp(struct bcm_sf2_priv *priv, int port, + + if (rule->fs.flow_type != fs->flow_type || + rule->fs.ring_cookie != fs->ring_cookie || +- rule->fs.m_ext.data[0] != fs->m_ext.data[0]) ++ rule->fs.h_ext.data[0] != fs->h_ext.data[0]) + continue; + + switch (fs->flow_type & ~FLOW_EXT) { +@@ -621,7 +621,7 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port, + return -EINVAL; + } + +- ip_frag = be32_to_cpu(fs->m_ext.data[0]); ++ ip_frag = !!(be32_to_cpu(fs->h_ext.data[0]) & 1); + + layout = &udf_tcpip6_layout; + slice_num = bcm_sf2_get_slice_number(layout, 0); +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 4e5a428ab1a4..7763221286d4 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -1560,8 +1560,8 @@ static int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled) + + if (enabled) { + /* Enable VLAN filtering. */ +- tpid = ETH_P_8021AD; +- tpid2 = ETH_P_8021Q; ++ tpid = ETH_P_8021Q; ++ tpid2 = ETH_P_8021AD; + } else { + /* Disable VLAN filtering. */ + tpid = ETH_P_SJA1105; +@@ -1570,9 +1570,9 @@ static int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled) + + table = &priv->static_config.tables[BLK_IDX_GENERAL_PARAMS]; + general_params = table->entries; +- /* EtherType used to identify outer tagged (S-tag) VLAN traffic */ +- general_params->tpid = tpid; + /* EtherType used to identify inner tagged (C-tag) VLAN traffic */ ++ general_params->tpid = tpid; ++ /* EtherType used to identify outer tagged (S-tag) VLAN traffic */ + general_params->tpid2 = tpid2; + /* When VLAN filtering is on, we need to at least be able to + * decode management traffic through the "backup plan". +diff --git a/drivers/net/dsa/sja1105/sja1105_static_config.c b/drivers/net/dsa/sja1105/sja1105_static_config.c +index 0d03e13e9909..63d2311817c4 100644 +--- a/drivers/net/dsa/sja1105/sja1105_static_config.c ++++ b/drivers/net/dsa/sja1105/sja1105_static_config.c +@@ -142,6 +142,9 @@ static size_t sja1105et_general_params_entry_packing(void *buf, void *entry_ptr, + return size; + } + ++/* TPID and TPID2 are intentionally reversed so that semantic ++ * compatibility with E/T is kept. ++ */ + static size_t + sja1105pqrs_general_params_entry_packing(void *buf, void *entry_ptr, + enum packing_op op) +@@ -166,9 +169,9 @@ sja1105pqrs_general_params_entry_packing(void *buf, void *entry_ptr, + sja1105_packing(buf, &entry->mirr_port, 141, 139, size, op); + sja1105_packing(buf, &entry->vlmarker, 138, 107, size, op); + sja1105_packing(buf, &entry->vlmask, 106, 75, size, op); +- sja1105_packing(buf, &entry->tpid, 74, 59, size, op); ++ sja1105_packing(buf, &entry->tpid2, 74, 59, size, op); + sja1105_packing(buf, &entry->ignore2stf, 58, 58, size, op); +- sja1105_packing(buf, &entry->tpid2, 57, 42, size, op); ++ sja1105_packing(buf, &entry->tpid, 57, 42, size, op); + sja1105_packing(buf, &entry->queue_ts, 41, 41, size, op); + sja1105_packing(buf, &entry->egrmirrvid, 40, 29, size, op); + sja1105_packing(buf, &entry->egrmirrpcp, 28, 26, size, op); +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index c487d2a7d6dd..b4a145220aba 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1238,8 +1238,8 @@ static int ena_io_poll(struct napi_struct *napi, int budget) + struct ena_napi *ena_napi = container_of(napi, struct ena_napi, napi); + struct ena_ring *tx_ring, *rx_ring; + +- u32 tx_work_done; +- u32 rx_work_done; ++ int tx_work_done; ++ int rx_work_done = 0; + int tx_budget; + int napi_comp_call = 0; + int ret; +@@ -1256,7 +1256,11 @@ static int ena_io_poll(struct napi_struct *napi, int budget) + } + + tx_work_done = ena_clean_tx_irq(tx_ring, tx_budget); +- rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget); ++ /* On netpoll the budget is zero and the handler should only clean the ++ * tx completions. ++ */ ++ if (likely(budget)) ++ rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget); + + /* If the device is about to reset or down, avoid unmask + * the interrupt and return 0 so NAPI won't reschedule +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 527e1bf93116..5c75b061243f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1995,6 +1995,9 @@ static int bnxt_async_event_process(struct bnxt *bp, + case ASYNC_EVENT_CMPL_EVENT_ID_RESET_NOTIFY: { + u32 data1 = le32_to_cpu(cmpl->event_data1); + ++ if (!bp->fw_health) ++ goto async_event_process_exit; ++ + bp->fw_reset_timestamp = jiffies; + bp->fw_reset_min_dsecs = cmpl->timestamp_lo; + if (!bp->fw_reset_min_dsecs) +@@ -4438,8 +4441,9 @@ static int bnxt_hwrm_func_drv_rgtr(struct bnxt *bp) + FUNC_DRV_RGTR_REQ_ENABLES_VER); + + req.os_type = cpu_to_le16(FUNC_DRV_RGTR_REQ_OS_TYPE_LINUX); +- flags = FUNC_DRV_RGTR_REQ_FLAGS_16BIT_VER_MODE | +- FUNC_DRV_RGTR_REQ_FLAGS_HOT_RESET_SUPPORT; ++ flags = FUNC_DRV_RGTR_REQ_FLAGS_16BIT_VER_MODE; ++ if (bp->fw_cap & BNXT_FW_CAP_HOT_RESET) ++ flags |= FUNC_DRV_RGTR_REQ_FLAGS_HOT_RESET_SUPPORT; + if (bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY) + flags |= FUNC_DRV_RGTR_REQ_FLAGS_ERROR_RECOVERY_SUPPORT; + req.flags = cpu_to_le32(flags); +@@ -6174,7 +6178,7 @@ static void bnxt_hwrm_set_coal_params(struct bnxt *bp, + tmr = bnxt_usec_to_coal_tmr(bp, hw_coal->coal_ticks_irq); + val = clamp_t(u16, tmr, 1, + coal_cap->cmpl_aggr_dma_tmr_during_int_max); +- req->cmpl_aggr_dma_tmr_during_int = cpu_to_le16(tmr); ++ req->cmpl_aggr_dma_tmr_during_int = cpu_to_le16(val); + req->enables |= + cpu_to_le16(BNXT_COAL_CMPL_AGGR_TMR_DURING_INT_ENABLE); + } +@@ -7096,14 +7100,6 @@ static int bnxt_hwrm_error_recovery_qcfg(struct bnxt *bp) + rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); + if (rc) + goto err_recovery_out; +- if (!fw_health) { +- fw_health = kzalloc(sizeof(*fw_health), GFP_KERNEL); +- bp->fw_health = fw_health; +- if (!fw_health) { +- rc = -ENOMEM; +- goto err_recovery_out; +- } +- } + fw_health->flags = le32_to_cpu(resp->flags); + if ((fw_health->flags & ERROR_RECOVERY_QCFG_RESP_FLAGS_CO_CPU) && + !(bp->fw_cap & BNXT_FW_CAP_KONG_MB_CHNL)) { +@@ -8766,6 +8762,9 @@ static int bnxt_hwrm_if_change(struct bnxt *bp, bool up) + } + if (resc_reinit || fw_reset) { + if (fw_reset) { ++ bnxt_free_ctx_mem(bp); ++ kfree(bp->ctx); ++ bp->ctx = NULL; + rc = bnxt_fw_init_one(bp); + if (rc) { + set_bit(BNXT_STATE_ABORT_ERR, &bp->state); +@@ -9954,8 +9953,7 @@ static void bnxt_fw_health_check(struct bnxt *bp) + struct bnxt_fw_health *fw_health = bp->fw_health; + u32 val; + +- if (!fw_health || !fw_health->enabled || +- test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) ++ if (!fw_health->enabled || test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) + return; + + if (fw_health->tmr_counter) { +@@ -10416,6 +10414,23 @@ static void bnxt_init_dflt_coal(struct bnxt *bp) + bp->stats_coal_ticks = BNXT_DEF_STATS_COAL_TICKS; + } + ++static void bnxt_alloc_fw_health(struct bnxt *bp) ++{ ++ if (bp->fw_health) ++ return; ++ ++ if (!(bp->fw_cap & BNXT_FW_CAP_HOT_RESET) && ++ !(bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY)) ++ return; ++ ++ bp->fw_health = kzalloc(sizeof(*bp->fw_health), GFP_KERNEL); ++ if (!bp->fw_health) { ++ netdev_warn(bp->dev, "Failed to allocate fw_health\n"); ++ bp->fw_cap &= ~BNXT_FW_CAP_HOT_RESET; ++ bp->fw_cap &= ~BNXT_FW_CAP_ERROR_RECOVERY; ++ } ++} ++ + static int bnxt_fw_init_one_p1(struct bnxt *bp) + { + int rc; +@@ -10462,6 +10477,7 @@ static int bnxt_fw_init_one_p2(struct bnxt *bp) + netdev_warn(bp->dev, "hwrm query adv flow mgnt failure rc: %d\n", + rc); + ++ bnxt_alloc_fw_health(bp); + rc = bnxt_hwrm_error_recovery_qcfg(bp); + if (rc) + netdev_warn(bp->dev, "hwrm query error recovery failure rc: %d\n", +@@ -10547,6 +10563,12 @@ static int bnxt_fw_init_one(struct bnxt *bp) + rc = bnxt_approve_mac(bp, bp->dev->dev_addr, false); + if (rc) + return rc; ++ ++ /* In case fw capabilities have changed, destroy the unneeded ++ * reporters and create newly capable ones. ++ */ ++ bnxt_dl_fw_reporters_destroy(bp, false); ++ bnxt_dl_fw_reporters_create(bp); + bnxt_fw_init_one_p3(bp); + return 0; + } +@@ -10680,8 +10702,7 @@ static void bnxt_fw_reset_task(struct work_struct *work) + bnxt_queue_fw_reset_work(bp, bp->fw_reset_min_dsecs * HZ / 10); + return; + case BNXT_FW_RESET_STATE_ENABLE_DEV: +- if (test_bit(BNXT_STATE_FW_FATAL_COND, &bp->state) && +- bp->fw_health) { ++ if (test_bit(BNXT_STATE_FW_FATAL_COND, &bp->state)) { + u32 val; + + val = bnxt_fw_health_readl(bp, +@@ -11322,11 +11343,11 @@ static void bnxt_remove_one(struct pci_dev *pdev) + struct net_device *dev = pci_get_drvdata(pdev); + struct bnxt *bp = netdev_priv(dev); + +- if (BNXT_PF(bp)) { ++ if (BNXT_PF(bp)) + bnxt_sriov_disable(bp); +- bnxt_dl_unregister(bp); +- } + ++ bnxt_dl_fw_reporters_destroy(bp, true); ++ bnxt_dl_unregister(bp); + pci_disable_pcie_error_reporting(pdev); + unregister_netdev(dev); + bnxt_shutdown_tc(bp); +@@ -11341,6 +11362,8 @@ static void bnxt_remove_one(struct pci_dev *pdev) + bnxt_dcb_free(bp); + kfree(bp->edev); + bp->edev = NULL; ++ kfree(bp->fw_health); ++ bp->fw_health = NULL; + bnxt_cleanup_pci(bp); + bnxt_free_ctx_mem(bp); + kfree(bp->ctx); +@@ -11820,8 +11843,8 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + if (rc) + goto init_err_cleanup_tc; + +- if (BNXT_PF(bp)) +- bnxt_dl_register(bp); ++ bnxt_dl_register(bp); ++ bnxt_dl_fw_reporters_create(bp); + + netdev_info(dev, "%s found at mem %lx, node addr %pM\n", + board_info[ent->driver_data].name, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 5163bb848618..dc26e3ace43f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1658,6 +1658,7 @@ struct bnxt { + #define BNXT_FW_CAP_PCIE_STATS_SUPPORTED 0x00020000 + #define BNXT_FW_CAP_EXT_STATS_SUPPORTED 0x00040000 + #define BNXT_FW_CAP_ERR_RECOVER_RELOAD 0x00100000 ++ #define BNXT_FW_CAP_HOT_RESET 0x00200000 + + #define BNXT_NEW_RM(bp) ((bp)->fw_cap & BNXT_FW_CAP_NEW_RM) + u32 hwrm_spec_code; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +index 7d2cfea05737..1e236e74ff2f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -19,11 +19,10 @@ static int bnxt_fw_reporter_diagnose(struct devlink_health_reporter *reporter, + struct devlink_fmsg *fmsg) + { + struct bnxt *bp = devlink_health_reporter_priv(reporter); +- struct bnxt_fw_health *health = bp->fw_health; + u32 val, health_status; + int rc; + +- if (!health || test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) ++ if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) + return 0; + + val = bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG); +@@ -103,21 +102,15 @@ struct devlink_health_reporter_ops bnxt_dl_fw_fatal_reporter_ops = { + .recover = bnxt_fw_fatal_recover, + }; + +-static void bnxt_dl_fw_reporters_create(struct bnxt *bp) ++void bnxt_dl_fw_reporters_create(struct bnxt *bp) + { + struct bnxt_fw_health *health = bp->fw_health; + +- if (!health) ++ if (!bp->dl || !health) + return; + +- health->fw_reporter = +- devlink_health_reporter_create(bp->dl, &bnxt_dl_fw_reporter_ops, +- 0, false, bp); +- if (IS_ERR(health->fw_reporter)) { +- netdev_warn(bp->dev, "Failed to create FW health reporter, rc = %ld\n", +- PTR_ERR(health->fw_reporter)); +- health->fw_reporter = NULL; +- } ++ if (!(bp->fw_cap & BNXT_FW_CAP_HOT_RESET) || health->fw_reset_reporter) ++ goto err_recovery; + + health->fw_reset_reporter = + devlink_health_reporter_create(bp->dl, +@@ -127,8 +120,30 @@ static void bnxt_dl_fw_reporters_create(struct bnxt *bp) + netdev_warn(bp->dev, "Failed to create FW fatal health reporter, rc = %ld\n", + PTR_ERR(health->fw_reset_reporter)); + health->fw_reset_reporter = NULL; ++ bp->fw_cap &= ~BNXT_FW_CAP_HOT_RESET; ++ } ++ ++err_recovery: ++ if (!(bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY)) ++ return; ++ ++ if (!health->fw_reporter) { ++ health->fw_reporter = ++ devlink_health_reporter_create(bp->dl, ++ &bnxt_dl_fw_reporter_ops, ++ 0, false, bp); ++ if (IS_ERR(health->fw_reporter)) { ++ netdev_warn(bp->dev, "Failed to create FW health reporter, rc = %ld\n", ++ PTR_ERR(health->fw_reporter)); ++ health->fw_reporter = NULL; ++ bp->fw_cap &= ~BNXT_FW_CAP_ERROR_RECOVERY; ++ return; ++ } + } + ++ if (health->fw_fatal_reporter) ++ return; ++ + health->fw_fatal_reporter = + devlink_health_reporter_create(bp->dl, + &bnxt_dl_fw_fatal_reporter_ops, +@@ -137,24 +152,35 @@ static void bnxt_dl_fw_reporters_create(struct bnxt *bp) + netdev_warn(bp->dev, "Failed to create FW fatal health reporter, rc = %ld\n", + PTR_ERR(health->fw_fatal_reporter)); + health->fw_fatal_reporter = NULL; ++ bp->fw_cap &= ~BNXT_FW_CAP_ERROR_RECOVERY; + } + } + +-static void bnxt_dl_fw_reporters_destroy(struct bnxt *bp) ++void bnxt_dl_fw_reporters_destroy(struct bnxt *bp, bool all) + { + struct bnxt_fw_health *health = bp->fw_health; + +- if (!health) ++ if (!bp->dl || !health) + return; + +- if (health->fw_reporter) +- devlink_health_reporter_destroy(health->fw_reporter); +- +- if (health->fw_reset_reporter) ++ if ((all || !(bp->fw_cap & BNXT_FW_CAP_HOT_RESET)) && ++ health->fw_reset_reporter) { + devlink_health_reporter_destroy(health->fw_reset_reporter); ++ health->fw_reset_reporter = NULL; ++ } + +- if (health->fw_fatal_reporter) ++ if ((bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY) && !all) ++ return; ++ ++ if (health->fw_reporter) { ++ devlink_health_reporter_destroy(health->fw_reporter); ++ health->fw_reporter = NULL; ++ } ++ ++ if (health->fw_fatal_reporter) { + devlink_health_reporter_destroy(health->fw_fatal_reporter); ++ health->fw_fatal_reporter = NULL; ++ } + } + + void bnxt_devlink_health_report(struct bnxt *bp, unsigned long event) +@@ -162,9 +188,6 @@ void bnxt_devlink_health_report(struct bnxt *bp, unsigned long event) + struct bnxt_fw_health *fw_health = bp->fw_health; + struct bnxt_fw_reporter_ctx fw_reporter_ctx; + +- if (!fw_health) +- return; +- + fw_reporter_ctx.sp_event = event; + switch (event) { + case BNXT_FW_RESET_NOTIFY_SP_EVENT: +@@ -203,6 +226,8 @@ static const struct devlink_ops bnxt_dl_ops = { + #endif /* CONFIG_BNXT_SRIOV */ + }; + ++static const struct devlink_ops bnxt_vf_dl_ops; ++ + enum bnxt_dl_param_id { + BNXT_DEVLINK_PARAM_ID_BASE = DEVLINK_PARAM_GENERIC_ID_MAX, + BNXT_DEVLINK_PARAM_ID_GRE_VER_CHECK, +@@ -416,7 +441,10 @@ int bnxt_dl_register(struct bnxt *bp) + return -ENOTSUPP; + } + +- dl = devlink_alloc(&bnxt_dl_ops, sizeof(struct bnxt_dl)); ++ if (BNXT_PF(bp)) ++ dl = devlink_alloc(&bnxt_dl_ops, sizeof(struct bnxt_dl)); ++ else ++ dl = devlink_alloc(&bnxt_vf_dl_ops, sizeof(struct bnxt_dl)); + if (!dl) { + netdev_warn(bp->dev, "devlink_alloc failed"); + return -ENOMEM; +@@ -435,6 +463,9 @@ int bnxt_dl_register(struct bnxt *bp) + goto err_dl_free; + } + ++ if (!BNXT_PF(bp)) ++ return 0; ++ + rc = devlink_params_register(dl, bnxt_dl_params, + ARRAY_SIZE(bnxt_dl_params)); + if (rc) { +@@ -462,8 +493,6 @@ int bnxt_dl_register(struct bnxt *bp) + + devlink_params_publish(dl); + +- bnxt_dl_fw_reporters_create(bp); +- + return 0; + + err_dl_port_unreg: +@@ -486,12 +515,14 @@ void bnxt_dl_unregister(struct bnxt *bp) + if (!dl) + return; + +- bnxt_dl_fw_reporters_destroy(bp); +- devlink_port_params_unregister(&bp->dl_port, bnxt_dl_port_params, +- ARRAY_SIZE(bnxt_dl_port_params)); +- devlink_port_unregister(&bp->dl_port); +- devlink_params_unregister(dl, bnxt_dl_params, +- ARRAY_SIZE(bnxt_dl_params)); ++ if (BNXT_PF(bp)) { ++ devlink_port_params_unregister(&bp->dl_port, ++ bnxt_dl_port_params, ++ ARRAY_SIZE(bnxt_dl_port_params)); ++ devlink_port_unregister(&bp->dl_port); ++ devlink_params_unregister(dl, bnxt_dl_params, ++ ARRAY_SIZE(bnxt_dl_params)); ++ } + devlink_unregister(dl); + devlink_free(dl); + } +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h +index 2f4fd0a7d04b..689c47ab2155 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h +@@ -57,6 +57,8 @@ struct bnxt_dl_nvm_param { + }; + + void bnxt_devlink_health_report(struct bnxt *bp, unsigned long event); ++void bnxt_dl_fw_reporters_create(struct bnxt *bp); ++void bnxt_dl_fw_reporters_destroy(struct bnxt *bp, bool all); + int bnxt_dl_register(struct bnxt *bp); + void bnxt_dl_unregister(struct bnxt *bp); + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 89f95428556e..ece70f61c89a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -3064,8 +3064,15 @@ static int bnxt_hwrm_dbg_dma_data(struct bnxt *bp, void *msg, int msg_len, + } + } + +- if (info->dest_buf) +- memcpy(info->dest_buf + off, dma_buf, len); ++ if (info->dest_buf) { ++ if ((info->seg_start + off + len) <= ++ BNXT_COREDUMP_BUF_LEN(info->buf_len)) { ++ memcpy(info->dest_buf + off, dma_buf, len); ++ } else { ++ rc = -ENOBUFS; ++ break; ++ } ++ } + + if (cmn_req->req_type == + cpu_to_le16(HWRM_DBG_COREDUMP_RETRIEVE)) +@@ -3119,7 +3126,7 @@ static int bnxt_hwrm_dbg_coredump_initiate(struct bnxt *bp, u16 component_id, + + static int bnxt_hwrm_dbg_coredump_retrieve(struct bnxt *bp, u16 component_id, + u16 segment_id, u32 *seg_len, +- void *buf, u32 offset) ++ void *buf, u32 buf_len, u32 offset) + { + struct hwrm_dbg_coredump_retrieve_input req = {0}; + struct bnxt_hwrm_dbg_dma_info info = {NULL}; +@@ -3134,8 +3141,11 @@ static int bnxt_hwrm_dbg_coredump_retrieve(struct bnxt *bp, u16 component_id, + seq_no); + info.data_len_off = offsetof(struct hwrm_dbg_coredump_retrieve_output, + data_len); +- if (buf) ++ if (buf) { + info.dest_buf = buf + offset; ++ info.buf_len = buf_len; ++ info.seg_start = offset; ++ } + + rc = bnxt_hwrm_dbg_dma_data(bp, &req, sizeof(req), &info); + if (!rc) +@@ -3225,14 +3235,17 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record, + static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len) + { + u32 ver_get_resp_len = sizeof(struct hwrm_ver_get_output); ++ u32 offset = 0, seg_hdr_len, seg_record_len, buf_len = 0; + struct coredump_segment_record *seg_record = NULL; +- u32 offset = 0, seg_hdr_len, seg_record_len; + struct bnxt_coredump_segment_hdr seg_hdr; + struct bnxt_coredump coredump = {NULL}; + time64_t start_time; + u16 start_utc; + int rc = 0, i; + ++ if (buf) ++ buf_len = *dump_len; ++ + start_time = ktime_get_real_seconds(); + start_utc = sys_tz.tz_minuteswest * 60; + seg_hdr_len = sizeof(seg_hdr); +@@ -3265,6 +3278,12 @@ static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len) + u32 duration = 0, seg_len = 0; + unsigned long start, end; + ++ if (buf && ((offset + seg_hdr_len) > ++ BNXT_COREDUMP_BUF_LEN(buf_len))) { ++ rc = -ENOBUFS; ++ goto err; ++ } ++ + start = jiffies; + + rc = bnxt_hwrm_dbg_coredump_initiate(bp, comp_id, seg_id); +@@ -3277,9 +3296,11 @@ static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len) + + /* Write segment data into the buffer */ + rc = bnxt_hwrm_dbg_coredump_retrieve(bp, comp_id, seg_id, +- &seg_len, buf, ++ &seg_len, buf, buf_len, + offset + seg_hdr_len); +- if (rc) ++ if (rc && rc == -ENOBUFS) ++ goto err; ++ else if (rc) + netdev_err(bp->dev, + "Failed to retrieve coredump for seg = %d\n", + seg_record->segment_id); +@@ -3309,7 +3330,8 @@ err: + rc); + kfree(coredump.data); + *dump_len += sizeof(struct bnxt_coredump_record); +- ++ if (rc == -ENOBUFS) ++ netdev_err(bp->dev, "Firmware returned large coredump buffer"); + return rc; + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h +index b5b65b3f8534..3998f6e809a9 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h +@@ -31,6 +31,8 @@ struct bnxt_coredump { + u16 total_segs; + }; + ++#define BNXT_COREDUMP_BUF_LEN(len) ((len) - sizeof(struct bnxt_coredump_record)) ++ + struct bnxt_hwrm_dbg_dma_info { + void *dest_buf; + int dest_buf_size; +@@ -38,6 +40,8 @@ struct bnxt_hwrm_dbg_dma_info { + u16 seq_off; + u16 data_len_off; + u16 segs; ++ u32 seg_start; ++ u32 buf_len; + }; + + struct hwrm_dbg_cmn_input { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +index b2c160947fc8..30816ec4fa91 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +@@ -113,8 +113,10 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id, + { + struct net_device *dev = edev->net; + struct bnxt *bp = netdev_priv(dev); ++ struct bnxt_hw_resc *hw_resc; + int max_idx, max_cp_rings; + int avail_msix, idx; ++ int total_vecs; + int rc = 0; + + ASSERT_RTNL(); +@@ -142,7 +144,10 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id, + } + edev->ulp_tbl[ulp_id].msix_base = idx; + edev->ulp_tbl[ulp_id].msix_requested = avail_msix; +- if (bp->total_irqs < (idx + avail_msix)) { ++ hw_resc = &bp->hw_resc; ++ total_vecs = idx + avail_msix; ++ if (bp->total_irqs < total_vecs || ++ (BNXT_NEW_RM(bp) && hw_resc->resv_irqs < total_vecs)) { + if (netif_running(dev)) { + bnxt_close_nic(bp, true, false); + rc = bnxt_open_nic(bp, true, false); +@@ -156,7 +161,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id, + } + + if (BNXT_NEW_RM(bp)) { +- struct bnxt_hw_resc *hw_resc = &bp->hw_resc; + int resv_msix; + + resv_msix = hw_resc->resv_irqs - bp->cp_nr_rings; +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h +index 1fbb640e896a..4025a683fa7d 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h +@@ -503,6 +503,7 @@ struct link_config { + + enum cc_pause requested_fc; /* flow control user has requested */ + enum cc_pause fc; /* actual link flow control */ ++ enum cc_pause advertised_fc; /* actual advertised flow control */ + + enum cc_fec requested_fec; /* Forward Error Correction: */ + enum cc_fec fec; /* requested and actual in use */ +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c +index 76538f4cd595..f537be9cb315 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c +@@ -793,8 +793,8 @@ static void get_pauseparam(struct net_device *dev, + struct port_info *p = netdev_priv(dev); + + epause->autoneg = (p->link_cfg.requested_fc & PAUSE_AUTONEG) != 0; +- epause->rx_pause = (p->link_cfg.fc & PAUSE_RX) != 0; +- epause->tx_pause = (p->link_cfg.fc & PAUSE_TX) != 0; ++ epause->rx_pause = (p->link_cfg.advertised_fc & PAUSE_RX) != 0; ++ epause->tx_pause = (p->link_cfg.advertised_fc & PAUSE_TX) != 0; + } + + static int set_pauseparam(struct net_device *dev, +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index f2a7824da42b..3f6813daf3c1 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -4089,7 +4089,8 @@ static inline fw_port_cap32_t cc_to_fwcap_pause(enum cc_pause cc_pause) + if (cc_pause & PAUSE_TX) + fw_pause |= FW_PORT_CAP32_802_3_PAUSE; + else +- fw_pause |= FW_PORT_CAP32_802_3_ASM_DIR; ++ fw_pause |= FW_PORT_CAP32_802_3_ASM_DIR | ++ FW_PORT_CAP32_802_3_PAUSE; + } else if (cc_pause & PAUSE_TX) { + fw_pause |= FW_PORT_CAP32_802_3_ASM_DIR; + } +@@ -8563,17 +8564,17 @@ static fw_port_cap32_t lstatus_to_fwcap(u32 lstatus) + void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl) + { + const struct fw_port_cmd *cmd = (const void *)rpl; +- int action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); +- struct adapter *adapter = pi->adapter; ++ fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; + struct link_config *lc = &pi->link_cfg; +- int link_ok, linkdnrc; +- enum fw_port_type port_type; ++ struct adapter *adapter = pi->adapter; ++ unsigned int speed, fc, fec, adv_fc; + enum fw_port_module_type mod_type; +- unsigned int speed, fc, fec; +- fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; ++ int action, link_ok, linkdnrc; ++ enum fw_port_type port_type; + + /* Extract the various fields from the Port Information message. + */ ++ action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); + switch (action) { + case FW_PORT_ACTION_GET_PORT_INFO: { + u32 lstatus = be32_to_cpu(cmd->u.info.lstatus_to_modtype); +@@ -8611,6 +8612,7 @@ void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl) + } + + fec = fwcap_to_cc_fec(acaps); ++ adv_fc = fwcap_to_cc_pause(acaps); + fc = fwcap_to_cc_pause(linkattr); + speed = fwcap_to_speed(linkattr); + +@@ -8667,7 +8669,9 @@ void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl) + } + + if (link_ok != lc->link_ok || speed != lc->speed || +- fc != lc->fc || fec != lc->fec) { /* something changed */ ++ fc != lc->fc || adv_fc != lc->advertised_fc || ++ fec != lc->fec) { ++ /* something changed */ + if (!link_ok && lc->link_ok) { + lc->link_down_rc = linkdnrc; + dev_warn_ratelimited(adapter->pdev_dev, +@@ -8677,6 +8681,7 @@ void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl) + } + lc->link_ok = link_ok; + lc->speed = speed; ++ lc->advertised_fc = adv_fc; + lc->fc = fc; + lc->fec = fec; + +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +index f6fc0875d5b0..f4d41f968afa 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +@@ -1690,8 +1690,8 @@ static void cxgb4vf_get_pauseparam(struct net_device *dev, + struct port_info *pi = netdev_priv(dev); + + pauseparam->autoneg = (pi->link_cfg.requested_fc & PAUSE_AUTONEG) != 0; +- pauseparam->rx_pause = (pi->link_cfg.fc & PAUSE_RX) != 0; +- pauseparam->tx_pause = (pi->link_cfg.fc & PAUSE_TX) != 0; ++ pauseparam->rx_pause = (pi->link_cfg.advertised_fc & PAUSE_RX) != 0; ++ pauseparam->tx_pause = (pi->link_cfg.advertised_fc & PAUSE_TX) != 0; + } + + /* +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h +index ccca67cf4487..57cfd10a99ec 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h +@@ -135,6 +135,7 @@ struct link_config { + + enum cc_pause requested_fc; /* flow control user has requested */ + enum cc_pause fc; /* actual link flow control */ ++ enum cc_pause advertised_fc; /* actual advertised flow control */ + + enum cc_fec auto_fec; /* Forward Error Correction: */ + enum cc_fec requested_fec; /* "automatic" (IEEE 802.3), */ +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c +index 8a389d617a23..9d49ff211cc1 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c +@@ -1913,16 +1913,16 @@ static const char *t4vf_link_down_rc_str(unsigned char link_down_rc) + static void t4vf_handle_get_port_info(struct port_info *pi, + const struct fw_port_cmd *cmd) + { +- int action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); +- struct adapter *adapter = pi->adapter; ++ fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; + struct link_config *lc = &pi->link_cfg; +- int link_ok, linkdnrc; +- enum fw_port_type port_type; ++ struct adapter *adapter = pi->adapter; ++ unsigned int speed, fc, fec, adv_fc; + enum fw_port_module_type mod_type; +- unsigned int speed, fc, fec; +- fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; ++ int action, link_ok, linkdnrc; ++ enum fw_port_type port_type; + + /* Extract the various fields from the Port Information message. */ ++ action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); + switch (action) { + case FW_PORT_ACTION_GET_PORT_INFO: { + u32 lstatus = be32_to_cpu(cmd->u.info.lstatus_to_modtype); +@@ -1982,6 +1982,7 @@ static void t4vf_handle_get_port_info(struct port_info *pi, + } + + fec = fwcap_to_cc_fec(acaps); ++ adv_fc = fwcap_to_cc_pause(acaps); + fc = fwcap_to_cc_pause(linkattr); + speed = fwcap_to_speed(linkattr); + +@@ -2012,7 +2013,9 @@ static void t4vf_handle_get_port_info(struct port_info *pi, + } + + if (link_ok != lc->link_ok || speed != lc->speed || +- fc != lc->fc || fec != lc->fec) { /* something changed */ ++ fc != lc->fc || adv_fc != lc->advertised_fc || ++ fec != lc->fec) { ++ /* something changed */ + if (!link_ok && lc->link_ok) { + lc->link_down_rc = linkdnrc; + dev_warn_ratelimited(adapter->pdev_dev, +@@ -2022,6 +2025,7 @@ static void t4vf_handle_get_port_info(struct port_info *pi, + } + lc->link_ok = link_ok; + lc->speed = speed; ++ lc->advertised_fc = adv_fc; + lc->fc = fc; + lc->fec = fec; + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 111b3b8239e1..ef44c6979a31 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -3674,7 +3674,7 @@ static int mvpp2_open(struct net_device *dev) + valid = true; + } + +- if (priv->hw_version == MVPP22 && port->link_irq && !port->phylink) { ++ if (priv->hw_version == MVPP22 && port->link_irq) { + err = request_irq(port->link_irq, mvpp2_link_status_isr, 0, + dev->name, port); + if (err) { +diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c +index 544344ac4894..79057af4fe99 100644 +--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c ++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include "mlxfw_mfa2.h" + #include "mlxfw_mfa2_file.h" +@@ -548,7 +549,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file, + comp_size = be32_to_cpu(comp->size); + comp_buf_size = comp_size + mlxfw_mfa2_comp_magic_len; + +- comp_data = kmalloc(sizeof(*comp_data) + comp_buf_size, GFP_KERNEL); ++ comp_data = vzalloc(sizeof(*comp_data) + comp_buf_size); + if (!comp_data) + return ERR_PTR(-ENOMEM); + comp_data->comp.data_size = comp_size; +@@ -570,7 +571,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file, + comp_data->comp.data = comp_data->buff + mlxfw_mfa2_comp_magic_len; + return &comp_data->comp; + err_out: +- kfree(comp_data); ++ vfree(comp_data); + return ERR_PTR(err); + } + +@@ -579,7 +580,7 @@ void mlxfw_mfa2_file_component_put(struct mlxfw_mfa2_component *comp) + const struct mlxfw_mfa2_comp_data *comp_data; + + comp_data = container_of(comp, struct mlxfw_mfa2_comp_data, comp); +- kfree(comp_data); ++ vfree(comp_data); + } + + void mlxfw_mfa2_file_fini(struct mlxfw_mfa2_file *mfa2_file) +diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h +index 5494cf93f34c..8e42ebdbd487 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h +@@ -5421,6 +5421,7 @@ enum mlxsw_reg_htgt_trap_group { + MLXSW_REG_HTGT_TRAP_GROUP_SP_LBERROR, + MLXSW_REG_HTGT_TRAP_GROUP_SP_PTP0, + MLXSW_REG_HTGT_TRAP_GROUP_SP_PTP1, ++ MLXSW_REG_HTGT_TRAP_GROUP_SP_VRRP, + + __MLXSW_REG_HTGT_TRAP_GROUP_MAX, + MLXSW_REG_HTGT_TRAP_GROUP_MAX = __MLXSW_REG_HTGT_TRAP_GROUP_MAX - 1 +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index dcf9562bce8a..3ec18fb0d479 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -4398,8 +4398,8 @@ static const struct mlxsw_listener mlxsw_sp_listener[] = { + MLXSW_SP_RXL_MARK(ROUTER_ALERT_IPV6, TRAP_TO_CPU, ROUTER_EXP, false), + MLXSW_SP_RXL_MARK(IPIP_DECAP_ERROR, TRAP_TO_CPU, ROUTER_EXP, false), + MLXSW_SP_RXL_MARK(DECAP_ECN0, TRAP_TO_CPU, ROUTER_EXP, false), +- MLXSW_SP_RXL_MARK(IPV4_VRRP, TRAP_TO_CPU, ROUTER_EXP, false), +- MLXSW_SP_RXL_MARK(IPV6_VRRP, TRAP_TO_CPU, ROUTER_EXP, false), ++ MLXSW_SP_RXL_MARK(IPV4_VRRP, TRAP_TO_CPU, VRRP, false), ++ MLXSW_SP_RXL_MARK(IPV6_VRRP, TRAP_TO_CPU, VRRP, false), + /* PKT Sample trap */ + MLXSW_RXL(mlxsw_sp_rx_listener_sample_func, PKT_SAMPLE, MIRROR_TO_CPU, + false, SP_IP2ME, DISCARD), +@@ -4483,6 +4483,10 @@ static int mlxsw_sp_cpu_policers_set(struct mlxsw_core *mlxsw_core) + rate = 19 * 1024; + burst_size = 12; + break; ++ case MLXSW_REG_HTGT_TRAP_GROUP_SP_VRRP: ++ rate = 360; ++ burst_size = 7; ++ break; + default: + continue; + } +@@ -4522,6 +4526,7 @@ static int mlxsw_sp_trap_groups_set(struct mlxsw_core *mlxsw_core) + case MLXSW_REG_HTGT_TRAP_GROUP_SP_OSPF: + case MLXSW_REG_HTGT_TRAP_GROUP_SP_PIM: + case MLXSW_REG_HTGT_TRAP_GROUP_SP_PTP0: ++ case MLXSW_REG_HTGT_TRAP_GROUP_SP_VRRP: + priority = 5; + tc = 5; + break; +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 210ebc91d3d6..efdf8cb5114c 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -6985,6 +6985,9 @@ static int mlxsw_sp_router_port_check_rif_addr(struct mlxsw_sp *mlxsw_sp, + + for (i = 0; i < MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_RIFS); i++) { + rif = mlxsw_sp->router->rifs[i]; ++ if (rif && rif->ops && ++ rif->ops->type == MLXSW_SP_RIF_TYPE_IPIP_LB) ++ continue; + if (rif && rif->dev && rif->dev != dev && + !ether_addr_equal_masked(rif->dev->dev_addr, dev_addr, + mlxsw_sp->mac_mask)) { +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +index 306da8f6b7d5..33ce139f090f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +@@ -112,6 +112,14 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac) + struct device *dev = dwmac->dev; + const char *parent_name, *mux_parent_names[MUX_CLK_NUM_PARENTS]; + struct meson8b_dwmac_clk_configs *clk_configs; ++ static const struct clk_div_table div_table[] = { ++ { .div = 2, .val = 2, }, ++ { .div = 3, .val = 3, }, ++ { .div = 4, .val = 4, }, ++ { .div = 5, .val = 5, }, ++ { .div = 6, .val = 6, }, ++ { .div = 7, .val = 7, }, ++ }; + + clk_configs = devm_kzalloc(dev, sizeof(*clk_configs), GFP_KERNEL); + if (!clk_configs) +@@ -146,9 +154,9 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac) + clk_configs->m250_div.reg = dwmac->regs + PRG_ETH0; + clk_configs->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT; + clk_configs->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH; +- clk_configs->m250_div.flags = CLK_DIVIDER_ONE_BASED | +- CLK_DIVIDER_ALLOW_ZERO | +- CLK_DIVIDER_ROUND_CLOSEST; ++ clk_configs->m250_div.table = div_table; ++ clk_configs->m250_div.flags = CLK_DIVIDER_ALLOW_ZERO | ++ CLK_DIVIDER_ROUND_CLOSEST; + clk = meson8b_dwmac_register_clk(dwmac, "m250_div", &parent_name, 1, + &clk_divider_ops, + &clk_configs->m250_div.hw); +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index ecfe26215935..fca471e27f39 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -38,7 +38,6 @@ struct pdp_ctx { + struct hlist_node hlist_addr; + + union { +- u64 tid; + struct { + u64 tid; + u16 flow; +@@ -541,7 +540,7 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev, + mtu = dst_mtu(&rt->dst); + } + +- rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu); ++ rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu, false); + + if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) && + mtu < ntohs(iph->tot_len)) { +@@ -641,9 +640,16 @@ static void gtp_link_setup(struct net_device *dev) + } + + static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize); +-static void gtp_hashtable_free(struct gtp_dev *gtp); + static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]); + ++static void gtp_destructor(struct net_device *dev) ++{ ++ struct gtp_dev *gtp = netdev_priv(dev); ++ ++ kfree(gtp->addr_hash); ++ kfree(gtp->tid_hash); ++} ++ + static int gtp_newlink(struct net *src_net, struct net_device *dev, + struct nlattr *tb[], struct nlattr *data[], + struct netlink_ext_ack *extack) +@@ -661,10 +667,13 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, + if (err < 0) + return err; + +- if (!data[IFLA_GTP_PDP_HASHSIZE]) ++ if (!data[IFLA_GTP_PDP_HASHSIZE]) { + hashsize = 1024; +- else ++ } else { + hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]); ++ if (!hashsize) ++ hashsize = 1024; ++ } + + err = gtp_hashtable_new(gtp, hashsize); + if (err < 0) +@@ -678,13 +687,15 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, + + gn = net_generic(dev_net(dev), gtp_net_id); + list_add_rcu(>p->list, &gn->gtp_dev_list); ++ dev->priv_destructor = gtp_destructor; + + netdev_dbg(dev, "registered new GTP interface\n"); + + return 0; + + out_hashtable: +- gtp_hashtable_free(gtp); ++ kfree(gtp->addr_hash); ++ kfree(gtp->tid_hash); + out_encap: + gtp_encap_disable(gtp); + return err; +@@ -693,8 +704,13 @@ out_encap: + static void gtp_dellink(struct net_device *dev, struct list_head *head) + { + struct gtp_dev *gtp = netdev_priv(dev); ++ struct pdp_ctx *pctx; ++ int i; ++ ++ for (i = 0; i < gtp->hash_size; i++) ++ hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) ++ pdp_context_delete(pctx); + +- gtp_hashtable_free(gtp); + list_del_rcu(>p->list); + unregister_netdevice_queue(dev, head); + } +@@ -772,20 +788,6 @@ err1: + return -ENOMEM; + } + +-static void gtp_hashtable_free(struct gtp_dev *gtp) +-{ +- struct pdp_ctx *pctx; +- int i; +- +- for (i = 0; i < gtp->hash_size; i++) +- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) +- pdp_context_delete(pctx); +- +- synchronize_rcu(); +- kfree(gtp->addr_hash); +- kfree(gtp->tid_hash); +-} +- + static struct sock *gtp_encap_enable_socket(int fd, int type, + struct gtp_dev *gtp) + { +@@ -926,24 +928,31 @@ static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info) + } + } + +-static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, +- struct genl_info *info) ++static int gtp_pdp_add(struct gtp_dev *gtp, struct sock *sk, ++ struct genl_info *info) + { ++ struct pdp_ctx *pctx, *pctx_tid = NULL; + struct net_device *dev = gtp->dev; + u32 hash_ms, hash_tid = 0; +- struct pdp_ctx *pctx; ++ unsigned int version; + bool found = false; + __be32 ms_addr; + + ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]); + hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size; ++ version = nla_get_u32(info->attrs[GTPA_VERSION]); + +- hlist_for_each_entry_rcu(pctx, >p->addr_hash[hash_ms], hlist_addr) { +- if (pctx->ms_addr_ip4.s_addr == ms_addr) { +- found = true; +- break; +- } +- } ++ pctx = ipv4_pdp_find(gtp, ms_addr); ++ if (pctx) ++ found = true; ++ if (version == GTP_V0) ++ pctx_tid = gtp0_pdp_find(gtp, ++ nla_get_u64(info->attrs[GTPA_TID])); ++ else if (version == GTP_V1) ++ pctx_tid = gtp1_pdp_find(gtp, ++ nla_get_u32(info->attrs[GTPA_I_TEI])); ++ if (pctx_tid) ++ found = true; + + if (found) { + if (info->nlhdr->nlmsg_flags & NLM_F_EXCL) +@@ -951,6 +960,11 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, + if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE) + return -EOPNOTSUPP; + ++ if (pctx && pctx_tid) ++ return -EEXIST; ++ if (!pctx) ++ pctx = pctx_tid; ++ + ipv4_pdp_fill(pctx, info); + + if (pctx->gtp_version == GTP_V0) +@@ -1074,7 +1088,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) + goto out_unlock; + } + +- err = ipv4_pdp_add(gtp, sk, info); ++ err = gtp_pdp_add(gtp, sk, info); + + out_unlock: + rcu_read_unlock(); +@@ -1232,43 +1246,46 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb, + struct netlink_callback *cb) + { + struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp; ++ int i, j, bucket = cb->args[0], skip = cb->args[1]; + struct net *net = sock_net(skb->sk); +- struct gtp_net *gn = net_generic(net, gtp_net_id); +- unsigned long tid = cb->args[1]; +- int i, k = cb->args[0], ret; + struct pdp_ctx *pctx; ++ struct gtp_net *gn; ++ ++ gn = net_generic(net, gtp_net_id); + + if (cb->args[4]) + return 0; + ++ rcu_read_lock(); + list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) { + if (last_gtp && last_gtp != gtp) + continue; + else + last_gtp = NULL; + +- for (i = k; i < gtp->hash_size; i++) { +- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) { +- if (tid && tid != pctx->u.tid) +- continue; +- else +- tid = 0; +- +- ret = gtp_genl_fill_info(skb, +- NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- cb->nlh->nlmsg_type, pctx); +- if (ret < 0) { ++ for (i = bucket; i < gtp->hash_size; i++) { ++ j = 0; ++ hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], ++ hlist_tid) { ++ if (j >= skip && ++ gtp_genl_fill_info(skb, ++ NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ cb->nlh->nlmsg_type, pctx)) { + cb->args[0] = i; +- cb->args[1] = pctx->u.tid; ++ cb->args[1] = j; + cb->args[2] = (unsigned long)gtp; + goto out; + } ++ j++; + } ++ skip = 0; + } ++ bucket = 0; + } + cb->args[4] = 1; + out: ++ rcu_read_unlock(); + return skb->len; + } + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index 23281aeeb222..71d6629e65c9 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -654,10 +654,10 @@ static void sixpack_close(struct tty_struct *tty) + { + struct sixpack *sp; + +- write_lock_bh(&disc_data_lock); ++ write_lock_irq(&disc_data_lock); + sp = tty->disc_data; + tty->disc_data = NULL; +- write_unlock_bh(&disc_data_lock); ++ write_unlock_irq(&disc_data_lock); + if (!sp) + return; + +diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c +index c5bfa19ddb93..deef14215110 100644 +--- a/drivers/net/hamradio/mkiss.c ++++ b/drivers/net/hamradio/mkiss.c +@@ -773,10 +773,10 @@ static void mkiss_close(struct tty_struct *tty) + { + struct mkiss *ax; + +- write_lock_bh(&disc_data_lock); ++ write_lock_irq(&disc_data_lock); + ax = tty->disc_data; + tty->disc_data = NULL; +- write_unlock_bh(&disc_data_lock); ++ write_unlock_irq(&disc_data_lock); + + if (!ax) + return; +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index abaf8156d19d..e3d3c9097ff1 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -1165,6 +1165,9 @@ int rndis_set_subchannel(struct net_device *ndev, + wait_event(nvdev->subchan_open, + atomic_read(&nvdev->open_chn) == nvdev->num_chn); + ++ for (i = 0; i < VRSS_SEND_TAB_SIZE; i++) ++ ndev_ctx->tx_table[i] = i % nvdev->num_chn; ++ + /* ignore failures from setting rss parameters, still have channels */ + if (dev_info) + rndis_filter_set_rss_param(rdev, dev_info->rss_key); +@@ -1174,9 +1177,6 @@ int rndis_set_subchannel(struct net_device *ndev, + netif_set_real_num_tx_queues(ndev, nvdev->num_chn); + netif_set_real_num_rx_queues(ndev, nvdev->num_chn); + +- for (i = 0; i < VRSS_SEND_TAB_SIZE; i++) +- ndev_ctx->tx_table[i] = i % nvdev->num_chn; +- + return 0; + } + +diff --git a/drivers/net/phy/aquantia_main.c b/drivers/net/phy/aquantia_main.c +index 3b29d381116f..975789d9349d 100644 +--- a/drivers/net/phy/aquantia_main.c ++++ b/drivers/net/phy/aquantia_main.c +@@ -627,6 +627,8 @@ static struct phy_driver aqr_driver[] = { + .config_intr = aqr_config_intr, + .ack_interrupt = aqr_ack_interrupt, + .read_status = aqr_read_status, ++ .suspend = aqr107_suspend, ++ .resume = aqr107_resume, + }, + { + PHY_ID_MATCH_MODEL(PHY_ID_AQR106), +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 536236fdb232..bf5bbb565cf5 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -444,8 +444,7 @@ static void phylink_mac_link_up(struct phylink *pl, + + pl->cur_interface = link_state.interface; + pl->ops->mac_link_up(pl->config, pl->link_an_mode, +- pl->phy_state.interface, +- pl->phydev); ++ pl->cur_interface, pl->phydev); + + if (ndev) + netif_carrier_on(ndev); +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 040cec17d3ad..b0b7eca1754e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -1111,18 +1111,18 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + /* same thing for QuZ... */ + if (iwl_trans->hw_rev == CSR_HW_REV_TYPE_QUZ) { +- if (iwl_trans->cfg == &iwl_ax101_cfg_qu_hr) +- iwl_trans->cfg = &iwl_ax101_cfg_quz_hr; +- else if (iwl_trans->cfg == &iwl_ax201_cfg_qu_hr) +- iwl_trans->cfg = &iwl_ax201_cfg_quz_hr; +- else if (iwl_trans->cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0) +- iwl_trans->cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc; +- else if (iwl_trans->cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0) +- iwl_trans->cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc; +- else if (iwl_trans->cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0) +- iwl_trans->cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc; +- else if (iwl_trans->cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0) +- iwl_trans->cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc; ++ if (cfg == &iwl_ax101_cfg_qu_hr) ++ cfg = &iwl_ax101_cfg_quz_hr; ++ else if (cfg == &iwl_ax201_cfg_qu_hr) ++ cfg = &iwl_ax201_cfg_quz_hr; ++ else if (cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0) ++ cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc; ++ else if (cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0) ++ cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc; ++ else if (cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0) ++ cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc; ++ else if (cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0) ++ cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc; + } + + #endif +diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c +index 3e9f45aec8d1..5129543a0473 100644 +--- a/drivers/nvdimm/btt.c ++++ b/drivers/nvdimm/btt.c +@@ -1261,11 +1261,11 @@ static int btt_read_pg(struct btt *btt, struct bio_integrity_payload *bip, + + ret = btt_data_read(arena, page, off, postmap, cur_len); + if (ret) { +- int rc; +- + /* Media error - set the e_flag */ +- rc = btt_map_write(arena, premap, postmap, 0, 1, +- NVDIMM_IO_ATOMIC); ++ if (btt_map_write(arena, premap, postmap, 0, 1, NVDIMM_IO_ATOMIC)) ++ dev_warn_ratelimited(to_dev(arena), ++ "Error persistently tracking bad blocks at %#x\n", ++ premap); + goto out_rtt; + } + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 92e895d86458..ca7823eef2b4 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -1146,8 +1146,10 @@ static void attach_node_and_children(struct device_node *np) + full_name = kasprintf(GFP_KERNEL, "%pOF", np); + + if (!strcmp(full_name, "/__local_fixups__") || +- !strcmp(full_name, "/__fixups__")) ++ !strcmp(full_name, "/__fixups__")) { ++ kfree(full_name); + return; ++ } + + dup = of_find_node_by_path(full_name); + kfree(full_name); +diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c +index 18627bb21e9e..32eab1776cfe 100644 +--- a/drivers/pci/hotplug/rpaphp_core.c ++++ b/drivers/pci/hotplug/rpaphp_core.c +@@ -154,11 +154,11 @@ static enum pci_bus_speed get_max_bus_speed(struct slot *slot) + return speed; + } + +-static int get_children_props(struct device_node *dn, const int **drc_indexes, +- const int **drc_names, const int **drc_types, +- const int **drc_power_domains) ++static int get_children_props(struct device_node *dn, const __be32 **drc_indexes, ++ const __be32 **drc_names, const __be32 **drc_types, ++ const __be32 **drc_power_domains) + { +- const int *indexes, *names, *types, *domains; ++ const __be32 *indexes, *names, *types, *domains; + + indexes = of_get_property(dn, "ibm,drc-indexes", NULL); + names = of_get_property(dn, "ibm,drc-names", NULL); +@@ -194,8 +194,8 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name, + char *drc_type, unsigned int my_index) + { + char *name_tmp, *type_tmp; +- const int *indexes, *names; +- const int *types, *domains; ++ const __be32 *indexes, *names; ++ const __be32 *types, *domains; + int i, rc; + + rc = get_children_props(dn->parent, &indexes, &names, &types, &domains); +@@ -208,7 +208,7 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name, + + /* Iterate through parent properties, looking for my-drc-index */ + for (i = 0; i < be32_to_cpu(indexes[0]); i++) { +- if ((unsigned int) indexes[i + 1] == my_index) ++ if (be32_to_cpu(indexes[i + 1]) == my_index) + break; + + name_tmp += (strlen(name_tmp) + 1); +@@ -239,6 +239,8 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name, + value = of_prop_next_u32(info, NULL, &entries); + if (!value) + return -EINVAL; ++ else ++ value++; + + for (j = 0; j < entries; j++) { + of_read_drc_info_cell(&info, &value, &drc); +@@ -246,9 +248,10 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name, + /* Should now know end of current entry */ + + /* Found it */ +- if (my_index <= drc.last_drc_index) { ++ if (my_index >= drc.drc_index_start && my_index <= drc.last_drc_index) { ++ int index = my_index - drc.drc_index_start; + sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix, +- my_index); ++ drc.drc_name_suffix_start + index); + break; + } + } +@@ -265,7 +268,7 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name, + int rpaphp_check_drc_props(struct device_node *dn, char *drc_name, + char *drc_type) + { +- const unsigned int *my_index; ++ const __be32 *my_index; + + my_index = of_get_property(dn, "ibm,my-drc-index", NULL); + if (!my_index) { +@@ -273,12 +276,12 @@ int rpaphp_check_drc_props(struct device_node *dn, char *drc_name, + return -EINVAL; + } + +- if (firmware_has_feature(FW_FEATURE_DRC_INFO)) ++ if (of_find_property(dn->parent, "ibm,drc-info", NULL)) + return rpaphp_check_drc_props_v2(dn, drc_name, drc_type, +- *my_index); ++ be32_to_cpu(*my_index)); + else + return rpaphp_check_drc_props_v1(dn, drc_name, drc_type, +- *my_index); ++ be32_to_cpu(*my_index)); + } + EXPORT_SYMBOL_GPL(rpaphp_check_drc_props); + +@@ -309,10 +312,11 @@ static int is_php_type(char *drc_type) + * for built-in pci slots (even when the built-in slots are + * dlparable.) + */ +-static int is_php_dn(struct device_node *dn, const int **indexes, +- const int **names, const int **types, const int **power_domains) ++static int is_php_dn(struct device_node *dn, const __be32 **indexes, ++ const __be32 **names, const __be32 **types, ++ const __be32 **power_domains) + { +- const int *drc_types; ++ const __be32 *drc_types; + int rc; + + rc = get_children_props(dn, indexes, names, &drc_types, power_domains); +@@ -347,7 +351,7 @@ int rpaphp_add_slot(struct device_node *dn) + struct slot *slot; + int retval = 0; + int i; +- const int *indexes, *names, *types, *power_domains; ++ const __be32 *indexes, *names, *types, *power_domains; + char *name, *type; + + if (!dn->name || strcmp(dn->name, "pci")) +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index ae21d08c65e8..1cab99320514 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -806,7 +806,6 @@ config PEAQ_WMI + tristate "PEAQ 2-in-1 WMI hotkey driver" + depends on ACPI_WMI + depends on INPUT +- select INPUT_POLLDEV + help + Say Y here if you want to support WMI-based hotkeys on PEAQ 2-in-1s. + +diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c +index 94a008efb09b..571b4754477c 100644 +--- a/drivers/platform/x86/intel_pmc_core.c ++++ b/drivers/platform/x86/intel_pmc_core.c +@@ -158,8 +158,9 @@ static const struct pmc_reg_map spt_reg_map = { + .pm_vric1_offset = SPT_PMC_VRIC1_OFFSET, + }; + +-/* Cannonlake: PGD PFET Enable Ack Status Register(s) bitmap */ ++/* Cannon Lake: PGD PFET Enable Ack Status Register(s) bitmap */ + static const struct pmc_bit_map cnp_pfear_map[] = { ++ /* Reserved for Cannon Lake but valid for Comet Lake */ + {"PMC", BIT(0)}, + {"OPI-DMI", BIT(1)}, + {"SPI/eSPI", BIT(2)}, +@@ -185,7 +186,7 @@ static const struct pmc_bit_map cnp_pfear_map[] = { + {"SDX", BIT(4)}, + {"SPE", BIT(5)}, + {"Fuse", BIT(6)}, +- /* Reserved for Cannonlake but valid for Icelake */ ++ /* Reserved for Cannon Lake but valid for Ice Lake and Comet Lake */ + {"SBR8", BIT(7)}, + + {"CSME_FSC", BIT(0)}, +@@ -229,12 +230,12 @@ static const struct pmc_bit_map cnp_pfear_map[] = { + {"HDA_PGD4", BIT(2)}, + {"HDA_PGD5", BIT(3)}, + {"HDA_PGD6", BIT(4)}, +- /* Reserved for Cannonlake but valid for Icelake */ ++ /* Reserved for Cannon Lake but valid for Ice Lake and Comet Lake */ + {"PSF6", BIT(5)}, + {"PSF7", BIT(6)}, + {"PSF8", BIT(7)}, + +- /* Icelake generation onwards only */ ++ /* Ice Lake generation onwards only */ + {"RES_65", BIT(0)}, + {"RES_66", BIT(1)}, + {"RES_67", BIT(2)}, +@@ -324,7 +325,7 @@ static const struct pmc_bit_map cnp_ltr_show_map[] = { + {"ISH", CNP_PMC_LTR_ISH}, + {"UFSX2", CNP_PMC_LTR_UFSX2}, + {"EMMC", CNP_PMC_LTR_EMMC}, +- /* Reserved for Cannonlake but valid for Icelake */ ++ /* Reserved for Cannon Lake but valid for Ice Lake */ + {"WIGIG", ICL_PMC_LTR_WIGIG}, + /* Below two cannot be used for LTR_IGNORE */ + {"CURRENT_PLATFORM", CNP_PMC_LTR_CUR_PLT}, +@@ -813,6 +814,8 @@ static const struct x86_cpu_id intel_pmc_core_ids[] = { + INTEL_CPU_FAM6(CANNONLAKE_L, cnp_reg_map), + INTEL_CPU_FAM6(ICELAKE_L, icl_reg_map), + INTEL_CPU_FAM6(ICELAKE_NNPI, icl_reg_map), ++ INTEL_CPU_FAM6(COMETLAKE, cnp_reg_map), ++ INTEL_CPU_FAM6(COMETLAKE_L, cnp_reg_map), + {} + }; + +@@ -871,8 +874,8 @@ static int pmc_core_probe(struct platform_device *pdev) + pmcdev->map = (struct pmc_reg_map *)cpu_id->driver_data; + + /* +- * Coffeelake has CPU ID of Kabylake and Cannonlake PCH. So here +- * Sunrisepoint PCH regmap can't be used. Use Cannonlake PCH regmap ++ * Coffee Lake has CPU ID of Kaby Lake and Cannon Lake PCH. So here ++ * Sunrisepoint PCH regmap can't be used. Use Cannon Lake PCH regmap + * in this case. + */ + if (pmcdev->map == &spt_reg_map && !pci_dev_present(pmc_pci_ids)) +diff --git a/drivers/platform/x86/peaq-wmi.c b/drivers/platform/x86/peaq-wmi.c +index fdeb3624c529..cf9c44c20a82 100644 +--- a/drivers/platform/x86/peaq-wmi.c ++++ b/drivers/platform/x86/peaq-wmi.c +@@ -6,7 +6,7 @@ + + #include + #include +-#include ++#include + #include + #include + +@@ -18,8 +18,7 @@ + + MODULE_ALIAS("wmi:"PEAQ_DOLBY_BUTTON_GUID); + +-static unsigned int peaq_ignore_events_counter; +-static struct input_polled_dev *peaq_poll_dev; ++static struct input_dev *peaq_poll_dev; + + /* + * The Dolby button (yes really a Dolby button) causes an ACPI variable to get +@@ -28,8 +27,10 @@ static struct input_polled_dev *peaq_poll_dev; + * (if polling after the release) or twice (polling between press and release). + * We ignore events for 0.5s after the first event to avoid reporting 2 presses. + */ +-static void peaq_wmi_poll(struct input_polled_dev *dev) ++static void peaq_wmi_poll(struct input_dev *input_dev) + { ++ static unsigned long last_event_time; ++ static bool had_events; + union acpi_object obj; + acpi_status status; + u32 dummy = 0; +@@ -44,22 +45,25 @@ static void peaq_wmi_poll(struct input_polled_dev *dev) + return; + + if (obj.type != ACPI_TYPE_INTEGER) { +- dev_err(&peaq_poll_dev->input->dev, ++ dev_err(&input_dev->dev, + "Error WMBC did not return an integer\n"); + return; + } + +- if (peaq_ignore_events_counter && peaq_ignore_events_counter--) ++ if (!obj.integer.value) + return; + +- if (obj.integer.value) { +- input_event(peaq_poll_dev->input, EV_KEY, KEY_SOUND, 1); +- input_sync(peaq_poll_dev->input); +- input_event(peaq_poll_dev->input, EV_KEY, KEY_SOUND, 0); +- input_sync(peaq_poll_dev->input); +- peaq_ignore_events_counter = max(1u, +- PEAQ_POLL_IGNORE_MS / peaq_poll_dev->poll_interval); +- } ++ if (had_events && time_before(jiffies, last_event_time + ++ msecs_to_jiffies(PEAQ_POLL_IGNORE_MS))) ++ return; ++ ++ input_event(input_dev, EV_KEY, KEY_SOUND, 1); ++ input_sync(input_dev); ++ input_event(input_dev, EV_KEY, KEY_SOUND, 0); ++ input_sync(input_dev); ++ ++ last_event_time = jiffies; ++ had_events = true; + } + + /* Some other devices (Shuttle XS35) use the same WMI GUID for other purposes */ +@@ -75,6 +79,8 @@ static const struct dmi_system_id peaq_dmi_table[] __initconst = { + + static int __init peaq_wmi_init(void) + { ++ int err; ++ + /* WMI GUID is not unique, also check for a DMI match */ + if (!dmi_check_system(peaq_dmi_table)) + return -ENODEV; +@@ -82,24 +88,36 @@ static int __init peaq_wmi_init(void) + if (!wmi_has_guid(PEAQ_DOLBY_BUTTON_GUID)) + return -ENODEV; + +- peaq_poll_dev = input_allocate_polled_device(); ++ peaq_poll_dev = input_allocate_device(); + if (!peaq_poll_dev) + return -ENOMEM; + +- peaq_poll_dev->poll = peaq_wmi_poll; +- peaq_poll_dev->poll_interval = PEAQ_POLL_INTERVAL_MS; +- peaq_poll_dev->poll_interval_max = PEAQ_POLL_MAX_MS; +- peaq_poll_dev->input->name = "PEAQ WMI hotkeys"; +- peaq_poll_dev->input->phys = "wmi/input0"; +- peaq_poll_dev->input->id.bustype = BUS_HOST; +- input_set_capability(peaq_poll_dev->input, EV_KEY, KEY_SOUND); ++ peaq_poll_dev->name = "PEAQ WMI hotkeys"; ++ peaq_poll_dev->phys = "wmi/input0"; ++ peaq_poll_dev->id.bustype = BUS_HOST; ++ input_set_capability(peaq_poll_dev, EV_KEY, KEY_SOUND); ++ ++ err = input_setup_polling(peaq_poll_dev, peaq_wmi_poll); ++ if (err) ++ goto err_out; ++ ++ input_set_poll_interval(peaq_poll_dev, PEAQ_POLL_INTERVAL_MS); ++ input_set_max_poll_interval(peaq_poll_dev, PEAQ_POLL_MAX_MS); ++ ++ err = input_register_device(peaq_poll_dev); ++ if (err) ++ goto err_out; ++ ++ return 0; + +- return input_register_polled_device(peaq_poll_dev); ++err_out: ++ input_free_device(peaq_poll_dev); ++ return err; + } + + static void __exit peaq_wmi_exit(void) + { +- input_unregister_polled_device(peaq_poll_dev); ++ input_unregister_device(peaq_poll_dev); + } + + module_init(peaq_wmi_init); +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c +index e60eab7f8a61..61fafe0374ce 100644 +--- a/drivers/ptp/ptp_clock.c ++++ b/drivers/ptp/ptp_clock.c +@@ -166,9 +166,9 @@ static struct posix_clock_operations ptp_clock_ops = { + .read = ptp_read, + }; + +-static void delete_ptp_clock(struct posix_clock *pc) ++static void ptp_clock_release(struct device *dev) + { +- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); ++ struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev); + + mutex_destroy(&ptp->tsevq_mux); + mutex_destroy(&ptp->pincfg_mux); +@@ -213,7 +213,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + } + + ptp->clock.ops = ptp_clock_ops; +- ptp->clock.release = delete_ptp_clock; + ptp->info = info; + ptp->devid = MKDEV(major, index); + ptp->index = index; +@@ -236,15 +235,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + if (err) + goto no_pin_groups; + +- /* Create a new device in our class. */ +- ptp->dev = device_create_with_groups(ptp_class, parent, ptp->devid, +- ptp, ptp->pin_attr_groups, +- "ptp%d", ptp->index); +- if (IS_ERR(ptp->dev)) { +- err = PTR_ERR(ptp->dev); +- goto no_device; +- } +- + /* Register a new PPS source. */ + if (info->pps) { + struct pps_source_info pps; +@@ -260,8 +250,18 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + } + } + +- /* Create a posix clock. */ +- err = posix_clock_register(&ptp->clock, ptp->devid); ++ /* Initialize a new device of our class in our clock structure. */ ++ device_initialize(&ptp->dev); ++ ptp->dev.devt = ptp->devid; ++ ptp->dev.class = ptp_class; ++ ptp->dev.parent = parent; ++ ptp->dev.groups = ptp->pin_attr_groups; ++ ptp->dev.release = ptp_clock_release; ++ dev_set_drvdata(&ptp->dev, ptp); ++ dev_set_name(&ptp->dev, "ptp%d", ptp->index); ++ ++ /* Create a posix clock and link it to the device. */ ++ err = posix_clock_register(&ptp->clock, &ptp->dev); + if (err) { + pr_err("failed to create posix clock\n"); + goto no_clock; +@@ -273,8 +273,6 @@ no_clock: + if (ptp->pps_source) + pps_unregister_source(ptp->pps_source); + no_pps: +- device_destroy(ptp_class, ptp->devid); +-no_device: + ptp_cleanup_pin_groups(ptp); + no_pin_groups: + if (ptp->kworker) +@@ -304,7 +302,6 @@ int ptp_clock_unregister(struct ptp_clock *ptp) + if (ptp->pps_source) + pps_unregister_source(ptp->pps_source); + +- device_destroy(ptp_class, ptp->devid); + ptp_cleanup_pin_groups(ptp); + + posix_clock_unregister(&ptp->clock); +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h +index 9171d42468fd..6b97155148f1 100644 +--- a/drivers/ptp/ptp_private.h ++++ b/drivers/ptp/ptp_private.h +@@ -28,7 +28,7 @@ struct timestamp_event_queue { + + struct ptp_clock { + struct posix_clock clock; +- struct device *dev; ++ struct device dev; + struct ptp_clock_info *info; + dev_t devid; + int index; /* index into clocks.map */ +diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h +index f34ee41cbed8..4f4dd9d727c9 100644 +--- a/drivers/s390/crypto/zcrypt_error.h ++++ b/drivers/s390/crypto/zcrypt_error.h +@@ -61,6 +61,7 @@ struct error_hdr { + #define REP82_ERROR_EVEN_MOD_IN_OPND 0x85 + #define REP82_ERROR_RESERVED_FIELD 0x88 + #define REP82_ERROR_INVALID_DOMAIN_PENDING 0x8A ++#define REP82_ERROR_FILTERED_BY_HYPERVISOR 0x8B + #define REP82_ERROR_TRANSPORT_FAIL 0x90 + #define REP82_ERROR_PACKET_TRUNCATED 0xA0 + #define REP82_ERROR_ZERO_BUFFER_LEN 0xB0 +@@ -91,6 +92,7 @@ static inline int convert_error(struct zcrypt_queue *zq, + case REP82_ERROR_INVALID_DOMAIN_PRECHECK: + case REP82_ERROR_INVALID_DOMAIN_PENDING: + case REP82_ERROR_INVALID_SPECIAL_CMD: ++ case REP82_ERROR_FILTERED_BY_HYPERVISOR: + // REP88_ERROR_INVALID_KEY // '82' CEX2A + // REP88_ERROR_OPERAND // '84' CEX2A + // REP88_ERROR_OPERAND_EVEN_MOD // '85' CEX2A +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index 536426f25e86..d4401c768a0c 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -129,6 +129,9 @@ + #define NCR5380_release_dma_irq(x) + #endif + ++static unsigned int disconnect_mask = ~0; ++module_param(disconnect_mask, int, 0444); ++ + static int do_abort(struct Scsi_Host *); + static void do_reset(struct Scsi_Host *); + static void bus_reset_cleanup(struct Scsi_Host *); +@@ -954,7 +957,8 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd) + int err; + bool ret = true; + bool can_disconnect = instance->irq != NO_IRQ && +- cmd->cmnd[0] != REQUEST_SENSE; ++ cmd->cmnd[0] != REQUEST_SENSE && ++ (disconnect_mask & BIT(scmd_id(cmd))); + + NCR5380_dprint(NDEBUG_ARBITRATION, instance); + dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n", +diff --git a/drivers/scsi/atari_scsi.c b/drivers/scsi/atari_scsi.c +index e809493d0d06..a82b63a66635 100644 +--- a/drivers/scsi/atari_scsi.c ++++ b/drivers/scsi/atari_scsi.c +@@ -742,7 +742,7 @@ static int __init atari_scsi_probe(struct platform_device *pdev) + atari_scsi_template.sg_tablesize = SG_ALL; + } else { + atari_scsi_template.can_queue = 1; +- atari_scsi_template.sg_tablesize = SG_NONE; ++ atari_scsi_template.sg_tablesize = 1; + } + + if (setup_can_queue > 0) +@@ -751,8 +751,8 @@ static int __init atari_scsi_probe(struct platform_device *pdev) + if (setup_cmd_per_lun > 0) + atari_scsi_template.cmd_per_lun = setup_cmd_per_lun; + +- /* Leave sg_tablesize at 0 on a Falcon! */ +- if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize >= 0) ++ /* Don't increase sg_tablesize on Falcon! */ ++ if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize > 0) + atari_scsi_template.sg_tablesize = setup_sg_tablesize; + + if (setup_hostid >= 0) { +diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c +index 66e58f0a75dc..23cbe4cda760 100644 +--- a/drivers/scsi/csiostor/csio_lnode.c ++++ b/drivers/scsi/csiostor/csio_lnode.c +@@ -301,6 +301,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + struct fc_fdmi_port_name *port_name; + uint8_t buf[64]; + uint8_t *fc4_type; ++ unsigned long flags; + + if (fdmi_req->wr_status != FW_SUCCESS) { + csio_ln_dbg(ln, "WR error:%x in processing fdmi rhba cmd\n", +@@ -385,13 +386,13 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + len = (uint32_t)(pld - (uint8_t *)cmd); + + /* Submit FDMI RPA request */ +- spin_lock_irq(&hw->lock); ++ spin_lock_irqsave(&hw->lock, flags); + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_done, + FCOE_CT, &fdmi_req->dma_buf, len)) { + CSIO_INC_STATS(ln, n_fdmi_err); + csio_ln_dbg(ln, "Failed to issue fdmi rpa req\n"); + } +- spin_unlock_irq(&hw->lock); ++ spin_unlock_irqrestore(&hw->lock, flags); + } + + /* +@@ -412,6 +413,7 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + struct fc_fdmi_rpl *reg_pl; + struct fs_fdmi_attrs *attrib_blk; + uint8_t buf[64]; ++ unsigned long flags; + + if (fdmi_req->wr_status != FW_SUCCESS) { + csio_ln_dbg(ln, "WR error:%x in processing fdmi dprt cmd\n", +@@ -491,13 +493,13 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + attrib_blk->numattrs = htonl(numattrs); + + /* Submit FDMI RHBA request */ +- spin_lock_irq(&hw->lock); ++ spin_lock_irqsave(&hw->lock, flags); + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_rhba_cbfn, + FCOE_CT, &fdmi_req->dma_buf, len)) { + CSIO_INC_STATS(ln, n_fdmi_err); + csio_ln_dbg(ln, "Failed to issue fdmi rhba req\n"); + } +- spin_unlock_irq(&hw->lock); ++ spin_unlock_irqrestore(&hw->lock, flags); + } + + /* +@@ -512,6 +514,7 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + void *cmd; + struct fc_fdmi_port_name *port_name; + uint32_t len; ++ unsigned long flags; + + if (fdmi_req->wr_status != FW_SUCCESS) { + csio_ln_dbg(ln, "WR error:%x in processing fdmi dhba cmd\n", +@@ -542,13 +545,13 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + len += sizeof(*port_name); + + /* Submit FDMI request */ +- spin_lock_irq(&hw->lock); ++ spin_lock_irqsave(&hw->lock, flags); + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_dprt_cbfn, + FCOE_CT, &fdmi_req->dma_buf, len)) { + CSIO_INC_STATS(ln, n_fdmi_err); + csio_ln_dbg(ln, "Failed to issue fdmi dprt req\n"); + } +- spin_unlock_irq(&hw->lock); ++ spin_unlock_irqrestore(&hw->lock, flags); + } + + /** +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index 0847e682797b..633effb09c9c 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -587,7 +587,13 @@ static int hisi_sas_task_exec(struct sas_task *task, gfp_t gfp_flags, + dev = hisi_hba->dev; + + if (unlikely(test_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags))) { +- if (in_softirq()) ++ /* ++ * For IOs from upper layer, it may already disable preempt ++ * in the IO path, if disable preempt again in down(), ++ * function schedule() will report schedule_bug(), so check ++ * preemptible() before goto down(). ++ */ ++ if (!preemptible()) + return -EINVAL; + + down(&hisi_hba->sem); +@@ -2676,6 +2682,7 @@ int hisi_sas_probe(struct platform_device *pdev, + err_out_register_ha: + scsi_remove_host(shost); + err_out_ha: ++ hisi_sas_debugfs_exit(hisi_hba); + hisi_sas_free(hisi_hba); + scsi_host_put(shost); + return rc; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index cb8d087762db..ef32ee12f606 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -3259,6 +3259,7 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) + err_out_register_ha: + scsi_remove_host(shost); + err_out_ha: ++ hisi_sas_debugfs_exit(hisi_hba); + scsi_host_put(shost); + err_out_regions: + pci_release_regions(pdev); +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c +index 7bedbe877704..0bc63a7ab41c 100644 +--- a/drivers/scsi/iscsi_tcp.c ++++ b/drivers/scsi/iscsi_tcp.c +@@ -369,8 +369,16 @@ static int iscsi_sw_tcp_pdu_xmit(struct iscsi_task *task) + { + struct iscsi_conn *conn = task->conn; + unsigned int noreclaim_flag; ++ struct iscsi_tcp_conn *tcp_conn = conn->dd_data; ++ struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; + int rc = 0; + ++ if (!tcp_sw_conn->sock) { ++ iscsi_conn_printk(KERN_ERR, conn, ++ "Transport not bound to socket!\n"); ++ return -EINVAL; ++ } ++ + noreclaim_flag = memalloc_noreclaim_save(); + + while (iscsi_sw_tcp_xmit_qlen(conn)) { +diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c +index 25e86706e207..f883fac2d2b1 100644 +--- a/drivers/scsi/lpfc/lpfc_ct.c ++++ b/drivers/scsi/lpfc/lpfc_ct.c +@@ -1868,6 +1868,12 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + if (irsp->ulpStatus == IOSTAT_LOCAL_REJECT) { + switch ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK)) { + case IOERR_SLI_ABORTED: ++ case IOERR_SLI_DOWN: ++ /* Driver aborted this IO. No retry as error ++ * is likely Offline->Online or some adapter ++ * error. Recovery will try again. ++ */ ++ break; + case IOERR_ABORT_IN_PROGRESS: + case IOERR_SEQUENCE_TIMEOUT: + case IOERR_ILLEGAL_FRAME: +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index d5303994bfd6..66f8867dd837 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -2236,6 +2236,7 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + struct Scsi_Host *shost = lpfc_shost_from_vport(vport); + IOCB_t *irsp; + struct lpfc_nodelist *ndlp; ++ char *mode; + + /* we pass cmdiocb to state machine which needs rspiocb as well */ + cmdiocb->context_un.rsp_iocb = rspiocb; +@@ -2273,8 +2274,17 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + goto out; + } + ++ /* If we don't send GFT_ID to Fabric, a PRLI error ++ * could be expected. ++ */ ++ if ((vport->fc_flag & FC_FABRIC) || ++ (vport->cfg_enable_fc4_type != LPFC_ENABLE_BOTH)) ++ mode = KERN_ERR; ++ else ++ mode = KERN_INFO; ++ + /* PRLI failed */ +- lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS, ++ lpfc_printf_vlog(vport, mode, LOG_ELS, + "2754 PRLI failure DID:%06X Status:x%x/x%x, " + "data: x%x\n", + ndlp->nlp_DID, irsp->ulpStatus, +@@ -4430,7 +4440,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + mempool_free(mbox, phba->mbox_mem_pool); + } + out: +- if (ndlp && NLP_CHK_NODE_ACT(ndlp)) { ++ if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) { + spin_lock_irq(shost->host_lock); + ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI); + spin_unlock_irq(shost->host_lock); +@@ -6455,7 +6465,7 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, + uint32_t payload_len, length, nportid, *cmd; + int rscn_cnt; + int rscn_id = 0, hba_id = 0; +- int i; ++ int i, tmo; + + pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; + lp = (uint32_t *) pcmd->virt; +@@ -6561,6 +6571,13 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, + + spin_lock_irq(shost->host_lock); + vport->fc_flag |= FC_RSCN_DEFERRED; ++ ++ /* Restart disctmo if its already running */ ++ if (vport->fc_flag & FC_DISC_TMO) { ++ tmo = ((phba->fc_ratov * 3) + 3); ++ mod_timer(&vport->fc_disctmo, ++ jiffies + msecs_to_jiffies(1000 * tmo)); ++ } + if ((rscn_cnt < FC_MAX_HOLD_RSCN) && + !(vport->fc_flag & FC_RSCN_DISCOVERY)) { + vport->fc_flag |= FC_RSCN_MODE; +@@ -7986,20 +8003,22 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport) + struct lpfc_sli_ring *pring; + struct lpfc_iocbq *tmp_iocb, *piocb; + IOCB_t *cmd = NULL; ++ unsigned long iflags = 0; + + lpfc_fabric_abort_vport(vport); ++ + /* + * For SLI3, only the hbalock is required. But SLI4 needs to coordinate + * with the ring insert operation. Because lpfc_sli_issue_abort_iotag + * ultimately grabs the ring_lock, the driver must splice the list into + * a working list and release the locks before calling the abort. + */ +- spin_lock_irq(&phba->hbalock); ++ spin_lock_irqsave(&phba->hbalock, iflags); + pring = lpfc_phba_elsring(phba); + + /* Bail out if we've no ELS wq, like in PCI error recovery case. */ + if (unlikely(!pring)) { +- spin_unlock_irq(&phba->hbalock); ++ spin_unlock_irqrestore(&phba->hbalock, iflags); + return; + } + +@@ -8014,6 +8033,9 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport) + if (piocb->vport != vport) + continue; + ++ if (piocb->iocb_flag & LPFC_DRIVER_ABORTED) ++ continue; ++ + /* On the ELS ring we can have ELS_REQUESTs or + * GEN_REQUESTs waiting for a response. + */ +@@ -8037,21 +8059,21 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport) + + if (phba->sli_rev == LPFC_SLI_REV4) + spin_unlock(&pring->ring_lock); +- spin_unlock_irq(&phba->hbalock); ++ spin_unlock_irqrestore(&phba->hbalock, iflags); + + /* Abort each txcmpl iocb on aborted list and remove the dlist links. */ + list_for_each_entry_safe(piocb, tmp_iocb, &abort_list, dlist) { +- spin_lock_irq(&phba->hbalock); ++ spin_lock_irqsave(&phba->hbalock, iflags); + list_del_init(&piocb->dlist); + lpfc_sli_issue_abort_iotag(phba, pring, piocb); +- spin_unlock_irq(&phba->hbalock); ++ spin_unlock_irqrestore(&phba->hbalock, iflags); + } + if (!list_empty(&abort_list)) + lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS, + "3387 abort list for txq not empty\n"); + INIT_LIST_HEAD(&abort_list); + +- spin_lock_irq(&phba->hbalock); ++ spin_lock_irqsave(&phba->hbalock, iflags); + if (phba->sli_rev == LPFC_SLI_REV4) + spin_lock(&pring->ring_lock); + +@@ -8091,7 +8113,7 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport) + + if (phba->sli_rev == LPFC_SLI_REV4) + spin_unlock(&pring->ring_lock); +- spin_unlock_irq(&phba->hbalock); ++ spin_unlock_irqrestore(&phba->hbalock, iflags); + + /* Cancel all the IOCBs from the completions list */ + lpfc_sli_cancel_iocbs(phba, &abort_list, +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index 749286acdc17..1286c658ba34 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -700,7 +700,10 @@ lpfc_work_done(struct lpfc_hba *phba) + if (!(phba->hba_flag & HBA_SP_QUEUE_EVT)) + set_bit(LPFC_DATA_READY, &phba->data_flags); + } else { +- if (phba->link_state >= LPFC_LINK_UP || ++ /* Driver could have abort request completed in queue ++ * when link goes down. Allow for this transition. ++ */ ++ if (phba->link_state >= LPFC_LINK_DOWN || + phba->link_flag & LS_MDS_LOOPBACK) { + pring->flag &= ~LPFC_DEFERRED_RING_EVENT; + lpfc_sli_handle_slow_ring_event(phba, pring, +@@ -5405,9 +5408,14 @@ lpfc_setup_disc_node(struct lpfc_vport *vport, uint32_t did) + /* If we've already received a PLOGI from this NPort + * we don't need to try to discover it again. + */ +- if (ndlp->nlp_flag & NLP_RCV_PLOGI) ++ if (ndlp->nlp_flag & NLP_RCV_PLOGI && ++ !(ndlp->nlp_type & ++ (NLP_FCP_TARGET | NLP_NVME_TARGET))) + return NULL; + ++ ndlp->nlp_prev_state = ndlp->nlp_state; ++ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE); ++ + spin_lock_irq(shost->host_lock); + ndlp->nlp_flag |= NLP_NPR_2B_DISC; + spin_unlock_irq(shost->host_lock); +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index fc6e4546d738..696171382558 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -484,8 +484,10 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + * single discovery thread, this will cause a huge delay in + * discovery. Also this will cause multiple state machines + * running in parallel for this node. ++ * This only applies to a fabric environment. + */ +- if (ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) { ++ if ((ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) && ++ (vport->fc_flag & FC_FABRIC)) { + /* software abort outstanding PLOGI */ + lpfc_els_abort(phba, ndlp); + } +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index ad8ef67a1db3..aa82d538a18a 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -4846,20 +4846,21 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd) + ret_val = __lpfc_sli_issue_iocb(phba, LPFC_FCP_RING, + abtsiocb, 0); + } +- /* no longer need the lock after this point */ +- spin_unlock_irqrestore(&phba->hbalock, flags); + + if (ret_val == IOCB_ERROR) { + /* Indicate the IO is not being aborted by the driver. */ + iocb->iocb_flag &= ~LPFC_DRIVER_ABORTED; + lpfc_cmd->waitq = NULL; + spin_unlock(&lpfc_cmd->buf_lock); ++ spin_unlock_irqrestore(&phba->hbalock, flags); + lpfc_sli_release_iocbq(phba, abtsiocb); + ret = FAILED; + goto out; + } + ++ /* no longer need the lock after this point */ + spin_unlock(&lpfc_cmd->buf_lock); ++ spin_unlock_irqrestore(&phba->hbalock, flags); + + if (phba->cfg_poll & DISABLE_FCP_RING_INT) + lpfc_sli_handle_fast_ring_event(phba, +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 5ed4219675eb..2b0e7b32c2df 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -11050,9 +11050,6 @@ lpfc_sli_abort_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + irsp->ulpStatus, irsp->un.ulpWord[4]); + + spin_unlock_irq(&phba->hbalock); +- if (irsp->ulpStatus == IOSTAT_LOCAL_REJECT && +- irsp->un.ulpWord[4] == IOERR_SLI_ABORTED) +- lpfc_sli_release_iocbq(phba, abort_iocb); + } + release_iocb: + lpfc_sli_release_iocbq(phba, cmdiocb); +@@ -13161,13 +13158,19 @@ send_current_mbox: + phba->sli.sli_flag &= ~LPFC_SLI_MBOX_ACTIVE; + /* Setting active mailbox pointer need to be in sync to flag clear */ + phba->sli.mbox_active = NULL; ++ if (bf_get(lpfc_trailer_consumed, mcqe)) ++ lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq); + spin_unlock_irqrestore(&phba->hbalock, iflags); + /* Wake up worker thread to post the next pending mailbox command */ + lpfc_worker_wake_up(phba); ++ return workposted; ++ + out_no_mqe_complete: ++ spin_lock_irqsave(&phba->hbalock, iflags); + if (bf_get(lpfc_trailer_consumed, mcqe)) + lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq); +- return workposted; ++ spin_unlock_irqrestore(&phba->hbalock, iflags); ++ return false; + } + + /** +@@ -18184,6 +18187,13 @@ lpfc_sli4_alloc_rpi(struct lpfc_hba *phba) + static void + __lpfc_sli4_free_rpi(struct lpfc_hba *phba, int rpi) + { ++ /* ++ * if the rpi value indicates a prior unreg has already ++ * been done, skip the unreg. ++ */ ++ if (rpi == LPFC_RPI_ALLOC_ERROR) ++ return; ++ + if (test_and_clear_bit(rpi, phba->sli4_hba.rpi_bmask)) { + phba->sli4_hba.rpi_count--; + phba->sli4_hba.max_cfg_param.rpi_used--; +diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c +index 9c5566217ef6..b5dde9d0d054 100644 +--- a/drivers/scsi/mac_scsi.c ++++ b/drivers/scsi/mac_scsi.c +@@ -464,7 +464,7 @@ static int __init mac_scsi_probe(struct platform_device *pdev) + mac_scsi_template.can_queue = setup_can_queue; + if (setup_cmd_per_lun > 0) + mac_scsi_template.cmd_per_lun = setup_cmd_per_lun; +- if (setup_sg_tablesize >= 0) ++ if (setup_sg_tablesize > 0) + mac_scsi_template.sg_tablesize = setup_sg_tablesize; + if (setup_hostid >= 0) + mac_scsi_template.this_id = setup_hostid & 7; +diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c +index 7d696952b376..b95f7d062ea4 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c +@@ -778,6 +778,18 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + case MPI2_FUNCTION_NVME_ENCAPSULATED: + { + nvme_encap_request = (Mpi26NVMeEncapsulatedRequest_t *)request; ++ if (!ioc->pcie_sg_lookup) { ++ dtmprintk(ioc, ioc_info(ioc, ++ "HBA doesn't support NVMe. Rejecting NVMe Encapsulated request.\n" ++ )); ++ ++ if (ioc->logging_level & MPT_DEBUG_TM) ++ _debug_dump_mf(nvme_encap_request, ++ ioc->request_sz/4); ++ mpt3sas_base_free_smid(ioc, smid); ++ ret = -EINVAL; ++ goto out; ++ } + /* + * Get the Physical Address of the sense buffer. + * Use Error Response buffer address field to hold the sense +@@ -1584,7 +1596,8 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc, + ioc_err(ioc, "%s: failed allocating memory for diag buffers, requested size(%d)\n", + __func__, request_data_sz); + mpt3sas_base_free_smid(ioc, smid); +- return -ENOMEM; ++ rc = -ENOMEM; ++ goto out; + } + ioc->diag_buffer[buffer_type] = request_data; + ioc->diag_buffer_sz[buffer_type] = request_data_sz; +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index 73261902d75d..161bf4760eac 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -2382,6 +2382,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb) + pm8001_printk("task 0x%p done with io_status 0x%x" + " resp 0x%x stat 0x%x but aborted by upper layer!\n", + t, status, ts->resp, ts->stat)); ++ if (t->slow_task) ++ complete(&t->slow_task->completion); + pm8001_ccb_task_free(pm8001_ha, t, ccb, tag); + } else { + spin_unlock_irqrestore(&t->task_state_lock, flags); +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index d323523f5f9d..32965ec76965 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -5263,6 +5263,11 @@ static int __init scsi_debug_init(void) + return -EINVAL; + } + ++ if (sdebug_num_tgts < 0) { ++ pr_err("num_tgts must be >= 0\n"); ++ return -EINVAL; ++ } ++ + if (sdebug_guard > 1) { + pr_err("guard must be 0 or 1\n"); + return -EINVAL; +diff --git a/drivers/scsi/scsi_trace.c b/drivers/scsi/scsi_trace.c +index 0f17e7dac1b0..07a2425ffa2c 100644 +--- a/drivers/scsi/scsi_trace.c ++++ b/drivers/scsi/scsi_trace.c +@@ -18,15 +18,18 @@ static const char * + scsi_trace_rw6(struct trace_seq *p, unsigned char *cdb, int len) + { + const char *ret = trace_seq_buffer_ptr(p); +- sector_t lba = 0, txlen = 0; ++ u32 lba = 0, txlen; + + lba |= ((cdb[1] & 0x1F) << 16); + lba |= (cdb[2] << 8); + lba |= cdb[3]; +- txlen = cdb[4]; ++ /* ++ * From SBC-2: a TRANSFER LENGTH field set to zero specifies that 256 ++ * logical blocks shall be read (READ(6)) or written (WRITE(6)). ++ */ ++ txlen = cdb[4] ? cdb[4] : 256; + +- trace_seq_printf(p, "lba=%llu txlen=%llu", +- (unsigned long long)lba, (unsigned long long)txlen); ++ trace_seq_printf(p, "lba=%u txlen=%u", lba, txlen); + trace_seq_putc(p, 0); + + return ret; +diff --git a/drivers/scsi/sun3_scsi.c b/drivers/scsi/sun3_scsi.c +index 955e4c938d49..701b842296f0 100644 +--- a/drivers/scsi/sun3_scsi.c ++++ b/drivers/scsi/sun3_scsi.c +@@ -501,7 +501,7 @@ static struct scsi_host_template sun3_scsi_template = { + .eh_host_reset_handler = sun3scsi_host_reset, + .can_queue = 16, + .this_id = 7, +- .sg_tablesize = SG_NONE, ++ .sg_tablesize = 1, + .cmd_per_lun = 2, + .dma_boundary = PAGE_SIZE - 1, + .cmd_size = NCR5380_CMD_SIZE, +@@ -523,7 +523,7 @@ static int __init sun3_scsi_probe(struct platform_device *pdev) + sun3_scsi_template.can_queue = setup_can_queue; + if (setup_cmd_per_lun > 0) + sun3_scsi_template.cmd_per_lun = setup_cmd_per_lun; +- if (setup_sg_tablesize >= 0) ++ if (setup_sg_tablesize > 0) + sun3_scsi_template.sg_tablesize = setup_sg_tablesize; + if (setup_hostid >= 0) + sun3_scsi_template.this_id = setup_hostid & 7; +diff --git a/drivers/scsi/ufs/ufs-sysfs.c b/drivers/scsi/ufs/ufs-sysfs.c +index 969a36b15897..ad2abc96c0f1 100644 +--- a/drivers/scsi/ufs/ufs-sysfs.c ++++ b/drivers/scsi/ufs/ufs-sysfs.c +@@ -126,13 +126,16 @@ static void ufshcd_auto_hibern8_update(struct ufs_hba *hba, u32 ahit) + return; + + spin_lock_irqsave(hba->host->host_lock, flags); +- if (hba->ahit == ahit) +- goto out_unlock; +- hba->ahit = ahit; +- if (!pm_runtime_suspended(hba->dev)) +- ufshcd_writel(hba, hba->ahit, REG_AUTO_HIBERNATE_IDLE_TIMER); +-out_unlock: ++ if (hba->ahit != ahit) ++ hba->ahit = ahit; + spin_unlock_irqrestore(hba->host->host_lock, flags); ++ if (!pm_runtime_suspended(hba->dev)) { ++ pm_runtime_get_sync(hba->dev); ++ ufshcd_hold(hba, false); ++ ufshcd_auto_hibern8_enable(hba); ++ ufshcd_release(hba); ++ pm_runtime_put(hba->dev); ++ } + } + + /* Convert Auto-Hibernate Idle Timer register value to microseconds */ +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 11a87f51c442..25a6a25b17a2 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -2986,10 +2986,10 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba, + goto out_unlock; + } + +- hba->dev_cmd.query.descriptor = NULL; + *buf_len = be16_to_cpu(response->upiu_res.length); + + out_unlock: ++ hba->dev_cmd.query.descriptor = NULL; + mutex_unlock(&hba->dev_cmd.lock); + out: + ufshcd_release(hba); +@@ -3885,15 +3885,24 @@ static int __ufshcd_uic_hibern8_enter(struct ufs_hba *hba) + ktime_to_us(ktime_sub(ktime_get(), start)), ret); + + if (ret) { ++ int err; ++ + dev_err(hba->dev, "%s: hibern8 enter failed. ret = %d\n", + __func__, ret); + + /* +- * If link recovery fails then return error so that caller +- * don't retry the hibern8 enter again. ++ * If link recovery fails then return error code returned from ++ * ufshcd_link_recovery(). ++ * If link recovery succeeds then return -EAGAIN to attempt ++ * hibern8 enter retry again. + */ +- if (ufshcd_link_recovery(hba)) +- ret = -ENOLINK; ++ err = ufshcd_link_recovery(hba); ++ if (err) { ++ dev_err(hba->dev, "%s: link recovery failed", __func__); ++ ret = err; ++ } else { ++ ret = -EAGAIN; ++ } + } else + ufshcd_vops_hibern8_notify(hba, UIC_CMD_DME_HIBER_ENTER, + POST_CHANGE); +@@ -3907,7 +3916,7 @@ static int ufshcd_uic_hibern8_enter(struct ufs_hba *hba) + + for (retries = UIC_HIBERN8_ENTER_RETRIES; retries > 0; retries--) { + ret = __ufshcd_uic_hibern8_enter(hba); +- if (!ret || ret == -ENOLINK) ++ if (!ret) + goto out; + } + out: +@@ -3941,7 +3950,7 @@ static int ufshcd_uic_hibern8_exit(struct ufs_hba *hba) + return ret; + } + +-static void ufshcd_auto_hibern8_enable(struct ufs_hba *hba) ++void ufshcd_auto_hibern8_enable(struct ufs_hba *hba) + { + unsigned long flags; + +@@ -6881,9 +6890,6 @@ static int ufshcd_probe_hba(struct ufs_hba *hba) + /* UniPro link is active now */ + ufshcd_set_link_active(hba); + +- /* Enable Auto-Hibernate if configured */ +- ufshcd_auto_hibern8_enable(hba); +- + ret = ufshcd_verify_dev_init(hba); + if (ret) + goto out; +@@ -6934,6 +6940,9 @@ static int ufshcd_probe_hba(struct ufs_hba *hba) + /* set the state as operational after switching to desired gear */ + hba->ufshcd_state = UFSHCD_STATE_OPERATIONAL; + ++ /* Enable Auto-Hibernate if configured */ ++ ufshcd_auto_hibern8_enable(hba); ++ + /* + * If we are in error handling context or in power management callbacks + * context, no need to scan the host +@@ -7950,12 +7959,12 @@ static int ufshcd_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) + if (hba->clk_scaling.is_allowed) + ufshcd_resume_clkscaling(hba); + +- /* Schedule clock gating in case of no access to UFS device yet */ +- ufshcd_release(hba); +- + /* Enable Auto-Hibernate if configured */ + ufshcd_auto_hibern8_enable(hba); + ++ /* Schedule clock gating in case of no access to UFS device yet */ ++ ufshcd_release(hba); ++ + goto out; + + set_old_link_state: +diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h +index c94cfda52829..52c9676a1242 100644 +--- a/drivers/scsi/ufs/ufshcd.h ++++ b/drivers/scsi/ufs/ufshcd.h +@@ -916,6 +916,8 @@ int ufshcd_query_attr(struct ufs_hba *hba, enum query_opcode opcode, + int ufshcd_query_flag(struct ufs_hba *hba, enum query_opcode opcode, + enum flag_idn idn, bool *flag_res); + ++void ufshcd_auto_hibern8_enable(struct ufs_hba *hba); ++ + #define SD_ASCII_STD true + #define SD_RAW false + int ufshcd_read_string_desc(struct ufs_hba *hba, u8 desc_index, +diff --git a/drivers/scsi/zorro_esp.c b/drivers/scsi/zorro_esp.c +index ca8e3abeb2c7..a23a8e5794f5 100644 +--- a/drivers/scsi/zorro_esp.c ++++ b/drivers/scsi/zorro_esp.c +@@ -218,7 +218,14 @@ static int fastlane_esp_irq_pending(struct esp *esp) + static u32 zorro_esp_dma_length_limit(struct esp *esp, u32 dma_addr, + u32 dma_len) + { +- return dma_len > 0xFFFF ? 0xFFFF : dma_len; ++ return dma_len > (1U << 16) ? (1U << 16) : dma_len; ++} ++ ++static u32 fastlane_esp_dma_length_limit(struct esp *esp, u32 dma_addr, ++ u32 dma_len) ++{ ++ /* The old driver used 0xfffc as limit, so do that here too */ ++ return dma_len > 0xfffc ? 0xfffc : dma_len; + } + + static void zorro_esp_reset_dma(struct esp *esp) +@@ -604,7 +611,7 @@ static const struct esp_driver_ops fastlane_esp_ops = { + .esp_write8 = zorro_esp_write8, + .esp_read8 = zorro_esp_read8, + .irq_pending = fastlane_esp_irq_pending, +- .dma_length_limit = zorro_esp_dma_length_limit, ++ .dma_length_limit = fastlane_esp_dma_length_limit, + .reset_dma = zorro_esp_reset_dma, + .dma_drain = zorro_esp_dma_drain, + .dma_invalidate = fastlane_esp_dma_invalidate, +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index d19e051f2bc2..f194ffc4699e 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1165,7 +1165,9 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, + hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length, + conn->cid); + +- target_get_sess_cmd(&cmd->se_cmd, true); ++ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0) ++ return iscsit_add_reject_cmd(cmd, ++ ISCSI_REASON_WAITING_FOR_LOGOUT, buf); + + cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd, + scsilun_to_int(&hdr->lun)); +@@ -2002,7 +2004,9 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, + conn->sess->se_sess, 0, DMA_NONE, + TCM_SIMPLE_TAG, cmd->sense_buffer + 2); + +- target_get_sess_cmd(&cmd->se_cmd, true); ++ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0) ++ return iscsit_add_reject_cmd(cmd, ++ ISCSI_REASON_WAITING_FOR_LOGOUT, buf); + + /* + * TASK_REASSIGN for ERL=2 / connection stays inside of +@@ -4232,6 +4236,8 @@ int iscsit_close_connection( + * must wait until they have completed. + */ + iscsit_check_conn_usage_count(conn); ++ target_sess_cmd_list_set_waiting(sess->se_sess); ++ target_wait_for_sess_cmds(sess->se_sess); + + ahash_request_free(conn->conn_tx_hash); + if (conn->conn_rx_hash) { +diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c +index 51ddca2033e0..8fe9b12a07a4 100644 +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -70,7 +70,7 @@ static int chap_check_algorithm(const char *a_str) + if (!token) + goto out; + +- if (!strncmp(token, "5", 1)) { ++ if (!strcmp(token, "5")) { + pr_debug("Selected MD5 Algorithm\n"); + kfree(orig); + return CHAP_DIGEST_MD5; +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 7f06a62f8661..eda8b4736c15 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -584,6 +584,15 @@ void transport_free_session(struct se_session *se_sess) + } + EXPORT_SYMBOL(transport_free_session); + ++static int target_release_res(struct se_device *dev, void *data) ++{ ++ struct se_session *sess = data; ++ ++ if (dev->reservation_holder == sess) ++ target_release_reservation(dev); ++ return 0; ++} ++ + void transport_deregister_session(struct se_session *se_sess) + { + struct se_portal_group *se_tpg = se_sess->se_tpg; +@@ -600,6 +609,12 @@ void transport_deregister_session(struct se_session *se_sess) + se_sess->fabric_sess_ptr = NULL; + spin_unlock_irqrestore(&se_tpg->session_lock, flags); + ++ /* ++ * Since the session is being removed, release SPC-2 ++ * reservations held by the session that is disappearing. ++ */ ++ target_for_each_device(target_release_res, se_sess); ++ + pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n", + se_tpg->se_tpg_tfo->fabric_name); + /* +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 9f57736fe15e..88a5aa6624b4 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -437,7 +437,9 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) + virtio_transport_deliver_tap_pkt(pkt); + + /* Only accept correctly addressed packets */ +- if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid) ++ if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid && ++ le64_to_cpu(pkt->hdr.dst_cid) == ++ vhost_transport_get_local_cid()) + virtio_transport_recv_pkt(pkt); + else + virtio_transport_free_pkt(pkt); +diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c +index 5ce51026989a..ba5d535a6db2 100644 +--- a/drivers/watchdog/imx7ulp_wdt.c ++++ b/drivers/watchdog/imx7ulp_wdt.c +@@ -106,12 +106,28 @@ static int imx7ulp_wdt_set_timeout(struct watchdog_device *wdog, + return 0; + } + ++static int imx7ulp_wdt_restart(struct watchdog_device *wdog, ++ unsigned long action, void *data) ++{ ++ struct imx7ulp_wdt_device *wdt = watchdog_get_drvdata(wdog); ++ ++ imx7ulp_wdt_enable(wdt->base, true); ++ imx7ulp_wdt_set_timeout(&wdt->wdd, 1); ++ ++ /* wait for wdog to fire */ ++ while (true) ++ ; ++ ++ return NOTIFY_DONE; ++} ++ + static const struct watchdog_ops imx7ulp_wdt_ops = { + .owner = THIS_MODULE, + .start = imx7ulp_wdt_start, + .stop = imx7ulp_wdt_stop, + .ping = imx7ulp_wdt_ping, + .set_timeout = imx7ulp_wdt_set_timeout, ++ .restart = imx7ulp_wdt_restart, + }; + + static const struct watchdog_info imx7ulp_wdt_info = { +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index dbd2ad4c9294..62483a99105c 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -34,7 +34,6 @@ + #include /* For __init/__exit/... */ + #include /* For hrtimers */ + #include /* For printk/panic/... */ +-#include /* For data references */ + #include /* For kthread_work */ + #include /* For handling misc devices */ + #include /* For module stuff/... */ +@@ -52,14 +51,14 @@ + + /* + * struct watchdog_core_data - watchdog core internal data +- * @kref: Reference count. ++ * @dev: The watchdog's internal device + * @cdev: The watchdog's Character device. + * @wdd: Pointer to watchdog device. + * @lock: Lock for watchdog core. + * @status: Watchdog core internal status bits. + */ + struct watchdog_core_data { +- struct kref kref; ++ struct device dev; + struct cdev cdev; + struct watchdog_device *wdd; + struct mutex lock; +@@ -158,7 +157,8 @@ static inline void watchdog_update_worker(struct watchdog_device *wdd) + ktime_t t = watchdog_next_keepalive(wdd); + + if (t > 0) +- hrtimer_start(&wd_data->timer, t, HRTIMER_MODE_REL); ++ hrtimer_start(&wd_data->timer, t, ++ HRTIMER_MODE_REL_HARD); + } else { + hrtimer_cancel(&wd_data->timer); + } +@@ -177,7 +177,7 @@ static int __watchdog_ping(struct watchdog_device *wdd) + if (ktime_after(earliest_keepalive, now)) { + hrtimer_start(&wd_data->timer, + ktime_sub(earliest_keepalive, now), +- HRTIMER_MODE_REL); ++ HRTIMER_MODE_REL_HARD); + return 0; + } + +@@ -839,7 +839,7 @@ static int watchdog_open(struct inode *inode, struct file *file) + file->private_data = wd_data; + + if (!hw_running) +- kref_get(&wd_data->kref); ++ get_device(&wd_data->dev); + + /* + * open_timeout only applies for the first open from +@@ -860,11 +860,11 @@ out_clear: + return err; + } + +-static void watchdog_core_data_release(struct kref *kref) ++static void watchdog_core_data_release(struct device *dev) + { + struct watchdog_core_data *wd_data; + +- wd_data = container_of(kref, struct watchdog_core_data, kref); ++ wd_data = container_of(dev, struct watchdog_core_data, dev); + + kfree(wd_data); + } +@@ -924,7 +924,7 @@ done: + */ + if (!running) { + module_put(wd_data->cdev.owner); +- kref_put(&wd_data->kref, watchdog_core_data_release); ++ put_device(&wd_data->dev); + } + return 0; + } +@@ -943,17 +943,22 @@ static struct miscdevice watchdog_miscdev = { + .fops = &watchdog_fops, + }; + ++static struct class watchdog_class = { ++ .name = "watchdog", ++ .owner = THIS_MODULE, ++ .dev_groups = wdt_groups, ++}; ++ + /* + * watchdog_cdev_register: register watchdog character device + * @wdd: watchdog device +- * @devno: character device number + * + * Register a watchdog character device including handling the legacy + * /dev/watchdog node. /dev/watchdog is actually a miscdevice and + * thus we set it up like that. + */ + +-static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) ++static int watchdog_cdev_register(struct watchdog_device *wdd) + { + struct watchdog_core_data *wd_data; + int err; +@@ -961,7 +966,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + wd_data = kzalloc(sizeof(struct watchdog_core_data), GFP_KERNEL); + if (!wd_data) + return -ENOMEM; +- kref_init(&wd_data->kref); + mutex_init(&wd_data->lock); + + wd_data->wdd = wdd; +@@ -971,7 +975,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + return -ENODEV; + + kthread_init_work(&wd_data->work, watchdog_ping_work); +- hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); ++ hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD); + wd_data->timer.function = watchdog_timer_expired; + + if (wdd->id == 0) { +@@ -990,23 +994,33 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + } + } + ++ device_initialize(&wd_data->dev); ++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); ++ wd_data->dev.class = &watchdog_class; ++ wd_data->dev.parent = wdd->parent; ++ wd_data->dev.groups = wdd->groups; ++ wd_data->dev.release = watchdog_core_data_release; ++ dev_set_drvdata(&wd_data->dev, wdd); ++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); ++ + /* Fill in the data structures */ + cdev_init(&wd_data->cdev, &watchdog_fops); +- wd_data->cdev.owner = wdd->ops->owner; + + /* Add the device */ +- err = cdev_add(&wd_data->cdev, devno, 1); ++ err = cdev_device_add(&wd_data->cdev, &wd_data->dev); + if (err) { + pr_err("watchdog%d unable to add device %d:%d\n", + wdd->id, MAJOR(watchdog_devt), wdd->id); + if (wdd->id == 0) { + misc_deregister(&watchdog_miscdev); + old_wd_data = NULL; +- kref_put(&wd_data->kref, watchdog_core_data_release); ++ put_device(&wd_data->dev); + } + return err; + } + ++ wd_data->cdev.owner = wdd->ops->owner; ++ + /* Record time of most recent heartbeat as 'just before now'. */ + wd_data->last_hw_keepalive = ktime_sub(ktime_get(), 1); + watchdog_set_open_deadline(wd_data); +@@ -1017,9 +1031,10 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + */ + if (watchdog_hw_running(wdd)) { + __module_get(wdd->ops->owner); +- kref_get(&wd_data->kref); ++ get_device(&wd_data->dev); + if (handle_boot_enabled) +- hrtimer_start(&wd_data->timer, 0, HRTIMER_MODE_REL); ++ hrtimer_start(&wd_data->timer, 0, ++ HRTIMER_MODE_REL_HARD); + else + pr_info("watchdog%d running and kernel based pre-userspace handler disabled\n", + wdd->id); +@@ -1040,7 +1055,7 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd) + { + struct watchdog_core_data *wd_data = wdd->wd_data; + +- cdev_del(&wd_data->cdev); ++ cdev_device_del(&wd_data->cdev, &wd_data->dev); + if (wdd->id == 0) { + misc_deregister(&watchdog_miscdev); + old_wd_data = NULL; +@@ -1059,15 +1074,9 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd) + hrtimer_cancel(&wd_data->timer); + kthread_cancel_work_sync(&wd_data->work); + +- kref_put(&wd_data->kref, watchdog_core_data_release); ++ put_device(&wd_data->dev); + } + +-static struct class watchdog_class = { +- .name = "watchdog", +- .owner = THIS_MODULE, +- .dev_groups = wdt_groups, +-}; +- + static int watchdog_reboot_notifier(struct notifier_block *nb, + unsigned long code, void *data) + { +@@ -1098,27 +1107,14 @@ static int watchdog_reboot_notifier(struct notifier_block *nb, + + int watchdog_dev_register(struct watchdog_device *wdd) + { +- struct device *dev; +- dev_t devno; + int ret; + +- devno = MKDEV(MAJOR(watchdog_devt), wdd->id); +- +- ret = watchdog_cdev_register(wdd, devno); ++ ret = watchdog_cdev_register(wdd); + if (ret) + return ret; + +- dev = device_create_with_groups(&watchdog_class, wdd->parent, +- devno, wdd, wdd->groups, +- "watchdog%d", wdd->id); +- if (IS_ERR(dev)) { +- watchdog_cdev_unregister(wdd); +- return PTR_ERR(dev); +- } +- + ret = watchdog_register_pretimeout(wdd); + if (ret) { +- device_destroy(&watchdog_class, devno); + watchdog_cdev_unregister(wdd); + return ret; + } +@@ -1126,7 +1122,8 @@ int watchdog_dev_register(struct watchdog_device *wdd) + if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) { + wdd->reboot_nb.notifier_call = watchdog_reboot_notifier; + +- ret = devm_register_reboot_notifier(dev, &wdd->reboot_nb); ++ ret = devm_register_reboot_notifier(&wdd->wd_data->dev, ++ &wdd->reboot_nb); + if (ret) { + pr_err("watchdog%d: Cannot register reboot notifier (%d)\n", + wdd->id, ret); +@@ -1148,7 +1145,6 @@ int watchdog_dev_register(struct watchdog_device *wdd) + void watchdog_dev_unregister(struct watchdog_device *wdd) + { + watchdog_unregister_pretimeout(wdd); +- device_destroy(&watchdog_class, wdd->wd_data->cdev.dev); + watchdog_cdev_unregister(wdd); + } + +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 1a135d1b85bd..07d8ace61f77 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -119,6 +119,7 @@ extern mempool_t *cifs_mid_poolp; + + struct workqueue_struct *cifsiod_wq; + struct workqueue_struct *decrypt_wq; ++struct workqueue_struct *fileinfo_put_wq; + struct workqueue_struct *cifsoplockd_wq; + __u32 cifs_lock_secret; + +@@ -1554,11 +1555,18 @@ init_cifs(void) + goto out_destroy_cifsiod_wq; + } + ++ fileinfo_put_wq = alloc_workqueue("cifsfileinfoput", ++ WQ_UNBOUND|WQ_FREEZABLE|WQ_MEM_RECLAIM, 0); ++ if (!fileinfo_put_wq) { ++ rc = -ENOMEM; ++ goto out_destroy_decrypt_wq; ++ } ++ + cifsoplockd_wq = alloc_workqueue("cifsoplockd", + WQ_FREEZABLE|WQ_MEM_RECLAIM, 0); + if (!cifsoplockd_wq) { + rc = -ENOMEM; +- goto out_destroy_decrypt_wq; ++ goto out_destroy_fileinfo_put_wq; + } + + rc = cifs_fscache_register(); +@@ -1624,6 +1632,8 @@ out_unreg_fscache: + cifs_fscache_unregister(); + out_destroy_cifsoplockd_wq: + destroy_workqueue(cifsoplockd_wq); ++out_destroy_fileinfo_put_wq: ++ destroy_workqueue(fileinfo_put_wq); + out_destroy_decrypt_wq: + destroy_workqueue(decrypt_wq); + out_destroy_cifsiod_wq: +@@ -1653,6 +1663,7 @@ exit_cifs(void) + cifs_fscache_unregister(); + destroy_workqueue(cifsoplockd_wq); + destroy_workqueue(decrypt_wq); ++ destroy_workqueue(fileinfo_put_wq); + destroy_workqueue(cifsiod_wq); + cifs_proc_clean(); + } +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 5d2dd04b55a6..f55e53486e74 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1265,6 +1265,7 @@ struct cifsFileInfo { + struct mutex fh_mutex; /* prevents reopen race after dead ses*/ + struct cifs_search_info srch_inf; + struct work_struct oplock_break; /* work for oplock breaks */ ++ struct work_struct put; /* work for the final part of _put */ + }; + + struct cifs_io_parms { +@@ -1370,7 +1371,8 @@ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file) + } + + struct cifsFileInfo *cifsFileInfo_get(struct cifsFileInfo *cifs_file); +-void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr); ++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr, ++ bool offload); + void cifsFileInfo_put(struct cifsFileInfo *cifs_file); + + #define CIFS_CACHE_READ_FLG 1 +@@ -1908,6 +1910,7 @@ void cifs_queue_oplock_break(struct cifsFileInfo *cfile); + extern const struct slow_work_ops cifs_oplock_break_ops; + extern struct workqueue_struct *cifsiod_wq; + extern struct workqueue_struct *decrypt_wq; ++extern struct workqueue_struct *fileinfo_put_wq; + extern struct workqueue_struct *cifsoplockd_wq; + extern __u32 cifs_lock_secret; + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 20c70cbab1ad..02451d085ddd 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -387,7 +387,7 @@ static inline int reconn_set_ipaddr(struct TCP_Server_Info *server) + #ifdef CONFIG_CIFS_DFS_UPCALL + struct super_cb_data { + struct TCP_Server_Info *server; +- struct cifs_sb_info *cifs_sb; ++ struct super_block *sb; + }; + + /* These functions must be called with server->srv_mutex held */ +@@ -398,25 +398,39 @@ static void super_cb(struct super_block *sb, void *arg) + struct cifs_sb_info *cifs_sb; + struct cifs_tcon *tcon; + +- if (d->cifs_sb) ++ if (d->sb) + return; + + cifs_sb = CIFS_SB(sb); + tcon = cifs_sb_master_tcon(cifs_sb); + if (tcon->ses->server == d->server) +- d->cifs_sb = cifs_sb; ++ d->sb = sb; + } + +-static inline struct cifs_sb_info * +-find_super_by_tcp(struct TCP_Server_Info *server) ++static struct super_block *get_tcp_super(struct TCP_Server_Info *server) + { + struct super_cb_data d = { + .server = server, +- .cifs_sb = NULL, ++ .sb = NULL, + }; + + iterate_supers_type(&cifs_fs_type, super_cb, &d); +- return d.cifs_sb ? d.cifs_sb : ERR_PTR(-ENOENT); ++ ++ if (unlikely(!d.sb)) ++ return ERR_PTR(-ENOENT); ++ /* ++ * Grab an active reference in order to prevent automounts (DFS links) ++ * of expiring and then freeing up our cifs superblock pointer while ++ * we're doing failover. ++ */ ++ cifs_sb_active(d.sb); ++ return d.sb; ++} ++ ++static inline void put_tcp_super(struct super_block *sb) ++{ ++ if (!IS_ERR_OR_NULL(sb)) ++ cifs_sb_deactive(sb); + } + + static void reconn_inval_dfs_target(struct TCP_Server_Info *server, +@@ -480,6 +494,7 @@ cifs_reconnect(struct TCP_Server_Info *server) + struct mid_q_entry *mid_entry; + struct list_head retry_list; + #ifdef CONFIG_CIFS_DFS_UPCALL ++ struct super_block *sb = NULL; + struct cifs_sb_info *cifs_sb = NULL; + struct dfs_cache_tgt_list tgt_list = {0}; + struct dfs_cache_tgt_iterator *tgt_it = NULL; +@@ -489,13 +504,15 @@ cifs_reconnect(struct TCP_Server_Info *server) + server->nr_targets = 1; + #ifdef CONFIG_CIFS_DFS_UPCALL + spin_unlock(&GlobalMid_Lock); +- cifs_sb = find_super_by_tcp(server); +- if (IS_ERR(cifs_sb)) { +- rc = PTR_ERR(cifs_sb); ++ sb = get_tcp_super(server); ++ if (IS_ERR(sb)) { ++ rc = PTR_ERR(sb); + cifs_dbg(FYI, "%s: will not do DFS failover: rc = %d\n", + __func__, rc); +- cifs_sb = NULL; ++ sb = NULL; + } else { ++ cifs_sb = CIFS_SB(sb); ++ + rc = reconn_setup_dfs_targets(cifs_sb, &tgt_list, &tgt_it); + if (rc && (rc != -EOPNOTSUPP)) { + cifs_server_dbg(VFS, "%s: no target servers for DFS failover\n", +@@ -512,6 +529,10 @@ cifs_reconnect(struct TCP_Server_Info *server) + /* the demux thread will exit normally + next time through the loop */ + spin_unlock(&GlobalMid_Lock); ++#ifdef CONFIG_CIFS_DFS_UPCALL ++ dfs_cache_free_tgts(&tgt_list); ++ put_tcp_super(sb); ++#endif + return rc; + } else + server->tcpStatus = CifsNeedReconnect; +@@ -638,7 +659,10 @@ cifs_reconnect(struct TCP_Server_Info *server) + __func__, rc); + } + dfs_cache_free_tgts(&tgt_list); ++ + } ++ ++ put_tcp_super(sb); + #endif + if (server->tcpStatus == CifsNeedNegotiate) + mod_delayed_work(cifsiod_wq, &server->echo, 0); +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index c32650f14c9b..969543034b4d 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -288,6 +288,8 @@ cifs_down_write(struct rw_semaphore *sem) + msleep(10); + } + ++static void cifsFileInfo_put_work(struct work_struct *work); ++ + struct cifsFileInfo * + cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + struct tcon_link *tlink, __u32 oplock) +@@ -322,6 +324,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + cfile->invalidHandle = false; + cfile->tlink = cifs_get_tlink(tlink); + INIT_WORK(&cfile->oplock_break, cifs_oplock_break); ++ INIT_WORK(&cfile->put, cifsFileInfo_put_work); + mutex_init(&cfile->fh_mutex); + spin_lock_init(&cfile->file_info_lock); + +@@ -376,6 +379,41 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file) + return cifs_file; + } + ++static void cifsFileInfo_put_final(struct cifsFileInfo *cifs_file) ++{ ++ struct inode *inode = d_inode(cifs_file->dentry); ++ struct cifsInodeInfo *cifsi = CIFS_I(inode); ++ struct cifsLockInfo *li, *tmp; ++ struct super_block *sb = inode->i_sb; ++ ++ /* ++ * Delete any outstanding lock records. We'll lose them when the file ++ * is closed anyway. ++ */ ++ cifs_down_write(&cifsi->lock_sem); ++ list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { ++ list_del(&li->llist); ++ cifs_del_lock_waiters(li); ++ kfree(li); ++ } ++ list_del(&cifs_file->llist->llist); ++ kfree(cifs_file->llist); ++ up_write(&cifsi->lock_sem); ++ ++ cifs_put_tlink(cifs_file->tlink); ++ dput(cifs_file->dentry); ++ cifs_sb_deactive(sb); ++ kfree(cifs_file); ++} ++ ++static void cifsFileInfo_put_work(struct work_struct *work) ++{ ++ struct cifsFileInfo *cifs_file = container_of(work, ++ struct cifsFileInfo, put); ++ ++ cifsFileInfo_put_final(cifs_file); ++} ++ + /** + * cifsFileInfo_put - release a reference of file priv data + * +@@ -383,15 +421,15 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file) + */ + void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + { +- _cifsFileInfo_put(cifs_file, true); ++ _cifsFileInfo_put(cifs_file, true, true); + } + + /** + * _cifsFileInfo_put - release a reference of file priv data + * + * This may involve closing the filehandle @cifs_file out on the +- * server. Must be called without holding tcon->open_file_lock and +- * cifs_file->file_info_lock. ++ * server. Must be called without holding tcon->open_file_lock, ++ * cinode->open_file_lock and cifs_file->file_info_lock. + * + * If @wait_for_oplock_handler is true and we are releasing the last + * reference, wait for any running oplock break handler of the file +@@ -399,7 +437,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + * oplock break handler, you need to pass false. + * + */ +-void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler) ++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, ++ bool wait_oplock_handler, bool offload) + { + struct inode *inode = d_inode(cifs_file->dentry); + struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink); +@@ -407,7 +446,6 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler) + struct cifsInodeInfo *cifsi = CIFS_I(inode); + struct super_block *sb = inode->i_sb; + struct cifs_sb_info *cifs_sb = CIFS_SB(sb); +- struct cifsLockInfo *li, *tmp; + struct cifs_fid fid; + struct cifs_pending_open open; + bool oplock_break_cancelled; +@@ -468,24 +506,10 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler) + + cifs_del_pending_open(&open); + +- /* +- * Delete any outstanding lock records. We'll lose them when the file +- * is closed anyway. +- */ +- cifs_down_write(&cifsi->lock_sem); +- list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { +- list_del(&li->llist); +- cifs_del_lock_waiters(li); +- kfree(li); +- } +- list_del(&cifs_file->llist->llist); +- kfree(cifs_file->llist); +- up_write(&cifsi->lock_sem); +- +- cifs_put_tlink(cifs_file->tlink); +- dput(cifs_file->dentry); +- cifs_sb_deactive(sb); +- kfree(cifs_file); ++ if (offload) ++ queue_work(fileinfo_put_wq, &cifs_file->put); ++ else ++ cifsFileInfo_put_final(cifs_file); + } + + int cifs_open(struct inode *inode, struct file *file) +@@ -816,7 +840,7 @@ reopen_error_exit: + int cifs_close(struct inode *inode, struct file *file) + { + if (file->private_data != NULL) { +- cifsFileInfo_put(file->private_data); ++ _cifsFileInfo_put(file->private_data, true, false); + file->private_data = NULL; + } + +@@ -4688,7 +4712,7 @@ void cifs_oplock_break(struct work_struct *work) + cinode); + cifs_dbg(FYI, "Oplock release rc = %d\n", rc); + } +- _cifsFileInfo_put(cfile, false /* do not wait for ourself */); ++ _cifsFileInfo_put(cfile, false /* do not wait for ourself */, false); + cifs_done_oplock_break(cinode); + } + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 53134e4509b8..8bba6cd5e870 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3532,8 +3532,14 @@ retry: + return ret; + } + ++ /* ++ * Writes that span EOF might trigger an I/O size update on completion, ++ * so consider them to be dirty for the purposes of O_DSYNC, even if ++ * there is no other metadata changes being made or are pending here. ++ */ + iomap->flags = 0; +- if (ext4_inode_datasync_dirty(inode)) ++ if (ext4_inode_datasync_dirty(inode) || ++ offset + length > i_size_read(inode)) + iomap->flags |= IOMAP_F_DIRTY; + iomap->bdev = inode->i_sb->s_bdev; + iomap->dax_dev = sbi->s_daxdev; +@@ -3836,7 +3842,13 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter) + * writes & truncates and since we take care of writing back page cache, + * we are protected against page writeback as well. + */ +- inode_lock_shared(inode); ++ if (iocb->ki_flags & IOCB_NOWAIT) { ++ if (!inode_trylock_shared(inode)) ++ return -EAGAIN; ++ } else { ++ inode_lock_shared(inode); ++ } ++ + ret = filemap_write_and_wait_range(mapping, iocb->ki_pos, + iocb->ki_pos + count - 1); + if (ret) +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 4024790028aa..9046432b87c2 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -1289,6 +1289,7 @@ struct f2fs_sb_info { + unsigned int gc_mode; /* current GC state */ + unsigned int next_victim_seg[2]; /* next segment in victim section */ + /* for skip statistic */ ++ unsigned int atomic_files; /* # of opened atomic file */ + unsigned long long skipped_atomic_files[2]; /* FG_GC and BG_GC */ + unsigned long long skipped_gc_rwsem; /* FG_GC only */ + +@@ -2704,6 +2705,20 @@ static inline void clear_file(struct inode *inode, int type) + f2fs_mark_inode_dirty_sync(inode, true); + } + ++static inline bool f2fs_is_time_consistent(struct inode *inode) ++{ ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &inode->i_atime)) ++ return false; ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &inode->i_ctime)) ++ return false; ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &inode->i_mtime)) ++ return false; ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 3, ++ &F2FS_I(inode)->i_crtime)) ++ return false; ++ return true; ++} ++ + static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync) + { + bool ret; +@@ -2721,14 +2736,7 @@ static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync) + i_size_read(inode) & ~PAGE_MASK) + return false; + +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &inode->i_atime)) +- return false; +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &inode->i_ctime)) +- return false; +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &inode->i_mtime)) +- return false; +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 3, +- &F2FS_I(inode)->i_crtime)) ++ if (!f2fs_is_time_consistent(inode)) + return false; + + down_read(&F2FS_I(inode)->i_sem); +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 29bc0a542759..8ed8e4328bd1 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1890,6 +1890,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp) + spin_lock(&sbi->inode_lock[ATOMIC_FILE]); + if (list_empty(&fi->inmem_ilist)) + list_add_tail(&fi->inmem_ilist, &sbi->inode_list[ATOMIC_FILE]); ++ sbi->atomic_files++; + spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); + + /* add inode in inmem_list first and set atomic_file */ +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index db4fec30c30d..386ad54c13c3 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -615,7 +615,11 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) + inode->i_ino == F2FS_META_INO(sbi)) + return 0; + +- if (!is_inode_flag_set(inode, FI_DIRTY_INODE)) ++ /* ++ * atime could be updated without dirtying f2fs inode in lazytime mode ++ */ ++ if (f2fs_is_time_consistent(inode) && ++ !is_inode_flag_set(inode, FI_DIRTY_INODE)) + return 0; + + if (!f2fs_is_checkpoint_ready(sbi)) +diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c +index 4faf06e8bf89..a1c507b0b4ac 100644 +--- a/fs/f2fs/namei.c ++++ b/fs/f2fs/namei.c +@@ -981,7 +981,8 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, + if (!old_dir_entry || whiteout) + file_lost_pino(old_inode); + else +- F2FS_I(old_inode)->i_pino = new_dir->i_ino; ++ /* adjust dir's i_pino to pass fsck check */ ++ f2fs_i_pino_write(old_inode, new_dir->i_ino); + up_write(&F2FS_I(old_inode)->i_sem); + + old_inode->i_ctime = current_time(old_inode); +@@ -1141,7 +1142,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry, + f2fs_set_link(old_dir, old_entry, old_page, new_inode); + + down_write(&F2FS_I(old_inode)->i_sem); +- file_lost_pino(old_inode); ++ if (!old_dir_entry) ++ file_lost_pino(old_inode); ++ else ++ /* adjust dir's i_pino to pass fsck check */ ++ f2fs_i_pino_write(old_inode, new_dir->i_ino); + up_write(&F2FS_I(old_inode)->i_sem); + + old_dir->i_ctime = current_time(old_dir); +@@ -1156,7 +1161,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry, + f2fs_set_link(new_dir, new_entry, new_page, old_inode); + + down_write(&F2FS_I(new_inode)->i_sem); +- file_lost_pino(new_inode); ++ if (!new_dir_entry) ++ file_lost_pino(new_inode); ++ else ++ /* adjust dir's i_pino to pass fsck check */ ++ f2fs_i_pino_write(new_inode, old_dir->i_ino); + up_write(&F2FS_I(new_inode)->i_sem); + + new_dir->i_ctime = current_time(new_dir); +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 808709581481..7d8578401267 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -288,6 +288,8 @@ void f2fs_drop_inmem_pages_all(struct f2fs_sb_info *sbi, bool gc_failure) + struct list_head *head = &sbi->inode_list[ATOMIC_FILE]; + struct inode *inode; + struct f2fs_inode_info *fi; ++ unsigned int count = sbi->atomic_files; ++ unsigned int looped = 0; + next: + spin_lock(&sbi->inode_lock[ATOMIC_FILE]); + if (list_empty(head)) { +@@ -296,22 +298,26 @@ next: + } + fi = list_first_entry(head, struct f2fs_inode_info, inmem_ilist); + inode = igrab(&fi->vfs_inode); ++ if (inode) ++ list_move_tail(&fi->inmem_ilist, head); + spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); + + if (inode) { + if (gc_failure) { +- if (fi->i_gc_failures[GC_FAILURE_ATOMIC]) +- goto drop; +- goto skip; ++ if (!fi->i_gc_failures[GC_FAILURE_ATOMIC]) ++ goto skip; + } +-drop: + set_inode_flag(inode, FI_ATOMIC_REVOKE_REQUEST); + f2fs_drop_inmem_pages(inode); ++skip: + iput(inode); + } +-skip: + congestion_wait(BLK_RW_ASYNC, HZ/50); + cond_resched(); ++ if (gc_failure) { ++ if (++looped >= count) ++ return; ++ } + goto next; + } + +@@ -327,13 +333,16 @@ void f2fs_drop_inmem_pages(struct inode *inode) + mutex_unlock(&fi->inmem_lock); + } + +- clear_inode_flag(inode, FI_ATOMIC_FILE); + fi->i_gc_failures[GC_FAILURE_ATOMIC] = 0; + stat_dec_atomic_write(inode); + + spin_lock(&sbi->inode_lock[ATOMIC_FILE]); + if (!list_empty(&fi->inmem_ilist)) + list_del_init(&fi->inmem_ilist); ++ if (f2fs_is_atomic_file(inode)) { ++ clear_inode_flag(inode, FI_ATOMIC_FILE); ++ sbi->atomic_files--; ++ } + spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); + } + +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index a478df035651..40306c1eab07 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -1461,28 +1461,43 @@ static int __init init_hugetlbfs_fs(void) + sizeof(struct hugetlbfs_inode_info), + 0, SLAB_ACCOUNT, init_once); + if (hugetlbfs_inode_cachep == NULL) +- goto out2; ++ goto out; + + error = register_filesystem(&hugetlbfs_fs_type); + if (error) +- goto out; ++ goto out_free; + ++ /* default hstate mount is required */ ++ mnt = mount_one_hugetlbfs(&hstates[default_hstate_idx]); ++ if (IS_ERR(mnt)) { ++ error = PTR_ERR(mnt); ++ goto out_unreg; ++ } ++ hugetlbfs_vfsmount[default_hstate_idx] = mnt; ++ ++ /* other hstates are optional */ + i = 0; + for_each_hstate(h) { +- mnt = mount_one_hugetlbfs(h); +- if (IS_ERR(mnt) && i == 0) { +- error = PTR_ERR(mnt); +- goto out; ++ if (i == default_hstate_idx) { ++ i++; ++ continue; + } +- hugetlbfs_vfsmount[i] = mnt; ++ ++ mnt = mount_one_hugetlbfs(h); ++ if (IS_ERR(mnt)) ++ hugetlbfs_vfsmount[i] = NULL; ++ else ++ hugetlbfs_vfsmount[i] = mnt; + i++; + } + + return 0; + +- out: ++ out_unreg: ++ (void)unregister_filesystem(&hugetlbfs_fs_type); ++ out_free: + kmem_cache_destroy(hugetlbfs_inode_cachep); +- out2: ++ out: + return error; + } + fs_initcall(init_hugetlbfs_fs) +diff --git a/fs/io_uring.c b/fs/io_uring.c +index a340147387ec..74e786578c77 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -3773,12 +3773,18 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx, + ctx->cq_entries = rings->cq_ring_entries; + + size = array_size(sizeof(struct io_uring_sqe), p->sq_entries); +- if (size == SIZE_MAX) ++ if (size == SIZE_MAX) { ++ io_mem_free(ctx->rings); ++ ctx->rings = NULL; + return -EOVERFLOW; ++ } + + ctx->sq_sqes = io_mem_alloc(size); +- if (!ctx->sq_sqes) ++ if (!ctx->sq_sqes) { ++ io_mem_free(ctx->rings); ++ ctx->rings = NULL; + return -ENOMEM; ++ } + + return 0; + } +diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c +index fd46ec83cb04..7b5f76efef02 100644 +--- a/fs/iomap/direct-io.c ++++ b/fs/iomap/direct-io.c +@@ -318,7 +318,9 @@ zero_tail: + if (pad) + iomap_dio_zero(dio, iomap, pos, fs_block_size - pad); + } +- return copied ? copied : ret; ++ if (copied) ++ return copied; ++ return ret; + } + + static loff_t +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index 132fb92098c7..c43591cd70f1 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -727,7 +727,6 @@ start_journal_io: + submit_bh(REQ_OP_WRITE, REQ_SYNC, bh); + } + cond_resched(); +- stats.run.rs_blocks_logged += bufs; + + /* Force a new descriptor to be generated next + time round the loop. */ +@@ -814,6 +813,7 @@ start_journal_io: + if (unlikely(!buffer_uptodate(bh))) + err = -EIO; + jbd2_unfile_log_bh(bh); ++ stats.run.rs_blocks_logged++; + + /* + * The list contains temporary buffer heads created by +@@ -859,6 +859,7 @@ start_journal_io: + BUFFER_TRACE(bh, "ph5: control buffer writeout done: unfile"); + clear_buffer_jwrite(bh); + jbd2_unfile_log_bh(bh); ++ stats.run.rs_blocks_logged++; + __brelse(bh); /* One for getblk */ + /* AKPM: bforget here */ + } +@@ -880,6 +881,7 @@ start_journal_io: + } + if (cbh) + err = journal_wait_on_commit_record(journal, cbh); ++ stats.run.rs_blocks_logged++; + if (jbd2_has_feature_async_commit(journal) && + journal->j_flags & JBD2_BARRIER) { + blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL); +diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c +index 3e7da392aa6f..bb981ec76456 100644 +--- a/fs/ocfs2/acl.c ++++ b/fs/ocfs2/acl.c +@@ -327,8 +327,8 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) + down_read(&OCFS2_I(inode)->ip_xattr_sem); + acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); + up_read(&OCFS2_I(inode)->ip_xattr_sem); +- if (IS_ERR(acl) || !acl) +- return PTR_ERR(acl); ++ if (IS_ERR_OR_NULL(acl)) ++ return PTR_ERR_OR_ZERO(acl); + ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); + if (ret) + return ret; +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 7f0b39da5022..9b96243de081 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -2861,68 +2861,73 @@ EXPORT_SYMBOL(dquot_quotactl_sysfile_ops); + static int do_proc_dqstats(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { +- unsigned int type = (int *)table->data - dqstats.stat; ++ unsigned int type = (unsigned long *)table->data - dqstats.stat; ++ s64 value = percpu_counter_sum(&dqstats.counter[type]); ++ ++ /* Filter negative values for non-monotonic counters */ ++ if (value < 0 && (type == DQST_ALLOC_DQUOTS || ++ type == DQST_FREE_DQUOTS)) ++ value = 0; + + /* Update global table */ +- dqstats.stat[type] = +- percpu_counter_sum_positive(&dqstats.counter[type]); +- return proc_dointvec(table, write, buffer, lenp, ppos); ++ dqstats.stat[type] = value; ++ return proc_doulongvec_minmax(table, write, buffer, lenp, ppos); + } + + static struct ctl_table fs_dqstats_table[] = { + { + .procname = "lookups", + .data = &dqstats.stat[DQST_LOOKUPS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "drops", + .data = &dqstats.stat[DQST_DROPS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "reads", + .data = &dqstats.stat[DQST_READS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "writes", + .data = &dqstats.stat[DQST_WRITES], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "cache_hits", + .data = &dqstats.stat[DQST_CACHE_HITS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "allocated_dquots", + .data = &dqstats.stat[DQST_ALLOC_DQUOTS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "free_dquots", + .data = &dqstats.stat[DQST_FREE_DQUOTS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, + { + .procname = "syncs", + .data = &dqstats.stat[DQST_SYNCS], +- .maxlen = sizeof(int), ++ .maxlen = sizeof(unsigned long), + .mode = 0444, + .proc_handler = do_proc_dqstats, + }, +diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c +index f9fd18670e22..d99d166fd892 100644 +--- a/fs/userfaultfd.c ++++ b/fs/userfaultfd.c +@@ -1834,13 +1834,12 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, + if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api))) + goto out; + features = uffdio_api.features; +- if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) { +- memset(&uffdio_api, 0, sizeof(uffdio_api)); +- if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api))) +- goto out; +- ret = -EINVAL; +- goto out; +- } ++ ret = -EINVAL; ++ if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) ++ goto err_out; ++ ret = -EPERM; ++ if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE)) ++ goto err_out; + /* report all available features and ioctls to userland */ + uffdio_api.features = UFFD_API_FEATURES; + uffdio_api.ioctls = UFFD_API_IOCTLS; +@@ -1853,6 +1852,11 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, + ret = 0; + out: + return ret; ++err_out: ++ memset(&uffdio_api, 0, sizeof(uffdio_api)); ++ if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api))) ++ ret = -EFAULT; ++ goto out; + } + + static long userfaultfd_ioctl(struct file *file, unsigned cmd, +diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c +index 641d07f30a27..7b0d9ad8cb1a 100644 +--- a/fs/xfs/xfs_log.c ++++ b/fs/xfs/xfs_log.c +@@ -1495,6 +1495,8 @@ out_free_iclog: + prev_iclog = iclog->ic_next; + kmem_free(iclog->ic_data); + kmem_free(iclog); ++ if (prev_iclog == log->l_iclog) ++ break; + } + out_free_log: + kmem_free(log); +diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h +index adf993a3bd58..6a18a97b76a8 100644 +--- a/include/linux/dma-direct.h ++++ b/include/linux/dma-direct.h +@@ -3,8 +3,11 @@ + #define _LINUX_DMA_DIRECT_H 1 + + #include ++#include /* for min_low_pfn */ + #include + ++static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr); ++ + #ifdef CONFIG_ARCH_HAS_PHYS_TO_DMA + #include + #else +@@ -24,11 +27,16 @@ static inline phys_addr_t __dma_to_phys(struct device *dev, dma_addr_t dev_addr) + + static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size) + { ++ dma_addr_t end = addr + size - 1; ++ + if (!dev->dma_mask) + return false; + +- return addr + size - 1 <= +- min_not_zero(*dev->dma_mask, dev->bus_dma_mask); ++ if (!IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT) && ++ min(addr, end) < phys_to_dma(dev, PFN_PHYS(min_low_pfn))) ++ return false; ++ ++ return end <= min_not_zero(*dev->dma_mask, dev->bus_dma_mask); + } + #endif /* !CONFIG_ARCH_HAS_PHYS_TO_DMA */ + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 4a1c4fca475a..4d450672b7d6 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -162,7 +162,7 @@ int dma_release_from_dev_coherent(struct device *dev, int order, void *vaddr); + int dma_mmap_from_dev_coherent(struct device *dev, struct vm_area_struct *vma, + void *cpu_addr, size_t size, int *ret); + +-void *dma_alloc_from_global_coherent(ssize_t size, dma_addr_t *dma_handle); ++void *dma_alloc_from_global_coherent(struct device *dev, ssize_t size, dma_addr_t *dma_handle); + int dma_release_from_global_coherent(int order, void *vaddr); + int dma_mmap_from_global_coherent(struct vm_area_struct *vma, void *cpu_addr, + size_t size, int *ret); +@@ -172,7 +172,7 @@ int dma_mmap_from_global_coherent(struct vm_area_struct *vma, void *cpu_addr, + #define dma_release_from_dev_coherent(dev, order, vaddr) (0) + #define dma_mmap_from_dev_coherent(dev, vma, vaddr, order, ret) (0) + +-static inline void *dma_alloc_from_global_coherent(ssize_t size, ++static inline void *dma_alloc_from_global_coherent(struct device *dev, ssize_t size, + dma_addr_t *dma_handle) + { + return NULL; +@@ -583,6 +583,10 @@ static inline unsigned long dma_get_merge_boundary(struct device *dev) + static inline dma_addr_t dma_map_single_attrs(struct device *dev, void *ptr, + size_t size, enum dma_data_direction dir, unsigned long attrs) + { ++ /* DMA must never operate on areas that might be remapped. */ ++ if (dev_WARN_ONCE(dev, is_vmalloc_addr(ptr), ++ "rejecting DMA map of vmalloc memory\n")) ++ return DMA_MAPPING_ERROR; + debug_dma_map_single(dev, ptr, size); + return dma_map_page_attrs(dev, virt_to_page(ptr), offset_in_page(ptr), + size, dir, attrs); +diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h +index 1b9a51a1bccb..1f98b52118f0 100644 +--- a/include/linux/hrtimer.h ++++ b/include/linux/hrtimer.h +@@ -456,12 +456,18 @@ extern u64 hrtimer_next_event_without(const struct hrtimer *exclude); + + extern bool hrtimer_active(const struct hrtimer *timer); + +-/* +- * Helper function to check, whether the timer is on one of the queues ++/** ++ * hrtimer_is_queued = check, whether the timer is on one of the queues ++ * @timer: Timer to check ++ * ++ * Returns: True if the timer is queued, false otherwise ++ * ++ * The function can be used lockless, but it gives only a current snapshot. + */ +-static inline int hrtimer_is_queued(struct hrtimer *timer) ++static inline bool hrtimer_is_queued(struct hrtimer *timer) + { +- return timer->state & HRTIMER_STATE_ENQUEUED; ++ /* The READ_ONCE pairs with the update functions of timer->state */ ++ return !!(READ_ONCE(timer->state) & HRTIMER_STATE_ENQUEUED); + } + + /* +diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h +index edb0f0c30904..1adf54aad2df 100644 +--- a/include/linux/libfdt_env.h ++++ b/include/linux/libfdt_env.h +@@ -7,6 +7,9 @@ + + #include + ++#define INT32_MAX S32_MAX ++#define UINT32_MAX U32_MAX ++ + typedef __be16 fdt16_t; + typedef __be32 fdt32_t; + typedef __be64 fdt64_t; +diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h +index fe6cfdcfbc26..468328b1e1dd 100644 +--- a/include/linux/posix-clock.h ++++ b/include/linux/posix-clock.h +@@ -69,29 +69,32 @@ struct posix_clock_operations { + * + * @ops: Functional interface to the clock + * @cdev: Character device instance for this clock +- * @kref: Reference count. ++ * @dev: Pointer to the clock's device. + * @rwsem: Protects the 'zombie' field from concurrent access. + * @zombie: If 'zombie' is true, then the hardware has disappeared. +- * @release: A function to free the structure when the reference count reaches +- * zero. May be NULL if structure is statically allocated. + * + * Drivers should embed their struct posix_clock within a private + * structure, obtaining a reference to it during callbacks using + * container_of(). ++ * ++ * Drivers should supply an initialized but not exposed struct device ++ * to posix_clock_register(). It is used to manage lifetime of the ++ * driver's private structure. It's 'release' field should be set to ++ * a release function for this private structure. + */ + struct posix_clock { + struct posix_clock_operations ops; + struct cdev cdev; +- struct kref kref; ++ struct device *dev; + struct rw_semaphore rwsem; + bool zombie; +- void (*release)(struct posix_clock *clk); + }; + + /** + * posix_clock_register() - register a new clock +- * @clk: Pointer to the clock. Caller must provide 'ops' and 'release' +- * @devid: Allocated device id ++ * @clk: Pointer to the clock. Caller must provide 'ops' field ++ * @dev: Pointer to the initialized device. Caller must provide ++ * 'release' field + * + * A clock driver calls this function to register itself with the + * clock device subsystem. If 'clk' points to dynamically allocated +@@ -100,7 +103,7 @@ struct posix_clock { + * + * Returns zero on success, non-zero otherwise. + */ +-int posix_clock_register(struct posix_clock *clk, dev_t devid); ++int posix_clock_register(struct posix_clock *clk, struct device *dev); + + /** + * posix_clock_unregister() - unregister a clock +diff --git a/include/linux/quota.h b/include/linux/quota.h +index f32dd270b8e3..27aab84fcbaa 100644 +--- a/include/linux/quota.h ++++ b/include/linux/quota.h +@@ -263,7 +263,7 @@ enum { + }; + + struct dqstats { +- int stat[_DQST_DQSTAT_LAST]; ++ unsigned long stat[_DQST_DQSTAT_LAST]; + struct percpu_counter counter[_DQST_DQSTAT_LAST]; + }; + +diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h +index bc8206a8f30e..61974c4c566b 100644 +--- a/include/linux/rculist_nulls.h ++++ b/include/linux/rculist_nulls.h +@@ -100,6 +100,43 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n, + first->pprev = &n->next; + } + ++/** ++ * hlist_nulls_add_tail_rcu ++ * @n: the element to add to the hash list. ++ * @h: the list to add to. ++ * ++ * Description: ++ * Adds the specified element to the specified hlist_nulls, ++ * while permitting racing traversals. ++ * ++ * The caller must take whatever precautions are necessary ++ * (such as holding appropriate locks) to avoid racing ++ * with another list-mutation primitive, such as hlist_nulls_add_head_rcu() ++ * or hlist_nulls_del_rcu(), running on this same list. ++ * However, it is perfectly legal to run concurrently with ++ * the _rcu list-traversal primitives, such as ++ * hlist_nulls_for_each_entry_rcu(), used to prevent memory-consistency ++ * problems on Alpha CPUs. Regardless of the type of CPU, the ++ * list-traversal primitive must be guarded by rcu_read_lock(). ++ */ ++static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n, ++ struct hlist_nulls_head *h) ++{ ++ struct hlist_nulls_node *i, *last = NULL; ++ ++ /* Note: write side code, so rcu accessors are not needed. */ ++ for (i = h->first; !is_a_nulls(i); i = i->next) ++ last = i; ++ ++ if (last) { ++ n->next = last->next; ++ n->pprev = &last->next; ++ rcu_assign_pointer(hlist_next_rcu(last), n); ++ } else { ++ hlist_nulls_add_head_rcu(n, h); ++ } ++} ++ + /** + * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type + * @tpos: the type * to use as a loop cursor. +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 1ba6e2cc2725..6ae88b0c1c31 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -1795,7 +1795,7 @@ static inline struct sk_buff *skb_peek_next(struct sk_buff *skb, + */ + static inline struct sk_buff *skb_peek_tail(const struct sk_buff_head *list_) + { +- struct sk_buff *skb = list_->prev; ++ struct sk_buff *skb = READ_ONCE(list_->prev); + + if (skb == (struct sk_buff *)list_) + skb = NULL; +@@ -1861,7 +1861,9 @@ static inline void __skb_insert(struct sk_buff *newsk, + struct sk_buff *prev, struct sk_buff *next, + struct sk_buff_head *list) + { +- /* see skb_queue_empty_lockless() for the opposite READ_ONCE() */ ++ /* See skb_queue_empty_lockless() and skb_peek_tail() ++ * for the opposite READ_ONCE() ++ */ + WRITE_ONCE(newsk->next, next); + WRITE_ONCE(newsk->prev, prev); + WRITE_ONCE(next->prev, newsk); +diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h +index 659a4400517b..e93e249a4e9b 100644 +--- a/include/linux/thread_info.h ++++ b/include/linux/thread_info.h +@@ -147,6 +147,8 @@ check_copy_size(const void *addr, size_t bytes, bool is_source) + __bad_copy_to(); + return false; + } ++ if (WARN_ON_ONCE(bytes > INT_MAX)) ++ return false; + check_object_size(addr, bytes, is_source); + return true; + } +diff --git a/include/net/dst.h b/include/net/dst.h +index 8224dad2ae94..3448cf865ede 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -516,7 +516,16 @@ static inline void skb_dst_update_pmtu(struct sk_buff *skb, u32 mtu) + struct dst_entry *dst = skb_dst(skb); + + if (dst && dst->ops->update_pmtu) +- dst->ops->update_pmtu(dst, NULL, skb, mtu); ++ dst->ops->update_pmtu(dst, NULL, skb, mtu, true); ++} ++ ++/* update dst pmtu but not do neighbor confirm */ ++static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu) ++{ ++ struct dst_entry *dst = skb_dst(skb); ++ ++ if (dst && dst->ops->update_pmtu) ++ dst->ops->update_pmtu(dst, NULL, skb, mtu, false); + } + + static inline void skb_tunnel_check_pmtu(struct sk_buff *skb, +@@ -526,7 +535,7 @@ static inline void skb_tunnel_check_pmtu(struct sk_buff *skb, + u32 encap_mtu = dst_mtu(encap_dst); + + if (skb->len > encap_mtu - headroom) +- skb_dst_update_pmtu(skb, encap_mtu - headroom); ++ skb_dst_update_pmtu_no_confirm(skb, encap_mtu - headroom); + } + + #endif /* _NET_DST_H */ +diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h +index 5ec645f27ee3..443863c7b8da 100644 +--- a/include/net/dst_ops.h ++++ b/include/net/dst_ops.h +@@ -27,7 +27,8 @@ struct dst_ops { + struct dst_entry * (*negative_advice)(struct dst_entry *); + void (*link_failure)(struct sk_buff *); + void (*update_pmtu)(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu); ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh); + void (*redirect)(struct dst_entry *dst, struct sock *sk, + struct sk_buff *skb); + int (*local_out)(struct net *net, struct sock *sk, struct sk_buff *skb); +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h +index af2b4c065a04..d0019d3395cf 100644 +--- a/include/net/inet_hashtables.h ++++ b/include/net/inet_hashtables.h +@@ -103,13 +103,19 @@ struct inet_bind_hashbucket { + struct hlist_head chain; + }; + +-/* +- * Sockets can be hashed in established or listening table ++/* Sockets can be hashed in established or listening table. ++ * We must use different 'nulls' end-of-chain value for all hash buckets : ++ * A socket might transition from ESTABLISH to LISTEN state without ++ * RCU grace period. A lookup in ehash table needs to handle this case. + */ ++#define LISTENING_NULLS_BASE (1U << 29) + struct inet_listen_hashbucket { + spinlock_t lock; + unsigned int count; +- struct hlist_head head; ++ union { ++ struct hlist_head head; ++ struct hlist_nulls_head nulls_head; ++ }; + }; + + /* This is for listening sockets, thus all sockets which possess wildcards. */ +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index d80acda231ae..47e61956168d 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -308,6 +308,7 @@ struct tcf_proto_ops { + int (*delete)(struct tcf_proto *tp, void *arg, + bool *last, bool rtnl_held, + struct netlink_ext_ack *); ++ bool (*delete_empty)(struct tcf_proto *tp); + void (*walk)(struct tcf_proto *tp, + struct tcf_walker *arg, bool rtnl_held); + int (*reoffload)(struct tcf_proto *tp, bool add, +@@ -336,6 +337,10 @@ struct tcf_proto_ops { + int flags; + }; + ++/* Classifiers setting TCF_PROTO_OPS_DOIT_UNLOCKED in tcf_proto_ops->flags ++ * are expected to implement tcf_proto_ops->delete_empty(), otherwise race ++ * conditions can occur when filters are inserted/deleted simultaneously. ++ */ + enum tcf_proto_ops_flags { + TCF_PROTO_OPS_DOIT_UNLOCKED = 1, + }; +diff --git a/include/net/sock.h b/include/net/sock.h +index 013396e50b91..e09e2886a836 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -723,6 +723,11 @@ static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_h + hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); + } + ++static inline void __sk_nulls_add_node_tail_rcu(struct sock *sk, struct hlist_nulls_head *list) ++{ ++ hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list); ++} ++ + static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) + { + sock_hold(sk); +diff --git a/include/scsi/iscsi_proto.h b/include/scsi/iscsi_proto.h +index b71b5c4f418c..533f56733ba8 100644 +--- a/include/scsi/iscsi_proto.h ++++ b/include/scsi/iscsi_proto.h +@@ -627,6 +627,7 @@ struct iscsi_reject { + #define ISCSI_REASON_BOOKMARK_INVALID 9 + #define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10 + #define ISCSI_REASON_NEGOTIATION_RESET 11 ++#define ISCSI_REASON_WAITING_FOR_LOGOUT 12 + + /* Max. number of Key=Value pairs in a text message */ + #define MAX_KEY_VALUE_PAIRS 8192 +diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c +index 545e3869b0e3..551b0eb7028a 100644 +--- a/kernel/dma/coherent.c ++++ b/kernel/dma/coherent.c +@@ -123,8 +123,9 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr, + return ret; + } + +-static void *__dma_alloc_from_coherent(struct dma_coherent_mem *mem, +- ssize_t size, dma_addr_t *dma_handle) ++static void *__dma_alloc_from_coherent(struct device *dev, ++ struct dma_coherent_mem *mem, ++ ssize_t size, dma_addr_t *dma_handle) + { + int order = get_order(size); + unsigned long flags; +@@ -143,7 +144,7 @@ static void *__dma_alloc_from_coherent(struct dma_coherent_mem *mem, + /* + * Memory was found in the coherent area. + */ +- *dma_handle = mem->device_base + (pageno << PAGE_SHIFT); ++ *dma_handle = dma_get_device_base(dev, mem) + (pageno << PAGE_SHIFT); + ret = mem->virt_base + (pageno << PAGE_SHIFT); + spin_unlock_irqrestore(&mem->spinlock, flags); + memset(ret, 0, size); +@@ -175,17 +176,18 @@ int dma_alloc_from_dev_coherent(struct device *dev, ssize_t size, + if (!mem) + return 0; + +- *ret = __dma_alloc_from_coherent(mem, size, dma_handle); ++ *ret = __dma_alloc_from_coherent(dev, mem, size, dma_handle); + return 1; + } + +-void *dma_alloc_from_global_coherent(ssize_t size, dma_addr_t *dma_handle) ++void *dma_alloc_from_global_coherent(struct device *dev, ssize_t size, ++ dma_addr_t *dma_handle) + { + if (!dma_coherent_default_memory) + return NULL; + +- return __dma_alloc_from_coherent(dma_coherent_default_memory, size, +- dma_handle); ++ return __dma_alloc_from_coherent(dev, dma_coherent_default_memory, size, ++ dma_handle); + } + + static int __dma_release_from_coherent(struct dma_coherent_mem *mem, +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index 099002d84f46..4ad74f5987ea 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -420,6 +420,7 @@ void debug_dma_dump_mappings(struct device *dev) + } + + spin_unlock_irqrestore(&bucket->lock, flags); ++ cond_resched(); + } + } + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index b6f2f35d0bcf..70665934d53e 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1466,7 +1466,7 @@ static struct ctl_table vm_table[] = { + .procname = "drop_caches", + .data = &sysctl_drop_caches, + .maxlen = sizeof(int), +- .mode = 0644, ++ .mode = 0200, + .proc_handler = drop_caches_sysctl_handler, + .extra1 = SYSCTL_ONE, + .extra2 = &four, +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 65605530ee34..7f31932216a1 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -966,7 +966,8 @@ static int enqueue_hrtimer(struct hrtimer *timer, + + base->cpu_base->active_bases |= 1 << base->index; + +- timer->state = HRTIMER_STATE_ENQUEUED; ++ /* Pairs with the lockless read in hrtimer_is_queued() */ ++ WRITE_ONCE(timer->state, HRTIMER_STATE_ENQUEUED); + + return timerqueue_add(&base->active, &timer->node); + } +@@ -988,7 +989,8 @@ static void __remove_hrtimer(struct hrtimer *timer, + struct hrtimer_cpu_base *cpu_base = base->cpu_base; + u8 state = timer->state; + +- timer->state = newstate; ++ /* Pairs with the lockless read in hrtimer_is_queued() */ ++ WRITE_ONCE(timer->state, newstate); + if (!(state & HRTIMER_STATE_ENQUEUED)) + return; + +@@ -1013,8 +1015,9 @@ static void __remove_hrtimer(struct hrtimer *timer, + static inline int + remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart) + { +- if (hrtimer_is_queued(timer)) { +- u8 state = timer->state; ++ u8 state = timer->state; ++ ++ if (state & HRTIMER_STATE_ENQUEUED) { + int reprogram; + + /* +diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c +index ec960bb939fd..200fb2d3be99 100644 +--- a/kernel/time/posix-clock.c ++++ b/kernel/time/posix-clock.c +@@ -14,8 +14,6 @@ + + #include "posix-timers.h" + +-static void delete_clock(struct kref *kref); +- + /* + * Returns NULL if the posix_clock instance attached to 'fp' is old and stale. + */ +@@ -125,7 +123,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp) + err = 0; + + if (!err) { +- kref_get(&clk->kref); ++ get_device(clk->dev); + fp->private_data = clk; + } + out: +@@ -141,7 +139,7 @@ static int posix_clock_release(struct inode *inode, struct file *fp) + if (clk->ops.release) + err = clk->ops.release(clk); + +- kref_put(&clk->kref, delete_clock); ++ put_device(clk->dev); + + fp->private_data = NULL; + +@@ -161,38 +159,35 @@ static const struct file_operations posix_clock_file_operations = { + #endif + }; + +-int posix_clock_register(struct posix_clock *clk, dev_t devid) ++int posix_clock_register(struct posix_clock *clk, struct device *dev) + { + int err; + +- kref_init(&clk->kref); + init_rwsem(&clk->rwsem); + + cdev_init(&clk->cdev, &posix_clock_file_operations); ++ err = cdev_device_add(&clk->cdev, dev); ++ if (err) { ++ pr_err("%s unable to add device %d:%d\n", ++ dev_name(dev), MAJOR(dev->devt), MINOR(dev->devt)); ++ return err; ++ } + clk->cdev.owner = clk->ops.owner; +- err = cdev_add(&clk->cdev, devid, 1); ++ clk->dev = dev; + +- return err; ++ return 0; + } + EXPORT_SYMBOL_GPL(posix_clock_register); + +-static void delete_clock(struct kref *kref) +-{ +- struct posix_clock *clk = container_of(kref, struct posix_clock, kref); +- +- if (clk->release) +- clk->release(clk); +-} +- + void posix_clock_unregister(struct posix_clock *clk) + { +- cdev_del(&clk->cdev); ++ cdev_device_del(&clk->cdev, clk->dev); + + down_write(&clk->rwsem); + clk->zombie = true; + up_write(&clk->rwsem); + +- kref_put(&clk->kref, delete_clock); ++ put_device(clk->dev); + } + EXPORT_SYMBOL_GPL(posix_clock_unregister); + +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index af7800103e51..59980ecfc962 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -662,6 +662,9 @@ static unsigned int br_nf_forward_arp(void *priv, + nf_bridge_pull_encap_header(skb); + } + ++ if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr)))) ++ return NF_DROP; ++ + if (arp_hdr(skb)->ar_pln != 4) { + if (is_vlan_arp(skb, state->net)) + nf_bridge_push_encap_header(skb); +diff --git a/net/bridge/br_nf_core.c b/net/bridge/br_nf_core.c +index 2cdfc5d6c25d..8c69f0c95a8e 100644 +--- a/net/bridge/br_nf_core.c ++++ b/net/bridge/br_nf_core.c +@@ -22,7 +22,8 @@ + #endif + + static void fake_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + } + +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 4096d8a74a2b..e1256e03a9a8 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1867,7 +1867,7 @@ static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz) + } + + static int ebt_buf_add(struct ebt_entries_buf_state *state, +- void *data, unsigned int sz) ++ const void *data, unsigned int sz) + { + if (state->buf_kern_start == NULL) + goto count_only; +@@ -1901,7 +1901,7 @@ enum compat_mwt { + EBT_COMPAT_TARGET, + }; + +-static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, ++static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt, + enum compat_mwt compat_mwt, + struct ebt_entries_buf_state *state, + const unsigned char *base) +@@ -1979,22 +1979,23 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, + /* return size of all matches, watchers or target, including necessary + * alignment and padding. + */ +-static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, ++static int ebt_size_mwt(const struct compat_ebt_entry_mwt *match32, + unsigned int size_left, enum compat_mwt type, + struct ebt_entries_buf_state *state, const void *base) + { ++ const char *buf = (const char *)match32; + int growth = 0; +- char *buf; + + if (size_left == 0) + return 0; + +- buf = (char *) match32; +- +- while (size_left >= sizeof(*match32)) { ++ do { + struct ebt_entry_match *match_kern; + int ret; + ++ if (size_left < sizeof(*match32)) ++ return -EINVAL; ++ + match_kern = (struct ebt_entry_match *) state->buf_kern_start; + if (match_kern) { + char *tmp; +@@ -2031,22 +2032,18 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, + if (match_kern) + match_kern->match_size = ret; + +- /* rule should have no remaining data after target */ +- if (type == EBT_COMPAT_TARGET && size_left) +- return -EINVAL; +- + match32 = (struct compat_ebt_entry_mwt *) buf; +- } ++ } while (size_left); + + return growth; + } + + /* called for all ebt_entry structures. */ +-static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, ++static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *base, + unsigned int *total, + struct ebt_entries_buf_state *state) + { +- unsigned int i, j, startoff, new_offset = 0; ++ unsigned int i, j, startoff, next_expected_off, new_offset = 0; + /* stores match/watchers/targets & offset of next struct ebt_entry: */ + unsigned int offsets[4]; + unsigned int *offsets_update = NULL; +@@ -2132,11 +2129,13 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, + return ret; + } + +- startoff = state->buf_user_offset - startoff; ++ next_expected_off = state->buf_user_offset - startoff; ++ if (next_expected_off != entry->next_offset) ++ return -EINVAL; + +- if (WARN_ON(*total < startoff)) ++ if (*total < entry->next_offset) + return -EINVAL; +- *total -= startoff; ++ *total -= entry->next_offset; + return 0; + } + +diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c +index aea918135ec3..08c3dc45f1a4 100644 +--- a/net/decnet/dn_route.c ++++ b/net/decnet/dn_route.c +@@ -110,7 +110,8 @@ static void dn_dst_ifdown(struct dst_entry *, struct net_device *dev, int how); + static struct dst_entry *dn_dst_negative_advice(struct dst_entry *); + static void dn_dst_link_failure(struct sk_buff *); + static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb , u32 mtu); ++ struct sk_buff *skb , u32 mtu, ++ bool confirm_neigh); + static void dn_dst_redirect(struct dst_entry *dst, struct sock *sk, + struct sk_buff *skb); + static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst, +@@ -251,7 +252,8 @@ static int dn_dst_gc(struct dst_ops *ops) + * advertise to the other end). + */ + static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + struct dn_route *rt = (struct dn_route *) dst; + struct neighbour *n = rt->n; +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 4298aae74e0e..ac95ba78b903 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -249,10 +249,11 @@ bool icmp_global_allow(void) + bool rc = false; + + /* Check if token bucket is empty and cannot be refilled +- * without taking the spinlock. ++ * without taking the spinlock. The READ_ONCE() are paired ++ * with the following WRITE_ONCE() in this same function. + */ +- if (!icmp_global.credit) { +- delta = min_t(u32, now - icmp_global.stamp, HZ); ++ if (!READ_ONCE(icmp_global.credit)) { ++ delta = min_t(u32, now - READ_ONCE(icmp_global.stamp), HZ); + if (delta < HZ / 50) + return false; + } +@@ -262,14 +263,14 @@ bool icmp_global_allow(void) + if (delta >= HZ / 50) { + incr = sysctl_icmp_msgs_per_sec * delta / HZ ; + if (incr) +- icmp_global.stamp = now; ++ WRITE_ONCE(icmp_global.stamp, now); + } + credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); + if (credit) { + credit--; + rc = true; + } +- icmp_global.credit = credit; ++ WRITE_ONCE(icmp_global.credit, credit); + spin_unlock(&icmp_global.lock); + return rc; + } +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index eb30fc1770de..ac05e273bc66 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -1086,7 +1086,7 @@ struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu) + if (!dst) + goto out; + } +- dst->ops->update_pmtu(dst, sk, NULL, mtu); ++ dst->ops->update_pmtu(dst, sk, NULL, mtu, true); + + dst = __sk_dst_check(sk, 0); + if (!dst) +diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c +index 7dc79b973e6e..6a4c82f96e78 100644 +--- a/net/ipv4/inet_diag.c ++++ b/net/ipv4/inet_diag.c +@@ -914,11 +914,12 @@ void inet_diag_dump_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *skb, + + for (i = s_i; i < INET_LHTABLE_SIZE; i++) { + struct inet_listen_hashbucket *ilb; ++ struct hlist_nulls_node *node; + + num = 0; + ilb = &hashinfo->listening_hash[i]; + spin_lock(&ilb->lock); +- sk_for_each(sk, &ilb->head) { ++ sk_nulls_for_each(sk, node, &ilb->nulls_head) { + struct inet_sock *inet = inet_sk(sk); + + if (!net_eq(sock_net(sk), net)) +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 83fb00153018..2bbaaf0c7176 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -516,10 +516,11 @@ static int inet_reuseport_add_sock(struct sock *sk, + struct inet_listen_hashbucket *ilb) + { + struct inet_bind_bucket *tb = inet_csk(sk)->icsk_bind_hash; ++ const struct hlist_nulls_node *node; + struct sock *sk2; + kuid_t uid = sock_i_uid(sk); + +- sk_for_each_rcu(sk2, &ilb->head) { ++ sk_nulls_for_each_rcu(sk2, node, &ilb->nulls_head) { + if (sk2 != sk && + sk2->sk_family == sk->sk_family && + ipv6_only_sock(sk2) == ipv6_only_sock(sk) && +@@ -555,9 +556,9 @@ int __inet_hash(struct sock *sk, struct sock *osk) + } + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport && + sk->sk_family == AF_INET6) +- hlist_add_tail_rcu(&sk->sk_node, &ilb->head); ++ __sk_nulls_add_node_tail_rcu(sk, &ilb->nulls_head); + else +- hlist_add_head_rcu(&sk->sk_node, &ilb->head); ++ __sk_nulls_add_node_rcu(sk, &ilb->nulls_head); + inet_hash2(hashinfo, sk); + ilb->count++; + sock_set_flag(sk, SOCK_RCU_FREE); +@@ -606,11 +607,9 @@ void inet_unhash(struct sock *sk) + reuseport_detach_sock(sk); + if (ilb) { + inet_unhash2(hashinfo, sk); +- __sk_del_node_init(sk); +- ilb->count--; +- } else { +- __sk_nulls_del_node_init_rcu(sk); ++ ilb->count--; + } ++ __sk_nulls_del_node_init_rcu(sk); + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); + unlock: + spin_unlock_bh(lock); +@@ -750,7 +749,8 @@ void inet_hashinfo_init(struct inet_hashinfo *h) + + for (i = 0; i < INET_LHTABLE_SIZE; i++) { + spin_lock_init(&h->listening_hash[i].lock); +- INIT_HLIST_HEAD(&h->listening_hash[i].head); ++ INIT_HLIST_NULLS_HEAD(&h->listening_hash[i].nulls_head, ++ i + LISTENING_NULLS_BASE); + h->listening_hash[i].count = 0; + } + +diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c +index be778599bfed..ff327a62c9ce 100644 +--- a/net/ipv4/inetpeer.c ++++ b/net/ipv4/inetpeer.c +@@ -160,7 +160,12 @@ static void inet_peer_gc(struct inet_peer_base *base, + base->total / inet_peer_threshold * HZ; + for (i = 0; i < gc_cnt; i++) { + p = gc_stack[i]; +- delta = (__u32)jiffies - p->dtime; ++ ++ /* The READ_ONCE() pairs with the WRITE_ONCE() ++ * in inet_putpeer() ++ */ ++ delta = (__u32)jiffies - READ_ONCE(p->dtime); ++ + if (delta < ttl || !refcount_dec_if_one(&p->refcnt)) + gc_stack[i] = NULL; + } +@@ -237,7 +242,10 @@ EXPORT_SYMBOL_GPL(inet_getpeer); + + void inet_putpeer(struct inet_peer *p) + { +- p->dtime = (__u32)jiffies; ++ /* The WRITE_ONCE() pairs with itself (we run lockless) ++ * and the READ_ONCE() in inet_peer_gc() ++ */ ++ WRITE_ONCE(p->dtime, (__u32)jiffies); + + if (refcount_dec_and_test(&p->refcnt)) + call_rcu(&p->rcu, inetpeer_free_rcu); +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 38c02bb62e2c..0fe2a5d3e258 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -505,7 +505,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + mtu = skb_valid_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu; + + if (skb_valid_dst(skb)) +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + + if (skb->protocol == htons(ETH_P_IP)) { + if (!skb_is_gso(skb) && +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index cfb025606793..fb9f6d60c27c 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -214,7 +214,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, + + mtu = dst_mtu(dst); + if (skb->len > mtu) { +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + if (skb->protocol == htons(ETH_P_IP)) { + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(mtu)); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 621f83434b24..fe34e9e0912a 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -139,7 +139,8 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst); + static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst); + static void ipv4_link_failure(struct sk_buff *skb); + static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu); ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh); + static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, + struct sk_buff *skb); + static void ipv4_dst_destroy(struct dst_entry *dst); +@@ -1043,7 +1044,8 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) + } + + static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + struct rtable *rt = (struct rtable *) dst; + struct flowi4 fl4; +@@ -2648,7 +2650,8 @@ static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst) + } + + static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + } + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 67b2dc7a1727..eda64871f983 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -2149,13 +2149,14 @@ static void *listening_get_next(struct seq_file *seq, void *cur) + struct tcp_iter_state *st = seq->private; + struct net *net = seq_file_net(seq); + struct inet_listen_hashbucket *ilb; ++ struct hlist_nulls_node *node; + struct sock *sk = cur; + + if (!sk) { + get_head: + ilb = &tcp_hashinfo.listening_hash[st->bucket]; + spin_lock(&ilb->lock); +- sk = sk_head(&ilb->head); ++ sk = sk_nulls_head(&ilb->nulls_head); + st->offset = 0; + goto get_sk; + } +@@ -2163,9 +2164,9 @@ get_head: + ++st->num; + ++st->offset; + +- sk = sk_next(sk); ++ sk = sk_nulls_next(sk); + get_sk: +- sk_for_each_from(sk) { ++ sk_nulls_for_each_from(sk, node) { + if (!net_eq(sock_net(sk), net)) + continue; + if (sk->sk_family == afinfo->family) +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 762edd800d78..0269584e9cf7 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -72,6 +72,9 @@ static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb) + __skb_unlink(skb, &sk->sk_write_queue); + tcp_rbtree_insert(&sk->tcp_rtx_queue, skb); + ++ if (tp->highest_sack == NULL) ++ tp->highest_sack = skb; ++ + tp->packets_out += tcp_skb_pcount(skb); + if (!prior_packets || icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) + tcp_rearm_rto(sk); +@@ -2438,6 +2441,14 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, + if (tcp_small_queue_check(sk, skb, 0)) + break; + ++ /* Argh, we hit an empty skb(), presumably a thread ++ * is sleeping in sendmsg()/sk_stream_wait_memory(). ++ * We do not want to send a pure-ack packet and have ++ * a strange looking rtx queue with empty packet(s). ++ */ ++ if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) ++ break; ++ + if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp))) + break; + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 447defbfccdd..7aa4e77161f6 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1475,7 +1475,7 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb) + * queue contains some other skb + */ + rmem = atomic_add_return(size, &sk->sk_rmem_alloc); +- if (rmem > (size + sk->sk_rcvbuf)) ++ if (rmem > (size + (unsigned int)sk->sk_rcvbuf)) + goto uncharge_drop; + + spin_lock(&list->lock); +diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c +index 35b84b52b702..9ebd54752e03 100644 +--- a/net/ipv4/xfrm4_policy.c ++++ b/net/ipv4/xfrm4_policy.c +@@ -100,12 +100,13 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, + } + + static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + struct xfrm_dst *xdst = (struct xfrm_dst *)dst; + struct dst_entry *path = xdst->route; + +- path->ops->update_pmtu(path, sk, skb, mtu); ++ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh); + } + + static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk, +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 34ccef18b40e..f9b5690e94fd 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -5231,16 +5231,16 @@ static int inet6_rtm_valid_getaddr_req(struct sk_buff *skb, + return -EINVAL; + } + ++ if (!netlink_strict_get_check(skb)) ++ return nlmsg_parse_deprecated(nlh, sizeof(*ifm), tb, IFA_MAX, ++ ifa_ipv6_policy, extack); ++ + ifm = nlmsg_data(nlh); + if (ifm->ifa_prefixlen || ifm->ifa_flags || ifm->ifa_scope) { + NL_SET_ERR_MSG_MOD(extack, "Invalid values in header for get address request"); + return -EINVAL; + } + +- if (!netlink_strict_get_check(skb)) +- return nlmsg_parse_deprecated(nlh, sizeof(*ifm), tb, IFA_MAX, +- ifa_ipv6_policy, extack); +- + err = nlmsg_parse_deprecated_strict(nlh, sizeof(*ifm), tb, IFA_MAX, + ifa_ipv6_policy, extack); + if (err) +diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c +index fe9cb8d1adca..e315526fa244 100644 +--- a/net/ipv6/inet6_connection_sock.c ++++ b/net/ipv6/inet6_connection_sock.c +@@ -146,7 +146,7 @@ struct dst_entry *inet6_csk_update_pmtu(struct sock *sk, u32 mtu) + + if (IS_ERR(dst)) + return NULL; +- dst->ops->update_pmtu(dst, sk, NULL, mtu); ++ dst->ops->update_pmtu(dst, sk, NULL, mtu, true); + + dst = inet6_csk_route_socket(sk, &fl6); + return IS_ERR(dst) ? NULL : dst; +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 923034c52ce4..189de56f5e36 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1040,7 +1040,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + + /* TooBig packet may have updated dst->dev's mtu */ + if (!t->parms.collect_md && dst && dst_mtu(dst) > dst->dev->mtu) +- dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu); ++ dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu, false); + + err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu, + NEXTHDR_GRE); +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 754a484d35df..2f376dbc37d5 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -640,7 +640,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + if (rel_info > dst_mtu(skb_dst(skb2))) + goto out; + +- skb_dst_update_pmtu(skb2, rel_info); ++ skb_dst_update_pmtu_no_confirm(skb2, rel_info); + } + + icmp_send(skb2, rel_type, rel_code, htonl(rel_info)); +@@ -1132,7 +1132,7 @@ route_lookup: + mtu = max(mtu, skb->protocol == htons(ETH_P_IPV6) ? + IPV6_MIN_MTU : IPV4_MIN_MTU); + +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { + *pmtu = mtu; + err = -EMSGSIZE; +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 024db17386d2..6f08b760c2a7 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -479,7 +479,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + + mtu = dst_mtu(dst); + if (skb->len > mtu) { +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + + if (skb->protocol == htons(ETH_P_IPV6)) { + if (mtu < IPV6_MIN_MTU) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 3f83ea851ebf..e4ed9c7b43b0 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -95,7 +95,8 @@ static int ip6_pkt_prohibit(struct sk_buff *skb); + static int ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb); + static void ip6_link_failure(struct sk_buff *skb); + static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu); ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh); + static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, + struct sk_buff *skb); + static int rt6_score_route(const struct fib6_nh *nh, u32 fib6_flags, int oif, +@@ -264,7 +265,8 @@ static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst) + } + + static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + } + +@@ -2695,7 +2697,8 @@ static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) + } + + static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, +- const struct ipv6hdr *iph, u32 mtu) ++ const struct ipv6hdr *iph, u32 mtu, ++ bool confirm_neigh) + { + const struct in6_addr *daddr, *saddr; + struct rt6_info *rt6 = (struct rt6_info *)dst; +@@ -2713,7 +2716,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, + daddr = NULL; + saddr = NULL; + } +- dst_confirm_neigh(dst, daddr); ++ ++ if (confirm_neigh) ++ dst_confirm_neigh(dst, daddr); ++ + mtu = max_t(u32, mtu, IPV6_MIN_MTU); + if (mtu >= dst_mtu(dst)) + return; +@@ -2767,9 +2773,11 @@ out_unlock: + } + + static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { +- __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu); ++ __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu, ++ confirm_neigh); + } + + void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu, +@@ -2788,7 +2796,7 @@ void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu, + + dst = ip6_route_output(net, NULL, &fl6); + if (!dst->error) +- __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu)); ++ __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu), true); + dst_release(dst); + } + EXPORT_SYMBOL_GPL(ip6_update_pmtu); +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index b2ccbc473127..98954830c40b 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -944,7 +944,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, + } + + if (tunnel->parms.iph.daddr) +- skb_dst_update_pmtu(skb, mtu); ++ skb_dst_update_pmtu_no_confirm(skb, mtu); + + if (skb->len > mtu && !skb_is_gso(skb)) { + icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); +diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c +index 699e0730ce8e..af7a4b8b1e9c 100644 +--- a/net/ipv6/xfrm6_policy.c ++++ b/net/ipv6/xfrm6_policy.c +@@ -98,12 +98,13 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, + } + + static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu) ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) + { + struct xfrm_dst *xdst = (struct xfrm_dst *)dst; + struct dst_entry *path = xdst->route; + +- path->ops->update_pmtu(path, sk, skb, mtu); ++ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh); + } + + static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk, +diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c +index 888d3068a492..c62a131a6094 100644 +--- a/net/netfilter/ipvs/ip_vs_xmit.c ++++ b/net/netfilter/ipvs/ip_vs_xmit.c +@@ -208,7 +208,7 @@ static inline void maybe_update_pmtu(int skb_af, struct sk_buff *skb, int mtu) + struct rtable *ort = skb_rtable(skb); + + if (!skb->dev && sk && sk_fullsock(sk)) +- ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu); ++ ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu, true); + } + + static inline bool ensure_mtu_is_adequate(struct netns_ipvs *ipvs, int skb_af, +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 08923b21e566..f0df0d90b8bd 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -219,8 +219,10 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + bool use_reinsert; + bool want_ingress; + bool is_redirect; ++ bool expects_nh; + int m_eaction; + int mac_len; ++ bool at_nh; + + rec_level = __this_cpu_inc_return(mirred_rec_level); + if (unlikely(rec_level > MIRRED_RECURSION_LIMIT)) { +@@ -261,19 +263,19 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + goto out; + } + +- /* If action's target direction differs than filter's direction, +- * and devices expect a mac header on xmit, then mac push/pull is +- * needed. +- */ + want_ingress = tcf_mirred_act_wants_ingress(m_eaction); +- if (skb_at_tc_ingress(skb) != want_ingress && m_mac_header_xmit) { +- if (!skb_at_tc_ingress(skb)) { +- /* caught at egress, act ingress: pull mac */ +- mac_len = skb_network_header(skb) - skb_mac_header(skb); ++ ++ expects_nh = want_ingress || !m_mac_header_xmit; ++ at_nh = skb->data == skb_network_header(skb); ++ if (at_nh != expects_nh) { ++ mac_len = skb_at_tc_ingress(skb) ? skb->mac_len : ++ skb_network_header(skb) - skb_mac_header(skb); ++ if (expects_nh) { ++ /* target device/action expect data at nh */ + skb_pull_rcsum(skb2, mac_len); + } else { +- /* caught at ingress, act egress: push mac */ +- skb_push_rcsum(skb2, skb->mac_len); ++ /* target device/action expect data at mac */ ++ skb_push_rcsum(skb2, mac_len); + } + } + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 6a0eacafdb19..76e0d122616a 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -308,33 +308,12 @@ static void tcf_proto_put(struct tcf_proto *tp, bool rtnl_held, + tcf_proto_destroy(tp, rtnl_held, true, extack); + } + +-static int walker_check_empty(struct tcf_proto *tp, void *fh, +- struct tcf_walker *arg) ++static bool tcf_proto_check_delete(struct tcf_proto *tp) + { +- if (fh) { +- arg->nonempty = true; +- return -1; +- } +- return 0; +-} +- +-static bool tcf_proto_is_empty(struct tcf_proto *tp, bool rtnl_held) +-{ +- struct tcf_walker walker = { .fn = walker_check_empty, }; +- +- if (tp->ops->walk) { +- tp->ops->walk(tp, &walker, rtnl_held); +- return !walker.nonempty; +- } +- return true; +-} ++ if (tp->ops->delete_empty) ++ return tp->ops->delete_empty(tp); + +-static bool tcf_proto_check_delete(struct tcf_proto *tp, bool rtnl_held) +-{ +- spin_lock(&tp->lock); +- if (tcf_proto_is_empty(tp, rtnl_held)) +- tp->deleting = true; +- spin_unlock(&tp->lock); ++ tp->deleting = true; + return tp->deleting; + } + +@@ -1751,7 +1730,7 @@ static void tcf_chain_tp_delete_empty(struct tcf_chain *chain, + * concurrently. + * Mark tp for deletion if it is empty. + */ +- if (!tp_iter || !tcf_proto_check_delete(tp, rtnl_held)) { ++ if (!tp_iter || !tcf_proto_check_delete(tp)) { + mutex_unlock(&chain->filter_chain_lock); + return; + } +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 4ac110bf19c5..5cf8163710c8 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -2519,6 +2519,17 @@ static void fl_bind_class(void *fh, u32 classid, unsigned long cl) + f->res.class = cl; + } + ++static bool fl_delete_empty(struct tcf_proto *tp) ++{ ++ struct cls_fl_head *head = fl_head_dereference(tp); ++ ++ spin_lock(&tp->lock); ++ tp->deleting = idr_is_empty(&head->handle_idr); ++ spin_unlock(&tp->lock); ++ ++ return tp->deleting; ++} ++ + static struct tcf_proto_ops cls_fl_ops __read_mostly = { + .kind = "flower", + .classify = fl_classify, +@@ -2528,6 +2539,7 @@ static struct tcf_proto_ops cls_fl_ops __read_mostly = { + .put = fl_put, + .change = fl_change, + .delete = fl_delete, ++ .delete_empty = fl_delete_empty, + .walk = fl_walk, + .reoffload = fl_reoffload, + .hw_add = fl_hw_add, +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 98dd87ce1510..78ecdf146882 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -301,6 +301,9 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q) + f->socket_hash != sk->sk_hash)) { + f->credit = q->initial_quantum; + f->socket_hash = sk->sk_hash; ++ if (q->rate_enable) ++ smp_store_release(&sk->sk_pacing_status, ++ SK_PACING_FQ); + if (fq_flow_is_throttled(f)) + fq_flow_unset_throttled(q, f); + f->time_next_packet = 0ULL; +@@ -322,8 +325,12 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q) + + fq_flow_set_detached(f); + f->sk = sk; +- if (skb->sk == sk) ++ if (skb->sk == sk) { + f->socket_hash = sk->sk_hash; ++ if (q->rate_enable) ++ smp_store_release(&sk->sk_pacing_status, ++ SK_PACING_FQ); ++ } + f->credit = q->initial_quantum; + + rb_link_node(&f->fq_node, parent, p); +@@ -428,17 +435,9 @@ static int fq_enqueue(struct sk_buff *skb, struct Qdisc *sch, + f->qlen++; + qdisc_qstats_backlog_inc(sch, skb); + if (fq_flow_is_detached(f)) { +- struct sock *sk = skb->sk; +- + fq_flow_add_tail(&q->new_flows, f); + if (time_after(jiffies, f->age + q->flow_refill_delay)) + f->credit = max_t(u32, f->credit, q->quantum); +- if (sk && q->rate_enable) { +- if (unlikely(smp_load_acquire(&sk->sk_pacing_status) != +- SK_PACING_FQ)) +- smp_store_release(&sk->sk_pacing_status, +- SK_PACING_FQ); +- } + q->inactive_flows--; + } + +diff --git a/net/sctp/stream.c b/net/sctp/stream.c +index 6a30392068a0..c1a100d2fed3 100644 +--- a/net/sctp/stream.c ++++ b/net/sctp/stream.c +@@ -84,10 +84,8 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt, + return 0; + + ret = genradix_prealloc(&stream->out, outcnt, gfp); +- if (ret) { +- genradix_free(&stream->out); ++ if (ret) + return ret; +- } + + stream->outcnt = outcnt; + return 0; +@@ -102,10 +100,8 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt, + return 0; + + ret = genradix_prealloc(&stream->in, incnt, gfp); +- if (ret) { +- genradix_free(&stream->in); ++ if (ret) + return ret; +- } + + stream->incnt = incnt; + return 0; +@@ -123,7 +119,7 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt, + * a new one with new outcnt to save memory if needed. + */ + if (outcnt == stream->outcnt) +- goto in; ++ goto handle_in; + + /* Filter out chunks queued on streams that won't exist anymore */ + sched->unsched_all(stream); +@@ -132,24 +128,28 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt, + + ret = sctp_stream_alloc_out(stream, outcnt, gfp); + if (ret) +- goto out; ++ goto out_err; + + for (i = 0; i < stream->outcnt; i++) + SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN; + +-in: ++handle_in: + sctp_stream_interleave_init(stream); + if (!incnt) + goto out; + + ret = sctp_stream_alloc_in(stream, incnt, gfp); +- if (ret) { +- sched->free(stream); +- genradix_free(&stream->out); +- stream->outcnt = 0; +- goto out; +- } ++ if (ret) ++ goto in_err; ++ ++ goto out; + ++in_err: ++ sched->free(stream); ++ genradix_free(&stream->in); ++out_err: ++ genradix_free(&stream->out); ++ stream->outcnt = 0; + out: + return ret; + } +diff --git a/net/sctp/transport.c b/net/sctp/transport.c +index 7235a6032671..3bbe1a58ec87 100644 +--- a/net/sctp/transport.c ++++ b/net/sctp/transport.c +@@ -263,7 +263,7 @@ bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu) + + pf->af->from_sk(&addr, sk); + pf->to_sk_daddr(&t->ipaddr, sk); +- dst->ops->update_pmtu(dst, sk, NULL, pmtu); ++ dst->ops->update_pmtu(dst, sk, NULL, pmtu, true); + pf->to_sk_daddr(&addr, sk); + + dst = sctp_transport_dst_check(t); +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 737b49909a7a..6a6d3b2aa5a9 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -854,6 +854,8 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr, + goto out; + + sock_hold(&smc->sk); /* sock put in passive closing */ ++ if (smc->use_fallback) ++ goto out; + if (flags & O_NONBLOCK) { + if (schedule_work(&smc->connect_work)) + smc->connect_nonblock = 1; +@@ -1716,8 +1718,6 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + sk->sk_err = smc->clcsock->sk->sk_err; + sk->sk_error_report(sk); + } +- if (rc) +- return rc; + + if (optlen < sizeof(int)) + return -EINVAL; +@@ -1725,6 +1725,8 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + return -EFAULT; + + lock_sock(sk); ++ if (rc || smc->use_fallback) ++ goto out; + switch (optname) { + case TCP_ULP: + case TCP_FASTOPEN: +@@ -1736,15 +1738,14 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + smc_switch_to_fallback(smc); + smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP; + } else { +- if (!smc->use_fallback) +- rc = -EINVAL; ++ rc = -EINVAL; + } + break; + case TCP_NODELAY: + if (sk->sk_state != SMC_INIT && + sk->sk_state != SMC_LISTEN && + sk->sk_state != SMC_CLOSED) { +- if (val && !smc->use_fallback) ++ if (val) + mod_delayed_work(system_wq, &smc->conn.tx_work, + 0); + } +@@ -1753,7 +1754,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + if (sk->sk_state != SMC_INIT && + sk->sk_state != SMC_LISTEN && + sk->sk_state != SMC_CLOSED) { +- if (!val && !smc->use_fallback) ++ if (!val) + mod_delayed_work(system_wq, &smc->conn.tx_work, + 0); + } +@@ -1764,6 +1765,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + default: + break; + } ++out: + release_sock(sk); + + return rc; +diff --git a/scripts/dtc/Makefile b/scripts/dtc/Makefile +index 82160808765c..b5a5b1c548c9 100644 +--- a/scripts/dtc/Makefile ++++ b/scripts/dtc/Makefile +@@ -11,7 +11,7 @@ dtc-objs += dtc-lexer.lex.o dtc-parser.tab.o + # Source files need to get at the userspace version of libfdt_env.h to compile + HOST_EXTRACFLAGS := -I $(srctree)/$(src)/libfdt + +-ifeq ($(wildcard /usr/include/yaml.h),) ++ifeq ($(shell pkg-config --exists yaml-0.1 2>/dev/null && echo yes),) + ifneq ($(CHECK_DTBS),) + $(error dtc needs libyaml for DT schema validation support. \ + Install the necessary libyaml development package.) +@@ -19,7 +19,7 @@ endif + HOST_EXTRACFLAGS += -DNO_YAML + else + dtc-objs += yamltree.o +-HOSTLDLIBS_dtc := -lyaml ++HOSTLDLIBS_dtc := $(shell pkg-config yaml-0.1 --libs) + endif + + # Generated files need one more search path to include headers in source tree +diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c +index ae6504d07fd6..fb15f09e0e38 100644 +--- a/scripts/kallsyms.c ++++ b/scripts/kallsyms.c +@@ -489,6 +489,8 @@ static void build_initial_tok_table(void) + table[pos] = table[i]; + learn_symbol(table[pos].sym, table[pos].len); + pos++; ++ } else { ++ free(table[i].sym); + } + } + table_cnt = pos; +diff --git a/security/apparmor/label.c b/security/apparmor/label.c +index 59f1cc2557a7..470693239e64 100644 +--- a/security/apparmor/label.c ++++ b/security/apparmor/label.c +@@ -1458,11 +1458,13 @@ static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label, + /* helper macro for snprint routines */ + #define update_for_len(total, len, size, str) \ + do { \ ++ size_t ulen = len; \ ++ \ + AA_BUG(len < 0); \ +- total += len; \ +- len = min(len, size); \ +- size -= len; \ +- str += len; \ ++ total += ulen; \ ++ ulen = min(ulen, size); \ ++ size -= ulen; \ ++ str += ulen; \ + } while (0) + + /** +@@ -1597,7 +1599,7 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, + struct aa_ns *prev_ns = NULL; + struct label_it i; + int count = 0, total = 0; +- size_t len; ++ ssize_t len; + + AA_BUG(!str && size != 0); + AA_BUG(!label); +diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c +index e7832448d721..bf38fc1b59b2 100644 +--- a/security/tomoyo/realpath.c ++++ b/security/tomoyo/realpath.c +@@ -217,31 +217,6 @@ out: + return ERR_PTR(-ENOMEM); + } + +-/** +- * tomoyo_get_socket_name - Get the name of a socket. +- * +- * @path: Pointer to "struct path". +- * @buffer: Pointer to buffer to return value in. +- * @buflen: Sizeof @buffer. +- * +- * Returns the buffer. +- */ +-static char *tomoyo_get_socket_name(const struct path *path, char * const buffer, +- const int buflen) +-{ +- struct inode *inode = d_backing_inode(path->dentry); +- struct socket *sock = inode ? SOCKET_I(inode) : NULL; +- struct sock *sk = sock ? sock->sk : NULL; +- +- if (sk) { +- snprintf(buffer, buflen, "socket:[family=%u:type=%u:protocol=%u]", +- sk->sk_family, sk->sk_type, sk->sk_protocol); +- } else { +- snprintf(buffer, buflen, "socket:[unknown]"); +- } +- return buffer; +-} +- + /** + * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root. + * +@@ -279,12 +254,7 @@ char *tomoyo_realpath_from_path(const struct path *path) + break; + /* To make sure that pos is '\0' terminated. */ + buf[buf_len - 1] = '\0'; +- /* Get better name for socket. */ +- if (sb->s_magic == SOCKFS_MAGIC) { +- pos = tomoyo_get_socket_name(path, buf, buf_len - 1); +- goto encode; +- } +- /* For "pipe:[\$]". */ ++ /* For "pipe:[\$]" and "socket:[\$]". */ + if (dentry->d_op && dentry->d_op->d_dname) { + pos = dentry->d_op->d_dname(dentry, buf, buf_len - 1); + goto encode; +diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c +index c37a78677955..265682296836 100644 +--- a/tools/perf/builtin-diff.c ++++ b/tools/perf/builtin-diff.c +@@ -575,8 +575,8 @@ static int64_t block_cycles_diff_cmp(struct hist_entry *left, + if (!pairs_left && !pairs_right) + return 0; + +- l = labs(left->diff.cycles); +- r = labs(right->diff.cycles); ++ l = llabs(left->diff.cycles); ++ r = llabs(right->diff.cycles); + return r - l; + } + +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 6dba8b728d23..3983d6ccd14d 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -448,7 +448,7 @@ static int perf_evsel__check_attr(struct evsel *evsel, + "selected. Hence, no address to lookup the source line number.\n"); + return -EINVAL; + } +- if (PRINT_FIELD(BRSTACKINSN) && ++ if (PRINT_FIELD(BRSTACKINSN) && !allow_user_set && + !(perf_evlist__combined_branch_type(session->evlist) & + PERF_SAMPLE_BRANCH_ANY)) { + pr_err("Display of branch stack assembler requested, but non all-branch filter set\n" +diff --git a/tools/perf/util/perf_regs.h b/tools/perf/util/perf_regs.h +index 47fe34e5f7d5..ec7640cc4c91 100644 +--- a/tools/perf/util/perf_regs.h ++++ b/tools/perf/util/perf_regs.h +@@ -41,7 +41,7 @@ int perf_reg_value(u64 *valp, struct regs_dump *regs, int id); + + static inline const char *perf_reg_name(int id __maybe_unused) + { +- return NULL; ++ return "unknown"; + } + + static inline int perf_reg_value(u64 *valp __maybe_unused, +diff --git a/tools/power/x86/intel-speed-select/isst-config.c b/tools/power/x86/intel-speed-select/isst-config.c +index 2a9890c8395a..21fcfe621d3a 100644 +--- a/tools/power/x86/intel-speed-select/isst-config.c ++++ b/tools/power/x86/intel-speed-select/isst-config.c +@@ -169,7 +169,7 @@ int get_topo_max_cpus(void) + static void set_cpu_online_offline(int cpu, int state) + { + char buffer[128]; +- int fd; ++ int fd, ret; + + snprintf(buffer, sizeof(buffer), + "/sys/devices/system/cpu/cpu%d/online", cpu); +@@ -179,9 +179,12 @@ static void set_cpu_online_offline(int cpu, int state) + err(-1, "%s open failed", buffer); + + if (state) +- write(fd, "1\n", 2); ++ ret = write(fd, "1\n", 2); + else +- write(fd, "0\n", 2); ++ ret = write(fd, "0\n", 2); ++ ++ if (ret == -1) ++ perror("Online/Offline: Operation failed\n"); + + close(fd); + } +diff --git a/tools/power/x86/intel-speed-select/isst-core.c b/tools/power/x86/intel-speed-select/isst-core.c +index 6dee5332c9d3..fde3f9cefc6d 100644 +--- a/tools/power/x86/intel-speed-select/isst-core.c ++++ b/tools/power/x86/intel-speed-select/isst-core.c +@@ -553,7 +553,6 @@ int isst_get_process_ctdp(int cpu, int tdp_level, struct isst_pkg_ctdp *pkg_dev) + i); + ctdp_level = &pkg_dev->ctdp_level[i]; + +- ctdp_level->processed = 1; + ctdp_level->level = i; + ctdp_level->control_cpu = cpu; + ctdp_level->pkg_id = get_physical_package_id(cpu); +@@ -561,7 +560,10 @@ int isst_get_process_ctdp(int cpu, int tdp_level, struct isst_pkg_ctdp *pkg_dev) + + ret = isst_get_ctdp_control(cpu, i, ctdp_level); + if (ret) +- return ret; ++ continue; ++ ++ pkg_dev->processed = 1; ++ ctdp_level->processed = 1; + + ret = isst_get_tdp_info(cpu, i, ctdp_level); + if (ret) +@@ -614,8 +616,6 @@ int isst_get_process_ctdp(int cpu, int tdp_level, struct isst_pkg_ctdp *pkg_dev) + } + } + +- pkg_dev->processed = 1; +- + return 0; + } + +diff --git a/tools/power/x86/intel-speed-select/isst-display.c b/tools/power/x86/intel-speed-select/isst-display.c +index 40346d534f78..b11575c3e886 100644 +--- a/tools/power/x86/intel-speed-select/isst-display.c ++++ b/tools/power/x86/intel-speed-select/isst-display.c +@@ -314,7 +314,8 @@ void isst_ctdp_display_information(int cpu, FILE *outf, int tdp_level, + char value[256]; + int i, base_level = 1; + +- print_package_info(cpu, outf); ++ if (pkg_dev->processed) ++ print_package_info(cpu, outf); + + for (i = 0; i <= pkg_dev->levels; ++i) { + struct isst_pkg_ctdp_level_info *ctdp_level; +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c +index 25e23e73c72e..2ecfa1158e2b 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c +@@ -73,7 +73,7 @@ trans: + [sprn_texasr]"i"(SPRN_TEXASR), [tar_1]"i"(TAR_1), + [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), [dscr_2]"i"(DSCR_2), + [tar_3]"i"(TAR_3), [dscr_3]"i"(DSCR_3) +- : "memory", "r0", "r1", "r3", "r4", "r5", "r6" ++ : "memory", "r0", "r3", "r4", "r5", "r6", "lr" + ); + + /* TM failed, analyse */ +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c +index f603fe5a445b..6f7fb51f0809 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c +@@ -74,8 +74,8 @@ trans: + "3: ;" + : [res] "=r" (result), [texasr] "=r" (texasr) + : [sprn_texasr] "i" (SPRN_TEXASR) +- : "memory", "r0", "r1", "r3", "r4", +- "r7", "r8", "r9", "r10", "r11" ++ : "memory", "r0", "r3", "r4", ++ "r7", "r8", "r9", "r10", "r11", "lr" + ); + + if (result) { +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c +index e0d37f07bdeb..46ef378a15ec 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c +@@ -62,7 +62,7 @@ trans: + [sprn_ppr]"i"(SPRN_PPR), [sprn_texasr]"i"(SPRN_TEXASR), + [tar_1]"i"(TAR_1), [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), + [dscr_2]"i"(DSCR_2), [cptr1] "b" (&cptr[1]) +- : "memory", "r0", "r1", "r3", "r4", "r5", "r6" ++ : "memory", "r0", "r3", "r4", "r5", "r6" + ); + + /* TM failed, analyse */ +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c +index 8027457b97b7..70ca01234f79 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c +@@ -62,8 +62,8 @@ trans: + "3: ;" + : [res] "=r" (result), [texasr] "=r" (texasr) + : [sprn_texasr] "i" (SPRN_TEXASR), [cptr1] "b" (&cptr[1]) +- : "memory", "r0", "r1", "r3", "r4", +- "r7", "r8", "r9", "r10", "r11" ++ : "memory", "r0", "r3", "r4", ++ "r7", "r8", "r9", "r10", "r11", "lr" + ); + + if (result) { +diff --git a/tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c b/tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c +index 56fbf9f6bbf3..07c388147b75 100644 +--- a/tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c ++++ b/tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c +@@ -10,10 +10,12 @@ + */ + + #define _GNU_SOURCE ++#include + #include + #include + + #include "utils.h" ++#include "tm.h" + + void trap_signal_handler(int signo, siginfo_t *si, void *uc) + { +@@ -29,6 +31,8 @@ int tm_signal_sigreturn_nt(void) + { + struct sigaction trap_sa; + ++ SKIP_IF(!have_htm()); ++ + trap_sa.sa_flags = SA_SIGINFO; + trap_sa.sa_sigaction = trap_signal_handler; + +diff --git a/tools/testing/selftests/vm/config b/tools/testing/selftests/vm/config +index 1c0d76cb5adf..93b90a9b1eeb 100644 +--- a/tools/testing/selftests/vm/config ++++ b/tools/testing/selftests/vm/config +@@ -1,2 +1,3 @@ + CONFIG_SYSVIPC=y + CONFIG_USERFAULTFD=y ++CONFIG_TEST_VMALLOC=m diff --git a/patch/kernel/odroidxu4-current/02-patch-5.4.8-9.patch b/patch/kernel/odroidxu4-current/02-patch-5.4.8-9.patch new file mode 100644 index 0000000000..fcc912840e --- /dev/null +++ b/patch/kernel/odroidxu4-current/02-patch-5.4.8-9.patch @@ -0,0 +1,7489 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index f5a551e4332d..5594c8bf1dcd 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -113,7 +113,7 @@ + the GPE dispatcher. + This facility can be used to prevent such uncontrolled + GPE floodings. +- Format: ++ Format: + + acpi_no_auto_serialize [HW,ACPI] + Disable auto-serialization of AML methods +diff --git a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt +index e96e085271c1..83f6c6a7c41c 100644 +--- a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt ++++ b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt +@@ -46,7 +46,7 @@ Required properties: + Example (R-Car H3): + + usb2_clksel: clock-controller@e6590630 { +- compatible = "renesas,r8a77950-rcar-usb2-clock-sel", ++ compatible = "renesas,r8a7795-rcar-usb2-clock-sel", + "renesas,rcar-gen3-usb2-clock-sel"; + reg = <0 0xe6590630 0 0x02>; + clocks = <&cpg CPG_MOD 703>, <&usb_extal>, <&usb_xtal>; +diff --git a/Makefile b/Makefile +index 1adee1b06f3d..3ba15c3528c8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 8 ++SUBLEVEL = 9 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +index 6039adda12ee..b0b12e389835 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +@@ -296,7 +296,7 @@ + }; + + &usb0_phy { +- status = "okay"; ++ status = "disabled"; + phy-supply = <&usb_otg_pwr>; + }; + +@@ -306,7 +306,7 @@ + }; + + &usb0 { +- status = "okay"; ++ status = "disabled"; + }; + + &usb1 { +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts +index 2a5cd303123d..8d6f316a5c7b 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts +@@ -192,6 +192,9 @@ + bluetooth { + compatible = "brcm,bcm43438-bt"; + shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; ++ max-speed = <2000000>; ++ clocks = <&wifi32k>; ++ clock-names = "lpo"; + }; + }; + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +index f25ddd18a607..4d67eb715b91 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +@@ -409,6 +409,9 @@ + bluetooth { + compatible = "brcm,bcm43438-bt"; + shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; ++ max-speed = <2000000>; ++ clocks = <&wifi32k>; ++ clock-names = "lpo"; + }; + }; + +diff --git a/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi b/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi +index 9682d4dd7496..1bae90705746 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi +@@ -23,6 +23,43 @@ + }; + }; + ++/* ++ * The laptop FW does not appear to support the retention state as it is ++ * not advertised as enabled in ACPI, and enabling it in DT can cause boot ++ * hangs. ++ */ ++&CPU0 { ++ cpu-idle-states = <&LITTLE_CPU_SLEEP_1>; ++}; ++ ++&CPU1 { ++ cpu-idle-states = <&LITTLE_CPU_SLEEP_1>; ++}; ++ ++&CPU2 { ++ cpu-idle-states = <&LITTLE_CPU_SLEEP_1>; ++}; ++ ++&CPU3 { ++ cpu-idle-states = <&LITTLE_CPU_SLEEP_1>; ++}; ++ ++&CPU4 { ++ cpu-idle-states = <&BIG_CPU_SLEEP_1>; ++}; ++ ++&CPU5 { ++ cpu-idle-states = <&BIG_CPU_SLEEP_1>; ++}; ++ ++&CPU6 { ++ cpu-idle-states = <&BIG_CPU_SLEEP_1>; ++}; ++ ++&CPU7 { ++ cpu-idle-states = <&BIG_CPU_SLEEP_1>; ++}; ++ + &qusb2phy { + status = "okay"; + +diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h +index 8dc6c5cdabe6..baf52baaa2a5 100644 +--- a/arch/arm64/include/asm/pgtable-prot.h ++++ b/arch/arm64/include/asm/pgtable-prot.h +@@ -85,13 +85,12 @@ + #define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE) + #define PAGE_READONLY __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN) + #define PAGE_READONLY_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN) +-#define PAGE_EXECONLY __pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN) + + #define __P000 PAGE_NONE + #define __P001 PAGE_READONLY + #define __P010 PAGE_READONLY + #define __P011 PAGE_READONLY +-#define __P100 PAGE_EXECONLY ++#define __P100 PAGE_READONLY_EXEC + #define __P101 PAGE_READONLY_EXEC + #define __P110 PAGE_READONLY_EXEC + #define __P111 PAGE_READONLY_EXEC +@@ -100,7 +99,7 @@ + #define __S001 PAGE_READONLY + #define __S010 PAGE_SHARED + #define __S011 PAGE_SHARED +-#define __S100 PAGE_EXECONLY ++#define __S100 PAGE_READONLY_EXEC + #define __S101 PAGE_READONLY_EXEC + #define __S110 PAGE_SHARED_EXEC + #define __S111 PAGE_SHARED_EXEC +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 565aa45ef134..13ebe2bad79f 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -96,12 +96,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; + #define pte_dirty(pte) (pte_sw_dirty(pte) || pte_hw_dirty(pte)) + + #define pte_valid(pte) (!!(pte_val(pte) & PTE_VALID)) +-/* +- * Execute-only user mappings do not have the PTE_USER bit set. All valid +- * kernel mappings have the PTE_UXN bit set. +- */ + #define pte_valid_not_user(pte) \ +- ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN)) ++ ((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID) + #define pte_valid_young(pte) \ + ((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF)) + #define pte_valid_user(pte) \ +@@ -117,8 +113,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; + + /* + * p??_access_permitted() is true for valid user mappings (subject to the +- * write permission check) other than user execute-only which do not have the +- * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set. ++ * write permission check). PROT_NONE mappings do not have the PTE_VALID bit ++ * set. + */ + #define pte_access_permitted(pte, write) \ + (pte_valid_user(pte) && (!(write) || pte_write(pte))) +diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c +index 9fc6db0bcbad..d26e6cd28953 100644 +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -454,7 +454,7 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, + const struct fault_info *inf; + struct mm_struct *mm = current->mm; + vm_fault_t fault, major = 0; +- unsigned long vm_flags = VM_READ | VM_WRITE; ++ unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC; + unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; + + if (kprobe_page_fault(regs, esr)) +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 60c929f3683b..d10247fab0fd 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -1069,7 +1069,6 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + + /* + * FIXME: Cleanup page tables (also in arch_add_memory() in case +@@ -1078,7 +1077,6 @@ void arch_remove_memory(int nid, u64 start, u64 size, + * unplug. ARCH_ENABLE_MEMORY_HOTREMOVE must not be + * unlocked yet. + */ +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + } + #endif +diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c +index bf9df2625bc8..a6dd80a2c939 100644 +--- a/arch/ia64/mm/init.c ++++ b/arch/ia64/mm/init.c +@@ -689,9 +689,7 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + } + #endif +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index a0bd9bdb5f83..e5c2d47608fe 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -46,7 +46,7 @@ config MIPS + select HAVE_ARCH_TRACEHOOK + select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES + select HAVE_ASM_MODVERSIONS +- select HAVE_EBPF_JIT if (!CPU_MICROMIPS) ++ select HAVE_EBPF_JIT if 64BIT && !CPU_MICROMIPS && TARGET_ISA_REV >= 2 + select HAVE_CONTEXT_TRACKING + select HAVE_COPY_THREAD_TLS + select HAVE_C_RECORDMCOUNT +diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h +index 4993db40482c..ee26f9a4575d 100644 +--- a/arch/mips/include/asm/thread_info.h ++++ b/arch/mips/include/asm/thread_info.h +@@ -49,8 +49,26 @@ struct thread_info { + .addr_limit = KERNEL_DS, \ + } + +-/* How to get the thread information struct from C. */ ++/* ++ * A pointer to the struct thread_info for the currently executing thread is ++ * held in register $28/$gp. ++ * ++ * We declare __current_thread_info as a global register variable rather than a ++ * local register variable within current_thread_info() because clang doesn't ++ * support explicit local register variables. ++ * ++ * When building the VDSO we take care not to declare the global register ++ * variable because this causes GCC to not preserve the value of $28/$gp in ++ * functions that change its value (which is common in the PIC VDSO when ++ * accessing the GOT). Since the VDSO shouldn't be accessing ++ * __current_thread_info anyway we declare it extern in order to cause a link ++ * failure if it's referenced. ++ */ ++#ifdef __VDSO__ ++extern struct thread_info *__current_thread_info; ++#else + register struct thread_info *__current_thread_info __asm__("$28"); ++#endif + + static inline struct thread_info *current_thread_info(void) + { +diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c +index 46b76751f3a5..a2405d5f7d1e 100644 +--- a/arch/mips/net/ebpf_jit.c ++++ b/arch/mips/net/ebpf_jit.c +@@ -1803,7 +1803,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + unsigned int image_size; + u8 *image_ptr; + +- if (!prog->jit_requested || MIPS_ISA_REV < 2) ++ if (!prog->jit_requested) + return prog; + + tmp = bpf_jit_blind_constants(prog); +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index be941d382c8d..460afa415434 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -104,6 +104,27 @@ int __weak remove_section_mapping(unsigned long start, unsigned long end) + return -ENODEV; + } + ++#define FLUSH_CHUNK_SIZE SZ_1G ++/** ++ * flush_dcache_range_chunked(): Write any modified data cache blocks out to ++ * memory and invalidate them, in chunks of up to FLUSH_CHUNK_SIZE ++ * Does not invalidate the corresponding instruction cache blocks. ++ * ++ * @start: the start address ++ * @stop: the stop address (exclusive) ++ * @chunk: the max size of the chunks ++ */ ++static void flush_dcache_range_chunked(unsigned long start, unsigned long stop, ++ unsigned long chunk) ++{ ++ unsigned long i; ++ ++ for (i = start; i < stop; i += chunk) { ++ flush_dcache_range(i, min(stop, start + chunk)); ++ cond_resched(); ++ } ++} ++ + int __ref arch_add_memory(int nid, u64 start, u64 size, + struct mhp_restrictions *restrictions) + { +@@ -120,7 +141,8 @@ int __ref arch_add_memory(int nid, u64 start, u64 size, + start, start + size, rc); + return -EFAULT; + } +- flush_dcache_range(start, start + size); ++ ++ flush_dcache_range_chunked(start, start + size, FLUSH_CHUNK_SIZE); + + return __add_pages(nid, start_pfn, nr_pages, restrictions); + } +@@ -130,14 +152,14 @@ void __ref arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct page *page = pfn_to_page(start_pfn) + vmem_altmap_offset(altmap); + int ret; + +- __remove_pages(page_zone(page), start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + + /* Remove htab bolted mappings for this section of memory */ + start = (unsigned long)__va(start); +- flush_dcache_range(start, start + size); ++ flush_dcache_range_chunked(start, start + size, FLUSH_CHUNK_SIZE); ++ + ret = remove_section_mapping(start, start + size); + WARN_ON_ONCE(ret); + +diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c +index 42bbcd47cc85..dffe1a45b6ed 100644 +--- a/arch/powerpc/mm/slice.c ++++ b/arch/powerpc/mm/slice.c +@@ -50,7 +50,7 @@ static void slice_print_mask(const char *label, const struct slice_mask *mask) { + + #endif + +-static inline bool slice_addr_is_low(unsigned long addr) ++static inline notrace bool slice_addr_is_low(unsigned long addr) + { + u64 tmp = (u64)addr; + +@@ -659,7 +659,7 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp, + mm_ctx_user_psize(¤t->mm->context), 1); + } + +-unsigned int get_slice_psize(struct mm_struct *mm, unsigned long addr) ++unsigned int notrace get_slice_psize(struct mm_struct *mm, unsigned long addr) + { + unsigned char *psizes; + int index, mask_index; +diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c +index b94d8db5ddcc..c40fdcdeb950 100644 +--- a/arch/riscv/kernel/ftrace.c ++++ b/arch/riscv/kernel/ftrace.c +@@ -142,7 +142,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr, + */ + old = *parent; + +- if (function_graph_enter(old, self_addr, frame_pointer, parent)) ++ if (!function_graph_enter(old, self_addr, frame_pointer, parent)) + *parent = return_hooker; + } + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 7511b71d2931..fdb8083e7870 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -1313,18 +1313,28 @@ static void hw_perf_event_update(struct perf_event *event, int flush_all) + */ + if (flush_all && done) + break; +- +- /* If an event overflow happened, discard samples by +- * processing any remaining sample-data-blocks. +- */ +- if (event_overflow) +- flush_all = 1; + } + + /* Account sample overflows in the event hardware structure */ + if (sampl_overflow) + OVERFLOW_REG(hwc) = DIV_ROUND_UP(OVERFLOW_REG(hwc) + + sampl_overflow, 1 + num_sdb); ++ ++ /* Perf_event_overflow() and perf_event_account_interrupt() limit ++ * the interrupt rate to an upper limit. Roughly 1000 samples per ++ * task tick. ++ * Hitting this limit results in a large number ++ * of throttled REF_REPORT_THROTTLE entries and the samples ++ * are dropped. ++ * Slightly increase the interval to avoid hitting this limit. ++ */ ++ if (event_overflow) { ++ SAMPL_RATE(hwc) += DIV_ROUND_UP(SAMPL_RATE(hwc), 10); ++ debug_sprintf_event(sfdbg, 1, "%s: rate adjustment %ld\n", ++ __func__, ++ DIV_ROUND_UP(SAMPL_RATE(hwc), 10)); ++ } ++ + if (sampl_overflow || event_overflow) + debug_sprintf_event(sfdbg, 4, "hw_perf_event_update: " + "overflow stats: sample=%llu event=%llu\n", +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index d95c85780e07..06dddd7c4290 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -727,39 +727,67 @@ static void __ref smp_get_core_info(struct sclp_core_info *info, int early) + + static int smp_add_present_cpu(int cpu); + +-static int __smp_rescan_cpus(struct sclp_core_info *info, int sysfs_add) ++static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail, ++ bool configured, bool early) + { + struct pcpu *pcpu; +- cpumask_t avail; +- int cpu, nr, i, j; ++ int cpu, nr, i; + u16 address; + + nr = 0; +- cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask); +- cpu = cpumask_first(&avail); +- for (i = 0; (i < info->combined) && (cpu < nr_cpu_ids); i++) { +- if (sclp.has_core_type && info->core[i].type != boot_core_type) ++ if (sclp.has_core_type && core->type != boot_core_type) ++ return nr; ++ cpu = cpumask_first(avail); ++ address = core->core_id << smp_cpu_mt_shift; ++ for (i = 0; (i <= smp_cpu_mtid) && (cpu < nr_cpu_ids); i++) { ++ if (pcpu_find_address(cpu_present_mask, address + i)) + continue; +- address = info->core[i].core_id << smp_cpu_mt_shift; +- for (j = 0; j <= smp_cpu_mtid; j++) { +- if (pcpu_find_address(cpu_present_mask, address + j)) +- continue; +- pcpu = pcpu_devices + cpu; +- pcpu->address = address + j; +- pcpu->state = +- (cpu >= info->configured*(smp_cpu_mtid + 1)) ? +- CPU_STATE_STANDBY : CPU_STATE_CONFIGURED; +- smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN); +- set_cpu_present(cpu, true); +- if (sysfs_add && smp_add_present_cpu(cpu) != 0) +- set_cpu_present(cpu, false); +- else +- nr++; +- cpu = cpumask_next(cpu, &avail); +- if (cpu >= nr_cpu_ids) ++ pcpu = pcpu_devices + cpu; ++ pcpu->address = address + i; ++ if (configured) ++ pcpu->state = CPU_STATE_CONFIGURED; ++ else ++ pcpu->state = CPU_STATE_STANDBY; ++ smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN); ++ set_cpu_present(cpu, true); ++ if (!early && smp_add_present_cpu(cpu) != 0) ++ set_cpu_present(cpu, false); ++ else ++ nr++; ++ cpumask_clear_cpu(cpu, avail); ++ cpu = cpumask_next(cpu, avail); ++ } ++ return nr; ++} ++ ++static int __smp_rescan_cpus(struct sclp_core_info *info, bool early) ++{ ++ struct sclp_core_entry *core; ++ cpumask_t avail; ++ bool configured; ++ u16 core_id; ++ int nr, i; ++ ++ nr = 0; ++ cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask); ++ /* ++ * Add IPL core first (which got logical CPU number 0) to make sure ++ * that all SMT threads get subsequent logical CPU numbers. ++ */ ++ if (early) { ++ core_id = pcpu_devices[0].address >> smp_cpu_mt_shift; ++ for (i = 0; i < info->configured; i++) { ++ core = &info->core[i]; ++ if (core->core_id == core_id) { ++ nr += smp_add_core(core, &avail, true, early); + break; ++ } + } + } ++ for (i = 0; i < info->combined; i++) { ++ configured = i < info->configured; ++ nr += smp_add_core(&info->core[i], &avail, configured, early); ++ } + return nr; + } + +@@ -808,7 +836,7 @@ void __init smp_detect_cpus(void) + + /* Add CPUs present at boot */ + get_online_cpus(); +- __smp_rescan_cpus(info, 0); ++ __smp_rescan_cpus(info, true); + put_online_cpus(); + memblock_free_early((unsigned long)info, sizeof(*info)); + } +@@ -1153,7 +1181,7 @@ int __ref smp_rescan_cpus(void) + smp_get_core_info(info, 0); + get_online_cpus(); + mutex_lock(&smp_cpu_state_mutex); +- nr = __smp_rescan_cpus(info, 1); ++ nr = __smp_rescan_cpus(info, false); + mutex_unlock(&smp_cpu_state_mutex); + put_online_cpus(); + kfree(info); +diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c +index a124f19f7b3c..c1d96e588152 100644 +--- a/arch/s390/mm/init.c ++++ b/arch/s390/mm/init.c +@@ -291,10 +291,8 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + vmem_remove_mapping(start, size); + } + #endif /* CONFIG_MEMORY_HOTPLUG */ +diff --git a/arch/sh/mm/init.c b/arch/sh/mm/init.c +index dfdbaa50946e..d1b1ff2be17a 100644 +--- a/arch/sh/mm/init.c ++++ b/arch/sh/mm/init.c +@@ -434,9 +434,7 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = PFN_DOWN(start); + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + } + #endif /* CONFIG_MEMORY_HOTPLUG */ +diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c +index 5ee3fed881d3..741540d849f3 100644 +--- a/arch/x86/events/intel/bts.c ++++ b/arch/x86/events/intel/bts.c +@@ -63,9 +63,17 @@ struct bts_buffer { + + static struct pmu bts_pmu; + ++static int buf_nr_pages(struct page *page) ++{ ++ if (!PagePrivate(page)) ++ return 1; ++ ++ return 1 << page_private(page); ++} ++ + static size_t buf_size(struct page *page) + { +- return 1 << (PAGE_SHIFT + page_private(page)); ++ return buf_nr_pages(page) * PAGE_SIZE; + } + + static void * +@@ -83,9 +91,7 @@ bts_buffer_setup_aux(struct perf_event *event, void **pages, + /* count all the high order buffers */ + for (pg = 0, nbuf = 0; pg < nr_pages;) { + page = virt_to_page(pages[pg]); +- if (WARN_ON_ONCE(!PagePrivate(page) && nr_pages > 1)) +- return NULL; +- pg += 1 << page_private(page); ++ pg += buf_nr_pages(page); + nbuf++; + } + +@@ -109,7 +115,7 @@ bts_buffer_setup_aux(struct perf_event *event, void **pages, + unsigned int __nr_pages; + + page = virt_to_page(pages[pg]); +- __nr_pages = PagePrivate(page) ? 1 << page_private(page) : 1; ++ __nr_pages = buf_nr_pages(page); + buf->buf[nbuf].page = page; + buf->buf[nbuf].offset = offset; + buf->buf[nbuf].displacement = (pad ? BTS_RECORD_SIZE - pad : 0); +diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c +index 930edeb41ec3..0a74407ef92e 100644 +--- a/arch/x86/mm/init_32.c ++++ b/arch/x86/mm/init_32.c +@@ -865,10 +865,8 @@ void arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct zone *zone; + +- zone = page_zone(pfn_to_page(start_pfn)); +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + } + #endif + +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index a6b5c653727b..b8541d77452c 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -1212,10 +1212,8 @@ void __ref arch_remove_memory(int nid, u64 start, u64 size, + { + unsigned long start_pfn = start >> PAGE_SHIFT; + unsigned long nr_pages = size >> PAGE_SHIFT; +- struct page *page = pfn_to_page(start_pfn) + vmem_altmap_offset(altmap); +- struct zone *zone = page_zone(page); + +- __remove_pages(zone, start_pfn, nr_pages, altmap); ++ __remove_pages(start_pfn, nr_pages, altmap); + kernel_physical_mapping_remove(start, start + size); + } + #endif /* CONFIG_MEMORY_HOTPLUG */ +diff --git a/block/bio.c b/block/bio.c +index 43df756b68c4..c822ceb7c4de 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -535,6 +535,45 @@ void zero_fill_bio_iter(struct bio *bio, struct bvec_iter start) + } + EXPORT_SYMBOL(zero_fill_bio_iter); + ++void bio_truncate(struct bio *bio, unsigned new_size) ++{ ++ struct bio_vec bv; ++ struct bvec_iter iter; ++ unsigned int done = 0; ++ bool truncated = false; ++ ++ if (new_size >= bio->bi_iter.bi_size) ++ return; ++ ++ if (bio_data_dir(bio) != READ) ++ goto exit; ++ ++ bio_for_each_segment(bv, bio, iter) { ++ if (done + bv.bv_len > new_size) { ++ unsigned offset; ++ ++ if (!truncated) ++ offset = new_size - done; ++ else ++ offset = 0; ++ zero_user(bv.bv_page, offset, bv.bv_len - offset); ++ truncated = true; ++ } ++ done += bv.bv_len; ++ } ++ ++ exit: ++ /* ++ * Don't touch bvec table here and make it really immutable, since ++ * fs bio user has to retrieve all pages via bio_for_each_segment_all ++ * in its .end_bio() callback. ++ * ++ * It is enough to truncate bio by updating .bi_size since we can make ++ * correct bvec with the updated .bi_size for drivers. ++ */ ++ bio->bi_iter.bi_size = new_size; ++} ++ + /** + * bio_put - release a reference to a bio + * @bio: bio to release reference to +diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c +index 6ca015f92766..7f053468b50d 100644 +--- a/block/compat_ioctl.c ++++ b/block/compat_ioctl.