From 683d9384e609cbba5fcf2944e1f930b6951b9dc2 Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Thu, 11 Apr 2019 00:01:58 +0200 Subject: [PATCH] [ sunxi & sunxi64 ] Upstream patches, small adjustement, remove deprecated patch, adjust config, briefly tested. --- config/kernel/linux-sunxi-next.config | 3 +- config/kernel/linux-sunxi64-next.config | 4 +- ...d-for-Allwinner-A64-timer-.patch.disabled} | 0 .../kernel/sunxi-next/patch-4.19.25-26.patch | 6420 +++++++++ .../kernel/sunxi-next/patch-4.19.26-27.patch | 2653 ++++ .../kernel/sunxi-next/patch-4.19.27-28.patch | 2598 ++++ .../kernel/sunxi-next/patch-4.19.28-29.patch | 6412 +++++++++ .../kernel/sunxi-next/patch-4.19.29-30.patch | 1866 +++ .../kernel/sunxi-next/patch-4.19.30-31.patch | 12008 ++++++++++++++++ .../kernel/sunxi-next/patch-4.19.31-32.patch | 1514 ++ .../kernel/sunxi-next/patch-4.19.32-33.patch | 4531 ++++++ .../kernel/sunxi-next/patch-4.19.33-34.patch | 6193 ++++++++ 12 files changed, 44199 insertions(+), 3 deletions(-) rename patch/kernel/sunxi-next/{0081-arm64-arch_timer-Workaround-for-Allwinner-A64-timer-.patch => 0081-arm64-arch_timer-Workaround-for-Allwinner-A64-timer-.patch.disabled} (100%) create mode 100644 patch/kernel/sunxi-next/patch-4.19.25-26.patch create mode 100644 patch/kernel/sunxi-next/patch-4.19.26-27.patch create mode 100644 patch/kernel/sunxi-next/patch-4.19.27-28.patch create mode 100644 patch/kernel/sunxi-next/patch-4.19.28-29.patch create mode 100644 patch/kernel/sunxi-next/patch-4.19.29-30.patch create mode 100644 patch/kernel/sunxi-next/patch-4.19.30-31.patch create mode 100644 patch/kernel/sunxi-next/patch-4.19.31-32.patch create mode 100644 patch/kernel/sunxi-next/patch-4.19.32-33.patch create mode 100644 patch/kernel/sunxi-next/patch-4.19.33-34.patch diff --git a/config/kernel/linux-sunxi-next.config b/config/kernel/linux-sunxi-next.config index 4b257b5f27..c73d14d789 100644 --- a/config/kernel/linux-sunxi-next.config +++ b/config/kernel/linux-sunxi-next.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.19.25 Kernel Configuration +# Linux/arm 4.19.34 Kernel Configuration # # @@ -51,6 +51,7 @@ CONFIG_GENERIC_IRQ_PROBE=y CONFIG_GENERIC_IRQ_SHOW=y CONFIG_GENERIC_IRQ_SHOW_LEVEL=y CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y +CONFIG_GENERIC_IRQ_MIGRATION=y CONFIG_HARDIRQS_SW_RESEND=y CONFIG_GENERIC_IRQ_CHIP=y CONFIG_IRQ_DOMAIN=y diff --git a/config/kernel/linux-sunxi64-next.config b/config/kernel/linux-sunxi64-next.config index e9dab2067e..5a42d7665f 100644 --- a/config/kernel/linux-sunxi64-next.config +++ b/config/kernel/linux-sunxi64-next.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 4.19.25 Kernel Configuration +# Linux/arm64 4.19.34 Kernel Configuration # # @@ -5100,7 +5100,7 @@ CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y CONFIG_FSL_ERRATUM_A008585=y # CONFIG_HISILICON_ERRATUM_161010101 is not set # CONFIG_ARM64_ERRATUM_858921 is not set -CONFIG_SUN50I_A64_UNSTABLE_TIMER=y +CONFIG_SUN50I_ERRATUM_UNKNOWN1=y # CONFIG_ARM_TIMER_SP804 is not set CONFIG_MAILBOX=y CONFIG_ARM_MHU=y diff --git a/patch/kernel/sunxi-next/0081-arm64-arch_timer-Workaround-for-Allwinner-A64-timer-.patch b/patch/kernel/sunxi-next/0081-arm64-arch_timer-Workaround-for-Allwinner-A64-timer-.patch.disabled similarity index 100% rename from patch/kernel/sunxi-next/0081-arm64-arch_timer-Workaround-for-Allwinner-A64-timer-.patch rename to patch/kernel/sunxi-next/0081-arm64-arch_timer-Workaround-for-Allwinner-A64-timer-.patch.disabled diff --git a/patch/kernel/sunxi-next/patch-4.19.25-26.patch b/patch/kernel/sunxi-next/patch-4.19.25-26.patch new file mode 100644 index 0000000000..46fc0162b8 --- /dev/null +++ b/patch/kernel/sunxi-next/patch-4.19.25-26.patch @@ -0,0 +1,6420 @@ +diff --git a/Makefile b/Makefile +index 2caa131ff306b..b71076cecba9c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 25 ++SUBLEVEL = 26 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h +index ff7d3232764a2..db681cf4959c8 100644 +--- a/arch/arc/include/asm/cache.h ++++ b/arch/arc/include/asm/cache.h +@@ -52,6 +52,17 @@ + #define cache_line_size() SMP_CACHE_BYTES + #define ARCH_DMA_MINALIGN SMP_CACHE_BYTES + ++/* ++ * Make sure slab-allocated buffers are 64-bit aligned when atomic64_t uses ++ * ARCv2 64-bit atomics (LLOCKD/SCONDD). This guarantess runtime 64-bit ++ * alignment for any atomic64_t embedded in buffer. ++ * Default ARCH_SLAB_MINALIGN is __alignof__(long long) which has a relaxed ++ * value of 4 (and not 8) in ARC ABI. ++ */ ++#if defined(CONFIG_ARC_HAS_LL64) && defined(CONFIG_ARC_HAS_LLSC) ++#define ARCH_SLAB_MINALIGN 8 ++#endif ++ + extern void arc_cache_init(void); + extern char *arc_cache_mumbojumbo(int cpu_id, char *buf, int len); + extern void read_decode_cache_bcr(void); +diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S +index 8b90d25a15cca..1f945d0f40daa 100644 +--- a/arch/arc/kernel/head.S ++++ b/arch/arc/kernel/head.S +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + .macro CPU_EARLY_SETUP + +@@ -47,6 +48,15 @@ + sr r5, [ARC_REG_DC_CTRL] + + 1: ++ ++#ifdef CONFIG_ISA_ARCV2 ++ ; Unaligned access is disabled at reset, so re-enable early as ++ ; gcc 7.3.1 (ARC GNU 2018.03) onwards generates unaligned access ++ ; by default ++ lr r5, [status32] ++ bset r5, r5, STATUS_AD_BIT ++ kflag r5 ++#endif + .endm + + .section .init.text, "ax",@progbits +@@ -93,9 +103,9 @@ ENTRY(stext) + #ifdef CONFIG_ARC_UBOOT_SUPPORT + ; Uboot - kernel ABI + ; r0 = [0] No uboot interaction, [1] cmdline in r2, [2] DTB in r2 +- ; r1 = magic number (board identity, unused as of now ++ ; r1 = magic number (always zero as of now) + ; r2 = pointer to uboot provided cmdline or external DTB in mem +- ; These are handled later in setup_arch() ++ ; These are handled later in handle_uboot_args() + st r0, [@uboot_tag] + st r2, [@uboot_arg] + #endif +diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c +index b2cae79a25d71..62a30e58441c5 100644 +--- a/arch/arc/kernel/setup.c ++++ b/arch/arc/kernel/setup.c +@@ -449,43 +449,80 @@ void setup_processor(void) + arc_chk_core_config(); + } + +-static inline int is_kernel(unsigned long addr) ++static inline bool uboot_arg_invalid(unsigned long addr) + { +- if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end) +- return 1; +- return 0; ++ /* ++ * Check that it is a untranslated address (although MMU is not enabled ++ * yet, it being a high address ensures this is not by fluke) ++ */ ++ if (addr < PAGE_OFFSET) ++ return true; ++ ++ /* Check that address doesn't clobber resident kernel image */ ++ return addr >= (unsigned long)_stext && addr <= (unsigned long)_end; + } + +-void __init setup_arch(char **cmdline_p) ++#define IGNORE_ARGS "Ignore U-boot args: " ++ ++/* uboot_tag values for U-boot - kernel ABI revision 0; see head.S */ ++#define UBOOT_TAG_NONE 0 ++#define UBOOT_TAG_CMDLINE 1 ++#define UBOOT_TAG_DTB 2 ++ ++void __init handle_uboot_args(void) + { ++ bool use_embedded_dtb = true; ++ bool append_cmdline = false; ++ + #ifdef CONFIG_ARC_UBOOT_SUPPORT +- /* make sure that uboot passed pointer to cmdline/dtb is valid */ +- if (uboot_tag && is_kernel((unsigned long)uboot_arg)) +- panic("Invalid uboot arg\n"); ++ /* check that we know this tag */ ++ if (uboot_tag != UBOOT_TAG_NONE && ++ uboot_tag != UBOOT_TAG_CMDLINE && ++ uboot_tag != UBOOT_TAG_DTB) { ++ pr_warn(IGNORE_ARGS "invalid uboot tag: '%08x'\n", uboot_tag); ++ goto ignore_uboot_args; ++ } ++ ++ if (uboot_tag != UBOOT_TAG_NONE && ++ uboot_arg_invalid((unsigned long)uboot_arg)) { ++ pr_warn(IGNORE_ARGS "invalid uboot arg: '%px'\n", uboot_arg); ++ goto ignore_uboot_args; ++ } ++ ++ /* see if U-boot passed an external Device Tree blob */ ++ if (uboot_tag == UBOOT_TAG_DTB) { ++ machine_desc = setup_machine_fdt((void *)uboot_arg); + +- /* See if u-boot passed an external Device Tree blob */ +- machine_desc = setup_machine_fdt(uboot_arg); /* uboot_tag == 2 */ +- if (!machine_desc) ++ /* external Device Tree blob is invalid - use embedded one */ ++ use_embedded_dtb = !machine_desc; ++ } ++ ++ if (uboot_tag == UBOOT_TAG_CMDLINE) ++ append_cmdline = true; ++ ++ignore_uboot_args: + #endif +- { +- /* No, so try the embedded one */ ++ ++ if (use_embedded_dtb) { + machine_desc = setup_machine_fdt(__dtb_start); + if (!machine_desc) + panic("Embedded DT invalid\n"); ++ } + +- /* +- * If we are here, it is established that @uboot_arg didn't +- * point to DT blob. Instead if u-boot says it is cmdline, +- * append to embedded DT cmdline. +- * setup_machine_fdt() would have populated @boot_command_line +- */ +- if (uboot_tag == 1) { +- /* Ensure a whitespace between the 2 cmdlines */ +- strlcat(boot_command_line, " ", COMMAND_LINE_SIZE); +- strlcat(boot_command_line, uboot_arg, +- COMMAND_LINE_SIZE); +- } ++ /* ++ * NOTE: @boot_command_line is populated by setup_machine_fdt() so this ++ * append processing can only happen after. ++ */ ++ if (append_cmdline) { ++ /* Ensure a whitespace between the 2 cmdlines */ ++ strlcat(boot_command_line, " ", COMMAND_LINE_SIZE); ++ strlcat(boot_command_line, uboot_arg, COMMAND_LINE_SIZE); + } ++} ++ ++void __init setup_arch(char **cmdline_p) ++{ ++ handle_uboot_args(); + + /* Save unparsed command line copy for /proc/cmdline */ + *cmdline_p = boot_command_line; +diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c +index 2c118a6ab3587..0dc23fc227ed2 100644 +--- a/arch/arm/probes/kprobes/opt-arm.c ++++ b/arch/arm/probes/kprobes/opt-arm.c +@@ -247,7 +247,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or + } + + /* Copy arch-dep-instance from template. */ +- memcpy(code, (unsigned char *)optprobe_template_entry, ++ memcpy(code, (unsigned long *)&optprobe_template_entry, + TMPL_END_IDX * sizeof(kprobe_opcode_t)); + + /* Adjust buffer according to instruction. */ +diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig +index 951c4231bdb85..4c47b3fd958b6 100644 +--- a/arch/mips/configs/ath79_defconfig ++++ b/arch/mips/configs/ath79_defconfig +@@ -71,6 +71,7 @@ CONFIG_SERIAL_8250_CONSOLE=y + # CONFIG_SERIAL_8250_PCI is not set + CONFIG_SERIAL_8250_NR_UARTS=1 + CONFIG_SERIAL_8250_RUNTIME_UARTS=1 ++CONFIG_SERIAL_OF_PLATFORM=y + CONFIG_SERIAL_AR933X=y + CONFIG_SERIAL_AR933X_CONSOLE=y + # CONFIG_HW_RANDOM is not set +diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c +index d31bc2f012088..fb2b6d0b77c36 100644 +--- a/arch/mips/jazz/jazzdma.c ++++ b/arch/mips/jazz/jazzdma.c +@@ -74,14 +74,15 @@ static int __init vdma_init(void) + get_order(VDMA_PGTBL_SIZE)); + BUG_ON(!pgtbl); + dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE); +- pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); ++ pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl); + + /* + * Clear the R4030 translation table + */ + vdma_pgtbl_init(); + +- r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl)); ++ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, ++ CPHYSADDR((unsigned long)pgtbl)); + r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE); + r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0); + +diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c +index aeb7b1b0f2024..252c00985c973 100644 +--- a/arch/mips/net/ebpf_jit.c ++++ b/arch/mips/net/ebpf_jit.c +@@ -343,12 +343,15 @@ static int build_int_epilogue(struct jit_ctx *ctx, int dest_reg) + const struct bpf_prog *prog = ctx->skf; + int stack_adjust = ctx->stack_size; + int store_offset = stack_adjust - 8; ++ enum reg_val_type td; + int r0 = MIPS_R_V0; + +- if (dest_reg == MIPS_R_RA && +- get_reg_val_type(ctx, prog->len, BPF_REG_0) == REG_32BIT_ZERO_EX) ++ if (dest_reg == MIPS_R_RA) { + /* Don't let zero extended value escape. */ +- emit_instr(ctx, sll, r0, r0, 0); ++ td = get_reg_val_type(ctx, prog->len, BPF_REG_0); ++ if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) ++ emit_instr(ctx, sll, r0, r0, 0); ++ } + + if (ctx->flags & EBPF_SAVE_RA) { + emit_instr(ctx, ld, MIPS_R_RA, store_offset, MIPS_R_SP); +diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c +index 2582df1c529bb..0964c236e3e5a 100644 +--- a/arch/parisc/kernel/ptrace.c ++++ b/arch/parisc/kernel/ptrace.c +@@ -308,15 +308,29 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, + + long do_syscall_trace_enter(struct pt_regs *regs) + { +- if (test_thread_flag(TIF_SYSCALL_TRACE) && +- tracehook_report_syscall_entry(regs)) { ++ if (test_thread_flag(TIF_SYSCALL_TRACE)) { ++ int rc = tracehook_report_syscall_entry(regs); ++ + /* +- * Tracing decided this syscall should not happen or the +- * debugger stored an invalid system call number. Skip +- * the system call and the system call restart handling. ++ * As tracesys_next does not set %r28 to -ENOSYS ++ * when %r20 is set to -1, initialize it here. + */ +- regs->gr[20] = -1UL; +- goto out; ++ regs->gr[28] = -ENOSYS; ++ ++ if (rc) { ++ /* ++ * A nonzero return code from ++ * tracehook_report_syscall_entry() tells us ++ * to prevent the syscall execution. Skip ++ * the syscall call and the syscall restart handling. ++ * ++ * Note that the tracer may also just change ++ * regs->gr[20] to an invalid syscall number, ++ * that is handled by tracesys_next. ++ */ ++ regs->gr[20] = -1UL; ++ return -1; ++ } + } + + /* Do the secure computing check after ptrace. */ +@@ -340,7 +354,6 @@ long do_syscall_trace_enter(struct pt_regs *regs) + regs->gr[24] & 0xffffffff, + regs->gr[23] & 0xffffffff); + +-out: + /* + * Sign extend the syscall number to 64bit since it may have been + * modified by a compat ptrace call +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index 81d4574d1f377..9fd2ff28b8ff2 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -919,11 +919,12 @@ start_here: + + /* set up the PTE pointers for the Abatron bdiGDB. + */ +- tovirt(r6,r6) + lis r5, abatron_pteptrs@h + ori r5, r5, abatron_pteptrs@l + stw r5, 0xf0(0) /* Must match your Abatron config file */ + tophys(r5,r5) ++ lis r6, swapper_pg_dir@h ++ ori r6, r6, swapper_pg_dir@l + stw r6, 0(r5) + + /* Now turn on the MMU for real! */ +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 7bcfa61375c09..98d13c6a64be0 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -337,6 +337,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + unsigned f_mpx = kvm_mpx_supported() ? F(MPX) : 0; + unsigned f_xsaves = kvm_x86_ops->xsaves_supported() ? F(XSAVES) : 0; + unsigned f_umip = kvm_x86_ops->umip_emulated() ? F(UMIP) : 0; ++ unsigned f_la57 = 0; + + /* cpuid 1.edx */ + const u32 kvm_cpuid_1_edx_x86_features = +@@ -491,7 +492,10 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + // TSC_ADJUST is emulated + entry->ebx |= F(TSC_ADJUST); + entry->ecx &= kvm_cpuid_7_0_ecx_x86_features; ++ f_la57 = entry->ecx & F(LA57); + cpuid_mask(&entry->ecx, CPUID_7_ECX); ++ /* Set LA57 based on hardware capability. */ ++ entry->ecx |= f_la57; + entry->ecx |= f_umip; + /* PKU is not yet implemented for shadow paging. */ + if (!tdp_enabled || !boot_cpu_has(X86_FEATURE_OSPKE)) +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 52a7c3faee0cc..782f98b332f05 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -899,10 +899,7 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err) + val = native_read_msr_safe(msr, err); + switch (msr) { + case MSR_IA32_APICBASE: +-#ifdef CONFIG_X86_X2APIC +- if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31)))) +-#endif +- val &= ~X2APIC_ENABLE; ++ val &= ~X2APIC_ENABLE; + break; + } + return val; +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index ea59c01ce8db0..f530d35412428 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -719,6 +719,7 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags) + struct acpi_nfit_memory_map *memdev; + struct acpi_nfit_desc *acpi_desc; + struct nfit_mem *nfit_mem; ++ u16 physical_id; + + mutex_lock(&acpi_desc_lock); + list_for_each_entry(acpi_desc, &acpi_descs, list) { +@@ -726,10 +727,11 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags) + list_for_each_entry(nfit_mem, &acpi_desc->dimms, list) { + memdev = __to_nfit_memdev(nfit_mem); + if (memdev->device_handle == device_handle) { ++ *flags = memdev->flags; ++ physical_id = memdev->physical_id; + mutex_unlock(&acpi_desc->init_mutex); + mutex_unlock(&acpi_desc_lock); +- *flags = memdev->flags; +- return memdev->physical_id; ++ return physical_id; + } + } + mutex_unlock(&acpi_desc->init_mutex); +diff --git a/drivers/atm/he.c b/drivers/atm/he.c +index 29f102dcfec49..329ce9072ee9f 100644 +--- a/drivers/atm/he.c ++++ b/drivers/atm/he.c +@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev) + instead of '/ 512', use '>> 9' to prevent a call + to divdu3 on x86 platforms + */ +- rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9; ++ rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9; + + if (rate_cps < 10) + rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */ +diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c +index 00e954f22bc92..74401e0adb29c 100644 +--- a/drivers/gpio/gpio-mt7621.c ++++ b/drivers/gpio/gpio-mt7621.c +@@ -30,6 +30,7 @@ + #define GPIO_REG_EDGE 0xA0 + + struct mtk_gc { ++ struct irq_chip irq_chip; + struct gpio_chip chip; + spinlock_t lock; + int bank; +@@ -189,13 +190,6 @@ mediatek_gpio_irq_type(struct irq_data *d, unsigned int type) + return 0; + } + +-static struct irq_chip mediatek_gpio_irq_chip = { +- .irq_unmask = mediatek_gpio_irq_unmask, +- .irq_mask = mediatek_gpio_irq_mask, +- .irq_mask_ack = mediatek_gpio_irq_mask, +- .irq_set_type = mediatek_gpio_irq_type, +-}; +- + static int + mediatek_gpio_xlate(struct gpio_chip *chip, + const struct of_phandle_args *spec, u32 *flags) +@@ -254,6 +248,13 @@ mediatek_gpio_bank_probe(struct device *dev, + return ret; + } + ++ rg->irq_chip.name = dev_name(dev); ++ rg->irq_chip.parent_device = dev; ++ rg->irq_chip.irq_unmask = mediatek_gpio_irq_unmask; ++ rg->irq_chip.irq_mask = mediatek_gpio_irq_mask; ++ rg->irq_chip.irq_mask_ack = mediatek_gpio_irq_mask; ++ rg->irq_chip.irq_set_type = mediatek_gpio_irq_type; ++ + if (mtk->gpio_irq) { + /* + * Manually request the irq here instead of passing +@@ -270,14 +271,14 @@ mediatek_gpio_bank_probe(struct device *dev, + return ret; + } + +- ret = gpiochip_irqchip_add(&rg->chip, &mediatek_gpio_irq_chip, ++ ret = gpiochip_irqchip_add(&rg->chip, &rg->irq_chip, + 0, handle_simple_irq, IRQ_TYPE_NONE); + if (ret) { + dev_err(dev, "failed to add gpiochip_irqchip\n"); + return ret; + } + +- gpiochip_set_chained_irqchip(&rg->chip, &mediatek_gpio_irq_chip, ++ gpiochip_set_chained_irqchip(&rg->chip, &rg->irq_chip, + mtk->gpio_irq, NULL); + } + +@@ -310,7 +311,6 @@ mediatek_gpio_probe(struct platform_device *pdev) + mtk->gpio_irq = irq_of_parse_and_map(np, 0); + mtk->dev = dev; + platform_set_drvdata(pdev, mtk); +- mediatek_gpio_irq_chip.name = dev_name(dev); + + for (i = 0; i < MTK_BANK_CNT; i++) { + ret = mediatek_gpio_bank_probe(dev, np, i); +diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c +index 9f3f166f17608..eb27fa76e8fc7 100644 +--- a/drivers/gpio/gpio-pxa.c ++++ b/drivers/gpio/gpio-pxa.c +@@ -245,6 +245,7 @@ static bool pxa_gpio_has_pinctrl(void) + { + switch (gpio_type) { + case PXA3XX_GPIO: ++ case MMP2_GPIO: + return false; + + default: +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index fd825d30edf13..c0396e83f3526 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -159,6 +159,7 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags) + } + + if (amdgpu_device_is_px(dev)) { ++ dev_pm_set_driver_flags(dev->dev, DPM_FLAG_NEVER_SKIP); + pm_runtime_use_autosuspend(dev->dev); + pm_runtime_set_autosuspend_delay(dev->dev, 5000); + pm_runtime_set_active(dev->dev); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +index 80f5db4ef75fd..0805c423a5ce0 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -1072,8 +1072,6 @@ static uint32_t kfd_generate_gpu_id(struct kfd_dev *gpu) + * the GPU device is not already present in the topology device + * list then return NULL. This means a new topology device has to + * be created for this GPU. +- * TODO: Rather than assiging @gpu to first topology device withtout +- * gpu attached, it will better to have more stringent check. + */ + static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu) + { +@@ -1081,12 +1079,20 @@ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu) + struct kfd_topology_device *out_dev = NULL; + + down_write(&topology_lock); +- list_for_each_entry(dev, &topology_device_list, list) ++ list_for_each_entry(dev, &topology_device_list, list) { ++ /* Discrete GPUs need their own topology device list ++ * entries. Don't assign them to CPU/APU nodes. ++ */ ++ if (!gpu->device_info->needs_iommu_device && ++ dev->node_props.cpu_cores_count) ++ continue; ++ + if (!dev->gpu && (dev->node_props.simd_count > 0)) { + dev->gpu = gpu; + out_dev = dev; + break; + } ++ } + up_write(&topology_lock); + return out_dev; + } +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index a851bb07443f0..c5ba9128b7361 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -624,12 +624,13 @@ static int dm_suspend(void *handle) + struct amdgpu_display_manager *dm = &adev->dm; + int ret = 0; + ++ WARN_ON(adev->dm.cached_state); ++ adev->dm.cached_state = drm_atomic_helper_suspend(adev->ddev); ++ + s3_handle_mst(adev->ddev, true); + + amdgpu_dm_irq_suspend(adev); + +- WARN_ON(adev->dm.cached_state); +- adev->dm.cached_state = drm_atomic_helper_suspend(adev->ddev); + + dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D3); + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index 580e7e82034fa..53ccacf99eca4 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -1000,7 +1000,7 @@ void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx) + + pipe_ctx->stream_res.audio->funcs->az_enable(pipe_ctx->stream_res.audio); + +- if (num_audio == 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL) ++ if (num_audio >= 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL) + /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/ + pp_smu->set_pme_wa_enable(&pp_smu->pp_smu); + /* un-mute audio */ +@@ -1017,6 +1017,8 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option) + pipe_ctx->stream_res.stream_enc->funcs->audio_mute_control( + pipe_ctx->stream_res.stream_enc, true); + if (pipe_ctx->stream_res.audio) { ++ struct pp_smu_funcs_rv *pp_smu = dc->res_pool->pp_smu; ++ + if (option != KEEP_ACQUIRED_RESOURCE || + !dc->debug.az_endpoint_mute_only) { + /*only disalbe az_endpoint if power down or free*/ +@@ -1036,6 +1038,9 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option) + update_audio_usage(&dc->current_state->res_ctx, dc->res_pool, pipe_ctx->stream_res.audio, false); + pipe_ctx->stream_res.audio = NULL; + } ++ if (pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL) ++ /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/ ++ pp_smu->set_pme_wa_enable(&pp_smu->pp_smu); + + /* TODO: notify audio driver for if audio modes list changed + * add audio mode list change flag */ +diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c +index 2d6506c08bf72..6f91634880aa2 100644 +--- a/drivers/gpu/drm/i915/intel_fbdev.c ++++ b/drivers/gpu/drm/i915/intel_fbdev.c +@@ -334,8 +334,8 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper, + bool *enabled, int width, int height) + { + struct drm_i915_private *dev_priv = to_i915(fb_helper->dev); +- unsigned long conn_configured, conn_seq, mask; + unsigned int count = min(fb_helper->connector_count, BITS_PER_LONG); ++ unsigned long conn_configured, conn_seq; + int i, j; + bool *save_enabled; + bool fallback = true, ret = true; +@@ -353,10 +353,9 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper, + drm_modeset_backoff(&ctx); + + memcpy(save_enabled, enabled, count); +- mask = GENMASK(count - 1, 0); ++ conn_seq = GENMASK(count - 1, 0); + conn_configured = 0; + retry: +- conn_seq = conn_configured; + for (i = 0; i < count; i++) { + struct drm_fb_helper_connector *fb_conn; + struct drm_connector *connector; +@@ -369,7 +368,8 @@ retry: + if (conn_configured & BIT(i)) + continue; + +- if (conn_seq == 0 && !connector->has_tile) ++ /* First pass, only consider tiled connectors */ ++ if (conn_seq == GENMASK(count - 1, 0) && !connector->has_tile) + continue; + + if (connector->status == connector_status_connected) +@@ -473,8 +473,10 @@ retry: + conn_configured |= BIT(i); + } + +- if ((conn_configured & mask) != mask && conn_configured != conn_seq) ++ if (conn_configured != conn_seq) { /* repeat until no more are found */ ++ conn_seq = conn_configured; + goto retry; ++ } + + /* + * If the BIOS didn't enable everything it could, fall back to have the +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index bf5f294f172fa..611ac340fb289 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -368,8 +368,10 @@ static int meson_probe_remote(struct platform_device *pdev, + remote_node = of_graph_get_remote_port_parent(ep); + if (!remote_node || + remote_node == parent || /* Ignore parent endpoint */ +- !of_device_is_available(remote_node)) ++ !of_device_is_available(remote_node)) { ++ of_node_put(remote_node); + continue; ++ } + + count += meson_probe_remote(pdev, match, remote, remote_node); + +@@ -388,10 +390,13 @@ static int meson_drv_probe(struct platform_device *pdev) + + for_each_endpoint_of_node(np, ep) { + remote = of_graph_get_remote_port_parent(ep); +- if (!remote || !of_device_is_available(remote)) ++ if (!remote || !of_device_is_available(remote)) { ++ of_node_put(remote); + continue; ++ } + + count += meson_probe_remote(pdev, &match, np, remote); ++ of_node_put(remote); + } + + if (count && !match) +diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c +index dec1e081f5295..6a8fb6fd183c3 100644 +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -172,6 +172,7 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags) + } + + if (radeon_is_px(dev)) { ++ dev_pm_set_driver_flags(dev->dev, DPM_FLAG_NEVER_SKIP); + pm_runtime_use_autosuspend(dev->dev); + pm_runtime_set_autosuspend_delay(dev->dev, 5000); + pm_runtime_set_active(dev->dev); +diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c +index d7950b52a1fd9..e30b1f5b9d91a 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_backend.c ++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c +@@ -717,17 +717,18 @@ static struct sun4i_frontend *sun4i_backend_find_frontend(struct sun4i_drv *drv, + remote = of_graph_get_remote_port_parent(ep); + if (!remote) + continue; ++ of_node_put(remote); + + /* does this node match any registered engines? */ + list_for_each_entry(frontend, &drv->frontend_list, list) { + if (remote == frontend->node) { +- of_node_put(remote); + of_node_put(port); ++ of_node_put(ep); + return frontend; + } + } + } +- ++ of_node_put(port); + return ERR_PTR(-EINVAL); + } + +diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c +index e36399213324d..ceb3db6f3fdda 100644 +--- a/drivers/hwmon/tmp421.c ++++ b/drivers/hwmon/tmp421.c +@@ -88,7 +88,7 @@ static const struct of_device_id tmp421_of_match[] = { + .data = (void *)2 + }, + { +- .compatible = "ti,tmp422", ++ .compatible = "ti,tmp442", + .data = (void *)3 + }, + { }, +diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c +index 0d3473b4596e1..21f4239022c7a 100644 +--- a/drivers/infiniband/hw/mthca/mthca_provider.c ++++ b/drivers/infiniband/hw/mthca/mthca_provider.c +@@ -533,7 +533,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd, + { + struct mthca_ucontext *context; + +- qp = kmalloc(sizeof *qp, GFP_KERNEL); ++ qp = kzalloc(sizeof(*qp), GFP_KERNEL); + if (!qp) + return ERR_PTR(-ENOMEM); + +@@ -599,7 +599,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd, + if (pd->uobject) + return ERR_PTR(-EINVAL); + +- qp = kmalloc(sizeof (struct mthca_sqp), GFP_KERNEL); ++ qp = kzalloc(sizeof(struct mthca_sqp), GFP_KERNEL); + if (!qp) + return ERR_PTR(-ENOMEM); + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 0b34e909505f5..2c1114ee0c6da 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2951,7 +2951,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) + { + struct srp_target_port *target = host_to_target(scmnd->device->host); + struct srp_rdma_ch *ch; +- int i, j; + u8 status; + + shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n"); +@@ -2963,15 +2962,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) + if (status) + return FAILED; + +- for (i = 0; i < target->ch_count; i++) { +- ch = &target->ch[i]; +- for (j = 0; j < target->req_ring_size; ++j) { +- struct srp_request *req = &ch->req_ring[j]; +- +- srp_finish_req(ch, req, scmnd->device, DID_RESET << 16); +- } +- } +- + return SUCCESS; + } + +diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c +index 4ac378e489023..40ca1e8fa09fc 100644 +--- a/drivers/isdn/hardware/avm/b1.c ++++ b/drivers/isdn/hardware/avm/b1.c +@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo) + int i, j; + + for (j = 0; j < AVM_MAXVERSION; j++) +- cinfo->version[j] = "\0\0" + 1; ++ cinfo->version[j] = ""; + for (i = 0, j = 0; + j < AVM_MAXVERSION && i < cinfo->versionlen; + j++, i += cinfo->versionbuf[i] + 1) +diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c +index b730037a0e2d3..9cff667b2d245 100644 +--- a/drivers/isdn/i4l/isdn_tty.c ++++ b/drivers/isdn/i4l/isdn_tty.c +@@ -1456,15 +1456,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios) + { + modem_info *info = (modem_info *) tty->driver_data; + ++ mutex_lock(&modem_info_mutex); + if (!old_termios) + isdn_tty_change_speed(info); + else { + if (tty->termios.c_cflag == old_termios->c_cflag && + tty->termios.c_ispeed == old_termios->c_ispeed && +- tty->termios.c_ospeed == old_termios->c_ospeed) ++ tty->termios.c_ospeed == old_termios->c_ospeed) { ++ mutex_unlock(&modem_info_mutex); + return; ++ } + isdn_tty_change_speed(info); + } ++ mutex_unlock(&modem_info_mutex); + } + + /* +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index a2e74feee2b2f..fd64df5a57a5e 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + + /* Let the programs run for couple of ms and check the engine status */ + usleep_range(3000, 6000); +- lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ if (ret) ++ return ret; + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c +index 30d09d1771717..11ab17f64c649 100644 +--- a/drivers/mfd/ab8500-core.c ++++ b/drivers/mfd/ab8500-core.c +@@ -261,7 +261,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank, + mutex_unlock(&ab8500->lock); + dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret); + +- return ret; ++ return (ret < 0) ? ret : 0; + } + + static int ab8500_get_register(struct device *dev, u8 bank, +diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c +index 503979c81dae1..fab3cdc27ed64 100644 +--- a/drivers/mfd/bd9571mwv.c ++++ b/drivers/mfd/bd9571mwv.c +@@ -59,6 +59,7 @@ static const struct regmap_access_table bd9571mwv_writable_table = { + }; + + static const struct regmap_range bd9571mwv_volatile_yes_ranges[] = { ++ regmap_reg_range(BD9571MWV_DVFS_MONIVDAC, BD9571MWV_DVFS_MONIVDAC), + regmap_reg_range(BD9571MWV_GPIO_IN, BD9571MWV_GPIO_IN), + regmap_reg_range(BD9571MWV_GPIO_INT, BD9571MWV_GPIO_INT), + regmap_reg_range(BD9571MWV_INT_INTREQ, BD9571MWV_INT_INTREQ), +diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c +index 6b22d54a540d1..bccde3eac92ca 100644 +--- a/drivers/mfd/cros_ec_dev.c ++++ b/drivers/mfd/cros_ec_dev.c +@@ -499,6 +499,7 @@ static int ec_device_remove(struct platform_device *pdev) + + cros_ec_debugfs_remove(ec); + ++ mfd_remove_devices(ec->dev); + cdev_del(&ec->cdev); + device_unregister(&ec->class_dev); + return 0; +diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c +index 5970b8def5487..aec20e1c7d3d5 100644 +--- a/drivers/mfd/db8500-prcmu.c ++++ b/drivers/mfd/db8500-prcmu.c +@@ -2584,7 +2584,7 @@ static struct irq_chip prcmu_irq_chip = { + .irq_unmask = prcmu_irq_unmask, + }; + +-static __init char *fw_project_name(u32 project) ++static char *fw_project_name(u32 project) + { + switch (project) { + case PRCMU_FW_PROJECT_U8500: +@@ -2732,7 +2732,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size) + INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work); + } + +-static void __init init_prcm_registers(void) ++static void init_prcm_registers(void) + { + u32 val; + +diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c +index c63e331738c17..234febfe6398b 100644 +--- a/drivers/mfd/mc13xxx-core.c ++++ b/drivers/mfd/mc13xxx-core.c +@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, + + mc13xxx->adcflags |= MC13XXX_ADC_WORKING; + +- mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0); ++ ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0); ++ if (ret) ++ goto out; + + adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2; + adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC; +diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c +index 77b64bd64df36..ab24e176ef448 100644 +--- a/drivers/mfd/mt6397-core.c ++++ b/drivers/mfd/mt6397-core.c +@@ -329,8 +329,7 @@ static int mt6397_probe(struct platform_device *pdev) + + default: + dev_err(&pdev->dev, "unsupported chip: %d\n", id); +- ret = -ENODEV; +- break; ++ return -ENODEV; + } + + if (ret) { +diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c +index 52fafea06067e..8d420c37b2a61 100644 +--- a/drivers/mfd/qcom_rpm.c ++++ b/drivers/mfd/qcom_rpm.c +@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev) + return -EFAULT; + } + ++ writel(fw_version[0], RPM_CTRL_REG(rpm, 0)); ++ writel(fw_version[1], RPM_CTRL_REG(rpm, 1)); ++ writel(fw_version[2], RPM_CTRL_REG(rpm, 2)); ++ + dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0], + fw_version[1], + fw_version[2]); +diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c +index 7a30546880a42..fe8d335a4d74d 100644 +--- a/drivers/mfd/ti_am335x_tscadc.c ++++ b/drivers/mfd/ti_am335x_tscadc.c +@@ -264,8 +264,9 @@ static int ti_tscadc_probe(struct platform_device *pdev) + cell->pdata_size = sizeof(tscadc); + } + +- err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells, +- tscadc->used_cells, NULL, 0, NULL); ++ err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO, ++ tscadc->cells, tscadc->used_cells, NULL, ++ 0, NULL); + if (err < 0) + goto err_disable_clk; + +diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c +index 910f569ff77c1..8bcdecf494d05 100644 +--- a/drivers/mfd/tps65218.c ++++ b/drivers/mfd/tps65218.c +@@ -235,9 +235,9 @@ static int tps65218_probe(struct i2c_client *client, + + mutex_init(&tps->tps_lock); + +- ret = regmap_add_irq_chip(tps->regmap, tps->irq, +- IRQF_ONESHOT, 0, &tps65218_irq_chip, +- &tps->irq_data); ++ ret = devm_regmap_add_irq_chip(&client->dev, tps->regmap, tps->irq, ++ IRQF_ONESHOT, 0, &tps65218_irq_chip, ++ &tps->irq_data); + if (ret < 0) + return ret; + +@@ -253,26 +253,9 @@ static int tps65218_probe(struct i2c_client *client, + ARRAY_SIZE(tps65218_cells), NULL, 0, + regmap_irq_get_domain(tps->irq_data)); + +- if (ret < 0) +- goto err_irq; +- +- return 0; +- +-err_irq: +- regmap_del_irq_chip(tps->irq, tps->irq_data); +- + return ret; + } + +-static int tps65218_remove(struct i2c_client *client) +-{ +- struct tps65218 *tps = i2c_get_clientdata(client); +- +- regmap_del_irq_chip(tps->irq, tps->irq_data); +- +- return 0; +-} +- + static const struct i2c_device_id tps65218_id_table[] = { + { "tps65218", TPS65218 }, + { }, +@@ -285,7 +268,6 @@ static struct i2c_driver tps65218_driver = { + .of_match_table = of_tps65218_match_table, + }, + .probe = tps65218_probe, +- .remove = tps65218_remove, + .id_table = tps65218_id_table, + }; + +diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c +index 4be3d239da9ec..299016bc46d90 100644 +--- a/drivers/mfd/twl-core.c ++++ b/drivers/mfd/twl-core.c +@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base, + * letting it generate the right frequencies for USB, MADC, and + * other purposes. + */ +-static inline int __init protect_pm_master(void) ++static inline int protect_pm_master(void) + { + int e = 0; + +@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void) + return e; + } + +-static inline int __init unprotect_pm_master(void) ++static inline int unprotect_pm_master(void) + { + int e = 0; + +diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c +index 1ee68bd440fbc..16c6e2accfaa5 100644 +--- a/drivers/mfd/wm5110-tables.c ++++ b/drivers/mfd/wm5110-tables.c +@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = { + { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */ + { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */ + { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */ ++ { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */ + { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */ + { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */ + { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */ +@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg) + case ARIZONA_ASRC_ENABLE: + case ARIZONA_ASRC_STATUS: + case ARIZONA_ASRC_RATE1: ++ case ARIZONA_ASRC_RATE2: + case ARIZONA_ISRC_1_CTRL_1: + case ARIZONA_ISRC_1_CTRL_2: + case ARIZONA_ISRC_1_CTRL_3: +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 4b73131a0f206..1b5f591cf0a23 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -2595,11 +2595,6 @@ static int ena_restore_device(struct ena_adapter *adapter) + goto err_device_destroy; + } + +- clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags); +- /* Make sure we don't have a race with AENQ Links state handler */ +- if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags)) +- netif_carrier_on(adapter->netdev); +- + rc = ena_enable_msix_and_set_admin_interrupts(adapter, + adapter->num_queues); + if (rc) { +@@ -2616,6 +2611,11 @@ static int ena_restore_device(struct ena_adapter *adapter) + } + + set_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags); ++ ++ clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags); ++ if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags)) ++ netif_carrier_on(adapter->netdev); ++ + mod_timer(&adapter->timer_service, round_jiffies(jiffies + HZ)); + dev_err(&pdev->dev, "Device reset completed successfully\n"); + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 65a22cd9aef26..029730bbe7db1 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2052,6 +2052,7 @@ static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) + bool nonlinear = skb_is_nonlinear(skb); + struct rtnl_link_stats64 *percpu_stats; + struct dpaa_percpu_priv *percpu_priv; ++ struct netdev_queue *txq; + struct dpaa_priv *priv; + struct qm_fd fd; + int offset = 0; +@@ -2101,6 +2102,11 @@ static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) + if (unlikely(err < 0)) + goto skb_to_fd_failed; + ++ txq = netdev_get_tx_queue(net_dev, queue_mapping); ++ ++ /* LLTX requires to do our own update of trans_start */ ++ txq->trans_start = jiffies; ++ + if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) { + fd.cmd |= cpu_to_be32(FM_FD_CMD_UPD); + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +index ad1779fc410e6..a78bfafd212c8 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +@@ -147,12 +147,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle) + struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle); + int i; + +- vf_cb->mac_cb = NULL; +- +- kfree(vf_cb); +- + for (i = 0; i < handle->q_num; i++) + hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0; ++ ++ kfree(vf_cb); + } + + static int hns_ae_wait_flow_down(struct hnae_handle *handle) +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c +index a1aeeb8094c37..f5cd9539980f8 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c +@@ -620,6 +620,8 @@ static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb, + } + #endif + ++#define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN) ++ + /* We reach this function only after checking that any of + * the (IPv4 | IPv6) bits are set in cqe->status. + */ +@@ -627,9 +629,20 @@ static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va, + netdev_features_t dev_features) + { + __wsum hw_checksum = 0; ++ void *hdr; ++ ++ /* CQE csum doesn't cover padding octets in short ethernet ++ * frames. And the pad field is appended prior to calculating ++ * and appending the FCS field. ++ * ++ * Detecting these padded frames requires to verify and parse ++ * IP headers, so we simply force all those small frames to skip ++ * checksum complete. ++ */ ++ if (short_frame(skb->len)) ++ return -EINVAL; + +- void *hdr = (u8 *)va + sizeof(struct ethhdr); +- ++ hdr = (u8 *)va + sizeof(struct ethhdr); + hw_checksum = csum_unfold((__force __sum16)cqe->checksum); + + if (cqe->vlan_my_qpn & cpu_to_be32(MLX4_CQE_CVLAN_PRESENT_MASK) && +@@ -822,6 +835,11 @@ xdp_drop_no_cnt: + skb_record_rx_queue(skb, cq_ring); + + if (likely(dev->features & NETIF_F_RXCSUM)) { ++ /* TODO: For IP non TCP/UDP packets when csum complete is ++ * not an option (not supported or any other reason) we can ++ * actually check cqe IPOK status bit and report ++ * CHECKSUM_UNNECESSARY rather than CHECKSUM_NONE ++ */ + if ((cqe->status & cpu_to_be16(MLX4_CQE_STATUS_TCP | + MLX4_CQE_STATUS_UDP)) && + (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPOK)) && +diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c +index 7262c6310650e..288fca826a55c 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/icm.c ++++ b/drivers/net/ethernet/mellanox/mlx4/icm.c +@@ -57,12 +57,12 @@ static void mlx4_free_icm_pages(struct mlx4_dev *dev, struct mlx4_icm_chunk *chu + int i; + + if (chunk->nsg > 0) +- pci_unmap_sg(dev->persist->pdev, chunk->mem, chunk->npages, ++ pci_unmap_sg(dev->persist->pdev, chunk->sg, chunk->npages, + PCI_DMA_BIDIRECTIONAL); + + for (i = 0; i < chunk->npages; ++i) +- __free_pages(sg_page(&chunk->mem[i]), +- get_order(chunk->mem[i].length)); ++ __free_pages(sg_page(&chunk->sg[i]), ++ get_order(chunk->sg[i].length)); + } + + static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *chunk) +@@ -71,9 +71,9 @@ static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk * + + for (i = 0; i < chunk->npages; ++i) + dma_free_coherent(&dev->persist->pdev->dev, +- chunk->mem[i].length, +- lowmem_page_address(sg_page(&chunk->mem[i])), +- sg_dma_address(&chunk->mem[i])); ++ chunk->buf[i].size, ++ chunk->buf[i].addr, ++ chunk->buf[i].dma_addr); + } + + void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent) +@@ -111,22 +111,21 @@ static int mlx4_alloc_icm_pages(struct scatterlist *mem, int order, + return 0; + } + +-static int mlx4_alloc_icm_coherent(struct device *dev, struct scatterlist *mem, +- int order, gfp_t gfp_mask) ++static int mlx4_alloc_icm_coherent(struct device *dev, struct mlx4_icm_buf *buf, ++ int order, gfp_t gfp_mask) + { +- void *buf = dma_alloc_coherent(dev, PAGE_SIZE << order, +- &sg_dma_address(mem), gfp_mask); +- if (!buf) ++ buf->addr = dma_alloc_coherent(dev, PAGE_SIZE << order, ++ &buf->dma_addr, gfp_mask); ++ if (!buf->addr) + return -ENOMEM; + +- if (offset_in_page(buf)) { +- dma_free_coherent(dev, PAGE_SIZE << order, +- buf, sg_dma_address(mem)); ++ if (offset_in_page(buf->addr)) { ++ dma_free_coherent(dev, PAGE_SIZE << order, buf->addr, ++ buf->dma_addr); + return -ENOMEM; + } + +- sg_set_buf(mem, buf, PAGE_SIZE << order); +- sg_dma_len(mem) = PAGE_SIZE << order; ++ buf->size = PAGE_SIZE << order; + return 0; + } + +@@ -159,21 +158,21 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages, + + while (npages > 0) { + if (!chunk) { +- chunk = kmalloc_node(sizeof(*chunk), ++ chunk = kzalloc_node(sizeof(*chunk), + gfp_mask & ~(__GFP_HIGHMEM | + __GFP_NOWARN), + dev->numa_node); + if (!chunk) { +- chunk = kmalloc(sizeof(*chunk), ++ chunk = kzalloc(sizeof(*chunk), + gfp_mask & ~(__GFP_HIGHMEM | + __GFP_NOWARN)); + if (!chunk) + goto fail; + } ++ chunk->coherent = coherent; + +- sg_init_table(chunk->mem, MLX4_ICM_CHUNK_LEN); +- chunk->npages = 0; +- chunk->nsg = 0; ++ if (!coherent) ++ sg_init_table(chunk->sg, MLX4_ICM_CHUNK_LEN); + list_add_tail(&chunk->list, &icm->chunk_list); + } + +@@ -186,10 +185,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages, + + if (coherent) + ret = mlx4_alloc_icm_coherent(&dev->persist->pdev->dev, +- &chunk->mem[chunk->npages], +- cur_order, mask); ++ &chunk->buf[chunk->npages], ++ cur_order, mask); + else +- ret = mlx4_alloc_icm_pages(&chunk->mem[chunk->npages], ++ ret = mlx4_alloc_icm_pages(&chunk->sg[chunk->npages], + cur_order, mask, + dev->numa_node); + +@@ -205,7 +204,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages, + if (coherent) + ++chunk->nsg; + else if (chunk->npages == MLX4_ICM_CHUNK_LEN) { +- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem, ++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg, + chunk->npages, + PCI_DMA_BIDIRECTIONAL); + +@@ -220,7 +219,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages, + } + + if (!coherent && chunk) { +- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem, ++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg, + chunk->npages, + PCI_DMA_BIDIRECTIONAL); + +@@ -320,7 +319,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj, + u64 idx; + struct mlx4_icm_chunk *chunk; + struct mlx4_icm *icm; +- struct page *page = NULL; ++ void *addr = NULL; + + if (!table->lowmem) + return NULL; +@@ -336,28 +335,49 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj, + + list_for_each_entry(chunk, &icm->chunk_list, list) { + for (i = 0; i < chunk->npages; ++i) { ++ dma_addr_t dma_addr; ++ size_t len; ++ ++ if (table->coherent) { ++ len = chunk->buf[i].size; ++ dma_addr = chunk->buf[i].dma_addr; ++ addr = chunk->buf[i].addr; ++ } else { ++ struct page *page; ++ ++ len = sg_dma_len(&chunk->sg[i]); ++ dma_addr = sg_dma_address(&chunk->sg[i]); ++ ++ /* XXX: we should never do this for highmem ++ * allocation. This function either needs ++ * to be split, or the kernel virtual address ++ * return needs to be made optional. ++ */ ++ page = sg_page(&chunk->sg[i]); ++ addr = lowmem_page_address(page); ++ } ++ + if (dma_handle && dma_offset >= 0) { +- if (sg_dma_len(&chunk->mem[i]) > dma_offset) +- *dma_handle = sg_dma_address(&chunk->mem[i]) + +- dma_offset; +- dma_offset -= sg_dma_len(&chunk->mem[i]); ++ if (len > dma_offset) ++ *dma_handle = dma_addr + dma_offset; ++ dma_offset -= len; + } ++ + /* + * DMA mapping can merge pages but not split them, + * so if we found the page, dma_handle has already + * been assigned to. + */ +- if (chunk->mem[i].length > offset) { +- page = sg_page(&chunk->mem[i]); ++ if (len > offset) + goto out; +- } +- offset -= chunk->mem[i].length; ++ offset -= len; + } + } + ++ addr = NULL; + out: + mutex_unlock(&table->mutex); +- return page ? lowmem_page_address(page) + offset : NULL; ++ return addr ? addr + offset : NULL; + } + + int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table, +diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h +index c9169a490557c..d199874b1c074 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/icm.h ++++ b/drivers/net/ethernet/mellanox/mlx4/icm.h +@@ -47,11 +47,21 @@ enum { + MLX4_ICM_PAGE_SIZE = 1 << MLX4_ICM_PAGE_SHIFT, + }; + ++struct mlx4_icm_buf { ++ void *addr; ++ size_t size; ++ dma_addr_t dma_addr; ++}; ++ + struct mlx4_icm_chunk { + struct list_head list; + int npages; + int nsg; +- struct scatterlist mem[MLX4_ICM_CHUNK_LEN]; ++ bool coherent; ++ union { ++ struct scatterlist sg[MLX4_ICM_CHUNK_LEN]; ++ struct mlx4_icm_buf buf[MLX4_ICM_CHUNK_LEN]; ++ }; + }; + + struct mlx4_icm { +@@ -114,12 +124,18 @@ static inline void mlx4_icm_next(struct mlx4_icm_iter *iter) + + static inline dma_addr_t mlx4_icm_addr(struct mlx4_icm_iter *iter) + { +- return sg_dma_address(&iter->chunk->mem[iter->page_idx]); ++ if (iter->chunk->coherent) ++ return iter->chunk->buf[iter->page_idx].dma_addr; ++ else ++ return sg_dma_address(&iter->chunk->sg[iter->page_idx]); + } + + static inline unsigned long mlx4_icm_size(struct mlx4_icm_iter *iter) + { +- return sg_dma_len(&iter->chunk->mem[iter->page_idx]); ++ if (iter->chunk->coherent) ++ return iter->chunk->buf[iter->page_idx].size; ++ else ++ return sg_dma_len(&iter->chunk->sg[iter->page_idx]); + } + + int mlx4_MAP_ICM_AUX(struct mlx4_dev *dev, struct mlx4_icm *icm); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index 16ceeb1b2c9d8..da52e60d4437c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -633,6 +633,7 @@ enum { + MLX5E_STATE_ASYNC_EVENTS_ENABLED, + MLX5E_STATE_OPENED, + MLX5E_STATE_DESTROYING, ++ MLX5E_STATE_XDP_TX_ENABLED, + }; + + struct mlx5e_rqt { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c +index ad6d471d00dd4..4a33c9a7cac7e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c +@@ -262,7 +262,8 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, + int sq_num; + int i; + +- if (unlikely(!test_bit(MLX5E_STATE_OPENED, &priv->state))) ++ /* this flag is sufficient, no need to test internal sq state */ ++ if (unlikely(!mlx5e_xdp_tx_is_enabled(priv))) + return -ENETDOWN; + + if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) +@@ -275,9 +276,6 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, + + sq = &priv->channels.c[sq_num]->xdpsq; + +- if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state))) +- return -ENETDOWN; +- + for (i = 0; i < n; i++) { + struct xdp_frame *xdpf = frames[i]; + struct mlx5e_xdp_info xdpi; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h +index 6dfab045925f0..4d096623178b9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h +@@ -49,6 +49,23 @@ bool mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq *sq, struct mlx5e_xdp_info *xdpi); + int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, + u32 flags); + ++static inline void mlx5e_xdp_tx_enable(struct mlx5e_priv *priv) ++{ ++ set_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state); ++} ++ ++static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv) ++{ ++ clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state); ++ /* let other device's napi(s) see our new state */ ++ synchronize_rcu(); ++} ++ ++static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv) ++{ ++ return test_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state); ++} ++ + static inline void mlx5e_xmit_xdp_doorbell(struct mlx5e_xdpsq *sq) + { + struct mlx5_wq_cyc *wq = &sq->wq; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 944f21f99d437..637d59c01fe5c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -2890,6 +2890,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv) + + mlx5e_build_tx2sq_maps(priv); + mlx5e_activate_channels(&priv->channels); ++ mlx5e_xdp_tx_enable(priv); + netif_tx_start_all_queues(priv->netdev); + + if (MLX5_ESWITCH_MANAGER(priv->mdev)) +@@ -2911,6 +2912,7 @@ void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv) + */ + netif_tx_stop_all_queues(priv->netdev); + netif_tx_disable(priv->netdev); ++ mlx5e_xdp_tx_disable(priv); + mlx5e_deactivate_channels(&priv->channels); + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index c9cc9747d21d1..701624a63d2f4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -144,6 +144,7 @@ static void mlx5e_rep_update_sw_counters(struct mlx5e_priv *priv) + + s->tx_packets += sq_stats->packets; + s->tx_bytes += sq_stats->bytes; ++ s->tx_queue_dropped += sq_stats->dropped; + } + } + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 3092c59c0dc71..9f7f8425f6767 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -96,6 +96,7 @@ struct mlx5e_tc_flow_parse_attr { + struct ip_tunnel_info tun_info; + struct mlx5_flow_spec spec; + int num_mod_hdr_actions; ++ int max_mod_hdr_actions; + void *mod_hdr_actions; + int mirred_ifindex; + }; +@@ -1742,9 +1743,9 @@ static struct mlx5_fields fields[] = { + OFFLOAD(UDP_DPORT, 2, udp.dest, 0), + }; + +-/* On input attr->num_mod_hdr_actions tells how many HW actions can be parsed at +- * max from the SW pedit action. On success, it says how many HW actions were +- * actually parsed. ++/* On input attr->max_mod_hdr_actions tells how many HW actions can be parsed at ++ * max from the SW pedit action. On success, attr->num_mod_hdr_actions ++ * says how many HW actions were actually parsed. + */ + static int offload_pedit_fields(struct pedit_headers *masks, + struct pedit_headers *vals, +@@ -1767,9 +1768,11 @@ static int offload_pedit_fields(struct pedit_headers *masks, + add_vals = &vals[TCA_PEDIT_KEY_EX_CMD_ADD]; + + action_size = MLX5_UN_SZ_BYTES(set_action_in_add_action_in_auto); +- action = parse_attr->mod_hdr_actions; +- max_actions = parse_attr->num_mod_hdr_actions; +- nactions = 0; ++ action = parse_attr->mod_hdr_actions + ++ parse_attr->num_mod_hdr_actions * action_size; ++ ++ max_actions = parse_attr->max_mod_hdr_actions; ++ nactions = parse_attr->num_mod_hdr_actions; + + for (i = 0; i < ARRAY_SIZE(fields); i++) { + f = &fields[i]; +@@ -1874,7 +1877,7 @@ static int alloc_mod_hdr_actions(struct mlx5e_priv *priv, + if (!parse_attr->mod_hdr_actions) + return -ENOMEM; + +- parse_attr->num_mod_hdr_actions = max_actions; ++ parse_attr->max_mod_hdr_actions = max_actions; + return 0; + } + +@@ -1918,9 +1921,11 @@ static int parse_tc_pedit_action(struct mlx5e_priv *priv, + goto out_err; + } + +- err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr); +- if (err) +- goto out_err; ++ if (!parse_attr->mod_hdr_actions) { ++ err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr); ++ if (err) ++ goto out_err; ++ } + + err = offload_pedit_fields(masks, vals, parse_attr); + if (err < 0) +diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c +index c7901a3f2a794..a903e97793f9a 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c +@@ -1367,10 +1367,10 @@ static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci, + u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY); + + if ((val & MLXSW_PCI_FW_READY_MASK) == MLXSW_PCI_FW_READY_MAGIC) +- break; ++ return 0; + cond_resched(); + } while (time_before(jiffies, end)); +- return 0; ++ return -EBUSY; + } + + static int mlxsw_pci_alloc_irq_vectors(struct mlxsw_pci *mlxsw_pci) +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c +index e3c6fe8b1d406..1dcf152b28138 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c +@@ -75,7 +75,15 @@ mlxsw_sp_acl_ctcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp, + act_set = mlxsw_afa_block_first_set(rulei->act_block); + mlxsw_reg_ptce2_flex_action_set_memcpy_to(ptce2_pl, act_set); + +- return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl); ++ err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl); ++ if (err) ++ goto err_ptce2_write; ++ ++ return 0; ++ ++err_ptce2_write: ++ cregion->ops->entry_remove(cregion, centry); ++ return err; + } + + static void +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index cdec48bcc6ad5..af673abdb4823 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -1209,7 +1209,7 @@ mlxsw_sp_bridge_port_fdb_flush(struct mlxsw_sp *mlxsw_sp, + static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic) + { + return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS : +- MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY; ++ MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG; + } + + static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding) +@@ -1221,7 +1221,7 @@ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding) + static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + const char *mac, u16 fid, bool adding, + enum mlxsw_reg_sfd_rec_action action, +- bool dynamic) ++ enum mlxsw_reg_sfd_rec_policy policy) + { + char *sfd_pl; + u8 num_rec; +@@ -1232,8 +1232,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + return -ENOMEM; + + mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0); +- mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic), +- mac, fid, action, local_port); ++ mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port); + num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl); + err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl); + if (err) +@@ -1252,7 +1251,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + bool dynamic) + { + return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding, +- MLXSW_REG_SFD_REC_ACTION_NOP, dynamic); ++ MLXSW_REG_SFD_REC_ACTION_NOP, ++ mlxsw_sp_sfd_rec_policy(dynamic)); + } + + int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid, +@@ -1260,7 +1260,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid, + { + return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding, + MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER, +- false); ++ MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY); + } + + static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +index 2fa1c050a14b4..92cd8abeb41d7 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +@@ -1592,6 +1592,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn, + cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain); + rx_prod.bd_prod = cpu_to_le16(bd_prod); + rx_prod.cqe_prod = cpu_to_le16(cq_prod); ++ ++ /* Make sure chain element is updated before ringing the doorbell */ ++ dma_wmb(); ++ + DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod)); + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +index 20909036e0028..1c39305274440 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +@@ -260,6 +260,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr, + struct stmmac_extra_stats *x, u32 chan) + { + u32 intr_status = readl(ioaddr + XGMAC_DMA_CH_STATUS(chan)); ++ u32 intr_en = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan)); + int ret = 0; + + /* ABNORMAL interrupts */ +@@ -279,8 +280,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr, + x->normal_irq_n++; + + if (likely(intr_status & XGMAC_RI)) { +- u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan)); +- if (likely(value & XGMAC_RIE)) { ++ if (likely(intr_en & XGMAC_RIE)) { + x->rx_normal_irq_n++; + ret |= handle_rx; + } +@@ -292,7 +292,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr, + } + + /* Clear interrupts */ +- writel(~0x0, ioaddr + XGMAC_DMA_CH_STATUS(chan)); ++ writel(intr_en & intr_status, ioaddr + XGMAC_DMA_CH_STATUS(chan)); + + return ret; + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 2103b865726ac..123b74e25ed81 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -3522,27 +3522,28 @@ static int stmmac_napi_poll(struct napi_struct *napi, int budget) + struct stmmac_channel *ch = + container_of(napi, struct stmmac_channel, napi); + struct stmmac_priv *priv = ch->priv_data; +- int work_done = 0, work_rem = budget; ++ int work_done, rx_done = 0, tx_done = 0; + u32 chan = ch->index; + + priv->xstats.napi_poll++; + +- if (ch->has_tx) { +- int done = stmmac_tx_clean(priv, work_rem, chan); ++ if (ch->has_tx) ++ tx_done = stmmac_tx_clean(priv, budget, chan); ++ if (ch->has_rx) ++ rx_done = stmmac_rx(priv, budget, chan); + +- work_done += done; +- work_rem -= done; +- } +- +- if (ch->has_rx) { +- int done = stmmac_rx(priv, work_rem, chan); ++ work_done = max(rx_done, tx_done); ++ work_done = min(work_done, budget); + +- work_done += done; +- work_rem -= done; +- } ++ if (work_done < budget && napi_complete_done(napi, work_done)) { ++ int stat; + +- if (work_done < budget && napi_complete_done(napi, work_done)) + stmmac_enable_dma_irq(priv, priv->ioaddr, chan); ++ stat = stmmac_dma_interrupt_status(priv, priv->ioaddr, ++ &priv->xstats, chan); ++ if (stat && napi_reschedule(napi)) ++ stmmac_disable_dma_irq(priv, priv->ioaddr, chan); ++ } + + return work_done; + } +@@ -4191,6 +4192,18 @@ static int stmmac_hw_init(struct stmmac_priv *priv) + return ret; + } + ++ /* Rx Watchdog is available in the COREs newer than the 3.40. ++ * In some case, for example on bugged HW this feature ++ * has to be disable and this can be done by passing the ++ * riwt_off field from the platform. ++ */ ++ if (((priv->synopsys_id >= DWMAC_CORE_3_50) || ++ (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) { ++ priv->use_riwt = 1; ++ dev_info(priv->device, ++ "Enable RX Mitigation via HW Watchdog Timer\n"); ++ } ++ + return 0; + } + +@@ -4323,18 +4336,6 @@ int stmmac_dvr_probe(struct device *device, + if (flow_ctrl) + priv->flow_ctrl = FLOW_AUTO; /* RX/TX pause on */ + +- /* Rx Watchdog is available in the COREs newer than the 3.40. +- * In some case, for example on bugged HW this feature +- * has to be disable and this can be done by passing the +- * riwt_off field from the platform. +- */ +- if (((priv->synopsys_id >= DWMAC_CORE_3_50) || +- (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) { +- priv->use_riwt = 1; +- dev_info(priv->device, +- "Enable RX Mitigation via HW Watchdog Timer\n"); +- } +- + /* Setup channels NAPI */ + maxq = max(priv->plat->rx_queues_to_use, priv->plat->tx_queues_to_use); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +index c54a50dbd5ac2..d819e8eaba122 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +@@ -299,7 +299,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev, + */ + static void stmmac_pci_remove(struct pci_dev *pdev) + { ++ int i; ++ + stmmac_dvr_remove(&pdev->dev); ++ ++ for (i = 0; i <= PCI_STD_RESOURCE_END; i++) { ++ if (pci_resource_len(pdev, i) == 0) ++ continue; ++ pcim_iounmap_regions(pdev, BIT(i)); ++ break; ++ } ++ + pci_disable_device(pdev); + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +index 531294f4978bc..58ea18af9813a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +@@ -301,6 +301,8 @@ static int tc_setup_cbs(struct stmmac_priv *priv, + /* Queue 0 is not AVB capable */ + if (queue <= 0 || queue >= tx_queues_count) + return -EINVAL; ++ if (!priv->dma_cap.av) ++ return -EOPNOTSUPP; + if (priv->speed != SPEED_100 && priv->speed != SPEED_1000) + return -EOPNOTSUPP; + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 493cd382b8aa0..01711e6e9a394 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -1406,9 +1406,13 @@ static void geneve_link_config(struct net_device *dev, + } + #if IS_ENABLED(CONFIG_IPV6) + case AF_INET6: { +- struct rt6_info *rt = rt6_lookup(geneve->net, +- &info->key.u.ipv6.dst, NULL, 0, +- NULL, 0); ++ struct rt6_info *rt; ++ ++ if (!__in6_dev_get(dev)) ++ break; ++ ++ rt = rt6_lookup(geneve->net, &info->key.u.ipv6.dst, NULL, 0, ++ NULL, 0); + + if (rt && rt->dst.dev) + ldev_mtu = rt->dst.dev->mtu - GENEVE_IPV6_HLEN; +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 70f3f90c2ed69..2787e8b1d668a 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -502,6 +502,17 @@ static void phylink_run_resolve(struct phylink *pl) + queue_work(system_power_efficient_wq, &pl->resolve); + } + ++static void phylink_run_resolve_and_disable(struct phylink *pl, int bit) ++{ ++ unsigned long state = pl->phylink_disable_state; ++ ++ set_bit(bit, &pl->phylink_disable_state); ++ if (state == 0) { ++ queue_work(system_power_efficient_wq, &pl->resolve); ++ flush_work(&pl->resolve); ++ } ++} ++ + static void phylink_fixed_poll(struct timer_list *t) + { + struct phylink *pl = container_of(t, struct phylink, link_poll); +@@ -955,9 +966,7 @@ void phylink_stop(struct phylink *pl) + if (pl->link_an_mode == MLO_AN_FIXED && !IS_ERR(pl->link_gpio)) + del_timer_sync(&pl->link_poll); + +- set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state); +- queue_work(system_power_efficient_wq, &pl->resolve); +- flush_work(&pl->resolve); ++ phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_STOPPED); + } + EXPORT_SYMBOL_GPL(phylink_stop); + +@@ -1664,9 +1673,7 @@ static void phylink_sfp_link_down(void *upstream) + + ASSERT_RTNL(); + +- set_bit(PHYLINK_DISABLE_LINK, &pl->phylink_disable_state); +- queue_work(system_power_efficient_wq, &pl->resolve); +- flush_work(&pl->resolve); ++ phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_LINK); + } + + static void phylink_sfp_link_up(void *upstream) +diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c +index ad9db652874dc..fef701bfad62e 100644 +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -347,6 +347,7 @@ static int sfp_register_bus(struct sfp_bus *bus) + return ret; + } + } ++ bus->socket_ops->attach(bus->sfp); + if (bus->started) + bus->socket_ops->start(bus->sfp); + bus->netdev->sfp_bus = bus; +@@ -362,6 +363,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus) + if (bus->registered) { + if (bus->started) + bus->socket_ops->stop(bus->sfp); ++ bus->socket_ops->detach(bus->sfp); + if (bus->phydev && ops && ops->disconnect_phy) + ops->disconnect_phy(bus->upstream); + } +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index fd8bb998ae52d..68c8fbf099f87 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -184,6 +184,7 @@ struct sfp { + + struct gpio_desc *gpio[GPIO_MAX]; + ++ bool attached; + unsigned int state; + struct delayed_work poll; + struct delayed_work timeout; +@@ -1475,7 +1476,7 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event) + */ + switch (sfp->sm_mod_state) { + default: +- if (event == SFP_E_INSERT) { ++ if (event == SFP_E_INSERT && sfp->attached) { + sfp_module_tx_disable(sfp); + sfp_sm_ins_next(sfp, SFP_MOD_PROBE, T_PROBE_INIT); + } +@@ -1607,6 +1608,19 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event) + mutex_unlock(&sfp->sm_mutex); + } + ++static void sfp_attach(struct sfp *sfp) ++{ ++ sfp->attached = true; ++ if (sfp->state & SFP_F_PRESENT) ++ sfp_sm_event(sfp, SFP_E_INSERT); ++} ++ ++static void sfp_detach(struct sfp *sfp) ++{ ++ sfp->attached = false; ++ sfp_sm_event(sfp, SFP_E_REMOVE); ++} ++ + static void sfp_start(struct sfp *sfp) + { + sfp_sm_event(sfp, SFP_E_DEV_UP); +@@ -1667,6 +1681,8 @@ static int sfp_module_eeprom(struct sfp *sfp, struct ethtool_eeprom *ee, + } + + static const struct sfp_socket_ops sfp_module_ops = { ++ .attach = sfp_attach, ++ .detach = sfp_detach, + .start = sfp_start, + .stop = sfp_stop, + .module_info = sfp_module_info, +@@ -1834,10 +1850,6 @@ static int sfp_probe(struct platform_device *pdev) + dev_info(sfp->dev, "Host maximum power %u.%uW\n", + sfp->max_power_mW / 1000, (sfp->max_power_mW / 100) % 10); + +- sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops); +- if (!sfp->sfp_bus) +- return -ENOMEM; +- + /* Get the initial state, and always signal TX disable, + * since the network interface will not be up. + */ +@@ -1848,10 +1860,6 @@ static int sfp_probe(struct platform_device *pdev) + sfp->state |= SFP_F_RATE_SELECT; + sfp_set_state(sfp, sfp->state); + sfp_module_tx_disable(sfp); +- rtnl_lock(); +- if (sfp->state & SFP_F_PRESENT) +- sfp_sm_event(sfp, SFP_E_INSERT); +- rtnl_unlock(); + + for (i = 0; i < GPIO_MAX; i++) { + if (gpio_flags[i] != GPIOD_IN || !sfp->gpio[i]) +@@ -1884,6 +1892,10 @@ static int sfp_probe(struct platform_device *pdev) + dev_warn(sfp->dev, + "No tx_disable pin: SFP modules will always be emitting.\n"); + ++ sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops); ++ if (!sfp->sfp_bus) ++ return -ENOMEM; ++ + return 0; + } + +diff --git a/drivers/net/phy/sfp.h b/drivers/net/phy/sfp.h +index 31b0acf337e27..64f54b0bbd8c4 100644 +--- a/drivers/net/phy/sfp.h ++++ b/drivers/net/phy/sfp.h +@@ -7,6 +7,8 @@ + struct sfp; + + struct sfp_socket_ops { ++ void (*attach)(struct sfp *sfp); ++ void (*detach)(struct sfp *sfp); + void (*start)(struct sfp *sfp); + void (*stop)(struct sfp *sfp); + int (*module_info)(struct sfp *sfp, struct ethtool_modinfo *modinfo); +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 4b6572f0188a7..723814d84b7d8 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -256,17 +256,6 @@ static void __team_option_inst_mark_removed_port(struct team *team, + } + } + +-static bool __team_option_inst_tmp_find(const struct list_head *opts, +- const struct team_option_inst *needle) +-{ +- struct team_option_inst *opt_inst; +- +- list_for_each_entry(opt_inst, opts, tmp_list) +- if (opt_inst == needle) +- return true; +- return false; +-} +- + static int __team_options_register(struct team *team, + const struct team_option *option, + size_t option_count) +@@ -2463,7 +2452,6 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info) + int err = 0; + int i; + struct nlattr *nl_option; +- LIST_HEAD(opt_inst_list); + + rtnl_lock(); + +@@ -2483,6 +2471,7 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info) + struct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX + 1]; + struct nlattr *attr; + struct nlattr *attr_data; ++ LIST_HEAD(opt_inst_list); + enum team_option_type opt_type; + int opt_port_ifindex = 0; /* != 0 for per-port options */ + u32 opt_array_index = 0; +@@ -2587,23 +2576,17 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info) + if (err) + goto team_put; + opt_inst->changed = true; +- +- /* dumb/evil user-space can send us duplicate opt, +- * keep only the last one +- */ +- if (__team_option_inst_tmp_find(&opt_inst_list, +- opt_inst)) +- continue; +- + list_add(&opt_inst->tmp_list, &opt_inst_list); + } + if (!opt_found) { + err = -ENOENT; + goto team_put; + } +- } + +- err = team_nl_send_event_options_get(team, &opt_inst_list); ++ err = team_nl_send_event_options_get(team, &opt_inst_list); ++ if (err) ++ break; ++ } + + team_put: + team_nl_team_put(team); +diff --git a/drivers/pinctrl/pinctrl-max77620.c b/drivers/pinctrl/pinctrl-max77620.c +index a7f37063518ec..3d05bc1937d40 100644 +--- a/drivers/pinctrl/pinctrl-max77620.c ++++ b/drivers/pinctrl/pinctrl-max77620.c +@@ -34,14 +34,12 @@ enum max77620_pin_ppdrv { + MAX77620_PIN_PP_DRV, + }; + +-enum max77620_pinconf_param { +- MAX77620_ACTIVE_FPS_SOURCE = PIN_CONFIG_END + 1, +- MAX77620_ACTIVE_FPS_POWER_ON_SLOTS, +- MAX77620_ACTIVE_FPS_POWER_DOWN_SLOTS, +- MAX77620_SUSPEND_FPS_SOURCE, +- MAX77620_SUSPEND_FPS_POWER_ON_SLOTS, +- MAX77620_SUSPEND_FPS_POWER_DOWN_SLOTS, +-}; ++#define MAX77620_ACTIVE_FPS_SOURCE (PIN_CONFIG_END + 1) ++#define MAX77620_ACTIVE_FPS_POWER_ON_SLOTS (PIN_CONFIG_END + 2) ++#define MAX77620_ACTIVE_FPS_POWER_DOWN_SLOTS (PIN_CONFIG_END + 3) ++#define MAX77620_SUSPEND_FPS_SOURCE (PIN_CONFIG_END + 4) ++#define MAX77620_SUSPEND_FPS_POWER_ON_SLOTS (PIN_CONFIG_END + 5) ++#define MAX77620_SUSPEND_FPS_POWER_DOWN_SLOTS (PIN_CONFIG_END + 6) + + struct max77620_pin_function { + const char *name; +diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c +index bf07735275a49..0fc382cb977bf 100644 +--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c ++++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c +@@ -1144,7 +1144,7 @@ static void ddp_clear_map(struct cxgbi_device *cdev, struct cxgbi_ppm *ppm, + } + + static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, +- unsigned int tid, int pg_idx, bool reply) ++ unsigned int tid, int pg_idx) + { + struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0, + GFP_KERNEL); +@@ -1160,7 +1160,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, + req = (struct cpl_set_tcb_field *)skb->head; + req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD)); + OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid)); +- req->reply = V_NO_REPLY(reply ? 0 : 1); ++ req->reply = V_NO_REPLY(1); + req->cpu_idx = 0; + req->word = htons(31); + req->mask = cpu_to_be64(0xF0000000); +@@ -1177,11 +1177,10 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, + * @tid: connection id + * @hcrc: header digest enabled + * @dcrc: data digest enabled +- * @reply: request reply from h/w + * set up the iscsi digest settings for a connection identified by tid + */ + static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, +- int hcrc, int dcrc, int reply) ++ int hcrc, int dcrc) + { + struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0, + GFP_KERNEL); +@@ -1197,7 +1196,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, + req = (struct cpl_set_tcb_field *)skb->head; + req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD)); + OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid)); +- req->reply = V_NO_REPLY(reply ? 0 : 1); ++ req->reply = V_NO_REPLY(1); + req->cpu_idx = 0; + req->word = htons(31); + req->mask = cpu_to_be64(0x0F000000); +diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c +index 211da1d5a8699..689d6c813a50d 100644 +--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c ++++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c +@@ -1517,16 +1517,22 @@ static void do_set_tcb_rpl(struct cxgbi_device *cdev, struct sk_buff *skb) + struct cxgbi_sock *csk; + + csk = lookup_tid(t, tid); +- if (!csk) ++ if (!csk) { + pr_err("can't find conn. for tid %u.\n", tid); ++ return; ++ } + + log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK, + "csk 0x%p,%u,%lx,%u, status 0x%x.\n", + csk, csk->state, csk->flags, csk->tid, rpl->status); + +- if (rpl->status != CPL_ERR_NONE) ++ if (rpl->status != CPL_ERR_NONE) { + pr_err("csk 0x%p,%u, SET_TCB_RPL status %u.\n", + csk, tid, rpl->status); ++ csk->err = -EINVAL; ++ } ++ ++ complete(&csk->cmpl); + + __kfree_skb(skb); + } +@@ -1903,7 +1909,7 @@ static int ddp_set_map(struct cxgbi_ppm *ppm, struct cxgbi_sock *csk, + } + + static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid, +- int pg_idx, bool reply) ++ int pg_idx) + { + struct sk_buff *skb; + struct cpl_set_tcb_field *req; +@@ -1919,7 +1925,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid, + req = (struct cpl_set_tcb_field *)skb->head; + INIT_TP_WR(req, csk->tid); + OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, csk->tid)); +- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid)); ++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid)); + req->word_cookie = htons(0); + req->mask = cpu_to_be64(0x3 << 8); + req->val = cpu_to_be64(pg_idx << 8); +@@ -1928,12 +1934,15 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid, + log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK, + "csk 0x%p, tid 0x%x, pg_idx %u.\n", csk, csk->tid, pg_idx); + ++ reinit_completion(&csk->cmpl); + cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb); +- return 0; ++ wait_for_completion(&csk->cmpl); ++ ++ return csk->err; + } + + static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, +- int hcrc, int dcrc, int reply) ++ int hcrc, int dcrc) + { + struct sk_buff *skb; + struct cpl_set_tcb_field *req; +@@ -1951,7 +1960,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, + req = (struct cpl_set_tcb_field *)skb->head; + INIT_TP_WR(req, tid); + OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid)); +- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid)); ++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid)); + req->word_cookie = htons(0); + req->mask = cpu_to_be64(0x3 << 4); + req->val = cpu_to_be64(((hcrc ? ULP_CRC_HEADER : 0) | +@@ -1961,8 +1970,11 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, + log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK, + "csk 0x%p, tid 0x%x, crc %d,%d.\n", csk, csk->tid, hcrc, dcrc); + ++ reinit_completion(&csk->cmpl); + cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb); +- return 0; ++ wait_for_completion(&csk->cmpl); ++ ++ return csk->err; + } + + static struct cxgbi_ppm *cdev2ppm(struct cxgbi_device *cdev) +diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c +index 3f3af5e74a07d..f2c561ca731a3 100644 +--- a/drivers/scsi/cxgbi/libcxgbi.c ++++ b/drivers/scsi/cxgbi/libcxgbi.c +@@ -573,6 +573,7 @@ static struct cxgbi_sock *cxgbi_sock_create(struct cxgbi_device *cdev) + skb_queue_head_init(&csk->receive_queue); + skb_queue_head_init(&csk->write_queue); + timer_setup(&csk->retry_timer, NULL, 0); ++ init_completion(&csk->cmpl); + rwlock_init(&csk->callback_lock); + csk->cdev = cdev; + csk->flags = 0; +@@ -2252,14 +2253,14 @@ int cxgbi_set_conn_param(struct iscsi_cls_conn *cls_conn, + if (!err && conn->hdrdgst_en) + err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid, + conn->hdrdgst_en, +- conn->datadgst_en, 0); ++ conn->datadgst_en); + break; + case ISCSI_PARAM_DATADGST_EN: + err = iscsi_set_param(cls_conn, param, buf, buflen); + if (!err && conn->datadgst_en) + err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid, + conn->hdrdgst_en, +- conn->datadgst_en, 0); ++ conn->datadgst_en); + break; + case ISCSI_PARAM_MAX_R2T: + return iscsi_tcp_set_max_r2t(conn, buf); +@@ -2385,7 +2386,7 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_session, + + ppm = csk->cdev->cdev2ppm(csk->cdev); + err = csk->cdev->csk_ddp_setup_pgidx(csk, csk->tid, +- ppm->tformat.pgsz_idx_dflt, 0); ++ ppm->tformat.pgsz_idx_dflt); + if (err < 0) + return err; + +diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h +index dcb190e753434..3bf7414a75e5e 100644 +--- a/drivers/scsi/cxgbi/libcxgbi.h ++++ b/drivers/scsi/cxgbi/libcxgbi.h +@@ -146,6 +146,7 @@ struct cxgbi_sock { + struct sk_buff_head receive_queue; + struct sk_buff_head write_queue; + struct timer_list retry_timer; ++ struct completion cmpl; + int err; + rwlock_t callback_lock; + void *user_data; +@@ -487,9 +488,9 @@ struct cxgbi_device { + struct cxgbi_ppm *, + struct cxgbi_task_tag_info *); + int (*csk_ddp_setup_digest)(struct cxgbi_sock *, +- unsigned int, int, int, int); ++ unsigned int, int, int); + int (*csk_ddp_setup_pgidx)(struct cxgbi_sock *, +- unsigned int, int, bool); ++ unsigned int, int); + + void (*csk_release_offload_resources)(struct cxgbi_sock *); + int (*csk_rx_pdu_ready)(struct cxgbi_sock *, struct sk_buff *); +diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c +index 08c7b1e25fe48..dde84f7443136 100644 +--- a/drivers/scsi/isci/init.c ++++ b/drivers/scsi/isci/init.c +@@ -588,6 +588,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id) + shost->max_lun = ~0; + shost->max_cmd_len = MAX_COMMAND_SIZE; + ++ /* turn on DIF support */ ++ scsi_host_set_prot(shost, ++ SHOST_DIF_TYPE1_PROTECTION | ++ SHOST_DIF_TYPE2_PROTECTION | ++ SHOST_DIF_TYPE3_PROTECTION); ++ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC); ++ + err = scsi_add_host(shost, &pdev->dev); + if (err) + goto err_shost; +@@ -675,13 +682,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + goto err_host_alloc; + } + pci_info->hosts[i] = h; +- +- /* turn on DIF support */ +- scsi_host_set_prot(to_shost(h), +- SHOST_DIF_TYPE1_PROTECTION | +- SHOST_DIF_TYPE2_PROTECTION | +- SHOST_DIF_TYPE3_PROTECTION); +- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC); + } + + err = isci_setup_interrupts(pdev); +diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c +index 2f0a4f2c5ff80..d4821b9dea45d 100644 +--- a/drivers/scsi/qedi/qedi_iscsi.c ++++ b/drivers/scsi/qedi/qedi_iscsi.c +@@ -954,6 +954,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms) + + qedi_ep = ep->dd_data; + if (qedi_ep->state == EP_STATE_IDLE || ++ qedi_ep->state == EP_STATE_OFLDCONN_NONE || + qedi_ep->state == EP_STATE_OFLDCONN_FAILED) + return -1; + +@@ -1036,6 +1037,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep) + + switch (qedi_ep->state) { + case EP_STATE_OFLDCONN_START: ++ case EP_STATE_OFLDCONN_NONE: + goto ep_release_conn; + case EP_STATE_OFLDCONN_FAILED: + break; +@@ -1226,6 +1228,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data) + + if (!is_valid_ether_addr(&path_data->mac_addr[0])) { + QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n"); ++ qedi_ep->state = EP_STATE_OFLDCONN_NONE; + ret = -EIO; + goto set_path_exit; + } +diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h +index 11260776212fa..892d70d545537 100644 +--- a/drivers/scsi/qedi/qedi_iscsi.h ++++ b/drivers/scsi/qedi/qedi_iscsi.h +@@ -59,6 +59,7 @@ enum { + EP_STATE_OFLDCONN_FAILED = 0x2000, + EP_STATE_CONNECT_FAILED = 0x4000, + EP_STATE_DISCONN_TIMEDOUT = 0x8000, ++ EP_STATE_OFLDCONN_NONE = 0x10000, + }; + + struct qedi_conn; +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 0e13349dce570..575445c761b48 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -7237,6 +7237,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha, + + rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn, + fw_ddb_entry); ++ if (rc) ++ goto free_sess; + + ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n", + __func__, fnode_sess->dev.kobj.name); +diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h +index 14e5bf7af0bb1..c3bcaaec0fc5c 100644 +--- a/drivers/scsi/ufs/ufs.h ++++ b/drivers/scsi/ufs/ufs.h +@@ -195,7 +195,7 @@ enum ufs_desc_def_size { + QUERY_DESC_CONFIGURATION_DEF_SIZE = 0x90, + QUERY_DESC_UNIT_DEF_SIZE = 0x23, + QUERY_DESC_INTERCONNECT_DEF_SIZE = 0x06, +- QUERY_DESC_GEOMETRY_DEF_SIZE = 0x44, ++ QUERY_DESC_GEOMETRY_DEF_SIZE = 0x48, + QUERY_DESC_POWER_DEF_SIZE = 0x62, + QUERY_DESC_HEALTH_DEF_SIZE = 0x25, + }; +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 12ddb5928a738..6e80dfe4fa979 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -7768,6 +7768,8 @@ out: + trace_ufshcd_system_resume(dev_name(hba->dev), ret, + ktime_to_us(ktime_sub(ktime_get(), start)), + hba->curr_dev_pwr_mode, hba->uic_link_state); ++ if (!ret) ++ hba->is_sys_suspended = false; + return ret; + } + EXPORT_SYMBOL(ufshcd_system_resume); +diff --git a/drivers/staging/erofs/data.c b/drivers/staging/erofs/data.c +index ac263a180253e..894e60ecebe20 100644 +--- a/drivers/staging/erofs/data.c ++++ b/drivers/staging/erofs/data.c +@@ -25,7 +25,7 @@ static inline void read_endio(struct bio *bio) + struct page *page = bvec->bv_page; + + /* page is already locked */ +- BUG_ON(PageUptodate(page)); ++ DBG_BUGON(PageUptodate(page)); + + if (unlikely(err)) + SetPageError(page); +@@ -91,12 +91,12 @@ static int erofs_map_blocks_flatmode(struct inode *inode, + struct erofs_map_blocks *map, + int flags) + { ++ int err = 0; + erofs_blk_t nblocks, lastblk; + u64 offset = map->m_la; + struct erofs_vnode *vi = EROFS_V(inode); + + trace_erofs_map_blocks_flatmode_enter(inode, map, flags); +- BUG_ON(is_inode_layout_compression(inode)); + + nblocks = DIV_ROUND_UP(inode->i_size, PAGE_SIZE); + lastblk = nblocks - is_inode_layout_inline(inode); +@@ -123,18 +123,27 @@ static int erofs_map_blocks_flatmode(struct inode *inode, + map->m_plen = inode->i_size - offset; + + /* inline data should locate in one meta block */ +- BUG_ON(erofs_blkoff(map->m_pa) + map->m_plen > PAGE_SIZE); ++ if (erofs_blkoff(map->m_pa) + map->m_plen > PAGE_SIZE) { ++ DBG_BUGON(1); ++ err = -EIO; ++ goto err_out; ++ } ++ + map->m_flags |= EROFS_MAP_META; + } else { + errln("internal error @ nid: %llu (size %llu), m_la 0x%llx", + vi->nid, inode->i_size, map->m_la); +- BUG(); ++ DBG_BUGON(1); ++ err = -EIO; ++ goto err_out; + } + + out: + map->m_llen = map->m_plen; ++ ++err_out: + trace_erofs_map_blocks_flatmode_exit(inode, map, flags, 0); +- return 0; ++ return err; + } + + #ifdef CONFIG_EROFS_FS_ZIP +@@ -190,7 +199,7 @@ static inline struct bio *erofs_read_raw_page( + erofs_off_t current_block = (erofs_off_t)page->index; + int err; + +- BUG_ON(!nblocks); ++ DBG_BUGON(!nblocks); + + if (PageUptodate(page)) { + err = 0; +@@ -233,7 +242,7 @@ submit_bio_retry: + } + + /* for RAW access mode, m_plen must be equal to m_llen */ +- BUG_ON(map.m_plen != map.m_llen); ++ DBG_BUGON(map.m_plen != map.m_llen); + + blknr = erofs_blknr(map.m_pa); + blkoff = erofs_blkoff(map.m_pa); +@@ -243,7 +252,7 @@ submit_bio_retry: + void *vsrc, *vto; + struct page *ipage; + +- BUG_ON(map.m_plen > PAGE_SIZE); ++ DBG_BUGON(map.m_plen > PAGE_SIZE); + + ipage = erofs_get_meta_page(inode->i_sb, blknr, 0); + +@@ -270,7 +279,7 @@ submit_bio_retry: + } + + /* pa must be block-aligned for raw reading */ +- BUG_ON(erofs_blkoff(map.m_pa) != 0); ++ DBG_BUGON(erofs_blkoff(map.m_pa)); + + /* max # of continuous pages */ + if (nblocks > DIV_ROUND_UP(map.m_plen, PAGE_SIZE)) +@@ -331,7 +340,7 @@ static int erofs_raw_access_readpage(struct file *file, struct page *page) + if (IS_ERR(bio)) + return PTR_ERR(bio); + +- BUG_ON(bio != NULL); /* since we have only one bio -- must be NULL */ ++ DBG_BUGON(bio); /* since we have only one bio -- must be NULL */ + return 0; + } + +@@ -369,7 +378,7 @@ static int erofs_raw_access_readpages(struct file *filp, + /* pages could still be locked */ + put_page(page); + } +- BUG_ON(!list_empty(pages)); ++ DBG_BUGON(!list_empty(pages)); + + /* the rare case (end in gaps) */ + if (unlikely(bio != NULL)) +diff --git a/drivers/staging/erofs/dir.c b/drivers/staging/erofs/dir.c +index be6ae3b1bdbe1..04b84ff31d036 100644 +--- a/drivers/staging/erofs/dir.c ++++ b/drivers/staging/erofs/dir.c +@@ -53,8 +53,11 @@ static int erofs_fill_dentries(struct dir_context *ctx, + strnlen(de_name, maxsize - nameoff) : + le16_to_cpu(de[1].nameoff) - nameoff; + +- /* the corrupted directory found */ +- BUG_ON(de_namelen < 0); ++ /* a corrupted entry is found */ ++ if (unlikely(de_namelen < 0)) { ++ DBG_BUGON(1); ++ return -EIO; ++ } + + #ifdef CONFIG_EROFS_FS_DEBUG + dbg_namelen = min(EROFS_NAME_LEN - 1, de_namelen); +diff --git a/drivers/staging/erofs/inode.c b/drivers/staging/erofs/inode.c +index fbf6ff25cd1bd..9e7815f55a17c 100644 +--- a/drivers/staging/erofs/inode.c ++++ b/drivers/staging/erofs/inode.c +@@ -132,7 +132,13 @@ static int fill_inline_data(struct inode *inode, void *data, unsigned m_pofs) + return -ENOMEM; + + m_pofs += vi->inode_isize + vi->xattr_isize; +- BUG_ON(m_pofs + inode->i_size > PAGE_SIZE); ++ ++ /* inline symlink data shouldn't across page boundary as well */ ++ if (unlikely(m_pofs + inode->i_size > PAGE_SIZE)) { ++ DBG_BUGON(1); ++ kfree(lnk); ++ return -EIO; ++ } + + /* get in-page inline data */ + memcpy(lnk, data + m_pofs, inode->i_size); +@@ -170,7 +176,7 @@ static int fill_inode(struct inode *inode, int isdir) + return PTR_ERR(page); + } + +- BUG_ON(!PageUptodate(page)); ++ DBG_BUGON(!PageUptodate(page)); + data = page_address(page); + + err = read_inode(inode, data + ofs); +diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h +index e6313c54e3ad6..9f44ed8f00239 100644 +--- a/drivers/staging/erofs/internal.h ++++ b/drivers/staging/erofs/internal.h +@@ -184,50 +184,70 @@ struct erofs_workgroup { + + #define EROFS_LOCKED_MAGIC (INT_MIN | 0xE0F510CCL) + +-static inline bool erofs_workgroup_try_to_freeze( +- struct erofs_workgroup *grp, int v) ++#if defined(CONFIG_SMP) ++static inline bool erofs_workgroup_try_to_freeze(struct erofs_workgroup *grp, ++ int val) + { +-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK) +- if (v != atomic_cmpxchg(&grp->refcount, +- v, EROFS_LOCKED_MAGIC)) +- return false; + preempt_disable(); ++ if (val != atomic_cmpxchg(&grp->refcount, val, EROFS_LOCKED_MAGIC)) { ++ preempt_enable(); ++ return false; ++ } ++ return true; ++} ++ ++static inline void erofs_workgroup_unfreeze(struct erofs_workgroup *grp, ++ int orig_val) ++{ ++ /* ++ * other observers should notice all modifications ++ * in the freezing period. ++ */ ++ smp_mb(); ++ atomic_set(&grp->refcount, orig_val); ++ preempt_enable(); ++} ++ ++static inline int erofs_wait_on_workgroup_freezed(struct erofs_workgroup *grp) ++{ ++ return atomic_cond_read_relaxed(&grp->refcount, ++ VAL != EROFS_LOCKED_MAGIC); ++} + #else ++static inline bool erofs_workgroup_try_to_freeze(struct erofs_workgroup *grp, ++ int val) ++{ + preempt_disable(); +- if (atomic_read(&grp->refcount) != v) { ++ /* no need to spin on UP platforms, let's just disable preemption. */ ++ if (val != atomic_read(&grp->refcount)) { + preempt_enable(); + return false; + } +-#endif + return true; + } + +-static inline void erofs_workgroup_unfreeze( +- struct erofs_workgroup *grp, int v) ++static inline void erofs_workgroup_unfreeze(struct erofs_workgroup *grp, ++ int orig_val) + { +-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK) +- atomic_set(&grp->refcount, v); +-#endif + preempt_enable(); + } + ++static inline int erofs_wait_on_workgroup_freezed(struct erofs_workgroup *grp) ++{ ++ int v = atomic_read(&grp->refcount); ++ ++ /* workgroup is never freezed on uniprocessor systems */ ++ DBG_BUGON(v == EROFS_LOCKED_MAGIC); ++ return v; ++} ++#endif ++ + static inline bool erofs_workgroup_get(struct erofs_workgroup *grp, int *ocnt) + { +- const int locked = (int)EROFS_LOCKED_MAGIC; + int o; + + repeat: +- o = atomic_read(&grp->refcount); +- +- /* spin if it is temporarily locked at the reclaim path */ +- if (unlikely(o == locked)) { +-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK) +- do +- cpu_relax(); +- while (atomic_read(&grp->refcount) == locked); +-#endif +- goto repeat; +- } ++ o = erofs_wait_on_workgroup_freezed(grp); + + if (unlikely(o <= 0)) + return -1; +diff --git a/drivers/staging/erofs/super.c b/drivers/staging/erofs/super.c +index 2df9768edac96..b0583cdb079ae 100644 +--- a/drivers/staging/erofs/super.c ++++ b/drivers/staging/erofs/super.c +@@ -40,7 +40,6 @@ static int erofs_init_inode_cache(void) + + static void erofs_exit_inode_cache(void) + { +- BUG_ON(erofs_inode_cachep == NULL); + kmem_cache_destroy(erofs_inode_cachep); + } + +@@ -265,8 +264,8 @@ static int managed_cache_releasepage(struct page *page, gfp_t gfp_mask) + int ret = 1; /* 0 - busy */ + struct address_space *const mapping = page->mapping; + +- BUG_ON(!PageLocked(page)); +- BUG_ON(mapping->a_ops != &managed_cache_aops); ++ DBG_BUGON(!PageLocked(page)); ++ DBG_BUGON(mapping->a_ops != &managed_cache_aops); + + if (PagePrivate(page)) + ret = erofs_try_to_free_cached_page(mapping, page); +@@ -279,10 +278,10 @@ static void managed_cache_invalidatepage(struct page *page, + { + const unsigned int stop = length + offset; + +- BUG_ON(!PageLocked(page)); ++ DBG_BUGON(!PageLocked(page)); + +- /* Check for overflow */ +- BUG_ON(stop > PAGE_SIZE || stop < length); ++ /* Check for potential overflow in debug mode */ ++ DBG_BUGON(stop > PAGE_SIZE || stop < length); + + if (offset == 0 && stop == PAGE_SIZE) + while (!managed_cache_releasepage(page, GFP_NOFS)) +@@ -404,12 +403,6 @@ static int erofs_read_super(struct super_block *sb, + + erofs_register_super(sb); + +- /* +- * We already have a positive dentry, which was instantiated +- * by d_make_root. Just need to d_rehash it. +- */ +- d_rehash(sb->s_root); +- + if (!silent) + infoln("mounted on %s with opts: %s.", dev_name, + (char *)data); +@@ -625,7 +618,7 @@ static int erofs_show_options(struct seq_file *seq, struct dentry *root) + + static int erofs_remount(struct super_block *sb, int *flags, char *data) + { +- BUG_ON(!sb_rdonly(sb)); ++ DBG_BUGON(!sb_rdonly(sb)); + + *flags |= SB_RDONLY; + return 0; +diff --git a/drivers/staging/erofs/unzip_pagevec.h b/drivers/staging/erofs/unzip_pagevec.h +index 0956615b86f72..23856ba2742d8 100644 +--- a/drivers/staging/erofs/unzip_pagevec.h ++++ b/drivers/staging/erofs/unzip_pagevec.h +@@ -150,7 +150,7 @@ z_erofs_pagevec_ctor_dequeue(struct z_erofs_pagevec_ctor *ctor, + erofs_vtptr_t t; + + if (unlikely(ctor->index >= ctor->nr)) { +- BUG_ON(ctor->next == NULL); ++ DBG_BUGON(!ctor->next); + z_erofs_pagevec_ctor_pagedown(ctor, true); + } + +diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c +index 0346630b67c8c..1279241449f4b 100644 +--- a/drivers/staging/erofs/unzip_vle.c ++++ b/drivers/staging/erofs/unzip_vle.c +@@ -18,9 +18,6 @@ static struct kmem_cache *z_erofs_workgroup_cachep __read_mostly; + + void z_erofs_exit_zip_subsystem(void) + { +- BUG_ON(z_erofs_workqueue == NULL); +- BUG_ON(z_erofs_workgroup_cachep == NULL); +- + destroy_workqueue(z_erofs_workqueue); + kmem_cache_destroy(z_erofs_workgroup_cachep); + } +@@ -293,12 +290,9 @@ z_erofs_vle_work_lookup(struct super_block *sb, + *grp_ret = grp = container_of(egrp, + struct z_erofs_vle_workgroup, obj); + +-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF + work = z_erofs_vle_grab_work(grp, pageofs); ++ /* if multiref is disabled, `primary' is always true */ + primary = true; +-#else +- BUG(); +-#endif + + DBG_BUGON(work->pageofs != pageofs); + +@@ -365,12 +359,12 @@ z_erofs_vle_work_register(struct super_block *sb, + struct z_erofs_vle_workgroup *grp = *grp_ret; + struct z_erofs_vle_work *work; + +-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF +- BUG_ON(grp != NULL); +-#else +- if (grp != NULL) +- goto skip; +-#endif ++ /* if multiref is disabled, grp should never be nullptr */ ++ if (unlikely(grp)) { ++ DBG_BUGON(1); ++ return ERR_PTR(-EINVAL); ++ } ++ + /* no available workgroup, let's allocate one */ + grp = kmem_cache_zalloc(z_erofs_workgroup_cachep, GFP_NOFS); + if (unlikely(grp == NULL)) +@@ -393,13 +387,7 @@ z_erofs_vle_work_register(struct super_block *sb, + *hosted = true; + + newgrp = true; +-#ifdef CONFIG_EROFS_FS_ZIP_MULTIREF +-skip: +- /* currently unimplemented */ +- BUG(); +-#else + work = z_erofs_vle_grab_primary_work(grp); +-#endif + work->pageofs = pageofs; + + mutex_init(&work->lock); +@@ -606,7 +594,7 @@ static int z_erofs_do_read_page(struct z_erofs_vle_frontend *fe, + + enum z_erofs_page_type page_type; + unsigned cur, end, spiltted, index; +- int err; ++ int err = 0; + + /* register locked file pages as online pages in pack */ + z_erofs_onlinepage_init(page); +@@ -624,7 +612,7 @@ repeat: + /* go ahead the next map_blocks */ + debugln("%s: [out-of-range] pos %llu", __func__, offset + cur); + +- if (!z_erofs_vle_work_iter_end(builder)) ++ if (z_erofs_vle_work_iter_end(builder)) + fe->initial = false; + + map->m_la = offset + cur; +@@ -633,12 +621,11 @@ repeat: + if (unlikely(err)) + goto err_out; + +- /* deal with hole (FIXME! broken now) */ + if (unlikely(!(map->m_flags & EROFS_MAP_MAPPED))) + goto hitted; + + DBG_BUGON(map->m_plen != 1 << sbi->clusterbits); +- BUG_ON(erofs_blkoff(map->m_pa)); ++ DBG_BUGON(erofs_blkoff(map->m_pa)); + + err = z_erofs_vle_work_iter_begin(builder, sb, map, &fe->owned_head); + if (unlikely(err)) +@@ -683,7 +670,7 @@ retry: + + err = z_erofs_vle_work_add_page(builder, + newpage, Z_EROFS_PAGE_TYPE_EXCLUSIVE); +- if (!err) ++ if (likely(!err)) + goto retry; + } + +@@ -694,9 +681,10 @@ retry: + + /* FIXME! avoid the last relundant fixup & endio */ + z_erofs_onlinepage_fixup(page, index, true); +- ++spiltted; + +- /* also update nr_pages and increase queued_pages */ ++ /* bump up the number of spiltted parts of a page */ ++ ++spiltted; ++ /* also update nr_pages */ + work->nr_pages = max_t(pgoff_t, work->nr_pages, index + 1); + next_part: + /* can be used for verification */ +@@ -706,16 +694,18 @@ next_part: + if (end > 0) + goto repeat; + ++out: + /* FIXME! avoid the last relundant fixup & endio */ + z_erofs_onlinepage_endio(page); + + debugln("%s, finish page: %pK spiltted: %u map->m_llen %llu", + __func__, page, spiltted, map->m_llen); +- return 0; ++ return err; + ++ /* if some error occurred while processing this page */ + err_out: +- /* TODO: the missing error handing cases */ +- return err; ++ SetPageError(page); ++ goto out; + } + + static void z_erofs_vle_unzip_kickoff(void *ptr, int bios) +@@ -752,7 +742,7 @@ static inline void z_erofs_vle_read_endio(struct bio *bio) + bool cachemngd = false; + + DBG_BUGON(PageUptodate(page)); +- BUG_ON(page->mapping == NULL); ++ DBG_BUGON(!page->mapping); + + #ifdef EROFS_FS_HAS_MANAGED_CACHE + if (unlikely(mngda == NULL && !z_erofs_is_stagingpage(page))) { +@@ -796,10 +786,8 @@ static int z_erofs_vle_unzip(struct super_block *sb, + const unsigned clusterpages = erofs_clusterpages(sbi); + + struct z_erofs_pagevec_ctor ctor; +- unsigned nr_pages; +-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF +- unsigned sparsemem_pages = 0; +-#endif ++ unsigned int nr_pages; ++ unsigned int sparsemem_pages = 0; + struct page *pages_onstack[Z_EROFS_VLE_VMAP_ONSTACK_PAGES]; + struct page **pages, **compressed_pages, *page; + unsigned i, llen; +@@ -811,12 +799,8 @@ static int z_erofs_vle_unzip(struct super_block *sb, + int err; + + might_sleep(); +-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF + work = z_erofs_vle_grab_primary_work(grp); +-#else +- BUG(); +-#endif +- BUG_ON(!READ_ONCE(work->nr_pages)); ++ DBG_BUGON(!READ_ONCE(work->nr_pages)); + + mutex_lock(&work->lock); + nr_pages = work->nr_pages; +@@ -865,14 +849,12 @@ repeat: + else + pagenr = z_erofs_onlinepage_index(page); + +- BUG_ON(pagenr >= nr_pages); ++ DBG_BUGON(pagenr >= nr_pages); ++ DBG_BUGON(pages[pagenr]); + +-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF +- BUG_ON(pages[pagenr] != NULL); +- ++sparsemem_pages; +-#endif + pages[pagenr] = page; + } ++ sparsemem_pages = i; + + z_erofs_pagevec_ctor_exit(&ctor, true); + +@@ -891,9 +873,8 @@ repeat: + if (z_erofs_is_stagingpage(page)) + continue; + #ifdef EROFS_FS_HAS_MANAGED_CACHE +- else if (page->mapping == mngda) { +- BUG_ON(PageLocked(page)); +- BUG_ON(!PageUptodate(page)); ++ if (page->mapping == mngda) { ++ DBG_BUGON(!PageUptodate(page)); + continue; + } + #endif +@@ -901,11 +882,9 @@ repeat: + /* only non-head page could be reused as a compressed page */ + pagenr = z_erofs_onlinepage_index(page); + +- BUG_ON(pagenr >= nr_pages); +-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF +- BUG_ON(pages[pagenr] != NULL); ++ DBG_BUGON(pagenr >= nr_pages); ++ DBG_BUGON(pages[pagenr]); + ++sparsemem_pages; +-#endif + pages[pagenr] = page; + + overlapped = true; +@@ -914,9 +893,6 @@ repeat: + llen = (nr_pages << PAGE_SHIFT) - work->pageofs; + + if (z_erofs_vle_workgrp_fmt(grp) == Z_EROFS_VLE_WORKGRP_FMT_PLAIN) { +- /* FIXME! this should be fixed in the future */ +- BUG_ON(grp->llen != llen); +- + err = z_erofs_vle_plain_copy(compressed_pages, clusterpages, + pages, nr_pages, work->pageofs); + goto out; +@@ -931,12 +907,8 @@ repeat: + if (err != -ENOTSUPP) + goto out_percpu; + +-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF +- if (sparsemem_pages >= nr_pages) { +- BUG_ON(sparsemem_pages > nr_pages); ++ if (sparsemem_pages >= nr_pages) + goto skip_allocpage; +- } +-#endif + + for (i = 0; i < nr_pages; ++i) { + if (pages[i] != NULL) +@@ -945,9 +917,7 @@ repeat: + pages[i] = __stagingpage_alloc(page_pool, GFP_NOFS); + } + +-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF + skip_allocpage: +-#endif + vout = erofs_vmap(pages, nr_pages); + + err = z_erofs_vle_unzip_vmap(compressed_pages, +@@ -1031,7 +1001,7 @@ static void z_erofs_vle_unzip_wq(struct work_struct *work) + struct z_erofs_vle_unzip_io_sb, io.u.work); + LIST_HEAD(page_pool); + +- BUG_ON(iosb->io.head == Z_EROFS_VLE_WORKGRP_TAIL_CLOSED); ++ DBG_BUGON(iosb->io.head == Z_EROFS_VLE_WORKGRP_TAIL_CLOSED); + z_erofs_vle_unzip_all(iosb->sb, &iosb->io, &page_pool); + + put_pages_list(&page_pool); +@@ -1360,7 +1330,6 @@ static inline int __z_erofs_vle_normalaccess_readpages( + continue; + } + +- BUG_ON(PagePrivate(page)); + set_page_private(page, (unsigned long)head); + head = page; + } +diff --git a/drivers/staging/erofs/unzip_vle.h b/drivers/staging/erofs/unzip_vle.h +index 3939985008652..3316bc36965d4 100644 +--- a/drivers/staging/erofs/unzip_vle.h ++++ b/drivers/staging/erofs/unzip_vle.h +@@ -47,13 +47,6 @@ static inline bool z_erofs_gather_if_stagingpage(struct list_head *page_pool, + #define Z_EROFS_VLE_INLINE_PAGEVECS 3 + + struct z_erofs_vle_work { +- /* struct z_erofs_vle_work *left, *right; */ +- +-#ifdef CONFIG_EROFS_FS_ZIP_MULTIREF +- struct list_head list; +- +- atomic_t refcount; +-#endif + struct mutex lock; + + /* I: decompression offset in page */ +@@ -107,10 +100,8 @@ static inline void z_erofs_vle_set_workgrp_fmt( + grp->flags = fmt | (grp->flags & ~Z_EROFS_VLE_WORKGRP_FMT_MASK); + } + +-#ifdef CONFIG_EROFS_FS_ZIP_MULTIREF +-#error multiref decompression is unimplemented yet +-#else + ++/* definitions if multiref is disabled */ + #define z_erofs_vle_grab_primary_work(grp) (&(grp)->work) + #define z_erofs_vle_grab_work(grp, pageofs) (&(grp)->work) + #define z_erofs_vle_work_workgroup(wrk, primary) \ +@@ -118,7 +109,6 @@ static inline void z_erofs_vle_set_workgrp_fmt( + struct z_erofs_vle_workgroup, work) : \ + ({ BUG(); (void *)NULL; })) + +-#endif + + #define Z_EROFS_WORKGROUP_SIZE sizeof(struct z_erofs_vle_workgroup) + +diff --git a/drivers/staging/erofs/unzip_vle_lz4.c b/drivers/staging/erofs/unzip_vle_lz4.c +index f5b665f15be52..9cb35cd33365a 100644 +--- a/drivers/staging/erofs/unzip_vle_lz4.c ++++ b/drivers/staging/erofs/unzip_vle_lz4.c +@@ -57,7 +57,7 @@ int z_erofs_vle_plain_copy(struct page **compressed_pages, + if (compressed_pages[j] != page) + continue; + +- BUG_ON(mirrored[j]); ++ DBG_BUGON(mirrored[j]); + memcpy(percpu_data + j * PAGE_SIZE, dst, PAGE_SIZE); + mirrored[j] = true; + break; +diff --git a/drivers/staging/erofs/utils.c b/drivers/staging/erofs/utils.c +index 595cf90af9bb2..dd2ac9dbc4b47 100644 +--- a/drivers/staging/erofs/utils.c ++++ b/drivers/staging/erofs/utils.c +@@ -23,9 +23,6 @@ struct page *erofs_allocpage(struct list_head *pool, gfp_t gfp) + list_del(&page->lru); + } else { + page = alloc_pages(gfp | __GFP_NOFAIL, 0); +- +- BUG_ON(page == NULL); +- BUG_ON(page->mapping != NULL); + } + return page; + } +@@ -60,7 +57,7 @@ repeat: + /* decrease refcount added by erofs_workgroup_put */ + if (unlikely(oldcount == 1)) + atomic_long_dec(&erofs_global_shrink_cnt); +- BUG_ON(index != grp->index); ++ DBG_BUGON(index != grp->index); + } + rcu_read_unlock(); + return grp; +@@ -73,8 +70,11 @@ int erofs_register_workgroup(struct super_block *sb, + struct erofs_sb_info *sbi; + int err; + +- /* grp->refcount should not < 1 */ +- BUG_ON(!atomic_read(&grp->refcount)); ++ /* grp shouldn't be broken or used before */ ++ if (unlikely(atomic_read(&grp->refcount) != 1)) { ++ DBG_BUGON(1); ++ return -EINVAL; ++ } + + err = radix_tree_preload(GFP_NOFS); + if (err) +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index 9cd404acdb82b..ac7620120491b 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -148,7 +148,7 @@ struct tcmu_dev { + size_t ring_size; + + struct mutex cmdr_lock; +- struct list_head cmdr_queue; ++ struct list_head qfull_queue; + + uint32_t dbi_max; + uint32_t dbi_thresh; +@@ -159,6 +159,7 @@ struct tcmu_dev { + + struct timer_list cmd_timer; + unsigned int cmd_time_out; ++ struct list_head inflight_queue; + + struct timer_list qfull_timer; + int qfull_time_out; +@@ -179,7 +180,7 @@ struct tcmu_dev { + struct tcmu_cmd { + struct se_cmd *se_cmd; + struct tcmu_dev *tcmu_dev; +- struct list_head cmdr_queue_entry; ++ struct list_head queue_entry; + + uint16_t cmd_id; + +@@ -192,6 +193,7 @@ struct tcmu_cmd { + unsigned long deadline; + + #define TCMU_CMD_BIT_EXPIRED 0 ++#define TCMU_CMD_BIT_INFLIGHT 1 + unsigned long flags; + }; + /* +@@ -586,7 +588,7 @@ static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd) + if (!tcmu_cmd) + return NULL; + +- INIT_LIST_HEAD(&tcmu_cmd->cmdr_queue_entry); ++ INIT_LIST_HEAD(&tcmu_cmd->queue_entry); + tcmu_cmd->se_cmd = se_cmd; + tcmu_cmd->tcmu_dev = udev; + +@@ -915,11 +917,13 @@ setup_timer: + return 0; + + tcmu_cmd->deadline = round_jiffies_up(jiffies + msecs_to_jiffies(tmo)); +- mod_timer(timer, tcmu_cmd->deadline); ++ if (!timer_pending(timer)) ++ mod_timer(timer, tcmu_cmd->deadline); ++ + return 0; + } + +-static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd) ++static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd) + { + struct tcmu_dev *udev = tcmu_cmd->tcmu_dev; + unsigned int tmo; +@@ -942,7 +946,7 @@ static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd) + if (ret) + return ret; + +- list_add_tail(&tcmu_cmd->cmdr_queue_entry, &udev->cmdr_queue); ++ list_add_tail(&tcmu_cmd->queue_entry, &udev->qfull_queue); + pr_debug("adding cmd %u on dev %s to ring space wait queue\n", + tcmu_cmd->cmd_id, udev->name); + return 0; +@@ -999,7 +1003,7 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err) + base_command_size = tcmu_cmd_get_base_cmd_size(tcmu_cmd->dbi_cnt); + command_size = tcmu_cmd_get_cmd_size(tcmu_cmd, base_command_size); + +- if (!list_empty(&udev->cmdr_queue)) ++ if (!list_empty(&udev->qfull_queue)) + goto queue; + + mb = udev->mb_addr; +@@ -1096,13 +1100,16 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err) + UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size); + tcmu_flush_dcache_range(mb, sizeof(*mb)); + ++ list_add_tail(&tcmu_cmd->queue_entry, &udev->inflight_queue); ++ set_bit(TCMU_CMD_BIT_INFLIGHT, &tcmu_cmd->flags); ++ + /* TODO: only if FLUSH and FUA? */ + uio_event_notify(&udev->uio_info); + + return 0; + + queue: +- if (add_to_cmdr_queue(tcmu_cmd)) { ++ if (add_to_qfull_queue(tcmu_cmd)) { + *scsi_err = TCM_OUT_OF_RESOURCES; + return -1; + } +@@ -1145,6 +1152,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry * + if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) + goto out; + ++ list_del_init(&cmd->queue_entry); ++ + tcmu_cmd_reset_dbi_cur(cmd); + + if (entry->hdr.uflags & TCMU_UFLAG_UNKNOWN_OP) { +@@ -1194,9 +1203,29 @@ out: + tcmu_free_cmd(cmd); + } + ++static void tcmu_set_next_deadline(struct list_head *queue, ++ struct timer_list *timer) ++{ ++ struct tcmu_cmd *tcmu_cmd, *tmp_cmd; ++ unsigned long deadline = 0; ++ ++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, queue, queue_entry) { ++ if (!time_after(jiffies, tcmu_cmd->deadline)) { ++ deadline = tcmu_cmd->deadline; ++ break; ++ } ++ } ++ ++ if (deadline) ++ mod_timer(timer, deadline); ++ else ++ del_timer(timer); ++} ++ + static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) + { + struct tcmu_mailbox *mb; ++ struct tcmu_cmd *cmd; + int handled = 0; + + if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags)) { +@@ -1210,7 +1239,6 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) + while (udev->cmdr_last_cleaned != READ_ONCE(mb->cmd_tail)) { + + struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned; +- struct tcmu_cmd *cmd; + + tcmu_flush_dcache_range(entry, sizeof(*entry)); + +@@ -1243,7 +1271,7 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) + /* no more pending commands */ + del_timer(&udev->cmd_timer); + +- if (list_empty(&udev->cmdr_queue)) { ++ if (list_empty(&udev->qfull_queue)) { + /* + * no more pending or waiting commands so try to + * reclaim blocks if needed. +@@ -1252,6 +1280,8 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) + tcmu_global_max_blocks) + schedule_delayed_work(&tcmu_unmap_work, 0); + } ++ } else if (udev->cmd_time_out) { ++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer); + } + + return handled; +@@ -1271,7 +1301,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data) + if (!time_after(jiffies, cmd->deadline)) + return 0; + +- is_running = list_empty(&cmd->cmdr_queue_entry); ++ is_running = test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags); + se_cmd = cmd->se_cmd; + + if (is_running) { +@@ -1288,12 +1318,11 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data) + */ + scsi_status = SAM_STAT_CHECK_CONDITION; + } else { +- list_del_init(&cmd->cmdr_queue_entry); +- + idr_remove(&udev->commands, id); + tcmu_free_cmd(cmd); + scsi_status = SAM_STAT_TASK_SET_FULL; + } ++ list_del_init(&cmd->queue_entry); + + pr_debug("Timing out cmd %u on dev %s that is %s.\n", + id, udev->name, is_running ? "inflight" : "queued"); +@@ -1372,7 +1401,8 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name) + + INIT_LIST_HEAD(&udev->node); + INIT_LIST_HEAD(&udev->timedout_entry); +- INIT_LIST_HEAD(&udev->cmdr_queue); ++ INIT_LIST_HEAD(&udev->qfull_queue); ++ INIT_LIST_HEAD(&udev->inflight_queue); + idr_init(&udev->commands); + + timer_setup(&udev->qfull_timer, tcmu_qfull_timedout, 0); +@@ -1383,7 +1413,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name) + return &udev->se_dev; + } + +-static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail) ++static bool run_qfull_queue(struct tcmu_dev *udev, bool fail) + { + struct tcmu_cmd *tcmu_cmd, *tmp_cmd; + LIST_HEAD(cmds); +@@ -1391,15 +1421,15 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail) + sense_reason_t scsi_ret; + int ret; + +- if (list_empty(&udev->cmdr_queue)) ++ if (list_empty(&udev->qfull_queue)) + return true; + + pr_debug("running %s's cmdr queue forcefail %d\n", udev->name, fail); + +- list_splice_init(&udev->cmdr_queue, &cmds); ++ list_splice_init(&udev->qfull_queue, &cmds); + +- list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, cmdr_queue_entry) { +- list_del_init(&tcmu_cmd->cmdr_queue_entry); ++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, queue_entry) { ++ list_del_init(&tcmu_cmd->queue_entry); + + pr_debug("removing cmd %u on dev %s from queue\n", + tcmu_cmd->cmd_id, udev->name); +@@ -1437,14 +1467,13 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail) + * cmd was requeued, so just put all cmds back in + * the queue + */ +- list_splice_tail(&cmds, &udev->cmdr_queue); ++ list_splice_tail(&cmds, &udev->qfull_queue); + drained = false; +- goto done; ++ break; + } + } +- if (list_empty(&udev->cmdr_queue)) +- del_timer(&udev->qfull_timer); +-done: ++ ++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer); + return drained; + } + +@@ -1454,7 +1483,7 @@ static int tcmu_irqcontrol(struct uio_info *info, s32 irq_on) + + mutex_lock(&udev->cmdr_lock); + tcmu_handle_completions(udev); +- run_cmdr_queue(udev, false); ++ run_qfull_queue(udev, false); + mutex_unlock(&udev->cmdr_lock); + + return 0; +@@ -1982,7 +2011,7 @@ static void tcmu_block_dev(struct tcmu_dev *udev) + /* complete IO that has executed successfully */ + tcmu_handle_completions(udev); + /* fail IO waiting to be queued */ +- run_cmdr_queue(udev, true); ++ run_qfull_queue(udev, true); + + unlock: + mutex_unlock(&udev->cmdr_lock); +@@ -1997,7 +2026,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level) + mutex_lock(&udev->cmdr_lock); + + idr_for_each_entry(&udev->commands, cmd, i) { +- if (!list_empty(&cmd->cmdr_queue_entry)) ++ if (!test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags)) + continue; + + pr_debug("removing cmd %u on dev %s from ring (is expired %d)\n", +@@ -2006,6 +2035,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level) + + idr_remove(&udev->commands, i); + if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) { ++ list_del_init(&cmd->queue_entry); + if (err_level == 1) { + /* + * Userspace was not able to start the +@@ -2666,6 +2696,10 @@ static void check_timedout_devices(void) + + mutex_lock(&udev->cmdr_lock); + idr_for_each(&udev->commands, tcmu_check_expired_cmd, NULL); ++ ++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer); ++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer); ++ + mutex_unlock(&udev->cmdr_lock); + + spin_lock_bh(&timed_out_udevs_lock); +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 5eaeca805c95c..b214a72d5caad 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -1035,8 +1035,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev, + int type, ret; + + ret = copy_from_iter(&type, sizeof(type), from); +- if (ret != sizeof(type)) ++ if (ret != sizeof(type)) { ++ ret = -EINVAL; + goto done; ++ } + + switch (type) { + case VHOST_IOTLB_MSG: +@@ -1055,8 +1057,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev, + + iov_iter_advance(from, offset); + ret = copy_from_iter(&msg, sizeof(msg), from); +- if (ret != sizeof(msg)) ++ if (ret != sizeof(msg)) { ++ ret = -EINVAL; + goto done; ++ } + if (vhost_process_iotlb_msg(dev, &msg)) { + ret = -EFAULT; + goto done; +diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c +index bdfcc0a71db14..6bde543452f25 100644 +--- a/drivers/video/backlight/pwm_bl.c ++++ b/drivers/video/backlight/pwm_bl.c +@@ -262,6 +262,16 @@ static int pwm_backlight_parse_dt(struct device *dev, + + memset(data, 0, sizeof(*data)); + ++ /* ++ * These values are optional and set as 0 by default, the out values ++ * are modified only if a valid u32 value can be decoded. ++ */ ++ of_property_read_u32(node, "post-pwm-on-delay-ms", ++ &data->post_pwm_on_delay); ++ of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay); ++ ++ data->enable_gpio = -EINVAL; ++ + /* + * Determine the number of brightness levels, if this property is not + * set a default table of brightness levels will be used. +@@ -374,15 +384,6 @@ static int pwm_backlight_parse_dt(struct device *dev, + data->max_brightness--; + } + +- /* +- * These values are optional and set as 0 by default, the out values +- * are modified only if a valid u32 value can be decoded. +- */ +- of_property_read_u32(node, "post-pwm-on-delay-ms", +- &data->post_pwm_on_delay); +- of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay); +- +- data->enable_gpio = -EINVAL; + return 0; + } + +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index afbd6101c78eb..070026a7e55a5 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -916,8 +916,6 @@ static int dlfb_ops_open(struct fb_info *info, int user) + + dlfb->fb_count++; + +- kref_get(&dlfb->kref); +- + if (fb_defio && (info->fbdefio == NULL)) { + /* enable defio at last moment if not disabled by client */ + +@@ -940,14 +938,17 @@ static int dlfb_ops_open(struct fb_info *info, int user) + return 0; + } + +-/* +- * Called when all client interfaces to start transactions have been disabled, +- * and all references to our device instance (dlfb_data) are released. +- * Every transaction must have a reference, so we know are fully spun down +- */ +-static void dlfb_free(struct kref *kref) ++static void dlfb_ops_destroy(struct fb_info *info) + { +- struct dlfb_data *dlfb = container_of(kref, struct dlfb_data, kref); ++ struct dlfb_data *dlfb = info->par; ++ ++ if (info->cmap.len != 0) ++ fb_dealloc_cmap(&info->cmap); ++ if (info->monspecs.modedb) ++ fb_destroy_modedb(info->monspecs.modedb); ++ vfree(info->screen_base); ++ ++ fb_destroy_modelist(&info->modelist); + + while (!list_empty(&dlfb->deferred_free)) { + struct dlfb_deferred_free *d = list_entry(dlfb->deferred_free.next, struct dlfb_deferred_free, list); +@@ -957,40 +958,13 @@ static void dlfb_free(struct kref *kref) + } + vfree(dlfb->backing_buffer); + kfree(dlfb->edid); ++ usb_put_dev(dlfb->udev); + kfree(dlfb); +-} +- +-static void dlfb_free_framebuffer(struct dlfb_data *dlfb) +-{ +- struct fb_info *info = dlfb->info; +- +- if (info) { +- unregister_framebuffer(info); +- +- if (info->cmap.len != 0) +- fb_dealloc_cmap(&info->cmap); +- if (info->monspecs.modedb) +- fb_destroy_modedb(info->monspecs.modedb); +- vfree(info->screen_base); +- +- fb_destroy_modelist(&info->modelist); +- +- dlfb->info = NULL; +- +- /* Assume info structure is freed after this point */ +- framebuffer_release(info); +- } + +- /* ref taken in probe() as part of registering framebfufer */ +- kref_put(&dlfb->kref, dlfb_free); ++ /* Assume info structure is freed after this point */ ++ framebuffer_release(info); + } + +-static void dlfb_free_framebuffer_work(struct work_struct *work) +-{ +- struct dlfb_data *dlfb = container_of(work, struct dlfb_data, +- free_framebuffer_work.work); +- dlfb_free_framebuffer(dlfb); +-} + /* + * Assumes caller is holding info->lock mutex (for open and release at least) + */ +@@ -1000,10 +974,6 @@ static int dlfb_ops_release(struct fb_info *info, int user) + + dlfb->fb_count--; + +- /* We can't free fb_info here - fbmem will touch it when we return */ +- if (dlfb->virtualized && (dlfb->fb_count == 0)) +- schedule_delayed_work(&dlfb->free_framebuffer_work, HZ); +- + if ((dlfb->fb_count == 0) && (info->fbdefio)) { + fb_deferred_io_cleanup(info); + kfree(info->fbdefio); +@@ -1013,8 +983,6 @@ static int dlfb_ops_release(struct fb_info *info, int user) + + dev_dbg(info->dev, "release, user=%d count=%d\n", user, dlfb->fb_count); + +- kref_put(&dlfb->kref, dlfb_free); +- + return 0; + } + +@@ -1172,6 +1140,7 @@ static struct fb_ops dlfb_ops = { + .fb_blank = dlfb_ops_blank, + .fb_check_var = dlfb_ops_check_var, + .fb_set_par = dlfb_ops_set_par, ++ .fb_destroy = dlfb_ops_destroy, + }; + + +@@ -1615,12 +1584,13 @@ success: + return true; + } + +-static void dlfb_init_framebuffer_work(struct work_struct *work); +- + static int dlfb_usb_probe(struct usb_interface *intf, + const struct usb_device_id *id) + { ++ int i; ++ const struct device_attribute *attr; + struct dlfb_data *dlfb; ++ struct fb_info *info; + int retval = -ENOMEM; + struct usb_device *usbdev = interface_to_usbdev(intf); + +@@ -1631,10 +1601,9 @@ static int dlfb_usb_probe(struct usb_interface *intf, + goto error; + } + +- kref_init(&dlfb->kref); /* matching kref_put in usb .disconnect fn */ + INIT_LIST_HEAD(&dlfb->deferred_free); + +- dlfb->udev = usbdev; ++ dlfb->udev = usb_get_dev(usbdev); + usb_set_intfdata(intf, dlfb); + + dev_dbg(&intf->dev, "console enable=%d\n", console); +@@ -1657,42 +1626,6 @@ static int dlfb_usb_probe(struct usb_interface *intf, + } + + +- if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) { +- retval = -ENOMEM; +- dev_err(&intf->dev, "unable to allocate urb list\n"); +- goto error; +- } +- +- kref_get(&dlfb->kref); /* matching kref_put in free_framebuffer_work */ +- +- /* We don't register a new USB class. Our client interface is dlfbev */ +- +- /* Workitem keep things fast & simple during USB enumeration */ +- INIT_DELAYED_WORK(&dlfb->init_framebuffer_work, +- dlfb_init_framebuffer_work); +- schedule_delayed_work(&dlfb->init_framebuffer_work, 0); +- +- return 0; +- +-error: +- if (dlfb) { +- +- kref_put(&dlfb->kref, dlfb_free); /* last ref from kref_init */ +- +- /* dev has been deallocated. Do not dereference */ +- } +- +- return retval; +-} +- +-static void dlfb_init_framebuffer_work(struct work_struct *work) +-{ +- int i, retval; +- struct fb_info *info; +- const struct device_attribute *attr; +- struct dlfb_data *dlfb = container_of(work, struct dlfb_data, +- init_framebuffer_work.work); +- + /* allocates framebuffer driver structure, not framebuffer memory */ + info = framebuffer_alloc(0, &dlfb->udev->dev); + if (!info) { +@@ -1706,17 +1639,22 @@ static void dlfb_init_framebuffer_work(struct work_struct *work) + dlfb->ops = dlfb_ops; + info->fbops = &dlfb->ops; + ++ INIT_LIST_HEAD(&info->modelist); ++ ++ if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) { ++ retval = -ENOMEM; ++ dev_err(&intf->dev, "unable to allocate urb list\n"); ++ goto error; ++ } ++ ++ /* We don't register a new USB class. Our client interface is dlfbev */ ++ + retval = fb_alloc_cmap(&info->cmap, 256, 0); + if (retval < 0) { + dev_err(info->device, "cmap allocation failed: %d\n", retval); + goto error; + } + +- INIT_DELAYED_WORK(&dlfb->free_framebuffer_work, +- dlfb_free_framebuffer_work); +- +- INIT_LIST_HEAD(&info->modelist); +- + retval = dlfb_setup_modes(dlfb, info, NULL, 0); + if (retval != 0) { + dev_err(info->device, +@@ -1760,10 +1698,16 @@ static void dlfb_init_framebuffer_work(struct work_struct *work) + dev_name(info->dev), info->var.xres, info->var.yres, + ((dlfb->backing_buffer) ? + info->fix.smem_len * 2 : info->fix.smem_len) >> 10); +- return; ++ return 0; + + error: +- dlfb_free_framebuffer(dlfb); ++ if (dlfb->info) { ++ dlfb_ops_destroy(dlfb->info); ++ } else if (dlfb) { ++ usb_put_dev(dlfb->udev); ++ kfree(dlfb); ++ } ++ return retval; + } + + static void dlfb_usb_disconnect(struct usb_interface *intf) +@@ -1791,20 +1735,9 @@ static void dlfb_usb_disconnect(struct usb_interface *intf) + for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++) + device_remove_file(info->dev, &fb_device_attrs[i]); + device_remove_bin_file(info->dev, &edid_attr); +- unlink_framebuffer(info); + } + +- usb_set_intfdata(intf, NULL); +- dlfb->udev = NULL; +- +- /* if clients still have us open, will be freed on last close */ +- if (dlfb->fb_count == 0) +- schedule_delayed_work(&dlfb->free_framebuffer_work, 0); +- +- /* release reference taken by kref_init in probe() */ +- kref_put(&dlfb->kref, dlfb_free); +- +- /* consider dlfb_data freed */ ++ unregister_framebuffer(info); + } + + static struct usb_driver dlfb_driver = { +diff --git a/drivers/watchdog/mt7621_wdt.c b/drivers/watchdog/mt7621_wdt.c +index 5c4a764717c4d..81208cd3f4ecb 100644 +--- a/drivers/watchdog/mt7621_wdt.c ++++ b/drivers/watchdog/mt7621_wdt.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include + +diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c +index 98967f0a7d10e..db7c57d82cfdc 100644 +--- a/drivers/watchdog/rt2880_wdt.c ++++ b/drivers/watchdog/rt2880_wdt.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #include + +diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c +index b1092fbefa630..d4ea33581ac26 100644 +--- a/drivers/xen/pvcalls-back.c ++++ b/drivers/xen/pvcalls-back.c +@@ -160,9 +160,10 @@ static void pvcalls_conn_back_read(void *opaque) + + /* write the data, then modify the indexes */ + virt_wmb(); +- if (ret < 0) ++ if (ret < 0) { ++ atomic_set(&map->read, 0); + intf->in_error = ret; +- else ++ } else + intf->in_prod = prod + ret; + /* update the indexes, then notify the other end */ + virt_wmb(); +@@ -282,13 +283,11 @@ static int pvcalls_back_socket(struct xenbus_device *dev, + static void pvcalls_sk_state_change(struct sock *sock) + { + struct sock_mapping *map = sock->sk_user_data; +- struct pvcalls_data_intf *intf; + + if (map == NULL) + return; + +- intf = map->ring; +- intf->in_error = -ENOTCONN; ++ atomic_inc(&map->read); + notify_remote_via_irq(map->irq); + } + +diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c +index 77224d8f3e6fe..91da7e44d5d4f 100644 +--- a/drivers/xen/pvcalls-front.c ++++ b/drivers/xen/pvcalls-front.c +@@ -31,6 +31,12 @@ + #define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE) + #define PVCALLS_FRONT_MAX_SPIN 5000 + ++static struct proto pvcalls_proto = { ++ .name = "PVCalls", ++ .owner = THIS_MODULE, ++ .obj_size = sizeof(struct sock), ++}; ++ + struct pvcalls_bedata { + struct xen_pvcalls_front_ring ring; + grant_ref_t ref; +@@ -335,6 +341,42 @@ int pvcalls_front_socket(struct socket *sock) + return ret; + } + ++static void free_active_ring(struct sock_mapping *map) ++{ ++ if (!map->active.ring) ++ return; ++ ++ free_pages((unsigned long)map->active.data.in, ++ map->active.ring->ring_order); ++ free_page((unsigned long)map->active.ring); ++} ++ ++static int alloc_active_ring(struct sock_mapping *map) ++{ ++ void *bytes; ++ ++ map->active.ring = (struct pvcalls_data_intf *) ++ get_zeroed_page(GFP_KERNEL); ++ if (!map->active.ring) ++ goto out; ++ ++ map->active.ring->ring_order = PVCALLS_RING_ORDER; ++ bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, ++ PVCALLS_RING_ORDER); ++ if (!bytes) ++ goto out; ++ ++ map->active.data.in = bytes; ++ map->active.data.out = bytes + ++ XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER); ++ ++ return 0; ++ ++out: ++ free_active_ring(map); ++ return -ENOMEM; ++} ++ + static int create_active(struct sock_mapping *map, int *evtchn) + { + void *bytes; +@@ -343,15 +385,7 @@ static int create_active(struct sock_mapping *map, int *evtchn) + *evtchn = -1; + init_waitqueue_head(&map->active.inflight_conn_req); + +- map->active.ring = (struct pvcalls_data_intf *) +- __get_free_page(GFP_KERNEL | __GFP_ZERO); +- if (map->active.ring == NULL) +- goto out_error; +- map->active.ring->ring_order = PVCALLS_RING_ORDER; +- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, +- PVCALLS_RING_ORDER); +- if (bytes == NULL) +- goto out_error; ++ bytes = map->active.data.in; + for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++) + map->active.ring->ref[i] = gnttab_grant_foreign_access( + pvcalls_front_dev->otherend_id, +@@ -361,10 +395,6 @@ static int create_active(struct sock_mapping *map, int *evtchn) + pvcalls_front_dev->otherend_id, + pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0); + +- map->active.data.in = bytes; +- map->active.data.out = bytes + +- XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER); +- + ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn); + if (ret) + goto out_error; +@@ -385,8 +415,6 @@ static int create_active(struct sock_mapping *map, int *evtchn) + out_error: + if (*evtchn >= 0) + xenbus_free_evtchn(pvcalls_front_dev, *evtchn); +- free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER); +- free_page((unsigned long)map->active.ring); + return ret; + } + +@@ -406,17 +434,24 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr, + return PTR_ERR(map); + + bedata = dev_get_drvdata(&pvcalls_front_dev->dev); ++ ret = alloc_active_ring(map); ++ if (ret < 0) { ++ pvcalls_exit_sock(sock); ++ return ret; ++ } + + spin_lock(&bedata->socket_lock); + ret = get_request(bedata, &req_id); + if (ret < 0) { + spin_unlock(&bedata->socket_lock); ++ free_active_ring(map); + pvcalls_exit_sock(sock); + return ret; + } + ret = create_active(map, &evtchn); + if (ret < 0) { + spin_unlock(&bedata->socket_lock); ++ free_active_ring(map); + pvcalls_exit_sock(sock); + return ret; + } +@@ -560,15 +595,13 @@ static int __read_ring(struct pvcalls_data_intf *intf, + error = intf->in_error; + /* get pointers before reading from the ring */ + virt_rmb(); +- if (error < 0) +- return error; + + size = pvcalls_queued(prod, cons, array_size); + masked_prod = pvcalls_mask(prod, array_size); + masked_cons = pvcalls_mask(cons, array_size); + + if (size == 0) +- return 0; ++ return error ?: size; + + if (len > size) + len = size; +@@ -780,25 +813,36 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags) + } + } + +- spin_lock(&bedata->socket_lock); +- ret = get_request(bedata, &req_id); +- if (ret < 0) { ++ map2 = kzalloc(sizeof(*map2), GFP_KERNEL); ++ if (map2 == NULL) { + clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, + (void *)&map->passive.flags); +- spin_unlock(&bedata->socket_lock); ++ pvcalls_exit_sock(sock); ++ return -ENOMEM; ++ } ++ ret = alloc_active_ring(map2); ++ if (ret < 0) { ++ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, ++ (void *)&map->passive.flags); ++ kfree(map2); + pvcalls_exit_sock(sock); + return ret; + } +- map2 = kzalloc(sizeof(*map2), GFP_ATOMIC); +- if (map2 == NULL) { ++ spin_lock(&bedata->socket_lock); ++ ret = get_request(bedata, &req_id); ++ if (ret < 0) { + clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, + (void *)&map->passive.flags); + spin_unlock(&bedata->socket_lock); ++ free_active_ring(map2); ++ kfree(map2); + pvcalls_exit_sock(sock); +- return -ENOMEM; ++ return ret; + } ++ + ret = create_active(map2, &evtchn); + if (ret < 0) { ++ free_active_ring(map2); + kfree(map2); + clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, + (void *)&map->passive.flags); +@@ -839,7 +883,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags) + + received: + map2->sock = newsock; +- newsock->sk = kzalloc(sizeof(*newsock->sk), GFP_KERNEL); ++ newsock->sk = sk_alloc(sock_net(sock->sk), PF_INET, GFP_KERNEL, &pvcalls_proto, false); + if (!newsock->sk) { + bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID; + map->passive.inflight_req_id = PVCALLS_INVALID_ID; +@@ -1032,8 +1076,8 @@ int pvcalls_front_release(struct socket *sock) + spin_lock(&bedata->socket_lock); + list_del(&map->list); + spin_unlock(&bedata->socket_lock); +- if (READ_ONCE(map->passive.inflight_req_id) != +- PVCALLS_INVALID_ID) { ++ if (READ_ONCE(map->passive.inflight_req_id) != PVCALLS_INVALID_ID && ++ READ_ONCE(map->passive.inflight_req_id) != 0) { + pvcalls_front_free_map(bedata, + map->passive.accept_map); + } +diff --git a/fs/afs/flock.c b/fs/afs/flock.c +index dc62d15a964b8..1bb300ef362b0 100644 +--- a/fs/afs/flock.c ++++ b/fs/afs/flock.c +@@ -208,7 +208,7 @@ again: + /* The new front of the queue now owns the state variables. */ + next = list_entry(vnode->pending_locks.next, + struct file_lock, fl_u.afs.link); +- vnode->lock_key = afs_file_key(next->fl_file); ++ vnode->lock_key = key_get(afs_file_key(next->fl_file)); + vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE; + vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB; + goto again; +@@ -413,7 +413,7 @@ static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl) + /* The new front of the queue now owns the state variables. */ + next = list_entry(vnode->pending_locks.next, + struct file_lock, fl_u.afs.link); +- vnode->lock_key = afs_file_key(next->fl_file); ++ vnode->lock_key = key_get(afs_file_key(next->fl_file)); + vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE; + vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB; + afs_lock_may_be_available(vnode); +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 071075d775a95..0726e40db0f8b 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -411,7 +411,6 @@ int afs_validate(struct afs_vnode *vnode, struct key *key) + } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) { + valid = true; + } else { +- vnode->cb_s_break = vnode->cb_interest->server->cb_s_break; + vnode->cb_v_break = vnode->volume->cb_v_break; + valid = false; + } +@@ -543,6 +542,8 @@ void afs_evict_inode(struct inode *inode) + #endif + + afs_put_permits(rcu_access_pointer(vnode->permit_cache)); ++ key_put(vnode->lock_key); ++ vnode->lock_key = NULL; + _leave(""); + } + +diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c +index 041c27ea8de15..f74193da0e092 100644 +--- a/fs/ceph/snap.c ++++ b/fs/ceph/snap.c +@@ -616,7 +616,8 @@ int __ceph_finish_cap_snap(struct ceph_inode_info *ci, + capsnap->size); + + spin_lock(&mdsc->snap_flush_lock); +- list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list); ++ if (list_empty(&ci->i_snap_flush_item)) ++ list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list); + spin_unlock(&mdsc->snap_flush_lock); + return 1; /* caller may want to ceph_flush_snaps */ + } +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 7e9f07bf260d2..81d77b15b3479 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -1084,10 +1084,6 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy) + + task_lock(p); + if (!p->vfork_done && process_shares_mm(p, mm)) { +- pr_info("updating oom_score_adj for %d (%s) from %d to %d because it shares mm with %d (%s). Report if this is unexpected.\n", +- task_pid_nr(p), p->comm, +- p->signal->oom_score_adj, oom_adj, +- task_pid_nr(task), task->comm); + p->signal->oom_score_adj = oom_adj; + if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE)) + p->signal->oom_score_adj_min = (short)oom_adj; +diff --git a/include/keys/user-type.h b/include/keys/user-type.h +index e098cbe27db54..12babe9915944 100644 +--- a/include/keys/user-type.h ++++ b/include/keys/user-type.h +@@ -31,7 +31,7 @@ + struct user_key_payload { + struct rcu_head rcu; /* RCU destructor */ + unsigned short datalen; /* length of this data */ +- char data[0]; /* actual data */ ++ char data[0] __aligned(__alignof__(u64)); /* actual data */ + }; + + extern struct key_type key_type_user; +diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h +index b1ce500fe8b3d..d756f2318efe0 100644 +--- a/include/linux/compiler-clang.h ++++ b/include/linux/compiler-clang.h +@@ -3,9 +3,8 @@ + #error "Please don't include directly, include instead." + #endif + +-/* Some compiler specific definitions are overwritten here +- * for Clang compiler +- */ ++/* Compiler specific definitions for Clang compiler */ ++ + #define uninitialized_var(x) x = *(&(x)) + + /* same as gcc, this was present in clang-2.6 so we can assume it works +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 0242f6eec4eaf..a8ff0ca0c3213 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -58,10 +58,6 @@ + (typeof(ptr)) (__ptr + (off)); \ + }) + +-/* Make the optimizer believe the variable can be manipulated arbitrarily. */ +-#define OPTIMIZER_HIDE_VAR(var) \ +- __asm__ ("" : "=r" (var) : "0" (var)) +- + /* + * A trick to suppress uninitialized variable warning without generating any + * code +diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h +index 4c7f9befa9f6c..f1fc60f103176 100644 +--- a/include/linux/compiler-intel.h ++++ b/include/linux/compiler-intel.h +@@ -5,9 +5,7 @@ + + #ifdef __ECC + +-/* Some compiler specific definitions are overwritten here +- * for Intel ECC compiler +- */ ++/* Compiler specific definitions for Intel ECC compiler */ + + #include + +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 681d866efb1eb..269d376f5a119 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -158,7 +158,9 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, + #endif + + #ifndef OPTIMIZER_HIDE_VAR +-#define OPTIMIZER_HIDE_VAR(var) barrier() ++/* Make the optimizer believe the variable can be manipulated arbitrarily. */ ++#define OPTIMIZER_HIDE_VAR(var) \ ++ __asm__ ("" : "=r" (var) : "0" (var)) + #endif + + /* Not-quite-unique ID. */ +diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h +index 59ddf9af909e4..2dd0a9ed5b361 100644 +--- a/include/linux/qed/qed_chain.h ++++ b/include/linux/qed/qed_chain.h +@@ -663,6 +663,37 @@ out: + static inline void qed_chain_set_prod(struct qed_chain *p_chain, + u32 prod_idx, void *p_prod_elem) + { ++ if (p_chain->mode == QED_CHAIN_MODE_PBL) { ++ u32 cur_prod, page_mask, page_cnt, page_diff; ++ ++ cur_prod = is_chain_u16(p_chain) ? p_chain->u.chain16.prod_idx : ++ p_chain->u.chain32.prod_idx; ++ ++ /* Assume that number of elements in a page is power of 2 */ ++ page_mask = ~p_chain->elem_per_page_mask; ++ ++ /* Use "cur_prod - 1" and "prod_idx - 1" since producer index ++ * reaches the first element of next page before the page index ++ * is incremented. See qed_chain_produce(). ++ * Index wrap around is not a problem because the difference ++ * between current and given producer indices is always ++ * positive and lower than the chain's capacity. ++ */ ++ page_diff = (((cur_prod - 1) & page_mask) - ++ ((prod_idx - 1) & page_mask)) / ++ p_chain->elem_per_page; ++ ++ page_cnt = qed_chain_get_page_cnt(p_chain); ++ if (is_chain_u16(p_chain)) ++ p_chain->pbl.c.u16.prod_page_idx = ++ (p_chain->pbl.c.u16.prod_page_idx - ++ page_diff + page_cnt) % page_cnt; ++ else ++ p_chain->pbl.c.u32.prod_page_idx = ++ (p_chain->pbl.c.u32.prod_page_idx - ++ page_diff + page_cnt) % page_cnt; ++ } ++ + if (is_chain_u16(p_chain)) + p_chain->u.chain16.prod_idx = (u16) prod_idx; + else +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 5d69e208e8d91..a404d475acee3 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2392,7 +2392,7 @@ static inline void skb_probe_transport_header(struct sk_buff *skb, + + if (skb_flow_dissect_flow_keys_basic(skb, &keys, NULL, 0, 0, 0, 0)) + skb_set_transport_header(skb, keys.control.thoff); +- else ++ else if (offset_hint >= 0) + skb_set_transport_header(skb, offset_hint); + } + +diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h +index cb462f9ab7dd5..e0348cb0a1dd7 100644 +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -57,6 +57,25 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, + + if (!skb_partial_csum_set(skb, start, off)) + return -EINVAL; ++ } else { ++ /* gso packets without NEEDS_CSUM do not set transport_offset. ++ * probe and drop if does not match one of the above types. ++ */ ++ if (gso_type && skb->network_header) { ++ if (!skb->protocol) ++ virtio_net_hdr_set_proto(skb, hdr); ++retry: ++ skb_probe_transport_header(skb, -1); ++ if (!skb_transport_header_was_set(skb)) { ++ /* UFO does not specify ipv4 or 6: try both */ ++ if (gso_type & SKB_GSO_UDP && ++ skb->protocol == htons(ETH_P_IP)) { ++ skb->protocol = htons(ETH_P_IPV6); ++ goto retry; ++ } ++ return -EINVAL; ++ } ++ } + } + + if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { +diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h +index 0e355f4a3d763..0a3de10c6dece 100644 +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -84,7 +84,6 @@ struct flow_offload { + struct nf_flow_route { + struct { + struct dst_entry *dst; +- int ifindex; + } tuple[FLOW_OFFLOAD_DIR_MAX]; + }; + +diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h +index 14565d703291b..e8baca85bac6a 100644 +--- a/include/uapi/linux/inet_diag.h ++++ b/include/uapi/linux/inet_diag.h +@@ -137,15 +137,21 @@ enum { + INET_DIAG_TCLASS, + INET_DIAG_SKMEMINFO, + INET_DIAG_SHUTDOWN, +- INET_DIAG_DCTCPINFO, +- INET_DIAG_PROTOCOL, /* response attribute only */ ++ ++ /* ++ * Next extenstions cannot be requested in struct inet_diag_req_v2: ++ * its field idiag_ext has only 8 bits. ++ */ ++ ++ INET_DIAG_DCTCPINFO, /* request as INET_DIAG_VEGASINFO */ ++ INET_DIAG_PROTOCOL, /* response attribute only */ + INET_DIAG_SKV6ONLY, + INET_DIAG_LOCALS, + INET_DIAG_PEERS, + INET_DIAG_PAD, +- INET_DIAG_MARK, +- INET_DIAG_BBRINFO, +- INET_DIAG_CLASS_ID, ++ INET_DIAG_MARK, /* only with CAP_NET_ADMIN */ ++ INET_DIAG_BBRINFO, /* request as INET_DIAG_VEGASINFO */ ++ INET_DIAG_CLASS_ID, /* request as INET_DIAG_TCLASS */ + INET_DIAG_MD5SIG, + __INET_DIAG_MAX, + }; +diff --git a/include/video/udlfb.h b/include/video/udlfb.h +index 3abd327bada64..7d09e54ae54e0 100644 +--- a/include/video/udlfb.h ++++ b/include/video/udlfb.h +@@ -36,12 +36,9 @@ struct dlfb_data { + struct usb_device *udev; + struct fb_info *info; + struct urb_list urbs; +- struct kref kref; + char *backing_buffer; + int fb_count; + bool virtualized; /* true when physical usb device not present */ +- struct delayed_work init_framebuffer_work; +- struct delayed_work free_framebuffer_work; + atomic_t usb_active; /* 0 = update virtual buffer, but no usb traffic */ + atomic_t lost_pixels; /* 1 = a render op failed. Need screen refresh */ + char *edid; /* null until we read edid from hw or get from sysfs */ +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 8061a439ef18c..6a32933cae4ff 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -180,11 +180,14 @@ static inline int stack_map_parse_build_id(void *page_addr, + + if (nhdr->n_type == BPF_BUILD_ID && + nhdr->n_namesz == sizeof("GNU") && +- nhdr->n_descsz == BPF_BUILD_ID_SIZE) { ++ nhdr->n_descsz > 0 && ++ nhdr->n_descsz <= BPF_BUILD_ID_SIZE) { + memcpy(build_id, + note_start + note_offs + + ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr), +- BPF_BUILD_ID_SIZE); ++ nhdr->n_descsz); ++ memset(build_id + nhdr->n_descsz, 0, ++ BPF_BUILD_ID_SIZE - nhdr->n_descsz); + return 0; + } + new_offs = note_offs + sizeof(Elf32_Nhdr) + +@@ -260,7 +263,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma, + return -EFAULT; /* page not mapped */ + + ret = -EINVAL; +- page_addr = page_address(page); ++ page_addr = kmap_atomic(page); + ehdr = (Elf32_Ehdr *)page_addr; + + /* compare magic x7f "ELF" */ +@@ -276,6 +279,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma, + else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64) + ret = stack_map_get_build_id_64(page_addr, build_id); + out: ++ kunmap_atomic(page_addr); + put_page(page); + return ret; + } +@@ -310,6 +314,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + for (i = 0; i < trace_nr; i++) { + id_offs[i].status = BPF_STACK_BUILD_ID_IP; + id_offs[i].ip = ips[i]; ++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE); + } + return; + } +@@ -320,6 +325,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + /* per entry fall back to ips */ + id_offs[i].status = BPF_STACK_BUILD_ID_IP; + id_offs[i].ip = ips[i]; ++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE); + continue; + } + id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i] +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index bf6f1d70484dc..17bd0c0dfa98a 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3383,6 +3383,8 @@ static void print_func_help_header_irq(struct trace_buffer *buf, struct seq_file + const char tgid_space[] = " "; + const char space[] = " "; + ++ print_event_info(buf, m); ++ + seq_printf(m, "# %s _-----=> irqs-off\n", + tgid ? tgid_space : space); + seq_printf(m, "# %s / _----=> need-resched\n", +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 149b6f4cf0233..89d4439516f6c 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -1300,7 +1300,7 @@ static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode, + nodemask_t *nodes) + { + unsigned long copy = ALIGN(maxnode-1, 64) / 8; +- const int nbytes = BITS_TO_LONGS(MAX_NUMNODES) * sizeof(long); ++ unsigned int nbytes = BITS_TO_LONGS(nr_node_ids) * sizeof(long); + + if (copy > nbytes) { + if (copy > PAGE_SIZE) +@@ -1477,7 +1477,7 @@ static int kernel_get_mempolicy(int __user *policy, + int uninitialized_var(pval); + nodemask_t nodes; + +- if (nmask != NULL && maxnode < MAX_NUMNODES) ++ if (nmask != NULL && maxnode < nr_node_ids) + return -EINVAL; + + err = do_get_mempolicy(&pval, &nodes, addr, flags); +@@ -1513,7 +1513,7 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy, + unsigned long nr_bits, alloc_size; + DECLARE_BITMAP(bm, MAX_NUMNODES); + +- nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES); ++ nr_bits = min_t(unsigned long, maxnode-1, nr_node_ids); + alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8; + + if (nmask) +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 3899fa6e201dd..a2976adeeedce 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -227,6 +227,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, + + switch (ntohs(ethhdr->h_proto)) { + case ETH_P_8021Q: ++ if (!pskb_may_pull(skb, sizeof(*vhdr))) ++ goto dropped; + vhdr = vlan_eth_hdr(skb); + + /* drop batman-in-batman packets to prevent loops */ +diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c +index 502f663495308..4d4b9b5ea1c17 100644 +--- a/net/bridge/br_fdb.c ++++ b/net/bridge/br_fdb.c +@@ -1088,6 +1088,8 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p, + err = -ENOMEM; + goto err_unlock; + } ++ if (swdev_notify) ++ fdb->added_by_user = 1; + fdb->added_by_external_learn = 1; + fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify); + } else { +@@ -1107,6 +1109,9 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p, + modified = true; + } + ++ if (swdev_notify) ++ fdb->added_by_user = 1; ++ + if (modified) + fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify); + } +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 6dec8e9b34511..20ed7adcf1cc4 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1420,14 +1420,7 @@ static void br_multicast_query_received(struct net_bridge *br, + return; + + br_multicast_update_query_timer(br, query, max_delay); +- +- /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules, +- * the arrival port for IGMP Queries where the source address +- * is 0.0.0.0 should not be added to router port list. +- */ +- if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) || +- saddr->proto == htons(ETH_P_IPV6)) +- br_multicast_mark_router(br, port); ++ br_multicast_mark_router(br, port); + } + + static void br_ip4_multicast_query(struct net_bridge *br, +diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c +index a127d14421164..f7d7f32ac673c 100644 +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -2091,6 +2091,8 @@ static int process_connect(struct ceph_connection *con) + dout("process_connect on %p tag %d\n", con, (int)con->in_tag); + + if (con->auth) { ++ int len = le32_to_cpu(con->in_reply.authorizer_len); ++ + /* + * Any connection that defines ->get_authorizer() + * should also define ->add_authorizer_challenge() and +@@ -2100,8 +2102,7 @@ static int process_connect(struct ceph_connection *con) + */ + if (con->in_reply.tag == CEPH_MSGR_TAG_CHALLENGE_AUTHORIZER) { + ret = con->ops->add_authorizer_challenge( +- con, con->auth->authorizer_reply_buf, +- le32_to_cpu(con->in_reply.authorizer_len)); ++ con, con->auth->authorizer_reply_buf, len); + if (ret < 0) + return ret; + +@@ -2111,10 +2112,12 @@ static int process_connect(struct ceph_connection *con) + return 0; + } + +- ret = con->ops->verify_authorizer_reply(con); +- if (ret < 0) { +- con->error_msg = "bad authorize reply"; +- return ret; ++ if (len) { ++ ret = con->ops->verify_authorizer_reply(con); ++ if (ret < 0) { ++ con->error_msg = "bad authorize reply"; ++ return ret; ++ } + } + } + +diff --git a/net/core/filter.c b/net/core/filter.c +index 8c2411fb25090..fb0080e84bd43 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -3930,7 +3930,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, + sk->sk_rcvlowat = val ? : 1; + break; + case SO_MARK: +- sk->sk_mark = val; ++ if (sk->sk_mark != val) { ++ sk->sk_mark = val; ++ sk_dst_reset(sk); ++ } + break; + default: + ret = -EINVAL; +@@ -4001,7 +4004,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, + /* Only some options are supported */ + switch (optname) { + case TCP_BPF_IW: +- if (val <= 0 || tp->data_segs_out > 0) ++ if (val <= 0 || tp->data_segs_out > tp->syn_data) + ret = -EINVAL; + else + tp->snd_cwnd = val; +diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c +index 1a4e9ff02762e..5731670c560b0 100644 +--- a/net/ipv4/inet_diag.c ++++ b/net/ipv4/inet_diag.c +@@ -108,6 +108,7 @@ static size_t inet_sk_attr_size(struct sock *sk, + + nla_total_size(1) /* INET_DIAG_TOS */ + + nla_total_size(1) /* INET_DIAG_TCLASS */ + + nla_total_size(4) /* INET_DIAG_MARK */ ++ + nla_total_size(4) /* INET_DIAG_CLASS_ID */ + + nla_total_size(sizeof(struct inet_diag_meminfo)) + + nla_total_size(sizeof(struct inet_diag_msg)) + + nla_total_size(SK_MEMINFO_VARS * sizeof(u32)) +@@ -287,12 +288,19 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk, + goto errout; + } + +- if (ext & (1 << (INET_DIAG_CLASS_ID - 1))) { ++ if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) || ++ ext & (1 << (INET_DIAG_TCLASS - 1))) { + u32 classid = 0; + + #ifdef CONFIG_SOCK_CGROUP_DATA + classid = sock_cgroup_classid(&sk->sk_cgrp_data); + #endif ++ /* Fallback to socket priority if class id isn't set. ++ * Classful qdiscs use it as direct reference to class. ++ * For cgroup2 classid is always zero. ++ */ ++ if (!classid) ++ classid = sk->sk_priority; + + if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid)) + goto errout; +diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c +index fb1e7f237f531..3cd237b42f446 100644 +--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c ++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c +@@ -56,7 +56,7 @@ struct clusterip_config { + #endif + enum clusterip_hashmode hash_mode; /* which hashing mode */ + u_int32_t hash_initval; /* hash initialization */ +- struct rcu_head rcu; ++ struct rcu_head rcu; /* for call_rcu_bh */ + struct net *net; /* netns for pernet list */ + char ifname[IFNAMSIZ]; /* device ifname */ + }; +@@ -72,6 +72,8 @@ struct clusterip_net { + + #ifdef CONFIG_PROC_FS + struct proc_dir_entry *procdir; ++ /* mutex protects the config->pde*/ ++ struct mutex mutex; + #endif + }; + +@@ -118,17 +120,18 @@ clusterip_config_entry_put(struct clusterip_config *c) + + local_bh_disable(); + if (refcount_dec_and_lock(&c->entries, &cn->lock)) { ++ list_del_rcu(&c->list); ++ spin_unlock(&cn->lock); ++ local_bh_enable(); + /* In case anyone still accesses the file, the open/close + * functions are also incrementing the refcount on their own, + * so it's safe to remove the entry even if it's in use. */ + #ifdef CONFIG_PROC_FS ++ mutex_lock(&cn->mutex); + if (cn->procdir) + proc_remove(c->pde); ++ mutex_unlock(&cn->mutex); + #endif +- list_del_rcu(&c->list); +- spin_unlock(&cn->lock); +- local_bh_enable(); +- + return; + } + local_bh_enable(); +@@ -278,9 +281,11 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i, + + /* create proc dir entry */ + sprintf(buffer, "%pI4", &ip); ++ mutex_lock(&cn->mutex); + c->pde = proc_create_data(buffer, 0600, + cn->procdir, + &clusterip_proc_fops, c); ++ mutex_unlock(&cn->mutex); + if (!c->pde) { + err = -ENOMEM; + goto err; +@@ -833,6 +838,7 @@ static int clusterip_net_init(struct net *net) + pr_err("Unable to proc dir entry\n"); + return -ENOMEM; + } ++ mutex_init(&cn->mutex); + #endif /* CONFIG_PROC_FS */ + + return 0; +@@ -841,9 +847,12 @@ static int clusterip_net_init(struct net *net) + static void clusterip_net_exit(struct net *net) + { + struct clusterip_net *cn = clusterip_pernet(net); ++ + #ifdef CONFIG_PROC_FS ++ mutex_lock(&cn->mutex); + proc_remove(cn->procdir); + cn->procdir = NULL; ++ mutex_unlock(&cn->mutex); + #endif + nf_unregister_net_hook(net, &cip_arp_ops); + } +diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c +index 8b075f0bc3516..6d0b1f3e927bd 100644 +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -23,9 +23,11 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb) + struct sock *sk = sk_to_full_sk(skb->sk); + unsigned int hh_len; + struct dst_entry *dst; ++ int strict = (ipv6_addr_type(&iph->daddr) & ++ (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)); + struct flowi6 fl6 = { + .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if : +- rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0, ++ strict ? skb_dst(skb)->dev->ifindex : 0, + .flowi6_mark = skb->mark, + .flowi6_uid = sock_net_uid(net, sk), + .daddr = iph->daddr, +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index 8d0ba757a46ce..9b2f272ca1649 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -221,9 +221,7 @@ static int seg6_genl_get_tunsrc(struct sk_buff *skb, struct genl_info *info) + rcu_read_unlock(); + + genlmsg_end(msg, hdr); +- genlmsg_reply(msg, info); +- +- return 0; ++ return genlmsg_reply(msg, info); + + nla_put_failure: + rcu_read_unlock(); +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index eb162bd0e0419..da6d5a3f53995 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -546,7 +546,8 @@ static int ipip6_err(struct sk_buff *skb, u32 info) + } + + err = 0; +- if (!ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len)) ++ if (__in6_dev_get(skb->dev) && ++ !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len)) + goto out; + + if (t->parms.iph.daddr == 0) +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 76ba2f34ef6b1..cab8b2b647f96 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1322,10 +1322,7 @@ do_udp_sendmsg: + ipc6.opt = opt; + + fl6.flowi6_proto = sk->sk_protocol; +- if (!ipv6_addr_any(daddr)) +- fl6.daddr = *daddr; +- else +- fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */ ++ fl6.daddr = *daddr; + if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr)) + fl6.saddr = np->saddr; + fl6.fl6_sport = inet->inet_sport; +@@ -1353,6 +1350,9 @@ do_udp_sendmsg: + } + } + ++ if (ipv6_addr_any(&fl6.daddr)) ++ fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */ ++ + final_p = fl6_update_dst(&fl6, opt, &final); + if (final_p) + connected = false; +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 5d22eda8a6b1e..c2abe9db1ea24 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -887,6 +887,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev, + BSS_CHANGED_P2P_PS | + BSS_CHANGED_TXPOWER; + int err; ++ int prev_beacon_int; + + old = sdata_dereference(sdata->u.ap.beacon, sdata); + if (old) +@@ -909,6 +910,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev, + + sdata->needed_rx_chains = sdata->local->rx_chains; + ++ prev_beacon_int = sdata->vif.bss_conf.beacon_int; + sdata->vif.bss_conf.beacon_int = params->beacon_interval; + + mutex_lock(&local->mtx); +@@ -917,8 +919,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev, + if (!err) + ieee80211_vif_copy_chanctx_to_vlans(sdata, false); + mutex_unlock(&local->mtx); +- if (err) ++ if (err) { ++ sdata->vif.bss_conf.beacon_int = prev_beacon_int; + return err; ++ } + + /* + * Apply control port protocol, this allows us to +diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h +index 21526630bf655..e84103b405341 100644 +--- a/net/mac80211/mesh.h ++++ b/net/mac80211/mesh.h +@@ -70,6 +70,7 @@ enum mesh_deferred_task_flags { + * @dst: mesh path destination mac address + * @mpp: mesh proxy mac address + * @rhash: rhashtable list pointer ++ * @walk_list: linked list containing all mesh_path objects. + * @gate_list: list pointer for known gates list + * @sdata: mesh subif + * @next_hop: mesh neighbor to which frames for this destination will be +@@ -105,6 +106,7 @@ struct mesh_path { + u8 dst[ETH_ALEN]; + u8 mpp[ETH_ALEN]; /* used for MPP or MAP */ + struct rhash_head rhash; ++ struct hlist_node walk_list; + struct hlist_node gate_list; + struct ieee80211_sub_if_data *sdata; + struct sta_info __rcu *next_hop; +@@ -133,12 +135,16 @@ struct mesh_path { + * gate's mpath may or may not be resolved and active. + * @gates_lock: protects updates to known_gates + * @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr ++ * @walk_head: linked list containging all mesh_path objects ++ * @walk_lock: lock protecting walk_head + * @entries: number of entries in the table + */ + struct mesh_table { + struct hlist_head known_gates; + spinlock_t gates_lock; + struct rhashtable rhead; ++ struct hlist_head walk_head; ++ spinlock_t walk_lock; + atomic_t entries; /* Up to MAX_MESH_NEIGHBOURS */ + }; + +diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c +index a5125624a76dc..c3a7396fb9556 100644 +--- a/net/mac80211/mesh_pathtbl.c ++++ b/net/mac80211/mesh_pathtbl.c +@@ -59,8 +59,10 @@ static struct mesh_table *mesh_table_alloc(void) + return NULL; + + INIT_HLIST_HEAD(&newtbl->known_gates); ++ INIT_HLIST_HEAD(&newtbl->walk_head); + atomic_set(&newtbl->entries, 0); + spin_lock_init(&newtbl->gates_lock); ++ spin_lock_init(&newtbl->walk_lock); + + return newtbl; + } +@@ -249,28 +251,15 @@ mpp_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst) + static struct mesh_path * + __mesh_path_lookup_by_idx(struct mesh_table *tbl, int idx) + { +- int i = 0, ret; +- struct mesh_path *mpath = NULL; +- struct rhashtable_iter iter; +- +- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC); +- if (ret) +- return NULL; +- +- rhashtable_walk_start(&iter); ++ int i = 0; ++ struct mesh_path *mpath; + +- while ((mpath = rhashtable_walk_next(&iter))) { +- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN) +- continue; +- if (IS_ERR(mpath)) +- break; ++ hlist_for_each_entry_rcu(mpath, &tbl->walk_head, walk_list) { + if (i++ == idx) + break; + } +- rhashtable_walk_stop(&iter); +- rhashtable_walk_exit(&iter); + +- if (IS_ERR(mpath) || !mpath) ++ if (!mpath) + return NULL; + + if (mpath_expired(mpath)) { +@@ -432,6 +421,7 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata, + return ERR_PTR(-ENOMEM); + + tbl = sdata->u.mesh.mesh_paths; ++ spin_lock_bh(&tbl->walk_lock); + do { + ret = rhashtable_lookup_insert_fast(&tbl->rhead, + &new_mpath->rhash, +@@ -441,20 +431,20 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata, + mpath = rhashtable_lookup_fast(&tbl->rhead, + dst, + mesh_rht_params); +- ++ else if (!ret) ++ hlist_add_head(&new_mpath->walk_list, &tbl->walk_head); + } while (unlikely(ret == -EEXIST && !mpath)); ++ spin_unlock_bh(&tbl->walk_lock); + +- if (ret && ret != -EEXIST) +- return ERR_PTR(ret); +- +- /* At this point either new_mpath was added, or we found a +- * matching entry already in the table; in the latter case +- * free the unnecessary new entry. +- */ +- if (ret == -EEXIST) { ++ if (ret) { + kfree(new_mpath); ++ ++ if (ret != -EEXIST) ++ return ERR_PTR(ret); ++ + new_mpath = mpath; + } ++ + sdata->u.mesh.mesh_paths_generation++; + return new_mpath; + } +@@ -480,9 +470,17 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata, + + memcpy(new_mpath->mpp, mpp, ETH_ALEN); + tbl = sdata->u.mesh.mpp_paths; ++ ++ spin_lock_bh(&tbl->walk_lock); + ret = rhashtable_lookup_insert_fast(&tbl->rhead, + &new_mpath->rhash, + mesh_rht_params); ++ if (!ret) ++ hlist_add_head_rcu(&new_mpath->walk_list, &tbl->walk_head); ++ spin_unlock_bh(&tbl->walk_lock); ++ ++ if (ret) ++ kfree(new_mpath); + + sdata->u.mesh.mpp_paths_generation++; + return ret; +@@ -503,20 +501,9 @@ void mesh_plink_broken(struct sta_info *sta) + struct mesh_table *tbl = sdata->u.mesh.mesh_paths; + static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; + struct mesh_path *mpath; +- struct rhashtable_iter iter; +- int ret; +- +- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC); +- if (ret) +- return; + +- rhashtable_walk_start(&iter); +- +- while ((mpath = rhashtable_walk_next(&iter))) { +- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN) +- continue; +- if (IS_ERR(mpath)) +- break; ++ rcu_read_lock(); ++ hlist_for_each_entry_rcu(mpath, &tbl->walk_head, walk_list) { + if (rcu_access_pointer(mpath->next_hop) == sta && + mpath->flags & MESH_PATH_ACTIVE && + !(mpath->flags & MESH_PATH_FIXED)) { +@@ -530,8 +517,7 @@ void mesh_plink_broken(struct sta_info *sta) + WLAN_REASON_MESH_PATH_DEST_UNREACHABLE, bcast); + } + } +- rhashtable_walk_stop(&iter); +- rhashtable_walk_exit(&iter); ++ rcu_read_unlock(); + } + + static void mesh_path_free_rcu(struct mesh_table *tbl, +@@ -551,6 +537,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl, + + static void __mesh_path_del(struct mesh_table *tbl, struct mesh_path *mpath) + { ++ hlist_del_rcu(&mpath->walk_list); + rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params); + mesh_path_free_rcu(tbl, mpath); + } +@@ -571,27 +558,14 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta) + struct ieee80211_sub_if_data *sdata = sta->sdata; + struct mesh_table *tbl = sdata->u.mesh.mesh_paths; + struct mesh_path *mpath; +- struct rhashtable_iter iter; +- int ret; +- +- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC); +- if (ret) +- return; +- +- rhashtable_walk_start(&iter); +- +- while ((mpath = rhashtable_walk_next(&iter))) { +- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN) +- continue; +- if (IS_ERR(mpath)) +- break; ++ struct hlist_node *n; + ++ spin_lock_bh(&tbl->walk_lock); ++ hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) { + if (rcu_access_pointer(mpath->next_hop) == sta) + __mesh_path_del(tbl, mpath); + } +- +- rhashtable_walk_stop(&iter); +- rhashtable_walk_exit(&iter); ++ spin_unlock_bh(&tbl->walk_lock); + } + + static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata, +@@ -599,51 +573,26 @@ static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata, + { + struct mesh_table *tbl = sdata->u.mesh.mpp_paths; + struct mesh_path *mpath; +- struct rhashtable_iter iter; +- int ret; +- +- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC); +- if (ret) +- return; +- +- rhashtable_walk_start(&iter); +- +- while ((mpath = rhashtable_walk_next(&iter))) { +- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN) +- continue; +- if (IS_ERR(mpath)) +- break; ++ struct hlist_node *n; + ++ spin_lock_bh(&tbl->walk_lock); ++ hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) { + if (ether_addr_equal(mpath->mpp, proxy)) + __mesh_path_del(tbl, mpath); + } +- +- rhashtable_walk_stop(&iter); +- rhashtable_walk_exit(&iter); ++ spin_unlock_bh(&tbl->walk_lock); + } + + static void table_flush_by_iface(struct mesh_table *tbl) + { + struct mesh_path *mpath; +- struct rhashtable_iter iter; +- int ret; +- +- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC); +- if (ret) +- return; +- +- rhashtable_walk_start(&iter); ++ struct hlist_node *n; + +- while ((mpath = rhashtable_walk_next(&iter))) { +- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN) +- continue; +- if (IS_ERR(mpath)) +- break; ++ spin_lock_bh(&tbl->walk_lock); ++ hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) { + __mesh_path_del(tbl, mpath); + } +- +- rhashtable_walk_stop(&iter); +- rhashtable_walk_exit(&iter); ++ spin_unlock_bh(&tbl->walk_lock); + } + + /** +@@ -675,7 +624,7 @@ static int table_path_del(struct mesh_table *tbl, + { + struct mesh_path *mpath; + +- rcu_read_lock(); ++ spin_lock_bh(&tbl->walk_lock); + mpath = rhashtable_lookup_fast(&tbl->rhead, addr, mesh_rht_params); + if (!mpath) { + rcu_read_unlock(); +@@ -683,7 +632,7 @@ static int table_path_del(struct mesh_table *tbl, + } + + __mesh_path_del(tbl, mpath); +- rcu_read_unlock(); ++ spin_unlock_bh(&tbl->walk_lock); + return 0; + } + +@@ -854,28 +803,16 @@ void mesh_path_tbl_expire(struct ieee80211_sub_if_data *sdata, + struct mesh_table *tbl) + { + struct mesh_path *mpath; +- struct rhashtable_iter iter; +- int ret; ++ struct hlist_node *n; + +- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_KERNEL); +- if (ret) +- return; +- +- rhashtable_walk_start(&iter); +- +- while ((mpath = rhashtable_walk_next(&iter))) { +- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN) +- continue; +- if (IS_ERR(mpath)) +- break; ++ spin_lock_bh(&tbl->walk_lock); ++ hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) { + if ((!(mpath->flags & MESH_PATH_RESOLVING)) && + (!(mpath->flags & MESH_PATH_FIXED)) && + time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE)) + __mesh_path_del(tbl, mpath); + } +- +- rhashtable_walk_stop(&iter); +- rhashtable_walk_exit(&iter); ++ spin_unlock_bh(&tbl->walk_lock); + } + + void mesh_path_expire(struct ieee80211_sub_if_data *sdata) +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 51ad330bf8e83..828348b2a504d 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2598,6 +2598,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + struct ieee80211_sub_if_data *sdata = rx->sdata; + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; + u16 ac, q, hdrlen; ++ int tailroom = 0; + + hdr = (struct ieee80211_hdr *) skb->data; + hdrlen = ieee80211_hdrlen(hdr->frame_control); +@@ -2684,8 +2685,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + if (!ifmsh->mshcfg.dot11MeshForwarding) + goto out; + ++ if (sdata->crypto_tx_tailroom_needed_cnt) ++ tailroom = IEEE80211_ENCRYPT_TAILROOM; ++ + fwd_skb = skb_copy_expand(skb, local->tx_headroom + +- sdata->encrypt_headroom, 0, GFP_ATOMIC); ++ sdata->encrypt_headroom, ++ tailroom, GFP_ATOMIC); + if (!fwd_skb) + goto out; + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index d8125616edc79..e1537ace2b90c 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -28,6 +28,7 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, + { + struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; + struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; ++ struct dst_entry *other_dst = route->tuple[!dir].dst; + struct dst_entry *dst = route->tuple[dir].dst; + + ft->dir = dir; +@@ -50,8 +51,8 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, + ft->src_port = ctt->src.u.tcp.port; + ft->dst_port = ctt->dst.u.tcp.port; + +- ft->iifidx = route->tuple[dir].ifindex; +- ft->oifidx = route->tuple[!dir].ifindex; ++ ft->iifidx = other_dst->dev->ifindex; ++ ft->oifidx = dst->dev->ifindex; + ft->dst_cache = dst; + } + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index ed9af46720e14..7d424fd270255 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -291,6 +291,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx) + int err; + + list_for_each_entry(rule, &ctx->chain->rules, list) { ++ if (!nft_is_active_next(ctx->net, rule)) ++ continue; ++ + err = nft_delrule(ctx, rule); + if (err < 0) + return err; +@@ -4439,6 +4442,8 @@ err6: + err5: + kfree(trans); + err4: ++ if (obj) ++ obj->use--; + kfree(elem.priv); + err3: + if (nla[NFTA_SET_ELEM_DATA] != NULL) +diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c +index 00db27dfd2ff7..b0bc130947c94 100644 +--- a/net/netfilter/nfnetlink_osf.c ++++ b/net/netfilter/nfnetlink_osf.c +@@ -71,6 +71,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb, + int ttl_check, + struct nf_osf_hdr_ctx *ctx) + { ++ const __u8 *optpinit = ctx->optp; + unsigned int check_WSS = 0; + int fmatch = FMATCH_WRONG; + int foptsize, optnum; +@@ -160,6 +161,9 @@ static bool nf_osf_match_one(const struct sk_buff *skb, + } + } + ++ if (fmatch != FMATCH_OK) ++ ctx->optp = optpinit; ++ + return fmatch == FMATCH_OK; + } + +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index 29d6fc73caf99..38da1f5436b48 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -282,6 +282,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) + { + struct xt_target *target = expr->ops->data; + void *info = nft_expr_priv(expr); ++ struct module *me = target->me; + struct xt_tgdtor_param par; + + par.net = ctx->net; +@@ -292,7 +293,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) + par.target->destroy(&par); + + if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) +- module_put(target->me); ++ module_put(me); + } + + static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr) +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 5fd4c57c79cc9..436cc14cfc59b 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + struct nft_flow_offload { + struct nft_flowtable *flowtable; +@@ -29,10 +30,12 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, + memset(&fl, 0, sizeof(fl)); + switch (nft_pf(pkt)) { + case NFPROTO_IPV4: +- fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip; ++ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; ++ fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex; + break; + case NFPROTO_IPV6: +- fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6; ++ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; ++ fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex; + break; + } + +@@ -41,9 +44,7 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, + return -ENOENT; + + route->tuple[dir].dst = this_dst; +- route->tuple[dir].ifindex = nft_in(pkt)->ifindex; + route->tuple[!dir].dst = other_dst; +- route->tuple[!dir].ifindex = nft_out(pkt)->ifindex; + + return 0; + } +@@ -66,6 +67,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + { + struct nft_flow_offload *priv = nft_expr_priv(expr); + struct nf_flowtable *flowtable = &priv->flowtable->data; ++ const struct nf_conn_help *help; + enum ip_conntrack_info ctinfo; + struct nf_flow_route route; + struct flow_offload *flow; +@@ -88,7 +90,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + goto out; + } + +- if (test_bit(IPS_HELPER_BIT, &ct->status)) ++ help = nfct_help(ct); ++ if (help) + goto out; + + if (ctinfo == IP_CT_NEW || +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index c76c21604ffd9..fd16fb836df28 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -4275,7 +4275,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + rb->frames_per_block = req->tp_block_size / req->tp_frame_size; + if (unlikely(rb->frames_per_block == 0)) + goto out; +- if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr)) ++ if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr)) + goto out; + if (unlikely((rb->frames_per_block * req->tp_block_nr) != + req->tp_frame_nr)) +diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c +index 9ccc93f257db0..38bb882bb9587 100644 +--- a/net/sched/cls_tcindex.c ++++ b/net/sched/cls_tcindex.c +@@ -48,7 +48,7 @@ struct tcindex_data { + u32 hash; /* hash table size; 0 if undefined */ + u32 alloc_hash; /* allocated size */ + u32 fall_through; /* 0: only classify if explicit match */ +- struct rcu_head rcu; ++ struct rcu_work rwork; + }; + + static inline int tcindex_filter_is_set(struct tcindex_filter_result *r) +@@ -221,17 +221,11 @@ found: + return 0; + } + +-static int tcindex_destroy_element(struct tcf_proto *tp, +- void *arg, struct tcf_walker *walker) +-{ +- bool last; +- +- return tcindex_delete(tp, arg, &last, NULL); +-} +- +-static void __tcindex_destroy(struct rcu_head *head) ++static void tcindex_destroy_work(struct work_struct *work) + { +- struct tcindex_data *p = container_of(head, struct tcindex_data, rcu); ++ struct tcindex_data *p = container_of(to_rcu_work(work), ++ struct tcindex_data, ++ rwork); + + kfree(p->perfect); + kfree(p->h); +@@ -258,9 +252,11 @@ static int tcindex_filter_result_init(struct tcindex_filter_result *r) + return tcf_exts_init(&r->exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE); + } + +-static void __tcindex_partial_destroy(struct rcu_head *head) ++static void tcindex_partial_destroy_work(struct work_struct *work) + { +- struct tcindex_data *p = container_of(head, struct tcindex_data, rcu); ++ struct tcindex_data *p = container_of(to_rcu_work(work), ++ struct tcindex_data, ++ rwork); + + kfree(p->perfect); + kfree(p); +@@ -275,7 +271,7 @@ static void tcindex_free_perfect_hash(struct tcindex_data *cp) + kfree(cp->perfect); + } + +-static int tcindex_alloc_perfect_hash(struct tcindex_data *cp) ++static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp) + { + int i, err = 0; + +@@ -289,6 +285,9 @@ static int tcindex_alloc_perfect_hash(struct tcindex_data *cp) + TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE); + if (err < 0) + goto errout; ++#ifdef CONFIG_NET_CLS_ACT ++ cp->perfect[i].exts.net = net; ++#endif + } + + return 0; +@@ -305,9 +304,9 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, + struct nlattr *est, bool ovr, struct netlink_ext_ack *extack) + { + struct tcindex_filter_result new_filter_result, *old_r = r; +- struct tcindex_filter_result cr; + struct tcindex_data *cp = NULL, *oldp; + struct tcindex_filter *f = NULL; /* make gcc behave */ ++ struct tcf_result cr = {}; + int err, balloc = 0; + struct tcf_exts e; + +@@ -337,7 +336,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, + if (p->perfect) { + int i; + +- if (tcindex_alloc_perfect_hash(cp) < 0) ++ if (tcindex_alloc_perfect_hash(net, cp) < 0) + goto errout; + for (i = 0; i < cp->hash; i++) + cp->perfect[i].res = p->perfect[i].res; +@@ -346,13 +345,10 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, + cp->h = p->h; + + err = tcindex_filter_result_init(&new_filter_result); +- if (err < 0) +- goto errout1; +- err = tcindex_filter_result_init(&cr); + if (err < 0) + goto errout1; + if (old_r) +- cr.res = r->res; ++ cr = r->res; + + if (tb[TCA_TCINDEX_HASH]) + cp->hash = nla_get_u32(tb[TCA_TCINDEX_HASH]); +@@ -406,7 +402,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, + err = -ENOMEM; + if (!cp->perfect && !cp->h) { + if (valid_perfect_hash(cp)) { +- if (tcindex_alloc_perfect_hash(cp) < 0) ++ if (tcindex_alloc_perfect_hash(net, cp) < 0) + goto errout_alloc; + balloc = 1; + } else { +@@ -443,8 +439,8 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, + } + + if (tb[TCA_TCINDEX_CLASSID]) { +- cr.res.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]); +- tcf_bind_filter(tp, &cr.res, base); ++ cr.