From 76cced5dff89fe1be5dd81416b4d8a3776101dd3 Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Thu, 26 Mar 2020 23:23:40 +0100 Subject: [PATCH] [ Odroid XU4 ] Upstream patches Signed-off-by: Igor Pecovnik --- config/kernel/linux-odroidxu4-current.config | 2 +- config/kernel/linux-odroidxu4-legacy.config | 2 +- .../03-patch-5.4.27-28.patch | 3393 +++++++++++++++++ .../odroidxu4-legacy/patch-4.14.173-174.patch | 3145 +++++++++++++++ 4 files changed, 6540 insertions(+), 2 deletions(-) create mode 100644 patch/kernel/odroidxu4-current/03-patch-5.4.27-28.patch create mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.173-174.patch diff --git a/config/kernel/linux-odroidxu4-current.config b/config/kernel/linux-odroidxu4-current.config index a54a9413ac..61c0c6007d 100644 --- a/config/kernel/linux-odroidxu4-current.config +++ b/config/kernel/linux-odroidxu4-current.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 5.4.27 Kernel Configuration +# Linux/arm 5.4.28 Kernel Configuration # # diff --git a/config/kernel/linux-odroidxu4-legacy.config b/config/kernel/linux-odroidxu4-legacy.config index 6797d30b4a..da0734686b 100644 --- a/config/kernel/linux-odroidxu4-legacy.config +++ b/config/kernel/linux-odroidxu4-legacy.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.14.173 Kernel Configuration +# Linux/arm 4.14.174 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y diff --git a/patch/kernel/odroidxu4-current/03-patch-5.4.27-28.patch b/patch/kernel/odroidxu4-current/03-patch-5.4.27-28.patch new file mode 100644 index 0000000000..bf580f45c3 --- /dev/null +++ b/patch/kernel/odroidxu4-current/03-patch-5.4.27-28.patch @@ -0,0 +1,3393 @@ +diff --git a/Documentation/kbuild/modules.rst b/Documentation/kbuild/modules.rst +index 774a998dcf37..199ce72bf922 100644 +--- a/Documentation/kbuild/modules.rst ++++ b/Documentation/kbuild/modules.rst +@@ -470,9 +470,9 @@ build. + + The syntax of the Module.symvers file is:: + +- ++ + +- 0xe1cc2a05 usb_stor_suspend USB_STORAGE drivers/usb/storage/usb-storage EXPORT_SYMBOL_GPL ++ 0xe1cc2a05 usb_stor_suspend drivers/usb/storage/usb-storage EXPORT_SYMBOL_GPL USB_STORAGE + + The fields are separated by tabs and values may be empty (e.g. + if no namespace is defined for an exported symbol). +diff --git a/Makefile b/Makefile +index 36a0847534dd..b015cc894123 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 27 ++SUBLEVEL = 28 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi +index c3954e34835b..3ae4f6358da4 100644 +--- a/arch/arm/boot/dts/dra7-l4.dtsi ++++ b/arch/arm/boot/dts/dra7-l4.dtsi +@@ -3413,6 +3413,7 @@ + clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER13_CLKCTRL 24>; + clock-names = "fck"; + interrupts = ; ++ ti,timer-pwm; + }; + }; + +@@ -3441,6 +3442,7 @@ + clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER14_CLKCTRL 24>; + clock-names = "fck"; + interrupts = ; ++ ti,timer-pwm; + }; + }; + +@@ -3469,6 +3471,7 @@ + clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER15_CLKCTRL 24>; + clock-names = "fck"; + interrupts = ; ++ ti,timer-pwm; + }; + }; + +@@ -3497,6 +3500,7 @@ + clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER16_CLKCTRL 24>; + clock-names = "fck"; + interrupts = ; ++ ti,timer-pwm; + }; + }; + +diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi +index 953f0ffce2a9..6481d2b7d6b6 100644 +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -184,6 +184,7 @@ + device_type = "pci"; + ranges = <0x81000000 0 0 0x03000 0 0x00010000 + 0x82000000 0 0x20013000 0x13000 0 0xffed000>; ++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; + bus-range = <0x00 0xff>; + #interrupt-cells = <1>; + num-lanes = <1>; +@@ -238,6 +239,7 @@ + device_type = "pci"; + ranges = <0x81000000 0 0 0x03000 0 0x00010000 + 0x82000000 0 0x30013000 0x13000 0 0xffed000>; ++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; + bus-range = <0x00 0xff>; + #interrupt-cells = <1>; + num-lanes = <1>; +diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h +index 5af82587909e..8c1b73dc8f55 100644 +--- a/arch/arm64/include/asm/unistd.h ++++ b/arch/arm64/include/asm/unistd.h +@@ -25,8 +25,8 @@ + #define __NR_compat_gettimeofday 78 + #define __NR_compat_sigreturn 119 + #define __NR_compat_rt_sigreturn 173 +-#define __NR_compat_clock_getres 247 + #define __NR_compat_clock_gettime 263 ++#define __NR_compat_clock_getres 264 + #define __NR_compat_clock_gettime64 403 + #define __NR_compat_clock_getres_time64 406 + +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index dc9fe879c279..993a4aedfd37 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -955,11 +955,22 @@ void tick_broadcast(const struct cpumask *mask) + } + #endif + ++/* ++ * The number of CPUs online, not counting this CPU (which may not be ++ * fully online and so not counted in num_online_cpus()). ++ */ ++static inline unsigned int num_other_online_cpus(void) ++{ ++ unsigned int this_cpu_online = cpu_online(smp_processor_id()); ++ ++ return num_online_cpus() - this_cpu_online; ++} ++ + void smp_send_stop(void) + { + unsigned long timeout; + +- if (num_online_cpus() > 1) { ++ if (num_other_online_cpus()) { + cpumask_t mask; + + cpumask_copy(&mask, cpu_online_mask); +@@ -972,10 +983,10 @@ void smp_send_stop(void) + + /* Wait up to one second for other CPUs to stop */ + timeout = USEC_PER_SEC; +- while (num_online_cpus() > 1 && timeout--) ++ while (num_other_online_cpus() && timeout--) + udelay(1); + +- if (num_online_cpus() > 1) ++ if (num_other_online_cpus()) + pr_warning("SMP: failed to stop secondary CPUs %*pbl\n", + cpumask_pr_args(cpu_online_mask)); + +@@ -998,7 +1009,11 @@ void crash_smp_send_stop(void) + + cpus_stopped = 1; + +- if (num_online_cpus() == 1) { ++ /* ++ * If this cpu is the only one alive at this point in time, online or ++ * not, there are no stop messages to be sent around, so just back out. ++ */ ++ if (num_other_online_cpus() == 0) { + sdei_mask_local_cpu(); + return; + } +@@ -1006,7 +1021,7 @@ void crash_smp_send_stop(void) + cpumask_copy(&mask, cpu_online_mask); + cpumask_clear_cpu(smp_processor_id(), &mask); + +- atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); ++ atomic_set(&waiting_for_crash_ipi, num_other_online_cpus()); + + pr_crit("SMP: stopping secondary CPUs\n"); + smp_cross_call(&mask, IPI_CPU_CRASH_STOP); +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 060a1acd7c6d..4638d2863388 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -326,6 +326,12 @@ SECTIONS + *(.branch_lt) + } + ++#ifdef CONFIG_DEBUG_INFO_BTF ++ .BTF : AT(ADDR(.BTF) - LOAD_OFFSET) { ++ *(.BTF) ++ } ++#endif ++ + .opd : AT(ADDR(.opd) - LOAD_OFFSET) { + __start_opd = .; + KEEP(*(.opd)) +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index ade9699aa0dd..a0fa4be94a68 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -101,6 +101,7 @@ config ARCH_FLATMEM_ENABLE + + config ARCH_SPARSEMEM_ENABLE + def_bool y ++ depends on MMU + select SPARSEMEM_VMEMMAP_ENABLE + + config ARCH_SELECT_MEMORY_MODEL +diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c +index 70bb94ae61c5..6bf5b1674384 100644 +--- a/arch/riscv/kernel/module.c ++++ b/arch/riscv/kernel/module.c +@@ -8,6 +8,10 @@ + #include + #include + #include ++#include ++#include ++#include ++#include + + static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v) + { +@@ -386,3 +390,15 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, + + return 0; + } ++ ++#if defined(CONFIG_MMU) && defined(CONFIG_64BIT) ++#define VMALLOC_MODULE_START \ ++ max(PFN_ALIGN((unsigned long)&_end - SZ_2G), VMALLOC_START) ++void *module_alloc(unsigned long size) ++{ ++ return __vmalloc_node_range(size, 1, VMALLOC_MODULE_START, ++ VMALLOC_END, GFP_KERNEL, ++ PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, ++ __builtin_return_address(0)); ++} ++#endif +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index 573463d1c799..f5d813c1304d 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -98,7 +98,7 @@ void __init setup_bootmem(void) + for_each_memblock(memory, reg) { + phys_addr_t end = reg->base + reg->size; + +- if (reg->base <= vmlinux_end && vmlinux_end <= end) { ++ if (reg->base <= vmlinux_start && vmlinux_end <= end) { + mem_size = min(reg->size, (phys_addr_t)-PAGE_OFFSET); + + /* +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 304d31d8cbbc..c494c8c05824 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -189,7 +189,7 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address) + return pmd_k; + } + +-void vmalloc_sync_all(void) ++static void vmalloc_sync(void) + { + unsigned long address; + +@@ -216,6 +216,16 @@ void vmalloc_sync_all(void) + } + } + ++void vmalloc_sync_mappings(void) ++{ ++ vmalloc_sync(); ++} ++ ++void vmalloc_sync_unmappings(void) ++{ ++ vmalloc_sync(); ++} ++ + /* + * 32-bit: + * +@@ -318,11 +328,23 @@ out: + + #else /* CONFIG_X86_64: */ + +-void vmalloc_sync_all(void) ++void vmalloc_sync_mappings(void) + { ++ /* ++ * 64-bit mappings might allocate new p4d/pud pages ++ * that need to be propagated to all tasks' PGDs. ++ */ + sync_global_pgds(VMALLOC_START & PGDIR_MASK, VMALLOC_END); + } + ++void vmalloc_sync_unmappings(void) ++{ ++ /* ++ * Unmappings never allocate or free p4d/pud pages. ++ * No work is required here. ++ */ ++} ++ + /* + * 64-bit: + * +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index d0e36d652264..86cd718e0380 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -593,12 +593,13 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd, + */ + entity = &bfqg->entity; + for_each_entity(entity) { +- bfqg = container_of(entity, struct bfq_group, entity); +- if (bfqg != bfqd->root_group) { +- parent = bfqg_parent(bfqg); ++ struct bfq_group *curr_bfqg = container_of(entity, ++ struct bfq_group, entity); ++ if (curr_bfqg != bfqd->root_group) { ++ parent = bfqg_parent(curr_bfqg); + if (!parent) + parent = bfqd->root_group; +- bfq_group_set_parent(bfqg, parent); ++ bfq_group_set_parent(curr_bfqg, parent); + } + } + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 777f6f7122b4..e0d82fab1f44 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -171,7 +171,7 @@ int ghes_estatus_pool_init(int num_ghes) + * New allocation must be visible in all pgd before it can be found by + * an NMI allocating from the pool. + */ +- vmalloc_sync_all(); ++ vmalloc_sync_mappings(); + + rc = gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1); + if (rc) +diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c +index 110e41f920c2..f303106b3362 100644 +--- a/drivers/android/binderfs.c ++++ b/drivers/android/binderfs.c +@@ -448,6 +448,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb) + inode->i_uid = info->root_uid; + inode->i_gid = info->root_gid; + ++ refcount_set(&device->ref, 1); + device->binderfs_inode = inode; + device->miscdev.minor = minor; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index 81842ba8cd75..1e25ca34d876 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -694,11 +694,11 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf, + ssize_t result = 0; + uint32_t offset, se, sh, cu, wave, simd, thread, bank, *data; + +- if (size & 3 || *pos & 3) ++ if (size > 4096 || size & 3 || *pos & 3) + return -EINVAL; + + /* decode offset */ +- offset = *pos & GENMASK_ULL(11, 0); ++ offset = (*pos & GENMASK_ULL(11, 0)) >> 2; + se = (*pos & GENMASK_ULL(19, 12)) >> 12; + sh = (*pos & GENMASK_ULL(27, 20)) >> 20; + cu = (*pos & GENMASK_ULL(35, 28)) >> 28; +@@ -729,7 +729,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf, + while (size) { + uint32_t value; + +- value = data[offset++]; ++ value = data[result >> 2]; + r = put_user(value, (uint32_t *)buf); + if (r) { + result = r; +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 2816d0329738..14417cebe38b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -3555,6 +3555,7 @@ static int gfx_v10_0_kcq_init_queue(struct amdgpu_ring *ring) + + /* reset ring buffer */ + ring->wptr = 0; ++ atomic64_set((atomic64_t *)&adev->wb.wb[ring->wptr_offs], 0); + amdgpu_ring_clear_ring(ring); + } else { + amdgpu_ring_clear_ring(ring); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index d85e1e559c82..40034efa64bb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -3756,6 +3756,7 @@ static int gfx_v9_0_kcq_init_queue(struct amdgpu_ring *ring) + + /* reset ring buffer */ + ring->wptr = 0; ++ atomic64_set((atomic64_t *)&adev->wb.wb[ring->wptr_offs], 0); + amdgpu_ring_clear_ring(ring); + } else { + amdgpu_ring_clear_ring(ring); +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 16218a202b59..28a6c7b2ef4b 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -379,6 +379,7 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + aconnector->dc_sink); + dc_sink_release(aconnector->dc_sink); + aconnector->dc_sink = NULL; ++ aconnector->dc_link->cur_link_settings.lane_count = 0; + } + + drm_connector_unregister(connector); +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c +index a02c10e23e0d..d163388c99a0 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c +@@ -840,8 +840,8 @@ static void hubbub1_det_request_size( + + hubbub1_get_blk256_size(&blk256_width, &blk256_height, bpe); + +- swath_bytes_horz_wc = height * blk256_height * bpe; +- swath_bytes_vert_wc = width * blk256_width * bpe; ++ swath_bytes_horz_wc = width * blk256_height * bpe; ++ swath_bytes_vert_wc = height * blk256_width * bpe; + + *req128_horz_wc = (2 * swath_bytes_horz_wc <= detile_buf_size) ? + false : /* full 256B request */ +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index 1326f2c734bf..41bf4aaff21c 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -1576,28 +1576,34 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) + frame.colorspace = HDMI_COLORSPACE_RGB; + + /* Set up colorimetry */ +- switch (hdmi->hdmi_data.enc_out_encoding) { +- case V4L2_YCBCR_ENC_601: +- if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) +- frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; +- else ++ if (!hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) { ++ switch (hdmi->hdmi_data.enc_out_encoding) { ++ case V4L2_YCBCR_ENC_601: ++ if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) ++ frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; ++ else ++ frame.colorimetry = HDMI_COLORIMETRY_ITU_601; ++ frame.extended_colorimetry = ++ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; ++ break; ++ case V4L2_YCBCR_ENC_709: ++ if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) ++ frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; ++ else ++ frame.colorimetry = HDMI_COLORIMETRY_ITU_709; ++ frame.extended_colorimetry = ++ HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; ++ break; ++ default: /* Carries no data */ + frame.colorimetry = HDMI_COLORIMETRY_ITU_601; ++ frame.extended_colorimetry = ++ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; ++ break; ++ } ++ } else { ++ frame.colorimetry = HDMI_COLORIMETRY_NONE; + frame.extended_colorimetry = +- HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; +- break; +- case V4L2_YCBCR_ENC_709: +- if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) +- frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; +- else +- frame.colorimetry = HDMI_COLORIMETRY_ITU_709; +- frame.extended_colorimetry = +- HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; +- break; +- default: /* Carries no data */ +- frame.colorimetry = HDMI_COLORIMETRY_ITU_601; +- frame.extended_colorimetry = +- HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; +- break; ++ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; + } + + frame.scan_mode = HDMI_SCAN_MODE_NONE; +diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c +index 18cb88b9105e..bf1bdb0aac19 100644 +--- a/drivers/gpu/drm/drm_client_modeset.c ++++ b/drivers/gpu/drm/drm_client_modeset.c +@@ -114,33 +114,6 @@ drm_client_find_modeset(struct drm_client_dev *client, struct drm_crtc *crtc) + return NULL; + } + +-static struct drm_display_mode * +-drm_connector_get_tiled_mode(struct drm_connector *connector) +-{ +- struct drm_display_mode *mode; +- +- list_for_each_entry(mode, &connector->modes, head) { +- if (mode->hdisplay == connector->tile_h_size && +- mode->vdisplay == connector->tile_v_size) +- return mode; +- } +- return NULL; +-} +- +-static struct drm_display_mode * +-drm_connector_fallback_non_tiled_mode(struct drm_connector *connector) +-{ +- struct drm_display_mode *mode; +- +- list_for_each_entry(mode, &connector->modes, head) { +- if (mode->hdisplay == connector->tile_h_size && +- mode->vdisplay == connector->tile_v_size) +- continue; +- return mode; +- } +- return NULL; +-} +- + static struct drm_display_mode * + drm_connector_has_preferred_mode(struct drm_connector *connector, int width, int height) + { +@@ -375,15 +348,8 @@ static bool drm_client_target_preferred(struct drm_connector **connectors, + struct drm_connector *connector; + u64 conn_configured = 0; + int tile_pass = 0; +- int num_tiled_conns = 0; + int i; + +- for (i = 0; i < connector_count; i++) { +- if (connectors[i]->has_tile && +- connectors[i]->status == connector_status_connected) +- num_tiled_conns++; +- } +- + retry: + for (i = 0; i < connector_count; i++) { + connector = connectors[i]; +@@ -433,28 +399,6 @@ retry: + list_for_each_entry(modes[i], &connector->modes, head) + break; + } +- /* +- * In case of tiled mode if all tiles not present fallback to +- * first available non tiled mode. +- * After all tiles are present, try to find the tiled mode +- * for all and if tiled mode not present due to fbcon size +- * limitations, use first non tiled mode only for +- * tile 0,0 and set to no mode for all other tiles. +- */ +- if (connector->has_tile) { +- if (num_tiled_conns < +- connector->num_h_tile * connector->num_v_tile || +- (connector->tile_h_loc == 0 && +- connector->tile_v_loc == 0 && +- !drm_connector_get_tiled_mode(connector))) { +- DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n", +- connector->base.id); +- modes[i] = drm_connector_fallback_non_tiled_mode(connector); +- } else { +- modes[i] = drm_connector_get_tiled_mode(connector); +- } +- } +- + DRM_DEBUG_KMS("found mode %s\n", modes[i] ? modes[i]->name : + "none"); + conn_configured |= BIT_ULL(i); +@@ -572,7 +516,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client, + bool fallback = true, ret = true; + int num_connectors_enabled = 0; + int num_connectors_detected = 0; +- int num_tiled_conns = 0; + struct drm_modeset_acquire_ctx ctx; + + if (!drm_drv_uses_atomic_modeset(dev)) +@@ -590,11 +533,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client, + memcpy(save_enabled, enabled, count); + mask = GENMASK(count - 1, 0); + conn_configured = 0; +- for (i = 0; i < count; i++) { +- if (connectors[i]->has_tile && +- connectors[i]->status == connector_status_connected) +- num_tiled_conns++; +- } + retry: + conn_seq = conn_configured; + for (i = 0; i < count; i++) { +@@ -694,16 +632,6 @@ retry: + connector->name); + modes[i] = &connector->state->crtc->mode; + } +- /* +- * In case of tiled modes, if all tiles are not present +- * then fallback to a non tiled mode. +- */ +- if (connector->has_tile && +- num_tiled_conns < connector->num_h_tile * connector->num_v_tile) { +- DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n", +- connector->base.id); +- modes[i] = drm_connector_fallback_non_tiled_mode(connector); +- } + crtcs[i] = new_crtc; + + DRM_DEBUG_KMS("connector %s on [CRTC:%d:%s]: %dx%d%s\n", +diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c +index b481cafdde28..825abe38201a 100644 +--- a/drivers/gpu/drm/drm_lease.c ++++ b/drivers/gpu/drm/drm_lease.c +@@ -542,10 +542,12 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev, + } + + DRM_DEBUG_LEASE("Creating lease\n"); ++ /* lessee will take the ownership of leases */ + lessee = drm_lease_create(lessor, &leases); + + if (IS_ERR(lessee)) { + ret = PTR_ERR(lessee); ++ idr_destroy(&leases); + goto out_leases; + } + +@@ -580,7 +582,6 @@ out_lessee: + + out_leases: + put_unused_fd(fd); +- idr_destroy(&leases); + + DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret); + return ret; +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +index 6926cee91b36..8ed94c994800 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +@@ -1750,8 +1750,9 @@ static int exynos_dsi_probe(struct platform_device *pdev) + ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(dsi->supplies), + dsi->supplies); + if (ret) { +- dev_info(dev, "failed to get regulators: %d\n", ret); +- return -EPROBE_DEFER; ++ if (ret != -EPROBE_DEFER) ++ dev_info(dev, "failed to get regulators: %d\n", ret); ++ return ret; + } + + dsi->clks = devm_kcalloc(dev, +@@ -1764,9 +1765,10 @@ static int exynos_dsi_probe(struct platform_device *pdev) + dsi->clks[i] = devm_clk_get(dev, clk_names[i]); + if (IS_ERR(dsi->clks[i])) { + if (strcmp(clk_names[i], "sclk_mipi") == 0) { +- strcpy(clk_names[i], OLD_SCLK_MIPI_CLK_NAME); +- i--; +- continue; ++ dsi->clks[i] = devm_clk_get(dev, ++ OLD_SCLK_MIPI_CLK_NAME); ++ if (!IS_ERR(dsi->clks[i])) ++ continue; + } + + dev_info(dev, "failed to get the clock: %s\n", +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index 09aa73c0f2ad..0073a2b3b80a 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -1802,18 +1802,10 @@ static int hdmi_resources_init(struct hdmi_context *hdata) + + hdata->reg_hdmi_en = devm_regulator_get_optional(dev, "hdmi-en"); + +- if (PTR_ERR(hdata->reg_hdmi_en) != -ENODEV) { ++ if (PTR_ERR(hdata->reg_hdmi_en) != -ENODEV) + if (IS_ERR(hdata->reg_hdmi_en)) + return PTR_ERR(hdata->reg_hdmi_en); + +- ret = regulator_enable(hdata->reg_hdmi_en); +- if (ret) { +- DRM_DEV_ERROR(dev, +- "failed to enable hdmi-en regulator\n"); +- return ret; +- } +- } +- + return hdmi_bridge_init(hdata); + } + +@@ -2020,6 +2012,15 @@ static int hdmi_probe(struct platform_device *pdev) + } + } + ++ if (!IS_ERR(hdata->reg_hdmi_en)) { ++ ret = regulator_enable(hdata->reg_hdmi_en); ++ if (ret) { ++ DRM_DEV_ERROR(dev, ++ "failed to enable hdmi-en regulator\n"); ++ goto err_hdmiphy; ++ } ++ } ++ + pm_runtime_enable(dev); + + audio_infoframe = &hdata->audio.infoframe; +@@ -2044,7 +2045,8 @@ err_unregister_audio: + + err_rpm_disable: + pm_runtime_disable(dev); +- ++ if (!IS_ERR(hdata->reg_hdmi_en)) ++ regulator_disable(hdata->reg_hdmi_en); + err_hdmiphy: + if (hdata->hdmiphy_port) + put_device(&hdata->hdmiphy_port->dev); +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index e6c049f4f08b..f9455f2724d2 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -496,10 +496,18 @@ static const struct drm_crtc_helper_funcs mtk_crtc_helper_funcs = { + + static int mtk_drm_crtc_init(struct drm_device *drm, + struct mtk_drm_crtc *mtk_crtc, +- struct drm_plane *primary, +- struct drm_plane *cursor, unsigned int pipe) ++ unsigned int pipe) + { +- int ret; ++ struct drm_plane *primary = NULL; ++ struct drm_plane *cursor = NULL; ++ int i, ret; ++ ++ for (i = 0; i < mtk_crtc->layer_nr; i++) { ++ if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_PRIMARY) ++ primary = &mtk_crtc->planes[i]; ++ else if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_CURSOR) ++ cursor = &mtk_crtc->planes[i]; ++ } + + ret = drm_crtc_init_with_planes(drm, &mtk_crtc->base, primary, cursor, + &mtk_crtc_funcs, NULL); +@@ -608,9 +616,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev, + return ret; + } + +- ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, &mtk_crtc->planes[0], +- mtk_crtc->layer_nr > 1 ? &mtk_crtc->planes[1] : +- NULL, pipe); ++ ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, pipe); + if (ret < 0) + return ret; + +diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c +index 8e48c7458aa3..255f8f41c8ff 100644 +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -718,9 +718,6 @@ static int msc_win_set_lockout(struct msc_window *win, + + if (old != expect) { + ret = -EINVAL; +- dev_warn_ratelimited(msc_dev(win->msc), +- "expected lockout state %d, got %d\n", +- expect, old); + goto unlock; + } + +@@ -741,6 +738,10 @@ unlock: + /* from intel_th_msc_window_unlock(), don't warn if not locked */ + if (expect == WIN_LOCKED && old == new) + return 0; ++ ++ dev_warn_ratelimited(msc_dev(win->msc), ++ "expected lockout state %d, got %d\n", ++ expect, old); + } + + return ret; +@@ -760,7 +761,7 @@ static int msc_configure(struct msc *msc) + lockdep_assert_held(&msc->buf_mutex); + + if (msc->mode > MSC_MODE_MULTI) +- return -ENOTSUPP; ++ return -EINVAL; + + if (msc->mode == MSC_MODE_MULTI) { + if (msc_win_set_lockout(msc->cur_win, WIN_READY, WIN_INUSE)) +@@ -1294,7 +1295,7 @@ static int msc_buffer_alloc(struct msc *msc, unsigned long *nr_pages, + } else if (msc->mode == MSC_MODE_MULTI) { + ret = msc_buffer_multi_alloc(msc, nr_pages, nr_wins); + } else { +- ret = -ENOTSUPP; ++ ret = -EINVAL; + } + + if (!ret) { +@@ -1530,7 +1531,7 @@ static ssize_t intel_th_msc_read(struct file *file, char __user *buf, + if (ret >= 0) + *ppos = iter->offset; + } else { +- ret = -ENOTSUPP; ++ ret = -EINVAL; + } + + put_count: +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index e9d90b53bbc4..86aa6a46bcba 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -234,6 +234,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Elkhart Lake CPU */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4529), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { + /* Elkhart Lake */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26), +diff --git a/drivers/hwtracing/stm/p_sys-t.c b/drivers/hwtracing/stm/p_sys-t.c +index b178a5495b67..360b5c03df95 100644 +--- a/drivers/hwtracing/stm/p_sys-t.c ++++ b/drivers/hwtracing/stm/p_sys-t.c +@@ -238,7 +238,7 @@ static struct configfs_attribute *sys_t_policy_attrs[] = { + static inline bool sys_t_need_ts(struct sys_t_output *op) + { + if (op->node.ts_interval && +- time_after(op->ts_jiffies + op->node.ts_interval, jiffies)) { ++ time_after(jiffies, op->ts_jiffies + op->node.ts_interval)) { + op->ts_jiffies = jiffies; + + return true; +@@ -250,8 +250,8 @@ static inline bool sys_t_need_ts(struct sys_t_output *op) + static bool sys_t_need_clock_sync(struct sys_t_output *op) + { + if (op->node.clocksync_interval && +- time_after(op->clocksync_jiffies + op->node.clocksync_interval, +- jiffies)) { ++ time_after(jiffies, ++ op->clocksync_jiffies + op->node.clocksync_interval)) { + op->clocksync_jiffies = jiffies; + + return true; +diff --git a/drivers/iio/accel/adxl372.c b/drivers/iio/accel/adxl372.c +index 67b8817995c0..60daf04ce188 100644 +--- a/drivers/iio/accel/adxl372.c ++++ b/drivers/iio/accel/adxl372.c +@@ -237,6 +237,7 @@ static const struct adxl372_axis_lookup adxl372_axis_lookup_table[] = { + .realbits = 12, \ + .storagebits = 16, \ + .shift = 4, \ ++ .endianness = IIO_BE, \ + }, \ + } + +diff --git a/drivers/iio/accel/st_accel_i2c.c b/drivers/iio/accel/st_accel_i2c.c +index 50fa0fc32baa..0a0bffe04217 100644 +--- a/drivers/iio/accel/st_accel_i2c.c ++++ b/drivers/iio/accel/st_accel_i2c.c +@@ -114,7 +114,7 @@ MODULE_DEVICE_TABLE(of, st_accel_of_match); + + #ifdef CONFIG_ACPI + static const struct acpi_device_id st_accel_acpi_match[] = { +- {"SMO8840", (kernel_ulong_t)LNG2DM_ACCEL_DEV_NAME}, ++ {"SMO8840", (kernel_ulong_t)LIS2DH12_ACCEL_DEV_NAME}, + {"SMO8A90", (kernel_ulong_t)LNG2DM_ACCEL_DEV_NAME}, + { }, + }; +diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c +index a2837a0e7cba..2c01963a6a5c 100644 +--- a/drivers/iio/adc/at91-sama5d2_adc.c ++++ b/drivers/iio/adc/at91-sama5d2_adc.c +@@ -723,6 +723,7 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) + + for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) { + struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit); ++ u32 cor; + + if (!chan) + continue; +@@ -731,6 +732,20 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) + chan->type == IIO_PRESSURE) + continue; + ++ if (state) { ++ cor = at91_adc_readl(st, AT91_SAMA5D2_COR); ++ ++ if (chan->differential) ++ cor |= (BIT(chan->channel) | ++ BIT(chan->channel2)) << ++ AT91_SAMA5D2_COR_DIFF_OFFSET; ++ else ++ cor &= ~(BIT(chan->channel) << ++ AT91_SAMA5D2_COR_DIFF_OFFSET); ++ ++ at91_adc_writel(st, AT91_SAMA5D2_COR, cor); ++ } ++ + if (state) { + at91_adc_writel(st, AT91_SAMA5D2_CHER, + BIT(chan->channel)); +diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c +index 0339ecdd06bd..3ae0366a7b58 100644 +--- a/drivers/iio/adc/stm32-dfsdm-adc.c ++++ b/drivers/iio/adc/stm32-dfsdm-adc.c +@@ -842,31 +842,6 @@ static inline void stm32_dfsdm_process_data(struct stm32_dfsdm_adc *adc, + } + } + +-static irqreturn_t stm32_dfsdm_adc_trigger_handler(int irq, void *p) +-{ +- struct iio_poll_func *pf = p; +- struct iio_dev *indio_dev = pf->indio_dev; +- struct stm32_dfsdm_adc *adc = iio_priv(indio_dev); +- int available = stm32_dfsdm_adc_dma_residue(adc); +- +- while (available >= indio_dev->scan_bytes) { +- s32 *buffer = (s32 *)&adc->rx_buf[adc->bufi]; +- +- stm32_dfsdm_process_data(adc, buffer); +- +- iio_push_to_buffers_with_timestamp(indio_dev, buffer, +- pf->timestamp); +- available -= indio_dev->scan_bytes; +- adc->bufi += indio_dev->scan_bytes; +- if (adc->bufi >= adc->buf_sz) +- adc->bufi = 0; +- } +- +- iio_trigger_notify_done(indio_dev->trig); +- +- return IRQ_HANDLED; +-} +- + static void stm32_dfsdm_dma_buffer_done(void *data) + { + struct iio_dev *indio_dev = data; +@@ -874,11 +849,6 @@ static void stm32_dfsdm_dma_buffer_done(void *data) + int available = stm32_dfsdm_adc_dma_residue(adc); + size_t old_pos; + +- if (indio_dev->currentmode & INDIO_BUFFER_TRIGGERED) { +- iio_trigger_poll_chained(indio_dev->trig); +- return; +- } +- + /* + * FIXME: In Kernel interface does not support cyclic DMA buffer,and + * offers only an interface to push data samples per samples. +@@ -906,7 +876,15 @@ static void stm32_dfsdm_dma_buffer_done(void *data) + adc->bufi = 0; + old_pos = 0; + } +- /* regular iio buffer without trigger */ ++ /* ++ * In DMA mode the trigger services of IIO are not used ++ * (e.g. no call to iio_trigger_poll). ++ * Calling irq handler associated to the hardware trigger is not ++ * relevant as the conversions have already been done. Data ++ * transfers are performed directly in DMA callback instead. ++ * This implementation avoids to call trigger irq handler that ++ * may sleep, in an atomic context (DMA irq handler context). ++ */ + if (adc->dev_data->type == DFSDM_IIO) + iio_push_to_buffers(indio_dev, buffer); + } +@@ -1517,8 +1495,7 @@ static int stm32_dfsdm_adc_init(struct iio_dev *indio_dev) + } + + ret = iio_triggered_buffer_setup(indio_dev, +- &iio_pollfunc_store_time, +- &stm32_dfsdm_adc_trigger_handler, ++ &iio_pollfunc_store_time, NULL, + &stm32_dfsdm_buffer_setup_ops); + if (ret) { + stm32_dfsdm_dma_release(indio_dev); +diff --git a/drivers/iio/chemical/Kconfig b/drivers/iio/chemical/Kconfig +index 0b91de4df8f4..a7e65a59bf42 100644 +--- a/drivers/iio/chemical/Kconfig ++++ b/drivers/iio/chemical/Kconfig +@@ -91,6 +91,8 @@ config SPS30 + tristate "SPS30 particulate matter sensor" + depends on I2C + select CRC8 ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + help + Say Y here to build support for the Sensirion SPS30 particulate + matter sensor. +diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c +index b0e241aaefb4..e5b00a6611ac 100644 +--- a/drivers/iio/light/vcnl4000.c ++++ b/drivers/iio/light/vcnl4000.c +@@ -167,16 +167,17 @@ static int vcnl4200_init(struct vcnl4000_data *data) + data->vcnl4200_ps.reg = VCNL4200_PS_DATA; + switch (id) { + case VCNL4200_PROD_ID: +- /* Integration time is 50ms, but the experiments */ +- /* show 54ms in total. */ +- data->vcnl4200_al.sampling_rate = ktime_set(0, 54000 * 1000); +- data->vcnl4200_ps.sampling_rate = ktime_set(0, 4200 * 1000); ++ /* Default wait time is 50ms, add 20% tolerance. */ ++ data->vcnl4200_al.sampling_rate = ktime_set(0, 60000 * 1000); ++ /* Default wait time is 4.8ms, add 20% tolerance. */ ++ data->vcnl4200_ps.sampling_rate = ktime_set(0, 5760 * 1000); + data->al_scale = 24000; + break; + case VCNL4040_PROD_ID: +- /* Integration time is 80ms, add 10ms. */ +- data->vcnl4200_al.sampling_rate = ktime_set(0, 100000 * 1000); +- data->vcnl4200_ps.sampling_rate = ktime_set(0, 100000 * 1000); ++ /* Default wait time is 80ms, add 20% tolerance. */ ++ data->vcnl4200_al.sampling_rate = ktime_set(0, 96000 * 1000); ++ /* Default wait time is 5ms, add 20% tolerance. */ ++ data->vcnl4200_ps.sampling_rate = ktime_set(0, 6000 * 1000); + data->al_scale = 120000; + break; + } +diff --git a/drivers/iio/magnetometer/ak8974.c b/drivers/iio/magnetometer/ak8974.c +index fc7e910f8e8b..d32996702110 100644 +--- a/drivers/iio/magnetometer/ak8974.c ++++ b/drivers/iio/magnetometer/ak8974.c +@@ -564,7 +564,7 @@ static int ak8974_read_raw(struct iio_dev *indio_dev, + * We read all axes and discard all but one, for optimized + * reading, use the triggered buffer. + */ +- *val = le16_to_cpu(hw_values[chan->address]); ++ *val = (s16)le16_to_cpu(hw_values[chan->address]); + + ret = IIO_VAL_INT; + } +diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c +index a5dfe65cd9b9..f98510c714b5 100644 +--- a/drivers/iio/trigger/stm32-timer-trigger.c ++++ b/drivers/iio/trigger/stm32-timer-trigger.c +@@ -161,7 +161,8 @@ static int stm32_timer_start(struct stm32_timer_trigger *priv, + return 0; + } + +-static void stm32_timer_stop(struct stm32_timer_trigger *priv) ++static void stm32_timer_stop(struct stm32_timer_trigger *priv, ++ struct iio_trigger *trig) + { + u32 ccer, cr1; + +@@ -179,6 +180,12 @@ static void stm32_timer_stop(struct stm32_timer_trigger *priv) + regmap_write(priv->regmap, TIM_PSC, 0); + regmap_write(priv->regmap, TIM_ARR, 0); + ++ /* Force disable master mode */ ++ if (stm32_timer_is_trgo2_name(trig->name)) ++ regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS2, 0); ++ else ++ regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS, 0); ++ + /* Make sure that registers are updated */ + regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG); + } +@@ -197,7 +204,7 @@ static ssize_t stm32_tt_store_frequency(struct device *dev, + return ret; + + if (freq == 0) { +- stm32_timer_stop(priv); ++ stm32_timer_stop(priv, trig); + } else { + ret = stm32_timer_start(priv, trig, freq); + if (ret) +diff --git a/drivers/md/dm-bio-record.h b/drivers/md/dm-bio-record.h +index c82578af56a5..2ea0360108e1 100644 +--- a/drivers/md/dm-bio-record.h ++++ b/drivers/md/dm-bio-record.h +@@ -20,8 +20,13 @@ + struct dm_bio_details { + struct gendisk *bi_disk; + u8 bi_partno; ++ int __bi_remaining; + unsigned long bi_flags; + struct bvec_iter bi_iter; ++ bio_end_io_t *bi_end_io; ++#if defined(CONFIG_BLK_DEV_INTEGRITY) ++ struct bio_integrity_payload *bi_integrity; ++#endif + }; + + static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio) +@@ -30,6 +35,11 @@ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio) + bd->bi_partno = bio->bi_partno; + bd->bi_flags = bio->bi_flags; + bd->bi_iter = bio->bi_iter; ++ bd->__bi_remaining = atomic_read(&bio->__bi_remaining); ++ bd->bi_end_io = bio->bi_end_io; ++#if defined(CONFIG_BLK_DEV_INTEGRITY) ++ bd->bi_integrity = bio_integrity(bio); ++#endif + } + + static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio) +@@ -38,6 +48,11 @@ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio) + bio->bi_partno = bd->bi_partno; + bio->bi_flags = bd->bi_flags; + bio->bi_iter = bd->bi_iter; ++ atomic_set(&bio->__bi_remaining, bd->__bi_remaining); ++ bio->bi_end_io = bd->bi_end_io; ++#if defined(CONFIG_BLK_DEV_INTEGRITY) ++ bio->bi_integrity = bd->bi_integrity; ++#endif + } + + #endif +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 57ac603f3741..145bc2e7eaf0 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -6,6 +6,8 @@ + * This file is released under the GPL. + */ + ++#include "dm-bio-record.h" ++ + #include + #include + #include +@@ -292,11 +294,7 @@ struct dm_integrity_io { + + struct completion *completion; + +- struct gendisk *orig_bi_disk; +- u8 orig_bi_partno; +- bio_end_io_t *orig_bi_end_io; +- struct bio_integrity_payload *orig_bi_integrity; +- struct bvec_iter orig_bi_iter; ++ struct dm_bio_details bio_details; + }; + + struct journal_completion { +@@ -1447,14 +1445,9 @@ static void integrity_end_io(struct bio *bio) + { + struct dm_integrity_io *dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io)); + +- bio->bi_iter = dio->orig_bi_iter; +- bio->bi_disk = dio->orig_bi_disk; +- bio->bi_partno = dio->orig_bi_partno; +- if (dio->orig_bi_integrity) { +- bio->bi_integrity = dio->orig_bi_integrity; ++ dm_bio_restore(&dio->bio_details, bio); ++ if (bio->bi_integrity) + bio->bi_opf |= REQ_INTEGRITY; +- } +- bio->bi_end_io = dio->orig_bi_end_io; + + if (dio->completion) + complete(dio->completion); +@@ -1539,7 +1532,7 @@ static void integrity_metadata(struct work_struct *w) + } + } + +- __bio_for_each_segment(bv, bio, iter, dio->orig_bi_iter) { ++ __bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) { + unsigned pos; + char *mem, *checksums_ptr; + +@@ -1583,7 +1576,7 @@ again: + if (likely(checksums != checksums_onstack)) + kfree(checksums); + } else { +- struct bio_integrity_payload *bip = dio->orig_bi_integrity; ++ struct bio_integrity_payload *bip = dio->bio_details.bi_integrity; + + if (bip) { + struct bio_vec biv; +@@ -2002,20 +1995,13 @@ offload_to_thread: + } else + dio->completion = NULL; + +- dio->orig_bi_iter = bio->bi_iter; +- +- dio->orig_bi_disk = bio->bi_disk; +- dio->orig_bi_partno = bio->bi_partno; ++ dm_bio_record(&dio->bio_details, bio); + bio_set_dev(bio, ic->dev->bdev); +- +- dio->orig_bi_integrity = bio_integrity(bio); + bio->bi_integrity = NULL; + bio->bi_opf &= ~REQ_INTEGRITY; +- +- dio->orig_bi_end_io = bio->bi_end_io; + bio->bi_end_io = integrity_end_io; +- + bio->bi_iter.bi_size = dio->range.n_sectors << SECTOR_SHIFT; ++ + generic_make_request(bio); + + if (need_sync_io) { +diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c +index 25e5f24b3fec..5bdf57472314 100644 +--- a/drivers/misc/altera-stapl/altera.c ++++ b/drivers/misc/altera-stapl/altera.c +@@ -2112,8 +2112,8 @@ exit_done: + return status; + } + +-static int altera_get_note(u8 *p, s32 program_size, +- s32 *offset, char *key, char *value, int length) ++static int altera_get_note(u8 *p, s32 program_size, s32 *offset, ++ char *key, char *value, int keylen, int vallen) + /* + * Gets key and value of NOTE fields in the JBC file. + * Can be called in two modes: if offset pointer is NULL, +@@ -2170,7 +2170,7 @@ static int altera_get_note(u8 *p, s32 program_size, + &p[note_table + (8 * i) + 4])]; + + if (value != NULL) +- strlcpy(value, value_ptr, length); ++ strlcpy(value, value_ptr, vallen); + + } + } +@@ -2189,13 +2189,13 @@ static int altera_get_note(u8 *p, s32 program_size, + strlcpy(key, &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i)])], +- length); ++ keylen); + + if (value != NULL) + strlcpy(value, &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i) + 4])], +- length); ++ vallen); + + *offset = i + 1; + } +@@ -2449,7 +2449,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw) + __func__, (format_version == 2) ? "Jam STAPL" : + "pre-standardized Jam 1.1"); + while (altera_get_note((u8 *)fw->data, fw->size, +- &offset, key, value, 256) == 0) ++ &offset, key, value, 32, 256) == 0) + printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n", + __func__, key, value); + } +diff --git a/drivers/misc/cardreader/rts5227.c b/drivers/misc/cardreader/rts5227.c +index 4feed296a327..423fecc19fc4 100644 +--- a/drivers/misc/cardreader/rts5227.c ++++ b/drivers/misc/cardreader/rts5227.c +@@ -394,7 +394,7 @@ static const struct pcr_ops rts522a_pcr_ops = { + void rts522a_init_params(struct rtsx_pcr *pcr) + { + rts5227_init_params(pcr); +- ++ pcr->tx_initial_phase = SET_CLOCK_PHASE(20, 20, 11); + pcr->reg_pm_ctrl3 = RTS522A_PM_CTRL3; + + pcr->option.ocp_en = 1; +diff --git a/drivers/misc/cardreader/rts5249.c b/drivers/misc/cardreader/rts5249.c +index db936e4d6e56..1a81cda948c1 100644 +--- a/drivers/misc/cardreader/rts5249.c ++++ b/drivers/misc/cardreader/rts5249.c +@@ -618,6 +618,7 @@ static const struct pcr_ops rts524a_pcr_ops = { + void rts524a_init_params(struct rtsx_pcr *pcr) + { + rts5249_init_params(pcr); ++ pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 29, 11); + pcr->option.ltr_l1off_sspwrgate = LTR_L1OFF_SSPWRGATE_5250_DEF; + pcr->option.ltr_l1off_snooze_sspwrgate = + LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF; +@@ -733,6 +734,7 @@ static const struct pcr_ops rts525a_pcr_ops = { + void rts525a_init_params(struct rtsx_pcr *pcr) + { + rts5249_init_params(pcr); ++ pcr->tx_initial_phase = SET_CLOCK_PHASE(25, 29, 11); + pcr->option.ltr_l1off_sspwrgate = LTR_L1OFF_SSPWRGATE_5250_DEF; + pcr->option.ltr_l1off_snooze_sspwrgate = + LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF; +diff --git a/drivers/misc/cardreader/rts5260.c b/drivers/misc/cardreader/rts5260.c +index 40a6d199f2ea..c9327bf92d16 100644 +--- a/drivers/misc/cardreader/rts5260.c ++++ b/drivers/misc/cardreader/rts5260.c +@@ -663,7 +663,7 @@ void rts5260_init_params(struct rtsx_pcr *pcr) + pcr->sd30_drive_sel_1v8 = CFG_DRIVER_TYPE_B; + pcr->sd30_drive_sel_3v3 = CFG_DRIVER_TYPE_B; + pcr->aspm_en = ASPM_L1_EN; +- pcr->tx_initial_phase = SET_CLOCK_PHASE(1, 29, 16); ++ pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 29, 11); + pcr->rx_initial_phase = SET_CLOCK_PHASE(24, 6, 5); + + pcr->ic_version = rts5260_get_ic_version(pcr); +diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c +index bd50935dc37d..11087976ab19 100644 +--- a/drivers/mmc/host/rtsx_pci_sdmmc.c ++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c +@@ -606,19 +606,22 @@ static int sd_change_phase(struct realtek_pci_sdmmc *host, + u8 sample_point, bool rx) + { + struct rtsx_pcr *pcr = host->pcr; +- ++ u16 SD_VP_CTL = 0; + dev_dbg(sdmmc_dev(host), "%s(%s): sample_point = %d\n", + __func__, rx ? "RX" : "TX", sample_point); + + rtsx_pci_write_register(pcr, CLK_CTL, CHANGE_CLK, CHANGE_CLK); +- if (rx) ++ if (rx) { ++ SD_VP_CTL = SD_VPRX_CTL; + rtsx_pci_write_register(pcr, SD_VPRX_CTL, + PHASE_SELECT_MASK, sample_point); +- else ++ } else { ++ SD_VP_CTL = SD_VPTX_CTL; + rtsx_pci_write_register(pcr, SD_VPTX_CTL, + PHASE_SELECT_MASK, sample_point); +- rtsx_pci_write_register(pcr, SD_VPCLK0_CTL, PHASE_NOT_RESET, 0); +- rtsx_pci_write_register(pcr, SD_VPCLK0_CTL, PHASE_NOT_RESET, ++ } ++ rtsx_pci_write_register(pcr, SD_VP_CTL, PHASE_NOT_RESET, 0); ++ rtsx_pci_write_register(pcr, SD_VP_CTL, PHASE_NOT_RESET, + PHASE_NOT_RESET); + rtsx_pci_write_register(pcr, CLK_CTL, CHANGE_CLK, 0); + rtsx_pci_write_register(pcr, SD_CFG1, SD_ASYNC_FIFO_NOT_RST, 0); +diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c +index ae0ec27dd7cc..5f2e9696ee4d 100644 +--- a/drivers/mmc/host/sdhci-cadence.c ++++ b/drivers/mmc/host/sdhci-cadence.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include "sdhci-pltfm.h" + +@@ -235,6 +236,11 @@ static const struct sdhci_ops sdhci_cdns_ops = { + .set_uhs_signaling = sdhci_cdns_set_uhs_signaling, + }; + ++static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = { ++ .ops = &sdhci_cdns_ops, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, ++}; ++ + static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = { + .ops = &sdhci_cdns_ops, + }; +@@ -334,6 +340,7 @@ static void sdhci_cdns_hs400_enhanced_strobe(struct mmc_host *mmc, + static int sdhci_cdns_probe(struct platform_device *pdev) + { + struct sdhci_host *host; ++ const struct sdhci_pltfm_data *data; + struct sdhci_pltfm_host *pltfm_host; + struct sdhci_cdns_priv *priv; + struct clk *clk; +@@ -350,8 +357,12 @@ static int sdhci_cdns_probe(struct platform_device *pdev) + if (ret) + return ret; + ++ data = of_device_get_match_data(dev); ++ if (!data) ++ data = &sdhci_cdns_pltfm_data; ++ + nr_phy_params = sdhci_cdns_phy_param_count(dev->of_node); +- host = sdhci_pltfm_init(pdev, &sdhci_cdns_pltfm_data, ++ host = sdhci_pltfm_init(pdev, data, + struct_size(priv, phy_params, nr_phy_params)); + if (IS_ERR(host)) { + ret = PTR_ERR(host); +@@ -431,7 +442,10 @@ static const struct dev_pm_ops sdhci_cdns_pm_ops = { + }; + + static const struct of_device_id sdhci_cdns_match[] = { +- { .compatible = "socionext,uniphier-sd4hc" }, ++ { ++ .compatible = "socionext,uniphier-sd4hc", ++ .data = &sdhci_cdns_uniphier_pltfm_data, ++ }, + { .compatible = "cdns,sd4hc" }, + { /* sentinel */ } + }; +diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c +index 9378d5dc86c8..881f8138e7de 100644 +--- a/drivers/mmc/host/sdhci-of-at91.c ++++ b/drivers/mmc/host/sdhci-of-at91.c +@@ -118,7 +118,8 @@ static void sdhci_at91_reset(struct sdhci_host *host, u8 mask) + { + sdhci_reset(host, mask); + +- if (host->mmc->caps & MMC_CAP_NONREMOVABLE) ++ if ((host->mmc->caps & MMC_CAP_NONREMOVABLE) ++ || mmc_gpio_get_cd(host->mmc) >= 0) + sdhci_at91_set_force_card_detect(host); + } + +@@ -397,8 +398,11 @@ static int sdhci_at91_probe(struct platform_device *pdev) + * detection procedure using the SDMCC_CD signal is bypassed. + * This bit is reset when a software reset for all command is performed + * so we need to implement our own reset function to set back this bit. ++ * ++ * WA: SAMA5D2 doesn't drive CMD if using CD GPIO line. + */ +- if (host->mmc->caps & MMC_CAP_NONREMOVABLE) ++ if ((host->mmc->caps & MMC_CAP_NONREMOVABLE) ++ || mmc_gpio_get_cd(host->mmc) >= 0) + sdhci_at91_set_force_card_detect(host); + + pm_runtime_put_autosuspend(&pdev->dev); +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index d535080b781f..2fe34fd4c3f3 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -515,7 +515,7 @@ static int nvmet_try_send_data_pdu(struct nvmet_tcp_cmd *cmd) + return 1; + } + +-static int nvmet_try_send_data(struct nvmet_tcp_cmd *cmd) ++static int nvmet_try_send_data(struct nvmet_tcp_cmd *cmd, bool last_in_batch) + { + struct nvmet_tcp_queue *queue = cmd->queue; + int ret; +@@ -523,9 +523,15 @@ static int nvmet_try_send_data(struct nvmet_tcp_cmd *cmd) + while (cmd->cur_sg) { + struct page *page = sg_page(cmd->cur_sg); + u32 left = cmd->cur_sg->length - cmd->offset; ++ int flags = MSG_DONTWAIT; ++ ++ if ((!last_in_batch && cmd->queue->send_list_len) || ++ cmd->wbytes_done + left < cmd->req.transfer_len || ++ queue->data_digest || !queue->nvme_sq.sqhd_disabled) ++ flags |= MSG_MORE; + + ret = kernel_sendpage(cmd->queue->sock, page, cmd->offset, +- left, MSG_DONTWAIT | MSG_MORE); ++ left, flags); + if (ret <= 0) + return ret; + +@@ -660,7 +666,7 @@ static int nvmet_tcp_try_send_one(struct nvmet_tcp_queue *queue, + } + + if (cmd->state == NVMET_TCP_SEND_DATA) { +- ret = nvmet_try_send_data(cmd); ++ ret = nvmet_try_send_data(cmd, last_in_batch); + if (ret <= 0) + goto done_send; + } +diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c +index acce8781c456..f5c7a845cd7b 100644 +--- a/drivers/perf/arm_pmu_acpi.c ++++ b/drivers/perf/arm_pmu_acpi.c +@@ -24,8 +24,6 @@ static int arm_pmu_acpi_register_irq(int cpu) + int gsi, trigger; + + gicc = acpi_cpu_get_madt_gicc(cpu); +- if (WARN_ON(!gicc)) +- return -EINVAL; + + gsi = gicc->performance_interrupt; + +@@ -64,11 +62,10 @@ static void arm_pmu_acpi_unregister_irq(int cpu) + int gsi; + + gicc = acpi_cpu_get_madt_gicc(cpu); +- if (!gicc) +- return; + + gsi = gicc->performance_interrupt; +- acpi_unregister_gsi(gsi); ++ if (gsi) ++ acpi_unregister_gsi(gsi); + } + + #if IS_ENABLED(CONFIG_ARM_SPE_PMU) +diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c +index 0e51baa48b14..6eef47de8fcc 100644 +--- a/drivers/perf/fsl_imx8_ddr_perf.c ++++ b/drivers/perf/fsl_imx8_ddr_perf.c +@@ -327,9 +327,10 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config, + + if (enable) { + /* +- * must disable first, then enable again +- * otherwise, cycle counter will not work +- * if previous state is enabled. ++ * cycle counter is special which should firstly write 0 then ++ * write 1 into CLEAR bit to clear it. Other counters only ++ * need write 0 into CLEAR bit and it turns out to be 1 by ++ * hardware. Below enable flow is harmless for all counters. + */ + writel(0, pmu->base + reg); + val = CNTL_EN | CNTL_CLEAR; +@@ -337,7 +338,8 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config, + writel(val, pmu->base + reg); + } else { + /* Disable counter */ +- writel(0, pmu->base + reg); ++ val = readl_relaxed(pmu->base + reg) & CNTL_EN_MASK; ++ writel(val, pmu->base + reg); + } + } + +diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c +index a28bd15297f5..1c536fc03c83 100644 +--- a/drivers/phy/ti/phy-gmii-sel.c ++++ b/drivers/phy/ti/phy-gmii-sel.c +@@ -80,20 +80,20 @@ static int phy_gmii_sel_mode(struct phy *phy, enum phy_mode mode, int submode) + break; + + case PHY_INTERFACE_MODE_MII: +- mode = AM33XX_GMII_SEL_MODE_MII; ++ case PHY_INTERFACE_MODE_GMII: ++ gmii_sel_mode = AM33XX_GMII_SEL_MODE_MII; + break; + + default: +- dev_warn(dev, +- "port%u: unsupported mode: \"%s\". Defaulting to MII.\n", +- if_phy->id, phy_modes(rgmii_id)); ++ dev_warn(dev, "port%u: unsupported mode: \"%s\"\n", ++ if_phy->id, phy_modes(submode)); + return -EINVAL; + } + + if_phy->phy_if_mode = submode; + + dev_dbg(dev, "%s id:%u mode:%u rgmii_id:%d rmii_clk_ext:%d\n", +- __func__, if_phy->id, mode, rgmii_id, ++ __func__, if_phy->id, submode, rgmii_id, + if_phy->rmii_clock_external); + + regfield = if_phy->fields[PHY_GMII_SEL_PORT_MODE]; +diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig +index 5d502fbd5803..c5b980414086 100644 +--- a/drivers/rtc/Kconfig ++++ b/drivers/rtc/Kconfig +@@ -327,6 +327,7 @@ config RTC_DRV_MAX6900 + config RTC_DRV_MAX8907 + tristate "Maxim MAX8907" + depends on MFD_MAX8907 || COMPILE_TEST ++ select REGMAP_IRQ + help + If you say yes here you will get support for the + RTC of Maxim MAX8907 PMIC. +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index 848e03e5f42d..4433cb4de564 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -985,20 +985,12 @@ static int omap2_mcspi_setup_transfer(struct spi_device *spi, + * Note that we currently allow DMA only if we get a channel + * for both rx and tx. Otherwise we'll do PIO for both rx and tx. + */ +-static int omap2_mcspi_request_dma(struct spi_device *spi) ++static int omap2_mcspi_request_dma(struct omap2_mcspi *mcspi, ++ struct omap2_mcspi_dma *mcspi_dma) + { +- struct spi_master *master = spi->master; +- struct omap2_mcspi *mcspi; +- struct omap2_mcspi_dma *mcspi_dma; + int ret = 0; + +- mcspi = spi_master_get_devdata(master); +- mcspi_dma = mcspi->dma_channels + spi->chip_select; +- +- init_completion(&mcspi_dma->dma_rx_completion); +- init_completion(&mcspi_dma->dma_tx_completion); +- +- mcspi_dma->dma_rx = dma_request_chan(&master->dev, ++ mcspi_dma->dma_rx = dma_request_chan(mcspi->dev, + mcspi_dma->dma_rx_ch_name); + if (IS_ERR(mcspi_dma->dma_rx)) { + ret = PTR_ERR(mcspi_dma->dma_rx); +@@ -1006,7 +998,7 @@ static int omap2_mcspi_request_dma(struct spi_device *spi) + goto no_dma; + } + +- mcspi_dma->dma_tx = dma_request_chan(&master->dev, ++ mcspi_dma->dma_tx = dma_request_chan(mcspi->dev, + mcspi_dma->dma_tx_ch_name); + if (IS_ERR(mcspi_dma->dma_tx)) { + ret = PTR_ERR(mcspi_dma->dma_tx); +@@ -1015,20 +1007,40 @@ static int omap2_mcspi_request_dma(struct spi_device *spi) + mcspi_dma->dma_rx = NULL; + } + ++ init_completion(&mcspi_dma->dma_rx_completion); ++ init_completion(&mcspi_dma->dma_tx_completion); ++ + no_dma: + return ret; + } + ++static void omap2_mcspi_release_dma(struct spi_master *master) ++{ ++ struct omap2_mcspi *mcspi = spi_master_get_devdata(master); ++ struct omap2_mcspi_dma *mcspi_dma; ++ int i; ++ ++ for (i = 0; i < master->num_chipselect; i++) { ++ mcspi_dma = &mcspi->dma_channels[i]; ++ ++ if (mcspi_dma->dma_rx) { ++ dma_release_channel(mcspi_dma->dma_rx); ++ mcspi_dma->dma_rx = NULL; ++ } ++ if (mcspi_dma->dma_tx) { ++ dma_release_channel(mcspi_dma->dma_tx); ++ mcspi_dma->dma_tx = NULL; ++ } ++ } ++} ++ + static int omap2_mcspi_setup(struct spi_device *spi) + { + int ret; + struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master); + struct omap2_mcspi_regs *ctx = &mcspi->ctx; +- struct omap2_mcspi_dma *mcspi_dma; + struct omap2_mcspi_cs *cs = spi->controller_state; + +- mcspi_dma = &mcspi->dma_channels[spi->chip_select]; +- + if (!cs) { + cs = kzalloc(sizeof *cs, GFP_KERNEL); + if (!cs) +@@ -1053,13 +1065,6 @@ static int omap2_mcspi_setup(struct spi_device *spi) + } + } + +- if (!mcspi_dma->dma_rx || !mcspi_dma->dma_tx) { +- ret = omap2_mcspi_request_dma(spi); +- if (ret) +- dev_warn(&spi->dev, "not using DMA for McSPI (%d)\n", +- ret); +- } +- + ret = pm_runtime_get_sync(mcspi->dev); + if (ret < 0) { + pm_runtime_put_noidle(mcspi->dev); +@@ -1076,12 +1081,8 @@ static int omap2_mcspi_setup(struct spi_device *spi) + + static void omap2_mcspi_cleanup(struct spi_device *spi) + { +- struct omap2_mcspi *mcspi; +- struct omap2_mcspi_dma *mcspi_dma; + struct omap2_mcspi_cs *cs; + +- mcspi = spi_master_get_devdata(spi->master); +- + if (spi->controller_state) { + /* Unlink controller state from context save list */ + cs = spi->controller_state; +@@ -1090,19 +1091,6 @@ static void omap2_mcspi_cleanup(struct spi_device *spi) + kfree(cs); + } + +- if (spi->chip_select < spi->master->num_chipselect) { +- mcspi_dma = &mcspi->dma_channels[spi->chip_select]; +- +- if (mcspi_dma->dma_rx) { +- dma_release_channel(mcspi_dma->dma_rx); +- mcspi_dma->dma_rx = NULL; +- } +- if (mcspi_dma->dma_tx) { +- dma_release_channel(mcspi_dma->dma_tx); +- mcspi_dma->dma_tx = NULL; +- } +- } +- + if (gpio_is_valid(spi->cs_gpio)) + gpio_free(spi->cs_gpio); + } +@@ -1313,6 +1301,9 @@ static bool omap2_mcspi_can_dma(struct spi_master *master, + if (spi_controller_is_slave(master)) + return true; + ++ master->dma_rx = mcspi_dma->dma_rx; ++ master->dma_tx = mcspi_dma->dma_tx; ++ + return (xfer->len >= DMA_MIN_BYTES); + } + +@@ -1475,6 +1466,11 @@ static int omap2_mcspi_probe(struct platform_device *pdev) + for (i = 0; i < master->num_chipselect; i++) { + sprintf(mcspi->dma_channels[i].dma_rx_ch_name, "rx%d", i); + sprintf(mcspi->dma_channels[i].dma_tx_ch_name, "tx%d", i); ++ ++ status = omap2_mcspi_request_dma(mcspi, ++ &mcspi->dma_channels[i]); ++ if (status == -EPROBE_DEFER) ++ goto free_master; + } + + status = platform_get_irq(pdev, 0); +@@ -1512,6 +1508,7 @@ disable_pm: + pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); + free_master: ++ omap2_mcspi_release_dma(master); + spi_master_put(master); + return status; + } +@@ -1521,6 +1518,8 @@ static int omap2_mcspi_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct omap2_mcspi *mcspi = spi_master_get_devdata(master); + ++ omap2_mcspi_release_dma(master); ++ + pm_runtime_dont_use_autosuspend(mcspi->dev); + pm_runtime_put_sync(mcspi->dev); + pm_runtime_disable(&pdev->dev); +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 2fd843b18297..723145673206 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -68,6 +68,10 @@ MODULE_ALIAS("platform:pxa2xx-spi"); + #define LPSS_CAPS_CS_EN_SHIFT 9 + #define LPSS_CAPS_CS_EN_MASK (0xf << LPSS_CAPS_CS_EN_SHIFT) + ++#define LPSS_PRIV_CLOCK_GATE 0x38 ++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK 0x3 ++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON 0x3 ++ + struct lpss_config { + /* LPSS offset from drv_data->ioaddr */ + unsigned offset; +@@ -84,6 +88,8 @@ struct lpss_config { + unsigned cs_sel_shift; + unsigned cs_sel_mask; + unsigned cs_num; ++ /* Quirks */ ++ unsigned cs_clk_stays_gated : 1; + }; + + /* Keep these sorted with enum pxa_ssp_type */ +@@ -154,6 +160,7 @@ static const struct lpss_config lpss_platforms[] = { + .tx_threshold_hi = 56, + .cs_sel_shift = 8, + .cs_sel_mask = 3 << 8, ++ .cs_clk_stays_gated = true, + }, + }; + +@@ -381,6 +388,22 @@ static void lpss_ssp_cs_control(struct spi_device *spi, bool enable) + else + value |= LPSS_CS_CONTROL_CS_HIGH; + __lpss_ssp_write_priv(drv_data, config->reg_cs_ctrl, value); ++ if (config->cs_clk_stays_gated) { ++ u32 clkgate; ++ ++ /* ++ * Changing CS alone when dynamic clock gating is on won't ++ * actually flip CS at that time. This ruins SPI transfers ++ * that specify delays, or have no data. Toggle the clock mode ++ * to force on briefly to poke the CS pin to move. ++ */ ++ clkgate = __lpss_ssp_read_priv(drv_data, LPSS_PRIV_CLOCK_GATE); ++ value = (clkgate & ~LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK) | ++ LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON; ++ ++ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, value); ++ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, clkgate); ++ } + } + + static void cs_assert(struct spi_device *spi) +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index 2f559e531100..fa8079fbea77 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1217,6 +1217,11 @@ static int spi_qup_suspend(struct device *device) + struct spi_qup *controller = spi_master_get_devdata(master); + int ret; + ++ if (pm_runtime_suspended(device)) { ++ ret = spi_qup_pm_resume_runtime(device); ++ if (ret) ++ return ret; ++ } + ret = spi_master_suspend(master); + if (ret) + return ret; +@@ -1225,10 +1230,8 @@ static int spi_qup_suspend(struct device *device) + if (ret) + return ret; + +- if (!pm_runtime_suspended(device)) { +- clk_disable_unprepare(controller->cclk); +- clk_disable_unprepare(controller->iclk); +- } ++ clk_disable_unprepare(controller->cclk); ++ clk_disable_unprepare(controller->iclk); + return 0; + } + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 60c4de4e4485..7412a3042a8d 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -401,9 +401,6 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high) + + zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, genfifoentry); + +- /* Dummy generic FIFO entry */ +- zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, 0x0); +- + /* Manually start the generic FIFO command */ + zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, + zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) | +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 26b91ee0855d..c186d3a944cd 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2452,7 +2452,7 @@ int spi_register_controller(struct spi_controller *ctlr) + if (ctlr->use_gpio_descriptors) { + status = spi_get_gpio_descs(ctlr); + if (status) +- return status; ++ goto free_bus_id; + /* + * A controller using GPIO descriptors always + * supports SPI_CS_HIGH if need be. +@@ -2462,7 +2462,7 @@ int spi_register_controller(struct spi_controller *ctlr) + /* Legacy code path for GPIOs from DT */ + status = of_spi_get_gpio_numbers(ctlr); + if (status) +- return status; ++ goto free_bus_id; + } + } + +@@ -2470,17 +2470,14 @@ int spi_register_controller(struct spi_controller *ctlr) + * Even if it's just one always-selected device, there must + * be at least one chipselect. + */ +- if (!ctlr->num_chipselect) +- return -EINVAL; ++ if (!ctlr->num_chipselect) { ++ status = -EINVAL; ++ goto free_bus_id; ++ } + + status = device_add(&ctlr->dev); +- if (status < 0) { +- /* free bus id */ +- mutex_lock(&board_lock); +- idr_remove(&spi_master_idr, ctlr->bus_num); +- mutex_unlock(&board_lock); +- goto done; +- } ++ if (status < 0) ++ goto free_bus_id; + dev_dbg(dev, "registered %s %s\n", + spi_controller_is_slave(ctlr) ? "slave" : "master", + dev_name(&ctlr->dev)); +@@ -2496,11 +2493,7 @@ int spi_register_controller(struct spi_controller *ctlr) + status = spi_controller_initialize_queue(ctlr); + if (status) { + device_del(&ctlr->dev); +- /* free bus id */ +- mutex_lock(&board_lock); +- idr_remove(&spi_master_idr, ctlr->bus_num); +- mutex_unlock(&board_lock); +- goto done; ++ goto free_bus_id; + } + } + /* add statistics */ +@@ -2515,7 +2508,12 @@ int spi_register_controller(struct spi_controller *ctlr) + /* Register devices from the device tree and ACPI */ + of_register_spi_devices(ctlr); + acpi_register_spi_devices(ctlr); +-done: ++ return status; ++ ++free_bus_id: ++ mutex_lock(&board_lock); ++ idr_remove(&spi_master_idr, ctlr->bus_num); ++ mutex_unlock(&board_lock); + return status; + } + EXPORT_SYMBOL_GPL(spi_register_controller); +diff --git a/drivers/staging/greybus/tools/loopback_test.c b/drivers/staging/greybus/tools/loopback_test.c +index ba6f905f26fa..69c6dce9be31 100644 +--- a/drivers/staging/greybus/tools/loopback_test.c ++++ b/drivers/staging/greybus/tools/loopback_test.c +@@ -19,6 +19,7 @@ + #include + + #define MAX_NUM_DEVICES 10 ++#define MAX_SYSFS_PREFIX 0x80 + #define MAX_SYSFS_PATH 0x200 + #define CSV_MAX_LINE 0x1000 + #define SYSFS_MAX_INT 0x20 +@@ -67,7 +68,7 @@ struct loopback_results { + }; + + struct loopback_device { +- char name[MAX_SYSFS_PATH]; ++ char name[MAX_STR_LEN]; + char sysfs_entry[MAX_SYSFS_PATH]; + char debugfs_entry[MAX_SYSFS_PATH]; + struct loopback_results results; +@@ -93,8 +94,8 @@ struct loopback_test { + int stop_all; + int poll_count; + char test_name[MAX_STR_LEN]; +- char sysfs_prefix[MAX_SYSFS_PATH]; +- char debugfs_prefix[MAX_SYSFS_PATH]; ++ char sysfs_prefix[MAX_SYSFS_PREFIX]; ++ char debugfs_prefix[MAX_SYSFS_PREFIX]; + struct timespec poll_timeout; + struct loopback_device devices[MAX_NUM_DEVICES]; + struct loopback_results aggregate_results; +@@ -637,7 +638,7 @@ baddir: + static int open_poll_files(struct loopback_test *t) + { + struct loopback_device *dev; +- char buf[MAX_STR_LEN]; ++ char buf[MAX_SYSFS_PATH + MAX_STR_LEN]; + char dummy; + int fds_idx = 0; + int i; +@@ -655,7 +656,7 @@ static int open_poll_files(struct loopback_test *t) + goto err; + } + read(t->fds[fds_idx].fd, &dummy, 1); +- t->fds[fds_idx].events = EPOLLERR|EPOLLPRI; ++ t->fds[fds_idx].events = POLLERR | POLLPRI; + t->fds[fds_idx].revents = 0; + fds_idx++; + } +@@ -748,7 +749,7 @@ static int wait_for_complete(struct loopback_test *t) + } + + for (i = 0; i < t->poll_count; i++) { +- if (t->fds[i].revents & EPOLLPRI) { ++ if (t->fds[i].revents & POLLPRI) { + /* Dummy read to clear the event */ + read(t->fds[i].fd, &dummy, 1); + number_of_events++; +@@ -907,10 +908,10 @@ int main(int argc, char *argv[]) + t.iteration_max = atoi(optarg); + break; + case 'S': +- snprintf(t.sysfs_prefix, MAX_SYSFS_PATH, "%s", optarg); ++ snprintf(t.sysfs_prefix, MAX_SYSFS_PREFIX, "%s", optarg); + break; + case 'D': +- snprintf(t.debugfs_prefix, MAX_SYSFS_PATH, "%s", optarg); ++ snprintf(t.debugfs_prefix, MAX_SYSFS_PREFIX, "%s", optarg); + break; + case 'm': + t.mask = atol(optarg); +@@ -961,10 +962,10 @@ int main(int argc, char *argv[]) + } + + if (!strcmp(t.sysfs_prefix, "")) +- snprintf(t.sysfs_prefix, MAX_SYSFS_PATH, "%s", sysfs_prefix); ++ snprintf(t.sysfs_prefix, MAX_SYSFS_PREFIX, "%s", sysfs_prefix); + + if (!strcmp(t.debugfs_prefix, "")) +- snprintf(t.debugfs_prefix, MAX_SYSFS_PATH, "%s", debugfs_prefix); ++ snprintf(t.debugfs_prefix, MAX_SYSFS_PREFIX, "%s", debugfs_prefix); + + ret = find_loopback_devices(&t); + if (ret) +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index b5d42f411dd8..845c8817281c 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -38,6 +38,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = { + {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ + {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ ++ {USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ + {} /* Terminating entry */ +diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c +index 488f2539aa9a..81ecfd1a200d 100644 +--- a/drivers/staging/speakup/main.c ++++ b/drivers/staging/speakup/main.c +@@ -561,7 +561,7 @@ static u_long get_word(struct vc_data *vc) + return 0; + } else if (tmpx < vc->vc_cols - 2 && + (ch == SPACE || ch == 0 || (ch < 0x100 && IS_WDLM(ch))) && +- get_char(vc, (u_short *)&tmp_pos + 1, &temp) > SPACE) { ++ get_char(vc, (u_short *)tmp_pos + 1, &temp) > SPACE) { + tmp_pos += 2; + tmpx++; + } else { +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 802c1210558f..36c1c59cc72a 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -2731,9 +2731,11 @@ static int compat_tty_tiocgserial(struct tty_struct *tty, + struct serial_struct32 v32; + struct serial_struct v; + int err; +- memset(&v, 0, sizeof(struct serial_struct)); + +- if (!tty->ops->set_serial) ++ memset(&v, 0, sizeof(v)); ++ memset(&v32, 0, sizeof(v32)); ++ ++ if (!tty->ops->get_serial) + return -ENOTTY; + err = tty->ops->get_serial(tty, &v); + if (!err) { +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 62f4fb9b362f..47f09a6ce7bd 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -896,10 +896,10 @@ static int get_serial_info(struct tty_struct *tty, struct serial_struct *ss) + + ss->xmit_fifo_size = acm->writesize; + ss->baud_base = le32_to_cpu(acm->line.dwDTERate); +- ss->close_delay = acm->port.close_delay / 10; ++ ss->close_delay = jiffies_to_msecs(acm->port.close_delay) / 10; + ss->closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ? + ASYNC_CLOSING_WAIT_NONE : +- acm->port.closing_wait / 10; ++ jiffies_to_msecs(acm->port.closing_wait) / 10; + return 0; + } + +@@ -907,24 +907,32 @@ static int set_serial_info(struct tty_struct *tty, struct serial_struct *ss) + { + struct acm *acm = tty->driver_data; + unsigned int closing_wait, close_delay; ++ unsigned int old_closing_wait, old_close_delay; + int retval = 0; + +- close_delay = ss->close_delay * 10; ++ close_delay = msecs_to_jiffies(ss->close_delay * 10); + closing_wait = ss->closing_wait == ASYNC_CLOSING_WAIT_NONE ? +- ASYNC_CLOSING_WAIT_NONE : ss->closing_wait * 10; ++ ASYNC_CLOSING_WAIT_NONE : ++ msecs_to_jiffies(ss->closing_wait * 10); ++ ++ /* we must redo the rounding here, so that the values match */ ++ old_close_delay = jiffies_to_msecs(acm->port.close_delay) / 10; ++ old_closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ? ++ ASYNC_CLOSING_WAIT_NONE : ++ jiffies_to_msecs(acm->port.closing_wait) / 10; + + mutex_lock(&acm->port.mutex); + +- if (!capable(CAP_SYS_ADMIN)) { +- if ((close_delay != acm->port.close_delay) || +- (closing_wait != acm->port.closing_wait)) ++ if ((ss->close_delay != old_close_delay) || ++ (ss->closing_wait != old_closing_wait)) { ++ if (!capable(CAP_SYS_ADMIN)) + retval = -EPERM; +- else +- retval = -EOPNOTSUPP; +- } else { +- acm->port.close_delay = close_delay; +- acm->port.closing_wait = closing_wait; +- } ++ else { ++ acm->port.close_delay = close_delay; ++ acm->port.closing_wait = closing_wait; ++ } ++ } else ++ retval = -EOPNOTSUPP; + + mutex_unlock(&acm->port.mutex); + return retval; +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 2dac3e7cdd97..da30b5664ff3 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -378,6 +378,12 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x0b05, 0x17e0), .driver_info = + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + ++ /* Realtek hub in Dell WD19 (Type-C) */ ++ { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, ++ ++ /* Generic RTL8153 based ethernet adapters */ ++ { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* Action Semiconductor flash disk */ + { USB_DEVICE(0x10d6, 0x2200), .driver_info = + USB_QUIRK_STRING_FETCH_255 }, +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 5e9b537df631..1fddc41fa1f3 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -136,7 +136,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_AMD_PLL_FIX; + + if (pdev->vendor == PCI_VENDOR_ID_AMD && +- (pdev->device == 0x15e0 || ++ (pdev->device == 0x145c || ++ pdev->device == 0x15e0 || + pdev->device == 0x15e1 || + pdev->device == 0x43bb)) + xhci->quirks |= XHCI_SUSPEND_DELAY; +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index d90cd5ec09cf..315b4552693c 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -445,6 +445,7 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match); + static struct platform_driver usb_xhci_driver = { + .probe = xhci_plat_probe, + .remove = xhci_plat_remove, ++ .shutdown = usb_hcd_platform_shutdown, + .driver = { + .name = "xhci-hcd", + .pm = &xhci_plat_pm_ops, +diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h +index 052a269d86f2..87da9098fb34 100644 +--- a/drivers/usb/host/xhci-trace.h ++++ b/drivers/usb/host/xhci-trace.h +@@ -289,23 +289,12 @@ DECLARE_EVENT_CLASS(xhci_log_urb, + ), + TP_printk("ep%d%s-%s: urb %p pipe %u slot %d length %d/%d sgs %d/%d stream %d flags %08x", + __entry->epnum, __entry->dir_in ? "in" : "out", +- ({ char *s; +- switch (__entry->type) { +- case USB_ENDPOINT_XFER_INT: +- s = "intr"; +- break; +- case USB_ENDPOINT_XFER_CONTROL: +- s = "control"; +- break; +- case USB_ENDPOINT_XFER_BULK: +- s = "bulk"; +- break; +- case USB_ENDPOINT_XFER_ISOC: +- s = "isoc"; +- break; +- default: +- s = "UNKNOWN"; +- } s; }), __entry->urb, __entry->pipe, __entry->slot_id, ++ __print_symbolic(__entry->type, ++ { USB_ENDPOINT_XFER_INT, "intr" }, ++ { USB_ENDPOINT_XFER_CONTROL, "control" }, ++ { USB_ENDPOINT_XFER_BULK, "bulk" }, ++ { USB_ENDPOINT_XFER_ISOC, "isoc" }), ++ __entry->urb, __entry->pipe, __entry->slot_id, + __entry->actual, __entry->length, __entry->num_mapped_sgs, + __entry->num_sgs, __entry->stream, __entry->flags + ) +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 084cc2fff3ae..0b5dcf973d94 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1183,6 +1183,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff), /* Telit ME910G1 */ + .driver_info = NCTRL(0) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110b, 0xff), /* Telit ME910G1 (ECM) */ ++ .driver_info = NCTRL(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 9d27b76c5c6e..e6d9b79d3521 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -93,6 +93,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index b0175f17d1a2..c98db6b650a5 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -124,6 +124,7 @@ + #define HP_LM920_PRODUCT_ID 0x026b + #define HP_TD620_PRODUCT_ID 0x0956 + #define HP_LD960_PRODUCT_ID 0x0b39 ++#define HP_LD381_PRODUCT_ID 0x0f7f + #define HP_LCM220_PRODUCT_ID 0x3139 + #define HP_LCM960_PRODUCT_ID 0x3239 + #define HP_LD220_PRODUCT_ID 0x3524 +diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c +index d99700cb4dca..166c2aabb512 100644 +--- a/drivers/usb/typec/ucsi/displayport.c ++++ b/drivers/usb/typec/ucsi/displayport.c +@@ -273,6 +273,9 @@ void ucsi_displayport_remove_partner(struct typec_altmode *alt) + return; + + dp = typec_altmode_get_drvdata(alt); ++ if (!dp) ++ return; ++ + dp->data.conf = 0; + dp->data.status = 0; + dp->initialized = false; +@@ -287,6 +290,8 @@ struct typec_altmode *ucsi_register_displayport(struct ucsi_connector *con, + struct typec_altmode *alt; + struct ucsi_dp *dp; + ++ mutex_lock(&con->lock); ++ + /* We can't rely on the firmware with the capabilities. */ + desc->vdo |= DP_CAP_DP_SIGNALING | DP_CAP_RECEPTACLE; + +@@ -295,12 +300,15 @@ struct typec_altmode *ucsi_register_displayport(struct ucsi_connector *con, + desc->vdo |= all_assignments << 16; + + alt = typec_port_register_altmode(con->port, desc); +- if (IS_ERR(alt)) ++ if (IS_ERR(alt)) { ++ mutex_unlock(&con->lock); + return alt; ++ } + + dp = devm_kzalloc(&alt->dev, sizeof(*dp), GFP_KERNEL); + if (!dp) { + typec_unregister_altmode(alt); ++ mutex_unlock(&con->lock); + return ERR_PTR(-ENOMEM); + } + +@@ -313,5 +321,7 @@ struct typec_altmode *ucsi_register_displayport(struct ucsi_connector *con, + alt->ops = &ucsi_displayport_ops; + typec_altmode_set_drvdata(alt, dp); + ++ mutex_unlock(&con->lock); ++ + return alt; + } +diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c +index d239fc3c5e3d..eb5151fc8efa 100644 +--- a/drivers/xen/xenbus/xenbus_comms.c ++++ b/drivers/xen/xenbus/xenbus_comms.c +@@ -313,6 +313,8 @@ static int process_msg(void) + req->msg.type = state.msg.type; + req->msg.len = state.msg.len; + req->body = state.body; ++ /* write body, then update state */ ++ virt_wmb(); + req->state = xb_req_state_got_reply; + req->cb(req); + } else +@@ -395,6 +397,8 @@ static int process_writes(void) + if (state.req->state == xb_req_state_aborted) + kfree(state.req); + else { ++ /* write err, then update state */ ++ virt_wmb(); + state.req->state = xb_req_state_got_reply; + wake_up(&state.req->wq); + } +diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c +index ddc18da61834..3a06eb699f33 100644 +--- a/drivers/xen/xenbus/xenbus_xs.c ++++ b/drivers/xen/xenbus/xenbus_xs.c +@@ -191,8 +191,11 @@ static bool xenbus_ok(void) + + static bool test_reply(struct xb_req_data *req) + { +- if (req->state == xb_req_state_got_reply || !xenbus_ok()) ++ if (req->state == xb_req_state_got_reply || !xenbus_ok()) { ++ /* read req->state before all other fields */ ++ virt_rmb(); + return true; ++ } + + /* Make sure to reread req->state each time. */ + barrier(); +@@ -202,7 +205,7 @@ static bool test_reply(struct xb_req_data *req) + + static void *read_reply(struct xb_req_data *req) + { +- while (req->state != xb_req_state_got_reply) { ++ do { + wait_event(req->wq, test_reply(req)); + + if (!xenbus_ok()) +@@ -216,7 +219,7 @@ static void *read_reply(struct xb_req_data *req) + if (req->err) + return ERR_PTR(req->err); + +- } ++ } while (req->state != xb_req_state_got_reply); + + return req->body; + } +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index c056d12cbb3c..94b0df3fb3c8 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -10142,6 +10142,10 @@ out_fail: + ret = btrfs_sync_log(trans, BTRFS_I(old_inode)->root, &ctx); + if (ret) + commit_transaction = true; ++ } else if (sync_log) { ++ mutex_lock(&root->log_mutex); ++ list_del(&ctx.list); ++ mutex_unlock(&root->log_mutex); + } + if (commit_transaction) { + ret = btrfs_commit_transaction(trans); +diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c +index 606f26d862dc..cc3ada12848d 100644 +--- a/fs/cifs/cifs_dfs_ref.c ++++ b/fs/cifs/cifs_dfs_ref.c +@@ -324,6 +324,8 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt) + if (full_path == NULL) + goto cdda_exit; + ++ convert_delimiter(full_path, '\\'); ++ + cifs_dbg(FYI, "%s: full_path: %s\n", __func__, full_path); + + if (!cifs_sb_master_tlink(cifs_sb)) { +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 637624ab6e46..115f063497ff 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -530,6 +530,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root) + + if (tcon->seal) + seq_puts(s, ",seal"); ++ else if (tcon->ses->server->ignore_signature) ++ seq_puts(s, ",signloosely"); + if (tcon->nocase) + seq_puts(s, ",nocase"); + if (tcon->local_lease) +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 0dbe47e89720..35c55cf38a35 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -1173,7 +1173,8 @@ try_again: + rc = posix_lock_file(file, flock, NULL); + up_write(&cinode->lock_sem); + if (rc == FILE_LOCK_DEFERRED) { +- rc = wait_event_interruptible(flock->fl_wait, !flock->fl_blocker); ++ rc = wait_event_interruptible(flock->fl_wait, ++ list_empty(&flock->fl_blocked_member)); + if (!rc) + goto try_again; + locks_delete_block(flock); +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 99420608d2ec..76eacffb24d8 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -3252,7 +3252,7 @@ static int smb3_fiemap(struct cifs_tcon *tcon, + if (rc) + goto out; + +- if (out_data_len < sizeof(struct file_allocated_range_buffer)) { ++ if (out_data_len && out_data_len < sizeof(struct file_allocated_range_buffer)) { + rc = -EINVAL; + goto out; + } +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index c4159bcc05d9..33cff49769cc 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1881,9 +1881,9 @@ fetch_events: + waiter = true; + init_waitqueue_entry(&wait, current); + +- spin_lock_irq(&ep->wq.lock); ++ write_lock_irq(&ep->lock); + __add_wait_queue_exclusive(&ep->wq, &wait); +- spin_unlock_irq(&ep->wq.lock); ++ write_unlock_irq(&ep->lock); + } + + for (;;) { +@@ -1931,9 +1931,9 @@ send_events: + goto fetch_events; + + if (waiter) { +- spin_lock_irq(&ep->wq.lock); ++ write_lock_irq(&ep->lock); + __remove_wait_queue(&ep->wq, &wait); +- spin_unlock_irq(&ep->wq.lock); ++ write_unlock_irq(&ep->lock); + } + + return res; +diff --git a/fs/inode.c b/fs/inode.c +index 96d62d97694e..c5267a4db0f5 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -137,6 +137,7 @@ int inode_init_always(struct super_block *sb, struct inode *inode) + inode->i_sb = sb; + inode->i_blkbits = sb->s_blocksize_bits; + inode->i_flags = 0; ++ atomic64_set(&inode->i_sequence, 0); + atomic_set(&inode->i_count, 1); + inode->i_op = &empty_iops; + inode->i_fop = &no_open_fops; +diff --git a/fs/locks.c b/fs/locks.c +index 44b6da032842..b8a31c1c4fff 100644 +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -725,7 +725,6 @@ static void __locks_delete_block(struct file_lock *waiter) + { + locks_delete_global_blocked(waiter); + list_del_init(&waiter->fl_blocked_member); +- waiter->fl_blocker = NULL; + } + + static void __locks_wake_up_blocks(struct file_lock *blocker) +@@ -740,6 +739,13 @@ static void __locks_wake_up_blocks(struct file_lock *blocker) + waiter->fl_lmops->lm_notify(waiter); + else + wake_up(&waiter->fl_wait); ++ ++ /* ++ * The setting of fl_blocker to NULL marks the "done" ++ * point in deleting a block. Paired with acquire at the top ++ * of locks_delete_block(). ++ */ ++ smp_store_release(&waiter->fl_blocker, NULL); + } + } + +@@ -754,24 +760,41 @@ int locks_delete_block(struct file_lock *waiter) + int status = -ENOENT; + + /* +- * If fl_blocker is NULL, it won't be set again as this thread +- * "owns" the lock and is the only one that might try to claim +- * the lock. So it is safe to test fl_blocker locklessly. +- * Also if fl_blocker is NULL, this waiter is not listed on +- * fl_blocked_requests for some lock, so no other request can +- * be added to the list of fl_blocked_requests for this +- * request. So if fl_blocker is NULL, it is safe to +- * locklessly check if fl_blocked_requests is empty. If both +- * of these checks succeed, there is no need to take the lock. ++ * If fl_blocker is NULL, it won't be set again as this thread "owns" ++ * the lock and is the only one that might try to claim the lock. ++ * ++ * We use acquire/release to manage fl_blocker so that we can ++ * optimize away taking the blocked_lock_lock in many cases. ++ * ++ * The smp_load_acquire guarantees two things: ++ * ++ * 1/ that fl_blocked_requests can be tested locklessly. If something ++ * was recently added to that list it must have been in a locked region ++ * *before* the locked region when fl_blocker was set to NULL. ++ * ++ * 2/ that no other thread is accessing 'waiter', so it is safe to free ++ * it. __locks_wake_up_blocks is careful not to touch waiter after ++ * fl_blocker is released. ++ * ++ * If a lockless check of fl_blocker shows it to be NULL, we know that ++ * no new locks can be inserted into its fl_blocked_requests list, and ++ * can avoid doing anything further if the list is empty. + */ +- if (waiter->fl_blocker == NULL && ++ if (!smp_load_acquire(&waiter->fl_blocker) && + list_empty(&waiter->fl_blocked_requests)) + return status; ++ + spin_lock(&blocked_lock_lock); + if (waiter->fl_blocker) + status = 0; + __locks_wake_up_blocks(waiter); + __locks_delete_block(waiter); ++ ++ /* ++ * The setting of fl_blocker to NULL marks the "done" point in deleting ++ * a block. Paired with acquire at the top of this function. ++ */ ++ smp_store_release(&waiter->fl_blocker, NULL); + spin_unlock(&blocked_lock_lock); + return status; + } +@@ -1364,7 +1387,8 @@ static int posix_lock_inode_wait(struct inode *inode, struct file_lock *fl) + error = posix_lock_inode(inode, fl, NULL); + if (error != FILE_LOCK_DEFERRED) + break; +- error = wait_event_interruptible(fl->fl_wait, !fl->fl_blocker); ++ error = wait_event_interruptible(fl->fl_wait, ++ list_empty(&fl->fl_blocked_member)); + if (error) + break; + } +@@ -1449,7 +1473,8 @@ int locks_mandatory_area(struct inode *inode, struct file *filp, loff_t start, + error = posix_lock_inode(inode, &fl, NULL); + if (error != FILE_LOCK_DEFERRED) + break; +- error = wait_event_interruptible(fl.fl_wait, !fl.fl_blocker); ++ error = wait_event_interruptible(fl.fl_wait, ++ list_empty(&fl.fl_blocked_member)); + if (!error) { + /* + * If we've been sleeping someone might have +@@ -1652,7 +1677,8 @@ restart: + + locks_dispose_list(&dispose); + error = wait_event_interruptible_timeout(new_fl->fl_wait, +- !new_fl->fl_blocker, break_time); ++ list_empty(&new_fl->fl_blocked_member), ++ break_time); + + percpu_down_read(&file_rwsem); + spin_lock(&ctx->flc_lock); +@@ -2136,7 +2162,8 @@ static int flock_lock_inode_wait(struct inode *inode, struct file_lock *fl) + error = flock_lock_inode(inode, fl); + if (error != FILE_LOCK_DEFERRED) + break; +- error = wait_event_interruptible(fl->fl_wait, !fl->fl_blocker); ++ error = wait_event_interruptible(fl->fl_wait, ++ list_empty(&fl->fl_blocked_member)); + if (error) + break; + } +@@ -2413,7 +2440,8 @@ static int do_lock_file_wait(struct file *filp, unsigned int cmd, + error = vfs_lock_file(filp, cmd, fl, NULL); + if (error != FILE_LOCK_DEFERRED) + break; +- error = wait_event_interruptible(fl->fl_wait, !fl->fl_blocker); ++ error = wait_event_interruptible(fl->fl_wait, ++ list_empty(&fl->fl_blocked_member)); + if (error) + break; + } +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 0b4d8fc79e0f..06668379109e 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -698,6 +698,7 @@ struct inode { + struct rcu_head i_rcu; + }; + atomic64_t i_version; ++ atomic64_t i_sequence; /* see futex */ + atomic_t i_count; + atomic_t i_dio_count; + atomic_t i_writecount; +diff --git a/include/linux/futex.h b/include/linux/futex.h +index 5cc3fed27d4c..b70df27d7e85 100644 +--- a/include/linux/futex.h ++++ b/include/linux/futex.h +@@ -31,23 +31,26 @@ struct task_struct; + + union futex_key { + struct { ++ u64 i_seq; + unsigned long pgoff; +- struct inode *inode; +- int offset; ++ unsigned int offset; + } shared; + struct { ++ union { ++ struct mm_struct *mm; ++ u64 __tmp; ++ }; + unsigned long address; +- struct mm_struct *mm; +- int offset; ++ unsigned int offset; + } private; + struct { ++ u64 ptr; + unsigned long word; +- void *ptr; +- int offset; ++ unsigned int offset; + } both; + }; + +-#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = NULL } } ++#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } } + + #ifdef CONFIG_FUTEX + enum { +diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h +index 1bf83c8fcaa7..77de28bfefb0 100644 +--- a/include/linux/page-flags.h ++++ b/include/linux/page-flags.h +@@ -311,7 +311,7 @@ static inline int TestClearPage##uname(struct page *page) { return 0; } + + __PAGEFLAG(Locked, locked, PF_NO_TAIL) + PAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) __CLEARPAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) +-PAGEFLAG(Error, error, PF_NO_COMPOUND) TESTCLEARFLAG(Error, error, PF_NO_COMPOUND) ++PAGEFLAG(Error, error, PF_NO_TAIL) TESTCLEARFLAG(Error, error, PF_NO_TAIL) + PAGEFLAG(Referenced, referenced, PF_HEAD) + TESTCLEARFLAG(Referenced, referenced, PF_HEAD) + __SETPAGEFLAG(Referenced, referenced, PF_HEAD) +diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h +index 4e7809408073..decac0790fc1 100644 +--- a/include/linux/vmalloc.h ++++ b/include/linux/vmalloc.h +@@ -126,8 +126,9 @@ extern int remap_vmalloc_range_partial(struct vm_area_struct *vma, + + extern int remap_vmalloc_range(struct vm_area_struct *vma, void *addr, + unsigned long pgoff); +-void vmalloc_sync_all(void); +- ++void vmalloc_sync_mappings(void); ++void vmalloc_sync_unmappings(void); ++ + /* + * Lowlevel-APIs (not for driver use!) + */ +diff --git a/kernel/futex.c b/kernel/futex.c +index afbf928d6a6b..5660c02b01b0 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -385,9 +385,9 @@ static inline int hb_waiters_pending(struct futex_hash_bucket *hb) + */ + static struct futex_hash_bucket *hash_futex(union futex_key *key) + { +- u32 hash = jhash2((u32*)&key->both.word, +- (sizeof(key->both.word)+sizeof(key->both.ptr))/4, ++ u32 hash = jhash2((u32 *)key, offsetof(typeof(*key), both.offset) / 4, + key->both.offset); ++ + return &futex_queues[hash & (futex_hashsize - 1)]; + } + +@@ -429,7 +429,7 @@ static void get_futex_key_refs(union futex_key *key) + + switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) { + case FUT_OFF_INODE: +- ihold(key->shared.inode); /* implies smp_mb(); (B) */ ++ smp_mb(); /* explicit smp_mb(); (B) */ + break; + case FUT_OFF_MMSHARED: + futex_get_mm(key); /* implies smp_mb(); (B) */ +@@ -463,7 +463,6 @@ static void drop_futex_key_refs(union futex_key *key) + + switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) { + case FUT_OFF_INODE: +- iput(key->shared.inode); + break; + case FUT_OFF_MMSHARED: + mmdrop(key->private.mm); +@@ -505,6 +504,46 @@ futex_setup_timer(ktime_t *time, struct hrtimer_sleeper *timeout, + return timeout; + } + ++/* ++ * Generate a machine wide unique identifier for this inode. ++ * ++ * This relies on u64 not wrapping in the life-time of the machine; which with ++ * 1ns resolution means almost 585 years. ++ * ++ * This further relies on the fact that a well formed program will not unmap ++ * the file while it has a (shared) futex waiting on it. This mapping will have ++ * a file reference which pins the mount and inode. ++ * ++ * If for some reason an inode gets evicted and read back in again, it will get ++ * a new sequence number and will _NOT_ match, even though it is the exact same ++ * file. ++ * ++ * It is important that match_futex() will never have a false-positive, esp. ++ * for PI futexes that can mess up the state. The above argues that false-negatives ++ * are only possible for malformed programs. ++ */ ++static u64 get_inode_sequence_number(struct inode *inode) ++{ ++ static atomic64_t i_seq; ++ u64 old; ++ ++ /* Does the inode already have a sequence number? */ ++ old = atomic64_read(&inode->i_sequence); ++ if (likely(old)) ++ return old; ++ ++ for (;;) { ++ u64 new = atomic64_add_return(1, &i_seq); ++ if (WARN_ON_ONCE(!new)) ++ continue; ++ ++ old = atomic64_cmpxchg_relaxed(&inode->i_sequence, 0, new); ++ if (old) ++ return old; ++ return new; ++ } ++} ++ + /** + * get_futex_key() - Get parameters which are the keys for a futex + * @uaddr: virtual address of the futex +@@ -517,9 +556,15 @@ futex_setup_timer(ktime_t *time, struct hrtimer_sleeper *timeout, + * + * The key words are stored in @key on success. + * +- * For shared mappings, it's (page->index, file_inode(vma->vm_file), +- * offset_within_page). For private mappings, it's (uaddr, current->mm). +- * We can usually work out the index without swapping in the page. ++ * For shared mappings (when @fshared), the key is: ++ * ( inode->i_sequence, page->index, offset_within_page ) ++ * [ also see get_inode_sequence_number() ] ++ * ++ * For private mappings (or when !@fshared), the key is: ++ * ( current->mm, address, 0 ) ++ * ++ * This allows (cross process, where applicable) identification of the futex ++ * without keeping the page pinned for the duration of the FUTEX_WAIT. + * + * lock_page() might sleep, the caller should not hold a spinlock. + */ +@@ -659,8 +704,6 @@ again: + key->private.mm = mm; + key->private.address = address; + +- get_futex_key_refs(key); /* implies smp_mb(); (B) */ +- + } else { + struct inode *inode; + +@@ -692,40 +735,14 @@ again: + goto again; + } + +- /* +- * Take a reference unless it is about to be freed. Previously +- * this reference was taken by ihold under the page lock +- * pinning the inode in place so i_lock was unnecessary. The +- * only way for this check to fail is if the inode was +- * truncated in parallel which is almost certainly an +- * application bug. In such a case, just retry. +- * +- * We are not calling into get_futex_key_refs() in file-backed +- * cases, therefore a successful atomic_inc return below will +- * guarantee that get_futex_key() will still imply smp_mb(); (B). +- */ +- if (!atomic_inc_not_zero(&inode->i_count)) { +- rcu_read_unlock(); +- put_page(page); +- +- goto again; +- } +- +- /* Should be impossible but lets be paranoid for now */ +- if (WARN_ON_ONCE(inode->i_mapping != mapping)) { +- err = -EFAULT; +- rcu_read_unlock(); +- iput(inode); +- +- goto out; +- } +- + key->both.offset |= FUT_OFF_INODE; /* inode-based key */ +- key->shared.inode = inode; ++ key->shared.i_seq = get_inode_sequence_number(inode); + key->shared.pgoff = basepage_index(tail); + rcu_read_unlock(); + } + ++ get_futex_key_refs(key); /* implies smp_mb(); (B) */ ++ + out: + put_page(page); + return err; +diff --git a/kernel/notifier.c b/kernel/notifier.c +index d9f5081d578d..157d7c29f720 100644 +--- a/kernel/notifier.c ++++ b/kernel/notifier.c +@@ -554,7 +554,7 @@ NOKPROBE_SYMBOL(notify_die); + + int register_die_notifier(struct notifier_block *nb) + { +- vmalloc_sync_all(); ++ vmalloc_sync_mappings(); + return atomic_notifier_chain_register(&die_chain, nb); + } + EXPORT_SYMBOL_GPL(register_die_notifier); +diff --git a/mm/madvise.c b/mm/madvise.c +index 94c343b4c968..d8cfc3a0c153 100644 +--- a/mm/madvise.c ++++ b/mm/madvise.c +@@ -335,12 +335,14 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, + } + + page = pmd_page(orig_pmd); ++ ++ /* Do not interfere with other mappings of this page */ ++ if (page_mapcount(page) != 1) ++ goto huge_unlock; ++ + if (next - addr != HPAGE_PMD_SIZE) { + int err; + +- if (page_mapcount(page) != 1) +- goto huge_unlock; +- + get_page(page); + spin_unlock(ptl); + lock_page(page); +@@ -426,6 +428,10 @@ regular_page: + continue; + } + ++ /* Do not interfere with other mappings of this page */ ++ if (page_mapcount(page) != 1) ++ continue; ++ + VM_BUG_ON_PAGE(PageTransCompound(page), page); + + if (pte_young(ptent)) { +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 23c99c6778d3..d804efb372e2 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -2414,28 +2414,41 @@ static void high_work_func(struct work_struct *work) + #define MEMCG_DELAY_SCALING_SHIFT 14 + + /* +- * Scheduled by try_charge() to be executed from the userland return path +- * and reclaims memory over the high limit. ++ * Get the number of jiffies that we should penalise a mischievous cgroup which ++ * is exceeding its memory.high by checking both it and its ancestors. + */ +-void mem_cgroup_handle_over_high(void) ++static unsigned long calculate_high_delay(struct mem_cgroup *memcg, ++ unsigned int nr_pages) + { +- unsigned long usage, high, clamped_high; +- unsigned long pflags; +- unsigned long penalty_jiffies, overage; +- unsigned int nr_pages = current->memcg_nr_pages_over_high; +- struct mem_cgroup *memcg; ++ unsigned long penalty_jiffies; ++ u64 max_overage = 0; + +- if (likely(!nr_pages)) +- return; ++ do { ++ unsigned long usage, high; ++ u64 overage; + +- memcg = get_mem_cgroup_from_mm(current->mm); +- reclaim_high(memcg, nr_pages, GFP_KERNEL); +- current->memcg_nr_pages_over_high = 0; ++ usage = page_counter_read(&memcg->memory); ++ high = READ_ONCE(memcg->high); ++ ++ /* ++ * Prevent division by 0 in overage calculation by acting as if ++ * it was a threshold of 1 page ++ */ ++ high = max(high, 1UL); ++ ++ overage = usage - high; ++ overage <<= MEMCG_DELAY_PRECISION_SHIFT; ++ overage = div64_u64(overage, high); ++ ++ if (overage > max_overage) ++ max_overage = overage; ++ } while ((memcg = parent_mem_cgroup(memcg)) && ++ !mem_cgroup_is_root(memcg)); ++ ++ if (!max_overage) ++ return 0; + + /* +- * memory.high is breached and reclaim is unable to keep up. Throttle +- * allocators proactively to slow down excessive growth. +- * + * We use overage compared to memory.high to calculate the number of + * jiffies to sleep (penalty_jiffies). Ideally this value should be + * fairly lenient on small overages, and increasingly harsh when the +@@ -2443,24 +2456,9 @@ void mem_cgroup_handle_over_high(void) + * its crazy behaviour, so we exponentially increase the delay based on + * overage amount. + */ +- +- usage = page_counter_read(&memcg->memory); +- high = READ_ONCE(memcg->high); +- +- if (usage <= high) +- goto out; +- +- /* +- * Prevent division by 0 in overage calculation by acting as if it was a +- * threshold of 1 page +- */ +- clamped_high = max(high, 1UL); +- +- overage = div_u64((u64)(usage - high) << MEMCG_DELAY_PRECISION_SHIFT, +- clamped_high); +- +- penalty_jiffies = ((u64)overage * overage * HZ) +- >> (MEMCG_DELAY_PRECISION_SHIFT + MEMCG_DELAY_SCALING_SHIFT); ++ penalty_jiffies = max_overage * max_overage * HZ; ++ penalty_jiffies >>= MEMCG_DELAY_PRECISION_SHIFT; ++ penalty_jiffies >>= MEMCG_DELAY_SCALING_SHIFT; + + /* + * Factor in the task's own contribution to the overage, such that four +@@ -2477,7 +2475,32 @@ void mem_cgroup_handle_over_high(void) + * application moving forwards and also permit diagnostics, albeit + * extremely slowly. + */ +- penalty_jiffies = min(penalty_jiffies, MEMCG_MAX_HIGH_DELAY_JIFFIES); ++ return min(penalty_jiffies, MEMCG_MAX_HIGH_DELAY_JIFFIES); ++} ++ ++/* ++ * Scheduled by try_charge() to be executed from the userland return path ++ * and reclaims memory over the high limit. ++ */ ++void mem_cgroup_handle_over_high(void) ++{ ++ unsigned long penalty_jiffies; ++ unsigned long pflags; ++ unsigned int nr_pages = current->memcg_nr_pages_over_high; ++ struct mem_cgroup *memcg; ++ ++ if (likely(!nr_pages)) ++ return; ++ ++ memcg = get_mem_cgroup_from_mm(current->mm); ++ reclaim_high(memcg, nr_pages, GFP_KERNEL); ++ current->memcg_nr_pages_over_high = 0; ++ ++ /* ++ * memory.high is breached and reclaim is unable to keep up. Throttle ++ * allocators proactively to slow down excessive growth. ++ */ ++ penalty_jiffies = calculate_high_delay(memcg, nr_pages); + + /* + * Don't sleep if the amount of jiffies this memcg owes us is so low +@@ -4151,7 +4174,7 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg, + struct mem_cgroup_thresholds *thresholds; + struct mem_cgroup_threshold_ary *new; + unsigned long usage; +- int i, j, size; ++ int i, j, size, entries; + + mutex_lock(&memcg->thresholds_lock); + +@@ -4171,14 +4194,20 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg, + __mem_cgroup_threshold(memcg, type == _MEMSWAP); + + /* Calculate new number of threshold */ +- size = 0; ++ size = entries = 0; + for (i = 0; i < thresholds->primary->size; i++) { + if (thresholds->primary->entries[i].eventfd != eventfd) + size++; ++ else ++ entries++; + } + + new = thresholds->spare; + ++ /* If no items related to eventfd have been cleared, nothing to do */ ++ if (!entries) ++ goto unlock; ++ + /* Set thresholds array to NULL if we don't have thresholds */ + if (!size) { + kfree(new); +diff --git a/mm/nommu.c b/mm/nommu.c +index 99b7ec318824..3b67bd20c2af 100644 +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -359,10 +359,14 @@ void vm_unmap_aliases(void) + EXPORT_SYMBOL_GPL(vm_unmap_aliases); + + /* +- * Implement a stub for vmalloc_sync_all() if the architecture chose not to +- * have one. ++ * Implement a stub for vmalloc_sync_[un]mapping() if the architecture ++ * chose not to have one. + */ +-void __weak vmalloc_sync_all(void) ++void __weak vmalloc_sync_mappings(void) ++{ ++} ++ ++void __weak vmalloc_sync_unmappings(void) + { + } + +diff --git a/mm/slub.c b/mm/slub.c +index 3ca4a223f44c..59ed00be02cb 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -1953,8 +1953,6 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node, + + if (node == NUMA_NO_NODE) + searchnode = numa_mem_id(); +- else if (!node_present_pages(node)) +- searchnode = node_to_mem_node(node); + + object = get_partial_node(s, get_node(s, searchnode), c, flags); + if (object || node != NUMA_NO_NODE) +@@ -2543,17 +2541,27 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, + struct page *page; + + page = c->page; +- if (!page) ++ if (!page) { ++ /* ++ * if the node is not online or has no normal memory, just ++ * ignore the node constraint ++ */ ++ if (unlikely(node != NUMA_NO_NODE && ++ !node_state(node, N_NORMAL_MEMORY))) ++ node = NUMA_NO_NODE; + goto new_slab; ++ } + redo: + + if (unlikely(!node_match(page, node))) { +- int searchnode = node; +- +- if (node != NUMA_NO_NODE && !node_present_pages(node)) +- searchnode = node_to_mem_node(node); +- +- if (unlikely(!node_match(page, searchnode))) { ++ /* ++ * same as above but node_match() being false already ++ * implies node != NUMA_NO_NODE ++ */ ++ if (!node_state(node, N_NORMAL_MEMORY)) { ++ node = NUMA_NO_NODE; ++ goto redo; ++ } else { + stat(s, ALLOC_NODE_MISMATCH); + deactivate_slab(s, page, c->freelist, c); + goto new_slab; +@@ -2977,11 +2985,13 @@ redo: + barrier(); + + if (likely(page == c->page)) { +- set_freepointer(s, tail_obj, c->freelist); ++ void **freelist = READ_ONCE(c->freelist); ++ ++ set_freepointer(s, tail_obj, freelist); + + if (unlikely(!this_cpu_cmpxchg_double( + s->cpu_slab->freelist, s->cpu_slab->tid, +- c->freelist, tid, ++ freelist, tid, + head, next_tid(tid)))) { + + note_cmpxchg_failure("slab_free", s, tid); +diff --git a/mm/sparse.c b/mm/sparse.c +index a5e5c1c3a2a8..a18ad9390d9f 100644 +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -742,6 +742,7 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, + struct mem_section *ms = __pfn_to_section(pfn); + bool section_is_early = early_section(ms); + struct page *memmap = NULL; ++ bool empty; + unsigned long *subsection_map = ms->usage + ? &ms->usage->subsection_map[0] : NULL; + +@@ -772,7 +773,8 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, + * For 2/ and 3/ the SPARSEMEM_VMEMMAP={y,n} cases are unified + */ + bitmap_xor(subsection_map, map, subsection_map, SUBSECTIONS_PER_SECTION); +- if (bitmap_empty(subsection_map, SUBSECTIONS_PER_SECTION)) { ++ empty = bitmap_empty(subsection_map, SUBSECTIONS_PER_SECTION); ++ if (empty) { + unsigned long section_nr = pfn_to_section_nr(pfn); + + /* +@@ -787,13 +789,15 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, + ms->usage = NULL; + } + memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); +- ms->section_mem_map = (unsigned long)NULL; + } + + if (section_is_early && memmap) + free_map_bootmem(memmap); + else + depopulate_section_memmap(pfn, nr_pages, altmap); ++ ++ if (empty) ++ ms->section_mem_map = (unsigned long)NULL; + } + + static struct page * __meminit section_activate(int nid, unsigned long pfn, +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 61bdbaf20cde..7d05834e594c 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -1259,7 +1259,7 @@ static bool __purge_vmap_area_lazy(unsigned long start, unsigned long end) + * First make sure the mappings are removed from all page-tables + * before they are freed. + */ +- vmalloc_sync_all(); ++ vmalloc_sync_unmappings(); + + /* + * TODO: to calculate a flush range without looping. +@@ -3050,16 +3050,19 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr, + EXPORT_SYMBOL(remap_vmalloc_range); + + /* +- * Implement a stub for vmalloc_sync_all() if the architecture chose not to +- * have one. ++ * Implement stubs for vmalloc_sync_[un]mappings () if the architecture chose ++ * not to have one. + * + * The purpose of this function is to make sure the vmalloc area + * mappings are identical in all page-tables in the system. + */ +-void __weak vmalloc_sync_all(void) ++void __weak vmalloc_sync_mappings(void) + { + } + ++void __weak vmalloc_sync_unmappings(void) ++{ ++} + + static int f(pte_t *pte, unsigned long addr, void *data) + { +diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn +index ecddf83ac142..ca08f2fe7c34 100644 +--- a/scripts/Makefile.extrawarn ++++ b/scripts/Makefile.extrawarn +@@ -48,6 +48,7 @@ KBUILD_CFLAGS += -Wno-initializer-overrides + KBUILD_CFLAGS += -Wno-format + KBUILD_CFLAGS += -Wno-sign-compare + KBUILD_CFLAGS += -Wno-format-zero-length ++KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) + endif + + endif +diff --git a/scripts/export_report.pl b/scripts/export_report.pl +index 548330e8c4e7..feb3d5542a62 100755 +--- a/scripts/export_report.pl ++++ b/scripts/export_report.pl +@@ -94,7 +94,7 @@ if (defined $opt{'o'}) { + # + while ( <$module_symvers> ) { + chomp; +- my (undef, $symbol, $namespace, $module, $gpl) = split('\t'); ++ my (undef, $symbol, $module, $gpl, $namespace) = split('\t'); + $SYMBOL { $symbol } = [ $module , "0" , $symbol, $gpl]; + } + close($module_symvers); +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index d2a30a7b3f07..52f1152c9838 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -2434,7 +2434,7 @@ static void write_if_changed(struct buffer *b, const char *fname) + } + + /* parse Module.symvers file. line format: +- * 0x12345678symbolmodule[[export]something] ++ * 0x12345678symbolmoduleexportnamespace + **/ + static void read_dump(const char *fname, unsigned int kernel) + { +@@ -2447,7 +2447,7 @@ static void read_dump(const char *fname, unsigned int kernel) + return; + + while ((line = get_next_line(&pos, file, size))) { +- char *symname, *namespace, *modname, *d, *export, *end; ++ char *symname, *namespace, *modname, *d, *export; + unsigned int crc; + struct module *mod; + struct symbol *s; +@@ -2455,16 +2455,16 @@ static void read_dump(const char *fname, unsigned int kernel) + if (!(symname = strchr(line, '\t'))) + goto fail; + *symname++ = '\0'; +- if (!(namespace = strchr(symname, '\t'))) +- goto fail; +- *namespace++ = '\0'; +- if (!(modname = strchr(namespace, '\t'))) ++ if (!(modname = strchr(symname, '\t'))) + goto fail; + *modname++ = '\0'; +- if ((export = strchr(modname, '\t')) != NULL) +- *export++ = '\0'; +- if (export && ((end = strchr(export, '\t')) != NULL)) +- *end = '\0'; ++ if (!(export = strchr(modname, '\t'))) ++ goto fail; ++ *export++ = '\0'; ++ if (!(namespace = strchr(export, '\t'))) ++ goto fail; ++ *namespace++ = '\0'; ++ + crc = strtoul(line, &d, 16); + if (*symname == '\0' || *modname == '\0' || *d != '\0') + goto fail; +@@ -2516,9 +2516,9 @@ static void write_dump(const char *fname) + namespace = symbol->namespace; + buf_printf(&buf, "0x%08x\t%s\t%s\t%s\t%s\n", + symbol->crc, symbol->name, +- namespace ? namespace : "", + symbol->module->name, +- export_str(symbol->export)); ++ export_str(symbol->export), ++ namespace ? namespace : ""); + } + symbol = symbol->next; + } +diff --git a/scripts/parse-maintainers.pl b/scripts/parse-maintainers.pl +old mode 100644 +new mode 100755 +diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c +index 31cb2acf8afc..732bbede7ebf 100644 +--- a/sound/core/oss/pcm_plugin.c ++++ b/sound/core/oss/pcm_plugin.c +@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames) + while (plugin->next) { + if (plugin->dst_frames) + frames = plugin->dst_frames(plugin, frames); +- if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) ++ if ((snd_pcm_sframes_t)frames <= 0) + return -ENXIO; + plugin = plugin->next; + err = snd_pcm_plugin_alloc(plugin, frames); +@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames) + while (plugin->prev) { + if (plugin->src_frames) + frames = plugin->src_frames(plugin, frames); +- if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) ++ if ((snd_pcm_sframes_t)frames <= 0) + return -ENXIO; + plugin = plugin->prev; + err = snd_pcm_plugin_alloc(plugin, frames); +@@ -209,6 +209,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p + if (stream == SNDRV_PCM_STREAM_PLAYBACK) { + plugin = snd_pcm_plug_last(plug); + while (plugin && drv_frames > 0) { ++ if (drv_frames > plugin->buf_frames) ++ drv_frames = plugin->buf_frames; + plugin_prev = plugin->prev; + if (plugin->src_frames) + drv_frames = plugin->src_frames(plugin, drv_frames); +@@ -220,6 +222,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p + plugin_next = plugin->next; + if (plugin->dst_frames) + drv_frames = plugin->dst_frames(plugin, drv_frames); ++ if (drv_frames > plugin->buf_frames) ++ drv_frames = plugin->buf_frames; + plugin = plugin_next; + } + } else +@@ -248,11 +252,15 @@ snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pc + if (frames < 0) + return frames; + } ++ if (frames > plugin->buf_frames) ++ frames = plugin->buf_frames; + plugin = plugin_next; + } + } else if (stream == SNDRV_PCM_STREAM_CAPTURE) { + plugin = snd_pcm_plug_last(plug); + while (plugin) { ++ if (frames > plugin->buf_frames) ++ frames = plugin->buf_frames; + plugin_prev = plugin->prev; + if (plugin->src_frames) { + frames = plugin->src_frames(plugin, frames); +diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c +index a88c235b2ea3..2ddfe2226651 100644 +--- a/sound/core/seq/oss/seq_oss_midi.c ++++ b/sound/core/seq/oss/seq_oss_midi.c +@@ -602,6 +602,7 @@ send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq + len = snd_seq_oss_timer_start(dp->timer); + if (ev->type == SNDRV_SEQ_EVENT_SYSEX) { + snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev); ++ snd_midi_event_reset_decode(mdev->coder); + } else { + len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev); + if (len > 0) +diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c +index 626d87c1539b..77d7037d1476 100644 +--- a/sound/core/seq/seq_virmidi.c ++++ b/sound/core/seq/seq_virmidi.c +@@ -81,6 +81,7 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev, + if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE) + continue; + snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream); ++ snd_midi_event_reset_decode(vmidi->parser); + } else { + len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev); + if (len > 0) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 12858d95c2c8..128db2e6bc64 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8080,6 +8080,8 @@ static int patch_alc269(struct hda_codec *codec) + spec->gen.mixer_nid = 0; + break; + case 0x10ec0225: ++ codec->power_save_node = 1; ++ /* fall through */ + case 0x10ec0295: + case 0x10ec0299: + spec->codec_variant = ALC269_TYPE_ALC225; +@@ -8639,6 +8641,8 @@ enum { + ALC669_FIXUP_ACER_ASPIRE_ETHOS, + ALC669_FIXUP_ACER_ASPIRE_ETHOS_HEADSET, + ALC671_FIXUP_HP_HEADSET_MIC2, ++ ALC662_FIXUP_ACER_X2660G_HEADSET_MODE, ++ ALC662_FIXUP_ACER_NITRO_HEADSET_MODE, + }; + + static const struct hda_fixup alc662_fixups[] = { +@@ -8984,6 +8988,25 @@ static const struct hda_fixup alc662_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc671_fixup_hp_headset_mic2, + }, ++ [ALC662_FIXUP_ACER_X2660G_HEADSET_MODE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x1a, 0x02a1113c }, /* use as headset mic, without its own jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC662_FIXUP_USI_FUNC ++ }, ++ [ALC662_FIXUP_ACER_NITRO_HEADSET_MODE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x1a, 0x01a11140 }, /* use as headset mic, without its own jack detect */ ++ { 0x1b, 0x0221144f }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC662_FIXUP_USI_FUNC ++ }, + }; + + static const struct snd_pci_quirk alc662_fixup_tbl[] = { +@@ -8995,6 +9018,8 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1025, 0x034a, "Gateway LT27", ALC662_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE), ++ SND_PCI_QUIRK(0x1025, 0x123c, "Acer Nitro N50-600", ALC662_FIXUP_ACER_NITRO_HEADSET_MODE), ++ SND_PCI_QUIRK(0x1025, 0x124e, "Acer 2660G", ALC662_FIXUP_ACER_X2660G_HEADSET_MODE), + SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x05fe, "Dell XPS 15", ALC668_FIXUP_DELL_XPS13), +diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c +index 30bcd5d3a32a..10eb4b8e8e7e 100644 +--- a/sound/soc/stm/stm32_sai_sub.c ++++ b/sound/soc/stm/stm32_sai_sub.c +@@ -1543,20 +1543,20 @@ static int stm32_sai_sub_probe(struct platform_device *pdev) + return ret; + } + +- ret = devm_snd_soc_register_component(&pdev->dev, &stm32_component, +- &sai->cpu_dai_drv, 1); ++ ret = snd_dmaengine_pcm_register(&pdev->dev, conf, 0); ++ if (ret) { ++ dev_err(&pdev->dev, "Could not register pcm dma\n"); ++ return ret; ++ } ++ ++ ret = snd_soc_register_component(&pdev->dev, &stm32_component, ++ &sai->cpu_dai_drv, 1); + if (ret) + return ret; + + if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) + conf = &stm32_sai_pcm_config_spdif; + +- ret = devm_snd_dmaengine_pcm_register(&pdev->dev, conf, 0); +- if (ret) { +- dev_err(&pdev->dev, "Could not register pcm dma\n"); +- return ret; +- } +- + return 0; + } + +@@ -1565,6 +1565,8 @@ static int stm32_sai_sub_remove(struct platform_device *pdev) + struct stm32_sai_sub_data *sai = dev_get_drvdata(&pdev->dev); + + clk_unprepare(sai->pdata->pclk); ++ snd_dmaengine_pcm_unregister(&pdev->dev); ++ snd_soc_unregister_component(&pdev->dev); + + return 0; + } +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index b5a3f754a4f1..4f096685ed65 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -305,7 +305,7 @@ static void line6_data_received(struct urb *urb) + line6_midibuf_read(mb, line6->buffer_message, + LINE6_MIDI_MESSAGE_MAXLEN); + +- if (done == 0) ++ if (done <= 0) + break; + + line6->message_length = done; +diff --git a/sound/usb/line6/midibuf.c b/sound/usb/line6/midibuf.c +index 8d6eefa0d936..6a70463f82c4 100644 +--- a/sound/usb/line6/midibuf.c ++++ b/sound/usb/line6/midibuf.c +@@ -159,7 +159,7 @@ int line6_midibuf_read(struct midi_buffer *this, unsigned char *data, + int midi_length_prev = + midibuf_message_length(this->command_prev); + +- if (midi_length_prev > 0) { ++ if (midi_length_prev > 1) { + midi_length = midi_length_prev - 1; + repeat = 1; + } else diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.173-174.