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -354,6 +355,10 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg) + * but we call blkdev_ioctl, which gets the lock for us + */ + case BLKRRPART: ++ case BLKREPORTZONE: ++ case BLKRESETZONE: ++ case BLKGETZONESZ: ++ case BLKGETNRZONES: + return blkdev_ioctl(bdev, mode, cmd, + (unsigned long)compat_ptr(arg)); + case BLKBSZSET_32: +@@ -401,6 +406,14 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg) + case BLKTRACETEARDOWN: /* compatible */ + ret = blk_trace_ioctl(bdev, cmd, compat_ptr(arg)); + return ret; ++ case IOC_PR_REGISTER: ++ case IOC_PR_RESERVE: ++ case IOC_PR_RELEASE: ++ case IOC_PR_PREEMPT: ++ case IOC_PR_PREEMPT_ABORT: ++ case IOC_PR_CLEAR: ++ return blkdev_ioctl(bdev, mode, cmd, ++ (unsigned long)compat_ptr(arg)); + default: + if (disk->fops->compat_ioctl) + ret = disk->fops->compat_ioctl(bdev, mode, cmd, arg); +diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c +index 75948a3f1a20..c60d2c6d31d6 100644 +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -819,14 +819,14 @@ end: + * interface: + * echo unmask > /sys/firmware/acpi/interrupts/gpe00 + */ +-#define ACPI_MASKABLE_GPE_MAX 0xFF ++#define ACPI_MASKABLE_GPE_MAX 0x100 + static DECLARE_BITMAP(acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) __initdata; + + static int __init acpi_gpe_set_masked_gpes(char *val) + { + u8 gpe; + +- if (kstrtou8(val, 0, &gpe) || gpe > ACPI_MASKABLE_GPE_MAX) ++ if (kstrtou8(val, 0, &gpe)) + return -EINVAL; + set_bit(gpe, acpi_masked_gpes_map); + +@@ -838,7 +838,7 @@ void __init acpi_gpe_apply_masked_gpes(void) + { + acpi_handle handle; + acpi_status status; +- u8 gpe; ++ u16 gpe; + + for_each_set_bit(gpe, acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) { + status = acpi_get_gpe_device(gpe, &handle); +diff --git a/drivers/ata/ahci_brcm.c b/drivers/ata/ahci_brcm.c +index f41744b9b38a..66a570d0da83 100644 +--- a/drivers/ata/ahci_brcm.c ++++ b/drivers/ata/ahci_brcm.c +@@ -76,8 +76,7 @@ enum brcm_ahci_version { + }; + + enum brcm_ahci_quirks { +- BRCM_AHCI_QUIRK_NO_NCQ = BIT(0), +- BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE = BIT(1), ++ BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE = BIT(0), + }; + + struct brcm_ahci_priv { +@@ -213,19 +212,12 @@ static void brcm_sata_phys_disable(struct brcm_ahci_priv *priv) + brcm_sata_phy_disable(priv, i); + } + +-static u32 brcm_ahci_get_portmask(struct platform_device *pdev, ++static u32 brcm_ahci_get_portmask(struct ahci_host_priv *hpriv, + struct brcm_ahci_priv *priv) + { +- void __iomem *ahci; +- struct resource *res; + u32 impl; + +- res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "ahci"); +- ahci = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(ahci)) +- return 0; +- +- impl = readl(ahci + HOST_PORTS_IMPL); ++ impl = readl(hpriv->mmio + HOST_PORTS_IMPL); + + if (fls(impl) > SATA_TOP_MAX_PHYS) + dev_warn(priv->dev, "warning: more ports than PHYs (%#x)\n", +@@ -233,9 +225,6 @@ static u32 brcm_ahci_get_portmask(struct platform_device *pdev, + else if (!impl) + dev_info(priv->dev, "no ports found\n"); + +- devm_iounmap(&pdev->dev, ahci); +- devm_release_mem_region(&pdev->dev, res->start, resource_size(res)); +- + return impl; + } + +@@ -285,6 +274,13 @@ static unsigned int brcm_ahci_read_id(struct ata_device *dev, + /* Perform the SATA PHY reset sequence */ + brcm_sata_phy_disable(priv, ap->port_no); + ++ /* Reset the SATA clock */ ++ ahci_platform_disable_clks(hpriv); ++ msleep(10); ++ ++ ahci_platform_enable_clks(hpriv); ++ msleep(10); ++ + /* Bring the PHY back on */ + brcm_sata_phy_enable(priv, ap->port_no); + +@@ -347,11 +343,10 @@ static int brcm_ahci_suspend(struct device *dev) + struct ata_host *host = dev_get_drvdata(dev); + struct ahci_host_priv *hpriv = host->private_data; + struct brcm_ahci_priv *priv = hpriv->plat_data; +- int ret; + +- ret = ahci_platform_suspend(dev); + brcm_sata_phys_disable(priv); +- return ret; ++ ++ return ahci_platform_suspend(dev); + } + + static int brcm_ahci_resume(struct device *dev) +@@ -359,11 +354,44 @@ static int brcm_ahci_resume(struct device *dev) + struct ata_host *host = dev_get_drvdata(dev); + struct ahci_host_priv *hpriv = host->private_data; + struct brcm_ahci_priv *priv = hpriv->plat_data; ++ int ret; ++ ++ /* Make sure clocks are turned on before re-configuration */ ++ ret = ahci_platform_enable_clks(hpriv); ++ if (ret) ++ return ret; + + brcm_sata_init(priv); + brcm_sata_phys_enable(priv); + brcm_sata_alpm_init(hpriv); +- return ahci_platform_resume(dev); ++ ++ /* Since we had to enable clocks earlier on, we cannot use ++ * ahci_platform_resume() as-is since a second call to ++ * ahci_platform_enable_resources() would bump up the resources ++ * (regulators, clocks, PHYs) count artificially so we copy the part ++ * after ahci_platform_enable_resources(). ++ */ ++ ret = ahci_platform_enable_phys(hpriv); ++ if (ret) ++ goto out_disable_phys; ++ ++ ret = ahci_platform_resume_host(dev); ++ if (ret) ++ goto out_disable_platform_phys; ++ ++ /* We resumed so update PM runtime state */ ++ pm_runtime_disable(dev); ++ pm_runtime_set_active(dev); ++ pm_runtime_enable(dev); ++ ++ return 0; ++ ++out_disable_platform_phys: ++ ahci_platform_disable_phys(hpriv); ++out_disable_phys: ++ brcm_sata_phys_disable(priv); ++ ahci_platform_disable_clks(hpriv); ++ return ret; + } + #endif + +@@ -410,44 +438,71 @@ static int brcm_ahci_probe(struct platform_device *pdev) + if (!IS_ERR_OR_NULL(priv->rcdev)) + reset_control_deassert(priv->rcdev); + +- if ((priv->version == BRCM_SATA_BCM7425) || +- (priv->version == BRCM_SATA_NSP)) { +- priv->quirks |= BRCM_AHCI_QUIRK_NO_NCQ; ++ hpriv = ahci_platform_get_resources(pdev, 0); ++ if (IS_ERR(hpriv)) { ++ ret = PTR_ERR(hpriv); ++ goto out_reset; ++ } ++ ++ hpriv->plat_data = priv; ++ hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP | AHCI_HFLAG_NO_WRITE_TO_RO; ++ ++ switch (priv->version) { ++ case BRCM_SATA_BCM7425: ++ hpriv->flags |= AHCI_HFLAG_DELAY_ENGINE; ++ /* fall through */ ++ case BRCM_SATA_NSP: ++ hpriv->flags |= AHCI_HFLAG_NO_NCQ; + priv->quirks |= BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE; ++ break; ++ default: ++ break; + } + ++ ret = ahci_platform_enable_clks(hpriv); ++ if (ret) ++ goto out_reset; ++ ++ /* Must be first so as to configure endianness including that ++ * of the standard AHCI register space. ++ */ + brcm_sata_init(priv); + +- priv->port_mask = brcm_ahci_get_portmask(pdev, priv); +- if (!priv->port_mask) +- return -ENODEV; ++ /* Initializes priv->port_mask which is used below */ ++ priv->port_mask = brcm_ahci_get_portmask(hpriv, priv); ++ if (!priv->port_mask) { ++ ret = -ENODEV; ++ goto out_disable_clks; ++ } + ++ /* Must be done before ahci_platform_enable_phys() */ + brcm_sata_phys_enable(priv); + +- hpriv = ahci_platform_get_resources(pdev, 0); +- if (IS_ERR(hpriv)) +- return PTR_ERR(hpriv); +- hpriv->plat_data = priv; +- hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP; +- + brcm_sata_alpm_init(hpriv); + +- ret = ahci_platform_enable_resources(hpriv); ++ ret = ahci_platform_enable_phys(hpriv); + if (ret) +- return ret; +- +- if (priv->quirks & BRCM_AHCI_QUIRK_NO_NCQ) +- hpriv->flags |= AHCI_HFLAG_NO_NCQ; +- hpriv->flags |= AHCI_HFLAG_NO_WRITE_TO_RO; ++ goto out_disable_phys; + + ret = ahci_platform_init_host(pdev, hpriv, &ahci_brcm_port_info, + &ahci_platform_sht); + if (ret) +- return ret; ++ goto out_disable_platform_phys; + + dev_info(dev, "Broadcom AHCI SATA3 registered\n"); + + return 0; ++ ++out_disable_platform_phys: ++ ahci_platform_disable_phys(hpriv); ++out_disable_phys: ++ brcm_sata_phys_disable(priv); ++out_disable_clks: ++ ahci_platform_disable_clks(hpriv); ++out_reset: ++ if (!IS_ERR_OR_NULL(priv->rcdev)) ++ reset_control_assert(priv->rcdev); ++ return ret; + } + + static int brcm_ahci_remove(struct platform_device *pdev) +@@ -457,12 +512,12 @@ static int brcm_ahci_remove(struct platform_device *pdev) + struct brcm_ahci_priv *priv = hpriv->plat_data; + int ret; + ++ brcm_sata_phys_disable(priv); ++ + ret = ata_platform_remove_one(pdev); + if (ret) + return ret; + +- brcm_sata_phys_disable(priv); +- + return 0; + } + +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index 8befce036af8..129556fcf6be 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -43,7 +43,7 @@ EXPORT_SYMBOL_GPL(ahci_platform_ops); + * RETURNS: + * 0 on success otherwise a negative error code + */ +-static int ahci_platform_enable_phys(struct ahci_host_priv *hpriv) ++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv) + { + int rc, i; + +@@ -74,6 +74,7 @@ disable_phys: + } + return rc; + } ++EXPORT_SYMBOL_GPL(ahci_platform_enable_phys); + + /** + * ahci_platform_disable_phys - Disable PHYs +@@ -81,7 +82,7 @@ disable_phys: + * + * This function disables all PHYs found in hpriv->phys. + */ +-static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv) ++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv) + { + int i; + +@@ -90,6 +91,7 @@ static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv) + phy_exit(hpriv->phys[i]); + } + } ++EXPORT_SYMBOL_GPL(ahci_platform_disable_phys); + + /** + * ahci_platform_enable_clks - Enable platform clocks +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 74c9b3032d46..84b183a6424e 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5325,6 +5325,30 @@ void ata_qc_complete(struct ata_queued_cmd *qc) + } + } + ++/** ++ * ata_qc_get_active - get bitmask of active qcs ++ * @ap: port in question ++ * ++ * LOCKING: ++ * spin_lock_irqsave(host lock) ++ * ++ * RETURNS: ++ * Bitmask of active qcs ++ */ ++u64 ata_qc_get_active(struct ata_port *ap) ++{ ++ u64 qc_active = ap->qc_active; ++ ++ /* ATA_TAG_INTERNAL is sent to hw as tag 0 */ ++ if (qc_active & (1ULL << ATA_TAG_INTERNAL)) { ++ qc_active |= (1 << 0); ++ qc_active &= ~(1ULL << ATA_TAG_INTERNAL); ++ } ++ ++ return qc_active; ++} ++EXPORT_SYMBOL_GPL(ata_qc_get_active); ++ + /** + * ata_qc_complete_multiple - Complete multiple qcs successfully + * @ap: port in question +diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c +index 8e9cb198fcd1..ca6c706e9c25 100644 +--- a/drivers/ata/sata_fsl.c ++++ b/drivers/ata/sata_fsl.c +@@ -1278,7 +1278,7 @@ static void sata_fsl_host_intr(struct ata_port *ap) + i, ioread32(hcr_base + CC), + ioread32(hcr_base + CA)); + } +- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask); ++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask); + return; + + } else if ((ap->qc_active & (1ULL << ATA_TAG_INTERNAL))) { +diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c +index ad385a113391..bde695a32097 100644 +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -2827,7 +2827,7 @@ static void mv_process_crpb_entries(struct ata_port *ap, struct mv_port_priv *pp + } + + if (work_done) { +- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask); ++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask); + + /* Update the software queue position index in hardware */ + writelfl((pp->crpb_dma & EDMA_RSP_Q_BASE_LO_MASK) | +diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c +index 56946012d113..7510303111fa 100644 +--- a/drivers/ata/sata_nv.c ++++ b/drivers/ata/sata_nv.c +@@ -984,7 +984,7 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance) + check_commands = 0; + check_commands &= ~(1 << pos); + } +- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask); ++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask); + } + } + +diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c +index fd1e19f1a49f..3666afa639d1 100644 +--- a/drivers/block/xen-blkback/blkback.c ++++ b/drivers/block/xen-blkback/blkback.c +@@ -936,6 +936,8 @@ next: + out_of_memory: + pr_alert("%s: out of memory\n", __func__); + put_free_pages(ring, pages_to_gnt, segs_to_map); ++ for (i = last_map; i < num; i++) ++ pages[i]->handle = BLKBACK_INVALID_HANDLE; + return -ENOMEM; + } + +diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c +index b90dbcd99c03..c4cd68116e7f 100644 +--- a/drivers/block/xen-blkback/xenbus.c ++++ b/drivers/block/xen-blkback/xenbus.c +@@ -171,6 +171,15 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid) + blkif->domid = domid; + atomic_set(&blkif->refcnt, 1); + init_completion(&blkif->drain_complete); ++ ++ /* ++ * Because freeing back to the cache may be deferred, it is not ++ * safe to unload the module (and hence destroy the cache) until ++ * this has completed. To prevent premature unloading, take an ++ * extra module reference here and release only when the object ++ * has been freed back to the cache. ++ */ ++ __module_get(THIS_MODULE); + INIT_WORK(&blkif->free_work, xen_blkif_deferred_free); + + return blkif; +@@ -320,6 +329,7 @@ static void xen_blkif_free(struct xen_blkif *blkif) + + /* Make sure everything is drained before shutting down */ + kmem_cache_free(xen_blkif_cachep, blkif); ++ module_put(THIS_MODULE); + } + + int __init xen_blkif_interface_init(void) +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 23e606aaaea4..04cf767d0708 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1200,7 +1200,7 @@ static int btusb_open(struct hci_dev *hdev) + if (data->setup_on_usb) { + err = data->setup_on_usb(hdev); + if (err < 0) +- return err; ++ goto setup_fail; + } + + data->intf->needs_remote_wakeup = 1; +@@ -1239,6 +1239,7 @@ done: + + failed: + clear_bit(BTUSB_INTR_RUNNING, &data->flags); ++setup_fail: + usb_autopm_put_interface(data->intf); + return err; + } +diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c +index 470c7ef02ea4..4b04ffbe5e7e 100644 +--- a/drivers/clocksource/timer-riscv.c ++++ b/drivers/clocksource/timer-riscv.c +@@ -41,7 +41,7 @@ static unsigned long long riscv_clocksource_rdtime(struct clocksource *cs) + return get_cycles64(); + } + +-static u64 riscv_sched_clock(void) ++static u64 notrace riscv_sched_clock(void) + { + return get_cycles64(); + } +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 3a1484e7a3ae..c64d20fdc187 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -551,26 +551,30 @@ static int devfreq_notifier_call(struct notifier_block *nb, unsigned long type, + void *devp) + { + struct devfreq *devfreq = container_of(nb, struct devfreq, nb); +- int ret; ++ int err = -EINVAL; + + mutex_lock(&devfreq->lock); + + devfreq->scaling_min_freq = find_available_min_freq(devfreq); +- if (!devfreq->scaling_min_freq) { +- mutex_unlock(&devfreq->lock); +- return -EINVAL; +- } ++ if (!devfreq->scaling_min_freq) ++ goto out; + + devfreq->scaling_max_freq = find_available_max_freq(devfreq); + if (!devfreq->scaling_max_freq) { +- mutex_unlock(&devfreq->lock); +- return -EINVAL; ++ devfreq->scaling_max_freq = ULONG_MAX; ++ goto out; + } + +- ret = update_devfreq(devfreq); ++ err = update_devfreq(devfreq); ++ ++out: + mutex_unlock(&devfreq->lock); ++ if (err) ++ dev_err(devfreq->dev.parent, ++ "failed to update frequency from OPP notifier (%d)\n", ++ err); + +- return ret; ++ return NOTIFY_OK; + } + + /** +@@ -584,11 +588,6 @@ static void devfreq_dev_release(struct device *dev) + struct devfreq *devfreq = to_devfreq(dev); + + mutex_lock(&devfreq_list_lock); +- if (IS_ERR(find_device_devfreq(devfreq->dev.parent))) { +- mutex_unlock(&devfreq_list_lock); +- dev_warn(&devfreq->dev, "releasing devfreq which doesn't exist\n"); +- return; +- } + list_del(&devfreq->node); + mutex_unlock(&devfreq_list_lock); + +@@ -643,6 +642,7 @@ struct devfreq *devfreq_add_device(struct device *dev, + devfreq->dev.parent = dev; + devfreq->dev.class = devfreq_class; + devfreq->dev.release = devfreq_dev_release; ++ INIT_LIST_HEAD(&devfreq->node); + devfreq->profile = profile; + strncpy(devfreq->governor_name, governor_name, DEVFREQ_NAME_LEN); + devfreq->previous_freq = profile->initial_freq; +@@ -1196,7 +1196,7 @@ static ssize_t available_governors_show(struct device *d, + * The devfreq with immutable governor (e.g., passive) shows + * only own governor. + */ +- if (df->governor->immutable) { ++ if (df->governor && df->governor->immutable) { + count = scnprintf(&buf[count], DEVFREQ_NAME_LEN, + "%s ", df->governor_name); + /* +diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c +index cafb1cc065bb..bf95f1d551c5 100644 +--- a/drivers/dma/dma-jz4780.c ++++ b/drivers/dma/dma-jz4780.c +@@ -1004,7 +1004,8 @@ static const struct jz4780_dma_soc_data jz4740_dma_soc_data = { + static const struct jz4780_dma_soc_data jz4725b_dma_soc_data = { + .nb_channels = 6, + .transfer_ord_max = 5, +- .flags = JZ_SOC_DATA_PER_CHAN_PM | JZ_SOC_DATA_NO_DCKES_DCKEC, ++ .flags = JZ_SOC_DATA_PER_CHAN_PM | JZ_SOC_DATA_NO_DCKES_DCKEC | ++ JZ_SOC_DATA_BREAK_LINKS, + }; + + static const struct jz4780_dma_soc_data jz4770_dma_soc_data = { +diff --git a/drivers/dma/virt-dma.c b/drivers/dma/virt-dma.c +index ec4adf4260a0..256fc662c500 100644 +--- a/drivers/dma/virt-dma.c ++++ b/drivers/dma/virt-dma.c +@@ -104,9 +104,8 @@ static void vchan_complete(unsigned long arg) + dmaengine_desc_get_callback(&vd->tx, &cb); + + list_del(&vd->node); +- vchan_vdesc_fini(vd); +- + dmaengine_desc_callback_invoke(&cb, &vd->tx_result); ++ vchan_vdesc_fini(vd); + } + } + +diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c +index b132ab9ad607..715e491dfbc3 100644 +--- a/drivers/firewire/net.c ++++ b/drivers/firewire/net.c +@@ -250,7 +250,11 @@ static int fwnet_header_cache(const struct neighbour *neigh, + h = (struct fwnet_header *)((u8 *)hh->hh_data + HH_DATA_OFF(sizeof(*h))); + h->h_proto = type; + memcpy(h->h_dest, neigh->ha, net->addr_len); +- hh->hh_len = FWNET_HLEN; ++ ++ /* Pairs with the READ_ONCE() in neigh_resolve_output(), ++ * neigh_hh_output() and neigh_update_hhs(). ++ */ ++ smp_store_release(&hh->hh_len, FWNET_HLEN); + + return 0; + } +diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c +index 92f843eaf1e0..7a30952b463d 100644 +--- a/drivers/firmware/arm_scmi/bus.c ++++ b/drivers/firmware/arm_scmi/bus.c +@@ -135,8 +135,10 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol) + return NULL; + + id = ida_simple_get(&scmi_bus_id, 1, 0, GFP_KERNEL); +- if (id < 0) +- goto free_mem; ++ if (id < 0) { ++ kfree(scmi_dev); ++ return NULL; ++ } + + scmi_dev->id = id; + scmi_dev->protocol_id = protocol; +@@ -154,8 +156,6 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol) + put_dev: + put_device(&scmi_dev->dev); + ida_simple_remove(&scmi_bus_id, id); +-free_mem: +- kfree(scmi_dev); + return NULL; + } + +diff --git a/drivers/firmware/efi/rci2-table.c b/drivers/firmware/efi/rci2-table.c +index 76b0c354a027..de1a9a1f9f14 100644 +--- a/drivers/firmware/efi/rci2-table.c ++++ b/drivers/firmware/efi/rci2-table.c +@@ -81,6 +81,9 @@ static int __init efi_rci2_sysfs_init(void) + struct kobject *tables_kobj; + int ret = -ENOMEM; + ++ if (rci2_table_phys == EFI_INVALID_TABLE_ADDR) ++ return 0; ++ + rci2_base = memremap(rci2_table_phys, + sizeof(struct rci2_table_global_hdr), + MEMREMAP_WB); +diff --git a/drivers/gpio/gpio-xtensa.c b/drivers/gpio/gpio-xtensa.c +index 43d3fa5f511a..0fb2211f9573 100644 +--- a/drivers/gpio/gpio-xtensa.c ++++ b/drivers/gpio/gpio-xtensa.c +@@ -44,15 +44,14 @@ static inline unsigned long enable_cp(unsigned long *cpenable) + unsigned long flags; + + local_irq_save(flags); +- RSR_CPENABLE(*cpenable); +- WSR_CPENABLE(*cpenable | BIT(XCHAL_CP_ID_XTIOP)); +- ++ *cpenable = xtensa_get_sr(cpenable); ++ xtensa_set_sr(*cpenable | BIT(XCHAL_CP_ID_XTIOP), cpenable); + return flags; + } + + static inline void disable_cp(unsigned long flags, unsigned long cpenable) + { +- WSR_CPENABLE(cpenable); ++ xtensa_set_sr(cpenable, cpenable); + local_irq_restore(flags); + } + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 104ed299d5ea..99d19f80440e 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -220,6 +220,14 @@ int gpiod_get_direction(struct gpio_desc *desc) + chip = gpiod_to_chip(desc); + offset = gpio_chip_hwgpio(desc); + ++ /* ++ * Open drain emulation using input mode may incorrectly report ++ * input here, fix that up. ++ */ ++ if (test_bit(FLAG_OPEN_DRAIN, &desc->flags) && ++ test_bit(FLAG_IS_OUT, &desc->flags)) ++ return 0; ++ + if (!chip->get_direction) + return -ENOTSUPP; + +diff --git a/drivers/gpu/drm/amd/amdgpu/df_v3_6.c b/drivers/gpu/drm/amd/amdgpu/df_v3_6.c +index 5850c8e34caa..97d11d792351 100644 +--- a/drivers/gpu/drm/amd/amdgpu/df_v3_6.c ++++ b/drivers/gpu/drm/amd/amdgpu/df_v3_6.c +@@ -261,23 +261,29 @@ static void df_v3_6_update_medium_grain_clock_gating(struct amdgpu_device *adev, + { + u32 tmp; + +- /* Put DF on broadcast mode */ +- adev->df_funcs->enable_broadcast_mode(adev, true); +- +- if (enable && (adev->cg_flags & AMD_CG_SUPPORT_DF_MGCG)) { +- tmp = RREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater); +- tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK; +- tmp |= DF_V3_6_MGCG_ENABLE_15_CYCLE_DELAY; +- WREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater, tmp); +- } else { +- tmp = RREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater); +- tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK; +- tmp |= DF_V3_6_MGCG_DISABLE; +- WREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater, tmp); +- } ++ if (adev->cg_flags & AMD_CG_SUPPORT_DF_MGCG) { ++ /* Put DF on broadcast mode */ ++ adev->df_funcs->enable_broadcast_mode(adev, true); ++ ++ if (enable) { ++ tmp = RREG32_SOC15(DF, 0, ++ mmDF_PIE_AON0_DfGlobalClkGater); ++ tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK; ++ tmp |= DF_V3_6_MGCG_ENABLE_15_CYCLE_DELAY; ++ WREG32_SOC15(DF, 0, ++ mmDF_PIE_AON0_DfGlobalClkGater, tmp); ++ } else { ++ tmp = RREG32_SOC15(DF, 0, ++ mmDF_PIE_AON0_DfGlobalClkGater); ++ tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK; ++ tmp |= DF_V3_6_MGCG_DISABLE; ++ WREG32_SOC15(DF, 0, ++ mmDF_PIE_AON0_DfGlobalClkGater, tmp); ++ } + +- /* Exit broadcast mode */ +- adev->df_funcs->enable_broadcast_mode(adev, false); ++ /* Exit broadcast mode */ ++ adev->df_funcs->enable_broadcast_mode(adev, false); ++ } + } + + static void df_v3_6_get_clockgating_state(struct amdgpu_device *adev, +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index 87dd55e9d72b..cc88ba76a8d4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -6184,7 +6184,23 @@ static void gfx_v8_0_ring_emit_fence_gfx(struct amdgpu_ring *ring, u64 addr, + bool write64bit = flags & AMDGPU_FENCE_FLAG_64BIT; + bool int_sel = flags & AMDGPU_FENCE_FLAG_INT; + +- /* EVENT_WRITE_EOP - flush caches, send int */ ++ /* Workaround for cache flush problems. First send a dummy EOP ++ * event down the pipe with seq one below. ++ */ ++ amdgpu_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4)); ++ amdgpu_ring_write(ring, (EOP_TCL1_ACTION_EN | ++ EOP_TC_ACTION_EN | ++ EOP_TC_WB_ACTION_EN | ++ EVENT_TYPE(CACHE_FLUSH_AND_INV_TS_EVENT) | ++ EVENT_INDEX(5))); ++ amdgpu_ring_write(ring, addr & 0xfffffffc); ++ amdgpu_ring_write(ring, (upper_32_bits(addr) & 0xffff) | ++ DATA_SEL(1) | INT_SEL(0)); ++ amdgpu_ring_write(ring, lower_32_bits(seq - 1)); ++ amdgpu_ring_write(ring, upper_32_bits(seq - 1)); ++ ++ /* Then send the real EOP event down the pipe: ++ * EVENT_WRITE_EOP - flush caches, send int */ + amdgpu_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4)); + amdgpu_ring_write(ring, (EOP_TCL1_ACTION_EN | + EOP_TC_ACTION_EN | +@@ -6926,7 +6942,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_gfx = { + 5 + /* COND_EXEC */ + 7 + /* PIPELINE_SYNC */ + VI_FLUSH_GPU_TLB_NUM_WREG * 5 + 9 + /* VM_FLUSH */ +- 8 + /* FENCE for VM_FLUSH */ ++ 12 + /* FENCE for VM_FLUSH */ + 20 + /* GDS switch */ + 4 + /* double SWITCH_BUFFER, + the first COND_EXEC jump to the place just +@@ -6938,7 +6954,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_gfx = { + 31 + /* DE_META */ + 3 + /* CNTX_CTRL */ + 5 + /* HDP_INVL */ +- 8 + 8 + /* FENCE x2 */ ++ 12 + 12 + /* FENCE x2 */ + 2, /* SWITCH_BUFFER */ + .emit_ib_size = 4, /* gfx_v8_0_ring_emit_ib_gfx */ + .emit_ib = gfx_v8_0_ring_emit_ib_gfx, +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 067f5579f452..793aa8e8ec9a 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -373,7 +373,7 @@ bool dc_link_is_dp_sink_present(struct dc_link *link) + + if (GPIO_RESULT_OK != dal_ddc_open( + ddc, GPIO_MODE_INPUT, GPIO_DDC_CONFIG_TYPE_MODE_I2C)) { +- dal_gpio_destroy_ddc(&ddc); ++ dal_ddc_close(ddc); + + return present; + } +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index 5a583707d198..0ab890c927ec 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -3492,7 +3492,14 @@ void dp_set_fec_enable(struct dc_link *link, bool enable) + if (link_enc->funcs->fec_set_enable && + link->dpcd_caps.fec_cap.bits.FEC_CAPABLE) { + if (link->fec_state == dc_link_fec_ready && enable) { +- msleep(1); ++ /* Accord to DP spec, FEC enable sequence can first ++ * be transmitted anytime after 1000 LL codes have ++ * been transmitted on the link after link training ++ * completion. Using 1 lane RBR should have the maximum ++ * time for transmitting 1000 LL codes which is 6.173 us. ++ * So use 7 microseconds delay instead. ++ */ ++ udelay(7); + link_enc->funcs->fec_set_enable(link_enc, true); + link->fec_state = dc_link_fec_enabled; + } else if (link->fec_state == dc_link_fec_enabled && !enable) { +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index 78b2cc2e122f..3b7769a3e67e 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -1419,13 +1419,20 @@ enum dc_status dcn20_build_mapped_resource(const struct dc *dc, struct dc_state + + static void acquire_dsc(struct resource_context *res_ctx, + const struct resource_pool *pool, +- struct display_stream_compressor **dsc) ++ struct display_stream_compressor **dsc, ++ int pipe_idx) + { + int i; + + ASSERT(*dsc == NULL); + *dsc = NULL; + ++ if (pool->res_cap->num_dsc == pool->res_cap->num_opp) { ++ *dsc = pool->dscs[pipe_idx]; ++ res_ctx->is_dsc_acquired[pipe_idx] = true; ++ return; ++ } ++ + /* Find first free DSC */ + for (i = 0; i < pool->res_cap->num_dsc; i++) + if (!res_ctx->is_dsc_acquired[i]) { +@@ -1468,7 +1475,7 @@ static enum dc_status add_dsc_to_stream_resource(struct dc *dc, + if (pipe_ctx->stream != dc_stream) + continue; + +- acquire_dsc(&dc_ctx->res_ctx, pool, &pipe_ctx->stream_res.dsc); ++ acquire_dsc(&dc_ctx->res_ctx, pool, &pipe_ctx->stream_res.dsc, i); + + /* The number of DSCs can be less than the number of pipes */ + if (!pipe_ctx->stream_res.dsc) { +@@ -1669,7 +1676,7 @@ static bool dcn20_split_stream_for_odm( + next_odm_pipe->stream_res.opp = pool->opps[next_odm_pipe->pipe_idx]; + #ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT + if (next_odm_pipe->stream->timing.flags.DSC == 1) { +- acquire_dsc(res_ctx, pool, &next_odm_pipe->stream_res.dsc); ++ acquire_dsc(res_ctx, pool, &next_odm_pipe->stream_res.dsc, next_odm_pipe->pipe_idx); + ASSERT(next_odm_pipe->stream_res.dsc); + if (next_odm_pipe->stream_res.dsc == NULL) + return false; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.c +index 5ab9d6240498..e95025b1d14d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.c +@@ -492,15 +492,23 @@ void enc2_stream_encoder_dp_unblank( + DP_VID_N_MUL, n_multiply); + } + +- /* set DIG_START to 0x1 to reset FIFO */ ++ /* make sure stream is disabled before resetting steer fifo */ ++ REG_UPDATE(DP_VID_STREAM_CNTL, DP_VID_STREAM_ENABLE, false); ++ REG_WAIT(DP_VID_STREAM_CNTL, DP_VID_STREAM_STATUS, 0, 10, 5000); + ++ /* set DIG_START to 0x1 to reset FIFO */ + REG_UPDATE(DIG_FE_CNTL, DIG_START, 1); ++ udelay(1); + + /* write 0 to take the FIFO out of reset */ + + REG_UPDATE(DIG_FE_CNTL, DIG_START, 0); + +- /* switch DP encoder to CRTC data */ ++ /* switch DP encoder to CRTC data, but reset it the fifo first. It may happen ++ * that it overflows during mode transition, and sometimes doesn't recover. ++ */ ++ REG_UPDATE(DP_STEER_FIFO, DP_STEER_FIFO_RESET, 1); ++ udelay(10); + + REG_UPDATE(DP_STEER_FIFO, DP_STEER_FIFO_RESET, 0); + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +index de182185fe1f..b0e5e64df212 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +@@ -258,7 +258,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = { + .vmm_page_size_bytes = 4096, + .dram_clock_change_latency_us = 23.84, + .return_bus_width_bytes = 64, +- .dispclk_dppclk_vco_speed_mhz = 3550, ++ .dispclk_dppclk_vco_speed_mhz = 3600, + .xfc_bus_transport_time_us = 4, + .xfc_xbuf_latency_tolerance_us = 4, + .use_urgent_burst_bw = 1, +diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c +index 58c091ab67b2..a066e9297777 100644 +--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c +@@ -844,6 +844,7 @@ static int smu_sw_init(void *handle) + smu->smu_baco.platform_support = false; + + mutex_init(&smu->sensor_lock); ++ mutex_init(&smu->metrics_lock); + + smu->watermarks_bitmap = 0; + smu->power_profile_mode = PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT; +diff --git a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c +index d493a3f8c07a..08a717a34bd6 100644 +--- a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c +@@ -910,18 +910,21 @@ static int arcturus_get_metrics_table(struct smu_context *smu, + struct smu_table_context *smu_table= &smu->smu_table; + int ret = 0; + ++ mutex_lock(&smu->metrics_lock); + if (!smu_table->metrics_time || + time_after(jiffies, smu_table->metrics_time + HZ / 1000)) { + ret = smu_update_table(smu, SMU_TABLE_SMU_METRICS, 0, + (void *)smu_table->metrics_table, false); + if (ret) { + pr_info("Failed to export SMU metrics table!\n"); ++ mutex_unlock(&smu->metrics_lock); + return ret; + } + smu_table->metrics_time = jiffies; + } + + memcpy(metrics_table, smu_table->metrics_table, sizeof(SmuMetrics_t)); ++ mutex_unlock(&smu->metrics_lock); + + return ret; + } +@@ -1388,12 +1391,17 @@ static int arcturus_get_power_profile_mode(struct smu_context *smu, + "VR", + "COMPUTE", + "CUSTOM"}; ++ static const char *title[] = { ++ "PROFILE_INDEX(NAME)"}; + uint32_t i, size = 0; + int16_t workload_type = 0; + + if (!smu->pm_enabled || !buf) + return -EINVAL; + ++ size += sprintf(buf + size, "%16s\n", ++ title[0]); ++ + for (i = 0; i <= PP_SMC_POWER_PROFILE_CUSTOM; i++) { + /* + * Conv PP_SMC_POWER_PROFILE* to WORKLOAD_PPLIB_*_BIT +diff --git a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h +index 23171a4d9a31..5ad9a7878f6b 100644 +--- a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h ++++ b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h +@@ -345,6 +345,7 @@ struct smu_context + const struct pptable_funcs *ppt_funcs; + struct mutex mutex; + struct mutex sensor_lock; ++ struct mutex metrics_lock; + uint64_t pool_size; + + struct smu_table_context smu_table; +diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c +index 328e258a6895..7d913a06ebac 100644 +--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c +@@ -547,17 +547,20 @@ static int navi10_get_metrics_table(struct smu_context *smu, + struct smu_table_context *smu_table= &smu->smu_table; + int ret = 0; + ++ mutex_lock(&smu->metrics_lock); + if (!smu_table->metrics_time || time_after(jiffies, smu_table->metrics_time + msecs_to_jiffies(100))) { + ret = smu_update_table(smu, SMU_TABLE_SMU_METRICS, 0, + (void *)smu_table->metrics_table, false); + if (ret) { + pr_info("Failed to export SMU metrics table!\n"); ++ mutex_unlock(&smu->metrics_lock); + return ret; + } + smu_table->metrics_time = jiffies; + } + + memcpy(metrics_table, smu_table->metrics_table, sizeof(SmuMetrics_t)); ++ mutex_unlock(&smu->metrics_lock); + + return ret; + } +diff --git a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c +index 92c393f613d3..3c3f719971f7 100644 +--- a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c +@@ -1691,17 +1691,20 @@ static int vega20_get_metrics_table(struct smu_context *smu, + struct smu_table_context *smu_table= &smu->smu_table; + int ret = 0; + ++ mutex_lock(&smu->metrics_lock); + if (!smu_table->metrics_time || time_after(jiffies, smu_table->metrics_time + HZ / 1000)) { + ret = smu_update_table(smu, SMU_TABLE_SMU_METRICS, 0, + (void *)smu_table->metrics_table, false); + if (ret) { + pr_info("Failed to export SMU metrics table!\n"); ++ mutex_unlock(&smu->metrics_lock); + return ret; + } + smu_table->metrics_time = jiffies; + } + + memcpy(metrics_table, smu_table->metrics_table, sizeof(SmuMetrics_t)); ++ mutex_unlock(&smu->metrics_lock); + + return ret; + } +diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c +index 06a506c29463..d564bfcab6a3 100644 +--- a/drivers/gpu/drm/i915/gt/intel_lrc.c ++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c +@@ -525,7 +525,8 @@ __unwind_incomplete_requests(struct intel_engine_cs *engine) + */ + if (test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, + &rq->fence.flags)) { +- spin_lock(&rq->lock); ++ spin_lock_nested(&rq->lock, ++ SINGLE_DEPTH_NESTING); + i915_request_cancel_breadcrumb(rq); + spin_unlock(&rq->lock); + } +diff --git a/drivers/gpu/drm/mcde/mcde_dsi.c b/drivers/gpu/drm/mcde/mcde_dsi.c +index f9c9e32b299c..35bb825d1918 100644 +--- a/drivers/gpu/drm/mcde/mcde_dsi.c ++++ b/drivers/gpu/drm/mcde/mcde_dsi.c +@@ -935,11 +935,13 @@ static int mcde_dsi_bind(struct device *dev, struct device *master, + for_each_available_child_of_node(dev->of_node, child) { + panel = of_drm_find_panel(child); + if (IS_ERR(panel)) { +- dev_err(dev, "failed to find panel try bridge (%lu)\n", ++ dev_err(dev, "failed to find panel try bridge (%ld)\n", + PTR_ERR(panel)); ++ panel = NULL; ++ + bridge = of_drm_find_bridge(child); + if (IS_ERR(bridge)) { +- dev_err(dev, "failed to find bridge (%lu)\n", ++ dev_err(dev, "failed to find bridge (%ld)\n", + PTR_ERR(bridge)); + return PTR_ERR(bridge); + } +diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c +index a052364a5d74..edd45f434ccd 100644 +--- a/drivers/gpu/drm/msm/msm_gpu.c ++++ b/drivers/gpu/drm/msm/msm_gpu.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + /* + * Power Management: +diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c +index b5b1a34f896f..d735ea7e2d88 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c +@@ -326,9 +326,9 @@ nv50_outp_atomic_check_view(struct drm_encoder *encoder, + * same size as the native one (e.g. different + * refresh rate) + */ +- if (adjusted_mode->hdisplay == native_mode->hdisplay && +- adjusted_mode->vdisplay == native_mode->vdisplay && +- adjusted_mode->type & DRM_MODE_TYPE_DRIVER) ++ if (mode->hdisplay == native_mode->hdisplay && ++ mode->vdisplay == native_mode->vdisplay && ++ mode->type & DRM_MODE_TYPE_DRIVER) + break; + mode = native_mode; + asyc->scaler.full = true; +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index a442a955f98c..eb31c5b6c8e9 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -245,14 +245,22 @@ nouveau_conn_atomic_duplicate_state(struct drm_connector *connector) + void + nouveau_conn_reset(struct drm_connector *connector) + { ++ struct nouveau_connector *nv_connector = nouveau_connector(connector); + struct nouveau_conn_atom *asyc; + +- if (WARN_ON(!(asyc = kzalloc(sizeof(*asyc), GFP_KERNEL)))) +- return; ++ if (drm_drv_uses_atomic_modeset(connector->dev)) { ++ if (WARN_ON(!(asyc = kzalloc(sizeof(*asyc), GFP_KERNEL)))) ++ return; ++ ++ if (connector->state) ++ nouveau_conn_atomic_destroy_state(connector, ++ connector->state); ++ ++ __drm_atomic_helper_connector_reset(connector, &asyc->state); ++ } else { ++ asyc = &nv_connector->properties_state; ++ } + +- if (connector->state) +- nouveau_conn_atomic_destroy_state(connector, connector->state); +- __drm_atomic_helper_connector_reset(connector, &asyc->state); + asyc->dither.mode = DITHERING_MODE_AUTO; + asyc->dither.depth = DITHERING_DEPTH_AUTO; + asyc->scaler.mode = DRM_MODE_SCALE_NONE; +@@ -276,8 +284,14 @@ void + nouveau_conn_attach_properties(struct drm_connector *connector) + { + struct drm_device *dev = connector->dev; +- struct nouveau_conn_atom *armc = nouveau_conn_atom(connector->state); + struct nouveau_display *disp = nouveau_display(dev); ++ struct nouveau_connector *nv_connector = nouveau_connector(connector); ++ struct nouveau_conn_atom *armc; ++ ++ if (drm_drv_uses_atomic_modeset(connector->dev)) ++ armc = nouveau_conn_atom(connector->state); ++ else ++ armc = &nv_connector->properties_state; + + /* Init DVI-I specific properties. */ + if (connector->connector_type == DRM_MODE_CONNECTOR_DVII) +@@ -749,9 +763,9 @@ static int + nouveau_connector_set_property(struct drm_connector *connector, + struct drm_property *property, uint64_t value) + { +- struct nouveau_conn_atom *asyc = nouveau_conn_atom(connector->state); + struct nouveau_connector *nv_connector = nouveau_connector(connector); + struct nouveau_encoder *nv_encoder = nv_connector->detected_encoder; ++ struct nouveau_conn_atom *asyc = &nv_connector->properties_state; + struct drm_encoder *encoder = to_drm_encoder(nv_encoder); + int ret; + +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h +index f43a8d63aef8..de84fb4708c7 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.h ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.h +@@ -29,6 +29,7 @@ + + #include + ++#include + #include + #include + #include +@@ -44,6 +45,60 @@ struct dcb_output; + struct nouveau_backlight; + #endif + ++#define nouveau_conn_atom(p) \ ++ container_of((p), struct nouveau_conn_atom, state) ++ ++struct nouveau_conn_atom { ++ struct drm_connector_state state; ++ ++ struct { ++ /* The enum values specifically defined here match nv50/gf119 ++ * hw values, and the code relies on this. ++ */ ++ enum { ++ DITHERING_MODE_OFF = 0x00, ++ DITHERING_MODE_ON = 0x01, ++ DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON, ++ DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON, ++ DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON, ++ DITHERING_MODE_AUTO ++ } mode; ++ enum { ++ DITHERING_DEPTH_6BPC = 0x00, ++ DITHERING_DEPTH_8BPC = 0x02, ++ DITHERING_DEPTH_AUTO ++ } depth; ++ } dither; ++ ++ struct { ++ int mode; /* DRM_MODE_SCALE_* */ ++ struct { ++ enum { ++ UNDERSCAN_OFF, ++ UNDERSCAN_ON, ++ UNDERSCAN_AUTO, ++ } mode; ++ u32 hborder; ++ u32 vborder; ++ } underscan; ++ bool full; ++ } scaler; ++ ++ struct { ++ int color_vibrance; ++ int vibrant_hue; ++ } procamp; ++ ++ union { ++ struct { ++ bool dither:1; ++ bool scaler:1; ++ bool procamp:1; ++ }; ++ u8 mask; ++ } set; ++}; ++ + struct nouveau_connector { + struct drm_connector base; + enum dcb_connector_type type; +@@ -63,6 +118,12 @@ struct nouveau_connector { + #ifdef CONFIG_DRM_NOUVEAU_BACKLIGHT + struct nouveau_backlight *backlight; + #endif ++ /* ++ * Our connector property code expects a nouveau_conn_atom struct ++ * even on pre-nv50 where we do not support atomic. This embedded ++ * version gets used in the non atomic modeset case. ++ */ ++ struct nouveau_conn_atom properties_state; + }; + + static inline struct nouveau_connector *nouveau_connector( +@@ -121,61 +182,6 @@ extern int nouveau_ignorelid; + extern int nouveau_duallink; + extern int nouveau_hdmimhz; + +-#include +-#define nouveau_conn_atom(p) \ +- container_of((p), struct nouveau_conn_atom, state) +- +-struct nouveau_conn_atom { +- struct drm_connector_state state; +- +- struct { +- /* The enum values specifically defined here match nv50/gf119 +- * hw values, and the code relies on this. +- */ +- enum { +- DITHERING_MODE_OFF = 0x00, +- DITHERING_MODE_ON = 0x01, +- DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON, +- DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON, +- DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON, +- DITHERING_MODE_AUTO +- } mode; +- enum { +- DITHERING_DEPTH_6BPC = 0x00, +- DITHERING_DEPTH_8BPC = 0x02, +- DITHERING_DEPTH_AUTO +- } depth; +- } dither; +- +- struct { +- int mode; /* DRM_MODE_SCALE_* */ +- struct { +- enum { +- UNDERSCAN_OFF, +- UNDERSCAN_ON, +- UNDERSCAN_AUTO, +- } mode; +- u32 hborder; +- u32 vborder; +- } underscan; +- bool full; +- } scaler; +- +- struct { +- int color_vibrance; +- int vibrant_hue; +- } procamp; +- +- union { +- struct { +- bool dither:1; +- bool scaler:1; +- bool procamp:1; +- }; +- u8 mask; +- } set; +-}; +- + void nouveau_conn_attach_properties(struct drm_connector *); + void nouveau_conn_reset(struct drm_connector *); + struct drm_connector_state * +diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +index eb8071a4d6d0..9c3bdfd20337 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c ++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +@@ -683,8 +683,6 @@ static void sun4i_hdmi_unbind(struct device *dev, struct device *master, + struct sun4i_hdmi *hdmi = dev_get_drvdata(dev); + + cec_unregister_adapter(hdmi->cec_adap); +- drm_connector_cleanup(&hdmi->connector); +- drm_encoder_cleanup(&hdmi->encoder); + i2c_del_adapter(hdmi->i2c); + i2c_put_adapter(hdmi->ddc_i2c); + clk_disable_unprepare(hdmi->mod_clk); +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 7608ee053114..ac44bf752ff1 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -48,6 +48,7 @@ + #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV BIT(0) + #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1) + #define I2C_HID_QUIRK_BOGUS_IRQ BIT(4) ++#define I2C_HID_QUIRK_RESET_ON_RESUME BIT(5) + + /* flags */ + #define I2C_HID_STARTED 0 +@@ -174,6 +175,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { USB_VENDOR_ID_ELAN, HID_ANY_ID, + I2C_HID_QUIRK_BOGUS_IRQ }, ++ { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID, ++ I2C_HID_QUIRK_RESET_ON_RESUME }, + { 0, 0 } + }; + +@@ -1214,8 +1217,15 @@ static int i2c_hid_resume(struct device *dev) + * solves "incomplete reports" on Raydium devices 2386:3118 and + * 2386:4B33 and fixes various SIS touchscreens no longer sending + * data after a suspend/resume. ++ * ++ * However some ALPS touchpads generate IRQ storm without reset, so ++ * let's still reset them here. + */ +- ret = i2c_hid_set_power(client, I2C_HID_PWR_ON); ++ if (ihid->quirks & I2C_HID_QUIRK_RESET_ON_RESUME) ++ ret = i2c_hid_hwreset(client); ++ else ++ ret = i2c_hid_set_power(client, I2C_HID_PWR_ON); ++ + if (ret) + return ret; + +diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c +index 2e37f8a6d8cf..be661396095c 100644 +--- a/drivers/iio/accel/st_accel_core.c ++++ b/drivers/iio/accel/st_accel_core.c +@@ -993,6 +993,7 @@ static const struct iio_trigger_ops st_accel_trigger_ops = { + #define ST_ACCEL_TRIGGER_OPS NULL + #endif + ++#ifdef CONFIG_ACPI + static const struct iio_mount_matrix * + get_mount_matrix(const struct iio_dev *indio_dev, + const struct iio_chan_spec *chan) +@@ -1013,7 +1014,6 @@ static const struct iio_chan_spec_ext_info mount_matrix_ext_info[] = { + static int apply_acpi_orientation(struct iio_dev *indio_dev, + struct iio_chan_spec *channels) + { +-#ifdef CONFIG_ACPI + struct st_sensor_data *adata = iio_priv(indio_dev); + struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; + struct acpi_device *adev; +@@ -1141,10 +1141,14 @@ static int apply_acpi_orientation(struct iio_dev *indio_dev, + out: + kfree(buffer.pointer); + return ret; ++} + #else /* !CONFIG_ACPI */ ++static int apply_acpi_orientation(struct iio_dev *indio_dev, ++ struct iio_chan_spec *channels) ++{ + return 0; +-#endif + } ++#endif + + /* + * st_accel_get_settings() - get sensor settings from device name +diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c +index da073d72f649..e480529b3f04 100644 +--- a/drivers/iio/adc/max9611.c ++++ b/drivers/iio/adc/max9611.c +@@ -89,6 +89,12 @@ + #define MAX9611_TEMP_SCALE_NUM 1000000 + #define MAX9611_TEMP_SCALE_DIV 2083 + ++/* ++ * Conversion time is 2 ms (typically) at Ta=25 degreeC ++ * No maximum value is known, so play it safe. ++ */ ++#define MAX9611_CONV_TIME_US_RANGE 3000, 3300 ++ + struct max9611_dev { + struct device *dev; + struct i2c_client *i2c_client; +@@ -236,11 +242,9 @@ static int max9611_read_single(struct max9611_dev *max9611, + return ret; + } + +- /* +- * need a delay here to make register configuration +- * stabilize. 1 msec at least, from empirical testing. +- */ +- usleep_range(1000, 2000); ++ /* need a delay here to make register configuration stabilize. */ ++ ++ usleep_range(MAX9611_CONV_TIME_US_RANGE); + + ret = i2c_smbus_read_word_swapped(max9611->i2c_client, reg_addr); + if (ret < 0) { +@@ -507,7 +511,7 @@ static int max9611_init(struct max9611_dev *max9611) + MAX9611_REG_CTRL2, 0); + return ret; + } +- usleep_range(1000, 2000); ++ usleep_range(MAX9611_CONV_TIME_US_RANGE); + + return 0; + } +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index d78f67623f24..50052e9a1731 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -4736,6 +4736,7 @@ err_ib: + err: + unregister_netdevice_notifier(&cma_nb); + ib_sa_unregister_client(&sa_client); ++ unregister_pernet_subsys(&cma_pernet_operations); + err_wq: + destroy_workqueue(cma_wq); + return ret; +diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c +index 680ad27f497d..023478107f0e 100644 +--- a/drivers/infiniband/core/counters.c ++++ b/drivers/infiniband/core/counters.c +@@ -282,6 +282,9 @@ int rdma_counter_bind_qp_auto(struct ib_qp *qp, u8 port) + struct rdma_counter *counter; + int ret; + ++ if (!qp->res.valid) ++ return 0; ++ + if (!rdma_is_port_valid(dev, port)) + return -EINVAL; + +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 8d2f1e38b891..907d99822bf0 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -3008,16 +3008,17 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr) + ibdev->ib_active = false; + flush_workqueue(wq); + +- mlx4_ib_close_sriov(ibdev); +- mlx4_ib_mad_cleanup(ibdev); +- ib_unregister_device(&ibdev->ib_dev); +- mlx4_ib_diag_cleanup(ibdev); + if (ibdev->iboe.nb.notifier_call) { + if (unregister_netdevice_notifier(&ibdev->iboe.nb)) + pr_warn("failure unregistering notifier\n"); + ibdev->iboe.nb.notifier_call = NULL; + } + ++ mlx4_ib_close_sriov(ibdev); ++ mlx4_ib_mad_cleanup(ibdev); ++ ib_unregister_device(&ibdev->ib_dev); ++ mlx4_ib_diag_cleanup(ibdev); ++ + mlx4_qp_release_range(dev, ibdev->steer_qpn_base, + ibdev->steer_qpn_count); + kfree(ibdev->ib_uc_qpns_bitmap); +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 831539419c30..e1cfbedefcbc 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -3548,10 +3548,6 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev, + } + + INIT_LIST_HEAD(&handler->list); +- if (dst) { +- memcpy(&dest_arr[0], dst, sizeof(*dst)); +- dest_num++; +- } + + for (spec_index = 0; spec_index < flow_attr->num_of_specs; spec_index++) { + err = parse_flow_attr(dev->mdev, spec, +@@ -3564,6 +3560,11 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev, + ib_flow += ((union ib_flow_spec *)ib_flow)->size; + } + ++ if (dst && !(flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DROP)) { ++ memcpy(&dest_arr[0], dst, sizeof(*dst)); ++ dest_num++; ++ } ++ + if (!flow_is_multicast_only(flow_attr)) + set_underlay_qp(dev, spec, underlay_qpn); + +@@ -3604,10 +3605,8 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev, + } + + if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DROP) { +- if (!(flow_act.action & MLX5_FLOW_CONTEXT_ACTION_COUNT)) { ++ if (!dest_num) + rule_dst = NULL; +- dest_num = 0; +- } + } else { + if (is_egress) + flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_ALLOW; +diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c +index f9a492ed900b..831ad578a7b2 100644 +--- a/drivers/infiniband/sw/rxe/rxe_recv.c ++++ b/drivers/infiniband/sw/rxe/rxe_recv.c +@@ -389,7 +389,7 @@ void rxe_rcv(struct sk_buff *skb) + + calc_icrc = rxe_icrc_hdr(pkt, skb); + calc_icrc = rxe_crc32(rxe, calc_icrc, (u8 *)payload_addr(pkt), +- payload_size(pkt)); ++ payload_size(pkt) + bth_pad(pkt)); + calc_icrc = (__force u32)cpu_to_be32(~calc_icrc); + if (unlikely(calc_icrc != pack_icrc)) { + if (skb->protocol == htons(ETH_P_IPV6)) +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index c5d9b558fa90..e5031172c019 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -500,6 +500,12 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + if (err) + return err; + } ++ if (bth_pad(pkt)) { ++ u8 *pad = payload_addr(pkt) + paylen; ++ ++ memset(pad, 0, bth_pad(pkt)); ++ crc = rxe_crc32(rxe, crc, pad, bth_pad(pkt)); ++ } + } + p = payload_addr(pkt) + paylen + bth_pad(pkt); + +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index 1cbfbd98eb22..c4a8195bf670 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -732,6 +732,13 @@ static enum resp_states read_reply(struct rxe_qp *qp, + if (err) + pr_err("Failed copying memory\n"); + ++ if (bth_pad(&ack_pkt)) { ++ struct rxe_dev *rxe = to_rdev(qp->ibqp.device); ++ u8 *pad = payload_addr(&ack_pkt) + payload; ++ ++ memset(pad, 0, bth_pad(&ack_pkt)); ++ icrc = rxe_crc32(rxe, icrc, pad, bth_pad(&ack_pkt)); ++ } + p = payload_addr(&ack_pkt) + payload + bth_pad(&ack_pkt); + *p = ~icrc; + +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index 9b159132405d..dca88f9fdf29 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -104,11 +104,7 @@ static void intel_flush_svm_range_dev (struct intel_svm *svm, struct intel_svm_d + { + struct qi_desc desc; + +- /* +- * Do PASID granu IOTLB invalidation if page selective capability is +- * not available. +- */ +- if (pages == -1 || !cap_pgsel_inv(svm->iommu->cap)) { ++ if (pages == -1) { + desc.qw0 = QI_EIOTLB_PASID(svm->pasid) | + QI_EIOTLB_DID(sdev->did) | + QI_EIOTLB_GRAN(QI_GRAN_NONG_PASID) | +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index bb29aeefcbd0..c7137f50bd1d 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2781,7 +2781,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr, + write_targets++; + } + } +- if (bio->bi_end_io) { ++ if (rdev && bio->bi_end_io) { + atomic_inc(&rdev->nr_pending); + bio->bi_iter.bi_sector = sector_nr + rdev->data_offset; + bio_set_dev(bio, rdev->bdev); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 12a8ce83786e..36cd7c2fbf40 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5726,7 +5726,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) + do_flush = false; + } + +- if (!sh->batch_head) ++ if (!sh->batch_head || sh == sh->batch_head) + set_bit(STRIPE_HANDLE, &sh->state); + clear_bit(STRIPE_DELAYED, &sh->state); + if ((!sh->batch_head || sh == sh->batch_head) && +diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c +index 5ef7daeb8cbd..b14c09cd9593 100644 +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -378,7 +378,8 @@ static void cec_data_cancel(struct cec_data *data, u8 tx_status) + } else { + list_del_init(&data->list); + if (!(data->msg.tx_status & CEC_TX_STATUS_OK)) +- data->adap->transmit_queue_sz--; ++ if (!WARN_ON(!data->adap->transmit_queue_sz)) ++ data->adap->transmit_queue_sz--; + } + + if (data->msg.tx_status & CEC_TX_STATUS_OK) { +@@ -430,6 +431,14 @@ static void cec_flush(struct cec_adapter *adap) + * need to do anything special in that case. + */ + } ++ /* ++ * If something went wrong and this counter isn't what it should ++ * be, then this will reset it back to 0. Warn if it is not 0, ++ * since it indicates a bug, either in this framework or in a ++ * CEC driver. ++ */ ++ if (WARN_ON(adap->transmit_queue_sz)) ++ adap->transmit_queue_sz = 0; + } + + /* +@@ -454,7 +463,7 @@ int cec_thread_func(void *_adap) + bool timeout = false; + u8 attempts; + +- if (adap->transmitting) { ++ if (adap->transmit_in_progress) { + int err; + + /* +@@ -489,7 +498,7 @@ int cec_thread_func(void *_adap) + goto unlock; + } + +- if (adap->transmitting && timeout) { ++ if (adap->transmit_in_progress && timeout) { + /* + * If we timeout, then log that. Normally this does + * not happen and it is an indication of a faulty CEC +@@ -498,14 +507,18 @@ int cec_thread_func(void *_adap) + * so much traffic on the bus that the adapter was + * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s). + */ +- pr_warn("cec-%s: message %*ph timed out\n", adap->name, +- adap->transmitting->msg.len, +- adap->transmitting->msg.msg); ++ if (adap->transmitting) { ++ pr_warn("cec-%s: message %*ph timed out\n", adap->name, ++ adap->transmitting->msg.len, ++ adap->transmitting->msg.msg); ++ /* Just give up on this. */ ++ cec_data_cancel(adap->transmitting, ++ CEC_TX_STATUS_TIMEOUT); ++ } else { ++ pr_warn("cec-%s: transmit timed out\n", adap->name); ++ } + adap->transmit_in_progress = false; + adap->tx_timeouts++; +- /* Just give up on this. */ +- cec_data_cancel(adap->transmitting, +- CEC_TX_STATUS_TIMEOUT); + goto unlock; + } + +@@ -520,7 +533,8 @@ int cec_thread_func(void *_adap) + data = list_first_entry(&adap->transmit_queue, + struct cec_data, list); + list_del_init(&data->list); +- adap->transmit_queue_sz--; ++ if (!WARN_ON(!data->adap->transmit_queue_sz)) ++ adap->transmit_queue_sz--; + + /* Make this the current transmitting message */ + adap->transmitting = data; +@@ -1083,11 +1097,11 @@ void cec_received_msg_ts(struct cec_adapter *adap, + valid_la = false; + else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED)) + valid_la = false; +- else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4)) ++ else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST)) + valid_la = false; + else if (cec_msg_is_broadcast(msg) && +- adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 && +- !(dir_fl & BCAST2_0)) ++ adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0 && ++ !(dir_fl & BCAST1_4)) + valid_la = false; + } + if (valid_la && min_len) { +diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c +index d1331f828108..039963a7765b 100644 +--- a/drivers/media/usb/b2c2/flexcop-usb.c ++++ b/drivers/media/usb/b2c2/flexcop-usb.c +@@ -295,7 +295,7 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c, + + mutex_unlock(&fc_usb->data_mutex); + +- return 0; ++ return ret; + } + + /* actual bus specific access functions, +diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c +index 02697d86e8c1..ac93e88d7038 100644 +--- a/drivers/media/usb/dvb-usb/af9005.c ++++ b/drivers/media/usb/dvb-usb/af9005.c +@@ -976,8 +976,9 @@ static int af9005_identify_state(struct usb_device *udev, + else if (reply == 0x02) + *cold = 0; + else +- return -EIO; +- deb_info("Identify state cold = %d\n", *cold); ++ ret = -EIO; ++ if (!ret) ++ deb_info("Identify state cold = %d\n", *cold); + + err: + kfree(buf); +diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c +index ac88ade94cda..59609556d969 100644 +--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c ++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c +@@ -116,6 +116,7 @@ struct pulse8 { + unsigned int vers; + struct completion cmd_done; + struct work_struct work; ++ u8 work_result; + struct delayed_work ping_eeprom_work; + struct cec_msg rx_msg; + u8 data[DATA_SIZE]; +@@ -137,8 +138,10 @@ static void pulse8_irq_work_handler(struct work_struct *work) + { + struct pulse8 *pulse8 = + container_of(work, struct pulse8, work); ++ u8 result = pulse8->work_result; + +- switch (pulse8->data[0] & 0x3f) { ++ pulse8->work_result = 0; ++ switch (result & 0x3f) { + case MSGCODE_FRAME_DATA: + cec_received_msg(pulse8->adap, &pulse8->rx_msg); + break; +@@ -172,12 +175,12 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data, + pulse8->escape = false; + } else if (data == MSGEND) { + struct cec_msg *msg = &pulse8->rx_msg; ++ u8 msgcode = pulse8->buf[0]; + + if (debug) + dev_info(pulse8->dev, "received: %*ph\n", + pulse8->idx, pulse8->buf); +- pulse8->data[0] = pulse8->buf[0]; +- switch (pulse8->buf[0] & 0x3f) { ++ switch (msgcode & 0x3f) { + case MSGCODE_FRAME_START: + msg->len = 1; + msg->msg[0] = pulse8->buf[1]; +@@ -186,14 +189,20 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data, + if (msg->len == CEC_MAX_MSG_SIZE) + break; + msg->msg[msg->len++] = pulse8->buf[1]; +- if (pulse8->buf[0] & MSGCODE_FRAME_EOM) ++ if (msgcode & MSGCODE_FRAME_EOM) { ++ WARN_ON(pulse8->work_result); ++ pulse8->work_result = msgcode; + schedule_work(&pulse8->work); ++ break; ++ } + break; + case MSGCODE_TRANSMIT_SUCCEEDED: + case MSGCODE_TRANSMIT_FAILED_LINE: + case MSGCODE_TRANSMIT_FAILED_ACK: + case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA: + case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE: ++ WARN_ON(pulse8->work_result); ++ pulse8->work_result = msgcode; + schedule_work(&pulse8->work); + break; + case MSGCODE_HIGH_ERROR: +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +index 4e8e80ac8341..9cec5c216e1f 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -973,6 +973,8 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + struct ath_htc_rx_status *rxstatus; + struct ath_rx_status rx_stats; + bool decrypt_error = false; ++ __be16 rs_datalen; ++ bool is_phyerr; + + if (skb->len < HTC_RX_FRAME_HEADER_SIZE) { + ath_err(common, "Corrupted RX frame, dropping (len: %d)\n", +@@ -982,11 +984,24 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + + rxstatus = (struct ath_htc_rx_status *)skb->data; + +- if (be16_to_cpu(rxstatus->rs_datalen) - +- (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0) { ++ rs_datalen = be16_to_cpu(rxstatus->rs_datalen); ++ if (unlikely(rs_datalen - ++ (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) { + ath_err(common, + "Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n", +- rxstatus->rs_datalen, skb->len); ++ rs_datalen, skb->len); ++ goto rx_next; ++ } ++ ++ is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY; ++ /* ++ * Discard zero-length packets and packets smaller than an ACK ++ * which are not PHY_ERROR (short radar pulses have a length of 3) ++ */ ++ if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) { ++ ath_warn(common, ++ "Short RX data len, dropping (dlen: %d)\n", ++ rs_datalen); + goto rx_next; + } + +@@ -1011,7 +1026,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + * Process PHY errors and return so that the packet + * can be dropped. + */ +- if (rx_stats.rs_status & ATH9K_RXERR_PHY) { ++ if (unlikely(is_phyerr)) { + /* TODO: Not using DFS processing now. */ + if (ath_cmn_process_fft(&priv->spec_priv, hdr, + &rx_stats, rx_status->mactime)) { +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 265f89e11d8b..59474bd0c728 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -342,7 +342,8 @@ nvme_fc_register_localport(struct nvme_fc_port_info *pinfo, + !template->ls_req || !template->fcp_io || + !template->ls_abort || !template->fcp_abort || + !template->max_hw_queues || !template->max_sgl_segments || +- !template->max_dif_sgl_segments || !template->dma_boundary) { ++ !template->max_dif_sgl_segments || !template->dma_boundary || ++ !template->module) { + ret = -EINVAL; + goto out_reghost_failed; + } +@@ -2015,6 +2016,7 @@ nvme_fc_ctrl_free(struct kref *ref) + { + struct nvme_fc_ctrl *ctrl = + container_of(ref, struct nvme_fc_ctrl, ref); ++ struct nvme_fc_lport *lport = ctrl->lport; + unsigned long flags; + + if (ctrl->ctrl.tagset) { +@@ -2041,6 +2043,7 @@ nvme_fc_ctrl_free(struct kref *ref) + if (ctrl->ctrl.opts) + nvmf_free_options(ctrl->ctrl.opts); + kfree(ctrl); ++ module_put(lport->ops->module); + } + + static void +@@ -2907,10 +2910,22 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status) + static void + __nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl) + { +- nvme_stop_keep_alive(&ctrl->ctrl); ++ /* ++ * if state is connecting - the error occurred as part of a ++ * reconnect attempt. The create_association error paths will ++ * clean up any outstanding io. ++ * ++ * if it's a different state - ensure all pending io is ++ * terminated. Given this can delay while waiting for the ++ * aborted io to return, we recheck adapter state below ++ * before changing state. ++ */ ++ if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) { ++ nvme_stop_keep_alive(&ctrl->ctrl); + +- /* will block will waiting for io to terminate */ +- nvme_fc_delete_association(ctrl); ++ /* will block will waiting for io to terminate */ ++ nvme_fc_delete_association(ctrl); ++ } + + if (ctrl->ctrl.state != NVME_CTRL_CONNECTING && + !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) +@@ -3056,10 +3071,15 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, + goto out_fail; + } + ++ if (!try_module_get(lport->ops->module)) { ++ ret = -EUNATCH; ++ goto out_free_ctrl; ++ } ++ + idx = ida_simple_get(&nvme_fc_ctrl_cnt, 0, 0, GFP_KERNEL); + if (idx < 0) { + ret = -ENOSPC; +- goto out_free_ctrl; ++ goto out_mod_put; + } + + ctrl->ctrl.opts = opts; +@@ -3212,6 +3232,8 @@ out_free_queues: + out_free_ida: + put_device(ctrl->dev); + ida_simple_remove(&nvme_fc_ctrl_cnt, ctrl->cnum); ++out_mod_put: ++ module_put(lport->ops->module); + out_free_ctrl: + kfree(ctrl); + out_fail: +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 869f462e6b6e..14d513087a14 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -68,14 +68,14 @@ static int io_queue_depth = 1024; + module_param_cb(io_queue_depth, &io_queue_depth_ops, &io_queue_depth, 0644); + MODULE_PARM_DESC(io_queue_depth, "set io queue depth, should >= 2"); + +-static int write_queues; +-module_param(write_queues, int, 0644); ++static unsigned int write_queues; ++module_param(write_queues, uint, 0644); + MODULE_PARM_DESC(write_queues, + "Number of queues to use for writes. If not set, reads and writes " + "will share a queue set."); + +-static int poll_queues; +-module_param(poll_queues, int, 0644); ++static unsigned int poll_queues; ++module_param(poll_queues, uint, 0644); + MODULE_PARM_DESC(poll_queues, "Number of queues to use for polled IO."); + + struct nvme_dev; +@@ -2060,7 +2060,6 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues) + .priv = dev, + }; + unsigned int irq_queues, this_p_queues; +- unsigned int nr_cpus = num_possible_cpus(); + + /* + * Poll queues don't need interrupts, but we need at least one IO +@@ -2071,10 +2070,7 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues) + this_p_queues = nr_io_queues - 1; + irq_queues = 1; + } else { +- if (nr_cpus < nr_io_queues - this_p_queues) +- irq_queues = nr_cpus + 1; +- else +- irq_queues = nr_io_queues - this_p_queues + 1; ++ irq_queues = nr_io_queues - this_p_queues + 1; + } + dev->io_queues[HCTX_TYPE_POLL] = this_p_queues; + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index b50b53db3746..1c50af6219f3 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -850,6 +850,7 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport) + #define FCLOOP_DMABOUND_4G 0xFFFFFFFF + + static struct nvme_fc_port_template fctemplate = { ++ .module = THIS_MODULE, + .localport_delete = fcloop_localport_delete, + .remoteport_delete = fcloop_remoteport_delete, + .create_queue = fcloop_create_queue, +diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c +index c423e94baf0f..9617b7df7c4d 100644 +--- a/drivers/of/overlay.c ++++ b/drivers/of/overlay.c +@@ -305,7 +305,6 @@ static int add_changeset_property(struct overlay_changeset *ovcs, + { + struct property *new_prop = NULL, *prop; + int ret = 0; +- bool check_for_non_overlay_node = false; + + if (target->in_livetree) + if (!of_prop_cmp(overlay_prop->name, "name") || +@@ -318,6 +317,25 @@ static int add_changeset_property(struct overlay_changeset *ovcs, + else + prop = NULL; + ++ if (prop) { ++ if (!of_prop_cmp(prop->name, "#address-cells")) { ++ if (!of_prop_val_eq(prop, overlay_prop)) { ++ pr_err("ERROR: changing value of #address-cells is not allowed in %pOF\n", ++ target->np); ++ ret = -EINVAL; ++ } ++ return ret; ++ ++ } else if (!of_prop_cmp(prop->name, "#size-cells")) { ++ if (!of_prop_val_eq(prop, overlay_prop)) { ++ pr_err("ERROR: changing value of #size-cells is not allowed in %pOF\n", ++ target->np); ++ ret = -EINVAL; ++ } ++ return ret; ++ } ++ } ++ + if (is_symbols_prop) { + if (prop) + return -EINVAL; +@@ -330,33 +348,18 @@ static int add_changeset_property(struct overlay_changeset *ovcs, + return -ENOMEM; + + if (!prop) { +- check_for_non_overlay_node = true; + if (!target->in_livetree) { + new_prop->next = target->np->deadprops; + target->np->deadprops = new_prop; + } + ret = of_changeset_add_property(&ovcs->cset, target->np, + new_prop); +- } else if (!of_prop_cmp(prop->name, "#address-cells")) { +- if (!of_prop_val_eq(prop, new_prop)) { +- pr_err("ERROR: changing value of #address-cells is not allowed in %pOF\n", +- target->np); +- ret = -EINVAL; +- } +- } else if (!of_prop_cmp(prop->name, "#size-cells")) { +- if (!of_prop_val_eq(prop, new_prop)) { +- pr_err("ERROR: changing value of #size-cells is not allowed in %pOF\n", +- target->np); +- ret = -EINVAL; +- } + } else { +- check_for_non_overlay_node = true; + ret = of_changeset_update_property(&ovcs->cset, target->np, + new_prop); + } + +- if (check_for_non_overlay_node && +- !of_node_check_flag(target->np, OF_OVERLAY)) ++ if (!of_node_check_flag(target->np, OF_OVERLAY)) + pr_err("WARNING: memory leak will occur if overlay removed, property: %pOF/%s\n", + target->np, new_prop->name); + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index a97e2571a527..fcfaadc774ee 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5854,6 +5854,24 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode, + return 0; + } + ++#ifdef CONFIG_ACPI ++bool pci_pr3_present(struct pci_dev *pdev) ++{ ++ struct acpi_device *adev; ++ ++ if (acpi_disabled) ++ return false; ++ ++ adev = ACPI_COMPANION(&pdev->dev); ++ if (!adev) ++ return false; ++ ++ return adev->power.flags.power_resources && ++ acpi_has_method(adev->handle, "_PR3"); ++} ++EXPORT_SYMBOL_GPL(pci_pr3_present); ++#endif ++ + /** + * pci_add_dma_alias - Add a DMA devfn alias for a device + * @dev: the PCI device for which alias is added +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index 6fd1390fd06e..bfb22f868857 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -615,7 +615,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + return PTR_ERR(channel->base); + + /* call request_irq for OTG */ +- irq = platform_get_irq(pdev, 0); ++ irq = platform_get_irq_optional(pdev, 0); + if (irq >= 0) { + INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work); + irq = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq, +diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c +index 07d1b911e72f..52ef1419b671 100644 +--- a/drivers/platform/x86/pmc_atom.c ++++ b/drivers/platform/x86/pmc_atom.c +@@ -429,6 +429,14 @@ static const struct dmi_system_id critclk_systems[] = { + DMI_MATCH(DMI_PRODUCT_VERSION, "6AV7882-0"), + }, + }, ++ { ++ .ident = "CONNECT X300", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SIEMENS AG"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "A5E45074588"), ++ }, ++ }, ++ + { /*sentinel*/ } + }; + +diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c +index efb2f01a9101..f60e1b26c2d2 100644 +--- a/drivers/regulator/ab8500.c ++++ b/drivers/regulator/ab8500.c +@@ -953,23 +953,6 @@ static struct ab8500_regulator_info + .update_val_idle = 0x82, + .update_val_normal = 0x02, + }, +- [AB8505_LDO_USB] = { +- .desc = { +- .name = "LDO-USB", +- .ops = &ab8500_regulator_mode_ops, +- .type = REGULATOR_VOLTAGE, +- .id = AB8505_LDO_USB, +- .owner = THIS_MODULE, +- .n_voltages = 1, +- .volt_table = fixed_3300000_voltage, +- }, +- .update_bank = 0x03, +- .update_reg = 0x82, +- .update_mask = 0x03, +- .update_val = 0x01, +- .update_val_idle = 0x03, +- .update_val_normal = 0x01, +- }, + [AB8505_LDO_AUDIO] = { + .desc = { + .name = "LDO-AUDIO", +diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c +index 989506bd90b1..16f0c8570036 100644 +--- a/drivers/regulator/axp20x-regulator.c ++++ b/drivers/regulator/axp20x-regulator.c +@@ -413,10 +413,13 @@ static int axp20x_set_ramp_delay(struct regulator_dev *rdev, int ramp) + int i; + + for (i = 0; i < rate_count; i++) { +- if (ramp <= slew_rates[i]) +- cfg = AXP20X_DCDC2_LDO3_V_RAMP_LDO3_RATE(i); +- else ++ if (ramp > slew_rates[i]) + break; ++ ++ if (id == AXP20X_DCDC2) ++ cfg = AXP20X_DCDC2_LDO3_V_RAMP_DCDC2_RATE(i); ++ else ++ cfg = AXP20X_DCDC2_LDO3_V_RAMP_LDO3_RATE(i); + } + + if (cfg == 0xff) { +@@ -605,7 +608,7 @@ static const struct regulator_desc axp22x_regulators[] = { + AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO1_MASK), + AXP_DESC(AXP22X, ELDO2, "eldo2", "eldoin", 700, 3300, 100, + AXP22X_ELDO2_V_OUT, AXP22X_ELDO2_V_OUT_MASK, +- AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO1_MASK), ++ AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO2_MASK), + AXP_DESC(AXP22X, ELDO3, "eldo3", "eldoin", 700, 3300, 100, + AXP22X_ELDO3_V_OUT, AXP22X_ELDO3_V_OUT_MASK, + AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO3_MASK), +diff --git a/drivers/regulator/bd70528-regulator.c b/drivers/regulator/bd70528-regulator.c +index 0248a61f1006..6041839ec38c 100644 +--- a/drivers/regulator/bd70528-regulator.c ++++ b/drivers/regulator/bd70528-regulator.c +@@ -101,7 +101,6 @@ static const struct regulator_ops bd70528_ldo_ops = { + .set_voltage_sel = regulator_set_voltage_sel_regmap, + .get_voltage_sel = regulator_get_voltage_sel_regmap, + .set_voltage_time_sel = regulator_set_voltage_time_sel, +- .set_ramp_delay = bd70528_set_ramp_delay, + }; + + static const struct regulator_ops bd70528_led_ops = { +diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c +index f47b4b281b14..d7302c2052f9 100644 +--- a/drivers/scsi/libsas/sas_discover.c ++++ b/drivers/scsi/libsas/sas_discover.c +@@ -81,12 +81,21 @@ static int sas_get_port_device(struct asd_sas_port *port) + else + dev->dev_type = SAS_SATA_DEV; + dev->tproto = SAS_PROTOCOL_SATA; +- } else { ++ } else if (port->oob_mode == SAS_OOB_MODE) { + struct sas_identify_frame *id = + (struct sas_identify_frame *) dev->frame_rcvd; + dev->dev_type = id->dev_type; + dev->iproto = id->initiator_bits; + dev->tproto = id->target_bits; ++ } else { ++ /* If the oob mode is OOB_NOT_CONNECTED, the port is ++ * disconnected due to race with PHY down. We cannot ++ * continue to discover this port ++ */ ++ sas_put_device(dev); ++ pr_warn("Port %016llx is disconnected when discovering\n", ++ SAS_ADDR(port->attached_sas_addr)); ++ return -ENODEV; + } + + sas_init_dev(dev); +diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c +index 39a736b887b1..6c2b03415a2c 100644 +--- a/drivers/scsi/lpfc/lpfc_bsg.c ++++ b/drivers/scsi/lpfc/lpfc_bsg.c +@@ -4489,12 +4489,6 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, + phba->mbox_ext_buf_ctx.seqNum++; + nemb_tp = phba->mbox_ext_buf_ctx.nembType; + +- dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL); +- if (!dd_data) { +- rc = -ENOMEM; +- goto job_error; +- } +- + pbuf = (uint8_t *)dmabuf->virt; + size = job->request_payload.payload_len; + sg_copy_to_buffer(job->request_payload.sg_list, +@@ -4531,6 +4525,13 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, + "2968 SLI_CONFIG ext-buffer wr all %d " + "ebuffers received\n", + phba->mbox_ext_buf_ctx.numBuf); ++ ++ dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL); ++ if (!dd_data) { ++ rc = -ENOMEM; ++ goto job_error; ++ } ++ + /* mailbox command structure for base driver */ + pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); + if (!pmboxq) { +@@ -4579,6 +4580,8 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, + return SLI_CONFIG_HANDLED; + + job_error: ++ if (pmboxq) ++ mempool_free(pmboxq, phba->mbox_mem_pool); + lpfc_bsg_dma_page_free(phba, dmabuf); + kfree(dd_data); + +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index 1286c658ba34..ee70d14e7a9d 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -4843,6 +4843,44 @@ lpfc_nlp_logo_unreg(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) + } + } + ++/* ++ * Sets the mailbox completion handler to be used for the ++ * unreg_rpi command. The handler varies based on the state of ++ * the port and what will be happening to the rpi next. ++ */ ++static void ++lpfc_set_unreg_login_mbx_cmpl(struct lpfc_hba *phba, struct lpfc_vport *vport, ++ struct lpfc_nodelist *ndlp, LPFC_MBOXQ_t *mbox) ++{ ++ unsigned long iflags; ++ ++ if (ndlp->nlp_flag & NLP_ISSUE_LOGO) { ++ mbox->ctx_ndlp = ndlp; ++ mbox->mbox_cmpl = lpfc_nlp_logo_unreg; ++ ++ } else if (phba->sli_rev == LPFC_SLI_REV4 && ++ (!(vport->load_flag & FC_UNLOADING)) && ++ (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >= ++ LPFC_SLI_INTF_IF_TYPE_2) && ++ (kref_read(&ndlp->kref) > 0)) { ++ mbox->ctx_ndlp = lpfc_nlp_get(ndlp); ++ mbox->mbox_cmpl = lpfc_sli4_unreg_rpi_cmpl_clr; ++ } else { ++ if (vport->load_flag & FC_UNLOADING) { ++ if (phba->sli_rev == LPFC_SLI_REV4) { ++ spin_lock_irqsave(&vport->phba->ndlp_lock, ++ iflags); ++ ndlp->nlp_flag |= NLP_RELEASE_RPI; ++ spin_unlock_irqrestore(&vport->phba->ndlp_lock, ++ iflags); ++ } ++ lpfc_nlp_get(ndlp); ++ } ++ mbox->ctx_ndlp = ndlp; ++ mbox->mbox_cmpl = lpfc_sli_def_mbox_cmpl; ++ } ++} ++ + /* + * Free rpi associated with LPFC_NODELIST entry. + * This routine is called from lpfc_freenode(), when we are removing +@@ -4893,33 +4931,12 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + + lpfc_unreg_login(phba, vport->vpi, rpi, mbox); + mbox->vport = vport; +- if (ndlp->nlp_flag & NLP_ISSUE_LOGO) { +- mbox->ctx_ndlp = ndlp; +- mbox->mbox_cmpl = lpfc_nlp_logo_unreg; +- } else { +- if (phba->sli_rev == LPFC_SLI_REV4 && +- (!(vport->load_flag & FC_UNLOADING)) && +- (bf_get(lpfc_sli_intf_if_type, +- &phba->sli4_hba.sli_intf) >= +- LPFC_SLI_INTF_IF_TYPE_2) && +- (kref_read(&ndlp->kref) > 0)) { +- mbox->ctx_ndlp = lpfc_nlp_get(ndlp); +- mbox->mbox_cmpl = +- lpfc_sli4_unreg_rpi_cmpl_clr; +- /* +- * accept PLOGIs after unreg_rpi_cmpl +- */ +- acc_plogi = 0; +- } else if (vport->load_flag & FC_UNLOADING) { +- mbox->ctx_ndlp = NULL; +- mbox->mbox_cmpl = +- lpfc_sli_def_mbox_cmpl; +- } else { +- mbox->ctx_ndlp = ndlp; +- mbox->mbox_cmpl = +- lpfc_sli_def_mbox_cmpl; +- } +- } ++ lpfc_set_unreg_login_mbx_cmpl(phba, vport, ndlp, mbox); ++ if (mbox->mbox_cmpl == lpfc_sli4_unreg_rpi_cmpl_clr) ++ /* ++ * accept PLOGIs after unreg_rpi_cmpl ++ */ ++ acc_plogi = 0; + if (((ndlp->nlp_DID & Fabric_DID_MASK) != + Fabric_DID_MASK) && + (!(vport->fc_flag & FC_OFFLINE_MODE))) +@@ -5060,6 +5077,7 @@ lpfc_cleanup_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + struct lpfc_hba *phba = vport->phba; + LPFC_MBOXQ_t *mb, *nextmb; + struct lpfc_dmabuf *mp; ++ unsigned long iflags; + + /* Cleanup node for NPort */ + lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE, +@@ -5141,8 +5159,20 @@ lpfc_cleanup_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + lpfc_cleanup_vports_rrqs(vport, ndlp); + if (phba->sli_rev == LPFC_SLI_REV4) + ndlp->nlp_flag |= NLP_RELEASE_RPI; +- lpfc_unreg_rpi(vport, ndlp); +- ++ if (!lpfc_unreg_rpi(vport, ndlp)) { ++ /* Clean up unregistered and non freed rpis */ ++ if ((ndlp->nlp_flag & NLP_RELEASE_RPI) && ++ !(ndlp->nlp_rpi == LPFC_RPI_ALLOC_ERROR)) { ++ lpfc_sli4_free_rpi(vport->phba, ++ ndlp->nlp_rpi); ++ spin_lock_irqsave(&vport->phba->ndlp_lock, ++ iflags); ++ ndlp->nlp_flag &= ~NLP_RELEASE_RPI; ++ ndlp->nlp_rpi = LPFC_RPI_ALLOC_ERROR; ++ spin_unlock_irqrestore(&vport->phba->ndlp_lock, ++ iflags); ++ } ++ } + return 0; + } + +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index a227e36cbdc2..8e0f03ef346b 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -1976,6 +1976,8 @@ out_unlock: + + /* Declare and initialization an instance of the FC NVME template. */ + static struct nvme_fc_port_template lpfc_nvme_template = { ++ .module = THIS_MODULE, ++ + /* initiator-based functions */ + .localport_delete = lpfc_nvme_localport_delete, + .remoteport_delete = lpfc_nvme_remoteport_delete, +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 2b0e7b32c2df..8860f41af3ff 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -2526,6 +2526,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) + } else { + __lpfc_sli_rpi_release(vport, ndlp); + } ++ if (vport->load_flag & FC_UNLOADING) ++ lpfc_nlp_put(ndlp); + pmb->ctx_ndlp = NULL; + } + } +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index d5386edddaf6..1eb3fe281cc3 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -2401,6 +2401,7 @@ typedef struct fc_port { + unsigned int id_changed:1; + unsigned int scan_needed:1; + unsigned int n2n_flag:1; ++ unsigned int explicit_logout:1; + + struct completion nvme_del_done; + uint32_t nvme_prli_service_param; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 5d31e3d52b6b..80f276d67c14 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -4927,14 +4927,8 @@ qla2x00_configure_loop(scsi_qla_host_t *vha) + set_bit(RSCN_UPDATE, &flags); + clear_bit(LOCAL_LOOP_UPDATE, &flags); + +- } else if (ha->current_topology == ISP_CFG_N) { +- clear_bit(RSCN_UPDATE, &flags); +- if (qla_tgt_mode_enabled(vha)) { +- /* allow the other side to start the login */ +- clear_bit(LOCAL_LOOP_UPDATE, &flags); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); +- } +- } else if (ha->current_topology == ISP_CFG_NL) { ++ } else if (ha->current_topology == ISP_CFG_NL || ++ ha->current_topology == ISP_CFG_N) { + clear_bit(RSCN_UPDATE, &flags); + set_bit(LOCAL_LOOP_UPDATE, &flags); + } else if (!vha->flags.online || +@@ -5051,7 +5045,6 @@ qla2x00_configure_local_loop(scsi_qla_host_t *vha) + memcpy(&ha->plogi_els_payld.data, + (void *)ha->init_cb, + sizeof(ha->plogi_els_payld.data)); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); + } else { + ql_dbg(ql_dbg_init, vha, 0x00d1, + "PLOGI ELS param read fail.\n"); +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 518eb954cf42..bdf1994251b9 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -2405,11 +2405,19 @@ qla2x00_login_iocb(srb_t *sp, struct mbx_entry *mbx) + static void + qla24xx_logout_iocb(srb_t *sp, struct logio_entry_24xx *logio) + { ++ u16 control_flags = LCF_COMMAND_LOGO; + logio->entry_type = LOGINOUT_PORT_IOCB_TYPE; +- logio->control_flags = +- cpu_to_le16(LCF_COMMAND_LOGO|LCF_IMPL_LOGO); +- if (!sp->fcport->keep_nport_handle) +- logio->control_flags |= cpu_to_le16(LCF_FREE_NPORT); ++ ++ if (sp->fcport->explicit_logout) { ++ control_flags |= LCF_EXPL_LOGO|LCF_FREE_NPORT; ++ } else { ++ control_flags |= LCF_IMPL_LOGO; ++ ++ if (!sp->fcport->keep_nport_handle) ++ control_flags |= LCF_FREE_NPORT; ++ } ++ ++ logio->control_flags = cpu_to_le16(control_flags); + logio->nport_handle = cpu_to_le16(sp->fcport->loop_id); + logio->port_id[0] = sp->fcport->d_id.b.al_pa; + logio->port_id[1] = sp->fcport->d_id.b.area; +@@ -2676,7 +2684,8 @@ qla24xx_els_logo_iocb(srb_t *sp, struct els_entry_24xx *els_iocb) + ql_dbg(ql_dbg_io + ql_dbg_buffer, vha, 0x3073, + "PLOGI ELS IOCB:\n"); + ql_dump_buffer(ql_log_info, vha, 0x0109, +- (uint8_t *)els_iocb, 0x70); ++ (uint8_t *)els_iocb, ++ sizeof(*els_iocb)); + } else { + els_iocb->control_flags = 1 << 13; + els_iocb->tx_byte_count = +@@ -2842,7 +2851,8 @@ qla24xx_els_dcmd2_iocb(scsi_qla_host_t *vha, int els_opcode, + + ql_dbg(ql_dbg_disc + ql_dbg_buffer, vha, 0x3073, "PLOGI buffer:\n"); + ql_dump_buffer(ql_dbg_disc + ql_dbg_buffer, vha, 0x0109, +- (uint8_t *)elsio->u.els_plogi.els_plogi_pyld, 0x70); ++ (uint8_t *)elsio->u.els_plogi.els_plogi_pyld, ++ sizeof(*elsio->u.els_plogi.els_plogi_pyld)); + + rval = qla2x00_start_sp(sp); + if (rval != QLA_SUCCESS) { +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 9204e8467a4e..b3766b1879e3 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1061,8 +1061,6 @@ global_port_update: + ql_dbg(ql_dbg_async, vha, 0x5011, + "Asynchronous PORT UPDATE ignored %04x/%04x/%04x.\n", + mb[1], mb[2], mb[3]); +- +- qlt_async_event(mb[0], vha, mb); + break; + } + +@@ -1079,8 +1077,6 @@ global_port_update: + set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags); + set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags); + set_bit(VP_CONFIG_OK, &vha->vp_flags); +- +- qlt_async_event(mb[0], vha, mb); + break; + + case MBA_RSCN_UPDATE: /* State Change Registration */ +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 4d90cf101f5f..eac76e934cbe 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -3920,6 +3920,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + vha->d_id.b24 = 0; + vha->d_id.b.al_pa = 1; + ha->flags.n2n_bigger = 1; ++ ha->flags.n2n_ae = 0; + + id.b.al_pa = 2; + ql_dbg(ql_dbg_async, vha, 0x5075, +@@ -3930,6 +3931,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + "Format 1: Remote login - Waiting for WWPN %8phC.\n", + rptid_entry->u.f1.port_name); + ha->flags.n2n_bigger = 0; ++ ha->flags.n2n_ae = 1; + } + qla24xx_post_newsess_work(vha, &id, + rptid_entry->u.f1.port_name, +@@ -3941,7 +3943,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + /* if our portname is higher then initiate N2N login */ + + set_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags); +- ha->flags.n2n_ae = 1; + return; + break; + case TOPO_FL: +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 941aa53363f5..bfcd02fdf2b8 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -610,6 +610,7 @@ static void qla_nvme_remoteport_delete(struct nvme_fc_remote_port *rport) + } + + static struct nvme_fc_port_template qla_nvme_fc_transport = { ++ .module = THIS_MODULE, + .localport_delete = qla_nvme_localport_delete, + .remoteport_delete = qla_nvme_remoteport_delete, + .create_queue = qla_nvme_alloc_queue, +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index a9bd0f513316..74a378a91b71 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1104,6 +1104,7 @@ void qlt_free_session_done(struct work_struct *work) + } + } + ++ sess->explicit_logout = 0; + spin_unlock_irqrestore(&ha->tgt.sess_lock, flags); + sess->free_pending = 0; + +@@ -1264,7 +1265,6 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess) + "Scheduling sess %p for deletion %8phC\n", + sess, sess->port_name); + +- INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn); + WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work)); + } + +@@ -4803,6 +4803,7 @@ static int qlt_handle_login(struct scsi_qla_host *vha, + + switch (sess->disc_state) { + case DSC_DELETED: ++ case DSC_LOGIN_PEND: + qlt_plogi_ack_unref(vha, pla); + break; + +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index bab2073c1f72..abe7f79bb789 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -350,6 +350,7 @@ static void tcm_qla2xxx_close_session(struct se_session *se_sess) + target_sess_cmd_list_set_waiting(se_sess); + spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); + ++ sess->explicit_logout = 1; + tcm_qla2xxx_put_sess(sess); + } + +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 8c674eca09f1..2323432a0edb 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -4275,7 +4275,6 @@ static int qla4xxx_mem_alloc(struct scsi_qla_host *ha) + return QLA_SUCCESS; + + mem_alloc_error_exit: +- qla4xxx_mem_free(ha); + return QLA_ERROR; + } + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 417b868d8735..ed8d9709b9b9 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -24,6 +24,8 @@ + + #define ISCSI_TRANSPORT_VERSION "2.0-870" + ++#define ISCSI_SEND_MAX_ALLOWED 10 ++ + #define CREATE_TRACE_POINTS + #include + +@@ -3682,6 +3684,7 @@ iscsi_if_rx(struct sk_buff *skb) + struct nlmsghdr *nlh; + struct iscsi_uevent *ev; + uint32_t group; ++ int retries = ISCSI_SEND_MAX_ALLOWED; + + nlh = nlmsg_hdr(skb); + if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) || +@@ -3712,6 +3715,10 @@ iscsi_if_rx(struct sk_buff *skb) + break; + err = iscsi_if_send_reply(portid, nlh->nlmsg_type, + ev, sizeof(*ev)); ++ if (err == -EAGAIN && --retries < 0) { ++ printk(KERN_WARNING "Send reply failed, error %d\n", err); ++ break; ++ } + } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH); + skb_pull(skb, rlen); + } +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index bec758e978fb..d47bd26577b3 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -583,21 +583,14 @@ static void dspi_tcfq_write(struct fsl_dspi *dspi) + dspi->tx_cmd |= SPI_PUSHR_CMD_CTCNT; + + if (dspi->devtype_data->xspi_mode && dspi->bits_per_word > 16) { +- /* Write two TX FIFO entries first, and then the corresponding +- * CMD FIFO entry. ++ /* Write the CMD FIFO entry first, and then the two ++ * corresponding TX FIFO entries. + */ + u32 data = dspi_pop_tx(dspi); + +- if (dspi->cur_chip->ctar_val & SPI_CTAR_LSBFE) { +- /* LSB */ +- tx_fifo_write(dspi, data & 0xFFFF); +- tx_fifo_write(dspi, data >> 16); +- } else { +- /* MSB */ +- tx_fifo_write(dspi, data >> 16); +- tx_fifo_write(dspi, data & 0xFFFF); +- } + cmd_fifo_write(dspi); ++ tx_fifo_write(dspi, data & 0xFFFF); ++ tx_fifo_write(dspi, data >> 16); + } else { + /* Write one entry to both TX FIFO and CMD FIFO + * simultaneously. +diff --git a/drivers/spi/spi-uniphier.c b/drivers/spi/spi-uniphier.c +index 47cde1864630..ce9b30112e26 100644 +--- a/drivers/spi/spi-uniphier.c ++++ b/drivers/spi/spi-uniphier.c +@@ -290,25 +290,32 @@ static void uniphier_spi_recv(struct uniphier_spi_priv *priv) + } + } + +-static void uniphier_spi_fill_tx_fifo(struct uniphier_spi_priv *priv) ++static void uniphier_spi_set_fifo_threshold(struct uniphier_spi_priv *priv, ++ unsigned int threshold) + { +- unsigned int fifo_threshold, fill_bytes; + u32 val; + +- fifo_threshold = DIV_ROUND_UP(priv->rx_bytes, +- bytes_per_word(priv->bits_per_word)); +- fifo_threshold = min(fifo_threshold, SSI_FIFO_DEPTH); +- +- fill_bytes = fifo_threshold - (priv->rx_bytes - priv->tx_bytes); +- +- /* set fifo threshold */ + val = readl(priv->base + SSI_FC); + val &= ~(SSI_FC_TXFTH_MASK | SSI_FC_RXFTH_MASK); +- val |= FIELD_PREP(SSI_FC_TXFTH_MASK, fifo_threshold); +- val |= FIELD_PREP(SSI_FC_RXFTH_MASK, fifo_threshold); ++ val |= FIELD_PREP(SSI_FC_TXFTH_MASK, SSI_FIFO_DEPTH - threshold); ++ val |= FIELD_PREP(SSI_FC_RXFTH_MASK, threshold); + writel(val, priv->base + SSI_FC); ++} ++ ++static void uniphier_spi_fill_tx_fifo(struct uniphier_spi_priv *priv) ++{ ++ unsigned int fifo_threshold, fill_words; ++ unsigned int bpw = bytes_per_word(priv->bits_per_word); ++ ++ fifo_threshold = DIV_ROUND_UP(priv->rx_bytes, bpw); ++ fifo_threshold = min(fifo_threshold, SSI_FIFO_DEPTH); ++ ++ uniphier_spi_set_fifo_threshold(priv, fifo_threshold); ++ ++ fill_words = fifo_threshold - ++ DIV_ROUND_UP(priv->rx_bytes - priv->tx_bytes, bpw); + +- while (fill_bytes--) ++ while (fill_words--) + uniphier_spi_send(priv); + } + +diff --git a/drivers/staging/wlan-ng/Kconfig b/drivers/staging/wlan-ng/Kconfig +index ac136663fa8e..082c16a31616 100644 +--- a/drivers/staging/wlan-ng/Kconfig ++++ b/drivers/staging/wlan-ng/Kconfig +@@ -4,6 +4,7 @@ config PRISM2_USB + depends on WLAN && USB && CFG80211 + select WIRELESS_EXT + select WEXT_PRIV ++ select CRC32 + help + This is the wlan-ng prism 2.5/3 USB driver for a wide range of + old USB wireless devices. +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index 00964b6e4ac1..e0718ee5d42a 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -1580,6 +1580,7 @@ static void __msm_console_write(struct uart_port *port, const char *s, + int num_newlines = 0; + bool replaced = false; + void __iomem *tf; ++ int locked = 1; + + if (is_uartdm) + tf = port->membase + UARTDM_TF; +@@ -1592,7 +1593,13 @@ static void __msm_console_write(struct uart_port *port, const char *s, + num_newlines++; + count += num_newlines; + +- spin_lock(&port->lock); ++ if (port->sysrq) ++ locked = 0; ++ else if (oops_in_progress) ++ locked = spin_trylock(&port->lock); ++ else ++ spin_lock(&port->lock); ++ + if (is_uartdm) + msm_reset_dm_count(port, count); + +@@ -1628,7 +1635,9 @@ static void __msm_console_write(struct uart_port *port, const char *s, + iowrite32_rep(tf, buf, 1); + i += num_chars; + } +- spin_unlock(&port->lock); ++ ++ if (locked) ++ spin_unlock(&port->lock); + } + + static void msm_console_write(struct console *co, const char *s, +diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c +index 6ce044008cf6..460d5d7c984f 100644 +--- a/drivers/usb/gadget/function/f_ecm.c ++++ b/drivers/usb/gadget/function/f_ecm.c +@@ -621,8 +621,12 @@ static void ecm_disable(struct usb_function *f) + + DBG(cdev, "ecm deactivated\n"); + +- if (ecm->port.in_ep->enabled) ++ if (ecm->port.in_ep->enabled) { + gether_disconnect(&ecm->port); ++ } else { ++ ecm->port.in_ep->desc = NULL; ++ ecm->port.out_ep->desc = NULL; ++ } + + usb_ep_disable(ecm->notify); + ecm->notify->desc = NULL; +diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c +index d48df36622b7..0d8e4a364ca6 100644 +--- a/drivers/usb/gadget/function/f_rndis.c ++++ b/drivers/usb/gadget/function/f_rndis.c +@@ -618,6 +618,7 @@ static void rndis_disable(struct usb_function *f) + gether_disconnect(&rndis->port); + + usb_ep_disable(rndis->notify); ++ rndis->notify->desc = NULL; + } + + /*-------------------------------------------------------------------------*/ +diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig +index 58e7c100b6ad..4c761abc5688 100644 +--- a/drivers/watchdog/Kconfig ++++ b/drivers/watchdog/Kconfig +@@ -1444,6 +1444,7 @@ config SMSC37B787_WDT + config TQMX86_WDT + tristate "TQ-Systems TQMX86 Watchdog Timer" + depends on X86 ++ select WATCHDOG_CORE + help + This is the driver for the hardware watchdog timer in the TQMX86 IO + controller found on some of their ComExpress Modules. +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index 5bae515c8e25..bed90d612e48 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -395,7 +395,8 @@ static struct notifier_block xen_memory_nb = { + #else + static enum bp_state reserve_additional_memory(void) + { +- balloon_stats.target_pages = balloon_stats.current_pages; ++ balloon_stats.target_pages = balloon_stats.current_pages + ++ balloon_stats.target_unpopulated; + return BP_ECANCELED; + } + #endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */ +diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c +index 4150280509ff..7503899c0a1b 100644 +--- a/fs/afs/dynroot.c ++++ b/fs/afs/dynroot.c +@@ -136,6 +136,9 @@ static struct dentry *afs_dynroot_lookup(struct inode *dir, struct dentry *dentr + + ASSERTCMP(d_inode(dentry), ==, NULL); + ++ if (flags & LOOKUP_CREATE) ++ return ERR_PTR(-EOPNOTSUPP); ++ + if (dentry->d_name.len >= AFSNAMEMAX) { + _leave(" = -ENAMETOOLONG"); + return ERR_PTR(-ENAMETOOLONG); +diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c +index f532d6d3bd28..79bc5f1338ed 100644 +--- a/fs/afs/mntpt.c ++++ b/fs/afs/mntpt.c +@@ -126,7 +126,7 @@ static int afs_mntpt_set_params(struct fs_context *fc, struct dentry *mntpt) + if (src_as->cell) + ctx->cell = afs_get_cell(src_as->cell); + +- if (size > PAGE_SIZE - 1) ++ if (size < 2 || size > PAGE_SIZE - 1) + return -EINVAL; + + page = read_mapping_page(d_inode(mntpt)->i_mapping, 0, NULL); +@@ -140,7 +140,9 @@ static int afs_mntpt_set_params(struct fs_context *fc, struct dentry *mntpt) + } + + buf = kmap(page); +- ret = vfs_parse_fs_string(fc, "source", buf, size); ++ ret = -EINVAL; ++ if (buf[size - 1] == '.') ++ ret = vfs_parse_fs_string(fc, "source", buf, size - 1); + kunmap(page); + put_page(page); + if (ret < 0) +diff --git a/fs/afs/server.c b/fs/afs/server.c +index 64d440aaabc0..ca8115ba1724 100644 +--- a/fs/afs/server.c ++++ b/fs/afs/server.c +@@ -32,18 +32,11 @@ static void afs_dec_servers_outstanding(struct afs_net *net) + struct afs_server *afs_find_server(struct afs_net *net, + const struct sockaddr_rxrpc *srx) + { +- const struct sockaddr_in6 *a = &srx->transport.sin6, *b; + const struct afs_addr_list *alist; + struct afs_server *server = NULL; + unsigned int i; +- bool ipv6 = true; + int seq = 0, diff; + +- if (srx->transport.sin6.sin6_addr.s6_addr32[0] == 0 || +- srx->transport.sin6.sin6_addr.s6_addr32[1] == 0 || +- srx->transport.sin6.sin6_addr.s6_addr32[2] == htonl(0xffff)) +- ipv6 = false; +- + rcu_read_lock(); + + do { +@@ -52,7 +45,8 @@ struct afs_server *afs_find_server(struct afs_net *net, + server = NULL; + read_seqbegin_or_lock(&net->fs_addr_lock, &seq); + +- if (ipv6) { ++ if (srx->transport.family == AF_INET6) { ++ const struct sockaddr_in6 *a = &srx->transport.sin6, *b; + hlist_for_each_entry_rcu(server, &net->fs_addresses6, addr6_link) { + alist = rcu_dereference(server->addresses); + for (i = alist->nr_ipv4; i < alist->nr_addrs; i++) { +@@ -68,15 +62,16 @@ struct afs_server *afs_find_server(struct afs_net *net, + } + } + } else { ++ const struct sockaddr_in *a = &srx->transport.sin, *b; + hlist_for_each_entry_rcu(server, &net->fs_addresses4, addr4_link) { + alist = rcu_dereference(server->addresses); + for (i = 0; i < alist->nr_ipv4; i++) { +- b = &alist->addrs[i].transport.sin6; +- diff = ((u16 __force)a->sin6_port - +- (u16 __force)b->sin6_port); ++ b = &alist->addrs[i].transport.sin; ++ diff = ((u16 __force)a->sin_port - ++ (u16 __force)b->sin_port); + if (diff == 0) +- diff = ((u32 __force)a->sin6_addr.s6_addr32[3] - +- (u32 __force)b->sin6_addr.s6_addr32[3]); ++ diff = ((u32 __force)a->sin_addr.s_addr - ++ (u32 __force)b->sin_addr.s_addr); + if (diff == 0) + goto found; + } +diff --git a/fs/afs/super.c b/fs/afs/super.c +index 488641b1a418..d9a6036b70b9 100644 +--- a/fs/afs/super.c ++++ b/fs/afs/super.c +@@ -448,7 +448,6 @@ static int afs_fill_super(struct super_block *sb, struct afs_fs_context *ctx) + /* allocate the root inode and dentry */ + if (as->dyn_root) { + inode = afs_iget_pseudo_dir(sb, true); +- sb->s_flags |= SB_RDONLY; + } else { + sprintf(sb->s_id, "%llu", as->volume->vid); + afs_activate_volume(as->volume); +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index 10a04b99798a..3f3110975f88 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -53,16 +53,6 @@ struct btrfs_workqueue { + struct __btrfs_workqueue *high; + }; + +-static void normal_work_helper(struct btrfs_work *work); +- +-#define BTRFS_WORK_HELPER(name) \ +-noinline_for_stack void btrfs_##name(struct work_struct *arg) \ +-{ \ +- struct btrfs_work *work = container_of(arg, struct btrfs_work, \ +- normal_work); \ +- normal_work_helper(work); \ +-} +- + struct btrfs_fs_info * + btrfs_workqueue_owner(const struct __btrfs_workqueue *wq) + { +@@ -89,29 +79,6 @@ bool btrfs_workqueue_normal_congested(const struct btrfs_workqueue *wq) + return atomic_read(&wq->normal->pending) > wq->normal->thresh * 2; + } + +-BTRFS_WORK_HELPER(worker_helper); +-BTRFS_WORK_HELPER(delalloc_helper); +-BTRFS_WORK_HELPER(flush_delalloc_helper); +-BTRFS_WORK_HELPER(cache_helper); +-BTRFS_WORK_HELPER(submit_helper); +-BTRFS_WORK_HELPER(fixup_helper); +-BTRFS_WORK_HELPER(endio_helper); +-BTRFS_WORK_HELPER(endio_meta_helper); +-BTRFS_WORK_HELPER(endio_meta_write_helper); +-BTRFS_WORK_HELPER(endio_raid56_helper); +-BTRFS_WORK_HELPER(endio_repair_helper); +-BTRFS_WORK_HELPER(rmw_helper); +-BTRFS_WORK_HELPER(endio_write_helper); +-BTRFS_WORK_HELPER(freespace_write_helper); +-BTRFS_WORK_HELPER(delayed_meta_helper); +-BTRFS_WORK_HELPER(readahead_helper); +-BTRFS_WORK_HELPER(qgroup_rescan_helper); +-BTRFS_WORK_HELPER(extent_refs_helper); +-BTRFS_WORK_HELPER(scrub_helper); +-BTRFS_WORK_HELPER(scrubwrc_helper); +-BTRFS_WORK_HELPER(scrubnc_helper); +-BTRFS_WORK_HELPER(scrubparity_helper); +- + static struct __btrfs_workqueue * + __btrfs_alloc_workqueue(struct btrfs_fs_info *fs_info, const char *name, + unsigned int flags, int limit_active, int thresh) +@@ -302,12 +269,13 @@ static void run_ordered_work(struct __btrfs_workqueue *wq, + * original work item cannot depend on the recycled work + * item in that case (see find_worker_executing_work()). + * +- * Note that the work of one Btrfs filesystem may depend +- * on the work of another Btrfs filesystem via, e.g., a +- * loop device. Therefore, we must not allow the current +- * work item to be recycled until we are really done, +- * otherwise we break the above assumption and can +- * deadlock. ++ * Note that different types of Btrfs work can depend on ++ * each other, and one type of work on one Btrfs ++ * filesystem may even depend on the same type of work ++ * on another Btrfs filesystem via, e.g., a loop device. ++ * Therefore, we must not allow the current work item to ++ * be recycled until we are really done, otherwise we ++ * break the above assumption and can deadlock. + */ + free_self = true; + } else { +@@ -331,8 +299,10 @@ static void run_ordered_work(struct __btrfs_workqueue *wq, + } + } + +-static void normal_work_helper(struct btrfs_work *work) ++static void btrfs_work_helper(struct work_struct *normal_work) + { ++ struct btrfs_work *work = container_of(normal_work, struct btrfs_work, ++ normal_work); + struct __btrfs_workqueue *wq; + void *wtag; + int need_order = 0; +@@ -362,15 +332,13 @@ static void normal_work_helper(struct btrfs_work *work) + trace_btrfs_all_work_done(wq->fs_info, wtag); + } + +-void btrfs_init_work(struct btrfs_work *work, btrfs_work_func_t uniq_func, +- btrfs_func_t func, +- btrfs_func_t ordered_func, +- btrfs_func_t ordered_free) ++void btrfs_init_work(struct btrfs_work *work, btrfs_func_t func, ++ btrfs_func_t ordered_func, btrfs_func_t ordered_free) + { + work->func = func; + work->ordered_func = ordered_func; + work->ordered_free = ordered_free; +- INIT_WORK(&work->normal_work, uniq_func); ++ INIT_WORK(&work->normal_work, btrfs_work_helper); + INIT_LIST_HEAD(&work->ordered_list); + work->flags = 0; + } +diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h +index 7861c9feba5f..c5bf2b117c05 100644 +--- a/fs/btrfs/async-thread.h ++++ b/fs/btrfs/async-thread.h +@@ -29,42 +29,13 @@ struct btrfs_work { + unsigned long flags; + }; + +-#define BTRFS_WORK_HELPER_PROTO(name) \ +-void btrfs_##name(struct work_struct *arg) +- +-BTRFS_WORK_HELPER_PROTO(worker_helper); +-BTRFS_WORK_HELPER_PROTO(delalloc_helper); +-BTRFS_WORK_HELPER_PROTO(flush_delalloc_helper); +-BTRFS_WORK_HELPER_PROTO(cache_helper); +-BTRFS_WORK_HELPER_PROTO(submit_helper); +-BTRFS_WORK_HELPER_PROTO(fixup_helper); +-BTRFS_WORK_HELPER_PROTO(endio_helper); +-BTRFS_WORK_HELPER_PROTO(endio_meta_helper); +-BTRFS_WORK_HELPER_PROTO(endio_meta_write_helper); +-BTRFS_WORK_HELPER_PROTO(endio_raid56_helper); +-BTRFS_WORK_HELPER_PROTO(endio_repair_helper); +-BTRFS_WORK_HELPER_PROTO(rmw_helper); +-BTRFS_WORK_HELPER_PROTO(endio_write_helper); +-BTRFS_WORK_HELPER_PROTO(freespace_write_helper); +-BTRFS_WORK_HELPER_PROTO(delayed_meta_helper); +-BTRFS_WORK_HELPER_PROTO(readahead_helper); +-BTRFS_WORK_HELPER_PROTO(qgroup_rescan_helper); +-BTRFS_WORK_HELPER_PROTO(extent_refs_helper); +-BTRFS_WORK_HELPER_PROTO(scrub_helper); +-BTRFS_WORK_HELPER_PROTO(scrubwrc_helper); +-BTRFS_WORK_HELPER_PROTO(scrubnc_helper); +-BTRFS_WORK_HELPER_PROTO(scrubparity_helper); +- +- + struct btrfs_workqueue *btrfs_alloc_workqueue(struct btrfs_fs_info *fs_info, + const char *name, + unsigned int flags, + int limit_active, + int thresh); +-void btrfs_init_work(struct btrfs_work *work, btrfs_work_func_t helper, +- btrfs_func_t func, +- btrfs_func_t ordered_func, +- btrfs_func_t ordered_free); ++void btrfs_init_work(struct btrfs_work *work, btrfs_func_t func, ++ btrfs_func_t ordered_func, btrfs_func_t ordered_free); + void btrfs_queue_work(struct btrfs_workqueue *wq, + struct btrfs_work *work); + void btrfs_destroy_workqueue(struct btrfs_workqueue *wq); +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 0d2da2366869..7dcfa7d7632a 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -695,8 +695,7 @@ int btrfs_cache_block_group(struct btrfs_block_group_cache *cache, + caching_ctl->block_group = cache; + caching_ctl->progress = cache->key.objectid; + refcount_set(&caching_ctl->count, 1); +- btrfs_init_work(&caching_ctl->work, btrfs_cache_helper, +- caching_thread, NULL, NULL); ++ btrfs_init_work(&caching_ctl->work, caching_thread, NULL, NULL); + + spin_lock(&cache->lock); + /* +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 57a9ad3e8c29..c7a53e79c66d 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1367,8 +1367,8 @@ static int btrfs_wq_run_delayed_node(struct btrfs_delayed_root *delayed_root, + return -ENOMEM; + + async_work->delayed_root = delayed_root; +- btrfs_init_work(&async_work->work, btrfs_delayed_meta_helper, +- btrfs_async_run_delayed_root, NULL, NULL); ++ btrfs_init_work(&async_work->work, btrfs_async_run_delayed_root, NULL, ++ NULL); + async_work->nr = nr; + + btrfs_queue_work(fs_info->delayed_workers, &async_work->work); +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 3895c21853cc..bae334212ee2 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -706,43 +706,31 @@ static void end_workqueue_bio(struct bio *bio) + struct btrfs_end_io_wq *end_io_wq = bio->bi_private; + struct btrfs_fs_info *fs_info; + struct btrfs_workqueue *wq; +- btrfs_work_func_t func; + + fs_info = end_io_wq->info; + end_io_wq->status = bio->bi_status; + + if (bio_op(bio) == REQ_OP_WRITE) { +- if (end_io_wq->metadata == BTRFS_WQ_ENDIO_METADATA) { ++ if (end_io_wq->metadata == BTRFS_WQ_ENDIO_METADATA) + wq = fs_info->endio_meta_write_workers; +- func = btrfs_endio_meta_write_helper; +- } else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_FREE_SPACE) { ++ else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_FREE_SPACE) + wq = fs_info->endio_freespace_worker; +- func = btrfs_freespace_write_helper; +- } else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) { ++ else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) + wq = fs_info->endio_raid56_workers; +- func = btrfs_endio_raid56_helper; +- } else { ++ else + wq = fs_info->endio_write_workers; +- func = btrfs_endio_write_helper; +- } + } else { +- if (unlikely(end_io_wq->metadata == +- BTRFS_WQ_ENDIO_DIO_REPAIR)) { ++ if (unlikely(end_io_wq->metadata == BTRFS_WQ_ENDIO_DIO_REPAIR)) + wq = fs_info->endio_repair_workers; +- func = btrfs_endio_repair_helper; +- } else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) { ++ else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) + wq = fs_info->endio_raid56_workers; +- func = btrfs_endio_raid56_helper; +- } else if (end_io_wq->metadata) { ++ else if (end_io_wq->metadata) + wq = fs_info->endio_meta_workers; +- func = btrfs_endio_meta_helper; +- } else { ++ else + wq = fs_info->endio_workers; +- func = btrfs_endio_helper; +- } + } + +- btrfs_init_work(&end_io_wq->work, func, end_workqueue_fn, NULL, NULL); ++ btrfs_init_work(&end_io_wq->work, end_workqueue_fn, NULL, NULL); + btrfs_queue_work(wq, &end_io_wq->work); + } + +@@ -835,8 +823,8 @@ blk_status_t btrfs_wq_submit_bio(struct btrfs_fs_info *fs_info, struct bio *bio, + async->mirror_num = mirror_num; + async->submit_bio_start = submit_bio_start; + +- btrfs_init_work(&async->work, btrfs_worker_helper, run_one_async_start, +- run_one_async_done, run_one_async_free); ++ btrfs_init_work(&async->work, run_one_async_start, run_one_async_done, ++ run_one_async_free); + + async->bio_offset = bio_offset; + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index be9dc78aa727..33c6b191ca59 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -1899,7 +1899,7 @@ static int __process_pages_contig(struct address_space *mapping, + if (page_ops & PAGE_SET_PRIVATE2) + SetPagePrivate2(pages[i]); + +- if (pages[i] == locked_page) { ++ if (locked_page && pages[i] == locked_page) { + put_page(pages[i]); + pages_locked++; + continue; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index e5758f62e8d8..0b2758961b1c 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -712,10 +712,12 @@ cleanup_and_bail_uncompressed: + * to our extent and set things up for the async work queue to run + * cow_file_range to do the normal delalloc dance. + */ +- if (page_offset(async_chunk->locked_page) >= start && +- page_offset(async_chunk->locked_page) <= end) ++ if (async_chunk->locked_page && ++ (page_offset(async_chunk->locked_page) >= start && ++ page_offset(async_chunk->locked_page)) <= end) { + __set_page_dirty_nobuffers(async_chunk->locked_page); + /* unlocked later on in the async handlers */ ++ } + + if (redirty) + extent_range_redirty_for_io(inode, start, end); +@@ -795,7 +797,7 @@ retry: + async_extent->start + + async_extent->ram_size - 1, + WB_SYNC_ALL); +- else if (ret) ++ else if (ret && async_chunk->locked_page) + unlock_page(async_chunk->locked_page); + kfree(async_extent); + cond_resched(); +@@ -1264,14 +1266,27 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page, + async_chunk[i].inode = inode; + async_chunk[i].start = start; + async_chunk[i].end = cur_end; +- async_chunk[i].locked_page = locked_page; + async_chunk[i].write_flags = write_flags; + INIT_LIST_HEAD(&async_chunk[i].extents); + +- btrfs_init_work(&async_chunk[i].work, +- btrfs_delalloc_helper, +- async_cow_start, async_cow_submit, +- async_cow_free); ++ /* ++ * The locked_page comes all the way from writepage and its ++ * the original page we were actually given. As we spread ++ * this large delalloc region across multiple async_chunk ++ * structs, only the first struct needs a pointer to locked_page ++ * ++ * This way we don't need racey decisions about who is supposed ++ * to unlock it. ++ */ ++ if (locked_page) { ++ async_chunk[i].locked_page = locked_page; ++ locked_page = NULL; ++ } else { ++ async_chunk[i].locked_page = NULL; ++ } ++ ++ btrfs_init_work(&async_chunk[i].work, async_cow_start, ++ async_cow_submit, async_cow_free); + + nr_pages = DIV_ROUND_UP(cur_end - start, PAGE_SIZE); + atomic_add(nr_pages, &fs_info->async_delalloc_pages); +@@ -1439,10 +1454,10 @@ next_slot: + disk_num_bytes = + btrfs_file_extent_disk_num_bytes(leaf, fi); + /* +- * If extent we got ends before our range starts, skip +- * to next extent ++ * If the extent we got ends before our current offset, ++ * skip to the next extent. + */ +- if (extent_end <= start) { ++ if (extent_end <= cur_offset) { + path->slots[0]++; + goto next_slot; + } +@@ -2264,8 +2279,7 @@ int btrfs_writepage_cow_fixup(struct page *page, u64 start, u64 end) + + SetPageChecked(page); + get_page(page); +- btrfs_init_work(&fixup->work, btrfs_fixup_helper, +- btrfs_writepage_fixup_worker, NULL, NULL); ++ btrfs_init_work(&fixup->work, btrfs_writepage_fixup_worker, NULL, NULL); + fixup->page = page; + btrfs_queue_work(fs_info->fixup_workers, &fixup->work); + return -EBUSY; +@@ -3258,7 +3272,6 @@ void btrfs_writepage_endio_finish_ordered(struct page *page, u64 start, + struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_ordered_extent *ordered_extent = NULL; + struct btrfs_workqueue *wq; +- btrfs_work_func_t func; + + trace_btrfs_writepage_end_io_hook(page, start, end, uptodate); + +@@ -3267,16 +3280,12 @@ void btrfs_writepage_endio_finish_ordered(struct page *page, u64 start, + end - start + 1, uptodate)) + return; + +- if (btrfs_is_free_space_inode(BTRFS_I(inode))) { ++ if (btrfs_is_free_space_inode(BTRFS_I(inode))) + wq = fs_info->endio_freespace_worker; +- func = btrfs_freespace_write_helper; +- } else { ++ else + wq = fs_info->endio_write_workers; +- func = btrfs_endio_write_helper; +- } + +- btrfs_init_work(&ordered_extent->work, func, finish_ordered_fn, NULL, +- NULL); ++ btrfs_init_work(&ordered_extent->work, finish_ordered_fn, NULL, NULL); + btrfs_queue_work(wq, &ordered_extent->work); + } + +@@ -8213,18 +8222,14 @@ static void __endio_write_update_ordered(struct inode *inode, + struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_ordered_extent *ordered = NULL; + struct btrfs_workqueue *wq; +- btrfs_work_func_t func; + u64 ordered_offset = offset; + u64 ordered_bytes = bytes; + u64 last_offset; + +- if (btrfs_is_free_space_inode(BTRFS_I(inode))) { ++ if (btrfs_is_free_space_inode(BTRFS_I(inode))) + wq = fs_info->endio_freespace_worker; +- func = btrfs_freespace_write_helper; +- } else { ++ else + wq = fs_info->endio_write_workers; +- func = btrfs_endio_write_helper; +- } + + while (ordered_offset < offset + bytes) { + last_offset = ordered_offset; +@@ -8232,9 +8237,8 @@ static void __endio_write_update_ordered(struct inode *inode, + &ordered_offset, + ordered_bytes, + uptodate)) { +- btrfs_init_work(&ordered->work, func, +- finish_ordered_fn, +- NULL, NULL); ++ btrfs_init_work(&ordered->work, finish_ordered_fn, NULL, ++ NULL); + btrfs_queue_work(wq, &ordered->work); + } + /* +@@ -10119,8 +10123,7 @@ static struct btrfs_delalloc_work *btrfs_alloc_delalloc_work(struct inode *inode + init_completion(&work->completion); + INIT_LIST_HEAD(&work->list); + work->inode = inode; +- btrfs_init_work(&work->work, btrfs_flush_delalloc_helper, +- btrfs_run_delalloc_work, NULL, NULL); ++ btrfs_init_work(&work->work, btrfs_run_delalloc_work, NULL, NULL); + + return work; + } +diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c +index 24b6c72b9a59..6240a5a1f2c0 100644 +--- a/fs/btrfs/ordered-data.c ++++ b/fs/btrfs/ordered-data.c +@@ -547,7 +547,6 @@ u64 btrfs_wait_ordered_extents(struct btrfs_root *root, u64 nr, + spin_unlock(&root->ordered_extent_lock); + + btrfs_init_work(&ordered->flush_work, +- btrfs_flush_delalloc_helper, + btrfs_run_ordered_extent_work, NULL, NULL); + list_add_tail(&ordered->work_list, &works); + btrfs_queue_work(fs_info->flush_workers, &ordered->flush_work); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 3ad151655eb8..27a903aaf43b 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3280,7 +3280,6 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, + memset(&fs_info->qgroup_rescan_work, 0, + sizeof(fs_info->qgroup_rescan_work)); + btrfs_init_work(&fs_info->qgroup_rescan_work, +- btrfs_qgroup_rescan_helper, + btrfs_qgroup_rescan_worker, NULL, NULL); + return 0; + } +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index 57a2ac721985..8f47a85944eb 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -190,7 +190,7 @@ static void scrub_parity_work(struct btrfs_work *work); + + static void start_async_work(struct btrfs_raid_bio *rbio, btrfs_func_t work_func) + { +- btrfs_init_work(&rbio->work, btrfs_rmw_helper, work_func, NULL, NULL); ++ btrfs_init_work(&rbio->work, work_func, NULL, NULL); + btrfs_queue_work(rbio->fs_info->rmw_workers, &rbio->work); + } + +@@ -1743,8 +1743,7 @@ static void btrfs_raid_unplug(struct blk_plug_cb *cb, bool from_schedule) + plug = container_of(cb, struct btrfs_plug_cb, cb); + + if (from_schedule) { +- btrfs_init_work(&plug->work, btrfs_rmw_helper, +- unplug_work, NULL, NULL); ++ btrfs_init_work(&plug->work, unplug_work, NULL, NULL); + btrfs_queue_work(plug->info->rmw_workers, + &plug->work); + return; +diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c +index dd4f9c2b7107..1feaeadc8cf5 100644 +--- a/fs/btrfs/reada.c ++++ b/fs/btrfs/reada.c +@@ -819,8 +819,7 @@ static void reada_start_machine(struct btrfs_fs_info *fs_info) + /* FIXME we cannot handle this properly right now */ + BUG(); + } +- btrfs_init_work(&rmw->work, btrfs_readahead_helper, +- reada_start_machine_worker, NULL, NULL); ++ btrfs_init_work(&rmw->work, reada_start_machine_worker, NULL, NULL); + rmw->fs_info = fs_info; + + btrfs_queue_work(fs_info->readahead_workers, &rmw->work); +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index a0770a6aee00..a7b043fd7a57 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -598,8 +598,8 @@ static noinline_for_stack struct scrub_ctx *scrub_setup_ctx( + sbio->index = i; + sbio->sctx = sctx; + sbio->page_count = 0; +- btrfs_init_work(&sbio->work, btrfs_scrub_helper, +- scrub_bio_end_io_worker, NULL, NULL); ++ btrfs_init_work(&sbio->work, scrub_bio_end_io_worker, NULL, ++ NULL); + + if (i != SCRUB_BIOS_PER_SCTX - 1) + sctx->bios[i]->next_free = i + 1; +@@ -1720,8 +1720,7 @@ static void scrub_wr_bio_end_io(struct bio *bio) + sbio->status = bio->bi_status; + sbio->bio = bio; + +- btrfs_init_work(&sbio->work, btrfs_scrubwrc_helper, +- scrub_wr_bio_end_io_worker, NULL, NULL); ++ btrfs_init_work(&sbio->work, scrub_wr_bio_end_io_worker, NULL, NULL); + btrfs_queue_work(fs_info->scrub_wr_completion_workers, &sbio->work); + } + +@@ -2203,8 +2202,7 @@ static void scrub_missing_raid56_pages(struct scrub_block *sblock) + raid56_add_scrub_pages(rbio, spage->page, spage->logical); + } + +- btrfs_init_work(&sblock->work, btrfs_scrub_helper, +- scrub_missing_raid56_worker, NULL, NULL); ++ btrfs_init_work(&sblock->work, scrub_missing_raid56_worker, NULL, NULL); + scrub_block_get(sblock); + scrub_pending_bio_inc(sctx); + raid56_submit_missing_rbio(rbio); +@@ -2742,8 +2740,8 @@ static void scrub_parity_bio_endio(struct bio *bio) + + bio_put(bio); + +- btrfs_init_work(&sparity->work, btrfs_scrubparity_helper, +- scrub_parity_bio_endio_worker, NULL, NULL); ++ btrfs_init_work(&sparity->work, scrub_parity_bio_endio_worker, NULL, ++ NULL); + btrfs_queue_work(fs_info->scrub_parity_workers, &sparity->work); + } + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index e04409f85063..d8d7b1ee83ca 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -6676,8 +6676,7 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info, + else + generate_random_uuid(dev->uuid); + +- btrfs_init_work(&dev->work, btrfs_submit_helper, +- pending_bios_fn, NULL, NULL); ++ btrfs_init_work(&dev->work, pending_bios_fn, NULL, NULL); + + return dev; + } +diff --git a/fs/buffer.c b/fs/buffer.c +index 86a38b979323..7744488f7bde 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -2994,8 +2994,6 @@ static void end_bio_bh_io_sync(struct bio *bio) + void guard_bio_eod(int op, struct bio *bio) + { + sector_t maxsector; +- struct bio_vec *bvec = bio_last_bvec_all(bio); +- unsigned truncated_bytes; + struct hd_struct *part; + + rcu_read_lock(); +@@ -3021,28 +3019,7 @@ void guard_bio_eod(int op, struct bio *bio) + if (likely((bio->bi_iter.bi_size >> 9) <= maxsector)) + return; + +- /* Uhhuh. We've got a bio that straddles the device size! */ +- truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9); +- +- /* +- * The bio contains more than one segment which spans EOD, just return +- * and let IO layer turn it into an EIO +- */ +- if (truncated_bytes > bvec->bv_len) +- return; +- +- /* Truncate the bio.. */ +- bio->bi_iter.bi_size -= truncated_bytes; +- bvec->bv_len -= truncated_bytes; +- +- /* ..and clear the end of the buffer for reads */ +- if (op == REQ_OP_READ) { +- struct bio_vec bv; +- +- mp_bvec_last_segment(bvec, &bv); +- zero_user(bv.bv_page, bv.bv_offset + bv.bv_len, +- truncated_bytes); +- } ++ bio_truncate(bio, maxsector << 9); + } + + static int submit_bh_wbc(int op, int op_flags, struct buffer_head *bh, +diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c +index 1692c0c6c23a..2faa05860a48 100644 +--- a/fs/cifs/dfs_cache.c ++++ b/fs/cifs/dfs_cache.c +@@ -1317,7 +1317,6 @@ static struct cifs_ses *find_root_ses(struct dfs_cache_vol_info *vi, + int rc; + struct dfs_info3_param ref = {0}; + char *mdata = NULL, *devname = NULL; +- bool is_smb3 = tcon->ses->server->vals->header_preamble_size == 0; + struct TCP_Server_Info *server; + struct cifs_ses *ses; + struct smb_vol vol; +@@ -1344,7 +1343,7 @@ static struct cifs_ses *find_root_ses(struct dfs_cache_vol_info *vi, + goto out; + } + +- rc = cifs_setup_volume_info(&vol, mdata, devname, is_smb3); ++ rc = cifs_setup_volume_info(&vol, mdata, devname, false); + kfree(devname); + + if (rc) { +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index df9377828e2f..ed59e4a8db59 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -163,7 +163,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr) + + spin_lock(&inode->i_lock); + /* we do not want atime to be less than mtime, it broke some apps */ +- if (timespec64_compare(&fattr->cf_atime, &fattr->cf_mtime)) ++ if (timespec64_compare(&fattr->cf_atime, &fattr->cf_mtime) < 0) + inode->i_atime = fattr->cf_mtime; + else + inode->i_atime = fattr->cf_atime; +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index c985caa2d955..e1d8cec6ba2e 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -252,7 +252,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) + if (tcon == NULL) + return 0; + +- if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL) ++ if (smb2_command == SMB2_TREE_CONNECT) + return 0; + + if (tcon->tidStatus == CifsExiting) { +@@ -426,16 +426,9 @@ fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, void *buf, + * SMB information in the SMB header. If the return code is zero, this + * function must have filled in request_buf pointer. + */ +-static int +-smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, +- void **request_buf, unsigned int *total_len) ++static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, ++ void **request_buf, unsigned int *total_len) + { +- int rc; +- +- rc = smb2_reconnect(smb2_command, tcon); +- if (rc) +- return rc; +- + /* BB eventually switch this to SMB2 specific small buf size */ + if (smb2_command == SMB2_SET_INFO) + *request_buf = cifs_buf_get(); +@@ -456,7 +449,31 @@ smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, + cifs_stats_inc(&tcon->num_smbs_sent); + } + +- return rc; ++ return 0; ++} ++ ++static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, ++ void **request_buf, unsigned int *total_len) ++{ ++ int rc; ++ ++ rc = smb2_reconnect(smb2_command, tcon); ++ if (rc) ++ return rc; ++ ++ return __smb2_plain_req_init(smb2_command, tcon, request_buf, ++ total_len); ++} ++ ++static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, ++ void **request_buf, unsigned int *total_len) ++{ ++ /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ ++ if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { ++ return __smb2_plain_req_init(SMB2_IOCTL, tcon, request_buf, ++ total_len); ++ } ++ return smb2_plain_req_init(SMB2_IOCTL, tcon, request_buf, total_len); + } + + /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ +@@ -2661,7 +2678,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst, + int rc; + char *in_data_buf; + +- rc = smb2_plain_req_init(SMB2_IOCTL, tcon, (void **) &req, &total_len); ++ rc = smb2_ioctl_req_init(opcode, tcon, (void **) &req, &total_len); + if (rc) + return rc; + +diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c +index a7ec2d3dff92..e0226b2138d6 100644 +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -1032,10 +1032,11 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, + #endif + + case FICLONE: ++ goto do_ioctl; + case FICLONERANGE: + case FIDEDUPERANGE: + case FS_IOC_FIEMAP: +- goto do_ioctl; ++ goto found_handler; + + case FIBMAP: + case FIGETBSZ: +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 74e786578c77..a60c6315a348 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -239,7 +239,7 @@ struct io_ring_ctx { + + struct user_struct *user; + +- struct cred *creds; ++ const struct cred *creds; + + struct completion ctx_done; + +@@ -3876,7 +3876,7 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p) + ctx->account_mem = account_mem; + ctx->user = user; + +- ctx->creds = prepare_creds(); ++ ctx->creds = get_current_cred(); + if (!ctx->creds) { + ret = -ENOMEM; + goto err; +diff --git a/fs/locks.c b/fs/locks.c +index 6970f55daf54..44b6da032842 100644 +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -2853,7 +2853,7 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl, + } + if (inode) { + /* userspace relies on this representation of dev_t */ +- seq_printf(f, "%d %02x:%02x:%ld ", fl_pid, ++ seq_printf(f, "%d %02x:%02x:%lu ", fl_pid, + MAJOR(inode->i_sb->s_dev), + MINOR(inode->i_sb->s_dev), inode->i_ino); + } else { +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index c65aeaa812d4..08f6eb2b73f8 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3548,12 +3548,17 @@ static bool replay_matches_cache(struct svc_rqst *rqstp, + (bool)seq->cachethis) + return false; + /* +- * If there's an error than the reply can have fewer ops than +- * the call. But if we cached a reply with *more* ops than the +- * call you're sending us now, then this new call is clearly not +- * really a replay of the old one: ++ * If there's an error then the reply can have fewer ops than ++ * the call. + */ +- if (slot->sl_opcnt < argp->opcnt) ++ if (slot->sl_opcnt < argp->opcnt && !slot->sl_status) ++ return false; ++ /* ++ * But if we cached a reply with *more* ops than the call you're ++ * sending us now, then this new call is clearly not really a ++ * replay of the old one: ++ */ ++ if (slot->sl_opcnt > argp->opcnt) + return false; + /* This is the only check explicitly called by spec: */ + if (!same_creds(&rqstp->rq_cred, &slot->sl_cred)) +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c +index 6e774c5ea13b..8a2e284ccfcd 100644 +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -3282,6 +3282,7 @@ static void ocfs2_dlm_init_debug(struct ocfs2_super *osb) + + debugfs_create_u32("locking_filter", 0600, osb->osb_debug_root, + &dlm_debug->d_filter_secs); ++ ocfs2_get_dlm_debug(dlm_debug); + } + + static void ocfs2_dlm_shutdown_debug(struct ocfs2_super *osb) +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index 8caff834f002..487ee39b438a 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -407,6 +407,17 @@ static int notrace ramoops_pstore_write(struct pstore_record *record) + + prz = cxt->dprzs[cxt->dump_write_cnt]; + ++ /* ++ * Since this is a new crash dump, we need to reset the buffer in ++ * case it still has an old dump present. Without this, the new dump ++ * will get appended, which would seriously confuse anything trying ++ * to check dump file contents. Specifically, ramoops_read_kmsg_hdr() ++ * expects to find a dump header in the beginning of buffer data, so ++ * we must to reset the buffer values, in order to ensure that the ++ * header will be written to the beginning of the buffer. ++ */ ++ persistent_ram_zap(prz); ++ + /* Build header and append record contents. */ + hlen = ramoops_write_kmsg_hdr(prz, record); + if (!hlen) +@@ -577,6 +588,7 @@ static int ramoops_init_przs(const char *name, + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, record_size, + (unsigned long long)*paddr, err); ++ kfree(label); + + while (i > 0) { + i--; +@@ -622,6 +634,7 @@ static int ramoops_init_prz(const char *name, + + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, sz, (unsigned long long)*paddr, err); ++ kfree(label); + return err; + } + +diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c +index a384a0f9ff32..234be1c4dc87 100644 +--- a/fs/ubifs/tnc_commit.c ++++ b/fs/ubifs/tnc_commit.c +@@ -212,7 +212,7 @@ static int is_idx_node_in_use(struct ubifs_info *c, union ubifs_key *key, + /** + * layout_leb_in_gaps - layout index nodes using in-the-gaps method. + * @c: UBIFS file-system description object +- * @p: return LEB number here ++ * @p: return LEB number in @c->gap_lebs[p] + * + * This function lays out new index nodes for dirty znodes using in-the-gaps + * method of TNC commit. +@@ -221,7 +221,7 @@ static int is_idx_node_in_use(struct ubifs_info *c, union ubifs_key *key, + * This function returns the number of index nodes written into the gaps, or a + * negative error code on failure. + */ +-static int layout_leb_in_gaps(struct ubifs_info *c, int *p) ++static int layout_leb_in_gaps(struct ubifs_info *c, int p) + { + struct ubifs_scan_leb *sleb; + struct ubifs_scan_node *snod; +@@ -236,7 +236,7 @@ static int layout_leb_in_gaps(struct ubifs_info *c, int *p) + * filled, however we do not check there at present. + */ + return lnum; /* Error code */ +- *p = lnum; ++ c->gap_lebs[p] = lnum; + dbg_gc("LEB %d", lnum); + /* + * Scan the index LEB. We use the generic scan for this even though +@@ -355,7 +355,7 @@ static int get_leb_cnt(struct ubifs_info *c, int cnt) + */ + static int layout_in_gaps(struct ubifs_info *c, int cnt) + { +- int err, leb_needed_cnt, written, *p; ++ int err, leb_needed_cnt, written, p = 0, old_idx_lebs, *gap_lebs; + + dbg_gc("%d znodes to write", cnt); + +@@ -364,9 +364,9 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt) + if (!c->gap_lebs) + return -ENOMEM; + +- p = c->gap_lebs; ++ old_idx_lebs = c->lst.idx_lebs; + do { +- ubifs_assert(c, p < c->gap_lebs + c->lst.idx_lebs); ++ ubifs_assert(c, p < c->lst.idx_lebs); + written = layout_leb_in_gaps(c, p); + if (written < 0) { + err = written; +@@ -392,9 +392,29 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt) + leb_needed_cnt = get_leb_cnt(c, cnt); + dbg_gc("%d znodes remaining, need %d LEBs, have %d", cnt, + leb_needed_cnt, c->ileb_cnt); ++ /* ++ * Dynamically change the size of @c->gap_lebs to prevent ++ * oob, because @c->lst.idx_lebs could be increased by ++ * function @get_idx_gc_leb (called by layout_leb_in_gaps-> ++ * ubifs_find_dirty_idx_leb) during loop. Only enlarge ++ * @c->gap_lebs when needed. ++ * ++ */ ++ if (leb_needed_cnt > c->ileb_cnt && p >= old_idx_lebs && ++ old_idx_lebs < c->lst.idx_lebs) { ++ old_idx_lebs = c->lst.idx_lebs; ++ gap_lebs = krealloc(c->gap_lebs, sizeof(int) * ++ (old_idx_lebs + 1), GFP_NOFS); ++ if (!gap_lebs) { ++ kfree(c->gap_lebs); ++ c->gap_lebs = NULL; ++ return -ENOMEM; ++ } ++ c->gap_lebs = gap_lebs; ++ } + } while (leb_needed_cnt > c->ileb_cnt); + +- *p = -1; ++ c->gap_lebs[p] = -1; + return 0; + } + +diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c +index 02469d59c787..3f76da11197c 100644 +--- a/fs/xfs/libxfs/xfs_bmap.c ++++ b/fs/xfs/libxfs/xfs_bmap.c +@@ -5300,7 +5300,7 @@ __xfs_bunmapi( + * Make sure we don't touch multiple AGF headers out of order + * in a single transaction, as that could cause AB-BA deadlocks. + */ +- if (!wasdel) { ++ if (!wasdel && !isrt) { + agno = XFS_FSB_TO_AGNO(mp, del.br_startblock); + if (prev_agno != NULLAGNUMBER && prev_agno > agno) + break; +diff --git a/fs/xfs/scrub/common.h b/fs/xfs/scrub/common.h +index 003a772cd26c..2e50d146105d 100644 +--- a/fs/xfs/scrub/common.h ++++ b/fs/xfs/scrub/common.h +@@ -14,8 +14,15 @@ + static inline bool + xchk_should_terminate( + struct xfs_scrub *sc, +- int *error) ++ int *error) + { ++ /* ++ * If preemption is disabled, we need to yield to the scheduler every ++ * few seconds so that we don't run afoul of the soft lockup watchdog ++ * or RCU stall detector. ++ */ ++ cond_resched(); ++ + if (fatal_signal_pending(current)) { + if (*error == 0) + *error = -EAGAIN; +diff --git a/include/linux/ahci_platform.h b/include/linux/ahci_platform.h +index 6782f0d45ebe..49e5383d4222 100644 +--- a/include/linux/ahci_platform.h ++++ b/include/linux/ahci_platform.h +@@ -19,6 +19,8 @@ struct ahci_host_priv; + struct platform_device; + struct scsi_host_template; + ++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv); ++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv); + int ahci_platform_enable_clks(struct ahci_host_priv *hpriv); + void ahci_platform_disable_clks(struct ahci_host_priv *hpriv); + int ahci_platform_enable_regulators(struct ahci_host_priv *hpriv); +diff --git a/include/linux/bio.h b/include/linux/bio.h +index 3cdb84cdc488..853d92ceee64 100644 +--- a/include/linux/bio.h ++++ b/include/linux/bio.h +@@ -470,6 +470,7 @@ extern struct bio *bio_copy_user_iov(struct request_queue *, + gfp_t); + extern int bio_uncopy_user(struct bio *); + void zero_fill_bio_iter(struct bio *bio, struct bvec_iter iter); ++void bio_truncate(struct bio *bio, unsigned new_size); + + static inline void zero_fill_bio(struct bio *bio) + { +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index 8fcdee1c0cf9..dad4a68fa009 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -1364,8 +1364,11 @@ static inline int dma_get_slave_caps(struct dma_chan *chan, + static inline int dmaengine_desc_set_reuse(struct dma_async_tx_descriptor *tx) + { + struct dma_slave_caps caps; ++ int ret; + +- dma_get_slave_caps(tx->chan, &caps); ++ ret = dma_get_slave_caps(tx->chan, &caps); ++ if (ret) ++ return ret; + + if (caps.descriptor_reuse) { + tx->flags |= DMA_CTRL_REUSE; +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 207e7ee764ce..fa0c3dae2094 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -1174,6 +1174,7 @@ extern unsigned int ata_do_dev_read_id(struct ata_device *dev, + struct ata_taskfile *tf, u16 *id); + extern void ata_qc_complete(struct ata_queued_cmd *qc); + extern int ata_qc_complete_multiple(struct ata_port *ap, u64 qc_active); ++extern u64 ata_qc_get_active(struct ata_port *ap); + extern void ata_scsi_simulate(struct ata_device *dev, struct scsi_cmnd *cmd); + extern int ata_std_bios_param(struct scsi_device *sdev, + struct block_device *bdev, +diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h +index f46ea71b4ffd..451efd4499cc 100644 +--- a/include/linux/memory_hotplug.h ++++ b/include/linux/memory_hotplug.h +@@ -125,8 +125,8 @@ static inline bool movable_node_is_enabled(void) + + extern void arch_remove_memory(int nid, u64 start, u64 size, + struct vmem_altmap *altmap); +-extern void __remove_pages(struct zone *zone, unsigned long start_pfn, +- unsigned long nr_pages, struct vmem_altmap *altmap); ++extern void __remove_pages(unsigned long start_pfn, unsigned long nr_pages, ++ struct vmem_altmap *altmap); + + /* reasonably generic interface to expand the physical pages */ + extern int __add_pages(int nid, unsigned long start_pfn, unsigned long nr_pages, +@@ -345,6 +345,9 @@ extern int add_memory(int nid, u64 start, u64 size); + extern int add_memory_resource(int nid, struct resource *resource); + extern void move_pfn_range_to_zone(struct zone *zone, unsigned long start_pfn, + unsigned long nr_pages, struct vmem_altmap *altmap); ++extern void remove_pfn_range_from_zone(struct zone *zone, ++ unsigned long start_pfn, ++ unsigned long nr_pages); + extern bool is_memblock_offlined(struct memory_block *mem); + extern int sparse_add_section(int nid, unsigned long pfn, + unsigned long nr_pages, struct vmem_altmap *altmap); +diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h +index 10f81629b9ce..6d0d70f3219c 100644 +--- a/include/linux/nvme-fc-driver.h ++++ b/include/linux/nvme-fc-driver.h +@@ -270,6 +270,8 @@ struct nvme_fc_remote_port { + * + * Host/Initiator Transport Entrypoints/Parameters: + * ++ * @module: The LLDD module using the interface ++ * + * @localport_delete: The LLDD initiates deletion of a localport via + * nvme_fc_deregister_localport(). However, the teardown is + * asynchronous. This routine is called upon the completion of the +@@ -383,6 +385,8 @@ struct nvme_fc_remote_port { + * Value is Mandatory. Allowed to be zero. + */ + struct nvme_fc_port_template { ++ struct module *module; ++ + /* initiator-based functions */ + void (*localport_delete)(struct nvme_fc_local_port *); + void (*remoteport_delete)(struct nvme_fc_remote_port *); +diff --git a/include/linux/pci.h b/include/linux/pci.h +index f9088c89a534..be529d311122 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -2310,9 +2310,11 @@ struct irq_domain *pci_host_bridge_acpi_msi_domain(struct pci_bus *bus); + + void + pci_msi_register_fwnode_provider(struct fwnode_handle *(*fn)(struct device *)); ++bool pci_pr3_present(struct pci_dev *pdev); + #else + static inline struct irq_domain * + pci_host_bridge_acpi_msi_domain(struct pci_bus *bus) { return NULL; } ++static inline bool pci_pr3_present(struct pci_dev *pdev) { return false; } + #endif + + #ifdef CONFIG_EEH +diff --git a/include/linux/regulator/ab8500.h b/include/linux/regulator/ab8500.h +index 7cf8f797e13a..505e94a6e3e8 100644 +--- a/include/linux/regulator/ab8500.h ++++ b/include/linux/regulator/ab8500.h +@@ -37,7 +37,6 @@ enum ab8505_regulator_id { + AB8505_LDO_AUX6, + AB8505_LDO_INTCORE, + AB8505_LDO_ADC, +- AB8505_LDO_USB, + AB8505_LDO_AUDIO, + AB8505_LDO_ANAMIC1, + AB8505_LDO_ANAMIC2, +diff --git a/include/net/neighbour.h b/include/net/neighbour.h +index 5e679c8dae0b..8ec77bfdc1a4 100644 +--- a/include/net/neighbour.h ++++ b/include/net/neighbour.h +@@ -467,7 +467,7 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb + + do { + seq = read_seqbegin(&hh->hh_lock); +- hh_len = hh->hh_len; ++ hh_len = READ_ONCE(hh->hh_len); + if (likely(hh_len <= HH_DATA_MOD)) { + hh_alen = HH_DATA_MOD; + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 47e61956168d..32e418dba133 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -149,8 +149,8 @@ static inline bool qdisc_is_percpu_stats(const struct Qdisc *q) + static inline bool qdisc_is_empty(const struct Qdisc *qdisc) + { + if (qdisc_is_percpu_stats(qdisc)) +- return qdisc->empty; +- return !qdisc->q.qlen; ++ return READ_ONCE(qdisc->empty); ++ return !READ_ONCE(qdisc->q.qlen); + } + + static inline bool qdisc_run_begin(struct Qdisc *qdisc) +@@ -158,7 +158,7 @@ static inline bool qdisc_run_begin(struct Qdisc *qdisc) + if (qdisc->flags & TCQ_F_NOLOCK) { + if (!spin_trylock(&qdisc->seqlock)) + return false; +- qdisc->empty = false; ++ WRITE_ONCE(qdisc->empty, false); + } else if (qdisc_is_running(qdisc)) { + return false; + } +diff --git a/include/net/sock.h b/include/net/sock.h +index e09e2886a836..6c5a3809483e 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2589,9 +2589,9 @@ static inline int sk_get_rmem0(const struct sock *sk, const struct proto *proto) + */ + static inline void sk_pacing_shift_update(struct sock *sk, int val) + { +- if (!sk || !sk_fullsock(sk) || sk->sk_pacing_shift == val) ++ if (!sk || !sk_fullsock(sk) || READ_ONCE(sk->sk_pacing_shift) == val) + return; +- sk->sk_pacing_shift = val; ++ WRITE_ONCE(sk->sk_pacing_shift, val); + } + + /* if a socket is bound to a device, check that the given device +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 9e7cee5307e0..5c51021775af 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -852,7 +852,8 @@ static const int caller_saved[CALLER_SAVED_REGS] = { + BPF_REG_0, BPF_REG_1, BPF_REG_2, BPF_REG_3, BPF_REG_4, BPF_REG_5 + }; + +-static void __mark_reg_not_init(struct bpf_reg_state *reg); ++static void __mark_reg_not_init(const struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg); + + /* Mark the unknown part of a register (variable offset or scalar value) as + * known to have the value @imm. +@@ -890,7 +891,7 @@ static void mark_reg_known_zero(struct bpf_verifier_env *env, + verbose(env, "mark_reg_known_zero(regs, %u)\n", regno); + /* Something bad happened, let's kill all regs */ + for (regno = 0; regno < MAX_BPF_REG; regno++) +- __mark_reg_not_init(regs + regno); ++ __mark_reg_not_init(env, regs + regno); + return; + } + __mark_reg_known_zero(regs + regno); +@@ -999,7 +1000,8 @@ static void __mark_reg_unbounded(struct bpf_reg_state *reg) + } + + /* Mark a register as having a completely unknown (scalar) value. */ +-static void __mark_reg_unknown(struct bpf_reg_state *reg) ++static void __mark_reg_unknown(const struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg) + { + /* + * Clear type, id, off, and union(map_ptr, range) and +@@ -1009,6 +1011,8 @@ static void __mark_reg_unknown(struct bpf_reg_state *reg) + reg->type = SCALAR_VALUE; + reg->var_off = tnum_unknown; + reg->frameno = 0; ++ reg->precise = env->subprog_cnt > 1 || !env->allow_ptr_leaks ? ++ true : false; + __mark_reg_unbounded(reg); + } + +@@ -1019,19 +1023,16 @@ static void mark_reg_unknown(struct bpf_verifier_env *env, + verbose(env, "mark_reg_unknown(regs, %u)\n", regno); + /* Something bad happened, let's kill all regs except FP */ + for (regno = 0; regno < BPF_REG_FP; regno++) +- __mark_reg_not_init(regs + regno); ++ __mark_reg_not_init(env, regs + regno); + return; + } +- regs += regno; +- __mark_reg_unknown(regs); +- /* constant backtracking is enabled for root without bpf2bpf calls */ +- regs->precise = env->subprog_cnt > 1 || !env->allow_ptr_leaks ? +- true : false; ++ __mark_reg_unknown(env, regs + regno); + } + +-static void __mark_reg_not_init(struct bpf_reg_state *reg) ++static void __mark_reg_not_init(const struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg) + { +- __mark_reg_unknown(reg); ++ __mark_reg_unknown(env, reg); + reg->type = NOT_INIT; + } + +@@ -1042,10 +1043,10 @@ static void mark_reg_not_init(struct bpf_verifier_env *env, + verbose(env, "mark_reg_not_init(regs, %u)\n", regno); + /* Something bad happened, let's kill all regs except FP */ + for (regno = 0; regno < BPF_REG_FP; regno++) +- __mark_reg_not_init(regs + regno); ++ __mark_reg_not_init(env, regs + regno); + return; + } +- __mark_reg_not_init(regs + regno); ++ __mark_reg_not_init(env, regs + regno); + } + + #define DEF_NOT_SUBREG (0) +@@ -3066,7 +3067,7 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, + } + if (state->stack[spi].slot_type[0] == STACK_SPILL && + state->stack[spi].spilled_ptr.type == SCALAR_VALUE) { +- __mark_reg_unknown(&state->stack[spi].spilled_ptr); ++ __mark_reg_unknown(env, &state->stack[spi].spilled_ptr); + for (j = 0; j < BPF_REG_SIZE; j++) + state->stack[spi].slot_type[j] = STACK_MISC; + goto mark; +@@ -3706,7 +3707,7 @@ static void __clear_all_pkt_pointers(struct bpf_verifier_env *env, + if (!reg) + continue; + if (reg_is_pkt_pointer_any(reg)) +- __mark_reg_unknown(reg); ++ __mark_reg_unknown(env, reg); + } + } + +@@ -3734,7 +3735,7 @@ static void release_reg_references(struct bpf_verifier_env *env, + if (!reg) + continue; + if (reg->ref_obj_id == ref_obj_id) +- __mark_reg_unknown(reg); ++ __mark_reg_unknown(env, reg); + } + } + +@@ -4357,7 +4358,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, + /* Taint dst register if offset had invalid bounds derived from + * e.g. dead branches. + */ +- __mark_reg_unknown(dst_reg); ++ __mark_reg_unknown(env, dst_reg); + return 0; + } + +@@ -4609,13 +4610,13 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, + /* Taint dst register if offset had invalid bounds derived from + * e.g. dead branches. + */ +- __mark_reg_unknown(dst_reg); ++ __mark_reg_unknown(env, dst_reg); + return 0; + } + + if (!src_known && + opcode != BPF_ADD && opcode != BPF_SUB && opcode != BPF_AND) { +- __mark_reg_unknown(dst_reg); ++ __mark_reg_unknown(env, dst_reg); + return 0; + } + +@@ -6746,7 +6747,7 @@ static void clean_func_state(struct bpf_verifier_env *env, + /* since the register is unused, clear its state + * to make further comparison simpler + */ +- __mark_reg_not_init(&st->regs[i]); ++ __mark_reg_not_init(env, &st->regs[i]); + } + + for (i = 0; i < st->allocated_stack / BPF_REG_SIZE; i++) { +@@ -6754,7 +6755,7 @@ static void clean_func_state(struct bpf_verifier_env *env, + /* liveness must not touch this stack slot anymore */ + st->stack[i].spilled_ptr.live |= REG_LIVE_DONE; + if (!(live & REG_LIVE_READ)) { +- __mark_reg_not_init(&st->stack[i].spilled_ptr); ++ __mark_reg_not_init(env, &st->stack[i].spilled_ptr); + for (j = 0; j < BPF_REG_SIZE; j++) + st->stack[i].slot_type[j] = STACK_INVALID; + } +diff --git a/kernel/cred.c b/kernel/cred.c +index c0a4c12d38b2..9ed51b70ed80 100644 +--- a/kernel/cred.c ++++ b/kernel/cred.c +@@ -223,7 +223,7 @@ struct cred *cred_alloc_blank(void) + new->magic = CRED_MAGIC; + #endif + +- if (security_cred_alloc_blank(new, GFP_KERNEL) < 0) ++ if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0) + goto error; + + return new; +@@ -282,7 +282,7 @@ struct cred *prepare_creds(void) + new->security = NULL; + #endif + +- if (security_prepare_creds(new, old, GFP_KERNEL) < 0) ++ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) + goto error; + validate_creds(new); + return new; +@@ -715,7 +715,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon) + #ifdef CONFIG_SECURITY + new->security = NULL; + #endif +- if (security_prepare_creds(new, old, GFP_KERNEL) < 0) ++ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) + goto error; + + put_cred(old); +diff --git a/kernel/exit.c b/kernel/exit.c +index d351fd09e739..22dfaac9e48c 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -517,10 +517,6 @@ static struct task_struct *find_child_reaper(struct task_struct *father, + } + + write_unlock_irq(&tasklist_lock); +- if (unlikely(pid_ns == &init_pid_ns)) { +- panic("Attempted to kill init! exitcode=0x%08x\n", +- father->signal->group_exit_code ?: father->exit_code); +- } + + list_for_each_entry_safe(p, n, dead, ptrace_entry) { + list_del_init(&p->ptrace_entry); +@@ -766,6 +762,14 @@ void __noreturn do_exit(long code) + acct_update_integrals(tsk); + group_dead = atomic_dec_and_test(&tsk->signal->live); + if (group_dead) { ++ /* ++ * If the last thread of global init has exited, panic ++ * immediately to get a useable coredump. ++ */ ++ if (unlikely(is_global_init(tsk))) ++ panic("Attempted to kill init! exitcode=0x%08x\n", ++ tsk->signal->group_exit_code ?: (int)code); ++ + #ifdef CONFIG_POSIX_TIMERS + hrtimer_cancel(&tsk->signal->real_timer); + exit_itimers(tsk->signal); +diff --git a/kernel/module.c b/kernel/module.c +index ff2d7359a418..cb09a5f37a5f 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1033,6 +1033,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, + strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module)); + + free_module(mod); ++ /* someone could wait for the module in add_unformed_module() */ ++ wake_up_all(&module_wq); + return 0; + out: + mutex_unlock(&module_mutex); +diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c +index 83105874f255..26b9168321e7 100644 +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -734,8 +734,15 @@ zone_found: + * We have found the zone. Now walk the radix tree to find the leaf node + * for our PFN. + */ ++ ++ /* ++ * If the zone we wish to scan is the the current zone and the ++ * pfn falls into the current node then we do not need to walk ++ * the tree. ++ */ + node = bm->cur.node; +- if (((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn) ++ if (zone == bm->cur.zone && ++ ((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn) + goto node_found; + + node = zone->rtree; +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index dba52a7db5e8..614a557a0814 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -1015,6 +1015,13 @@ static long seccomp_notify_recv(struct seccomp_filter *filter, + struct seccomp_notif unotif; + ssize_t ret; + ++ /* Verify that we're not given garbage to keep struct extensible. */ ++ ret = check_zeroed_user(buf, sizeof(unotif)); ++ if (ret < 0) ++ return ret; ++ if (!ret) ++ return -EINVAL; ++ + memset(&unotif, 0, sizeof(unotif)); + + ret = down_interruptible(&filter->notif->request); +diff --git a/kernel/taskstats.c b/kernel/taskstats.c +index 13a0f2e6ebc2..e2ac0e37c4ae 100644 +--- a/kernel/taskstats.c ++++ b/kernel/taskstats.c +@@ -554,25 +554,33 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info) + static struct taskstats *taskstats_tgid_alloc(struct task_struct *tsk) + { + struct signal_struct *sig = tsk->signal; +- struct taskstats *stats; ++ struct taskstats *stats_new, *stats; + +- if (sig->stats || thread_group_empty(tsk)) +- goto ret; ++ /* Pairs with smp_store_release() below. */ ++ stats = smp_load_acquire(&sig->stats); ++ if (stats || thread_group_empty(tsk)) ++ return stats; + + /* No problem if kmem_cache_zalloc() fails */ +- stats = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL); ++ stats_new = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL); + + spin_lock_irq(&tsk->sighand->siglock); +- if (!sig->stats) { +- sig->stats = stats; +- stats = NULL; ++ stats = sig->stats; ++ if (!stats) { ++ /* ++ * Pairs with smp_store_release() above and order the ++ * kmem_cache_zalloc(). ++ */ ++ smp_store_release(&sig->stats, stats_new); ++ stats = stats_new; ++ stats_new = NULL; + } + spin_unlock_irq(&tsk->sighand->siglock); + +- if (stats) +- kmem_cache_free(taskstats_cache, stats); +-ret: +- return sig->stats; ++ if (stats_new) ++ kmem_cache_free(taskstats_cache, stats_new); ++ ++ return stats; + } + + /* Send pid data out on exit */ +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index f296d89be757..0708a41cfe2d 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -524,8 +524,7 @@ static int function_stat_show(struct seq_file *m, void *v) + } + + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +- avg = rec->time; +- do_div(avg, rec->counter); ++ avg = div64_ul(rec->time, rec->counter); + if (tracing_thresh && (avg < tracing_thresh)) + goto out; + #endif +@@ -551,7 +550,8 @@ static int function_stat_show(struct seq_file *m, void *v) + * Divide only 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide 1000 again. + */ +- do_div(stddev, rec->counter * (rec->counter - 1) * 1000); ++ stddev = div64_ul(stddev, ++ rec->counter * (rec->counter - 1) * 1000); + } + + trace_seq_init(&s); +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 2fa72419bbd7..d8bd9b1d8bce 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4590,6 +4590,10 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) + + int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) + { ++ if ((mask == TRACE_ITER_RECORD_TGID) || ++ (mask == TRACE_ITER_RECORD_CMD)) ++ lockdep_assert_held(&event_mutex); ++ + /* do nothing if flag is already set */ + if (!!(tr->trace_flags & mask) == !!enabled) + return 0; +@@ -4657,6 +4661,7 @@ static int trace_set_options(struct trace_array *tr, char *option) + + cmp += len; + ++ mutex_lock(&event_mutex); + mutex_lock(&trace_types_lock); + + ret = match_string(trace_options, -1, cmp); +@@ -4667,6 +4672,7 @@ static int trace_set_options(struct trace_array *tr, char *option) + ret = set_tracer_flag(tr, 1 << ret, !neg); + + mutex_unlock(&trace_types_lock); ++ mutex_unlock(&event_mutex); + + /* + * If the first trailing whitespace is replaced with '\0' by strstrip, +@@ -7972,9 +7978,11 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, + if (val != 0 && val != 1) + return -EINVAL; + ++ mutex_lock(&event_mutex); + mutex_lock(&trace_types_lock); + ret = set_tracer_flag(tr, 1 << index, val); + mutex_unlock(&trace_types_lock); ++ mutex_unlock(&event_mutex); + + if (ret < 0) + return ret; +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index fba87d10f0c1..995061bb2dec 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -320,7 +320,8 @@ void trace_event_enable_cmd_record(bool enable) + struct trace_event_file *file; + struct trace_array *tr; + +- mutex_lock(&event_mutex); ++ lockdep_assert_held(&event_mutex); ++ + do_for_each_event_file(tr, file) { + + if (!(file->flags & EVENT_FILE_FL_ENABLED)) +@@ -334,7 +335,6 @@ void trace_event_enable_cmd_record(bool enable) + clear_bit(EVENT_FILE_FL_RECORDED_CMD_BIT, &file->flags); + } + } while_for_each_event_file(); +- mutex_unlock(&event_mutex); + } + + void trace_event_enable_tgid_record(bool enable) +@@ -342,7 +342,8 @@ void trace_event_enable_tgid_record(bool enable) + struct trace_event_file *file; + struct trace_array *tr; + +- mutex_lock(&event_mutex); ++ lockdep_assert_held(&event_mutex); ++ + do_for_each_event_file(tr, file) { + if (!(file->flags & EVENT_FILE_FL_ENABLED)) + continue; +@@ -356,7 +357,6 @@ void trace_event_enable_tgid_record(bool enable) + &file->flags); + } + } while_for_each_event_file(); +- mutex_unlock(&event_mutex); + } + + static int __ftrace_event_enable_disable(struct trace_event_file *file, +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index c9a74f82b14a..bf44f6bbd0c3 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1662,7 +1662,7 @@ static int process_system_preds(struct trace_subsystem_dir *dir, + parse_error(pe, FILT_ERR_BAD_SUBSYS_FILTER, 0); + return -EINVAL; + fail_mem: +- kfree(filter); ++ __free_filter(filter); + /* If any call succeeded, we still need to sync */ + if (!fail) + tracepoint_synchronize_unregister(); +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 7482a1466ebf..c2783915600c 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -911,7 +911,26 @@ static notrace void trace_event_raw_event_synth(void *__data, + strscpy(str_field, str_val, STR_VAR_LEN_MAX); + n_u64 += STR_VAR_LEN_MAX / sizeof(u64); + } else { +- entry->fields[n_u64] = var_ref_vals[var_ref_idx + i]; ++ struct synth_field *field = event->fields[i]; ++ u64 val = var_ref_vals[var_ref_idx + i]; ++ ++ switch (field->size) { ++ case 1: ++ *(u8 *)&entry->fields[n_u64] = (u8)val; ++ break; ++ ++ case 2: ++ *(u16 *)&entry->fields[n_u64] = (u16)val; ++ break; ++ ++ case 4: ++ *(u32 *)&entry->fields[n_u64] = (u32)val; ++ break; ++ ++ default: ++ entry->fields[n_u64] = val; ++ break; ++ } + n_u64++; + } + } +diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c +index 9a1c22310323..9e31bfc818ff 100644 +--- a/kernel/trace/tracing_map.c ++++ b/kernel/trace/tracing_map.c +@@ -148,8 +148,8 @@ static int tracing_map_cmp_atomic64(void *val_a, void *val_b) + #define DEFINE_TRACING_MAP_CMP_FN(type) \ + static int tracing_map_cmp_##type(void *val_a, void *val_b) \ + { \ +- type a = *(type *)val_a; \ +- type b = *(type *)val_b; \ ++ type a = (type)(*(u64 *)val_a); \ ++ type b = (type)(*(u64 *)val_b); \ + \ + return (a > b) ? 1 : ((a < b) ? -1 : 0); \ + } +diff --git a/lib/ubsan.c b/lib/ubsan.c +index 0c4681118fcd..f007a406f89c 100644 +--- a/lib/ubsan.c ++++ b/lib/ubsan.c +@@ -140,25 +140,21 @@ static void val_to_string(char *str, size_t size, struct type_descriptor *type, + } + } + +-static DEFINE_SPINLOCK(report_lock); +- +-static void ubsan_prologue(struct source_location *location, +- unsigned long *flags) ++static void ubsan_prologue(struct source_location *location) + { + current->in_ubsan++; +- spin_lock_irqsave(&report_lock, *flags); + + pr_err("========================================" + "========================================\n"); + print_source_location("UBSAN: Undefined behaviour in", location); + } + +-static void ubsan_epilogue(unsigned long *flags) ++static void ubsan_epilogue(void) + { + dump_stack(); + pr_err("========================================" + "========================================\n"); +- spin_unlock_irqrestore(&report_lock, *flags); ++ + current->in_ubsan--; + } + +@@ -167,14 +163,13 @@ static void handle_overflow(struct overflow_data *data, void *lhs, + { + + struct type_descriptor *type = data->type; +- unsigned long flags; + char lhs_val_str[VALUE_LENGTH]; + char rhs_val_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs); + val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs); +@@ -186,7 +181,7 @@ static void handle_overflow(struct overflow_data *data, void *lhs, + rhs_val_str, + type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + + void __ubsan_handle_add_overflow(struct overflow_data *data, +@@ -214,20 +209,19 @@ EXPORT_SYMBOL(__ubsan_handle_mul_overflow); + void __ubsan_handle_negate_overflow(struct overflow_data *data, + void *old_val) + { +- unsigned long flags; + char old_val_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val); + + pr_err("negation of %s cannot be represented in type %s:\n", + old_val_str, data->type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + EXPORT_SYMBOL(__ubsan_handle_negate_overflow); + +@@ -235,13 +229,12 @@ EXPORT_SYMBOL(__ubsan_handle_negate_overflow); + void __ubsan_handle_divrem_overflow(struct overflow_data *data, + void *lhs, void *rhs) + { +- unsigned long flags; + char rhs_val_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs); + +@@ -251,58 +244,52 @@ void __ubsan_handle_divrem_overflow(struct overflow_data *data, + else + pr_err("division by zero\n"); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + EXPORT_SYMBOL(__ubsan_handle_divrem_overflow); + + static void handle_null_ptr_deref(struct type_mismatch_data_common *data) + { +- unsigned long flags; +- + if (suppress_report(data->location)) + return; + +- ubsan_prologue(data->location, &flags); ++ ubsan_prologue(data->location); + + pr_err("%s null pointer of type %s\n", + type_check_kinds[data->type_check_kind], + data->type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + + static void handle_misaligned_access(struct type_mismatch_data_common *data, + unsigned long ptr) + { +- unsigned long flags; +- + if (suppress_report(data->location)) + return; + +- ubsan_prologue(data->location, &flags); ++ ubsan_prologue(data->location); + + pr_err("%s misaligned address %p for type %s\n", + type_check_kinds[data->type_check_kind], + (void *)ptr, data->type->type_name); + pr_err("which requires %ld byte alignment\n", data->alignment); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + + static void handle_object_size_mismatch(struct type_mismatch_data_common *data, + unsigned long ptr) + { +- unsigned long flags; +- + if (suppress_report(data->location)) + return; + +- ubsan_prologue(data->location, &flags); ++ ubsan_prologue(data->location); + pr_err("%s address %p with insufficient space\n", + type_check_kinds[data->type_check_kind], + (void *) ptr); + pr_err("for an object of type %s\n", data->type->type_name); +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + + static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data, +@@ -351,25 +338,23 @@ EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1); + + void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) + { +- unsigned long flags; + char index_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(index_str, sizeof(index_str), data->index_type, index); + pr_err("index %s is out of range for type %s\n", index_str, + data->array_type->type_name); +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + EXPORT_SYMBOL(__ubsan_handle_out_of_bounds); + + void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + void *lhs, void *rhs) + { +- unsigned long flags; + struct type_descriptor *rhs_type = data->rhs_type; + struct type_descriptor *lhs_type = data->lhs_type; + char rhs_str[VALUE_LENGTH]; +@@ -379,7 +364,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + if (suppress_report(&data->location)) + goto out; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs); + val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs); +@@ -402,7 +387,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + lhs_str, rhs_str, + lhs_type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + out: + user_access_restore(ua_flags); + } +@@ -411,11 +396,9 @@ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); + + void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) + { +- unsigned long flags; +- +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + pr_err("calling __builtin_unreachable()\n"); +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + panic("can't return from __builtin_unreachable()"); + } + EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable); +@@ -423,19 +406,18 @@ EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable); + void __ubsan_handle_load_invalid_value(struct invalid_value_data *data, + void *val) + { +- unsigned long flags; + char val_str[VALUE_LENGTH]; + + if (suppress_report(&data->location)) + return; + +- ubsan_prologue(&data->location, &flags); ++ ubsan_prologue(&data->location); + + val_to_string(val_str, sizeof(val_str), data->type, val); + + pr_err("load of value %s is not a valid value for type %s\n", + val_str, data->type->type_name); + +- ubsan_epilogue(&flags); ++ ubsan_epilogue(); + } + EXPORT_SYMBOL(__ubsan_handle_load_invalid_value); +diff --git a/mm/filemap.c b/mm/filemap.c +index 85b7d087eb45..1f5731768222 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -2329,27 +2329,6 @@ EXPORT_SYMBOL(generic_file_read_iter); + + #ifdef CONFIG_MMU + #define MMAP_LOTSAMISS (100) +-static struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf, +- struct file *fpin) +-{ +- int flags = vmf->flags; +- +- if (fpin) +- return fpin; +- +- /* +- * FAULT_FLAG_RETRY_NOWAIT means we don't want to wait on page locks or +- * anything, so we only pin the file and drop the mmap_sem if only +- * FAULT_FLAG_ALLOW_RETRY is set. +- */ +- if ((flags & (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT)) == +- FAULT_FLAG_ALLOW_RETRY) { +- fpin = get_file(vmf->vma->vm_file); +- up_read(&vmf->vma->vm_mm->mmap_sem); +- } +- return fpin; +-} +- + /* + * lock_page_maybe_drop_mmap - lock the page, possibly dropping the mmap_sem + * @vmf - the vm_fault for this fault. +diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c +index 7dd602d7f8db..ad9d5b1c4473 100644 +--- a/mm/gup_benchmark.c ++++ b/mm/gup_benchmark.c +@@ -26,6 +26,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd, + unsigned long i, nr_pages, addr, next; + int nr; + struct page **pages; ++ int ret = 0; + + if (gup->size > ULONG_MAX) + return -EINVAL; +@@ -63,7 +64,9 @@ static int __gup_benchmark_ioctl(unsigned int cmd, + NULL); + break; + default: +- return -1; ++ kvfree(pages); ++ ret = -EINVAL; ++ goto out; + } + + if (nr <= 0) +@@ -85,7 +88,8 @@ static int __gup_benchmark_ioctl(unsigned int cmd, + gup->put_delta_usec = ktime_us_delta(end_time, start_time); + + kvfree(pages); +- return 0; ++out: ++ return ret; + } + + static long gup_benchmark_ioctl(struct file *filep, unsigned int cmd, +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index b45a95363a84..e0afd582ca01 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1255,7 +1256,7 @@ static inline void ClearPageHugeTemporary(struct page *page) + page[2].mapping = NULL; + } + +-void free_huge_page(struct page *page) ++static void __free_huge_page(struct page *page) + { + /* + * Can't pass hstate in here because it is called from the +@@ -1318,6 +1319,54 @@ void free_huge_page(struct page *page) + spin_unlock(&hugetlb_lock); + } + ++/* ++ * As free_huge_page() can be called from a non-task context, we have ++ * to defer the actual freeing in a workqueue to prevent potential ++ * hugetlb_lock deadlock. ++ * ++ * free_hpage_workfn() locklessly retrieves the linked list of pages to ++ * be freed and frees them one-by-one. As the page->mapping pointer is ++ * going to be cleared in __free_huge_page() anyway, it is reused as the ++ * llist_node structure of a lockless linked list of huge pages to be freed. ++ */ ++static LLIST_HEAD(hpage_freelist); ++ ++static void free_hpage_workfn(struct work_struct *work) ++{ ++ struct llist_node *node; ++ struct page *page; ++ ++ node = llist_del_all(&hpage_freelist); ++ ++ while (node) { ++ page = container_of((struct address_space **)node, ++ struct page, mapping); ++ node = node->next; ++ __free_huge_page(page); ++ } ++} ++static DECLARE_WORK(free_hpage_work, free_hpage_workfn); ++ ++void free_huge_page(struct page *page) ++{ ++ /* ++ * Defer freeing if in non-task context to avoid hugetlb_lock deadlock. ++ */ ++ if (!in_task()) { ++ /* ++ * Only call schedule_work() if hpage_freelist is previously ++ * empty. Otherwise, schedule_work() had been called but the ++ * workfn hasn't retrieved the list yet. ++ */ ++ if (llist_add((struct llist_node *)&page->mapping, ++ &hpage_freelist)) ++ schedule_work(&free_hpage_work); ++ return; ++ } ++ ++ __free_huge_page(page); ++} ++ + static void prep_new_huge_page(struct hstate *h, struct page *page, int nid) + { + INIT_LIST_HEAD(&page->lru); +diff --git a/mm/internal.h b/mm/internal.h +index 0d5f720c75ab..7dd7fbb577a9 100644 +--- a/mm/internal.h ++++ b/mm/internal.h +@@ -362,6 +362,27 @@ vma_address(struct page *page, struct vm_area_struct *vma) + return max(start, vma->vm_start); + } + ++static inline struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf, ++ struct file *fpin) ++{ ++ int flags = vmf->flags; ++ ++ if (fpin) ++ return fpin; ++ ++ /* ++ * FAULT_FLAG_RETRY_NOWAIT means we don't want to wait on page locks or ++ * anything, so we only pin the file and drop the mmap_sem if only ++ * FAULT_FLAG_ALLOW_RETRY is set. ++ */ ++ if ((flags & (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT)) == ++ FAULT_FLAG_ALLOW_RETRY) { ++ fpin = get_file(vmf->vma->vm_file); ++ up_read(&vmf->vma->vm_mm->mmap_sem); ++ } ++ return fpin; ++} ++ + #else /* !CONFIG_MMU */ + static inline void clear_page_mlock(struct page *page) { } + static inline void mlock_vma_page(struct page *page) { } +diff --git a/mm/memory.c b/mm/memory.c +index b1ca51a079f2..cb7c940cf800 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -2227,10 +2227,11 @@ static vm_fault_t do_page_mkwrite(struct vm_fault *vmf) + * + * The function expects the page to be locked and unlocks it. + */ +-static void fault_dirty_shared_page(struct vm_area_struct *vma, +- struct page *page) ++static vm_fault_t fault_dirty_shared_page(struct vm_fault *vmf) + { ++ struct vm_area_struct *vma = vmf->vma; + struct address_space *mapping; ++ struct page *page = vmf->page; + bool dirtied; + bool page_mkwrite = vma->vm_ops && vma->vm_ops->page_mkwrite; + +@@ -2245,16 +2246,30 @@ static void fault_dirty_shared_page(struct vm_area_struct *vma, + mapping = page_rmapping(page); + unlock_page(page); + ++ if (!page_mkwrite) ++ file_update_time(vma->vm_file); ++ ++ /* ++ * Throttle page dirtying rate down to writeback speed. ++ * ++ * mapping may be NULL here because some device drivers do not ++ * set page.mapping but still dirty their pages ++ * ++ * Drop the mmap_sem before waiting on IO, if we can. The file ++ * is pinning the mapping, as per above. ++ */ + if ((dirtied || page_mkwrite) && mapping) { +- /* +- * Some device drivers do not set page.mapping +- * but still dirty their pages +- */ ++ struct file *fpin; ++ ++ fpin = maybe_unlock_mmap_for_io(vmf, NULL); + balance_dirty_pages_ratelimited(mapping); ++ if (fpin) { ++ fput(fpin); ++ return VM_FAULT_RETRY; ++ } + } + +- if (!page_mkwrite) +- file_update_time(vma->vm_file); ++ return 0; + } + + /* +@@ -2497,6 +2512,7 @@ static vm_fault_t wp_page_shared(struct vm_fault *vmf) + __releases(vmf->ptl) + { + struct vm_area_struct *vma = vmf->vma; ++ vm_fault_t ret = VM_FAULT_WRITE; + + get_page(vmf->page); + +@@ -2520,10 +2536,10 @@ static vm_fault_t wp_page_shared(struct vm_fault *vmf) + wp_page_reuse(vmf); + lock_page(vmf->page); + } +- fault_dirty_shared_page(vma, vmf->page); ++ ret |= fault_dirty_shared_page(vmf); + put_page(vmf->page); + +- return VM_FAULT_WRITE; ++ return ret; + } + + /* +@@ -3567,7 +3583,7 @@ static vm_fault_t do_shared_fault(struct vm_fault *vmf) + return ret; + } + +- fault_dirty_shared_page(vma, vmf->page); ++ ret |= fault_dirty_shared_page(vmf); + return ret; + } + +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index f307bd82d750..fab540685279 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -465,8 +465,9 @@ static void update_pgdat_span(struct pglist_data *pgdat) + pgdat->node_spanned_pages = node_end_pfn - node_start_pfn; + } + +-static void __remove_zone(struct zone *zone, unsigned long start_pfn, +- unsigned long nr_pages) ++void __ref remove_pfn_range_from_zone(struct zone *zone, ++ unsigned long start_pfn, ++ unsigned long nr_pages) + { + struct pglist_data *pgdat = zone->zone_pgdat; + unsigned long flags; +@@ -481,28 +482,30 @@ static void __remove_zone(struct zone *zone, unsigned long start_pfn, + return; + #endif + ++ clear_zone_contiguous(zone); ++ + pgdat_resize_lock(zone->zone_pgdat, &flags); + shrink_zone_span(zone, start_pfn, start_pfn + nr_pages); + update_pgdat_span(pgdat); + pgdat_resize_unlock(zone->zone_pgdat, &flags); ++ ++ set_zone_contiguous(zone); + } + +-static void __remove_section(struct zone *zone, unsigned long pfn, +- unsigned long nr_pages, unsigned long map_offset, +- struct vmem_altmap *altmap) ++static void __remove_section(unsigned long pfn, unsigned long nr_pages, ++ unsigned long map_offset, ++ struct vmem_altmap *altmap) + { + struct mem_section *ms = __nr_to_section(pfn_to_section_nr(pfn)); + + if (WARN_ON_ONCE(!valid_section(ms))) + return; + +- __remove_zone(zone, pfn, nr_pages); + sparse_remove_section(ms, pfn, nr_pages, map_offset, altmap); + } + + /** +- * __remove_pages() - remove sections of pages from a zone +- * @zone: zone from which pages need to be removed ++ * __remove_pages() - remove sections of pages + * @pfn: starting pageframe (must be aligned to start of a section) + * @nr_pages: number of pages to remove (must be multiple of section size) + * @altmap: alternative device page map or %NULL if default memmap is used +@@ -512,16 +515,14 @@ static void __remove_section(struct zone *zone, unsigned long pfn, + * sure that pages are marked reserved and zones are adjust properly by + * calling offline_pages(). + */ +-void __remove_pages(struct zone *zone, unsigned long pfn, +- unsigned long nr_pages, struct vmem_altmap *altmap) ++void __remove_pages(unsigned long pfn, unsigned long nr_pages, ++ struct vmem_altmap *altmap) + { + unsigned long map_offset = 0; + unsigned long nr, start_sec, end_sec; + + map_offset = vmem_altmap_offset(altmap); + +- clear_zone_contiguous(zone); +- + if (check_pfn_span(pfn, nr_pages, "remove")) + return; + +@@ -533,13 +534,11 @@ void __remove_pages(struct zone *zone, unsigned long pfn, + cond_resched(); + pfns = min(nr_pages, PAGES_PER_SECTION + - (pfn & ~PAGE_SECTION_MASK)); +- __remove_section(zone, pfn, pfns, map_offset, altmap); ++ __remove_section(pfn, pfns, map_offset, altmap); + pfn += pfns; + nr_pages -= pfns; + map_offset = 0; + } +- +- set_zone_contiguous(zone); + } + + int set_online_page_callback(online_page_callback_t callback) +@@ -867,6 +866,7 @@ failed_addition: + (unsigned long long) pfn << PAGE_SHIFT, + (((unsigned long long) pfn + nr_pages) << PAGE_SHIFT) - 1); + memory_notify(MEM_CANCEL_ONLINE, &arg); ++ remove_pfn_range_from_zone(zone, pfn, nr_pages); + mem_hotplug_done(); + return ret; + } +@@ -1602,6 +1602,7 @@ static int __ref __offline_pages(unsigned long start_pfn, + writeback_set_ratelimit(); + + memory_notify(MEM_OFFLINE, &arg); ++ remove_pfn_range_from_zone(zone, start_pfn, nr_pages); + mem_hotplug_done(); + return 0; + +diff --git a/mm/memremap.c b/mm/memremap.c +index 03ccbdfeb697..c51c6bd2fe34 100644 +--- a/mm/memremap.c ++++ b/mm/memremap.c +@@ -120,7 +120,7 @@ void memunmap_pages(struct dev_pagemap *pgmap) + + mem_hotplug_begin(); + if (pgmap->type == MEMORY_DEVICE_PRIVATE) { +- __remove_pages(page_zone(first_page), PHYS_PFN(res->start), ++ __remove_pages(PHYS_PFN(res->start), + PHYS_PFN(resource_size(res)), NULL); + } else { + arch_remove_memory(nid, res->start, resource_size(res), +diff --git a/mm/migrate.c b/mm/migrate.c +index 4fe45d1428c8..45d3303e0022 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -1516,9 +1516,11 @@ static int do_move_pages_to_node(struct mm_struct *mm, + /* + * Resolves the given address to a struct page, isolates it from the LRU and + * puts it to the given pagelist. +- * Returns -errno if the page cannot be found/isolated or 0 when it has been +- * queued or the page doesn't need to be migrated because it is already on +- * the target node ++ * Returns: ++ * errno - if the page cannot be found/isolated ++ * 0 - when it doesn't have to be migrated because it is already on the ++ * target node ++ * 1 - when it has been queued + */ + static int add_page_for_migration(struct mm_struct *mm, unsigned long addr, + int node, struct list_head *pagelist, bool migrate_all) +@@ -1557,7 +1559,7 @@ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr, + if (PageHuge(page)) { + if (PageHead(page)) { + isolate_huge_page(page, pagelist); +- err = 0; ++ err = 1; + } + } else { + struct page *head; +@@ -1567,7 +1569,7 @@ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr, + if (err) + goto out_putpage; + +- err = 0; ++ err = 1; + list_add_tail(&head->lru, pagelist); + mod_node_page_state(page_pgdat(head), + NR_ISOLATED_ANON + page_is_file_cache(head), +@@ -1644,8 +1646,17 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes, + */ + err = add_page_for_migration(mm, addr, current_node, + &pagelist, flags & MPOL_MF_MOVE_ALL); +- if (!err) ++ ++ if (!err) { ++ /* The page is already on the target node */ ++ err = store_status(status, i, current_node, 1); ++ if (err) ++ goto out_flush; + continue; ++ } else if (err > 0) { ++ /* The page is successfully queued for migration */ ++ continue; ++ } + + err = store_status(status, i, err, 1); + if (err) +diff --git a/mm/mmap.c b/mm/mmap.c +index a7d8c84d19b7..4390dbea4aa5 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -90,12 +90,6 @@ static void unmap_region(struct mm_struct *mm, + * MAP_PRIVATE r: (no) no r: (yes) yes r: (no) yes r: (no) yes + * w: (no) no w: (no) no w: (copy) copy w: (no) no + * x: (no) no x: (no) yes x: (no) yes x: (yes) yes +- * +- * On arm64, PROT_EXEC has the following behaviour for both MAP_SHARED and +- * MAP_PRIVATE: +- * r: (no) no +- * w: (no) no +- * x: (yes) yes + */ + pgprot_t protection_map[16] __ro_after_init = { + __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111, +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index 71e3acea7817..d58c481b3df8 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -890,7 +890,7 @@ static void __oom_kill_process(struct task_struct *victim, const char *message) + K(get_mm_counter(mm, MM_FILEPAGES)), + K(get_mm_counter(mm, MM_SHMEMPAGES)), + from_kuid(&init_user_ns, task_uid(victim)), +- mm_pgtables_bytes(mm), victim->signal->oom_score_adj); ++ mm_pgtables_bytes(mm) >> 10, victim->signal->oom_score_adj); + task_unlock(victim); + + /* +diff --git a/mm/shmem.c b/mm/shmem.c +index 7a22e3e03d11..6074714fdbd4 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2022,16 +2022,14 @@ static vm_fault_t shmem_fault(struct vm_fault *vmf) + shmem_falloc->waitq && + vmf->pgoff >= shmem_falloc->start && + vmf->pgoff < shmem_falloc->next) { ++ struct file *fpin; + wait_queue_head_t *shmem_falloc_waitq; + DEFINE_WAIT_FUNC(shmem_fault_wait, synchronous_wake_function); + + ret = VM_FAULT_NOPAGE; +- if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) && +- !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) { +- /* It's polite to up mmap_sem if we can */ +- up_read(&vma->vm_mm->mmap_sem); ++ fpin = maybe_unlock_mmap_for_io(vmf, NULL); ++ if (fpin) + ret = VM_FAULT_RETRY; +- } + + shmem_falloc_waitq = shmem_falloc->waitq; + prepare_to_wait(shmem_falloc_waitq, &shmem_fault_wait, +@@ -2049,6 +2047,9 @@ static vm_fault_t shmem_fault(struct vm_fault *vmf) + spin_lock(&inode->i_lock); + finish_wait(shmem_falloc_waitq, &shmem_fault_wait); + spin_unlock(&inode->i_lock); ++ ++ if (fpin) ++ fput(fpin); + return ret; + } + spin_unlock(&inode->i_lock); +diff --git a/mm/sparse.c b/mm/sparse.c +index f6891c1992b1..c2c01b6330af 100644 +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -647,7 +647,7 @@ void offline_mem_sections(unsigned long start_pfn, unsigned long end_pfn) + #endif + + #ifdef CONFIG_SPARSEMEM_VMEMMAP +-static struct page *populate_section_memmap(unsigned long pfn, ++static struct page * __meminit populate_section_memmap(unsigned long pfn, + unsigned long nr_pages, int nid, struct vmem_altmap *altmap) + { + return __populate_section_memmap(pfn, nr_pages, nid, altmap); +@@ -669,7 +669,7 @@ static void free_map_bootmem(struct page *memmap) + vmemmap_free(start, end, NULL); + } + #else +-struct page *populate_section_memmap(unsigned long pfn, ++struct page * __meminit populate_section_memmap(unsigned long pfn, + unsigned long nr_pages, int nid, struct vmem_altmap *altmap) + { + struct page *page, *ret; +diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c +index 2b2b9aae8a3c..22d17ecfe7df 100644 +--- a/mm/zsmalloc.c ++++ b/mm/zsmalloc.c +@@ -2069,6 +2069,11 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage, + zs_pool_dec_isolated(pool); + } + ++ if (page_zone(newpage) != page_zone(page)) { ++ dec_zone_page_state(page, NR_ZSPAGES); ++ inc_zone_page_state(newpage, NR_ZSPAGES); ++ } ++ + reset_page(page); + put_page(page); + page = newpage; +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 7ff92dd4c53c..87691404d0c6 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1176,8 +1176,10 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, + if (!conn) + return ERR_PTR(-ENOMEM); + +- if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) ++ if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) { ++ hci_conn_del(conn); + return ERR_PTR(-EBUSY); ++ } + + conn->state = BT_CONNECT; + set_bit(HCI_CONN_SCANNING, &conn->flags); +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index da7fdbdf9c41..a845786258a0 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4936,10 +4936,8 @@ void __l2cap_physical_cfm(struct l2cap_chan *chan, int result) + BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d", + chan, result, local_amp_id, remote_amp_id); + +- if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) { +- l2cap_chan_unlock(chan); ++ if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) + return; +- } + + if (chan->state != BT_CONNECTED) { + l2cap_do_create(chan, result, local_amp_id, remote_amp_id); +diff --git a/net/core/dev.c b/net/core/dev.c +index 046307445ece..3e11c6bb4dd6 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3386,7 +3386,7 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q, + qdisc_calculate_pkt_len(skb, q); + + if (q->flags & TCQ_F_NOLOCK) { +- if ((q->flags & TCQ_F_CAN_BYPASS) && q->empty && ++ if ((q->flags & TCQ_F_CAN_BYPASS) && READ_ONCE(q->empty) && + qdisc_run_begin(q)) { + if (unlikely(test_bit(__QDISC_STATE_DEACTIVATED, + &q->state))) { +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 08ebc3ac5343..f2452496ad9f 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -1194,7 +1194,7 @@ static void neigh_update_hhs(struct neighbour *neigh) + + if (update) { + hh = &neigh->hh; +- if (hh->hh_len) { ++ if (READ_ONCE(hh->hh_len)) { + write_seqlock_bh(&hh->hh_lock); + update(hh, neigh->dev, neigh->ha); + write_sequnlock_bh(&hh->hh_lock); +@@ -1473,7 +1473,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb) + struct net_device *dev = neigh->dev; + unsigned int seq; + +- if (dev->header_ops->cache && !neigh->hh.hh_len) ++ if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len)) + neigh_hh_init(neigh); + + do { +diff --git a/net/core/sock.c b/net/core/sock.c +index ac78a570e43a..b4d1112174c1 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2918,7 +2918,7 @@ void sock_init_data(struct socket *sock, struct sock *sk) + + sk->sk_max_pacing_rate = ~0UL; + sk->sk_pacing_rate = ~0UL; +- sk->sk_pacing_shift = 10; ++ WRITE_ONCE(sk->sk_pacing_shift, 10); + sk->sk_incoming_cpu = -1; + + sk_rx_queue_clear(sk); +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index eb29e5adc84d..9f9e00ba3ad7 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -288,6 +288,7 @@ static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write, + return ret; + } + ++# ifdef CONFIG_HAVE_EBPF_JIT + static int + proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, +@@ -298,6 +299,7 @@ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write, + + return proc_dointvec_minmax(table, write, buffer, lenp, ppos); + } ++# endif /* CONFIG_HAVE_EBPF_JIT */ + + static int + proc_dolongvec_minmax_bpf_restricted(struct ctl_table *table, int write, +diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c +index 17374afee28f..9040fe55e0f5 100644 +--- a/net/ethernet/eth.c ++++ b/net/ethernet/eth.c +@@ -244,7 +244,12 @@ int eth_header_cache(const struct neighbour *neigh, struct hh_cache *hh, __be16 + eth->h_proto = type; + memcpy(eth->h_source, dev->dev_addr, ETH_ALEN); + memcpy(eth->h_dest, neigh->ha, ETH_ALEN); +- hh->hh_len = ETH_HLEN; ++ ++ /* Pairs with READ_ONCE() in neigh_resolve_output(), ++ * neigh_hh_output() and neigh_update_hhs(). ++ */ ++ smp_store_release(&hh->hh_len, ETH_HLEN); ++ + return 0; + } + EXPORT_SYMBOL(eth_header_cache); +diff --git a/net/hsr/hsr_debugfs.c b/net/hsr/hsr_debugfs.c +index 94447974a3c0..6618a9d8e58e 100644 +--- a/net/hsr/hsr_debugfs.c ++++ b/net/hsr/hsr_debugfs.c +@@ -64,7 +64,6 @@ hsr_node_table_open(struct inode *inode, struct file *filp) + } + + static const struct file_operations hsr_fops = { +- .owner = THIS_MODULE, + .open = hsr_node_table_open, + .read = seq_read, + .llseek = seq_lseek, +@@ -78,15 +77,14 @@ static const struct file_operations hsr_fops = { + * When debugfs is configured this routine sets up the node_table file per + * hsr device for dumping the node_table entries + */ +-int hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev) ++void hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev) + { +- int rc = -1; + struct dentry *de = NULL; + + de = debugfs_create_dir(hsr_dev->name, NULL); +- if (!de) { ++ if (IS_ERR(de)) { + pr_err("Cannot create hsr debugfs root\n"); +- return rc; ++ return; + } + + priv->node_tbl_root = de; +@@ -94,13 +92,13 @@ int hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev) + de = debugfs_create_file("node_table", S_IFREG | 0444, + priv->node_tbl_root, priv, + &hsr_fops); +- if (!de) { ++ if (IS_ERR(de)) { + pr_err("Cannot create hsr node_table directory\n"); +- return rc; ++ debugfs_remove(priv->node_tbl_root); ++ priv->node_tbl_root = NULL; ++ return; + } + priv->node_tbl_file = de; +- +- return 0; + } + + /* hsr_debugfs_term - Tear down debugfs intrastructure +diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c +index b01e1bae4ddc..62c03f0d0079 100644 +--- a/net/hsr/hsr_device.c ++++ b/net/hsr/hsr_device.c +@@ -368,7 +368,7 @@ static void hsr_dev_destroy(struct net_device *hsr_dev) + del_timer_sync(&hsr->prune_timer); + del_timer_sync(&hsr->announce_timer); + +- hsr_del_self_node(&hsr->self_node_db); ++ hsr_del_self_node(hsr); + hsr_del_nodes(&hsr->node_db); + } + +@@ -440,11 +440,12 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], + INIT_LIST_HEAD(&hsr->ports); + INIT_LIST_HEAD(&hsr->node_db); + INIT_LIST_HEAD(&hsr->self_node_db); ++ spin_lock_init(&hsr->list_lock); + + ether_addr_copy(hsr_dev->dev_addr, slave[0]->dev_addr); + + /* Make sure we recognize frames from ourselves in hsr_rcv() */ +- res = hsr_create_self_node(&hsr->self_node_db, hsr_dev->dev_addr, ++ res = hsr_create_self_node(hsr, hsr_dev->dev_addr, + slave[1]->dev_addr); + if (res < 0) + return res; +@@ -477,31 +478,32 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], + + res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER); + if (res) +- goto err_add_port; ++ goto err_add_master; + + res = register_netdevice(hsr_dev); + if (res) +- goto fail; ++ goto err_unregister; + + res = hsr_add_port(hsr, slave[0], HSR_PT_SLAVE_A); + if (res) +- goto fail; ++ goto err_add_slaves; ++ + res = hsr_add_port(hsr, slave[1], HSR_PT_SLAVE_B); + if (res) +- goto fail; ++ goto err_add_slaves; + ++ hsr_debugfs_init(hsr, hsr_dev); + mod_timer(&hsr->prune_timer, jiffies + msecs_to_jiffies(PRUNE_PERIOD)); +- res = hsr_debugfs_init(hsr, hsr_dev); +- if (res) +- goto fail; + + return 0; + +-fail: ++err_add_slaves: ++ unregister_netdevice(hsr_dev); ++err_unregister: + list_for_each_entry_safe(port, tmp, &hsr->ports, port_list) + hsr_del_port(port); +-err_add_port: +- hsr_del_self_node(&hsr->self_node_db); ++err_add_master: ++ hsr_del_self_node(hsr); + + return res; + } +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index 292be446007b..27dc65d7de67 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -75,10 +75,11 @@ static struct hsr_node *find_node_by_addr_A(struct list_head *node_db, + /* Helper for device init; the self_node_db is used in hsr_rcv() to recognize + * frames from self that's been looped over the HSR ring. + */ +-int hsr_create_self_node(struct list_head *self_node_db, ++int hsr_create_self_node(struct hsr_priv *hsr, + unsigned char addr_a[ETH_ALEN], + unsigned char addr_b[ETH_ALEN]) + { ++ struct list_head *self_node_db = &hsr->self_node_db; + struct hsr_node *node, *oldnode; + + node = kmalloc(sizeof(*node), GFP_KERNEL); +@@ -88,33 +89,33 @@ int hsr_create_self_node(struct list_head *self_node_db, + ether_addr_copy(node->macaddress_A, addr_a); + ether_addr_copy(node->macaddress_B, addr_b); + +- rcu_read_lock(); ++ spin_lock_bh(&hsr->list_lock); + oldnode = list_first_or_null_rcu(self_node_db, + struct hsr_node, mac_list); + if (oldnode) { + list_replace_rcu(&oldnode->mac_list, &node->mac_list); +- rcu_read_unlock(); +- synchronize_rcu(); +- kfree(oldnode); ++ spin_unlock_bh(&hsr->list_lock); ++ kfree_rcu(oldnode, rcu_head); + } else { +- rcu_read_unlock(); + list_add_tail_rcu(&node->mac_list, self_node_db); ++ spin_unlock_bh(&hsr->list_lock); + } + + return 0; + } + +-void hsr_del_self_node(struct list_head *self_node_db) ++void hsr_del_self_node(struct hsr_priv *hsr) + { ++ struct list_head *self_node_db = &hsr->self_node_db; + struct hsr_node *node; + +- rcu_read_lock(); ++ spin_lock_bh(&hsr->list_lock); + node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list); +- rcu_read_unlock(); + if (node) { + list_del_rcu(&node->mac_list); +- kfree(node); ++ kfree_rcu(node, rcu_head); + } ++ spin_unlock_bh(&hsr->list_lock); + } + + void hsr_del_nodes(struct list_head *node_db) +@@ -130,30 +131,43 @@ void hsr_del_nodes(struct list_head *node_db) + * seq_out is used to initialize filtering of outgoing duplicate frames + * originating from the newly added node. + */ +-struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[], +- u16 seq_out) ++static struct hsr_node *hsr_add_node(struct hsr_priv *hsr, ++ struct list_head *node_db, ++ unsigned char addr[], ++ u16 seq_out) + { +- struct hsr_node *node; ++ struct hsr_node *new_node, *node; + unsigned long now; + int i; + +- node = kzalloc(sizeof(*node), GFP_ATOMIC); +- if (!node) ++ new_node = kzalloc(sizeof(*new_node), GFP_ATOMIC); ++ if (!new_node) + return NULL; + +- ether_addr_copy(node->macaddress_A, addr); ++ ether_addr_copy(new_node->macaddress_A, addr); + + /* We are only interested in time diffs here, so use current jiffies + * as initialization. (0 could trigger an spurious ring error warning). + */ + now = jiffies; + for (i = 0; i < HSR_PT_PORTS; i++) +- node->time_in[i] = now; ++ new_node->time_in[i] = now; + for (i = 0; i < HSR_PT_PORTS; i++) +- node->seq_out[i] = seq_out; +- +- list_add_tail_rcu(&node->mac_list, node_db); ++ new_node->seq_out[i] = seq_out; + ++ spin_lock_bh(&hsr->list_lock); ++ list_for_each_entry_rcu(node, node_db, mac_list) { ++ if (ether_addr_equal(node->macaddress_A, addr)) ++ goto out; ++ if (ether_addr_equal(node->macaddress_B, addr)) ++ goto out; ++ } ++ list_add_tail_rcu(&new_node->mac_list, node_db); ++ spin_unlock_bh(&hsr->list_lock); ++ return new_node; ++out: ++ spin_unlock_bh(&hsr->list_lock); ++ kfree(new_node); + return node; + } + +@@ -163,6 +177,7 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, + bool is_sup) + { + struct list_head *node_db = &port->hsr->node_db; ++ struct hsr_priv *hsr = port->hsr; + struct hsr_node *node; + struct ethhdr *ethhdr; + u16 seq_out; +@@ -196,7 +211,7 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, + seq_out = HSR_SEQNR_START; + } + +- return hsr_add_node(node_db, ethhdr->h_source, seq_out); ++ return hsr_add_node(hsr, node_db, ethhdr->h_source, seq_out); + } + + /* Use the Supervision frame's info about an eventual macaddress_B for merging +@@ -206,10 +221,11 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, + void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr, + struct hsr_port *port_rcv) + { +- struct ethhdr *ethhdr; +- struct hsr_node *node_real; ++ struct hsr_priv *hsr = port_rcv->hsr; + struct hsr_sup_payload *hsr_sp; ++ struct hsr_node *node_real; + struct list_head *node_db; ++ struct ethhdr *ethhdr; + int i; + + ethhdr = (struct ethhdr *)skb_mac_header(skb); +@@ -231,7 +247,7 @@ void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr, + node_real = find_node_by_addr_A(node_db, hsr_sp->macaddress_A); + if (!node_real) + /* No frame received from AddrA of this node yet */ +- node_real = hsr_add_node(node_db, hsr_sp->macaddress_A, ++ node_real = hsr_add_node(hsr, node_db, hsr_sp->macaddress_A, + HSR_SEQNR_START - 1); + if (!node_real) + goto done; /* No mem */ +@@ -252,7 +268,9 @@ void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr, + } + node_real->addr_B_port = port_rcv->type; + ++ spin_lock_bh(&hsr->list_lock); + list_del_rcu(&node_curr->mac_list); ++ spin_unlock_bh(&hsr->list_lock); + kfree_rcu(node_curr, rcu_head); + + done: +@@ -368,12 +386,13 @@ void hsr_prune_nodes(struct timer_list *t) + { + struct hsr_priv *hsr = from_timer(hsr, t, prune_timer); + struct hsr_node *node; ++ struct hsr_node *tmp; + struct hsr_port *port; + unsigned long timestamp; + unsigned long time_a, time_b; + +- rcu_read_lock(); +- list_for_each_entry_rcu(node, &hsr->node_db, mac_list) { ++ spin_lock_bh(&hsr->list_lock); ++ list_for_each_entry_safe(node, tmp, &hsr->node_db, mac_list) { + /* Don't prune own node. Neither time_in[HSR_PT_SLAVE_A] + * nor time_in[HSR_PT_SLAVE_B], will ever be updated for + * the master port. Thus the master node will be repeatedly +@@ -421,7 +440,7 @@ void hsr_prune_nodes(struct timer_list *t) + kfree_rcu(node, rcu_head); + } + } +- rcu_read_unlock(); ++ spin_unlock_bh(&hsr->list_lock); + + /* Restart timer */ + mod_timer(&hsr->prune_timer, +diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h +index 89a3ce38151d..0f0fa12b4329 100644 +--- a/net/hsr/hsr_framereg.h ++++ b/net/hsr/hsr_framereg.h +@@ -12,10 +12,8 @@ + + struct hsr_node; + +-void hsr_del_self_node(struct list_head *self_node_db); ++void hsr_del_self_node(struct hsr_priv *hsr); + void hsr_del_nodes(struct list_head *node_db); +-struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[], +- u16 seq_out); + struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, + bool is_sup); + void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr, +@@ -33,7 +31,7 @@ int hsr_register_frame_out(struct hsr_port *port, struct hsr_node *node, + + void hsr_prune_nodes(struct timer_list *t); + +-int hsr_create_self_node(struct list_head *self_node_db, ++int hsr_create_self_node(struct hsr_priv *hsr, + unsigned char addr_a[ETH_ALEN], + unsigned char addr_b[ETH_ALEN]); + +diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c +index b9988a662ee1..6deb8fa8d5c8 100644 +--- a/net/hsr/hsr_main.c ++++ b/net/hsr/hsr_main.c +@@ -64,7 +64,7 @@ static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event, + + /* Make sure we recognize frames from ourselves in hsr_rcv() */ + port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_B); +- res = hsr_create_self_node(&hsr->self_node_db, ++ res = hsr_create_self_node(hsr, + master->dev->dev_addr, + port ? + port->dev->dev_addr : +diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h +index 96fac696a1e1..9ec38e33b8b1 100644 +--- a/net/hsr/hsr_main.h ++++ b/net/hsr/hsr_main.h +@@ -160,8 +160,9 @@ struct hsr_priv { + int announce_count; + u16 sequence_nr; + u16 sup_sequence_nr; /* For HSRv1 separate seq_nr for supervision */ +- u8 prot_version; /* Indicate if HSRv0 or HSRv1. */ +- spinlock_t seqnr_lock; /* locking for sequence_nr */ ++ u8 prot_version; /* Indicate if HSRv0 or HSRv1. */ ++ spinlock_t seqnr_lock; /* locking for sequence_nr */ ++ spinlock_t list_lock; /* locking for node list */ + unsigned char sup_multicast_addr[ETH_ALEN]; + #ifdef CONFIG_DEBUG_FS + struct dentry *node_tbl_root; +@@ -184,15 +185,12 @@ static inline u16 hsr_get_skb_sequence_nr(struct sk_buff *skb) + } + + #if IS_ENABLED(CONFIG_DEBUG_FS) +-int hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev); ++void hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev); + void hsr_debugfs_term(struct hsr_priv *priv); + #else +-static inline int hsr_debugfs_init(struct hsr_priv *priv, +- struct net_device *hsr_dev) +-{ +- return 0; +-} +- ++static inline void hsr_debugfs_init(struct hsr_priv *priv, ++ struct net_device *hsr_dev) ++{} + static inline void hsr_debugfs_term(struct hsr_priv *priv) + {} + #endif +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index d8876f0e9672..e537a4b6531b 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1958,8 +1958,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock, + struct sk_buff *skb, *last; + u32 urg_hole = 0; + struct scm_timestamping_internal tss; +- bool has_tss = false; +- bool has_cmsg; ++ int cmsg_flags; + + if (unlikely(flags & MSG_ERRQUEUE)) + return inet_recv_error(sk, msg, len, addr_len); +@@ -1974,7 +1973,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock, + if (sk->sk_state == TCP_LISTEN) + goto out; + +- has_cmsg = tp->recvmsg_inq; ++ cmsg_flags = tp->recvmsg_inq ? 1 : 0; + timeo = sock_rcvtimeo(sk, nonblock); + + /* Urgent data needs to be handled specially. */ +@@ -2157,8 +2156,7 @@ skip_copy: + + if (TCP_SKB_CB(skb)->has_rxtstamp) { + tcp_update_recv_tstamps(skb, &tss); +- has_tss = true; +- has_cmsg = true; ++ cmsg_flags |= 2; + } + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) + goto found_fin_ok; +@@ -2183,10 +2181,10 @@ found_fin_ok: + + release_sock(sk); + +- if (has_cmsg) { +- if (has_tss) ++ if (cmsg_flags) { ++ if (cmsg_flags & 2) + tcp_recv_timestamp(msg, sk, &tss); +- if (tp->recvmsg_inq) { ++ if (cmsg_flags & 1) { + inq = tcp_inq_hint(sk); + put_cmsg(msg, SOL_TCP, TCP_CM_INQ, sizeof(inq), &inq); + } +diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c +index 32772d6ded4e..a6545ef0d27b 100644 +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -306,7 +306,8 @@ static u32 bbr_tso_segs_goal(struct sock *sk) + /* Sort of tcp_tso_autosize() but ignoring + * driver provided sk_gso_max_size. + */ +- bytes = min_t(unsigned long, sk->sk_pacing_rate >> sk->sk_pacing_shift, ++ bytes = min_t(unsigned long, ++ sk->sk_pacing_rate >> READ_ONCE(sk->sk_pacing_shift), + GSO_MAX_SIZE - 1 - MAX_TCP_HEADER); + segs = max_t(u32, bytes / tp->mss_cache, bbr_min_tso_segs(sk)); + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 0269584e9cf7..e4ba915c4bb5 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1728,7 +1728,7 @@ static u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now, + u32 bytes, segs; + + bytes = min_t(unsigned long, +- sk->sk_pacing_rate >> sk->sk_pacing_shift, ++ sk->sk_pacing_rate >> READ_ONCE(sk->sk_pacing_shift), + sk->sk_gso_max_size - 1 - MAX_TCP_HEADER); + + /* Goal is to send at least one packet per ms, +@@ -2263,7 +2263,7 @@ static bool tcp_small_queue_check(struct sock *sk, const struct sk_buff *skb, + + limit = max_t(unsigned long, + 2 * skb->truesize, +- sk->sk_pacing_rate >> sk->sk_pacing_shift); ++ sk->sk_pacing_rate >> READ_ONCE(sk->sk_pacing_shift)); + if (sk->sk_pacing_status == SK_PACING_NONE) + limit = min_t(unsigned long, limit, + sock_net(sk)->ipv4.sysctl_tcp_limit_output_bytes); +diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c +index a2b58de82600..f8f52ff99cfb 100644 +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -189,7 +189,7 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, + goto err; + } + +- if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) { ++ if (skb_dst(skb) && !skb_dst_force(skb)) { + status = -ENETDOWN; + goto err; + } +diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c +index f92a82c73880..95980154ef02 100644 +--- a/net/netfilter/nft_tproxy.c ++++ b/net/netfilter/nft_tproxy.c +@@ -50,7 +50,7 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr, + taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr); + + if (priv->sreg_port) +- tport = regs->data[priv->sreg_port]; ++ tport = nft_reg_load16(®s->data[priv->sreg_port]); + if (!tport) + tport = hp->dest; + +@@ -117,7 +117,7 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr, + taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr); + + if (priv->sreg_port) +- tport = regs->data[priv->sreg_port]; ++ tport = nft_reg_load16(®s->data[priv->sreg_port]); + if (!tport) + tport = hp->dest; + +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 8769b4b8807d..7c3c5fdb82a9 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -657,7 +657,7 @@ static struct sk_buff *pfifo_fast_dequeue(struct Qdisc *qdisc) + if (likely(skb)) { + qdisc_update_stats_at_dequeue(qdisc, skb); + } else { +- qdisc->empty = true; ++ WRITE_ONCE(qdisc->empty, true); + } + + return skb; +diff --git a/net/socket.c b/net/socket.c +index d7a106028f0e..ca8de9e1582d 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -955,7 +955,7 @@ static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to) + .msg_iocb = iocb}; + ssize_t res; + +- if (file->f_flags & O_NONBLOCK) ++ if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT)) + msg.msg_flags = MSG_DONTWAIT; + + if (iocb->ki_pos != 0) +@@ -980,7 +980,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from) + if (iocb->ki_pos != 0) + return -ESPIPE; + +- if (file->f_flags & O_NONBLOCK) ++ if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT)) + msg.msg_flags = MSG_DONTWAIT; + + if (sock->type == SOCK_SEQPACKET) +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index a349094f6fb7..f740cb51802a 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -53,9 +53,6 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) + h->last_refresh = now; + } + +-static inline int cache_is_valid(struct cache_head *h); +-static void cache_fresh_locked(struct cache_head *head, time_t expiry, +- struct cache_detail *detail); + static void cache_fresh_unlocked(struct cache_head *head, + struct cache_detail *detail); + +@@ -105,9 +102,6 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail, + if (cache_is_expired(detail, tmp)) { + hlist_del_init_rcu(&tmp->cache_list); + detail->entries --; +- if (cache_is_valid(tmp) == -EAGAIN) +- set_bit(CACHE_NEGATIVE, &tmp->flags); +- cache_fresh_locked(tmp, 0, detail); + freeme = tmp; + break; + } +diff --git a/samples/seccomp/user-trap.c b/samples/seccomp/user-trap.c +index 6d0125ca8af7..20291ec6489f 100644 +--- a/samples/seccomp/user-trap.c ++++ b/samples/seccomp/user-trap.c +@@ -298,14 +298,14 @@ int main(void) + req = malloc(sizes.seccomp_notif); + if (!req) + goto out_close; +- memset(req, 0, sizeof(*req)); + + resp = malloc(sizes.seccomp_notif_resp); + if (!resp) + goto out_req; +- memset(resp, 0, sizeof(*resp)); ++ memset(resp, 0, sizes.seccomp_notif_resp); + + while (1) { ++ memset(req, 0, sizes.seccomp_notif); + if (ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, req)) { + perror("ioctl recv"); + goto out_resp; +diff --git a/samples/trace_printk/trace-printk.c b/samples/trace_printk/trace-printk.c +index 7affc3b50b61..cfc159580263 100644 +--- a/samples/trace_printk/trace-printk.c ++++ b/samples/trace_printk/trace-printk.c +@@ -36,6 +36,7 @@ static int __init trace_printk_init(void) + + /* Kick off printing in irq context */ + irq_work_queue(&irqwork); ++ irq_work_sync(&irqwork); + + trace_printk("This is a %s that will use trace_bprintk()\n", + "static string"); +diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig +index d33de0b9f4f5..e3569543bdac 100644 +--- a/scripts/gcc-plugins/Kconfig ++++ b/scripts/gcc-plugins/Kconfig +@@ -14,8 +14,8 @@ config HAVE_GCC_PLUGINS + An arch should select this symbol if it supports building with + GCC plugins. + +-config GCC_PLUGINS +- bool ++menuconfig GCC_PLUGINS ++ bool "GCC plugins" + depends on HAVE_GCC_PLUGINS + depends on PLUGIN_HOSTCC != "" + default y +@@ -25,8 +25,7 @@ config GCC_PLUGINS + + See Documentation/core-api/gcc-plugins.rst for details. + +-menu "GCC plugins" +- depends on GCC_PLUGINS ++if GCC_PLUGINS + + config GCC_PLUGIN_CYC_COMPLEXITY + bool "Compute the cyclomatic complexity of a function" if EXPERT +@@ -113,4 +112,4 @@ config GCC_PLUGIN_ARM_SSP_PER_TASK + bool + depends on GCC_PLUGINS && ARM + +-endmenu ++endif +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index 45d13b6462aa..90d21675c3ad 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -593,7 +593,7 @@ static __poll_t ns_revision_poll(struct file *file, poll_table *pt) + + void __aa_bump_ns_revision(struct aa_ns *ns) + { +- ns->revision++; ++ WRITE_ONCE(ns->revision, ns->revision + 1); + wake_up_interruptible(&ns->wait); + } + +diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c +index 9e0492795267..039ca71872ce 100644 +--- a/security/apparmor/domain.c ++++ b/security/apparmor/domain.c +@@ -317,6 +317,7 @@ static int aa_xattrs_match(const struct linux_binprm *bprm, + + if (!bprm || !profile->xattr_count) + return 0; ++ might_sleep(); + + /* transition from exec match to xattr set */ + state = aa_dfa_null_transition(profile->xmatch, state); +@@ -361,10 +362,11 @@ out: + } + + /** +- * __attach_match_ - find an attachment match ++ * find_attach - do attachment search for unconfined processes + * @bprm - binprm structure of transitioning task +- * @name - to match against (NOT NULL) ++ * @ns: the current namespace (NOT NULL) + * @head - profile list to walk (NOT NULL) ++ * @name - to match against (NOT NULL) + * @info - info message if there was an error (NOT NULL) + * + * Do a linear search on the profiles in the list. There is a matching +@@ -374,12 +376,11 @@ out: + * + * Requires: @head not be shared or have appropriate locks held + * +- * Returns: profile or NULL if no match found ++ * Returns: label or NULL if no match found + */ +-static struct aa_profile *__attach_match(const struct linux_binprm *bprm, +- const char *name, +- struct list_head *head, +- const char **info) ++static struct aa_label *find_attach(const struct linux_binprm *bprm, ++ struct aa_ns *ns, struct list_head *head, ++ const char *name, const char **info) + { + int candidate_len = 0, candidate_xattrs = 0; + bool conflict = false; +@@ -388,6 +389,8 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm, + AA_BUG(!name); + AA_BUG(!head); + ++ rcu_read_lock(); ++restart: + list_for_each_entry_rcu(profile, head, base.list) { + if (profile->label.flags & FLAG_NULL && + &profile->label == ns_unconfined(profile->ns)) +@@ -413,16 +416,32 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm, + perm = dfa_user_allow(profile->xmatch, state); + /* any accepting state means a valid match. */ + if (perm & MAY_EXEC) { +- int ret; ++ int ret = 0; + + if (count < candidate_len) + continue; + +- ret = aa_xattrs_match(bprm, profile, state); +- /* Fail matching if the xattrs don't match */ +- if (ret < 0) +- continue; +- ++ if (bprm && profile->xattr_count) { ++ long rev = READ_ONCE(ns->revision); ++ ++ if (!aa_get_profile_not0(profile)) ++ goto restart; ++ rcu_read_unlock(); ++ ret = aa_xattrs_match(bprm, profile, ++ state); ++ rcu_read_lock(); ++ aa_put_profile(profile); ++ if (rev != ++ READ_ONCE(ns->revision)) ++ /* policy changed */ ++ goto restart; ++ /* ++ * Fail matching if the xattrs don't ++ * match ++ */ ++ if (ret < 0) ++ continue; ++ } + /* + * TODO: allow for more flexible best match + * +@@ -445,43 +464,28 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm, + candidate_xattrs = ret; + conflict = false; + } +- } else if (!strcmp(profile->base.name, name)) ++ } else if (!strcmp(profile->base.name, name)) { + /* + * old exact non-re match, without conditionals such + * as xattrs. no more searching required + */ +- return profile; ++ candidate = profile; ++ goto out; ++ } + } + +- if (conflict) { +- *info = "conflicting profile attachments"; ++ if (!candidate || conflict) { ++ if (conflict) ++ *info = "conflicting profile attachments"; ++ rcu_read_unlock(); + return NULL; + } + +- return candidate; +-} +- +-/** +- * find_attach - do attachment search for unconfined processes +- * @bprm - binprm structure of transitioning task +- * @ns: the current namespace (NOT NULL) +- * @list: list to search (NOT NULL) +- * @name: the executable name to match against (NOT NULL) +- * @info: info message if there was an error +- * +- * Returns: label or NULL if no match found +- */ +-static struct aa_label *find_attach(const struct linux_binprm *bprm, +- struct aa_ns *ns, struct list_head *list, +- const char *name, const char **info) +-{ +- struct aa_profile *profile; +- +- rcu_read_lock(); +- profile = aa_get_profile(__attach_match(bprm, name, list, info)); ++out: ++ candidate = aa_get_newest_profile(candidate); + rcu_read_unlock(); + +- return profile ? &profile->label : NULL; ++ return &candidate->label; + } + + static const char *next_name(int xtype, const char *name) +diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c +index ade333074c8e..06355717ee84 100644 +--- a/security/apparmor/policy.c ++++ b/security/apparmor/policy.c +@@ -1124,8 +1124,8 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj, + if (!name) { + /* remove namespace - can only happen if fqname[0] == ':' */ + mutex_lock_nested(&ns->parent->lock, ns->level); +- __aa_remove_ns(ns); + __aa_bump_ns_revision(ns); ++ __aa_remove_ns(ns); + mutex_unlock(&ns->parent->lock); + } else { + /* remove profile */ +@@ -1137,9 +1137,9 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj, + goto fail_ns_lock; + } + name = profile->base.hname; ++ __aa_bump_ns_revision(ns); + __remove_profile(profile); + __aa_labelset_update_subtree(ns); +- __aa_bump_ns_revision(ns); + mutex_unlock(&ns->lock); + } + +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index d4280568a41e..5c74ea2bb44b 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -3408,7 +3408,8 @@ int snd_pcm_lib_default_mmap(struct snd_pcm_substream *substream, + #endif /* CONFIG_GENERIC_ALLOCATOR */ + #ifndef CONFIG_X86 /* for avoiding warnings arch/x86/mm/pat.c */ + if (IS_ENABLED(CONFIG_HAS_DMA) && !substream->ops->page && +- substream->dma_buffer.dev.type == SNDRV_DMA_TYPE_DEV) ++ (substream->dma_buffer.dev.type == SNDRV_DMA_TYPE_DEV || ++ substream->dma_buffer.dev.type == SNDRV_DMA_TYPE_DEV_UC)) + return dma_mmap_coherent(substream->dma_buffer.dev.dev, + area, + substream->runtime->dma_area, +diff --git a/sound/firewire/motu/motu-proc.c b/sound/firewire/motu/motu-proc.c +index ea46fb4c1b5a..126a7bd187bb 100644 +--- a/sound/firewire/motu/motu-proc.c ++++ b/sound/firewire/motu/motu-proc.c +@@ -16,7 +16,7 @@ static const char *const clock_names[] = { + [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT] = "S/PDIF on optical interface", + [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_A] = "S/PDIF on optical interface A", + [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_B] = "S/PDIF on optical interface B", +- [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PCIF on coaxial interface", ++ [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PDIF on coaxial interface", + [SND_MOTU_CLOCK_SOURCE_AESEBU_ON_XLR] = "AESEBU on XLR interface", + [SND_MOTU_CLOCK_SOURCE_WORD_ON_BNC] = "Word clock on BNC interface", + }; +diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c +index 78dd213589b4..fa3c39cff5f8 100644 +--- a/sound/isa/cs423x/cs4236.c ++++ b/sound/isa/cs423x/cs4236.c +@@ -278,7 +278,8 @@ static int snd_cs423x_pnp_init_mpu(int dev, struct pnp_dev *pdev) + } else { + mpu_port[dev] = pnp_port_start(pdev, 0); + if (mpu_irq[dev] >= 0 && +- pnp_irq_valid(pdev, 0) && pnp_irq(pdev, 0) >= 0) { ++ pnp_irq_valid(pdev, 0) && ++ pnp_irq(pdev, 0) != (resource_size_t)-1) { + mpu_irq[dev] = pnp_irq(pdev, 0); + } else { + mpu_irq[dev] = -1; /* disable interrupt */ +diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c +index 6387c7e90918..76b507058cb4 100644 +--- a/sound/pci/hda/hda_controller.c ++++ b/sound/pci/hda/hda_controller.c +@@ -884,7 +884,7 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr, + return -EAGAIN; /* give a chance to retry */ + } + +- dev_WARN(chip->card->dev, ++ dev_err(chip->card->dev, + "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n", + bus->last_cmd[addr]); + chip->single_cmd = 1; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 86a416cdeb29..f6cbb831b86a 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -280,12 +280,13 @@ enum { + + /* quirks for old Intel chipsets */ + #define AZX_DCAPS_INTEL_ICH \ +- (AZX_DCAPS_OLD_SSYNC | AZX_DCAPS_NO_ALIGN_BUFSIZE) ++ (AZX_DCAPS_OLD_SSYNC | AZX_DCAPS_NO_ALIGN_BUFSIZE |\ ++ AZX_DCAPS_SYNC_WRITE) + + /* quirks for Intel PCH */ + #define AZX_DCAPS_INTEL_PCH_BASE \ + (AZX_DCAPS_NO_ALIGN_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY |\ +- AZX_DCAPS_SNOOP_TYPE(SCH)) ++ AZX_DCAPS_SNOOP_TYPE(SCH) | AZX_DCAPS_SYNC_WRITE) + + /* PCH up to IVB; no runtime PM; bind with i915 gfx */ + #define AZX_DCAPS_INTEL_PCH_NOPM \ +@@ -300,13 +301,13 @@ enum { + #define AZX_DCAPS_INTEL_HASWELL \ + (/*AZX_DCAPS_ALIGN_BUFSIZE |*/ AZX_DCAPS_COUNT_LPIB_DELAY |\ + AZX_DCAPS_PM_RUNTIME | AZX_DCAPS_I915_COMPONENT |\ +- AZX_DCAPS_SNOOP_TYPE(SCH)) ++ AZX_DCAPS_SNOOP_TYPE(SCH) | AZX_DCAPS_SYNC_WRITE) + + /* Broadwell HDMI can't use position buffer reliably, force to use LPIB */ + #define AZX_DCAPS_INTEL_BROADWELL \ + (/*AZX_DCAPS_ALIGN_BUFSIZE |*/ AZX_DCAPS_POSFIX_LPIB |\ + AZX_DCAPS_PM_RUNTIME | AZX_DCAPS_I915_COMPONENT |\ +- AZX_DCAPS_SNOOP_TYPE(SCH)) ++ AZX_DCAPS_SNOOP_TYPE(SCH) | AZX_DCAPS_SYNC_WRITE) + + #define AZX_DCAPS_INTEL_BAYTRAIL \ + (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_I915_COMPONENT) +@@ -1280,11 +1281,17 @@ static void init_vga_switcheroo(struct azx *chip) + { + struct hda_intel *hda = container_of(chip, struct hda_intel, chip); + struct pci_dev *p = get_bound_vga(chip->pci); ++ struct pci_dev *parent; + if (p) { + dev_info(chip->card->dev, + "Handle vga_switcheroo audio client\n"); + hda->use_vga_switcheroo = 1; +- chip->bus.keep_power = 1; /* cleared in either gpu_bound op or codec probe */ ++ ++ /* cleared in either gpu_bound op or codec probe, or when its ++ * upstream port has _PR3 (i.e. dGPU). ++ */ ++ parent = pci_upstream_bridge(p); ++ chip->bus.keep_power = parent ? !pci_pr3_present(parent) : 1; + chip->driver_caps |= AZX_DCAPS_PM_RUNTIME; + pci_dev_put(p); + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index e1229dbad6b2..252888f426de 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -501,6 +501,7 @@ static void alc_shutup_pins(struct hda_codec *codec) + struct alc_spec *spec = codec->spec; + + switch (codec->core.vendor_id) { ++ case 0x10ec0283: + case 0x10ec0286: + case 0x10ec0288: + case 0x10ec0298: +@@ -5547,6 +5548,16 @@ static void alc295_fixup_disable_dac3(struct hda_codec *codec, + } + } + ++/* force NID 0x17 (Bass Speaker) to DAC1 to share it with the main speaker */ ++static void alc285_fixup_speaker2_to_dac1(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ hda_nid_t conn[1] = { 0x02 }; ++ snd_hda_override_conn_list(codec, 0x17, 1, conn); ++ } ++} ++ + /* Hook to update amp GPIO4 for automute */ + static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, + struct hda_jack_callback *jack) +@@ -5849,6 +5860,7 @@ enum { + ALC225_FIXUP_DISABLE_MIC_VREF, + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC295_FIXUP_DISABLE_DAC3, ++ ALC285_FIXUP_SPEAKER2_TO_DAC1, + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, +@@ -5893,9 +5905,12 @@ enum { + ALC256_FIXUP_ASUS_HEADSET_MIC, + ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC299_FIXUP_PREDATOR_SPK, +- ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC, + ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, +- ALC294_FIXUP_ASUS_INTSPK_GPIO, ++ ALC289_FIXUP_DELL_SPK2, ++ ALC289_FIXUP_DUAL_SPK, ++ ALC294_FIXUP_SPK2_TO_DAC1, ++ ALC294_FIXUP_ASUS_DUAL_SPK, ++ + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6649,6 +6664,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc295_fixup_disable_dac3, + }, ++ [ALC285_FIXUP_SPEAKER2_TO_DAC1] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_speaker2_to_dac1, ++ }, + [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -6966,33 +6985,45 @@ static const struct hda_fixup alc269_fixups[] = { + { } + } + }, +- [ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC] = { ++ [ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +- { 0x14, 0x411111f0 }, /* disable confusing internal speaker */ +- { 0x19, 0x04a11150 }, /* use as headset mic, without its own jack detect */ ++ { 0x19, 0x04a11040 }, ++ { 0x21, 0x04211020 }, + { } + }, + .chained = true, +- .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE + }, +- [ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = { ++ [ALC289_FIXUP_DELL_SPK2] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +- { 0x19, 0x04a11040 }, +- { 0x21, 0x04211020 }, ++ { 0x17, 0x90170130 }, /* bass spk */ + { } + }, + .chained = true, +- .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE ++ .chain_id = ALC269_FIXUP_DELL4_MIC_NO_PRESENCE + }, +- [ALC294_FIXUP_ASUS_INTSPK_GPIO] = { ++ [ALC289_FIXUP_DUAL_SPK] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_speaker2_to_dac1, ++ .chained = true, ++ .chain_id = ALC289_FIXUP_DELL_SPK2 ++ }, ++ [ALC294_FIXUP_SPK2_TO_DAC1] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_speaker2_to_dac1, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC ++ }, ++ [ALC294_FIXUP_ASUS_DUAL_SPK] = { + .type = HDA_FIXUP_FUNC, + /* The GPIO must be pulled to initialize the AMP */ + .v.func = alc_fixup_gpio4, + .chained = true, +- .chain_id = ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC ++ .chain_id = ALC294_FIXUP_SPK2_TO_DAC1 + }, ++ + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7065,6 +7096,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), ++ SND_PCI_QUIRK(0x1028, 0x097e, "Dell Precision", ALC289_FIXUP_DUAL_SPK), ++ SND_PCI_QUIRK(0x1028, 0x097d, "Dell Precision", ALC289_FIXUP_DUAL_SPK), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), +@@ -7152,7 +7185,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), +- SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_GPIO), ++ SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), +@@ -7224,6 +7257,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), +@@ -7408,6 +7442,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"}, + {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc225-dell1"}, + {.id = ALC295_FIXUP_DISABLE_DAC3, .name = "alc295-disable-dac3"}, ++ {.id = ALC285_FIXUP_SPEAKER2_TO_DAC1, .name = "alc285-speaker2-to-dac1"}, + {.id = ALC280_FIXUP_HP_HEADSET_MIC, .name = "alc280-hp-headset"}, + {.id = ALC221_FIXUP_HP_FRONT_MIC, .name = "alc221-hp-mic"}, + {.id = ALC298_FIXUP_SPK_VOLUME, .name = "alc298-spk-volume"}, +diff --git a/sound/pci/ice1712/ice1724.c b/sound/pci/ice1712/ice1724.c +index e62c11816683..f360b33a1042 100644 +--- a/sound/pci/ice1712/ice1724.c ++++ b/sound/pci/ice1712/ice1724.c +@@ -647,6 +647,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, + unsigned long flags; + unsigned char mclk_change; + unsigned int i, old_rate; ++ bool call_set_rate = false; + + if (rate > ice->hw_rates->list[ice->hw_rates->count - 1]) + return -EINVAL; +@@ -670,7 +671,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, + * setting clock rate for internal clock mode */ + old_rate = ice->get_rate(ice); + if (force || (old_rate != rate)) +- ice->set_rate(ice, rate); ++ call_set_rate = true; + else if (rate == ice->cur_rate) { + spin_unlock_irqrestore(&ice->reg_lock, flags); + return 0; +@@ -678,12 +679,14 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, + } + + ice->cur_rate = rate; ++ spin_unlock_irqrestore(&ice->reg_lock, flags); ++ ++ if (call_set_rate) ++ ice->set_rate(ice, rate); + + /* setting master clock */ + mclk_change = ice->set_mclk(ice, rate); + +- spin_unlock_irqrestore(&ice->reg_lock, flags); +- + if (mclk_change && ice->gpio.i2s_mclk_changed) + ice->gpio.i2s_mclk_changed(ice); + if (ice->gpio.set_pro_rate) +diff --git a/sound/usb/card.h b/sound/usb/card.h +index 2991b9986f66..395403a2d33f 100644 +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -145,6 +145,7 @@ struct snd_usb_substream { + struct snd_usb_endpoint *sync_endpoint; + unsigned long flags; + bool need_setup_ep; /* (re)configure EP at prepare? */ ++ bool need_setup_fmt; /* (re)configure fmt after resume? */ + unsigned int speed; /* USB_SPEED_XXX */ + + u64 formats; /* format bitmasks (all or'ed) */ +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index ff5ab24f3bd1..a04c727dcd19 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -506,15 +506,15 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt) + if (WARN_ON(!iface)) + return -EINVAL; + alts = usb_altnum_to_altsetting(iface, fmt->altsetting); +- altsd = get_iface_desc(alts); +- if (WARN_ON(altsd->bAlternateSetting != fmt->altsetting)) ++ if (WARN_ON(!alts)) + return -EINVAL; ++ altsd = get_iface_desc(alts); + +- if (fmt == subs->cur_audiofmt) ++ if (fmt == subs->cur_audiofmt && !subs->need_setup_fmt) + return 0; + + /* close the old interface */ +- if (subs->interface >= 0 && subs->interface != fmt->iface) { ++ if (subs->interface >= 0 && (subs->interface != fmt->iface || subs->need_setup_fmt)) { + if (!subs->stream->chip->keep_iface) { + err = usb_set_interface(subs->dev, subs->interface, 0); + if (err < 0) { +@@ -528,6 +528,9 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt) + subs->altset_idx = 0; + } + ++ if (subs->need_setup_fmt) ++ subs->need_setup_fmt = false; ++ + /* set interface */ + if (iface->cur_altsetting != alts) { + err = snd_usb_select_mode_quirk(subs, fmt); +@@ -1735,6 +1738,13 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea + subs->data_endpoint->retire_data_urb = retire_playback_urb; + subs->running = 0; + return 0; ++ case SNDRV_PCM_TRIGGER_SUSPEND: ++ if (subs->stream->chip->setup_fmt_after_resume_quirk) { ++ stop_endpoints(subs, true); ++ subs->need_setup_fmt = true; ++ return 0; ++ } ++ break; + } + + return -EINVAL; +@@ -1767,6 +1777,13 @@ static int snd_usb_substream_capture_trigger(struct snd_pcm_substream *substream + subs->data_endpoint->retire_data_urb = retire_capture_urb; + subs->running = 1; + return 0; ++ case SNDRV_PCM_TRIGGER_SUSPEND: ++ if (subs->stream->chip->setup_fmt_after_resume_quirk) { ++ stop_endpoints(subs, true); ++ subs->need_setup_fmt = true; ++ return 0; ++ } ++ break; + } + + return -EINVAL; +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 70c338f3ae24..d187aa6d50db 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3466,7 +3466,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + .vendor_name = "Dell", + .product_name = "WD19 Dock", + .profile_name = "Dell-WD15-Dock", +- .ifnum = QUIRK_NO_INTERFACE ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_SETUP_FMT_AFTER_RESUME + } + }, + /* MOTU Microbook II */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 349e1e52996d..a81c2066499f 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -508,6 +508,16 @@ static int create_standard_mixer_quirk(struct snd_usb_audio *chip, + return snd_usb_create_mixer(chip, quirk->ifnum, 0); + } + ++ ++static int setup_fmt_after_resume_quirk(struct snd_usb_audio *chip, ++ struct usb_interface *iface, ++ struct usb_driver *driver, ++ const struct snd_usb_audio_quirk *quirk) ++{ ++ chip->setup_fmt_after_resume_quirk = 1; ++ return 1; /* Continue with creating streams and mixer */ ++} ++ + /* + * audio-interface quirks + * +@@ -546,6 +556,7 @@ int snd_usb_create_quirk(struct snd_usb_audio *chip, + [QUIRK_AUDIO_EDIROL_UAXX] = create_uaxx_quirk, + [QUIRK_AUDIO_ALIGN_TRANSFER] = create_align_transfer_quirk, + [QUIRK_AUDIO_STANDARD_MIXER] = create_standard_mixer_quirk, ++ [QUIRK_SETUP_FMT_AFTER_RESUME] = setup_fmt_after_resume_quirk, + }; + + if (quirk->type < QUIRK_TYPE_COUNT) { +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index feb30f9c1716..e360680f45f3 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -33,7 +33,7 @@ struct snd_usb_audio { + wait_queue_head_t shutdown_wait; + unsigned int txfr_quirk:1; /* Subframe boundaries on transfers */ + unsigned int tx_length_quirk:1; /* Put length specifier in transfers */ +- ++ unsigned int setup_fmt_after_resume_quirk:1; /* setup the format to interface after resume */ + int num_interfaces; + int num_suspended_intf; + int sample_rate_read_error; +@@ -98,6 +98,7 @@ enum quirk_type { + QUIRK_AUDIO_EDIROL_UAXX, + QUIRK_AUDIO_ALIGN_TRANSFER, + QUIRK_AUDIO_STANDARD_MIXER, ++ QUIRK_SETUP_FMT_AFTER_RESUME, + + QUIRK_TYPE_COUNT + }; +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index 70a9f8716a4b..888814df758d 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -2403,7 +2403,7 @@ static int thread__resolve_callchain_sample(struct thread *thread, + } + + check_calls: +- if (callchain_param.order != ORDER_CALLEE) { ++ if (chain && callchain_param.order != ORDER_CALLEE) { + err = find_prev_cpumode(chain, thread, cursor, parent, root_al, + &cpumode, chain->nr - first_call); + if (err) +diff --git a/tools/testing/selftests/rseq/param_test.c b/tools/testing/selftests/rseq/param_test.c +index eec2663261f2..e8a657a5f48a 100644 +--- a/tools/testing/selftests/rseq/param_test.c ++++ b/tools/testing/selftests/rseq/param_test.c +@@ -15,7 +15,7 @@ + #include + #include + +-static inline pid_t gettid(void) ++static inline pid_t rseq_gettid(void) + { + return syscall(__NR_gettid); + } +@@ -373,11 +373,12 @@ void *test_percpu_spinlock_thread(void *arg) + rseq_percpu_unlock(&data->lock, cpu); + #ifndef BENCHMARK + if (i != 0 && !