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]); ++ tcf_bind_filter(tp, &cr, base); + } + + if (old_r && old_r != r) { +@@ -456,7 +452,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, + } + + oldp = p; +- r->res = cr.res; ++ r->res = cr; + tcf_exts_change(&r->exts, &e); + + rcu_assign_pointer(tp->root, cp); +@@ -475,10 +471,12 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, + ; /* nothing */ + + rcu_assign_pointer(*fp, f); ++ } else { ++ tcf_exts_destroy(&new_filter_result.exts); + } + + if (oldp) +- call_rcu(&oldp->rcu, __tcindex_partial_destroy); ++ tcf_queue_work(&oldp->rwork, tcindex_partial_destroy_work); + return 0; + + errout_alloc: +@@ -487,7 +485,6 @@ errout_alloc: + else if (balloc == 2) + kfree(cp->h); + errout1: +- tcf_exts_destroy(&cr.exts); + tcf_exts_destroy(&new_filter_result.exts); + errout: + kfree(cp); +@@ -562,15 +559,34 @@ static void tcindex_destroy(struct tcf_proto *tp, + struct netlink_ext_ack *extack) + { + struct tcindex_data *p = rtnl_dereference(tp->root); +- struct tcf_walker walker; ++ int i; + + pr_debug("tcindex_destroy(tp %p),p %p\n", tp, p); +- walker.count = 0; +- walker.skip = 0; +- walker.fn = tcindex_destroy_element; +- tcindex_walk(tp, &walker); + +- call_rcu(&p->rcu, __tcindex_destroy); ++ if (p->perfect) { ++ for (i = 0; i < p->hash; i++) { ++ struct tcindex_filter_result *r = p->perfect + i; ++ ++ tcf_unbind_filter(tp, &r->res); ++ if (tcf_exts_get_net(&r->exts)) ++ tcf_queue_work(&r->rwork, ++ tcindex_destroy_rexts_work); ++ else ++ __tcindex_destroy_rexts(r); ++ } ++ } ++ ++ for (i = 0; p->h && i < p->hash; i++) { ++ struct tcindex_filter *f, *next; ++ bool last; ++ ++ for (f = rtnl_dereference(p->h[i]); f; f = next) { ++ next = rtnl_dereference(f->next); ++ tcindex_delete(tp, &f->result, &last, NULL); ++ } ++ } ++ ++ tcf_queue_work(&p->rwork, tcindex_destroy_work); + } + + +diff --git a/net/sctp/diag.c b/net/sctp/diag.c +index 078f01a8d582a..435847d98b51c 100644 +--- a/net/sctp/diag.c ++++ b/net/sctp/diag.c +@@ -256,6 +256,7 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc) + + nla_total_size(1) /* INET_DIAG_TOS */ + + nla_total_size(1) /* INET_DIAG_TCLASS */ + + nla_total_size(4) /* INET_DIAG_MARK */ ++ + nla_total_size(4) /* INET_DIAG_CLASS_ID */ + + nla_total_size(addrlen * asoc->peer.transport_count) + + nla_total_size(addrlen * addrcnt) + + nla_total_size(sizeof(struct inet_diag_meminfo)) +diff --git a/net/sctp/offload.c b/net/sctp/offload.c +index 123e9f2dc2265..edfcf16e704c4 100644 +--- a/net/sctp/offload.c ++++ b/net/sctp/offload.c +@@ -36,6 +36,7 @@ static __le32 sctp_gso_make_checksum(struct sk_buff *skb) + { + skb->ip_summed = CHECKSUM_NONE; + skb->csum_not_inet = 0; ++ gso_reset_checksum(skb, ~0); + return sctp_compute_cksum(skb, skb_transport_offset(skb)); + } + +diff --git a/net/sctp/stream.c b/net/sctp/stream.c +index f24633114dfdf..2936ed17bf9ef 100644 +--- a/net/sctp/stream.c ++++ b/net/sctp/stream.c +@@ -144,8 +144,10 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream, + } + } + +- for (i = outcnt; i < stream->outcnt; i++) ++ for (i = outcnt; i < stream->outcnt; i++) { + kfree(SCTP_SO(stream, i)->ext); ++ SCTP_SO(stream, i)->ext = NULL; ++ } + } + + static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt, +diff --git a/net/socket.c b/net/socket.c +index 390a8ecef4bf4..5c820212ba815 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -941,8 +941,7 @@ void dlci_ioctl_set(int (*hook) (unsigned int, void __user *)) + EXPORT_SYMBOL(dlci_ioctl_set); + + static long sock_do_ioctl(struct net *net, struct socket *sock, +- unsigned int cmd, unsigned long arg, +- unsigned int ifreq_size) ++ unsigned int cmd, unsigned long arg) + { + int err; + void __user *argp = (void __user *)arg; +@@ -968,11 +967,11 @@ static long sock_do_ioctl(struct net *net, struct socket *sock, + } else { + struct ifreq ifr; + bool need_copyout; +- if (copy_from_user(&ifr, argp, ifreq_size)) ++ if (copy_from_user(&ifr, argp, sizeof(struct ifreq))) + return -EFAULT; + err = dev_ioctl(net, cmd, &ifr, &need_copyout); + if (!err && need_copyout) +- if (copy_to_user(argp, &ifr, ifreq_size)) ++ if (copy_to_user(argp, &ifr, sizeof(struct ifreq))) + return -EFAULT; + } + return err; +@@ -1071,8 +1070,7 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg) + err = open_related_ns(&net->ns, get_net_ns); + break; + default: +- err = sock_do_ioctl(net, sock, cmd, arg, +- sizeof(struct ifreq)); ++ err = sock_do_ioctl(net, sock, cmd, arg); + break; + } + return err; +@@ -2752,8 +2750,7 @@ static int do_siocgstamp(struct net *net, struct socket *sock, + int err; + + set_fs(KERNEL_DS); +- err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv, +- sizeof(struct compat_ifreq)); ++ err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv); + set_fs(old_fs); + if (!err) + err = compat_put_timeval(&ktv, up); +@@ -2769,8 +2766,7 @@ static int do_siocgstampns(struct net *net, struct socket *sock, + int err; + + set_fs(KERNEL_DS); +- err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts, +- sizeof(struct compat_ifreq)); ++ err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts); + set_fs(old_fs); + if (!err) + err = compat_put_timespec(&kts, up); +@@ -2966,6 +2962,54 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd, + return dev_ioctl(net, cmd, &ifreq, NULL); + } + ++static int compat_ifreq_ioctl(struct net *net, struct socket *sock, ++ unsigned int cmd, ++ struct compat_ifreq __user *uifr32) ++{ ++ struct ifreq __user *uifr; ++ int err; ++ ++ /* Handle the fact that while struct ifreq has the same *layout* on ++ * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data, ++ * which are handled elsewhere, it still has different *size* due to ++ * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit, ++ * resulting in struct ifreq being 32 and 40 bytes respectively). ++ * As a result, if the struct happens to be at the end of a page and ++ * the next page isn't readable/writable, we get a fault. To prevent ++ * that, copy back and forth to the full size. ++ */ ++ ++ uifr = compat_alloc_user_space(sizeof(*uifr)); ++ if (copy_in_user(uifr, uifr32, sizeof(*uifr32))) ++ return -EFAULT; ++ ++ err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr); ++ ++ if (!err) { ++ switch (cmd) { ++ case SIOCGIFFLAGS: ++ case SIOCGIFMETRIC: ++ case SIOCGIFMTU: ++ case SIOCGIFMEM: ++ case SIOCGIFHWADDR: ++ case SIOCGIFINDEX: ++ case SIOCGIFADDR: ++ case SIOCGIFBRDADDR: ++ case SIOCGIFDSTADDR: ++ case SIOCGIFNETMASK: ++ case SIOCGIFPFLAGS: ++ case SIOCGIFTXQLEN: ++ case SIOCGMIIPHY: ++ case SIOCGMIIREG: ++ case SIOCGIFNAME: ++ if (copy_in_user(uifr32, uifr, sizeof(*uifr32))) ++ err = -EFAULT; ++ break; ++ } ++ } ++ return err; ++} ++ + static int compat_sioc_ifmap(struct net *net, unsigned int cmd, + struct compat_ifreq __user *uifr32) + { +@@ -3081,8 +3125,7 @@ static int routing_ioctl(struct net *net, struct socket *sock, + } + + set_fs(KERNEL_DS); +- ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r, +- sizeof(struct compat_ifreq)); ++ ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r); + set_fs(old_fs); + + out: +@@ -3182,21 +3225,22 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock, + case SIOCSIFTXQLEN: + case SIOCBRADDIF: + case SIOCBRDELIF: ++ case SIOCGIFNAME: + case SIOCSIFNAME: + case SIOCGMIIPHY: + case SIOCGMIIREG: + case SIOCSMIIREG: +- case SIOCSARP: +- case SIOCGARP: +- case SIOCDARP: +- case SIOCATMARK: + case SIOCBONDENSLAVE: + case SIOCBONDRELEASE: + case SIOCBONDSETHWADDR: + case SIOCBONDCHANGEACTIVE: +- case SIOCGIFNAME: +- return sock_do_ioctl(net, sock, cmd, arg, +- sizeof(struct compat_ifreq)); ++ return compat_ifreq_ioctl(net, sock, cmd, argp); ++ ++ case SIOCSARP: ++ case SIOCGARP: ++ case SIOCDARP: ++ case SIOCATMARK: ++ return sock_do_ioctl(net, sock, cmd, arg); + } + + return -ENOIOCTLCMD; +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 956a5ea47b58e..3d6bf790cf1fb 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -872,7 +872,7 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt) + for (i = 0; i <= buf->rb_sc_last; i++) { + sc = rpcrdma_sendctx_create(&r_xprt->rx_ia); + if (!sc) +- goto out_destroy; ++ return -ENOMEM; + + sc->sc_xprt = r_xprt; + buf->rb_sc_ctxs[i] = sc; +@@ -880,10 +880,6 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt) + buf->rb_flags = 0; + + return 0; +- +-out_destroy: +- rpcrdma_sendctxs_destroy(buf); +- return -ENOMEM; + } + + /* The sendctx queue is not guaranteed to have a size that is a +diff --git a/security/keys/key.c b/security/keys/key.c +index d97c9394b5dd4..249a6da4d2770 100644 +--- a/security/keys/key.c ++++ b/security/keys/key.c +@@ -265,8 +265,8 @@ struct key *key_alloc(struct key_type *type, const char *desc, + + spin_lock(&user->lock); + if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) { +- if (user->qnkeys + 1 >= maxkeys || +- user->qnbytes + quotalen >= maxbytes || ++ if (user->qnkeys + 1 > maxkeys || ++ user->qnbytes + quotalen > maxbytes || + user->qnbytes + quotalen < user->qnbytes) + goto no_quota; + } +diff --git a/security/keys/keyring.c b/security/keys/keyring.c +index 41bcf57e96f21..99a55145ddcd2 100644 +--- a/security/keys/keyring.c ++++ b/security/keys/keyring.c +@@ -661,9 +661,6 @@ static bool search_nested_keyrings(struct key *keyring, + BUG_ON((ctx->flags & STATE_CHECKS) == 0 || + (ctx->flags & STATE_CHECKS) == STATE_CHECKS); + +- if (ctx->index_key.description) +- ctx->index_key.desc_len = strlen(ctx->index_key.description); +- + /* Check to see if this top-level keyring is what we are looking for + * and whether it is valid or not. + */ +@@ -914,6 +911,7 @@ key_ref_t keyring_search(key_ref_t keyring, + struct keyring_search_context ctx = { + .index_key.type = type, + .index_key.description = description, ++ .index_key.desc_len = strlen(description), + .cred = current_cred(), + .match_data.cmp = key_default_cmp, + .match_data.raw_data = description, +diff --git a/security/keys/proc.c b/security/keys/proc.c +index 5af2934965d80..d38be9db2cc07 100644 +--- a/security/keys/proc.c ++++ b/security/keys/proc.c +@@ -166,8 +166,7 @@ static int proc_keys_show(struct seq_file *m, void *v) + int rc; + + struct keyring_search_context ctx = { +- .index_key.type = key->type, +- .index_key.description = key->description, ++ .index_key = key->index_key, + .cred = m->file->f_cred, + .match_data.cmp = lookup_user_key_possessed, + .match_data.raw_data = key, +diff --git a/security/keys/request_key.c b/security/keys/request_key.c +index 114f7408feee6..7385536986497 100644 +--- a/security/keys/request_key.c ++++ b/security/keys/request_key.c +@@ -545,6 +545,7 @@ struct key *request_key_and_link(struct key_type *type, + struct keyring_search_context ctx = { + .index_key.type = type, + .index_key.description = description, ++ .index_key.desc_len = strlen(description), + .cred = current_cred(), + .match_data.cmp = key_default_cmp, + .match_data.raw_data = description, +diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c +index 424e1d90412ea..6797843154f03 100644 +--- a/security/keys/request_key_auth.c ++++ b/security/keys/request_key_auth.c +@@ -246,7 +246,7 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id) + struct key *authkey; + key_ref_t authkey_ref; + +- sprintf(description, "%x", target_id); ++ ctx.index_key.desc_len = sprintf(description, "%x", target_id); + + authkey_ref = search_process_keyrings(&ctx); + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 9199d91d0a594..bf1ffcaab23fe 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -1855,6 +1855,8 @@ enum { + ALC887_FIXUP_BASS_CHMAP, + ALC1220_FIXUP_GB_DUAL_CODECS, + ALC1220_FIXUP_CLEVO_P950, ++ ALC1220_FIXUP_SYSTEM76_ORYP5, ++ ALC1220_FIXUP_SYSTEM76_ORYP5_PINS, + }; + + static void alc889_fixup_coef(struct hda_codec *codec, +@@ -2056,6 +2058,17 @@ static void alc1220_fixup_clevo_p950(struct hda_codec *codec, + snd_hda_override_conn_list(codec, 0x1b, 1, conn1); + } + ++static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action); ++ ++static void alc1220_fixup_system76_oryp5(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ alc1220_fixup_clevo_p950(codec, fix, action); ++ alc_fixup_headset_mode_no_hp_mic(codec, fix, action); ++} ++ + static const struct hda_fixup alc882_fixups[] = { + [ALC882_FIXUP_ABIT_AW9D_MAX] = { + .type = HDA_FIXUP_PINS, +@@ -2300,6 +2313,19 @@ static const struct hda_fixup alc882_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc1220_fixup_clevo_p950, + }, ++ [ALC1220_FIXUP_SYSTEM76_ORYP5] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc1220_fixup_system76_oryp5, ++ }, ++ [ALC1220_FIXUP_SYSTEM76_ORYP5_PINS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */ ++ {} ++ }, ++ .chained = true, ++ .chain_id = ALC1220_FIXUP_SYSTEM76_ORYP5, ++ }, + }; + + static const struct snd_pci_quirk alc882_fixup_tbl[] = { +@@ -2376,6 +2402,8 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950), ++ SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS), ++ SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS), + SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD), + SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD), + SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530), +@@ -5573,6 +5601,7 @@ enum { + ALC294_FIXUP_ASUS_HEADSET_MIC, + ALC294_FIXUP_ASUS_SPK, + ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE, ++ ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6506,6 +6535,17 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC + }, ++ [ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* Disable PCBEEP-IN passthrough */ ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x36 }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x57d7 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC285_FIXUP_LENOVO_HEADPHONE_NOISE ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7187,7 +7227,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60130}, + {0x19, 0x03a11020}, + {0x21, 0x0321101f}), +- SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_HEADPHONE_NOISE, ++ SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, + {0x12, 0x90a60130}, + {0x14, 0x90170110}, + {0x19, 0x04a11040}, +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index d029cad08cbd8..89f8b0dae7ef0 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -1136,7 +1136,9 @@ static void test_stacktrace_build_id(void) + int i, j; + struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH]; + int build_id_matches = 0; ++ int retry = 1; + ++retry: + err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd); + if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno)) + goto out; +@@ -1249,6 +1251,19 @@ static void test_stacktrace_build_id(void) + previous_key = key; + } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0); + ++ /* stack_map_get_build_id_offset() is racy and sometimes can return ++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID; ++ * try it one more time. ++ */ ++ if (build_id_matches < 1 && retry--) { ++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE); ++ close(pmu_fd); ++ bpf_object__close(obj); ++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n", ++ __func__); ++ goto retry; ++ } ++ + if (CHECK(build_id_matches < 1, "build id match", + "Didn't find expected build ID from the map\n")) + goto disable_pmu; +@@ -1289,7 +1304,9 @@ static void test_stacktrace_build_id_nmi(void) + int i, j; + struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH]; + int build_id_matches = 0; ++ int retry = 1; + ++retry: + err = bpf_prog_load(file, BPF_PROG_TYPE_PERF_EVENT, &obj, &prog_fd); + if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno)) + return; +@@ -1384,6 +1401,19 @@ static void test_stacktrace_build_id_nmi(void) + previous_key = key; + } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0); + ++ /* stack_map_get_build_id_offset() is racy and sometimes can return ++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID; ++ * try it one more time. ++ */ ++ if (build_id_matches < 1 && retry--) { ++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE); ++ close(pmu_fd); ++ bpf_object__close(obj); ++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n", ++ __func__); ++ goto retry; ++ } ++ + if (CHECK(build_id_matches < 1, "build id match", + "Didn't find expected build ID from the map\n")) + goto disable_pmu; +diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c +index aeeb76a54d633..e38f1cb7089d3 100644 +--- a/tools/testing/selftests/bpf/test_sock_addr.c ++++ b/tools/testing/selftests/bpf/test_sock_addr.c +@@ -44,6 +44,7 @@ + #define SERV6_V4MAPPED_IP "::ffff:192.168.0.4" + #define SRC6_IP "::1" + #define SRC6_REWRITE_IP "::6" ++#define WILDCARD6_IP "::" + #define SERV6_PORT 6060 + #define SERV6_REWRITE_PORT 6666 + +@@ -85,12 +86,14 @@ static int bind4_prog_load(const struct sock_addr_test *test); + static int bind6_prog_load(const struct sock_addr_test *test); + static int connect4_prog_load(const struct sock_addr_test *test); + static int connect6_prog_load(const struct sock_addr_test *test); ++static int sendmsg_allow_prog_load(const struct sock_addr_test *test); + static int sendmsg_deny_prog_load(const struct sock_addr_test *test); + static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test); + static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test); + static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test); + static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test); + static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test); ++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test); + + static struct sock_addr_test tests[] = { + /* bind */ +@@ -462,6 +465,34 @@ static struct sock_addr_test tests[] = { + SRC6_REWRITE_IP, + SYSCALL_ENOTSUPP, + }, ++ { ++ "sendmsg6: set dst IP = [::] (BSD'ism)", ++ sendmsg6_rw_wildcard_prog_load, ++ BPF_CGROUP_UDP6_SENDMSG, ++ BPF_CGROUP_UDP6_SENDMSG, ++ AF_INET6, ++ SOCK_DGRAM, ++ SERV6_IP, ++ SERV6_PORT, ++ SERV6_REWRITE_IP, ++ SERV6_REWRITE_PORT, ++ SRC6_REWRITE_IP, ++ SUCCESS, ++ }, ++ { ++ "sendmsg6: preserve dst IP = [::] (BSD'ism)", ++ sendmsg_allow_prog_load, ++ BPF_CGROUP_UDP6_SENDMSG, ++ BPF_CGROUP_UDP6_SENDMSG, ++ AF_INET6, ++ SOCK_DGRAM, ++ WILDCARD6_IP, ++ SERV6_PORT, ++ SERV6_REWRITE_IP, ++ SERV6_PORT, ++ SRC6_IP, ++ SUCCESS, ++ }, + { + "sendmsg6: deny call", + sendmsg_deny_prog_load, +@@ -714,16 +745,27 @@ static int connect6_prog_load(const struct sock_addr_test *test) + return load_path(test, CONNECT6_PROG_PATH); + } + +-static int sendmsg_deny_prog_load(const struct sock_addr_test *test) ++static int sendmsg_ret_only_prog_load(const struct sock_addr_test *test, ++ int32_t rc) + { + struct bpf_insn insns[] = { +- /* return 0 */ +- BPF_MOV64_IMM(BPF_REG_0, 0), ++ /* return rc */ ++ BPF_MOV64_IMM(BPF_REG_0, rc), + BPF_EXIT_INSN(), + }; + return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn)); + } + ++static int sendmsg_allow_prog_load(const struct sock_addr_test *test) ++{ ++ return sendmsg_ret_only_prog_load(test, /*rc*/ 1); ++} ++ ++static int sendmsg_deny_prog_load(const struct sock_addr_test *test) ++{ ++ return sendmsg_ret_only_prog_load(test, /*rc*/ 0); ++} ++ + static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test) + { + struct sockaddr_in dst4_rw_addr; +@@ -844,6 +886,11 @@ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test) + return sendmsg6_rw_dst_asm_prog_load(test, SERV6_V4MAPPED_IP); + } + ++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test) ++{ ++ return sendmsg6_rw_dst_asm_prog_load(test, WILDCARD6_IP); ++} ++ + static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test) + { + return load_path(test, SENDMSG6_PROG_PATH); +diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh +index d8313d0438b74..b90dff8d3a94b 100755 +--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh ++++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh +@@ -1,7 +1,7 @@ + #!/bin/bash + # SPDX-License-Identifier: GPL-2.0 + +-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding" ++ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion extern_learn" + NUM_NETIFS=4 + CHECK_TC="yes" + source lib.sh +@@ -96,6 +96,51 @@ flooding() + flood_test $swp2 $h1 $h2 + } + ++vlan_deletion() ++{ ++ # Test that the deletion of a VLAN on a bridge port does not affect ++ # the PVID VLAN ++ log_info "Add and delete a VLAN on bridge port $swp1" ++ ++ bridge vlan add vid 10 dev $swp1 ++ bridge vlan del vid 10 dev $swp1 ++ ++ ping_ipv4 ++ ping_ipv6 ++} ++ ++extern_learn() ++{ ++ local mac=de:ad:be:ef:13:37 ++ local ageing_time ++ ++ # Test that externally learned FDB entries can roam, but not age out ++ RET=0 ++ ++ bridge fdb add de:ad:be:ef:13:37 dev $swp1 master extern_learn vlan 1 ++ ++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37 ++ check_err $? "Did not find FDB entry when should" ++ ++ # Wait for 10 seconds after the ageing time to make sure the FDB entry ++ # was not aged out ++ ageing_time=$(bridge_ageing_time_get br0) ++ sleep $((ageing_time + 10)) ++ ++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37 ++ check_err $? "FDB entry was aged out when should not" ++ ++ $MZ $h2 -c 1 -p 64 -a $mac -t ip -q ++ ++ bridge fdb show brport $swp2 | grep -q de:ad:be:ef:13:37 ++ check_err $? "FDB entry did not roam when should" ++ ++ log_test "Externally learned FDB entry - ageing & roaming" ++ ++ bridge fdb del de:ad:be:ef:13:37 dev $swp2 master vlan 1 &> /dev/null ++ bridge fdb del de:ad:be:ef:13:37 dev $swp1 master vlan 1 &> /dev/null ++} ++ + trap cleanup EXIT + + setup_prepare +diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json +index 637ea0219617f..0da3545cabdb6 100644 +--- a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json +@@ -17,7 +17,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -41,7 +41,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 10 pipe index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -65,7 +65,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark continue index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*allow mark.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*allow mark.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -89,7 +89,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 789 drop index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*use mark 789.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*use mark 789.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -113,7 +113,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 656768 reclassify index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 656768.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 656768.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -137,7 +137,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 65 jump 1 index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0xED3E.*use mark 65.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0[xX]ED3E.*use mark 65.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -161,7 +161,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295 reclassify index 90", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 90", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 4294967295.*index 90", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 4294967295.*index 90", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -185,7 +185,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295999 pipe index 90", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 90", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark 4294967295999.*index 90", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark 4294967295999.*index 90", + "matchCount": "0", + "teardown": [] + }, +@@ -207,7 +207,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow prio pass index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow prio.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow prio.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -231,7 +231,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 7 pipe index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 7.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 7.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -255,7 +255,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 3 continue index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use prio 3.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use prio 3.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -279,7 +279,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow prio drop index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow prio.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow prio.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -303,7 +303,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 998877 reclassify index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 998877.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 998877.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -327,7 +327,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 998877 jump 10 index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0xED3E.*use prio 998877.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0[xX]ED3E.*use prio 998877.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -351,7 +351,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 4294967295 reclassify index 99", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 99", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 4294967295.*index 99", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 4294967295.*index 99", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -375,7 +375,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 4294967298 pipe index 99", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 99", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 4294967298.*index 99", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 4294967298.*index 99", + "matchCount": "0", + "teardown": [] + }, +@@ -397,7 +397,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex pass index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -421,7 +421,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 111 pipe index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 111.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 111.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -445,7 +445,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -469,7 +469,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -493,7 +493,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex drop index 77", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 77", +- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow tcindex.*index 77", ++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow tcindex.*index 77", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -517,7 +517,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex reclassify index 77", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 77", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*allow tcindex.*index 77", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*allow tcindex.*index 77", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -541,7 +541,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex jump 999 index 77", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 77", +- "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0xED3E.*allow tcindex.*index 77", ++ "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0[xX]ED3E.*allow tcindex.*index 77", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -565,7 +565,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 65535 pass index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*use tcindex 65535.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*use tcindex 65535.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -589,7 +589,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 65539 pipe index 1", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 65539.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 65539.*index 1", + "matchCount": "0", + "teardown": [] + }, +@@ -611,7 +611,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark src 00:11:22:33:44:55 pipe index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow mark src 00:11:22:33:44:55.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow mark src 00:11:22:33:44:55.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -635,7 +635,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 9876 dst 00:11:22:33:44:55 reclassify index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -659,7 +659,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex src 00:aa:bb:cc:dd:ee dst 00:11:22:33:44:55 pass index 11", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 11", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -683,7 +683,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 7 type 0xfefe pass index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xFEFE.*use mark 7.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]FEFE.*use mark 7.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -707,7 +707,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 444 type 0xabba pipe index 21", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 21", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xABBA.*use prio 444.*index 21", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ABBA.*use prio 444.*index 21", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -731,7 +731,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 5000 type 0xabcd reclassify index 21", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 21", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xABCD.*use tcindex 5000.*index 21", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ABCD.*use tcindex 5000.*index 21", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -739,7 +739,7 @@ + }, + { + "id": "fac3", +- "name": "Create valid ife encode action with index at 32-bit maximnum", ++ "name": "Create valid ife encode action with index at 32-bit maximum", + "category": [ + "actions", + "ife" +@@ -755,7 +755,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 4294967295", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -779,7 +779,7 @@ + "cmdUnderTest": "$TC actions add action ife decode pass index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action pass.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action pass.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -803,7 +803,7 @@ + "cmdUnderTest": "$TC actions add action ife decode pipe index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -827,7 +827,7 @@ + "cmdUnderTest": "$TC actions add action ife decode continue index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action continue.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action continue.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -851,7 +851,7 @@ + "cmdUnderTest": "$TC actions add action ife decode drop index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action drop.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action drop.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -875,7 +875,7 @@ + "cmdUnderTest": "$TC actions add action ife decode reclassify index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -899,7 +899,7 @@ + "cmdUnderTest": "$TC actions add action ife decode jump 10 index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -923,7 +923,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295999", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 4294967295999", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295999", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295999", + "matchCount": "0", + "teardown": [] + }, +@@ -945,7 +945,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark kuka index 4", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 4", +- "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0xED3E.*allow mark.*index 4", ++ "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0[xX]ED3E.*allow mark.*index 4", + "matchCount": "0", + "teardown": [] + }, +@@ -967,7 +967,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow prio pipe index 4 cookie aabbccddeeff112233445566778800a1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 4", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -991,7 +991,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow foo pipe index 4", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 4", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow foo.*index 4", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow foo.*index 4", + "matchCount": "0", + "teardown": [] + }, +@@ -1013,7 +1013,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow prio type 70000 pipe index 4", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 4", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0x11170.*allow prio.*index 4", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]11170.*allow prio.*index 4", + "matchCount": "0", + "teardown": [] + }, +diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json +index 10b2d894e4362..e7e15a7336b6d 100644 +--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json +@@ -81,35 +81,6 @@ + ] + ] + }, +- { +- "id": "ba4e", +- "name": "Add tunnel_key set action with missing mandatory id parameter", +- "category": [ +- "actions", +- "tunnel_key" +- ], +- "setup": [ +- [ +- "$TC actions flush action tunnel_key", +- 0, +- 1, +- 255 +- ] +- ], +- "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 20.20.20.2", +- "expExitCode": "255", +- "verifyCmd": "$TC actions list action tunnel_key", +- "matchPattern": "action order [0-9]+: tunnel_key set.*src_ip 10.10.10.1.*dst_ip 20.20.20.2", +- "matchCount": "0", +- "teardown": [ +- [ +- "$TC actions flush action tunnel_key", +- 0, +- 1, +- 255 +- ] +- ] +- }, + { + "id": "a5e0", + "name": "Add tunnel_key set action with invalid src_ip parameter", +@@ -634,7 +605,7 @@ + "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 10.10.10.2 id 7 index 4 cookie aa11bb22cc33dd44ee55ff66aa11b1b2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action tunnel_key index 4", +- "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*dst_port 0.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2", ++ "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action tunnel_key" diff --git a/patch/kernel/sunxi-next/patch-4.19.26-27.patch b/patch/kernel/sunxi-next/patch-4.19.26-27.patch new file mode 100644 index 0000000000..541d47b3af --- /dev/null +++ b/patch/kernel/sunxi-next/patch-4.19.26-27.patch @@ -0,0 +1,2653 @@ +diff --git a/Makefile b/Makefile +index b71076cecba9c..70ed9a53558a5 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 26 ++SUBLEVEL = 27 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h +index 8da87feec59aa..99e6d8948f4ac 100644 +--- a/arch/arc/include/asm/bitops.h ++++ b/arch/arc/include/asm/bitops.h +@@ -340,7 +340,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x) + /* + * __ffs: Similar to ffs, but zero based (0-31) + */ +-static inline __attribute__ ((const)) int __ffs(unsigned long word) ++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word) + { + if (!word) + return word; +@@ -400,9 +400,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x) + /* + * __ffs: Similar to ffs, but zero based (0-31) + */ +-static inline __attribute__ ((const)) int __ffs(unsigned long x) ++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x) + { +- int n; ++ unsigned long n; + + asm volatile( + " ffs.f %0, %1 \n" /* 0:31; 31(Z) if src 0 */ +diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c +index e8d9fb4523462..5c6663321e873 100644 +--- a/arch/arc/kernel/troubleshoot.c ++++ b/arch/arc/kernel/troubleshoot.c +@@ -18,6 +18,8 @@ + #include + #include + ++#define ARC_PATH_MAX 256 ++ + /* + * Common routine to print scratch regs (r0-r12) or callee regs (r13-r25) + * -Prints 3 regs per line and a CR. +@@ -58,11 +60,12 @@ static void show_callee_regs(struct callee_regs *cregs) + print_reg_file(&(cregs->r13), 13); + } + +-static void print_task_path_n_nm(struct task_struct *tsk, char *buf) ++static void print_task_path_n_nm(struct task_struct *tsk) + { + char *path_nm = NULL; + struct mm_struct *mm; + struct file *exe_file; ++ char buf[ARC_PATH_MAX]; + + mm = get_task_mm(tsk); + if (!mm) +@@ -72,7 +75,7 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf) + mmput(mm); + + if (exe_file) { +- path_nm = file_path(exe_file, buf, 255); ++ path_nm = file_path(exe_file, buf, ARC_PATH_MAX-1); + fput(exe_file); + } + +@@ -80,10 +83,9 @@ done: + pr_info("Path: %s\n", !IS_ERR(path_nm) ? path_nm : "?"); + } + +-static void show_faulting_vma(unsigned long address, char *buf) ++static void show_faulting_vma(unsigned long address) + { + struct vm_area_struct *vma; +- char *nm = buf; + struct mm_struct *active_mm = current->active_mm; + + /* can't use print_vma_addr() yet as it doesn't check for +@@ -96,8 +98,11 @@ static void show_faulting_vma(unsigned long address, char *buf) + * if the container VMA is not found + */ + if (vma && (vma->vm_start <= address)) { ++ char buf[ARC_PATH_MAX]; ++ char *nm = "?"; ++ + if (vma->vm_file) { +- nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1); ++ nm = file_path(vma->vm_file, buf, ARC_PATH_MAX-1); + if (IS_ERR(nm)) + nm = "?"; + } +@@ -173,13 +178,8 @@ void show_regs(struct pt_regs *regs) + { + struct task_struct *tsk = current; + struct callee_regs *cregs; +- char *buf; + +- buf = (char *)__get_free_page(GFP_KERNEL); +- if (!buf) +- return; +- +- print_task_path_n_nm(tsk, buf); ++ print_task_path_n_nm(tsk); + show_regs_print_info(KERN_INFO); + + show_ecr_verbose(regs); +@@ -189,7 +189,7 @@ void show_regs(struct pt_regs *regs) + (void *)regs->blink, (void *)regs->ret); + + if (user_mode(regs)) +- show_faulting_vma(regs->ret, buf); /* faulting code, not data */ ++ show_faulting_vma(regs->ret); /* faulting code, not data */ + + pr_info("[STAT32]: 0x%08lx", regs->status32); + +@@ -221,8 +221,6 @@ void show_regs(struct pt_regs *regs) + cregs = (struct callee_regs *)current->thread.callee_reg; + if (cregs) + show_callee_regs(cregs); +- +- free_page((unsigned long)buf); + } + + void show_kernel_fault_diag(const char *str, struct pt_regs *regs, +diff --git a/arch/mips/bcm63xx/dev-enet.c b/arch/mips/bcm63xx/dev-enet.c +index 07b4c65a88a43..8e73d65f34806 100644 +--- a/arch/mips/bcm63xx/dev-enet.c ++++ b/arch/mips/bcm63xx/dev-enet.c +@@ -70,6 +70,8 @@ static struct platform_device bcm63xx_enet_shared_device = { + + static int shared_device_registered; + ++static u64 enet_dmamask = DMA_BIT_MASK(32); ++ + static struct resource enet0_res[] = { + { + .start = -1, /* filled at runtime */ +@@ -99,6 +101,8 @@ static struct platform_device bcm63xx_enet0_device = { + .resource = enet0_res, + .dev = { + .platform_data = &enet0_pd, ++ .dma_mask = &enet_dmamask, ++ .coherent_dma_mask = DMA_BIT_MASK(32), + }, + }; + +@@ -131,6 +135,8 @@ static struct platform_device bcm63xx_enet1_device = { + .resource = enet1_res, + .dev = { + .platform_data = &enet1_pd, ++ .dma_mask = &enet_dmamask, ++ .coherent_dma_mask = DMA_BIT_MASK(32), + }, + }; + +@@ -157,6 +163,8 @@ static struct platform_device bcm63xx_enetsw_device = { + .resource = enetsw_res, + .dev = { + .platform_data = &enetsw_pd, ++ .dma_mask = &enet_dmamask, ++ .coherent_dma_mask = DMA_BIT_MASK(32), + }, + }; + +diff --git a/arch/mips/kernel/cmpxchg.c b/arch/mips/kernel/cmpxchg.c +index 0b9535bc2c53d..6b2a4a902a981 100644 +--- a/arch/mips/kernel/cmpxchg.c ++++ b/arch/mips/kernel/cmpxchg.c +@@ -54,10 +54,9 @@ unsigned long __xchg_small(volatile void *ptr, unsigned long val, unsigned int s + unsigned long __cmpxchg_small(volatile void *ptr, unsigned long old, + unsigned long new, unsigned int size) + { +- u32 mask, old32, new32, load32; ++ u32 mask, old32, new32, load32, load; + volatile u32 *ptr32; + unsigned int shift; +- u8 load; + + /* Check that ptr is naturally aligned */ + WARN_ON((unsigned long)ptr & (size - 1)); +diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c +index 252c00985c973..9bda82ed75eb7 100644 +--- a/arch/mips/net/ebpf_jit.c ++++ b/arch/mips/net/ebpf_jit.c +@@ -1818,7 +1818,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + + /* Update the icache */ + flush_icache_range((unsigned long)ctx.target, +- (unsigned long)(ctx.target + ctx.idx * sizeof(u32))); ++ (unsigned long)&ctx.target[ctx.idx]); + + if (bpf_jit_enable > 1) + /* Dump JIT code */ +diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h +index aae77eb8491c0..4111edb3188e2 100644 +--- a/arch/x86/include/asm/uaccess.h ++++ b/arch/x86/include/asm/uaccess.h +@@ -293,8 +293,7 @@ do { \ + __put_user_asm(x, ptr, retval, "l", "k", "ir", errret); \ + break; \ + case 8: \ +- __put_user_asm_u64((__typeof__(*ptr))(x), ptr, retval, \ +- errret); \ ++ __put_user_asm_u64(x, ptr, retval, errret); \ + break; \ + default: \ + __put_user_bad(); \ +@@ -440,8 +439,10 @@ do { \ + #define __put_user_nocheck(x, ptr, size) \ + ({ \ + int __pu_err; \ ++ __typeof__(*(ptr)) __pu_val; \ ++ __pu_val = x; \ + __uaccess_begin(); \ +- __put_user_size((x), (ptr), (size), __pu_err, -EFAULT); \ ++ __put_user_size(__pu_val, (ptr), (size), __pu_err, -EFAULT);\ + __uaccess_end(); \ + __builtin_expect(__pu_err, 0); \ + }) +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index 7654febd51027..652e7ffa9b9de 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -313,14 +313,13 @@ assign_managed_vector(struct irq_data *irqd, const struct cpumask *dest) + struct apic_chip_data *apicd = apic_chip_data(irqd); + int vector, cpu; + +- cpumask_and(vector_searchmask, vector_searchmask, affmsk); +- cpu = cpumask_first(vector_searchmask); +- if (cpu >= nr_cpu_ids) +- return -EINVAL; ++ cpumask_and(vector_searchmask, dest, affmsk); ++ + /* set_affinity might call here for nothing */ + if (apicd->vector && cpumask_test_cpu(apicd->cpu, vector_searchmask)) + return 0; +- vector = irq_matrix_alloc_managed(vector_matrix, cpu); ++ vector = irq_matrix_alloc_managed(vector_matrix, vector_searchmask, ++ &cpu); + trace_vector_alloc_managed(irqd->irq, vector, vector); + if (vector < 0) + return vector; +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index ee8f8d70b98a2..b475419620121 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -3399,6 +3399,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm) + kvm_mmu_reset_context(&svm->vcpu); + kvm_mmu_load(&svm->vcpu); + ++ /* ++ * Drop what we picked up for L2 via svm_complete_interrupts() so it ++ * doesn't end up in L1. ++ */ ++ svm->vcpu.arch.nmi_injected = false; ++ kvm_clear_exception_queue(&svm->vcpu); ++ kvm_clear_interrupt_queue(&svm->vcpu); ++ + return 0; + } + +@@ -4485,25 +4493,14 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm) + kvm_lapic_reg_write(apic, APIC_ICR, icrl); + break; + case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: { +- int i; +- struct kvm_vcpu *vcpu; +- struct kvm *kvm = svm->vcpu.kvm; + struct kvm_lapic *apic = svm->vcpu.arch.apic; + + /* +- * At this point, we expect that the AVIC HW has already +- * set the appropriate IRR bits on the valid target +- * vcpus. So, we just need to kick the appropriate vcpu. ++ * Update ICR high and low, then emulate sending IPI, ++ * which is handled when writing APIC_ICR. + */ +- kvm_for_each_vcpu(i, vcpu, kvm) { +- bool m = kvm_apic_match_dest(vcpu, apic, +- icrl & KVM_APIC_SHORT_MASK, +- GET_APIC_DEST_FIELD(icrh), +- icrl & KVM_APIC_DEST_MASK); +- +- if (m && !avic_vcpu_is_running(vcpu)) +- kvm_vcpu_wake_up(vcpu); +- } ++ kvm_lapic_reg_write(apic, APIC_ICR2, icrh); ++ kvm_lapic_reg_write(apic, APIC_ICR, icrl); + break; + } + case AVIC_IPI_FAILURE_INVALID_TARGET: +diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c +index 7ae36868aed25..c9faf34cbb62e 100644 +--- a/arch/x86/mm/mem_encrypt_identity.c ++++ b/arch/x86/mm/mem_encrypt_identity.c +@@ -157,8 +157,8 @@ static void __init sme_populate_pgd(struct sme_populate_pgd_data *ppd) + pmd = pmd_offset(pud, ppd->vaddr); + if (pmd_none(*pmd)) { + pte = ppd->pgtable_area; +- memset(pte, 0, sizeof(pte) * PTRS_PER_PTE); +- ppd->pgtable_area += sizeof(pte) * PTRS_PER_PTE; ++ memset(pte, 0, sizeof(*pte) * PTRS_PER_PTE); ++ ppd->pgtable_area += sizeof(*pte) * PTRS_PER_PTE; + set_pmd(pmd, __pmd(PMD_FLAGS | __pa(pte))); + } + +diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c +index decffb3826ece..a738af893532f 100644 +--- a/drivers/clk/clk-versaclock5.c ++++ b/drivers/clk/clk-versaclock5.c +@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index) + + if (vc5->clk_mux_ins == VC5_MUX_IN_XIN) + src = VC5_PRIM_SRC_SHDN_EN_XTAL; +- if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN) ++ else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN) + src = VC5_PRIM_SRC_SHDN_EN_CLKIN; ++ else /* Invalid; should have been caught by vc5_probe() */ ++ return -EINVAL; + } + + return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src); +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index d31055ae6ec6f..5413ffaf02e23 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -2687,7 +2687,7 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level) + seq_printf(s, "\"protect_count\": %d,", c->protect_count); + seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c)); + seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c)); +- seq_printf(s, "\"phase\": %d", clk_core_get_phase(c)); ++ seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c)); + seq_printf(s, "\"duty_cycle\": %u", + clk_core_get_scaled_duty_cycle(c, 100000)); + } +diff --git a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c +index 269d3595758be..edc31bb56674a 100644 +--- a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c ++++ b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c +@@ -133,9 +133,11 @@ static int tegra124_dfll_fcpu_remove(struct platform_device *pdev) + struct tegra_dfll_soc_data *soc; + + soc = tegra_dfll_unregister(pdev); +- if (IS_ERR(soc)) ++ if (IS_ERR(soc)) { + dev_err(&pdev->dev, "failed to unregister DFLL: %ld\n", + PTR_ERR(soc)); ++ return PTR_ERR(soc); ++ } + + tegra_cvb_remove_opp_table(soc->dev, soc->cvb, soc->max_freq); + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c +index 16b1a9cf6cf08..743d3c983082d 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c +@@ -32,6 +32,7 @@ + #include "vega10_pptable.h" + + #define NUM_DSPCLK_LEVELS 8 ++#define VEGA10_ENGINECLOCK_HARDMAX 198000 + + static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable, + enum phm_platform_caps cap) +@@ -258,7 +259,26 @@ static int init_over_drive_limits( + struct pp_hwmgr *hwmgr, + const ATOM_Vega10_POWERPLAYTABLE *powerplay_table) + { +- hwmgr->platform_descriptor.overdriveLimit.engineClock = ++ const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table = ++ (const ATOM_Vega10_GFXCLK_Dependency_Table *) ++ (((unsigned long) powerplay_table) + ++ le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset)); ++ bool is_acg_enabled = false; ++ ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2; ++ ++ if (gfxclk_dep_table->ucRevId == 1) { ++ patom_record_v2 = ++ (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries; ++ is_acg_enabled = ++ (bool)patom_record_v2[gfxclk_dep_table->ucNumEntries-1].ucACGEnable; ++ } ++ ++ if (powerplay_table->ulMaxODEngineClock > VEGA10_ENGINECLOCK_HARDMAX && ++ !is_acg_enabled) ++ hwmgr->platform_descriptor.overdriveLimit.engineClock = ++ VEGA10_ENGINECLOCK_HARDMAX; ++ else ++ hwmgr->platform_descriptor.overdriveLimit.engineClock = + le32_to_cpu(powerplay_table->ulMaxODEngineClock); + hwmgr->platform_descriptor.overdriveLimit.memoryClock = + le32_to_cpu(powerplay_table->ulMaxODMemoryClock); +diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c +index 23397c08be11c..1d74aed7e471f 100644 +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -1564,6 +1564,15 @@ int drm_atomic_helper_async_check(struct drm_device *dev, + old_plane_state->crtc != new_plane_state->crtc) + return -EINVAL; + ++ /* ++ * FIXME: Since prepare_fb and cleanup_fb are always called on ++ * the new_plane_state for async updates we need to block framebuffer ++ * changes. This prevents use of a fb that's been cleaned up and ++ * double cleanups from occuring. ++ */ ++ if (old_plane_state->fb != new_plane_state->fb) ++ return -EINVAL; ++ + funcs = plane->helper_private; + if (!funcs->atomic_async_update) + return -EINVAL; +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +index bbb8126ec5c57..9acb9dfaf57e6 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +@@ -896,7 +896,7 @@ static u32 a6xx_gmu_get_arc_level(struct device *dev, unsigned long freq) + np = dev_pm_opp_get_of_node(opp); + + if (np) { +- of_property_read_u32(np, "qcom,level", &val); ++ of_property_read_u32(np, "opp-level", &val); + of_node_put(np); + } + +diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c +index f7a0edea4705b..d4cc5ceb22d01 100644 +--- a/drivers/gpu/drm/msm/msm_rd.c ++++ b/drivers/gpu/drm/msm/msm_rd.c +@@ -115,7 +115,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz) + char *fptr = &fifo->buf[fifo->head]; + int n; + +- wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0); ++ wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open); ++ if (!rd->open) ++ return; + + /* Note that smp_load_acquire() is not strictly required + * as CIRC_SPACE_TO_END() does not access the tail more +@@ -213,7 +215,10 @@ out: + static int rd_release(struct inode *inode, struct file *file) + { + struct msm_rd_state *rd = inode->i_private; ++ + rd->open = false; ++ wake_up_all(&rd->fifo_event); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +index 061d2e0d9011e..416da53767018 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c ++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +@@ -92,6 +92,8 @@ static void sun4i_hdmi_disable(struct drm_encoder *encoder) + val = readl(hdmi->base + SUN4I_HDMI_VID_CTRL_REG); + val &= ~SUN4I_HDMI_VID_CTRL_ENABLE; + writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG); ++ ++ clk_disable_unprepare(hdmi->tmds_clk); + } + + static void sun4i_hdmi_enable(struct drm_encoder *encoder) +@@ -102,6 +104,8 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder) + + DRM_DEBUG_DRIVER("Enabling the HDMI Output\n"); + ++ clk_prepare_enable(hdmi->tmds_clk); ++ + sun4i_hdmi_setup_avi_infoframes(hdmi, mode); + val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI); + val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END); +diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c +index ad70e7c416e30..fbfa7ff6deb16 100644 +--- a/drivers/irqchip/irq-gic-v3-mbi.c ++++ b/drivers/irqchip/irq-gic-v3-mbi.c +@@ -24,7 +24,7 @@ struct mbi_range { + unsigned long *bm; + }; + +-static struct mutex mbi_lock; ++static DEFINE_MUTEX(mbi_lock); + static phys_addr_t mbi_phys_base; + static struct mbi_range *mbi_ranges; + static unsigned int mbi_range_nr; +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 50a5c340307b8..d4f9bfbaf0232 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -95,7 +95,7 @@ static void mmc_should_fail_request(struct mmc_host *host, + if (!data) + return; + +- if (cmd->error || data->error || ++ if ((cmd && cmd->error) || data->error || + !should_fail(&host->fail_mmc_request, data->blksz * data->blocks)) + return; + +diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c +index 159270e947cf6..a8af682a91821 100644 +--- a/drivers/mmc/host/cqhci.c ++++ b/drivers/mmc/host/cqhci.c +@@ -201,7 +201,7 @@ static int cqhci_host_alloc_tdl(struct cqhci_host *cq_host) + cq_host->desc_size = cq_host->slot_sz * cq_host->num_slots; + + cq_host->data_size = cq_host->trans_desc_len * cq_host->mmc->max_segs * +- (cq_host->num_slots - 1); ++ cq_host->mmc->cqe_qdepth; + + pr_debug("%s: cqhci: desc_size: %zu data_sz: %zu slot-sz: %d\n", + mmc_hostname(cq_host->mmc), cq_host->desc_size, cq_host->data_size, +@@ -217,12 +217,21 @@ static int cqhci_host_alloc_tdl(struct cqhci_host *cq_host) + cq_host->desc_size, + &cq_host->desc_dma_base, + GFP_KERNEL); ++ if (!cq_host->desc_base) ++ return -ENOMEM; ++ + cq_host->trans_desc_base = dmam_alloc_coherent(mmc_dev(cq_host->mmc), + cq_host->data_size, + &cq_host->trans_desc_dma_base, + GFP_KERNEL); +- if (!cq_host->desc_base || !cq_host->trans_desc_base) ++ if (!cq_host->trans_desc_base) { ++ dmam_free_coherent(mmc_dev(cq_host->mmc), cq_host->desc_size, ++ cq_host->desc_base, ++ cq_host->desc_dma_base); ++ cq_host->desc_base = NULL; ++ cq_host->desc_dma_base = 0; + return -ENOMEM; ++ } + + pr_debug("%s: cqhci: desc-base: 0x%p trans-base: 0x%p\n desc_dma 0x%llx trans_dma: 0x%llx\n", + mmc_hostname(cq_host->mmc), cq_host->desc_base, cq_host->trans_desc_base, +diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c +index 476e53d301283..67f6bd24a9d0c 100644 +--- a/drivers/mmc/host/mmc_spi.c ++++ b/drivers/mmc/host/mmc_spi.c +@@ -1447,6 +1447,7 @@ static int mmc_spi_probe(struct spi_device *spi) + mmc->caps &= ~MMC_CAP_NEEDS_POLL; + mmc_gpiod_request_cd_irq(mmc); + } ++ mmc_detect_change(mmc, 0); + + if (host->pdata && host->pdata->flags & MMC_SPI_USE_RO_GPIO) { + has_ro = true; +diff --git a/drivers/mmc/host/renesas_sdhi_sys_dmac.c b/drivers/mmc/host/renesas_sdhi_sys_dmac.c +index 5389c48218820..c3d63edb545e3 100644 +--- a/drivers/mmc/host/renesas_sdhi_sys_dmac.c ++++ b/drivers/mmc/host/renesas_sdhi_sys_dmac.c +@@ -68,6 +68,7 @@ static const struct renesas_sdhi_of_data of_rcar_gen2_compatible = { + .scc_offset = 0x0300, + .taps = rcar_gen2_scc_taps, + .taps_num = ARRAY_SIZE(rcar_gen2_scc_taps), ++ .max_blk_count = 0xffffffff, + }; + + /* Definitions for sampling clocks */ +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index f44e49014a440..753973dc16556 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -1097,11 +1097,12 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) + writel(readl(host->ioaddr + SDHCI_HOST_CONTROL) + | ESDHC_BURST_LEN_EN_INCR, + host->ioaddr + SDHCI_HOST_CONTROL); ++ + /* +- * erratum ESDHC_FLAG_ERR004536 fix for MX6Q TO1.2 and MX6DL +- * TO1.1, it's harmless for MX6SL +- */ +- writel(readl(host->ioaddr + 0x6c) | BIT(7), ++ * erratum ESDHC_FLAG_ERR004536 fix for MX6Q TO1.2 and MX6DL ++ * TO1.1, it's harmless for MX6SL ++ */ ++ writel(readl(host->ioaddr + 0x6c) & ~BIT(7), + host->ioaddr + 0x6c); + + /* disable DLL_CTRL delay line settings */ +diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h +index 5d141f79e175b..7c40a7e1fea1c 100644 +--- a/drivers/mmc/host/tmio_mmc.h ++++ b/drivers/mmc/host/tmio_mmc.h +@@ -279,6 +279,11 @@ static inline void sd_ctrl_write32_as_16_and_16(struct tmio_mmc_host *host, + iowrite16(val >> 16, host->ctl + ((addr + 2) << host->bus_shift)); + } + ++static inline void sd_ctrl_write32(struct tmio_mmc_host *host, int addr, u32 val) ++{ ++ iowrite32(val, host->ctl + (addr << host->bus_shift)); ++} ++ + static inline void sd_ctrl_write32_rep(struct tmio_mmc_host *host, int addr, + const u32 *buf, int count) + { +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index 261b4d62d2b10..7d13ca9ea5347 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -46,6 +46,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -703,7 +704,7 @@ static bool __tmio_mmc_sdcard_irq(struct tmio_mmc_host *host, int ireg, + return false; + } + +-static void __tmio_mmc_sdio_irq(struct tmio_mmc_host *host) ++static bool __tmio_mmc_sdio_irq(struct tmio_mmc_host *host) + { + struct mmc_host *mmc = host->mmc; + struct tmio_mmc_data *pdata = host->pdata; +@@ -711,7 +712,7 @@ static void __tmio_mmc_sdio_irq(struct tmio_mmc_host *host) + unsigned int sdio_status; + + if (!(pdata->flags & TMIO_MMC_SDIO_IRQ)) +- return; ++ return false; + + status = sd_ctrl_read16(host, CTL_SDIO_STATUS); + ireg = status & TMIO_SDIO_MASK_ALL & ~host->sdio_irq_mask; +@@ -724,6 +725,8 @@ static void __tmio_mmc_sdio_irq(struct tmio_mmc_host *host) + + if (mmc->caps & MMC_CAP_SDIO_IRQ && ireg & TMIO_SDIO_STAT_IOIRQ) + mmc_signal_sdio_irq(mmc); ++ ++ return ireg; + } + + irqreturn_t tmio_mmc_irq(int irq, void *devid) +@@ -742,9 +745,10 @@ irqreturn_t tmio_mmc_irq(int irq, void *devid) + if (__tmio_mmc_sdcard_irq(host, ireg, status)) + return IRQ_HANDLED; + +- __tmio_mmc_sdio_irq(host); ++ if (__tmio_mmc_sdio_irq(host)) ++ return IRQ_HANDLED; + +- return IRQ_HANDLED; ++ return IRQ_NONE; + } + EXPORT_SYMBOL_GPL(tmio_mmc_irq); + +@@ -774,7 +778,10 @@ static int tmio_mmc_start_data(struct tmio_mmc_host *host, + + /* Set transfer length / blocksize */ + sd_ctrl_write16(host, CTL_SD_XFER_LEN, data->blksz); +- sd_ctrl_write16(host, CTL_XFER_BLK_COUNT, data->blocks); ++ if (host->mmc->max_blk_count >= SZ_64K) ++ sd_ctrl_write32(host, CTL_XFER_BLK_COUNT, data->blocks); ++ else ++ sd_ctrl_write16(host, CTL_XFER_BLK_COUNT, data->blocks); + + tmio_mmc_start_dma(host, data); + +diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c +index baca8f704a459..c3c1195021a2b 100644 +--- a/drivers/net/ethernet/altera/altera_tse_main.c ++++ b/drivers/net/ethernet/altera/altera_tse_main.c +@@ -714,8 +714,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev) + + phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link, + priv->phy_iface); +- if (IS_ERR(phydev)) ++ if (IS_ERR(phydev)) { + netdev_err(dev, "Could not attach to PHY\n"); ++ phydev = NULL; ++ } + + } else { + int ret; +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c +index 91f48c0780734..f70cb4d3c6846 100644 +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -1314,7 +1314,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) + unsigned long lpar_rc; + u16 mss = 0; + +-restart_poll: + while (frames_processed < budget) { + if (!ibmveth_rxq_pending_buffer(adapter)) + break; +@@ -1402,7 +1401,6 @@ restart_poll: + napi_reschedule(napi)) { + lpar_rc = h_vio_signal(adapter->vdev->unit_address, + VIO_IRQ_DISABLE); +- goto restart_poll; + } + } + +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index a32ded5b4f416..42d284669b03a 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -144,6 +144,8 @@ struct hv_netvsc_packet { + u32 total_data_buflen; + }; + ++#define NETVSC_HASH_KEYLEN 40 ++ + struct netvsc_device_info { + unsigned char mac_adr[ETH_ALEN]; + u32 num_chn; +@@ -151,6 +153,8 @@ struct netvsc_device_info { + u32 recv_sections; + u32 send_section_size; + u32 recv_section_size; ++ ++ u8 rss_key[NETVSC_HASH_KEYLEN]; + }; + + enum rndis_device_state { +@@ -160,8 +164,6 @@ enum rndis_device_state { + RNDIS_DEV_DATAINITIALIZED, + }; + +-#define NETVSC_HASH_KEYLEN 40 +- + struct rndis_device { + struct net_device *ndev; + +@@ -210,7 +212,9 @@ int netvsc_recv_callback(struct net_device *net, + void netvsc_channel_cb(void *context); + int netvsc_poll(struct napi_struct *napi, int budget); + +-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev); ++int rndis_set_subchannel(struct net_device *ndev, ++ struct netvsc_device *nvdev, ++ struct netvsc_device_info *dev_info); + int rndis_filter_open(struct netvsc_device *nvdev); + int rndis_filter_close(struct netvsc_device *nvdev); + struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index fe01e141c8f87..1a942feab9548 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -84,7 +84,7 @@ static void netvsc_subchan_work(struct work_struct *w) + + rdev = nvdev->extension; + if (rdev) { +- ret = rndis_set_subchannel(rdev->ndev, nvdev); ++ ret = rndis_set_subchannel(rdev->ndev, nvdev, NULL); + if (ret == 0) { + netif_device_attach(rdev->ndev); + } else { +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 1c37a821895b7..c9e2a986ccb72 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -856,6 +856,39 @@ static void netvsc_get_channels(struct net_device *net, + } + } + ++/* Alloc struct netvsc_device_info, and initialize it from either existing ++ * struct netvsc_device, or from default values. ++ */ ++static struct netvsc_device_info *netvsc_devinfo_get ++ (struct netvsc_device *nvdev) ++{ ++ struct netvsc_device_info *dev_info; ++ ++ dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC); ++ ++ if (!dev_info) ++ return NULL; ++ ++ if (nvdev) { ++ dev_info->num_chn = nvdev->num_chn; ++ dev_info->send_sections = nvdev->send_section_cnt; ++ dev_info->send_section_size = nvdev->send_section_size; ++ dev_info->recv_sections = nvdev->recv_section_cnt; ++ dev_info->recv_section_size = nvdev->recv_section_size; ++ ++ memcpy(dev_info->rss_key, nvdev->extension->rss_key, ++ NETVSC_HASH_KEYLEN); ++ } else { ++ dev_info->num_chn = VRSS_CHANNEL_DEFAULT; ++ dev_info->send_sections = NETVSC_DEFAULT_TX; ++ dev_info->send_section_size = NETVSC_SEND_SECTION_SIZE; ++ dev_info->recv_sections = NETVSC_DEFAULT_RX; ++ dev_info->recv_section_size = NETVSC_RECV_SECTION_SIZE; ++ } ++ ++ return dev_info; ++} ++ + static int netvsc_detach(struct net_device *ndev, + struct netvsc_device *nvdev) + { +@@ -907,7 +940,7 @@ static int netvsc_attach(struct net_device *ndev, + return PTR_ERR(nvdev); + + if (nvdev->num_chn > 1) { +- ret = rndis_set_subchannel(ndev, nvdev); ++ ret = rndis_set_subchannel(ndev, nvdev, dev_info); + + /* if unavailable, just proceed with one queue */ + if (ret) { +@@ -941,7 +974,7 @@ static int netvsc_set_channels(struct net_device *net, + struct net_device_context *net_device_ctx = netdev_priv(net); + struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev); + unsigned int orig, count = channels->combined_count; +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info; + int ret; + + /* We do not support separate count for rx, tx, or other */ +@@ -960,24 +993,26 @@ static int netvsc_set_channels(struct net_device *net, + + orig = nvdev->num_chn; + +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = count; +- device_info.send_sections = nvdev->send_section_cnt; +- device_info.send_section_size = nvdev->send_section_size; +- device_info.recv_sections = nvdev->recv_section_cnt; +- device_info.recv_section_size = nvdev->recv_section_size; ++ device_info = netvsc_devinfo_get(nvdev); ++ ++ if (!device_info) ++ return -ENOMEM; ++ ++ device_info->num_chn = count; + + ret = netvsc_detach(net, nvdev); + if (ret) +- return ret; ++ goto out; + +- ret = netvsc_attach(net, &device_info); ++ ret = netvsc_attach(net, device_info); + if (ret) { +- device_info.num_chn = orig; +- if (netvsc_attach(net, &device_info)) ++ device_info->num_chn = orig; ++ if (netvsc_attach(net, device_info)) + netdev_err(net, "restoring channel setting failed\n"); + } + ++out: ++ kfree(device_info); + return ret; + } + +@@ -1044,48 +1079,45 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) + struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev); + struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); + int orig_mtu = ndev->mtu; +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info; + int ret = 0; + + if (!nvdev || nvdev->destroy) + return -ENODEV; + ++ device_info = netvsc_devinfo_get(nvdev); ++ ++ if (!device_info) ++ return -ENOMEM; ++ + /* Change MTU of underlying VF netdev first. */ + if (vf_netdev) { + ret = dev_set_mtu(vf_netdev, mtu); + if (ret) +- return ret; ++ goto out; + } + +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = nvdev->num_chn; +- device_info.send_sections = nvdev->send_section_cnt; +- device_info.send_section_size = nvdev->send_section_size; +- device_info.recv_sections = nvdev->recv_section_cnt; +- device_info.recv_section_size = nvdev->recv_section_size; +- + ret = netvsc_detach(ndev, nvdev); + if (ret) + goto rollback_vf; + + ndev->mtu = mtu; + +- ret = netvsc_attach(ndev, &device_info); +- if (ret) +- goto rollback; +- +- return 0; ++ ret = netvsc_attach(ndev, device_info); ++ if (!ret) ++ goto out; + +-rollback: + /* Attempt rollback to original MTU */ + ndev->mtu = orig_mtu; + +- if (netvsc_attach(ndev, &device_info)) ++ if (netvsc_attach(ndev, device_info)) + netdev_err(ndev, "restoring mtu failed\n"); + rollback_vf: + if (vf_netdev) + dev_set_mtu(vf_netdev, orig_mtu); + ++out: ++ kfree(device_info); + return ret; + } + +@@ -1690,7 +1722,7 @@ static int netvsc_set_ringparam(struct net_device *ndev, + { + struct net_device_context *ndevctx = netdev_priv(ndev); + struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info; + struct ethtool_ringparam orig; + u32 new_tx, new_rx; + int ret = 0; +@@ -1710,26 +1742,29 @@ static int netvsc_set_ringparam(struct net_device *ndev, + new_rx == orig.rx_pending) + return 0; /* no change */ + +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = nvdev->num_chn; +- device_info.send_sections = new_tx; +- device_info.send_section_size = nvdev->send_section_size; +- device_info.recv_sections = new_rx; +- device_info.recv_section_size = nvdev->recv_section_size; ++ device_info = netvsc_devinfo_get(nvdev); ++ ++ if (!device_info) ++ return -ENOMEM; ++ ++ device_info->send_sections = new_tx; ++ device_info->recv_sections = new_rx; + + ret = netvsc_detach(ndev, nvdev); + if (ret) +- return ret; ++ goto out; + +- ret = netvsc_attach(ndev, &device_info); ++ ret = netvsc_attach(ndev, device_info); + if (ret) { +- device_info.send_sections = orig.tx_pending; +- device_info.recv_sections = orig.rx_pending; ++ device_info->send_sections = orig.tx_pending; ++ device_info->recv_sections = orig.rx_pending; + +- if (netvsc_attach(ndev, &device_info)) ++ if (netvsc_attach(ndev, device_info)) + netdev_err(ndev, "restoring ringparam failed"); + } + ++out: ++ kfree(device_info); + return ret; + } + +@@ -2158,7 +2193,7 @@ static int netvsc_probe(struct hv_device *dev, + { + struct net_device *net = NULL; + struct net_device_context *net_device_ctx; +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info = NULL; + struct netvsc_device *nvdev; + int ret = -ENOMEM; + +@@ -2205,21 +2240,21 @@ static int netvsc_probe(struct hv_device *dev, + netif_set_real_num_rx_queues(net, 1); + + /* Notify the netvsc driver of the new device */ +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = VRSS_CHANNEL_DEFAULT; +- device_info.send_sections = NETVSC_DEFAULT_TX; +- device_info.send_section_size = NETVSC_SEND_SECTION_SIZE; +- device_info.recv_sections = NETVSC_DEFAULT_RX; +- device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE; +- +- nvdev = rndis_filter_device_add(dev, &device_info); ++ device_info = netvsc_devinfo_get(NULL); ++ ++ if (!device_info) { ++ ret = -ENOMEM; ++ goto devinfo_failed; ++ } ++ ++ nvdev = rndis_filter_device_add(dev, device_info); + if (IS_ERR(nvdev)) { + ret = PTR_ERR(nvdev); + netdev_err(net, "unable to add netvsc device (ret %d)\n", ret); + goto rndis_failed; + } + +- memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN); ++ memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN); + + /* We must get rtnl lock before scheduling nvdev->subchan_work, + * otherwise netvsc_subchan_work() can get rtnl lock first and wait +@@ -2257,12 +2292,16 @@ static int netvsc_probe(struct hv_device *dev, + + list_add(&net_device_ctx->list, &netvsc_dev_list); + rtnl_unlock(); ++ ++ kfree(device_info); + return 0; + + register_failed: + rtnl_unlock(); + rndis_filter_device_remove(dev, nvdev); + rndis_failed: ++ kfree(device_info); ++devinfo_failed: + free_percpu(net_device_ctx->vf_stats); + no_stats: + hv_set_drvdata(dev, NULL); +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index 2a5209f23f296..53c6039bffb67 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -715,8 +715,8 @@ cleanup: + return ret; + } + +-int rndis_filter_set_rss_param(struct rndis_device *rdev, +- const u8 *rss_key) ++static int rndis_set_rss_param_msg(struct rndis_device *rdev, ++ const u8 *rss_key, u16 flag) + { + struct net_device *ndev = rdev->ndev; + struct rndis_request *request; +@@ -745,7 +745,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev, + rssp->hdr.type = NDIS_OBJECT_TYPE_RSS_PARAMETERS; + rssp->hdr.rev = NDIS_RECEIVE_SCALE_PARAMETERS_REVISION_2; + rssp->hdr.size = sizeof(struct ndis_recv_scale_param); +- rssp->flag = 0; ++ rssp->flag = flag; + rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 | + NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 | + NDIS_HASH_TCP_IPV6; +@@ -770,9 +770,12 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev, + + wait_for_completion(&request->wait_event); + set_complete = &request->response_msg.msg.set_complete; +- if (set_complete->status == RNDIS_STATUS_SUCCESS) +- memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN); +- else { ++ if (set_complete->status == RNDIS_STATUS_SUCCESS) { ++ if (!(flag & NDIS_RSS_PARAM_FLAG_DISABLE_RSS) && ++ !(flag & NDIS_RSS_PARAM_FLAG_HASH_KEY_UNCHANGED)) ++ memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN); ++ ++ } else { + netdev_err(ndev, "Fail to set RSS parameters:0x%x\n", + set_complete->status); + ret = -EINVAL; +@@ -783,6 +786,16 @@ cleanup: + return ret; + } + ++int rndis_filter_set_rss_param(struct rndis_device *rdev, ++ const u8 *rss_key) ++{ ++ /* Disable RSS before change */ ++ rndis_set_rss_param_msg(rdev, rss_key, ++ NDIS_RSS_PARAM_FLAG_DISABLE_RSS); ++ ++ return rndis_set_rss_param_msg(rdev, rss_key, 0); ++} ++ + static int rndis_filter_query_device_link_status(struct rndis_device *dev, + struct netvsc_device *net_device) + { +@@ -1062,7 +1075,9 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc) + * This breaks overlap of processing the host message for the + * new primary channel with the initialization of sub-channels. + */ +-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev) ++int rndis_set_subchannel(struct net_device *ndev, ++ struct netvsc_device *nvdev, ++ struct netvsc_device_info *dev_info) + { + struct nvsp_message *init_packet = &nvdev->channel_init_pkt; + struct net_device_context *ndev_ctx = netdev_priv(ndev); +@@ -1103,7 +1118,10 @@ int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev) + atomic_read(&nvdev->open_chn) == nvdev->num_chn); + + /* ignore failues from setting rss parameters, still have channels */ +- rndis_filter_set_rss_param(rdev, netvsc_hash_key); ++ if (dev_info) ++ rndis_filter_set_rss_param(rdev, dev_info->rss_key); ++ else ++ rndis_filter_set_rss_param(rdev, netvsc_hash_key); + + netif_set_real_num_tx_queues(ndev, nvdev->num_chn); + netif_set_real_num_rx_queues(ndev, nvdev->num_chn); +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index b654f05b2ccd0..3d93993e74da0 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -739,8 +739,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) + asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0); + chipcode &= AX_CHIPCODE_MASK; + +- (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) : +- ax88772a_hw_reset(dev, 0); ++ ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) : ++ ax88772a_hw_reset(dev, 0); ++ ++ if (ret < 0) { ++ netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret); ++ return ret; ++ } + + /* Read PHYID register *AFTER* the PHY was reset properly */ + phyid = asix_get_phyid(dev); +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 815509dbed846..da8f5ad30c719 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -531,8 +531,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); + ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + + ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc); +- if (!(ctrl->anacap & (1 << 6))) +- ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); ++ ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); + + if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) { + dev_err(ctrl->device, +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index b6a28de682e85..0939a4e178fb9 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -1672,18 +1672,28 @@ static enum blk_eh_timer_return + nvme_rdma_timeout(struct request *rq, bool reserved) + { + struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq); ++ struct nvme_rdma_queue *queue = req->queue; ++ struct nvme_rdma_ctrl *ctrl = queue->ctrl; + +- dev_warn(req->queue->ctrl->ctrl.device, +- "I/O %d QID %d timeout, reset controller\n", +- rq->tag, nvme_rdma_queue_idx(req->queue)); ++ dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n", ++ rq->tag, nvme_rdma_queue_idx(queue)); + +- /* queue error recovery */ +- nvme_rdma_error_recovery(req->queue->ctrl); ++ if (ctrl->ctrl.state != NVME_CTRL_LIVE) { ++ /* ++ * Teardown immediately if controller times out while starting ++ * or we are already started error recovery. all outstanding ++ * requests are completed on shutdown, so we return BLK_EH_DONE. ++ */ ++ flush_work(&ctrl->err_work); ++ nvme_rdma_teardown_io_queues(ctrl, false); ++ nvme_rdma_teardown_admin_queue(ctrl, false); ++ return BLK_EH_DONE; ++ } + +- /* fail with DNR on cmd timeout */ +- nvme_req(rq)->status = NVME_SC_ABORT_REQ | NVME_SC_DNR; ++ dev_warn(ctrl->ctrl.device, "starting error recovery\n"); ++ nvme_rdma_error_recovery(ctrl); + +- return BLK_EH_DONE; ++ return BLK_EH_RESET_TIMER; + } + + static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx, +diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c +index 6fd6e07ab345f..09a77e556eceb 100644 +--- a/drivers/phy/qualcomm/phy-ath79-usb.c ++++ b/drivers/phy/qualcomm/phy-ath79-usb.c +@@ -31,7 +31,7 @@ static int ath79_usb_phy_power_on(struct phy *phy) + + err = reset_control_deassert(priv->reset); + if (err && priv->no_suspend_override) +- reset_control_assert(priv->no_suspend_override); ++ reset_control_deassert(priv->no_suspend_override); + + return err; + } +@@ -69,7 +69,7 @@ static int ath79_usb_phy_probe(struct platform_device *pdev) + if (!priv) + return -ENOMEM; + +- priv->reset = devm_reset_control_get(&pdev->dev, "usb-phy"); ++ priv->reset = devm_reset_control_get(&pdev->dev, "phy"); + if (IS_ERR(priv->reset)) + return PTR_ERR(priv->reset); + +diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c +index 8a004036e3d72..9bd2bd8dc2be2 100644 +--- a/drivers/scsi/csiostor/csio_attr.c ++++ b/drivers/scsi/csiostor/csio_attr.c +@@ -594,12 +594,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable) + } + + fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING); ++ ln->fc_vport = fc_vport; + + if (csio_fcoe_alloc_vnp(hw, ln)) + goto error; + + *(struct csio_lnode **)fc_vport->dd_data = ln; +- ln->fc_vport = fc_vport; + if (!fc_vport->node_name) + fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln)); + if (!fc_vport->port_name) +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index fadc99cb60df9..a1551ab336165 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -829,6 +829,7 @@ static struct domain_device *sas_ex_discover_end_dev( + rphy = sas_end_device_alloc(phy->port); + if (!rphy) + goto out_free; ++ rphy->identify.phy_identifier = phy_id; + + child->rphy = rphy; + get_device(&rphy->dev); +@@ -856,6 +857,7 @@ static struct domain_device *sas_ex_discover_end_dev( + + child->rphy = rphy; + get_device(&rphy->dev); ++ rphy->identify.phy_identifier = phy_id; + sas_fill_in_rphy(child, rphy); + + list_add_tail(&child->disco_list_node, &parent->port->disco_list); +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index 918ae18ef8a82..ca62117a2d131 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -297,7 +297,8 @@ lpfc_nvme_localport_delete(struct nvme_fc_local_port *localport) + lport); + + /* release any threads waiting for the unreg to complete */ +- complete(&lport->lport_unreg_done); ++ if (lport->vport->localport) ++ complete(lport->lport_unreg_cmp); + } + + /* lpfc_nvme_remoteport_delete +@@ -2556,7 +2557,8 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport) + */ + void + lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport, +- struct lpfc_nvme_lport *lport) ++ struct lpfc_nvme_lport *lport, ++ struct completion *lport_unreg_cmp) + { + #if (IS_ENABLED(CONFIG_NVME_FC)) + u32 wait_tmo; +@@ -2568,8 +2570,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport, + */ + wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000); + while (true) { +- ret = wait_for_completion_timeout(&lport->lport_unreg_done, +- wait_tmo); ++ ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo); + if (unlikely(!ret)) { + lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR, + "6176 Lport %p Localport %p wait " +@@ -2603,12 +2604,12 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport) + struct lpfc_nvme_lport *lport; + struct lpfc_nvme_ctrl_stat *cstat; + int ret; ++ DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp); + + if (vport->nvmei_support == 0) + return; + + localport = vport->localport; +- vport->localport = NULL; + lport = (struct lpfc_nvme_lport *)localport->private; + cstat = lport->cstat; + +@@ -2619,13 +2620,14 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport) + /* lport's rport list is clear. Unregister + * lport and release resources. + */ +- init_completion(&lport->lport_unreg_done); ++ lport->lport_unreg_cmp = &lport_unreg_cmp; + ret = nvme_fc_unregister_localport(localport); + + /* Wait for completion. This either blocks + * indefinitely or succeeds + */ +- lpfc_nvme_lport_unreg_wait(vport, lport); ++ lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp); ++ vport->localport = NULL; + kfree(cstat); + + /* Regardless of the unregister upcall response, clear +diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h +index cfd4719be25c3..b234d02989942 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.h ++++ b/drivers/scsi/lpfc/lpfc_nvme.h +@@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat { + /* Declare nvme-based local and remote port definitions. */ + struct lpfc_nvme_lport { + struct lpfc_vport *vport; +- struct completion lport_unreg_done; ++ struct completion *lport_unreg_cmp; + /* Add stats counters here */ + struct lpfc_nvme_ctrl_stat *cstat; + atomic_t fc4NvmeLsRequests; +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c +index b766afe10d3d7..e2575c8ec93e8 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.c ++++ b/drivers/scsi/lpfc/lpfc_nvmet.c +@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport) + struct lpfc_nvmet_tgtport *tport = targetport->private; + + /* release any threads waiting for the unreg to complete */ +- complete(&tport->tport_unreg_done); ++ if (tport->phba->targetport) ++ complete(tport->tport_unreg_cmp); + } + + static void +@@ -1700,6 +1701,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) + struct lpfc_nvmet_tgtport *tgtp; + struct lpfc_queue *wq; + uint32_t qidx; ++ DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp); + + if (phba->nvmet_support == 0) + return; +@@ -1709,9 +1711,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) + wq = phba->sli4_hba.nvme_wq[qidx]; + lpfc_nvmet_wqfull_flush(phba, wq, NULL); + } +- init_completion(&tgtp->tport_unreg_done); ++ tgtp->tport_unreg_cmp = &tport_unreg_cmp; + nvmet_fc_unregister_targetport(phba->targetport); +- wait_for_completion_timeout(&tgtp->tport_unreg_done, 5); ++ wait_for_completion_timeout(&tport_unreg_cmp, 5); + lpfc_nvmet_cleanup_io_context(phba); + } + phba->targetport = NULL; +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h +index 1aaff63f1f419..0ec1082ce7ef6 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.h ++++ b/drivers/scsi/lpfc/lpfc_nvmet.h +@@ -34,7 +34,7 @@ + /* Used for NVME Target */ + struct lpfc_nvmet_tgtport { + struct lpfc_hba *phba; +- struct completion tport_unreg_done; ++ struct completion *tport_unreg_cmp; + + /* Stats counters - lpfc_nvmet_unsol_ls_buffer */ + atomic_t rcv_ls_req_in; +diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c +index 99073325b0c00..45c7f829e3872 100644 +--- a/drivers/staging/android/ion/ion.c ++++ b/drivers/staging/android/ion/ion.c +@@ -237,10 +237,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf, + struct ion_dma_buf_attachment *a = attachment->priv; + struct ion_buffer *buffer = dmabuf->priv; + +- free_duped_table(a->table); + mutex_lock(&buffer->lock); + list_del(&a->list); + mutex_unlock(&buffer->lock); ++ free_duped_table(a->table); + + kfree(a); + } +diff --git a/drivers/staging/rtl8723bs/include/ieee80211.h b/drivers/staging/rtl8723bs/include/ieee80211.h +index bcc8dfa8e6728..9efb4dcb9d3a8 100644 +--- a/drivers/staging/rtl8723bs/include/ieee80211.h ++++ b/drivers/staging/rtl8723bs/include/ieee80211.h +@@ -850,18 +850,18 @@ enum ieee80211_state { + #define IP_FMT "%pI4" + #define IP_ARG(x) (x) + +-extern __inline int is_multicast_mac_addr(const u8 *addr) ++static inline int is_multicast_mac_addr(const u8 *addr) + { + return ((addr[0] != 0xff) && (0x01 & addr[0])); + } + +-extern __inline int is_broadcast_mac_addr(const u8 *addr) ++static inline int is_broadcast_mac_addr(const u8 *addr) + { + return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) && \ + (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff)); + } + +-extern __inline int is_zero_mac_addr(const u8 *addr) ++static inline int is_zero_mac_addr(const u8 *addr) + { + return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) && \ + (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00)); +diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c +index 284cf2c5a8fd9..8e1cf4d789be1 100644 +--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c ++++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c +@@ -84,7 +84,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \ + struct pci_dev *pci_dev; \ + struct platform_device *pdev; \ + struct proc_thermal_device *proc_dev; \ +-\ ++ \ ++ if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \ ++ dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \ ++ return 0; \ ++ } \ ++ \ + if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \ + pdev = to_platform_device(dev); \ + proc_dev = platform_get_drvdata(pdev); \ +@@ -298,11 +303,6 @@ static int proc_thermal_add(struct device *dev, + *priv = proc_priv; + + ret = proc_thermal_read_ppcc(proc_priv); +- if (!ret) { +- ret = sysfs_create_group(&dev->kobj, +- &power_limit_attribute_group); +- +- } + if (ret) + return ret; + +@@ -316,8 +316,7 @@ static int proc_thermal_add(struct device *dev, + + proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops); + if (IS_ERR(proc_priv->int340x_zone)) { +- ret = PTR_ERR(proc_priv->int340x_zone); +- goto remove_group; ++ return PTR_ERR(proc_priv->int340x_zone); + } else + ret = 0; + +@@ -331,9 +330,6 @@ static int proc_thermal_add(struct device *dev, + + remove_zone: + int340x_thermal_zone_remove(proc_priv->int340x_zone); +-remove_group: +- sysfs_remove_group(&proc_priv->dev->kobj, +- &power_limit_attribute_group); + + return ret; + } +@@ -364,7 +360,10 @@ static int int3401_add(struct platform_device *pdev) + platform_set_drvdata(pdev, proc_priv); + proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV; + +- return 0; ++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n"); ++ ++ return sysfs_create_group(&pdev->dev.kobj, ++ &power_limit_attribute_group); + } + + static int int3401_remove(struct platform_device *pdev) +@@ -423,7 +422,7 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, + proc_priv->soc_dts = intel_soc_dts_iosf_init( + INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0); + +- if (proc_priv->soc_dts && pdev->irq) { ++ if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) { + ret = pci_enable_msi(pdev); + if (!ret) { + ret = request_threaded_irq(pdev->irq, NULL, +@@ -441,7 +440,10 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "No auxiliary DTSs enabled\n"); + } + +- return 0; ++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n"); ++ ++ return sysfs_create_group(&pdev->dev.kobj, ++ &power_limit_attribute_group); + } + + static void proc_thermal_pci_remove(struct pci_dev *pdev) +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 7d030c2e42ffd..50b6746a8b5d7 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1695,7 +1695,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, + } + + /* ask the core to calculate the divisor */ +- baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16); ++ baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4); + + spin_lock_irqsave(&sport->port.lock, flags); + +diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c +index 1515074e18fb6..35d1f6fa0e3c3 100644 +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -221,7 +221,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport) + unsigned int mctrl = TIOCM_DSR | TIOCM_CAR; + u32 geni_ios; + +- if (uart_console(uport) || !uart_cts_enabled(uport)) { ++ if (uart_console(uport)) { + mctrl |= TIOCM_CTS; + } else { + geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS); +@@ -237,7 +237,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport, + { + u32 uart_manual_rfr = 0; + +- if (uart_console(uport) || !uart_cts_enabled(uport)) ++ if (uart_console(uport)) + return; + + if (!(mctrl & TIOCM_RTS)) +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 0db90f6f4aa81..700fb626ad03b 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1864,6 +1864,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc) + + /* begin to receive SETUP packets */ + dwc->ep0state = EP0_SETUP_PHASE; ++ dwc->link_state = DWC3_LINK_STATE_SS_DIS; + dwc3_ep0_out_start(dwc); + + dwc3_gadget_enable_irq(dwc); +@@ -3274,6 +3275,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc) + dwc3_disconnect_gadget(dwc); + __dwc3_gadget_stop(dwc); + ++ synchronize_irq(dwc->irq_gadget); ++ + return 0; + } + +diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c +index 9cdef108fb1b3..ed68a4860b7d8 100644 +--- a/drivers/usb/gadget/function/f_sourcesink.c ++++ b/drivers/usb/gadget/function/f_sourcesink.c +@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func( + + ss = kzalloc(sizeof(*ss), GFP_KERNEL); + if (!ss) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + ss_opts = container_of(fi, struct f_ss_opts, func_inst); + +diff --git a/fs/direct-io.c b/fs/direct-io.c +index 1991460360930..1abb7634b2d58 100644 +--- a/fs/direct-io.c ++++ b/fs/direct-io.c +@@ -679,6 +679,7 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio, + unsigned long fs_count; /* Number of filesystem-sized blocks */ + int create; + unsigned int i_blkbits = sdio->blkbits + sdio->blkfactor; ++ loff_t i_size; + + /* + * If there was a memory error and we've overwritten all the +@@ -708,8 +709,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio, + */ + create = dio->op == REQ_OP_WRITE; + if (dio->flags & DIO_SKIP_HOLES) { +- if (fs_startblk <= ((i_size_read(dio->inode) - 1) >> +- i_blkbits)) ++ i_size = i_size_read(dio->inode); ++ if (i_size && fs_startblk <= (i_size - 1) >> i_blkbits) + create = 0; + } + +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index 471d863958bc2..82ce6d4f7e314 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -331,11 +331,22 @@ struct inode_switch_wbs_context { + struct work_struct work; + }; + ++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) ++{ ++ down_write(&bdi->wb_switch_rwsem); ++} ++ ++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) ++{ ++ up_write(&bdi->wb_switch_rwsem); ++} ++ + static void inode_switch_wbs_work_fn(struct work_struct *work) + { + struct inode_switch_wbs_context *isw = + container_of(work, struct inode_switch_wbs_context, work); + struct inode *inode = isw->inode; ++ struct backing_dev_info *bdi = inode_to_bdi(inode); + struct address_space *mapping = inode->i_mapping; + struct bdi_writeback *old_wb = inode->i_wb; + struct bdi_writeback *new_wb = isw->new_wb; +@@ -343,6 +354,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) + bool switched = false; + void **slot; + ++ /* ++ * If @inode switches cgwb membership while sync_inodes_sb() is ++ * being issued, sync_inodes_sb() might miss it. Synchronize. ++ */ ++ down_read(&bdi->wb_switch_rwsem); ++ + /* + * By the time control reaches here, RCU grace period has passed + * since I_WB_SWITCH assertion and all wb stat update transactions +@@ -435,6 +452,8 @@ skip_switch: + spin_unlock(&new_wb->list_lock); + spin_unlock(&old_wb->list_lock); + ++ up_read(&bdi->wb_switch_rwsem); ++ + if (switched) { + wb_wakeup(new_wb); + wb_put(old_wb); +@@ -475,9 +494,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) + if (inode->i_state & I_WB_SWITCH) + return; + ++ /* ++ * Avoid starting new switches while sync_inodes_sb() is in ++ * progress. Otherwise, if the down_write protected issue path ++ * blocks heavily, we might end up starting a large number of ++ * switches which will block on the rwsem. ++ */ ++ if (!down_read_trylock(&bdi->wb_switch_rwsem)) ++ return; ++ + isw = kzalloc(sizeof(*isw), GFP_ATOMIC); + if (!isw) +- return; ++ goto out_unlock; + + /* find and pin the new wb */ + rcu_read_lock(); +@@ -511,12 +539,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) + * Let's continue after I_WB_SWITCH is guaranteed to be visible. + */ + call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn); +- return; ++ goto out_unlock; + + out_free: + if (isw->new_wb) + wb_put(isw->new_wb); + kfree(isw); ++out_unlock: ++ up_read(&bdi->wb_switch_rwsem); + } + + /** +@@ -894,6 +924,9 @@ fs_initcall(cgroup_writeback_init); + + #else /* CONFIG_CGROUP_WRITEBACK */ + ++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } ++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } ++ + static struct bdi_writeback * + locked_inode_to_wb_and_lock_list(struct inode *inode) + __releases(&inode->i_lock) +@@ -2420,8 +2453,11 @@ void sync_inodes_sb(struct super_block *sb) + return; + WARN_ON(!rwsem_is_locked(&sb->s_umount)); + ++ /* protect against inode wb switch, see inode_switch_wbs_work_fn() */ ++ bdi_down_write_wb_switch_rwsem(bdi); + bdi_split_work_to_wbs(bdi, &work, false); + wb_wait_for_completion(bdi, &done); ++ bdi_up_write_wb_switch_rwsem(bdi); + + wait_sb_inodes(sb); + } +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index 32920a10100e2..a7fa037b876b7 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -859,6 +859,18 @@ static int hugetlbfs_migrate_page(struct address_space *mapping, + rc = migrate_huge_page_move_mapping(mapping, newpage, page); + if (rc != MIGRATEPAGE_SUCCESS) + return rc; ++ ++ /* ++ * page_private is subpool pointer in hugetlb pages. Transfer to ++ * new page. PagePrivate is not associated with page_private for ++ * hugetlb pages and can not be set here as only page_huge_active ++ * pages can be migrated. ++ */ ++ if (page_private(page)) { ++ set_page_private(newpage, page_private(page)); ++ set_page_private(page, 0); ++ } ++ + if (mode != MIGRATE_SYNC_NO_COPY) + migrate_page_copy(newpage, page); + else +diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h +index c311571355981..07e02d6df5ad9 100644 +--- a/include/linux/backing-dev-defs.h ++++ b/include/linux/backing-dev-defs.h +@@ -190,6 +190,7 @@ struct backing_dev_info { + struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */ + struct rb_root cgwb_congested_tree; /* their congested states */ + struct mutex cgwb_release_mutex; /* protect shutdown of wb structs */ ++ struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */ + #else + struct bdi_writeback_congested *wb_congested; + #endif +diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h +index 6756fea18b69f..e44746de95cdf 100644 +--- a/include/linux/if_arp.h ++++ b/include/linux/if_arp.h +@@ -54,6 +54,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev) + case ARPHRD_IPGRE: + case ARPHRD_VOID: + case ARPHRD_NONE: ++ case ARPHRD_RAWIP: + return false; + default: + return true; +diff --git a/include/linux/irq.h b/include/linux/irq.h +index 201de12a99571..c9bffda04a450 100644 +--- a/include/linux/irq.h ++++ b/include/linux/irq.h +@@ -1151,7 +1151,8 @@ void irq_matrix_offline(struct irq_matrix *m); + void irq_matrix_assign_system(struct irq_matrix *m, unsigned int bit, bool replace); + int irq_matrix_reserve_managed(struct irq_matrix *m, const struct cpumask *msk); + void irq_matrix_remove_managed(struct irq_matrix *m, const struct cpumask *msk); +-int irq_matrix_alloc_managed(struct irq_matrix *m, unsigned int cpu); ++int irq_matrix_alloc_managed(struct irq_matrix *m, const struct cpumask *msk, ++ unsigned int *mapped_cpu); + void irq_matrix_reserve(struct irq_matrix *m); + void irq_matrix_remove_reserved(struct irq_matrix *m); + int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk, +diff --git a/kernel/exit.c b/kernel/exit.c +index 55b4fa6d01ebd..d607e23fd0c3e 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -307,7 +307,7 @@ void rcuwait_wake_up(struct rcuwait *w) + * MB (A) MB (B) + * [L] cond [L] tsk + */ +- smp_rmb(); /* (B) */ ++ smp_mb(); /* (B) */ + + /* + * Avoid using task_rcu_dereference() magic as long as we are careful, +diff --git a/kernel/futex.c b/kernel/futex.c +index d7c465fd687c6..c5fca746edc46 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1444,11 +1444,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q) + if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n")) + return; + +- /* +- * Queue the task for later wakeup for after we've released +- * the hb->lock. wake_q_add() grabs reference to p. +- */ +- wake_q_add(wake_q, p); ++ get_task_struct(p); + __unqueue_futex(q); + /* + * The waiting task can free the futex_q as soon as q->lock_ptr = NULL +@@ -1458,6 +1454,13 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q) + * plist_del in __unqueue_futex(). + */ + smp_store_release(&q->lock_ptr, NULL); ++ ++ /* ++ * Queue the task for later wakeup for after we've released ++ * the hb->lock. wake_q_add() grabs reference to p. ++ */ ++ wake_q_add(wake_q, p); ++ put_task_struct(p); + } + + /* +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 9dbdccab3b6a3..5c0ba5ca59308 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -393,6 +393,9 @@ int irq_setup_affinity(struct irq_desc *desc) + } + + cpumask_and(&mask, cpu_online_mask, set); ++ if (cpumask_empty(&mask)) ++ cpumask_copy(&mask, cpu_online_mask); ++ + if (node != NUMA_NO_NODE) { + const struct cpumask *nodemask = cpumask_of_node(node); + +diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c +index 5092494bf2614..92337703ca9fd 100644 +--- a/kernel/irq/matrix.c ++++ b/kernel/irq/matrix.c +@@ -14,6 +14,7 @@ struct cpumap { + unsigned int available; + unsigned int allocated; + unsigned int managed; ++ unsigned int managed_allocated; + bool initialized; + bool online; + unsigned long alloc_map[IRQ_MATRIX_SIZE]; +@@ -124,6 +125,48 @@ static unsigned int matrix_alloc_area(struct irq_matrix *m, struct cpumap *cm, + return area; + } + ++/* Find the best CPU which has the lowest vector allocation count */ ++static unsigned int matrix_find_best_cpu(struct irq_matrix *m, ++ const struct cpumask *msk) ++{ ++ unsigned int cpu, best_cpu, maxavl = 0; ++ struct cpumap *cm; ++ ++ best_cpu = UINT_MAX; ++ ++ for_each_cpu(cpu, msk) { ++ cm = per_cpu_ptr(m->maps, cpu); ++ ++ if (!cm->online || cm->available <= maxavl) ++ continue; ++ ++ best_cpu = cpu; ++ maxavl = cm->available; ++ } ++ return best_cpu; ++} ++ ++/* Find the best CPU which has the lowest number of managed IRQs allocated */ ++static unsigned int matrix_find_best_cpu_managed(struct irq_matrix *m, ++ const struct cpumask *msk) ++{ ++ unsigned int cpu, best_cpu, allocated = UINT_MAX; ++ struct cpumap *cm; ++ ++ best_cpu = UINT_MAX; ++ ++ for_each_cpu(cpu, msk) { ++ cm = per_cpu_ptr(m->maps, cpu); ++ ++ if (!cm->online || cm->managed_allocated > allocated) ++ continue; ++ ++ best_cpu = cpu; ++ allocated = cm->managed_allocated; ++ } ++ return best_cpu; ++} ++ + /** + * irq_matrix_assign_system - Assign system wide entry in the matrix + * @m: Matrix pointer +@@ -239,11 +282,21 @@ void irq_matrix_remove_managed(struct irq_matrix *m, const struct cpumask *msk) + * @m: Matrix pointer + * @cpu: On which CPU the interrupt should be allocated + */ +-int irq_matrix_alloc_managed(struct irq_matrix *m, unsigned int cpu) ++int irq_matrix_alloc_managed(struct irq_matrix *m, const struct cpumask *msk, ++ unsigned int *mapped_cpu) + { +- struct cpumap *cm = per_cpu_ptr(m->maps, cpu); +- unsigned int bit, end = m->alloc_end; ++ unsigned int bit, cpu, end = m->alloc_end; ++ struct cpumap *cm; + ++ if (cpumask_empty(msk)) ++ return -EINVAL; ++ ++ cpu = matrix_find_best_cpu_managed(m, msk); ++ if (cpu == UINT_MAX) ++ return -ENOSPC; ++ ++ cm = per_cpu_ptr(m->maps, cpu); ++ end = m->alloc_end; + /* Get managed bit which are not allocated */ + bitmap_andnot(m->scratch_map, cm->managed_map, cm->alloc_map, end); + bit = find_first_bit(m->scratch_map, end); +@@ -251,7 +304,9 @@ int irq_matrix_alloc_managed(struct irq_matrix *m, unsigned int cpu) + return -ENOSPC; + set_bit(bit, cm->alloc_map); + cm->allocated++; ++ cm->managed_allocated++; + m->total_allocated++; ++ *mapped_cpu = cpu; + trace_irq_matrix_alloc_managed(bit, cpu, m, cm); + return bit; + } +@@ -322,37 +377,27 @@ void irq_matrix_remove_reserved(struct irq_matrix *m) + int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk, + bool reserved, unsigned int *mapped_cpu) + { +- unsigned int cpu, best_cpu, maxavl = 0; ++ unsigned int cpu, bit; + struct cpumap *cm; +- unsigned int bit; + +- best_cpu = UINT_MAX; +- for_each_cpu(cpu, msk) { +- cm = per_cpu_ptr(m->maps, cpu); +- +- if (!cm->online || cm->available <= maxavl) +- continue; ++ cpu = matrix_find_best_cpu(m, msk); ++ if (cpu == UINT_MAX) ++ return -ENOSPC; + +- best_cpu = cpu; +- maxavl = cm->available; +- } ++ cm = per_cpu_ptr(m->maps, cpu); ++ bit = matrix_alloc_area(m, cm, 1, false); ++ if (bit >= m->alloc_end) ++ return -ENOSPC; ++ cm->allocated++; ++ cm->available--; ++ m->total_allocated++; ++ m->global_available--; ++ if (reserved) ++ m->global_reserved--; ++ *mapped_cpu = cpu; ++ trace_irq_matrix_alloc(bit, cpu, m, cm); ++ return bit; + +- if (maxavl) { +- cm = per_cpu_ptr(m->maps, best_cpu); +- bit = matrix_alloc_area(m, cm, 1, false); +- if (bit < m->alloc_end) { +- cm->allocated++; +- cm->available--; +- m->total_allocated++; +- m->global_available--; +- if (reserved) +- m->global_reserved--; +- *mapped_cpu = best_cpu; +- trace_irq_matrix_alloc(bit, best_cpu, m, cm); +- return bit; +- } +- } +- return -ENOSPC; + } + + /** +@@ -373,6 +418,8 @@ void irq_matrix_free(struct irq_matrix *m, unsigned int cpu, + + clear_bit(bit, cm->alloc_map); + cm->allocated--; ++ if(managed) ++ cm->managed_allocated--; + + if (cm->online) + m->total_allocated--; +@@ -442,13 +489,14 @@ void irq_matrix_debug_show(struct seq_file *sf, struct irq_matrix *m, int ind) + seq_printf(sf, "Total allocated: %6u\n", m->total_allocated); + seq_printf(sf, "System: %u: %*pbl\n", nsys, m->matrix_bits, + m->system_map); +- seq_printf(sf, "%*s| CPU | avl | man | act | vectors\n", ind, " "); ++ seq_printf(sf, "%*s| CPU | avl | man | mac | act | vectors\n", ind, " "); + cpus_read_lock(); + for_each_online_cpu(cpu) { + struct cpumap *cm = per_cpu_ptr(m->maps, cpu); + +- seq_printf(sf, "%*s %4d %4u %4u %4u %*pbl\n", ind, " ", +- cpu, cm->available, cm->managed, cm->allocated, ++ seq_printf(sf, "%*s %4d %4u %4u %4u %4u %*pbl\n", ind, " ", ++ cpu, cm->available, cm->managed, ++ cm->managed_allocated, cm->allocated, + m->matrix_bits, cm->alloc_map); + } + cpus_read_unlock(); +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index 3064c50e181e1..ef909357b84e1 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -198,15 +198,22 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, + woken++; + tsk = waiter->task; + +- wake_q_add(wake_q, tsk); ++ get_task_struct(tsk); + list_del(&waiter->list); + /* +- * Ensure that the last operation is setting the reader ++ * Ensure calling get_task_struct() before setting the reader + * waiter to nil such that rwsem_down_read_failed() cannot + * race with do_exit() by always holding a reference count + * to the task to wakeup. + */ + smp_store_release(&waiter->task, NULL); ++ /* ++ * Ensure issuing the wakeup (either by us or someone else) ++ * after setting the reader waiter to nil. ++ */ ++ wake_q_add(wake_q, tsk); ++ /* wake_q_add() already take the task ref */ ++ put_task_struct(tsk); + } + + adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment; +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 13ddfa46d741f..152a0b0c91bb6 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -405,10 +405,11 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task) + * its already queued (either by us or someone else) and will get the + * wakeup due to that. + * +- * This cmpxchg() executes a full barrier, which pairs with the full +- * barrier executed by the wakeup in wake_up_q(). ++ * In order to ensure that a pending wakeup will observe our pending ++ * state, even in the failed case, an explicit smp_mb() must be used. + */ +- if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL)) ++ smp_mb__before_atomic(); ++ if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL)) + return; + + get_task_struct(task); +diff --git a/mm/backing-dev.c b/mm/backing-dev.c +index 8a8bb8796c6c4..72e6d0c55cfad 100644 +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -689,6 +689,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi) + INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC); + bdi->cgwb_congested_tree = RB_ROOT; + mutex_init(&bdi->cgwb_release_mutex); ++ init_rwsem(&bdi->wb_switch_rwsem); + + ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL); + if (!ret) { +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 10e83672bfbec..9e5f66cbf711c 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -3624,7 +3624,6 @@ retry_avoidcopy: + copy_user_huge_page(new_page, old_page, address, vma, + pages_per_huge_page(h)); + __SetPageUptodate(new_page); +- set_page_huge_active(new_page); + + mmun_start = haddr; + mmun_end = mmun_start + huge_page_size(h); +@@ -3646,6 +3645,7 @@ retry_avoidcopy: + make_huge_pte(vma, new_page, 1)); + page_remove_rmap(old_page, true); + hugepage_add_new_anon_rmap(new_page, vma, haddr); ++ set_page_huge_active(new_page); + /* Make the old page be freed below */ + new_page = old_page; + } +@@ -3730,6 +3730,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, + pte_t new_pte; + spinlock_t *ptl; + unsigned long haddr = address & huge_page_mask(h); ++ bool new_page = false; + + /* + * Currently, we are forced to kill the process in the event the +@@ -3791,7 +3792,7 @@ retry: + } + clear_huge_page(page, address, pages_per_huge_page(h)); + __SetPageUptodate(page); +- set_page_huge_active(page); ++ new_page = true; + + if (vma->vm_flags & VM_MAYSHARE) { + int err = huge_add_to_page_cache(page, mapping, idx); +@@ -3862,6 +3863,15 @@ retry: + } + + spin_unlock(ptl); ++ ++ /* ++ * Only make newly allocated pages active. Existing pages found ++ * in the pagecache could be !page_huge_active() if they have been ++ * isolated for migration. ++ */ ++ if (new_page) ++ set_page_huge_active(page); ++ + unlock_page(page); + out: + return ret; +@@ -4096,7 +4106,6 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm, + * the set_pte_at() write. + */ + __SetPageUptodate(page); +- set_page_huge_active(page); + + mapping = dst_vma->vm_file->f_mapping; + idx = vma_hugecache_offset(h, dst_vma, dst_addr); +@@ -4164,6 +4173,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm, + update_mmu_cache(dst_vma, dst_addr, dst_pte); + + spin_unlock(ptl); ++ set_page_huge_active(page); + if (vm_shared) + unlock_page(page); + ret = 0; +diff --git a/mm/migrate.c b/mm/migrate.c +index ab260260a6262..14779c4f9a60a 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -1303,6 +1303,16 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, + lock_page(hpage); + } + ++ /* ++ * Check for pages which are in the process of being freed. Without ++ * page_mapping() set, hugetlbfs specific move page routine will not ++ * be called and we could leak usage counts for subpools. ++ */ ++ if (page_private(hpage) && !page_mapping(hpage)) { ++ rc = -EBUSY; ++ goto out_unlock; ++ } ++ + if (PageAnon(hpage)) + anon_vma = page_get_anon_vma(hpage); + +@@ -1333,6 +1343,7 @@ put_anon: + put_new_page = NULL; + } + ++out_unlock: + unlock_page(hpage); + out: + if (rc != -EAGAIN) +diff --git a/mm/mmap.c b/mm/mmap.c +index f7cd9cb966c0f..43507f7e66b41 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2391,12 +2391,11 @@ int expand_downwards(struct vm_area_struct *vma, + { + struct mm_struct *mm = vma->vm_mm; + struct vm_area_struct *prev; +- int error; ++ int error = 0; + + address &= PAGE_MASK; +- error = security_mmap_addr(address); +- if (error) +- return error; ++ if (address < mmap_min_addr) ++ return -EPERM; + + /* Enforce stack_guard_gap */ + prev = vma->vm_prev; +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index c2abe9db1ea24..40c5102234679 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -1478,6 +1478,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev, + if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) + sta->sta.tdls = true; + ++ if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION && ++ !sdata->u.mgd.associated) ++ return -EINVAL; ++ + err = sta_apply_parameters(local, sta, params); + if (err) { + sta_info_free(local, sta); +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 828348b2a504d..e946ee4f335bd 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -221,7 +221,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata, + struct ieee80211_hdr_3addr hdr; + u8 category; + u8 action_code; +- } __packed action; ++ } __packed __aligned(2) action; + + if (!sdata) + return; +@@ -2678,7 +2678,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + skb_set_queue_mapping(skb, q); + + if (!--mesh_hdr->ttl) { +- IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); ++ if (!is_multicast_ether_addr(hdr->addr1)) ++ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, ++ dropped_frames_ttl); + goto out; + } + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index c7ccd7b71b151..743cde66aaf62 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -3614,10 +3614,10 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb, + /* We need a bit of data queued to build aggregates properly, so + * instruct the TCP stack to allow more than a single ms of data + * to be queued in the stack. The value is a bit-shift of 1 +- * second, so 8 is ~4ms of queued data. Only affects local TCP ++ * second, so 7 is ~8ms of queued data. Only affects local TCP + * sockets. + */ +- sk_pacing_shift_update(skb->sk, 8); ++ sk_pacing_shift_update(skb->sk, 7); + + fast_tx = rcu_dereference(sta->fast_tx); + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 24cfa2776f50b..8002ace7c9f65 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -1249,7 +1249,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd) + * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"), + * however it is safe for now to assume that a frequency rule should not be + * part of a frequency's band if the start freq or end freq are off by more +- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the ++ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the + * 60 GHz band. + * This resolution can be lowered and should be considered as we add + * regulatory rule support for other "bands". +@@ -1264,7 +1264,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range, + * with the Channel starting frequency above 45 GHz. + */ + u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ? +- 10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; ++ 20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; + if (abs(freq_khz - freq_range->start_freq_khz) <= limit) + return true; + if (abs(freq_khz - freq_range->end_freq_khz) <= limit) +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 26b5e245b0747..8b78ddffa509a 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params) + { + /* first let's check the buffer parameter's */ + if (params->buffer.fragment_size == 0 || +- params->buffer.fragments > INT_MAX / params->buffer.fragment_size) ++ params->buffer.fragments > INT_MAX / params->buffer.fragment_size || ++ params->buffer.fragments == 0) + return -EINVAL; + + /* now codec parameters */ +diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c +index d88e673410835..18a931c25ca58 100644 +--- a/sound/soc/codecs/rt274.c ++++ b/sound/soc/codecs/rt274.c +@@ -1126,8 +1126,11 @@ static int rt274_i2c_probe(struct i2c_client *i2c, + return ret; + } + +- regmap_read(rt274->regmap, ++ ret = regmap_read(rt274->regmap, + RT274_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val); ++ if (ret) ++ return ret; ++ + if (val != RT274_VENDOR_ID) { + dev_err(&i2c->dev, + "Device with ID register %#x is not rt274\n", val); +diff --git a/sound/soc/codecs/rt5682.h b/sound/soc/codecs/rt5682.h +index 8068140ebe3f1..cdd659f4df93d 100644 +--- a/sound/soc/codecs/rt5682.h ++++ b/sound/soc/codecs/rt5682.h +@@ -849,18 +849,18 @@ + #define RT5682_SCLK_SRC_PLL2 (0x2 << 13) + #define RT5682_SCLK_SRC_SDW (0x3 << 13) + #define RT5682_SCLK_SRC_RCCLK (0x4 << 13) +-#define RT5682_PLL1_SRC_MASK (0x3 << 10) +-#define RT5682_PLL1_SRC_SFT 10 +-#define RT5682_PLL1_SRC_MCLK (0x0 << 10) +-#define RT5682_PLL1_SRC_BCLK1 (0x1 << 10) +-#define RT5682_PLL1_SRC_SDW (0x2 << 10) +-#define RT5682_PLL1_SRC_RC (0x3 << 10) +-#define RT5682_PLL2_SRC_MASK (0x3 << 8) +-#define RT5682_PLL2_SRC_SFT 8 +-#define RT5682_PLL2_SRC_MCLK (0x0 << 8) +-#define RT5682_PLL2_SRC_BCLK1 (0x1 << 8) +-#define RT5682_PLL2_SRC_SDW (0x2 << 8) +-#define RT5682_PLL2_SRC_RC (0x3 << 8) ++#define RT5682_PLL2_SRC_MASK (0x3 << 10) ++#define RT5682_PLL2_SRC_SFT 10 ++#define RT5682_PLL2_SRC_MCLK (0x0 << 10) ++#define RT5682_PLL2_SRC_BCLK1 (0x1 << 10) ++#define RT5682_PLL2_SRC_SDW (0x2 << 10) ++#define RT5682_PLL2_SRC_RC (0x3 << 10) ++#define RT5682_PLL1_SRC_MASK (0x3 << 8) ++#define RT5682_PLL1_SRC_SFT 8 ++#define RT5682_PLL1_SRC_MCLK (0x0 << 8) ++#define RT5682_PLL1_SRC_BCLK1 (0x1 << 8) ++#define RT5682_PLL1_SRC_SDW (0x2 << 8) ++#define RT5682_PLL1_SRC_RC (0x3 << 8) + + + +diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c +index 392d5eef356d3..99e07b01a2ce9 100644 +--- a/sound/soc/fsl/imx-audmux.c ++++ b/sound/soc/fsl/imx-audmux.c +@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf, + if (!buf) + return -ENOMEM; + +- ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", ++ ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", + pdcr, ptcr); + + if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxFS output from %s, ", + audmux_port_string((ptcr >> 27) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxFS input, "); + + if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxClk output from %s", + audmux_port_string((ptcr >> 22) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxClk input"); + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); + + if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) { +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "Port is symmetric"); + } else { + if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxFS output from %s, ", + audmux_port_string((ptcr >> 17) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxFS input, "); + + if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxClk output from %s", + audmux_port_string((ptcr >> 12) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxClk input"); + } + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "\nData received from %s\n", + audmux_port_string((pdcr >> 13) & 0x7)); + +diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c +index 7b0ee67b4fc8b..78ec97b53f50e 100644 +--- a/sound/soc/intel/boards/broadwell.c ++++ b/sound/soc/intel/boards/broadwell.c +@@ -192,7 +192,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = { + .stream_name = "Loopback", + .cpu_dai_name = "Loopback Pin", + .platform_name = "haswell-pcm-audio", +- .dynamic = 0, ++ .dynamic = 1, + .codec_name = "snd-soc-dummy", + .codec_dai_name = "snd-soc-dummy-dai", + .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, +diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c +index eab1f439dd3f1..a4022983a7ce0 100644 +--- a/sound/soc/intel/boards/haswell.c ++++ b/sound/soc/intel/boards/haswell.c +@@ -146,7 +146,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = { + .stream_name = "Loopback", + .cpu_dai_name = "Loopback Pin", + .platform_name = "haswell-pcm-audio", +- .dynamic = 0, ++ .dynamic = 1, + .codec_name = "snd-soc-dummy", + .codec_dai_name = "snd-soc-dummy-dai", + .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 461d951917c05..6537069452226 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2028,19 +2028,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + out = is_connected_output_ep(w, NULL, NULL); + } + +- ret = snprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", ++ ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", + w->name, w->power ? "On" : "Off", + w->force ? " (forced)" : "", in, out); + + if (w->reg >= 0) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + " - R%d(0x%x) mask 0x%x", + w->reg, w->reg, w->mask << w->shift); + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); + + if (w->sname) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", + w->sname, + w->active ? "active" : "inactive"); + +@@ -2053,7 +2053,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + if (!p->connect) + continue; + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + " %s \"%s\" \"%s\"\n", + (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out", + p->name ? p->name : "static", +diff --git a/tools/testing/selftests/gpio/gpio-mockup-chardev.c b/tools/testing/selftests/gpio/gpio-mockup-chardev.c +index f8d468f54e986..aaa1e9f083c37 100644 +--- a/tools/testing/selftests/gpio/gpio-mockup-chardev.c ++++ b/tools/testing/selftests/gpio/gpio-mockup-chardev.c +@@ -37,7 +37,7 @@ static int get_debugfs(char **path) + struct libmnt_table *tb; + struct libmnt_iter *itr = NULL; + struct libmnt_fs *fs; +- int found = 0; ++ int found = 0, ret; + + cxt = mnt_new_context(); + if (!cxt) +@@ -58,8 +58,11 @@ static int get_debugfs(char **path) + break; + } + } +- if (found) +- asprintf(path, "%s/gpio", mnt_fs_get_target(fs)); ++ if (found) { ++ ret = asprintf(path, "%s/gpio", mnt_fs_get_target(fs)); ++ if (ret < 0) ++ err(EXIT_FAILURE, "failed to format string"); ++ } + + mnt_free_iter(itr); + mnt_free_context(cxt); +diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c +index 6fd8c089cafcd..fb5d2d1e0c048 100644 +--- a/tools/testing/selftests/kvm/lib/kvm_util.c ++++ b/tools/testing/selftests/kvm/lib/kvm_util.c +@@ -590,7 +590,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm, + * already exist. + */ + region = (struct userspace_mem_region *) userspace_mem_region_find( +- vm, guest_paddr, guest_paddr + npages * vm->page_size); ++ vm, guest_paddr, (guest_paddr + npages * vm->page_size) - 1); + if (region != NULL) + TEST_ASSERT(false, "overlapping userspace_mem_region already " + "exists\n" +@@ -606,15 +606,10 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm, + region = region->next) { + if (region->region.slot == slot) + break; +- if ((guest_paddr <= (region->region.guest_phys_addr +- + region->region.memory_size)) +- && ((guest_paddr + npages * vm->page_size) +- >= region->region.guest_phys_addr)) +- break; + } + if (region != NULL) + TEST_ASSERT(false, "A mem region with the requested slot " +- "or overlapping physical memory range already exists.\n" ++ "already exists.\n" + " requested slot: %u paddr: 0x%lx npages: 0x%lx\n" + " existing slot: %u paddr: 0x%lx size: 0x%lx", + slot, guest_paddr, npages, +diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c +index e20b017e70731..b2065536d4075 100644 +--- a/tools/testing/selftests/rtc/rtctest.c ++++ b/tools/testing/selftests/rtc/rtctest.c +@@ -145,15 +145,12 @@ TEST_F(rtc, alarm_alm_set) { + + rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); + ASSERT_NE(-1, rc); +- EXPECT_NE(0, rc); ++ ASSERT_NE(0, rc); + + /* Disable alarm interrupts */ + rc = ioctl(self->fd, RTC_AIE_OFF, 0); + ASSERT_NE(-1, rc); + +- if (rc == 0) +- return; +- + rc = read(self->fd, &data, sizeof(unsigned long)); + ASSERT_NE(-1, rc); + TH_LOG("data: %lx", data); +@@ -202,7 +199,109 @@ TEST_F(rtc, alarm_wkalm_set) { + + rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); + ASSERT_NE(-1, rc); +- EXPECT_NE(0, rc); ++ ASSERT_NE(0, rc); ++ ++ rc = read(self->fd, &data, sizeof(unsigned long)); ++ ASSERT_NE(-1, rc); ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &tm); ++ ASSERT_NE(-1, rc); ++ ++ new = timegm((struct tm *)&tm); ++ ASSERT_EQ(new, secs); ++} ++ ++TEST_F(rtc, alarm_alm_set_minute) { ++ struct timeval tv = { .tv_sec = 62 }; ++ unsigned long data; ++ struct rtc_time tm; ++ fd_set readfds; ++ time_t secs, new; ++ int rc; ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &tm); ++ ASSERT_NE(-1, rc); ++ ++ secs = timegm((struct tm *)&tm) + 60 - tm.tm_sec; ++ gmtime_r(&secs, (struct tm *)&tm); ++ ++ rc = ioctl(self->fd, RTC_ALM_SET, &tm); ++ if (rc == -1) { ++ ASSERT_EQ(EINVAL, errno); ++ TH_LOG("skip alarms are not supported."); ++ return; ++ } ++ ++ rc = ioctl(self->fd, RTC_ALM_READ, &tm); ++ ASSERT_NE(-1, rc); ++ ++ TH_LOG("Alarm time now set to %02d:%02d:%02d.", ++ tm.tm_hour, tm.tm_min, tm.tm_sec); ++ ++ /* Enable alarm interrupts */ ++ rc = ioctl(self->fd, RTC_AIE_ON, 0); ++ ASSERT_NE(-1, rc); ++ ++ FD_ZERO(&readfds); ++ FD_SET(self->fd, &readfds); ++ ++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); ++ ASSERT_NE(-1, rc); ++ ASSERT_NE(0, rc); ++ ++ /* Disable alarm interrupts */ ++ rc = ioctl(self->fd, RTC_AIE_OFF, 0); ++ ASSERT_NE(-1, rc); ++ ++ rc = read(self->fd, &data, sizeof(unsigned long)); ++ ASSERT_NE(-1, rc); ++ TH_LOG("data: %lx", data); ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &tm); ++ ASSERT_NE(-1, rc); ++ ++ new = timegm((struct tm *)&tm); ++ ASSERT_EQ(new, secs); ++} ++ ++TEST_F(rtc, alarm_wkalm_set_minute) { ++ struct timeval tv = { .tv_sec = 62 }; ++ struct rtc_wkalrm alarm = { 0 }; ++ struct rtc_time tm; ++ unsigned long data; ++ fd_set readfds; ++ time_t secs, new; ++ int rc; ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &alarm.time); ++ ASSERT_NE(-1, rc); ++ ++ secs = timegm((struct tm *)&alarm.time) + 60 - alarm.time.tm_sec; ++ gmtime_r(&secs, (struct tm *)&alarm.time); ++ ++ alarm.enabled = 1; ++ ++ rc = ioctl(self->fd, RTC_WKALM_SET, &alarm); ++ if (rc == -1) { ++ ASSERT_EQ(EINVAL, errno); ++ TH_LOG("skip alarms are not supported."); ++ return; ++ } ++ ++ rc = ioctl(self->fd, RTC_WKALM_RD, &alarm); ++ ASSERT_NE(-1, rc); ++ ++ TH_LOG("Alarm time now set to %02d/%02d/%02d %02d:%02d:%02d.", ++ alarm.time.tm_mday, alarm.time.tm_mon + 1, ++ alarm.time.tm_year + 1900, alarm.time.tm_hour, ++ alarm.time.tm_min, alarm.time.tm_sec); ++ ++ FD_ZERO(&readfds); ++ FD_SET(self->fd, &readfds); ++ ++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); ++ ASSERT_NE(-1, rc); ++ ASSERT_NE(0, rc); + + rc = read(self->fd, &data, sizeof(unsigned long)); + ASSERT_NE(-1, rc); +diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile +index fce7f4ce06925..1760b3e397306 100644 +--- a/tools/testing/selftests/seccomp/Makefile ++++ b/tools/testing/selftests/seccomp/Makefile +@@ -9,7 +9,7 @@ BINARIES := seccomp_bpf seccomp_benchmark + CFLAGS += -Wl,-no-as-needed -Wall + + seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h +- $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@ ++ $(CC) $(CFLAGS) $(LDFLAGS) $< -lpthread -o $@ + + TEST_PROGS += $(BINARIES) + EXTRA_CLEAN := $(BINARIES) +diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c +index 36df55132036f..9601bc24454d9 100644 +--- a/tools/testing/selftests/vm/gup_benchmark.c ++++ b/tools/testing/selftests/vm/gup_benchmark.c +@@ -22,6 +22,7 @@ struct gup_benchmark { + __u64 size; + __u32 nr_pages_per_call; + __u32 flags; ++ __u64 expansion[10]; /* For future use */ + }; + + int main(int argc, char **argv) diff --git a/patch/kernel/sunxi-next/patch-4.19.27-28.patch b/patch/kernel/sunxi-next/patch-4.19.27-28.patch new file mode 100644 index 0000000000..c2e1d84c3b --- /dev/null +++ b/patch/kernel/sunxi-next/patch-4.19.27-28.patch @@ -0,0 +1,2598 @@ +diff --git a/Makefile b/Makefile +index 70ed9a53558a5..c6ac023ba33a5 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 27 ++SUBLEVEL = 28 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c +index ba150c755fcce..85b6c60f285d2 100644 +--- a/arch/mips/kernel/irq.c ++++ b/arch/mips/kernel/irq.c +@@ -52,6 +52,7 @@ asmlinkage void spurious_interrupt(void) + void __init init_IRQ(void) + { + int i; ++ unsigned int order = get_order(IRQ_STACK_SIZE); + + for (i = 0; i < NR_IRQS; i++) + irq_set_noprobe(i); +@@ -62,8 +63,7 @@ void __init init_IRQ(void) + arch_init_irq(); + + for_each_possible_cpu(i) { +- int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE; +- void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages); ++ void *s = (void *)__get_free_pages(GFP_KERNEL, order); + + irq_stack[i] = s; + pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i, +diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c +index 9e21573714910..f8debf7aeb4c1 100644 +--- a/arch/x86/boot/compressed/pgtable_64.c ++++ b/arch/x86/boot/compressed/pgtable_64.c +@@ -1,5 +1,7 @@ ++#include + #include + #include ++#include + #include "pgtable.h" + #include "../string.h" + +@@ -37,9 +39,10 @@ int cmdline_find_option_bool(const char *option); + + static unsigned long find_trampoline_placement(void) + { +- unsigned long bios_start, ebda_start; ++ unsigned long bios_start = 0, ebda_start = 0; + unsigned long trampoline_start; + struct boot_e820_entry *entry; ++ char *signature; + int i; + + /* +@@ -47,8 +50,18 @@ static unsigned long find_trampoline_placement(void) + * This code is based on reserve_bios_regions(). + */ + +- ebda_start = *(unsigned short *)0x40e << 4; +- bios_start = *(unsigned short *)0x413 << 10; ++ /* ++ * EFI systems may not provide legacy ROM. The memory may not be mapped ++ * at all. ++ * ++ * Only look for values in the legacy ROM for non-EFI system. ++ */ ++ signature = (char *)&boot_params->efi_info.efi_loader_signature; ++ if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) && ++ strncmp(signature, EFI64_LOADER_SIGNATURE, 4)) { ++ ebda_start = *(unsigned short *)0x40e << 4; ++ bios_start = *(unsigned short *)0x413 << 10; ++ } + + if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX) + bios_start = BIOS_START_MAX; +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index eeea634bee0a7..6a25278e00929 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -818,11 +818,9 @@ static void init_amd_bd(struct cpuinfo_x86 *c) + static void init_amd_zn(struct cpuinfo_x86 *c) + { + set_cpu_cap(c, X86_FEATURE_ZEN); +- /* +- * Fix erratum 1076: CPB feature bit not being set in CPUID. It affects +- * all up to and including B1. +- */ +- if (c->x86_model <= 1 && c->x86_stepping <= 1) ++ ++ /* Fix erratum 1076: CPB feature bit not being set in CPUID. */ ++ if (!cpu_has(c, X86_FEATURE_CPB)) + set_cpu_cap(c, X86_FEATURE_CPB); + } + +diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c +index 4bb68133a72af..5a0e0bd68b769 100644 +--- a/arch/xtensa/kernel/process.c ++++ b/arch/xtensa/kernel/process.c +@@ -320,8 +320,8 @@ unsigned long get_wchan(struct task_struct *p) + + /* Stack layout: sp-4: ra, sp-3: sp' */ + +- pc = MAKE_PC_FROM_RA(*(unsigned long*)sp - 4, sp); +- sp = *(unsigned long *)sp - 3; ++ pc = MAKE_PC_FROM_RA(SPILL_SLOT(sp, 0), sp); ++ sp = SPILL_SLOT(sp, 1); + } while (count++ < 16); + return 0; + } +diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c +index 7f9ea8e4c1b22..1342f8e6025cc 100644 +--- a/drivers/bluetooth/btrtl.c ++++ b/drivers/bluetooth/btrtl.c +@@ -544,10 +544,9 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + hdev->bus); + + if (!btrtl_dev->ic_info) { +- rtl_dev_err(hdev, "rtl: unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x", ++ rtl_dev_info(hdev, "rtl: unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x", + lmp_subver, hci_rev, hci_ver); +- ret = -EINVAL; +- goto err_free; ++ return btrtl_dev; + } + + if (btrtl_dev->ic_info->has_rom_version) { +@@ -602,6 +601,11 @@ int btrtl_download_firmware(struct hci_dev *hdev, + * standard btusb. Once that firmware is uploaded, the subver changes + * to a different value. + */ ++ if (!btrtl_dev->ic_info) { ++ rtl_dev_info(hdev, "rtl: assuming no firmware upload needed\n"); ++ return 0; ++ } ++ + switch (btrtl_dev->ic_info->lmp_subver) { + case RTL_ROM_LMP_8723A: + case RTL_ROM_LMP_3499: +diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c +index c0a5b1f3a9863..4ccc39e00ced3 100644 +--- a/drivers/char/applicom.c ++++ b/drivers/char/applicom.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -386,7 +387,11 @@ static ssize_t ac_write(struct file *file, const char __user *buf, size_t count, + TicCard = st_loc.tic_des_from_pc; /* tic number to send */ + IndexCard = NumCard - 1; + +- if((NumCard < 1) || (NumCard > MAX_BOARD) || !apbs[IndexCard].RamIO) ++ if (IndexCard >= MAX_BOARD) ++ return -EINVAL; ++ IndexCard = array_index_nospec(IndexCard, MAX_BOARD); ++ ++ if (!apbs[IndexCard].RamIO) + return -EINVAL; + + #ifdef DEBUG +@@ -697,6 +702,7 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + unsigned char IndexCard; + void __iomem *pmem; + int ret = 0; ++ static int warncount = 10; + volatile unsigned char byte_reset_it; + struct st_ram_io *adgl; + void __user *argp = (void __user *)arg; +@@ -711,16 +717,12 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + mutex_lock(&ac_mutex); + IndexCard = adgl->num_card-1; + +- if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) { +- static int warncount = 10; +- if (warncount) { +- printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1); +- warncount--; +- } +- kfree(adgl); +- mutex_unlock(&ac_mutex); +- return -EINVAL; +- } ++ if (cmd != 6 && IndexCard >= MAX_BOARD) ++ goto err; ++ IndexCard = array_index_nospec(IndexCard, MAX_BOARD); ++ ++ if (cmd != 6 && !apbs[IndexCard].RamIO) ++ goto err; + + switch (cmd) { + +@@ -838,5 +840,16 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + kfree(adgl); + mutex_unlock(&ac_mutex); + return 0; ++ ++err: ++ if (warncount) { ++ pr_warn("APPLICOM driver IOCTL, bad board number %d\n", ++ (int)IndexCard + 1); ++ warncount--; ++ } ++ kfree(adgl); ++ mutex_unlock(&ac_mutex); ++ return -EINVAL; ++ + } + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index b100260b6ed2e..505c9a55d5551 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -545,13 +545,13 @@ EXPORT_SYMBOL_GPL(cpufreq_policy_transition_delay_us); + * SYSFS INTERFACE * + *********************************************************************/ + static ssize_t show_boost(struct kobject *kobj, +- struct attribute *attr, char *buf) ++ struct kobj_attribute *attr, char *buf) + { + return sprintf(buf, "%d\n", cpufreq_driver->boost_enabled); + } + +-static ssize_t store_boost(struct kobject *kobj, struct attribute *attr, +- const char *buf, size_t count) ++static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, ++ const char *buf, size_t count) + { + int ret, enable; + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index b6a1aadaff9f3..a005711f909ea 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -833,7 +833,7 @@ static void intel_pstate_update_policies(void) + /************************** sysfs begin ************************/ + #define show_one(file_name, object) \ + static ssize_t show_##file_name \ +- (struct kobject *kobj, struct attribute *attr, char *buf) \ ++ (struct kobject *kobj, struct kobj_attribute *attr, char *buf) \ + { \ + return sprintf(buf, "%u\n", global.object); \ + } +@@ -842,7 +842,7 @@ static ssize_t intel_pstate_show_status(char *buf); + static int intel_pstate_update_status(const char *buf, size_t size); + + static ssize_t show_status(struct kobject *kobj, +- struct attribute *attr, char *buf) ++ struct kobj_attribute *attr, char *buf) + { + ssize_t ret; + +@@ -853,7 +853,7 @@ static ssize_t show_status(struct kobject *kobj, + return ret; + } + +-static ssize_t store_status(struct kobject *a, struct attribute *b, ++static ssize_t store_status(struct kobject *a, struct kobj_attribute *b, + const char *buf, size_t count) + { + char *p = memchr(buf, '\n', count); +@@ -867,7 +867,7 @@ static ssize_t store_status(struct kobject *a, struct attribute *b, + } + + static ssize_t show_turbo_pct(struct kobject *kobj, +- struct attribute *attr, char *buf) ++ struct kobj_attribute *attr, char *buf) + { + struct cpudata *cpu; + int total, no_turbo, turbo_pct; +@@ -893,7 +893,7 @@ static ssize_t show_turbo_pct(struct kobject *kobj, + } + + static ssize_t show_num_pstates(struct kobject *kobj, +- struct attribute *attr, char *buf) ++ struct kobj_attribute *attr, char *buf) + { + struct cpudata *cpu; + int total; +@@ -914,7 +914,7 @@ static ssize_t show_num_pstates(struct kobject *kobj, + } + + static ssize_t show_no_turbo(struct kobject *kobj, +- struct attribute *attr, char *buf) ++ struct kobj_attribute *attr, char *buf) + { + ssize_t ret; + +@@ -936,7 +936,7 @@ static ssize_t show_no_turbo(struct kobject *kobj, + return ret; + } + +-static ssize_t store_no_turbo(struct kobject *a, struct attribute *b, ++static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b, + const char *buf, size_t count) + { + unsigned int input; +@@ -983,7 +983,7 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b, + return count; + } + +-static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b, ++static ssize_t store_max_perf_pct(struct kobject *a, struct kobj_attribute *b, + const char *buf, size_t count) + { + unsigned int input; +@@ -1013,7 +1013,7 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b, + return count; + } + +-static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b, ++static ssize_t store_min_perf_pct(struct kobject *a, struct kobj_attribute *b, + const char *buf, size_t count) + { + unsigned int input; +@@ -1045,12 +1045,13 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b, + } + + static ssize_t show_hwp_dynamic_boost(struct kobject *kobj, +- struct attribute *attr, char *buf) ++ struct kobj_attribute *attr, char *buf) + { + return sprintf(buf, "%u\n", hwp_boost); + } + +-static ssize_t store_hwp_dynamic_boost(struct kobject *a, struct attribute *b, ++static ssize_t store_hwp_dynamic_boost(struct kobject *a, ++ struct kobj_attribute *b, + const char *buf, size_t count) + { + unsigned int input; +diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c +index 2c22836d3ffd5..4596fde16dfe6 100644 +--- a/drivers/gnss/sirf.c ++++ b/drivers/gnss/sirf.c +@@ -310,30 +310,26 @@ static int sirf_probe(struct serdev_device *serdev) + ret = -ENODEV; + goto err_put_device; + } ++ ++ ret = regulator_enable(data->vcc); ++ if (ret) ++ goto err_put_device; ++ ++ /* Wait for chip to boot into hibernate mode. */ ++ msleep(SIRF_BOOT_DELAY); + } + + if (data->wakeup) { + ret = gpiod_to_irq(data->wakeup); + if (ret < 0) +- goto err_put_device; +- ++ goto err_disable_vcc; + data->irq = ret; + +- ret = devm_request_threaded_irq(dev, data->irq, NULL, +- sirf_wakeup_handler, ++ ret = request_threaded_irq(data->irq, NULL, sirf_wakeup_handler, + IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + "wakeup", data); + if (ret) +- goto err_put_device; +- } +- +- if (data->on_off) { +- ret = regulator_enable(data->vcc); +- if (ret) +- goto err_put_device; +- +- /* Wait for chip to boot into hibernate mode */ +- msleep(SIRF_BOOT_DELAY); ++ goto err_disable_vcc; + } + + if (IS_ENABLED(CONFIG_PM)) { +@@ -342,7 +338,7 @@ static int sirf_probe(struct serdev_device *serdev) + } else { + ret = sirf_runtime_resume(dev); + if (ret < 0) +- goto err_disable_vcc; ++ goto err_free_irq; + } + + ret = gnss_register_device(gdev); +@@ -356,6 +352,9 @@ err_disable_rpm: + pm_runtime_disable(dev); + else + sirf_runtime_suspend(dev); ++err_free_irq: ++ if (data->wakeup) ++ free_irq(data->irq, data); + err_disable_vcc: + if (data->on_off) + regulator_disable(data->vcc); +@@ -376,6 +375,9 @@ static void sirf_remove(struct serdev_device *serdev) + else + sirf_runtime_suspend(&serdev->dev); + ++ if (data->wakeup) ++ free_irq(data->irq, data); ++ + if (data->on_off) + regulator_disable(data->vcc); + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 9f697a5b8e3df..c078c791f481a 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -884,7 +884,7 @@ static uint64_t _mv88e6xxx_get_ethtool_stat(struct mv88e6xxx_chip *chip, + default: + return U64_MAX; + } +- value = (((u64)high) << 16) | low; ++ value = (((u64)high) << 32) | low; + return value; + } + +@@ -3070,7 +3070,7 @@ static const struct mv88e6xxx_ops mv88e6161_ops = { + .port_disable_pri_override = mv88e6xxx_port_disable_pri_override, + .port_link_state = mv88e6352_port_link_state, + .port_get_cmode = mv88e6185_port_get_cmode, +- .stats_snapshot = mv88e6320_g1_stats_snapshot, ++ .stats_snapshot = mv88e6xxx_g1_stats_snapshot, + .stats_set_histogram = mv88e6095_g1_stats_set_histogram, + .stats_get_sset_count = mv88e6095_stats_get_sset_count, + .stats_get_strings = mv88e6095_stats_get_strings, +@@ -4188,7 +4188,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { + .name = "Marvell 88E6190", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, +@@ -4211,7 +4211,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { + .name = "Marvell 88E6190X", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, +@@ -4234,7 +4234,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { + .name = "Marvell 88E6191", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .max_vid = 8191, + .port_base_addr = 0x0, + .phy_base_addr = 0x0, +@@ -4281,7 +4281,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { + .name = "Marvell 88E6290", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, +@@ -4443,7 +4443,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { + .name = "Marvell 88E6390", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, +@@ -4466,7 +4466,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { + .name = "Marvell 88E6390X", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, +@@ -4561,6 +4561,14 @@ static int mv88e6xxx_smi_init(struct mv88e6xxx_chip *chip, + return 0; + } + ++static void mv88e6xxx_ports_cmode_init(struct mv88e6xxx_chip *chip) ++{ ++ int i; ++ ++ for (i = 0; i < mv88e6xxx_num_ports(chip); i++) ++ chip->ports[i].cmode = MV88E6XXX_PORT_STS_CMODE_INVALID; ++} ++ + static enum dsa_tag_protocol mv88e6xxx_get_tag_protocol(struct dsa_switch *ds, + int port) + { +@@ -4597,6 +4605,8 @@ static const char *mv88e6xxx_drv_probe(struct device *dsa_dev, + if (err) + goto free; + ++ mv88e6xxx_ports_cmode_init(chip); ++ + mutex_lock(&chip->reg_lock); + err = mv88e6xxx_switch_reset(chip); + mutex_unlock(&chip->reg_lock); +diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c +index 92945841c8e88..7fffce734f0a5 100644 +--- a/drivers/net/dsa/mv88e6xxx/port.c ++++ b/drivers/net/dsa/mv88e6xxx/port.c +@@ -190,7 +190,7 @@ int mv88e6xxx_port_set_duplex(struct mv88e6xxx_chip *chip, int port, int dup) + /* normal duplex detection */ + break; + default: +- return -EINVAL; ++ return -EOPNOTSUPP; + } + + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_MAC_CTL, reg); +@@ -374,6 +374,10 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + cmode = 0; + } + ++ /* cmode doesn't change, nothing to do for us */ ++ if (cmode == chip->ports[port].cmode) ++ return 0; ++ + lane = mv88e6390x_serdes_get_lane(chip, port); + if (lane < 0) + return lane; +@@ -384,7 +388,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + return err; + } + +- err = mv88e6390_serdes_power(chip, port, false); ++ err = mv88e6390x_serdes_power(chip, port, false); + if (err) + return err; + +@@ -400,7 +404,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port, + if (err) + return err; + +- err = mv88e6390_serdes_power(chip, port, true); ++ err = mv88e6390x_serdes_power(chip, port, true); + if (err) + return err; + +diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h +index b31910023bb64..95b59f5eb3931 100644 +--- a/drivers/net/dsa/mv88e6xxx/port.h ++++ b/drivers/net/dsa/mv88e6xxx/port.h +@@ -52,6 +52,7 @@ + #define MV88E6185_PORT_STS_CMODE_1000BASE_X 0x0005 + #define MV88E6185_PORT_STS_CMODE_PHY 0x0006 + #define MV88E6185_PORT_STS_CMODE_DISABLED 0x0007 ++#define MV88E6XXX_PORT_STS_CMODE_INVALID 0xff + + /* Offset 0x01: MAC (or PCS or Physical) Control Register */ + #define MV88E6XXX_PORT_MAC_CTL 0x01 +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 034f57500f00e..1fdaf86bbe8fb 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -463,6 +463,12 @@ normal_tx: + } + + length >>= 9; ++ if (unlikely(length >= ARRAY_SIZE(bnxt_lhint_arr))) { ++ dev_warn_ratelimited(&pdev->dev, "Dropped oversize %d bytes TX packet.\n", ++ skb->len); ++ i = 0; ++ goto tx_dma_error; ++ } + flags |= bnxt_lhint_arr[length]; + txbd->tx_bd_len_flags_type = cpu_to_le32(flags); + +diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c +index ae2f35039343b..1485f66cf7b0c 100644 +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -46,6 +46,7 @@ + #include + #include + #include ++#include + + #include + +@@ -93,7 +94,7 @@ static int copybreak __read_mostly = 128; + module_param(copybreak, int, 0); + MODULE_PARM_DESC(copybreak, "Receive copy threshold"); + +-static int disable_msi = 0; ++static int disable_msi = -1; + module_param(disable_msi, int, 0); + MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)"); + +@@ -4931,6 +4932,24 @@ static const char *sky2_name(u8 chipid, char *buf, int sz) + return buf; + } + ++static const struct dmi_system_id msi_blacklist[] = { ++ { ++ .ident = "Dell Inspiron 1545", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1545"), ++ }, ++ }, ++ { ++ .ident = "Gateway P-79", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Gateway"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P-79"), ++ }, ++ }, ++ {} ++}; ++ + static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + struct net_device *dev, *dev1; +@@ -5042,6 +5061,9 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto err_out_free_pci; + } + ++ if (disable_msi == -1) ++ disable_msi = !!dmi_check_system(msi_blacklist); ++ + if (!disable_msi && pci_enable_msi(pdev) == 0) { + err = sky2_test_msi(hw); + if (err) { +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c +index 42f5bfa33694c..de5a6abda7e3f 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -1403,7 +1403,8 @@ static int lan743x_tx_frame_start(struct lan743x_tx *tx, + } + + static void lan743x_tx_frame_add_lso(struct lan743x_tx *tx, +- unsigned int frame_length) ++ unsigned int frame_length, ++ int nr_frags) + { + /* called only from within lan743x_tx_xmit_frame. + * assuming tx->ring_lock has already been acquired. +@@ -1413,6 +1414,10 @@ static void lan743x_tx_frame_add_lso(struct lan743x_tx *tx, + + /* wrap up previous descriptor */ + tx->frame_data0 |= TX_DESC_DATA0_EXT_; ++ if (nr_frags <= 0) { ++ tx->frame_data0 |= TX_DESC_DATA0_LS_; ++ tx->frame_data0 |= TX_DESC_DATA0_IOC_; ++ } + tx_descriptor = &tx->ring_cpu_ptr[tx->frame_tail]; + tx_descriptor->data0 = tx->frame_data0; + +@@ -1517,8 +1522,11 @@ static void lan743x_tx_frame_end(struct lan743x_tx *tx, + u32 tx_tail_flags = 0; + + /* wrap up previous descriptor */ +- tx->frame_data0 |= TX_DESC_DATA0_LS_; +- tx->frame_data0 |= TX_DESC_DATA0_IOC_; ++ if ((tx->frame_data0 & TX_DESC_DATA0_DTYPE_MASK_) == ++ TX_DESC_DATA0_DTYPE_DATA_) { ++ tx->frame_data0 |= TX_DESC_DATA0_LS_; ++ tx->frame_data0 |= TX_DESC_DATA0_IOC_; ++ } + + tx_descriptor = &tx->ring_cpu_ptr[tx->frame_tail]; + buffer_info = &tx->buffer_info[tx->frame_tail]; +@@ -1603,7 +1611,7 @@ static netdev_tx_t lan743x_tx_xmit_frame(struct lan743x_tx *tx, + } + + if (gso) +- lan743x_tx_frame_add_lso(tx, frame_length); ++ lan743x_tx_frame_add_lso(tx, frame_length, nr_frags); + + if (nr_frags <= 0) + goto finish; +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 01711e6e9a394..e1427b56a073a 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -636,15 +636,20 @@ out: + static int geneve_open(struct net_device *dev) + { + struct geneve_dev *geneve = netdev_priv(dev); +- bool ipv6 = !!(geneve->info.mode & IP_TUNNEL_INFO_IPV6); + bool metadata = geneve->collect_md; ++ bool ipv4, ipv6; + int ret = 0; + ++ ipv6 = geneve->info.mode & IP_TUNNEL_INFO_IPV6 || metadata; ++ ipv4 = !ipv6 || metadata; + #if IS_ENABLED(CONFIG_IPV6) +- if (ipv6 || metadata) ++ if (ipv6) { + ret = geneve_sock_add(geneve, true); ++ if (ret < 0 && ret != -EAFNOSUPPORT) ++ ipv4 = false; ++ } + #endif +- if (!ret && (!ipv6 || metadata)) ++ if (ipv4) + ret = geneve_sock_add(geneve, false); + if (ret < 0) + geneve_sock_release(geneve); +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index c9e2a986ccb72..c8320405c8f1d 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -743,6 +743,14 @@ void netvsc_linkstatus_callback(struct net_device *net, + schedule_delayed_work(&ndev_ctx->dwork, 0); + } + ++static void netvsc_comp_ipcsum(struct sk_buff *skb) ++{ ++ struct iphdr *iph = (struct iphdr *)skb->data; ++ ++ iph->check = 0; ++ iph->check = ip_fast_csum(iph, iph->ihl); ++} ++ + static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net, + struct napi_struct *napi, + const struct ndis_tcp_ip_checksum_info *csum_info, +@@ -766,9 +774,17 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net, + /* skb is already created with CHECKSUM_NONE */ + skb_checksum_none_assert(skb); + +- /* +- * In Linux, the IP checksum is always checked. +- * Do L4 checksum offload if enabled and present. ++ /* Incoming packets may have IP header checksum verified by the host. ++ * They may not have IP header checksum computed after coalescing. ++ * We compute it here if the flags are set, because on Linux, the IP ++ * checksum is always checked. ++ */ ++ if (csum_info && csum_info->receive.ip_checksum_value_invalid && ++ csum_info->receive.ip_checksum_succeeded && ++ skb->protocol == htons(ETH_P_IP)) ++ netvsc_comp_ipcsum(skb); ++ ++ /* Do L4 checksum offload if enabled and present. + */ + if (csum_info && (net->features & NETIF_F_RXCSUM)) { + if (csum_info->receive.tcp_checksum_succeeded || +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 3db06b40580d3..05a6ae32ff652 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -339,6 +339,17 @@ static int ksz8041_config_aneg(struct phy_device *phydev) + return genphy_config_aneg(phydev); + } + ++static int ksz8061_config_init(struct phy_device *phydev) ++{ ++ int ret; ++ ++ ret = phy_write_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_DEVID1, 0xB61A); ++ if (ret) ++ return ret; ++ ++ return kszphy_config_init(phydev); ++} ++ + static int ksz9021_load_values_from_of(struct phy_device *phydev, + const struct device_node *of_node, + u16 reg, +@@ -934,7 +945,7 @@ static struct phy_driver ksphy_driver[] = { + .phy_id_mask = MICREL_PHY_ID_MASK, + .features = PHY_BASIC_FEATURES, + .flags = PHY_HAS_INTERRUPT, +- .config_init = kszphy_config_init, ++ .config_init = ksz8061_config_init, + .ack_interrupt = kszphy_ack_interrupt, + .config_intr = kszphy_config_intr, + .suspend = genphy_suspend, +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 2787e8b1d668a..f6e70f2dfd12b 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -348,6 +348,10 @@ static int phylink_get_mac_state(struct phylink *pl, struct phylink_link_state * + linkmode_zero(state->lp_advertising); + state->interface = pl->link_config.interface; + state->an_enabled = pl->link_config.an_enabled; ++ state->speed = SPEED_UNKNOWN; ++ state->duplex = DUPLEX_UNKNOWN; ++ state->pause = MLO_PAUSE_NONE; ++ state->an_complete = 0; + state->link = 1; + + return pl->ops->mac_link_state(ndev, state); +diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c +index a5ef97010eb34..5541e1c19936c 100644 +--- a/drivers/net/team/team_mode_loadbalance.c ++++ b/drivers/net/team/team_mode_loadbalance.c +@@ -325,6 +325,20 @@ static int lb_bpf_func_set(struct team *team, struct team_gsetter_ctx *ctx) + return 0; + } + ++static void lb_bpf_func_free(struct team *team) ++{ ++ struct lb_priv *lb_priv = get_lb_priv(team); ++ struct bpf_prog *fp; ++ ++ if (!lb_priv->ex->orig_fprog) ++ return; ++ ++ __fprog_destroy(lb_priv->ex->orig_fprog); ++ fp = rcu_dereference_protected(lb_priv->fp, ++ lockdep_is_held(&team->lock)); ++ bpf_prog_destroy(fp); ++} ++ + static int lb_tx_method_get(struct team *team, struct team_gsetter_ctx *ctx) + { + struct lb_priv *lb_priv = get_lb_priv(team); +@@ -639,6 +653,7 @@ static void lb_exit(struct team *team) + + team_options_unregister(team, lb_options, + ARRAY_SIZE(lb_options)); ++ lb_bpf_func_free(team); + cancel_delayed_work_sync(&lb_priv->ex->stats.refresh_dw); + free_percpu(lb_priv->pcpu_stats); + kfree(lb_priv->ex); +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 65844f28db30e..f3293355c7849 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -2122,9 +2122,9 @@ static void *tun_ring_recv(struct tun_file *tfile, int noblock, int *err) + } + + add_wait_queue(&tfile->wq.wait, &wait); +- current->state = TASK_INTERRUPTIBLE; + + while (1) { ++ set_current_state(TASK_INTERRUPTIBLE); + ptr = ptr_ring_consume(&tfile->tx_ring); + if (ptr) + break; +@@ -2140,7 +2140,7 @@ static void *tun_ring_recv(struct tun_file *tfile, int noblock, int *err) + schedule(); + } + +- current->state = TASK_RUNNING; ++ __set_current_state(TASK_RUNNING); + remove_wait_queue(&tfile->wq.wait, &wait); + + out: +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 735ad838e2ba8..6e381354f658e 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -976,6 +976,13 @@ static const struct usb_device_id products[] = { + 0xff), + .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr, + }, ++ { /* Quectel EG12/EM12 */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x0512, ++ USB_CLASS_VENDOR_SPEC, ++ USB_SUBCLASS_VENDOR_SPEC, ++ 0xff), ++ .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr, ++ }, + + /* 3. Combined interface devices matching on interface number */ + {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */ +@@ -1343,17 +1350,20 @@ static bool quectel_ec20_detected(struct usb_interface *intf) + return false; + } + +-static bool quectel_ep06_diag_detected(struct usb_interface *intf) ++static bool quectel_diag_detected(struct usb_interface *intf) + { + struct usb_device *dev = interface_to_usbdev(intf); + struct usb_interface_descriptor intf_desc = intf->cur_altsetting->desc; ++ u16 id_vendor = le16_to_cpu(dev->descriptor.idVendor); ++ u16 id_product = le16_to_cpu(dev->descriptor.idProduct); + +- if (le16_to_cpu(dev->descriptor.idVendor) == 0x2c7c && +- le16_to_cpu(dev->descriptor.idProduct) == 0x0306 && +- intf_desc.bNumEndpoints == 2) +- return true; ++ if (id_vendor != 0x2c7c || intf_desc.bNumEndpoints != 2) ++ return false; + +- return false; ++ if (id_product == 0x0306 || id_product == 0x0512) ++ return true; ++ else ++ return false; + } + + static int qmi_wwan_probe(struct usb_interface *intf, +@@ -1390,13 +1400,13 @@ static int qmi_wwan_probe(struct usb_interface *intf, + return -ENODEV; + } + +- /* Quectel EP06/EM06/EG06 supports dynamic interface configuration, so ++ /* Several Quectel modems supports dynamic interface configuration, so + * we need to match on class/subclass/protocol. These values are + * identical for the diagnostic- and QMI-interface, but bNumEndpoints is + * different. Ignore the current interface if the number of endpoints + * the number for the diag interface (two). + */ +- if (quectel_ep06_diag_detected(intf)) ++ if (quectel_diag_detected(intf)) + return -ENODEV; + + return usbnet_probe(intf, id); +diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c +index 0ccb021f1e786..10d580c3dea3f 100644 +--- a/drivers/net/xen-netback/hash.c ++++ b/drivers/net/xen-netback/hash.c +@@ -454,6 +454,8 @@ void xenvif_init_hash(struct xenvif *vif) + if (xenvif_hash_cache_size == 0) + return; + ++ BUG_ON(vif->hash.cache.count); ++ + spin_lock_init(&vif->hash.cache.lock); + INIT_LIST_HEAD(&vif->hash.cache.list); + } +diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c +index f6ae23fc3f6b0..82add0ac4a5f6 100644 +--- a/drivers/net/xen-netback/interface.c ++++ b/drivers/net/xen-netback/interface.c +@@ -153,6 +153,13 @@ static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb, + { + struct xenvif *vif = netdev_priv(dev); + unsigned int size = vif->hash.size; ++ unsigned int num_queues; ++ ++ /* If queues are not set up internally - always return 0 ++ * as the packet going to be dropped anyway */ ++ num_queues = READ_ONCE(vif->num_queues); ++ if (num_queues < 1) ++ return 0; + + if (vif->hash.alg == XEN_NETIF_CTRL_HASH_ALGORITHM_NONE) + return fallback(dev, skb, NULL) % dev->real_num_tx_queues; +diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c +index 3621e05a7494c..d5081ffdc8f03 100644 +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -1072,11 +1072,6 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s + skb_frag_size_set(&frags[i], len); + } + +- /* Copied all the bits from the frag list -- free it. */ +- skb_frag_list_init(skb); +- xenvif_skb_zerocopy_prepare(queue, nskb); +- kfree_skb(nskb); +- + /* Release all the original (foreign) frags. */ + for (f = 0; f < skb_shinfo(skb)->nr_frags; f++) + skb_frag_unref(skb, f); +@@ -1145,6 +1140,8 @@ static int xenvif_tx_submit(struct xenvif_queue *queue) + xenvif_fill_frags(queue, skb); + + if (unlikely(skb_has_frag_list(skb))) { ++ struct sk_buff *nskb = skb_shinfo(skb)->frag_list; ++ xenvif_skb_zerocopy_prepare(queue, nskb); + if (xenvif_handle_frag_list(queue, skb)) { + if (net_ratelimit()) + netdev_err(queue->vif->dev, +@@ -1153,6 +1150,9 @@ static int xenvif_tx_submit(struct xenvif_queue *queue) + kfree_skb(skb); + continue; + } ++ /* Copied all the bits from the frag list -- free it. */ ++ skb_frag_list_init(skb); ++ kfree_skb(nskb); + } + + skb->dev = queue->vif->dev; +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index b5f638286037a..18e4289baf993 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -757,6 +757,7 @@ static blk_status_t scsi_result_to_blk_status(struct scsi_cmnd *cmd, int result) + set_host_byte(cmd, DID_OK); + return BLK_STS_TARGET; + case DID_NEXUS_FAILURE: ++ set_host_byte(cmd, DID_OK); + return BLK_STS_NEXUS; + case DID_ALLOC_FAILURE: + set_host_byte(cmd, DID_OK); +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index a880b5c6c6c32..be815330ed958 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -75,6 +75,9 @@ struct ashmem_range { + /* LRU list of unpinned pages, protected by ashmem_mutex */ + static LIST_HEAD(ashmem_lru_list); + ++static atomic_t ashmem_shrink_inflight = ATOMIC_INIT(0); ++static DECLARE_WAIT_QUEUE_HEAD(ashmem_shrink_wait); ++ + /* + * long lru_count - The count of pages on our LRU list. + * +@@ -168,19 +171,15 @@ static inline void lru_del(struct ashmem_range *range) + * @end: The ending page (inclusive) + * + * This function is protected by ashmem_mutex. +- * +- * Return: 0 if successful, or -ENOMEM if there is an error + */ +-static int range_alloc(struct ashmem_area *asma, +- struct ashmem_range *prev_range, unsigned int purged, +- size_t start, size_t end) ++static void range_alloc(struct ashmem_area *asma, ++ struct ashmem_range *prev_range, unsigned int purged, ++ size_t start, size_t end, ++ struct ashmem_range **new_range) + { +- struct ashmem_range *range; +- +- range = kmem_cache_zalloc(ashmem_range_cachep, GFP_KERNEL); +- if (!range) +- return -ENOMEM; ++ struct ashmem_range *range = *new_range; + ++ *new_range = NULL; + range->asma = asma; + range->pgstart = start; + range->pgend = end; +@@ -190,8 +189,6 @@ static int range_alloc(struct ashmem_area *asma, + + if (range_on_lru(range)) + lru_add(range); +- +- return 0; + } + + /** +@@ -438,7 +435,6 @@ out: + static unsigned long + ashmem_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + { +- struct ashmem_range *range, *next; + unsigned long freed = 0; + + /* We might recurse into filesystem code, so bail out if necessary */ +@@ -448,21 +444,33 @@ ashmem_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + if (!mutex_trylock(&ashmem_mutex)) + return -1; + +- list_for_each_entry_safe(range, next, &ashmem_lru_list, lru) { ++ while (!list_empty(&ashmem_lru_list)) { ++ struct ashmem_range *range = ++ list_first_entry(&ashmem_lru_list, typeof(*range), lru); + loff_t start = range->pgstart * PAGE_SIZE; + loff_t end = (range->pgend + 1) * PAGE_SIZE; ++ struct file *f = range->asma->file; + +- range->asma->file->f_op->fallocate(range->asma->file, +- FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, +- start, end - start); ++ get_file(f); ++ atomic_inc(&ashmem_shrink_inflight); + range->purged = ASHMEM_WAS_PURGED; + lru_del(range); + + freed += range_size(range); ++ mutex_unlock(&ashmem_mutex); ++ f->f_op->fallocate(f, ++ FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, ++ start, end - start); ++ fput(f); ++ if (atomic_dec_and_test(&ashmem_shrink_inflight)) ++ wake_up_all(&ashmem_shrink_wait); ++ if (!mutex_trylock(&ashmem_mutex)) ++ goto out; + if (--sc->nr_to_scan <= 0) + break; + } + mutex_unlock(&ashmem_mutex); ++out: + return freed; + } + +@@ -582,7 +590,8 @@ static int get_name(struct ashmem_area *asma, void __user *name) + * + * Caller must hold ashmem_mutex. + */ +-static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend) ++static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend, ++ struct ashmem_range **new_range) + { + struct ashmem_range *range, *next; + int ret = ASHMEM_NOT_PURGED; +@@ -635,7 +644,7 @@ static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend) + * second half and adjust the first chunk's endpoint. + */ + range_alloc(asma, range, range->purged, +- pgend + 1, range->pgend); ++ pgend + 1, range->pgend, new_range); + range_shrink(range, range->pgstart, pgstart - 1); + break; + } +@@ -649,7 +658,8 @@ static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend) + * + * Caller must hold ashmem_mutex. + */ +-static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend) ++static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend, ++ struct ashmem_range **new_range) + { + struct ashmem_range *range, *next; + unsigned int purged = ASHMEM_NOT_PURGED; +@@ -675,7 +685,8 @@ restart: + } + } + +- return range_alloc(asma, range, purged, pgstart, pgend); ++ range_alloc(asma, range, purged, pgstart, pgend, new_range); ++ return 0; + } + + /* +@@ -708,11 +719,19 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, + struct ashmem_pin pin; + size_t pgstart, pgend; + int ret = -EINVAL; ++ struct ashmem_range *range = NULL; + + if (copy_from_user(&pin, p, sizeof(pin))) + return -EFAULT; + ++ if (cmd == ASHMEM_PIN || cmd == ASHMEM_UNPIN) { ++ range = kmem_cache_zalloc(ashmem_range_cachep, GFP_KERNEL); ++ if (!range) ++ return -ENOMEM; ++ } ++ + mutex_lock(&ashmem_mutex); ++ wait_event(ashmem_shrink_wait, !atomic_read(&ashmem_shrink_inflight)); + + if (!asma->file) + goto out_unlock; +@@ -735,10 +754,10 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, + + switch (cmd) { + case ASHMEM_PIN: +- ret = ashmem_pin(asma, pgstart, pgend); ++ ret = ashmem_pin(asma, pgstart, pgend, &range); + break; + case ASHMEM_UNPIN: +- ret = ashmem_unpin(asma, pgstart, pgend); ++ ret = ashmem_unpin(asma, pgstart, pgend, &range); + break; + case ASHMEM_GET_PIN_STATUS: + ret = ashmem_get_pin_status(asma, pgstart, pgend); +@@ -747,6 +766,8 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, + + out_unlock: + mutex_unlock(&ashmem_mutex); ++ if (range) ++ kmem_cache_free(ashmem_range_cachep, range); + + return ret; + } +diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c +index 701eb9f3b0f13..0a1b1ff1be042 100644 +--- a/drivers/staging/android/ion/ion_system_heap.c ++++ b/drivers/staging/android/ion/ion_system_heap.c +@@ -247,10 +247,10 @@ static void ion_system_heap_destroy_pools(struct ion_page_pool **pools) + static int ion_system_heap_create_pools(struct ion_page_pool **pools) + { + int i; +- gfp_t gfp_flags = low_order_gfp_flags; + + for (i = 0; i < NUM_ORDERS; i++) { + struct ion_page_pool *pool; ++ gfp_t gfp_flags = low_order_gfp_flags; + + if (orders[i] > 4) + gfp_flags = high_order_gfp_flags; +diff --git a/drivers/staging/comedi/drivers/ni_660x.c b/drivers/staging/comedi/drivers/ni_660x.c +index e521ed9d08870..35bd4d2efe166 100644 +--- a/drivers/staging/comedi/drivers/ni_660x.c ++++ b/drivers/staging/comedi/drivers/ni_660x.c +@@ -602,6 +602,7 @@ static int ni_660x_set_pfi_routing(struct comedi_device *dev, + case NI_660X_PFI_OUTPUT_DIO: + if (chan > 31) + return -EINVAL; ++ break; + default: + return -EINVAL; + } +diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c +index 1279241449f4b..f44662dd795c4 100644 +--- a/drivers/staging/erofs/unzip_vle.c ++++ b/drivers/staging/erofs/unzip_vle.c +@@ -57,15 +57,30 @@ enum z_erofs_vle_work_role { + Z_EROFS_VLE_WORK_SECONDARY, + Z_EROFS_VLE_WORK_PRIMARY, + /* +- * The current work has at least been linked with the following +- * processed chained works, which means if the processing page +- * is the tail partial page of the work, the current work can +- * safely use the whole page, as illustrated below: +- * +--------------+-------------------------------------------+ +- * | tail page | head page (of the previous work) | +- * +--------------+-------------------------------------------+ +- * /\ which belongs to the current work +- * [ (*) this page can be used for the current work itself. ] ++ * The current work was the tail of an exist chain, and the previous ++ * processed chained works are all decided to be hooked up to it. ++ * A new chain should be created for the remaining unprocessed works, ++ * therefore different from Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED, ++ * the next work cannot reuse the whole page in the following scenario: ++ * ________________________________________________________________ ++ * | tail (partial) page | head (partial) page | ++ * | (belongs to the next work) | (belongs to the current work) | ++ * |_______PRIMARY_FOLLOWED_______|________PRIMARY_HOOKED___________| ++ */ ++ Z_EROFS_VLE_WORK_PRIMARY_HOOKED, ++ /* ++ * The current work has been linked with the processed chained works, ++ * and could be also linked with the potential remaining works, which ++ * means if the processing page is the tail partial page of the work, ++ * the current work can safely use the whole page (since the next work ++ * is under control) for in-place decompression, as illustrated below: ++ * ________________________________________________________________ ++ * | tail (partial) page | head (partial) page | ++ * | (of the current work) | (of the previous work) | ++ * | PRIMARY_FOLLOWED or | | ++ * |_____PRIMARY_HOOKED____|____________PRIMARY_FOLLOWED____________| ++ * ++ * [ (*) the above page can be used for the current work itself. ] + */ + Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED, + Z_EROFS_VLE_WORK_MAX +@@ -234,10 +249,10 @@ static int z_erofs_vle_work_add_page( + return ret ? 0 : -EAGAIN; + } + +-static inline bool try_to_claim_workgroup( +- struct z_erofs_vle_workgroup *grp, +- z_erofs_vle_owned_workgrp_t *owned_head, +- bool *hosted) ++static enum z_erofs_vle_work_role ++try_to_claim_workgroup(struct z_erofs_vle_workgroup *grp, ++ z_erofs_vle_owned_workgrp_t *owned_head, ++ bool *hosted) + { + DBG_BUGON(*hosted == true); + +@@ -251,6 +266,9 @@ retry: + + *owned_head = grp; + *hosted = true; ++ /* lucky, I am the followee :) */ ++ return Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED; ++ + } else if (grp->next == Z_EROFS_VLE_WORKGRP_TAIL) { + /* + * type 2, link to the end of a existing open chain, +@@ -260,12 +278,11 @@ retry: + if (Z_EROFS_VLE_WORKGRP_TAIL != cmpxchg(&grp->next, + Z_EROFS_VLE_WORKGRP_TAIL, *owned_head)) + goto retry; +- + *owned_head = Z_EROFS_VLE_WORKGRP_TAIL; +- } else +- return false; /* :( better luck next time */ ++ return Z_EROFS_VLE_WORK_PRIMARY_HOOKED; ++ } + +- return true; /* lucky, I am the followee :) */ ++ return Z_EROFS_VLE_WORK_PRIMARY; /* :( better luck next time */ + } + + static struct z_erofs_vle_work * +@@ -337,12 +354,8 @@ z_erofs_vle_work_lookup(struct super_block *sb, + *hosted = false; + if (!primary) + *role = Z_EROFS_VLE_WORK_SECONDARY; +- /* claim the workgroup if possible */ +- else if (try_to_claim_workgroup(grp, owned_head, hosted)) +- *role = Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED; +- else +- *role = Z_EROFS_VLE_WORK_PRIMARY; +- ++ else /* claim the workgroup if possible */ ++ *role = try_to_claim_workgroup(grp, owned_head, hosted); + return work; + } + +@@ -419,6 +432,9 @@ static inline void __update_workgrp_llen(struct z_erofs_vle_workgroup *grp, + } + } + ++#define builder_is_hooked(builder) \ ++ ((builder)->role >= Z_EROFS_VLE_WORK_PRIMARY_HOOKED) ++ + #define builder_is_followed(builder) \ + ((builder)->role >= Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED) + +@@ -583,7 +599,7 @@ static int z_erofs_do_read_page(struct z_erofs_vle_frontend *fe, + struct z_erofs_vle_work_builder *const builder = &fe->builder; + const loff_t offset = page_offset(page); + +- bool tight = builder_is_followed(builder); ++ bool tight = builder_is_hooked(builder); + struct z_erofs_vle_work *work = builder->work; + + #ifdef EROFS_FS_HAS_MANAGED_CACHE +@@ -606,8 +622,12 @@ repeat: + + /* lucky, within the range of the current map_blocks */ + if (offset + cur >= map->m_la && +- offset + cur < map->m_la + map->m_llen) ++ offset + cur < map->m_la + map->m_llen) { ++ /* didn't get a valid unzip work previously (very rare) */ ++ if (!builder->work) ++ goto restart_now; + goto hitted; ++ } + + /* go ahead the next map_blocks */ + debugln("%s: [out-of-range] pos %llu", __func__, offset + cur); +@@ -621,6 +641,7 @@ repeat: + if (unlikely(err)) + goto err_out; + ++restart_now: + if (unlikely(!(map->m_flags & EROFS_MAP_MAPPED))) + goto hitted; + +@@ -646,7 +667,7 @@ repeat: + builder->role = Z_EROFS_VLE_WORK_PRIMARY; + #endif + +- tight &= builder_is_followed(builder); ++ tight &= builder_is_hooked(builder); + work = builder->work; + hitted: + cur = end - min_t(unsigned, offset + end - map->m_la, end); +@@ -661,6 +682,9 @@ hitted: + (tight ? Z_EROFS_PAGE_TYPE_EXCLUSIVE : + Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED)); + ++ if (cur) ++ tight &= builder_is_followed(builder); ++ + retry: + err = z_erofs_vle_work_add_page(builder, page, page_type); + /* should allocate an additional staging page for pagevec */ +@@ -901,11 +925,10 @@ repeat: + if (llen > grp->llen) + llen = grp->llen; + +- err = z_erofs_vle_unzip_fast_percpu(compressed_pages, +- clusterpages, pages, llen, work->pageofs, +- z_erofs_onlinepage_endio); ++ err = z_erofs_vle_unzip_fast_percpu(compressed_pages, clusterpages, ++ pages, llen, work->pageofs); + if (err != -ENOTSUPP) +- goto out_percpu; ++ goto out; + + if (sparsemem_pages >= nr_pages) + goto skip_allocpage; +@@ -926,8 +949,25 @@ skip_allocpage: + erofs_vunmap(vout, nr_pages); + + out: ++ /* must handle all compressed pages before endding pages */ ++ for (i = 0; i < clusterpages; ++i) { ++ page = compressed_pages[i]; ++ ++#ifdef EROFS_FS_HAS_MANAGED_CACHE ++ if (page->mapping == mngda) ++ continue; ++#endif ++ /* recycle all individual staging pages */ ++ (void)z_erofs_gather_if_stagingpage(page_pool, page); ++ ++ WRITE_ONCE(compressed_pages[i], NULL); ++ } ++ + for (i = 0; i < nr_pages; ++i) { + page = pages[i]; ++ if (!page) ++ continue; ++ + DBG_BUGON(page->mapping == NULL); + + /* recycle all individual staging pages */ +@@ -940,20 +980,6 @@ out: + z_erofs_onlinepage_endio(page); + } + +-out_percpu: +- for (i = 0; i < clusterpages; ++i) { +- page = compressed_pages[i]; +- +-#ifdef EROFS_FS_HAS_MANAGED_CACHE +- if (page->mapping == mngda) +- continue; +-#endif +- /* recycle all individual staging pages */ +- (void)z_erofs_gather_if_stagingpage(page_pool, page); +- +- WRITE_ONCE(compressed_pages[i], NULL); +- } +- + if (pages == z_pagemap_global) + mutex_unlock(&z_pagemap_global_lock); + else if (unlikely(pages != pages_onstack)) +diff --git a/drivers/staging/erofs/unzip_vle.h b/drivers/staging/erofs/unzip_vle.h +index 3316bc36965d4..684ff06fc7bf8 100644 +--- a/drivers/staging/erofs/unzip_vle.h ++++ b/drivers/staging/erofs/unzip_vle.h +@@ -218,8 +218,7 @@ extern int z_erofs_vle_plain_copy(struct page **compressed_pages, + + extern int z_erofs_vle_unzip_fast_percpu(struct page **compressed_pages, + unsigned clusterpages, struct page **pages, +- unsigned outlen, unsigned short pageofs, +- void (*endio)(struct page *)); ++ unsigned int outlen, unsigned short pageofs); + + extern int z_erofs_vle_unzip_vmap(struct page **compressed_pages, + unsigned clusterpages, void *vaddr, unsigned llen, +diff --git a/drivers/staging/erofs/unzip_vle_lz4.c b/drivers/staging/erofs/unzip_vle_lz4.c +index 9cb35cd33365a..055420e8af2cf 100644 +--- a/drivers/staging/erofs/unzip_vle_lz4.c ++++ b/drivers/staging/erofs/unzip_vle_lz4.c +@@ -105,8 +105,7 @@ int z_erofs_vle_unzip_fast_percpu(struct page **compressed_pages, + unsigned clusterpages, + struct page **pages, + unsigned outlen, +- unsigned short pageofs, +- void (*endio)(struct page *)) ++ unsigned short pageofs) + { + void *vin, *vout; + unsigned nr_pages, i, j; +@@ -128,31 +127,30 @@ int z_erofs_vle_unzip_fast_percpu(struct page **compressed_pages, + ret = z_erofs_unzip_lz4(vin, vout + pageofs, + clusterpages * PAGE_SIZE, outlen); + +- if (ret >= 0) { +- outlen = ret; +- ret = 0; +- } ++ if (ret < 0) ++ goto out; ++ ret = 0; + + for (i = 0; i < nr_pages; ++i) { + j = min((unsigned)PAGE_SIZE - pageofs, outlen); + + if (pages[i] != NULL) { +- if (ret < 0) +- SetPageError(pages[i]); +- else if (clusterpages == 1 && pages[i] == compressed_pages[0]) ++ if (clusterpages == 1 && ++ pages[i] == compressed_pages[0]) { + memcpy(vin + pageofs, vout + pageofs, j); +- else { ++ } else { + void *dst = kmap_atomic(pages[i]); + + memcpy(dst + pageofs, vout + pageofs, j); + kunmap_atomic(dst); + } +- endio(pages[i]); + } + vout += PAGE_SIZE; + outlen -= j; + pageofs = 0; + } ++ ++out: + preempt_enable(); + + if (clusterpages == 1) +diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c +index 3b8d237decbf1..649caae2b6033 100644 +--- a/drivers/staging/wilc1000/linux_wlan.c ++++ b/drivers/staging/wilc1000/linux_wlan.c +@@ -1090,8 +1090,8 @@ int wilc_netdev_init(struct wilc **wilc, struct device *dev, int io_type, + vif->wilc = *wilc; + vif->ndev = ndev; + wl->vif[i] = vif; +- wl->vif_num = i; +- vif->idx = wl->vif_num; ++ wl->vif_num = i + 1; ++ vif->idx = i; + + ndev->netdev_ops = &wilc_netdev_ops; + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 09bf6b4b741b8..1493d0fdf5ad1 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -187,6 +187,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_SSIC_PORT_UNUSED; + if (pdev->vendor == PCI_VENDOR_ID_INTEL && + (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) + xhci->quirks |= XHCI_INTEL_USB_ROLE_SW; + if (pdev->vendor == PCI_VENDOR_ID_INTEL && +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index c0777a374a88f..4c66edf533fe9 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -61,6 +61,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ + { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ + { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ ++ { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */ + { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ + { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ + { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ +@@ -1353,8 +1354,13 @@ static int cp210x_gpio_get(struct gpio_chip *gc, unsigned int gpio) + if (priv->partnum == CP210X_PARTNUM_CP2105) + req_type = REQTYPE_INTERFACE_TO_HOST; + ++ result = usb_autopm_get_interface(serial->interface); ++ if (result) ++ return result; ++ + result = cp210x_read_vendor_block(serial, req_type, + CP210X_READ_LATCH, &buf, sizeof(buf)); ++ usb_autopm_put_interface(serial->interface); + if (result < 0) + return result; + +@@ -1375,6 +1381,10 @@ static void cp210x_gpio_set(struct gpio_chip *gc, unsigned int gpio, int value) + + buf.mask = BIT(gpio); + ++ result = usb_autopm_get_interface(serial->interface); ++ if (result) ++ goto out; ++ + if (priv->partnum == CP210X_PARTNUM_CP2105) { + result = cp210x_write_vendor_block(serial, + REQTYPE_HOST_TO_INTERFACE, +@@ -1392,6 +1402,8 @@ static void cp210x_gpio_set(struct gpio_chip *gc, unsigned int gpio, int value) + NULL, 0, USB_CTRL_SET_TIMEOUT); + } + ++ usb_autopm_put_interface(serial->interface); ++out: + if (result < 0) { + dev_err(&serial->interface->dev, "failed to set GPIO value: %d\n", + result); +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index b5cef322826f1..1d8077e880a01 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1015,6 +1015,8 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, + { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, + { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) }, ++ /* EZPrototypes devices */ ++ { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 975d02666c5a0..b863bedb55a13 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1308,6 +1308,12 @@ + #define IONICS_VID 0x1c0c + #define IONICS_PLUGCOMPUTER_PID 0x0102 + ++/* ++ * EZPrototypes (PID reseller) ++ */ ++#define EZPROTOTYPES_VID 0x1c40 ++#define HJELMSLUND_USB485_ISO_PID 0x0477 ++ + /* + * Dresden Elektronik Sensor Terminal Board + */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index fb544340888b0..faf833e8f5573 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1148,6 +1148,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), + .driver_info = NCTRL(0) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */ ++ .driver_info = NCTRL(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), +diff --git a/fs/aio.c b/fs/aio.c +index 44551d96eaa4b..45d5ef8dd0a87 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -1661,6 +1661,7 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, + struct poll_iocb *req = container_of(wait, struct poll_iocb, wait); + struct aio_kiocb *iocb = container_of(req, struct aio_kiocb, poll); + __poll_t mask = key_to_poll(key); ++ unsigned long flags; + + req->woken = true; + +@@ -1669,10 +1670,15 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, + if (!