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.173-174.patch new file mode 100644 index 0000000000..bfe0e9e014 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.173-174.patch @@ -0,0 +1,3145 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 7e0a4be3503d..ae51b1b7b67f 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -137,6 +137,10 @@ + dynamic table installation which will install SSDT + tables to /sys/firmware/acpi/tables/dynamic. + ++ acpi_no_watchdog [HW,ACPI,WDT] ++ Ignore the ACPI-based watchdog interface (WDAT) and let ++ a native driver control the watchdog device instead. ++ + acpi_rsdp= [ACPI,EFI,KEXEC] + Pass the RSDP address to the kernel, mostly used + on machines running EFI runtime service to boot the +diff --git a/Documentation/filesystems/porting b/Documentation/filesystems/porting +index 93e0a2404532..c757c1c3cb81 100644 +--- a/Documentation/filesystems/porting ++++ b/Documentation/filesystems/porting +@@ -606,3 +606,10 @@ in your dentry operations instead. + dentry separately, and it now has request_mask and query_flags arguments + to specify the fields and sync type requested by statx. Filesystems not + supporting any statx-specific features may ignore the new arguments. ++-- ++[mandatory] ++ ++ [should've been added in 2016] stale comment in finish_open() ++ nonwithstanding, failure exits in ->atomic_open() instances should ++ *NOT* fput() the file, no matter what. Everything is handled by the ++ caller. +diff --git a/Makefile b/Makefile +index 9a524b5c1d55..edc6b62bd892 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 173 ++SUBLEVEL = 174 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h +index b29f1a9fd6f7..07c8e1a6c56e 100644 +--- a/arch/arc/include/asm/linkage.h ++++ b/arch/arc/include/asm/linkage.h +@@ -14,6 +14,8 @@ + #ifdef __ASSEMBLY__ + + #define ASM_NL ` /* use '`' to mark new line in macro */ ++#define __ALIGN .align 4 ++#define __ALIGN_STR __stringify(__ALIGN) + + /* annotation for data we want in DCCM - if enabled in .config */ + .macro ARCFP_DATA nm +diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c +index f4dd7f9663c1..0001742c131d 100644 +--- a/arch/arm/kernel/vdso.c ++++ b/arch/arm/kernel/vdso.c +@@ -103,6 +103,8 @@ static bool __init cntvct_functional(void) + * this. + */ + np = of_find_compatible_node(NULL, NULL, "arm,armv7-timer"); ++ if (!np) ++ np = of_find_compatible_node(NULL, NULL, "arm,armv8-timer"); + if (!np) + goto out_put; + +diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S +index 6709a8d33963..f1e34f16cfab 100644 +--- a/arch/arm/lib/copy_from_user.S ++++ b/arch/arm/lib/copy_from_user.S +@@ -100,7 +100,7 @@ ENTRY(arm_copy_from_user) + + ENDPROC(arm_copy_from_user) + +- .pushsection .fixup,"ax" ++ .pushsection .text.fixup,"ax" + .align 0 + copy_abort_preamble + ldmfd sp!, {r1, r2, r3} +diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c +index baa7e36073f9..604a8558752d 100644 +--- a/arch/x86/events/amd/uncore.c ++++ b/arch/x86/events/amd/uncore.c +@@ -193,20 +193,18 @@ static int amd_uncore_event_init(struct perf_event *event) + + /* + * NB and Last level cache counters (MSRs) are shared across all cores +- * that share the same NB / Last level cache. Interrupts can be directed +- * to a single target core, however, event counts generated by processes +- * running on other cores cannot be masked out. So we do not support +- * sampling and per-thread events. ++ * that share the same NB / Last level cache. On family 16h and below, ++ * Interrupts can be directed to a single target core, however, event ++ * counts generated by processes running on other cores cannot be masked ++ * out. So we do not support sampling and per-thread events via ++ * CAP_NO_INTERRUPT, and we do not enable counter overflow interrupts: + */ +- if (is_sampling_event(event) || event->attach_state & PERF_ATTACH_TASK) +- return -EINVAL; + + /* NB and Last level cache counters do not have usr/os/guest/host bits */ + if (event->attr.exclude_user || event->attr.exclude_kernel || + event->attr.exclude_host || event->attr.exclude_guest) + return -EINVAL; + +- /* and we do not enable counter overflow interrupts */ + hwc->config = event->attr.config & AMD64_RAW_EVENT_MASK_NB; + hwc->idx = -1; + +@@ -314,6 +312,7 @@ static struct pmu amd_nb_pmu = { + .start = amd_uncore_start, + .stop = amd_uncore_stop, + .read = amd_uncore_read, ++ .capabilities = PERF_PMU_CAP_NO_INTERRUPT, + }; + + static struct pmu amd_llc_pmu = { +@@ -324,6 +323,7 @@ static struct pmu amd_llc_pmu = { + .start = amd_uncore_start, + .stop = amd_uncore_stop, + .read = amd_uncore_read, ++ .capabilities = PERF_PMU_CAP_NO_INTERRUPT, + }; + + static struct amd_uncore *amd_uncore_alloc(unsigned int cpu) +diff --git a/arch/x86/kernel/cpu/mcheck/mce_intel.c b/arch/x86/kernel/cpu/mcheck/mce_intel.c +index d05be307d081..1d87b85150db 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_intel.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_intel.c +@@ -489,17 +489,18 @@ static void intel_ppin_init(struct cpuinfo_x86 *c) + return; + + if ((val & 3UL) == 1UL) { +- /* PPIN available but disabled: */ ++ /* PPIN locked in disabled mode */ + return; + } + +- /* If PPIN is disabled, but not locked, try to enable: */ +- if (!(val & 3UL)) { ++ /* If PPIN is disabled, try to enable */ ++ if (!(val & 2UL)) { + wrmsrl_safe(MSR_PPIN_CTL, val | 2UL); + rdmsrl_safe(MSR_PPIN_CTL, &val); + } + +- if ((val & 3UL) == 2UL) ++ /* Is the enable bit set? */ ++ if (val & 2UL) + set_cpu_cap(c, X86_FEATURE_INTEL_PPIN); + } + } +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 70f3636aff11..4cc8a4a6f1d0 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -5062,6 +5062,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) + ctxt->fetch.ptr = ctxt->fetch.data; + ctxt->fetch.end = ctxt->fetch.data + insn_len; + ctxt->opcode_len = 1; ++ ctxt->intercept = x86_intercept_none; + if (insn_len > 0) + memcpy(ctxt->fetch.data, insn, insn_len); + else { +diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c +index 23cde3d8e8fb..0bd1899a287f 100644 +--- a/drivers/acpi/acpi_watchdog.c ++++ b/drivers/acpi/acpi_watchdog.c +@@ -58,12 +58,14 @@ static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat) + } + #endif + ++static bool acpi_no_watchdog; ++ + static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void) + { + const struct acpi_table_wdat *wdat = NULL; + acpi_status status; + +- if (acpi_disabled) ++ if (acpi_disabled || acpi_no_watchdog) + return NULL; + + status = acpi_get_table(ACPI_SIG_WDAT, 0, +@@ -91,6 +93,14 @@ bool acpi_has_watchdog(void) + } + EXPORT_SYMBOL_GPL(acpi_has_watchdog); + ++/* ACPI watchdog can be disabled on boot command line */ ++static int __init disable_acpi_watchdog(char *str) ++{ ++ acpi_no_watchdog = true; ++ return 1; ++} ++__setup("acpi_no_watchdog", disable_acpi_watchdog); ++ + void __init acpi_watchdog_init(void) + { + const struct acpi_wdat_entry *entries; +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 8767401f75e0..19d226ff15ef 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -271,10 +271,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx, + err = virtblk_add_req(vblk->vqs[qid].vq, vbr, vbr->sg, num); + if (err) { + virtqueue_kick(vblk->vqs[qid].vq); +- blk_mq_stop_hw_queue(hctx); ++ /* Don't stop the queue if -ENOMEM: we may have failed to ++ * bounce the buffer due to global resource outage. ++ */ ++ if (err == -ENOSPC) ++ blk_mq_stop_hw_queue(hctx); + spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags); +- /* Out of mem doesn't actually happen, since we fall back +- * to direct descriptors */ + if (err == -ENOMEM || err == -ENOSPC) + return BLK_STS_RESOURCE; + return BLK_STS_IOERR; +diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c +index 3e626fd9bd4e..1c65f5ac4368 100644 +--- a/drivers/firmware/efi/efivars.c ++++ b/drivers/firmware/efi/efivars.c +@@ -139,13 +139,16 @@ static ssize_t + efivar_attr_read(struct efivar_entry *entry, char *buf) + { + struct efi_variable *var = &entry->var; ++ unsigned long size = sizeof(var->Data); + char *str = buf; ++ int ret; + + if (!entry || !buf) + return -EINVAL; + +- var->DataSize = 1024; +- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data)) ++ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data); ++ var->DataSize = size; ++ if (ret) + return -EIO; + + if (var->Attributes & EFI_VARIABLE_NON_VOLATILE) +@@ -172,13 +175,16 @@ static ssize_t + efivar_size_read(struct efivar_entry *entry, char *buf) + { + struct efi_variable *var = &entry->var; ++ unsigned long size = sizeof(var->Data); + char *str = buf; ++ int ret; + + if (!entry || !buf) + return -EINVAL; + +- var->DataSize = 1024; +- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data)) ++ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data); ++ var->DataSize = size; ++ if (ret) + return -EIO; + + str += sprintf(str, "0x%lx\n", var->DataSize); +@@ -189,12 +195,15 @@ static ssize_t + efivar_data_read(struct efivar_entry *entry, char *buf) + { + struct efi_variable *var = &entry->var; ++ unsigned long size = sizeof(var->Data); ++ int ret; + + if (!entry || !buf) + return -EINVAL; + +- var->DataSize = 1024; +- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data)) ++ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data); ++ var->DataSize = size; ++ if (ret) + return -EIO; + + memcpy(buf, var->Data, var->DataSize); +@@ -263,6 +272,9 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count) + u8 *data; + int err; + ++ if (!entry || !buf) ++ return -EINVAL; ++ + if (is_compat()) { + struct compat_efi_variable *compat; + +@@ -314,14 +326,16 @@ efivar_show_raw(struct efivar_entry *entry, char *buf) + { + struct efi_variable *var = &entry->var; + struct compat_efi_variable *compat; ++ unsigned long datasize = sizeof(var->Data); + size_t size; ++ int ret; + + if (!entry || !buf) + return 0; + +- var->DataSize = 1024; +- if (efivar_entry_get(entry, &entry->var.Attributes, +- &entry->var.DataSize, entry->var.Data)) ++ ret = efivar_entry_get(entry, &var->Attributes, &datasize, var->Data); ++ var->DataSize = datasize; ++ if (ret) + return -EIO; + + if (is_compat()) { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +index 4779740421a8..2153f19e59cc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +@@ -363,8 +363,7 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device * + router.ddc_valid = false; + router.cd_valid = false; + for (j = 0; j < ((le16_to_cpu(path->usSize) - 8) / 2); j++) { +- uint8_t grph_obj_type= +- grph_obj_type = ++ uint8_t grph_obj_type = + (le16_to_cpu(path->usGraphicObjIds[j]) & + OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT; + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index d0a81a03ddbd..8ab8f2350bbc 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -343,7 +343,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, + unsigned long **bit, int *max) + { + if (usage->hid == (HID_UP_CUSTOM | 0x0003) || +- usage->hid == (HID_UP_MSVENDOR | 0x0003)) { ++ usage->hid == (HID_UP_MSVENDOR | 0x0003) || ++ usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) { + /* The fn key on Apple USB keyboards */ + set_bit(EV_REP, hi->input->evbit); + hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN); +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 10af8585c820..95052373a828 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -341,6 +341,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "Trekstor SURFBOOK E11B", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TREKSTOR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SURFBOOK E11B"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { + .ident = "Direkt-Tek DTLAPY116-2", + .matches = { +diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c +index df9800aaeac7..0d4d5dcf94f3 100644 +--- a/drivers/i2c/i2c-core-acpi.c ++++ b/drivers/i2c/i2c-core-acpi.c +@@ -352,10 +352,18 @@ static struct i2c_adapter *i2c_acpi_find_adapter_by_handle(acpi_handle handle) + static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev) + { + struct device *dev; ++ struct i2c_client *client; + + dev = bus_find_device(&i2c_bus_type, NULL, adev, + i2c_acpi_find_match_device); +- return dev ? i2c_verify_client(dev) : NULL; ++ if (!dev) ++ return NULL; ++ ++ client = i2c_verify_client(dev); ++ if (!client) ++ put_device(dev); ++ ++ return client; + } + + static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index c87764a4e212..8000b798e6e6 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -208,15 +208,15 @@ static int cookie_init_hw_msi_region(struct iommu_dma_cookie *cookie, + start -= iova_offset(iovad, start); + num_pages = iova_align(iovad, end - start) >> iova_shift(iovad); + +- msi_page = kcalloc(num_pages, sizeof(*msi_page), GFP_KERNEL); +- if (!msi_page) +- return -ENOMEM; +- + for (i = 0; i < num_pages; i++) { +- msi_page[i].phys = start; +- msi_page[i].iova = start; +- INIT_LIST_HEAD(&msi_page[i].list); +- list_add(&msi_page[i].list, &cookie->msi_page_list); ++ msi_page = kmalloc(sizeof(*msi_page), GFP_KERNEL); ++ if (!msi_page) ++ return -ENOMEM; ++ ++ msi_page->phys = start; ++ msi_page->iova = start; ++ INIT_LIST_HEAD(&msi_page->list); ++ list_add(&msi_page->list, &cookie->msi_page_list); + start += iovad->granule; + } + +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index 38d0128b8135..1f527ca60955 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -39,6 +39,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -139,6 +140,13 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned long event) + + BUG_ON(dev->is_virtfn); + ++ /* ++ * Ignore devices that have a domain number higher than what can ++ * be looked up in DMAR, e.g. VMD subdevices with domain 0x10000 ++ */ ++ if (pci_domain_nr(dev->bus) > U16_MAX) ++ return NULL; ++ + /* Only generate path[] for device addition event */ + if (event == BUS_NOTIFY_ADD_DEVICE) + for (tmp = dev; tmp; tmp = tmp->bus->self) +@@ -451,12 +459,13 @@ static int __init dmar_parse_one_andd(struct acpi_dmar_header *header, + + /* Check for NUL termination within the designated length */ + if (strnlen(andd->device_name, header->length - 8) == header->length - 8) { +- WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND, ++ pr_warn(FW_BUG + "Your BIOS is broken; ANDD object name is not NUL-terminated\n" + "BIOS vendor: %s; Ver: %s; Product Version: %s\n", + dmi_get_system_info(DMI_BIOS_VENDOR), + dmi_get_system_info(DMI_BIOS_VERSION), + dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + return -EINVAL; + } + pr_info("ANDD device: %x name: %s\n", andd->device_number, +@@ -482,14 +491,14 @@ static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg) + return 0; + } + } +- WARN_TAINT( +- 1, TAINT_FIRMWARE_WORKAROUND, ++ pr_warn(FW_BUG + "Your BIOS is broken; RHSA refers to non-existent DMAR unit at %llx\n" + "BIOS vendor: %s; Ver: %s; Product Version: %s\n", +- drhd->reg_base_addr, ++ rhsa->base_address, + dmi_get_system_info(DMI_BIOS_VENDOR), + dmi_get_system_info(DMI_BIOS_VERSION), + dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + + return 0; + } +@@ -835,14 +844,14 @@ int __init dmar_table_init(void) + + static void warn_invalid_dmar(u64 addr, const char *message) + { +- WARN_TAINT_ONCE( +- 1, TAINT_FIRMWARE_WORKAROUND, ++ pr_warn_once(FW_BUG + "Your BIOS is broken; DMAR reported at address %llx%s!\n" + "BIOS vendor: %s; Ver: %s; Product Version: %s\n", + addr, message, + dmi_get_system_info(DMI_BIOS_VENDOR), + dmi_get_system_info(DMI_BIOS_VERSION), + dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + } + + static int __ref +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index b48666849dbe..db1b546134f5 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -3984,10 +3984,11 @@ static void quirk_ioat_snb_local_iommu(struct pci_dev *pdev) + + /* we know that the this iommu should be at offset 0xa000 from vtbar */ + drhd = dmar_find_matched_drhd_unit(pdev); +- if (WARN_TAINT_ONCE(!drhd || drhd->reg_base_addr - vtbar != 0xa000, +- TAINT_FIRMWARE_WORKAROUND, +- "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n")) ++ if (!drhd || drhd->reg_base_addr - vtbar != 0xa000) { ++ pr_warn_once(FW_BUG "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n"); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + pdev->dev.archdata.iommu = DUMMY_DEVICE_DOMAIN_INFO; ++ } + } + DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_SNB, quirk_ioat_snb_local_iommu); + +@@ -5123,8 +5124,10 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain, + u64 phys = 0; + + pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level); +- if (pte) +- phys = dma_pte_addr(pte); ++ if (pte && dma_pte_present(pte)) ++ phys = dma_pte_addr(pte) + ++ (iova & (BIT_MASK(level_to_offset_bits(level) + ++ VTD_PAGE_SHIFT) - 1)); + + return phys; + } +diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c +index 755d588bbcb1..0b79ddec15b7 100644 +--- a/drivers/net/bonding/bond_alb.c ++++ b/drivers/net/bonding/bond_alb.c +@@ -71,11 +71,6 @@ struct arp_pkt { + }; + #pragma pack() + +-static inline struct arp_pkt *arp_pkt(const struct sk_buff *skb) +-{ +- return (struct arp_pkt *)skb_network_header(skb); +-} +- + /* Forward declaration */ + static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[], + bool strict_match); +@@ -574,10 +569,11 @@ static void rlb_req_update_subnet_clients(struct bonding *bond, __be32 src_ip) + spin_unlock(&bond->mode_lock); + } + +-static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bond) ++static struct slave *rlb_choose_channel(struct sk_buff *skb, ++ struct bonding *bond, ++ const struct arp_pkt *arp) + { + struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond)); +- struct arp_pkt *arp = arp_pkt(skb); + struct slave *assigned_slave, *curr_active_slave; + struct rlb_client_info *client_info; + u32 hash_index = 0; +@@ -674,8 +670,12 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon + */ + static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) + { +- struct arp_pkt *arp = arp_pkt(skb); + struct slave *tx_slave = NULL; ++ struct arp_pkt *arp; ++ ++ if (!pskb_network_may_pull(skb, sizeof(*arp))) ++ return NULL; ++ arp = (struct arp_pkt *)skb_network_header(skb); + + /* Don't modify or load balance ARPs that do not originate locally + * (e.g.,arrive via a bridge). +@@ -685,7 +685,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) + + if (arp->op_code == htons(ARPOP_REPLY)) { + /* the arp must be sent on the selected rx channel */ +- tx_slave = rlb_choose_channel(skb, bond); ++ tx_slave = rlb_choose_channel(skb, bond, arp); + if (tx_slave) + bond_hw_addr_copy(arp->mac_src, tx_slave->dev->dev_addr, + tx_slave->dev->addr_len); +@@ -696,7 +696,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) + * When the arp reply is received the entry will be updated + * with the correct unicast address of the client. + */ +- rlb_choose_channel(skb, bond); ++ rlb_choose_channel(skb, bond, arp); + + /* The ARP reply packets must be delayed so that + * they can cancel out the influence of the ARP request. +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index d92113db4fb9..05ad5ed145a3 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -867,6 +867,7 @@ static const struct nla_policy can_policy[IFLA_CAN_MAX + 1] = { + = { .len = sizeof(struct can_bittiming) }, + [IFLA_CAN_DATA_BITTIMING_CONST] + = { .len = sizeof(struct can_bittiming_const) }, ++ [IFLA_CAN_TERMINATION] = { .type = NLA_U16 }, + }; + + static int can_validate(struct nlattr *tb[], struct nlattr *data[], +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 41bc7820d2dd..5163da01e54f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -7310,13 +7310,13 @@ static int bnxt_change_mtu(struct net_device *dev, int new_mtu) + struct bnxt *bp = netdev_priv(dev); + + if (netif_running(dev)) +- bnxt_close_nic(bp, false, false); ++ bnxt_close_nic(bp, true, false); + + dev->mtu = new_mtu; + bnxt_set_ring_params(bp); + + if (netif_running(dev)) +- return bnxt_open_nic(bp, false, false); ++ return bnxt_open_nic(bp, true, false); + + return 0; + } +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 62bc19bedb06..8ba915cc4c2e 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -2478,15 +2478,15 @@ fec_enet_set_coalesce(struct net_device *ndev, struct ethtool_coalesce *ec) + return -EINVAL; + } + +- cycle = fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr); ++ cycle = fec_enet_us_to_itr_clock(ndev, ec->rx_coalesce_usecs); + if (cycle > 0xFFFF) { + pr_err("Rx coalesced usec exceed hardware limitation\n"); + return -EINVAL; + } + +- cycle = fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr); ++ cycle = fec_enet_us_to_itr_clock(ndev, ec->tx_coalesce_usecs); + if (cycle > 0xFFFF) { +- pr_err("Rx coalesced usec exceed hardware limitation\n"); ++ pr_err("Tx coalesced usec exceed hardware limitation\n"); + return -EINVAL; + } + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c +index 79b567447084..46aba02b8672 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c +@@ -312,6 +312,7 @@ static int set_hw_ioctxt(struct hinic_hwdev *hwdev, unsigned int rq_depth, + } + + hw_ioctxt.func_idx = HINIC_HWIF_FUNC_IDX(hwif); ++ hw_ioctxt.ppf_idx = HINIC_HWIF_PPF_IDX(hwif); + + hw_ioctxt.set_cmdq_depth = HW_IOCTXT_SET_CMDQ_DEPTH_DEFAULT; + hw_ioctxt.cmdq_depth = 0; +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h +index 0f5563f3b779..a011fd2d2627 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h ++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h +@@ -104,8 +104,8 @@ struct hinic_cmd_hw_ioctxt { + + u8 rsvd2; + u8 rsvd3; ++ u8 ppf_idx; + u8 rsvd4; +- u8 rsvd5; + + u16 rq_depth; + u16 rx_buf_sz_idx; +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h b/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h +index 5b4760c0e9f5..f683ccbdfca0 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h ++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h +@@ -146,6 +146,7 @@ + #define HINIC_HWIF_FUNC_IDX(hwif) ((hwif)->attr.func_idx) + #define HINIC_HWIF_PCI_INTF(hwif) ((hwif)->attr.pci_intf_idx) + #define HINIC_HWIF_PF_IDX(hwif) ((hwif)->attr.pf_idx) ++#define HINIC_HWIF_PPF_IDX(hwif) ((hwif)->attr.ppf_idx) + + #define HINIC_FUNC_TYPE(hwif) ((hwif)->attr.func_type) + #define HINIC_IS_PF(hwif) (HINIC_FUNC_TYPE(hwif) == HINIC_PF) +diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c +index 799154d7c047..c699a779757e 100644 +--- a/drivers/net/ethernet/micrel/ks8851_mll.c ++++ b/drivers/net/ethernet/micrel/ks8851_mll.c +@@ -831,14 +831,17 @@ static irqreturn_t ks_irq(int irq, void *pw) + { + struct net_device *netdev = pw; + struct ks_net *ks = netdev_priv(netdev); ++ unsigned long flags; + u16 status; + ++ spin_lock_irqsave(&ks->statelock, flags); + /*this should be the first in IRQ handler */ + ks_save_cmd_reg(ks); + + status = ks_rdreg16(ks, KS_ISR); + if (unlikely(!status)) { + ks_restore_cmd_reg(ks); ++ spin_unlock_irqrestore(&ks->statelock, flags); + return IRQ_NONE; + } + +@@ -864,6 +867,7 @@ static irqreturn_t ks_irq(int irq, void *pw) + ks->netdev->stats.rx_over_errors++; + /* this should be the last