(i % (reps / 10))) +- printf_verbose("tid %d: count %lld\n", (int) gettid(), i); ++ printf_verbose("tid %d: count %lld\n", ++ (int) rseq_gettid(), i); + #endif + } + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && thread_data->reg && + rseq_unregister_current_thread()) + abort(); +@@ -454,11 +455,12 @@ void *test_percpu_inc_thread(void *arg) + } while (rseq_unlikely(ret)); + #ifndef BENCHMARK + if (i != 0 && !(i % (reps / 10))) +- printf_verbose("tid %d: count %lld\n", (int) gettid(), i); ++ printf_verbose("tid %d: count %lld\n", ++ (int) rseq_gettid(), i); + #endif + } + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && thread_data->reg && + rseq_unregister_current_thread()) + abort(); +@@ -605,7 +607,7 @@ void *test_percpu_list_thread(void *arg) + } + + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && rseq_unregister_current_thread()) + abort(); + +@@ -796,7 +798,7 @@ void *test_percpu_buffer_thread(void *arg) + } + + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && rseq_unregister_current_thread()) + abort(); + +@@ -1011,7 +1013,7 @@ void *test_percpu_memcpy_buffer_thread(void *arg) + } + + printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n", +- (int) gettid(), nr_abort, signals_delivered); ++ (int) rseq_gettid(), nr_abort, signals_delivered); + if (!opt_disable_rseq && rseq_unregister_current_thread()) + abort(); + +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index b505bb062d07..96bbda4f10fc 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -3147,7 +3147,18 @@ TEST(user_notification_basic) + EXPECT_GT(poll(&pollfd, 1, -1), 0); + EXPECT_EQ(pollfd.revents, POLLIN); + +- EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); ++ /* Test that we can't pass garbage to the kernel. */ ++ memset(&req, 0, sizeof(req)); ++ req.pid = -1; ++ errno = 0; ++ ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req); ++ EXPECT_EQ(-1, ret); ++ EXPECT_EQ(EINVAL, errno); ++ ++ if (ret) { ++ req.pid = 0; ++ EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); ++ } + + pollfd.fd = listener; + pollfd.events = POLLIN | POLLOUT; +@@ -3267,6 +3278,7 @@ TEST(user_notification_signal) + + close(sk_pair[1]); + ++ memset(&req, 0, sizeof(req)); + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); + + EXPECT_EQ(kill(pid, SIGUSR1), 0); +@@ -3285,6 +3297,7 @@ TEST(user_notification_signal) + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); + EXPECT_EQ(errno, ENOENT); + ++ memset(&req, 0, sizeof(req)); + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); + + resp.id = req.id; +diff --git a/usr/gen_initramfs_list.sh b/usr/gen_initramfs_list.sh +index 0aad760fcd8c..2bbac73e6477 100755 +--- a/usr/gen_initramfs_list.sh ++++ b/usr/gen_initramfs_list.sh +@@ -128,7 +128,7 @@ parse() { + str="${ftype} ${name} ${location} ${str}" + ;; + "nod") +- local dev=`LC_ALL=C ls -l "${location}"` ++ local dev="`LC_ALL=C ls -l "${location}"`" + local maj=`field 5 ${dev}` + local min=`field 6 ${dev}` + maj=${maj%,} diff --git a/patch/kernel/odroidxu4-current/02-patch-5.4.9-10.patch b/patch/kernel/odroidxu4-current/02-patch-5.4.9-10.patch new file mode 100644 index 0000000000..ef48304451 --- /dev/null +++ b/patch/kernel/odroidxu4-current/02-patch-5.4.9-10.patch @@ -0,0 +1,26 @@ +diff --git a/Makefile b/Makefile +index 3ba15c3528c8..726bb3dacd5b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 9 ++SUBLEVEL = 10 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index 460afa415434..d30a2e6e68b4 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -120,7 +120,7 @@ static void flush_dcache_range_chunked(unsigned long start, unsigned long stop, + unsigned long i; + + for (i = start; i < stop; i += chunk) { +- flush_dcache_range(i, min(stop, start + chunk)); ++ flush_dcache_range(i, min(stop, i + chunk)); + cond_resched(); + } + } diff --git a/patch/kernel/odroidxu4-current/03-patch-5.4.10-11.patch b/patch/kernel/odroidxu4-current/03-patch-5.4.10-11.patch new file mode 100644 index 0000000000..28d7a5b889 --- /dev/null +++ b/patch/kernel/odroidxu4-current/03-patch-5.4.10-11.patch @@ -0,0 +1,5959 @@ +diff --git a/Makefile b/Makefile +index 726bb3dacd5b..e8963f623568 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 10 ++SUBLEVEL = 11 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/am335x-sancloud-bbe.dts b/arch/arm/boot/dts/am335x-sancloud-bbe.dts +index 8678e6e35493..e5fdb7abb0d5 100644 +--- a/arch/arm/boot/dts/am335x-sancloud-bbe.dts ++++ b/arch/arm/boot/dts/am335x-sancloud-bbe.dts +@@ -108,7 +108,7 @@ + + &cpsw_emac0 { + phy-handle = <ðphy0>; +- phy-mode = "rgmii-txid"; ++ phy-mode = "rgmii-id"; + }; + + &i2c0 { +diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts +index cae4500194fe..811c8cae315b 100644 +--- a/arch/arm/boot/dts/am437x-gp-evm.dts ++++ b/arch/arm/boot/dts/am437x-gp-evm.dts +@@ -86,7 +86,7 @@ + }; + + lcd0: display { +- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; ++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; + label = "lcd"; + + backlight = <&lcd_bl>; +diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts +index 95314121d111..078cb473fa7d 100644 +--- a/arch/arm/boot/dts/am43x-epos-evm.dts ++++ b/arch/arm/boot/dts/am43x-epos-evm.dts +@@ -42,7 +42,7 @@ + }; + + lcd0: display { +- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; ++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; + label = "lcd"; + + backlight = <&lcd_bl>; +diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi +index 2dac3efc7640..1bc45cfd5453 100644 +--- a/arch/arm/boot/dts/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi +@@ -174,8 +174,8 @@ + mdio: mdio@18002000 { + compatible = "brcm,iproc-mdio"; + reg = <0x18002000 0x8>; +- #size-cells = <1>; +- #address-cells = <0>; ++ #size-cells = <0>; ++ #address-cells = <1>; + status = "disabled"; + + gphy0: ethernet-phy@0 { +diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi +index 2d191fcbc2cc..90125ce19a1b 100644 +--- a/arch/arm/boot/dts/bcm283x.dtsi ++++ b/arch/arm/boot/dts/bcm283x.dtsi +@@ -40,7 +40,7 @@ + + trips { + cpu-crit { +- temperature = <80000>; ++ temperature = <90000>; + hysteresis = <0>; + type = "critical"; + }; +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 372dc1eb88a0..2d9b4dd05830 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -353,8 +353,8 @@ + mdio: mdio@18003000 { + compatible = "brcm,iproc-mdio"; + reg = <0x18003000 0x8>; +- #size-cells = <1>; +- #address-cells = <0>; ++ #size-cells = <0>; ++ #address-cells = <1>; + }; + + mdio-bus-mux@18003000 { +diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi +index c2a9dd57e56a..aa86341adaaa 100644 +--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi ++++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi +@@ -215,7 +215,7 @@ + flash0: n25q256a@0 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "micron,n25q256a"; ++ compatible = "micron,n25q256a", "jedec,spi-nor"; + spi-max-frequency = <29000000>; + spi-rx-bus-width = <4>; + spi-tx-bus-width = <4>; +diff --git a/arch/arm/configs/exynos_defconfig b/arch/arm/configs/exynos_defconfig +index 08db1c83eb2d..736ed7a7bcf8 100644 +--- a/arch/arm/configs/exynos_defconfig ++++ b/arch/arm/configs/exynos_defconfig +@@ -348,6 +348,7 @@ CONFIG_PRINTK_TIME=y + CONFIG_DYNAMIC_DEBUG=y + CONFIG_DEBUG_INFO=y + CONFIG_MAGIC_SYSRQ=y ++CONFIG_DEBUG_FS=y + CONFIG_DEBUG_KERNEL=y + CONFIG_SOFTLOCKUP_DETECTOR=y + # CONFIG_DETECT_HUNG_TASK is not set +diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig +index 0f7381ee0c37..dabb80453249 100644 +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -460,6 +460,7 @@ CONFIG_FONT_8x8=y + CONFIG_FONT_8x16=y + CONFIG_PRINTK_TIME=y + CONFIG_MAGIC_SYSRQ=y ++CONFIG_DEBUG_FS=y + # CONFIG_SCHED_DEBUG is not set + CONFIG_PROVE_LOCKING=y + # CONFIG_DEBUG_BUGVERBOSE is not set +diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig +index 40d7f1a4fc45..4ec69fb8a698 100644 +--- a/arch/arm/configs/omap2plus_defconfig ++++ b/arch/arm/configs/omap2plus_defconfig +@@ -552,5 +552,6 @@ CONFIG_DEBUG_INFO=y + CONFIG_DEBUG_INFO_SPLIT=y + CONFIG_DEBUG_INFO_DWARF4=y + CONFIG_MAGIC_SYSRQ=y ++CONFIG_DEBUG_FS=y + CONFIG_SCHEDSTATS=y + # CONFIG_DEBUG_BUGVERBOSE is not set +diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c +index 354e0e7025ae..1da11bdb1dfb 100644 +--- a/arch/arm/mach-vexpress/spc.c ++++ b/arch/arm/mach-vexpress/spc.c +@@ -551,8 +551,9 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev) + + static int __init ve_spc_clk_init(void) + { +- int cpu; ++ int cpu, cluster; + struct clk *clk; ++ bool init_opp_table[MAX_CLUSTERS] = { false }; + + if (!info) + return 0; /* Continue only if SPC is initialised */ +@@ -578,8 +579,17 @@ static int __init ve_spc_clk_init(void) + continue; + } + ++ cluster = topology_physical_package_id(cpu_dev->id); ++ if (init_opp_table[cluster]) ++ continue; ++ + if (ve_init_opp_table(cpu_dev)) + pr_warn("failed to initialise cpu%d opp table\n", cpu); ++ else if (dev_pm_opp_set_sharing_cpus(cpu_dev, ++ topology_core_cpumask(cpu_dev->id))) ++ pr_warn("failed to mark OPPs shared for cpu%d\n", cpu); ++ else ++ init_opp_table[cluster] = true; + } + + platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0); +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 72b9a75976a1..bb960fe2bb64 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -102,7 +102,7 @@ + + reboot { + compatible ="syscon-reboot"; +- regmap = <&dcfg>; ++ regmap = <&rst>; + offset = <0xb0>; + mask = <0x02>; + }; +@@ -161,6 +161,12 @@ + big-endian; + }; + ++ rst: syscon@1e60000 { ++ compatible = "syscon"; ++ reg = <0x0 0x1e60000 0x0 0x10000>; ++ little-endian; ++ }; ++ + scfg: syscon@1fc0000 { + compatible = "fsl,ls1028a-scfg", "syscon"; + reg = <0x0 0x1fc0000 0x0 0x10000>; +@@ -567,7 +573,7 @@ + 0x00010004 0x0000003d + 0x00010005 0x00000045 + 0x00010006 0x0000004d +- 0x00010007 0x00000045 ++ 0x00010007 0x00000055 + 0x00010008 0x0000005e + 0x00010009 0x00000066 + 0x0001000a 0x0000006e +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 93f34b4eca25..96f576e9ea46 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -575,6 +575,7 @@ static const struct midr_range spectre_v2_safe_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_A53), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A55), + MIDR_ALL_VERSIONS(MIDR_BRAHMA_B53), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + { /* sentinel */ } + }; + +diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c +index a2405d5f7d1e..561154cbcc40 100644 +--- a/arch/mips/net/ebpf_jit.c ++++ b/arch/mips/net/ebpf_jit.c +@@ -604,6 +604,7 @@ static void emit_const_to_reg(struct jit_ctx *ctx, int dst, u64 value) + static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx) + { + int off, b_off; ++ int tcc_reg; + + ctx->flags |= EBPF_SEEN_TC; + /* +@@ -616,14 +617,14 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx) + b_off = b_imm(this_idx + 1, ctx); + emit_instr(ctx, bne, MIPS_R_AT, MIPS_R_ZERO, b_off); + /* +- * if (--TCC < 0) ++ * if (TCC-- < 0) + * goto out; + */ + /* Delay slot */ +- emit_instr(ctx, daddiu, MIPS_R_T5, +- (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4, -1); ++ tcc_reg = (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4; ++ emit_instr(ctx, daddiu, MIPS_R_T5, tcc_reg, -1); + b_off = b_imm(this_idx + 1, ctx); +- emit_instr(ctx, bltz, MIPS_R_T5, b_off); ++ emit_instr(ctx, bltz, tcc_reg, b_off); + /* + * prog = array->ptrs[index]; + * if (prog == NULL) +diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h +index f627c37dad9c..ab5c215cf46c 100644 +--- a/arch/parisc/include/asm/cmpxchg.h ++++ b/arch/parisc/include/asm/cmpxchg.h +@@ -44,8 +44,14 @@ __xchg(unsigned long x, __volatile__ void *ptr, int size) + ** if (((unsigned long)p & 0xf) == 0) + ** return __ldcw(p); + */ +-#define xchg(ptr, x) \ +- ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) ++#define xchg(ptr, x) \ ++({ \ ++ __typeof__(*(ptr)) __ret; \ ++ __typeof__(*(ptr)) _x_ = (x); \ ++ __ret = (__typeof__(*(ptr))) \ ++ __xchg((unsigned long)_x_, (ptr), sizeof(*(ptr))); \ ++ __ret; \ ++}) + + /* bug catcher for when unsupported size is used - won't link */ + extern void __cmpxchg_called_with_bad_pointer(void); +diff --git a/arch/parisc/include/asm/kexec.h b/arch/parisc/include/asm/kexec.h +index a99ea747d7ed..87e174006995 100644 +--- a/arch/parisc/include/asm/kexec.h ++++ b/arch/parisc/include/asm/kexec.h +@@ -2,8 +2,6 @@ + #ifndef _ASM_PARISC_KEXEC_H + #define _ASM_PARISC_KEXEC_H + +-#ifdef CONFIG_KEXEC +- + /* Maximum physical address we can use pages from */ + #define KEXEC_SOURCE_MEMORY_LIMIT (-1UL) + /* Maximum address we can reach in physical address mode */ +@@ -32,6 +30,4 @@ static inline void crash_setup_regs(struct pt_regs *newregs, + + #endif /* __ASSEMBLY__ */ + +-#endif /* CONFIG_KEXEC */ +- + #endif /* _ASM_PARISC_KEXEC_H */ +diff --git a/arch/parisc/kernel/Makefile b/arch/parisc/kernel/Makefile +index 2663c8f8be11..068d90950d93 100644 +--- a/arch/parisc/kernel/Makefile ++++ b/arch/parisc/kernel/Makefile +@@ -37,5 +37,5 @@ obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o + obj-$(CONFIG_JUMP_LABEL) += jump_label.o + obj-$(CONFIG_KGDB) += kgdb.o + obj-$(CONFIG_KPROBES) += kprobes.o +-obj-$(CONFIG_KEXEC) += kexec.o relocate_kernel.o ++obj-$(CONFIG_KEXEC_CORE) += kexec.o relocate_kernel.o + obj-$(CONFIG_KEXEC_FILE) += kexec_file.o +diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c +index 3b330e58a4f0..a6c9f49c6612 100644 +--- a/arch/parisc/kernel/drivers.c ++++ b/arch/parisc/kernel/drivers.c +@@ -810,7 +810,7 @@ EXPORT_SYMBOL(device_to_hwpath); + static void walk_native_bus(unsigned long io_io_low, unsigned long io_io_high, + struct device *parent); + +-static void walk_lower_bus(struct parisc_device *dev) ++static void __init walk_lower_bus(struct parisc_device *dev) + { + unsigned long io_io_low, io_io_high; + +diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h +index e9a960e28f3c..d6102e34eb21 100644 +--- a/arch/powerpc/include/asm/spinlock.h ++++ b/arch/powerpc/include/asm/spinlock.h +@@ -15,6 +15,7 @@ + * + * (the type definitions are in asm/spinlock_types.h) + */ ++#include + #include + #ifdef CONFIG_PPC64 + #include +@@ -36,10 +37,12 @@ + #endif + + #ifdef CONFIG_PPC_PSERIES ++DECLARE_STATIC_KEY_FALSE(shared_processor); ++ + #define vcpu_is_preempted vcpu_is_preempted + static inline bool vcpu_is_preempted(int cpu) + { +- if (!firmware_has_feature(FW_FEATURE_SPLPAR)) ++ if (!static_branch_unlikely(&shared_processor)) + return false; + return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1); + } +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index d30a2e6e68b4..9f5b32163bda 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -282,6 +282,14 @@ void __init mem_init(void) + BUILD_BUG_ON(MMU_PAGE_COUNT > 16); + + #ifdef CONFIG_SWIOTLB ++ /* ++ * Some platforms (e.g. 85xx) limit DMA-able memory way below ++ * 4G. We force memblock to bottom-up mode to ensure that the ++ * memory allocated in swiotlb_init() is DMA-able. ++ * As it's the last memblock allocation, no need to reset it ++ * back to to-down. ++ */ ++ memblock_set_bottom_up(true); + swiotlb_init(0); + #endif + +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 0a40201f315f..0c8421dd01ab 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -74,6 +74,9 @@ + #include "pseries.h" + #include "../../../../drivers/pci/pci.h" + ++DEFINE_STATIC_KEY_FALSE(shared_processor); ++EXPORT_SYMBOL_GPL(shared_processor); ++ + int CMO_PrPSP = -1; + int CMO_SecPSP = -1; + unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K); +@@ -758,6 +761,10 @@ static void __init pSeries_setup_arch(void) + + if (firmware_has_feature(FW_FEATURE_LPAR)) { + vpa_init(boot_cpuid); ++ ++ if (lppaca_shared_proc(get_lppaca())) ++ static_branch_enable(&shared_processor); ++ + ppc_md.power_save = pseries_lpar_idle; + ppc_md.enable_pmcs = pseries_lpar_enable_pmcs; + #ifdef CONFIG_PCI_IOV +diff --git a/arch/riscv/net/bpf_jit_comp.c b/arch/riscv/net/bpf_jit_comp.c +index 5451ef3845f2..7fbf56aab661 100644 +--- a/arch/riscv/net/bpf_jit_comp.c ++++ b/arch/riscv/net/bpf_jit_comp.c +@@ -631,14 +631,14 @@ static int emit_bpf_tail_call(int insn, struct rv_jit_context *ctx) + return -1; + emit(rv_bgeu(RV_REG_A2, RV_REG_T1, off >> 1), ctx); + +- /* if (--TCC < 0) ++ /* if (TCC-- < 0) + * goto out; + */ + emit(rv_addi(RV_REG_T1, tcc, -1), ctx); + off = (tc_ninsn - (ctx->ninsns - start_insn)) << 2; + if (is_13b_check(off, insn)) + return -1; +- emit(rv_blt(RV_REG_T1, RV_REG_ZERO, off >> 1), ctx); ++ emit(rv_blt(tcc, RV_REG_ZERO, off >> 1), ctx); + + /* prog = array->ptrs[index]; + * if (!prog) +diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile +index bc0d7a0d0394..9de56065f28c 100644 +--- a/arch/s390/purgatory/Makefile ++++ b/arch/s390/purgatory/Makefile +@@ -15,8 +15,10 @@ CFLAGS_sha256.o := -D__DISABLE_EXPORTS + $(obj)/mem.o: $(srctree)/arch/s390/lib/mem.S FORCE + $(call if_changed_rule,as_o_S) + +-$(obj)/string.o: $(srctree)/arch/s390/lib/string.c FORCE +- $(call if_changed_rule,cc_o_c) ++KCOV_INSTRUMENT := n ++GCOV_PROFILE := n ++UBSAN_SANITIZE := n ++KASAN_SANITIZE := n + + KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes + KBUILD_CFLAGS += -Wno-pointer-sign -Wno-sign-compare +diff --git a/arch/s390/purgatory/string.c b/arch/s390/purgatory/string.c +new file mode 100644 +index 000000000000..c98c22a72db7 +--- /dev/null ++++ b/arch/s390/purgatory/string.c +@@ -0,0 +1,3 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#define __HAVE_ARCH_MEMCMP /* arch function */ ++#include "../lib/string.c" +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 7b21455d7504..e622158f5659 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -375,7 +375,7 @@ int x86_add_exclusive(unsigned int what) + * LBR and BTS are still mutually exclusive. + */ + if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt) +- return 0; ++ goto out; + + if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) { + mutex_lock(&pmc_reserve_mutex); +@@ -387,6 +387,7 @@ int x86_add_exclusive(unsigned int what) + mutex_unlock(&pmc_reserve_mutex); + } + ++out: + atomic_inc(&active_events); + return 0; + +@@ -397,11 +398,15 @@ fail_unlock: + + void x86_del_exclusive(unsigned int what) + { ++ atomic_dec(&active_events); ++ ++ /* ++ * See the comment in x86_add_exclusive(). ++ */ + if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt) + return; + + atomic_dec(&x86_pmu.lbr_exclusive[what]); +- atomic_dec(&active_events); + } + + int x86_setup_perfctr(struct perf_event *event) +@@ -1641,9 +1646,12 @@ static struct attribute_group x86_pmu_format_group __ro_after_init = { + + ssize_t events_sysfs_show(struct device *dev, struct device_attribute *attr, char *page) + { +- struct perf_pmu_events_attr *pmu_attr = \ ++ struct perf_pmu_events_attr *pmu_attr = + container_of(attr, struct perf_pmu_events_attr, attr); +- u64 config = x86_pmu.event_map(pmu_attr->id); ++ u64 config = 0; ++ ++ if (pmu_attr->id < x86_pmu.max_events) ++ config = x86_pmu.event_map(pmu_attr->id); + + /* string trumps id */ + if (pmu_attr->event_str) +@@ -1712,6 +1720,9 @@ is_visible(struct kobject *kobj, struct attribute *attr, int idx) + { + struct perf_pmu_events_attr *pmu_attr; + ++ if (idx >= x86_pmu.max_events) ++ return 0; ++ + pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr.attr); + /* str trumps id */ + return pmu_attr->event_str || x86_pmu.event_map(idx) ? attr->mode : 0; +diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c +index 606711f5ebf8..2f9ec14be3b1 100644 +--- a/arch/x86/kernel/early-quirks.c ++++ b/arch/x86/kernel/early-quirks.c +@@ -714,6 +714,8 @@ static struct chipset early_qrk[] __initdata = { + PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, + { PCI_VENDOR_ID_INTEL, 0x3ec4, + PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, ++ { PCI_VENDOR_ID_INTEL, 0x8a12, ++ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, + { PCI_VENDOR_ID_BROADCOM, 0x4331, + PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset}, + {} +diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c +index 3b9fd679cea9..aefe845dff59 100644 +--- a/arch/x86/platform/efi/quirks.c ++++ b/arch/x86/platform/efi/quirks.c +@@ -260,10 +260,6 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size) + return; + } + +- /* No need to reserve regions that will never be freed. */ +- if (md.attribute & EFI_MEMORY_RUNTIME) +- return; +- + size += addr % EFI_PAGE_SIZE; + size = round_up(size, EFI_PAGE_SIZE); + addr = round_down(addr, EFI_PAGE_SIZE); +@@ -293,6 +289,8 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size) + early_memunmap(new, new_size); + + efi_memmap_install(new_phys, num_entries); ++ e820__range_update(addr, size, E820_TYPE_RAM, E820_TYPE_RESERVED); ++ e820__update_table(e820_table); + } + + /* +diff --git a/block/blk-core.c b/block/blk-core.c +index d5e668ec751b..1075aaff606d 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -886,11 +886,14 @@ generic_make_request_checks(struct bio *bio) + } + + /* +- * For a REQ_NOWAIT based request, return -EOPNOTSUPP +- * if queue is not a request based queue. ++ * Non-mq queues do not honor REQ_NOWAIT, so complete a bio ++ * with BLK_STS_AGAIN status in order to catch -EAGAIN and ++ * to give a chance to the caller to repeat request gracefully. + */ +- if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q)) +- goto not_supported; ++ if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q)) { ++ status = BLK_STS_AGAIN; ++ goto end_io; ++ } + + if (should_fail_bio(bio)) + goto end_io; +diff --git a/block/blk-flush.c b/block/blk-flush.c +index 1eec9cbe5a0a..b1f0a1ac505c 100644 +--- a/block/blk-flush.c ++++ b/block/blk-flush.c +@@ -69,6 +69,7 @@ + #include + #include + #include ++#include + + #include "blk.h" + #include "blk-mq.h" +@@ -492,6 +493,9 @@ struct blk_flush_queue *blk_alloc_flush_queue(struct request_queue *q, + INIT_LIST_HEAD(&fq->flush_queue[1]); + INIT_LIST_HEAD(&fq->flush_data_in_flight); + ++ lockdep_register_key(&fq->key); ++ lockdep_set_class(&fq->mq_flush_lock, &fq->key); ++ + return fq; + + fail_rq: +@@ -506,6 +510,7 @@ void blk_free_flush_queue(struct blk_flush_queue *fq) + if (!fq) + return; + ++ lockdep_unregister_key(&fq->key); + kfree(fq->flush_rq); + kfree(fq); + } +diff --git a/block/blk-map.c b/block/blk-map.c +index 3a62e471d81b..b0790268ed9d 100644 +--- a/block/blk-map.c ++++ b/block/blk-map.c +@@ -151,7 +151,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, + return 0; + + unmap_rq: +- __blk_rq_unmap_user(bio); ++ blk_rq_unmap_user(bio); + fail: + rq->bio = NULL; + return ret; +diff --git a/block/blk.h b/block/blk.h +index 47fba9362e60..ffea1691470e 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -30,6 +30,7 @@ struct blk_flush_queue { + * at the same time + */ + struct request *orig_rq; ++ struct lock_class_key key; + spinlock_t mq_flush_lock; + }; + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 2b6670daf7fc..34bd9bf4e68a 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1594,6 +1594,10 @@ static int sysc_reset(struct sysc *ddata) + sysc_val |= sysc_mask; + sysc_write(ddata, sysc_offset, sysc_val); + ++ if (ddata->cfg.srst_udelay) ++ usleep_range(ddata->cfg.srst_udelay, ++ ddata->cfg.srst_udelay * 2); ++ + if (ddata->clk_enable_quirk) + ddata->clk_enable_quirk(ddata); + +diff --git a/drivers/char/tpm/tpm_ftpm_tee.c b/drivers/char/tpm/tpm_ftpm_tee.c +index 6640a14dbe48..22bf553ccf9d 100644 +--- a/drivers/char/tpm/tpm_ftpm_tee.c ++++ b/drivers/char/tpm/tpm_ftpm_tee.c +@@ -32,7 +32,7 @@ static const uuid_t ftpm_ta_uuid = + 0x82, 0xCB, 0x34, 0x3F, 0xB7, 0xF3, 0x78, 0x96); + + /** +- * ftpm_tee_tpm_op_recv - retrieve fTPM response. ++ * ftpm_tee_tpm_op_recv() - retrieve fTPM response. + * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h. + * @buf: the buffer to store data. + * @count: the number of bytes to read. +@@ -61,7 +61,7 @@ static int ftpm_tee_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count) + } + + /** +- * ftpm_tee_tpm_op_send - send TPM commands through the TEE shared memory. ++ * ftpm_tee_tpm_op_send() - send TPM commands through the TEE shared memory. + * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h + * @buf: the buffer to send. + * @len: the number of bytes to send. +@@ -208,7 +208,7 @@ static int ftpm_tee_match(struct tee_ioctl_version_data *ver, const void *data) + } + + /** +- * ftpm_tee_probe - initialize the fTPM ++ * ftpm_tee_probe() - initialize the fTPM + * @pdev: the platform_device description. + * + * Return: +@@ -298,7 +298,7 @@ out_tee_session: + } + + /** +- * ftpm_tee_remove - remove the TPM device ++ * ftpm_tee_remove() - remove the TPM device + * @pdev: the platform_device description. + * + * Return: +@@ -328,6 +328,19 @@ static int ftpm_tee_remove(struct platform_device *pdev) + return 0; + } + ++/** ++ * ftpm_tee_shutdown() - shutdown the TPM device ++ * @pdev: the platform_device description. ++ */ ++static void ftpm_tee_shutdown(struct platform_device *pdev) ++{ ++ struct ftpm_tee_private *pvt_data = dev_get_drvdata(&pdev->dev); ++ ++ tee_shm_free(pvt_data->shm); ++ tee_client_close_session(pvt_data->ctx, pvt_data->session); ++ tee_client_close_context(pvt_data->ctx); ++} ++ + static const struct of_device_id of_ftpm_tee_ids[] = { + { .compatible = "microsoft,ftpm" }, + { } +@@ -341,6 +354,7 @@ static struct platform_driver ftpm_tee_driver = { + }, + .probe = ftpm_tee_probe, + .remove = ftpm_tee_remove, ++ .shutdown = ftpm_tee_shutdown, + }; + + module_platform_driver(ftpm_tee_driver); +diff --git a/drivers/clk/at91/at91sam9260.c b/drivers/clk/at91/at91sam9260.c +index 0aabe49aed09..a9d4234758d7 100644 +--- a/drivers/clk/at91/at91sam9260.c ++++ b/drivers/clk/at91/at91sam9260.c +@@ -348,7 +348,7 @@ static void __init at91sam926x_pmc_setup(struct device_node *np, + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/clk/at91/at91sam9rl.c b/drivers/clk/at91/at91sam9rl.c +index 0ac34cdaa106..77fe83a73bf4 100644 +--- a/drivers/clk/at91/at91sam9rl.c ++++ b/drivers/clk/at91/at91sam9rl.c +@@ -83,7 +83,7 @@ static void __init at91sam9rl_pmc_setup(struct device_node *np) + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/clk/at91/at91sam9x5.c b/drivers/clk/at91/at91sam9x5.c +index 0855f3a80cc7..086cf0b4955c 100644 +--- a/drivers/clk/at91/at91sam9x5.c ++++ b/drivers/clk/at91/at91sam9x5.c +@@ -146,7 +146,7 @@ static void __init at91sam9x5_pmc_setup(struct device_node *np, + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/clk/at91/pmc.c b/drivers/clk/at91/pmc.c +index 0b03cfae3a9d..b71515acdec1 100644 +--- a/drivers/clk/at91/pmc.c ++++ b/drivers/clk/at91/pmc.c +@@ -275,7 +275,7 @@ static int __init pmc_register_ops(void) + + np = of_find_matching_node(NULL, sama5d2_pmc_dt_ids); + +- pmcreg = syscon_node_to_regmap(np); ++ pmcreg = device_node_to_regmap(np); + if (IS_ERR(pmcreg)) + return PTR_ERR(pmcreg); + +diff --git a/drivers/clk/at91/sama5d2.c b/drivers/clk/at91/sama5d2.c +index 0de1108737db..ff7e3f727082 100644 +--- a/drivers/clk/at91/sama5d2.c ++++ b/drivers/clk/at91/sama5d2.c +@@ -162,7 +162,7 @@ static void __init sama5d2_pmc_setup(struct device_node *np) + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/clk/at91/sama5d4.c b/drivers/clk/at91/sama5d4.c +index 25b156d4e645..a6dee4a3b6e4 100644 +--- a/drivers/clk/at91/sama5d4.c ++++ b/drivers/clk/at91/sama5d4.c +@@ -136,7 +136,7 @@ static void __init sama5d4_pmc_setup(struct device_node *np) + return; + mainxtal_name = of_clk_get_parent_name(np, i); + +- regmap = syscon_node_to_regmap(np); ++ regmap = device_node_to_regmap(np); + if (IS_ERR(regmap)) + return; + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 1c677d7f7f53..27a95c86a80b 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -3231,6 +3231,34 @@ static inline void clk_debug_unregister(struct clk_core *core) + } + #endif + ++static void clk_core_reparent_orphans_nolock(void) ++{ ++ struct clk_core *orphan; ++ struct hlist_node *tmp2; ++ ++ /* ++ * walk the list of orphan clocks and reparent any that newly finds a ++ * parent. ++ */ ++ hlist_for_each_entry_safe(orphan, tmp2, &clk_orphan_list, child_node) { ++ struct clk_core *parent = __clk_init_parent(orphan); ++ ++ /* ++ * We need to use __clk_set_parent_before() and _after() to ++ * to properly migrate any prepare/enable count of the orphan ++ * clock. This is important for CLK_IS_CRITICAL clocks, which ++ * are enabled during init but might not have a parent yet. ++ */ ++ if (parent) { ++ /* update the clk tree topology */ ++ __clk_set_parent_before(orphan, parent); ++ __clk_set_parent_after(orphan, parent, NULL); ++ __clk_recalc_accuracies(orphan); ++ __clk_recalc_rates(orphan, 0); ++ } ++ } ++} ++ + /** + * __clk_core_init - initialize the data structures in a struct clk_core + * @core: clk_core being initialized +@@ -3241,8 +3269,6 @@ static inline void clk_debug_unregister(struct clk_core *core) + static int __clk_core_init(struct clk_core *core) + { + int ret; +- struct clk_core *orphan; +- struct hlist_node *tmp2; + unsigned long rate; + + if (!core) +@@ -3389,27 +3415,8 @@ static int __clk_core_init(struct clk_core *core) + clk_enable_unlock(flags); + } + +- /* +- * walk the list of orphan clocks and reparent any that newly finds a +- * parent. +- */ +- hlist_for_each_entry_safe(orphan, tmp2, &clk_orphan_list, child_node) { +- struct clk_core *parent = __clk_init_parent(orphan); ++ clk_core_reparent_orphans_nolock(); + +- /* +- * We need to use __clk_set_parent_before() and _after() to +- * to properly migrate any prepare/enable count of the orphan +- * clock. This is important for CLK_IS_CRITICAL clocks, which +- * are enabled during init but might not have a parent yet. +- */ +- if (parent) { +- /* update the clk tree topology */ +- __clk_set_parent_before(orphan, parent); +- __clk_set_parent_after(orphan, parent, NULL); +- __clk_recalc_accuracies(orphan); +- __clk_recalc_rates(orphan, 0); +- } +- } + + kref_init(&core->ref); + out: +@@ -4160,6 +4167,13 @@ int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb) + EXPORT_SYMBOL_GPL(clk_notifier_unregister); + + #ifdef CONFIG_OF ++static void clk_core_reparent_orphans(void) ++{ ++ clk_prepare_lock(); ++ clk_core_reparent_orphans_nolock(); ++ clk_prepare_unlock(); ++} ++ + /** + * struct of_clk_provider - Clock provider registration structure + * @link: Entry in global list of clock providers +@@ -4255,6 +4269,8 @@ int of_clk_add_provider(struct device_node *np, + mutex_unlock(&of_clk_mutex); + pr_debug("Added clock from %pOF\n", np); + ++ clk_core_reparent_orphans(); ++ + ret = of_clk_set_defaults(np, true); + if (ret < 0) + of_clk_del_provider(np); +@@ -4290,6 +4306,8 @@ int of_clk_add_hw_provider(struct device_node *np, + mutex_unlock(&of_clk_mutex); + pr_debug("Added clk_hw provider from %pOF\n", np); + ++ clk_core_reparent_orphans(); ++ + ret = of_clk_set_defaults(np, true); + if (ret < 0) + of_clk_del_provider(np); +diff --git a/drivers/firmware/efi/earlycon.c b/drivers/firmware/efi/earlycon.c +index c9a0efca17b0..d4077db6dc97 100644 +--- a/drivers/firmware/efi/earlycon.c ++++ b/drivers/firmware/efi/earlycon.c +@@ -13,18 +13,57 @@ + + #include + ++static const struct console *earlycon_console __initdata; + static const struct font_desc *font; + static u32 efi_x, efi_y; + static u64 fb_base; + static pgprot_t fb_prot; ++static void *efi_fb; ++ ++/* ++ * EFI earlycon needs to use early_memremap() to map the framebuffer. ++ * But early_memremap() is not usable for 'earlycon=efifb keep_bootcon', ++ * memremap() should be used instead. memremap() will be available after ++ * paging_init() which is earlier than initcall callbacks. Thus adding this ++ * early initcall function early_efi_map_fb() to map the whole EFI framebuffer. ++ */ ++static int __init efi_earlycon_remap_fb(void) ++{ ++ /* bail if there is no bootconsole or it has been disabled already */ ++ if (!earlycon_console || !(earlycon_console->flags & CON_ENABLED)) ++ return 0; ++ ++ if (pgprot_val(fb_prot) == pgprot_val(PAGE_KERNEL)) ++ efi_fb = memremap(fb_base, screen_info.lfb_size, MEMREMAP_WB); ++ else ++ efi_fb = memremap(fb_base, screen_info.lfb_size, MEMREMAP_WC); ++ ++ return efi_fb ? 0 : -ENOMEM; ++} ++early_initcall(efi_earlycon_remap_fb); ++ ++static int __init efi_earlycon_unmap_fb(void) ++{ ++ /* unmap the bootconsole fb unless keep_bootcon has left it enabled */ ++ if (efi_fb && !(earlycon_console->flags & CON_ENABLED)) ++ memunmap(efi_fb); ++ return 0; ++} ++late_initcall(efi_earlycon_unmap_fb); + + static __ref void *efi_earlycon_map(unsigned long start, unsigned long len) + { ++ if (efi_fb) ++ return efi_fb + start; ++ + return early_memremap_prot(fb_base + start, len, pgprot_val(fb_prot)); + } + + static __ref void efi_earlycon_unmap(void *addr, unsigned long len) + { ++ if (efi_fb) ++ return; ++ + early_memunmap(addr, len); + } + +@@ -201,6 +240,7 @@ static int __init efi_earlycon_setup(struct earlycon_device *device, + efi_earlycon_scroll_up(); + + device->con->write = efi_earlycon_write; ++ earlycon_console = device->con; + return 0; + } + EARLYCON_DECLARE(efifb, efi_earlycon_setup); +diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c +index 0101ca4c13b1..b7bf1e993b8b 100644 +--- a/drivers/firmware/efi/libstub/gop.c ++++ b/drivers/firmware/efi/libstub/gop.c +@@ -83,30 +83,6 @@ setup_pixel_info(struct screen_info *si, u32 pixels_per_scan_line, + } + } + +-static efi_status_t +-__gop_query32(efi_system_table_t *sys_table_arg, +- struct efi_graphics_output_protocol_32 *gop32, +- struct efi_graphics_output_mode_info **info, +- unsigned long *size, u64 *fb_base) +-{ +- struct efi_graphics_output_protocol_mode_32 *mode; +- efi_graphics_output_protocol_query_mode query_mode; +- efi_status_t status; +- unsigned long m; +- +- m = gop32->mode; +- mode = (struct efi_graphics_output_protocol_mode_32 *)m; +- query_mode = (void *)(unsigned long)gop32->query_mode; +- +- status = __efi_call_early(query_mode, (void *)gop32, mode->mode, size, +- info); +- if (status != EFI_SUCCESS) +- return status; +- +- *fb_base = mode->frame_buffer_base; +- return status; +-} +- + static efi_status_t + setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + efi_guid_t *proto, unsigned long size, void **gop_handle) +@@ -119,7 +95,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + u64 fb_base; + struct efi_pixel_bitmask pixel_info; + int pixel_format; +- efi_status_t status = EFI_NOT_FOUND; ++ efi_status_t status; + u32 *handles = (u32 *)(unsigned long)gop_handle; + int i; + +@@ -128,6 +104,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + + nr_gops = size / sizeof(u32); + for (i = 0; i < nr_gops; i++) { ++ struct efi_graphics_output_protocol_mode_32 *mode; + struct efi_graphics_output_mode_info *info = NULL; + efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID; + bool conout_found = false; +@@ -145,9 +122,11 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + if (status == EFI_SUCCESS) + conout_found = true; + +- status = __gop_query32(sys_table_arg, gop32, &info, &size, +- ¤t_fb_base); +- if (status == EFI_SUCCESS && (!first_gop || conout_found) && ++ mode = (void *)(unsigned long)gop32->mode; ++ info = (void *)(unsigned long)mode->info; ++ current_fb_base = mode->frame_buffer_base; ++ ++ if ((!first_gop || conout_found) && + info->pixel_format != PIXEL_BLT_ONLY) { + /* + * Systems that use the UEFI Console Splitter may +@@ -175,7 +154,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + + /* Did we find any GOPs? */ + if (!first_gop) +- goto out; ++ return EFI_NOT_FOUND; + + /* EFI framebuffer */ + si->orig_video_isVGA = VIDEO_TYPE_EFI; +@@ -197,32 +176,8 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, + si->lfb_size = si->lfb_linelength * si->lfb_height; + + si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS; +-out: +- return status; +-} +- +-static efi_status_t +-__gop_query64(efi_system_table_t *sys_table_arg, +- struct efi_graphics_output_protocol_64 *gop64, +- struct efi_graphics_output_mode_info **info, +- unsigned long *size, u64 *fb_base) +-{ +- struct efi_graphics_output_protocol_mode_64 *mode; +- efi_graphics_output_protocol_query_mode query_mode; +- efi_status_t status; +- unsigned long m; +- +- m = gop64->mode; +- mode = (struct efi_graphics_output_protocol_mode_64 *)m; +- query_mode = (void *)(unsigned long)gop64->query_mode; +- +- status = __efi_call_early(query_mode, (void *)gop64, mode->mode, size, +- info); +- if (status != EFI_SUCCESS) +- return status; + +- *fb_base = mode->frame_buffer_base; +- return status; ++ return EFI_SUCCESS; + } + + static efi_status_t +@@ -237,7 +192,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + u64 fb_base; + struct efi_pixel_bitmask pixel_info; + int pixel_format; +- efi_status_t status = EFI_NOT_FOUND; ++ efi_status_t status; + u64 *handles = (u64 *)(unsigned long)gop_handle; + int i; + +@@ -246,6 +201,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + + nr_gops = size / sizeof(u64); + for (i = 0; i < nr_gops; i++) { ++ struct efi_graphics_output_protocol_mode_64 *mode; + struct efi_graphics_output_mode_info *info = NULL; + efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID; + bool conout_found = false; +@@ -263,9 +219,11 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + if (status == EFI_SUCCESS) + conout_found = true; + +- status = __gop_query64(sys_table_arg, gop64, &info, &size, +- ¤t_fb_base); +- if (status == EFI_SUCCESS && (!first_gop || conout_found) && ++ mode = (void *)(unsigned long)gop64->mode; ++ info = (void *)(unsigned long)mode->info; ++ current_fb_base = mode->frame_buffer_base; ++ ++ if ((!first_gop || conout_found) && + info->pixel_format != PIXEL_BLT_ONLY) { + /* + * Systems that use the UEFI Console Splitter may +@@ -293,7 +251,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + + /* Did we find any GOPs? */ + if (!first_gop) +- goto out; ++ return EFI_NOT_FOUND; + + /* EFI framebuffer */ + si->orig_video_isVGA = VIDEO_TYPE_EFI; +@@ -315,8 +273,8 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, + si->lfb_size = si->lfb_linelength * si->lfb_height; + + si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS; +-out: +- return status; ++ ++ return EFI_SUCCESS; + } + + /* +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index 80ea49f570f4..43ffec3a6fbb 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -23,6 +23,29 @@ + #include "gpiolib.h" + #include "gpiolib-of.h" + ++/** ++ * of_gpio_spi_cs_get_count() - special GPIO counting for SPI ++ * Some elder GPIO controllers need special quirks. Currently we handle ++ * the Freescale GPIO controller with bindings that doesn't use the ++ * established "cs-gpios" for chip selects but instead rely on ++ * "gpios" for the chip select lines. If we detect this, we redirect ++ * the counting of "cs-gpios" to count "gpios" transparent to the ++ * driver. ++ */ ++int of_gpio_spi_cs_get_count(struct device *dev, const char *con_id) ++{ ++ struct device_node *np = dev->of_node; ++ ++ if (!IS_ENABLED(CONFIG_SPI_MASTER)) ++ return 0; ++ if (!con_id || strcmp(con_id, "cs")) ++ return 0; ++ if (!of_device_is_compatible(np, "fsl,spi") && ++ !of_device_is_compatible(np, "aeroflexgaisler,spictrl")) ++ return 0; ++ return of_gpio_named_count(np, "gpios"); ++} ++ + /* + * This is used by external users of of_gpio_count() from + * +@@ -35,6 +58,10 @@ int of_gpio_get_count(struct device *dev, const char *con_id) + char propname[32]; + unsigned int i; + ++ ret = of_gpio_spi_cs_get_count(dev, con_id); ++ if (ret > 0) ++ return ret; ++ + for (i = 0; i < ARRAY_SIZE(gpio_suffixes); i++) { + if (con_id) + snprintf(propname, sizeof(propname), "%s-%s", +diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +index 7ae087b0504d..88b6fcaa20be 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +@@ -1313,6 +1313,7 @@ static int gsc_remove(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + ++ component_del(dev, &gsc_component_ops); + pm_runtime_dont_use_autosuspend(dev); + pm_runtime_disable(dev); + +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index f321279baf9e..51456e7f264f 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -43,7 +44,6 @@ struct iommu_dma_cookie { + dma_addr_t msi_iova; + }; + struct list_head msi_page_list; +- spinlock_t msi_lock; + + /* Domain for flush queue callback; NULL if flush queue not in use */ + struct iommu_domain *fq_domain; +@@ -62,7 +62,6 @@ static struct iommu_dma_cookie *cookie_alloc(enum iommu_dma_cookie_type type) + + cookie = kzalloc(sizeof(*cookie), GFP_KERNEL); + if (cookie) { +- spin_lock_init(&cookie->msi_lock); + INIT_LIST_HEAD(&cookie->msi_page_list); + cookie->type = type; + } +@@ -1150,7 +1149,7 @@ static struct iommu_dma_msi_page *iommu_dma_get_msi_page(struct device *dev, + if (msi_page->phys == msi_addr) + return msi_page; + +- msi_page = kzalloc(sizeof(*msi_page), GFP_ATOMIC); ++ msi_page = kzalloc(sizeof(*msi_page), GFP_KERNEL); + if (!msi_page) + return NULL; + +@@ -1180,7 +1179,7 @@ int iommu_dma_prepare_msi(struct msi_desc *desc, phys_addr_t msi_addr) + struct iommu_domain *domain = iommu_get_domain_for_dev(dev); + struct iommu_dma_cookie *cookie; + struct iommu_dma_msi_page *msi_page; +- unsigned long flags; ++ static DEFINE_MUTEX(msi_prepare_lock); /* see below */ + + if (!domain || !domain->iova_cookie) { + desc->iommu_cookie = NULL; +@@ -1190,13 +1189,13 @@ int iommu_dma_prepare_msi(struct msi_desc *desc, phys_addr_t msi_addr) + cookie = domain->iova_cookie; + + /* +- * We disable IRQs to rule out a possible inversion against +- * irq_desc_lock if, say, someone tries to retarget the affinity +- * of an MSI from within an IPI handler. ++ * In fact the whole prepare operation should already be serialised by ++ * irq_domain_mutex further up the callchain, but that's pretty subtle ++ * on its own, so consider this locking as failsafe documentation... + */ +- spin_lock_irqsave(&cookie->msi_lock, flags); ++ mutex_lock(&msi_prepare_lock); + msi_page = iommu_dma_get_msi_page(dev, msi_addr, domain); +- spin_unlock_irqrestore(&cookie->msi_lock, flags); ++ mutex_unlock(&msi_prepare_lock); + + msi_desc_set_iommu_cookie(desc, msi_page); + +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index 41c605b0058f..c7a914b9bbbc 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -233,7 +233,7 @@ static DEFINE_MUTEX(iova_cache_mutex); + + struct iova *alloc_iova_mem(void) + { +- return kmem_cache_alloc(iova_cache, GFP_ATOMIC); ++ return kmem_cache_zalloc(iova_cache, GFP_ATOMIC); + } + EXPORT_SYMBOL(alloc_iova_mem); + +diff --git a/drivers/misc/habanalabs/command_submission.c b/drivers/misc/habanalabs/command_submission.c +index a9ac045dcfde..447f307ef4d6 100644 +--- a/drivers/misc/habanalabs/command_submission.c ++++ b/drivers/misc/habanalabs/command_submission.c +@@ -777,8 +777,9 @@ int hl_cs_wait_ioctl(struct hl_fpriv *hpriv, void *data) + memset(args, 0, sizeof(*args)); + + if (rc < 0) { +- dev_err(hdev->dev, "Error %ld on waiting for CS handle %llu\n", +- rc, seq); ++ dev_err_ratelimited(hdev->dev, ++ "Error %ld on waiting for CS handle %llu\n", ++ rc, seq); + if (rc == -ERESTARTSYS) { + args->out.status = HL_WAIT_CS_STATUS_INTERRUPTED; + rc = -EINTR; +diff --git a/drivers/misc/habanalabs/context.c b/drivers/misc/habanalabs/context.c +index 17db7b3dfb4c..2df6fb87e7ff 100644 +--- a/drivers/misc/habanalabs/context.c ++++ b/drivers/misc/habanalabs/context.c +@@ -176,7 +176,7 @@ struct dma_fence *hl_ctx_get_fence(struct hl_ctx *ctx, u64 seq) + spin_lock(&ctx->cs_lock); + + if (seq >= ctx->cs_sequence) { +- dev_notice(hdev->dev, ++ dev_notice_ratelimited(hdev->dev, + "Can't wait on seq %llu because current CS is at seq %llu\n", + seq, ctx->cs_sequence); + spin_unlock(&ctx->cs_lock); +diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c +index 6fba14b81f90..fe3574a83b7c 100644 +--- a/drivers/misc/habanalabs/goya/goya.c ++++ b/drivers/misc/habanalabs/goya/goya.c +@@ -2171,7 +2171,7 @@ static int goya_push_linux_to_device(struct hl_device *hdev) + + static int goya_pldm_init_cpu(struct hl_device *hdev) + { +- u32 val, unit_rst_val; ++ u32 unit_rst_val; + int rc; + + /* Must initialize SRAM scrambler before pushing u-boot to SRAM */ +@@ -2179,14 +2179,14 @@ static int goya_pldm_init_cpu(struct hl_device *hdev) + + /* Put ARM cores into reset */ + WREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL, CPU_RESET_ASSERT); +- val = RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL); ++ RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL); + + /* Reset the CA53 MACRO */ + unit_rst_val = RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); + WREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N, CA53_RESET); +- val = RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); ++ RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); + WREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N, unit_rst_val); +- val = RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); ++ RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N); + + rc = goya_push_uboot_to_device(hdev); + if (rc) +@@ -2207,7 +2207,7 @@ static int goya_pldm_init_cpu(struct hl_device *hdev) + /* Release ARM core 0 from reset */ + WREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL, + CPU_RESET_CORE0_DEASSERT); +- val = RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL); ++ RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL); + + return 0; + } +@@ -2475,13 +2475,12 @@ err: + static int goya_hw_init(struct hl_device *hdev) + { + struct asic_fixed_properties *prop = &hdev->asic_prop; +- u32 val; + int rc; + + dev_info(hdev->dev, "Starting initialization of H/W\n"); + + /* Perform read from the device to make sure device is up */ +- val = RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG); ++ RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG); + + /* + * Let's mark in the H/W that we have reached this point. We check +@@ -2533,7 +2532,7 @@ static int goya_hw_init(struct hl_device *hdev) + goto disable_queues; + + /* Perform read from the device to flush all MSI-X configuration */ +- val = RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG); ++ RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG); + + return 0; + +diff --git a/drivers/misc/ocxl/context.c b/drivers/misc/ocxl/context.c +index 994563a078eb..de8a66b9d76b 100644 +--- a/drivers/misc/ocxl/context.c ++++ b/drivers/misc/ocxl/context.c +@@ -10,18 +10,17 @@ int ocxl_context_alloc(struct ocxl_context **context, struct ocxl_afu *afu, + int pasid; + struct ocxl_context *ctx; + +- *context = kzalloc(sizeof(struct ocxl_context), GFP_KERNEL); +- if (!*context) ++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); ++ if (!ctx) + return -ENOMEM; + +- ctx = *context; +- + ctx->afu = afu; + mutex_lock(&afu->contexts_lock); + pasid = idr_alloc(&afu->contexts_idr, ctx, afu->pasid_base, + afu->pasid_base + afu->pasid_max, GFP_KERNEL); + if (pasid < 0) { + mutex_unlock(&afu->contexts_lock); ++ kfree(ctx); + return pasid; + } + afu->pasid_count++; +@@ -43,6 +42,7 @@ int ocxl_context_alloc(struct ocxl_context **context, struct ocxl_afu *afu, + * duration of the life of the context + */ + ocxl_afu_get(afu); ++ *context = ctx; + return 0; + } + EXPORT_SYMBOL_GPL(ocxl_context_alloc); +diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c +index 25ec4c0ac589..8a903624fdd7 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.c ++++ b/drivers/net/dsa/mv88e6xxx/global1.c +@@ -332,6 +332,11 @@ int mv88e6390_g1_set_cpu_port(struct mv88e6xxx_chip *chip, int port) + { + u16 ptr = MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST; + ++ /* Use the default high priority for management frames sent to ++ * the CPU. ++ */ ++ port |= MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST_MGMTPRI; ++ + return mv88e6390_g1_monitor_write(chip, ptr, port); + } + +diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h +index 0870fcc8bfc8..0ae96a1e919b 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.h ++++ b/drivers/net/dsa/mv88e6xxx/global1.h +@@ -210,6 +210,7 @@ + #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_INGRESS_DEST 0x2000 + #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_EGRESS_DEST 0x2100 + #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST 0x3000 ++#define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST_MGMTPRI 0x00e0 + #define MV88E6390_G1_MONITOR_MGMT_CTL_DATA_MASK 0x00ff + + /* Offset 0x1C: Global Control 2 */ +diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c +index 15ef81654b67..330c41e87171 100644 +--- a/drivers/net/dsa/mv88e6xxx/port.c ++++ b/drivers/net/dsa/mv88e6xxx/port.c +@@ -393,7 +393,7 @@ phy_interface_t mv88e6390x_port_max_speed_mode(int port) + } + + static int mv88e6xxx_port_set_cmode(struct mv88e6xxx_chip *chip, int port, +- phy_interface_t mode) ++ phy_interface_t mode, bool force) + { + u8 lane; + u16 cmode; +@@ -427,8 +427,8 @@ static int mv88e6xxx_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + cmode = 0; + } + +- /* cmode doesn't change, nothing to do for us */ +- if (cmode == chip->ports[port].cmode) ++ /* cmode doesn't change, nothing to do for us unless forced */ ++ if (cmode == chip->ports[port].cmode && !force) + return 0; + + lane = mv88e6xxx_serdes_get_lane(chip, port); +@@ -484,7 +484,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + if (port != 9 && port != 10) + return -EOPNOTSUPP; + +- return mv88e6xxx_port_set_cmode(chip, port, mode); ++ return mv88e6xxx_port_set_cmode(chip, port, mode, false); + } + + int mv88e6390_port_set_cmode(struct mv88e6xxx_chip *chip, int port, +@@ -504,7 +504,7 @@ int mv88e6390_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + break; + } + +- return mv88e6xxx_port_set_cmode(chip, port, mode); ++ return mv88e6xxx_port_set_cmode(chip, port, mode, false); + } + + static int mv88e6341_port_set_cmode_writable(struct mv88e6xxx_chip *chip, +@@ -555,7 +555,7 @@ int mv88e6341_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + if (err) + return err; + +- return mv88e6xxx_port_set_cmode(chip, port, mode); ++ return mv88e6xxx_port_set_cmode(chip, port, mode, true); + } + + int mv88e6185_port_get_cmode(struct mv88e6xxx_chip *chip, int port, u8 *cmode) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +index 8b08cb18e363..3f63ffd7561b 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +@@ -1109,7 +1109,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp) + for (i = 0; i < E1H_FUNC_MAX / 2; i++) { + u32 func_config = + MF_CFG_RD(bp, +- func_mf_config[BP_PORT(bp) + 2 * i]. ++ func_mf_config[BP_PATH(bp) + 2 * i]. + config); + func_num += + ((func_config & FUNC_MF_CFG_FUNC_HIDE) ? 0 : 1); +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 192ff8d5da32..cff64e43bdd8 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9976,10 +9976,18 @@ static void bnx2x_recovery_failed(struct bnx2x *bp) + */ + static void bnx2x_parity_recover(struct bnx2x *bp) + { +- bool global = false; + u32 error_recovered, error_unrecovered; +- bool is_parity; ++ bool is_parity, global = false; ++#ifdef CONFIG_BNX2X_SRIOV ++ int vf_idx; ++ ++ for (vf_idx = 0; vf_idx < bp->requested_nr_virtfn; vf_idx++) { ++ struct bnx2x_virtf *vf = BP_VF(bp, vf_idx); + ++ if (vf) ++ vf->state = VF_LOST; ++ } ++#endif + DP(NETIF_MSG_HW, "Handling parity\n"); + while (1) { + switch (bp->recovery_state) { +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +index b6ebd92ec565..3a716c015415 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +@@ -139,6 +139,7 @@ struct bnx2x_virtf { + #define VF_ACQUIRED 1 /* VF acquired, but not initialized */ + #define VF_ENABLED 2 /* VF Enabled */ + #define VF_RESET 3 /* VF FLR'd, pending cleanup */ ++#define VF_LOST 4 /* Recovery while VFs are loaded */ + + bool flr_clnup_stage; /* true during flr cleanup */ + bool malicious; /* true if FW indicated so, until FLR */ +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +index 0752b7fa4d9c..ea0e9394f898 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +@@ -2107,6 +2107,18 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf, + { + int i; + ++ if (vf->state == VF_LOST) { ++ /* Just ack the FW and return if VFs are lost ++ * in case of parity error. VFs are supposed to be timedout ++ * on waiting for PF response. ++ */ ++ DP(BNX2X_MSG_IOV, ++ "VF 0x%x lost, not handling the request\n", vf->abs_vfid); ++ ++ storm_memset_vf_mbx_ack(bp, vf->abs_vfid); ++ return; ++ } ++ + /* check if tlv type is known */ + if (bnx2x_tlv_supported(mbx->first_tlv.tl.type)) { + /* Lock the per vf op mutex and note the locker's identity. +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 0f10a272827c..f496b248bda3 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -4027,7 +4027,7 @@ static int fu540_c000_clk_init(struct platform_device *pdev, struct clk **pclk, + mgmt->rate = 0; + mgmt->hw.init = &init; + +- *tx_clk = clk_register(NULL, &mgmt->hw); ++ *tx_clk = devm_clk_register(&pdev->dev, &mgmt->hw); + if (IS_ERR(*tx_clk)) + return PTR_ERR(*tx_clk); + +@@ -4361,7 +4361,6 @@ err_out_free_netdev: + + err_disable_clocks: + clk_disable_unprepare(tx_clk); +- clk_unregister(tx_clk); + clk_disable_unprepare(hclk); + clk_disable_unprepare(pclk); + clk_disable_unprepare(rx_clk); +@@ -4397,7 +4396,6 @@ static int macb_remove(struct platform_device *pdev) + pm_runtime_dont_use_autosuspend(&pdev->dev); + if (!pm_runtime_suspended(&pdev->dev)) { + clk_disable_unprepare(bp->tx_clk); +- clk_unregister(bp->tx_clk); + clk_disable_unprepare(bp->hclk); + clk_disable_unprepare(bp->pclk); + clk_disable_unprepare(bp->rx_clk); +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +index ae6a47dd7dc9..fb8ade9a05a9 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +@@ -2996,6 +2996,9 @@ static int sge_queue_entries(const struct adapter *adap) + int tot_uld_entries = 0; + int i; + ++ if (!is_uld(adap)) ++ goto lld_only; ++ + mutex_lock(&uld_mutex); + for (i = 0; i < CXGB4_TX_MAX; i++) + tot_uld_entries += sge_qinfo_uld_txq_entries(adap, i); +@@ -3006,6 +3009,7 @@ static int sge_queue_entries(const struct adapter *adap) + } + mutex_unlock(&uld_mutex); + ++lld_only: + return DIV_ROUND_UP(adap->sge.ethqsets, 4) + + tot_uld_entries + + DIV_ROUND_UP(MAX_CTRL_QUEUES, 4) + 1; +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 4bb30761abfc..8336f4cbaf95 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -2199,8 +2199,14 @@ static void fec_enet_get_regs(struct net_device *ndev, + { + struct fec_enet_private *fep = netdev_priv(ndev); + u32 __iomem *theregs = (u32 __iomem *)fep->hwp; ++ struct device *dev = &fep->pdev->dev; + u32 *buf = (u32 *)regbuf; + u32 i, off; ++ int ret; ++ ++ ret = pm_runtime_get_sync(dev); ++ if (ret < 0) ++ return; + + regs->version = fec_enet_register_version; + +@@ -2216,6 +2222,9 @@ static void fec_enet_get_regs(struct net_device *ndev, + off >>= 2; + buf[off] = readl(&theregs[off]); + } ++ ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); + } + + static int fec_enet_get_ts_info(struct net_device *ndev, +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 2af9f6308f84..401304d4d553 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -1151,7 +1151,7 @@ void i40e_set_fec_in_flags(u8 fec_cfg, u32 *flags); + + static inline bool i40e_enabled_xdp_vsi(struct i40e_vsi *vsi) + { +- return !!vsi->xdp_prog; ++ return !!READ_ONCE(vsi->xdp_prog); + } + + int i40e_create_queue_channel(struct i40e_vsi *vsi, struct i40e_channel *ch); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 339925af0206..4960c9c3e773 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -6804,8 +6804,8 @@ void i40e_down(struct i40e_vsi *vsi) + for (i = 0; i < vsi->num_queue_pairs; i++) { + i40e_clean_tx_ring(vsi->tx_rings[i]); + if (i40e_enabled_xdp_vsi(vsi)) { +- /* Make sure that in-progress ndo_xdp_xmit +- * calls are completed. ++ /* Make sure that in-progress ndo_xdp_xmit and ++ * ndo_xsk_wakeup calls are completed. + */ + synchronize_rcu(); + i40e_clean_tx_ring(vsi->xdp_rings[i]); +@@ -12526,8 +12526,12 @@ static int i40e_xdp_setup(struct i40e_vsi *vsi, + + old_prog = xchg(&vsi->xdp_prog, prog); + +- if (need_reset) ++ if (need_reset) { ++ if (!prog) ++ /* Wait until ndo_xsk_wakeup completes. */ ++ synchronize_rcu(); + i40e_reset_and_rebuild(pf, true, true); ++ } + + for (i = 0; i < vsi->num_queue_pairs; i++) + WRITE_ONCE(vsi->rx_rings[i]->xdp_prog, vsi->xdp_prog); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +index d07e1a890428..f73cd917c44f 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +@@ -787,8 +787,12 @@ int i40e_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags) + { + struct i40e_netdev_priv *np = netdev_priv(dev); + struct i40e_vsi *vsi = np->vsi; ++ struct i40e_pf *pf = vsi->back; + struct i40e_ring *ring; + ++ if (test_bit(__I40E_CONFIG_BUSY, pf->state)) ++ return -ENETDOWN; ++ + if (test_bit(__I40E_VSI_DOWN, vsi->state)) + return -ENETDOWN; + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 1a7203fede12..c6404abf2dd1 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -10248,7 +10248,12 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog) + + /* If transitioning XDP modes reconfigure rings */ + if (need_reset) { +- int err = ixgbe_setup_tc(dev, adapter->hw_tcs); ++ int err; ++ ++ if (!prog) ++ /* Wait until ndo_xsk_wakeup completes. */ ++ synchronize_rcu(); ++ err = ixgbe_setup_tc(dev, adapter->hw_tcs); + + if (err) { + rcu_assign_pointer(adapter->xdp_prog, old_prog); +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c +index d6feaacfbf89..b43be9f14105 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c +@@ -709,10 +709,14 @@ int ixgbe_xsk_wakeup(struct net_device *dev, u32 qid, u32 flags) + if (qid >= adapter->num_xdp_queues) + return -ENXIO; + +- if (!adapter->xdp_ring[qid]->xsk_umem) ++ ring = adapter->xdp_ring[qid]; ++ ++ if (test_bit(__IXGBE_TX_DISABLED, &ring->state)) ++ return -ENETDOWN; ++ ++ if (!ring->xsk_umem) + return -ENXIO; + +- ring = adapter->xdp_ring[qid]; + if (!napi_if_scheduled_mark_missed(&ring->q_vector->napi)) { + u64 eics = BIT_ULL(ring->q_vector->v_idx); + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index 2c16add0b642..9c8427698238 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -760,7 +760,7 @@ enum { + MLX5E_STATE_OPENED, + MLX5E_STATE_DESTROYING, + MLX5E_STATE_XDP_TX_ENABLED, +- MLX5E_STATE_XDP_OPEN, ++ MLX5E_STATE_XDP_ACTIVE, + }; + + struct mlx5e_rqt { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +index 68d593074f6c..d48292ccda29 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +@@ -122,6 +122,22 @@ enum { + #endif + }; + ++#define MLX5E_TTC_NUM_GROUPS 3 ++#define MLX5E_TTC_GROUP1_SIZE (BIT(3) + MLX5E_NUM_TUNNEL_TT) ++#define MLX5E_TTC_GROUP2_SIZE BIT(1) ++#define MLX5E_TTC_GROUP3_SIZE BIT(0) ++#define MLX5E_TTC_TABLE_SIZE (MLX5E_TTC_GROUP1_SIZE +\ ++ MLX5E_TTC_GROUP2_SIZE +\ ++ MLX5E_TTC_GROUP3_SIZE) ++ ++#define MLX5E_INNER_TTC_NUM_GROUPS 3 ++#define MLX5E_INNER_TTC_GROUP1_SIZE BIT(3) ++#define MLX5E_INNER_TTC_GROUP2_SIZE BIT(1) ++#define MLX5E_INNER_TTC_GROUP3_SIZE BIT(0) ++#define MLX5E_INNER_TTC_TABLE_SIZE (MLX5E_INNER_TTC_GROUP1_SIZE +\ ++ MLX5E_INNER_TTC_GROUP2_SIZE +\ ++ MLX5E_INNER_TTC_GROUP3_SIZE) ++ + #ifdef CONFIG_MLX5_EN_RXNFC + + struct mlx5e_ethtool_table { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c +index 1d6b58860da6..3a975641f902 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c +@@ -197,9 +197,10 @@ int mlx5e_health_report(struct mlx5e_priv *priv, + struct devlink_health_reporter *reporter, char *err_str, + struct mlx5e_err_ctx *err_ctx) + { +- if (!reporter) { +- netdev_err(priv->netdev, err_str); ++ netdev_err(priv->netdev, err_str); ++ ++ if (!reporter) + return err_ctx->recover(&err_ctx->ctx); +- } ++ + return devlink_health_report(reporter, err_str, err_ctx); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h +index 36ac1e3816b9..d7587f40ecae 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h +@@ -75,12 +75,18 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, + static inline void mlx5e_xdp_tx_enable(struct mlx5e_priv *priv) + { + set_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state); ++ ++ if (priv->channels.params.xdp_prog) ++ set_bit(MLX5E_STATE_XDP_ACTIVE, &priv->state); + } + + static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv) + { ++ if (priv->channels.params.xdp_prog) ++ clear_bit(MLX5E_STATE_XDP_ACTIVE, &priv->state); ++ + clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state); +- /* let other device's napi(s) see our new state */ ++ /* Let other device's napi(s) and XSK wakeups see our new state. */ + synchronize_rcu(); + } + +@@ -89,19 +95,9 @@ static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv) + return test_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state); + } + +-static inline void mlx5e_xdp_set_open(struct mlx5e_priv *priv) +-{ +- set_bit(MLX5E_STATE_XDP_OPEN, &priv->state); +-} +- +-static inline void mlx5e_xdp_set_closed(struct mlx5e_priv *priv) +-{ +- clear_bit(MLX5E_STATE_XDP_OPEN, &priv->state); +-} +- +-static inline bool mlx5e_xdp_is_open(struct mlx5e_priv *priv) ++static inline bool mlx5e_xdp_is_active(struct mlx5e_priv *priv) + { +- return test_bit(MLX5E_STATE_XDP_OPEN, &priv->state); ++ return test_bit(MLX5E_STATE_XDP_ACTIVE, &priv->state); + } + + static inline void mlx5e_xmit_xdp_doorbell(struct mlx5e_xdpsq *sq) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +index 631af8dee517..c28cbae42331 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +@@ -144,6 +144,7 @@ void mlx5e_close_xsk(struct mlx5e_channel *c) + { + clear_bit(MLX5E_CHANNEL_STATE_XSK, c->state); + napi_synchronize(&c->napi); ++ synchronize_rcu(); /* Sync with the XSK wakeup. */ + + mlx5e_close_rq(&c->xskrq); + mlx5e_close_cq(&c->xskrq.cq); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c +index 87827477d38c..fe2d596cb361 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c +@@ -14,7 +14,7 @@ int mlx5e_xsk_wakeup(struct net_device *dev, u32 qid, u32 flags) + struct mlx5e_channel *c; + u16 ix; + +- if (unlikely(!mlx5e_xdp_is_open(priv))) ++ if (unlikely(!mlx5e_xdp_is_active(priv))) + return -ENETDOWN; + + if (unlikely(!mlx5e_qid_get_ch_if_in_group(params, qid, MLX5E_RQ_GROUP_XSK, &ix))) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +index 15b7f0f1427c..73d3dc07331f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -904,22 +904,6 @@ del_rules: + return err; + } + +-#define MLX5E_TTC_NUM_GROUPS 3 +-#define MLX5E_TTC_GROUP1_SIZE (BIT(3) + MLX5E_NUM_TUNNEL_TT) +-#define MLX5E_TTC_GROUP2_SIZE BIT(1) +-#define MLX5E_TTC_GROUP3_SIZE BIT(0) +-#define MLX5E_TTC_TABLE_SIZE (MLX5E_TTC_GROUP1_SIZE +\ +- MLX5E_TTC_GROUP2_SIZE +\ +- MLX5E_TTC_GROUP3_SIZE) +- +-#define MLX5E_INNER_TTC_NUM_GROUPS 3 +-#define MLX5E_INNER_TTC_GROUP1_SIZE BIT(3) +-#define MLX5E_INNER_TTC_GROUP2_SIZE BIT(1) +-#define MLX5E_INNER_TTC_GROUP3_SIZE BIT(0) +-#define MLX5E_INNER_TTC_TABLE_SIZE (MLX5E_INNER_TTC_GROUP1_SIZE +\ +- MLX5E_INNER_TTC_GROUP2_SIZE +\ +- MLX5E_INNER_TTC_GROUP3_SIZE) +- + static int mlx5e_create_ttc_table_groups(struct mlx5e_ttc_table *ttc, + bool use_ipv) + { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 6abd4ed5b69b..29a5a8c894e3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3002,12 +3002,9 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv) + int mlx5e_open_locked(struct net_device *netdev) + { + struct mlx5e_priv *priv = netdev_priv(netdev); +- bool is_xdp = priv->channels.params.xdp_prog; + int err; + + set_bit(MLX5E_STATE_OPENED, &priv->state); +- if (is_xdp) +- mlx5e_xdp_set_open(priv); + + err = mlx5e_open_channels(priv, &priv->channels); + if (err) +@@ -3022,8 +3019,6 @@ int mlx5e_open_locked(struct net_device *netdev) + return 0; + + err_clear_state_opened_flag: +- if (is_xdp) +- mlx5e_xdp_set_closed(priv); + clear_bit(MLX5E_STATE_OPENED, &priv->state); + return err; + } +@@ -3055,8 +3050,6 @@ int mlx5e_close_locked(struct net_device *netdev) + if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) + return 0; + +- if (priv->channels.params.xdp_prog) +- mlx5e_xdp_set_closed(priv); + clear_bit(MLX5E_STATE_OPENED, &priv->state); + + netif_carrier_off(priv->netdev); +@@ -4373,16 +4366,6 @@ static int mlx5e_xdp_allowed(struct mlx5e_priv *priv, struct bpf_prog *prog) + return 0; + } + +-static int mlx5e_xdp_update_state(struct mlx5e_priv *priv) +-{ +- if (priv->channels.params.xdp_prog) +- mlx5e_xdp_set_open(priv); +- else +- mlx5e_xdp_set_closed(priv); +- +- return 0; +-} +- + static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog) + { + struct mlx5e_priv *priv = netdev_priv(netdev); +@@ -4422,7 +4405,7 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog) + mlx5e_set_rq_type(priv->mdev, &new_channels.params); + old_prog = priv->channels.params.xdp_prog; + +- err = mlx5e_safe_switch_channels(priv, &new_channels, mlx5e_xdp_update_state); ++ err = mlx5e_safe_switch_channels(priv, &new_channels, NULL); + if (err) + goto unlock; + } else { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 814a4ba4e7fa..947122c68493 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -586,7 +586,7 @@ static void mlx5e_hairpin_set_ttc_params(struct mlx5e_hairpin *hp, + for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) + ttc_params->indir_tirn[tt] = hp->indir_tirn[tt]; + +- ft_attr->max_fte = MLX5E_NUM_TT; ++ ft_attr->max_fte = MLX5E_TTC_TABLE_SIZE; + ft_attr->level = MLX5E_TC_TTC_FT_LEVEL; + ft_attr->prio = MLX5E_TC_PRIO; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 50ab88d80033..051ab845b501 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1197,6 +1197,12 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, bool boot) + if (err) + goto err_load; + ++ if (boot) { ++ err = mlx5_devlink_register(priv_to_devlink(dev), dev->device); ++ if (err) ++ goto err_devlink_reg; ++ } ++ + if (mlx5_device_registered(dev)) { + mlx5_attach_device(dev); + } else { +@@ -1214,6 +1220,9 @@ out: + return err; + + err_reg_dev: ++ if (boot) ++ mlx5_devlink_unregister(priv_to_devlink(dev)); ++err_devlink_reg: + mlx5_unload(dev); + err_load: + if (boot) +@@ -1353,10 +1362,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *id) + + request_module_nowait(MLX5_IB_MOD); + +- err = mlx5_devlink_register(devlink, &pdev->dev); +- if (err) +- goto clean_load; +- + err = mlx5_crdump_enable(dev); + if (err) + dev_err(&pdev->dev, "mlx5_crdump_enable failed with error code %d\n", err); +@@ -1364,9 +1369,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *id) + pci_save_state(pdev); + return 0; + +-clean_load: +- mlx5_unload_one(dev, true); +- + err_load_one: + mlx5_pci_close(dev); + pci_init_err: +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c +index bd1699e62142..e1a647dde978 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c +@@ -209,7 +209,7 @@ static void dr_rule_rehash_copy_ste_ctrl(struct mlx5dr_matcher *matcher, + /* We need to copy the refcount since this ste + * may have been traversed several times + */ +- refcount_set(&new_ste->refcount, refcount_read(&cur_ste->refcount)); ++ new_ste->refcount = cur_ste->refcount; + + /* Link old STEs rule_mem list to the new ste */ + mlx5dr_rule_update_rule_member(cur_ste, new_ste); +@@ -638,6 +638,9 @@ static int dr_rule_add_member(struct mlx5dr_rule_rx_tx *nic_rule, + if (!rule_mem) + return -ENOMEM; + ++ INIT_LIST_HEAD(&rule_mem->list); ++ INIT_LIST_HEAD(&rule_mem->use_ste_list); ++ + rule_mem->ste = ste; + list_add_tail(&rule_mem->list, &nic_rule->rule_members_list); + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c +index 3cbf74b44d1f..2739ed2a2911 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c +@@ -340,7 +340,7 @@ static void dr_ste_replace(struct mlx5dr_ste *dst, struct mlx5dr_ste *src) + if (dst->next_htbl) + dst->next_htbl->pointing_ste = dst; + +- refcount_set(&dst->refcount, refcount_read(&src->refcount)); ++ dst->refcount = src->refcount; + + INIT_LIST_HEAD(&dst->rule_list); + list_splice_tail_init(&src->rule_list, &dst->rule_list); +@@ -557,7 +557,7 @@ bool mlx5dr_ste_is_not_valid_entry(u8 *p_hw_ste) + + bool mlx5dr_ste_not_used_ste(struct mlx5dr_ste *ste) + { +- return !refcount_read(&ste->refcount); ++ return !ste->refcount; + } + + /* Init one ste as a pattern for ste data array */ +@@ -681,14 +681,14 @@ struct mlx5dr_ste_htbl *mlx5dr_ste_htbl_alloc(struct mlx5dr_icm_pool *pool, + htbl->ste_arr = chunk->ste_arr; + htbl->hw_ste_arr = chunk->hw_ste_arr; + htbl->miss_list = chunk->miss_list; +- refcount_set(&htbl->refcount, 0); ++ htbl->refcount = 0; + + for (i = 0; i < chunk->num_of_entries; i++) { + struct mlx5dr_ste *ste = &htbl->ste_arr[i]; + + ste->hw_ste = htbl->hw_ste_arr + i * DR_STE_SIZE_REDUCED; + ste->htbl = htbl; +- refcount_set(&ste->refcount, 0); ++ ste->refcount = 0; + INIT_LIST_HEAD(&ste->miss_list_node); + INIT_LIST_HEAD(&htbl->miss_list[i]); + INIT_LIST_HEAD(&ste->rule_list); +@@ -705,7 +705,7 @@ out_free_htbl: + + int mlx5dr_ste_htbl_free(struct mlx5dr_ste_htbl *htbl) + { +- if (refcount_read(&htbl->refcount)) ++ if (htbl->refcount) + return -EBUSY; + + mlx5dr_icm_free_chunk(htbl->chunk); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h +index 1cb3769d4e3c..31737dfca4ea 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h +@@ -117,7 +117,7 @@ struct mlx5dr_matcher_rx_tx; + struct mlx5dr_ste { + u8 *hw_ste; + /* refcount: indicates the num of rules that using this ste */ +- refcount_t refcount; ++ u32 refcount; + + /* attached to the miss_list head at each htbl entry */ + struct list_head miss_list_node; +@@ -149,7 +149,7 @@ struct mlx5dr_ste_htbl_ctrl { + struct mlx5dr_ste_htbl { + u8 lu_type; + u16 byte_mask; +- refcount_t refcount; ++ u32 refcount; + struct mlx5dr_icm_chunk *chunk; + struct mlx5dr_ste *ste_arr; + u8 *hw_ste_arr; +@@ -200,13 +200,14 @@ int mlx5dr_ste_htbl_free(struct mlx5dr_ste_htbl *htbl); + + static inline void mlx5dr_htbl_put(struct mlx5dr_ste_htbl *htbl) + { +- if (refcount_dec_and_test(&htbl->refcount)) ++ htbl->refcount--; ++ if (!htbl->refcount) + mlx5dr_ste_htbl_free(htbl); + } + + static inline void mlx5dr_htbl_get(struct mlx5dr_ste_htbl *htbl) + { +- refcount_inc(&htbl->refcount); ++ htbl->refcount++; + } + + /* STE utils */ +@@ -248,14 +249,15 @@ static inline void mlx5dr_ste_put(struct mlx5dr_ste *ste, + struct mlx5dr_matcher *matcher, + struct mlx5dr_matcher_rx_tx *nic_matcher) + { +- if (refcount_dec_and_test(&ste->refcount)) ++ ste->refcount--; ++ if (!ste->refcount) + mlx5dr_ste_free(ste, matcher, nic_matcher); + } + + /* initial as 0, increased only when ste appears in a new rule */ + static inline void mlx5dr_ste_get(struct mlx5dr_ste *ste) + { +- refcount_inc(&ste->refcount); ++ ste->refcount++; + } + + void mlx5dr_ste_set_hit_addr_by_next_htbl(u8 *hw_ste, +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c +index bdf53cf350f6..720514b5c006 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c +@@ -650,6 +650,13 @@ mlxsw_sp_qdisc_prio_graft(struct mlxsw_sp_port *mlxsw_sp_port, + mlxsw_sp_port->tclass_qdiscs[tclass_num].handle == p->child_handle) + return 0; + ++ if (!p->child_handle) { ++ /* This is an invisible FIFO replacing the original Qdisc. ++ * Ignore it--the original Qdisc's destroy will follow. ++ */ ++ return 0; ++ } ++ + /* See if the grafted qdisc is already offloaded on any tclass. If so, + * unoffload it. + */ +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +index 6e47be63a43c..e9e0867ec139 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -957,6 +957,9 @@ static int sun8i_dwmac_set_syscon(struct stmmac_priv *priv) + /* default */ + break; + case PHY_INTERFACE_MODE_RGMII: ++ case PHY_INTERFACE_MODE_RGMII_ID: ++ case PHY_INTERFACE_MODE_RGMII_RXID: ++ case PHY_INTERFACE_MODE_RGMII_TXID: + reg |= SYSCON_EPIT | SYSCON_ETCS_INT_GMII; + break; + case PHY_INTERFACE_MODE_RMII: +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +index a299da3971b4..102d637bc84a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +@@ -44,7 +44,7 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + * rate, which then uses the auto-reparenting feature of the + * clock driver, and enabling/disabling the clock. + */ +- if (gmac->interface == PHY_INTERFACE_MODE_RGMII) { ++ if (phy_interface_mode_is_rgmii(gmac->interface)) { + clk_set_rate(gmac->tx_clk, SUN7I_GMAC_GMII_RGMII_RATE); + clk_prepare_enable(gmac->tx_clk); + gmac->clk_enabled = 1; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h +index 9d08a934fe4f..ff751ab3d765 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h +@@ -343,6 +343,8 @@ + #define XGMAC_DMA_CH_RX_CONTROL(x) (0x00003108 + (0x80 * (x))) + #define XGMAC_RxPBL GENMASK(21, 16) + #define XGMAC_RxPBL_SHIFT 16 ++#define XGMAC_RBSZ GENMASK(14, 1) ++#define XGMAC_RBSZ_SHIFT 1 + #define XGMAC_RXST BIT(0) + #define XGMAC_DMA_CH_TxDESC_HADDR(x) (0x00003110 + (0x80 * (x))) + #define XGMAC_DMA_CH_TxDESC_LADDR(x) (0x00003114 + (0x80 * (x))) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +index f70ca5300b82..4af7271cea56 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +@@ -489,7 +489,8 @@ static void dwxgmac2_set_bfsize(void __iomem *ioaddr, int bfsize, u32 chan) + u32 value; + + value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan)); +- value |= bfsize << 1; ++ value &= ~XGMAC_RBSZ; ++ value |= bfsize << XGMAC_RBSZ_SHIFT; + writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan)); + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 271a00f24f45..903c5d8a226e 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -45,7 +45,7 @@ + #include "dwxgmac2.h" + #include "hwif.h" + +-#define STMMAC_ALIGN(x) __ALIGN_KERNEL(x, SMP_CACHE_BYTES) ++#define STMMAC_ALIGN(x) ALIGN(ALIGN(x, SMP_CACHE_BYTES), 16) + #define TSO_MAX_BUFF_SIZE (SZ_16K - 1) + + /* Module parameters */ +@@ -1292,19 +1292,9 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags) + struct stmmac_priv *priv = netdev_priv(dev); + u32 rx_count = priv->plat->rx_queues_to_use; + int ret = -ENOMEM; +- int bfsize = 0; + int queue; + int i; + +- bfsize = stmmac_set_16kib_bfsize(priv, dev->mtu); +- if (bfsize < 0) +- bfsize = 0; +- +- if (bfsize < BUF_SIZE_16KiB) +- bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz); +- +- priv->dma_buf_sz = bfsize; +- + /* RX INITIALIZATION */ + netif_dbg(priv, probe, priv->dev, + "SKB addresses:\nskb\t\tskb data\tdma data\n"); +@@ -1346,8 +1336,6 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags) + } + } + +- buf_sz = bfsize; +- + return 0; + + err_init_rx_buffers: +@@ -2654,6 +2642,7 @@ static void stmmac_hw_teardown(struct net_device *dev) + static int stmmac_open(struct net_device *dev) + { + struct stmmac_priv *priv = netdev_priv(dev); ++ int bfsize = 0; + u32 chan; + int ret; + +@@ -2673,7 +2662,16 @@ static int stmmac_open(struct net_device *dev) + memset(&priv->xstats, 0, sizeof(struct stmmac_extra_stats)); + priv->xstats.threshold = tc; + +- priv->dma_buf_sz = STMMAC_ALIGN(buf_sz); ++ bfsize = stmmac_set_16kib_bfsize(priv, dev->mtu); ++ if (bfsize < 0) ++ bfsize = 0; ++ ++ if (bfsize < BUF_SIZE_16KiB) ++ bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz); ++ ++ priv->dma_buf_sz = bfsize; ++ buf_sz = bfsize; ++ + priv->rx_copybreak = STMMAC_RX_COPYBREAK; + + ret = alloc_dma_desc_resources(priv); +@@ -3103,6 +3101,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) + + tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc)); + stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue); ++ stmmac_tx_timer_arm(priv, queue); + + return NETDEV_TX_OK; + +@@ -3330,6 +3329,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + + tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc)); + stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue); ++ stmmac_tx_timer_arm(priv, queue); + + return NETDEV_TX_OK; + +@@ -3747,12 +3747,24 @@ static void stmmac_set_rx_mode(struct net_device *dev) + static int stmmac_change_mtu(struct net_device *dev, int new_mtu) + { + struct stmmac_priv *priv = netdev_priv(dev); ++ int txfifosz = priv->plat->tx_fifo_size; ++ ++ if (txfifosz == 0) ++ txfifosz = priv->dma_cap.tx_fifo_size; ++ ++ txfifosz /= priv->plat->tx_queues_to_use; + + if (netif_running(dev)) { + netdev_err(priv->dev, "must be stopped to change its MTU\n"); + return -EBUSY; + } + ++ new_mtu = STMMAC_ALIGN(new_mtu); ++ ++ /* If condition true, FIFO is too small or MTU too large */ ++ if ((txfifosz < new_mtu) || (new_mtu > BUF_SIZE_16KiB)) ++ return -EINVAL; ++ + dev->mtu = new_mtu; + + netdev_update_features(dev); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 1f230bd854c4..5150551c28be 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -320,7 +320,7 @@ out: + static int stmmac_dt_phy(struct plat_stmmacenet_data *plat, + struct device_node *np, struct device *dev) + { +- bool mdio = false; ++ bool mdio = !of_phy_is_fixed_link(np); + static const struct of_device_id need_mdio_ids[] = { + { .compatible = "snps,dwc-qos-ethernet-4.10" }, + {}, +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +index ac3f658105c0..a0513deab1a0 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +@@ -624,6 +624,8 @@ static int stmmac_test_mcfilt(struct stmmac_priv *priv) + return -EOPNOTSUPP; + if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries) + return -EOPNOTSUPP; ++ if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins) ++ return -EOPNOTSUPP; + + while (--tries) { + /* We only need to check the mc_addr for collisions */ +@@ -666,6 +668,8 @@ static int stmmac_test_ucfilt(struct stmmac_priv *priv) + + if (stmmac_filter_check(priv)) + return -EOPNOTSUPP; ++ if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries) ++ return -EOPNOTSUPP; + if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins) + return -EOPNOTSUPP; + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index fca471e27f39..f6222ada6818 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -813,7 +813,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, + lock_sock(sock->sk); + if (sock->sk->sk_user_data) { + sk = ERR_PTR(-EBUSY); +- goto out_sock; ++ goto out_rel_sock; + } + + sk = sock->sk; +@@ -826,8 +826,9 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, + + setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); + +-out_sock: ++out_rel_sock: + release_sock(sock->sk); ++out_sock: + sockfd_put(sock); + return sk; + } +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index fb547f37af1e..e74f2d1def80 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -169,7 +169,6 @@ struct rndis_device { + + u8 hw_mac_adr[ETH_ALEN]; + u8 rss_key[NETVSC_HASH_KEYLEN]; +- u16 rx_table[ITAB_NUM]; + }; + + +@@ -938,6 +937,8 @@ struct net_device_context { + + u32 tx_table[VRSS_SEND_TAB_SIZE]; + ++ u16 rx_table[ITAB_NUM]; ++ + /* Ethtool settings */ + u8 duplex; + u32 speed; +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 963509add611..78e3e689a733 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -1659,7 +1659,7 @@ static int netvsc_get_rxfh(struct net_device *dev, u32 *indir, u8 *key, + rndis_dev = ndev->extension; + if (indir) { + for (i = 0; i < ITAB_NUM; i++) +- indir[i] = rndis_dev->rx_table[i]; ++ indir[i] = ndc->rx_table[i]; + } + + if (key) +@@ -1689,7 +1689,7 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir, + return -EINVAL; + + for (i = 0; i < ITAB_NUM; i++) +- rndis_dev->rx_table[i] = indir[i]; ++ ndc->rx_table[i] = indir[i]; + } + + if (!key) { +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index e3d3c9097ff1..f81e58267a6e 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -767,6 +767,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev, + const u8 *rss_key, u16 flag) + { + struct net_device *ndev = rdev->ndev; ++ struct net_device_context *ndc = netdev_priv(ndev); + struct rndis_request *request; + struct rndis_set_request *set; + struct rndis_set_complete *set_complete; +@@ -806,7 +807,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev, + /* Set indirection table entries */ + itab = (u32 *)(rssp + 1); + for (i = 0; i < ITAB_NUM; i++) +- itab[i] = rdev->rx_table[i]; ++ itab[i] = ndc->rx_table[i]; + + /* Set hask key values */ + keyp = (u8 *)((unsigned long)rssp + rssp->hashkey_offset); +@@ -1305,6 +1306,7 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + struct netvsc_device_info *device_info) + { + struct net_device *net = hv_get_drvdata(dev); ++ struct net_device_context *ndc = netdev_priv(net); + struct netvsc_device *net_device; + struct rndis_device *rndis_device; + struct ndis_recv_scale_cap rsscap; +@@ -1391,9 +1393,11 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + /* We will use the given number of channels if available. */ + net_device->num_chn = min(net_device->max_chn, device_info->num_chn); + +- for (i = 0; i < ITAB_NUM; i++) +- rndis_device->rx_table[i] = ethtool_rxfh_indir_default( ++ if (!netif_is_rxfh_configured(net)) { ++ for (i = 0; i < ITAB_NUM; i++) ++ ndc->rx_table[i] = ethtool_rxfh_indir_default( + i, net_device->num_chn); ++ } + + atomic_set(&net_device->open_chn, 1); + vmbus_set_sc_create_callback(dev->channel, netvsc_sc_open); +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 05631d97eeb4..747c0542a53c 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -259,7 +259,7 @@ static void macvlan_broadcast(struct sk_buff *skb, + struct net_device *src, + enum macvlan_mode mode) + { +- const struct ethhdr *eth = eth_hdr(skb); ++ const struct ethhdr *eth = skb_eth_hdr(skb); + const struct macvlan_dev *vlan; + struct sk_buff *nskb; + unsigned int i; +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 0becc79fd431..3e5f2f7a155e 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -511,7 +511,7 @@ static int lan78xx_read_stats(struct lan78xx_net *dev, + } + } else { + netdev_warn(dev->net, +- "Failed to read stat ret = 0x%x", ret); ++ "Failed to read stat ret = %d", ret); + } + + kfree(stats); +@@ -2724,11 +2724,6 @@ static int lan78xx_stop(struct net_device *net) + return 0; + } + +-static int lan78xx_linearize(struct sk_buff *skb) +-{ +- return skb_linearize(skb); +-} +- + static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, + struct sk_buff *skb, gfp_t flags) + { +@@ -2740,8 +2735,10 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, + return NULL; + } + +- if (lan78xx_linearize(skb) < 0) ++ if (skb_linearize(skb)) { ++ dev_kfree_skb_any(skb); + return NULL; ++ } + + tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN_MASK_) | TX_CMD_A_FCS_; + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 404ac3a0d1c3..283dfeb406ad 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2542,7 +2542,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + ndst = &rt->dst; + skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM); + +- tos = ip_tunnel_ecn_encap(tos, old_iph, skb); ++ tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); + ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); + err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr), + vni, md, flags, udp_sum); +@@ -2582,7 +2582,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + + skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM); + +- tos = ip_tunnel_ecn_encap(tos, old_iph, skb); ++ tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); + ttl = ttl ? : ip6_dst_hoplimit(ndst); + skb_scrub_packet(skb, xnet); + err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr), +diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c +index 09313047beed..7caf1d26124a 100644 +--- a/drivers/net/wireless/marvell/mwifiex/tdls.c ++++ b/drivers/net/wireless/marvell/mwifiex/tdls.c +@@ -953,59 +953,117 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv, + + switch (*pos) { + case WLAN_EID_SUPP_RATES: ++ if (pos[1] > 32) ++ return; + sta_ptr->tdls_cap.rates_len = pos[1]; + for (i = 0; i < pos[1]; i++) + sta_ptr->tdls_cap.rates[i] = pos[i + 2]; + break; + + case WLAN_EID_EXT_SUPP_RATES: ++ if (pos[1] > 32) ++ return; + basic = sta_ptr->tdls_cap.rates_len; ++ if (pos[1] > 32 - basic) ++ return; + for (i = 0; i < pos[1]; i++) + sta_ptr->tdls_cap.rates[basic + i] = pos[i + 2]; + sta_ptr->tdls_cap.rates_len += pos[1]; + break; + case WLAN_EID_HT_CAPABILITY: +- memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos, ++ if (pos > end - sizeof(struct ieee80211_ht_cap) - 2) ++ return; ++ if (pos[1] != sizeof(struct ieee80211_ht_cap)) ++ return; ++ /* copy the ie's value into ht_capb*/ ++ memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos + 2, + sizeof(struct ieee80211_ht_cap)); + sta_ptr->is_11n_enabled = 1; + break; + case WLAN_EID_HT_OPERATION: +- memcpy(&sta_ptr->tdls_cap.ht_oper, pos, ++ if (pos > end - ++ sizeof(struct ieee80211_ht_operation) - 2) ++ return; ++ if (pos[1] != sizeof(struct ieee80211_ht_operation)) ++ return; ++ /* copy the ie's value into ht_oper*/ ++ memcpy(&sta_ptr->tdls_cap.ht_oper, pos + 2, + sizeof(struct ieee80211_ht_operation)); + break; + case WLAN_EID_BSS_COEX_2040: ++ if (pos > end - 3) ++ return; ++ if (pos[1] != 1) ++ return; + sta_ptr->tdls_cap.coex_2040 = pos[2]; + break; + case WLAN_EID_EXT_CAPABILITY: ++ if (pos > end - sizeof(struct ieee_types_header)) ++ return; ++ if (pos[1] < sizeof(struct ieee_types_header)) ++ return; ++ if (pos[1] > 8) ++ return; + memcpy((u8 *)&sta_ptr->tdls_cap.extcap, pos, + sizeof(struct ieee_types_header) + + min_t(u8, pos[1], 8)); + break; + case WLAN_EID_RSN: ++ if (pos > end - sizeof(struct ieee_types_header)) ++ return; ++ if (pos[1] < sizeof(struct ieee_types_header)) ++ return; ++ if (pos[1] > IEEE_MAX_IE_SIZE - ++ sizeof(struct ieee_types_header)) ++ return; + memcpy((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos, + sizeof(struct ieee_types_header) + + min_t(u8, pos[1], IEEE_MAX_IE_SIZE - + sizeof(struct ieee_types_header))); + break; + case WLAN_EID_QOS_CAPA: ++ if (pos > end - 3) ++ return; ++ if (pos[1] != 1) ++ return; + sta_ptr->tdls_cap.qos_info = pos[2]; + break; + case WLAN_EID_VHT_OPERATION: +- if (priv->adapter->is_hw_11ac_capable) +- memcpy(&sta_ptr->tdls_cap.vhtoper, pos, ++ if (priv->adapter->is_hw_11ac_capable) { ++ if (pos > end - ++ sizeof(struct ieee80211_vht_operation) - 2) ++ return; ++ if (pos[1] != ++ sizeof(struct ieee80211_vht_operation)) ++ return; ++ /* copy the ie's value into vhtoper*/ ++ memcpy(&sta_ptr->tdls_cap.vhtoper, pos + 2, + sizeof(struct ieee80211_vht_operation)); ++ } + break; + case WLAN_EID_VHT_CAPABILITY: + if (priv->adapter->is_hw_11ac_capable) { +- memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos, ++ if (pos > end - ++ sizeof(struct ieee80211_vht_cap) - 2) ++ return; ++ if (pos[1] != sizeof(struct ieee80211_vht_cap)) ++ return; ++ /* copy the ie's value into vhtcap*/ ++ memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos + 2, + sizeof(struct ieee80211_vht_cap)); + sta_ptr->is_11ac_enabled = 1; + } + break; + case WLAN_EID_AID: +- if (priv->adapter->is_hw_11ac_capable) ++ if (priv->adapter->is_hw_11ac_capable) { ++ if (pos > end - 4) ++ return; ++ if (pos[1] != 2) ++ return; + sta_ptr->tdls_cap.aid = + get_unaligned_le16((pos + 2)); ++ } ++ break; + default: + break; + } +diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c +index abcf54f7d19c..191f410cf35c 100644 +--- a/drivers/perf/arm_smmuv3_pmu.c ++++ b/drivers/perf/arm_smmuv3_pmu.c +@@ -815,7 +815,7 @@ static int smmu_pmu_probe(struct platform_device *pdev) + if (err) { + dev_err(dev, "Error %d registering hotplug, PMU @%pa\n", + err, &res_0->start); +- goto out_cpuhp_err; ++ return err; + } + + err = perf_pmu_register(&smmu_pmu->pmu, name, -1); +@@ -834,8 +834,6 @@ static int smmu_pmu_probe(struct platform_device *pdev) + + out_unregister: + cpuhp_state_remove_instance_nocalls(cpuhp_state_num, &smmu_pmu->node); +-out_cpuhp_err: +- put_cpu(); + return err; + } + +diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +index c6800d220920..bb07024d22ed 100644 +--- a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c ++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +@@ -1088,60 +1088,52 @@ SSSF_PIN_DECL(AF15, GPIOV7, LPCSMI, SIG_DESC_SET(SCU434, 15)); + + #define AB7 176 + SIG_EXPR_LIST_DECL_SESG(AB7, LAD0, LPC, SIG_DESC_SET(SCU434, 16), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AB7, ESPID0, ESPI, SIG_DESC_SET(SCU434, 16), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AB7, ESPID0, ESPI, SIG_DESC_SET(SCU434, 16)); + PIN_DECL_2(AB7, GPIOW0, LAD0, ESPID0); + + #define AB8 177 + SIG_EXPR_LIST_DECL_SESG(AB8, LAD1, LPC, SIG_DESC_SET(SCU434, 17), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AB8, ESPID1, ESPI, SIG_DESC_SET(SCU434, 17), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AB8, ESPID1, ESPI, SIG_DESC_SET(SCU434, 17)); + PIN_DECL_2(AB8, GPIOW1, LAD1, ESPID1); + + #define AC8 178 + SIG_EXPR_LIST_DECL_SESG(AC8, LAD2, LPC, SIG_DESC_SET(SCU434, 18), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AC8, ESPID2, ESPI, SIG_DESC_SET(SCU434, 18), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AC8, ESPID2, ESPI, SIG_DESC_SET(SCU434, 18)); + PIN_DECL_2(AC8, GPIOW2, LAD2, ESPID2); + + #define AC7 179 + SIG_EXPR_LIST_DECL_SESG(AC7, LAD3, LPC, SIG_DESC_SET(SCU434, 19), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AC7, ESPID3, ESPI, SIG_DESC_SET(SCU434, 19), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AC7, ESPID3, ESPI, SIG_DESC_SET(SCU434, 19)); + PIN_DECL_2(AC7, GPIOW3, LAD3, ESPID3); + + #define AE7 180 + SIG_EXPR_LIST_DECL_SESG(AE7, LCLK, LPC, SIG_DESC_SET(SCU434, 20), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AE7, ESPICK, ESPI, SIG_DESC_SET(SCU434, 20), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AE7, ESPICK, ESPI, SIG_DESC_SET(SCU434, 20)); + PIN_DECL_2(AE7, GPIOW4, LCLK, ESPICK); + + #define AF7 181 + SIG_EXPR_LIST_DECL_SESG(AF7, LFRAME, LPC, SIG_DESC_SET(SCU434, 21), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AF7, ESPICS, ESPI, SIG_DESC_SET(SCU434, 21), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AF7, ESPICS, ESPI, SIG_DESC_SET(SCU434, 21)); + PIN_DECL_2(AF7, GPIOW5, LFRAME, ESPICS); + + #define AD7 182 + SIG_EXPR_LIST_DECL_SESG(AD7, LSIRQ, LSIRQ, SIG_DESC_SET(SCU434, 22), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AD7, ESPIALT, ESPIALT, SIG_DESC_SET(SCU434, 22), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AD7, ESPIALT, ESPIALT, SIG_DESC_SET(SCU434, 22)); + PIN_DECL_2(AD7, GPIOW6, LSIRQ, ESPIALT); + FUNC_GROUP_DECL(LSIRQ, AD7); + FUNC_GROUP_DECL(ESPIALT, AD7); + + #define AD8 183 + SIG_EXPR_LIST_DECL_SESG(AD8, LPCRST, LPC, SIG_DESC_SET(SCU434, 23), +- SIG_DESC_CLEAR(SCU510, 6)); +-SIG_EXPR_LIST_DECL_SESG(AD8, ESPIRST, ESPI, SIG_DESC_SET(SCU434, 23), + SIG_DESC_SET(SCU510, 6)); ++SIG_EXPR_LIST_DECL_SESG(AD8, ESPIRST, ESPI, SIG_DESC_SET(SCU434, 23)); + PIN_DECL_2(AD8, GPIOW7, LPCRST, ESPIRST); + + FUNC_GROUP_DECL(LPC, AB7, AB8, AC8, AC7, AE7, AF7, AD8); +diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c +index e914f6efd39e..9503ddf2edc7 100644 +--- a/drivers/pinctrl/pinmux.c ++++ b/drivers/pinctrl/pinmux.c +@@ -85,7 +85,7 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned pin) + const struct pinmux_ops *ops = pctldev->desc->pmxops; + + /* Can't inspect pin, assume it can be used */ +- if (!desc) ++ if (!desc || !ops) + return true; + + if (ops->strict && desc->mux_usecount) +diff --git a/drivers/platform/x86/pcengines-apuv2.c b/drivers/platform/x86/pcengines-apuv2.c +index 48b112b4f0b0..c32daf087640 100644 +--- a/drivers/platform/x86/pcengines-apuv2.c ++++ b/drivers/platform/x86/pcengines-apuv2.c +@@ -95,7 +95,7 @@ static struct gpiod_lookup_table gpios_led_table = { + NULL, 1, GPIO_ACTIVE_LOW), + GPIO_LOOKUP_IDX(AMD_FCH_GPIO_DRIVER_NAME, APU2_GPIO_LINE_LED3, + NULL, 2, GPIO_ACTIVE_LOW), +- GPIO_LOOKUP_IDX(AMD_FCH_GPIO_DRIVER_NAME, APU2_GPIO_REG_SIMSWAP, ++ GPIO_LOOKUP_IDX(AMD_FCH_GPIO_DRIVER_NAME, APU2_GPIO_LINE_SIMSWAP, + NULL, 3, GPIO_ACTIVE_LOW), + } + }; +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 87bc06b386a0..1dba0bdf3762 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1937,8 +1937,8 @@ struct regulator *_regulator_get(struct device *dev, const char *id, + regulator = create_regulator(rdev, dev, id); + if (regulator == NULL) { + regulator = ERR_PTR(-ENOMEM); +- put_device(&rdev->dev); + module_put(rdev->owner); ++ put_device(&rdev->dev); + return regulator; + } + +@@ -2059,13 +2059,13 @@ static void _regulator_put(struct regulator *regulator) + + rdev->open_count--; + rdev->exclusive = 0; +- put_device(&rdev->dev); + regulator_unlock(rdev); + + kfree_const(regulator->supply_name); + kfree(regulator); + + module_put(rdev->owner); ++ put_device(&rdev->dev); + } + + /** +@@ -4992,6 +4992,7 @@ regulator_register(const struct regulator_desc *regulator_desc, + struct regulator_dev *rdev; + bool dangling_cfg_gpiod = false; + bool dangling_of_gpiod = false; ++ bool reg_device_fail = false; + struct device *dev; + int ret, i; + +@@ -5177,7 +5178,7 @@ regulator_register(const struct regulator_desc *regulator_desc, + dev_set_drvdata(&rdev->dev, rdev); + ret = device_register(&rdev->dev); + if (ret != 0) { +- put_device(&rdev->dev); ++ reg_device_fail = true; + goto unset_supplies; + } + +@@ -5208,7 +5209,10 @@ wash: + clean: + if (dangling_of_gpiod) + gpiod_put(config->ena_gpiod); +- kfree(rdev); ++ if (reg_device_fail) ++ put_device(&rdev->dev); ++ else ++ kfree(rdev); + kfree(config); + rinse: + if (dangling_cfg_gpiod) +diff --git a/drivers/regulator/rn5t618-regulator.c b/drivers/regulator/rn5t618-regulator.c +index eb807a059479..aa6e7c5341ce 100644 +--- a/drivers/regulator/rn5t618-regulator.c ++++ b/drivers/regulator/rn5t618-regulator.c +@@ -148,6 +148,7 @@ static struct platform_driver rn5t618_regulator_driver = { + + module_platform_driver(rn5t618_regulator_driver); + ++MODULE_ALIAS("platform:rn5t618-regulator"); + MODULE_AUTHOR("Beniamino Galvani "); + MODULE_DESCRIPTION("RN5T618 regulator driver"); + MODULE_LICENSE("GPL v2"); +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index 3c9a64c1b7a8..f343bd814d32 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -787,7 +787,7 @@ struct reset_control *__devm_reset_control_get(struct device *dev, + return ERR_PTR(-ENOMEM); + + rstc = __reset_control_get(dev, id, index, shared, optional, acquired); +- if (!IS_ERR(rstc)) { ++ if (!IS_ERR_OR_NULL(rstc)) { + *ptr = rstc; + devres_add(dev, ptr); + } else { +@@ -930,7 +930,7 @@ devm_reset_control_array_get(struct device *dev, bool shared, bool optional) + return ERR_PTR(-ENOMEM); + + rstc = of_reset_control_array_get(dev->of_node, shared, optional, true); +- if (IS_ERR(rstc)) { ++ if (IS_ERR_OR_NULL(rstc)) { + devres_free(devres); + return rstc; + } +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index c94184d080f8..a28b9ff82378 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -1128,7 +1128,8 @@ static u32 get_fcx_max_data(struct dasd_device *device) + { + struct dasd_eckd_private *private = device->private; + int fcx_in_css, fcx_in_gneq, fcx_in_features; +- int tpm, mdc; ++ unsigned int mdc; ++ int tpm; + + if (dasd_nofcx) + return 0; +@@ -1142,7 +1143,7 @@ static u32 get_fcx_max_data(struct dasd_device *device) + return 0; + + mdc = ccw_device_get_mdc(device->cdev, 0); +- if (mdc < 0) { ++ if (mdc == 0) { + dev_warn(&device->cdev->dev, "Detecting the maximum supported data size for zHPF requests failed\n"); + return 0; + } else { +@@ -1153,12 +1154,12 @@ static u32 get_fcx_max_data(struct dasd_device *device) + static int verify_fcx_max_data(struct dasd_device *device, __u8 lpm) + { + struct dasd_eckd_private *private = device->private; +- int mdc; ++ unsigned int mdc; + u32 fcx_max_data; + + if (private->fcx_max_data) { + mdc = ccw_device_get_mdc(device->cdev, lpm); +- if ((mdc < 0)) { ++ if (mdc == 0) { + dev_warn(&device->cdev->dev, + "Detecting the maximum data size for zHPF " + "requests failed (rc=%d) for a new path %x\n", +@@ -2073,7 +2074,7 @@ out_err2: + dasd_free_block(device->block); + device->block = NULL; + out_err1: +- kfree(private->conf_data); ++ dasd_eckd_clear_conf_data(device); + kfree(device->private); + device->private = NULL; + return rc; +@@ -2082,7 +2083,6 @@ out_err1: + static void dasd_eckd_uncheck_device(struct dasd_device *device) + { + struct dasd_eckd_private *private = device->private; +- int i; + + if (!private) + return; +@@ -2092,21 +2092,7 @@ static void dasd_eckd_uncheck_device(struct dasd_device *device) + private->sneq = NULL; + private->vdsneq = NULL; + private->gneq = NULL; +- private->conf_len = 0; +- for (i = 0; i < 8; i++) { +- kfree(device->path[i].conf_data); +- if ((__u8 *)device->path[i].conf_data == +- private->conf_data) { +- private->conf_data = NULL; +- private->conf_len = 0; +- } +- device->path[i].conf_data = NULL; +- device->path[i].cssid = 0; +- device->path[i].ssid = 0; +- device->path[i].chpid = 0; +- } +- kfree(private->conf_data); +- private->conf_data = NULL; ++ dasd_eckd_clear_conf_data(device); + } + + static struct dasd_ccw_req * +diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c +index 65841af15748..ccecf6b9504e 100644 +--- a/drivers/s390/cio/device_ops.c ++++ b/drivers/s390/cio/device_ops.c +@@ -635,7 +635,7 @@ EXPORT_SYMBOL(ccw_device_tm_start_timeout); + * @mask: mask of paths to use + * + * Return the number of 64K-bytes blocks all paths at least support +- * for a transport command. Return values <= 0 indicate failures. ++ * for a transport command. Return value 0 indicates failure. + */ + int ccw_device_get_mdc(struct ccw_device *cdev, u8 mask) + { +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 83794d7494d4..9df47421d69c 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -653,17 +653,17 @@ static int qeth_check_idx_response(struct qeth_card *card, + unsigned char *buffer) + { + QETH_DBF_HEX(CTRL, 2, buffer, QETH_DBF_CTRL_LEN); +- if ((buffer[2] & 0xc0) == 0xc0) { ++ if ((buffer[2] & QETH_IDX_TERMINATE_MASK) == QETH_IDX_TERMINATE) { + QETH_DBF_MESSAGE(2, "received an IDX TERMINATE with cause code %#04x\n", + buffer[4]); + QETH_CARD_TEXT(card, 2, "ckidxres"); + QETH_CARD_TEXT(card, 2, " idxterm"); +- QETH_CARD_TEXT_(card, 2, " rc%d", -EIO); +- if (buffer[4] == 0xf6) { ++ QETH_CARD_TEXT_(card, 2, "rc%x", buffer[4]); ++ if (buffer[4] == QETH_IDX_TERM_BAD_TRANSPORT || ++ buffer[4] == QETH_IDX_TERM_BAD_TRANSPORT_VM) { + dev_err(&card->gdev->dev, +- "The qeth device is not configured " +- "for the OSI layer required by z/VM\n"); +- return -EPERM; ++ "The device does not support the configured transport mode\n"); ++ return -EPROTONOSUPPORT; + } + return -EIO; + } +@@ -740,10 +740,10 @@ static void qeth_issue_next_read_cb(struct qeth_card *card, + case 0: + break; + case -EIO: +- qeth_clear_ipacmd_list(card); + qeth_schedule_recovery(card); + /* fall through */ + default: ++ qeth_clear_ipacmd_list(card); + goto out; + } + +diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h +index 6420b58cf42b..b7c17b5c823b 100644 +--- a/drivers/s390/net/qeth_core_mpc.h ++++ b/drivers/s390/net/qeth_core_mpc.h +@@ -912,6 +912,11 @@ extern unsigned char IDX_ACTIVATE_WRITE[]; + #define QETH_IDX_ACT_ERR_AUTH 0x1E + #define QETH_IDX_ACT_ERR_AUTH_USER 0x20 + ++#define QETH_IDX_TERMINATE 0xc0 ++#define QETH_IDX_TERMINATE_MASK 0xc0 ++#define QETH_IDX_TERM_BAD_TRANSPORT 0x41 ++#define QETH_IDX_TERM_BAD_TRANSPORT_VM 0xf6 ++ + #define PDU_ENCAPSULATION(buffer) \ + (buffer + *(buffer + (*(buffer + 0x0b)) + \ + *(buffer + *(buffer + 0x0b) + 0x11) + 0x07)) +diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c +index 9f392497d570..4c3e222e5572 100644 +--- a/drivers/s390/net/qeth_core_sys.c ++++ b/drivers/s390/net/qeth_core_sys.c +@@ -227,7 +227,7 @@ static ssize_t qeth_dev_prioqing_store(struct device *dev, + card->qdio.default_out_queue = QETH_DEFAULT_QUEUE; + } else if (sysfs_streq(buf, "prio_queueing_vlan")) { + if (IS_LAYER3(card)) { +- rc = -ENOTSUPP; ++ rc = -EOPNOTSUPP; + goto out; + } + card->qdio.do_prio_queueing = QETH_PRIO_Q_ING_VLAN; +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 4bccdce19b5a..8b7d911dccd8 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -295,6 +295,7 @@ static void qeth_l2_stop_card(struct qeth_card *card) + + flush_workqueue(card->event_wq); + card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED; ++ card->info.promisc_mode = 0; + } + + static int qeth_l2_process_inbound_buffer(struct qeth_card *card, +diff --git a/drivers/s390/net/qeth_l2_sys.c b/drivers/s390/net/qeth_l2_sys.c +index e2bcb26105a3..fc7101ad84de 100644 +--- a/drivers/s390/net/qeth_l2_sys.c ++++ b/drivers/s390/net/qeth_l2_sys.c +@@ -279,7 +279,8 @@ void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card) + return; + + mutex_lock(&card->sbp_lock); +- if (card->options.sbp.role != QETH_SBP_ROLE_NONE) { ++ if (!card->options.sbp.reflect_promisc && ++ card->options.sbp.role != QETH_SBP_ROLE_NONE) { + /* Conditional to avoid spurious error messages */ + qeth_bridgeport_setrole(card, card->options.sbp.role); + /* Let the callback function refresh the stored role value. */ +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index d7bfc7a0e4c0..32385327539b 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -1433,6 +1433,7 @@ static void qeth_l3_stop_card(struct qeth_card *card) + } + + flush_workqueue(card->event_wq); ++ card->info.promisc_mode = 0; + } + + static void qeth_l3_set_promisc_mode(struct qeth_card *card) +diff --git a/drivers/spi/spi-cavium-thunderx.c b/drivers/spi/spi-cavium-thunderx.c +index d12e149f1a41..fd6b9caffaf0 100644 +--- a/drivers/spi/spi-cavium-thunderx.c ++++ b/drivers/spi/spi-cavium-thunderx.c +@@ -82,6 +82,7 @@ static int thunderx_spi_probe(struct pci_dev *pdev, + + error: + clk_disable_unprepare(p->clk); ++ pci_release_regions(pdev); + spi_master_put(master); + return ret; + } +@@ -96,6 +97,7 @@ static void thunderx_spi_remove(struct pci_dev *pdev) + return; + + clk_disable_unprepare(p->clk); ++ pci_release_regions(pdev); + /* Put everything in a known state. */ + writeq(0, p->register_base + OCTEON_SPI_CFG(p)); + } +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index 2d563874b4ac..be7c6ba73072 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -612,6 +612,7 @@ static struct spi_master * fsl_spi_probe(struct device *dev, + master->setup = fsl_spi_setup; + master->cleanup = fsl_spi_cleanup; + master->transfer_one_message = fsl_spi_do_one_msg; ++ master->use_gpio_descriptors = true; + + mpc8xxx_spi = spi_master_get_devdata(master); + mpc8xxx_spi->max_bits_per_word = 32; +@@ -728,8 +729,18 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) + } + } + #endif +- +- pdata->cs_control = fsl_spi_cs_control; ++ /* ++ * Handle the case where we have one hardwired (always selected) ++ * device on the first "chipselect". Else we let the core code ++ * handle any GPIOs or native chip selects and assign the ++ * appropriate callback for dealing with the CS lines. This isn't ++ * supported on the GRLIB variant. ++ */ ++ ret = gpiod_count(dev, "cs"); ++ if (ret <= 0) ++ pdata->max_chipselect = 1; ++ else ++ pdata->cs_control = fsl_spi_cs_control; + } + + ret = of_address_to_resource(np, 0, &mem); +diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c +index 501b923f2c27..28ae5229f889 100644 +--- a/drivers/spi/spi-nxp-fspi.c ++++ b/drivers/spi/spi-nxp-fspi.c +@@ -439,7 +439,7 @@ static bool nxp_fspi_supports_op(struct spi_mem *mem, + op->data.nbytes > f->devtype_data->txfifo) + return false; + +- return true; ++ return spi_mem_default_supports_op(mem, op); + } + + /* Instead of busy looping invoke readl_poll_timeout functionality. */ +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 2e73d75a6ac5..ae95ec0bc964 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1441,6 +1441,10 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = { + { PCI_VDEVICE(INTEL, 0x4b2a), LPSS_BXT_SSP }, + { PCI_VDEVICE(INTEL, 0x4b2b), LPSS_BXT_SSP }, + { PCI_VDEVICE(INTEL, 0x4b37), LPSS_BXT_SSP }, ++ /* JSL */ ++ { PCI_VDEVICE(INTEL, 0x4daa), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0x4dab), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0x4dfb), LPSS_CNL_SSP }, + /* APL */ + { PCI_VDEVICE(INTEL, 0x5ac2), LPSS_BXT_SSP }, + { PCI_VDEVICE(INTEL, 0x5ac4), LPSS_BXT_SSP }, +diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c +index 3cb65371ae3b..66dcb6128539 100644 +--- a/drivers/spi/spi-ti-qspi.c ++++ b/drivers/spi/spi-ti-qspi.c +@@ -62,6 +62,7 @@ struct ti_qspi { + u32 dc; + + bool mmap_enabled; ++ int current_cs; + }; + + #define QSPI_PID (0x0) +@@ -487,6 +488,7 @@ static void ti_qspi_enable_memory_map(struct spi_device *spi) + MEM_CS_EN(spi->chip_select)); + } + qspi->mmap_enabled = true; ++ qspi->current_cs = spi->chip_select; + } + + static void ti_qspi_disable_memory_map(struct spi_device *spi) +@@ -498,6 +500,7 @@ static void ti_qspi_disable_memory_map(struct spi_device *spi) + regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg, + MEM_CS_MASK, 0); + qspi->mmap_enabled = false; ++ qspi->current_cs = -1; + } + + static void ti_qspi_setup_mmap_read(struct spi_device *spi, u8 opcode, +@@ -543,7 +546,7 @@ static int ti_qspi_exec_mem_op(struct spi_mem *mem, + + mutex_lock(&qspi->list_lock); + +- if (!qspi->mmap_enabled) ++ if (!qspi->mmap_enabled || qspi->current_cs != mem->spi->chip_select) + ti_qspi_enable_memory_map(mem->spi); + ti_qspi_setup_mmap_read(mem->spi, op->cmd.opcode, op->data.buswidth, + op->addr.nbytes, op->dummy.nbytes); +@@ -799,6 +802,7 @@ no_dma: + } + } + qspi->mmap_enabled = false; ++ qspi->current_cs = -1; + + ret = devm_spi_register_master(&pdev->dev, master); + if (!ret) +diff --git a/drivers/staging/axis-fifo/Kconfig b/drivers/staging/axis-fifo/Kconfig +index 3fffe4d6f327..f180a8e9f58a 100644 +--- a/drivers/staging/axis-fifo/Kconfig ++++ b/drivers/staging/axis-fifo/Kconfig +@@ -4,7 +4,7 @@ + # + config XIL_AXIS_FIFO + tristate "Xilinx AXI-Stream FIFO IP core driver" +- depends on OF ++ depends on OF && HAS_IOMEM + help + This adds support for the Xilinx AXI-Stream FIFO IP core driver. + The AXI Streaming FIFO allows memory mapped access to a AXI Streaming +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 1ac1095bfeac..5e92c6abe306 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -203,9 +203,58 @@ static const unsigned short super_speed_maxpacket_maxes[4] = { + [USB_ENDPOINT_XFER_INT] = 1024, + }; + +-static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, +- int asnum, struct usb_host_interface *ifp, int num_ep, +- unsigned char *buffer, int size) ++static bool endpoint_is_duplicate(struct usb_endpoint_descriptor *e1, ++ struct usb_endpoint_descriptor *e2) ++{ ++ if (e1->bEndpointAddress == e2->bEndpointAddress) ++ return true; ++ ++ if (usb_endpoint_xfer_control(e1) || usb_endpoint_xfer_control(e2)) { ++ if (usb_endpoint_num(e1) == usb_endpoint_num(e2)) ++ return true; ++ } ++ ++ return false; ++} ++ ++/* ++ * Check for duplicate endpoint addresses in other interfaces and in the ++ * altsetting currently being parsed. ++ */ ++static bool config_endpoint_is_duplicate(struct usb_host_config *config, ++ int inum, int asnum, struct usb_endpoint_descriptor *d) ++{ ++ struct usb_endpoint_descriptor *epd; ++ struct usb_interface_cache *intfc; ++ struct usb_host_interface *alt; ++ int i, j, k; ++ ++ for (i = 0; i < config->desc.bNumInterfaces; ++i) { ++ intfc = config->intf_cache[i]; ++ ++ for (j = 0; j < intfc->num_altsetting; ++j) { ++ alt = &intfc->altsetting[j]; ++ ++ if (alt->desc.bInterfaceNumber == inum && ++ alt->desc.bAlternateSetting != asnum) ++ continue; ++ ++ for (k = 0; k < alt->desc.bNumEndpoints; ++k) { ++ epd = &alt->endpoint[k].desc; ++ ++ if (endpoint_is_duplicate(epd, d)) ++ return true; ++ } ++ } ++ } ++ ++ return false; ++} ++ ++static int usb_parse_endpoint(struct device *ddev, int cfgno, ++ struct usb_host_config *config, int inum, int asnum, ++ struct usb_host_interface *ifp, int num_ep, ++ unsigned char *buffer, int size) + { + unsigned char *buffer0 = buffer; + struct usb_endpoint_descriptor *d; +@@ -242,13 +291,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, + goto skip_to_next_endpoint_or_interface_descriptor; + + /* Check for duplicate endpoint addresses */ +- for (i = 0; i < ifp->desc.bNumEndpoints; ++i) { +- if (ifp->endpoint[i].desc.bEndpointAddress == +- d->bEndpointAddress) { +- dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", +- cfgno, inum, asnum, d->bEndpointAddress); +- goto skip_to_next_endpoint_or_interface_descriptor; +- } ++ if (config_endpoint_is_duplicate(config, inum, asnum, d)) { ++ dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", ++ cfgno, inum, asnum, d->bEndpointAddress); ++ goto skip_to_next_endpoint_or_interface_descriptor; + } + + endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; +@@ -522,8 +568,8 @@ static int usb_parse_interface(struct device *ddev, int cfgno, + if (((struct usb_descriptor_header *) buffer)->bDescriptorType + == USB_DT_INTERFACE) + break; +- retval = usb_parse_endpoint(ddev, cfgno, inum, asnum, alt, +- num_ep, buffer, size); ++ retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum, ++ alt, num_ep, buffer, size); + if (retval < 0) + return retval; + ++n; +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index dfe9ac8d2375..8b23162e4239 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2691,7 +2691,7 @@ static unsigned hub_is_wusb(struct usb_hub *hub) + #define SET_ADDRESS_TRIES 2 + #define GET_DESCRIPTOR_TRIES 2 + #define SET_CONFIG_TRIES (2 * (use_both_schemes + 1)) +-#define USE_NEW_SCHEME(i, scheme) ((i) / 2 == (int)scheme) ++#define USE_NEW_SCHEME(i, scheme) ((i) / 2 == (int)(scheme)) + + #define HUB_ROOT_RESET_TIME 60 /* times are in msec */ + #define HUB_SHORT_RESET_TIME 10 +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 0c960a97ea02..154f3f3e8cff 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2467,6 +2467,13 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep, + + static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req) + { ++ /* ++ * For OUT direction, host may send less than the setup ++ * length. Return true for all OUT requests. ++ */ ++ if (!req->direction) ++ return true; ++ + return req->request.actual == req->request.length; + } + +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index a8f1e5707c14..4c9d1e49d5ed 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -1321,7 +1321,7 @@ static int dummy_perform_transfer(struct urb *urb, struct dummy_request *req, + u32 this_sg; + bool next_sg; + +- to_host = usb_pipein(urb->pipe); ++ to_host = usb_urb_dir_in(urb); + rbuf = req->req.buf + req->req.actual; + + if (!urb->num_sgs) { +@@ -1409,7 +1409,7 @@ top: + + /* FIXME update emulated data toggle too */ + +- to_host = usb_pipein(urb->pipe); ++ to_host = usb_urb_dir_in(urb); + if (unlikely(len == 0)) + is_short = 1; + else { +@@ -1830,7 +1830,7 @@ restart: + + /* find the gadget's ep for this request (if configured) */ + address = usb_pipeendpoint (urb->pipe); +- if (usb_pipein(urb->pipe)) ++ if (usb_urb_dir_in(urb)) + address |= USB_DIR_IN; + ep = find_endpoint(dum, address); + if (!ep) { +@@ -2385,7 +2385,7 @@ static inline ssize_t show_urb(char *buf, size_t size, struct urb *urb) + s = "?"; + break; + } s; }), +- ep, ep ? (usb_pipein(urb->pipe) ? "in" : "out") : "", ++ ep, ep ? (usb_urb_dir_in(urb) ? "in" : "out") : "", + ({ char *s; \ + switch (usb_pipetype(urb->pipe)) { \ + case PIPE_CONTROL: \ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index e9491d400a24..fea09a3f491f 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1172,6 +1172,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff), /* Telit ME910G1 */ ++ .