(mask & req->events)) + return 0; + +- /* try to complete the iocb inline if we can: */ +- if (spin_trylock(&iocb->ki_ctx->ctx_lock)) { ++ /* ++ * Try to complete the iocb inline if we can. Use ++ * irqsave/irqrestore because not all filesystems (e.g. fuse) ++ * call this function with IRQs disabled and because IRQs ++ * have to be disabled before ctx_lock is obtained. ++ */ ++ if (spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) { + list_del(&iocb->ki_list); +- spin_unlock(&iocb->ki_ctx->ctx_lock); ++ spin_unlock_irqrestore(&iocb->ki_ctx->ctx_lock, flags); + + list_del_init(&req->wait.entry); + aio_poll_complete(iocb, mask); +diff --git a/fs/exec.c b/fs/exec.c +index 1ebf6e5a521d9..433b1257694ab 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -929,7 +929,7 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size, + bytes = kernel_read(file, *buf + pos, i_size - pos, &pos); + if (bytes < 0) { + ret = bytes; +- goto out; ++ goto out_free; + } + + if (bytes == 0) +diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h +index 882a9b9e34bc2..72f59e8321e79 100644 +--- a/include/linux/cpufreq.h ++++ b/include/linux/cpufreq.h +@@ -254,20 +254,12 @@ __ATTR(_name, 0644, show_##_name, store_##_name) + static struct freq_attr _name = \ + __ATTR(_name, 0200, NULL, store_##_name) + +-struct global_attr { +- struct attribute attr; +- ssize_t (*show)(struct kobject *kobj, +- struct attribute *attr, char *buf); +- ssize_t (*store)(struct kobject *a, struct attribute *b, +- const char *c, size_t count); +-}; +- + #define define_one_global_ro(_name) \ +-static struct global_attr _name = \ ++static struct kobj_attribute _name = \ + __ATTR(_name, 0444, show_##_name, NULL) + + #define define_one_global_rw(_name) \ +-static struct global_attr _name = \ ++static struct kobj_attribute _name = \ + __ATTR(_name, 0644, show_##_name, store_##_name) + + +diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h +index ec9d6bc658559..fabee6db0abb7 100644 +--- a/include/net/bluetooth/bluetooth.h ++++ b/include/net/bluetooth/bluetooth.h +@@ -276,7 +276,7 @@ int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg); + int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo); + int bt_sock_wait_ready(struct sock *sk, unsigned long flags); + +-void bt_accept_enqueue(struct sock *parent, struct sock *sk); ++void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh); + void bt_accept_unlink(struct sock *sk); + struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock); + +diff --git a/include/net/icmp.h b/include/net/icmp.h +index 3ef2743a8eecc..8665bf24e3b7a 100644 +--- a/include/net/icmp.h ++++ b/include/net/icmp.h +@@ -22,6 +22,7 @@ + + #include + #include ++#include + + struct icmp_err { + int errno; +@@ -39,7 +40,13 @@ struct net_proto_family; + struct sk_buff; + struct net; + +-void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info); ++void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, ++ const struct ip_options *opt); ++static inline void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) ++{ ++ __icmp_send(skb_in, type, code, info, &IPCB(skb_in)->opt); ++} ++ + int icmp_rcv(struct sk_buff *skb); + void icmp_err(struct sk_buff *skb, u32 info); + int icmp_init(void); +diff --git a/include/net/ip.h b/include/net/ip.h +index e44b1a44f67ad..71d31e4d4391f 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -638,6 +638,8 @@ static inline int ip_options_echo(struct net *net, struct ip_options *dopt, + } + + void ip_options_fragment(struct sk_buff *skb); ++int __ip_options_compile(struct net *net, struct ip_options *opt, ++ struct sk_buff *skb, __be32 *info); + int ip_options_compile(struct net *net, struct ip_options *opt, + struct sk_buff *skb); + int ip_options_get(struct net *net, struct ip_options_rcu **optp, +@@ -687,7 +689,7 @@ extern int sysctl_icmp_msgs_burst; + int ip_misc_proc_init(void); + #endif + +-int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto, ++int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto, u8 family, + struct netlink_ext_ack *extack); + + #endif /* _IP_H */ +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index a6d00093f35e7..c44da48de7dfd 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -47,7 +47,10 @@ struct qdisc_size_table { + struct qdisc_skb_head { + struct sk_buff *head; + struct sk_buff *tail; +- __u32 qlen; ++ union { ++ u32 qlen; ++ atomic_t atomic_qlen; ++ }; + spinlock_t lock; + }; + +@@ -384,27 +387,19 @@ static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz) + BUILD_BUG_ON(sizeof(qcb->data) < sz); + } + +-static inline int qdisc_qlen_cpu(const struct Qdisc *q) +-{ +- return this_cpu_ptr(q->cpu_qstats)->qlen; +-} +- + static inline int qdisc_qlen(const struct Qdisc *q) + { + return q->q.qlen; + } + +-static inline int qdisc_qlen_sum(const struct Qdisc *q) ++static inline u32 qdisc_qlen_sum(const struct Qdisc *q) + { +- __u32 qlen = q->qstats.qlen; +- int i; ++ u32 qlen = q->qstats.qlen; + +- if (q->flags & TCQ_F_NOLOCK) { +- for_each_possible_cpu(i) +- qlen += per_cpu_ptr(q->cpu_qstats, i)->qlen; +- } else { ++ if (q->flags & TCQ_F_NOLOCK) ++ qlen += atomic_read(&q->q.atomic_qlen); ++ else + qlen += q->q.qlen; +- } + + return qlen; + } +@@ -776,14 +771,14 @@ static inline void qdisc_qstats_cpu_backlog_inc(struct Qdisc *sch, + this_cpu_add(sch->cpu_qstats->backlog, qdisc_pkt_len(skb)); + } + +-static inline void qdisc_qstats_cpu_qlen_inc(struct Qdisc *sch) ++static inline void qdisc_qstats_atomic_qlen_inc(struct Qdisc *sch) + { +- this_cpu_inc(sch->cpu_qstats->qlen); ++ atomic_inc(&sch->q.atomic_qlen); + } + +-static inline void qdisc_qstats_cpu_qlen_dec(struct Qdisc *sch) ++static inline void qdisc_qstats_atomic_qlen_dec(struct Qdisc *sch) + { +- this_cpu_dec(sch->cpu_qstats->qlen); ++ atomic_dec(&sch->q.atomic_qlen); + } + + static inline void qdisc_qstats_cpu_requeues_inc(struct Qdisc *sch) +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 4d81be2d07390..bcb42aaf1b3ae 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6035,7 +6035,8 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) + u32 off_reg; + + aux = &env->insn_aux_data[i + delta]; +- if (!aux->alu_state) ++ if (!aux->alu_state || ++ aux->alu_state == BPF_ALU_NON_POINTER) + continue; + + isneg = aux->alu_state & BPF_ALU_NEG_VALUE; +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index 5574e862de8d5..5a1c64a26e819 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1301,7 +1301,7 @@ static int parse_pred(const char *str, void *data, + /* go past the last quote */ + i++; + +- } else if (isdigit(str[i])) { ++ } else if (isdigit(str[i]) || str[i] == '-') { + + /* Make sure the field is not a string */ + if (is_string_field(field)) { +@@ -1314,6 +1314,9 @@ static int parse_pred(const char *str, void *data, + goto err_free; + } + ++ if (str[i] == '-') ++ i++; ++ + /* We allow 0xDEADBEEF */ + while (isalnum(str[i])) + i++; +diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c +index deacc52d7ff18..8d12198eaa949 100644 +--- a/net/bluetooth/af_bluetooth.c ++++ b/net/bluetooth/af_bluetooth.c +@@ -154,15 +154,25 @@ void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk) + } + EXPORT_SYMBOL(bt_sock_unlink); + +-void bt_accept_enqueue(struct sock *parent, struct sock *sk) ++void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh) + { + BT_DBG("parent %p, sk %p", parent, sk); + + sock_hold(sk); +- lock_sock_nested(sk, SINGLE_DEPTH_NESTING); ++ ++ if (bh) ++ bh_lock_sock_nested(sk); ++ else ++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING); ++ + list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q); + bt_sk(sk)->parent = parent; +- release_sock(sk); ++ ++ if (bh) ++ bh_unlock_sock(sk); ++ else ++ release_sock(sk); ++ + parent->sk_ack_backlog++; + } + EXPORT_SYMBOL(bt_accept_enqueue); +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index 686bdc6b35b03..a3a2cd55e23a9 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1252,7 +1252,7 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) + + l2cap_sock_init(sk, parent); + +- bt_accept_enqueue(parent, sk); ++ bt_accept_enqueue(parent, sk, false); + + release_sock(parent); + +diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c +index d606e92122916..c044ff2f73e6c 100644 +--- a/net/bluetooth/rfcomm/sock.c ++++ b/net/bluetooth/rfcomm/sock.c +@@ -988,7 +988,7 @@ int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc * + rfcomm_pi(sk)->channel = channel; + + sk->sk_state = BT_CONFIG; +- bt_accept_enqueue(parent, sk); ++ bt_accept_enqueue(parent, sk, true); + + /* Accept connection and return socket DLC */ + *d = rfcomm_pi(sk)->dlc; +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 8f0f9279eac9f..a4ca55df73908 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -193,7 +193,7 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, + conn->sk = sk; + + if (parent) +- bt_accept_enqueue(parent, sk); ++ bt_accept_enqueue(parent, sk, true); + } + + static int sco_chan_add(struct sco_conn *conn, struct sock *sk, +diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c +index 188d693cb251a..e2fd8baec65f3 100644 +--- a/net/core/gen_stats.c ++++ b/net/core/gen_stats.c +@@ -256,7 +256,6 @@ __gnet_stats_copy_queue_cpu(struct gnet_stats_queue *qstats, + for_each_possible_cpu(i) { + const struct gnet_stats_queue *qcpu = per_cpu_ptr(q, i); + +- qstats->qlen = 0; + qstats->backlog += qcpu->backlog; + qstats->drops += qcpu->drops; + qstats->requeues += qcpu->requeues; +@@ -272,7 +271,6 @@ void __gnet_stats_copy_queue(struct gnet_stats_queue *qstats, + if (cpu) { + __gnet_stats_copy_queue_cpu(qstats, cpu); + } else { +- qstats->qlen = q->qlen; + qstats->backlog = q->backlog; + qstats->drops = q->drops; + qstats->requeues = q->requeues; +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index bd67c4d0fcfdf..2aabb7eb08541 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1547,6 +1547,9 @@ static int register_queue_kobjects(struct net_device *dev) + error: + netdev_queue_update_kobjects(dev, txq, 0); + net_rx_queue_update_kobjects(dev, rxq, 0); ++#ifdef CONFIG_SYSFS ++ kset_unregister(dev->queues_kset); ++#endif + return error; + } + +diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c +index 777fa3b7fb13d..f0165c5f376b3 100644 +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -667,7 +667,8 @@ static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level) + case CIPSO_V4_MAP_PASS: + return 0; + case CIPSO_V4_MAP_TRANS: +- if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL) ++ if ((level < doi_def->map.std->lvl.cipso_size) && ++ (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)) + return 0; + break; + } +@@ -1735,13 +1736,26 @@ validate_return: + */ + void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway) + { ++ unsigned char optbuf[sizeof(struct ip_options) + 40]; ++ struct ip_options *opt = (struct ip_options *)optbuf; ++ + if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES) + return; + ++ /* ++ * We might be called above the IP layer, ++ * so we can not use icmp_send and IPCB here. ++ */ ++ ++ memset(opt, 0, sizeof(struct ip_options)); ++ opt->optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr); ++ if (__ip_options_compile(dev_net(skb->dev), opt, skb, NULL)) ++ return; ++ + if (gateway) +- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0); ++ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0, opt); + else +- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0); ++ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0, opt); + } + + /** +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 958e185a8e8d1..dae743b649c1d 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -700,6 +700,10 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb, + case RTA_GATEWAY: + cfg->fc_gw = nla_get_be32(attr); + break; ++ case RTA_VIA: ++ NL_SET_ERR_MSG(extack, "IPv4 does not support RTA_VIA attribute"); ++ err = -EINVAL; ++ goto errout; + case RTA_PRIORITY: + cfg->fc_priority = nla_get_u32(attr); + break; +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 695979b7ef6d0..ad75c468ecfb2 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -570,7 +570,8 @@ relookup_failed: + * MUST reply to only the first fragment. + */ + +-void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) ++void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, ++ const struct ip_options *opt) + { + struct iphdr *iph; + int room; +@@ -691,7 +692,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) + iph->tos; + mark = IP4_REPLY_MARK(net, skb_in->mark); + +- if (ip_options_echo(net, &icmp_param.replyopts.opt.opt, skb_in)) ++ if (__ip_options_echo(net, &icmp_param.replyopts.opt.opt, skb_in, opt)) + goto out_unlock; + + +@@ -742,7 +743,7 @@ out_bh_enable: + local_bh_enable(); + out:; + } +-EXPORT_SYMBOL(icmp_send); ++EXPORT_SYMBOL(__icmp_send); + + + static void icmp_socket_deliver(struct sk_buff *skb, u32 info) +diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c +index 6f977b0fef545..bd8ef4f87c795 100644 +--- a/net/ipv4/ip_input.c ++++ b/net/ipv4/ip_input.c +@@ -308,11 +308,10 @@ drop: + } + + static int ip_rcv_finish_core(struct net *net, struct sock *sk, +- struct sk_buff *skb) ++ struct sk_buff *skb, struct net_device *dev) + { + const struct iphdr *iph = ip_hdr(skb); + int (*edemux)(struct sk_buff *skb); +- struct net_device *dev = skb->dev; + struct rtable *rt; + int err; + +@@ -401,6 +400,7 @@ drop_error: + + static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb) + { ++ struct net_device *dev = skb->dev; + int ret; + + /* if ingress device is enslaved to an L3 master device pass the +@@ -410,7 +410,7 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb) + if (!skb) + return NET_RX_SUCCESS; + +- ret = ip_rcv_finish_core(net, sk, skb); ++ ret = ip_rcv_finish_core(net, sk, skb, dev); + if (ret != NET_RX_DROP) + ret = dst_input(skb); + return ret; +@@ -550,6 +550,7 @@ static void ip_list_rcv_finish(struct net *net, struct sock *sk, + + INIT_LIST_HEAD(&sublist); + list_for_each_entry_safe(skb, next, head, list) { ++ struct net_device *dev = skb->dev; + struct dst_entry *dst; + + skb_list_del_init(skb); +@@ -559,7 +560,7 @@ static void ip_list_rcv_finish(struct net *net, struct sock *sk, + skb = l3mdev_ip_rcv(skb); + if (!skb) + continue; +- if (ip_rcv_finish_core(net, sk, skb) == NET_RX_DROP) ++ if (ip_rcv_finish_core(net, sk, skb, dev) == NET_RX_DROP) + continue; + + dst = skb_dst(skb); +diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c +index ed194d46c00e3..32a35043c9f59 100644 +--- a/net/ipv4/ip_options.c ++++ b/net/ipv4/ip_options.c +@@ -251,8 +251,9 @@ static void spec_dst_fill(__be32 *spec_dst, struct sk_buff *skb) + * If opt == NULL, then skb->data should point to IP header. + */ + +-int ip_options_compile(struct net *net, +- struct ip_options *opt, struct sk_buff *skb) ++int __ip_options_compile(struct net *net, ++ struct ip_options *opt, struct sk_buff *skb, ++ __be32 *info) + { + __be32 spec_dst = htonl(INADDR_ANY); + unsigned char *pp_ptr = NULL; +@@ -468,11 +469,22 @@ eol: + return 0; + + error: +- if (skb) { +- icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((pp_ptr-iph)<<24)); +- } ++ if (info) ++ *info = htonl((pp_ptr-iph)<<24); + return -EINVAL; + } ++ ++int ip_options_compile(struct net *net, ++ struct ip_options *opt, struct sk_buff *skb) ++{ ++ int ret; ++ __be32 info; ++ ++ ret = __ip_options_compile(net, opt, skb, &info); ++ if (ret != 0 && skb) ++ icmp_send(skb, ICMP_PARAMETERPROB, 0, info); ++ return ret; ++} + EXPORT_SYMBOL(ip_options_compile); + + /* +diff --git a/net/ipv4/netlink.c b/net/ipv4/netlink.c +index f86bb4f066095..d8e3a1fb8e826 100644 +--- a/net/ipv4/netlink.c ++++ b/net/ipv4/netlink.c +@@ -3,9 +3,10 @@ + #include + #include + #include ++#include + #include + +-int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto, ++int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto, u8 family, + struct netlink_ext_ack *extack) + { + *ip_proto = nla_get_u8(attr); +@@ -13,11 +14,19 @@ int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto, + switch (*ip_proto) { + case IPPROTO_TCP: + case IPPROTO_UDP: ++ return 0; + case IPPROTO_ICMP: ++ if (family != AF_INET) ++ break; ++ return 0; ++#if IS_ENABLED(CONFIG_IPV6) ++ case IPPROTO_ICMPV6: ++ if (family != AF_INET6) ++ break; + return 0; +- default: +- NL_SET_ERR_MSG(extack, "Unsupported ip proto"); +- return -EOPNOTSUPP; ++#endif + } ++ NL_SET_ERR_MSG(extack, "Unsupported ip proto"); ++ return -EOPNOTSUPP; + } + EXPORT_SYMBOL_GPL(rtm_getroute_parse_ip_proto); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 436b46c0e687f..ca87bb6784e5d 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -2814,7 +2814,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, + + if (tb[RTA_IP_PROTO]) { + err = rtm_getroute_parse_ip_proto(tb[RTA_IP_PROTO], +- &ip_proto, extack); ++ &ip_proto, AF_INET, extack); + if (err) + return err; + } +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index 10aafea3af0f1..35e7092eceb37 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -1954,10 +1954,10 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) + + static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb) + { +- __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), +- IPSTATS_MIB_OUTFORWDATAGRAMS); +- __IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)), +- IPSTATS_MIB_OUTOCTETS, skb->len); ++ IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), ++ IPSTATS_MIB_OUTFORWDATAGRAMS); ++ IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)), ++ IPSTATS_MIB_OUTOCTETS, skb->len); + return dst_output(net, sk, skb); + } + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 08c4516ae4a4d..ba59a9c14e02a 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -4213,6 +4213,10 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh, + cfg->fc_gateway = nla_get_in6_addr(tb[RTA_GATEWAY]); + cfg->fc_flags |= RTF_GATEWAY; + } ++ if (tb[RTA_VIA]) { ++ NL_SET_ERR_MSG(extack, "IPv6 does not support RTA_VIA attribute"); ++ goto errout; ++ } + + if (tb[RTA_DST]) { + int plen = (rtm->rtm_dst_len + 7) >> 3; +@@ -4907,7 +4911,8 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, + + if (tb[RTA_IP_PROTO]) { + err = rtm_getroute_parse_ip_proto(tb[RTA_IP_PROTO], +- &fl6.flowi6_proto, extack); ++ &fl6.flowi6_proto, AF_INET6, ++ extack); + if (err) + goto errout; + } +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index da6d5a3f53995..868d7da7a0cb3 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1873,6 +1873,7 @@ static int __net_init sit_init_net(struct net *net) + + err_reg_dev: + ipip6_dev_free(sitn->fb_tunnel_dev); ++ free_netdev(sitn->fb_tunnel_dev); + err_alloc_dev: + return err; + } +diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c +index 8fbe6cdbe255d..d5a4db5b3fe7b 100644 +--- a/net/mpls/af_mpls.c ++++ b/net/mpls/af_mpls.c +@@ -1822,6 +1822,9 @@ static int rtm_to_route_config(struct sk_buff *skb, + goto errout; + break; + } ++ case RTA_GATEWAY: ++ NL_SET_ERR_MSG(extack, "MPLS does not support RTA_GATEWAY attribute"); ++ goto errout; + case RTA_VIA: + { + if (nla_get_via(nla, &cfg->rc_via_alen, +diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c +index ea7c67050792c..ee3e5b6471a69 100644 +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -903,7 +903,8 @@ int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, + (state == 0 && (byte & bitmask) == 0)) + return bit_spot; + +- bit_spot++; ++ if (++bit_spot >= bitmap_len) ++ return -1; + bitmask >>= 1; + if (bitmask == 0) { + byte = bitmap[++byte_offset]; +diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c +index 6a196e438b6c0..d1fc019e932e0 100644 +--- a/net/nfc/llcp_commands.c ++++ b/net/nfc/llcp_commands.c +@@ -419,6 +419,10 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock) + sock->service_name, + sock->service_name_len, + &service_name_tlv_length); ++ if (!service_name_tlv) { ++ err = -ENOMEM; ++ goto error_tlv; ++ } + size += service_name_tlv_length; + } + +@@ -429,9 +433,17 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock) + + miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0, + &miux_tlv_length); ++ if (!miux_tlv) { ++ err = -ENOMEM; ++ goto error_tlv; ++ } + size += miux_tlv_length; + + rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length); ++ if (!rw_tlv) { ++ err = -ENOMEM; ++ goto error_tlv; ++ } + size += rw_tlv_length; + + pr_debug("SKB size %d SN length %zu\n", size, sock->service_name_len); +@@ -484,9 +496,17 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock) + + miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0, + &miux_tlv_length); ++ if (!miux_tlv) { ++ err = -ENOMEM; ++ goto error_tlv; ++ } + size += miux_tlv_length; + + rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length); ++ if (!rw_tlv) { ++ err = -ENOMEM; ++ goto error_tlv; ++ } + size += rw_tlv_length; + + skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, size); +diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c +index ef4026a23e802..4fa015208aab1 100644 +--- a/net/nfc/llcp_core.c ++++ b/net/nfc/llcp_core.c +@@ -532,10 +532,10 @@ static u8 nfc_llcp_reserve_sdp_ssap(struct nfc_llcp_local *local) + + static int nfc_llcp_build_gb(struct nfc_llcp_local *local) + { +- u8 *gb_cur, *version_tlv, version, version_length; +- u8 *lto_tlv, lto_length; +- u8 *wks_tlv, wks_length; +- u8 *miux_tlv, miux_length; ++ u8 *gb_cur, version, version_length; ++ u8 lto_length, wks_length, miux_length; ++ u8 *version_tlv = NULL, *lto_tlv = NULL, ++ *wks_tlv = NULL, *miux_tlv = NULL; + __be16 wks = cpu_to_be16(local->local_wks); + u8 gb_len = 0; + int ret = 0; +@@ -543,17 +543,33 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local) + version = LLCP_VERSION_11; + version_tlv = nfc_llcp_build_tlv(LLCP_TLV_VERSION, &version, + 1, &version_length); ++ if (!version_tlv) { ++ ret = -ENOMEM; ++ goto out; ++ } + gb_len += version_length; + + lto_tlv = nfc_llcp_build_tlv(LLCP_TLV_LTO, &local->lto, 1, <o_length); ++ if (!lto_tlv) { ++ ret = -ENOMEM; ++ goto out; ++ } + gb_len += lto_length; + + pr_debug("Local wks 0x%lx\n", local->local_wks); + wks_tlv = nfc_llcp_build_tlv(LLCP_TLV_WKS, (u8 *)&wks, 2, &wks_length); ++ if (!wks_tlv) { ++ ret = -ENOMEM; ++ goto out; ++ } + gb_len += wks_length; + + miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&local->miux, 0, + &miux_length); ++ if (!miux_tlv) { ++ ret = -ENOMEM; ++ goto out; ++ } + gb_len += miux_length; + + gb_len += ARRAY_SIZE(llcp_magic); +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index 8525de8116163..334f3a0576713 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -199,8 +199,7 @@ err3: + err2: + kfree(tname); + err1: +- if (ret == ACT_P_CREATED) +- tcf_idr_release(*a, bind); ++ tcf_idr_release(*a, bind); + return err; + } + +diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c +index 73e44ce2a8837..86d90fc5e97ea 100644 +--- a/net/sched/act_skbedit.c ++++ b/net/sched/act_skbedit.c +@@ -191,8 +191,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, + + params_new = kzalloc(sizeof(*params_new), GFP_KERNEL); + if (unlikely(!params_new)) { +- if (ret == ACT_P_CREATED) +- tcf_idr_release(*a, bind); ++ tcf_idr_release(*a, bind); + return -ENOMEM; + } + +diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c +index 0f6601fdf8899..72d9c432e8b42 100644 +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -377,7 +377,8 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla, + return ret; + + release_tun_meta: +- dst_release(&metadata->dst); ++ if (metadata) ++ dst_release(&metadata->dst); + + err_out: + if (exists) +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 69078c82963ef..77b289da77636 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -68,7 +68,7 @@ static inline struct sk_buff *__skb_dequeue_bad_txq(struct Qdisc *q) + skb = __skb_dequeue(&q->skb_bad_txq); + if (qdisc_is_percpu_stats(q)) { + qdisc_qstats_cpu_backlog_dec(q, skb); +- qdisc_qstats_cpu_qlen_dec(q); ++ qdisc_qstats_atomic_qlen_dec(q); + } else { + qdisc_qstats_backlog_dec(q, skb); + q->q.qlen--; +@@ -108,7 +108,7 @@ static inline void qdisc_enqueue_skb_bad_txq(struct Qdisc *q, + + if (qdisc_is_percpu_stats(q)) { + qdisc_qstats_cpu_backlog_inc(q, skb); +- qdisc_qstats_cpu_qlen_inc(q); ++ qdisc_qstats_atomic_qlen_inc(q); + } else { + qdisc_qstats_backlog_inc(q, skb); + q->q.qlen++; +@@ -147,7 +147,7 @@ static inline int dev_requeue_skb_locked(struct sk_buff *skb, struct Qdisc *q) + + qdisc_qstats_cpu_requeues_inc(q); + qdisc_qstats_cpu_backlog_inc(q, skb); +- qdisc_qstats_cpu_qlen_inc(q); ++ qdisc_qstats_atomic_qlen_inc(q); + + skb = next; + } +@@ -252,7 +252,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate, + skb = __skb_dequeue(&q->gso_skb); + if (qdisc_is_percpu_stats(q)) { + qdisc_qstats_cpu_backlog_dec(q, skb); +- qdisc_qstats_cpu_qlen_dec(q); ++ qdisc_qstats_atomic_qlen_dec(q); + } else { + qdisc_qstats_backlog_dec(q, skb); + q->q.qlen--; +@@ -633,7 +633,7 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc, + if (unlikely(err)) + return qdisc_drop_cpu(skb, qdisc, to_free); + +- qdisc_qstats_cpu_qlen_inc(qdisc); ++ qdisc_qstats_atomic_qlen_inc(qdisc); + /* Note: skb can not be used after skb_array_produce(), + * so we better not use qdisc_qstats_cpu_backlog_inc() + */ +@@ -658,7 +658,7 @@ static struct sk_buff *pfifo_fast_dequeue(struct Qdisc *qdisc) + if (likely(skb)) { + qdisc_qstats_cpu_backlog_dec(qdisc, skb); + qdisc_bstats_cpu_update(qdisc, skb); +- qdisc_qstats_cpu_qlen_dec(qdisc); ++ qdisc_qstats_atomic_qlen_dec(qdisc); + } + + return skb; +@@ -702,7 +702,6 @@ static void pfifo_fast_reset(struct Qdisc *qdisc) + struct gnet_stats_queue *q = per_cpu_ptr(qdisc->cpu_qstats, i); + + q->backlog = 0; +- q->qlen = 0; + } + } + +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c +index 74c0f656f28c5..4dfe10b9f96c8 100644 +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -440,6 +440,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + int nb = 0; + int count = 1; + int rc = NET_XMIT_SUCCESS; ++ int rc_drop = NET_XMIT_DROP; + + /* Do not fool qdisc_drop_all() */ + skb->prev = NULL; +@@ -479,6 +480,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + q->duplicate = 0; + rootq->enqueue(skb2, rootq, to_free); + q->duplicate = dupsave; ++ rc_drop = NET_XMIT_SUCCESS; + } + + /* +@@ -491,7 +493,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + if (skb_is_gso(skb)) { + segs = netem_segment(skb, sch, to_free); + if (!segs) +- return NET_XMIT_DROP; ++ return rc_drop; + } else { + segs = skb; + } +@@ -514,8 +516,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + 1<<(prandom_u32() % 8); + } + +- if (unlikely(sch->q.qlen >= sch->limit)) +- return qdisc_drop_all(skb, sch, to_free); ++ if (unlikely(sch->q.qlen >= sch->limit)) { ++ qdisc_drop_all(skb, sch, to_free); ++ return rc_drop; ++ } + + qdisc_qstats_backlog_inc(sch, skb); + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index e5e70cff5bb30..1b16250c5718d 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -1884,6 +1884,7 @@ static int sctp_sendmsg_check_sflags(struct sctp_association *asoc, + + pr_debug("%s: aborting association:%p\n", __func__, asoc); + sctp_primitive_ABORT(net, asoc, chunk); ++ iov_iter_revert(&msg->msg_iter, msg_len); + + return 0; + } +diff --git a/net/socket.c b/net/socket.c +index 5c820212ba815..18d27b8c25116 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -577,6 +577,7 @@ static void __sock_release(struct socket *sock, struct inode *inode) + if (inode) + inode_lock(inode); + sock->ops->release(sock); ++ sock->sk = NULL; + if (inode) + inode_unlock(inode); + sock->ops = NULL; +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index e1bdaf056c8f7..88c307ef13181 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -377,11 +377,13 @@ static int tipc_sk_sock_err(struct socket *sock, long *timeout) + + #define tipc_wait_for_cond(sock_, timeo_, condition_) \ + ({ \ ++ DEFINE_WAIT_FUNC(wait_, woken_wake_function); \ + struct sock *sk_; \ + int rc_; \ + \ + while ((rc_ = !(condition_))) { \ +- DEFINE_WAIT_FUNC(wait_, woken_wake_function); \ ++ /* coupled with smp_wmb() in tipc_sk_proto_rcv() */ \ ++ smp_rmb(); \ + sk_ = (sock_)->sk; \ + rc_ = tipc_sk_sock_err((sock_), timeo_); \ + if (rc_) \ +@@ -1318,7 +1320,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen) + + if (unlikely(!dest)) { + dest = &tsk->peer; +- if (!syn || dest->family != AF_TIPC) ++ if (!syn && dest->family != AF_TIPC) + return -EDESTADDRREQ; + } + +@@ -1961,6 +1963,8 @@ static void tipc_sk_proto_rcv(struct sock *sk, + return; + case SOCK_WAKEUP: + tipc_dest_del(&tsk->cong_links, msg_orignode(hdr), 0); ++ /* coupled with smp_rmb() in tipc_wait_for_cond() */ ++ smp_wmb(); + tsk->cong_link_cnt--; + wakeup = true; + break; +diff --git a/tools/testing/selftests/firmware/fw_lib.sh b/tools/testing/selftests/firmware/fw_lib.sh +index 6c5f1b2ffb745..1cbb12e284a68 100755 +--- a/tools/testing/selftests/firmware/fw_lib.sh ++++ b/tools/testing/selftests/firmware/fw_lib.sh +@@ -91,7 +91,7 @@ verify_reqs() + if [ "$TEST_REQS_FW_SYSFS_FALLBACK" = "yes" ]; then + if [ ! "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then + echo "usermode helper disabled so ignoring test" +- exit $ksft_skip ++ exit 0 + fi + fi + } diff --git a/patch/kernel/sunxi-next/patch-4.19.28-29.patch b/patch/kernel/sunxi-next/patch-4.19.28-29.patch new file mode 100644 index 0000000000..0eb9cf93a6 --- /dev/null +++ b/patch/kernel/sunxi-next/patch-4.19.28-29.patch @@ -0,0 +1,6412 @@ +diff --git a/Makefile b/Makefile +index c6ac023ba33a..6e526583291c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 28 ++SUBLEVEL = 29 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi +index 27a1ee28c3bb..94efca78c42f 100644 +--- a/arch/arm/boot/dts/exynos3250.dtsi ++++ b/arch/arm/boot/dts/exynos3250.dtsi +@@ -168,6 +168,9 @@ + interrupt-controller; + #interrupt-cells = <3>; + interrupt-parent = <&gic>; ++ clock-names = "clkout8"; ++ clocks = <&cmu CLK_FIN_PLL>; ++ #clock-cells = <1>; + }; + + mipi_phy: video-phy { +diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi +index a09e46c9dbc0..00820d239753 100644 +--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi ++++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi +@@ -49,7 +49,7 @@ + }; + + emmc_pwrseq: pwrseq { +- pinctrl-0 = <&sd1_cd>; ++ pinctrl-0 = <&emmc_rstn>; + pinctrl-names = "default"; + compatible = "mmc-pwrseq-emmc"; + reset-gpios = <&gpk1 2 GPIO_ACTIVE_LOW>; +@@ -161,12 +161,6 @@ + cpu0-supply = <&buck2_reg>; + }; + +-/* RSTN signal for eMMC */ +-&sd1_cd { +- samsung,pin-pud = ; +- samsung,pin-drv = ; +-}; +- + &pinctrl_1 { + gpio_power_key: power_key { + samsung,pins = "gpx1-3"; +@@ -184,6 +178,11 @@ + samsung,pins = "gpx3-7"; + samsung,pin-pud = ; + }; ++ ++ emmc_rstn: emmc-rstn { ++ samsung,pins = "gpk1-2"; ++ samsung,pin-pud = ; ++ }; + }; + + &ehci { +diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi +index 2f4f40882dab..27214e6ebe4f 100644 +--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi ++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi +@@ -334,7 +334,7 @@ + buck8_reg: BUCK8 { + regulator-name = "vdd_1.8v_ldo"; + regulator-min-microvolt = <800000>; +- regulator-max-microvolt = <1500000>; ++ regulator-max-microvolt = <2000000>; + regulator-always-on; + regulator-boot-on; + }; +diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi +index 844caa39364f..50083cecc6c9 100644 +--- a/arch/arm/boot/dts/imx6sx.dtsi ++++ b/arch/arm/boot/dts/imx6sx.dtsi +@@ -462,7 +462,7 @@ + }; + + gpt: gpt@2098000 { +- compatible = "fsl,imx6sx-gpt", "fsl,imx31-gpt"; ++ compatible = "fsl,imx6sx-gpt", "fsl,imx6dl-gpt"; + reg = <0x02098000 0x4000>; + interrupts = ; + clocks = <&clks IMX6SX_CLK_GPT_BUS>, +diff --git a/arch/arm/boot/dts/meson.dtsi b/arch/arm/boot/dts/meson.dtsi +index 0d9faf1a51ea..a86b89086334 100644 +--- a/arch/arm/boot/dts/meson.dtsi ++++ b/arch/arm/boot/dts/meson.dtsi +@@ -263,7 +263,7 @@ + compatible = "amlogic,meson6-dwmac", "snps,dwmac"; + reg = <0xc9410000 0x10000 + 0xc1108108 0x4>; +- interrupts = ; ++ interrupts = ; + interrupt-names = "macirq"; + status = "disabled"; + }; +diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts +index ef3177d3da3d..8fdeeffecbdb 100644 +--- a/arch/arm/boot/dts/meson8b-odroidc1.dts ++++ b/arch/arm/boot/dts/meson8b-odroidc1.dts +@@ -125,7 +125,6 @@ + /* Realtek RTL8211F (0x001cc916) */ + eth_phy: ethernet-phy@0 { + reg = <0>; +- eee-broken-1000t; + interrupt-parent = <&gpio_intc>; + /* GPIOH_3 */ + interrupts = <17 IRQ_TYPE_LEVEL_LOW>; +@@ -172,8 +171,7 @@ + cap-sd-highspeed; + disable-wp; + +- cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>; +- cd-inverted; ++ cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>; + + vmmc-supply = <&tflash_vdd>; + vqmmc-supply = <&tf_io>; +diff --git a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts +index f5853610b20b..6ac02beb5fa7 100644 +--- a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts ++++ b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts +@@ -206,8 +206,7 @@ + cap-sd-highspeed; + disable-wp; + +- cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>; +- cd-inverted; ++ cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>; + + vmmc-supply = <&vcc_3v3>; + }; +diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +index ddc7a7bb33c0..f57acf8f66b9 100644 +--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi ++++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +@@ -105,7 +105,7 @@ + interrupts-extended = < + &cpcap 15 0 &cpcap 14 0 &cpcap 28 0 &cpcap 19 0 + &cpcap 18 0 &cpcap 17 0 &cpcap 16 0 &cpcap 49 0 +- &cpcap 48 1 ++ &cpcap 48 0 + >; + interrupt-names = + "id_ground", "id_float", "se0conn", "vbusvld", +diff --git a/arch/arm/boot/dts/omap3-n950-n9.dtsi b/arch/arm/boot/dts/omap3-n950-n9.dtsi +index 0d9b85317529..e142e6c70a59 100644 +--- a/arch/arm/boot/dts/omap3-n950-n9.dtsi ++++ b/arch/arm/boot/dts/omap3-n950-n9.dtsi +@@ -370,6 +370,19 @@ + compatible = "ti,omap2-onenand"; + reg = <0 0 0x20000>; /* CS0, offset 0, IO size 128K */ + ++ /* ++ * These timings are based on CONFIG_OMAP_GPMC_DEBUG=y reported ++ * bootloader set values when booted with v4.19 using both N950 ++ * and N9 devices (OneNAND Manufacturer: Samsung): ++ * ++ * gpmc cs0 before gpmc_cs_program_settings: ++ * cs0 GPMC_CS_CONFIG1: 0xfd001202 ++ * cs0 GPMC_CS_CONFIG2: 0x00181800 ++ * cs0 GPMC_CS_CONFIG3: 0x00030300 ++ * cs0 GPMC_CS_CONFIG4: 0x18001804 ++ * cs0 GPMC_CS_CONFIG5: 0x03171d1d ++ * cs0 GPMC_CS_CONFIG6: 0x97080000 ++ */ + gpmc,sync-read; + gpmc,sync-write; + gpmc,burst-length = <16>; +@@ -379,26 +392,27 @@ + gpmc,device-width = <2>; + gpmc,mux-add-data = <2>; + gpmc,cs-on-ns = <0>; +- gpmc,cs-rd-off-ns = <87>; +- gpmc,cs-wr-off-ns = <87>; ++ gpmc,cs-rd-off-ns = <122>; ++ gpmc,cs-wr-off-ns = <122>; + gpmc,adv-on-ns = <0>; +- gpmc,adv-rd-off-ns = <10>; +- gpmc,adv-wr-off-ns = <10>; +- gpmc,oe-on-ns = <15>; +- gpmc,oe-off-ns = <87>; ++ gpmc,adv-rd-off-ns = <15>; ++ gpmc,adv-wr-off-ns = <15>; ++ gpmc,oe-on-ns = <20>; ++ gpmc,oe-off-ns = <122>; + gpmc,we-on-ns = <0>; +- gpmc,we-off-ns = <87>; +- gpmc,rd-cycle-ns = <112>; +- gpmc,wr-cycle-ns = <112>; +- gpmc,access-ns = <81>; ++ gpmc,we-off-ns = <122>; ++ gpmc,rd-cycle-ns = <148>; ++ gpmc,wr-cycle-ns = <148>; ++ gpmc,access-ns = <117>; + gpmc,page-burst-access-ns = <15>; + gpmc,bus-turnaround-ns = <0>; + gpmc,cycle2cycle-delay-ns = <0>; + gpmc,wait-monitoring-ns = <0>; +- gpmc,clk-activation-ns = <5>; +- gpmc,wr-data-mux-bus-ns = <30>; +- gpmc,wr-access-ns = <81>; +- gpmc,sync-clk-ps = <15000>; ++ gpmc,clk-activation-ns = <10>; ++ gpmc,wr-data-mux-bus-ns = <40>; ++ gpmc,wr-access-ns = <117>; ++ ++ gpmc,sync-clk-ps = <15000>; /* TBC; Where this value came? */ + + /* + * MTD partition table corresponding to Nokia's MeeGo 1.2 +diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts +index 5d23667dc2d2..25540b7694d5 100644 +--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts ++++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts +@@ -53,7 +53,7 @@ + + aliases { + serial0 = &uart0; +- /* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */ ++ ethernet0 = &emac; + ethernet1 = &sdiowifi; + }; + +diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c +index ed36dcab80f1..f51919974183 100644 +--- a/arch/arm/plat-pxa/ssp.c ++++ b/arch/arm/plat-pxa/ssp.c +@@ -190,8 +190,6 @@ static int pxa_ssp_remove(struct platform_device *pdev) + if (ssp == NULL) + return -ENODEV; + +- iounmap(ssp->mmio_base); +- + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + release_mem_region(res->start, resource_size(res)); + +@@ -201,7 +199,6 @@ static int pxa_ssp_remove(struct platform_device *pdev) + list_del(&ssp->node); + mutex_unlock(&ssp_lock); + +- kfree(ssp); + return 0; + } + +diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts +index f4964bee6a1a..e80a792827ed 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts ++++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts +@@ -118,6 +118,7 @@ + reset-gpios = <&gpio0 5 GPIO_ACTIVE_LOW>; + clocks = <&pmic>; + clock-names = "ext_clock"; ++ post-power-on-delay-ms = <10>; + power-off-delay-us = <10>; + }; + +@@ -300,7 +301,6 @@ + + dwmmc_0: dwmmc0@f723d000 { + cap-mmc-highspeed; +- mmc-hs200-1_8v; + non-removable; + bus-width = <0x8>; + vmmc-supply = <&ldo19>; +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index cd3865e7a270..8c86c41a0d25 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -399,7 +399,7 @@ + }; + + intc: interrupt-controller@9bc0000 { +- compatible = "arm,gic-v3"; ++ compatible = "qcom,msm8996-gic-v3", "arm,gic-v3"; + #interrupt-cells = <3>; + interrupt-controller; + #redistributor-regions = <1>; +diff --git a/arch/arm64/boot/dts/renesas/r8a7796.dtsi b/arch/arm64/boot/dts/renesas/r8a7796.dtsi +index cbd35c00b4af..33cb0281c39c 100644 +--- a/arch/arm64/boot/dts/renesas/r8a7796.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a7796.dtsi +@@ -1161,6 +1161,9 @@ + <&cpg CPG_CORE R8A7796_CLK_S3D1>, + <&scif_clk>; + clock-names = "fck", "brg_int", "scif_clk"; ++ dmas = <&dmac1 0x13>, <&dmac1 0x12>, ++ <&dmac2 0x13>, <&dmac2 0x12>; ++ dma-names = "tx", "rx", "tx", "rx"; + power-domains = <&sysc R8A7796_PD_ALWAYS_ON>; + resets = <&cpg 310>; + status = "disabled"; +diff --git a/arch/arm64/boot/dts/renesas/r8a77965.dtsi b/arch/arm64/boot/dts/renesas/r8a77965.dtsi +index 0cd44461a0bd..f60f08ba1a6f 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77965.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a77965.dtsi +@@ -951,6 +951,9 @@ + <&cpg CPG_CORE R8A77965_CLK_S3D1>, + <&scif_clk>; + clock-names = "fck", "brg_int", "scif_clk"; ++ dmas = <&dmac1 0x13>, <&dmac1 0x12>, ++ <&dmac2 0x13>, <&dmac2 0x12>; ++ dma-names = "tx", "rx", "tx", "rx"; + power-domains = <&sysc R8A77965_PD_ALWAYS_ON>; + resets = <&cpg 310>; + status = "disabled"; +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts +index eb5e8bddb610..8954c8c6f547 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts ++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts +@@ -101,6 +101,7 @@ + sdio_pwrseq: sdio_pwrseq { + compatible = "mmc-pwrseq-simple"; + reset-gpios = <&gpio 7 GPIO_ACTIVE_LOW>; /* WIFI_EN */ ++ post-power-on-delay-ms = <10>; + }; + }; + +diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c +index b5a367d4bba6..30bb13797034 100644 +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -478,13 +478,13 @@ bool arch_within_kprobe_blacklist(unsigned long addr) + addr < (unsigned long)__entry_text_end) || + (addr >= (unsigned long)__idmap_text_start && + addr < (unsigned long)__idmap_text_end) || ++ (addr >= (unsigned long)__hyp_text_start && ++ addr < (unsigned long)__hyp_text_end) || + !!search_exception_tables(addr)) + return true; + + if (!is_kernel_in_hyp_mode()) { +- if ((addr >= (unsigned long)__hyp_text_start && +- addr < (unsigned long)__hyp_text_end) || +- (addr >= (unsigned long)__hyp_idmap_text_start && ++ if ((addr >= (unsigned long)__hyp_idmap_text_start && + addr < (unsigned long)__hyp_idmap_text_end)) + return true; + } +diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts +index 50cff3cbcc6d..4f7b1fa31cf5 100644 +--- a/arch/mips/boot/dts/ingenic/ci20.dts ++++ b/arch/mips/boot/dts/ingenic/ci20.dts +@@ -76,7 +76,7 @@ + status = "okay"; + + pinctrl-names = "default"; +- pinctrl-0 = <&pins_uart2>; ++ pinctrl-0 = <&pins_uart3>; + }; + + &uart4 { +@@ -196,9 +196,9 @@ + bias-disable; + }; + +- pins_uart2: uart2 { +- function = "uart2"; +- groups = "uart2-data", "uart2-hwflow"; ++ pins_uart3: uart3 { ++ function = "uart3"; ++ groups = "uart3-data", "uart3-hwflow"; + bias-disable; + }; + +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index d4f7fd4550e1..85522c137f19 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -371,7 +371,7 @@ static inline int is_sp_move_ins(union mips_instruction *ip, int *frame_size) + static int get_frame_info(struct mips_frame_info *info) + { + bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS); +- union mips_instruction insn, *ip, *ip_end; ++ union mips_instruction insn, *ip; + const unsigned int max_insns = 128; + unsigned int last_insn_size = 0; + unsigned int i; +@@ -384,10 +384,9 @@ static int get_frame_info(struct mips_frame_info *info) + if (!ip) + goto err; + +- ip_end = (void *)ip + info->func_size; +- +- for (i = 0; i < max_insns && ip < ip_end; i++) { ++ for (i = 0; i < max_insns; i++) { + ip = (void *)ip + last_insn_size; ++ + if (is_mmips && mm_insn_16bit(ip->halfword[0])) { + insn.word = ip->halfword[0] << 16; + last_insn_size = 2; +diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h +index 3fe4af8147d2..c23578a37b44 100644 +--- a/arch/riscv/include/asm/processor.h ++++ b/arch/riscv/include/asm/processor.h +@@ -22,7 +22,7 @@ + * This decides where the kernel will search for a free chunk of vm + * space during mmap's. + */ +-#define TASK_UNMAPPED_BASE PAGE_ALIGN(TASK_SIZE >> 1) ++#define TASK_UNMAPPED_BASE PAGE_ALIGN(TASK_SIZE / 3) + + #define STACK_TOP TASK_SIZE + #define STACK_TOP_MAX STACK_TOP +diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c +index b2d26d9d8489..9713d4e8c22b 100644 +--- a/arch/riscv/kernel/setup.c ++++ b/arch/riscv/kernel/setup.c +@@ -186,7 +186,7 @@ static void __init setup_bootmem(void) + BUG_ON(mem_size == 0); + + set_max_mapnr(PFN_DOWN(mem_size)); +- max_low_pfn = memblock_end_of_DRAM(); ++ max_low_pfn = PFN_DOWN(memblock_end_of_DRAM()); + + #ifdef CONFIG_BLK_DEV_INITRD + setup_initrd(); +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index 58a522f9bcc3..200a4b315e15 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -29,7 +29,8 @@ static void __init zone_sizes_init(void) + unsigned long max_zone_pfns[MAX_NR_ZONES] = { 0, }; + + #ifdef CONFIG_ZONE_DMA32 +- max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G, max_low_pfn)); ++ max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G, ++ (unsigned long) PFN_PHYS(max_low_pfn))); + #endif + max_zone_pfns[ZONE_NORMAL] = max_low_pfn; + +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index 64037895b085..f105ae8651c9 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -600,6 +600,14 @@ ENTRY(trampoline_32bit_src) + leal TRAMPOLINE_32BIT_PGTABLE_OFFSET(%ecx), %eax + movl %eax, %cr3 + 3: ++ /* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */ ++ pushl %ecx ++ movl $MSR_EFER, %ecx ++ rdmsr ++ btsl $_EFER_LME, %eax ++ wrmsr ++ popl %ecx ++ + /* Enable PAE and LA57 (if required) paging modes */ + movl $X86_CR4_PAE, %eax + cmpl $0, %edx +diff --git a/arch/x86/boot/compressed/pgtable.h b/arch/x86/boot/compressed/pgtable.h +index 91f75638f6e6..6ff7e81b5628 100644 +--- a/arch/x86/boot/compressed/pgtable.h ++++ b/arch/x86/boot/compressed/pgtable.h +@@ -6,7 +6,7 @@ + #define TRAMPOLINE_32BIT_PGTABLE_OFFSET 0 + + #define TRAMPOLINE_32BIT_CODE_OFFSET PAGE_SIZE +-#define TRAMPOLINE_32BIT_CODE_SIZE 0x60 ++#define TRAMPOLINE_32BIT_CODE_SIZE 0x70 + + #define TRAMPOLINE_32BIT_STACK_END TRAMPOLINE_32BIT_SIZE + +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index c04a8813cff9..a41554350893 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -1970,7 +1970,7 @@ static int x86_pmu_commit_txn(struct pmu *pmu) + */ + static void free_fake_cpuc(struct cpu_hw_events *cpuc) + { +- kfree(cpuc->shared_regs); ++ intel_cpuc_finish(cpuc); + kfree(cpuc); + } + +@@ -1982,14 +1982,11 @@ static struct cpu_hw_events *allocate_fake_cpuc(void) + cpuc = kzalloc(sizeof(*cpuc), GFP_KERNEL); + if (!cpuc) + return ERR_PTR(-ENOMEM); +- +- /* only needed, if we have extra_regs */ +- if (x86_pmu.extra_regs) { +- cpuc->shared_regs = allocate_shared_regs(cpu); +- if (!cpuc->shared_regs) +- goto error; +- } + cpuc->is_fake = 1; ++ ++ if (intel_cpuc_prepare(cpuc, cpu)) ++ goto error; ++ + return cpuc; + error: + free_fake_cpuc(cpuc); +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index fbd7551a8d44..220b40b75e6f 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -1995,6 +1995,39 @@ static void intel_pmu_nhm_enable_all(int added) + intel_pmu_enable_all(added); + } + ++static void intel_set_tfa(struct cpu_hw_events *cpuc, bool on) ++{ ++ u64 val = on ? MSR_TFA_RTM_FORCE_ABORT : 0; ++ ++ if (cpuc->tfa_shadow != val) { ++ cpuc->tfa_shadow = val; ++ wrmsrl(MSR_TSX_FORCE_ABORT, val); ++ } ++} ++ ++static void intel_tfa_commit_scheduling(struct cpu_hw_events *cpuc, int idx, int cntr) ++{ ++ /* ++ * We're going to use PMC3, make sure TFA is set before we touch it. ++ */ ++ if (cntr == 3 && !cpuc->is_fake) ++ intel_set_tfa(cpuc, true); ++} ++ ++static void intel_tfa_pmu_enable_all(int added) ++{ ++ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); ++ ++ /* ++ * If we find PMC3 is no longer used when we enable the PMU, we can ++ * clear TFA. ++ */ ++ if (!test_bit(3, cpuc->active_mask)) ++ intel_set_tfa(cpuc, false); ++ ++ intel_pmu_enable_all(added); ++} ++ + static inline u64 intel_pmu_get_status(void) + { + u64 status; +@@ -2652,6 +2685,35 @@ intel_stop_scheduling(struct cpu_hw_events *cpuc) + raw_spin_unlock(&excl_cntrs->lock); + } + ++static struct event_constraint * ++dyn_constraint(struct cpu_hw_events *cpuc, struct event_constraint *c, int idx) ++{ ++ WARN_ON_ONCE(!cpuc->constraint_list); ++ ++ if (!(c->flags & PERF_X86_EVENT_DYNAMIC)) { ++ struct event_constraint *cx; ++ ++ /* ++ * grab pre-allocated constraint entry ++ */ ++ cx = &cpuc->constraint_list[idx]; ++ ++ /* ++ * initialize dynamic constraint ++ * with static constraint ++ */ ++ *cx = *c; ++ ++ /* ++ * mark constraint as dynamic ++ */ ++ cx->flags |= PERF_X86_EVENT_DYNAMIC; ++ c = cx; ++ } ++ ++ return c; ++} ++ + static struct event_constraint * + intel_get_excl_constraints(struct cpu_hw_events *cpuc, struct perf_event *event, + int idx, struct event_constraint *c) +@@ -2682,27 +2744,7 @@ intel_get_excl_constraints(struct cpu_hw_events *cpuc, struct perf_event *event, + * only needed when constraint has not yet + * been cloned (marked dynamic) + */ +- if (!(c->flags & PERF_X86_EVENT_DYNAMIC)) { +- struct event_constraint *cx; +- +- /* +- * grab pre-allocated constraint entry +- */ +- cx = &cpuc->constraint_list[idx]; +- +- /* +- * initialize dynamic constraint +- * with static constraint +- */ +- *cx = *c; +- +- /* +- * mark constraint as dynamic, so we +- * can free it later on +- */ +- cx->flags |= PERF_X86_EVENT_DYNAMIC; +- c = cx; +- } ++ c = dyn_constraint(cpuc, c, idx); + + /* + * From here on, the constraint is dynamic. +@@ -3229,6 +3271,26 @@ glp_get_event_constraints(struct cpu_hw_events *cpuc, int idx, + return c; + } + ++static bool allow_tsx_force_abort = true; ++ ++static struct event_constraint * ++tfa_get_event_constraints(struct cpu_hw_events *cpuc, int idx, ++ struct perf_event *event) ++{ ++ struct event_constraint *c = hsw_get_event_constraints(cpuc, idx, event); ++ ++ /* ++ * Without TFA we must not use PMC3. ++ */ ++ if (!allow_tsx_force_abort && test_bit(3, c->idxmsk)) { ++ c = dyn_constraint(cpuc, c, idx); ++ c->idxmsk64 &= ~(1ULL << 3); ++ c->weight--; ++ } ++ ++ return c; ++} ++ + /* + * Broadwell: + * +@@ -3282,7 +3344,7 @@ ssize_t intel_event_sysfs_show(char *page, u64 config) + return x86_event_sysfs_show(page, config, event); + } + +-struct intel_shared_regs *allocate_shared_regs(int cpu) ++static struct intel_shared_regs *allocate_shared_regs(int cpu) + { + struct intel_shared_regs *regs; + int i; +@@ -3314,23 +3376,24 @@ static struct intel_excl_cntrs *allocate_excl_cntrs(int cpu) + return c; + } + +-static int intel_pmu_cpu_prepare(int cpu) +-{ +- struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu); + ++int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu) ++{ + if (x86_pmu.extra_regs || x86_pmu.lbr_sel_map) { + cpuc->shared_regs = allocate_shared_regs(cpu); + if (!cpuc->shared_regs) + goto err; + } + +- if (x86_pmu.flags & PMU_FL_EXCL_CNTRS) { ++ if (x86_pmu.flags & (PMU_FL_EXCL_CNTRS | PMU_FL_TFA)) { + size_t sz = X86_PMC_IDX_MAX * sizeof(struct event_constraint); + +- cpuc->constraint_list = kzalloc(sz, GFP_KERNEL); ++ cpuc->constraint_list = kzalloc_node(sz, GFP_KERNEL, cpu_to_node(cpu)); + if (!cpuc->constraint_list) + goto err_shared_regs; ++ } + ++ if (x86_pmu.flags & PMU_FL_EXCL_CNTRS) { + cpuc->excl_cntrs = allocate_excl_cntrs(cpu); + if (!cpuc->excl_cntrs) + goto err_constraint_list; +@@ -3352,6 +3415,11 @@ err: + return -ENOMEM; + } + ++static int intel_pmu_cpu_prepare(int cpu) ++{ ++ return intel_cpuc_prepare(&per_cpu(cpu_hw_events, cpu), cpu); ++} ++ + static void flip_smm_bit(void *data) + { + unsigned long set = *(unsigned long *)data; +@@ -3423,9 +3491,8 @@ static void intel_pmu_cpu_starting(int cpu) + } + } + +-static void free_excl_cntrs(int cpu) ++static void free_excl_cntrs(struct cpu_hw_events *cpuc) + { +- struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu); + struct intel_excl_cntrs *c; + + c = cpuc->excl_cntrs; +@@ -3433,9 +3500,10 @@ static void free_excl_cntrs(int cpu) + if (c->core_id == -1 || --c->refcnt == 0) + kfree(c); + cpuc->excl_cntrs = NULL; +- kfree(cpuc->constraint_list); +- cpuc->constraint_list = NULL; + } ++ ++ kfree(cpuc->constraint_list); ++ cpuc->constraint_list = NULL; + } + + static void intel_pmu_cpu_dying(int cpu) +@@ -3443,9 +3511,8 @@ static void intel_pmu_cpu_dying(int cpu) + fini_debug_store_on_cpu(cpu); + } + +-static void intel_pmu_cpu_dead(int cpu) ++void intel_cpuc_finish(struct cpu_hw_events *cpuc) + { +- struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu); + struct intel_shared_regs *pc; + + pc = cpuc->shared_regs; +@@ -3455,7 +3522,12 @@ static void intel_pmu_cpu_dead(int cpu) + cpuc->shared_regs = NULL; + } + +- free_excl_cntrs(cpu); ++ free_excl_cntrs(cpuc); ++} ++ ++static void intel_pmu_cpu_dead(int cpu) ++{ ++ intel_cpuc_finish(&per_cpu(cpu_hw_events, cpu)); + } + + static void intel_pmu_sched_task(struct perf_event_context *ctx, +@@ -3917,8 +3989,11 @@ static struct attribute *intel_pmu_caps_attrs[] = { + NULL + }; + ++DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort); ++ + static struct attribute *intel_pmu_attrs[] = { + &dev_attr_freeze_on_smi.attr, ++ NULL, /* &dev_attr_allow_tsx_force_abort.attr.attr */ + NULL, + }; + +@@ -4374,6 +4449,15 @@ __init int intel_pmu_init(void) + x86_pmu.cpu_events = get_hsw_events_attrs(); + intel_pmu_pebs_data_source_skl( + boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X); ++ ++ if (boot_cpu_has(X86_FEATURE_TSX_FORCE_ABORT)) { ++ x86_pmu.flags |= PMU_FL_TFA; ++ x86_pmu.get_event_constraints = tfa_get_event_constraints; ++ x86_pmu.enable_all = intel_tfa_pmu_enable_all; ++ x86_pmu.commit_scheduling = intel_tfa_commit_scheduling; ++ intel_pmu_attrs[1] = &dev_attr_allow_tsx_force_abort.attr.attr; ++ } ++ + pr_cont("Skylake events, "); + name = "skylake"; + break; +@@ -4515,7 +4599,7 @@ static __init int fixup_ht_bug(void) + hardlockup_detector_perf_restart(); + + for_each_online_cpu(c) +- free_excl_cntrs(c); ++ free_excl_cntrs(&per_cpu(cpu_hw_events, c)); + + cpus_read_unlock(); + pr_info("PMU erratum BJ122, BV98, HSD29 workaround disabled, HT off\n"); +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h +index 0ee3a441ad79..5c424009b71f 100644 +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -242,6 +242,11 @@ struct cpu_hw_events { + struct intel_excl_cntrs *excl_cntrs; + int excl_thread_id; /* 0 or 1 */ + ++ /* ++ * SKL TSX_FORCE_ABORT shadow ++ */ ++ u64 tfa_shadow; ++ + /* + * AMD specific bits + */ +@@ -679,6 +684,7 @@ do { \ + #define PMU_FL_EXCL_CNTRS 0x4 /* has exclusive counter requirements */ + #define PMU_FL_EXCL_ENABLED 0x8 /* exclusive counter active */ + #define PMU_FL_PEBS_ALL 0x10 /* all events are valid PEBS events */ ++#define PMU_FL_TFA 0x20 /* deal with TSX force abort */ + + #define EVENT_VAR(_id) event_attr_##_id + #define EVENT_PTR(_id) &event_attr_##_id.attr.attr +@@ -887,7 +893,8 @@ struct event_constraint * + x86_get_event_constraints(struct cpu_hw_events *cpuc, int idx, + struct perf_event *event); + +-struct intel_shared_regs *allocate_shared_regs(int cpu); ++extern int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu); ++extern void intel_cpuc_finish(struct cpu_hw_events *cpuc); + + int intel_pmu_init(void); + +@@ -1023,9 +1030,13 @@ static inline int intel_pmu_init(void) + return 0; + } + +-static inline struct intel_shared_regs *allocate_shared_regs(int cpu) ++static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu) ++{ ++ return 0; ++} ++ ++static inline void intel_cpuc_finish(struct cpu_hw_event *cpuc) + { +- return NULL; + } + + static inline int is_ht_workaround_enabled(void) +diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h +index 89a048c2faec..7b31ee5223fc 100644 +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -340,6 +340,7 @@ + /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ + #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */ + #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */ ++#define X86_FEATURE_TSX_FORCE_ABORT (18*32+13) /* "" TSX_FORCE_ABORT */ + #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */ + #define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */ + #define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */ +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h +index 1f9de7635bcb..f14ca0be1e3f 100644 +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -629,6 +629,12 @@ + + #define MSR_IA32_TSC_DEADLINE 0x000006E0 + ++ ++#define MSR_TSX_FORCE_ABORT 0x0000010F ++ ++#define MSR_TFA_RTM_FORCE_ABORT_BIT 0 ++#define MSR_TFA_RTM_FORCE_ABORT BIT_ULL(MSR_TFA_RTM_FORCE_ABORT_BIT) ++ + /* P4/Xeon+ specific */ + #define MSR_IA32_MCG_EAX 0x00000180 + #define MSR_IA32_MCG_EBX 0x00000181 +diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h +index b99d497e342d..0b6352aabbd3 100644 +--- a/arch/x86/include/asm/page_64_types.h ++++ b/arch/x86/include/asm/page_64_types.h +@@ -7,7 +7,11 @@ + #endif + + #ifdef CONFIG_KASAN ++#ifdef CONFIG_KASAN_EXTRA ++#define KASAN_STACK_ORDER 2 ++#else + #define KASAN_STACK_ORDER 1 ++#endif + #else + #define KASAN_STACK_ORDER 0 + #endif +diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c +index 07b5fc00b188..a4e7e100ed26 100644 +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -707,7 +707,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) + if (!p) { + return ret; + } else { +- if (boot_cpu_data.microcode == p->patch_id) ++ if (boot_cpu_data.microcode >= p->patch_id) + return ret; + + ret = UCODE_NEW; +diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c +index 278cd07228dd..9490a2845f14 100644 +--- a/arch/x86/kernel/kexec-bzimage64.c ++++ b/arch/x86/kernel/kexec-bzimage64.c +@@ -167,6 +167,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr, + struct efi_info *current_ei = &boot_params.efi_info; + struct efi_info *ei = ¶ms->efi_info; + ++ if (!efi_enabled(EFI_RUNTIME_SERVICES)) ++ return 0; ++ + if (!current_ei->efi_memmap_size) + return 0; + +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index 13f4485ca388..bd372e896557 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -641,6 +641,22 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334b, quirk_no_aersid); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334c, quirk_no_aersid); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334d, quirk_no_aersid); + ++static void quirk_intel_th_dnv(struct pci_dev *dev) ++{ ++ struct resource *r = &dev->resource[4]; ++ ++ /* ++ * Denverton reports 2k of RTIT_BAR (intel_th resource 4), which ++ * appears to be 4 MB in reality. ++ */ ++ if (r->end == r->start + 0x7ff) { ++ r->start = 0; ++ r->end = 0x3fffff; ++ r->flags |= IORESOURCE_UNSET; ++ } ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x19e1, quirk_intel_th_dnv); ++ + #ifdef CONFIG_PHYS_ADDR_T_64BIT + + #define AMD_141b_MMIO_BASE(x) (0x80 + (x) * 0x8) +diff --git a/arch/xtensa/configs/smp_lx200_defconfig b/arch/xtensa/configs/smp_lx200_defconfig +index 11fed6c06a7c..b5938160fb3d 100644 +--- a/arch/xtensa/configs/smp_lx200_defconfig ++++ b/arch/xtensa/configs/smp_lx200_defconfig +@@ -33,6 +33,7 @@ CONFIG_SMP=y + CONFIG_HOTPLUG_CPU=y + # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set + # CONFIG_PCI is not set ++CONFIG_VECTORS_OFFSET=0x00002000 + CONFIG_XTENSA_PLATFORM_XTFPGA=y + CONFIG_CMDLINE_BOOL=y + CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=96M@0" +diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S +index 9053a5622d2c..5bd38ea2da38 100644 +--- a/arch/xtensa/kernel/head.S ++++ b/arch/xtensa/kernel/head.S +@@ -280,12 +280,13 @@ should_never_return: + + movi a2, cpu_start_ccount + 1: ++ memw + l32i a3, a2, 0 + beqi a3, 0, 1b + movi a3, 0 + s32i a3, a2, 0 +- memw + 1: ++ memw + l32i a3, a2, 0 + beqi a3, 0, 1b + wsr a3, ccount +@@ -321,11 +322,13 @@ ENTRY(cpu_restart) + rsr a0, prid + neg a2, a0 + movi a3, cpu_start_id ++ memw + s32i a2, a3, 0 + #if XCHAL_DCACHE_IS_WRITEBACK + dhwbi a3, 0 + #endif + 1: ++ memw + l32i a2, a3, 0 + dhi a3, 0 + bne a2, a0, 1b +diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c +index 932d64689bac..be1f280c322c 100644 +--- a/arch/xtensa/kernel/smp.c ++++ b/arch/xtensa/kernel/smp.c +@@ -83,7 +83,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus) + { + unsigned i; + +- for (i = 0; i < max_cpus; ++i) ++ for_each_possible_cpu(i) + set_cpu_present(i, true); + } + +@@ -96,6 +96,11 @@ void __init smp_init_cpus(void) + pr_info("%s: Core Count = %d\n", __func__, ncpus); + pr_info("%s: Core Id = %d\n", __func__, core_id); + ++ if (ncpus > NR_CPUS) { ++ ncpus = NR_CPUS; ++ pr_info("%s: limiting core count by %d\n", __func__, ncpus); ++ } ++ + for (i = 0; i < ncpus; ++i) + set_cpu_possible(i, true); + } +@@ -195,9 +200,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts) + int i; + + #ifdef CONFIG_HOTPLUG_CPU +- cpu_start_id = cpu; +- system_flush_invalidate_dcache_range( +- (unsigned long)&cpu_start_id, sizeof(cpu_start_id)); ++ WRITE_ONCE(cpu_start_id, cpu); ++ /* Pairs with the third memw in the cpu_restart */ ++ mb(); ++ system_flush_invalidate_dcache_range((unsigned long)&cpu_start_id, ++ sizeof(cpu_start_id)); + #endif + smp_call_function_single(0, mx_cpu_start, (void *)cpu, 1); + +@@ -206,18 +213,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts) + ccount = get_ccount(); + while (!ccount); + +- cpu_start_ccount = ccount; ++ WRITE_ONCE(cpu_start_ccount, ccount); + +- while (time_before(jiffies, timeout)) { ++ do { ++ /* ++ * Pairs with the first two memws in the ++ * .Lboot_secondary. ++ */ + mb(); +- if (!cpu_start_ccount) +- break; +- } ++ ccount = READ_ONCE(cpu_start_ccount); ++ } while (ccount && time_before(jiffies, timeout)); + +- if (cpu_start_ccount) { ++ if (ccount) { + smp_call_function_single(0, mx_cpu_stop, +- (void *)cpu, 1); +- cpu_start_ccount = 0; ++ (void *)cpu, 1); ++ WRITE_ONCE(cpu_start_ccount, 0); + return -EIO; + } + } +@@ -237,6 +247,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) + pr_debug("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n", + __func__, cpu, idle, start_info.stack); + ++ init_completion(&cpu_running); + ret = boot_secondary(cpu, idle); + if (ret == 0) { + wait_for_completion_timeout(&cpu_running, +@@ -298,8 +309,10 @@ void __cpu_die(unsigned int cpu) + unsigned long timeout = jiffies + msecs_to_jiffies(1000); + while (time_before(jiffies, timeout)) { + system_invalidate_dcache_range((unsigned long)&cpu_start_id, +- sizeof(cpu_start_id)); +- if (cpu_start_id == -cpu) { ++ sizeof(cpu_start_id)); ++ /* Pairs with the second memw in the cpu_restart */ ++ mb(); ++ if (READ_ONCE(cpu_start_id) == -cpu) { + platform_cpu_kill(cpu); + return; + } +diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c +index fd524a54d2ab..378186b5eb40 100644 +--- a/arch/xtensa/kernel/time.c ++++ b/arch/xtensa/kernel/time.c +@@ -89,7 +89,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt) + container_of(evt, struct ccount_timer, evt); + + if (timer->irq_enabled) { +- disable_irq(evt->irq); ++ disable_irq_nosync(evt->irq); + timer->irq_enabled = 0; + } + return 0; +diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c +index 19923f8a029d..b154e057ca67 100644 +--- a/block/blk-iolatency.c ++++ b/block/blk-iolatency.c +@@ -72,6 +72,7 @@ + #include + #include + #include ++#include + #include "blk-rq-qos.h" + #include "blk-stat.h" + +@@ -568,6 +569,9 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio) + return; + + enabled = blk_iolatency_enabled(iolat->blkiolat); ++ if (!enabled) ++ return; ++ + while (blkg && blkg->parent) { + iolat = blkg_to_lat(blkg); + if (!iolat) { +@@ -577,7 +581,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio) + rqw = &iolat->rq_wait; + + atomic_dec(&rqw->inflight); +- if (!enabled || iolat->min_lat_nsec == 0) ++ if (iolat->min_lat_nsec == 0) + goto next; + iolatency_record_time(iolat, &bio->bi_issue, now, + issue_as_root); +@@ -721,10 +725,13 @@ int blk_iolatency_init(struct request_queue *q) + return 0; + } + +-static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) ++/* ++ * return 1 for enabling iolatency, return -1 for disabling iolatency, otherwise ++ * return 0. ++ */ ++static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) + { + struct iolatency_grp *iolat = blkg_to_lat(blkg); +- struct blk_iolatency *blkiolat = iolat->blkiolat; + u64 oldval = iolat->min_lat_nsec; + + iolat->min_lat_nsec = val; +@@ -733,9 +740,10 @@ static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) + BLKIOLATENCY_MAX_WIN_SIZE); + + if (!oldval && val) +- atomic_inc(&blkiolat->enabled); ++ return 1; + if (oldval && !val) +- atomic_dec(&blkiolat->enabled); ++ return -1; ++ return 0; + } + + static void iolatency_clear_scaling(struct blkcg_gq *blkg) +@@ -768,6 +776,7 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, + u64 lat_val = 0; + u64 oldval; + int ret; ++ int enable = 0; + + ret = blkg_conf_prep(blkcg, &blkcg_policy_iolatency, buf, &ctx); + if (ret) +@@ -803,7 +812,12 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, + blkg = ctx.blkg; + oldval = iolat->min_lat_nsec; + +- iolatency_set_min_lat_nsec(blkg, lat_val); ++ enable = iolatency_set_min_lat_nsec(blkg, lat_val); ++ if (enable) { ++ WARN_ON_ONCE(!blk_get_queue(blkg->q)); ++ blkg_get(blkg); ++ } ++ + if (oldval != iolat->min_lat_nsec) { + iolatency_clear_scaling(blkg); + } +@@ -811,6 +825,24 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, + ret = 0; + out: + blkg_conf_finish(&ctx); ++ if (ret == 0 && enable) { ++ struct iolatency_grp *tmp = blkg_to_lat(blkg); ++ struct blk_iolatency *blkiolat = tmp->blkiolat; ++ ++ blk_mq_freeze_queue(blkg->q); ++ ++ if (enable == 1) ++ atomic_inc(&blkiolat->enabled); ++ else if (enable == -1) ++ atomic_dec(&blkiolat->enabled); ++ else ++ WARN_ON_ONCE(1); ++ ++ blk_mq_unfreeze_queue(blkg->q); ++ ++ blkg_put(blkg); ++ blk_put_queue(blkg->q); ++ } + return ret ?: nbytes; + } + +@@ -910,8 +942,14 @@ static void iolatency_pd_offline(struct blkg_policy_data *pd) + { + struct iolatency_grp *iolat = pd_to_lat(pd); + struct blkcg_gq *blkg = lat_to_blkg(iolat); ++ struct blk_iolatency *blkiolat = iolat->blkiolat; ++ int ret; + +- iolatency_set_min_lat_nsec(blkg, 0); ++ ret = iolatency_set_min_lat_nsec(blkg, 0); ++ if (ret == 1) ++ atomic_inc(&blkiolat->enabled); ++ if (ret == -1) ++ atomic_dec(&blkiolat->enabled); + iolatency_clear_scaling(blkg); + } + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 7caa1adaf62a..f5b74856784a 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -963,9 +963,9 @@ static void __device_release_driver(struct device *dev, struct device *parent) + drv->remove(dev); + + device_links_driver_cleanup(dev); +- dma_deconfigure(dev); + + devres_release_all(dev); ++ dma_deconfigure(dev); + dev->driver = NULL; + dev_set_drvdata(dev, NULL); + if (dev->pm_domain && dev->pm_domain->dismiss) +diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c +index fa1a196350f1..3bf11a620094 100644 +--- a/drivers/clk/qcom/gcc-sdm845.c ++++ b/drivers/clk/qcom/gcc-sdm845.c +@@ -131,8 +131,8 @@ static const char * const gcc_parent_names_6[] = { + "core_bi_pll_test_se", + }; + +-static const char * const gcc_parent_names_7[] = { +- "bi_tcxo", ++static const char * const gcc_parent_names_7_ao[] = { ++ "bi_tcxo_ao", + "gpll0", + "gpll0_out_even", + "core_bi_pll_test_se", +@@ -144,6 +144,12 @@ static const char * const gcc_parent_names_8[] = { + "core_bi_pll_test_se", + }; + ++static const char * const gcc_parent_names_8_ao[] = { ++ "bi_tcxo_ao", ++ "gpll0", ++ "core_bi_pll_test_se", ++}; ++ + static const struct parent_map gcc_parent_map_10[] = { + { P_BI_TCXO, 0 }, + { P_GPLL0_OUT_MAIN, 1 }, +@@ -226,7 +232,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = { + .freq_tbl = ftbl_gcc_cpuss_ahb_clk_src, + .clkr.hw.init = &(struct clk_init_data){ + .name = "gcc_cpuss_ahb_clk_src", +- .parent_names = gcc_parent_names_7, ++ .parent_names = gcc_parent_names_7_ao, + .num_parents = 4, + .ops = &clk_rcg2_ops, + }, +@@ -245,7 +251,7 @@ static struct clk_rcg2 gcc_cpuss_rbcpr_clk_src = { + .freq_tbl = ftbl_gcc_cpuss_rbcpr_clk_src, + .clkr.hw.init = &(struct clk_init_data){ + .name = "gcc_cpuss_rbcpr_clk_src", +- .parent_names = gcc_parent_names_8, ++ .parent_names = gcc_parent_names_8_ao, + .num_parents = 3, + .ops = &clk_rcg2_ops, + }, +diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c +index ccfb4d9a152a..079f0beda8b6 100644 +--- a/drivers/clk/ti/divider.c ++++ b/drivers/clk/ti/divider.c +@@ -367,8 +367,10 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div, + num_dividers = i; + + tmp = kcalloc(valid_div + 1, sizeof(*tmp), GFP_KERNEL); +- if (!tmp) ++ if (!tmp) { ++ *table = ERR_PTR(-ENOMEM); + return -ENOMEM; ++ } + + valid_div = 0; + *width = 0; +@@ -403,6 +405,7 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup) + { + struct clk_omap_divider *div; + struct clk_omap_reg *reg; ++ int ret; + + if (!setup) + return NULL; +@@ -422,6 +425,12 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup) + div->flags |= CLK_DIVIDER_POWER_OF_TWO; + + div->table = _get_div_table_from_setup(setup, &div->width); ++ if (IS_ERR(div->table)) { ++ ret = PTR_ERR(div->table); ++ kfree(div); ++ return ERR_PTR(ret); ++ } ++ + + div->shift = setup->bit_shift; + div->latch = -EINVAL; +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index 4bf72561667c..a75b95fac3bd 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -203,6 +203,7 @@ struct at_xdmac_chan { + u32 save_cim; + u32 save_cnda; + u32 save_cndc; ++ u32 irq_status; + unsigned long status; + struct tasklet_struct tasklet; + struct dma_slave_config sconfig; +@@ -1580,8 +1581,8 @@ static void at_xdmac_tasklet(unsigned long data) + struct at_xdmac_desc *desc; + u32 error_mask; + +- dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08lx\n", +- __func__, atchan->status); ++ dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08x\n", ++ __func__, atchan->irq_status); + + error_mask = AT_XDMAC_CIS_RBEIS + | AT_XDMAC_CIS_WBEIS +@@ -1589,15 +1590,15 @@ static void at_xdmac_tasklet(unsigned long data) + + if (at_xdmac_chan_is_cyclic(atchan)) { + at_xdmac_handle_cyclic(atchan); +- } else if ((atchan->status & AT_XDMAC_CIS_LIS) +- || (atchan->status & error_mask)) { ++ } else if ((atchan->irq_status & AT_XDMAC_CIS_LIS) ++ || (atchan->irq_status & error_mask)) { + struct dma_async_tx_descriptor *txd; + +- if (atchan->status & AT_XDMAC_CIS_RBEIS) ++ if (atchan->irq_status & AT_XDMAC_CIS_RBEIS) + dev_err(chan2dev(&atchan->chan), "read bus error!!!"); +- if (atchan->status & AT_XDMAC_CIS_WBEIS) ++ if (atchan->irq_status & AT_XDMAC_CIS_WBEIS) + dev_err(chan2dev(&atchan->chan), "write bus error!!!"); +- if (atchan->status & AT_XDMAC_CIS_ROIS) ++ if (atchan->irq_status & AT_XDMAC_CIS_ROIS) + dev_err(chan2dev(&atchan->chan), "request overflow error!!!"); + + spin_lock_bh(&atchan->lock); +@@ -1652,7 +1653,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id) + atchan = &atxdmac->chan[i]; + chan_imr = at_xdmac_chan_read(atchan, AT_XDMAC_CIM); + chan_status = at_xdmac_chan_read(atchan, AT_XDMAC_CIS); +- atchan->status = chan_status & chan_imr; ++ atchan->irq_status = chan_status & chan_imr; + dev_vdbg(atxdmac->dma.dev, + "%s: chan%d: imr=0x%x, status=0x%x\n", + __func__, i, chan_imr, chan_status); +@@ -1666,7 +1667,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id) + at_xdmac_chan_read(atchan, AT_XDMAC_CDA), + at_xdmac_chan_read(atchan, AT_XDMAC_CUBC)); + +- if (atchan->status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS)) ++ if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS)) + at_xdmac_write(atxdmac, AT_XDMAC_GD, atchan->mask); + + tasklet_schedule(&atchan->tasklet); +diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c +index aa1712beb0cc..7b7fba0c9253 100644 +--- a/drivers/dma/dmatest.c ++++ b/drivers/dma/dmatest.c +@@ -642,11 +642,9 @@ static int dmatest_func(void *data) + srcs[i] = um->addr[i] + src_off; + ret = dma_mapping_error(dev->dev, um->addr[i]); + if (ret) { +- dmaengine_unmap_put(um); + result("src mapping error", total_tests, + src_off, dst_off, len, ret); +- failed_tests++; +- continue; ++ goto error_unmap_continue; + } + um->to_cnt++; + } +@@ -661,11 +659,9 @@ static int dmatest_func(void *data) + DMA_BIDIRECTIONAL); + ret = dma_mapping_error(dev->dev, dsts[i]); + if (ret) { +- dmaengine_unmap_put(um); + result("dst mapping error", total_tests, + src_off, dst_off, len, ret); +- failed_tests++; +- continue; ++ goto error_unmap_continue; + } + um->bidi_cnt++; + } +@@ -693,12 +689,10 @@ static int dmatest_func(void *data) + } + + if (!tx) { +- dmaengine_unmap_put(um); + result("prep error", total_tests, src_off, + dst_off, len, ret); + msleep(100); +- failed_tests++; +- continue; ++ goto error_unmap_continue; + } + + done->done = false; +@@ -707,12 +701,10 @@ static int dmatest_func(void *data) + cookie = tx->tx_submit(tx); + + if (dma_submit_error(cookie)) { +- dmaengine_unmap_put(um); + result("submit error", total_tests, src_off, + dst_off, len, ret); + msleep(100); +- failed_tests++; +- continue; ++ goto error_unmap_continue; + } + dma_async_issue_pending(chan); + +@@ -725,16 +717,14 @@ static int dmatest_func(void *data) + dmaengine_unmap_put(um); + result("test timed out", total_tests, src_off, dst_off, + len, 0); +- failed_tests++; +- continue; ++ goto error_unmap_continue; + } else if (status != DMA_COMPLETE) { + dmaengine_unmap_put(um); + result(status == DMA_ERROR ? + "completion error status" : + "completion busy status", total_tests, src_off, + dst_off, len, ret); +- failed_tests++; +- continue; ++ goto error_unmap_continue; + } + + dmaengine_unmap_put(um); +@@ -779,6 +769,12 @@ static int dmatest_func(void *data) + verbose_result("test passed", total_tests, src_off, + dst_off, len, 0); + } ++ ++ continue; ++ ++error_unmap_continue: ++ dmaengine_unmap_put(um); ++ failed_tests++; + } + ktime = ktime_sub(ktime_get(), ktime); + ktime = ktime_sub(ktime, comparetime); +diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c +index 6bc8e6640d71..c51462f5aa1e 100644 +--- a/drivers/firmware/iscsi_ibft.c ++++ b/drivers/firmware/iscsi_ibft.c +@@ -542,6 +542,7 @@ static umode_t __init ibft_check_tgt_for(void *data, int type) + case ISCSI_BOOT_TGT_NIC_ASSOC: + case ISCSI_BOOT_TGT_CHAP_TYPE: + rc = S_IRUGO; ++ break; + case ISCSI_BOOT_TGT_NAME: + if (tgt->tgt_name_len) + rc = S_IRUGO; +diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c +index d4ad6d0e02a2..7e09ce75ffb2 100644 +--- a/drivers/gpio/gpio-vf610.c ++++ b/drivers/gpio/gpio-vf610.c +@@ -259,6 +259,7 @@ static int vf610_gpio_probe(struct platform_device *pdev) + struct vf610_gpio_port *port; + struct resource *iores; + struct gpio_chip *gc; ++ int i; + int ret; + + port = devm_kzalloc(&pdev->dev, sizeof(*port), GFP_KERNEL); +@@ -298,6 +299,10 @@ static int vf610_gpio_probe(struct platform_device *pdev) + if (ret < 0) + return ret; + ++ /* Mask all GPIO interrupts */ ++ for (i = 0; i < gc->ngpio; i++) ++ vf610_gpio_writel(0, port->base + PORT_PCR(i)); ++ + /* Clear the interrupt status register for all GPIO's */ + vf610_gpio_writel(~0, port->base + PORT_ISFR); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +index 7b4e657a95c7..c3df75a9f65d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +@@ -1443,7 +1443,8 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj, + effective_mode &= ~S_IWUSR; + + if ((adev->flags & AMD_IS_APU) && +- (attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr || ++ (attr == &sensor_dev_attr_power1_average.dev_attr.attr || ++ attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr || + attr == &sensor_dev_attr_power1_cap_min.dev_attr.attr|| + attr == &sensor_dev_attr_power1_cap.dev_attr.attr)) + return 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c +index 1c5d97f4b4dd..8dcf6227ab99 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c +@@ -37,6 +37,7 @@ + #include "amdgpu_display.h" + #include + #include ++#include + + static const struct dma_buf_ops amdgpu_dmabuf_ops; + +@@ -188,6 +189,48 @@ error: + return ERR_PTR(ret); + } + ++static int ++__reservation_object_make_exclusive(struct reservation_object *obj) ++{ ++ struct dma_fence **fences; ++ unsigned int count; ++ int r; ++ ++ if (!reservation_object_get_list(obj)) /* no shared fences to convert */ ++ return 0; ++ ++ r = reservation_object_get_fences_rcu(obj, NULL, &count, &fences); ++ if (r) ++ return r; ++ ++ if (count == 0) { ++ /* Now that was unexpected. */ ++ } else if (count == 1) { ++ reservation_object_add_excl_fence(obj, fences[0]); ++ dma_fence_put(fences[0]); ++ kfree(fences); ++ } else { ++ struct dma_fence_array *array; ++ ++ array = dma_fence_array_create(count, fences, ++ dma_fence_context_alloc(1), 0, ++ false); ++ if (!array) ++ goto err_fences_put; ++ ++ reservation_object_add_excl_fence(obj, &array->base); ++ dma_fence_put(&array->base); ++ } ++ ++ return 0; ++ ++err_fences_put: ++ while (count--) ++ dma_fence_put(fences[count]); ++ kfree(fences); ++ return -ENOMEM; ++} ++ + /** + * amdgpu_gem_map_attach - &dma_buf_ops.attach implementation + * @dma_buf: shared DMA buffer +@@ -219,16 +262,16 @@ static int amdgpu_gem_map_attach(struct dma_buf *dma_buf, + + if (attach->dev->driver != adev->dev->driver) { + /* +- * Wait for all shared fences to complete before we switch to future +- * use of exclusive fence on this prime shared bo. ++ * We only create shared fences for internal use, but importers ++ * of the dmabuf rely on exclusive fences for implicitly ++ * tracking write hazards. As any of the current fences may ++ * correspond to a write, we need to convert all existing ++ * fences on the reservation object into a single exclusive ++ * fence. + */ +- r = reservation_object_wait_timeout_rcu(bo->tbo.resv, +- true, false, +- MAX_SCHEDULE_TIMEOUT); +- if (unlikely(r < 0)) { +- DRM_DEBUG_PRIME("Fence wait failed: %li\n", r); ++ r = __reservation_object_make_exclusive(bo->tbo.resv); ++ if (r) + goto error_unreserve; +- } + } + + /* pin buffer into GTT */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 6a84526e20e0..49fe5084c53d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -3011,14 +3011,15 @@ void amdgpu_vm_get_task_info(struct amdgpu_device *adev, unsigned int pasid, + struct amdgpu_task_info *task_info) + { + struct amdgpu_vm *vm; ++ unsigned long flags; + +- spin_lock(&adev->vm_manager.pasid_lock); ++ spin_lock_irqsave(&adev->vm_manager.pasid_lock, flags); + + vm = idr_find(&adev->vm_manager.pasid_idr, pasid); + if (vm) + *task_info = vm->task_info; + +- spin_unlock(&adev->vm_manager.pasid_lock); ++ spin_unlock_irqrestore(&adev->vm_manager.pasid_lock, flags); + } + + /** +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index d587779a80b4..a97294ac96d5 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -5676,7 +5676,7 @@ int ci_dpm_init(struct radeon_device *rdev) + u16 data_offset, size; + u8 frev, crev; + struct ci_power_info *pi; +- enum pci_bus_speed speed_cap; ++ enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN; + struct pci_dev *root = rdev->pdev->bus->self; + int ret; + +@@ -5685,7 +5685,8 @@ int ci_dpm_init(struct radeon_device *rdev) + return -ENOMEM; + rdev->pm.dpm.priv = pi; + +- speed_cap = pcie_get_speed_cap(root); ++ if (!pci_is_root_bus(rdev->pdev->bus)) ++ speed_cap = pcie_get_speed_cap(root); + if (speed_cap == PCI_SPEED_UNKNOWN) { + pi->sys_pcie_mask = 0; + } else { +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 8fb60b3af015..0a785ef0ab66 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -6899,7 +6899,7 @@ int si_dpm_init(struct radeon_device *rdev) + struct ni_power_info *ni_pi; + struct si_power_info *si_pi; + struct atom_clock_dividers dividers; +- enum pci_bus_speed speed_cap; ++ enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN; + struct pci_dev *root = rdev->pdev->bus->self; + int ret; + +@@ -6911,7 +6911,8 @@ int si_dpm_init(struct radeon_device *rdev) + eg_pi = &ni_pi->eg; + pi = &eg_pi->rv7xx; + +- speed_cap = pcie_get_speed_cap(root); ++ if (!pci_is_root_bus(rdev->pdev->bus)) ++ speed_cap = pcie_get_speed_cap(root); + if (speed_cap == PCI_SPEED_UNKNOWN) { + si_pi->sys_pcie_mask = 0; + } else { +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c +index 3fb084f802e2..8c31c9ab06f8 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -672,6 +672,7 @@ static int sun4i_tcon_init_clocks(struct device *dev, + return PTR_ERR(tcon->sclk0); + } + } ++ clk_prepare_enable(tcon->sclk0); + + if (tcon->quirks->has_channel_1) { + tcon->sclk1 = devm_clk_get(dev, "tcon-ch1"); +@@ -686,6 +687,7 @@ static int sun4i_tcon_init_clocks(struct device *dev, + + static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon) + { ++ clk_disable_unprepare(tcon->sclk0); + clk_disable_unprepare(tcon->clk); + } + +diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c +index 65d06a819307..2ac86096ddd9 100644 +--- a/drivers/i2c/busses/i2c-omap.c ++++ b/drivers/i2c/busses/i2c-omap.c +@@ -1498,8 +1498,7 @@ static int omap_i2c_remove(struct platform_device *pdev) + return 0; + } + +-#ifdef CONFIG_PM +-static int omap_i2c_runtime_suspend(struct device *dev) ++static int __maybe_unused omap_i2c_runtime_suspend(struct device *dev) + { + struct omap_i2c_dev *omap = dev_get_drvdata(dev); + +@@ -1525,7 +1524,7 @@ static int omap_i2c_runtime_suspend(struct device *dev) + return 0; + } + +-static int omap_i2c_runtime_resume(struct device *dev) ++static int __maybe_unused omap_i2c_runtime_resume(struct device *dev) + { + struct omap_i2c_dev *omap = dev_get_drvdata(dev); + +@@ -1540,20 +1539,18 @@ static int omap_i2c_runtime_resume(struct device *dev) + } + + static const struct dev_pm_ops omap_i2c_pm_ops = { ++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, ++ pm_runtime_force_resume) + SET_RUNTIME_PM_OPS(omap_i2c_runtime_suspend, + omap_i2c_runtime_resume, NULL) + }; +-#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops) +-#else +-#define OMAP_I2C_PM_OPS NULL +-#endif /* CONFIG_PM */ + + static struct platform_driver omap_i2c_driver = { + .probe = omap_i2c_probe, + .remove = omap_i2c_remove, + .driver = { + .name = "omap_i2c", +- .pm = OMAP_I2C_PM_OPS, ++ .pm = &omap_i2c_pm_ops, + .of_match_table = of_match_ptr(omap_i2c_of_match), + }, + }; +diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c +index 70d39fc450a1..54eb69564264 100644 +--- a/drivers/infiniband/hw/hfi1/ud.c ++++ b/drivers/infiniband/hw/hfi1/ud.c +@@ -980,7 +980,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet) + opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { + wc.ex.imm_data = packet->ohdr->u.ud.imm_data; + wc.wc_flags = IB_WC_WITH_IMM; +- tlen -= sizeof(u32); + } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { + wc.ex.imm_data = 0; + wc.wc_flags = 0; +diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c +index f8d029a2390f..bce2b5cd3c7b 100644 +--- a/drivers/infiniband/hw/qib/qib_ud.c ++++ b/drivers/infiniband/hw/qib/qib_ud.c +@@ -513,7 +513,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr, + opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { + wc.ex.imm_data = ohdr->u.ud.imm_data; + wc.wc_flags = IB_WC_WITH_IMM; +- tlen -= sizeof(u32); + } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { + wc.ex.imm_data = 0; + wc.wc_flags = 0; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h +index 1abe3c62f106..b22d02c9de90 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib.h ++++ b/drivers/infiniband/ulp/ipoib/ipoib.h +@@ -248,7 +248,6 @@ struct ipoib_cm_tx { + struct list_head list; + struct net_device *dev; + struct ipoib_neigh *neigh; +- struct ipoib_path *path; + struct ipoib_tx_buf *tx_ring; + unsigned int tx_head; + unsigned int tx_tail; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index 0428e01e8f69..aa9dcfc36cd3 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -1312,7 +1312,6 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path + + neigh->cm = tx; + tx->neigh = neigh; +- tx->path = path; + tx->dev = dev; + list_add(&tx->list, &priv->cm.start_list); + set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags); +@@ -1371,7 +1370,7 @@ static void ipoib_cm_tx_start(struct work_struct *work) + neigh->daddr + QPN_AND_OPTIONS_OFFSET); + goto free_neigh; + } +- memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec)); ++ memcpy(&pathrec, &path->pathrec, sizeof(pathrec)); + + spin_unlock_irqrestore(&priv->lock, flags); + netif_tx_unlock_bh(dev); +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index 225ae6980182..628ef617bb2f 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1337,6 +1337,7 @@ static const struct acpi_device_id elan_acpi_id[] = { + { "ELAN0000", 0 }, + { "ELAN0100", 0 }, + { "ELAN0600", 0 }, ++ { "ELAN0601", 0 }, + { "ELAN0602", 0 }, + { "ELAN0605", 0 }, + { "ELAN0608", 0 }, +diff --git a/drivers/input/tablet/wacom_serial4.c b/drivers/input/tablet/wacom_serial4.c +index 38bfaca48eab..150f9eecaca7 100644 +--- a/drivers/input/tablet/wacom_serial4.c ++++ b/drivers/input/tablet/wacom_serial4.c +@@ -187,6 +187,7 @@ enum { + MODEL_DIGITIZER_II = 0x5544, /* UD */ + MODEL_GRAPHIRE = 0x4554, /* ET */ + MODEL_PENPARTNER = 0x4354, /* CT */ ++ MODEL_ARTPAD_II = 0x4B54, /* KT */ + }; + + static void wacom_handle_model_response(struct wacom *wacom) +@@ -245,6 +246,7 @@ static void wacom_handle_model_response(struct wacom *wacom) + wacom->flags = F_HAS_STYLUS2 | F_HAS_SCROLLWHEEL; + break; + ++ case MODEL_ARTPAD_II: + case MODEL_DIGITIZER_II: + wacom->dev->name = "Wacom Digitizer II"; + wacom->dev->id.version = MODEL_DIGITIZER_II; +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 34c9aa76a7bd..27500abe8ca7 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -1929,16 +1929,13 @@ static void do_attach(struct iommu_dev_data *dev_data, + + static void do_detach(struct iommu_dev_data *dev_data) + { ++ struct protection_domain *domain = dev_data->domain; + struct amd_iommu *iommu; + u16 alias; + + iommu = amd_iommu_rlookup_table[dev_data->devid]; + alias = dev_data->alias; + +- /* decrease reference counters */ +- dev_data->domain->dev_iommu[iommu->index] -= 1; +- dev_data->domain->dev_cnt -= 1; +- + /* Update data structures */ + dev_data->domain = NULL; + list_del(&dev_data->list); +@@ -1948,6 +1945,16 @@ static void do_detach(struct iommu_dev_data *dev_data) + + /* Flush the DTE entry */ + device_flush_dte(dev_data); ++ ++ /* Flush IOTLB */ ++ domain_flush_tlb_pde(domain); ++ ++ /* Wait for the flushes to finish */ ++ domain_flush_complete(domain); ++ ++ /* decrease reference counters - needs to happen after the flushes */ ++ domain->dev_iommu[iommu->index] -= 1; ++ domain->dev_cnt -= 1; + } + + /* +@@ -2555,13 +2562,13 @@ out_unmap: + bus_addr = address + s->dma_address + (j << PAGE_SHIFT); + iommu_unmap_page(domain, bus_addr, PAGE_SIZE); + +- if (--mapped_pages) ++ if (--mapped_pages == 0) + goto out_free_iova; + } + } + + out_free_iova: +- free_iova_fast(&dma_dom->iovad, address, npages); ++ free_iova_fast(&dma_dom->iovad, address >> PAGE_SHIFT, npages); + + out_err: + return 0; +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index 4c2246fe5dbe..15579cba1a88 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -1581,6 +1581,9 @@ static unsigned long *its_lpi_alloc(int nr_irqs, u32 *base, int *nr_ids) + nr_irqs /= 2; + } while (nr_irqs > 0); + ++ if (!nr_irqs) ++ err = -ENOSPC; ++ + if (err) + goto out; + +@@ -1951,6 +1954,29 @@ static void its_free_pending_table(struct page *pt) + get_order(max_t(u32, LPI_PENDBASE_SZ, SZ_64K))); + } + ++static u64 its_clear_vpend_valid(void __iomem *vlpi_base) ++{ ++ u32 count = 1000000; /* 1s! */ ++ bool clean; ++ u64 val; ++ ++ val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER); ++ val &= ~GICR_VPENDBASER_Valid; ++ gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER); ++ ++ do { ++ val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER); ++ clean = !(val & GICR_VPENDBASER_Dirty); ++ if (!clean) { ++ count--; ++ cpu_relax(); ++ udelay(1); ++ } ++ } while (!clean && count); ++ ++ return val; ++} ++ + static void its_cpu_init_lpis(void) + { + void __iomem *rbase = gic_data_rdist_rd_base(); +@@ -2024,6 +2050,30 @@ static void its_cpu_init_lpis(void) + val |= GICR_CTLR_ENABLE_LPIS; + writel_relaxed(val, rbase + GICR_CTLR); + ++ if (gic_rdists->has_vlpis) { ++ void __iomem *vlpi_base = gic_data_rdist_vlpi_base(); ++ ++ /* ++ * It's possible for CPU to receive VLPIs before it is ++ * sheduled as a vPE, especially for the first CPU, and the ++ * VLPI with INTID larger than 2^(IDbits+1) will be considered ++ * as out of range and dropped by GIC. ++ * So we initialize IDbits to known value to avoid VLPI drop. ++ */ ++ val = (LPI_NRBITS - 1) & GICR_VPROPBASER_IDBITS_MASK; ++ pr_debug("GICv4: CPU%d: Init IDbits to 0x%llx for GICR_VPROPBASER\n", ++ smp_processor_id(), val); ++ gits_write_vpropbaser(val, vlpi_base + GICR_VPROPBASER); ++ ++ /* ++ * Also clear Valid bit of GICR_VPENDBASER, in case some ++ * ancient programming gets left in and has possibility of ++ * corrupting memory. ++ */ ++ val = its_clear_vpend_valid(vlpi_base); ++ WARN_ON(val & GICR_VPENDBASER_Dirty); ++ } ++ + /* Make sure the GIC has seen the above */ + dsb(sy); + } +@@ -2644,26 +2694,11 @@ static void its_vpe_schedule(struct its_vpe *vpe) + static void its_vpe_deschedule(struct its_vpe *vpe) + { + void __iomem *vlpi_base = gic_data_rdist_vlpi_base(); +- u32 count = 1000000; /* 1s! */ +- bool clean; + u64 val; + +- /* We're being scheduled out */ +- val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER); +- val &= ~GICR_VPENDBASER_Valid; +- gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER); +- +- do { +- val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER); +- clean = !(val & GICR_VPENDBASER_Dirty); +- if (!clean) { +- count--; +- cpu_relax(); +- udelay(1); +- } +- } while (!clean && count); ++ val = its_clear_vpend_valid(vlpi_base); + +- if (unlikely(!clean && !count)) { ++ if (unlikely(val & GICR_VPENDBASER_Dirty)) { + pr_err_ratelimited("ITS virtual pending table not cleaning\n"); + vpe->idai = false; + vpe->pending_last = true; +diff --git a/drivers/irqchip/irq-mmp.c b/drivers/irqchip/irq-mmp.c +index 25f32e1d7764..3496b61a312a 100644 +--- a/drivers/irqchip/irq-mmp.c ++++ b/drivers/irqchip/irq-mmp.c +@@ -34,6 +34,9 @@ + #define SEL_INT_PENDING (1 << 6) + #define SEL_INT_NUM_MASK 0x3f + ++#define MMP2_ICU_INT_ROUTE_PJ4_IRQ (1 << 5) ++#define MMP2_ICU_INT_ROUTE_PJ4_FIQ (1 << 6) ++ + struct icu_chip_data { + int nr_irqs; + unsigned int virq_base; +@@ -190,7 +193,8 @@ static const struct mmp_intc_conf mmp_conf = { + static const struct mmp_intc_conf mmp2_conf = { + .conf_enable = 0x20, + .conf_disable = 0x0, +- .conf_mask = 0x7f, ++ .conf_mask = MMP2_ICU_INT_ROUTE_PJ4_IRQ | ++ MMP2_ICU_INT_ROUTE_PJ4_FIQ, + }; + + static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs) +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 361abbc00486..6f1fd40fce10 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -1065,11 +1065,19 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return -EINVAL; + } + +- /* Make sure the terminal type MSB is not null, otherwise it +- * could be confused with a unit. ++ /* ++ * Reject invalid terminal types that would cause issues: ++ * ++ * - The high byte must be non-zero, otherwise it would be ++ * confused with a unit. ++ * ++ * - Bit 15 must be 0, as we use it internally as a terminal ++ * direction flag. ++ * ++ * Other unknown types are accepted. + */ + type = get_unaligned_le16(&buffer[4]); +- if ((type & 0xff00) == 0) { ++ if ((type & 0x7f00) == 0 || (type & 0x8000) != 0) { + uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " + "interface %d INPUT_TERMINAL %d has invalid " + "type 0x%04x, skipping\n", udev->devnum, +diff --git a/drivers/net/ethernet/altera/altera_msgdma.c b/drivers/net/ethernet/altera/altera_msgdma.c +index 0fb986ba3290..0ae723f75341 100644 +--- a/drivers/net/ethernet/altera/altera_msgdma.c ++++ b/drivers/net/ethernet/altera/altera_msgdma.c +@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv) + & 0xffff; + + if (inuse) { /* Tx FIFO is not empty */ +- ready = priv->tx_prod - priv->tx_cons - inuse - 1; ++ ready = max_t(int, ++ priv->tx_prod - priv->tx_cons - inuse - 1, 0); + } else { + /* Check for buffered last packet */ + status = csrrd32(priv->tx_dma_csr, msgdma_csroffs(status)); +diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h +index 3d45f4c92cf6..9bbaad9f3d63 100644 +--- a/drivers/net/ethernet/cadence/macb.h ++++ b/drivers/net/ethernet/cadence/macb.h +@@ -643,6 +643,7 @@ + #define MACB_CAPS_JUMBO 0x00000020 + #define MACB_CAPS_GEM_HAS_PTP 0x00000040 + #define MACB_CAPS_BD_RD_PREFETCH 0x00000080 ++#define MACB_CAPS_NEEDS_RSTONUBR 0x00000100 + #define MACB_CAPS_FIFO_MODE 0x10000000 + #define MACB_CAPS_GIGABIT_MODE_AVAILABLE 0x20000000 + #define MACB_CAPS_SG_DISABLED 0x40000000 +@@ -1214,6 +1215,8 @@ struct macb { + + int rx_bd_rd_prefetch; + int tx_bd_rd_prefetch; ++ ++ u32 rx_intr_mask; + }; + + #ifdef CONFIG_MACB_USE_HWSTAMP +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 8f4b2f9a8e07..8abea1c3844f 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -56,8 +56,7 @@ + /* level of occupied TX descriptors under which we wake up TX process */ + #define MACB_TX_WAKEUP_THRESH(bp) (3 * (bp)->tx_ring_size / 4) + +-#define MACB_RX_INT_FLAGS (MACB_BIT(RCOMP) | MACB_BIT(RXUBR) \ +- | MACB_BIT(ISR_ROVR)) ++#define MACB_RX_INT_FLAGS (MACB_BIT(RCOMP) | MACB_BIT(ISR_ROVR)) + #define MACB_TX_ERR_FLAGS (MACB_BIT(ISR_TUND) \ + | MACB_BIT(ISR_RLE) \ + | MACB_BIT(TXERR)) +@@ -1271,7 +1270,7 @@ static int macb_poll(struct napi_struct *napi, int budget) + queue_writel(queue, ISR, MACB_BIT(RCOMP)); + napi_reschedule(napi); + } else { +- queue_writel(queue, IER, MACB_RX_INT_FLAGS); ++ queue_writel(queue, IER, bp->rx_intr_mask); + } + } + +@@ -1289,7 +1288,7 @@ static void macb_hresp_error_task(unsigned long data) + u32 ctrl; + + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { +- queue_writel(queue, IDR, MACB_RX_INT_FLAGS | ++ queue_writel(queue, IDR, bp->rx_intr_mask | + MACB_TX_INT_FLAGS | + MACB_BIT(HRESP)); + } +@@ -1319,7 +1318,7 @@ static void macb_hresp_error_task(unsigned long data) + + /* Enable interrupts */ + queue_writel(queue, IER, +- MACB_RX_INT_FLAGS | ++ bp->rx_intr_mask | + MACB_TX_INT_FLAGS | + MACB_BIT(HRESP)); + } +@@ -1373,14 +1372,14 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id) + (unsigned int)(queue - bp->queues), + (unsigned long)status); + +- if (status & MACB_RX_INT_FLAGS) { ++ if (status & bp->rx_intr_mask) { + /* There's no point taking any more interrupts + * until we have processed the buffers. The + * scheduling call may fail if the poll routine + * is already scheduled, so disable interrupts + * now. + */ +- queue_writel(queue, IDR, MACB_RX_INT_FLAGS); ++ queue_writel(queue, IDR, bp->rx_intr_mask); + if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE) + queue_writel(queue, ISR, MACB_BIT(RCOMP)); + +@@ -1413,8 +1412,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id) + /* There is a hardware issue under heavy load where DMA can + * stop, this causes endless "used buffer descriptor read" + * interrupts but it can be cleared by re-enabling RX. See +- * the at91 manual, section 41.3.1 or the Zynq manual +- * section 16.7.4 for details. ++ * the at91rm9200 manual, section 41.3.1 or the Zynq manual ++ * section 16.7.4 for details. RXUBR is only enabled for ++ * these two versions. + */ + if (status & MACB_BIT(RXUBR)) { + ctrl = macb_readl(bp, NCR); +@@ -2264,7 +2264,7 @@ static void macb_init_hw(struct macb *bp) + + /* Enable interrupts */ + queue_writel(queue, IER, +- MACB_RX_INT_FLAGS | ++ bp->rx_intr_mask | + MACB_TX_INT_FLAGS | + MACB_BIT(HRESP)); + } +@@ -3912,6 +3912,7 @@ static const struct macb_config sama5d4_config = { + }; + + static const struct macb_config emac_config = { ++ .caps = MACB_CAPS_NEEDS_RSTONUBR, + .clk_init = at91ether_clk_init, + .init = at91ether_init, + }; +@@ -3933,7 +3934,8 @@ static const struct macb_config zynqmp_config = { + }; + + static const struct macb_config zynq_config = { +- .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF, ++ .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF | ++ MACB_CAPS_NEEDS_RSTONUBR, + .dma_burst_length = 16, + .clk_init = macb_clk_init, + .init = macb_init, +@@ -4088,6 +4090,10 @@ static int macb_probe(struct platform_device *pdev) + macb_dma_desc_get_size(bp); + } + ++ bp->rx_intr_mask = MACB_RX_INT_FLAGS; ++ if (bp->caps & MACB_CAPS_NEEDS_RSTONUBR) ++ bp->rx_intr_mask |= MACB_BIT(RXUBR); ++ + mac = of_get_mac_address(np); + if (mac) { + ether_addr_copy(bp->dev->dev_addr, mac); +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 6242249c9f4c..b043370c2685 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -2419,6 +2419,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev) + out_notify_fail: + (void)cancel_work_sync(&priv->service_task); + out_read_prop_fail: ++ /* safe for ACPI FW */ ++ of_node_put(to_of_node(priv->fwnode)); + free_netdev(ndev); + return ret; + } +@@ -2448,6 +2450,9 @@ static int hns_nic_dev_remove(struct platform_device *pdev) + set_bit(NIC_STATE_REMOVING, &priv->state); + (void)cancel_work_sync(&priv->service_task); + ++ /* safe for ACPI FW */ ++ of_node_put(to_of_node(priv->fwnode)); ++ + free_netdev(ndev); + return 0; + } +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +index 774beda040a1..e2710ff48fb0 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -1157,16 +1157,18 @@ static int hns_get_regs_len(struct net_device *net_dev) + */ + static int hns_nic_nway_reset(struct net_device *netdev) + { +- int ret = 0; + struct phy_device *phy = netdev->phydev; + +- if (netif_running(netdev)) { +- /* if autoneg is disabled, don't restart auto-negotiation */ +- if (phy && phy->autoneg == AUTONEG_ENABLE) +- ret = genphy_restart_aneg(phy); +- } ++ if (!netif_running(netdev)) ++ return 0; + +- return ret; ++ if (!phy) ++ return -EOPNOTSUPP; ++ ++ if (phy->autoneg != AUTONEG_ENABLE) ++ return -EINVAL; ++ ++ return genphy_restart_aneg(phy); + } + + static u32 +diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c +index 017e08452d8c..baf5cc251f32 100644 +--- a/drivers/net/ethernet/hisilicon/hns_mdio.c ++++ b/drivers/net/ethernet/hisilicon/hns_mdio.c +@@ -321,7 +321,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum) + } + + hns_mdio_cmd_write(mdio_dev, is_c45, +- MDIO_C45_WRITE_ADDR, phy_id, devad); ++ MDIO_C45_READ, phy_id, devad); + } + + /* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/ +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c +index 2f69ee9221c6..4dd82a1612aa 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -473,19 +473,19 @@ static void qed_init_qm_pq(struct qed_hwfn *p_hwfn, + + /* get pq index according to PQ_FLAGS */ + static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn, +- u32 pq_flags) ++ unsigned long pq_flags) + { + struct qed_qm_info *qm_info = &p_hwfn->qm_info; + + /* Can't have multiple flags set here */ +- if (bitmap_weight((unsigned long *)&pq_flags, ++ if (bitmap_weight(&pq_flags, + sizeof(pq_flags) * BITS_PER_BYTE) > 1) { +- DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags); ++ DP_ERR(p_hwfn, "requested multiple pq flags 0x%lx\n", pq_flags); + goto err; + } + + if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) { +- DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags); ++ DP_ERR(p_hwfn, "pq flag 0x%lx is not set\n", pq_flags); + goto err; + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c +index 67c02ea93906..64ac95ca4df2 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c +@@ -609,6 +609,10 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn, + (!!(accept_filter & QED_ACCEPT_MCAST_MATCHED) && + !!(accept_filter & QED_ACCEPT_MCAST_UNMATCHED))); + ++ SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL, ++ (!!(accept_filter & QED_ACCEPT_UCAST_MATCHED) && ++ !!(accept_filter & QED_ACCEPT_UCAST_UNMATCHED))); ++ + SET_FIELD(state, ETH_VPORT_TX_MODE_BCAST_ACCEPT_ALL, + !!(accept_filter & QED_ACCEPT_BCAST)); + +@@ -744,6 +748,11 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn, + return rc; + } + ++ if (p_params->update_ctl_frame_check) { ++ p_cmn->ctl_frame_mac_check_en = p_params->mac_chk_en; ++ p_cmn->ctl_frame_ethtype_check_en = p_params->ethtype_chk_en; ++ } ++ + /* Update mcast bins for VFs, PF doesn't use this functionality */ + qed_sp_update_mcast_bin(p_hwfn, p_ramrod, p_params); + +@@ -2207,7 +2216,7 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev, + u16 num_queues = 0; + + /* Since the feature controls only queue-zones, +- * make sure we have the contexts [rx, tx, xdp] to ++ * make sure we have the contexts [rx, xdp, tcs] to + * match. + */ + for_each_hwfn(cdev, i) { +@@ -2217,7 +2226,8 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev, + u16 cids; + + cids = hwfn->pf_params.eth_pf_params.num_cons; +- num_queues += min_t(u16, l2_queues, cids / 3); ++ cids /= (2 + info->num_tc); ++ num_queues += min_t(u16, l2_queues, cids); + } + + /* queues might theoretically be >256, but interrupts' +@@ -2688,7 +2698,8 @@ static int qed_configure_filter_rx_mode(struct qed_dev *cdev, + if (type == QED_FILTER_RX_MODE_TYPE_PROMISC) { + accept_flags.rx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED | + QED_ACCEPT_MCAST_UNMATCHED; +- accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED; ++ accept_flags.tx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED | ++ QED_ACCEPT_MCAST_UNMATCHED; + } else if (type == QED_FILTER_RX_MODE_TYPE_MULTI_PROMISC) { + accept_flags.rx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED; + accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED; +diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.h b/drivers/net/ethernet/qlogic/qed/qed_l2.h +index 8d80f1095d17..7127d5aaac42 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_l2.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.h +@@ -219,6 +219,9 @@ struct qed_sp_vport_update_params { + struct qed_rss_params *rss_params; + struct qed_filter_accept_flags accept_flags; + struct qed_sge_tpa_params *sge_tpa_params; ++ u8 update_ctl_frame_check; ++ u8 mac_chk_en; ++ u8 ethtype_chk_en; + }; + + int qed_sp_vport_update(struct qed_hwfn *p_hwfn, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +index 92cd8abeb41d..015de1e0addd 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +@@ -2430,19 +2430,24 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb, + { + struct qed_ll2_tx_pkt_info pkt; + const skb_frag_t *frag; ++ u8 flags = 0, nr_frags; + int rc = -EINVAL, i; + dma_addr_t mapping; + u16 vlan = 0; +- u8 flags = 0; + + if (unlikely(skb->ip_summed != CHECKSUM_NONE)) { + DP_INFO(cdev, "Cannot transmit a checksummed packet\n"); + return -EINVAL; + } + +- if (1 + skb_shinfo(skb)->nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) { ++ /* Cache number of fragments from SKB since SKB may be freed by ++ * the completion routine after calling qed_ll2_prepare_tx_packet() ++ */ ++ nr_frags = skb_shinfo(skb)->nr_frags; ++ ++ if (1 + nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) { + DP_ERR(cdev, "Cannot transmit a packet with %d fragments\n", +- 1 + skb_shinfo(skb)->nr_frags); ++ 1 + nr_frags); + return -EINVAL; + } + +@@ -2464,7 +2469,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb, + } + + memset(&pkt, 0, sizeof(pkt)); +- pkt.num_of_bds = 1 + skb_shinfo(skb)->nr_frags; ++ pkt.num_of_bds = 1 + nr_frags; + pkt.vlan = vlan; + pkt.bd_flags = flags; + pkt.tx_dest = QED_LL2_TX_DEST_NW; +@@ -2475,12 +2480,17 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb, + test_bit(QED_LL2_XMIT_FLAGS_FIP_DISCOVERY, &xmit_flags)) + pkt.remove_stag = true; + ++ /* qed_ll2_prepare_tx_packet() may actually send the packet if ++ * there are no fragments in the skb and subsequently the completion ++ * routine may run and free the SKB, so no dereferencing the SKB ++ * beyond this point unless skb has any fragments. ++ */ + rc = qed_ll2_prepare_tx_packet(&cdev->hwfns[0], cdev->ll2->handle, + &pkt, 1); + if (rc) + goto err; + +- for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) { ++ for (i = 0; i < nr_frags; i++) { + frag = &skb_shinfo(skb)->frags[i]; + + mapping = skb_frag_dma_map(&cdev->pdev->dev, frag, 0, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h +index 3157c0d99441..dae2896e1d8e 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h +@@ -380,6 +380,7 @@ void qed_consq_setup(struct qed_hwfn *p_hwfn); + * @param p_hwfn + */ + void qed_consq_free(struct qed_hwfn *p_hwfn); ++int qed_spq_pend_post(struct qed_hwfn *p_hwfn); + + /** + * @file +diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c +index 7106ad17afe2..a0ee847f379b 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c +@@ -402,6 +402,11 @@ int qed_eq_completion(struct qed_hwfn *p_hwfn, void *cookie) + + qed_eq_prod_update(p_hwfn, qed_chain_get_prod_idx(p_chain)); + ++ /* Attempt to post pending requests */ ++ spin_lock_bh(&p_hwfn->p_spq->lock); ++ rc = qed_spq_pend_post(p_hwfn); ++ spin_unlock_bh(&p_hwfn->p_spq->lock); ++ + return rc; + } + +@@ -745,7 +750,7 @@ static int qed_spq_post_list(struct qed_hwfn *p_hwfn, + return 0; + } + +-static int qed_spq_pend_post(struct qed_hwfn *p_hwfn) ++int qed_spq_pend_post(struct qed_hwfn *p_hwfn) + { + struct qed_spq *p_spq = p_hwfn->p_spq; + struct qed_spq_entry *p_ent = NULL; +@@ -883,7 +888,6 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, + struct qed_spq_entry *p_ent = NULL; + struct qed_spq_entry *tmp; + struct qed_spq_entry *found = NULL; +- int rc; + + if (!p_hwfn) + return -EINVAL; +@@ -941,12 +945,7 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, + */ + qed_spq_return_entry(p_hwfn, found); + +- /* Attempt to post pending requests */ +- spin_lock_bh(&p_spq->lock); +- rc = qed_spq_pend_post(p_hwfn); +- spin_unlock_bh(&p_spq->lock); +- +- return rc; ++ return 0; + } + + int qed_consq_alloc(struct qed_hwfn *p_hwfn) +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index ca6290fa0f30..71a7af134dd8 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -1969,7 +1969,9 @@ static void qed_iov_vf_mbx_start_vport(struct qed_hwfn *p_hwfn, + params.vport_id = vf->vport_id; + params.max_buffers_per_cqe = start->max_buffers_per_cqe; + params.mtu = vf->mtu; +- params.check_mac = true; ++ ++ /* Non trusted VFs should enable control frame filtering */ ++ params.check_mac = !vf->p_vf_info.is_trusted_configured; + + rc = qed_sp_eth_vport_start(p_hwfn, ¶ms); + if (rc) { +@@ -5130,6 +5132,9 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + params.opaque_fid = vf->opaque_fid; + params.vport_id = vf->vport_id; + ++ params.update_ctl_frame_check = 1; ++ params.mac_chk_en = !vf_info->is_trusted_configured; ++ + if (vf_info->rx_accept_mode & mask) { + flags->update_rx_mode_config = 1; + flags->rx_accept_filter = vf_info->rx_accept_mode; +@@ -5147,7 +5152,8 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + } + + if (flags->update_rx_mode_config || +- flags->update_tx_mode_config) ++ flags->update_tx_mode_config || ++ params.update_ctl_frame_check) + qed_sp_vport_update(hwfn, ¶ms, + QED_SPQ_MODE_EBLOCK, NULL); + } +diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c +index be118d057b92..6ab3fb008139 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c +@@ -261,6 +261,7 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn) + struct pfvf_acquire_resp_tlv *resp = &p_iov->pf2vf_reply->acquire_resp; + struct pf_vf_pfdev_info *pfdev_info = &resp->pfdev_info; + struct vf_pf_resc_request *p_resc; ++ u8 retry_cnt = VF_ACQUIRE_THRESH; + bool resources_acquired = false; + struct vfpf_acquire_tlv *req; + int rc = 0, attempts = 0; +@@ -314,6 +315,15 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn) + + /* send acquire request */ + rc = qed_send_msg2pf(p_hwfn, &resp->hdr.status, sizeof(*resp)); ++ ++ /* Re-try acquire in case of vf-pf hw channel timeout */ ++ if (retry_cnt && rc == -EBUSY) { ++ DP_VERBOSE(p_hwfn, QED_MSG_IOV, ++ "VF retrying to acquire due to VPC timeout\n"); ++ retry_cnt--; ++ continue; ++ } ++ + if (rc) + goto exit; + +diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h +index 6a4d266fb8e2..d242a5724069 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede.h ++++ b/drivers/net/ethernet/qlogic/qede/qede.h +@@ -489,6 +489,9 @@ struct qede_reload_args { + + /* Datapath functions definition */ + netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev); ++u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb, ++ struct net_device *sb_dev, ++ select_queue_fallback_t fallback); + netdev_features_t qede_features_check(struct sk_buff *skb, + struct net_device *dev, + netdev_features_t features); +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index 1a78027de071..a96da16f3404 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -1695,6 +1695,19 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev) + return NETDEV_TX_OK; + } + ++u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb, ++ struct net_device *sb_dev, ++ select_queue_fallback_t fallback) ++{ ++ struct qede_dev *edev = netdev_priv(dev); ++ int total_txq; ++ ++ total_txq = QEDE_TSS_COUNT(edev) * edev->dev_info.num_tc; ++ ++ return QEDE_TSS_COUNT(edev) ? ++ fallback(dev, skb, NULL) % total_txq : 0; ++} ++ + /* 8B udp header + 8B base tunnel header + 32B option length */ + #define QEDE_MAX_TUN_HDR_LEN 48 + +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index 46d0f2eaa0c0..f3d9c40c4115 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -631,6 +631,7 @@ static const struct net_device_ops qede_netdev_ops = { + .ndo_open = qede_open, + .ndo_stop = qede_close, + .ndo_start_xmit = qede_start_xmit, ++ .ndo_select_queue = qede_select_queue, + .ndo_set_rx_mode = qede_set_rx_mode, + .ndo_set_mac_address = qede_set_mac_addr, + .ndo_validate_addr = eth_validate_addr, +@@ -666,6 +667,7 @@ static const struct net_device_ops qede_netdev_vf_ops = { + .ndo_open = qede_open, + .ndo_stop = qede_close, + .ndo_start_xmit = qede_start_xmit, ++ .ndo_select_queue = qede_select_queue, + .ndo_set_rx_mode = qede_set_rx_mode, + .ndo_set_mac_address = qede_set_mac_addr, + .ndo_validate_addr = eth_validate_addr, +@@ -684,6 +686,7 @@ static const struct net_device_ops qede_netdev_vf_xdp_ops = { + .ndo_open = qede_open, + .ndo_stop = qede_close, + .ndo_start_xmit = qede_start_xmit, ++ .ndo_select_queue = qede_select_queue, + .ndo_set_rx_mode = qede_set_rx_mode, + .ndo_set_mac_address = qede_set_mac_addr, + .ndo_validate_addr = eth_validate_addr, +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +index 7b923362ee55..3b174eae77c1 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +@@ -1342,8 +1342,10 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv) + } + + ret = phy_power_on(bsp_priv, true); +- if (ret) ++ if (ret) { ++ gmac_clk_enable(bsp_priv, false); + return ret; ++ } + + pm_runtime_enable(dev); + pm_runtime_get_sync(dev); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +index 9caf79ba5ef1..4d5fb4b51cc4 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +@@ -719,8 +719,11 @@ static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv) + { + unsigned long clk = clk_get_rate(priv->plat->stmmac_clk); + +- if (!clk) +- return 0; ++ if (!clk) { ++ clk = priv->plat->clk_ref_rate; ++ if (!clk) ++ return 0; ++ } + + return (usec * (clk / 1000000)) / 256; + } +@@ -729,8 +732,11 @@ static u32 stmmac_riwt2usec(u32 riwt, struct stmmac_priv *priv) + { + unsigned long clk = clk_get_rate(priv->plat->stmmac_clk); + +- if (!clk) +- return 0; ++ if (!clk) { ++ clk = priv->plat->clk_ref_rate; ++ if (!clk) ++ return 0; ++ } + + return (riwt * 256) / (clk / 1000000); + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 123b74e25ed8..43ab9e905bed 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -3028,10 +3028,22 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + + tx_q = &priv->tx_queue[queue]; + ++ if (priv->tx_path_in_lpi_mode) ++ stmmac_disable_eee_mode(priv); ++ + /* Manage oversized TCP frames for GMAC4 device */ + if (skb_is_gso(skb) && priv->tso) { +- if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) ++ if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) { ++ /* ++ * There is no way to determine the number of TSO ++ * capable Queues. Let's use always the Queue 0 ++ * because if TSO is supported then at least this ++ * one will be capable. ++ */ ++ skb_set_queue_mapping(skb, 0); ++ + return stmmac_tso_xmit(skb, dev); ++ } + } + + if (unlikely(stmmac_tx_avail(priv, queue) < nfrags + 1)) { +@@ -3046,9 +3058,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_BUSY; + } + +- if (priv->tx_path_in_lpi_mode) +- stmmac_disable_eee_mode(priv); +- + entry = tx_q->cur_tx; + first_entry = entry; + WARN_ON(tx_q->tx_skbuff[first_entry]); +diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c +index c070a9e51ebf..fae572b38416 100644 +--- a/drivers/net/wireless/ath/ath9k/init.c ++++ b/drivers/net/wireless/ath/ath9k/init.c +@@ -636,15 +636,15 @@ static int ath9k_of_init(struct ath_softc *sc) + ret = ath9k_eeprom_request(sc, eeprom_name); + if (ret) + return ret; ++ ++ ah->ah_flags &= ~AH_USE_EEPROM; ++ ah->ah_flags |= AH_NO_EEP_SWAP; + } + + mac = of_get_mac_address(np); + if (mac) + ether_addr_copy(common->macaddr, mac); + +- ah->ah_flags &= ~AH_USE_EEPROM; +- ah->ah_flags |= AH_NO_EEP_SWAP; +- + return 0; + } + +diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c +index 750bea3574ee..627df164b7b6 100644 +--- a/drivers/net/wireless/ti/wlcore/sdio.c ++++ b/drivers/net/wireless/ti/wlcore/sdio.c +@@ -164,6 +164,12 @@ static int wl12xx_sdio_power_on(struct wl12xx_sdio_glue *glue) + } + + sdio_claim_host(func); ++ /* ++ * To guarantee that the SDIO card is power cycled, as required to make ++ * the FW programming to succeed, let's do a brute force HW reset. ++ */ ++ mmc_hw_reset(card->host); ++ + sdio_enable_func(func); + sdio_release_host(func); + +@@ -174,20 +180,13 @@ static int wl12xx_sdio_power_off(struct wl12xx_sdio_glue *glue) + { + struct sdio_func *func = dev_to_sdio_func(glue->dev); + struct mmc_card *card = func->card; +- int error; + + sdio_claim_host(func); + sdio_disable_func(func); + sdio_release_host(func); + + /* Let runtime PM know the card is powered off */ +- error = pm_runtime_put(&card->dev); +- if (error < 0 && error != -EBUSY) { +- dev_err(&card->dev, "%s failed: %i\n", __func__, error); +- +- return error; +- } +- ++ pm_runtime_put(&card->dev); + return 0; + } + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index e0d2b7473901..2cdb3032ca0f 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1182,6 +1182,7 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns, + * effects say only one namespace is affected. + */ + if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) { ++ mutex_lock(&ctrl->scan_lock); + nvme_start_freeze(ctrl); + nvme_wait_freeze(ctrl); + } +@@ -1210,8 +1211,10 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects) + */ + if (effects & NVME_CMD_EFFECTS_LBCC) + nvme_update_formats(ctrl); +- if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) ++ if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) { + nvme_unfreeze(ctrl); ++ mutex_unlock(&ctrl->scan_lock); ++ } + if (effects & NVME_CMD_EFFECTS_CCC) + nvme_init_identify(ctrl); + if (effects & (NVME_CMD_EFFECTS_NIC | NVME_CMD_EFFECTS_NCC)) +@@ -3292,6 +3295,7 @@ static void nvme_scan_work(struct work_struct *work) + if (nvme_identify_ctrl(ctrl, &id)) + return; + ++ mutex_lock(&ctrl->scan_lock); + nn = le32_to_cpu(id->nn); + if (ctrl->vs >= NVME_VS(1, 1, 0) && + !(ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)) { +@@ -3300,6 +3304,7 @@ static void nvme_scan_work(struct work_struct *work) + } + nvme_scan_ns_sequential(ctrl, nn); + out_free_id: ++ mutex_unlock(&ctrl->scan_lock); + kfree(id); + down_write(&ctrl->namespaces_rwsem); + list_sort(NULL, &ctrl->namespaces, ns_cmp); +@@ -3535,6 +3540,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + + ctrl->state = NVME_CTRL_NEW; + spin_lock_init(&ctrl->lock); ++ mutex_init(&ctrl->scan_lock); + INIT_LIST_HEAD(&ctrl->namespaces); + init_rwsem(&ctrl->namespaces_rwsem); + ctrl->dev = dev; +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 60220de2db52..e82cdaec81c9 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -148,6 +148,7 @@ struct nvme_ctrl { + enum nvme_ctrl_state state; + bool identified; + spinlock_t lock; ++ struct mutex scan_lock; + const struct nvme_ctrl_ops *ops; + struct request_queue *admin_q; + struct request_queue *connect_q; +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index f46313f441ec..7b9ef8e734e7 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2260,27 +2260,18 @@ static void nvme_reset_work(struct work_struct *work) + if (dev->ctrl.ctrl_config & NVME_CC_ENABLE) + nvme_dev_disable(dev, false); + +- /* +- * Introduce CONNECTING state from nvme-fc/rdma transports to mark the +- * initializing procedure here. +- */ +- if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) { +- dev_warn(dev->ctrl.device, +- "failed to mark controller CONNECTING\n"); +- goto out; +- } +- ++ mutex_lock(&dev->shutdown_lock); + result = nvme_pci_enable(dev); + if (result) +- goto out; ++ goto out_unlock; + + result = nvme_pci_configure_admin_queue(dev); + if (result) +- goto out; ++ goto out_unlock; + + result = nvme_alloc_admin_tags(dev); + if (result) +- goto out; ++ goto out_unlock; + + /* + * Limit the max command size to prevent iod->sg allocations going +@@ -2288,6 +2279,17 @@ static void nvme_reset_work(struct work_struct *work) + */ + dev->ctrl.max_hw_sectors = NVME_MAX_KB_SZ << 1; + dev->ctrl.max_segments = NVME_MAX_SEGS; ++ mutex_unlock(&dev->shutdown_lock); ++ ++ /* ++ * Introduce CONNECTING state from nvme-fc/rdma transports to mark the ++ * initializing procedure here. ++ */ ++ if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) { ++ dev_warn(dev->ctrl.device, ++ "failed to mark controller CONNECTING\n"); ++ goto out; ++ } + + result = nvme_init_identify(&dev->ctrl); + if (result) +@@ -2352,6 +2354,8 @@ static void nvme_reset_work(struct work_struct *work) + nvme_start_ctrl(&dev->ctrl); + return; + ++ out_unlock: ++ mutex_unlock(&dev->shutdown_lock); + out: + nvme_remove_dead_ctrl(dev, result); + } +diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c +index cf73a403d22d..cecbce21d01f 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c +@@ -832,8 +832,13 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev, + break; + + case MCP_TYPE_S18: ++ one_regmap_config = ++ devm_kmemdup(dev, &mcp23x17_regmap, ++ sizeof(struct regmap_config), GFP_KERNEL); ++ if (!one_regmap_config) ++ return -ENOMEM; + mcp->regmap = devm_regmap_init(dev, &mcp23sxx_spi_regmap, mcp, +- &mcp23x17_regmap); ++ one_regmap_config); + mcp->reg_shift = 1; + mcp->chip.ngpio = 16; + mcp->chip.label = "mcp23s18"; +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index 0c1aa6c314f5..7563c07e14e4 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -856,6 +856,7 @@ config TOSHIBA_WMI + config ACPI_CMPC + tristate "CMPC Laptop Extras" + depends on ACPI && INPUT ++ depends on BACKLIGHT_LCD_SUPPORT + depends on RFKILL || RFKILL=n + select BACKLIGHT_CLASS_DEVICE + help +@@ -1077,6 +1078,7 @@ config INTEL_OAKTRAIL + config SAMSUNG_Q10 + tristate "Samsung Q10 Extras" + depends on ACPI ++ depends on BACKLIGHT_LCD_SUPPORT + select BACKLIGHT_CLASS_DEVICE + ---help--- + This driver provides support for backlight control on Samsung Q10 +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 970654fcc48d..2d1f6a583641 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + #include + #include +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index b03515d43745..56aacf32f71b 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -565,6 +565,7 @@ static int __qeth_issue_next_read(struct qeth_card *card) + QETH_DBF_MESSAGE(2, "%s error in starting next read ccw! " + "rc=%i\n", dev_name(&card->gdev->dev), rc); + atomic_set(&channel->irq_pending, 0); ++ qeth_release_buffer(channel, iob); + card->read_or_write_problem = 1; + qeth_schedule_recovery(card); + wake_up(&card->wait_q); +@@ -1187,6 +1188,8 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + rc = qeth_get_problem(cdev, irb); + if (rc) { + card->read_or_write_problem = 1; ++ if (iob) ++ qeth_release_buffer(iob->channel, iob); + qeth_clear_ipacmd_list(card); + qeth_schedule_recovery(card); + goto out; +@@ -1852,6 +1855,7 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel, + QETH_DBF_MESSAGE(2, "Error2 in activating channel rc=%d\n", rc); + QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc); + atomic_set(&channel->irq_pending, 0); ++ qeth_release_buffer(channel, iob); + wake_up(&card->wait_q); + return rc; + } +@@ -1923,6 +1927,7 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel, + rc); + QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc); + atomic_set(&channel->irq_pending, 0); ++ qeth_release_buffer(channel, iob); + wake_up(&card->wait_q); + return rc; + } +@@ -2110,6 +2115,7 @@ int qeth_send_control_data(struct qeth_card *card, int len, + } + reply = qeth_alloc_reply(card); + if (!reply) { ++ qeth_release_buffer(channel, iob); + return -ENOMEM; + } + reply->callback = reply_cb; +@@ -2448,11 +2454,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx) + return 0; + } + +-static void qeth_free_qdio_out_buf(struct qeth_qdio_out_q *q) ++static void qeth_free_output_queue(struct qeth_qdio_out_q *q) + { + if (!q) + return; + ++ qeth_clear_outq_buffers(q, 1); + qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q); + kfree(q); + } +@@ -2526,10 +2533,8 @@ out_freeoutqbufs: + card->qdio.out_qs[i]->bufs[j] = NULL; + } + out_freeoutq: +- while (i > 0) { +- qeth_free_qdio_out_buf(card->qdio.out_qs[--i]); +- qeth_clear_outq_buffers(card->qdio.out_qs[i], 1); +- } ++ while (i > 0) ++ qeth_free_output_queue(card->qdio.out_qs[--i]); + kfree(card->qdio.out_qs); + card->qdio.out_qs = NULL; + out_freepool: +@@ -2562,10 +2567,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card) + qeth_free_buffer_pool(card); + /* free outbound qdio_qs */ + if (card->qdio.out_qs) { +- for (i = 0; i < card->qdio.no_out_queues; ++i) { +- qeth_clear_outq_buffers(card->qdio.out_qs[i], 1); +- qeth_free_qdio_out_buf(card->qdio.out_qs[i]); +- } ++ for (i = 0; i < card->qdio.no_out_queues; i++) ++ qeth_free_output_queue(card->qdio.out_qs[i]); + kfree(card->qdio.out_qs); + card->qdio.out_qs = NULL; + } +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 76b2fba5fba2..b7513c5848cf 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -854,6 +854,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev) + + if (cgdev->state == CCWGROUP_ONLINE) + qeth_l2_set_offline(cgdev); ++ ++ cancel_work_sync(&card->close_dev_work); + if (qeth_netdev_is_registered(card->dev)) + unregister_netdev(card->dev); + } +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index b7f6a8384543..7f71ca0d08e7 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -2611,6 +2611,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev) + if (cgdev->state == CCWGROUP_ONLINE) + qeth_l3_set_offline(cgdev); + ++ cancel_work_sync(&card->close_dev_work); + if (qeth_netdev_is_registered(card->dev)) + unregister_netdev(card->dev); + qeth_l3_clear_ip_htable(card, 0); +diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c +index 6be77b3aa8a5..ac79f2088b31 100644 +--- a/drivers/scsi/53c700.c ++++ b/drivers/scsi/53c700.c +@@ -295,7 +295,7 @@ NCR_700_detect(struct scsi_host_template *tpnt, + if(tpnt->sdev_attrs == NULL) + tpnt->sdev_attrs = NCR_700_dev_attrs; + +- memory = dma_alloc_attrs(hostdata->dev, TOTAL_MEM_SIZE, &pScript, ++ memory = dma_alloc_attrs(dev, TOTAL_MEM_SIZE, &pScript, + GFP_KERNEL, DMA_ATTR_NON_CONSISTENT); + if(memory == NULL) { + printk(KERN_ERR "53c700: Failed to allocate memory for driver, detaching\n"); +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index 6e1b022a823d..3236240a4edd 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -1304,8 +1304,9 @@ static void aac_handle_aif(struct aac_dev * dev, struct fib * fibptr) + ADD : DELETE; + break; + } +- case AifBuManagerEvent: +- aac_handle_aif_bu(dev, aifcmd); ++ break; ++ case AifBuManagerEvent: ++ aac_handle_aif_bu(dev, aifcmd); + break; + } + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c +index 350257c13a5b..bc9f2a2365f4 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_io.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_io.c +@@ -240,6 +240,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba) + return NULL; + } + ++ cmgr->hba = hba; + cmgr->free_list = kcalloc(arr_sz, sizeof(*cmgr->free_list), + GFP_KERNEL); + if (!cmgr->free_list) { +@@ -256,7 +257,6 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba) + goto mem_err; + } + +- cmgr->hba = hba; + cmgr->cmds = (struct bnx2fc_cmd **)(cmgr + 1); + + for (i = 0; i < arr_sz; i++) { +@@ -295,7 +295,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba) + + /* Allocate pool of io_bdts - one for each bnx2fc_cmd */ + mem_size = num_ios * sizeof(struct io_bdt *); +- cmgr->io_bdt_pool = kmalloc(mem_size, GFP_KERNEL); ++ cmgr->io_bdt_pool = kzalloc(mem_size, GFP_KERNEL); + if (!cmgr->io_bdt_pool) { + printk(KERN_ERR PFX "failed to alloc io_bdt_pool\n"); + goto mem_err; +diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c +index be83590ed955..ff943f477d6f 100644 +--- a/drivers/scsi/libfc/fc_lport.c ++++ b/drivers/scsi/libfc/fc_lport.c +@@ -1726,14 +1726,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, + fc_frame_payload_op(fp) != ELS_LS_ACC) { + FC_LPORT_DBG(lport, "FLOGI not accepted or bad response\n"); + fc_lport_error(lport, fp); +- goto err; ++ goto out; + } + + flp = fc_frame_payload_get(fp, sizeof(*flp)); + if (!flp) { + FC_LPORT_DBG(lport, "FLOGI bad response\n"); + fc_lport_error(lport, fp); +- goto err; ++ goto out; + } + + mfs = ntohs(flp->fl_csp.sp_bb_data) & +@@ -1743,7 +1743,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, + FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, " + "lport->mfs:%hu\n", mfs, lport->mfs); + fc_lport_error(lport, fp); +- goto err; ++ goto out; + } + + if (mfs <= lport->mfs) { +diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c +index 372387a450df..1797e47fab38 100644 +--- a/drivers/scsi/libfc/fc_rport.c ++++ b/drivers/scsi/libfc/fc_rport.c +@@ -184,7 +184,6 @@ void fc_rport_destroy(struct kref *kref) + struct fc_rport_priv *rdata; + + rdata = container_of(kref, struct fc_rport_priv, kref); +- WARN_ON(!list_empty(&rdata->peers)); + kfree_rcu(rdata, rcu); + } + EXPORT_SYMBOL(fc_rport_destroy); +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index 60bcc6df97a9..65305b3848bc 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -62,7 +62,7 @@ + + /* make sure inq_product_rev string corresponds to this version */ + #define SDEBUG_VERSION "0188" /* format to fit INQUIRY revision field */ +-static const char *sdebug_version_date = "20180128"; ++static const char *sdebug_version_date = "20190125"; + + #define MY_NAME "scsi_debug" + +@@ -735,7 +735,7 @@ static inline bool scsi_debug_lbp(void) + (sdebug_lbpu || sdebug_lbpws || sdebug_lbpws10); + } + +-static void *fake_store(unsigned long long lba) ++static void *lba2fake_store(unsigned long long lba) + { + lba = do_div(lba, sdebug_store_sectors); + +@@ -2514,8 +2514,8 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba, + return ret; + } + +-/* If fake_store(lba,num) compares equal to arr(num), then copy top half of +- * arr into fake_store(lba,num) and return true. If comparison fails then ++/* If lba2fake_store(lba,num) compares equal to arr(num), then copy top half of ++ * arr into lba2fake_store(lba,num) and return true. If comparison fails then + * return false. */ + static bool comp_write_worker(u64 lba, u32 num, const u8 *arr) + { +@@ -2643,7 +2643,7 @@ static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec, + if (sdt->app_tag == cpu_to_be16(0xffff)) + continue; + +- ret = dif_verify(sdt, fake_store(sector), sector, ei_lba); ++ ret = dif_verify(sdt, lba2fake_store(sector), sector, ei_lba); + if (ret) { + dif_errors++; + return ret; +@@ -3261,10 +3261,12 @@ err_out: + static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num, + u32 ei_lba, bool unmap, bool ndob) + { ++ int ret; + unsigned long iflags; + unsigned long long i; +- int ret; +- u64 lba_off; ++ u32 lb_size = sdebug_sector_size; ++ u64 block, lbaa; ++ u8 *fs1p; + + ret = check_device_access_params(scp, lba, num); + if (ret) +@@ -3276,31 +3278,30 @@ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num, + unmap_region(lba, num); + goto out; + } +- +- lba_off = lba * sdebug_sector_size; ++ lbaa = lba; ++ block = do_div(lbaa, sdebug_store_sectors); + /* if ndob then zero 1 logical block, else fetch 1 logical block */ ++ fs1p = fake_storep + (block * lb_size); + if (ndob) { +- memset(fake_storep + lba_off, 0, sdebug_sector_size); ++ memset(fs1p, 0, lb_size); + ret = 0; + } else +- ret = fetch_to_dev_buffer(scp, fake_storep + lba_off, +- sdebug_sector_size); ++ ret = fetch_to_dev_buffer(scp, fs1p, lb_size); + + if (-1 == ret) { + write_unlock_irqrestore(&atomic_rw, iflags); + return DID_ERROR << 16; +- } else if (sdebug_verbose && !ndob && (ret < sdebug_sector_size)) ++ } else if (sdebug_verbose && !ndob && (ret < lb_size)) + sdev_printk(KERN_INFO, scp->device, + "%s: %s: lb size=%u, IO sent=%d bytes\n", +- my_name, "write same", +- sdebug_sector_size, ret); ++ my_name, "write same", lb_size, ret); + + /* Copy first sector to remaining blocks */ +- for (i = 1 ; i < num ; i++) +- memcpy(fake_storep + ((lba + i) * sdebug_sector_size), +- fake_storep + lba_off, +- sdebug_sector_size); +- ++ for (i = 1 ; i < num ; i++) { ++ lbaa = lba + i; ++ block = do_div(lbaa, sdebug_store_sectors); ++ memmove(fake_storep + (block * lb_size), fs1p, lb_size); ++ } + if (scsi_debug_lbp()) + map_region(lba, num); + out: +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index 8cc015183043..a4ac6073c555 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -1081,18 +1081,19 @@ static void qm_mr_process_task(struct work_struct *work); + static irqreturn_t portal_isr(int irq, void *ptr) + { + struct qman_portal *p = ptr; +- +- u32 clear = QM_DQAVAIL_MASK | p->irq_sources; + u32 is = qm_in(&p->p, QM_REG_ISR) & p->irq_sources; ++ u32 clear = 0; + + if (unlikely(!is)) + return IRQ_NONE; + + /* DQRR-handling if it's interrupt-driven */ +- if (is & QM_PIRQ_DQRI) ++ if (is & QM_PIRQ_DQRI) { + __poll_portal_fast(p, QMAN_POLL_LIMIT); ++ clear = QM_DQAVAIL_MASK | QM_PIRQ_DQRI; ++ } + /* Handling of anything else that's interrupt-driven */ +- clear |= __poll_portal_slow(p, is); ++ clear |= __poll_portal_slow(p, is) & QM_PIRQ_SLOW; + qm_out(&p->p, QM_REG_ISR, clear); + return IRQ_HANDLED; + } +diff --git a/drivers/staging/erofs/inode.c b/drivers/staging/erofs/inode.c +index 9e7815f55a17..7448744cc515 100644 +--- a/drivers/staging/erofs/inode.c ++++ b/drivers/staging/erofs/inode.c +@@ -184,16 +184,16 @@ static int fill_inode(struct inode *inode, int isdir) + /* setup the new inode */ + if (S_ISREG(inode->i_mode)) { + #ifdef CONFIG_EROFS_FS_XATTR +- if (vi->xattr_isize) +- inode->i_op = &erofs_generic_xattr_iops; ++ inode->i_op = &erofs_generic_xattr_iops; + #endif + inode->i_fop = &generic_ro_fops; + } else if (S_ISDIR(inode->i_mode)) { + inode->i_op = + #ifdef CONFIG_EROFS_FS_XATTR +- vi->xattr_isize ? &erofs_dir_xattr_iops : +-#endif ++ &erofs_dir_xattr_iops; ++#else + &erofs_dir_iops; ++#endif + inode->i_fop = &erofs_dir_fops; + } else if (S_ISLNK(inode->i_mode)) { + /* by default, page_get_link is used for symlink */ +diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h +index 9f44ed8f0023..c70f0c5237ea 100644 +--- a/drivers/staging/erofs/internal.h ++++ b/drivers/staging/erofs/internal.h +@@ -327,12 +327,17 @@ static inline erofs_off_t iloc(struct erofs_sb_info *sbi, erofs_nid_t nid) + return blknr_to_addr(sbi->meta_blkaddr) + (nid << sbi->islotbits); + } + +-#define inode_set_inited_xattr(inode) (EROFS_V(inode)->flags |= 1) +-#define inode_has_inited_xattr(inode) (EROFS_V(inode)->flags & 1) ++/* atomic flag definitions */ ++#define EROFS_V_EA_INITED_BIT 0 ++ ++/* bitlock definitions (arranged in reverse order) */ ++#define EROFS_V_BL_XATTR_BIT (BITS_PER_LONG - 1) + + struct erofs_vnode { + erofs_nid_t nid; +- unsigned int flags; ++ ++ /* atomic flags (including bitlocks) */ ++ unsigned long flags; + + unsigned char data_mapping_mode; + /* inline size in bytes */ +@@ -485,8 +490,9 @@ struct erofs_map_blocks_iter { + }; + + +-static inline struct page *erofs_get_inline_page(struct inode *inode, +- erofs_blk_t blkaddr) ++static inline struct page * ++erofs_get_inline_page(struct inode *inode, ++ erofs_blk_t blkaddr) + { + return erofs_get_meta_page(inode->i_sb, + blkaddr, S_ISDIR(inode->i_mode)); +diff --git a/drivers/staging/erofs/namei.c b/drivers/staging/erofs/namei.c +index 546a47156101..023f64fa2c87 100644 +--- a/drivers/staging/erofs/namei.c ++++ b/drivers/staging/erofs/namei.c +@@ -15,74 +15,77 @@ + + #include + +-/* based on the value of qn->len is accurate */ +-static inline int dirnamecmp(struct qstr *qn, +- struct qstr *qd, unsigned *matched) ++struct erofs_qstr { ++ const unsigned char *name; ++ const unsigned char *end; ++}; ++ ++/* based on the end of qn is accurate and it must have the trailing '\0' */ ++static inline int dirnamecmp(const struct erofs_qstr *qn, ++ const struct erofs_qstr *qd, ++ unsigned int *matched) + { +- unsigned i = *matched, len = min(qn->len, qd->len); +-loop: +- if (unlikely(i >= len)) { +- *matched = i; +- if (qn->len < qd->len) { +- /* +- * actually (qn->len == qd->len) +- * when qd->name[i] == '\0' +- */ +- return qd->name[i] == '\0' ? 0 : -1; ++ unsigned int i = *matched; ++ ++ /* ++ * on-disk error, let's only BUG_ON in the debugging mode. ++ * otherwise, it will return 1 to just skip the invalid name ++ * and go on (in consideration of the lookup performance). ++ */ ++ DBG_BUGON(qd->name > qd->end); ++ ++ /* qd could not have trailing '\0' */ ++ /* However it is absolutely safe if < qd->end */ ++ while (qd->name + i < qd->end && qd->name[i] != '\0') { ++ if (qn->name[i] != qd->name[i]) { ++ *matched = i; ++ return qn->name[i] > qd->name[i] ? 1 : -1; + } +- return (qn->len > qd->len); ++ ++i; + } +- +- if (qn->name[i] != qd->name[i]) { +- *matched = i; +- return qn->name[i] > qd->name[i] ? 1 : -1; +- } +- +- ++i; +- goto loop; ++ *matched = i; ++ /* See comments in __d_alloc on the terminating NUL character */ ++ return qn->name[i] == '\0' ? 0 : 1; + } + +-static struct erofs_dirent *find_target_dirent( +- struct qstr *name, +- u8 *data, int maxsize) ++#define nameoff_from_disk(off, sz) (le16_to_cpu(off) & ((sz) - 1)) ++ ++static struct erofs_dirent *find_target_dirent(struct erofs_qstr *name, ++ u8 *data, ++ unsigned int dirblksize, ++ const int ndirents) + { +- unsigned ndirents, head, back; +- unsigned startprfx, endprfx; ++ int head, back; ++ unsigned int startprfx, endprfx; + struct erofs_dirent *const de = (struct erofs_dirent *)data; + +- /* make sure that maxsize is valid */ +- BUG_ON(maxsize < sizeof(struct erofs_dirent)); +- +- ndirents = le16_to_cpu(de->nameoff) / sizeof(*de); +- +- /* corrupted dir (may be unnecessary...) */ +- BUG_ON(!ndirents); +- +- head = 0; ++ /* since the 1st dirent has been evaluated previously */ ++ head = 1; + back = ndirents - 1; + startprfx = endprfx = 0; + + while (head <= back) { +- unsigned mid = head + (back - head) / 2; +- unsigned nameoff = le16_to_cpu(de[mid].nameoff); +- unsigned matched = min(startprfx, endprfx); +- +- struct qstr dname = QSTR_INIT(data + nameoff, +- unlikely(mid >= ndirents - 1) ? +- maxsize - nameoff : +- le16_to_cpu(de[mid + 1].nameoff) - nameoff); ++ const int mid = head + (back - head) / 2; ++ const int nameoff = nameoff_from_disk(de[mid].nameoff, ++ dirblksize); ++ unsigned int matched = min(startprfx, endprfx); ++ struct erofs_qstr dname = { ++ .name = data + nameoff, ++ .end = unlikely(mid >= ndirents - 1) ? ++ data + dirblksize : ++ data + nameoff_from_disk(de[mid + 1].nameoff, ++ dirblksize) ++ }; + + /* string comparison without already matched prefix */ + int ret = dirnamecmp(name, &dname, &matched); + +- if (unlikely(!ret)) ++ if (unlikely(!ret)) { + return de + mid; +- else if (ret > 0) { ++ } else if (ret > 0) { + head = mid + 1; + startprfx = matched; +- } else if (unlikely(mid < 1)) /* fix "mid" overflow */ +- break; +- else { ++ } else { + back = mid - 1; + endprfx = matched; + } +@@ -91,12 +94,12 @@ static struct erofs_dirent *find_target_dirent( + return ERR_PTR(-ENOENT); + } + +-static struct page *find_target_block_classic( +- struct inode *dir, +- struct qstr *name, int *_diff) ++static struct page *find_target_block_classic(struct inode *dir, ++ struct erofs_qstr *name, ++ int *_ndirents) + { +- unsigned startprfx, endprfx; +- unsigned head, back; ++ unsigned int startprfx, endprfx; ++ int head, back; + struct address_space *const mapping = dir->i_mapping; + struct page *candidate = ERR_PTR(-ENOENT); + +@@ -105,41 +108,43 @@ static struct page *find_target_block_classic( + back = inode_datablocks(dir) - 1; + + while (head <= back) { +- unsigned mid = head + (back - head) / 2; ++ const int mid = head + (back - head) / 2; + struct page *page = read_mapping_page(mapping, mid, NULL); + +- if (IS_ERR(page)) { +-exact_out: +- if (!IS_ERR(candidate)) /* valid candidate */ +- put_page(candidate); +- return page; +- } else { +- int diff; +- unsigned ndirents, matched; +- struct qstr dname; ++ if (!IS_ERR(page)) { + struct erofs_dirent *de = kmap_atomic(page); +- unsigned nameoff = le16_to_cpu(de->nameoff); +- +- ndirents = nameoff / sizeof(*de); ++ const int nameoff = nameoff_from_disk(de->nameoff, ++ EROFS_BLKSIZ); ++ const int ndirents = nameoff / sizeof(*de); ++ int diff; ++ unsigned int matched; ++ struct erofs_qstr dname; + +- /* corrupted dir (should have one entry at least) */ +- BUG_ON(!ndirents || nameoff > PAGE_SIZE); ++ if (unlikely(!ndirents)) { ++ DBG_BUGON(1); ++ kunmap_atomic(de); ++ put_page(page); ++ page = ERR_PTR(-EIO); ++ goto out; ++ } + + matched = min(startprfx, endprfx); + + dname.name = (u8 *)de + nameoff; +- dname.len = ndirents == 1 ? +- /* since the rest of the last page is 0 */ +- EROFS_BLKSIZ - nameoff +- : le16_to_cpu(de[1].nameoff) - nameoff; ++ if (ndirents == 1) ++ dname.end = (u8 *)de + EROFS_BLKSIZ; ++ else ++ dname.end = (u8 *)de + ++ nameoff_from_disk(de[1].nameoff, ++ EROFS_BLKSIZ); + + /* string comparison without already matched prefix */ + diff = dirnamecmp(name, &dname, &matched); + kunmap_atomic(de); + + if (unlikely(!diff)) { +- *_diff = 0; +- goto exact_out; ++ *_ndirents = 0; ++ goto out; + } else if (diff > 0) { + head = mid + 1; + startprfx = matched; +@@ -147,45 +152,51 @@ exact_out: + if (likely(!IS_ERR(candidate))) + put_page(candidate); + candidate = page; ++ *_ndirents = ndirents; + } else { + put_page(page); + +- if (unlikely(mid < 1)) /* fix "mid" overflow */ +- break; +- + back = mid - 1; + endprfx = matched; + } ++ continue; + } ++out: /* free if the candidate is valid */ ++ if (!IS_ERR(candidate)) ++ put_page(candidate); ++ return page; + } +- *_diff = 1; + return candidate; + } + + int erofs_namei(struct inode *dir, +- struct qstr *name, +- erofs_nid_t *nid, unsigned *d_type) ++ struct qstr *name, ++ erofs_nid_t *nid, unsigned int *d_type) + { +- int diff; ++ int ndirents; + struct page *page; +- u8 *data; ++ void *data; + struct erofs_dirent *de; ++ struct erofs_qstr qn; + + if (unlikely(!dir->i_size)) + return -ENOENT; + +- diff = 1; +- page = find_target_block_classic(dir, name, &diff); ++ qn.name = name->name; ++ qn.end = name->name + name->len; ++ ++ ndirents = 0; ++ page = find_target_block_classic(dir, &qn, &ndirents); + + if (unlikely(IS_ERR(page))) + return PTR_ERR(page); + + data = kmap_atomic(page); + /* the target page has been mapped */ +- de = likely(diff) ? +- /* since the rest of the last page is 0 */ +- find_target_dirent(name, data, EROFS_BLKSIZ) : +- (struct erofs_dirent *)data; ++ if (ndirents) ++ de = find_target_dirent(&qn, data, EROFS_BLKSIZ, ndirents); ++ else ++ de = (struct erofs_dirent *)data; + + if (likely(!IS_ERR(de))) { + *nid = le64_to_cpu(de->nid); +diff --git a/drivers/staging/erofs/xattr.c b/drivers/staging/erofs/xattr.c +index 0e9cfeccdf99..2db99cff3c99 100644 +--- a/drivers/staging/erofs/xattr.c ++++ b/drivers/staging/erofs/xattr.c +@@ -24,36 +24,77 @@ struct xattr_iter { + + static inline void xattr_iter_end(struct xattr_iter *it, bool atomic) + { +- /* only init_inode_xattrs use non-atomic once */ ++ /* the only user of kunmap() is 'init_inode_xattrs' */ + if (unlikely(!atomic)) + kunmap(it->page); + else + kunmap_atomic(it->kaddr); ++ + unlock_page(it->page); + put_page(it->page); + } + +-static void init_inode_xattrs(struct inode *inode) ++static inline void xattr_iter_end_final(struct xattr_iter *it) ++{ ++ if (!it->page) ++ return; ++ ++ xattr_iter_end(it, true); ++} ++ ++static int init_inode_xattrs(struct inode *inode) + { ++ struct erofs_vnode *const vi = EROFS_V(inode); + struct xattr_iter it; + unsigned i; + struct erofs_xattr_ibody_header *ih; + struct erofs_sb_info *sbi; +- struct erofs_vnode *vi; + bool atomic_map; ++ int ret = 0; + +- if (likely(inode_has_inited_xattr(inode))) +- return; ++ /* the most case is that xattrs of this inode are initialized. */ ++ if (test_bit(EROFS_V_EA_INITED_BIT, &vi->flags)) ++ return 0; ++ ++ if (wait_on_bit_lock(&vi->flags, EROFS_V_BL_XATTR_BIT, TASK_KILLABLE)) ++ return -ERESTARTSYS; + +- vi = EROFS_V(inode); +- BUG_ON(!vi->xattr_isize); ++ /* someone has initialized xattrs for us? */ ++ if (test_bit(EROFS_V_EA_INITED_BIT, &vi->flags)) ++ goto out_unlock; ++ ++ /* ++ * bypass all xattr operations if ->xattr_isize is not greater than ++ * sizeof(struct erofs_xattr_ibody_header), in detail: ++ * 1) it is not enough to contain erofs_xattr_ibody_header then ++ * ->xattr_isize should be 0 (it means no xattr); ++ * 2) it is just to contain erofs_xattr_ibody_header, which is on-disk ++ * undefined right now (maybe use later with some new sb feature). ++ */ ++ if (vi->xattr_isize == sizeof(struct erofs_xattr_ibody_header)) { ++ errln("xattr_isize %d of nid %llu is not supported yet", ++ vi->xattr_isize, vi->nid); ++ ret = -ENOTSUPP; ++ goto out_unlock; ++ } else if (vi->xattr_isize < sizeof(struct erofs_xattr_ibody_header)) { ++ if (unlikely(vi->xattr_isize)) { ++ DBG_BUGON(1); ++ ret = -EIO; ++ goto out_unlock; /* xattr ondisk layout error */ ++ } ++ ret = -ENOATTR; ++ goto out_unlock; ++ } + + sbi = EROFS_I_SB(inode); + it.blkaddr = erofs_blknr(iloc(sbi, vi->nid) + vi->inode_isize); + it.ofs = erofs_blkoff(iloc(sbi, vi->nid) + vi->inode_isize); + + it.page = erofs_get_inline_page(inode, it.blkaddr); +- BUG_ON(IS_ERR(it.page)); ++ if (IS_ERR(it.page)) { ++ ret = PTR_ERR(it.page); ++ goto out_unlock; ++ } + + /* read in shared xattr array (non-atomic, see kmalloc below) */ + it.kaddr = kmap(it.page); +@@ -62,9 +103,13 @@ static void init_inode_xattrs(struct inode *inode) + ih = (struct erofs_xattr_ibody_header *)(it.kaddr + it.ofs); + + vi->xattr_shared_count = ih->h_shared_count; +- vi->xattr_shared_xattrs = (unsigned *)kmalloc_array( +- vi->xattr_shared_count, sizeof(unsigned), +- GFP_KERNEL | __GFP_NOFAIL); ++ vi->xattr_shared_xattrs = kmalloc_array(vi->xattr_shared_count, ++ sizeof(uint), GFP_KERNEL); ++ if (!vi->xattr_shared_xattrs) { ++ xattr_iter_end(&it, atomic_map); ++ ret = -ENOMEM; ++ goto out_unlock; ++ } + + /* let's skip ibody header */ + it.ofs += sizeof(struct erofs_xattr_ibody_header); +@@ -77,7 +122,12 @@ static void init_inode_xattrs(struct inode *inode) + + it.page = erofs_get_meta_page(inode->i_sb, + ++it.blkaddr, S_ISDIR(inode->i_mode)); +- BUG_ON(IS_ERR(it.page)); ++ if (IS_ERR(it.page)) { ++ kfree(vi->xattr_shared_xattrs); ++ vi->xattr_shared_xattrs = NULL; ++ ret = PTR_ERR(it.page); ++ goto out_unlock; ++ } + + it.kaddr = kmap_atomic(it.page); + atomic_map = true; +@@ -89,7 +139,11 @@ static void init_inode_xattrs(struct inode *inode) + } + xattr_iter_end(&it, atomic_map); + +- inode_set_inited_xattr(inode); ++ set_bit(EROFS_V_EA_INITED_BIT, &vi->flags); ++ ++out_unlock: ++ clear_and_wake_up_bit(EROFS_V_BL_XATTR_BIT, &vi->flags); ++ return ret; + } + + struct xattr_iter_handlers { +@@ -99,18 +153,25 @@ struct xattr_iter_handlers { + void (*value)(struct xattr_iter *, unsigned, char *, unsigned); + }; + +-static void xattr_iter_fixup(struct xattr_iter *it) ++static inline int xattr_iter_fixup(struct xattr_iter *it) + { +- if (unlikely(it->ofs >= EROFS_BLKSIZ)) { +- xattr_iter_end(it, true); ++ if (it->ofs < EROFS_BLKSIZ) ++ return 0; + +- it->blkaddr += erofs_blknr(it->ofs); +- it->page = erofs_get_meta_page(it->sb, it->blkaddr, false); +- BUG_ON(IS_ERR(it->page)); ++ xattr_iter_end(it, true); + +- it->kaddr = kmap_atomic(it->page); +- it->ofs = erofs_blkoff(it->ofs); ++ it->blkaddr += erofs_blknr(it->ofs); ++ it->page = erofs_get_meta_page(it->sb, it->blkaddr, false); ++ if (IS_ERR(it->page)) { ++ int err = PTR_ERR(it->page); ++ ++ it->page = NULL; ++ return err; + } ++ ++ it->kaddr = kmap_atomic(it->page); ++ it->ofs = erofs_blkoff(it->ofs); ++ return 0; + } + + static int inline_xattr_iter_begin(struct xattr_iter *it, +@@ -132,21 +193,24 @@ static int inline_xattr_iter_begin(struct xattr_iter *it, + it->ofs = erofs_blkoff(iloc(sbi, vi->nid) + inline_xattr_ofs); + + it->page = erofs_get_inline_page(inode, it->blkaddr); +- BUG_ON(IS_ERR(it->page)); +- it->kaddr = kmap_atomic(it->page); ++ if (IS_ERR(it->page)) ++ return PTR_ERR(it->page); + ++ it->kaddr = kmap_atomic(it->page); + return vi->xattr_isize - xattr_header_sz; + } + + static int xattr_foreach(struct xattr_iter *it, +- struct xattr_iter_handlers *op, unsigned *tlimit) ++ const struct xattr_iter_handlers *op, unsigned int *tlimit) + { + struct erofs_xattr_entry entry; + unsigned value_sz, processed, slice; + int err; + + /* 0. fixup blkaddr, ofs, ipage */ +- xattr_iter_fixup(it); ++ err = xattr_iter_fixup(it); ++ if (err) ++ return err; + + /* + * 1. read xattr entry to the memory, +@@ -178,7 +242,9 @@ static int xattr_foreach(struct xattr_iter *it, + if (it->ofs >= EROFS_BLKSIZ) { + BUG_ON(it->ofs > EROFS_BLKSIZ); + +- xattr_iter_fixup(it); ++ err = xattr_iter_fixup(it); ++ if (err) ++ goto out; + it->ofs = 0; + } + +@@ -210,7 +276,10 @@ static int xattr_foreach(struct xattr_iter *it, + while (processed < value_sz) { + if (it->ofs >= EROFS_BLKSIZ) { + BUG_ON(it->ofs > EROFS_BLKSIZ); +- xattr_iter_fixup(it); ++ ++ err = xattr_iter_fixup(it); ++ if (err) ++ goto out; + it->ofs = 0; + } + +@@ -270,7 +339,7 @@ static void xattr_copyvalue(struct xattr_iter *_it, + memcpy(it->buffer + processed, buf, len); + } + +-static struct xattr_iter_handlers find_xattr_handlers = { ++static const struct xattr_iter_handlers find_xattr_handlers = { + .entry = xattr_entrymatch, + .name = xattr_namematch, + .alloc_buffer = xattr_checkbuffer, +@@ -291,8 +360,11 @@ static int inline_getxattr(struct inode *inode, struct getxattr_iter *it) + ret = xattr_foreach(&it->it, &find_xattr_handlers, &remaining); + if (ret >= 0) + break; ++ ++ if (ret != -ENOATTR) /* -ENOMEM, -EIO, etc. */ ++ break; + } +- xattr_iter_end(&it->it, true); ++ xattr_iter_end_final(&it->it); + + return ret < 0 ? ret : it->buffer_size; + } +@@ -315,8 +387,10 @@ static int shared_getxattr(struct inode *inode, struct getxattr_iter *it) + xattr_iter_end(&it->it, true); + + it->it.page = erofs_get_meta_page(inode->i_sb, +- blkaddr, false); +- BUG_ON(IS_ERR(it->it.page)); ++ blkaddr, false); ++ if (IS_ERR(it->it.page)) ++ return PTR_ERR(it->it.page); ++ + it->it.kaddr = kmap_atomic(it->it.page); + it->it.blkaddr = blkaddr; + } +@@ -324,9 +398,12 @@ static int shared_getxattr(struct inode *inode, struct getxattr_iter *it) + ret = xattr_foreach(&it->it, &find_xattr_handlers, NULL); + if (ret >= 0) + break; ++ ++ if (ret != -ENOATTR) /* -ENOMEM, -EIO, etc. */ ++ break; + } + if (vi->xattr_shared_count) +- xattr_iter_end(&it->it, true); ++ xattr_iter_end_final(&it->it); + + return ret < 0 ? ret : it->buffer_size; + } +@@ -351,7 +428,9 @@ int erofs_getxattr(struct inode *inode, int index, + if (unlikely(name == NULL)) + return -EINVAL; + +- init_inode_xattrs(inode); ++ ret = init_inode_xattrs(inode); ++ if (ret) ++ return ret; + + it.index = index; + +@@ -374,7 +453,6 @@ static int erofs_xattr_generic_get(const struct xattr_handler *handler, + struct dentry *unused, struct inode *inode, + const char *name, void *buffer, size_t size) + { +- struct erofs_vnode *const vi = EROFS_V(inode); + struct erofs_sb_info *const sbi = EROFS_I_SB(inode); + + switch (handler->flags) { +@@ -392,9 +470,6 @@ static int erofs_xattr_generic_get(const struct xattr_handler *handler, + return -EINVAL; + } + +- if (!vi->xattr_isize) +- return -ENOATTR; +- + return erofs_getxattr(inode, handler->flags, name, buffer, size); + } + +@@ -494,7 +569,7 @@ static int xattr_skipvalue(struct xattr_iter *_it, + return 1; + } + +-static struct xattr_iter_handlers list_xattr_handlers = { ++static const struct xattr_iter_handlers list_xattr_handlers = { + .entry = xattr_entrylist, + .name = xattr_namelist, + .alloc_buffer = xattr_skipvalue, +@@ -516,7 +591,7 @@ static int inline_listxattr(struct listxattr_iter *it) + if (ret < 0) + break; + } +- xattr_iter_end(&it->it, true); ++ xattr_iter_end_final(&it->it); + return ret < 0 ? ret : it->buffer_ofs; + } + +@@ -538,8 +613,10 @@ static int shared_listxattr(struct listxattr_iter *it) + xattr_iter_end(&it->it, true); + + it->it.page = erofs_get_meta_page(inode->i_sb, +- blkaddr, false); +- BUG_ON(IS_ERR(it->it.page)); ++ blkaddr, false); ++ if (IS_ERR(it->it.page)) ++ return PTR_ERR(it->it.page); ++ + it->it.kaddr = kmap_atomic(it->it.page); + it->it.blkaddr = blkaddr; + } +@@ -549,7 +626,7 @@ static int shared_listxattr(struct listxattr_iter *it) + break; + } + if (vi->xattr_shared_count) +- xattr_iter_end(&it->it, true); ++ xattr_iter_end_final(&it->it); + + return ret < 0 ? ret : it->buffer_ofs; + } +@@ -560,7 +637,9 @@ ssize_t erofs_listxattr(struct dentry *dentry, + int ret; + struct listxattr_iter it; + +- init_inode_xattrs(d_inode(dentry)); ++ ret = init_inode_xattrs(d_inode(dentry)); ++ if (ret) ++ return ret; + + it.dentry = dentry; + it.buffer = buffer; +diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig +index d7312eed6088..91ea3083e7ad 100644 +--- a/drivers/usb/phy/Kconfig ++++ b/drivers/usb/phy/Kconfig +@@ -21,7 +21,7 @@ config AB8500_USB + + config FSL_USB2_OTG + bool "Freescale USB OTG Transceiver Driver" +- depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM ++ depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM + depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y' + select USB_PHY + help +diff --git a/fs/autofs/expire.c b/fs/autofs/expire.c +index d441244b79df..28d9c2b1b3bb 100644 +--- a/fs/autofs/expire.c ++++ b/fs/autofs/expire.c +@@ -596,7 +596,6 @@ int autofs_expire_run(struct super_block *sb, + pkt.len = dentry->d_name.len; + memcpy(pkt.name, dentry->d_name.name, pkt.len); + pkt.name[pkt.len] = '\0'; +- dput(dentry); + + if (copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire))) + ret = -EFAULT; +@@ -609,6 +608,8 @@ int autofs_expire_run(struct super_block *sb, + complete_all(&ino->expire_complete); + spin_unlock(&sbi->fs_lock); + ++ dput(dentry); ++ + return ret; + } + +diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c +index 846c052569dd..3c14a8e45ffb 100644 +--- a/fs/autofs/inode.c ++++ b/fs/autofs/inode.c +@@ -255,8 +255,10 @@ int autofs_fill_super(struct super_block *s, void *data, int silent) + } + root_inode = autofs_get_inode(s, S_IFDIR | 0755); + root = d_make_root(root_inode); +- if (!root) ++ if (!root) { ++ ret = -ENOMEM; + goto fail_ino; ++ } + pipe = NULL; + + root->d_fsdata = ino; +diff --git a/fs/buffer.c b/fs/buffer.c +index 6f1ae3ac9789..c083c4b3c1e7 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -200,6 +200,7 @@ __find_get_block_slow(struct block_device *bdev, sector_t block) + struct buffer_head *head; + struct page *page; + int all_mapped = 1; ++ static DEFINE_RATELIMIT_STATE(last_warned, HZ, 1); + + index = block >> (PAGE_SHIFT - bd_inode->i_blkbits); + page = find_get_page_flags(bd_mapping, index, FGP_ACCESSED); +@@ -227,15 +228,15 @@ __find_get_block_slow(struct block_device *bdev, sector_t block) + * file io on the block device and getblk. It gets dealt with + * elsewhere, don't buffer_error if we had some unmapped buffers + */ +- if (all_mapped) { +- printk("__find_get_block_slow() failed. " +- "block=%llu, b_blocknr=%llu\n", +- (unsigned long long)block, +- (unsigned long long)bh->b_blocknr); +- printk("b_state=0x%08lx, b_size=%zu\n", +- bh->b_state, bh->b_size); +- printk("device %pg blocksize: %d\n", bdev, +- 1 << bd_inode->i_blkbits); ++ ratelimit_set_flags(&last_warned, RATELIMIT_MSG_ON_RELEASE); ++ if (all_mapped && __ratelimit(&last_warned)) { ++ printk("__find_get_block_slow() failed. block=%llu, " ++ "b_blocknr=%llu, b_state=0x%08lx, b_size=%zu, " ++ "device %pg blocksize: %d\n", ++ (unsigned long long)block, ++ (unsigned long long)bh->b_blocknr, ++ bh->b_state, bh->b_size, bdev, ++ 1 << bd_inode->i_blkbits); + } + out_unlock: + spin_unlock(&bd_mapping->private_lock); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 1e5a1171212f..a2d701775c49 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2243,10 +2243,12 @@ SMB2_open_free(struct smb_rqst *rqst) + { + int i; + +- cifs_small_buf_release(rqst->rq_iov[0].iov_base); +- for (i = 1; i < rqst->rq_nvec; i++) +- if (rqst->rq_iov[i].iov_base != smb2_padding) +- kfree(rqst->rq_iov[i].iov_base); ++ if (rqst && rqst->rq_iov) { ++ cifs_small_buf_release(rqst->rq_iov[0].iov_base); ++ for (i = 1; i < rqst->rq_nvec; i++) ++ if (rqst->rq_iov[i].iov_base != smb2_padding) ++ kfree(rqst->rq_iov[i].iov_base); ++ } + } + + int +@@ -2535,7 +2537,8 @@ SMB2_close_init(struct cifs_tcon *tcon, struct smb_rqst *rqst, + void + SMB2_close_free(struct smb_rqst *rqst) + { +- cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ ++ if (rqst && rqst->rq_iov) ++ cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ + } + + int +@@ -2685,7 +2688,8 @@ SMB2_query_info_init(struct cifs_tcon *tcon, struct smb_rqst *rqst, + void + SMB2_query_info_free(struct smb_rqst *rqst) + { +- cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ ++ if (rqst && rqst->rq_iov) ++ cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ + } + + static int +diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h +index 8fb7887f2b3d..437257d1116f 100644 +--- a/fs/cifs/smb2pdu.h ++++ b/fs/cifs/smb2pdu.h +@@ -84,8 +84,8 @@ + + #define NUMBER_OF_SMB2_COMMANDS 0x0013 + +-/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */ +-#define MAX_SMB2_HDR_SIZE 0x00b0 ++/* 52 transform hdr + 64 hdr + 88 create rsp */ ++#define MAX_SMB2_HDR_SIZE 204 + + #define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe) + #define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd) +diff --git a/fs/drop_caches.c b/fs/drop_caches.c +index 82377017130f..d31b6c72b476 100644 +--- a/fs/drop_caches.c ++++ b/fs/drop_caches.c +@@ -21,8 +21,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused) + spin_lock(&sb->s_inode_list_lock); + list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { + spin_lock(&inode->i_lock); ++ /* ++ * We must skip inodes in unusual state. We may also skip ++ * inodes without pages but we deliberately won't in case ++ * we need to reschedule to avoid softlockups. ++ */ + if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) || +- (inode->i_mapping->nrpages == 0)) { ++ (inode->i_mapping->nrpages == 0 && !need_resched())) { + spin_unlock(&inode->i_lock); + continue; + } +@@ -30,6 +35,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused) + spin_unlock(&inode->i_lock); + spin_unlock(&sb->s_inode_list_lock); + ++ cond_resched(); + invalidate_mapping_pages(inode->i_mapping, 0, -1); + iput(toput_inode); + toput_inode = inode; +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 4614ee25f621..9d566e62684c 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -107,7 +107,7 @@ static int glock_wake_function(wait_queue_entry_t *wait, unsigned int mode, + + static wait_queue_head_t *glock_waitqueue(struct lm_lockname *name) + { +- u32 hash = jhash2((u32 *)name, sizeof(*name) / 4, 0); ++ u32 hash = jhash2((u32 *)name, ht_parms.key_len / 4, 0); + + return glock_wait_table + hash_32(hash, GLOCK_WAIT_TABLE_BITS); + } +diff --git a/fs/iomap.c b/fs/iomap.c +index e57fb1e534c5..fac45206418a 100644 +--- a/fs/iomap.c ++++ b/fs/iomap.c +@@ -117,6 +117,12 @@ iomap_page_create(struct inode *inode, struct page *page) + atomic_set(&iop->read_count, 0); + atomic_set(&iop->write_count, 0); + bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE); ++ ++ /* ++ * migrate_page_move_mapping() assumes that pages with private data have ++ * their count elevated by 1. ++ */ ++ get_page(page); + set_page_private(page, (unsigned long)iop); + SetPagePrivate(page); + return iop; +@@ -133,6 +139,7 @@ iomap_page_release(struct page *page) + WARN_ON_ONCE(atomic_read(&iop->write_count)); + ClearPagePrivate(page); + set_page_private(page, 0); ++ put_page(page); + kfree(iop); + } + +@@ -565,8 +572,10 @@ iomap_migrate_page(struct address_space *mapping, struct page *newpage, + + if (page_has_private(page)) { + ClearPagePrivate(page); ++ get_page(newpage); + set_page_private(newpage, page_private(page)); + set_page_private(page, 0); ++ put_page(page); + SetPagePrivate(newpage); + } + +@@ -1778,6 +1787,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, + loff_t pos = iocb->ki_pos, start = pos; + loff_t end = iocb->ki_pos + count - 1, ret = 0; + unsigned int flags = IOMAP_DIRECT; ++ bool wait_for_completion = is_sync_kiocb(iocb); + struct blk_plug plug; + struct iomap_dio *dio; + +@@ -1797,7 +1807,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, + dio->end_io = end_io; + dio->error = 0; + dio->flags = 0; +- dio->wait_for_completion = is_sync_kiocb(iocb); + + dio->submit.iter = iter; + dio->submit.waiter = current; +@@ -1852,7 +1861,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, + dio_warn_stale_pagecache(iocb->ki_filp); + ret = 0; + +- if (iov_iter_rw(iter) == WRITE && !dio->wait_for_completion && ++ if (iov_iter_rw(iter) == WRITE && !wait_for_completion && + !inode->i_sb->s_dio_done_wq) { + ret = sb_init_dio_done_wq(inode->i_sb); + if (ret < 0) +@@ -1868,7 +1877,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, + if (ret <= 0) { + /* magic error code to fall back to buffered I/O */ + if (ret == -ENOTBLK) { +- dio->wait_for_completion = true; ++ wait_for_completion = true; + ret = 0; + } + break; +@@ -1890,8 +1899,24 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, + if (dio->flags & IOMAP_DIO_WRITE_FUA) + dio->flags &= ~IOMAP_DIO_NEED_SYNC; + ++ /* ++ * We are about to drop our additional submission reference, which ++ * might be the last reference to the dio. There are three three ++ * different ways we can progress here: ++ * ++ * (a) If this is the last reference we will always complete and free ++ * the dio ourselves. ++ * (b) If this is not the last reference, and we serve an asynchronous ++ * iocb, we must never touch the dio after the decrement, the ++ * I/O completion handler will complete and free it. ++ * (c) If this is not the last reference, but we serve a synchronous ++ * iocb, the I/O completion handler will wake us up on the drop ++ * of the final reference, and we will complete and free it here ++ * after we got woken by the I/O completion handler. ++ */ ++ dio->wait_for_completion = wait_for_completion; + if (!atomic_dec_and_test(&dio->ref)) { +- if (!dio->wait_for_completion) ++ if (!wait_for_completion) + return -EIOCBQUEUED; + + for (;;) { +@@ -1908,9 +1933,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, + __set_current_state(TASK_RUNNING); + } + +- ret = iomap_dio_complete(dio); +- +- return ret; ++ return iomap_dio_complete(dio); + + out_free_dio: + kfree(dio); +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index 5ef2c71348bd..6b666d187907 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -1906,6 +1906,11 @@ static int nfs_parse_devname(const char *dev_name, + size_t len; + char *end; + ++ if (unlikely(!dev_name || !*dev_name)) { ++ dfprintk(MOUNT, "NFS: device name not specified\n"); ++ return -EINVAL; ++ } ++ + /* Is the host name protected with square brakcets? */ + if (*dev_name == '[') { + end = strchr(++dev_name, ']'); +diff --git a/fs/proc/generic.c b/fs/proc/generic.c +index 8ae109429a88..e39bac94dead 100644 +--- a/fs/proc/generic.c ++++ b/fs/proc/generic.c +@@ -256,7 +256,7 @@ struct dentry *proc_lookup_de(struct inode *dir, struct dentry *dentry, + inode = proc_get_inode(dir->i_sb, de); + if (!inode) + return ERR_PTR(-ENOMEM); +- d_set_d_op(dentry, &proc_misc_dentry_ops); ++ d_set_d_op(dentry, de->proc_dops); + return d_splice_alias(inode, dentry); + } + read_unlock(&proc_subdir_lock); +@@ -429,6 +429,8 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent, + INIT_LIST_HEAD(&ent->pde_openers); + proc_set_user(ent, (*parent)->uid, (*parent)->gid); + ++ ent->proc_dops = &proc_misc_dentry_ops; ++ + out: + return ent; + } +diff --git a/fs/proc/internal.h b/fs/proc/internal.h +index 5185d7f6a51e..95b14196f284 100644 +--- a/fs/proc/internal.h ++++ b/fs/proc/internal.h +@@ -44,6 +44,7 @@ struct proc_dir_entry { + struct completion *pde_unload_completion; + const struct inode_operations *proc_iops; + const struct file_operations *proc_fops; ++ const struct dentry_operations *proc_dops; + union { + const struct seq_operations *seq_ops; + int (*single_show)(struct seq_file *, void *); +diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c +index d5e0fcb3439e..a7b12435519e 100644 +--- a/fs/proc/proc_net.c ++++ b/fs/proc/proc_net.c +@@ -38,6 +38,22 @@ static struct net *get_proc_net(const struct inode *inode) + return maybe_get_net(PDE_NET(PDE(inode))); + } + ++static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags) ++{ ++ return 0; ++} ++ ++static const struct dentry_operations proc_net_dentry_ops = { ++ .d_revalidate = proc_net_d_revalidate, ++ .d_delete = always_delete_dentry, ++}; ++ ++static void pde_force_lookup(struct proc_dir_entry *pde) ++{ ++ /* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */ ++ pde->proc_dops = &proc_net_dentry_ops; ++} ++ + static int seq_open_net(struct inode *inode, struct file *file) + { + unsigned int state_size = PDE(inode)->state_size; +@@ -90,6 +106,7 @@ struct proc_dir_entry *proc_create_net_data(const char *name, umode_t mode, + p = proc_create_reg(name, mode, &parent, data); + if (!p) + return NULL; ++ pde_force_lookup(p); + p->proc_fops = &proc_net_seq_fops; + p->seq_ops = ops; + p->state_size = state_size; +@@ -133,6 +150,7 @@ struct proc_dir_entry *proc_create_net_data_write(const char *name, umode_t mode + p = proc_create_reg(name, mode, &parent, data); + if (!p) + return NULL; ++ pde_force_lookup(p); + p->proc_fops = &proc_net_seq_fops; + p->seq_ops = ops; + p->state_size = state_size; +@@ -181,6 +199,7 @@ struct proc_dir_entry *proc_create_net_single(const char *name, umode_t mode, + p = proc_create_reg(name, mode, &parent, data); + if (!p) + return NULL; ++ pde_force_lookup(p); + p->proc_fops = &proc_net_single_fops; + p->single_show = show; + return proc_register(parent, p); +@@ -223,6 +242,7 @@ struct proc_dir_entry *proc_create_net_single_write(const char *name, umode_t mo + p = proc_create_reg(name, mode, &parent, data); + if (!p) + return NULL; ++ pde_force_lookup(p); + p->proc_fops = &proc_net_single_fops; + p->single_show = show; + p->write = write; +diff --git a/include/drm/drm_cache.h b/include/drm/drm_cache.h +index bfe1639df02d..97fc498dc767 100644 +--- a/include/drm/drm_cache.h ++++ b/include/drm/drm_cache.h +@@ -47,6 +47,24 @@ static inline bool drm_arch_can_wc_memory(void) + return false; + #elif defined(CONFIG_MIPS) && defined(CONFIG_CPU_LOONGSON3) + return false; ++#elif defined(CONFIG_ARM) || defined(CONFIG_ARM64) ++ /* ++ * The DRM driver stack is designed to work with cache coherent devices ++ * only, but permits an optimization to be enabled in some cases, where ++ * for some buffers, both the CPU and the GPU use uncached mappings, ++ * removing the need for DMA snooping and allocation in the CPU caches. ++ * ++ * The use of uncached GPU mappings relies on the correct implementation ++ * of the PCIe NoSnoop TLP attribute by the platform, otherwise the GPU ++ * will use cached mappings nonetheless. On x86 platforms, this does not ++ * seem to matter, as uncached CPU mappings will snoop the caches in any ++ * case. However, on ARM and arm64, enabling this optimization on a ++ * platform where NoSnoop is ignored results in loss of coherency, which ++ * breaks correct operation of the device. Since we have no way of ++ * detecting whether NoSnoop works or not, just disable this ++ * optimization entirely for ARM and arm64. ++ */ ++ return false; + #else + return true; + #endif +diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h +index 8bdbb5f29494..3188c0bef3e7 100644 +--- a/include/linux/irqchip/arm-gic-v3.h ++++ b/include/linux/irqchip/arm-gic-v3.h +@@ -319,7 +319,7 @@ + #define GITS_TYPER_PLPIS (1UL << 0) + #define GITS_TYPER_VLPIS (1UL << 1) + #define GITS_TYPER_ITT_ENTRY_SIZE_SHIFT 4 +-#define GITS_TYPER_ITT_ENTRY_SIZE(r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0x1f) + 1) ++#define GITS_TYPER_ITT_ENTRY_SIZE(r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0xf) + 1) + #define GITS_TYPER_IDBITS_SHIFT 8 + #define GITS_TYPER_DEVBITS_SHIFT 13 + #define GITS_TYPER_DEVBITS(r) ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1) +diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h +index 7ddfc65586b0..4335bd771ce5 100644 +--- a/include/linux/stmmac.h ++++ b/include/linux/stmmac.h +@@ -184,6 +184,7 @@ struct plat_stmmacenet_data { + struct clk *pclk; + struct clk *clk_ptp_ref; + unsigned int clk_ptp_rate; ++ unsigned int clk_ref_rate; + struct reset_control *stmmac_rst; + struct stmmac_axi *axi; + int has_gmac4; +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index 03cc59ee9c95..cebadd6af4d9 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -677,7 +677,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l) + } + + if (htab_is_prealloc(htab)) { +- pcpu_freelist_push(&htab->freelist, &l->fnode); ++ __pcpu_freelist_push(&htab->freelist, &l->fnode); + } else { + atomic_dec(&htab->count); + l->htab = htab; +@@ -739,7 +739,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, + } else { + struct pcpu_freelist_node *l; + +- l = pcpu_freelist_pop(&htab->freelist); ++ l = __pcpu_freelist_pop(&htab->freelist); + if (!l) + return ERR_PTR(-E2BIG); + l_new = container_of(l, struct htab_elem, fnode); +diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c +index 673fa6fe2d73..0c1b4ba9e90e 100644 +--- a/kernel/bpf/percpu_freelist.c ++++ b/kernel/bpf/percpu_freelist.c +@@ -28,8 +28,8 @@ void pcpu_freelist_destroy(struct pcpu_freelist *s) + free_percpu(s->freelist); + } + +-static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head, +- struct pcpu_freelist_node *node) ++static inline void ___pcpu_freelist_push(struct pcpu_freelist_head *head, ++ struct pcpu_freelist_node *node) + { + raw_spin_lock(&head->lock); + node->next = head->first; +@@ -37,12 +37,22 @@ static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head, + raw_spin_unlock(&head->lock); + } + +-void pcpu_freelist_push(struct pcpu_freelist *s, ++void __pcpu_freelist_push(struct pcpu_freelist *s, + struct pcpu_freelist_node *node) + { + struct pcpu_freelist_head *head = this_cpu_ptr(s->freelist); + +- __pcpu_freelist_push(head, node); ++ ___pcpu_freelist_push(head, node); ++} ++ ++void pcpu_freelist_push(struct pcpu_freelist *s, ++ struct pcpu_freelist_node *node) ++{ ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ __pcpu_freelist_push(s, node); ++ local_irq_restore(flags); + } + + void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size, +@@ -63,7 +73,7 @@ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size, + for_each_possible_cpu(cpu) { + again: + head = per_cpu_ptr(s->freelist, cpu); +- __pcpu_freelist_push(head, buf); ++ ___pcpu_freelist_push(head, buf); + i++; + buf += elem_size; + if (i == nr_elems) +@@ -74,14 +84,12 @@ again: + local_irq_restore(flags); + } + +-struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s) ++struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *s) + { + struct pcpu_freelist_head *head; + struct pcpu_freelist_node *node; +- unsigned long flags; + int orig_cpu, cpu; + +- local_irq_save(flags); + orig_cpu = cpu = raw_smp_processor_id(); + while (1) { + head = per_cpu_ptr(s->freelist, cpu); +@@ -89,16 +97,25 @@ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s) + node = head->first; + if (node) { + head->first = node->next; +- raw_spin_unlock_irqrestore(&head->lock, flags); ++ raw_spin_unlock(&head->lock); + return node; + } + raw_spin_unlock(&head->lock); + cpu = cpumask_next(cpu, cpu_possible_mask); + if (cpu >= nr_cpu_ids) + cpu = 0; +- if (cpu == orig_cpu) { +- local_irq_restore(flags); ++ if (cpu == orig_cpu) + return NULL; +- } + } + } ++ ++struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s) ++{ ++ struct pcpu_freelist_node *ret; ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ ret = __pcpu_freelist_pop(s); ++ local_irq_restore(flags); ++ return ret; ++} +diff --git a/kernel/bpf/percpu_freelist.h b/kernel/bpf/percpu_freelist.h +index 3049aae8ea1e..c3960118e617 100644 +--- a/kernel/bpf/percpu_freelist.h ++++ b/kernel/bpf/percpu_freelist.h +@@ -22,8 +22,12 @@ struct pcpu_freelist_node { + struct pcpu_freelist_node *next; + }; + ++/* pcpu_freelist_* do spin_lock_irqsave. */ + void pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *); + struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *); ++/* __pcpu_freelist_* do spin_lock only. caller must disable irqs. */ ++void __pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *); ++struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *); + void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size, + u32 nr_elems); + int pcpu_freelist_init(struct pcpu_freelist *); +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 382c09dddf93..cc40b8be1171 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -701,8 +701,13 @@ static int map_lookup_elem(union bpf_attr *attr) + + if (bpf_map_is_dev_bound(map)) { + err = bpf_map_offload_lookup_elem(map, key, value); +- } else if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH || +- map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) { ++ goto done; ++ } ++ ++ preempt_disable(); ++ this_cpu_inc(bpf_prog_active); ++ if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH || ++ map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) { + err = bpf_percpu_hash_copy(map, key, value); + } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) { + err = bpf_percpu_array_copy(map, key, value); +@@ -722,7 +727,10 @@ static int map_lookup_elem(union bpf_attr *attr) + rcu_read_unlock(); + err = ptr ? 0 : -ENOENT; + } ++ this_cpu_dec(bpf_prog_active); ++ preempt_enable(); + ++done: + if (err) + goto free_value; + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 4fb9d5054618..aa996a0854b9 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -436,18 +436,18 @@ int perf_proc_update_handler(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, + loff_t *ppos) + { +- int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); +- +- if (ret || !write) +- return ret; +- ++ int ret; ++ int perf_cpu = sysctl_perf_cpu_time_max_percent; + /* + * If throttling is disabled don't allow the write: + */ +- if (sysctl_perf_cpu_time_max_percent == 100 || +- sysctl_perf_cpu_time_max_percent == 0) ++ if (write && (perf_cpu == 100 || perf_cpu == 0)) + return -EINVAL; + ++ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); ++ if (ret || !write) ++ return ret; ++ + max_samples_per_tick = DIV_ROUND_UP(sysctl_perf_event_sample_rate, HZ); + perf_sample_period_ns = NSEC_PER_SEC / sysctl_perf_event_sample_rate; + update_perf_cpu_limits(); +diff --git a/kernel/relay.c b/kernel/relay.c +index 04f248644e06..9e0f52375487 100644 +--- a/kernel/relay.c ++++ b/kernel/relay.c +@@ -428,6 +428,8 @@ static struct dentry *relay_create_buf_file(struct rchan *chan, + dentry = chan->cb->create_buf_file(tmpname, chan->parent, + S_IRUSR, buf, + &chan->is_global); ++ if (IS_ERR(dentry)) ++ dentry = NULL; + + kfree(tmpname); + +@@ -461,7 +463,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu) + dentry = chan->cb->create_buf_file(NULL, NULL, + S_IRUSR, buf, + &chan->is_global); +- if (WARN_ON(dentry)) ++ if (IS_ERR_OR_NULL(dentry)) + goto free_buf; + } + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 9864a35c8bb5..6c28d519447d 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -1158,22 +1158,12 @@ static int __bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog * + + int bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *prog) + { +- int err; +- +- mutex_lock(&bpf_event_mutex); +- err = __bpf_probe_register(btp, prog); +- mutex_unlock(&bpf_event_mutex); +- return err; ++ return __bpf_probe_register(btp, prog); + } + + int bpf_probe_unregister(struct bpf_raw_event_map *btp, struct bpf_prog *prog) + { +- int err; +- +- mutex_lock(&bpf_event_mutex); +- err = tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog); +- mutex_unlock(&bpf_event_mutex); +- return err; ++ return tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog); + } + + int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id, +diff --git a/lib/test_kmod.c b/lib/test_kmod.c +index d82d022111e0..9cf77628fc91 100644 +--- a/lib/test_kmod.c ++++ b/lib/test_kmod.c +@@ -632,7 +632,7 @@ static void __kmod_config_free(struct test_config *config) + config->test_driver = NULL; + + kfree_const(config->test_fs); +- config->test_driver = NULL; ++ config->test_fs = NULL; + } + + static void kmod_config_free(struct kmod_test_device *test_dev) +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index c6119ad3561e..156991edec2a 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -1213,11 +1213,13 @@ static inline int pageblock_free(struct page *page) + return PageBuddy(page) && page_order(page) >= pageblock_order; + } + +-/* Return the start of the next active pageblock after a given page */ +-static struct page *next_active_pageblock(struct page *page) ++/* Return the pfn of the start of the next active pageblock after a given pfn */ ++static unsigned long next_active_pageblock(unsigned long pfn) + { ++ struct page *page = pfn_to_page(pfn); ++ + /* Ensure the starting page is pageblock-aligned */ +- BUG_ON(page_to_pfn(page) & (pageblock_nr_pages - 1)); ++ BUG_ON(pfn & (pageblock_nr_pages - 1)); + + /* If the entire pageblock is free, move to the end of free page */ + if (pageblock_free(page)) { +@@ -1225,16 +1227,16 @@ static struct page *next_active_pageblock(struct page *page) + /* be careful. we don't have locks, page_order can be changed.*/ + order = page_order(page); + if ((order < MAX_ORDER) && (order >= pageblock_order)) +- return page + (1 << order); ++ return pfn + (1 << order); + } + +- return page + pageblock_nr_pages; ++ return pfn + pageblock_nr_pages; + } + +-static bool is_pageblock_removable_nolock(struct page *page) ++static bool is_pageblock_removable_nolock(unsigned long pfn) + { ++ struct page *page = pfn_to_page(pfn); + struct zone *zone; +- unsigned long pfn; + + /* + * We have to be careful here because we are iterating over memory +@@ -1257,12 +1259,14 @@ static bool is_pageblock_removable_nolock(struct page *page) + /* Checks if this range of memory is likely to be hot-removable. */ + bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages) + { +- struct page *page = pfn_to_page(start_pfn); +- struct page *end_page = page + nr_pages; ++ unsigned long end_pfn, pfn; ++ ++ end_pfn = min(start_pfn + nr_pages, ++ zone_end_pfn(page_zone(pfn_to_page(start_pfn)))); + + /* Check the starting page of each pageblock within the range */ +- for (; page < end_page; page = next_active_pageblock(page)) { +- if (!is_pageblock_removable_nolock(page)) ++ for (pfn = start_pfn; pfn < end_pfn; pfn = next_active_pageblock(pfn)) { ++ if (!is_pageblock_removable_nolock(pfn)) + return false; + cond_resched(); + } +@@ -1298,6 +1302,9 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, + i++; + if (i == MAX_ORDER_NR_PAGES || pfn + i >= end_pfn) + continue; ++ /* Check if we got outside of the zone */ ++ if (zone && !zone_spans_pfn(zone, pfn + i)) ++ return 0; + page = pfn_to_page(pfn + i); + if (zone && page_zone(page) != zone) + return 0; +diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c +index e8090f099eb8..ef0dec20c7d8 100644 +--- a/net/batman-adv/bat_v_elp.c ++++ b/net/batman-adv/bat_v_elp.c +@@ -104,6 +104,9 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh) + + ret = cfg80211_get_station(real_netdev, neigh->addr, &sinfo); + ++ /* free the TID stats immediately */ ++ cfg80211_sinfo_release_content(&sinfo); ++ + dev_put(real_netdev); + if (ret == -ENOENT) { + /* Node is not associated anymore! It would be +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 5e55cef0cec3..6693e209efe8 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -2293,9 +2293,12 @@ static int compat_do_replace(struct net *net, void __user *user, + + xt_compat_lock(NFPROTO_BRIDGE); + +- ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries); +- if (ret < 0) +- goto out_unlock; ++ if (tmp.nentries) { ++ ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries); ++ if (ret < 0) ++ goto out_unlock; ++ } ++ + ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); + if (ret < 0) + goto out_unlock; +diff --git a/net/core/filter.c b/net/core/filter.c +index fb0080e84bd4..bed9061102f4 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -3909,10 +3909,12 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, + /* Only some socketops are supported */ + switch (optname) { + case SO_RCVBUF: ++ val = min_t(u32, val, sysctl_rmem_max); + sk->sk_userlocks |= SOCK_RCVBUF_LOCK; + sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF); + break; + case SO_SNDBUF: ++ val = min_t(u32, val, sysctl_wmem_max); + sk->sk_userlocks |= SOCK_SNDBUF_LOCK; + sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF); + break; +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index 7f56944b020f..40a7cd56e008 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -74,6 +74,33 @@ drop: + return 0; + } + ++static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi, ++ int encap_type) ++{ ++ struct ip_tunnel *tunnel; ++ const struct iphdr *iph = ip_hdr(skb); ++ struct net *net = dev_net(skb->dev); ++ struct ip_tunnel_net *itn = net_generic(net, vti_net_id); ++ ++ tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY, ++ iph->saddr, iph->daddr, 0); ++ if (tunnel) { ++ if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) ++ goto drop; ++ ++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel; ++ ++ skb->dev = tunnel->dev; ++ ++ return xfrm_input(skb, nexthdr, spi, encap_type); ++ } ++ ++ return -EINVAL; ++drop: ++ kfree_skb(skb); ++ return 0; ++} ++ + static int vti_rcv(struct sk_buff *skb) + { + XFRM_SPI_SKB_CB(skb)->family = AF_INET; +@@ -82,6 +109,14 @@ static int vti_rcv(struct sk_buff *skb) + return vti_input(skb, ip_hdr(skb)->protocol, 0, 0); + } + ++static int vti_rcv_ipip(struct sk_buff *skb) ++{ ++ XFRM_SPI_SKB_CB(skb)->family = AF_INET; ++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); ++ ++ return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0); ++} ++ + static int vti_rcv_cb(struct sk_buff *skb, int err) + { + unsigned short family; +@@ -435,6 +470,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = { + .priority = 100, + }; + ++static struct xfrm_tunnel ipip_handler __read_mostly = { ++ .handler = vti_rcv_ipip, ++ .err_handler = vti4_err, ++ .priority = 0, ++}; ++ + static int __net_init vti_init_net(struct net *net) + { + int err; +@@ -603,6 +644,13 @@ static int __init vti_init(void) + if (err < 0) + goto xfrm_proto_comp_failed; + ++ msg = "ipip tunnel"; ++ err = xfrm4_tunnel_register(&ipip_handler, AF_INET); ++ if (err < 0) { ++ pr_info("%s: cant't register tunnel\n",__func__); ++ goto xfrm_tunnel_failed; ++ } ++ + msg = "netlink interface"; + err = rtnl_link_register(&vti_link_ops); + if (err < 0) +@@ -612,6 +660,8 @@ static int __init vti_init(void) + + rtnl_link_failed: + xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP); ++xfrm_tunnel_failed: ++ xfrm4_tunnel_deregister(&ipip_handler, AF_INET); + xfrm_proto_comp_failed: + xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH); + xfrm_proto_ah_failed: +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index 518364f4abcc..55a77314340a 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -2220,6 +2220,18 @@ static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user + u->tcp_fin_timeout, + u->udp_timeout); + ++#ifdef CONFIG_IP_VS_PROTO_TCP ++ if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) || ++ u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) { ++ return -EINVAL; ++ } ++#endif ++ ++#ifdef CONFIG_IP_VS_PROTO_UDP ++ if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ)) ++ return -EINVAL; ++#endif ++ + #ifdef CONFIG_IP_VS_PROTO_TCP + if (u->tcp_timeout) { + pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP); +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 277d02a8cac8..895171a2e1f1 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1007,6 +1007,22 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, + } + + if (nf_ct_key_equal(h, tuple, zone, net)) { ++ /* Tuple is taken already, so caller will need to find ++ * a new source port to use. ++ * ++ * Only exception: ++ * If the *original tuples* are identical, then both ++ * conntracks refer to the same flow. ++ * This is a rare situation, it can occur e.g. when ++ * more than one UDP packet is sent from same socket ++ * in different threads. ++ * ++ * Let nf_ct_resolve_clash() deal with this later. ++ */ ++ if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple, ++ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)) ++ continue; ++ + NF_CT_STAT_INC_ATOMIC(net, found); + rcu_read_unlock(); + return 1; +diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c +index 0d0d68c989df..1dae02a97ee3 100644 +--- a/net/netfilter/xt_TEE.c ++++ b/net/netfilter/xt_TEE.c +@@ -14,6 +14,8 @@ + #include + #include + #include ++#include ++#include + #include + #include + #include +@@ -25,8 +27,15 @@ struct xt_tee_priv { + int oif; + }; + ++static unsigned int tee_net_id __read_mostly; + static const union nf_inet_addr tee_zero_address; + ++struct tee_net { ++ struct list_head priv_list; ++ /* lock protects the priv_list */ ++ struct mutex lock; ++}; ++ + static unsigned int + tee_tg4(struct sk_buff *skb, const struct xt_action_param *par) + { +@@ -51,17 +60,16 @@ tee_tg6(struct sk_buff *skb, const struct xt_action_param *par) + } + #endif + +-static DEFINE_MUTEX(priv_list_mutex); +-static LIST_HEAD(priv_list); +- + static int tee_netdev_event(struct notifier_block *this, unsigned long event, + void *ptr) + { + struct net_device *dev = netdev_notifier_info_to_dev(ptr); ++ struct net *net = dev_net(dev); ++ struct tee_net *tn = net_generic(net, tee_net_id); + struct xt_tee_priv *priv; + +- mutex_lock(&priv_list_mutex); +- list_for_each_entry(priv, &priv_list, list) { ++ mutex_lock(&tn->lock); ++ list_for_each_entry(priv, &tn->priv_list, list) { + switch (event) { + case NETDEV_REGISTER: + if (!strcmp(dev->name, priv->tginfo->oif)) +@@ -79,13 +87,14 @@ static int tee_netdev_event(struct notifier_block *this, unsigned long event, + break; + } + } +- mutex_unlock(&priv_list_mutex); ++ mutex_unlock(&tn->lock); + + return NOTIFY_DONE; + } + + static int tee_tg_check(const struct xt_tgchk_param *par) + { ++ struct tee_net *tn = net_generic(par->net, tee_net_id); + struct xt_tee_tginfo *info = par->targinfo; + struct xt_tee_priv *priv; + +@@ -95,6 +104,8 @@ static int tee_tg_check(const struct xt_tgchk_param *par) + return -EINVAL; + + if (info->oif[0]) { ++ struct net_device *dev; ++ + if (info->oif[sizeof(info->oif)-1] != '\0') + return -EINVAL; + +@@ -106,9 +117,14 @@ static int tee_tg_check(const struct xt_tgchk_param *par) + priv->oif = -1; + info->priv = priv; + +- mutex_lock(&priv_list_mutex); +- list_add(&priv->list, &priv_list); +- mutex_unlock(&priv_list_mutex); ++ dev = dev_get_by_name(par->net, info->oif); ++ if (dev) { ++ priv->oif = dev->ifindex; ++ dev_put(dev); ++ } ++ mutex_lock(&tn->lock); ++ list_add(&priv->list, &tn->priv_list); ++ mutex_unlock(&tn->lock); + } else + info->priv = NULL; + +@@ -118,12 +134,13 @@ static int tee_tg_check(const struct xt_tgchk_param *par) + + static void tee_tg_destroy(const struct xt_tgdtor_param *par) + { ++ struct tee_net *tn = net_generic(par->net, tee_net_id); + struct xt_tee_tginfo *info = par->targinfo; + + if (info->priv) { +- mutex_lock(&priv_list_mutex); ++ mutex_lock(&tn->lock); + list_del(&info->priv->list); +- mutex_unlock(&priv_list_mutex); ++ mutex_unlock(&tn->lock); + kfree(info->priv); + } + static_key_slow_dec(&xt_tee_enabled); +@@ -156,6 +173,21 @@ static struct xt_target tee_tg_reg[] __read_mostly = { + #endif + }; + ++static int __net_init tee_net_init(struct net *net) ++{ ++ struct tee_net *tn = net_generic(net, tee_net_id); ++ ++ INIT_LIST_HEAD(&tn->priv_list); ++ mutex_init(&tn->lock); ++ return 0; ++} ++ ++static struct pernet_operations tee_net_ops = { ++ .init = tee_net_init, ++ .id = &tee_net_id, ++ .size = sizeof(struct tee_net), ++}; ++ + static struct notifier_block tee_netdev_notifier = { + .notifier_call = tee_netdev_event, + }; +@@ -164,22 +196,32 @@ static int __init tee_tg_init(void) + { + int ret; + +- ret = xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); +- if (ret) ++ ret = register_pernet_subsys(&tee_net_ops); ++ if (ret < 0) + return ret; ++ ++ ret = xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); ++ if (ret < 0) ++ goto cleanup_subsys; ++ + ret = register_netdevice_notifier(&tee_netdev_notifier); +- if (ret) { +- xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); +- return ret; +- } ++ if (ret < 0) ++ goto unregister_targets; + + return 0; ++ ++unregister_targets: ++ xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); ++cleanup_subsys: ++ unregister_pernet_subsys(&tee_net_ops); ++ return ret; + } + + static void __exit tee_tg_exit(void) + { + unregister_netdevice_notifier(&tee_netdev_notifier); + xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); ++ unregister_pernet_subsys(&tee_net_ops); + } + + module_init(tee_tg_init); +diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c +index 5d3cce9e8744..15eb5d3d4750 100644 +--- a/net/vmw_vsock/virtio_transport.c ++++ b/net/vmw_vsock/virtio_transport.c +@@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void) + { + struct virtio_vsock *vsock = virtio_vsock_get(); + ++ if (!vsock) ++ return VMADDR_CID_ANY; ++ + return vsock->guest_cid; + } + +@@ -584,10 +587,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev) + + virtio_vsock_update_guest_cid(vsock); + +- ret = vsock_core_init(&virtio_transport.transport); +- if (ret < 0) +- goto out_vqs; +- + vsock->rx_buf_nr = 0; + vsock->rx_buf_max_nr = 0; + atomic_set(&vsock->queued_replies, 0); +@@ -618,8 +617,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev) + mutex_unlock(&the_virtio_vsock_mutex); + return 0; + +-out_vqs: +- vsock->vdev->config->del_vqs(vsock->vdev); + out: + kfree(vsock); + mutex_unlock(&the_virtio_vsock_mutex); +@@ -637,6 +634,9 @@ static void virtio_vsock_remove(struct virtio_device *vdev) + flush_work(&vsock->event_work); + flush_work(&vsock->send_pkt_work); + ++ /* Reset all connected sockets when the device disappear */ ++ vsock_for_each_connected_socket(virtio_vsock_reset_sock); ++ + vdev->config->reset(vdev); + + mutex_lock(&vsock->rx_lock); +@@ -669,7 +669,6 @@ static void virtio_vsock_remove(struct virtio_device *vdev) + + mutex_lock(&the_virtio_vsock_mutex); + the_virtio_vsock = NULL; +- vsock_core_exit(); + mutex_unlock(&the_virtio_vsock_mutex); + + vdev->config->del_vqs(vdev); +@@ -702,14 +701,28 @@ static int __init virtio_vsock_init(void) + virtio_vsock_workqueue = alloc_workqueue("virtio_vsock", 0, 0); + if (!virtio_vsock_workqueue) + return -ENOMEM; ++ + ret = register_virtio_driver(&virtio_vsock_driver); + if (ret) +- destroy_workqueue(virtio_vsock_workqueue); ++ goto out_wq; ++ ++ ret = vsock_core_init(&virtio_transport.transport); ++ if (ret) ++ goto out_vdr; ++ ++ return 0; ++ ++out_vdr: ++ unregister_virtio_driver(&virtio_vsock_driver); ++out_wq: ++ destroy_workqueue(virtio_vsock_workqueue); + return ret; ++ + } + + static void __exit virtio_vsock_exit(void) + { ++ vsock_core_exit(); + unregister_virtio_driver(&virtio_vsock_driver); + destroy_workqueue(virtio_vsock_workqueue); + } +diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c +index 08c88de0ffda..11975ec8d566 100644 +--- a/security/apparmor/domain.c ++++ b/security/apparmor/domain.c +@@ -1444,7 +1444,10 @@ check: + new = aa_label_merge(label, target, GFP_KERNEL); + if (IS_ERR_OR_NULL(new)) { + info = "failed to build target label"; +- error = PTR_ERR(new); ++ if (!new) ++ error = -ENOMEM; ++ else ++ error = PTR_ERR(new); + new = NULL; + perms.allow = 0; + goto audit; +diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c +index b455930a3eaf..ec73d83d0d31 100644 +--- a/tools/bpf/bpftool/map.c ++++ b/tools/bpf/bpftool/map.c +@@ -370,6 +370,20 @@ static char **parse_bytes(char **argv, const char *name, unsigned char *val, + return argv + i; + } + ++/* on per cpu maps we must copy the provided value on all value instances */ ++static void fill_per_cpu_value(struct bpf_map_info *info, void *value) ++{ ++ unsigned int i, n, step; ++ ++ if (!map_is_per_cpu(info->type)) ++ return; ++ ++ n = get_possible_cpus(); ++ step = round_up(info->value_size, 8); ++ for (i = 1; i < n; i++) ++ memcpy(value + i * step, value, info->value_size); ++} ++ + static int parse_elem(char **argv, struct bpf_map_info *info, + void *key, void *value, __u32 key_size, __u32 value_size, + __u32 *flags, __u32 **value_fd) +@@ -449,6 +463,8 @@ static int parse_elem(char **argv, struct bpf_map_info *info, + argv = parse_bytes(argv, "value", value, value_size); + if (!argv) + return -1; ++ ++ fill_per_cpu_value(info, value); + } + + return parse_elem(argv, info, key, NULL, key_size, value_size, +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index 0de024a6cc2b..bbba0d61570f 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -109,13 +109,14 @@ static void print_boot_time(__u64 nsecs, char *buf, unsigned int size) + + static int prog_fd_by_tag(unsigned char *tag) + { +- struct bpf_prog_info info = {}; +- __u32 len = sizeof(info); + unsigned int id = 0; + int err; + int fd; + + while (true) { ++ struct bpf_prog_info info = {}; ++ __u32 len = sizeof(info); ++ + err = bpf_prog_get_next_id(id, &id); + if (err) { + p_err("%s", strerror(errno)); +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 6c1e7ceedcf3..53c11fc0855e 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -1589,13 +1589,8 @@ static void perf_sample__fprint_metric(struct perf_script *script, + .force_header = false, + }; + struct perf_evsel *ev2; +- static bool init; + u64 val; + +- if (!init) { +- perf_stat__init_shadow_stats(); +- init = true; +- } + if (!evsel->stats) + perf_evlist__alloc_stats(script->session->evlist, false); + if (evsel_script(evsel->leader)->gnum++ == 0) +@@ -1658,7 +1653,7 @@ static void process_event(struct perf_script *script, + return; + } + +- if (PRINT_FIELD(TRACE)) { ++ if (PRINT_FIELD(TRACE) && sample->raw_data) { + event_format__fprintf(evsel->tp_format, sample->cpu, + sample->raw_data, sample->raw_size, fp); + } +@@ -2214,6 +2209,8 @@ static int __cmd_script(struct perf_script *script) + + signal(SIGINT, sig_handler); + ++ perf_stat__init_shadow_stats(); ++ + /* override event processing functions */ + if (script->show_task_events) { + script->tool.comm = process_comm_event; +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index 22ab8e67c760..3f43aedb384d 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -2263,19 +2263,30 @@ static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp); + + static bool perf_evlist__add_vfs_getname(struct perf_evlist *evlist) + { +- struct perf_evsel *evsel = perf_evsel__newtp("probe", "vfs_getname"); ++ bool found = false; ++ struct perf_evsel *evsel, *tmp; ++ struct parse_events_error err = { .idx = 0, }; ++ int ret = parse_events(evlist, "probe:vfs_getname*", &err); + +- if (IS_ERR(evsel)) ++ if (ret) + return false; + +- if (perf_evsel__field(evsel, "pathname") == NULL) { ++ evlist__for_each_entry_safe(evlist, evsel, tmp) { ++ if (!strstarts(perf_evsel__name(evsel), "probe:vfs_getname")) ++ continue; ++ ++ if (perf_evsel__field(evsel, "pathname")) { ++ evsel->handler = trace__vfs_getname; ++ found = true; ++ continue; ++ } ++ ++ list_del_init(&evsel->node); ++ evsel->evlist = NULL; + perf_evsel__delete(evsel); +- return false; + } + +- evsel->handler = trace__vfs_getname; +- perf_evlist__add(evlist, evsel); +- return true; ++ return found; + } + + static struct perf_evsel *perf_evsel__new_pgfault(u64 config) +diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c +index 1ccbd3342069..383674f448fc 100644 +--- a/tools/perf/util/cpumap.c ++++ b/tools/perf/util/cpumap.c +@@ -134,7 +134,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list) + if (!cpu_list) + return cpu_map__read_all_cpu_map(); + +- if (!isdigit(*cpu_list)) ++ /* ++ * must handle the case of empty cpumap to cover ++ * TOPOLOGY header for NUMA nodes with no CPU ++ * ( e.g., because of CPU hotplug) ++ */ ++ if (!isdigit(*cpu_list) && *cpu_list != '\0') + goto out; + + while (isdigit(*cpu_list)) { +@@ -181,8 +186,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list) + + if (nr_cpus > 0) + cpus = cpu_map__trim_new(nr_cpus, tmp_cpus); +- else ++ else if (*cpu_list != '\0') + cpus = cpu_map__default_new(); ++ else ++ cpus = cpu_map__dummy_new(); + invalid: + free(tmp_cpus); + out: +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index 6e70cc00c161..a701a8a48f00 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -87,6 +87,11 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym) + return GELF_ST_TYPE(sym->st_info); + } + ++static inline uint8_t elf_sym__visibility(const GElf_Sym *sym) ++{ ++ return GELF_ST_VISIBILITY(sym->st_other); ++} ++ + #ifndef STT_GNU_IFUNC + #define STT_GNU_IFUNC 10 + #endif +@@ -111,7 +116,9 @@ static inline int elf_sym__is_label(const GElf_Sym *sym) + return elf_sym__type(sym) == STT_NOTYPE && + sym->st_name != 0 && + sym->st_shndx != SHN_UNDEF && +- sym->st_shndx != SHN_ABS; ++ sym->st_shndx != SHN_ABS && ++ elf_sym__visibility(sym) != STV_HIDDEN && ++ elf_sym__visibility(sym) != STV_INTERNAL; + } + + static bool elf_sym__filter(GElf_Sym *sym) +diff --git a/tools/testing/selftests/bpf/bpf_util.h b/tools/testing/selftests/bpf/bpf_util.h +index 315a44fa32af..84fd6f1bf33e 100644 +--- a/tools/testing/selftests/bpf/bpf_util.h ++++ b/tools/testing/selftests/bpf/bpf_util.h +@@ -13,7 +13,7 @@ static inline unsigned int bpf_num_possible_cpus(void) + unsigned int start, end, possible_cpus = 0; + char buff[128]; + FILE *fp; +- int n; ++ int len, n, i, j = 0; + + fp = fopen(fcpu, "r"); + if (!fp) { +@@ -21,17 +21,27 @@ static inline unsigned int bpf_num_possible_cpus(void) + exit(1); + } + +- while (fgets(buff, sizeof(buff), fp)) { +- n = sscanf(buff, "%u-%u", &start, &end); +- if (n == 0) { +- printf("Failed to retrieve # possible CPUs!\n"); +- exit(1); +- } else if (n == 1) { +- end = start; ++ if (!fgets(buff, sizeof(buff), fp)) { ++ printf("Failed to read %s!\n", fcpu); ++ exit(1); ++ } ++ ++ len = strlen(buff); ++ for (i = 0; i <= len; i++) { ++ if (buff[i] == ',' || buff[i] == '\0') { ++ buff[i] = '\0'; ++ n = sscanf(&buff[j], "%u-%u", &start, &end); ++ if (n <= 0) { ++ printf("Failed to retrieve # possible CPUs!\n"); ++ exit(1); ++ } else if (n == 1) { ++ end = start; ++ } ++ possible_cpus += end - start + 1; ++ j = i + 1; + } +- possible_cpus = start == 0 ? end + 1 : 0; +- break; + } ++ + fclose(fp); + + return possible_cpus; +diff --git a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh +index bab13dd025a6..0d26b5e3f966 100755 +--- a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh ++++ b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh +@@ -37,6 +37,10 @@ prerequisite() + exit $ksft_skip + fi + ++ present_cpus=`cat $SYSFS/devices/system/cpu/present` ++ present_max=${present_cpus##*-} ++ echo "present_cpus = $present_cpus present_max = $present_max" ++ + echo -e "\t Cpus in online state: $online_cpus" + + offline_cpus=`cat $SYSFS/devices/system/cpu/offline` +@@ -151,6 +155,8 @@ online_cpus=0 + online_max=0 + offline_cpus=0 + offline_max=0 ++present_cpus=0 ++present_max=0 + + while getopts e:ahp: opt; do + case $opt in +@@ -190,9 +196,10 @@ if [ $allcpus -eq 0 ]; then + online_cpu_expect_success $online_max + + if [[ $offline_cpus -gt 0 ]]; then +- echo -e "\t offline to online to offline: cpu $offline_max" +- online_cpu_expect_success $offline_max +- offline_cpu_expect_success $offline_max ++ echo -e "\t offline to online to offline: cpu $present_max" ++ online_cpu_expect_success $present_max ++ offline_cpu_expect_success $present_max ++ online_cpu $present_max + fi + exit 0 + else +diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile +index 919aa2ac00af..9a3764a1084e 100644 +--- a/tools/testing/selftests/net/Makefile ++++ b/tools/testing/selftests/net/Makefile +@@ -18,6 +18,6 @@ TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict tls + KSFT_KHDR_INSTALL := 1 + include ../lib.mk + +-$(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma ++$(OUTPUT)/reuseport_bpf_numa: LDLIBS += -lnuma + $(OUTPUT)/tcp_mmap: LDFLAGS += -lpthread + $(OUTPUT)/tcp_inq: LDFLAGS += -lpthread +diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile +index 47ed6cef93fb..c9ff2b47bd1c 100644 +--- a/tools/testing/selftests/netfilter/Makefile ++++ b/tools/testing/selftests/netfilter/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + # Makefile for netfilter selftests + +-TEST_PROGS := nft_trans_stress.sh ++TEST_PROGS := nft_trans_stress.sh nft_nat.sh + + include ../lib.mk +diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config +index 1017313e41a8..59caa8f71cd8 100644 +--- a/tools/testing/selftests/netfilter/config ++++ b/tools/testing/selftests/netfilter/config +@@ -1,2 +1,2 @@ + CONFIG_NET_NS=y +-NF_TABLES_INET=y ++CONFIG_NF_TABLES_INET=y +diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh +new file mode 100755 +index 000000000000..8ec76681605c +--- /dev/null ++++ b/tools/testing/selftests/netfilter/nft_nat.sh +@@ -0,0 +1,762 @@ ++#!/bin/bash ++# ++# This test is for basic NAT functionality: snat, dnat, redirect, masquerade. ++# ++ ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ret=0 ++ ++nft --version > /dev/null 2>&1 ++if [ $? -ne 0 ];then ++ echo "SKIP: Could not run test without nft tool" ++ exit $ksft_skip ++fi ++ ++ip -Version > /dev/null 2>&1 ++if [ $? -ne 0 ];then ++ echo "SKIP: Could not run test without ip tool" ++ exit $ksft_skip ++fi ++ ++ip netns add ns0 ++ip netns add ns1 ++ip netns add ns2 ++ ++ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 ++ip link add veth1 netns ns0 type veth peer name eth0 netns ns2 ++ ++ip -net ns0 link set lo up ++ip -net ns0 link set veth0 up ++ip -net ns0 addr add 10.0.1.1/24 dev veth0 ++ip -net ns0 addr add dead:1::1/64 dev veth0 ++ ++ip -net ns0 link set veth1 up ++ip -net ns0 addr add 10.0.2.1/24 dev veth1 ++ip -net ns0 addr add dead:2::1/64 dev veth1 ++ ++for i in 1 2; do ++ ip -net ns$i link set lo up ++ ip -net ns$i link set eth0 up ++ ip -net ns$i addr add 10.0.$i.99/24 dev eth0 ++ ip -net ns$i route add default via 10.0.$i.1 ++ ip -net ns$i addr add dead:$i::99/64 dev eth0 ++ ip -net ns$i route add default via dead:$i::1 ++done ++ ++bad_counter() ++{ ++ local ns=$1 ++ local counter=$2 ++ local expect=$3 ++ ++ echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2 ++ ip netns exec $ns nft list counter inet filter $counter 1>&2 ++} ++ ++check_counters() ++{ ++ ns=$1 ++ local lret=0 ++ ++ cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84") ++ if [ $? -ne 0 ]; then ++ bad_counter $ns ns0in "packets 1 bytes 84" ++ lret=1 ++ fi ++ cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84") ++ if [ $? -ne 0 ]; then ++ bad_counter $ns ns0out "packets 1 bytes 84" ++ lret=1 ++ fi ++ ++ expect="packets 1 bytes 104" ++ cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter $ns ns0in6 "$expect" ++ lret=1 ++ fi ++ cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter $ns ns0out6 "$expect" ++ lret=1 ++ fi ++ ++ return $lret ++} ++ ++check_ns0_counters() ++{ ++ local ns=$1 ++ local lret=0 ++ ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns0in "packets 0 bytes 0" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns0in6 "packets 0 bytes 0" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns0out "packets 0 bytes 0" ++ lret=1 ++ fi ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns0out6 "packets 0 bytes 0" ++ lret=1 ++ fi ++ ++ for dir in "in" "out" ; do ++ expect="packets 1 bytes 84" ++ cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 $ns$dir "$expect" ++ lret=1 ++ fi ++ ++ expect="packets 1 bytes 104" ++ cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 $ns$dir6 "$expect" ++ lret=1 ++ fi ++ done ++ ++ return $lret ++} ++ ++reset_counters() ++{ ++ for i in 0 1 2;do ++ ip netns exec ns$i nft reset counters inet > /dev/null ++ done ++} ++ ++test_local_dnat6() ++{ ++ local lret=0 ++ip netns exec ns0 nft -f - < /dev/null ++ if [ $? -ne 0 ]; then ++ lret=1 ++ echo "ERROR: ping6 failed" ++ return $lret ++ fi ++ ++ expect="packets 0 bytes 0" ++ for dir in "in6" "out6" ; do ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ expect="packets 1 bytes 104" ++ for dir in "in6" "out6" ; do ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns2$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # expect 0 count in ns1 ++ expect="packets 0 bytes 0" ++ for dir in "in6" "out6" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # expect 1 packet in ns2 ++ expect="packets 1 bytes 104" ++ for dir in "in6" "out6" ; do ++ cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns0$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was NATted to ns2" ++ ip netns exec ns0 nft flush chain ip6 nat output ++ ++ return $lret ++} ++ ++test_local_dnat() ++{ ++ local lret=0 ++ip netns exec ns0 nft -f - < /dev/null ++ if [ $? -ne 0 ]; then ++ lret=1 ++ echo "ERROR: ping failed" ++ return $lret ++ fi ++ ++ expect="packets 0 bytes 0" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ expect="packets 1 bytes 84" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns2$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # expect 0 count in ns1 ++ expect="packets 0 bytes 0" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # expect 1 packet in ns2 ++ expect="packets 1 bytes 84" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns0$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ test $lret -eq 0 && echo "PASS: ping to ns1 was NATted to ns2" ++ ++ ip netns exec ns0 nft flush chain ip nat output ++ ++ reset_counters ++ ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null ++ if [ $? -ne 0 ]; then ++ lret=1 ++ echo "ERROR: ping failed" ++ return $lret ++ fi ++ ++ expect="packets 1 bytes 84" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ expect="packets 0 bytes 0" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns2$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # expect 1 count in ns1 ++ expect="packets 1 bytes 84" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns0 ns0$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # expect 0 packet in ns2 ++ expect="packets 0 bytes 0" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns2$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ test $lret -eq 0 && echo "PASS: ping to ns1 OK after nat output chain flush" ++ ++ return $lret ++} ++ ++ ++test_masquerade6() ++{ ++ local lret=0 ++ ++ ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null ++ ++ ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 ++ if [ $? -ne 0 ] ; then ++ echo "ERROR: cannot ping ns1 from ns2 via ipv6" ++ return 1 ++ lret=1 ++ fi ++ ++ expect="packets 1 bytes 104" ++ for dir in "in6" "out6" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns2$dir "$expect" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ reset_counters ++ ++# add masquerading rule ++ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ if [ $? -ne 0 ] ; then ++ echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerading" ++ lret=1 ++ fi ++ ++ # ns1 should have seen packets from ns0, due to masquerade ++ expect="packets 1 bytes 104" ++ for dir in "in6" "out6" ; do ++ ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # ns1 should not have seen packets from ns2, due to masquerade ++ expect="packets 0 bytes 0" ++ for dir in "in6" "out6" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ ip netns exec ns0 nft flush chain ip6 nat postrouting ++ if [ $? -ne 0 ]; then ++ echo "ERROR: Could not flush ip6 nat postrouting" 1>&2 ++ lret=1 ++ fi ++ ++ test $lret -eq 0 && echo "PASS: IPv6 masquerade for ns2" ++ ++ return $lret ++} ++ ++test_masquerade() ++{ ++ local lret=0 ++ ++ ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null ++ ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null ++ ++ ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 ++ if [ $? -ne 0 ] ; then ++ echo "ERROR: canot ping ns1 from ns2" ++ lret=1 ++ fi ++ ++ expect="packets 1 bytes 84" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns2$dir "$expect" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ reset_counters ++ ++# add masquerading rule ++ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ if [ $? -ne 0 ] ; then ++ echo "ERROR: cannot ping ns1 from ns2 with active ip masquerading" ++ lret=1 ++ fi ++ ++ # ns1 should have seen packets from ns0, due to masquerade ++ expect="packets 1 bytes 84" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # ns1 should not have seen packets from ns2, due to masquerade ++ expect="packets 0 bytes 0" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ ip netns exec ns0 nft flush chain ip nat postrouting ++ if [ $? -ne 0 ]; then ++ echo "ERROR: Could not flush nat postrouting" 1>&2 ++ lret=1 ++ fi ++ ++ test $lret -eq 0 && echo "PASS: IP masquerade for ns2" ++ ++ return $lret ++} ++ ++test_redirect6() ++{ ++ local lret=0 ++ ++ ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null ++ ++ ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 ++ if [ $? -ne 0 ] ; then ++ echo "ERROR: cannnot ping ns1 from ns2 via ipv6" ++ lret=1 ++ fi ++ ++ expect="packets 1 bytes 104" ++ for dir in "in6" "out6" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns2$dir "$expect" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ reset_counters ++ ++# add redirect rule ++ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ if [ $? -ne 0 ] ; then ++ echo "ERROR: cannot ping ns1 from ns2 with active ip6 redirect" ++ lret=1 ++ fi ++ ++ # ns1 should have seen no packets from ns2, due to redirection ++ expect="packets 0 bytes 0" ++ for dir in "in6" "out6" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # ns0 should have seen packets from ns2, due to masquerade ++ expect="packets 1 bytes 104" ++ for dir in "in6" "out6" ; do ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ ip netns exec ns0 nft delete table ip6 nat ++ if [ $? -ne 0 ]; then ++ echo "ERROR: Could not delete ip6 nat table" 1>&2 ++ lret=1 ++ fi ++ ++ test $lret -eq 0 && echo "PASS: IPv6 redirection for ns2" ++ ++ return $lret ++} ++ ++test_redirect() ++{ ++ local lret=0 ++ ++ ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null ++ ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null ++ ++ ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 ++ if [ $? -ne 0 ] ; then ++ echo "ERROR: cannot ping ns1 from ns2" ++ lret=1 ++ fi ++ ++ expect="packets 1 bytes 84" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns2$dir "$expect" ++ lret=1 ++ fi ++ ++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns2 ns1$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ reset_counters ++ ++# add redirect rule ++ip netns exec ns0 nft -f - < /dev/null # ping ns2->ns1 ++ if [ $? -ne 0 ] ; then ++ echo "ERROR: cannot ping ns1 from ns2 with active ip redirect" ++ lret=1 ++ fi ++ ++ # ns1 should have seen no packets from ns2, due to redirection ++ expect="packets 0 bytes 0" ++ for dir in "in" "out" ; do ++ ++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ # ns0 should have seen packets from ns2, due to masquerade ++ expect="packets 1 bytes 84" ++ for dir in "in" "out" ; do ++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") ++ if [ $? -ne 0 ]; then ++ bad_counter ns1 ns0$dir "$expect" ++ lret=1 ++ fi ++ done ++ ++ ip netns exec ns0 nft delete table ip nat ++ if [ $? -ne 0 ]; then ++ echo "ERROR: Could not delete nat table" 1>&2 ++ lret=1 ++ fi ++ ++ test $lret -eq 0 && echo "PASS: IP redirection for ns2" ++ ++ return $lret ++} ++ ++ ++# ip netns exec ns0 ping -c 1 -q 10.0.$i.99 ++for i in 0 1 2; do ++ip netns exec ns$i nft -f - < /dev/null ++ if [ $? -ne 0 ];then ++ echo "ERROR: Could not reach other namespace(s)" 1>&2 ++ ret=1 ++ fi ++ ++ ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null ++ if [ $? -ne 0 ];then ++ echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2 ++ ret=1 ++ fi ++ check_counters ns$i ++ if [ $? -ne 0 ]; then ++ ret=1 ++ fi ++ ++ check_ns0_counters ns$i ++ if [ $? -ne 0 ]; then ++ ret=1 ++ fi ++ reset_counters ++done ++ ++if [ $ret -eq 0 ];then ++ echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2" ++fi ++ ++reset_counters ++test_local_dnat ++test_local_dnat6 ++ ++reset_counters ++test_masquerade ++test_masquerade6 ++ ++reset_counters ++test_redirect ++test_redirect6 ++ ++for i in 0 1 2; do ip netns del ns$i;done ++ ++exit $ret +diff --git a/tools/testing/selftests/proc/.gitignore b/tools/testing/selftests/proc/.gitignore +index 82121a81681f..29bac5ef9a93 100644 +--- a/tools/testing/selftests/proc/.gitignore ++++ b/tools/testing/selftests/proc/.gitignore +@@ -10,4 +10,5 @@ + /proc-uptime-002 + /read + /self ++/setns-dcache + /thread-self +diff --git a/tools/testing/selftests/proc/Makefile b/tools/testing/selftests/proc/Makefile +index 1c12c34cf85d..434d033ee067 100644 +--- a/tools/testing/selftests/proc/Makefile ++++ b/tools/testing/selftests/proc/Makefile +@@ -14,6 +14,7 @@ TEST_GEN_PROGS += proc-uptime-001 + TEST_GEN_PROGS += proc-uptime-002 + TEST_GEN_PROGS += read + TEST_GEN_PROGS += self ++TEST_GEN_PROGS += setns-dcache + TEST_GEN_PROGS += thread-self + + include ../lib.mk +diff --git a/tools/testing/selftests/proc/setns-dcache.c b/tools/testing/selftests/proc/setns-dcache.c +new file mode 100644 +index 000000000000..60ab197a73fc +--- /dev/null ++++ b/tools/testing/selftests/proc/setns-dcache.c +@@ -0,0 +1,129 @@ ++/* ++ * Copyright © 2019 Alexey Dobriyan ++ * ++ * Permission to use, copy, modify, and distribute this software for any ++ * purpose with or without fee is hereby granted, provided that the above ++ * copyright notice and this permission notice appear in all copies. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES ++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF ++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF ++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ */ ++/* ++ * Test that setns(CLONE_NEWNET) points to new /proc/net content even ++ * if old one is in dcache. ++ * ++ * FIXME /proc/net/unix is under CONFIG_UNIX which can be disabled. ++ */ ++#undef NDEBUG ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++static pid_t pid = -1; ++ ++static void f(void) ++{ ++ if (pid > 0) { ++ kill(pid, SIGTERM); ++ } ++} ++ ++int main(void) ++{ ++ int fd[2]; ++ char _ = 0; ++ int nsfd; ++ ++ atexit(f); ++ ++ /* Check for priviledges and syscall availability straight away. */ ++ if (unshare(CLONE_NEWNET) == -1) { ++ if (errno == ENOSYS || errno == EPERM) { ++ return 4; ++ } ++ return 1; ++ } ++ /* Distinguisher between two otherwise empty net namespaces. */ ++ if (socket(AF_UNIX, SOCK_STREAM, 0) == -1) { ++ return 1; ++ } ++ ++ if (pipe(fd) == -1) { ++ return 1; ++ } ++ ++ pid = fork(); ++ if (pid == -1) { ++ return 1; ++ } ++ ++ if (pid == 0) { ++ if (unshare(CLONE_NEWNET) == -1) { ++ return 1; ++ } ++ ++ if (write(fd[1], &_, 1) != 1) { ++ return 1; ++ } ++ ++ pause(); ++ ++ return 0; ++ } ++ ++ if (read(fd[0], &_, 1) != 1) { ++ return 1; ++ } ++ ++ { ++ char buf[64]; ++ snprintf(buf, sizeof(buf), "/proc/%u/ns/net", pid); ++ nsfd = open(buf, O_RDONLY); ++ if (nsfd == -1) { ++ return 1; ++ } ++ } ++ ++ /* Reliably pin dentry into dcache. */ ++ (void)open("/proc/net/unix", O_RDONLY); ++ ++ if (setns(nsfd, CLONE_NEWNET) == -1) { ++ return 1; ++ } ++ ++ kill(pid, SIGTERM); ++ pid = 0; ++ ++ { ++ char buf[4096]; ++ ssize_t rv; ++ int fd; ++ ++ fd = open("/proc/net/unix", O_RDONLY); ++ if (fd == -1) { ++ return 1; ++ } ++ ++#define S "Num RefCount Protocol Flags Type St Inode Path\n" ++ rv = read(fd, buf, sizeof(buf)); ++ ++ assert(rv == strlen(S)); ++ assert(memcmp(buf, S, strlen(S)) == 0); ++ } ++ ++ return 0; ++} +diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile +index c02683cfb6c9..7656c7ce79d9 100644 +--- a/tools/testing/selftests/timers/Makefile ++++ b/tools/testing/selftests/timers/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + CFLAGS += -O3 -Wl,-no-as-needed -Wall +-LDFLAGS += -lrt -lpthread -lm ++LDLIBS += -lrt -lpthread -lm + + # these are all "safe" tests that don't modify + # system time or require escalated privileges diff --git a/patch/kernel/sunxi-next/patch-4.19.29-30.patch b/patch/kernel/sunxi-next/patch-4.19.29-30.patch new file mode 100644 index 0000000000..f6460e771d --- /dev/null +++ b/patch/kernel/sunxi-next/patch-4.19.29-30.patch @@ -0,0 +1,1866 @@ +diff --git a/Makefile b/Makefile +index 6e526583291c..72e27c379eaf 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 29 ++SUBLEVEL = 30 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 220b40b75e6f..12453cf7c11b 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3282,7 +3282,7 @@ tfa_get_event_constraints(struct cpu_hw_events *cpuc, int idx, + /* + * Without TFA we must not use PMC3. + */ +- if (!allow_tsx_force_abort && test_bit(3, c->idxmsk)) { ++ if (!allow_tsx_force_abort && test_bit(3, c->idxmsk) && idx >= 0) { + c = dyn_constraint(cpuc, c, idx); + c->idxmsk64 &= ~(1ULL << 3); + c->weight--; +@@ -3989,7 +3989,7 @@ static struct attribute *intel_pmu_caps_attrs[] = { + NULL + }; + +-DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort); ++static DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort); + + static struct attribute *intel_pmu_attrs[] = { + &dev_attr_freeze_on_smi.attr, +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h +index 5c424009b71f..42a36280d168 100644 +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -1030,12 +1030,12 @@ static inline int intel_pmu_init(void) + return 0; + } + +-static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu) ++static inline int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu) + { + return 0; + } + +-static inline void intel_cpuc_finish(struct cpu_hw_event *cpuc) ++static inline void intel_cpuc_finish(struct cpu_hw_events *cpuc) + { + } + +diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c +index ed5e42461094..ad48fd52cb53 100644 +--- a/drivers/connector/cn_proc.c ++++ b/drivers/connector/cn_proc.c +@@ -250,6 +250,7 @@ void proc_coredump_connector(struct task_struct *task) + { + struct cn_msg *msg; + struct proc_event *ev; ++ struct task_struct *parent; + __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8); + + if (atomic_read(&proc_event_num_listeners) < 1) +@@ -262,8 +263,14 @@ void proc_coredump_connector(struct task_struct *task) + ev->what = PROC_EVENT_COREDUMP; + ev->event_data.coredump.process_pid = task->pid; + ev->event_data.coredump.process_tgid = task->tgid; +- ev->event_data.coredump.parent_pid = task->real_parent->pid; +- ev->event_data.coredump.parent_tgid = task->real_parent->tgid; ++ ++ rcu_read_lock(); ++ if (pid_alive(task)) { ++ parent = rcu_dereference(task->real_parent); ++ ev->event_data.coredump.parent_pid = parent->pid; ++ ev->event_data.coredump.parent_tgid = parent->tgid; ++ } ++ rcu_read_unlock(); + + memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); + msg->ack = 0; /* not used */ +@@ -276,6 +283,7 @@ void proc_exit_connector(struct task_struct *task) + { + struct cn_msg *msg; + struct proc_event *ev; ++ struct task_struct *parent; + __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8); + + if (atomic_read(&proc_event_num_listeners) < 1) +@@ -290,8 +298,14 @@ void proc_exit_connector(struct task_struct *task) + ev->event_data.exit.process_tgid = task->tgid; + ev->event_data.exit.exit_code = task->exit_code; + ev->event_data.exit.exit_signal = task->exit_signal; +- ev->event_data.exit.parent_pid = task->real_parent->pid; +- ev->event_data.exit.parent_tgid = task->real_parent->tgid; ++ ++ rcu_read_lock(); ++ if (pid_alive(task)) { ++ parent = rcu_dereference(task->real_parent); ++ ev->event_data.exit.parent_pid = parent->pid; ++ ev->event_data.exit.parent_tgid = parent->tgid; ++ } ++ rcu_read_unlock(); + + memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); + msg->ack = 0; /* not used */ +diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c +index 1d74aed7e471..94f5c3646cb7 100644 +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -1573,6 +1573,15 @@ int drm_atomic_helper_async_check(struct drm_device *dev, + if (old_plane_state->fb != new_plane_state->fb) + return -EINVAL; + ++ /* ++ * FIXME: Since prepare_fb and cleanup_fb are always called on ++ * the new_plane_state for async updates we need to block framebuffer ++ * changes. This prevents use of a fb that's been cleaned up and ++ * double cleanups from occuring. ++ */ ++ if (old_plane_state->fb != new_plane_state->fb) ++ return -EINVAL; ++ + funcs = plane->helper_private; + if (!funcs->atomic_async_update) + return -EINVAL; +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 7033a2880771..9df1334608b7 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -4630,7 +4630,6 @@ read_more: + atomic_inc(&r10_bio->remaining); + read_bio->bi_next = NULL; + generic_make_request(read_bio); +- sector_nr += nr_sectors; + sectors_done += nr_sectors; + if (sector_nr <= last) + goto read_more; +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index a6fcc5c96070..b2c42cae3081 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1171,29 +1171,22 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb) + } + } + +- /* Link-local multicast packets should be passed to the +- * stack on the link they arrive as well as pass them to the +- * bond-master device. These packets are mostly usable when +- * stack receives it with the link on which they arrive +- * (e.g. LLDP) they also must be available on master. Some of +- * the use cases include (but are not limited to): LLDP agents +- * that must be able to operate both on enslaved interfaces as +- * well as on bonds themselves; linux bridges that must be able +- * to process/pass BPDUs from attached bonds when any kind of +- * STP version is enabled on the network. ++ /* ++ * For packets determined by bond_should_deliver_exact_match() call to ++ * be suppressed we want to make an exception for link-local packets. ++ * This is necessary for e.g. LLDP daemons to be able to monitor ++ * inactive slave links without being forced to bind to them ++ * explicitly. ++ * ++ * At the same time, packets that are passed to the bonding master ++ * (including link-local ones) can have their originating interface ++ * determined via PACKET_ORIGDEV socket option. + */ +- if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) { +- struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); +- +- if (nskb) { +- nskb->dev = bond->dev; +- nskb->queue_mapping = 0; +- netif_rx(nskb); +- } +- return RX_HANDLER_PASS; +- } +- if (bond_should_deliver_exact_match(skb, slave, bond)) ++ if (bond_should_deliver_exact_match(skb, slave, bond)) { ++ if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) ++ return RX_HANDLER_PASS; + return RX_HANDLER_EXACT; ++ } + + skb->dev = bond->dev; + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 41fa22c562c1..f81ad0aa8b09 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -424,9 +424,9 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev, + struct rtnl_link_stats64 *stats) + { + struct i40e_netdev_priv *np = netdev_priv(netdev); +- struct i40e_ring *tx_ring, *rx_ring; + struct i40e_vsi *vsi = np->vsi; + struct rtnl_link_stats64 *vsi_stats = i40e_get_vsi_stats_struct(vsi); ++ struct i40e_ring *ring; + int i; + + if (test_bit(__I40E_VSI_DOWN, vsi->state)) +@@ -440,24 +440,26 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev, + u64 bytes, packets; + unsigned int start; + +- tx_ring = READ_ONCE(vsi->tx_rings[i]); +- if (!tx_ring) ++ ring = READ_ONCE(vsi->tx_rings[i]); ++ if (!ring) + continue; +- i40e_get_netdev_stats_struct_tx(tx_ring, stats); ++ i40e_get_netdev_stats_struct_tx(ring, stats); + +- rx_ring = &tx_ring[1]; ++ if (i40e_enabled_xdp_vsi(vsi)) { ++ ring++; ++ i40e_get_netdev_stats_struct_tx(ring, stats); ++ } + ++ ring++; + do { +- start = u64_stats_fetch_begin_irq(&rx_ring->syncp); +- packets = rx_ring->stats.packets; +- bytes = rx_ring->stats.bytes; +- } while (u64_stats_fetch_retry_irq(&rx_ring->syncp, start)); ++ start = u64_stats_fetch_begin_irq(&ring->syncp); ++ packets = ring->stats.packets; ++ bytes = ring->stats.bytes; ++ } while (u64_stats_fetch_retry_irq(&ring->syncp, start)); + + stats->rx_packets += packets; + stats->rx_bytes += bytes; + +- if (i40e_enabled_xdp_vsi(vsi)) +- i40e_get_netdev_stats_struct_tx(&rx_ring[1], stats); + } + rcu_read_unlock(); + +diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c +index e65bc3c95630..857588e2488d 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c +@@ -2645,6 +2645,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev) + if (!priv->cmd.context) + return -ENOMEM; + ++ if (mlx4_is_mfunc(dev)) ++ mutex_lock(&priv->cmd.slave_cmd_mutex); + down_write(&priv->cmd.switch_sem); + for (i = 0; i < priv->cmd.max_cmds; ++i) { + priv->cmd.context[i].token = i; +@@ -2670,6 +2672,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev) + down(&priv->cmd.poll_sem); + priv->cmd.use_events = 1; + up_write(&priv->cmd.switch_sem); ++ if (mlx4_is_mfunc(dev)) ++ mutex_unlock(&priv->cmd.slave_cmd_mutex); + + return err; + } +@@ -2682,6 +2686,8 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev) + struct mlx4_priv *priv = mlx4_priv(dev); + int i; + ++ if (mlx4_is_mfunc(dev)) ++ mutex_lock(&priv->cmd.slave_cmd_mutex); + down_write(&priv->cmd.switch_sem); + priv->cmd.use_events = 0; + +@@ -2689,9 +2695,12 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev) + down(&priv->cmd.event_sem); + + kfree(priv->cmd.context); ++ priv->cmd.context = NULL; + + up(&priv->cmd.poll_sem); + up_write(&priv->cmd.switch_sem); ++ if (mlx4_is_mfunc(dev)) ++ mutex_unlock(&priv->cmd.slave_cmd_mutex); + } + + struct mlx4_cmd_mailbox *mlx4_alloc_cmd_mailbox(struct mlx4_dev *dev) +diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +index 31bd56727022..676428a57662 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -2719,13 +2719,13 @@ static int qp_get_mtt_size(struct mlx4_qp_context *qpc) + int total_pages; + int total_mem; + int page_offset = (be32_to_cpu(qpc->params2) >> 6) & 0x3f; ++ int tot; + + sq_size = 1 << (log_sq_size + log_sq_sride + 4); + rq_size = (srq|rss|xrc) ? 0 : (1 << (log_rq_size + log_rq_stride + 4)); + total_mem = sq_size + rq_size; +- total_pages = +- roundup_pow_of_two((total_mem + (page_offset << 6)) >> +- page_shift); ++ tot = (total_mem + (page_offset << 6)) >> page_shift; ++ total_pages = !tot ? 1 : roundup_pow_of_two(tot); + + return total_pages; + } +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c +index de5a6abda7e3..208341541087 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -585,8 +585,7 @@ static int lan743x_intr_open(struct lan743x_adapter *adapter) + + if (adapter->csr.flags & + LAN743X_CSR_FLAG_SUPPORTS_INTR_AUTO_SET_CLR) { +- flags = LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_CLEAR | +- LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_SET | ++ flags = LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_SET | + LAN743X_VECTOR_FLAG_SOURCE_ENABLE_AUTO_SET | + LAN743X_VECTOR_FLAG_SOURCE_ENABLE_AUTO_CLEAR | + LAN743X_VECTOR_FLAG_SOURCE_STATUS_AUTO_CLEAR; +@@ -599,12 +598,6 @@ static int lan743x_intr_open(struct lan743x_adapter *adapter) + /* map TX interrupt to vector */ + int_vec_map1 |= INT_VEC_MAP1_TX_VEC_(index, vector); + lan743x_csr_write(adapter, INT_VEC_MAP1, int_vec_map1); +- if (flags & +- LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_CLEAR) { +- int_vec_en_auto_clr |= INT_VEC_EN_(vector); +- lan743x_csr_write(adapter, INT_VEC_EN_AUTO_CLR, +- int_vec_en_auto_clr); +- } + + /* Remove TX interrupt from shared mask */ + intr->vector_list[0].int_mask &= ~int_bit; +@@ -1905,7 +1898,17 @@ static int lan743x_rx_next_index(struct lan743x_rx *rx, int index) + return ((++index) % rx->ring_size); + } + +-static int lan743x_rx_allocate_ring_element(struct lan743x_rx *rx, int index) ++static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx) ++{ ++ int length = 0; ++ ++ length = (LAN743X_MAX_FRAME_SIZE + ETH_HLEN + 4 + RX_HEAD_PADDING); ++ return __netdev_alloc_skb(rx->adapter->netdev, ++ length, GFP_ATOMIC | GFP_DMA); ++} ++ ++static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index, ++ struct sk_buff *skb) + { + struct lan743x_rx_buffer_info *buffer_info; + struct lan743x_rx_descriptor *descriptor; +@@ -1914,9 +1917,7 @@ static int lan743x_rx_allocate_ring_element(struct lan743x_rx *rx, int index) + length = (LAN743X_MAX_FRAME_SIZE + ETH_HLEN + 4 + RX_HEAD_PADDING); + descriptor = &rx->ring_cpu_ptr[index]; + buffer_info = &rx->buffer_info[index]; +- buffer_info->skb = __netdev_alloc_skb(rx->adapter->netdev, +- length, +- GFP_ATOMIC | GFP_DMA); ++ buffer_info->skb = skb; + if (!(buffer_info->skb)) + return -ENOMEM; + buffer_info->dma_ptr = dma_map_single(&rx->adapter->pdev->dev, +@@ -2063,8 +2064,19 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx) + /* packet is available */ + if (first_index == last_index) { + /* single buffer packet */ ++ struct sk_buff *new_skb = NULL; + int packet_length; + ++ new_skb = lan743x_rx_allocate_skb(rx); ++ if (!new_skb) { ++ /* failed to allocate next skb. ++ * Memory is very low. ++ * Drop this packet and reuse buffer. ++ */ ++ lan743x_rx_reuse_ring_element(rx, first_index); ++ goto process_extension; ++ } ++ + buffer_info = &rx->buffer_info[first_index]; + skb = buffer_info->skb; + descriptor = &rx->ring_cpu_ptr[first_index]; +@@ -2084,7 +2096,7 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx) + skb_put(skb, packet_length - 4); + skb->protocol = eth_type_trans(skb, + rx->adapter->netdev); +- lan743x_rx_allocate_ring_element(rx, first_index); ++ lan743x_rx_init_ring_element(rx, first_index, new_skb); + } else { + int index = first_index; + +@@ -2097,26 +2109,23 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx) + if (first_index <= last_index) { + while ((index >= first_index) && + (index <= last_index)) { +- lan743x_rx_release_ring_element(rx, +- index); +- lan743x_rx_allocate_ring_element(rx, +- index); ++ lan743x_rx_reuse_ring_element(rx, ++ index); + index = lan743x_rx_next_index(rx, + index); + } + } else { + while ((index >= first_index) || + (index <= last_index)) { +- lan743x_rx_release_ring_element(rx, +- index); +- lan743x_rx_allocate_ring_element(rx, +- index); ++ lan743x_rx_reuse_ring_element(rx, ++ index); + index = lan743x_rx_next_index(rx, + index); + } + } + } + ++process_extension: + if (extension_index >= 0) { + descriptor = &rx->ring_cpu_ptr[extension_index]; + buffer_info = &rx->buffer_info[extension_index]; +@@ -2293,7 +2302,9 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx) + + rx->last_head = 0; + for (index = 0; index < rx->ring_size; index++) { +- ret = lan743x_rx_allocate_ring_element(rx, index); ++ struct sk_buff *new_skb = lan743x_rx_allocate_skb(rx); ++ ++ ret = lan743x_rx_init_ring_element(rx, index, new_skb); + if (ret) + goto cleanup; + } +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 8441c86d9f3b..5f092bbd0514 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -459,7 +459,7 @@ static int ravb_dmac_init(struct net_device *ndev) + RCR_EFFS | RCR_ENCF | RCR_ETS0 | RCR_ESF | 0x18000000, RCR); + + /* Set FIFO size */ +- ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00222200, TGC); ++ ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00112200, TGC); + + /* Timestamp enable */ + ravb_write(ndev, TCCR_TFEN, TCCR); +diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c +index 5fb541897863..68b8007da82b 100644 +--- a/drivers/net/ipvlan/ipvlan_main.c ++++ b/drivers/net/ipvlan/ipvlan_main.c +@@ -494,6 +494,8 @@ static int ipvlan_nl_changelink(struct net_device *dev, + + if (!data) + return 0; ++ if (!ns_capable(dev_net(ipvlan->phy_dev)->user_ns, CAP_NET_ADMIN)) ++ return -EPERM; + + if (data[IFLA_IPVLAN_MODE]) { + u16 nmode = nla_get_u16(data[IFLA_IPVLAN_MODE]); +@@ -596,6 +598,8 @@ int ipvlan_link_new(struct net *src_net, struct net_device *dev, + struct ipvl_dev *tmp = netdev_priv(phy_dev); + + phy_dev = tmp->phy_dev; ++ if (!ns_capable(dev_net(phy_dev)->user_ns, CAP_NET_ADMIN)) ++ return -EPERM; + } else if (!netif_is_ipvlan_port(phy_dev)) { + /* Exit early if the underlying link is invalid or busy */ + if (phy_dev->type != ARPHRD_ETHER || +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index 15c5586d74ff..c5588d4508f9 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -380,7 +380,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) + err = device_register(&bus->dev); + if (err) { + pr_err("mii_bus %s failed to register\n", bus->id); +- put_device(&bus->dev); + return -EINVAL; + } + +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index 67ffe74747a1..7321a4eca235 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -537,6 +537,7 @@ static void pptp_sock_destruct(struct sock *sk) + pppox_unbind_sock(sk); + } + skb_queue_purge(&sk->sk_receive_queue); ++ dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1)); + } + + static int pptp_create(struct net *net, struct socket *sock, int kern) +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 723814d84b7d..95ee9d815d76 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1259,7 +1259,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev, + list_add_tail_rcu(&port->list, &team->port_list); + team_port_enable(team, port); + __team_compute_features(team); +- __team_port_change_port_added(port, !!netif_carrier_ok(port_dev)); ++ __team_port_change_port_added(port, !!netif_oper_up(port_dev)); + __team_options_change_check(team); + + netdev_info(dev, "Port device %s added\n", portname); +@@ -2918,7 +2918,7 @@ static int team_device_event(struct notifier_block *unused, + + switch (event) { + case NETDEV_UP: +- if (netif_carrier_ok(dev)) ++ if (netif_oper_up(dev)) + team_port_change_check(port, true); + break; + case NETDEV_DOWN: +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 9fc9aed6ca9a..52387f7f12ed 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -1469,6 +1469,14 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) + goto drop; + } + ++ rcu_read_lock(); ++ ++ if (unlikely(!(vxlan->dev->flags & IFF_UP))) { ++ rcu_read_unlock(); ++ atomic_long_inc(&vxlan->dev->rx_dropped); ++ goto drop; ++ } ++ + stats = this_cpu_ptr(vxlan->dev->tstats); + u64_stats_update_begin(&stats->syncp); + stats->rx_packets++; +@@ -1476,6 +1484,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) + u64_stats_update_end(&stats->syncp); + + gro_cells_receive(&vxlan->gro_cells, skb); ++ ++ rcu_read_unlock(); ++ + return 0; + + drop: +@@ -2460,6 +2471,8 @@ static void vxlan_uninit(struct net_device *dev) + { + struct vxlan_dev *vxlan = netdev_priv(dev); + ++ gro_cells_destroy(&vxlan->gro_cells); ++ + vxlan_fdb_delete_default(vxlan, vxlan->cfg.vni); + + free_percpu(dev->tstats); +@@ -3526,7 +3539,6 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head) + + vxlan_flush(vxlan, true); + +- gro_cells_destroy(&vxlan->gro_cells); + list_del(&vxlan->next); + unregister_netdevice_queue(dev, head); + } +diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h +index c70f0c5237ea..58d8cbc3f921 100644 +--- a/drivers/staging/erofs/internal.h ++++ b/drivers/staging/erofs/internal.h +@@ -260,6 +260,7 @@ repeat: + } + + #define __erofs_workgroup_get(grp) atomic_inc(&(grp)->refcount) ++#define __erofs_workgroup_put(grp) atomic_dec(&(grp)->refcount) + + extern int erofs_workgroup_put(struct erofs_workgroup *grp); + +diff --git a/drivers/staging/erofs/utils.c b/drivers/staging/erofs/utils.c +index dd2ac9dbc4b4..2d96820da62e 100644 +--- a/drivers/staging/erofs/utils.c ++++ b/drivers/staging/erofs/utils.c +@@ -87,12 +87,21 @@ int erofs_register_workgroup(struct super_block *sb, + grp = (void *)((unsigned long)grp | + 1UL << RADIX_TREE_EXCEPTIONAL_SHIFT); + +- err = radix_tree_insert(&sbi->workstn_tree, +- grp->index, grp); ++ /* ++ * Bump up reference count before making this workgroup ++ * visible to other users in order to avoid potential UAF ++ * without serialized by erofs_workstn_lock. ++ */ ++ __erofs_workgroup_get(grp); + +- if (!err) { +- __erofs_workgroup_get(grp); +- } ++ err = radix_tree_insert(&sbi->workstn_tree, ++ grp->index, grp); ++ if (unlikely(err)) ++ /* ++ * it's safe to decrease since the workgroup isn't visible ++ * and refcount >= 2 (cannot be freezed). ++ */ ++ __erofs_workgroup_put(grp); + + erofs_workstn_unlock(sbi); + radix_tree_preload_end(); +@@ -101,19 +110,99 @@ int erofs_register_workgroup(struct super_block *sb, + + extern void erofs_workgroup_free_rcu(struct erofs_workgroup *grp); + ++static void __erofs_workgroup_free(struct erofs_workgroup *grp) ++{ ++ atomic_long_dec(&erofs_global_shrink_cnt); ++ erofs_workgroup_free_rcu(grp); ++} ++ + int erofs_workgroup_put(struct erofs_workgroup *grp) + { + int count = atomic_dec_return(&grp->refcount); + + if (count == 1) + atomic_long_inc(&erofs_global_shrink_cnt); +- else if (!count) { +- atomic_long_dec(&erofs_global_shrink_cnt); +- erofs_workgroup_free_rcu(grp); +- } ++ else if (!count) ++ __erofs_workgroup_free(grp); + return count; + } + ++#ifdef EROFS_FS_HAS_MANAGED_CACHE ++/* for cache-managed case, customized reclaim paths exist */ ++static void erofs_workgroup_unfreeze_final(struct erofs_workgroup *grp) ++{ ++ erofs_workgroup_unfreeze(grp, 0); ++ __erofs_workgroup_free(grp); ++} ++ ++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, ++ struct erofs_workgroup *grp, ++ bool cleanup) ++{ ++ void *entry; ++ ++ /* ++ * for managed cache enabled, the refcount of workgroups ++ * themselves could be < 0 (freezed). So there is no guarantee ++ * that all refcount > 0 if managed cache is enabled. ++ */ ++ if (!erofs_workgroup_try_to_freeze(grp, 1)) ++ return false; ++ ++ /* ++ * note that all cached pages should be unlinked ++ * before delete it from the radix tree. ++ * Otherwise some cached pages of an orphan old workgroup ++ * could be still linked after the new one is available. ++ */ ++ if (erofs_try_to_free_all_cached_pages(sbi, grp)) { ++ erofs_workgroup_unfreeze(grp, 1); ++ return false; ++ } ++ ++ /* ++ * it is impossible to fail after the workgroup is freezed, ++ * however in order to avoid some race conditions, add a ++ * DBG_BUGON to observe this in advance. ++ */ ++ entry = radix_tree_delete(&sbi->workstn_tree, grp->index); ++ DBG_BUGON((void *)((unsigned long)entry & ++ ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp); ++ ++ /* ++ * if managed cache is enable, the last refcount ++ * should indicate the related workstation. ++ */ ++ erofs_workgroup_unfreeze_final(grp); ++ return true; ++} ++ ++#else ++/* for nocache case, no customized reclaim path at all */ ++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, ++ struct erofs_workgroup *grp, ++ bool cleanup) ++{ ++ int cnt = atomic_read(&grp->refcount); ++ void *entry; ++ ++ DBG_BUGON(cnt <= 0); ++ DBG_BUGON(cleanup && cnt != 1); ++ ++ if (cnt > 1) ++ return false; ++ ++ entry = radix_tree_delete(&sbi->workstn_tree, grp->index); ++ DBG_BUGON((void *)((unsigned long)entry & ++ ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp); ++ ++ /* (rarely) could be grabbed again when freeing */ ++ erofs_workgroup_put(grp); ++ return true; ++} ++ ++#endif ++ + unsigned long erofs_shrink_workstation(struct erofs_sb_info *sbi, + unsigned long nr_shrink, + bool cleanup) +@@ -130,44 +219,16 @@ repeat: + batch, first_index, PAGEVEC_SIZE); + + for (i = 0; i < found; ++i) { +- int cnt; + struct erofs_workgroup *grp = (void *) + ((unsigned long)batch[i] & + ~RADIX_TREE_EXCEPTIONAL_ENTRY); + + first_index = grp->index + 1; + +- cnt = atomic_read(&grp->refcount); +- BUG_ON(cnt <= 0); +- +- if (cleanup) +- BUG_ON(cnt != 1); +- +-#ifndef EROFS_FS_HAS_MANAGED_CACHE +- else if (cnt > 1) +-#else +- if (!erofs_workgroup_try_to_freeze(grp, 1)) +-#endif ++ /* try to shrink each valid workgroup */ ++ if (!erofs_try_to_release_workgroup(sbi, grp, cleanup)) + continue; + +- if (radix_tree_delete(&sbi->workstn_tree, +- grp->index) != grp) { +-#ifdef EROFS_FS_HAS_MANAGED_CACHE +-skip: +- erofs_workgroup_unfreeze(grp, 1); +-#endif +- continue; +- } +- +-#ifdef EROFS_FS_HAS_MANAGED_CACHE +- if (erofs_try_to_free_all_cached_pages(sbi, grp)) +- goto skip; +- +- erofs_workgroup_unfreeze(grp, 1); +-#endif +- /* (rarely) grabbed again when freeing */ +- erofs_workgroup_put(grp); +- + ++freed; + if (unlikely(!--nr_shrink)) + break; +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index fa93f6711d8d..e440f87ae1d6 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -642,7 +642,7 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid) + hash_del_rcu(&vsock->hash); + + vsock->guest_cid = guest_cid; +- hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid); ++ hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid); + spin_unlock_bh(&vhost_vsock_lock); + + return 0; +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index fd36aa6569dc..81c1dd635a8d 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1736,10 +1736,12 @@ static int f2fs_ioc_start_atomic_write(struct file *filp) + + down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + +- if (!get_dirty_pages(inode)) +- goto skip_flush; +- +- f2fs_msg(F2FS_I_SB(inode)->sb, KERN_WARNING, ++ /* ++ * Should wait end_io to count F2FS_WB_CP_DATA correctly by ++ * f2fs_is_atomic_file. ++ */ ++ if (get_dirty_pages(inode)) ++ f2fs_msg(F2FS_I_SB(inode)->sb, KERN_WARNING, + "Unexpected flush for atomic writes: ino=%lu, npages=%u", + inode->i_ino, get_dirty_pages(inode)); + ret = filemap_write_and_wait_range(inode->i_mapping, 0, LLONG_MAX); +@@ -1747,7 +1749,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp) + up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + goto out; + } +-skip_flush: ++ + set_inode_flag(inode, FI_ATOMIC_FILE); + clear_inode_flag(inode, FI_ATOMIC_REVOKE_REQUEST); + up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); +diff --git a/net/core/gro_cells.c b/net/core/gro_cells.c +index acf45ddbe924..e095fb871d91 100644 +--- a/net/core/gro_cells.c ++++ b/net/core/gro_cells.c +@@ -13,22 +13,36 @@ int gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb) + { + struct net_device *dev = skb->dev; + struct gro_cell *cell; ++ int res; + +- if (!gcells->cells || skb_cloned(skb) || netif_elide_gro(dev)) +- return netif_rx(skb); ++ rcu_read_lock(); ++ if (unlikely(!(dev->flags & IFF_UP))) ++ goto drop; ++ ++ if (!gcells->cells || skb_cloned(skb) || netif_elide_gro(dev)) { ++ res = netif_rx(skb); ++ goto unlock; ++ } + + cell = this_cpu_ptr(gcells->cells); + + if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) { ++drop: + atomic_long_inc(&dev->rx_dropped); + kfree_skb(skb); +- return NET_RX_DROP; ++ res = NET_RX_DROP; ++ goto unlock; + } + + __skb_queue_tail(&cell->napi_skbs, skb); + if (skb_queue_len(&cell->napi_skbs) == 1) + napi_schedule(&cell->napi); +- return NET_RX_SUCCESS; ++ ++ res = NET_RX_SUCCESS; ++ ++unlock: ++ rcu_read_unlock(); ++ return res; + } + EXPORT_SYMBOL(gro_cells_receive); + +diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c +index b8cd43c9ed5b..a97bf326b231 100644 +--- a/net/hsr/hsr_device.c ++++ b/net/hsr/hsr_device.c +@@ -94,9 +94,8 @@ static void hsr_check_announce(struct net_device *hsr_dev, + && (old_operstate != IF_OPER_UP)) { + /* Went up */ + hsr->announce_count = 0; +- hsr->announce_timer.expires = jiffies + +- msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL); +- add_timer(&hsr->announce_timer); ++ mod_timer(&hsr->announce_timer, ++ jiffies + msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL)); + } + + if ((hsr_dev->operstate != IF_OPER_UP) && (old_operstate == IF_OPER_UP)) +@@ -332,6 +331,7 @@ static void hsr_announce(struct timer_list *t) + { + struct hsr_priv *hsr; + struct hsr_port *master; ++ unsigned long interval; + + hsr = from_timer(hsr, t, announce_timer); + +@@ -343,18 +343,16 @@ static void hsr_announce(struct timer_list *t) + hsr->protVersion); + hsr->announce_count++; + +- hsr->announce_timer.expires = jiffies + +- msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL); ++ interval = msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL); + } else { + send_hsr_supervision_frame(master, HSR_TLV_LIFE_CHECK, + hsr->protVersion); + +- hsr->announce_timer.expires = jiffies + +- msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL); ++ interval = msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL); + } + + if (is_admin_up(master->dev)) +- add_timer(&hsr->announce_timer); ++ mod_timer(&hsr->announce_timer, jiffies + interval); + + rcu_read_unlock(); + } +@@ -486,7 +484,7 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], + + res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER); + if (res) +- return res; ++ goto err_add_port; + + res = register_netdevice(hsr_dev); + if (res) +@@ -506,6 +504,8 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], + fail: + hsr_for_each_port(hsr, port) + hsr_del_port(port); ++err_add_port: ++ hsr_del_node(&hsr->self_node_db); + + return res; + } +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index 286ceb41ac0c..9af16cb68f76 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_head *self_node_db, + return 0; + } + ++void hsr_del_node(struct list_head *self_node_db) ++{ ++ struct hsr_node *node; ++ ++ rcu_read_lock(); ++ node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list); ++ rcu_read_unlock(); ++ if (node) { ++ list_del_rcu(&node->mac_list); ++ kfree(node); ++ } ++} + + /* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA; + * seq_out is used to initialize filtering of outgoing duplicate frames +diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h +index 370b45998121..531fd3dfcac1 100644 +--- a/net/hsr/hsr_framereg.h ++++ b/net/hsr/hsr_framereg.h +@@ -16,6 +16,7 @@ + + struct hsr_node; + ++void hsr_del_node(struct list_head *self_node_db); + struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[], + u16 seq_out); + struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index ca87bb6784e5..7a556e459375 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1308,6 +1308,10 @@ static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr) + if (fnhe->fnhe_daddr == daddr) { + rcu_assign_pointer(*fnhe_p, rcu_dereference_protected( + fnhe->fnhe_next, lockdep_is_held(&fnhe_lock))); ++ /* set fnhe_daddr to 0 to ensure it won't bind with ++ * new dsts in rt_bind_exception(). ++ */ ++ fnhe->fnhe_daddr = 0; + fnhe_flush_routes(fnhe); + kfree_rcu(fnhe, rcu); + break; +@@ -2155,12 +2159,13 @@ int ip_route_input_rcu(struct sk_buff *skb, __be32 daddr, __be32 saddr, + int our = 0; + int err = -EINVAL; + +- if (in_dev) +- our = ip_check_mc_rcu(in_dev, daddr, saddr, +- ip_hdr(skb)->protocol); ++ if (!in_dev) ++ return err; ++ our = ip_check_mc_rcu(in_dev, daddr, saddr, ++ ip_hdr(skb)->protocol); + + /* check l3 master if no match yet */ +- if ((!in_dev || !our) && netif_is_l3_slave(dev)) { ++ if (!our && netif_is_l3_slave(dev)) { + struct in_device *l3_in_dev; + + l3_in_dev = __in_dev_get_rcu(skb->dev); +diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c +index c3387dfd725b..f66b2e6d97a7 100644 +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -216,7 +216,12 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb, + refcount_set(&req->rsk_refcnt, 1); + tcp_sk(child)->tsoffset = tsoff; + sock_rps_save_rxhash(child, skb); +- inet_csk_reqsk_queue_add(sk, req, child); ++ if (!inet_csk_reqsk_queue_add(sk, req, child)) { ++ bh_unlock_sock(child); ++ sock_put(child); ++ child = NULL; ++ reqsk_put(req); ++ } + } else { + reqsk_free(req); + } +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 432dc9af1172..30c6e94b06c4 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1901,6 +1901,11 @@ static int tcp_inq_hint(struct sock *sk) + inq = tp->rcv_nxt - tp->copied_seq; + release_sock(sk); + } ++ /* After receiving a FIN, tell the user-space to continue reading ++ * by returning a non-zero inq. ++ */ ++ if (inq == 0 && sock_flag(sk, SOCK_DONE)) ++ inq = 1; + return inq; + } + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 664fa7d8f7d9..572f79abd393 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -6514,7 +6514,13 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + af_ops->send_synack(fastopen_sk, dst, &fl, req, + &foc, TCP_SYNACK_FASTOPEN); + /* Add the child socket directly into the accept queue */ +- inet_csk_reqsk_queue_add(sk, req, fastopen_sk); ++ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { ++ reqsk_fastopen_remove(fastopen_sk, req, false); ++ bh_unlock_sock(fastopen_sk); ++ sock_put(fastopen_sk); ++ reqsk_put(req); ++ goto drop; ++ } + sk->sk_data_ready(sk); + bh_unlock_sock(fastopen_sk); + sock_put(fastopen_sk); +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 3b83b157b0a1..30fdf891940b 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1646,15 +1646,8 @@ EXPORT_SYMBOL(tcp_add_backlog); + int tcp_filter(struct sock *sk, struct sk_buff *skb) + { + struct tcphdr *th = (struct tcphdr *)skb->data; +- unsigned int eaten = skb->len; +- int err; + +- err = sk_filter_trim_cap(sk, skb, th->doff * 4); +- if (!err) { +- eaten -= skb->len; +- TCP_SKB_CB(skb)->end_seq -= eaten; +- } +- return err; ++ return sk_filter_trim_cap(sk, skb, th->doff * 4); + } + EXPORT_SYMBOL(tcp_filter); + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index ba59a9c14e02..66cc94427437 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1282,18 +1282,29 @@ static DEFINE_SPINLOCK(rt6_exception_lock); + static void rt6_remove_exception(struct rt6_exception_bucket *bucket, + struct rt6_exception *rt6_ex) + { ++ struct fib6_info *from; + struct net *net; + + if (!bucket || !rt6_ex) + return; + + net = dev_net(rt6_ex->rt6i->dst.dev); ++ net->ipv6.rt6_stats->fib_rt_cache--; ++ ++ /* purge completely the exception to allow releasing the held resources: ++ * some [sk] cache may keep the dst around for unlimited time ++ */ ++ from = rcu_dereference_protected(rt6_ex->rt6i->from, ++ lockdep_is_held(&rt6_exception_lock)); ++ rcu_assign_pointer(rt6_ex->rt6i->from, NULL); ++ fib6_info_release(from); ++ dst_dev_put(&rt6_ex->rt6i->dst); ++ + hlist_del_rcu(&rt6_ex->hlist); + dst_release(&rt6_ex->rt6i->dst); + kfree_rcu(rt6_ex, rcu); + WARN_ON_ONCE(!bucket->depth); + bucket->depth--; +- net->ipv6.rt6_stats->fib_rt_cache--; + } + + /* Remove oldest rt6_ex in bucket and free the memory +@@ -1612,15 +1623,15 @@ static int rt6_remove_exception_rt(struct rt6_info *rt) + static void rt6_update_exception_stamp_rt(struct rt6_info *rt) + { + struct rt6_exception_bucket *bucket; +- struct fib6_info *from = rt->from; + struct in6_addr *src_key = NULL; + struct rt6_exception *rt6_ex; +- +- if (!from || +- !(rt->rt6i_flags & RTF_CACHE)) +- return; ++ struct fib6_info *from; + + rcu_read_lock(); ++ from = rcu_dereference(rt->from); ++ if (!from || !(rt->rt6i_flags & RTF_CACHE)) ++ goto unlock; ++ + bucket = rcu_dereference(from->rt6i_exception_bucket); + + #ifdef CONFIG_IPV6_SUBTREES +@@ -1639,6 +1650,7 @@ static void rt6_update_exception_stamp_rt(struct rt6_info *rt) + if (rt6_ex) + rt6_ex->stamp = jiffies; + ++unlock: + rcu_read_unlock(); + } + +@@ -2796,20 +2808,24 @@ static int ip6_route_check_nh_onlink(struct net *net, + u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN; + const struct in6_addr *gw_addr = &cfg->fc_gateway; + u32 flags = RTF_LOCAL | RTF_ANYCAST | RTF_REJECT; ++ struct fib6_info *from; + struct rt6_info *grt; + int err; + + err = 0; + grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0); + if (grt) { ++ rcu_read_lock(); ++ from = rcu_dereference(grt->from); + if (!grt->dst.error && + /* ignore match if it is the default route */ +- grt->from && !ipv6_addr_any(&grt->from->fib6_dst.addr) && ++ from && !ipv6_addr_any(&from->fib6_dst.addr) && + (grt->rt6i_flags & flags || dev != grt->dst.dev)) { + NL_SET_ERR_MSG(extack, + "Nexthop has invalid gateway or device mismatch"); + err = -EINVAL; + } ++ rcu_read_unlock(); + + ip6_rt_put(grt); + } +@@ -4710,7 +4726,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, + table = rt->fib6_table->tb6_id; + else + table = RT6_TABLE_UNSPEC; +- rtm->rtm_table = table; ++ rtm->rtm_table = table < 256 ? table : RT_TABLE_COMPAT; + if (nla_put_u32(skb, RTA_TABLE, table)) + goto nla_put_failure; + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 868d7da7a0cb..de9aa5cb295c 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -778,8 +778,9 @@ static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst, + pbw0 = tunnel->ip6rd.prefixlen >> 5; + pbi0 = tunnel->ip6rd.prefixlen & 0x1f; + +- d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >> +- tunnel->ip6rd.relay_prefixlen; ++ d = tunnel->ip6rd.relay_prefixlen < 32 ? ++ (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >> ++ tunnel->ip6rd.relay_prefixlen : 0; + + pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen; + if (pbi1 > 0) +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index 0ae6899edac0..37a69df17cab 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -674,9 +674,6 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + if (flags & MSG_OOB) + goto out; + +- if (addr_len) +- *addr_len = sizeof(*lsa); +- + if (flags & MSG_ERRQUEUE) + return ipv6_recv_error(sk, msg, len, addr_len); + +@@ -706,6 +703,7 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + lsa->l2tp_conn_id = 0; + if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL) + lsa->l2tp_scope_id = inet6_iif(skb); ++ *addr_len = sizeof(*lsa); + } + + if (np->rxopt.all) +diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c +index 521189f4b666..6e419b15a9f8 100644 +--- a/net/rxrpc/conn_client.c ++++ b/net/rxrpc/conn_client.c +@@ -353,7 +353,7 @@ static int rxrpc_get_client_conn(struct rxrpc_sock *rx, + * normally have to take channel_lock but we do this before anyone else + * can see the connection. + */ +- list_add_tail(&call->chan_wait_link, &candidate->waiting_calls); ++ list_add(&call->chan_wait_link, &candidate->waiting_calls); + + if (cp->exclusive) { + call->conn = candidate; +@@ -432,7 +432,7 @@ found_extant_conn: + call->conn = conn; + call->security_ix = conn->security_ix; + call->service_id = conn->service_id; +- list_add(&call->chan_wait_link, &conn->waiting_calls); ++ list_add_tail(&call->chan_wait_link, &conn->waiting_calls); + spin_unlock(&conn->channel_lock); + _leave(" = 0 [extant %d]", conn->debug_id); + return 0; +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 84893bc67531..09b359784629 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -1213,47 +1213,47 @@ static int fl_change(struct net *net, struct sk_buff *in_skb, + if (err < 0) + goto errout; + +- if (!handle) { +- handle = 1; +- err = idr_alloc_u32(&head->handle_idr, fnew, &handle, +- INT_MAX, GFP_KERNEL); +- } else if (!fold) { +- /* user specifies a handle and it doesn't exist */ +- err = idr_alloc_u32(&head->handle_idr, fnew, &handle, +- handle, GFP_KERNEL); +- } +- if (err) +- goto errout; +- fnew->handle = handle; +- + if (tb[TCA_FLOWER_FLAGS]) { + fnew->flags = nla_get_u32(tb[TCA_FLOWER_FLAGS]); + + if (!tc_flags_valid(fnew->flags)) { + err = -EINVAL; +- goto errout_idr; ++ goto errout; + } + } + + err = fl_set_parms(net, tp, fnew, mask, base, tb, tca[TCA_RATE], ovr, + tp->chain->tmplt_priv, extack); + if (err) +- goto errout_idr; ++ goto errout; + + err = fl_check_assign_mask(head, fnew, fold, mask); + if (err) +- goto errout_idr; ++ goto errout; ++ ++ if (!handle) { ++ handle = 1; ++ err = idr_alloc_u32(&head->handle_idr, fnew, &handle, ++ INT_MAX, GFP_KERNEL); ++ } else if (!fold) { ++ /* user specifies a handle and it doesn't exist */ ++ err = idr_alloc_u32(&head->handle_idr, fnew, &handle, ++ handle, GFP_KERNEL); ++ } ++ if (err) ++ goto errout_mask; ++ fnew->handle = handle; + + if (!tc_skip_sw(fnew->flags)) { + if (!fold && fl_lookup(fnew->mask, &fnew->mkey)) { + err = -EEXIST; +- goto errout_mask; ++ goto errout_idr; + } + + err = rhashtable_insert_fast(&fnew->mask->ht, &fnew->ht_node, + fnew->mask->filter_ht_params); + if (err) +- goto errout_mask; ++ goto errout_idr; + } + + if (!tc_skip_hw(fnew->flags)) { +@@ -1290,12 +1290,13 @@ static int fl_change(struct net *net, struct sk_buff *in_skb, + kfree(mask); + return 0; + +-errout_mask: +- fl_mask_put(head, fnew->mask, false); +- + errout_idr: + if (!fold) + idr_remove(&head->handle_idr, fnew->handle); ++ ++errout_mask: ++ fl_mask_put(head, fnew->mask, false); ++ + errout: + tcf_exts_destroy(&fnew->exts); + kfree(fnew); +diff --git a/net/sctp/stream.c b/net/sctp/stream.c +index 2936ed17bf9e..3b47457862cc 100644 +--- a/net/sctp/stream.c ++++ b/net/sctp/stream.c +@@ -230,8 +230,6 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt, + for (i = 0; i < stream->outcnt; i++) + SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN; + +- sched->init(stream); +- + in: + sctp_stream_interleave_init(stream); + if (!incnt) +diff --git a/net/smc/smc.h b/net/smc/smc.h +index 5721416d0605..adbdf195eb08 100644 +--- a/net/smc/smc.h ++++ b/net/smc/smc.h +@@ -113,9 +113,9 @@ struct smc_host_cdc_msg { /* Connection Data Control message */ + } __aligned(8); + + enum smc_urg_state { +- SMC_URG_VALID, /* data present */ +- SMC_URG_NOTYET, /* data pending */ +- SMC_URG_READ /* data was already read */ ++ SMC_URG_VALID = 1, /* data present */ ++ SMC_URG_NOTYET = 2, /* data pending */ ++ SMC_URG_READ = 3, /* data was already read */ + }; + + struct smc_connection { +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index c754f3a90a2e..f601933ad728 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -888,7 +888,7 @@ retry: + addr->hash ^= sk->sk_type; + + __unix_remove_socket(sk); +- u->addr = addr; ++ smp_store_release(&u->addr, addr); + __unix_insert_socket(&unix_socket_table[addr->hash], sk); + spin_unlock(&unix_table_lock); + err = 0; +@@ -1058,7 +1058,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + + err = 0; + __unix_remove_socket(sk); +- u->addr = addr; ++ smp_store_release(&u->addr, addr); + __unix_insert_socket(list, sk); + + out_unlock: +@@ -1329,15 +1329,29 @@ restart: + RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq); + otheru = unix_sk(other); + +- /* copy address information from listening to new sock*/ +- if (otheru->addr) { +- refcount_inc(&otheru->addr->refcnt); +- newu->addr = otheru->addr; +- } ++ /* copy address information from listening to new sock ++ * ++ * The contents of *(otheru->addr) and otheru->path ++ * are seen fully set up here, since we have found ++ * otheru in hash under unix_table_lock. Insertion ++ * into the hash chain we'd found it in had been done ++ * in an earlier critical area protected by unix_table_lock, ++ * the same one where we'd set *(otheru->addr) contents, ++ * as well as otheru->path and otheru->addr itself. ++ * ++ * Using smp_store_release() here to set newu->addr ++ * is enough to make those stores, as well as stores ++ * to newu->path visible to anyone who gets newu->addr ++ * by smp_load_acquire(). IOW, the same warranties ++ * as for unix_sock instances bound in unix_bind() or ++ * in unix_autobind(). ++ */ + if (otheru->path.dentry) { + path_get(&otheru->path); + newu->path = otheru->path; + } ++ refcount_inc(&otheru->addr->refcnt); ++ smp_store_release(&newu->addr, otheru->addr); + + /* Set credentials */ + copy_peercred(sk, other); +@@ -1451,7 +1465,7 @@ out: + static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) + { + struct sock *sk = sock->sk; +- struct unix_sock *u; ++ struct unix_address *addr; + DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr); + int err = 0; + +@@ -1466,19 +1480,15 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) + sock_hold(sk); + } + +- u = unix_sk(sk); +- unix_state_lock(sk); +- if (!u->addr) { ++ addr = smp_load_acquire(&unix_sk(sk)->addr); ++ if (!addr) { + sunaddr->sun_family = AF_UNIX; + sunaddr->sun_path[0] = 0; + err = sizeof(short); + } else { +- struct unix_address *addr = u->addr; +- + err = addr->len; + memcpy(sunaddr, addr->name, addr->len); + } +- unix_state_unlock(sk); + sock_put(sk); + out: + return err; +@@ -2071,11 +2081,11 @@ static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg, + + static void unix_copy_addr(struct msghdr *msg, struct sock *sk) + { +- struct unix_sock *u = unix_sk(sk); ++ struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr); + +- if (u->addr) { +- msg->msg_namelen = u->addr->len; +- memcpy(msg->msg_name, u->addr->name, u->addr->len); ++ if (addr) { ++ msg->msg_namelen = addr->len; ++ memcpy(msg->msg_name, addr->name, addr->len); + } + } + +@@ -2579,15 +2589,14 @@ static int unix_open_file(struct sock *sk) + if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) + return -EPERM; + +- unix_state_lock(sk); ++ if (!smp_load_acquire(&unix_sk(sk)->addr)) ++ return -ENOENT; ++ + path = unix_sk(sk)->path; +- if (!path.dentry) { +- unix_state_unlock(sk); ++ if (!path.dentry) + return -ENOENT; +- } + + path_get(&path); +- unix_state_unlock(sk); + + fd = get_unused_fd_flags(O_CLOEXEC); + if (fd < 0) +@@ -2828,7 +2837,7 @@ static int unix_seq_show(struct seq_file *seq, void *v) + (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING), + sock_i_ino(s)); + +- if (u->addr) { ++ if (u->addr) { // under unix_table_lock here + int i, len; + seq_putc(seq, ' '); + +diff --git a/net/unix/diag.c b/net/unix/diag.c +index 384c84e83462..3183d9b8ab33 100644 +--- a/net/unix/diag.c ++++ b/net/unix/diag.c +@@ -10,7 +10,8 @@ + + static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb) + { +- struct unix_address *addr = unix_sk(sk)->addr; ++ /* might or might not have unix_table_lock */ ++ struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr); + + if (!addr) + return 0; +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index fef473c736fa..f7f53f9ae7ef 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -679,8 +679,7 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr; + int len, i, rc = 0; + +- if (!sock_flag(sk, SOCK_ZAPPED) || +- addr_len != sizeof(struct sockaddr_x25) || ++ if (addr_len != sizeof(struct sockaddr_x25) || + addr->sx25_family != AF_X25) { + rc = -EINVAL; + goto out; +@@ -695,9 +694,13 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + } + + lock_sock(sk); +- x25_sk(sk)->source_addr = addr->sx25_addr; +- x25_insert_socket(sk); +- sock_reset_flag(sk, SOCK_ZAPPED); ++ if (sock_flag(sk, SOCK_ZAPPED)) { ++ x25_sk(sk)->source_addr = addr->sx25_addr; ++ x25_insert_socket(sk); ++ sock_reset_flag(sk, SOCK_ZAPPED); ++ } else { ++ rc = -EINVAL; ++ } + release_sock(sk); + SOCK_DEBUG(sk, "x25_bind: socket is bound\n"); + out: +@@ -813,8 +816,13 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr, + sock->state = SS_CONNECTED; + rc = 0; + out_put_neigh: +- if (rc) ++ if (rc) { ++ read_lock_bh(&x25_list_lock); + x25_neigh_put(x25->neighbour); ++ x25->neighbour = NULL; ++ read_unlock_bh(&x25_list_lock); ++ x25->state = X25_STATE_0; ++ } + out_put_route: + x25_route_put(rt); + out: +diff --git a/security/lsm_audit.c b/security/lsm_audit.c +index f84001019356..33028c098ef3 100644 +--- a/security/lsm_audit.c ++++ b/security/lsm_audit.c +@@ -321,6 +321,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, + if (a->u.net->sk) { + struct sock *sk = a->u.net->sk; + struct unix_sock *u; ++ struct unix_address *addr; + int len = 0; + char *p = NULL; + +@@ -351,14 +352,15 @@ static void dump_common_audit_data(struct audit_buffer *ab, + #endif + case AF_UNIX: + u = unix_sk(sk); ++ addr = smp_load_acquire(&u->addr); ++ if (!addr) ++ break; + if (u->path.dentry) { + audit_log_d_path(ab, " path=", &u->path); + break; + } +- if (!u->addr) +- break; +- len = u->addr->len-sizeof(short); +- p = &u->addr->name->sun_path[0]; ++ len = addr->len-sizeof(short); ++ p = &addr->name->sun_path[0]; + audit_log_format(ab, " path="); + if (*p) + audit_log_untrustedstring(ab, p); +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index de4af8a41ff0..5636e89ce5c7 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -474,7 +474,19 @@ static const struct ieee1394_device_id bebob_id_table[] = { + /* Focusrite, SaffirePro 26 I/O */ + SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000003, &saffirepro_26_spec), + /* Focusrite, SaffirePro 10 I/O */ +- SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000006, &saffirepro_10_spec), ++ { ++ // The combination of vendor_id and model_id is the same as the ++ // same as the one of Liquid Saffire 56. ++ .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_MODEL_ID | ++ IEEE1394_MATCH_SPECIFIER_ID | ++ IEEE1394_MATCH_VERSION, ++ .vendor_id = VEN_FOCUSRITE, ++ .model_id = 0x000006, ++ .specifier_id = 0x00a02d, ++ .version = 0x010001, ++ .driver_data = (kernel_ulong_t)&saffirepro_10_spec, ++ }, + /* Focusrite, Saffire(no label and LE) */ + SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, MODEL_FOCUSRITE_SAFFIRE_BOTH, + &saffire_spec), +diff --git a/sound/firewire/motu/amdtp-motu.c b/sound/firewire/motu/amdtp-motu.c +index f0555a24d90e..6c9b743ea74b 100644 +--- a/sound/firewire/motu/amdtp-motu.c ++++ b/sound/firewire/motu/amdtp-motu.c +@@ -136,7 +136,9 @@ static void read_pcm_s32(struct amdtp_stream *s, + byte = (u8 *)buffer + p->pcm_byte_offset; + + for (c = 0; c < channels; ++c) { +- *dst = (byte[0] << 24) | (byte[1] << 16) | byte[2]; ++ *dst = (byte[0] << 24) | ++ (byte[1] << 16) | ++ (byte[2] << 8); + byte += 3; + dst++; + } +diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c +index 617ff1aa818f..27eb0270a711 100644 +--- a/sound/hda/hdac_i915.c ++++ b/sound/hda/hdac_i915.c +@@ -144,9 +144,9 @@ int snd_hdac_i915_init(struct hdac_bus *bus) + return -ENODEV; + if (!acomp->ops) { + request_module("i915"); +- /* 10s timeout */ ++ /* 60s timeout */ + wait_for_completion_timeout(&bind_complete, +- msecs_to_jiffies(10 * 1000)); ++ msecs_to_jiffies(60 * 1000)); + } + if (!acomp->ops) { + dev_info(bus->dev, "couldn't bind with audio component\n"); +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index fead0acb29f7..3cbd2119e148 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -936,6 +936,9 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index bf1ffcaab23f..877293149e3a 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -118,6 +118,7 @@ struct alc_spec { + unsigned int has_alc5505_dsp:1; + unsigned int no_depop_delay:1; + unsigned int done_hp_init:1; ++ unsigned int no_shutup_pins:1; + + /* for PLL fix */ + hda_nid_t pll_nid; +@@ -476,6 +477,14 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on) + set_eapd(codec, *p, on); + } + ++static void alc_shutup_pins(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ if (!spec->no_shutup_pins) ++ snd_hda_shutup_pins(codec); ++} ++ + /* generic shutup callback; + * just turning off EAPD and a little pause for avoiding pop-noise + */ +@@ -486,7 +495,7 @@ static void alc_eapd_shutup(struct hda_codec *codec) + alc_auto_setup_eapd(codec, false); + if (!spec->no_depop_delay) + msleep(200); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + /* generic EAPD initialization */ +@@ -814,7 +823,7 @@ static inline void alc_shutup(struct hda_codec *codec) + if (spec && spec->shutup) + spec->shutup(codec); + else +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static void alc_reboot_notify(struct hda_codec *codec) +@@ -2950,7 +2959,7 @@ static void alc269_shutup(struct hda_codec *codec) + (alc_get_coef0(codec) & 0x00ff) == 0x018) { + msleep(150); + } +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static struct coef_fw alc282_coefs[] = { +@@ -3053,14 +3062,15 @@ static void alc282_shutup(struct hda_codec *codec) + if (hp_pin_sense) + msleep(85); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + if (hp_pin_sense) + msleep(100); + + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + alc_write_coef_idx(codec, 0x78, coef78); + } + +@@ -3166,15 +3176,16 @@ static void alc283_shutup(struct hda_codec *codec) + if (hp_pin_sense) + msleep(100); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + alc_update_coef_idx(codec, 0x46, 0, 3 << 12); + + if (hp_pin_sense) + msleep(100); + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + alc_write_coef_idx(codec, 0x43, 0x9614); + } + +@@ -3240,14 +3251,15 @@ static void alc256_shutup(struct hda_codec *codec) + /* NOTE: call this before clearing the pin, otherwise codec stalls */ + alc_update_coef_idx(codec, 0x46, 0, 3 << 12); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + if (hp_pin_sense) + msleep(100); + + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static void alc225_init(struct hda_codec *codec) +@@ -3334,7 +3346,7 @@ static void alc225_shutup(struct hda_codec *codec) + msleep(100); + + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static void alc_default_init(struct hda_codec *codec) +@@ -3388,14 +3400,15 @@ static void alc_default_shutup(struct hda_codec *codec) + if (hp_pin_sense) + msleep(85); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + if (hp_pin_sense) + msleep(100); + + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static void alc294_hp_init(struct hda_codec *codec) +@@ -3412,8 +3425,9 @@ static void alc294_hp_init(struct hda_codec *codec) + + msleep(100); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */ + alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */ +@@ -5007,16 +5021,12 @@ static void alc_fixup_auto_mute_via_amp(struct hda_codec *codec, + } + } + +-static void alc_no_shutup(struct hda_codec *codec) +-{ +-} +- + static void alc_fixup_no_shutup(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { + if (action == HDA_FIXUP_ACT_PRE_PROBE) { + struct alc_spec *spec = codec->spec; +- spec->shutup = alc_no_shutup; ++ spec->no_shutup_pins = 1; + } + } + +@@ -5602,6 +5612,7 @@ enum { + ALC294_FIXUP_ASUS_SPK, + ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE, + ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, ++ ALC255_FIXUP_ACER_HEADSET_MIC, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6546,6 +6557,16 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC285_FIXUP_LENOVO_HEADPHONE_NOISE + }, ++ [ALC255_FIXUP_ACER_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x03a11130 }, ++ { 0x1a, 0x90a60140 }, /* use as internal mic */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -6565,6 +6586,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), + SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X), +@@ -6596,6 +6618,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), +@@ -6670,11 +6693,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x103c, 0x802e, "HP Z240 SFF", ALC221_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC), + SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360), +- SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x103c, 0x82c0, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), +@@ -6690,7 +6715,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), +- SND_PCI_QUIRK(0x1043, 0x14a1, "ASUS UX533FD", ALC294_FIXUP_ASUS_SPK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), +@@ -7303,6 +7327,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x14, 0x90170110}, + {0x1b, 0x90a70130}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK, ++ {0x12, 0x90a60130}, ++ {0x17, 0x90170110}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK, + {0x12, 0x90a60130}, + {0x17, 0x90170110}, diff --git a/patch/kernel/sunxi-next/patch-4.19.30-31.patch b/patch/kernel/sunxi-next/patch-4.19.30-31.patch new file mode 100644 index 0000000000..74fc1cf902 --- /dev/null +++ b/patch/kernel/sunxi-next/patch-4.19.30-31.patch @@ -0,0 +1,12008 @@ +diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt +index 3b2f2dd82225..3c6fc2e08d04 100644 +--- a/Documentation/arm64/silicon-errata.txt ++++ b/Documentation/arm64/silicon-errata.txt +@@ -44,6 +44,8 @@ stable kernels. + + | Implementor | Component | Erratum ID | Kconfig | + +----------------+-----------------+-----------------+-----------------------------+ ++| Allwinner | A64/R18 | UNKNOWN1 | SUN50I_ERRATUM_UNKNOWN1 | ++| | | | | + | ARM | Cortex-A53 | #826319 | ARM64_ERRATUM_826319 | + | ARM | Cortex-A53 | #827319 | ARM64_ERRATUM_827319 | + | ARM | Cortex-A53 | #824069 | ARM64_ERRATUM_824069 | +diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst +index 0de6f6145cc6..7ba8cd567f84 100644 +--- a/Documentation/process/stable-kernel-rules.rst ++++ b/Documentation/process/stable-kernel-rules.rst +@@ -38,6 +38,9 @@ Procedure for submitting patches to the -stable tree + - If the patch covers files in net/ or drivers/net please follow netdev stable + submission guidelines as described in + :ref:`Documentation/networking/netdev-FAQ.rst ` ++ after first checking the stable networking queue at ++ https://patchwork.ozlabs.org/bundle/davem/stable/?series=&submitter=&state=*&q=&archive= ++ to ensure the requested patch is not already queued up. + - Security patches should not be handled (solely) by the -stable review + process but should follow the procedures in + :ref:`Documentation/admin-guide/security-bugs.rst `. +diff --git a/Makefile b/Makefile +index 72e27c379eaf..3b1c6cff6700 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 30 ++SUBLEVEL = 31 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig +index ac69f307dcfe..74953e76a57d 100644 +--- a/arch/arc/Kconfig ++++ b/arch/arc/Kconfig +@@ -420,6 +420,14 @@ config ARC_HAS_ACCL_REGS + (also referred to as r58:r59). These can also be used by gcc as GPR so + kernel needs to save/restore per process + ++config ARC_IRQ_NO_AUTOSAVE ++ bool "Disable hardware autosave regfile on interrupts" ++ default n ++ help ++ On HS cores, taken interrupt auto saves the regfile on stack. ++ This is programmable and can be optionally disabled in which case ++ software INTERRUPT_PROLOGUE/EPILGUE do the needed work ++ + endif # ISA_ARCV2 + + endmenu # "ARC CPU Configuration" +diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h +index 49bfbd879caa..bdbdaef902eb 100644 +--- a/arch/arc/include/asm/arcregs.h ++++ b/arch/arc/include/asm/arcregs.h +@@ -151,6 +151,14 @@ struct bcr_isa_arcv2 { + #endif + }; + ++struct bcr_uarch_build_arcv2 { ++#ifdef CONFIG_CPU_BIG_ENDIAN ++ unsigned int pad:8, prod:8, maj:8, min:8; ++#else ++ unsigned int min:8, maj:8, prod:8, pad:8; ++#endif ++}; ++ + struct bcr_mpy { + #ifdef CONFIG_CPU_BIG_ENDIAN + unsigned int pad:8, x1616:8, dsp:4, cycles:2, type:2, ver:8; +diff --git a/arch/arc/include/asm/entry-arcv2.h b/arch/arc/include/asm/entry-arcv2.h +index 309f4e6721b3..225e7df2d8ed 100644 +--- a/arch/arc/include/asm/entry-arcv2.h ++++ b/arch/arc/include/asm/entry-arcv2.h +@@ -17,6 +17,33 @@ + ; + ; Now manually save: r12, sp, fp, gp, r25 + ++#ifdef CONFIG_ARC_IRQ_NO_AUTOSAVE ++.ifnc \called_from, exception ++ st.as r9, [sp, -10] ; save r9 in it's final stack slot ++ sub sp, sp, 12 ; skip JLI, LDI, EI ++ ++ PUSH lp_count ++ PUSHAX lp_start ++ PUSHAX lp_end ++ PUSH blink ++ ++ PUSH r11 ++ PUSH r10 ++ ++ sub sp, sp, 4 ; skip r9 ++ ++ PUSH r8 ++ PUSH r7 ++ PUSH r6 ++ PUSH r5 ++ PUSH r4 ++ PUSH r3 ++ PUSH r2 ++ PUSH r1 ++ PUSH r0 ++.endif ++#endif ++ + #ifdef CONFIG_ARC_HAS_ACCL_REGS + PUSH r59 + PUSH r58 +@@ -86,6 +113,33 @@ + POP r59 + #endif + ++#ifdef CONFIG_ARC_IRQ_NO_AUTOSAVE ++.ifnc \called_from, exception ++ POP r0 ++ POP r1 ++ POP r2 ++ POP r3 ++ POP r4 ++ POP r5 ++ POP r6 ++ POP r7 ++ POP r8 ++ POP r9 ++ POP r10 ++ POP r11 ++ ++ POP blink ++ POPAX lp_end ++ POPAX lp_start ++ ++ POP r9 ++ mov lp_count, r9 ++ ++ add sp, sp, 12 ; skip JLI, LDI, EI ++ ld.as r9, [sp, -10] ; reload r9 which got clobbered ++.endif ++#endif ++ + .endm + + /*------------------------------------------------------------------------*/ +diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h +index c9173c02081c..eabc3efa6c6d 100644 +--- a/arch/arc/include/asm/uaccess.h ++++ b/arch/arc/include/asm/uaccess.h +@@ -207,7 +207,7 @@ raw_copy_from_user(void *to, const void __user *from, unsigned long n) + */ + "=&r" (tmp), "+r" (to), "+r" (from) + : +- : "lp_count", "lp_start", "lp_end", "memory"); ++ : "lp_count", "memory"); + + return n; + } +@@ -433,7 +433,7 @@ raw_copy_to_user(void __user *to, const void *from, unsigned long n) + */ + "=&r" (tmp), "+r" (to), "+r" (from) + : +- : "lp_count", "lp_start", "lp_end", "memory"); ++ : "lp_count", "memory"); + + return n; + } +@@ -653,7 +653,7 @@ static inline unsigned long __arc_clear_user(void __user *to, unsigned long n) + " .previous \n" + : "+r"(d_char), "+r"(res) + : "i"(0) +- : "lp_count", "lp_start", "lp_end", "memory"); ++ : "lp_count", "memory"); + + return res; + } +@@ -686,7 +686,7 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count) + " .previous \n" + : "+r"(res), "+r"(dst), "+r"(src), "=r"(val) + : "g"(-EFAULT), "r"(count) +- : "lp_count", "lp_start", "lp_end", "memory"); ++ : "lp_count", "memory"); + + return res; + } +diff --git a/arch/arc/kernel/entry-arcv2.S b/arch/arc/kernel/entry-arcv2.S +index cc558a25b8fa..562089d62d9d 100644 +--- a/arch/arc/kernel/entry-arcv2.S ++++ b/arch/arc/kernel/entry-arcv2.S +@@ -209,7 +209,9 @@ restore_regs: + ;####### Return from Intr ####### + + debug_marker_l1: +- bbit1.nt r0, STATUS_DE_BIT, .Lintr_ret_to_delay_slot ++ ; bbit1.nt r0, STATUS_DE_BIT, .Lintr_ret_to_delay_slot ++ btst r0, STATUS_DE_BIT ; Z flag set if bit clear ++ bnz .Lintr_ret_to_delay_slot ; branch if STATUS_DE_BIT set + + .Lisr_ret_fast_path: + ; Handle special case #1: (Entry via Exception, Return via IRQ) +diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c +index 067ea362fb3e..cf18b3e5a934 100644 +--- a/arch/arc/kernel/intc-arcv2.c ++++ b/arch/arc/kernel/intc-arcv2.c +@@ -49,11 +49,13 @@ void arc_init_IRQ(void) + + *(unsigned int *)&ictrl = 0; + ++#ifndef CONFIG_ARC_IRQ_NO_AUTOSAVE + ictrl.save_nr_gpr_pairs = 6; /* r0 to r11 (r12 saved manually) */ + ictrl.save_blink = 1; + ictrl.save_lp_regs = 1; /* LP_COUNT, LP_START, LP_END */ + ictrl.save_u_to_u = 0; /* user ctxt saved on kernel stack */ + ictrl.save_idx_regs = 1; /* JLI, LDI, EI */ ++#endif + + WRITE_AUX(AUX_IRQ_CTRL, ictrl); + +diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c +index 62a30e58441c..3320ca2fe20f 100644 +--- a/arch/arc/kernel/setup.c ++++ b/arch/arc/kernel/setup.c +@@ -196,13 +196,29 @@ static void read_arc_build_cfg_regs(void) + cpu->bpu.num_pred = 2048 << bpu.pte; + + if (cpu->core.family >= 0x54) { +- unsigned int exec_ctrl; + +- READ_BCR(AUX_EXEC_CTRL, exec_ctrl); +- cpu->extn.dual_enb = !(exec_ctrl & 1); ++ struct bcr_uarch_build_arcv2 uarch; + +- /* dual issue always present for this core */ +- cpu->extn.dual = 1; ++ /* ++ * The first 0x54 core (uarch maj:min 0:1 or 0:2) was ++ * dual issue only (HS4x). But next uarch rev (1:0) ++ * allows it be configured for single issue (HS3x) ++ * Ensure we fiddle with dual issue only on HS4x ++ */ ++ READ_BCR(ARC_REG_MICRO_ARCH_BCR, uarch); ++ ++ if (uarch.prod == 4) { ++ unsigned int exec_ctrl; ++ ++ /* dual issue hardware always present */ ++ cpu->extn.dual = 1; ++ ++ READ_BCR(AUX_EXEC_CTRL, exec_ctrl); ++ ++ /* dual issue hardware enabled ? */ ++ cpu->extn.dual_enb = !(exec_ctrl & 1); ++ ++ } + } + } + +diff --git a/arch/arc/lib/memcpy-archs.S b/arch/arc/lib/memcpy-archs.S +index d61044dd8b58..ea14b0bf3116 100644 +--- a/arch/arc/lib/memcpy-archs.S ++++ b/arch/arc/lib/memcpy-archs.S +@@ -25,15 +25,11 @@ + #endif + + #ifdef CONFIG_ARC_HAS_LL64 +-# define PREFETCH_READ(RX) prefetch [RX, 56] +-# define PREFETCH_WRITE(RX) prefetchw [RX, 64] + # define LOADX(DST,RX) ldd.ab DST, [RX, 8] + # define STOREX(SRC,RX) std.ab SRC, [RX, 8] + # define ZOLSHFT 5 + # define ZOLAND 0x1F + #else +-# define PREFETCH_READ(RX) prefetch [RX, 28] +-# define PREFETCH_WRITE(RX) prefetchw [RX, 32] + # define LOADX(DST,RX) ld.ab DST, [RX, 4] + # define STOREX(SRC,RX) st.ab SRC, [RX, 4] + # define ZOLSHFT 4 +@@ -41,8 +37,6 @@ + #endif + + ENTRY_CFI(memcpy) +- prefetch [r1] ; Prefetch the read location +- prefetchw [r0] ; Prefetch the write location + mov.f 0, r2 + ;;; if size is zero + jz.d [blink] +@@ -72,8 +66,6 @@ ENTRY_CFI(memcpy) + lpnz @.Lcopy32_64bytes + ;; LOOP START + LOADX (r6, r1) +- PREFETCH_READ (r1) +- PREFETCH_WRITE (r3) + LOADX (r8, r1) + LOADX (r10, r1) + LOADX (r4, r1) +@@ -117,9 +109,7 @@ ENTRY_CFI(memcpy) + lpnz @.Lcopy8bytes_1 + ;; LOOP START + ld.ab r6, [r1, 4] +- prefetch [r1, 28] ;Prefetch the next read location + ld.ab r8, [r1,4] +- prefetchw [r3, 32] ;Prefetch the next write location + + SHIFT_1 (r7, r6, 24) + or r7, r7, r5 +@@ -162,9 +152,7 @@ ENTRY_CFI(memcpy) + lpnz @.Lcopy8bytes_2 + ;; LOOP START + ld.ab r6, [r1, 4] +- prefetch [r1, 28] ;Prefetch the next read location + ld.ab r8, [r1,4] +- prefetchw [r3, 32] ;Prefetch the next write location + + SHIFT_1 (r7, r6, 16) + or r7, r7, r5 +@@ -204,9 +192,7 @@ ENTRY_CFI(memcpy) + lpnz @.Lcopy8bytes_3 + ;; LOOP START + ld.ab r6, [r1, 4] +- prefetch [r1, 28] ;Prefetch the next read location + ld.ab r8, [r1,4] +- prefetchw [r3, 32] ;Prefetch the next write location + + SHIFT_1 (r7, r6, 8) + or r7, r7, r5 +diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig +index 9356753c2ed8..c285a83cbf08 100644 +--- a/arch/arc/plat-hsdk/Kconfig ++++ b/arch/arc/plat-hsdk/Kconfig +@@ -9,6 +9,7 @@ menuconfig ARC_SOC_HSDK + bool "ARC HS Development Kit SOC" + depends on ISA_ARCV2 + select ARC_HAS_ACCL_REGS ++ select ARC_IRQ_NO_AUTOSAVE + select CLK_HSDK + select RESET_HSDK + select MIGHT_HAVE_PCI +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index e8cd55a5b04c..cd4c74daf71e 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1444,6 +1444,7 @@ config NR_CPUS + config HOTPLUG_CPU + bool "Support for hot-pluggable CPUs" + depends on SMP ++ select GENERIC_IRQ_MIGRATION + help + Say Y here to experiment with turning CPUs off and on. CPUs + can be controlled through /sys/devices/system/cpu. +diff --git a/arch/arm/boot/dts/armada-xp-db.dts b/arch/arm/boot/dts/armada-xp-db.dts +index f3ac7483afed..5d04dc68cf57 100644 +--- a/arch/arm/boot/dts/armada-xp-db.dts ++++ b/arch/arm/boot/dts/armada-xp-db.dts +@@ -144,30 +144,32 @@ + status = "okay"; + }; + +- nand@d0000 { ++ nand-controller@d0000 { + status = "okay"; +- label = "pxa3xx_nand-0"; +- num-cs = <1>; +- marvell,nand-keep-config; +- nand-on-flash-bbt; +- +- partitions { +- compatible = "fixed-partitions"; +- #address-cells = <1>; +- #size-cells = <1>; +- +- partition@0 { +- label = "U-Boot"; +- reg = <0 0x800000>; +- }; +- partition@800000 { +- label = "Linux"; +- reg = <0x800000 0x800000>; +- }; +- partition@1000000 { +- label = "Filesystem"; +- reg = <0x1000000 0x3f000000>; + ++ nand@0 { ++ reg = <0>; ++ label = "pxa3xx_nand-0"; ++ nand-rb = <0>; ++ nand-on-flash-bbt; ++ ++ partitions { ++ compatible = "fixed-partitions"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ++ partition@0 { ++ label = "U-Boot"; ++ reg = <0 0x800000>; ++ }; ++ partition@800000 { ++ label = "Linux"; ++ reg = <0x800000 0x800000>; ++ }; ++ partition@1000000 { ++ label = "Filesystem"; ++ reg = <0x1000000 0x3f000000>; ++ }; + }; + }; + }; +diff --git a/arch/arm/boot/dts/armada-xp-gp.dts b/arch/arm/boot/dts/armada-xp-gp.dts +index 1139e9469a83..b4cca507cf13 100644 +--- a/arch/arm/boot/dts/armada-xp-gp.dts ++++ b/arch/arm/boot/dts/armada-xp-gp.dts +@@ -160,12 +160,15 @@ + status = "okay"; + }; + +- nand@d0000 { ++ nand-controller@d0000 { + status = "okay"; +- label = "pxa3xx_nand-0"; +- num-cs = <1>; +- marvell,nand-keep-config; +- nand-on-flash-bbt; ++ ++ nand@0 { ++ reg = <0>; ++ label = "pxa3xx_nand-0"; ++ nand-rb = <0>; ++ nand-on-flash-bbt; ++ }; + }; + }; + +diff --git a/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts b/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts +index bbbb38888bb8..87dcb502f72d 100644 +--- a/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts ++++ b/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts +@@ -81,49 +81,52 @@ + + }; + +- nand@d0000 { ++ nand-controller@d0000 { + status = "okay"; +- label = "pxa3xx_nand-0"; +- num-cs = <1>; +- marvell,nand-keep-config; +- nand-on-flash-bbt; +- +- partitions { +- compatible = "fixed-partitions"; +- #address-cells = <1>; +- #size-cells = <1>; +- +- partition@0 { +- label = "u-boot"; +- reg = <0x00000000 0x000e0000>; +- read-only; +- }; +- +- partition@e0000 { +- label = "u-boot-env"; +- reg = <0x000e0000 0x00020000>; +- read-only; +- }; +- +- partition@100000 { +- label = "u-boot-env2"; +- reg = <0x00100000 0x00020000>; +- read-only; +- }; +- +- partition@120000 { +- label = "zImage"; +- reg = <0x00120000 0x00400000>; +- }; +- +- partition@520000 { +- label = "initrd"; +- reg = <0x00520000 0x00400000>; +- }; + +- partition@e00000 { +- label = "boot"; +- reg = <0x00e00000 0x3f200000>; ++ nand@0 { ++ reg = <0>; ++ label = "pxa3xx_nand-0"; ++ nand-rb = <0>; ++ nand-on-flash-bbt; ++ ++ partitions { ++ compatible = "fixed-partitions"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ++ partition@0 { ++ label = "u-boot"; ++ reg = <0x00000000 0x000e0000>; ++ read-only; ++ }; ++ ++ partition@e0000 { ++ label = "u-boot-env"; ++ reg = <0x000e0000 0x00020000>; ++ read-only; ++ }; ++ ++ partition@100000 { ++ label = "u-boot-env2"; ++ reg = <0x00100000 0x00020000>; ++ read-only; ++ }; ++ ++ partition@120000 { ++ label = "zImage"; ++ reg = <0x00120000 0x00400000>; ++ }; ++ ++ partition@520000 { ++ label = "initrd"; ++ reg = <0x00520000 0x00400000>; ++ }; ++ ++ partition@e00000 { ++ label = "boot"; ++ reg = <0x00e00000 0x3f200000>; ++ }; + }; + }; + }; +diff --git a/arch/arm/boot/dts/omap4-droid4-xt894.dts b/arch/arm/boot/dts/omap4-droid4-xt894.dts +index 04758a2a87f0..67d77eee9433 100644 +--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts ++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts +@@ -644,6 +644,17 @@ + }; + }; + ++/* Configure pwm clock source for timers 8 & 9 */ ++&timer8 { ++ assigned-clocks = <&abe_clkctrl OMAP4_TIMER8_CLKCTRL 24>; ++ assigned-clock-parents = <&sys_clkin_ck>; ++}; ++ ++&timer9 { ++ assigned-clocks = <&l4_per_clkctrl OMAP4_TIMER9_CLKCTRL 24>; ++ assigned-clock-parents = <&sys_clkin_ck>; ++}; ++ + /* + * As uart1 is wired to mdm6600 with rts and cts, we can use the cts pin for + * uart1 wakeirq. +diff --git a/arch/arm/boot/dts/tegra124-nyan.dtsi b/arch/arm/boot/dts/tegra124-nyan.dtsi +index d5f11d6d987e..bc85b6a166c7 100644 +--- a/arch/arm/boot/dts/tegra124-nyan.dtsi ++++ b/arch/arm/boot/dts/tegra124-nyan.dtsi +@@ -13,10 +13,25 @@ + stdout-path = "serial0:115200n8"; + }; + +- memory@80000000 { ++ /* ++ * Note that recent version of the device tree compiler (starting with ++ * version 1.4.2) warn about this node containing a reg property, but ++ * missing a unit-address. However, the bootloader on these Chromebook ++ * devices relies on the full name of this node to be exactly /memory. ++ * Adding the unit-address causes the bootloader to create a /memory ++ * node and write the memory bank configuration to that node, which in ++ * turn leads the kernel to believe that the device has 2 GiB of ++ * memory instead of the amount detected by the bootloader. ++ * ++ * The name of this node is effectively ABI and must not be changed. ++ */ ++ memory { ++ device_type = "memory"; + reg = <0x0 0x80000000 0x0 0x80000000>; + }; + ++ /delete-node/ memory@80000000; ++ + host1x@50000000 { + hdmi@54280000 { + status = "okay"; +diff --git a/arch/arm/crypto/crct10dif-ce-core.S b/arch/arm/crypto/crct10dif-ce-core.S +index ce45ba0c0687..16019b5961e7 100644 +--- a/arch/arm/crypto/crct10dif-ce-core.S ++++ b/arch/arm/crypto/crct10dif-ce-core.S +@@ -124,10 +124,10 @@ ENTRY(crc_t10dif_pmull) + vext.8 q10, qzr, q0, #4 + + // receive the initial 64B data, xor the initial crc value +- vld1.64 {q0-q1}, [arg2, :128]! +- vld1.64 {q2-q3}, [arg2, :128]! +- vld1.64 {q4-q5}, [arg2, :128]! +- vld1.64 {q6-q7}, [arg2, :128]! ++ vld1.64 {q0-q1}, [arg2]! ++ vld1.64 {q2-q3}, [arg2]! ++ vld1.64 {q4-q5}, [arg2]! ++ vld1.64 {q6-q7}, [arg2]! + CPU_LE( vrev64.8 q0, q0 ) + CPU_LE( vrev64.8 q1, q1 ) + CPU_LE( vrev64.8 q2, q2 ) +@@ -167,7 +167,7 @@ CPU_LE( vrev64.8 q7, q7 ) + _fold_64_B_loop: + + .macro fold64, reg1, reg2 +- vld1.64 {q11-q12}, [arg2, :128]! ++ vld1.64 {q11-q12}, [arg2]! + + vmull.p64 q8, \reg1\()h, d21 + vmull.p64 \reg1, \reg1\()l, d20 +@@ -238,7 +238,7 @@ _16B_reduction_loop: + vmull.p64 q7, d15, d21 + veor.8 q7, q7, q8 + +- vld1.64 {q0}, [arg2, :128]! ++ vld1.64 {q0}, [arg2]! + CPU_LE( vrev64.8 q0, q0 ) + vswp d0, d1 + veor.8 q7, q7, q0 +@@ -335,7 +335,7 @@ _less_than_128: + vmov.i8 q0, #0 + vmov s3, arg1_low32 // get the initial crc value + +- vld1.64 {q7}, [arg2, :128]! ++ vld1.64 {q7}, [arg2]! + CPU_LE( vrev64.8 q7, q7 ) + vswp d14, d15 + veor.8 q7, q7, q0 +diff --git a/arch/arm/crypto/crct10dif-ce-glue.c b/arch/arm/crypto/crct10dif-ce-glue.c +index d428355cf38d..14c19c70a841 100644 +--- a/arch/arm/crypto/crct10dif-ce-glue.c ++++ b/arch/arm/crypto/crct10dif-ce-glue.c +@@ -35,26 +35,15 @@ static int crct10dif_update(struct shash_desc *desc, const u8 *data, + unsigned int length) + { + u16 *crc = shash_desc_ctx(desc); +- unsigned int l; + +- if (!may_use_simd()) { +- *crc = crc_t10dif_generic(*crc, data, length); ++ if (length >= CRC_T10DIF_PMULL_CHUNK_SIZE && may_use_simd()) { ++ kernel_neon_begin(); ++ *crc = crc_t10dif_pmull(*crc, data, length); ++ kernel_neon_end(); + } else { +- if (unlikely((u32)data % CRC_T10DIF_PMULL_CHUNK_SIZE)) { +- l = min_t(u32, length, CRC_T10DIF_PMULL_CHUNK_SIZE - +- ((u32)data % CRC_T10DIF_PMULL_CHUNK_SIZE)); +- +- *crc = crc_t10dif_generic(*crc, data, l); +- +- length -= l; +- data += l; +- } +- if (length > 0) { +- kernel_neon_begin(); +- *crc = crc_t10dif_pmull(*crc, data, length); +- kernel_neon_end(); +- } ++ *crc = crc_t10dif_generic(*crc, data, length); + } ++ + return 0; + } + +diff --git a/arch/arm/include/asm/irq.h b/arch/arm/include/asm/irq.h +index c883fcbe93b6..46d41140df27 100644 +--- a/arch/arm/include/asm/irq.h ++++ b/arch/arm/include/asm/irq.h +@@ -25,7 +25,6 @@ + #ifndef __ASSEMBLY__ + struct irqaction; + struct pt_regs; +-extern void migrate_irqs(void); + + extern void asm_do_IRQ(unsigned int, struct pt_regs *); + void handle_IRQ(unsigned int, struct pt_regs *); +diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h +index 3ad482d2f1eb..d0d0227fc70d 100644 +--- a/arch/arm/include/asm/kvm_host.h ++++ b/arch/arm/include/asm/kvm_host.h +@@ -48,6 +48,7 @@ + #define KVM_REQ_SLEEP \ + KVM_ARCH_REQ_FLAGS(0, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQ_IRQ_PENDING KVM_ARCH_REQ(1) ++#define KVM_REQ_VCPU_RESET KVM_ARCH_REQ(2) + + DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use); + +@@ -147,6 +148,13 @@ struct kvm_cpu_context { + + typedef struct kvm_cpu_context kvm_cpu_context_t; + ++struct vcpu_reset_state { ++ unsigned long pc; ++ unsigned long r0; ++ bool be; ++ bool reset; ++}; ++ + struct kvm_vcpu_arch { + struct kvm_cpu_context ctxt; + +@@ -186,6 +194,8 @@ struct kvm_vcpu_arch { + /* Cache some mmu pages needed inside spinlock regions */ + struct kvm_mmu_memory_cache mmu_page_cache; + ++ struct vcpu_reset_state reset_state; ++ + /* Detect first run of a vcpu */ + bool has_run_once; + }; +diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c +index 9908dacf9229..844861368cd5 100644 +--- a/arch/arm/kernel/irq.c ++++ b/arch/arm/kernel/irq.c +@@ -31,7 +31,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -109,64 +108,3 @@ int __init arch_probe_nr_irqs(void) + return nr_irqs; + } + #endif +- +-#ifdef CONFIG_HOTPLUG_CPU +-static bool migrate_one_irq(struct irq_desc *desc) +-{ +- struct irq_data *d = irq_desc_get_irq_data(desc); +- const struct cpumask *affinity = irq_data_get_affinity_mask(d); +- struct irq_chip *c; +- bool ret = false; +- +- /* +- * If this is a per-CPU interrupt, or the affinity does not +- * include this CPU, then we have nothing to do. +- */ +- if (irqd_is_per_cpu(d) || !cpumask_test_cpu(smp_processor_id(), affinity)) +- return false; +- +- if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) { +- affinity = cpu_online_mask; +- ret = true; +- } +- +- c = irq_data_get_irq_chip(d); +- if (!c->irq_set_affinity) +- pr_debug("IRQ%u: unable to set affinity\n", d->irq); +- else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret) +- cpumask_copy(irq_data_get_affinity_mask(d), affinity); +- +- return ret; +-} +- +-/* +- * The current CPU has been marked offline. Migrate IRQs off this CPU. +- * If the affinity settings do not allow other CPUs, force them onto any +- * available CPU. +- * +- * Note: we must iterate over all IRQs, whether they have an attached +- * action structure or not, as we need to get chained interrupts too. +- */ +-void migrate_irqs(void) +-{ +- unsigned int i; +- struct irq_desc *desc; +- unsigned long flags; +- +- local_irq_save(flags); +- +- for_each_irq_desc(i, desc) { +- bool affinity_broken; +- +- raw_spin_lock(&desc->lock); +- affinity_broken = migrate_one_irq(desc); +- raw_spin_unlock(&desc->lock); +- +- if (affinity_broken) +- pr_warn_ratelimited("IRQ%u no longer affine to CPU%u\n", +- i, smp_processor_id()); +- } +- +- local_irq_restore(flags); +-} +-#endif /* CONFIG_HOTPLUG_CPU */ +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index 3bf82232b1be..1d6f5ea522f4 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -254,7 +254,7 @@ int __cpu_disable(void) + /* + * OK - migrate IRQs away from this CPU + */ +- migrate_irqs(); ++ irq_migrate_all_off_this_cpu(); + + /* + * Flush user cache and TLB mappings, and then remove this CPU +diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c +index cb094e55dc5f..fd6cde23bb5d 100644 +--- a/arch/arm/kvm/coproc.c ++++ b/arch/arm/kvm/coproc.c +@@ -1450,6 +1450,6 @@ void kvm_reset_coprocs(struct kvm_vcpu *vcpu) + reset_coproc_regs(vcpu, table, num); + + for (num = 1; num < NR_CP15_REGS; num++) +- if (vcpu_cp15(vcpu, num) == 0x42424242) +- panic("Didn't reset vcpu_cp15(vcpu, %zi)", num); ++ WARN(vcpu_cp15(vcpu, num) == 0x42424242, ++ "Didn't reset vcpu_cp15(vcpu, %zi)", num); + } +diff --git a/arch/arm/kvm/reset.c b/arch/arm/kvm/reset.c +index 5ed0c3ee33d6..e53327912adc 100644 +--- a/arch/arm/kvm/reset.c ++++ b/arch/arm/kvm/reset.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #include + +@@ -69,6 +70,29 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu) + /* Reset CP15 registers */ + kvm_reset_coprocs(vcpu); + ++ /* ++ * Additional reset state handling that PSCI may have imposed on us. ++ * Must be done after all the sys_reg reset. ++ */ ++ if (READ_ONCE(vcpu->arch.reset_state.reset)) { ++ unsigned long target_pc = vcpu->arch.reset_state.pc; ++ ++ /* Gracefully handle Thumb2 entry point */ ++ if (target_pc & 1) { ++ target_pc &= ~1UL; ++ vcpu_set_thumb(vcpu); ++ } ++ ++ /* Propagate caller endianness */ ++ if (vcpu->arch.reset_state.be) ++ kvm_vcpu_set_be(vcpu); ++ ++ *vcpu_pc(vcpu) = target_pc; ++ vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0); ++ ++ vcpu->arch.reset_state.reset = false; ++ } ++ + /* Reset arch_timer context */ + return kvm_timer_vcpu_reset(vcpu); + } +diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c +index a8b291f00109..dae514c8276a 100644 +--- a/arch/arm/mach-omap2/cpuidle44xx.c ++++ b/arch/arm/mach-omap2/cpuidle44xx.c +@@ -152,6 +152,10 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, + mpuss_can_lose_context = (cx->mpu_state == PWRDM_POWER_RET) && + (cx->mpu_logic_state == PWRDM_POWER_OFF); + ++ /* Enter broadcast mode for periodic timers */ ++ tick_broadcast_enable(); ++ ++ /* Enter broadcast mode for one-shot timers */ + tick_broadcast_enter(); + + /* +@@ -218,15 +222,6 @@ fail: + return index; + } + +-/* +- * For each cpu, setup the broadcast timer because local timers +- * stops for the states above C1. +- */ +-static void omap_setup_broadcast_timer(void *arg) +-{ +- tick_broadcast_enable(); +-} +- + static struct cpuidle_driver omap4_idle_driver = { + .name = "omap4_idle", + .owner = THIS_MODULE, +@@ -319,8 +314,5 @@ int __init omap4_idle_init(void) + if (!cpu_clkdm[0] || !cpu_clkdm[1]) + return -ENODEV; + +- /* Configure the broadcast timer on each cpu */ +- on_each_cpu(omap_setup_broadcast_timer, NULL, 1); +- + return cpuidle_register(idle_driver, cpu_online_mask); + } +diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c +index 9500b6e27380..5d73f2c0b117 100644 +--- a/arch/arm/mach-omap2/display.c ++++ b/arch/arm/mach-omap2/display.c +@@ -83,6 +83,7 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes) + u32 enable_mask, enable_shift; + u32 pipd_mask, pipd_shift; + u32 reg; ++ int ret; + + if (dsi_id == 0) { + enable_mask = OMAP4_DSI1_LANEENABLE_MASK; +@@ -98,7 +99,11 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes) + return -ENODEV; + } + +- regmap_read(omap4_dsi_mux_syscon, OMAP4_DSIPHY_SYSCON_OFFSET, ®); ++ ret = regmap_read(omap4_dsi_mux_syscon, ++ OMAP4_DSIPHY_SYSCON_OFFSET, ++ ®); ++ if (ret) ++ return ret; + + reg &= ~enable_mask; + reg &= ~pipd_mask; +diff --git a/arch/arm/mach-s3c24xx/mach-osiris-dvs.c b/arch/arm/mach-s3c24xx/mach-osiris-dvs.c +index 058ce73137e8..5d819b6ea428 100644 +--- a/arch/arm/mach-s3c24xx/mach-osiris-dvs.c ++++ b/arch/arm/mach-s3c24xx/mach-osiris-dvs.c +@@ -65,16 +65,16 @@ static int osiris_dvs_notify(struct notifier_block *nb, + + switch (val) { + case CPUFREQ_PRECHANGE: +- if (old_dvs & !new_dvs || +- cur_dvs & !new_dvs) { ++ if ((old_dvs && !new_dvs) || ++ (cur_dvs && !new_dvs)) { + pr_debug("%s: exiting dvs\n", __func__); + cur_dvs = false; + gpio_set_value(OSIRIS_GPIO_DVS, 1); + } + break; + case CPUFREQ_POSTCHANGE: +- if (!old_dvs & new_dvs || +- !cur_dvs & new_dvs) { ++ if ((!old_dvs && new_dvs) || ++ (!cur_dvs && new_dvs)) { + pr_debug("entering dvs\n"); + cur_dvs = true; + gpio_set_value(OSIRIS_GPIO_DVS, 0); +diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c +index 1cb9c0f9b5d6..8211cf45ece1 100644 +--- a/arch/arm/mm/dma-mapping.c ++++ b/arch/arm/mm/dma-mapping.c +@@ -2400,4 +2400,6 @@ void arch_teardown_dma_ops(struct device *dev) + return; + + arm_teardown_iommu_dma_ops(dev); ++ /* Let arch_setup_dma_ops() start again from scratch upon re-probe */ ++ set_dma_ops(dev, NULL); + } +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts +index 1ee0dc0d9f10..d1cf404b8708 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts +@@ -22,7 +22,7 @@ + backlight = <&backlight>; + power-supply = <&pp3300_disp>; + +- ports { ++ port { + panel_in_edp: endpoint { + remote-endpoint = <&edp_out_panel>; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts +index 2cc7c47d6a85..65637a5a4b21 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts +@@ -43,7 +43,7 @@ + backlight = <&backlight>; + power-supply = <&pp3300_disp>; + +- ports { ++ port { + panel_in_edp: endpoint { + remote-endpoint = <&edp_out_panel>; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +index fef2c0608999..b14d83919f14 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +@@ -50,7 +50,7 @@ + pinctrl-0 = <&lcd_panel_reset>; + power-supply = <&vcc3v3_s0>; + +- ports { ++ port { + panel_in_edp: endpoint { + remote-endpoint = <&edp_out_panel>; + }; +diff --git a/arch/arm64/crypto/aes-ce-ccm-core.S b/arch/arm64/crypto/aes-ce-ccm-core.S +index e3a375c4cb83..1b151442dac1 100644 +--- a/arch/arm64/crypto/aes-ce-ccm-core.S ++++ b/arch/arm64/crypto/aes-ce-ccm-core.S +@@ -74,12 +74,13 @@ ENTRY(ce_aes_ccm_auth_data) + beq 10f + ext v0.16b, v0.16b, v0.16b, #1 /* rotate out the mac bytes */ + b 7b +-8: mov w7, w8 ++8: cbz w8, 91f ++ mov w7, w8 + add w8, w8, #16 + 9: ext v1.16b, v1.16b, v1.16b, #1 + adds w7, w7, #1 + bne 9b +- eor v0.16b, v0.16b, v1.16b ++91: eor v0.16b, v0.16b, v1.16b + st1 {v0.16b}, [x0] + 10: str w8, [x3] + ret +diff --git a/arch/arm64/crypto/aes-ce-ccm-glue.c b/arch/arm64/crypto/aes-ce-ccm-glue.c +index 68b11aa690e4..986191e8c058 100644 +--- a/arch/arm64/crypto/aes-ce-ccm-glue.c ++++ b/arch/arm64/crypto/aes-ce-ccm-glue.c +@@ -125,7 +125,7 @@ static void ccm_update_mac(struct crypto_aes_ctx *key, u8 mac[], u8 const in[], + abytes -= added; + } + +- while (abytes > AES_BLOCK_SIZE) { ++ while (abytes >= AES_BLOCK_SIZE) { + __aes_arm64_encrypt(key->key_enc, mac, mac, + num_rounds(key)); + crypto_xor(mac, in, AES_BLOCK_SIZE); +@@ -139,8 +139,6 @@ static void ccm_update_mac(struct crypto_aes_ctx *key, u8 mac[], u8 const in[], + num_rounds(key)); + crypto_xor(mac, in, abytes); + *macp = abytes; +- } else { +- *macp = 0; + } + } + } +diff --git a/arch/arm64/crypto/aes-neonbs-core.S b/arch/arm64/crypto/aes-neonbs-core.S +index e613a87f8b53..8432c8d0dea6 100644 +--- a/arch/arm64/crypto/aes-neonbs-core.S ++++ b/arch/arm64/crypto/aes-neonbs-core.S +@@ -971,18 +971,22 @@ CPU_LE( rev x8, x8 ) + + 8: next_ctr v0 + st1 {v0.16b}, [x24] +- cbz x23, 0f ++ cbz x23, .Lctr_done + + cond_yield_neon 98b + b 99b + +-0: frame_pop ++.Lctr_done: ++ frame_pop + ret + + /* + * If we are handling the tail of the input (x6 != NULL), return the + * final keystream block back to the caller. + */ ++0: cbz x25, 8b ++ st1 {v0.16b}, [x25] ++ b 8b + 1: cbz x25, 8b + st1 {v1.16b}, [x25] + b 8b +diff --git a/arch/arm64/crypto/crct10dif-ce-glue.c b/arch/arm64/crypto/crct10dif-ce-glue.c +index 96f0cae4a022..617bcfc1b080 100644 +--- a/arch/arm64/crypto/crct10dif-ce-glue.c ++++ b/arch/arm64/crypto/crct10dif-ce-glue.c +@@ -36,26 +36,13 @@ static int crct10dif_update(struct shash_desc *desc, const u8 *data, + unsigned int length) + { + u16 *crc = shash_desc_ctx(desc); +- unsigned int l; + +- if (unlikely((u64)data % CRC_T10DIF_PMULL_CHUNK_SIZE)) { +- l = min_t(u32, length, CRC_T10DIF_PMULL_CHUNK_SIZE - +- ((u64)data % CRC_T10DIF_PMULL_CHUNK_SIZE)); +- +- *crc = crc_t10dif_generic(*crc, data, l); +- +- length -= l; +- data += l; +- } +- +- if (length > 0) { +- if (may_use_simd()) { +- kernel_neon_begin(); +- *crc = crc_t10dif_pmull(*crc, data, length); +- kernel_neon_end(); +- } else { +- *crc = crc_t10dif_generic(*crc, data, length); +- } ++ if (length >= CRC_T10DIF_PMULL_CHUNK_SIZE && may_use_simd()) { ++ kernel_neon_begin(); ++ *crc = crc_t10dif_pmull(*crc, data, length); ++ kernel_neon_end(); ++ } else { ++ *crc = crc_t10dif_generic(*crc, data, length); + } + + return 0; +diff --git a/arch/arm64/include/asm/hardirq.h b/arch/arm64/include/asm/hardirq.h +index 1473fc2f7ab7..89691c86640a 100644 +--- a/arch/arm64/include/asm/hardirq.h ++++ b/arch/arm64/include/asm/hardirq.h +@@ -17,8 +17,12 @@ + #define __ASM_HARDIRQ_H + + #include ++#include + #include ++#include + #include ++#include ++#include + + #define NR_IPI 7 + +@@ -37,6 +41,33 @@ u64 smp_irq_stat_cpu(unsigned int cpu); + + #define __ARCH_IRQ_EXIT_IRQS_DISABLED 1 + ++struct nmi_ctx { ++ u64 hcr; ++}; ++ ++DECLARE_PER_CPU(struct nmi_ctx, nmi_contexts); ++ ++#define arch_nmi_enter() \ ++ do { \ ++ if (is_kernel_in_hyp_mode()) { \ ++ struct nmi_ctx *nmi_ctx = this_cpu_ptr(&nmi_contexts); \ ++ nmi_ctx->hcr = read_sysreg(hcr_el2); \ ++ if (!(nmi_ctx->hcr & HCR_TGE)) { \ ++ write_sysreg(nmi_ctx->hcr | HCR_TGE, hcr_el2); \ ++ isb(); \ ++ } \ ++ } \ ++ } while (0) ++ ++#define arch_nmi_exit() \ ++ do { \ ++ if (is_kernel_in_hyp_mode()) { \ ++ struct nmi_ctx *nmi_ctx = this_cpu_ptr(&nmi_contexts); \ ++ if (!(nmi_ctx->hcr & HCR_TGE)) \ ++ write_sysreg(nmi_ctx->hcr, hcr_el2); \ ++ } \ ++ } while (0) ++ + static inline void ack_bad_irq(unsigned int irq) + { + extern unsigned long irq_err_count; +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index 3d6d7336f871..6abe4002945f 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -48,6 +48,7 @@ + #define KVM_REQ_SLEEP \ + KVM_ARCH_REQ_FLAGS(0, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQ_IRQ_PENDING KVM_ARCH_REQ(1) ++#define KVM_REQ_VCPU_RESET KVM_ARCH_REQ(2) + + DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use); + +@@ -206,6 +207,13 @@ struct kvm_cpu_context { + + typedef struct kvm_cpu_context kvm_cpu_context_t; + ++struct vcpu_reset_state { ++ unsigned long pc; ++ unsigned long r0; ++ bool be; ++ bool reset; ++}; ++ + struct kvm_vcpu_arch { + struct kvm_cpu_context ctxt; + +@@ -295,6 +303,9 @@ struct kvm_vcpu_arch { + /* Virtual SError ESR to restore when HCR_EL2.VSE is set */ + u64 vsesr_el2; + ++ /* Additional reset state */ ++ struct vcpu_reset_state reset_state; ++ + /* True when deferrable sysregs are loaded on the physical CPU, + * see kvm_vcpu_load_sysregs and kvm_vcpu_put_sysregs. */ + bool sysregs_loaded_on_cpu; +diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S +index 651a06b1980f..77ca59598c8b 100644 +--- a/arch/arm64/kernel/head.S ++++ b/arch/arm64/kernel/head.S +@@ -522,8 +522,7 @@ set_hcr: + /* GICv3 system register access */ + mrs x0, id_aa64pfr0_el1 + ubfx x0, x0, #24, #4 +- cmp x0, #1 +- b.ne 3f ++ cbz x0, 3f + + mrs_s x0, SYS_ICC_SRE_EL2 + orr x0, x0, #ICC_SRE_EL2_SRE // Set ICC_SRE_EL2.SRE==1 +diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c +index 780a12f59a8f..92fa81798fb9 100644 +--- a/arch/arm64/kernel/irq.c ++++ b/arch/arm64/kernel/irq.c +@@ -33,6 +33,9 @@ + + unsigned long irq_err_count; + ++/* Only access this in an NMI enter/exit */ ++DEFINE_PER_CPU(struct nmi_ctx, nmi_contexts); ++ + DEFINE_PER_CPU(unsigned long *, irq_stack_ptr); + + int arch_show_interrupts(struct seq_file *p, int prec) +diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c +index a20de58061a8..35f184a8fd85 100644 +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -244,27 +244,33 @@ int kgdb_arch_handle_exception(int exception_vector, int signo, + + static int kgdb_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + kgdb_handle_exception(1, SIGTRAP, 0, regs); +- return 0; ++ return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_brk_fn) + + static int kgdb_compiled_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + compiled_break = 1; + kgdb_handle_exception(1, SIGTRAP, 0, regs); + +- return 0; ++ return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_compiled_brk_fn); + + static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr) + { +- if (!kgdb_single_step) ++ if (user_mode(regs) || !kgdb_single_step) + return DBG_HOOK_ERROR; + + kgdb_handle_exception(1, SIGTRAP, 0, regs); +- return 0; ++ return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_step_brk_fn); + +diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c +index 30bb13797034..2d63df112b89 100644 +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -450,6 +450,9 @@ kprobe_single_step_handler(struct pt_regs *regs, unsigned int esr) + struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); + int retval; + ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + /* return error if this is not our step */ + retval = kprobe_ss_hit(kcb, instruction_pointer(regs)); + +@@ -466,6 +469,9 @@ kprobe_single_step_handler(struct pt_regs *regs, unsigned int esr) + int __kprobes + kprobe_breakpoint_handler(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + kprobe_handler(regs); + return DBG_HOOK_HANDLED; + } +diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c +index a1c32c1f2267..6290a4e81d57 100644 +--- a/arch/arm64/kvm/hyp/switch.c ++++ b/arch/arm64/kvm/hyp/switch.c +@@ -23,6 +23,7 @@ + #include + + #include ++#include + #include + #include + #include +@@ -107,6 +108,7 @@ static void activate_traps_vhe(struct kvm_vcpu *vcpu) + + write_sysreg(kvm_get_hyp_vector(), vbar_el1); + } ++NOKPROBE_SYMBOL(activate_traps_vhe); + + static void __hyp_text __activate_traps_nvhe(struct kvm_vcpu *vcpu) + { +@@ -146,6 +148,7 @@ static void deactivate_traps_vhe(void) + write_sysreg(CPACR_EL1_DEFAULT, cpacr_el1); + write_sysreg(vectors, vbar_el1); + } ++NOKPROBE_SYMBOL(deactivate_traps_vhe); + + static void __hyp_text __deactivate_traps_nvhe(void) + { +@@ -529,6 +532,7 @@ int kvm_vcpu_run_vhe(struct kvm_vcpu *vcpu) + + return exit_code; + } ++NOKPROBE_SYMBOL(kvm_vcpu_run_vhe); + + /* Switch to the guest for legacy non-VHE systems */ + int __hyp_text __kvm_vcpu_run_nvhe(struct kvm_vcpu *vcpu) +@@ -636,6 +640,7 @@ static void __hyp_call_panic_vhe(u64 spsr, u64 elr, u64 par, + read_sysreg_el2(esr), read_sysreg_el2(far), + read_sysreg(hpfar_el2), par, vcpu); + } ++NOKPROBE_SYMBOL(__hyp_call_panic_vhe); + + void __hyp_text __noreturn hyp_panic(struct kvm_cpu_context *host_ctxt) + { +diff --git a/arch/arm64/kvm/hyp/sysreg-sr.c b/arch/arm64/kvm/hyp/sysreg-sr.c +index 9ce223944983..963d669ae3a2 100644 +--- a/arch/arm64/kvm/hyp/sysreg-sr.c ++++ b/arch/arm64/kvm/hyp/sysreg-sr.c +@@ -18,6 +18,7 @@ + #include + #include + ++#include + #include + #include + #include +@@ -98,12 +99,14 @@ void sysreg_save_host_state_vhe(struct kvm_cpu_context *ctxt) + { + __sysreg_save_common_state(ctxt); + } ++NOKPROBE_SYMBOL(sysreg_save_host_state_vhe); + + void sysreg_save_guest_state_vhe(struct kvm_cpu_context *ctxt) + { + __sysreg_save_common_state(ctxt); + __sysreg_save_el2_return_state(ctxt); + } ++NOKPROBE_SYMBOL(sysreg_save_guest_state_vhe); + + static void __hyp_text __sysreg_restore_common_state(struct kvm_cpu_context *ctxt) + { +@@ -171,12 +174,14 @@ void sysreg_restore_host_state_vhe(struct kvm_cpu_context *ctxt) + { + __sysreg_restore_common_state(ctxt); + } ++NOKPROBE_SYMBOL(sysreg_restore_host_state_vhe); + + void sysreg_restore_guest_state_vhe(struct kvm_cpu_context *ctxt) + { + __sysreg_restore_common_state(ctxt); + __sysreg_restore_el2_return_state(ctxt); + } ++NOKPROBE_SYMBOL(sysreg_restore_guest_state_vhe); + + void __hyp_text __sysreg32_save_state(struct kvm_vcpu *vcpu) + { +diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c +index e37c78bbe1ca..18b9a522a2b3 100644 +--- a/arch/arm64/kvm/reset.c ++++ b/arch/arm64/kvm/reset.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -99,16 +100,33 @@ int kvm_arch_dev_ioctl_check_extension(struct kvm *kvm, long ext) + * This function finds the right table above and sets the registers on + * the virtual CPU struct to their architecturally defined reset + * values. ++ * ++ * Note: This function can be called from two paths: The KVM_ARM_VCPU_INIT ++ * ioctl or as part of handling a request issued by another VCPU in the PSCI ++ * handling code. In the first case, the VCPU will not be loaded, and in the ++ * second case the VCPU will be loaded. Because this function operates purely ++ * on the memory-backed valus of system registers, we want to do a full put if ++ * we were loaded (handling a request) and load the values back at the end of ++ * the function. Otherwise we leave the state alone. In both cases, we ++ * disable preemption around the vcpu reset as we would otherwise race with ++ * preempt notifiers which also call put/load. + */ + int kvm_reset_vcpu(struct kvm_vcpu *vcpu) + { + const struct kvm_regs *cpu_reset; ++ int ret = -EINVAL; ++ bool loaded; ++ ++ preempt_disable(); ++ loaded = (vcpu->cpu != -1); ++ if (loaded) ++ kvm_arch_vcpu_put(vcpu); + + switch (vcpu->arch.target) { + default: + if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features)) { + if (!cpu_has_32bit_el1()) +- return -EINVAL; ++ goto out; + cpu_reset = &default_regs_reset32; + } else { + cpu_reset = &default_regs_reset; +@@ -123,6 +141,29 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu) + /* Reset system registers */ + kvm_reset_sys_regs(vcpu); + ++ /* ++ * Additional reset state handling that PSCI may have imposed on us. ++ * Must be done after all the sys_reg reset. ++ */ ++ if (vcpu->arch.reset_state.reset) { ++ unsigned long target_pc = vcpu->arch.reset_state.pc; ++ ++ /* Gracefully handle Thumb2 entry point */ ++ if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) { ++ target_pc &= ~1UL; ++ vcpu_set_thumb(vcpu); ++ } ++ ++ /* Propagate caller endianness */ ++ if (vcpu->arch.reset_state.be) ++ kvm_vcpu_set_be(vcpu); ++ ++ *vcpu_pc(vcpu) = target_pc; ++ vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0); ++ ++ vcpu->arch.reset_state.reset = false; ++ } ++ + /* Reset PMU */ + kvm_pmu_vcpu_reset(vcpu); + +@@ -131,5 +172,10 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu) + vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG; + + /* Reset timer */ +- return kvm_timer_vcpu_reset(vcpu); ++ ret = kvm_timer_vcpu_reset(vcpu); ++out: ++ if (loaded) ++ kvm_arch_vcpu_load(vcpu, smp_processor_id()); ++ preempt_enable(); ++ return ret; + } +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index 22fbbdbece3c..d112af75680b 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -1456,7 +1456,7 @@ static const struct sys_reg_desc sys_reg_descs[] = { + + { SYS_DESC(SYS_DACR32_EL2), NULL, reset_unknown, DACR32_EL2 }, + { SYS_DESC(SYS_IFSR32_EL2), NULL, reset_unknown, IFSR32_EL2 }, +- { SYS_DESC(SYS_FPEXC32_EL2), NULL, reset_val, FPEXC32_EL2, 0x70 }, ++ { SYS_DESC(SYS_FPEXC32_EL2), NULL, reset_val, FPEXC32_EL2, 0x700 }, + }; + + static bool trap_dbgidr(struct kvm_vcpu *vcpu, +@@ -2586,7 +2586,9 @@ void kvm_reset_sys_regs(struct kvm_vcpu *vcpu) + table = get_target_table(vcpu->arch.target, true, &num); + reset_sys_reg_descs(vcpu, table, num); + +- for (num = 1; num < NR_SYS_REGS; num++) +- if (__vcpu_sys_reg(vcpu, num) == 0x4242424242424242) +- panic("Didn't reset __vcpu_sys_reg(%zi)", num); ++ for (num = 1; num < NR_SYS_REGS; num++) { ++ if (WARN(__vcpu_sys_reg(vcpu, num) == 0x4242424242424242, ++ "Didn't reset __vcpu_sys_reg(%zi)\n", num)) ++ break; ++ } + } +diff --git a/arch/m68k/Makefile b/arch/m68k/Makefile +index 997c9f20ea0f..4474e51ee53e 100644 +--- a/arch/m68k/Makefile ++++ b/arch/m68k/Makefile +@@ -58,7 +58,10 @@ cpuflags-$(CONFIG_M5206e) := $(call cc-option,-mcpu=5206e,-m5200) + cpuflags-$(CONFIG_M5206) := $(call cc-option,-mcpu=5206,-m5200) + + KBUILD_AFLAGS += $(cpuflags-y) +-KBUILD_CFLAGS += $(cpuflags-y) -pipe ++KBUILD_CFLAGS += $(cpuflags-y) ++ ++KBUILD_CFLAGS += -pipe -ffreestanding ++ + ifdef CONFIG_MMU + # without -fno-strength-reduce the 53c7xx.c driver fails ;-( + KBUILD_CFLAGS += -fno-strength-reduce -ffixed-a2 +diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h +index 2c1c53d12179..f567ace7a9e9 100644 +--- a/arch/mips/include/asm/kvm_host.h ++++ b/arch/mips/include/asm/kvm_host.h +@@ -1131,7 +1131,7 @@ static inline void kvm_arch_hardware_unsetup(void) {} + static inline void kvm_arch_sync_events(struct kvm *kvm) {} + static inline void kvm_arch_free_memslot(struct kvm *kvm, + struct kvm_memory_slot *free, struct kvm_memory_slot *dont) {} +-static inline void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) {} ++static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {} + static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {} + static inline void kvm_arch_vcpu_blocking(struct kvm_vcpu *vcpu) {} + static inline void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu) {} +diff --git a/arch/powerpc/include/asm/book3s/64/hugetlb.h b/arch/powerpc/include/asm/book3s/64/hugetlb.h +index 50888388a359..02544939ef0b 100644 +--- a/arch/powerpc/include/asm/book3s/64/hugetlb.h ++++ b/arch/powerpc/include/asm/book3s/64/hugetlb.h +@@ -35,6 +35,14 @@ static inline int hstate_get_psize(struct hstate *hstate) + #ifdef CONFIG_ARCH_HAS_GIGANTIC_PAGE + static inline bool gigantic_page_supported(void) + { ++ /* ++ * We used gigantic page reservation with hypervisor assist in some case. ++ * We cannot use runtime allocation of gigantic pages in those platforms ++ * This is hash translation mode LPARs. ++ */ ++ if (firmware_has_feature(FW_FEATURE_LPAR) && !radix_enabled()) ++ return false; ++ + return true; + } + #endif +diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h +index 906bcbdfd2a1..bccc5051249e 100644 +--- a/arch/powerpc/include/asm/kvm_host.h ++++ b/arch/powerpc/include/asm/kvm_host.h +@@ -822,7 +822,7 @@ struct kvm_vcpu_arch { + static inline void kvm_arch_hardware_disable(void) {} + static inline void kvm_arch_hardware_unsetup(void) {} + static inline void kvm_arch_sync_events(struct kvm *kvm) {} +-static inline void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) {} ++static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {} + static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {} + static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {} + static inline void kvm_arch_exit(void) {} +diff --git a/arch/powerpc/include/asm/powernv.h b/arch/powerpc/include/asm/powernv.h +index 2f3ff7a27881..d85fcfea32ca 100644 +--- a/arch/powerpc/include/asm/powernv.h ++++ b/arch/powerpc/include/asm/powernv.h +@@ -23,6 +23,8 @@ extern int pnv_npu2_handle_fault(struct npu_context *context, uintptr_t *ea, + unsigned long *flags, unsigned long *status, + int count); + ++void pnv_program_cpu_hotplug_lpcr(unsigned int cpu, u64 lpcr_val); ++ + void pnv_tm_init(void); + #else + static inline void powernv_set_nmmu_ptcr(unsigned long ptcr) { } +diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S +index e58c3f467db5..26b3f853cbf6 100644 +--- a/arch/powerpc/kernel/entry_32.S ++++ b/arch/powerpc/kernel/entry_32.S +@@ -745,6 +745,9 @@ fast_exception_return: + mtcr r10 + lwz r10,_LINK(r11) + mtlr r10 ++ /* Clear the exception_marker on the stack to avoid confusing stacktrace */ ++ li r10, 0 ++ stw r10, 8(r11) + REST_GPR(10, r11) + #if defined(CONFIG_PPC_8xx) && defined(CONFIG_PERF_EVENTS) + mtspr SPRN_NRI, r0 +@@ -982,6 +985,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX) + mtcrf 0xFF,r10 + mtlr r11 + ++ /* Clear the exception_marker on the stack to avoid confusing stacktrace */ ++ li r10, 0 ++ stw r10, 8(r1) + /* + * Once we put values in SRR0 and SRR1, we are in a state + * where exceptions are not recoverable, since taking an +@@ -1021,6 +1027,9 @@ exc_exit_restart_end: + mtlr r11 + lwz r10,_CCR(r1) + mtcrf 0xff,r10 ++ /* Clear the exception_marker on the stack to avoid confusing stacktrace */ ++ li r10, 0 ++ stw r10, 8(r1) + REST_2GPRS(9, r1) + .globl exc_exit_restart + exc_exit_restart: +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index bb6ac471a784..d29f2dca725b 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -180,7 +180,7 @@ static void __giveup_fpu(struct task_struct *tsk) + + save_fpu(tsk); + msr = tsk->thread.regs->msr; +- msr &= ~MSR_FP; ++ msr &= ~(MSR_FP|MSR_FE0|MSR_FE1); + #ifdef CONFIG_VSX + if (cpu_has_feature(CPU_FTR_VSX)) + msr &= ~MSR_VSX; +diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c +index 9667666eb18e..e08b32ccf1d9 100644 +--- a/arch/powerpc/kernel/ptrace.c ++++ b/arch/powerpc/kernel/ptrace.c +@@ -561,6 +561,7 @@ static int vr_get(struct task_struct *target, const struct user_regset *regset, + /* + * Copy out only the low-order word of vrsave. + */ ++ int start, end; + union { + elf_vrreg_t reg; + u32 word; +@@ -569,8 +570,10 @@ static int vr_get(struct task_struct *target, const struct user_regset *regset, + + vrsave.word = target->thread.vrsave; + ++ start = 33 * sizeof(vector128); ++ end = start + sizeof(vrsave); + ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &vrsave, +- 33 * sizeof(vector128), -1); ++ start, end); + } + + return ret; +@@ -608,6 +611,7 @@ static int vr_set(struct task_struct *target, const struct user_regset *regset, + /* + * We use only the first word of vrsave. + */ ++ int start, end; + union { + elf_vrreg_t reg; + u32 word; +@@ -616,8 +620,10 @@ static int vr_set(struct task_struct *target, const struct user_regset *regset, + + vrsave.word = target->thread.vrsave; + ++ start = 33 * sizeof(vector128); ++ end = start + sizeof(vrsave); + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &vrsave, +- 33 * sizeof(vector128), -1); ++ start, end); + if (!ret) + target->thread.vrsave = vrsave.word; + } +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index 8689a02b7df8..02fe6d020174 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -767,15 +767,15 @@ void machine_check_exception(struct pt_regs *regs) + if (check_io_access(regs)) + goto bail; + +- /* Must die if the interrupt is not recoverable */ +- if (!(regs->msr & MSR_RI)) +- nmi_panic(regs, "Unrecoverable Machine check"); +- + if (!nested) + nmi_exit(); + + die("Machine check", regs, SIGBUS); + ++ /* Must die if the interrupt is not recoverable */ ++ if (!(regs->msr & MSR_RI)) ++ nmi_panic(regs, "Unrecoverable Machine check"); ++ + return; + + bail: +@@ -1545,8 +1545,8 @@ bail: + + void StackOverflow(struct pt_regs *regs) + { +- printk(KERN_CRIT "Kernel stack overflow in process %p, r1=%lx\n", +- current, regs->gpr[1]); ++ pr_crit("Kernel stack overflow in process %s[%d], r1=%lx\n", ++ current->comm, task_pid_nr(current), regs->gpr[1]); + debugger(regs); + show_regs(regs); + panic("kernel stack overflow"); +diff --git a/arch/powerpc/platforms/83xx/suspend-asm.S b/arch/powerpc/platforms/83xx/suspend-asm.S +index 3d1ecd211776..8137f77abad5 100644 +--- a/arch/powerpc/platforms/83xx/suspend-asm.S ++++ b/arch/powerpc/platforms/83xx/suspend-asm.S +@@ -26,13 +26,13 @@ + #define SS_MSR 0x74 + #define SS_SDR1 0x78 + #define SS_LR 0x7c +-#define SS_SPRG 0x80 /* 4 SPRGs */ +-#define SS_DBAT 0x90 /* 8 DBATs */ +-#define SS_IBAT 0xd0 /* 8 IBATs */ +-#define SS_TB 0x110 +-#define SS_CR 0x118 +-#define SS_GPREG 0x11c /* r12-r31 */ +-#define STATE_SAVE_SIZE 0x16c ++#define SS_SPRG 0x80 /* 8 SPRGs */ ++#define SS_DBAT 0xa0 /* 8 DBATs */ ++#define SS_IBAT 0xe0 /* 8 IBATs */ ++#define SS_TB 0x120 ++#define SS_CR 0x128 ++#define SS_GPREG 0x12c /* r12-r31 */ ++#define STATE_SAVE_SIZE 0x17c + + .section .data + .align 5 +@@ -103,6 +103,16 @@ _GLOBAL(mpc83xx_enter_deep_sleep) + stw r7, SS_SPRG+12(r3) + stw r8, SS_SDR1(r3) + ++ mfspr r4, SPRN_SPRG4 ++ mfspr r5, SPRN_SPRG5 ++ mfspr r6, SPRN_SPRG6 ++ mfspr r7, SPRN_SPRG7 ++ ++ stw r4, SS_SPRG+16(r3) ++ stw r5, SS_SPRG+20(r3) ++ stw r6, SS_SPRG+24(r3) ++ stw r7, SS_SPRG+28(r3) ++ + mfspr r4, SPRN_DBAT0U + mfspr r5, SPRN_DBAT0L + mfspr r6, SPRN_DBAT1U +@@ -493,6 +503,16 @@ mpc83xx_deep_resume: + mtspr SPRN_IBAT7U, r6 + mtspr SPRN_IBAT7L, r7 + ++ lwz r4, SS_SPRG+16(r3) ++ lwz r5, SS_SPRG+20(r3) ++ lwz r6, SS_SPRG+24(r3) ++ lwz r7, SS_SPRG+28(r3) ++ ++ mtspr SPRN_SPRG4, r4 ++ mtspr SPRN_SPRG5, r5 ++ mtspr SPRN_SPRG6, r6 ++ mtspr SPRN_SPRG7, r7 ++ + lwz r4, SS_SPRG+0(r3) + lwz r5, SS_SPRG+4(r3) + lwz r6, SS_SPRG+8(r3) +diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c +index 403523c061ba..343bffd20fca 100644 +--- a/arch/powerpc/platforms/embedded6xx/wii.c ++++ b/arch/powerpc/platforms/embedded6xx/wii.c +@@ -83,6 +83,10 @@ unsigned long __init wii_mmu_mapin_mem2(unsigned long top) + /* MEM2 64MB@0x10000000 */ + delta = wii_hole_start + wii_hole_size; + size = top - delta; ++ ++ if (__map_without_bats) ++ return delta; ++ + for (bl = 128<<10; bl < max_size; bl <<= 1) { + if (bl * 2 > size) + break; +diff --git a/arch/powerpc/platforms/powernv/idle.c b/arch/powerpc/platforms/powernv/idle.c +index 35f699ebb662..e52f9b06dd9c 100644 +--- a/arch/powerpc/platforms/powernv/idle.c ++++ b/arch/powerpc/platforms/powernv/idle.c +@@ -458,7 +458,8 @@ EXPORT_SYMBOL_GPL(pnv_power9_force_smt4_release); + #endif /* CONFIG_KVM_BOOK3S_HV_POSSIBLE */ + + #ifdef CONFIG_HOTPLUG_CPU +-static void pnv_program_cpu_hotplug_lpcr(unsigned int cpu, u64 lpcr_val) ++ ++void pnv_program_cpu_hotplug_lpcr(unsigned int cpu, u64 lpcr_val) + { + u64 pir = get_hard_smp_processor_id(cpu); + +@@ -481,20 +482,6 @@ unsigned long pnv_cpu_offline(unsigned int cpu) + { + unsigned long srr1; + u32 idle_states = pnv_get_supported_cpuidle_states(); +- u64 lpcr_val; +- +- /* +- * We don't want to take decrementer interrupts while we are +- * offline, so clear LPCR:PECE1. We keep PECE2 (and +- * LPCR_PECE_HVEE on P9) enabled as to let IPIs in. +- * +- * If the CPU gets woken up by a special wakeup, ensure that +- * the SLW engine sets LPCR with decrementer bit cleared, else +- * the CPU will come back to the kernel due to a spurious +- * wakeup. +- */ +- lpcr_val = mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1; +- pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val); + + __ppc64_runlatch_off(); + +@@ -526,16 +513,6 @@ unsigned long pnv_cpu_offline(unsigned int cpu) + + __ppc64_runlatch_on(); + +- /* +- * Re-enable decrementer interrupts in LPCR. +- * +- * Further, we want stop states to be woken up by decrementer +- * for non-hotplug cases. So program the LPCR via stop api as +- * well. +- */ +- lpcr_val = mfspr(SPRN_LPCR) | (u64)LPCR_PECE1; +- pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val); +- + return srr1; + } + #endif +diff --git a/arch/powerpc/platforms/powernv/opal-msglog.c b/arch/powerpc/platforms/powernv/opal-msglog.c +index acd3206dfae3..06628c71cef6 100644 +--- a/arch/powerpc/platforms/powernv/opal-msglog.c ++++ b/arch/powerpc/platforms/powernv/opal-msglog.c +@@ -98,7 +98,7 @@ static ssize_t opal_msglog_read(struct file *file, struct kobject *kobj, + } + + static struct bin_attribute opal_msglog_attr = { +- .attr = {.name = "msglog", .mode = 0444}, ++ .attr = {.name = "msglog", .mode = 0400}, + .read = opal_msglog_read + }; + +diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c +index 0d354e19ef92..db09c7022635 100644 +--- a/arch/powerpc/platforms/powernv/smp.c ++++ b/arch/powerpc/platforms/powernv/smp.c +@@ -39,6 +39,7 @@ + #include + #include + #include ++#include + + #include "powernv.h" + +@@ -153,6 +154,7 @@ static void pnv_smp_cpu_kill_self(void) + { + unsigned int cpu; + unsigned long srr1, wmask; ++ u64 lpcr_val; + + /* Standard hot unplug procedure */ + /* +@@ -174,6 +176,19 @@ static void pnv_smp_cpu_kill_self(void) + if (cpu_has_feature(CPU_FTR_ARCH_207S)) + wmask = SRR1_WAKEMASK_P8; + ++ /* ++ * We don't want to take decrementer interrupts while we are ++ * offline, so clear LPCR:PECE1. We keep PECE2 (and ++ * LPCR_PECE_HVEE on P9) enabled so as to let IPIs in. ++ * ++ * If the CPU gets woken up by a special wakeup, ensure that ++ * the SLW engine sets LPCR with decrementer bit cleared, else ++ * the CPU will come back to the kernel due to a spurious ++ * wakeup. ++ */ ++ lpcr_val = mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1; ++ pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val); ++ + while (!generic_check_cpu_restart(cpu)) { + /* + * Clear IPI flag, since we don't handle IPIs while +@@ -246,6 +261,16 @@ static void pnv_smp_cpu_kill_self(void) + + } + ++ /* ++ * Re-enable decrementer interrupts in LPCR. ++ * ++ * Further, we want stop states to be woken up by decrementer ++ * for non-hotplug cases. So program the LPCR via stop api as ++ * well. ++ */ ++ lpcr_val = mfspr(SPRN_LPCR) | (u64)LPCR_PECE1; ++ pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val); ++ + DBG("CPU%d coming online...\n", cpu); + } + +diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h +index 29c940bf8506..dad110e9f41b 100644 +--- a/arch/s390/include/asm/kvm_host.h ++++ b/arch/s390/include/asm/kvm_host.h +@@ -865,7 +865,7 @@ static inline void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu) {} + static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {} + static inline void kvm_arch_free_memslot(struct kvm *kvm, + struct kvm_memory_slot *free, struct kvm_memory_slot *dont) {} +-static inline void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) {} ++static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {} + static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {} + static inline void kvm_arch_flush_shadow_memslot(struct kvm *kvm, + struct kvm_memory_slot *slot) {} +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index a0097f8bada8..5f85e0dfa66d 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -303,7 +303,7 @@ early_param("vmalloc", parse_vmalloc); + + void *restart_stack __section(.data); + +-static void __init setup_lowcore(void) ++static void __init setup_lowcore_dat_off(void) + { + struct lowcore *lc; + +@@ -314,19 +314,16 @@ static void __init setup_lowcore(void) + lc = memblock_virt_alloc_low(sizeof(*lc), sizeof(*lc)); + lc->restart_psw.mask = PSW_KERNEL_BITS; + lc->restart_psw.addr = (unsigned long) restart_int_handler; +- lc->external_new_psw.mask = PSW_KERNEL_BITS | +- PSW_MASK_DAT | PSW_MASK_MCHECK; ++ lc->external_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_MCHECK; + lc->external_new_psw.addr = (unsigned long) ext_int_handler; + lc->svc_new_psw.mask = PSW_KERNEL_BITS | +- PSW_MASK_DAT | PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK; ++ PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK; + lc->svc_new_psw.addr = (unsigned long) system_call; +- lc->program_new_psw.mask = PSW_KERNEL_BITS | +- PSW_MASK_DAT | PSW_MASK_MCHECK; ++ lc->program_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_MCHECK; + lc->program_new_psw.addr = (unsigned long) pgm_check_handler; + lc->mcck_new_psw.mask = PSW_KERNEL_BITS; + lc->mcck_new_psw.addr = (unsigned long) mcck_int_handler; +- lc->io_new_psw.mask = PSW_KERNEL_BITS | +- PSW_MASK_DAT | PSW_MASK_MCHECK; ++ lc->io_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_MCHECK; + lc->io_new_psw.addr = (unsigned long) io_int_handler; + lc->clock_comparator = clock_comparator_max; + lc->kernel_stack = ((unsigned long) &init_thread_union) +@@ -388,6 +385,16 @@ static void __init setup_lowcore(void) + lowcore_ptr[0] = lc; + } + ++static void __init setup_lowcore_dat_on(void) ++{ ++ __ctl_clear_bit(0, 28); ++ S390_lowcore.external_new_psw.mask |= PSW_MASK_DAT; ++ S390_lowcore.svc_new_psw.mask |= PSW_MASK_DAT; ++ S390_lowcore.program_new_psw.mask |= PSW_MASK_DAT; ++ S390_lowcore.io_new_psw.mask |= PSW_MASK_DAT; ++ __ctl_set_bit(0, 28); ++} ++ + static struct resource code_resource = { + .name = "Kernel code", + .flags = IORESOURCE_BUSY | IORESOURCE_SYSTEM_RAM, +@@ -946,7 +953,7 @@ void __init setup_arch(char **cmdline_p) + #endif + + setup_resources(); +- setup_lowcore(); ++ setup_lowcore_dat_off(); + smp_fill_possible_mask(); + cpu_detect_mhz_feature(); + cpu_init(); +@@ -959,6 +966,12 @@ void __init setup_arch(char **cmdline_p) + */ + paging_init(); + ++ /* ++ * After paging_init created the kernel page table, the new PSWs ++ * in lowcore can now run with DAT enabled. ++ */ ++ setup_lowcore_dat_on(); ++ + /* Setup default console */ + conmode_default(); + set_preferred_console(); +diff --git a/arch/x86/crypto/aegis128-aesni-glue.c b/arch/x86/crypto/aegis128-aesni-glue.c +index 2a356b948720..3ea71b871813 100644 +--- a/arch/x86/crypto/aegis128-aesni-glue.c ++++ b/arch/x86/crypto/aegis128-aesni-glue.c +@@ -119,31 +119,20 @@ static void crypto_aegis128_aesni_process_ad( + } + + static void crypto_aegis128_aesni_process_crypt( +- struct aegis_state *state, struct aead_request *req, ++ struct aegis_state *state, struct skcipher_walk *walk, + const struct aegis_crypt_ops *ops) + { +- struct skcipher_walk walk; +- u8 *src, *dst; +- unsigned int chunksize, base; +- +- ops->skcipher_walk_init(&walk, req, false); +- +- while (walk.nbytes) { +- src = walk.src.virt.addr; +- dst = walk.dst.virt.addr; +- chunksize = walk.nbytes; +- +- ops->crypt_blocks(state, chunksize, src, dst); +- +- base = chunksize & ~(AEGIS128_BLOCK_SIZE - 1); +- src += base; +- dst += base; +- chunksize &= AEGIS128_BLOCK_SIZE - 1; +- +- if (chunksize > 0) +- ops->crypt_tail(state, chunksize, src, dst); ++ while (walk->nbytes >= AEGIS128_BLOCK_SIZE) { ++ ops->crypt_blocks(state, ++ round_down(walk->nbytes, AEGIS128_BLOCK_SIZE), ++ walk->src.virt.addr, walk->dst.virt.addr); ++ skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE); ++ } + +- skcipher_walk_done(&walk, 0); ++ if (walk->nbytes) { ++ ops->crypt_tail(state, walk->nbytes, walk->src.virt.addr, ++ walk->dst.virt.addr); ++ skcipher_walk_done(walk, 0); + } + } + +@@ -186,13 +175,16 @@ static void crypto_aegis128_aesni_crypt(struct aead_request *req, + { + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct aegis_ctx *ctx = crypto_aegis128_aesni_ctx(tfm); ++ struct skcipher_walk walk; + struct aegis_state state; + ++ ops->skcipher_walk_init(&walk, req, true); ++ + kernel_fpu_begin(); + + crypto_aegis128_aesni_init(&state, ctx->key.bytes, req->iv); + crypto_aegis128_aesni_process_ad(&state, req->src, req->assoclen); +- crypto_aegis128_aesni_process_crypt(&state, req, ops); ++ crypto_aegis128_aesni_process_crypt(&state, &walk, ops); + crypto_aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen); + + kernel_fpu_end(); +diff --git a/arch/x86/crypto/aegis128l-aesni-glue.c b/arch/x86/crypto/aegis128l-aesni-glue.c +index dbe8bb980da1..1b1b39c66c5e 100644 +--- a/arch/x86/crypto/aegis128l-aesni-glue.c ++++ b/arch/x86/crypto/aegis128l-aesni-glue.c +@@ -119,31 +119,20 @@ static void crypto_aegis128l_aesni_process_ad( + } + + static void crypto_aegis128l_aesni_process_crypt( +- struct aegis_state *state, struct aead_request *req, ++ struct aegis_state *state, struct skcipher_walk *walk, + const struct aegis_crypt_ops *ops) + { +- struct skcipher_walk walk; +- u8 *src, *dst; +- unsigned int chunksize, base; +- +- ops->skcipher_walk_init(&walk, req, false); +- +- while (walk.nbytes) { +- src = walk.src.virt.addr; +- dst = walk.dst.virt.addr; +- chunksize = walk.nbytes; +- +- ops->crypt_blocks(state, chunksize, src, dst); +- +- base = chunksize & ~(AEGIS128L_BLOCK_SIZE - 1); +- src += base; +- dst += base; +- chunksize &= AEGIS128L_BLOCK_SIZE - 1; +- +- if (chunksize > 0) +- ops->crypt_tail(state, chunksize, src, dst); ++ while (walk->nbytes >= AEGIS128L_BLOCK_SIZE) { ++ ops->crypt_blocks(state, round_down(walk->nbytes, ++ AEGIS128L_BLOCK_SIZE), ++ walk->src.virt.addr, walk->dst.virt.addr); ++ skcipher_walk_done(walk, walk->nbytes % AEGIS128L_BLOCK_SIZE); ++ } + +- skcipher_walk_done(&walk, 0); ++ if (walk->nbytes) { ++ ops->crypt_tail(state, walk->nbytes, walk->src.virt.addr, ++ walk->dst.virt.addr); ++ skcipher_walk_done(walk, 0); + } + } + +@@ -186,13 +175,16 @@ static void crypto_aegis128l_aesni_crypt(struct aead_request *req, + { + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct aegis_ctx *ctx = crypto_aegis128l_aesni_ctx(tfm); ++ struct skcipher_walk walk; + struct aegis_state state; + ++ ops->skcipher_walk_init(&walk, req, true); ++ + kernel_fpu_begin(); + + crypto_aegis128l_aesni_init(&state, ctx->key.bytes, req->iv); + crypto_aegis128l_aesni_process_ad(&state, req->src, req->assoclen); +- crypto_aegis128l_aesni_process_crypt(&state, req, ops); ++ crypto_aegis128l_aesni_process_crypt(&state, &walk, ops); + crypto_aegis128l_aesni_final(&state, tag_xor, req->assoclen, cryptlen); + + kernel_fpu_end(); +diff --git a/arch/x86/crypto/aegis256-aesni-glue.c b/arch/x86/crypto/aegis256-aesni-glue.c +index 8bebda2de92f..6227ca3220a0 100644 +--- a/arch/x86/crypto/aegis256-aesni-glue.c ++++ b/arch/x86/crypto/aegis256-aesni-glue.c +@@ -119,31 +119,20 @@ static void crypto_aegis256_aesni_process_ad( + } + + static void crypto_aegis256_aesni_process_crypt( +- struct aegis_state *state, struct aead_request *req, ++ struct aegis_state *state, struct skcipher_walk *walk, + const struct aegis_crypt_ops *ops) + { +- struct skcipher_walk walk; +- u8 *src, *dst; +- unsigned int chunksize, base; +- +- ops->skcipher_walk_init(&walk, req, false); +- +- while (walk.nbytes) { +- src = walk.src.virt.addr; +- dst = walk.dst.virt.addr; +- chunksize = walk.nbytes; +- +- ops->crypt_blocks(state, chunksize, src, dst); +- +- base = chunksize & ~(AEGIS256_BLOCK_SIZE - 1); +- src += base; +- dst += base; +- chunksize &= AEGIS256_BLOCK_SIZE - 1; +- +- if (chunksize > 0) +- ops->crypt_tail(state, chunksize, src, dst); ++ while (walk->nbytes >= AEGIS256_BLOCK_SIZE) { ++ ops->crypt_blocks(state, ++ round_down(walk->nbytes, AEGIS256_BLOCK_SIZE), ++ walk->src.virt.addr, walk->dst.virt.addr); ++ skcipher_walk_done(walk, walk->nbytes % AEGIS256_BLOCK_SIZE); ++ } + +- skcipher_walk_done(&walk, 0); ++ if (walk->nbytes) { ++ ops->crypt_tail(state, walk->nbytes, walk->src.virt.addr, ++ walk->dst.virt.addr); ++ skcipher_walk_done(walk, 0); + } + } + +@@ -186,13 +175,16 @@ static void crypto_aegis256_aesni_crypt(struct aead_request *req, + { + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct aegis_ctx *ctx = crypto_aegis256_aesni_ctx(tfm); ++ struct skcipher_walk walk; + struct aegis_state state; + ++ ops->skcipher_walk_init(&walk, req, true); ++ + kernel_fpu_begin(); + + crypto_aegis256_aesni_init(&state, ctx->key, req->iv); + crypto_aegis256_aesni_process_ad(&state, req->src, req->assoclen); +- crypto_aegis256_aesni_process_crypt(&state, req, ops); ++ crypto_aegis256_aesni_process_crypt(&state, &walk, ops); + crypto_aegis256_aesni_final(&state, tag_xor, req->assoclen, cryptlen); + + kernel_fpu_end(); +diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c +index e4b78f962874..917f25e4d0a8 100644 +--- a/arch/x86/crypto/aesni-intel_glue.c ++++ b/arch/x86/crypto/aesni-intel_glue.c +@@ -830,11 +830,14 @@ static int gcmaes_crypt_by_sg(bool enc, struct aead_request *req, + scatterwalk_map_and_copy(assoc, req->src, 0, assoclen, 0); + } + +- src_sg = scatterwalk_ffwd(src_start, req->src, req->assoclen); +- scatterwalk_start(&src_sg_walk, src_sg); +- if (req->src != req->dst) { +- dst_sg = scatterwalk_ffwd(dst_start, req->dst, req->assoclen); +- scatterwalk_start(&dst_sg_walk, dst_sg); ++ if (left) { ++ src_sg = scatterwalk_ffwd(src_start, req->src, req->assoclen); ++ scatterwalk_start(&src_sg_walk, src_sg); ++ if (req->src != req->dst) { ++ dst_sg = scatterwalk_ffwd(dst_start, req->dst, ++ req->assoclen); ++ scatterwalk_start(&dst_sg_walk, dst_sg); ++ } + } + + kernel_fpu_begin(); +diff --git a/arch/x86/crypto/morus1280_glue.c b/arch/x86/crypto/morus1280_glue.c +index 0dccdda1eb3a..7e600f8bcdad 100644 +--- a/arch/x86/crypto/morus1280_glue.c ++++ b/arch/x86/crypto/morus1280_glue.c +@@ -85,31 +85,20 @@ static void crypto_morus1280_glue_process_ad( + + static void crypto_morus1280_glue_process_crypt(struct morus1280_state *state, + struct morus1280_ops ops, +- struct aead_request *req) ++ struct skcipher_walk *walk) + { +- struct skcipher_walk walk; +- u8 *cursor_src, *cursor_dst; +- unsigned int chunksize, base; +- +- ops.skcipher_walk_init(&walk, req, false); +- +- while (walk.nbytes) { +- cursor_src = walk.src.virt.addr; +- cursor_dst = walk.dst.virt.addr; +- chunksize = walk.nbytes; +- +- ops.crypt_blocks(state, cursor_src, cursor_dst, chunksize); +- +- base = chunksize & ~(MORUS1280_BLOCK_SIZE - 1); +- cursor_src += base; +- cursor_dst += base; +- chunksize &= MORUS1280_BLOCK_SIZE - 1; +- +- if (chunksize > 0) +- ops.crypt_tail(state, cursor_src, cursor_dst, +- chunksize); ++ while (walk->nbytes >= MORUS1280_BLOCK_SIZE) { ++ ops.crypt_blocks(state, walk->src.virt.addr, ++ walk->dst.virt.addr, ++ round_down(walk->nbytes, ++ MORUS1280_BLOCK_SIZE)); ++ skcipher_walk_done(walk, walk->nbytes % MORUS1280_BLOCK_SIZE); ++ } + +- skcipher_walk_done(&walk, 0); ++ if (walk->nbytes) { ++ ops.crypt_tail(state, walk->src.virt.addr, walk->dst.virt.addr, ++ walk->nbytes); ++ skcipher_walk_done(walk, 0); + } + } + +@@ -147,12 +136,15 @@ static void crypto_morus1280_glue_crypt(struct aead_request *req, + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct morus1280_ctx *ctx = crypto_aead_ctx(tfm); + struct morus1280_state state; ++ struct skcipher_walk walk; ++ ++ ops.skcipher_walk_init(&walk, req, true); + + kernel_fpu_begin(); + + ctx->ops->init(&state, &ctx->key, req->iv); + crypto_morus1280_glue_process_ad(&state, ctx->ops, req->src, req->assoclen); +- crypto_morus1280_glue_process_crypt(&state, ops, req); ++ crypto_morus1280_glue_process_crypt(&state, ops, &walk); + ctx->ops->final(&state, tag_xor, req->assoclen, cryptlen); + + kernel_fpu_end(); +diff --git a/arch/x86/crypto/morus640_glue.c b/arch/x86/crypto/morus640_glue.c +index 7b58fe4d9bd1..cb3a81732016 100644 +--- a/arch/x86/crypto/morus640_glue.c ++++ b/arch/x86/crypto/morus640_glue.c +@@ -85,31 +85,19 @@ static void crypto_morus640_glue_process_ad( + + static void crypto_morus640_glue_process_crypt(struct morus640_state *state, + struct morus640_ops ops, +- struct aead_request *req) ++ struct skcipher_walk *walk) + { +- struct skcipher_walk walk; +- u8 *cursor_src, *cursor_dst; +- unsigned int chunksize, base; +- +- ops.skcipher_walk_init(&walk, req, false); +- +- while (walk.nbytes) { +- cursor_src = walk.src.virt.addr; +- cursor_dst = walk.dst.virt.addr; +- chunksize = walk.nbytes; +- +- ops.crypt_blocks(state, cursor_src, cursor_dst, chunksize); +- +- base = chunksize & ~(MORUS640_BLOCK_SIZE - 1); +- cursor_src += base; +- cursor_dst += base; +- chunksize &= MORUS640_BLOCK_SIZE - 1; +- +- if (chunksize > 0) +- ops.crypt_tail(state, cursor_src, cursor_dst, +- chunksize); ++ while (walk->nbytes >= MORUS640_BLOCK_SIZE) { ++ ops.crypt_blocks(state, walk->src.virt.addr, ++ walk->dst.virt.addr, ++ round_down(walk->nbytes, MORUS640_BLOCK_SIZE)); ++ skcipher_walk_done(walk, walk->nbytes % MORUS640_BLOCK_SIZE); ++ } + +- skcipher_walk_done(&walk, 0); ++ if (walk->nbytes) { ++ ops.crypt_tail(state, walk->src.virt.addr, walk->dst.virt.addr, ++ walk->nbytes); ++ skcipher_walk_done(walk, 0); + } + } + +@@ -143,12 +131,15 @@ static void crypto_morus640_glue_crypt(struct aead_request *req, + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct morus640_ctx *ctx = crypto_aead_ctx(tfm); + struct morus640_state state; ++ struct skcipher_walk walk; ++ ++ ops.skcipher_walk_init(&walk, req, true); + + kernel_fpu_begin(); + + ctx->ops->init(&state, &ctx->key, req->iv); + crypto_morus640_glue_process_ad(&state, ctx->ops, req->src, req->assoclen); +- crypto_morus640_glue_process_crypt(&state, ops, req); ++ crypto_morus640_glue_process_crypt(&state, ops, &walk); + ctx->ops->final(&state, tag_xor, req->assoclen, cryptlen); + + kernel_fpu_end(); +diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c +index 27a461414b30..2690135bf83f 100644 +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -740,6 +740,7 @@ static int uncore_pmu_event_init(struct perf_event *event) + /* fixed counters have event field hardcoded to zero */ + hwc->config = 0ULL; + } else if (is_freerunning_event(event)) { ++ hwc->config = event->attr.config; + if (!check_valid_freerunning_event(box, event)) + return -EINVAL; + event->hw.idx = UNCORE_PMC_IDX_FREERUNNING; +diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h +index e17ab885b1e9..cc6dd4f78158 100644 +--- a/arch/x86/events/intel/uncore.h ++++ b/arch/x86/events/intel/uncore.h +@@ -285,8 +285,8 @@ static inline + unsigned int uncore_freerunning_counter(struct intel_uncore_box *box, + struct perf_event *event) + { +- unsigned int type = uncore_freerunning_type(event->attr.config); +- unsigned int idx = uncore_freerunning_idx(event->attr.config); ++ unsigned int type = uncore_freerunning_type(event->hw.config); ++ unsigned int idx = uncore_freerunning_idx(event->hw.config); + struct intel_uncore_pmu *pmu = box->pmu; + + return pmu->type->freerunning[type].counter_base + +@@ -360,7 +360,7 @@ static inline + unsigned int uncore_freerunning_bits(struct intel_uncore_box *box, + struct perf_event *event) + { +- unsigned int type = uncore_freerunning_type(event->attr.config); ++ unsigned int type = uncore_freerunning_type(event->hw.config); + + return box->pmu->type->freerunning[type].bits; + } +@@ -368,7 +368,7 @@ unsigned int uncore_freerunning_bits(struct intel_uncore_box *box, + static inline int uncore_num_freerunning(struct intel_uncore_box *box, + struct perf_event *event) + { +- unsigned int type = uncore_freerunning_type(event->attr.config); ++ unsigned int type = uncore_freerunning_type(event->hw.config); + + return box->pmu->type->freerunning[type].num_counters; + } +@@ -382,8 +382,8 @@ static inline int uncore_num_freerunning_types(struct intel_uncore_box *box, + static inline bool check_valid_freerunning_event(struct intel_uncore_box *box, + struct perf_event *event) + { +- unsigned int type = uncore_freerunning_type(event->attr.config); +- unsigned int idx = uncore_freerunning_idx(event->attr.config); ++ unsigned int type = uncore_freerunning_type(event->hw.config); ++ unsigned int idx = uncore_freerunning_idx(event->hw.config); + + return (type < uncore_num_freerunning_types(box, event)) && + (idx < uncore_num_freerunning(box, event)); +diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c +index bfa25814fe5f..2d328386f83a 100644 +--- a/arch/x86/events/intel/uncore_snb.c ++++ b/arch/x86/events/intel/uncore_snb.c +@@ -444,9 +444,11 @@ static int snb_uncore_imc_event_init(struct perf_event *event) + + /* must be done before validate_group */ + event->hw.event_base = base; +- event->hw.config = cfg; + event->hw.idx = idx; + ++ /* Convert to standard encoding format for freerunning counters */ ++ event->hw.config = ((cfg - 1) << 8) | 0x10ff; ++ + /* no group validation needed, we have free running counters */ + + return 0; +diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h +index 7ed08a7c3398..0ad25cc895ae 100644 +--- a/arch/x86/include/asm/intel-family.h ++++ b/arch/x86/include/asm/intel-family.h +@@ -55,6 +55,8 @@ + + #define INTEL_FAM6_CANNONLAKE_MOBILE 0x66 + ++#define INTEL_FAM6_ICELAKE_MOBILE 0x7E ++ + /* "Small Core" Processors (Atom) */ + + #define INTEL_FAM6_ATOM_PINEVIEW 0x1C +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 728dc661ebb6..46f0b621bd37 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -1194,7 +1194,7 @@ void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm, + struct kvm_memory_slot *slot, + gfn_t gfn_offset, unsigned long mask); + void kvm_mmu_zap_all(struct kvm *kvm); +-void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, struct kvm_memslots *slots); ++void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen); + unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm); + void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages); + +diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c +index 6adf6e6c2933..544bd41a514c 100644 +--- a/arch/x86/kernel/kprobes/opt.c ++++ b/arch/x86/kernel/kprobes/opt.c +@@ -141,6 +141,11 @@ asm ( + + void optprobe_template_func(void); + STACK_FRAME_NON_STANDARD(optprobe_template_func); ++NOKPROBE_SYMBOL(optprobe_template_func); ++NOKPROBE_SYMBOL(optprobe_template_entry); ++NOKPROBE_SYMBOL(optprobe_template_val); ++NOKPROBE_SYMBOL(optprobe_template_call); ++NOKPROBE_SYMBOL(optprobe_template_end); + + #define TMPL_MOVE_IDX \ + ((long)optprobe_template_val - (long)optprobe_template_entry) +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 1b82bc7c3cca..779ed52047d1 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -5774,13 +5774,30 @@ static bool kvm_has_zapped_obsolete_pages(struct kvm *kvm) + return unlikely(!list_empty_careful(&kvm->arch.zapped_obsolete_pages)); + } + +-void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, struct kvm_memslots *slots) ++void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen) + { ++ gen &= MMIO_GEN_MASK; ++ ++ /* ++ * Shift to eliminate the "update in-progress" flag, which isn't ++ * included in the spte's generation number. ++ */ ++ gen >>= 1; ++ ++ /* ++ * Generation numbers are incremented in multiples of the number of ++ * address spaces in order to provide unique generations across all ++ * address spaces. Strip what is effectively the address space ++ * modifier prior to checking for a wrap of the MMIO generation so ++ * that a wrap in any address space is detected. ++ */ ++ gen &= ~((u64)KVM_ADDRESS_SPACE_NUM - 1); ++ + /* +- * The very rare case: if the generation-number is round, ++ * The very rare case: if the MMIO generation number has wrapped, + * zap all shadow pages. + */ +- if (unlikely((slots->generation & MMIO_GEN_MASK) == 0)) { ++ if (unlikely(gen == 0)) { + kvm_debug_ratelimited("kvm: zapping shadow pages for mmio generation wraparound\n"); + kvm_mmu_invalidate_zap_all_pages(kvm); + } +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index f6da5c37d2e8..4029d3783e18 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -8184,25 +8184,50 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu, + /* Addr = segment_base + offset */ + /* offset = base + [index * scale] + displacement */ + off = exit_qualification; /* holds the displacement */ ++ if (addr_size == 1) ++ off = (gva_t)sign_extend64(off, 31); ++ else if (addr_size == 0) ++ off = (gva_t)sign_extend64(off, 15); + if (base_is_valid) + off += kvm_register_read(vcpu, base_reg); + if (index_is_valid) + off += kvm_register_read(vcpu, index_reg)< s.limit); ++ if (!(s.base == 0 && s.limit == 0xffffffff && ++ ((s.type & 8) || !(s.type & 4)))) ++ exn = exn || (off + sizeof(u64) > s.limit); + } + if (exn) { + kvm_queue_exception_e(vcpu, +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 3a7cf7c6b28a..6181ec19bed2 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -9108,13 +9108,13 @@ out_free: + return -ENOMEM; + } + +-void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) ++void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) + { + /* + * memslots->generation has been incremented. + * mmio generation may have reached its maximum value. + */ +- kvm_mmu_invalidate_mmio_sptes(kvm, slots); ++ kvm_mmu_invalidate_mmio_sptes(kvm, gen); + } + + int kvm_arch_prepare_memory_region(struct kvm *kvm, +diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h +index 67b9568613f3..1826ed9dd1c8 100644 +--- a/arch/x86/kvm/x86.h ++++ b/arch/x86/kvm/x86.h +@@ -181,6 +181,11 @@ static inline bool emul_is_noncanonical_address(u64 la, + static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu, + gva_t gva, gfn_t gfn, unsigned access) + { ++ u64 gen = kvm_memslots(vcpu->kvm)->generation; ++ ++ if (unlikely(gen & 1)) ++ return; ++ + /* + * If this is a shadow nested page table, the "GVA" is + * actually a nGPA. +@@ -188,7 +193,7 @@ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu, + vcpu->arch.mmio_gva = mmu_is_nested(vcpu) ? 0 : gva & PAGE_MASK; + vcpu->arch.access = access; + vcpu->arch.mmio_gfn = gfn; +- vcpu->arch.mmio_gen = kvm_memslots(vcpu->kvm)->generation; ++ vcpu->arch.mmio_gen = gen; + } + + static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c +index c8f011e07a15..73aa0b89a74a 100644 +--- a/arch/x86/xen/mmu_pv.c ++++ b/arch/x86/xen/mmu_pv.c +@@ -2106,10 +2106,10 @@ void __init xen_relocate_p2m(void) + pt = early_memremap(pt_phys, PAGE_SIZE); + clear_page(pt); + for (idx_pte = 0; +- idx_pte < min(n_pte, PTRS_PER_PTE); +- idx_pte++) { +- set_pte(pt + idx_pte, +- pfn_pte(p2m_pfn, PAGE_KERNEL)); ++ idx_pte < min(n_pte, PTRS_PER_PTE); ++ idx_pte++) { ++ pt[idx_pte] = pfn_pte(p2m_pfn, ++ PAGE_KERNEL); + p2m_pfn++; + } + n_pte -= PTRS_PER_PTE; +@@ -2117,8 +2117,7 @@ void __init xen_relocate_p2m(void) + make_lowmem_page_readonly(__va(pt_phys)); + pin_pagetable_pfn(MMUEXT_PIN_L1_TABLE, + PFN_DOWN(pt_phys)); +- set_pmd(pmd + idx_pt, +- __pmd(_PAGE_TABLE | pt_phys)); ++ pmd[idx_pt] = __pmd(_PAGE_TABLE | pt_phys); + pt_phys += PAGE_SIZE; + } + n_pt -= PTRS_PER_PMD; +@@ -2126,7 +2125,7 @@ void __init xen_relocate_p2m(void) + make_lowmem_page_readonly(__va(pmd_phys)); + pin_pagetable_pfn(MMUEXT_PIN_L2_TABLE, + PFN_DOWN(pmd_phys)); +- set_pud(pud + idx_pmd, __pud(_PAGE_TABLE | pmd_phys)); ++ pud[idx_pmd] = __pud(_PAGE_TABLE | pmd_phys); + pmd_phys += PAGE_SIZE; + } + n_pmd -= PTRS_PER_PUD; +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 23a53b67cf0d..7d53f2314d7c 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -701,12 +701,20 @@ static void blk_mq_requeue_work(struct work_struct *work) + spin_unlock_irq(&q->requeue_lock); + + list_for_each_entry_safe(rq, next, &rq_list, queuelist) { +- if (!