in IRQ handler*/ + ks_restore_cmd_reg(ks); ++ spin_unlock_irqrestore(&ks->statelock, flags); + return IRQ_HANDLED; + } + +@@ -933,6 +937,7 @@ static int ks_net_stop(struct net_device *netdev) + + /* shutdown RX/TX QMU */ + ks_disable_qmu(ks); ++ ks_disable_int(ks); + + /* set powermode to soft power down to save power */ + ks_set_powermode(ks, PMECR_PM_SOFTDOWN); +@@ -989,10 +994,9 @@ static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) + { + netdev_tx_t retv = NETDEV_TX_OK; + struct ks_net *ks = netdev_priv(netdev); ++ unsigned long flags; + +- disable_irq(netdev->irq); +- ks_disable_int(ks); +- spin_lock(&ks->statelock); ++ spin_lock_irqsave(&ks->statelock, flags); + + /* Extra space are required: + * 4 byte for alignment, 4 for status/length, 4 for CRC +@@ -1006,9 +1010,7 @@ static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) + dev_kfree_skb(skb); + } else + retv = NETDEV_TX_BUSY; +- spin_unlock(&ks->statelock); +- ks_enable_int(ks); +- enable_irq(netdev->irq); ++ spin_unlock_irqrestore(&ks->statelock, flags); + return retv; + } + +diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +index 7d8303e45f09..b7df8c1121e3 100644 +--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c ++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +@@ -157,6 +157,11 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev, + int err = 0; + u16 mux_id; + ++ if (!tb[IFLA_LINK]) { ++ NL_SET_ERR_MSG_MOD(extack, "link not specified"); ++ return -EINVAL; ++ } ++ + real_dev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK])); + if (!real_dev || !dev) + return -ENODEV; +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index b9cb697b2818..e0d4c1e850cf 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -505,6 +505,7 @@ efx_copy_channel(const struct efx_channel *old_channel) + if (tx_queue->channel) + tx_queue->channel = channel; + tx_queue->buffer = NULL; ++ tx_queue->cb_page = NULL; + memset(&tx_queue->txd, 0, sizeof(tx_queue->txd)); + } + +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index 71ff6bd4be9f..baf8aab59f82 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -256,6 +256,7 @@ void ipvlan_process_multicast(struct work_struct *work) + } + if (dev) + dev_put(dev); ++ cond_resched(); + } + } + +@@ -448,19 +449,21 @@ static int ipvlan_process_outbound(struct sk_buff *skb) + struct ethhdr *ethh = eth_hdr(skb); + int ret = NET_XMIT_DROP; + +- /* In this mode we dont care about multicast and broadcast traffic */ +- if (is_multicast_ether_addr(ethh->h_dest)) { +- pr_warn_ratelimited("Dropped {multi|broad}cast of type= [%x]\n", +- ntohs(skb->protocol)); +- kfree_skb(skb); +- goto out; +- } +- + /* The ipvlan is a pseudo-L2 device, so the packets that we receive + * will have L2; which need to discarded and processed further + * in the net-ns of the main-device. + */ + if (skb_mac_header_was_set(skb)) { ++ /* In this mode we dont care about ++ * multicast and broadcast traffic */ ++ if (is_multicast_ether_addr(ethh->h_dest)) { ++ pr_debug_ratelimited( ++ "Dropped {multi|broad}cast of type=[%x]\n", ++ ntohs(skb->protocol)); ++ kfree_skb(skb); ++ goto out; ++ } ++ + skb_pull(skb, sizeof(*ethh)); + skb->mac_header = (typeof(skb->mac_header))~0U; + skb_reset_network_header(skb); +diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c +index 09f6795cce53..cd32d6623f6a 100644 +--- a/drivers/net/ipvlan/ipvlan_main.c ++++ b/drivers/net/ipvlan/ipvlan_main.c +@@ -236,7 +236,6 @@ static void ipvlan_uninit(struct net_device *dev) + static int ipvlan_open(struct net_device *dev) + { + struct ipvl_dev *ipvlan = netdev_priv(dev); +- struct net_device *phy_dev = ipvlan->phy_dev; + struct ipvl_addr *addr; + + if (ipvlan->port->mode == IPVLAN_MODE_L3 || +@@ -248,7 +247,7 @@ static int ipvlan_open(struct net_device *dev) + list_for_each_entry(addr, &ipvlan->addrs, anode) + ipvlan_ht_addr_add(ipvlan, addr); + +- return dev_uc_add(phy_dev, phy_dev->dev_addr); ++ return 0; + } + + static int ipvlan_stop(struct net_device *dev) +@@ -260,8 +259,6 @@ static int ipvlan_stop(struct net_device *dev) + dev_uc_unsync(phy_dev, dev); + dev_mc_unsync(phy_dev, dev); + +- dev_uc_del(phy_dev, phy_dev->dev_addr); +- + list_for_each_entry(addr, &ipvlan->addrs, anode) + ipvlan_ht_addr_del(addr); + +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 9bb65e0af7dd..c2c3ce5653db 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -2871,6 +2871,11 @@ static void macsec_dev_set_rx_mode(struct net_device *dev) + dev_uc_sync(real_dev, dev); + } + ++static sci_t dev_to_sci(struct net_device *dev, __be16 port) ++{ ++ return make_sci(dev->dev_addr, port); ++} ++ + static int macsec_set_mac_address(struct net_device *dev, void *p) + { + struct macsec_dev *macsec = macsec_priv(dev); +@@ -2892,6 +2897,7 @@ static int macsec_set_mac_address(struct net_device *dev, void *p) + + out: + ether_addr_copy(dev->dev_addr, addr->sa_data); ++ macsec->secy.sci = dev_to_sci(dev, MACSEC_PORT_ES); + return 0; + } + +@@ -2974,6 +2980,7 @@ static const struct device_type macsec_type = { + + static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = { + [IFLA_MACSEC_SCI] = { .type = NLA_U64 }, ++ [IFLA_MACSEC_PORT] = { .type = NLA_U16 }, + [IFLA_MACSEC_ICV_LEN] = { .type = NLA_U8 }, + [IFLA_MACSEC_CIPHER_SUITE] = { .type = NLA_U64 }, + [IFLA_MACSEC_WINDOW] = { .type = NLA_U32 }, +@@ -3159,11 +3166,6 @@ static bool sci_exists(struct net_device *dev, sci_t sci) + return false; + } + +-static sci_t dev_to_sci(struct net_device *dev, __be16 port) +-{ +- return make_sci(dev->dev_addr, port); +-} +- + static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len) + { + struct macsec_dev *macsec = macsec_priv(dev); +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index ab539136d5bf..6989e84670e5 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -338,6 +338,8 @@ static void macvlan_process_broadcast(struct work_struct *w) + if (src) + dev_put(src->dev); + kfree_skb(skb); ++ ++ cond_resched(); + } + } + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 99dae55cd334..27f1f0b5b8f6 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list); + static DEFINE_MUTEX(phy_fixup_lock); + + #ifdef CONFIG_PM +-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) ++static bool mdio_bus_phy_may_suspend(struct phy_device *phydev) + { + struct device_driver *drv = phydev->mdio.dev.driver; + struct phy_driver *phydrv = to_phy_driver(drv); +@@ -88,11 +88,10 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) + /* PHY not attached? May suspend if the PHY has not already been + * suspended as part of a prior call to phy_disconnect() -> + * phy_detach() -> phy_suspend() because the parent netdev might be the +- * MDIO bus driver and clock gated at this point. Also may resume if +- * PHY is not attached. ++ * MDIO bus driver and clock gated at this point. + */ + if (!netdev) +- return suspend ? !phydev->suspended : phydev->suspended; ++ goto out; + + /* Don't suspend PHY if the attached netdev parent may wakeup. + * The parent may point to a PCI device, as in tg3 driver. +@@ -107,7 +106,8 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) + if (device_may_wakeup(&netdev->dev)) + return false; + +- return true; ++out: ++ return !phydev->suspended; + } + + static int mdio_bus_phy_suspend(struct device *dev) +@@ -122,9 +122,11 @@ static int mdio_bus_phy_suspend(struct device *dev) + if (phydev->attached_dev && phydev->adjust_link) + phy_stop_machine(phydev); + +- if (!mdio_bus_phy_may_suspend(phydev, true)) ++ if (!mdio_bus_phy_may_suspend(phydev)) + return 0; + ++ phydev->suspended_by_mdio_bus = true; ++ + return phy_suspend(phydev); + } + +@@ -133,9 +135,11 @@ static int mdio_bus_phy_resume(struct device *dev) + struct phy_device *phydev = to_phy_device(dev); + int ret; + +- if (!mdio_bus_phy_may_suspend(phydev, false)) ++ if (!phydev->suspended_by_mdio_bus) + goto no_resume; + ++ phydev->suspended_by_mdio_bus = false; ++ + ret = phy_resume(phydev); + if (ret < 0) + return ret; +diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c +index ea90db3c7705..01334aeac577 100644 +--- a/drivers/net/slip/slhc.c ++++ b/drivers/net/slip/slhc.c +@@ -232,7 +232,7 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize, + register struct cstate *cs = lcs->next; + register unsigned long deltaS, deltaA; + register short changes = 0; +- int hlen; ++ int nlen, hlen; + unsigned char new_seq[16]; + register unsigned char *cp = new_seq; + struct iphdr *ip; +@@ -248,6 +248,8 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize, + return isize; + + ip = (struct iphdr *) icp; ++ if (ip->version != 4 || ip->ihl < 5) ++ return isize; + + /* Bail if this packet isn't TCP, or is an IP fragment */ + if (ip->protocol != IPPROTO_TCP || (ntohs(ip->frag_off) & 0x3fff)) { +@@ -258,10 +260,14 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize, + comp->sls_o_tcp++; + return isize; + } +- /* Extract TCP header */ ++ nlen = ip->ihl * 4; ++ if (isize < nlen + sizeof(*th)) ++ return isize; + +- th = (struct tcphdr *)(((unsigned char *)ip) + ip->ihl*4); +- hlen = ip->ihl*4 + th->doff*4; ++ th = (struct tcphdr *)(icp + nlen); ++ if (th->doff < sizeof(struct tcphdr) / 4) ++ return isize; ++ hlen = nlen + th->doff * 4; + + /* Bail if the TCP packet isn't `compressible' (i.e., ACK isn't set or + * some other control bit is set). Also uncompressible if +diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c +index b07f367abd91..d7882b548b79 100644 +--- a/drivers/net/slip/slip.c ++++ b/drivers/net/slip/slip.c +@@ -867,7 +867,10 @@ err_free_chan: + tty->disc_data = NULL; + clear_bit(SLF_INUSE, &sl->flags); + sl_free_netdev(sl->dev); ++ /* do not call free_netdev before rtnl_unlock */ ++ rtnl_unlock(); + free_netdev(sl->dev); ++ return err; + + err_exit: + rtnl_unlock(); +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index f1aabf8a16c2..3dba58fa3433 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -2207,6 +2207,8 @@ team_nl_option_policy[TEAM_ATTR_OPTION_MAX + 1] = { + [TEAM_ATTR_OPTION_CHANGED] = { .type = NLA_FLAG }, + [TEAM_ATTR_OPTION_TYPE] = { .type = NLA_U8 }, + [TEAM_ATTR_OPTION_DATA] = { .type = NLA_BINARY }, ++ [TEAM_ATTR_OPTION_PORT_IFINDEX] = { .type = NLA_U32 }, ++ [TEAM_ATTR_OPTION_ARRAY_INDEX] = { .type = NLA_U32 }, + }; + + static int team_nl_cmd_noop(struct sk_buff *skb, struct genl_info *info) +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 189715438328..a8d5561afc7d 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -274,6 +274,9 @@ static void qmi_wwan_netdev_setup(struct net_device *net) + netdev_dbg(net, "mode: raw IP\n"); + } else if (!net->header_ops) { /* don't bother if already set */ + ether_setup(net); ++ /* Restoring min/max mtu values set originally by usbnet */ ++ net->min_mtu = 0; ++ net->max_mtu = ETH_MAX_MTU; + clear_bit(EVENT_NO_IP_ALIGN, &dev->flags); + netdev_dbg(net, "mode: Ethernet\n"); + } +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index a7f9c1886bd4..cadf5ded45a9 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2696,6 +2696,8 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired) + } + + msleep(20); ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ break; + } + + return data; +@@ -4055,7 +4057,10 @@ static void r8153_init(struct r8152 *tp) + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; ++ + msleep(20); ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ break; + } + + data = r8153_phy_status(tp, 0); +@@ -4170,7 +4175,10 @@ static void r8153b_init(struct r8152 *tp) + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; ++ + msleep(20); ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ break; + } + + data = r8153_phy_status(tp, 0); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +index 8f3032b7174d..b2e393c4fab5 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +@@ -326,7 +326,8 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm) + } + + /* PHY_SKU section is mandatory in B0 */ +- if (!mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) { ++ if (mvm->trans->cfg->nvm_type == IWL_NVM_EXT && ++ !mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) { + IWL_ERR(mvm, + "Can't parse phy_sku in B0, empty sections\n"); + return NULL; +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index c55517312485..08ea74177de2 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -2031,7 +2031,6 @@ static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev) + return PTR_ERR(pctldev->p); + } + +- kref_get(&pctldev->p->users); + pctldev->hog_default = + pinctrl_lookup_state(pctldev->p, PINCTRL_STATE_DEFAULT); + if (IS_ERR(pctldev->hog_default)) { +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 36c14b85fc7c..8db182067ecb 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -158,8 +158,8 @@ static const unsigned int sdio_d0_pins[] = { PIN(GPIOX_0, EE_OFF) }; + static const unsigned int sdio_d1_pins[] = { PIN(GPIOX_1, EE_OFF) }; + static const unsigned int sdio_d2_pins[] = { PIN(GPIOX_2, EE_OFF) }; + static const unsigned int sdio_d3_pins[] = { PIN(GPIOX_3, EE_OFF) }; +-static const unsigned int sdio_cmd_pins[] = { PIN(GPIOX_4, EE_OFF) }; +-static const unsigned int sdio_clk_pins[] = { PIN(GPIOX_5, EE_OFF) }; ++static const unsigned int sdio_clk_pins[] = { PIN(GPIOX_4, EE_OFF) }; ++static const unsigned int sdio_cmd_pins[] = { PIN(GPIOX_5, EE_OFF) }; + static const unsigned int sdio_irq_pins[] = { PIN(GPIOX_7, EE_OFF) }; + + static const unsigned int nand_ce0_pins[] = { PIN(BOOT_8, EE_OFF) }; +diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c +index bb9c1c016643..28b50ab2fbb0 100644 +--- a/drivers/scsi/libfc/fc_disc.c ++++ b/drivers/scsi/libfc/fc_disc.c +@@ -652,6 +652,8 @@ redisc: + } + out: + kref_put(&rdata->kref, fc_rport_destroy); ++ if (!IS_ERR(fp)) ++ fc_frame_free(fp); + } + + /** +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index f00a7ce3eb6e..03293e543c07 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -562,7 +562,6 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, + if (server->ops->close) + server->ops->close(xid, tcon, &fid); + cifs_del_pending_open(&open); +- fput(file); + rc = -ENOMEM; + } + +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index c850579ae5a4..6c6401084d3d 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -1255,7 +1255,7 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry, + if (!(*opened & FILE_OPENED)) + return finish_no_open(file, d); + dput(d); +- return 0; ++ return excl && (flags & O_CREAT) ? -EEXIST : 0; + } + + BUG_ON(d != NULL); +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index f2ff141a4479..a355ca418e78 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1050,8 +1050,8 @@ static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh, + /* For undo access buffer must have data copied */ + if (undo && !jh->b_committed_data) + goto out; +- if (jh->b_transaction != handle->h_transaction && +- jh->b_next_transaction != handle->h_transaction) ++ if (READ_ONCE(jh->b_transaction) != handle->h_transaction && ++ READ_ONCE(jh->b_next_transaction) != handle->h_transaction) + goto out; + /* + * There are two reasons for the barrier here: +@@ -2466,8 +2466,8 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh) + * our jh reference and thus __jbd2_journal_file_buffer() must not + * take a new one. + */ +- jh->b_transaction = jh->b_next_transaction; +- jh->b_next_transaction = NULL; ++ WRITE_ONCE(jh->b_transaction, jh->b_next_transaction); ++ WRITE_ONCE(jh->b_next_transaction, NULL); + if (buffer_freed(bh)) + jlist = BJ_Forget; + else if (jh->b_modified) +diff --git a/fs/open.c b/fs/open.c +index 29a2cdcbcb17..49fd070be0ec 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -824,9 +824,6 @@ cleanup_file: + * the return value of d_splice_alias(), then the caller needs to perform dput() + * on it after finish_open(). + * +- * On successful return @file is a fully instantiated open file. After this, if +- * an error occurs in ->atomic_open(), it needs to clean up with fput(). +- * + * Returns zero on success or -errno if the open failed. + */ + int finish_open(struct file *file, struct dentry *dentry, +diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h +index 0e21619f1c03..61ab21c34866 100644 +--- a/include/linux/cgroup.h ++++ b/include/linux/cgroup.h +@@ -61,6 +61,7 @@ struct css_task_iter { + struct list_head *mg_tasks_head; + struct list_head *dying_tasks_head; + ++ struct list_head *cur_tasks_head; + struct css_set *cur_cset; + struct css_set *cur_dcset; + struct task_struct *cur_task; +diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h +index 39faaaf843e1..c91cf2dee12a 100644 +--- a/include/linux/inet_diag.h ++++ b/include/linux/inet_diag.h +@@ -2,15 +2,10 @@ + #ifndef _INET_DIAG_H_ + #define _INET_DIAG_H_ 1 + ++#include + #include + +-struct net; +-struct sock; + struct inet_hashinfo; +-struct nlattr; +-struct nlmsghdr; +-struct sk_buff; +-struct netlink_callback; + + struct inet_diag_handler { + void (*dump)(struct sk_buff *skb, +@@ -62,6 +57,17 @@ int inet_diag_bc_sk(const struct nlattr *_bc, struct sock *sk); + + void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk); + ++static inline size_t inet_diag_msg_attrs_size(void) ++{ ++ return nla_total_size(1) /* INET_DIAG_SHUTDOWN */ ++ + nla_total_size(1) /* INET_DIAG_TOS */ ++#if IS_ENABLED(CONFIG_IPV6) ++ + nla_total_size(1) /* INET_DIAG_TCLASS */ ++ + nla_total_size(1) /* INET_DIAG_SKV6ONLY */ ++#endif ++ + nla_total_size(4) /* INET_DIAG_MARK */ ++ + nla_total_size(4); /* INET_DIAG_CLASS_ID */ ++} + int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb, + struct inet_diag_msg *r, int ext, + struct user_namespace *user_ns, bool net_admin); +diff --git a/include/linux/phy.h b/include/linux/phy.h +index efc04c2d92c9..8b6850707e62 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -372,6 +372,7 @@ struct phy_c45_device_ids { + * is_pseudo_fixed_link: Set to true if this phy is an Ethernet switch, etc. + * has_fixups: Set to true if this phy has fixups/quirks. + * suspended: Set to true if this phy has been suspended successfully. ++ * suspended_by_mdio_bus: Set to true if this phy was suspended by MDIO bus. + * sysfs_links: Internal boolean tracking sysfs symbolic links setup/removal. + * loopback_enabled: Set true if this phy has been loopbacked successfully. + * state: state of the PHY for management purposes +@@ -410,6 +411,7 @@ struct phy_device { + bool is_pseudo_fixed_link; + bool has_fixups; + bool suspended; ++ bool suspended_by_mdio_bus; + bool sysfs_links; + bool loopback_enabled; + +diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h +index 648caf90ec07..b8fd023ba625 100644 +--- a/include/net/fib_rules.h ++++ b/include/net/fib_rules.h +@@ -102,6 +102,7 @@ struct fib_rule_notifier_info { + [FRA_OIFNAME] = { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \ + [FRA_PRIORITY] = { .type = NLA_U32 }, \ + [FRA_FWMARK] = { .type = NLA_U32 }, \ ++ [FRA_TUN_ID] = { .type = NLA_U64 }, \ + [FRA_FWMASK] = { .type = NLA_U32 }, \ + [FRA_TABLE] = { .type = NLA_U32 }, \ + [FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \ +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 829943aad7be..2b3f2ea6a8a3 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -4051,12 +4051,16 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it) + } + } while (!css_set_populated(cset) && list_empty(&cset->dying_tasks)); + +- if (!list_empty(&cset->tasks)) ++ if (!list_empty(&cset->tasks)) { + it->task_pos = cset->tasks.next; +- else if (!list_empty(&cset->mg_tasks)) ++ it->cur_tasks_head = &cset->tasks; ++ } else if (!list_empty(&cset->mg_tasks)) { + it->task_pos = cset->mg_tasks.next; +- else ++ it->cur_tasks_head = &cset->mg_tasks; ++ } else { + it->task_pos = cset->dying_tasks.next; ++ it->cur_tasks_head = &cset->dying_tasks; ++ } + + it->tasks_head = &cset->tasks; + it->mg_tasks_head = &cset->mg_tasks; +@@ -4114,10 +4118,14 @@ repeat: + else + it->task_pos = it->task_pos->next; + +- if (it->task_pos == it->tasks_head) ++ if (it->task_pos == it->tasks_head) { + it->task_pos = it->mg_tasks_head->next; +- if (it->task_pos == it->mg_tasks_head) ++ it->cur_tasks_head = it->mg_tasks_head; ++ } ++ if (it->task_pos == it->mg_tasks_head) { + it->task_pos = it->dying_tasks_head->next; ++ it->cur_tasks_head = it->dying_tasks_head; ++ } + if (it->task_pos == it->dying_tasks_head) + css_task_iter_advance_css_set(it); + } else { +@@ -4136,11 +4144,12 @@ repeat: + goto repeat; + + /* and dying leaders w/o live member threads */ +- if (!atomic_read(&task->signal->live)) ++ if (it->cur_tasks_head == it->dying_tasks_head && ++ !atomic_read(&task->signal->live)) + goto repeat; + } else { + /* skip all dying ones */ +- if (task->flags & PF_EXITING) ++ if (it->cur_tasks_head == it->dying_tasks_head) + goto repeat; + } + } +@@ -4249,6 +4258,9 @@ static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos) + struct kernfs_open_file *of = s->private; + struct css_task_iter *it = of->priv; + ++ if (pos) ++ (*pos)++; ++ + return css_task_iter_next(it); + } + +@@ -4264,7 +4276,7 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, + * from position 0, so we can simply keep iterating on !0 *pos. + */ + if (!it) { +- if (WARN_ON_ONCE((*pos)++)) ++ if (WARN_ON_ONCE((*pos))) + return ERR_PTR(-EINVAL); + + it = kzalloc(sizeof(*it), GFP_KERNEL); +@@ -4272,10 +4284,11 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, + return ERR_PTR(-ENOMEM); + of->priv = it; + css_task_iter_start(&cgrp->self, iter_flags, it); +- } else if (!(*pos)++) { ++ } else if (!(*pos)) { + css_task_iter_end(it); + css_task_iter_start(&cgrp->self, iter_flags, it); +- } ++ } else ++ return it->cur_task; + + return cgroup_procs_next(s, NULL, NULL); + } +@@ -5799,6 +5812,10 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd) + return; + } + ++ /* Don't associate the sock with unrelated interrupted task's cgroup. */ ++ if (in_interrupt()) ++ return; ++ + rcu_read_lock(); + + while (true) { +diff --git a/kernel/signal.c b/kernel/signal.c +index 8fee1f2eba2f..c066168f8854 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -379,27 +379,32 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi + { + struct sigqueue *q = NULL; + struct user_struct *user; ++ int sigpending; + + /* + * Protect access to @t credentials. This can go away when all + * callers hold rcu read lock. ++ * ++ * NOTE! A pending signal will hold on to the user refcount, ++ * and we get/put the refcount only when the sigpending count ++ * changes from/to zero. + */ + rcu_read_lock(); +- user = get_uid(__task_cred(t)->user); +- atomic_inc(&user->sigpending); ++ user = __task_cred(t)->user; ++ sigpending = atomic_inc_return(&user->sigpending); ++ if (sigpending == 1) ++ get_uid(user); + rcu_read_unlock(); + +- if (override_rlimit || +- atomic_read(&user->sigpending) <= +- task_rlimit(t, RLIMIT_SIGPENDING)) { ++ if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { + q = kmem_cache_alloc(sigqueue_cachep, flags); + } else { + print_dropped_signal(sig); + } + + if (unlikely(q == NULL)) { +- atomic_dec(&user->sigpending); +- free_uid(user); ++ if (atomic_dec_and_test(&user->sigpending)) ++ free_uid(user); + } else { + INIT_LIST_HEAD(&q->list); + q->flags = 0; +@@ -413,8 +418,8 @@ static void __sigqueue_free(struct sigqueue *q) + { + if (q->flags & SIGQUEUE_PREALLOC) + return; +- atomic_dec(&q->user->sigpending); +- free_uid(q->user); ++ if (atomic_dec_and_test(&q->user->sigpending)) ++ free_uid(q->user); + kmem_cache_free(sigqueue_cachep, q); + } + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index a37f5dc7cb39..18fae55713b0 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1386,14 +1386,16 @@ static void __queue_work(int cpu, struct workqueue_struct *wq, + WARN_ON_ONCE(!is_chained_work(wq))) + return; + retry: +- if (req_cpu == WORK_CPU_UNBOUND) +- cpu = wq_select_unbound_cpu(raw_smp_processor_id()); +- + /* pwq which will be used unless @work is executing elsewhere */ +- if (!(wq->flags & WQ_UNBOUND)) +- pwq = per_cpu_ptr(wq->cpu_pwqs, cpu); +- else ++ if (wq->flags & WQ_UNBOUND) { ++ if (req_cpu == WORK_CPU_UNBOUND) ++ cpu = wq_select_unbound_cpu(raw_smp_processor_id()); + pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu)); ++ } else { ++ if (req_cpu == WORK_CPU_UNBOUND) ++ cpu = raw_smp_processor_id(); ++ pwq = per_cpu_ptr(wq->cpu_pwqs, cpu); ++ } + + /* + * If @work was previously on a different pool, it might still be +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 326525a97c47..5d6ebd1449f0 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -5867,19 +5867,9 @@ void mem_cgroup_sk_alloc(struct sock *sk) + if (!mem_cgroup_sockets_enabled) + return; + +- /* +- * Socket cloning can throw us here with sk_memcg already +- * filled. It won't however, necessarily happen from +- * process context. So the test for root memcg given +- * the current task's memcg won't help us in this case. +- * +- * Respecting the original socket's memcg is a better +- * decision in this case. +- */ +- if (sk->sk_memcg) { +- css_get(&sk->sk_memcg->css); ++ /* Do not associate the sock with unrelated interrupted task's memcg. */ ++ if (in_interrupt()) + return; +- } + + rcu_read_lock(); + memcg = mem_cgroup_from_task(current); +diff --git a/mm/slub.c b/mm/slub.c +index 07aeb129f3f8..099c7a85ede0 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -3122,6 +3122,15 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size, + void *object = c->freelist; + + if (unlikely(!object)) { ++ /* ++ * We may have removed an object from c->freelist using ++ * the fastpath in the previous iteration; in that case, ++ * c->tid has not been bumped yet. ++ * Since ___slab_alloc() may reenable interrupts while ++ * allocating memory, we should bump c->tid now. ++ */ ++ c->tid = next_tid(c->tid); ++ + /* + * Invoking slow path likely have side-effect + * of re-populating per CPU c->freelist +diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c +index 8b3f9441b3a0..7a723e124dbb 100644 +--- a/net/batman-adv/bat_iv_ogm.c ++++ b/net/batman-adv/bat_iv_ogm.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -149,7 +150,7 @@ static void batadv_iv_ogm_orig_free(struct batadv_orig_node *orig_node) + * Return: 0 on success, a negative error code otherwise. + */ + static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node, +- int max_if_num) ++ unsigned int max_if_num) + { + void *data_ptr; + size_t old_size; +@@ -193,7 +194,8 @@ unlock: + */ + static void + batadv_iv_ogm_drop_bcast_own_entry(struct batadv_orig_node *orig_node, +- int max_if_num, int del_if_num) ++ unsigned int max_if_num, ++ unsigned int del_if_num) + { + size_t chunk_size; + size_t if_offset; +@@ -231,7 +233,8 @@ batadv_iv_ogm_drop_bcast_own_entry(struct batadv_orig_node *orig_node, + */ + static void + batadv_iv_ogm_drop_bcast_own_sum_entry(struct batadv_orig_node *orig_node, +- int max_if_num, int del_if_num) ++ unsigned int max_if_num, ++ unsigned int del_if_num) + { + size_t if_offset; + void *data_ptr; +@@ -268,7 +271,8 @@ batadv_iv_ogm_drop_bcast_own_sum_entry(struct batadv_orig_node *orig_node, + * Return: 0 on success, a negative error code otherwise. + */ + static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node, +- int max_if_num, int del_if_num) ++ unsigned int max_if_num, ++ unsigned int del_if_num) + { + spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock); + +@@ -302,7 +306,8 @@ static struct batadv_orig_node * + batadv_iv_ogm_orig_get(struct batadv_priv *bat_priv, const u8 *addr) + { + struct batadv_orig_node *orig_node; +- int size, hash_added; ++ int hash_added; ++ size_t size; + + orig_node = batadv_orig_hash_find(bat_priv, addr); + if (orig_node) +@@ -366,14 +371,18 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface) + unsigned char *ogm_buff; + u32 random_seqno; + ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ + /* randomize initial seqno to avoid collision */ + get_random_bytes(&random_seqno, sizeof(random_seqno)); + atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno); + + hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN; + ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC); +- if (!ogm_buff) ++ if (!ogm_buff) { ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); + return -ENOMEM; ++ } + + hard_iface->bat_iv.ogm_buff = ogm_buff; + +@@ -385,35 +394,59 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface) + batadv_ogm_packet->reserved = 0; + batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE; + ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); ++ + return 0; + } + + static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface) + { ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ + kfree(hard_iface->bat_iv.ogm_buff); + hard_iface->bat_iv.ogm_buff = NULL; ++ ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); + } + + static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface) + { + struct batadv_ogm_packet *batadv_ogm_packet; +- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; ++ void *ogm_buff; + +- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ ++ ogm_buff = hard_iface->bat_iv.ogm_buff; ++ if (!ogm_buff) ++ goto unlock; ++ ++ batadv_ogm_packet = ogm_buff; + ether_addr_copy(batadv_ogm_packet->orig, + hard_iface->net_dev->dev_addr); + ether_addr_copy(batadv_ogm_packet->prev_sender, + hard_iface->net_dev->dev_addr); ++ ++unlock: ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); + } + + static void + batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface) + { + struct batadv_ogm_packet *batadv_ogm_packet; +- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; ++ void *ogm_buff; + +- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ ++ ogm_buff = hard_iface->bat_iv.ogm_buff; ++ if (!ogm_buff) ++ goto unlock; ++ ++ batadv_ogm_packet = ogm_buff; + batadv_ogm_packet->ttl = BATADV_TTL; ++ ++unlock: ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); + } + + /* when do we schedule our own ogm to be sent */ +@@ -890,7 +923,7 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface) + u32 i; + size_t word_index; + u8 *w; +- int if_num; ++ unsigned int if_num; + + for (i = 0; i < hash->size; i++) { + head = &hash->table[i]; +@@ -911,7 +944,11 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface) + } + } + +-static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) ++/** ++ * batadv_iv_ogm_schedule_buff() - schedule submission of hardif ogm buffer ++ * @hard_iface: interface whose ogm buffer should be transmitted ++ */ ++static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface) + { + struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface); + unsigned char **ogm_buff = &hard_iface->bat_iv.ogm_buff; +@@ -922,8 +959,10 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) + u16 tvlv_len = 0; + unsigned long send_time; + +- if ((hard_iface->if_status == BATADV_IF_NOT_IN_USE) || +- (hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)) ++ lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex); ++ ++ /* interface already disabled by batadv_iv_ogm_iface_disable */ ++ if (!*ogm_buff) + return; + + /* the interface gets activated here to avoid race conditions between +@@ -992,6 +1031,17 @@ out: + batadv_hardif_put(primary_if); + } + ++static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) ++{ ++ if (hard_iface->if_status == BATADV_IF_NOT_IN_USE || ++ hard_iface->if_status == BATADV_IF_TO_BE_REMOVED) ++ return; ++ ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ batadv_iv_ogm_schedule_buff(hard_iface); ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); ++} ++ + /** + * batadv_iv_ogm_orig_update - use OGM to update corresponding data in an + * originator +@@ -1020,7 +1070,7 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv, + struct batadv_neigh_node *tmp_neigh_node = NULL; + struct batadv_neigh_node *router = NULL; + struct batadv_orig_node *orig_node_tmp; +- int if_num; ++ unsigned int if_num; + u8 sum_orig, sum_neigh; + u8 *neigh_addr; + u8 tq_avg; +@@ -1179,7 +1229,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node, + u8 total_count; + u8 orig_eq_count, neigh_rq_count, neigh_rq_inv, tq_own; + unsigned int neigh_rq_inv_cube, neigh_rq_max_cube; +- int if_num; ++ unsigned int if_num; + unsigned int tq_asym_penalty, inv_asym_penalty; + unsigned int combined_tq; + unsigned int tq_iface_penalty; +@@ -1220,7 +1270,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node, + orig_node->last_seen = jiffies; + + /* find packet count of corresponding one hop neighbor */ +- spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock); ++ spin_lock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock); + if_num = if_incoming->if_num; + orig_eq_count = orig_neigh_node->bat_iv.bcast_own_sum[if_num]; + neigh_ifinfo = batadv_neigh_ifinfo_new(neigh_node, if_outgoing); +@@ -1230,7 +1280,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node, + } else { + neigh_rq_count = 0; + } +- spin_unlock_bh(&orig_node->bat_iv.ogm_cnt_lock); ++ spin_unlock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock); + + /* pay attention to not get a value bigger than 100 % */ + if (orig_eq_count > neigh_rq_count) +@@ -1698,9 +1748,9 @@ static void batadv_iv_ogm_process(const struct sk_buff *skb, int ogm_offset, + + if (is_my_orig) { + unsigned long *word; +- int offset; ++ size_t offset; + s32 bit_pos; +- s16 if_num; ++ unsigned int if_num; + u8 *weight; + + orig_neigh_node = batadv_iv_ogm_orig_get(bat_priv, +@@ -2477,7 +2527,7 @@ batadv_iv_ogm_neigh_is_sob(struct batadv_neigh_node *neigh1, + return ret; + } + +-static void batadv_iv_iface_activate(struct batadv_hard_iface *hard_iface) ++static void batadv_iv_iface_enabled(struct batadv_hard_iface *hard_iface) + { + /* begin scheduling originator messages on that interface */ + batadv_iv_ogm_schedule(hard_iface); +@@ -2817,8 +2867,8 @@ unlock: + static struct batadv_algo_ops batadv_batman_iv __read_mostly = { + .name = "BATMAN_IV", + .iface = { +- .activate = batadv_iv_iface_activate, + .enable = batadv_iv_ogm_iface_enable, ++ .enabled = batadv_iv_iface_enabled, + .disable = batadv_iv_ogm_iface_disable, + .update_mac = batadv_iv_ogm_iface_update_mac, + .primary_set = batadv_iv_ogm_primary_iface_set, +diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c +index 371a1f1651b4..eb8cec14b854 100644 +--- a/net/batman-adv/bat_v.c ++++ b/net/batman-adv/bat_v.c +@@ -19,7 +19,6 @@ + #include "main.h" + + #include +-#include + #include + #include + #include +@@ -623,11 +622,11 @@ static int batadv_v_neigh_cmp(struct batadv_neigh_node *neigh1, + int ret = 0; + + ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1); +- if (WARN_ON(!ifinfo1)) ++ if (!ifinfo1) + goto err_ifinfo1; + + ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2); +- if (WARN_ON(!ifinfo2)) ++ if (!ifinfo2) + goto err_ifinfo2; + + ret = ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput; +@@ -649,11 +648,11 @@ static bool batadv_v_neigh_is_sob(struct batadv_neigh_node *neigh1, + bool ret = false; + + ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1); +- if (WARN_ON(!ifinfo1)) ++ if (!ifinfo1) + goto err_ifinfo1; + + ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2); +- if (WARN_ON(!ifinfo2)) ++ if (!ifinfo2) + goto err_ifinfo2; + + threshold = ifinfo1->bat_v.throughput / 4; +@@ -815,7 +814,7 @@ static bool batadv_v_gw_is_eligible(struct batadv_priv *bat_priv, + } + + orig_gw = batadv_gw_node_get(bat_priv, orig_node); +- if (!orig_node) ++ if (!orig_gw) + goto out; + + if (batadv_v_gw_throughput_get(orig_gw, &orig_throughput) < 0) +diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c +index e07f636160b6..cec31769bb3f 100644 +--- a/net/batman-adv/bat_v_ogm.c ++++ b/net/batman-adv/bat_v_ogm.c +@@ -28,6 +28,8 @@ + #include + #include + #include ++#include ++#include + #include + #include + #include +@@ -127,14 +129,12 @@ static void batadv_v_ogm_send_to_if(struct sk_buff *skb, + } + + /** +- * batadv_v_ogm_send - periodic worker broadcasting the own OGM +- * @work: work queue item ++ * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM ++ * @bat_priv: the bat priv with all the soft interface information + */ +-static void batadv_v_ogm_send(struct work_struct *work) ++static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv) + { + struct batadv_hard_iface *hard_iface; +- struct batadv_priv_bat_v *bat_v; +- struct batadv_priv *bat_priv; + struct batadv_ogm2_packet *ogm_packet; + struct sk_buff *skb, *skb_tmp; + unsigned char *ogm_buff; +@@ -142,8 +142,7 @@ static void batadv_v_ogm_send(struct work_struct *work) + u16 tvlv_len = 0; + int ret; + +- bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); +- bat_priv = container_of(bat_v, struct batadv_priv, bat_v); ++ lockdep_assert_held(&bat_priv->bat_v.ogm_buff_mutex); + + if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING) + goto out; +@@ -234,6 +233,23 @@ out: + return; + } + ++/** ++ * batadv_v_ogm_send() - periodic worker broadcasting the own OGM ++ * @work: work queue item ++ */ ++static void batadv_v_ogm_send(struct work_struct *work) ++{ ++ struct batadv_priv_bat_v *bat_v; ++ struct batadv_priv *bat_priv; ++ ++ bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); ++ bat_priv = container_of(bat_v, struct batadv_priv, bat_v); ++ ++ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); ++ batadv_v_ogm_send_softif(bat_priv); ++ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); ++} ++ + /** + * batadv_v_ogm_iface_enable - prepare an interface for B.A.T.M.A.N. V + * @hard_iface: the interface to prepare +@@ -260,11 +276,15 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface) + struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface); + struct batadv_ogm2_packet *ogm_packet; + ++ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); + if (!bat_priv->bat_v.ogm_buff) +- return; ++ goto unlock; + + ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff; + ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr); ++ ++unlock: ++ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); + } + + /** +@@ -886,6 +906,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv) + atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno); + INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send); + ++ mutex_init(&bat_priv->bat_v.ogm_buff_mutex); ++ + return 0; + } + +@@ -897,7 +919,11 @@ void batadv_v_ogm_free(struct batadv_priv *bat_priv) + { + cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq); + ++ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); ++ + kfree(bat_priv->bat_v.ogm_buff); + bat_priv->bat_v.ogm_buff = NULL; + bat_priv->bat_v.ogm_buff_len = 0; ++ ++ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); + } +diff --git a/net/batman-adv/debugfs.c b/net/batman-adv/debugfs.c +index e32ad47c6efd..4957d4824437 100644 +--- a/net/batman-adv/debugfs.c ++++ b/net/batman-adv/debugfs.c +@@ -18,6 +18,7 @@ + #include "debugfs.h" + #include "main.h" + ++#include + #include + #include + #include +@@ -338,7 +339,26 @@ out: + } + + /** +- * batadv_debugfs_del_hardif - delete the base directory for a hard interface ++ * batadv_debugfs_rename_hardif() - Fix debugfs path for renamed hardif ++ * @hard_iface: hard interface which was renamed ++ */ ++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface) ++{ ++ const char *name = hard_iface->net_dev->name; ++ struct dentry *dir; ++ struct dentry *d; ++ ++ dir = hard_iface->debug_dir; ++ if (!dir) ++ return; ++ ++ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name); ++ if (!d) ++ pr_err("Can't rename debugfs dir to %s\n", name); ++} ++ ++/** ++ * batadv_debugfs_del_hardif() - delete the base directory for a hard interface + * in debugfs. + * @hard_iface: hard interface which is deleted. + */ +@@ -401,6 +421,30 @@ out: + return -ENOMEM; + } + ++/** ++ * batadv_debugfs_rename_meshif() - Fix debugfs path for renamed softif ++ * @dev: net_device which was renamed ++ */ ++void batadv_debugfs_rename_meshif(struct net_device *dev) ++{ ++ struct batadv_priv *bat_priv = netdev_priv(dev); ++ const char *name = dev->name; ++ struct dentry *dir; ++ struct dentry *d; ++ ++ dir = bat_priv->debug_dir; ++ if (!dir) ++ return; ++ ++ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name); ++ if (!d) ++ pr_err("Can't rename debugfs dir to %s\n", name); ++} ++ ++/** ++ * batadv_debugfs_del_meshif() - Remove interface dependent debugfs entries ++ * @dev: netdev struct of the soft interface ++ */ + void batadv_debugfs_del_meshif(struct net_device *dev) + { + struct batadv_priv *bat_priv = netdev_priv(dev); +diff --git a/net/batman-adv/debugfs.h b/net/batman-adv/debugfs.h +index 9c5d4a65b98c..901bbc357bf4 100644 +--- a/net/batman-adv/debugfs.h ++++ b/net/batman-adv/debugfs.h +@@ -29,8 +29,10 @@ struct net_device; + void batadv_debugfs_init(void); + void batadv_debugfs_destroy(void); + int batadv_debugfs_add_meshif(struct net_device *dev); ++void batadv_debugfs_rename_meshif(struct net_device *dev); + void batadv_debugfs_del_meshif(struct net_device *dev); + int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface); ++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface); + void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface); + + #else +@@ -48,6 +50,10 @@ static inline int batadv_debugfs_add_meshif(struct net_device *dev) + return 0; + } + ++static inline void batadv_debugfs_rename_meshif(struct net_device *dev) ++{ ++} ++ + static inline void batadv_debugfs_del_meshif(struct net_device *dev) + { + } +@@ -58,6 +64,11 @@ int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface) + return 0; + } + ++static inline ++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface) ++{ ++} ++ + static inline + void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface) + { +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index c6d37d22bd12..788d62073964 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -500,6 +500,8 @@ int batadv_frag_send_packet(struct sk_buff *skb, + */ + if (skb->priority >= 256 && skb->priority <= 263) + frag_header.priority = skb->priority - 256; ++ else ++ frag_header.priority = 0; + + ether_addr_copy(frag_header.orig, primary_if->net_dev->dev_addr); + ether_addr_copy(frag_header.dest, orig_node->orig); +diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c +index 2e1a084b0bd2..9fdfa9984f02 100644 +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -738,6 +739,11 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface, + hard_iface->soft_iface = soft_iface; + bat_priv = netdev_priv(hard_iface->soft_iface); + ++ if (bat_priv->num_ifaces >= UINT_MAX) { ++ ret = -ENOSPC; ++ goto err_dev; ++ } ++ + ret = netdev_master_upper_dev_link(hard_iface->net_dev, + soft_iface, NULL, NULL); + if (ret) +@@ -790,6 +796,9 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface, + + batadv_hardif_recalc_extra_skbroom(soft_iface); + ++ if (bat_priv->algo_ops->iface.enabled) ++ bat_priv->algo_ops->iface.enabled(hard_iface); ++ + out: + return 0; + +@@ -845,7 +854,7 @@ void batadv_hardif_disable_interface(struct batadv_hard_iface *hard_iface, + batadv_hardif_recalc_extra_skbroom(hard_iface->soft_iface); + + /* nobody uses this interface anymore */ +- if (!bat_priv->num_ifaces) { ++ if (bat_priv->num_ifaces == 0) { + batadv_gw_check_client_stop(bat_priv); + + if (autodel == BATADV_IF_CLEANUP_AUTO) +@@ -881,7 +890,7 @@ batadv_hardif_add_interface(struct net_device *net_dev) + if (ret) + goto free_if; + +- hard_iface->if_num = -1; ++ hard_iface->if_num = 0; + hard_iface->net_dev = net_dev; + hard_iface->soft_iface = NULL; + hard_iface->if_status = BATADV_IF_NOT_IN_USE; +@@ -893,6 +902,7 @@ batadv_hardif_add_interface(struct net_device *net_dev) + INIT_LIST_HEAD(&hard_iface->list); + INIT_HLIST_HEAD(&hard_iface->neigh_list); + ++ mutex_init(&hard_iface->bat_iv.ogm_buff_mutex); + spin_lock_init(&hard_iface->neigh_list_lock); + kref_init(&hard_iface->refcount); + +@@ -950,6 +960,32 @@ void batadv_hardif_remove_interfaces(void) + rtnl_unlock(); + } + ++/** ++ * batadv_hard_if_event_softif() - Handle events for soft interfaces ++ * @event: NETDEV_* event to handle ++ * @net_dev: net_device which generated an event ++ * ++ * Return: NOTIFY_* result ++ */ ++static int batadv_hard_if_event_softif(unsigned long event, ++ struct net_device *net_dev) ++{ ++ struct batadv_priv *bat_priv; ++ ++ switch (event) { ++ case NETDEV_REGISTER: ++ batadv_sysfs_add_meshif(net_dev); ++ bat_priv = netdev_priv(net_dev); ++ batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS); ++ break; ++ case NETDEV_CHANGENAME: ++ batadv_debugfs_rename_meshif(net_dev); ++ break; ++ } ++ ++ return NOTIFY_DONE; ++} ++ + static int batadv_hard_if_event(struct notifier_block *this, + unsigned long event, void *ptr) + { +@@ -958,12 +994,8 @@ static int batadv_hard_if_event(struct notifier_block *this, + struct batadv_hard_iface *primary_if = NULL; + struct batadv_priv *bat_priv; + +- if (batadv_softif_is_valid(net_dev) && event == NETDEV_REGISTER) { +- batadv_sysfs_add_meshif(net_dev); +- bat_priv = netdev_priv(net_dev); +- batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS); +- return NOTIFY_DONE; +- } ++ if (batadv_softif_is_valid(net_dev)) ++ return batadv_hard_if_event_softif(event, net_dev); + + hard_iface = batadv_hardif_get_by_netdev(net_dev); + if (!hard_iface && (event == NETDEV_REGISTER || +@@ -1012,6 +1044,9 @@ static int batadv_hard_if_event(struct notifier_block *this, + if (batadv_is_wifi_hardif(hard_iface)) + hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS; + break; ++ case NETDEV_CHANGENAME: ++ batadv_debugfs_rename_hardif(hard_iface); ++ break; + default: + break; + } +diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c +index 8e2a4b205257..653eaadcfefb 100644 +--- a/net/batman-adv/originator.c ++++ b/net/batman-adv/originator.c +@@ -1500,7 +1500,7 @@ int batadv_orig_dump(struct sk_buff *msg, struct netlink_callback *cb) + } + + int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface, +- int max_if_num) ++ unsigned int max_if_num) + { + struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface); + struct batadv_algo_ops *bao = bat_priv->algo_ops; +@@ -1535,7 +1535,7 @@ err: + } + + int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface, +- int max_if_num) ++ unsigned int max_if_num) + { + struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface); + struct batadv_hashtable *hash = bat_priv->orig_hash; +diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h +index d94220a6d21a..d6ca52220ec0 100644 +--- a/net/batman-adv/originator.h ++++ b/net/batman-adv/originator.h +@@ -78,9 +78,9 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset); + int batadv_orig_dump(struct sk_buff *msg, struct netlink_callback *cb); + int batadv_orig_hardif_seq_print_text(struct seq_file *seq, void *offset); + int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface, +- int max_if_num); ++ unsigned int max_if_num); + int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface, +- int max_if_num); ++ unsigned int max_if_num); + struct batadv_orig_node_vlan * + batadv_orig_node_vlan_new(struct batadv_orig_node *orig_node, + unsigned short vid); +diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c +index cd82cff716c7..f59aac06733e 100644 +--- a/net/batman-adv/routing.c ++++ b/net/batman-adv/routing.c +@@ -950,14 +950,10 @@ int batadv_recv_unicast_packet(struct sk_buff *skb, + struct batadv_orig_node *orig_node = NULL, *orig_node_gw = NULL; + int check, hdr_size = sizeof(*unicast_packet); + enum batadv_subtype subtype; +- struct ethhdr *ethhdr; + int ret = NET_RX_DROP; + bool is4addr, is_gw; + + unicast_packet = (struct batadv_unicast_packet *)skb->data; +- unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data; +- ethhdr = eth_hdr(skb); +- + is4addr = unicast_packet->packet_type == BATADV_UNICAST_4ADDR; + /* the caller function should have already pulled 2 bytes */ + if (is4addr) +@@ -977,12 +973,14 @@ int batadv_recv_unicast_packet(struct sk_buff *skb, + if (!batadv_check_unicast_ttvn(bat_priv, skb, hdr_size)) + goto free_skb; + ++ unicast_packet = (struct batadv_unicast_packet *)skb->data; ++ + /* packet for me */ + if (batadv_is_my_mac(bat_priv, unicast_packet->dest)) { + /* If this is a unicast packet from another backgone gw, + * drop it. + */ +- orig_addr_gw = ethhdr->h_source; ++ orig_addr_gw = eth_hdr(skb)->h_source; + orig_node_gw = batadv_orig_hash_find(bat_priv, orig_addr_gw); + if (orig_node_gw) { + is_gw = batadv_bla_is_backbone_gw(skb, orig_node_gw, +@@ -997,6 +995,8 @@ int batadv_recv_unicast_packet(struct sk_buff *skb, + } + + if (is4addr) { ++ unicast_4addr_packet = ++ (struct batadv_unicast_4addr_packet *)skb->data; + subtype = unicast_4addr_packet->subtype; + batadv_dat_inc_counter(bat_priv, subtype); + +diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c +index 2c2670b85fa9..dbc516824175 100644 +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -872,7 +872,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, + struct batadv_orig_node_vlan *vlan; + u8 *tt_change_ptr; + +- rcu_read_lock(); ++ spin_lock_bh(&orig_node->vlan_list_lock); + hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) { + num_vlan++; + num_entries += atomic_read(&vlan->tt.num_entries); +@@ -910,7 +910,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, + *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr; + + out: +- rcu_read_unlock(); ++ spin_unlock_bh(&orig_node->vlan_list_lock); + return tvlv_len; + } + +@@ -941,15 +941,20 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, + struct batadv_tvlv_tt_vlan_data *tt_vlan; + struct batadv_softif_vlan *vlan; + u16 num_vlan = 0; +- u16 num_entries = 0; ++ u16 vlan_entries = 0; ++ u16 total_entries = 0; + u16 tvlv_len; + u8 *tt_change_ptr; + int change_offset; + +- rcu_read_lock(); ++ spin_lock_bh(&bat_priv->softif_vlan_list_lock); + hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) { ++ vlan_entries = atomic_read(&vlan->tt.num_entries); ++ if (vlan_entries < 1) ++ continue; ++ + num_vlan++; +- num_entries += atomic_read(&vlan->tt.num_entries); ++ total_entries += vlan_entries; + } + + change_offset = sizeof(**tt_data); +@@ -957,7 +962,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, + + /* if tt_len is negative, allocate the space needed by the full table */ + if (*tt_len < 0) +- *tt_len = batadv_tt_len(num_entries); ++ *tt_len = batadv_tt_len(total_entries); + + tvlv_len = *tt_len; + tvlv_len += change_offset; +@@ -974,6 +979,10 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, + + tt_vlan = (struct batadv_tvlv_tt_vlan_data *)(*tt_data + 1); + hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) { ++ vlan_entries = atomic_read(&vlan->tt.num_entries); ++ if (vlan_entries < 1) ++ continue; ++ + tt_vlan->vid = htons(vlan->vid); + tt_vlan->crc = htonl(vlan->tt.crc); + +@@ -984,7 +993,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, + *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr; + + out: +- rcu_read_unlock(); ++ spin_unlock_bh(&bat_priv->softif_vlan_list_lock); + return tvlv_len; + } + +@@ -1544,6 +1553,8 @@ batadv_tt_global_orig_entry_find(const struct batadv_tt_global_entry *entry, + * by a given originator + * @entry: the TT global entry to check + * @orig_node: the originator to search in the list ++ * @flags: a pointer to store TT flags for the given @entry received ++ * from @orig_node + * + * find out if an orig_node is already in the list of a tt_global_entry. + * +@@ -1551,7 +1562,8 @@ batadv_tt_global_orig_entry_find(const struct batadv_tt_global_entry *entry, + */ + static bool + batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry, +- const struct batadv_orig_node *orig_node) ++ const struct batadv_orig_node *orig_node, ++ u8 *flags) + { + struct batadv_tt_orig_list_entry *orig_entry; + bool found = false; +@@ -1559,6 +1571,10 @@ batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry, + orig_entry = batadv_tt_global_orig_entry_find(entry, orig_node); + if (orig_entry) { + found = true; ++ ++ if (flags) ++ *flags = orig_entry->flags; ++ + batadv_tt_orig_list_entry_put(orig_entry); + } + +@@ -1741,7 +1757,7 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv, + if (!(common->flags & BATADV_TT_CLIENT_TEMP)) + goto out; + if (batadv_tt_global_entry_has_orig(tt_global_entry, +- orig_node)) ++ orig_node, NULL)) + goto out_remove; + batadv_tt_global_del_orig_list(tt_global_entry); + goto add_orig_entry; +@@ -2884,23 +2900,46 @@ unlock: + } + + /** +- * batadv_tt_local_valid - verify that given tt entry is a valid one ++ * batadv_tt_local_valid() - verify local tt entry and get flags + * @entry_ptr: to be checked local tt entry + * @data_ptr: not used but definition required to satisfy the callback prototype ++ * @flags: a pointer to store TT flags for this client to ++ * ++ * Checks the validity of the given local TT entry. If it is, then the provided ++ * flags pointer is updated. + * + * Return: true if the entry is a valid, false otherwise. + */ +-static bool batadv_tt_local_valid(const void *entry_ptr, const void *data_ptr) ++static bool batadv_tt_local_valid(const void *entry_ptr, ++ const void *data_ptr, ++ u8 *flags) + { + const struct batadv_tt_common_entry *tt_common_entry = entry_ptr; + + if (tt_common_entry->flags & BATADV_TT_CLIENT_NEW) + return false; ++ ++ if (flags) ++ *flags = tt_common_entry->flags; ++ + return true; + } + ++/** ++ * batadv_tt_global_valid() - verify global tt entry and get flags ++ * @entry_ptr: to be checked global tt entry ++ * @data_ptr: an orig_node object (may be NULL) ++ * @flags: a pointer to store TT flags for this client to ++ * ++ * Checks the validity of the given global TT entry. If it is, then the provided ++ * flags pointer is updated either with the common (summed) TT flags if data_ptr ++ * is NULL or the specific, per originator TT flags otherwise. ++ * ++ * Return: true if the entry is a valid, false otherwise. ++ */ + static bool batadv_tt_global_valid(const void *entry_ptr, +- const void *data_ptr) ++ const void *data_ptr, ++ u8 *flags) + { + const struct batadv_tt_common_entry *tt_common_entry = entry_ptr; + const struct batadv_tt_global_entry *tt_global_entry; +@@ -2914,7 +2953,8 @@ static bool batadv_tt_global_valid(const void *entry_ptr, + struct batadv_tt_global_entry, + common); + +- return batadv_tt_global_entry_has_orig(tt_global_entry, orig_node); ++ return batadv_tt_global_entry_has_orig(tt_global_entry, orig_node, ++ flags); + } + + /** +@@ -2924,25 +2964,34 @@ static bool batadv_tt_global_valid(const void *entry_ptr, + * @hash: hash table containing the tt entries + * @tt_len: expected tvlv tt data buffer length in number of bytes + * @tvlv_buff: pointer to the buffer to fill with the TT data +- * @valid_cb: function to filter tt change entries ++ * @valid_cb: function to filter tt change entries and to return TT flags + * @cb_data: data passed to the filter function as argument ++ * ++ * Fills the tvlv buff with the tt entries from the specified hash. If valid_cb ++ * is not provided then this becomes a no-op. + */ + static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv, + struct batadv_hashtable *hash, + void *tvlv_buff, u16 tt_len, + bool (*valid_cb)(const void *, +- const void *), ++ const void *, ++ u8 *flags), + void *cb_data) + { + struct batadv_tt_common_entry *tt_common_entry; + struct batadv_tvlv_tt_change *tt_change; + struct hlist_head *head; + u16 tt_tot, tt_num_entries = 0; ++ u8 flags; ++ bool ret; + u32 i; + + tt_tot = batadv_tt_entries(tt_len); + tt_change = (struct batadv_tvlv_tt_change *)tvlv_buff; + ++ if (!valid_cb) ++ return; ++ + rcu_read_lock(); + for (i = 0; i < hash->size; i++) { + head = &hash->table[i]; +@@ -2952,11 +3001,12 @@ static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv, + if (tt_tot == tt_num_entries) + break; + +- if ((valid_cb) && (!valid_cb(tt_common_entry, cb_data))) ++ ret = valid_cb(tt_common_entry, cb_data, &flags); ++ if (!ret) + continue; + + ether_addr_copy(tt_change->addr, tt_common_entry->addr); +- tt_change->flags = tt_common_entry->flags; ++ tt_change->flags = flags; + tt_change->vid = htons(tt_common_entry->vid); + memset(tt_change->reserved, 0, + sizeof(tt_change->reserved)); +diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h +index d5e3968619b8..540a9c5c2270 100644 +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include + #include + #include /* for linux/wait.h */ +@@ -81,11 +82,13 @@ enum batadv_dhcp_recipient { + * @ogm_buff: buffer holding the OGM packet + * @ogm_buff_len: length of the OGM packet buffer + * @ogm_seqno: OGM sequence number - used to identify each OGM ++ * @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len + */ + struct batadv_hard_iface_bat_iv { + unsigned char *ogm_buff; + int ogm_buff_len; + atomic_t ogm_seqno; ++ struct mutex ogm_buff_mutex; + }; + + /** +@@ -155,7 +158,7 @@ enum batadv_hard_iface_wifi_flags { + */ + struct batadv_hard_iface { + struct list_head list; +- s16 if_num; ++ unsigned int if_num; + char if_status; + u8 num_bcasts; + u32 wifi_flags; +@@ -989,12 +992,14 @@ struct batadv_softif_vlan { + * @ogm_buff: buffer holding the OGM packet + * @ogm_buff_len: length of the OGM packet buffer + * @ogm_seqno: OGM sequence number - used to identify each OGM ++ * @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len + * @ogm_wq: workqueue used to schedule OGM transmissions + */ + struct batadv_priv_bat_v { + unsigned char *ogm_buff; + int ogm_buff_len; + atomic_t ogm_seqno; ++ struct mutex ogm_buff_mutex; + struct delayed_work ogm_wq; + }; + +@@ -1081,7 +1086,7 @@ struct batadv_priv { + atomic_t bcast_seqno; + atomic_t bcast_queue_left; + atomic_t batman_queue_left; +- char num_ifaces; ++ unsigned int num_ifaces; + struct kobject *mesh_obj; + struct dentry *debug_dir; + struct hlist_head forw_bat_list; +@@ -1424,6 +1429,7 @@ struct batadv_forw_packet { + * @activate: start routing mechanisms when hard-interface is brought up + * (optional) + * @enable: init routing info when hard-interface is enabled ++ * @enabled: notification when hard-interface was enabled (optional) + * @disable: de-init routing info when hard-interface is disabled + * @update_mac: (re-)init mac addresses of the protocol information + * belonging to this hard-interface +@@ -1432,6 +1438,7 @@ struct batadv_forw_packet { + struct batadv_algo_iface_ops { + void (*activate)(struct batadv_hard_iface *hard_iface); + int (*enable)(struct batadv_hard_iface *hard_iface); ++ void (*enabled)(struct batadv_hard_iface *hard_iface); + void (*disable)(struct batadv_hard_iface *hard_iface); + void (*update_mac)(struct batadv_hard_iface *hard_iface); + void (*primary_set)(struct batadv_hard_iface *hard_iface); +@@ -1479,9 +1486,10 @@ struct batadv_algo_neigh_ops { + */ + struct batadv_algo_orig_ops { + void (*free)(struct batadv_orig_node *orig_node); +- int (*add_if)(struct batadv_orig_node *orig_node, int max_if_num); +- int (*del_if)(struct batadv_orig_node *orig_node, int max_if_num, +- int del_if_num); ++ int (*add_if)(struct batadv_orig_node *orig_node, ++ unsigned int max_if_num); ++ int (*del_if)(struct batadv_orig_node *orig_node, ++ unsigned int max_if_num, unsigned int del_if_num); + #ifdef CONFIG_BATMAN_ADV_DEBUGFS + void (*print)(struct batadv_priv *priv, struct seq_file *seq, + struct batadv_hard_iface *hard_iface); +diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c +index 7bf833598615..67feeb207dad 100644 +--- a/net/core/netclassid_cgroup.c ++++ b/net/core/netclassid_cgroup.c +@@ -57,30 +57,60 @@ static void cgrp_css_free(struct cgroup_subsys_state *css) + kfree(css_cls_state(css)); + } + ++/* ++ * To avoid freezing of sockets creation for tasks with big number of threads ++ * and opened sockets lets release file_lock every 1000 iterated descriptors. ++ * New sockets will already have been created with new classid. ++ */ ++ ++struct update_classid_context { ++ u32 classid; ++ unsigned int batch; ++}; ++ ++#define UPDATE_CLASSID_BATCH 1000 ++ + static int update_classid_sock(const void *v, struct file *file, unsigned n) + { + int err; ++ struct update_classid_context *ctx = (void *)v; + struct socket *sock = sock_from_file(file, &err); + + if (sock) { + spin_lock(&cgroup_sk_update_lock); +- sock_cgroup_set_classid(&sock->sk->sk_cgrp_data, +- (unsigned long)v); ++ sock_cgroup_set_classid(&sock->sk->sk_cgrp_data, ctx->classid); + spin_unlock(&cgroup_sk_update_lock); + } ++ if (--ctx->batch == 0) { ++ ctx->batch = UPDATE_CLASSID_BATCH; ++ return n + 1; ++ } + return 0; + } + ++static void update_classid_task(struct task_struct *p, u32 classid) ++{ ++ struct update_classid_context ctx = { ++ .classid = classid, ++ .batch = UPDATE_CLASSID_BATCH ++ }; ++ unsigned int fd = 0; ++ ++ do { ++ task_lock(p); ++ fd = iterate_fd(p->files, fd, update_classid_sock, &ctx); ++ task_unlock(p); ++ cond_resched(); ++ } while (fd); ++} ++ + static void cgrp_attach(struct cgroup_taskset *tset) + { + struct cgroup_subsys_state *css; + struct task_struct *p; + + cgroup_taskset_for_each(p, css, tset) { +- task_lock(p); +- iterate_fd(p->files, 0, update_classid_sock, +- (void *)(unsigned long)css_cls_state(css)->classid); +- task_unlock(p); ++ update_classid_task(p, css_cls_state(css)->classid); + } + } + +@@ -102,10 +132,7 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft, + + css_task_iter_start(css, 0, &it); + while ((p = css_task_iter_next(&it))) { +- task_lock(p); +- iterate_fd(p->files, 0, update_classid_sock, +- (void *)(unsigned long)cs->classid); +- task_unlock(p); ++ update_classid_task(p, cs->classid); + cond_resched(); + } + css_task_iter_end(&it); +diff --git a/net/core/sock.c b/net/core/sock.c +index 03ca2f638eb4..d2cb2051d045 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1684,7 +1684,10 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) + atomic_set(&newsk->sk_zckey, 0); + + sock_reset_flag(newsk, SOCK_DONE); +- mem_cgroup_sk_alloc(newsk); ++ ++ /* sk->sk_memcg will be populated at accept() time */ ++ newsk->sk_memcg = NULL; ++ + cgroup_sk_alloc(&newsk->sk_cgrp_data); + + rcu_read_lock(); +diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c +index 35c432668454..040983fc15da 100644 +--- a/net/ieee802154/nl_policy.c ++++ b/net/ieee802154/nl_policy.c +@@ -30,7 +30,13 @@ const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = { + [IEEE802154_ATTR_HW_ADDR] = { .type = NLA_HW_ADDR, }, + [IEEE802154_ATTR_PAN_ID] = { .type = NLA_U16, }, + [IEEE802154_ATTR_CHANNEL] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_BCN_ORD] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_SF_ORD] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_PAN_COORD] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_BAT_EXT] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_COORD_REALIGN] = { .type = NLA_U8, }, + [IEEE802154_ATTR_PAGE] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_DEV_TYPE] = { .type = NLA_U8, }, + [IEEE802154_ATTR_COORD_SHORT_ADDR] = { .type = NLA_U16, }, + [IEEE802154_ATTR_COORD_HW_ADDR] = { .type = NLA_HW_ADDR, }, + [IEEE802154_ATTR_COORD_PAN_ID] = { .type = NLA_U16, }, +diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c +index f0165c5f376b..1c21dc5d6dd4 100644 +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -1738,6 +1738,7 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway) + { + unsigned char optbuf[sizeof(struct ip_options) + 40]; + struct ip_options *opt = (struct ip_options *)optbuf; ++ int res; + + if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES) + return; +@@ -1749,7 +1750,11 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway) + + memset(opt, 0, sizeof(struct ip_options)); + opt->optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr); +- if (__ip_options_compile(dev_net(skb->dev), opt, skb, NULL)) ++ rcu_read_lock(); ++ res = __ip_options_compile(dev_net(skb->dev), opt, skb, NULL); ++ rcu_read_unlock(); ++ ++ if (res) + return; + + if (gateway) +diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c +index 7efe740c06eb..4a5e55e94a9e 100644 +--- a/net/ipv4/gre_demux.c ++++ b/net/ipv4/gre_demux.c +@@ -60,7 +60,9 @@ int gre_del_protocol(const struct gre_protocol *proto, u8 version) + } + EXPORT_SYMBOL_GPL(gre_del_protocol); + +-/* Fills in tpi and returns header length to be pulled. */ ++/* Fills in tpi and returns header length to be pulled. ++ * Note that caller must use pskb_may_pull() before pulling GRE header. ++ */ + int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, + bool *csum_err, __be16 proto, int nhs) + { +@@ -114,8 +116,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, + * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header + */ + if (greh->flags == 0 && tpi->proto == htons(ETH_P_WCCP)) { ++ u8 _val, *val; ++ ++ val = skb_header_pointer(skb, nhs + hdr_len, ++ sizeof(_val), &_val); ++ if (!val) ++ return -EINVAL; + tpi->proto = proto; +- if ((*(u8 *)options & 0xF0) != 0x40) ++ if ((*val & 0xF0) != 0x40) + hdr_len += 4; + } + tpi->hdr_len = hdr_len; +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index da55ce62fe50..7826fba34b14 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -475,8 +475,28 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern) + } + spin_unlock_bh(&queue->fastopenq.lock); + } ++ + out: + release_sock(sk); ++ if (newsk && mem_cgroup_sockets_enabled) { ++ int amt; ++ ++ /* atomically get the memory usage, set and charge the ++ * newsk->sk_memcg. ++ */ ++ lock_sock(newsk); ++ ++ /* The socket has not been accepted yet, no need to look at ++ * newsk->sk_wmem_queued. ++ */ ++ amt = sk_mem_pages(newsk->sk_forward_alloc + ++ atomic_read(&newsk->sk_rmem_alloc)); ++ mem_cgroup_sk_alloc(newsk); ++ if (newsk->sk_memcg && amt) ++ mem_cgroup_charge_skmem(newsk->sk_memcg, amt); ++ ++ release_sock(newsk); ++ } + if (req) + reqsk_put(req); + return newsk; +diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c +index eb158badebc4..7ba013d6c00a 100644 +--- a/net/ipv4/inet_diag.c ++++ b/net/ipv4/inet_diag.c +@@ -105,13 +105,9 @@ static size_t inet_sk_attr_size(struct sock *sk, + aux = handler->idiag_get_aux_size(sk, net_admin); + + return nla_total_size(sizeof(struct tcp_info)) +- + nla_total_size(1) /* INET_DIAG_SHUTDOWN */ +- + nla_total_size(1) /* INET_DIAG_TOS */ +- + nla_total_size(1) /* INET_DIAG_TCLASS */ +- + nla_total_size(4) /* INET_DIAG_MARK */ +- + nla_total_size(4) /* INET_DIAG_CLASS_ID */ +- + nla_total_size(sizeof(struct inet_diag_meminfo)) + + nla_total_size(sizeof(struct inet_diag_msg)) ++ + inet_diag_msg_attrs_size() ++ + nla_total_size(sizeof(struct inet_diag_meminfo)) + + nla_total_size(SK_MEMINFO_VARS * sizeof(u32)) + + nla_total_size(TCP_CA_NAME_MAX) + + nla_total_size(sizeof(struct tcpvegas_info)) +@@ -152,6 +148,24 @@ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb, + if (net_admin && nla_put_u32(skb, INET_DIAG_MARK, sk->sk_mark)) + goto errout; + ++ if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) || ++ ext & (1 << (INET_DIAG_TCLASS - 1))) { ++ u32 classid = 0; ++ ++#ifdef CONFIG_SOCK_CGROUP_DATA ++ classid = sock_cgroup_classid(&sk->sk_cgrp_data); ++#endif ++ /* Fallback to socket priority if class id isn't set. ++ * Classful qdiscs use it as direct reference to class. ++ * For cgroup2 classid is always zero. ++ */ ++ if (!classid) ++ classid = sk->sk_priority; ++ ++ if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid)) ++ goto errout; ++ } ++ + r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk)); + r->idiag_inode = sock_i_ino(sk); + +@@ -289,24 +303,6 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk, + goto errout; + } + +- if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) || +- ext & (1 << (INET_DIAG_TCLASS - 1))) { +- u32 classid = 0; +- +-#ifdef CONFIG_SOCK_CGROUP_DATA +- classid = sock_cgroup_classid(&sk->sk_cgrp_data); +-#endif +- /* Fallback to socket priority if class id isn't set. +- * Classful qdiscs use it as direct reference to class. +- * For cgroup2 classid is always zero. +- */ +- if (!classid) +- classid = sk->sk_priority; +- +- if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid)) +- goto errout; +- } +- + out: + nlmsg_end(skb, nlh); + return 0; +diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c +index 6367ecdf76c4..1d84b02ec765 100644 +--- a/net/ipv4/raw_diag.c ++++ b/net/ipv4/raw_diag.c +@@ -99,8 +99,9 @@ static int raw_diag_dump_one(struct sk_buff *in_skb, + if (IS_ERR(sk)) + return PTR_ERR(sk); + +- rep = nlmsg_new(sizeof(struct inet_diag_msg) + +- sizeof(struct inet_diag_meminfo) + 64, ++ rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) + ++ inet_diag_msg_attrs_size() + ++ nla_total_size(sizeof(struct inet_diag_meminfo)) + 64, + GFP_KERNEL); + if (!rep) { + sock_put(sk); +diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c +index d9ad986c7b2c..cc3f6da306c6 100644 +--- a/net/ipv4/udp_diag.c ++++ b/net/ipv4/udp_diag.c +@@ -67,8 +67,9 @@ static int udp_dump_one(struct udp_table *tbl, struct sk_buff *in_skb, + goto out; + + err = -ENOMEM; +- rep = nlmsg_new(sizeof(struct inet_diag_msg) + +- sizeof(struct inet_diag_meminfo) + 64, ++ rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) + ++ inet_diag_msg_attrs_size() + ++ nla_total_size(sizeof(struct inet_diag_meminfo)) + 64, + GFP_KERNEL); + if (!rep) + goto out; +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index a81201dd3a1a..092e72d6a61d 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3223,6 +3223,10 @@ static void addrconf_dev_config(struct net_device *dev) + (dev->type != ARPHRD_TUNNEL) && + (dev->type != ARPHRD_NONE)) { + /* Alas, we support only Ethernet autoconfiguration. */ ++ idev = __in6_dev_get(dev); ++ if (!IS_ERR_OR_NULL(idev) && dev->flags & IFF_UP && ++ dev->flags & IFF_MULTICAST) ++ ipv6_mc_up(idev); + return; + } + +diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c +index 5c91b05c8d8f..8c492471b0da 100644 +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -185,9 +185,15 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + retv = -EBUSY; + break; + } +- } else if (sk->sk_protocol != IPPROTO_TCP) ++ } else if (sk->sk_protocol == IPPROTO_TCP) { ++ if (sk->sk_prot != &tcpv6_prot) { ++ retv = -EBUSY; ++ break; ++ } + break; +- ++ } else { ++ break; ++ } + if (sk->sk_state != TCP_ESTABLISHED) { + retv = -ENOTCONN; + break; +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 31000622376d..7c92b1471c34 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3862,7 +3862,7 @@ void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) + + lockdep_assert_held(&local->sta_mtx); + +- list_for_each_entry_rcu(sta, &local->sta_list, list) { ++ list_for_each_entry(sta, &local->sta_list, list) { + if (sdata != sta->sdata && + (!sta->sdata->bss || sta->sdata->bss != sdata->bss)) + continue; +diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c +index d33ce6d5ebce..dd1030f5dd5e 100644 +--- a/net/netfilter/nfnetlink_cthelper.c ++++ b/net/netfilter/nfnetlink_cthelper.c +@@ -733,6 +733,8 @@ static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = { + [NFCTH_NAME] = { .type = NLA_NUL_STRING, + .len = NF_CT_HELPER_NAME_LEN-1 }, + [NFCTH_QUEUE_NUM] = { .type = NLA_U32, }, ++ [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, }, ++ [NFCTH_STATUS] = { .type = NLA_U32, }, + }; + + static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = { +diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c +index e110b0ebbf58..19446a89a2a8 100644 +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -121,6 +121,7 @@ static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = { + [NFTA_PAYLOAD_LEN] = { .type = NLA_U32 }, + [NFTA_PAYLOAD_CSUM_TYPE] = { .type = NLA_U32 }, + [NFTA_PAYLOAD_CSUM_OFFSET] = { .type = NLA_U32 }, ++ [NFTA_PAYLOAD_CSUM_FLAGS] = { .type = NLA_U32 }, + }; + + static int nft_payload_init(const struct nft_ctx *ctx, +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 07924559cb10..3e4e07559272 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -2389,7 +2389,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err, + in_skb->len)) + WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS, + (u8 *)extack->bad_attr - +- in_skb->data)); ++ (u8 *)nlh)); + } else { + if (extack->cookie_len) + WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE, +diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c +index 6bf14f4f4b42..ae315dbd3732 100644 +--- a/net/nfc/hci/core.c ++++ b/net/nfc/hci/core.c +@@ -193,13 +193,20 @@ exit: + void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, + struct sk_buff *skb) + { +- u8 gate = hdev->pipes[pipe].gate; + u8 status = NFC_HCI_ANY_OK; + struct hci_create_pipe_resp *create_info; + struct hci_delete_pipe_noti *delete_info; + struct hci_all_pipe_cleared_noti *cleared_info; ++ u8 gate; + +- pr_debug("from gate %x pipe %x cmd %x\n", gate, pipe, cmd); ++ pr_debug("from pipe %x cmd %x\n", pipe, cmd); ++ ++ if (pipe >= NFC_HCI_MAX_PIPES) { ++ status = NFC_HCI_ANY_E_NOK; ++ goto exit; ++ } ++ ++ gate = hdev->pipes[pipe].gate; + + switch (cmd) { + case NFC_HCI_ADM_NOTIFY_PIPE_CREATED: +@@ -387,8 +394,14 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event, + struct sk_buff *skb) + { + int r = 0; +- u8 gate = hdev->pipes[pipe].gate; ++ u8 gate; ++ ++ if (pipe >= NFC_HCI_MAX_PIPES) { ++ pr_err("Discarded event %x to invalid pipe %x\n", event, pipe); ++ goto exit; ++ } + ++ gate = hdev->pipes[pipe].gate; + if (gate == NFC_HCI_INVALID_GATE) { + pr_err("Discarded event %x to unopened pipe %x\n", event, pipe); + goto exit; +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c +index 7b8d4d235a3a..6199f4334fbd 100644 +--- a/net/nfc/netlink.c ++++ b/net/nfc/netlink.c +@@ -55,7 +55,10 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = { + [NFC_ATTR_LLC_SDP] = { .type = NLA_NESTED }, + [NFC_ATTR_FIRMWARE_NAME] = { .type = NLA_STRING, + .len = NFC_FIRMWARE_NAME_MAXSIZE }, ++ [NFC_ATTR_SE_INDEX] = { .type = NLA_U32 }, + [NFC_ATTR_SE_APDU] = { .type = NLA_BINARY }, ++ [NFC_ATTR_VENDOR_ID] = { .type = NLA_U32 }, ++ [NFC_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, + [NFC_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, + + }; +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 46b7fac82775..387589a4a340 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2299,6 +2299,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + TP_STATUS_KERNEL, (macoff+snaplen)); + if (!h.raw) + goto drop_n_account; ++ ++ if (do_vnet && ++ virtio_net_hdr_from_skb(skb, h.raw + macoff - ++ sizeof(struct virtio_net_hdr), ++ vio_le(), true, 0)) ++ goto drop_n_account; ++ + if (po->tp_version <= TPACKET_V2) { + packet_increment_rx_head(po, &po->rx_ring); + /* +@@ -2311,12 +2318,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + status |= TP_STATUS_LOSING; + } + +- if (do_vnet && +- virtio_net_hdr_from_skb(skb, h.raw + macoff - +- sizeof(struct virtio_net_hdr), +- vio_le(), true, 0)) +- goto drop_n_account; +- + po->stats.stats1.tp_packets++; + if (copy_skb) { + status |= TP_STATUS_COPY; +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 7a944f508cae..66f1d40b910a 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -695,6 +695,7 @@ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = { + [TCA_FQ_FLOW_MAX_RATE] = { .type = NLA_U32 }, + [TCA_FQ_BUCKETS_LOG] = { .type = NLA_U32 }, + [TCA_FQ_FLOW_REFILL_DELAY] = { .type = NLA_U32 }, ++ [TCA_FQ_ORPHAN_MASK] = { .type = NLA_U32 }, + [TCA_FQ_LOW_RATE_THRESHOLD] = { .type = NLA_U32 }, + }; + +diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c +index 75274a60b77a..6a5a3dfa6c8d 100644 +--- a/net/sctp/sctp_diag.c ++++ b/net/sctp/sctp_diag.c +@@ -221,15 +221,11 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc) + addrcnt++; + + return nla_total_size(sizeof(struct sctp_info)) +- + nla_total_size(1) /* INET_DIAG_SHUTDOWN */ +- + nla_total_size(1) /* INET_DIAG_TOS */ +- + nla_total_size(1) /* INET_DIAG_TCLASS */ +- + nla_total_size(4) /* INET_DIAG_MARK */ +- + nla_total_size(4) /* INET_DIAG_CLASS_ID */ + + nla_total_size(addrlen * asoc->peer.transport_count) + + nla_total_size(addrlen * addrcnt) +- + nla_total_size(sizeof(struct inet_diag_meminfo)) + + nla_total_size(sizeof(struct inet_diag_msg)) ++ + inet_diag_msg_attrs_size() ++ + nla_total_size(sizeof(struct inet_diag_meminfo)) + + 64; + } + +diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c +index 4410d0071515..7d89b0584944 100644 +--- a/net/smc/smc_ib.c ++++ b/net/smc/smc_ib.c +@@ -513,6 +513,8 @@ static void smc_ib_remove_dev(struct ib_device *ibdev, void *client_data) + struct smc_ib_device *smcibdev; + + smcibdev = ib_get_client_data(ibdev, &smc_ib_client); ++ if (!smcibdev || smcibdev->ibdev != ibdev) ++ return; + ib_set_client_data(ibdev, &smc_ib_client, NULL); + spin_lock(&smc_ib_devices.lock); + list_del_init(&smcibdev->list); /* remove from smc_ib_devices */ +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index b248578aeb7b..d0b75781e6f7 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -347,6 +347,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { + [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, + [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, + [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 }, ++ [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, ++ [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, + [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, + [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, + [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, +@@ -395,6 +397,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { + [NL80211_ATTR_MDID] = { .type = NLA_U16 }, + [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, + .len = IEEE80211_MAX_DATA_LEN }, ++ [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, ++ [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = { .type = NLA_U16 }, + [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 }, + [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, + [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, +@@ -420,6 +424,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { + [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 }, + [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, + [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, ++ [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, + [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN }, + [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, + [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index a520f433d476..b95d1c2bdef7 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -1733,7 +1733,7 @@ static void handle_channel_custom(struct wiphy *wiphy, + break; + } + +- if (IS_ERR(reg_rule)) { ++ if (IS_ERR_OR_NULL(reg_rule)) { + pr_debug("Disabling freq %d MHz as custom regd has no rule that fits it\n", + chan->center_freq); + if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) { +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index 0c8b61f8398e..3bdd6a463819 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -1345,7 +1345,7 @@ sub reboot { + + } else { + # Make sure everything has been written to disk +- run_ssh("sync"); ++ run_ssh("sync", 10); + + if (defined($time)) { + start_monitor;