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), +diff --git a/drivers/usb/typec/tcpm/Kconfig b/drivers/usb/typec/tcpm/Kconfig +index 72481bbb2af3..5b986d6c801d 100644 +--- a/drivers/usb/typec/tcpm/Kconfig ++++ b/drivers/usb/typec/tcpm/Kconfig +@@ -32,6 +32,7 @@ endif # TYPEC_TCPCI + config TYPEC_FUSB302 + tristate "Fairchild FUSB302 Type-C chip driver" + depends on I2C ++ depends on EXTCON || !EXTCON + help + The Fairchild FUSB302 Type-C chip driver that works with + Type-C Port Controller Manager to provide USB PD and USB +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index eb95ed78a18e..dc50605ecbda 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -3781,6 +3781,7 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info, + u64 flags, int delalloc) + { + int ret = 0; ++ int cache_block_group_error = 0; + struct btrfs_free_cluster *last_ptr = NULL; + struct btrfs_block_group_cache *block_group = NULL; + struct find_free_extent_ctl ffe_ctl = {0}; +@@ -3940,7 +3941,20 @@ have_block_group: + if (unlikely(!ffe_ctl.cached)) { + ffe_ctl.have_caching_bg = true; + ret = btrfs_cache_block_group(block_group, 0); +- BUG_ON(ret < 0); ++ ++ /* ++ * If we get ENOMEM here or something else we want to ++ * try other block groups, because it may not be fatal. ++ * However if we can't find anything else we need to ++ * save our return here so that we return the actual ++ * error that caused problems, not ENOSPC. ++ */ ++ if (ret < 0) { ++ if (!cache_block_group_error) ++ cache_block_group_error = ret; ++ ret = 0; ++ goto loop; ++ } + ret = 0; + } + +@@ -4027,7 +4041,7 @@ loop: + if (ret > 0) + goto search; + +- if (ret == -ENOSPC) { ++ if (ret == -ENOSPC && !cache_block_group_error) { + /* + * Use ffe_ctl->total_free_space as fallback if we can't find + * any contiguous hole. +@@ -4038,6 +4052,8 @@ loop: + space_info->max_extent_size = ffe_ctl.max_extent_size; + spin_unlock(&space_info->lock); + ins->offset = ffe_ctl.max_extent_size; ++ } else if (ret == -ENOSPC) { ++ ret = cache_block_group_error; + } + return ret; + } +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index c332968f9056..eaafd00f93d4 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -2601,8 +2601,8 @@ int btrfs_punch_hole_range(struct inode *inode, struct btrfs_path *path, + } + } + +- if (clone_info) { +- u64 clone_len = drop_end - cur_offset; ++ if (clone_info && drop_end > clone_info->file_offset) { ++ u64 clone_len = drop_end - clone_info->file_offset; + + ret = btrfs_insert_clone_extent(trans, inode, path, + clone_info, clone_len); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index a56dcc0c9c2a..5720e450a46f 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3727,24 +3727,18 @@ process_slot: + ret = 0; + + if (last_dest_end < destoff + len) { +- struct btrfs_clone_extent_info clone_info = { 0 }; + /* +- * We have an implicit hole (NO_HOLES feature is enabled) that +- * fully or partially overlaps our cloning range at its end. ++ * We have an implicit hole that fully or partially overlaps our ++ * cloning range at its end. This means that we either have the ++ * NO_HOLES feature enabled or the implicit hole happened due to ++ * mixing buffered and direct IO writes against this file. + */ + btrfs_release_path(path); + path->leave_spinning = 0; + +- /* +- * We are dealing with a hole and our clone_info already has a +- * disk_offset of 0, we only need to fill the data length and +- * file offset. +- */ +- clone_info.data_len = destoff + len - last_dest_end; +- clone_info.file_offset = last_dest_end; + ret = btrfs_punch_hole_range(inode, path, + last_dest_end, destoff + len - 1, +- &clone_info, &trans); ++ NULL, &trans); + if (ret) + goto out; + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 27a903aaf43b..aeb5f2f3cdd7 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3232,12 +3232,12 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, + if (!(fs_info->qgroup_flags & + BTRFS_QGROUP_STATUS_FLAG_RESCAN)) { + btrfs_warn(fs_info, +- "qgroup rescan init failed, qgroup is not enabled"); ++ "qgroup rescan init failed, qgroup rescan is not queued"); + ret = -EINVAL; + } else if (!(fs_info->qgroup_flags & + BTRFS_QGROUP_STATUS_FLAG_ON)) { + btrfs_warn(fs_info, +- "qgroup rescan init failed, qgroup rescan is not queued"); ++ "qgroup rescan init failed, qgroup is not enabled"); + ret = -EINVAL; + } + +diff --git a/fs/drop_caches.c b/fs/drop_caches.c +index d31b6c72b476..dc1a1d5d825b 100644 +--- a/fs/drop_caches.c ++++ b/fs/drop_caches.c +@@ -35,11 +35,11 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused) + spin_unlock(&inode->i_lock); + spin_unlock(&sb->s_inode_list_lock); + +- cond_resched(); + invalidate_mapping_pages(inode->i_mapping, 0, -1); + iput(toput_inode); + toput_inode = inode; + ++ cond_resched(); + spin_lock(&sb->s_inode_list_lock); + } + spin_unlock(&sb->s_inode_list_lock); +diff --git a/fs/inode.c b/fs/inode.c +index fef457a42882..96d62d97694e 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -676,6 +676,7 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty) + struct inode *inode, *next; + LIST_HEAD(dispose); + ++again: + spin_lock(&sb->s_inode_list_lock); + list_for_each_entry_safe(inode, next, &sb->s_inodes, i_sb_list) { + spin_lock(&inode->i_lock); +@@ -698,6 +699,12 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty) + inode_lru_list_del(inode); + spin_unlock(&inode->i_lock); + list_add(&inode->i_lru, &dispose); ++ if (need_resched()) { ++ spin_unlock(&sb->s_inode_list_lock); ++ cond_resched(); ++ dispose_list(&dispose); ++ goto again; ++ } + } + spin_unlock(&sb->s_inode_list_lock); + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index a60c6315a348..709671faaed6 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -3721,6 +3721,9 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, + mutex_lock(&ctx->uring_lock); + submitted = io_ring_submit(ctx, to_submit); + mutex_unlock(&ctx->uring_lock); ++ ++ if (submitted != to_submit) ++ goto out; + } + if (flags & IORING_ENTER_GETEVENTS) { + unsigned nr_events = 0; +@@ -3734,6 +3737,7 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, + } + } + ++out: + percpu_ref_put(&ctx->refs); + out_fput: + fdput(f); +diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c +index 2ecef6155fc0..f44e39c68328 100644 +--- a/fs/notify/fsnotify.c ++++ b/fs/notify/fsnotify.c +@@ -57,6 +57,9 @@ static void fsnotify_unmount_inodes(struct super_block *sb) + * doing an __iget/iput with SB_ACTIVE clear would actually + * evict all inodes with zero i_count from icache which is + * unnecessarily violent and may in fact be illegal to do. ++ * However, we should have been called /after/ evict_inodes ++ * removed all zero refcount inodes, in any case. Test to ++ * be sure. + */ + if (!atomic_read(&inode->i_count)) { + spin_unlock(&inode->i_lock); +@@ -77,6 +80,7 @@ static void fsnotify_unmount_inodes(struct super_block *sb) + + iput_inode = inode; + ++ cond_resched(); + spin_lock(&sb->s_inode_list_lock); + } + spin_unlock(&sb->s_inode_list_lock); +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 9b96243de081..7abc3230c21a 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -986,6 +986,7 @@ static int add_dquot_ref(struct super_block *sb, int type) + * later. + */ + old_inode = inode; ++ cond_resched(); + spin_lock(&sb->s_inode_list_lock); + } + spin_unlock(&sb->s_inode_list_lock); +diff --git a/fs/super.c b/fs/super.c +index cfadab2cbf35..cd352530eca9 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -448,10 +448,12 @@ void generic_shutdown_super(struct super_block *sb) + sync_filesystem(sb); + sb->s_flags &= ~SB_ACTIVE; + +- fsnotify_sb_delete(sb); + cgroup_writeback_umount(); + ++ /* evict all inodes with zero refcount */ + evict_inodes(sb); ++ /* only nonzero refcount inodes can have marks */ ++ fsnotify_sb_delete(sb); + + if (sb->s_dio_done_wq) { + destroy_workqueue(sb->s_dio_done_wq); +diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h +index 76cf11e905e1..8a9792a6427a 100644 +--- a/include/linux/if_ether.h ++++ b/include/linux/if_ether.h +@@ -24,6 +24,14 @@ static inline struct ethhdr *eth_hdr(const struct sk_buff *skb) + return (struct ethhdr *)skb_mac_header(skb); + } + ++/* Prefer this version in TX path, instead of ++ * skb_reset_mac_header() + eth_hdr() ++ */ ++static inline struct ethhdr *skb_eth_hdr(const struct sk_buff *skb) ++{ ++ return (struct ethhdr *)skb->data; ++} ++ + static inline struct ethhdr *inner_eth_hdr(const struct sk_buff *skb) + { + return (struct ethhdr *)skb_inner_mac_header(skb); +diff --git a/include/uapi/linux/netfilter/xt_sctp.h b/include/uapi/linux/netfilter/xt_sctp.h +index 4bc6d1a08781..b4d804a9fccb 100644 +--- a/include/uapi/linux/netfilter/xt_sctp.h ++++ b/include/uapi/linux/netfilter/xt_sctp.h +@@ -41,19 +41,19 @@ struct xt_sctp_info { + #define SCTP_CHUNKMAP_SET(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] |= \ +- 1 << (type % bytes(__u32)); \ ++ 1u << (type % bytes(__u32)); \ + } while (0) + + #define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] &= \ +- ~(1 << (type % bytes(__u32))); \ ++ ~(1u << (type % bytes(__u32))); \ + } while (0) + + #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \ + ({ \ + ((chunkmap)[type / bytes (__u32)] & \ +- (1 << (type % bytes (__u32)))) ? 1: 0; \ ++ (1u << (type % bytes (__u32)))) ? 1: 0; \ + }) + + #define SCTP_CHUNKMAP_RESET(chunkmap) \ +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 5c51021775af..9c74c98f6501 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6039,6 +6039,7 @@ static bool may_access_skb(enum bpf_prog_type type) + static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) + { + struct bpf_reg_state *regs = cur_regs(env); ++ static const int ctx_reg = BPF_REG_6; + u8 mode = BPF_MODE(insn->code); + int i, err; + +@@ -6072,7 +6073,7 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) + } + + /* check whether implicit source operand (register R6) is readable */ +- err = check_reg_arg(env, BPF_REG_6, SRC_OP); ++ err = check_reg_arg(env, ctx_reg, SRC_OP); + if (err) + return err; + +@@ -6091,7 +6092,7 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) + return -EINVAL; + } + +- if (regs[BPF_REG_6].type != PTR_TO_CTX) { ++ if (regs[ctx_reg].type != PTR_TO_CTX) { + verbose(env, + "at the time of BPF_LD_ABS|IND R6 != pointer to skb\n"); + return -EINVAL; +@@ -6104,6 +6105,10 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) + return err; + } + ++ err = check_ctx_reg(env, ®s[ctx_reg], ctx_reg); ++ if (err < 0) ++ return err; ++ + /* reset caller saved regs to unreadable */ + for (i = 0; i < CALLER_SAVED_REGS; i++) { + mark_reg_not_init(env, regs, caller_saved[i]); +diff --git a/kernel/locking/spinlock_debug.c b/kernel/locking/spinlock_debug.c +index 399669f7eba8..472dd462a40c 100644 +--- a/kernel/locking/spinlock_debug.c ++++ b/kernel/locking/spinlock_debug.c +@@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init); + + static void spin_dump(raw_spinlock_t *lock, const char *msg) + { +- struct task_struct *owner = NULL; ++ struct task_struct *owner = READ_ONCE(lock->owner); + +- if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT) +- owner = lock->owner; ++ if (owner == SPINLOCK_OWNER_INIT) ++ owner = NULL; + printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n", + msg, raw_smp_processor_id(), + current->comm, task_pid_nr(current)); + printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, " + ".owner_cpu: %d\n", +- lock, lock->magic, ++ lock, READ_ONCE(lock->magic), + owner ? owner->comm : "", + owner ? task_pid_nr(owner) : -1, +- lock->owner_cpu); ++ READ_ONCE(lock->owner_cpu)); + dump_stack(); + } + +@@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *lock, const char *msg) + static inline void + debug_spin_lock_before(raw_spinlock_t *lock) + { +- SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic"); +- SPIN_BUG_ON(lock->owner == current, lock, "recursion"); +- SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(), ++ SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic"); ++ SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion"); ++ SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(), + lock, "cpu recursion"); + } + + static inline void debug_spin_lock_after(raw_spinlock_t *lock) + { +- lock->owner_cpu = raw_smp_processor_id(); +- lock->owner = current; ++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); ++ WRITE_ONCE(lock->owner, current); + } + + static inline void debug_spin_unlock(raw_spinlock_t *lock) +@@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw_spinlock_t *lock) + SPIN_BUG_ON(lock->owner != current, lock, "wrong owner"); + SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), + lock, "wrong CPU"); +- lock->owner = SPINLOCK_OWNER_INIT; +- lock->owner_cpu = -1; ++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); ++ WRITE_ONCE(lock->owner_cpu, -1); + } + + /* +@@ -187,8 +187,8 @@ static inline void debug_write_lock_before(rwlock_t *lock) + + static inline void debug_write_lock_after(rwlock_t *lock) + { +- lock->owner_cpu = raw_smp_processor_id(); +- lock->owner = current; ++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); ++ WRITE_ONCE(lock->owner, current); + } + + static inline void debug_write_unlock(rwlock_t *lock) +@@ -197,8 +197,8 @@ static inline void debug_write_unlock(rwlock_t *lock) + RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner"); + RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), + lock, "wrong CPU"); +- lock->owner = SPINLOCK_OWNER_INIT; +- lock->owner_cpu = -1; ++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); ++ WRITE_ONCE(lock->owner_cpu, -1); + } + + void do_raw_write_lock(rwlock_t *lock) +diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c +index 517e3719027e..ce8f6748678a 100644 +--- a/kernel/sched/psi.c ++++ b/kernel/sched/psi.c +@@ -185,7 +185,8 @@ static void group_init(struct psi_group *group) + + for_each_possible_cpu(cpu) + seqcount_init(&per_cpu_ptr(group->pcpu, cpu)->seq); +- group->avg_next_update = sched_clock() + psi_period; ++ group->avg_last_update = sched_clock(); ++ group->avg_next_update = group->avg_last_update + psi_period; + INIT_DELAYED_WORK(&group->avgs_work, psi_avgs_work); + mutex_init(&group->avgs_lock); + /* Init trigger-related members */ +@@ -481,7 +482,7 @@ static u64 window_update(struct psi_window *win, u64 now, u64 value) + u32 remaining; + + remaining = win->size - elapsed; +- growth += div_u64(win->prev_growth * remaining, win->size); ++ growth += div64_u64(win->prev_growth * remaining, win->size); + } + + return growth; +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 66358d66c933..4bf050fcfe3b 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include /* for self test */ +@@ -5068,6 +5069,11 @@ static __init int test_ringbuffer(void) + int cpu; + int ret = 0; + ++ if (security_locked_down(LOCKDOWN_TRACEFS)) { ++ pr_warning("Lockdown is enabled, skipping ring buffer tests\n"); ++ return 0; ++ } ++ + pr_info("Running ring buffer tests...\n"); + + buffer = ring_buffer_alloc(RB_TEST_BUFFER_SIZE, RB_FL_OVERWRITE); +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index d8bd9b1d8bce..bcb72f102613 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1804,6 +1804,12 @@ int __init register_tracer(struct tracer *type) + return -1; + } + ++ if (security_locked_down(LOCKDOWN_TRACEFS)) { ++ pr_warning("Can not register tracer %s due to lockdown\n", ++ type->name); ++ return -EPERM; ++ } ++ + mutex_lock(&trace_types_lock); + + tracing_selftest_running = true; +@@ -8647,6 +8653,11 @@ struct dentry *tracing_init_dentry(void) + { + struct trace_array *tr = &global_trace; + ++ if (security_locked_down(LOCKDOWN_TRACEFS)) { ++ pr_warning("Tracing disabled due to lockdown\n"); ++ return ERR_PTR(-EPERM); ++ } ++ + /* The top level trace array uses NULL as parent */ + if (tr->dir) + return NULL; +@@ -9089,6 +9100,12 @@ __init static int tracer_alloc_buffers(void) + int ring_buf_size; + int ret = -ENOMEM; + ++ ++ if (security_locked_down(LOCKDOWN_TRACEFS)) { ++ pr_warning("Tracing disabled due to lockdown\n"); ++ return -EPERM; ++ } ++ + /* + * Make sure we don't accidently add more trace options + * than we have bits for. +diff --git a/lib/sbitmap.c b/lib/sbitmap.c +index 969e5400a615..ee3ce1494568 100644 +--- a/lib/sbitmap.c ++++ b/lib/sbitmap.c +@@ -667,8 +667,8 @@ void sbitmap_add_wait_queue(struct sbitmap_queue *sbq, + if (!sbq_wait->sbq) { + sbq_wait->sbq = sbq; + atomic_inc(&sbq->ws_active); ++ add_wait_queue(&ws->wait, &sbq_wait->wait); + } +- add_wait_queue(&ws->wait, &sbq_wait->wait); + } + EXPORT_SYMBOL_GPL(sbitmap_add_wait_queue); + +diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h +index c46daf09a501..bb7ec1a3915d 100644 +--- a/net/8021q/vlan.h ++++ b/net/8021q/vlan.h +@@ -126,6 +126,7 @@ int vlan_check_real_dev(struct net_device *real_dev, + void vlan_setup(struct net_device *dev); + int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack); + void unregister_vlan_dev(struct net_device *dev, struct list_head *head); ++void vlan_dev_uninit(struct net_device *dev); + bool vlan_dev_inherit_address(struct net_device *dev, + struct net_device *real_dev); + +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index e5bff5cc6f97..2a78da4072de 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -586,7 +586,8 @@ static int vlan_dev_init(struct net_device *dev) + return 0; + } + +-static void vlan_dev_uninit(struct net_device *dev) ++/* Note: this function might be called multiple times for the same device. */ ++void vlan_dev_uninit(struct net_device *dev) + { + struct vlan_priority_tci_mapping *pm; + struct vlan_dev_priv *vlan = vlan_dev_priv(dev); +diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c +index c482a6fe9393..0db85aeb119b 100644 +--- a/net/8021q/vlan_netlink.c ++++ b/net/8021q/vlan_netlink.c +@@ -108,11 +108,13 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[], + struct ifla_vlan_flags *flags; + struct ifla_vlan_qos_mapping *m; + struct nlattr *attr; +- int rem; ++ int rem, err; + + if (data[IFLA_VLAN_FLAGS]) { + flags = nla_data(data[IFLA_VLAN_FLAGS]); +- vlan_dev_change_flags(dev, flags->flags, flags->mask); ++ err = vlan_dev_change_flags(dev, flags->flags, flags->mask); ++ if (err) ++ return err; + } + if (data[IFLA_VLAN_INGRESS_QOS]) { + nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) { +@@ -123,7 +125,9 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[], + if (data[IFLA_VLAN_EGRESS_QOS]) { + nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) { + m = nla_data(attr); +- vlan_dev_set_egress_priority(dev, m->from, m->to); ++ err = vlan_dev_set_egress_priority(dev, m->from, m->to); ++ if (err) ++ return err; + } + } + return 0; +@@ -179,10 +183,11 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev, + return -EINVAL; + + err = vlan_changelink(dev, tb, data, extack); +- if (err < 0) +- return err; +- +- return register_vlan_dev(dev, extack); ++ if (!err) ++ err = register_vlan_dev(dev, extack); ++ if (err) ++ vlan_dev_uninit(dev); ++ return err; + } + + static inline size_t vlan_qos_map_size(unsigned int n) +diff --git a/net/core/filter.c b/net/core/filter.c +index 6d0111bfdb4a..2f76461c120d 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2055,6 +2055,7 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb) + } + + skb->dev = dev; ++ skb->tstamp = 0; + + dev_xmit_recursion_inc(); + ret = dev_queue_xmit(skb); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index a2e52ad7cdab..67e44e6717b0 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -1727,8 +1727,11 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb, + } + + /* Ignore very old stuff early */ +- if (!after(sp[used_sacks].end_seq, prior_snd_una)) ++ if (!after(sp[used_sacks].end_seq, prior_snd_una)) { ++ if (i == 0) ++ first_sack_index = -1; + continue; ++ } + + used_sacks++; + } +diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c +index 204a8351efff..c29170e767a8 100644 +--- a/net/llc/llc_station.c ++++ b/net/llc/llc_station.c +@@ -32,7 +32,7 @@ static int llc_stat_ev_rx_null_dsap_xid_c(struct sk_buff *skb) + return LLC_PDU_IS_CMD(pdu) && /* command PDU */ + LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ + LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID && +- !pdu->dsap ? 0 : 1; /* NULL DSAP value */ ++ !pdu->dsap; /* NULL DSAP value */ + } + + static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) +@@ -42,7 +42,7 @@ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) + return LLC_PDU_IS_CMD(pdu) && /* command PDU */ + LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ + LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST && +- !pdu->dsap ? 0 : 1; /* NULL DSAP */ ++ !pdu->dsap; /* NULL DSAP */ + } + + static int llc_station_ac_send_xid_r(struct sk_buff *skb) +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 1fa422782905..cbd273c0b275 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -2263,6 +2263,15 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb, + payload[7]); + } + ++ /* ++ * Initialize skb->priority for QoS frames. This is put in the TID field ++ * of the frame before passing it to the driver. ++ */ ++ if (ieee80211_is_data_qos(hdr->frame_control)) { ++ u8 *p = ieee80211_get_qos_ctl(hdr); ++ skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK; ++ } ++ + memset(info, 0, sizeof(*info)); + + info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS | +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index e2d13cd18875..aa8adf930b3c 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -3602,6 +3602,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list) + + list_for_each_entry(net, net_exit_list, exit_list) + ctnetlink_net_exit(net); ++ ++ /* wait for other cpus until they are done with ctnl_notifiers */ ++ synchronize_rcu(); + } + + static struct pernet_operations ctnetlink_net_ops = { +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 712a428509ad..67ca47c7ce54 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4252,8 +4252,10 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, + return err; + + err = -EINVAL; +- if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) ++ if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) { ++ nft_data_release(&elem.key.val, desc.type); + return err; ++ } + + priv = set->ops->get(ctx->net, set, &elem, flags); + if (IS_ERR(priv)) +@@ -4489,14 +4491,20 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + if (nla[NFTA_SET_ELEM_DATA] == NULL && + !(flags & NFT_SET_ELEM_INTERVAL_END)) + return -EINVAL; +- if (nla[NFTA_SET_ELEM_DATA] != NULL && +- flags & NFT_SET_ELEM_INTERVAL_END) +- return -EINVAL; + } else { + if (nla[NFTA_SET_ELEM_DATA] != NULL) + return -EINVAL; + } + ++ if ((flags & NFT_SET_ELEM_INTERVAL_END) && ++ (nla[NFTA_SET_ELEM_DATA] || ++ nla[NFTA_SET_ELEM_OBJREF] || ++ nla[NFTA_SET_ELEM_TIMEOUT] || ++ nla[NFTA_SET_ELEM_EXPIRATION] || ++ nla[NFTA_SET_ELEM_USERDATA] || ++ nla[NFTA_SET_ELEM_EXPR])) ++ return -EINVAL; ++ + timeout = 0; + if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { + if (!(set->flags & NFT_SET_TIMEOUT)) +@@ -5209,7 +5217,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, + if (nlh->nlmsg_flags & NLM_F_REPLACE) + return -EOPNOTSUPP; + +- type = nft_obj_type_get(net, objtype); ++ type = __nft_obj_type_get(objtype); + nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + + return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); +diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c +index 5f6037695dee..e743f811245f 100644 +--- a/net/netfilter/nf_tables_offload.c ++++ b/net/netfilter/nf_tables_offload.c +@@ -44,6 +44,9 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, + expr = nft_expr_next(expr); + } + ++ if (num_actions == 0) ++ return ERR_PTR(-EOPNOTSUPP); ++ + flow = nft_flow_rule_alloc(num_actions); + if (!flow) + return ERR_PTR(-ENOMEM); +@@ -446,6 +449,9 @@ static int nft_offload_netdev_event(struct notifier_block *this, + struct net *net = dev_net(dev); + struct nft_chain *chain; + ++ if (event != NETDEV_UNREGISTER) ++ return NOTIFY_DONE; ++ + mutex_lock(&net->nft.commit_mutex); + chain = __nft_offload_get_chain(dev); + if (chain) +diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c +index 02afa752dd2e..10e9d50e4e19 100644 +--- a/net/netfilter/nft_bitwise.c ++++ b/net/netfilter/nft_bitwise.c +@@ -80,7 +80,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, + tb[NFTA_BITWISE_MASK]); + if (err < 0) + return err; +- if (d1.len != priv->len) { ++ if (d1.type != NFT_DATA_VALUE || d1.len != priv->len) { + err = -EINVAL; + goto err1; + } +@@ -89,7 +89,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, + tb[NFTA_BITWISE_XOR]); + if (err < 0) + goto err1; +- if (d2.len != priv->len) { ++ if (d2.type != NFT_DATA_VALUE || d2.len != priv->len) { + err = -EINVAL; + goto err2; + } +diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c +index 0744b2bb46da..ae730dba60c8 100644 +--- a/net/netfilter/nft_cmp.c ++++ b/net/netfilter/nft_cmp.c +@@ -80,6 +80,12 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + if (err < 0) + return err; + ++ if (desc.type != NFT_DATA_VALUE) { ++ err = -EINVAL; ++ nft_data_release(&priv->data, desc.type); ++ return err; ++ } ++ + priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]); + err = nft_validate_register_load(priv->sreg, desc.len); + if (err < 0) +diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c +index 4701fa8a45e7..89efcc5a533d 100644 +--- a/net/netfilter/nft_range.c ++++ b/net/netfilter/nft_range.c +@@ -66,11 +66,21 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr + if (err < 0) + return err; + ++ if (desc_from.type != NFT_DATA_VALUE) { ++ err = -EINVAL; ++ goto err1; ++ } ++ + err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to), + &desc_to, tb[NFTA_RANGE_TO_DATA]); + if (err < 0) + goto err1; + ++ if (desc_to.type != NFT_DATA_VALUE) { ++ err = -EINVAL; ++ goto err2; ++ } ++ + if (desc_from.len != desc_to.len) { + err = -EINVAL; + goto err2; +diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c +index 57123259452f..a9f804f7a04a 100644 +--- a/net/netfilter/nft_set_rbtree.c ++++ b/net/netfilter/nft_set_rbtree.c +@@ -74,8 +74,13 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set + parent = rcu_dereference_raw(parent->rb_left); + continue; + } +- if (nft_rbtree_interval_end(rbe)) +- goto out; ++ if (nft_rbtree_interval_end(rbe)) { ++ if (nft_set_is_anonymous(set)) ++ return false; ++ parent = rcu_dereference_raw(parent->rb_left); ++ interval = NULL; ++ continue; ++ } + + *ext = &rbe->ext; + return true; +@@ -88,7 +93,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set + *ext = &interval->ext; + return true; + } +-out: ++ + return false; + } + +@@ -139,8 +144,10 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, + if (flags & NFT_SET_ELEM_INTERVAL_END) + interval = rbe; + } else { +- if (!nft_set_elem_active(&rbe->ext, genmask)) ++ if (!nft_set_elem_active(&rbe->ext, genmask)) { + parent = rcu_dereference_raw(parent->rb_left); ++ continue; ++ } + + if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) || + (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) == +@@ -148,7 +155,11 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, + *elem = rbe; + return true; + } +- return false; ++ ++ if (nft_rbtree_interval_end(rbe)) ++ interval = NULL; ++ ++ parent = rcu_dereference_raw(parent->rb_left); + } + } + +diff --git a/net/rfkill/core.c b/net/rfkill/core.c +index 0bf9bf1ceb8f..6c089320ae4f 100644 +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -1002,10 +1002,13 @@ static void rfkill_sync_work(struct work_struct *work) + int __must_check rfkill_register(struct rfkill *rfkill) + { + static unsigned long rfkill_no; +- struct device *dev = &rfkill->dev; ++ struct device *dev; + int error; + +- BUG_ON(!rfkill); ++ if (!rfkill) ++ return -EINVAL; ++ ++ dev = &rfkill->dev; + + mutex_lock(&rfkill_global_mutex); + +diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c +index 53a80bc6b13a..dd0e8680b030 100644 +--- a/net/sched/sch_cake.c ++++ b/net/sched/sch_cake.c +@@ -1769,7 +1769,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, + q->avg_window_begin)); + u64 b = q->avg_window_bytes * (u64)NSEC_PER_SEC; + +- do_div(b, window_interval); ++ b = div64_u64(b, window_interval); + q->avg_peak_bandwidth = + cake_ewma(q->avg_peak_bandwidth, b, + b > q->avg_peak_bandwidth ? 2 : 8); +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 78ecdf146882..712ad248d6a7 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -787,10 +787,12 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt, + if (tb[TCA_FQ_QUANTUM]) { + u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]); + +- if (quantum > 0) ++ if (quantum > 0 && quantum <= (1 << 20)) { + q->quantum = quantum; +- else ++ } else { ++ NL_SET_ERR_MSG_MOD(extack, "invalid quantum"); + err = -EINVAL; ++ } + } + + if (tb[TCA_FQ_INITIAL_QUANTUM]) +diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c +index 18b884cfdfe8..647941702f9f 100644 +--- a/net/sched/sch_prio.c ++++ b/net/sched/sch_prio.c +@@ -292,8 +292,14 @@ static int prio_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, + struct tc_prio_qopt_offload graft_offload; + unsigned long band = arg - 1; + +- if (new == NULL) +- new = &noop_qdisc; ++ if (!new) { ++ new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, ++ TC_H_MAKE(sch->handle, arg), extack); ++ if (!new) ++ new = &noop_qdisc; ++ else ++ qdisc_hash_add(new, true); ++ } + + *old = qdisc_replace(sch, new, &q->queues[band]); + +diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c +index e52b2128e43b..b06cae508158 100644 +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -1358,8 +1358,10 @@ static int sctp_cmd_interpreter(enum sctp_event_type event_type, + /* Generate an INIT ACK chunk. */ + new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC, + 0); +- if (!new_obj) +- goto nomem; ++ if (!new_obj) { ++ error = -ENOMEM; ++ break; ++ } + + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, + SCTP_CHUNK(new_obj)); +@@ -1381,7 +1383,8 @@ static int sctp_cmd_interpreter(enum sctp_event_type event_type, + if (!new_obj) { + if (cmd->obj.chunk) + sctp_chunk_free(cmd->obj.chunk); +- goto nomem; ++ error = -ENOMEM; ++ break; + } + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, + SCTP_CHUNK(new_obj)); +@@ -1428,8 +1431,10 @@ static int sctp_cmd_interpreter(enum sctp_event_type event_type, + + /* Generate a SHUTDOWN chunk. */ + new_obj = sctp_make_shutdown(asoc, chunk); +- if (!new_obj) +- goto nomem; ++ if (!new_obj) { ++ error = -ENOMEM; ++ break; ++ } + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, + SCTP_CHUNK(new_obj)); + break; +@@ -1765,11 +1770,17 @@ static int sctp_cmd_interpreter(enum sctp_event_type event_type, + break; + } + +- if (error) ++ if (error) { ++ cmd = sctp_next_cmd(commands); ++ while (cmd) { ++ if (cmd->verb == SCTP_CMD_REPLY) ++ sctp_chunk_free(cmd->obj.chunk); ++ cmd = sctp_next_cmd(commands); ++ } + break; ++ } + } + +-out: + /* If this is in response to a received chunk, wait until + * we are done with the packet to open the queue so that we don't + * send multiple packets in response to a single request. +@@ -1784,7 +1795,4 @@ out: + sp->data_ready_signalled = 0; + + return error; +-nomem: +- error = -ENOMEM; +- goto out; + } +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 350513744575..3e25229a059d 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -1102,6 +1102,7 @@ static void __cfg80211_unregister_wdev(struct wireless_dev *wdev, bool sync) + + #ifdef CONFIG_CFG80211_WEXT + kzfree(wdev->wext.keys); ++ wdev->wext.keys = NULL; + #endif + /* only initialized if we have a netdev */ + if (wdev->netdev) +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 9044073fbf22..d426fc01c529 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -305,12 +305,21 @@ out: + } + EXPORT_SYMBOL(xsk_umem_consume_tx); + +-static int xsk_zc_xmit(struct xdp_sock *xs) ++static int xsk_wakeup(struct xdp_sock *xs, u8 flags) + { + struct net_device *dev = xs->dev; ++ int err; ++ ++ rcu_read_lock(); ++ err = dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, flags); ++ rcu_read_unlock(); ++ ++ return err; ++} + +- return dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, +- XDP_WAKEUP_TX); ++static int xsk_zc_xmit(struct xdp_sock *xs) ++{ ++ return xsk_wakeup(xs, XDP_WAKEUP_TX); + } + + static void xsk_destruct_skb(struct sk_buff *skb) +@@ -424,19 +433,16 @@ static unsigned int xsk_poll(struct file *file, struct socket *sock, + unsigned int mask = datagram_poll(file, sock, wait); + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); +- struct net_device *dev; + struct xdp_umem *umem; + + if (unlikely(!xsk_is_bound(xs))) + return mask; + +- dev = xs->dev; + umem = xs->umem; + + if (umem->need_wakeup) { +- if (dev->netdev_ops->ndo_xsk_wakeup) +- dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, +- umem->need_wakeup); ++ if (xs->zc) ++ xsk_wakeup(xs, umem->need_wakeup); + else + /* Poll needs to drive Tx also in copy mode */ + __xsk_sendmsg(sk); +diff --git a/samples/bpf/syscall_tp_kern.c b/samples/bpf/syscall_tp_kern.c +index 1d78819ffef1..630ce8c4d5a2 100644 +--- a/samples/bpf/syscall_tp_kern.c ++++ b/samples/bpf/syscall_tp_kern.c +@@ -47,13 +47,27 @@ static __always_inline void count(void *map) + SEC("tracepoint/syscalls/sys_enter_open") + int trace_enter_open(struct syscalls_enter_open_args *ctx) + { +- count((void *)&enter_open_map); ++ count(&enter_open_map); ++ return 0; ++} ++ ++SEC("tracepoint/syscalls/sys_enter_openat") ++int trace_enter_open_at(struct syscalls_enter_open_args *ctx) ++{ ++ count(&enter_open_map); + return 0; + } + + SEC("tracepoint/syscalls/sys_exit_open") + int trace_enter_exit(struct syscalls_exit_open_args *ctx) + { +- count((void *)&exit_open_map); ++ count(&exit_open_map); ++ return 0; ++} ++ ++SEC("tracepoint/syscalls/sys_exit_openat") ++int trace_enter_exit_at(struct syscalls_exit_open_args *ctx) ++{ ++ count(&exit_open_map); + return 0; + } +diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c +index 16a16eadd509..749a50f2f9f3 100644 +--- a/samples/bpf/trace_event_user.c ++++ b/samples/bpf/trace_event_user.c +@@ -37,9 +37,9 @@ static void print_ksym(__u64 addr) + } + + printf("%s;", sym->name); +- if (!strcmp(sym->name, "sys_read")) ++ if (!strstr(sym->name, "sys_read")) + sys_read_seen = true; +- else if (!strcmp(sym->name, "sys_write")) ++ else if (!strstr(sym->name, "sys_write")) + sys_write_seen = true; + } + +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c +index 77ffff3a053c..9f1de58e9f0c 100644 +--- a/scripts/kconfig/expr.c ++++ b/scripts/kconfig/expr.c +@@ -254,6 +254,13 @@ static int expr_eq(struct expr *e1, struct expr *e2) + { + int res, old_count; + ++ /* ++ * A NULL expr is taken to be yes, but there's also a different way to ++ * represent yes. expr_is_yes() checks for either representation. ++ */ ++ if (!e1 || !e2) ++ return expr_is_yes(e1) && expr_is_yes(e2); ++ + if (e1->type != e2->type) + return 0; + switch (e1->type) { +diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian +index e0750b70453f..7c230016b08d 100755 +--- a/scripts/package/mkdebian ++++ b/scripts/package/mkdebian +@@ -174,7 +174,7 @@ Source: $sourcename + Section: kernel + Priority: optional + Maintainer: $maintainer +-Build-Depends: bc, kmod, cpio, bison, flex | flex:native $extra_build_depends ++Build-Depends: bc, rsync, kmod, cpio, bison, flex | flex:native $extra_build_depends + Homepage: http://www.kernel.org/ + + Package: $packagename +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index f6bf4cfbea23..45da2b51543e 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -2103,10 +2103,8 @@ static void max98090_pll_det_disable_work(struct work_struct *work) + M98090_IULK_MASK, 0); + } + +-static void max98090_pll_work(struct work_struct *work) ++static void max98090_pll_work(struct max98090_priv *max98090) + { +- struct max98090_priv *max98090 = +- container_of(work, struct max98090_priv, pll_work); + struct snd_soc_component *component = max98090->component; + + if (!snd_soc_component_is_active(component)) +@@ -2259,7 +2257,7 @@ static irqreturn_t max98090_interrupt(int irq, void *data) + + if (active & M98090_ULK_MASK) { + dev_dbg(component->dev, "M98090_ULK_MASK\n"); +- schedule_work(&max98090->pll_work); ++ max98090_pll_work(max98090); + } + + if (active & M98090_JDET_MASK) { +@@ -2422,7 +2420,6 @@ static int max98090_probe(struct snd_soc_component *component) + max98090_pll_det_enable_work); + INIT_WORK(&max98090->pll_det_disable_work, + max98090_pll_det_disable_work); +- INIT_WORK(&max98090->pll_work, max98090_pll_work); + + /* Enable jack detection */ + snd_soc_component_write(component, M98090_REG_JACK_DETECT, +@@ -2475,7 +2472,6 @@ static void max98090_remove(struct snd_soc_component *component) + cancel_delayed_work_sync(&max98090->jack_work); + cancel_delayed_work_sync(&max98090->pll_det_enable_work); + cancel_work_sync(&max98090->pll_det_disable_work); +- cancel_work_sync(&max98090->pll_work); + max98090->component = NULL; + } + +diff --git a/sound/soc/codecs/max98090.h b/sound/soc/codecs/max98090.h +index 57965cd678b4..a197114b0dad 100644 +--- a/sound/soc/codecs/max98090.h ++++ b/sound/soc/codecs/max98090.h +@@ -1530,7 +1530,6 @@ struct max98090_priv { + struct delayed_work jack_work; + struct delayed_work pll_det_enable_work; + struct work_struct pll_det_disable_work; +- struct work_struct pll_work; + struct snd_soc_jack *jack; + unsigned int dai_fmt; + int tdm_slots; +diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c +index c50b75ce82e0..05e883a65d7a 100644 +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -72,6 +72,7 @@ struct rt5682_priv { + static const struct reg_sequence patch_list[] = { + {RT5682_HP_IMP_SENS_CTRL_19, 0x1000}, + {RT5682_DAC_ADC_DIG_VOL1, 0xa020}, ++ {RT5682_I2C_CTRL, 0x000f}, + }; + + static const struct reg_default rt5682_reg[] = { +@@ -2481,6 +2482,7 @@ static void rt5682_calibrate(struct rt5682_priv *rt5682) + mutex_lock(&rt5682->calibrate_mutex); + + rt5682_reset(rt5682->regmap); ++ regmap_write(rt5682->regmap, RT5682_I2C_CTRL, 0x000f); + regmap_write(rt5682->regmap, RT5682_PWR_ANLG_1, 0xa2af); + usleep_range(15000, 20000); + regmap_write(rt5682->regmap, RT5682_PWR_ANLG_1, 0xf2af); +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 3e5c69fbc33a..d9d59f45833f 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2788,7 +2788,7 @@ static int fll_factors(struct _fll_div *fll_div, unsigned int Fref, + + if (target % Fref == 0) { + fll_div->theta = 0; +- fll_div->lambda = 0; ++ fll_div->lambda = 1; + } else { + gcd_fll = gcd(target, fratio * Fref); + +@@ -2858,7 +2858,7 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s + return -EINVAL; + } + +- if (fll_div.theta || fll_div.lambda) ++ if (fll_div.theta) + fll1 |= WM8962_FLL_FRAC; + + /* Stop the FLL while we reconfigure */ +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index dd2b5ad08659..243f683bc02a 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -707,13 +707,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_MCLK_EN), + }, + { ++ /* Teclast X89 */ + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), + DMI_MATCH(DMI_BOARD_NAME, "tPAD"), + }, + .driver_data = (void *)(BYT_RT5640_IN3_MAP | +- BYT_RT5640_MCLK_EN | +- BYT_RT5640_SSP0_AIF1), ++ BYT_RT5640_JD_SRC_JD1_IN4P | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_1P0 | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), + }, + { /* Toshiba Satellite Click Mini L9W-B */ + .matches = { +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 0fd032914a31..fd2d22ddc81b 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -1918,11 +1918,13 @@ static int soc_tplg_fe_link_create(struct soc_tplg *tplg, + ret = soc_tplg_dai_link_load(tplg, link, NULL); + if (ret < 0) { + dev_err(tplg->comp->dev, "ASoC: FE link loading failed\n"); +- kfree(link->name); +- kfree(link->stream_name); +- kfree(link->cpus->dai_name); +- kfree(link); +- return ret; ++ goto err; ++ } ++ ++ ret = snd_soc_add_dai_link(tplg->comp->card, link); ++ if (ret < 0) { ++ dev_err(tplg->comp->dev, "ASoC: adding FE link failed\n"); ++ goto err; + } + + link->dobj.index = tplg->index; +@@ -1930,8 +1932,13 @@ static int soc_tplg_fe_link_create(struct soc_tplg *tplg, + link->dobj.type = SND_SOC_DOBJ_DAI_LINK; + list_add(&link->dobj.list, &tplg->comp->dobj_list); + +- snd_soc_add_dai_link(tplg->comp->card, link); + return 0; ++err: ++ kfree(link->name); ++ kfree(link->stream_name); ++ kfree(link->cpus->dai_name); ++ kfree(link); ++ return ret; + } + + /* create a FE DAI and DAI link from the PCM object */ +@@ -2024,6 +2031,7 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg, + int size; + int i; + bool abi_match; ++ int ret; + + count = le32_to_cpu(hdr->count); + +@@ -2065,7 +2073,12 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg, + } + + /* create the FE DAIs and DAI links */ +- soc_tplg_pcm_create(tplg, _pcm); ++ ret = soc_tplg_pcm_create(tplg, _pcm); ++ if (ret < 0) { ++ if (!abi_match) ++ kfree(_pcm); ++ return ret; ++ } + + /* offset by version-specific struct size and + * real priv data size +diff --git a/sound/soc/sof/intel/byt.c b/sound/soc/sof/intel/byt.c +index a1e514f71739..41008c974ac6 100644 +--- a/sound/soc/sof/intel/byt.c ++++ b/sound/soc/sof/intel/byt.c +@@ -24,7 +24,8 @@ + #define DRAM_OFFSET 0x100000 + #define DRAM_SIZE (160 * 1024) + #define SHIM_OFFSET 0x140000 +-#define SHIM_SIZE 0x100 ++#define SHIM_SIZE_BYT 0x100 ++#define SHIM_SIZE_CHT 0x118 + #define MBOX_OFFSET 0x144000 + #define MBOX_SIZE 0x1000 + #define EXCEPT_OFFSET 0x800 +@@ -75,7 +76,7 @@ static const struct snd_sof_debugfs_map byt_debugfs[] = { + SOF_DEBUGFS_ACCESS_D0_ONLY}, + {"dram", BYT_DSP_BAR, DRAM_OFFSET, DRAM_SIZE, + SOF_DEBUGFS_ACCESS_D0_ONLY}, +- {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE, ++ {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE_BYT, + SOF_DEBUGFS_ACCESS_ALWAYS}, + }; + +@@ -102,7 +103,7 @@ static const struct snd_sof_debugfs_map cht_debugfs[] = { + SOF_DEBUGFS_ACCESS_D0_ONLY}, + {"dram", BYT_DSP_BAR, DRAM_OFFSET, DRAM_SIZE, + SOF_DEBUGFS_ACCESS_D0_ONLY}, +- {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE, ++ {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE_CHT, + SOF_DEBUGFS_ACCESS_ALWAYS}, + }; + +diff --git a/sound/soc/sof/loader.c b/sound/soc/sof/loader.c +index 9a9a381a908d..a041adf0669d 100644 +--- a/sound/soc/sof/loader.c ++++ b/sound/soc/sof/loader.c +@@ -66,6 +66,8 @@ int snd_sof_fw_parse_ext_data(struct snd_sof_dev *sdev, u32 bar, u32 offset) + ret = get_ext_windows(sdev, ext_hdr); + break; + default: ++ dev_warn(sdev->dev, "warning: unknown ext header type %d size 0x%x\n", ++ ext_hdr->type, ext_hdr->hdr.size); + break; + } + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index 43fdbbfe41bb..ea0bcd58bcb9 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -493,7 +493,7 @@ static int do_dump(int argc, char **argv) + + info = &info_linear->info; + if (mode == DUMP_JITED) { +- if (info->jited_prog_len == 0) { ++ if (info->jited_prog_len == 0 || !info->jited_prog_insns) { + p_info("no instructions returned"); + goto err_free; + } +diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c +index 494d7ae3614d..5b91ee65a080 100644 +--- a/tools/bpf/bpftool/xlated_dumper.c ++++ b/tools/bpf/bpftool/xlated_dumper.c +@@ -174,7 +174,7 @@ static const char *print_call(void *private_data, + struct kernel_sym *sym; + + if (insn->src_reg == BPF_PSEUDO_CALL && +- (__u32) insn->imm < dd->nr_jited_ksyms) ++ (__u32) insn->imm < dd->nr_jited_ksyms && dd->jited_ksyms) + address = dd->jited_ksyms[insn->imm]; + + sym = kernel_syms_search(dd, address); +diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile +index 5315f3787f8d..ecf882308d8a 100644 +--- a/tools/lib/traceevent/Makefile ++++ b/tools/lib/traceevent/Makefile +@@ -97,6 +97,7 @@ EVENT_PARSE_VERSION = $(EP_VERSION).$(EP_PATCHLEVEL).$(EP_EXTRAVERSION) + + LIB_TARGET = libtraceevent.a libtraceevent.so.$(EVENT_PARSE_VERSION) + LIB_INSTALL = libtraceevent.a libtraceevent.so* ++LIB_INSTALL := $(addprefix $(OUTPUT),$(LIB_INSTALL)) + + INCLUDES = -I. -I $(srctree)/tools/include $(CONFIG_INCLUDES) + +@@ -207,10 +208,11 @@ define do_install + $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2' + endef + +-PKG_CONFIG_FILE = libtraceevent.pc ++PKG_CONFIG_SOURCE_FILE = libtraceevent.pc ++PKG_CONFIG_FILE := $(addprefix $(OUTPUT),$(PKG_CONFIG_SOURCE_FILE)) + define do_install_pkgconfig_file + if [ -n "${pkgconfig_dir}" ]; then \ +- cp -f ${PKG_CONFIG_FILE}.template ${PKG_CONFIG_FILE}; \ ++ cp -f ${PKG_CONFIG_SOURCE_FILE}.template ${PKG_CONFIG_FILE}; \ + sed -i "s|INSTALL_PREFIX|${1}|g" ${PKG_CONFIG_FILE}; \ + sed -i "s|LIB_VERSION|${EVENT_PARSE_VERSION}|g" ${PKG_CONFIG_FILE}; \ + sed -i "s|LIB_DIR|${libdir}|g" ${PKG_CONFIG_FILE}; \ +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index becc2d109423..d3412f2c0d18 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -1089,21 +1089,18 @@ static void cpu_cache_level__fprintf(FILE *out, struct cpu_cache_level *c) + fprintf(out, "L%d %-15s %8s [%s]\n", c->level, c->type, c->size, c->map); + } + +-static int build_caches(struct cpu_cache_level caches[], u32 size, u32 *cntp) ++#define MAX_CACHE_LVL 4 ++ ++static int build_caches(struct cpu_cache_level caches[], u32 *cntp) + { + u32 i, cnt = 0; +- long ncpus; + u32 nr, cpu; + u16 level; + +- ncpus = sysconf(_SC_NPROCESSORS_CONF); +- if (ncpus < 0) +- return -1; +- +- nr = (u32)(ncpus & UINT_MAX); ++ nr = cpu__max_cpu(); + + for (cpu = 0; cpu < nr; cpu++) { +- for (level = 0; level < 10; level++) { ++ for (level = 0; level < MAX_CACHE_LVL; level++) { + struct cpu_cache_level c; + int err; + +@@ -1123,18 +1120,12 @@ static int build_caches(struct cpu_cache_level caches[], u32 size, u32 *cntp) + caches[cnt++] = c; + else + cpu_cache_level__free(&c); +- +- if (WARN_ONCE(cnt == size, "way too many cpu caches..")) +- goto out; + } + } +- out: + *cntp = cnt; + return 0; + } + +-#define MAX_CACHE_LVL 4 +- + static int write_cache(struct feat_fd *ff, + struct evlist *evlist __maybe_unused) + { +@@ -1143,7 +1134,7 @@ static int write_cache(struct feat_fd *ff, + u32 cnt = 0, i, version = 1; + int ret; + +- ret = build_caches(caches, max_caches, &cnt); ++ ret = build_caches(caches, &cnt); + if (ret) + goto out; + +diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c +index a7c0424dbda3..940a6e7a6854 100644 +--- a/tools/perf/util/metricgroup.c ++++ b/tools/perf/util/metricgroup.c +@@ -103,8 +103,11 @@ static struct evsel *find_evsel_group(struct evlist *perf_evlist, + if (!strcmp(ev->name, ids[i])) { + if (!metric_events[i]) + metric_events[i] = ev; ++ i++; ++ if (i == idnum) ++ break; + } else { +- if (++i == idnum) { ++ if (i + 1 == idnum) { + /* Discard the whole match and start again */ + i = 0; + memset(metric_events, 0, +@@ -124,7 +127,7 @@ static struct evsel *find_evsel_group(struct evlist *perf_evlist, + } + } + +- if (i != idnum - 1) { ++ if (i != idnum) { + /* Not whole match */ + return NULL; + } +diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc +index 36fb59f886ea..1a52f2883fe0 100644 +--- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc ++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc +@@ -3,6 +3,8 @@ + # description: ftrace - stacktrace filter command + # flags: instance + ++[ ! -f set_ftrace_filter ] && exit_unsupported ++ + echo _do_fork:stacktrace >> set_ftrace_filter + + grep -q "_do_fork:stacktrace:unlimited" set_ftrace_filter +diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc +index 86a1f07ef2ca..71fa3f49e35e 100644 +--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc ++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc +@@ -15,6 +15,11 @@ if [ $NP -eq 1 ] ;then + exit_unresolved + fi + ++if ! grep -q "function" available_tracers ; then ++ echo "Function trace is not enabled" ++ exit_unsupported ++fi ++ + ORIG_CPUMASK=`cat tracing_cpumask` + + do_reset() { +diff --git a/tools/testing/selftests/ftrace/test.d/functions b/tools/testing/selftests/ftrace/test.d/functions +index 86986c4bba54..5d4550591ff9 100644 +--- a/tools/testing/selftests/ftrace/test.d/functions ++++ b/tools/testing/selftests/ftrace/test.d/functions +@@ -46,6 +46,9 @@ reset_events_filter() { # reset all current setting filters + } + + reset_ftrace_filter() { # reset all triggers in set_ftrace_filter ++ if [ ! -f set_ftrace_filter ]; then ++ return 0 ++ fi + echo > set_ftrace_filter + grep -v '^#' set_ftrace_filter | while read t; do + tr=`echo $t | cut -d: -f2` +@@ -93,7 +96,7 @@ initialize_ftrace() { # Reset ftrace to initial-state + disable_events + [ -f set_event_pid ] && echo > set_event_pid + [ -f set_ftrace_pid ] && echo > set_ftrace_pid +- [ -f set_ftrace_filter ] && echo | tee set_ftrace_* ++ [ -f set_ftrace_notrace ] && echo > set_ftrace_notrace + [ -f set_graph_function ] && echo | tee set_graph_* + [ -f stack_trace_filter ] && echo > stack_trace_filter + [ -f kprobe_events ] && echo > kprobe_events +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc +index 5862eee91e1d..6e3dbe5f96b7 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc +@@ -20,9 +20,9 @@ while read i; do + test $N -eq 256 && break + done + +-L=`wc -l kprobe_events` +-if [ $L -ne $N ]; then +- echo "The number of kprobes events ($L) is not $N" ++L=`cat kprobe_events | wc -l` ++if [ $L -ne 256 ]; then ++ echo "The number of kprobes events ($L) is not 256" + exit_fail + fi + +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc +index 1221240f8cf6..3f2aee115f6e 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc +@@ -21,10 +21,10 @@ grep -q "snapshot()" README || exit_unsupported # version issue + + echo "Test expected snapshot action failure" + +-echo 'hist:keys=comm:onmatch(sched.sched_wakeup).snapshot()' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger && exit_fail ++echo 'hist:keys=comm:onmatch(sched.sched_wakeup).snapshot()' >> events/sched/sched_waking/trigger && exit_fail + + echo "Test expected save action failure" + +-echo 'hist:keys=comm:onmatch(sched.sched_wakeup).save(comm,prio)' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger && exit_fail ++echo 'hist:keys=comm:onmatch(sched.sched_wakeup).save(comm,prio)' >> events/sched/sched_waking/trigger && exit_fail + + exit_xfail +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc +index 064a284e4e75..c80007aa9f86 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc +@@ -16,7 +16,7 @@ grep -q "onchange(var)" README || exit_unsupported # version issue + + echo "Test onchange action" + +-echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio) if comm=="ping"' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger ++echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio) if comm=="ping"' >> events/sched/sched_waking/trigger + + ping $LOCALHOST -c 3 + nice -n 1 ping $LOCALHOST -c 3 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc +index 18fff69fc433..f546c1b66a9b 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc +@@ -23,9 +23,9 @@ grep -q "snapshot()" README || exit_unsupported # version issue + + echo "Test snapshot action" + +-echo 1 > /sys/kernel/debug/tracing/events/sched/enable ++echo 1 > events/sched/enable + +-echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio):onchange($newprio).snapshot() if comm=="ping"' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger ++echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio):onchange($newprio).snapshot() if comm=="ping"' >> events/sched/sched_waking/trigger + + ping $LOCALHOST -c 3 + nice -n 1 ping $LOCALHOST -c 3 +diff --git a/tools/testing/selftests/kselftest/prefix.pl b/tools/testing/selftests/kselftest/prefix.pl +index ec7e48118183..31f7c2a0a8bd 100755 +--- a/tools/testing/selftests/kselftest/prefix.pl ++++ b/tools/testing/selftests/kselftest/prefix.pl +@@ -3,6 +3,7 @@ + # Prefix all lines with "# ", unbuffered. Command being piped in may need + # to have unbuffering forced with "stdbuf -i0 -o0 -e0 $cmd". + use strict; ++use IO::Handle; + + binmode STDIN; + binmode STDOUT; +diff --git a/tools/testing/selftests/kselftest/runner.sh b/tools/testing/selftests/kselftest/runner.sh +index 84de7bc74f2c..a8d20cbb711c 100644 +--- a/tools/testing/selftests/kselftest/runner.sh ++++ b/tools/testing/selftests/kselftest/runner.sh +@@ -79,6 +79,7 @@ run_one() + if [ $rc -eq $skip_rc ]; then \ + echo "not ok $test_num $TEST_HDR_MSG # SKIP" + elif [ $rc -eq $timeout_rc ]; then \ ++ echo "#" + echo "not ok $test_num $TEST_HDR_MSG # TIMEOUT" + else + echo "not ok $test_num $TEST_HDR_MSG # exit=$rc" +diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh +index d697815d2785..71a62e7e35b1 100755 +--- a/tools/testing/selftests/net/pmtu.sh ++++ b/tools/testing/selftests/net/pmtu.sh +@@ -11,9 +11,9 @@ + # R1 and R2 (also implemented with namespaces), with different MTUs: + # + # segment a_r1 segment b_r1 a_r1: 2000 +-# .--------------R1--------------. a_r2: 1500 +-# A B a_r3: 2000 +-# '--------------R2--------------' a_r4: 1400 ++# .--------------R1--------------. b_r1: 1400 ++# A B a_r2: 2000 ++# '--------------R2--------------' b_r2: 1500 + # segment a_r2 segment b_r2 + # + # Check that PMTU exceptions with the correct PMTU are created. Then +diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh +index 1be55e705780..d7e07f4c3d7f 100755 +--- a/tools/testing/selftests/netfilter/nft_nat.sh ++++ b/tools/testing/selftests/netfilter/nft_nat.sh +@@ -8,9 +8,14 @@ ksft_skip=4 + ret=0 + test_inet_nat=true + ++sfx=$(mktemp -u "XXXXXXXX") ++ns0="ns0-$sfx" ++ns1="ns1-$sfx" ++ns2="ns2-$sfx" ++ + cleanup() + { +- for i in 0 1 2; do ip netns del ns$i;done ++ for i in 0 1 2; do ip netns del ns$i-"$sfx";done + } + + nft --version > /dev/null 2>&1 +@@ -25,40 +30,49 @@ if [ $? -ne 0 ];then + exit $ksft_skip + fi + +-ip netns add ns0 ++ip netns add "$ns0" + if [ $? -ne 0 ];then +- echo "SKIP: Could not create net namespace" ++ echo "SKIP: Could not create net namespace $ns0" + exit $ksft_skip + fi + + trap cleanup EXIT + +-ip netns add ns1 +-ip netns add ns2 ++ip netns add "$ns1" ++if [ $? -ne 0 ];then ++ echo "SKIP: Could not create net namespace $ns1" ++ exit $ksft_skip ++fi ++ ++ip netns add "$ns2" ++if [ $? -ne 0 ];then ++ echo "SKIP: Could not create net namespace $ns2" ++ exit $ksft_skip ++fi + +-ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 > /dev/null 2>&1 ++ip link add veth0 netns "$ns0" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1 + if [ $? -ne 0 ];then + echo "SKIP: No virtual ethernet pair device support in kernel" + exit $ksft_skip + fi +-ip link add veth1 netns ns0 type veth peer name eth0 netns ns2 ++ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns2" + +-ip -net ns0 link set lo up +-ip -net ns0 link set veth0 up +-ip -net ns0 addr add 10.0.1.1/24 dev veth0 +-ip -net ns0 addr add dead:1::1/64 dev veth0 ++ip -net "$ns0" link set lo up ++ip -net "$ns0" link set veth0 up ++ip -net "$ns0" addr add 10.0.1.1/24 dev veth0 ++ip -net "$ns0" addr add dead:1::1/64 dev veth0 + +-ip -net ns0 link set veth1 up +-ip -net ns0 addr add 10.0.2.1/24 dev veth1 +-ip -net ns0 addr add dead:2::1/64 dev veth1 ++ip -net "$ns0" link set veth1 up ++ip -net "$ns0" addr add 10.0.2.1/24 dev veth1 ++ip -net "$ns0" addr add dead:2::1/64 dev veth1 + + for i in 1 2; do +- ip -net ns$i link set lo up +- ip -net ns$i link set eth0 up +- ip -net ns$i addr add 10.0.$i.99/24 dev eth0 +- ip -net ns$i route add default via 10.0.$i.1 +- ip -net ns$i addr add dead:$i::99/64 dev eth0 +- ip -net ns$i route add default via dead:$i::1 ++ ip -net ns$i-$sfx link set lo up ++ ip -net ns$i-$sfx link set eth0 up ++ ip -net ns$i-$sfx addr add 10.0.$i.99/24 dev eth0 ++ ip -net ns$i-$sfx route add default via 10.0.$i.1 ++ ip -net ns$i-$sfx addr add dead:$i::99/64 dev eth0 ++ ip -net ns$i-$sfx route add default via dead:$i::1 + done + + bad_counter() +@@ -66,8 +80,9 @@ bad_counter() + local ns=$1 + local counter=$2 + local expect=$3 ++ local tag=$4 + +- echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2 ++ echo "ERROR: $counter counter in $ns has unexpected value (expected $expect) at $tag" 1>&2 + ip netns exec $ns nft list counter inet filter $counter 1>&2 + } + +@@ -78,24 +93,24 @@ check_counters() + + cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84") + if [ $? -ne 0 ]; then +- bad_counter $ns ns0in "packets 1 bytes 84" ++ bad_counter $ns ns0in "packets 1 bytes 84" "check_counters 1" + lret=1 + fi + cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84") + if [ $? -ne 0 ]; then +- bad_counter $ns ns0out "packets 1 bytes 84" ++ bad_counter $ns ns0out "packets 1 bytes 84" "check_counters 2" + lret=1 + fi + + expect="packets 1 bytes 104" + cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter $ns ns0in6 "$expect" ++ bad_counter $ns ns0in6 "$expect" "check_counters 3" + lret=1 + fi + cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter $ns ns0out6 "$expect" ++ bad_counter $ns ns0out6 "$expect" "check_counters 4" + lret=1 + fi + +@@ -107,41 +122,41 @@ check_ns0_counters() + local ns=$1 + local lret=0 + +- cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0in "packets 0 bytes 0" ++ bad_counter "$ns0" ns0in "packets 0 bytes 0" "check_ns0_counters 1" + lret=1 + fi + +- cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0in6 "packets 0 bytes 0" ++ bad_counter "$ns0" ns0in6 "packets 0 bytes 0" + lret=1 + fi + +- cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0out "packets 0 bytes 0" ++ bad_counter "$ns0" ns0out "packets 0 bytes 0" "check_ns0_counters 2" + lret=1 + fi +- cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0out6 "packets 0 bytes 0" ++ bad_counter "$ns0" ns0out6 "packets 0 bytes 0" "check_ns0_counters3 " + lret=1 + fi + + for dir in "in" "out" ; do + expect="packets 1 bytes 84" +- cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 $ns$dir "$expect" ++ bad_counter "$ns0" $ns$dir "$expect" "check_ns0_counters 4" + lret=1 + fi + + expect="packets 1 bytes 104" +- cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir}6 | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 $ns$dir6 "$expect" ++ bad_counter "$ns0" $ns$dir6 "$expect" "check_ns0_counters 5" + lret=1 + fi + done +@@ -152,7 +167,7 @@ check_ns0_counters() + reset_counters() + { + for i in 0 1 2;do +- ip netns exec ns$i nft reset counters inet > /dev/null ++ ip netns exec ns$i-$sfx nft reset counters inet > /dev/null + done + } + +@@ -166,7 +181,7 @@ test_local_dnat6() + IPF="ip6" + fi + +-ip netns exec ns0 nft -f - < /dev/null ++ ip netns exec "$ns0" ping -q -c 1 dead:1::99 > /dev/null + if [ $? -ne 0 ]; then + lret=1 + echo "ERROR: ping6 failed" +@@ -189,18 +204,18 @@ EOF + + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns1$dir "$expect" ++ bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat6 1" + lret=1 + fi + done + + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns2$dir "$expect" ++ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat6 2" + lret=1 + fi + done +@@ -208,9 +223,9 @@ EOF + # expect 0 count in ns1 + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat6 3" + lret=1 + fi + done +@@ -218,15 +233,15 @@ EOF + # expect 1 packet in ns2 + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns0$dir "$expect" ++ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat6 4" + lret=1 + fi + done + +- test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was $family NATted to ns2" +- ip netns exec ns0 nft flush chain ip6 nat output ++ test $lret -eq 0 && echo "PASS: ipv6 ping to $ns1 was $family NATted to $ns2" ++ ip netns exec "$ns0" nft flush chain ip6 nat output + + return $lret + } +@@ -241,7 +256,7 @@ test_local_dnat() + IPF="ip" + fi + +-ip netns exec ns0 nft -f - </dev/null ++ip netns exec "$ns0" nft -f /dev/stdin </dev/null + table $family nat { + chain output { + type nat hook output priority 0; policy accept; +@@ -260,7 +275,7 @@ EOF + fi + + # ping netns1, expect rewrite to netns2 +- ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null ++ ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null + if [ $? -ne 0 ]; then + lret=1 + echo "ERROR: ping failed" +@@ -269,18 +284,18 @@ EOF + + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns1$dir "$expect" ++ bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat 1" + lret=1 + fi + done + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns2$dir "$expect" ++ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 2" + lret=1 + fi + done +@@ -288,9 +303,9 @@ EOF + # expect 0 count in ns1 + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat 3" + lret=1 + fi + done +@@ -298,19 +313,19 @@ EOF + # expect 1 packet in ns2 + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns0$dir "$expect" ++ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 4" + lret=1 + fi + done + +- test $lret -eq 0 && echo "PASS: ping to ns1 was $family NATted to ns2" ++ test $lret -eq 0 && echo "PASS: ping to $ns1 was $family NATted to $ns2" + +- ip netns exec ns0 nft flush chain $family nat output ++ ip netns exec "$ns0" nft flush chain $family nat output + + reset_counters +- ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null ++ ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null + if [ $? -ne 0 ]; then + lret=1 + echo "ERROR: ping failed" +@@ -319,17 +334,17 @@ EOF + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns1$dir "$expect" ++ bad_counter "$ns1" ns1$dir "$expect" "test_local_dnat 5" + lret=1 + fi + done + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns2$dir "$expect" ++ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 6" + lret=1 + fi + done +@@ -337,9 +352,9 @@ EOF + # expect 1 count in ns1 + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns0 ns0$dir "$expect" ++ bad_counter "$ns0" ns0$dir "$expect" "test_local_dnat 7" + lret=1 + fi + done +@@ -347,14 +362,14 @@ EOF + # expect 0 packet in ns2 + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns2$dir "$expect" ++ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 8" + lret=1 + fi + done + +- test $lret -eq 0 && echo "PASS: ping to ns1 OK after $family nat output chain flush" ++ test $lret -eq 0 && echo "PASS: ping to $ns1 OK after $family nat output chain flush" + + return $lret + } +@@ -366,26 +381,26 @@ test_masquerade6() + local natflags=$2 + local lret=0 + +- ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null + +- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 via ipv6" ++ echo "ERROR: cannot ping $ns1 from $ns2 via ipv6" + return 1 + lret=1 + fi + + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns2$dir "$expect" ++ bad_counter "$ns1" ns2$dir "$expect" "test_masquerade6 1" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 2" + lret=1 + fi + done +@@ -393,7 +408,7 @@ test_masquerade6() + reset_counters + + # add masquerading rule +-ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags" + lret=1 + fi + + # ns1 should have seen packets from ns0, due to masquerade + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 3" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 4" + lret=1 + fi + done +@@ -431,32 +446,32 @@ EOF + # ns1 should not have seen packets from ns2, due to masquerade + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 5" + lret=1 + fi + +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns0" ns1$dir "$expect" "test_masquerade6 6" + lret=1 + fi + done + +- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags (attempt 2)" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active ipv6 masquerade $natflags (attempt 2)" + lret=1 + fi + +- ip netns exec ns0 nft flush chain $family nat postrouting ++ ip netns exec "$ns0" nft flush chain $family nat postrouting + if [ $? -ne 0 ]; then + echo "ERROR: Could not flush $family nat postrouting" 1>&2 + lret=1 + fi + +- test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for ns2" ++ test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for $ns2" + + return $lret + } +@@ -467,26 +482,26 @@ test_masquerade() + local natflags=$2 + local lret=0 + +- ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null +- ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null + +- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 $natflags" ++ echo "ERROR: cannot ping $ns1 from "$ns2" $natflags" + lret=1 + fi + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns2$dir "$expect" ++ bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 2" + lret=1 + fi + done +@@ -494,7 +509,7 @@ test_masquerade() + reset_counters + + # add masquerading rule +-ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags" + lret=1 + fi + + # ns1 should have seen packets from ns0, due to masquerade + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 3" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 4" + lret=1 + fi + done +@@ -532,32 +547,32 @@ EOF + # ns1 should not have seen packets from ns2, due to masquerade + expect="packets 0 bytes 0" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 5" + lret=1 + fi + +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns0" ns1$dir "$expect" "test_masquerade 6" + lret=1 + fi + done + +- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active ip masquerade $natflags (attempt 2)" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active ip masquerade $natflags (attempt 2)" + lret=1 + fi + +- ip netns exec ns0 nft flush chain $family nat postrouting ++ ip netns exec "$ns0" nft flush chain $family nat postrouting + if [ $? -ne 0 ]; then + echo "ERROR: Could not flush $family nat postrouting" 1>&2 + lret=1 + fi + +- test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for ns2" ++ test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for $ns2" + + return $lret + } +@@ -567,25 +582,25 @@ test_redirect6() + local family=$1 + local lret=0 + +- ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null + +- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannnot ping ns1 from ns2 via ipv6" ++ echo "ERROR: cannnot ping $ns1 from $ns2 via ipv6" + lret=1 + fi + + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns2$dir "$expect" ++ bad_counter "$ns1" ns2$dir "$expect" "test_redirect6 1" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_redirect6 2" + lret=1 + fi + done +@@ -593,7 +608,7 @@ test_redirect6() + reset_counters + + # add redirect rule +-ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 via ipv6 with active $family redirect" ++ echo "ERROR: cannot ping $ns1 from $ns2 via ipv6 with active $family redirect" + lret=1 + fi + + # ns1 should have seen no packets from ns2, due to redirection + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 3" + lret=1 + fi + done +@@ -625,20 +640,20 @@ EOF + # ns0 should have seen packets from ns2, due to masquerade + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 4" + lret=1 + fi + done + +- ip netns exec ns0 nft delete table $family nat ++ ip netns exec "$ns0" nft delete table $family nat + if [ $? -ne 0 ]; then + echo "ERROR: Could not delete $family nat table" 1>&2 + lret=1 + fi + +- test $lret -eq 0 && echo "PASS: $family IPv6 redirection for ns2" ++ test $lret -eq 0 && echo "PASS: $family IPv6 redirection for $ns2" + + return $lret + } +@@ -648,26 +663,26 @@ test_redirect() + local family=$1 + local lret=0 + +- ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null +- ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null ++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null + +- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2" ++ echo "ERROR: cannot ping $ns1 from $ns2" + lret=1 + fi + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns2$dir "$expect" ++ bad_counter "$ns1" $ns2$dir "$expect" "test_redirect 1" + lret=1 + fi + +- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns2 ns1$dir "$expect" ++ bad_counter "$ns2" ns1$dir "$expect" "test_redirect 2" + lret=1 + fi + done +@@ -675,7 +690,7 @@ test_redirect() + reset_counters + + # add redirect rule +-ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then +- echo "ERROR: cannot ping ns1 from ns2 with active $family ip redirect" ++ echo "ERROR: cannot ping $ns1 from $ns2 with active $family ip redirect" + lret=1 + fi + +@@ -698,9 +713,9 @@ EOF + expect="packets 0 bytes 0" + for dir in "in" "out" ; do + +- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns1" ns0$dir "$expect" "test_redirect 3" + lret=1 + fi + done +@@ -708,28 +723,28 @@ EOF + # ns0 should have seen packets from ns2, due to masquerade + expect="packets 1 bytes 84" + for dir in "in" "out" ; do +- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then +- bad_counter ns1 ns0$dir "$expect" ++ bad_counter "$ns0" ns0$dir "$expect" "test_redirect 4" + lret=1 + fi + done + +- ip netns exec ns0 nft delete table $family nat ++ ip netns exec "$ns0" nft delete table $family nat + if [ $? -ne 0 ]; then + echo "ERROR: Could not delete $family nat table" 1>&2 + lret=1 + fi + +- test $lret -eq 0 && echo "PASS: $family IP redirection for ns2" ++ test $lret -eq 0 && echo "PASS: $family IP redirection for $ns2" + + return $lret + } + + +-# ip netns exec ns0 ping -c 1 -q 10.0.$i.99 ++# ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 + for i in 0 1 2; do +-ip netns exec ns$i nft -f - < /dev/null ++ ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 > /dev/null + if [ $? -ne 0 ];then + echo "ERROR: Could not reach other namespace(s)" 1>&2 + ret=1 + fi + +- ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null ++ ip netns exec "$ns0" ping -c 1 -q dead:$i::99 > /dev/null + if [ $? -ne 0 ];then + echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2 + ret=1 + fi +- check_counters ns$i ++ check_counters ns$i-$sfx + if [ $? -ne 0 ]; then + ret=1 + fi +@@ -820,7 +835,7 @@ for i in 1 2; do + done + + if [ $ret -eq 0 ];then +- echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2" ++ echo "PASS: netns routing/connectivity: $ns0 can reach $ns1 and $ns2" + fi + + reset_counters +@@ -846,4 +861,9 @@ reset_counters + $test_inet_nat && test_redirect inet + $test_inet_nat && test_redirect6 inet + ++if [ $ret -ne 0 ];then ++ echo -n "FAIL: " ++ nft --version ++fi ++ + exit $ret +diff --git a/tools/testing/selftests/safesetid/Makefile b/tools/testing/selftests/safesetid/Makefile +index 98da7a504737..fa02c4d5ec13 100644 +--- a/tools/testing/selftests/safesetid/Makefile ++++ b/tools/testing/selftests/safesetid/Makefile +@@ -1,8 +1,9 @@ + # SPDX-License-Identifier: GPL-2.0 + # Makefile for mount selftests. +-CFLAGS = -Wall -lcap -O2 ++CFLAGS = -Wall -O2 ++LDLIBS = -lcap + +-TEST_PROGS := run_tests.sh ++TEST_PROGS := safesetid-test.sh + TEST_GEN_FILES := safesetid-test + + include ../lib.mk +diff --git a/tools/testing/selftests/safesetid/safesetid-test.c b/tools/testing/selftests/safesetid/safesetid-test.c +index 8f40c6ecdad1..0c4d50644c13 100644 +--- a/tools/testing/selftests/safesetid/safesetid-test.c ++++ b/tools/testing/selftests/safesetid/safesetid-test.c +@@ -213,7 +213,8 @@ static void test_setuid(uid_t child_uid, bool expect_success) + } + + if (cpid == 0) { /* Code executed by child */ +- setuid(child_uid); ++ if (setuid(child_uid) < 0) ++ exit(EXIT_FAILURE); + if (getuid() == child_uid) + exit(EXIT_SUCCESS); + else +@@ -291,8 +292,10 @@ int main(int argc, char **argv) + + // First test to make sure we can write userns mappings from a user + // that doesn't have any restrictions (as long as it has CAP_SETUID); +- setuid(NO_POLICY_USER); +- setgid(NO_POLICY_USER); ++ if (setuid(NO_POLICY_USER) < 0) ++ die("Error with set uid(%d)\n", NO_POLICY_USER); ++ if (setgid(NO_POLICY_USER) < 0) ++ die("Error with set gid(%d)\n", NO_POLICY_USER); + + // Take away all but setid caps + drop_caps(true); +@@ -306,8 +309,10 @@ int main(int argc, char **argv) + die("test_userns failed when it should work\n"); + } + +- setuid(RESTRICTED_PARENT); +- setgid(RESTRICTED_PARENT); ++ if (setuid(RESTRICTED_PARENT) < 0) ++ die("Error with set uid(%d)\n", RESTRICTED_PARENT); ++ if (setgid(RESTRICTED_PARENT) < 0) ++ die("Error with set gid(%d)\n", RESTRICTED_PARENT); + + test_setuid(ROOT_USER, false); + test_setuid(ALLOWED_CHILD1, true); diff --git a/patch/kernel/odroidxu4-current/7.patch b/patch/kernel/odroidxu4-current/7.patch new file mode 100644 index 0000000000..ba65e83adf --- /dev/null +++ b/patch/kernel/odroidxu4-current/7.patch @@ -0,0 +1,333 @@ +From f4fa5785238393813ddc7105f799d1da00254933 Mon Sep 17 00:00:00 2001 +From: Yang Deokgyu +Date: Thu, 5 Dec 2019 18:07:13 +0900 +Subject: [PATCH] ODROID-XU4: Introduce device tree overlay + +Copy *.dtbo files at arch/arm/boot/dts/overlays to boot +partition, e.g, /media/boot/overlays/. Then use "fdtoverlay" tool +to integrate DTB and DTBOs. Or, you also can use "fdt apply" u-boot +command to prepare device tree blob at booting time. + +Signed-off-by: Yang Deokgyu +Change-Id: I40e6a915e2149952fb548f64e7fae335ba12db18 +--- + .gitignore | 1 + + Makefile | 7 +++- + arch/arm/boot/dts/Makefile | 3 ++ + arch/arm/boot/dts/exynos5422-odroidxu4.dts | 8 ++--- + arch/arm/boot/dts/overlays/Makefile | 31 ++++++++++++++++ + .../dts/overlays/hktft-cs-ogst-overlay.dts | 36 +++++++++++++++++++ + .../arm/boot/dts/overlays/hktft32-overlay.dts | 36 +++++++++++++++++++ + .../arm/boot/dts/overlays/hktft35-overlay.dts | 36 +++++++++++++++++++ + arch/arm/boot/dts/overlays/i2c1-overlay.dts | 12 +++++++ + arch/arm/boot/dts/overlays/i2c5-overlay.dts | 12 +++++++ + .../arm/boot/dts/overlays/spidev1-overlay.dts | 20 +++++++++++ + 11 files changed, 197 insertions(+), 5 deletions(-) + create mode 100644 arch/arm/boot/dts/overlays/Makefile + create mode 100644 arch/arm/boot/dts/overlays/hktft-cs-ogst-overlay.dts + create mode 100644 arch/arm/boot/dts/overlays/hktft32-overlay.dts + create mode 100644 arch/arm/boot/dts/overlays/hktft35-overlay.dts + create mode 100644 arch/arm/boot/dts/overlays/i2c1-overlay.dts + create mode 100644 arch/arm/boot/dts/overlays/i2c5-overlay.dts + create mode 100644 arch/arm/boot/dts/overlays/spidev1-overlay.dts + +diff --git a/.gitignore b/.gitignore +index 70580bdd352cc..a0cf56d7d0d2e 100644 +--- a/.gitignore ++++ b/.gitignore +@@ -17,6 +17,7 @@ + *.c.[012]*.* + *.dt.yaml + *.dtb ++*.dtbo + *.dtb.S + *.dwo + *.elf +diff --git a/Makefile b/Makefile +index 07998b60d56cf..5579165a84634 100644 +--- a/Makefile ++++ b/Makefile +@@ -1242,7 +1242,12 @@ ifneq ($(dtstree),) + %.dtb: include/config/kernel.release scripts_dtc + $(Q)$(MAKE) $(build)=$(dtstree) $(dtstree)/$@ + +-PHONY += dtbs dtbs_install dt_binding_check ++%.dtbo: ++ $(Q)$(MAKE) -C $(dtstree)/overlays $@ ++ ++PHONY += dtbs dtbs_install dt_binding_check dtbos ++dtbos: ++ $(Q)$(MAKE) -C $(dtstree)/overlays + dtbs dtbs_check: include/config/kernel.release scripts_dtc + $(Q)$(MAKE) $(build)=$(dtstree) + +diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile +index b21b3a64641a7..f6e3a8817c576 100644 +--- a/arch/arm/boot/dts/Makefile ++++ b/arch/arm/boot/dts/Makefile +@@ -1303,3 +1303,6 @@ dtb-$(CONFIG_ARCH_ASPEED) += \ + aspeed-bmc-opp-zaius.dtb \ + aspeed-bmc-portwell-neptune.dtb \ + aspeed-bmc-quanta-q71l.dtb ++ ++DTC_FLAGS ?= -@ ++subdir-y := overlays +diff --git a/arch/arm/boot/dts/exynos5422-odroidxu4.dts b/arch/arm/boot/dts/exynos5422-odroidxu4.dts +index 6e7da591654f4..6768dc18ebeeb 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidxu4.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidxu4.dts +@@ -143,25 +143,25 @@ + + /* i2c@12C70000 */ + &i2c_1 { +- status = "okay"; ++ status = "disabled"; + samsung,i2c-max-bus-freq = <400000>; + }; + + /* i2c@12cb0000 */ + &hsi2c_5 { +- status = "okay"; ++ status = "disabled"; + samsung,hs-mode; + clock-frequency = <400000>; + }; + + &spi_1 { +- status = "okay"; ++ status = "disabled"; + samsung,spi-src-clk = <0>; + num-cs = <2>; + cs-gpios = <&gpa2 5 GPIO_ACTIVE_HIGH>, <&gpx2 1 GPIO_ACTIVE_HIGH>; + + spidev: spidev@0 { +- status = "okay"; ++ status = "disabled"; + reg = <0>; + compatible = "odroid,spidev"; + spi-max-frequency = <1000000>; +diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile +new file mode 100644 +index 0000000000000..dff81c41c8688 +--- /dev/null ++++ b/arch/arm/boot/dts/overlays/Makefile +@@ -0,0 +1,31 @@ ++# Overlays for the Odroid platform ++ ++DTC ?= dtc ++DTCO_FLAGS ?= \ ++ -Wno-unit_address_vs_reg \ ++ -@ ++ ++OBJ := $(patsubst %.dts, %.dtbo, $(wildcard *.dts)) ++ ++dtbo-y := \ ++ spidev1-overlay.dtbo \ ++ i2c1-overlay.dtbo \ ++ i2c5-overlay.dtbo \ ++ hktft32-overlay.dtbo \ ++ hktft35-overlay.dtbo \ ++ hktft-cs-ogst-overlay.dtbo ++ ++%.dtbo: %.dts ++ @echo " DTCO $@" ++ @$(DTC) $(DTCO_FLAGS) -I dts -O dtb -o $@ $^ ++ ++dtbos: $(dtbo-y) ++ ++all: $(dtbos) ++ ++clean: ++ @rm -rf *.dtbo ++ ++.PHONY: all clean dtbos ++ ++always += $(dtbo-y) +diff --git a/arch/arm/boot/dts/overlays/hktft-cs-ogst-overlay.dts b/arch/arm/boot/dts/overlays/hktft-cs-ogst-overlay.dts +new file mode 100644 +index 0000000000000..a727fb311574f +--- /dev/null ++++ b/arch/arm/boot/dts/overlays/hktft-cs-ogst-overlay.dts +@@ -0,0 +1,36 @@ ++/dts-v1/; ++/plugin/; ++ ++/ { ++ fragment@0 { ++ target = <&i2c_1>; ++ ++ __overlay__ { ++ status = "disabled"; ++ }; ++ }; ++ ++ fragment@1 { ++ target = <&hsi2c_5>; ++ ++ __overlay__ { ++ status = "disabled"; ++ }; ++ }; ++ ++ fragment@2 { ++ target = <&spi_1>; ++ ++ __overlay__ { ++ status = "okay"; ++ }; ++ }; ++ ++ fragment@3 { ++ target = <&hktft_cs_ogst>; ++ ++ __overlay__ { ++ status = "okay"; ++ }; ++ }; ++}; +diff --git a/arch/arm/boot/dts/overlays/hktft32-overlay.dts b/arch/arm/boot/dts/overlays/hktft32-overlay.dts +new file mode 100644 +index 0000000000000..7bda6cd8e6d8a +--- /dev/null ++++ b/arch/arm/boot/dts/overlays/hktft32-overlay.dts +@@ -0,0 +1,36 @@ ++/dts-v1/; ++/plugin/; ++ ++/ { ++ fragment@0 { ++ target = <&i2c_1>; ++ ++ __overlay__ { ++ status = "disabled"; ++ }; ++ }; ++ ++ fragment@1 { ++ target = <&hsi2c_5>; ++ ++ __overlay__ { ++ status = "disabled"; ++ }; ++ }; ++ ++ fragment@2 { ++ target = <&spi_1>; ++ ++ __overlay__ { ++ status = "okay"; ++ }; ++ }; ++ ++ fragment@3 { ++ target = <&hktft32>; ++ ++ __overlay__ { ++ status = "okay"; ++ }; ++ }; ++}; +diff --git a/arch/arm/boot/dts/overlays/hktft35-overlay.dts b/arch/arm/boot/dts/overlays/hktft35-overlay.dts +new file mode 100644 +index 0000000000000..a656dd272165c +--- /dev/null ++++ b/arch/arm/boot/dts/overlays/hktft35-overlay.dts +@@ -0,0 +1,36 @@ ++/dts-v1/; ++/plugin/; ++ ++/ { ++ fragment@0 { ++ target = <&i2c_1>; ++ ++ __overlay__ { ++ status = "disabled"; ++ }; ++ }; ++ ++ fragment@1 { ++ target = <&hsi2c_5>; ++ ++ __overlay__ { ++ status = "disabled"; ++ }; ++ }; ++ ++ fragment@2 { ++ target = <&spi_1>; ++ ++ __overlay__ { ++ status = "disabled"; ++ }; ++ }; ++ ++ fragment@3 { ++ target = <&hktft35>; ++ ++ __overlay__ { ++ status = "okay"; ++ }; ++ }; ++}; +diff --git a/arch/arm/boot/dts/overlays/i2c1-overlay.dts b/arch/arm/boot/dts/overlays/i2c1-overlay.dts +new file mode 100644 +index 0000000000000..2fd27754e7c89 +--- /dev/null ++++ b/arch/arm/boot/dts/overlays/i2c1-overlay.dts +@@ -0,0 +1,12 @@ ++/dts-v1/; ++/plugin/; ++ ++/ { ++ fragment@0 { ++ target = <&i2c_1>; ++ ++ __overlay__ { ++ status = "okay"; ++ }; ++ }; ++}; +diff --git a/arch/arm/boot/dts/overlays/i2c5-overlay.dts b/arch/arm/boot/dts/overlays/i2c5-overlay.dts +new file mode 100644 +index 0000000000000..9ef9e66699e08 +--- /dev/null ++++ b/arch/arm/boot/dts/overlays/i2c5-overlay.dts +@@ -0,0 +1,12 @@ ++/dts-v1/; ++/plugin/; ++ ++/ { ++ fragment@0 { ++ target = <&hsi2c_5>; ++ ++ __overlay__ { ++ status = "okay"; ++ }; ++ }; ++}; +diff --git a/arch/arm/boot/dts/overlays/spidev1-overlay.dts b/arch/arm/boot/dts/overlays/spidev1-overlay.dts +new file mode 100644 +index 0000000000000..c5cb6bcb60114 +--- /dev/null ++++ b/arch/arm/boot/dts/overlays/spidev1-overlay.dts +@@ -0,0 +1,20 @@ ++/dts-v1/; ++/plugin/; ++ ++/ { ++ fragment@0 { ++ target = <&spi_1>; ++ ++ __overlay__ { ++ status = "okay"; ++ }; ++ }; ++ ++ fragment@1 { ++ target = <&spidev>; ++ ++ __overlay__ { ++ status = "okay"; ++ }; ++ }; ++}; diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.164-165.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.164-165.patch new file mode 100644 index 0000000000..600d8fc2e9 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.164-165.patch @@ -0,0 +1,1239 @@ +diff --git a/Makefile b/Makefile +index f2aa55cea457..166e18aa9ca9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 164 ++SUBLEVEL = 165 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index 15ce2c8b9ee2..60066315d669 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -799,11 +799,6 @@ static bool has_no_hw_prefetch(const struct arm64_cpu_capabilities *entry, int _ + MIDR_CPU_VAR_REV(1, MIDR_REVISION_MASK)); + } + +-static bool runs_at_el2(const struct arm64_cpu_capabilities *entry, int __unused) +-{ +- return is_kernel_in_hyp_mode(); +-} +- + static bool hyp_offset_low(const struct arm64_cpu_capabilities *entry, + int __unused) + { +@@ -937,6 +932,12 @@ static int __init parse_kpti(char *str) + } + early_param("kpti", parse_kpti); + ++#ifdef CONFIG_ARM64_VHE ++static bool runs_at_el2(const struct arm64_cpu_capabilities *entry, int __unused) ++{ ++ return is_kernel_in_hyp_mode(); ++} ++ + static void cpu_copy_el2regs(const struct arm64_cpu_capabilities *__unused) + { + /* +@@ -950,6 +951,7 @@ static void cpu_copy_el2regs(const struct arm64_cpu_capabilities *__unused) + if (!alternatives_applied) + write_sysreg(read_sysreg(tpidr_el1), tpidr_el2); + } ++#endif + + #ifdef CONFIG_ARM64_SSBD + static int ssbs_emulation_handler(struct pt_regs *regs, u32 instr) +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 3aa7fe6baf2a..c7b9125c8ec2 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -24,11 +24,19 @@ + + #include "gpiolib.h" + ++#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l ++#define QUIRK_NO_WAKEUP 0x02l ++ + static int run_edge_events_on_boot = -1; + module_param(run_edge_events_on_boot, int, 0444); + MODULE_PARM_DESC(run_edge_events_on_boot, + "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto"); + ++static int honor_wakeup = -1; ++module_param(honor_wakeup, int, 0444); ++MODULE_PARM_DESC(honor_wakeup, ++ "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto"); ++ + /** + * struct acpi_gpio_event - ACPI GPIO event handler data + * +@@ -339,7 +347,7 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, + event->handle = evt_handle; + event->handler = handler; + event->irq = irq; +- event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE; ++ event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE; + event->pin = pin; + event->desc = desc; + +@@ -1312,7 +1320,7 @@ static int acpi_gpio_handle_deferred_request_irqs(void) + /* We must use _sync so that this runs after the first deferred_probe run */ + late_initcall_sync(acpi_gpio_handle_deferred_request_irqs); + +-static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { ++static const struct dmi_system_id gpiolib_acpi_quirks[] = { + { + /* + * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for +@@ -1322,7 +1330,8 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "MINIX"), + DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), +- } ++ }, ++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, + }, + { + /* +@@ -1334,20 +1343,52 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"), + DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"), +- } ++ }, ++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, ++ }, ++ { ++ /* ++ * Various HP X2 10 Cherry Trail models use an external ++ * embedded-controller connected via I2C + an ACPI GPIO ++ * event handler. The embedded controller generates various ++ * spurious wakeup events when suspended. So disable wakeup ++ * for its handler (it uses the only ACPI GPIO event handler). ++ * This breaks wakeup when opening the lid, the user needs ++ * to press the power-button to wakeup the system. The ++ * alternative is suspend simply not working, which is worse. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"), ++ }, ++ .driver_data = (void *)QUIRK_NO_WAKEUP, + }, + {} /* Terminating entry */ + }; + + static int acpi_gpio_setup_params(void) + { ++ const struct dmi_system_id *id; ++ long quirks = 0; ++ ++ id = dmi_first_match(gpiolib_acpi_quirks); ++ if (id) ++ quirks = (long)id->driver_data; ++ + if (run_edge_events_on_boot < 0) { +- if (dmi_check_system(run_edge_events_on_boot_blacklist)) ++ if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT) + run_edge_events_on_boot = 0; + else + run_edge_events_on_boot = 1; + } + ++ if (honor_wakeup < 0) { ++ if (quirks & QUIRK_NO_WAKEUP) ++ honor_wakeup = 0; ++ else ++ honor_wakeup = 1; ++ } ++ + return 0; + } + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index ef86721c06f3..c8c83f84aced 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -274,7 +274,7 @@ static void drm_dp_encode_sideband_req(struct drm_dp_sideband_msg_req_body *req, + memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes); + idx += req->u.i2c_read.transactions[i].num_bytes; + +- buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5; ++ buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4; + buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf); + idx++; + } +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index f1259a0c2883..eb6bf881c465 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -1590,7 +1590,7 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, + * Changes struct fb_var_screeninfo are currently not pushed back + * to KMS, hence fail if different settings are requested. + */ +- if (var->bits_per_pixel != fb->format->cpp[0] * 8 || ++ if (var->bits_per_pixel > fb->format->cpp[0] * 8 || + var->xres > fb->width || var->yres > fb->height || + var->xres_virtual > fb->width || var->yres_virtual > fb->height) { + DRM_DEBUG("fb requested width/height/bpp can't fit in current fb " +@@ -1615,6 +1615,11 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, + drm_fb_helper_fill_pixel_fmt(var, fb->format->depth); + } + ++ /* ++ * Likewise, bits_per_pixel should be rounded up to a supported value. ++ */ ++ var->bits_per_pixel = fb->format->cpp[0] * 8; ++ + /* + * drm fbdev emulation doesn't support changing the pixel format at all, + * so reject all pixel format changing requests. +diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c +index e0483c068d23..baff1f01bfc7 100644 +--- a/drivers/gpu/drm/i915/intel_lrc.c ++++ b/drivers/gpu/drm/i915/intel_lrc.c +@@ -1101,17 +1101,14 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch) + + *batch++ = MI_NOOP; + +- /* WaClearSlmSpaceAtContextSwitch:kbl */ +- /* Actual scratch location is at 128 bytes offset */ +- if (IS_KBL_REVID(engine->i915, 0, KBL_REVID_A0)) { +- batch = gen8_emit_pipe_control(batch, +- PIPE_CONTROL_FLUSH_L3 | +- PIPE_CONTROL_GLOBAL_GTT_IVB | +- PIPE_CONTROL_CS_STALL | +- PIPE_CONTROL_QW_WRITE, +- i915_ggtt_offset(engine->scratch) +- + 2 * CACHELINE_BYTES); +- } ++ /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */ ++ batch = gen8_emit_pipe_control(batch, ++ PIPE_CONTROL_FLUSH_L3 | ++ PIPE_CONTROL_GLOBAL_GTT_IVB | ++ PIPE_CONTROL_CS_STALL | ++ PIPE_CONTROL_QW_WRITE, ++ i915_ggtt_offset(engine->scratch) + ++ 2 * CACHELINE_BYTES); + + /* WaMediaPoolStateCmdInWABB:bxt,glk */ + if (HAS_POOLED_EU(engine->i915)) { +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 6a04b56d161b..2d089d3954e3 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -268,6 +268,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign + offset = report->size; + report->size += parser->global.report_size * parser->global.report_count; + ++ /* Total size check: Allow for possible report index byte */ ++ if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { ++ hid_err(parser->device, "report is too long\n"); ++ return -1; ++ } ++ + if (!parser->local.usage_index) /* Ignore padding fields */ + return 0; + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 9d24fb0715ba..14e4003fde4d 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1116,9 +1116,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + } + + mapped: +- if (device->driver->input_mapped && device->driver->input_mapped(device, +- hidinput, field, usage, &bit, &max) < 0) +- goto ignore; ++ if (device->driver->input_mapped && ++ device->driver->input_mapped(device, hidinput, field, usage, ++ &bit, &max) < 0) { ++ /* ++ * The driver indicated that no further generic handling ++ * of the usage is desired. ++ */ ++ return; ++ } + + set_bit(usage->type, input->evbit); + +@@ -1176,9 +1182,11 @@ mapped: + set_bit(MSC_SCAN, input->mscbit); + } + +-ignore: + return; + ++ignore: ++ usage->type = 0; ++ usage->code = 0; + } + + void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value) +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index 6f67d73b184e..e63b761f600a 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + #define UHID_NAME "uhid" + #define UHID_BUFSIZE 32 +@@ -774,7 +775,7 @@ static unsigned int uhid_char_poll(struct file *file, poll_table *wait) + if (uhid->head != uhid->tail) + return POLLIN | POLLRDNORM; + +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static const struct file_operations uhid_fops = { +diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c +index ce342fd0457e..bccd97cdc53f 100644 +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -254,12 +254,51 @@ static int hiddev_release(struct inode * inode, struct file * file) + return 0; + } + ++static int __hiddev_open(struct hiddev *hiddev, struct file *file) ++{ ++ struct hiddev_list *list; ++ int error; ++ ++ lockdep_assert_held(&hiddev->existancelock); ++ ++ list = vzalloc(sizeof(*list)); ++ if (!list) ++ return -ENOMEM; ++ ++ mutex_init(&list->thread_lock); ++ list->hiddev = hiddev; ++ ++ if (!hiddev->open++) { ++ error = hid_hw_power(hiddev->hid, PM_HINT_FULLON); ++ if (error < 0) ++ goto err_drop_count; ++ ++ error = hid_hw_open(hiddev->hid); ++ if (error < 0) ++ goto err_normal_power; ++ } ++ ++ spin_lock_irq(&hiddev->list_lock); ++ list_add_tail(&list->node, &hiddev->list); ++ spin_unlock_irq(&hiddev->list_lock); ++ ++ file->private_data = list; ++ ++ return 0; ++ ++err_normal_power: ++ hid_hw_power(hiddev->hid, PM_HINT_NORMAL); ++err_drop_count: ++ hiddev->open--; ++ vfree(list); ++ return error; ++} ++ + /* + * open file op + */ + static int hiddev_open(struct inode *inode, struct file *file) + { +- struct hiddev_list *list; + struct usb_interface *intf; + struct hid_device *hid; + struct hiddev *hiddev; +@@ -268,66 +307,14 @@ static int hiddev_open(struct inode *inode, struct file *file) + intf = usbhid_find_interface(iminor(inode)); + if (!intf) + return -ENODEV; ++ + hid = usb_get_intfdata(intf); + hiddev = hid->hiddev; + +- if (!(list = vzalloc(sizeof(struct hiddev_list)))) +- return -ENOMEM; +- mutex_init(&list->thread_lock); +- list->hiddev = hiddev; +- file->private_data = list; +- +- /* +- * no need for locking because the USB major number +- * is shared which usbcore guards against disconnect +- */ +- if (list->hiddev->exist) { +- if (!list->hiddev->open++) { +- res = hid_hw_open(hiddev->hid); +- if (res < 0) +- goto bail; +- } +- } else { +- res = -ENODEV; +- goto bail; +- } +- +- spin_lock_irq(&list->hiddev->list_lock); +- list_add_tail(&list->node, &hiddev->list); +- spin_unlock_irq(&list->hiddev->list_lock); +- + mutex_lock(&hiddev->existancelock); +- /* +- * recheck exist with existance lock held to +- * avoid opening a disconnected device +- */ +- if (!list->hiddev->exist) { +- res = -ENODEV; +- goto bail_unlock; +- } +- if (!list->hiddev->open++) +- if (list->hiddev->exist) { +- struct hid_device *hid = hiddev->hid; +- res = hid_hw_power(hid, PM_HINT_FULLON); +- if (res < 0) +- goto bail_unlock; +- res = hid_hw_open(hid); +- if (res < 0) +- goto bail_normal_power; +- } +- mutex_unlock(&hiddev->existancelock); +- return 0; +-bail_normal_power: +- hid_hw_power(hid, PM_HINT_NORMAL); +-bail_unlock: ++ res = hiddev->exist ? __hiddev_open(hiddev, file) : -ENODEV; + mutex_unlock(&hiddev->existancelock); + +- spin_lock_irq(&list->hiddev->list_lock); +- list_del(&list->node); +- spin_unlock_irq(&list->hiddev->list_lock); +-bail: +- file->private_data = NULL; +- vfree(list); + return res; + } + +diff --git a/drivers/input/input.c b/drivers/input/input.c +index 50d425fe6706..cadb368be8ef 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -858,16 +858,18 @@ static int input_default_setkeycode(struct input_dev *dev, + } + } + +- __clear_bit(*old_keycode, dev->keybit); +- __set_bit(ke->keycode, dev->keybit); +- +- for (i = 0; i < dev->keycodemax; i++) { +- if (input_fetch_keycode(dev, i) == *old_keycode) { +- __set_bit(*old_keycode, dev->keybit); +- break; /* Setting the bit twice is useless, so break */ ++ if (*old_keycode <= KEY_MAX) { ++ __clear_bit(*old_keycode, dev->keybit); ++ for (i = 0; i < dev->keycodemax; i++) { ++ if (input_fetch_keycode(dev, i) == *old_keycode) { ++ __set_bit(*old_keycode, dev->keybit); ++ /* Setting the bit twice is useless, so break */ ++ break; ++ } + } + } + ++ __set_bit(ke->keycode, dev->keybit); + return 0; + } + +@@ -923,9 +925,13 @@ int input_set_keycode(struct input_dev *dev, + * Simulate keyup event if keycode is not present + * in the keymap anymore + */ +- if (test_bit(EV_KEY, dev->evbit) && +- !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && +- __test_and_clear_bit(old_keycode, dev->key)) { ++ if (old_keycode > KEY_MAX) { ++ dev_warn(dev->dev.parent ?: &dev->dev, ++ "%s: got too big old keycode %#x\n", ++ __func__, old_keycode); ++ } else if (test_bit(EV_KEY, dev->evbit) && ++ !