(rq->rq_flags & RQF_SOFTBARRIER)) ++ if (!(rq->rq_flags & (RQF_SOFTBARRIER | RQF_DONTPREP))) + continue; + + rq->rq_flags &= ~RQF_SOFTBARRIER; + list_del_init(&rq->queuelist); +- blk_mq_sched_insert_request(rq, true, false, false); ++ /* ++ * If RQF_DONTPREP, rq has contained some driver specific ++ * data, so insert it to hctx dispatch list to avoid any ++ * merge. ++ */ ++ if (rq->rq_flags & RQF_DONTPREP) ++ blk_mq_request_bypass_insert(rq, false); ++ else ++ blk_mq_sched_insert_request(rq, true, false, false); + } + + while (!list_empty(&rq_list)) { +diff --git a/crypto/aead.c b/crypto/aead.c +index 60b3bbe973e7..9688ada13981 100644 +--- a/crypto/aead.c ++++ b/crypto/aead.c +@@ -61,8 +61,10 @@ int crypto_aead_setkey(struct crypto_aead *tfm, + else + err = crypto_aead_alg(tfm)->setkey(tfm, key, keylen); + +- if (err) ++ if (unlikely(err)) { ++ crypto_aead_set_flags(tfm, CRYPTO_TFM_NEED_KEY); + return err; ++ } + + crypto_aead_clear_flags(tfm, CRYPTO_TFM_NEED_KEY); + return 0; +diff --git a/crypto/aegis128.c b/crypto/aegis128.c +index c22f4414856d..789716f92e4c 100644 +--- a/crypto/aegis128.c ++++ b/crypto/aegis128.c +@@ -290,19 +290,19 @@ static void crypto_aegis128_process_crypt(struct aegis_state *state, + const struct aegis128_ops *ops) + { + struct skcipher_walk walk; +- u8 *src, *dst; +- unsigned int chunksize; + + ops->skcipher_walk_init(&walk, req, false); + + while (walk.nbytes) { +- src = walk.src.virt.addr; +- dst = walk.dst.virt.addr; +- chunksize = walk.nbytes; ++ unsigned int nbytes = walk.nbytes; + +- ops->crypt_chunk(state, dst, src, chunksize); ++ if (nbytes < walk.total) ++ nbytes = round_down(nbytes, walk.stride); + +- skcipher_walk_done(&walk, 0); ++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr, ++ nbytes); ++ ++ skcipher_walk_done(&walk, walk.nbytes - nbytes); + } + } + +diff --git a/crypto/aegis128l.c b/crypto/aegis128l.c +index b6fb21ebdc3e..73811448cb6b 100644 +--- a/crypto/aegis128l.c ++++ b/crypto/aegis128l.c +@@ -353,19 +353,19 @@ static void crypto_aegis128l_process_crypt(struct aegis_state *state, + const struct aegis128l_ops *ops) + { + struct skcipher_walk walk; +- u8 *src, *dst; +- unsigned int chunksize; + + ops->skcipher_walk_init(&walk, req, false); + + while (walk.nbytes) { +- src = walk.src.virt.addr; +- dst = walk.dst.virt.addr; +- chunksize = walk.nbytes; ++ unsigned int nbytes = walk.nbytes; + +- ops->crypt_chunk(state, dst, src, chunksize); ++ if (nbytes < walk.total) ++ nbytes = round_down(nbytes, walk.stride); + +- skcipher_walk_done(&walk, 0); ++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr, ++ nbytes); ++ ++ skcipher_walk_done(&walk, walk.nbytes - nbytes); + } + } + +diff --git a/crypto/aegis256.c b/crypto/aegis256.c +index 11f0f8ec9c7c..8a71e9c06193 100644 +--- a/crypto/aegis256.c ++++ b/crypto/aegis256.c +@@ -303,19 +303,19 @@ static void crypto_aegis256_process_crypt(struct aegis_state *state, + const struct aegis256_ops *ops) + { + struct skcipher_walk walk; +- u8 *src, *dst; +- unsigned int chunksize; + + ops->skcipher_walk_init(&walk, req, false); + + while (walk.nbytes) { +- src = walk.src.virt.addr; +- dst = walk.dst.virt.addr; +- chunksize = walk.nbytes; ++ unsigned int nbytes = walk.nbytes; + +- ops->crypt_chunk(state, dst, src, chunksize); ++ if (nbytes < walk.total) ++ nbytes = round_down(nbytes, walk.stride); + +- skcipher_walk_done(&walk, 0); ++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr, ++ nbytes); ++ ++ skcipher_walk_done(&walk, walk.nbytes - nbytes); + } + } + +diff --git a/crypto/ahash.c b/crypto/ahash.c +index a64c143165b1..158e716f21a1 100644 +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -86,17 +86,17 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk) + int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) + { + unsigned int alignmask = walk->alignmask; +- unsigned int nbytes = walk->entrylen; + + walk->data -= walk->offset; + +- if (nbytes && walk->offset & alignmask && !err) { +- walk->offset = ALIGN(walk->offset, alignmask + 1); +- nbytes = min(nbytes, +- ((unsigned int)(PAGE_SIZE)) - walk->offset); +- walk->entrylen -= nbytes; ++ if (walk->entrylen && (walk->offset & alignmask) && !err) { ++ unsigned int nbytes; + ++ walk->offset = ALIGN(walk->offset, alignmask + 1); ++ nbytes = min(walk->entrylen, ++ (unsigned int)(PAGE_SIZE - walk->offset)); + if (nbytes) { ++ walk->entrylen -= nbytes; + walk->data += walk->offset; + return nbytes; + } +@@ -116,7 +116,7 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) + if (err) + return err; + +- if (nbytes) { ++ if (walk->entrylen) { + walk->offset = 0; + walk->pg++; + return hash_walk_next(walk); +@@ -190,6 +190,21 @@ static int ahash_setkey_unaligned(struct crypto_ahash *tfm, const u8 *key, + return ret; + } + ++static int ahash_nosetkey(struct crypto_ahash *tfm, const u8 *key, ++ unsigned int keylen) ++{ ++ return -ENOSYS; ++} ++ ++static void ahash_set_needkey(struct crypto_ahash *tfm) ++{ ++ const struct hash_alg_common *alg = crypto_hash_alg_common(tfm); ++ ++ if (tfm->setkey != ahash_nosetkey && ++ !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY)) ++ crypto_ahash_set_flags(tfm, CRYPTO_TFM_NEED_KEY); ++} ++ + int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key, + unsigned int keylen) + { +@@ -201,20 +216,16 @@ int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key, + else + err = tfm->setkey(tfm, key, keylen); + +- if (err) ++ if (unlikely(err)) { ++ ahash_set_needkey(tfm); + return err; ++ } + + crypto_ahash_clear_flags(tfm, CRYPTO_TFM_NEED_KEY); + return 0; + } + EXPORT_SYMBOL_GPL(crypto_ahash_setkey); + +-static int ahash_nosetkey(struct crypto_ahash *tfm, const u8 *key, +- unsigned int keylen) +-{ +- return -ENOSYS; +-} +- + static inline unsigned int ahash_align_buffer_size(unsigned len, + unsigned long mask) + { +@@ -467,8 +478,7 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm) + + if (alg->setkey) { + hash->setkey = alg->setkey; +- if (!(alg->halg.base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY)) +- crypto_ahash_set_flags(hash, CRYPTO_TFM_NEED_KEY); ++ ahash_set_needkey(hash); + } + + return 0; +diff --git a/crypto/cfb.c b/crypto/cfb.c +index e81e45673498..4abfe32ff845 100644 +--- a/crypto/cfb.c ++++ b/crypto/cfb.c +@@ -77,12 +77,14 @@ static int crypto_cfb_encrypt_segment(struct skcipher_walk *walk, + do { + crypto_cfb_encrypt_one(tfm, iv, dst); + crypto_xor(dst, src, bsize); +- memcpy(iv, dst, bsize); ++ iv = dst; + + src += bsize; + dst += bsize; + } while ((nbytes -= bsize) >= bsize); + ++ memcpy(walk->iv, iv, bsize); ++ + return nbytes; + } + +@@ -162,7 +164,7 @@ static int crypto_cfb_decrypt_inplace(struct skcipher_walk *walk, + const unsigned int bsize = crypto_cfb_bsize(tfm); + unsigned int nbytes = walk->nbytes; + u8 *src = walk->src.virt.addr; +- u8 *iv = walk->iv; ++ u8 * const iv = walk->iv; + u8 tmp[MAX_CIPHER_BLOCKSIZE]; + + do { +@@ -172,8 +174,6 @@ static int crypto_cfb_decrypt_inplace(struct skcipher_walk *walk, + src += bsize; + } while ((nbytes -= bsize) >= bsize); + +- memcpy(walk->iv, iv, bsize); +- + return nbytes; + } + +@@ -298,6 +298,12 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb) + inst->alg.base.cra_blocksize = 1; + inst->alg.base.cra_alignmask = alg->cra_alignmask; + ++ /* ++ * To simplify the implementation, configure the skcipher walk to only ++ * give a partial block at the very end, never earlier. ++ */ ++ inst->alg.chunksize = alg->cra_blocksize; ++ + inst->alg.ivsize = alg->cra_blocksize; + inst->alg.min_keysize = alg->cra_cipher.cia_min_keysize; + inst->alg.max_keysize = alg->cra_cipher.cia_max_keysize; +diff --git a/crypto/morus1280.c b/crypto/morus1280.c +index 3889c188f266..b83576b4eb55 100644 +--- a/crypto/morus1280.c ++++ b/crypto/morus1280.c +@@ -366,18 +366,19 @@ static void crypto_morus1280_process_crypt(struct morus1280_state *state, + const struct morus1280_ops *ops) + { + struct skcipher_walk walk; +- u8 *dst; +- const u8 *src; + + ops->skcipher_walk_init(&walk, req, false); + + while (walk.nbytes) { +- src = walk.src.virt.addr; +- dst = walk.dst.virt.addr; ++ unsigned int nbytes = walk.nbytes; + +- ops->crypt_chunk(state, dst, src, walk.nbytes); ++ if (nbytes < walk.total) ++ nbytes = round_down(nbytes, walk.stride); + +- skcipher_walk_done(&walk, 0); ++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr, ++ nbytes); ++ ++ skcipher_walk_done(&walk, walk.nbytes - nbytes); + } + } + +diff --git a/crypto/morus640.c b/crypto/morus640.c +index da06ec2f6a80..b6a477444f6d 100644 +--- a/crypto/morus640.c ++++ b/crypto/morus640.c +@@ -365,18 +365,19 @@ static void crypto_morus640_process_crypt(struct morus640_state *state, + const struct morus640_ops *ops) + { + struct skcipher_walk walk; +- u8 *dst; +- const u8 *src; + + ops->skcipher_walk_init(&walk, req, false); + + while (walk.nbytes) { +- src = walk.src.virt.addr; +- dst = walk.dst.virt.addr; ++ unsigned int nbytes = walk.nbytes; + +- ops->crypt_chunk(state, dst, src, walk.nbytes); ++ if (nbytes < walk.total) ++ nbytes = round_down(nbytes, walk.stride); + +- skcipher_walk_done(&walk, 0); ++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr, ++ nbytes); ++ ++ skcipher_walk_done(&walk, walk.nbytes - nbytes); + } + } + +diff --git a/crypto/pcbc.c b/crypto/pcbc.c +index 8aa10144407c..1b182dfedc94 100644 +--- a/crypto/pcbc.c ++++ b/crypto/pcbc.c +@@ -51,7 +51,7 @@ static int crypto_pcbc_encrypt_segment(struct skcipher_request *req, + unsigned int nbytes = walk->nbytes; + u8 *src = walk->src.virt.addr; + u8 *dst = walk->dst.virt.addr; +- u8 *iv = walk->iv; ++ u8 * const iv = walk->iv; + + do { + crypto_xor(iv, src, bsize); +@@ -72,7 +72,7 @@ static int crypto_pcbc_encrypt_inplace(struct skcipher_request *req, + int bsize = crypto_cipher_blocksize(tfm); + unsigned int nbytes = walk->nbytes; + u8 *src = walk->src.virt.addr; +- u8 *iv = walk->iv; ++ u8 * const iv = walk->iv; + u8 tmpbuf[MAX_CIPHER_BLOCKSIZE]; + + do { +@@ -84,8 +84,6 @@ static int crypto_pcbc_encrypt_inplace(struct skcipher_request *req, + src += bsize; + } while ((nbytes -= bsize) >= bsize); + +- memcpy(walk->iv, iv, bsize); +- + return nbytes; + } + +@@ -121,7 +119,7 @@ static int crypto_pcbc_decrypt_segment(struct skcipher_request *req, + unsigned int nbytes = walk->nbytes; + u8 *src = walk->src.virt.addr; + u8 *dst = walk->dst.virt.addr; +- u8 *iv = walk->iv; ++ u8 * const iv = walk->iv; + + do { + crypto_cipher_decrypt_one(tfm, dst, src); +@@ -132,8 +130,6 @@ static int crypto_pcbc_decrypt_segment(struct skcipher_request *req, + dst += bsize; + } while ((nbytes -= bsize) >= bsize); + +- memcpy(walk->iv, iv, bsize); +- + return nbytes; + } + +@@ -144,7 +140,7 @@ static int crypto_pcbc_decrypt_inplace(struct skcipher_request *req, + int bsize = crypto_cipher_blocksize(tfm); + unsigned int nbytes = walk->nbytes; + u8 *src = walk->src.virt.addr; +- u8 *iv = walk->iv; ++ u8 * const iv = walk->iv; + u8 tmpbuf[MAX_CIPHER_BLOCKSIZE] __aligned(__alignof__(u32)); + + do { +@@ -156,8 +152,6 @@ static int crypto_pcbc_decrypt_inplace(struct skcipher_request *req, + src += bsize; + } while ((nbytes -= bsize) >= bsize); + +- memcpy(walk->iv, iv, bsize); +- + return nbytes; + } + +diff --git a/crypto/shash.c b/crypto/shash.c +index 5d732c6bb4b2..a04145e5306a 100644 +--- a/crypto/shash.c ++++ b/crypto/shash.c +@@ -53,6 +53,13 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, + return err; + } + ++static void shash_set_needkey(struct crypto_shash *tfm, struct shash_alg *alg) ++{ ++ if (crypto_shash_alg_has_setkey(alg) && ++ !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY)) ++ crypto_shash_set_flags(tfm, CRYPTO_TFM_NEED_KEY); ++} ++ + int crypto_shash_setkey(struct crypto_shash *tfm, const u8 *key, + unsigned int keylen) + { +@@ -65,8 +72,10 @@ int crypto_shash_setkey(struct crypto_shash *tfm, const u8 *key, + else + err = shash->setkey(tfm, key, keylen); + +- if (err) ++ if (unlikely(err)) { ++ shash_set_needkey(tfm, shash); + return err; ++ } + + crypto_shash_clear_flags(tfm, CRYPTO_TFM_NEED_KEY); + return 0; +@@ -368,7 +377,8 @@ int crypto_init_shash_ops_async(struct crypto_tfm *tfm) + crt->final = shash_async_final; + crt->finup = shash_async_finup; + crt->digest = shash_async_digest; +- crt->setkey = shash_async_setkey; ++ if (crypto_shash_alg_has_setkey(alg)) ++ crt->setkey = shash_async_setkey; + + crypto_ahash_set_flags(crt, crypto_shash_get_flags(shash) & + CRYPTO_TFM_NEED_KEY); +@@ -390,9 +400,7 @@ static int crypto_shash_init_tfm(struct crypto_tfm *tfm) + + hash->descsize = alg->descsize; + +- if (crypto_shash_alg_has_setkey(alg) && +- !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY)) +- crypto_shash_set_flags(hash, CRYPTO_TFM_NEED_KEY); ++ shash_set_needkey(hash, alg); + + return 0; + } +diff --git a/crypto/skcipher.c b/crypto/skcipher.c +index 0bd8c6caa498..46bb300d418f 100644 +--- a/crypto/skcipher.c ++++ b/crypto/skcipher.c +@@ -584,6 +584,12 @@ static unsigned int crypto_skcipher_extsize(struct crypto_alg *alg) + return crypto_alg_extsize(alg); + } + ++static void skcipher_set_needkey(struct crypto_skcipher *tfm) ++{ ++ if (tfm->keysize) ++ crypto_skcipher_set_flags(tfm, CRYPTO_TFM_NEED_KEY); ++} ++ + static int skcipher_setkey_blkcipher(struct crypto_skcipher *tfm, + const u8 *key, unsigned int keylen) + { +@@ -597,8 +603,10 @@ static int skcipher_setkey_blkcipher(struct crypto_skcipher *tfm, + err = crypto_blkcipher_setkey(blkcipher, key, keylen); + crypto_skcipher_set_flags(tfm, crypto_blkcipher_get_flags(blkcipher) & + CRYPTO_TFM_RES_MASK); +- if (err) ++ if (unlikely(err)) { ++ skcipher_set_needkey(tfm); + return err; ++ } + + crypto_skcipher_clear_flags(tfm, CRYPTO_TFM_NEED_KEY); + return 0; +@@ -676,8 +684,7 @@ static int crypto_init_skcipher_ops_blkcipher(struct crypto_tfm *tfm) + skcipher->ivsize = crypto_blkcipher_ivsize(blkcipher); + skcipher->keysize = calg->cra_blkcipher.max_keysize; + +- if (skcipher->keysize) +- crypto_skcipher_set_flags(skcipher, CRYPTO_TFM_NEED_KEY); ++ skcipher_set_needkey(skcipher); + + return 0; + } +@@ -697,8 +704,10 @@ static int skcipher_setkey_ablkcipher(struct crypto_skcipher *tfm, + crypto_skcipher_set_flags(tfm, + crypto_ablkcipher_get_flags(ablkcipher) & + CRYPTO_TFM_RES_MASK); +- if (err) ++ if (unlikely(err)) { ++ skcipher_set_needkey(tfm); + return err; ++ } + + crypto_skcipher_clear_flags(tfm, CRYPTO_TFM_NEED_KEY); + return 0; +@@ -775,8 +784,7 @@ static int crypto_init_skcipher_ops_ablkcipher(struct crypto_tfm *tfm) + sizeof(struct ablkcipher_request); + skcipher->keysize = calg->cra_ablkcipher.max_keysize; + +- if (skcipher->keysize) +- crypto_skcipher_set_flags(skcipher, CRYPTO_TFM_NEED_KEY); ++ skcipher_set_needkey(skcipher); + + return 0; + } +@@ -819,8 +827,10 @@ static int skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key, + else + err = cipher->setkey(tfm, key, keylen); + +- if (err) ++ if (unlikely(err)) { ++ skcipher_set_needkey(tfm); + return err; ++ } + + crypto_skcipher_clear_flags(tfm, CRYPTO_TFM_NEED_KEY); + return 0; +@@ -852,8 +862,7 @@ static int crypto_skcipher_init_tfm(struct crypto_tfm *tfm) + skcipher->ivsize = alg->ivsize; + skcipher->keysize = alg->max_keysize; + +- if (skcipher->keysize) +- crypto_skcipher_set_flags(skcipher, CRYPTO_TFM_NEED_KEY); ++ skcipher_set_needkey(skcipher); + + if (alg->exit) + skcipher->base.exit = crypto_skcipher_exit_tfm; +diff --git a/crypto/testmgr.c b/crypto/testmgr.c +index 54d882ffe438..3664c26f4838 100644 +--- a/crypto/testmgr.c ++++ b/crypto/testmgr.c +@@ -1894,14 +1894,21 @@ static int alg_test_crc32c(const struct alg_test_desc *desc, + + err = alg_test_hash(desc, driver, type, mask); + if (err) +- goto out; ++ return err; + + tfm = crypto_alloc_shash(driver, type, mask); + if (IS_ERR(tfm)) { ++ if (PTR_ERR(tfm) == -ENOENT) { ++ /* ++ * This crc32c implementation is only available through ++ * ahash API, not the shash API, so the remaining part ++ * of the test is not applicable to it. ++ */ ++ return 0; ++ } + printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: " + "%ld\n", driver, PTR_ERR(tfm)); +- err = PTR_ERR(tfm); +- goto out; ++ return PTR_ERR(tfm); + } + + do { +@@ -1928,7 +1935,6 @@ static int alg_test_crc32c(const struct alg_test_desc *desc, + + crypto_free_shash(tfm); + +-out: + return err; + } + +diff --git a/crypto/testmgr.h b/crypto/testmgr.h +index 11e6f17fe724..862ee1d04263 100644 +--- a/crypto/testmgr.h ++++ b/crypto/testmgr.h +@@ -11416,6 +11416,31 @@ static const struct cipher_testvec aes_cfb_tv_template[] = { + "\x75\xa3\x85\x74\x1a\xb9\xce\xf8" + "\x20\x31\x62\x3d\x55\xb1\xe4\x71", + .len = 64, ++ .also_non_np = 1, ++ .np = 2, ++ .tap = { 31, 33 }, ++ }, { /* > 16 bytes, not a multiple of 16 bytes */ ++ .key = "\x2b\x7e\x15\x16\x28\xae\xd2\xa6" ++ "\xab\xf7\x15\x88\x09\xcf\x4f\x3c", ++ .klen = 16, ++ .iv = "\x00\x01\x02\x03\x04\x05\x06\x07" ++ "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", ++ .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96" ++ "\xe9\x3d\x7e\x11\x73\x93\x17\x2a" ++ "\xae", ++ .ctext = "\x3b\x3f\xd9\x2e\xb7\x2d\xad\x20" ++ "\x33\x34\x49\xf8\xe8\x3c\xfb\x4a" ++ "\xc8", ++ .len = 17, ++ }, { /* < 16 bytes */ ++ .key = "\x2b\x7e\x15\x16\x28\xae\xd2\xa6" ++ "\xab\xf7\x15\x88\x09\xcf\x4f\x3c", ++ .klen = 16, ++ .iv = "\x00\x01\x02\x03\x04\x05\x06\x07" ++ "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", ++ .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f", ++ .ctext = "\x3b\x3f\xd9\x2e\xb7\x2d\xad", ++ .len = 7, + }, + }; + +diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c +index 545e91420cde..8940054d6250 100644 +--- a/drivers/acpi/device_sysfs.c ++++ b/drivers/acpi/device_sysfs.c +@@ -202,11 +202,15 @@ static int create_of_modalias(struct acpi_device *acpi_dev, char *modalias, + { + struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER }; + const union acpi_object *of_compatible, *obj; ++ acpi_status status; + int len, count; + int i, nval; + char *c; + +- acpi_get_name(acpi_dev->handle, ACPI_SINGLE_NAME, &buf); ++ status = acpi_get_name(acpi_dev->handle, ACPI_SINGLE_NAME, &buf); ++ if (ACPI_FAILURE(status)) ++ return -ENODEV; ++ + /* DT strings are all in lower case */ + for (c = buf.pointer; *c != '\0'; c++) + *c = tolower(*c); +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index f530d3541242..df2175b1169a 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -397,7 +397,7 @@ static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd, + if (call_pkg) { + int i; + +- if (nfit_mem->family != call_pkg->nd_family) ++ if (nfit_mem && nfit_mem->family != call_pkg->nd_family) + return -ENOTTY; + + for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++) +@@ -406,6 +406,10 @@ static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd, + return call_pkg->nd_command; + } + ++ /* In the !call_pkg case, bus commands == bus functions */ ++ if (!nfit_mem) ++ return cmd; ++ + /* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */ + if (nfit_mem->family == NVDIMM_FAMILY_INTEL) + return cmd; +@@ -436,17 +440,18 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, + if (cmd_rc) + *cmd_rc = -EINVAL; + ++ if (cmd == ND_CMD_CALL) ++ call_pkg = buf; ++ func = cmd_to_func(nfit_mem, cmd, call_pkg); ++ if (func < 0) ++ return func; ++ + if (nvdimm) { + struct acpi_device *adev = nfit_mem->adev; + + if (!adev) + return -ENOTTY; + +- if (cmd == ND_CMD_CALL) +- call_pkg = buf; +- func = cmd_to_func(nfit_mem, cmd, call_pkg); +- if (func < 0) +- return func; + dimm_name = nvdimm_name(nvdimm); + cmd_name = nvdimm_cmd_name(cmd); + cmd_mask = nvdimm_cmd_mask(nvdimm); +@@ -457,12 +462,9 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, + } else { + struct acpi_device *adev = to_acpi_dev(acpi_desc); + +- func = cmd; + cmd_name = nvdimm_bus_cmd_name(cmd); + cmd_mask = nd_desc->cmd_mask; +- dsm_mask = cmd_mask; +- if (cmd == ND_CMD_CALL) +- dsm_mask = nd_desc->bus_dsm_mask; ++ dsm_mask = nd_desc->bus_dsm_mask; + desc = nd_cmd_bus_desc(cmd); + guid = to_nfit_uuid(NFIT_DEV_BUS); + handle = adev->handle; +@@ -533,6 +535,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, + return -EINVAL; + } + ++ if (out_obj->type != ACPI_TYPE_BUFFER) { ++ dev_dbg(dev, "%s unexpected output object type cmd: %s type: %d\n", ++ dimm_name, cmd_name, out_obj->type); ++ rc = -EINVAL; ++ goto out; ++ } ++ + if (call_pkg) { + call_pkg->nd_fw_size = out_obj->buffer.length; + memcpy(call_pkg->nd_payload + call_pkg->nd_size_in, +@@ -551,13 +560,6 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, + return 0; + } + +- if (out_obj->package.type != ACPI_TYPE_BUFFER) { +- dev_dbg(dev, "%s unexpected output object type cmd: %s type: %d\n", +- dimm_name, cmd_name, out_obj->type); +- rc = -EINVAL; +- goto out; +- } +- + dev_dbg(dev, "%s cmd: %s output length: %d\n", dimm_name, + cmd_name, out_obj->buffer.length); + print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4, +@@ -2890,14 +2892,16 @@ static int ars_register(struct acpi_nfit_desc *acpi_desc, + { + int rc; + +- if (no_init_ars || test_bit(ARS_FAILED, &nfit_spa->ars_state)) ++ if (test_bit(ARS_FAILED, &nfit_spa->ars_state)) + return acpi_nfit_register_region(acpi_desc, nfit_spa); + + set_bit(ARS_REQ_SHORT, &nfit_spa->ars_state); +- set_bit(ARS_REQ_LONG, &nfit_spa->ars_state); ++ if (!no_init_ars) ++ set_bit(ARS_REQ_LONG, &nfit_spa->ars_state); + + switch (acpi_nfit_query_poison(acpi_desc)) { + case 0: ++ case -ENOSPC: + case -EAGAIN: + rc = ars_start(acpi_desc, nfit_spa, ARS_REQ_SHORT); + /* shouldn't happen, try again later */ +@@ -2922,7 +2926,6 @@ static int ars_register(struct acpi_nfit_desc *acpi_desc, + break; + case -EBUSY: + case -ENOMEM: +- case -ENOSPC: + /* + * BIOS was using ARS, wait for it to complete (or + * resources to become available) and then perform our +diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c +index a43276c76fc6..21393ec3b9a4 100644 +--- a/drivers/auxdisplay/ht16k33.c ++++ b/drivers/auxdisplay/ht16k33.c +@@ -509,7 +509,7 @@ static int ht16k33_remove(struct i2c_client *client) + struct ht16k33_priv *priv = i2c_get_clientdata(client); + struct ht16k33_fbdev *fbdev = &priv->fbdev; + +- cancel_delayed_work(&fbdev->work); ++ cancel_delayed_work_sync(&fbdev->work); + unregister_framebuffer(fbdev->info); + framebuffer_release(fbdev->info); + free_page((unsigned long) fbdev->buffer); +diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c +index 5fa1898755a3..7c84f64c74f7 100644 +--- a/drivers/base/power/wakeup.c ++++ b/drivers/base/power/wakeup.c +@@ -118,7 +118,6 @@ void wakeup_source_drop(struct wakeup_source *ws) + if (!ws) + return; + +- del_timer_sync(&ws->timer); + __pm_relax(ws); + } + EXPORT_SYMBOL_GPL(wakeup_source_drop); +@@ -205,6 +204,13 @@ void wakeup_source_remove(struct wakeup_source *ws) + list_del_rcu(&ws->entry); + raw_spin_unlock_irqrestore(&events_lock, flags); + synchronize_srcu(&wakeup_srcu); ++ ++ del_timer_sync(&ws->timer); ++ /* ++ * Clear timer.function to make wakeup_source_not_registered() treat ++ * this wakeup source as not registered. ++ */ ++ ws->timer.function = NULL; + } + EXPORT_SYMBOL_GPL(wakeup_source_remove); + +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index fdabd0b74492..a8de56f1936d 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -4084,7 +4084,7 @@ static unsigned int floppy_check_events(struct gendisk *disk, + + if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) { + if (lock_fdc(drive)) +- return -EINTR; ++ return 0; + poll_drive(false, 0); + process_fd_request(); + } +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index 5faa917df1b6..82d831b103f9 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -2085,6 +2085,11 @@ static int try_smi_init(struct smi_info *new_smi) + WARN_ON(new_smi->io.dev->init_name != NULL); + + out_err: ++ if (rv && new_smi->io.io_cleanup) { ++ new_smi->io.io_cleanup(&new_smi->io); ++ new_smi->io.io_cleanup = NULL; ++ } ++ + kfree(init_name); + return rv; + } +diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c +index 1b869d530884..638f4ab88f44 100644 +--- a/drivers/char/ipmi/ipmi_si_mem_io.c ++++ b/drivers/char/ipmi/ipmi_si_mem_io.c +@@ -81,8 +81,6 @@ int ipmi_si_mem_setup(struct si_sm_io *io) + if (!addr) + return -ENODEV; + +- io->io_cleanup = mem_cleanup; +- + /* + * Figure out the actual readb/readw/readl/etc routine to use based + * upon the register size. +@@ -141,5 +139,8 @@ int ipmi_si_mem_setup(struct si_sm_io *io) + mem_region_cleanup(io, io->io_size); + return -EIO; + } ++ ++ io->io_cleanup = mem_cleanup; ++ + return 0; + } +diff --git a/drivers/char/ipmi/ipmi_si_port_io.c b/drivers/char/ipmi/ipmi_si_port_io.c +index ef6dffcea9fa..03924c32b6e9 100644 +--- a/drivers/char/ipmi/ipmi_si_port_io.c ++++ b/drivers/char/ipmi/ipmi_si_port_io.c +@@ -68,8 +68,6 @@ int ipmi_si_port_setup(struct si_sm_io *io) + if (!addr) + return -ENODEV; + +- io->io_cleanup = port_cleanup; +- + /* + * Figure out the actual inb/inw/inl/etc routine to use based + * upon the register size. +@@ -109,5 +107,8 @@ int ipmi_si_port_setup(struct si_sm_io *io) + return -EIO; + } + } ++ ++ io->io_cleanup = port_cleanup; ++ + return 0; + } +diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c +index abd675bec88c..694fc58888c1 100644 +--- a/drivers/char/tpm/st33zp24/st33zp24.c ++++ b/drivers/char/tpm/st33zp24/st33zp24.c +@@ -436,7 +436,7 @@ static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf, + goto out_err; + } + +- return len; ++ return 0; + out_err: + st33zp24_cancel(chip); + release_locality(chip); +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index 1010cb79dcc6..43c3f9b87614 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -495,10 +495,19 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip, + if (rc < 0) { + if (rc != -EPIPE) + dev_err(&chip->dev, +- "%s: tpm_send: error %d\n", __func__, rc); ++ "%s: send(): error %d\n", __func__, rc); + goto out; + } + ++ /* A sanity check. send() should just return zero on success e.g. ++ * not the command length. ++ */ ++ if (rc > 0) { ++ dev_warn(&chip->dev, ++ "%s: send(): invalid value %d\n", __func__, rc); ++ rc = 0; ++ } ++ + if (chip->flags & TPM_CHIP_FLAG_IRQ) + goto out_recv; + +diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c +index 66a14526aaf4..a290b30a0c35 100644 +--- a/drivers/char/tpm/tpm_atmel.c ++++ b/drivers/char/tpm/tpm_atmel.c +@@ -105,7 +105,7 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count) + iowrite8(buf[i], priv->iobase); + } + +- return count; ++ return 0; + } + + static void tpm_atml_cancel(struct tpm_chip *chip) +diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c +index 36952ef98f90..763fc7e6c005 100644 +--- a/drivers/char/tpm/tpm_crb.c ++++ b/drivers/char/tpm/tpm_crb.c +@@ -287,19 +287,29 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count) + struct crb_priv *priv = dev_get_drvdata(&chip->dev); + unsigned int expected; + +- /* sanity check */ +- if (count < 6) ++ /* A sanity check that the upper layer wants to get at least the header ++ * as that is the minimum size for any TPM response. ++ */ ++ if (count < TPM_HEADER_SIZE) + return -EIO; + ++ /* If this bit is set, according to the spec, the TPM is in ++ * unrecoverable condition. ++ */ + if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR) + return -EIO; + +- memcpy_fromio(buf, priv->rsp, 6); +- expected = be32_to_cpup((__be32 *) &buf[2]); +- if (expected > count || expected < 6) ++ /* Read the first 8 bytes in order to get the length of the response. ++ * We read exactly a quad word in order to make sure that the remaining ++ * reads will be aligned. ++ */ ++ memcpy_fromio(buf, priv->rsp, 8); ++ ++ expected = be32_to_cpup((__be32 *)&buf[2]); ++ if (expected > count || expected < TPM_HEADER_SIZE) + return -EIO; + +- memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6); ++ memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8); + + return expected; + } +diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c +index 95ce2e9ccdc6..32a8e27c5382 100644 +--- a/drivers/char/tpm/tpm_i2c_atmel.c ++++ b/drivers/char/tpm/tpm_i2c_atmel.c +@@ -65,7 +65,11 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len) + dev_dbg(&chip->dev, + "%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__, + (int)min_t(size_t, 64, len), buf, len, status); +- return status; ++ ++ if (status < 0) ++ return status; ++ ++ return 0; + } + + static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count) +diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c +index 9086edc9066b..977fd42daa1b 100644 +--- a/drivers/char/tpm/tpm_i2c_infineon.c ++++ b/drivers/char/tpm/tpm_i2c_infineon.c +@@ -587,7 +587,7 @@ static int tpm_tis_i2c_send(struct tpm_chip *chip, u8 *buf, size_t len) + /* go and do it */ + iic_tpm_write(TPM_STS(tpm_dev.locality), &sts, 1); + +- return len; ++ return 0; + out_err: + tpm_tis_i2c_ready(chip); + /* The TPM needs some time to clean up here, +diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c +index f74f451baf6a..b8defdfdf2dc 100644 +--- a/drivers/char/tpm/tpm_i2c_nuvoton.c ++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c +@@ -469,7 +469,7 @@ static int i2c_nuvoton_send(struct tpm_chip *chip, u8 *buf, size_t len) + } + + dev_dbg(dev, "%s() -> %zd\n", __func__, len); +- return len; ++ return 0; + } + + static bool i2c_nuvoton_req_canceled(struct tpm_chip *chip, u8 status) +diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c +index 25f6e2665385..77e47dc5aacc 100644 +--- a/drivers/char/tpm/tpm_ibmvtpm.c ++++ b/drivers/char/tpm/tpm_ibmvtpm.c +@@ -141,14 +141,14 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count) + } + + /** +- * tpm_ibmvtpm_send - Send tpm request +- * ++ * tpm_ibmvtpm_send() - Send a TPM command + * @chip: tpm chip struct + * @buf: buffer contains data to send + * @count: size of buffer + * + * Return: +- * Number of bytes sent or < 0 on error. ++ * 0 on success, ++ * -errno on error + */ + static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) + { +@@ -194,7 +194,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) + rc = 0; + ibmvtpm->tpm_processing_cmd = false; + } else +- rc = count; ++ rc = 0; + + spin_unlock(&ibmvtpm->rtce_lock); + return rc; +diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c +index d8f10047fbba..97f6d4fe0aee 100644 +--- a/drivers/char/tpm/tpm_infineon.c ++++ b/drivers/char/tpm/tpm_infineon.c +@@ -354,7 +354,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count) + for (i = 0; i < count; i++) { + wait_and_send(chip, buf[i]); + } +- return count; ++ return 0; + } + + static void tpm_inf_cancel(struct tpm_chip *chip) +diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c +index 5d6cce74cd3f..9bee3c5eb4bf 100644 +--- a/drivers/char/tpm/tpm_nsc.c ++++ b/drivers/char/tpm/tpm_nsc.c +@@ -226,7 +226,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count) + } + outb(NSC_COMMAND_EOC, priv->base + NSC_COMMAND); + +- return count; ++ return 0; + } + + static void tpm_nsc_cancel(struct tpm_chip *chip) +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index d2345d9fd7b5..0eaea3a7b8f4 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -485,7 +485,7 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len) + goto out_err; + } + } +- return len; ++ return 0; + out_err: + tpm_tis_ready(chip); + return rc; +diff --git a/drivers/char/tpm/tpm_vtpm_proxy.c b/drivers/char/tpm/tpm_vtpm_proxy.c +index 87a0ce47f201..ecbb63f8d231 100644 +--- a/drivers/char/tpm/tpm_vtpm_proxy.c ++++ b/drivers/char/tpm/tpm_vtpm_proxy.c +@@ -335,7 +335,6 @@ static int vtpm_proxy_is_driver_command(struct tpm_chip *chip, + static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count) + { + struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); +- int rc = 0; + + if (count > sizeof(proxy_dev->buffer)) { + dev_err(&chip->dev, +@@ -366,7 +365,7 @@ static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count) + + wake_up_interruptible(&proxy_dev->wq); + +- return rc; ++ return 0; + } + + static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip) +diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c +index b150f87f38f5..5a327eb7f63a 100644 +--- a/drivers/char/tpm/xen-tpmfront.c ++++ b/drivers/char/tpm/xen-tpmfront.c +@@ -173,7 +173,7 @@ static int vtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) + return -ETIME; + } + +- return count; ++ return 0; + } + + static int vtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count) +diff --git a/drivers/clk/clk-twl6040.c b/drivers/clk/clk-twl6040.c +index 25dfe050ae9f..4bd1b32a4f93 100644 +--- a/drivers/clk/clk-twl6040.c ++++ b/drivers/clk/clk-twl6040.c +@@ -41,6 +41,43 @@ static int twl6040_pdmclk_is_prepared(struct clk_hw *hw) + return pdmclk->enabled; + } + ++static int twl6040_pdmclk_reset_one_clock(struct twl6040_pdmclk *pdmclk, ++ unsigned int reg) ++{ ++ const u8 reset_mask = TWL6040_HPLLRST; /* Same for HPPLL and LPPLL */ ++ int ret; ++ ++ ret = twl6040_set_bits(pdmclk->twl6040, reg, reset_mask); ++ if (ret < 0) ++ return ret; ++ ++ ret = twl6040_clear_bits(pdmclk->twl6040, reg, reset_mask); ++ if (ret < 0) ++ return ret; ++ ++ return 0; ++} ++ ++/* ++ * TWL6040A2 Phoenix Audio IC erratum #6: "PDM Clock Generation Issue At ++ * Cold Temperature". This affects cold boot and deeper idle states it ++ * seems. The workaround consists of resetting HPPLL and LPPLL. ++ */ ++static int twl6040_pdmclk_quirk_reset_clocks(struct twl6040_pdmclk *pdmclk) ++{ ++ int ret; ++ ++ ret = twl6040_pdmclk_reset_one_clock(pdmclk, TWL6040_REG_HPPLLCTL); ++ if (ret) ++ return ret; ++ ++ ret = twl6040_pdmclk_reset_one_clock(pdmclk, TWL6040_REG_LPPLLCTL); ++ if (ret) ++ return ret; ++ ++ return 0; ++} ++ + static int twl6040_pdmclk_prepare(struct clk_hw *hw) + { + struct twl6040_pdmclk *pdmclk = container_of(hw, struct twl6040_pdmclk, +@@ -48,8 +85,20 @@ static int twl6040_pdmclk_prepare(struct clk_hw *hw) + int ret; + + ret = twl6040_power(pdmclk->twl6040, 1); +- if (!ret) +- pdmclk->enabled = 1; ++ if (ret) ++ return ret; ++ ++ ret = twl6040_pdmclk_quirk_reset_clocks(pdmclk); ++ if (ret) ++ goto out_err; ++ ++ pdmclk->enabled = 1; ++ ++ return 0; ++ ++out_err: ++ dev_err(pdmclk->dev, "%s: error %i\n", __func__, ret); ++ twl6040_power(pdmclk->twl6040, 0); + + return ret; + } +diff --git a/drivers/clk/ingenic/cgu.c b/drivers/clk/ingenic/cgu.c +index 5ef7d9ba2195..b40160eb3372 100644 +--- a/drivers/clk/ingenic/cgu.c ++++ b/drivers/clk/ingenic/cgu.c +@@ -426,16 +426,16 @@ ingenic_clk_round_rate(struct clk_hw *hw, unsigned long req_rate, + struct ingenic_clk *ingenic_clk = to_ingenic_clk(hw); + struct ingenic_cgu *cgu = ingenic_clk->cgu; + const struct ingenic_cgu_clk_info *clk_info; +- long rate = *parent_rate; ++ unsigned int div = 1; + + clk_info = &cgu->clock_info[ingenic_clk->idx]; + + if (clk_info->type & CGU_CLK_DIV) +- rate /= ingenic_clk_calc_div(clk_info, *parent_rate, req_rate); ++ div = ingenic_clk_calc_div(clk_info, *parent_rate, req_rate); + else if (clk_info->type & CGU_CLK_FIXDIV) +- rate /= clk_info->fixdiv.div; ++ div = clk_info->fixdiv.div; + +- return rate; ++ return DIV_ROUND_UP(*parent_rate, div); + } + + static int +@@ -455,7 +455,7 @@ ingenic_clk_set_rate(struct clk_hw *hw, unsigned long req_rate, + + if (clk_info->type & CGU_CLK_DIV) { + div = ingenic_clk_calc_div(clk_info, parent_rate, req_rate); +- rate = parent_rate / div; ++ rate = DIV_ROUND_UP(parent_rate, div); + + if (rate != req_rate) + return -EINVAL; +diff --git a/drivers/clk/ingenic/cgu.h b/drivers/clk/ingenic/cgu.h +index 502bcbb61b04..e12716d8ce3c 100644 +--- a/drivers/clk/ingenic/cgu.h ++++ b/drivers/clk/ingenic/cgu.h +@@ -80,7 +80,7 @@ struct ingenic_cgu_mux_info { + * @reg: offset of the divider control register within the CGU + * @shift: number of bits to left shift the divide value by (ie. the index of + * the lowest bit of the divide value within its control register) +- * @div: number of bits to divide the divider value by (i.e. if the ++ * @div: number to divide the divider value by (i.e. if the + * effective divider value is the value written to the register + * multiplied by some constant) + * @bits: the size of the divide value in bits +diff --git a/drivers/clk/samsung/clk-exynos5-subcmu.c b/drivers/clk/samsung/clk-exynos5-subcmu.c +index 93306283d764..8ae44b5db4c2 100644 +--- a/drivers/clk/samsung/clk-exynos5-subcmu.c ++++ b/drivers/clk/samsung/clk-exynos5-subcmu.c +@@ -136,15 +136,20 @@ static int __init exynos5_clk_register_subcmu(struct device *parent, + { + struct of_phandle_args genpdspec = { .np = pd_node }; + struct platform_device *pdev; ++ int ret; ++ ++ pdev = platform_device_alloc("exynos5-subcmu", PLATFORM_DEVID_AUTO); ++ if (!pdev) ++ return -ENOMEM; + +- pdev = platform_device_alloc(info->pd_name, -1); + pdev->dev.parent = parent; +- pdev->driver_override = "exynos5-subcmu"; + platform_set_drvdata(pdev, (void *)info); + of_genpd_add_device(&genpdspec, &pdev->dev); +- platform_device_add(pdev); ++ ret = platform_device_add(pdev); ++ if (ret) ++ platform_device_put(pdev); + +- return 0; ++ return ret; + } + + static int __init exynos5_clk_probe(struct platform_device *pdev) +diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c +index 3b97f60540ad..609970c0b666 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c ++++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c +@@ -264,9 +264,9 @@ static SUNXI_CCU_GATE(ahb1_mmc1_clk, "ahb1-mmc1", "ahb1", + static SUNXI_CCU_GATE(ahb1_mmc2_clk, "ahb1-mmc2", "ahb1", + 0x060, BIT(10), 0); + static SUNXI_CCU_GATE(ahb1_mmc3_clk, "ahb1-mmc3", "ahb1", +- 0x060, BIT(12), 0); ++ 0x060, BIT(11), 0); + static SUNXI_CCU_GATE(ahb1_nand1_clk, "ahb1-nand1", "ahb1", +- 0x060, BIT(13), 0); ++ 0x060, BIT(12), 0); + static SUNXI_CCU_GATE(ahb1_nand0_clk, "ahb1-nand0", "ahb1", + 0x060, BIT(13), 0); + static SUNXI_CCU_GATE(ahb1_sdram_clk, "ahb1-sdram", "ahb1", +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c +index 621b1cd996db..ac12f261f8ca 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c +@@ -542,7 +542,7 @@ static struct ccu_reset_map sun8i_v3s_ccu_resets[] = { + [RST_BUS_OHCI0] = { 0x2c0, BIT(29) }, + + [RST_BUS_VE] = { 0x2c4, BIT(0) }, +- [RST_BUS_TCON0] = { 0x2c4, BIT(3) }, ++ [RST_BUS_TCON0] = { 0x2c4, BIT(4) }, + [RST_BUS_CSI] = { 0x2c4, BIT(8) }, + [RST_BUS_DE] = { 0x2c4, BIT(12) }, + [RST_BUS_DBG] = { 0x2c4, BIT(31) }, +diff --git a/drivers/clk/uniphier/clk-uniphier-cpugear.c b/drivers/clk/uniphier/clk-uniphier-cpugear.c +index ec11f55594ad..5d2d42b7e182 100644 +--- a/drivers/clk/uniphier/clk-uniphier-cpugear.c ++++ b/drivers/clk/uniphier/clk-uniphier-cpugear.c +@@ -47,7 +47,7 @@ static int uniphier_clk_cpugear_set_parent(struct clk_hw *hw, u8 index) + return ret; + + ret = regmap_write_bits(gear->regmap, +- gear->regbase + UNIPHIER_CLK_CPUGEAR_SET, ++ gear->regbase + UNIPHIER_CLK_CPUGEAR_UPD, + UNIPHIER_CLK_CPUGEAR_UPD_BIT, + UNIPHIER_CLK_CPUGEAR_UPD_BIT); + if (ret) +diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig +index 316d48d7be72..c1ddafa4c299 100644 +--- a/drivers/clocksource/Kconfig ++++ b/drivers/clocksource/Kconfig +@@ -365,6 +365,16 @@ config ARM64_ERRATUM_858921 + The workaround will be dynamically enabled when an affected + core is detected. + ++config SUN50I_ERRATUM_UNKNOWN1 ++ bool "Workaround for Allwinner A64 erratum UNKNOWN1" ++ default y ++ depends on ARM_ARCH_TIMER && ARM64 && ARCH_SUNXI ++ select ARM_ARCH_TIMER_OOL_WORKAROUND ++ help ++ This option enables a workaround for instability in the timer on ++ the Allwinner A64 SoC. The workaround will only be active if the ++ allwinner,erratum-unknown1 property is found in the timer node. ++ + config ARM_GLOBAL_TIMER + bool "Support for the ARM global timer" if COMPILE_TEST + select TIMER_OF if OF +diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c +index d8c7f5750cdb..0445ad7e559e 100644 +--- a/drivers/clocksource/arm_arch_timer.c ++++ b/drivers/clocksource/arm_arch_timer.c +@@ -319,6 +319,48 @@ static u64 notrace arm64_858921_read_cntvct_el0(void) + } + #endif + ++#ifdef CONFIG_SUN50I_ERRATUM_UNKNOWN1 ++/* ++ * The low bits of the counter registers are indeterminate while bit 10 or ++ * greater is rolling over. Since the counter value can jump both backward ++ * (7ff -> 000 -> 800) and forward (7ff -> fff -> 800), ignore register values ++ * with all ones or all zeros in the low bits. Bound the loop by the maximum ++ * number of CPU cycles in 3 consecutive 24 MHz counter periods. ++ */ ++#define __sun50i_a64_read_reg(reg) ({ \ ++ u64 _val; \ ++ int _retries = 150; \ ++ \ ++ do { \ ++ _val = read_sysreg(reg); \ ++ _retries--; \ ++ } while (((_val + 1) & GENMASK(9, 0)) <= 1 && _retries); \ ++ \ ++ WARN_ON_ONCE(!_retries); \ ++ _val; \ ++}) ++ ++static u64 notrace sun50i_a64_read_cntpct_el0(void) ++{ ++ return __sun50i_a64_read_reg(cntpct_el0); ++} ++ ++static u64 notrace sun50i_a64_read_cntvct_el0(void) ++{ ++ return __sun50i_a64_read_reg(cntvct_el0); ++} ++ ++static u32 notrace sun50i_a64_read_cntp_tval_el0(void) ++{ ++ return read_sysreg(cntp_cval_el0) - sun50i_a64_read_cntpct_el0(); ++} ++ ++static u32 notrace sun50i_a64_read_cntv_tval_el0(void) ++{ ++ return read_sysreg(cntv_cval_el0) - sun50i_a64_read_cntvct_el0(); ++} ++#endif ++ + #ifdef CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND + DEFINE_PER_CPU(const struct arch_timer_erratum_workaround *, timer_unstable_counter_workaround); + EXPORT_SYMBOL_GPL(timer_unstable_counter_workaround); +@@ -408,6 +450,19 @@ static const struct arch_timer_erratum_workaround ool_workarounds[] = { + .read_cntvct_el0 = arm64_858921_read_cntvct_el0, + }, + #endif ++#ifdef CONFIG_SUN50I_ERRATUM_UNKNOWN1 ++ { ++ .match_type = ate_match_dt, ++ .id = "allwinner,erratum-unknown1", ++ .desc = "Allwinner erratum UNKNOWN1", ++ .read_cntp_tval_el0 = sun50i_a64_read_cntp_tval_el0, ++ .read_cntv_tval_el0 = sun50i_a64_read_cntv_tval_el0, ++ .read_cntpct_el0 = sun50i_a64_read_cntpct_el0, ++ .read_cntvct_el0 = sun50i_a64_read_cntvct_el0, ++ .set_next_event_phys = erratum_set_next_event_tval_phys, ++ .set_next_event_virt = erratum_set_next_event_tval_virt, ++ }, ++#endif + }; + + typedef bool (*ate_match_fn_t)(const struct arch_timer_erratum_workaround *, +diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c +index 7a244b681876..d55c30f6981d 100644 +--- a/drivers/clocksource/exynos_mct.c ++++ b/drivers/clocksource/exynos_mct.c +@@ -388,6 +388,13 @@ static void exynos4_mct_tick_start(unsigned long cycles, + exynos4_mct_write(tmp, mevt->base + MCT_L_TCON_OFFSET); + } + ++static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt) ++{ ++ /* Clear the MCT tick interrupt */ ++ if (readl_relaxed(reg_base + mevt->base + MCT_L_INT_CSTAT_OFFSET) & 1) ++ exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET); ++} ++ + static int exynos4_tick_set_next_event(unsigned long cycles, + struct clock_event_device *evt) + { +@@ -404,6 +411,7 @@ static int set_state_shutdown(struct clock_event_device *evt) + + mevt = container_of(evt, struct mct_clock_event_device, evt); + exynos4_mct_tick_stop(mevt); ++ exynos4_mct_tick_clear(mevt); + return 0; + } + +@@ -420,8 +428,11 @@ static int set_state_periodic(struct clock_event_device *evt) + return 0; + } + +-static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt) ++static irqreturn_t exynos4_mct_tick_isr(int irq, void *dev_id) + { ++ struct mct_clock_event_device *mevt = dev_id; ++ struct clock_event_device *evt = &mevt->evt; ++ + /* + * This is for supporting oneshot mode. + * Mct would generate interrupt periodically +@@ -430,16 +441,6 @@ static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt) + if (!clockevent_state_periodic(&mevt->evt)) + exynos4_mct_tick_stop(mevt); + +- /* Clear the MCT tick interrupt */ +- if (readl_relaxed(reg_base + mevt->base + MCT_L_INT_CSTAT_OFFSET) & 1) +- exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET); +-} +- +-static irqreturn_t exynos4_mct_tick_isr(int irq, void *dev_id) +-{ +- struct mct_clock_event_device *mevt = dev_id; +- struct clock_event_device *evt = &mevt->evt; +- + exynos4_mct_tick_clear(mevt); + + evt->event_handler(evt); +diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c +index 4cce6b224b87..3ecf84706640 100644 +--- a/drivers/clocksource/timer-ti-dm.c ++++ b/drivers/clocksource/timer-ti-dm.c +@@ -154,6 +154,10 @@ static int omap_dm_timer_of_set_source(struct omap_dm_timer *timer) + if (IS_ERR(parent)) + return -ENODEV; + ++ /* Bail out if both clocks point to fck */ ++ if (clk_is_match(parent, timer->fclk)) ++ return 0; ++ + ret = clk_set_parent(timer->fclk, parent); + if (ret < 0) + pr_err("%s: failed to set parent\n", __func__); +diff --git a/drivers/cpufreq/pxa2xx-cpufreq.c b/drivers/cpufreq/pxa2xx-cpufreq.c +index 46254e583982..74e0e0c20c46 100644 +--- a/drivers/cpufreq/pxa2xx-cpufreq.c ++++ b/drivers/cpufreq/pxa2xx-cpufreq.c +@@ -143,7 +143,7 @@ static int pxa_cpufreq_change_voltage(const struct pxa_freqs *pxa_freq) + return ret; + } + +-static void __init pxa_cpufreq_init_voltages(void) ++static void pxa_cpufreq_init_voltages(void) + { + vcc_core = regulator_get(NULL, "vcc_core"); + if (IS_ERR(vcc_core)) { +@@ -159,7 +159,7 @@ static int pxa_cpufreq_change_voltage(const struct pxa_freqs *pxa_freq) + return 0; + } + +-static void __init pxa_cpufreq_init_voltages(void) { } ++static void pxa_cpufreq_init_voltages(void) { } + #endif + + static void find_freq_tables(struct cpufreq_frequency_table **freq_table, +diff --git a/drivers/cpufreq/qcom-cpufreq-kryo.c b/drivers/cpufreq/qcom-cpufreq-kryo.c +index 2a3675c24032..a472b814058f 100644 +--- a/drivers/cpufreq/qcom-cpufreq-kryo.c ++++ b/drivers/cpufreq/qcom-cpufreq-kryo.c +@@ -75,7 +75,7 @@ static enum _msm8996_version qcom_cpufreq_kryo_get_msm_id(void) + + static int qcom_cpufreq_kryo_probe(struct platform_device *pdev) + { +- struct opp_table *opp_tables[NR_CPUS] = {0}; ++ struct opp_table **opp_tables; + enum _msm8996_version msm8996_version; + struct nvmem_cell *speedbin_nvmem; + struct device_node *np; +@@ -133,6 +133,10 @@ static int qcom_cpufreq_kryo_probe(struct platform_device *pdev) + } + kfree(speedbin); + ++ opp_tables = kcalloc(num_possible_cpus(), sizeof(*opp_tables), GFP_KERNEL); ++ if (!opp_tables) ++ return -ENOMEM; ++ + for_each_possible_cpu(cpu) { + cpu_dev = get_cpu_device(cpu); + if (NULL == cpu_dev) { +@@ -151,8 +155,10 @@ static int qcom_cpufreq_kryo_probe(struct platform_device *pdev) + + cpufreq_dt_pdev = platform_device_register_simple("cpufreq-dt", -1, + NULL, 0); +- if (!IS_ERR(cpufreq_dt_pdev)) ++ if (!IS_ERR(cpufreq_dt_pdev)) { ++ platform_set_drvdata(pdev, opp_tables); + return 0; ++ } + + ret = PTR_ERR(cpufreq_dt_pdev); + dev_err(cpu_dev, "Failed to register platform device\n"); +@@ -163,13 +169,23 @@ free_opp: + break; + dev_pm_opp_put_supported_hw(opp_tables[cpu]); + } ++ kfree(opp_tables); + + return ret; + } + + static int qcom_cpufreq_kryo_remove(struct platform_device *pdev) + { ++ struct opp_table **opp_tables = platform_get_drvdata(pdev); ++ unsigned int cpu; ++ + platform_device_unregister(cpufreq_dt_pdev); ++ ++ for_each_possible_cpu(cpu) ++ dev_pm_opp_put_supported_hw(opp_tables[cpu]); ++ ++ kfree(opp_tables); ++ + return 0; + } + +diff --git a/drivers/cpufreq/tegra124-cpufreq.c b/drivers/cpufreq/tegra124-cpufreq.c +index 43530254201a..4bb154f6c54c 100644 +--- a/drivers/cpufreq/tegra124-cpufreq.c ++++ b/drivers/cpufreq/tegra124-cpufreq.c +@@ -134,6 +134,8 @@ static int tegra124_cpufreq_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, priv); + ++ of_node_put(np); ++ + return 0; + + out_switch_to_pllx: +diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c +index ec40f991e6c6..9bc54c3c2cb9 100644 +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -1005,6 +1005,7 @@ static void init_aead_job(struct aead_request *req, + if (unlikely(req->src != req->dst)) { + if (edesc->dst_nents == 1) { + dst_dma = sg_dma_address(req->dst); ++ out_options = 0; + } else { + dst_dma = edesc->sec4_sg_dma + + sec4_sg_index * +diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c +index f84ca2ff61de..f5fd00065650 100644 +--- a/drivers/crypto/caam/caamhash.c ++++ b/drivers/crypto/caam/caamhash.c +@@ -118,6 +118,7 @@ struct caam_hash_ctx { + struct caam_hash_state { + dma_addr_t buf_dma; + dma_addr_t ctx_dma; ++ int ctx_dma_len; + u8 buf_0[CAAM_MAX_HASH_BLOCK_SIZE] ____cacheline_aligned; + int buflen_0; + u8 buf_1[CAAM_MAX_HASH_BLOCK_SIZE] ____cacheline_aligned; +@@ -170,6 +171,7 @@ static inline int map_seq_out_ptr_ctx(u32 *desc, struct device *jrdev, + struct caam_hash_state *state, + int ctx_len) + { ++ state->ctx_dma_len = ctx_len; + state->ctx_dma = dma_map_single(jrdev, state->caam_ctx, + ctx_len, DMA_FROM_DEVICE); + if (dma_mapping_error(jrdev, state->ctx_dma)) { +@@ -183,18 +185,6 @@ static inline int map_seq_out_ptr_ctx(u32 *desc, struct device *jrdev, + return 0; + } + +-/* Map req->result, and append seq_out_ptr command that points to it */ +-static inline dma_addr_t map_seq_out_ptr_result(u32 *desc, struct device *jrdev, +- u8 *result, int digestsize) +-{ +- dma_addr_t dst_dma; +- +- dst_dma = dma_map_single(jrdev, result, digestsize, DMA_FROM_DEVICE); +- append_seq_out_ptr(desc, dst_dma, digestsize, 0); +- +- return dst_dma; +-} +- + /* Map current buffer in state (if length > 0) and put it in link table */ + static inline int buf_map_to_sec4_sg(struct device *jrdev, + struct sec4_sg_entry *sec4_sg, +@@ -223,6 +213,7 @@ static inline int ctx_map_to_sec4_sg(struct device *jrdev, + struct caam_hash_state *state, int ctx_len, + struct sec4_sg_entry *sec4_sg, u32 flag) + { ++ state->ctx_dma_len = ctx_len; + state->ctx_dma = dma_map_single(jrdev, state->caam_ctx, ctx_len, flag); + if (dma_mapping_error(jrdev, state->ctx_dma)) { + dev_err(jrdev, "unable to map ctx\n"); +@@ -485,7 +476,6 @@ static int ahash_setkey(struct crypto_ahash *ahash, + + /* + * ahash_edesc - s/w-extended ahash descriptor +- * @dst_dma: physical mapped address of req->result + * @sec4_sg_dma: physical mapped address of h/w link table + * @src_nents: number of segments in input scatterlist + * @sec4_sg_bytes: length of dma mapped sec4_sg space +@@ -493,7 +483,6 @@ static int ahash_setkey(struct crypto_ahash *ahash, + * @sec4_sg: h/w link table + */ + struct ahash_edesc { +- dma_addr_t dst_dma; + dma_addr_t sec4_sg_dma; + int src_nents; + int sec4_sg_bytes; +@@ -509,8 +498,6 @@ static inline void ahash_unmap(struct device *dev, + + if (edesc->src_nents) + dma_unmap_sg(dev, req->src, edesc->src_nents, DMA_TO_DEVICE); +- if (edesc->dst_dma) +- dma_unmap_single(dev, edesc->dst_dma, dst_len, DMA_FROM_DEVICE); + + if (edesc->sec4_sg_bytes) + dma_unmap_single(dev, edesc->sec4_sg_dma, +@@ -527,12 +514,10 @@ static inline void ahash_unmap_ctx(struct device *dev, + struct ahash_edesc *edesc, + struct ahash_request *req, int dst_len, u32 flag) + { +- struct crypto_ahash *ahash = crypto_ahash_reqtfm(req); +- struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash); + struct caam_hash_state *state = ahash_request_ctx(req); + + if (state->ctx_dma) { +- dma_unmap_single(dev, state->ctx_dma, ctx->ctx_len, flag); ++ dma_unmap_single(dev, state->ctx_dma, state->ctx_dma_len, flag); + state->ctx_dma = 0; + } + ahash_unmap(dev, edesc, req, dst_len); +@@ -545,9 +530,9 @@ static void ahash_done(struct device *jrdev, u32 *desc, u32 err, + struct ahash_edesc *edesc; + struct crypto_ahash *ahash = crypto_ahash_reqtfm(req); + int digestsize = crypto_ahash_digestsize(ahash); ++ struct caam_hash_state *state = ahash_request_ctx(req); + #ifdef DEBUG + struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash); +- struct caam_hash_state *state = ahash_request_ctx(req); + + dev_err(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err); + #endif +@@ -556,17 +541,14 @@ static void ahash_done(struct device *jrdev, u32 *desc, u32 err, + if (err) + caam_jr_strstatus(jrdev, err); + +- ahash_unmap(jrdev, edesc, req, digestsize); ++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE); ++ memcpy(req->result, state->caam_ctx, digestsize); + kfree(edesc); + + #ifdef DEBUG + print_hex_dump(KERN_ERR, "ctx@"__stringify(__LINE__)": ", + DUMP_PREFIX_ADDRESS, 16, 4, state->caam_ctx, + ctx->ctx_len, 1); +- if (req->result) +- print_hex_dump(KERN_ERR, "result@"__stringify(__LINE__)": ", +- DUMP_PREFIX_ADDRESS, 16, 4, req->result, +- digestsize, 1); + #endif + + req->base.complete(&req->base, err); +@@ -614,9 +596,9 @@ static void ahash_done_ctx_src(struct device *jrdev, u32 *desc, u32 err, + struct ahash_edesc *edesc; + struct crypto_ahash *ahash = crypto_ahash_reqtfm(req); + int digestsize = crypto_ahash_digestsize(ahash); ++ struct caam_hash_state *state = ahash_request_ctx(req); + #ifdef DEBUG + struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash); +- struct caam_hash_state *state = ahash_request_ctx(req); + + dev_err(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err); + #endif +@@ -625,17 +607,14 @@ static void ahash_done_ctx_src(struct device *jrdev, u32 *desc, u32 err, + if (err) + caam_jr_strstatus(jrdev, err); + +- ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_TO_DEVICE); ++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_BIDIRECTIONAL); ++ memcpy(req->result, state->caam_ctx, digestsize); + kfree(edesc); + + #ifdef DEBUG + print_hex_dump(KERN_ERR, "ctx@"__stringify(__LINE__)": ", + DUMP_PREFIX_ADDRESS, 16, 4, state->caam_ctx, + ctx->ctx_len, 1); +- if (req->result) +- print_hex_dump(KERN_ERR, "result@"__stringify(__LINE__)": ", +- DUMP_PREFIX_ADDRESS, 16, 4, req->result, +- digestsize, 1); + #endif + + req->base.complete(&req->base, err); +@@ -896,7 +875,7 @@ static int ahash_final_ctx(struct ahash_request *req) + edesc->sec4_sg_bytes = sec4_sg_bytes; + + ret = ctx_map_to_sec4_sg(jrdev, state, ctx->ctx_len, +- edesc->sec4_sg, DMA_TO_DEVICE); ++ edesc->sec4_sg, DMA_BIDIRECTIONAL); + if (ret) + goto unmap_ctx; + +@@ -916,14 +895,7 @@ static int ahash_final_ctx(struct ahash_request *req) + + append_seq_in_ptr(desc, edesc->sec4_sg_dma, ctx->ctx_len + buflen, + LDST_SGF); +- +- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result, +- digestsize); +- if (dma_mapping_error(jrdev, edesc->dst_dma)) { +- dev_err(jrdev, "unable to map dst\n"); +- ret = -ENOMEM; +- goto unmap_ctx; +- } ++ append_seq_out_ptr(desc, state->ctx_dma, digestsize, 0); + + #ifdef DEBUG + print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ", +@@ -936,7 +908,7 @@ static int ahash_final_ctx(struct ahash_request *req) + + return -EINPROGRESS; + unmap_ctx: +- ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE); ++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_BIDIRECTIONAL); + kfree(edesc); + return ret; + } +@@ -990,7 +962,7 @@ static int ahash_finup_ctx(struct ahash_request *req) + edesc->src_nents = src_nents; + + ret = ctx_map_to_sec4_sg(jrdev, state, ctx->ctx_len, +- edesc->sec4_sg, DMA_TO_DEVICE); ++ edesc->sec4_sg, DMA_BIDIRECTIONAL); + if (ret) + goto unmap_ctx; + +@@ -1004,13 +976,7 @@ static int ahash_finup_ctx(struct ahash_request *req) + if (ret) + goto unmap_ctx; + +- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result, +- digestsize); +- if (dma_mapping_error(jrdev, edesc->dst_dma)) { +- dev_err(jrdev, "unable to map dst\n"); +- ret = -ENOMEM; +- goto unmap_ctx; +- } ++ append_seq_out_ptr(desc, state->ctx_dma, digestsize, 0); + + #ifdef DEBUG + print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ", +@@ -1023,7 +989,7 @@ static int ahash_finup_ctx(struct ahash_request *req) + + return -EINPROGRESS; + unmap_ctx: +- ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE); ++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_BIDIRECTIONAL); + kfree(edesc); + return ret; + } +@@ -1082,10 +1048,8 @@ static int ahash_digest(struct ahash_request *req) + + desc = edesc->hw_desc; + +- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result, +- digestsize); +- if (dma_mapping_error(jrdev, edesc->dst_dma)) { +- dev_err(jrdev, "unable to map dst\n"); ++ ret = map_seq_out_ptr_ctx(desc, jrdev, state, digestsize); ++ if (ret) { + ahash_unmap(jrdev, edesc, req, digestsize); + kfree(edesc); + return -ENOMEM; +@@ -1100,7 +1064,7 @@ static int ahash_digest(struct ahash_request *req) + if (!ret) { + ret = -EINPROGRESS; + } else { +- ahash_unmap(jrdev, edesc, req, digestsize); ++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE); + kfree(edesc); + } + +@@ -1142,12 +1106,9 @@ static int ahash_final_no_ctx(struct ahash_request *req) + append_seq_in_ptr(desc, state->buf_dma, buflen, 0); + } + +- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result, +- digestsize); +- if (dma_mapping_error(jrdev, edesc->dst_dma)) { +- dev_err(jrdev, "unable to map dst\n"); ++ ret = map_seq_out_ptr_ctx(desc, jrdev, state, digestsize); ++ if (ret) + goto unmap; +- } + + #ifdef DEBUG + print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ", +@@ -1158,7 +1119,7 @@ static int ahash_final_no_ctx(struct ahash_request *req) + if (!ret) { + ret = -EINPROGRESS; + } else { +- ahash_unmap(jrdev, edesc, req, digestsize); ++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE); + kfree(edesc); + } + +@@ -1357,12 +1318,9 @@ static int ahash_finup_no_ctx(struct ahash_request *req) + goto unmap; + } + +- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result, +- digestsize); +- if (dma_mapping_error(jrdev, edesc->dst_dma)) { +- dev_err(jrdev, "unable to map dst\n"); ++ ret = map_seq_out_ptr_ctx(desc, jrdev, state, digestsize); ++ if (ret) + goto unmap; +- } + + #ifdef DEBUG + print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ", +@@ -1373,7 +1331,7 @@ static int ahash_finup_no_ctx(struct ahash_request *req) + if (!ret) { + ret = -EINPROGRESS; + } else { +- ahash_unmap(jrdev, edesc, req, digestsize); ++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE); + kfree(edesc); + } + +@@ -1505,6 +1463,7 @@ static int ahash_init(struct ahash_request *req) + state->final = ahash_final_no_ctx; + + state->ctx_dma = 0; ++ state->ctx_dma_len = 0; + state->current_buf = 0; + state->buf_dma = 0; + state->buflen_0 = 0; +diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c +index dd948e1df9e5..3bcb6bce666e 100644 +--- a/drivers/crypto/ccree/cc_buffer_mgr.c ++++ b/drivers/crypto/ccree/cc_buffer_mgr.c +@@ -614,10 +614,10 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req) + hw_iv_size, DMA_BIDIRECTIONAL); + } + +- /*In case a pool was set, a table was +- *allocated and should be released +- */ +- if (areq_ctx->mlli_params.curr_pool) { ++ /* Release pool */ ++ if ((areq_ctx->assoc_buff_type == CC_DMA_BUF_MLLI || ++ areq_ctx->data_buff_type == CC_DMA_BUF_MLLI) && ++ (areq_ctx->mlli_params.mlli_virt_addr)) { + dev_dbg(dev, "free MLLI buffer: dma=%pad virt=%pK\n", + &areq_ctx->mlli_params.mlli_dma_addr, + areq_ctx->mlli_params.mlli_virt_addr); +diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c +index 7623b29911af..54a39164aab8 100644 +--- a/drivers/crypto/ccree/cc_cipher.c ++++ b/drivers/crypto/ccree/cc_cipher.c +@@ -79,6 +79,7 @@ static int validate_keys_sizes(struct cc_cipher_ctx *ctx_p, u32 size) + default: + break; + } ++ break; + case S_DIN_to_DES: + if (size == DES3_EDE_KEY_SIZE || size == DES_KEY_SIZE) + return 0; +@@ -634,6 +635,8 @@ static void cc_cipher_complete(struct device *dev, void *cc_req, int err) + unsigned int ivsize = crypto_skcipher_ivsize(sk_tfm); + unsigned int len; + ++ cc_unmap_cipher_request(dev, req_ctx, ivsize, src, dst); ++ + switch (ctx_p->cipher_mode) { + case DRV_CIPHER_CBC: + /* +@@ -663,7 +666,6 @@ static void cc_cipher_complete(struct device *dev, void *cc_req, int err) + break; + } + +- cc_unmap_cipher_request(dev, req_ctx, ivsize, src, dst); + kzfree(req_ctx->iv); + + skcipher_request_complete(req, err); +@@ -781,7 +783,8 @@ static int cc_cipher_decrypt(struct skcipher_request *req) + + memset(req_ctx, 0, sizeof(*req_ctx)); + +- if (ctx_p->cipher_mode == DRV_CIPHER_CBC) { ++ if ((ctx_p->cipher_mode == DRV_CIPHER_CBC) && ++ (req->cryptlen >= ivsize)) { + + /* Allocate and save the last IV sized bytes of the source, + * which will be lost in case of in-place decryption. +diff --git a/drivers/crypto/rockchip/rk3288_crypto.c b/drivers/crypto/rockchip/rk3288_crypto.c +index c9d622abd90c..0ce4a65b95f5 100644 +--- a/drivers/crypto/rockchip/rk3288_crypto.c ++++ b/drivers/crypto/rockchip/rk3288_crypto.c +@@ -119,7 +119,7 @@ static int rk_load_data(struct rk_crypto_info *dev, + count = (dev->left_bytes > PAGE_SIZE) ? + PAGE_SIZE : dev->left_bytes; + +- if (!sg_pcopy_to_buffer(dev->first, dev->nents, ++ if (!sg_pcopy_to_buffer(dev->first, dev->src_nents, + dev->addr_vir, count, + dev->total - dev->left_bytes)) { + dev_err(dev->dev, "[%s:%d] pcopy err\n", +diff --git a/drivers/crypto/rockchip/rk3288_crypto.h b/drivers/crypto/rockchip/rk3288_crypto.h +index d5fb4013fb42..54ee5b3ed9db 100644 +--- a/drivers/crypto/rockchip/rk3288_crypto.h ++++ b/drivers/crypto/rockchip/rk3288_crypto.h +@@ -207,7 +207,8 @@ struct rk_crypto_info { + void *addr_vir; + int aligned; + int align_size; +- size_t nents; ++ size_t src_nents; ++ size_t dst_nents; + unsigned int total; + unsigned int count; + dma_addr_t addr_in; +@@ -244,6 +245,7 @@ struct rk_cipher_ctx { + struct rk_crypto_info *dev; + unsigned int keylen; + u32 mode; ++ u8 iv[AES_BLOCK_SIZE]; + }; + + enum alg_type { +diff --git a/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c b/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c +index 639c15c5364b..23305f22072f 100644 +--- a/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c ++++ b/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c +@@ -242,6 +242,17 @@ static void crypto_dma_start(struct rk_crypto_info *dev) + static int rk_set_data_start(struct rk_crypto_info *dev) + { + int err; ++ struct ablkcipher_request *req = ++ ablkcipher_request_cast(dev->async_req); ++ struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req); ++ struct rk_cipher_ctx *ctx = crypto_ablkcipher_ctx(tfm); ++ u32 ivsize = crypto_ablkcipher_ivsize(tfm); ++ u8 *src_last_blk = page_address(sg_page(dev->sg_src)) + ++ dev->sg_src->offset + dev->sg_src->length - ivsize; ++ ++ /* store the iv that need to be updated in chain mode */ ++ if (ctx->mode & RK_CRYPTO_DEC) ++ memcpy(ctx->iv, src_last_blk, ivsize); + + err = dev->load_data(dev, dev->sg_src, dev->sg_dst); + if (!err) +@@ -260,8 +271,9 @@ static int rk_ablk_start(struct rk_crypto_info *dev) + dev->total = req->nbytes; + dev->sg_src = req->src; + dev->first = req->src; +- dev->nents = sg_nents(req->src); ++ dev->src_nents = sg_nents(req->src); + dev->sg_dst = req->dst; ++ dev->dst_nents = sg_nents(req->dst); + dev->aligned = 1; + + spin_lock_irqsave(&dev->lock, flags); +@@ -285,6 +297,28 @@ static void rk_iv_copyback(struct rk_crypto_info *dev) + memcpy_fromio(req->info, dev->reg + RK_CRYPTO_AES_IV_0, ivsize); + } + ++static void rk_update_iv(struct rk_crypto_info *dev) ++{ ++ struct ablkcipher_request *req = ++ ablkcipher_request_cast(dev->async_req); ++ struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req); ++ struct rk_cipher_ctx *ctx = crypto_ablkcipher_ctx(tfm); ++ u32 ivsize = crypto_ablkcipher_ivsize(tfm); ++ u8 *new_iv = NULL; ++ ++ if (ctx->mode & RK_CRYPTO_DEC) { ++ new_iv = ctx->iv; ++ } else { ++ new_iv = page_address(sg_page(dev->sg_dst)) + ++ dev->sg_dst->offset + dev->sg_dst->length - ivsize; ++ } ++ ++ if (ivsize == DES_BLOCK_SIZE) ++ memcpy_toio(dev->reg + RK_CRYPTO_TDES_IV_0, new_iv, ivsize); ++ else if (ivsize == AES_BLOCK_SIZE) ++ memcpy_toio(dev->reg + RK_CRYPTO_AES_IV_0, new_iv, ivsize); ++} ++ + /* return: + * true some err was occurred + * fault no err, continue +@@ -297,7 +331,7 @@ static int rk_ablk_rx(struct rk_crypto_info *dev) + + dev->unload_data(dev); + if (!dev->aligned) { +- if (!sg_pcopy_from_buffer(req->dst, dev->nents, ++ if (!sg_pcopy_from_buffer(req->dst, dev->dst_nents, + dev->addr_vir, dev->count, + dev->total - dev->left_bytes - + dev->count)) { +@@ -306,6 +340,7 @@ static int rk_ablk_rx(struct rk_crypto_info *dev) + } + } + if (dev->left_bytes) { ++ rk_update_iv(dev); + if (dev->aligned) { + if (sg_is_last(dev->sg_src)) { + dev_err(dev->dev, "[%s:%d] Lack of data\n", +diff --git a/drivers/crypto/rockchip/rk3288_crypto_ahash.c b/drivers/crypto/rockchip/rk3288_crypto_ahash.c +index 821a506b9e17..c336ae75e361 100644 +--- a/drivers/crypto/rockchip/rk3288_crypto_ahash.c ++++ b/drivers/crypto/rockchip/rk3288_crypto_ahash.c +@@ -206,7 +206,7 @@ static int rk_ahash_start(struct rk_crypto_info *dev) + dev->sg_dst = NULL; + dev->sg_src = req->src; + dev->first = req->src; +- dev->nents = sg_nents(req->src); ++ dev->src_nents = sg_nents(req->src); + rctx = ahash_request_ctx(req); + rctx->mode = 0; + +diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c +index 1bb1a8e09025..6c94ed750049 100644 +--- a/drivers/dma/sh/usb-dmac.c ++++ b/drivers/dma/sh/usb-dmac.c +@@ -697,6 +697,8 @@ static int usb_dmac_runtime_resume(struct device *dev) + #endif /* CONFIG_PM */ + + static const struct dev_pm_ops usb_dmac_pm = { ++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, ++ pm_runtime_force_resume) + SET_RUNTIME_PM_OPS(usb_dmac_runtime_suspend, usb_dmac_runtime_resume, + NULL) + }; +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 023a32cfac42..e0657fc72d31 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -543,7 +543,8 @@ static int pca953x_irq_set_type(struct irq_data *d, unsigned int type) + + static void pca953x_irq_shutdown(struct irq_data *d) + { +- struct pca953x_chip *chip = irq_data_get_irq_chip_data(d); ++ struct gpio_chip *gc = irq_data_get_irq_chip_data(d); ++ struct pca953x_chip *chip = gpiochip_get_data(gc); + u8 mask = 1 << (d->hwirq % BANK_SZ); + + chip->irq_trig_raise[d->hwirq / BANK_SZ] &= ~mask; +diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c +index bd039322f697..6342f6499351 100644 +--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c ++++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c +@@ -1347,12 +1347,12 @@ void dcn_bw_update_from_pplib(struct dc *dc) + struct dm_pp_clock_levels_with_voltage fclks = {0}, dcfclks = {0}; + bool res; + +- kernel_fpu_begin(); +- + /* TODO: This is not the proper way to obtain fabric_and_dram_bandwidth, should be min(fclk, memclk) */ + res = dm_pp_get_clock_levels_by_type_with_voltage( + ctx, DM_PP_CLOCK_TYPE_FCLK, &fclks); + ++ kernel_fpu_begin(); ++ + if (res) + res = verify_clock_values(&fclks); + +@@ -1371,9 +1371,13 @@ void dcn_bw_update_from_pplib(struct dc *dc) + } else + BREAK_TO_DEBUGGER(); + ++ kernel_fpu_end(); ++ + res = dm_pp_get_clock_levels_by_type_with_voltage( + ctx, DM_PP_CLOCK_TYPE_DCFCLK, &dcfclks); + ++ kernel_fpu_begin(); ++ + if (res) + res = verify_clock_values(&dcfclks); + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +index 052e60dfaf9f..b52ccab428a9 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -3487,14 +3487,14 @@ static int smu7_get_gpu_power(struct pp_hwmgr *hwmgr, u32 *query) + + smum_send_msg_to_smc(hwmgr, PPSMC_MSG_PmStatusLogStart); + cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, +- ixSMU_PM_STATUS_94, 0); ++ ixSMU_PM_STATUS_95, 0); + + for (i = 0; i < 10; i++) { +- mdelay(1); ++ mdelay(500); + smum_send_msg_to_smc(hwmgr, PPSMC_MSG_PmStatusLogSample); + tmp = cgs_read_ind_register(hwmgr->device, + CGS_IND_REG__SMC, +- ixSMU_PM_STATUS_94); ++ ixSMU_PM_STATUS_95); + if (tmp != 0) + break; + } +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index 1bda809a7289..e65596617239 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -3156,9 +3156,7 @@ static void drm_fbdev_client_unregister(struct drm_client_dev *client) + + static int drm_fbdev_client_restore(struct drm_client_dev *client) + { +- struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client); +- +- drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper); ++ drm_fb_helper_lastclose(client->dev); + + return 0; + } +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 280c851714e6..03cda197fb6b 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1828,7 +1828,8 @@ __vma_matches(struct vm_area_struct *vma, struct file *filp, + if (vma->vm_file != filp) + return false; + +- return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size; ++ return vma->vm_start == addr && ++ (vma->vm_end - vma->vm_start) == PAGE_ALIGN(size); + } + + /** +diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c +index 3bd0f8a18e74..42daa5c9ff8e 100644 +--- a/drivers/gpu/drm/imx/imx-ldb.c ++++ b/drivers/gpu/drm/imx/imx-ldb.c +@@ -651,8 +651,10 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) + int bus_format; + + ret = of_property_read_u32(child, "reg", &i); +- if (ret || i < 0 || i > 1) +- return -EINVAL; ++ if (ret || i < 0 || i > 1) { ++ ret = -EINVAL; ++ goto free_child; ++ } + + if (!of_device_is_available(child)) + continue; +@@ -665,7 +667,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) + channel = &imx_ldb->channel[i]; + channel->ldb = imx_ldb; + channel->chno = i; +- channel->child = child; + + /* + * The output port is port@4 with an external 4-port mux or +@@ -675,13 +676,13 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) + imx_ldb->lvds_mux ? 4 : 2, 0, + &channel->panel, &channel->bridge); + if (ret && ret != -ENODEV) +- return ret; ++ goto free_child; + + /* panel ddc only if there is no bridge */ + if (!channel->bridge) { + ret = imx_ldb_panel_ddc(dev, channel, child); + if (ret) +- return ret; ++ goto free_child; + } + + bus_format = of_get_bus_format(dev, child); +@@ -697,18 +698,26 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) + if (bus_format < 0) { + dev_err(dev, "could not determine data mapping: %d\n", + bus_format); +- return bus_format; ++ ret = bus_format; ++ goto free_child; + } + channel->bus_format = bus_format; ++ channel->child = child; + + ret = imx_ldb_register(drm, channel); +- if (ret) +- return ret; ++ if (ret) { ++ channel->child = NULL; ++ goto free_child; ++ } + } + + dev_set_drvdata(dev, imx_ldb); + + return 0; ++ ++free_child: ++ of_node_put(child); ++ return ret; + } + + static void imx_ldb_unbind(struct device *dev, struct device *master, +diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c +index 203f247d4854..a323a0db2fc1 100644 +--- a/drivers/gpu/drm/imx/ipuv3-plane.c ++++ b/drivers/gpu/drm/imx/ipuv3-plane.c +@@ -375,9 +375,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane, + if (ret) + return ret; + +- /* CRTC should be enabled */ ++ /* nothing to check when disabling or disabled */ + if (!crtc_state->enable) +- return -EINVAL; ++ return 0; + + switch (plane->type) { + case DRM_PLANE_TYPE_PRIMARY: +diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c +index 54324330b91f..2f0a5bd50174 100644 +--- a/drivers/gpu/drm/radeon/evergreen_cs.c ++++ b/drivers/gpu/drm/radeon/evergreen_cs.c +@@ -1299,6 +1299,7 @@ static int evergreen_cs_handle_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) + return -EINVAL; + } + ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff); ++ break; + case CB_TARGET_MASK: + track->cb_target_mask = radeon_get_ib_value(p, idx); + track->cb_dirty = true; +diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c +index 474b00e19697..0a7d4395d427 100644 +--- a/drivers/gpu/ipu-v3/ipu-common.c ++++ b/drivers/gpu/ipu-v3/ipu-common.c +@@ -898,8 +898,8 @@ static struct ipu_devtype ipu_type_imx51 = { + .cpmem_ofs = 0x1f000000, + .srm_ofs = 0x1f040000, + .tpm_ofs = 0x1f060000, +- .csi0_ofs = 0x1f030000, +- .csi1_ofs = 0x1f038000, ++ .csi0_ofs = 0x1e030000, ++ .csi1_ofs = 0x1e038000, + .ic_ofs = 0x1e020000, + .disp0_ofs = 0x1e040000, + .disp1_ofs = 0x1e048000, +@@ -914,8 +914,8 @@ static struct ipu_devtype ipu_type_imx53 = { + .cpmem_ofs = 0x07000000, + .srm_ofs = 0x07040000, + .tpm_ofs = 0x07060000, +- .csi0_ofs = 0x07030000, +- .csi1_ofs = 0x07038000, ++ .csi0_ofs = 0x06030000, ++ .csi1_ofs = 0x06038000, + .ic_ofs = 0x06020000, + .disp0_ofs = 0x06040000, + .disp1_ofs = 0x06048000, +diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c +index 8426b7970c14..cc287cf6eb29 100644 +--- a/drivers/hwtracing/intel_th/gth.c ++++ b/drivers/hwtracing/intel_th/gth.c +@@ -607,6 +607,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev, + { + struct gth_device *gth = dev_get_drvdata(&thdev->dev); + int port = othdev->output.port; ++ int master; + + if (thdev->host_mode) + return; +@@ -615,6 +616,9 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev, + othdev->output.port = -1; + othdev->output.active = false; + gth->output[port].output = NULL; ++ for (master = 0; master < TH_CONFIGURABLE_MASTERS; master++) ++ if (gth->master[master] == port) ++ gth->master[master] = -1; + spin_unlock(>h->gth_lock); + } + +diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c +index 10bcb5d73f90..9d55e104400c 100644 +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -244,6 +244,9 @@ static int find_free_channels(unsigned long *bitmap, unsigned int start, + ; + if (i == width) + return pos; ++ ++ /* step over [pos..pos+i) to continue search */ ++ pos += i; + } + + return -1; +@@ -550,7 +553,7 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg) + { + struct stm_device *stm = stmf->stm; + struct stp_policy_id *id; +- int ret = -EINVAL; ++ int ret = -EINVAL, wlimit = 1; + u32 size; + + if (stmf->output.nr_chans) +@@ -578,8 +581,10 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg) + if (id->__reserved_0 || id->__reserved_1) + goto err_free; + +- if (id->width < 1 || +- id->width > PAGE_SIZE / stm->data->sw_mmiosz) ++ if (stm->data->sw_mmiosz) ++ wlimit = PAGE_SIZE / stm->data->sw_mmiosz; ++ ++ if (id->width < 1 || id->width > wlimit) + goto err_free; + + ret = stm_file_assign(stmf, id->id, id->width); +diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c +index 44deae78913e..4d19254f78c8 100644 +--- a/drivers/i2c/busses/i2c-bcm2835.c ++++ b/drivers/i2c/busses/i2c-bcm2835.c +@@ -191,6 +191,15 @@ static void bcm2835_i2c_start_transfer(struct bcm2835_i2c_dev *i2c_dev) + bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, c); + } + ++static void bcm2835_i2c_finish_transfer(struct bcm2835_i2c_dev *i2c_dev) ++{ ++ i2c_dev->curr_msg = NULL; ++ i2c_dev->num_msgs = 0; ++ ++ i2c_dev->msg_buf = NULL; ++ i2c_dev->msg_buf_remaining = 0; ++} ++ + /* + * Note about I2C_C_CLEAR on error: + * The I2C_C_CLEAR on errors will take some time to resolve -- if you were in +@@ -291,6 +300,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], + + time_left = wait_for_completion_timeout(&i2c_dev->completion, + adap->timeout); ++ ++ bcm2835_i2c_finish_transfer(i2c_dev); ++ + if (!time_left) { + bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, + BCM2835_I2C_C_CLEAR); +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index b13605718291..d917cefc5a19 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -382,8 +382,10 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id) + * Check for the message size against FIFO depth and set the + * 'hold bus' bit if it is greater than FIFO depth. + */ +- if (id->recv_count > CDNS_I2C_FIFO_DEPTH) ++ if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag) + ctrl_reg |= CDNS_I2C_CR_HOLD; ++ else ++ ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD; + + cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET); + +@@ -440,8 +442,11 @@ static void cdns_i2c_msend(struct cdns_i2c *id) + * Check for the message size against FIFO depth and set the + * 'hold bus' bit if it is greater than FIFO depth. + */ +- if (id->send_count > CDNS_I2C_FIFO_DEPTH) ++ if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag) + ctrl_reg |= CDNS_I2C_CR_HOLD; ++ else ++ ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD; ++ + cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET); + + /* Clear the interrupts in interrupt status register. */ +diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c +index 60c8561fbe65..ef13b6ce9d8d 100644 +--- a/drivers/i2c/busses/i2c-tegra.c ++++ b/drivers/i2c/busses/i2c-tegra.c +@@ -832,7 +832,7 @@ static const struct i2c_algorithm tegra_i2c_algo = { + /* payload size is only 12 bit */ + static const struct i2c_adapter_quirks tegra_i2c_quirks = { + .max_read_len = 4096, +- .max_write_len = 4096, ++ .max_write_len = 4096 - 12, + }; + + static const struct tegra_i2c_hw_feature tegra20_i2c_hw = { +diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c +index f10443f92e4c..4be29ed44755 100644 +--- a/drivers/iio/adc/exynos_adc.c ++++ b/drivers/iio/adc/exynos_adc.c +@@ -915,7 +915,7 @@ static int exynos_adc_remove(struct platform_device *pdev) + struct iio_dev *indio_dev = platform_get_drvdata(pdev); + struct exynos_adc *info = iio_priv(indio_dev); + +- if (IS_REACHABLE(CONFIG_INPUT)) { ++ if (IS_REACHABLE(CONFIG_INPUT) && info->input) { + free_irq(info->tsirq, info); + input_unregister_device(info->input); + } +diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h +index cfd252386356..2ea42c04cfd2 100644 +--- a/drivers/infiniband/hw/hfi1/hfi.h ++++ b/drivers/infiniband/hw/hfi1/hfi.h +@@ -1425,7 +1425,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd, + struct hfi1_devdata *dd, u8 hw_pidx, u8 port); + void hfi1_free_ctxtdata(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd); + int hfi1_rcd_put(struct hfi1_ctxtdata *rcd); +-void hfi1_rcd_get(struct hfi1_ctxtdata *rcd); ++int hfi1_rcd_get(struct hfi1_ctxtdata *rcd); + struct hfi1_ctxtdata *hfi1_rcd_get_by_index_safe(struct hfi1_devdata *dd, + u16 ctxt); + struct hfi1_ctxtdata *hfi1_rcd_get_by_index(struct hfi1_devdata *dd, u16 ctxt); +diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c +index 758d273c32cf..da786eb18558 100644 +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -213,12 +213,12 @@ static void hfi1_rcd_free(struct kref *kref) + struct hfi1_ctxtdata *rcd = + container_of(kref, struct hfi1_ctxtdata, kref); + +- hfi1_free_ctxtdata(rcd->dd, rcd); +- + spin_lock_irqsave(&rcd->dd->uctxt_lock, flags); + rcd->dd->rcd[rcd->ctxt] = NULL; + spin_unlock_irqrestore(&rcd->dd->uctxt_lock, flags); + ++ hfi1_free_ctxtdata(rcd->dd, rcd); ++ + kfree(rcd); + } + +@@ -241,10 +241,13 @@ int hfi1_rcd_put(struct hfi1_ctxtdata *rcd) + * @rcd: pointer to an initialized rcd data structure + * + * Use this to get a reference after the init. ++ * ++ * Return : reflect kref_get_unless_zero(), which returns non-zero on ++ * increment, otherwise 0. + */ +-void hfi1_rcd_get(struct hfi1_ctxtdata *rcd) ++int hfi1_rcd_get(struct hfi1_ctxtdata *rcd) + { +- kref_get(&rcd->kref); ++ return kref_get_unless_zero(&rcd->kref); + } + + /** +@@ -324,7 +327,8 @@ struct hfi1_ctxtdata *hfi1_rcd_get_by_index(struct hfi1_devdata *dd, u16 ctxt) + spin_lock_irqsave(&dd->uctxt_lock, flags); + if (dd->rcd[ctxt]) { + rcd = dd->rcd[ctxt]; +- hfi1_rcd_get(rcd); ++ if (!hfi1_rcd_get(rcd)) ++ rcd = NULL; + } + spin_unlock_irqrestore(&dd->uctxt_lock, flags); + +diff --git a/drivers/input/keyboard/cap11xx.c b/drivers/input/keyboard/cap11xx.c +index 312916f99597..73686c2460ce 100644 +--- a/drivers/input/keyboard/cap11xx.c ++++ b/drivers/input/keyboard/cap11xx.c +@@ -75,9 +75,7 @@ + struct cap11xx_led { + struct cap11xx_priv *priv; + struct led_classdev cdev; +- struct work_struct work; + u32 reg; +- enum led_brightness new_brightness; + }; + #endif + +@@ -233,30 +231,21 @@ static void cap11xx_input_close(struct input_dev *idev) + } + + #ifdef CONFIG_LEDS_CLASS +-static void cap11xx_led_work(struct work_struct *work) ++static int cap11xx_led_set(struct led_classdev *cdev, ++ enum led_brightness value) + { +- struct cap11xx_led *led = container_of(work, struct cap11xx_led, work); ++ struct cap11xx_led *led = container_of(cdev, struct cap11xx_led, cdev); + struct cap11xx_priv *priv = led->priv; +- int value = led->new_brightness; + + /* +- * All LEDs share the same duty cycle as this is a HW limitation. +- * Brightness levels per LED are either 0 (OFF) and 1 (ON). ++ * All LEDs share the same duty cycle as this is a HW ++ * limitation. Brightness levels per LED are either ++ * 0 (OFF) and 1 (ON). + */ +- regmap_update_bits(priv->regmap, CAP11XX_REG_LED_OUTPUT_CONTROL, +- BIT(led->reg), value ? BIT(led->reg) : 0); +-} +- +-static void cap11xx_led_set(struct led_classdev *cdev, +- enum led_brightness value) +-{ +- struct cap11xx_led *led = container_of(cdev, struct cap11xx_led, cdev); +- +- if (led->new_brightness == value) +- return; +- +- led->new_brightness = value; +- schedule_work(&led->work); ++ return regmap_update_bits(priv->regmap, ++ CAP11XX_REG_LED_OUTPUT_CONTROL, ++ BIT(led->reg), ++ value ? BIT(led->reg) : 0); + } + + static int cap11xx_init_leds(struct device *dev, +@@ -299,7 +288,7 @@ static int cap11xx_init_leds(struct device *dev, + led->cdev.default_trigger = + of_get_property(child, "linux,default-trigger", NULL); + led->cdev.flags = 0; +- led->cdev.brightness_set = cap11xx_led_set; ++ led->cdev.brightness_set_blocking = cap11xx_led_set; + led->cdev.max_brightness = 1; + led->cdev.brightness = LED_OFF; + +@@ -312,8 +301,6 @@ static int cap11xx_init_leds(struct device *dev, + led->reg = reg; + led->priv = priv; + +- INIT_WORK(&led->work, cap11xx_led_work); +- + error = devm_led_classdev_register(dev, &led->cdev); + if (error) { + of_node_put(child); +diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c +index 403452ef00e6..3d1cb7bf5e35 100644 +--- a/drivers/input/keyboard/matrix_keypad.c ++++ b/drivers/input/keyboard/matrix_keypad.c +@@ -222,7 +222,7 @@ static void matrix_keypad_stop(struct input_dev *dev) + keypad->stopped = true; + spin_unlock_irq(&keypad->lock); + +- flush_work(&keypad->work.work); ++ flush_delayed_work(&keypad->work); + /* + * matrix_keypad_scan() will leave IRQs enabled; + * we should disable them now. +diff --git a/drivers/input/keyboard/st-keyscan.c b/drivers/input/keyboard/st-keyscan.c +index babcfb165e4f..3b85631fde91 100644 +--- a/drivers/input/keyboard/st-keyscan.c ++++ b/drivers/input/keyboard/st-keyscan.c +@@ -153,6 +153,8 @@ static int keyscan_probe(struct platform_device *pdev) + + input_dev->id.bustype = BUS_HOST; + ++ keypad_data->input_dev = input_dev; ++ + error = keypad_matrix_key_parse_dt(keypad_data); + if (error) + return error; +@@ -168,8 +170,6 @@ static int keyscan_probe(struct platform_device *pdev) + + input_set_drvdata(input_dev, keypad_data); + +- keypad_data->input_dev = input_dev; +- + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + keypad_data->base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(keypad_data->base)) +diff --git a/drivers/input/misc/pwm-vibra.c b/drivers/input/misc/pwm-vibra.c +index 55da191ae550..dbb6d9e1b947 100644 +--- a/drivers/input/misc/pwm-vibra.c ++++ b/drivers/input/misc/pwm-vibra.c +@@ -34,6 +34,7 @@ struct pwm_vibrator { + struct work_struct play_work; + u16 level; + u32 direction_duty_cycle; ++ bool vcc_on; + }; + + static int pwm_vibrator_start(struct pwm_vibrator *vibrator) +@@ -42,10 +43,13 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator) + struct pwm_state state; + int err; + +- err = regulator_enable(vibrator->vcc); +- if (err) { +- dev_err(pdev, "failed to enable regulator: %d", err); +- return err; ++ if (!vibrator->vcc_on) { ++ err = regulator_enable(vibrator->vcc); ++ if (err) { ++ dev_err(pdev, "failed to enable regulator: %d", err); ++ return err; ++ } ++ vibrator->vcc_on = true; + } + + pwm_get_state(vibrator->pwm, &state); +@@ -76,11 +80,14 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator) + + static void pwm_vibrator_stop(struct pwm_vibrator *vibrator) + { +- regulator_disable(vibrator->vcc); +- + if (vibrator->pwm_dir) + pwm_disable(vibrator->pwm_dir); + pwm_disable(vibrator->pwm); ++ ++ if (vibrator->vcc_on) { ++ regulator_disable(vibrator->vcc); ++ vibrator->vcc_on = false; ++ } + } + + static void pwm_vibrator_play_work(struct work_struct *work) +diff --git a/drivers/input/serio/ps2-gpio.c b/drivers/input/serio/ps2-gpio.c +index c62cceb97bb1..5e8d8384aa2a 100644 +--- a/drivers/input/serio/ps2-gpio.c ++++ b/drivers/input/serio/ps2-gpio.c +@@ -76,6 +76,7 @@ static void ps2_gpio_close(struct serio *serio) + { + struct ps2_gpio_data *drvdata = serio->port_data; + ++ flush_delayed_work(&drvdata->tx_work); + disable_irq(drvdata->irq); + } + +diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c +index 0e65f609352e..83364fedbf0a 100644 +--- a/drivers/irqchip/irq-brcmstb-l2.c ++++ b/drivers/irqchip/irq-brcmstb-l2.c +@@ -129,8 +129,9 @@ static void brcmstb_l2_intc_suspend(struct irq_data *d) + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct irq_chip_type *ct = irq_data_get_chip_type(d); + struct brcmstb_l2_intc_data *b = gc->private; ++ unsigned long flags; + +- irq_gc_lock(gc); ++ irq_gc_lock_irqsave(gc, flags); + /* Save the current mask */ + b->saved_mask = irq_reg_readl(gc, ct->regs.mask); + +@@ -139,7 +140,7 @@ static void brcmstb_l2_intc_suspend(struct irq_data *d) + irq_reg_writel(gc, ~gc->wake_active, ct->regs.disable); + irq_reg_writel(gc, gc->wake_active, ct->regs.enable); + } +- irq_gc_unlock(gc); ++ irq_gc_unlock_irqrestore(gc, flags); + } + + static void brcmstb_l2_intc_resume(struct irq_data *d) +@@ -147,8 +148,9 @@ static void brcmstb_l2_intc_resume(struct irq_data *d) + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct irq_chip_type *ct = irq_data_get_chip_type(d); + struct brcmstb_l2_intc_data *b = gc->private; ++ unsigned long flags; + +- irq_gc_lock(gc); ++ irq_gc_lock_irqsave(gc, flags); + if (ct->chip.irq_ack) { + /* Clear unmasked non-wakeup interrupts */ + irq_reg_writel(gc, ~b->saved_mask & ~gc->wake_active, +@@ -158,7 +160,7 @@ static void brcmstb_l2_intc_resume(struct irq_data *d) + /* Restore the saved mask */ + irq_reg_writel(gc, b->saved_mask, ct->regs.disable); + irq_reg_writel(gc, ~b->saved_mask, ct->regs.enable); +- irq_gc_unlock(gc); ++ irq_gc_unlock_irqrestore(gc, flags); + } + + static int __init brcmstb_l2_intc_of_init(struct device_node *np, +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index 15579cba1a88..78970cdf2ef6 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -1893,6 +1893,8 @@ static int its_alloc_tables(struct its_node *its) + indirect = its_parse_indirect_baser(its, baser, + psz, &order, + its->device_ids); ++ break; ++ + case GITS_BASER_TYPE_VCPU: + indirect = its_parse_indirect_baser(its, baser, + psz, &order, +diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c +index 8ab077ff58f4..96bcabfebc23 100644 +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -1396,9 +1396,9 @@ static void flexrm_shutdown(struct mbox_chan *chan) + + /* Clear ring flush state */ + timeout = 1000; /* timeout of 1s */ +- writel_relaxed(0x0, ring + RING_CONTROL); ++ writel_relaxed(0x0, ring->regs + RING_CONTROL); + do { +- if (!(readl_relaxed(ring + RING_FLUSH_DONE) & ++ if (!(readl_relaxed(ring->regs + RING_FLUSH_DONE) & + FLUSH_DONE_MASK)) + break; + mdelay(1); +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index 22944aa7d8e5..4ca3e3d3f9c7 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -392,10 +392,11 @@ static bool check_should_bypass(struct cached_dev *dc, struct bio *bio) + + /* + * Flag for bypass if the IO is for read-ahead or background, +- * unless the read-ahead request is for metadata (eg, for gfs2). ++ * unless the read-ahead request is for metadata ++ * (eg, for gfs2 or xfs). + */ + if (bio->bi_opf & (REQ_RAHEAD|REQ_BACKGROUND) && +- !(bio->bi_opf & REQ_META)) ++ !(bio->bi_opf & (REQ_META|REQ_PRIO))) + goto skip; + + if (bio->bi_iter.bi_sector & (c->sb.block_size - 1) || +@@ -877,7 +878,7 @@ static int cached_dev_cache_miss(struct btree *b, struct search *s, + } + + if (!(bio->bi_opf & REQ_RAHEAD) && +- !(bio->bi_opf & REQ_META) && ++ !(bio->bi_opf & (REQ_META|REQ_PRIO)) && + s->iop.c->gc_stats.in_use < CUTOFF_CACHE_READA) + reada = min_t(sector_t, dc->readahead >> 9, + get_capacity(bio->bi_disk) - bio_end_sector(bio)); +diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h +index d2b9fdbc8994..e75dc33339f6 100644 +--- a/drivers/md/bcache/writeback.h ++++ b/drivers/md/bcache/writeback.h +@@ -63,6 +63,9 @@ static inline bool should_writeback(struct cached_dev *dc, struct bio *bio, + in_use > CUTOFF_WRITEBACK_SYNC) + return false; + ++ if (bio_op(bio) == REQ_OP_DISCARD) ++ return false; ++ + if (dc->partial_stripes_expensive && + bcache_dev_stripe_dirty(dc, bio->bi_iter.bi_sector, + bio_sectors(bio))) +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index e1fa6baf4e8e..96d5fb3f6199 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -1357,8 +1357,8 @@ again: + checksums_ptr - checksums, !dio->write ? TAG_CMP : TAG_WRITE); + if (unlikely(r)) { + if (r > 0) { +- DMERR("Checksum failed at sector 0x%llx", +- (unsigned long long)(sector - ((r + ic->tag_size - 1) / ic->tag_size))); ++ DMERR_LIMIT("Checksum failed at sector 0x%llx", ++ (unsigned long long)(sector - ((r + ic->tag_size - 1) / ic->tag_size))); + r = -EILSEQ; + atomic64_inc(&ic->number_of_mismatches); + } +@@ -1550,8 +1550,8 @@ retry_kmap: + + integrity_sector_checksum(ic, logical_sector, mem + bv.bv_offset, checksums_onstack); + if (unlikely(memcmp(checksums_onstack, journal_entry_tag(ic, je), ic->tag_size))) { +- DMERR("Checksum failed when reading from journal, at sector 0x%llx", +- (unsigned long long)logical_sector); ++ DMERR_LIMIT("Checksum failed when reading from journal, at sector 0x%llx", ++ (unsigned long long)logical_sector); + } + } + #endif +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 9df1334608b7..25e97de36717 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3959,6 +3959,8 @@ static int raid10_run(struct mddev *mddev) + set_bit(MD_RECOVERY_RUNNING, &mddev->recovery); + mddev->sync_thread = md_register_thread(md_do_sync, mddev, + "reshape"); ++ if (!mddev->sync_thread) ++ goto out_free_conf; + } + + return 0; +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 45a3551d3afd..ae38895c44b2 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -7390,6 +7390,8 @@ static int raid5_run(struct mddev *mddev) + set_bit(MD_RECOVERY_RUNNING, &mddev->recovery); + mddev->sync_thread = md_register_thread(md_do_sync, mddev, + "reshape"); ++ if (!mddev->sync_thread) ++ goto abort; + } + + /* Ok, everything is just fine now */ +diff --git a/drivers/media/common/videobuf2/videobuf2-v4l2.c b/drivers/media/common/videobuf2/videobuf2-v4l2.c +index 886a2d8d5c6c..9d4a81bb0e59 100644 +--- a/drivers/media/common/videobuf2/videobuf2-v4l2.c ++++ b/drivers/media/common/videobuf2/videobuf2-v4l2.c +@@ -145,7 +145,6 @@ static void vb2_warn_zero_bytesused(struct vb2_buffer *vb) + return; + + check_once = true; +- WARN_ON(1); + + pr_warn("use of bytesused == 0 is deprecated and will be removed in the future,\n"); + if (vb->vb2_queue->allow_zero_bytesused) +diff --git a/drivers/media/dvb-frontends/lgdt330x.c b/drivers/media/dvb-frontends/lgdt330x.c +index 10d584ce538d..9ee1c1360ab8 100644 +--- a/drivers/media/dvb-frontends/lgdt330x.c ++++ b/drivers/media/dvb-frontends/lgdt330x.c +@@ -783,7 +783,7 @@ static int lgdt3303_read_status(struct dvb_frontend *fe, + + if ((buf[0] & 0x02) == 0x00) + *status |= FE_HAS_SYNC; +- if ((buf[0] & 0xfd) == 0x01) ++ if ((buf[0] & 0x01) == 0x01) + *status |= FE_HAS_VITERBI | FE_HAS_LOCK; + break; + default: +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 8e7a2a59cd32..d5c0ffc55d46 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -1759,7 +1759,7 @@ static void ov5640_reset(struct ov5640_dev *sensor) + usleep_range(1000, 2000); + + gpiod_set_value_cansleep(sensor->reset_gpio, 0); +- usleep_range(5000, 10000); ++ usleep_range(20000, 25000); + } + + static int ov5640_set_power_on(struct ov5640_dev *sensor) +diff --git a/drivers/media/platform/vimc/Makefile b/drivers/media/platform/vimc/Makefile +index 4b2e3de7856e..c4fc8e7d365a 100644 +--- a/drivers/media/platform/vimc/Makefile ++++ b/drivers/media/platform/vimc/Makefile +@@ -5,6 +5,7 @@ vimc_common-objs := vimc-common.o + vimc_debayer-objs := vimc-debayer.o + vimc_scaler-objs := vimc-scaler.o + vimc_sensor-objs := vimc-sensor.o ++vimc_streamer-objs := vimc-streamer.o + + obj-$(CONFIG_VIDEO_VIMC) += vimc.o vimc_capture.o vimc_common.o vimc-debayer.o \ +- vimc_scaler.o vimc_sensor.o ++ vimc_scaler.o vimc_sensor.o vimc_streamer.o +diff --git a/drivers/media/platform/vimc/vimc-capture.c b/drivers/media/platform/vimc/vimc-capture.c +index ec68feaac378..65d657daf66f 100644 +--- a/drivers/media/platform/vimc/vimc-capture.c ++++ b/drivers/media/platform/vimc/vimc-capture.c +@@ -24,6 +24,7 @@ + #include + + #include "vimc-common.h" ++#include "vimc-streamer.h" + + #define VIMC_CAP_DRV_NAME "vimc-capture" + +@@ -44,7 +45,7 @@ struct vimc_cap_device { + spinlock_t qlock; + struct mutex lock; + u32 sequence; +- struct media_pipeline pipe; ++ struct vimc_stream stream; + }; + + static const struct v4l2_pix_format fmt_default = { +@@ -248,14 +249,13 @@ static int vimc_cap_start_streaming(struct vb2_queue *vq, unsigned int count) + vcap->sequence = 0; + + /* Start the media pipeline */ +- ret = media_pipeline_start(entity, &vcap->pipe); ++ ret = media_pipeline_start(entity, &vcap->stream.pipe); + if (ret) { + vimc_cap_return_all_buffers(vcap, VB2_BUF_STATE_QUEUED); + return ret; + } + +- /* Enable streaming from the pipe */ +- ret = vimc_pipeline_s_stream(&vcap->vdev.entity, 1); ++ ret = vimc_streamer_s_stream(&vcap->stream, &vcap->ved, 1); + if (ret) { + media_pipeline_stop(entity); + vimc_cap_return_all_buffers(vcap, VB2_BUF_STATE_QUEUED); +@@ -273,8 +273,7 @@ static void vimc_cap_stop_streaming(struct vb2_queue *vq) + { + struct vimc_cap_device *vcap = vb2_get_drv_priv(vq); + +- /* Disable streaming from the pipe */ +- vimc_pipeline_s_stream(&vcap->vdev.entity, 0); ++ vimc_streamer_s_stream(&vcap->stream, &vcap->ved, 0); + + /* Stop the media pipeline */ + media_pipeline_stop(&vcap->vdev.entity); +@@ -355,8 +354,8 @@ static void vimc_cap_comp_unbind(struct device *comp, struct device *master, + kfree(vcap); + } + +-static void vimc_cap_process_frame(struct vimc_ent_device *ved, +- struct media_pad *sink, const void *frame) ++static void *vimc_cap_process_frame(struct vimc_ent_device *ved, ++ const void *frame) + { + struct vimc_cap_device *vcap = container_of(ved, struct vimc_cap_device, + ved); +@@ -370,7 +369,7 @@ static void vimc_cap_process_frame(struct vimc_ent_device *ved, + typeof(*vimc_buf), list); + if (!vimc_buf) { + spin_unlock(&vcap->qlock); +- return; ++ return ERR_PTR(-EAGAIN); + } + + /* Remove this entry from the list */ +@@ -391,6 +390,7 @@ static void vimc_cap_process_frame(struct vimc_ent_device *ved, + vb2_set_plane_payload(&vimc_buf->vb2.vb2_buf, 0, + vcap->format.sizeimage); + vb2_buffer_done(&vimc_buf->vb2.vb2_buf, VB2_BUF_STATE_DONE); ++ return NULL; + } + + static int vimc_cap_comp_bind(struct device *comp, struct device *master, +diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c +index 617415c224fe..204aa6f554e4 100644 +--- a/drivers/media/platform/vimc/vimc-common.c ++++ b/drivers/media/platform/vimc/vimc-common.c +@@ -207,41 +207,6 @@ const struct vimc_pix_map *vimc_pix_map_by_pixelformat(u32 pixelformat) + } + EXPORT_SYMBOL_GPL(vimc_pix_map_by_pixelformat); + +-int vimc_propagate_frame(struct media_pad *src, const void *frame) +-{ +- struct media_link *link; +- +- if (!(src->flags & MEDIA_PAD_FL_SOURCE)) +- return -EINVAL; +- +- /* Send this frame to all sink pads that are direct linked */ +- list_for_each_entry(link, &src->entity->links, list) { +- if (link->source == src && +- (link->flags & MEDIA_LNK_FL_ENABLED)) { +- struct vimc_ent_device *ved = NULL; +- struct media_entity *entity = link->sink->entity; +- +- if (is_media_entity_v4l2_subdev(entity)) { +- struct v4l2_subdev *sd = +- container_of(entity, struct v4l2_subdev, +- entity); +- ved = v4l2_get_subdevdata(sd); +- } else if (is_media_entity_v4l2_video_device(entity)) { +- struct video_device *vdev = +- container_of(entity, +- struct video_device, +- entity); +- ved = video_get_drvdata(vdev); +- } +- if (ved && ved->process_frame) +- ved->process_frame(ved, link->sink, frame); +- } +- } +- +- return 0; +-} +-EXPORT_SYMBOL_GPL(vimc_propagate_frame); +- + /* Helper function to allocate and initialize pads */ + struct media_pad *vimc_pads_init(u16 num_pads, const unsigned long *pads_flag) + { +diff --git a/drivers/media/platform/vimc/vimc-common.h b/drivers/media/platform/vimc/vimc-common.h +index 2e9981b18166..6ed969d9efbb 100644 +--- a/drivers/media/platform/vimc/vimc-common.h ++++ b/drivers/media/platform/vimc/vimc-common.h +@@ -113,23 +113,12 @@ struct vimc_pix_map { + struct vimc_ent_device { + struct media_entity *ent; + struct media_pad *pads; +- void (*process_frame)(struct vimc_ent_device *ved, +- struct media_pad *sink, const void *frame); ++ void * (*process_frame)(struct vimc_ent_device *ved, ++ const void *frame); + void (*vdev_get_format)(struct vimc_ent_device *ved, + struct v4l2_pix_format *fmt); + }; + +-/** +- * vimc_propagate_frame - propagate a frame through the topology +- * +- * @src: the source pad where the frame is being originated +- * @frame: the frame to be propagated +- * +- * This function will call the process_frame callback from the vimc_ent_device +- * struct of the nodes directly connected to the @src pad +- */ +-int vimc_propagate_frame(struct media_pad *src, const void *frame); +- + /** + * vimc_pads_init - initialize pads + * +diff --git a/drivers/media/platform/vimc/vimc-debayer.c b/drivers/media/platform/vimc/vimc-debayer.c +index 77887f66f323..7d77c63b99d2 100644 +--- a/drivers/media/platform/vimc/vimc-debayer.c ++++ b/drivers/media/platform/vimc/vimc-debayer.c +@@ -321,7 +321,6 @@ static void vimc_deb_set_rgb_mbus_fmt_rgb888_1x24(struct vimc_deb_device *vdeb, + static int vimc_deb_s_stream(struct v4l2_subdev *sd, int enable) + { + struct vimc_deb_device *vdeb = v4l2_get_subdevdata(sd); +- int ret; + + if (enable) { + const struct vimc_pix_map *vpix; +@@ -351,22 +350,10 @@ static int vimc_deb_s_stream(struct v4l2_subdev *sd, int enable) + if (!vdeb->src_frame) + return -ENOMEM; + +- /* Turn the stream on in the subdevices directly connected */ +- ret = vimc_pipeline_s_stream(&vdeb->sd.entity, 1); +- if (ret) { +- vfree(vdeb->src_frame); +- vdeb->src_frame = NULL; +- return ret; +- } + } else { + if (!vdeb->src_frame) + return 0; + +- /* Disable streaming from the pipe */ +- ret = vimc_pipeline_s_stream(&vdeb->sd.entity, 0); +- if (ret) +- return ret; +- + vfree(vdeb->src_frame); + vdeb->src_frame = NULL; + } +@@ -480,9 +467,8 @@ static void vimc_deb_calc_rgb_sink(struct vimc_deb_device *vdeb, + } + } + +-static void vimc_deb_process_frame(struct vimc_ent_device *ved, +- struct media_pad *sink, +- const void *sink_frame) ++static void *vimc_deb_process_frame(struct vimc_ent_device *ved, ++ const void *sink_frame) + { + struct vimc_deb_device *vdeb = container_of(ved, struct vimc_deb_device, + ved); +@@ -491,7 +477,7 @@ static void vimc_deb_process_frame(struct vimc_ent_device *ved, + + /* If the stream in this node is not active, just return */ + if (!vdeb->src_frame) +- return; ++ return ERR_PTR(-EINVAL); + + for (i = 0; i < vdeb->sink_fmt.height; i++) + for (j = 0; j < vdeb->sink_fmt.width; j++) { +@@ -499,12 +485,8 @@ static void vimc_deb_process_frame(struct vimc_ent_device *ved, + vdeb->set_rgb_src(vdeb, i, j, rgb); + } + +- /* Propagate the frame through all source pads */ +- for (i = 1; i < vdeb->sd.entity.num_pads; i++) { +- struct media_pad *pad = &vdeb->sd.entity.pads[i]; ++ return vdeb->src_frame; + +- vimc_propagate_frame(pad, vdeb->src_frame); +- } + } + + static void vimc_deb_comp_unbind(struct device *comp, struct device *master, +diff --git a/drivers/media/platform/vimc/vimc-scaler.c b/drivers/media/platform/vimc/vimc-scaler.c +index b0952ee86296..39b2a73dfcc1 100644 +--- a/drivers/media/platform/vimc/vimc-scaler.c ++++ b/drivers/media/platform/vimc/vimc-scaler.c +@@ -217,7 +217,6 @@ static const struct v4l2_subdev_pad_ops vimc_sca_pad_ops = { + static int vimc_sca_s_stream(struct v4l2_subdev *sd, int enable) + { + struct vimc_sca_device *vsca = v4l2_get_subdevdata(sd); +- int ret; + + if (enable) { + const struct vimc_pix_map *vpix; +@@ -245,22 +244,10 @@ static int vimc_sca_s_stream(struct v4l2_subdev *sd, int enable) + if (!vsca->src_frame) + return -ENOMEM; + +- /* Turn the stream on in the subdevices directly connected */ +- ret = vimc_pipeline_s_stream(&vsca->sd.entity, 1); +- if (ret) { +- vfree(vsca->src_frame); +- vsca->src_frame = NULL; +- return ret; +- } + } else { + if (!vsca->src_frame) + return 0; + +- /* Disable streaming from the pipe */ +- ret = vimc_pipeline_s_stream(&vsca->sd.entity, 0); +- if (ret) +- return ret; +- + vfree(vsca->src_frame); + vsca->src_frame = NULL; + } +@@ -346,26 +333,19 @@ static void vimc_sca_fill_src_frame(const struct vimc_sca_device *const vsca, + vimc_sca_scale_pix(vsca, i, j, sink_frame); + } + +-static void vimc_sca_process_frame(struct vimc_ent_device *ved, +- struct media_pad *sink, +- const void *sink_frame) ++static void *vimc_sca_process_frame(struct vimc_ent_device *ved, ++ const void *sink_frame) + { + struct vimc_sca_device *vsca = container_of(ved, struct vimc_sca_device, + ved); +- unsigned int i; + + /* If the stream in this node is not active, just return */ + if (!vsca->src_frame) +- return; ++ return ERR_PTR(-EINVAL); + + vimc_sca_fill_src_frame(vsca, sink_frame); + +- /* Propagate the frame through all source pads */ +- for (i = 1; i < vsca->sd.entity.num_pads; i++) { +- struct media_pad *pad = &vsca->sd.entity.pads[i]; +- +- vimc_propagate_frame(pad, vsca->src_frame); +- } ++ return vsca->src_frame; + }; + + static void vimc_sca_comp_unbind(struct device *comp, struct device *master, +diff --git a/drivers/media/platform/vimc/vimc-sensor.c b/drivers/media/platform/vimc/vimc-sensor.c +index b2b89315e7ba..9e0d70e9f119 100644 +--- a/drivers/media/platform/vimc/vimc-sensor.c ++++ b/drivers/media/platform/vimc/vimc-sensor.c +@@ -16,8 +16,6 @@ + */ + + #include +-#include +-#include + #include + #include + #include +@@ -201,38 +199,27 @@ static const struct v4l2_subdev_pad_ops vimc_sen_pad_ops = { + .set_fmt = vimc_sen_set_fmt, + }; + +-static int vimc_sen_tpg_thread(void *data) ++static void *vimc_sen_process_frame(struct vimc_ent_device *ved, ++ const void *sink_frame) + { +- struct vimc_sen_device *vsen = data; +- unsigned int i; +- +- set_freezable(); +- set_current_state(TASK_UNINTERRUPTIBLE); +- +- for (;;) { +- try_to_freeze(); +- if (kthread_should_stop()) +- break; +- +- tpg_fill_plane_buffer(&vsen->tpg, 0, 0, vsen->frame); ++ struct vimc_sen_device *vsen = container_of(ved, struct vimc_sen_device, ++ ved); ++ const struct vimc_pix_map *vpix; ++ unsigned int frame_size; + +- /* Send the frame to all source pads */ +- for (i = 0; i < vsen->sd.entity.num_pads; i++) +- vimc_propagate_frame(&vsen->sd.entity.pads[i], +- vsen->frame); ++ /* Calculate the frame size */ ++ vpix = vimc_pix_map_by_code(vsen->mbus_format.code); ++ frame_size = vsen->mbus_format.width * vpix->bpp * ++ vsen->mbus_format.height; + +- /* 60 frames per second */ +- schedule_timeout(HZ/60); +- } +- +- return 0; ++ tpg_fill_plane_buffer(&vsen->tpg, 0, 0, vsen->frame); ++ return vsen->frame; + } + + static int vimc_sen_s_stream(struct v4l2_subdev *sd, int enable) + { + struct vimc_sen_device *vsen = + container_of(sd, struct vimc_sen_device, sd); +- int ret; + + if (enable) { + const struct vimc_pix_map *vpix; +@@ -258,26 +245,8 @@ static int vimc_sen_s_stream(struct v4l2_subdev *sd, int enable) + /* configure the test pattern generator */ + vimc_sen_tpg_s_format(vsen); + +- /* Initialize the image generator thread */ +- vsen->kthread_sen = kthread_run(vimc_sen_tpg_thread, vsen, +- "%s-sen", vsen->sd.v4l2_dev->name); +- if (IS_ERR(vsen->kthread_sen)) { +- dev_err(vsen->dev, "%s: kernel_thread() failed\n", +- vsen->sd.name); +- vfree(vsen->frame); +- vsen->frame = NULL; +- return PTR_ERR(vsen->kthread_sen); +- } + } else { +- if (!vsen->kthread_sen) +- return 0; +- +- /* Stop image generator */ +- ret = kthread_stop(vsen->kthread_sen); +- if (ret) +- return ret; + +- vsen->kthread_sen = NULL; + vfree(vsen->frame); + vsen->frame = NULL; + return 0; +@@ -393,6 +362,7 @@ static int vimc_sen_comp_bind(struct device *comp, struct device *master, + if (ret) + goto err_free_hdl; + ++ vsen->ved.process_frame = vimc_sen_process_frame; + dev_set_drvdata(comp, &vsen->ved); + vsen->dev = comp; + +diff --git a/drivers/media/platform/vimc/vimc-streamer.c b/drivers/media/platform/vimc/vimc-streamer.c +new file mode 100644 +index 000000000000..fcc897fb247b +--- /dev/null ++++ b/drivers/media/platform/vimc/vimc-streamer.c +@@ -0,0 +1,188 @@ ++// SPDX-License-Identifier: GPL-2.0+ ++/* ++ * vimc-streamer.c Virtual Media Controller Driver ++ * ++ * Copyright (C) 2018 Lucas A. M. Magalhães ++ * ++ */ ++ ++#include ++#include ++#include ++#include ++ ++#include "vimc-streamer.h" ++ ++/** ++ * vimc_get_source_entity - get the entity connected with the first sink pad ++ * ++ * @ent: reference media_entity ++ * ++ * Helper function that returns the media entity containing the source pad ++ * linked with the first sink pad from the given media entity pad list. ++ */ ++static struct media_entity *vimc_get_source_entity(struct media_entity *ent) ++{ ++ struct media_pad *pad; ++ int i; ++ ++ for (i = 0; i < ent->num_pads; i++) { ++ if (ent->pads[i].flags & MEDIA_PAD_FL_SOURCE) ++ continue; ++ pad = media_entity_remote_pad(&ent->pads[i]); ++ return pad ? pad->entity : NULL; ++ } ++ return NULL; ++} ++ ++/* ++ * vimc_streamer_pipeline_terminate - Disable stream in all ved in stream ++ * ++ * @stream: the pointer to the stream structure with the pipeline to be ++ * disabled. ++ * ++ * Calls s_stream to disable the stream in each entity of the pipeline ++ * ++ */ ++static void vimc_streamer_pipeline_terminate(struct vimc_stream *stream) ++{ ++ struct media_entity *entity; ++ struct v4l2_subdev *sd; ++ ++ while (stream->pipe_size) { ++ stream->pipe_size--; ++ entity = stream->ved_pipeline[stream->pipe_size]->ent; ++ entity = vimc_get_source_entity(entity); ++ stream->ved_pipeline[stream->pipe_size] = NULL; ++ ++ if (!is_media_entity_v4l2_subdev(entity)) ++ continue; ++ ++ sd = media_entity_to_v4l2_subdev(entity); ++ v4l2_subdev_call(sd, video, s_stream, 0); ++ } ++} ++ ++/* ++ * vimc_streamer_pipeline_init - initializes the stream structure ++ * ++ * @stream: the pointer to the stream structure to be initialized ++ * @ved: the pointer to the vimc entity initializing the stream ++ * ++ * Initializes the stream structure. Walks through the entity graph to ++ * construct the pipeline used later on the streamer thread. ++ * Calls s_stream to enable stream in all entities of the pipeline. ++ */ ++static int vimc_streamer_pipeline_init(struct vimc_stream *stream, ++ struct vimc_ent_device *ved) ++{ ++ struct media_entity *entity; ++ struct video_device *vdev; ++ struct v4l2_subdev *sd; ++ int ret = 0; ++ ++ stream->pipe_size = 0; ++ while (stream->pipe_size < VIMC_STREAMER_PIPELINE_MAX_SIZE) { ++ if (!ved) { ++ vimc_streamer_pipeline_terminate(stream); ++ return -EINVAL; ++ } ++ stream->ved_pipeline[stream->pipe_size++] = ved; ++ ++ entity = vimc_get_source_entity(ved->ent); ++ /* Check if the end of the pipeline was reached*/ ++ if (!entity) ++ return 0; ++ ++ if (is_media_entity_v4l2_subdev(entity)) { ++ sd = media_entity_to_v4l2_subdev(entity); ++ ret = v4l2_subdev_call(sd, video, s_stream, 1); ++ if (ret && ret != -ENOIOCTLCMD) { ++ vimc_streamer_pipeline_terminate(stream); ++ return ret; ++ } ++ ved = v4l2_get_subdevdata(sd); ++ } else { ++ vdev = container_of(entity, ++ struct video_device, ++ entity); ++ ved = video_get_drvdata(vdev); ++ } ++ } ++ ++ vimc_streamer_pipeline_terminate(stream); ++ return -EINVAL; ++} ++ ++static int vimc_streamer_thread(void *data) ++{ ++ struct vimc_stream *stream = data; ++ int i; ++ ++ set_freezable(); ++ set_current_state(TASK_UNINTERRUPTIBLE); ++ ++ for (;;) { ++ try_to_freeze(); ++ if (kthread_should_stop()) ++ break; ++ ++ for (i = stream->pipe_size - 1; i >= 0; i--) { ++ stream->frame = stream->ved_pipeline[i]->process_frame( ++ stream->ved_pipeline[i], ++ stream->frame); ++ if (!stream->frame) ++ break; ++ if (IS_ERR(stream->frame)) ++ break; ++ } ++ //wait for 60hz ++ schedule_timeout(HZ / 60); ++ } ++ ++ return 0; ++} ++ ++int vimc_streamer_s_stream(struct vimc_stream *stream, ++ struct vimc_ent_device *ved, ++ int enable) ++{ ++ int ret; ++ ++ if (!stream || !ved) ++ return -EINVAL; ++ ++ if (enable) { ++ if (stream->kthread) ++ return 0; ++ ++ ret = vimc_streamer_pipeline_init(stream, ved); ++ if (ret) ++ return ret; ++ ++ stream->kthread = kthread_run(vimc_streamer_thread, stream, ++ "vimc-streamer thread"); ++ ++ if (IS_ERR(stream->kthread)) ++ return PTR_ERR(stream->kthread); ++ ++ } else { ++ if (!stream->kthread) ++ return 0; ++ ++ ret = kthread_stop(stream->kthread); ++ if (ret) ++ return ret; ++ ++ stream->kthread = NULL; ++ ++ vimc_streamer_pipeline_terminate(stream); ++ } ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(vimc_streamer_s_stream); ++ ++MODULE_DESCRIPTION("Virtual Media Controller Driver (VIMC) Streamer"); ++MODULE_AUTHOR("Lucas A. M. Magalhães "); ++MODULE_LICENSE("GPL"); +diff --git a/drivers/media/platform/vimc/vimc-streamer.h b/drivers/media/platform/vimc/vimc-streamer.h +new file mode 100644 +index 000000000000..752af2e2d5a2 +--- /dev/null ++++ b/drivers/media/platform/vimc/vimc-streamer.h +@@ -0,0 +1,38 @@ ++/* SPDX-License-Identifier: GPL-2.0+ */ ++/* ++ * vimc-streamer.h Virtual Media Controller Driver ++ * ++ * Copyright (C) 2018 Lucas A. M. Magalhães ++ * ++ */ ++ ++#ifndef _VIMC_STREAMER_H_ ++#define _VIMC_STREAMER_H_ ++ ++#include ++ ++#include "vimc-common.h" ++ ++#define VIMC_STREAMER_PIPELINE_MAX_SIZE 16 ++ ++struct vimc_stream { ++ struct media_pipeline pipe; ++ struct vimc_ent_device *ved_pipeline[VIMC_STREAMER_PIPELINE_MAX_SIZE]; ++ unsigned int pipe_size; ++ u8 *frame; ++ struct task_struct *kthread; ++}; ++ ++/** ++ * vimc_streamer_s_streamer - start/stop the stream ++ * ++ * @stream: the pointer to the stream to start or stop ++ * @ved: The last entity of the streamer pipeline ++ * @enable: any non-zero number start the stream, zero stop ++ * ++ */ ++int vimc_streamer_s_stream(struct vimc_stream *stream, ++ struct vimc_ent_device *ved, ++ int enable); ++ ++#endif //_VIMC_STREAMER_H_ +diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c +index 86a99f461fd8..ffffb66d51a0 100644 +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -676,6 +676,14 @@ void uvc_video_clock_update(struct uvc_streaming *stream, + if (!uvc_hw_timestamps_param) + return; + ++ /* ++ * We will get called from __vb2_queue_cancel() if there are buffers ++ * done but not dequeued by the user, but the sample array has already ++ * been released at that time. Just bail out in that case. ++ */ ++ if (!clock->samples) ++ return; ++ + spin_lock_irqsave(&clock->lock, flags); + + if (clock->count < clock->size) +diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c +index a530972c5a7e..e0173bf4b0dc 100644 +--- a/drivers/mfd/sm501.c ++++ b/drivers/mfd/sm501.c +@@ -1145,6 +1145,9 @@ static int sm501_register_gpio_i2c_instance(struct sm501_devdata *sm, + lookup = devm_kzalloc(&pdev->dev, + sizeof(*lookup) + 3 * sizeof(struct gpiod_lookup), + GFP_KERNEL); ++ if (!lookup) ++ return -ENOMEM; ++ + lookup->dev_id = "i2c-gpio"; + if (iic->pin_sda < 32) + lookup->table[0].chip_label = "SM501-LOW"; +diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c +index 3bc0c15d4d85..b83a373e3a8d 100644 +--- a/drivers/misc/cxl/guest.c ++++ b/drivers/misc/cxl/guest.c +@@ -267,6 +267,7 @@ static int guest_reset(struct cxl *adapter) + int i, rc; + + pr_devel("Adapter reset request\n"); ++ spin_lock(&adapter->afu_list_lock); + for (i = 0; i < adapter->slices; i++) { + if ((afu = adapter->afu[i])) { + pci_error_handlers(afu, CXL_ERROR_DETECTED_EVENT, +@@ -283,6 +284,7 @@ static int guest_reset(struct cxl *adapter) + pci_error_handlers(afu, CXL_RESUME_EVENT, 0); + } + } ++ spin_unlock(&adapter->afu_list_lock); + return rc; + } + +diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c +index b66d832d3233..787a69a2a726 100644 +--- a/drivers/misc/cxl/pci.c ++++ b/drivers/misc/cxl/pci.c +@@ -1807,7 +1807,7 @@ static pci_ers_result_t cxl_vphb_error_detected(struct cxl_afu *afu, + /* There should only be one entry, but go through the list + * anyway + */ +- if (afu->phb == NULL) ++ if (afu == NULL || afu->phb == NULL) + return result; + + list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) { +@@ -1834,7 +1834,8 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev, + { + struct cxl *adapter = pci_get_drvdata(pdev); + struct cxl_afu *afu; +- pci_ers_result_t result = PCI_ERS_RESULT_NEED_RESET, afu_result; ++ pci_ers_result_t result = PCI_ERS_RESULT_NEED_RESET; ++ pci_ers_result_t afu_result = PCI_ERS_RESULT_NEED_RESET; + int i; + + /* At this point, we could still have an interrupt pending. +@@ -1845,6 +1846,7 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev, + + /* If we're permanently dead, give up. */ + if (state == pci_channel_io_perm_failure) { ++ spin_lock(&adapter->afu_list_lock); + for (i = 0; i < adapter->slices; i++) { + afu = adapter->afu[i]; + /* +@@ -1853,6 +1855,7 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev, + */ + cxl_vphb_error_detected(afu, state); + } ++ spin_unlock(&adapter->afu_list_lock); + return PCI_ERS_RESULT_DISCONNECT; + } + +@@ -1934,11 +1937,17 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev, + * * In slot_reset, free the old resources and allocate new ones. + * * In resume, clear the flag to allow things to start. + */ ++ ++ /* Make sure no one else changes the afu list */ ++ spin_lock(&adapter->afu_list_lock); ++ + for (i = 0; i < adapter->slices; i++) { + afu = adapter->afu[i]; + +- afu_result = cxl_vphb_error_detected(afu, state); ++ if (afu == NULL) ++ continue; + ++ afu_result = cxl_vphb_error_detected(afu, state); + cxl_context_detach_all(afu); + cxl_ops->afu_deactivate_mode(afu, afu->current_mode); + pci_deconfigure_afu(afu); +@@ -1950,6 +1959,7 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev, + (result == PCI_ERS_RESULT_NEED_RESET)) + result = PCI_ERS_RESULT_NONE; + } ++ spin_unlock(&adapter->afu_list_lock); + + /* should take the context lock here */ + if (cxl_adapter_context_lock(adapter) != 0) +@@ -1982,14 +1992,18 @@ static pci_ers_result_t cxl_pci_slot_reset(struct pci_dev *pdev) + */ + cxl_adapter_context_unlock(adapter); + ++ spin_lock(&adapter->afu_list_lock); + for (i = 0; i < adapter->slices; i++) { + afu = adapter->afu[i]; + ++ if (afu == NULL) ++ continue; ++ + if (pci_configure_afu(afu, adapter, pdev)) +- goto err; ++ goto err_unlock; + + if (cxl_afu_select_best_mode(afu)) +- goto err; ++ goto err_unlock; + + if (afu->phb == NULL) + continue; +@@ -2001,16 +2015,16 @@ static pci_ers_result_t cxl_pci_slot_reset(struct pci_dev *pdev) + ctx = cxl_get_context(afu_dev); + + if (ctx && cxl_release_context(ctx)) +- goto err; ++ goto err_unlock; + + ctx = cxl_dev_context_init(afu_dev); + if (IS_ERR(ctx)) +- goto err; ++ goto err_unlock; + + afu_dev->dev.archdata.cxl_ctx = ctx; + + if (cxl_ops->afu_check_and_enable(afu)) +- goto err; ++ goto err_unlock; + + afu_dev->error_state = pci_channel_io_normal; + +@@ -2031,8 +2045,13 @@ static pci_ers_result_t cxl_pci_slot_reset(struct pci_dev *pdev) + result = PCI_ERS_RESULT_DISCONNECT; + } + } ++ ++ spin_unlock(&adapter->afu_list_lock); + return result; + ++err_unlock: ++ spin_unlock(&adapter->afu_list_lock); ++ + err: + /* All the bits that happen in both error_detected and cxl_remove + * should be idempotent, so we don't need to worry about leaving a mix +@@ -2053,10 +2072,11 @@ static void cxl_pci_resume(struct pci_dev *pdev) + * This is not the place to be checking if everything came back up + * properly, because there's no return value: do that in slot_reset. + */ ++ spin_lock(&adapter->afu_list_lock); + for (i = 0; i < adapter->slices; i++) { + afu = adapter->afu[i]; + +- if (afu->phb == NULL) ++ if (afu == NULL || afu->phb == NULL) + continue; + + list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) { +@@ -2065,6 +2085,7 @@ static void cxl_pci_resume(struct pci_dev *pdev) + afu_dev->driver->err_handler->resume(afu_dev); + } + } ++ spin_unlock(&adapter->afu_list_lock); + } + + static const struct pci_error_handlers cxl_err_handler = { +diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c +index fc3872fe7b25..c383322ec2ba 100644 +--- a/drivers/misc/mei/bus.c ++++ b/drivers/misc/mei/bus.c +@@ -541,17 +541,9 @@ int mei_cldev_enable(struct mei_cl_device *cldev) + goto out; + } + +- if (!mei_cl_bus_module_get(cldev)) { +- dev_err(&cldev->dev, "get hw module failed"); +- ret = -ENODEV; +- goto out; +- } +- + ret = mei_cl_connect(cl, cldev->me_cl, NULL); +- if (ret < 0) { ++ if (ret < 0) + dev_err(&cldev->dev, "cannot connect\n"); +- mei_cl_bus_module_put(cldev); +- } + + out: + mutex_unlock(&bus->device_lock); +@@ -614,7 +606,6 @@ int mei_cldev_disable(struct mei_cl_device *cldev) + if (err < 0) + dev_err(bus->dev, "Could not disconnect from the ME client\n"); + +- mei_cl_bus_module_put(cldev); + out: + /* Flush queues and remove any pending read */ + mei_cl_flush_queues(cl, NULL); +@@ -725,9 +716,16 @@ static int mei_cl_device_probe(struct device *dev) + if (!id) + return -ENODEV; + ++ if (!mei_cl_bus_module_get(cldev)) { ++ dev_err(&cldev->dev, "get hw module failed"); ++ return -ENODEV; ++ } ++ + ret = cldrv->probe(cldev, id); +- if (ret) ++ if (ret) { ++ mei_cl_bus_module_put(cldev); + return ret; ++ } + + __module_get(THIS_MODULE); + return 0; +@@ -755,6 +753,7 @@ static int mei_cl_device_remove(struct device *dev) + + mei_cldev_unregister_callbacks(cldev); + ++ mei_cl_bus_module_put(cldev); + module_put(THIS_MODULE); + dev->driver = NULL; + return ret; +diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c +index e56f3e72d57a..d39cc2909474 100644 +--- a/drivers/misc/mei/hbm.c ++++ b/drivers/misc/mei/hbm.c +@@ -986,29 +986,36 @@ static void mei_hbm_config_features(struct mei_device *dev) + dev->version.minor_version >= HBM_MINOR_VERSION_PGI) + dev->hbm_f_pg_supported = 1; + ++ dev->hbm_f_dc_supported = 0; + if (dev->version.major_version >= HBM_MAJOR_VERSION_DC) + dev->hbm_f_dc_supported = 1; + ++ dev->hbm_f_ie_supported = 0; + if (dev->version.major_version >= HBM_MAJOR_VERSION_IE) + dev->hbm_f_ie_supported = 1; + + /* disconnect on connect timeout instead of link reset */ ++ dev->hbm_f_dot_supported = 0; + if (dev->version.major_version >= HBM_MAJOR_VERSION_DOT) + dev->hbm_f_dot_supported = 1; + + /* Notification Event Support */ ++ dev->hbm_f_ev_supported = 0; + if (dev->version.major_version >= HBM_MAJOR_VERSION_EV) + dev->hbm_f_ev_supported = 1; + + /* Fixed Address Client Support */ ++ dev->hbm_f_fa_supported = 0; + if (dev->version.major_version >= HBM_MAJOR_VERSION_FA) + dev->hbm_f_fa_supported = 1; + + /* OS ver message Support */ ++ dev->hbm_f_os_supported = 0; + if (dev->version.major_version >= HBM_MAJOR_VERSION_OS) + dev->hbm_f_os_supported = 1; + + /* DMA Ring Support */ ++ dev->hbm_f_dr_supported = 0; + if (dev->version.major_version > HBM_MAJOR_VERSION_DR || + (dev->version.major_version == HBM_MAJOR_VERSION_DR && + dev->version.minor_version >= HBM_MINOR_VERSION_DR)) +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index d4f9bfbaf023..6600b3466dfb 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -2378,9 +2378,9 @@ unsigned int mmc_calc_max_discard(struct mmc_card *card) + return card->pref_erase; + + max_discard = mmc_do_calc_max_discard(card, MMC_ERASE_ARG); +- if (max_discard && mmc_can_trim(card)) { ++ if (mmc_can_trim(card)) { + max_trim = mmc_do_calc_max_discard(card, MMC_TRIM_ARG); +- if (max_trim < max_discard) ++ if (max_trim < max_discard || max_discard == 0) + max_discard = max_trim; + } else if (max_discard < card->erase_size) { + max_discard = 0; +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index 753973dc1655..8dae12b841b3 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -981,6 +981,7 @@ static void esdhc_set_uhs_signaling(struct sdhci_host *host, unsigned timing) + case MMC_TIMING_UHS_SDR25: + case MMC_TIMING_UHS_SDR50: + case MMC_TIMING_UHS_SDR104: ++ case MMC_TIMING_MMC_HS: + case MMC_TIMING_MMC_HS200: + writel(m, host->ioaddr + ESDHC_MIX_CTRL); + break; +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index ae219b8a7754..2646faffd36e 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -140,7 +140,7 @@ + #define FLEXCAN_TX_MB 63 + #define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST (FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP + 1) + #define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST (FLEXCAN_TX_MB - 1) +-#define FLEXCAN_IFLAG_MB(x) BIT(x & 0x1f) ++#define FLEXCAN_IFLAG_MB(x) BIT((x) & 0x1f) + #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW BIT(7) + #define FLEXCAN_IFLAG_RX_FIFO_WARN BIT(6) + #define FLEXCAN_IFLAG_RX_FIFO_AVAILABLE BIT(5) +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index fc8b48adf38b..2fa2caf7a746 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -692,7 +692,7 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds) + * port, the other ones have already been disabled during + * bcm_sf2_sw_setup + */ +- for (port = 0; port < DSA_MAX_PORTS; port++) { ++ for (port = 0; port < ds->num_ports; port++) { + if (dsa_is_user_port(ds, port) || dsa_is_cpu_port(ds, port)) + bcm_sf2_port_disable(ds, port, NULL); + } +@@ -724,10 +724,11 @@ static void bcm_sf2_sw_get_wol(struct dsa_switch *ds, int port, + { + struct net_device *p = ds->ports[port].cpu_dp->master; + struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds); +- struct ethtool_wolinfo pwol; ++ struct ethtool_wolinfo pwol = { }; + + /* Get the parent device WoL settings */ +- p->ethtool_ops->get_wol(p, &pwol); ++ if (p->ethtool_ops->get_wol) ++ p->ethtool_ops->get_wol(p, &pwol); + + /* Advertise the parent device supported settings */ + wol->supported = pwol.supported; +@@ -748,9 +749,10 @@ static int bcm_sf2_sw_set_wol(struct dsa_switch *ds, int port, + struct net_device *p = ds->ports[port].cpu_dp->master; + struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds); + s8 cpu_port = ds->ports[port].cpu_dp->index; +- struct ethtool_wolinfo pwol; ++ struct ethtool_wolinfo pwol = { }; + +- p->ethtool_ops->get_wol(p, &pwol); ++ if (p->ethtool_ops->get_wol) ++ p->ethtool_ops->get_wol(p, &pwol); + if (wol->wolopts & ~pwol.supported) + return -EINVAL; + +diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c +index bb41becb6609..31ff1e0d1baa 100644 +--- a/drivers/net/ethernet/atheros/atlx/atl2.c ++++ b/drivers/net/ethernet/atheros/atlx/atl2.c +@@ -1335,13 +1335,11 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + struct net_device *netdev; + struct atl2_adapter *adapter; +- static int cards_found; ++ static int cards_found = 0; + unsigned long mmio_start; + int mmio_len; + int err; + +- cards_found = 0; +- + err = pci_enable_device(pdev); + if (err) + return err; +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index fc16b2b0d0e9..0bdbc72605e1 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -134,6 +134,10 @@ static int bcm_sysport_set_rx_csum(struct net_device *dev, + + priv->rx_chk_en = !!(wanted & NETIF_F_RXCSUM); + reg = rxchk_readl(priv, RXCHK_CONTROL); ++ /* Clear L2 header checks, which would prevent BPDUs ++ * from being received. ++ */ ++ reg &= ~RXCHK_L2_HDR_DIS; + if (priv->rx_chk_en) + reg |= RXCHK_EN; + else +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 1fdaf86bbe8f..0bd93bb7d1a2 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -3542,7 +3542,7 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len, + if (len) + break; + /* on first few passes, just barely sleep */ +- if (i < DFLT_HWRM_CMD_TIMEOUT) ++ if (i < HWRM_SHORT_TIMEOUT_COUNTER) + usleep_range(HWRM_SHORT_MIN_TIMEOUT, + HWRM_SHORT_MAX_TIMEOUT); + else +@@ -3565,7 +3565,7 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len, + dma_rmb(); + if (*valid) + break; +- udelay(1); ++ usleep_range(1, 5); + } + + if (j >= HWRM_VALID_BIT_DELAY_USEC) { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index bde384630a75..cf2d4a6583d5 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -548,7 +548,7 @@ struct rx_tpa_end_cmp_ext { + (HWRM_SHORT_TIMEOUT_COUNTER * HWRM_SHORT_MIN_TIMEOUT + \ + ((n) - HWRM_SHORT_TIMEOUT_COUNTER) * HWRM_MIN_TIMEOUT)) + +-#define HWRM_VALID_BIT_DELAY_USEC 20 ++#define HWRM_VALID_BIT_DELAY_USEC 150 + + #define BNXT_RX_EVENT 1 + #define BNXT_AGG_EVENT 2 +diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c +index 6c8dcb65ff03..90497a27df18 100644 +--- a/drivers/net/ethernet/cavium/thunder/nic_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nic_main.c +@@ -1039,7 +1039,7 @@ static void nic_handle_mbx_intr(struct nicpf *nic, int vf) + case NIC_MBOX_MSG_CFG_DONE: + /* Last message of VF config msg sequence */ + nic_enable_vf(nic, vf, true); +- goto unlock; ++ break; + case NIC_MBOX_MSG_SHUTDOWN: + /* First msg in VF teardown sequence */ + if (vf >= nic->num_vf_en) +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +index 88f8a8fa93cd..9800738448ec 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -172,6 +172,17 @@ static int nicvf_check_pf_ready(struct nicvf *nic) + return 1; + } + ++static void nicvf_send_cfg_done(struct nicvf *nic) ++{ ++ union nic_mbx mbx = {}; ++ ++ mbx.msg.msg = NIC_MBOX_MSG_CFG_DONE; ++ if (nicvf_send_msg_to_pf(nic, &mbx)) { ++ netdev_err(nic->netdev, ++ "PF didn't respond to CFG DONE msg\n"); ++ } ++} ++ + static void nicvf_read_bgx_stats(struct nicvf *nic, struct bgx_stats_msg *bgx) + { + if (bgx->rx) +@@ -1416,7 +1427,6 @@ int nicvf_open(struct net_device *netdev) + struct nicvf *nic = netdev_priv(netdev); + struct queue_set *qs = nic->qs; + struct nicvf_cq_poll *cq_poll = NULL; +- union nic_mbx mbx = {}; + + netif_carrier_off(netdev); + +@@ -1512,8 +1522,7 @@ int nicvf_open(struct net_device *netdev) + nicvf_enable_intr(nic, NICVF_INTR_RBDR, qidx); + + /* Send VF config done msg to PF */ +- mbx.msg.msg = NIC_MBOX_MSG_CFG_DONE; +- nicvf_write_to_mbx(nic, &mbx); ++ nicvf_send_cfg_done(nic); + + return 0; + cleanup: +@@ -1941,7 +1950,8 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs, + + /* flush DMAC filters and reset RX mode */ + mbx.xcast.msg = NIC_MBOX_MSG_RESET_XCAST; +- nicvf_send_msg_to_pf(nic, &mbx); ++ if (nicvf_send_msg_to_pf(nic, &mbx) < 0) ++ goto free_mc; + + if (mode & BGX_XCAST_MCAST_FILTER) { + /* once enabling filtering, we need to signal to PF to add +@@ -1949,7 +1959,8 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs, + */ + mbx.xcast.msg = NIC_MBOX_MSG_ADD_MCAST; + mbx.xcast.data.mac = 0; +- nicvf_send_msg_to_pf(nic, &mbx); ++ if (nicvf_send_msg_to_pf(nic, &mbx) < 0) ++ goto free_mc; + } + + /* check if we have any specific MACs to be added to PF DMAC filter */ +@@ -1958,9 +1969,9 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs, + for (idx = 0; idx < mc_addrs->count; idx++) { + mbx.xcast.msg = NIC_MBOX_MSG_ADD_MCAST; + mbx.xcast.data.mac = mc_addrs->mc[idx]; +- nicvf_send_msg_to_pf(nic, &mbx); ++ if (nicvf_send_msg_to_pf(nic, &mbx) < 0) ++ goto free_mc; + } +- kfree(mc_addrs); + } + + /* and finally set rx mode for PF accordingly */ +@@ -1968,6 +1979,8 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs, + mbx.xcast.data.mode = mode; + + nicvf_send_msg_to_pf(nic, &mbx); ++free_mc: ++ kfree(mc_addrs); + } + + static void nicvf_set_rx_mode_task(struct work_struct *work_arg) +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +index 3b9e74be5fbd..b8155f5e71b4 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +@@ -3081,6 +3081,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset) + dsaf_dev = dev_get_drvdata(&pdev->dev); + if (!dsaf_dev) { + dev_err(&pdev->dev, "dsaf_dev is NULL\n"); ++ put_device(&pdev->dev); + return -ENODEV; + } + +@@ -3088,6 +3089,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset) + if (AE_IS_VER1(dsaf_dev->dsaf_ver)) { + dev_err(dsaf_dev->dev, "%s v1 chip doesn't support RoCE!\n", + dsaf_dev->ae_dev.name); ++ put_device(&pdev->dev); + return -ENODEV; + } + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 6cdd58d9d461..410d5d3aa393 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -3924,8 +3924,11 @@ static void ixgbe_setup_mrqc(struct ixgbe_adapter *adapter) + else + mrqc = IXGBE_MRQC_VMDQRSS64EN; + +- /* Enable L3/L4 for Tx Switched packets */ +- mrqc |= IXGBE_MRQC_L3L4TXSWEN; ++ /* Enable L3/L4 for Tx Switched packets only for X550, ++ * older devices do not support this feature ++ */ ++ if (hw->mac.type >= ixgbe_mac_X550) ++ mrqc |= IXGBE_MRQC_L3L4TXSWEN; + } else { + if (tcs > 4) + mrqc = IXGBE_MRQC_RTRSS8TCEN; +diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c +index 62f204f32316..59007d6cd36d 100644 +--- a/drivers/net/ethernet/marvell/mv643xx_eth.c ++++ b/drivers/net/ethernet/marvell/mv643xx_eth.c +@@ -2886,7 +2886,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev) + + ret = mv643xx_eth_shared_of_probe(pdev); + if (ret) +- return ret; ++ goto err_put_clk; + pd = dev_get_platdata(&pdev->dev); + + msp->tx_csum_limit = (pd != NULL && pd->tx_csum_limit) ? +@@ -2894,6 +2894,11 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev) + infer_hw_params(msp); + + return 0; ++ ++err_put_clk: ++ if (!IS_ERR(msp->clk)) ++ clk_disable_unprepare(msp->clk); ++ return ret; + } + + static int mv643xx_eth_shared_remove(struct platform_device *pdev) +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index a78a39244b79..2ba0d89aaf3c 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -2147,7 +2147,7 @@ err_drop_frame: + if (unlikely(!skb)) + goto err_drop_frame_ret_pool; + +- dma_sync_single_range_for_cpu(dev->dev.parent, ++ dma_sync_single_range_for_cpu(&pp->bm_priv->pdev->dev, + rx_desc->buf_phys_addr, + MVNETA_MH_SIZE + NET_SKB_PAD, + rx_bytes, +diff --git a/drivers/net/ethernet/netronome/nfp/bpf/jit.c b/drivers/net/ethernet/netronome/nfp/bpf/jit.c +index eff57f7d056a..4e18d95e548f 100644 +--- a/drivers/net/ethernet/netronome/nfp/bpf/jit.c ++++ b/drivers/net/ethernet/netronome/nfp/bpf/jit.c +@@ -1288,15 +1288,10 @@ wrp_alu64_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta, + + static int + wrp_alu32_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta, +- enum alu_op alu_op, bool skip) ++ enum alu_op alu_op) + { + const struct bpf_insn *insn = &meta->insn; + +- if (skip) { +- meta->skip = true; +- return 0; +- } +- + wrp_alu_imm(nfp_prog, insn->dst_reg * 2, alu_op, insn->imm); + wrp_immed(nfp_prog, reg_both(insn->dst_reg * 2 + 1), 0); + +@@ -2306,7 +2301,7 @@ static int xor_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + + static int xor_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + { +- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_XOR, !~meta->insn.imm); ++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_XOR); + } + + static int and_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) +@@ -2316,7 +2311,7 @@ static int and_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + + static int and_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + { +- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_AND, !~meta->insn.imm); ++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_AND); + } + + static int or_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) +@@ -2326,7 +2321,7 @@ static int or_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + + static int or_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + { +- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_OR, !meta->insn.imm); ++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_OR); + } + + static int add_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) +@@ -2336,7 +2331,7 @@ static int add_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + + static int add_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + { +- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_ADD, !meta->insn.imm); ++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_ADD); + } + + static int sub_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) +@@ -2346,7 +2341,7 @@ static int sub_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + + static int sub_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) + { +- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_SUB, !meta->insn.imm); ++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_SUB); + } + + static int mul_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) +diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c +index e860bdf0f752..b7471e48db7b 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c +@@ -1689,6 +1689,15 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn, + + eth_hlen = ETH_HLEN + (vlan_valid ? sizeof(u32) : 0); + ++ if (!ether_addr_equal(ethh->h_dest, ++ p_hwfn->p_rdma_info->iwarp.mac_addr)) { ++ DP_VERBOSE(p_hwfn, ++ QED_MSG_RDMA, ++ "Got unexpected mac %pM instead of %pM\n", ++ ethh->h_dest, p_hwfn->p_rdma_info->iwarp.mac_addr); ++ return -EINVAL; ++ } ++ + ether_addr_copy(remote_mac_addr, ethh->h_source); + ether_addr_copy(local_mac_addr, ethh->h_dest); + +@@ -2606,7 +2615,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn, + struct qed_iwarp_info *iwarp_info; + struct qed_ll2_acquire_data data; + struct qed_ll2_cbs cbs; +- u32 mpa_buff_size; ++ u32 buff_size; + u16 n_ooo_bufs; + int rc = 0; + int i; +@@ -2633,7 +2642,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn, + + memset(&data, 0, sizeof(data)); + data.input.conn_type = QED_LL2_TYPE_IWARP; +- data.input.mtu = QED_IWARP_MAX_SYN_PKT_SIZE; ++ data.input.mtu = params->max_mtu; + data.input.rx_num_desc = QED_IWARP_LL2_SYN_RX_SIZE; + data.input.tx_num_desc = QED_IWARP_LL2_SYN_TX_SIZE; + data.input.tx_max_bds_per_packet = 1; /* will never be fragmented */ +@@ -2655,9 +2664,10 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn, + goto err; + } + ++ buff_size = QED_IWARP_MAX_BUF_SIZE(params->max_mtu); + rc = qed_iwarp_ll2_alloc_buffers(p_hwfn, + QED_IWARP_LL2_SYN_RX_SIZE, +- QED_IWARP_MAX_SYN_PKT_SIZE, ++ buff_size, + iwarp_info->ll2_syn_handle); + if (rc) + goto err; +@@ -2711,10 +2721,9 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn, + if (rc) + goto err; + +- mpa_buff_size = QED_IWARP_MAX_BUF_SIZE(params->max_mtu); + rc = qed_iwarp_ll2_alloc_buffers(p_hwfn, + data.input.rx_num_desc, +- mpa_buff_size, ++ buff_size, + iwarp_info->ll2_mpa_handle); + if (rc) + goto err; +@@ -2727,7 +2736,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn, + + iwarp_info->max_num_partial_fpdus = (u16)p_hwfn->p_rdma_info->num_qps; + +- iwarp_info->mpa_intermediate_buf = kzalloc(mpa_buff_size, GFP_KERNEL); ++ iwarp_info->mpa_intermediate_buf = kzalloc(buff_size, GFP_KERNEL); + if (!iwarp_info->mpa_intermediate_buf) + goto err; + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.h b/drivers/net/ethernet/qlogic/qed/qed_iwarp.h +index b8f612d00241..7ac959038324 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.h +@@ -46,7 +46,6 @@ enum qed_iwarp_qp_state qed_roce2iwarp_state(enum qed_roce_qp_state state); + + #define QED_IWARP_LL2_SYN_TX_SIZE (128) + #define QED_IWARP_LL2_SYN_RX_SIZE (256) +-#define QED_IWARP_MAX_SYN_PKT_SIZE (128) + + #define QED_IWARP_LL2_OOO_DEF_TX_SIZE (256) + #define QED_IWARP_MAX_OOO (16) +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 6e381354f658..74bebbdb4b15 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1208,8 +1208,8 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 19)}, /* Sierra Wireless MC7710 in QMI mode */ +- {QMI_FIXED_INTF(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC7304/MC7354 */ +- {QMI_FIXED_INTF(0x1199, 0x68c0, 10)}, /* Sierra Wireless MC7304/MC7354 */ ++ {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC7304/MC7354, WP76xx */ ++ {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 10)},/* Sierra Wireless MC7304/MC7354 */ + {QMI_FIXED_INTF(0x1199, 0x901c, 8)}, /* Sierra Wireless EM7700 */ + {QMI_FIXED_INTF(0x1199, 0x901f, 8)}, /* Sierra Wireless EM7355 */ + {QMI_FIXED_INTF(0x1199, 0x9041, 8)}, /* Sierra Wireless MC7305/MC7355 */ +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 4ca6592f5b3a..7cd428c0af43 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3454,7 +3454,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info) + goto out_err; + } + +- genlmsg_reply(skb, info); ++ res = genlmsg_reply(skb, info); + break; + } + +diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +index 789337ea676a..6ede6168bd85 100644 +--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +@@ -433,8 +433,6 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp, + skb_tail_pointer(skb), + MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn, cardp); + +- cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET; +- + lbtf_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n", + cardp->rx_urb); + ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC); +diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c +index 1d28cd656536..1eeb7be6aa34 100644 +--- a/drivers/nvdimm/label.c ++++ b/drivers/nvdimm/label.c +@@ -625,7 +625,7 @@ static const guid_t *to_abstraction_guid(enum nvdimm_claim_class claim_class, + + static int __pmem_label_update(struct nd_region *nd_region, + struct nd_mapping *nd_mapping, struct nd_namespace_pmem *nspm, +- int pos) ++ int pos, unsigned long flags) + { + struct nd_namespace_common *ndns = &nspm->nsio.common; + struct nd_interleave_set *nd_set = nd_region->nd_set; +@@ -666,7 +666,7 @@ static int __pmem_label_update(struct nd_region *nd_region, + memcpy(nd_label->uuid, nspm->uuid, NSLABEL_UUID_LEN); + if (nspm->alt_name) + memcpy(nd_label->name, nspm->alt_name, NSLABEL_NAME_LEN); +- nd_label->flags = __cpu_to_le32(NSLABEL_FLAG_UPDATING); ++ nd_label->flags = __cpu_to_le32(flags); + nd_label->nlabel = __cpu_to_le16(nd_region->ndr_mappings); + nd_label->position = __cpu_to_le16(pos); + nd_label->isetcookie = __cpu_to_le64(cookie); +@@ -1120,13 +1120,13 @@ static int del_labels(struct nd_mapping *nd_mapping, u8 *uuid) + int nd_pmem_namespace_label_update(struct nd_region *nd_region, + struct nd_namespace_pmem *nspm, resource_size_t size) + { +- int i; ++ int i, rc; + + for (i = 0; i < nd_region->ndr_mappings; i++) { + struct nd_mapping *nd_mapping = &nd_region->mapping[i]; + struct nvdimm_drvdata *ndd = to_ndd(nd_mapping); + struct resource *res; +- int rc, count = 0; ++ int count = 0; + + if (size == 0) { + rc = del_labels(nd_mapping, nspm->uuid); +@@ -1144,7 +1144,20 @@ int nd_pmem_namespace_label_update(struct nd_region *nd_region, + if (rc < 0) + return rc; + +- rc = __pmem_label_update(nd_region, nd_mapping, nspm, i); ++ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i, ++ NSLABEL_FLAG_UPDATING); ++ if (rc) ++ return rc; ++ } ++ ++ if (size == 0) ++ return 0; ++ ++ /* Clear the UPDATING flag per UEFI 2.7 expectations */ ++ for (i = 0; i < nd_region->ndr_mappings; i++) { ++ struct nd_mapping *nd_mapping = &nd_region->mapping[i]; ++ ++ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i, 0); + if (rc) + return rc; + } +diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c +index 4a4266250c28..54d79837f7c6 100644 +--- a/drivers/nvdimm/namespace_devs.c ++++ b/drivers/nvdimm/namespace_devs.c +@@ -138,6 +138,7 @@ bool nd_is_uuid_unique(struct device *dev, u8 *uuid) + bool pmem_should_map_pages(struct device *dev) + { + struct nd_region *nd_region = to_nd_region(dev->parent); ++ struct nd_namespace_common *ndns = to_ndns(dev); + struct nd_namespace_io *nsio; + + if (!IS_ENABLED(CONFIG_ZONE_DEVICE)) +@@ -149,6 +150,9 @@ bool pmem_should_map_pages(struct device *dev) + if (is_nd_pfn(dev) || is_nd_btt(dev)) + return false; + ++ if (ndns->force_raw) ++ return false; ++ + nsio = to_nd_namespace_io(dev); + if (region_intersects(nsio->res.start, resource_size(&nsio->res), + IORESOURCE_SYSTEM_RAM, +diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c +index 7fe84bfe0878..3ee995a3bfc9 100644 +--- a/drivers/nvdimm/pfn_devs.c ++++ b/drivers/nvdimm/pfn_devs.c +@@ -534,7 +534,7 @@ static unsigned long init_altmap_base(resource_size_t base) + + static unsigned long init_altmap_reserve(resource_size_t base) + { +- unsigned long reserve = PHYS_PFN(SZ_8K); ++ unsigned long reserve = PFN_UP(SZ_8K); + unsigned long base_pfn = PHYS_PFN(base); + + reserve += base_pfn - PFN_SECTION_ALIGN_DOWN(base_pfn); +@@ -619,7 +619,7 @@ static void trim_pfn_device(struct nd_pfn *nd_pfn, u32 *start_pad, u32 *end_trun + if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM, + IORES_DESC_NONE) == REGION_MIXED + || !IS_ALIGNED(end, nd_pfn->align) +- || nd_region_conflict(nd_region, start, size + adjust)) ++ || nd_region_conflict(nd_region, start, size)) + *end_trunc = end - phys_pmem_align_down(nd_pfn, end); + } + +diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c +index 380916bff9e0..dee5b9e35ffd 100644 +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -1377,7 +1377,7 @@ static struct superio_struct *find_superio(struct parport *p) + { + int i; + for (i = 0; i < NR_SUPERIOS; i++) +- if (superios[i].io != p->base) ++ if (superios[i].io == p->base) + return &superios[i]; + return NULL; + } +diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c +index 0fa9e8fdce66..b56e22262a77 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-host.c ++++ b/drivers/pci/controller/dwc/pcie-designware-host.c +@@ -439,7 +439,7 @@ int dw_pcie_host_init(struct pcie_port *pp) + if (ret) + pci->num_viewport = 2; + +- if (IS_ENABLED(CONFIG_PCI_MSI)) { ++ if (IS_ENABLED(CONFIG_PCI_MSI) && pci_msi_enabled()) { + /* + * If a specific SoC driver needs to change the + * default number of vectors, it needs to implement +diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c +index f03279fc87cd..1908dd2978d3 100644 +--- a/drivers/pci/pcie/dpc.c ++++ b/drivers/pci/pcie/dpc.c +@@ -153,6 +153,28 @@ static void dpc_process_rp_pio_error(struct dpc_dev *dpc) + pci_write_config_dword(pdev, cap + PCI_EXP_DPC_RP_PIO_STATUS, status); + } + ++static int dpc_get_aer_uncorrect_severity(struct pci_dev *dev, ++ struct aer_err_info *info) ++{ ++ int pos = dev->aer_cap; ++ u32 status, mask, sev; ++ ++ pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_STATUS, &status); ++ pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_MASK, &mask); ++ status &= ~mask; ++ if (!status) ++ return 0; ++ ++ pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_SEVER, &sev); ++ status &= sev; ++ if (status) ++ info->severity = AER_FATAL; ++ else ++ info->severity = AER_NONFATAL; ++ ++ return 1; ++} ++ + static irqreturn_t dpc_handler(int irq, void *context) + { + struct aer_err_info info; +@@ -180,9 +202,12 @@ static irqreturn_t dpc_handler(int irq, void *context) + /* show RP PIO error detail information */ + if (dpc->rp_extensions && reason == 3 && ext_reason == 0) + dpc_process_rp_pio_error(dpc); +- else if (reason == 0 && aer_get_device_error_info(pdev, &info)) { ++ else if (reason == 0 && ++ dpc_get_aer_uncorrect_severity(pdev, &info) && ++ aer_get_device_error_info(pdev, &info)) { + aer_print_error(pdev, &info); + pci_cleanup_aer_uncorrect_error_status(pdev); ++ pci_aer_clear_fatal_status(pdev); + } + + /* We configure DPC so it only triggers on ERR_FATAL */ +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 201f9e5ff55c..4a4c16bfc0d3 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -2038,11 +2038,8 @@ static void pci_configure_ltr(struct pci_dev *dev) + { + #ifdef CONFIG_PCIEASPM + struct pci_host_bridge *host = pci_find_host_bridge(dev->bus); +- u32 cap; + struct pci_dev *bridge; +- +- if (!host->native_ltr) +- return; ++ u32 cap, ctl; + + if (!pci_is_pcie(dev)) + return; +@@ -2051,22 +2048,35 @@ static void pci_configure_ltr(struct pci_dev *dev) + if (!(cap & PCI_EXP_DEVCAP2_LTR)) + return; + +- /* +- * Software must not enable LTR in an Endpoint unless the Root +- * Complex and all intermediate Switches indicate support for LTR. +- * PCIe r3.1, sec 6.18. +- */ +- if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) +- dev->ltr_path = 1; +- else { ++ pcie_capability_read_dword(dev, PCI_EXP_DEVCTL2, &ctl); ++ if (ctl & PCI_EXP_DEVCTL2_LTR_EN) { ++ if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) { ++ dev->ltr_path = 1; ++ return; ++ } ++ + bridge = pci_upstream_bridge(dev); + if (bridge && bridge->ltr_path) + dev->ltr_path = 1; ++ ++ return; + } + +- if (dev->ltr_path) ++ if (!host->native_ltr) ++ return; ++ ++ /* ++ * Software must not enable LTR in an Endpoint unless the Root ++ * Complex and all intermediate Switches indicate support for LTR. ++ * PCIe r4.0, sec 6.18. ++ */ ++ if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT || ++ ((bridge = pci_upstream_bridge(dev)) && ++ bridge->ltr_path)) { + pcie_capability_set_word(dev, PCI_EXP_DEVCTL2, + PCI_EXP_DEVCTL2_LTR_EN); ++ dev->ltr_path = 1; ++ } + #endif + } + +diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c +index 91cffc051055..ead4beb5f55f 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson8b.c ++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c +@@ -665,7 +665,7 @@ static const char * const sd_a_groups[] = { + + static const char * const sdxc_a_groups[] = { + "sdxc_d0_0_a", "sdxc_d13_0_a", "sdxc_d47_a", "sdxc_clk_a", +- "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d0_13_1_a" ++ "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d13_1_a" + }; + + static const char * const pcm_a_groups[] = { +diff --git a/drivers/power/supply/cpcap-charger.c b/drivers/power/supply/cpcap-charger.c +index e4905bef2663..37be541e057d 100644 +--- a/drivers/power/supply/cpcap-charger.c ++++ b/drivers/power/supply/cpcap-charger.c +@@ -458,6 +458,7 @@ static void cpcap_usb_detect(struct work_struct *work) + goto out_err; + } + ++ power_supply_changed(ddata->usb); + return; + + out_err: +diff --git a/drivers/regulator/max77620-regulator.c b/drivers/regulator/max77620-regulator.c +index b94e3a721721..cd93cf53e23c 100644 +--- a/drivers/regulator/max77620-regulator.c ++++ b/drivers/regulator/max77620-regulator.c +@@ -1,7 +1,7 @@ + /* + * Maxim MAX77620 Regulator driver + * +- * Copyright (c) 2016, NVIDIA CORPORATION. All rights reserved. ++ * Copyright (c) 2016-2018, NVIDIA CORPORATION. All rights reserved. + * + * Author: Mallikarjun Kasoju + * Laxman Dewangan +@@ -803,6 +803,14 @@ static int max77620_regulator_probe(struct platform_device *pdev) + rdesc = &rinfo[id].desc; + pmic->rinfo[id] = &max77620_regs_info[id]; + pmic->enable_power_mode[id] = MAX77620_POWER_MODE_NORMAL; ++ pmic->reg_pdata[id].active_fps_src = -1; ++ pmic->reg_pdata[id].active_fps_pd_slot = -1; ++ pmic->reg_pdata[id].active_fps_pu_slot = -1; ++ pmic->reg_pdata[id].suspend_fps_src = -1; ++ pmic->reg_pdata[id].suspend_fps_pd_slot = -1; ++ pmic->reg_pdata[id].suspend_fps_pu_slot = -1; ++ pmic->reg_pdata[id].power_ok = -1; ++ pmic->reg_pdata[id].ramp_rate_setting = -1; + + ret = max77620_read_slew_rate(pmic, id); + if (ret < 0) +diff --git a/drivers/regulator/s2mpa01.c b/drivers/regulator/s2mpa01.c +index 095d25f3d2ea..58a1fe583a6c 100644 +--- a/drivers/regulator/s2mpa01.c ++++ b/drivers/regulator/s2mpa01.c +@@ -298,13 +298,13 @@ static const struct regulator_desc regulators[] = { + regulator_desc_ldo(2, STEP_50_MV), + regulator_desc_ldo(3, STEP_50_MV), + regulator_desc_ldo(4, STEP_50_MV), +- regulator_desc_ldo(5, STEP_50_MV), ++ regulator_desc_ldo(5, STEP_25_MV), + regulator_desc_ldo(6, STEP_25_MV), + regulator_desc_ldo(7, STEP_50_MV), + regulator_desc_ldo(8, STEP_50_MV), + regulator_desc_ldo(9, STEP_50_MV), + regulator_desc_ldo(10, STEP_50_MV), +- regulator_desc_ldo(11, STEP_25_MV), ++ regulator_desc_ldo(11, STEP_50_MV), + regulator_desc_ldo(12, STEP_50_MV), + regulator_desc_ldo(13, STEP_50_MV), + regulator_desc_ldo(14, STEP_50_MV), +@@ -315,11 +315,11 @@ static const struct regulator_desc regulators[] = { + regulator_desc_ldo(19, STEP_50_MV), + regulator_desc_ldo(20, STEP_50_MV), + regulator_desc_ldo(21, STEP_50_MV), +- regulator_desc_ldo(22, STEP_25_MV), +- regulator_desc_ldo(23, STEP_25_MV), ++ regulator_desc_ldo(22, STEP_50_MV), ++ regulator_desc_ldo(23, STEP_50_MV), + regulator_desc_ldo(24, STEP_50_MV), + regulator_desc_ldo(25, STEP_50_MV), +- regulator_desc_ldo(26, STEP_50_MV), ++ regulator_desc_ldo(26, STEP_25_MV), + regulator_desc_buck1_4(1), + regulator_desc_buck1_4(2), + regulator_desc_buck1_4(3), +diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c +index 5bb6f4ca48db..c584bd1ffa9c 100644 +--- a/drivers/regulator/s2mps11.c ++++ b/drivers/regulator/s2mps11.c +@@ -363,7 +363,7 @@ static const struct regulator_desc s2mps11_regulators[] = { + regulator_desc_s2mps11_ldo(32, STEP_50_MV), + regulator_desc_s2mps11_ldo(33, STEP_50_MV), + regulator_desc_s2mps11_ldo(34, STEP_50_MV), +- regulator_desc_s2mps11_ldo(35, STEP_50_MV), ++ regulator_desc_s2mps11_ldo(35, STEP_25_MV), + regulator_desc_s2mps11_ldo(36, STEP_50_MV), + regulator_desc_s2mps11_ldo(37, STEP_50_MV), + regulator_desc_s2mps11_ldo(38, STEP_50_MV), +@@ -373,8 +373,8 @@ static const struct regulator_desc s2mps11_regulators[] = { + regulator_desc_s2mps11_buck1_4(4), + regulator_desc_s2mps11_buck5, + regulator_desc_s2mps11_buck67810(6, MIN_600_MV, STEP_6_25_MV), +- regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_6_25_MV), +- regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_6_25_MV), ++ regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_12_5_MV), ++ regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_12_5_MV), + regulator_desc_s2mps11_buck9, + regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV), + }; +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index 4e7b55a14b1a..6e294b4d3635 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -4469,6 +4469,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp) + usrparm.psf_data &= 0x7fffffffULL; + usrparm.rssd_result &= 0x7fffffffULL; + } ++ /* at least 2 bytes are accessed and should be allocated */ ++ if (usrparm.psf_data_len < 2) { ++ DBF_DEV_EVENT(DBF_WARNING, device, ++ "Symmetrix ioctl invalid data length %d", ++ usrparm.psf_data_len); ++ rc = -EINVAL; ++ goto out; ++ } + /* alloc I/O data area */ + psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA); + rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA); +diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c +index b67dc4974f23..ec54538f7ae1 100644 +--- a/drivers/s390/virtio/virtio_ccw.c ++++ b/drivers/s390/virtio/virtio_ccw.c +@@ -272,6 +272,8 @@ static void virtio_ccw_drop_indicators(struct virtio_ccw_device *vcdev) + { + struct virtio_ccw_vq_info *info; + ++ if (!vcdev->airq_info) ++ return; + list_for_each_entry(info, &vcdev->virtqueues, node) + drop_airq_indicator(info->vq, vcdev->airq_info); + } +@@ -413,7 +415,7 @@ static int virtio_ccw_read_vq_conf(struct virtio_ccw_device *vcdev, + ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_VQ_CONF); + if (ret) + return ret; +- return vcdev->config_block->num; ++ return vcdev->config_block->num ?: -ENOENT; + } + + static void virtio_ccw_del_vq(struct virtqueue *vq, struct ccw1 *ccw) +diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c +index 04443577d48b..1046947064a0 100644 +--- a/drivers/scsi/aacraid/linit.c ++++ b/drivers/scsi/aacraid/linit.c +@@ -413,13 +413,16 @@ static int aac_slave_configure(struct scsi_device *sdev) + if (chn < AAC_MAX_BUSES && tid < AAC_MAX_TARGETS && aac->sa_firmware) { + devtype = aac->hba_map[chn][tid].devtype; + +- if (devtype == AAC_DEVTYPE_NATIVE_RAW) ++ if (devtype == AAC_DEVTYPE_NATIVE_RAW) { + depth = aac->hba_map[chn][tid].qd_limit; +- else if (devtype == AAC_DEVTYPE_ARC_RAW) ++ set_timeout = 1; ++ goto common_config; ++ } ++ if (devtype == AAC_DEVTYPE_ARC_RAW) { + set_qd_dev_type = true; +- +- set_timeout = 1; +- goto common_config; ++ set_timeout = 1; ++ goto common_config; ++ } + } + + if (aac->jbod && (sdev->type == TYPE_DISK)) +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index f78d2e5c1471..4ad61cfa69c0 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1449,7 +1449,13 @@ static int iscsi_xmit_task(struct iscsi_conn *conn) + if (test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx)) + return -ENODATA; + ++ spin_lock_bh(&conn->session->back_lock); ++ if (conn->task == NULL) { ++ spin_unlock_bh(&conn->session->back_lock); ++ return -ENODATA; ++ } + __iscsi_get_task(task); ++ spin_unlock_bh(&conn->session->back_lock); + spin_unlock_bh(&conn->session->frwd_lock); + rc = conn->session->tt->xmit_task(task); + spin_lock_bh(&conn->session->frwd_lock); +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 5352c9bbcaf7..f84f9bf15027 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -643,11 +643,14 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha, + break; + case DSC_LS_PORT_UNAVAIL: + default: +- if (fcport->loop_id != FC_NO_LOOP_ID) +- qla2x00_clear_loop_id(fcport); +- +- fcport->loop_id = loop_id; +- fcport->fw_login_state = DSC_LS_PORT_UNAVAIL; ++ if (fcport->loop_id == FC_NO_LOOP_ID) { ++ qla2x00_find_new_loop_id(vha, fcport); ++ fcport->fw_login_state = ++ DSC_LS_PORT_UNAVAIL; ++ } ++ ql_dbg(ql_dbg_disc, vha, 0x20e5, ++ "%s %d %8phC\n", __func__, __LINE__, ++ fcport->port_name); + qla24xx_fcport_handle_login(vha, fcport); + break; + } +@@ -1719,13 +1722,13 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun, + + /* Issue Marker IOCB */ + qla2x00_marker(vha, vha->hw->req_q_map[0], +- vha->hw->rsp_q_map[0], sp->fcport->loop_id, lun, ++ vha->hw->rsp_q_map[0], fcport->loop_id, lun, + flags == TCF_LUN_RESET ? MK_SYNC_ID_LUN : MK_SYNC_ID); + } + + done_free_sp: + sp->free(sp); +- sp->fcport->flags &= ~FCF_ASYNC_SENT; ++ fcport->flags &= ~FCF_ASYNC_SENT; + done: + return rval; + } +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 58b78702c6c9..a3a5162fa60e 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -3066,6 +3066,55 @@ static void sd_read_security(struct scsi_disk *sdkp, unsigned char *buffer) + sdkp->security = 1; + } + ++/* ++ * Determine the device's preferred I/O size for reads and writes ++ * unless the reported value is unreasonably small, large, not a ++ * multiple of the physical block size, or simply garbage. ++ */ ++static bool sd_validate_opt_xfer_size(struct scsi_disk *sdkp, ++ unsigned int dev_max) ++{ ++ struct scsi_device *sdp = sdkp->device; ++ unsigned int opt_xfer_bytes = ++ logical_to_bytes(sdp, sdkp->opt_xfer_blocks); ++ ++ if (sdkp->opt_xfer_blocks > dev_max) { ++ sd_first_printk(KERN_WARNING, sdkp, ++ "Optimal transfer size %u logical blocks " \ ++ "> dev_max (%u logical blocks)\n", ++ sdkp->opt_xfer_blocks, dev_max); ++ return false; ++ } ++ ++ if (sdkp->opt_xfer_blocks > SD_DEF_XFER_BLOCKS) { ++ sd_first_printk(KERN_WARNING, sdkp, ++ "Optimal transfer size %u logical blocks " \ ++ "> sd driver limit (%u logical blocks)\n", ++ sdkp->opt_xfer_blocks, SD_DEF_XFER_BLOCKS); ++ return false; ++ } ++ ++ if (opt_xfer_bytes < PAGE_SIZE) { ++ sd_first_printk(KERN_WARNING, sdkp, ++ "Optimal transfer size %u bytes < " \ ++ "PAGE_SIZE (%u bytes)\n", ++ opt_xfer_bytes, (unsigned int)PAGE_SIZE); ++ return false; ++ } ++ ++ if (opt_xfer_bytes & (sdkp->physical_block_size - 1)) { ++ sd_first_printk(KERN_WARNING, sdkp, ++ "Optimal transfer size %u bytes not a " \ ++ "multiple of physical block size (%u bytes)\n", ++ opt_xfer_bytes, sdkp->physical_block_size); ++ return false; ++ } ++ ++ sd_first_printk(KERN_INFO, sdkp, "Optimal transfer size %u bytes\n", ++ opt_xfer_bytes); ++ return true; ++} ++ + /** + * sd_revalidate_disk - called the first time a new disk is seen, + * performs disk spin up, read_capacity, etc. +@@ -3144,15 +3193,7 @@ static int sd_revalidate_disk(struct gendisk *disk) + dev_max = min_not_zero(dev_max, sdkp->max_xfer_blocks); + q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max); + +- /* +- * Determine the device's preferred I/O size for reads and writes +- * unless the reported value is unreasonably small, large, or +- * garbage. +- */ +- if (sdkp->opt_xfer_blocks && +- sdkp->opt_xfer_blocks <= dev_max && +- sdkp->opt_xfer_blocks <= SD_DEF_XFER_BLOCKS && +- logical_to_bytes(sdp, sdkp->opt_xfer_blocks) >= PAGE_SIZE) { ++ if (sd_validate_opt_xfer_size(sdkp, dev_max)) { + q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks); + rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks); + } else +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 1c72db94270e..3d331a864b2f 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -621,7 +621,6 @@ static int virtscsi_device_reset(struct scsi_cmnd *sc) + return FAILED; + + memset(cmd, 0, sizeof(*cmd)); +- cmd->sc = sc; + cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){ + .type = VIRTIO_SCSI_T_TMF, + .subtype = cpu_to_virtio32(vscsi->vdev, +@@ -680,7 +679,6 @@ static int virtscsi_abort(struct scsi_cmnd *sc) + return FAILED; + + memset(cmd, 0, sizeof(*cmd)); +- cmd->sc = sc; + cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){ + .type = VIRTIO_SCSI_T_TMF, + .subtype = VIRTIO_SCSI_T_TMF_ABORT_TASK, +diff --git a/drivers/soc/qcom/rpmh.c b/drivers/soc/qcom/rpmh.c +index c7beb6841289..ab8f731a3426 100644 +--- a/drivers/soc/qcom/rpmh.c ++++ b/drivers/soc/qcom/rpmh.c +@@ -80,6 +80,7 @@ void rpmh_tx_done(const struct tcs_request *msg, int r) + struct rpmh_request *rpm_msg = container_of(msg, struct rpmh_request, + msg); + struct completion *compl = rpm_msg->completion; ++ bool free = rpm_msg->needs_free; + + rpm_msg->err = r; + +@@ -94,7 +95,7 @@ void rpmh_tx_done(const struct tcs_request *msg, int r) + complete(compl); + + exit: +- if (rpm_msg->needs_free) ++ if (free) + kfree(rpm_msg); + } + +@@ -348,11 +349,12 @@ int rpmh_write_batch(const struct device *dev, enum rpmh_state state, + { + struct batch_cache_req *req; + struct rpmh_request *rpm_msgs; +- DECLARE_COMPLETION_ONSTACK(compl); ++ struct completion *compls; + struct rpmh_ctrlr *ctrlr = get_rpmh_ctrlr(dev); + unsigned long time_left; + int count = 0; +- int ret, i, j; ++ int ret, i; ++ void *ptr; + + if (!cmd || !n) + return -EINVAL; +@@ -362,10 +364,15 @@ int rpmh_write_batch(const struct device *dev, enum rpmh_state state, + if (!count) + return -EINVAL; + +- req = kzalloc(sizeof(*req) + count * sizeof(req->rpm_msgs[0]), ++ ptr = kzalloc(sizeof(*req) + ++ count * (sizeof(req->rpm_msgs[0]) + sizeof(*compls)), + GFP_ATOMIC); +- if (!req) ++ if (!ptr) + return -ENOMEM; ++ ++ req = ptr; ++ compls = ptr + sizeof(*req) + count * sizeof(*rpm_msgs); ++ + req->count = count; + rpm_msgs = req->rpm_msgs; + +@@ -380,25 +387,26 @@ int rpmh_write_batch(const struct device *dev, enum rpmh_state state, + } + + for (i = 0; i < count; i++) { +- rpm_msgs[i].completion = &compl; ++ struct completion *compl = &compls[i]; ++ ++ init_completion(compl); ++ rpm_msgs[i].completion = compl; + ret = rpmh_rsc_send_data(ctrlr_to_drv(ctrlr), &rpm_msgs[i].msg); + if (ret) { + pr_err("Error(%d) sending RPMH message addr=%#x\n", + ret, rpm_msgs[i].msg.cmds[0].addr); +- for (j = i; j < count; j++) +- rpmh_tx_done(&rpm_msgs[j].msg, ret); + break; + } + } + + time_left = RPMH_TIMEOUT_MS; +- for (i = 0; i < count; i++) { +- time_left = wait_for_completion_timeout(&compl, time_left); ++ while (i--) { ++ time_left = wait_for_completion_timeout(&compls[i], time_left); + if (!time_left) { + /* + * Better hope they never finish because they'll signal +- * the completion on our stack and that's bad once +- * we've returned from the function. ++ * the completion that we're going to free once ++ * we've returned from this function. + */ + WARN_ON(1); + ret = -ETIMEDOUT; +@@ -407,7 +415,7 @@ int rpmh_write_batch(const struct device *dev, enum rpmh_state state, + } + + exit: +- kfree(req); ++ kfree(ptr); + + return ret; + } +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 14f4ea59caff..b624f6fb04ce 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1612,6 +1612,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev) + platform_info->enable_dma = false; + } else { + master->can_dma = pxa2xx_spi_can_dma; ++ master->max_dma_len = MAX_DMA_LEN; + } + } + +diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c +index 5f19016bbf10..b9fb6493cd6b 100644 +--- a/drivers/spi/spi-ti-qspi.c ++++ b/drivers/spi/spi-ti-qspi.c +@@ -490,8 +490,8 @@ static void ti_qspi_enable_memory_map(struct spi_device *spi) + ti_qspi_write(qspi, MM_SWITCH, QSPI_SPI_SWITCH_REG); + if (qspi->ctrl_base) { + regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg, +- MEM_CS_EN(spi->chip_select), +- MEM_CS_MASK); ++ MEM_CS_MASK, ++ MEM_CS_EN(spi->chip_select)); + } + qspi->mmap_enabled = true; + } +@@ -503,7 +503,7 @@ static void ti_qspi_disable_memory_map(struct spi_device *spi) + ti_qspi_write(qspi, 0, QSPI_SPI_SWITCH_REG); + if (qspi->ctrl_base) + regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg, +- 0, MEM_CS_MASK); ++ MEM_CS_MASK, 0); + qspi->mmap_enabled = false; + } + +diff --git a/drivers/staging/media/imx/imx-ic-prpencvf.c b/drivers/staging/media/imx/imx-ic-prpencvf.c +index 28f41caba05d..fb442499f806 100644 +--- a/drivers/staging/media/imx/imx-ic-prpencvf.c ++++ b/drivers/staging/media/imx/imx-ic-prpencvf.c +@@ -680,12 +680,23 @@ static int prp_start(struct prp_priv *priv) + goto out_free_nfb4eof_irq; + } + ++ /* start upstream */ ++ ret = v4l2_subdev_call(priv->src_sd, video, s_stream, 1); ++ ret = (ret && ret != -ENOIOCTLCMD) ? ret : 0; ++ if (ret) { ++ v4l2_err(&ic_priv->sd, ++ "upstream stream on failed: %d\n", ret); ++ goto out_free_eof_irq; ++ } ++ + /* start the EOF timeout timer */ + mod_timer(&priv->eof_timeout_timer, + jiffies + msecs_to_jiffies(IMX_MEDIA_EOF_TIMEOUT)); + + return 0; + ++out_free_eof_irq: ++ devm_free_irq(ic_priv->dev, priv->eof_irq, priv); + out_free_nfb4eof_irq: + devm_free_irq(ic_priv->dev, priv->nfb4eof_irq, priv); + out_unsetup: +@@ -717,6 +728,12 @@ static void prp_stop(struct prp_priv *priv) + if (ret == 0) + v4l2_warn(&ic_priv->sd, "wait last EOF timeout\n"); + ++ /* stop upstream */ ++ ret = v4l2_subdev_call(priv->src_sd, video, s_stream, 0); ++ if (ret && ret != -ENOIOCTLCMD) ++ v4l2_warn(&ic_priv->sd, ++ "upstream stream off failed: %d\n", ret); ++ + devm_free_irq(ic_priv->dev, priv->eof_irq, priv); + devm_free_irq(ic_priv->dev, priv->nfb4eof_irq, priv); + +@@ -1148,15 +1165,6 @@ static int prp_s_stream(struct v4l2_subdev *sd, int enable) + if (ret) + goto out; + +- /* start/stop upstream */ +- ret = v4l2_subdev_call(priv->src_sd, video, s_stream, enable); +- ret = (ret && ret != -ENOIOCTLCMD) ? ret : 0; +- if (ret) { +- if (enable) +- prp_stop(priv); +- goto out; +- } +- + update_count: + priv->stream_count += enable ? 1 : -1; + if (priv->stream_count < 0) +diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c +index cd2c291e1e94..e22f1239a318 100644 +--- a/drivers/staging/media/imx/imx-media-csi.c ++++ b/drivers/staging/media/imx/imx-media-csi.c +@@ -626,7 +626,7 @@ out_put_ipu: + return ret; + } + +-static void csi_idmac_stop(struct csi_priv *priv) ++static void csi_idmac_wait_last_eof(struct csi_priv *priv) + { + unsigned long flags; + int ret; +@@ -643,7 +643,10 @@ static void csi_idmac_stop(struct csi_priv *priv) + &priv->last_eof_comp, msecs_to_jiffies(IMX_MEDIA_EOF_TIMEOUT)); + if (ret == 0) + v4l2_warn(&priv->sd, "wait last EOF timeout\n"); ++} + ++static void csi_idmac_stop(struct csi_priv *priv) ++{ + devm_free_irq(priv->dev, priv->eof_irq, priv); + devm_free_irq(priv->dev, priv->nfb4eof_irq, priv); + +@@ -719,10 +722,16 @@ static int csi_start(struct csi_priv *priv) + + output_fi = &priv->frame_interval[priv->active_output_pad]; + ++ /* start upstream */ ++ ret = v4l2_subdev_call(priv->src_sd, video, s_stream, 1); ++ ret = (ret && ret != -ENOIOCTLCMD) ? ret : 0; ++ if (ret) ++ return ret; ++ + if (priv->dest == IPU_CSI_DEST_IDMAC) { + ret = csi_idmac_start(priv); + if (ret) +- return ret; ++ goto stop_upstream; + } + + ret = csi_setup(priv); +@@ -750,11 +759,26 @@ fim_off: + idmac_stop: + if (priv->dest == IPU_CSI_DEST_IDMAC) + csi_idmac_stop(priv); ++stop_upstream: ++ v4l2_subdev_call(priv->src_sd, video, s_stream, 0); + return ret; + } + + static void csi_stop(struct csi_priv *priv) + { ++ if (priv->dest == IPU_CSI_DEST_IDMAC) ++ csi_idmac_wait_last_eof(priv); ++ ++ /* ++ * Disable the CSI asap, after syncing with the last EOF. ++ * Doing so after the IDMA channel is disabled has shown to ++ * create hard system-wide hangs. ++ */ ++ ipu_csi_disable(priv->csi); ++ ++ /* stop upstream */ ++ v4l2_subdev_call(priv->src_sd, video, s_stream, 0); ++ + if (priv->dest == IPU_CSI_DEST_IDMAC) { + csi_idmac_stop(priv); + +@@ -762,8 +786,6 @@ static void csi_stop(struct csi_priv *priv) + if (priv->fim) + imx_media_fim_set_stream(priv->fim, NULL, false); + } +- +- ipu_csi_disable(priv->csi); + } + + static const struct csi_skip_desc csi_skip[12] = { +@@ -924,23 +946,13 @@ static int csi_s_stream(struct v4l2_subdev *sd, int enable) + goto update_count; + + if (enable) { +- /* upstream must be started first, before starting CSI */ +- ret = v4l2_subdev_call(priv->src_sd, video, s_stream, 1); +- ret = (ret && ret != -ENOIOCTLCMD) ? ret : 0; +- if (ret) +- goto out; +- + dev_dbg(priv->dev, "stream ON\n"); + ret = csi_start(priv); +- if (ret) { +- v4l2_subdev_call(priv->src_sd, video, s_stream, 0); ++ if (ret) + goto out; +- } + } else { + dev_dbg(priv->dev, "stream OFF\n"); +- /* CSI must be stopped first, then stop upstream */ + csi_stop(priv); +- v4l2_subdev_call(priv->src_sd, video, s_stream, 0); + } + + update_count: +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index cc756a123fd8..03e9cb156df9 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4045,9 +4045,9 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + struct se_cmd *se_cmd = &cmd->se_cmd; + + if (se_cmd->se_tfo != NULL) { +- spin_lock(&se_cmd->t_state_lock); ++ spin_lock_irq(&se_cmd->t_state_lock); + se_cmd->transport_state |= CMD_T_FABRIC_STOP; +- spin_unlock(&se_cmd->t_state_lock); ++ spin_unlock_irq(&se_cmd->t_state_lock); + } + } + spin_unlock_bh(&conn->cmd_lock); +diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c +index 877fd7f8a8ed..98125de2f0a6 100644 +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -130,6 +130,10 @@ static int of_platform_serial_setup(struct platform_device *ofdev, + port->flags |= UPF_IOREMAP; + } + ++ /* Compatibility with the deprecated pxa driver and 8250_pxa drivers. */ ++ if (of_device_is_compatible(np, "mrvl,mmp-uart")) ++ port->regshift = 2; ++ + /* Check for registers offset within the devices address range */ + if (of_property_read_u32(np, "reg-shift", &prop) == 0) + port->regshift = prop; +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index 48bd694a5fa1..bbe5cba21522 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -2027,6 +2027,111 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = { + .setup = pci_default_setup, + .exit = pci_plx9050_exit, + }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, ++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_ACCESIO, ++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_pericom_setup, ++ }, + /* + * SBS Technologies, Inc., PMC-OCTALPRO 232 + */ +@@ -4575,10 +4680,10 @@ static const struct pci_device_id serial_pci_tbl[] = { + */ + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_pericom_PI7C9X7954 }, +@@ -4587,10 +4692,10 @@ static const struct pci_device_id serial_pci_tbl[] = { + pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_pericom_PI7C9X7954 }, +@@ -4599,10 +4704,10 @@ static const struct pci_device_id serial_pci_tbl[] = { + pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_pericom_PI7C9X7954 }, +@@ -4611,13 +4716,13 @@ static const struct pci_device_id serial_pci_tbl[] = { + pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7951 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_pericom_PI7C9X7954 }, +@@ -4626,16 +4731,16 @@ static const struct pci_device_id serial_pci_tbl[] = { + pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_pericom_PI7C9X7954 }, +@@ -4644,13 +4749,13 @@ static const struct pci_device_id serial_pci_tbl[] = { + pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7954 }, ++ pbn_pericom_PI7C9X7952 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7958 }, ++ pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7958 }, ++ pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_pericom_PI7C9X7958 }, +@@ -4659,19 +4764,19 @@ static const struct pci_device_id serial_pci_tbl[] = { + pbn_pericom_PI7C9X7958 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7958 }, ++ pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_pericom_PI7C9X7958 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7958 }, ++ pbn_pericom_PI7C9X7954 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_pericom_PI7C9X7958 }, + { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_pericom_PI7C9X7958 }, ++ pbn_pericom_PI7C9X7954 }, + /* + * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke) + */ +diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c +index 87d8dd90d605..0e3627289047 100644 +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -362,7 +362,13 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id) + cdns_uart_handle_tx(dev_id); + isrstatus &= ~CDNS_UART_IXR_TXEMPTY; + } +- if (isrstatus & CDNS_UART_IXR_RXMASK) ++ ++ /* ++ * Skip RX processing if RX is disabled as RXEMPTY will never be set ++ * as read bytes will not be removed from the FIFO. ++ */ ++ if (isrstatus & CDNS_UART_IXR_RXMASK && ++ !(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS)) + cdns_uart_handle_rx(dev_id, isrstatus); + + spin_unlock(&port->lock); +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index da335899527b..b9a9a07f1ee9 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -935,8 +935,11 @@ static void flush_scrollback(struct vc_data *vc) + { + WARN_CONSOLE_UNLOCKED(); + ++ set_origin(vc); + if (vc->vc_sw->con_flush_scrollback) + vc->vc_sw->con_flush_scrollback(vc); ++ else ++ vc->vc_sw->con_switch(vc); + } + + /* +@@ -1506,8 +1509,10 @@ static void csi_J(struct vc_data *vc, int vpar) + count = ((vc->vc_pos - vc->vc_origin) >> 1) + 1; + start = (unsigned short *)vc->vc_origin; + break; ++ case 3: /* include scrollback */ ++ flush_scrollback(vc); ++ /* fallthrough */ + case 2: /* erase whole display */ +- case 3: /* (and scrollback buffer later) */ + vc_uniscr_clear_lines(vc, 0, vc->vc_rows); + count = vc->vc_cols * vc->vc_rows; + start = (unsigned short *)vc->vc_origin; +@@ -1516,13 +1521,7 @@ static void csi_J(struct vc_data *vc, int vpar) + return; + } + scr_memsetw(start, vc->vc_video_erase_char, 2 * count); +- if (vpar == 3) { +- set_origin(vc); +- flush_scrollback(vc); +- if (con_is_visible(vc)) +- update_screen(vc); +- } else if (con_should_update(vc)) +- do_update_region(vc, (unsigned long) start, count); ++ update_region(vc, (unsigned long) start, count); + vc->vc_need_wrap = 0; + } + +diff --git a/drivers/usb/chipidea/ci_hdrc_tegra.c b/drivers/usb/chipidea/ci_hdrc_tegra.c +index 772851bee99b..12025358bb3c 100644 +--- a/drivers/usb/chipidea/ci_hdrc_tegra.c ++++ b/drivers/usb/chipidea/ci_hdrc_tegra.c +@@ -130,6 +130,7 @@ static int tegra_udc_remove(struct platform_device *pdev) + { + struct tegra_udc *udc = platform_get_drvdata(pdev); + ++ ci_hdrc_remove_device(udc->dev); + usb_phy_set_suspend(udc->phy, 1); + clk_disable_unprepare(udc->clk); + +diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c +index c84c8c189e90..eb8046f87a54 100644 +--- a/drivers/usb/typec/tps6598x.c ++++ b/drivers/usb/typec/tps6598x.c +@@ -110,6 +110,20 @@ tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len) + return 0; + } + ++static int tps6598x_block_write(struct tps6598x *tps, u8 reg, ++ void *val, size_t len) ++{ ++ u8 data[TPS_MAX_LEN + 1]; ++ ++ if (!tps->i2c_protocol) ++ return regmap_raw_write(tps->regmap, reg, val, len); ++ ++ data[0] = len; ++ memcpy(&data[1], val, len); ++ ++ return regmap_raw_write(tps->regmap, reg, data, sizeof(data)); ++} ++ + static inline int tps6598x_read16(struct tps6598x *tps, u8 reg, u16 *val) + { + return tps6598x_block_read(tps, reg, val, sizeof(u16)); +@@ -127,23 +141,23 @@ static inline int tps6598x_read64(struct tps6598x *tps, u8 reg, u64 *val) + + static inline int tps6598x_write16(struct tps6598x *tps, u8 reg, u16 val) + { +- return regmap_raw_write(tps->regmap, reg, &val, sizeof(u16)); ++ return tps6598x_block_write(tps, reg, &val, sizeof(u16)); + } + + static inline int tps6598x_write32(struct tps6598x *tps, u8 reg, u32 val) + { +- return regmap_raw_write(tps->regmap, reg, &val, sizeof(u32)); ++ return tps6598x_block_write(tps, reg, &val, sizeof(u32)); + } + + static inline int tps6598x_write64(struct tps6598x *tps, u8 reg, u64 val) + { +- return regmap_raw_write(tps->regmap, reg, &val, sizeof(u64)); ++ return tps6598x_block_write(tps, reg, &val, sizeof(u64)); + } + + static inline int + tps6598x_write_4cc(struct tps6598x *tps, u8 reg, const char *val) + { +- return regmap_raw_write(tps->regmap, reg, &val, sizeof(u32)); ++ return tps6598x_block_write(tps, reg, &val, sizeof(u32)); + } + + static int tps6598x_read_partner_identity(struct tps6598x *tps) +@@ -229,8 +243,8 @@ static int tps6598x_exec_cmd(struct tps6598x *tps, const char *cmd, + return -EBUSY; + + if (in_len) { +- ret = regmap_raw_write(tps->regmap, TPS_REG_DATA1, +- in_data, in_len); ++ ret = tps6598x_block_write(tps, TPS_REG_DATA1, ++ in_data, in_len); + if (ret) + return ret; + } +diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h +index 5a0db6dec8d1..aaee1e6584e6 100644 +--- a/fs/9p/v9fs_vfs.h ++++ b/fs/9p/v9fs_vfs.h +@@ -40,6 +40,9 @@ + */ + #define P9_LOCK_TIMEOUT (30*HZ) + ++/* flags for v9fs_stat2inode() & v9fs_stat2inode_dotl() */ ++#define V9FS_STAT2INODE_KEEP_ISIZE 1 ++ + extern struct file_system_type v9fs_fs_type; + extern const struct address_space_operations v9fs_addr_operations; + extern const struct file_operations v9fs_file_operations; +@@ -61,8 +64,10 @@ int v9fs_init_inode(struct v9fs_session_info *v9ses, + struct inode *inode, umode_t mode, dev_t); + void v9fs_evict_inode(struct inode *inode); + ino_t v9fs_qid2ino(struct p9_qid *qid); +-void v9fs_stat2inode(struct p9_wstat *, struct inode *, struct super_block *); +-void v9fs_stat2inode_dotl(struct p9_stat_dotl *, struct inode *); ++void v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode, ++ struct super_block *sb, unsigned int flags); ++void v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode, ++ unsigned int flags); + int v9fs_dir_release(struct inode *inode, struct file *filp); + int v9fs_file_open(struct inode *inode, struct file *file); + void v9fs_inode2stat(struct inode *inode, struct p9_wstat *stat); +@@ -83,4 +88,18 @@ static inline void v9fs_invalidate_inode_attr(struct inode *inode) + } + + int v9fs_open_to_dotl_flags(int flags); ++ ++static inline void v9fs_i_size_write(struct inode *inode, loff_t i_size) ++{ ++ /* ++ * 32-bit need the lock, concurrent updates could break the ++ * sequences and make i_size_read() loop forever. ++ * 64-bit updates are atomic and can skip the locking. ++ */ ++ if (sizeof(i_size) > sizeof(long)) ++ spin_lock(&inode->i_lock); ++ i_size_write(inode, i_size); ++ if (sizeof(i_size) > sizeof(long)) ++ spin_unlock(&inode->i_lock); ++} + #endif +diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c +index ab3d5f5dbb00..c87e6d6ec069 100644 +--- a/fs/9p/vfs_file.c ++++ b/fs/9p/vfs_file.c +@@ -442,7 +442,11 @@ v9fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + i_size = i_size_read(inode); + if (iocb->ki_pos > i_size) { + inode_add_bytes(inode, iocb->ki_pos - i_size); +- i_size_write(inode, iocb->ki_pos); ++ /* ++ * Need to serialize against i_size_write() in ++ * v9fs_stat2inode() ++ */ ++ v9fs_i_size_write(inode, iocb->ki_pos); + } + return retval; + } +diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c +index 85ff859d3af5..72b779bc0942 100644 +--- a/fs/9p/vfs_inode.c ++++ b/fs/9p/vfs_inode.c +@@ -538,7 +538,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, + if (retval) + goto error; + +- v9fs_stat2inode(st, inode, sb); ++ v9fs_stat2inode(st, inode, sb, 0); + v9fs_cache_inode_get_cookie(inode); + unlock_new_inode(inode); + return inode; +@@ -1092,7 +1092,7 @@ v9fs_vfs_getattr(const struct path *path, struct kstat *stat, + if (IS_ERR(st)) + return PTR_ERR(st); + +- v9fs_stat2inode(st, d_inode(dentry), dentry->d_sb); ++ v9fs_stat2inode(st, d_inode(dentry), dentry->d_sb, 0); + generic_fillattr(d_inode(dentry), stat); + + p9stat_free(st); +@@ -1170,12 +1170,13 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr) + * @stat: Plan 9 metadata (mistat) structure + * @inode: inode to populate + * @sb: superblock of filesystem ++ * @flags: control flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) + * + */ + + void + v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode, +- struct super_block *sb) ++ struct super_block *sb, unsigned int flags) + { + umode_t mode; + char ext[32]; +@@ -1216,10 +1217,11 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode, + mode = p9mode2perm(v9ses, stat); + mode |= inode->i_mode & ~S_IALLUGO; + inode->i_mode = mode; +- i_size_write(inode, stat->length); + ++ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE)) ++ v9fs_i_size_write(inode, stat->length); + /* not real number of blocks, but 512 byte ones ... */ +- inode->i_blocks = (i_size_read(inode) + 512 - 1) >> 9; ++ inode->i_blocks = (stat->length + 512 - 1) >> 9; + v9inode->cache_validity &= ~V9FS_INO_INVALID_ATTR; + } + +@@ -1416,9 +1418,9 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode) + { + int umode; + dev_t rdev; +- loff_t i_size; + struct p9_wstat *st; + struct v9fs_session_info *v9ses; ++ unsigned int flags; + + v9ses = v9fs_inode2v9ses(inode); + st = p9_client_stat(fid); +@@ -1431,16 +1433,13 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode) + if ((inode->i_mode & S_IFMT) != (umode & S_IFMT)) + goto out; + +- spin_lock(&inode->i_lock); + /* + * We don't want to refresh inode->i_size, + * because we may have cached data + */ +- i_size = inode->i_size; +- v9fs_stat2inode(st, inode, inode->i_sb); +- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) +- inode->i_size = i_size; +- spin_unlock(&inode->i_lock); ++ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ? ++ V9FS_STAT2INODE_KEEP_ISIZE : 0; ++ v9fs_stat2inode(st, inode, inode->i_sb, flags); + out: + p9stat_free(st); + kfree(st); +diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c +index 4823e1c46999..a950a927a626 100644 +--- a/fs/9p/vfs_inode_dotl.c ++++ b/fs/9p/vfs_inode_dotl.c +@@ -143,7 +143,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, + if (retval) + goto error; + +- v9fs_stat2inode_dotl(st, inode); ++ v9fs_stat2inode_dotl(st, inode, 0); + v9fs_cache_inode_get_cookie(inode); + retval = v9fs_get_acl(inode, fid); + if (retval) +@@ -496,7 +496,7 @@ v9fs_vfs_getattr_dotl(const struct path *path, struct kstat *stat, + if (IS_ERR(st)) + return PTR_ERR(st); + +- v9fs_stat2inode_dotl(st, d_inode(dentry)); ++ v9fs_stat2inode_dotl(st, d_inode(dentry), 0); + generic_fillattr(d_inode(dentry), stat); + /* Change block size to what the server returned */ + stat->blksize = st->st_blksize; +@@ -607,11 +607,13 @@ int v9fs_vfs_setattr_dotl(struct dentry *dentry, struct iattr *iattr) + * v9fs_stat2inode_dotl - populate an inode structure with stat info + * @stat: stat structure + * @inode: inode to populate ++ * @flags: ctrl flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) + * + */ + + void +-v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode) ++v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode, ++ unsigned int flags) + { + umode_t mode; + struct v9fs_inode *v9inode = V9FS_I(inode); +@@ -631,7 +633,8 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode) + mode |= inode->i_mode & ~S_IALLUGO; + inode->i_mode = mode; + +- i_size_write(inode, stat->st_size); ++ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE)) ++ v9fs_i_size_write(inode, stat->st_size); + inode->i_blocks = stat->st_blocks; + } else { + if (stat->st_result_mask & P9_STATS_ATIME) { +@@ -661,8 +664,9 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode) + } + if (stat->st_result_mask & P9_STATS_RDEV) + inode->i_rdev = new_decode_dev(stat->st_rdev); +- if (stat->st_result_mask & P9_STATS_SIZE) +- i_size_write(inode, stat->st_size); ++ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE) && ++ stat->st_result_mask & P9_STATS_SIZE) ++ v9fs_i_size_write(inode, stat->st_size); + if (stat->st_result_mask & P9_STATS_BLOCKS) + inode->i_blocks = stat->st_blocks; + } +@@ -928,9 +932,9 @@ v9fs_vfs_get_link_dotl(struct dentry *dentry, + + int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode) + { +- loff_t i_size; + struct p9_stat_dotl *st; + struct v9fs_session_info *v9ses; ++ unsigned int flags; + + v9ses = v9fs_inode2v9ses(inode); + st = p9_client_getattr_dotl(fid, P9_STATS_ALL); +@@ -942,16 +946,13 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode) + if ((inode->i_mode & S_IFMT) != (st->st_mode & S_IFMT)) + goto out; + +- spin_lock(&inode->i_lock); + /* + * We don't want to refresh inode->i_size, + * because we may have cached data + */ +- i_size = inode->i_size; +- v9fs_stat2inode_dotl(st, inode); +- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) +- inode->i_size = i_size; +- spin_unlock(&inode->i_lock); ++ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ? ++ V9FS_STAT2INODE_KEEP_ISIZE : 0; ++ v9fs_stat2inode_dotl(st, inode, flags); + out: + kfree(st); + return 0; +diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c +index 48ce50484e80..eeab9953af89 100644 +--- a/fs/9p/vfs_super.c ++++ b/fs/9p/vfs_super.c +@@ -172,7 +172,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags, + goto release_sb; + } + d_inode(root)->i_ino = v9fs_qid2ino(&st->qid); +- v9fs_stat2inode_dotl(st, d_inode(root)); ++ v9fs_stat2inode_dotl(st, d_inode(root), 0); + kfree(st); + } else { + struct p9_wstat *st = NULL; +@@ -183,7 +183,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags, + } + + d_inode(root)->i_ino = v9fs_qid2ino(&st->qid); +- v9fs_stat2inode(st, d_inode(root), sb); ++ v9fs_stat2inode(st, d_inode(root), sb, 0); + + p9stat_free(st); + kfree(st); +diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c +index 3b66c957ea6f..5810463dc6d2 100644 +--- a/fs/btrfs/acl.c ++++ b/fs/btrfs/acl.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + + #include "ctree.h" +@@ -72,8 +73,16 @@ static int __btrfs_set_acl(struct btrfs_trans_handle *trans, + } + + if (acl) { ++ unsigned int nofs_flag; ++ + size = posix_acl_xattr_size(acl->a_count); ++ /* ++ * We're holding a transaction handle, so use a NOFS memory ++ * allocation context to avoid deadlock if reclaim happens. ++ */ ++ nofs_flag = memalloc_nofs_save(); + value = kmalloc(size, GFP_KERNEL); ++ memalloc_nofs_restore(nofs_flag); + if (!value) { + ret = -ENOMEM; + goto out; +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index d96d1390068a..b4f61a3d560a 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include "ctree.h" + #include "disk-io.h" +@@ -1236,10 +1237,17 @@ struct btrfs_root *btrfs_create_tree(struct btrfs_trans_handle *trans, + struct btrfs_root *tree_root = fs_info->tree_root; + struct btrfs_root *root; + struct btrfs_key key; ++ unsigned int nofs_flag; + int ret = 0; + uuid_le uuid = NULL_UUID_LE; + ++ /* ++ * We're holding a transaction handle, so use a NOFS memory allocation ++ * context to avoid deadlock if reclaim happens. ++ */ ++ nofs_flag = memalloc_nofs_save(); + root = btrfs_alloc_root(fs_info, GFP_KERNEL); ++ memalloc_nofs_restore(nofs_flag); + if (!root) + return ERR_PTR(-ENOMEM); + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 79f82f2ec4d5..90b0a6eff535 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -3002,11 +3002,11 @@ static int __do_readpage(struct extent_io_tree *tree, + */ + if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) && + prev_em_start && *prev_em_start != (u64)-1 && +- *prev_em_start != em->orig_start) ++ *prev_em_start != em->start) + force_bio_submit = true; + + if (prev_em_start) +- *prev_em_start = em->orig_start; ++ *prev_em_start = em->start; + + free_extent_map(em); + em = NULL; +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 285f64f2de5f..c13f62182513 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -6425,10 +6425,10 @@ static int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info, + } + + if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) || +- (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes < 1) || ++ (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes != 2) || + (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) || + (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) || +- (type & BTRFS_BLOCK_GROUP_DUP && num_stripes > 2) || ++ (type & BTRFS_BLOCK_GROUP_DUP && num_stripes != 2) || + ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 && + num_stripes != 1)) { + btrfs_err(fs_info, +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 9dcaed031843..80f33582059e 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -235,6 +235,8 @@ struct smb_version_operations { + int * (*get_credits_field)(struct TCP_Server_Info *, const int); + unsigned int (*get_credits)(struct mid_q_entry *); + __u64 (*get_next_mid)(struct TCP_Server_Info *); ++ void (*revert_current_mid)(struct TCP_Server_Info *server, ++ const unsigned int val); + /* data offset from read response message */ + unsigned int (*read_data_offset)(char *); + /* +@@ -756,6 +758,22 @@ get_next_mid(struct TCP_Server_Info *server) + return cpu_to_le16(mid); + } + ++static inline void ++revert_current_mid(struct TCP_Server_Info *server, const unsigned int val) ++{ ++ if (server->ops->revert_current_mid) ++ server->ops->revert_current_mid(server, val); ++} ++ ++static inline void ++revert_current_mid_from_hdr(struct TCP_Server_Info *server, ++ const struct smb2_sync_hdr *shdr) ++{ ++ unsigned int num = le16_to_cpu(shdr->CreditCharge); ++ ++ return revert_current_mid(server, num > 0 ? num : 1); ++} ++ + static inline __u16 + get_mid(const struct smb_hdr *smb) + { +@@ -1391,6 +1409,7 @@ struct mid_q_entry { + struct kref refcount; + struct TCP_Server_Info *server; /* server corresponding to this mid */ + __u64 mid; /* multiplex id */ ++ __u16 credits; /* number of credits consumed by this mid */ + __u32 pid; /* process id */ + __u32 sequence_number; /* for CIFS signing */ + unsigned long when_alloc; /* when mid was created */ +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 23db881daab5..08761a6a039d 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -2871,14 +2871,16 @@ cifs_strict_writev(struct kiocb *iocb, struct iov_iter *from) + * these pages but not on the region from pos to ppos+len-1. + */ + written = cifs_user_writev(iocb, from); +- if (written > 0 && CIFS_CACHE_READ(cinode)) { ++ if (CIFS_CACHE_READ(cinode)) { + /* +- * Windows 7 server can delay breaking level2 oplock if a write +- * request comes - break it on the client to prevent reading +- * an old data. ++ * We have read level caching and we have just sent a write ++ * request to the server thus making data in the cache stale. ++ * Zap the cache and set oplock/lease level to NONE to avoid ++ * reading stale data from the cache. All subsequent read ++ * operations will read new data from the server. + */ + cifs_zap_mapping(inode); +- cifs_dbg(FYI, "Set no oplock for inode=%p after a write operation\n", ++ cifs_dbg(FYI, "Set Oplock/Lease to NONE for inode=%p after write\n", + inode); + cinode->oplock = 0; + } +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 7b8b58fb4d3f..58700d2ba8cd 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -517,7 +517,6 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, + __u8 lease_state; + struct list_head *tmp; + struct cifsFileInfo *cfile; +- struct TCP_Server_Info *server = tcon->ses->server; + struct cifs_pending_open *open; + struct cifsInodeInfo *cinode; + int ack_req = le32_to_cpu(rsp->Flags & +@@ -537,13 +536,25 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, + cifs_dbg(FYI, "lease key match, lease break 0x%x\n", + le32_to_cpu(rsp->NewLeaseState)); + +- server->ops->set_oplock_level(cinode, lease_state, 0, NULL); +- + if (ack_req) + cfile->oplock_break_cancelled = false; + else + cfile->oplock_break_cancelled = true; + ++ set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags); ++ ++ /* ++ * Set or clear flags depending on the lease state being READ. ++ * HANDLE caching flag should be added when the client starts ++ * to defer closing remote file handles with HANDLE leases. ++ */ ++ if (lease_state & SMB2_LEASE_READ_CACHING_HE) ++ set_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, ++ &cinode->flags); ++ else ++ clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, ++ &cinode->flags); ++ + queue_work(cifsoplockd_wq, &cfile->oplock_break); + kfree(lw); + return true; +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 237d7281ada3..d4d7d61a6fe2 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -204,6 +204,15 @@ smb2_get_next_mid(struct TCP_Server_Info *server) + return mid; + } + ++static void ++smb2_revert_current_mid(struct TCP_Server_Info *server, const unsigned int val) ++{ ++ spin_lock(&GlobalMid_Lock); ++ if (server->CurrentMid >= val) ++ server->CurrentMid -= val; ++ spin_unlock(&GlobalMid_Lock); ++} ++ + static struct mid_q_entry * + smb2_find_mid(struct TCP_Server_Info *server, char *buf) + { +@@ -2300,6 +2309,15 @@ smb2_downgrade_oplock(struct TCP_Server_Info *server, + server->ops->set_oplock_level(cinode, 0, 0, NULL); + } + ++static void ++smb21_downgrade_oplock(struct TCP_Server_Info *server, ++ struct cifsInodeInfo *cinode, bool set_level2) ++{ ++ server->ops->set_oplock_level(cinode, ++ set_level2 ? SMB2_LEASE_READ_CACHING_HE : ++ 0, 0, NULL); ++} ++ + static void + smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, + unsigned int epoch, bool *purge_cache) +@@ -3247,6 +3265,7 @@ struct smb_version_operations smb20_operations = { + .get_credits = smb2_get_credits, + .wait_mtu_credits = cifs_wait_mtu_credits, + .get_next_mid = smb2_get_next_mid, ++ .revert_current_mid = smb2_revert_current_mid, + .read_data_offset = smb2_read_data_offset, + .read_data_length = smb2_read_data_length, + .map_error = map_smb2_to_linux_error, +@@ -3341,6 +3360,7 @@ struct smb_version_operations smb21_operations = { + .get_credits = smb2_get_credits, + .wait_mtu_credits = smb2_wait_mtu_credits, + .get_next_mid = smb2_get_next_mid, ++ .revert_current_mid = smb2_revert_current_mid, + .read_data_offset = smb2_read_data_offset, + .read_data_length = smb2_read_data_length, + .map_error = map_smb2_to_linux_error, +@@ -3351,7 +3371,7 @@ struct smb_version_operations smb21_operations = { + .print_stats = smb2_print_stats, + .is_oplock_break = smb2_is_valid_oplock_break, + .handle_cancelled_mid = smb2_handle_cancelled_mid, +- .downgrade_oplock = smb2_downgrade_oplock, ++ .downgrade_oplock = smb21_downgrade_oplock, + .need_neg = smb2_need_neg, + .negotiate = smb2_negotiate, + .negotiate_wsize = smb2_negotiate_wsize, +@@ -3436,6 +3456,7 @@ struct smb_version_operations smb30_operations = { + .get_credits = smb2_get_credits, + .wait_mtu_credits = smb2_wait_mtu_credits, + .get_next_mid = smb2_get_next_mid, ++ .revert_current_mid = smb2_revert_current_mid, + .read_data_offset = smb2_read_data_offset, + .read_data_length = smb2_read_data_length, + .map_error = map_smb2_to_linux_error, +@@ -3447,7 +3468,7 @@ struct smb_version_operations smb30_operations = { + .dump_share_caps = smb2_dump_share_caps, + .is_oplock_break = smb2_is_valid_oplock_break, + .handle_cancelled_mid = smb2_handle_cancelled_mid, +- .downgrade_oplock = smb2_downgrade_oplock, ++ .downgrade_oplock = smb21_downgrade_oplock, + .need_neg = smb2_need_neg, + .negotiate = smb2_negotiate, + .negotiate_wsize = smb2_negotiate_wsize, +@@ -3540,6 +3561,7 @@ struct smb_version_operations smb311_operations = { + .get_credits = smb2_get_credits, + .wait_mtu_credits = smb2_wait_mtu_credits, + .get_next_mid = smb2_get_next_mid, ++ .revert_current_mid = smb2_revert_current_mid, + .read_data_offset = smb2_read_data_offset, + .read_data_length = smb2_read_data_length, + .map_error = map_smb2_to_linux_error, +@@ -3551,7 +3573,7 @@ struct smb_version_operations smb311_operations = { + .dump_share_caps = smb2_dump_share_caps, + .is_oplock_break = smb2_is_valid_oplock_break, + .handle_cancelled_mid = smb2_handle_cancelled_mid, +- .downgrade_oplock = smb2_downgrade_oplock, ++ .downgrade_oplock = smb21_downgrade_oplock, + .need_neg = smb2_need_neg, + .negotiate = smb2_negotiate, + .negotiate_wsize = smb2_negotiate_wsize, +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index 7b351c65ee46..63264db78b89 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -576,6 +576,7 @@ smb2_mid_entry_alloc(const struct smb2_sync_hdr *shdr, + struct TCP_Server_Info *server) + { + struct mid_q_entry *temp; ++ unsigned int credits = le16_to_cpu(shdr->CreditCharge); + + if (server == NULL) { + cifs_dbg(VFS, "Null TCP session in smb2_mid_entry_alloc\n"); +@@ -586,6 +587,7 @@ smb2_mid_entry_alloc(const struct smb2_sync_hdr *shdr, + memset(temp, 0, sizeof(struct mid_q_entry)); + kref_init(&temp->refcount); + temp->mid = le64_to_cpu(shdr->MessageId); ++ temp->credits = credits > 0 ? credits : 1; + temp->pid = current->pid; + temp->command = shdr->Command; /* Always LE */ + temp->when_alloc = jiffies; +@@ -674,13 +676,18 @@ smb2_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst) + smb2_seq_num_into_buf(ses->server, shdr); + + rc = smb2_get_mid_entry(ses, shdr, &mid); +- if (rc) ++ if (rc) { ++ revert_current_mid_from_hdr(ses->server, shdr); + return ERR_PTR(rc); ++ } ++ + rc = smb2_sign_rqst(rqst, ses->server); + if (rc) { ++ revert_current_mid_from_hdr(ses->server, shdr); + cifs_delete_mid(mid); + return ERR_PTR(rc); + } ++ + return mid; + } + +@@ -695,11 +702,14 @@ smb2_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst) + smb2_seq_num_into_buf(server, shdr); + + mid = smb2_mid_entry_alloc(shdr, server); +- if (mid == NULL) ++ if (mid == NULL) { ++ revert_current_mid_from_hdr(server, shdr); + return ERR_PTR(-ENOMEM); ++ } + + rc = smb2_sign_rqst(rqst, server); + if (rc) { ++ revert_current_mid_from_hdr(server, shdr); + DeleteMidQEntry(mid); + return ERR_PTR(rc); + } +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 66348b3d28e6..f2938bd95c40 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -638,6 +638,7 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst, + cifs_in_send_dec(server); + + if (rc < 0) { ++ revert_current_mid(server, mid->credits); + server->sequence_number -= 2; + cifs_delete_mid(mid); + } +@@ -842,6 +843,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + for (i = 0; i < num_rqst; i++) { + midQ[i] = ses->server->ops->setup_request(ses, &rqst[i]); + if (IS_ERR(midQ[i])) { ++ revert_current_mid(ses->server, i); + for (j = 0; j < i; j++) + cifs_delete_mid(midQ[j]); + mutex_unlock(&ses->server->srv_mutex); +@@ -867,8 +869,10 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + for (i = 0; i < num_rqst; i++) + cifs_save_when_sent(midQ[i]); + +- if (rc < 0) ++ if (rc < 0) { ++ revert_current_mid(ses->server, num_rqst); + ses->server->sequence_number -= 2; ++ } + + mutex_unlock(&ses->server->srv_mutex); + +diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c +index c53814539070..553a3f3300ae 100644 +--- a/fs/devpts/inode.c ++++ b/fs/devpts/inode.c +@@ -455,6 +455,7 @@ devpts_fill_super(struct super_block *s, void *data, int silent) + s->s_blocksize_bits = 10; + s->s_magic = DEVPTS_SUPER_MAGIC; + s->s_op = &devpts_sops; ++ s->s_d_op = &simple_dentry_operations; + s->s_time_gran = 1; + + error = -ENOMEM; +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index 0c38e31ec938..364e647d87c0 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -761,7 +761,8 @@ static loff_t ext2_max_size(int bits) + { + loff_t res = EXT2_NDIR_BLOCKS; + int meta_blocks; +- loff_t upper_limit; ++ unsigned int upper_limit; ++ unsigned int ppb = 1 << (bits-2); + + /* This is calculated to be the largest file size for a + * dense, file such that the total number of +@@ -775,24 +776,34 @@ static loff_t ext2_max_size(int bits) + /* total blocks in file system block size */ + upper_limit >>= (bits - 9); + ++ /* Compute how many blocks we can address by block tree */ ++ res += 1LL << (bits-2); ++ res += 1LL << (2*(bits-2)); ++ res += 1LL << (3*(bits-2)); ++ /* Does block tree limit file size? */ ++ if (res < upper_limit) ++ goto check_lfs; + ++ res = upper_limit; ++ /* How many metadata blocks are needed for addressing upper_limit? */ ++ upper_limit -= EXT2_NDIR_BLOCKS; + /* indirect blocks */ + meta_blocks = 1; ++ upper_limit -= ppb; + /* double indirect blocks */ +- meta_blocks += 1 + (1LL << (bits-2)); +- /* tripple indirect blocks */ +- meta_blocks += 1 + (1LL << (bits-2)) + (1LL << (2*(bits-2))); +- +- upper_limit -= meta_blocks; +- upper_limit <<= bits; +- +- res += 1LL << (bits-2); +- res += 1LL << (2*(bits-2)); +- res += 1LL << (3*(bits-2)); ++ if (upper_limit < ppb * ppb) { ++ meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb); ++ res -= meta_blocks; ++ goto check_lfs; ++ } ++ meta_blocks += 1 + ppb; ++ upper_limit -= ppb * ppb; ++ /* tripple indirect blocks for the rest */ ++ meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb) + ++ DIV_ROUND_UP(upper_limit, ppb*ppb); ++ res -= meta_blocks; ++check_lfs: + res <<= bits; +- if (res > upper_limit) +- res = upper_limit; +- + if (res > MAX_LFS_FILESIZE) + res = MAX_LFS_FILESIZE; + +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 032cf9b92665..2ddf7833350d 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -435,6 +435,9 @@ struct flex_groups { + /* Flags that are appropriate for non-directories/regular files. */ + #define EXT4_OTHER_FLMASK (EXT4_NODUMP_FL | EXT4_NOATIME_FL) + ++/* The only flags that should be swapped */ ++#define EXT4_FL_SHOULD_SWAP (EXT4_HUGE_FILE_FL | EXT4_EXTENTS_FL) ++ + /* Mask out flags that are inappropriate for the given type of inode. */ + static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags) + { +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index d37dafa1d133..2e76fb55d94a 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -63,18 +63,20 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2) + loff_t isize; + struct ext4_inode_info *ei1; + struct ext4_inode_info *ei2; ++ unsigned long tmp; + + ei1 = EXT4_I(inode1); + ei2 = EXT4_I(inode2); + + swap(inode1->i_version, inode2->i_version); +- swap(inode1->i_blocks, inode2->i_blocks); +- swap(inode1->i_bytes, inode2->i_bytes); + swap(inode1->i_atime, inode2->i_atime); + swap(inode1->i_mtime, inode2->i_mtime); + + memswap(ei1->i_data, ei2->i_data, sizeof(ei1->i_data)); +- swap(ei1->i_flags, ei2->i_flags); ++ tmp = ei1->i_flags & EXT4_FL_SHOULD_SWAP; ++ ei1->i_flags = (ei2->i_flags & EXT4_FL_SHOULD_SWAP) | ++ (ei1->i_flags & ~EXT4_FL_SHOULD_SWAP); ++ ei2->i_flags = tmp | (ei2->i_flags & ~EXT4_FL_SHOULD_SWAP); + swap(ei1->i_disksize, ei2->i_disksize); + ext4_es_remove_extent(inode1, 0, EXT_MAX_BLOCKS); + ext4_es_remove_extent(inode2, 0, EXT_MAX_BLOCKS); +@@ -115,28 +117,41 @@ static long swap_inode_boot_loader(struct super_block *sb, + int err; + struct inode *inode_bl; + struct ext4_inode_info *ei_bl; +- +- if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) || +- IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) || +- ext4_has_inline_data(inode)) +- return -EINVAL; +- +- if (IS_RDONLY(inode) || IS_APPEND(inode) || IS_IMMUTABLE(inode) || +- !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN)) +- return -EPERM; ++ qsize_t size, size_bl, diff; ++ blkcnt_t blocks; ++ unsigned short bytes; + + inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL); + if (IS_ERR(inode_bl)) + return PTR_ERR(inode_bl); + ei_bl = EXT4_I(inode_bl); + +- filemap_flush(inode->i_mapping); +- filemap_flush(inode_bl->i_mapping); +- + /* Protect orig inodes against a truncate and make sure, + * that only 1 swap_inode_boot_loader is running. */ + lock_two_nondirectories(inode, inode_bl); + ++ if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) || ++ IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) || ++ ext4_has_inline_data(inode)) { ++ err = -EINVAL; ++ goto journal_err_out; ++ } ++ ++ if (IS_RDONLY(inode) || IS_APPEND(inode) || IS_IMMUTABLE(inode) || ++ !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN)) { ++ err = -EPERM; ++ goto journal_err_out; ++ } ++ ++ down_write(&EXT4_I(inode)->i_mmap_sem); ++ err = filemap_write_and_wait(inode->i_mapping); ++ if (err) ++ goto err_out; ++ ++ err = filemap_write_and_wait(inode_bl->i_mapping); ++ if (err) ++ goto err_out; ++ + /* Wait for all existing dio workers */ + inode_dio_wait(inode); + inode_dio_wait(inode_bl); +@@ -147,7 +162,7 @@ static long swap_inode_boot_loader(struct super_block *sb, + handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2); + if (IS_ERR(handle)) { + err = -EINVAL; +- goto journal_err_out; ++ goto err_out; + } + + /* Protect extent tree against block allocations via delalloc */ +@@ -170,6 +185,13 @@ static long swap_inode_boot_loader(struct super_block *sb, + memset(ei_bl->i_data, 0, sizeof(ei_bl->i_data)); + } + ++ err = dquot_initialize(inode); ++ if (err) ++ goto err_out1; ++ ++ size = (qsize_t)(inode->i_blocks) * (1 << 9) + inode->i_bytes; ++ size_bl = (qsize_t)(inode_bl->i_blocks) * (1 << 9) + inode_bl->i_bytes; ++ diff = size - size_bl; + swap_inode_data(inode, inode_bl); + + inode->i_ctime = inode_bl->i_ctime = current_time(inode); +@@ -183,27 +205,51 @@ static long swap_inode_boot_loader(struct super_block *sb, + + err = ext4_mark_inode_dirty(handle, inode); + if (err < 0) { ++ /* No need to update quota information. */ + ext4_warning(inode->i_sb, + "couldn't mark inode #%lu dirty (err %d)", + inode->i_ino, err); + /* Revert all changes: */ + swap_inode_data(inode, inode_bl); + ext4_mark_inode_dirty(handle, inode); +- } else { +- err = ext4_mark_inode_dirty(handle, inode_bl); +- if (err < 0) { +- ext4_warning(inode_bl->i_sb, +- "couldn't mark inode #%lu dirty (err %d)", +- inode_bl->i_ino, err); +- /* Revert all changes: */ +- swap_inode_data(inode, inode_bl); +- ext4_mark_inode_dirty(handle, inode); +- ext4_mark_inode_dirty(handle, inode_bl); +- } ++ goto err_out1; ++ } ++ ++ blocks = inode_bl->i_blocks; ++ bytes = inode_bl->i_bytes; ++ inode_bl->i_blocks = inode->i_blocks; ++ inode_bl->i_bytes = inode->i_bytes; ++ err = ext4_mark_inode_dirty(handle, inode_bl); ++ if (err < 0) { ++ /* No need to update quota information. */ ++ ext4_warning(inode_bl->i_sb, ++ "couldn't mark inode #%lu dirty (err %d)", ++ inode_bl->i_ino, err); ++ goto revert; ++ } ++ ++ /* Bootloader inode should not be counted into quota information. */ ++ if (diff > 0) ++ dquot_free_space(inode, diff); ++ else ++ err = dquot_alloc_space(inode, -1 * diff); ++ ++ if (err < 0) { ++revert: ++ /* Revert all changes: */ ++ inode_bl->i_blocks = blocks; ++ inode_bl->i_bytes = bytes; ++ swap_inode_data(inode, inode_bl); ++ ext4_mark_inode_dirty(handle, inode); ++ ext4_mark_inode_dirty(handle, inode_bl); + } ++ ++err_out1: + ext4_journal_stop(handle); + ext4_double_up_write_data_sem(inode, inode_bl); + ++err_out: ++ up_write(&EXT4_I(inode)->i_mmap_sem); + journal_err_out: + unlock_two_nondirectories(inode, inode_bl); + iput(inode_bl); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 48421de803b7..3d9b18505c0c 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1960,7 +1960,8 @@ retry: + le16_to_cpu(es->s_reserved_gdt_blocks); + n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb); + n_blocks_count = (ext4_fsblk_t)n_group * +- EXT4_BLOCKS_PER_GROUP(sb); ++ EXT4_BLOCKS_PER_GROUP(sb) + ++ le32_to_cpu(es->s_first_data_block); + n_group--; /* set to last group number */ + } + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index c0b66a7a795b..914e725c82c4 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1219,11 +1219,12 @@ int jbd2_journal_get_undo_access(handle_t *handle, struct buffer_head *bh) + struct journal_head *jh; + char *committed_data = NULL; + +- JBUFFER_TRACE(jh, "entry"); + if (jbd2_write_access_granted(handle, bh, true)) + return 0; + + jh = jbd2_journal_add_journal_head(bh); ++ JBUFFER_TRACE(jh, "entry"); ++ + /* + * Do this first --- it can drop the journal lock, so we want to + * make sure that obtaining the committed_data is done +@@ -1334,15 +1335,17 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + + if (is_handle_aborted(handle)) + return -EROFS; +- if (!buffer_jbd(bh)) { +- ret = -EUCLEAN; +- goto out; +- } ++ if (!buffer_jbd(bh)) ++ return -EUCLEAN; ++ + /* + * We don't grab jh reference here since the buffer must be part + * of the running transaction. + */ + jh = bh2jh(bh); ++ jbd_debug(5, "journal_head %p\n", jh); ++ JBUFFER_TRACE(jh, "entry"); ++ + /* + * This and the following assertions are unreliable since we may see jh + * in inconsistent state unless we grab bh_state lock. But this is +@@ -1376,9 +1379,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + } + + journal = transaction->t_journal; +- jbd_debug(5, "journal_head %p\n", jh); +- JBUFFER_TRACE(jh, "entry"); +- + jbd_lock_bh_state(bh); + + if (jh->b_modified == 0) { +@@ -1576,14 +1576,21 @@ int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh) + /* However, if the buffer is still owned by a prior + * (committing) transaction, we can't drop it yet... */ + JBUFFER_TRACE(jh, "belongs to older transaction"); +- /* ... but we CAN drop it from the new transaction if we +- * have also modified it since the original commit. */ ++ /* ... but we CAN drop it from the new transaction through ++ * marking the buffer as freed and set j_next_transaction to ++ * the new transaction, so that not only the commit code ++ * knows it should clear dirty bits when it is done with the ++ * buffer, but also the buffer can be checkpointed only ++ * after the new transaction commits. */ + +- if (jh->b_next_transaction) { +- J_ASSERT(jh->b_next_transaction == transaction); ++ set_buffer_freed(bh); ++ ++ if (!jh->b_next_transaction) { + spin_lock(&journal->j_list_lock); +- jh->b_next_transaction = NULL; ++ jh->b_next_transaction = transaction; + spin_unlock(&journal->j_list_lock); ++ } else { ++ J_ASSERT(jh->b_next_transaction == transaction); + + /* + * only drop a reference if this transaction modified +diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c +index ff2716f9322e..0b22c39dad47 100644 +--- a/fs/kernfs/mount.c ++++ b/fs/kernfs/mount.c +@@ -196,8 +196,10 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn, + return dentry; + + knparent = find_next_ancestor(kn, NULL); +- if (WARN_ON(!knparent)) ++ if (WARN_ON(!knparent)) { ++ dput(dentry); + return ERR_PTR(-EINVAL); ++ } + + do { + struct dentry *dtmp; +@@ -206,8 +208,10 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn, + if (kn == knparent) + return dentry; + kntmp = find_next_ancestor(kn, knparent); +- if (WARN_ON(!kntmp)) ++ if (WARN_ON(!kntmp)) { ++ dput(dentry); + return ERR_PTR(-EINVAL); ++ } + dtmp = lookup_one_len_unlocked(kntmp->name, dentry, + strlen(kntmp->name)); + dput(dentry); +diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c +index 3f23b6840547..bf34ddaa2ad7 100644 +--- a/fs/nfs/nfs4idmap.c ++++ b/fs/nfs/nfs4idmap.c +@@ -44,6 +44,7 @@ + #include + #include + #include ++#include + #include + + #include "internal.h" +@@ -59,7 +60,7 @@ static struct key_type key_type_id_resolver_legacy; + struct idmap_legacy_upcalldata { + struct rpc_pipe_msg pipe_msg; + struct idmap_msg idmap_msg; +- struct key_construction *key_cons; ++ struct key *authkey; + struct idmap *idmap; + }; + +@@ -384,7 +385,7 @@ static const match_table_t nfs_idmap_tokens = { + { Opt_find_err, NULL } + }; + +-static int nfs_idmap_legacy_upcall(struct key_construction *, const char *, void *); ++static int nfs_idmap_legacy_upcall(struct key *, void *); + static ssize_t idmap_pipe_downcall(struct file *, const char __user *, + size_t); + static void idmap_release_pipe(struct inode *); +@@ -549,11 +550,12 @@ nfs_idmap_prepare_pipe_upcall(struct idmap *idmap, + static void + nfs_idmap_complete_pipe_upcall_locked(struct idmap *idmap, int ret) + { +- struct key_construction *cons = idmap->idmap_upcall_data->key_cons; ++ struct key *authkey = idmap->idmap_upcall_data->authkey; + + kfree(idmap->idmap_upcall_data); + idmap->idmap_upcall_data = NULL; +- complete_request_key(cons, ret); ++ complete_request_key(authkey, ret); ++ key_put(authkey); + } + + static void +@@ -563,15 +565,14 @@ nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret) + nfs_idmap_complete_pipe_upcall_locked(idmap, ret); + } + +-static int nfs_idmap_legacy_upcall(struct key_construction *cons, +- const char *op, +- void *aux) ++static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux) + { + struct idmap_legacy_upcalldata *data; ++ struct request_key_auth *rka = get_request_key_auth(authkey); + struct rpc_pipe_msg *msg; + struct idmap_msg *im; + struct idmap *idmap = (struct idmap *)aux; +- struct key *key = cons->key; ++ struct key *key = rka->target_key; + int ret = -ENOKEY; + + if (!aux) +@@ -586,7 +587,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons, + msg = &data->pipe_msg; + im = &data->idmap_msg; + data->idmap = idmap; +- data->key_cons = cons; ++ data->authkey = key_get(authkey); + + ret = nfs_idmap_prepare_message(key->description, idmap, im, msg); + if (ret < 0) +@@ -604,7 +605,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons, + out2: + kfree(data); + out1: +- complete_request_key(cons, ret); ++ complete_request_key(authkey, ret); + return ret; + } + +@@ -651,9 +652,10 @@ out: + static ssize_t + idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + { ++ struct request_key_auth *rka; + struct rpc_inode *rpci = RPC_I(file_inode(filp)); + struct idmap *idmap = (struct idmap *)rpci->private; +- struct key_construction *cons; ++ struct key *authkey; + struct idmap_msg im; + size_t namelen_in; + int ret = -ENOKEY; +@@ -665,7 +667,8 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + if (idmap->idmap_upcall_data == NULL) + goto out_noupcall; + +- cons = idmap->idmap_upcall_data->key_cons; ++ authkey = idmap->idmap_upcall_data->authkey; ++ rka = get_request_key_auth(authkey); + + if (mlen != sizeof(im)) { + ret = -ENOSPC; +@@ -690,9 +693,9 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + + ret = nfs_idmap_read_and_verify_message(&im, + &idmap->idmap_upcall_data->idmap_msg, +- cons->key, cons->authkey); ++ rka->target_key, authkey); + if (ret >= 0) { +- key_set_timeout(cons->key, nfs_idmap_cache_timeout); ++ key_set_timeout(rka->target_key, nfs_idmap_cache_timeout); + ret = mlen; + } + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 8220a168282e..e7abcf7629b3 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -947,6 +947,13 @@ nfs4_sequence_process_interrupted(struct nfs_client *client, + + #endif /* !CONFIG_NFS_V4_1 */ + ++static void nfs41_sequence_res_init(struct nfs4_sequence_res *res) ++{ ++ res->sr_timestamp = jiffies; ++ res->sr_status_flags = 0; ++ res->sr_status = 1; ++} ++ + static + void nfs4_sequence_attach_slot(struct nfs4_sequence_args *args, + struct nfs4_sequence_res *res, +@@ -958,10 +965,6 @@ void nfs4_sequence_attach_slot(struct nfs4_sequence_args *args, + args->sa_slot = slot; + + res->sr_slot = slot; +- res->sr_timestamp = jiffies; +- res->sr_status_flags = 0; +- res->sr_status = 1; +- + } + + int nfs4_setup_sequence(struct nfs_client *client, +@@ -1007,6 +1010,7 @@ int nfs4_setup_sequence(struct nfs_client *client, + + trace_nfs4_setup_sequence(session, args); + out_start: ++ nfs41_sequence_res_init(res); + rpc_call_start(task); + return 0; + +diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c +index 3dbd15b47c27..0ec6bce3dd69 100644 +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -989,6 +989,17 @@ static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc) + } + } + ++static void ++nfs_pageio_cleanup_request(struct nfs_pageio_descriptor *desc, ++ struct nfs_page *req) ++{ ++ LIST_HEAD(head); ++ ++ nfs_list_remove_request(req); ++ nfs_list_add_request(req, &head); ++ desc->pg_completion_ops->error_cleanup(&head); ++} ++ + /** + * nfs_pageio_add_request - Attempt to coalesce a request into a page list. + * @desc: destination io descriptor +@@ -1026,10 +1037,8 @@ static int __nfs_pageio_add_request(struct nfs_pageio_descriptor *desc, + nfs_page_group_unlock(req); + desc->pg_moreio = 1; + nfs_pageio_doio(desc); +- if (desc->pg_error < 0) +- return 0; +- if (mirror->pg_recoalesce) +- return 0; ++ if (desc->pg_error < 0 || mirror->pg_recoalesce) ++ goto out_cleanup_subreq; + /* retry add_request for this subreq */ + nfs_page_group_lock(req); + continue; +@@ -1062,6 +1071,10 @@ err_ptr: + desc->pg_error = PTR_ERR(subreq); + nfs_page_group_unlock(req); + return 0; ++out_cleanup_subreq: ++ if (req != subreq) ++ nfs_pageio_cleanup_request(desc, subreq); ++ return 0; + } + + static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc) +@@ -1080,7 +1093,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc) + struct nfs_page *req; + + req = list_first_entry(&head, struct nfs_page, wb_list); +- nfs_list_remove_request(req); + if (__nfs_pageio_add_request(desc, req)) + continue; + if (desc->pg_error < 0) { +@@ -1169,11 +1181,14 @@ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc, + if (nfs_pgio_has_mirroring(desc)) + desc->pg_mirror_idx = midx; + if (!nfs_pageio_add_request_mirror(desc, dupreq)) +- goto out_failed; ++ goto out_cleanup_subreq; + } + + return 1; + ++out_cleanup_subreq: ++ if (req != dupreq) ++ nfs_pageio_cleanup_request(desc, dupreq); + out_failed: + /* remember fatal errors */ + if (nfs_error_is_fatal(desc->pg_error)) +@@ -1199,7 +1214,7 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc, + desc->pg_mirror_idx = mirror_idx; + for (;;) { + nfs_pageio_doio(desc); +- if (!mirror->pg_recoalesce) ++ if (desc->pg_error < 0 || !mirror->pg_recoalesce) + break; + if (!nfs_do_recoalesce(desc)) + break; +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index d790faff8e47..51d0b7913c04 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -238,9 +238,9 @@ out: + } + + /* A writeback failed: mark the page as bad, and invalidate the page cache */ +-static void nfs_set_pageerror(struct page *page) ++static void nfs_set_pageerror(struct address_space *mapping) + { +- nfs_zap_mapping(page_file_mapping(page)->host, page_file_mapping(page)); ++ nfs_zap_mapping(mapping->host, mapping); + } + + /* +@@ -994,7 +994,7 @@ static void nfs_write_completion(struct nfs_pgio_header *hdr) + nfs_list_remove_request(req); + if (test_bit(NFS_IOHDR_ERROR, &hdr->flags) && + (hdr->good_bytes < bytes)) { +- nfs_set_pageerror(req->wb_page); ++ nfs_set_pageerror(page_file_mapping(req->wb_page)); + nfs_context_set_write_error(req->wb_context, hdr->error); + goto remove_req; + } +@@ -1330,7 +1330,8 @@ int nfs_updatepage(struct file *file, struct page *page, + unsigned int offset, unsigned int count) + { + struct nfs_open_context *ctx = nfs_file_open_context(file); +- struct inode *inode = page_file_mapping(page)->host; ++ struct address_space *mapping = page_file_mapping(page); ++ struct inode *inode = mapping->host; + int status = 0; + + nfs_inc_stats(inode, NFSIOS_VFSUPDATEPAGE); +@@ -1348,7 +1349,7 @@ int nfs_updatepage(struct file *file, struct page *page, + + status = nfs_writepage_setup(ctx, page, offset, count); + if (status < 0) +- nfs_set_pageerror(page); ++ nfs_set_pageerror(mapping); + else + __set_page_dirty_nobuffers(page); + out: +diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c +index 9eb8086ea841..c9cf46e0c040 100644 +--- a/fs/nfsd/nfs3proc.c ++++ b/fs/nfsd/nfs3proc.c +@@ -463,8 +463,19 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp) + &resp->common, nfs3svc_encode_entry); + memcpy(resp->verf, argp->verf, 8); + resp->count = resp->buffer - argp->buffer; +- if (resp->offset) +- xdr_encode_hyper(resp->offset, argp->cookie); ++ if (resp->offset) { ++ loff_t offset = argp->cookie; ++ ++ if (unlikely(resp->offset1)) { ++ /* we ended up with offset on a page boundary */ ++ *resp->offset = htonl(offset >> 32); ++ *resp->offset1 = htonl(offset & 0xffffffff); ++ resp->offset1 = NULL; ++ } else { ++ xdr_encode_hyper(resp->offset, offset); ++ } ++ resp->offset = NULL; ++ } + + RETURN_STATUS(nfserr); + } +@@ -533,6 +544,7 @@ nfsd3_proc_readdirplus(struct svc_rqst *rqstp) + } else { + xdr_encode_hyper(resp->offset, offset); + } ++ resp->offset = NULL; + } + + RETURN_STATUS(nfserr); +diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c +index 9b973f4f7d01..83919116d5cb 100644 +--- a/fs/nfsd/nfs3xdr.c ++++ b/fs/nfsd/nfs3xdr.c +@@ -921,6 +921,7 @@ encode_entry(struct readdir_cd *ccd, const char *name, int namlen, + } else { + xdr_encode_hyper(cd->offset, offset64); + } ++ cd->offset = NULL; + } + + /* +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 9c6d1d57b598..bec75600e692 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -1514,16 +1514,16 @@ static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca) + { + u32 slotsize = slot_bytes(ca); + u32 num = ca->maxreqs; +- int avail; ++ unsigned long avail, total_avail; + + spin_lock(&nfsd_drc_lock); +- avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION, +- nfsd_drc_max_mem - nfsd_drc_mem_used); ++ total_avail = nfsd_drc_max_mem - nfsd_drc_mem_used; ++ avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION, total_avail); + /* + * Never use more than a third of the remaining memory, + * unless it's the only way to give this client a slot: + */ +- avail = clamp_t(int, avail, slotsize, avail/3); ++ avail = clamp_t(int, avail, slotsize, total_avail/3); + num = min_t(int, num, avail / slotsize); + nfsd_drc_mem_used += num * slotsize; + spin_unlock(&nfsd_drc_lock); +diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c +index 39b835d7c445..cb69660d0779 100644 +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -1126,7 +1126,7 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) + case 'Y': + case 'y': + case '1': +- if (nn->nfsd_serv) ++ if (!nn->nfsd_serv) + return -EBUSY; + nfsd4_end_grace(nn); + break; +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index 1cc797a08a5b..75eeee08d848 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -501,6 +501,24 @@ static int ovl_copy_up_inode(struct ovl_copy_up_ctx *c, struct dentry *temp) + { + int err; + ++ /* ++ * Copy up data first and then xattrs. Writing data after ++ * xattrs will remove security.capability xattr automatically. ++ */ ++ if (S_ISREG(c->stat.mode) && !c->metacopy) { ++ struct path upperpath, datapath; ++ ++ ovl_path_upper(c->dentry, &upperpath); ++ if (WARN_ON(upperpath.dentry != NULL)) ++ return -EIO; ++ upperpath.dentry = temp; ++ ++ ovl_path_lowerdata(c->dentry, &datapath); ++ err = ovl_copy_up_data(&datapath, &upperpath, c->stat.size); ++ if (err) ++ return err; ++ } ++ + err = ovl_copy_xattr(c->lowerpath.dentry, temp); + if (err) + return err; +@@ -518,19 +536,6 @@ static int ovl_copy_up_inode(struct ovl_copy_up_ctx *c, struct dentry *temp) + return err; + } + +- if (S_ISREG(c->stat.mode) && !c->metacopy) { +- struct path upperpath, datapath; +- +- ovl_path_upper(c->dentry, &upperpath); +- BUG_ON(upperpath.dentry != NULL); +- upperpath.dentry = temp; +- +- ovl_path_lowerdata(c->dentry, &datapath); +- err = ovl_copy_up_data(&datapath, &upperpath, c->stat.size); +- if (err) +- return err; +- } +- + if (c->metacopy) { + err = ovl_check_setxattr(c->dentry, temp, OVL_XATTR_METACOPY, + NULL, 0, -EOPNOTSUPP); +@@ -706,6 +711,8 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c) + { + struct path upperpath, datapath; + int err; ++ char *capability = NULL; ++ ssize_t uninitialized_var(cap_size); + + ovl_path_upper(c->dentry, &upperpath); + if (WARN_ON(upperpath.dentry == NULL)) +@@ -715,15 +722,37 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c) + if (WARN_ON(datapath.dentry == NULL)) + return -EIO; + ++ if (c->stat.size) { ++ err = cap_size = ovl_getxattr(upperpath.dentry, XATTR_NAME_CAPS, ++ &capability, 0); ++ if (err < 0 && err != -ENODATA) ++ goto out; ++ } ++ + err = ovl_copy_up_data(&datapath, &upperpath, c->stat.size); + if (err) +- return err; ++ goto out_free; ++ ++ /* ++ * Writing to upper file will clear security.capability xattr. We ++ * don't want that to happen for normal copy-up operation. ++ */ ++ if (capability) { ++ err = ovl_do_setxattr(upperpath.dentry, XATTR_NAME_CAPS, ++ capability, cap_size, 0); ++ if (err) ++ goto out_free; ++ } ++ + + err = vfs_removexattr(upperpath.dentry, OVL_XATTR_METACOPY); + if (err) +- return err; ++ goto out_free; + + ovl_set_upperdata(d_inode(c->dentry)); ++out_free: ++ kfree(capability); ++out: + return err; + } + +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index a3c0d9584312..d9c16ceebfe7 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -277,6 +277,8 @@ int ovl_lock_rename_workdir(struct dentry *workdir, struct dentry *upperdir); + int ovl_check_metacopy_xattr(struct dentry *dentry); + bool ovl_is_metacopy_dentry(struct dentry *dentry); + char *ovl_get_redirect_xattr(struct dentry *dentry, int padding); ++ssize_t ovl_getxattr(struct dentry *dentry, char *name, char **value, ++ size_t padding); + + static inline bool ovl_is_impuredir(struct dentry *dentry) + { +diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c +index ace4fe4c39a9..c9a2e3c6d537 100644 +--- a/fs/overlayfs/util.c ++++ b/fs/overlayfs/util.c +@@ -867,28 +867,49 @@ bool ovl_is_metacopy_dentry(struct dentry *dentry) + return (oe->numlower > 1); + } + +-char *ovl_get_redirect_xattr(struct dentry *dentry, int padding) ++ssize_t ovl_getxattr(struct dentry *dentry, char *name, char **value, ++ size_t padding) + { +- int res; +- char *s, *next, *buf = NULL; ++ ssize_t res; ++ char *buf = NULL; + +- res = vfs_getxattr(dentry, OVL_XATTR_REDIRECT, NULL, 0); ++ res = vfs_getxattr(dentry, name, NULL, 0); + if (res < 0) { + if (res == -ENODATA || res == -EOPNOTSUPP) +- return NULL; ++ return -ENODATA; + goto fail; + } + +- buf = kzalloc(res + padding + 1, GFP_KERNEL); +- if (!buf) +- return ERR_PTR(-ENOMEM); ++ if (res != 0) { ++ buf = kzalloc(res + padding, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; + +- if (res == 0) +- goto invalid; ++ res = vfs_getxattr(dentry, name, buf, res); ++ if (res < 0) ++ goto fail; ++ } ++ *value = buf; ++ ++ return res; ++ ++fail: ++ pr_warn_ratelimited("overlayfs: failed to get xattr %s: err=%zi)\n", ++ name, res); ++ kfree(buf); ++ return res; ++} + +- res = vfs_getxattr(dentry, OVL_XATTR_REDIRECT, buf, res); ++char *ovl_get_redirect_xattr(struct dentry *dentry, int padding) ++{ ++ int res; ++ char *s, *next, *buf = NULL; ++ ++ res = ovl_getxattr(dentry, OVL_XATTR_REDIRECT, &buf, padding + 1); ++ if (res == -ENODATA) ++ return NULL; + if (res < 0) +- goto fail; ++ return ERR_PTR(res); + if (res == 0) + goto invalid; + +@@ -904,15 +925,9 @@ char *ovl_get_redirect_xattr(struct dentry *dentry, int padding) + } + + return buf; +- +-err_free: +- kfree(buf); +- return ERR_PTR(res); +-fail: +- pr_warn_ratelimited("overlayfs: failed to get redirect (%i)\n", res); +- goto err_free; + invalid: + pr_warn_ratelimited("overlayfs: invalid redirect (%s)\n", buf); + res = -EINVAL; +- goto err_free; ++ kfree(buf); ++ return ERR_PTR(res); + } +diff --git a/fs/pipe.c b/fs/pipe.c +index bdc5d3c0977d..c51750ed4011 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -234,6 +234,14 @@ static const struct pipe_buf_operations anon_pipe_buf_ops = { + .get = generic_pipe_buf_get, + }; + ++static const struct pipe_buf_operations anon_pipe_buf_nomerge_ops = { ++ .can_merge = 0, ++ .confirm = generic_pipe_buf_confirm, ++ .release = anon_pipe_buf_release, ++ .steal = anon_pipe_buf_steal, ++ .get = generic_pipe_buf_get, ++}; ++ + static const struct pipe_buf_operations packet_pipe_buf_ops = { + .can_merge = 0, + .confirm = generic_pipe_buf_confirm, +@@ -242,6 +250,12 @@ static const struct pipe_buf_operations packet_pipe_buf_ops = { + .get = generic_pipe_buf_get, + }; + ++void pipe_buf_mark_unmergeable(struct pipe_buffer *buf) ++{ ++ if (buf->ops == &anon_pipe_buf_ops) ++ buf->ops = &anon_pipe_buf_nomerge_ops; ++} ++ + static ssize_t + pipe_read(struct kiocb *iocb, struct iov_iter *to) + { +diff --git a/fs/splice.c b/fs/splice.c +index b3daa971f597..29e92b506394 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -1593,6 +1593,8 @@ retry: + */ + obuf->flags &= ~PIPE_BUF_FLAG_GIFT; + ++ pipe_buf_mark_unmergeable(obuf); ++ + obuf->len = len; + opipe->nrbufs++; + ibuf->offset += obuf->len; +@@ -1667,6 +1669,8 @@ static int link_pipe(struct pipe_inode_info *ipipe, + */ + obuf->flags &= ~PIPE_BUF_FLAG_GIFT; + ++ pipe_buf_mark_unmergeable(obuf); ++ + if (obuf->len > len) + obuf->len = len; + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index d7701d466b60..dd38c97933f1 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -727,7 +727,7 @@ + KEEP(*(.orc_unwind_ip)) \ + __stop_orc_unwind_ip = .; \ + } \ +- . = ALIGN(6); \ ++ . = ALIGN(2); \ + .orc_unwind : AT(ADDR(.orc_unwind) - LOAD_OFFSET) { \ + __start_orc_unwind = .; \ + KEEP(*(.orc_unwind)) \ +diff --git a/include/keys/request_key_auth-type.h b/include/keys/request_key_auth-type.h +new file mode 100644 +index 000000000000..a726dd3f1dc6 +--- /dev/null ++++ b/include/keys/request_key_auth-type.h +@@ -0,0 +1,36 @@ ++/* request_key authorisation token key type ++ * ++ * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++#ifndef _KEYS_REQUEST_KEY_AUTH_TYPE_H ++#define _KEYS_REQUEST_KEY_AUTH_TYPE_H ++ ++#include ++ ++/* ++ * Authorisation record for request_key(). ++ */ ++struct request_key_auth { ++ struct key *target_key; ++ struct key *dest_keyring; ++ const struct cred *cred; ++ void *callout_info; ++ size_t callout_len; ++ pid_t pid; ++ char op[8]; ++} __randomize_layout; ++ ++static inline struct request_key_auth *get_request_key_auth(const struct key *key) ++{ ++ return key->payload.data[0]; ++} ++ ++ ++#endif /* _KEYS_REQUEST_KEY_AUTH_TYPE_H */ +diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h +index 4f31f96bbfab..90ac450745f1 100644 +--- a/include/kvm/arm_vgic.h ++++ b/include/kvm/arm_vgic.h +@@ -256,7 +256,7 @@ struct vgic_dist { + u64 propbaser; + + /* Protects the lpi_list and the count value below. */ +- spinlock_t lpi_list_lock; ++ raw_spinlock_t lpi_list_lock; + struct list_head lpi_list_head; + int lpi_list_count; + +diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h +index 6fb0808e87c8..bef2e36c01b4 100644 +--- a/include/linux/device-mapper.h ++++ b/include/linux/device-mapper.h +@@ -601,7 +601,7 @@ do { \ + */ + #define dm_target_offset(ti, sector) ((sector) - (ti)->begin) + +-static inline sector_t to_sector(unsigned long n) ++static inline sector_t to_sector(unsigned long long n) + { + return (n >> SECTOR_SHIFT); + } +diff --git a/include/linux/hardirq.h b/include/linux/hardirq.h +index 0fbbcdf0c178..da0af631ded5 100644 +--- a/include/linux/hardirq.h ++++ b/include/linux/hardirq.h +@@ -60,8 +60,14 @@ extern void irq_enter(void); + */ + extern void irq_exit(void); + ++#ifndef arch_nmi_enter ++#define arch_nmi_enter() do { } while (0) ++#define arch_nmi_exit() do { } while (0) ++#endif ++ + #define nmi_enter() \ + do { \ ++ arch_nmi_enter(); \ + printk_nmi_enter(); \ + lockdep_off(); \ + ftrace_nmi_enter(); \ +@@ -80,6 +86,7 @@ extern void irq_exit(void); + ftrace_nmi_exit(); \ + lockdep_on(); \ + printk_nmi_exit(); \ ++ arch_nmi_exit(); \ + } while (0) + + #endif /* LINUX_HARDIRQ_H */ +diff --git a/include/linux/key-type.h b/include/linux/key-type.h +index 05d8fb5a06c4..d3c5ae8ad498 100644 +--- a/include/linux/key-type.h ++++ b/include/linux/key-type.h +@@ -17,15 +17,6 @@ + + #ifdef CONFIG_KEYS + +-/* +- * key under-construction record +- * - passed to the request_key actor if supplied +- */ +-struct key_construction { +- struct key *key; /* key being constructed */ +- struct key *authkey;/* authorisation for key being constructed */ +-}; +- + /* + * Pre-parsed payload, used by key add, update and instantiate. + * +@@ -47,8 +38,7 @@ struct key_preparsed_payload { + time64_t expiry; /* Expiry time of key */ + } __randomize_layout; + +-typedef int (*request_key_actor_t)(struct key_construction *key, +- const char *op, void *aux); ++typedef int (*request_key_actor_t)(struct key *auth_key, void *aux); + + /* + * Preparsed matching criterion. +@@ -170,20 +160,20 @@ extern int key_instantiate_and_link(struct key *key, + const void *data, + size_t datalen, + struct key *keyring, +- struct key *instkey); ++ struct key *authkey); + extern int key_reject_and_link(struct key *key, + unsigned timeout, + unsigned error, + struct key *keyring, +- struct key *instkey); +-extern void complete_request_key(struct key_construction *cons, int error); ++ struct key *authkey); ++extern void complete_request_key(struct key *authkey, int error); + + static inline int key_negate_and_link(struct key *key, + unsigned timeout, + struct key *keyring, +- struct key *instkey) ++ struct key *authkey) + { +- return key_reject_and_link(key, timeout, ENOKEY, keyring, instkey); ++ return key_reject_and_link(key, timeout, ENOKEY, keyring, authkey); + } + + extern int generic_key_instantiate(struct key *key, struct key_preparsed_payload *prep); +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index a03d5e264e5e..23c242a7ac52 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -633,7 +633,7 @@ void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free, + struct kvm_memory_slot *dont); + int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot, + unsigned long npages); +-void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots); ++void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen); + int kvm_arch_prepare_memory_region(struct kvm *kvm, + struct kvm_memory_slot *memslot, + const struct kvm_userspace_memory_region *mem, +diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h +index 5a3bb3b7c9ad..3ecd7ea212ae 100644 +--- a/include/linux/pipe_fs_i.h ++++ b/include/linux/pipe_fs_i.h +@@ -182,6 +182,7 @@ void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *); + int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *); + int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *); + void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *); ++void pipe_buf_mark_unmergeable(struct pipe_buffer *buf); + + extern const struct pipe_buf_operations nosteal_pipe_buf_ops; + +diff --git a/include/linux/property.h b/include/linux/property.h +index ac8a1ebc4c1b..1a12364050d8 100644 +--- a/include/linux/property.h ++++ b/include/linux/property.h +@@ -258,7 +258,7 @@ struct property_entry { + #define PROPERTY_ENTRY_STRING(_name_, _val_) \ + (struct property_entry) { \ + .name = _name_, \ +- .length = sizeof(_val_), \ ++ .length = sizeof(const char *), \ + .type = DEV_PROP_STRING, \ + { .value = { .str = _val_ } }, \ + } +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index a404d475acee..820903ceac4f 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -4086,6 +4086,12 @@ static inline bool skb_is_gso_sctp(const struct sk_buff *skb) + return skb_shinfo(skb)->gso_type & SKB_GSO_SCTP; + } + ++/* Note: Should be called only if skb_is_gso(skb) is true */ ++static inline bool skb_is_gso_tcp(const struct sk_buff *skb) ++{ ++ return skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6); ++} ++ + static inline void skb_gso_reset(struct sk_buff *skb) + { + skb_shinfo(skb)->gso_size = 0; +diff --git a/include/net/phonet/pep.h b/include/net/phonet/pep.h +index b669fe6dbc3b..98f31c7ea23d 100644 +--- a/include/net/phonet/pep.h ++++ b/include/net/phonet/pep.h +@@ -63,10 +63,11 @@ struct pnpipehdr { + u8 state_after_reset; /* reset request */ + u8 error_code; /* any response */ + u8 pep_type; /* status indication */ +- u8 data[1]; ++ u8 data0; /* anything else */ + }; ++ u8 data[]; + }; +-#define other_pep_type data[1] ++#define other_pep_type data[0] + + static inline struct pnpipehdr *pnp_hdr(struct sk_buff *skb) + { +diff --git a/init/main.c b/init/main.c +index 18f8f0140fa0..e083fac08aed 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -689,7 +689,6 @@ asmlinkage __visible void __init start_kernel(void) + initrd_start = 0; + } + #endif +- page_ext_init(); + kmemleak_init(); + debug_objects_mem_init(); + setup_per_cpu_pageset(); +@@ -1140,6 +1139,8 @@ static noinline void __init kernel_init_freeable(void) + sched_init_smp(); + + page_alloc_init_late(); ++ /* Initialize page ext after all struct pages are initialized. */ ++ page_ext_init(); + + do_basic_setup(); + +diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c +index 9058317ba9de..4f3138e6ecb2 100644 +--- a/kernel/bpf/lpm_trie.c ++++ b/kernel/bpf/lpm_trie.c +@@ -432,6 +432,7 @@ static int trie_delete_elem(struct bpf_map *map, void *_key) + } + + if (!node || node->prefixlen != key->prefixlen || ++ node->prefixlen != matchlen || + (node->flags & LPM_TREE_NODE_FLAG_IM)) { + ret = -ENOENT; + goto out; +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 6a32933cae4f..7cb7a7f98a37 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -44,7 +44,7 @@ static void do_up_read(struct irq_work *entry) + struct stack_map_irq_work *work; + + work = container_of(entry, struct stack_map_irq_work, irq_work); +- up_read(work->sem); ++ up_read_non_owner(work->sem); + work->sem = NULL; + } + +@@ -338,6 +338,12 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + } else { + work->sem = ¤t->mm->mmap_sem; + irq_work_queue(&work->irq_work); ++ /* ++ * The irq_work will release the mmap_sem with ++ * up_read_non_owner(). The rwsem_release() is called ++ * here to release the lock from lockdep's perspective. ++ */ ++ rwsem_release(¤t->mm->mmap_sem.dep_map, 1, _RET_IP_); + } + } + +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index e578c3999970..e710ac7fbbbf 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -1998,7 +1998,7 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags, + struct cgroup_namespace *ns) + { + struct dentry *dentry; +- bool new_sb; ++ bool new_sb = false; + + dentry = kernfs_mount(fs_type, flags, root->kf_root, magic, &new_sb); + +@@ -2008,6 +2008,7 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags, + */ + if (!IS_ERR(dentry) && ns != &init_cgroup_ns) { + struct dentry *nsdentry; ++ struct super_block *sb = dentry->d_sb; + struct cgroup *cgrp; + + mutex_lock(&cgroup_mutex); +@@ -2018,12 +2019,14 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags, + spin_unlock_irq(&css_set_lock); + mutex_unlock(&cgroup_mutex); + +- nsdentry = kernfs_node_dentry(cgrp->kn, dentry->d_sb); ++ nsdentry = kernfs_node_dentry(cgrp->kn, sb); + dput(dentry); ++ if (IS_ERR(nsdentry)) ++ deactivate_locked_super(sb); + dentry = nsdentry; + } + +- if (IS_ERR(dentry) || !new_sb) ++ if (!new_sb) + cgroup_put(&root->cgrp); + + return dentry; +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index 15301ed19da6..f7e89c989df7 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -1689,15 +1689,23 @@ static bool rcu_future_gp_cleanup(struct rcu_state *rsp, struct rcu_node *rnp) + } + + /* +- * Awaken the grace-period kthread for the specified flavor of RCU. +- * Don't do a self-awaken, and don't bother awakening when there is +- * nothing for the grace-period kthread to do (as in several CPUs +- * raced to awaken, and we lost), and finally don't try to awaken +- * a kthread that has not yet been created. ++ * Awaken the grace-period kthread. Don't do a self-awaken (unless in ++ * an interrupt or softirq handler), and don't bother awakening when there ++ * is nothing for the grace-period kthread to do (as in several CPUs raced ++ * to awaken, and we lost), and finally don't try to awaken a kthread that ++ * has not yet been created. If all those checks are passed, track some ++ * debug information and awaken. ++ * ++ * So why do the self-wakeup when in an interrupt or softirq handler ++ * in the grace-period kthread's context? Because the kthread might have ++ * been interrupted just as it was going to sleep, and just after the final ++ * pre-sleep check of the awaken condition. In this case, a wakeup really ++ * is required, and is therefore supplied. + */ + static void rcu_gp_kthread_wake(struct rcu_state *rsp) + { +- if (current == rsp->gp_kthread || ++ if ((current == rsp->gp_kthread && ++ !in_interrupt() && !in_serving_softirq()) || + !READ_ONCE(rsp->gp_flags) || + !rsp->gp_kthread) + return; +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 32dea29d05a0..3b86acd5de4e 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -2552,7 +2552,16 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp, + { + struct do_proc_dointvec_minmax_conv_param *param = data; + if (write) { +- int val = *negp ? -*lvalp : *lvalp; ++ int val; ++ if (*negp) { ++ if (*lvalp > (unsigned long) INT_MAX + 1) ++ return -EINVAL; ++ val = -*lvalp; ++ } else { ++ if (*lvalp > (unsigned long) INT_MAX) ++ return -EINVAL; ++ val = *lvalp; ++ } + if ((param->min && *param->min > val) || + (param->max && *param->max < val)) + return -EINVAL; +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 17bd0c0dfa98..1f96b292df31 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -5606,7 +5606,6 @@ out: + return ret; + + fail: +- kfree(iter->trace); + kfree(iter); + __trace_array_put(tr); + mutex_unlock(&trace_types_lock); +diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c +index 69a3fe926e8c..e6945b55c688 100644 +--- a/kernel/trace/trace_event_perf.c ++++ b/kernel/trace/trace_event_perf.c +@@ -298,15 +298,13 @@ int perf_uprobe_init(struct perf_event *p_event, bool is_retprobe) + + if (!p_event->attr.uprobe_path) + return -EINVAL; +- path = kzalloc(PATH_MAX, GFP_KERNEL); +- if (!path) +- return -ENOMEM; +- ret = strncpy_from_user( +- path, u64_to_user_ptr(p_event->attr.uprobe_path), PATH_MAX); +- if (ret == PATH_MAX) +- return -E2BIG; +- if (ret < 0) +- goto out; ++ ++ path = strndup_user(u64_to_user_ptr(p_event->attr.uprobe_path), ++ PATH_MAX); ++ if (IS_ERR(path)) { ++ ret = PTR_ERR(path); ++ return (ret == -EINVAL) ? -E2BIG : ret; ++ } + if (path[0] == '\0') { + ret = -EINVAL; + goto out; +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index eb908ef2ecec..11853e90b649 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -4621,9 +4621,10 @@ static inline void add_to_key(char *compound_key, void *key, + /* ensure NULL-termination */ + if (size > key_field->size - 1) + size = key_field->size - 1; +- } + +- memcpy(compound_key + key_field->offset, key, size); ++ strncpy(compound_key + key_field->offset, (char *)key, size); ++ } else ++ memcpy(compound_key + key_field->offset, key, size); + } + + static void +diff --git a/lib/assoc_array.c b/lib/assoc_array.c +index c6659cb37033..59875eb278ea 100644 +--- a/lib/assoc_array.c ++++ b/lib/assoc_array.c +@@ -768,9 +768,11 @@ all_leaves_cluster_together: + new_s0->index_key[i] = + ops->get_key_chunk(index_key, i * ASSOC_ARRAY_KEY_CHUNK_SIZE); + +- blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK); +- pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank); +- new_s0->index_key[keylen - 1] &= ~blank; ++ if (level & ASSOC_ARRAY_KEY_CHUNK_MASK) { ++ blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK); ++ pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank); ++ new_s0->index_key[keylen - 1] &= ~blank; ++ } + + /* This now reduces to a node splitting exercise for which we'll need + * to regenerate the disparity table. +diff --git a/mm/gup.c b/mm/gup.c +index 1abc8b4afff6..0a5374e6e82d 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -1649,7 +1649,8 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end, + if (!pmd_present(pmd)) + return 0; + +- if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd))) { ++ if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd) || ++ pmd_devmap(pmd))) { + /* + * NUMA hinting faults need to be handled in the GUP + * slowpath for accounting purposes and so that they +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index d9b8a2490633..6edc6db5ec1b 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1823,19 +1823,17 @@ static int soft_offline_in_use_page(struct page *page, int flags) + struct page *hpage = compound_head(page); + + if (!PageHuge(page) && PageTransHuge(hpage)) { +- lock_page(hpage); +- if (!PageAnon(hpage) || unlikely(split_huge_page(hpage))) { +- unlock_page(hpage); +- if (!PageAnon(hpage)) ++ lock_page(page); ++ if (!PageAnon(page) || unlikely(split_huge_page(page))) { ++ unlock_page(page); ++ if (!PageAnon(page)) + pr_info("soft offline: %#lx: non anonymous thp\n", page_to_pfn(page)); + else + pr_info("soft offline: %#lx: thp split failed\n", page_to_pfn(page)); +- put_hwpoison_page(hpage); ++ put_hwpoison_page(page); + return -EBUSY; + } +- unlock_page(hpage); +- get_hwpoison_page(page); +- put_hwpoison_page(hpage); ++ unlock_page(page); + } + + /* +diff --git a/mm/memory.c b/mm/memory.c +index 281172540a9c..5b3f71bcd1ae 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3762,10 +3762,13 @@ static vm_fault_t do_shared_fault(struct vm_fault *vmf) + * but allow concurrent faults). + * The mmap_sem may have been released depending on flags and our + * return value. See filemap_fault() and __lock_page_or_retry(). ++ * If mmap_sem is released, vma may become invalid (for example ++ * by other thread calling munmap()). + */ + static vm_fault_t do_fault(struct vm_fault *vmf) + { + struct vm_area_struct *vma = vmf->vma; ++ struct mm_struct *vm_mm = vma->vm_mm; + vm_fault_t ret; + + /* +@@ -3806,7 +3809,7 @@ static vm_fault_t do_fault(struct vm_fault *vmf) + + /* preallocated pagetable is unused: free it */ + if (vmf->prealloc_pte) { +- pte_free(vma->vm_mm, vmf->prealloc_pte); ++ pte_free(vm_mm, vmf->prealloc_pte); + vmf->prealloc_pte = NULL; + } + return ret; +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index a9de1dbb9a6c..ef99971c13dd 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -4532,11 +4532,11 @@ refill: + /* Even if we own the page, we do not use atomic_set(). + * This would break get_page_unless_zero() users. + */ +- page_ref_add(page, size - 1); ++ page_ref_add(page, size); + + /* reset page count bias and offset to start of new frag */ + nc->pfmemalloc = page_is_pfmemalloc(page); +- nc->pagecnt_bias = size; ++ nc->pagecnt_bias = size + 1; + nc->offset = size; + } + +@@ -4552,10 +4552,10 @@ refill: + size = nc->size; + #endif + /* OK, page count is 0, we can safely set it */ +- set_page_count(page, size); ++ set_page_count(page, size + 1); + + /* reset page count bias and offset to start of new frag */ +- nc->pagecnt_bias = size; ++ nc->pagecnt_bias = size + 1; + offset = size - fragsz; + } + +diff --git a/mm/page_ext.c b/mm/page_ext.c +index a9826da84ccb..4961f13b6ec1 100644 +--- a/mm/page_ext.c ++++ b/mm/page_ext.c +@@ -398,10 +398,8 @@ void __init page_ext_init(void) + * We know some arch can have a nodes layout such as + * -------------pfn--------------> + * N0 | N1 | N2 | N0 | N1 | N2|.... +- * +- * Take into account DEFERRED_STRUCT_PAGE_INIT. + */ +- if (early_pfn_to_nid(pfn) != nid) ++ if (pfn_to_nid(pfn) != nid) + continue; + if (init_section_page_ext(pfn, nid)) + goto oom; +diff --git a/mm/shmem.c b/mm/shmem.c +index b6cf0e8e685b..3c8742655756 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2895,16 +2895,20 @@ static int shmem_create(struct inode *dir, struct dentry *dentry, umode_t mode, + static int shmem_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry) + { + struct inode *inode = d_inode(old_dentry); +- int ret; ++ int ret = 0; + + /* + * No ordinary (disk based) filesystem counts links as inodes; + * but each new link needs a new dentry, pinning lowmem, and + * tmpfs dentries cannot be pruned until they are unlinked. ++ * But if an O_TMPFILE file is linked into the tmpfs, the ++ * first link must skip that, to get the accounting right. + */ +- ret = shmem_reserve_inode(inode->i_sb); +- if (ret) +- goto out; ++ if (inode->i_nlink) { ++ ret = shmem_reserve_inode(inode->i_sb); ++ if (ret) ++ goto out; ++ } + + dir->i_size += BOGO_DIRENT_SIZE; + inode->i_ctime = dir->i_ctime = dir->i_mtime = current_time(inode); +diff --git a/mm/swap.c b/mm/swap.c +index 26fc9b5f1b6c..a3fc028e338e 100644 +--- a/mm/swap.c ++++ b/mm/swap.c +@@ -321,11 +321,6 @@ static inline void activate_page_drain(int cpu) + { + } + +-static bool need_activate_page_drain(int cpu) +-{ +- return false; +-} +- + void activate_page(struct page *page) + { + struct zone *zone = page_zone(page); +@@ -654,13 +649,15 @@ void lru_add_drain(void) + put_cpu(); + } + ++#ifdef CONFIG_SMP ++ ++static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work); ++ + static void lru_add_drain_per_cpu(struct work_struct *dummy) + { + lru_add_drain(); + } + +-static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work); +- + /* + * Doesn't need any cpu hotplug locking because we do rely on per-cpu + * kworkers being shut down before our page_alloc_cpu_dead callback is +@@ -703,6 +700,12 @@ void lru_add_drain_all(void) + + mutex_unlock(&lock); + } ++#else ++void lru_add_drain_all(void) ++{ ++ lru_add_drain(); ++} ++#endif + + /** + * release_pages - batched put_page() +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index a728fc492557..91a789a46b12 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -2244,7 +2244,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr, + if (!(area->flags & VM_USERMAP)) + return -EINVAL; + +- if (kaddr + size > area->addr + area->size) ++ if (kaddr + size > area->addr + get_vm_area_size(area)) + return -EINVAL; + + do { +diff --git a/net/9p/client.c b/net/9p/client.c +index 75b7bf7c7f07..23ec6187dc07 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -1073,7 +1073,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) + p9_debug(P9_DEBUG_ERROR, + "Please specify a msize of at least 4k\n"); + err = -EINVAL; +- goto free_client; ++ goto close_trans; + } + + err = p9_client_version(clnt); +diff --git a/net/core/filter.c b/net/core/filter.c +index bed9061102f4..eb81e9db4093 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2614,8 +2614,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb) + u32 off = skb_mac_header_len(skb); + int ret; + +- /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */ +- if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb))) ++ if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) + return -ENOTSUPP; + + ret = skb_cow(skb, len_diff); +@@ -2656,8 +2655,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb) + u32 off = skb_mac_header_len(skb); + int ret; + +- /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */ +- if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb))) ++ if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) + return -ENOTSUPP; + + ret = skb_unclone(skb, GFP_ATOMIC); +@@ -2782,8 +2780,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff) + u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb); + int ret; + +- /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */ +- if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb))) ++ if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) + return -ENOTSUPP; + + ret = skb_cow(skb, len_diff); +@@ -2812,8 +2809,7 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff) + u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb); + int ret; + +- /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */ +- if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb))) ++ if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) + return -ENOTSUPP; + + ret = skb_unclone(skb, GFP_ATOMIC); +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index 97689012b357..12a43a5369a5 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -325,7 +325,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * + skb->len += tailen; + skb->data_len += tailen; + skb->truesize += tailen; +- if (sk) ++ if (sk && sk_fullsock(sk)) + refcount_add(tailen, &sk->sk_wmem_alloc); + + goto out; +diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c +index 3cd237b42f44..2fa196325988 100644 +--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c ++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c +@@ -846,9 +846,9 @@ static int clusterip_net_init(struct net *net) + + static void clusterip_net_exit(struct net *net) + { ++#ifdef CONFIG_PROC_FS + struct clusterip_net *cn = clusterip_pernet(net); + +-#ifdef CONFIG_PROC_FS + mutex_lock(&cn->mutex); + proc_remove(cn->procdir); + cn->procdir = NULL; +diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c +index 88a7579c23bd..a7d996148eed 100644 +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -293,7 +293,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info + skb->len += tailen; + skb->data_len += tailen; + skb->truesize += tailen; +- if (sk) ++ if (sk && sk_fullsock(sk)) + refcount_add(tailen, &sk->sk_wmem_alloc); + + goto out; +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 9d61266526e7..7da629d59717 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -196,30 +196,22 @@ static int pfkey_release(struct socket *sock) + return 0; + } + +-static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2, +- gfp_t allocation, struct sock *sk) ++static int pfkey_broadcast_one(struct sk_buff *skb, gfp_t allocation, ++ struct sock *sk) + { + int err = -ENOBUFS; + +- sock_hold(sk); +- if (*skb2 == NULL) { +- if (refcount_read(&skb->users) != 1) { +- *skb2 = skb_clone(skb, allocation); +- } else { +- *skb2 = skb; +- refcount_inc(&skb->users); +- } +- } +- if (*skb2 != NULL) { +- if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) { +- skb_set_owner_r(*skb2, sk); +- skb_queue_tail(&sk->sk_receive_queue, *skb2); +- sk->sk_data_ready(sk); +- *skb2 = NULL; +- err = 0; +- } ++ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) ++ return err; ++ ++ skb = skb_clone(skb, allocation); ++ ++ if (skb) { ++ skb_set_owner_r(skb, sk); ++ skb_queue_tail(&sk->sk_receive_queue, skb); ++ sk->sk_data_ready(sk); ++ err = 0; + } +- sock_put(sk); + return err; + } + +@@ -234,7 +226,6 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, + { + struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id); + struct sock *sk; +- struct sk_buff *skb2 = NULL; + int err = -ESRCH; + + /* XXX Do we need something like netlink_overrun? I think +@@ -253,7 +244,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, + * socket. + */ + if (pfk->promisc) +- pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk); ++ pfkey_broadcast_one(skb, GFP_ATOMIC, sk); + + /* the exact target will be processed later */ + if (sk == one_sk) +@@ -268,7 +259,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, + continue; + } + +- err2 = pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk); ++ err2 = pfkey_broadcast_one(skb, GFP_ATOMIC, sk); + + /* Error is cleared after successful sending to at least one + * registered KM */ +@@ -278,9 +269,8 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, + rcu_read_unlock(); + + if (one_sk != NULL) +- err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk); ++ err = pfkey_broadcast_one(skb, allocation, one_sk); + +- kfree_skb(skb2); + kfree_skb(skb); + return err; + } +diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c +index 69e831bc317b..54821fb1a960 100644 +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -8,7 +8,7 @@ + * Copyright 2007, Michael Wu + * Copyright 2007-2010, Intel Corporation + * Copyright(c) 2015-2017 Intel Deutschland GmbH +- * Copyright (C) 2018 Intel Corporation ++ * Copyright (C) 2018 - 2019 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -366,6 +366,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, + + set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state); + ++ ieee80211_agg_stop_txq(sta, tid); ++ + spin_unlock_bh(&sta->lock); + + ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n", +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 716cd6442d86..3deaa01ebee4 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -5,7 +5,7 @@ + * Copyright 2007 Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH + * Copyright (C) 2015-2017 Intel Deutschland GmbH +- * Copyright (C) 2018 Intel Corporation ++ * Copyright (C) 2018-2019 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -2020,6 +2020,10 @@ int ieee80211_reconfig(struct ieee80211_local *local) + case NL80211_IFTYPE_AP_VLAN: + case NL80211_IFTYPE_MONITOR: + break; ++ case NL80211_IFTYPE_ADHOC: ++ if (sdata->vif.bss_conf.ibss_joined) ++ WARN_ON(drv_join_ibss(local, sdata)); ++ /* fall through */ + default: + ieee80211_reconfig_stations(sdata); + /* fall through */ +diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig +index cad48d07c818..8401cefd9f65 100644 +--- a/net/netfilter/ipvs/Kconfig ++++ b/net/netfilter/ipvs/Kconfig +@@ -29,6 +29,7 @@ config IP_VS_IPV6 + bool "IPv6 support for IPVS" + depends on IPV6 = y || IP_VS = IPV6 + select IP6_NF_IPTABLES ++ select NF_DEFRAG_IPV6 + ---help--- + Add IPv6 support to IPVS. + +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 7ca926a03b81..3f963ea22277 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1536,14 +1536,12 @@ ip_vs_try_to_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, + /* sorry, all this trouble for a no-hit :) */ + IP_VS_DBG_PKT(12, af, pp, skb, iph->off, + "ip_vs_in: packet continues traversal as normal"); +- if (iph->fragoffs) { +- /* Fragment that couldn't be mapped to a conn entry +- * is missing module nf_defrag_ipv6 +- */ +- IP_VS_DBG_RL("Unhandled frag, load nf_defrag_ipv6\n"); ++ ++ /* Fragment couldn't be mapped to a conn entry */ ++ if (iph->fragoffs) + IP_VS_DBG_PKT(7, af, pp, skb, iph->off, + "unhandled fragment"); +- } ++ + *verdict = NF_ACCEPT; + return 0; + } +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index 55a77314340a..8fd8d06454d6 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -43,6 +43,7 @@ + #ifdef CONFIG_IP_VS_IPV6 + #include + #include ++#include + #endif + #include + #include +@@ -895,6 +896,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest, + { + struct ip_vs_dest *dest; + unsigned int atype, i; ++ int ret = 0; + + EnterFunction(2); + +@@ -905,6 +907,10 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest, + atype & IPV6_ADDR_LINKLOCAL) && + !__ip_vs_addr_is_local_v6(svc->ipvs->net, &udest->addr.in6)) + return -EINVAL; ++ ++ ret = nf_defrag_ipv6_enable(svc->ipvs->net); ++ if (ret) ++ return ret; + } else + #endif + { +@@ -1228,6 +1234,10 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, + ret = -EINVAL; + goto out_err; + } ++ ++ ret = nf_defrag_ipv6_enable(ipvs->net); ++ if (ret) ++ goto out_err; + } + #endif + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index aecadd471e1d..13e1ac333fa4 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1899,7 +1899,7 @@ static int __init xt_init(void) + seqcount_init(&per_cpu(xt_recseq, i)); + } + +- xt = kmalloc_array(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL); ++ xt = kcalloc(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL); + if (!xt) + return -ENOMEM; + +diff --git a/net/phonet/pep.c b/net/phonet/pep.c +index 9fc76b19cd3c..db3473540303 100644 +--- a/net/phonet/pep.c ++++ b/net/phonet/pep.c +@@ -132,7 +132,7 @@ static int pep_indicate(struct sock *sk, u8 id, u8 code, + ph->utid = 0; + ph->message_id = id; + ph->pipe_handle = pn->pipe_handle; +- ph->data[0] = code; ++ ph->error_code = code; + return pn_skb_send(sk, skb, NULL); + } + +@@ -153,7 +153,7 @@ static int pipe_handler_request(struct sock *sk, u8 id, u8 code, + ph->utid = id; /* whatever */ + ph->message_id = id; + ph->pipe_handle = pn->pipe_handle; +- ph->data[0] = code; ++ ph->error_code = code; + return pn_skb_send(sk, skb, NULL); + } + +@@ -208,7 +208,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code, + struct pnpipehdr *ph; + struct sockaddr_pn dst; + u8 data[4] = { +- oph->data[0], /* PEP type */ ++ oph->pep_type, /* PEP type */ + code, /* error code, at an unusual offset */ + PAD, PAD, + }; +@@ -221,7 +221,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code, + ph->utid = oph->utid; + ph->message_id = PNS_PEP_CTRL_RESP; + ph->pipe_handle = oph->pipe_handle; +- ph->data[0] = oph->data[1]; /* CTRL id */ ++ ph->data0 = oph->data[0]; /* CTRL id */ + + pn_skb_get_src_sockaddr(oskb, &dst); + return pn_skb_send(sk, skb, &dst); +@@ -272,17 +272,17 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) + return -EINVAL; + + hdr = pnp_hdr(skb); +- if (hdr->data[0] != PN_PEP_TYPE_COMMON) { ++ if (hdr->pep_type != PN_PEP_TYPE_COMMON) { + net_dbg_ratelimited("Phonet unknown PEP type: %u\n", +- (unsigned int)hdr->data[0]); ++ (unsigned int)hdr->pep_type); + return -EOPNOTSUPP; + } + +- switch (hdr->data[1]) { ++ switch (hdr->data[0]) { + case PN_PEP_IND_FLOW_CONTROL: + switch (pn->tx_fc) { + case PN_LEGACY_FLOW_CONTROL: +- switch (hdr->data[4]) { ++ switch (hdr->data[3]) { + case PEP_IND_BUSY: + atomic_set(&pn->tx_credits, 0); + break; +@@ -292,7 +292,7 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) + } + break; + case PN_ONE_CREDIT_FLOW_CONTROL: +- if (hdr->data[4] == PEP_IND_READY) ++ if (hdr->data[3] == PEP_IND_READY) + atomic_set(&pn->tx_credits, wake = 1); + break; + } +@@ -301,12 +301,12 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) + case PN_PEP_IND_ID_MCFC_GRANT_CREDITS: + if (pn->tx_fc != PN_MULTI_CREDIT_FLOW_CONTROL) + break; +- atomic_add(wake = hdr->data[4], &pn->tx_credits); ++ atomic_add(wake = hdr->data[3], &pn->tx_credits); + break; + + default: + net_dbg_ratelimited("Phonet unknown PEP indication: %u\n", +- (unsigned int)hdr->data[1]); ++ (unsigned int)hdr->data[0]); + return -EOPNOTSUPP; + } + if (wake) +@@ -318,7 +318,7 @@ static int pipe_rcv_created(struct sock *sk, struct sk_buff *skb) + { + struct pep_sock *pn = pep_sk(sk); + struct pnpipehdr *hdr = pnp_hdr(skb); +- u8 n_sb = hdr->data[0]; ++ u8 n_sb = hdr->data0; + + pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL; + __skb_pull(skb, sizeof(*hdr)); +@@ -506,7 +506,7 @@ static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb) + return -ECONNREFUSED; + + /* Parse sub-blocks */ +- n_sb = hdr->data[4]; ++ n_sb = hdr->data[3]; + while (n_sb > 0) { + u8 type, buf[6], len = sizeof(buf); + const u8 *data = pep_get_sb(skb, &type, &len, buf); +@@ -739,7 +739,7 @@ static int pipe_do_remove(struct sock *sk) + ph->utid = 0; + ph->message_id = PNS_PIPE_REMOVE_REQ; + ph->pipe_handle = pn->pipe_handle; +- ph->data[0] = PAD; ++ ph->data0 = PAD; + return pn_skb_send(sk, skb, NULL); + } + +@@ -817,7 +817,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp, + peer_type = hdr->other_pep_type << 8; + + /* Parse sub-blocks (options) */ +- n_sb = hdr->data[4]; ++ n_sb = hdr->data[3]; + while (n_sb > 0) { + u8 type, buf[1], len = sizeof(buf); + const u8 *data = pep_get_sb(skb, &type, &len, buf); +@@ -1109,7 +1109,7 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb) + ph->utid = 0; + if (pn->aligned) { + ph->message_id = PNS_PIPE_ALIGNED_DATA; +- ph->data[0] = 0; /* padding */ ++ ph->data0 = 0; /* padding */ + } else + ph->message_id = PNS_PIPE_DATA; + ph->pipe_handle = pn->pipe_handle; +diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c +index 97a8282955a8..8566531c2f10 100644 +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -381,12 +381,16 @@ static int svc_partial_recvfrom(struct svc_rqst *rqstp, + /* + * Set socket snd and rcv buffer lengths + */ +-static void svc_sock_setbufsize(struct socket *sock, unsigned int snd, +- unsigned int rcv) ++static void svc_sock_setbufsize(struct svc_sock *svsk, unsigned int nreqs) + { ++ unsigned int max_mesg = svsk->sk_xprt.xpt_server->sv_max_mesg; ++ struct socket *sock = svsk->sk_sock; ++ ++ nreqs = min(nreqs, INT_MAX / 2 / max_mesg); ++ + lock_sock(sock->sk); +- sock->sk->sk_sndbuf = snd * 2; +- sock->sk->sk_rcvbuf = rcv * 2; ++ sock->sk->sk_sndbuf = nreqs * max_mesg * 2; ++ sock->sk->sk_rcvbuf = nreqs * max_mesg * 2; + sock->sk->sk_write_space(sock->sk); + release_sock(sock->sk); + } +@@ -548,9 +552,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp) + * provides an upper bound on the number of threads + * which will access the socket. + */ +- svc_sock_setbufsize(svsk->sk_sock, +- (serv->sv_nrthreads+3) * serv->sv_max_mesg, +- (serv->sv_nrthreads+3) * serv->sv_max_mesg); ++ svc_sock_setbufsize(svsk, serv->sv_nrthreads + 3); + + clear_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags); + skb = NULL; +@@ -718,9 +720,7 @@ static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv) + * receive and respond to one request. + * svc_udp_recvfrom will re-adjust if necessary + */ +- svc_sock_setbufsize(svsk->sk_sock, +- 3 * svsk->sk_xprt.xpt_server->sv_max_mesg, +- 3 * svsk->sk_xprt.xpt_server->sv_max_mesg); ++ svc_sock_setbufsize(svsk, 3); + + /* data might have come in before data_ready set up */ + set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags); +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 3d6bf790cf1f..5ddbf227e7c6 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -546,7 +546,8 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia, + + sendcq = ib_alloc_cq(ia->ri_device, NULL, + ep->rep_attr.cap.max_send_wr + 1, +- 1, IB_POLL_WORKQUEUE); ++ ia->ri_device->num_comp_vectors > 1 ? 1 : 0, ++ IB_POLL_WORKQUEUE); + if (IS_ERR(sendcq)) { + rc = PTR_ERR(sendcq); + dprintk("RPC: %s: failed to create send CQ: %i\n", +diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c +index 6f05e831a73e..82723ef44db3 100644 +--- a/net/xfrm/xfrm_interface.c ++++ b/net/xfrm/xfrm_interface.c +@@ -76,10 +76,10 @@ static struct xfrm_if *xfrmi_decode_session(struct sk_buff *skb) + int ifindex; + struct xfrm_if *xi; + +- if (!skb->dev) ++ if (!secpath_exists(skb) || !skb->dev) + return NULL; + +- xfrmn = net_generic(dev_net(skb->dev), xfrmi_net_id); ++ xfrmn = net_generic(xs_net(xfrm_input_state(skb)), xfrmi_net_id); + ifindex = skb->dev->ifindex; + + for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) { +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 6ea8036fcdbe..bf5d59270f79 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -2340,8 +2340,10 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, + + if (ifcb) { + xi = ifcb->decode_session(skb); +- if (xi) ++ if (xi) { + if_id = xi->p.if_id; ++ net = xi->net; ++ } + } + rcu_read_unlock(); + +diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c +index a9186a98a37d..0c9c54b57515 100644 +--- a/scripts/kallsyms.c ++++ b/scripts/kallsyms.c +@@ -120,8 +120,8 @@ static int read_symbol(FILE *in, struct sym_entry *s) + fprintf(stderr, "Read error or end of file.\n"); + return -1; + } +- if (strlen(sym) > KSYM_NAME_LEN) { +- fprintf(stderr, "Symbol %s too long for kallsyms (%zu vs %d).\n" ++ if (strlen(sym) >= KSYM_NAME_LEN) { ++ fprintf(stderr, "Symbol %s too long for kallsyms (%zu >= %d).\n" + "Please increase KSYM_NAME_LEN both in kernel and kallsyms.c\n", + sym, strlen(sym), KSYM_NAME_LEN); + return -1; +diff --git a/security/keys/internal.h b/security/keys/internal.h +index 9f8208dc0e55..a02742621c8d 100644 +--- a/security/keys/internal.h ++++ b/security/keys/internal.h +@@ -188,20 +188,9 @@ static inline int key_permission(const key_ref_t key_ref, unsigned perm) + return key_task_permission(key_ref, current_cred(), perm); + } + +-/* +- * Authorisation record for request_key(). +- */ +-struct request_key_auth { +- struct key *target_key; +- struct key *dest_keyring; +- const struct cred *cred; +- void *callout_info; +- size_t callout_len; +- pid_t pid; +-} __randomize_layout; +- + extern struct key_type key_type_request_key_auth; + extern struct key *request_key_auth_new(struct key *target, ++ const char *op, + const void *callout_info, + size_t callout_len, + struct key *dest_keyring); +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index 1ffe60bb2845..ca31af186abd 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include "internal.h" + + #define KEY_MAX_DESC_SIZE 4096 +diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c +index d5b25e535d3a..d776d2114651 100644 +--- a/security/keys/process_keys.c ++++ b/security/keys/process_keys.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include "internal.h" + + /* Session keyring create vs join semaphore */ +diff --git a/security/keys/request_key.c b/security/keys/request_key.c +index 738553698649..1a547cec8385 100644 +--- a/security/keys/request_key.c ++++ b/security/keys/request_key.c +@@ -18,31 +18,30 @@ + #include + #include + #include "internal.h" ++#include + + #define key_negative_timeout 60 /* default timeout on a negative key's existence */ + + /** + * complete_request_key - Complete the construction of a key. +- * @cons: The key construction record. ++ * @auth_key: The authorisation key. + * @error: The success or failute of the construction. + * + * Complete the attempt to construct a key. The key will be negated + * if an error is indicated. The authorisation key will be revoked + * unconditionally. + */ +-void complete_request_key(struct key_construction *cons, int error) ++void complete_request_key(struct key *authkey, int error) + { +- kenter("{%d,%d},%d", cons->key->serial, cons->authkey->serial, error); ++ struct request_key_auth *rka = get_request_key_auth(authkey); ++ struct key *key = rka->target_key; ++ ++ kenter("%d{%d},%d", authkey->serial, key->serial, error); + + if (error < 0) +- key_negate_and_link(cons->key, key_negative_timeout, NULL, +- cons->authkey); ++ key_negate_and_link(key, key_negative_timeout, NULL, authkey); + else +- key_revoke(cons->authkey); +- +- key_put(cons->key); +- key_put(cons->authkey); +- kfree(cons); ++ key_revoke(authkey); + } + EXPORT_SYMBOL(complete_request_key); + +@@ -91,21 +90,19 @@ static int call_usermodehelper_keys(const char *path, char **argv, char **envp, + * Request userspace finish the construction of a key + * - execute "/sbin/request-key " + */ +-static int call_sbin_request_key(struct key_construction *cons, +- const char *op, +- void *aux) ++static int call_sbin_request_key(struct key *authkey, void *aux) + { + static char const request_key[] = "/sbin/request-key"; ++ struct request_key_auth *rka = get_request_key_auth(authkey); + const struct cred *cred = current_cred(); + key_serial_t prkey, sskey; +- struct key *key = cons->key, *authkey = cons->authkey, *keyring, +- *session; ++ struct key *key = rka->target_key, *keyring, *session; + char *argv[9], *envp[3], uid_str[12], gid_str[12]; + char key_str[12], keyring_str[3][12]; + char desc[20]; + int ret, i; + +- kenter("{%d},{%d},%s", key->serial, authkey->serial, op); ++ kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op); + + ret = install_user_keyrings(); + if (ret < 0) +@@ -163,7 +160,7 @@ static int call_sbin_request_key(struct key_construction *cons, + /* set up the argument list */ + i = 0; + argv[i++] = (char *)request_key; +- argv[i++] = (char *) op; ++ argv[i++] = (char *)rka->op; + argv[i++] = key_str; + argv[i++] = uid_str; + argv[i++] = gid_str; +@@ -191,7 +188,7 @@ error_link: + key_put(keyring); + + error_alloc: +- complete_request_key(cons, ret); ++ complete_request_key(authkey, ret); + kleave(" = %d", ret); + return ret; + } +@@ -205,42 +202,31 @@ static int construct_key(struct key *key, const void *callout_info, + size_t callout_len, void *aux, + struct key *dest_keyring) + { +- struct key_construction *cons; + request_key_actor_t actor; + struct key *authkey; + int ret; + + kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux); + +- cons = kmalloc(sizeof(*cons), GFP_KERNEL); +- if (!cons) +- return -ENOMEM; +- + /* allocate an authorisation key */ +- authkey = request_key_auth_new(key, callout_info, callout_len, ++ authkey = request_key_auth_new(key, "create", callout_info, callout_len, + dest_keyring); +- if (IS_ERR(authkey)) { +- kfree(cons); +- ret = PTR_ERR(authkey); +- authkey = NULL; +- } else { +- cons->authkey = key_get(authkey); +- cons->key = key_get(key); ++ if (IS_ERR(authkey)) ++ return PTR_ERR(authkey); + +- /* make the call */ +- actor = call_sbin_request_key; +- if (key->type->request_key) +- actor = key->type->request_key; ++ /* Make the call */ ++ actor = call_sbin_request_key; ++ if (key->type->request_key) ++ actor = key->type->request_key; + +- ret = actor(cons, "create", aux); ++ ret = actor(authkey, aux); + +- /* check that the actor called complete_request_key() prior to +- * returning an error */ +- WARN_ON(ret < 0 && +- !test_bit(KEY_FLAG_REVOKED, &authkey->flags)); +- key_put(authkey); +- } ++ /* check that the actor called complete_request_key() prior to ++ * returning an error */ ++ WARN_ON(ret < 0 && ++ !test_bit(KEY_FLAG_REVOKED, &authkey->flags)); + ++ key_put(authkey); + kleave(" = %d", ret); + return ret; + } +@@ -275,7 +261,7 @@ static int construct_get_dest_keyring(struct key **_dest_keyring) + if (cred->request_key_auth) { + authkey = cred->request_key_auth; + down_read(&authkey->sem); +- rka = authkey->payload.data[0]; ++ rka = get_request_key_auth(authkey); + if (!test_bit(KEY_FLAG_REVOKED, + &authkey->flags)) + dest_keyring = +diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c +index 6797843154f0..5e515791ccd1 100644 +--- a/security/keys/request_key_auth.c ++++ b/security/keys/request_key_auth.c +@@ -18,7 +18,7 @@ + #include + #include + #include "internal.h" +-#include ++#include + + static int request_key_auth_preparse(struct key_preparsed_payload *); + static void request_key_auth_free_preparse(struct key_preparsed_payload *); +@@ -69,7 +69,7 @@ static int request_key_auth_instantiate(struct key *key, + static void request_key_auth_describe(const struct key *key, + struct seq_file *m) + { +- struct request_key_auth *rka = key->payload.data[0]; ++ struct request_key_auth *rka = get_request_key_auth(key); + + seq_puts(m, "key:"); + seq_puts(m, key->description); +@@ -84,7 +84,7 @@ static void request_key_auth_describe(const struct key *key, + static long request_key_auth_read(const struct key *key, + char __user *buffer, size_t buflen) + { +- struct request_key_auth *rka = key->payload.data[0]; ++ struct request_key_auth *rka = get_request_key_auth(key); + size_t datalen; + long ret; + +@@ -110,7 +110,7 @@ static long request_key_auth_read(const struct key *key, + */ + static void request_key_auth_revoke(struct key *key) + { +- struct request_key_auth *rka = key->payload.data[0]; ++ struct request_key_auth *rka = get_request_key_auth(key); + + kenter("{%d}", key->serial); + +@@ -137,7 +137,7 @@ static void free_request_key_auth(struct request_key_auth *rka) + */ + static void request_key_auth_destroy(struct key *key) + { +- struct request_key_auth *rka = key->payload.data[0]; ++ struct request_key_auth *rka = get_request_key_auth(key); + + kenter("{%d}", key->serial); + +@@ -148,8 +148,9 @@ static void request_key_auth_destroy(struct key *key) + * Create an authorisation token for /sbin/request-key or whoever to gain + * access to the caller's security data. + */ +-struct key *request_key_auth_new(struct key *target, const void *callout_info, +- size_t callout_len, struct key *dest_keyring) ++struct key *request_key_auth_new(struct key *target, const char *op, ++ const void *callout_info, size_t callout_len, ++ struct key *dest_keyring) + { + struct request_key_auth *rka, *irka; + const struct cred *cred = current->cred; +@@ -167,6 +168,7 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info, + if (!rka->callout_info) + goto error_free_rka; + rka->callout_len = callout_len; ++ strlcpy(rka->op, op, sizeof(rka->op)); + + /* see if the calling process is already servicing the key request of + * another process */ +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 3c3878f0d2fa..6ea3d3aa1a1e 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1034,8 +1034,11 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb, + BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED)); + + /* if fs is reusing a sb, make sure that the contexts match */ +- if (newsbsec->flags & SE_SBINITIALIZED) ++ if (newsbsec->flags & SE_SBINITIALIZED) { ++ if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) ++ *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS; + return selinux_cmp_sb_context(oldsb, newsb); ++ } + + mutex_lock(&newsbsec->lock); + +@@ -5334,6 +5337,9 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname, + return -EINVAL; + } + ++ if (walk_size + len > addrlen) ++ return -EINVAL; ++ + err = -EINVAL; + switch (optname) { + /* Bind checks */ +diff --git a/sound/soc/codecs/pcm186x.c b/sound/soc/codecs/pcm186x.c +index 690c26e7389e..3be0e1478d7d 100644 +--- a/sound/soc/codecs/pcm186x.c ++++ b/sound/soc/codecs/pcm186x.c +@@ -42,7 +42,7 @@ struct pcm186x_priv { + bool is_master_mode; + }; + +-static const DECLARE_TLV_DB_SCALE(pcm186x_pga_tlv, -1200, 4000, 50); ++static const DECLARE_TLV_DB_SCALE(pcm186x_pga_tlv, -1200, 50, 0); + + static const struct snd_kcontrol_new pcm1863_snd_controls[] = { + SOC_DOUBLE_R_S_TLV("ADC Capture Volume", PCM186X_PGA_VAL_CH1_L, +@@ -158,7 +158,7 @@ static const struct snd_soc_dapm_widget pcm1863_dapm_widgets[] = { + * Put the codec into SLEEP mode when not in use, allowing the + * Energysense mechanism to operate. + */ +- SND_SOC_DAPM_ADC("ADC", "HiFi Capture", PCM186X_POWER_CTRL, 1, 0), ++ SND_SOC_DAPM_ADC("ADC", "HiFi Capture", PCM186X_POWER_CTRL, 1, 1), + }; + + static const struct snd_soc_dapm_widget pcm1865_dapm_widgets[] = { +@@ -184,8 +184,8 @@ static const struct snd_soc_dapm_widget pcm1865_dapm_widgets[] = { + * Put the codec into SLEEP mode when not in use, allowing the + * Energysense mechanism to operate. + */ +- SND_SOC_DAPM_ADC("ADC1", "HiFi Capture 1", PCM186X_POWER_CTRL, 1, 0), +- SND_SOC_DAPM_ADC("ADC2", "HiFi Capture 2", PCM186X_POWER_CTRL, 1, 0), ++ SND_SOC_DAPM_ADC("ADC1", "HiFi Capture 1", PCM186X_POWER_CTRL, 1, 1), ++ SND_SOC_DAPM_ADC("ADC2", "HiFi Capture 2", PCM186X_POWER_CTRL, 1, 1), + }; + + static const struct snd_soc_dapm_route pcm1863_dapm_routes[] = { +diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c +index afe7d5b19313..79ebcc239786 100644 +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -1757,7 +1757,9 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = { + {"ADC Stereo1 Filter", NULL, "ADC STO1 ASRC", is_using_asrc}, + {"DAC Stereo1 Filter", NULL, "DAC STO1 ASRC", is_using_asrc}, + {"ADC STO1 ASRC", NULL, "AD ASRC"}, ++ {"ADC STO1 ASRC", NULL, "DA ASRC"}, + {"ADC STO1 ASRC", NULL, "CLKDET"}, ++ {"DAC STO1 ASRC", NULL, "AD ASRC"}, + {"DAC STO1 ASRC", NULL, "DA ASRC"}, + {"DAC STO1 ASRC", NULL, "CLKDET"}, + +diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c +index c1d1d06783e5..4daefa5b150a 100644 +--- a/sound/soc/fsl/fsl_esai.c ++++ b/sound/soc/fsl/fsl_esai.c +@@ -398,7 +398,8 @@ static int fsl_esai_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt) + break; + case SND_SOC_DAIFMT_RIGHT_J: + /* Data on rising edge of bclk, frame high, right aligned */ +- xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCR_xWA; ++ xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP; ++ xcr |= ESAI_xCR_xWA; + break; + case SND_SOC_DAIFMT_DSP_A: + /* Data on rising edge of bclk, frame high, 1clk before data */ +@@ -455,12 +456,12 @@ static int fsl_esai_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt) + return -EINVAL; + } + +- mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR; ++ mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR | ESAI_xCR_xWA; + regmap_update_bits(esai_priv->regmap, REG_ESAI_TCR, mask, xcr); + regmap_update_bits(esai_priv->regmap, REG_ESAI_RCR, mask, xcr); + + mask = ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCCR_xFSP | +- ESAI_xCCR_xFSD | ESAI_xCCR_xCKD | ESAI_xCR_xWA; ++ ESAI_xCCR_xFSD | ESAI_xCCR_xCKD; + regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR, mask, xccr); + regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR, mask, xccr); + +diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c +index d6c62aa13041..ce00fe2f6aae 100644 +--- a/sound/soc/samsung/i2s.c ++++ b/sound/soc/samsung/i2s.c +@@ -700,6 +700,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream, + { + struct i2s_dai *i2s = to_info(dai); + u32 mod, mask = 0, val = 0; ++ struct clk *rclksrc; + unsigned long flags; + + WARN_ON(!pm_runtime_active(dai->dev)); +@@ -782,6 +783,10 @@ static int i2s_hw_params(struct snd_pcm_substream *substream, + + i2s->frmclk = params_rate(params); + ++ rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC]; ++ if (rclksrc && !IS_ERR(rclksrc)) ++ i2s->rclk_srcrate = clk_get_rate(rclksrc); ++ + return 0; + } + +@@ -886,11 +891,6 @@ static int config_setup(struct i2s_dai *i2s) + return 0; + + if (!(i2s->quirks & QUIRK_NO_MUXPSR)) { +- struct clk *rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC]; +- +- if (rclksrc && !IS_ERR(rclksrc)) +- i2s->rclk_srcrate = clk_get_rate(rclksrc); +- + psr = i2s->rclk_srcrate / i2s->frmclk / rfs; + writel(((psr - 1) << 8) | PSR_PSREN, i2s->addr + I2SPSR); + dev_dbg(&i2s->pdev->dev, +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index a566dae3ec8a..9410e0a9b14b 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -283,7 +283,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod, + if (rsnd_ssi_is_multi_slave(mod, io)) + return 0; + +- if (ssi->usrcnt > 1) { ++ if (ssi->usrcnt > 0) { + if (ssi->rate != rate) { + dev_err(dev, "SSI parent/child should use same rate\n"); + return -EINVAL; +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 653706945222..9b78fb3daa7b 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -71,12 +71,16 @@ static int dapm_up_seq[] = { + [snd_soc_dapm_clock_supply] = 1, + [snd_soc_dapm_supply] = 2, + [snd_soc_dapm_micbias] = 3, ++ [snd_soc_dapm_vmid] = 3, + [snd_soc_dapm_dai_link] = 2, + [snd_soc_dapm_dai_in] = 4, + [snd_soc_dapm_dai_out] = 4, + [snd_soc_dapm_aif_in] = 4, + [snd_soc_dapm_aif_out] = 4, + [snd_soc_dapm_mic] = 5, ++ [snd_soc_dapm_siggen] = 5, ++ [snd_soc_dapm_input] = 5, ++ [snd_soc_dapm_output] = 5, + [snd_soc_dapm_mux] = 6, + [snd_soc_dapm_demux] = 6, + [snd_soc_dapm_dac] = 7, +@@ -84,11 +88,19 @@ static int dapm_up_seq[] = { + [snd_soc_dapm_mixer] = 8, + [snd_soc_dapm_mixer_named_ctl] = 8, + [snd_soc_dapm_pga] = 9, ++ [snd_soc_dapm_buffer] = 9, ++ [snd_soc_dapm_scheduler] = 9, ++ [snd_soc_dapm_effect] = 9, ++ [snd_soc_dapm_src] = 9, ++ [snd_soc_dapm_asrc] = 9, ++ [snd_soc_dapm_encoder] = 9, ++ [snd_soc_dapm_decoder] = 9, + [snd_soc_dapm_adc] = 10, + [snd_soc_dapm_out_drv] = 11, + [snd_soc_dapm_hp] = 11, + [snd_soc_dapm_spk] = 11, + [snd_soc_dapm_line] = 11, ++ [snd_soc_dapm_sink] = 11, + [snd_soc_dapm_kcontrol] = 12, + [snd_soc_dapm_post] = 13, + }; +@@ -101,13 +113,25 @@ static int dapm_down_seq[] = { + [snd_soc_dapm_spk] = 3, + [snd_soc_dapm_line] = 3, + [snd_soc_dapm_out_drv] = 3, ++ [snd_soc_dapm_sink] = 3, + [snd_soc_dapm_pga] = 4, ++ [snd_soc_dapm_buffer] = 4, ++ [snd_soc_dapm_scheduler] = 4, ++ [snd_soc_dapm_effect] = 4, ++ [snd_soc_dapm_src] = 4, ++ [snd_soc_dapm_asrc] = 4, ++ [snd_soc_dapm_encoder] = 4, ++ [snd_soc_dapm_decoder] = 4, + [snd_soc_dapm_switch] = 5, + [snd_soc_dapm_mixer_named_ctl] = 5, + [snd_soc_dapm_mixer] = 5, + [snd_soc_dapm_dac] = 6, + [snd_soc_dapm_mic] = 7, ++ [snd_soc_dapm_siggen] = 7, ++ [snd_soc_dapm_input] = 7, ++ [snd_soc_dapm_output] = 7, + [snd_soc_dapm_micbias] = 8, ++ [snd_soc_dapm_vmid] = 8, + [snd_soc_dapm_mux] = 9, + [snd_soc_dapm_demux] = 9, + [snd_soc_dapm_aif_in] = 10, +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 66e77e020745..88a7e860b175 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -2493,6 +2493,7 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp, + struct snd_soc_tplg_ops *ops, const struct firmware *fw, u32 id) + { + struct soc_tplg tplg; ++ int ret; + + /* setup parsing context */ + memset(&tplg, 0, sizeof(tplg)); +@@ -2506,7 +2507,12 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp, + tplg.bytes_ext_ops = ops->bytes_ext_ops; + tplg.bytes_ext_ops_count = ops->bytes_ext_ops_count; + +- return soc_tplg_load(&tplg); ++ ret = soc_tplg_load(&tplg); ++ /* free the created components if fail to load topology */ ++ if (ret) ++ snd_soc_tplg_component_remove(comp, SND_SOC_TPLG_INDEX_ALL); ++ ++ return ret; + } + EXPORT_SYMBOL_GPL(snd_soc_tplg_component_load); + +diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c +index db1511359c5e..40c93d8158b5 100644 +--- a/tools/perf/util/auxtrace.c ++++ b/tools/perf/util/auxtrace.c +@@ -1273,9 +1273,9 @@ static int __auxtrace_mmap__read(struct auxtrace_mmap *mm, + } + + /* padding must be written by fn() e.g. record__process_auxtrace() */ +- padding = size & 7; ++ padding = size & (PERF_AUXTRACE_RECORD_ALIGNMENT - 1); + if (padding) +- padding = 8 - padding; ++ padding = PERF_AUXTRACE_RECORD_ALIGNMENT - padding; + + memset(&ev, 0, sizeof(ev)); + ev.auxtrace.header.type = PERF_RECORD_AUXTRACE; +diff --git a/tools/perf/util/auxtrace.h b/tools/perf/util/auxtrace.h +index 71fc3bd74299..136c5f95f9bf 100644 +--- a/tools/perf/util/auxtrace.h ++++ b/tools/perf/util/auxtrace.h +@@ -38,6 +38,9 @@ struct record_opts; + struct auxtrace_info_event; + struct events_stats; + ++/* Auxtrace records must have the same alignment as perf event records */ ++#define PERF_AUXTRACE_RECORD_ALIGNMENT 8 ++ + enum auxtrace_type { + PERF_AUXTRACE_UNKNOWN, + PERF_AUXTRACE_INTEL_PT, +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +index d404bed7003a..f3db68abbd9a 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +@@ -26,6 +26,7 @@ + + #include "../cache.h" + #include "../util.h" ++#include "../auxtrace.h" + + #include "intel-pt-insn-decoder.h" + #include "intel-pt-pkt-decoder.h" +@@ -1389,7 +1390,6 @@ static int intel_pt_overflow(struct intel_pt_decoder *decoder) + { + intel_pt_log("ERROR: Buffer overflow\n"); + intel_pt_clear_tx_flags(decoder); +- decoder->cbr = 0; + decoder->timestamp_insn_cnt = 0; + decoder->pkt_state = INTEL_PT_STATE_ERR_RESYNC; + decoder->overflow = true; +@@ -2559,6 +2559,34 @@ static int intel_pt_tsc_cmp(uint64_t tsc1, uint64_t tsc2) + } + } + ++#define MAX_PADDING (PERF_AUXTRACE_RECORD_ALIGNMENT - 1) ++ ++/** ++ * adj_for_padding - adjust overlap to account for padding. ++ * @buf_b: second buffer ++ * @buf_a: first buffer ++ * @len_a: size of first buffer ++ * ++ * @buf_a might have up to 7 bytes of padding appended. Adjust the overlap ++ * accordingly. ++ * ++ * Return: A pointer into @buf_b from where non-overlapped data starts ++ */ ++static unsigned char *adj_for_padding(unsigned char *buf_b, ++ unsigned char *buf_a, size_t len_a) ++{ ++ unsigned char *p = buf_b - MAX_PADDING; ++ unsigned char *q = buf_a + len_a - MAX_PADDING; ++ int i; ++ ++ for (i = MAX_PADDING; i; i--, p++, q++) { ++ if (*p != *q) ++ break; ++ } ++ ++ return p; ++} ++ + /** + * intel_pt_find_overlap_tsc - determine start of non-overlapped trace data + * using TSC. +@@ -2609,8 +2637,11 @@ static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a, + + /* Same TSC, so buffers are consecutive */ + if (!cmp && rem_b >= rem_a) { ++ unsigned char *start; ++ + *consecutive = true; +- return buf_b + len_b - (rem_b - rem_a); ++ start = buf_b + len_b - (rem_b - rem_a); ++ return adj_for_padding(start, buf_a, len_a); + } + if (cmp < 0) + return buf_b; /* tsc_a < tsc_b => no overlap */ +@@ -2673,7 +2704,7 @@ unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, + found = memmem(buf_a, len_a, buf_b, len_a); + if (found) { + *consecutive = true; +- return buf_b + len_a; ++ return adj_for_padding(buf_b + len_a, buf_a, len_a); + } + + /* Try again at next PSB in buffer 'a' */ +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index 4f48bc11a29c..ff2c41ea94c8 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -2507,6 +2507,8 @@ int intel_pt_process_auxtrace_info(union perf_event *event, + } + + pt->timeless_decoding = intel_pt_timeless_decoding(pt); ++ if (pt->timeless_decoding && !pt->tc.time_mult) ++ pt->tc.time_mult = 1; + pt->have_tsc = intel_pt_have_tsc(pt); + pt->sampling_mode = false; + pt->est_tsc = !pt->timeless_decoding; +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index d188b7588152..0715f972a275 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -709,6 +709,8 @@ static int map_groups__split_kallsyms_for_kcore(struct map_groups *kmaps, struct + } + + pos->start -= curr_map->start - curr_map->pgoff; ++ if (pos->end > curr_map->end) ++ pos->end = curr_map->end; + if (pos->end) + pos->end -= curr_map->start - curr_map->pgoff; + symbols__insert(&curr_map->dso->symbols, pos); +diff --git a/tools/testing/selftests/bpf/test_lpm_map.c b/tools/testing/selftests/bpf/test_lpm_map.c +index 147e34cfceb7..02d7c871862a 100644 +--- a/tools/testing/selftests/bpf/test_lpm_map.c ++++ b/tools/testing/selftests/bpf/test_lpm_map.c +@@ -474,6 +474,16 @@ static void test_lpm_delete(void) + assert(bpf_map_lookup_elem(map_fd, key, &value) == -1 && + errno == ENOENT); + ++ key->prefixlen = 30; // unused prefix so far ++ inet_pton(AF_INET, "192.255.0.0", key->data); ++ assert(bpf_map_delete_elem(map_fd, key) == -1 && ++ errno == ENOENT); ++ ++ key->prefixlen = 16; // same prefix as the root node ++ inet_pton(AF_INET, "192.255.0.0", key->data); ++ assert(bpf_map_delete_elem(map_fd, key) == -1 && ++ errno == ENOENT); ++ + /* assert initial lookup */ + key->prefixlen = 32; + inet_pton(AF_INET, "192.168.0.1", key->data); +diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh +index 0f45633bd634..a4ccde0e473b 100755 +--- a/tools/testing/selftests/net/fib_tests.sh ++++ b/tools/testing/selftests/net/fib_tests.sh +@@ -385,6 +385,7 @@ fib_carrier_unicast_test() + + set -e + $IP link set dev dummy0 carrier off ++ sleep 1 + set +e + + echo " Carrier down" +diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c +index 91495045ad5a..1415e36fed3d 100644 +--- a/virt/kvm/arm/arm.c ++++ b/virt/kvm/arm/arm.c +@@ -624,6 +624,13 @@ static void vcpu_req_sleep(struct kvm_vcpu *vcpu) + /* Awaken to handle a signal, request we sleep again later. */ + kvm_make_request(KVM_REQ_SLEEP, vcpu); + } ++ ++ /* ++ * Make sure we will observe a potential reset request if we've ++ * observed a change to the power state. Pairs with the smp_wmb() in ++ * kvm_psci_vcpu_on(). ++ */ ++ smp_rmb(); + } + + static int kvm_vcpu_initialized(struct kvm_vcpu *vcpu) +@@ -637,6 +644,9 @@ static void check_vcpu_requests(struct kvm_vcpu *vcpu) + if (kvm_check_request(KVM_REQ_SLEEP, vcpu)) + vcpu_req_sleep(vcpu); + ++ if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu)) ++ kvm_reset_vcpu(vcpu); ++ + /* + * Clear IRQ_PENDING requests that were made to guarantee + * that a VCPU sees new virtual interrupts. +diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c +index 2f405b0be25c..1344557a7085 100644 +--- a/virt/kvm/arm/mmu.c ++++ b/virt/kvm/arm/mmu.c +@@ -2154,7 +2154,7 @@ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot, + return 0; + } + +-void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) ++void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) + { + } + +diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c +index 9b73d3ad918a..34d08ee63747 100644 +--- a/virt/kvm/arm/psci.c ++++ b/virt/kvm/arm/psci.c +@@ -104,12 +104,10 @@ static void kvm_psci_vcpu_off(struct kvm_vcpu *vcpu) + + static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu) + { ++ struct vcpu_reset_state *reset_state; + struct kvm *kvm = source_vcpu->kvm; + struct kvm_vcpu *vcpu = NULL; +- struct swait_queue_head *wq; + unsigned long cpu_id; +- unsigned long context_id; +- phys_addr_t target_pc; + + cpu_id = smccc_get_arg1(source_vcpu) & MPIDR_HWID_BITMASK; + if (vcpu_mode_is_32bit(source_vcpu)) +@@ -130,32 +128,30 @@ static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu) + return PSCI_RET_INVALID_PARAMS; + } + +- target_pc = smccc_get_arg2(source_vcpu); +- context_id = smccc_get_arg3(source_vcpu); ++ reset_state = &vcpu->arch.reset_state; + +- kvm_reset_vcpu(vcpu); +- +- /* Gracefully handle Thumb2 entry point */ +- if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) { +- target_pc &= ~((phys_addr_t) 1); +- vcpu_set_thumb(vcpu); +- } ++ reset_state->pc = smccc_get_arg2(source_vcpu); + + /* Propagate caller endianness */ +- if (kvm_vcpu_is_be(source_vcpu)) +- kvm_vcpu_set_be(vcpu); ++ reset_state->be = kvm_vcpu_is_be(source_vcpu); + +- *vcpu_pc(vcpu) = target_pc; + /* + * NOTE: We always update r0 (or x0) because for PSCI v0.1 + * the general puspose registers are undefined upon CPU_ON. + */ +- smccc_set_retval(vcpu, context_id, 0, 0, 0); +- vcpu->arch.power_off = false; +- smp_mb(); /* Make sure the above is visible */ ++ reset_state->r0 = smccc_get_arg3(source_vcpu); ++ ++ WRITE_ONCE(reset_state->reset, true); ++ kvm_make_request(KVM_REQ_VCPU_RESET, vcpu); + +- wq = kvm_arch_vcpu_wq(vcpu); +- swake_up_one(wq); ++ /* ++ * Make sure the reset request is observed if the change to ++ * power_state is observed. ++ */ ++ smp_wmb(); ++ ++ vcpu->arch.power_off = false; ++ kvm_vcpu_wake_up(vcpu); + + return PSCI_RET_SUCCESS; + } +diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c +index c0c0b88af1d5..8196e4f8731f 100644 +--- a/virt/kvm/arm/vgic/vgic-init.c ++++ b/virt/kvm/arm/vgic/vgic-init.c +@@ -64,7 +64,7 @@ void kvm_vgic_early_init(struct kvm *kvm) + struct vgic_dist *dist = &kvm->arch.vgic; + + INIT_LIST_HEAD(&dist->lpi_list_head); +- spin_lock_init(&dist->lpi_list_lock); ++ raw_spin_lock_init(&dist->lpi_list_lock); + } + + /* CREATION */ +@@ -231,13 +231,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu) + irq->config = VGIC_CONFIG_LEVEL; + } + +- /* +- * GICv3 can only be created via the KVM_DEVICE_CREATE API and +- * so we always know the emulation type at this point as it's +- * either explicitly configured as GICv3, or explicitly +- * configured as GICv2, or not configured yet which also +- * implies GICv2. +- */ + if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) + irq->group = 1; + else +@@ -281,7 +274,7 @@ int vgic_init(struct kvm *kvm) + { + struct vgic_dist *dist = &kvm->arch.vgic; + struct kvm_vcpu *vcpu; +- int ret = 0, i; ++ int ret = 0, i, idx; + + if (vgic_initialized(kvm)) + return 0; +@@ -298,6 +291,19 @@ int vgic_init(struct kvm *kvm) + if (ret) + goto out; + ++ /* Initialize groups on CPUs created before the VGIC type was known */ ++ kvm_for_each_vcpu(idx, vcpu, kvm) { ++ struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu; ++ ++ for (i = 0; i < VGIC_NR_PRIVATE_IRQS; i++) { ++ struct vgic_irq *irq = &vgic_cpu->private_irqs[i]; ++ if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) ++ irq->group = 1; ++ else ++ irq->group = 0; ++ } ++ } ++ + if (vgic_has_its(kvm)) { + ret = vgic_v4_init(kvm); + if (ret) +diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c +index 12502251727e..f376c82afb61 100644 +--- a/virt/kvm/arm/vgic/vgic-its.c ++++ b/virt/kvm/arm/vgic/vgic-its.c +@@ -73,7 +73,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid, + irq->target_vcpu = vcpu; + irq->group = 1; + +- spin_lock_irqsave(&dist->lpi_list_lock, flags); ++ raw_spin_lock_irqsave(&dist->lpi_list_lock, flags); + + /* + * There could be a race with another vgic_add_lpi(), so we need to +@@ -101,7 +101,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid, + dist->lpi_list_count++; + + out_unlock: +- spin_unlock_irqrestore(&dist->lpi_list_lock, flags); ++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags); + + /* + * We "cache" the configuration table entries in our struct vgic_irq's. +@@ -339,7 +339,7 @@ int vgic_copy_lpi_list(struct kvm *kvm, struct kvm_vcpu *vcpu, u32 **intid_ptr) + if (!intids) + return -ENOMEM; + +- spin_lock_irqsave(&dist->lpi_list_lock, flags); ++ raw_spin_lock_irqsave(&dist->lpi_list_lock, flags); + list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) { + if (i == irq_count) + break; +@@ -348,7 +348,7 @@ int vgic_copy_lpi_list(struct kvm *kvm, struct kvm_vcpu *vcpu, u32 **intid_ptr) + continue; + intids[i++] = irq->intid; + } +- spin_unlock_irqrestore(&dist->lpi_list_lock, flags); ++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags); + + *intid_ptr = intids; + return i; +diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c +index f884a54b2601..c5165e3b80cb 100644 +--- a/virt/kvm/arm/vgic/vgic.c ++++ b/virt/kvm/arm/vgic/vgic.c +@@ -72,7 +72,7 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid) + struct vgic_irq *irq = NULL; + unsigned long flags; + +- spin_lock_irqsave(&dist->lpi_list_lock, flags); ++ raw_spin_lock_irqsave(&dist->lpi_list_lock, flags); + + list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) { + if (irq->intid != intid) +@@ -88,7 +88,7 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid) + irq = NULL; + + out_unlock: +- spin_unlock_irqrestore(&dist->lpi_list_lock, flags); ++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags); + + return irq; + } +@@ -138,15 +138,15 @@ void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq) + if (irq->intid < VGIC_MIN_LPI) + return; + +- spin_lock_irqsave(&dist->lpi_list_lock, flags); ++ raw_spin_lock_irqsave(&dist->lpi_list_lock, flags); + if (!kref_put(&irq->refcount, vgic_irq_release)) { +- spin_unlock_irqrestore(&dist->lpi_list_lock, flags); ++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags); + return; + }; + + list_del(&irq->lpi_list); + dist->lpi_list_count--; +- spin_unlock_irqrestore(&dist->lpi_list_lock, flags); ++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags); + + kfree(irq); + } +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 0ffb02ff5234..c436d95fd7aa 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -873,6 +873,7 @@ static struct kvm_memslots *install_new_memslots(struct kvm *kvm, + int as_id, struct kvm_memslots *slots) + { + struct kvm_memslots *old_memslots = __kvm_memslots(kvm, as_id); ++ u64 gen; + + /* + * Set the low bit in the generation, which disables SPTE caching +@@ -895,9 +896,11 @@ static struct kvm_memslots *install_new_memslots(struct kvm *kvm, + * space 0 will use generations 0, 4, 8, ... while * address space 1 will + * use generations 2, 6, 10, 14, ... + */ +- slots->generation += KVM_ADDRESS_SPACE_NUM * 2 - 1; ++ gen = slots->generation + KVM_ADDRESS_SPACE_NUM * 2 - 1; + +- kvm_arch_memslots_updated(kvm, slots); ++ kvm_arch_memslots_updated(kvm, gen); ++ ++ slots->generation = gen; + + return old_memslots; + } diff --git a/patch/kernel/sunxi-next/patch-4.19.31-32.patch b/patch/kernel/sunxi-next/patch-4.19.31-32.patch new file mode 100644 index 0000000000..29e4d49997 --- /dev/null +++ b/patch/kernel/sunxi-next/patch-4.19.31-32.patch @@ -0,0 +1,1514 @@ +diff --git a/Makefile b/Makefile +index 3b1c6cff6700..d66c433df5b1 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 31 ++SUBLEVEL = 32 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h +index e77672539e8e..e4456e450f94 100644 +--- a/arch/mips/include/asm/jump_label.h ++++ b/arch/mips/include/asm/jump_label.h +@@ -21,15 +21,15 @@ + #endif + + #ifdef CONFIG_CPU_MICROMIPS +-#define NOP_INSN "nop32" ++#define B_INSN "b32" + #else +-#define NOP_INSN "nop" ++#define B_INSN "b" + #endif + + static __always_inline bool arch_static_branch(struct static_key *key, bool branch) + { +- asm_volatile_goto("1:\t" NOP_INSN "\n\t" +- "nop\n\t" ++ asm_volatile_goto("1:\t" B_INSN " 2f\n\t" ++ "2:\tnop\n\t" + ".pushsection __jump_table, \"aw\"\n\t" + WORD_INSN " 1b, %l[l_yes], %0\n\t" + ".popsection\n\t" +diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S +index 971a504001c2..36f2e860ba3e 100644 +--- a/arch/mips/kernel/vmlinux.lds.S ++++ b/arch/mips/kernel/vmlinux.lds.S +@@ -140,6 +140,13 @@ SECTIONS + PERCPU_SECTION(1 << CONFIG_MIPS_L1_CACHE_SHIFT) + #endif + ++#ifdef CONFIG_MIPS_ELF_APPENDED_DTB ++ .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) { ++ *(.appended_dtb) ++ KEEP(*(.appended_dtb)) ++ } ++#endif ++ + #ifdef CONFIG_RELOCATABLE + . = ALIGN(4); + +@@ -164,11 +171,6 @@ SECTIONS + __appended_dtb = .; + /* leave space for appended DTB */ + . += 0x100000; +-#elif defined(CONFIG_MIPS_ELF_APPENDED_DTB) +- .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) { +- *(.appended_dtb) +- KEEP(*(.appended_dtb)) +- } + #endif + /* + * Align to 64K in attempt to eliminate holes before the +diff --git a/arch/mips/loongson64/lemote-2f/irq.c b/arch/mips/loongson64/lemote-2f/irq.c +index 9e33e45aa17c..b213cecb8e3a 100644 +--- a/arch/mips/loongson64/lemote-2f/irq.c ++++ b/arch/mips/loongson64/lemote-2f/irq.c +@@ -103,7 +103,7 @@ static struct irqaction ip6_irqaction = { + static struct irqaction cascade_irqaction = { + .handler = no_action, + .name = "cascade", +- .flags = IRQF_NO_THREAD, ++ .flags = IRQF_NO_THREAD | IRQF_NO_SUSPEND, + }; + + void __init mach_init_irq(void) +diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h +index 1afe90ade595..bbc06bd72b1f 100644 +--- a/arch/powerpc/include/asm/vdso_datapage.h ++++ b/arch/powerpc/include/asm/vdso_datapage.h +@@ -82,10 +82,10 @@ struct vdso_data { + __u32 icache_block_size; /* L1 i-cache block size */ + __u32 dcache_log_block_size; /* L1 d-cache log block size */ + __u32 icache_log_block_size; /* L1 i-cache log block size */ +- __s32 wtom_clock_sec; /* Wall to monotonic clock */ +- __s32 wtom_clock_nsec; +- struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ +- __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __s32 wtom_clock_nsec; /* Wall to monotonic clock nsec */ ++ __s64 wtom_clock_sec; /* Wall to monotonic clock sec */ ++ struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ + __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + }; +diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S +index c002adcc694c..afbad2ac3147 100644 +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -92,7 +92,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + * At this point, r4,r5 contain our sec/nsec values. + */ + +- lwa r6,WTOM_CLOCK_SEC(r3) ++ ld r6,WTOM_CLOCK_SEC(r3) + lwa r9,WTOM_CLOCK_NSEC(r3) + + /* We now have our result in r6,r9. We create a fake dependency +@@ -125,7 +125,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + bne cr6,75f + + /* CLOCK_MONOTONIC_COARSE */ +- lwa r6,WTOM_CLOCK_SEC(r3) ++ ld r6,WTOM_CLOCK_SEC(r3) + lwa r9,WTOM_CLOCK_NSEC(r3) + + /* check if counter has updated */ +diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h +index 1f86e1b0a5cd..499578f7e6d7 100644 +--- a/arch/x86/include/asm/unwind.h ++++ b/arch/x86/include/asm/unwind.h +@@ -23,6 +23,12 @@ struct unwind_state { + #elif defined(CONFIG_UNWINDER_FRAME_POINTER) + bool got_irq; + unsigned long *bp, *orig_sp, ip; ++ /* ++ * If non-NULL: The current frame is incomplete and doesn't contain a ++ * valid BP. When looking for the next frame, use this instead of the ++ * non-existent saved BP. ++ */ ++ unsigned long *next_bp; + struct pt_regs *regs; + #else + unsigned long *sp; +diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c +index 3dc26f95d46e..9b9fd4826e7a 100644 +--- a/arch/x86/kernel/unwind_frame.c ++++ b/arch/x86/kernel/unwind_frame.c +@@ -320,10 +320,14 @@ bool unwind_next_frame(struct unwind_state *state) + } + + /* Get the next frame pointer: */ +- if (state->regs) ++ if (state->next_bp) { ++ next_bp = state->next_bp; ++ state->next_bp = NULL; ++ } else if (state->regs) { + next_bp = (unsigned long *)state->regs->bp; +- else ++ } else { + next_bp = (unsigned long *)READ_ONCE_TASK_STACK(state->task, *state->bp); ++ } + + /* Move to the next frame if it's safe: */ + if (!update_stack_state(state, next_bp)) +@@ -398,6 +402,21 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, + + bp = get_frame_pointer(task, regs); + ++ /* ++ * If we crash with IP==0, the last successfully executed instruction ++ * was probably an indirect function call with a NULL function pointer. ++ * That means that SP points into the middle of an incomplete frame: ++ * *SP is a return pointer, and *(SP-sizeof(unsigned long)) is where we ++ * would have written a frame pointer if we hadn't crashed. ++ * Pretend that the frame is complete and that BP points to it, but save ++ * the real BP so that we can use it when looking for the next frame. ++ */ ++ if (regs && regs->ip == 0 && ++ (unsigned long *)kernel_stack_pointer(regs) >= first_frame) { ++ state->next_bp = bp; ++ bp = ((unsigned long *)kernel_stack_pointer(regs)) - 1; ++ } ++ + /* Initialize stack info and make sure the frame data is accessible: */ + get_stack_info(bp, state->task, &state->stack_info, + &state->stack_mask); +@@ -410,7 +429,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, + */ + while (!unwind_done(state) && + (!on_stack(&state->stack_info, first_frame, sizeof(long)) || +- state->bp < first_frame)) ++ (state->next_bp == NULL && state->bp < first_frame))) + unwind_next_frame(state); + } + EXPORT_SYMBOL_GPL(__unwind_start); +diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c +index 26038eacf74a..89be1be1790c 100644 +--- a/arch/x86/kernel/unwind_orc.c ++++ b/arch/x86/kernel/unwind_orc.c +@@ -113,6 +113,20 @@ static struct orc_entry *orc_ftrace_find(unsigned long ip) + } + #endif + ++/* ++ * If we crash with IP==0, the last successfully executed instruction ++ * was probably an indirect function call with a NULL function pointer, ++ * and we don't have unwind information for NULL. ++ * This hardcoded ORC entry for IP==0 allows us to unwind from a NULL function ++ * pointer into its parent and then continue normally from there. ++ */ ++static struct orc_entry null_orc_entry = { ++ .sp_offset = sizeof(long), ++ .sp_reg = ORC_REG_SP, ++ .bp_reg = ORC_REG_UNDEFINED, ++ .type = ORC_TYPE_CALL ++}; ++ + static struct orc_entry *orc_find(unsigned long ip) + { + static struct orc_entry *orc; +@@ -120,6 +134,9 @@ static struct orc_entry *orc_find(unsigned long ip) + if (!orc_init) + return NULL; + ++ if (ip == 0) ++ return &null_orc_entry; ++ + /* For non-init vmlinux addresses, use the fast lookup table: */ + if (ip >= LOOKUP_START_IP && ip < LOOKUP_STOP_IP) { + unsigned int idx, start, stop; +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index c9c2bcc36e26..0c5aeab4d23a 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -657,7 +657,7 @@ static int loop_validate_file(struct file *file, struct block_device *bdev) + return -EBADF; + + l = f->f_mapping->host->i_bdev->bd_disk->private_data; +- if (l->lo_state == Lo_unbound) { ++ if (l->lo_state != Lo_bound) { + return -EINVAL; + } + f = l->lo_backing_file; +diff --git a/drivers/bluetooth/h4_recv.h b/drivers/bluetooth/h4_recv.h +index b432651f8236..307d82166f48 100644 +--- a/drivers/bluetooth/h4_recv.h ++++ b/drivers/bluetooth/h4_recv.h +@@ -60,6 +60,10 @@ static inline struct sk_buff *h4_recv_buf(struct hci_dev *hdev, + const struct h4_recv_pkt *pkts, + int pkts_count) + { ++ /* Check for error from previous call */ ++ if (IS_ERR(skb)) ++ skb = NULL; ++ + while (count) { + int i, len; + +diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c +index fb97a3bf069b..5d97d77627c1 100644 +--- a/drivers/bluetooth/hci_h4.c ++++ b/drivers/bluetooth/hci_h4.c +@@ -174,6 +174,10 @@ struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb, + struct hci_uart *hu = hci_get_drvdata(hdev); + u8 alignment = hu->alignment ? hu->alignment : 1; + ++ /* Check for error from previous call */ ++ if (IS_ERR(skb)) ++ skb = NULL; ++ + while (count) { + int i, len; + +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c +index ea6238ed5c0e..c915daf01a89 100644 +--- a/drivers/bluetooth/hci_ldisc.c ++++ b/drivers/bluetooth/hci_ldisc.c +@@ -207,11 +207,11 @@ void hci_uart_init_work(struct work_struct *work) + err = hci_register_dev(hu->hdev); + if (err < 0) { + BT_ERR("Can't register HCI device"); ++ clear_bit(HCI_UART_PROTO_READY, &hu->flags); ++ hu->proto->close(hu); + hdev = hu->hdev; + hu->hdev = NULL; + hci_free_dev(hdev); +- clear_bit(HCI_UART_PROTO_READY, &hu->flags); +- hu->proto->close(hu); + return; + } + +@@ -616,6 +616,7 @@ static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data, + static int hci_uart_register_dev(struct hci_uart *hu) + { + struct hci_dev *hdev; ++ int err; + + BT_DBG(""); + +@@ -659,11 +660,22 @@ static int hci_uart_register_dev(struct hci_uart *hu) + else + hdev->dev_type = HCI_PRIMARY; + ++ /* Only call open() for the protocol after hdev is fully initialized as ++ * open() (or a timer/workqueue it starts) may attempt to reference it. ++ */ ++ err = hu->proto->open(hu); ++ if (err) { ++ hu->hdev = NULL; ++ hci_free_dev(hdev); ++ return err; ++ } ++ + if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags)) + return 0; + + if (hci_register_dev(hdev) < 0) { + BT_ERR("Can't register HCI device"); ++ hu->proto->close(hu); + hu->hdev = NULL; + hci_free_dev(hdev); + return -ENODEV; +@@ -683,20 +695,14 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id) + if (!p) + return -EPROTONOSUPPORT; + +- err = p->open(hu); +- if (err) +- return err; +- + hu->proto = p; +- set_bit(HCI_UART_PROTO_READY, &hu->flags); + + err = hci_uart_register_dev(hu); + if (err) { +- clear_bit(HCI_UART_PROTO_READY, &hu->flags); +- p->close(hu); + return err; + } + ++ set_bit(HCI_UART_PROTO_READY, &hu->flags); + return 0; + } + +diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c +index fcb0ab0abb75..57cc9aa6683a 100644 +--- a/drivers/gpu/drm/drm_mode_object.c ++++ b/drivers/gpu/drm/drm_mode_object.c +@@ -458,12 +458,13 @@ static int set_property_atomic(struct drm_mode_object *obj, + struct drm_modeset_acquire_ctx ctx; + int ret; + +- drm_modeset_acquire_init(&ctx, 0); +- + state = drm_atomic_state_alloc(dev); + if (!state) + return -ENOMEM; ++ ++ drm_modeset_acquire_init(&ctx, 0); + state->acquire_ctx = &ctx; ++ + retry: + if (prop == state->dev->mode_config.dpms_property) { + if (obj->type != DRM_MODE_OBJECT_CONNECTOR) { +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index b913a56f3426..2a9112515f46 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -564,11 +564,9 @@ static int vmw_fb_set_par(struct fb_info *info) + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) + }; +- struct drm_display_mode *old_mode; + struct drm_display_mode *mode; + int ret; + +- old_mode = par->set_mode; + mode = drm_mode_duplicate(vmw_priv->dev, &new_mode); + if (!mode) { + DRM_ERROR("Could not create new fb mode.\n"); +@@ -579,11 +577,7 @@ static int vmw_fb_set_par(struct fb_info *info) + mode->vdisplay = var->yres; + vmw_guess_mode_timing(mode); + +- if (old_mode && drm_mode_equal(old_mode, mode)) { +- drm_mode_destroy(vmw_priv->dev, mode); +- mode = old_mode; +- old_mode = NULL; +- } else if (!vmw_kms_validate_mode_vram(vmw_priv, ++ if (!vmw_kms_validate_mode_vram(vmw_priv, + mode->hdisplay * + DIV_ROUND_UP(var->bits_per_pixel, 8), + mode->vdisplay)) { +@@ -620,8 +614,8 @@ static int vmw_fb_set_par(struct fb_info *info) + schedule_delayed_work(&par->local_work, 0); + + out_unlock: +- if (old_mode) +- drm_mode_destroy(vmw_priv->dev, old_mode); ++ if (par->set_mode) ++ drm_mode_destroy(vmw_priv->dev, par->set_mode); + par->set_mode = mode; + + mutex_unlock(&par->bo_mutex); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c +index b93c558dd86e..7da752ca1c34 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c +@@ -57,7 +57,7 @@ static int vmw_gmrid_man_get_node(struct ttm_mem_type_manager *man, + + id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL); + if (id < 0) +- return id; ++ return (id != -ENOMEM ? 0 : id); + + spin_lock(&gman->lock); + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index a36c94930c31..6f5be7802476 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2854,13 +2854,22 @@ static void addr_handler(int status, struct sockaddr *src_addr, + { + struct rdma_id_private *id_priv = context; + struct rdma_cm_event event = {}; ++ struct sockaddr *addr; ++ struct sockaddr_storage old_addr; + + mutex_lock(&id_priv->handler_mutex); + if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_QUERY, + RDMA_CM_ADDR_RESOLVED)) + goto out; + +- memcpy(cma_src_addr(id_priv), src_addr, rdma_addr_size(src_addr)); ++ /* ++ * Store the previous src address, so that if we fail to acquire ++ * matching rdma device, old address can be restored back, which helps ++ * to cancel the cma listen operation correctly. ++ */ ++ addr = cma_src_addr(id_priv); ++ memcpy(&old_addr, addr, rdma_addr_size(addr)); ++ memcpy(addr, src_addr, rdma_addr_size(src_addr)); + if (!status && !id_priv->cma_dev) { + status = cma_acquire_dev(id_priv, NULL); + if (status) +@@ -2871,6 +2880,8 @@ static void addr_handler(int status, struct sockaddr *src_addr, + } + + if (status) { ++ memcpy(addr, &old_addr, ++ rdma_addr_size((struct sockaddr *)&old_addr)); + if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_RESOLVED, + RDMA_CM_ADDR_BOUND)) + goto out; +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 27500abe8ca7..0b3877681e4a 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2543,7 +2543,12 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, + + /* Everything is mapped - write the right values into s->dma_address */ + for_each_sg(sglist, s, nelems, i) { +- s->dma_address += address + s->offset; ++ /* ++ * Add in the remaining piece of the scatter-gather offset that ++ * was masked out when we were determining the physical address ++ * via (sg_phys(s) & PAGE_MASK) earlier. ++ */ ++ s->dma_address += address + (s->offset & ~PAGE_MASK); + s->dma_length = s->length; + } + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index 78970cdf2ef6..65ab2c80529c 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -1477,7 +1477,7 @@ static int lpi_range_cmp(void *priv, struct list_head *a, struct list_head *b) + ra = container_of(a, struct lpi_range, entry); + rb = container_of(b, struct lpi_range, entry); + +- return rb->base_id - ra->base_id; ++ return ra->base_id - rb->base_id; + } + + static void merge_lpi_ranges(void) +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index c2ad102bd693..467b1ddaf4e7 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1212,7 +1212,7 @@ static void uvc_ctrl_fill_event(struct uvc_video_chain *chain, + + __uvc_query_v4l2_ctrl(chain, ctrl, mapping, &v4l2_ctrl); + +- memset(ev->reserved, 0, sizeof(ev->reserved)); ++ memset(ev, 0, sizeof(*ev)); + ev->type = V4L2_EVENT_CTRL; + ev->id = v4l2_ctrl.id; + ev->u.ctrl.value = value; +diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c +index 599c1cbff3b9..6ac5f5d42615 100644 +--- a/drivers/media/v4l2-core/v4l2-ctrls.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls.c +@@ -1379,7 +1379,7 @@ static u32 user_flags(const struct v4l2_ctrl *ctrl) + + static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 changes) + { +- memset(ev->reserved, 0, sizeof(ev->reserved)); ++ memset(ev, 0, sizeof(*ev)); + ev->type = V4L2_EVENT_CTRL; + ev->id = ctrl->id; + ev->u.ctrl.changes = changes; +diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c +index de4e6e5bf304..2f604b312767 100644 +--- a/drivers/mmc/host/mxcmmc.c ++++ b/drivers/mmc/host/mxcmmc.c +@@ -292,11 +292,8 @@ static void mxcmci_swap_buffers(struct mmc_data *data) + struct scatterlist *sg; + int i; + +- for_each_sg(data->sg, sg, data->sg_len, i) { +- void *buf = kmap_atomic(sg_page(sg) + sg->offset); +- buffer_swap32(buf, sg->length); +- kunmap_atomic(buf); +- } ++ for_each_sg(data->sg, sg, data->sg_len, i) ++ buffer_swap32(sg_virt(sg), sg->length); + } + #else + static inline void mxcmci_swap_buffers(struct mmc_data *data) {} +@@ -613,7 +610,6 @@ static int mxcmci_transfer_data(struct mxcmci_host *host) + { + struct mmc_data *data = host->req->data; + struct scatterlist *sg; +- void *buf; + int stat, i; + + host->data = data; +@@ -621,18 +617,14 @@ static int mxcmci_transfer_data(struct mxcmci_host *host) + + if (data->flags & MMC_DATA_READ) { + for_each_sg(data->sg, sg, data->sg_len, i) { +- buf = kmap_atomic(sg_page(sg) + sg->offset); +- stat = mxcmci_pull(host, buf, sg->length); +- kunmap(buf); ++ stat = mxcmci_pull(host, sg_virt(sg), sg->length); + if (stat) + return stat; + host->datasize += sg->length; + } + } else { + for_each_sg(data->sg, sg, data->sg_len, i) { +- buf = kmap_atomic(sg_page(sg) + sg->offset); +- stat = mxcmci_push(host, buf, sg->length); +- kunmap(buf); ++ stat = mxcmci_push(host, sg_virt(sg), sg->length); + if (stat) + return stat; + host->datasize += sg->length; +diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c +index f7ffbf1676b1..00b5465dfb0c 100644 +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -164,7 +164,7 @@ static void pxamci_dma_irq(void *param); + static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) + { + struct dma_async_tx_descriptor *tx; +- enum dma_data_direction direction; ++ enum dma_transfer_direction direction; + struct dma_slave_config config; + struct dma_chan *chan; + unsigned int nob = data->blocks; +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index 777e32b0e410..45baf5d9120e 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -557,6 +557,7 @@ int renesas_sdhi_probe(struct platform_device *pdev, + struct renesas_sdhi *priv; + struct resource *res; + int irq, ret, i; ++ u16 ver; + + of_data = of_device_get_match_data(&pdev->dev); + +@@ -671,12 +672,17 @@ int renesas_sdhi_probe(struct platform_device *pdev, + if (ret) + goto efree; + ++ ver = sd_ctrl_read16(host, CTL_VERSION); ++ /* GEN2_SDR104 is first known SDHI to use 32bit block count */ ++ if (ver < SDHI_VER_GEN2_SDR104 && mmc_data->max_blk_count > U16_MAX) ++ mmc_data->max_blk_count = U16_MAX; ++ + ret = tmio_mmc_host_probe(host); + if (ret < 0) + goto edisclk; + + /* One Gen2 SDHI incarnation does NOT have a CBSY bit */ +- if (sd_ctrl_read16(host, CTL_VERSION) == SDHI_VER_GEN2_SDR50) ++ if (ver == SDHI_VER_GEN2_SDR50) + mmc_data->flags &= ~TMIO_MMC_HAVE_CBSY; + + /* Enable tuning iff we have an SCC and a supported mode */ +diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c +index faa1a67cf3d2..7ae983e37f64 100644 +--- a/drivers/power/supply/charger-manager.c ++++ b/drivers/power/supply/charger-manager.c +@@ -1212,7 +1212,6 @@ static int charger_extcon_init(struct charger_manager *cm, + if (ret < 0) { + pr_info("Cannot register extcon_dev for %s(cable: %s)\n", + cable->extcon_name, cable->name); +- ret = -EINVAL; + } + + return ret; +@@ -1633,7 +1632,7 @@ static int charger_manager_probe(struct platform_device *pdev) + + if (IS_ERR(desc)) { + dev_err(&pdev->dev, "No platform data (desc) found\n"); +- return -ENODEV; ++ return PTR_ERR(desc); + } + + cm = devm_kzalloc(&pdev->dev, sizeof(*cm), GFP_KERNEL); +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index 9df8a1a2299c..e60822f07653 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -96,6 +96,7 @@ static int client_reserve = 1; + static char partition_name[96] = "UNKNOWN"; + static unsigned int partition_number = -1; + static LIST_HEAD(ibmvscsi_head); ++static DEFINE_SPINLOCK(ibmvscsi_driver_lock); + + static struct scsi_transport_template *ibmvscsi_transport_template; + +@@ -2271,7 +2272,9 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id) + } + + dev_set_drvdata(&vdev->dev, hostdata); ++ spin_lock(&ibmvscsi_driver_lock); + list_add_tail(&hostdata->host_list, &ibmvscsi_head); ++ spin_unlock(&ibmvscsi_driver_lock); + return 0; + + add_srp_port_failed: +@@ -2293,15 +2296,27 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id) + static int ibmvscsi_remove(struct vio_dev *vdev) + { + struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev); +- list_del(&hostdata->host_list); +- unmap_persist_bufs(hostdata); ++ unsigned long flags; ++ ++ srp_remove_host(hostdata->host); ++ scsi_remove_host(hostdata->host); ++ ++ purge_requests(hostdata, DID_ERROR); ++ ++ spin_lock_irqsave(hostdata->host->host_lock, flags); + release_event_pool(&hostdata->pool, hostdata); ++ spin_unlock_irqrestore(hostdata->host->host_lock, flags); ++ + ibmvscsi_release_crq_queue(&hostdata->queue, hostdata, + max_events); + + kthread_stop(hostdata->work_thread); +- srp_remove_host(hostdata->host); +- scsi_remove_host(hostdata->host); ++ unmap_persist_bufs(hostdata); ++ ++ spin_lock(&ibmvscsi_driver_lock); ++ list_del(&hostdata->host_list); ++ spin_unlock(&ibmvscsi_driver_lock); ++ + scsi_host_put(hostdata->host); + + return 0; +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index a2d701775c49..3d0db37d64ad 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1500,9 +1500,16 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, + iov[1].iov_base = unc_path; + iov[1].iov_len = unc_path_len; + +- /* 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 */ ++ /* ++ * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 ++ * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 ++ * (Samba servers don't always set the flag so also check if null user) ++ */ + if ((ses->server->dialect == SMB311_PROT_ID) && +- !smb3_encryption_required(tcon)) ++ !smb3_encryption_required(tcon) && ++ !(ses->session_flags & ++ (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && ++ ((ses->user_name != NULL) || (ses->sectype == Kerberos))) + req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED; + + memset(&rqst, 0, sizeof(struct smb_rqst)); +diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h +index 15b6dd733780..df908ef79cce 100644 +--- a/fs/ext4/ext4_jbd2.h ++++ b/fs/ext4/ext4_jbd2.h +@@ -384,7 +384,7 @@ static inline void ext4_update_inode_fsync_trans(handle_t *handle, + { + struct ext4_inode_info *ei = EXT4_I(inode); + +- if (ext4_handle_valid(handle)) { ++ if (ext4_handle_valid(handle) && !is_handle_aborted(handle)) { + ei->i_sync_tid = handle->h_transaction->t_tid; + if (datasync) + ei->i_datasync_tid = handle->h_transaction->t_tid; +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index 69d65d49837b..98ec11f69cd4 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -125,7 +125,7 @@ ext4_unaligned_aio(struct inode *inode, struct iov_iter *from, loff_t pos) + struct super_block *sb = inode->i_sb; + int blockmask = sb->s_blocksize - 1; + +- if (pos >= i_size_read(inode)) ++ if (pos >= ALIGN(i_size_read(inode), sb->s_blocksize)) + return 0; + + if ((pos | iov_iter_alignment(from)) & blockmask) +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index bf7fa1507e81..9e96a0bd08d9 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -1387,10 +1387,14 @@ end_range: + partial->p + 1, + partial2->p, + (chain+n-1) - partial); +- BUFFER_TRACE(partial->bh, "call brelse"); +- brelse(partial->bh); +- BUFFER_TRACE(partial2->bh, "call brelse"); +- brelse(partial2->bh); ++ while (partial > chain) { ++ BUFFER_TRACE(partial->bh, "call brelse"); ++ brelse(partial->bh); ++ } ++ while (partial2 > chain2) { ++ BUFFER_TRACE(partial2->bh, "call brelse"); ++ brelse(partial2->bh); ++ } + return 0; + } + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 30779aaa9dba..1fa6f8185766 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -216,7 +216,8 @@ void f2fs_register_inmem_page(struct inode *inode, struct page *page) + } + + static int __revoke_inmem_pages(struct inode *inode, +- struct list_head *head, bool drop, bool recover) ++ struct list_head *head, bool drop, bool recover, ++ bool trylock) + { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct inmem_pages *cur, *tmp; +@@ -228,7 +229,16 @@ static int __revoke_inmem_pages(struct inode *inode, + if (drop) + trace_f2fs_commit_inmem_page(page, INMEM_DROP); + +- lock_page(page); ++ if (trylock) { ++ /* ++ * to avoid deadlock in between page lock and ++ * inmem_lock. ++ */ ++ if (!trylock_page(page)) ++ continue; ++ } else { ++ lock_page(page); ++ } + + f2fs_wait_on_page_writeback(page, DATA, true); + +@@ -317,13 +327,19 @@ void f2fs_drop_inmem_pages(struct inode *inode) + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct f2fs_inode_info *fi = F2FS_I(inode); + +- mutex_lock(&fi->inmem_lock); +- __revoke_inmem_pages(inode, &fi->inmem_pages, true, false); +- spin_lock(&sbi->inode_lock[ATOMIC_FILE]); +- if (!list_empty(&fi->inmem_ilist)) +- list_del_init(&fi->inmem_ilist); +- spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); +- mutex_unlock(&fi->inmem_lock); ++ while (!list_empty(&fi->inmem_pages)) { ++ mutex_lock(&fi->inmem_lock); ++ __revoke_inmem_pages(inode, &fi->inmem_pages, ++ true, false, true); ++ ++ if (list_empty(&fi->inmem_pages)) { ++ spin_lock(&sbi->inode_lock[ATOMIC_FILE]); ++ if (!list_empty(&fi->inmem_ilist)) ++ list_del_init(&fi->inmem_ilist); ++ spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); ++ } ++ mutex_unlock(&fi->inmem_lock); ++ } + + clear_inode_flag(inode, FI_ATOMIC_FILE); + fi->i_gc_failures[GC_FAILURE_ATOMIC] = 0; +@@ -427,12 +443,15 @@ retry: + * recovery or rewrite & commit last transaction. For other + * error number, revoking was done by filesystem itself. + */ +- err = __revoke_inmem_pages(inode, &revoke_list, false, true); ++ err = __revoke_inmem_pages(inode, &revoke_list, ++ false, true, false); + + /* drop all uncommitted pages */ +- __revoke_inmem_pages(inode, &fi->inmem_pages, true, false); ++ __revoke_inmem_pages(inode, &fi->inmem_pages, ++ true, false, false); + } else { +- __revoke_inmem_pages(inode, &revoke_list, false, false); ++ __revoke_inmem_pages(inode, &revoke_list, ++ false, false, false); + } + + return err; +diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c +index b647f0bd150c..94220ba85628 100644 +--- a/fs/udf/truncate.c ++++ b/fs/udf/truncate.c +@@ -260,6 +260,9 @@ void udf_truncate_extents(struct inode *inode) + epos.block = eloc; + epos.bh = udf_tread(sb, + udf_get_lb_pblock(sb, &eloc, 0)); ++ /* Error reading indirect block? */ ++ if (!epos.bh) ++ return; + if (elen) + indirect_ext_len = + (elen + sb->s_blocksize - 1) >> +diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h +index 68bb09c29ce8..0b589e684554 100644 +--- a/include/linux/ceph/libceph.h ++++ b/include/linux/ceph/libceph.h +@@ -292,6 +292,8 @@ extern void ceph_destroy_client(struct ceph_client *client); + extern int __ceph_open_session(struct ceph_client *client, + unsigned long started); + extern int ceph_open_session(struct ceph_client *client); ++int ceph_wait_for_latest_osdmap(struct ceph_client *client, ++ unsigned long timeout); + + /* pagevec.c */ + extern void ceph_release_page_vector(struct page **pages, int num_pages); +diff --git a/kernel/futex.c b/kernel/futex.c +index c5fca746edc4..5a26d843a015 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -3432,6 +3432,10 @@ int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi) + { + u32 uval, uninitialized_var(nval), mval; + ++ /* Futex address must be 32bit aligned */ ++ if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0) ++ return -1; ++ + retry: + if (get_user(uval, uaddr)) + return -1; +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 26b57e24476f..0cbdbbb0729f 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -3567,6 +3567,9 @@ __lock_set_class(struct lockdep_map *lock, const char *name, + unsigned int depth; + int i; + ++ if (unlikely(!debug_locks)) ++ return 0; ++ + depth = curr->lockdep_depth; + /* + * This function is about (re)setting the class of a held lock, +diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c +index 1506e1632394..d4e2a166ae17 100644 +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -831,8 +831,6 @@ static int hci_sock_release(struct socket *sock) + if (!sk) + return 0; + +- hdev = hci_pi(sk)->hdev; +- + switch (hci_pi(sk)->channel) { + case HCI_CHANNEL_MONITOR: + atomic_dec(&monitor_promisc); +@@ -854,6 +852,7 @@ static int hci_sock_release(struct socket *sock) + + bt_sock_unlink(&hci_sk_list, sk); + ++ hdev = hci_pi(sk)->hdev; + if (hdev) { + if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { + /* When releasing a user channel exclusive access, +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 6693e209efe8..f77888ec93f1 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -31,10 +31,6 @@ + /* needed for logical [in,out]-dev filtering */ + #include "../br_private.h" + +-#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\ +- "report to author: "format, ## args) +-/* #define BUGPRINT(format, args...) */ +- + /* Each cpu has its own set of counters, so there is no need for write_lock in + * the softirq + * For reading or updating the counters, the user context needs to +@@ -466,8 +462,6 @@ static int ebt_verify_pointers(const struct ebt_replace *repl, + /* we make userspace set this right, + * so there is no misunderstanding + */ +- BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set " +- "in distinguisher\n"); + return -EINVAL; + } + if (i != NF_BR_NUMHOOKS) +@@ -485,18 +479,14 @@ static int ebt_verify_pointers(const struct ebt_replace *repl, + offset += e->next_offset; + } + } +- if (offset != limit) { +- BUGPRINT("entries_size too small\n"); ++ if (offset != limit) + return -EINVAL; +- } + + /* check if all valid hooks have a chain */ + for (i = 0; i < NF_BR_NUMHOOKS; i++) { + if (!newinfo->hook_entry[i] && +- (valid_hooks & (1 << i))) { +- BUGPRINT("Valid hook without chain\n"); ++ (valid_hooks & (1 << i))) + return -EINVAL; +- } + } + return 0; + } +@@ -523,26 +513,20 @@ ebt_check_entry_size_and_hooks(const struct ebt_entry *e, + /* this checks if the previous chain has as many entries + * as it said it has + */ +- if (*n != *cnt) { +- BUGPRINT("nentries does not equal the nr of entries " +- "in the chain\n"); ++ if (*n != *cnt) + return -EINVAL; +- } ++ + if (((struct ebt_entries *)e)->policy != EBT_DROP && + ((struct ebt_entries *)e)->policy != EBT_ACCEPT) { + /* only RETURN from udc */ + if (i != NF_BR_NUMHOOKS || +- ((struct ebt_entries *)e)->policy != EBT_RETURN) { +- BUGPRINT("bad policy\n"); ++ ((struct ebt_entries *)e)->policy != EBT_RETURN) + return -EINVAL; +- } + } + if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */ + (*udc_cnt)++; +- if (((struct ebt_entries *)e)->counter_offset != *totalcnt) { +- BUGPRINT("counter_offset != totalcnt"); ++ if (((struct ebt_entries *)e)->counter_offset != *totalcnt) + return -EINVAL; +- } + *n = ((struct ebt_entries *)e)->nentries; + *cnt = 0; + return 0; +@@ -550,15 +534,13 @@ ebt_check_entry_size_and_hooks(const struct ebt_entry *e, + /* a plain old entry, heh */ + if (sizeof(struct ebt_entry) > e->watchers_offset || + e->watchers_offset > e->target_offset || +- e->target_offset >= e->next_offset) { +- BUGPRINT("entry offsets not in right order\n"); ++ e->target_offset >= e->next_offset) + return -EINVAL; +- } ++ + /* this is not checked anywhere else */ +- if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) { +- BUGPRINT("target size too small\n"); ++ if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) + return -EINVAL; +- } ++ + (*cnt)++; + (*totalcnt)++; + return 0; +@@ -678,18 +660,15 @@ ebt_check_entry(struct ebt_entry *e, struct net *net, + if (e->bitmask == 0) + return 0; + +- if (e->bitmask & ~EBT_F_MASK) { +- BUGPRINT("Unknown flag for bitmask\n"); ++ if (e->bitmask & ~EBT_F_MASK) + return -EINVAL; +- } +- if (e->invflags & ~EBT_INV_MASK) { +- BUGPRINT("Unknown flag for inv bitmask\n"); ++ ++ if (e->invflags & ~EBT_INV_MASK) + return -EINVAL; +- } +- if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3)) { +- BUGPRINT("NOPROTO & 802_3 not allowed\n"); ++ ++ if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3)) + return -EINVAL; +- } ++ + /* what hook do we belong to? */ + for (i = 0; i < NF_BR_NUMHOOKS; i++) { + if (!newinfo->hook_entry[i]) +@@ -748,13 +727,11 @@ ebt_check_entry(struct ebt_entry *e, struct net *net, + t->u.target = target; + if (t->u.target == &ebt_standard_target) { + if (gap < sizeof(struct ebt_standard_target)) { +- BUGPRINT("Standard target size too big\n"); + ret = -EFAULT; + goto cleanup_watchers; + } + if (((struct ebt_standard_target *)t)->verdict < + -NUM_STANDARD_TARGETS) { +- BUGPRINT("Invalid standard target\n"); + ret = -EFAULT; + goto cleanup_watchers; + } +@@ -813,10 +790,9 @@ static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack + if (strcmp(t->u.name, EBT_STANDARD_TARGET)) + goto letscontinue; + if (e->target_offset + sizeof(struct ebt_standard_target) > +- e->next_offset) { +- BUGPRINT("Standard target size too big\n"); ++ e->next_offset) + return -1; +- } ++ + verdict = ((struct ebt_standard_target *)t)->verdict; + if (verdict >= 0) { /* jump to another chain */ + struct ebt_entries *hlp2 = +@@ -825,14 +801,12 @@ static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack + if (hlp2 == cl_s[i].cs.chaininfo) + break; + /* bad destination or loop */ +- if (i == udc_cnt) { +- BUGPRINT("bad destination\n"); ++ if (i == udc_cnt) + return -1; +- } +- if (cl_s[i].cs.n) { +- BUGPRINT("loop\n"); ++ ++ if (cl_s[i].cs.n) + return -1; +- } ++ + if (cl_s[i].hookmask & (1 << hooknr)) + goto letscontinue; + /* this can't be 0, so the loop test is correct */ +@@ -865,24 +839,21 @@ static int translate_table(struct net *net, const char *name, + i = 0; + while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i]) + i++; +- if (i == NF_BR_NUMHOOKS) { +- BUGPRINT("No valid hooks specified\n"); ++ if (i == NF_BR_NUMHOOKS) + return -EINVAL; +- } +- if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) { +- BUGPRINT("Chains don't start at beginning\n"); ++ ++ if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) + return -EINVAL; +- } ++ + /* make sure chains are ordered after each other in same order + * as their corresponding hooks + */ + for (j = i + 1; j < NF_BR_NUMHOOKS; j++) { + if (!newinfo->hook_entry[j]) + continue; +- if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) { +- BUGPRINT("Hook order must be followed\n"); ++ if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) + return -EINVAL; +- } ++ + i = j; + } + +@@ -900,15 +871,11 @@ static int translate_table(struct net *net, const char *name, + if (ret != 0) + return ret; + +- if (i != j) { +- BUGPRINT("nentries does not equal the nr of entries in the " +- "(last) chain\n"); ++ if (i != j) + return -EINVAL; +- } +- if (k != newinfo->nentries) { +- BUGPRINT("Total nentries is wrong\n"); ++ ++ if (k != newinfo->nentries) + return -EINVAL; +- } + + /* get the location of the udc, put them in an array + * while we're at it, allocate the chainstack +@@ -942,7 +909,6 @@ static int translate_table(struct net *net, const char *name, + ebt_get_udc_positions, newinfo, &i, cl_s); + /* sanity check */ + if (i != udc_cnt) { +- BUGPRINT("i != udc_cnt\n"); + vfree(cl_s); + return -EFAULT; + } +@@ -1042,7 +1008,6 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl, + goto free_unlock; + + if (repl->num_counters && repl->num_counters != t->private->nentries) { +- BUGPRINT("Wrong nr. of counters requested\n"); + ret = -EINVAL; + goto free_unlock; + } +@@ -1118,15 +1083,12 @@ static int do_replace(struct net *net, const void __user *user, + if (copy_from_user(&tmp, user, sizeof(tmp)) != 0) + return -EFAULT; + +- if (len != sizeof(tmp) + tmp.entries_size) { +- BUGPRINT("Wrong len argument\n"); ++ if (len != sizeof(tmp) + tmp.entries_size) + return -EINVAL; +- } + +- if (tmp.entries_size == 0) { +- BUGPRINT("Entries_size never zero\n"); ++ if (tmp.entries_size == 0) + return -EINVAL; +- } ++ + /* overflow check */ + if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / + NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter)) +@@ -1153,7 +1115,6 @@ static int do_replace(struct net *net, const void __user *user, + } + if (copy_from_user( + newinfo->entries, tmp.entries, tmp.entries_size) != 0) { +- BUGPRINT("Couldn't copy entries from userspace\n"); + ret = -EFAULT; + goto free_entries; + } +@@ -1194,10 +1155,8 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table, + + if (input_table == NULL || (repl = input_table->table) == NULL || + repl->entries == NULL || repl->entries_size == 0 || +- repl->counters != NULL || input_table->private != NULL) { +- BUGPRINT("Bad table data for ebt_register_table!!!\n"); ++ repl->counters != NULL || input_table->private != NULL) + return -EINVAL; +- } + + /* Don't add one table to multiple lists. */ + table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL); +@@ -1235,13 +1194,10 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table, + ((char *)repl->hook_entry[i] - repl->entries); + } + ret = translate_table(net, repl->name, newinfo); +- if (ret != 0) { +- BUGPRINT("Translate_table failed\n"); ++ if (ret != 0) + goto free_chainstack; +- } + + if (table->check && table->check(newinfo, table->valid_hooks)) { +- BUGPRINT("The table doesn't like its own initial data, lol\n"); + ret = -EINVAL; + goto free_chainstack; + } +@@ -1252,7 +1208,6 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table, + list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) { + if (strcmp(t->name, table->name) == 0) { + ret = -EEXIST; +- BUGPRINT("Table name already exists\n"); + goto free_unlock; + } + } +@@ -1320,7 +1275,6 @@ static int do_update_counters(struct net *net, const char *name, + goto free_tmp; + + if (num_counters != t->private->nentries) { +- BUGPRINT("Wrong nr of counters\n"); + ret = -EINVAL; + goto unlock_mutex; + } +@@ -1447,10 +1401,8 @@ static int copy_counters_to_user(struct ebt_table *t, + if (num_counters == 0) + return 0; + +- if (num_counters != nentries) { +- BUGPRINT("Num_counters wrong\n"); ++ if (num_counters != nentries) + return -EINVAL; +- } + + counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp))); + if (!counterstmp) +@@ -1496,15 +1448,11 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user, + (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0)) + return -EINVAL; + +- if (tmp.nentries != nentries) { +- BUGPRINT("Nentries wrong\n"); ++ if (tmp.nentries != nentries) + return -EINVAL; +- } + +- if (tmp.entries_size != entries_size) { +- BUGPRINT("Wrong size\n"); ++ if (tmp.entries_size != entries_size) + return -EINVAL; +- } + + ret = copy_counters_to_user(t, oldcounters, tmp.counters, + tmp.num_counters, nentries); +@@ -1576,7 +1524,6 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) + } + mutex_unlock(&ebt_mutex); + if (copy_to_user(user, &tmp, *len) != 0) { +- BUGPRINT("c2u Didn't work\n"); + ret = -EFAULT; + break; + } +diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c +index 87afb9ec4c68..20f0c3d7ed50 100644 +--- a/net/ceph/ceph_common.c ++++ b/net/ceph/ceph_common.c +@@ -729,7 +729,6 @@ int __ceph_open_session(struct ceph_client *client, unsigned long started) + } + EXPORT_SYMBOL(__ceph_open_session); + +- + int ceph_open_session(struct ceph_client *client) + { + int ret; +@@ -745,6 +744,23 @@ int ceph_open_session(struct ceph_client *client) + } + EXPORT_SYMBOL(ceph_open_session); + ++int ceph_wait_for_latest_osdmap(struct ceph_client *client, ++ unsigned long timeout) ++{ ++ u64 newest_epoch; ++ int ret; ++ ++ ret = ceph_monc_get_version(&client->monc, "osdmap", &newest_epoch); ++ if (ret) ++ return ret; ++ ++ if (client->osdc.osdmap->epoch >= newest_epoch) ++ return 0; ++ ++ ceph_osdc_maybe_request_map(&client->osdc); ++ return ceph_monc_wait_osdmap(&client->monc, newest_epoch, timeout); ++} ++EXPORT_SYMBOL(ceph_wait_for_latest_osdmap); + + static int __init init_ceph_lib(void) + { +diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c +index 18deb3d889c4..a53e4fbb6319 100644 +--- a/net/ceph/mon_client.c ++++ b/net/ceph/mon_client.c +@@ -922,6 +922,15 @@ int ceph_monc_blacklist_add(struct ceph_mon_client *monc, + mutex_unlock(&monc->mutex); + + ret = wait_generic_request(req); ++ if (!ret) ++ /* ++ * Make sure we have the osdmap that includes the blacklist ++ * entry. This is needed to ensure that the OSDs pick up the ++ * new blacklist before processing any future requests from ++ * this client. ++ */ ++ ret = ceph_wait_for_latest_osdmap(monc->client, 0); ++ + out: + put_generic_request(req); + return ret; +diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c +index 9f0c480489ef..9cbf6927abe9 100644 +--- a/sound/ac97/bus.c ++++ b/sound/ac97/bus.c +@@ -84,7 +84,7 @@ ac97_of_get_child_device(struct ac97_controller *ac97_ctrl, int idx, + if ((idx != of_property_read_u32(node, "reg", ®)) || + !of_device_is_compatible(node, compat)) + continue; +- return of_node_get(node); ++ return node; + } + + return NULL; +diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c +index 300d31b6f191..743015e87a96 100644 +--- a/sound/firewire/motu/motu.c ++++ b/sound/firewire/motu/motu.c +@@ -36,7 +36,7 @@ static void name_card(struct snd_motu *motu) + fw_csr_iterator_init(&it, motu->unit->directory); + while (fw_csr_iterator_next(&it, &key, &val)) { + switch (key) { +- case CSR_VERSION: ++ case CSR_MODEL: + version = val; + break; + } +@@ -46,7 +46,7 @@ static void name_card(struct snd_motu *motu) + strcpy(motu->card->shortname, motu->spec->name); + strcpy(motu->card->mixername, motu->spec->name); + snprintf(motu->card->longname, sizeof(motu->card->longname), +- "MOTU %s (version:%d), GUID %08x%08x at %s, S%d", ++ "MOTU %s (version:%06x), GUID %08x%08x at %s, S%d", + motu->spec->name, version, + fw_dev->config_rom[3], fw_dev->config_rom[4], + dev_name(&motu->unit->device), 100 << fw_dev->max_speed); +@@ -258,20 +258,20 @@ static const struct snd_motu_spec motu_audio_express = { + #define SND_MOTU_DEV_ENTRY(model, data) \ + { \ + .match_flags = IEEE1394_MATCH_VENDOR_ID | \ +- IEEE1394_MATCH_MODEL_ID | \ +- IEEE1394_MATCH_SPECIFIER_ID, \ ++ IEEE1394_MATCH_SPECIFIER_ID | \ ++ IEEE1394_MATCH_VERSION, \ + .vendor_id = OUI_MOTU, \ +- .model_id = model, \ + .specifier_id = OUI_MOTU, \ ++ .version = model, \ + .driver_data = (kernel_ulong_t)data, \ + } + + static const struct ieee1394_device_id motu_id_table[] = { +- SND_MOTU_DEV_ENTRY(0x101800, &motu_828mk2), +- SND_MOTU_DEV_ENTRY(0x107800, &snd_motu_spec_traveler), +- SND_MOTU_DEV_ENTRY(0x106800, &motu_828mk3), /* FireWire only. */ +- SND_MOTU_DEV_ENTRY(0x100800, &motu_828mk3), /* Hybrid. */ +- SND_MOTU_DEV_ENTRY(0x104800, &motu_audio_express), ++ SND_MOTU_DEV_ENTRY(0x000003, &motu_828mk2), ++ SND_MOTU_DEV_ENTRY(0x000009, &snd_motu_spec_traveler), ++ SND_MOTU_DEV_ENTRY(0x000015, &motu_828mk3), /* FireWire only. */ ++ SND_MOTU_DEV_ENTRY(0x000035, &motu_828mk3), /* Hybrid. */ ++ SND_MOTU_DEV_ENTRY(0x000033, &motu_audio_express), + { } + }; + MODULE_DEVICE_TABLE(ieee1394, motu_id_table); +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 26d348b47867..21de8145f1a6 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -2909,6 +2909,7 @@ static void hda_call_codec_resume(struct hda_codec *codec) + hda_jackpoll_work(&codec->jackpoll_work.work); + else + snd_hda_jack_report_sync(codec); ++ codec->core.dev.power.power_state = PMSG_ON; + snd_hdac_leave_pm(&codec->core); + } + +@@ -2942,10 +2943,62 @@ static int hda_codec_runtime_resume(struct device *dev) + } + #endif /* CONFIG_PM */ + ++#ifdef CONFIG_PM_SLEEP ++static int hda_codec_force_resume(struct device *dev) ++{ ++ int ret; ++ ++ /* The get/put pair below enforces the runtime resume even if the ++ * device hasn't been used at suspend time. This trick is needed to ++ * update the jack state change during the sleep. ++ */ ++ pm_runtime_get_noresume(dev); ++ ret = pm_runtime_force_resume(dev); ++ pm_runtime_put(dev); ++ return ret; ++} ++ ++static int hda_codec_pm_suspend(struct device *dev) ++{ ++ dev->power.power_state = PMSG_SUSPEND; ++ return pm_runtime_force_suspend(dev); ++} ++ ++static int hda_codec_pm_resume(struct device *dev) ++{ ++ dev->power.power_state = PMSG_RESUME; ++ return hda_codec_force_resume(dev); ++} ++ ++static int hda_codec_pm_freeze(struct device *dev) ++{ ++ dev->power.power_state = PMSG_FREEZE; ++ return pm_runtime_force_suspend(dev); ++} ++ ++static int hda_codec_pm_thaw(struct device *dev) ++{ ++ dev->power.power_state = PMSG_THAW; ++ return hda_codec_force_resume(dev); ++} ++ ++static int hda_codec_pm_restore(struct device *dev) ++{ ++ dev->power.power_state = PMSG_RESTORE; ++ return hda_codec_force_resume(dev); ++} ++#endif /* CONFIG_PM_SLEEP */ ++ + /* referred in hda_bind.c */ + const struct dev_pm_ops hda_codec_driver_pm = { +- SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, +- pm_runtime_force_resume) ++#ifdef CONFIG_PM_SLEEP ++ .suspend = hda_codec_pm_suspend, ++ .resume = hda_codec_pm_resume, ++ .freeze = hda_codec_pm_freeze, ++ .thaw = hda_codec_pm_thaw, ++ .poweroff = hda_codec_pm_suspend, ++ .restore = hda_codec_pm_restore, ++#endif /* CONFIG_PM_SLEEP */ + SET_RUNTIME_PM_OPS(hda_codec_runtime_suspend, hda_codec_runtime_resume, + NULL) + }; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 1bb7613701ac..7572b8cc7127 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2274,10 +2274,12 @@ static struct snd_pci_quirk power_save_blacklist[] = { + SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */ + SND_PCI_QUIRK(0x8086, 0x2068, "Intel NUC7i3BNB", 0), +- /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */ +- SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0), + /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */ + SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0), ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1689623 */ ++ SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0), ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */ ++ SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0), + {} + }; + #endif /* CONFIG_PM */ +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index dffd60cebc31..80f73810b21b 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -7394,7 +7394,7 @@ static void ca0132_free(struct hda_codec *codec) + ca0132_exit_chip(codec); + + snd_hda_power_down(codec); +- if (spec->mem_base) ++ if (IS_ENABLED(CONFIG_PCI) && spec->mem_base) + pci_iounmap(codec->bus->pci, spec->mem_base); + kfree(spec->spec_init_verbs); + kfree(codec->spec); +diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c +index fa7dca5a68c8..ec50d1d0b5fe 100644 +--- a/sound/x86/intel_hdmi_audio.c ++++ b/sound/x86/intel_hdmi_audio.c +@@ -1900,7 +1900,6 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev) + + pm_runtime_use_autosuspend(&pdev->dev); + pm_runtime_mark_last_busy(&pdev->dev); +- pm_runtime_set_active(&pdev->dev); + + dev_dbg(&pdev->dev, "%s: handle pending notification\n", __func__); + for_each_port(card_ctx, port) { +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 2928939b98ec..550f17611bd7 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -2157,9 +2157,10 @@ static void cleanup(struct objtool_file *file) + elf_close(file->elf); + } + ++static struct objtool_file file; ++ + int check(const char *_objname, bool orc) + { +- struct objtool_file file; + int ret, warnings = 0; + + objname = _objname; +diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c +index f119eb628dbb..a22e1f538aea 100644 +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -157,8 +157,10 @@ static struct map *kernel_get_module_map(const char *module) + if (module && strchr(module, '/')) + return dso__new_map(module); + +- if (!module) +- module = "kernel"; ++ if (!module) { ++ pos = machine__kernel_map(host_machine); ++ return map__get(pos); ++ } + + for (pos = maps__first(maps); pos; pos = map__next(pos)) { + /* short_name is "[module]" */ diff --git a/patch/kernel/sunxi-next/patch-4.19.32-33.patch b/patch/kernel/sunxi-next/patch-4.19.32-33.patch new file mode 100644 index 0000000000..018985eec9 --- /dev/null +++ b/patch/kernel/sunxi-next/patch-4.19.32-33.patch @@ -0,0 +1,4531 @@ +diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt +index 647f94128a85..8e16017ff397 100644 +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong to three classes + + - VM ioctls: These query and set attributes that affect an entire virtual + machine, for example memory layout. In addition a VM ioctl is used to +- create virtual cpus (vcpus). ++ create virtual cpus (vcpus) and devices. + + Only run VM ioctls from the same process (address space) that was used + to create the VM. +@@ -24,6 +24,11 @@ of a virtual machine. The ioctls belong to three classes + Only run vcpu ioctls from the same thread that was used to create the + vcpu. + ++ - device ioctls: These query and set attributes that control the operation ++ of a single device. ++ ++ device ioctls must be issued from the same process (address space) that ++ was used to create the VM. + + 2. File descriptors + ------------------- +@@ -32,10 +37,11 @@ The kvm API is centered around file descriptors. An initial + open("/dev/kvm") obtains a handle to the kvm subsystem; this handle + can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this + handle will create a VM file descriptor which can be used to issue VM +-ioctls. A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu +-and return a file descriptor pointing to it. Finally, ioctls on a vcpu +-fd can be used to control the vcpu, including the important task of +-actually running guest code. ++ioctls. A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will ++create a virtual cpu or device and return a file descriptor pointing to ++the new resource. Finally, ioctls on a vcpu or device fd can be used ++to control the vcpu or device. For vcpus, this includes the important ++task of actually running guest code. + + In general file descriptors can be migrated among processes by means + of fork() and the SCM_RIGHTS facility of unix domain socket. These +diff --git a/Makefile b/Makefile +index d66c433df5b1..8de5fab711d8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 32 ++SUBLEVEL = 33 + EXTRAVERSION = + NAME = "People's Front" + +@@ -948,9 +948,11 @@ mod_sign_cmd = true + endif + export mod_sign_cmd + ++HOST_LIBELF_LIBS = $(shell pkg-config libelf --libs 2>/dev/null || echo -lelf) ++ + ifdef CONFIG_STACK_VALIDATION + has_libelf := $(call try-run,\ +- echo "int main() {}" | $(HOSTCC) -xc -o /dev/null -lelf -,1,0) ++ echo "int main() {}" | $(HOSTCC) -xc -o /dev/null $(HOST_LIBELF_LIBS) -,1,0) + ifeq ($(has_libelf),1) + objtool_target := tools/objtool FORCE + else +diff --git a/arch/arm/mach-imx/cpuidle-imx6q.c b/arch/arm/mach-imx/cpuidle-imx6q.c +index bfeb25aaf9a2..326e870d7123 100644 +--- a/arch/arm/mach-imx/cpuidle-imx6q.c ++++ b/arch/arm/mach-imx/cpuidle-imx6q.c +@@ -16,30 +16,23 @@ + #include "cpuidle.h" + #include "hardware.h" + +-static atomic_t master = ATOMIC_INIT(0); +-static DEFINE_SPINLOCK(master_lock); ++static int num_idle_cpus = 0; ++static DEFINE_SPINLOCK(cpuidle_lock); + + static int imx6q_enter_wait(struct cpuidle_device *dev, + struct cpuidle_driver *drv, int index) + { +- if (atomic_inc_return(&master) == num_online_cpus()) { +- /* +- * With this lock, we prevent other cpu to exit and enter +- * this function again and become the master. +- */ +- if (!spin_trylock(&master_lock)) +- goto idle; ++ spin_lock(&cpuidle_lock); ++ if (++num_idle_cpus == num_online_cpus()) + imx6_set_lpm(WAIT_UNCLOCKED); +- cpu_do_idle(); +- imx6_set_lpm(WAIT_CLOCKED); +- spin_unlock(&master_lock); +- goto done; +- } ++ spin_unlock(&cpuidle_lock); + +-idle: + cpu_do_idle(); +-done: +- atomic_dec(&master); ++ ++ spin_lock(&cpuidle_lock); ++ if (num_idle_cpus-- == num_online_cpus()) ++ imx6_set_lpm(WAIT_CLOCKED); ++ spin_unlock(&cpuidle_lock); + + return index; + } +diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h +index 33b6f9c892c8..40a6c9261a6b 100644 +--- a/arch/powerpc/include/asm/feature-fixups.h ++++ b/arch/powerpc/include/asm/feature-fixups.h +@@ -221,6 +221,17 @@ label##3: \ + FTR_ENTRY_OFFSET 953b-954b; \ + .popsection; + ++#define START_BTB_FLUSH_SECTION \ ++955: \ ++ ++#define END_BTB_FLUSH_SECTION \ ++956: \ ++ .pushsection __btb_flush_fixup,"a"; \ ++ .align 2; \ ++957: \ ++ FTR_ENTRY_OFFSET 955b-957b; \ ++ FTR_ENTRY_OFFSET 956b-957b; \ ++ .popsection; + + #ifndef __ASSEMBLY__ + #include +@@ -230,6 +241,7 @@ extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup; + extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup; + extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup; + extern long __start___barrier_nospec_fixup, __stop___barrier_nospec_fixup; ++extern long __start__btb_flush_fixup, __stop__btb_flush_fixup; + + void apply_feature_fixups(void); + void setup_feature_keys(void); +diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h +index 665af14850e4..2b7135391231 100644 +--- a/arch/powerpc/include/asm/ppc-opcode.h ++++ b/arch/powerpc/include/asm/ppc-opcode.h +@@ -300,6 +300,7 @@ + /* Misc instructions for BPF compiler */ + #define PPC_INST_LBZ 0x88000000 + #define PPC_INST_LD 0xe8000000 ++#define PPC_INST_LDX 0x7c00002a + #define PPC_INST_LHZ 0xa0000000 + #define PPC_INST_LWZ 0x80000000 + #define PPC_INST_LHBRX 0x7c00062c +@@ -307,6 +308,7 @@ + #define PPC_INST_STB 0x98000000 + #define PPC_INST_STH 0xb0000000 + #define PPC_INST_STD 0xf8000000 ++#define PPC_INST_STDX 0x7c00012a + #define PPC_INST_STDU 0xf8000001 + #define PPC_INST_STW 0x90000000 + #define PPC_INST_STWU 0x94000000 +diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h +index b5d023680801..5c901bf4c505 100644 +--- a/arch/powerpc/include/asm/ppc_asm.h ++++ b/arch/powerpc/include/asm/ppc_asm.h +@@ -821,4 +821,14 @@ END_FTR_SECTION_IFCLR(CPU_FTR_601) + stringify_in_c(.long (_target) - . ;) \ + stringify_in_c(.previous) + ++#ifdef CONFIG_PPC_FSL_BOOK3E ++#define BTB_FLUSH(reg) \ ++ lis reg,BUCSR_INIT@h; \ ++ ori reg,reg,BUCSR_INIT@l; \ ++ mtspr SPRN_BUCSR,reg; \ ++ isync; ++#else ++#define BTB_FLUSH(reg) ++#endif /* CONFIG_PPC_FSL_BOOK3E */ ++ + #endif /* _ASM_POWERPC_PPC_ASM_H */ +diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h +index 1fffbba8d6a5..65676e2325b8 100644 +--- a/arch/powerpc/include/asm/setup.h ++++ b/arch/powerpc/include/asm/setup.h +@@ -67,6 +67,13 @@ void do_barrier_nospec_fixups_range(bool enable, void *start, void *end); + static inline void do_barrier_nospec_fixups_range(bool enable, void *start, void *end) { }; + #endif + ++#ifdef CONFIG_PPC_FSL_BOOK3E ++void setup_spectre_v2(void); ++#else ++static inline void setup_spectre_v2(void) {}; ++#endif ++void do_btb_flush_fixups(void); ++ + #endif /* !__ASSEMBLY__ */ + + #endif /* _ASM_POWERPC_SETUP_H */ +diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S +index 2206912ea4f0..c806a3c12592 100644 +--- a/arch/powerpc/kernel/entry_64.S ++++ b/arch/powerpc/kernel/entry_64.S +@@ -80,6 +80,11 @@ END_FTR_SECTION_IFSET(CPU_FTR_TM) + std r0,GPR0(r1) + std r10,GPR1(r1) + beq 2f /* if from kernel mode */ ++#ifdef CONFIG_PPC_FSL_BOOK3E ++START_BTB_FLUSH_SECTION ++ BTB_FLUSH(r10) ++END_BTB_FLUSH_SECTION ++#endif + ACCOUNT_CPU_USER_ENTRY(r13, r10, r11) + 2: std r2,GPR2(r1) + std r3,GPR3(r1) +diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S +index 6d6e144a28ce..447defdd4503 100644 +--- a/arch/powerpc/kernel/exceptions-64e.S ++++ b/arch/powerpc/kernel/exceptions-64e.S +@@ -296,7 +296,8 @@ ret_from_mc_except: + andi. r10,r11,MSR_PR; /* save stack pointer */ \ + beq 1f; /* branch around if supervisor */ \ + ld r1,PACAKSAVE(r13); /* get kernel stack coming from usr */\ +-1: cmpdi cr1,r1,0; /* check if SP makes sense */ \ ++1: type##_BTB_FLUSH \ ++ cmpdi cr1,r1,0; /* check if SP makes sense */ \ + bge- cr1,exc_##n##_bad_stack;/* bad stack (TODO: out of line) */ \ + mfspr r10,SPRN_##type##_SRR0; /* read SRR0 before touching stack */ + +@@ -328,6 +329,30 @@ ret_from_mc_except: + #define SPRN_MC_SRR0 SPRN_MCSRR0 + #define SPRN_MC_SRR1 SPRN_MCSRR1 + ++#ifdef CONFIG_PPC_FSL_BOOK3E ++#define GEN_BTB_FLUSH \ ++ START_BTB_FLUSH_SECTION \ ++ beq 1f; \ ++ BTB_FLUSH(r10) \ ++ 1: \ ++ END_BTB_FLUSH_SECTION ++ ++#define CRIT_BTB_FLUSH \ ++ START_BTB_FLUSH_SECTION \ ++ BTB_FLUSH(r10) \ ++ END_BTB_FLUSH_SECTION ++ ++#define DBG_BTB_FLUSH CRIT_BTB_FLUSH ++#define MC_BTB_FLUSH CRIT_BTB_FLUSH ++#define GDBELL_BTB_FLUSH GEN_BTB_FLUSH ++#else ++#define GEN_BTB_FLUSH ++#define CRIT_BTB_FLUSH ++#define DBG_BTB_FLUSH ++#define MC_BTB_FLUSH ++#define GDBELL_BTB_FLUSH ++#endif ++ + #define NORMAL_EXCEPTION_PROLOG(n, intnum, addition) \ + EXCEPTION_PROLOG(n, intnum, GEN, addition##_GEN(n)) + +diff --git a/arch/powerpc/kernel/head_booke.h b/arch/powerpc/kernel/head_booke.h +index d0862a100d29..306e26c073a0 100644 +--- a/arch/powerpc/kernel/head_booke.h ++++ b/arch/powerpc/kernel/head_booke.h +@@ -32,6 +32,16 @@ + */ + #define THREAD_NORMSAVE(offset) (THREAD_NORMSAVES + (offset * 4)) + ++#ifdef CONFIG_PPC_FSL_BOOK3E ++#define BOOKE_CLEAR_BTB(reg) \ ++START_BTB_FLUSH_SECTION \ ++ BTB_FLUSH(reg) \ ++END_BTB_FLUSH_SECTION ++#else ++#define BOOKE_CLEAR_BTB(reg) ++#endif ++ ++ + #define NORMAL_EXCEPTION_PROLOG(intno) \ + mtspr SPRN_SPRG_WSCRATCH0, r10; /* save one register */ \ + mfspr r10, SPRN_SPRG_THREAD; \ +@@ -43,6 +53,7 @@ + andi. r11, r11, MSR_PR; /* check whether user or kernel */\ + mr r11, r1; \ + beq 1f; \ ++ BOOKE_CLEAR_BTB(r11) \ + /* if from user, start at top of this thread's kernel stack */ \ + lwz r11, THREAD_INFO-THREAD(r10); \ + ALLOC_STACK_FRAME(r11, THREAD_SIZE); \ +@@ -128,6 +139,7 @@ + stw r9,_CCR(r8); /* save CR on stack */\ + mfspr r11,exc_level_srr1; /* check whether user or kernel */\ + DO_KVM BOOKE_INTERRUPT_##intno exc_level_srr1; \ ++ BOOKE_CLEAR_BTB(r10) \ + andi. r11,r11,MSR_PR; \ + mfspr r11,SPRN_SPRG_THREAD; /* if from user, start at top of */\ + lwz r11,THREAD_INFO-THREAD(r11); /* this thread's kernel stack */\ +diff --git a/arch/powerpc/kernel/head_fsl_booke.S b/arch/powerpc/kernel/head_fsl_booke.S +index e2750b856c8f..2386ce2a9c6e 100644 +--- a/arch/powerpc/kernel/head_fsl_booke.S ++++ b/arch/powerpc/kernel/head_fsl_booke.S +@@ -453,6 +453,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_EMB_HV) + mfcr r13 + stw r13, THREAD_NORMSAVE(3)(r10) + DO_KVM BOOKE_INTERRUPT_DTLB_MISS SPRN_SRR1 ++START_BTB_FLUSH_SECTION ++ mfspr r11, SPRN_SRR1 ++ andi. r10,r11,MSR_PR ++ beq 1f ++ BTB_FLUSH(r10) ++1: ++END_BTB_FLUSH_SECTION + mfspr r10, SPRN_DEAR /* Get faulting address */ + + /* If we are faulting a kernel address, we have to use the +@@ -547,6 +554,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_EMB_HV) + mfcr r13 + stw r13, THREAD_NORMSAVE(3)(r10) + DO_KVM BOOKE_INTERRUPT_ITLB_MISS SPRN_SRR1 ++START_BTB_FLUSH_SECTION ++ mfspr r11, SPRN_SRR1 ++ andi. r10,r11,MSR_PR ++ beq 1f ++ BTB_FLUSH(r10) ++1: ++END_BTB_FLUSH_SECTION ++ + mfspr r10, SPRN_SRR0 /* Get faulting address */ + + /* If we are faulting a kernel address, we have to use the +diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c +index 1b395b85132b..1341325599a7 100644 +--- a/arch/powerpc/kernel/security.c ++++ b/arch/powerpc/kernel/security.c +@@ -26,6 +26,10 @@ static enum count_cache_flush_type count_cache_flush_type = COUNT_CACHE_FLUSH_NO + + bool barrier_nospec_enabled; + static bool no_nospec; ++static bool btb_flush_enabled; ++#ifdef CONFIG_PPC_FSL_BOOK3E ++static bool no_spectrev2; ++#endif + + static void enable_barrier_nospec(bool enable) + { +@@ -101,6 +105,23 @@ static __init int barrier_nospec_debugfs_init(void) + device_initcall(barrier_nospec_debugfs_init); + #endif /* CONFIG_DEBUG_FS */ + ++#ifdef CONFIG_PPC_FSL_BOOK3E ++static int __init handle_nospectre_v2(char *p) ++{ ++ no_spectrev2 = true; ++ ++ return 0; ++} ++early_param("nospectre_v2", handle_nospectre_v2); ++void setup_spectre_v2(void) ++{ ++ if (no_spectrev2) ++ do_btb_flush_fixups(); ++ else ++ btb_flush_enabled = true; ++} ++#endif /* CONFIG_PPC_FSL_BOOK3E */ ++ + #ifdef CONFIG_PPC_BOOK3S_64 + ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) + { +@@ -168,31 +189,27 @@ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, c + bcs = security_ftr_enabled(SEC_FTR_BCCTRL_SERIALISED); + ccd = security_ftr_enabled(SEC_FTR_COUNT_CACHE_DISABLED); + +- if (bcs || ccd || count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) { +- bool comma = false; ++ if (bcs || ccd) { + seq_buf_printf(&s, "Mitigation: "); + +- if (bcs) { ++ if (bcs) + seq_buf_printf(&s, "Indirect branch serialisation (kernel only)"); +- comma = true; +- } +- +- if (ccd) { +- if (comma) +- seq_buf_printf(&s, ", "); +- seq_buf_printf(&s, "Indirect branch cache disabled"); +- comma = true; +- } + +- if (comma) ++ if (bcs && ccd) + seq_buf_printf(&s, ", "); + +- seq_buf_printf(&s, "Software count cache flush"); ++ if (ccd) ++ seq_buf_printf(&s, "Indirect branch cache disabled"); ++ } else if (count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) { ++ seq_buf_printf(&s, "Mitigation: Software count cache flush"); + + if (count_cache_flush_type == COUNT_CACHE_FLUSH_HW) +- seq_buf_printf(&s, "(hardware accelerated)"); +- } else ++ seq_buf_printf(&s, " (hardware accelerated)"); ++ } else if (btb_flush_enabled) { ++ seq_buf_printf(&s, "Mitigation: Branch predictor state flush"); ++ } else { + seq_buf_printf(&s, "Vulnerable"); ++ } + + seq_buf_printf(&s, "\n"); + +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index 93fa0c99681e..508244bcf19c 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -973,6 +973,7 @@ void __init setup_arch(char **cmdline_p) + ppc_md.setup_arch(); + + setup_barrier_nospec(); ++ setup_spectre_v2(); + + paging_init(); + +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 53016c753f3c..fd35eddf3266 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -164,6 +164,14 @@ SECTIONS + } + #endif /* CONFIG_PPC_BARRIER_NOSPEC */ + ++#ifdef CONFIG_PPC_FSL_BOOK3E ++ . = ALIGN(8); ++ __spec_btb_flush_fixup : AT(ADDR(__spec_btb_flush_fixup) - LOAD_OFFSET) { ++ __start__btb_flush_fixup = .; ++ *(__btb_flush_fixup) ++ __stop__btb_flush_fixup = .; ++ } ++#endif + EXCEPTION_TABLE(0) + + NOTES :kernel :notes +diff --git a/arch/powerpc/kvm/bookehv_interrupts.S b/arch/powerpc/kvm/bookehv_interrupts.S +index 81bd8a07aa51..612b7f6a887f 100644 +--- a/arch/powerpc/kvm/bookehv_interrupts.S ++++ b/arch/powerpc/kvm/bookehv_interrupts.S +@@ -75,6 +75,10 @@ + PPC_LL r1, VCPU_HOST_STACK(r4) + PPC_LL r2, HOST_R2(r1) + ++START_BTB_FLUSH_SECTION ++ BTB_FLUSH(r10) ++END_BTB_FLUSH_SECTION ++ + mfspr r10, SPRN_PID + lwz r8, VCPU_HOST_PID(r4) + PPC_LL r11, VCPU_SHARED(r4) +diff --git a/arch/powerpc/kvm/e500_emulate.c b/arch/powerpc/kvm/e500_emulate.c +index 3f8189eb56ed..fde1de08b4d7 100644 +--- a/arch/powerpc/kvm/e500_emulate.c ++++ b/arch/powerpc/kvm/e500_emulate.c +@@ -277,6 +277,13 @@ int kvmppc_core_emulate_mtspr_e500(struct kvm_vcpu *vcpu, int sprn, ulong spr_va + vcpu->arch.pwrmgtcr0 = spr_val; + break; + ++ case SPRN_BUCSR: ++ /* ++ * If we are here, it means that we have already flushed the ++ * branch predictor, so just return to guest. ++ */ ++ break; ++ + /* extra exceptions */ + #ifdef CONFIG_SPE_POSSIBLE + case SPRN_IVOR32: +diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c +index e613b02bb2f0..dbe478e7b8e0 100644 +--- a/arch/powerpc/lib/feature-fixups.c ++++ b/arch/powerpc/lib/feature-fixups.c +@@ -347,6 +347,29 @@ void do_barrier_nospec_fixups_range(bool enable, void *fixup_start, void *fixup_ + + printk(KERN_DEBUG "barrier-nospec: patched %d locations\n", i); + } ++ ++static void patch_btb_flush_section(long *curr) ++{ ++ unsigned int *start, *end; ++ ++ start = (void *)curr + *curr; ++ end = (void *)curr + *(curr + 1); ++ for (; start < end; start++) { ++ pr_devel("patching dest %lx\n", (unsigned long)start); ++ patch_instruction(start, PPC_INST_NOP); ++ } ++} ++ ++void do_btb_flush_fixups(void) ++{ ++ long *start, *end; ++ ++ start = PTRRELOC(&__start__btb_flush_fixup); ++ end = PTRRELOC(&__stop__btb_flush_fixup); ++ ++ for (; start < end; start += 2) ++ patch_btb_flush_section(start); ++} + #endif /* CONFIG_PPC_FSL_BOOK3E */ + + void do_lwsync_fixups(unsigned long value, void *fixup_start, void *fixup_end) +diff --git a/arch/powerpc/lib/memcmp_64.S b/arch/powerpc/lib/memcmp_64.S +index 844d8e774492..b7f6f6e0b6e8 100644 +--- a/arch/powerpc/lib/memcmp_64.S ++++ b/arch/powerpc/lib/memcmp_64.S +@@ -215,11 +215,20 @@ _GLOBAL_TOC(memcmp) + beq .Lzero + + .Lcmp_rest_lt8bytes: +- /* Here we have only less than 8 bytes to compare with. at least s1 +- * Address is aligned with 8 bytes. +- * The next double words are load and shift right with appropriate +- * bits. ++ /* ++ * Here we have less than 8 bytes to compare. At least s1 is aligned to ++ * 8 bytes, but s2 may not be. We must make sure s2 + 7 doesn't cross a ++ * page boundary, otherwise we might read past the end of the buffer and ++ * trigger a page fault. We use 4K as the conservative minimum page ++ * size. If we detect that case we go to the byte-by-byte loop. ++ * ++ * Otherwise the next double word is loaded from s1 and s2, and shifted ++ * right to compare the appropriate bits. + */ ++ clrldi r6,r4,(64-12) // r6 = r4 & 0xfff ++ cmpdi r6,0xff8 ++ bgt .Lshort ++ + subfic r6,r5,8 + slwi r6,r6,3 + LD rA,0,r3 +diff --git a/arch/powerpc/mm/tlb_low_64e.S b/arch/powerpc/mm/tlb_low_64e.S +index 7fd20c52a8ec..9ed90064f542 100644 +--- a/arch/powerpc/mm/tlb_low_64e.S ++++ b/arch/powerpc/mm/tlb_low_64e.S +@@ -70,6 +70,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_EMB_HV) + std r15,EX_TLB_R15(r12) + std r10,EX_TLB_CR(r12) + #ifdef CONFIG_PPC_FSL_BOOK3E ++START_BTB_FLUSH_SECTION ++ mfspr r11, SPRN_SRR1 ++ andi. r10,r11,MSR_PR ++ beq 1f ++ BTB_FLUSH(r10) ++1: ++END_BTB_FLUSH_SECTION + std r7,EX_TLB_R7(r12) + #endif + TLB_MISS_PROLOG_STATS +diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h +index 47fc6660845d..68dece206048 100644 +--- a/arch/powerpc/net/bpf_jit.h ++++ b/arch/powerpc/net/bpf_jit.h +@@ -51,6 +51,8 @@ + #define PPC_LIS(r, i) PPC_ADDIS(r, 0, i) + #define PPC_STD(r, base, i) EMIT(PPC_INST_STD | ___PPC_RS(r) | \ + ___PPC_RA(base) | ((i) & 0xfffc)) ++#define PPC_STDX(r, base, b) EMIT(PPC_INST_STDX | ___PPC_RS(r) | \ ++ ___PPC_RA(base) | ___PPC_RB(b)) + #define PPC_STDU(r, base, i) EMIT(PPC_INST_STDU | ___PPC_RS(r) | \ + ___PPC_RA(base) | ((i) & 0xfffc)) + #define PPC_STW(r, base, i) EMIT(PPC_INST_STW | ___PPC_RS(r) | \ +@@ -65,7 +67,9 @@ + #define PPC_LBZ(r, base, i) EMIT(PPC_INST_LBZ | ___PPC_RT(r) | \ + ___PPC_RA(base) | IMM_L(i)) + #define PPC_LD(r, base, i) EMIT(PPC_INST_LD | ___PPC_RT(r) | \ +- ___PPC_RA(base) | IMM_L(i)) ++ ___PPC_RA(base) | ((i) & 0xfffc)) ++#define PPC_LDX(r, base, b) EMIT(PPC_INST_LDX | ___PPC_RT(r) | \ ++ ___PPC_RA(base) | ___PPC_RB(b)) + #define PPC_LWZ(r, base, i) EMIT(PPC_INST_LWZ | ___PPC_RT(r) | \ + ___PPC_RA(base) | IMM_L(i)) + #define PPC_LHZ(r, base, i) EMIT(PPC_INST_LHZ | ___PPC_RT(r) | \ +@@ -85,17 +89,6 @@ + ___PPC_RA(a) | ___PPC_RB(b)) + #define PPC_BPF_STDCX(s, a, b) EMIT(PPC_INST_STDCX | ___PPC_RS(s) | \ + ___PPC_RA(a) | ___PPC_RB(b)) +- +-#ifdef CONFIG_PPC64 +-#define PPC_BPF_LL(r, base, i) do { PPC_LD(r, base, i); } while(0) +-#define PPC_BPF_STL(r, base, i) do { PPC_STD(r, base, i); } while(0) +-#define PPC_BPF_STLU(r, base, i) do { PPC_STDU(r, base, i); } while(0) +-#else +-#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0) +-#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0) +-#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0) +-#endif +- + #define PPC_CMPWI(a, i) EMIT(PPC_INST_CMPWI | ___PPC_RA(a) | IMM_L(i)) + #define PPC_CMPDI(a, i) EMIT(PPC_INST_CMPDI | ___PPC_RA(a) | IMM_L(i)) + #define PPC_CMPW(a, b) EMIT(PPC_INST_CMPW | ___PPC_RA(a) | \ +diff --git a/arch/powerpc/net/bpf_jit32.h b/arch/powerpc/net/bpf_jit32.h +index 6f4daacad296..ade04547703f 100644 +--- a/arch/powerpc/net/bpf_jit32.h ++++ b/arch/powerpc/net/bpf_jit32.h +@@ -123,6 +123,10 @@ DECLARE_LOAD_FUNC(sk_load_byte_msh); + #define PPC_NTOHS_OFFS(r, base, i) PPC_LHZ_OFFS(r, base, i) + #endif + ++#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0) ++#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0) ++#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0) ++ + #define SEEN_DATAREF 0x10000 /* might call external helpers */ + #define SEEN_XREG 0x20000 /* X reg is used */ + #define SEEN_MEM 0x40000 /* SEEN_MEM+(1< MAX_TAIL_CALL_CNT) + * goto out; + */ +- PPC_LD(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx)); ++ PPC_BPF_LL(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx)); + PPC_CMPLWI(b2p[TMP_REG_1], MAX_TAIL_CALL_CNT); + PPC_BCC(COND_GT, out); + +@@ -239,7 +239,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 + /* prog = array->ptrs[index]; */ + PPC_MULI(b2p[TMP_REG_1], b2p_index, 8); + PPC_ADD(b2p[TMP_REG_1], b2p[TMP_REG_1], b2p_bpf_array); +- PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs)); ++ PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs)); + + /* + * if (prog == NULL) +@@ -249,7 +249,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 + PPC_BCC(COND_EQ, out); + + /* goto *(prog->bpf_func + prologue_size); */ +- PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func)); ++ PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func)); + #ifdef PPC64_ELF_ABI_v1 + /* skip past the function descriptor */ + PPC_ADDI(b2p[TMP_REG_1], b2p[TMP_REG_1], +@@ -573,7 +573,7 @@ bpf_alu32_trunc: + * the instructions generated will remain the + * same across all passes + */ +- PPC_STD(dst_reg, 1, bpf_jit_stack_local(ctx)); ++ PPC_BPF_STL(dst_reg, 1, bpf_jit_stack_local(ctx)); + PPC_ADDI(b2p[TMP_REG_1], 1, bpf_jit_stack_local(ctx)); + PPC_LDBRX(dst_reg, 0, b2p[TMP_REG_1]); + break; +@@ -629,7 +629,7 @@ emit_clear: + PPC_LI32(b2p[TMP_REG_1], imm); + src_reg = b2p[TMP_REG_1]; + } +- PPC_STD(src_reg, dst_reg, off); ++ PPC_BPF_STL(src_reg, dst_reg, off); + break; + + /* +@@ -676,7 +676,7 @@ emit_clear: + break; + /* dst = *(u64 *)(ul) (src + off) */ + case BPF_LDX | BPF_MEM | BPF_DW: +- PPC_LD(dst_reg, src_reg, off); ++ PPC_BPF_LL(dst_reg, src_reg, off); + break; + + /* +diff --git a/arch/powerpc/platforms/pseries/pseries_energy.c b/arch/powerpc/platforms/pseries/pseries_energy.c +index 6ed22127391b..921f12182f3e 100644 +--- a/arch/powerpc/platforms/pseries/pseries_energy.c ++++ b/arch/powerpc/platforms/pseries/pseries_energy.c +@@ -77,18 +77,27 @@ static u32 cpu_to_drc_index(int cpu) + + ret = drc.drc_index_start + (thread_index * drc.sequential_inc); + } else { +- const __be32 *indexes; +- +- indexes = of_get_property(dn, "ibm,drc-indexes", NULL); +- if (indexes == NULL) +- goto err_of_node_put; ++ u32 nr_drc_indexes, thread_drc_index; + + /* +- * The first element indexes[0] is the number of drc_indexes +- * returned in the list. Hence thread_index+1 will get the +- * drc_index corresponding to core number thread_index. ++ * The first element of ibm,drc-indexes array is the ++ * number of drc_indexes returned in the list. Hence ++ * thread_index+1 will get the drc_index corresponding ++ * to core number thread_index. + */ +- ret = indexes[thread_index + 1]; ++ rc = of_property_read_u32_index(dn, "ibm,drc-indexes", ++ 0, &nr_drc_indexes); ++ if (rc) ++ goto err_of_node_put; ++ ++ WARN_ON_ONCE(thread_index > nr_drc_indexes); ++ rc = of_property_read_u32_index(dn, "ibm,drc-indexes", ++ thread_index + 1, ++ &thread_drc_index); ++ if (rc) ++ goto err_of_node_put; ++ ++ ret = thread_drc_index; + } + + rc = 0; +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 44c6a82b7ce5..e76d16ac2776 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -2199,14 +2199,8 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING + If unsure, leave at the default value. + + config HOTPLUG_CPU +- bool "Support for hot-pluggable CPUs" ++ def_bool y + depends on SMP +- ---help--- +- Say Y here to allow turning CPUs off and on. CPUs can be +- controlled through /sys/devices/system/cpu. +- ( Note: power management support will enable this option +- automatically on SMP systems. ) +- Say N if you want to disable CPU hotplug. + + config BOOTPARAM_HOTPLUG_CPU0 + bool "Set default setting of cpu0_hotpluggable" +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 46f0b621bd37..7014dba23d20 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -315,6 +315,7 @@ struct kvm_mmu_page { + }; + + struct kvm_pio_request { ++ unsigned long linear_rip; + unsigned long count; + int in; + int port; +@@ -527,6 +528,7 @@ struct kvm_vcpu_arch { + bool tpr_access_reporting; + u64 ia32_xss; + u64 microcode_version; ++ u64 arch_capabilities; + + /* + * Paging state of the vcpu +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 4029d3783e18..f99f59625da5 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -970,7 +970,6 @@ struct vcpu_vmx { + u64 msr_guest_kernel_gs_base; + #endif + +- u64 arch_capabilities; + u64 spec_ctrl; + + u32 vm_entry_controls_shadow; +@@ -4104,12 +4103,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + + msr_info->data = to_vmx(vcpu)->spec_ctrl; + break; +- case MSR_IA32_ARCH_CAPABILITIES: +- if (!msr_info->host_initiated && +- !guest_cpuid_has(vcpu, X86_FEATURE_ARCH_CAPABILITIES)) +- return 1; +- msr_info->data = to_vmx(vcpu)->arch_capabilities; +- break; + case MSR_IA32_SYSENTER_CS: + msr_info->data = vmcs_read32(GUEST_SYSENTER_CS); + break; +@@ -4271,11 +4264,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD, + MSR_TYPE_W); + break; +- case MSR_IA32_ARCH_CAPABILITIES: +- if (!msr_info->host_initiated) +- return 1; +- vmx->arch_capabilities = data; +- break; + case MSR_IA32_CR_PAT: + if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { + if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data)) +@@ -6666,8 +6654,6 @@ static void vmx_vcpu_setup(struct vcpu_vmx *vmx) + ++vmx->nmsrs; + } + +- vmx->arch_capabilities = kvm_get_arch_capabilities(); +- + vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl); + + /* 22.2.1, 20.8.1 */ +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 6181ec19bed2..4a61e1609c97 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -2350,6 +2350,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + if (msr_info->host_initiated) + vcpu->arch.microcode_version = data; + break; ++ case MSR_IA32_ARCH_CAPABILITIES: ++ if (!msr_info->host_initiated) ++ return 1; ++ vcpu->arch.arch_capabilities = data; ++ break; + case MSR_EFER: + return set_efer(vcpu, data); + case MSR_K7_HWCR: +@@ -2654,6 +2659,12 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + case MSR_IA32_UCODE_REV: + msr_info->data = vcpu->arch.microcode_version; + break; ++ case MSR_IA32_ARCH_CAPABILITIES: ++ if (!msr_info->host_initiated && ++ !guest_cpuid_has(vcpu, X86_FEATURE_ARCH_CAPABILITIES)) ++ return 1; ++ msr_info->data = vcpu->arch.arch_capabilities; ++ break; + case MSR_IA32_TSC: + msr_info->data = kvm_scale_tsc(vcpu, rdtsc()) + vcpu->arch.tsc_offset; + break; +@@ -6317,14 +6328,27 @@ int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu, + } + EXPORT_SYMBOL_GPL(kvm_emulate_instruction_from_buffer); + ++static int complete_fast_pio_out(struct kvm_vcpu *vcpu) ++{ ++ vcpu->arch.pio.count = 0; ++ ++ if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip))) ++ return 1; ++ ++ return kvm_skip_emulated_instruction(vcpu); ++} ++ + static int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size, + unsigned short port) + { + unsigned long val = kvm_register_read(vcpu, VCPU_REGS_RAX); + int ret = emulator_pio_out_emulated(&vcpu->arch.emulate_ctxt, + size, port, &val, 1); +- /* do not return to emulator after return from userspace */ +- vcpu->arch.pio.count = 0; ++ ++ if (!ret) { ++ vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu); ++ vcpu->arch.complete_userspace_io = complete_fast_pio_out; ++ } + return ret; + } + +@@ -6335,6 +6359,11 @@ static int complete_fast_pio_in(struct kvm_vcpu *vcpu) + /* We should only ever be called with arch.pio.count equal to 1 */ + BUG_ON(vcpu->arch.pio.count != 1); + ++ if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip))) { ++ vcpu->arch.pio.count = 0; ++ return 1; ++ } ++ + /* For size less than 4 we merge, else we zero extend */ + val = (vcpu->arch.pio.size < 4) ? kvm_register_read(vcpu, VCPU_REGS_RAX) + : 0; +@@ -6347,7 +6376,7 @@ static int complete_fast_pio_in(struct kvm_vcpu *vcpu) + vcpu->arch.pio.port, &val, 1); + kvm_register_write(vcpu, VCPU_REGS_RAX, val); + +- return 1; ++ return kvm_skip_emulated_instruction(vcpu); + } + + static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size, +@@ -6366,6 +6395,7 @@ static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size, + return ret; + } + ++ vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu); + vcpu->arch.complete_userspace_io = complete_fast_pio_in; + + return 0; +@@ -6373,16 +6403,13 @@ static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size, + + int kvm_fast_pio(struct kvm_vcpu *vcpu, int size, unsigned short port, int in) + { +- int ret = kvm_skip_emulated_instruction(vcpu); ++ int ret; + +- /* +- * TODO: we might be squashing a KVM_GUESTDBG_SINGLESTEP-triggered +- * KVM_EXIT_DEBUG here. +- */ + if (in) +- return kvm_fast_pio_in(vcpu, size, port) && ret; ++ ret = kvm_fast_pio_in(vcpu, size, port); + else +- return kvm_fast_pio_out(vcpu, size, port) && ret; ++ ret = kvm_fast_pio_out(vcpu, size, port); ++ return ret && kvm_skip_emulated_instruction(vcpu); + } + EXPORT_SYMBOL_GPL(kvm_fast_pio); + +@@ -8485,6 +8512,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, + + int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu) + { ++ vcpu->arch.arch_capabilities = kvm_get_arch_capabilities(); + kvm_vcpu_mtrr_init(vcpu); + vcpu_load(vcpu); + kvm_vcpu_reset(vcpu, false); +diff --git a/drivers/char/ipmi/ipmi_si.h b/drivers/char/ipmi/ipmi_si.h +index 52f6152d1fcb..7ae52c17618e 100644 +--- a/drivers/char/ipmi/ipmi_si.h ++++ b/drivers/char/ipmi/ipmi_si.h +@@ -25,7 +25,9 @@ void ipmi_irq_finish_setup(struct si_sm_io *io); + int ipmi_si_remove_by_dev(struct device *dev); + void ipmi_si_remove_by_data(int addr_space, enum si_type si_type, + unsigned long addr); +-int ipmi_si_hardcode_find_bmc(void); ++void ipmi_hardcode_init(void); ++void ipmi_si_hardcode_exit(void); ++int ipmi_si_hardcode_match(int addr_type, unsigned long addr); + void ipmi_si_platform_init(void); + void ipmi_si_platform_shutdown(void); + +diff --git a/drivers/char/ipmi/ipmi_si_hardcode.c b/drivers/char/ipmi/ipmi_si_hardcode.c +index 10219f24546b..9ae2405c28bb 100644 +--- a/drivers/char/ipmi/ipmi_si_hardcode.c ++++ b/drivers/char/ipmi/ipmi_si_hardcode.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0+ + + #include ++#include + #include "ipmi_si.h" + + #define PFX "ipmi_hardcode: " +@@ -11,23 +12,22 @@ + + #define SI_MAX_PARMS 4 + +-static char *si_type[SI_MAX_PARMS]; + #define MAX_SI_TYPE_STR 30 +-static char si_type_str[MAX_SI_TYPE_STR]; ++static char si_type_str[MAX_SI_TYPE_STR] __initdata; + static unsigned long addrs[SI_MAX_PARMS]; + static unsigned int num_addrs; + static unsigned int ports[SI_MAX_PARMS]; + static unsigned int num_ports; +-static int irqs[SI_MAX_PARMS]; +-static unsigned int num_irqs; +-static int regspacings[SI_MAX_PARMS]; +-static unsigned int num_regspacings; +-static int regsizes[SI_MAX_PARMS]; +-static unsigned int num_regsizes; +-static int regshifts[SI_MAX_PARMS]; +-static unsigned int num_regshifts; +-static int slave_addrs[SI_MAX_PARMS]; /* Leaving 0 chooses the default value */ +-static unsigned int num_slave_addrs; ++static int irqs[SI_MAX_PARMS] __initdata; ++static unsigned int num_irqs __initdata; ++static int regspacings[SI_MAX_PARMS] __initdata; ++static unsigned int num_regspacings __initdata; ++static int regsizes[SI_MAX_PARMS] __initdata; ++static unsigned int num_regsizes __initdata; ++static int regshifts[SI_MAX_PARMS] __initdata; ++static unsigned int num_regshifts __initdata; ++static int slave_addrs[SI_MAX_PARMS] __initdata; ++static unsigned int num_slave_addrs __initdata; + + module_param_string(type, si_type_str, MAX_SI_TYPE_STR, 0); + MODULE_PARM_DESC(type, "Defines the type of each interface, each" +@@ -72,12 +72,133 @@ MODULE_PARM_DESC(slave_addrs, "Set the default IPMB slave address for" + " overridden by this parm. This is an array indexed" + " by interface number."); + +-int ipmi_si_hardcode_find_bmc(void) ++static struct platform_device *ipmi_hc_pdevs[SI_MAX_PARMS]; ++ ++static void __init ipmi_hardcode_init_one(const char *si_type_str, ++ unsigned int i, ++ unsigned long addr, ++ unsigned int flags) + { +- int ret = -ENODEV; +- int i; +- struct si_sm_io io; ++ struct platform_device *pdev; ++ unsigned int num_r = 1, size; ++ struct resource r[4]; ++ struct property_entry p[6]; ++ enum si_type si_type; ++ unsigned int regspacing, regsize; ++ int rv; ++ ++ memset(p, 0, sizeof(p)); ++ memset(r, 0, sizeof(r)); ++ ++ if (!si_type_str || !*si_type_str || strcmp(si_type_str, "kcs") == 0) { ++ size = 2; ++ si_type = SI_KCS; ++ } else if (strcmp(si_type_str, "smic") == 0) { ++ size = 2; ++ si_type = SI_SMIC; ++ } else if (strcmp(si_type_str, "bt") == 0) { ++ size = 3; ++ si_type = SI_BT; ++ } else if (strcmp(si_type_str, "invalid") == 0) { ++ /* ++ * Allow a firmware-specified interface to be ++ * disabled. ++ */ ++ size = 1; ++ si_type = SI_TYPE_INVALID; ++ } else { ++ pr_warn("Interface type specified for interface %d, was invalid: %s\n", ++ i, si_type_str); ++ return; ++ } ++ ++ regsize = regsizes[i]; ++ if (regsize == 0) ++ regsize = DEFAULT_REGSIZE; ++ ++ p[0] = PROPERTY_ENTRY_U8("ipmi-type", si_type); ++ p[1] = PROPERTY_ENTRY_U8("slave-addr", slave_addrs[i]); ++ p[2] = PROPERTY_ENTRY_U8("addr-source", SI_HARDCODED); ++ p[3] = PROPERTY_ENTRY_U8("reg-shift", regshifts[i]); ++ p[4] = PROPERTY_ENTRY_U8("reg-size", regsize); ++ /* Last entry must be left NULL to terminate it. */ ++ ++ /* ++ * Register spacing is derived from the resources in ++ * the IPMI platform code. ++ */ ++ regspacing = regspacings[i]; ++ if (regspacing == 0) ++ regspacing = regsize; ++ ++ r[0].start = addr; ++ r[0].end = r[0].start + regsize - 1; ++ r[0].name = "IPMI Address 1"; ++ r[0].flags = flags; ++ ++ if (size > 1) { ++ r[1].start = r[0].start + regspacing; ++ r[1].end = r[1].start + regsize - 1; ++ r[1].name = "IPMI Address 2"; ++ r[1].flags = flags; ++ num_r++; ++ } ++ ++ if (size > 2) { ++ r[2].start = r[1].start + regspacing; ++ r[2].end = r[2].start + regsize - 1; ++ r[2].name = "IPMI Address 3"; ++ r[2].flags = flags; ++ num_r++; ++ } ++ ++ if (irqs[i]) { ++ r[num_r].start = irqs[i]; ++ r[num_r].end = irqs[i]; ++ r[num_r].name = "IPMI IRQ"; ++ r[num_r].flags = IORESOURCE_IRQ; ++ num_r++; ++ } ++ ++ pdev = platform_device_alloc("hardcode-ipmi-si", i); ++ if (!pdev) { ++ pr_err("Error allocating IPMI platform device %d\n", i); ++ return; ++ } ++ ++ rv = platform_device_add_resources(pdev, r, num_r); ++ if (rv) { ++ dev_err(&pdev->dev, ++ "Unable to add hard-code resources: %d\n", rv); ++ goto err; ++ } ++ ++ rv = platform_device_add_properties(pdev, p); ++ if (rv) { ++ dev_err(&pdev->dev, ++ "Unable to add hard-code properties: %d\n", rv); ++ goto err; ++ } ++ ++ rv = platform_device_add(pdev); ++ if (rv) { ++ dev_err(&pdev->dev, ++ "Unable to add hard-code device: %d\n", rv); ++ goto err; ++ } ++ ++ ipmi_hc_pdevs[i] = pdev; ++ return; ++ ++err: ++ platform_device_put(pdev); ++} ++ ++void __init ipmi_hardcode_init(void) ++{ ++ unsigned int i; + char *str; ++ char *si_type[SI_MAX_PARMS]; + + /* Parse out the si_type string into its components. */ + str = si_type_str; +@@ -94,54 +215,45 @@ int ipmi_si_hardcode_find_bmc(void) + } + } + +- memset(&io, 0, sizeof(io)); + for (i = 0; i < SI_MAX_PARMS; i++) { +- if (!ports[i] && !addrs[i]) +- continue; +- +- io.addr_source = SI_HARDCODED; +- pr_info(PFX "probing via hardcoded address\n"); +- +- if (!si_type[i] || strcmp(si_type[i], "kcs") == 0) { +- io.si_type = SI_KCS; +- } else if (strcmp(si_type[i], "smic") == 0) { +- io.si_type = SI_SMIC; +- } else if (strcmp(si_type[i], "bt") == 0) { +- io.si_type = SI_BT; +- } else { +- pr_warn(PFX "Interface type specified for interface %d, was invalid: %s\n", +- i, si_type[i]); +- continue; +- } ++ if (i < num_ports && ports[i]) ++ ipmi_hardcode_init_one(si_type[i], i, ports[i], ++ IORESOURCE_IO); ++ if (i < num_addrs && addrs[i]) ++ ipmi_hardcode_init_one(si_type[i], i, addrs[i], ++ IORESOURCE_MEM); ++ } ++} + +- if (ports[i]) { +- /* An I/O port */ +- io.addr_data = ports[i]; +- io.addr_type = IPMI_IO_ADDR_SPACE; +- } else if (addrs[i]) { +- /* A memory port */ +- io.addr_data = addrs[i]; +- io.addr_type = IPMI_MEM_ADDR_SPACE; +- } else { +- pr_warn(PFX "Interface type specified for interface %d, but port and address were not set or set to zero.\n", +- i); +- continue; +- } ++void ipmi_si_hardcode_exit(void) ++{ ++ unsigned int i; + +- io.addr = NULL; +- io.regspacing = regspacings[i]; +- if (!io.regspacing) +- io.regspacing = DEFAULT_REGSPACING; +- io.regsize = regsizes[i]; +- if (!io.regsize) +- io.regsize = DEFAULT_REGSIZE; +- io.regshift = regshifts[i]; +- io.irq = irqs[i]; +- if (io.irq) +- io.irq_setup = ipmi_std_irq_setup; +- io.slave_addr = slave_addrs[i]; +- +- ret = ipmi_si_add_smi(&io); ++ for (i = 0; i < SI_MAX_PARMS; i++) { ++ if (ipmi_hc_pdevs[i]) ++ platform_device_unregister(ipmi_hc_pdevs[i]); + } +- return ret; ++} ++ ++/* ++ * Returns true of the given address exists as a hardcoded address, ++ * false if not. ++ */ ++int ipmi_si_hardcode_match(int addr_type, unsigned long addr) ++{ ++ unsigned int i; ++ ++ if (addr_type == IPMI_IO_ADDR_SPACE) { ++ for (i = 0; i < num_ports; i++) { ++ if (ports[i] == addr) ++ return 1; ++ } ++ } else { ++ for (i = 0; i < num_addrs; i++) { ++ if (addrs[i] == addr) ++ return 1; ++ } ++ } ++ ++ return 0; + } +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index 82d831b103f9..75e5006f395a 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -1862,6 +1862,18 @@ int ipmi_si_add_smi(struct si_sm_io *io) + int rv = 0; + struct smi_info *new_smi, *dup; + ++ /* ++ * If the user gave us a hard-coded device at the same ++ * address, they presumably want us to use it and not what is ++ * in the firmware. ++ */ ++ if (io->addr_source != SI_HARDCODED && ++ ipmi_si_hardcode_match(io->addr_type, io->addr_data)) { ++ dev_info(io->dev, ++ "Hard-coded device at this address already exists"); ++ return -ENODEV; ++ } ++ + if (!io->io_setup) { + if (io->addr_type == IPMI_IO_ADDR_SPACE) { + io->io_setup = ipmi_si_port_setup; +@@ -2094,7 +2106,7 @@ static int try_smi_init(struct smi_info *new_smi) + return rv; + } + +-static int init_ipmi_si(void) ++static int __init init_ipmi_si(void) + { + struct smi_info *e; + enum ipmi_addr_src type = SI_INVALID; +@@ -2102,12 +2114,9 @@ static int init_ipmi_si(void) + if (initialized) + return 0; + ++ ipmi_hardcode_init(); + pr_info("IPMI System Interface driver.\n"); + +- /* If the user gave us a device, they presumably want us to use it */ +- if (!ipmi_si_hardcode_find_bmc()) +- goto do_scan; +- + ipmi_si_platform_init(); + + ipmi_si_pci_init(); +@@ -2118,7 +2127,6 @@ static int init_ipmi_si(void) + with multiple BMCs we assume that there will be several instances + of a given type so if we succeed in registering a type then also + try to register everything else of the same type */ +-do_scan: + mutex_lock(&smi_infos_lock); + list_for_each_entry(e, &smi_infos, link) { + /* Try to register a device if it has an IRQ and we either +@@ -2304,6 +2312,8 @@ static void cleanup_ipmi_si(void) + list_for_each_entry_safe(e, tmp_e, &smi_infos, link) + cleanup_one_si(e); + mutex_unlock(&smi_infos_lock); ++ ++ ipmi_si_hardcode_exit(); + } + module_exit(cleanup_ipmi_si); + +diff --git a/drivers/char/ipmi/ipmi_si_platform.c b/drivers/char/ipmi/ipmi_si_platform.c +index bf69927502bd..d32b0dd377c5 100644 +--- a/drivers/char/ipmi/ipmi_si_platform.c ++++ b/drivers/char/ipmi/ipmi_si_platform.c +@@ -126,8 +126,6 @@ ipmi_get_info_from_resources(struct platform_device *pdev, + if (res_second->start > io->addr_data) + io->regspacing = res_second->start - io->addr_data; + } +- io->regsize = DEFAULT_REGSIZE; +- io->regshift = 0; + + return res; + } +@@ -135,7 +133,7 @@ ipmi_get_info_from_resources(struct platform_device *pdev, + static int platform_ipmi_probe(struct platform_device *pdev) + { + struct si_sm_io io; +- u8 type, slave_addr, addr_source; ++ u8 type, slave_addr, addr_source, regsize, regshift; + int rv; + + rv = device_property_read_u8(&pdev->dev, "addr-source", &addr_source); +@@ -147,7 +145,7 @@ static int platform_ipmi_probe(struct platform_device *pdev) + if (addr_source == SI_SMBIOS) { + if (!si_trydmi) + return -ENODEV; +- } else { ++ } else if (addr_source != SI_HARDCODED) { + if (!si_tryplatform) + return -ENODEV; + } +@@ -167,11 +165,23 @@ static int platform_ipmi_probe(struct platform_device *pdev) + case SI_BT: + io.si_type = type; + break; ++ case SI_TYPE_INVALID: /* User disabled this in hardcode. */ ++ return -ENODEV; + default: + dev_err(&pdev->dev, "ipmi-type property is invalid\n"); + return -EINVAL; + } + ++ io.regsize = DEFAULT_REGSIZE; ++ rv = device_property_read_u8(&pdev->dev, "reg-size", ®size); ++ if (!rv) ++ io.regsize = regsize; ++ ++ io.regshift = 0; ++ rv = device_property_read_u8(&pdev->dev, "reg-shift", ®shift); ++ if (!rv) ++ io.regshift = regshift; ++ + if (!ipmi_get_info_from_resources(pdev, &io)) + return -EINVAL; + +@@ -191,7 +201,8 @@ static int platform_ipmi_probe(struct platform_device *pdev) + + io.dev = &pdev->dev; + +- pr_info("ipmi_si: SMBIOS: %s %#lx regsize %d spacing %d irq %d\n", ++ pr_info("ipmi_si: %s: %s %#lx regsize %d spacing %d irq %d\n", ++ ipmi_addr_src_to_str(addr_source), + (io.addr_type == IPMI_IO_ADDR_SPACE) ? "io" : "mem", + io.addr_data, io.regsize, io.regspacing, io.irq); + +@@ -356,6 +367,9 @@ static int acpi_ipmi_probe(struct platform_device *pdev) + goto err_free; + } + ++ io.regsize = DEFAULT_REGSIZE; ++ io.regshift = 0; ++ + res = ipmi_get_info_from_resources(pdev, &io); + if (!res) { + rv = -EINVAL; +@@ -417,6 +431,11 @@ static int ipmi_remove(struct platform_device *pdev) + return ipmi_si_remove_by_dev(&pdev->dev); + } + ++static const struct platform_device_id si_plat_ids[] = { ++ { "hardcode-ipmi-si", 0 }, ++ { } ++}; ++ + struct platform_driver ipmi_platform_driver = { + .driver = { + .name = DEVICE_NAME, +@@ -425,6 +444,7 @@ struct platform_driver ipmi_platform_driver = { + }, + .probe = ipmi_probe, + .remove = ipmi_remove, ++ .id_table = si_plat_ids + }; + + void ipmi_si_platform_init(void) +diff --git a/drivers/gpio/gpio-adnp.c b/drivers/gpio/gpio-adnp.c +index 91b90c0cea73..12acdac85820 100644 +--- a/drivers/gpio/gpio-adnp.c ++++ b/drivers/gpio/gpio-adnp.c +@@ -132,8 +132,10 @@ static int adnp_gpio_direction_input(struct gpio_chip *chip, unsigned offset) + if (err < 0) + goto out; + +- if (err & BIT(pos)) +- err = -EACCES; ++ if (value & BIT(pos)) { ++ err = -EPERM; ++ goto out; ++ } + + err = 0; + +diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c +index 0ecd2369c2ca..a09d2f9ebacc 100644 +--- a/drivers/gpio/gpio-exar.c ++++ b/drivers/gpio/gpio-exar.c +@@ -148,6 +148,8 @@ static int gpio_exar_probe(struct platform_device *pdev) + mutex_init(&exar_gpio->lock); + + index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL); ++ if (index < 0) ++ goto err_destroy; + + sprintf(exar_gpio->name, "exar_gpio%d", index); + exar_gpio->gpio_chip.label = exar_gpio->name; +diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c +index a614db310ea2..be15289bff9c 100644 +--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c ++++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c +@@ -1446,7 +1446,7 @@ static inline int cmd_address_audit(struct parser_exec_state *s, + } + + if (index_mode) { +- if (guest_gma >= I915_GTT_PAGE_SIZE / sizeof(u64)) { ++ if (guest_gma >= I915_GTT_PAGE_SIZE) { + ret = -EFAULT; + goto err; + } +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index 1359e5c773e4..f8f9ae6622eb 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -505,6 +505,18 @@ static void vop_core_clks_disable(struct vop *vop) + clk_disable(vop->hclk); + } + ++static void vop_win_disable(struct vop *vop, const struct vop_win_data *win) ++{ ++ if (win->phy->scl && win->phy->scl->ext) { ++ VOP_SCL_SET_EXT(vop, win, yrgb_hor_scl_mode, SCALE_NONE); ++ VOP_SCL_SET_EXT(vop, win, yrgb_ver_scl_mode, SCALE_NONE); ++ VOP_SCL_SET_EXT(vop, win, cbcr_hor_scl_mode, SCALE_NONE); ++ VOP_SCL_SET_EXT(vop, win, cbcr_ver_scl_mode, SCALE_NONE); ++ } ++ ++ VOP_WIN_SET(vop, win, enable, 0); ++} ++ + static int vop_enable(struct drm_crtc *crtc) + { + struct vop *vop = to_vop(crtc); +@@ -550,7 +562,7 @@ static int vop_enable(struct drm_crtc *crtc) + struct vop_win *vop_win = &vop->win[i]; + const struct vop_win_data *win = vop_win->data; + +- VOP_WIN_SET(vop, win, enable, 0); ++ vop_win_disable(vop, win); + } + spin_unlock(&vop->reg_lock); + +@@ -694,7 +706,7 @@ static void vop_plane_atomic_disable(struct drm_plane *plane, + + spin_lock(&vop->reg_lock); + +- VOP_WIN_SET(vop, win, enable, 0); ++ vop_win_disable(vop, win); + + spin_unlock(&vop->reg_lock); + } +@@ -1449,7 +1461,7 @@ static int vop_initial(struct vop *vop) + int channel = i * 2 + 1; + + VOP_WIN_SET(vop, win, channel, (channel + 1) << 4 | channel); +- VOP_WIN_SET(vop, win, enable, 0); ++ vop_win_disable(vop, win); + VOP_WIN_SET(vop, win, gate, 1); + } + +diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c +index 6887db878b38..4709f08f39e4 100644 +--- a/drivers/gpu/drm/vgem/vgem_drv.c ++++ b/drivers/gpu/drm/vgem/vgem_drv.c +@@ -191,13 +191,9 @@ static struct drm_gem_object *vgem_gem_create(struct drm_device *dev, + ret = drm_gem_handle_create(file, &obj->base, handle); + drm_gem_object_put_unlocked(&obj->base); + if (ret) +- goto err; ++ return ERR_PTR(ret); + + return &obj->base; +- +-err: +- __vgem_gem_destroy(obj); +- return ERR_PTR(ret); + } + + static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev, +diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c +index ca4a74e04977..ce394009a36c 100644 +--- a/drivers/gpu/drm/vkms/vkms_gem.c ++++ b/drivers/gpu/drm/vkms/vkms_gem.c +@@ -110,11 +110,8 @@ struct drm_gem_object *vkms_gem_create(struct drm_device *dev, + + ret = drm_gem_handle_create(file, &obj->gem, handle); + drm_gem_object_put_unlocked(&obj->gem); +- if (ret) { +- drm_gem_object_release(&obj->gem); +- kfree(obj); ++ if (ret) + return ERR_PTR(ret); +- } + + return &obj->gem; + } +diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c +index b5948ba6b3b3..fde728ea2900 100644 +--- a/drivers/iommu/io-pgtable-arm-v7s.c ++++ b/drivers/iommu/io-pgtable-arm-v7s.c +@@ -161,6 +161,14 @@ + + #define ARM_V7S_TCR_PD1 BIT(5) + ++#ifdef CONFIG_ZONE_DMA32 ++#define ARM_V7S_TABLE_GFP_DMA GFP_DMA32 ++#define ARM_V7S_TABLE_SLAB_FLAGS SLAB_CACHE_DMA32 ++#else ++#define ARM_V7S_TABLE_GFP_DMA GFP_DMA ++#define ARM_V7S_TABLE_SLAB_FLAGS SLAB_CACHE_DMA ++#endif ++ + typedef u32 arm_v7s_iopte; + + static bool selftest_running; +@@ -198,13 +206,16 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + void *table = NULL; + + if (lvl == 1) +- table = (void *)__get_dma_pages(__GFP_ZERO, get_order(size)); ++ table = (void *)__get_free_pages( ++ __GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size)); + else if (lvl == 2) +- table = kmem_cache_zalloc(data->l2_tables, gfp | GFP_DMA); ++ table = kmem_cache_zalloc(data->l2_tables, gfp); + phys = virt_to_phys(table); +- if (phys != (arm_v7s_iopte)phys) ++ if (phys != (arm_v7s_iopte)phys) { + /* Doesn't fit in PTE */ ++ dev_err(dev, "Page table does not fit in PTE: %pa", &phys); + goto out_free; ++ } + if (table && !(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)) { + dma = dma_map_single(dev, table, size, DMA_TO_DEVICE); + if (dma_mapping_error(dev, dma)) +@@ -728,7 +739,7 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, + data->l2_tables = kmem_cache_create("io-pgtable_armv7s_l2", + ARM_V7S_TABLE_SIZE(2), + ARM_V7S_TABLE_SIZE(2), +- SLAB_CACHE_DMA, NULL); ++ ARM_V7S_TABLE_SLAB_FLAGS, NULL); + if (!data->l2_tables) + goto out_free_data; + +diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c +index 4d85645c87f7..0928fd1f0e0c 100644 +--- a/drivers/isdn/hardware/mISDN/hfcmulti.c ++++ b/drivers/isdn/hardware/mISDN/hfcmulti.c +@@ -4365,7 +4365,8 @@ setup_pci(struct hfc_multi *hc, struct pci_dev *pdev, + if (m->clock2) + test_and_set_bit(HFC_CHIP_CLOCK2, &hc->chip); + +- if (ent->device == 0xB410) { ++ if (ent->vendor == PCI_VENDOR_ID_DIGIUM && ++ ent->device == PCI_DEVICE_ID_DIGIUM_HFC4S) { + test_and_set_bit(HFC_CHIP_B410P, &hc->chip); + test_and_set_bit(HFC_CHIP_PCM_MASTER, &hc->chip); + test_and_clear_bit(HFC_CHIP_PCM_SLAVE, &hc->chip); +diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig +index d03775100f7d..619bf1498a66 100644 +--- a/drivers/net/Kconfig ++++ b/drivers/net/Kconfig +@@ -213,8 +213,8 @@ config GENEVE + + config GTP + tristate "GPRS Tunneling Protocol datapath (GTP-U)" +- depends on INET && NET_UDP_TUNNEL +- select NET_IP_TUNNEL ++ depends on INET ++ select NET_UDP_TUNNEL + ---help--- + This allows one to create gtp virtual interfaces that provide + the GPRS Tunneling Protocol datapath (GTP-U). This tunneling protocol +diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c +index cdcde7f8e0b2..bdd8f2df6630 100644 +--- a/drivers/net/dsa/qca8k.c ++++ b/drivers/net/dsa/qca8k.c +@@ -620,22 +620,6 @@ qca8k_adjust_link(struct dsa_switch *ds, int port, struct phy_device *phy) + qca8k_port_set_status(priv, port, 1); + } + +-static int +-qca8k_phy_read(struct dsa_switch *ds, int phy, int regnum) +-{ +- struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv; +- +- return mdiobus_read(priv->bus, phy, regnum); +-} +- +-static int +-qca8k_phy_write(struct dsa_switch *ds, int phy, int regnum, u16 val) +-{ +- struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv; +- +- return mdiobus_write(priv->bus, phy, regnum, val); +-} +- + static void + qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data) + { +@@ -876,8 +860,6 @@ static const struct dsa_switch_ops qca8k_switch_ops = { + .setup = qca8k_setup, + .adjust_link = qca8k_adjust_link, + .get_strings = qca8k_get_strings, +- .phy_read = qca8k_phy_read, +- .phy_write = qca8k_phy_write, + .get_ethtool_stats = qca8k_get_ethtool_stats, + .get_sset_count = qca8k_get_sset_count, + .get_mac_eee = qca8k_get_mac_eee, +diff --git a/drivers/net/ethernet/8390/mac8390.c b/drivers/net/ethernet/8390/mac8390.c +index 342ae08ec3c2..d60a86aa8aa8 100644 +--- a/drivers/net/ethernet/8390/mac8390.c ++++ b/drivers/net/ethernet/8390/mac8390.c +@@ -153,8 +153,6 @@ static void dayna_block_input(struct net_device *dev, int count, + static void dayna_block_output(struct net_device *dev, int count, + const unsigned char *buf, int start_page); + +-#define memcmp_withio(a, b, c) memcmp((a), (void *)(b), (c)) +- + /* Slow Sane (16-bit chunk memory read/write) Cabletron uses this */ + static void slow_sane_get_8390_hdr(struct net_device *dev, + struct e8390_pkt_hdr *hdr, int ring_page); +@@ -233,19 +231,26 @@ static enum mac8390_type mac8390_ident(struct nubus_rsrc *fres) + + static enum mac8390_access mac8390_testio(unsigned long membase) + { +- unsigned long outdata = 0xA5A0B5B0; +- unsigned long indata = 0x00000000; ++ u32 outdata = 0xA5A0B5B0; ++ u32 indata = 0; ++ + /* Try writing 32 bits */ +- memcpy_toio((void __iomem *)membase, &outdata, 4); +- /* Now compare them */ +- if (memcmp_withio(&outdata, membase, 4) == 0) ++ nubus_writel(outdata, membase); ++ /* Now read it back */ ++ indata = nubus_readl(membase); ++ if (outdata == indata) + return ACCESS_32; ++ ++ outdata = 0xC5C0D5D0; ++ indata = 0; ++ + /* Write 16 bit output */ + word_memcpy_tocard(membase, &outdata, 4); + /* Now read it back */ + word_memcpy_fromcard(&indata, membase, 4); + if (outdata == indata) + return ACCESS_16; ++ + return ACCESS_UNKNOWN; + } + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index 7134d0d4cdf7..6f3312350cac 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -186,11 +186,12 @@ static void aq_rx_checksum(struct aq_ring_s *self, + } + if (buff->is_ip_cso) { + __skb_incr_checksum_unnecessary(skb); +- if (buff->is_udp_cso || buff->is_tcp_cso) +- __skb_incr_checksum_unnecessary(skb); + } else { + skb->ip_summed = CHECKSUM_NONE; + } ++ ++ if (buff->is_udp_cso || buff->is_tcp_cso) ++ __skb_incr_checksum_unnecessary(skb); + } + + #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +index fcaf18fa3904..9a4cfa61ed93 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +@@ -105,20 +105,19 @@ static inline struct pgcache *nicvf_alloc_page(struct nicvf *nic, + /* Check if page can be recycled */ + if (page) { + ref_count = page_ref_count(page); +- /* Check if this page has been used once i.e 'put_page' +- * called after packet transmission i.e internal ref_count +- * and page's ref_count are equal i.e page can be recycled. ++ /* This page can be recycled if internal ref_count and page's ++ * ref_count are equal, indicating that the page has been used ++ * once for packet transmission. For non-XDP mode, internal ++ * ref_count is always '1'. + */ +- if (rbdr->is_xdp && (ref_count == pgcache->ref_count)) +- pgcache->ref_count--; +- else +- page = NULL; +- +- /* In non-XDP mode, page's ref_count needs to be '1' for it +- * to be recycled. +- */ +- if (!rbdr->is_xdp && (ref_count != 1)) ++ if (rbdr->is_xdp) { ++ if (ref_count == pgcache->ref_count) ++ pgcache->ref_count--; ++ else ++ page = NULL; ++ } else if (ref_count != 1) { + page = NULL; ++ } + } + + if (!page) { +@@ -365,11 +364,10 @@ static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr) + while (head < rbdr->pgcnt) { + pgcache = &rbdr->pgcache[head]; + if (pgcache->page && page_ref_count(pgcache->page) != 0) { +- if (!rbdr->is_xdp) { +- put_page(pgcache->page); +- continue; ++ if (rbdr->is_xdp) { ++ page_ref_sub(pgcache->page, ++ pgcache->ref_count - 1); + } +- page_ref_sub(pgcache->page, pgcache->ref_count - 1); + put_page(pgcache->page); + } + head++; +diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c +index bc83ced94e1b..afed0f0f4027 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c ++++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c +@@ -111,10 +111,11 @@ static unsigned int is_jumbo_frm(int len, int enh_desc) + + static void refill_desc3(void *priv_ptr, struct dma_desc *p) + { +- struct stmmac_priv *priv = (struct stmmac_priv *)priv_ptr; ++ struct stmmac_rx_queue *rx_q = priv_ptr; ++ struct stmmac_priv *priv = rx_q->priv_data; + + /* Fill DES3 in case of RING mode */ +- if (priv->dma_buf_sz >= BUF_SIZE_8KiB) ++ if (priv->dma_buf_sz == BUF_SIZE_16KiB) + p->des3 = cpu_to_le32(le32_to_cpu(p->des2) + BUF_SIZE_8KiB); + } + +diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c +index ddc2c5ea3787..7ceebbc4bcc2 100644 +--- a/drivers/net/phy/meson-gxl.c ++++ b/drivers/net/phy/meson-gxl.c +@@ -211,6 +211,7 @@ static int meson_gxl_ack_interrupt(struct phy_device *phydev) + static int meson_gxl_config_intr(struct phy_device *phydev) + { + u16 val; ++ int ret; + + if (phydev->interrupts == PHY_INTERRUPT_ENABLED) { + val = INTSRC_ANEG_PR +@@ -223,6 +224,11 @@ static int meson_gxl_config_intr(struct phy_device *phydev) + val = 0; + } + ++ /* Ack any pending IRQ */ ++ ret = meson_gxl_ack_interrupt(phydev); ++ if (ret) ++ return ret; ++ + return phy_write(phydev, INTSRC_MASK, val); + } + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index f3293355c784..044d5c3a4d04 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1718,9 +1718,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, + int skb_xdp = 1; + bool frags = tun_napi_frags_enabled(tfile); + +- if (!(tun->dev->flags & IFF_UP)) +- return -EIO; +- + if (!(tun->flags & IFF_NO_PI)) { + if (len < sizeof(pi)) + return -EINVAL; +@@ -1822,6 +1819,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, + err = skb_copy_datagram_from_iter(skb, 0, from, len); + + if (err) { ++ err = -EFAULT; ++drop: + this_cpu_inc(tun->pcpu_stats->rx_dropped); + kfree_skb(skb); + if (frags) { +@@ -1829,7 +1828,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, + mutex_unlock(&tfile->napi_mutex); + } + +- return -EFAULT; ++ return err; + } + } + +@@ -1913,6 +1912,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, + !tfile->detached) + rxhash = __skb_get_hash_symmetric(skb); + ++ rcu_read_lock(); ++ if (unlikely(!(tun->dev->flags & IFF_UP))) { ++ err = -EIO; ++ rcu_read_unlock(); ++ goto drop; ++ } ++ + if (frags) { + /* Exercise flow dissector code path. */ + u32 headlen = eth_get_headlen(skb->data, skb_headlen(skb)); +@@ -1920,6 +1926,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, + if (unlikely(headlen > skb_headlen(skb))) { + this_cpu_inc(tun->pcpu_stats->rx_dropped); + napi_free_frags(&tfile->napi); ++ rcu_read_unlock(); + mutex_unlock(&tfile->napi_mutex); + WARN_ON(1); + return -ENOMEM; +@@ -1947,6 +1954,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, + } else { + netif_rx_ni(skb); + } ++ rcu_read_unlock(); + + stats = get_cpu_ptr(tun->pcpu_stats); + u64_stats_update_begin(&stats->syncp); +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index f93547f257fb..449fc52f9a89 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -1262,6 +1262,7 @@ static void vrf_setup(struct net_device *dev) + + /* default to no qdisc; user can add if desired */ + dev->priv_flags |= IFF_NO_QUEUE; ++ dev->priv_flags |= IFF_NO_RX_HANDLER; + } + + static int vrf_validate(struct nlattr *tb[], struct nlattr *data[], +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 52387f7f12ed..0b1ec44acbf9 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3798,10 +3798,8 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head) + /* If vxlan->dev is in the same netns, it has already been added + * to the list by the previous loop. + */ +- if (!net_eq(dev_net(vxlan->dev), net)) { +- gro_cells_destroy(&vxlan->gro_cells); ++ if (!net_eq(dev_net(vxlan->dev), net)) + unregister_netdevice_queue(vxlan->dev, head); +- } + } + + for (h = 0; h < PORT_HASH_SIZE; ++h) +diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c +index 881078ff73f6..15c8fc2abf01 100644 +--- a/drivers/phy/allwinner/phy-sun4i-usb.c ++++ b/drivers/phy/allwinner/phy-sun4i-usb.c +@@ -481,8 +481,11 @@ static int sun4i_usb_phy_set_mode(struct phy *_phy, enum phy_mode mode) + struct sun4i_usb_phy_data *data = to_sun4i_usb_phy_data(phy); + int new_mode; + +- if (phy->index != 0) ++ if (phy->index != 0) { ++ if (mode == PHY_MODE_USB_HOST) ++ return 0; + return -EINVAL; ++ } + + switch (mode) { + case PHY_MODE_USB_HOST: +diff --git a/drivers/platform/x86/intel_cht_int33fe.c b/drivers/platform/x86/intel_cht_int33fe.c +index 39d4100c60a2..a26f410800c2 100644 +--- a/drivers/platform/x86/intel_cht_int33fe.c ++++ b/drivers/platform/x86/intel_cht_int33fe.c +@@ -34,7 +34,7 @@ struct cht_int33fe_data { + struct i2c_client *fusb302; + struct i2c_client *pi3usb30532; + /* Contain a list-head must be per device */ +- struct device_connection connections[3]; ++ struct device_connection connections[5]; + }; + + /* +@@ -174,19 +174,20 @@ static int cht_int33fe_probe(struct i2c_client *client) + return -EPROBE_DEFER; /* Wait for i2c-adapter to load */ + } + +- data->connections[0].endpoint[0] = "i2c-fusb302"; ++ data->connections[0].endpoint[0] = "port0"; + data->connections[0].endpoint[1] = "i2c-pi3usb30532"; + data->connections[0].id = "typec-switch"; +- data->connections[1].endpoint[0] = "i2c-fusb302"; ++ data->connections[1].endpoint[0] = "port0"; + data->connections[1].endpoint[1] = "i2c-pi3usb30532"; + data->connections[1].id = "typec-mux"; +- data->connections[2].endpoint[0] = "i2c-fusb302"; +- data->connections[2].endpoint[1] = "intel_xhci_usb_sw-role-switch"; +- data->connections[2].id = "usb-role-switch"; ++ data->connections[2].endpoint[0] = "port0"; ++ data->connections[2].endpoint[1] = "i2c-pi3usb30532"; ++ data->connections[2].id = "idff01m01"; ++ data->connections[3].endpoint[0] = "i2c-fusb302"; ++ data->connections[3].endpoint[1] = "intel_xhci_usb_sw-role-switch"; ++ data->connections[3].id = "usb-role-switch"; + +- device_connection_add(&data->connections[0]); +- device_connection_add(&data->connections[1]); +- device_connection_add(&data->connections[2]); ++ device_connections_add(data->connections); + + memset(&board_info, 0, sizeof(board_info)); + strlcpy(board_info.type, "typec_fusb302", I2C_NAME_SIZE); +@@ -217,9 +218,7 @@ out_unregister_max17047: + if (data->max17047) + i2c_unregister_device(data->max17047); + +- device_connection_remove(&data->connections[2]); +- device_connection_remove(&data->connections[1]); +- device_connection_remove(&data->connections[0]); ++ device_connections_remove(data->connections); + + return -EPROBE_DEFER; /* Wait for the i2c-adapter to load */ + } +@@ -233,9 +232,7 @@ static int cht_int33fe_remove(struct i2c_client *i2c) + if (data->max17047) + i2c_unregister_device(data->max17047); + +- device_connection_remove(&data->connections[2]); +- device_connection_remove(&data->connections[1]); +- device_connection_remove(&data->connections[0]); ++ device_connections_remove(data->connections); + + return 0; + } +diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c +index f47d16b5810b..fabd9798e4c4 100644 +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -72,20 +72,24 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) + { + struct vfio_ccw_private *private; + struct irb *irb; ++ bool is_final; + + private = container_of(work, struct vfio_ccw_private, io_work); + irb = &private->irb; + ++ is_final = !(scsw_actl(&irb->scsw) & ++ (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); + if (scsw_is_solicited(&irb->scsw)) { + cp_update_scsw(&private->cp, &irb->scsw); +- cp_free(&private->cp); ++ if (is_final) ++ cp_free(&private->cp); + } + memcpy(private->io_region->irb_area, irb, sizeof(*irb)); + + if (private->io_trigger) + eventfd_signal(private->io_trigger, 1); + +- if (private->mdev) ++ if (private->mdev && is_final) + private->state = VFIO_CCW_STATE_IDLE; + } + +diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c +index e7e6b63905e2..ebdbc457003f 100644 +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -643,6 +643,20 @@ static void zfcp_erp_strategy_memwait(struct zfcp_erp_action *erp_action) + add_timer(&erp_action->timer); + } + ++void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter, ++ int clear, char *dbftag) ++{ ++ unsigned long flags; ++ struct zfcp_port *port; ++ ++ write_lock_irqsave(&adapter->erp_lock, flags); ++ read_lock(&adapter->port_list_lock); ++ list_for_each_entry(port, &adapter->port_list, list) ++ _zfcp_erp_port_forced_reopen(port, clear, dbftag); ++ read_unlock(&adapter->port_list_lock); ++ write_unlock_irqrestore(&adapter->erp_lock, flags); ++} ++ + static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter, + int clear, char *id) + { +@@ -1297,6 +1311,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port *port) + struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev); + int lun_status; + ++ if (sdev->sdev_state == SDEV_DEL || ++ sdev->sdev_state == SDEV_CANCEL) ++ continue; + if (zsdev->port != port) + continue; + /* LUN under port of interest */ +diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h +index bd0c5a9f04cb..1b4d6a3afb8f 100644 +--- a/drivers/s390/scsi/zfcp_ext.h ++++ b/drivers/s390/scsi/zfcp_ext.h +@@ -69,6 +69,8 @@ extern void zfcp_erp_clear_port_status(struct zfcp_port *, u32); + extern void zfcp_erp_port_reopen(struct zfcp_port *port, int clear, char *id); + extern void zfcp_erp_port_shutdown(struct zfcp_port *, int, char *); + extern void zfcp_erp_port_forced_reopen(struct zfcp_port *, int, char *); ++extern void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter, ++ int clear, char *dbftag); + extern void zfcp_erp_set_lun_status(struct scsi_device *, u32); + extern void zfcp_erp_clear_lun_status(struct scsi_device *, u32); + extern void zfcp_erp_lun_reopen(struct scsi_device *, int, char *); +diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c +index a8efcb330bc1..a4bbfa4ef653 100644 +--- a/drivers/s390/scsi/zfcp_scsi.c ++++ b/drivers/s390/scsi/zfcp_scsi.c +@@ -362,6 +362,10 @@ static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt) + struct zfcp_adapter *adapter = zfcp_sdev->port->adapter; + int ret = SUCCESS, fc_ret; + ++ if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE)) { ++ zfcp_erp_port_forced_reopen_all(adapter, 0, "schrh_p"); ++ zfcp_erp_wait(adapter); ++ } + zfcp_erp_adapter_reopen(adapter, 0, "schrh_1"); + zfcp_erp_wait(adapter); + fc_ret = fc_block_scsi_eh(scpnt); +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index a3a5162fa60e..e925eda93191 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1408,11 +1408,6 @@ static void sd_release(struct gendisk *disk, fmode_t mode) + scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW); + } + +- /* +- * XXX and what if there are packets in flight and this close() +- * XXX is followed by a "rmmod sd_mod"? +- */ +- + scsi_disk_put(sdkp); + } + +@@ -3078,6 +3073,9 @@ static bool sd_validate_opt_xfer_size(struct scsi_disk *sdkp, + unsigned int opt_xfer_bytes = + logical_to_bytes(sdp, sdkp->opt_xfer_blocks); + ++ if (sdkp->opt_xfer_blocks == 0) ++ return false; ++ + if (sdkp->opt_xfer_blocks > dev_max) { + sd_first_printk(KERN_WARNING, sdkp, + "Optimal transfer size %u logical blocks " \ +@@ -3509,9 +3507,21 @@ static void scsi_disk_release(struct device *dev) + { + struct scsi_disk *sdkp = to_scsi_disk(dev); + struct gendisk *disk = sdkp->disk; +- ++ struct request_queue *q = disk->queue; ++ + ida_free(&sd_index_ida, sdkp->index); + ++ /* ++ * Wait until all requests that are in progress have completed. ++ * This is necessary to avoid that e.g. scsi_end_request() crashes ++ * due to clearing the disk->private_data pointer. Wait from inside ++ * scsi_disk_release() instead of from sd_release() to avoid that ++ * freezing and unfreezing the request queue affects user space I/O ++ * in case multiple processes open a /dev/sd... node concurrently. ++ */ ++ blk_mq_freeze_queue(q); ++ blk_mq_unfreeze_queue(q); ++ + disk->private_data = NULL; + put_disk(disk); + put_device(&sdkp->device->sdev_gendev); +diff --git a/drivers/staging/comedi/comedidev.h b/drivers/staging/comedi/comedidev.h +index 5775a93917f4..fbbdf4b0f6c5 100644 +--- a/drivers/staging/comedi/comedidev.h ++++ b/drivers/staging/comedi/comedidev.h +@@ -987,6 +987,8 @@ int comedi_dio_insn_config(struct comedi_device *dev, + unsigned int mask); + unsigned int comedi_dio_update_state(struct comedi_subdevice *s, + unsigned int *data); ++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, ++ struct comedi_cmd *cmd); + unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s); + unsigned int comedi_nscans_left(struct comedi_subdevice *s, + unsigned int nscans); +diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c +index 57dd63d548b7..5329a3955214 100644 +--- a/drivers/staging/comedi/drivers.c ++++ b/drivers/staging/comedi/drivers.c +@@ -381,11 +381,13 @@ unsigned int comedi_dio_update_state(struct comedi_subdevice *s, + EXPORT_SYMBOL_GPL(comedi_dio_update_state); + + /** +- * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes ++ * comedi_bytes_per_scan_cmd() - Get length of asynchronous command "scan" in ++ * bytes + * @s: COMEDI subdevice. ++ * @cmd: COMEDI command. + * + * Determines the overall scan length according to the subdevice type and the +- * number of channels in the scan. ++ * number of channels in the scan for the specified command. + * + * For digital input, output or input/output subdevices, samples for + * multiple channels are assumed to be packed into one or more unsigned +@@ -395,9 +397,9 @@ EXPORT_SYMBOL_GPL(comedi_dio_update_state); + * + * Returns the overall scan length in bytes. + */ +-unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) ++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, ++ struct comedi_cmd *cmd) + { +- struct comedi_cmd *cmd = &s->async->cmd; + unsigned int num_samples; + unsigned int bits_per_sample; + +@@ -414,6 +416,29 @@ unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) + } + return comedi_samples_to_bytes(s, num_samples); + } ++EXPORT_SYMBOL_GPL(comedi_bytes_per_scan_cmd); ++ ++/** ++ * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes ++ * @s: COMEDI subdevice. ++ * ++ * Determines the overall scan length according to the subdevice type and the ++ * number of channels in the scan for the current command. ++ * ++ * For digital input, output or input/output subdevices, samples for ++ * multiple channels are assumed to be packed into one or more unsigned ++ * short or unsigned int values according to the subdevice's %SDF_LSAMPL ++ * flag. For other types of subdevice, samples are assumed to occupy a ++ * whole unsigned short or unsigned int according to the %SDF_LSAMPL flag. ++ * ++ * Returns the overall scan length in bytes. ++ */ ++unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) ++{ ++ struct comedi_cmd *cmd = &s->async->cmd; ++ ++ return comedi_bytes_per_scan_cmd(s, cmd); ++} + EXPORT_SYMBOL_GPL(comedi_bytes_per_scan); + + static unsigned int __comedi_nscans_left(struct comedi_subdevice *s, +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index 4dee2fc37aed..d799b1b55de3 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -3516,6 +3516,7 @@ static int ni_cdio_check_chanlist(struct comedi_device *dev, + static int ni_cdio_cmdtest(struct comedi_device *dev, + struct comedi_subdevice *s, struct comedi_cmd *cmd) + { ++ unsigned int bytes_per_scan; + int err = 0; + int tmp; + +@@ -3545,9 +3546,12 @@ static int ni_cdio_cmdtest(struct comedi_device *dev, + err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0); + err |= comedi_check_trigger_arg_is(&cmd->scan_end_arg, + cmd->chanlist_len); +- err |= comedi_check_trigger_arg_max(&cmd->stop_arg, +- s->async->prealloc_bufsz / +- comedi_bytes_per_scan(s)); ++ bytes_per_scan = comedi_bytes_per_scan_cmd(s, cmd); ++ if (bytes_per_scan) { ++ err |= comedi_check_trigger_arg_max(&cmd->stop_arg, ++ s->async->prealloc_bufsz / ++ bytes_per_scan); ++ } + + if (err) + return 3; +diff --git a/drivers/staging/erofs/dir.c b/drivers/staging/erofs/dir.c +index 04b84ff31d03..0a089cf5c78f 100644 +--- a/drivers/staging/erofs/dir.c ++++ b/drivers/staging/erofs/dir.c +@@ -23,6 +23,21 @@ static const unsigned char erofs_filetype_table[EROFS_FT_MAX] = { + [EROFS_FT_SYMLINK] = DT_LNK, + }; + ++static void debug_one_dentry(unsigned char d_type, const char *de_name, ++ unsigned int de_namelen) ++{ ++#ifdef CONFIG_EROFS_FS_DEBUG ++ /* since the on-disk name could not have the trailing '\0' */ ++ unsigned char dbg_namebuf[EROFS_NAME_LEN + 1]; ++ ++ memcpy(dbg_namebuf, de_name, de_namelen); ++ dbg_namebuf[de_namelen] = '\0'; ++ ++ debugln("found dirent %s de_len %u d_type %d", dbg_namebuf, ++ de_namelen, d_type); ++#endif ++} ++ + static int erofs_fill_dentries(struct dir_context *ctx, + void *dentry_blk, unsigned *ofs, + unsigned nameoff, unsigned maxsize) +@@ -33,14 +48,10 @@ static int erofs_fill_dentries(struct dir_context *ctx, + de = dentry_blk + *ofs; + while (de < end) { + const char *de_name; +- int de_namelen; ++ unsigned int de_namelen; + unsigned char d_type; +-#ifdef CONFIG_EROFS_FS_DEBUG +- unsigned dbg_namelen; +- unsigned char dbg_namebuf[EROFS_NAME_LEN]; +-#endif + +- if (unlikely(de->file_type < EROFS_FT_MAX)) ++ if (de->file_type < EROFS_FT_MAX) + d_type = erofs_filetype_table[de->file_type]; + else + d_type = DT_UNKNOWN; +@@ -48,26 +59,20 @@ static int erofs_fill_dentries(struct dir_context *ctx, + nameoff = le16_to_cpu(de->nameoff); + de_name = (char *)dentry_blk + nameoff; + +- de_namelen = unlikely(de + 1 >= end) ? +- /* last directory entry */ +- strnlen(de_name, maxsize - nameoff) : +- le16_to_cpu(de[1].nameoff) - nameoff; ++ /* the last dirent in the block? */ ++ if (de + 1 >= end) ++ de_namelen = strnlen(de_name, maxsize - nameoff); ++ else ++ de_namelen = le16_to_cpu(de[1].nameoff) - nameoff; + + /* a corrupted entry is found */ +- if (unlikely(de_namelen < 0)) { ++ if (unlikely(nameoff + de_namelen > maxsize || ++ de_namelen > EROFS_NAME_LEN)) { + DBG_BUGON(1); + return -EIO; + } + +-#ifdef CONFIG_EROFS_FS_DEBUG +- dbg_namelen = min(EROFS_NAME_LEN - 1, de_namelen); +- memcpy(dbg_namebuf, de_name, dbg_namelen); +- dbg_namebuf[dbg_namelen] = '\0'; +- +- debugln("%s, found de_name %s de_len %d d_type %d", __func__, +- dbg_namebuf, de_namelen, d_type); +-#endif +- ++ debug_one_dentry(d_type, de_name, de_namelen); + if (!dir_emit(ctx, de_name, de_namelen, + le64_to_cpu(de->nid), d_type)) + /* stoped by some reason */ +diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c +index f44662dd795c..ad6fe6d9d00a 100644 +--- a/drivers/staging/erofs/unzip_vle.c ++++ b/drivers/staging/erofs/unzip_vle.c +@@ -885,6 +885,7 @@ repeat: + overlapped = false; + compressed_pages = grp->compressed_pages; + ++ err = 0; + for (i = 0; i < clusterpages; ++i) { + unsigned pagenr; + +@@ -894,26 +895,39 @@ repeat: + DBG_BUGON(page == NULL); + DBG_BUGON(page->mapping == NULL); + +- if (z_erofs_is_stagingpage(page)) +- continue; ++ if (!z_erofs_is_stagingpage(page)) { + #ifdef EROFS_FS_HAS_MANAGED_CACHE +- if (page->mapping == mngda) { +- DBG_BUGON(!PageUptodate(page)); +- continue; +- } ++ if (page->mapping == mngda) { ++ if (unlikely(!PageUptodate(page))) ++ err = -EIO; ++ continue; ++ } + #endif + +- /* only non-head page could be reused as a compressed page */ +- pagenr = z_erofs_onlinepage_index(page); ++ /* ++ * only if non-head page can be selected ++ * for inplace decompression ++ */ ++ pagenr = z_erofs_onlinepage_index(page); + +- DBG_BUGON(pagenr >= nr_pages); +- DBG_BUGON(pages[pagenr]); +- ++sparsemem_pages; +- pages[pagenr] = page; ++ DBG_BUGON(pagenr >= nr_pages); ++ DBG_BUGON(pages[pagenr]); ++ ++sparsemem_pages; ++ pages[pagenr] = page; + +- overlapped = true; ++ overlapped = true; ++ } ++ ++ /* PG_error needs checking for inplaced and staging pages */ ++ if (unlikely(PageError(page))) { ++ DBG_BUGON(PageUptodate(page)); ++ err = -EIO; ++ } + } + ++ if (unlikely(err)) ++ goto out; ++ + llen = (nr_pages << PAGE_SHIFT) - work->pageofs; + + if (z_erofs_vle_workgrp_fmt(grp) == Z_EROFS_VLE_WORKGRP_FMT_PLAIN) { +@@ -942,6 +956,10 @@ repeat: + + skip_allocpage: + vout = erofs_vmap(pages, nr_pages); ++ if (!vout) { ++ err = -ENOMEM; ++ goto out; ++ } + + err = z_erofs_vle_unzip_vmap(compressed_pages, + clusterpages, vout, llen, work->pageofs, overlapped); +@@ -1078,6 +1096,8 @@ static inline bool recover_managed_page(struct z_erofs_vle_workgroup *grp, + return true; + + lock_page(page); ++ ClearPageError(page); ++ + if (unlikely(!PagePrivate(page))) { + set_page_private(page, (unsigned long)grp); + SetPagePrivate(page); +diff --git a/drivers/staging/erofs/unzip_vle_lz4.c b/drivers/staging/erofs/unzip_vle_lz4.c +index 055420e8af2c..3a7428317f0a 100644 +--- a/drivers/staging/erofs/unzip_vle_lz4.c ++++ b/drivers/staging/erofs/unzip_vle_lz4.c +@@ -116,10 +116,13 @@ int z_erofs_vle_unzip_fast_percpu(struct page **compressed_pages, + + nr_pages = DIV_ROUND_UP(outlen + pageofs, PAGE_SIZE); + +- if (clusterpages == 1) ++ if (clusterpages == 1) { + vin = kmap_atomic(compressed_pages[0]); +- else ++ } else { + vin = erofs_vmap(compressed_pages, clusterpages); ++ if (!vin) ++ return -ENOMEM; ++ } + + preempt_disable(); + vout = erofs_pcpubuf[smp_processor_id()].data; +diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c +index 947c79532e10..d5383974d40e 100644 +--- a/drivers/staging/speakup/speakup_soft.c ++++ b/drivers/staging/speakup/speakup_soft.c +@@ -208,12 +208,15 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count, + return -EINVAL; + + spin_lock_irqsave(&speakup_info.spinlock, flags); ++ synth_soft.alive = 1; + while (1) { + prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE); +- if (!unicode) +- synth_buffer_skip_nonlatin1(); +- if (!synth_buffer_empty() || speakup_info.flushing) +- break; ++ if (synth_current() == &synth_soft) { ++ if (!unicode) ++ synth_buffer_skip_nonlatin1(); ++ if (!synth_buffer_empty() || speakup_info.flushing) ++ break; ++ } + spin_unlock_irqrestore(&speakup_info.spinlock, flags); + if (fp->f_flags & O_NONBLOCK) { + finish_wait(&speakup_event, &wait); +@@ -233,6 +236,8 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count, + + /* Keep 3 bytes available for a 16bit UTF-8-encoded character */ + while (chars_sent <= count - bytes_per_ch) { ++ if (synth_current() != &synth_soft) ++ break; + if (speakup_info.flushing) { + speakup_info.flushing = 0; + ch = '\x18'; +@@ -329,7 +334,8 @@ static __poll_t softsynth_poll(struct file *fp, struct poll_table_struct *wait) + poll_wait(fp, &speakup_event, wait); + + spin_lock_irqsave(&speakup_info.spinlock, flags); +- if (!synth_buffer_empty() || speakup_info.flushing) ++ if (synth_current() == &synth_soft && ++ (!synth_buffer_empty() || speakup_info.flushing)) + ret = EPOLLIN | EPOLLRDNORM; + spin_unlock_irqrestore(&speakup_info.spinlock, flags); + return ret; +diff --git a/drivers/staging/speakup/spk_priv.h b/drivers/staging/speakup/spk_priv.h +index 7b3a16e1fa23..796ffcca43c1 100644 +--- a/drivers/staging/speakup/spk_priv.h ++++ b/drivers/staging/speakup/spk_priv.h +@@ -72,6 +72,7 @@ int synth_request_region(unsigned long start, unsigned long n); + int synth_release_region(unsigned long start, unsigned long n); + int synth_add(struct spk_synth *in_synth); + void synth_remove(struct spk_synth *in_synth); ++struct spk_synth *synth_current(void); + + extern struct speakup_info_t speakup_info; + +diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c +index 25f259ee4ffc..3568bfb89912 100644 +--- a/drivers/staging/speakup/synth.c ++++ b/drivers/staging/speakup/synth.c +@@ -481,4 +481,10 @@ void synth_remove(struct spk_synth *in_synth) + } + EXPORT_SYMBOL_GPL(synth_remove); + ++struct spk_synth *synth_current(void) ++{ ++ return synth; ++} ++EXPORT_SYMBOL_GPL(synth_current); ++ + short spk_punc_masks[] = { 0, SOME, MOST, PUNC, PUNC | B_SYM }; +diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c +index 1ab0e8562d40..607804aa560d 100644 +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1040,8 +1040,6 @@ static void vnt_interrupt_process(struct vnt_private *priv) + return; + } + +- MACvIntDisable(priv->PortOffset); +- + spin_lock_irqsave(&priv->lock, flags); + + /* Read low level stats */ +@@ -1129,8 +1127,6 @@ static void vnt_interrupt_process(struct vnt_private *priv) + } + + spin_unlock_irqrestore(&priv->lock, flags); +- +- MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); + } + + static void vnt_interrupt_work(struct work_struct *work) +@@ -1140,14 +1136,17 @@ static void vnt_interrupt_work(struct work_struct *work) + + if (priv->vif) + vnt_interrupt_process(priv); ++ ++ MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); + } + + static irqreturn_t vnt_interrupt(int irq, void *arg) + { + struct vnt_private *priv = arg; + +- if (priv->vif) +- schedule_work(&priv->interrupt_work); ++ schedule_work(&priv->interrupt_work); ++ ++ MACvIntDisable(priv->PortOffset); + + return IRQ_HANDLED; + } +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 8e4428725848..bfdd5ad4116f 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1156,6 +1156,10 @@ static int atmel_prepare_rx_dma(struct uart_port *port) + sg_dma_len(&atmel_port->sg_rx)/2, + DMA_DEV_TO_MEM, + DMA_PREP_INTERRUPT); ++ if (!desc) { ++ dev_err(port->dev, "Preparing DMA cyclic failed\n"); ++ goto chan_err; ++ } + desc->callback = atmel_complete_rx_dma; + desc->callback_param = port; + atmel_port->desc_rx = desc; +diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c +index 93d3a0ec5e11..b0aa864f84a9 100644 +--- a/drivers/tty/serial/kgdboc.c ++++ b/drivers/tty/serial/kgdboc.c +@@ -145,8 +145,10 @@ static int configure_kgdboc(void) + char *cptr = config; + struct console *cons; + +- if (!strlen(config) || isspace(config[0])) ++ if (!strlen(config) || isspace(config[0])) { ++ err = 0; + goto noconfig; ++ } + + kgdboc_io_ops.is_console = 0; + kgdb_tty_driver = NULL; +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 3db48fcd6068..4c4070a202fb 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1419,6 +1419,8 @@ static int max310x_spi_probe(struct spi_device *spi) + if (spi->dev.of_node) { + const struct of_device_id *of_id = + of_match_device(max310x_dt_ids, &spi->dev); ++ if (!of_id) ++ return -ENODEV; + + devtype = (struct max310x_devtype *)of_id->data; + } else { +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index 170e446a2f62..7d26c9b57d8e 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -799,6 +799,9 @@ static int mvebu_uart_probe(struct platform_device *pdev) + return -EINVAL; + } + ++ if (!match) ++ return -ENODEV; ++ + /* Assume that all UART ports have a DT alias or none has */ + id = of_alias_get_id(pdev->dev.of_node, "serial"); + if (!pdev->dev.of_node || id < 0) +diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c +index 76aa289652f7..34acdf29713d 100644 +--- a/drivers/tty/serial/mxs-auart.c ++++ b/drivers/tty/serial/mxs-auart.c +@@ -1685,6 +1685,10 @@ static int mxs_auart_probe(struct platform_device *pdev) + + s->port.mapbase = r->start; + s->port.membase = ioremap(r->start, resource_size(r)); ++ if (!s->port.membase) { ++ ret = -ENOMEM; ++ goto out_disable_clks; ++ } + s->port.ops = &mxs_auart_ops; + s->port.iotype = UPIO_MEM; + s->port.fifosize = MXS_AUART_FIFO_SIZE; +diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c +index 35d1f6fa0e3c..5b96df4ad5b3 100644 +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -1052,7 +1052,7 @@ static int __init qcom_geni_console_setup(struct console *co, char *options) + { + struct uart_port *uport; + struct qcom_geni_serial_port *port; +- int baud; ++ int baud = 9600; + int bits = 8; + int parity = 'n'; + int flow = 'n'; +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 859b173e3b82..cbbf239aea0f 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -838,19 +838,9 @@ static void sci_transmit_chars(struct uart_port *port) + + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); +- if (uart_circ_empty(xmit)) { ++ if (uart_circ_empty(xmit)) + sci_stop_tx(port); +- } else { +- ctrl = serial_port_in(port, SCSCR); +- +- if (port->type != PORT_SCI) { +- serial_port_in(port, SCxSR); /* Dummy read */ +- sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port)); +- } + +- ctrl |= SCSCR_TIE; +- serial_port_out(port, SCSCR, ctrl); +- } + } + + /* On SH3, SCIF may read end-of-break as a space->mark char */ +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 08b8aa5299b5..32da5a4182ac 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -558,10 +558,8 @@ static void acm_softint(struct work_struct *work) + clear_bit(EVENT_RX_STALL, &acm->flags); + } + +- if (test_bit(EVENT_TTY_WAKEUP, &acm->flags)) { ++ if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags)) + tty_port_tty_wakeup(&acm->port); +- clear_bit(EVENT_TTY_WAKEUP, &acm->flags); +- } + } + + /* +diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c +index 48277bbc15e4..73c8e6591746 100644 +--- a/drivers/usb/common/common.c ++++ b/drivers/usb/common/common.c +@@ -145,6 +145,8 @@ enum usb_dr_mode of_usb_get_dr_mode_by_phy(struct device_node *np, int arg0) + + do { + controller = of_find_node_with_property(controller, "phys"); ++ if (!of_device_is_available(controller)) ++ continue; + index = 0; + do { + if (arg0 == -1) { +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index 54e859dcb25c..492bb44153b3 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -391,20 +391,20 @@ try_again: + req->complete = f_hidg_req_complete; + req->context = hidg; + ++ spin_unlock_irqrestore(&hidg->write_spinlock, flags); ++ + status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC); + if (status < 0) { + ERROR(hidg->func.config->cdev, + "usb_ep_queue error on int endpoint %zd\n", status); +- goto release_write_pending_unlocked; ++ goto release_write_pending; + } else { + status = count; + } +- spin_unlock_irqrestore(&hidg->write_spinlock, flags); + + return status; + release_write_pending: + spin_lock_irqsave(&hidg->write_spinlock, flags); +-release_write_pending_unlocked: + hidg->write_pending = 0; + spin_unlock_irqrestore(&hidg->write_spinlock, flags); + +diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c +index 86cff5c28eff..ba841c569c48 100644 +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -516,7 +516,6 @@ static int xhci_do_dbc_stop(struct xhci_hcd *xhci) + return -1; + + writel(0, &dbc->regs->control); +- xhci_dbc_mem_cleanup(xhci); + dbc->state = DS_DISABLED; + + return 0; +@@ -562,8 +561,10 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci) + ret = xhci_do_dbc_stop(xhci); + spin_unlock_irqrestore(&dbc->lock, flags); + +- if (!ret) ++ if (!ret) { ++ xhci_dbc_mem_cleanup(xhci); + pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller); ++ } + } + + static void +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 01b5818a4be5..333f9202ec8b 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1501,20 +1501,25 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + port_index = max_ports; + while (port_index--) { + u32 t1, t2; +- ++ int retries = 10; ++retry: + t1 = readl(ports[port_index]->addr); + t2 = xhci_port_state_to_neutral(t1); + portsc_buf[port_index] = 0; + +- /* Bail out if a USB3 port has a new device in link training */ +- if ((hcd->speed >= HCD_USB3) && ++ /* ++ * Give a USB3 port in link training time to finish, but don't ++ * prevent suspend as port might be stuck ++ */ ++ if ((hcd->speed >= HCD_USB3) && retries-- && + (t1 & PORT_PLS_MASK) == XDEV_POLLING) { +- bus_state->bus_suspended = 0; + spin_unlock_irqrestore(&xhci->lock, flags); +- xhci_dbg(xhci, "Bus suspend bailout, port in polling\n"); +- return -EBUSY; ++ msleep(XHCI_PORT_POLLING_LFPS_TIME); ++ spin_lock_irqsave(&xhci->lock, flags); ++ xhci_dbg(xhci, "port %d polling in bus suspend, waiting\n", ++ port_index); ++ goto retry; + } +- + /* suspend ports in U0, or bail out for new connect changes */ + if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) { + if ((t1 & PORT_CSC) && wake_enabled) { +diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c +index a6e463715779..671bce18782c 100644 +--- a/drivers/usb/host/xhci-rcar.c ++++ b/drivers/usb/host/xhci-rcar.c +@@ -246,6 +246,7 @@ int xhci_rcar_init_quirk(struct usb_hcd *hcd) + if (!xhci_rcar_wait_for_pll_active(hcd)) + return -ETIMEDOUT; + ++ xhci->quirks |= XHCI_TRUST_TX_LENGTH; + return xhci_rcar_download_firmware(hcd); + } + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 9ae17a666bdb..f054464347c9 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1643,10 +1643,13 @@ static void handle_port_status(struct xhci_hcd *xhci, + } + } + +- if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_U0 && +- DEV_SUPERSPEED_ANY(portsc)) { ++ if ((portsc & PORT_PLC) && ++ DEV_SUPERSPEED_ANY(portsc) && ++ ((portsc & PORT_PLS_MASK) == XDEV_U0 || ++ (portsc & PORT_PLS_MASK) == XDEV_U1 || ++ (portsc & PORT_PLS_MASK) == XDEV_U2)) { + xhci_dbg(xhci, "resume SS port %d finished\n", port_id); +- /* We've just brought the device into U0 through either the ++ /* We've just brought the device into U0/1/2 through either the + * Resume state after a device remote wakeup, or through the + * U3Exit state after a host-initiated resume. If it's a device + * initiated remote wake, don't pass up the link state change, +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index e88060ea1e33..dc00f59c8e69 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -452,6 +452,14 @@ struct xhci_op_regs { + */ + #define XHCI_DEFAULT_BESL 4 + ++/* ++ * USB3 specification define a 360ms tPollingLFPSTiemout for USB3 ports ++ * to complete link training. usually link trainig completes much faster ++ * so check status 10 times with 36ms sleep in places we need to wait for ++ * polling to complete. ++ */ ++#define XHCI_PORT_POLLING_LFPS_TIME 36 ++ + /** + * struct xhci_intr_reg - Interrupt Register Set + * @irq_pending: IMAN - Interrupt Management Register. Used to enable +diff --git a/drivers/usb/mtu3/Kconfig b/drivers/usb/mtu3/Kconfig +index 40bbf1f53337..fe58904f350b 100644 +--- a/drivers/usb/mtu3/Kconfig ++++ b/drivers/usb/mtu3/Kconfig +@@ -4,6 +4,7 @@ config USB_MTU3 + tristate "MediaTek USB3 Dual Role controller" + depends on USB || USB_GADGET + depends on ARCH_MEDIATEK || COMPILE_TEST ++ depends on EXTCON || !EXTCON + select USB_XHCI_MTK if USB_SUPPORT && USB_XHCI_HCD + help + Say Y or M here if your system runs on MediaTek SoCs with +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 4c66edf533fe..e732949f6567 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -80,6 +80,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */ + { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */ + { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */ ++ { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */ + { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */ + { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */ + { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 1d8077e880a0..c0dc4bc776db 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -599,6 +599,8 @@ static const struct usb_device_id id_table_combined[] = { + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index b863bedb55a1..5755f0df0025 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -567,7 +567,9 @@ + /* + * NovaTech product ids (FTDI_VID) + */ +-#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ ++#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ ++#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */ ++#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */ + + /* + * Synapse Wireless product ids (FTDI_VID) +diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c +index 27109522fd8b..e8f275a0326d 100644 +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -366,8 +366,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, + if (!urbtrack) + return -ENOMEM; + +- kref_get(&mos_parport->ref_count); +- urbtrack->mos_parport = mos_parport; + urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC); + if (!urbtrack->urb) { + kfree(urbtrack); +@@ -388,6 +386,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, + usb_sndctrlpipe(usbdev, 0), + (unsigned char *)urbtrack->setup, + NULL, 0, async_complete, urbtrack); ++ kref_get(&mos_parport->ref_count); ++ urbtrack->mos_parport = mos_parport; + kref_init(&urbtrack->ref_count); + INIT_LIST_HEAD(&urbtrack->urblist_entry); + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index faf833e8f557..d8c474b386a8 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -246,6 +246,7 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_PRODUCT_EC25 0x0125 + #define QUECTEL_PRODUCT_BG96 0x0296 + #define QUECTEL_PRODUCT_EP06 0x0306 ++#define QUECTEL_PRODUCT_EM12 0x0512 + + #define CMOTECH_VENDOR_ID 0x16d8 + #define CMOTECH_PRODUCT_6001 0x6001 +@@ -1066,7 +1067,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(3) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ +- { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */ ++ .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) }, + /* Quectel products using Qualcomm vendor ID */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, + { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20), +@@ -1087,6 +1089,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff), ++ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), +@@ -1940,10 +1945,12 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ + .driver_info = RSVD(4) }, +- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ +- { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ ++ .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, + { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, +diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c +index e61dffb27a0c..00141e05bc72 100644 +--- a/drivers/usb/typec/class.c ++++ b/drivers/usb/typec/class.c +@@ -1500,7 +1500,7 @@ typec_port_register_altmode(struct typec_port *port, + + sprintf(id, "id%04xm%02x", desc->svid, desc->mode); + +- mux = typec_mux_get(port->dev.parent, id); ++ mux = typec_mux_get(&port->dev, id); + if (IS_ERR(mux)) + return ERR_CAST(mux); + +@@ -1540,18 +1540,6 @@ struct typec_port *typec_register_port(struct device *parent, + return ERR_PTR(id); + } + +- port->sw = typec_switch_get(cap->fwnode ? &port->dev : parent); +- if (IS_ERR(port->sw)) { +- ret = PTR_ERR(port->sw); +- goto err_switch; +- } +- +- port->mux = typec_mux_get(parent, "typec-mux"); +- if (IS_ERR(port->mux)) { +- ret = PTR_ERR(port->mux); +- goto err_mux; +- } +- + switch (cap->type) { + case TYPEC_PORT_SRC: + port->pwr_role = TYPEC_SOURCE; +@@ -1592,13 +1580,26 @@ struct typec_port *typec_register_port(struct device *parent, + port->port_type = cap->type; + port->prefer_role = cap->prefer_role; + ++ device_initialize(&port->dev); + port->dev.class = typec_class; + port->dev.parent = parent; + port->dev.fwnode = cap->fwnode; + port->dev.type = &typec_port_dev_type; + dev_set_name(&port->dev, "port%d", id); + +- ret = device_register(&port->dev); ++ port->sw = typec_switch_get(&port->dev); ++ if (IS_ERR(port->sw)) { ++ put_device(&port->dev); ++ return ERR_CAST(port->sw); ++ } ++ ++ port->mux = typec_mux_get(&port->dev, "typec-mux"); ++ if (IS_ERR(port->mux)) { ++ put_device(&port->dev); ++ return ERR_CAST(port->mux); ++ } ++ ++ ret = device_add(&port->dev); + if (ret) { + dev_err(parent, "failed to register port (%d)\n", ret); + put_device(&port->dev); +@@ -1606,15 +1607,6 @@ struct typec_port *typec_register_port(struct device *parent, + } + + return port; +- +-err_mux: +- typec_switch_put(port->sw); +- +-err_switch: +- ida_simple_remove(&typec_index_ida, port->id); +- kfree(port); +- +- return ERR_PTR(ret); + } + EXPORT_SYMBOL_GPL(typec_register_port); + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index a16760b410b1..c0db7785cede 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -5872,7 +5872,7 @@ static void btrfs_calculate_inode_block_rsv_size(struct btrfs_fs_info *fs_info, + * + * This is overestimating in most cases. + */ +- qgroup_rsv_size = outstanding_extents * fs_info->nodesize; ++ qgroup_rsv_size = (u64)outstanding_extents * fs_info->nodesize; + + spin_lock(&block_rsv->lock); + block_rsv->size = reserve_size; +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index df41d7049936..927f9f3daddb 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -2429,8 +2429,9 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, + bitmap_clear(rbio->dbitmap, pagenr, 1); + kunmap(p); + +- for (stripe = 0; stripe < rbio->real_stripes; stripe++) ++ for (stripe = 0; stripe < nr_data; stripe++) + kunmap(page_in_rbio(rbio, stripe, pagenr, 0)); ++ kunmap(p_page); + } + + __free_page(p_page); +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 0805f8c5e72d..2f4f0958e5f2 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -3532,9 +3532,16 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, + } + btrfs_release_path(path); + +- /* find the first key from this transaction again */ ++ /* ++ * Find the first key from this transaction again. See the note for ++ * log_new_dir_dentries, if we're logging a directory recursively we ++ * won't be holding its i_mutex, which means we can modify the directory ++ * while we're logging it. If we remove an entry between our first ++ * search and this search we'll not find the key again and can just ++ * bail. ++ */ + ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0); +- if (WARN_ON(ret != 0)) ++ if (ret != 0) + goto done; + + /* +@@ -4504,6 +4511,19 @@ static int logged_inode_size(struct btrfs_root *log, struct btrfs_inode *inode, + item = btrfs_item_ptr(path->nodes[0], path->slots[0], + struct btrfs_inode_item); + *size_ret = btrfs_inode_size(path->nodes[0], item); ++ /* ++ * If the in-memory inode's i_size is smaller then the inode ++ * size stored in the btree, return the inode's i_size, so ++ * that we get a correct inode size after replaying the log ++ * when before a power failure we had a shrinking truncate ++ * followed by addition of a new name (rename / new hard link). ++ * Otherwise return the inode size from the btree, to avoid ++ * data loss when replaying a log due to previously doing a ++ * write that expands the inode's size and logging a new name ++ * immediately after. ++ */ ++ if (*size_ret > inode->vfs_inode.i_size) ++ *size_ret = inode->vfs_inode.i_size; + } + + btrfs_release_path(path); +@@ -4665,15 +4685,8 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans, + struct btrfs_file_extent_item); + + if (btrfs_file_extent_type(leaf, extent) == +- BTRFS_FILE_EXTENT_INLINE) { +- len = btrfs_file_extent_ram_bytes(leaf, extent); +- ASSERT(len == i_size || +- (len == fs_info->sectorsize && +- btrfs_file_extent_compression(leaf, extent) != +- BTRFS_COMPRESS_NONE) || +- (len < i_size && i_size < fs_info->sectorsize)); ++ BTRFS_FILE_EXTENT_INLINE) + return 0; +- } + + len = btrfs_file_extent_num_bytes(leaf, extent); + /* Last extent goes beyond i_size, no need to log a hole. */ +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index c13f62182513..207f4e87445d 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -6051,7 +6051,7 @@ static void btrfs_end_bio(struct bio *bio) + if (bio_op(bio) == REQ_OP_WRITE) + btrfs_dev_stat_inc_and_print(dev, + BTRFS_DEV_STAT_WRITE_ERRS); +- else ++ else if (!(bio->bi_opf & REQ_RAHEAD)) + btrfs_dev_stat_inc_and_print(dev, + BTRFS_DEV_STAT_READ_ERRS); + if (bio->bi_opf & REQ_PREFLUSH) +diff --git a/fs/lockd/host.c b/fs/lockd/host.c +index 93fb7cf0b92b..f0b5c987d6ae 100644 +--- a/fs/lockd/host.c ++++ b/fs/lockd/host.c +@@ -290,12 +290,11 @@ void nlmclnt_release_host(struct nlm_host *host) + + WARN_ON_ONCE(host->h_server); + +- if (refcount_dec_and_test(&host->h_count)) { ++ if (refcount_dec_and_mutex_lock(&host->h_count, &nlm_host_mutex)) { + WARN_ON_ONCE(!list_empty(&host->h_lockowners)); + WARN_ON_ONCE(!list_empty(&host->h_granted)); + WARN_ON_ONCE(!list_empty(&host->h_reclaim)); + +- mutex_lock(&nlm_host_mutex); + nlm_destroy_host_locked(host); + mutex_unlock(&nlm_host_mutex); + } +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index e7abcf7629b3..580e37bc3fe2 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2909,7 +2909,8 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, + } + + out: +- nfs4_sequence_free_slot(&opendata->o_res.seq_res); ++ if (!opendata->cancelled) ++ nfs4_sequence_free_slot(&opendata->o_res.seq_res); + return ret; + } + +diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c +index 7a5ee145c733..fc197e599e8c 100644 +--- a/fs/ocfs2/refcounttree.c ++++ b/fs/ocfs2/refcounttree.c +@@ -4716,22 +4716,23 @@ out: + + /* Lock an inode and grab a bh pointing to the inode. */ + static int ocfs2_reflink_inodes_lock(struct inode *s_inode, +- struct buffer_head **bh1, ++ struct buffer_head **bh_s, + struct inode *t_inode, +- struct buffer_head **bh2) ++ struct buffer_head **bh_t) + { +- struct inode *inode1; +- struct inode *inode2; ++ struct inode *inode1 = s_inode; ++ struct inode *inode2 = t_inode; + struct ocfs2_inode_info *oi1; + struct ocfs2_inode_info *oi2; ++ struct buffer_head *bh1 = NULL; ++ struct buffer_head *bh2 = NULL; + bool same_inode = (s_inode == t_inode); ++ bool need_swap = (inode1->i_ino > inode2->i_ino); + int status; + + /* First grab the VFS and rw locks. */ + lock_two_nondirectories(s_inode, t_inode); +- inode1 = s_inode; +- inode2 = t_inode; +- if (inode1->i_ino > inode2->i_ino) ++ if (need_swap) + swap(inode1, inode2); + + status = ocfs2_rw_lock(inode1, 1); +@@ -4754,17 +4755,13 @@ static int ocfs2_reflink_inodes_lock(struct inode *s_inode, + trace_ocfs2_double_lock((unsigned long long)oi1->ip_blkno, + (unsigned long long)oi2->ip_blkno); + +- if (*bh1) +- *bh1 = NULL; +- if (*bh2) +- *bh2 = NULL; +- + /* We always want to lock the one with the lower lockid first. */ + if (oi1->ip_blkno > oi2->ip_blkno) + mlog_errno(-ENOLCK); + + /* lock id1 */ +- status = ocfs2_inode_lock_nested(inode1, bh1, 1, OI_LS_REFLINK_TARGET); ++ status = ocfs2_inode_lock_nested(inode1, &bh1, 1, ++ OI_LS_REFLINK_TARGET); + if (status < 0) { + if (status != -ENOENT) + mlog_errno(status); +@@ -4773,15 +4770,25 @@ static int ocfs2_reflink_inodes_lock(struct inode *s_inode, + + /* lock id2 */ + if (!same_inode) { +- status = ocfs2_inode_lock_nested(inode2, bh2, 1, ++ status = ocfs2_inode_lock_nested(inode2, &bh2, 1, + OI_LS_REFLINK_TARGET); + if (status < 0) { + if (status != -ENOENT) + mlog_errno(status); + goto out_cl1; + } +- } else +- *bh2 = *bh1; ++ } else { ++ bh2 = bh1; ++ } ++ ++ /* ++ * If we swapped inode order above, we have to swap the buffer heads ++ * before passing them back to the caller. ++ */ ++ if (need_swap) ++ swap(bh1, bh2); ++ *bh_s = bh1; ++ *bh_t = bh2; + + trace_ocfs2_double_lock_end( + (unsigned long long)oi1->ip_blkno, +@@ -4791,8 +4798,7 @@ static int ocfs2_reflink_inodes_lock(struct inode *s_inode, + + out_cl1: + ocfs2_inode_unlock(inode1, 1); +- brelse(*bh1); +- *bh1 = NULL; ++ brelse(bh1); + out_rw2: + ocfs2_rw_unlock(inode2, 1); + out_i2: +diff --git a/fs/open.c b/fs/open.c +index 0285ce7dbd51..f1c2f855fd43 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -733,6 +733,12 @@ static int do_dentry_open(struct file *f, + return 0; + } + ++ /* Any file opened for execve()/uselib() has to be a regular file. */ ++ if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) { ++ error = -EACCES; ++ goto cleanup_file; ++ } ++ + if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { + error = get_write_access(inode); + if (unlikely(error)) +diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c +index 4d598a399bbf..d65390727541 100644 +--- a/fs/proc/proc_sysctl.c ++++ b/fs/proc/proc_sysctl.c +@@ -1626,7 +1626,8 @@ static void drop_sysctl_table(struct ctl_table_header *header) + if (--header->nreg) + return; + +- put_links(header); ++ if (parent) ++ put_links(header); + start_unregistering(header); + if (!--header->count) + kfree_rcu(header, rcu); +diff --git a/include/linux/device.h b/include/linux/device.h +index 8f882549edee..3f1066a9e1c3 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -773,6 +773,30 @@ struct device *device_connection_find(struct device *dev, const char *con_id); + void device_connection_add(struct device_connection *con); + void device_connection_remove(struct device_connection *con); + ++/** ++ * device_connections_add - Add multiple device connections at once ++ * @cons: Zero terminated array of device connection descriptors ++ */ ++static inline void device_connections_add(struct device_connection *cons) ++{ ++ struct device_connection *c; ++ ++ for (c = cons; c->endpoint[0]; c++) ++ device_connection_add(c); ++} ++ ++/** ++ * device_connections_remove - Remove multiple device connections at once ++ * @cons: Zero terminated array of device connection descriptors ++ */ ++static inline void device_connections_remove(struct device_connection *cons) ++{ ++ struct device_connection *c; ++ ++ for (c = cons; c->endpoint[0]; c++) ++ device_connection_remove(c); ++} ++ + /** + * enum device_link_state - Device link states. + * @DL_STATE_NONE: The presence of the drivers is not being tracked. +diff --git a/include/linux/slab.h b/include/linux/slab.h +index ed9cbddeb4a6..d6393413ef09 100644 +--- a/include/linux/slab.h ++++ b/include/linux/slab.h +@@ -32,6 +32,8 @@ + #define SLAB_HWCACHE_ALIGN ((slab_flags_t __force)0x00002000U) + /* Use GFP_DMA memory */ + #define SLAB_CACHE_DMA ((slab_flags_t __force)0x00004000U) ++/* Use GFP_DMA32 memory */ ++#define SLAB_CACHE_DMA32 ((slab_flags_t __force)0x00008000U) + /* DEBUG: Store the last owner for bug hunting */ + #define SLAB_STORE_USER ((slab_flags_t __force)0x00010000U) + /* Panic if kmem_cache_create() fails */ +diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h +index 32ee65a30aff..1c6e6c0766ca 100644 +--- a/include/net/sctp/checksum.h ++++ b/include/net/sctp/checksum.h +@@ -61,7 +61,7 @@ static inline __wsum sctp_csum_combine(__wsum csum, __wsum csum2, + static inline __le32 sctp_compute_cksum(const struct sk_buff *skb, + unsigned int offset) + { +- struct sctphdr *sh = sctp_hdr(skb); ++ struct sctphdr *sh = (struct sctphdr *)(skb->data + offset); + const struct skb_checksum_ops ops = { + .update = sctp_csum_update, + .combine = sctp_csum_combine, +diff --git a/include/net/sock.h b/include/net/sock.h +index 6cb5a545df7d..1ece7736c49c 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -710,6 +710,12 @@ static inline void sk_add_node_rcu(struct sock *sk, struct hlist_head *list) + hlist_add_head_rcu(&sk->sk_node, list); + } + ++static inline void sk_add_node_tail_rcu(struct sock *sk, struct hlist_head *list) ++{ ++ sock_hold(sk); ++ hlist_add_tail_rcu(&sk->sk_node, list); ++} ++ + static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) + { + hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index bcb42aaf1b3a..acc2305ad895 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -2815,7 +2815,7 @@ do_sim: + *dst_reg = *ptr_reg; + } + ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true); +- if (!ptr_is_dst_reg) ++ if (!ptr_is_dst_reg && ret) + *dst_reg = tmp; + return !ret ? -EFAULT : 0; + } +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 56f657adcf03..9d0ecc4a0e79 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -533,6 +533,20 @@ static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st) + cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL); + } + ++static inline bool can_rollback_cpu(struct cpuhp_cpu_state *st) ++{ ++ if (IS_ENABLED(CONFIG_HOTPLUG_CPU)) ++ return true; ++ /* ++ * When CPU hotplug is disabled, then taking the CPU down is not ++ * possible because takedown_cpu() and the architecture and ++ * subsystem specific mechanisms are not available. So the CPU ++ * which would be completely unplugged again needs to stay around ++ * in the current state. ++ */ ++ return st->state <= CPUHP_BRINGUP_CPU; ++} ++ + static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st, + enum cpuhp_state target) + { +@@ -543,8 +557,10 @@ static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st, + st->state++; + ret = cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL); + if (ret) { +- st->target = prev_state; +- undo_cpu_up(cpu, st); ++ if (can_rollback_cpu(st)) { ++ st->target = prev_state; ++ undo_cpu_up(cpu, st); ++ } + break; + } + } +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index 977918d5d350..bbc4940f21af 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -547,13 +547,15 @@ static void softlockup_start_all(void) + + int lockup_detector_online_cpu(unsigned int cpu) + { +- watchdog_enable(cpu); ++ if (cpumask_test_cpu(cpu, &watchdog_allowed_mask)) ++ watchdog_enable(cpu); + return 0; + } + + int lockup_detector_offline_cpu(unsigned int cpu) + { +- watchdog_disable(cpu); ++ if (cpumask_test_cpu(cpu, &watchdog_allowed_mask)) ++ watchdog_disable(cpu); + return 0; + } + +diff --git a/lib/rhashtable.c b/lib/rhashtable.c +index 30526afa8343..6410c857b048 100644 +--- a/lib/rhashtable.c ++++ b/lib/rhashtable.c +@@ -416,8 +416,12 @@ static void rht_deferred_worker(struct work_struct *work) + else if (tbl->nest) + err = rhashtable_rehash_alloc(ht, tbl, tbl->size); + +- if (!err) +- err = rhashtable_rehash_table(ht); ++ if (!err || err == -EEXIST) { ++ int nerr; ++ ++ nerr = rhashtable_rehash_table(ht); ++ err = err ?: nerr; ++ } + + mutex_unlock(&ht->mutex); + +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 89d4439516f6..f32d0a5be4fb 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -428,6 +428,13 @@ static inline bool queue_pages_required(struct page *page, + return node_isset(nid, *qp->nmask) == !(flags & MPOL_MF_INVERT); + } + ++/* ++ * queue_pages_pmd() has three possible return values: ++ * 1 - pages are placed on the right node or queued successfully. ++ * 0 - THP was split. ++ * -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing ++ * page was already on a node that does not follow the policy. ++ */ + static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr, + unsigned long end, struct mm_walk *walk) + { +@@ -437,7 +444,7 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr, + unsigned long flags; + + if (unlikely(is_pmd_migration_entry(*pmd))) { +- ret = 1; ++ ret = -EIO; + goto unlock; + } + page = pmd_page(*pmd); +@@ -454,8 +461,15 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr, + ret = 1; + flags = qp->flags; + /* go to thp migration */ +- if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) ++ if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) { ++ if (!vma_migratable(walk->vma)) { ++ ret = -EIO; ++ goto unlock; ++ } ++ + migrate_page_add(page, qp->pagelist, flags); ++ } else ++ ret = -EIO; + unlock: + spin_unlock(ptl); + out: +@@ -480,8 +494,10 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr, + ptl = pmd_trans_huge_lock(pmd, vma); + if (ptl) { + ret = queue_pages_pmd(pmd, ptl, addr, end, walk); +- if (ret) ++ if (ret > 0) + return 0; ++ else if (ret < 0) ++ return ret; + } + + if (pmd_trans_unstable(pmd)) +@@ -502,11 +518,16 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr, + continue; + if (!queue_pages_required(page, qp)) + continue; +- migrate_page_add(page, qp->pagelist, flags); ++ if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) { ++ if (!vma_migratable(vma)) ++ break; ++ migrate_page_add(page, qp->pagelist, flags); ++ } else ++ break; + } + pte_unmap_unlock(pte - 1, ptl); + cond_resched(); +- return 0; ++ return addr != end ? -EIO : 0; + } + + static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask, +@@ -576,7 +597,12 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end, + unsigned long endvma = vma->vm_end; + unsigned long flags = qp->flags; + +- if (!vma_migratable(vma)) ++ /* ++ * Need check MPOL_MF_STRICT to return -EIO if possible ++ * regardless of vma_migratable ++ */ ++ if (!vma_migratable(vma) && ++ !(flags & MPOL_MF_STRICT)) + return 1; + + if (endvma > end) +@@ -603,7 +629,7 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end, + } + + /* queue pages from current vma */ +- if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) ++ if (flags & MPOL_MF_VALID) + return 0; + return 1; + } +diff --git a/mm/migrate.c b/mm/migrate.c +index 14779c4f9a60..b2ea7d1e6f24 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -248,10 +248,8 @@ static bool remove_migration_pte(struct page *page, struct vm_area_struct *vma, + pte = swp_entry_to_pte(entry); + } else if (is_device_public_page(new)) { + pte = pte_mkdevmap(pte); +- flush_dcache_page(new); + } +- } else +- flush_dcache_page(new); ++ } + + #ifdef CONFIG_HUGETLB_PAGE + if (PageHuge(new)) { +@@ -983,6 +981,13 @@ static int move_to_new_page(struct page *newpage, struct page *page, + */ + if (!PageMappingFlags(page)) + page->mapping = NULL; ++ ++ if (unlikely(is_zone_device_page(newpage))) { ++ if (is_device_public_page(newpage)) ++ flush_dcache_page(newpage); ++ } else ++ flush_dcache_page(newpage); ++ + } + out: + return rc; +diff --git a/mm/slab.c b/mm/slab.c +index fad6839e8eab..364e42d5a399 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -2124,6 +2124,8 @@ done: + cachep->allocflags = __GFP_COMP; + if (flags & SLAB_CACHE_DMA) + cachep->allocflags |= GFP_DMA; ++ if (flags & SLAB_CACHE_DMA32) ++ cachep->allocflags |= GFP_DMA32; + if (flags & SLAB_RECLAIM_ACCOUNT) + cachep->allocflags |= __GFP_RECLAIMABLE; + cachep->size = size; +diff --git a/mm/slab.h b/mm/slab.h +index 58c6c1c2a78e..9632772e14be 100644 +--- a/mm/slab.h ++++ b/mm/slab.h +@@ -127,7 +127,8 @@ static inline slab_flags_t kmem_cache_flags(unsigned int object_size, + + + /* Legal flag mask for kmem_cache_create(), for various configurations */ +-#define SLAB_CORE_FLAGS (SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA | SLAB_PANIC | \ ++#define SLAB_CORE_FLAGS (SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA | \ ++ SLAB_CACHE_DMA32 | SLAB_PANIC | \ + SLAB_TYPESAFE_BY_RCU | SLAB_DEBUG_OBJECTS ) + + #if defined(CONFIG_DEBUG_SLAB) +diff --git a/mm/slab_common.c b/mm/slab_common.c +index 3a7ac4f15194..4d3c2e76d1ba 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -53,7 +53,7 @@ static DECLARE_WORK(slab_caches_to_rcu_destroy_work, + SLAB_FAILSLAB | SLAB_KASAN) + + #define SLAB_MERGE_SAME (SLAB_RECLAIM_ACCOUNT | SLAB_CACHE_DMA | \ +- SLAB_ACCOUNT) ++ SLAB_CACHE_DMA32 | SLAB_ACCOUNT) + + /* + * Merge control. If this is set then no merging of slab caches will occur. +diff --git a/mm/slub.c b/mm/slub.c +index 8da34a8af53d..09c0e24a06d8 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -3539,6 +3539,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) + if (s->flags & SLAB_CACHE_DMA) + s->allocflags |= GFP_DMA; + ++ if (s->flags & SLAB_CACHE_DMA32) ++ s->allocflags |= GFP_DMA32; ++ + if (s->flags & SLAB_RECLAIM_ACCOUNT) + s->allocflags |= __GFP_RECLAIMABLE; + +@@ -5633,6 +5636,8 @@ static char *create_unique_id(struct kmem_cache *s) + */ + if (s->flags & SLAB_CACHE_DMA) + *p++ = 'd'; ++ if (s->flags & SLAB_CACHE_DMA32) ++ *p++ = 'D'; + if (s->flags & SLAB_RECLAIM_ACCOUNT) + *p++ = 'a'; + if (s->flags & SLAB_CONSISTENCY_CHECKS) +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index d17a4736e47c..2c6eabf294b3 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -3336,16 +3336,22 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data + + while (len >= L2CAP_CONF_OPT_SIZE) { + len -= l2cap_get_conf_opt(&req, &type, &olen, &val); ++ if (len < 0) ++ break; + + hint = type & L2CAP_CONF_HINT; + type &= L2CAP_CONF_MASK; + + switch (type) { + case L2CAP_CONF_MTU: ++ if (olen != 2) ++ break; + mtu = val; + break; + + case L2CAP_CONF_FLUSH_TO: ++ if (olen != 2) ++ break; + chan->flush_to = val; + break; + +@@ -3353,26 +3359,30 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data + break; + + case L2CAP_CONF_RFC: +- if (olen == sizeof(rfc)) +- memcpy(&rfc, (void *) val, olen); ++ if (olen != sizeof(rfc)) ++ break; ++ memcpy(&rfc, (void *) val, olen); + break; + + case L2CAP_CONF_FCS: ++ if (olen != 1) ++ break; + if (val == L2CAP_FCS_NONE) + set_bit(CONF_RECV_NO_FCS, &chan->conf_state); + break; + + case L2CAP_CONF_EFS: +- if (olen == sizeof(efs)) { +- remote_efs = 1; +- memcpy(&efs, (void *) val, olen); +- } ++ if (olen != sizeof(efs)) ++ break; ++ remote_efs = 1; ++ memcpy(&efs, (void *) val, olen); + break; + + case L2CAP_CONF_EWS: ++ if (olen != 2) ++ break; + if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP)) + return -ECONNREFUSED; +- + set_bit(FLAG_EXT_CTRL, &chan->flags); + set_bit(CONF_EWS_RECV, &chan->conf_state); + chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; +@@ -3382,7 +3392,6 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data + default: + if (hint) + break; +- + result = L2CAP_CONF_UNKNOWN; + *((u8 *) ptr++) = type; + break; +@@ -3547,58 +3556,65 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, + + while (len >= L2CAP_CONF_OPT_SIZE) { + len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); ++ if (len < 0) ++ break; + + switch (type) { + case L2CAP_CONF_MTU: ++ if (olen != 2) ++ break; + if (val < L2CAP_DEFAULT_MIN_MTU) { + *result = L2CAP_CONF_UNACCEPT; + chan->imtu = L2CAP_DEFAULT_MIN_MTU; + } else + chan->imtu = val; +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, ++ endptr - ptr); + break; + + case L2CAP_CONF_FLUSH_TO: ++ if (olen != 2) ++ break; + chan->flush_to = val; +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, +- 2, chan->flush_to, endptr - ptr); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, ++ chan->flush_to, endptr - ptr); + break; + + case L2CAP_CONF_RFC: +- if (olen == sizeof(rfc)) +- memcpy(&rfc, (void *)val, olen); +- ++ if (olen != sizeof(rfc)) ++ break; ++ memcpy(&rfc, (void *)val, olen); + if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && + rfc.mode != chan->mode) + return -ECONNREFUSED; +- + chan->fcs = 0; +- +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, +- sizeof(rfc), (unsigned long) &rfc, endptr - ptr); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), ++ (unsigned long) &rfc, endptr - ptr); + break; + + case L2CAP_CONF_EWS: ++ if (olen != 2) ++ break; + chan->ack_win = min_t(u16, val, chan->ack_win); + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, + chan->tx_win, endptr - ptr); + break; + + case L2CAP_CONF_EFS: +- if (olen == sizeof(efs)) { +- memcpy(&efs, (void *)val, olen); +- +- if (chan->local_stype != L2CAP_SERV_NOTRAFIC && +- efs.stype != L2CAP_SERV_NOTRAFIC && +- efs.stype != chan->local_stype) +- return -ECONNREFUSED; +- +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), +- (unsigned long) &efs, endptr - ptr); +- } ++ if (olen != sizeof(efs)) ++ break; ++ memcpy(&efs, (void *)val, olen); ++ if (chan->local_stype != L2CAP_SERV_NOTRAFIC && ++ efs.stype != L2CAP_SERV_NOTRAFIC && ++ efs.stype != chan->local_stype) ++ return -ECONNREFUSED; ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), ++ (unsigned long) &efs, endptr - ptr); + break; + + case L2CAP_CONF_FCS: ++ if (olen != 1) ++ break; + if (*result == L2CAP_CONF_PENDING) + if (val == L2CAP_FCS_NONE) + set_bit(CONF_RECV_NO_FCS, +@@ -3727,13 +3743,18 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) + + while (len >= L2CAP_CONF_OPT_SIZE) { + len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); ++ if (len < 0) ++ break; + + switch (type) { + case L2CAP_CONF_RFC: +- if (olen == sizeof(rfc)) +- memcpy(&rfc, (void *)val, olen); ++ if (olen != sizeof(rfc)) ++ break; ++ memcpy(&rfc, (void *)val, olen); + break; + case L2CAP_CONF_EWS: ++ if (olen != 2) ++ break; + txwin_ext = val; + break; + } +diff --git a/net/core/datagram.c b/net/core/datagram.c +index 57f3a6fcfc1e..a487df53a453 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -279,7 +279,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags, + break; + + sk_busy_loop(sk, flags & MSG_DONTWAIT); +- } while (!skb_queue_empty(&sk->sk_receive_queue)); ++ } while (sk->sk_receive_queue.prev != *last); + + error = -EAGAIN; + +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index 2aabb7eb0854..bf9a3b6ac885 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -934,6 +934,8 @@ static int rx_queue_add_kobject(struct net_device *dev, int index) + if (error) + return error; + ++ dev_hold(queue->dev); ++ + if (dev->sysfs_rx_queue_group) { + error = sysfs_create_group(kobj, dev->sysfs_rx_queue_group); + if (error) { +@@ -943,7 +945,6 @@ static int rx_queue_add_kobject(struct net_device *dev, int index) + } + + kobject_uevent(kobj, KOBJ_ADD); +- dev_hold(queue->dev); + + return error; + } +@@ -1472,6 +1473,8 @@ static int netdev_queue_add_kobject(struct net_device *dev, int index) + if (error) + return error; + ++ dev_hold(queue->dev); ++ + #ifdef CONFIG_BQL + error = sysfs_create_group(kobj, &dql_group); + if (error) { +@@ -1481,7 +1484,6 @@ static int netdev_queue_add_kobject(struct net_device *dev, int index) + #endif + + kobject_uevent(kobj, KOBJ_ADD); +- dev_hold(queue->dev); + + return 0; + } +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index 6344f1b18a6a..58a401e9cf09 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -433,8 +433,8 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk, + newnp->ipv6_mc_list = NULL; + newnp->ipv6_ac_list = NULL; + newnp->ipv6_fl_list = NULL; +- newnp->mcast_oif = inet6_iif(skb); +- newnp->mcast_hops = ipv6_hdr(skb)->hop_limit; ++ newnp->mcast_oif = inet_iif(skb); ++ newnp->mcast_hops = ip_hdr(skb)->ttl; + + /* + * No need to charge this sock to the relevant IPv6 refcnt debug socks count +diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c +index 17c455ff69ff..7858fa9ea103 100644 +--- a/net/ipv6/ila/ila_xlat.c ++++ b/net/ipv6/ila/ila_xlat.c +@@ -420,6 +420,7 @@ int ila_xlat_nl_cmd_flush(struct sk_buff *skb, struct genl_info *info) + + done: + rhashtable_walk_stop(&iter); ++ rhashtable_walk_exit(&iter); + return ret; + } + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 66cc94427437..9006bb3c9e72 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1048,14 +1048,20 @@ static struct rt6_info *ip6_create_rt_rcu(struct fib6_info *rt) + struct rt6_info *nrt; + + if (!fib6_info_hold_safe(rt)) +- return NULL; ++ goto fallback; + + nrt = ip6_dst_alloc(dev_net(dev), dev, flags); +- if (nrt) +- ip6_rt_copy_init(nrt, rt); +- else ++ if (!nrt) { + fib6_info_release(rt); ++ goto fallback; ++ } + ++ ip6_rt_copy_init(nrt, rt); ++ return nrt; ++ ++fallback: ++ nrt = dev_net(dev)->ipv6.ip6_null_entry; ++ dst_hold(&nrt->dst); + return nrt; + } + +@@ -1104,10 +1110,6 @@ restart: + dst_hold(&rt->dst); + } else { + rt = ip6_create_rt_rcu(f6i); +- if (!rt) { +- rt = net->ipv6.ip6_null_entry; +- dst_hold(&rt->dst); +- } + } + + rcu_read_unlock(); +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 03e6b7a2bc53..e7cdfa92c382 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1108,11 +1108,11 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * + newnp->ipv6_fl_list = NULL; + newnp->pktoptions = NULL; + newnp->opt = NULL; +- newnp->mcast_oif = tcp_v6_iif(skb); +- newnp->mcast_hops = ipv6_hdr(skb)->hop_limit; +- newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb)); ++ newnp->mcast_oif = inet_iif(skb); ++ newnp->mcast_hops = ip_hdr(skb)->ttl; ++ newnp->rcv_flowinfo = 0; + if (np->repflow) +- newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb)); ++ newnp->flow_label = 0; + + /* + * No need to charge this sock to the relevant IPv6 refcnt debug socks count +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index 25eeb6d2a75a..f0ec068e1d02 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -366,7 +366,7 @@ int genl_register_family(struct genl_family *family) + start, end + 1, GFP_KERNEL); + if (family->id < 0) { + err = family->id; +- goto errout_locked; ++ goto errout_free; + } + + err = genl_validate_assign_mc_groups(family); +@@ -385,6 +385,7 @@ int genl_register_family(struct genl_family *family) + + errout_remove: + idr_remove(&genl_fam_idr, family->id); ++errout_free: + kfree(family->attrbuf); + errout_locked: + genl_unlock_all(); +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index fd16fb836df2..a0d295478e69 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3245,7 +3245,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, + } + + mutex_lock(&net->packet.sklist_lock); +- sk_add_node_rcu(sk, &net->packet.sklist); ++ sk_add_node_tail_rcu(sk, &net->packet.sklist); + mutex_unlock(&net->packet.sklist_lock); + + preempt_disable(); +@@ -4194,7 +4194,7 @@ static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order) + struct pgv *pg_vec; + int i; + +- pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL); ++ pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN); + if (unlikely(!pg_vec)) + goto out; + +diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c +index 7ca57741b2fb..7849f286bb93 100644 +--- a/net/rose/rose_subr.c ++++ b/net/rose/rose_subr.c +@@ -105,16 +105,17 @@ void rose_write_internal(struct sock *sk, int frametype) + struct sk_buff *skb; + unsigned char *dptr; + unsigned char lci1, lci2; +- char buffer[100]; +- int len, faclen = 0; ++ int maxfaclen = 0; ++ int len, faclen; ++ int reserve; + +- len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 1; ++ reserve = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1; ++ len = ROSE_MIN_LEN; + + switch (frametype) { + case ROSE_CALL_REQUEST: + len += 1 + ROSE_ADDR_LEN + ROSE_ADDR_LEN; +- faclen = rose_create_facilities(buffer, rose); +- len += faclen; ++ maxfaclen = 256; + break; + case ROSE_CALL_ACCEPTED: + case ROSE_CLEAR_REQUEST: +@@ -123,15 +124,16 @@ void rose_write_internal(struct sock *sk, int frametype) + break; + } + +- if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL) ++ skb = alloc_skb(reserve + len + maxfaclen, GFP_ATOMIC); ++ if (!skb) + return; + + /* + * Space for AX.25 header and PID. + */ +- skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1); ++ skb_reserve(skb, reserve); + +- dptr = skb_put(skb, skb_tailroom(skb)); ++ dptr = skb_put(skb, len); + + lci1 = (rose->lci >> 8) & 0x0F; + lci2 = (rose->lci >> 0) & 0xFF; +@@ -146,7 +148,8 @@ void rose_write_internal(struct sock *sk, int frametype) + dptr += ROSE_ADDR_LEN; + memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN); + dptr += ROSE_ADDR_LEN; +- memcpy(dptr, buffer, faclen); ++ faclen = rose_create_facilities(dptr, rose); ++ skb_put(skb, faclen); + dptr += faclen; + break; + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 8bf66d0a6800..f767e78e38c9 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -159,6 +159,9 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla, + } + m = to_mirred(*a); + ++ if (ret == ACT_P_CREATED) ++ INIT_LIST_HEAD(&m->tcfm_list); ++ + spin_lock_bh(&m->tcf_lock); + m->tcf_action = parm->action; + m->tcfm_eaction = parm->eaction; +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 1b16250c5718..8c00a7ef1bcd 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -1017,7 +1017,7 @@ static int sctp_setsockopt_bindx(struct sock *sk, + if (unlikely(addrs_size <= 0)) + return -EINVAL; + +- kaddrs = vmemdup_user(addrs, addrs_size); ++ kaddrs = memdup_user(addrs, addrs_size); + if (unlikely(IS_ERR(kaddrs))) + return PTR_ERR(kaddrs); + +@@ -1025,7 +1025,7 @@ static int sctp_setsockopt_bindx(struct sock *sk, + addr_buf = kaddrs; + while (walk_size < addrs_size) { + if (walk_size + sizeof(sa_family_t) > addrs_size) { +- kvfree(kaddrs); ++ kfree(kaddrs); + return -EINVAL; + } + +@@ -1036,7 +1036,7 @@ static int sctp_setsockopt_bindx(struct sock *sk, + * causes the address buffer to overflow return EINVAL. + */ + if (!af || (walk_size + af->sockaddr_len) > addrs_size) { +- kvfree(kaddrs); ++ kfree(kaddrs); + return -EINVAL; + } + addrcnt++; +@@ -1072,7 +1072,7 @@ static int sctp_setsockopt_bindx(struct sock *sk, + } + + out: +- kvfree(kaddrs); ++ kfree(kaddrs); + + return err; + } +@@ -1347,7 +1347,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk, + if (unlikely(addrs_size <= 0)) + return -EINVAL; + +- kaddrs = vmemdup_user(addrs, addrs_size); ++ kaddrs = memdup_user(addrs, addrs_size); + if (unlikely(IS_ERR(kaddrs))) + return PTR_ERR(kaddrs); + +@@ -1367,7 +1367,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk, + err = __sctp_connect(sk, kaddrs, addrs_size, flags, assoc_id); + + out_free: +- kvfree(kaddrs); ++ kfree(kaddrs); + + return err; + } +diff --git a/net/tipc/net.c b/net/tipc/net.c +index f076edb74338..7ce1e86b024f 100644 +--- a/net/tipc/net.c ++++ b/net/tipc/net.c +@@ -163,12 +163,9 @@ void tipc_sched_net_finalize(struct net *net, u32 addr) + + void tipc_net_stop(struct net *net) + { +- u32 self = tipc_own_addr(net); +- +- if (!self) ++ if (!tipc_own_id(net)) + return; + +- tipc_nametbl_withdraw(net, TIPC_CFG_SRV, self, self, self); + rtnl_lock(); + tipc_bearer_stop(net); + tipc_node_stop(net); +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index 88c307ef1318..67a7b312a499 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2310,6 +2310,16 @@ static int tipc_wait_for_connect(struct socket *sock, long *timeo_p) + return 0; + } + ++static bool tipc_sockaddr_is_sane(struct sockaddr_tipc *addr) ++{ ++ if (addr->family != AF_TIPC) ++ return false; ++ if (addr->addrtype == TIPC_SERVICE_RANGE) ++ return (addr->addr.nameseq.lower <= addr->addr.nameseq.upper); ++ return (addr->addrtype == TIPC_SERVICE_ADDR || ++ addr->addrtype == TIPC_SOCKET_ADDR); ++} ++ + /** + * tipc_connect - establish a connection to another TIPC port + * @sock: socket structure +@@ -2345,18 +2355,18 @@ static int tipc_connect(struct socket *sock, struct sockaddr *dest, + if (!tipc_sk_type_connectionless(sk)) + res = -EINVAL; + goto exit; +- } else if (dst->family != AF_TIPC) { +- res = -EINVAL; + } +- if (dst->addrtype != TIPC_ADDR_ID && dst->addrtype != TIPC_ADDR_NAME) ++ if (!tipc_sockaddr_is_sane(dst)) { + res = -EINVAL; +- if (res) + goto exit; +- ++ } + /* DGRAM/RDM connect(), just save the destaddr */ + if (tipc_sk_type_connectionless(sk)) { + memcpy(&tsk->peer, dest, destlen); + goto exit; ++ } else if (dst->addrtype == TIPC_SERVICE_RANGE) { ++ res = -EINVAL; ++ goto exit; + } + + previous = sk->sk_state; +diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c +index d65eed88c495..2301b09df234 100644 +--- a/net/tipc/topsrv.c ++++ b/net/tipc/topsrv.c +@@ -371,6 +371,7 @@ static int tipc_conn_rcv_sub(struct tipc_topsrv *srv, + struct tipc_subscription *sub; + + if (tipc_sub_read(s, filter) & TIPC_SUB_CANCEL) { ++ s->filter &= __constant_ntohl(~TIPC_SUB_CANCEL); + tipc_conn_delete_sub(con, s); + return 0; + } +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 5a77efd39b3f..858cbe56b100 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -640,7 +640,7 @@ static void handle_modversions(struct module *mod, struct elf_info *info, + info->sechdrs[sym->st_shndx].sh_offset - + (info->hdr->e_type != ET_REL ? + info->sechdrs[sym->st_shndx].sh_addr : 0); +- crc = *crcp; ++ crc = TO_NATIVE(*crcp); + } + sym_update_crc(symname + strlen("__crc_"), mod, crc, + export); +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index 467039b342b5..41abb8bd466a 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -940,6 +940,28 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) + oss_frame_size = snd_pcm_format_physical_width(params_format(params)) * + params_channels(params) / 8; + ++ err = snd_pcm_oss_period_size(substream, params, sparams); ++ if (err < 0) ++ goto failure; ++ ++ n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); ++ err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); ++ if (err < 0) ++ goto failure; ++ ++ err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, ++ runtime->oss.periods, NULL); ++ if (err < 0) ++ goto failure; ++ ++ snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); ++ ++ err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams); ++ if (err < 0) { ++ pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); ++ goto failure; ++ } ++ + #ifdef CONFIG_SND_PCM_OSS_PLUGINS + snd_pcm_oss_plugin_clear(substream); + if (!direct) { +@@ -974,27 +996,6 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) + } + #endif + +- err = snd_pcm_oss_period_size(substream, params, sparams); +- if (err < 0) +- goto failure; +- +- n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); +- err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); +- if (err < 0) +- goto failure; +- +- err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, +- runtime->oss.periods, NULL); +- if (err < 0) +- goto failure; +- +- snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); +- +- if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams)) < 0) { +- pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); +- goto failure; +- } +- + if (runtime->oss.trigger) { + sw_params->start_threshold = 1; + } else { +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 818dff1de545..b67f6fe08a1b 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -1426,8 +1426,15 @@ static int snd_pcm_pause(struct snd_pcm_substream *substream, int push) + static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state) + { + struct snd_pcm_runtime *runtime = substream->runtime; +- if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) ++ switch (runtime->status->state) { ++ case SNDRV_PCM_STATE_SUSPENDED: + return -EBUSY; ++ /* unresumable PCM state; return -EBUSY for skipping suspend */ ++ case SNDRV_PCM_STATE_OPEN: ++ case SNDRV_PCM_STATE_SETUP: ++ case SNDRV_PCM_STATE_DISCONNECTED: ++ return -EBUSY; ++ } + runtime->trigger_master = substream; + return 0; + } +diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c +index 08d5662039e3..a52d6d16efc4 100644 +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -601,6 +602,7 @@ static int __snd_rawmidi_info_select(struct snd_card *card, + return -ENXIO; + if (info->stream < 0 || info->stream > 1) + return -EINVAL; ++ info->stream = array_index_nospec(info->stream, 2); + pstr = &rmidi->streams[info->stream]; + if (pstr->substream_count == 0) + return -ENOENT; +diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c +index 278ebb993122..c93945917235 100644 +--- a/sound/core/seq/oss/seq_oss_synth.c ++++ b/sound/core/seq/oss/seq_oss_synth.c +@@ -617,13 +617,14 @@ int + snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf) + { + struct seq_oss_synth *rec; ++ struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev); + +- if (dev < 0 || dev >= dp->max_synthdev) ++ if (!info) + return -ENXIO; + +- if (dp->synths[dev].is_midi) { ++ if (info->is_midi) { + struct midi_info minf; +- snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf); ++ snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf); + inf->synth_type = SYNTH_TYPE_MIDI; + inf->synth_subtype = 0; + inf->nr_voices = 16; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 877293149e3a..4c6321ec844d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5613,6 +5613,12 @@ enum { + ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE, + ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, + ALC255_FIXUP_ACER_HEADSET_MIC, ++ ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE, ++ ALC225_FIXUP_WYSE_AUTO_MUTE, ++ ALC225_FIXUP_WYSE_DISABLE_MIC_VREF, ++ ALC286_FIXUP_ACER_AIO_HEADSET_MIC, ++ ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, ++ ALC299_FIXUP_PREDATOR_SPK, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6567,6 +6573,54 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC + }, ++ [ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x16, 0x01011020 }, /* Rear Line out */ ++ { 0x19, 0x01a1913c }, /* use as Front headset mic, without its own jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC225_FIXUP_WYSE_AUTO_MUTE ++ }, ++ [ALC225_FIXUP_WYSE_AUTO_MUTE] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_auto_mute_via_amp, ++ .chained = true, ++ .chain_id = ALC225_FIXUP_WYSE_DISABLE_MIC_VREF ++ }, ++ [ALC225_FIXUP_WYSE_DISABLE_MIC_VREF] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_disable_mic_vref, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ }, ++ [ALC286_FIXUP_ACER_AIO_HEADSET_MIC] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x4f }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x5029 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE ++ }, ++ [ALC256_FIXUP_ASUS_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x04a11120 }, /* use as headset mic, without its own jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE ++ }, ++ [ALC299_FIXUP_PREDATOR_SPK] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x21, 0x90170150 }, /* use as headset mic, without its own jack detect */ ++ { } ++ } ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -6583,9 +6637,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), + SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), +- SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1099, "Acer Aspire E5-523G", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK), ++ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), +@@ -6631,6 +6689,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), ++ SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), +@@ -6976,6 +7036,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC255_FIXUP_DUMMY_LINEOUT_VERB, .name = "alc255-dummy-lineout"}, + {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"}, + {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"}, ++ {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"}, + {} + }; + #define ALC225_STANDARD_PINS \ +@@ -7196,6 +7257,18 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x14, 0x90170110}, + {0x1b, 0x90a70130}, + {0x21, 0x03211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, ++ {0x12, 0x90a60130}, ++ {0x14, 0x90170110}, ++ {0x21, 0x03211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, ++ {0x12, 0x90a60130}, ++ {0x14, 0x90170110}, ++ {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, ++ {0x1a, 0x90a70130}, ++ {0x1b, 0x90170110}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, + {0x12, 0xb7a60130}, + {0x13, 0xb8a61140}, +diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile +index c9d038f91af6..53f8be0f4a1f 100644 +--- a/tools/objtool/Makefile ++++ b/tools/objtool/Makefile +@@ -25,14 +25,17 @@ LIBSUBCMD = $(LIBSUBCMD_OUTPUT)libsubcmd.a + OBJTOOL := $(OUTPUT)objtool + OBJTOOL_IN := $(OBJTOOL)-in.o + ++LIBELF_FLAGS := $(shell pkg-config libelf --cflags 2>/dev/null) ++LIBELF_LIBS := $(shell pkg-config libelf --libs 2>/dev/null || echo -lelf) ++ + all: $(OBJTOOL) + + INCLUDES := -I$(srctree)/tools/include \ + -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \ + -I$(srctree)/tools/objtool/arch/$(ARCH)/include + WARNINGS := $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -Wno-packed +-CFLAGS += -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES) +-LDFLAGS += -lelf $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS) ++CFLAGS += -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES) $(LIBELF_FLAGS) ++LDFLAGS += $(LIBELF_LIBS) $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS) + + # Allow old libelf to be used: + elfshdr := $(shell echo '$(pound)include ' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr) +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +index f3db68abbd9a..0bc3e6e93c31 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +@@ -251,19 +251,15 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params) + if (!(decoder->tsc_ctc_ratio_n % decoder->tsc_ctc_ratio_d)) + decoder->tsc_ctc_mult = decoder->tsc_ctc_ratio_n / + decoder->tsc_ctc_ratio_d; +- +- /* +- * Allow for timestamps appearing to backwards because a TSC +- * packet has slipped past a MTC packet, so allow 2 MTC ticks +- * or ... +- */ +- decoder->tsc_slip = multdiv(2 << decoder->mtc_shift, +- decoder->tsc_ctc_ratio_n, +- decoder->tsc_ctc_ratio_d); + } +- /* ... or 0x100 paranoia */ +- if (decoder->tsc_slip < 0x100) +- decoder->tsc_slip = 0x100; ++ ++ /* ++ * A TSC packet can slip past MTC packets so that the timestamp appears ++ * to go backwards. One estimate is that can be up to about 40 CPU ++ * cycles, which is certainly less than 0x1000 TSC ticks, but accept ++ * slippage an order of magnitude more to be on the safe side. ++ */ ++ decoder->tsc_slip = 0x10000; + + intel_pt_log("timestamp: mtc_shift %u\n", decoder->mtc_shift); + intel_pt_log("timestamp: tsc_ctc_ratio_n %u\n", decoder->tsc_ctc_ratio_n); +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index 7348eea0248f..36cfc64c3824 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -773,10 +773,20 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu) + + if (!is_arm_pmu_core(name)) { + pname = pe->pmu ? pe->pmu : "cpu"; ++ ++ /* ++ * uncore alias may be from different PMU ++ * with common prefix ++ */ ++ if (pmu_is_uncore(name) && ++ !strncmp(pname, name, strlen(pname))) ++ goto new_alias; ++ + if (strcmp(pname, name)) + continue; + } + ++new_alias: + /* need type casts to override 'const' */ + __perf_pmu__new_alias(head, NULL, (char *)pe->name, + (char *)pe->desc, (char *)pe->event, +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index c436d95fd7aa..6a79df88b546 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -2815,6 +2815,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, + { + struct kvm_device *dev = filp->private_data; + ++ if (dev->kvm->mm != current->mm) ++ return -EIO; ++ + switch (ioctl) { + case KVM_SET_DEVICE_ATTR: + return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg); diff --git a/patch/kernel/sunxi-next/patch-4.19.33-34.patch b/patch/kernel/sunxi-next/patch-4.19.33-34.patch new file mode 100644 index 0000000000..b499004f7f --- /dev/null +++ b/patch/kernel/sunxi-next/patch-4.19.33-34.patch @@ -0,0 +1,6193 @@ +diff --git a/Documentation/arm/kernel_mode_neon.txt b/Documentation/arm/kernel_mode_neon.txt +index 525452726d31..b9e060c5b61e 100644 +--- a/Documentation/arm/kernel_mode_neon.txt ++++ b/Documentation/arm/kernel_mode_neon.txt +@@ -6,7 +6,7 @@ TL;DR summary + * Use only NEON instructions, or VFP instructions that don't rely on support + code + * Isolate your NEON code in a separate compilation unit, and compile it with +- '-mfpu=neon -mfloat-abi=softfp' ++ '-march=armv7-a -mfpu=neon -mfloat-abi=softfp' + * Put kernel_neon_begin() and kernel_neon_end() calls around the calls into your + NEON code + * Don't sleep in your NEON code, and be aware that it will be executed with +@@ -87,7 +87,7 @@ instructions appearing in unexpected places if no special care is taken. + Therefore, the recommended and only supported way of using NEON/VFP in the + kernel is by adhering to the following rules: + * isolate the NEON code in a separate compilation unit and compile it with +- '-mfpu=neon -mfloat-abi=softfp'; ++ '-march=armv7-a -mfpu=neon -mfloat-abi=softfp'; + * issue the calls to kernel_neon_begin(), kernel_neon_end() as well as the calls + into the unit containing the NEON code from a compilation unit which is *not* + built with the GCC flag '-mfpu=neon' set. +diff --git a/Makefile b/Makefile +index 8de5fab711d8..8fdfe0af5862 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 33 ++SUBLEVEL = 34 + EXTRAVERSION = + NAME = "People's Front" + +@@ -626,12 +626,15 @@ ifeq ($(may-sync-config),1) + -include include/config/auto.conf.cmd + + # To avoid any implicit rule to kick in, define an empty command +-$(KCONFIG_CONFIG) include/config/auto.conf.cmd: ; ++$(KCONFIG_CONFIG): ; + + # The actual configuration files used during the build are stored in + # include/generated/ and include/config/. Update them if .config is newer than + # include/config/auto.conf (which mirrors .config). +-include/config/%.conf: $(KCONFIG_CONFIG) include/config/auto.conf.cmd ++# ++# This exploits the 'multi-target pattern rule' trick. ++# The syncconfig should be executed only once to make all the targets. ++%/auto.conf %/auto.conf.cmd %/tristate.conf: $(KCONFIG_CONFIG) + $(Q)$(MAKE) -f $(srctree)/Makefile syncconfig + else + # External modules and some install targets need include/generated/autoconf.h +diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi +index abff7ef7c9cd..4981741377f3 100644 +--- a/arch/arm/boot/dts/lpc32xx.dtsi ++++ b/arch/arm/boot/dts/lpc32xx.dtsi +@@ -230,7 +230,7 @@ + status = "disabled"; + }; + +- i2s1: i2s@2009C000 { ++ i2s1: i2s@2009c000 { + compatible = "nxp,lpc3220-i2s"; + reg = <0x2009C000 0x1000>; + }; +@@ -273,7 +273,7 @@ + status = "disabled"; + }; + +- i2c1: i2c@400A0000 { ++ i2c1: i2c@400a0000 { + compatible = "nxp,pnx-i2c"; + reg = <0x400A0000 0x100>; + interrupt-parent = <&sic1>; +@@ -284,7 +284,7 @@ + clocks = <&clk LPC32XX_CLK_I2C1>; + }; + +- i2c2: i2c@400A8000 { ++ i2c2: i2c@400a8000 { + compatible = "nxp,pnx-i2c"; + reg = <0x400A8000 0x100>; + interrupt-parent = <&sic1>; +@@ -295,7 +295,7 @@ + clocks = <&clk LPC32XX_CLK_I2C2>; + }; + +- mpwm: mpwm@400E8000 { ++ mpwm: mpwm@400e8000 { + compatible = "nxp,lpc3220-motor-pwm"; + reg = <0x400E8000 0x78>; + status = "disabled"; +@@ -394,7 +394,7 @@ + #gpio-cells = <3>; /* bank, pin, flags */ + }; + +- timer4: timer@4002C000 { ++ timer4: timer@4002c000 { + compatible = "nxp,lpc3220-timer"; + reg = <0x4002C000 0x1000>; + interrupts = <3 IRQ_TYPE_LEVEL_LOW>; +@@ -412,7 +412,7 @@ + status = "disabled"; + }; + +- watchdog: watchdog@4003C000 { ++ watchdog: watchdog@4003c000 { + compatible = "nxp,pnx4008-wdt"; + reg = <0x4003C000 0x1000>; + clocks = <&clk LPC32XX_CLK_WDOG>; +@@ -451,7 +451,7 @@ + status = "disabled"; + }; + +- timer1: timer@4004C000 { ++ timer1: timer@4004c000 { + compatible = "nxp,lpc3220-timer"; + reg = <0x4004C000 0x1000>; + interrupts = <17 IRQ_TYPE_LEVEL_LOW>; +@@ -475,7 +475,7 @@ + status = "disabled"; + }; + +- pwm1: pwm@4005C000 { ++ pwm1: pwm@4005c000 { + compatible = "nxp,lpc3220-pwm"; + reg = <0x4005C000 0x4>; + clocks = <&clk LPC32XX_CLK_PWM1>; +@@ -484,7 +484,7 @@ + status = "disabled"; + }; + +- pwm2: pwm@4005C004 { ++ pwm2: pwm@4005c004 { + compatible = "nxp,lpc3220-pwm"; + reg = <0x4005C004 0x4>; + clocks = <&clk LPC32XX_CLK_PWM2>; +diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi +index 08f7f6be7254..5b3e5c50c72f 100644 +--- a/arch/arm/boot/dts/meson8b.dtsi ++++ b/arch/arm/boot/dts/meson8b.dtsi +@@ -207,9 +207,7 @@ + groups = "eth_tx_clk", + "eth_tx_en", + "eth_txd1_0", +- "eth_txd1_1", + "eth_txd0_0", +- "eth_txd0_1", + "eth_rx_clk", + "eth_rx_dv", + "eth_rxd1", +@@ -218,7 +216,9 @@ + "eth_mdc", + "eth_ref_clk", + "eth_txd2", +- "eth_txd3"; ++ "eth_txd3", ++ "eth_rxd3", ++ "eth_rxd2"; + function = "ethernet"; + }; + }; +diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h +index 69772e742a0a..83ae97c049d9 100644 +--- a/arch/arm/include/asm/barrier.h ++++ b/arch/arm/include/asm/barrier.h +@@ -11,6 +11,8 @@ + #define sev() __asm__ __volatile__ ("sev" : : : "memory") + #define wfe() __asm__ __volatile__ ("wfe" : : : "memory") + #define wfi() __asm__ __volatile__ ("wfi" : : : "memory") ++#else ++#define wfe() do { } while (0) + #endif + + #if __LINUX_ARM_ARCH__ >= 7 +diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h +index 1bf65b47808a..cb2a3423b714 100644 +--- a/arch/arm/include/asm/processor.h ++++ b/arch/arm/include/asm/processor.h +@@ -95,7 +95,11 @@ extern void release_thread(struct task_struct *); + unsigned long get_wchan(struct task_struct *p); + + #if __LINUX_ARM_ARCH__ == 6 || defined(CONFIG_ARM_ERRATA_754327) +-#define cpu_relax() smp_mb() ++#define cpu_relax() \ ++ do { \ ++ smp_mb(); \ ++ __asm__ __volatile__("nop; nop; nop; nop; nop; nop; nop; nop; nop; nop;"); \ ++ } while (0) + #else + #define cpu_relax() barrier() + #endif +diff --git a/arch/arm/include/asm/v7m.h b/arch/arm/include/asm/v7m.h +index 187ccf6496ad..2cb00d15831b 100644 +--- a/arch/arm/include/asm/v7m.h ++++ b/arch/arm/include/asm/v7m.h +@@ -49,7 +49,7 @@ + * (0 -> msp; 1 -> psp). Bits [1:0] are fixed to 0b01. + */ + #define EXC_RET_STACK_MASK 0x00000004 +-#define EXC_RET_THREADMODE_PROCESSSTACK 0xfffffffd ++#define EXC_RET_THREADMODE_PROCESSSTACK (3 << 2) + + /* Cache related definitions */ + +diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S +index 773424843d6e..62db1c9746cb 100644 +--- a/arch/arm/kernel/entry-header.S ++++ b/arch/arm/kernel/entry-header.S +@@ -127,7 +127,8 @@ + */ + .macro v7m_exception_slow_exit ret_r0 + cpsid i +- ldr lr, =EXC_RET_THREADMODE_PROCESSSTACK ++ ldr lr, =exc_ret ++ ldr lr, [lr] + + @ read original r12, sp, lr, pc and xPSR + add r12, sp, #S_IP +diff --git a/arch/arm/kernel/entry-v7m.S b/arch/arm/kernel/entry-v7m.S +index abcf47848525..19d2dcd6530d 100644 +--- a/arch/arm/kernel/entry-v7m.S ++++ b/arch/arm/kernel/entry-v7m.S +@@ -146,3 +146,7 @@ ENTRY(vector_table) + .rept CONFIG_CPU_V7M_NUM_IRQ + .long __irq_entry @ External Interrupts + .endr ++ .align 2 ++ .globl exc_ret ++exc_ret: ++ .space 4 +diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c +index dd2eb5f76b9f..76300f3813e8 100644 +--- a/arch/arm/kernel/machine_kexec.c ++++ b/arch/arm/kernel/machine_kexec.c +@@ -91,8 +91,11 @@ void machine_crash_nonpanic_core(void *unused) + + set_cpu_online(smp_processor_id(), false); + atomic_dec(&waiting_for_crash_ipi); +- while (1) ++ ++ while (1) { + cpu_relax(); ++ wfe(); ++ } + } + + void crash_smp_send_stop(void) +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index 1d6f5ea522f4..a3ce7c5365fa 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -604,8 +604,10 @@ static void ipi_cpu_stop(unsigned int cpu) + local_fiq_disable(); + local_irq_disable(); + +- while (1) ++ while (1) { + cpu_relax(); ++ wfe(); ++ } + } + + static DEFINE_PER_CPU(struct completion *, cpu_completion); +diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c +index 0bee233fef9a..314cfb232a63 100644 +--- a/arch/arm/kernel/unwind.c ++++ b/arch/arm/kernel/unwind.c +@@ -93,7 +93,7 @@ extern const struct unwind_idx __start_unwind_idx[]; + static const struct unwind_idx *__origin_unwind_idx; + extern const struct unwind_idx __stop_unwind_idx[]; + +-static DEFINE_SPINLOCK(unwind_lock); ++static DEFINE_RAW_SPINLOCK(unwind_lock); + static LIST_HEAD(unwind_tables); + + /* Convert a prel31 symbol to an absolute address */ +@@ -201,7 +201,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr) + /* module unwind tables */ + struct unwind_table *table; + +- spin_lock_irqsave(&unwind_lock, flags); ++ raw_spin_lock_irqsave(&unwind_lock, flags); + list_for_each_entry(table, &unwind_tables, list) { + if (addr >= table->begin_addr && + addr < table->end_addr) { +@@ -213,7 +213,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr) + break; + } + } +- spin_unlock_irqrestore(&unwind_lock, flags); ++ raw_spin_unlock_irqrestore(&unwind_lock, flags); + } + + pr_debug("%s: idx = %p\n", __func__, idx); +@@ -529,9 +529,9 @@ struct unwind_table *unwind_table_add(unsigned long start, unsigned long size, + tab->begin_addr = text_addr; + tab->end_addr = text_addr + text_size; + +- spin_lock_irqsave(&unwind_lock, flags); ++ raw_spin_lock_irqsave(&unwind_lock, flags); + list_add_tail(&tab->list, &unwind_tables); +- spin_unlock_irqrestore(&unwind_lock, flags); ++ raw_spin_unlock_irqrestore(&unwind_lock, flags); + + return tab; + } +@@ -543,9 +543,9 @@ void unwind_table_del(struct unwind_table *tab) + if (!tab) + return; + +- spin_lock_irqsave(&unwind_lock, flags); ++ raw_spin_lock_irqsave(&unwind_lock, flags); + list_del(&tab->list); +- spin_unlock_irqrestore(&unwind_lock, flags); ++ raw_spin_unlock_irqrestore(&unwind_lock, flags); + + kfree(tab); + } +diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile +index ad25fd1872c7..0bff0176db2c 100644 +--- a/arch/arm/lib/Makefile ++++ b/arch/arm/lib/Makefile +@@ -39,7 +39,7 @@ $(obj)/csumpartialcopy.o: $(obj)/csumpartialcopygeneric.S + $(obj)/csumpartialcopyuser.o: $(obj)/csumpartialcopygeneric.S + + ifeq ($(CONFIG_KERNEL_MODE_NEON),y) +- NEON_FLAGS := -mfloat-abi=softfp -mfpu=neon ++ NEON_FLAGS := -march=armv7-a -mfloat-abi=softfp -mfpu=neon + CFLAGS_xor-neon.o += $(NEON_FLAGS) + obj-$(CONFIG_XOR_BLOCKS) += xor-neon.o + endif +diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c +index 2c40aeab3eaa..c691b901092f 100644 +--- a/arch/arm/lib/xor-neon.c ++++ b/arch/arm/lib/xor-neon.c +@@ -14,7 +14,7 @@ + MODULE_LICENSE("GPL"); + + #ifndef __ARM_NEON__ +-#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon' ++#error You should compile this file with '-march=armv7-a -mfloat-abi=softfp -mfpu=neon' + #endif + + /* +diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c +index 058a37e6d11c..fd6e0671f957 100644 +--- a/arch/arm/mach-omap2/prm_common.c ++++ b/arch/arm/mach-omap2/prm_common.c +@@ -523,8 +523,10 @@ void omap_prm_reset_system(void) + + prm_ll_data->reset_system(); + +- while (1) ++ while (1) { + cpu_relax(); ++ wfe(); ++ } + } + + /** +diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S +index 47a5acc64433..92e84181933a 100644 +--- a/arch/arm/mm/proc-v7m.S ++++ b/arch/arm/mm/proc-v7m.S +@@ -139,6 +139,9 @@ __v7m_setup_cont: + cpsie i + svc #0 + 1: cpsid i ++ ldr r0, =exc_ret ++ orr lr, lr, #EXC_RET_THREADMODE_PROCESSSTACK ++ str lr, [r0] + ldmia sp, {r0-r3, r12} + str r5, [r12, #11 * 4] @ restore the original SVC vector entry + mov lr, r6 @ restore LR +diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c +index 50b30ff30de4..a4c134677285 100644 +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -827,11 +827,12 @@ void __init hook_debug_fault_code(int nr, + debug_fault_info[nr].name = name; + } + +-asmlinkage int __exception do_debug_exception(unsigned long addr, ++asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint, + unsigned int esr, + struct pt_regs *regs) + { + const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); ++ unsigned long pc = instruction_pointer(regs); + int rv; + + /* +@@ -841,10 +842,10 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, + if (interrupts_enabled(regs)) + trace_hardirqs_off(); + +- if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE) ++ if (user_mode(regs) && pc > TASK_SIZE) + arm64_apply_bp_hardening(); + +- if (!inf->fn(addr, esr, regs)) { ++ if (!inf->fn(addr_if_watchpoint, esr, regs)) { + rv = 1; + } else { + struct siginfo info; +@@ -853,7 +854,7 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, + info.si_signo = inf->sig; + info.si_errno = 0; + info.si_code = inf->code; +- info.si_addr = (void __user *)addr; ++ info.si_addr = (void __user *)pc; + arm64_notify_die(inf->name, regs, &info, esr); + rv = 0; + } +diff --git a/arch/h8300/Makefile b/arch/h8300/Makefile +index 58634e6bae92..55f251810129 100644 +--- a/arch/h8300/Makefile ++++ b/arch/h8300/Makefile +@@ -27,7 +27,7 @@ KBUILD_LDFLAGS += $(ldflags-y) + CHECKFLAGS += -msize-long + + ifeq ($(CROSS_COMPILE),) +-CROSS_COMPILE := h8300-unknown-linux- ++CROSS_COMPILE := $(call cc-cross-prefix, h8300-unknown-linux- h8300-linux-) + endif + + core-y += arch/$(ARCH)/kernel/ arch/$(ARCH)/mm/ +diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h +index a4a718dbfec6..f85e2b01c3df 100644 +--- a/arch/powerpc/include/asm/topology.h ++++ b/arch/powerpc/include/asm/topology.h +@@ -132,6 +132,8 @@ static inline void shared_proc_topology_init(void) {} + #define topology_sibling_cpumask(cpu) (per_cpu(cpu_sibling_map, cpu)) + #define topology_core_cpumask(cpu) (per_cpu(cpu_core_map, cpu)) + #define topology_core_id(cpu) (cpu_to_core_id(cpu)) ++ ++int dlpar_cpu_readd(int cpu); + #endif + #endif + +diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S +index c806a3c12592..7a46e0e57a36 100644 +--- a/arch/powerpc/kernel/entry_64.S ++++ b/arch/powerpc/kernel/entry_64.S +@@ -994,6 +994,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) + ld r2,_NIP(r1) + mtspr SPRN_SRR0,r2 + ++ /* ++ * Leaving a stale exception_marker on the stack can confuse ++ * the reliable stack unwinder later on. Clear it. ++ */ ++ li r2,0 ++ std r2,STACK_FRAME_OVERHEAD-16(r1) ++ + ld r0,GPR0(r1) + ld r2,GPR2(r1) + ld r3,GPR3(r1) +diff --git a/arch/powerpc/mm/hugetlbpage-radix.c b/arch/powerpc/mm/hugetlbpage-radix.c +index 2486bee0f93e..97c7a39ebc00 100644 +--- a/arch/powerpc/mm/hugetlbpage-radix.c ++++ b/arch/powerpc/mm/hugetlbpage-radix.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + #include + #include ++#include + #include + #include + #include +@@ -73,7 +74,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr, + if (addr) { + addr = ALIGN(addr, huge_page_size(h)); + vma = find_vma(mm, addr); +- if (high_limit - len >= addr && ++ if (high_limit - len >= addr && addr >= mmap_min_addr && + (!vma || addr + len <= vm_start_gap(vma))) + return addr; + } +@@ -83,7 +84,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr, + */ + info.flags = VM_UNMAPPED_AREA_TOPDOWN; + info.length = len; +- info.low_limit = PAGE_SIZE; ++ info.low_limit = max(PAGE_SIZE, mmap_min_addr); + info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW); + info.align_mask = PAGE_MASK & ~huge_page_mask(h); + info.align_offset = 0; +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index 5500e4edabc6..10fb43efef50 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -1461,13 +1461,6 @@ static void reset_topology_timer(void) + + #ifdef CONFIG_SMP + +-static void stage_topology_update(int core_id) +-{ +- cpumask_or(&cpu_associativity_changes_mask, +- &cpu_associativity_changes_mask, cpu_sibling_mask(core_id)); +- reset_topology_timer(); +-} +- + static int dt_update_callback(struct notifier_block *nb, + unsigned long action, void *data) + { +@@ -1480,7 +1473,7 @@ static int dt_update_callback(struct notifier_block *nb, + !of_prop_cmp(update->prop->name, "ibm,associativity")) { + u32 core_id; + of_property_read_u32(update->dn, "reg", &core_id); +- stage_topology_update(core_id); ++ rc = dlpar_cpu_readd(core_id); + rc = NOTIFY_OK; + } + break; +diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c +index 7639b2168755..f5adb6b756f7 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c +@@ -313,7 +313,6 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset, + page_shift); + tbl->it_level_size = 1ULL << (level_shift - 3); + tbl->it_indirect_levels = levels - 1; +- tbl->it_allocated_size = total_allocated; + tbl->it_userspace = uas; + tbl->it_nid = nid; + +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index cde710297a4e..326ca6288bb1 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -2603,8 +2603,13 @@ static long pnv_pci_ioda2_create_table_userspace( + int num, __u32 page_shift, __u64 window_size, __u32 levels, + struct iommu_table **ptbl) + { +- return pnv_pci_ioda2_create_table(table_group, ++ long ret = pnv_pci_ioda2_create_table(table_group, + num, page_shift, window_size, levels, true, ptbl); ++ ++ if (!ret) ++ (*ptbl)->it_allocated_size = pnv_pci_ioda2_get_table_size( ++ page_shift, window_size, levels); ++ return ret; + } + + static void pnv_ioda2_take_ownership(struct iommu_table_group *table_group) +diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c +index 6ef77caf7bcf..1d3f9313c02f 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c ++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c +@@ -802,6 +802,25 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add) + return rc; + } + ++int dlpar_cpu_readd(int cpu) ++{ ++ struct device_node *dn; ++ struct device *dev; ++ u32 drc_index; ++ int rc; ++ ++ dev = get_cpu_device(cpu); ++ dn = dev->of_node; ++ ++ rc = of_property_read_u32(dn, "ibm,my-drc-index", &drc_index); ++ ++ rc = dlpar_cpu_remove_by_index(drc_index); ++ if (!rc) ++ rc = dlpar_cpu_add(drc_index); ++ ++ return rc; ++} ++ + int dlpar_cpu(struct pseries_hp_errorlog *hp_elog) + { + u32 count, drc_index; +diff --git a/arch/powerpc/xmon/ppc-dis.c b/arch/powerpc/xmon/ppc-dis.c +index 9deea5ee13f6..27f1e6415036 100644 +--- a/arch/powerpc/xmon/ppc-dis.c ++++ b/arch/powerpc/xmon/ppc-dis.c +@@ -158,7 +158,7 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr) + dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 + | PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM + | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 +- | PPC_OPCODE_VSX | PPC_OPCODE_VSX3), ++ | PPC_OPCODE_VSX | PPC_OPCODE_VSX3); + + /* Get the major opcode of the insn. */ + opcode = NULL; +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 5c53e977be62..44404836e9d1 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -1600,7 +1600,7 @@ static void aux_sdb_init(unsigned long sdb) + + /* + * aux_buffer_setup() - Setup AUX buffer for diagnostic mode sampling +- * @cpu: On which to allocate, -1 means current ++ * @event: Event the buffer is setup for, event->cpu == -1 means current + * @pages: Array of pointers to buffer pages passed from perf core + * @nr_pages: Total pages + * @snapshot: Flag for snapshot mode +@@ -1612,8 +1612,8 @@ static void aux_sdb_init(unsigned long sdb) + * + * Return the private AUX buffer structure if success or NULL if fails. + */ +-static void *aux_buffer_setup(int cpu, void **pages, int nr_pages, +- bool snapshot) ++static void *aux_buffer_setup(struct perf_event *event, void **pages, ++ int nr_pages, bool snapshot) + { + struct sf_buffer *sfb; + struct aux_buffer *aux; +diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile +index 9b5adae9cc40..e2839b5c246c 100644 +--- a/arch/x86/boot/Makefile ++++ b/arch/x86/boot/Makefile +@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE + AFLAGS_header.o += -I$(objtree)/$(obj) + $(obj)/header.o: $(obj)/zoffset.h + +-LDFLAGS_setup.elf := -T ++LDFLAGS_setup.elf := -m elf_i386 -T + $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE + $(call if_changed,ld) + +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index f95dcb209fdf..617df50a11d9 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -627,6 +627,7 @@ ENTRY(interrupt_entry) + + ret + END(interrupt_entry) ++_ASM_NOKPROBE(interrupt_entry) + + + /* Interrupt entry/exit. */ +@@ -826,6 +827,7 @@ native_irq_return_ldt: + jmp native_irq_return_iret + #endif + END(common_interrupt) ++_ASM_NOKPROBE(common_interrupt) + + /* + * APIC interrupts. +@@ -840,6 +842,7 @@ ENTRY(\sym) + call \do_sym /* rdi points to pt_regs */ + jmp ret_from_intr + END(\sym) ++_ASM_NOKPROBE(\sym) + .endm + + /* Make sure APIC interrupt handlers end up in the irqentry section: */ +@@ -984,6 +987,7 @@ ENTRY(\sym) + + jmp error_exit + .endif ++_ASM_NOKPROBE(\sym) + END(\sym) + .endm + +diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c +index 24ffa1e88cf9..7139f6bf27ad 100644 +--- a/arch/x86/events/intel/bts.c ++++ b/arch/x86/events/intel/bts.c +@@ -77,10 +77,12 @@ static size_t buf_size(struct page *page) + } + + static void * +-bts_buffer_setup_aux(int cpu, void **pages, int nr_pages, bool overwrite) ++bts_buffer_setup_aux(struct perf_event *event, void **pages, ++ int nr_pages, bool overwrite) + { + struct bts_buffer *buf; + struct page *page; ++ int cpu = event->cpu; + int node = (cpu == -1) ? cpu : cpu_to_node(cpu); + unsigned long offset; + size_t size = nr_pages << PAGE_SHIFT; +diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c +index 8d016ce5b80d..8f4c98fdd03c 100644 +--- a/arch/x86/events/intel/pt.c ++++ b/arch/x86/events/intel/pt.c +@@ -1104,10 +1104,11 @@ static int pt_buffer_init_topa(struct pt_buffer *buf, unsigned long nr_pages, + * Return: Our private PT buffer structure. + */ + static void * +-pt_buffer_setup_aux(int cpu, void **pages, int nr_pages, bool snapshot) ++pt_buffer_setup_aux(struct perf_event *event, void **pages, ++ int nr_pages, bool snapshot) + { + struct pt_buffer *buf; +- int node, ret; ++ int node, ret, cpu = event->cpu; + + if (!nr_pages) + return NULL; +diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c +index 20c876c7c5bf..87abd5145cc9 100644 +--- a/arch/x86/hyperv/hv_init.c ++++ b/arch/x86/hyperv/hv_init.c +@@ -387,6 +387,13 @@ void hyperv_cleanup(void) + /* Reset our OS id */ + wrmsrl(HV_X64_MSR_GUEST_OS_ID, 0); + ++ /* ++ * Reset hypercall page reference before reset the page, ++ * let hypercall operations fail safely rather than ++ * panic the kernel for using invalid hypercall page ++ */ ++ hv_hypercall_pg = NULL; ++ + /* Reset the hypercall page */ + hypercall_msr.as_uint64 = 0; + wrmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64); +diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S +index 5dd3317d761f..c63bab98780c 100644 +--- a/arch/x86/kernel/vmlinux.lds.S ++++ b/arch/x86/kernel/vmlinux.lds.S +@@ -411,7 +411,7 @@ SECTIONS + * Per-cpu symbols which need to be offset from __per_cpu_load + * for the boot processor. + */ +-#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load ++#define INIT_PER_CPU(x) init_per_cpu__##x = ABSOLUTE(x) + __per_cpu_load + INIT_PER_CPU(gdt_page); + INIT_PER_CPU(irq_stack_union); + +diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile +index 4463fa72db94..96cb20de08af 100644 +--- a/arch/x86/realmode/rm/Makefile ++++ b/arch/x86/realmode/rm/Makefile +@@ -47,7 +47,7 @@ $(obj)/pasyms.h: $(REALMODE_OBJS) FORCE + targets += realmode.lds + $(obj)/realmode.lds: $(obj)/pasyms.h + +-LDFLAGS_realmode.elf := --emit-relocs -T ++LDFLAGS_realmode.elf := -m elf_i386 --emit-relocs -T + CPPFLAGS_realmode.lds += -P -C -I$(objtree)/$(obj) + + targets += realmode.elf +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 653100fb719e..c5e2c5a01182 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2215,7 +2215,8 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + + if (in_service_bfqq && in_service_bfqq != bfqq && + likely(in_service_bfqq != &bfqd->oom_bfqq) && +- bfq_rq_close_to_sector(io_struct, request, bfqd->last_position) && ++ bfq_rq_close_to_sector(io_struct, request, ++ bfqd->in_serv_last_pos) && + bfqq->entity.parent == in_service_bfqq->entity.parent && + bfq_may_be_close_cooperator(bfqq, in_service_bfqq)) { + new_bfqq = bfq_setup_merge(bfqq, in_service_bfqq); +@@ -2755,6 +2756,8 @@ update_rate_and_reset: + bfq_update_rate_reset(bfqd, rq); + update_last_values: + bfqd->last_position = blk_rq_pos(rq) + blk_rq_sectors(rq); ++ if (RQ_BFQQ(rq) == bfqd->in_service_queue) ++ bfqd->in_serv_last_pos = bfqd->last_position; + bfqd->last_dispatch = now_ns; + } + +diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h +index a8a2e5aca4d4..d5e9e60cb1a5 100644 +--- a/block/bfq-iosched.h ++++ b/block/bfq-iosched.h +@@ -469,6 +469,9 @@ struct bfq_data { + /* on-disk position of the last served request */ + sector_t last_position; + ++ /* position of the last served request for the in-service queue */ ++ sector_t in_serv_last_pos; ++ + /* time of last request completion (ns) */ + u64 last_completion; + +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index f0b52266b3ac..d73afb562ad9 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -2124,21 +2124,29 @@ static int __init intel_opregion_present(void) + return opregion; + } + ++/* Check if the chassis-type indicates there is no builtin LCD panel */ + static bool dmi_is_desktop(void) + { + const char *chassis_type; ++ unsigned long type; + + chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE); + if (!chassis_type) + return false; + +- if (!strcmp(chassis_type, "3") || /* 3: Desktop */ +- !strcmp(chassis_type, "4") || /* 4: Low Profile Desktop */ +- !strcmp(chassis_type, "5") || /* 5: Pizza Box */ +- !strcmp(chassis_type, "6") || /* 6: Mini Tower */ +- !strcmp(chassis_type, "7") || /* 7: Tower */ +- !strcmp(chassis_type, "11")) /* 11: Main Server Chassis */ ++ if (kstrtoul(chassis_type, 10, &type) != 0) ++ return false; ++ ++ switch (type) { ++ case 0x03: /* Desktop */ ++ case 0x04: /* Low Profile Desktop */ ++ case 0x05: /* Pizza Box */ ++ case 0x06: /* Mini Tower */ ++ case 0x07: /* Tower */ ++ case 0x10: /* Lunch Box */ ++ case 0x11: /* Main Server Chassis */ + return true; ++ } + + return false; + } +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 0c5aeab4d23a..a63da9e07341 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1090,16 +1090,12 @@ static int __loop_clr_fd(struct loop_device *lo, bool release) + kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); + } + mapping_set_gfp_mask(filp->f_mapping, gfp); +- lo->lo_state = Lo_unbound; + /* This is safe: open() is still holding a reference. */ + module_put(THIS_MODULE); + blk_mq_unfreeze_queue(lo->lo_queue); + + partscan = lo->lo_flags & LO_FLAGS_PARTSCAN && bdev; + lo_number = lo->lo_number; +- lo->lo_flags = 0; +- if (!part_shift) +- lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN; + loop_unprepare_queue(lo); + out_unlock: + mutex_unlock(&loop_ctl_mutex); +@@ -1121,6 +1117,23 @@ out_unlock: + /* Device is gone, no point in returning error */ + err = 0; + } ++ ++ /* ++ * lo->lo_state is set to Lo_unbound here after above partscan has ++ * finished. ++ * ++ * There cannot be anybody else entering __loop_clr_fd() as ++ * lo->lo_backing_file is already cleared and Lo_rundown state ++ * protects us from all the other places trying to change the 'lo' ++ * device. ++ */ ++ mutex_lock(&loop_ctl_mutex); ++ lo->lo_flags = 0; ++ if (!part_shift) ++ lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN; ++ lo->lo_state = Lo_unbound; ++ mutex_unlock(&loop_ctl_mutex); ++ + /* + * Need not hold loop_ctl_mutex to fput backing file. + * Calling fput holding loop_ctl_mutex triggers a circular +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index 10802d1fc554..27a82a559ab9 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -265,6 +265,7 @@ + /* #define ERRLOGMASK (CD_WARNING|CD_OPEN|CD_COUNT_TRACKS|CD_CLOSE) */ + /* #define ERRLOGMASK (CD_WARNING|CD_REG_UNREG|CD_DO_IOCTL|CD_OPEN|CD_CLOSE|CD_COUNT_TRACKS) */ + ++#include + #include + #include + #include +@@ -3693,9 +3694,9 @@ static struct ctl_table_header *cdrom_sysctl_header; + + static void cdrom_sysctl_register(void) + { +- static int initialized; ++ static atomic_t initialized = ATOMIC_INIT(0); + +- if (initialized == 1) ++ if (!atomic_add_unless(&initialized, 1, 1)) + return; + + cdrom_sysctl_header = register_sysctl_table(cdrom_root_table); +@@ -3706,8 +3707,6 @@ static void cdrom_sysctl_register(void) + cdrom_sysctl_settings.debug = debug; + cdrom_sysctl_settings.lock = lockdoor; + cdrom_sysctl_settings.check = check_media_type; +- +- initialized = 1; + } + + static void cdrom_sysctl_unregister(void) +diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c +index 4a22b4b41aef..9bffcd37cc7b 100644 +--- a/drivers/char/hpet.c ++++ b/drivers/char/hpet.c +@@ -377,7 +377,7 @@ static __init int hpet_mmap_enable(char *str) + pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled"); + return 1; + } +-__setup("hpet_mmap", hpet_mmap_enable); ++__setup("hpet_mmap=", hpet_mmap_enable); + + static int hpet_mmap(struct file *file, struct vm_area_struct *vma) + { +diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c +index b89df66ea1ae..7abd604e938c 100644 +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -73,7 +73,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + + if (!vi->busy) { + vi->busy = true; +- init_completion(&vi->have_data); ++ reinit_completion(&vi->have_data); + register_buffer(vi, buf, size); + } + +diff --git a/drivers/clk/clk-fractional-divider.c b/drivers/clk/clk-fractional-divider.c +index fdf625fb10fa..083daa293280 100644 +--- a/drivers/clk/clk-fractional-divider.c ++++ b/drivers/clk/clk-fractional-divider.c +@@ -77,7 +77,7 @@ static long clk_fd_round_rate(struct clk_hw *hw, unsigned long rate, + unsigned long m, n; + u64 ret; + +- if (!rate || rate >= *parent_rate) ++ if (!rate || (!clk_hw_can_set_rate_parent(hw) && rate >= *parent_rate)) + return *parent_rate; + + if (fd->approximation) +diff --git a/drivers/clk/meson/meson-aoclk.c b/drivers/clk/meson/meson-aoclk.c +index f965845917e3..258c8d259ea1 100644 +--- a/drivers/clk/meson/meson-aoclk.c ++++ b/drivers/clk/meson/meson-aoclk.c +@@ -65,15 +65,20 @@ int meson_aoclkc_probe(struct platform_device *pdev) + return ret; + } + +- /* +- * Populate regmap and register all clks +- */ +- for (clkid = 0; clkid < data->num_clks; clkid++) { ++ /* Populate regmap */ ++ for (clkid = 0; clkid < data->num_clks; clkid++) + data->clks[clkid]->map = regmap; + ++ /* Register all clks */ ++ for (clkid = 0; clkid < data->hw_data->num; clkid++) { ++ if (!data->hw_data->hws[clkid]) ++ continue; ++ + ret = devm_clk_hw_register(dev, data->hw_data->hws[clkid]); +- if (ret) ++ if (ret) { ++ dev_err(dev, "Clock registration failed\n"); + return ret; ++ } + } + + return devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get, +diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c +index 2c5426607790..e431661fe874 100644 +--- a/drivers/clk/rockchip/clk-rk3328.c ++++ b/drivers/clk/rockchip/clk-rk3328.c +@@ -78,17 +78,17 @@ static struct rockchip_pll_rate_table rk3328_pll_rates[] = { + + static struct rockchip_pll_rate_table rk3328_pll_frac_rates[] = { + /* _mhz, _refdiv, _fbdiv, _postdiv1, _postdiv2, _dsmpd, _frac */ +- RK3036_PLL_RATE(1016064000, 3, 127, 1, 1, 0, 134217), ++ RK3036_PLL_RATE(1016064000, 3, 127, 1, 1, 0, 134218), + /* vco = 1016064000 */ +- RK3036_PLL_RATE(983040000, 24, 983, 1, 1, 0, 671088), ++ RK3036_PLL_RATE(983040000, 24, 983, 1, 1, 0, 671089), + /* vco = 983040000 */ +- RK3036_PLL_RATE(491520000, 24, 983, 2, 1, 0, 671088), ++ RK3036_PLL_RATE(491520000, 24, 983, 2, 1, 0, 671089), + /* vco = 983040000 */ +- RK3036_PLL_RATE(61440000, 6, 215, 7, 2, 0, 671088), ++ RK3036_PLL_RATE(61440000, 6, 215, 7, 2, 0, 671089), + /* vco = 860156000 */ +- RK3036_PLL_RATE(56448000, 12, 451, 4, 4, 0, 9797894), ++ RK3036_PLL_RATE(56448000, 12, 451, 4, 4, 0, 9797895), + /* vco = 903168000 */ +- RK3036_PLL_RATE(40960000, 12, 409, 4, 5, 0, 10066329), ++ RK3036_PLL_RATE(40960000, 12, 409, 4, 5, 0, 10066330), + /* vco = 819200000 */ + { /* sentinel */ }, + }; +diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c +index b61f4ec43e06..aca30f45172e 100644 +--- a/drivers/cpufreq/acpi-cpufreq.c ++++ b/drivers/cpufreq/acpi-cpufreq.c +@@ -911,8 +911,10 @@ static void __init acpi_cpufreq_boost_init(void) + { + int ret; + +- if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA))) ++ if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA))) { ++ pr_debug("Boost capabilities not present in the processor\n"); + return; ++ } + + acpi_cpufreq_driver.set_boost = set_boost; + acpi_cpufreq_driver.boost_enabled = boost_state(0); +diff --git a/drivers/crypto/amcc/crypto4xx_trng.c b/drivers/crypto/amcc/crypto4xx_trng.c +index 5e63742b0d22..53ab1f140a26 100644 +--- a/drivers/crypto/amcc/crypto4xx_trng.c ++++ b/drivers/crypto/amcc/crypto4xx_trng.c +@@ -80,8 +80,10 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev) + + /* Find the TRNG device node and map it */ + trng = of_find_matching_node(NULL, ppc4xx_trng_match); +- if (!trng || !of_device_is_available(trng)) ++ if (!trng || !of_device_is_available(trng)) { ++ of_node_put(trng); + return; ++ } + + dev->trng_base = of_iomap(trng, 0); + of_node_put(trng); +diff --git a/drivers/crypto/cavium/zip/zip_main.c b/drivers/crypto/cavium/zip/zip_main.c +index be055b9547f6..6183f9128a8a 100644 +--- a/drivers/crypto/cavium/zip/zip_main.c ++++ b/drivers/crypto/cavium/zip/zip_main.c +@@ -351,6 +351,7 @@ static struct pci_driver zip_driver = { + + static struct crypto_alg zip_comp_deflate = { + .cra_name = "deflate", ++ .cra_driver_name = "deflate-cavium", + .cra_flags = CRYPTO_ALG_TYPE_COMPRESS, + .cra_ctxsize = sizeof(struct zip_kernel_ctx), + .cra_priority = 300, +@@ -365,6 +366,7 @@ static struct crypto_alg zip_comp_deflate = { + + static struct crypto_alg zip_comp_lzs = { + .cra_name = "lzs", ++ .cra_driver_name = "lzs-cavium", + .cra_flags = CRYPTO_ALG_TYPE_COMPRESS, + .cra_ctxsize = sizeof(struct zip_kernel_ctx), + .cra_priority = 300, +@@ -384,7 +386,7 @@ static struct scomp_alg zip_scomp_deflate = { + .decompress = zip_scomp_decompress, + .base = { + .cra_name = "deflate", +- .cra_driver_name = "deflate-scomp", ++ .cra_driver_name = "deflate-scomp-cavium", + .cra_module = THIS_MODULE, + .cra_priority = 300, + } +@@ -397,7 +399,7 @@ static struct scomp_alg zip_scomp_lzs = { + .decompress = zip_scomp_decompress, + .base = { + .cra_name = "lzs", +- .cra_driver_name = "lzs-scomp", ++ .cra_driver_name = "lzs-scomp-cavium", + .cra_module = THIS_MODULE, + .cra_priority = 300, + } +diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c +index 118d371a2a4a..dfee0d895ce3 100644 +--- a/drivers/dma/imx-dma.c ++++ b/drivers/dma/imx-dma.c +@@ -284,7 +284,7 @@ static inline int imxdma_sg_next(struct imxdma_desc *d) + struct scatterlist *sg = d->sg; + unsigned long now; + +- now = min(d->len, sg_dma_len(sg)); ++ now = min_t(size_t, d->len, sg_dma_len(sg)); + if (d->len != IMX_DMA_LENGTH_LOOP) + d->len -= now; + +diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c +index 43d4b00b8138..411f91fde734 100644 +--- a/drivers/dma/qcom/hidma.c ++++ b/drivers/dma/qcom/hidma.c +@@ -138,24 +138,25 @@ static void hidma_process_completed(struct hidma_chan *mchan) + desc = &mdesc->desc; + last_cookie = desc->cookie; + ++ llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch); ++ + spin_lock_irqsave(&mchan->lock, irqflags); ++ if (llstat == DMA_COMPLETE) { ++ mchan->last_success = last_cookie; ++ result.result = DMA_TRANS_NOERROR; ++ } else { ++ result.result = DMA_TRANS_ABORTED; ++ } ++ + dma_cookie_complete(desc); + spin_unlock_irqrestore(&mchan->lock, irqflags); + +- llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch); + dmaengine_desc_get_callback(desc, &cb); + + dma_run_dependencies(desc); + + spin_lock_irqsave(&mchan->lock, irqflags); + list_move(&mdesc->node, &mchan->free); +- +- if (llstat == DMA_COMPLETE) { +- mchan->last_success = last_cookie; +- result.result = DMA_TRANS_NOERROR; +- } else +- result.result = DMA_TRANS_ABORTED; +- + spin_unlock_irqrestore(&mchan->lock, irqflags); + + dmaengine_desc_callback_invoke(&cb, &result); +@@ -415,6 +416,7 @@ hidma_prep_dma_memcpy(struct dma_chan *dmach, dma_addr_t dest, dma_addr_t src, + if (!mdesc) + return NULL; + ++ mdesc->desc.flags = flags; + hidma_ll_set_transfer_params(mdma->lldev, mdesc->tre_ch, + src, dest, len, flags, + HIDMA_TRE_MEMCPY); +@@ -447,6 +449,7 @@ hidma_prep_dma_memset(struct dma_chan *dmach, dma_addr_t dest, int value, + if (!mdesc) + return NULL; + ++ mdesc->desc.flags = flags; + hidma_ll_set_transfer_params(mdma->lldev, mdesc->tre_ch, + value, dest, len, flags, + HIDMA_TRE_MEMSET); +diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c +index 9a558e30c461..8219ab88a507 100644 +--- a/drivers/dma/tegra20-apb-dma.c ++++ b/drivers/dma/tegra20-apb-dma.c +@@ -636,7 +636,10 @@ static void handle_cont_sngl_cycle_dma_done(struct tegra_dma_channel *tdc, + + sgreq = list_first_entry(&tdc->pending_sg_req, typeof(*sgreq), node); + dma_desc = sgreq->dma_desc; +- dma_desc->bytes_transferred += sgreq->req_len; ++ /* if we dma for long enough the transfer count will wrap */ ++ dma_desc->bytes_transferred = ++ (dma_desc->bytes_transferred + sgreq->req_len) % ++ dma_desc->bytes_requested; + + /* Callback need to be call */ + if (!dma_desc->cb_count) +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index a7902fccdcfa..6090d25dce85 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -546,19 +546,24 @@ EXPORT_SYMBOL_GPL(cper_estatus_check_header); + int cper_estatus_check(const struct acpi_hest_generic_status *estatus) + { + struct acpi_hest_generic_data *gdata; +- unsigned int data_len, gedata_len; ++ unsigned int data_len, record_size; + int rc; + + rc = cper_estatus_check_header(estatus); + if (rc) + return rc; ++ + data_len = estatus->data_length; + + apei_estatus_for_each_section(estatus, gdata) { +- gedata_len = acpi_hest_get_error_length(gdata); +- if (gedata_len > data_len - acpi_hest_get_size(gdata)) ++ if (sizeof(struct acpi_hest_generic_data) > data_len) ++ return -EINVAL; ++ ++ record_size = acpi_hest_get_record_size(gdata); ++ if (record_size > data_len) + return -EINVAL; +- data_len -= acpi_hest_get_record_size(gdata); ++ ++ data_len -= record_size; + } + if (data_len) + return -EINVAL; +diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c +index 6920033de6d4..6c09644d620e 100644 +--- a/drivers/firmware/efi/libstub/arm-stub.c ++++ b/drivers/firmware/efi/libstub/arm-stub.c +@@ -340,6 +340,11 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size, + paddr = in->phys_addr; + size = in->num_pages * EFI_PAGE_SIZE; + ++ if (novamap()) { ++ in->virt_addr = in->phys_addr; ++ continue; ++ } ++ + /* + * Make the mapping compatible with 64k pages: this allows + * a 4k page size kernel to kexec a 64k page size kernel and +diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c +index e94975f4655b..442f51c2a53d 100644 +--- a/drivers/firmware/efi/libstub/efi-stub-helper.c ++++ b/drivers/firmware/efi/libstub/efi-stub-helper.c +@@ -34,6 +34,7 @@ static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE; + + static int __section(.data) __nokaslr; + static int __section(.data) __quiet; ++static int __section(.data) __novamap; + + int __pure nokaslr(void) + { +@@ -43,6 +44,10 @@ int __pure is_quiet(void) + { + return __quiet; + } ++int __pure novamap(void) ++{ ++ return __novamap; ++} + + #define EFI_MMAP_NR_SLACK_SLOTS 8 + +@@ -482,6 +487,11 @@ efi_status_t efi_parse_options(char const *cmdline) + __chunk_size = -1UL; + } + ++ if (!strncmp(str, "novamap", 7)) { ++ str += strlen("novamap"); ++ __novamap = 1; ++ } ++ + /* Group words together, delimited by "," */ + while (*str && *str != ' ' && *str != ',') + str++; +diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h +index 32799cf039ef..337b52c4702c 100644 +--- a/drivers/firmware/efi/libstub/efistub.h ++++ b/drivers/firmware/efi/libstub/efistub.h +@@ -27,6 +27,7 @@ + + extern int __pure nokaslr(void); + extern int __pure is_quiet(void); ++extern int __pure novamap(void); + + #define pr_efi(sys_table, msg) do { \ + if (!is_quiet()) efi_printk(sys_table, "EFI stub: "msg); \ +diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c +index 0c0d2312f4a8..dba296a44f4e 100644 +--- a/drivers/firmware/efi/libstub/fdt.c ++++ b/drivers/firmware/efi/libstub/fdt.c +@@ -327,6 +327,9 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table, + if (status == EFI_SUCCESS) { + efi_set_virtual_address_map_t *svam; + ++ if (novamap()) ++ return EFI_SUCCESS; ++ + /* Install the new virtual address map */ + svam = sys_table->runtime->set_virtual_address_map; + status = svam(runtime_entry_count * desc_size, desc_size, +diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c +index 8986757eafaf..aac972b056d9 100644 +--- a/drivers/firmware/efi/memattr.c ++++ b/drivers/firmware/efi/memattr.c +@@ -94,7 +94,7 @@ static bool entry_is_valid(const efi_memory_desc_t *in, efi_memory_desc_t *out) + + if (!(md->attribute & EFI_MEMORY_RUNTIME)) + continue; +- if (md->virt_addr == 0) { ++ if (md->virt_addr == 0 && md->phys_addr != 0) { + /* no virtual mapping has been installed by the stub */ + break; + } +diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c +index e81008678a38..6c1acf642c8e 100644 +--- a/drivers/gpio/gpio-omap.c ++++ b/drivers/gpio/gpio-omap.c +@@ -888,14 +888,16 @@ static void omap_gpio_unmask_irq(struct irq_data *d) + if (trigger) + omap_set_gpio_triggering(bank, offset, trigger); + +- /* For level-triggered GPIOs, the clearing must be done after +- * the HW source is cleared, thus after the handler has run */ +- if (bank->level_mask & BIT(offset)) { +- omap_set_gpio_irqenable(bank, offset, 0); ++ omap_set_gpio_irqenable(bank, offset, 1); ++ ++ /* ++ * For level-triggered GPIOs, clearing must be done after the source ++ * is cleared, thus after the handler has run. OMAP4 needs this done ++ * after enabing the interrupt to clear the wakeup status. ++ */ ++ if (bank->level_mask & BIT(offset)) + omap_clear_gpio_irqstatus(bank, offset); +- } + +- omap_set_gpio_irqenable(bank, offset, 1); + raw_spin_unlock_irqrestore(&bank->lock, flags); + } + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index c5ba9128b736..2b8b892eb846 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4368,7 +4368,8 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, + static void amdgpu_dm_crtc_copy_transient_flags(struct drm_crtc_state *crtc_state, + struct dc_stream_state *stream_state) + { +- stream_state->mode_changed = crtc_state->mode_changed; ++ stream_state->mode_changed = ++ crtc_state->mode_changed || crtc_state->active_changed; + } + + static int amdgpu_dm_atomic_commit(struct drm_device *dev, +@@ -4389,10 +4390,22 @@ static int amdgpu_dm_atomic_commit(struct drm_device *dev, + */ + for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) { + struct dm_crtc_state *dm_old_crtc_state = to_dm_crtc_state(old_crtc_state); ++ struct dm_crtc_state *dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); + struct amdgpu_crtc *acrtc = to_amdgpu_crtc(crtc); + +- if (drm_atomic_crtc_needs_modeset(new_crtc_state) && dm_old_crtc_state->stream) ++ if (drm_atomic_crtc_needs_modeset(new_crtc_state) ++ && dm_old_crtc_state->stream) { ++ /* ++ * CRC capture was enabled but not disabled. ++ * Release the vblank reference. ++ */ ++ if (dm_new_crtc_state->crc_enabled) { ++ drm_crtc_vblank_put(crtc); ++ dm_new_crtc_state->crc_enabled = false; ++ } ++ + manage_dm_interrupts(adev, acrtc, false); ++ } + } + /* Add check here for SoC's that support hardware cursor plane, to + * unset legacy_cursor_update */ +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c +index 6a6d977ddd7a..36a0bed9af07 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c +@@ -51,6 +51,7 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name, + { + struct dm_crtc_state *crtc_state = to_dm_crtc_state(crtc->state); + struct dc_stream_state *stream_state = crtc_state->stream; ++ bool enable; + + enum amdgpu_dm_pipe_crc_source source = dm_parse_crc_source(src_name); + +@@ -65,28 +66,27 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name, + return -EINVAL; + } + ++ enable = (source == AMDGPU_DM_PIPE_CRC_SOURCE_AUTO); ++ ++ if (!dc_stream_configure_crc(stream_state->ctx->dc, stream_state, ++ enable, enable)) ++ return -EINVAL; ++ + /* When enabling CRC, we should also disable dithering. */ +- if (source == AMDGPU_DM_PIPE_CRC_SOURCE_AUTO) { +- if (dc_stream_configure_crc(stream_state->ctx->dc, +- stream_state, +- true, true)) { +- crtc_state->crc_enabled = true; +- dc_stream_set_dither_option(stream_state, +- DITHER_OPTION_TRUN8); +- } +- else +- return -EINVAL; +- } else { +- if (dc_stream_configure_crc(stream_state->ctx->dc, +- stream_state, +- false, false)) { +- crtc_state->crc_enabled = false; +- dc_stream_set_dither_option(stream_state, +- DITHER_OPTION_DEFAULT); +- } +- else +- return -EINVAL; +- } ++ dc_stream_set_dither_option(stream_state, ++ enable ? DITHER_OPTION_TRUN8 ++ : DITHER_OPTION_DEFAULT); ++ ++ /* ++ * Reading the CRC requires the vblank interrupt handler to be ++ * enabled. Keep a reference until CRC capture stops. ++ */ ++ if (!crtc_state->crc_enabled && enable) ++ drm_crtc_vblank_get(crtc); ++ else if (crtc_state->crc_enabled && !enable) ++ drm_crtc_vblank_put(crtc); ++ ++ crtc_state->crc_enabled = enable; + + *values_cnt = 3; + /* Reset crc_skipped on dm state */ +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 9045e6fa0780..bb0cda727605 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -958,6 +958,9 @@ static enum dc_status dc_commit_state_no_check(struct dc *dc, struct dc_state *c + /* pplib is notified if disp_num changed */ + dc->hwss.set_bandwidth(dc, context, true); + ++ for (i = 0; i < context->stream_count; i++) ++ context->streams[i]->mode_changed = false; ++ + dc_release_state(dc->current_state); + + dc->current_state = context; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index 4058b59d9bea..a0355709abd1 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -2336,9 +2336,10 @@ static void dcn10_apply_ctx_for_surface( + } + } + +- if (!pipe_ctx->plane_state && +- old_pipe_ctx->plane_state && +- old_pipe_ctx->stream_res.tg == tg) { ++ if ((!pipe_ctx->plane_state || ++ pipe_ctx->stream_res.tg != old_pipe_ctx->stream_res.tg) && ++ old_pipe_ctx->plane_state && ++ old_pipe_ctx->stream_res.tg == tg) { + + dc->hwss.plane_atomic_disconnect(dc, old_pipe_ctx); + removed_pipe[i] = true; +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index d708472d93c4..65f58e23e03d 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -3278,6 +3278,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs + msg.u.i2c_read.transactions[i].i2c_dev_id = msgs[i].addr; + msg.u.i2c_read.transactions[i].num_bytes = msgs[i].len; + msg.u.i2c_read.transactions[i].bytes = msgs[i].buf; ++ msg.u.i2c_read.transactions[i].no_stop_bit = !(msgs[i].flags & I2C_M_STOP); + } + msg.u.i2c_read.read_i2c_device_id = msgs[num - 1].addr; + msg.u.i2c_read.num_bytes_read = msgs[num - 1].len; +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index e65596617239..a0663f44e218 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -2877,7 +2877,7 @@ int drm_fb_helper_fbdev_setup(struct drm_device *dev, + return 0; + + err_drm_fb_helper_fini: +- drm_fb_helper_fini(fb_helper); ++ drm_fb_helper_fbdev_teardown(dev); + + return ret; + } +diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c +index 6153cbda239f..d36b1be632d9 100644 +--- a/drivers/gpu/drm/drm_plane.c ++++ b/drivers/gpu/drm/drm_plane.c +@@ -211,6 +211,9 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane, + format_modifier_count++; + } + ++ if (format_modifier_count) ++ config->allow_fb_modifiers = true; ++ + plane->modifier_count = format_modifier_count; + plane->modifiers = kmalloc_array(format_modifier_count, + sizeof(format_modifiers[0]), +diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +index 6a4ca139cf5d..8fd8124d72ba 100644 +--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c ++++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +@@ -750,7 +750,9 @@ static int nv17_tv_set_property(struct drm_encoder *encoder, + /* Disable the crtc to ensure a full modeset is + * performed whenever it's turned on again. */ + if (crtc) +- drm_crtc_force_disable(crtc); ++ drm_crtc_helper_set_mode(crtc, &crtc->mode, ++ crtc->x, crtc->y, ++ crtc->primary->fb); + } + + return 0; +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c +index fb46df56f0c4..0386b454e221 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c +@@ -300,6 +300,7 @@ static int rcar_du_encoders_init_one(struct rcar_du_device *rcdu, + dev_dbg(rcdu->dev, + "connected entity %pOF is disabled, skipping\n", + entity); ++ of_node_put(entity); + return -ENODEV; + } + +@@ -335,6 +336,7 @@ static int rcar_du_encoders_init_one(struct rcar_du_device *rcdu, + dev_warn(rcdu->dev, + "no encoder found for endpoint %pOF, skipping\n", + ep->local_node); ++ of_node_put(entity); + return -ENODEV; + } + +diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c +index 1ea2dd35bca9..0a271f762a0a 100644 +--- a/drivers/gpu/drm/vkms/vkms_crtc.c ++++ b/drivers/gpu/drm/vkms/vkms_crtc.c +@@ -55,6 +55,9 @@ bool vkms_get_vblank_timestamp(struct drm_device *dev, unsigned int pipe, + + *vblank_time = output->vblank_hrtimer.node.expires; + ++ if (!in_vblank_irq) ++ *vblank_time -= output->period_ns; ++ + return true; + } + +diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c +index bfbca7ec54ce..e00b9dbe220f 100644 +--- a/drivers/hid/intel-ish-hid/ipc/ipc.c ++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c +@@ -91,7 +91,10 @@ static bool check_generated_interrupt(struct ishtp_device *dev) + IPC_INT_FROM_ISH_TO_HOST_CHV_AB(pisr_val); + } else { + pisr_val = ish_reg_read(dev, IPC_REG_PISR_BXT); +- interrupt_generated = IPC_INT_FROM_ISH_TO_HOST_BXT(pisr_val); ++ interrupt_generated = !!pisr_val; ++ /* only busy-clear bit is RW, others are RO */ ++ if (pisr_val) ++ ish_reg_write(dev, IPC_REG_PISR_BXT, pisr_val); + } + + return interrupt_generated; +@@ -843,11 +846,11 @@ int ish_hw_start(struct ishtp_device *dev) + { + ish_set_host_rdy(dev); + ++ set_host_ready(dev); ++ + /* After that we can enable ISH DMA operation and wakeup ISHFW */ + ish_wakeup(dev); + +- set_host_ready(dev); +- + /* wait for FW-initiated reset flow */ + if (!dev->recvd_hw_ready) + wait_event_interruptible_timeout(dev->wait_hw_ready, +diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c +index 2623a567ffba..f546635e9ac9 100644 +--- a/drivers/hid/intel-ish-hid/ishtp/bus.c ++++ b/drivers/hid/intel-ish-hid/ishtp/bus.c +@@ -623,7 +623,8 @@ int ishtp_cl_device_bind(struct ishtp_cl *cl) + spin_lock_irqsave(&cl->dev->device_list_lock, flags); + list_for_each_entry(cl_device, &cl->dev->device_list, + device_link) { +- if (cl_device->fw_client->client_id == cl->fw_client_id) { ++ if (cl_device->fw_client && ++ cl_device->fw_client->client_id == cl->fw_client_id) { + cl->device = cl_device; + rv = 0; + break; +@@ -683,6 +684,7 @@ void ishtp_bus_remove_all_clients(struct ishtp_device *ishtp_dev, + spin_lock_irqsave(&ishtp_dev->device_list_lock, flags); + list_for_each_entry_safe(cl_device, n, &ishtp_dev->device_list, + device_link) { ++ cl_device->fw_client = NULL; + if (warm_reset && cl_device->reference_count) + continue; + +diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c +index 677695635211..0f5e03e4df22 100644 +--- a/drivers/hwtracing/coresight/coresight-etm-perf.c ++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c +@@ -181,15 +181,15 @@ static void etm_free_aux(void *data) + schedule_work(&event_data->work); + } + +-static void *etm_setup_aux(int event_cpu, void **pages, ++static void *etm_setup_aux(struct perf_event *event, void **pages, + int nr_pages, bool overwrite) + { +- int cpu; ++ int cpu = event->cpu; + cpumask_t *mask; + struct coresight_device *sink; + struct etm_event_data *event_data = NULL; + +- event_data = alloc_event_data(event_cpu); ++ event_data = alloc_event_data(cpu); + if (!event_data) + return NULL; + INIT_WORK(&event_data->work, free_event_data); +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c +index 1d94ebec027b..2bce7cf0b0af 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x.c +@@ -54,7 +54,8 @@ static void etm4_os_unlock(struct etmv4_drvdata *drvdata) + + static bool etm4_arch_supported(u8 arch) + { +- switch (arch) { ++ /* Mask out the minor version number */ ++ switch (arch & 0xf0) { + case ETM_ARCH_V4: + break; + default: +diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c +index 6cb7ad608bcd..0f01cdba9d2c 100644 +--- a/drivers/i2c/i2c-core-of.c ++++ b/drivers/i2c/i2c-core-of.c +@@ -121,6 +121,17 @@ static int of_dev_node_match(struct device *dev, void *data) + return dev->of_node == data; + } + ++static int of_dev_or_parent_node_match(struct device *dev, void *data) ++{ ++ if (dev->of_node == data) ++ return 1; ++ ++ if (dev->parent) ++ return dev->parent->of_node == data; ++ ++ return 0; ++} ++ + /* must call put_device() when done with returned i2c_client device */ + struct i2c_client *of_find_i2c_device_by_node(struct device_node *node) + { +@@ -145,7 +156,8 @@ struct i2c_adapter *of_find_i2c_adapter_by_node(struct device_node *node) + struct device *dev; + struct i2c_adapter *adapter; + +- dev = bus_find_device(&i2c_bus_type, NULL, node, of_dev_node_match); ++ dev = bus_find_device(&i2c_bus_type, NULL, node, ++ of_dev_or_parent_node_match); + if (!dev) + return NULL; + +diff --git a/drivers/iio/adc/qcom-pm8xxx-xoadc.c b/drivers/iio/adc/qcom-pm8xxx-xoadc.c +index b093ecddf1a8..54db848f0bcd 100644 +--- a/drivers/iio/adc/qcom-pm8xxx-xoadc.c ++++ b/drivers/iio/adc/qcom-pm8xxx-xoadc.c +@@ -423,18 +423,14 @@ static irqreturn_t pm8xxx_eoc_irq(int irq, void *d) + static struct pm8xxx_chan_info * + pm8xxx_get_channel(struct pm8xxx_xoadc *adc, u8 chan) + { +- struct pm8xxx_chan_info *ch; + int i; + + for (i = 0; i < adc->nchans; i++) { +- ch = &adc->chans[i]; ++ struct pm8xxx_chan_info *ch = &adc->chans[i]; + if (ch->hwchan->amux_channel == chan) +- break; ++ return ch; + } +- if (i == adc->nchans) +- return NULL; +- +- return ch; ++ return NULL; + } + + static int pm8xxx_read_channel_rsv(struct pm8xxx_xoadc *adc, +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 0f83cbec33f3..a68569ec86bf 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -1904,8 +1904,10 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb) + } + mutex_unlock(&ep->com.mutex); + +- if (release) ++ if (release) { ++ close_complete_upcall(ep, -ECONNRESET); + release_ep_resources(ep); ++ } + c4iw_put_ep(&ep->com); + return 0; + } +@@ -3608,7 +3610,6 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp) + if (close) { + if (abrupt) { + set_bit(EP_DISC_ABORT, &ep->com.history); +- close_complete_upcall(ep, -ECONNRESET); + ret = send_abort(ep); + } else { + set_bit(EP_DISC_CLOSE, &ep->com.history); +diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c +index fedaf8260105..8c79a480f2b7 100644 +--- a/drivers/infiniband/hw/mlx4/cm.c ++++ b/drivers/infiniband/hw/mlx4/cm.c +@@ -39,7 +39,7 @@ + + #include "mlx4_ib.h" + +-#define CM_CLEANUP_CACHE_TIMEOUT (5 * HZ) ++#define CM_CLEANUP_CACHE_TIMEOUT (30 * HZ) + + struct id_map_entry { + struct rb_node node; +diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c +index 23520df7650f..55cd6e0b409c 100644 +--- a/drivers/input/misc/soc_button_array.c ++++ b/drivers/input/misc/soc_button_array.c +@@ -373,7 +373,7 @@ static struct soc_button_info soc_button_PNP0C40[] = { + { "home", 1, EV_KEY, KEY_LEFTMETA, false, true }, + { "volume_up", 2, EV_KEY, KEY_VOLUMEUP, true, false }, + { "volume_down", 3, EV_KEY, KEY_VOLUMEDOWN, true, false }, +- { "rotation_lock", 4, EV_SW, SW_ROTATE_LOCK, false, false }, ++ { "rotation_lock", 4, EV_KEY, KEY_ROTATE_LOCK_TOGGLE, false, false }, + { } + }; + +diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c +index fde728ea2900..48d4709a8e93 100644 +--- a/drivers/iommu/io-pgtable-arm-v7s.c ++++ b/drivers/iommu/io-pgtable-arm-v7s.c +@@ -228,7 +228,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + if (dma != phys) + goto out_unmap; + } +- kmemleak_ignore(table); ++ if (lvl == 2) ++ kmemleak_ignore(table); + return table; + + out_unmap: +diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c +index 3d79a6380761..723f2f17497a 100644 +--- a/drivers/leds/leds-lp55xx-common.c ++++ b/drivers/leds/leds-lp55xx-common.c +@@ -201,7 +201,7 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context) + + if (!fw) { + dev_err(dev, "firmware request failed\n"); +- goto out; ++ return; + } + + /* handling firmware data is chip dependent */ +@@ -214,9 +214,9 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context) + + mutex_unlock(&chip->lock); + +-out: + /* firmware should be released for other channel use */ + release_firmware(chip->fw); ++ chip->fw = NULL; + } + + static int lp55xx_request_firmware(struct lp55xx_chip *chip) +diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c +index 26f035a0c5b9..d9481640b3e1 100644 +--- a/drivers/md/bcache/sysfs.c ++++ b/drivers/md/bcache/sysfs.c +@@ -283,8 +283,12 @@ STORE(__cached_dev) + sysfs_strtoul_clamp(writeback_rate_update_seconds, + dc->writeback_rate_update_seconds, + 1, WRITEBACK_RATE_UPDATE_SECS_MAX); +- d_strtoul(writeback_rate_i_term_inverse); +- d_strtoul_nonzero(writeback_rate_p_term_inverse); ++ sysfs_strtoul_clamp(writeback_rate_i_term_inverse, ++ dc->writeback_rate_i_term_inverse, ++ 1, UINT_MAX); ++ sysfs_strtoul_clamp(writeback_rate_p_term_inverse, ++ dc->writeback_rate_p_term_inverse, ++ 1, UINT_MAX); + d_strtoul_nonzero(writeback_rate_minimum); + + sysfs_strtoul_clamp(io_error_limit, dc->error_limit, 0, INT_MAX); +@@ -295,7 +299,9 @@ STORE(__cached_dev) + dc->io_disable = v ? 1 : 0; + } + +- d_strtoi_h(sequential_cutoff); ++ sysfs_strtoul_clamp(sequential_cutoff, ++ dc->sequential_cutoff, ++ 0, UINT_MAX); + d_strtoi_h(readahead); + + if (attr == &sysfs_clear_stats) +@@ -766,8 +772,17 @@ STORE(__bch_cache_set) + c->error_limit = strtoul_or_return(buf); + + /* See count_io_errors() for why 88 */ +- if (attr == &sysfs_io_error_halflife) +- c->error_decay = strtoul_or_return(buf) / 88; ++ if (attr == &sysfs_io_error_halflife) { ++ unsigned long v = 0; ++ ssize_t ret; ++ ++ ret = strtoul_safe_clamp(buf, v, 0, UINT_MAX); ++ if (!ret) { ++ c->error_decay = v / 88; ++ return size; ++ } ++ return ret; ++ } + + if (attr == &sysfs_io_disable) { + v = strtoul_or_return(buf); +diff --git a/drivers/md/bcache/sysfs.h b/drivers/md/bcache/sysfs.h +index 3fe82425859c..0ad2715a884e 100644 +--- a/drivers/md/bcache/sysfs.h ++++ b/drivers/md/bcache/sysfs.h +@@ -81,9 +81,16 @@ do { \ + + #define sysfs_strtoul_clamp(file, var, min, max) \ + do { \ +- if (attr == &sysfs_ ## file) \ +- return strtoul_safe_clamp(buf, var, min, max) \ +- ?: (ssize_t) size; \ ++ if (attr == &sysfs_ ## file) { \ ++ unsigned long v = 0; \ ++ ssize_t ret; \ ++ ret = strtoul_safe_clamp(buf, v, min, max); \ ++ if (!ret) { \ ++ var = v; \ ++ return size; \ ++ } \ ++ return ret; \ ++ } \ + } while (0) + + #define strtoul_or_return(cp) \ +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index cd4220ee7004..435a2ee4a392 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -3283,6 +3283,13 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) + as.argc = argc; + as.argv = argv; + ++ /* make sure metadata and data are different devices */ ++ if (!strcmp(argv[0], argv[1])) { ++ ti->error = "Error setting metadata or data device"; ++ r = -EINVAL; ++ goto out_unlock; ++ } ++ + /* + * Set default pool features. + */ +@@ -4167,6 +4174,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) + tc->sort_bio_list = RB_ROOT; + + if (argc == 3) { ++ if (!strcmp(argv[0], argv[2])) { ++ ti->error = "Error setting origin device"; ++ r = -EINVAL; ++ goto bad_origin_dev; ++ } ++ + r = dm_get_device(ti, argv[2], FMODE_READ, &origin_dev); + if (r) { + ti->error = "Error opening origin device"; +diff --git a/drivers/media/i2c/mt9m111.c b/drivers/media/i2c/mt9m111.c +index efda1aa95ca0..7a7d3969af20 100644 +--- a/drivers/media/i2c/mt9m111.c ++++ b/drivers/media/i2c/mt9m111.c +@@ -1014,6 +1014,8 @@ static int mt9m111_probe(struct i2c_client *client, + mt9m111->rect.top = MT9M111_MIN_DARK_ROWS; + mt9m111->rect.width = MT9M111_MAX_WIDTH; + mt9m111->rect.height = MT9M111_MAX_HEIGHT; ++ mt9m111->width = mt9m111->rect.width; ++ mt9m111->height = mt9m111->rect.height; + mt9m111->fmt = &mt9m111_colour_fmts[0]; + mt9m111->lastpage = -1; + mutex_init(&mt9m111->power_lock); +diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c +index 605f3e25ad82..f5a1ee90a6c5 100644 +--- a/drivers/media/i2c/ov7740.c ++++ b/drivers/media/i2c/ov7740.c +@@ -1101,6 +1101,9 @@ static int ov7740_probe(struct i2c_client *client, + if (ret) + return ret; + ++ pm_runtime_set_active(&client->dev); ++ pm_runtime_enable(&client->dev); ++ + ret = ov7740_detect(ov7740); + if (ret) + goto error_detect; +@@ -1123,8 +1126,6 @@ static int ov7740_probe(struct i2c_client *client, + if (ret) + goto error_async_register; + +- pm_runtime_set_active(&client->dev); +- pm_runtime_enable(&client->dev); + pm_runtime_idle(&client->dev); + + return 0; +@@ -1134,6 +1135,8 @@ error_async_register: + error_init_controls: + ov7740_free_controls(ov7740); + error_detect: ++ pm_runtime_disable(&client->dev); ++ pm_runtime_set_suspended(&client->dev); + ov7740_set_power(ov7740, 0); + media_entity_cleanup(&ov7740->subdev.entity); + +diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c +index 4f24da8afecc..11429633b2fb 100644 +--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c ++++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c +@@ -702,7 +702,7 @@ end: + v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, to_vb2_v4l2_buffer(vb)); + } + +-static void *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx, ++static struct vb2_v4l2_buffer *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx, + enum v4l2_buf_type type) + { + if (V4L2_TYPE_IS_OUTPUT(type)) +@@ -714,7 +714,7 @@ static void *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx, + static int mtk_jpeg_start_streaming(struct vb2_queue *q, unsigned int count) + { + struct mtk_jpeg_ctx *ctx = vb2_get_drv_priv(q); +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + int ret = 0; + + ret = pm_runtime_get_sync(ctx->jpeg->dev); +@@ -724,14 +724,14 @@ static int mtk_jpeg_start_streaming(struct vb2_queue *q, unsigned int count) + return 0; + err: + while ((vb = mtk_jpeg_buf_remove(ctx, q->type))) +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(vb), VB2_BUF_STATE_QUEUED); ++ v4l2_m2m_buf_done(vb, VB2_BUF_STATE_QUEUED); + return ret; + } + + static void mtk_jpeg_stop_streaming(struct vb2_queue *q) + { + struct mtk_jpeg_ctx *ctx = vb2_get_drv_priv(q); +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + + /* + * STREAMOFF is an acknowledgment for source change event. +@@ -743,7 +743,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q) + struct mtk_jpeg_src_buf *src_buf; + + vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); +- src_buf = mtk_jpeg_vb2_to_srcbuf(vb); ++ src_buf = mtk_jpeg_vb2_to_srcbuf(&vb->vb2_buf); + mtk_jpeg_set_queue_data(ctx, &src_buf->dec_param); + ctx->state = MTK_JPEG_RUNNING; + } else if (V4L2_TYPE_IS_OUTPUT(q->type)) { +@@ -751,7 +751,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q) + } + + while ((vb = mtk_jpeg_buf_remove(ctx, q->type))) +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(vb), VB2_BUF_STATE_ERROR); ++ v4l2_m2m_buf_done(vb, VB2_BUF_STATE_ERROR); + + pm_runtime_put_sync(ctx->jpeg->dev); + } +@@ -807,7 +807,7 @@ static void mtk_jpeg_device_run(void *priv) + { + struct mtk_jpeg_ctx *ctx = priv; + struct mtk_jpeg_dev *jpeg = ctx->jpeg; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR; + unsigned long flags; + struct mtk_jpeg_src_buf *jpeg_src_buf; +@@ -817,11 +817,11 @@ static void mtk_jpeg_device_run(void *priv) + + src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); +- jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(src_buf); ++ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf); + + if (jpeg_src_buf->flags & MTK_JPEG_BUF_FLAGS_LAST_FRAME) { +- for (i = 0; i < dst_buf->num_planes; i++) +- vb2_set_plane_payload(dst_buf, i, 0); ++ for (i = 0; i < dst_buf->vb2_buf.num_planes; i++) ++ vb2_set_plane_payload(&dst_buf->vb2_buf, i, 0); + buf_state = VB2_BUF_STATE_DONE; + goto dec_end; + } +@@ -833,8 +833,8 @@ static void mtk_jpeg_device_run(void *priv) + return; + } + +- mtk_jpeg_set_dec_src(ctx, src_buf, &bs); +- if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, dst_buf, &fb)) ++ mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs); ++ if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb)) + goto dec_end; + + spin_lock_irqsave(&jpeg->hw_lock, flags); +@@ -849,8 +849,8 @@ static void mtk_jpeg_device_run(void *priv) + dec_end: + v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); + v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), buf_state); +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(dst_buf), buf_state); ++ v4l2_m2m_buf_done(src_buf, buf_state); ++ v4l2_m2m_buf_done(dst_buf, buf_state); + v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx); + } + +@@ -921,7 +921,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) + { + struct mtk_jpeg_dev *jpeg = priv; + struct mtk_jpeg_ctx *ctx; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + struct mtk_jpeg_src_buf *jpeg_src_buf; + enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR; + u32 dec_irq_ret; +@@ -938,7 +938,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) + + src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); + dst_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); +- jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(src_buf); ++ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf); + + if (dec_irq_ret >= MTK_JPEG_DEC_RESULT_UNDERFLOW) + mtk_jpeg_dec_reset(jpeg->dec_reg_base); +@@ -948,15 +948,15 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) + goto dec_end; + } + +- for (i = 0; i < dst_buf->num_planes; i++) +- vb2_set_plane_payload(dst_buf, i, ++ for (i = 0; i < dst_buf->vb2_buf.num_planes; i++) ++ vb2_set_plane_payload(&dst_buf->vb2_buf, i, + jpeg_src_buf->dec_param.comp_size[i]); + + buf_state = VB2_BUF_STATE_DONE; + + dec_end: +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), buf_state); +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(dst_buf), buf_state); ++ v4l2_m2m_buf_done(src_buf, buf_state); ++ v4l2_m2m_buf_done(dst_buf, buf_state); + v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx); + return IRQ_HANDLED; + } +diff --git a/drivers/media/platform/mx2_emmaprp.c b/drivers/media/platform/mx2_emmaprp.c +index 64195c4ddeaf..419e1cb10dc6 100644 +--- a/drivers/media/platform/mx2_emmaprp.c ++++ b/drivers/media/platform/mx2_emmaprp.c +@@ -274,7 +274,7 @@ static void emmaprp_device_run(void *priv) + { + struct emmaprp_ctx *ctx = priv; + struct emmaprp_q_data *s_q_data, *d_q_data; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + struct emmaprp_dev *pcdev = ctx->dev; + unsigned int s_width, s_height; + unsigned int d_width, d_height; +@@ -294,8 +294,8 @@ static void emmaprp_device_run(void *priv) + d_height = d_q_data->height; + d_size = d_width * d_height; + +- p_in = vb2_dma_contig_plane_dma_addr(src_buf, 0); +- p_out = vb2_dma_contig_plane_dma_addr(dst_buf, 0); ++ p_in = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0); ++ p_out = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0); + if (!p_in || !p_out) { + v4l2_err(&pcdev->v4l2_dev, + "Acquiring kernel pointers to buffers failed\n"); +diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c +index ce09799976ef..e1085e3ab3cc 100644 +--- a/drivers/media/platform/rcar-vin/rcar-core.c ++++ b/drivers/media/platform/rcar-vin/rcar-core.c +@@ -131,9 +131,13 @@ static int rvin_group_link_notify(struct media_link *link, u32 flags, + !is_media_entity_v4l2_video_device(link->sink->entity)) + return 0; + +- /* If any entity is in use don't allow link changes. */ ++ /* ++ * Don't allow link changes if any entity in the graph is ++ * streaming, modifying the CHSEL register fields can disrupt ++ * running streams. ++ */ + media_device_for_each_entity(entity, &group->mdev) +- if (entity->use_count) ++ if (entity->stream_count) + return -EBUSY; + + mutex_lock(&group->lock); +diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c +index ab5a6f95044a..86a76f35a9a1 100644 +--- a/drivers/media/platform/rockchip/rga/rga.c ++++ b/drivers/media/platform/rockchip/rga/rga.c +@@ -43,7 +43,7 @@ static void device_run(void *prv) + { + struct rga_ctx *ctx = prv; + struct rockchip_rga *rga = ctx->rga; +- struct vb2_buffer *src, *dst; ++ struct vb2_v4l2_buffer *src, *dst; + unsigned long flags; + + spin_lock_irqsave(&rga->ctrl_lock, flags); +@@ -53,8 +53,8 @@ static void device_run(void *prv) + src = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + dst = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); + +- rga_buf_map(src); +- rga_buf_map(dst); ++ rga_buf_map(&src->vb2_buf); ++ rga_buf_map(&dst->vb2_buf); + + rga_hw_start(rga); + +diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c +index e901201b6fcc..1f58574d0b96 100644 +--- a/drivers/media/platform/s5p-g2d/g2d.c ++++ b/drivers/media/platform/s5p-g2d/g2d.c +@@ -487,7 +487,7 @@ static void device_run(void *prv) + { + struct g2d_ctx *ctx = prv; + struct g2d_dev *dev = ctx->dev; +- struct vb2_buffer *src, *dst; ++ struct vb2_v4l2_buffer *src, *dst; + unsigned long flags; + u32 cmd = 0; + +@@ -502,10 +502,10 @@ static void device_run(void *prv) + spin_lock_irqsave(&dev->ctrl_lock, flags); + + g2d_set_src_size(dev, &ctx->in); +- g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(src, 0)); ++ g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(&src->vb2_buf, 0)); + + g2d_set_dst_size(dev, &ctx->out); +- g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(dst, 0)); ++ g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(&dst->vb2_buf, 0)); + + g2d_set_rop4(dev, ctx->rop); + g2d_set_flip(dev, ctx->flip); +diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c +index 04fd2e0493c0..350afaa29a62 100644 +--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c ++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c +@@ -793,14 +793,14 @@ static void skip(struct s5p_jpeg_buffer *buf, long len); + static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); ++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + struct s5p_jpeg_buffer jpeg_buffer; + unsigned int word; + int c, x, components; + + jpeg_buffer.size = 2; /* Ls */ + jpeg_buffer.data = +- (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sos + 2; ++ (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; + jpeg_buffer.curr = 0; + + word = 0; +@@ -830,14 +830,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) + static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); ++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + struct s5p_jpeg_buffer jpeg_buffer; + unsigned int word; + int c, i, n, j; + + for (j = 0; j < ctx->out_q.dht.n; ++j) { + jpeg_buffer.size = ctx->out_q.dht.len[j]; +- jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) + ++ jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + + ctx->out_q.dht.marker[j]; + jpeg_buffer.curr = 0; + +@@ -889,13 +889,13 @@ static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx) + static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); ++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + struct s5p_jpeg_buffer jpeg_buffer; + int c, x, components; + + jpeg_buffer.size = ctx->out_q.sof_len; + jpeg_buffer.data = +- (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sof; ++ (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sof; + jpeg_buffer.curr = 0; + + skip(&jpeg_buffer, 5); /* P, Y, X */ +@@ -920,14 +920,14 @@ static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx) + static void exynos4_jpeg_parse_q_tbl(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); ++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + struct s5p_jpeg_buffer jpeg_buffer; + unsigned int word; + int c, i, j; + + for (j = 0; j < ctx->out_q.dqt.n; ++j) { + jpeg_buffer.size = ctx->out_q.dqt.len[j]; +- jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) + ++ jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + + ctx->out_q.dqt.marker[j]; + jpeg_buffer.curr = 0; + +@@ -1293,13 +1293,16 @@ static int s5p_jpeg_querycap(struct file *file, void *priv, + return 0; + } + +-static int enum_fmt(struct s5p_jpeg_fmt *sjpeg_formats, int n, ++static int enum_fmt(struct s5p_jpeg_ctx *ctx, ++ struct s5p_jpeg_fmt *sjpeg_formats, int n, + struct v4l2_fmtdesc *f, u32 type) + { + int i, num = 0; ++ unsigned int fmt_ver_flag = ctx->jpeg->variant->fmt_ver_flag; + + for (i = 0; i < n; ++i) { +- if (sjpeg_formats[i].flags & type) { ++ if (sjpeg_formats[i].flags & type && ++ sjpeg_formats[i].flags & fmt_ver_flag) { + /* index-th format of type type found ? */ + if (num == f->index) + break; +@@ -1326,11 +1329,11 @@ static int s5p_jpeg_enum_fmt_vid_cap(struct file *file, void *priv, + struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv); + + if (ctx->mode == S5P_JPEG_ENCODE) +- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, ++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, + SJPEG_FMT_FLAG_ENC_CAPTURE); + +- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, +- SJPEG_FMT_FLAG_DEC_CAPTURE); ++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, ++ SJPEG_FMT_FLAG_DEC_CAPTURE); + } + + static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv, +@@ -1339,11 +1342,11 @@ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv, + struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv); + + if (ctx->mode == S5P_JPEG_ENCODE) +- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, ++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, + SJPEG_FMT_FLAG_ENC_OUTPUT); + +- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, +- SJPEG_FMT_FLAG_DEC_OUTPUT); ++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, ++ SJPEG_FMT_FLAG_DEC_OUTPUT); + } + + static struct s5p_jpeg_q_data *get_q_data(struct s5p_jpeg_ctx *ctx, +@@ -2072,15 +2075,15 @@ static void s5p_jpeg_device_run(void *priv) + { + struct s5p_jpeg_ctx *ctx = priv; + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + unsigned long src_addr, dst_addr, flags; + + spin_lock_irqsave(&ctx->jpeg->slock, flags); + + src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); +- src_addr = vb2_dma_contig_plane_dma_addr(src_buf, 0); +- dst_addr = vb2_dma_contig_plane_dma_addr(dst_buf, 0); ++ src_addr = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0); ++ dst_addr = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0); + + s5p_jpeg_reset(jpeg->regs); + s5p_jpeg_poweron(jpeg->regs); +@@ -2153,7 +2156,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; + struct s5p_jpeg_fmt *fmt; +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + struct s5p_jpeg_addr jpeg_addr = {}; + u32 pix_size, padding_bytes = 0; + +@@ -2172,7 +2175,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + vb = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); + } + +- jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0); ++ jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); + + if (fmt->colplanes == 2) { + jpeg_addr.cb = jpeg_addr.y + pix_size - padding_bytes; +@@ -2190,7 +2193,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + unsigned int jpeg_addr = 0; + + if (ctx->mode == S5P_JPEG_ENCODE) +@@ -2198,7 +2201,7 @@ static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) + else + vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + +- jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0); ++ jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); + if (jpeg->variant->version == SJPEG_EXYNOS5433 && + ctx->mode == S5P_JPEG_DECODE) + jpeg_addr += ctx->out_q.sos; +@@ -2314,7 +2317,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; + struct s5p_jpeg_fmt *fmt; +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + struct s5p_jpeg_addr jpeg_addr = {}; + u32 pix_size; + +@@ -2328,7 +2331,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + fmt = ctx->cap_q.fmt; + } + +- jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0); ++ jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); + + if (fmt->colplanes == 2) { + jpeg_addr.cb = jpeg_addr.y + pix_size; +@@ -2346,7 +2349,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + unsigned int jpeg_addr = 0; + + if (ctx->mode == S5P_JPEG_ENCODE) +@@ -2354,7 +2357,7 @@ static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) + else + vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + +- jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0); ++ jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); + exynos3250_jpeg_jpgadr(jpeg->regs, jpeg_addr); + } + +diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c +index 1d274c64de09..03ee9839a03e 100644 +--- a/drivers/media/platform/sh_veu.c ++++ b/drivers/media/platform/sh_veu.c +@@ -273,13 +273,13 @@ static void sh_veu_process(struct sh_veu_dev *veu, + static void sh_veu_device_run(void *priv) + { + struct sh_veu_dev *veu = priv; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + + src_buf = v4l2_m2m_next_src_buf(veu->m2m_ctx); + dst_buf = v4l2_m2m_next_dst_buf(veu->m2m_ctx); + + if (src_buf && dst_buf) +- sh_veu_process(veu, src_buf, dst_buf); ++ sh_veu_process(veu, &src_buf->vb2_buf, &dst_buf->vb2_buf); + } + + /* ========== video ioctls ========== */ +diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c +index c60a7625b1fa..b2873a2432b6 100644 +--- a/drivers/mmc/host/omap.c ++++ b/drivers/mmc/host/omap.c +@@ -920,7 +920,7 @@ static inline void set_cmd_timeout(struct mmc_omap_host *host, struct mmc_reques + reg &= ~(1 << 5); + OMAP_MMC_WRITE(host, SDIO, reg); + /* Set maximum timeout */ +- OMAP_MMC_WRITE(host, CTO, 0xff); ++ OMAP_MMC_WRITE(host, CTO, 0xfd); + } + + static inline void set_data_timeout(struct mmc_omap_host *host, struct mmc_request *req) +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index c078c791f481..dabe89968a78 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -442,12 +442,20 @@ out_mapping: + + static int mv88e6xxx_g1_irq_setup(struct mv88e6xxx_chip *chip) + { ++ static struct lock_class_key lock_key; ++ static struct lock_class_key request_key; + int err; + + err = mv88e6xxx_g1_irq_setup_common(chip); + if (err) + return err; + ++ /* These lock classes tells lockdep that global 1 irqs are in ++ * a different category than their parent GPIO, so it won't ++ * report false recursion. ++ */ ++ irq_set_lockdep_class(chip->irq, &lock_key, &request_key); ++ + err = request_threaded_irq(chip->irq, NULL, + mv88e6xxx_g1_irq_thread_fn, + IRQF_ONESHOT, +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index 9a7f70db20c7..733d9172425b 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -119,7 +119,7 @@ static void enic_init_affinity_hint(struct enic *enic) + + for (i = 0; i < enic->intr_count; i++) { + if (enic_is_err_intr(enic, i) || enic_is_notify_intr(enic, i) || +- (enic->msix[i].affinity_mask && ++ (cpumask_available(enic->msix[i].affinity_mask) && + !cpumask_empty(enic->msix[i].affinity_mask))) + continue; + if (zalloc_cpumask_var(&enic->msix[i].affinity_mask, +@@ -148,7 +148,7 @@ static void enic_set_affinity_hint(struct enic *enic) + for (i = 0; i < enic->intr_count; i++) { + if (enic_is_err_intr(enic, i) || + enic_is_notify_intr(enic, i) || +- !enic->msix[i].affinity_mask || ++ !cpumask_available(enic->msix[i].affinity_mask) || + cpumask_empty(enic->msix[i].affinity_mask)) + continue; + err = irq_set_affinity_hint(enic->msix_entry[i].vector, +@@ -161,7 +161,7 @@ static void enic_set_affinity_hint(struct enic *enic) + for (i = 0; i < enic->wq_count; i++) { + int wq_intr = enic_msix_wq_intr(enic, i); + +- if (enic->msix[wq_intr].affinity_mask && ++ if (cpumask_available(enic->msix[wq_intr].affinity_mask) && + !cpumask_empty(enic->msix[wq_intr].affinity_mask)) + netif_set_xps_queue(enic->netdev, + enic->msix[wq_intr].affinity_mask, +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 3ba0c90e7055..8b11682ebba2 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -2106,7 +2106,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter) + if (strlen(netdev->name) < (IFNAMSIZ - 5)) + snprintf(adapter->rx_ring->name, + sizeof(adapter->rx_ring->name) - 1, +- "%s-rx-0", netdev->name); ++ "%.14s-rx-0", netdev->name); + else + memcpy(adapter->rx_ring->name, netdev->name, IFNAMSIZ); + err = request_irq(adapter->msix_entries[vector].vector, +@@ -2122,7 +2122,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter) + if (strlen(netdev->name) < (IFNAMSIZ - 5)) + snprintf(adapter->tx_ring->name, + sizeof(adapter->tx_ring->name) - 1, +- "%s-tx-0", netdev->name); ++ "%.14s-tx-0", netdev->name); + else + memcpy(adapter->tx_ring->name, netdev->name, IFNAMSIZ); + err = request_irq(adapter->msix_entries[vector].vector, +@@ -5286,8 +5286,13 @@ static void e1000_watchdog_task(struct work_struct *work) + /* 8000ES2LAN requires a Rx packet buffer work-around + * on link down event; reset the controller to flush + * the Rx packet buffer. ++ * ++ * If the link is lost the controller stops DMA, but ++ * if there is queued Tx work it cannot be done. So ++ * reset the controller to flush the Tx packet buffers. + */ +- if (adapter->flags & FLAG_RX_NEEDS_RESTART) ++ if ((adapter->flags & FLAG_RX_NEEDS_RESTART) || ++ e1000_desc_unused(tx_ring) + 1 < tx_ring->count) + adapter->flags |= FLAG_RESTART_NOW; + else + pm_schedule_suspend(netdev->dev.parent, +@@ -5310,14 +5315,6 @@ link_up: + adapter->gotc_old = adapter->stats.gotc; + spin_unlock(&adapter->stats64_lock); + +- /* If the link is lost the controller stops DMA, but +- * if there is queued Tx work it cannot be done. So +- * reset the controller to flush the Tx packet buffers. +- */ +- if (!netif_carrier_ok(netdev) && +- (e1000_desc_unused(tx_ring) + 1 < tx_ring->count)) +- adapter->flags |= FLAG_RESTART_NOW; +- + /* If reset is necessary, do it outside of interrupt context. */ + if (adapter->flags & FLAG_RESTART_NOW) { + schedule_work(&adapter->reset_task); +@@ -7330,6 +7327,8 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + e1000_print_device_info(adapter); + ++ dev_pm_set_driver_flags(&pdev->dev, DPM_FLAG_NEVER_SKIP); ++ + if (pci_dev_run_wake(pdev)) + pm_runtime_put_noidle(&pdev->dev); + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index f8e4808a8317..9988c89ed9fd 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -1372,13 +1372,9 @@ static void mvpp2_port_reset(struct mvpp2_port *port) + for (i = 0; i < ARRAY_SIZE(mvpp2_ethtool_regs); i++) + mvpp2_read_count(port, &mvpp2_ethtool_regs[i]); + +- val = readl(port->base + MVPP2_GMAC_CTRL_2_REG) & +- ~MVPP2_GMAC_PORT_RESET_MASK; ++ val = readl(port->base + MVPP2_GMAC_CTRL_2_REG) | ++ MVPP2_GMAC_PORT_RESET_MASK; + writel(val, port->base + MVPP2_GMAC_CTRL_2_REG); +- +- while (readl(port->base + MVPP2_GMAC_CTRL_2_REG) & +- MVPP2_GMAC_PORT_RESET_MASK) +- continue; + } + + /* Change maximum receive size of the port */ +@@ -4445,12 +4441,15 @@ static void mvpp2_gmac_config(struct mvpp2_port *port, unsigned int mode, + const struct phylink_link_state *state) + { + u32 an, ctrl0, ctrl2, ctrl4; ++ u32 old_ctrl2; + + an = readl(port->base + MVPP2_GMAC_AUTONEG_CONFIG); + ctrl0 = readl(port->base + MVPP2_GMAC_CTRL_0_REG); + ctrl2 = readl(port->base + MVPP2_GMAC_CTRL_2_REG); + ctrl4 = readl(port->base + MVPP22_GMAC_CTRL_4_REG); + ++ old_ctrl2 = ctrl2; ++ + /* Force link down */ + an &= ~MVPP2_GMAC_FORCE_LINK_PASS; + an |= MVPP2_GMAC_FORCE_LINK_DOWN; +@@ -4523,6 +4522,12 @@ static void mvpp2_gmac_config(struct mvpp2_port *port, unsigned int mode, + writel(ctrl2, port->base + MVPP2_GMAC_CTRL_2_REG); + writel(ctrl4, port->base + MVPP22_GMAC_CTRL_4_REG); + writel(an, port->base + MVPP2_GMAC_AUTONEG_CONFIG); ++ ++ if (old_ctrl2 & MVPP2_GMAC_PORT_RESET_MASK) { ++ while (readl(port->base + MVPP2_GMAC_CTRL_2_REG) & ++ MVPP2_GMAC_PORT_RESET_MASK) ++ continue; ++ } + } + + static void mvpp2_mac_config(struct net_device *dev, unsigned int mode, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index d6706475a3ba..26c9f9421901 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1797,7 +1797,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw, + u64 node_guid; + int err = 0; + +- if (!MLX5_CAP_GEN(esw->dev, vport_group_manager)) ++ if (!esw || !MLX5_CAP_GEN(esw->dev, vport_group_manager)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac)) + return -EINVAL; +@@ -1871,7 +1871,7 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw, + { + struct mlx5_vport *evport; + +- if (!MLX5_CAP_GEN(esw->dev, vport_group_manager)) ++ if (!esw || !MLX5_CAP_GEN(esw->dev, vport_group_manager)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport)) + return -EINVAL; +@@ -2044,19 +2044,24 @@ static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider) + int mlx5_eswitch_set_vport_rate(struct mlx5_eswitch *esw, int vport, + u32 max_rate, u32 min_rate) + { +- u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share); +- bool min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) && +- fw_max_bw_share >= MLX5_MIN_BW_SHARE; +- bool max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit); + struct mlx5_vport *evport; ++ u32 fw_max_bw_share; + u32 previous_min_rate; + u32 divider; ++ bool min_rate_supported; ++ bool max_rate_supported; + int err = 0; + + if (!ESW_ALLOWED(esw)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport)) + return -EINVAL; ++ ++ fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share); ++ min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) && ++ fw_max_bw_share >= MLX5_MIN_BW_SHARE; ++ max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit); ++ + if ((min_rate && !min_rate_supported) || (max_rate && !max_rate_supported)) + return -EOPNOTSUPP; + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index a12b5710891e..f9bef030ee05 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -1988,7 +1988,7 @@ static void mlxsw_sp_port_get_prio_strings(u8 **p, int prio) + int i; + + for (i = 0; i < MLXSW_SP_PORT_HW_PRIO_STATS_LEN; i++) { +- snprintf(*p, ETH_GSTRING_LEN, "%s_%d", ++ snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d", + mlxsw_sp_port_hw_prio_stats[i].str, prio); + *p += ETH_GSTRING_LEN; + } +@@ -1999,7 +1999,7 @@ static void mlxsw_sp_port_get_tc_strings(u8 **p, int tc) + int i; + + for (i = 0; i < MLXSW_SP_PORT_HW_TC_STATS_LEN; i++) { +- snprintf(*p, ETH_GSTRING_LEN, "%s_%d", ++ snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d", + mlxsw_sp_port_hw_tc_stats[i].str, tc); + *p += ETH_GSTRING_LEN; + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 43ab9e905bed..886176be818e 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -474,7 +474,7 @@ static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv, + struct dma_desc *p, struct sk_buff *skb) + { + struct skb_shared_hwtstamps shhwtstamp; +- u64 ns; ++ u64 ns = 0; + + if (!priv->hwts_tx_en) + return; +@@ -513,7 +513,7 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p, + { + struct skb_shared_hwtstamps *shhwtstamp = NULL; + struct dma_desc *desc = p; +- u64 ns; ++ u64 ns = 0; + + if (!priv->hwts_rx_en) + return; +@@ -558,8 +558,8 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr) + u32 snap_type_sel = 0; + u32 ts_master_en = 0; + u32 ts_event_en = 0; ++ u32 sec_inc = 0; + u32 value = 0; +- u32 sec_inc; + bool xmac; + + xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c +index 2293e21f789f..cc60b3fb0892 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c +@@ -105,7 +105,7 @@ static int stmmac_get_time(struct ptp_clock_info *ptp, struct timespec64 *ts) + struct stmmac_priv *priv = + container_of(ptp, struct stmmac_priv, ptp_clock_ops); + unsigned long flags; +- u64 ns; ++ u64 ns = 0; + + spin_lock_irqsave(&priv->ptp_lock, flags); + stmmac_get_systime(priv, priv->ptpaddr, &ns); +diff --git a/drivers/net/phy/phy-c45.c b/drivers/net/phy/phy-c45.c +index e1225545362d..0ba3607585bd 100644 +--- a/drivers/net/phy/phy-c45.c ++++ b/drivers/net/phy/phy-c45.c +@@ -147,9 +147,15 @@ int genphy_c45_read_link(struct phy_device *phydev, u32 mmd_mask) + mmd_mask &= ~BIT(devad); + + /* The link state is latched low so that momentary link +- * drops can be detected. Do not double-read the status +- * register if the link is down. ++ * drops can be detected. Do not double-read the status ++ * in polling mode to detect such short link drops. + */ ++ if (!phy_polling_mode(phydev)) { ++ val = phy_read_mmd(phydev, devad, MDIO_STAT1); ++ if (val < 0) ++ return val; ++ } ++ + val = phy_read_mmd(phydev, devad, MDIO_STAT1); + if (val < 0) + return val; +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 2c32c795f5dd..8a96d985a52f 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -1503,10 +1503,15 @@ int genphy_update_link(struct phy_device *phydev) + { + int status; + +- /* Do a fake read */ +- status = phy_read(phydev, MII_BMSR); +- if (status < 0) +- return status; ++ /* The link state is latched low so that momentary link ++ * drops can be detected. Do not double-read the status ++ * in polling mode to detect such short link drops. ++ */ ++ if (!phy_polling_mode(phydev)) { ++ status = phy_read(phydev, MII_BMSR); ++ if (status < 0) ++ return status; ++ } + + /* Read link and autonegotiation status */ + status = phy_read(phydev, MII_BMSR); +diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c +index 18c709c484e7..f761d651c16e 100644 +--- a/drivers/net/wireless/ath/ath10k/ce.c ++++ b/drivers/net/wireless/ath/ath10k/ce.c +@@ -500,14 +500,8 @@ static int _ath10k_ce_send_nolock(struct ath10k_ce_pipe *ce_state, + write_index = CE_RING_IDX_INCR(nentries_mask, write_index); + + /* WORKAROUND */ +- if (!(flags & CE_SEND_FLAG_GATHER)) { +- if (ar->hw_params.shadow_reg_support) +- ath10k_ce_shadow_src_ring_write_index_set(ar, ce_state, +- write_index); +- else +- ath10k_ce_src_ring_write_index_set(ar, ctrl_addr, +- write_index); +- } ++ if (!(flags & CE_SEND_FLAG_GATHER)) ++ ath10k_ce_src_ring_write_index_set(ar, ctrl_addr, write_index); + + src_ring->write_index = write_index; + exit: +@@ -581,8 +575,14 @@ static int _ath10k_ce_send_nolock_64(struct ath10k_ce_pipe *ce_state, + /* Update Source Ring Write Index */ + write_index = CE_RING_IDX_INCR(nentries_mask, write_index); + +- if (!(flags & CE_SEND_FLAG_GATHER)) +- ath10k_ce_src_ring_write_index_set(ar, ctrl_addr, write_index); ++ if (!(flags & CE_SEND_FLAG_GATHER)) { ++ if (ar->hw_params.shadow_reg_support) ++ ath10k_ce_shadow_src_ring_write_index_set(ar, ce_state, ++ write_index); ++ else ++ ath10k_ce_src_ring_write_index_set(ar, ctrl_addr, ++ write_index); ++ } + + src_ring->write_index = write_index; + exit: +@@ -1394,12 +1394,12 @@ static int ath10k_ce_alloc_shadow_base(struct ath10k *ar, + u32 nentries) + { + src_ring->shadow_base_unaligned = kcalloc(nentries, +- sizeof(struct ce_desc), ++ sizeof(struct ce_desc_64), + GFP_KERNEL); + if (!src_ring->shadow_base_unaligned) + return -ENOMEM; + +- src_ring->shadow_base = (struct ce_desc *) ++ src_ring->shadow_base = (struct ce_desc_64 *) + PTR_ALIGN(src_ring->shadow_base_unaligned, + CE_DESC_RING_ALIGN); + return 0; +@@ -1453,7 +1453,7 @@ ath10k_ce_alloc_src_ring(struct ath10k *ar, unsigned int ce_id, + ret = ath10k_ce_alloc_shadow_base(ar, src_ring, nentries); + if (ret) { + dma_free_coherent(ar->dev, +- (nentries * sizeof(struct ce_desc) + ++ (nentries * sizeof(struct ce_desc_64) + + CE_DESC_RING_ALIGN), + src_ring->base_addr_owner_space_unaligned, + base_addr); +diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h +index b8fb5382dede..8088f7a66426 100644 +--- a/drivers/net/wireless/ath/ath10k/ce.h ++++ b/drivers/net/wireless/ath/ath10k/ce.h +@@ -118,7 +118,7 @@ struct ath10k_ce_ring { + u32 base_addr_ce_space; + + char *shadow_base_unaligned; +- struct ce_desc *shadow_base; ++ struct ce_desc_64 *shadow_base; + + /* keep last */ + void *per_transfer_context[0]; +diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c +index f79c337105cb..2daf33342b23 100644 +--- a/drivers/net/wireless/ath/wil6210/cfg80211.c ++++ b/drivers/net/wireless/ath/wil6210/cfg80211.c +@@ -1420,6 +1420,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, + u8 *buf, *dpos; + const u8 *spos; + ++ if (!ies1) ++ ies1_len = 0; ++ ++ if (!ies2) ++ ies2_len = 0; ++ + if (ies1_len == 0 && ies2_len == 0) { + *merged_ies = NULL; + *merged_len = 0; +@@ -1429,17 +1435,19 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, + buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL); + if (!buf) + return -ENOMEM; +- memcpy(buf, ies1, ies1_len); ++ if (ies1) ++ memcpy(buf, ies1, ies1_len); + dpos = buf + ies1_len; + spos = ies2; +- while (spos + 1 < ies2 + ies2_len) { ++ while (spos && (spos + 1 < ies2 + ies2_len)) { + /* IE tag at offset 0, length at offset 1 */ + u16 ielen = 2 + spos[1]; + + if (spos + ielen > ies2 + ies2_len) + break; + if (spos[0] == WLAN_EID_VENDOR_SPECIFIC && +- !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) { ++ (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len, ++ spos, ielen))) { + memcpy(dpos, spos, ielen); + dpos += ielen; + } +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +index cd3651069d0c..27893af63ebc 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +@@ -149,7 +149,7 @@ static int brcmf_c_process_clm_blob(struct brcmf_if *ifp) + return err; + } + +- err = request_firmware(&clm, clm_name, bus->dev); ++ err = firmware_request_nowarn(&clm, clm_name, bus->dev); + if (err) { + brcmf_info("no clm_blob available (err=%d), device may have limited channels available\n", + err); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 16c6c7f921a8..8b7d70e3a379 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -132,13 +132,17 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm) + + static int iwl_configure_rxq(struct iwl_mvm *mvm) + { +- int i, num_queues, size; ++ int i, num_queues, size, ret; + struct iwl_rfh_queue_config *cmd; ++ struct iwl_host_cmd hcmd = { ++ .id = WIDE_ID(DATA_PATH_GROUP, RFH_QUEUE_CONFIG_CMD), ++ .dataflags[0] = IWL_HCMD_DFL_NOCOPY, ++ }; + + /* Do not configure default queue, it is configured via context info */ + num_queues = mvm->trans->num_rx_queues - 1; + +- size = sizeof(*cmd) + num_queues * sizeof(struct iwl_rfh_queue_data); ++ size = struct_size(cmd, data, num_queues); + + cmd = kzalloc(size, GFP_KERNEL); + if (!cmd) +@@ -159,10 +163,14 @@ static int iwl_configure_rxq(struct iwl_mvm *mvm) + cmd->data[i].fr_bd_wid = cpu_to_le32(data.fr_bd_wid); + } + +- return iwl_mvm_send_cmd_pdu(mvm, +- WIDE_ID(DATA_PATH_GROUP, +- RFH_QUEUE_CONFIG_CMD), +- 0, size, cmd); ++ hcmd.data[0] = cmd; ++ hcmd.len[0] = size; ++ ++ ret = iwl_mvm_send_cmd(mvm, &hcmd); ++ ++ kfree(cmd); ++ ++ return ret; + } + + static int iwl_mvm_send_dqa_cmd(struct iwl_mvm *mvm) +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index d4a31e014c82..b2905f01b7df 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -502,7 +502,7 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans) + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); + struct iwl_rb_allocator *rba = &trans_pcie->rba; + struct list_head local_empty; +- int pending = atomic_xchg(&rba->req_pending, 0); ++ int pending = atomic_read(&rba->req_pending); + + IWL_DEBUG_RX(trans, "Pending allocation requests = %d\n", pending); + +@@ -557,11 +557,13 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans) + i++; + } + ++ atomic_dec(&rba->req_pending); + pending--; ++ + if (!pending) { +- pending = atomic_xchg(&rba->req_pending, 0); ++ pending = atomic_read(&rba->req_pending); + IWL_DEBUG_RX(trans, +- "Pending allocation requests = %d\n", ++ "Got more pending allocation requests = %d\n", + pending); + } + +@@ -573,12 +575,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans) + spin_unlock(&rba->lock); + + atomic_inc(&rba->req_ready); ++ + } + + spin_lock(&rba->lock); + /* return unused rbds to the allocator empty list */ + list_splice_tail(&local_empty, &rba->rbd_empty); + spin_unlock(&rba->lock); ++ ++ IWL_DEBUG_RX(trans, "%s, exit.\n", __func__); + } + + /* +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index adc88433faa8..2d87ebbfa4da 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -4282,11 +4282,13 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter) + wiphy->mgmt_stypes = mwifiex_mgmt_stypes; + wiphy->max_remain_on_channel_duration = 5000; + wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) | +- BIT(NL80211_IFTYPE_ADHOC) | + BIT(NL80211_IFTYPE_P2P_CLIENT) | + BIT(NL80211_IFTYPE_P2P_GO) | + BIT(NL80211_IFTYPE_AP); + ++ if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info)) ++ wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC); ++ + wiphy->bands[NL80211_BAND_2GHZ] = &mwifiex_band_2ghz; + if (adapter->config_bands & BAND_A) + wiphy->bands[NL80211_BAND_5GHZ] = &mwifiex_band_5ghz; +@@ -4346,11 +4348,13 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter) + wiphy->available_antennas_tx = BIT(adapter->number_of_antenna) - 1; + wiphy->available_antennas_rx = BIT(adapter->number_of_antenna) - 1; + +- wiphy->features |= NL80211_FEATURE_HT_IBSS | +- NL80211_FEATURE_INACTIVITY_TIMER | ++ wiphy->features |= NL80211_FEATURE_INACTIVITY_TIMER | + NL80211_FEATURE_LOW_PRIORITY_SCAN | + NL80211_FEATURE_NEED_OBSS_SCAN; + ++ if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info)) ++ wiphy->features |= NL80211_FEATURE_HT_IBSS; ++ + if (ISSUPP_RANDOM_MAC(adapter->fw_cap_info)) + wiphy->features |= NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR | + NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR | +diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c +index 530e5593765c..a1529920d877 100644 +--- a/drivers/net/wireless/mediatek/mt76/eeprom.c ++++ b/drivers/net/wireless/mediatek/mt76/eeprom.c +@@ -54,22 +54,30 @@ mt76_get_of_eeprom(struct mt76_dev *dev, int len) + part = np->name; + + mtd = get_mtd_device_nm(part); +- if (IS_ERR(mtd)) +- return PTR_ERR(mtd); ++ if (IS_ERR(mtd)) { ++ ret = PTR_ERR(mtd); ++ goto out_put_node; ++ } + +- if (size <= sizeof(*list)) +- return -EINVAL; ++ if (size <= sizeof(*list)) { ++ ret = -EINVAL; ++ goto out_put_node; ++ } + + offset = be32_to_cpup(list); + ret = mtd_read(mtd, offset, len, &retlen, dev->eeprom.data); + put_mtd_device(mtd); + if (ret) +- return ret; ++ goto out_put_node; + +- if (retlen < len) +- return -EINVAL; ++ if (retlen < len) { ++ ret = -EINVAL; ++ goto out_put_node; ++ } + +- return 0; ++out_put_node: ++ of_node_put(np); ++ return ret; + #else + return -ENOENT; + #endif +diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c +index 79e59f2379a2..8d40e92fb6f2 100644 +--- a/drivers/net/wireless/mediatek/mt76/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/usb.c +@@ -796,16 +796,9 @@ int mt76u_alloc_queues(struct mt76_dev *dev) + + err = mt76u_alloc_rx(dev); + if (err < 0) +- goto err; +- +- err = mt76u_alloc_tx(dev); +- if (err < 0) +- goto err; ++ return err; + +- return 0; +-err: +- mt76u_queues_deinit(dev); +- return err; ++ return mt76u_alloc_tx(dev); + } + EXPORT_SYMBOL_GPL(mt76u_alloc_queues); + +diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.h b/drivers/net/wireless/mediatek/mt7601u/eeprom.h +index 662d12703b69..57b503ae63f1 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.h ++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.h +@@ -17,7 +17,7 @@ + + struct mt7601u_dev; + +-#define MT7601U_EE_MAX_VER 0x0c ++#define MT7601U_EE_MAX_VER 0x0d + #define MT7601U_EEPROM_SIZE 256 + + #define MT7601U_DEFAULT_TX_POWER 6 +diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c +index 19e3c5a0b715..2ca5658bbc2a 100644 +--- a/drivers/net/wireless/ti/wlcore/main.c ++++ b/drivers/net/wireless/ti/wlcore/main.c +@@ -1084,8 +1084,11 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool plt) + goto out; + + ret = wl12xx_fetch_firmware(wl, plt); +- if (ret < 0) +- goto out; ++ if (ret < 0) { ++ kfree(wl->fw_status); ++ kfree(wl->raw_fw_status); ++ kfree(wl->tx_res_if); ++ } + + out: + return ret; +diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c +index 3ed67676ea2a..e85c5a8206c4 100644 +--- a/drivers/pci/pcie/pme.c ++++ b/drivers/pci/pcie/pme.c +@@ -363,6 +363,16 @@ static bool pcie_pme_check_wakeup(struct pci_bus *bus) + return false; + } + ++static void pcie_pme_disable_interrupt(struct pci_dev *port, ++ struct pcie_pme_service_data *data) ++{ ++ spin_lock_irq(&data->lock); ++ pcie_pme_interrupt_enable(port, false); ++ pcie_clear_root_pme_status(port); ++ data->noirq = true; ++ spin_unlock_irq(&data->lock); ++} ++ + /** + * pcie_pme_suspend - Suspend PCIe PME service device. + * @srv: PCIe service device to suspend. +@@ -387,11 +397,7 @@ static int pcie_pme_suspend(struct pcie_device *srv) + return 0; + } + +- spin_lock_irq(&data->lock); +- pcie_pme_interrupt_enable(port, false); +- pcie_clear_root_pme_status(port); +- data->noirq = true; +- spin_unlock_irq(&data->lock); ++ pcie_pme_disable_interrupt(port, data); + + synchronize_irq(srv->irq); + +@@ -427,9 +433,11 @@ static int pcie_pme_resume(struct pcie_device *srv) + */ + static void pcie_pme_remove(struct pcie_device *srv) + { +- pcie_pme_suspend(srv); ++ struct pcie_pme_service_data *data = get_service_data(srv); ++ ++ pcie_pme_disable_interrupt(srv->port, data); + free_irq(srv->irq, srv); +- kfree(get_service_data(srv)); ++ kfree(data); + } + + static struct pcie_port_service_driver pcie_pme_driver = { +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index e1a77b2de78a..3623f6489f49 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -824,10 +824,10 @@ static void arm_spe_pmu_read(struct perf_event *event) + { + } + +-static void *arm_spe_pmu_setup_aux(int cpu, void **pages, int nr_pages, +- bool snapshot) ++static void *arm_spe_pmu_setup_aux(struct perf_event *event, void **pages, ++ int nr_pages, bool snapshot) + { +- int i; ++ int i, cpu = event->cpu; + struct page **pglist; + struct arm_spe_pmu_buf *buf; + +diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c +index ead4beb5f55f..036124fd363c 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson8b.c ++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c +@@ -346,6 +346,8 @@ static const unsigned int eth_rx_dv_pins[] = { DIF_1_P }; + static const unsigned int eth_rx_clk_pins[] = { DIF_1_N }; + static const unsigned int eth_txd0_1_pins[] = { DIF_2_P }; + static const unsigned int eth_txd1_1_pins[] = { DIF_2_N }; ++static const unsigned int eth_rxd3_pins[] = { DIF_2_P }; ++static const unsigned int eth_rxd2_pins[] = { DIF_2_N }; + static const unsigned int eth_tx_en_pins[] = { DIF_3_P }; + static const unsigned int eth_ref_clk_pins[] = { DIF_3_N }; + static const unsigned int eth_mdc_pins[] = { DIF_4_P }; +@@ -571,6 +573,8 @@ static struct meson_pmx_group meson8b_cbus_groups[] = { + GROUP(eth_ref_clk, 6, 8), + GROUP(eth_mdc, 6, 9), + GROUP(eth_mdio_en, 6, 10), ++ GROUP(eth_rxd3, 7, 22), ++ GROUP(eth_rxd2, 7, 23), + }; + + static struct meson_pmx_group meson8b_aobus_groups[] = { +@@ -720,7 +724,7 @@ static const char * const ethernet_groups[] = { + "eth_tx_clk", "eth_tx_en", "eth_txd1_0", "eth_txd1_1", + "eth_txd0_0", "eth_txd0_1", "eth_rx_clk", "eth_rx_dv", + "eth_rxd1", "eth_rxd0", "eth_mdio_en", "eth_mdc", "eth_ref_clk", +- "eth_txd2", "eth_txd3" ++ "eth_txd2", "eth_txd3", "eth_rxd3", "eth_rxd2" + }; + + static const char * const i2c_a_groups[] = { +diff --git a/drivers/platform/mellanox/mlxreg-hotplug.c b/drivers/platform/mellanox/mlxreg-hotplug.c +index b6d44550d98c..eca16d00e310 100644 +--- a/drivers/platform/mellanox/mlxreg-hotplug.c ++++ b/drivers/platform/mellanox/mlxreg-hotplug.c +@@ -248,7 +248,8 @@ mlxreg_hotplug_work_helper(struct mlxreg_hotplug_priv_data *priv, + struct mlxreg_core_item *item) + { + struct mlxreg_core_data *data; +- u32 asserted, regval, bit; ++ unsigned long asserted; ++ u32 regval, bit; + int ret; + + /* +@@ -281,7 +282,7 @@ mlxreg_hotplug_work_helper(struct mlxreg_hotplug_priv_data *priv, + asserted = item->cache ^ regval; + item->cache = regval; + +- for_each_set_bit(bit, (unsigned long *)&asserted, 8) { ++ for_each_set_bit(bit, &asserted, 8) { + data = item->data + bit; + if (regval & BIT(bit)) { + if (item->inversed) +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index d4f1259ff5a2..62d4b94e2531 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -989,7 +989,7 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { + .ident = "Lenovo RESCUER R720-15IKBN", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_BOARD_NAME, "80WW"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo R720-15IKBN"), + }, + }, + { +diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c +index 6cf9b7fa5bf0..3201a83073b5 100644 +--- a/drivers/platform/x86/intel-hid.c ++++ b/drivers/platform/x86/intel-hid.c +@@ -373,7 +373,7 @@ wakeup: + * the 5-button array, but still send notifies with power button + * event code to this device object on power button actions. + * +- * Report the power button press; catch and ignore the button release. ++ * Report the power button press and release. + */ + if (!priv->array) { + if (event == 0xce) { +@@ -382,8 +382,11 @@ wakeup: + return; + } + +- if (event == 0xcf) ++ if (event == 0xcf) { ++ input_report_key(priv->input_dev, KEY_POWER, 0); ++ input_sync(priv->input_dev); + return; ++ } + } + + /* 0xC0 is for HID events, other values are for 5 button array */ +diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c +index 2d272a3e0176..e0dcdb3cc070 100644 +--- a/drivers/platform/x86/intel_pmc_core.c ++++ b/drivers/platform/x86/intel_pmc_core.c +@@ -333,7 +333,8 @@ static int pmc_core_ppfear_sts_show(struct seq_file *s, void *unused) + index < PPFEAR_MAX_NUM_ENTRIES; index++, iter++) + pf_regs[index] = pmc_core_reg_read_byte(pmcdev, iter); + +- for (index = 0; map[index].name; index++) ++ for (index = 0; map[index].name && ++ index < pmcdev->map->ppfear_buckets * 8; index++) + pmc_core_display_map(s, index, pf_regs[index / 8], map); + + return 0; +diff --git a/drivers/platform/x86/intel_pmc_core.h b/drivers/platform/x86/intel_pmc_core.h +index 93a7e99e1f8b..3f9711b03cb4 100644 +--- a/drivers/platform/x86/intel_pmc_core.h ++++ b/drivers/platform/x86/intel_pmc_core.h +@@ -39,7 +39,7 @@ + #define SPT_PMC_SLP_S0_RES_COUNTER_STEP 0x64 + #define PMC_BASE_ADDR_MASK ~(SPT_PMC_MMIO_REG_LEN - 1) + #define MTPMC_MASK 0xffff0000 +-#define PPFEAR_MAX_NUM_ENTRIES 5 ++#define PPFEAR_MAX_NUM_ENTRIES 12 + #define SPT_PPFEAR_NUM_ENTRIES 5 + #define SPT_PMC_READ_DISABLE_BIT 0x16 + #define SPT_PMC_MSG_FULL_STS_BIT 0x18 +diff --git a/drivers/regulator/act8865-regulator.c b/drivers/regulator/act8865-regulator.c +index 21e20483bd91..e0239cf3f56d 100644 +--- a/drivers/regulator/act8865-regulator.c ++++ b/drivers/regulator/act8865-regulator.c +@@ -131,7 +131,7 @@ + * ACT8865 voltage number + */ + #define ACT8865_VOLTAGE_NUM 64 +-#define ACT8600_SUDCDC_VOLTAGE_NUM 255 ++#define ACT8600_SUDCDC_VOLTAGE_NUM 256 + + struct act8865 { + struct regmap *regmap; +@@ -222,7 +222,8 @@ static const struct regulator_linear_range act8600_sudcdc_voltage_ranges[] = { + REGULATOR_LINEAR_RANGE(3000000, 0, 63, 0), + REGULATOR_LINEAR_RANGE(3000000, 64, 159, 100000), + REGULATOR_LINEAR_RANGE(12600000, 160, 191, 200000), +- REGULATOR_LINEAR_RANGE(19000000, 191, 255, 400000), ++ REGULATOR_LINEAR_RANGE(19000000, 192, 247, 400000), ++ REGULATOR_LINEAR_RANGE(41400000, 248, 255, 0), + }; + + static struct regulator_ops act8865_ops = { +diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c +index 8684bcec8ff4..00cc96341411 100644 +--- a/drivers/s390/net/ism_drv.c ++++ b/drivers/s390/net/ism_drv.c +@@ -141,10 +141,13 @@ static int register_ieq(struct ism_dev *ism) + + static int unregister_sba(struct ism_dev *ism) + { ++ int ret; ++ + if (!ism->sba) + return 0; + +- if (ism_cmd_simple(ism, ISM_UNREG_SBA)) ++ ret = ism_cmd_simple(ism, ISM_UNREG_SBA); ++ if (ret && ret != ISM_ERROR) + return -EIO; + + dma_free_coherent(&ism->pdev->dev, PAGE_SIZE, +@@ -158,10 +161,13 @@ static int unregister_sba(struct ism_dev *ism) + + static int unregister_ieq(struct ism_dev *ism) + { ++ int ret; ++ + if (!ism->ieq) + return 0; + +- if (ism_cmd_simple(ism, ISM_UNREG_IEQ)) ++ ret = ism_cmd_simple(ism, ISM_UNREG_IEQ); ++ if (ret && ret != ISM_ERROR) + return -EIO; + + dma_free_coherent(&ism->pdev->dev, PAGE_SIZE, +@@ -288,7 +294,7 @@ static int ism_unregister_dmb(struct smcd_dev *smcd, struct smcd_dmb *dmb) + cmd.request.dmb_tok = dmb->dmb_tok; + + ret = ism_cmd(ism, &cmd); +- if (ret) ++ if (ret && ret != ISM_ERROR) + goto out; + + ism_free_dmb(ism, dmb); +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index 3f97ec4aac4b..780651c4fc0c 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -1445,7 +1445,7 @@ bind_err: + static struct bnx2fc_interface * + bnx2fc_interface_create(struct bnx2fc_hba *hba, + struct net_device *netdev, +- enum fip_state fip_mode) ++ enum fip_mode fip_mode) + { + struct fcoe_ctlr_device *ctlr_dev; + struct bnx2fc_interface *interface; +diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c +index f46b312d04bc..6768b2e8148a 100644 +--- a/drivers/scsi/fcoe/fcoe.c ++++ b/drivers/scsi/fcoe/fcoe.c +@@ -390,7 +390,7 @@ static int fcoe_interface_setup(struct fcoe_interface *fcoe, + * Returns: pointer to a struct fcoe_interface or NULL on error + */ + static struct fcoe_interface *fcoe_interface_create(struct net_device *netdev, +- enum fip_state fip_mode) ++ enum fip_mode fip_mode) + { + struct fcoe_ctlr_device *ctlr_dev; + struct fcoe_ctlr *ctlr; +diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c +index 54da3166da8d..7dc4ffa24430 100644 +--- a/drivers/scsi/fcoe/fcoe_ctlr.c ++++ b/drivers/scsi/fcoe/fcoe_ctlr.c +@@ -147,7 +147,7 @@ static void fcoe_ctlr_map_dest(struct fcoe_ctlr *fip) + * fcoe_ctlr_init() - Initialize the FCoE Controller instance + * @fip: The FCoE controller to initialize + */ +-void fcoe_ctlr_init(struct fcoe_ctlr *fip, enum fip_state mode) ++void fcoe_ctlr_init(struct fcoe_ctlr *fip, enum fip_mode mode) + { + fcoe_ctlr_set_state(fip, FIP_ST_LINK_WAIT); + fip->mode = mode; +@@ -454,7 +454,10 @@ void fcoe_ctlr_link_up(struct fcoe_ctlr *fip) + mutex_unlock(&fip->ctlr_mutex); + fc_linkup(fip->lp); + } else if (fip->state == FIP_ST_LINK_WAIT) { +- fcoe_ctlr_set_state(fip, fip->mode); ++ if (fip->mode == FIP_MODE_NON_FIP) ++ fcoe_ctlr_set_state(fip, FIP_ST_NON_FIP); ++ else ++ fcoe_ctlr_set_state(fip, FIP_ST_AUTO); + switch (fip->mode) { + default: + LIBFCOE_FIP_DBG(fip, "invalid mode %d\n", fip->mode); +diff --git a/drivers/scsi/fcoe/fcoe_transport.c b/drivers/scsi/fcoe/fcoe_transport.c +index f4909cd206d3..f15d5e1d56b1 100644 +--- a/drivers/scsi/fcoe/fcoe_transport.c ++++ b/drivers/scsi/fcoe/fcoe_transport.c +@@ -873,7 +873,7 @@ static int fcoe_transport_create(const char *buffer, + int rc = -ENODEV; + struct net_device *netdev = NULL; + struct fcoe_transport *ft = NULL; +- enum fip_state fip_mode = (enum fip_state)(long)kp->arg; ++ enum fip_mode fip_mode = (enum fip_mode)kp->arg; + + mutex_lock(&ft_mutex); + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index a4e2e6aa9a6b..fd9d82c9033d 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -10,6 +10,7 @@ + */ + + #include "hisi_sas.h" ++#include "../libsas/sas_internal.h" + #define DRV_NAME "hisi_sas" + + #define DEV_IS_GONE(dev) \ +@@ -809,7 +810,8 @@ static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task + spin_lock_irqsave(&task->task_state_lock, flags); + task->task_state_flags &= + ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR); +- task->task_state_flags |= SAS_TASK_STATE_DONE; ++ if (!slot->is_internal && task->task_proto != SAS_PROTOCOL_SMP) ++ task->task_state_flags |= SAS_TASK_STATE_DONE; + spin_unlock_irqrestore(&task->task_state_lock, flags); + } + +@@ -1879,9 +1881,18 @@ static int hisi_sas_write_gpio(struct sas_ha_struct *sha, u8 reg_type, + + static void hisi_sas_phy_disconnected(struct hisi_sas_phy *phy) + { ++ struct asd_sas_phy *sas_phy = &phy->sas_phy; ++ struct sas_phy *sphy = sas_phy->phy; ++ struct sas_phy_data *d = sphy->hostdata; ++ + phy->phy_attached = 0; + phy->phy_type = 0; + phy->port = NULL; ++ ++ if (d->enable) ++ sphy->negotiated_linkrate = SAS_LINK_RATE_UNKNOWN; ++ else ++ sphy->negotiated_linkrate = SAS_PHY_DISABLED; + } + + void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy) +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index f6de7526ded5..acb503ea8f0c 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -4155,6 +4155,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance) + if (megasas_create_frame_pool(instance)) { + dev_printk(KERN_DEBUG, &instance->pdev->dev, "Error creating frame DMA pool\n"); + megasas_free_cmds(instance); ++ return -ENOMEM; + } + + return 0; +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 0a5dd5595dd3..cd61905ca2f5 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -1418,7 +1418,7 @@ static struct libfc_function_template qedf_lport_template = { + + static void qedf_fcoe_ctlr_setup(struct qedf_ctx *qedf) + { +- fcoe_ctlr_init(&qedf->ctlr, FIP_ST_AUTO); ++ fcoe_ctlr_init(&qedf->ctlr, FIP_MODE_AUTO); + + qedf->ctlr.send = qedf_fip_send; + qedf->ctlr.get_src_addr = qedf_get_src_mac; +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 78ca63dfba4a..9a7e3a3bd5ce 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -220,7 +220,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, + struct Scsi_Host *shost = dev_to_shost(starget->dev.parent); + + sdev = kzalloc(sizeof(*sdev) + shost->transportt->device_size, +- GFP_ATOMIC); ++ GFP_KERNEL); + if (!sdev) + goto out; + +@@ -796,7 +796,7 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result, + */ + sdev->inquiry = kmemdup(inq_result, + max_t(size_t, sdev->inquiry_len, 36), +- GFP_ATOMIC); ++ GFP_KERNEL); + if (sdev->inquiry == NULL) + return SCSI_SCAN_NO_RESPONSE; + +@@ -1087,7 +1087,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget, + if (!sdev) + goto out; + +- result = kmalloc(result_len, GFP_ATOMIC | ++ result = kmalloc(result_len, GFP_KERNEL | + ((shost->unchecked_isa_dma) ? __GFP_DMA : 0)); + if (!result) + goto out_free_sdev; +diff --git a/drivers/soc/qcom/qcom_gsbi.c b/drivers/soc/qcom/qcom_gsbi.c +index 09c669e70d63..038abc377fdb 100644 +--- a/drivers/soc/qcom/qcom_gsbi.c ++++ b/drivers/soc/qcom/qcom_gsbi.c +@@ -138,7 +138,7 @@ static int gsbi_probe(struct platform_device *pdev) + struct resource *res; + void __iomem *base; + struct gsbi_info *gsbi; +- int i; ++ int i, ret; + u32 mask, gsbi_num; + const struct crci_config *config = NULL; + +@@ -221,7 +221,10 @@ static int gsbi_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, gsbi); + +- return of_platform_populate(node, NULL, NULL, &pdev->dev); ++ ret = of_platform_populate(node, NULL, NULL, &pdev->dev); ++ if (ret) ++ clk_disable_unprepare(gsbi->hclk); ++ return ret; + } + + static int gsbi_remove(struct platform_device *pdev) +diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c +index a33ee8ef8b6b..51625703399e 100644 +--- a/drivers/soc/tegra/fuse/fuse-tegra.c ++++ b/drivers/soc/tegra/fuse/fuse-tegra.c +@@ -137,13 +137,17 @@ static int tegra_fuse_probe(struct platform_device *pdev) + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + fuse->phys = res->start; + fuse->base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(fuse->base)) +- return PTR_ERR(fuse->base); ++ if (IS_ERR(fuse->base)) { ++ err = PTR_ERR(fuse->base); ++ fuse->base = base; ++ return err; ++ } + + fuse->clk = devm_clk_get(&pdev->dev, "fuse"); + if (IS_ERR(fuse->clk)) { + dev_err(&pdev->dev, "failed to get FUSE clock: %ld", + PTR_ERR(fuse->clk)); ++ fuse->base = base; + return PTR_ERR(fuse->clk); + } + +@@ -152,8 +156,10 @@ static int tegra_fuse_probe(struct platform_device *pdev) + + if (fuse->soc->probe) { + err = fuse->soc->probe(fuse); +- if (err < 0) ++ if (err < 0) { ++ fuse->base = base; + return err; ++ } + } + + if (tegra_fuse_create_sysfs(&pdev->dev, fuse->soc->info->size, +diff --git a/drivers/staging/mt7621-spi/spi-mt7621.c b/drivers/staging/mt7621-spi/spi-mt7621.c +index d045b5568e0f..578aa6824ad3 100644 +--- a/drivers/staging/mt7621-spi/spi-mt7621.c ++++ b/drivers/staging/mt7621-spi/spi-mt7621.c +@@ -429,6 +429,7 @@ static int mt7621_spi_probe(struct platform_device *pdev) + int status = 0; + struct clk *clk; + struct mt7621_spi_ops *ops; ++ int ret; + + match = of_match_device(mt7621_spi_match, &pdev->dev); + if (!match) +@@ -476,7 +477,11 @@ static int mt7621_spi_probe(struct platform_device *pdev) + rs->pending_write = 0; + dev_info(&pdev->dev, "sys_freq: %u\n", rs->sys_freq); + +- device_reset(&pdev->dev); ++ ret = device_reset(&pdev->dev); ++ if (ret) { ++ dev_err(&pdev->dev, "SPI reset failed!\n"); ++ return ret; ++ } + + mt7621_spi_reset(rs, 0); + +diff --git a/drivers/tty/serial/8250/8250_pxa.c b/drivers/tty/serial/8250/8250_pxa.c +index b9bcbe20a2be..c47188860e32 100644 +--- a/drivers/tty/serial/8250/8250_pxa.c ++++ b/drivers/tty/serial/8250/8250_pxa.c +@@ -113,6 +113,10 @@ static int serial_pxa_probe(struct platform_device *pdev) + if (ret) + return ret; + ++ ret = of_alias_get_id(pdev->dev.of_node, "serial"); ++ if (ret >= 0) ++ uart.port.line = ret; ++ + uart.port.type = PORT_XSCALE; + uart.port.iotype = UPIO_MEM32; + uart.port.mapbase = mmres->start; +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index bfdd5ad4116f..1cb80fe5f95c 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -163,6 +163,8 @@ struct atmel_uart_port { + unsigned int pending_status; + spinlock_t lock_suspended; + ++ bool hd_start_rx; /* can start RX during half-duplex operation */ ++ + #ifdef CONFIG_PM + struct { + u32 cr; +@@ -225,6 +227,12 @@ static inline void atmel_uart_write_char(struct uart_port *port, u8 value) + __raw_writeb(value, port->membase + ATMEL_US_THR); + } + ++static inline int atmel_uart_is_half_duplex(struct uart_port *port) ++{ ++ return (port->rs485.flags & SER_RS485_ENABLED) && ++ !(port->rs485.flags & SER_RS485_RX_DURING_TX); ++} ++ + #ifdef CONFIG_SERIAL_ATMEL_PDC + static bool atmel_use_pdc_rx(struct uart_port *port) + { +@@ -481,9 +489,9 @@ static void atmel_stop_tx(struct uart_port *port) + /* Disable interrupts */ + atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); + +- if ((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ++ if (atmel_uart_is_half_duplex(port)) + atmel_start_rx(port); ++ + } + + /* +@@ -500,8 +508,7 @@ static void atmel_start_tx(struct uart_port *port) + return; + + if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port)) +- if ((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ++ if (atmel_uart_is_half_duplex(port)) + atmel_stop_rx(port); + + if (atmel_use_pdc_tx(port)) +@@ -799,10 +806,14 @@ static void atmel_complete_tx_dma(void *arg) + */ + if (!uart_circ_empty(xmit)) + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); +- else if ((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { +- /* DMA done, stop TX, start RX for RS485 */ +- atmel_start_rx(port); ++ else if (atmel_uart_is_half_duplex(port)) { ++ /* ++ * DMA done, re-enable TXEMPTY and signal that we can stop ++ * TX and start RX for RS485 ++ */ ++ atmel_port->hd_start_rx = true; ++ atmel_uart_writel(port, ATMEL_US_IER, ++ atmel_port->tx_done_mask); + } + + spin_unlock_irqrestore(&port->lock, flags); +@@ -1248,9 +1259,20 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending) + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + + if (pending & atmel_port->tx_done_mask) { +- /* Either PDC or interrupt transmission */ + atmel_uart_writel(port, ATMEL_US_IDR, + atmel_port->tx_done_mask); ++ ++ /* Start RX if flag was set and FIFO is empty */ ++ if (atmel_port->hd_start_rx) { ++ if (!(atmel_uart_readl(port, ATMEL_US_CSR) ++ & ATMEL_US_TXEMPTY)) ++ dev_warn(port->dev, "Should start RX, but TX fifo is not empty\n"); ++ ++ atmel_port->hd_start_rx = false; ++ atmel_start_rx(port); ++ return; ++ } ++ + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); + } + } +@@ -1377,8 +1399,7 @@ static void atmel_tx_pdc(struct uart_port *port) + atmel_uart_writel(port, ATMEL_US_IER, + atmel_port->tx_done_mask); + } else { +- if ((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { ++ if (atmel_uart_is_half_duplex(port)) { + /* DMA done, stop TX, start RX for RS485 */ + atmel_start_rx(port); + } +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index ae3ce330200e..ee3aa57bc0e7 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -26,7 +26,7 @@ + * Byte threshold to limit memory consumption for flip buffers. + * The actual memory limit is > 2x this amount. + */ +-#define TTYB_DEFAULT_MEM_LIMIT 65536 ++#define TTYB_DEFAULT_MEM_LIMIT (640 * 1024UL) + + /* + * We default to dicing tty buffer allocations to this many characters +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index 85fc6db48e44..159b897c5e80 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -935,8 +935,15 @@ static int ci_hdrc_probe(struct platform_device *pdev) + } else if (ci->platdata->usb_phy) { + ci->usb_phy = ci->platdata->usb_phy; + } else { ++ ci->usb_phy = devm_usb_get_phy_by_phandle(dev->parent, "phys", ++ 0); + ci->phy = devm_phy_get(dev->parent, "usb-phy"); +- ci->usb_phy = devm_usb_get_phy(dev->parent, USB_PHY_TYPE_USB2); ++ ++ /* Fallback to grabbing any registered USB2 PHY */ ++ if (IS_ERR(ci->usb_phy) && ++ PTR_ERR(ci->usb_phy) != -EPROBE_DEFER) ++ ci->usb_phy = devm_usb_get_phy(dev->parent, ++ USB_PHY_TYPE_USB2); + + /* if both generic PHY and USB PHY layers aren't enabled */ + if (PTR_ERR(ci->phy) == -ENOSYS && +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 700fb626ad03..524104eed8a7 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3233,6 +3233,8 @@ int dwc3_gadget_init(struct dwc3 *dwc) + goto err4; + } + ++ dwc3_gadget_set_speed(&dwc->gadget, dwc->maximum_speed); ++ + return 0; + + err4: +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 31e8bf3578c8..aa15593a3ac4 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1008,6 +1008,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) + * condition with req->complete callback. + */ + usb_ep_dequeue(ep->ep, req); ++ wait_for_completion(&done); + interrupted = ep->status < 0; + } + +diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c +index 6bde543452f2..7ddc0930e98c 100644 +--- a/drivers/video/backlight/pwm_bl.c ++++ b/drivers/video/backlight/pwm_bl.c +@@ -425,7 +425,7 @@ static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb) + */ + + /* if the enable GPIO is disabled, do not enable the backlight */ +- if (pb->enable_gpio && gpiod_get_value(pb->enable_gpio) == 0) ++ if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0) + return FB_BLANK_POWERDOWN; + + /* The regulator is disabled, do not enable the backlight */ +diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c +index 77cee99fc36c..c48f083d522a 100644 +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -427,6 +427,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, + { + unsigned int x; + ++ if (image->width > info->var.xres || image->height > info->var.yres) ++ return; ++ + if (rotate == FB_ROTATE_UR) { + for (x = 0; + x < num && image->dx + image->width <= info->var.xres; +diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c +index cba6b586bfbd..d97fcfc5e558 100644 +--- a/drivers/xen/gntdev-dmabuf.c ++++ b/drivers/xen/gntdev-dmabuf.c +@@ -80,6 +80,12 @@ struct gntdev_dmabuf_priv { + struct list_head imp_list; + /* This is the lock which protects dma_buf_xxx lists. */ + struct mutex lock; ++ /* ++ * We reference this file while exporting dma-bufs, so ++ * the grant device context is not destroyed while there are ++ * external users alive. ++ */ ++ struct file *filp; + }; + + /* DMA buffer export support. */ +@@ -311,6 +317,7 @@ static void dmabuf_exp_release(struct kref *kref) + + dmabuf_exp_wait_obj_signal(gntdev_dmabuf->priv, gntdev_dmabuf); + list_del(&gntdev_dmabuf->next); ++ fput(gntdev_dmabuf->priv->filp); + kfree(gntdev_dmabuf); + } + +@@ -423,6 +430,7 @@ static int dmabuf_exp_from_pages(struct gntdev_dmabuf_export_args *args) + mutex_lock(&args->dmabuf_priv->lock); + list_add(&gntdev_dmabuf->next, &args->dmabuf_priv->exp_list); + mutex_unlock(&args->dmabuf_priv->lock); ++ get_file(gntdev_dmabuf->priv->filp); + return 0; + + fail: +@@ -834,7 +842,7 @@ long gntdev_ioctl_dmabuf_imp_release(struct gntdev_priv *priv, + return dmabuf_imp_release(priv->dmabuf_priv, op.fd); + } + +-struct gntdev_dmabuf_priv *gntdev_dmabuf_init(void) ++struct gntdev_dmabuf_priv *gntdev_dmabuf_init(struct file *filp) + { + struct gntdev_dmabuf_priv *priv; + +@@ -847,6 +855,8 @@ struct gntdev_dmabuf_priv *gntdev_dmabuf_init(void) + INIT_LIST_HEAD(&priv->exp_wait_list); + INIT_LIST_HEAD(&priv->imp_list); + ++ priv->filp = filp; ++ + return priv; + } + +diff --git a/drivers/xen/gntdev-dmabuf.h b/drivers/xen/gntdev-dmabuf.h +index 7220a53d0fc5..3d9b9cf9d5a1 100644 +--- a/drivers/xen/gntdev-dmabuf.h ++++ b/drivers/xen/gntdev-dmabuf.h +@@ -14,7 +14,7 @@ + struct gntdev_dmabuf_priv; + struct gntdev_priv; + +-struct gntdev_dmabuf_priv *gntdev_dmabuf_init(void); ++struct gntdev_dmabuf_priv *gntdev_dmabuf_init(struct file *filp); + + void gntdev_dmabuf_fini(struct gntdev_dmabuf_priv *priv); + +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index b0b02a501167..9d8e02cfd480 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -600,7 +600,7 @@ static int gntdev_open(struct inode *inode, struct file *flip) + mutex_init(&priv->lock); + + #ifdef CONFIG_XEN_GNTDEV_DMABUF +- priv->dmabuf_priv = gntdev_dmabuf_init(); ++ priv->dmabuf_priv = gntdev_dmabuf_init(flip); + if (IS_ERR(priv->dmabuf_priv)) { + ret = PTR_ERR(priv->dmabuf_priv); + kfree(priv); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index e1fcb28ad4cc..e46e83e87600 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2427,16 +2427,15 @@ out: + /* + * Two limits to commit transaction in advance. + * +- * For RATIO, it will be 1/RATIO of the remaining limit +- * (excluding data and prealloc meta) as threshold. ++ * For RATIO, it will be 1/RATIO of the remaining limit as threshold. + * For SIZE, it will be in byte unit as threshold. + */ +-#define QGROUP_PERTRANS_RATIO 32 +-#define QGROUP_PERTRANS_SIZE SZ_32M ++#define QGROUP_FREE_RATIO 32 ++#define QGROUP_FREE_SIZE SZ_32M + static bool qgroup_check_limits(struct btrfs_fs_info *fs_info, + const struct btrfs_qgroup *qg, u64 num_bytes) + { +- u64 limit; ++ u64 free; + u64 threshold; + + if ((qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_RFER) && +@@ -2455,20 +2454,21 @@ static bool qgroup_check_limits(struct btrfs_fs_info *fs_info, + */ + if ((qg->lim_flags & (BTRFS_QGROUP_LIMIT_MAX_RFER | + BTRFS_QGROUP_LIMIT_MAX_EXCL))) { +- if (qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_EXCL) +- limit = qg->max_excl; +- else +- limit = qg->max_rfer; +- threshold = (limit - qg->rsv.values[BTRFS_QGROUP_RSV_DATA] - +- qg->rsv.values[BTRFS_QGROUP_RSV_META_PREALLOC]) / +- QGROUP_PERTRANS_RATIO; +- threshold = min_t(u64, threshold, QGROUP_PERTRANS_SIZE); ++ if (qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_EXCL) { ++ free = qg->max_excl - qgroup_rsv_total(qg) - qg->excl; ++ threshold = min_t(u64, qg->max_excl / QGROUP_FREE_RATIO, ++ QGROUP_FREE_SIZE); ++ } else { ++ free = qg->max_rfer - qgroup_rsv_total(qg) - qg->rfer; ++ threshold = min_t(u64, qg->max_rfer / QGROUP_FREE_RATIO, ++ QGROUP_FREE_SIZE); ++ } + + /* + * Use transaction_kthread to commit transaction, so we no + * longer need to bother nested transaction nor lock context. + */ +- if (qg->rsv.values[BTRFS_QGROUP_RSV_META_PERTRANS] > threshold) ++ if (free < threshold) + btrfs_commit_transaction_locksafe(fs_info); + } + +diff --git a/fs/buffer.c b/fs/buffer.c +index c083c4b3c1e7..a550e0d8e965 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -3027,6 +3027,13 @@ void guard_bio_eod(int op, struct bio *bio) + /* Uhhuh. We've got a bio that straddles the device size! */ + truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9); + ++ /* ++ * The bio contains more than one segment which spans EOD, just return ++ * and let IO layer turn it into an EIO ++ */ ++ if (truncated_bytes > bvec->bv_len) ++ return; ++ + /* Truncate the bio.. */ + bio->bi_iter.bi_size -= truncated_bytes; + bvec->bv_len -= truncated_bytes; +diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c +index 6b61df117fd4..563e2f6268c3 100644 +--- a/fs/cifs/cifs_dfs_ref.c ++++ b/fs/cifs/cifs_dfs_ref.c +@@ -271,9 +271,9 @@ static void dump_referral(const struct dfs_info3_param *ref) + { + cifs_dbg(FYI, "DFS: ref path: %s\n", ref->path_name); + cifs_dbg(FYI, "DFS: node path: %s\n", ref->node_name); +- cifs_dbg(FYI, "DFS: fl: %hd, srv_type: %hd\n", ++ cifs_dbg(FYI, "DFS: fl: %d, srv_type: %d\n", + ref->flags, ref->server_type); +- cifs_dbg(FYI, "DFS: ref_flags: %hd, path_consumed: %hd\n", ++ cifs_dbg(FYI, "DFS: ref_flags: %d, path_consumed: %d\n", + ref->ref_flag, ref->path_consumed); + } + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index a5ea742654aa..f31339db45fd 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1347,6 +1347,11 @@ cifs_parse_devname(const char *devname, struct smb_vol *vol) + const char *delims = "/\\"; + size_t len; + ++ if (unlikely(!devname || !*devname)) { ++ cifs_dbg(VFS, "Device name not specified.\n"); ++ return -EINVAL; ++ } ++ + /* make sure we have a valid UNC double delimiter prefix */ + len = strspn(devname, delims); + if (len != 2) +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 08761a6a039d..d847132ab027 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -1631,8 +1631,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type, + rc = server->ops->mand_unlock_range(cfile, flock, xid); + + out: +- if (flock->fl_flags & FL_POSIX && !rc) ++ if (flock->fl_flags & FL_POSIX) { ++ /* ++ * If this is a request to remove all locks because we ++ * are closing the file, it doesn't matter if the ++ * unlocking failed as both cifs.ko and the SMB server ++ * remove the lock on file close ++ */ ++ if (rc) { ++ cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc); ++ if (!(flock->fl_flags & FL_CLOSE)) ++ return rc; ++ } + rc = locks_lock_file_wait(file, flock); ++ } + return rc; + } + +diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c +index 378151e09e91..47db8eb6cbcf 100644 +--- a/fs/cifs/smb1ops.c ++++ b/fs/cifs/smb1ops.c +@@ -308,7 +308,7 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr) + remaining = tgt_total_cnt - total_in_tgt; + + if (remaining < 0) { +- cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%hu\n", ++ cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%u\n", + tgt_total_cnt, total_in_tgt); + return -EPROTO; + } +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 3d0db37d64ad..71f32d983384 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -881,8 +881,14 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) + rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, + FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */, + (char *)pneg_inbuf, inbuflen, (char **)&pneg_rsp, &rsplen); +- +- if (rc != 0) { ++ if (rc == -EOPNOTSUPP) { ++ /* ++ * Old Windows versions or Netapp SMB server can return ++ * not supported error. Client should accept it. ++ */ ++ cifs_dbg(VFS, "Server does not support validate negotiate\n"); ++ return 0; ++ } else if (rc != 0) { + cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc); + rc = -EIO; + goto out_free_inbuf; +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index 9e96a0bd08d9..e1801b288847 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -1219,6 +1219,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode, + ext4_lblk_t offsets[4], offsets2[4]; + Indirect chain[4], chain2[4]; + Indirect *partial, *partial2; ++ Indirect *p = NULL, *p2 = NULL; + ext4_lblk_t max_block; + __le32 nr = 0, nr2 = 0; + int n = 0, n2 = 0; +@@ -1260,7 +1261,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode, + } + + +- partial = ext4_find_shared(inode, n, offsets, chain, &nr); ++ partial = p = ext4_find_shared(inode, n, offsets, chain, &nr); + if (nr) { + if (partial == chain) { + /* Shared branch grows from the inode */ +@@ -1285,13 +1286,11 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode, + partial->p + 1, + (__le32 *)partial->bh->b_data+addr_per_block, + (chain+n-1) - partial); +- BUFFER_TRACE(partial->bh, "call brelse"); +- brelse(partial->bh); + partial--; + } + + end_range: +- partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); ++ partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); + if (nr2) { + if (partial2 == chain2) { + /* +@@ -1321,16 +1320,14 @@ end_range: + (__le32 *)partial2->bh->b_data, + partial2->p, + (chain2+n2-1) - partial2); +- BUFFER_TRACE(partial2->bh, "call brelse"); +- brelse(partial2->bh); + partial2--; + } + goto do_indirects; + } + + /* Punch happened within the same level (n == n2) */ +- partial = ext4_find_shared(inode, n, offsets, chain, &nr); +- partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); ++ partial = p = ext4_find_shared(inode, n, offsets, chain, &nr); ++ partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); + + /* Free top, but only if partial2 isn't its subtree. */ + if (nr) { +@@ -1387,15 +1384,7 @@ end_range: + partial->p + 1, + partial2->p, + (chain+n-1) - partial); +- while (partial > chain) { +- BUFFER_TRACE(partial->bh, "call brelse"); +- brelse(partial->bh); +- } +- while (partial2 > chain2) { +- BUFFER_TRACE(partial2->bh, "call brelse"); +- brelse(partial2->bh); +- } +- return 0; ++ goto cleanup; + } + + /* +@@ -1410,8 +1399,6 @@ end_range: + partial->p + 1, + (__le32 *)partial->bh->b_data+addr_per_block, + (chain+n-1) - partial); +- BUFFER_TRACE(partial->bh, "call brelse"); +- brelse(partial->bh); + partial--; + } + if (partial2 > chain2 && depth2 <= depth) { +@@ -1419,11 +1406,21 @@ end_range: + (__le32 *)partial2->bh->b_data, + partial2->p, + (chain2+n2-1) - partial2); +- BUFFER_TRACE(partial2->bh, "call brelse"); +- brelse(partial2->bh); + partial2--; + } + } ++ ++cleanup: ++ while (p && p > chain) { ++ BUFFER_TRACE(p->bh, "call brelse"); ++ brelse(p->bh); ++ p--; ++ } ++ while (p2 && p2 > chain2) { ++ BUFFER_TRACE(p2->bh, "call brelse"); ++ brelse(p2->bh); ++ p2--; ++ } + return 0; + + do_indirects: +@@ -1431,7 +1428,7 @@ do_indirects: + switch (offsets[0]) { + default: + if (++n >= n2) +- return 0; ++ break; + nr = i_data[EXT4_IND_BLOCK]; + if (nr) { + ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 1); +@@ -1439,7 +1436,7 @@ do_indirects: + } + case EXT4_IND_BLOCK: + if (++n >= n2) +- return 0; ++ break; + nr = i_data[EXT4_DIND_BLOCK]; + if (nr) { + ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 2); +@@ -1447,7 +1444,7 @@ do_indirects: + } + case EXT4_DIND_BLOCK: + if (++n >= n2) +- return 0; ++ break; + nr = i_data[EXT4_TIND_BLOCK]; + if (nr) { + ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 3); +@@ -1456,5 +1453,5 @@ do_indirects: + case EXT4_TIND_BLOCK: + ; + } +- return 0; ++ goto cleanup; + } +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 42aef5c94927..a3ba20e5946f 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -450,7 +450,6 @@ struct f2fs_flush_device { + + /* for inline stuff */ + #define DEF_INLINE_RESERVED_SIZE 1 +-#define DEF_MIN_INLINE_SIZE 1 + static inline int get_extra_isize(struct inode *inode); + static inline int get_inline_xattr_addrs(struct inode *inode); + #define MAX_INLINE_DATA(inode) (sizeof(__le32) * \ +diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c +index 115dc219344b..92703efde36e 100644 +--- a/fs/f2fs/inline.c ++++ b/fs/f2fs/inline.c +@@ -661,6 +661,12 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx, + if (IS_ERR(ipage)) + return PTR_ERR(ipage); + ++ /* ++ * f2fs_readdir was protected by inode.i_rwsem, it is safe to access ++ * ipage without page's lock held. ++ */ ++ unlock_page(ipage); ++ + inline_dentry = inline_data_addr(inode, ipage); + + make_dentry_ptr_inline(inode, &d, inline_dentry); +@@ -669,7 +675,7 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx, + if (!err) + ctx->pos = d.max; + +- f2fs_put_page(ipage, 1); ++ f2fs_put_page(ipage, 0); + return err < 0 ? err : 0; + } + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index c9639ef0e8d5..79370b7fa9d2 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -822,12 +822,13 @@ static int parse_options(struct super_block *sb, char *options) + "set with inline_xattr option"); + return -EINVAL; + } +- if (!F2FS_OPTION(sbi).inline_xattr_size || +- F2FS_OPTION(sbi).inline_xattr_size >= +- DEF_ADDRS_PER_INODE - +- F2FS_TOTAL_EXTRA_ATTR_SIZE - +- DEF_INLINE_RESERVED_SIZE - +- DEF_MIN_INLINE_SIZE) { ++ if (F2FS_OPTION(sbi).inline_xattr_size < ++ sizeof(struct f2fs_xattr_header) / sizeof(__le32) || ++ F2FS_OPTION(sbi).inline_xattr_size > ++ DEF_ADDRS_PER_INODE - ++ F2FS_TOTAL_EXTRA_ATTR_SIZE / sizeof(__le32) - ++ DEF_INLINE_RESERVED_SIZE - ++ MIN_INLINE_DENTRY_SIZE / sizeof(__le32)) { + f2fs_msg(sb, KERN_ERR, + "inline xattr size is out of range"); + return -EINVAL; +diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c +index 81c0e5337443..98887187af4c 100644 +--- a/fs/f2fs/sysfs.c ++++ b/fs/f2fs/sysfs.c +@@ -273,10 +273,16 @@ out: + return count; + } + +- *ui = t; + +- if (!strcmp(a->attr.name, "iostat_enable") && *ui == 0) +- f2fs_reset_iostat(sbi); ++ if (!strcmp(a->attr.name, "iostat_enable")) { ++ sbi->iostat_enable = !!t; ++ if (!sbi->iostat_enable) ++ f2fs_reset_iostat(sbi); ++ return count; ++ } ++ ++ *ui = (unsigned int)t; ++ + return count; + } + +diff --git a/fs/f2fs/trace.c b/fs/f2fs/trace.c +index a1fcd00bbb2b..8ac1851a21c0 100644 +--- a/fs/f2fs/trace.c ++++ b/fs/f2fs/trace.c +@@ -17,7 +17,7 @@ + #include "trace.h" + + static RADIX_TREE(pids, GFP_ATOMIC); +-static struct mutex pids_lock; ++static spinlock_t pids_lock; + static struct last_io_info last_io; + + static inline void __print_last_io(void) +@@ -61,23 +61,29 @@ void f2fs_trace_pid(struct page *page) + + set_page_private(page, (unsigned long)pid); + ++retry: + if (radix_tree_preload(GFP_NOFS)) + return; + +- mutex_lock(&pids_lock); ++ spin_lock(&pids_lock); + p = radix_tree_lookup(&pids, pid); + if (p == current) + goto out; + if (p) + radix_tree_delete(&pids, pid); + +- f2fs_radix_tree_insert(&pids, pid, current); ++ if (radix_tree_insert(&pids, pid, current)) { ++ spin_unlock(&pids_lock); ++ radix_tree_preload_end(); ++ cond_resched(); ++ goto retry; ++ } + + trace_printk("%3x:%3x %4x %-16s\n", + MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev), + pid, current->comm); + out: +- mutex_unlock(&pids_lock); ++ spin_unlock(&pids_lock); + radix_tree_preload_end(); + } + +@@ -122,7 +128,7 @@ void f2fs_trace_ios(struct f2fs_io_info *fio, int flush) + + void f2fs_build_trace_ios(void) + { +- mutex_init(&pids_lock); ++ spin_lock_init(&pids_lock); + } + + #define PIDVEC_SIZE 128 +@@ -150,7 +156,7 @@ void f2fs_destroy_trace_ios(void) + pid_t next_pid = 0; + unsigned int found; + +- mutex_lock(&pids_lock); ++ spin_lock(&pids_lock); + while ((found = gang_lookup_pids(pid, next_pid, PIDVEC_SIZE))) { + unsigned idx; + +@@ -158,5 +164,5 @@ void f2fs_destroy_trace_ios(void) + for (idx = 0; idx < found; idx++) + radix_tree_delete(&pids, pid[idx]); + } +- mutex_unlock(&pids_lock); ++ spin_unlock(&pids_lock); + } +diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c +index 087e53a2d96c..409a637f7a92 100644 +--- a/fs/f2fs/xattr.c ++++ b/fs/f2fs/xattr.c +@@ -227,11 +227,11 @@ static struct f2fs_xattr_entry *__find_inline_xattr(struct inode *inode, + { + struct f2fs_xattr_entry *entry; + unsigned int inline_size = inline_xattr_size(inode); ++ void *max_addr = base_addr + inline_size; + + list_for_each_xattr(entry, base_addr) { +- if ((void *)entry + sizeof(__u32) > base_addr + inline_size || +- (void *)XATTR_NEXT_ENTRY(entry) + sizeof(__u32) > +- base_addr + inline_size) { ++ if ((void *)entry + sizeof(__u32) > max_addr || ++ (void *)XATTR_NEXT_ENTRY(entry) > max_addr) { + *last_addr = entry; + return NULL; + } +@@ -242,6 +242,13 @@ static struct f2fs_xattr_entry *__find_inline_xattr(struct inode *inode, + if (!memcmp(entry->e_name, name, len)) + break; + } ++ ++ /* inline xattr header or entry across max inline xattr size */ ++ if (IS_XATTR_LAST_ENTRY(entry) && ++ (void *)entry + sizeof(__u32) > max_addr) { ++ *last_addr = entry; ++ return NULL; ++ } + return entry; + } + +diff --git a/fs/file.c b/fs/file.c +index 7ffd6e9d103d..780d29e58847 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -457,6 +457,7 @@ struct files_struct init_files = { + .full_fds_bits = init_files.full_fds_bits_init, + }, + .file_lock = __SPIN_LOCK_UNLOCKED(init_files.file_lock), ++ .resize_wait = __WAIT_QUEUE_HEAD_INITIALIZER(init_files.resize_wait), + }; + + static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start) +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index 150cc030b4d7..65ea0355a4f6 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -691,9 +691,11 @@ void jbd2_journal_commit_transaction(journal_t *journal) + the last tag we set up. */ + + tag->t_flags |= cpu_to_be16(JBD2_FLAG_LAST_TAG); +- +- jbd2_descriptor_block_csum_set(journal, descriptor); + start_journal_io: ++ if (descriptor) ++ jbd2_descriptor_block_csum_set(journal, ++ descriptor); ++ + for (i = 0; i < bufs; i++) { + struct buffer_head *bh = wbuf[i]; + /* +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 8ef6b6daaa7a..88f2a49338a1 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1356,6 +1356,10 @@ static int journal_reset(journal_t *journal) + return jbd2_journal_start_thread(journal); + } + ++/* ++ * This function expects that the caller will have locked the journal ++ * buffer head, and will return with it unlocked ++ */ + static int jbd2_write_superblock(journal_t *journal, int write_flags) + { + struct buffer_head *bh = journal->j_sb_buffer; +@@ -1365,7 +1369,6 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) + trace_jbd2_write_superblock(journal, write_flags); + if (!(journal->j_flags & JBD2_BARRIER)) + write_flags &= ~(REQ_FUA | REQ_PREFLUSH); +- lock_buffer(bh); + if (buffer_write_io_error(bh)) { + /* + * Oh, dear. A previous attempt to write the journal +@@ -1424,6 +1427,7 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", + tail_block, tail_tid); + ++ lock_buffer(journal->j_sb_buffer); + sb->s_sequence = cpu_to_be32(tail_tid); + sb->s_start = cpu_to_be32(tail_block); + +@@ -1454,18 +1458,17 @@ static void jbd2_mark_journal_empty(journal_t *journal, int write_op) + journal_superblock_t *sb = journal->j_superblock; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); +- read_lock(&journal->j_state_lock); +- /* Is it already empty? */ +- if (sb->s_start == 0) { +- read_unlock(&journal->j_state_lock); ++ lock_buffer(journal->j_sb_buffer); ++ if (sb->s_start == 0) { /* Is it already empty? */ ++ unlock_buffer(journal->j_sb_buffer); + return; + } ++ + jbd_debug(1, "JBD2: Marking journal as empty (seq %d)\n", + journal->j_tail_sequence); + + sb->s_sequence = cpu_to_be32(journal->j_tail_sequence); + sb->s_start = cpu_to_be32(0); +- read_unlock(&journal->j_state_lock); + + jbd2_write_superblock(journal, write_op); + +@@ -1488,9 +1491,8 @@ void jbd2_journal_update_sb_errno(journal_t *journal) + journal_superblock_t *sb = journal->j_superblock; + int errcode; + +- read_lock(&journal->j_state_lock); ++ lock_buffer(journal->j_sb_buffer); + errcode = journal->j_errno; +- read_unlock(&journal->j_state_lock); + if (errcode == -ESHUTDOWN) + errcode = 0; + jbd_debug(1, "JBD2: updating superblock error (errno %d)\n", errcode); +@@ -1894,28 +1896,27 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat, + + sb = journal->j_superblock; + ++ /* Load the checksum driver if necessary */ ++ if ((journal->j_chksum_driver == NULL) && ++ INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) { ++ journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0); ++ if (IS_ERR(journal->j_chksum_driver)) { ++ printk(KERN_ERR "JBD2: Cannot load crc32c driver.\n"); ++ journal->j_chksum_driver = NULL; ++ return 0; ++ } ++ /* Precompute checksum seed for all metadata */ ++ journal->j_csum_seed = jbd2_chksum(journal, ~0, sb->s_uuid, ++ sizeof(sb->s_uuid)); ++ } ++ ++ lock_buffer(journal->j_sb_buffer); ++ + /* If enabling v3 checksums, update superblock */ + if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) { + sb->s_checksum_type = JBD2_CRC32C_CHKSUM; + sb->s_feature_compat &= + ~cpu_to_be32(JBD2_FEATURE_COMPAT_CHECKSUM); +- +- /* Load the checksum driver */ +- if (journal->j_chksum_driver == NULL) { +- journal->j_chksum_driver = crypto_alloc_shash("crc32c", +- 0, 0); +- if (IS_ERR(journal->j_chksum_driver)) { +- printk(KERN_ERR "JBD2: Cannot load crc32c " +- "driver.\n"); +- journal->j_chksum_driver = NULL; +- return 0; +- } +- +- /* Precompute checksum seed for all metadata */ +- journal->j_csum_seed = jbd2_chksum(journal, ~0, +- sb->s_uuid, +- sizeof(sb->s_uuid)); +- } + } + + /* If enabling v1 checksums, downgrade superblock */ +@@ -1927,6 +1928,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat, + sb->s_feature_compat |= cpu_to_be32(compat); + sb->s_feature_ro_compat |= cpu_to_be32(ro); + sb->s_feature_incompat |= cpu_to_be32(incompat); ++ unlock_buffer(journal->j_sb_buffer); + + return 1; + #undef COMPAT_FEATURE_ON +diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c +index 0e4166cc23a0..4ac775e32240 100644 +--- a/fs/ocfs2/cluster/nodemanager.c ++++ b/fs/ocfs2/cluster/nodemanager.c +@@ -621,13 +621,15 @@ static void o2nm_node_group_drop_item(struct config_group *group, + struct o2nm_node *node = to_o2nm_node(item); + struct o2nm_cluster *cluster = to_o2nm_cluster(group->cg_item.ci_parent); + +- o2net_disconnect_node(node); ++ if (cluster->cl_nodes[node->nd_num] == node) { ++ o2net_disconnect_node(node); + +- if (cluster->cl_has_local && +- (cluster->cl_local_node == node->nd_num)) { +- cluster->cl_has_local = 0; +- cluster->cl_local_node = O2NM_INVALID_NODE_NUM; +- o2net_stop_listening(node); ++ if (cluster->cl_has_local && ++ (cluster->cl_local_node == node->nd_num)) { ++ cluster->cl_has_local = 0; ++ cluster->cl_local_node = O2NM_INVALID_NODE_NUM; ++ o2net_stop_listening(node); ++ } + } + + /* XXX call into net to stop this node from trading messages */ +diff --git a/fs/read_write.c b/fs/read_write.c +index 8a2737f0d61d..562974a0616c 100644 +--- a/fs/read_write.c ++++ b/fs/read_write.c +@@ -1241,6 +1241,9 @@ COMPAT_SYSCALL_DEFINE5(preadv64v2, unsigned long, fd, + const struct compat_iovec __user *,vec, + unsigned long, vlen, loff_t, pos, rwf_t, flags) + { ++ if (pos == -1) ++ return do_compat_readv(fd, vec, vlen, flags); ++ + return do_compat_preadv64(fd, vec, vlen, pos, flags); + } + #endif +@@ -1347,6 +1350,9 @@ COMPAT_SYSCALL_DEFINE5(pwritev64v2, unsigned long, fd, + const struct compat_iovec __user *,vec, + unsigned long, vlen, loff_t, pos, rwf_t, flags) + { ++ if (pos == -1) ++ return do_compat_writev(fd, vec, vlen, flags); ++ + return do_compat_pwritev64(fd, vec, vlen, pos, flags); + } + #endif +diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h +index 22254c1fe1c5..6002275937f5 100644 +--- a/include/linux/cgroup-defs.h ++++ b/include/linux/cgroup-defs.h +@@ -597,7 +597,7 @@ struct cgroup_subsys { + void (*cancel_fork)(struct task_struct *task); + void (*fork)(struct task_struct *task); + void (*exit)(struct task_struct *task); +- void (*free)(struct task_struct *task); ++ void (*release)(struct task_struct *task); + void (*bind)(struct cgroup_subsys_state *root_css); + + bool early_init:1; +diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h +index 32c553556bbd..ca51b2c15bcc 100644 +--- a/include/linux/cgroup.h ++++ b/include/linux/cgroup.h +@@ -119,6 +119,7 @@ extern int cgroup_can_fork(struct task_struct *p); + extern void cgroup_cancel_fork(struct task_struct *p); + extern void cgroup_post_fork(struct task_struct *p); + void cgroup_exit(struct task_struct *p); ++void cgroup_release(struct task_struct *p); + void cgroup_free(struct task_struct *p); + + int cgroup_init_early(void); +@@ -699,6 +700,7 @@ static inline int cgroup_can_fork(struct task_struct *p) { return 0; } + static inline void cgroup_cancel_fork(struct task_struct *p) {} + static inline void cgroup_post_fork(struct task_struct *p) {} + static inline void cgroup_exit(struct task_struct *p) {} ++static inline void cgroup_release(struct task_struct *p) {} + static inline void cgroup_free(struct task_struct *p) {} + + static inline int cgroup_init_early(void) { return 0; } +diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h +index 08b1aa70a38d..d1b6d2c3ada6 100644 +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -782,6 +782,9 @@ unsigned int __clk_get_enable_count(struct clk *clk); + unsigned long clk_hw_get_rate(const struct clk_hw *hw); + unsigned long __clk_get_flags(struct clk *clk); + unsigned long clk_hw_get_flags(const struct clk_hw *hw); ++#define clk_hw_can_set_rate_parent(hw) \ ++ (clk_hw_get_flags((hw)) & CLK_SET_RATE_PARENT) ++ + bool clk_hw_is_prepared(const struct clk_hw *hw); + bool clk_hw_rate_is_protected(const struct clk_hw *hw); + bool clk_hw_is_enabled(const struct clk_hw *hw); +diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h +index f70f8ac9c4f4..40fec5f94949 100644 +--- a/include/linux/f2fs_fs.h ++++ b/include/linux/f2fs_fs.h +@@ -489,12 +489,12 @@ typedef __le32 f2fs_hash_t; + + /* + * space utilization of regular dentry and inline dentry (w/o extra reservation) +- * regular dentry inline dentry +- * bitmap 1 * 27 = 27 1 * 23 = 23 +- * reserved 1 * 3 = 3 1 * 7 = 7 +- * dentry 11 * 214 = 2354 11 * 182 = 2002 +- * filename 8 * 214 = 1712 8 * 182 = 1456 +- * total 4096 3488 ++ * regular dentry inline dentry (def) inline dentry (min) ++ * bitmap 1 * 27 = 27 1 * 23 = 23 1 * 1 = 1 ++ * reserved 1 * 3 = 3 1 * 7 = 7 1 * 1 = 1 ++ * dentry 11 * 214 = 2354 11 * 182 = 2002 11 * 2 = 22 ++ * filename 8 * 214 = 1712 8 * 182 = 1456 8 * 2 = 16 ++ * total 4096 3488 40 + * + * Note: there are more reserved space in inline dentry than in regular + * dentry, when converting inline dentry we should handle this carefully. +@@ -506,6 +506,7 @@ typedef __le32 f2fs_hash_t; + #define SIZE_OF_RESERVED (PAGE_SIZE - ((SIZE_OF_DIR_ENTRY + \ + F2FS_SLOT_LEN) * \ + NR_DENTRY_IN_BLOCK + SIZE_OF_DENTRY_BITMAP)) ++#define MIN_INLINE_DENTRY_SIZE 40 /* just include '.' and '..' entries */ + + /* One directory entry slot representing F2FS_SLOT_LEN-sized file name */ + struct f2fs_dir_entry { +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 1a39d57eb88f..037610845892 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -844,7 +844,9 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr, + unsigned int alignment, + bpf_jit_fill_hole_t bpf_fill_ill_insns); + void bpf_jit_binary_free(struct bpf_binary_header *hdr); +- ++u64 bpf_jit_alloc_exec_limit(void); ++void *bpf_jit_alloc_exec(unsigned long size); ++void bpf_jit_free_exec(void *addr); + void bpf_jit_free(struct bpf_prog *fp); + + struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *fp); +diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h +index dd1e40ddac7d..875c41b23f20 100644 +--- a/include/linux/irqdesc.h ++++ b/include/linux/irqdesc.h +@@ -65,6 +65,7 @@ struct irq_desc { + unsigned int core_internal_state__do_not_mess_with_it; + unsigned int depth; /* nested irq disables */ + unsigned int wake_depth; /* nested wake enables */ ++ unsigned int tot_count; + unsigned int irq_count; /* For detecting broken IRQs */ + unsigned long last_unhandled; /* Aging timer for unhandled count */ + unsigned int irqs_unhandled; +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index c2876e740514..42fc852bf512 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -409,7 +409,7 @@ struct pmu { + /* + * Set up pmu-private data structures for an AUX area + */ +- void *(*setup_aux) (int cpu, void **pages, ++ void *(*setup_aux) (struct perf_event *event, void **pages, + int nr_pages, bool overwrite); + /* optional */ + +diff --git a/include/linux/relay.h b/include/linux/relay.h +index e1bdf01a86e2..c759f96e39c1 100644 +--- a/include/linux/relay.h ++++ b/include/linux/relay.h +@@ -66,7 +66,7 @@ struct rchan + struct kref kref; /* channel refcount */ + void *private_data; /* for user-defined data */ + size_t last_toobig; /* tried to log event > subbuf size */ +- struct rchan_buf ** __percpu buf; /* per-cpu channel buffers */ ++ struct rchan_buf * __percpu *buf; /* per-cpu channel buffers */ + int is_global; /* One global buffer ? */ + struct list_head list; /* for channel list */ + struct dentry *parent; /* parent dentry passed to open */ +diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h +index 0940fda59872..941bfd9b3c89 100644 +--- a/include/linux/ring_buffer.h ++++ b/include/linux/ring_buffer.h +@@ -128,7 +128,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts, + unsigned long *lost_events); + + struct ring_buffer_iter * +-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu); ++ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags); + void ring_buffer_read_prepare_sync(void); + void ring_buffer_read_start(struct ring_buffer_iter *iter); + void ring_buffer_read_finish(struct ring_buffer_iter *iter); +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 4abb5bd74b04..5dc024e28397 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1737,9 +1737,9 @@ static __always_inline bool need_resched(void) + static inline unsigned int task_cpu(const struct task_struct *p) + { + #ifdef CONFIG_THREAD_INFO_IN_TASK +- return p->cpu; ++ return READ_ONCE(p->cpu); + #else +- return task_thread_info(p)->cpu; ++ return READ_ONCE(task_thread_info(p)->cpu); + #endif + } + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index 26347741ba50..15f3f61f7e3b 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -177,10 +177,10 @@ typedef int (*sched_domain_flags_f)(void); + #define SDTL_OVERLAP 0x01 + + struct sd_data { +- struct sched_domain **__percpu sd; +- struct sched_domain_shared **__percpu sds; +- struct sched_group **__percpu sg; +- struct sched_group_capacity **__percpu sgc; ++ struct sched_domain *__percpu *sd; ++ struct sched_domain_shared *__percpu *sds; ++ struct sched_group *__percpu *sg; ++ struct sched_group_capacity *__percpu *sgc; + }; + + struct sched_domain_topology_level { +diff --git a/include/net/netfilter/br_netfilter.h b/include/net/netfilter/br_netfilter.h +index 74af19c3a8f7..a4ba601b5d04 100644 +--- a/include/net/netfilter/br_netfilter.h ++++ b/include/net/netfilter/br_netfilter.h +@@ -49,7 +49,6 @@ static inline struct rtable *bridge_parent_rtable(const struct net_device *dev) + } + + struct net_device *setup_pre_routing(struct sk_buff *skb); +-void br_netfilter_enable(void); + + #if IS_ENABLED(CONFIG_IPV6) + int br_validate_ipv6(struct net *net, struct sk_buff *skb); +diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h +index cb8a273732cf..bb8092fa1e36 100644 +--- a/include/scsi/libfcoe.h ++++ b/include/scsi/libfcoe.h +@@ -79,7 +79,7 @@ enum fip_state { + * It must not change after fcoe_ctlr_init() sets it. + */ + enum fip_mode { +- FIP_MODE_AUTO = FIP_ST_AUTO, ++ FIP_MODE_AUTO, + FIP_MODE_NON_FIP, + FIP_MODE_FABRIC, + FIP_MODE_VN2VN, +@@ -250,7 +250,7 @@ struct fcoe_rport { + }; + + /* FIP API functions */ +-void fcoe_ctlr_init(struct fcoe_ctlr *, enum fip_state); ++void fcoe_ctlr_init(struct fcoe_ctlr *, enum fip_mode); + void fcoe_ctlr_destroy(struct fcoe_ctlr *); + void fcoe_ctlr_link_up(struct fcoe_ctlr *); + int fcoe_ctlr_link_down(struct fcoe_ctlr *); +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index e710ac7fbbbf..63dae7e0ccae 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -195,7 +195,7 @@ static u64 css_serial_nr_next = 1; + */ + static u16 have_fork_callback __read_mostly; + static u16 have_exit_callback __read_mostly; +-static u16 have_free_callback __read_mostly; ++static u16 have_release_callback __read_mostly; + static u16 have_canfork_callback __read_mostly; + + /* cgroup namespace for init task */ +@@ -5240,7 +5240,7 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss, bool early) + + have_fork_callback |= (bool)ss->fork << ss->id; + have_exit_callback |= (bool)ss->exit << ss->id; +- have_free_callback |= (bool)ss->free << ss->id; ++ have_release_callback |= (bool)ss->release << ss->id; + have_canfork_callback |= (bool)ss->can_fork << ss->id; + + /* At system boot, before all subsystems have been +@@ -5676,16 +5676,19 @@ void cgroup_exit(struct task_struct *tsk) + } while_each_subsys_mask(); + } + +-void cgroup_free(struct task_struct *task) ++void cgroup_release(struct task_struct *task) + { +- struct css_set *cset = task_css_set(task); + struct cgroup_subsys *ss; + int ssid; + +- do_each_subsys_mask(ss, ssid, have_free_callback) { +- ss->free(task); ++ do_each_subsys_mask(ss, ssid, have_release_callback) { ++ ss->release(task); + } while_each_subsys_mask(); ++} + ++void cgroup_free(struct task_struct *task) ++{ ++ struct css_set *cset = task_css_set(task); + put_css_set(cset); + } + +diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c +index 9829c67ebc0a..c9960baaa14f 100644 +--- a/kernel/cgroup/pids.c ++++ b/kernel/cgroup/pids.c +@@ -247,7 +247,7 @@ static void pids_cancel_fork(struct task_struct *task) + pids_uncharge(pids, 1); + } + +-static void pids_free(struct task_struct *task) ++static void pids_release(struct task_struct *task) + { + struct pids_cgroup *pids = css_pids(task_css(task, pids_cgrp_id)); + +@@ -342,7 +342,7 @@ struct cgroup_subsys pids_cgrp_subsys = { + .cancel_attach = pids_cancel_attach, + .can_fork = pids_can_fork, + .cancel_fork = pids_cancel_fork, +- .free = pids_free, ++ .release = pids_release, + .legacy_cftypes = pids_files, + .dfl_cftypes = pids_files, + .threaded = true, +diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c +index d503d1a9007c..bb95a35e8c2d 100644 +--- a/kernel/cgroup/rstat.c ++++ b/kernel/cgroup/rstat.c +@@ -87,7 +87,6 @@ static struct cgroup *cgroup_rstat_cpu_pop_updated(struct cgroup *pos, + struct cgroup *root, int cpu) + { + struct cgroup_rstat_cpu *rstatc; +- struct cgroup *parent; + + if (pos == root) + return NULL; +@@ -115,8 +114,8 @@ static struct cgroup *cgroup_rstat_cpu_pop_updated(struct cgroup *pos, + * However, due to the way we traverse, @pos will be the first + * child in most cases. The only exception is @root. + */ +- parent = cgroup_parent(pos); +- if (parent && rstatc->updated_next) { ++ if (rstatc->updated_next) { ++ struct cgroup *parent = cgroup_parent(pos); + struct cgroup_rstat_cpu *prstatc = cgroup_rstat_cpu(parent, cpu); + struct cgroup_rstat_cpu *nrstatc; + struct cgroup **nextp; +@@ -140,9 +139,12 @@ static struct cgroup *cgroup_rstat_cpu_pop_updated(struct cgroup *pos, + * updated stat. + */ + smp_mb(); ++ ++ return pos; + } + +- return pos; ++ /* only happens for @root */ ++ return NULL; + } + + /* see cgroup_rstat_flush() */ +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 9d0ecc4a0e79..dc250ec2c096 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -313,6 +313,15 @@ void cpus_write_unlock(void) + + void lockdep_assert_cpus_held(void) + { ++ /* ++ * We can't have hotplug operations before userspace starts running, ++ * and some init codepaths will knowingly not take the hotplug lock. ++ * This is all valid, so mute lockdep until it makes sense to report ++ * unheld locks. ++ */ ++ if (system_state < SYSTEM_RUNNING) ++ return; ++ + percpu_rwsem_assert_held(&cpu_hotplug_lock); + } + +diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c +index 5631af940316..474b2ccdbe69 100644 +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -648,7 +648,7 @@ int rb_alloc_aux(struct ring_buffer *rb, struct perf_event *event, + goto out; + } + +- rb->aux_priv = event->pmu->setup_aux(event->cpu, rb->aux_pages, nr_pages, ++ rb->aux_priv = event->pmu->setup_aux(event, rb->aux_pages, nr_pages, + overwrite); + if (!rb->aux_priv) + goto out; +diff --git a/kernel/exit.c b/kernel/exit.c +index d607e23fd0c3..5c0964dc805a 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -219,6 +219,7 @@ repeat: + } + + write_unlock_irq(&tasklist_lock); ++ cgroup_release(p); + release_thread(p); + call_rcu(&p->rcu, delayed_put_task_struct); + +diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c +index a2b3d9de999c..811009ebacd4 100644 +--- a/kernel/irq/chip.c ++++ b/kernel/irq/chip.c +@@ -855,7 +855,11 @@ void handle_percpu_irq(struct irq_desc *desc) + { + struct irq_chip *chip = irq_desc_get_chip(desc); + +- kstat_incr_irqs_this_cpu(desc); ++ /* ++ * PER CPU interrupts are not serialized. Do not touch ++ * desc->tot_count. ++ */ ++ __kstat_incr_irqs_this_cpu(desc); + + if (chip->irq_ack) + chip->irq_ack(&desc->irq_data); +@@ -884,7 +888,11 @@ void handle_percpu_devid_irq(struct irq_desc *desc) + unsigned int irq = irq_desc_get_irq(desc); + irqreturn_t res; + +- kstat_incr_irqs_this_cpu(desc); ++ /* ++ * PER CPU interrupts are not serialized. Do not touch ++ * desc->tot_count. ++ */ ++ __kstat_incr_irqs_this_cpu(desc); + + if (chip->irq_ack) + chip->irq_ack(&desc->irq_data); +diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h +index ca6afa267070..e74e7eea76cf 100644 +--- a/kernel/irq/internals.h ++++ b/kernel/irq/internals.h +@@ -242,12 +242,18 @@ static inline void irq_state_set_masked(struct irq_desc *desc) + + #undef __irqd_to_state + +-static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc) ++static inline void __kstat_incr_irqs_this_cpu(struct irq_desc *desc) + { + __this_cpu_inc(*desc->kstat_irqs); + __this_cpu_inc(kstat.irqs_sum); + } + ++static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc) ++{ ++ __kstat_incr_irqs_this_cpu(desc); ++ desc->tot_count++; ++} ++ + static inline int irq_desc_get_node(struct irq_desc *desc) + { + return irq_common_data_get_node(&desc->irq_common_data); +diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c +index 578d0e5f1b5b..ba454cba4069 100644 +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -119,6 +119,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node, + desc->depth = 1; + desc->irq_count = 0; + desc->irqs_unhandled = 0; ++ desc->tot_count = 0; + desc->name = NULL; + desc->owner = owner; + for_each_possible_cpu(cpu) +@@ -915,11 +916,15 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu) + unsigned int kstat_irqs(unsigned int irq) + { + struct irq_desc *desc = irq_to_desc(irq); +- int cpu; + unsigned int sum = 0; ++ int cpu; + + if (!desc || !desc->kstat_irqs) + return 0; ++ if (!irq_settings_is_per_cpu_devid(desc) && ++ !irq_settings_is_per_cpu(desc)) ++ return desc->tot_count; ++ + for_each_possible_cpu(cpu) + sum += *per_cpu_ptr(desc->kstat_irqs, cpu); + return sum; +diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c +index 39cb23d22109..81688a133552 100644 +--- a/kernel/rcu/update.c ++++ b/kernel/rcu/update.c +@@ -52,6 +52,7 @@ + #include + #include + #include ++#include + + #define CREATE_TRACE_POINTS + +@@ -253,6 +254,7 @@ int notrace debug_lockdep_rcu_enabled(void) + current->lockdep_recursion == 0; + } + EXPORT_SYMBOL_GPL(debug_lockdep_rcu_enabled); ++NOKPROBE_SYMBOL(debug_lockdep_rcu_enabled); + + /** + * rcu_read_lock_held() - might we be in RCU read-side critical section? +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 152a0b0c91bb..9a4f57d7e931 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -107,11 +107,12 @@ struct rq *task_rq_lock(struct task_struct *p, struct rq_flags *rf) + * [L] ->on_rq + * RELEASE (rq->lock) + * +- * If we observe the old CPU in task_rq_lock, the acquire of ++ * If we observe the old CPU in task_rq_lock(), the acquire of + * the old rq->lock will fully serialize against the stores. + * +- * If we observe the new CPU in task_rq_lock, the acquire will +- * pair with the WMB to ensure we must then also see migrating. ++ * If we observe the new CPU in task_rq_lock(), the address ++ * dependency headed by '[L] rq = task_rq()' and the acquire ++ * will pair with the WMB to ensure we then also see migrating. + */ + if (likely(rq == task_rq(p) && !task_on_rq_migrating(p))) { + rq_pin_lock(rq, rf); +@@ -910,7 +911,7 @@ static struct rq *move_queued_task(struct rq *rq, struct rq_flags *rf, + { + lockdep_assert_held(&rq->lock); + +- p->on_rq = TASK_ON_RQ_MIGRATING; ++ WRITE_ONCE(p->on_rq, TASK_ON_RQ_MIGRATING); + dequeue_task(rq, p, DEQUEUE_NOCLOCK); + set_task_cpu(p, new_cpu); + rq_unlock(rq, rf); +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 6383aa6a60ca..141ea9ff210e 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -315,6 +315,7 @@ void register_sched_domain_sysctl(void) + { + static struct ctl_table *cpu_entries; + static struct ctl_table **cpu_idx; ++ static bool init_done = false; + char buf[32]; + int i; + +@@ -344,7 +345,10 @@ void register_sched_domain_sysctl(void) + if (!cpumask_available(sd_sysctl_cpus)) { + if (!alloc_cpumask_var(&sd_sysctl_cpus, GFP_KERNEL)) + return; ++ } + ++ if (!init_done) { ++ init_done = true; + /* init to possible to not have holes in @cpu_entries */ + cpumask_copy(sd_sysctl_cpus, cpu_possible_mask); + } +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index b63172288f7b..4c7a837d7c14 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1331,9 +1331,9 @@ static inline void __set_task_cpu(struct task_struct *p, unsigned int cpu) + */ + smp_wmb(); + #ifdef CONFIG_THREAD_INFO_IN_TASK +- p->cpu = cpu; ++ WRITE_ONCE(p->cpu, cpu); + #else +- task_thread_info(p)->cpu = cpu; ++ WRITE_ONCE(task_thread_info(p)->cpu, cpu); + #endif + p->wake_cpu = cpu; + #endif +@@ -1434,7 +1434,7 @@ static inline int task_on_rq_queued(struct task_struct *p) + + static inline int task_on_rq_migrating(struct task_struct *p) + { +- return p->on_rq == TASK_ON_RQ_MIGRATING; ++ return READ_ONCE(p->on_rq) == TASK_ON_RQ_MIGRATING; + } + + /* +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 505a41c42b96..c0a751464971 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -477,7 +477,7 @@ cpu_attach_domain(struct sched_domain *sd, struct root_domain *rd, int cpu) + } + + struct s_data { +- struct sched_domain ** __percpu sd; ++ struct sched_domain * __percpu *sd; + struct root_domain *rd; + }; + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 3b86acd5de4e..9e22660153ff 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -126,6 +126,7 @@ static int __maybe_unused one = 1; + static int __maybe_unused two = 2; + static int __maybe_unused four = 4; + static unsigned long one_ul = 1; ++static unsigned long long_max = LONG_MAX; + static int one_hundred = 100; + static int one_thousand = 1000; + #ifdef CONFIG_PRINTK +@@ -1695,6 +1696,8 @@ static struct ctl_table fs_table[] = { + .maxlen = sizeof(files_stat.max_files), + .mode = 0644, + .proc_handler = proc_doulongvec_minmax, ++ .extra1 = &zero, ++ .extra2 = &long_max, + }, + { + .procname = "nr_open", +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 65bd4616220d..34b4c32b0692 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -4141,6 +4141,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume); + * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer + * @buffer: The ring buffer to read from + * @cpu: The cpu buffer to iterate over ++ * @flags: gfp flags to use for memory allocation + * + * This performs the initial preparations necessary to iterate + * through the buffer. Memory is allocated, buffer recording +@@ -4158,7 +4159,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume); + * This overall must be paired with ring_buffer_read_finish. + */ + struct ring_buffer_iter * +-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu) ++ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags) + { + struct ring_buffer_per_cpu *cpu_buffer; + struct ring_buffer_iter *iter; +@@ -4166,7 +4167,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu) + if (!cpumask_test_cpu(cpu, buffer->cpumask)) + return NULL; + +- iter = kmalloc(sizeof(*iter), GFP_KERNEL); ++ iter = kmalloc(sizeof(*iter), flags); + if (!iter) + return NULL; + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 1f96b292df31..c65cea71d1ee 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3903,7 +3903,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot) + if (iter->cpu_file == RING_BUFFER_ALL_CPUS) { + for_each_tracing_cpu(cpu) { + iter->buffer_iter[cpu] = +- ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu); ++ ring_buffer_read_prepare(iter->trace_buffer->buffer, ++ cpu, GFP_KERNEL); + } + ring_buffer_read_prepare_sync(); + for_each_tracing_cpu(cpu) { +@@ -3913,7 +3914,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot) + } else { + cpu = iter->cpu_file; + iter->buffer_iter[cpu] = +- ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu); ++ ring_buffer_read_prepare(iter->trace_buffer->buffer, ++ cpu, GFP_KERNEL); + ring_buffer_read_prepare_sync(); + ring_buffer_read_start(iter->buffer_iter[cpu]); + tracing_iter_reset(iter, cpu); +diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c +index d953c163a079..810d78a8d14c 100644 +--- a/kernel/trace/trace_kdb.c ++++ b/kernel/trace/trace_kdb.c +@@ -51,14 +51,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file) + if (cpu_file == RING_BUFFER_ALL_CPUS) { + for_each_tracing_cpu(cpu) { + iter.buffer_iter[cpu] = +- ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu); ++ ring_buffer_read_prepare(iter.trace_buffer->buffer, ++ cpu, GFP_ATOMIC); + ring_buffer_read_start(iter.buffer_iter[cpu]); + tracing_iter_reset(&iter, cpu); + } + } else { + iter.cpu_file = cpu_file; + iter.buffer_iter[cpu_file] = +- ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu_file); ++ ring_buffer_read_prepare(iter.trace_buffer->buffer, ++ cpu_file, GFP_ATOMIC); + ring_buffer_read_start(iter.buffer_iter[cpu_file]); + tracing_iter_reset(&iter, cpu_file); + } +diff --git a/lib/bsearch.c b/lib/bsearch.c +index 18b445b010c3..82512fe7b33c 100644 +--- a/lib/bsearch.c ++++ b/lib/bsearch.c +@@ -11,6 +11,7 @@ + + #include + #include ++#include + + /* + * bsearch - binary search an array of elements +@@ -53,3 +54,4 @@ void *bsearch(const void *key, const void *base, size_t num, size_t size, + return NULL; + } + EXPORT_SYMBOL(bsearch); ++NOKPROBE_SYMBOL(bsearch); +diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile +index 7ed43eaa02ef..5e0d55c54100 100644 +--- a/lib/raid6/Makefile ++++ b/lib/raid6/Makefile +@@ -40,7 +40,7 @@ endif + ifeq ($(CONFIG_KERNEL_MODE_NEON),y) + NEON_FLAGS := -ffreestanding + ifeq ($(ARCH),arm) +-NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon ++NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon + endif + CFLAGS_recov_neon_inner.o += $(NEON_FLAGS) + ifeq ($(ARCH),arm64) +diff --git a/mm/cma.c b/mm/cma.c +index 4cb76121a3ab..bfe9f5397165 100644 +--- a/mm/cma.c ++++ b/mm/cma.c +@@ -353,12 +353,14 @@ int __init cma_declare_contiguous(phys_addr_t base, + + ret = cma_init_reserved_mem(base, size, order_per_bit, name, res_cma); + if (ret) +- goto err; ++ goto free_mem; + + pr_info("Reserved %ld MiB at %pa\n", (unsigned long)size / SZ_1M, + &base); + return 0; + ++free_mem: ++ memblock_free(base, size); + err: + pr_err("Failed to reserve %ld MiB\n", (unsigned long)size / SZ_1M); + return ret; +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 9518aefd8cbb..7c712c4565e6 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -248,6 +248,12 @@ enum res_type { + iter != NULL; \ + iter = mem_cgroup_iter(NULL, iter, NULL)) + ++static inline bool should_force_charge(void) ++{ ++ return tsk_is_oom_victim(current) || fatal_signal_pending(current) || ++ (current->flags & PF_EXITING); ++} ++ + /* Some nice accessors for the vmpressure. */ + struct vmpressure *memcg_to_vmpressure(struct mem_cgroup *memcg) + { +@@ -1382,8 +1388,13 @@ static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, + }; + bool ret; + +- mutex_lock(&oom_lock); +- ret = out_of_memory(&oc); ++ if (mutex_lock_killable(&oom_lock)) ++ return true; ++ /* ++ * A few threads which were not waiting at mutex_lock_killable() can ++ * fail to bail out. Therefore, check again after holding oom_lock. ++ */ ++ ret = should_force_charge() || out_of_memory(&oc); + mutex_unlock(&oom_lock); + return ret; + } +@@ -2200,9 +2211,7 @@ retry: + * bypass the last charges so that they can exit quickly and + * free their memory. + */ +- if (unlikely(tsk_is_oom_victim(current) || +- fatal_signal_pending(current) || +- current->flags & PF_EXITING)) ++ if (unlikely(should_force_charge())) + goto force; + + /* +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index f32d0a5be4fb..360b24bc69e5 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -350,7 +350,7 @@ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask) + { + if (!pol) + return; +- if (!mpol_store_user_nodemask(pol) && ++ if (!mpol_store_user_nodemask(pol) && !(pol->flags & MPOL_F_LOCAL) && + nodes_equal(pol->w.cpuset_mems_allowed, *newmask)) + return; + +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index e66ac8a47dd6..dbddb7a409dd 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -915,7 +915,8 @@ static void __oom_kill_process(struct task_struct *victim) + */ + static int oom_kill_memcg_member(struct task_struct *task, void *unused) + { +- if (task->signal->oom_score_adj != OOM_SCORE_ADJ_MIN) { ++ if (task->signal->oom_score_adj != OOM_SCORE_ADJ_MIN && ++ !is_global_init(task)) { + get_task_struct(task); + __oom_kill_process(task); + } +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index ef99971c13dd..8e6932a140b8 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1922,8 +1922,8 @@ inline void post_alloc_hook(struct page *page, unsigned int order, + + arch_alloc_page(page, order); + kernel_map_pages(page, 1 << order, 1); +- kernel_poison_pages(page, 1 << order, 1); + kasan_alloc_pages(page, order); ++ kernel_poison_pages(page, 1 << order, 1); + set_page_owner(page, order, gfp_flags); + } + +diff --git a/mm/page_ext.c b/mm/page_ext.c +index 4961f13b6ec1..aad120123688 100644 +--- a/mm/page_ext.c ++++ b/mm/page_ext.c +@@ -273,6 +273,7 @@ static void free_page_ext(void *addr) + table_size = get_entry_size() * PAGES_PER_SECTION; + + BUG_ON(PageReserved(page)); ++ kmemleak_free(addr); + free_pages_exact(addr, table_size); + } + } +diff --git a/mm/page_poison.c b/mm/page_poison.c +index aa2b3d34e8ea..6cfa8e7d7213 100644 +--- a/mm/page_poison.c ++++ b/mm/page_poison.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + + static bool want_page_poisoning __read_mostly; + +@@ -34,7 +35,10 @@ static void poison_page(struct page *page) + { + void *addr = kmap_atomic(page); + ++ /* KASAN still think the page is in-use, so skip it. */ ++ kasan_disable_current(); + memset(addr, PAGE_POISON, PAGE_SIZE); ++ kasan_enable_current(); + kunmap_atomic(addr); + } + +diff --git a/mm/slab.c b/mm/slab.c +index 364e42d5a399..b8e0ec74330f 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -563,14 +563,6 @@ static void start_cpu_timer(int cpu) + + static void init_arraycache(struct array_cache *ac, int limit, int batch) + { +- /* +- * The array_cache structures contain pointers to free object. +- * However, when such objects are allocated or transferred to another +- * cache the pointers are not cleared and they could be counted as +- * valid references during a kmemleak scan. Therefore, kmemleak must +- * not scan such objects. +- */ +- kmemleak_no_scan(ac); + if (ac) { + ac->avail = 0; + ac->limit = limit; +@@ -586,6 +578,14 @@ static struct array_cache *alloc_arraycache(int node, int entries, + struct array_cache *ac = NULL; + + ac = kmalloc_node(memsize, gfp, node); ++ /* ++ * The array_cache structures contain pointers to free object. ++ * However, when such objects are allocated or transferred to another ++ * cache the pointers are not cleared and they could be counted as ++ * valid references during a kmemleak scan. Therefore, kmemleak must ++ * not scan such objects. ++ */ ++ kmemleak_no_scan(ac); + init_arraycache(ac, entries, batchcount); + return ac; + } +@@ -680,6 +680,7 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries, + + alc = kmalloc_node(memsize, gfp, node); + if (alc) { ++ kmemleak_no_scan(alc); + init_arraycache(&alc->ac, entries, batch); + spin_lock_init(&alc->lock); + } +diff --git a/mm/sparse.c b/mm/sparse.c +index 10b07eea9a6e..45950a074bdb 100644 +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -196,7 +196,7 @@ static inline int next_present_section_nr(int section_nr) + } + #define for_each_present_section_nr(start, section_nr) \ + for (section_nr = next_present_section_nr(start-1); \ +- ((section_nr >= 0) && \ ++ ((section_nr != -1) && \ + (section_nr <= __highest_present_section_nr)); \ + section_nr = next_present_section_nr(section_nr)) + +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 340ef3177686..0047dcaf9369 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -98,6 +98,15 @@ static atomic_t proc_poll_event = ATOMIC_INIT(0); + + atomic_t nr_rotate_swap = ATOMIC_INIT(0); + ++static struct swap_info_struct *swap_type_to_swap_info(int type) ++{ ++ if (type >= READ_ONCE(nr_swapfiles)) ++ return NULL; ++ ++ smp_rmb(); /* Pairs with smp_wmb in alloc_swap_info. */ ++ return READ_ONCE(swap_info[type]); ++} ++ + static inline unsigned char swap_count(unsigned char ent) + { + return ent & ~SWAP_HAS_CACHE; /* may include COUNT_CONTINUED flag */ +@@ -1030,12 +1039,14 @@ noswap: + /* The only caller of this function is now suspend routine */ + swp_entry_t get_swap_page_of_type(int type) + { +- struct swap_info_struct *si; ++ struct swap_info_struct *si = swap_type_to_swap_info(type); + pgoff_t offset; + +- si = swap_info[type]; ++ if (!si) ++ goto fail; ++ + spin_lock(&si->lock); +- if (si && (si->flags & SWP_WRITEOK)) { ++ if (si->flags & SWP_WRITEOK) { + atomic_long_dec(&nr_swap_pages); + /* This is called for allocating swap entry, not cache */ + offset = scan_swap_map(si, 1); +@@ -1046,6 +1057,7 @@ swp_entry_t get_swap_page_of_type(int type) + atomic_long_inc(&nr_swap_pages); + } + spin_unlock(&si->lock); ++fail: + return (swp_entry_t) {0}; + } + +@@ -1057,9 +1069,9 @@ static struct swap_info_struct *__swap_info_get(swp_entry_t entry) + if (!entry.val) + goto out; + type = swp_type(entry); +- if (type >= nr_swapfiles) ++ p = swap_type_to_swap_info(type); ++ if (!p) + goto bad_nofile; +- p = swap_info[type]; + if (!(p->flags & SWP_USED)) + goto bad_device; + offset = swp_offset(entry); +@@ -1708,10 +1720,9 @@ int swap_type_of(dev_t device, sector_t offset, struct block_device **bdev_p) + sector_t swapdev_block(int type, pgoff_t offset) + { + struct block_device *bdev; ++ struct swap_info_struct *si = swap_type_to_swap_info(type); + +- if ((unsigned int)type >= nr_swapfiles) +- return 0; +- if (!(swap_info[type]->flags & SWP_WRITEOK)) ++ if (!si || !(si->flags & SWP_WRITEOK)) + return 0; + return map_swap_entry(swp_entry(type, offset), &bdev); + } +@@ -2269,7 +2280,7 @@ static sector_t map_swap_entry(swp_entry_t entry, struct block_device **bdev) + struct swap_extent *se; + pgoff_t offset; + +- sis = swap_info[swp_type(entry)]; ++ sis = swp_swap_info(entry); + *bdev = sis->bdev; + + offset = swp_offset(entry); +@@ -2707,9 +2718,7 @@ static void *swap_start(struct seq_file *swap, loff_t *pos) + if (!l) + return SEQ_START_TOKEN; + +- for (type = 0; type < nr_swapfiles; type++) { +- smp_rmb(); /* read nr_swapfiles before swap_info[type] */ +- si = swap_info[type]; ++ for (type = 0; (si = swap_type_to_swap_info(type)); type++) { + if (!(si->flags & SWP_USED) || !si->swap_map) + continue; + if (!--l) +@@ -2729,9 +2738,7 @@ static void *swap_next(struct seq_file *swap, void *v, loff_t *pos) + else + type = si->type + 1; + +- for (; type < nr_swapfiles; type++) { +- smp_rmb(); /* read nr_swapfiles before swap_info[type] */ +- si = swap_info[type]; ++ for (; (si = swap_type_to_swap_info(type)); type++) { + if (!(si->flags & SWP_USED) || !si->swap_map) + continue; + ++*pos; +@@ -2838,14 +2845,14 @@ static struct swap_info_struct *alloc_swap_info(void) + } + if (type >= nr_swapfiles) { + p->type = type; +- swap_info[type] = p; ++ WRITE_ONCE(swap_info[type], p); + /* + * Write swap_info[type] before nr_swapfiles, in case a + * racing procfs swap_start() or swap_next() is reading them. + * (We never shrink nr_swapfiles, we never free this entry.) + */ + smp_wmb(); +- nr_swapfiles++; ++ WRITE_ONCE(nr_swapfiles, nr_swapfiles + 1); + } else { + kvfree(p); + p = swap_info[type]; +@@ -3365,7 +3372,7 @@ static int __swap_duplicate(swp_entry_t entry, unsigned char usage) + { + struct swap_info_struct *p; + struct swap_cluster_info *ci; +- unsigned long offset, type; ++ unsigned long offset; + unsigned char count; + unsigned char has_cache; + int err = -EINVAL; +@@ -3373,10 +3380,10 @@ static int __swap_duplicate(swp_entry_t entry, unsigned char usage) + if (non_swap_entry(entry)) + goto out; + +- type = swp_type(entry); +- if (type >= nr_swapfiles) ++ p = swp_swap_info(entry); ++ if (!p) + goto bad_file; +- p = swap_info[type]; ++ + offset = swp_offset(entry); + if (unlikely(offset >= p->max)) + goto out; +@@ -3473,7 +3480,7 @@ int swapcache_prepare(swp_entry_t entry) + + struct swap_info_struct *swp_swap_info(swp_entry_t entry) + { +- return swap_info[swp_type(entry)]; ++ return swap_type_to_swap_info(swp_type(entry)); + } + + struct swap_info_struct *page_swap_info(struct page *page) +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 91a789a46b12..a46ec261a44e 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -498,7 +498,11 @@ nocache: + } + + found: +- if (addr + size > vend) ++ /* ++ * Check also calculated address against the vstart, ++ * because it can be 0 because of big align request. ++ */ ++ if (addr + size > vend || addr < vstart) + goto overflow; + + va->va_start = addr; +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index e07a7e62c705..3b0a03b92080 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -884,11 +884,6 @@ static const struct nf_br_ops br_ops = { + .br_dev_xmit_hook = br_nf_dev_xmit, + }; + +-void br_netfilter_enable(void) +-{ +-} +-EXPORT_SYMBOL_GPL(br_netfilter_enable); +- + /* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because + * br_dev_queue_push_xmit is called afterwards */ + static const struct nf_hook_ops br_nf_ops[] = { +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 895171a2e1f1..9a249478abf2 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -901,10 +901,18 @@ __nf_conntrack_confirm(struct sk_buff *skb) + * REJECT will give spurious warnings here. + */ + +- /* No external references means no one else could have +- * confirmed us. ++ /* Another skb with the same unconfirmed conntrack may ++ * win the race. This may happen for bridge(br_flood) ++ * or broadcast/multicast packets do skb_clone with ++ * unconfirmed conntrack. + */ +- WARN_ON(nf_ct_is_confirmed(ct)); ++ if (unlikely(nf_ct_is_confirmed(ct))) { ++ WARN_ON_ONCE(1); ++ nf_conntrack_double_unlock(hash, reply_hash); ++ local_bh_enable(); ++ return NF_DROP; ++ } ++ + pr_debug("Confirming conntrack %p\n", ct); + /* We have to check the DYING flag after unlink to prevent + * a race against nf_ct_get_next_corpse() possibly called from +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 247b89784a6f..842f3f86fb2e 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -769,6 +769,12 @@ static int tcp_error(struct net *net, struct nf_conn *tmpl, + return NF_ACCEPT; + } + ++static bool nf_conntrack_tcp_established(const struct nf_conn *ct) ++{ ++ return ct->proto.tcp.state == TCP_CONNTRACK_ESTABLISHED && ++ test_bit(IPS_ASSURED_BIT, &ct->status); ++} ++ + /* Returns verdict for packet, or -1 for invalid. */ + static int tcp_packet(struct nf_conn *ct, + const struct sk_buff *skb, +@@ -963,16 +969,38 @@ static int tcp_packet(struct nf_conn *ct, + new_state = TCP_CONNTRACK_ESTABLISHED; + break; + case TCP_CONNTRACK_CLOSE: +- if (index == TCP_RST_SET +- && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET) +- && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) { +- /* Invalid RST */ +- spin_unlock_bh(&ct->lock); +- nf_ct_l4proto_log_invalid(skb, ct, "invalid rst"); +- return -NF_ACCEPT; ++ if (index != TCP_RST_SET) ++ break; ++ ++ if (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET) { ++ u32 seq = ntohl(th->seq); ++ ++ if (before(seq, ct->proto.tcp.seen[!dir].td_maxack)) { ++ /* Invalid RST */ ++ spin_unlock_bh(&ct->lock); ++ nf_ct_l4proto_log_invalid(skb, ct, "invalid rst"); ++ return -NF_ACCEPT; ++ } ++ ++ if (!nf_conntrack_tcp_established(ct) || ++ seq == ct->proto.tcp.seen[!dir].td_maxack) ++ break; ++ ++ /* Check if rst is part of train, such as ++ * foo:80 > bar:4379: P, 235946583:235946602(19) ack 42 ++ * foo:80 > bar:4379: R, 235946602:235946602(0) ack 42 ++ */ ++ if (ct->proto.tcp.last_index == TCP_ACK_SET && ++ ct->proto.tcp.last_dir == dir && ++ seq == ct->proto.tcp.last_end) ++ break; ++ ++ /* ... RST sequence number doesn't match exactly, keep ++ * established state to allow a possible challenge ACK. ++ */ ++ new_state = old_state; + } +- if (index == TCP_RST_SET +- && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status) ++ if (((test_bit(IPS_SEEN_REPLY_BIT, &ct->status) + && ct->proto.tcp.last_index == TCP_SYN_SET) + || (!test_bit(IPS_ASSURED_BIT, &ct->status) + && ct->proto.tcp.last_index == TCP_ACK_SET)) +@@ -988,7 +1016,7 @@ static int tcp_packet(struct nf_conn *ct, + * segments we ignored. */ + goto in_window; + } +- /* Just fall through */ ++ break; + default: + /* Keep compilers happy. */ + break; +@@ -1023,6 +1051,8 @@ static int tcp_packet(struct nf_conn *ct, + if (ct->proto.tcp.retrans >= tn->tcp_max_retrans && + timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS]) + timeout = timeouts[TCP_CONNTRACK_RETRANS]; ++ else if (unlikely(index == TCP_RST_SET)) ++ timeout = timeouts[TCP_CONNTRACK_CLOSE]; + else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) & + IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED && + timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK]) +diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c +index 60f258f2c707..a3850414dba2 100644 +--- a/net/netfilter/nf_tables_core.c ++++ b/net/netfilter/nf_tables_core.c +@@ -98,21 +98,23 @@ static noinline void nft_update_chain_stats(const struct nft_chain *chain, + const struct nft_pktinfo *pkt) + { + struct nft_base_chain *base_chain; ++ struct nft_stats __percpu *pstats; + struct nft_stats *stats; + + base_chain = nft_base_chain(chain); +- if (!rcu_access_pointer(base_chain->stats)) +- return; + +- local_bh_disable(); +- stats = this_cpu_ptr(rcu_dereference(base_chain->stats)); +- if (stats) { ++ rcu_read_lock(); ++ pstats = READ_ONCE(base_chain->stats); ++ if (pstats) { ++ local_bh_disable(); ++ stats = this_cpu_ptr(pstats); + u64_stats_update_begin(&stats->syncp); + stats->pkts++; + stats->bytes += pkt->skb->len; + u64_stats_update_end(&stats->syncp); ++ local_bh_enable(); + } +- local_bh_enable(); ++ rcu_read_unlock(); + } + + struct nft_jumpstack { +diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c +index 9d6d67b953ac..05f00fb20b04 100644 +--- a/net/netfilter/xt_physdev.c ++++ b/net/netfilter/xt_physdev.c +@@ -96,8 +96,7 @@ match_outdev: + static int physdev_mt_check(const struct xt_mtchk_param *par) + { + const struct xt_physdev_info *info = par->matchinfo; +- +- br_netfilter_enable(); ++ static bool brnf_probed __read_mostly; + + if (!(info->bitmask & XT_PHYSDEV_OP_MASK) || + info->bitmask & ~XT_PHYSDEV_OP_MASK) +@@ -111,6 +110,12 @@ static int physdev_mt_check(const struct xt_mtchk_param *par) + if (par->hook_mask & (1 << NF_INET_LOCAL_OUT)) + return -EINVAL; + } ++ ++ if (!brnf_probed) { ++ brnf_probed = true; ++ request_module("br_netfilter"); ++ } ++ + return 0; + } + +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 6ea3d3aa1a1e..4337b6d9369e 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -3458,12 +3458,16 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name, + const void *value, size_t size, int flags) + { + struct inode_security_struct *isec = inode_security_novalidate(inode); ++ struct superblock_security_struct *sbsec = inode->i_sb->s_security; + u32 newsid; + int rc; + + if (strcmp(name, XATTR_SELINUX_SUFFIX)) + return -EOPNOTSUPP; + ++ if (!(sbsec->flags & SBLABEL_MNT)) ++ return -EOPNOTSUPP; ++ + if (!value || !size) + return -EACCES; + +@@ -6612,7 +6616,10 @@ static void selinux_inode_invalidate_secctx(struct inode *inode) + */ + static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) + { +- return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0); ++ int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ++ ctx, ctxlen, 0); ++ /* Do not return error when suppressing label (SBLABEL_MNT not set). */ ++ return rc == -EOPNOTSUPP ? 0 : rc; + } + + /* +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index b67f6fe08a1b..e08c6c6ca029 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -1513,6 +1513,14 @@ int snd_pcm_suspend_all(struct snd_pcm *pcm) + /* FIXME: the open/close code should lock this as well */ + if (substream->runtime == NULL) + continue; ++ ++ /* ++ * Skip BE dai link PCM's that are internal and may ++ * not have their substream ops set. ++ */ ++ if (!substream->ops) ++ continue; ++ + err = snd_pcm_suspend(substream); + if (err < 0 && err != -EBUSY) + return err; +diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c +index 774eb2205668..3d600f498914 100644 +--- a/sound/firewire/dice/dice.c ++++ b/sound/firewire/dice/dice.c +@@ -18,6 +18,7 @@ MODULE_LICENSE("GPL v2"); + #define OUI_ALESIS 0x000595 + #define OUI_MAUDIO 0x000d6c + #define OUI_MYTEK 0x001ee8 ++#define OUI_SSL 0x0050c2 // Actually ID reserved by IEEE. + + #define DICE_CATEGORY_ID 0x04 + #define WEISS_CATEGORY_ID 0x00 +@@ -216,7 +217,7 @@ static int dice_probe(struct fw_unit *unit, + struct snd_dice *dice; + int err; + +- if (!entry->driver_data) { ++ if (!entry->driver_data && entry->vendor_id != OUI_SSL) { + err = check_dice_category(unit); + if (err < 0) + return -ENODEV; +@@ -382,6 +383,15 @@ static const struct ieee1394_device_id dice_id_table[] = { + .model_id = 0x000002, + .driver_data = (kernel_ulong_t)snd_dice_detect_mytek_formats, + }, ++ // Solid State Logic, Duende Classic and Mini. ++ // NOTE: each field of GUID in config ROM is not compliant to standard ++ // DICE scheme. ++ { ++ .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_MODEL_ID, ++ .vendor_id = OUI_SSL, ++ .model_id = 0x000070, ++ }, + { + .match_flags = IEEE1394_MATCH_VERSION, + .version = DICE_INTERFACE, +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index 44433b20435c..600d9be9706e 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -689,6 +689,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) + asrc_fail: + of_node_put(asrc_np); + of_node_put(codec_np); ++ put_device(&cpu_pdev->dev); + fail: + of_node_put(cpu_np); + +diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c +index c29200cf755a..9b9a7ec52905 100644 +--- a/sound/soc/fsl/imx-sgtl5000.c ++++ b/sound/soc/fsl/imx-sgtl5000.c +@@ -108,6 +108,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + ret = -EPROBE_DEFER; + goto fail; + } ++ put_device(&ssi_pdev->dev); + codec_dev = of_find_i2c_device_by_node(codec_np); + if (!codec_dev) { + dev_err(&pdev->dev, "failed to find codec platform device\n"); +diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c +index 4715527054e5..5661025e8cec 100644 +--- a/sound/soc/qcom/common.c ++++ b/sound/soc/qcom/common.c +@@ -42,6 +42,9 @@ int qcom_snd_parse_of(struct snd_soc_card *card) + link = card->dai_link; + for_each_child_of_node(dev->of_node, np) { + cpu = of_get_child_by_name(np, "cpu"); ++ platform = of_get_child_by_name(np, "platform"); ++ codec = of_get_child_by_name(np, "codec"); ++ + if (!cpu) { + dev_err(dev, "Can't find cpu DT node\n"); + ret = -EINVAL; +@@ -63,8 +66,6 @@ int qcom_snd_parse_of(struct snd_soc_card *card) + goto err; + } + +- platform = of_get_child_by_name(np, "platform"); +- codec = of_get_child_by_name(np, "codec"); + if (codec && platform) { + link->platform_of_node = of_parse_phandle(platform, + "sound-dai", +@@ -100,10 +101,15 @@ int qcom_snd_parse_of(struct snd_soc_card *card) + link->dpcm_capture = 1; + link->stream_name = link->name; + link++; ++ ++ of_node_put(cpu); ++ of_node_put(codec); ++ of_node_put(platform); + } + + return 0; + err: ++ of_node_put(np); + of_node_put(cpu); + of_node_put(codec); + of_node_put(platform); +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index d49902e818b5..3624557550a1 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -149,7 +149,8 @@ CMD_TARGETS = $(LIB_FILE) + + TARGETS = $(CMD_TARGETS) + +-all: fixdep all_cmd ++all: fixdep ++ $(Q)$(MAKE) all_cmd + + all_cmd: $(CMD_TARGETS) + +diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c +index 75de355a63d6..10985d991ed2 100644 +--- a/tools/lib/traceevent/event-parse.c ++++ b/tools/lib/traceevent/event-parse.c +@@ -2416,7 +2416,7 @@ static int arg_num_eval(struct print_arg *arg, long long *val) + static char *arg_eval (struct print_arg *arg) + { + long long val; +- static char buf[20]; ++ static char buf[24]; + + switch (arg->type) { + case PRINT_ATOM: +diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c +index f3aa9d02a5ab..763c2edf52e7 100644 +--- a/tools/perf/builtin-c2c.c ++++ b/tools/perf/builtin-c2c.c +@@ -2055,6 +2055,12 @@ static int setup_nodes(struct perf_session *session) + if (!set) + return -ENOMEM; + ++ nodes[node] = set; ++ ++ /* empty node, skip */ ++ if (cpu_map__empty(map)) ++ continue; ++ + for (cpu = 0; cpu < map->nr; cpu++) { + set_bit(map->map[cpu], set); + +@@ -2063,8 +2069,6 @@ static int setup_nodes(struct perf_session *session) + + cpu2node[map->map[cpu]] = node; + } +- +- nodes[node] = set; + } + + setup_nodes_header(); +diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c +index 67bcbf876776..d0406116c905 100644 +--- a/tools/perf/tests/evsel-tp-sched.c ++++ b/tools/perf/tests/evsel-tp-sched.c +@@ -43,7 +43,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes + return -1; + } + +- if (perf_evsel__test_field(evsel, "prev_comm", 16, true)) ++ if (perf_evsel__test_field(evsel, "prev_comm", 16, false)) + ret = -1; + + if (perf_evsel__test_field(evsel, "prev_pid", 4, true)) +@@ -55,7 +55,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes + if (perf_evsel__test_field(evsel, "prev_state", sizeof(long), true)) + ret = -1; + +- if (perf_evsel__test_field(evsel, "next_comm", 16, true)) ++ if (perf_evsel__test_field(evsel, "next_comm", 16, false)) + ret = -1; + + if (perf_evsel__test_field(evsel, "next_pid", 4, true)) +@@ -73,7 +73,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes + return -1; + } + +- if (perf_evsel__test_field(evsel, "comm", 16, true)) ++ if (perf_evsel__test_field(evsel, "comm", 16, false)) + ret = -1; + + if (perf_evsel__test_field(evsel, "pid", 4, true)) +diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c +index 28cd6a17491b..dfee110b3a58 100644 +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -1862,6 +1862,7 @@ int symbol__annotate(struct symbol *sym, struct map *map, + struct annotation_options *options, + struct arch **parch) + { ++ struct annotation *notes = symbol__annotation(sym); + struct annotate_args args = { + .privsize = privsize, + .evsel = evsel, +@@ -1892,6 +1893,7 @@ int symbol__annotate(struct symbol *sym, struct map *map, + + args.ms.map = map; + args.ms.sym = sym; ++ notes->start = map__rip_2objdump(map, sym->start); + + return symbol__disassemble(sym, &args); + } +@@ -2746,8 +2748,6 @@ int symbol__annotate2(struct symbol *sym, struct map *map, struct perf_evsel *ev + + symbol__calc_percent(sym, evsel); + +- notes->start = map__rip_2objdump(map, sym->start); +- + annotation__set_offsets(notes, size); + annotation__mark_jump_targets(notes, sym); + annotation__compute_ipc(notes, size); +diff --git a/tools/perf/util/s390-cpumsf.c b/tools/perf/util/s390-cpumsf.c +index aa7f8c11fbb7..910f2621d211 100644 +--- a/tools/perf/util/s390-cpumsf.c ++++ b/tools/perf/util/s390-cpumsf.c +@@ -294,6 +294,11 @@ static bool s390_cpumsf_validate(int machine_type, + *dsdes = 85; + *bsdes = 32; + break; ++ case 2964: ++ case 2965: ++ *dsdes = 112; ++ *bsdes = 32; ++ break; + default: + /* Illegal trailer entry */ + return false; +diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c +index 05d95de14e20..9569cc06e0a7 100644 +--- a/tools/perf/util/scripting-engines/trace-event-python.c ++++ b/tools/perf/util/scripting-engines/trace-event-python.c +@@ -733,8 +733,7 @@ static PyObject *get_perf_sample_dict(struct perf_sample *sample, + Py_FatalError("couldn't create Python dictionary"); + + pydict_set_item_string_decref(dict, "ev_name", _PyUnicode_FromString(perf_evsel__name(evsel))); +- pydict_set_item_string_decref(dict, "attr", _PyUnicode_FromStringAndSize( +- (const char *)&evsel->attr, sizeof(evsel->attr))); ++ pydict_set_item_string_decref(dict, "attr", _PyBytes_FromStringAndSize((const char *)&evsel->attr, sizeof(evsel->attr))); + + pydict_set_item_string_decref(dict_sample, "pid", + _PyLong_FromLong(sample->pid)); +@@ -1494,34 +1493,40 @@ static void _free_command_line(wchar_t **command_line, int num) + static int python_start_script(const char *script, int argc, const char **argv) + { + struct tables *tables = &tables_global; ++ PyMODINIT_FUNC (*initfunc)(void); + #if PY_MAJOR_VERSION < 3 + const char **command_line; + #else + wchar_t **command_line; + #endif +- char buf[PATH_MAX]; ++ /* ++ * Use a non-const name variable to cope with python 2.6's ++ * PyImport_AppendInittab prototype ++ */ ++ char buf[PATH_MAX], name[19] = "perf_trace_context"; + int i, err = 0; + FILE *fp; + + #if PY_MAJOR_VERSION < 3 ++ initfunc = initperf_trace_context; + command_line = malloc((argc + 1) * sizeof(const char *)); + command_line[0] = script; + for (i = 1; i < argc + 1; i++) + command_line[i] = argv[i - 1]; + #else ++ initfunc = PyInit_perf_trace_context; + command_line = malloc((argc + 1) * sizeof(wchar_t *)); + command_line[0] = Py_DecodeLocale(script, NULL); + for (i = 1; i < argc + 1; i++) + command_line[i] = Py_DecodeLocale(argv[i - 1], NULL); + #endif + ++ PyImport_AppendInittab(name, initfunc); + Py_Initialize(); + + #if PY_MAJOR_VERSION < 3 +- initperf_trace_context(); + PySys_SetArgv(argc + 1, (char **)command_line); + #else +- PyInit_perf_trace_context(); + PySys_SetArgv(argc + 1, command_line); + #endif + +diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c +index b284276ec963..46daa22b86e3 100644 +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -229,8 +229,14 @@ static int64_t _sort__sym_cmp(struct symbol *sym_l, struct symbol *sym_r) + if (sym_l == sym_r) + return 0; + +- if (sym_l->inlined || sym_r->inlined) +- return strcmp(sym_l->name, sym_r->name); ++ if (sym_l->inlined || sym_r->inlined) { ++ int ret = strcmp(sym_l->name, sym_r->name); ++ ++ if (ret) ++ return ret; ++ if ((sym_l->start <= sym_r->end) && (sym_l->end >= sym_r->start)) ++ return 0; ++ } + + if (sym_l->start != sym_r->start) + return (int64_t)(sym_r->start - sym_l->start); +diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c +index e767c4a9d4d2..af3f9b9f1e8b 100644 +--- a/tools/perf/util/srcline.c ++++ b/tools/perf/util/srcline.c +@@ -104,7 +104,7 @@ static struct symbol *new_inline_sym(struct dso *dso, + } else { + /* create a fake symbol for the inline frame */ + inline_sym = symbol__new(base_sym ? base_sym->start : 0, +- base_sym ? base_sym->end : 0, ++ base_sym ? (base_sym->end - base_sym->start) : 0, + base_sym ? base_sym->binding : 0, + base_sym ? base_sym->type : 0, + funcname); +diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c +index 9db5a7378f40..294fc18aba2a 100644 +--- a/tools/testing/selftests/bpf/test_verifier.c ++++ b/tools/testing/selftests/bpf/test_verifier.c +@@ -32,6 +32,7 @@ + #include + + #include ++#include + + #ifdef HAVE_GENHDR + # include "autoconf.h" +@@ -56,6 +57,7 @@ + + #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled" + static bool unpriv_disabled = false; ++static int skips; + + struct bpf_test { + const char *descr; +@@ -12770,6 +12772,11 @@ static void do_test_single(struct bpf_test *test, bool unpriv, + fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER, + prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT, + "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1); ++ if (fd_prog < 0 && !bpf_probe_prog_type(prog_type, 0)) { ++ printf("SKIP (unsupported program type %d)\n", prog_type); ++ skips++; ++ goto close_fds; ++ } + + expected_ret = unpriv && test->result_unpriv != UNDEF ? + test->result_unpriv : test->result; +@@ -12905,7 +12912,7 @@ static void get_unpriv_disabled() + + static int do_test(bool unpriv, unsigned int from, unsigned int to) + { +- int i, passes = 0, errors = 0, skips = 0; ++ int i, passes = 0, errors = 0; + + for (i = from; i < to; i++) { + struct bpf_test *test = &tests[i]; +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 83057fa9d391..14cad657bc6a 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -2920,6 +2920,12 @@ TEST(get_metadata) + struct seccomp_metadata md; + long ret; + ++ /* Only real root can get metadata. */ ++ if (geteuid()) { ++ XFAIL(return, "get_metadata requires real root"); ++ return; ++ } ++ + ASSERT_EQ(0, pipe(pipefd)); + + pid = fork();