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && ++ __test_and_clear_bit(old_keycode, dev->key)) { + struct input_value vals[] = { + { EV_KEY, old_keycode, 0 }, + input_value_sync +diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c +index acb708fc1463..0a7d818a06f3 100644 +--- a/drivers/net/can/mscan/mscan.c ++++ b/drivers/net/can/mscan/mscan.c +@@ -392,13 +392,12 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + struct net_device *dev = napi->dev; + struct mscan_regs __iomem *regs = priv->reg_base; + struct net_device_stats *stats = &dev->stats; +- int npackets = 0; +- int ret = 1; ++ int work_done = 0; + struct sk_buff *skb; + struct can_frame *frame; + u8 canrflg; + +- while (npackets < quota) { ++ while (work_done < quota) { + canrflg = in_8(®s->canrflg); + if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF))) + break; +@@ -419,18 +418,18 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + + stats->rx_packets++; + stats->rx_bytes += frame->can_dlc; +- npackets++; ++ work_done++; + netif_receive_skb(skb); + } + +- if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) { +- napi_complete(&priv->napi); +- clear_bit(F_RX_PROGRESS, &priv->flags); +- if (priv->can.state < CAN_STATE_BUS_OFF) +- out_8(®s->canrier, priv->shadow_canrier); +- ret = 0; ++ if (work_done < quota) { ++ if (likely(napi_complete_done(&priv->napi, work_done))) { ++ clear_bit(F_RX_PROGRESS, &priv->flags); ++ if (priv->can.state < CAN_STATE_BUS_OFF) ++ out_8(®s->canrier, priv->shadow_canrier); ++ } + } +- return ret; ++ return work_done; + } + + static irqreturn_t mscan_isr(int irq, void *dev_id) +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index bfbf80949600..aed8ab6d6c5b 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -926,7 +926,7 @@ static int gs_usb_probe(struct usb_interface *intf, + GS_USB_BREQ_HOST_FORMAT, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + hconf, + sizeof(*hconf), + 1000); +@@ -949,7 +949,7 @@ static int gs_usb_probe(struct usb_interface *intf, + GS_USB_BREQ_DEVICE_CONFIG, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + dconf, + sizeof(*dconf), + 1000); +diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c +index f9c79e21ab22..c64a03f164c0 100644 +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -454,6 +454,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id, + ath10k_dbg(ar, ATH10K_DBG_USB_BULK, + "usb bulk transmit failed: %d\n", ret); + usb_unanchor_urb(urb); ++ usb_free_urb(urb); + ret = -EINVAL; + goto err_free_urb_to_pipe; + } +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 9d0d790a1319..8ee9609ef974 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1022,8 +1022,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) + } + skb_put(skb, MWIFIEX_UPLD_SIZE); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); + return -1; ++ } + + card->cmdrsp_buf = skb; + +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +index a8043d76152a..f88a953b3cd5 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +@@ -271,6 +271,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv, + "11D: skip setting domain info in FW\n"); + return 0; + } ++ ++ if (country_ie_len > ++ (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "11D: country_ie_len overflow!, deauth AP\n"); ++ return -EINVAL; ++ } ++ + memcpy(priv->adapter->country_code, &country_ie[2], 2); + + domain_info->country_code[0] = country_ie[2]; +@@ -314,8 +322,9 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss, + priv->scan_block = false; + + if (bss) { +- if (adapter->region_code == 0x00) +- mwifiex_process_country_ie(priv, bss); ++ if (adapter->region_code == 0x00 && ++ mwifiex_process_country_ie(priv, bss)) ++ return -EINVAL; + + /* Allocate and fill new bss descriptor */ + bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor), +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index b58bf8e2cad2..73fc5952fd37 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5453,6 +5453,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) + ret = usb_submit_urb(urb, GFP_KERNEL); + if (ret) { + usb_unanchor_urb(urb); ++ usb_free_urb(urb); + goto error; + } + +diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c +index 6601ad0dfb3a..4ba3634009af 100644 +--- a/drivers/phy/motorola/phy-cpcap-usb.c ++++ b/drivers/phy/motorola/phy-cpcap-usb.c +@@ -207,6 +207,19 @@ static int cpcap_phy_get_ints_state(struct cpcap_phy_ddata *ddata, + static int cpcap_usb_set_uart_mode(struct cpcap_phy_ddata *ddata); + static int cpcap_usb_set_usb_mode(struct cpcap_phy_ddata *ddata); + ++static void cpcap_usb_try_musb_mailbox(struct cpcap_phy_ddata *ddata, ++ enum musb_vbus_id_status status) ++{ ++ int error; ++ ++ error = musb_mailbox(status); ++ if (!error) ++ return; ++ ++ dev_dbg(ddata->dev, "%s: musb_mailbox failed: %i\n", ++ __func__, error); ++} ++ + static void cpcap_usb_detect(struct work_struct *work) + { + struct cpcap_phy_ddata *ddata; +@@ -226,9 +239,7 @@ static void cpcap_usb_detect(struct work_struct *work) + if (error) + goto out_err; + +- error = musb_mailbox(MUSB_ID_GROUND); +- if (error) +- goto out_err; ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND); + + error = regmap_update_bits(ddata->reg, CPCAP_REG_USBC3, + CPCAP_BIT_VBUSSTBY_EN, +@@ -255,9 +266,7 @@ static void cpcap_usb_detect(struct work_struct *work) + error = cpcap_usb_set_usb_mode(ddata); + if (error) + goto out_err; +- error = musb_mailbox(MUSB_ID_GROUND); +- if (error) +- goto out_err; ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND); + + return; + } +@@ -267,22 +276,18 @@ static void cpcap_usb_detect(struct work_struct *work) + error = cpcap_usb_set_usb_mode(ddata); + if (error) + goto out_err; +- error = musb_mailbox(MUSB_VBUS_VALID); +- if (error) +- goto out_err; ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_VALID); + + return; + } + ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); ++ + /* Default to debug UART mode */ + error = cpcap_usb_set_uart_mode(ddata); + if (error) + goto out_err; + +- error = musb_mailbox(MUSB_VBUS_OFF); +- if (error) +- goto out_err; +- + dev_dbg(ddata->dev, "set UART mode\n"); + + return; +@@ -647,9 +652,7 @@ static int cpcap_usb_phy_remove(struct platform_device *pdev) + if (error) + dev_err(ddata->dev, "could not set UART mode\n"); + +- error = musb_mailbox(MUSB_VBUS_OFF); +- if (error) +- dev_err(ddata->dev, "could not set mailbox\n"); ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); + + usb_remove_phy(&ddata->phy); + cancel_delayed_work_sync(&ddata->detect_work); +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index d0a504af5b4f..0a70d54a4df6 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -283,8 +283,10 @@ bfad_im_get_stats(struct Scsi_Host *shost) + rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa), + fcstats, bfad_hcb_comp, &fcomp); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); +- if (rc != BFA_STATUS_OK) ++ if (rc != BFA_STATUS_OK) { ++ kfree(fcstats); + return NULL; ++ } + + wait_for_completion(&fcomp.comp); + +diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c +index 2c1b6de30da8..385e14269870 100644 +--- a/drivers/staging/comedi/drivers/adv_pci1710.c ++++ b/drivers/staging/comedi/drivers/adv_pci1710.c +@@ -45,8 +45,8 @@ + #define PCI171X_RANGE_UNI BIT(4) + #define PCI171X_RANGE_GAIN(x) (((x) & 0x7) << 0) + #define PCI171X_MUX_REG 0x04 /* W: A/D multiplexor control */ +-#define PCI171X_MUX_CHANH(x) (((x) & 0xf) << 8) +-#define PCI171X_MUX_CHANL(x) (((x) & 0xf) << 0) ++#define PCI171X_MUX_CHANH(x) (((x) & 0xff) << 8) ++#define PCI171X_MUX_CHANL(x) (((x) & 0xff) << 0) + #define PCI171X_MUX_CHAN(x) (PCI171X_MUX_CHANH(x) | PCI171X_MUX_CHANL(x)) + #define PCI171X_STATUS_REG 0x06 /* R: status register */ + #define PCI171X_STATUS_IRQ BIT(11) /* 1=IRQ occurred */ +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index 3733b73863b6..536453358568 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -45,6 +45,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = { + {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ + {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ ++ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ + {} /* Terminating entry */ +diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h +index 74715c854856..705fffa59da9 100644 +--- a/drivers/staging/vt6656/device.h ++++ b/drivers/staging/vt6656/device.h +@@ -269,6 +269,7 @@ struct vnt_private { + u8 mac_hw; + /* netdev */ + struct usb_device *usb; ++ struct usb_interface *intf; + + u64 tsf_time; + u8 rx_rate; +diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c +index cc6d8778fe5b..645ea16b53d5 100644 +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -954,6 +954,7 @@ vt6656_probe(struct usb_interface *intf, const struct usb_device_id *id) + priv = hw->priv; + priv->hw = hw; + priv->usb = udev; ++ priv->intf = intf; + + vnt_set_options(priv); + +diff --git a/drivers/staging/vt6656/wcmd.c b/drivers/staging/vt6656/wcmd.c +index b2fc17f1381b..3f6ccdeb6dec 100644 +--- a/drivers/staging/vt6656/wcmd.c ++++ b/drivers/staging/vt6656/wcmd.c +@@ -109,6 +109,7 @@ void vnt_run_command(struct work_struct *work) + if (vnt_init(priv)) { + /* If fail all ends TODO retry */ + dev_err(&priv->usb->dev, "failed to start\n"); ++ usb_set_intfdata(priv->intf, NULL); + ieee80211_free_hw(priv->hw); + return; + } +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 38bb8f85e88d..0ff8de7725cf 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2810,6 +2810,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport) + if (uport->cons && uport->dev) + of_console_check(uport->dev->of_node, uport->cons->name, uport->line); + ++ tty_port_link_device(port, drv->tty_driver, uport->line); + uart_configure_port(drv, state, uport); + + port->console = uart_console(uport); +diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c +index 18cb8e46262d..83683a5627f3 100644 +--- a/drivers/usb/chipidea/host.c ++++ b/drivers/usb/chipidea/host.c +@@ -37,6 +37,7 @@ static int (*orig_bus_suspend)(struct usb_hcd *hcd); + + struct ehci_ci_priv { + struct regulator *reg_vbus; ++ bool enabled; + }; + + static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) +@@ -48,7 +49,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + int ret = 0; + int port = HCS_N_PORTS(ehci->hcs_params); + +- if (priv->reg_vbus) { ++ if (priv->reg_vbus && enable != priv->enabled) { + if (port > 1) { + dev_warn(dev, + "Not support multi-port regulator control\n"); +@@ -64,6 +65,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + enable ? "enable" : "disable", ret); + return ret; + } ++ priv->enabled = enable; + } + + if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) { +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 1f525d5f6d2d..7df7faa3eed5 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -392,12 +392,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, + endpoint->desc.wMaxPacketSize = cpu_to_le16(8); + } + +- /* Validate the wMaxPacketSize field */ ++ /* ++ * Validate the wMaxPacketSize field. ++ * Some devices have isochronous endpoints in altsetting 0; ++ * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 ++ * (see the end of section 5.6.3), so don't warn about them. ++ */ + maxp = usb_endpoint_maxp(&endpoint->desc); +- if (maxp == 0) { +- dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n", ++ if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { ++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", + cfgno, inum, asnum, d->bEndpointAddress); +- goto skip_to_next_endpoint_or_interface_descriptor; + } + + /* Find the highest legal maxpacket size for this endpoint */ +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index ff17e94ef465..dca39c9a13b0 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1838,6 +1838,9 @@ static const struct attribute_group musb_attr_group = { + #define MUSB_QUIRK_B_INVALID_VBUS_91 (MUSB_DEVCTL_BDEVICE | \ + (2 << MUSB_DEVCTL_VBUS_SHIFT) | \ + MUSB_DEVCTL_SESSION) ++#define MUSB_QUIRK_B_DISCONNECT_99 (MUSB_DEVCTL_BDEVICE | \ ++ (3 << MUSB_DEVCTL_VBUS_SHIFT) | \ ++ MUSB_DEVCTL_SESSION) + #define MUSB_QUIRK_A_DISCONNECT_19 ((3 << MUSB_DEVCTL_VBUS_SHIFT) | \ + MUSB_DEVCTL_SESSION) + +@@ -1860,6 +1863,11 @@ static void musb_pm_runtime_check_session(struct musb *musb) + s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV | + MUSB_DEVCTL_HR; + switch (devctl & ~s) { ++ case MUSB_QUIRK_B_DISCONNECT_99: ++ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); ++ schedule_delayed_work(&musb->irq_work, ++ msecs_to_jiffies(1000)); ++ break; + case MUSB_QUIRK_B_INVALID_VBUS_91: + if (musb->quirk_retries && !musb->flush_irq_work) { + musb_dbg(musb, +@@ -2320,6 +2328,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl) + musb_disable_interrupts(musb); + musb_writeb(musb->mregs, MUSB_DEVCTL, 0); + ++ /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */ ++ musb_writeb(musb->mregs, MUSB_POWER, 0); ++ + /* Init IRQ workqueue before request_irq */ + INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work); + INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset); +diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c +index 512108e22d2b..1dc35ab31275 100644 +--- a/drivers/usb/musb/musbhsdma.c ++++ b/drivers/usb/musb/musbhsdma.c +@@ -399,7 +399,7 @@ struct dma_controller *musbhs_dma_controller_create(struct musb *musb, + controller->controller.channel_abort = dma_channel_abort; + + if (request_irq(irq, dma_controller_irq, 0, +- dev_name(musb->controller), &controller->controller)) { ++ dev_name(musb->controller), controller)) { + dev_err(dev, "request_irq %d failed!\n", irq); + musb_dma_controller_destroy(&controller->controller); + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index dc9a1139e7e1..e69e31539914 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -570,6 +570,9 @@ static void option_instat_callback(struct urb *urb); + /* Interface must have two endpoints */ + #define NUMEP2 BIT(16) + ++/* Device needs ZLP */ ++#define ZLP BIT(17) ++ + + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, +@@ -1201,6 +1204,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, +@@ -2109,6 +2114,9 @@ static int option_attach(struct usb_serial *serial) + if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) + data->use_send_setup = 1; + ++ if (device_flags & ZLP) ++ data->use_zlp = 1; ++ + spin_lock_init(&data->susp_lock); + + usb_set_serial_data(serial, data); +diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h +index d28dab4b9eff..9879773fb39e 100644 +--- a/drivers/usb/serial/usb-wwan.h ++++ b/drivers/usb/serial/usb-wwan.h +@@ -36,6 +36,7 @@ struct usb_wwan_intf_private { + spinlock_t susp_lock; + unsigned int suspended:1; + unsigned int use_send_setup:1; ++ unsigned int use_zlp:1; + int in_flight; + unsigned int open_ports; + void *private; +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index 59bfcb3da116..95e9576c2fe6 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -492,6 +492,7 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + void (*callback) (struct urb *)) + { + struct usb_serial *serial = port->serial; ++ struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial); + struct urb *urb; + + urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */ +@@ -502,6 +503,9 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + usb_sndbulkpipe(serial->dev, endpoint) | dir, + buf, len, callback, ctx); + ++ if (intfdata->use_zlp && dir == USB_DIR_OUT) ++ urb->transfer_flags |= URB_ZERO_PACKET; ++ + return urb; + } + +diff --git a/fs/char_dev.c b/fs/char_dev.c +index 20ce45c7c57c..715d76b00108 100644 +--- a/fs/char_dev.c ++++ b/fs/char_dev.c +@@ -361,7 +361,7 @@ static struct kobject *cdev_get(struct cdev *p) + + if (owner && !try_module_get(owner)) + return NULL; +- kobj = kobject_get(&p->kobj); ++ kobj = kobject_get_unless_zero(&p->kobj); + if (!kobj) + module_put(owner); + return kobj; +diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h +index c0c0b992210e..995903c7055b 100644 +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -90,6 +91,36 @@ struct can_priv { + #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC)) + #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC)) + ++/* Check for outgoing skbs that have not been created by the CAN subsystem */ ++static inline bool can_skb_headroom_valid(struct net_device *dev, ++ struct sk_buff *skb) ++{ ++ /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */ ++ if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv))) ++ return false; ++ ++ /* af_packet does not apply CAN skb specific settings */ ++ if (skb->ip_summed == CHECKSUM_NONE) { ++ /* init headroom */ ++ can_skb_prv(skb)->ifindex = dev->ifindex; ++ can_skb_prv(skb)->skbcnt = 0; ++ ++ skb->ip_summed = CHECKSUM_UNNECESSARY; ++ ++ /* preform proper loopback on capable devices */ ++ if (dev->flags & IFF_ECHO) ++ skb->pkt_type = PACKET_LOOPBACK; ++ else ++ skb->pkt_type = PACKET_HOST; ++ ++ skb_reset_mac_header(skb); ++ skb_reset_network_header(skb); ++ skb_reset_transport_header(skb); ++ } ++ ++ return true; ++} ++ + /* Drop a given socketbuffer if it does not contain a valid CAN frame. */ + static inline bool can_dropped_invalid_skb(struct net_device *dev, + struct sk_buff *skb) +@@ -107,6 +138,9 @@ static inline bool can_dropped_invalid_skb(struct net_device *dev, + } else + goto inval_skb; + ++ if (!can_skb_headroom_valid(dev, skb)) ++ goto inval_skb; ++ + return false; + + inval_skb: +diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c +index 0fa9dadf3f4f..a5a4b5663163 100644 +--- a/kernel/trace/trace_sched_wakeup.c ++++ b/kernel/trace/trace_sched_wakeup.c +@@ -640,7 +640,7 @@ static void start_wakeup_tracer(struct trace_array *tr) + if (ret) { + pr_info("wakeup trace: Couldn't activate tracepoint" + " probe to kernel_sched_migrate_task\n"); +- return; ++ goto fail_deprobe_sched_switch; + } + + wakeup_reset(tr); +@@ -658,6 +658,8 @@ static void start_wakeup_tracer(struct trace_array *tr) + printk(KERN_ERR "failed to start wakeup tracer\n"); + + return; ++fail_deprobe_sched_switch: ++ unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); + fail_deprobe_wake_new: + unregister_trace_sched_wakeup_new(probe_wakeup, NULL); + fail_deprobe: +diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c +index 719a52a4064a..6f9091f874a9 100644 +--- a/kernel/trace/trace_stack.c ++++ b/kernel/trace/trace_stack.c +@@ -196,6 +196,11 @@ check_stack(unsigned long ip, unsigned long *stack) + local_irq_restore(flags); + } + ++/* Some archs may not define MCOUNT_INSN_SIZE */ ++#ifndef MCOUNT_INSN_SIZE ++# define MCOUNT_INSN_SIZE 0 ++#endif ++ + static void + stack_trace_call(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *op, struct pt_regs *pt_regs) +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 356ae7da4f16..e288489ae3d5 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -394,10 +394,11 @@ next: ; + return 1; + } + +-static inline int check_target(struct arpt_entry *e, const char *name) ++static int check_target(struct arpt_entry *e, struct net *net, const char *name) + { + struct xt_entry_target *t = arpt_get_target(e); + struct xt_tgchk_param par = { ++ .net = net, + .table = name, + .entryinfo = e, + .target = t->u.kernel.target, +@@ -409,8 +410,9 @@ static inline int check_target(struct arpt_entry *e, const char *name) + return xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false); + } + +-static inline int +-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, ++static int ++find_check_entry(struct arpt_entry *e, struct net *net, const char *name, ++ unsigned int size, + struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; +@@ -429,7 +431,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, + } + t->u.kernel.target = target; + +- ret = check_target(e, name); ++ ret = check_target(e, net, name); + if (ret) + goto err; + return 0; +@@ -522,7 +524,9 @@ static inline void cleanup_entry(struct arpt_entry *e) + /* Checks and translates the user-supplied table segment (held in + * newinfo). + */ +-static int translate_table(struct xt_table_info *newinfo, void *entry0, ++static int translate_table(struct net *net, ++ struct xt_table_info *newinfo, ++ void *entry0, + const struct arpt_replace *repl) + { + struct xt_percpu_counter_alloc_state alloc_state = { 0 }; +@@ -586,7 +590,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, repl->name, repl->size, ++ ret = find_check_entry(iter, net, repl->name, repl->size, + &alloc_state); + if (ret != 0) + break; +@@ -974,7 +978,7 @@ static int do_replace(struct net *net, const void __user *user, + goto free_newinfo; + } + +- ret = translate_table(newinfo, loc_cpu_entry, &tmp); ++ ret = translate_table(net, newinfo, loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1149,7 +1153,8 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr, + } + } + +-static int translate_compat_table(struct xt_table_info **pinfo, ++static int translate_compat_table(struct net *net, ++ struct xt_table_info **pinfo, + void **pentry0, + const struct compat_arpt_replace *compatr) + { +@@ -1217,7 +1222,7 @@ static int translate_compat_table(struct xt_table_info **pinfo, + repl.num_counters = 0; + repl.counters = NULL; + repl.size = newinfo->size; +- ret = translate_table(newinfo, entry1, &repl); ++ ret = translate_table(net, newinfo, entry1, &repl); + if (ret) + goto free_newinfo; + +@@ -1270,7 +1275,7 @@ static int compat_do_replace(struct net *net, void __user *user, + goto free_newinfo; + } + +- ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp); ++ ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1546,7 +1551,7 @@ int arpt_register_table(struct net *net, + loc_cpu_entry = newinfo->entries; + memcpy(loc_cpu_entry, repl->entries, repl->size); + +- ret = translate_table(newinfo, loc_cpu_entry, repl); ++ ret = translate_table(net, newinfo, loc_cpu_entry, repl); + if (ret != 0) + goto out_free; + +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index 94d74ec61f42..c2b21c9c1229 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -1639,6 +1639,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, + struct ip_set *set; + struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {}; + int ret = 0; ++ u32 lineno; + + if (unlikely(protocol_failed(attr) || + !attr[IPSET_ATTR_SETNAME] || +@@ -1655,7 +1656,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, + return -IPSET_ERR_PROTOCOL; + + rcu_read_lock_bh(); +- ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0); ++ ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0); + rcu_read_unlock_bh(); + /* Userspace can't trigger element to be re-added */ + if (ret == -EAGAIN) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 41e3c77d5fb7..5a7afbeb612d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -378,6 +378,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0672: + alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */ + break; ++ case 0x10ec0222: + case 0x10ec0623: + alc_update_coef_idx(codec, 0x19, 1<<13, 0); + break; +@@ -396,6 +397,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + break; + case 0x10ec0899: + case 0x10ec0900: ++ case 0x10ec0b00: + case 0x10ec1168: + case 0x10ec1220: + alc_update_coef_idx(codec, 0x7, 1<<1, 0); +@@ -2389,6 +2391,7 @@ static int patch_alc882(struct hda_codec *codec) + case 0x10ec0882: + case 0x10ec0885: + case 0x10ec0900: ++ case 0x10ec0b00: + case 0x10ec1220: + break; + default: +@@ -8398,6 +8401,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { + HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662), + HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882), + HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882), ++ HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882), + {} /* terminator */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index ad14d6b78bdc..51ee7910e98c 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1143,6 +1143,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ + case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ + case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ ++ case USB_ID(0x05a7, 0x1020): /* Bose Companion 5 */ + case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ + case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */ + case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */ diff --git a/patch/kernel/rk3399-legacy/patch-4.4.208-209.patch b/patch/kernel/rk3399-legacy/patch-4.4.208-209.patch new file mode 100644 index 0000000000..eca7d9ae5a --- /dev/null +++ b/patch/kernel/rk3399-legacy/patch-4.4.208-209.patch @@ -0,0 +1,1715 @@ +diff --git a/Makefile b/Makefile +index 84d74ea25d70..762f77777e62 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 208 ++SUBLEVEL = 209 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts +index d2450ab0a380..3293484028ad 100644 +--- a/arch/arm/boot/dts/am437x-gp-evm.dts ++++ b/arch/arm/boot/dts/am437x-gp-evm.dts +@@ -79,7 +79,7 @@ + }; + + lcd0: display { +- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; ++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; + label = "lcd"; + + panel-timing { +diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts +index 00707aac72fc..a74b09f17a1a 100644 +--- a/arch/arm/boot/dts/am43x-epos-evm.dts ++++ b/arch/arm/boot/dts/am43x-epos-evm.dts +@@ -41,7 +41,7 @@ + }; + + lcd0: display { +- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; ++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; + label = "lcd"; + + panel-timing { +diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c +index 5766ce2be32b..29eb945075e3 100644 +--- a/arch/arm/mach-vexpress/spc.c ++++ b/arch/arm/mach-vexpress/spc.c +@@ -555,8 +555,9 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev) + + static int __init ve_spc_clk_init(void) + { +- int cpu; ++ int cpu, cluster; + struct clk *clk; ++ bool init_opp_table[MAX_CLUSTERS] = { false }; + + if (!info) + return 0; /* Continue only if SPC is initialised */ +@@ -582,8 +583,17 @@ static int __init ve_spc_clk_init(void) + continue; + } + ++ cluster = topology_physical_package_id(cpu_dev->id); ++ if (init_opp_table[cluster]) ++ continue; ++ + if (ve_init_opp_table(cpu_dev)) + pr_warn("failed to initialise cpu%d opp table\n", cpu); ++ else if (dev_pm_opp_set_sharing_cpus(cpu_dev, ++ topology_core_cpumask(cpu_dev->id))) ++ pr_warn("failed to mark OPPs shared for cpu%d\n", cpu); ++ else ++ init_opp_table[cluster] = true; + } + + platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0); +diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h +index e309d8fcb516..da1cb0499d6c 100644 +--- a/arch/mips/include/asm/thread_info.h ++++ b/arch/mips/include/asm/thread_info.h +@@ -52,8 +52,26 @@ struct thread_info { + #define init_thread_info (init_thread_union.thread_info) + #define init_stack (init_thread_union.stack) + +-/* How to get the thread information struct from C. */ ++/* ++ * A pointer to the struct thread_info for the currently executing thread is ++ * held in register $28/$gp. ++ * ++ * We declare __current_thread_info as a global register variable rather than a ++ * local register variable within current_thread_info() because clang doesn't ++ * support explicit local register variables. ++ * ++ * When building the VDSO we take care not to declare the global register ++ * variable because this causes GCC to not preserve the value of $28/$gp in ++ * functions that change its value (which is common in the PIC VDSO when ++ * accessing the GOT). Since the VDSO shouldn't be accessing ++ * __current_thread_info anyway we declare it extern in order to cause a link ++ * failure if it's referenced. ++ */ ++#ifdef __VDSO__ ++extern struct thread_info *__current_thread_info; ++#else + register struct thread_info *__current_thread_info __asm__("$28"); ++#endif + + static inline struct thread_info *current_thread_info(void) + { +diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h +index 0a90b965cccb..9849bef2a766 100644 +--- a/arch/parisc/include/asm/cmpxchg.h ++++ b/arch/parisc/include/asm/cmpxchg.h +@@ -43,8 +43,14 @@ __xchg(unsigned long x, __volatile__ void *ptr, int size) + ** if (((unsigned long)p & 0xf) == 0) + ** return __ldcw(p); + */ +-#define xchg(ptr, x) \ +- ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) ++#define xchg(ptr, x) \ ++({ \ ++ __typeof__(*(ptr)) __ret; \ ++ __typeof__(*(ptr)) _x_ = (x); \ ++ __ret = (__typeof__(*(ptr))) \ ++ __xchg((unsigned long)_x_, (ptr), sizeof(*(ptr))); \ ++ __ret; \ ++}) + + /* bug catcher for when unsupported size is used - won't link */ + extern void __cmpxchg_called_with_bad_pointer(void); +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index 1efe5ca5c3bc..5bb2c89d55c8 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -330,6 +330,14 @@ void __init mem_init(void) + BUILD_BUG_ON(MMU_PAGE_COUNT > 16); + + #ifdef CONFIG_SWIOTLB ++ /* ++ * Some platforms (e.g. 85xx) limit DMA-able memory way below ++ * 4G. We force memblock to bottom-up mode to ensure that the ++ * memory allocated in swiotlb_init() is DMA-able. ++ * As it's the last memblock allocation, no need to reset it ++ * back to to-down. ++ */ ++ memblock_set_bottom_up(true); + swiotlb_init(0); + #endif + +diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c +index 849b29b3e9ae..954ef27128f2 100644 +--- a/arch/powerpc/platforms/pseries/hvconsole.c ++++ b/arch/powerpc/platforms/pseries/hvconsole.c +@@ -62,7 +62,7 @@ EXPORT_SYMBOL(hvc_get_chars); + * @vtermno: The vtermno or unit_address of the adapter from which the data + * originated. + * @buf: The character buffer that contains the character data to send to +- * firmware. ++ * firmware. Must be at least 16 bytes, even if count is less than 16. + * @count: Send this number of characters. + */ + int hvc_put_chars(uint32_t vtermno, const char *buf, int count) +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 7490c52b2715..4a76b381d25a 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -1294,18 +1294,28 @@ static void hw_perf_event_update(struct perf_event *event, int flush_all) + */ + if (flush_all && done) + break; +- +- /* If an event overflow happened, discard samples by +- * processing any remaining sample-data-blocks. +- */ +- if (event_overflow) +- flush_all = 1; + } + + /* Account sample overflows in the event hardware structure */ + if (sampl_overflow) + OVERFLOW_REG(hwc) = DIV_ROUND_UP(OVERFLOW_REG(hwc) + + sampl_overflow, 1 + num_sdb); ++ ++ /* Perf_event_overflow() and perf_event_account_interrupt() limit ++ * the interrupt rate to an upper limit. Roughly 1000 samples per ++ * task tick. ++ * Hitting this limit results in a large number ++ * of throttled REF_REPORT_THROTTLE entries and the samples ++ * are dropped. ++ * Slightly increase the interval to avoid hitting this limit. ++ */ ++ if (event_overflow) { ++ SAMPL_RATE(hwc) += DIV_ROUND_UP(SAMPL_RATE(hwc), 10); ++ debug_sprintf_event(sfdbg, 1, "%s: rate adjustment %ld\n", ++ __func__, ++ DIV_ROUND_UP(SAMPL_RATE(hwc), 10)); ++ } ++ + if (sampl_overflow || event_overflow) + debug_sprintf_event(sfdbg, 4, "hw_perf_event_update: " + "overflow stats: sample=%llu event=%llu\n", +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 29e5409c0d48..f113fcd781d8 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -702,39 +702,67 @@ static struct sclp_core_info *smp_get_core_info(void) + + static int smp_add_present_cpu(int cpu); + +-static int __smp_rescan_cpus(struct sclp_core_info *info, int sysfs_add) ++static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail, ++ bool configured, bool early) + { + struct pcpu *pcpu; +- cpumask_t avail; +- int cpu, nr, i, j; ++ int cpu, nr, i; + u16 address; + + nr = 0; +- cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask); +- cpu = cpumask_first(&avail); +- for (i = 0; (i < info->combined) && (cpu < nr_cpu_ids); i++) { +- if (sclp.has_core_type && info->core[i].type != boot_core_type) ++ if (sclp.has_core_type && core->type != boot_core_type) ++ return nr; ++ cpu = cpumask_first(avail); ++ address = core->core_id << smp_cpu_mt_shift; ++ for (i = 0; (i <= smp_cpu_mtid) && (cpu < nr_cpu_ids); i++) { ++ if (pcpu_find_address(cpu_present_mask, address + i)) + continue; +- address = info->core[i].core_id << smp_cpu_mt_shift; +- for (j = 0; j <= smp_cpu_mtid; j++) { +- if (pcpu_find_address(cpu_present_mask, address + j)) +- continue; +- pcpu = pcpu_devices + cpu; +- pcpu->address = address + j; +- pcpu->state = +- (cpu >= info->configured*(smp_cpu_mtid + 1)) ? +- CPU_STATE_STANDBY : CPU_STATE_CONFIGURED; +- smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN); +- set_cpu_present(cpu, true); +- if (sysfs_add && smp_add_present_cpu(cpu) != 0) +- set_cpu_present(cpu, false); +- else +- nr++; +- cpu = cpumask_next(cpu, &avail); +- if (cpu >= nr_cpu_ids) ++ pcpu = pcpu_devices + cpu; ++ pcpu->address = address + i; ++ if (configured) ++ pcpu->state = CPU_STATE_CONFIGURED; ++ else ++ pcpu->state = CPU_STATE_STANDBY; ++ smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN); ++ set_cpu_present(cpu, true); ++ if (!early && smp_add_present_cpu(cpu) != 0) ++ set_cpu_present(cpu, false); ++ else ++ nr++; ++ cpumask_clear_cpu(cpu, avail); ++ cpu = cpumask_next(cpu, avail); ++ } ++ return nr; ++} ++ ++static int __smp_rescan_cpus(struct sclp_core_info *info, bool early) ++{ ++ struct sclp_core_entry *core; ++ cpumask_t avail; ++ bool configured; ++ u16 core_id; ++ int nr, i; ++ ++ nr = 0; ++ cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask); ++ /* ++ * Add IPL core first (which got logical CPU number 0) to make sure ++ * that all SMT threads get subsequent logical CPU numbers. ++ */ ++ if (early) { ++ core_id = pcpu_devices[0].address >> smp_cpu_mt_shift; ++ for (i = 0; i < info->configured; i++) { ++ core = &info->core[i]; ++ if (core->core_id == core_id) { ++ nr += smp_add_core(core, &avail, true, early); + break; ++ } + } + } ++ for (i = 0; i < info->combined; i++) { ++ configured = i < info->configured; ++ nr += smp_add_core(&info->core[i], &avail, configured, early); ++ } + return nr; + } + +@@ -782,7 +810,7 @@ static void __init smp_detect_cpus(void) + + /* Add CPUs present at boot */ + get_online_cpus(); +- __smp_rescan_cpus(info, 0); ++ __smp_rescan_cpus(info, true); + put_online_cpus(); + kfree(info); + } +@@ -1140,7 +1168,7 @@ int __ref smp_rescan_cpus(void) + return -ENOMEM; + get_online_cpus(); + mutex_lock(&smp_cpu_state_mutex); +- nr = __smp_rescan_cpus(info, 1); ++ nr = __smp_rescan_cpus(info, false); + mutex_unlock(&smp_cpu_state_mutex); + put_online_cpus(); + kfree(info); +diff --git a/arch/tile/lib/atomic_asm_32.S b/arch/tile/lib/atomic_asm_32.S +index f611265633d6..6d6c2fecb0c1 100644 +--- a/arch/tile/lib/atomic_asm_32.S ++++ b/arch/tile/lib/atomic_asm_32.S +@@ -24,8 +24,7 @@ + * has an opportunity to return -EFAULT to the user if needed. + * The 64-bit routines just return a "long long" with the value, + * since they are only used from kernel space and don't expect to fault. +- * Support for 16-bit ops is included in the framework but we don't provide +- * any (x86_64 has an atomic_inc_short(), so we might want to some day). ++ * Support for 16-bit ops is included in the framework but we don't provide any. + * + * Note that the caller is advised to issue a suitable L1 or L2 + * prefetch on the address being manipulated to avoid extra stalls. +diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h +index 249fa6b27557..afc2387323c9 100644 +--- a/arch/x86/include/asm/atomic.h ++++ b/arch/x86/include/asm/atomic.h +@@ -220,19 +220,6 @@ static __always_inline int __atomic_add_unless(atomic_t *v, int a, int u) + return c; + } + +-/** +- * atomic_inc_short - increment of a short integer +- * @v: pointer to type int +- * +- * Atomically adds 1 to @v +- * Returns the new value of @u +- */ +-static __always_inline short int atomic_inc_short(short int *v) +-{ +- asm(LOCK_PREFIX "addw $1, %0" : "+m" (*v)); +- return *v; +-} +- + #ifdef CONFIG_X86_32 + # include + #else +diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c +index d2c46454ffa8..a8814df03bd1 100644 +--- a/block/compat_ioctl.c ++++ b/block/compat_ioctl.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -406,6 +407,14 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg) + case BLKTRACETEARDOWN: /* compatible */ + ret = blk_trace_ioctl(bdev, cmd, compat_ptr(arg)); + return ret; ++ case IOC_PR_REGISTER: ++ case IOC_PR_RESERVE: ++ case IOC_PR_RELEASE: ++ case IOC_PR_PREEMPT: ++ case IOC_PR_PREEMPT_ABORT: ++ case IOC_PR_CLEAR: ++ return blkdev_ioctl(bdev, mode, cmd, ++ (unsigned long)compat_ptr(arg)); + default: + if (disk->fops->compat_ioctl) + ret = disk->fops->compat_ioctl(bdev, mode, cmd, arg); +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index fcc12c879659..7039a58a6a4e 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1056,7 +1056,7 @@ static int btusb_open(struct hci_dev *hdev) + if (data->setup_on_usb) { + err = data->setup_on_usb(hdev); + if (err < 0) +- return err; ++ goto setup_fail; + } + + err = usb_autopm_get_interface(data->intf); +@@ -1092,6 +1092,7 @@ done: + + failed: + clear_bit(BTUSB_INTR_RUNNING, &data->flags); ++setup_fail: + usb_autopm_put_interface(data->intf); + return err; + } +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 4f6fc1cfd7da..f01f7434df8e 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -396,11 +396,6 @@ static int devfreq_notifier_call(struct notifier_block *nb, unsigned long type, + static void _remove_devfreq(struct devfreq *devfreq) + { + mutex_lock(&devfreq_list_lock); +- if (IS_ERR(find_device_devfreq(devfreq->dev.parent))) { +- mutex_unlock(&devfreq_list_lock); +- dev_warn(&devfreq->dev, "releasing devfreq which doesn't exist\n"); +- return; +- } + list_del(&devfreq->node); + mutex_unlock(&devfreq_list_lock); + +@@ -472,6 +467,7 @@ struct devfreq *devfreq_add_device(struct device *dev, + devfreq->dev.parent = dev; + devfreq->dev.class = devfreq_class; + devfreq->dev.release = devfreq_dev_release; ++ INIT_LIST_HEAD(&devfreq->node); + devfreq->profile = profile; + strncpy(devfreq->governor_name, governor_name, DEVFREQ_NAME_LEN); + devfreq->previous_freq = profile->initial_freq; +diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c +index b9d2f76a0cf7..117d16a455fd 100644 +--- a/drivers/firewire/net.c ++++ b/drivers/firewire/net.c +@@ -249,7 +249,11 @@ static int fwnet_header_cache(const struct neighbour *neigh, + h = (struct fwnet_header *)((u8 *)hh->hh_data + HH_DATA_OFF(sizeof(*h))); + h->h_proto = type; + memcpy(h->h_dest, neigh->ha, net->addr_len); +- hh->hh_len = FWNET_HLEN; ++ ++ /* Pairs with the READ_ONCE() in neigh_resolve_output(), ++ * neigh_hh_output() and neigh_update_hhs(). ++ */ ++ smp_store_release(&hh->hh_len, FWNET_HLEN); + + return 0; + } +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index fe89fd56eabf..db0801c7bb8e 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -163,6 +163,14 @@ int gpiod_get_direction(struct gpio_desc *desc) + chip = gpiod_to_chip(desc); + offset = gpio_chip_hwgpio(desc); + ++ /* ++ * Open drain emulation using input mode may incorrectly report ++ * input here, fix that up. ++ */ ++ if (test_bit(FLAG_OPEN_DRAIN, &desc->flags) && ++ test_bit(FLAG_IS_OUT, &desc->flags)) ++ return 0; ++ + if (!chip->get_direction) + return status; + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index ff12d926eb65..cd707b401b10 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1538,7 +1538,11 @@ static void process_single_up_tx_qlock(struct drm_dp_mst_topology_mgr *mgr, + if (ret != 1) + DRM_DEBUG_KMS("failed to send msg in q %d\n", ret); + +- txmsg->dst->tx_slots[txmsg->seqno] = NULL; ++ if (txmsg->seqno != -1) { ++ WARN_ON((unsigned int)txmsg->seqno > ++ ARRAY_SIZE(txmsg->dst->tx_slots)); ++ txmsg->dst->tx_slots[txmsg->seqno] = NULL; ++ } + } + + static void drm_dp_queue_down_tx(struct drm_dp_mst_topology_mgr *mgr, +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 8ad9c6b04769..5ed9b5f8a037 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -4109,6 +4109,7 @@ err: + unregister_netdevice_notifier(&cma_nb); + rdma_addr_unregister_client(&addr_client); + ib_sa_unregister_client(&sa_client); ++ unregister_pernet_subsys(&cma_pernet_operations); + err_wq: + destroy_workqueue(cma_wq); + return ret; +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index abb99515068b..096f3a2ba524 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2630,7 +2630,7 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr, int *skipp + write_targets++; + } + } +- if (bio->bi_end_io) { ++ if (rdev && bio->bi_end_io) { + atomic_inc(&rdev->nr_pending); + bio->bi_iter.bi_sector = sector_nr + rdev->data_offset; + bio->bi_bdev = rdev->bdev; +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +index b7d32e8412f1..ec2122acc3c1 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +@@ -1107,7 +1107,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp) + for (i = 0; i < E1H_FUNC_MAX / 2; i++) { + u32 func_config = + MF_CFG_RD(bp, +- func_mf_config[BP_PORT(bp) + 2 * i]. ++ func_mf_config[BP_PATH(bp) + 2 * i]. + config); + func_num += + ((func_config & FUNC_MF_CFG_FUNC_HIDE) ? 0 : 1); +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 82960603da33..026c72e62c18 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9942,10 +9942,18 @@ static void bnx2x_recovery_failed(struct bnx2x *bp) + */ + static void bnx2x_parity_recover(struct bnx2x *bp) + { +- bool global = false; + u32 error_recovered, error_unrecovered; +- bool is_parity; ++ bool is_parity, global = false; ++#ifdef CONFIG_BNX2X_SRIOV ++ int vf_idx; ++ ++ for (vf_idx = 0; vf_idx < bp->requested_nr_virtfn; vf_idx++) { ++ struct bnx2x_virtf *vf = BP_VF(bp, vf_idx); + ++ if (vf) ++ vf->state = VF_LOST; ++ } ++#endif + DP(NETIF_MSG_HW, "Handling parity\n"); + while (1) { + switch (bp->recovery_state) { +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +index 6f6f13dc2be3..ab8339594cd3 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +@@ -139,6 +139,7 @@ struct bnx2x_virtf { + #define VF_ACQUIRED 1 /* VF acquired, but not initialized */ + #define VF_ENABLED 2 /* VF Enabled */ + #define VF_RESET 3 /* VF FLR'd, pending cleanup */ ++#define VF_LOST 4 /* Recovery while VFs are loaded */ + + bool flr_clnup_stage; /* true during flr cleanup */ + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +index a12a4236b143..e9fc3b09dba8 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +@@ -2095,6 +2095,18 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf, + { + int i; + ++ if (vf->state == VF_LOST) { ++ /* Just ack the FW and return if VFs are lost ++ * in case of parity error. VFs are supposed to be timedout ++ * on waiting for PF response. ++ */ ++ DP(BNX2X_MSG_IOV, ++ "VF 0x%x lost, not handling the request\n", vf->abs_vfid); ++ ++ storm_memset_vf_mbx_ack(bp, vf->abs_vfid); ++ return; ++ } ++ + /* check if tlv type is known */ + if (bnx2x_tlv_supported(mbx->first_tlv.tl.type)) { + /* Lock the per vf op mutex and note the locker's identity. +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +index 6e56c4e5ecec..31ab5e749e66 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +@@ -53,7 +53,7 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + * rate, which then uses the auto-reparenting feature of the + * clock driver, and enabling/disabling the clock. + */ +- if (gmac->interface == PHY_INTERFACE_MODE_RGMII) { ++ if (phy_interface_mode_is_rgmii(gmac->interface)) { + clk_set_rate(gmac->tx_clk, SUN7I_GMAC_GMII_RGMII_RATE); + clk_prepare_enable(gmac->tx_clk); + gmac->clk_enabled = 1; +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 4002bd90201f..eb825ea52d6b 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -233,7 +233,7 @@ static void macvlan_broadcast(struct sk_buff *skb, + struct net_device *src, + enum macvlan_mode mode) + { +- const struct ethhdr *eth = eth_hdr(skb); ++ const struct ethhdr *eth = skb_eth_hdr(skb); + const struct macvlan_dev *vlan; + struct sk_buff *nskb; + unsigned int i; +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index c813c5345a52..0d138bc60b18 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -370,7 +370,7 @@ static int lan78xx_read_stats(struct lan78xx_net *dev, + } + } else { + netdev_warn(dev->net, +- "Failed to read stat ret = 0x%x", ret); ++ "Failed to read stat ret = %d", ret); + } + + kfree(stats); +@@ -2036,11 +2036,6 @@ int lan78xx_stop(struct net_device *net) + return 0; + } + +-static int lan78xx_linearize(struct sk_buff *skb) +-{ +- return skb_linearize(skb); +-} +- + static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, + struct sk_buff *skb, gfp_t flags) + { +@@ -2051,8 +2046,10 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, + return NULL; + } + +- if (lan78xx_linearize(skb) < 0) ++ if (skb_linearize(skb)) { ++ dev_kfree_skb_any(skb); + return NULL; ++ } + + tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN_MASK_) | TX_CMD_A_FCS_; + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 536fee1e4b70..133b144ec1aa 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2068,7 +2068,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + return; + } + +- tos = ip_tunnel_ecn_encap(tos, old_iph, skb); ++ tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); + ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); + err = vxlan_xmit_skb(rt, sk, skb, fl4.saddr, + dst->sin.sin_addr.s_addr, tos, ttl, df, +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +index cc9648f844ae..0d757ced49ba 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -972,6 +972,8 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + struct ath_htc_rx_status *rxstatus; + struct ath_rx_status rx_stats; + bool decrypt_error = false; ++ __be16 rs_datalen; ++ bool is_phyerr; + + if (skb->len < HTC_RX_FRAME_HEADER_SIZE) { + ath_err(common, "Corrupted RX frame, dropping (len: %d)\n", +@@ -981,11 +983,24 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + + rxstatus = (struct ath_htc_rx_status *)skb->data; + +- if (be16_to_cpu(rxstatus->rs_datalen) - +- (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0) { ++ rs_datalen = be16_to_cpu(rxstatus->rs_datalen); ++ if (unlikely(rs_datalen - ++ (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) { + ath_err(common, + "Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n", +- rxstatus->rs_datalen, skb->len); ++ rs_datalen, skb->len); ++ goto rx_next; ++ } ++ ++ is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY; ++ /* ++ * Discard zero-length packets and packets smaller than an ACK ++ * which are not PHY_ERROR (short radar pulses have a length of 3) ++ */ ++ if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) { ++ ath_warn(common, ++ "Short RX data len, dropping (dlen: %d)\n", ++ rs_datalen); + goto rx_next; + } + +@@ -1010,7 +1025,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + * Process PHY errors and return so that the packet + * can be dropped. + */ +- if (rx_stats.rs_status & ATH9K_RXERR_PHY) { ++ if (unlikely(is_phyerr)) { + /* TODO: Not using DFS processing now. */ + if (ath_cmn_process_fft(&priv->spec_priv, hdr, + &rx_stats, rx_status->mactime)) { +diff --git a/drivers/regulator/rn5t618-regulator.c b/drivers/regulator/rn5t618-regulator.c +index b85ceb8ff911..eccdddcf5315 100644 +--- a/drivers/regulator/rn5t618-regulator.c ++++ b/drivers/regulator/rn5t618-regulator.c +@@ -95,6 +95,7 @@ static struct platform_driver rn5t618_regulator_driver = { + + module_platform_driver(rn5t618_regulator_driver); + ++MODULE_ALIAS("platform:rn5t618-regulator"); + MODULE_AUTHOR("Beniamino Galvani "); + MODULE_DESCRIPTION("RN5T618 regulator driver"); + MODULE_LICENSE("GPL v2"); +diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c +index 60de66252fa2..b200edc665a5 100644 +--- a/drivers/scsi/libsas/sas_discover.c ++++ b/drivers/scsi/libsas/sas_discover.c +@@ -97,12 +97,21 @@ static int sas_get_port_device(struct asd_sas_port *port) + else + dev->dev_type = SAS_SATA_DEV; + dev->tproto = SAS_PROTOCOL_SATA; +- } else { ++ } else if (port->oob_mode == SAS_OOB_MODE) { + struct sas_identify_frame *id = + (struct sas_identify_frame *) dev->frame_rcvd; + dev->dev_type = id->dev_type; + dev->iproto = id->initiator_bits; + dev->tproto = id->target_bits; ++ } else { ++ /* If the oob mode is OOB_NOT_CONNECTED, the port is ++ * disconnected due to race with PHY down. We cannot ++ * continue to discover this port ++ */ ++ sas_put_device(dev); ++ pr_warn("Port %016llx is disconnected when discovering\n", ++ SAS_ADDR(port->attached_sas_addr)); ++ return -ENODEV; + } + + sas_init_dev(dev); +diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c +index 05dcc2abd541..99f06ac7bf4c 100644 +--- a/drivers/scsi/lpfc/lpfc_bsg.c ++++ b/drivers/scsi/lpfc/lpfc_bsg.c +@@ -4352,12 +4352,6 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct fc_bsg_job *job, + phba->mbox_ext_buf_ctx.seqNum++; + nemb_tp = phba->mbox_ext_buf_ctx.nembType; + +- dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL); +- if (!dd_data) { +- rc = -ENOMEM; +- goto job_error; +- } +- + pbuf = (uint8_t *)dmabuf->virt; + size = job->request_payload.payload_len; + sg_copy_to_buffer(job->request_payload.sg_list, +@@ -4394,6 +4388,13 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct fc_bsg_job *job, + "2968 SLI_CONFIG ext-buffer wr all %d " + "ebuffers received\n", + phba->mbox_ext_buf_ctx.numBuf); ++ ++ dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL); ++ if (!dd_data) { ++ rc = -ENOMEM; ++ goto job_error; ++ } ++ + /* mailbox command structure for base driver */ + pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); + if (!pmboxq) { +@@ -4441,6 +4442,8 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct fc_bsg_job *job, + return SLI_CONFIG_HANDLED; + + job_error: ++ if (pmboxq) ++ mempool_free(pmboxq, phba->mbox_mem_pool); + lpfc_bsg_dma_page_free(phba, dmabuf); + kfree(dd_data); + +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 440d79e6aea5..dc7cef6ff829 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -966,8 +966,6 @@ global_port_update: + ql_dbg(ql_dbg_async, vha, 0x5011, + "Asynchronous PORT UPDATE ignored %04x/%04x/%04x.\n", + mb[1], mb[2], mb[3]); +- +- qlt_async_event(mb[0], vha, mb); + break; + } + +@@ -988,8 +986,6 @@ global_port_update: + set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags); + set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags); + set_bit(VP_CONFIG_OK, &vha->vp_flags); +- +- qlt_async_event(mb[0], vha, mb); + break; + + case MBA_RSCN_UPDATE: /* State Change Registration */ +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index d220b4f691c7..f714d5f917d1 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -4285,7 +4285,6 @@ static int qla4xxx_mem_alloc(struct scsi_qla_host *ha) + return QLA_SUCCESS; + + mem_alloc_error_exit: +- qla4xxx_mem_free(ha); + return QLA_ERROR; + } + +diff --git a/drivers/tty/hvc/hvc_vio.c b/drivers/tty/hvc/hvc_vio.c +index f575a9b5ede7..1d671d058dcb 100644 +--- a/drivers/tty/hvc/hvc_vio.c ++++ b/drivers/tty/hvc/hvc_vio.c +@@ -122,6 +122,14 @@ static int hvterm_raw_get_chars(uint32_t vtermno, char *buf, int count) + return got; + } + ++/** ++ * hvterm_raw_put_chars: send characters to firmware for given vterm adapter ++ * @vtermno: The virtual terminal number. ++ * @buf: The characters to send. Because of the underlying hypercall in ++ * hvc_put_chars(), this buffer must be at least 16 bytes long, even if ++ * you are sending fewer chars. ++ * @count: number of chars to send. ++ */ + static int hvterm_raw_put_chars(uint32_t vtermno, const char *buf, int count) + { + struct hvterm_priv *pv = hvterm_privs[vtermno]; +@@ -234,6 +242,7 @@ static const struct hv_ops hvterm_hvsi_ops = { + static void udbg_hvc_putc(char c) + { + int count = -1; ++ unsigned char bounce_buffer[16]; + + if (!hvterm_privs[0]) + return; +@@ -244,7 +253,12 @@ static void udbg_hvc_putc(char c) + do { + switch(hvterm_privs[0]->proto) { + case HV_PROTOCOL_RAW: +- count = hvterm_raw_put_chars(0, &c, 1); ++ /* ++ * hvterm_raw_put_chars requires at least a 16-byte ++ * buffer, so go via the bounce buffer ++ */ ++ bounce_buffer[0] = c; ++ count = hvterm_raw_put_chars(0, bounce_buffer, 1); + break; + case HV_PROTOCOL_HVSI: + count = hvterm_hvsi_put_chars(0, &c, 1); +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index 03cac2183579..1a4df5005aec 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -1381,6 +1381,7 @@ static void __msm_console_write(struct uart_port *port, const char *s, + int num_newlines = 0; + bool replaced = false; + void __iomem *tf; ++ int locked = 1; + + if (is_uartdm) + tf = port->membase + UARTDM_TF; +@@ -1393,7 +1394,13 @@ static void __msm_console_write(struct uart_port *port, const char *s, + num_newlines++; + count += num_newlines; + +- spin_lock(&port->lock); ++ if (port->sysrq) ++ locked = 0; ++ else if (oops_in_progress) ++ locked = spin_trylock(&port->lock); ++ else ++ spin_lock(&port->lock); ++ + if (is_uartdm) + msm_reset_dm_count(port, count); + +@@ -1429,7 +1436,9 @@ static void __msm_console_write(struct uart_port *port, const char *s, + iowrite32_rep(tf, buf, 1); + i += num_chars; + } +- spin_unlock(&port->lock); ++ ++ if (locked) ++ spin_unlock(&port->lock); + } + + static void msm_console_write(struct console *co, const char *s, +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index cbd064fae23b..d650ce3bc556 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -169,9 +169,58 @@ static const unsigned short super_speed_maxpacket_maxes[4] = { + [USB_ENDPOINT_XFER_INT] = 1024, + }; + +-static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, +- int asnum, struct usb_host_interface *ifp, int num_ep, +- unsigned char *buffer, int size) ++static bool endpoint_is_duplicate(struct usb_endpoint_descriptor *e1, ++ struct usb_endpoint_descriptor *e2) ++{ ++ if (e1->bEndpointAddress == e2->bEndpointAddress) ++ return true; ++ ++ if (usb_endpoint_xfer_control(e1) || usb_endpoint_xfer_control(e2)) { ++ if (usb_endpoint_num(e1) == usb_endpoint_num(e2)) ++ return true; ++ } ++ ++ return false; ++} ++ ++/* ++ * Check for duplicate endpoint addresses in other interfaces and in the ++ * altsetting currently being parsed. ++ */ ++static bool config_endpoint_is_duplicate(struct usb_host_config *config, ++ int inum, int asnum, struct usb_endpoint_descriptor *d) ++{ ++ struct usb_endpoint_descriptor *epd; ++ struct usb_interface_cache *intfc; ++ struct usb_host_interface *alt; ++ int i, j, k; ++ ++ for (i = 0; i < config->desc.bNumInterfaces; ++i) { ++ intfc = config->intf_cache[i]; ++ ++ for (j = 0; j < intfc->num_altsetting; ++j) { ++ alt = &intfc->altsetting[j]; ++ ++ if (alt->desc.bInterfaceNumber == inum && ++ alt->desc.bAlternateSetting != asnum) ++ continue; ++ ++ for (k = 0; k < alt->desc.bNumEndpoints; ++k) { ++ epd = &alt->endpoint[k].desc; ++ ++ if (endpoint_is_duplicate(epd, d)) ++ return true; ++ } ++ } ++ } ++ ++ return false; ++} ++ ++static int usb_parse_endpoint(struct device *ddev, int cfgno, ++ struct usb_host_config *config, int inum, int asnum, ++ struct usb_host_interface *ifp, int num_ep, ++ unsigned char *buffer, int size) + { + unsigned char *buffer0 = buffer; + struct usb_endpoint_descriptor *d; +@@ -208,13 +257,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, + goto skip_to_next_endpoint_or_interface_descriptor; + + /* Check for duplicate endpoint addresses */ +- for (i = 0; i < ifp->desc.bNumEndpoints; ++i) { +- if (ifp->endpoint[i].desc.bEndpointAddress == +- d->bEndpointAddress) { +- dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", +- cfgno, inum, asnum, d->bEndpointAddress); +- goto skip_to_next_endpoint_or_interface_descriptor; +- } ++ if (config_endpoint_is_duplicate(config, inum, asnum, d)) { ++ dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", ++ cfgno, inum, asnum, d->bEndpointAddress); ++ goto skip_to_next_endpoint_or_interface_descriptor; + } + + endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; +@@ -488,8 +534,8 @@ static int usb_parse_interface(struct device *ddev, int cfgno, + if (((struct usb_descriptor_header *) buffer)->bDescriptorType + == USB_DT_INTERFACE) + break; +- retval = usb_parse_endpoint(ddev, cfgno, inum, asnum, alt, +- num_ep, buffer, size); ++ retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum, ++ alt, num_ep, buffer, size); + if (retval < 0) + return retval; + ++n; +diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c +index 7ad60ee41914..4ce19b860289 100644 +--- a/drivers/usb/gadget/function/f_ecm.c ++++ b/drivers/usb/gadget/function/f_ecm.c +@@ -625,8 +625,12 @@ static void ecm_disable(struct usb_function *f) + + DBG(cdev, "ecm deactivated\n"); + +- if (ecm->port.in_ep->enabled) ++ if (ecm->port.in_ep->enabled) { + gether_disconnect(&ecm->port); ++ } else { ++ ecm->port.in_ep->desc = NULL; ++ ecm->port.out_ep->desc = NULL; ++ } + + usb_ep_disable(ecm->notify); + ecm->notify->desc = NULL; +diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c +index e587767e374c..e281af92e084 100644 +--- a/drivers/usb/gadget/function/f_rndis.c ++++ b/drivers/usb/gadget/function/f_rndis.c +@@ -619,6 +619,7 @@ static void rndis_disable(struct usb_function *f) + gether_disconnect(&rndis->port); + + usb_ep_disable(rndis->notify); ++ rndis->notify->desc = NULL; + } + + /*-------------------------------------------------------------------------*/ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 084332a5855e..2d302ff62cc1 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1167,6 +1167,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff), /* Telit ME910G1 */ ++ .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index cfab1d24e4bc..1c789056e7e8 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -392,7 +392,8 @@ static struct notifier_block xen_memory_nb = { + #else + static enum bp_state reserve_additional_memory(void) + { +- balloon_stats.target_pages = balloon_stats.current_pages; ++ balloon_stats.target_pages = balloon_stats.current_pages + ++ balloon_stats.target_unpopulated; + return BP_ECANCELED; + } + #endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */ +diff --git a/fs/locks.c b/fs/locks.c +index b515e65f1376..2c8e1e429cf7 100644 +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -2599,7 +2599,7 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl, + } + if (inode) { + /* userspace relies on this representation of dev_t */ +- seq_printf(f, "%d %02x:%02x:%ld ", fl_pid, ++ seq_printf(f, "%d %02x:%02x:%lu ", fl_pid, + MAJOR(inode->i_sb->s_dev), + MINOR(inode->i_sb->s_dev), inode->i_ino); + } else { +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index 59d93acc29c7..fa0e89edb62d 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -319,6 +319,17 @@ static int notrace ramoops_pstore_write_buf(enum pstore_type_id type, + + prz = cxt->przs[cxt->dump_write_cnt]; + ++ /* ++ * Since this is a new crash dump, we need to reset the buffer in ++ * case it still has an old dump present. Without this, the new dump ++ * will get appended, which would seriously confuse anything trying ++ * to check dump file contents. Specifically, ramoops_read_kmsg_hdr() ++ * expects to find a dump header in the beginning of buffer data, so ++ * we must to reset the buffer values, in order to ensure that the ++ * header will be written to the beginning of the buffer. ++ */ ++ persistent_ram_zap(prz); ++ + hlen = ramoops_write_kmsg_hdr(prz, compressed); + if (size + hlen > prz->buffer_size) + size = prz->buffer_size - hlen; +diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c +index 73b725f965eb..065aa4752607 100644 +--- a/fs/xfs/xfs_log.c ++++ b/fs/xfs/xfs_log.c +@@ -1503,6 +1503,8 @@ out_free_iclog: + if (iclog->ic_bp) + xfs_buf_free(iclog->ic_bp); + kmem_free(iclog); ++ if (prev_iclog == log->l_iclog) ++ break; + } + spinlock_destroy(&log->l_icloglock); + xfs_buf_free(log->l_xbuf); +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index a16d1851cfb1..f1bd19c69fec 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -1207,8 +1207,11 @@ static inline int dma_get_slave_caps(struct dma_chan *chan, + static inline int dmaengine_desc_set_reuse(struct dma_async_tx_descriptor *tx) + { + struct dma_slave_caps caps; ++ int ret; + +- dma_get_slave_caps(tx->chan, &caps); ++ ret = dma_get_slave_caps(tx->chan, &caps); ++ if (ret) ++ return ret; + + if (caps.descriptor_reuse) { + tx->flags |= DMA_CTRL_REUSE; +diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h +index d5569734f672..676cf8d0acca 100644 +--- a/include/linux/if_ether.h ++++ b/include/linux/if_ether.h +@@ -28,6 +28,14 @@ static inline struct ethhdr *eth_hdr(const struct sk_buff *skb) + return (struct ethhdr *)skb_mac_header(skb); + } + ++/* Prefer this version in TX path, instead of ++ * skb_reset_mac_header() + eth_hdr() ++ */ ++static inline struct ethhdr *skb_eth_hdr(const struct sk_buff *skb) ++{ ++ return (struct ethhdr *)skb->data; ++} ++ + int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr); + + extern ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len); +diff --git a/include/net/neighbour.h b/include/net/neighbour.h +index 1c0d07376125..a68a460fa4f3 100644 +--- a/include/net/neighbour.h ++++ b/include/net/neighbour.h +@@ -454,7 +454,7 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb + + do { + seq = read_seqbegin(&hh->hh_lock); +- hh_len = hh->hh_len; ++ hh_len = READ_ONCE(hh->hh_len); + if (likely(hh_len <= HH_DATA_MOD)) { + hh_alen = HH_DATA_MOD; + +diff --git a/include/uapi/linux/netfilter/xt_sctp.h b/include/uapi/linux/netfilter/xt_sctp.h +index 29287be696a2..788b77c347a0 100644 +--- a/include/uapi/linux/netfilter/xt_sctp.h ++++ b/include/uapi/linux/netfilter/xt_sctp.h +@@ -40,19 +40,19 @@ struct xt_sctp_info { + #define SCTP_CHUNKMAP_SET(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] |= \ +- 1 << (type % bytes(__u32)); \ ++ 1u << (type % bytes(__u32)); \ + } while (0) + + #define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] &= \ +- ~(1 << (type % bytes(__u32))); \ ++ ~(1u << (type % bytes(__u32))); \ + } while (0) + + #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \ + ({ \ + ((chunkmap)[type / bytes (__u32)] & \ +- (1 << (type % bytes (__u32)))) ? 1: 0; \ ++ (1u << (type % bytes (__u32)))) ? 1: 0; \ + }) + + #define SCTP_CHUNKMAP_RESET(chunkmap) \ +diff --git a/kernel/locking/spinlock_debug.c b/kernel/locking/spinlock_debug.c +index 0374a596cffa..95e610e3f7ef 100644 +--- a/kernel/locking/spinlock_debug.c ++++ b/kernel/locking/spinlock_debug.c +@@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init); + + static void spin_dump(raw_spinlock_t *lock, const char *msg) + { +- struct task_struct *owner = NULL; ++ struct task_struct *owner = READ_ONCE(lock->owner); + +- if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT) +- owner = lock->owner; ++ if (owner == SPINLOCK_OWNER_INIT) ++ owner = NULL; + printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n", + msg, raw_smp_processor_id(), + current->comm, task_pid_nr(current)); + printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, " + ".owner_cpu: %d\n", +- lock, lock->magic, ++ lock, READ_ONCE(lock->magic), + owner ? owner->comm : "", + owner ? task_pid_nr(owner) : -1, +- lock->owner_cpu); ++ READ_ONCE(lock->owner_cpu)); + dump_stack(); + } + +@@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *lock, const char *msg) + static inline void + debug_spin_lock_before(raw_spinlock_t *lock) + { +- SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic"); +- SPIN_BUG_ON(lock->owner == current, lock, "recursion"); +- SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(), ++ SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic"); ++ SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion"); ++ SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(), + lock, "cpu recursion"); + } + + static inline void debug_spin_lock_after(raw_spinlock_t *lock) + { +- lock->owner_cpu = raw_smp_processor_id(); +- lock->owner = current; ++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); ++ WRITE_ONCE(lock->owner, current); + } + + static inline void debug_spin_unlock(raw_spinlock_t *lock) +@@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw_spinlock_t *lock) + SPIN_BUG_ON(lock->owner != current, lock, "wrong owner"); + SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), + lock, "wrong CPU"); +- lock->owner = SPINLOCK_OWNER_INIT; +- lock->owner_cpu = -1; ++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); ++ WRITE_ONCE(lock->owner_cpu, -1); + } + + static void __spin_lock_debug(raw_spinlock_t *lock) +@@ -233,8 +233,8 @@ static inline void debug_write_lock_before(rwlock_t *lock) + + static inline void debug_write_lock_after(rwlock_t *lock) + { +- lock->owner_cpu = raw_smp_processor_id(); +- lock->owner = current; ++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); ++ WRITE_ONCE(lock->owner, current); + } + + static inline void debug_write_unlock(rwlock_t *lock) +@@ -243,8 +243,8 @@ static inline void debug_write_unlock(rwlock_t *lock) + RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner"); + RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), + lock, "wrong CPU"); +- lock->owner = SPINLOCK_OWNER_INIT; +- lock->owner_cpu = -1; ++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); ++ WRITE_ONCE(lock->owner_cpu, -1); + } + + #if 0 /* This can cause lockups */ +diff --git a/kernel/taskstats.c b/kernel/taskstats.c +index 21f82c29c914..0737a50380d7 100644 +--- a/kernel/taskstats.c ++++ b/kernel/taskstats.c +@@ -582,25 +582,33 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info) + static struct taskstats *taskstats_tgid_alloc(struct task_struct *tsk) + { + struct signal_struct *sig = tsk->signal; +- struct taskstats *stats; ++ struct taskstats *stats_new, *stats; + +- if (sig->stats || thread_group_empty(tsk)) +- goto ret; ++ /* Pairs with smp_store_release() below. */ ++ stats = smp_load_acquire(&sig->stats); ++ if (stats || thread_group_empty(tsk)) ++ return stats; + + /* No problem if kmem_cache_zalloc() fails */ +- stats = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL); ++ stats_new = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL); + + spin_lock_irq(&tsk->sighand->siglock); +- if (!sig->stats) { +- sig->stats = stats; +- stats = NULL; ++ stats = sig->stats; ++ if (!stats) { ++ /* ++ * Pairs with smp_store_release() above and order the ++ * kmem_cache_zalloc(). ++ */ ++ smp_store_release(&sig->stats, stats_new); ++ stats = stats_new; ++ stats_new = NULL; + } + spin_unlock_irq(&tsk->sighand->siglock); + +- if (stats) +- kmem_cache_free(taskstats_cache, stats); +-ret: +- return sig->stats; ++ if (stats_new) ++ kmem_cache_free(taskstats_cache, stats_new); ++ ++ return stats; + } + + /* Send pid data out on exit */ +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 6380ec0453e0..e4c6f89b6b11 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -637,8 +637,7 @@ static int function_stat_show(struct seq_file *m, void *v) + } + + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +- avg = rec->time; +- do_div(avg, rec->counter); ++ avg = div64_ul(rec->time, rec->counter); + if (tracing_thresh && (avg < tracing_thresh)) + goto out; + #endif +@@ -664,7 +663,8 @@ static int function_stat_show(struct seq_file *m, void *v) + * Divide only 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide 1000 again. + */ +- do_div(stddev, rec->counter * (rec->counter - 1) * 1000); ++ stddev = div64_ul(stddev, ++ rec->counter * (rec->counter - 1) * 1000); + } + + trace_seq_init(&s); +diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h +index cc1557978066..ecdfeaafba9c 100644 +--- a/net/8021q/vlan.h ++++ b/net/8021q/vlan.h +@@ -109,6 +109,7 @@ int vlan_check_real_dev(struct net_device *real_dev, + void vlan_setup(struct net_device *dev); + int register_vlan_dev(struct net_device *dev); + void unregister_vlan_dev(struct net_device *dev, struct list_head *head); ++void vlan_dev_uninit(struct net_device *dev); + bool vlan_dev_inherit_address(struct net_device *dev, + struct net_device *real_dev); + +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index 5139c4ebb96b..22f4e5292278 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -606,7 +606,8 @@ static int vlan_dev_init(struct net_device *dev) + return 0; + } + +-static void vlan_dev_uninit(struct net_device *dev) ++/* Note: this function might be called multiple times for the same device. */ ++void vlan_dev_uninit(struct net_device *dev) + { + struct vlan_priority_tci_mapping *pm; + struct vlan_dev_priv *vlan = vlan_dev_priv(dev); +diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c +index c92b52f37d38..7c95a16c1cef 100644 +--- a/net/8021q/vlan_netlink.c ++++ b/net/8021q/vlan_netlink.c +@@ -92,11 +92,13 @@ static int vlan_changelink(struct net_device *dev, + struct ifla_vlan_flags *flags; + struct ifla_vlan_qos_mapping *m; + struct nlattr *attr; +- int rem; ++ int rem, err; + + if (data[IFLA_VLAN_FLAGS]) { + flags = nla_data(data[IFLA_VLAN_FLAGS]); +- vlan_dev_change_flags(dev, flags->flags, flags->mask); ++ err = vlan_dev_change_flags(dev, flags->flags, flags->mask); ++ if (err) ++ return err; + } + if (data[IFLA_VLAN_INGRESS_QOS]) { + nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) { +@@ -107,7 +109,9 @@ static int vlan_changelink(struct net_device *dev, + if (data[IFLA_VLAN_EGRESS_QOS]) { + nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) { + m = nla_data(attr); +- vlan_dev_set_egress_priority(dev, m->from, m->to); ++ err = vlan_dev_set_egress_priority(dev, m->from, m->to); ++ if (err) ++ return err; + } + } + return 0; +@@ -150,10 +154,11 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev, + return -EINVAL; + + err = vlan_changelink(dev, tb, data); +- if (err < 0) +- return err; +- +- return register_vlan_dev(dev); ++ if (!err) ++ err = register_vlan_dev(dev); ++ if (err) ++ vlan_dev_uninit(dev); ++ return err; + } + + static inline size_t vlan_qos_map_size(unsigned int n) +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 302c3bacb024..0e31bbe1256c 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4897,10 +4897,8 @@ void __l2cap_physical_cfm(struct l2cap_chan *chan, int result) + BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d", + chan, result, local_amp_id, remote_amp_id); + +- if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) { +- l2cap_chan_unlock(chan); ++ if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) + return; +- } + + if (chan->state != BT_CONNECTED) { + l2cap_do_create(chan, result, local_amp_id, remote_amp_id); +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 8aef689b8f32..af1ecd0e7b07 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -1058,7 +1058,7 @@ static void neigh_update_hhs(struct neighbour *neigh) + + if (update) { + hh = &neigh->hh; +- if (hh->hh_len) { ++ if (READ_ONCE(hh->hh_len)) { + write_seqlock_bh(&hh->hh_lock); + update(hh, neigh->dev, neigh->ha); + write_sequnlock_bh(&hh->hh_lock); +@@ -1323,7 +1323,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb) + struct net_device *dev = neigh->dev; + unsigned int seq; + +- if (dev->header_ops->cache && !neigh->hh.hh_len) ++ if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len)) + neigh_hh_init(neigh); + + do { +diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c +index 52dcd414c2af..3f51b4e590b1 100644 +--- a/net/ethernet/eth.c ++++ b/net/ethernet/eth.c +@@ -235,7 +235,12 @@ int eth_header_cache(const struct neighbour *neigh, struct hh_cache *hh, __be16 + eth->h_proto = type; + memcpy(eth->h_source, dev->dev_addr, ETH_ALEN); + memcpy(eth->h_dest, neigh->ha, ETH_ALEN); +- hh->hh_len = ETH_HLEN; ++ ++ /* Pairs with READ_ONCE() in neigh_resolve_output(), ++ * neigh_hh_output() and neigh_update_hhs(). ++ */ ++ smp_store_release(&hh->hh_len, ETH_HLEN); ++ + return 0; + } + EXPORT_SYMBOL(eth_header_cache); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index b0677b265b48..1abf88aec19d 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -1685,8 +1685,11 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb, + } + + /* Ignore very old stuff early */ +- if (!after(sp[used_sacks].end_seq, prior_snd_una)) ++ if (!after(sp[used_sacks].end_seq, prior_snd_una)) { ++ if (i == 0) ++ first_sack_index = -1; + continue; ++ } + + used_sacks++; + } +diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c +index 204a8351efff..c29170e767a8 100644 +--- a/net/llc/llc_station.c ++++ b/net/llc/llc_station.c +@@ -32,7 +32,7 @@ static int llc_stat_ev_rx_null_dsap_xid_c(struct sk_buff *skb) + return LLC_PDU_IS_CMD(pdu) && /* command PDU */ + LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ + LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID && +- !pdu->dsap ? 0 : 1; /* NULL DSAP value */ ++ !pdu->dsap; /* NULL DSAP value */ + } + + static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) +@@ -42,7 +42,7 @@ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) + return LLC_PDU_IS_CMD(pdu) && /* command PDU */ + LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ + LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST && +- !pdu->dsap ? 0 : 1; /* NULL DSAP */ ++ !pdu->dsap; /* NULL DSAP */ + } + + static int llc_station_ac_send_xid_r(struct sk_buff *skb) +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 3a24c01cb909..f324a1124418 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -3390,6 +3390,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list) + + list_for_each_entry(net, net_exit_list, exit_list) + ctnetlink_net_exit(net); ++ ++ /* wait for other cpus until they are done with ctnl_notifiers */ ++ synchronize_rcu(); + } + + static struct pernet_operations ctnetlink_net_ops = { +diff --git a/net/rfkill/core.c b/net/rfkill/core.c +index cf5b69ab1829..ad927a6ca2a1 100644 +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -941,10 +941,13 @@ static void rfkill_sync_work(struct work_struct *work) + int __must_check rfkill_register(struct rfkill *rfkill) + { + static unsigned long rfkill_no; +- struct device *dev = &rfkill->dev; ++ struct device *dev; + int error; + +- BUG_ON(!rfkill); ++ if (!rfkill) ++ return -EINVAL; ++ ++ dev = &rfkill->dev; + + mutex_lock(&rfkill_global_mutex); + +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 117ed90c5f21..fb99872ef426 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -706,7 +706,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt) + if (tb[TCA_FQ_QUANTUM]) { + u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]); + +- if (quantum > 0) ++ if (quantum > 0 && quantum <= (1 << 20)) + q->quantum = quantum; + else + err = -EINVAL; +diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c +index 7c220e905168..8e2e10d12728 100644 +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -1333,8 +1333,10 @@ static int sctp_cmd_interpreter(sctp_event_t event_type, + /* Generate an INIT ACK chunk. */ + new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC, + 0); +- if (!new_obj) +- goto nomem; ++ if (!new_obj) { ++ error = -ENOMEM; ++ break; ++ } + + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, + SCTP_CHUNK(new_obj)); +@@ -1356,7 +1358,8 @@ static int sctp_cmd_interpreter(sctp_event_t event_type, + if (!new_obj) { + if (cmd->obj.chunk) + sctp_chunk_free(cmd->obj.chunk); +- goto nomem; ++ error = -ENOMEM; ++ break; + } + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, + SCTP_CHUNK(new_obj)); +@@ -1403,8 +1406,10 @@ static int sctp_cmd_interpreter(sctp_event_t event_type, + + /* Generate a SHUTDOWN chunk. */ + new_obj = sctp_make_shutdown(asoc, chunk); +- if (!new_obj) +- goto nomem; ++ if (!new_obj) { ++ error = -ENOMEM; ++ break; ++ } + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, + SCTP_CHUNK(new_obj)); + break; +@@ -1733,11 +1738,17 @@ static int sctp_cmd_interpreter(sctp_event_t event_type, + break; + } + +- if (error) ++ if (error) { ++ cmd = sctp_next_cmd(commands); ++ while (cmd) { ++ if (cmd->verb == SCTP_CMD_REPLY) ++ sctp_chunk_free(cmd->obj.chunk); ++ cmd = sctp_next_cmd(commands); ++ } + break; ++ } + } + +-out: + /* If this is in response to a received chunk, wait until + * we are done with the packet to open the queue so that we don't + * send multiple packets in response to a single request. +@@ -1748,8 +1759,5 @@ out: + } else if (local_cork) + error = sctp_outq_uncork(&asoc->outqueue); + return error; +-nomem: +- error = -ENOMEM; +- goto out; + } + +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c +index ed29bad1f03a..96420b620963 100644 +--- a/scripts/kconfig/expr.c ++++ b/scripts/kconfig/expr.c +@@ -201,6 +201,13 @@ static int expr_eq(struct expr *e1, struct expr *e2) + { + int res, old_count; + ++ /* ++ * A NULL expr is taken to be yes, but there's also a different way to ++ * represent yes. expr_is_yes() checks for either representation. ++ */ ++ if (!e1 || !e2) ++ return expr_is_yes(e1) && expr_is_yes(e2); ++ + if (e1->type != e2->type) + return 0; + switch (e1->type) { +diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c +index 9d7582c90a95..c67d379cb6d6 100644 +--- a/sound/isa/cs423x/cs4236.c ++++ b/sound/isa/cs423x/cs4236.c +@@ -293,7 +293,8 @@ static int snd_cs423x_pnp_init_mpu(int dev, struct pnp_dev *pdev) + } else { + mpu_port[dev] = pnp_port_start(pdev, 0); + if (mpu_irq[dev] >= 0 && +- pnp_irq_valid(pdev, 0) && pnp_irq(pdev, 0) >= 0) { ++ pnp_irq_valid(pdev, 0) && ++ pnp_irq(pdev, 0) != (resource_size_t)-1) { + mpu_irq[dev] = pnp_irq(pdev, 0); + } else { + mpu_irq[dev] = -1; /* disable interrupt */ +diff --git a/sound/pci/ice1712/ice1724.c b/sound/pci/ice1712/ice1724.c +index 0b22c00642bb..6a1de2cd27bf 100644 +--- a/sound/pci/ice1712/ice1724.c ++++ b/sound/pci/ice1712/ice1724.c +@@ -663,6 +663,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, + unsigned long flags; + unsigned char mclk_change; + unsigned int i, old_rate; ++ bool call_set_rate = false; + + if (rate > ice->hw_rates->list[ice->hw_rates->count - 1]) + return -EINVAL; +@@ -686,7 +687,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, + * setting clock rate for internal clock mode */ + old_rate = ice->get_rate(ice); + if (force || (old_rate != rate)) +- ice->set_rate(ice, rate); ++ call_set_rate = true; + else if (rate == ice->cur_rate) { + spin_unlock_irqrestore(&ice->reg_lock, flags); + return 0; +@@ -694,12 +695,14 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, + } + + ice->cur_rate = rate; ++ spin_unlock_irqrestore(&ice->reg_lock, flags); ++ ++ if (call_set_rate) ++ ice->set_rate(ice, rate); + + /* setting master clock */ + mclk_change = ice->set_mclk(ice, rate); + +- spin_unlock_irqrestore(&ice->reg_lock, flags); +- + if (mclk_change && ice->gpio.i2s_mclk_changed) + ice->gpio.i2s_mclk_changed(ice); + if (ice->gpio.set_pro_rate) +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index a7e79784fc16..4a3ce9b85253 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2792,7 +2792,7 @@ static int fll_factors(struct _fll_div *fll_div, unsigned int Fref, + + if (target % Fref == 0) { + fll_div->theta = 0; +- fll_div->lambda = 0; ++ fll_div->lambda = 1; + } else { + gcd_fll = gcd(target, fratio * Fref); + +@@ -2862,7 +2862,7 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source, + return -EINVAL; + } + +- if (fll_div.theta || fll_div.lambda) ++ if (fll_div.theta) + fll1 |= WM8962_FLL_FRAC; + + /* Stop the FLL while we reconfigure */ +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index 0f7ebac1846b..f256fac1e722 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -285,13 +285,6 @@ static int report__setup_sample_type(struct report *rep) + PERF_SAMPLE_BRANCH_ANY)) + rep->nonany_branch_mode = true; + +-#ifndef HAVE_LIBUNWIND_SUPPORT +- if (dwarf_callchain_users) { +- ui__warning("Please install libunwind development packages " +- "during the perf build.\n"); +- } +-#endif +- + return 0; + } + diff --git a/patch/kernel/rk3399-legacy/patch-4.4.209-210.patch b/patch/kernel/rk3399-legacy/patch-4.4.209-210.patch new file mode 100644 index 0000000000..3a736872e2 --- /dev/null +++ b/patch/kernel/rk3399-legacy/patch-4.4.209-210.patch @@ -0,0 +1,810 @@ +diff --git a/Makefile b/Makefile +index 762f77777e62..c09b55163c2c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 209 ++SUBLEVEL = 210 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index cd707b401b10..2cb924ffd5a3 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -272,7 +272,7 @@ static void drm_dp_encode_sideband_req(struct drm_dp_sideband_msg_req_body *req, + memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes); + idx += req->u.i2c_read.transactions[i].num_bytes; + +- buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5; ++ buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4; + buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf); + idx++; + } +diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c +index 7058f75c7b42..58b6d85c440a 100644 +--- a/drivers/gpu/drm/i915/intel_lrc.c ++++ b/drivers/gpu/drm/i915/intel_lrc.c +@@ -1312,6 +1312,7 @@ static int gen9_init_indirectctx_bb(struct intel_engine_cs *ring, + int ret; + struct drm_device *dev = ring->dev; + uint32_t index = wa_ctx_start(wa_ctx, *offset, CACHELINE_DWORDS); ++ uint32_t scratch_addr; + + /* WaDisableCtxRestoreArbitration:skl,bxt */ + if ((IS_SKYLAKE(dev) && (INTEL_REVID(dev) <= SKL_REVID_D0)) || +@@ -1324,6 +1325,19 @@ static int gen9_init_indirectctx_bb(struct intel_engine_cs *ring, + return ret; + index = ret; + ++ /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */ ++ /* Actual scratch location is at 128 bytes offset */ ++ scratch_addr = ring->scratch.gtt_offset + 2 * CACHELINE_BYTES; ++ wa_ctx_emit(batch, index, GFX_OP_PIPE_CONTROL(6)); ++ wa_ctx_emit(batch, index, (PIPE_CONTROL_FLUSH_L3 | ++ PIPE_CONTROL_GLOBAL_GTT_IVB | ++ PIPE_CONTROL_CS_STALL | ++ PIPE_CONTROL_QW_WRITE)); ++ wa_ctx_emit(batch, index, scratch_addr); ++ wa_ctx_emit(batch, index, 0); ++ wa_ctx_emit(batch, index, 0); ++ wa_ctx_emit(batch, index, 0); ++ + /* Pad to end of cacheline */ + while (index % CACHELINE_DWORDS) + wa_ctx_emit(batch, index, MI_NOOP); +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 7cd945575463..16ff8d3c7cfe 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -269,6 +269,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign + offset = report->size; + report->size += parser->global.report_size * parser->global.report_count; + ++ /* Total size check: Allow for possible report index byte */ ++ if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { ++ hid_err(parser->device, "report is too long\n"); ++ return -1; ++ } ++ + if (!parser->local.usage_index) /* Ignore padding fields */ + return 0; + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index ee3c66c02043..3331bf8ad85e 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -994,9 +994,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + } + + mapped: +- if (device->driver->input_mapped && device->driver->input_mapped(device, +- hidinput, field, usage, &bit, &max) < 0) +- goto ignore; ++ if (device->driver->input_mapped && ++ device->driver->input_mapped(device, hidinput, field, usage, ++ &bit, &max) < 0) { ++ /* ++ * The driver indicated that no further generic handling ++ * of the usage is desired. ++ */ ++ return; ++ } + + set_bit(usage->type, input->evbit); + +@@ -1055,9 +1061,11 @@ mapped: + set_bit(MSC_SCAN, input->mscbit); + } + +-ignore: + return; + ++ignore: ++ usage->type = 0; ++ usage->code = 0; + } + + void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value) +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index f6863adc15ad..ea0c860ee842 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #define UHID_NAME "uhid" + #define UHID_BUFSIZE 32 +@@ -774,7 +775,7 @@ static unsigned int uhid_char_poll(struct file *file, poll_table *wait) + if (uhid->head != uhid->tail) + return POLLIN | POLLRDNORM; + +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static const struct file_operations uhid_fops = { +diff --git a/drivers/input/input.c b/drivers/input/input.c +index 880605959aa6..6d9f58a446fa 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -851,16 +851,18 @@ static int input_default_setkeycode(struct input_dev *dev, + } + } + +- __clear_bit(*old_keycode, dev->keybit); +- __set_bit(ke->keycode, dev->keybit); +- +- for (i = 0; i < dev->keycodemax; i++) { +- if (input_fetch_keycode(dev, i) == *old_keycode) { +- __set_bit(*old_keycode, dev->keybit); +- break; /* Setting the bit twice is useless, so break */ ++ if (*old_keycode <= KEY_MAX) { ++ __clear_bit(*old_keycode, dev->keybit); ++ for (i = 0; i < dev->keycodemax; i++) { ++ if (input_fetch_keycode(dev, i) == *old_keycode) { ++ __set_bit(*old_keycode, dev->keybit); ++ /* Setting the bit twice is useless, so break */ ++ break; ++ } + } + } + ++ __set_bit(ke->keycode, dev->keybit); + return 0; + } + +@@ -916,9 +918,13 @@ int input_set_keycode(struct input_dev *dev, + * Simulate keyup event if keycode is not present + * in the keymap anymore + */ +- if (test_bit(EV_KEY, dev->evbit) && +- !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && +- __test_and_clear_bit(old_keycode, dev->key)) { ++ if (old_keycode > KEY_MAX) { ++ dev_warn(dev->dev.parent ?: &dev->dev, ++ "%s: got too big old keycode %#x\n", ++ __func__, old_keycode); ++ } else if (test_bit(EV_KEY, dev->evbit) && ++ !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && ++ __test_and_clear_bit(old_keycode, dev->key)) { + struct input_value vals[] = { + { EV_KEY, old_keycode, 0 }, + input_value_sync +diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c +index e36b7400d5cc..d57af6a13baf 100644 +--- a/drivers/net/can/mscan/mscan.c ++++ b/drivers/net/can/mscan/mscan.c +@@ -392,13 +392,12 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + struct net_device *dev = napi->dev; + struct mscan_regs __iomem *regs = priv->reg_base; + struct net_device_stats *stats = &dev->stats; +- int npackets = 0; +- int ret = 1; ++ int work_done = 0; + struct sk_buff *skb; + struct can_frame *frame; + u8 canrflg; + +- while (npackets < quota) { ++ while (work_done < quota) { + canrflg = in_8(®s->canrflg); + if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF))) + break; +@@ -419,18 +418,18 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + + stats->rx_packets++; + stats->rx_bytes += frame->can_dlc; +- npackets++; ++ work_done++; + netif_receive_skb(skb); + } + +- if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) { +- napi_complete(&priv->napi); +- clear_bit(F_RX_PROGRESS, &priv->flags); +- if (priv->can.state < CAN_STATE_BUS_OFF) +- out_8(®s->canrier, priv->shadow_canrier); +- ret = 0; ++ if (work_done < quota) { ++ if (likely(napi_complete_done(&priv->napi, work_done))) { ++ clear_bit(F_RX_PROGRESS, &priv->flags); ++ if (priv->can.state < CAN_STATE_BUS_OFF) ++ out_8(®s->canrier, priv->shadow_canrier); ++ } + } +- return ret; ++ return work_done; + } + + static irqreturn_t mscan_isr(int irq, void *dev_id) +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index 6982ab8777b7..3e965b00bc09 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -847,7 +847,7 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id * + GS_USB_BREQ_HOST_FORMAT, + USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + hconf, + sizeof(*hconf), + 1000); +@@ -870,7 +870,7 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id * + GS_USB_BREQ_DEVICE_CONFIG, + USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + dconf, + sizeof(*dconf), + 1000); +diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c +index 4c0a65692899..c410ef92b084 100644 +--- a/drivers/net/wireless/mwifiex/pcie.c ++++ b/drivers/net/wireless/mwifiex/pcie.c +@@ -921,8 +921,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) + } + skb_put(skb, MWIFIEX_UPLD_SIZE); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); + return -1; ++ } + + card->cmdrsp_buf = skb; + +diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c +index 992f9feaea92..a13c6f1712b3 100644 +--- a/drivers/net/wireless/mwifiex/sta_ioctl.c ++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c +@@ -229,6 +229,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv, + "11D: skip setting domain info in FW\n"); + return 0; + } ++ ++ if (country_ie_len > ++ (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "11D: country_ie_len overflow!, deauth AP\n"); ++ return -EINVAL; ++ } ++ + memcpy(priv->adapter->country_code, &country_ie[2], 2); + + domain_info->country_code[0] = country_ie[2]; +@@ -272,7 +280,8 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss, + priv->scan_block = false; + + if (bss) { +- mwifiex_process_country_ie(priv, bss); ++ if (mwifiex_process_country_ie(priv, bss)) ++ return -EINVAL; + + /* Allocate and fill new bss descriptor */ + bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor), +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c +index 52def14d55d3..4d94bb4e95f8 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c +@@ -5135,6 +5135,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) + ret = usb_submit_urb(urb, GFP_KERNEL); + if (ret) { + usb_unanchor_urb(urb); ++ usb_free_urb(urb); + goto error; + } + +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index 6d21bc6a7713..e37ab2425e1a 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -282,8 +282,10 @@ bfad_im_get_stats(struct Scsi_Host *shost) + rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa), + fcstats, bfad_hcb_comp, &fcomp); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); +- if (rc != BFA_STATUS_OK) ++ if (rc != BFA_STATUS_OK) { ++ kfree(fcstats); + return NULL; ++ } + + wait_for_completion(&fcomp.comp); + +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index 5c802c2cb984..f7ed06a1a22e 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -49,6 +49,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { + {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ + {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ ++ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ + {} /* Terminating entry */ +diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h +index dec36f296f3d..ba362a883016 100644 +--- a/drivers/staging/vt6656/device.h ++++ b/drivers/staging/vt6656/device.h +@@ -272,6 +272,7 @@ struct vnt_private { + u8 mac_hw; + /* netdev */ + struct usb_device *usb; ++ struct usb_interface *intf; + + u64 tsf_time; + u8 rx_rate; +diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c +index f35ee85f61b5..668fcd3a0bfe 100644 +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -979,6 +979,7 @@ vt6656_probe(struct usb_interface *intf, const struct usb_device_id *id) + priv = hw->priv; + priv->hw = hw; + priv->usb = udev; ++ priv->intf = intf; + + vnt_set_options(priv); + +diff --git a/drivers/staging/vt6656/wcmd.c b/drivers/staging/vt6656/wcmd.c +index 3cbf4791bac1..de541b85f8a5 100644 +--- a/drivers/staging/vt6656/wcmd.c ++++ b/drivers/staging/vt6656/wcmd.c +@@ -113,6 +113,7 @@ void vnt_run_command(struct work_struct *work) + if (vnt_init(priv)) { + /* If fail all ends TODO retry */ + dev_err(&priv->usb->dev, "failed to start\n"); ++ usb_set_intfdata(priv->intf, NULL); + ieee80211_free_hw(priv->hw); + return; + } +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 54122db81de4..013fb874c64e 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2702,6 +2702,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport) + if (uport->cons && uport->dev) + of_console_check(uport->dev->of_node, uport->cons->name, uport->line); + ++ tty_port_link_device(port, drv->tty_driver, uport->line); + uart_configure_port(drv, state, uport); + + num_groups = 2; +diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c +index 3d24304405b3..496788584034 100644 +--- a/drivers/usb/chipidea/host.c ++++ b/drivers/usb/chipidea/host.c +@@ -37,6 +37,7 @@ static int (*orig_bus_suspend)(struct usb_hcd *hcd); + + struct ehci_ci_priv { + struct regulator *reg_vbus; ++ bool enabled; + }; + + static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) +@@ -48,7 +49,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + int ret = 0; + int port = HCS_N_PORTS(ehci->hcs_params); + +- if (priv->reg_vbus) { ++ if (priv->reg_vbus && enable != priv->enabled) { + if (port > 1) { + dev_warn(dev, + "Not support multi-port regulator control\n"); +@@ -64,6 +65,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + enable ? "enable" : "disable", ret); + return ret; + } ++ priv->enabled = enable; + } + + if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) { +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index d650ce3bc556..570a76d91250 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -358,12 +358,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, + endpoint->desc.wMaxPacketSize = cpu_to_le16(8); + } + +- /* Validate the wMaxPacketSize field */ ++ /* ++ * Validate the wMaxPacketSize field. ++ * Some devices have isochronous endpoints in altsetting 0; ++ * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 ++ * (see the end of section 5.6.3), so don't warn about them. ++ */ + maxp = usb_endpoint_maxp(&endpoint->desc); +- if (maxp == 0) { +- dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n", ++ if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { ++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", + cfgno, inum, asnum, d->bEndpointAddress); +- goto skip_to_next_endpoint_or_interface_descriptor; + } + + /* Find the highest legal maxpacket size for this endpoint */ +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index 3a81b4c4d0dd..c4e26f9f4ec5 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -2132,6 +2132,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl) + musb_platform_disable(musb); + musb_generic_disable(musb); + ++ /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */ ++ musb_writeb(musb->mregs, MUSB_POWER, 0); ++ + /* Init IRQ workqueue before request_irq */ + INIT_WORK(&musb->irq_work, musb_irq_work); + INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset); +diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c +index 7539c3188ffc..ffcc704165f7 100644 +--- a/drivers/usb/musb/musbhsdma.c ++++ b/drivers/usb/musb/musbhsdma.c +@@ -398,7 +398,7 @@ struct dma_controller *musbhs_dma_controller_create(struct musb *musb, + controller->controller.channel_abort = dma_channel_abort; + + if (request_irq(irq, dma_controller_irq, 0, +- dev_name(musb->controller), &controller->controller)) { ++ dev_name(musb->controller), controller)) { + dev_err(dev, "request_irq %d failed!\n", irq); + musb_dma_controller_destroy(&controller->controller); + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 2d302ff62cc1..5ea4cd10abc7 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -566,6 +566,9 @@ static void option_instat_callback(struct urb *urb); + /* Interface is reserved */ + #define RSVD(ifnum) ((BIT(ifnum) & 0xff) << 0) + ++/* Device needs ZLP */ ++#define ZLP BIT(17) ++ + + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, +@@ -1193,6 +1196,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, +@@ -2097,6 +2102,9 @@ static int option_attach(struct usb_serial *serial) + if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) + data->use_send_setup = 1; + ++ if (device_flags & ZLP) ++ data->use_zlp = 1; ++ + spin_lock_init(&data->susp_lock); + + usb_set_serial_data(serial, data); +diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h +index 44b25c08c68a..1d0e28538346 100644 +--- a/drivers/usb/serial/usb-wwan.h ++++ b/drivers/usb/serial/usb-wwan.h +@@ -35,6 +35,7 @@ struct usb_wwan_intf_private { + spinlock_t susp_lock; + unsigned int suspended:1; + unsigned int use_send_setup:1; ++ unsigned int use_zlp:1; + int in_flight; + unsigned int open_ports; + void *private; +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index be9cb61b4d19..485bad73b6ed 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -495,6 +495,7 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + void (*callback) (struct urb *)) + { + struct usb_serial *serial = port->serial; ++ struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial); + struct urb *urb; + + urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */ +@@ -505,6 +506,9 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + usb_sndbulkpipe(serial->dev, endpoint) | dir, + buf, len, callback, ctx); + ++ if (intfdata->use_zlp && dir == USB_DIR_OUT) ++ urb->transfer_flags |= URB_ZERO_PACKET; ++ + return urb; + } + +diff --git a/fs/char_dev.c b/fs/char_dev.c +index d0655ca89481..f1f3bb812799 100644 +--- a/fs/char_dev.c ++++ b/fs/char_dev.c +@@ -332,7 +332,7 @@ static struct kobject *cdev_get(struct cdev *p) + + if (owner && !try_module_get(owner)) + return NULL; +- kobj = kobject_get(&p->kobj); ++ kobj = kobject_get_unless_zero(&p->kobj); + if (!kobj) + module_put(owner); + return kobj; +diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h +index f7178f44825b..d2a497950639 100644 +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -81,6 +82,36 @@ struct can_priv { + #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC)) + #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC)) + ++/* Check for outgoing skbs that have not been created by the CAN subsystem */ ++static inline bool can_skb_headroom_valid(struct net_device *dev, ++ struct sk_buff *skb) ++{ ++ /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */ ++ if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv))) ++ return false; ++ ++ /* af_packet does not apply CAN skb specific settings */ ++ if (skb->ip_summed == CHECKSUM_NONE) { ++ /* init headroom */ ++ can_skb_prv(skb)->ifindex = dev->ifindex; ++ can_skb_prv(skb)->skbcnt = 0; ++ ++ skb->ip_summed = CHECKSUM_UNNECESSARY; ++ ++ /* preform proper loopback on capable devices */ ++ if (dev->flags & IFF_ECHO) ++ skb->pkt_type = PACKET_LOOPBACK; ++ else ++ skb->pkt_type = PACKET_HOST; ++ ++ skb_reset_mac_header(skb); ++ skb_reset_network_header(skb); ++ skb_reset_transport_header(skb); ++ } ++ ++ return true; ++} ++ + /* Drop a given socketbuffer if it does not contain a valid CAN frame. */ + static inline bool can_dropped_invalid_skb(struct net_device *dev, + struct sk_buff *skb) +@@ -98,6 +129,9 @@ static inline bool can_dropped_invalid_skb(struct net_device *dev, + } else + goto inval_skb; + ++ if (!can_skb_headroom_valid(dev, skb)) ++ goto inval_skb; ++ + return false; + + inval_skb: +diff --git a/include/linux/kobject.h b/include/linux/kobject.h +index 5957c6a3fd7f..d9d4485ebad2 100644 +--- a/include/linux/kobject.h ++++ b/include/linux/kobject.h +@@ -108,6 +108,8 @@ extern int __must_check kobject_rename(struct kobject *, const char *new_name); + extern int __must_check kobject_move(struct kobject *, struct kobject *); + + extern struct kobject *kobject_get(struct kobject *kobj); ++extern struct kobject * __must_check kobject_get_unless_zero( ++ struct kobject *kobj); + extern void kobject_put(struct kobject *kobj); + + extern const void *kobject_namespace(struct kobject *kobj); +diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c +index 9d4399b553a3..6403f45da9d5 100644 +--- a/kernel/trace/trace_sched_wakeup.c ++++ b/kernel/trace/trace_sched_wakeup.c +@@ -625,7 +625,7 @@ static void start_wakeup_tracer(struct trace_array *tr) + if (ret) { + pr_info("wakeup trace: Couldn't activate tracepoint" + " probe to kernel_sched_migrate_task\n"); +- return; ++ goto fail_deprobe_sched_switch; + } + + wakeup_reset(tr); +@@ -643,6 +643,8 @@ static void start_wakeup_tracer(struct trace_array *tr) + printk(KERN_ERR "failed to start wakeup tracer\n"); + + return; ++fail_deprobe_sched_switch: ++ unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); + fail_deprobe_wake_new: + unregister_trace_sched_wakeup_new(probe_wakeup, NULL); + fail_deprobe: +diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c +index 202df6cffcca..f08ec7c6f9e0 100644 +--- a/kernel/trace/trace_stack.c ++++ b/kernel/trace/trace_stack.c +@@ -197,6 +197,11 @@ check_stack(unsigned long ip, unsigned long *stack) + local_irq_restore(flags); + } + ++/* Some archs may not define MCOUNT_INSN_SIZE */ ++#ifndef MCOUNT_INSN_SIZE ++# define MCOUNT_INSN_SIZE 0 ++#endif ++ + static void + stack_trace_call(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *op, struct pt_regs *pt_regs) +diff --git a/lib/kobject.c b/lib/kobject.c +index 35d490b02cdd..cebbe79d2c65 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -599,12 +599,15 @@ struct kobject *kobject_get(struct kobject *kobj) + } + EXPORT_SYMBOL(kobject_get); + +-static struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj) ++struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj) + { ++ if (!kobj) ++ return NULL; + if (!kref_get_unless_zero(&kobj->kref)) + kobj = NULL; + return kobj; + } ++EXPORT_SYMBOL(kobject_get_unless_zero); + + /* + * kobject_cleanup - free kobject resources. +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index cbe630aab44a..574697326ebc 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -488,11 +488,12 @@ next: + return 1; + } + +-static inline int check_target(struct arpt_entry *e, const char *name) ++static int check_target(struct arpt_entry *e, struct net *net, const char *name) + { + struct xt_entry_target *t = arpt_get_target(e); + int ret; + struct xt_tgchk_param par = { ++ .net = net, + .table = name, + .entryinfo = e, + .target = t->u.kernel.target, +@@ -510,8 +511,9 @@ static inline int check_target(struct arpt_entry *e, const char *name) + return 0; + } + +-static inline int +-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, ++static int ++find_check_entry(struct arpt_entry *e, struct net *net, const char *name, ++ unsigned int size, + struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; +@@ -531,7 +533,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, + } + t->u.kernel.target = target; + +- ret = check_target(e, name); ++ ret = check_target(e, net, name); + if (ret) + goto err; + return 0; +@@ -632,7 +634,9 @@ static inline void cleanup_entry(struct arpt_entry *e) + /* Checks and translates the user-supplied table segment (held in + * newinfo). + */ +-static int translate_table(struct xt_table_info *newinfo, void *entry0, ++static int translate_table(struct net *net, ++ struct xt_table_info *newinfo, ++ void *entry0, + const struct arpt_replace *repl) + { + struct xt_percpu_counter_alloc_state alloc_state = { 0 }; +@@ -709,7 +713,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, repl->name, repl->size, ++ ret = find_check_entry(iter, net, repl->name, repl->size, + &alloc_state); + if (ret != 0) + break; +@@ -1114,7 +1118,7 @@ static int do_replace(struct net *net, const void __user *user, + goto free_newinfo; + } + +- ret = translate_table(newinfo, loc_cpu_entry, &tmp); ++ ret = translate_table(net, newinfo, loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1301,7 +1305,8 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr, + } + } + +-static int translate_compat_table(struct xt_table_info **pinfo, ++static int translate_compat_table(struct net *net, ++ struct xt_table_info **pinfo, + void **pentry0, + const struct compat_arpt_replace *compatr) + { +@@ -1371,7 +1376,7 @@ static int translate_compat_table(struct xt_table_info **pinfo, + repl.num_counters = 0; + repl.counters = NULL; + repl.size = newinfo->size; +- ret = translate_table(newinfo, entry1, &repl); ++ ret = translate_table(net, newinfo, entry1, &repl); + if (ret) + goto free_newinfo; + +@@ -1426,7 +1431,7 @@ static int compat_do_replace(struct net *net, void __user *user, + goto free_newinfo; + } + +- ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp); ++ ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1696,7 +1701,7 @@ struct xt_table *arpt_register_table(struct net *net, + loc_cpu_entry = newinfo->entries; + memcpy(loc_cpu_entry, repl->entries, repl->size); + +- ret = translate_table(newinfo, loc_cpu_entry, repl); ++ ret = translate_table(net, newinfo, loc_cpu_entry, repl); + duprintf("arpt_register_table: translate table gives %d\n", ret); + if (ret != 0) + goto out_free; +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index caa26184f7e3..0583e2491770 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -1619,6 +1619,7 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb, + struct ip_set *set; + struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {}; + int ret = 0; ++ u32 lineno; + + if (unlikely(protocol_failed(attr) || + !attr[IPSET_ATTR_SETNAME] || +@@ -1635,7 +1636,7 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb, + return -IPSET_ERR_PROTOCOL; + + rcu_read_lock_bh(); +- ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0); ++ ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0); + rcu_read_unlock_bh(); + /* Userspace can't trigger element to be re-added */ + if (ret == -EAGAIN) +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 9c5368e7ee23..5e50386c8ebb 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1142,6 +1142,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ + case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ + case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ ++ case USB_ID(0x05a7, 0x1020): /* Bose Companion 5 */ + #ifdef CONFIG_HID_RKVR + case USB_ID(0x071B, 0x3205): /* RockChip NanoC VR */ + #endif diff --git a/patch/kernel/rockchip-legacy/patch-4.4.209-210.patch b/patch/kernel/rockchip-legacy/patch-4.4.209-210.patch new file mode 100644 index 0000000000..3a736872e2 --- /dev/null +++ b/patch/kernel/rockchip-legacy/patch-4.4.209-210.patch @@ -0,0 +1,810 @@ +diff --git a/Makefile b/Makefile +index 762f77777e62..c09b55163c2c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 209 ++SUBLEVEL = 210 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index cd707b401b10..2cb924ffd5a3 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -272,7 +272,7 @@ static void drm_dp_encode_sideband_req(struct drm_dp_sideband_msg_req_body *req, + memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes); + idx += req->u.i2c_read.transactions[i].num_bytes; + +- buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5; ++ buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4; + buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf); + idx++; + } +diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c +index 7058f75c7b42..58b6d85c440a 100644 +--- a/drivers/gpu/drm/i915/intel_lrc.c ++++ b/drivers/gpu/drm/i915/intel_lrc.c +@@ -1312,6 +1312,7 @@ static int gen9_init_indirectctx_bb(struct intel_engine_cs *ring, + int ret; + struct drm_device *dev = ring->dev; + uint32_t index = wa_ctx_start(wa_ctx, *offset, CACHELINE_DWORDS); ++ uint32_t scratch_addr; + + /* WaDisableCtxRestoreArbitration:skl,bxt */ + if ((IS_SKYLAKE(dev) && (INTEL_REVID(dev) <= SKL_REVID_D0)) || +@@ -1324,6 +1325,19 @@ static int gen9_init_indirectctx_bb(struct intel_engine_cs *ring, + return ret; + index = ret; + ++ /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */ ++ /* Actual scratch location is at 128 bytes offset */ ++ scratch_addr = ring->scratch.gtt_offset + 2 * CACHELINE_BYTES; ++ wa_ctx_emit(batch, index, GFX_OP_PIPE_CONTROL(6)); ++ wa_ctx_emit(batch, index, (PIPE_CONTROL_FLUSH_L3 | ++ PIPE_CONTROL_GLOBAL_GTT_IVB | ++ PIPE_CONTROL_CS_STALL | ++ PIPE_CONTROL_QW_WRITE)); ++ wa_ctx_emit(batch, index, scratch_addr); ++ wa_ctx_emit(batch, index, 0); ++ wa_ctx_emit(batch, index, 0); ++ wa_ctx_emit(batch, index, 0); ++ + /* Pad to end of cacheline */ + while (index % CACHELINE_DWORDS) + wa_ctx_emit(batch, index, MI_NOOP); +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 7cd945575463..16ff8d3c7cfe 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -269,6 +269,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign + offset = report->size; + report->size += parser->global.report_size * parser->global.report_count; + ++ /* Total size check: Allow for possible report index byte */ ++ if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { ++ hid_err(parser->device, "report is too long\n"); ++ return -1; ++ } ++ + if (!parser->local.usage_index) /* Ignore padding fields */ + return 0; + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index ee3c66c02043..3331bf8ad85e 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -994,9 +994,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + } + + mapped: +- if (device->driver->input_mapped && device->driver->input_mapped(device, +- hidinput, field, usage, &bit, &max) < 0) +- goto ignore; ++ if (device->driver->input_mapped && ++ device->driver->input_mapped(device, hidinput, field, usage, ++ &bit, &max) < 0) { ++ /* ++ * The driver indicated that no further generic handling ++ * of the usage is desired. ++ */ ++ return; ++ } + + set_bit(usage->type, input->evbit); + +@@ -1055,9 +1061,11 @@ mapped: + set_bit(MSC_SCAN, input->mscbit); + } + +-ignore: + return; + ++ignore: ++ usage->type = 0; ++ usage->code = 0; + } + + void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value) +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index f6863adc15ad..ea0c860ee842 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #define UHID_NAME "uhid" + #define UHID_BUFSIZE 32 +@@ -774,7 +775,7 @@ static unsigned int uhid_char_poll(struct file *file, poll_table *wait) + if (uhid->head != uhid->tail) + return POLLIN | POLLRDNORM; + +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static const struct file_operations uhid_fops = { +diff --git a/drivers/input/input.c b/drivers/input/input.c +index 880605959aa6..6d9f58a446fa 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -851,16 +851,18 @@ static int input_default_setkeycode(struct input_dev *dev, + } + } + +- __clear_bit(*old_keycode, dev->keybit); +- __set_bit(ke->keycode, dev->keybit); +- +- for (i = 0; i < dev->keycodemax; i++) { +- if (input_fetch_keycode(dev, i) == *old_keycode) { +- __set_bit(*old_keycode, dev->keybit); +- break; /* Setting the bit twice is useless, so break */ ++ if (*old_keycode <= KEY_MAX) { ++ __clear_bit(*old_keycode, dev->keybit); ++ for (i = 0; i < dev->keycodemax; i++) { ++ if (input_fetch_keycode(dev, i) == *old_keycode) { ++ __set_bit(*old_keycode, dev->keybit); ++ /* Setting the bit twice is useless, so break */ ++ break; ++ } + } + } + ++ __set_bit(ke->keycode, dev->keybit); + return 0; + } + +@@ -916,9 +918,13 @@ int input_set_keycode(struct input_dev *dev, + * Simulate keyup event if keycode is not present + * in the keymap anymore + */ +- if (test_bit(EV_KEY, dev->evbit) && +- !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && +- __test_and_clear_bit(old_keycode, dev->key)) { ++ if (old_keycode > KEY_MAX) { ++ dev_warn(dev->dev.parent ?: &dev->dev, ++ "%s: got too big old keycode %#x\n", ++ __func__, old_keycode); ++ } else if (test_bit(EV_KEY, dev->evbit) && ++ !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && ++ __test_and_clear_bit(old_keycode, dev->key)) { + struct input_value vals[] = { + { EV_KEY, old_keycode, 0 }, + input_value_sync +diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c +index e36b7400d5cc..d57af6a13baf 100644 +--- a/drivers/net/can/mscan/mscan.c ++++ b/drivers/net/can/mscan/mscan.c +@@ -392,13 +392,12 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + struct net_device *dev = napi->dev; + struct mscan_regs __iomem *regs = priv->reg_base; + struct net_device_stats *stats = &dev->stats; +- int npackets = 0; +- int ret = 1; ++ int work_done = 0; + struct sk_buff *skb; + struct can_frame *frame; + u8 canrflg; + +- while (npackets < quota) { ++ while (work_done < quota) { + canrflg = in_8(®s->canrflg); + if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF))) + break; +@@ -419,18 +418,18 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + + stats->rx_packets++; + stats->rx_bytes += frame->can_dlc; +- npackets++; ++ work_done++; + netif_receive_skb(skb); + } + +- if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) { +- napi_complete(&priv->napi); +- clear_bit(F_RX_PROGRESS, &priv->flags); +- if (priv->can.state < CAN_STATE_BUS_OFF) +- out_8(®s->canrier, priv->shadow_canrier); +- ret = 0; ++ if (work_done < quota) { ++ if (likely(napi_complete_done(&priv->napi, work_done))) { ++ clear_bit(F_RX_PROGRESS, &priv->flags); ++ if (priv->can.state < CAN_STATE_BUS_OFF) ++ out_8(®s->canrier, priv->shadow_canrier); ++ } + } +- return ret; ++ return work_done; + } + + static irqreturn_t mscan_isr(int irq, void *dev_id) +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index 6982ab8777b7..3e965b00bc09 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -847,7 +847,7 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id * + GS_USB_BREQ_HOST_FORMAT, + USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + hconf, + sizeof(*hconf), + 1000); +@@ -870,7 +870,7 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id * + GS_USB_BREQ_DEVICE_CONFIG, + USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + dconf, + sizeof(*dconf), + 1000); +diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c +index 4c0a65692899..c410ef92b084 100644 +--- a/drivers/net/wireless/mwifiex/pcie.c ++++ b/drivers/net/wireless/mwifiex/pcie.c +@@ -921,8 +921,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) + } + skb_put(skb, MWIFIEX_UPLD_SIZE); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); + return -1; ++ } + + card->cmdrsp_buf = skb; + +diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c +index 992f9feaea92..a13c6f1712b3 100644 +--- a/drivers/net/wireless/mwifiex/sta_ioctl.c ++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c +@@ -229,6 +229,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv, + "11D: skip setting domain info in FW\n"); + return 0; + } ++ ++ if (country_ie_len > ++ (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "11D: country_ie_len overflow!, deauth AP\n"); ++ return -EINVAL; ++ } ++ + memcpy(priv->adapter->country_code, &country_ie[2], 2); + + domain_info->country_code[0] = country_ie[2]; +@@ -272,7 +280,8 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss, + priv->scan_block = false; + + if (bss) { +- mwifiex_process_country_ie(priv, bss); ++ if (mwifiex_process_country_ie(priv, bss)) ++ return -EINVAL; + + /* Allocate and fill new bss descriptor */ + bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor), +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c +index 52def14d55d3..4d94bb4e95f8 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c +@@ -5135,6 +5135,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) + ret = usb_submit_urb(urb, GFP_KERNEL); + if (ret) { + usb_unanchor_urb(urb); ++ usb_free_urb(urb); + goto error; + } + +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index 6d21bc6a7713..e37ab2425e1a 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -282,8 +282,10 @@ bfad_im_get_stats(struct Scsi_Host *shost) + rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa), + fcstats, bfad_hcb_comp, &fcomp); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); +- if (rc != BFA_STATUS_OK) ++ if (rc != BFA_STATUS_OK) { ++ kfree(fcstats); + return NULL; ++ } + + wait_for_completion(&fcomp.comp); + +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index 5c802c2cb984..f7ed06a1a22e 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -49,6 +49,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { + {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ + {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ ++ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ + {} /* Terminating entry */ +diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h +index dec36f296f3d..ba362a883016 100644 +--- a/drivers/staging/vt6656/device.h ++++ b/drivers/staging/vt6656/device.h +@@ -272,6 +272,7 @@ struct vnt_private { + u8 mac_hw; + /* netdev */ + struct usb_device *usb; ++ struct usb_interface *intf; + + u64 tsf_time; + u8 rx_rate; +diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c +index f35ee85f61b5..668fcd3a0bfe 100644 +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -979,6 +979,7 @@ vt6656_probe(struct usb_interface *intf, const struct usb_device_id *id) + priv = hw->priv; + priv->hw = hw; + priv->usb = udev; ++ priv->intf = intf; + + vnt_set_options(priv); + +diff --git a/drivers/staging/vt6656/wcmd.c b/drivers/staging/vt6656/wcmd.c +index 3cbf4791bac1..de541b85f8a5 100644 +--- a/drivers/staging/vt6656/wcmd.c ++++ b/drivers/staging/vt6656/wcmd.c +@@ -113,6 +113,7 @@ void vnt_run_command(struct work_struct *work) + if (vnt_init(priv)) { + /* If fail all ends TODO retry */ + dev_err(&priv->usb->dev, "failed to start\n"); ++ usb_set_intfdata(priv->intf, NULL); + ieee80211_free_hw(priv->hw); + return; + } +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 54122db81de4..013fb874c64e 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2702,6 +2702,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport) + if (uport->cons && uport->dev) + of_console_check(uport->dev->of_node, uport->cons->name, uport->line); + ++ tty_port_link_device(port, drv->tty_driver, uport->line); + uart_configure_port(drv, state, uport); + + num_groups = 2; +diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c +index 3d24304405b3..496788584034 100644 +--- a/drivers/usb/chipidea/host.c ++++ b/drivers/usb/chipidea/host.c +@@ -37,6 +37,7 @@ static int (*orig_bus_suspend)(struct usb_hcd *hcd); + + struct ehci_ci_priv { + struct regulator *reg_vbus; ++ bool enabled; + }; + + static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) +@@ -48,7 +49,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + int ret = 0; + int port = HCS_N_PORTS(ehci->hcs_params); + +- if (priv->reg_vbus) { ++ if (priv->reg_vbus && enable != priv->enabled) { + if (port > 1) { + dev_warn(dev, + "Not support multi-port regulator control\n"); +@@ -64,6 +65,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + enable ? "enable" : "disable", ret); + return ret; + } ++ priv->enabled = enable; + } + + if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) { +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index d650ce3bc556..570a76d91250 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -358,12 +358,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, + endpoint->desc.wMaxPacketSize = cpu_to_le16(8); + } + +- /* Validate the wMaxPacketSize field */ ++ /* ++ * Validate the wMaxPacketSize field. ++ * Some devices have isochronous endpoints in altsetting 0; ++ * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 ++ * (see the end of section 5.6.3), so don't warn about them. ++ */ + maxp = usb_endpoint_maxp(&endpoint->desc); +- if (maxp == 0) { +- dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n", ++ if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { ++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", + cfgno, inum, asnum, d->bEndpointAddress); +- goto skip_to_next_endpoint_or_interface_descriptor; + } + + /* Find the highest legal maxpacket size for this endpoint */ +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index 3a81b4c4d0dd..c4e26f9f4ec5 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -2132,6 +2132,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl) + musb_platform_disable(musb); + musb_generic_disable(musb); + ++ /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */ ++ musb_writeb(musb->mregs, MUSB_POWER, 0); ++ + /* Init IRQ workqueue before request_irq */ + INIT_WORK(&musb->irq_work, musb_irq_work); + INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset); +diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c +index 7539c3188ffc..ffcc704165f7 100644 +--- a/drivers/usb/musb/musbhsdma.c ++++ b/drivers/usb/musb/musbhsdma.c +@@ -398,7 +398,7 @@ struct dma_controller *musbhs_dma_controller_create(struct musb *musb, + controller->controller.channel_abort = dma_channel_abort; + + if (request_irq(irq, dma_controller_irq, 0, +- dev_name(musb->controller), &controller->controller)) { ++ dev_name(musb->controller), controller)) { + dev_err(dev, "request_irq %d failed!\n", irq); + musb_dma_controller_destroy(&controller->controller); + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 2d302ff62cc1..5ea4cd10abc7 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -566,6 +566,9 @@ static void option_instat_callback(struct urb *urb); + /* Interface is reserved */ + #define RSVD(ifnum) ((BIT(ifnum) & 0xff) << 0) + ++/* Device needs ZLP */ ++#define ZLP BIT(17) ++ + + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, +@@ -1193,6 +1196,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, +@@ -2097,6 +2102,9 @@ static int option_attach(struct usb_serial *serial) + if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) + data->use_send_setup = 1; + ++ if (device_flags & ZLP) ++ data->use_zlp = 1; ++ + spin_lock_init(&data->susp_lock); + + usb_set_serial_data(serial, data); +diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h +index 44b25c08c68a..1d0e28538346 100644 +--- a/drivers/usb/serial/usb-wwan.h ++++ b/drivers/usb/serial/usb-wwan.h +@@ -35,6 +35,7 @@ struct usb_wwan_intf_private { + spinlock_t susp_lock; + unsigned int suspended:1; + unsigned int use_send_setup:1; ++ unsigned int use_zlp:1; + int in_flight; + unsigned int open_ports; + void *private; +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index be9cb61b4d19..485bad73b6ed 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -495,6 +495,7 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + void (*callback) (struct urb *)) + { + struct usb_serial *serial = port->serial; ++ struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial); + struct urb *urb; + + urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */ +@@ -505,6 +506,9 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + usb_sndbulkpipe(serial->dev, endpoint) | dir, + buf, len, callback, ctx); + ++ if (intfdata->use_zlp && dir == USB_DIR_OUT) ++ urb->transfer_flags |= URB_ZERO_PACKET; ++ + return urb; + } + +diff --git a/fs/char_dev.c b/fs/char_dev.c +index d0655ca89481..f1f3bb812799 100644 +--- a/fs/char_dev.c ++++ b/fs/char_dev.c +@@ -332,7 +332,7 @@ static struct kobject *cdev_get(struct cdev *p) + + if (owner && !try_module_get(owner)) + return NULL; +- kobj = kobject_get(&p->kobj); ++ kobj = kobject_get_unless_zero(&p->kobj); + if (!kobj) + module_put(owner); + return kobj; +diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h +index f7178f44825b..d2a497950639 100644 +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -81,6 +82,36 @@ struct can_priv { + #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC)) + #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC)) + ++/* Check for outgoing skbs that have not been created by the CAN subsystem */ ++static inline bool can_skb_headroom_valid(struct net_device *dev, ++ struct sk_buff *skb) ++{ ++ /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */ ++ if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv))) ++ return false; ++ ++ /* af_packet does not apply CAN skb specific settings */ ++ if (skb->ip_summed == CHECKSUM_NONE) { ++ /* init headroom */ ++ can_skb_prv(skb)->ifindex = dev->ifindex; ++ can_skb_prv(skb)->skbcnt = 0; ++ ++ skb->ip_summed = CHECKSUM_UNNECESSARY; ++ ++ /* preform proper loopback on capable devices */ ++ if (dev->flags & IFF_ECHO) ++ skb->pkt_type = PACKET_LOOPBACK; ++ else ++ skb->pkt_type = PACKET_HOST; ++ ++ skb_reset_mac_header(skb); ++ skb_reset_network_header(skb); ++ skb_reset_transport_header(skb); ++ } ++ ++ return true; ++} ++ + /* Drop a given socketbuffer if it does not contain a valid CAN frame. */ + static inline bool can_dropped_invalid_skb(struct net_device *dev, + struct sk_buff *skb) +@@ -98,6 +129,9 @@ static inline bool can_dropped_invalid_skb(struct net_device *dev, + } else + goto inval_skb; + ++ if (!can_skb_headroom_valid(dev, skb)) ++ goto inval_skb; ++ + return false; + + inval_skb: +diff --git a/include/linux/kobject.h b/include/linux/kobject.h +index 5957c6a3fd7f..d9d4485ebad2 100644 +--- a/include/linux/kobject.h ++++ b/include/linux/kobject.h +@@ -108,6 +108,8 @@ extern int __must_check kobject_rename(struct kobject *, const char *new_name); + extern int __must_check kobject_move(struct kobject *, struct kobject *); + + extern struct kobject *kobject_get(struct kobject *kobj); ++extern struct kobject * __must_check kobject_get_unless_zero( ++ struct kobject *kobj); + extern void kobject_put(struct kobject *kobj); + + extern const void *kobject_namespace(struct kobject *kobj); +diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c +index 9d4399b553a3..6403f45da9d5 100644 +--- a/kernel/trace/trace_sched_wakeup.c ++++ b/kernel/trace/trace_sched_wakeup.c +@@ -625,7 +625,7 @@ static void start_wakeup_tracer(struct trace_array *tr) + if (ret) { + pr_info("wakeup trace: Couldn't activate tracepoint" + " probe to kernel_sched_migrate_task\n"); +- return; ++ goto fail_deprobe_sched_switch; + } + + wakeup_reset(tr); +@@ -643,6 +643,8 @@ static void start_wakeup_tracer(struct trace_array *tr) + printk(KERN_ERR "failed to start wakeup tracer\n"); + + return; ++fail_deprobe_sched_switch: ++ unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); + fail_deprobe_wake_new: + unregister_trace_sched_wakeup_new(probe_wakeup, NULL); + fail_deprobe: +diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c +index 202df6cffcca..f08ec7c6f9e0 100644 +--- a/kernel/trace/trace_stack.c ++++ b/kernel/trace/trace_stack.c +@@ -197,6 +197,11 @@ check_stack(unsigned long ip, unsigned long *stack) + local_irq_restore(flags); + } + ++/* Some archs may not define MCOUNT_INSN_SIZE */ ++#ifndef MCOUNT_INSN_SIZE ++# define MCOUNT_INSN_SIZE 0 ++#endif ++ + static void + stack_trace_call(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *op, struct pt_regs *pt_regs) +diff --git a/lib/kobject.c b/lib/kobject.c +index 35d490b02cdd..cebbe79d2c65 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -599,12 +599,15 @@ struct kobject *kobject_get(struct kobject *kobj) + } + EXPORT_SYMBOL(kobject_get); + +-static struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj) ++struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj) + { ++ if (!kobj) ++ return NULL; + if (!kref_get_unless_zero(&kobj->kref)) + kobj = NULL; + return kobj; + } ++EXPORT_SYMBOL(kobject_get_unless_zero); + + /* + * kobject_cleanup - free kobject resources. +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index cbe630aab44a..574697326ebc 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -488,11 +488,12 @@ next: + return 1; + } + +-static inline int check_target(struct arpt_entry *e, const char *name) ++static int check_target(struct arpt_entry *e, struct net *net, const char *name) + { + struct xt_entry_target *t = arpt_get_target(e); + int ret; + struct xt_tgchk_param par = { ++ .net = net, + .table = name, + .entryinfo = e, + .target = t->u.kernel.target, +@@ -510,8 +511,9 @@ static inline int check_target(struct arpt_entry *e, const char *name) + return 0; + } + +-static inline int +-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, ++static int ++find_check_entry(struct arpt_entry *e, struct net *net, const char *name, ++ unsigned int size, + struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; +@@ -531,7 +533,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, + } + t->u.kernel.target = target; + +- ret = check_target(e, name); ++ ret = check_target(e, net, name); + if (ret) + goto err; + return 0; +@@ -632,7 +634,9 @@ static inline void cleanup_entry(struct arpt_entry *e) + /* Checks and translates the user-supplied table segment (held in + * newinfo). + */ +-static int translate_table(struct xt_table_info *newinfo, void *entry0, ++static int translate_table(struct net *net, ++ struct xt_table_info *newinfo, ++ void *entry0, + const struct arpt_replace *repl) + { + struct xt_percpu_counter_alloc_state alloc_state = { 0 }; +@@ -709,7 +713,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, repl->name, repl->size, ++ ret = find_check_entry(iter, net, repl->name, repl->size, + &alloc_state); + if (ret != 0) + break; +@@ -1114,7 +1118,7 @@ static int do_replace(struct net *net, const void __user *user, + goto free_newinfo; + } + +- ret = translate_table(newinfo, loc_cpu_entry, &tmp); ++ ret = translate_table(net, newinfo, loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1301,7 +1305,8 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr, + } + } + +-static int translate_compat_table(struct xt_table_info **pinfo, ++static int translate_compat_table(struct net *net, ++ struct xt_table_info **pinfo, + void **pentry0, + const struct compat_arpt_replace *compatr) + { +@@ -1371,7 +1376,7 @@ static int translate_compat_table(struct xt_table_info **pinfo, + repl.num_counters = 0; + repl.counters = NULL; + repl.size = newinfo->size; +- ret = translate_table(newinfo, entry1, &repl); ++ ret = translate_table(net, newinfo, entry1, &repl); + if (ret) + goto free_newinfo; + +@@ -1426,7 +1431,7 @@ static int compat_do_replace(struct net *net, void __user *user, + goto free_newinfo; + } + +- ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp); ++ ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1696,7 +1701,7 @@ struct xt_table *arpt_register_table(struct net *net, + loc_cpu_entry = newinfo->entries; + memcpy(loc_cpu_entry, repl->entries, repl->size); + +- ret = translate_table(newinfo, loc_cpu_entry, repl); ++ ret = translate_table(net, newinfo, loc_cpu_entry, repl); + duprintf("arpt_register_table: translate table gives %d\n", ret); + if (ret != 0) + goto out_free; +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index caa26184f7e3..0583e2491770 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -1619,6 +1619,7 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb, + struct ip_set *set; + struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {}; + int ret = 0; ++ u32 lineno; + + if (unlikely(protocol_failed(attr) || + !attr[IPSET_ATTR_SETNAME] || +@@ -1635,7 +1636,7 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb, + return -IPSET_ERR_PROTOCOL; + + rcu_read_lock_bh(); +- ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0); ++ ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0); + rcu_read_unlock_bh(); + /* Userspace can't trigger element to be re-added */ + if (ret == -EAGAIN) +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 9c5368e7ee23..5e50386c8ebb 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1142,6 +1142,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ + case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ + case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ ++ case USB_ID(0x05a7, 0x1020): /* Bose Companion 5 */ + #ifdef CONFIG_HID_RKVR + case USB_ID(0x071B, 0x3205): /* RockChip NanoC VR */ + #endif diff --git a/patch/kernel/sunxi-current/patch-5.4.11-12.patch b/patch/kernel/sunxi-current/patch-5.4.11-12.patch new file mode 100644 index 0000000000..e0f4084ba9 --- /dev/null +++ b/patch/kernel/sunxi-current/patch-5.4.11-12.patch @@ -0,0 +1,2421 @@ +diff --git a/Makefile b/Makefile +index e8963f623568..45c6264f1108 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 11 ++SUBLEVEL = 12 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index 8a50efb559f3..39002d769d95 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -73,6 +73,7 @@ config ARM + select HAVE_ARM_SMCCC if CPU_V7 + select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32 + select HAVE_CONTEXT_TRACKING ++ select HAVE_COPY_THREAD_TLS + select HAVE_C_RECORDMCOUNT + select HAVE_DEBUG_KMEMLEAK + select HAVE_DMA_CONTIGUOUS if MMU +diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c +index 9485acc520a4..e7fac125ea0d 100644 +--- a/arch/arm/kernel/process.c ++++ b/arch/arm/kernel/process.c +@@ -224,8 +224,8 @@ void release_thread(struct task_struct *dead_task) + asmlinkage void ret_from_fork(void) __asm__("ret_from_fork"); + + int +-copy_thread(unsigned long clone_flags, unsigned long stack_start, +- unsigned long stk_sz, struct task_struct *p) ++copy_thread_tls(unsigned long clone_flags, unsigned long stack_start, ++ unsigned long stk_sz, struct task_struct *p, unsigned long tls) + { + struct thread_info *thread = task_thread_info(p); + struct pt_regs *childregs = task_pt_regs(p); +@@ -259,7 +259,7 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start, + clear_ptrace_hw_breakpoint(p); + + if (clone_flags & CLONE_SETTLS) +- thread->tp_value[0] = childregs->ARM_r3; ++ thread->tp_value[0] = tls; + thread->tp_value[1] = get_tpuser(); + + thread_notify(THREAD_NOTIFY_COPY, thread); +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 3f047afb982c..6ccd2ed30963 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -139,6 +139,7 @@ config ARM64 + select HAVE_CMPXCHG_DOUBLE + select HAVE_CMPXCHG_LOCAL + select HAVE_CONTEXT_TRACKING ++ select HAVE_COPY_THREAD_TLS + select HAVE_DEBUG_BUGVERBOSE + select HAVE_DEBUG_KMEMLEAK + select HAVE_DMA_CONTIGUOUS +diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h +index 2629a68b8724..5af82587909e 100644 +--- a/arch/arm64/include/asm/unistd.h ++++ b/arch/arm64/include/asm/unistd.h +@@ -42,7 +42,6 @@ + #endif + + #define __ARCH_WANT_SYS_CLONE +-#define __ARCH_WANT_SYS_CLONE3 + + #ifndef __COMPAT_SYSCALL_NR + #include +diff --git a/arch/arm64/include/uapi/asm/unistd.h b/arch/arm64/include/uapi/asm/unistd.h +index 4703d218663a..f83a70e07df8 100644 +--- a/arch/arm64/include/uapi/asm/unistd.h ++++ b/arch/arm64/include/uapi/asm/unistd.h +@@ -19,5 +19,6 @@ + #define __ARCH_WANT_NEW_STAT + #define __ARCH_WANT_SET_GET_RLIMIT + #define __ARCH_WANT_TIME32_SYSCALLS ++#define __ARCH_WANT_SYS_CLONE3 + + #include +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 71f788cd2b18..d54586d5b031 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -360,8 +360,8 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + + asmlinkage void ret_from_fork(void) asm("ret_from_fork"); + +-int copy_thread(unsigned long clone_flags, unsigned long stack_start, +- unsigned long stk_sz, struct task_struct *p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long stack_start, ++ unsigned long stk_sz, struct task_struct *p, unsigned long tls) + { + struct pt_regs *childregs = task_pt_regs(p); + +@@ -394,11 +394,11 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start, + } + + /* +- * If a TLS pointer was passed to clone (4th argument), use it +- * for the new thread. ++ * If a TLS pointer was passed to clone, use it for the new ++ * thread. + */ + if (clone_flags & CLONE_SETTLS) +- p->thread.uw.tp_value = childregs->regs[3]; ++ p->thread.uw.tp_value = tls; + } else { + memset(childregs, 0, sizeof(struct pt_regs)); + childregs->pstate = PSR_MODE_EL1h; +diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig +index b16237c95ea3..0c29d6cb2c8d 100644 +--- a/arch/parisc/Kconfig ++++ b/arch/parisc/Kconfig +@@ -62,6 +62,7 @@ config PARISC + select HAVE_FTRACE_MCOUNT_RECORD if HAVE_DYNAMIC_FTRACE + select HAVE_KPROBES_ON_FTRACE + select HAVE_DYNAMIC_FTRACE_WITH_REGS ++ select HAVE_COPY_THREAD_TLS + + help + The PA-RISC microprocessor is designed by Hewlett-Packard and used +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index ecc5c2771208..230a6422b99f 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -208,8 +208,8 @@ arch_initcall(parisc_idle_init); + * Copy architecture-specific thread state + */ + int +-copy_thread(unsigned long clone_flags, unsigned long usp, +- unsigned long kthread_arg, struct task_struct *p) ++copy_thread_tls(unsigned long clone_flags, unsigned long usp, ++ unsigned long kthread_arg, struct task_struct *p, unsigned long tls) + { + struct pt_regs *cregs = &(p->thread.regs); + void *stack = task_stack_page(p); +@@ -254,9 +254,9 @@ copy_thread(unsigned long clone_flags, unsigned long usp, + cregs->ksp = (unsigned long)stack + THREAD_SZ_ALGN + FRAME_SIZE; + cregs->kpc = (unsigned long) &child_return; + +- /* Setup thread TLS area from the 4th parameter in clone */ ++ /* Setup thread TLS area */ + if (clone_flags & CLONE_SETTLS) +- cregs->cr27 = cregs->gr[23]; ++ cregs->cr27 = tls; + } + + return 0; +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index 8eebbc8860bb..ade9699aa0dd 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -61,6 +61,7 @@ config RISCV + select SPARSEMEM_STATIC if 32BIT + select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT if MMU + select HAVE_ARCH_MMAP_RND_BITS ++ select HAVE_COPY_THREAD_TLS + + config ARCH_MMAP_RND_BITS_MIN + default 18 if 64BIT +diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c +index 85e3c39bb60b..330b34706aa0 100644 +--- a/arch/riscv/kernel/process.c ++++ b/arch/riscv/kernel/process.c +@@ -99,8 +99,8 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + return 0; + } + +-int copy_thread(unsigned long clone_flags, unsigned long usp, +- unsigned long arg, struct task_struct *p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long usp, ++ unsigned long arg, struct task_struct *p, unsigned long tls) + { + struct pt_regs *childregs = task_pt_regs(p); + +@@ -120,7 +120,7 @@ int copy_thread(unsigned long clone_flags, unsigned long usp, + if (usp) /* User fork */ + childregs->sp = usp; + if (clone_flags & CLONE_SETTLS) +- childregs->tp = childregs->a5; ++ childregs->tp = tls; + childregs->a0 = 0; /* Return value of fork() */ + p->thread.ra = (unsigned long)ret_from_fork; + } +diff --git a/arch/um/Kconfig b/arch/um/Kconfig +index fec6b4ca2b6e..c56d3526a3bd 100644 +--- a/arch/um/Kconfig ++++ b/arch/um/Kconfig +@@ -14,6 +14,7 @@ config UML + select HAVE_FUTEX_CMPXCHG if FUTEX + select HAVE_DEBUG_KMEMLEAK + select HAVE_DEBUG_BUGVERBOSE ++ select HAVE_COPY_THREAD_TLS + select GENERIC_IRQ_SHOW + select GENERIC_CPU_DEVICES + select GENERIC_CLOCKEVENTS +diff --git a/arch/um/include/asm/ptrace-generic.h b/arch/um/include/asm/ptrace-generic.h +index 81c647ef9c6c..adf91ef553ae 100644 +--- a/arch/um/include/asm/ptrace-generic.h ++++ b/arch/um/include/asm/ptrace-generic.h +@@ -36,7 +36,7 @@ extern long subarch_ptrace(struct task_struct *child, long request, + extern unsigned long getreg(struct task_struct *child, int regno); + extern int putreg(struct task_struct *child, int regno, unsigned long value); + +-extern int arch_copy_tls(struct task_struct *new); ++extern int arch_set_tls(struct task_struct *new, unsigned long tls); + extern void clear_flushed_tls(struct task_struct *task); + extern int syscall_trace_enter(struct pt_regs *regs); + extern void syscall_trace_leave(struct pt_regs *regs); +diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c +index 263a8f069133..17045e7211bf 100644 +--- a/arch/um/kernel/process.c ++++ b/arch/um/kernel/process.c +@@ -153,8 +153,8 @@ void fork_handler(void) + userspace(¤t->thread.regs.regs, current_thread_info()->aux_fp_regs); + } + +-int copy_thread(unsigned long clone_flags, unsigned long sp, +- unsigned long arg, struct task_struct * p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long sp, ++ unsigned long arg, struct task_struct * p, unsigned long tls) + { + void (*handler)(void); + int kthread = current->flags & PF_KTHREAD; +@@ -188,7 +188,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, + * Set a new TLS for the child thread? + */ + if (clone_flags & CLONE_SETTLS) +- ret = arch_copy_tls(p); ++ ret = arch_set_tls(p, tls); + } + + return ret; +diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c +index 5bd949da7a4a..ac8eee093f9c 100644 +--- a/arch/x86/um/tls_32.c ++++ b/arch/x86/um/tls_32.c +@@ -215,14 +215,12 @@ static int set_tls_entry(struct task_struct* task, struct user_desc *info, + return 0; + } + +-int arch_copy_tls(struct task_struct *new) ++int arch_set_tls(struct task_struct *new, unsigned long tls) + { + struct user_desc info; + int idx, ret = -EFAULT; + +- if (copy_from_user(&info, +- (void __user *) UPT_SI(&new->thread.regs.regs), +- sizeof(info))) ++ if (copy_from_user(&info, (void __user *) tls, sizeof(info))) + goto out; + + ret = -EINVAL; +diff --git a/arch/x86/um/tls_64.c b/arch/x86/um/tls_64.c +index 3a621e0d3925..ebd3855d9b13 100644 +--- a/arch/x86/um/tls_64.c ++++ b/arch/x86/um/tls_64.c +@@ -6,14 +6,13 @@ void clear_flushed_tls(struct task_struct *task) + { + } + +-int arch_copy_tls(struct task_struct *t) ++int arch_set_tls(struct task_struct *t, unsigned long tls) + { + /* + * If CLONE_SETTLS is set, we need to save the thread id +- * (which is argument 5, child_tid, of clone) so it can be set +- * during context switches. ++ * so it can be set during context switches. + */ +- t->thread.arch.fs = t->thread.regs.regs.gp[R8 / sizeof(long)]; ++ t->thread.arch.fs = tls; + + return 0; + } +diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig +index a8e7beb6b7b5..8352037322df 100644 +--- a/arch/xtensa/Kconfig ++++ b/arch/xtensa/Kconfig +@@ -22,6 +22,7 @@ config XTENSA + select HAVE_ARCH_JUMP_LABEL + select HAVE_ARCH_KASAN if MMU + select HAVE_ARCH_TRACEHOOK ++ select HAVE_COPY_THREAD_TLS + select HAVE_DEBUG_KMEMLEAK + select HAVE_DMA_CONTIGUOUS + select HAVE_EXIT_THREAD +diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c +index db278a9e80c7..7cbf8bd6d922 100644 +--- a/arch/xtensa/kernel/process.c ++++ b/arch/xtensa/kernel/process.c +@@ -202,8 +202,9 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + * involved. Much simpler to just not copy those live frames across. + */ + +-int copy_thread(unsigned long clone_flags, unsigned long usp_thread_fn, +- unsigned long thread_fn_arg, struct task_struct *p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long usp_thread_fn, ++ unsigned long thread_fn_arg, struct task_struct *p, ++ unsigned long tls) + { + struct pt_regs *childregs = task_pt_regs(p); + +@@ -264,9 +265,8 @@ int copy_thread(unsigned long clone_flags, unsigned long usp_thread_fn, + ®s->areg[XCHAL_NUM_AREGS - len/4], len); + } + +- /* The thread pointer is passed in the '4th argument' (= a5) */ + if (clone_flags & CLONE_SETTLS) +- childregs->threadptr = childregs->areg[5]; ++ childregs->threadptr = tls; + } else { + p->thread.ra = MAKE_RA_FOR_CALL( + (unsigned long)ret_from_kernel_thread, 1); +diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c +index b23b0b999232..87f449340202 100644 +--- a/drivers/char/tpm/tpm-dev-common.c ++++ b/drivers/char/tpm/tpm-dev-common.c +@@ -130,7 +130,7 @@ ssize_t tpm_common_read(struct file *file, char __user *buf, + priv->response_read = true; + + ret_size = min_t(ssize_t, size, priv->response_length); +- if (!ret_size) { ++ if (ret_size <= 0) { + priv->response_length = 0; + goto out; + } +diff --git a/drivers/char/tpm/tpm-dev.h b/drivers/char/tpm/tpm-dev.h +index 1089fc0bb290..f3742bcc73e3 100644 +--- a/drivers/char/tpm/tpm-dev.h ++++ b/drivers/char/tpm/tpm-dev.h +@@ -14,7 +14,7 @@ struct file_priv { + struct work_struct timeout_work; + struct work_struct async_work; + wait_queue_head_t async_wait; +- size_t response_length; ++ ssize_t response_length; + bool response_read; + bool command_enqueued; + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index f528fc39ea6b..c3181ea9f271 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -899,13 +899,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + + if (wait_startup(chip, 0) != 0) { + rc = -ENODEV; +- goto err_start; ++ goto out_err; + } + + /* Take control of the TPM's interrupt hardware and shut it off */ + rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask); + if (rc < 0) +- goto err_start; ++ goto out_err; + + intmask |= TPM_INTF_CMD_READY_INT | TPM_INTF_LOCALITY_CHANGE_INT | + TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; +@@ -914,21 +914,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + + rc = tpm_chip_start(chip); + if (rc) +- goto err_start; +- ++ goto out_err; + rc = tpm2_probe(chip); ++ tpm_chip_stop(chip); + if (rc) +- goto err_probe; ++ goto out_err; + + rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor); + if (rc < 0) +- goto err_probe; ++ goto out_err; + + priv->manufacturer_id = vendor; + + rc = tpm_tis_read8(priv, TPM_RID(0), &rid); + if (rc < 0) +- goto err_probe; ++ goto out_err; + + dev_info(dev, "%s TPM (device-id 0x%X, rev-id %d)\n", + (chip->flags & TPM_CHIP_FLAG_TPM2) ? "2.0" : "1.2", +@@ -937,13 +937,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + probe = probe_itpm(chip); + if (probe < 0) { + rc = -ENODEV; +- goto err_probe; ++ goto out_err; + } + + /* Figure out the capabilities */ + rc = tpm_tis_read32(priv, TPM_INTF_CAPS(priv->locality), &intfcaps); + if (rc < 0) +- goto err_probe; ++ goto out_err; + + dev_dbg(dev, "TPM interface capabilities (0x%x):\n", + intfcaps); +@@ -977,10 +977,9 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + if (tpm_get_timeouts(chip)) { + dev_err(dev, "Could not get TPM timeouts and durations\n"); + rc = -ENODEV; +- goto err_probe; ++ goto out_err; + } + +- chip->flags |= TPM_CHIP_FLAG_IRQ; + if (irq) { + tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED, + irq); +@@ -992,18 +991,15 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + } + } + +- tpm_chip_stop(chip); +- + rc = tpm_chip_register(chip); + if (rc) +- goto err_start; +- +- return 0; ++ goto out_err; + +-err_probe: +- tpm_chip_stop(chip); ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, false); + +-err_start: ++ return 0; ++out_err: + if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL)) + chip->ops->clk_enable(chip, false); + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 59ccfd24627d..1f98e988c0d3 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -21,11 +21,19 @@ + #include "gpiolib.h" + #include "gpiolib-acpi.h" + ++#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l ++#define QUIRK_NO_WAKEUP 0x02l ++ + static int run_edge_events_on_boot = -1; + module_param(run_edge_events_on_boot, int, 0444); + MODULE_PARM_DESC(run_edge_events_on_boot, + "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto"); + ++static int honor_wakeup = -1; ++module_param(honor_wakeup, int, 0444); ++MODULE_PARM_DESC(honor_wakeup, ++ "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto"); ++ + /** + * struct acpi_gpio_event - ACPI GPIO event handler data + * +@@ -274,7 +282,7 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, + event->handle = evt_handle; + event->handler = handler; + event->irq = irq; +- event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE; ++ event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE; + event->pin = pin; + event->desc = desc; + +@@ -1302,7 +1310,7 @@ static int acpi_gpio_handle_deferred_request_irqs(void) + /* We must use _sync so that this runs after the first deferred_probe run */ + late_initcall_sync(acpi_gpio_handle_deferred_request_irqs); + +-static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { ++static const struct dmi_system_id gpiolib_acpi_quirks[] = { + { + /* + * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for +@@ -1312,7 +1320,8 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "MINIX"), + DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), +- } ++ }, ++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, + }, + { + /* +@@ -1324,20 +1333,52 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"), + DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"), +- } ++ }, ++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, ++ }, ++ { ++ /* ++ * Various HP X2 10 Cherry Trail models use an external ++ * embedded-controller connected via I2C + an ACPI GPIO ++ * event handler. The embedded controller generates various ++ * spurious wakeup events when suspended. So disable wakeup ++ * for its handler (it uses the only ACPI GPIO event handler). ++ * This breaks wakeup when opening the lid, the user needs ++ * to press the power-button to wakeup the system. The ++ * alternative is suspend simply not working, which is worse. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"), ++ }, ++ .driver_data = (void *)QUIRK_NO_WAKEUP, + }, + {} /* Terminating entry */ + }; + + static int acpi_gpio_setup_params(void) + { ++ const struct dmi_system_id *id; ++ long quirks = 0; ++ ++ id = dmi_first_match(gpiolib_acpi_quirks); ++ if (id) ++ quirks = (long)id->driver_data; ++ + if (run_edge_events_on_boot < 0) { +- if (dmi_check_system(run_edge_events_on_boot_blacklist)) ++ if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT) + run_edge_events_on_boot = 0; + else + run_edge_events_on_boot = 1; + } + ++ if (honor_wakeup < 0) { ++ if (quirks & QUIRK_NO_WAKEUP) ++ honor_wakeup = 0; ++ else ++ honor_wakeup = 1; ++ } ++ + return 0; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index b19157b19fa0..33a1099e2f33 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -145,7 +145,7 @@ int amdgpu_async_gfx_ring = 1; + int amdgpu_mcbp = 0; + int amdgpu_discovery = -1; + int amdgpu_mes = 0; +-int amdgpu_noretry = 1; ++int amdgpu_noretry; + + struct amdgpu_mgpu_info mgpu_info = { + .mutex = __MUTEX_INITIALIZER(mgpu_info.mutex), +@@ -613,7 +613,7 @@ MODULE_PARM_DESC(mes, + module_param_named(mes, amdgpu_mes, int, 0444); + + MODULE_PARM_DESC(noretry, +- "Disable retry faults (0 = retry enabled, 1 = retry disabled (default))"); ++ "Disable retry faults (0 = retry enabled (default), 1 = retry disabled)"); + module_param_named(noretry, amdgpu_noretry, int, 0644); + + #ifdef CONFIG_HSA_AMD +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 86c17896b532..a48a4c21b1b3 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -339,7 +339,7 @@ static void drm_dp_encode_sideband_req(struct drm_dp_sideband_msg_req_body *req, + memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes); + idx += req->u.i2c_read.transactions[i].num_bytes; + +- buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5; ++ buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4; + buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf); + idx++; + } +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index a7ba5b4902d6..8d193a58363d 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -1320,7 +1320,7 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, + * Changes struct fb_var_screeninfo are currently not pushed back + * to KMS, hence fail if different settings are requested. + */ +- if (var->bits_per_pixel != fb->format->cpp[0] * 8 || ++ if (var->bits_per_pixel > fb->format->cpp[0] * 8 || + var->xres > fb->width || var->yres > fb->height || + var->xres_virtual > fb->width || var->yres_virtual > fb->height) { + DRM_DEBUG("fb requested width/height/bpp can't fit in current fb " +@@ -1345,6 +1345,11 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, + drm_fb_helper_fill_pixel_fmt(var, fb->format->depth); + } + ++ /* ++ * Likewise, bits_per_pixel should be rounded up to a supported value. ++ */ ++ var->bits_per_pixel = fb->format->cpp[0] * 8; ++ + /* + * drm fbdev emulation doesn't support changing the pixel format at all, + * so reject all pixel format changing requests. +diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c +index d564bfcab6a3..4949b5ad860f 100644 +--- a/drivers/gpu/drm/i915/gt/intel_lrc.c ++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c +@@ -2132,6 +2132,14 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch) + /* WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk */ + batch = gen8_emit_flush_coherentl3_wa(engine, batch); + ++ /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */ ++ batch = gen8_emit_pipe_control(batch, ++ PIPE_CONTROL_FLUSH_L3 | ++ PIPE_CONTROL_GLOBAL_GTT_IVB | ++ PIPE_CONTROL_CS_STALL | ++ PIPE_CONTROL_QW_WRITE, ++ slm_offset(engine)); ++ + batch = emit_lri(batch, lri, ARRAY_SIZE(lri)); + + /* WaMediaPoolStateCmdInWABB:bxt,glk */ +@@ -3716,9 +3724,11 @@ intel_execlists_create_virtual(struct i915_gem_context *ctx, + ve->base.i915 = ctx->i915; + ve->base.gt = siblings[0]->gt; + ve->base.id = -1; ++ + ve->base.class = OTHER_CLASS; + ve->base.uabi_class = I915_ENGINE_CLASS_INVALID; + ve->base.instance = I915_ENGINE_CLASS_INVALID_VIRTUAL; ++ ve->base.uabi_instance = I915_ENGINE_CLASS_INVALID_VIRTUAL; + + /* + * The decision on whether to submit a request using semaphores +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index f8ee9aba3955..7b6e68f082f8 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -4049,7 +4049,13 @@ enum { + #define GWUNIT_CLKGATE_DIS (1 << 16) + + #define UNSLICE_UNIT_LEVEL_CLKGATE _MMIO(0x9434) +-#define VFUNIT_CLKGATE_DIS (1 << 20) ++#define VFUNIT_CLKGATE_DIS REG_BIT(20) ++#define HSUNIT_CLKGATE_DIS REG_BIT(8) ++#define VSUNIT_CLKGATE_DIS REG_BIT(3) ++ ++#define UNSLICE_UNIT_LEVEL_CLKGATE2 _MMIO(0x94e4) ++#define VSUNIT_CLKGATE_DIS_TGL REG_BIT(19) ++#define PSDUNIT_CLKGATE_DIS REG_BIT(5) + + #define INF_UNIT_LEVEL_CLKGATE _MMIO(0x9560) + #define CGPSF_CLKGATE_DIS (1 << 3) +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 2efe1d12d5a9..3ccfc025fde2 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -9194,6 +9194,17 @@ static void icl_init_clock_gating(struct drm_i915_private *dev_priv) + /* WaEnable32PlaneMode:icl */ + I915_WRITE(GEN9_CSFE_CHICKEN1_RCS, + _MASKED_BIT_ENABLE(GEN11_ENABLE_32_PLANE_MODE)); ++ ++ /* ++ * Wa_1408615072:icl,ehl (vsunit) ++ * Wa_1407596294:icl,ehl (hsunit) ++ */ ++ intel_uncore_rmw(&dev_priv->uncore, UNSLICE_UNIT_LEVEL_CLKGATE, ++ 0, VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS); ++ ++ /* Wa_1407352427:icl,ehl */ ++ intel_uncore_rmw(&dev_priv->uncore, UNSLICE_UNIT_LEVEL_CLKGATE2, ++ 0, PSDUNIT_CLKGATE_DIS); + } + + static void cnp_init_clock_gating(struct drm_i915_private *dev_priv) +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c +index b89439ed210d..27c80c9e2b83 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -488,7 +488,7 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon, + + WARN_ON(!tcon->quirks->has_channel_0); + +- tcon->dclk_min_div = 1; ++ tcon->dclk_min_div = tcon->quirks->dclk_min_div; + tcon->dclk_max_div = 127; + sun4i_tcon0_mode_set_common(tcon, mode); + +@@ -1425,12 +1425,14 @@ static int sun8i_r40_tcon_tv_set_mux(struct sun4i_tcon *tcon, + static const struct sun4i_tcon_quirks sun4i_a10_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, ++ .dclk_min_div = 4, + .set_mux = sun4i_a10_tcon_set_mux, + }; + + static const struct sun4i_tcon_quirks sun5i_a13_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, ++ .dclk_min_div = 4, + .set_mux = sun5i_a13_tcon_set_mux, + }; + +@@ -1439,6 +1441,7 @@ static const struct sun4i_tcon_quirks sun6i_a31_quirks = { + .has_channel_1 = true, + .has_lvds_alt = true, + .needs_de_be_mux = true, ++ .dclk_min_div = 1, + .set_mux = sun6i_tcon_set_mux, + }; + +@@ -1446,11 +1449,13 @@ static const struct sun4i_tcon_quirks sun6i_a31s_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, + .needs_de_be_mux = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun7i_a20_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, ++ .dclk_min_div = 4, + /* Same display pipeline structure as A10 */ + .set_mux = sun4i_a10_tcon_set_mux, + }; +@@ -1458,11 +1463,13 @@ static const struct sun4i_tcon_quirks sun7i_a20_quirks = { + static const struct sun4i_tcon_quirks sun8i_a33_quirks = { + .has_channel_0 = true, + .has_lvds_alt = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun8i_a83t_lcd_quirks = { + .supports_lvds = true, + .has_channel_0 = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = { +@@ -1476,11 +1483,13 @@ static const struct sun4i_tcon_quirks sun8i_r40_tv_quirks = { + + static const struct sun4i_tcon_quirks sun8i_v3s_quirks = { + .has_channel_0 = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun9i_a80_tcon_lcd_quirks = { +- .has_channel_0 = true, +- .needs_edp_reset = true, ++ .has_channel_0 = true, ++ .needs_edp_reset = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun9i_a80_tcon_tv_quirks = { +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h +index f9f1fe80b206..a62ec826ae71 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h +@@ -224,6 +224,7 @@ struct sun4i_tcon_quirks { + bool needs_de_be_mux; /* sun6i needs mux to select backend */ + bool needs_edp_reset; /* a80 edp reset needed for tcon0 access */ + bool supports_lvds; /* Does the TCON support an LVDS output? */ ++ u8 dclk_min_div; /* minimum divider for TCON0 DCLK */ + + /* callback to handle tcon muxing options */ + int (*set_mux)(struct sun4i_tcon *, const struct drm_encoder *); +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index e0b241bd3070..851fe54ea59e 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -288,6 +288,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign + offset = report->size; + report->size += parser->global.report_size * parser->global.report_count; + ++ /* Total size check: Allow for possible report index byte */ ++ if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { ++ hid_err(parser->device, "report is too long\n"); ++ return -1; ++ } ++ + if (!parser->local.usage_index) /* Ignore padding fields */ + return 0; + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 63855f275a38..dea9cc65bf80 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1132,9 +1132,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + } + + mapped: +- if (device->driver->input_mapped && device->driver->input_mapped(device, +- hidinput, field, usage, &bit, &max) < 0) +- goto ignore; ++ if (device->driver->input_mapped && ++ device->driver->input_mapped(device, hidinput, field, usage, ++ &bit, &max) < 0) { ++ /* ++ * The driver indicated that no further generic handling ++ * of the usage is desired. ++ */ ++ return; ++ } + + set_bit(usage->type, input->evbit); + +@@ -1215,9 +1221,11 @@ mapped: + set_bit(MSC_SCAN, input->mscbit); + } + +-ignore: + return; + ++ignore: ++ usage->type = 0; ++ usage->code = 0; + } + + static void hidinput_handle_scroll(struct hid_usage *usage, +diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c +index bbc6ec1aa5cb..c25e95c19cad 100644 +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -252,10 +252,10 @@ static __poll_t hidraw_poll(struct file *file, poll_table *wait) + + poll_wait(file, &list->hidraw->wait, wait); + if (list->head != list->tail) +- return EPOLLIN | EPOLLRDNORM | EPOLLOUT; ++ return EPOLLIN | EPOLLRDNORM; + if (!list->hidraw->exist) + return EPOLLERR | EPOLLHUP; +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static int hidraw_open(struct inode *inode, struct file *file) +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index fa0cc0899827..935c3d0a3b63 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -772,7 +772,7 @@ static __poll_t uhid_char_poll(struct file *file, poll_table *wait) + if (uhid->head != uhid->tail) + return EPOLLIN | EPOLLRDNORM; + +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static const struct file_operations uhid_fops = { +diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c +index 1f9bc4483465..c879b214a479 100644 +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -241,12 +241,51 @@ static int hiddev_release(struct inode * inode, struct file * file) + return 0; + } + ++static int __hiddev_open(struct hiddev *hiddev, struct file *file) ++{ ++ struct hiddev_list *list; ++ int error; ++ ++ lockdep_assert_held(&hiddev->existancelock); ++ ++ list = vzalloc(sizeof(*list)); ++ if (!list) ++ return -ENOMEM; ++ ++ mutex_init(&list->thread_lock); ++ list->hiddev = hiddev; ++ ++ if (!hiddev->open++) { ++ error = hid_hw_power(hiddev->hid, PM_HINT_FULLON); ++ if (error < 0) ++ goto err_drop_count; ++ ++ error = hid_hw_open(hiddev->hid); ++ if (error < 0) ++ goto err_normal_power; ++ } ++ ++ spin_lock_irq(&hiddev->list_lock); ++ list_add_tail(&list->node, &hiddev->list); ++ spin_unlock_irq(&hiddev->list_lock); ++ ++ file->private_data = list; ++ ++ return 0; ++ ++err_normal_power: ++ hid_hw_power(hiddev->hid, PM_HINT_NORMAL); ++err_drop_count: ++ hiddev->open--; ++ vfree(list); ++ return error; ++} ++ + /* + * open file op + */ + static int hiddev_open(struct inode *inode, struct file *file) + { +- struct hiddev_list *list; + struct usb_interface *intf; + struct hid_device *hid; + struct hiddev *hiddev; +@@ -255,66 +294,14 @@ static int hiddev_open(struct inode *inode, struct file *file) + intf = usbhid_find_interface(iminor(inode)); + if (!intf) + return -ENODEV; ++ + hid = usb_get_intfdata(intf); + hiddev = hid->hiddev; + +- if (!(list = vzalloc(sizeof(struct hiddev_list)))) +- return -ENOMEM; +- mutex_init(&list->thread_lock); +- list->hiddev = hiddev; +- file->private_data = list; +- +- /* +- * no need for locking because the USB major number +- * is shared which usbcore guards against disconnect +- */ +- if (list->hiddev->exist) { +- if (!list->hiddev->open++) { +- res = hid_hw_open(hiddev->hid); +- if (res < 0) +- goto bail; +- } +- } else { +- res = -ENODEV; +- goto bail; +- } +- +- spin_lock_irq(&list->hiddev->list_lock); +- list_add_tail(&list->node, &hiddev->list); +- spin_unlock_irq(&list->hiddev->list_lock); +- + mutex_lock(&hiddev->existancelock); +- /* +- * recheck exist with existance lock held to +- * avoid opening a disconnected device +- */ +- if (!list->hiddev->exist) { +- res = -ENODEV; +- goto bail_unlock; +- } +- if (!list->hiddev->open++) +- if (list->hiddev->exist) { +- struct hid_device *hid = hiddev->hid; +- res = hid_hw_power(hid, PM_HINT_FULLON); +- if (res < 0) +- goto bail_unlock; +- res = hid_hw_open(hid); +- if (res < 0) +- goto bail_normal_power; +- } +- mutex_unlock(&hiddev->existancelock); +- return 0; +-bail_normal_power: +- hid_hw_power(hid, PM_HINT_NORMAL); +-bail_unlock: ++ res = hiddev->exist ? __hiddev_open(hiddev, file) : -ENODEV; + mutex_unlock(&hiddev->existancelock); + +- spin_lock_irq(&list->hiddev->list_lock); +- list_del(&list->node); +- spin_unlock_irq(&list->hiddev->list_lock); +-bail: +- file->private_data = NULL; +- vfree(list); + return res; + } + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 5f6a4985f2bc..810a942eaa8e 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -186,10 +186,11 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap) + * If we can set SDA, we will always create a STOP to ensure additional + * pulses will do no harm. This is achieved by letting SDA follow SCL + * half a cycle later. Check the 'incomplete_write_byte' fault injector +- * for details. ++ * for details. Note that we must honour tsu:sto, 4us, but lets use 5us ++ * here for simplicity. + */ + bri->set_scl(adap, scl); +- ndelay(RECOVERY_NDELAY / 2); ++ ndelay(RECOVERY_NDELAY); + if (bri->set_sda) + bri->set_sda(adap, scl); + ndelay(RECOVERY_NDELAY / 2); +@@ -211,7 +212,13 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap) + scl = !scl; + bri->set_scl(adap, scl); + /* Creating STOP again, see above */ +- ndelay(RECOVERY_NDELAY / 2); ++ if (scl) { ++ /* Honour minimum tsu:sto */ ++ ndelay(RECOVERY_NDELAY); ++ } else { ++ /* Honour minimum tf and thd:dat */ ++ ndelay(RECOVERY_NDELAY / 2); ++ } + if (bri->set_sda) + bri->set_sda(adap, scl); + ndelay(RECOVERY_NDELAY / 2); +diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c +index e53f542b60af..8a2e0d9351e9 100644 +--- a/drivers/infiniband/hw/hfi1/tid_rdma.c ++++ b/drivers/infiniband/hw/hfi1/tid_rdma.c +@@ -4633,6 +4633,15 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet) + */ + fpsn = full_flow_psn(flow, flow->flow_state.spsn); + req->r_ack_psn = psn; ++ /* ++ * If resync_psn points to the last flow PSN for a ++ * segment and the new segment (likely from a new ++ * request) starts with a new generation number, we ++ * need to adjust resync_psn accordingly. ++ */ ++ if (flow->flow_state.generation != ++ (resync_psn >> HFI1_KDETH_BTH_SEQ_SHIFT)) ++ resync_psn = mask_psn(fpsn - 1); + flow->resync_npkts += + delta_psn(mask_psn(resync_psn + 1), fpsn); + /* +diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c +index d7dd6fcf2db0..f918fca9ada3 100644 +--- a/drivers/input/evdev.c ++++ b/drivers/input/evdev.c +@@ -224,13 +224,13 @@ static void __pass_event(struct evdev_client *client, + */ + client->tail = (client->head - 2) & (client->bufsize - 1); + +- client->buffer[client->tail].input_event_sec = +- event->input_event_sec; +- client->buffer[client->tail].input_event_usec = +- event->input_event_usec; +- client->buffer[client->tail].type = EV_SYN; +- client->buffer[client->tail].code = SYN_DROPPED; +- client->buffer[client->tail].value = 0; ++ client->buffer[client->tail] = (struct input_event) { ++ .input_event_sec = event->input_event_sec, ++ .input_event_usec = event->input_event_usec, ++ .type = EV_SYN, ++ .code = SYN_DROPPED, ++ .value = 0, ++ }; + + client->packet_head = client->tail; + } +diff --git a/drivers/input/input.c b/drivers/input/input.c +index 55086279d044..ee6c3234df36 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -878,16 +878,18 @@ static int input_default_setkeycode(struct input_dev *dev, + } + } + +- __clear_bit(*old_keycode, dev->keybit); +- __set_bit(ke->keycode, dev->keybit); +- +- for (i = 0; i < dev->keycodemax; i++) { +- if (input_fetch_keycode(dev, i) == *old_keycode) { +- __set_bit(*old_keycode, dev->keybit); +- break; /* Setting the bit twice is useless, so break */ ++ if (*old_keycode <= KEY_MAX) { ++ __clear_bit(*old_keycode, dev->keybit); ++ for (i = 0; i < dev->keycodemax; i++) { ++ if (input_fetch_keycode(dev, i) == *old_keycode) { ++ __set_bit(*old_keycode, dev->keybit); ++ /* Setting the bit twice is useless, so break */ ++ break; ++ } + } + } + ++ __set_bit(ke->keycode, dev->keybit); + return 0; + } + +@@ -943,9 +945,13 @@ int input_set_keycode(struct input_dev *dev, + * Simulate keyup event if keycode is not present + * in the keymap anymore + */ +- if (test_bit(EV_KEY, dev->evbit) && +- !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && +- __test_and_clear_bit(old_keycode, dev->key)) { ++ if (old_keycode > KEY_MAX) { ++ dev_warn(dev->dev.parent ?: &dev->dev, ++ "%s: got too big old keycode %#x\n", ++ __func__, old_keycode); ++ } else if (test_bit(EV_KEY, dev->evbit) && ++ !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && ++ __test_and_clear_bit(old_keycode, dev->key)) { + struct input_value vals[] = { + { EV_KEY, old_keycode, 0 }, + input_value_sync +diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c +index 84051f20b18a..002654ec7040 100644 +--- a/drivers/input/misc/uinput.c ++++ b/drivers/input/misc/uinput.c +@@ -74,12 +74,16 @@ static int uinput_dev_event(struct input_dev *dev, + struct uinput_device *udev = input_get_drvdata(dev); + struct timespec64 ts; + +- udev->buff[udev->head].type = type; +- udev->buff[udev->head].code = code; +- udev->buff[udev->head].value = value; + ktime_get_ts64(&ts); +- udev->buff[udev->head].input_event_sec = ts.tv_sec; +- udev->buff[udev->head].input_event_usec = ts.tv_nsec / NSEC_PER_USEC; ++ ++ udev->buff[udev->head] = (struct input_event) { ++ .input_event_sec = ts.tv_sec, ++ .input_event_usec = ts.tv_nsec / NSEC_PER_USEC, ++ .type = type, ++ .code = code, ++ .value = value, ++ }; ++ + udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE; + + wake_up_interruptible(&udev->waitq); +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 4ce797d4259f..67aa317de6db 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -5786,6 +5786,13 @@ static void intel_iommu_apply_resv_region(struct device *dev, + WARN_ON_ONCE(!reserve_iova(&dmar_domain->iovad, start, end)); + } + ++static struct iommu_group *intel_iommu_device_group(struct device *dev) ++{ ++ if (dev_is_pci(dev)) ++ return pci_device_group(dev); ++ return generic_device_group(dev); ++} ++ + #ifdef CONFIG_INTEL_IOMMU_SVM + struct intel_iommu *intel_svm_device_to_iommu(struct device *dev) + { +@@ -5958,7 +5965,7 @@ const struct iommu_ops intel_iommu_ops = { + .get_resv_regions = intel_iommu_get_resv_regions, + .put_resv_regions = intel_iommu_put_resv_regions, + .apply_resv_region = intel_iommu_apply_resv_region, +- .device_group = pci_device_group, ++ .device_group = intel_iommu_device_group, + .dev_has_feat = intel_iommu_dev_has_feat, + .dev_feat_enabled = intel_iommu_dev_feat_enabled, + .dev_enable_feat = intel_iommu_dev_enable_feat, +diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c +index d5d4bfa9c8fd..d797912e665a 100644 +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -445,6 +445,10 @@ static int tcan4x5x_can_probe(struct spi_device *spi) + + tcan4x5x_power_enable(priv->power, 1); + ++ ret = tcan4x5x_init(mcan_class); ++ if (ret) ++ goto out_power; ++ + ret = m_can_class_register(mcan_class); + if (ret) + goto out_power; +diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c +index 8caf7af0dee2..99101d7027a8 100644 +--- a/drivers/net/can/mscan/mscan.c ++++ b/drivers/net/can/mscan/mscan.c +@@ -381,13 +381,12 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + struct net_device *dev = napi->dev; + struct mscan_regs __iomem *regs = priv->reg_base; + struct net_device_stats *stats = &dev->stats; +- int npackets = 0; +- int ret = 1; ++ int work_done = 0; + struct sk_buff *skb; + struct can_frame *frame; + u8 canrflg; + +- while (npackets < quota) { ++ while (work_done < quota) { + canrflg = in_8(®s->canrflg); + if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF))) + break; +@@ -408,18 +407,18 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) + + stats->rx_packets++; + stats->rx_bytes += frame->can_dlc; +- npackets++; ++ work_done++; + netif_receive_skb(skb); + } + +- if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) { +- napi_complete(&priv->napi); +- clear_bit(F_RX_PROGRESS, &priv->flags); +- if (priv->can.state < CAN_STATE_BUS_OFF) +- out_8(®s->canrier, priv->shadow_canrier); +- ret = 0; ++ if (work_done < quota) { ++ if (likely(napi_complete_done(&priv->napi, work_done))) { ++ clear_bit(F_RX_PROGRESS, &priv->flags); ++ if (priv->can.state < CAN_STATE_BUS_OFF) ++ out_8(®s->canrier, priv->shadow_canrier); ++ } + } +- return ret; ++ return work_done; + } + + static irqreturn_t mscan_isr(int irq, void *dev_id) +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index 2f74f6704c12..a4b4b742c80c 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -918,7 +918,7 @@ static int gs_usb_probe(struct usb_interface *intf, + GS_USB_BREQ_HOST_FORMAT, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + hconf, + sizeof(*hconf), + 1000); +@@ -941,7 +941,7 @@ static int gs_usb_probe(struct usb_interface *intf, + GS_USB_BREQ_DEVICE_CONFIG, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + dconf, + sizeof(*dconf), + 1000); +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index 5fc0be564274..7ab87a758754 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -1590,7 +1590,7 @@ static int kvaser_usb_hydra_setup_endpoints(struct kvaser_usb *dev) + struct usb_endpoint_descriptor *ep; + int i; + +- iface_desc = &dev->intf->altsetting[0]; ++ iface_desc = dev->intf->cur_altsetting; + + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + ep = &iface_desc->endpoint[i].desc; +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index ae4c37e1bb75..1b9957f12459 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -1310,7 +1310,7 @@ static int kvaser_usb_leaf_setup_endpoints(struct kvaser_usb *dev) + struct usb_endpoint_descriptor *endpoint; + int i; + +- iface_desc = &dev->intf->altsetting[0]; ++ iface_desc = dev->intf->cur_altsetting; + + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; +diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c +index 9ebe74ee4aef..1e0343081be9 100644 +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -443,6 +443,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id, + ath10k_dbg(ar, ATH10K_DBG_USB_BULK, + "usb bulk transmit failed: %d\n", ret); + usb_unanchor_urb(urb); ++ usb_free_urb(urb); + ret = -EINVAL; + goto err_free_urb_to_pipe; + } +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 096334e941a1..fc1706d0647d 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1032,8 +1032,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) + } + skb_put(skb, MWIFIEX_UPLD_SIZE); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); + return -1; ++ } + + card->cmdrsp_buf = skb; + +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +index 74e50566db1f..6dd835f1efc2 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +@@ -229,6 +229,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv, + "11D: skip setting domain info in FW\n"); + return 0; + } ++ ++ if (country_ie_len > ++ (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "11D: country_ie_len overflow!, deauth AP\n"); ++ return -EINVAL; ++ } ++ + memcpy(priv->adapter->country_code, &country_ie[2], 2); + + domain_info->country_code[0] = country_ie[2]; +@@ -272,8 +280,9 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss, + priv->scan_block = false; + + if (bss) { +- if (adapter->region_code == 0x00) +- mwifiex_process_country_ie(priv, bss); ++ if (adapter->region_code == 0x00 && ++ mwifiex_process_country_ie(priv, bss)) ++ return -EINVAL; + + /* Allocate and fill new bss descriptor */ + bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor), +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 361248e97568..e7d96ac673b7 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5447,6 +5447,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) + ret = usb_submit_urb(urb, GFP_KERNEL); + if (ret) { + usb_unanchor_urb(urb); ++ usb_free_urb(urb); + goto error; + } + +diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c +index ead06c6c2601..9a38741d3546 100644 +--- a/drivers/phy/motorola/phy-cpcap-usb.c ++++ b/drivers/phy/motorola/phy-cpcap-usb.c +@@ -207,6 +207,19 @@ static int cpcap_phy_get_ints_state(struct cpcap_phy_ddata *ddata, + static int cpcap_usb_set_uart_mode(struct cpcap_phy_ddata *ddata); + static int cpcap_usb_set_usb_mode(struct cpcap_phy_ddata *ddata); + ++static void cpcap_usb_try_musb_mailbox(struct cpcap_phy_ddata *ddata, ++ enum musb_vbus_id_status status) ++{ ++ int error; ++ ++ error = musb_mailbox(status); ++ if (!error) ++ return; ++ ++ dev_dbg(ddata->dev, "%s: musb_mailbox failed: %i\n", ++ __func__, error); ++} ++ + static void cpcap_usb_detect(struct work_struct *work) + { + struct cpcap_phy_ddata *ddata; +@@ -226,9 +239,7 @@ static void cpcap_usb_detect(struct work_struct *work) + if (error) + goto out_err; + +- error = musb_mailbox(MUSB_ID_GROUND); +- if (error) +- goto out_err; ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND); + + error = regmap_update_bits(ddata->reg, CPCAP_REG_USBC3, + CPCAP_BIT_VBUSSTBY_EN | +@@ -257,9 +268,7 @@ static void cpcap_usb_detect(struct work_struct *work) + error = cpcap_usb_set_usb_mode(ddata); + if (error) + goto out_err; +- error = musb_mailbox(MUSB_ID_GROUND); +- if (error) +- goto out_err; ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND); + + return; + } +@@ -269,22 +278,18 @@ static void cpcap_usb_detect(struct work_struct *work) + error = cpcap_usb_set_usb_mode(ddata); + if (error) + goto out_err; +- error = musb_mailbox(MUSB_VBUS_VALID); +- if (error) +- goto out_err; ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_VALID); + + return; + } + ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); ++ + /* Default to debug UART mode */ + error = cpcap_usb_set_uart_mode(ddata); + if (error) + goto out_err; + +- error = musb_mailbox(MUSB_VBUS_OFF); +- if (error) +- goto out_err; +- + dev_dbg(ddata->dev, "set UART mode\n"); + + return; +@@ -649,9 +654,7 @@ static int cpcap_usb_phy_remove(struct platform_device *pdev) + if (error) + dev_err(ddata->dev, "could not set UART mode\n"); + +- error = musb_mailbox(MUSB_VBUS_OFF); +- if (error) +- dev_err(ddata->dev, "could not set mailbox\n"); ++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); + + usb_remove_phy(&ddata->phy); + cancel_delayed_work_sync(&ddata->detect_work); +diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c +index 94ddd7d659c8..925b0004a0ed 100644 +--- a/drivers/powercap/intel_rapl_common.c ++++ b/drivers/powercap/intel_rapl_common.c +@@ -1293,6 +1293,9 @@ struct rapl_package *rapl_add_package(int cpu, struct rapl_if_priv *priv) + struct cpuinfo_x86 *c = &cpu_data(cpu); + int ret; + ++ if (!rapl_defaults) ++ return ERR_PTR(-ENODEV); ++ + rp = kzalloc(sizeof(struct rapl_package), GFP_KERNEL); + if (!rp) + return ERR_PTR(-ENOMEM); +diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c +index eea5ebbb5119..c655074c07c2 100644 +--- a/drivers/rpmsg/rpmsg_char.c ++++ b/drivers/rpmsg/rpmsg_char.c +@@ -227,8 +227,10 @@ static ssize_t rpmsg_eptdev_write_iter(struct kiocb *iocb, + if (!kbuf) + return -ENOMEM; + +- if (!copy_from_iter_full(kbuf, len, from)) +- return -EFAULT; ++ if (!copy_from_iter_full(kbuf, len, from)) { ++ ret = -EFAULT; ++ goto free_kbuf; ++ } + + if (mutex_lock_interruptible(&eptdev->ept_lock)) { + ret = -ERESTARTSYS; +diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c +index 5e2bd9f1d01e..fc32be687606 100644 +--- a/drivers/rtc/rtc-sun6i.c ++++ b/drivers/rtc/rtc-sun6i.c +@@ -380,6 +380,22 @@ static void __init sun50i_h6_rtc_clk_init(struct device_node *node) + CLK_OF_DECLARE_DRIVER(sun50i_h6_rtc_clk, "allwinner,sun50i-h6-rtc", + sun50i_h6_rtc_clk_init); + ++/* ++ * The R40 user manual is self-conflicting on whether the prescaler is ++ * fixed or configurable. The clock diagram shows it as fixed, but there ++ * is also a configurable divider in the RTC block. ++ */ ++static const struct sun6i_rtc_clk_data sun8i_r40_rtc_data = { ++ .rc_osc_rate = 16000000, ++ .fixed_prescaler = 512, ++}; ++static void __init sun8i_r40_rtc_clk_init(struct device_node *node) ++{ ++ sun6i_rtc_clk_init(node, &sun8i_r40_rtc_data); ++} ++CLK_OF_DECLARE_DRIVER(sun8i_r40_rtc_clk, "allwinner,sun8i-r40-rtc", ++ sun8i_r40_rtc_clk_init); ++ + static const struct sun6i_rtc_clk_data sun8i_v3_rtc_data = { + .rc_osc_rate = 32000, + .has_out_clk = 1, +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index 29ab81df75c0..fbfce02e5b93 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -275,8 +275,10 @@ bfad_im_get_stats(struct Scsi_Host *shost) + rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa), + fcstats, bfad_hcb_comp, &fcomp); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); +- if (rc != BFA_STATUS_OK) ++ if (rc != BFA_STATUS_OK) { ++ kfree(fcstats); + return NULL; ++ } + + wait_for_completion(&fcomp.comp); + +diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c +index dbff0f7e7cf5..ddc0dc93d08b 100644 +--- a/drivers/staging/comedi/drivers/adv_pci1710.c ++++ b/drivers/staging/comedi/drivers/adv_pci1710.c +@@ -46,8 +46,8 @@ + #define PCI171X_RANGE_UNI BIT(4) + #define PCI171X_RANGE_GAIN(x) (((x) & 0x7) << 0) + #define PCI171X_MUX_REG 0x04 /* W: A/D multiplexor control */ +-#define PCI171X_MUX_CHANH(x) (((x) & 0xf) << 8) +-#define PCI171X_MUX_CHANL(x) (((x) & 0xf) << 0) ++#define PCI171X_MUX_CHANH(x) (((x) & 0xff) << 8) ++#define PCI171X_MUX_CHANL(x) (((x) & 0xff) << 0) + #define PCI171X_MUX_CHAN(x) (PCI171X_MUX_CHANH(x) | PCI171X_MUX_CHANL(x)) + #define PCI171X_STATUS_REG 0x06 /* R: status register */ + #define PCI171X_STATUS_IRQ BIT(11) /* 1=IRQ occurred */ +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index a7cac0719b8b..b5d42f411dd8 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -37,6 +37,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = { + {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ + {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ ++ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ + {} /* Terminating entry */ +diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c +index 8d19ae71e7cc..4e651b698617 100644 +--- a/drivers/staging/vt6656/baseband.c ++++ b/drivers/staging/vt6656/baseband.c +@@ -449,8 +449,8 @@ int vnt_vt3184_init(struct vnt_private *priv) + + memcpy(array, addr, length); + +- ret = vnt_control_out(priv, MESSAGE_TYPE_WRITE, 0, +- MESSAGE_REQUEST_BBREG, length, array); ++ ret = vnt_control_out_blocks(priv, VNT_REG_BLOCK_SIZE, ++ MESSAGE_REQUEST_BBREG, length, array); + if (ret) + goto end; + +diff --git a/drivers/staging/vt6656/card.c b/drivers/staging/vt6656/card.c +index 56cd77fd9ea0..7958fc165462 100644 +--- a/drivers/staging/vt6656/card.c ++++ b/drivers/staging/vt6656/card.c +@@ -719,7 +719,7 @@ end: + */ + int vnt_radio_power_on(struct vnt_private *priv) + { +- int ret = true; ++ int ret = 0; + + vnt_exit_deep_sleep(priv); + +diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h +index 6074ceda78bf..50e1c8918040 100644 +--- a/drivers/staging/vt6656/device.h ++++ b/drivers/staging/vt6656/device.h +@@ -259,6 +259,7 @@ struct vnt_private { + u8 mac_hw; + /* netdev */ + struct usb_device *usb; ++ struct usb_interface *intf; + + u64 tsf_time; + u8 rx_rate; +diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c +index 856ba97aec4f..c26882e2bb80 100644 +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -950,7 +950,7 @@ static const struct ieee80211_ops vnt_mac_ops = { + + int vnt_init(struct vnt_private *priv) + { +- if (!(vnt_init_registers(priv))) ++ if (vnt_init_registers(priv)) + return -EAGAIN; + + SET_IEEE80211_PERM_ADDR(priv->hw, priv->permanent_net_addr); +@@ -993,6 +993,7 @@ vt6656_probe(struct usb_interface *intf, const struct usb_device_id *id) + priv = hw->priv; + priv->hw = hw; + priv->usb = udev; ++ priv->intf = intf; + + vnt_set_options(priv); + +diff --git a/drivers/staging/vt6656/usbpipe.c b/drivers/staging/vt6656/usbpipe.c +index d3304df6bd53..d977d4777e4f 100644 +--- a/drivers/staging/vt6656/usbpipe.c ++++ b/drivers/staging/vt6656/usbpipe.c +@@ -59,7 +59,9 @@ int vnt_control_out(struct vnt_private *priv, u8 request, u16 value, + + kfree(usb_buffer); + +- if (ret >= 0 && ret < (int)length) ++ if (ret == (int)length) ++ ret = 0; ++ else + ret = -EIO; + + end_unlock: +@@ -74,6 +76,23 @@ int vnt_control_out_u8(struct vnt_private *priv, u8 reg, u8 reg_off, u8 data) + reg_off, reg, sizeof(u8), &data); + } + ++int vnt_control_out_blocks(struct vnt_private *priv, ++ u16 block, u8 reg, u16 length, u8 *data) ++{ ++ int ret = 0, i; ++ ++ for (i = 0; i < length; i += block) { ++ u16 len = min_t(int, length - i, block); ++ ++ ret = vnt_control_out(priv, MESSAGE_TYPE_WRITE, ++ i, reg, len, data + i); ++ if (ret) ++ goto end; ++ } ++end: ++ return ret; ++} ++ + int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, + u16 index, u16 length, u8 *buffer) + { +@@ -103,7 +122,9 @@ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, + + kfree(usb_buffer); + +- if (ret >= 0 && ret < (int)length) ++ if (ret == (int)length) ++ ret = 0; ++ else + ret = -EIO; + + end_unlock: +diff --git a/drivers/staging/vt6656/usbpipe.h b/drivers/staging/vt6656/usbpipe.h +index 95147ec7b96a..b65d9c01a211 100644 +--- a/drivers/staging/vt6656/usbpipe.h ++++ b/drivers/staging/vt6656/usbpipe.h +@@ -18,6 +18,8 @@ + + #include "device.h" + ++#define VNT_REG_BLOCK_SIZE 64 ++ + int vnt_control_out(struct vnt_private *priv, u8 request, u16 value, + u16 index, u16 length, u8 *buffer); + int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, +@@ -26,6 +28,9 @@ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, + int vnt_control_out_u8(struct vnt_private *priv, u8 reg, u8 ref_off, u8 data); + int vnt_control_in_u8(struct vnt_private *priv, u8 reg, u8 reg_off, u8 *data); + ++int vnt_control_out_blocks(struct vnt_private *priv, ++ u16 block, u8 reg, u16 len, u8 *data); ++ + int vnt_start_interrupt_urb(struct vnt_private *priv); + int vnt_submit_rx_urb(struct vnt_private *priv, struct vnt_rcb *rcb); + int vnt_tx_context(struct vnt_private *priv, +diff --git a/drivers/staging/vt6656/wcmd.c b/drivers/staging/vt6656/wcmd.c +index 3eb2f11a5de1..2c5250ca2801 100644 +--- a/drivers/staging/vt6656/wcmd.c ++++ b/drivers/staging/vt6656/wcmd.c +@@ -99,6 +99,7 @@ void vnt_run_command(struct work_struct *work) + if (vnt_init(priv)) { + /* If fail all ends TODO retry */ + dev_err(&priv->usb->dev, "failed to start\n"); ++ usb_set_intfdata(priv->intf, NULL); + ieee80211_free_hw(priv->hw); + return; + } +diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c +index a0ac16ee6575..a9719858c950 100644 +--- a/drivers/tty/serdev/core.c ++++ b/drivers/tty/serdev/core.c +@@ -582,6 +582,12 @@ static acpi_status acpi_serdev_register_device(struct serdev_controller *ctrl, + return AE_OK; + } + ++static const struct acpi_device_id serdev_acpi_devices_blacklist[] = { ++ { "INT3511", 0 }, ++ { "INT3512", 0 }, ++ { }, ++}; ++ + static acpi_status acpi_serdev_add_device(acpi_handle handle, u32 level, + void *data, void **return_value) + { +@@ -591,6 +597,10 @@ static acpi_status acpi_serdev_add_device(acpi_handle handle, u32 level, + if (acpi_bus_get_device(handle, &adev)) + return AE_OK; + ++ /* Skip if black listed */ ++ if (!acpi_match_device_ids(adev, serdev_acpi_devices_blacklist)) ++ return AE_OK; ++ + return acpi_serdev_register_device(ctrl, adev); + } + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index b0a6eb106edb..7c2782785736 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2834,6 +2834,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport) + if (uport->cons && uport->dev) + of_console_check(uport->dev->of_node, uport->cons->name, uport->line); + ++ tty_port_link_device(port, drv->tty_driver, uport->line); + uart_configure_port(drv, state, uport); + + port->console = uart_console(uport); +diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c +index 4c1e75509303..02f6ca2cb1ba 100644 +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -1375,13 +1375,10 @@ static void cdns3_check_usb_interrupt_proceed(struct cdns3_device *priv_dev, + */ + static irqreturn_t cdns3_device_irq_handler(int irq, void *data) + { +- struct cdns3_device *priv_dev; +- struct cdns3 *cdns = data; ++ struct cdns3_device *priv_dev = data; + irqreturn_t ret = IRQ_NONE; + u32 reg; + +- priv_dev = cdns->gadget_dev; +- + /* check USB device interrupt */ + reg = readl(&priv_dev->regs->usb_ists); + if (reg) { +@@ -1419,14 +1416,12 @@ static irqreturn_t cdns3_device_irq_handler(int irq, void *data) + */ + static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data) + { +- struct cdns3_device *priv_dev; +- struct cdns3 *cdns = data; ++ struct cdns3_device *priv_dev = data; + irqreturn_t ret = IRQ_NONE; + unsigned long flags; + int bit; + u32 reg; + +- priv_dev = cdns->gadget_dev; + spin_lock_irqsave(&priv_dev->lock, flags); + + reg = readl(&priv_dev->regs->usb_ists); +@@ -2539,7 +2534,7 @@ void cdns3_gadget_exit(struct cdns3 *cdns) + + priv_dev = cdns->gadget_dev; + +- devm_free_irq(cdns->dev, cdns->dev_irq, cdns); ++ devm_free_irq(cdns->dev, cdns->dev_irq, priv_dev); + + pm_runtime_mark_last_busy(cdns->dev); + pm_runtime_put_autosuspend(cdns->dev); +@@ -2710,7 +2705,8 @@ static int __cdns3_gadget_init(struct cdns3 *cdns) + ret = devm_request_threaded_irq(cdns->dev, cdns->dev_irq, + cdns3_device_irq_handler, + cdns3_device_thread_irq_handler, +- IRQF_SHARED, dev_name(cdns->dev), cdns); ++ IRQF_SHARED, dev_name(cdns->dev), ++ cdns->gadget_dev); + + if (ret) + goto err0; +diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c +index b45ceb91c735..48e4a5ca1835 100644 +--- a/drivers/usb/chipidea/host.c ++++ b/drivers/usb/chipidea/host.c +@@ -26,6 +26,7 @@ static int (*orig_bus_suspend)(struct usb_hcd *hcd); + + struct ehci_ci_priv { + struct regulator *reg_vbus; ++ bool enabled; + }; + + static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) +@@ -37,7 +38,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + int ret = 0; + int port = HCS_N_PORTS(ehci->hcs_params); + +- if (priv->reg_vbus) { ++ if (priv->reg_vbus && enable != priv->enabled) { + if (port > 1) { + dev_warn(dev, + "Not support multi-port regulator control\n"); +@@ -53,6 +54,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) + enable ? "enable" : "disable", ret); + return ret; + } ++ priv->enabled = enable; + } + + if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) { +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 5e92c6abe306..3e94259406d7 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -392,12 +392,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, + endpoint->desc.wMaxPacketSize = cpu_to_le16(8); + } + +- /* Validate the wMaxPacketSize field */ ++ /* ++ * Validate the wMaxPacketSize field. ++ * Some devices have isochronous endpoints in altsetting 0; ++ * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 ++ * (see the end of section 5.6.3), so don't warn about them. ++ */ + maxp = usb_endpoint_maxp(&endpoint->desc); +- if (maxp == 0) { +- dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n", ++ if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { ++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", + cfgno, inum, asnum, d->bEndpointAddress); +- goto skip_to_next_endpoint_or_interface_descriptor; + } + + /* Find the highest legal maxpacket size for this endpoint */ +diff --git a/drivers/usb/host/ohci-da8xx.c b/drivers/usb/host/ohci-da8xx.c +index 38183ac438c6..1371b0c249ec 100644 +--- a/drivers/usb/host/ohci-da8xx.c ++++ b/drivers/usb/host/ohci-da8xx.c +@@ -415,13 +415,17 @@ static int ohci_da8xx_probe(struct platform_device *pdev) + } + + da8xx_ohci->oc_gpio = devm_gpiod_get_optional(dev, "oc", GPIOD_IN); +- if (IS_ERR(da8xx_ohci->oc_gpio)) ++ if (IS_ERR(da8xx_ohci->oc_gpio)) { ++ error = PTR_ERR(da8xx_ohci->oc_gpio); + goto err; ++ } + + if (da8xx_ohci->oc_gpio) { + oc_irq = gpiod_to_irq(da8xx_ohci->oc_gpio); +- if (oc_irq < 0) ++ if (oc_irq < 0) { ++ error = oc_irq; + goto err; ++ } + + error = devm_request_threaded_irq(dev, oc_irq, NULL, + ohci_da8xx_oc_thread, IRQF_TRIGGER_RISING | +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index bd63450af76a..bf083c1f997f 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1840,6 +1840,9 @@ ATTRIBUTE_GROUPS(musb); + #define MUSB_QUIRK_B_INVALID_VBUS_91 (MUSB_DEVCTL_BDEVICE | \ + (2 << MUSB_DEVCTL_VBUS_SHIFT) | \ + MUSB_DEVCTL_SESSION) ++#define MUSB_QUIRK_B_DISCONNECT_99 (MUSB_DEVCTL_BDEVICE | \ ++ (3 << MUSB_DEVCTL_VBUS_SHIFT) | \ ++ MUSB_DEVCTL_SESSION) + #define MUSB_QUIRK_A_DISCONNECT_19 ((3 << MUSB_DEVCTL_VBUS_SHIFT) | \ + MUSB_DEVCTL_SESSION) + +@@ -1862,6 +1865,11 @@ static void musb_pm_runtime_check_session(struct musb *musb) + s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV | + MUSB_DEVCTL_HR; + switch (devctl & ~s) { ++ case MUSB_QUIRK_B_DISCONNECT_99: ++ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); ++ schedule_delayed_work(&musb->irq_work, ++ msecs_to_jiffies(1000)); ++ break; + case MUSB_QUIRK_B_INVALID_VBUS_91: + if (musb->quirk_retries && !musb->flush_irq_work) { + musb_dbg(musb, +@@ -2310,6 +2318,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl) + musb_disable_interrupts(musb); + musb_writeb(musb->mregs, MUSB_DEVCTL, 0); + ++ /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */ ++ musb_writeb(musb->mregs, MUSB_POWER, 0); ++ + /* Init IRQ workqueue before request_irq */ + INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work); + INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset); +diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c +index 5fc6825745f2..2d3751d885b4 100644 +--- a/drivers/usb/musb/musbhsdma.c ++++ b/drivers/usb/musb/musbhsdma.c +@@ -425,7 +425,7 @@ struct dma_controller *musbhs_dma_controller_create(struct musb *musb, + controller->controller.channel_abort = dma_channel_abort; + + if (request_irq(irq, dma_controller_irq, 0, +- dev_name(musb->controller), &controller->controller)) { ++ dev_name(musb->controller), controller)) { + dev_err(dev, "request_irq %d failed!\n", irq); + musb_dma_controller_destroy(&controller->controller); + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index fea09a3f491f..2d919d0e6e45 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -567,6 +567,9 @@ static void option_instat_callback(struct urb *urb); + /* Interface must have two endpoints */ + #define NUMEP2 BIT(16) + ++/* Device needs ZLP */ ++#define ZLP BIT(17) ++ + + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, +@@ -1198,6 +1201,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, +@@ -2099,6 +2104,9 @@ static int option_attach(struct usb_serial *serial) + if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) + data->use_send_setup = 1; + ++ if (device_flags & ZLP) ++ data->use_zlp = 1; ++ + spin_lock_init(&data->susp_lock); + + usb_set_serial_data(serial, data); +diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h +index 1c120eaf4091..934e9361cf6b 100644 +--- a/drivers/usb/serial/usb-wwan.h ++++ b/drivers/usb/serial/usb-wwan.h +@@ -38,6 +38,7 @@ struct usb_wwan_intf_private { + spinlock_t susp_lock; + unsigned int suspended:1; + unsigned int use_send_setup:1; ++ unsigned int use_zlp:1; + int in_flight; + unsigned int open_ports; + void *private; +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index 7e855c87e4f7..13be21aad2f4 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -461,6 +461,7 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + void (*callback) (struct urb *)) + { + struct usb_serial *serial = port->serial; ++ struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial); + struct urb *urb; + + urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */ +@@ -471,6 +472,9 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, + usb_sndbulkpipe(serial->dev, endpoint) | dir, + buf, len, callback, ctx); + ++ if (intfdata->use_zlp && dir == USB_DIR_OUT) ++ urb->transfer_flags |= URB_ZERO_PACKET; ++ + return urb; + } + +diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c +index c1f7073a56de..8b4ff9fff340 100644 +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -432,20 +432,30 @@ irqreturn_t tcpci_irq(struct tcpci *tcpci) + + if (status & TCPC_ALERT_RX_STATUS) { + struct pd_message msg; +- unsigned int cnt; ++ unsigned int cnt, payload_cnt; + u16 header; + + regmap_read(tcpci->regmap, TCPC_RX_BYTE_CNT, &cnt); ++ /* ++ * 'cnt' corresponds to READABLE_BYTE_COUNT in section 4.4.14 ++ * of the TCPCI spec [Rev 2.0 Ver 1.0 October 2017] and is ++ * defined in table 4-36 as one greater than the number of ++ * bytes received. And that number includes the header. So: ++ */ ++ if (cnt > 3) ++ payload_cnt = cnt - (1 + sizeof(msg.header)); ++ else ++ payload_cnt = 0; + + tcpci_read16(tcpci, TCPC_RX_HDR, &header); + msg.header = cpu_to_le16(header); + +- if (WARN_ON(cnt > sizeof(msg.payload))) +- cnt = sizeof(msg.payload); ++ if (WARN_ON(payload_cnt > sizeof(msg.payload))) ++ payload_cnt = sizeof(msg.payload); + +- if (cnt > 0) ++ if (payload_cnt > 0) + regmap_raw_read(tcpci->regmap, TCPC_RX_DATA, +- &msg.payload, cnt); ++ &msg.payload, payload_cnt); + + /* Read complete, clear RX status alert bit */ + tcpci_write16(tcpci, TCPC_ALERT, TCPC_ALERT_RX_STATUS); +diff --git a/fs/char_dev.c b/fs/char_dev.c +index 00dfe17871ac..c5e6eff5a381 100644 +--- a/fs/char_dev.c ++++ b/fs/char_dev.c +@@ -352,7 +352,7 @@ static struct kobject *cdev_get(struct cdev *p) + + if (owner && !try_module_get(owner)) + return NULL; +- kobj = kobject_get(&p->kobj); ++ kobj = kobject_get_unless_zero(&p->kobj); + if (!kobj) + module_put(owner); + return kobj; +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index 487ee39b438a..013486b5125e 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -583,12 +583,12 @@ static int ramoops_init_przs(const char *name, + prz_ar[i] = persistent_ram_new(*paddr, zone_sz, sig, + &cxt->ecc_info, + cxt->memtype, flags, label); ++ kfree(label); + if (IS_ERR(prz_ar[i])) { + err = PTR_ERR(prz_ar[i]); + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, record_size, + (unsigned long long)*paddr, err); +- kfree(label); + + while (i > 0) { + i--; +@@ -629,12 +629,12 @@ static int ramoops_init_prz(const char *name, + label = kasprintf(GFP_KERNEL, "ramoops:%s", name); + *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, + cxt->memtype, PRZ_FLAG_ZAP_OLD, label); ++ kfree(label); + if (IS_ERR(*prz)) { + int err = PTR_ERR(*prz); + + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, sz, (unsigned long long)*paddr, err); +- kfree(label); + return err; + } + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 8823f65888f0..1f4d8c06f9be 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -574,7 +574,7 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size, + /* Initialize general buffer state. */ + raw_spin_lock_init(&prz->buffer_lock); + prz->flags = flags; +- prz->label = label; ++ prz->label = kstrdup(label, GFP_KERNEL); + + ret = persistent_ram_buffer_map(start, size, prz, memtype); + if (ret) +diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h +index 9b3c720a31b1..5e3d45525bd3 100644 +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -91,6 +92,36 @@ struct can_priv { + #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC)) + #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC)) + ++/* Check for outgoing skbs that have not been created by the CAN subsystem */ ++static inline bool can_skb_headroom_valid(struct net_device *dev, ++ struct sk_buff *skb) ++{ ++ /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */ ++ if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv))) ++ return false; ++ ++ /* af_packet does not apply CAN skb specific settings */ ++ if (skb->ip_summed == CHECKSUM_NONE) { ++ /* init headroom */ ++ can_skb_prv(skb)->ifindex = dev->ifindex; ++ can_skb_prv(skb)->skbcnt = 0; ++ ++ skb->ip_summed = CHECKSUM_UNNECESSARY; ++ ++ /* preform proper loopback on capable devices */ ++ if (dev->flags & IFF_ECHO) ++ skb->pkt_type = PACKET_LOOPBACK; ++ else ++ skb->pkt_type = PACKET_HOST; ++ ++ skb_reset_mac_header(skb); ++ skb_reset_network_header(skb); ++ skb_reset_transport_header(skb); ++ } ++ ++ return true; ++} ++ + /* Drop a given socketbuffer if it does not contain a valid CAN frame. */ + static inline bool can_dropped_invalid_skb(struct net_device *dev, + struct sk_buff *skb) +@@ -108,6 +139,9 @@ static inline bool can_dropped_invalid_skb(struct net_device *dev, + } else + goto inval_skb; + ++ if (!can_skb_headroom_valid(dev, skb)) ++ goto inval_skb; ++ + return false; + + inval_skb: +diff --git a/include/trace/events/preemptirq.h b/include/trace/events/preemptirq.h +index 95fba0471e5b..3f249e150c0c 100644 +--- a/include/trace/events/preemptirq.h ++++ b/include/trace/events/preemptirq.h +@@ -18,13 +18,13 @@ DECLARE_EVENT_CLASS(preemptirq_template, + TP_ARGS(ip, parent_ip), + + TP_STRUCT__entry( +- __field(u32, caller_offs) +- __field(u32, parent_offs) ++ __field(s32, caller_offs) ++ __field(s32, parent_offs) + ), + + TP_fast_assign( +- __entry->caller_offs = (u32)(ip - (unsigned long)_stext); +- __entry->parent_offs = (u32)(parent_ip - (unsigned long)_stext); ++ __entry->caller_offs = (s32)(ip - (unsigned long)_stext); ++ __entry->parent_offs = (s32)(parent_ip - (unsigned long)_stext); + ), + + TP_printk("caller=%pS parent=%pS", +diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h +index f056b2a00d5c..9a61c28ed3ae 100644 +--- a/include/uapi/linux/input.h ++++ b/include/uapi/linux/input.h +@@ -34,6 +34,7 @@ struct input_event { + __kernel_ulong_t __sec; + #if defined(__sparc__) && defined(__arch64__) + unsigned int __usec; ++ unsigned int __pad; + #else + __kernel_ulong_t __usec; + #endif +diff --git a/kernel/fork.c b/kernel/fork.c +index 6cabc124378c..755d8160e001 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2513,6 +2513,16 @@ SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp, + #endif + + #ifdef __ARCH_WANT_SYS_CLONE3 ++ ++/* ++ * copy_thread implementations handle CLONE_SETTLS by reading the TLS value from ++ * the registers containing the syscall arguments for clone. This doesn't work ++ * with clone3 since the TLS value is passed in clone_args instead. ++ */ ++#ifndef CONFIG_HAVE_COPY_THREAD_TLS ++#error clone3 requires copy_thread_tls support in arch ++#endif ++ + noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, + struct clone_args __user *uargs, + size_t usize) +diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c +index 5e43b9664eca..617e297f46dc 100644 +--- a/kernel/trace/trace_sched_wakeup.c ++++ b/kernel/trace/trace_sched_wakeup.c +@@ -630,7 +630,7 @@ static void start_wakeup_tracer(struct trace_array *tr) + if (ret) { + pr_info("wakeup trace: Couldn't activate tracepoint" + " probe to kernel_sched_migrate_task\n"); +- return; ++ goto fail_deprobe_sched_switch; + } + + wakeup_reset(tr); +@@ -648,6 +648,8 @@ static void start_wakeup_tracer(struct trace_array *tr) + printk(KERN_ERR "failed to start wakeup tracer\n"); + + return; ++fail_deprobe_sched_switch: ++ unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); + fail_deprobe_wake_new: + unregister_trace_sched_wakeup_new(probe_wakeup, NULL); + fail_deprobe: +diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c +index 4df9a209f7ca..c557f42a9397 100644 +--- a/kernel/trace/trace_stack.c ++++ b/kernel/trace/trace_stack.c +@@ -283,6 +283,11 @@ static void check_stack(unsigned long ip, unsigned long *stack) + local_irq_restore(flags); + } + ++/* Some archs may not define MCOUNT_INSN_SIZE */ ++#ifndef MCOUNT_INSN_SIZE ++# define MCOUNT_INSN_SIZE 0 ++#endif ++ + static void + stack_trace_call(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *op, struct pt_regs *pt_regs) +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 214154b47d56..069f72edb264 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -384,10 +384,11 @@ next: ; + return 1; + } + +-static inline int check_target(struct arpt_entry *e, const char *name) ++static int check_target(struct arpt_entry *e, struct net *net, const char *name) + { + struct xt_entry_target *t = arpt_get_target(e); + struct xt_tgchk_param par = { ++ .net = net, + .table = name, + .entryinfo = e, + .target = t->u.kernel.target, +@@ -399,8 +400,9 @@ static inline int check_target(struct arpt_entry *e, const char *name) + return xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false); + } + +-static inline int +-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, ++static int ++find_check_entry(struct arpt_entry *e, struct net *net, const char *name, ++ unsigned int size, + struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; +@@ -419,7 +421,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, + } + t->u.kernel.target = target; + +- ret = check_target(e, name); ++ ret = check_target(e, net, name); + if (ret) + goto err; + return 0; +@@ -512,7 +514,9 @@ static inline void cleanup_entry(struct arpt_entry *e) + /* Checks and translates the user-supplied table segment (held in + * newinfo). + */ +-static int translate_table(struct xt_table_info *newinfo, void *entry0, ++static int translate_table(struct net *net, ++ struct xt_table_info *newinfo, ++ void *entry0, + const struct arpt_replace *repl) + { + struct xt_percpu_counter_alloc_state alloc_state = { 0 }; +@@ -569,7 +573,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, repl->name, repl->size, ++ ret = find_check_entry(iter, net, repl->name, repl->size, + &alloc_state); + if (ret != 0) + break; +@@ -974,7 +978,7 @@ static int do_replace(struct net *net, const void __user *user, + goto free_newinfo; + } + +- ret = translate_table(newinfo, loc_cpu_entry, &tmp); ++ ret = translate_table(net, newinfo, loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1149,7 +1153,8 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr, + } + } + +-static int translate_compat_table(struct xt_table_info **pinfo, ++static int translate_compat_table(struct net *net, ++ struct xt_table_info **pinfo, + void **pentry0, + const struct compat_arpt_replace *compatr) + { +@@ -1217,7 +1222,7 @@ static int translate_compat_table(struct xt_table_info **pinfo, + repl.num_counters = 0; + repl.counters = NULL; + repl.size = newinfo->size; +- ret = translate_table(newinfo, entry1, &repl); ++ ret = translate_table(net, newinfo, entry1, &repl); + if (ret) + goto free_newinfo; + +@@ -1270,7 +1275,7 @@ static int compat_do_replace(struct net *net, void __user *user, + goto free_newinfo; + } + +- ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp); ++ ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp); + if (ret != 0) + goto free_newinfo; + +@@ -1546,7 +1551,7 @@ int arpt_register_table(struct net *net, + loc_cpu_entry = newinfo->entries; + memcpy(loc_cpu_entry, repl->entries, repl->size); + +- ret = translate_table(newinfo, loc_cpu_entry, repl); ++ ret = translate_table(net, newinfo, loc_cpu_entry, repl); + if (ret != 0) + goto out_free; + +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index d73d1828216a..d8143a8c034d 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -1658,6 +1658,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, + struct ip_set *set; + struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {}; + int ret = 0; ++ u32 lineno; + + if (unlikely(protocol_min_failed(attr) || + !attr[IPSET_ATTR_SETNAME] || +@@ -1674,7 +1675,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, + return -IPSET_ERR_PROTOCOL; + + rcu_read_lock_bh(); +- ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0); ++ ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0); + rcu_read_unlock_bh(); + /* Userspace can't trigger element to be re-added */ + if (ret == -EAGAIN) +diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c +index b6b14db3955b..b3f4a334f9d7 100644 +--- a/net/netfilter/nf_conntrack_proto_dccp.c ++++ b/net/netfilter/nf_conntrack_proto_dccp.c +@@ -677,6 +677,9 @@ static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[], + unsigned int *timeouts = data; + int i; + ++ if (!timeouts) ++ timeouts = dn->dccp_timeout; ++ + /* set default DCCP timeouts. */ + for (i=0; idccp_timeout[i]; +diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c +index fce3d93f1541..0399ae8f1188 100644 +--- a/net/netfilter/nf_conntrack_proto_sctp.c ++++ b/net/netfilter/nf_conntrack_proto_sctp.c +@@ -594,6 +594,9 @@ static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[], + struct nf_sctp_net *sn = nf_sctp_pernet(net); + int i; + ++ if (!timeouts) ++ timeouts = sn->timeouts; ++ + /* set default SCTP timeouts. */ + for (i=0; itimeouts[i]; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 252888f426de..d293488dc3dd 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -412,6 +412,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0672: + alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */ + break; ++ case 0x10ec0222: + case 0x10ec0623: + alc_update_coef_idx(codec, 0x19, 1<<13, 0); + break; +@@ -430,6 +431,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + break; + case 0x10ec0899: + case 0x10ec0900: ++ case 0x10ec0b00: + case 0x10ec1168: + case 0x10ec1220: + alc_update_coef_idx(codec, 0x7, 1<<1, 0); +@@ -2526,6 +2528,7 @@ static int patch_alc882(struct hda_codec *codec) + case 0x10ec0882: + case 0x10ec0885: + case 0x10ec0900: ++ case 0x10ec0b00: + case 0x10ec1220: + break; + default: +@@ -7257,6 +7260,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x17aa, 0x2292, "Thinkpad X1 Yoga 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1), + SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), +@@ -9295,6 +9299,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { + HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662), + HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882), + HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882), ++ HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882), + {} /* terminator */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index a81c2066499f..82184036437b 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1397,6 +1397,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ + case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ + case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ ++ case USB_ID(0x05a7, 0x1020): /* Bose Companion 5 */ + case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ + case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */ + case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */