diff --git a/patch/kernel/archive/sunxi-5.11/patch-5.11.6-7.patch b/patch/kernel/archive/sunxi-5.11/patch-5.11.6-7.patch deleted file mode 100644 index 9967a2217f..0000000000 --- a/patch/kernel/archive/sunxi-5.11/patch-5.11.6-7.patch +++ /dev/null @@ -1,11819 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-devices-memory b/Documentation/ABI/testing/sysfs-devices-memory -index 246a45b96d22a..58dbc592bc57d 100644 ---- a/Documentation/ABI/testing/sysfs-devices-memory -+++ b/Documentation/ABI/testing/sysfs-devices-memory -@@ -26,8 +26,9 @@ Date: September 2008 - Contact: Badari Pulavarty - Description: - The file /sys/devices/system/memory/memoryX/phys_device -- is read-only and is designed to show the name of physical -- memory device. Implementation is currently incomplete. -+ is read-only; it is a legacy interface only ever used on s390x -+ to expose the covered storage increment. -+Users: Legacy s390-tools lsmem/chmem - - What: /sys/devices/system/memory/memoryX/phys_index - Date: September 2008 -diff --git a/Documentation/admin-guide/mm/memory-hotplug.rst b/Documentation/admin-guide/mm/memory-hotplug.rst -index 5c4432c96c4b6..245739f55ac7d 100644 ---- a/Documentation/admin-guide/mm/memory-hotplug.rst -+++ b/Documentation/admin-guide/mm/memory-hotplug.rst -@@ -160,8 +160,8 @@ Under each memory block, you can see 5 files: - - "online_movable", "online", "offline" command - which will be performed on all sections in the block. --``phys_device`` read-only: designed to show the name of physical memory -- device. This is not well implemented now. -+``phys_device`` read-only: legacy interface only ever used on s390x to -+ expose the covered storage increment. - ``removable`` read-only: contains an integer value indicating - whether the memory block is removable or not - removable. A value of 1 indicates that the memory -diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst -index 009d8e6c7e3c3..1cb7b9f9356e7 100644 ---- a/Documentation/gpu/todo.rst -+++ b/Documentation/gpu/todo.rst -@@ -594,6 +594,27 @@ Some of these date from the very introduction of KMS in 2008 ... - - Level: Intermediate - -+Remove automatic page mapping from dma-buf importing -+---------------------------------------------------- -+ -+When importing dma-bufs, the dma-buf and PRIME frameworks automatically map -+imported pages into the importer's DMA area. drm_gem_prime_fd_to_handle() and -+drm_gem_prime_handle_to_fd() require that importers call dma_buf_attach() -+even if they never do actual device DMA, but only CPU access through -+dma_buf_vmap(). This is a problem for USB devices, which do not support DMA -+operations. -+ -+To fix the issue, automatic page mappings should be removed from the -+buffer-sharing code. Fixing this is a bit more involved, since the import/export -+cache is also tied to &drm_gem_object.import_attach. Meanwhile we paper over -+this problem for USB devices by fishing out the USB host controller device, as -+long as that supports DMA. Otherwise importing can still needlessly fail. -+ -+Contact: Thomas Zimmermann , Daniel Vetter -+ -+Level: Advanced -+ -+ - Better Testing - ============== - -diff --git a/Documentation/networking/netdev-FAQ.rst b/Documentation/networking/netdev-FAQ.rst -index ae2ae37cd9216..a1a3fc7b2a4ee 100644 ---- a/Documentation/networking/netdev-FAQ.rst -+++ b/Documentation/networking/netdev-FAQ.rst -@@ -142,73 +142,13 @@ Please send incremental versions on top of what has been merged in order to fix - the patches the way they would look like if your latest patch series was to be - merged. - --How can I tell what patches are queued up for backporting to the various stable releases? ------------------------------------------------------------------------------------------- --Normally Greg Kroah-Hartman collects stable commits himself, but for --networking, Dave collects up patches he deems critical for the --networking subsystem, and then hands them off to Greg. -- --There is a patchworks queue that you can see here: -- -- https://patchwork.kernel.org/bundle/netdev/stable/?state=* -- --It contains the patches which Dave has selected, but not yet handed off --to Greg. If Greg already has the patch, then it will be here: -- -- https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git -- --A quick way to find whether the patch is in this stable-queue is to --simply clone the repo, and then git grep the mainline commit ID, e.g. --:: -- -- stable-queue$ git grep -l 284041ef21fdf2e -- releases/3.0.84/ipv6-fix-possible-crashes-in-ip6_cork_release.patch -- releases/3.4.51/ipv6-fix-possible-crashes-in-ip6_cork_release.patch -- releases/3.9.8/ipv6-fix-possible-crashes-in-ip6_cork_release.patch -- stable/stable-queue$ -- --I see a network patch and I think it should be backported to stable. Should I request it via stable@vger.kernel.org like the references in the kernel's Documentation/process/stable-kernel-rules.rst file say? ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --No, not for networking. Check the stable queues as per above first --to see if it is already queued. If not, then send a mail to netdev, --listing the upstream commit ID and why you think it should be a stable --candidate. -- --Before you jump to go do the above, do note that the normal stable rules --in :ref:`Documentation/process/stable-kernel-rules.rst ` --still apply. So you need to explicitly indicate why it is a critical --fix and exactly what users are impacted. In addition, you need to --convince yourself that you *really* think it has been overlooked, --vs. having been considered and rejected. -- --Generally speaking, the longer it has had a chance to "soak" in --mainline, the better the odds that it is an OK candidate for stable. So --scrambling to request a commit be added the day after it appears should --be avoided. -- --I have created a network patch and I think it should be backported to stable. Should I add a Cc: stable@vger.kernel.org like the references in the kernel's Documentation/ directory say? ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --No. See above answer. In short, if you think it really belongs in --stable, then ensure you write a decent commit log that describes who --gets impacted by the bug fix and how it manifests itself, and when the --bug was introduced. If you do that properly, then the commit will get --handled appropriately and most likely get put in the patchworks stable --queue if it really warrants it. -- --If you think there is some valid information relating to it being in --stable that does *not* belong in the commit log, then use the three dash --marker line as described in --:ref:`Documentation/process/submitting-patches.rst ` --to temporarily embed that information into the patch that you send. -- --Are all networking bug fixes backported to all stable releases? -+Are there special rules regarding stable submissions on netdev? - --------------------------------------------------------------- --Due to capacity, Dave could only take care of the backports for the --last two stable releases. For earlier stable releases, each stable --branch maintainer is supposed to take care of them. If you find any --patch is missing from an earlier stable branch, please notify --stable@vger.kernel.org with either a commit ID or a formal patch --backported, and CC Dave and other relevant networking developers. -+While it used to be the case that netdev submissions were not supposed -+to carry explicit ``CC: stable@vger.kernel.org`` tags that is no longer -+the case today. Please follow the standard stable rules in -+:ref:`Documentation/process/stable-kernel-rules.rst `, -+and make sure you include appropriate Fixes tags! - - Is the comment style convention different for the networking content? - --------------------------------------------------------------------- -diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst -index 3973556250e17..003c865e9c212 100644 ---- a/Documentation/process/stable-kernel-rules.rst -+++ b/Documentation/process/stable-kernel-rules.rst -@@ -35,12 +35,6 @@ Rules on what kind of patches are accepted, and which ones are not, into the - Procedure for submitting patches to the -stable tree - ---------------------------------------------------- - -- - If the patch covers files in net/ or drivers/net please follow netdev stable -- submission guidelines as described in -- :ref:`Documentation/networking/netdev-FAQ.rst ` -- after first checking the stable networking queue at -- https://patchwork.kernel.org/bundle/netdev/stable/?state=* -- to ensure the requested patch is not already queued up. - - Security patches should not be handled (solely) by the -stable review - process but should follow the procedures in - :ref:`Documentation/admin-guide/security-bugs.rst `. -diff --git a/Documentation/process/submitting-patches.rst b/Documentation/process/submitting-patches.rst -index 5ba54120bef7e..5a1b1ea3aed05 100644 ---- a/Documentation/process/submitting-patches.rst -+++ b/Documentation/process/submitting-patches.rst -@@ -250,11 +250,6 @@ should also read - :ref:`Documentation/process/stable-kernel-rules.rst ` - in addition to this file. - --Note, however, that some subsystem maintainers want to come to their own --conclusions on which patches should go to the stable trees. The networking --maintainer, in particular, would rather not see individual developers --adding lines like the above to their patches. -- - If changes affect userland-kernel interfaces, please send the MAN-PAGES - maintainer (as listed in the MAINTAINERS file) a man-pages patch, or at - least a notification of the change, so that some information makes its way -diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst -index 99ceb978c8b08..5570887a2dce2 100644 ---- a/Documentation/virt/kvm/api.rst -+++ b/Documentation/virt/kvm/api.rst -@@ -182,6 +182,9 @@ is dependent on the CPU capability and the kernel configuration. The limit can - be retrieved using KVM_CAP_ARM_VM_IPA_SIZE of the KVM_CHECK_EXTENSION - ioctl() at run-time. - -+Creation of the VM will fail if the requested IPA size (whether it is -+implicit or explicit) is unsupported on the host. -+ - Please note that configuring the IPA size does not affect the capability - exposed by the guest CPUs in ID_AA64MMFR0_EL1[PARange]. It only affects - size of the address translated by the stage2 level (guest physical to -diff --git a/Makefile b/Makefile -index 472136a7881e6..6ba32b82c4802 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 11 --SUBLEVEL = 6 -+SUBLEVEL = 7 - EXTRAVERSION = - NAME = 💕 Valentine's Day Edition 💕 - -@@ -1246,9 +1246,15 @@ define filechk_utsrelease.h - endef - - define filechk_version.h -- echo \#define LINUX_VERSION_CODE $(shell \ -- expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 0$(SUBLEVEL)); \ -- echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))' -+ if [ $(SUBLEVEL) -gt 255 ]; then \ -+ echo \#define LINUX_VERSION_CODE $(shell \ -+ expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 255); \ -+ else \ -+ echo \#define LINUX_VERSION_CODE $(shell \ -+ expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + $(SUBLEVEL)); \ -+ fi; \ -+ echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + \ -+ ((c) > 255 ? 255 : (c)))' - endef - - $(version_h): FORCE -diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h -index 8a33d83ea843a..3398477c891d5 100644 ---- a/arch/arm64/include/asm/kvm_asm.h -+++ b/arch/arm64/include/asm/kvm_asm.h -@@ -47,7 +47,7 @@ - #define __KVM_HOST_SMCCC_FUNC___kvm_flush_vm_context 2 - #define __KVM_HOST_SMCCC_FUNC___kvm_tlb_flush_vmid_ipa 3 - #define __KVM_HOST_SMCCC_FUNC___kvm_tlb_flush_vmid 4 --#define __KVM_HOST_SMCCC_FUNC___kvm_tlb_flush_local_vmid 5 -+#define __KVM_HOST_SMCCC_FUNC___kvm_flush_cpu_context 5 - #define __KVM_HOST_SMCCC_FUNC___kvm_timer_set_cntvoff 6 - #define __KVM_HOST_SMCCC_FUNC___kvm_enable_ssbs 7 - #define __KVM_HOST_SMCCC_FUNC___vgic_v3_get_ich_vtr_el2 8 -@@ -183,10 +183,10 @@ DECLARE_KVM_HYP_SYM(__bp_harden_hyp_vecs); - #define __bp_harden_hyp_vecs CHOOSE_HYP_SYM(__bp_harden_hyp_vecs) - - extern void __kvm_flush_vm_context(void); -+extern void __kvm_flush_cpu_context(struct kvm_s2_mmu *mmu); - extern void __kvm_tlb_flush_vmid_ipa(struct kvm_s2_mmu *mmu, phys_addr_t ipa, - int level); - extern void __kvm_tlb_flush_vmid(struct kvm_s2_mmu *mmu); --extern void __kvm_tlb_flush_local_vmid(struct kvm_s2_mmu *mmu); - - extern void __kvm_timer_set_cntvoff(u64 cntvoff); - -diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h -index c0450828378b5..32ae676236b6b 100644 ---- a/arch/arm64/include/asm/kvm_hyp.h -+++ b/arch/arm64/include/asm/kvm_hyp.h -@@ -83,6 +83,11 @@ void sysreg_restore_guest_state_vhe(struct kvm_cpu_context *ctxt); - void __debug_switch_to_guest(struct kvm_vcpu *vcpu); - void __debug_switch_to_host(struct kvm_vcpu *vcpu); - -+#ifdef __KVM_NVHE_HYPERVISOR__ -+void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu); -+void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu); -+#endif -+ - void __fpsimd_save_state(struct user_fpsimd_state *fp_regs); - void __fpsimd_restore_state(struct user_fpsimd_state *fp_regs); - -@@ -97,7 +102,8 @@ bool kvm_host_psci_handler(struct kvm_cpu_context *host_ctxt); - - void __noreturn hyp_panic(void); - #ifdef __KVM_NVHE_HYPERVISOR__ --void __noreturn __hyp_do_panic(bool restore_host, u64 spsr, u64 elr, u64 par); -+void __noreturn __hyp_do_panic(struct kvm_cpu_context *host_ctxt, u64 spsr, -+ u64 elr, u64 par); - #endif - - #endif /* __ARM64_KVM_HYP_H__ */ -diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h -index ff4732785c32f..63b6ef2cfb52c 100644 ---- a/arch/arm64/include/asm/memory.h -+++ b/arch/arm64/include/asm/memory.h -@@ -315,6 +315,11 @@ static inline void *phys_to_virt(phys_addr_t x) - #define ARCH_PFN_OFFSET ((unsigned long)PHYS_PFN_OFFSET) - - #if !defined(CONFIG_SPARSEMEM_VMEMMAP) || defined(CONFIG_DEBUG_VIRTUAL) -+#define page_to_virt(x) ({ \ -+ __typeof__(x) __page = x; \ -+ void *__addr = __va(page_to_phys(__page)); \ -+ (void *)__tag_set((const void *)__addr, page_kasan_tag(__page));\ -+}) - #define virt_to_page(x) pfn_to_page(virt_to_pfn(x)) - #else - #define page_to_virt(x) ({ \ -diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h -index 0b3079fd28ebe..1c364ec0ad318 100644 ---- a/arch/arm64/include/asm/mmu_context.h -+++ b/arch/arm64/include/asm/mmu_context.h -@@ -65,10 +65,7 @@ extern u64 idmap_ptrs_per_pgd; - - static inline bool __cpu_uses_extended_idmap(void) - { -- if (IS_ENABLED(CONFIG_ARM64_VA_BITS_52)) -- return false; -- -- return unlikely(idmap_t0sz != TCR_T0SZ(VA_BITS)); -+ return unlikely(idmap_t0sz != TCR_T0SZ(vabits_actual)); - } - - /* -diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h -index 046be789fbb47..9a65fb5281100 100644 ---- a/arch/arm64/include/asm/pgtable-prot.h -+++ b/arch/arm64/include/asm/pgtable-prot.h -@@ -66,7 +66,6 @@ extern bool arm64_use_ng_mappings; - #define _PAGE_DEFAULT (_PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL)) - - #define PAGE_KERNEL __pgprot(PROT_NORMAL) --#define PAGE_KERNEL_TAGGED __pgprot(PROT_NORMAL_TAGGED) - #define PAGE_KERNEL_RO __pgprot((PROT_NORMAL & ~PTE_WRITE) | PTE_RDONLY) - #define PAGE_KERNEL_ROX __pgprot((PROT_NORMAL & ~(PTE_WRITE | PTE_PXN)) | PTE_RDONLY) - #define PAGE_KERNEL_EXEC __pgprot(PROT_NORMAL & ~PTE_PXN) -diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index 501562793ce26..a5215d16a0f48 100644 ---- a/arch/arm64/include/asm/pgtable.h -+++ b/arch/arm64/include/asm/pgtable.h -@@ -486,6 +486,9 @@ static inline pmd_t pmd_mkdevmap(pmd_t pmd) - __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN) - #define pgprot_device(prot) \ - __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRE) | PTE_PXN | PTE_UXN) -+#define pgprot_tagged(prot) \ -+ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_TAGGED)) -+#define pgprot_mhp pgprot_tagged - /* - * DMA allocations for non-coherent devices use what the Arm architecture calls - * "Normal non-cacheable" memory, which permits speculation, unaligned accesses -diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index 7ec430e18f95e..a0b3bfe676096 100644 ---- a/arch/arm64/kernel/head.S -+++ b/arch/arm64/kernel/head.S -@@ -319,7 +319,7 @@ SYM_FUNC_START_LOCAL(__create_page_tables) - */ - adrp x5, __idmap_text_end - clz x5, x5 -- cmp x5, TCR_T0SZ(VA_BITS) // default T0SZ small enough? -+ cmp x5, TCR_T0SZ(VA_BITS_MIN) // default T0SZ small enough? - b.ge 1f // .. then skip VA range extension - - adr_l x6, idmap_t0sz -diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c -index 3605f77ad4df1..11852e05ee32a 100644 ---- a/arch/arm64/kernel/perf_event.c -+++ b/arch/arm64/kernel/perf_event.c -@@ -460,7 +460,7 @@ static inline int armv8pmu_counter_has_overflowed(u32 pmnc, int idx) - return pmnc & BIT(ARMV8_IDX_TO_COUNTER(idx)); - } - --static inline u32 armv8pmu_read_evcntr(int idx) -+static inline u64 armv8pmu_read_evcntr(int idx) - { - u32 counter = ARMV8_IDX_TO_COUNTER(idx); - -diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c -index fe60d25c000e4..b25b4c19feebc 100644 ---- a/arch/arm64/kvm/arm.c -+++ b/arch/arm64/kvm/arm.c -@@ -385,11 +385,16 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu) - last_ran = this_cpu_ptr(mmu->last_vcpu_ran); - - /* -+ * We guarantee that both TLBs and I-cache are private to each -+ * vcpu. If detecting that a vcpu from the same VM has -+ * previously run on the same physical CPU, call into the -+ * hypervisor code to nuke the relevant contexts. -+ * - * We might get preempted before the vCPU actually runs, but - * over-invalidation doesn't affect correctness. - */ - if (*last_ran != vcpu->vcpu_id) { -- kvm_call_hyp(__kvm_tlb_flush_local_vmid, mmu); -+ kvm_call_hyp(__kvm_flush_cpu_context, mmu); - *last_ran = vcpu->vcpu_id; - } - -diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S -index b0afad7a99c6e..0c66a1d408fd7 100644 ---- a/arch/arm64/kvm/hyp/entry.S -+++ b/arch/arm64/kvm/hyp/entry.S -@@ -146,7 +146,7 @@ SYM_INNER_LABEL(__guest_exit, SYM_L_GLOBAL) - // Now restore the hyp regs - restore_callee_saved_regs x2 - -- set_loaded_vcpu xzr, x1, x2 -+ set_loaded_vcpu xzr, x2, x3 - - alternative_if ARM64_HAS_RAS_EXTN - // If we have the RAS extensions we can consume a pending error -diff --git a/arch/arm64/kvm/hyp/nvhe/debug-sr.c b/arch/arm64/kvm/hyp/nvhe/debug-sr.c -index 91a711aa8382e..f401724f12ef7 100644 ---- a/arch/arm64/kvm/hyp/nvhe/debug-sr.c -+++ b/arch/arm64/kvm/hyp/nvhe/debug-sr.c -@@ -58,16 +58,24 @@ static void __debug_restore_spe(u64 pmscr_el1) - write_sysreg_s(pmscr_el1, SYS_PMSCR_EL1); - } - --void __debug_switch_to_guest(struct kvm_vcpu *vcpu) -+void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu) - { - /* Disable and flush SPE data generation */ - __debug_save_spe(&vcpu->arch.host_debug_state.pmscr_el1); -+} -+ -+void __debug_switch_to_guest(struct kvm_vcpu *vcpu) -+{ - __debug_switch_to_guest_common(vcpu); - } - --void __debug_switch_to_host(struct kvm_vcpu *vcpu) -+void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu) - { - __debug_restore_spe(vcpu->arch.host_debug_state.pmscr_el1); -+} -+ -+void __debug_switch_to_host(struct kvm_vcpu *vcpu) -+{ - __debug_switch_to_host_common(vcpu); - } - -diff --git a/arch/arm64/kvm/hyp/nvhe/host.S b/arch/arm64/kvm/hyp/nvhe/host.S -index a820dfdc9c25d..3a06085aab6f1 100644 ---- a/arch/arm64/kvm/hyp/nvhe/host.S -+++ b/arch/arm64/kvm/hyp/nvhe/host.S -@@ -71,10 +71,15 @@ SYM_FUNC_START(__host_enter) - SYM_FUNC_END(__host_enter) - - /* -- * void __noreturn __hyp_do_panic(bool restore_host, u64 spsr, u64 elr, u64 par); -+ * void __noreturn __hyp_do_panic(struct kvm_cpu_context *host_ctxt, u64 spsr, -+ * u64 elr, u64 par); - */ - SYM_FUNC_START(__hyp_do_panic) -- /* Load the format arguments into x1-7 */ -+ mov x29, x0 -+ -+ /* Load the format string into x0 and arguments into x1-7 */ -+ ldr x0, =__hyp_panic_string -+ - mov x6, x3 - get_vcpu_ptr x7, x3 - -@@ -89,13 +94,8 @@ SYM_FUNC_START(__hyp_do_panic) - ldr lr, =panic - msr elr_el2, lr - -- /* -- * Set the panic format string and enter the host, conditionally -- * restoring the host context. -- */ -- cmp x0, xzr -- ldr x0, =__hyp_panic_string -- b.eq __host_enter_without_restoring -+ /* Enter the host, conditionally restoring the host context. */ -+ cbz x29, __host_enter_without_restoring - b __host_enter_for_panic - SYM_FUNC_END(__hyp_do_panic) - -@@ -150,7 +150,7 @@ SYM_FUNC_END(__hyp_do_panic) - - .macro invalid_host_el1_vect - .align 7 -- mov x0, xzr /* restore_host = false */ -+ mov x0, xzr /* host_ctxt = NULL */ - mrs x1, spsr_el2 - mrs x2, elr_el2 - mrs x3, par_el1 -diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c -index a906f9e2ff34f..1b8ef37bf8054 100644 ---- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c -+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c -@@ -46,11 +46,11 @@ static void handle___kvm_tlb_flush_vmid(struct kvm_cpu_context *host_ctxt) - __kvm_tlb_flush_vmid(kern_hyp_va(mmu)); - } - --static void handle___kvm_tlb_flush_local_vmid(struct kvm_cpu_context *host_ctxt) -+static void handle___kvm_flush_cpu_context(struct kvm_cpu_context *host_ctxt) - { - DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); - -- __kvm_tlb_flush_local_vmid(kern_hyp_va(mmu)); -+ __kvm_flush_cpu_context(kern_hyp_va(mmu)); - } - - static void handle___kvm_timer_set_cntvoff(struct kvm_cpu_context *host_ctxt) -@@ -115,7 +115,7 @@ static const hcall_t *host_hcall[] = { - HANDLE_FUNC(__kvm_flush_vm_context), - HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa), - HANDLE_FUNC(__kvm_tlb_flush_vmid), -- HANDLE_FUNC(__kvm_tlb_flush_local_vmid), -+ HANDLE_FUNC(__kvm_flush_cpu_context), - HANDLE_FUNC(__kvm_timer_set_cntvoff), - HANDLE_FUNC(__kvm_enable_ssbs), - HANDLE_FUNC(__vgic_v3_get_ich_vtr_el2), -diff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c -index f3d0e9eca56cd..68ab6b4d51414 100644 ---- a/arch/arm64/kvm/hyp/nvhe/switch.c -+++ b/arch/arm64/kvm/hyp/nvhe/switch.c -@@ -192,6 +192,14 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu) - pmu_switch_needed = __pmu_switch_to_guest(host_ctxt); - - __sysreg_save_state_nvhe(host_ctxt); -+ /* -+ * We must flush and disable the SPE buffer for nVHE, as -+ * the translation regime(EL1&0) is going to be loaded with -+ * that of the guest. And we must do this before we change the -+ * translation regime to EL2 (via MDCR_EL2_E2PB == 0) and -+ * before we load guest Stage1. -+ */ -+ __debug_save_host_buffers_nvhe(vcpu); - - __adjust_pc(vcpu); - -@@ -234,11 +242,12 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu) - if (vcpu->arch.flags & KVM_ARM64_FP_ENABLED) - __fpsimd_save_fpexc32(vcpu); - -+ __debug_switch_to_host(vcpu); - /* - * This must come after restoring the host sysregs, since a non-VHE - * system may enable SPE here and make use of the TTBRs. - */ -- __debug_switch_to_host(vcpu); -+ __debug_restore_host_buffers_nvhe(vcpu); - - if (pmu_switch_needed) - __pmu_switch_to_host(host_ctxt); -@@ -257,7 +266,6 @@ void __noreturn hyp_panic(void) - u64 spsr = read_sysreg_el2(SYS_SPSR); - u64 elr = read_sysreg_el2(SYS_ELR); - u64 par = read_sysreg_par(); -- bool restore_host = true; - struct kvm_cpu_context *host_ctxt; - struct kvm_vcpu *vcpu; - -@@ -271,7 +279,7 @@ void __noreturn hyp_panic(void) - __sysreg_restore_state_nvhe(host_ctxt); - } - -- __hyp_do_panic(restore_host, spsr, elr, par); -+ __hyp_do_panic(host_ctxt, spsr, elr, par); - unreachable(); - } - -diff --git a/arch/arm64/kvm/hyp/nvhe/tlb.c b/arch/arm64/kvm/hyp/nvhe/tlb.c -index fbde89a2c6e83..229b06748c208 100644 ---- a/arch/arm64/kvm/hyp/nvhe/tlb.c -+++ b/arch/arm64/kvm/hyp/nvhe/tlb.c -@@ -123,7 +123,7 @@ void __kvm_tlb_flush_vmid(struct kvm_s2_mmu *mmu) - __tlb_switch_to_host(&cxt); - } - --void __kvm_tlb_flush_local_vmid(struct kvm_s2_mmu *mmu) -+void __kvm_flush_cpu_context(struct kvm_s2_mmu *mmu) - { - struct tlb_inv_context cxt; - -@@ -131,6 +131,7 @@ void __kvm_tlb_flush_local_vmid(struct kvm_s2_mmu *mmu) - __tlb_switch_to_guest(mmu, &cxt); - - __tlbi(vmalle1); -+ asm volatile("ic iallu"); - dsb(nsh); - isb(); - -diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c -index bdf8e55ed308e..4d99d07c610c8 100644 ---- a/arch/arm64/kvm/hyp/pgtable.c -+++ b/arch/arm64/kvm/hyp/pgtable.c -@@ -225,6 +225,7 @@ static inline int __kvm_pgtable_visit(struct kvm_pgtable_walk_data *data, - goto out; - - if (!table) { -+ data->addr = ALIGN_DOWN(data->addr, kvm_granule_size(level)); - data->addr += kvm_granule_size(level); - goto out; - } -diff --git a/arch/arm64/kvm/hyp/vhe/tlb.c b/arch/arm64/kvm/hyp/vhe/tlb.c -index fd7895945bbc6..66f17349f0c36 100644 ---- a/arch/arm64/kvm/hyp/vhe/tlb.c -+++ b/arch/arm64/kvm/hyp/vhe/tlb.c -@@ -127,7 +127,7 @@ void __kvm_tlb_flush_vmid(struct kvm_s2_mmu *mmu) - __tlb_switch_to_host(&cxt); - } - --void __kvm_tlb_flush_local_vmid(struct kvm_s2_mmu *mmu) -+void __kvm_flush_cpu_context(struct kvm_s2_mmu *mmu) - { - struct tlb_inv_context cxt; - -@@ -135,6 +135,7 @@ void __kvm_tlb_flush_local_vmid(struct kvm_s2_mmu *mmu) - __tlb_switch_to_guest(mmu, &cxt); - - __tlbi(vmalle1); -+ asm volatile("ic iallu"); - dsb(nsh); - isb(); - -diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c -index 7d2257cc54387..eebde5eb6c3d0 100644 ---- a/arch/arm64/kvm/mmu.c -+++ b/arch/arm64/kvm/mmu.c -@@ -1309,8 +1309,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, - * Prevent userspace from creating a memory region outside of the IPA - * space addressable by the KVM guest IPA space. - */ -- if (memslot->base_gfn + memslot->npages >= -- (kvm_phys_size(kvm) >> PAGE_SHIFT)) -+ if ((memslot->base_gfn + memslot->npages) > (kvm_phys_size(kvm) >> PAGE_SHIFT)) - return -EFAULT; - - mmap_read_lock(current->mm); -diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c -index 47f3f035f3eac..9d3d09a898945 100644 ---- a/arch/arm64/kvm/reset.c -+++ b/arch/arm64/kvm/reset.c -@@ -324,10 +324,9 @@ int kvm_set_ipa_limit(void) - } - - kvm_ipa_limit = id_aa64mmfr0_parange_to_phys_shift(parange); -- WARN(kvm_ipa_limit < KVM_PHYS_SHIFT, -- "KVM IPA Size Limit (%d bits) is smaller than default size\n", -- kvm_ipa_limit); -- kvm_info("IPA Size Limit: %d bits\n", kvm_ipa_limit); -+ kvm_info("IPA Size Limit: %d bits%s\n", kvm_ipa_limit, -+ ((kvm_ipa_limit < KVM_PHYS_SHIFT) ? -+ " (Reduced IPA size, limited VM/VMM compatibility)" : "")); - - return 0; - } -@@ -356,6 +355,11 @@ int kvm_arm_setup_stage2(struct kvm *kvm, unsigned long type) - return -EINVAL; - } else { - phys_shift = KVM_PHYS_SHIFT; -+ if (phys_shift > kvm_ipa_limit) { -+ pr_warn_once("%s using unsupported default IPA limit, upgrade your VMM\n", -+ current->comm); -+ return -EINVAL; -+ } - } - - mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); -diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c -index 709d98fea90cc..1141075e4d53c 100644 ---- a/arch/arm64/mm/init.c -+++ b/arch/arm64/mm/init.c -@@ -230,6 +230,18 @@ int pfn_valid(unsigned long pfn) - - if (!valid_section(__pfn_to_section(pfn))) - return 0; -+ -+ /* -+ * ZONE_DEVICE memory does not have the memblock entries. -+ * memblock_is_map_memory() check for ZONE_DEVICE based -+ * addresses will always fail. Even the normal hotplugged -+ * memory will never have MEMBLOCK_NOMAP flag set in their -+ * memblock entries. Skip memblock search for all non early -+ * memory sections covering all of hotplug memory including -+ * both normal and ZONE_DEVICE based. -+ */ -+ if (!early_section(__pfn_to_section(pfn))) -+ return pfn_section_valid(__pfn_to_section(pfn), pfn); - #endif - return memblock_is_map_memory(addr); - } -diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c -index ae0c3d023824e..6f0648777d347 100644 ---- a/arch/arm64/mm/mmu.c -+++ b/arch/arm64/mm/mmu.c -@@ -40,7 +40,7 @@ - #define NO_BLOCK_MAPPINGS BIT(0) - #define NO_CONT_MAPPINGS BIT(1) - --u64 idmap_t0sz = TCR_T0SZ(VA_BITS); -+u64 idmap_t0sz = TCR_T0SZ(VA_BITS_MIN); - u64 idmap_ptrs_per_pgd = PTRS_PER_PGD; - - u64 __section(".mmuoff.data.write") vabits_actual; -@@ -512,7 +512,8 @@ static void __init map_mem(pgd_t *pgdp) - * if MTE is present. Otherwise, it has the same attributes as - * PAGE_KERNEL. - */ -- __map_memblock(pgdp, start, end, PAGE_KERNEL_TAGGED, flags); -+ __map_memblock(pgdp, start, end, pgprot_tagged(PAGE_KERNEL), -+ flags); - } - - /* -diff --git a/arch/mips/crypto/Makefile b/arch/mips/crypto/Makefile -index 8e1deaf00e0c0..5e4105cccf9fa 100644 ---- a/arch/mips/crypto/Makefile -+++ b/arch/mips/crypto/Makefile -@@ -12,8 +12,8 @@ AFLAGS_chacha-core.o += -O2 # needed to fill branch delay slots - obj-$(CONFIG_CRYPTO_POLY1305_MIPS) += poly1305-mips.o - poly1305-mips-y := poly1305-core.o poly1305-glue.o - --perlasm-flavour-$(CONFIG_CPU_MIPS32) := o32 --perlasm-flavour-$(CONFIG_CPU_MIPS64) := 64 -+perlasm-flavour-$(CONFIG_32BIT) := o32 -+perlasm-flavour-$(CONFIG_64BIT) := 64 - - quiet_cmd_perlasm = PERLASM $@ - cmd_perlasm = $(PERL) $(<) $(perlasm-flavour-y) $(@) -diff --git a/arch/mips/include/asm/traps.h b/arch/mips/include/asm/traps.h -index 6a0864bb604dc..9038b91e2d8c3 100644 ---- a/arch/mips/include/asm/traps.h -+++ b/arch/mips/include/asm/traps.h -@@ -24,6 +24,9 @@ extern void (*board_ebase_setup)(void); - extern void (*board_cache_error_setup)(void); - - extern int register_nmi_notifier(struct notifier_block *nb); -+extern void reserve_exception_space(phys_addr_t addr, unsigned long size); -+ -+#define VECTORSPACING 0x100 /* for EI/VI mode */ - - #define nmi_notifier(fn, pri) \ - ({ \ -diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c -index 31cb9199197ca..21794db53c05a 100644 ---- a/arch/mips/kernel/cpu-probe.c -+++ b/arch/mips/kernel/cpu-probe.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - #include - - #include "fpu-probe.h" -@@ -1619,6 +1620,7 @@ static inline void cpu_probe_broadcom(struct cpuinfo_mips *c, unsigned int cpu) - c->cputype = CPU_BMIPS3300; - __cpu_name[cpu] = "Broadcom BMIPS3300"; - set_elf_platform(cpu, "bmips3300"); -+ reserve_exception_space(0x400, VECTORSPACING * 64); - break; - case PRID_IMP_BMIPS43XX: { - int rev = c->processor_id & PRID_REV_MASK; -@@ -1629,6 +1631,7 @@ static inline void cpu_probe_broadcom(struct cpuinfo_mips *c, unsigned int cpu) - __cpu_name[cpu] = "Broadcom BMIPS4380"; - set_elf_platform(cpu, "bmips4380"); - c->options |= MIPS_CPU_RIXI; -+ reserve_exception_space(0x400, VECTORSPACING * 64); - } else { - c->cputype = CPU_BMIPS4350; - __cpu_name[cpu] = "Broadcom BMIPS4350"; -@@ -1645,6 +1648,7 @@ static inline void cpu_probe_broadcom(struct cpuinfo_mips *c, unsigned int cpu) - __cpu_name[cpu] = "Broadcom BMIPS5000"; - set_elf_platform(cpu, "bmips5000"); - c->options |= MIPS_CPU_ULRI | MIPS_CPU_RIXI; -+ reserve_exception_space(0x1000, VECTORSPACING * 64); - break; - } - } -@@ -2124,6 +2128,8 @@ void cpu_probe(void) - if (cpu == 0) - __ua_limit = ~((1ull << cpu_vmbits) - 1); - #endif -+ -+ reserve_exception_space(0, 0x1000); - } - - void cpu_report(void) -diff --git a/arch/mips/kernel/cpu-r3k-probe.c b/arch/mips/kernel/cpu-r3k-probe.c -index abdbbe8c5a43a..af654771918cd 100644 ---- a/arch/mips/kernel/cpu-r3k-probe.c -+++ b/arch/mips/kernel/cpu-r3k-probe.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - - #include "fpu-probe.h" - -@@ -158,6 +159,8 @@ void cpu_probe(void) - cpu_set_fpu_opts(c); - else - cpu_set_nofpu_opts(c); -+ -+ reserve_exception_space(0, 0x400); - } - - void cpu_report(void) -diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c -index e0352958e2f72..808b8b61ded15 100644 ---- a/arch/mips/kernel/traps.c -+++ b/arch/mips/kernel/traps.c -@@ -2009,13 +2009,16 @@ void __noreturn nmi_exception_handler(struct pt_regs *regs) - nmi_exit(); - } - --#define VECTORSPACING 0x100 /* for EI/VI mode */ -- - unsigned long ebase; - EXPORT_SYMBOL_GPL(ebase); - unsigned long exception_handlers[32]; - unsigned long vi_handlers[64]; - -+void reserve_exception_space(phys_addr_t addr, unsigned long size) -+{ -+ memblock_reserve(addr, size); -+} -+ - void __init *set_except_vector(int n, void *addr) - { - unsigned long handler = (unsigned long) addr; -@@ -2367,10 +2370,7 @@ void __init trap_init(void) - - if (!cpu_has_mips_r2_r6) { - ebase = CAC_BASE; -- ebase_pa = virt_to_phys((void *)ebase); - vec_size = 0x400; -- -- memblock_reserve(ebase_pa, vec_size); - } else { - if (cpu_has_veic || cpu_has_vint) - vec_size = 0x200 + VECTORSPACING*64; -diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h -index eacc9102c2515..d5b3c3bb95b40 100644 ---- a/arch/powerpc/include/asm/code-patching.h -+++ b/arch/powerpc/include/asm/code-patching.h -@@ -73,7 +73,7 @@ void __patch_exception(int exc, unsigned long addr); - #endif - - #define OP_RT_RA_MASK 0xffff0000UL --#define LIS_R2 0x3c020000UL -+#define LIS_R2 0x3c400000UL - #define ADDIS_R2_R12 0x3c4c0000UL - #define ADDI_R2_R2 0x38420000UL - -diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h -index cf6ebbc16cb47..764f2732a8218 100644 ---- a/arch/powerpc/include/asm/machdep.h -+++ b/arch/powerpc/include/asm/machdep.h -@@ -59,6 +59,9 @@ struct machdep_calls { - int (*pcibios_root_bridge_prepare)(struct pci_host_bridge - *bridge); - -+ /* finds all the pci_controllers present at boot */ -+ void (*discover_phbs)(void); -+ - /* To setup PHBs when using automatic OF platform driver for PCI */ - int (*pci_setup_phb)(struct pci_controller *host); - -diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h -index 58f9dc060a7b4..42e9bc4018da4 100644 ---- a/arch/powerpc/include/asm/ptrace.h -+++ b/arch/powerpc/include/asm/ptrace.h -@@ -70,6 +70,9 @@ struct pt_regs - }; - #endif - -+ -+#define STACK_FRAME_WITH_PT_REGS (STACK_FRAME_OVERHEAD + sizeof(struct pt_regs)) -+ - #ifdef __powerpc64__ - - /* -@@ -192,7 +195,7 @@ static inline void regs_set_return_value(struct pt_regs *regs, unsigned long rc) - #define TRAP_FLAGS_MASK 0x11 - #define TRAP(regs) ((regs)->trap & ~TRAP_FLAGS_MASK) - #define FULL_REGS(regs) (((regs)->trap & 1) == 0) --#define SET_FULL_REGS(regs) ((regs)->trap |= 1) -+#define SET_FULL_REGS(regs) ((regs)->trap &= ~1) - #endif - #define CHECK_FULL_REGS(regs) BUG_ON(!FULL_REGS(regs)) - #define NV_REG_POISON 0xdeadbeefdeadbeefUL -@@ -207,7 +210,7 @@ static inline void regs_set_return_value(struct pt_regs *regs, unsigned long rc) - #define TRAP_FLAGS_MASK 0x1F - #define TRAP(regs) ((regs)->trap & ~TRAP_FLAGS_MASK) - #define FULL_REGS(regs) (((regs)->trap & 1) == 0) --#define SET_FULL_REGS(regs) ((regs)->trap |= 1) -+#define SET_FULL_REGS(regs) ((regs)->trap &= ~1) - #define IS_CRITICAL_EXC(regs) (((regs)->trap & 2) != 0) - #define IS_MCHECK_EXC(regs) (((regs)->trap & 4) != 0) - #define IS_DEBUG_EXC(regs) (((regs)->trap & 8) != 0) -diff --git a/arch/powerpc/include/asm/switch_to.h b/arch/powerpc/include/asm/switch_to.h -index fdab934283721..9d1fbd8be1c74 100644 ---- a/arch/powerpc/include/asm/switch_to.h -+++ b/arch/powerpc/include/asm/switch_to.h -@@ -71,6 +71,16 @@ static inline void disable_kernel_vsx(void) - { - msr_check_and_clear(MSR_FP|MSR_VEC|MSR_VSX); - } -+#else -+static inline void enable_kernel_vsx(void) -+{ -+ BUILD_BUG(); -+} -+ -+static inline void disable_kernel_vsx(void) -+{ -+ BUILD_BUG(); -+} - #endif - - #ifdef CONFIG_SPE -diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c -index b12d7c049bfe2..989006b5ad0ff 100644 ---- a/arch/powerpc/kernel/asm-offsets.c -+++ b/arch/powerpc/kernel/asm-offsets.c -@@ -309,7 +309,7 @@ int main(void) - - /* Interrupt register frame */ - DEFINE(INT_FRAME_SIZE, STACK_INT_FRAME_SIZE); -- DEFINE(SWITCH_FRAME_SIZE, STACK_FRAME_OVERHEAD + sizeof(struct pt_regs)); -+ DEFINE(SWITCH_FRAME_SIZE, STACK_FRAME_WITH_PT_REGS); - STACK_PT_REGS_OFFSET(GPR0, gpr[0]); - STACK_PT_REGS_OFFSET(GPR1, gpr[1]); - STACK_PT_REGS_OFFSET(GPR2, gpr[2]); -diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S -index 6e53f76387374..de988770a7e4e 100644 ---- a/arch/powerpc/kernel/exceptions-64s.S -+++ b/arch/powerpc/kernel/exceptions-64s.S -@@ -470,7 +470,7 @@ DEFINE_FIXED_SYMBOL(\name\()_common_real) - - ld r10,PACAKMSR(r13) /* get MSR value for kernel */ - /* MSR[RI] is clear iff using SRR regs */ -- .if IHSRR == EXC_HV_OR_STD -+ .if IHSRR_IF_HVMODE - BEGIN_FTR_SECTION - xori r10,r10,MSR_RI - END_FTR_SECTION_IFCLR(CPU_FTR_HVMODE) -diff --git a/arch/powerpc/kernel/head_book3s_32.S b/arch/powerpc/kernel/head_book3s_32.S -index bc57e3a82d689..b1a1a928fcb8b 100644 ---- a/arch/powerpc/kernel/head_book3s_32.S -+++ b/arch/powerpc/kernel/head_book3s_32.S -@@ -447,11 +447,12 @@ InstructionTLBMiss: - cmplw 0,r1,r3 - #endif - mfspr r2, SPRN_SDR1 -- li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC -+ li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC | _PAGE_USER - rlwinm r2, r2, 28, 0xfffff000 - #ifdef CONFIG_MODULES - bgt- 112f - lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ -+ li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC - addi r2, r2, (swapper_pg_dir - PAGE_OFFSET)@l /* kernel page table */ - #endif - 112: rlwimi r2,r3,12,20,29 /* insert top 10 bits of address */ -@@ -510,10 +511,11 @@ DataLoadTLBMiss: - lis r1, TASK_SIZE@h /* check if kernel address */ - cmplw 0,r1,r3 - mfspr r2, SPRN_SDR1 -- li r1, _PAGE_PRESENT | _PAGE_ACCESSED -+ li r1, _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER - rlwinm r2, r2, 28, 0xfffff000 - bgt- 112f - lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ -+ li r1, _PAGE_PRESENT | _PAGE_ACCESSED - addi r2, r2, (swapper_pg_dir - PAGE_OFFSET)@l /* kernel page table */ - 112: rlwimi r2,r3,12,20,29 /* insert top 10 bits of address */ - lwz r2,0(r2) /* get pmd entry */ -@@ -587,10 +589,11 @@ DataStoreTLBMiss: - lis r1, TASK_SIZE@h /* check if kernel address */ - cmplw 0,r1,r3 - mfspr r2, SPRN_SDR1 -- li r1, _PAGE_RW | _PAGE_DIRTY | _PAGE_PRESENT | _PAGE_ACCESSED -+ li r1, _PAGE_RW | _PAGE_DIRTY | _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER - rlwinm r2, r2, 28, 0xfffff000 - bgt- 112f - lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ -+ li r1, _PAGE_RW | _PAGE_DIRTY | _PAGE_PRESENT | _PAGE_ACCESSED - addi r2, r2, (swapper_pg_dir - PAGE_OFFSET)@l /* kernel page table */ - 112: rlwimi r2,r3,12,20,29 /* insert top 10 bits of address */ - lwz r2,0(r2) /* get pmd entry */ -diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c -index 2b555997b2950..001e90cd8948b 100644 ---- a/arch/powerpc/kernel/pci-common.c -+++ b/arch/powerpc/kernel/pci-common.c -@@ -1699,3 +1699,13 @@ static void fixup_hide_host_resource_fsl(struct pci_dev *dev) - } - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MOTOROLA, PCI_ANY_ID, fixup_hide_host_resource_fsl); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_FREESCALE, PCI_ANY_ID, fixup_hide_host_resource_fsl); -+ -+ -+static int __init discover_phbs(void) -+{ -+ if (ppc_md.discover_phbs) -+ ppc_md.discover_phbs(); -+ -+ return 0; -+} -+core_initcall(discover_phbs); -diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c -index a66f435dabbfe..b65a73e4d6423 100644 ---- a/arch/powerpc/kernel/process.c -+++ b/arch/powerpc/kernel/process.c -@@ -2176,7 +2176,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack, - * See if this is an exception frame. - * We look for the "regshere" marker in the current frame. - */ -- if (validate_sp(sp, tsk, STACK_INT_FRAME_SIZE) -+ if (validate_sp(sp, tsk, STACK_FRAME_WITH_PT_REGS) - && stack[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) { - struct pt_regs *regs = (struct pt_regs *) - (sp + STACK_FRAME_OVERHEAD); -diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c -index 3ec7b443fe6bb..4be05517f2db8 100644 ---- a/arch/powerpc/kernel/traps.c -+++ b/arch/powerpc/kernel/traps.c -@@ -503,8 +503,11 @@ out: - die("Unrecoverable nested System Reset", regs, SIGABRT); - #endif - /* Must die if the interrupt is not recoverable */ -- if (!(regs->msr & MSR_RI)) -+ if (!(regs->msr & MSR_RI)) { -+ /* For the reason explained in die_mce, nmi_exit before die */ -+ nmi_exit(); - die("Unrecoverable System Reset", regs, SIGABRT); -+ } - - if (saved_hsrrs) { - mtspr(SPRN_HSRR0, hsrr0); -diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c -index bb5c20d4ca91c..c6aebc149d141 100644 ---- a/arch/powerpc/lib/sstep.c -+++ b/arch/powerpc/lib/sstep.c -@@ -904,7 +904,7 @@ static nokprobe_inline int do_vsx_load(struct instruction_op *op, - if (!address_ok(regs, ea, size) || copy_mem_in(mem, ea, size, regs)) - return -EFAULT; - -- nr_vsx_regs = size / sizeof(__vector128); -+ nr_vsx_regs = max(1ul, size / sizeof(__vector128)); - emulate_vsx_load(op, buf, mem, cross_endian); - preempt_disable(); - if (reg < 32) { -@@ -951,7 +951,7 @@ static nokprobe_inline int do_vsx_store(struct instruction_op *op, - if (!address_ok(regs, ea, size)) - return -EFAULT; - -- nr_vsx_regs = size / sizeof(__vector128); -+ nr_vsx_regs = max(1ul, size / sizeof(__vector128)); - preempt_disable(); - if (reg < 32) { - /* FP regs + extensions */ -diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c -index 28206b1fe172a..51f413521fdef 100644 ---- a/arch/powerpc/perf/core-book3s.c -+++ b/arch/powerpc/perf/core-book3s.c -@@ -212,7 +212,7 @@ static inline void perf_get_data_addr(struct perf_event *event, struct pt_regs * - if (!(mmcra & MMCRA_SAMPLE_ENABLE) || sdar_valid) - *addrp = mfspr(SPRN_SDAR); - -- if (is_kernel_addr(mfspr(SPRN_SDAR)) && perf_allow_kernel(&event->attr) != 0) -+ if (is_kernel_addr(mfspr(SPRN_SDAR)) && event->attr.exclude_kernel) - *addrp = 0; - } - -@@ -506,7 +506,7 @@ static void power_pmu_bhrb_read(struct perf_event *event, struct cpu_hw_events * - * addresses, hence include a check before filtering code - */ - if (!(ppmu->flags & PPMU_ARCH_31) && -- is_kernel_addr(addr) && perf_allow_kernel(&event->attr) != 0) -+ is_kernel_addr(addr) && event->attr.exclude_kernel) - continue; - - /* Branches are read most recent first (ie. mfbhrb 0 is -@@ -2149,7 +2149,17 @@ static void record_and_restart(struct perf_event *event, unsigned long val, - left += period; - if (left <= 0) - left = period; -- record = siar_valid(regs); -+ -+ /* -+ * If address is not requested in the sample via -+ * PERF_SAMPLE_IP, just record that sample irrespective -+ * of SIAR valid check. -+ */ -+ if (event->attr.sample_type & PERF_SAMPLE_IP) -+ record = siar_valid(regs); -+ else -+ record = 1; -+ - event->hw.last_period = event->hw.sample_period; - } - if (left < 0x80000000LL) -@@ -2167,9 +2177,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val, - * MMCR2. Check attr.exclude_kernel and address to drop the sample in - * these cases. - */ -- if (event->attr.exclude_kernel && record) -- if (is_kernel_addr(mfspr(SPRN_SIAR))) -- record = 0; -+ if (event->attr.exclude_kernel && -+ (event->attr.sample_type & PERF_SAMPLE_IP) && -+ is_kernel_addr(mfspr(SPRN_SIAR))) -+ record = 0; - - /* - * Finally record data if requested. -diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c -index b3ac2455faadc..637300330507f 100644 ---- a/arch/powerpc/platforms/pseries/msi.c -+++ b/arch/powerpc/platforms/pseries/msi.c -@@ -4,6 +4,7 @@ - * Copyright 2006-2007 Michael Ellerman, IBM Corp. - */ - -+#include - #include - #include - #include -@@ -458,8 +459,28 @@ again: - return hwirq; - } - -- virq = irq_create_mapping_affinity(NULL, hwirq, -- entry->affinity); -+ /* -+ * Depending on the number of online CPUs in the original -+ * kernel, it is likely for CPU #0 to be offline in a kdump -+ * kernel. The associated IRQs in the affinity mappings -+ * provided by irq_create_affinity_masks() are thus not -+ * started by irq_startup(), as per-design for managed IRQs. -+ * This can be a problem with multi-queue block devices driven -+ * by blk-mq : such a non-started IRQ is very likely paired -+ * with the single queue enforced by blk-mq during kdump (see -+ * blk_mq_alloc_tag_set()). This causes the device to remain -+ * silent and likely hangs the guest at some point. -+ * -+ * We don't really care for fine-grained affinity when doing -+ * kdump actually : simply ignore the pre-computed affinity -+ * masks in this case and let the default mask with all CPUs -+ * be used when creating the IRQ mappings. -+ */ -+ if (is_kdump_kernel()) -+ virq = irq_create_mapping(NULL, hwirq); -+ else -+ virq = irq_create_mapping_affinity(NULL, hwirq, -+ entry->affinity); - - if (!virq) { - pr_debug("rtas_msi: Failed mapping hwirq %d\n", hwirq); -diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c -index 27c7630141148..1bae4a65416b2 100644 ---- a/arch/s390/kernel/smp.c -+++ b/arch/s390/kernel/smp.c -@@ -770,7 +770,7 @@ static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail, - static int __smp_rescan_cpus(struct sclp_core_info *info, bool early) - { - struct sclp_core_entry *core; -- cpumask_t avail; -+ static cpumask_t avail; - bool configured; - u16 core_id; - int nr, i; -diff --git a/arch/sparc/include/asm/mman.h b/arch/sparc/include/asm/mman.h -index f94532f25db14..274217e7ed702 100644 ---- a/arch/sparc/include/asm/mman.h -+++ b/arch/sparc/include/asm/mman.h -@@ -57,35 +57,39 @@ static inline int sparc_validate_prot(unsigned long prot, unsigned long addr) - { - if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC | PROT_SEM | PROT_ADI)) - return 0; -- if (prot & PROT_ADI) { -- if (!adi_capable()) -- return 0; -+ return 1; -+} - -- if (addr) { -- struct vm_area_struct *vma; -+#define arch_validate_flags(vm_flags) arch_validate_flags(vm_flags) -+/* arch_validate_flags() - Ensure combination of flags is valid for a -+ * VMA. -+ */ -+static inline bool arch_validate_flags(unsigned long vm_flags) -+{ -+ /* If ADI is being enabled on this VMA, check for ADI -+ * capability on the platform and ensure VMA is suitable -+ * for ADI -+ */ -+ if (vm_flags & VM_SPARC_ADI) { -+ if (!adi_capable()) -+ return false; - -- vma = find_vma(current->mm, addr); -- if (vma) { -- /* ADI can not be enabled on PFN -- * mapped pages -- */ -- if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP)) -- return 0; -+ /* ADI can not be enabled on PFN mapped pages */ -+ if (vm_flags & (VM_PFNMAP | VM_MIXEDMAP)) -+ return false; - -- /* Mergeable pages can become unmergeable -- * if ADI is enabled on them even if they -- * have identical data on them. This can be -- * because ADI enabled pages with identical -- * data may still not have identical ADI -- * tags on them. Disallow ADI on mergeable -- * pages. -- */ -- if (vma->vm_flags & VM_MERGEABLE) -- return 0; -- } -- } -+ /* Mergeable pages can become unmergeable -+ * if ADI is enabled on them even if they -+ * have identical data on them. This can be -+ * because ADI enabled pages with identical -+ * data may still not have identical ADI -+ * tags on them. Disallow ADI on mergeable -+ * pages. -+ */ -+ if (vm_flags & VM_MERGEABLE) -+ return false; - } -- return 1; -+ return true; - } - #endif /* CONFIG_SPARC64 */ - -diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c -index eb2946b1df8a4..6139c5700ccc9 100644 ---- a/arch/sparc/mm/init_32.c -+++ b/arch/sparc/mm/init_32.c -@@ -197,6 +197,9 @@ unsigned long __init bootmem_init(unsigned long *pages_avail) - size = memblock_phys_mem_size() - memblock_reserved_size(); - *pages_avail = (size >> PAGE_SHIFT) - high_pages; - -+ /* Only allow low memory to be allocated via memblock allocation */ -+ memblock_set_current_limit(max_low_pfn << PAGE_SHIFT); -+ - return max_pfn; - } - -diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c -index f89ae8ada64fe..2e4d91f3feea4 100644 ---- a/arch/x86/entry/common.c -+++ b/arch/x86/entry/common.c -@@ -128,7 +128,8 @@ static noinstr bool __do_fast_syscall_32(struct pt_regs *regs) - regs->ax = -EFAULT; - - instrumentation_end(); -- syscall_exit_to_user_mode(regs); -+ local_irq_disable(); -+ irqentry_exit_to_user_mode(regs); - return false; - } - -diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S -index 541fdaf640453..0051cf5c792d1 100644 ---- a/arch/x86/entry/entry_64_compat.S -+++ b/arch/x86/entry/entry_64_compat.S -@@ -210,6 +210,8 @@ SYM_CODE_START(entry_SYSCALL_compat) - /* Switch to the kernel stack */ - movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp - -+SYM_INNER_LABEL(entry_SYSCALL_compat_safe_stack, SYM_L_GLOBAL) -+ - /* Construct struct pt_regs on stack */ - pushq $__USER32_DS /* pt_regs->ss */ - pushq %r8 /* pt_regs->sp */ -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index 4faaef3a8f6c4..d3f5cf70c1a09 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -3578,8 +3578,10 @@ static int intel_pmu_hw_config(struct perf_event *event) - if (!(event->attr.freq || (event->attr.wakeup_events && !event->attr.watermark))) { - event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD; - if (!(event->attr.sample_type & -- ~intel_pmu_large_pebs_flags(event))) -+ ~intel_pmu_large_pebs_flags(event))) { - event->hw.flags |= PERF_X86_EVENT_LARGE_PEBS; -+ event->attach_state |= PERF_ATTACH_SCHED_CB; -+ } - } - if (x86_pmu.pebs_aliases) - x86_pmu.pebs_aliases(event); -@@ -3592,6 +3594,7 @@ static int intel_pmu_hw_config(struct perf_event *event) - ret = intel_pmu_setup_lbr_filter(event); - if (ret) - return ret; -+ event->attach_state |= PERF_ATTACH_SCHED_CB; - - /* - * BTS is set up earlier in this path, so don't account twice -diff --git a/arch/x86/include/asm/insn-eval.h b/arch/x86/include/asm/insn-eval.h -index a0f839aa144d9..98b4dae5e8bc8 100644 ---- a/arch/x86/include/asm/insn-eval.h -+++ b/arch/x86/include/asm/insn-eval.h -@@ -23,6 +23,8 @@ unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx); - int insn_get_code_seg_params(struct pt_regs *regs); - int insn_fetch_from_user(struct pt_regs *regs, - unsigned char buf[MAX_INSN_SIZE]); -+int insn_fetch_from_user_inatomic(struct pt_regs *regs, -+ unsigned char buf[MAX_INSN_SIZE]); - bool insn_decode(struct insn *insn, struct pt_regs *regs, - unsigned char buf[MAX_INSN_SIZE], int buf_size); - -diff --git a/arch/x86/include/asm/proto.h b/arch/x86/include/asm/proto.h -index 2c35f1c01a2df..b6a9d51d1d791 100644 ---- a/arch/x86/include/asm/proto.h -+++ b/arch/x86/include/asm/proto.h -@@ -25,6 +25,7 @@ void __end_SYSENTER_singlestep_region(void); - void entry_SYSENTER_compat(void); - void __end_entry_SYSENTER_compat(void); - void entry_SYSCALL_compat(void); -+void entry_SYSCALL_compat_safe_stack(void); - void entry_INT80_compat(void); - #ifdef CONFIG_XEN_PV - void xen_entry_INT80_compat(void); -diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h -index d8324a2366961..409f661481e11 100644 ---- a/arch/x86/include/asm/ptrace.h -+++ b/arch/x86/include/asm/ptrace.h -@@ -94,6 +94,8 @@ struct pt_regs { - #include - #endif - -+#include -+ - struct cpuinfo_x86; - struct task_struct; - -@@ -175,6 +177,19 @@ static inline bool any_64bit_mode(struct pt_regs *regs) - #ifdef CONFIG_X86_64 - #define current_user_stack_pointer() current_pt_regs()->sp - #define compat_user_stack_pointer() current_pt_regs()->sp -+ -+static inline bool ip_within_syscall_gap(struct pt_regs *regs) -+{ -+ bool ret = (regs->ip >= (unsigned long)entry_SYSCALL_64 && -+ regs->ip < (unsigned long)entry_SYSCALL_64_safe_stack); -+ -+#ifdef CONFIG_IA32_EMULATION -+ ret = ret || (regs->ip >= (unsigned long)entry_SYSCALL_compat && -+ regs->ip < (unsigned long)entry_SYSCALL_compat_safe_stack); -+#endif -+ -+ return ret; -+} - #endif - - static inline unsigned long kernel_stack_pointer(struct pt_regs *regs) -diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c -index aa593743acf67..1fc0962c89c08 100644 ---- a/arch/x86/kernel/kvmclock.c -+++ b/arch/x86/kernel/kvmclock.c -@@ -268,21 +268,20 @@ static void __init kvmclock_init_mem(void) - - static int __init kvm_setup_vsyscall_timeinfo(void) - { --#ifdef CONFIG_X86_64 -- u8 flags; -+ kvmclock_init_mem(); - -- if (!per_cpu(hv_clock_per_cpu, 0) || !kvmclock_vsyscall) -- return 0; -+#ifdef CONFIG_X86_64 -+ if (per_cpu(hv_clock_per_cpu, 0) && kvmclock_vsyscall) { -+ u8 flags; - -- flags = pvclock_read_flags(&hv_clock_boot[0].pvti); -- if (!(flags & PVCLOCK_TSC_STABLE_BIT)) -- return 0; -+ flags = pvclock_read_flags(&hv_clock_boot[0].pvti); -+ if (!(flags & PVCLOCK_TSC_STABLE_BIT)) -+ return 0; - -- kvm_clock.vdso_clock_mode = VDSO_CLOCKMODE_PVCLOCK; -+ kvm_clock.vdso_clock_mode = VDSO_CLOCKMODE_PVCLOCK; -+ } - #endif - -- kvmclock_init_mem(); -- - return 0; - } - early_initcall(kvm_setup_vsyscall_timeinfo); -diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c -index 84c1821819afb..04a780abb512d 100644 ---- a/arch/x86/kernel/sev-es.c -+++ b/arch/x86/kernel/sev-es.c -@@ -121,8 +121,18 @@ static void __init setup_vc_stacks(int cpu) - cea_set_pte((void *)vaddr, pa, PAGE_KERNEL); - } - --static __always_inline bool on_vc_stack(unsigned long sp) -+static __always_inline bool on_vc_stack(struct pt_regs *regs) - { -+ unsigned long sp = regs->sp; -+ -+ /* User-mode RSP is not trusted */ -+ if (user_mode(regs)) -+ return false; -+ -+ /* SYSCALL gap still has user-mode RSP */ -+ if (ip_within_syscall_gap(regs)) -+ return false; -+ - return ((sp >= __this_cpu_ist_bottom_va(VC)) && (sp < __this_cpu_ist_top_va(VC))); - } - -@@ -144,7 +154,7 @@ void noinstr __sev_es_ist_enter(struct pt_regs *regs) - old_ist = __this_cpu_read(cpu_tss_rw.x86_tss.ist[IST_INDEX_VC]); - - /* Make room on the IST stack */ -- if (on_vc_stack(regs->sp)) -+ if (on_vc_stack(regs)) - new_ist = ALIGN_DOWN(regs->sp, 8) - sizeof(old_ist); - else - new_ist = old_ist - sizeof(old_ist); -@@ -248,7 +258,7 @@ static enum es_result vc_decode_insn(struct es_em_ctxt *ctxt) - int res; - - if (user_mode(ctxt->regs)) { -- res = insn_fetch_from_user(ctxt->regs, buffer); -+ res = insn_fetch_from_user_inatomic(ctxt->regs, buffer); - if (!res) { - ctxt->fi.vector = X86_TRAP_PF; - ctxt->fi.error_code = X86_PF_INSTR | X86_PF_USER; -@@ -1248,13 +1258,12 @@ static __always_inline bool on_vc_fallback_stack(struct pt_regs *regs) - DEFINE_IDTENTRY_VC_SAFE_STACK(exc_vmm_communication) - { - struct sev_es_runtime_data *data = this_cpu_read(runtime_data); -+ irqentry_state_t irq_state; - struct ghcb_state state; - struct es_em_ctxt ctxt; - enum es_result result; - struct ghcb *ghcb; - -- lockdep_assert_irqs_disabled(); -- - /* - * Handle #DB before calling into !noinstr code to avoid recursive #DB. - */ -@@ -1263,6 +1272,8 @@ DEFINE_IDTENTRY_VC_SAFE_STACK(exc_vmm_communication) - return; - } - -+ irq_state = irqentry_nmi_enter(regs); -+ lockdep_assert_irqs_disabled(); - instrumentation_begin(); - - /* -@@ -1325,6 +1336,7 @@ DEFINE_IDTENTRY_VC_SAFE_STACK(exc_vmm_communication) - - out: - instrumentation_end(); -+ irqentry_nmi_exit(regs, irq_state); - - return; - -diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c -index 7f5aec758f0ee..ac1874a2a70e8 100644 ---- a/arch/x86/kernel/traps.c -+++ b/arch/x86/kernel/traps.c -@@ -694,8 +694,7 @@ asmlinkage __visible noinstr struct pt_regs *vc_switch_off_ist(struct pt_regs *r - * In the SYSCALL entry path the RSP value comes from user-space - don't - * trust it and switch to the current kernel stack - */ -- if (regs->ip >= (unsigned long)entry_SYSCALL_64 && -- regs->ip < (unsigned long)entry_SYSCALL_64_safe_stack) { -+ if (ip_within_syscall_gap(regs)) { - sp = this_cpu_read(cpu_current_top_of_stack); - goto sync; - } -diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c -index 73f8001000669..c451d5f6422f6 100644 ---- a/arch/x86/kernel/unwind_orc.c -+++ b/arch/x86/kernel/unwind_orc.c -@@ -367,8 +367,8 @@ static bool deref_stack_regs(struct unwind_state *state, unsigned long addr, - if (!stack_access_ok(state, addr, sizeof(struct pt_regs))) - return false; - -- *ip = regs->ip; -- *sp = regs->sp; -+ *ip = READ_ONCE_NOCHECK(regs->ip); -+ *sp = READ_ONCE_NOCHECK(regs->sp); - return true; - } - -@@ -380,8 +380,8 @@ static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr - if (!stack_access_ok(state, addr, IRET_FRAME_SIZE)) - return false; - -- *ip = regs->ip; -- *sp = regs->sp; -+ *ip = READ_ONCE_NOCHECK(regs->ip); -+ *sp = READ_ONCE_NOCHECK(regs->sp); - return true; - } - -@@ -402,12 +402,12 @@ static bool get_reg(struct unwind_state *state, unsigned int reg_off, - return false; - - if (state->full_regs) { -- *val = ((unsigned long *)state->regs)[reg]; -+ *val = READ_ONCE_NOCHECK(((unsigned long *)state->regs)[reg]); - return true; - } - - if (state->prev_regs) { -- *val = ((unsigned long *)state->prev_regs)[reg]; -+ *val = READ_ONCE_NOCHECK(((unsigned long *)state->prev_regs)[reg]); - return true; - } - -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index 43cceadd073ed..570fa298083cd 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -1641,7 +1641,16 @@ static void apic_timer_expired(struct kvm_lapic *apic, bool from_timer_fn) - } - - if (kvm_use_posted_timer_interrupt(apic->vcpu)) { -- kvm_wait_lapic_expire(vcpu); -+ /* -+ * Ensure the guest's timer has truly expired before posting an -+ * interrupt. Open code the relevant checks to avoid querying -+ * lapic_timer_int_injected(), which will be false since the -+ * interrupt isn't yet injected. Waiting until after injecting -+ * is not an option since that won't help a posted interrupt. -+ */ -+ if (vcpu->arch.apic->lapic_timer.expired_tscdeadline && -+ vcpu->arch.apic->lapic_timer.timer_advance_ns) -+ __kvm_wait_lapic_expire(vcpu); - kvm_apic_inject_pending_timer_irqs(apic); - return; - } -diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c -index 4229950a5d78c..bb0b3fe1e0a02 100644 ---- a/arch/x86/lib/insn-eval.c -+++ b/arch/x86/lib/insn-eval.c -@@ -1415,6 +1415,25 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) - } - } - -+static unsigned long insn_get_effective_ip(struct pt_regs *regs) -+{ -+ unsigned long seg_base = 0; -+ -+ /* -+ * If not in user-space long mode, a custom code segment could be in -+ * use. This is true in protected mode (if the process defined a local -+ * descriptor table), or virtual-8086 mode. In most of the cases -+ * seg_base will be zero as in USER_CS. -+ */ -+ if (!user_64bit_mode(regs)) { -+ seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS); -+ if (seg_base == -1L) -+ return 0; -+ } -+ -+ return seg_base + regs->ip; -+} -+ - /** - * insn_fetch_from_user() - Copy instruction bytes from user-space memory - * @regs: Structure with register values as seen when entering kernel mode -@@ -1431,24 +1450,43 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) - */ - int insn_fetch_from_user(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE]) - { -- unsigned long seg_base = 0; -+ unsigned long ip; - int not_copied; - -- /* -- * If not in user-space long mode, a custom code segment could be in -- * use. This is true in protected mode (if the process defined a local -- * descriptor table), or virtual-8086 mode. In most of the cases -- * seg_base will be zero as in USER_CS. -- */ -- if (!user_64bit_mode(regs)) { -- seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS); -- if (seg_base == -1L) -- return 0; -- } -+ ip = insn_get_effective_ip(regs); -+ if (!ip) -+ return 0; -+ -+ not_copied = copy_from_user(buf, (void __user *)ip, MAX_INSN_SIZE); - -+ return MAX_INSN_SIZE - not_copied; -+} -+ -+/** -+ * insn_fetch_from_user_inatomic() - Copy instruction bytes from user-space memory -+ * while in atomic code -+ * @regs: Structure with register values as seen when entering kernel mode -+ * @buf: Array to store the fetched instruction -+ * -+ * Gets the linear address of the instruction and copies the instruction bytes -+ * to the buf. This function must be used in atomic context. -+ * -+ * Returns: -+ * -+ * Number of instruction bytes copied. -+ * -+ * 0 if nothing was copied. -+ */ -+int insn_fetch_from_user_inatomic(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE]) -+{ -+ unsigned long ip; -+ int not_copied; -+ -+ ip = insn_get_effective_ip(regs); -+ if (!ip) -+ return 0; - -- not_copied = copy_from_user(buf, (void __user *)(seg_base + regs->ip), -- MAX_INSN_SIZE); -+ not_copied = __copy_from_user_inatomic(buf, (void __user *)ip, MAX_INSN_SIZE); - - return MAX_INSN_SIZE - not_copied; - } -diff --git a/block/blk-zoned.c b/block/blk-zoned.c -index 7a68b6e4300ce..df0ecf6790d35 100644 ---- a/block/blk-zoned.c -+++ b/block/blk-zoned.c -@@ -318,6 +318,22 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode, - return 0; - } - -+static int blkdev_truncate_zone_range(struct block_device *bdev, fmode_t mode, -+ const struct blk_zone_range *zrange) -+{ -+ loff_t start, end; -+ -+ if (zrange->sector + zrange->nr_sectors <= zrange->sector || -+ zrange->sector + zrange->nr_sectors > get_capacity(bdev->bd_disk)) -+ /* Out of range */ -+ return -EINVAL; -+ -+ start = zrange->sector << SECTOR_SHIFT; -+ end = ((zrange->sector + zrange->nr_sectors) << SECTOR_SHIFT) - 1; -+ -+ return truncate_bdev_range(bdev, mode, start, end); -+} -+ - /* - * BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE ioctl processing. - * Called from blkdev_ioctl. -@@ -329,6 +345,7 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, fmode_t mode, - struct request_queue *q; - struct blk_zone_range zrange; - enum req_opf op; -+ int ret; - - if (!argp) - return -EINVAL; -@@ -352,6 +369,11 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, fmode_t mode, - switch (cmd) { - case BLKRESETZONE: - op = REQ_OP_ZONE_RESET; -+ -+ /* Invalidate the page cache, including dirty pages. */ -+ ret = blkdev_truncate_zone_range(bdev, mode, &zrange); -+ if (ret) -+ return ret; - break; - case BLKOPENZONE: - op = REQ_OP_ZONE_OPEN; -@@ -366,8 +388,20 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, fmode_t mode, - return -ENOTTY; - } - -- return blkdev_zone_mgmt(bdev, op, zrange.sector, zrange.nr_sectors, -- GFP_KERNEL); -+ ret = blkdev_zone_mgmt(bdev, op, zrange.sector, zrange.nr_sectors, -+ GFP_KERNEL); -+ -+ /* -+ * Invalidate the page cache again for zone reset: writes can only be -+ * direct for zoned devices so concurrent writes would not add any page -+ * to the page cache after/during reset. The page cache may be filled -+ * again due to concurrent reads though and dropping the pages for -+ * these is fine. -+ */ -+ if (!ret && cmd == BLKRESETZONE) -+ ret = blkdev_truncate_zone_range(bdev, mode, &zrange); -+ -+ return ret; - } - - static inline unsigned long *blk_alloc_zone_bitmap(int node, -diff --git a/crypto/Kconfig b/crypto/Kconfig -index a367fcfeb5d45..3913e409ba884 100644 ---- a/crypto/Kconfig -+++ b/crypto/Kconfig -@@ -772,7 +772,7 @@ config CRYPTO_POLY1305_X86_64 - - config CRYPTO_POLY1305_MIPS - tristate "Poly1305 authenticator algorithm (MIPS optimized)" -- depends on CPU_MIPS32 || (CPU_MIPS64 && 64BIT) -+ depends on MIPS - select CRYPTO_ARCH_HAVE_LIB_POLY1305 - - config CRYPTO_MD4 -diff --git a/drivers/base/memory.c b/drivers/base/memory.c -index eef4ffb6122c9..de058d15b33ea 100644 ---- a/drivers/base/memory.c -+++ b/drivers/base/memory.c -@@ -290,20 +290,20 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr, - } - - /* -- * phys_device is a bad name for this. What I really want -- * is a way to differentiate between memory ranges that -- * are part of physical devices that constitute -- * a complete removable unit or fru. -- * i.e. do these ranges belong to the same physical device, -- * s.t. if I offline all of these sections I can then -- * remove the physical device? -+ * Legacy interface that we cannot remove: s390x exposes the storage increment -+ * covered by a memory block, allowing for identifying which memory blocks -+ * comprise a storage increment. Since a memory block spans complete -+ * storage increments nowadays, this interface is basically unused. Other -+ * archs never exposed != 0. - */ - static ssize_t phys_device_show(struct device *dev, - struct device_attribute *attr, char *buf) - { - struct memory_block *mem = to_memory_block(dev); -+ unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr); - -- return sysfs_emit(buf, "%d\n", mem->phys_device); -+ return sysfs_emit(buf, "%d\n", -+ arch_get_memory_phys_device(start_pfn)); - } - - #ifdef CONFIG_MEMORY_HOTREMOVE -@@ -488,11 +488,7 @@ static DEVICE_ATTR_WO(soft_offline_page); - static DEVICE_ATTR_WO(hard_offline_page); - #endif - --/* -- * Note that phys_device is optional. It is here to allow for -- * differentiation between which *physical* devices each -- * section belongs to... -- */ -+/* See phys_device_show(). */ - int __weak arch_get_memory_phys_device(unsigned long start_pfn) - { - return 0; -@@ -574,7 +570,6 @@ int register_memory(struct memory_block *memory) - static int init_memory_block(unsigned long block_id, unsigned long state) - { - struct memory_block *mem; -- unsigned long start_pfn; - int ret = 0; - - mem = find_memory_block_by_id(block_id); -@@ -588,8 +583,6 @@ static int init_memory_block(unsigned long block_id, unsigned long state) - - mem->start_section_nr = block_id * sections_per_block; - mem->state = state; -- start_pfn = section_nr_to_pfn(mem->start_section_nr); -- mem->phys_device = arch_get_memory_phys_device(start_pfn); - mem->nid = NUMA_NO_NODE; - - ret = register_memory(mem); -diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c -index 4fcc1a6fb724c..fbfb01ff18565 100644 ---- a/drivers/base/swnode.c -+++ b/drivers/base/swnode.c -@@ -786,6 +786,9 @@ int software_node_register(const struct software_node *node) - if (software_node_to_swnode(node)) - return -EEXIST; - -+ if (node->parent && !parent) -+ return -EINVAL; -+ - return PTR_ERR_OR_ZERO(swnode_register(node, parent, 0)); - } - EXPORT_SYMBOL_GPL(software_node_register); -diff --git a/drivers/base/test/Makefile b/drivers/base/test/Makefile -index 3ca56367c84b7..2f15fae8625f1 100644 ---- a/drivers/base/test/Makefile -+++ b/drivers/base/test/Makefile -@@ -2,3 +2,4 @@ - obj-$(CONFIG_TEST_ASYNC_DRIVER_PROBE) += test_async_driver_probe.o - - obj-$(CONFIG_KUNIT_DRIVER_PE_TEST) += property-entry-test.o -+CFLAGS_REMOVE_property-entry-test.o += -fplugin-arg-structleak_plugin-byref -fplugin-arg-structleak_plugin-byref-all -diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c -index 5ac1881396afb..227e1be4c6f99 100644 ---- a/drivers/block/rsxx/core.c -+++ b/drivers/block/rsxx/core.c -@@ -871,6 +871,7 @@ static int rsxx_pci_probe(struct pci_dev *dev, - card->event_wq = create_singlethread_workqueue(DRIVER_NAME"_event"); - if (!card->event_wq) { - dev_err(CARD_TO_DEV(card), "Failed card event setup.\n"); -+ st = -ENOMEM; - goto failed_event_handler; - } - -diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c -index 3279969fc99cb..37d11103a706d 100644 ---- a/drivers/block/zram/zram_drv.c -+++ b/drivers/block/zram/zram_drv.c -@@ -628,7 +628,7 @@ static ssize_t writeback_store(struct device *dev, - struct bio_vec bio_vec; - struct page *page; - ssize_t ret = len; -- int mode; -+ int mode, err; - unsigned long blk_idx = 0; - - if (sysfs_streq(buf, "idle")) -@@ -639,8 +639,8 @@ static ssize_t writeback_store(struct device *dev, - if (strncmp(buf, PAGE_WB_SIG, sizeof(PAGE_WB_SIG) - 1)) - return -EINVAL; - -- ret = kstrtol(buf + sizeof(PAGE_WB_SIG) - 1, 10, &index); -- if (ret || index >= nr_pages) -+ if (kstrtol(buf + sizeof(PAGE_WB_SIG) - 1, 10, &index) || -+ index >= nr_pages) - return -EINVAL; - - nr_pages = 1; -@@ -664,7 +664,7 @@ static ssize_t writeback_store(struct device *dev, - goto release_init_lock; - } - -- while (nr_pages--) { -+ for (; nr_pages != 0; index++, nr_pages--) { - struct bio_vec bvec; - - bvec.bv_page = page; -@@ -729,12 +729,17 @@ static ssize_t writeback_store(struct device *dev, - * XXX: A single page IO would be inefficient for write - * but it would be not bad as starter. - */ -- ret = submit_bio_wait(&bio); -- if (ret) { -+ err = submit_bio_wait(&bio); -+ if (err) { - zram_slot_lock(zram, index); - zram_clear_flag(zram, index, ZRAM_UNDER_WB); - zram_clear_flag(zram, index, ZRAM_IDLE); - zram_slot_unlock(zram, index); -+ /* -+ * Return last IO error unless every IO were -+ * not suceeded. -+ */ -+ ret = err; - continue; - } - -diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c -index af26e0695b866..51ed640e527b4 100644 ---- a/drivers/clk/qcom/gdsc.c -+++ b/drivers/clk/qcom/gdsc.c -@@ -183,7 +183,10 @@ static inline int gdsc_assert_reset(struct gdsc *sc) - static inline void gdsc_force_mem_on(struct gdsc *sc) - { - int i; -- u32 mask = RETAIN_MEM | RETAIN_PERIPH; -+ u32 mask = RETAIN_MEM; -+ -+ if (!(sc->flags & NO_RET_PERIPH)) -+ mask |= RETAIN_PERIPH; - - for (i = 0; i < sc->cxc_count; i++) - regmap_update_bits(sc->regmap, sc->cxcs[i], mask, mask); -@@ -192,7 +195,10 @@ static inline void gdsc_force_mem_on(struct gdsc *sc) - static inline void gdsc_clear_mem_on(struct gdsc *sc) - { - int i; -- u32 mask = RETAIN_MEM | RETAIN_PERIPH; -+ u32 mask = RETAIN_MEM; -+ -+ if (!(sc->flags & NO_RET_PERIPH)) -+ mask |= RETAIN_PERIPH; - - for (i = 0; i < sc->cxc_count; i++) - regmap_update_bits(sc->regmap, sc->cxcs[i], mask, 0); -diff --git a/drivers/clk/qcom/gdsc.h b/drivers/clk/qcom/gdsc.h -index bd537438c7932..5bb396b344d16 100644 ---- a/drivers/clk/qcom/gdsc.h -+++ b/drivers/clk/qcom/gdsc.h -@@ -42,7 +42,7 @@ struct gdsc { - #define PWRSTS_ON BIT(2) - #define PWRSTS_OFF_ON (PWRSTS_OFF | PWRSTS_ON) - #define PWRSTS_RET_ON (PWRSTS_RET | PWRSTS_ON) -- const u8 flags; -+ const u16 flags; - #define VOTABLE BIT(0) - #define CLAMP_IO BIT(1) - #define HW_CTRL BIT(2) -@@ -51,6 +51,7 @@ struct gdsc { - #define POLL_CFG_GDSCR BIT(5) - #define ALWAYS_ON BIT(6) - #define RETAIN_FF_ENABLE BIT(7) -+#define NO_RET_PERIPH BIT(8) - struct reset_controller_dev *rcdev; - unsigned int *resets; - unsigned int reset_count; -diff --git a/drivers/clk/qcom/gpucc-msm8998.c b/drivers/clk/qcom/gpucc-msm8998.c -index 9b3923af02a14..1a518c4915b4b 100644 ---- a/drivers/clk/qcom/gpucc-msm8998.c -+++ b/drivers/clk/qcom/gpucc-msm8998.c -@@ -253,12 +253,16 @@ static struct gdsc gpu_cx_gdsc = { - static struct gdsc gpu_gx_gdsc = { - .gdscr = 0x1094, - .clamp_io_ctrl = 0x130, -+ .resets = (unsigned int []){ GPU_GX_BCR }, -+ .reset_count = 1, -+ .cxcs = (unsigned int []){ 0x1098 }, -+ .cxc_count = 1, - .pd = { - .name = "gpu_gx", - }, - .parent = &gpu_cx_gdsc.pd, -- .pwrsts = PWRSTS_OFF_ON, -- .flags = CLAMP_IO | AON_RESET, -+ .pwrsts = PWRSTS_OFF_ON | PWRSTS_RET, -+ .flags = CLAMP_IO | SW_RESET | AON_RESET | NO_RET_PERIPH, - }; - - static struct clk_regmap *gpucc_msm8998_clocks[] = { -diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c -index 2726e77c9e5a9..6de07556665b1 100644 ---- a/drivers/cpufreq/qcom-cpufreq-hw.c -+++ b/drivers/cpufreq/qcom-cpufreq-hw.c -@@ -317,9 +317,9 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy) - } - - base = ioremap(res->start, resource_size(res)); -- if (IS_ERR(base)) { -+ if (!base) { - dev_err(dev, "failed to map resource %pR\n", res); -- ret = PTR_ERR(base); -+ ret = -ENOMEM; - goto release_region; - } - -@@ -368,7 +368,7 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy) - error: - kfree(data); - unmap_base: -- iounmap(data->base); -+ iounmap(base); - release_region: - release_mem_region(res->start, resource_size(res)); - return ret; -diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c -index ec2f3985bef35..26e69788f27a4 100644 ---- a/drivers/firmware/efi/libstub/efi-stub.c -+++ b/drivers/firmware/efi/libstub/efi-stub.c -@@ -96,6 +96,18 @@ static void install_memreserve_table(void) - efi_err("Failed to install memreserve config table!\n"); - } - -+static u32 get_supported_rt_services(void) -+{ -+ const efi_rt_properties_table_t *rt_prop_table; -+ u32 supported = EFI_RT_SUPPORTED_ALL; -+ -+ rt_prop_table = get_efi_config_table(EFI_RT_PROPERTIES_TABLE_GUID); -+ if (rt_prop_table) -+ supported &= rt_prop_table->runtime_services_supported; -+ -+ return supported; -+} -+ - /* - * EFI entry point for the arm/arm64 EFI stubs. This is the entrypoint - * that is described in the PE/COFF header. Most of the code is the same -@@ -250,6 +262,10 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle, - (prop_tbl->memory_protection_attribute & - EFI_PROPERTIES_RUNTIME_MEMORY_PROTECTION_NON_EXECUTABLE_PE_DATA); - -+ /* force efi_novamap if SetVirtualAddressMap() is unsupported */ -+ efi_novamap |= !(get_supported_rt_services() & -+ EFI_RT_SUPPORTED_SET_VIRTUAL_ADDRESS_MAP); -+ - /* hibernation expects the runtime regions to stay in the same place */ - if (!IS_ENABLED(CONFIG_HIBERNATION) && !efi_nokaslr && !flat_va_mapping) { - /* -diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c -index 825b362eb4b7d..6898c27f71f85 100644 ---- a/drivers/gpio/gpio-pca953x.c -+++ b/drivers/gpio/gpio-pca953x.c -@@ -112,8 +112,29 @@ MODULE_DEVICE_TABLE(i2c, pca953x_id); - #ifdef CONFIG_GPIO_PCA953X_IRQ - - #include --#include --#include -+ -+static const struct acpi_gpio_params pca953x_irq_gpios = { 0, 0, true }; -+ -+static const struct acpi_gpio_mapping pca953x_acpi_irq_gpios[] = { -+ { "irq-gpios", &pca953x_irq_gpios, 1, ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER }, -+ { } -+}; -+ -+static int pca953x_acpi_get_irq(struct device *dev) -+{ -+ int ret; -+ -+ ret = devm_acpi_dev_add_driver_gpios(dev, pca953x_acpi_irq_gpios); -+ if (ret) -+ dev_warn(dev, "can't add GPIO ACPI mapping\n"); -+ -+ ret = acpi_dev_gpio_irq_get_by(ACPI_COMPANION(dev), "irq-gpios", 0); -+ if (ret < 0) -+ return ret; -+ -+ dev_info(dev, "ACPI interrupt quirk (IRQ %d)\n", ret); -+ return ret; -+} - - static const struct dmi_system_id pca953x_dmi_acpi_irq_info[] = { - { -@@ -132,59 +153,6 @@ static const struct dmi_system_id pca953x_dmi_acpi_irq_info[] = { - }, - {} - }; -- --#ifdef CONFIG_ACPI --static int pca953x_acpi_get_pin(struct acpi_resource *ares, void *data) --{ -- struct acpi_resource_gpio *agpio; -- int *pin = data; -- -- if (acpi_gpio_get_irq_resource(ares, &agpio)) -- *pin = agpio->pin_table[0]; -- return 1; --} -- --static int pca953x_acpi_find_pin(struct device *dev) --{ -- struct acpi_device *adev = ACPI_COMPANION(dev); -- int pin = -ENOENT, ret; -- LIST_HEAD(r); -- -- ret = acpi_dev_get_resources(adev, &r, pca953x_acpi_get_pin, &pin); -- acpi_dev_free_resource_list(&r); -- if (ret < 0) -- return ret; -- -- return pin; --} --#else --static inline int pca953x_acpi_find_pin(struct device *dev) { return -ENXIO; } --#endif -- --static int pca953x_acpi_get_irq(struct device *dev) --{ -- int pin, ret; -- -- pin = pca953x_acpi_find_pin(dev); -- if (pin < 0) -- return pin; -- -- dev_info(dev, "Applying ACPI interrupt quirk (GPIO %d)\n", pin); -- -- if (!gpio_is_valid(pin)) -- return -EINVAL; -- -- ret = gpio_request(pin, "pca953x interrupt"); -- if (ret) -- return ret; -- -- ret = gpio_to_irq(pin); -- -- /* When pin is used as an IRQ, no need to keep it requested */ -- gpio_free(pin); -- -- return ret; --} - #endif - - static const struct acpi_device_id pca953x_acpi_ids[] = { -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index e37a57d0a2f07..495f779b2ab99 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -677,6 +677,7 @@ static int acpi_populate_gpio_lookup(struct acpi_resource *ares, void *data) - if (!lookup->desc) { - const struct acpi_resource_gpio *agpio = &ares->data.gpio; - bool gpioint = agpio->connection_type == ACPI_RESOURCE_GPIO_TYPE_INT; -+ struct gpio_desc *desc; - u16 pin_index; - - if (lookup->info.quirks & ACPI_GPIO_QUIRK_ONLY_GPIOIO && gpioint) -@@ -689,8 +690,12 @@ static int acpi_populate_gpio_lookup(struct acpi_resource *ares, void *data) - if (pin_index >= agpio->pin_table_length) - return 1; - -- lookup->desc = acpi_get_gpiod(agpio->resource_source.string_ptr, -+ if (lookup->info.quirks & ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER) -+ desc = gpio_to_desc(agpio->pin_table[pin_index]); -+ else -+ desc = acpi_get_gpiod(agpio->resource_source.string_ptr, - agpio->pin_table[pin_index]); -+ lookup->desc = desc; - lookup->info.pin_config = agpio->pin_config; - lookup->info.debounce = agpio->debounce_timeout; - lookup->info.gpioint = gpioint; -@@ -940,8 +945,9 @@ struct gpio_desc *acpi_node_get_gpiod(struct fwnode_handle *fwnode, - } - - /** -- * acpi_dev_gpio_irq_get() - Find GpioInt and translate it to Linux IRQ number -+ * acpi_dev_gpio_irq_get_by() - Find GpioInt and translate it to Linux IRQ number - * @adev: pointer to a ACPI device to get IRQ from -+ * @name: optional name of GpioInt resource - * @index: index of GpioInt resource (starting from %0) - * - * If the device has one or more GpioInt resources, this function can be -@@ -951,9 +957,12 @@ struct gpio_desc *acpi_node_get_gpiod(struct fwnode_handle *fwnode, - * The function is idempotent, though each time it runs it will configure GPIO - * pin direction according to the flags in GpioInt resource. - * -+ * The function takes optional @name parameter. If the resource has a property -+ * name, then only those will be taken into account. -+ * - * Return: Linux IRQ number (> %0) on success, negative errno on failure. - */ --int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index) -+int acpi_dev_gpio_irq_get_by(struct acpi_device *adev, const char *name, int index) - { - int idx, i; - unsigned int irq_flags; -@@ -963,7 +972,7 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index) - struct acpi_gpio_info info; - struct gpio_desc *desc; - -- desc = acpi_get_gpiod_by_index(adev, NULL, i, &info); -+ desc = acpi_get_gpiod_by_index(adev, name, i, &info); - - /* Ignore -EPROBE_DEFER, it only matters if idx matches */ - if (IS_ERR(desc) && PTR_ERR(desc) != -EPROBE_DEFER) -@@ -1008,7 +1017,7 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index) - } - return -ENOENT; - } --EXPORT_SYMBOL_GPL(acpi_dev_gpio_irq_get); -+EXPORT_SYMBOL_GPL(acpi_dev_gpio_irq_get_by); - - static acpi_status - acpi_gpio_adr_space_handler(u32 function, acpi_physical_address address, -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index 97eec8d8dbdc4..e4cfa27f6893d 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -473,8 +473,12 @@ EXPORT_SYMBOL_GPL(gpiochip_line_is_valid); - static void gpiodevice_release(struct device *dev) - { - struct gpio_device *gdev = dev_get_drvdata(dev); -+ unsigned long flags; - -+ spin_lock_irqsave(&gpio_lock, flags); - list_del(&gdev->list); -+ spin_unlock_irqrestore(&gpio_lock, flags); -+ - ida_free(&gpio_ida, gdev->id); - kfree_const(gdev->label); - kfree(gdev->descs); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index 37fb846af4888..ccdf508aca471 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -179,6 +179,7 @@ extern uint amdgpu_smu_memory_pool_size; - extern uint amdgpu_dc_feature_mask; - extern uint amdgpu_dc_debug_mask; - extern uint amdgpu_dm_abm_level; -+extern int amdgpu_backlight; - extern struct amdgpu_mgpu_info mgpu_info; - extern int amdgpu_ras_enable; - extern uint amdgpu_ras_mask; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c -index 36a741d63ddcf..2e9b16fb3fcd1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c -@@ -903,7 +903,7 @@ void amdgpu_acpi_fini(struct amdgpu_device *adev) - */ - bool amdgpu_acpi_is_s0ix_supported(struct amdgpu_device *adev) - { --#if defined(CONFIG_AMD_PMC) -+#if defined(CONFIG_AMD_PMC) || defined(CONFIG_AMD_PMC_MODULE) - if (acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0) { - if (adev->flags & AMD_IS_APU) - return true; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index 0ffea970d0179..1aed641a3eecc 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -777,6 +777,10 @@ uint amdgpu_dm_abm_level; - MODULE_PARM_DESC(abmlevel, "ABM level (0 = off (default), 1-4 = backlight reduction level) "); - module_param_named(abmlevel, amdgpu_dm_abm_level, uint, 0444); - -+int amdgpu_backlight = -1; -+MODULE_PARM_DESC(backlight, "Backlight control (0 = pwm, 1 = aux, -1 auto (default))"); -+module_param_named(backlight, amdgpu_backlight, bint, 0444); -+ - /** - * DOC: tmz (int) - * Trusted Memory Zone (TMZ) is a method to protect data being written -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 947cd923fb4c3..1d26e82602f75 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2209,6 +2209,11 @@ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector) - caps->ext_caps->bits.hdr_aux_backlight_control == 1) - caps->aux_support = true; - -+ if (amdgpu_backlight == 0) -+ caps->aux_support = false; -+ else if (amdgpu_backlight == 1) -+ caps->aux_support = true; -+ - /* From the specification (CTA-861-G), for calculating the maximum - * luminance we need to use: - * Luminance = 50*2**(CV/32) -@@ -3127,19 +3132,6 @@ static void amdgpu_dm_update_backlight_caps(struct amdgpu_display_manager *dm) - #endif - } - --static int set_backlight_via_aux(struct dc_link *link, uint32_t brightness) --{ -- bool rc; -- -- if (!link) -- return 1; -- -- rc = dc_link_set_backlight_level_nits(link, true, brightness, -- AUX_BL_DEFAULT_TRANSITION_TIME_MS); -- -- return rc ? 0 : 1; --} -- - static int get_brightness_range(const struct amdgpu_dm_backlight_caps *caps, - unsigned *min, unsigned *max) - { -@@ -3202,9 +3194,10 @@ static int amdgpu_dm_backlight_update_status(struct backlight_device *bd) - brightness = convert_brightness_from_user(&caps, bd->props.brightness); - // Change brightness based on AUX property - if (caps.aux_support) -- return set_backlight_via_aux(link, brightness); -- -- rc = dc_link_set_backlight_level(dm->backlight_link, brightness, 0); -+ rc = dc_link_set_backlight_level_nits(link, true, brightness, -+ AUX_BL_DEFAULT_TRANSITION_TIME_MS); -+ else -+ rc = dc_link_set_backlight_level(dm->backlight_link, brightness, 0); - - return rc ? 0 : 1; - } -@@ -3212,11 +3205,27 @@ static int amdgpu_dm_backlight_update_status(struct backlight_device *bd) - static int amdgpu_dm_backlight_get_brightness(struct backlight_device *bd) - { - struct amdgpu_display_manager *dm = bl_get_data(bd); -- int ret = dc_link_get_backlight_level(dm->backlight_link); -+ struct amdgpu_dm_backlight_caps caps; -+ -+ amdgpu_dm_update_backlight_caps(dm); -+ caps = dm->backlight_caps; -+ -+ if (caps.aux_support) { -+ struct dc_link *link = (struct dc_link *)dm->backlight_link; -+ u32 avg, peak; -+ bool rc; - -- if (ret == DC_ERROR_UNEXPECTED) -- return bd->props.brightness; -- return convert_brightness_to_user(&dm->backlight_caps, ret); -+ rc = dc_link_get_backlight_level_nits(link, &avg, &peak); -+ if (!rc) -+ return bd->props.brightness; -+ return convert_brightness_to_user(&caps, avg); -+ } else { -+ int ret = dc_link_get_backlight_level(dm->backlight_link); -+ -+ if (ret == DC_ERROR_UNEXPECTED) -+ return bd->props.brightness; -+ return convert_brightness_to_user(&caps, ret); -+ } - } - - static const struct backlight_ops amdgpu_dm_backlight_ops = { -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c -index 278ade3a90ccf..32cb5ce8bcd0d 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c -@@ -2571,7 +2571,6 @@ bool dc_link_set_backlight_level(const struct dc_link *link, - if (pipe_ctx->plane_state == NULL) - frame_ramp = 0; - } else { -- ASSERT(false); - return false; - } - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -index 072f8c8809243..94ee2cab26b7c 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -@@ -1062,8 +1062,6 @@ static void patch_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_s - { - int i; - -- DC_FP_START(); -- - if (dc->bb_overrides.sr_exit_time_ns) { - for (i = 0; i < WM_SET_COUNT; i++) { - dc->clk_mgr->bw_params->wm_table.entries[i].sr_exit_time_us = -@@ -1088,8 +1086,6 @@ static void patch_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_s - dc->bb_overrides.dram_clock_change_latency_ns / 1000.0; - } - } -- -- DC_FP_END(); - } - - void dcn21_calculate_wm( -@@ -1339,7 +1335,7 @@ static noinline bool dcn21_validate_bandwidth_fp(struct dc *dc, - int vlevel = 0; - int pipe_split_from[MAX_PIPES]; - int pipe_cnt = 0; -- display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_KERNEL); -+ display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_ATOMIC); - DC_LOGGER_INIT(dc->ctx->logger); - - BW_VAL_TRACE_COUNT(); -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -index 82676c086ce46..d7794370cb5a1 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -@@ -5216,10 +5216,10 @@ static int smu7_set_watermarks_for_clocks_ranges(struct pp_hwmgr *hwmgr, - for (j = 0; j < dep_sclk_table->count; j++) { - valid_entry = false; - for (k = 0; k < watermarks->num_wm_sets; k++) { -- if (dep_sclk_table->entries[i].clk / 10 >= watermarks->wm_clk_ranges[k].wm_min_eng_clk_in_khz && -- dep_sclk_table->entries[i].clk / 10 < watermarks->wm_clk_ranges[k].wm_max_eng_clk_in_khz && -- dep_mclk_table->entries[i].clk / 10 >= watermarks->wm_clk_ranges[k].wm_min_mem_clk_in_khz && -- dep_mclk_table->entries[i].clk / 10 < watermarks->wm_clk_ranges[k].wm_max_mem_clk_in_khz) { -+ if (dep_sclk_table->entries[i].clk >= watermarks->wm_clk_ranges[k].wm_min_eng_clk_in_khz / 10 && -+ dep_sclk_table->entries[i].clk < watermarks->wm_clk_ranges[k].wm_max_eng_clk_in_khz / 10 && -+ dep_mclk_table->entries[i].clk >= watermarks->wm_clk_ranges[k].wm_min_mem_clk_in_khz / 10 && -+ dep_mclk_table->entries[i].clk < watermarks->wm_clk_ranges[k].wm_max_mem_clk_in_khz / 10) { - valid_entry = true; - table->DisplayWatermark[i][j] = watermarks->wm_clk_ranges[k].wm_set_id; - break; -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c -index 1b47f94e03317..c7a01ea9ed647 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c -@@ -1506,6 +1506,48 @@ static int vega10_populate_single_lclk_level(struct pp_hwmgr *hwmgr, - return 0; - } - -+static int vega10_override_pcie_parameters(struct pp_hwmgr *hwmgr) -+{ -+ struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); -+ struct vega10_hwmgr *data = -+ (struct vega10_hwmgr *)(hwmgr->backend); -+ uint32_t pcie_gen = 0, pcie_width = 0; -+ PPTable_t *pp_table = &(data->smc_state_table.pp_table); -+ int i; -+ -+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4) -+ pcie_gen = 3; -+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) -+ pcie_gen = 2; -+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) -+ pcie_gen = 1; -+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1) -+ pcie_gen = 0; -+ -+ if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X16) -+ pcie_width = 6; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X12) -+ pcie_width = 5; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X8) -+ pcie_width = 4; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X4) -+ pcie_width = 3; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X2) -+ pcie_width = 2; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X1) -+ pcie_width = 1; -+ -+ for (i = 0; i < NUM_LINK_LEVELS; i++) { -+ if (pp_table->PcieGenSpeed[i] > pcie_gen) -+ pp_table->PcieGenSpeed[i] = pcie_gen; -+ -+ if (pp_table->PcieLaneCount[i] > pcie_width) -+ pp_table->PcieLaneCount[i] = pcie_width; -+ } -+ -+ return 0; -+} -+ - static int vega10_populate_smc_link_levels(struct pp_hwmgr *hwmgr) - { - int result = -1; -@@ -2557,6 +2599,11 @@ static int vega10_init_smc_table(struct pp_hwmgr *hwmgr) - "Failed to initialize Link Level!", - return result); - -+ result = vega10_override_pcie_parameters(hwmgr); -+ PP_ASSERT_WITH_CODE(!result, -+ "Failed to override pcie parameters!", -+ return result); -+ - result = vega10_populate_all_graphic_levels(hwmgr); - PP_ASSERT_WITH_CODE(!result, - "Failed to initialize Graphics Level!", -@@ -2923,6 +2970,7 @@ static int vega10_start_dpm(struct pp_hwmgr *hwmgr, uint32_t bitmap) - return 0; - } - -+ - static int vega10_enable_disable_PCC_limit_feature(struct pp_hwmgr *hwmgr, bool enable) - { - struct vega10_hwmgr *data = hwmgr->backend; -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c -index dc206fa88c5e5..62076035029ac 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c -@@ -481,6 +481,67 @@ static void vega12_init_dpm_state(struct vega12_dpm_state *dpm_state) - dpm_state->hard_max_level = 0xffff; - } - -+static int vega12_override_pcie_parameters(struct pp_hwmgr *hwmgr) -+{ -+ struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); -+ struct vega12_hwmgr *data = -+ (struct vega12_hwmgr *)(hwmgr->backend); -+ uint32_t pcie_gen = 0, pcie_width = 0, smu_pcie_arg, pcie_gen_arg, pcie_width_arg; -+ PPTable_t *pp_table = &(data->smc_state_table.pp_table); -+ int i; -+ int ret; -+ -+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4) -+ pcie_gen = 3; -+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) -+ pcie_gen = 2; -+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) -+ pcie_gen = 1; -+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1) -+ pcie_gen = 0; -+ -+ if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X16) -+ pcie_width = 6; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X12) -+ pcie_width = 5; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X8) -+ pcie_width = 4; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X4) -+ pcie_width = 3; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X2) -+ pcie_width = 2; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X1) -+ pcie_width = 1; -+ -+ /* Bit 31:16: LCLK DPM level. 0 is DPM0, and 1 is DPM1 -+ * Bit 15:8: PCIE GEN, 0 to 3 corresponds to GEN1 to GEN4 -+ * Bit 7:0: PCIE lane width, 1 to 7 corresponds is x1 to x32 -+ */ -+ for (i = 0; i < NUM_LINK_LEVELS; i++) { -+ pcie_gen_arg = (pp_table->PcieGenSpeed[i] > pcie_gen) ? pcie_gen : -+ pp_table->PcieGenSpeed[i]; -+ pcie_width_arg = (pp_table->PcieLaneCount[i] > pcie_width) ? pcie_width : -+ pp_table->PcieLaneCount[i]; -+ -+ if (pcie_gen_arg != pp_table->PcieGenSpeed[i] || pcie_width_arg != -+ pp_table->PcieLaneCount[i]) { -+ smu_pcie_arg = (i << 16) | (pcie_gen_arg << 8) | pcie_width_arg; -+ ret = smum_send_msg_to_smc_with_parameter(hwmgr, -+ PPSMC_MSG_OverridePcieParameters, smu_pcie_arg, -+ NULL); -+ PP_ASSERT_WITH_CODE(!ret, -+ "[OverridePcieParameters] Attempt to override pcie params failed!", -+ return ret); -+ } -+ -+ /* update the pptable */ -+ pp_table->PcieGenSpeed[i] = pcie_gen_arg; -+ pp_table->PcieLaneCount[i] = pcie_width_arg; -+ } -+ -+ return 0; -+} -+ - static int vega12_get_number_of_dpm_level(struct pp_hwmgr *hwmgr, - PPCLK_e clk_id, uint32_t *num_of_levels) - { -@@ -969,6 +1030,11 @@ static int vega12_enable_dpm_tasks(struct pp_hwmgr *hwmgr) - "Failed to enable all smu features!", - return result); - -+ result = vega12_override_pcie_parameters(hwmgr); -+ PP_ASSERT_WITH_CODE(!result, -+ "[EnableDPMTasks] Failed to override pcie parameters!", -+ return result); -+ - tmp_result = vega12_power_control_set_level(hwmgr); - PP_ASSERT_WITH_CODE(!tmp_result, - "Failed to power control set level!", -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c -index da84012b7fd51..251979c059c8b 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c -@@ -832,7 +832,9 @@ static int vega20_override_pcie_parameters(struct pp_hwmgr *hwmgr) - struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); - struct vega20_hwmgr *data = - (struct vega20_hwmgr *)(hwmgr->backend); -- uint32_t pcie_gen = 0, pcie_width = 0, smu_pcie_arg; -+ uint32_t pcie_gen = 0, pcie_width = 0, smu_pcie_arg, pcie_gen_arg, pcie_width_arg; -+ PPTable_t *pp_table = &(data->smc_state_table.pp_table); -+ int i; - int ret; - - if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4) -@@ -861,17 +863,27 @@ static int vega20_override_pcie_parameters(struct pp_hwmgr *hwmgr) - * Bit 15:8: PCIE GEN, 0 to 3 corresponds to GEN1 to GEN4 - * Bit 7:0: PCIE lane width, 1 to 7 corresponds is x1 to x32 - */ -- smu_pcie_arg = (1 << 16) | (pcie_gen << 8) | pcie_width; -- ret = smum_send_msg_to_smc_with_parameter(hwmgr, -- PPSMC_MSG_OverridePcieParameters, smu_pcie_arg, -- NULL); -- PP_ASSERT_WITH_CODE(!ret, -- "[OverridePcieParameters] Attempt to override pcie params failed!", -- return ret); -+ for (i = 0; i < NUM_LINK_LEVELS; i++) { -+ pcie_gen_arg = (pp_table->PcieGenSpeed[i] > pcie_gen) ? pcie_gen : -+ pp_table->PcieGenSpeed[i]; -+ pcie_width_arg = (pp_table->PcieLaneCount[i] > pcie_width) ? pcie_width : -+ pp_table->PcieLaneCount[i]; -+ -+ if (pcie_gen_arg != pp_table->PcieGenSpeed[i] || pcie_width_arg != -+ pp_table->PcieLaneCount[i]) { -+ smu_pcie_arg = (i << 16) | (pcie_gen_arg << 8) | pcie_width_arg; -+ ret = smum_send_msg_to_smc_with_parameter(hwmgr, -+ PPSMC_MSG_OverridePcieParameters, smu_pcie_arg, -+ NULL); -+ PP_ASSERT_WITH_CODE(!ret, -+ "[OverridePcieParameters] Attempt to override pcie params failed!", -+ return ret); -+ } - -- data->pcie_parameters_override = true; -- data->pcie_gen_level1 = pcie_gen; -- data->pcie_width_level1 = pcie_width; -+ /* update the pptable */ -+ pp_table->PcieGenSpeed[i] = pcie_gen_arg; -+ pp_table->PcieLaneCount[i] = pcie_width_arg; -+ } - - return 0; - } -@@ -3320,9 +3332,7 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr, - data->od8_settings.od8_settings_array; - OverDriveTable_t *od_table = - &(data->smc_state_table.overdrive_table); -- struct phm_ppt_v3_information *pptable_information = -- (struct phm_ppt_v3_information *)hwmgr->pptable; -- PPTable_t *pptable = (PPTable_t *)pptable_information->smc_pptable; -+ PPTable_t *pptable = &(data->smc_state_table.pp_table); - struct pp_clock_levels_with_latency clocks; - struct vega20_single_dpm_table *fclk_dpm_table = - &(data->dpm_table.fclk_table); -@@ -3421,13 +3431,9 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr, - current_lane_width = - vega20_get_current_pcie_link_width_level(hwmgr); - for (i = 0; i < NUM_LINK_LEVELS; i++) { -- if (i == 1 && data->pcie_parameters_override) { -- gen_speed = data->pcie_gen_level1; -- lane_width = data->pcie_width_level1; -- } else { -- gen_speed = pptable->PcieGenSpeed[i]; -- lane_width = pptable->PcieLaneCount[i]; -- } -+ gen_speed = pptable->PcieGenSpeed[i]; -+ lane_width = pptable->PcieLaneCount[i]; -+ - size += sprintf(buf + size, "%d: %s %s %dMhz %s\n", i, - (gen_speed == 0) ? "2.5GT/s," : - (gen_speed == 1) ? "5.0GT/s," : -diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c -index e82db0f4e7715..080fd437fd43c 100644 ---- a/drivers/gpu/drm/drm_fb_helper.c -+++ b/drivers/gpu/drm/drm_fb_helper.c -@@ -2043,7 +2043,7 @@ static void drm_fbdev_cleanup(struct drm_fb_helper *fb_helper) - - if (shadow) - vfree(shadow); -- else -+ else if (fb_helper->buffer) - drm_client_buffer_vunmap(fb_helper->buffer); - - drm_client_framebuffer_delete(fb_helper->buffer); -diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c -index 9825c378dfa6d..6d625cee7a6af 100644 ---- a/drivers/gpu/drm/drm_gem_shmem_helper.c -+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c -@@ -357,13 +357,14 @@ static void drm_gem_shmem_vunmap_locked(struct drm_gem_shmem_object *shmem, - if (--shmem->vmap_use_count > 0) - return; - -- if (obj->import_attach) -+ if (obj->import_attach) { - dma_buf_vunmap(obj->import_attach->dmabuf, map); -- else -+ } else { - vunmap(shmem->vaddr); -+ drm_gem_shmem_put_pages(shmem); -+ } - - shmem->vaddr = NULL; -- drm_gem_shmem_put_pages(shmem); - } - - /* -@@ -525,14 +526,28 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf) - struct drm_gem_object *obj = vma->vm_private_data; - struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); - loff_t num_pages = obj->size >> PAGE_SHIFT; -+ vm_fault_t ret; - struct page *page; -+ pgoff_t page_offset; - -- if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages)) -- return VM_FAULT_SIGBUS; -+ /* We don't use vmf->pgoff since that has the fake offset */ -+ page_offset = (vmf->address - vma->vm_start) >> PAGE_SHIFT; - -- page = shmem->pages[vmf->pgoff]; -+ mutex_lock(&shmem->pages_lock); - -- return vmf_insert_page(vma, vmf->address, page); -+ if (page_offset >= num_pages || -+ WARN_ON_ONCE(!shmem->pages) || -+ shmem->madv < 0) { -+ ret = VM_FAULT_SIGBUS; -+ } else { -+ page = shmem->pages[page_offset]; -+ -+ ret = vmf_insert_page(vma, vmf->address, page); -+ } -+ -+ mutex_unlock(&shmem->pages_lock); -+ -+ return ret; - } - - static void drm_gem_shmem_vm_open(struct vm_area_struct *vma) -@@ -581,9 +596,6 @@ int drm_gem_shmem_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma) - struct drm_gem_shmem_object *shmem; - int ret; - -- /* Remove the fake offset */ -- vma->vm_pgoff -= drm_vma_node_start(&obj->vma_node); -- - if (obj->import_attach) { - /* Drop the reference drm_gem_mmap_obj() acquired.*/ - drm_gem_object_put(obj); -diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c -index f86448ab1fe04..dc734d4828a17 100644 ---- a/drivers/gpu/drm/drm_ioc32.c -+++ b/drivers/gpu/drm/drm_ioc32.c -@@ -99,6 +99,8 @@ static int compat_drm_version(struct file *file, unsigned int cmd, - if (copy_from_user(&v32, (void __user *)arg, sizeof(v32))) - return -EFAULT; - -+ memset(&v, 0, sizeof(v)); -+ - v = (struct drm_version) { - .name_len = v32.name_len, - .name = compat_ptr(v32.name), -@@ -137,6 +139,9 @@ static int compat_drm_getunique(struct file *file, unsigned int cmd, - - if (copy_from_user(&uq32, (void __user *)arg, sizeof(uq32))) - return -EFAULT; -+ -+ memset(&uq, 0, sizeof(uq)); -+ - uq = (struct drm_unique){ - .unique_len = uq32.unique_len, - .unique = compat_ptr(uq32.unique), -@@ -265,6 +270,8 @@ static int compat_drm_getclient(struct file *file, unsigned int cmd, - if (copy_from_user(&c32, argp, sizeof(c32))) - return -EFAULT; - -+ memset(&client, 0, sizeof(client)); -+ - client.idx = c32.idx; - - err = drm_ioctl_kernel(file, drm_getclient, &client, 0); -@@ -852,6 +859,8 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd, - if (copy_from_user(&req32, argp, sizeof(req32))) - return -EFAULT; - -+ memset(&req, 0, sizeof(req)); -+ - req.request.type = req32.request.type; - req.request.sequence = req32.request.sequence; - req.request.signal = req32.request.signal; -@@ -889,6 +898,8 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd, - struct drm_mode_fb_cmd2 req64; - int err; - -+ memset(&req64, 0, sizeof(req64)); -+ - if (copy_from_user(&req64, argp, - offsetof(drm_mode_fb_cmd232_t, modifier))) - return -EFAULT; -diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c -index 0b31670343f5a..346aa2057bad0 100644 ---- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c -+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c -@@ -709,9 +709,12 @@ static int engine_setup_common(struct intel_engine_cs *engine) - goto err_status; - } - -+ err = intel_engine_init_cmd_parser(engine); -+ if (err) -+ goto err_cmd_parser; -+ - intel_engine_init_active(engine, ENGINE_PHYSICAL); - intel_engine_init_execlists(engine); -- intel_engine_init_cmd_parser(engine); - intel_engine_init__pm(engine); - intel_engine_init_retire(engine); - -@@ -725,6 +728,8 @@ static int engine_setup_common(struct intel_engine_cs *engine) - - return 0; - -+err_cmd_parser: -+ intel_breadcrumbs_free(engine->breadcrumbs); - err_status: - cleanup_status_page(engine); - return err; -diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c -index b0899b665e852..da1d6d58fc429 100644 ---- a/drivers/gpu/drm/i915/i915_cmd_parser.c -+++ b/drivers/gpu/drm/i915/i915_cmd_parser.c -@@ -939,7 +939,7 @@ static void fini_hash_table(struct intel_engine_cs *engine) - * struct intel_engine_cs based on whether the platform requires software - * command parsing. - */ --void intel_engine_init_cmd_parser(struct intel_engine_cs *engine) -+int intel_engine_init_cmd_parser(struct intel_engine_cs *engine) - { - const struct drm_i915_cmd_table *cmd_tables; - int cmd_table_count; -@@ -947,7 +947,7 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine) - - if (!IS_GEN(engine->i915, 7) && !(IS_GEN(engine->i915, 9) && - engine->class == COPY_ENGINE_CLASS)) -- return; -+ return 0; - - switch (engine->class) { - case RENDER_CLASS: -@@ -1012,19 +1012,19 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine) - break; - default: - MISSING_CASE(engine->class); -- return; -+ goto out; - } - - if (!validate_cmds_sorted(engine, cmd_tables, cmd_table_count)) { - drm_err(&engine->i915->drm, - "%s: command descriptions are not sorted\n", - engine->name); -- return; -+ goto out; - } - if (!validate_regs_sorted(engine)) { - drm_err(&engine->i915->drm, - "%s: registers are not sorted\n", engine->name); -- return; -+ goto out; - } - - ret = init_hash_table(engine, cmd_tables, cmd_table_count); -@@ -1032,10 +1032,17 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine) - drm_err(&engine->i915->drm, - "%s: initialised failed!\n", engine->name); - fini_hash_table(engine); -- return; -+ goto out; - } - - engine->flags |= I915_ENGINE_USING_CMD_PARSER; -+ -+out: -+ if (intel_engine_requires_cmd_parser(engine) && -+ !intel_engine_using_cmd_parser(engine)) -+ return -EINVAL; -+ -+ return 0; - } - - /** -diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h -index c6964f82a1bb6..bd5f76a28d68d 100644 ---- a/drivers/gpu/drm/i915/i915_drv.h -+++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -1947,7 +1947,7 @@ const char *i915_cache_level_str(struct drm_i915_private *i915, int type); - - /* i915_cmd_parser.c */ - int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv); --void intel_engine_init_cmd_parser(struct intel_engine_cs *engine); -+int intel_engine_init_cmd_parser(struct intel_engine_cs *engine); - void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine); - int intel_engine_cmd_parser(struct intel_engine_cs *engine, - struct i915_vma *batch, -diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c -index 42c5d3246cfcb..453d8b4c5763d 100644 ---- a/drivers/gpu/drm/meson/meson_drv.c -+++ b/drivers/gpu/drm/meson/meson_drv.c -@@ -482,6 +482,16 @@ static int meson_probe_remote(struct platform_device *pdev, - return count; - } - -+static void meson_drv_shutdown(struct platform_device *pdev) -+{ -+ struct meson_drm *priv = dev_get_drvdata(&pdev->dev); -+ struct drm_device *drm = priv->drm; -+ -+ DRM_DEBUG_DRIVER("\n"); -+ drm_kms_helper_poll_fini(drm); -+ drm_atomic_helper_shutdown(drm); -+} -+ - static int meson_drv_probe(struct platform_device *pdev) - { - struct component_match *match = NULL; -@@ -553,6 +563,7 @@ static const struct dev_pm_ops meson_drv_pm_ops = { - - static struct platform_driver meson_drm_platform_driver = { - .probe = meson_drv_probe, -+ .shutdown = meson_drv_shutdown, - .driver = { - .name = "meson-drm", - .of_match_table = dt_match, -diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c -index 7ea367a5444dd..f1c9a22083beb 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_bo.c -+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c -@@ -556,7 +556,8 @@ nouveau_bo_sync_for_device(struct nouveau_bo *nvbo) - if (nvbo->force_coherent) - return; - -- for (i = 0; i < ttm_dma->num_pages; ++i) { -+ i = 0; -+ while (i < ttm_dma->num_pages) { - struct page *p = ttm_dma->pages[i]; - size_t num_pages = 1; - -@@ -587,7 +588,8 @@ nouveau_bo_sync_for_cpu(struct nouveau_bo *nvbo) - if (nvbo->force_coherent) - return; - -- for (i = 0; i < ttm_dma->num_pages; ++i) { -+ i = 0; -+ while (i < ttm_dma->num_pages) { - struct page *p = ttm_dma->pages[i]; - size_t num_pages = 1; - -diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c -index 012bce0cdb65c..10738e04c09b8 100644 ---- a/drivers/gpu/drm/qxl/qxl_display.c -+++ b/drivers/gpu/drm/qxl/qxl_display.c -@@ -328,6 +328,7 @@ static void qxl_crtc_update_monitors_config(struct drm_crtc *crtc, - - head.id = i; - head.flags = 0; -+ head.surface_id = 0; - oldcount = qdev->monitors_config->count; - if (crtc->state->active) { - struct drm_display_mode *mode = &crtc->mode; -diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h -index 5f3adba43e478..aa3b589f30a18 100644 ---- a/drivers/gpu/drm/radeon/radeon.h -+++ b/drivers/gpu/drm/radeon/radeon.h -@@ -575,6 +575,8 @@ struct radeon_gem { - struct list_head objects; - }; - -+extern const struct drm_gem_object_funcs radeon_gem_object_funcs; -+ - int radeon_gem_init(struct radeon_device *rdev); - void radeon_gem_fini(struct radeon_device *rdev); - int radeon_gem_object_create(struct radeon_device *rdev, unsigned long size, -diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c -index b6b21d2e72624..f17f621077deb 100644 ---- a/drivers/gpu/drm/radeon/radeon_gem.c -+++ b/drivers/gpu/drm/radeon/radeon_gem.c -@@ -43,7 +43,7 @@ struct sg_table *radeon_gem_prime_get_sg_table(struct drm_gem_object *obj); - int radeon_gem_prime_pin(struct drm_gem_object *obj); - void radeon_gem_prime_unpin(struct drm_gem_object *obj); - --static const struct drm_gem_object_funcs radeon_gem_object_funcs; -+const struct drm_gem_object_funcs radeon_gem_object_funcs; - - static void radeon_gem_object_free(struct drm_gem_object *gobj) - { -@@ -227,7 +227,7 @@ static int radeon_gem_handle_lockup(struct radeon_device *rdev, int r) - return r; - } - --static const struct drm_gem_object_funcs radeon_gem_object_funcs = { -+const struct drm_gem_object_funcs radeon_gem_object_funcs = { - .free = radeon_gem_object_free, - .open = radeon_gem_object_open, - .close = radeon_gem_object_close, -diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c -index dd482edc819c5..d0ff3ce68a4f5 100644 ---- a/drivers/gpu/drm/radeon/radeon_prime.c -+++ b/drivers/gpu/drm/radeon/radeon_prime.c -@@ -56,6 +56,8 @@ struct drm_gem_object *radeon_gem_prime_import_sg_table(struct drm_device *dev, - if (ret) - return ERR_PTR(ret); - -+ bo->tbo.base.funcs = &radeon_gem_object_funcs; -+ - mutex_lock(&rdev->gem.mutex); - list_add_tail(&bo->list, &rdev->gem.objects); - mutex_unlock(&rdev->gem.mutex); -diff --git a/drivers/gpu/drm/tiny/gm12u320.c b/drivers/gpu/drm/tiny/gm12u320.c -index 33f65f4626e5a..23866a54e3f91 100644 ---- a/drivers/gpu/drm/tiny/gm12u320.c -+++ b/drivers/gpu/drm/tiny/gm12u320.c -@@ -83,6 +83,7 @@ MODULE_PARM_DESC(eco_mode, "Turn on Eco mode (less bright, more silent)"); - - struct gm12u320_device { - struct drm_device dev; -+ struct device *dmadev; - struct drm_simple_display_pipe pipe; - struct drm_connector conn; - unsigned char *cmd_buf; -@@ -601,6 +602,22 @@ static const uint64_t gm12u320_pipe_modifiers[] = { - DRM_FORMAT_MOD_INVALID - }; - -+/* -+ * FIXME: Dma-buf sharing requires DMA support by the importing device. -+ * This function is a workaround to make USB devices work as well. -+ * See todo.rst for how to fix the issue in the dma-buf framework. -+ */ -+static struct drm_gem_object *gm12u320_gem_prime_import(struct drm_device *dev, -+ struct dma_buf *dma_buf) -+{ -+ struct gm12u320_device *gm12u320 = to_gm12u320(dev); -+ -+ if (!gm12u320->dmadev) -+ return ERR_PTR(-ENODEV); -+ -+ return drm_gem_prime_import_dev(dev, dma_buf, gm12u320->dmadev); -+} -+ - DEFINE_DRM_GEM_FOPS(gm12u320_fops); - - static const struct drm_driver gm12u320_drm_driver = { -@@ -614,6 +631,7 @@ static const struct drm_driver gm12u320_drm_driver = { - - .fops = &gm12u320_fops, - DRM_GEM_SHMEM_DRIVER_OPS, -+ .gem_prime_import = gm12u320_gem_prime_import, - }; - - static const struct drm_mode_config_funcs gm12u320_mode_config_funcs = { -@@ -640,15 +658,18 @@ static int gm12u320_usb_probe(struct usb_interface *interface, - struct gm12u320_device, dev); - if (IS_ERR(gm12u320)) - return PTR_ERR(gm12u320); -+ dev = &gm12u320->dev; -+ -+ gm12u320->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev)); -+ if (!gm12u320->dmadev) -+ drm_warn(dev, "buffer sharing not supported"); /* not an error */ - - INIT_DELAYED_WORK(&gm12u320->fb_update.work, gm12u320_fb_update_work); - mutex_init(&gm12u320->fb_update.lock); - -- dev = &gm12u320->dev; -- - ret = drmm_mode_config_init(dev); - if (ret) -- return ret; -+ goto err_put_device; - - dev->mode_config.min_width = GM12U320_USER_WIDTH; - dev->mode_config.max_width = GM12U320_USER_WIDTH; -@@ -658,15 +679,15 @@ static int gm12u320_usb_probe(struct usb_interface *interface, - - ret = gm12u320_usb_alloc(gm12u320); - if (ret) -- return ret; -+ goto err_put_device; - - ret = gm12u320_set_ecomode(gm12u320); - if (ret) -- return ret; -+ goto err_put_device; - - ret = gm12u320_conn_init(gm12u320); - if (ret) -- return ret; -+ goto err_put_device; - - ret = drm_simple_display_pipe_init(&gm12u320->dev, - &gm12u320->pipe, -@@ -676,24 +697,31 @@ static int gm12u320_usb_probe(struct usb_interface *interface, - gm12u320_pipe_modifiers, - &gm12u320->conn); - if (ret) -- return ret; -+ goto err_put_device; - - drm_mode_config_reset(dev); - - usb_set_intfdata(interface, dev); - ret = drm_dev_register(dev, 0); - if (ret) -- return ret; -+ goto err_put_device; - - drm_fbdev_generic_setup(dev, 0); - - return 0; -+ -+err_put_device: -+ put_device(gm12u320->dmadev); -+ return ret; - } - - static void gm12u320_usb_disconnect(struct usb_interface *interface) - { - struct drm_device *dev = usb_get_intfdata(interface); -+ struct gm12u320_device *gm12u320 = to_gm12u320(dev); - -+ put_device(gm12u320->dmadev); -+ gm12u320->dmadev = NULL; - drm_dev_unplug(dev); - drm_atomic_helper_shutdown(dev); - } -diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c -index 6e27cb1bf48b2..4eb6efb8b8c02 100644 ---- a/drivers/gpu/drm/ttm/ttm_pool.c -+++ b/drivers/gpu/drm/ttm/ttm_pool.c -@@ -268,13 +268,13 @@ static void ttm_pool_type_init(struct ttm_pool_type *pt, struct ttm_pool *pool, - /* Remove a pool_type from the global shrinker list and free all pages */ - static void ttm_pool_type_fini(struct ttm_pool_type *pt) - { -- struct page *p, *tmp; -+ struct page *p; - - mutex_lock(&shrinker_lock); - list_del(&pt->shrinker_list); - mutex_unlock(&shrinker_lock); - -- list_for_each_entry_safe(p, tmp, &pt->pages, lru) -+ while ((p = ttm_pool_type_take(pt))) - ttm_pool_free_page(pt->pool, pt->caching, pt->order, p); - } - -diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c -index 9269092697d8c..5703277c6f527 100644 ---- a/drivers/gpu/drm/udl/udl_drv.c -+++ b/drivers/gpu/drm/udl/udl_drv.c -@@ -32,6 +32,22 @@ static int udl_usb_resume(struct usb_interface *interface) - return drm_mode_config_helper_resume(dev); - } - -+/* -+ * FIXME: Dma-buf sharing requires DMA support by the importing device. -+ * This function is a workaround to make USB devices work as well. -+ * See todo.rst for how to fix the issue in the dma-buf framework. -+ */ -+static struct drm_gem_object *udl_driver_gem_prime_import(struct drm_device *dev, -+ struct dma_buf *dma_buf) -+{ -+ struct udl_device *udl = to_udl(dev); -+ -+ if (!udl->dmadev) -+ return ERR_PTR(-ENODEV); -+ -+ return drm_gem_prime_import_dev(dev, dma_buf, udl->dmadev); -+} -+ - DEFINE_DRM_GEM_FOPS(udl_driver_fops); - - static const struct drm_driver driver = { -@@ -40,6 +56,7 @@ static const struct drm_driver driver = { - /* GEM hooks */ - .fops = &udl_driver_fops, - DRM_GEM_SHMEM_DRIVER_OPS, -+ .gem_prime_import = udl_driver_gem_prime_import, - - .name = DRIVER_NAME, - .desc = DRIVER_DESC, -diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h -index 875e73551ae98..cc16a13316e4e 100644 ---- a/drivers/gpu/drm/udl/udl_drv.h -+++ b/drivers/gpu/drm/udl/udl_drv.h -@@ -50,6 +50,7 @@ struct urb_list { - struct udl_device { - struct drm_device drm; - struct device *dev; -+ struct device *dmadev; - - struct drm_simple_display_pipe display_pipe; - -diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c -index 0e2a376cb0752..853f147036f6b 100644 ---- a/drivers/gpu/drm/udl/udl_main.c -+++ b/drivers/gpu/drm/udl/udl_main.c -@@ -315,6 +315,10 @@ int udl_init(struct udl_device *udl) - - DRM_DEBUG("\n"); - -+ udl->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev)); -+ if (!udl->dmadev) -+ drm_warn(dev, "buffer sharing not supported"); /* not an error */ -+ - mutex_init(&udl->gem_lock); - - if (!udl_parse_vendor_descriptor(udl)) { -@@ -343,12 +347,18 @@ int udl_init(struct udl_device *udl) - err: - if (udl->urbs.count) - udl_free_urb_list(dev); -+ put_device(udl->dmadev); - DRM_ERROR("%d\n", ret); - return ret; - } - - int udl_drop_usb(struct drm_device *dev) - { -+ struct udl_device *udl = to_udl(dev); -+ - udl_free_urb_list(dev); -+ put_device(udl->dmadev); -+ udl->dmadev = NULL; -+ - return 0; - } -diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c -index fcdc922bc9733..271bd8d243395 100644 ---- a/drivers/hid/hid-logitech-dj.c -+++ b/drivers/hid/hid-logitech-dj.c -@@ -995,7 +995,12 @@ static void logi_hidpp_recv_queue_notif(struct hid_device *hdev, - workitem.reports_supported |= STD_KEYBOARD; - break; - case 0x0d: -- device_type = "eQUAD Lightspeed 1_1"; -+ device_type = "eQUAD Lightspeed 1.1"; -+ logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem); -+ workitem.reports_supported |= STD_KEYBOARD; -+ break; -+ case 0x0f: -+ device_type = "eQUAD Lightspeed 1.2"; - logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem); - workitem.reports_supported |= STD_KEYBOARD; - break; -diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c -index 217def2d7cb44..ad6630e3cc779 100644 ---- a/drivers/i2c/busses/i2c-rcar.c -+++ b/drivers/i2c/busses/i2c-rcar.c -@@ -91,7 +91,6 @@ - - #define RCAR_BUS_PHASE_START (MDBS | MIE | ESG) - #define RCAR_BUS_PHASE_DATA (MDBS | MIE) --#define RCAR_BUS_MASK_DATA (~(ESG | FSB) & 0xFF) - #define RCAR_BUS_PHASE_STOP (MDBS | MIE | FSB) - - #define RCAR_IRQ_SEND (MNR | MAL | MST | MAT | MDE) -@@ -120,6 +119,7 @@ enum rcar_i2c_type { - }; - - struct rcar_i2c_priv { -+ u32 flags; - void __iomem *io; - struct i2c_adapter adap; - struct i2c_msg *msg; -@@ -130,7 +130,6 @@ struct rcar_i2c_priv { - - int pos; - u32 icccr; -- u32 flags; - u8 recovery_icmcr; /* protected by adapter lock */ - enum rcar_i2c_type devtype; - struct i2c_client *slave; -@@ -621,7 +620,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) - /* - * This driver has a lock-free design because there are IP cores (at least - * R-Car Gen2) which have an inherent race condition in their hardware design. -- * There, we need to clear RCAR_BUS_MASK_DATA bits as soon as possible after -+ * There, we need to switch to RCAR_BUS_PHASE_DATA as soon as possible after - * the interrupt was generated, otherwise an unwanted repeated message gets - * generated. It turned out that taking a spinlock at the beginning of the ISR - * was already causing repeated messages. Thus, this driver was converted to -@@ -630,13 +629,11 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) - static irqreturn_t rcar_i2c_irq(int irq, void *ptr) - { - struct rcar_i2c_priv *priv = ptr; -- u32 msr, val; -+ u32 msr; - - /* Clear START or STOP immediately, except for REPSTART after read */ -- if (likely(!(priv->flags & ID_P_REP_AFTER_RD))) { -- val = rcar_i2c_read(priv, ICMCR); -- rcar_i2c_write(priv, ICMCR, val & RCAR_BUS_MASK_DATA); -- } -+ if (likely(!(priv->flags & ID_P_REP_AFTER_RD))) -+ rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA); - - msr = rcar_i2c_read(priv, ICMSR); - -diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/applespi.c -index d22223154177f..27e87c45edf25 100644 ---- a/drivers/input/keyboard/applespi.c -+++ b/drivers/input/keyboard/applespi.c -@@ -48,6 +48,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -409,7 +410,7 @@ struct applespi_data { - unsigned int cmd_msg_cntr; - /* lock to protect the above parameters and flags below */ - spinlock_t cmd_msg_lock; -- bool cmd_msg_queued; -+ ktime_t cmd_msg_queued; - enum applespi_evt_type cmd_evt_type; - - struct led_classdev backlight_info; -@@ -729,7 +730,7 @@ static void applespi_msg_complete(struct applespi_data *applespi, - wake_up_all(&applespi->drain_complete); - - if (is_write_msg) { -- applespi->cmd_msg_queued = false; -+ applespi->cmd_msg_queued = 0; - applespi_send_cmd_msg(applespi); - } - -@@ -771,8 +772,16 @@ static int applespi_send_cmd_msg(struct applespi_data *applespi) - return 0; - - /* check whether send is in progress */ -- if (applespi->cmd_msg_queued) -- return 0; -+ if (applespi->cmd_msg_queued) { -+ if (ktime_ms_delta(ktime_get(), applespi->cmd_msg_queued) < 1000) -+ return 0; -+ -+ dev_warn(&applespi->spi->dev, "Command %d timed out\n", -+ applespi->cmd_evt_type); -+ -+ applespi->cmd_msg_queued = 0; -+ applespi->write_active = false; -+ } - - /* set up packet */ - memset(packet, 0, APPLESPI_PACKET_SIZE); -@@ -869,7 +878,7 @@ static int applespi_send_cmd_msg(struct applespi_data *applespi) - return sts; - } - -- applespi->cmd_msg_queued = true; -+ applespi->cmd_msg_queued = ktime_get_coarse(); - applespi->write_active = true; - - return 0; -@@ -1921,7 +1930,7 @@ static int __maybe_unused applespi_resume(struct device *dev) - applespi->drain = false; - applespi->have_cl_led_on = false; - applespi->have_bl_level = 0; -- applespi->cmd_msg_queued = false; -+ applespi->cmd_msg_queued = 0; - applespi->read_active = false; - applespi->write_active = false; - -diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c -index 83d8ab2aed9f4..01da76dc1caa8 100644 ---- a/drivers/iommu/amd/init.c -+++ b/drivers/iommu/amd/init.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -254,6 +255,8 @@ static enum iommu_init_state init_state = IOMMU_START_STATE; - static int amd_iommu_enable_interrupts(void); - static int __init iommu_go_to_state(enum iommu_init_state state); - static void init_device_table_dma(void); -+static int iommu_pc_get_set_reg(struct amd_iommu *iommu, u8 bank, u8 cntr, -+ u8 fxn, u64 *value, bool is_write); - - static bool amd_iommu_pre_enabled = true; - -@@ -1712,13 +1715,11 @@ static int __init init_iommu_all(struct acpi_table_header *table) - return 0; - } - --static int iommu_pc_get_set_reg(struct amd_iommu *iommu, u8 bank, u8 cntr, -- u8 fxn, u64 *value, bool is_write); -- --static void init_iommu_perf_ctr(struct amd_iommu *iommu) -+static void __init init_iommu_perf_ctr(struct amd_iommu *iommu) - { -+ int retry; - struct pci_dev *pdev = iommu->dev; -- u64 val = 0xabcd, val2 = 0, save_reg = 0; -+ u64 val = 0xabcd, val2 = 0, save_reg, save_src; - - if (!iommu_feature(iommu, FEATURE_PC)) - return; -@@ -1726,17 +1727,39 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu) - amd_iommu_pc_present = true; - - /* save the value to restore, if writable */ -- if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, false)) -+ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, false) || -+ iommu_pc_get_set_reg(iommu, 0, 0, 8, &save_src, false)) - goto pc_false; - -- /* Check if the performance counters can be written to */ -- if ((iommu_pc_get_set_reg(iommu, 0, 0, 0, &val, true)) || -- (iommu_pc_get_set_reg(iommu, 0, 0, 0, &val2, false)) || -- (val != val2)) -+ /* -+ * Disable power gating by programing the performance counter -+ * source to 20 (i.e. counts the reads and writes from/to IOMMU -+ * Reserved Register [MMIO Offset 1FF8h] that are ignored.), -+ * which never get incremented during this init phase. -+ * (Note: The event is also deprecated.) -+ */ -+ val = 20; -+ if (iommu_pc_get_set_reg(iommu, 0, 0, 8, &val, true)) - goto pc_false; - -+ /* Check if the performance counters can be written to */ -+ val = 0xabcd; -+ for (retry = 5; retry; retry--) { -+ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &val, true) || -+ iommu_pc_get_set_reg(iommu, 0, 0, 0, &val2, false) || -+ val2) -+ break; -+ -+ /* Wait about 20 msec for power gating to disable and retry. */ -+ msleep(20); -+ } -+ - /* restore */ -- if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, true)) -+ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, true) || -+ iommu_pc_get_set_reg(iommu, 0, 0, 8, &save_src, true)) -+ goto pc_false; -+ -+ if (val != val2) - goto pc_false; - - pci_info(pdev, "IOMMU performance counters supported\n"); -diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c -index 18a9f05df4079..b3bcd6dec93e7 100644 ---- a/drivers/iommu/intel/svm.c -+++ b/drivers/iommu/intel/svm.c -@@ -1079,8 +1079,17 @@ prq_advance: - * Clear the page request overflow bit and wake up all threads that - * are waiting for the completion of this handling. - */ -- if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO) -- writel(DMA_PRS_PRO, iommu->reg + DMAR_PRS_REG); -+ if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO) { -+ pr_info_ratelimited("IOMMU: %s: PRQ overflow detected\n", -+ iommu->name); -+ head = dmar_readq(iommu->reg + DMAR_PQH_REG) & PRQ_RING_MASK; -+ tail = dmar_readq(iommu->reg + DMAR_PQT_REG) & PRQ_RING_MASK; -+ if (head == tail) { -+ writel(DMA_PRS_PRO, iommu->reg + DMAR_PRS_REG); -+ pr_info_ratelimited("IOMMU: %s: PRQ overflow cleared", -+ iommu->name); -+ } -+ } - - if (!completion_done(&iommu->prq_complete)) - complete(&iommu->prq_complete); -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c -index aa5f45749543b..a60c302ef2676 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c -@@ -1288,7 +1288,6 @@ static void rkisp1_params_config_parameter(struct rkisp1_params *params) - memset(hst.hist_weight, 0x01, sizeof(hst.hist_weight)); - rkisp1_hst_config(params, &hst); - rkisp1_param_set_bits(params, RKISP1_CIF_ISP_HIST_PROP, -- ~RKISP1_CIF_ISP_HIST_PROP_MODE_MASK | - rkisp1_hst_params_default_config.mode); - - /* set the range */ -diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c -index 86d5e3f4b1ffc..06f74d410973e 100644 ---- a/drivers/media/platform/vsp1/vsp1_drm.c -+++ b/drivers/media/platform/vsp1/vsp1_drm.c -@@ -245,7 +245,7 @@ static int vsp1_du_pipeline_setup_brx(struct vsp1_device *vsp1, - brx = &vsp1->bru->entity; - else if (pipe->brx && !drm_pipe->force_brx_release) - brx = pipe->brx; -- else if (!vsp1->bru->entity.pipe) -+ else if (vsp1_feature(vsp1, VSP1_HAS_BRU) && !vsp1->bru->entity.pipe) - brx = &vsp1->bru->entity; - else - brx = &vsp1->brs->entity; -@@ -462,9 +462,9 @@ static int vsp1_du_pipeline_setup_inputs(struct vsp1_device *vsp1, - * make sure it is present in the pipeline's list of entities if it - * wasn't already. - */ -- if (!use_uif) { -+ if (drm_pipe->uif && !use_uif) { - drm_pipe->uif->pipe = NULL; -- } else if (!drm_pipe->uif->pipe) { -+ } else if (drm_pipe->uif && !drm_pipe->uif->pipe) { - drm_pipe->uif->pipe = pipe; - list_add_tail(&drm_pipe->uif->list_pipe, &pipe->entities); - } -diff --git a/drivers/media/rc/Makefile b/drivers/media/rc/Makefile -index 5bb2932ab1195..ff6a8fc4c38e5 100644 ---- a/drivers/media/rc/Makefile -+++ b/drivers/media/rc/Makefile -@@ -5,6 +5,7 @@ obj-y += keymaps/ - obj-$(CONFIG_RC_CORE) += rc-core.o - rc-core-y := rc-main.o rc-ir-raw.o - rc-core-$(CONFIG_LIRC) += lirc_dev.o -+rc-core-$(CONFIG_MEDIA_CEC_RC) += keymaps/rc-cec.o - rc-core-$(CONFIG_BPF_LIRC_MODE2) += bpf-lirc.o - obj-$(CONFIG_IR_NEC_DECODER) += ir-nec-decoder.o - obj-$(CONFIG_IR_RC5_DECODER) += ir-rc5-decoder.o -diff --git a/drivers/media/rc/keymaps/Makefile b/drivers/media/rc/keymaps/Makefile -index b252a1d2ebd66..cc6662e1903f5 100644 ---- a/drivers/media/rc/keymaps/Makefile -+++ b/drivers/media/rc/keymaps/Makefile -@@ -21,7 +21,6 @@ obj-$(CONFIG_RC_MAP) += rc-adstech-dvb-t-pci.o \ - rc-behold.o \ - rc-behold-columbus.o \ - rc-budget-ci-old.o \ -- rc-cec.o \ - rc-cinergy-1400.o \ - rc-cinergy.o \ - rc-d680-dmb.o \ -diff --git a/drivers/media/rc/keymaps/rc-cec.c b/drivers/media/rc/keymaps/rc-cec.c -index 3e3bd11092b45..068e22aeac8c3 100644 ---- a/drivers/media/rc/keymaps/rc-cec.c -+++ b/drivers/media/rc/keymaps/rc-cec.c -@@ -1,5 +1,15 @@ - // SPDX-License-Identifier: GPL-2.0-or-later - /* Keytable for the CEC remote control -+ * -+ * This keymap is unusual in that it can't be built as a module, -+ * instead it is registered directly in rc-main.c if CONFIG_MEDIA_CEC_RC -+ * is set. This is because it can be called from drm_dp_cec_set_edid() via -+ * cec_register_adapter() in an asynchronous context, and it is not -+ * allowed to use request_module() to load rc-cec.ko in that case. -+ * -+ * Since this keymap is only used if CONFIG_MEDIA_CEC_RC is set, we -+ * just compile this keymap into the rc-core module and never as a -+ * separate module. - * - * Copyright (c) 2015 by Kamil Debski - */ -@@ -152,7 +162,7 @@ static struct rc_map_table cec[] = { - /* 0x77-0xff: Reserved */ - }; - --static struct rc_map_list cec_map = { -+struct rc_map_list cec_map = { - .map = { - .scan = cec, - .size = ARRAY_SIZE(cec), -@@ -160,19 +170,3 @@ static struct rc_map_list cec_map = { - .name = RC_MAP_CEC, - } - }; -- --static int __init init_rc_map_cec(void) --{ -- return rc_map_register(&cec_map); --} -- --static void __exit exit_rc_map_cec(void) --{ -- rc_map_unregister(&cec_map); --} -- --module_init(init_rc_map_cec); --module_exit(exit_rc_map_cec); -- --MODULE_LICENSE("GPL"); --MODULE_AUTHOR("Kamil Debski"); -diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c -index 1fd62c1dac768..8e88dc8ea6c5e 100644 ---- a/drivers/media/rc/rc-main.c -+++ b/drivers/media/rc/rc-main.c -@@ -2069,6 +2069,9 @@ static int __init rc_core_init(void) - - led_trigger_register_simple("rc-feedback", &led_feedback); - rc_map_register(&empty_map); -+#ifdef CONFIG_MEDIA_CEC_RC -+ rc_map_register(&cec_map); -+#endif - - return 0; - } -@@ -2078,6 +2081,9 @@ static void __exit rc_core_exit(void) - lirc_dev_exit(); - class_unregister(&rc_class); - led_trigger_unregister_simple(led_feedback); -+#ifdef CONFIG_MEDIA_CEC_RC -+ rc_map_unregister(&cec_map); -+#endif - rc_map_unregister(&empty_map); - } - -diff --git a/drivers/media/usb/usbtv/usbtv-audio.c b/drivers/media/usb/usbtv/usbtv-audio.c -index b57e94fb19770..333bd305a4f9f 100644 ---- a/drivers/media/usb/usbtv/usbtv-audio.c -+++ b/drivers/media/usb/usbtv/usbtv-audio.c -@@ -371,7 +371,7 @@ void usbtv_audio_free(struct usbtv *usbtv) - cancel_work_sync(&usbtv->snd_trigger); - - if (usbtv->snd && usbtv->udev) { -- snd_card_free(usbtv->snd); -+ snd_card_free_when_closed(usbtv->snd); - usbtv->snd = NULL; - } - } -diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c -index f12e909034ac0..beda610e6b30d 100644 ---- a/drivers/misc/fastrpc.c -+++ b/drivers/misc/fastrpc.c -@@ -950,6 +950,11 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel, - if (!fl->cctx->rpdev) - return -EPIPE; - -+ if (handle == FASTRPC_INIT_HANDLE && !kernel) { -+ dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n", handle); -+ return -EPERM; -+ } -+ - ctx = fastrpc_context_alloc(fl, kernel, sc, args); - if (IS_ERR(ctx)) - return PTR_ERR(ctx); -diff --git a/drivers/misc/pvpanic.c b/drivers/misc/pvpanic.c -index 41cab297d66e7..2356d621967ef 100644 ---- a/drivers/misc/pvpanic.c -+++ b/drivers/misc/pvpanic.c -@@ -92,6 +92,7 @@ static const struct of_device_id pvpanic_mmio_match[] = { - { .compatible = "qemu,pvpanic-mmio", }, - {} - }; -+MODULE_DEVICE_TABLE(of, pvpanic_mmio_match); - - static const struct acpi_device_id pvpanic_device_ids[] = { - { "QEMU0001", 0 }, -diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c -index c2e70b757dd12..4383c262b3f5a 100644 ---- a/drivers/mmc/core/bus.c -+++ b/drivers/mmc/core/bus.c -@@ -399,11 +399,6 @@ void mmc_remove_card(struct mmc_card *card) - mmc_remove_card_debugfs(card); - #endif - -- if (host->cqe_enabled) { -- host->cqe_ops->cqe_disable(host); -- host->cqe_enabled = false; -- } -- - if (mmc_card_present(card)) { - if (mmc_host_is_spi(card->host)) { - pr_info("%s: SPI card removed\n", -@@ -416,6 +411,10 @@ void mmc_remove_card(struct mmc_card *card) - of_node_put(card->dev.of_node); - } - -+ if (host->cqe_enabled) { -+ host->cqe_ops->cqe_disable(host); -+ host->cqe_enabled = false; -+ } -+ - put_device(&card->dev); - } -- -diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c -index ff3063ce2acda..9ce34e8800335 100644 ---- a/drivers/mmc/core/mmc.c -+++ b/drivers/mmc/core/mmc.c -@@ -423,10 +423,6 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd) - - /* EXT_CSD value is in units of 10ms, but we store in ms */ - card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME]; -- /* Some eMMC set the value too low so set a minimum */ -- if (card->ext_csd.part_time && -- card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME) -- card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME; - - /* Sleep / awake timeout in 100ns units */ - if (sa_shift > 0 && sa_shift <= 0x17) -@@ -616,6 +612,17 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd) - card->ext_csd.data_sector_size = 512; - } - -+ /* -+ * GENERIC_CMD6_TIME is to be used "unless a specific timeout is defined -+ * when accessing a specific field", so use it here if there is no -+ * PARTITION_SWITCH_TIME. -+ */ -+ if (!card->ext_csd.part_time) -+ card->ext_csd.part_time = card->ext_csd.generic_cmd6_time; -+ /* Some eMMC set the value too low so set a minimum */ -+ if (card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME) -+ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME; -+ - /* eMMC v5 or later */ - if (card->ext_csd.rev >= 7) { - memcpy(card->ext_csd.fwrev, &ext_csd[EXT_CSD_FIRMWARE_VERSION], -diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c -index b5a41a7ce1658..9bde0def114b5 100644 ---- a/drivers/mmc/host/mmci.c -+++ b/drivers/mmc/host/mmci.c -@@ -1241,7 +1241,11 @@ mmci_start_command(struct mmci_host *host, struct mmc_command *cmd, u32 c) - if (!cmd->busy_timeout) - cmd->busy_timeout = 10 * MSEC_PER_SEC; - -- clks = (unsigned long long)cmd->busy_timeout * host->cclk; -+ if (cmd->busy_timeout > host->mmc->max_busy_timeout) -+ clks = (unsigned long long)host->mmc->max_busy_timeout * host->cclk; -+ else -+ clks = (unsigned long long)cmd->busy_timeout * host->cclk; -+ - do_div(clks, MSEC_PER_SEC); - writel_relaxed(clks, host->base + MMCIDATATIMER); - } -@@ -2091,6 +2095,10 @@ static int mmci_probe(struct amba_device *dev, - mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY; - } - -+ /* Variants with mandatory busy timeout in HW needs R1B responses. */ -+ if (variant->busy_timeout) -+ mmc->caps |= MMC_CAP_NEED_RSP_BUSY; -+ - /* Prepare a CMD12 - needed to clear the DPSM on some variants. */ - host->stop_abort.opcode = MMC_STOP_TRANSMISSION; - host->stop_abort.arg = 0; -diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c -index de09c63475240..898ed1b023df6 100644 ---- a/drivers/mmc/host/mtk-sd.c -+++ b/drivers/mmc/host/mtk-sd.c -@@ -1127,13 +1127,13 @@ static void msdc_track_cmd_data(struct msdc_host *host, - static void msdc_request_done(struct msdc_host *host, struct mmc_request *mrq) - { - unsigned long flags; -- bool ret; - -- ret = cancel_delayed_work(&host->req_timeout); -- if (!ret) { -- /* delay work already running */ -- return; -- } -+ /* -+ * No need check the return value of cancel_delayed_work, as only ONE -+ * path will go here! -+ */ -+ cancel_delayed_work(&host->req_timeout); -+ - spin_lock_irqsave(&host->lock, flags); - host->mrq = NULL; - spin_unlock_irqrestore(&host->lock, flags); -@@ -1155,7 +1155,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events, - bool done = false; - bool sbc_error; - unsigned long flags; -- u32 *rsp = cmd->resp; -+ u32 *rsp; - - if (mrq->sbc && cmd == mrq->cmd && - (events & (MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR -@@ -1176,6 +1176,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events, - - if (done) - return true; -+ rsp = cmd->resp; - - sdr_clr_bits(host->base + MSDC_INTEN, cmd_ints_mask); - -@@ -1363,7 +1364,7 @@ static void msdc_data_xfer_next(struct msdc_host *host, - static bool msdc_data_xfer_done(struct msdc_host *host, u32 events, - struct mmc_request *mrq, struct mmc_data *data) - { -- struct mmc_command *stop = data->stop; -+ struct mmc_command *stop; - unsigned long flags; - bool done; - unsigned int check_data = events & -@@ -1379,6 +1380,7 @@ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events, - - if (done) - return true; -+ stop = data->stop; - - if (check_data || (stop && stop->error)) { - dev_dbg(host->dev, "DMA status: 0x%8X\n", -diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c -index 56bbc6cd9c848..947581de78601 100644 ---- a/drivers/mmc/host/mxs-mmc.c -+++ b/drivers/mmc/host/mxs-mmc.c -@@ -628,7 +628,7 @@ static int mxs_mmc_probe(struct platform_device *pdev) - - ret = mmc_of_parse(mmc); - if (ret) -- goto out_clk_disable; -+ goto out_free_dma; - - mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34; - -diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c -index c9434b461aabc..ddeaf8e1f72f9 100644 ---- a/drivers/mmc/host/sdhci-iproc.c -+++ b/drivers/mmc/host/sdhci-iproc.c -@@ -296,9 +296,27 @@ static const struct of_device_id sdhci_iproc_of_match[] = { - MODULE_DEVICE_TABLE(of, sdhci_iproc_of_match); - - #ifdef CONFIG_ACPI -+/* -+ * This is a duplicate of bcm2835_(pltfrm_)data without caps quirks -+ * which are provided by the ACPI table. -+ */ -+static const struct sdhci_pltfm_data sdhci_bcm_arasan_data = { -+ .quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION | -+ SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK | -+ SDHCI_QUIRK_NO_HISPD_BIT, -+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, -+ .ops = &sdhci_iproc_32only_ops, -+}; -+ -+static const struct sdhci_iproc_data bcm_arasan_data = { -+ .pdata = &sdhci_bcm_arasan_data, -+}; -+ - static const struct acpi_device_id sdhci_iproc_acpi_ids[] = { - { .id = "BRCM5871", .driver_data = (kernel_ulong_t)&iproc_cygnus_data }, - { .id = "BRCM5872", .driver_data = (kernel_ulong_t)&iproc_data }, -+ { .id = "BCM2847", .driver_data = (kernel_ulong_t)&bcm_arasan_data }, -+ { .id = "BRCME88C", .driver_data = (kernel_ulong_t)&bcm2711_data }, - { /* sentinel */ } - }; - MODULE_DEVICE_TABLE(acpi, sdhci_iproc_acpi_ids); -diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig -index 63339d29be905..6d9e90887b29a 100644 ---- a/drivers/net/Kconfig -+++ b/drivers/net/Kconfig -@@ -92,7 +92,7 @@ config WIREGUARD - select CRYPTO_POLY1305_ARM if ARM - select CRYPTO_CURVE25519_NEON if ARM && KERNEL_MODE_NEON - select CRYPTO_CHACHA_MIPS if CPU_MIPS32_R2 -- select CRYPTO_POLY1305_MIPS if CPU_MIPS32 || (CPU_MIPS64 && 64BIT) -+ select CRYPTO_POLY1305_MIPS if MIPS - help - WireGuard is a secure, fast, and easy to use replacement for IPSec - that uses modern cryptography and clever networking tricks. It's -diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c -index 7ab20a6b0d1db..2893297555eba 100644 ---- a/drivers/net/can/flexcan.c -+++ b/drivers/net/can/flexcan.c -@@ -701,7 +701,7 @@ static int flexcan_chip_freeze(struct flexcan_priv *priv) - u32 reg; - - reg = priv->read(®s->mcr); -- reg |= FLEXCAN_MCR_HALT; -+ reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT; - priv->write(reg, ®s->mcr); - - while (timeout-- && !(priv->read(®s->mcr) & FLEXCAN_MCR_FRZ_ACK)) -@@ -1479,10 +1479,13 @@ static int flexcan_chip_start(struct net_device *dev) - - flexcan_set_bittiming(dev); - -+ /* set freeze, halt */ -+ err = flexcan_chip_freeze(priv); -+ if (err) -+ goto out_chip_disable; -+ - /* MCR - * -- * enable freeze -- * halt now - * only supervisor access - * enable warning int - * enable individual RX masking -@@ -1491,9 +1494,8 @@ static int flexcan_chip_start(struct net_device *dev) - */ - reg_mcr = priv->read(®s->mcr); - reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff); -- reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT | FLEXCAN_MCR_SUPV | -- FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_IRMQ | FLEXCAN_MCR_IDAM_C | -- FLEXCAN_MCR_MAXMB(priv->tx_mb_idx); -+ reg_mcr |= FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_IRMQ | -+ FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_MAXMB(priv->tx_mb_idx); - - /* MCR - * -@@ -1864,10 +1866,14 @@ static int register_flexcandev(struct net_device *dev) - if (err) - goto out_chip_disable; - -- /* set freeze, halt and activate FIFO, restrict register access */ -+ /* set freeze, halt */ -+ err = flexcan_chip_freeze(priv); -+ if (err) -+ goto out_chip_disable; -+ -+ /* activate FIFO, restrict register access */ - reg = priv->read(®s->mcr); -- reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT | -- FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV; -+ reg |= FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV; - priv->write(reg, ®s->mcr); - - /* Currently we only support newer versions of this core -diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c -index 970f0e9d19bfd..4920de09ffb79 100644 ---- a/drivers/net/can/m_can/tcan4x5x.c -+++ b/drivers/net/can/m_can/tcan4x5x.c -@@ -326,14 +326,14 @@ static int tcan4x5x_init(struct m_can_classdev *cdev) - if (ret) - return ret; - -+ /* Zero out the MCAN buffers */ -+ m_can_init_ram(cdev); -+ - ret = regmap_update_bits(tcan4x5x->regmap, TCAN4X5X_CONFIG, - TCAN4X5X_MODE_SEL_MASK, TCAN4X5X_MODE_NORMAL); - if (ret) - return ret; - -- /* Zero out the MCAN buffers */ -- m_can_init_ram(cdev); -- - return ret; - } - -diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c -index 4ca0296509936..1a855816cbc9d 100644 ---- a/drivers/net/dsa/sja1105/sja1105_main.c -+++ b/drivers/net/dsa/sja1105/sja1105_main.c -@@ -1834,7 +1834,7 @@ out_unlock_ptp: - speed = SPEED_1000; - else if (bmcr & BMCR_SPEED100) - speed = SPEED_100; -- else if (bmcr & BMCR_SPEED10) -+ else - speed = SPEED_10; - - sja1105_sgmii_pcs_force_speed(priv, speed); -diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c -index 9b7f1af5f5747..9e02f88645931 100644 ---- a/drivers/net/ethernet/atheros/alx/main.c -+++ b/drivers/net/ethernet/atheros/alx/main.c -@@ -1894,13 +1894,16 @@ static int alx_resume(struct device *dev) - - if (!netif_running(alx->dev)) - return 0; -- netif_device_attach(alx->dev); - - rtnl_lock(); - err = __alx_open(alx, true); - rtnl_unlock(); -+ if (err) -+ return err; - -- return err; -+ netif_device_attach(alx->dev); -+ -+ return 0; - } - - static SIMPLE_DEV_PM_OPS(alx_pm_ops, alx_suspend, alx_resume); -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 1c96b7ba24f28..80819d8fddb4b 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -8430,10 +8430,18 @@ static void bnxt_setup_inta(struct bnxt *bp) - bp->irq_tbl[0].handler = bnxt_inta; - } - -+static int bnxt_init_int_mode(struct bnxt *bp); -+ - static int bnxt_setup_int_mode(struct bnxt *bp) - { - int rc; - -+ if (!bp->irq_tbl) { -+ rc = bnxt_init_int_mode(bp); -+ if (rc || !bp->irq_tbl) -+ return rc ?: -ENODEV; -+ } -+ - if (bp->flags & BNXT_FLAG_USING_MSIX) - bnxt_setup_msix(bp); - else -@@ -8618,7 +8626,7 @@ static int bnxt_init_inta(struct bnxt *bp) - - static int bnxt_init_int_mode(struct bnxt *bp) - { -- int rc = 0; -+ int rc = -ENODEV; - - if (bp->flags & BNXT_FLAG_MSIX_CAP) - rc = bnxt_init_msix(bp); -@@ -9339,7 +9347,8 @@ static int bnxt_hwrm_if_change(struct bnxt *bp, bool up) - { - struct hwrm_func_drv_if_change_output *resp = bp->hwrm_cmd_resp_addr; - struct hwrm_func_drv_if_change_input req = {0}; -- bool resc_reinit = false, fw_reset = false; -+ bool fw_reset = !bp->irq_tbl; -+ bool resc_reinit = false; - u32 flags = 0; - int rc; - -@@ -9367,6 +9376,7 @@ static int bnxt_hwrm_if_change(struct bnxt *bp, bool up) - - if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state) && !fw_reset) { - netdev_err(bp->dev, "RESET_DONE not set during FW reset.\n"); -+ set_bit(BNXT_STATE_ABORT_ERR, &bp->state); - return -ENODEV; - } - if (resc_reinit || fw_reset) { -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 814a5b10141d1..07cdb38e7d118 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -3950,6 +3950,13 @@ static int macb_init(struct platform_device *pdev) - return 0; - } - -+static const struct macb_usrio_config macb_default_usrio = { -+ .mii = MACB_BIT(MII), -+ .rmii = MACB_BIT(RMII), -+ .rgmii = GEM_BIT(RGMII), -+ .refclk = MACB_BIT(CLKEN), -+}; -+ - #if defined(CONFIG_OF) - /* 1518 rounded up */ - #define AT91ETHER_MAX_RBUFF_SZ 0x600 -@@ -4435,13 +4442,6 @@ static int fu540_c000_init(struct platform_device *pdev) - return macb_init(pdev); - } - --static const struct macb_usrio_config macb_default_usrio = { -- .mii = MACB_BIT(MII), -- .rmii = MACB_BIT(RMII), -- .rgmii = GEM_BIT(RGMII), -- .refclk = MACB_BIT(CLKEN), --}; -- - static const struct macb_usrio_config sama7g5_usrio = { - .mii = 0, - .rmii = 1, -@@ -4590,6 +4590,7 @@ static const struct macb_config default_gem_config = { - .dma_burst_length = 16, - .clk_init = macb_clk_init, - .init = macb_init, -+ .usrio = &macb_default_usrio, - .jumbo_max_len = 10240, - }; - -diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c -index 3fdc70dab5c14..a95e95ce94386 100644 ---- a/drivers/net/ethernet/davicom/dm9000.c -+++ b/drivers/net/ethernet/davicom/dm9000.c -@@ -133,6 +133,8 @@ struct board_info { - u32 wake_state; - - int ip_summed; -+ -+ struct regulator *power_supply; - }; - - /* debug code */ -@@ -1449,7 +1451,7 @@ dm9000_probe(struct platform_device *pdev) - if (ret) { - dev_err(dev, "failed to request reset gpio %d: %d\n", - reset_gpios, ret); -- return -ENODEV; -+ goto out_regulator_disable; - } - - /* According to manual PWRST# Low Period Min 1ms */ -@@ -1461,8 +1463,10 @@ dm9000_probe(struct platform_device *pdev) - - if (!pdata) { - pdata = dm9000_parse_dt(&pdev->dev); -- if (IS_ERR(pdata)) -- return PTR_ERR(pdata); -+ if (IS_ERR(pdata)) { -+ ret = PTR_ERR(pdata); -+ goto out_regulator_disable; -+ } - } - - /* Init network device */ -@@ -1479,6 +1483,8 @@ dm9000_probe(struct platform_device *pdev) - - db->dev = &pdev->dev; - db->ndev = ndev; -+ if (!IS_ERR(power)) -+ db->power_supply = power; - - spin_lock_init(&db->lock); - mutex_init(&db->addr_lock); -@@ -1703,6 +1709,10 @@ out: - dm9000_release_board(pdev, db); - free_netdev(ndev); - -+out_regulator_disable: -+ if (!IS_ERR(power)) -+ regulator_disable(power); -+ - return ret; - } - -@@ -1760,10 +1770,13 @@ static int - dm9000_drv_remove(struct platform_device *pdev) - { - struct net_device *ndev = platform_get_drvdata(pdev); -+ struct board_info *dm = to_dm9000_board(ndev); - - unregister_netdev(ndev); -- dm9000_release_board(pdev, netdev_priv(ndev)); -+ dm9000_release_board(pdev, dm); - free_netdev(ndev); /* free device structure */ -+ if (dm->power_supply) -+ regulator_disable(dm->power_supply); - - dev_dbg(&pdev->dev, "released and freed device\n"); - return 0; -diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c -index c78d12229730b..09471329f3a36 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc.c -@@ -281,6 +281,8 @@ static int enetc_poll(struct napi_struct *napi, int budget) - int work_done; - int i; - -+ enetc_lock_mdio(); -+ - for (i = 0; i < v->count_tx_rings; i++) - if (!enetc_clean_tx_ring(&v->tx_ring[i], budget)) - complete = false; -@@ -291,8 +293,10 @@ static int enetc_poll(struct napi_struct *napi, int budget) - if (work_done) - v->rx_napi_work = true; - -- if (!complete) -+ if (!complete) { -+ enetc_unlock_mdio(); - return budget; -+ } - - napi_complete_done(napi, work_done); - -@@ -301,8 +305,6 @@ static int enetc_poll(struct napi_struct *napi, int budget) - - v->rx_napi_work = false; - -- enetc_lock_mdio(); -- - /* enable interrupts */ - enetc_wr_reg_hot(v->rbier, ENETC_RBIER_RXTIE); - -@@ -327,8 +329,8 @@ static void enetc_get_tx_tstamp(struct enetc_hw *hw, union enetc_tx_bd *txbd, - { - u32 lo, hi, tstamp_lo; - -- lo = enetc_rd(hw, ENETC_SICTR0); -- hi = enetc_rd(hw, ENETC_SICTR1); -+ lo = enetc_rd_hot(hw, ENETC_SICTR0); -+ hi = enetc_rd_hot(hw, ENETC_SICTR1); - tstamp_lo = le32_to_cpu(txbd->wb.tstamp); - if (lo <= tstamp_lo) - hi -= 1; -@@ -342,6 +344,12 @@ static void enetc_tstamp_tx(struct sk_buff *skb, u64 tstamp) - if (skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS) { - memset(&shhwtstamps, 0, sizeof(shhwtstamps)); - shhwtstamps.hwtstamp = ns_to_ktime(tstamp); -+ /* Ensure skb_mstamp_ns, which might have been populated with -+ * the txtime, is not mistaken for a software timestamp, -+ * because this will prevent the dispatch of our hardware -+ * timestamp to the socket. -+ */ -+ skb->tstamp = ktime_set(0, 0); - skb_tstamp_tx(skb, &shhwtstamps); - } - } -@@ -358,9 +366,7 @@ static bool enetc_clean_tx_ring(struct enetc_bdr *tx_ring, int napi_budget) - i = tx_ring->next_to_clean; - tx_swbd = &tx_ring->tx_swbd[i]; - -- enetc_lock_mdio(); - bds_to_clean = enetc_bd_ready_count(tx_ring, i); -- enetc_unlock_mdio(); - - do_tstamp = false; - -@@ -403,8 +409,6 @@ static bool enetc_clean_tx_ring(struct enetc_bdr *tx_ring, int napi_budget) - tx_swbd = tx_ring->tx_swbd; - } - -- enetc_lock_mdio(); -- - /* BD iteration loop end */ - if (is_eof) { - tx_frm_cnt++; -@@ -415,8 +419,6 @@ static bool enetc_clean_tx_ring(struct enetc_bdr *tx_ring, int napi_budget) - - if (unlikely(!bds_to_clean)) - bds_to_clean = enetc_bd_ready_count(tx_ring, i); -- -- enetc_unlock_mdio(); - } - - tx_ring->next_to_clean = i; -@@ -527,9 +529,8 @@ static void enetc_get_rx_tstamp(struct net_device *ndev, - static void enetc_get_offloads(struct enetc_bdr *rx_ring, - union enetc_rx_bd *rxbd, struct sk_buff *skb) - { --#ifdef CONFIG_FSL_ENETC_PTP_CLOCK - struct enetc_ndev_priv *priv = netdev_priv(rx_ring->ndev); --#endif -+ - /* TODO: hashing */ - if (rx_ring->ndev->features & NETIF_F_RXCSUM) { - u16 inet_csum = le16_to_cpu(rxbd->r.inet_csum); -@@ -538,12 +539,31 @@ static void enetc_get_offloads(struct enetc_bdr *rx_ring, - skb->ip_summed = CHECKSUM_COMPLETE; - } - -- /* copy VLAN to skb, if one is extracted, for now we assume it's a -- * standard TPID, but HW also supports custom values -- */ -- if (le16_to_cpu(rxbd->r.flags) & ENETC_RXBD_FLAG_VLAN) -- __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), -- le16_to_cpu(rxbd->r.vlan_opt)); -+ if (le16_to_cpu(rxbd->r.flags) & ENETC_RXBD_FLAG_VLAN) { -+ __be16 tpid = 0; -+ -+ switch (le16_to_cpu(rxbd->r.flags) & ENETC_RXBD_FLAG_TPID) { -+ case 0: -+ tpid = htons(ETH_P_8021Q); -+ break; -+ case 1: -+ tpid = htons(ETH_P_8021AD); -+ break; -+ case 2: -+ tpid = htons(enetc_port_rd(&priv->si->hw, -+ ENETC_PCVLANR1)); -+ break; -+ case 3: -+ tpid = htons(enetc_port_rd(&priv->si->hw, -+ ENETC_PCVLANR2)); -+ break; -+ default: -+ break; -+ } -+ -+ __vlan_hwaccel_put_tag(skb, tpid, le16_to_cpu(rxbd->r.vlan_opt)); -+ } -+ - #ifdef CONFIG_FSL_ENETC_PTP_CLOCK - if (priv->active_offloads & ENETC_F_RX_TSTAMP) - enetc_get_rx_tstamp(rx_ring->ndev, rxbd, skb); -@@ -660,8 +680,6 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, - u32 bd_status; - u16 size; - -- enetc_lock_mdio(); -- - if (cleaned_cnt >= ENETC_RXBD_BUNDLE) { - int count = enetc_refill_rx_ring(rx_ring, cleaned_cnt); - -@@ -672,19 +690,15 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, - - rxbd = enetc_rxbd(rx_ring, i); - bd_status = le32_to_cpu(rxbd->r.lstatus); -- if (!bd_status) { -- enetc_unlock_mdio(); -+ if (!bd_status) - break; -- } - - enetc_wr_reg_hot(rx_ring->idr, BIT(rx_ring->index)); - dma_rmb(); /* for reading other rxbd fields */ - size = le16_to_cpu(rxbd->r.buf_len); - skb = enetc_map_rx_buff_to_skb(rx_ring, i, size); -- if (!skb) { -- enetc_unlock_mdio(); -+ if (!skb) - break; -- } - - enetc_get_offloads(rx_ring, rxbd, skb); - -@@ -696,7 +710,6 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, - - if (unlikely(bd_status & - ENETC_RXBD_LSTATUS(ENETC_RXBD_ERR_MASK))) { -- enetc_unlock_mdio(); - dev_kfree_skb(skb); - while (!(bd_status & ENETC_RXBD_LSTATUS_F)) { - dma_rmb(); -@@ -736,8 +749,6 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, - - enetc_process_skb(rx_ring, skb); - -- enetc_unlock_mdio(); -- - napi_gro_receive(napi, skb); - - rx_frm_cnt++; -@@ -984,7 +995,7 @@ static void enetc_free_rxtx_rings(struct enetc_ndev_priv *priv) - enetc_free_tx_ring(priv->tx_ring[i]); - } - --static int enetc_alloc_cbdr(struct device *dev, struct enetc_cbdr *cbdr) -+int enetc_alloc_cbdr(struct device *dev, struct enetc_cbdr *cbdr) - { - int size = cbdr->bd_count * sizeof(struct enetc_cbd); - -@@ -1005,7 +1016,7 @@ static int enetc_alloc_cbdr(struct device *dev, struct enetc_cbdr *cbdr) - return 0; - } - --static void enetc_free_cbdr(struct device *dev, struct enetc_cbdr *cbdr) -+void enetc_free_cbdr(struct device *dev, struct enetc_cbdr *cbdr) - { - int size = cbdr->bd_count * sizeof(struct enetc_cbd); - -@@ -1013,7 +1024,7 @@ static void enetc_free_cbdr(struct device *dev, struct enetc_cbdr *cbdr) - cbdr->bd_base = NULL; - } - --static void enetc_setup_cbdr(struct enetc_hw *hw, struct enetc_cbdr *cbdr) -+void enetc_setup_cbdr(struct enetc_hw *hw, struct enetc_cbdr *cbdr) - { - /* set CBDR cache attributes */ - enetc_wr(hw, ENETC_SICAR2, -@@ -1033,7 +1044,7 @@ static void enetc_setup_cbdr(struct enetc_hw *hw, struct enetc_cbdr *cbdr) - cbdr->cir = hw->reg + ENETC_SICBDRCIR; - } - --static void enetc_clear_cbdr(struct enetc_hw *hw) -+void enetc_clear_cbdr(struct enetc_hw *hw) - { - enetc_wr(hw, ENETC_SICBDRMR, 0); - } -@@ -1058,13 +1069,12 @@ static int enetc_setup_default_rss_table(struct enetc_si *si, int num_groups) - return 0; - } - --static int enetc_configure_si(struct enetc_ndev_priv *priv) -+int enetc_configure_si(struct enetc_ndev_priv *priv) - { - struct enetc_si *si = priv->si; - struct enetc_hw *hw = &si->hw; - int err; - -- enetc_setup_cbdr(hw, &si->cbd_ring); - /* set SI cache attributes */ - enetc_wr(hw, ENETC_SICAR0, - ENETC_SICAR_RD_COHERENT | ENETC_SICAR_WR_COHERENT); -@@ -1112,6 +1122,8 @@ int enetc_alloc_si_resources(struct enetc_ndev_priv *priv) - if (err) - return err; - -+ enetc_setup_cbdr(&si->hw, &si->cbd_ring); -+ - priv->cls_rules = kcalloc(si->num_fs_entries, sizeof(*priv->cls_rules), - GFP_KERNEL); - if (!priv->cls_rules) { -@@ -1119,14 +1131,8 @@ int enetc_alloc_si_resources(struct enetc_ndev_priv *priv) - goto err_alloc_cls; - } - -- err = enetc_configure_si(priv); -- if (err) -- goto err_config_si; -- - return 0; - --err_config_si: -- kfree(priv->cls_rules); - err_alloc_cls: - enetc_clear_cbdr(&si->hw); - enetc_free_cbdr(priv->dev, &si->cbd_ring); -@@ -1212,7 +1218,8 @@ static void enetc_setup_rxbdr(struct enetc_hw *hw, struct enetc_bdr *rx_ring) - rx_ring->idr = hw->reg + ENETC_SIRXIDR; - - enetc_refill_rx_ring(rx_ring, enetc_bd_unused(rx_ring)); -- enetc_wr(hw, ENETC_SIRXIDR, rx_ring->next_to_use); -+ /* update ENETC's consumer index */ -+ enetc_rxbdr_wr(hw, idx, ENETC_RBCIR, rx_ring->next_to_use); - - /* enable ring */ - enetc_rxbdr_wr(hw, idx, ENETC_RBMR, rbmr); -diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h -index 8532d23b54f5f..8b380fc13314a 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc.h -+++ b/drivers/net/ethernet/freescale/enetc/enetc.h -@@ -292,6 +292,7 @@ void enetc_get_si_caps(struct enetc_si *si); - void enetc_init_si_rings_params(struct enetc_ndev_priv *priv); - int enetc_alloc_si_resources(struct enetc_ndev_priv *priv); - void enetc_free_si_resources(struct enetc_ndev_priv *priv); -+int enetc_configure_si(struct enetc_ndev_priv *priv); - - int enetc_open(struct net_device *ndev); - int enetc_close(struct net_device *ndev); -@@ -309,6 +310,10 @@ int enetc_setup_tc(struct net_device *ndev, enum tc_setup_type type, - void enetc_set_ethtool_ops(struct net_device *ndev); - - /* control buffer descriptor ring (CBDR) */ -+int enetc_alloc_cbdr(struct device *dev, struct enetc_cbdr *cbdr); -+void enetc_free_cbdr(struct device *dev, struct enetc_cbdr *cbdr); -+void enetc_setup_cbdr(struct enetc_hw *hw, struct enetc_cbdr *cbdr); -+void enetc_clear_cbdr(struct enetc_hw *hw); - int enetc_set_mac_flt_entry(struct enetc_si *si, int index, - char *mac_addr, int si_map); - int enetc_clear_mac_flt_entry(struct enetc_si *si, int index); -diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h -index c71fe8d751d50..de0d20b0f489c 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h -+++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h -@@ -172,6 +172,8 @@ enum enetc_bdr_type {TX, RX}; - #define ENETC_PSIPMAR0(n) (0x0100 + (n) * 0x8) /* n = SI index */ - #define ENETC_PSIPMAR1(n) (0x0104 + (n) * 0x8) - #define ENETC_PVCLCTR 0x0208 -+#define ENETC_PCVLANR1 0x0210 -+#define ENETC_PCVLANR2 0x0214 - #define ENETC_VLAN_TYPE_C BIT(0) - #define ENETC_VLAN_TYPE_S BIT(1) - #define ENETC_PVCLCTR_OVTPIDL(bmp) ((bmp) & 0xff) /* VLAN_TYPE */ -@@ -236,10 +238,17 @@ enum enetc_bdr_type {TX, RX}; - #define ENETC_PM_IMDIO_BASE 0x8030 - - #define ENETC_PM0_IF_MODE 0x8300 --#define ENETC_PMO_IFM_RG BIT(2) -+#define ENETC_PM0_IFM_RG BIT(2) - #define ENETC_PM0_IFM_RLP (BIT(5) | BIT(11)) --#define ENETC_PM0_IFM_RGAUTO (BIT(15) | ENETC_PMO_IFM_RG | BIT(1)) --#define ENETC_PM0_IFM_XGMII BIT(12) -+#define ENETC_PM0_IFM_EN_AUTO BIT(15) -+#define ENETC_PM0_IFM_SSP_MASK GENMASK(14, 13) -+#define ENETC_PM0_IFM_SSP_1000 (2 << 13) -+#define ENETC_PM0_IFM_SSP_100 (0 << 13) -+#define ENETC_PM0_IFM_SSP_10 (1 << 13) -+#define ENETC_PM0_IFM_FULL_DPX BIT(12) -+#define ENETC_PM0_IFM_IFMODE_MASK GENMASK(1, 0) -+#define ENETC_PM0_IFM_IFMODE_XGMII 0 -+#define ENETC_PM0_IFM_IFMODE_GMII 2 - #define ENETC_PSIDCAPR 0x1b08 - #define ENETC_PSIDCAPR_MSK GENMASK(15, 0) - #define ENETC_PSFCAPR 0x1b18 -@@ -453,6 +462,8 @@ static inline u64 _enetc_rd_reg64_wa(void __iomem *reg) - #define enetc_wr_reg(reg, val) _enetc_wr_reg_wa((reg), (val)) - #define enetc_rd(hw, off) enetc_rd_reg((hw)->reg + (off)) - #define enetc_wr(hw, off, val) enetc_wr_reg((hw)->reg + (off), val) -+#define enetc_rd_hot(hw, off) enetc_rd_reg_hot((hw)->reg + (off)) -+#define enetc_wr_hot(hw, off, val) enetc_wr_reg_hot((hw)->reg + (off), val) - #define enetc_rd64(hw, off) _enetc_rd_reg64_wa((hw)->reg + (off)) - /* port register accessors - PF only */ - #define enetc_port_rd(hw, off) enetc_rd_reg((hw)->port + (off)) -@@ -568,6 +579,7 @@ union enetc_rx_bd { - #define ENETC_RXBD_LSTATUS(flags) ((flags) << 16) - #define ENETC_RXBD_FLAG_VLAN BIT(9) - #define ENETC_RXBD_FLAG_TSTMP BIT(10) -+#define ENETC_RXBD_FLAG_TPID GENMASK(1, 0) - - #define ENETC_MAC_ADDR_FILT_CNT 8 /* # of supported entries per port */ - #define EMETC_MAC_ADDR_FILT_RES 3 /* # of reserved entries at the beginning */ -diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c -index 515c5b29d7aab..ca02f033bea21 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c -@@ -190,7 +190,6 @@ static void enetc_pf_set_rx_mode(struct net_device *ndev) - { - struct enetc_ndev_priv *priv = netdev_priv(ndev); - struct enetc_pf *pf = enetc_si_priv(priv->si); -- char vlan_promisc_simap = pf->vlan_promisc_simap; - struct enetc_hw *hw = &priv->si->hw; - bool uprom = false, mprom = false; - struct enetc_mac_filter *filter; -@@ -203,16 +202,12 @@ static void enetc_pf_set_rx_mode(struct net_device *ndev) - psipmr = ENETC_PSIPMR_SET_UP(0) | ENETC_PSIPMR_SET_MP(0); - uprom = true; - mprom = true; -- /* Enable VLAN promiscuous mode for SI0 (PF) */ -- vlan_promisc_simap |= BIT(0); - } else if (ndev->flags & IFF_ALLMULTI) { - /* enable multi cast promisc mode for SI0 (PF) */ - psipmr = ENETC_PSIPMR_SET_MP(0); - mprom = true; - } - -- enetc_set_vlan_promisc(&pf->si->hw, vlan_promisc_simap); -- - /* first 2 filter entries belong to PF */ - if (!uprom) { - /* Update unicast filters */ -@@ -320,7 +315,7 @@ static void enetc_set_loopback(struct net_device *ndev, bool en) - u32 reg; - - reg = enetc_port_rd(hw, ENETC_PM0_IF_MODE); -- if (reg & ENETC_PMO_IFM_RG) { -+ if (reg & ENETC_PM0_IFM_RG) { - /* RGMII mode */ - reg = (reg & ~ENETC_PM0_IFM_RLP) | - (en ? ENETC_PM0_IFM_RLP : 0); -@@ -499,13 +494,20 @@ static void enetc_configure_port_mac(struct enetc_hw *hw) - - static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode) - { -- /* set auto-speed for RGMII */ -- if (enetc_port_rd(hw, ENETC_PM0_IF_MODE) & ENETC_PMO_IFM_RG || -- phy_interface_mode_is_rgmii(phy_mode)) -- enetc_port_wr(hw, ENETC_PM0_IF_MODE, ENETC_PM0_IFM_RGAUTO); -+ u32 val; - -- if (phy_mode == PHY_INTERFACE_MODE_USXGMII) -- enetc_port_wr(hw, ENETC_PM0_IF_MODE, ENETC_PM0_IFM_XGMII); -+ if (phy_interface_mode_is_rgmii(phy_mode)) { -+ val = enetc_port_rd(hw, ENETC_PM0_IF_MODE); -+ val &= ~ENETC_PM0_IFM_EN_AUTO; -+ val &= ENETC_PM0_IFM_IFMODE_MASK; -+ val |= ENETC_PM0_IFM_IFMODE_GMII | ENETC_PM0_IFM_RG; -+ enetc_port_wr(hw, ENETC_PM0_IF_MODE, val); -+ } -+ -+ if (phy_mode == PHY_INTERFACE_MODE_USXGMII) { -+ val = ENETC_PM0_IFM_FULL_DPX | ENETC_PM0_IFM_IFMODE_XGMII; -+ enetc_port_wr(hw, ENETC_PM0_IF_MODE, val); -+ } - } - - static void enetc_mac_enable(struct enetc_hw *hw, bool en) -@@ -937,6 +939,34 @@ static void enetc_pl_mac_config(struct phylink_config *config, - phylink_set_pcs(priv->phylink, &pf->pcs->pcs); - } - -+static void enetc_force_rgmii_mac(struct enetc_hw *hw, int speed, int duplex) -+{ -+ u32 old_val, val; -+ -+ old_val = val = enetc_port_rd(hw, ENETC_PM0_IF_MODE); -+ -+ if (speed == SPEED_1000) { -+ val &= ~ENETC_PM0_IFM_SSP_MASK; -+ val |= ENETC_PM0_IFM_SSP_1000; -+ } else if (speed == SPEED_100) { -+ val &= ~ENETC_PM0_IFM_SSP_MASK; -+ val |= ENETC_PM0_IFM_SSP_100; -+ } else if (speed == SPEED_10) { -+ val &= ~ENETC_PM0_IFM_SSP_MASK; -+ val |= ENETC_PM0_IFM_SSP_10; -+ } -+ -+ if (duplex == DUPLEX_FULL) -+ val |= ENETC_PM0_IFM_FULL_DPX; -+ else -+ val &= ~ENETC_PM0_IFM_FULL_DPX; -+ -+ if (val == old_val) -+ return; -+ -+ enetc_port_wr(hw, ENETC_PM0_IF_MODE, val); -+} -+ - static void enetc_pl_mac_link_up(struct phylink_config *config, - struct phy_device *phy, unsigned int mode, - phy_interface_t interface, int speed, -@@ -949,6 +979,10 @@ static void enetc_pl_mac_link_up(struct phylink_config *config, - if (priv->active_offloads & ENETC_F_QBV) - enetc_sched_speed_set(priv, speed); - -+ if (!phylink_autoneg_inband(mode) && -+ phy_interface_mode_is_rgmii(interface)) -+ enetc_force_rgmii_mac(&pf->si->hw, speed, duplex); -+ - enetc_mac_enable(&pf->si->hw, true); - } - -@@ -1041,6 +1075,26 @@ static int enetc_init_port_rss_memory(struct enetc_si *si) - return err; - } - -+static void enetc_init_unused_port(struct enetc_si *si) -+{ -+ struct device *dev = &si->pdev->dev; -+ struct enetc_hw *hw = &si->hw; -+ int err; -+ -+ si->cbd_ring.bd_count = ENETC_CBDR_DEFAULT_SIZE; -+ err = enetc_alloc_cbdr(dev, &si->cbd_ring); -+ if (err) -+ return; -+ -+ enetc_setup_cbdr(hw, &si->cbd_ring); -+ -+ enetc_init_port_rfs_memory(si); -+ enetc_init_port_rss_memory(si); -+ -+ enetc_clear_cbdr(hw); -+ enetc_free_cbdr(dev, &si->cbd_ring); -+} -+ - static int enetc_pf_probe(struct pci_dev *pdev, - const struct pci_device_id *ent) - { -@@ -1051,11 +1105,6 @@ static int enetc_pf_probe(struct pci_dev *pdev, - struct enetc_pf *pf; - int err; - -- if (node && !of_device_is_available(node)) { -- dev_info(&pdev->dev, "device is disabled, skipping\n"); -- return -ENODEV; -- } -- - err = enetc_pci_probe(pdev, KBUILD_MODNAME, sizeof(*pf)); - if (err) { - dev_err(&pdev->dev, "PCI probing failed\n"); -@@ -1069,6 +1118,13 @@ static int enetc_pf_probe(struct pci_dev *pdev, - goto err_map_pf_space; - } - -+ if (node && !of_device_is_available(node)) { -+ enetc_init_unused_port(si); -+ dev_info(&pdev->dev, "device is disabled, skipping\n"); -+ err = -ENODEV; -+ goto err_device_disabled; -+ } -+ - pf = enetc_si_priv(si); - pf->si = si; - pf->total_vfs = pci_sriov_get_totalvfs(pdev); -@@ -1108,6 +1164,12 @@ static int enetc_pf_probe(struct pci_dev *pdev, - goto err_init_port_rss; - } - -+ err = enetc_configure_si(priv); -+ if (err) { -+ dev_err(&pdev->dev, "Failed to configure SI\n"); -+ goto err_config_si; -+ } -+ - err = enetc_alloc_msix(priv); - if (err) { - dev_err(&pdev->dev, "MSIX alloc failed\n"); -@@ -1136,6 +1198,7 @@ err_phylink_create: - enetc_mdiobus_destroy(pf); - err_mdiobus_create: - enetc_free_msix(priv); -+err_config_si: - err_init_port_rss: - err_init_port_rfs: - err_alloc_msix: -@@ -1144,6 +1207,7 @@ err_alloc_si_res: - si->ndev = NULL; - free_netdev(ndev); - err_alloc_netdev: -+err_device_disabled: - err_map_pf_space: - enetc_pci_remove(pdev); - -diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c -index 39c1a09e69a95..9b755a84c2d62 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c -@@ -171,6 +171,12 @@ static int enetc_vf_probe(struct pci_dev *pdev, - goto err_alloc_si_res; - } - -+ err = enetc_configure_si(priv); -+ if (err) { -+ dev_err(&pdev->dev, "Failed to configure SI\n"); -+ goto err_config_si; -+ } -+ - err = enetc_alloc_msix(priv); - if (err) { - dev_err(&pdev->dev, "MSIX alloc failed\n"); -@@ -187,6 +193,7 @@ static int enetc_vf_probe(struct pci_dev *pdev, - - err_reg_netdev: - enetc_free_msix(priv); -+err_config_si: - err_alloc_msix: - enetc_free_si_resources(priv); - err_alloc_si_res: -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h -index edfadb5cb1c34..a731f207b4f14 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h -@@ -1048,16 +1048,16 @@ struct hclge_fd_tcam_config_3_cmd { - #define HCLGE_FD_AD_DROP_B 0 - #define HCLGE_FD_AD_DIRECT_QID_B 1 - #define HCLGE_FD_AD_QID_S 2 --#define HCLGE_FD_AD_QID_M GENMASK(12, 2) -+#define HCLGE_FD_AD_QID_M GENMASK(11, 2) - #define HCLGE_FD_AD_USE_COUNTER_B 12 - #define HCLGE_FD_AD_COUNTER_NUM_S 13 - #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(20, 13) - #define HCLGE_FD_AD_NXT_STEP_B 20 - #define HCLGE_FD_AD_NXT_KEY_S 21 --#define HCLGE_FD_AD_NXT_KEY_M GENMASK(26, 21) -+#define HCLGE_FD_AD_NXT_KEY_M GENMASK(25, 21) - #define HCLGE_FD_AD_WR_RULE_ID_B 0 - #define HCLGE_FD_AD_RULE_ID_S 1 --#define HCLGE_FD_AD_RULE_ID_M GENMASK(13, 1) -+#define HCLGE_FD_AD_RULE_ID_M GENMASK(12, 1) - #define HCLGE_FD_AD_TC_OVRD_B 16 - #define HCLGE_FD_AD_TC_SIZE_S 17 - #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17) -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -index 48549db23c524..67764d9304355 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -@@ -5194,9 +5194,9 @@ static bool hclge_fd_convert_tuple(u32 tuple_bit, u8 *key_x, u8 *key_y, - case BIT(INNER_SRC_MAC): - for (i = 0; i < ETH_ALEN; i++) { - calc_x(key_x[ETH_ALEN - 1 - i], rule->tuples.src_mac[i], -- rule->tuples.src_mac[i]); -+ rule->tuples_mask.src_mac[i]); - calc_y(key_y[ETH_ALEN - 1 - i], rule->tuples.src_mac[i], -- rule->tuples.src_mac[i]); -+ rule->tuples_mask.src_mac[i]); - } - - return true; -@@ -6283,8 +6283,7 @@ static void hclge_fd_get_ext_info(struct ethtool_rx_flow_spec *fs, - fs->h_ext.vlan_tci = cpu_to_be16(rule->tuples.vlan_tag1); - fs->m_ext.vlan_tci = - rule->unused_tuple & BIT(INNER_VLAN_TAG_FST) ? -- cpu_to_be16(VLAN_VID_MASK) : -- cpu_to_be16(rule->tuples_mask.vlan_tag1); -+ 0 : cpu_to_be16(rule->tuples_mask.vlan_tag1); - } - - if (fs->flow_type & FLOW_MAC_EXT) { -diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c -index 13ae7eee7ef5f..3552c4485ed53 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.c -+++ b/drivers/net/ethernet/ibm/ibmvnic.c -@@ -1923,10 +1923,9 @@ static int ibmvnic_set_mac(struct net_device *netdev, void *p) - if (!is_valid_ether_addr(addr->sa_data)) - return -EADDRNOTAVAIL; - -- if (adapter->state != VNIC_PROBED) { -- ether_addr_copy(adapter->mac_addr, addr->sa_data); -+ ether_addr_copy(adapter->mac_addr, addr->sa_data); -+ if (adapter->state != VNIC_PROBED) - rc = __ibmvnic_set_mac(netdev, addr->sa_data); -- } - - return rc; - } -@@ -5283,16 +5282,14 @@ static int ibmvnic_reset_init(struct ibmvnic_adapter *adapter, bool reset) - { - struct device *dev = &adapter->vdev->dev; - unsigned long timeout = msecs_to_jiffies(20000); -- u64 old_num_rx_queues, old_num_tx_queues; -+ u64 old_num_rx_queues = adapter->req_rx_queues; -+ u64 old_num_tx_queues = adapter->req_tx_queues; - int rc; - - adapter->from_passive_init = false; - -- if (reset) { -- old_num_rx_queues = adapter->req_rx_queues; -- old_num_tx_queues = adapter->req_tx_queues; -+ if (reset) - reinit_completion(&adapter->init_done); -- } - - adapter->init_done_rc = 0; - rc = ibmvnic_send_crq_init(adapter); -@@ -5477,9 +5474,9 @@ static int ibmvnic_remove(struct vio_dev *dev) - * after setting state, so __ibmvnic_reset() which is called - * from the flush_work() below, can make progress. - */ -- spin_lock_irqsave(&adapter->rwi_lock, flags); -+ spin_lock(&adapter->rwi_lock); - adapter->state = VNIC_REMOVING; -- spin_unlock_irqrestore(&adapter->rwi_lock, flags); -+ spin_unlock(&adapter->rwi_lock); - - spin_unlock_irqrestore(&adapter->state_lock, flags); - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index fcd6f623f2fd8..4a2d03cada01e 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -15100,6 +15100,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - if (err) { - dev_info(&pdev->dev, - "setup of misc vector failed: %d\n", err); -+ i40e_cloud_filter_exit(pf); -+ i40e_fdir_teardown(pf); - goto err_vsis; - } - } -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c -index eca73526ac86b..54d47265a7ac1 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c -@@ -575,6 +575,11 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs) - return -EINVAL; - } - -+ if (xs->props.mode != XFRM_MODE_TRANSPORT) { -+ netdev_err(dev, "Unsupported mode for ipsec offload\n"); -+ return -EINVAL; -+ } -+ - if (ixgbe_ipsec_check_mgmt_ip(xs)) { - netdev_err(dev, "IPsec IP addr clash with mgmt filters\n"); - return -EINVAL; -diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c b/drivers/net/ethernet/intel/ixgbevf/ipsec.c -index 5170dd9d8705b..caaea2c920a6e 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c -+++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c -@@ -272,6 +272,11 @@ static int ixgbevf_ipsec_add_sa(struct xfrm_state *xs) - return -EINVAL; - } - -+ if (xs->props.mode != XFRM_MODE_TRANSPORT) { -+ netdev_err(dev, "Unsupported mode for ipsec offload\n"); -+ return -EINVAL; -+ } -+ - if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) { - struct rx_sa rsa; - -diff --git a/drivers/net/ethernet/mediatek/mtk_star_emac.c b/drivers/net/ethernet/mediatek/mtk_star_emac.c -index a8641a407c06a..96d2891f1675a 100644 ---- a/drivers/net/ethernet/mediatek/mtk_star_emac.c -+++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c -@@ -1225,8 +1225,6 @@ static int mtk_star_receive_packet(struct mtk_star_priv *priv) - goto push_new_skb; - } - -- desc_data.dma_addr = new_dma_addr; -- - /* We can't fail anymore at this point: it's safe to unmap the skb. */ - mtk_star_dma_unmap_rx(priv, &desc_data); - -@@ -1236,6 +1234,9 @@ static int mtk_star_receive_packet(struct mtk_star_priv *priv) - desc_data.skb->dev = ndev; - netif_receive_skb(desc_data.skb); - -+ /* update dma_addr for new skb */ -+ desc_data.dma_addr = new_dma_addr; -+ - push_new_skb: - desc_data.len = skb_tailroom(new_skb); - desc_data.skb = new_skb; -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -index 23849f2b9c252..1434df66fcf2e 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -@@ -47,7 +47,7 @@ - #define EN_ETHTOOL_SHORT_MASK cpu_to_be16(0xffff) - #define EN_ETHTOOL_WORD_MASK cpu_to_be32(0xffffffff) - --static int mlx4_en_moderation_update(struct mlx4_en_priv *priv) -+int mlx4_en_moderation_update(struct mlx4_en_priv *priv) - { - int i, t; - int err = 0; -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -index 32aad4d32b884..c7504223a12a9 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -@@ -3558,6 +3558,8 @@ int mlx4_en_reset_config(struct net_device *dev, - en_err(priv, "Failed starting port\n"); - } - -+ if (!err) -+ err = mlx4_en_moderation_update(priv); - out: - mutex_unlock(&mdev->state_lock); - kfree(tmp); -diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h -index e8ed23190de01..f3d1a20201ef3 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h -+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h -@@ -775,6 +775,7 @@ void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev); - #define DEV_FEATURE_CHANGED(dev, new_features, feature) \ - ((dev->features & feature) ^ (new_features & feature)) - -+int mlx4_en_moderation_update(struct mlx4_en_priv *priv); - int mlx4_en_reset_config(struct net_device *dev, - struct hwtstamp_config ts_config, - netdev_features_t new_features); -diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h -index 16e2df6ef2f48..c4adc7f740d3e 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/reg.h -+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h -@@ -4430,6 +4430,7 @@ MLXSW_ITEM32(reg, ptys, ext_eth_proto_cap, 0x08, 0, 32); - #define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_CR4 BIT(20) - #define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_SR4 BIT(21) - #define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_KR4 BIT(22) -+#define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_LR4_ER4 BIT(23) - #define MLXSW_REG_PTYS_ETH_SPEED_25GBASE_CR BIT(27) - #define MLXSW_REG_PTYS_ETH_SPEED_25GBASE_KR BIT(28) - #define MLXSW_REG_PTYS_ETH_SPEED_25GBASE_SR BIT(29) -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c -index 540616469e284..68333ecf6151e 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c -@@ -1171,6 +1171,11 @@ static const struct mlxsw_sp1_port_link_mode mlxsw_sp1_port_link_mode[] = { - .mask_ethtool = ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT, - .speed = SPEED_100000, - }, -+ { -+ .mask = MLXSW_REG_PTYS_ETH_SPEED_100GBASE_LR4_ER4, -+ .mask_ethtool = ETHTOOL_LINK_MODE_100000baseLR4_ER4_Full_BIT, -+ .speed = SPEED_100000, -+ }, - }; - - #define MLXSW_SP1_PORT_LINK_MODE_LEN ARRAY_SIZE(mlxsw_sp1_port_link_mode) -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -index 41424ee909a08..23d9fe18adba0 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -@@ -5861,6 +5861,10 @@ mlxsw_sp_router_fib4_replace(struct mlxsw_sp *mlxsw_sp, - if (mlxsw_sp->router->aborted) - return 0; - -+ if (fen_info->fi->nh && -+ !mlxsw_sp_nexthop_obj_group_lookup(mlxsw_sp, fen_info->fi->nh->id)) -+ return 0; -+ - fib_node = mlxsw_sp_fib_node_get(mlxsw_sp, fen_info->tb_id, - &fen_info->dst, sizeof(fen_info->dst), - fen_info->dst_len, -@@ -6511,6 +6515,9 @@ static int mlxsw_sp_router_fib6_replace(struct mlxsw_sp *mlxsw_sp, - if (mlxsw_sp_fib6_rt_should_ignore(rt)) - return 0; - -+ if (rt->nh && !mlxsw_sp_nexthop_obj_group_lookup(mlxsw_sp, rt->nh->id)) -+ return 0; -+ - fib_node = mlxsw_sp_fib_node_get(mlxsw_sp, rt->fib6_table->tb6_id, - &rt->fib6_dst.addr, - sizeof(rt->fib6_dst.addr), -diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c -index 40e2e79d45179..131b2a53d261d 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c -@@ -613,7 +613,8 @@ static const struct mlxsw_sx_port_link_mode mlxsw_sx_port_link_mode[] = { - { - .mask = MLXSW_REG_PTYS_ETH_SPEED_100GBASE_CR4 | - MLXSW_REG_PTYS_ETH_SPEED_100GBASE_SR4 | -- MLXSW_REG_PTYS_ETH_SPEED_100GBASE_KR4, -+ MLXSW_REG_PTYS_ETH_SPEED_100GBASE_KR4 | -+ MLXSW_REG_PTYS_ETH_SPEED_100GBASE_LR4_ER4, - .speed = 100000, - }, - }; -diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c b/drivers/net/ethernet/mscc/ocelot_flower.c -index 729495a1a77ee..3655503352928 100644 ---- a/drivers/net/ethernet/mscc/ocelot_flower.c -+++ b/drivers/net/ethernet/mscc/ocelot_flower.c -@@ -540,13 +540,14 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int port, bool ingress, - return -EOPNOTSUPP; - } - -+ flow_rule_match_ipv4_addrs(rule, &match); -+ - if (filter->block_id == VCAP_IS1 && *(u32 *)&match.mask->dst) { - NL_SET_ERR_MSG_MOD(extack, - "Key type S1_NORMAL cannot match on destination IP"); - return -EOPNOTSUPP; - } - -- flow_rule_match_ipv4_addrs(rule, &match); - tmp = &filter->key.ipv4.sip.value.addr[0]; - memcpy(tmp, &match.key->src, 4); - -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index 35b015c9ab025..ea265b428c2f3 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -1013,7 +1013,7 @@ static void r8168fp_adjust_ocp_cmd(struct rtl8169_private *tp, u32 *cmd, int typ - { - /* based on RTL8168FP_OOBMAC_BASE in vendor driver */ - if (tp->mac_version == RTL_GIGA_MAC_VER_52 && type == ERIAR_OOB) -- *cmd |= 0x7f0 << 18; -+ *cmd |= 0xf70 << 18; - } - - DECLARE_RTL_COND(rtl_eriar_cond) -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 590b088bc4c7f..f029c7c03804f 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -560,6 +560,8 @@ static struct sh_eth_cpu_data r7s72100_data = { - EESR_TDE, - .fdr_value = 0x0000070f, - -+ .trscer_err_mask = DESC_I_RINT8 | DESC_I_RINT5, -+ - .no_psr = 1, - .apr = 1, - .mpr = 1, -@@ -780,6 +782,8 @@ static struct sh_eth_cpu_data r7s9210_data = { - - .fdr_value = 0x0000070f, - -+ .trscer_err_mask = DESC_I_RINT8 | DESC_I_RINT5, -+ - .apr = 1, - .mpr = 1, - .tpauser = 1, -@@ -1089,6 +1093,9 @@ static struct sh_eth_cpu_data sh771x_data = { - EESIPR_CEEFIP | EESIPR_CELFIP | - EESIPR_RRFIP | EESIPR_RTLFIP | EESIPR_RTSFIP | - EESIPR_PREIP | EESIPR_CERFIP, -+ -+ .trscer_err_mask = DESC_I_RINT8, -+ - .tsu = 1, - .dual_port = 1, - }; -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c -index 103d2448e9e0d..a9087dae767de 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c -@@ -233,6 +233,7 @@ static void common_default_data(struct plat_stmmacenet_data *plat) - static int intel_mgbe_common_data(struct pci_dev *pdev, - struct plat_stmmacenet_data *plat) - { -+ char clk_name[20]; - int ret; - int i; - -@@ -300,8 +301,10 @@ static int intel_mgbe_common_data(struct pci_dev *pdev, - plat->eee_usecs_rate = plat->clk_ptp_rate; - - /* Set system clock */ -+ sprintf(clk_name, "%s-%s", "stmmac", pci_name(pdev)); -+ - plat->stmmac_clk = clk_register_fixed_rate(&pdev->dev, -- "stmmac-clk", NULL, 0, -+ clk_name, NULL, 0, - plat->clk_ptp_rate); - - if (IS_ERR(plat->stmmac_clk)) { -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c -index c6540b003b430..2ecd3a8a690c2 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c -@@ -499,10 +499,15 @@ static void dwmac4_get_rx_header_len(struct dma_desc *p, unsigned int *len) - *len = le32_to_cpu(p->des2) & RDES2_HL; - } - --static void dwmac4_set_sec_addr(struct dma_desc *p, dma_addr_t addr) -+static void dwmac4_set_sec_addr(struct dma_desc *p, dma_addr_t addr, bool buf2_valid) - { - p->des2 = cpu_to_le32(lower_32_bits(addr)); -- p->des3 = cpu_to_le32(upper_32_bits(addr) | RDES3_BUFFER2_VALID_ADDR); -+ p->des3 = cpu_to_le32(upper_32_bits(addr)); -+ -+ if (buf2_valid) -+ p->des3 |= cpu_to_le32(RDES3_BUFFER2_VALID_ADDR); -+ else -+ p->des3 &= cpu_to_le32(~RDES3_BUFFER2_VALID_ADDR); - } - - static void dwmac4_set_tbs(struct dma_edesc *p, u32 sec, u32 nsec) -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c -index bb29bfcd62c34..62aa0e95beb70 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c -@@ -124,6 +124,23 @@ static void dwmac4_dma_init_channel(void __iomem *ioaddr, - ioaddr + DMA_CHAN_INTR_ENA(chan)); - } - -+static void dwmac410_dma_init_channel(void __iomem *ioaddr, -+ struct stmmac_dma_cfg *dma_cfg, u32 chan) -+{ -+ u32 value; -+ -+ /* common channel control register config */ -+ value = readl(ioaddr + DMA_CHAN_CONTROL(chan)); -+ if (dma_cfg->pblx8) -+ value = value | DMA_BUS_MODE_PBL; -+ -+ writel(value, ioaddr + DMA_CHAN_CONTROL(chan)); -+ -+ /* Mask interrupts by writing to CSR7 */ -+ writel(DMA_CHAN_INTR_DEFAULT_MASK_4_10, -+ ioaddr + DMA_CHAN_INTR_ENA(chan)); -+} -+ - static void dwmac4_dma_init(void __iomem *ioaddr, - struct stmmac_dma_cfg *dma_cfg, int atds) - { -@@ -523,7 +540,7 @@ const struct stmmac_dma_ops dwmac4_dma_ops = { - const struct stmmac_dma_ops dwmac410_dma_ops = { - .reset = dwmac4_dma_reset, - .init = dwmac4_dma_init, -- .init_chan = dwmac4_dma_init_channel, -+ .init_chan = dwmac410_dma_init_channel, - .init_rx_chan = dwmac4_dma_init_rx_chan, - .init_tx_chan = dwmac4_dma_init_tx_chan, - .axi = dwmac4_dma_axi, -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c -index 0b4ee2dbb691d..71e50751ef2dc 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c -@@ -53,10 +53,6 @@ void dwmac4_dma_stop_tx(void __iomem *ioaddr, u32 chan) - - value &= ~DMA_CONTROL_ST; - writel(value, ioaddr + DMA_CHAN_TX_CONTROL(chan)); -- -- value = readl(ioaddr + GMAC_CONFIG); -- value &= ~GMAC_CONFIG_TE; -- writel(value, ioaddr + GMAC_CONFIG); - } - - void dwmac4_dma_start_rx(void __iomem *ioaddr, u32 chan) -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c -index 0aaf19ab56729..ccfb0102dde49 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c -@@ -292,7 +292,7 @@ static void dwxgmac2_get_rx_header_len(struct dma_desc *p, unsigned int *len) - *len = le32_to_cpu(p->des2) & XGMAC_RDES2_HL; - } - --static void dwxgmac2_set_sec_addr(struct dma_desc *p, dma_addr_t addr) -+static void dwxgmac2_set_sec_addr(struct dma_desc *p, dma_addr_t addr, bool is_valid) - { - p->des2 = cpu_to_le32(lower_32_bits(addr)); - p->des3 = cpu_to_le32(upper_32_bits(addr)); -diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h -index b40b2e0667bba..15d7b82611896 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/hwif.h -+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h -@@ -91,7 +91,7 @@ struct stmmac_desc_ops { - int (*get_rx_hash)(struct dma_desc *p, u32 *hash, - enum pkt_hash_types *type); - void (*get_rx_header_len)(struct dma_desc *p, unsigned int *len); -- void (*set_sec_addr)(struct dma_desc *p, dma_addr_t addr); -+ void (*set_sec_addr)(struct dma_desc *p, dma_addr_t addr, bool buf2_valid); - void (*set_sarc)(struct dma_desc *p, u32 sarc_type); - void (*set_vlan_tag)(struct dma_desc *p, u16 tag, u16 inner_tag, - u32 inner_type); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 26b971cd4da5a..e87961432a793 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -1303,9 +1303,10 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p, - return -ENOMEM; - - buf->sec_addr = page_pool_get_dma_addr(buf->sec_page); -- stmmac_set_desc_sec_addr(priv, p, buf->sec_addr); -+ stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, true); - } else { - buf->sec_page = NULL; -+ stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, false); - } - - buf->addr = page_pool_get_dma_addr(buf->page); -@@ -3648,7 +3649,10 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue) - DMA_FROM_DEVICE); - - stmmac_set_desc_addr(priv, p, buf->addr); -- stmmac_set_desc_sec_addr(priv, p, buf->sec_addr); -+ if (priv->sph) -+ stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, true); -+ else -+ stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, false); - stmmac_refill_desc3(priv, rx_q, p); - - rx_q->rx_count_frames++; -@@ -5144,13 +5148,16 @@ int stmmac_dvr_remove(struct device *dev) - netdev_info(priv->dev, "%s: removing driver", __func__); - - stmmac_stop_all_dma(priv); -+ stmmac_mac_set(priv, priv->ioaddr, false); -+ netif_carrier_off(ndev); -+ unregister_netdev(ndev); - -+ /* Serdes power down needs to happen after VLAN filter -+ * is deleted that is triggered by unregister_netdev(). -+ */ - if (priv->plat->serdes_powerdown) - priv->plat->serdes_powerdown(ndev, priv->plat->bsp_priv); - -- stmmac_mac_set(priv, priv->ioaddr, false); -- netif_carrier_off(ndev); -- unregister_netdev(ndev); - #ifdef CONFIG_DEBUG_FS - stmmac_exit_fs(ndev); - #endif -@@ -5257,6 +5264,8 @@ static void stmmac_reset_queues_param(struct stmmac_priv *priv) - tx_q->cur_tx = 0; - tx_q->dirty_tx = 0; - tx_q->mss = 0; -+ -+ netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue)); - } - } - -diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c -index 7178468302c8f..ad6dbf0110526 100644 ---- a/drivers/net/netdevsim/netdev.c -+++ b/drivers/net/netdevsim/netdev.c -@@ -296,6 +296,7 @@ nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port) - dev_net_set(dev, nsim_dev_net(nsim_dev)); - ns = netdev_priv(dev); - ns->netdev = dev; -+ u64_stats_init(&ns->syncp); - ns->nsim_dev = nsim_dev; - ns->nsim_dev_port = nsim_dev_port; - ns->nsim_bus_dev = nsim_dev->nsim_bus_dev; -diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c -index fff371ca1086c..423952cb9e1cd 100644 ---- a/drivers/net/phy/dp83822.c -+++ b/drivers/net/phy/dp83822.c -@@ -290,6 +290,7 @@ static int dp83822_config_intr(struct phy_device *phydev) - - static irqreturn_t dp83822_handle_interrupt(struct phy_device *phydev) - { -+ bool trigger_machine = false; - int irq_status; - - /* The MISR1 and MISR2 registers are holding the interrupt status in -@@ -305,7 +306,7 @@ static irqreturn_t dp83822_handle_interrupt(struct phy_device *phydev) - return IRQ_NONE; - } - if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) -- goto trigger_machine; -+ trigger_machine = true; - - irq_status = phy_read(phydev, MII_DP83822_MISR2); - if (irq_status < 0) { -@@ -313,11 +314,11 @@ static irqreturn_t dp83822_handle_interrupt(struct phy_device *phydev) - return IRQ_NONE; - } - if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) -- goto trigger_machine; -+ trigger_machine = true; - -- return IRQ_NONE; -+ if (!trigger_machine) -+ return IRQ_NONE; - --trigger_machine: - phy_trigger_machine(phydev); - - return IRQ_HANDLED; -diff --git a/drivers/net/phy/dp83tc811.c b/drivers/net/phy/dp83tc811.c -index 688fadffb249d..7ea32fb77190c 100644 ---- a/drivers/net/phy/dp83tc811.c -+++ b/drivers/net/phy/dp83tc811.c -@@ -264,6 +264,7 @@ static int dp83811_config_intr(struct phy_device *phydev) - - static irqreturn_t dp83811_handle_interrupt(struct phy_device *phydev) - { -+ bool trigger_machine = false; - int irq_status; - - /* The INT_STAT registers 1, 2 and 3 are holding the interrupt status -@@ -279,7 +280,7 @@ static irqreturn_t dp83811_handle_interrupt(struct phy_device *phydev) - return IRQ_NONE; - } - if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) -- goto trigger_machine; -+ trigger_machine = true; - - irq_status = phy_read(phydev, MII_DP83811_INT_STAT2); - if (irq_status < 0) { -@@ -287,7 +288,7 @@ static irqreturn_t dp83811_handle_interrupt(struct phy_device *phydev) - return IRQ_NONE; - } - if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) -- goto trigger_machine; -+ trigger_machine = true; - - irq_status = phy_read(phydev, MII_DP83811_INT_STAT3); - if (irq_status < 0) { -@@ -295,11 +296,11 @@ static irqreturn_t dp83811_handle_interrupt(struct phy_device *phydev) - return IRQ_NONE; - } - if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) -- goto trigger_machine; -+ trigger_machine = true; - -- return IRQ_NONE; -+ if (!trigger_machine) -+ return IRQ_NONE; - --trigger_machine: - phy_trigger_machine(phydev); - - return IRQ_HANDLED; -diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c -index 45f75533c47ce..b79c4068ee619 100644 ---- a/drivers/net/phy/phy.c -+++ b/drivers/net/phy/phy.c -@@ -276,14 +276,16 @@ int phy_ethtool_ksettings_set(struct phy_device *phydev, - - phydev->autoneg = autoneg; - -- phydev->speed = speed; -+ if (autoneg == AUTONEG_DISABLE) { -+ phydev->speed = speed; -+ phydev->duplex = duplex; -+ } - - linkmode_copy(phydev->advertising, advertising); - - linkmode_mod_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, - phydev->advertising, autoneg == AUTONEG_ENABLE); - -- phydev->duplex = duplex; - phydev->master_slave_set = cmd->base.master_slave_cfg; - phydev->mdix_ctrl = cmd->base.eth_tp_mdix_ctrl; - -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 71169e7d6177d..1c6ae845e03f2 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -230,7 +230,6 @@ static struct phy_driver genphy_driver; - static LIST_HEAD(phy_fixup_list); - static DEFINE_MUTEX(phy_fixup_lock); - --#ifdef CONFIG_PM - static bool mdio_bus_phy_may_suspend(struct phy_device *phydev) - { - struct device_driver *drv = phydev->mdio.dev.driver; -@@ -270,7 +269,7 @@ out: - return !phydev->suspended; - } - --static int mdio_bus_phy_suspend(struct device *dev) -+static __maybe_unused int mdio_bus_phy_suspend(struct device *dev) - { - struct phy_device *phydev = to_phy_device(dev); - -@@ -290,7 +289,7 @@ static int mdio_bus_phy_suspend(struct device *dev) - return phy_suspend(phydev); - } - --static int mdio_bus_phy_resume(struct device *dev) -+static __maybe_unused int mdio_bus_phy_resume(struct device *dev) - { - struct phy_device *phydev = to_phy_device(dev); - int ret; -@@ -316,7 +315,6 @@ no_resume: - - static SIMPLE_DEV_PM_OPS(mdio_bus_phy_pm_ops, mdio_bus_phy_suspend, - mdio_bus_phy_resume); --#endif /* CONFIG_PM */ - - /** - * phy_register_fixup - creates a new phy_fixup and adds it to the list -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 7410215e2a2e9..e18ded349d840 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -396,13 +396,6 @@ static ssize_t add_mux_store(struct device *d, struct device_attribute *attr, c - goto err; - } - -- /* we don't want to modify a running netdev */ -- if (netif_running(dev->net)) { -- netdev_err(dev->net, "Cannot change a running device\n"); -- ret = -EBUSY; -- goto err; -- } -- - ret = qmimux_register_device(dev->net, mux_id); - if (!ret) { - info->flags |= QMI_WWAN_FLAG_MUX; -@@ -432,13 +425,6 @@ static ssize_t del_mux_store(struct device *d, struct device_attribute *attr, c - if (!rtnl_trylock()) - return restart_syscall(); - -- /* we don't want to modify a running netdev */ -- if (netif_running(dev->net)) { -- netdev_err(dev->net, "Cannot change a running device\n"); -- ret = -EBUSY; -- goto err; -- } -- - del_dev = qmimux_find_dev(dev, mux_id); - if (!del_dev) { - netdev_err(dev->net, "mux_id not present\n"); -diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c -index 605fe555e157d..c3372498f4f15 100644 ---- a/drivers/net/wan/lapbether.c -+++ b/drivers/net/wan/lapbether.c -@@ -292,7 +292,6 @@ static int lapbeth_open(struct net_device *dev) - return -ENODEV; - } - -- netif_start_queue(dev); - return 0; - } - -@@ -300,8 +299,6 @@ static int lapbeth_close(struct net_device *dev) - { - int err; - -- netif_stop_queue(dev); -- - if ((err = lapb_unregister(dev)) != LAPB_OK) - pr_err("lapb_unregister error: %d\n", err); - -diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c -index 7d799fe6fbd89..54bdef33f3f85 100644 ---- a/drivers/net/wireless/ath/ath11k/mac.c -+++ b/drivers/net/wireless/ath/ath11k/mac.c -@@ -5299,8 +5299,8 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, - } - - if (ab->hw_params.vdev_start_delay && -- (arvif->vdev_type == WMI_VDEV_TYPE_AP || -- arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)) { -+ arvif->vdev_type != WMI_VDEV_TYPE_AP && -+ arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) { - param.vdev_id = arvif->vdev_id; - param.peer_type = WMI_PEER_TYPE_DEFAULT; - param.peer_addr = ar->mac_addr; -diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h -index 13b4f5f50f8aa..ef6f5ea06c1f5 100644 ---- a/drivers/net/wireless/ath/ath9k/ath9k.h -+++ b/drivers/net/wireless/ath/ath9k/ath9k.h -@@ -177,7 +177,8 @@ struct ath_frame_info { - s8 txq; - u8 keyix; - u8 rtscts_rate; -- u8 retries : 7; -+ u8 retries : 6; -+ u8 dyn_smps : 1; - u8 baw_tracked : 1; - u8 tx_power; - enum ath9k_key_type keytype:2; -diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c -index e60d4737fc6e4..5691bd6eb82c2 100644 ---- a/drivers/net/wireless/ath/ath9k/xmit.c -+++ b/drivers/net/wireless/ath/ath9k/xmit.c -@@ -1271,6 +1271,11 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf, - is_40, is_sgi, is_sp); - if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC)) - info->rates[i].RateFlags |= ATH9K_RATESERIES_STBC; -+ if (rix >= 8 && fi->dyn_smps) { -+ info->rates[i].RateFlags |= -+ ATH9K_RATESERIES_RTS_CTS; -+ info->flags |= ATH9K_TXDESC_CTSENA; -+ } - - info->txpower[i] = ath_get_rate_txpower(sc, bf, rix, - is_40, false); -@@ -2114,6 +2119,7 @@ static void setup_frame_info(struct ieee80211_hw *hw, - fi->keyix = an->ps_key; - else - fi->keyix = ATH9K_TXKEYIX_INVALID; -+ fi->dyn_smps = sta && sta->smps_mode == IEEE80211_SMPS_DYNAMIC; - fi->keytype = keytype; - fi->framelen = framelen; - fi->tx_power = txpower; -diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c -index e81dfaf99bcbf..9bf13994c036b 100644 ---- a/drivers/net/wireless/mediatek/mt76/dma.c -+++ b/drivers/net/wireless/mediatek/mt76/dma.c -@@ -511,13 +511,13 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, - { - struct sk_buff *skb = q->rx_head; - struct skb_shared_info *shinfo = skb_shinfo(skb); -+ int nr_frags = shinfo->nr_frags; - -- if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) { -+ if (nr_frags < ARRAY_SIZE(shinfo->frags)) { - struct page *page = virt_to_head_page(data); - int offset = data - page_address(page) + q->buf_offset; - -- skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len, -- q->buf_size); -+ skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size); - } else { - skb_free_frag(data); - } -@@ -526,7 +526,10 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, - return; - - q->rx_head = NULL; -- dev->drv->rx_skb(dev, q - dev->q_rx, skb); -+ if (nr_frags < ARRAY_SIZE(shinfo->frags)) -+ dev->drv->rx_skb(dev, q - dev->q_rx, skb); -+ else -+ dev_kfree_skb(skb); - } - - static int -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index 5f36cfa8136c0..7ec6869b3e5b1 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -2055,7 +2055,7 @@ done: - nvme_fc_complete_rq(rq); - - check_error: -- if (terminate_assoc) -+ if (terminate_assoc && ctrl->ctrl.state != NVME_CTRL_RESETTING) - queue_work(nvme_reset_wq, &ctrl->ioerr_work); - } - -diff --git a/drivers/opp/core.c b/drivers/opp/core.c -index 8c905aabacc01..f4fb43816e595 100644 ---- a/drivers/opp/core.c -+++ b/drivers/opp/core.c -@@ -1335,7 +1335,11 @@ static struct dev_pm_opp *_opp_get_next(struct opp_table *opp_table, - - mutex_lock(&opp_table->lock); - list_for_each_entry(temp, &opp_table->opp_list, node) { -- if (dynamic == temp->dynamic) { -+ /* -+ * Refcount must be dropped only once for each OPP by OPP core, -+ * do that with help of "removed" flag. -+ */ -+ if (!temp->removed && dynamic == temp->dynamic) { - opp = temp; - break; - } -@@ -1345,10 +1349,27 @@ static struct dev_pm_opp *_opp_get_next(struct opp_table *opp_table, - return opp; - } - --bool _opp_remove_all_static(struct opp_table *opp_table) -+/* -+ * Can't call dev_pm_opp_put() from under the lock as debugfs removal needs to -+ * happen lock less to avoid circular dependency issues. This routine must be -+ * called without the opp_table->lock held. -+ */ -+static void _opp_remove_all(struct opp_table *opp_table, bool dynamic) - { - struct dev_pm_opp *opp; - -+ while ((opp = _opp_get_next(opp_table, dynamic))) { -+ opp->removed = true; -+ dev_pm_opp_put(opp); -+ -+ /* Drop the references taken by dev_pm_opp_add() */ -+ if (dynamic) -+ dev_pm_opp_put_opp_table(opp_table); -+ } -+} -+ -+bool _opp_remove_all_static(struct opp_table *opp_table) -+{ - mutex_lock(&opp_table->lock); - - if (!opp_table->parsed_static_opps) { -@@ -1363,13 +1384,7 @@ bool _opp_remove_all_static(struct opp_table *opp_table) - - mutex_unlock(&opp_table->lock); - -- /* -- * Can't remove the OPP from under the lock, debugfs removal needs to -- * happen lock less to avoid circular dependency issues. -- */ -- while ((opp = _opp_get_next(opp_table, false))) -- dev_pm_opp_put(opp); -- -+ _opp_remove_all(opp_table, false); - return true; - } - -@@ -1382,25 +1397,12 @@ bool _opp_remove_all_static(struct opp_table *opp_table) - void dev_pm_opp_remove_all_dynamic(struct device *dev) - { - struct opp_table *opp_table; -- struct dev_pm_opp *opp; -- int count = 0; - - opp_table = _find_opp_table(dev); - if (IS_ERR(opp_table)) - return; - -- /* -- * Can't remove the OPP from under the lock, debugfs removal needs to -- * happen lock less to avoid circular dependency issues. -- */ -- while ((opp = _opp_get_next(opp_table, true))) { -- dev_pm_opp_put(opp); -- count++; -- } -- -- /* Drop the references taken by dev_pm_opp_add() */ -- while (count--) -- dev_pm_opp_put_opp_table(opp_table); -+ _opp_remove_all(opp_table, true); - - /* Drop the reference taken by _find_opp_table() */ - dev_pm_opp_put_opp_table(opp_table); -diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h -index 4ced7ffa8158e..8dca37662dd83 100644 ---- a/drivers/opp/opp.h -+++ b/drivers/opp/opp.h -@@ -56,6 +56,7 @@ extern struct list_head opp_tables; - * @dynamic: not-created from static DT entries. - * @turbo: true if turbo (boost) OPP - * @suspend: true if suspend OPP -+ * @removed: flag indicating that OPP's reference is dropped by OPP core. - * @pstate: Device's power domain's performance state. - * @rate: Frequency in hertz - * @level: Performance level -@@ -78,6 +79,7 @@ struct dev_pm_opp { - bool dynamic; - bool turbo; - bool suspend; -+ bool removed; - unsigned int pstate; - unsigned long rate; - unsigned int level; -diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c -index 2470782cb01af..1c34c897a7e2a 100644 ---- a/drivers/pci/controller/pci-xgene-msi.c -+++ b/drivers/pci/controller/pci-xgene-msi.c -@@ -384,13 +384,9 @@ static int xgene_msi_hwirq_alloc(unsigned int cpu) - if (!msi_group->gic_irq) - continue; - -- irq_set_chained_handler(msi_group->gic_irq, -- xgene_msi_isr); -- err = irq_set_handler_data(msi_group->gic_irq, msi_group); -- if (err) { -- pr_err("failed to register GIC IRQ handler\n"); -- return -EINVAL; -- } -+ irq_set_chained_handler_and_data(msi_group->gic_irq, -+ xgene_msi_isr, msi_group); -+ - /* - * Statically allocate MSI GIC IRQs to each CPU core. - * With 8-core X-Gene v1, 2 MSI GIC IRQs are allocated -diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c -index cf4c18f0c25ab..23548b517e4b6 100644 ---- a/drivers/pci/controller/pcie-mediatek.c -+++ b/drivers/pci/controller/pcie-mediatek.c -@@ -1035,14 +1035,14 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie) - err = of_pci_get_devfn(child); - if (err < 0) { - dev_err(dev, "failed to parse devfn: %d\n", err); -- return err; -+ goto error_put_node; - } - - slot = PCI_SLOT(err); - - err = mtk_pcie_parse_port(pcie, child, slot); - if (err) -- return err; -+ goto error_put_node; - } - - err = mtk_pcie_subsys_powerup(pcie); -@@ -1058,6 +1058,9 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie) - mtk_pcie_subsys_powerdown(pcie); - - return 0; -+error_put_node: -+ of_node_put(child); -+ return err; - } - - static int mtk_pcie_probe(struct platform_device *pdev) -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index ba791165ed194..9449dfde2841e 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -4029,6 +4029,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr, - ret = logic_pio_register_range(range); - if (ret) - kfree(range); -+ -+ /* Ignore duplicates due to deferred probing */ -+ if (ret == -EEXIST) -+ ret = 0; - #endif - - return ret; -diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig -index 3946555a60422..45a2ef702b45b 100644 ---- a/drivers/pci/pcie/Kconfig -+++ b/drivers/pci/pcie/Kconfig -@@ -133,14 +133,6 @@ config PCIE_PTM - This is only useful if you have devices that support PTM, but it - is safe to enable even if you don't. - --config PCIE_BW -- bool "PCI Express Bandwidth Change Notification" -- depends on PCIEPORTBUS -- help -- This enables PCI Express Bandwidth Change Notification. If -- you know link width or rate changes occur only to correct -- unreliable links, you may answer Y. -- - config PCIE_EDR - bool "PCI Express Error Disconnect Recover support" - depends on PCIE_DPC && ACPI -diff --git a/drivers/pci/pcie/Makefile b/drivers/pci/pcie/Makefile -index d9697892fa3e9..b2980db88cc09 100644 ---- a/drivers/pci/pcie/Makefile -+++ b/drivers/pci/pcie/Makefile -@@ -12,5 +12,4 @@ obj-$(CONFIG_PCIEAER_INJECT) += aer_inject.o - obj-$(CONFIG_PCIE_PME) += pme.o - obj-$(CONFIG_PCIE_DPC) += dpc.o - obj-$(CONFIG_PCIE_PTM) += ptm.o --obj-$(CONFIG_PCIE_BW) += bw_notification.o - obj-$(CONFIG_PCIE_EDR) += edr.o -diff --git a/drivers/pci/pcie/bw_notification.c b/drivers/pci/pcie/bw_notification.c -deleted file mode 100644 -index 565d23cccb8b5..0000000000000 ---- a/drivers/pci/pcie/bw_notification.c -+++ /dev/null -@@ -1,138 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0+ --/* -- * PCI Express Link Bandwidth Notification services driver -- * Author: Alexandru Gagniuc -- * -- * Copyright (C) 2019, Dell Inc -- * -- * The PCIe Link Bandwidth Notification provides a way to notify the -- * operating system when the link width or data rate changes. This -- * capability is required for all root ports and downstream ports -- * supporting links wider than x1 and/or multiple link speeds. -- * -- * This service port driver hooks into the bandwidth notification interrupt -- * and warns when links become degraded in operation. -- */ -- --#define dev_fmt(fmt) "bw_notification: " fmt -- --#include "../pci.h" --#include "portdrv.h" -- --static bool pcie_link_bandwidth_notification_supported(struct pci_dev *dev) --{ -- int ret; -- u32 lnk_cap; -- -- ret = pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &lnk_cap); -- return (ret == PCIBIOS_SUCCESSFUL) && (lnk_cap & PCI_EXP_LNKCAP_LBNC); --} -- --static void pcie_enable_link_bandwidth_notification(struct pci_dev *dev) --{ -- u16 lnk_ctl; -- -- pcie_capability_write_word(dev, PCI_EXP_LNKSTA, PCI_EXP_LNKSTA_LBMS); -- -- pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnk_ctl); -- lnk_ctl |= PCI_EXP_LNKCTL_LBMIE; -- pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl); --} -- --static void pcie_disable_link_bandwidth_notification(struct pci_dev *dev) --{ -- u16 lnk_ctl; -- -- pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnk_ctl); -- lnk_ctl &= ~PCI_EXP_LNKCTL_LBMIE; -- pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl); --} -- --static irqreturn_t pcie_bw_notification_irq(int irq, void *context) --{ -- struct pcie_device *srv = context; -- struct pci_dev *port = srv->port; -- u16 link_status, events; -- int ret; -- -- ret = pcie_capability_read_word(port, PCI_EXP_LNKSTA, &link_status); -- events = link_status & PCI_EXP_LNKSTA_LBMS; -- -- if (ret != PCIBIOS_SUCCESSFUL || !events) -- return IRQ_NONE; -- -- pcie_capability_write_word(port, PCI_EXP_LNKSTA, events); -- pcie_update_link_speed(port->subordinate, link_status); -- return IRQ_WAKE_THREAD; --} -- --static irqreturn_t pcie_bw_notification_handler(int irq, void *context) --{ -- struct pcie_device *srv = context; -- struct pci_dev *port = srv->port; -- struct pci_dev *dev; -- -- /* -- * Print status from downstream devices, not this root port or -- * downstream switch port. -- */ -- down_read(&pci_bus_sem); -- list_for_each_entry(dev, &port->subordinate->devices, bus_list) -- pcie_report_downtraining(dev); -- up_read(&pci_bus_sem); -- -- return IRQ_HANDLED; --} -- --static int pcie_bandwidth_notification_probe(struct pcie_device *srv) --{ -- int ret; -- -- /* Single-width or single-speed ports do not have to support this. */ -- if (!pcie_link_bandwidth_notification_supported(srv->port)) -- return -ENODEV; -- -- ret = request_threaded_irq(srv->irq, pcie_bw_notification_irq, -- pcie_bw_notification_handler, -- IRQF_SHARED, "PCIe BW notif", srv); -- if (ret) -- return ret; -- -- pcie_enable_link_bandwidth_notification(srv->port); -- pci_info(srv->port, "enabled with IRQ %d\n", srv->irq); -- -- return 0; --} -- --static void pcie_bandwidth_notification_remove(struct pcie_device *srv) --{ -- pcie_disable_link_bandwidth_notification(srv->port); -- free_irq(srv->irq, srv); --} -- --static int pcie_bandwidth_notification_suspend(struct pcie_device *srv) --{ -- pcie_disable_link_bandwidth_notification(srv->port); -- return 0; --} -- --static int pcie_bandwidth_notification_resume(struct pcie_device *srv) --{ -- pcie_enable_link_bandwidth_notification(srv->port); -- return 0; --} -- --static struct pcie_port_service_driver pcie_bandwidth_notification_driver = { -- .name = "pcie_bw_notification", -- .port_type = PCIE_ANY_PORT, -- .service = PCIE_PORT_SERVICE_BWNOTIF, -- .probe = pcie_bandwidth_notification_probe, -- .suspend = pcie_bandwidth_notification_suspend, -- .resume = pcie_bandwidth_notification_resume, -- .remove = pcie_bandwidth_notification_remove, --}; -- --int __init pcie_bandwidth_notification_init(void) --{ -- return pcie_port_service_register(&pcie_bandwidth_notification_driver); --} -diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c -index 510f31f0ef6d0..4798bd6de97d5 100644 ---- a/drivers/pci/pcie/err.c -+++ b/drivers/pci/pcie/err.c -@@ -198,8 +198,7 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev, - pci_dbg(bridge, "broadcast error_detected message\n"); - if (state == pci_channel_io_frozen) { - pci_walk_bridge(bridge, report_frozen_detected, &status); -- status = reset_subordinates(bridge); -- if (status != PCI_ERS_RESULT_RECOVERED) { -+ if (reset_subordinates(bridge) != PCI_ERS_RESULT_RECOVERED) { - pci_warn(bridge, "subordinate device reset failed\n"); - goto failed; - } -diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h -index af7cf237432ac..2ff5724b8f13f 100644 ---- a/drivers/pci/pcie/portdrv.h -+++ b/drivers/pci/pcie/portdrv.h -@@ -53,12 +53,6 @@ int pcie_dpc_init(void); - static inline int pcie_dpc_init(void) { return 0; } - #endif - --#ifdef CONFIG_PCIE_BW --int pcie_bandwidth_notification_init(void); --#else --static inline int pcie_bandwidth_notification_init(void) { return 0; } --#endif -- - /* Port Type */ - #define PCIE_ANY_PORT (~0) - -diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c -index 0b250bc5f4050..8bd4992a4f328 100644 ---- a/drivers/pci/pcie/portdrv_pci.c -+++ b/drivers/pci/pcie/portdrv_pci.c -@@ -255,7 +255,6 @@ static void __init pcie_init_services(void) - pcie_pme_init(); - pcie_dpc_init(); - pcie_hp_init(); -- pcie_bandwidth_notification_init(); - } - - static int __init pcie_portdrv_init(void) -diff --git a/drivers/perf/arm_dmc620_pmu.c b/drivers/perf/arm_dmc620_pmu.c -index 004930eb4bbb6..b50b47f1a0d92 100644 ---- a/drivers/perf/arm_dmc620_pmu.c -+++ b/drivers/perf/arm_dmc620_pmu.c -@@ -681,6 +681,7 @@ static int dmc620_pmu_device_probe(struct platform_device *pdev) - if (!name) { - dev_err(&pdev->dev, - "Create name failed, PMU @%pa\n", &res->start); -+ ret = -ENOMEM; - goto out_teardown_dev; - } - -diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c -index f64b82824db28..2db7113383fdc 100644 ---- a/drivers/platform/olpc/olpc-ec.c -+++ b/drivers/platform/olpc/olpc-ec.c -@@ -426,11 +426,8 @@ static int olpc_ec_probe(struct platform_device *pdev) - - /* get the EC revision */ - err = olpc_ec_cmd(EC_FIRMWARE_REV, NULL, 0, &ec->version, 1); -- if (err) { -- ec_priv = NULL; -- kfree(ec); -- return err; -- } -+ if (err) -+ goto error; - - config.dev = pdev->dev.parent; - config.driver_data = ec; -@@ -440,12 +437,16 @@ static int olpc_ec_probe(struct platform_device *pdev) - if (IS_ERR(ec->dcon_rdev)) { - dev_err(&pdev->dev, "failed to register DCON regulator\n"); - err = PTR_ERR(ec->dcon_rdev); -- kfree(ec); -- return err; -+ goto error; - } - - ec->dbgfs_dir = olpc_ec_setup_debugfs(); - -+ return 0; -+ -+error: -+ ec_priv = NULL; -+ kfree(ec); - return err; - } - -diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c -index ef83425724634..b9da58ee9b1e3 100644 ---- a/drivers/platform/x86/amd-pmc.c -+++ b/drivers/platform/x86/amd-pmc.c -@@ -210,31 +210,39 @@ static int amd_pmc_probe(struct platform_device *pdev) - dev->dev = &pdev->dev; - - rdev = pci_get_domain_bus_and_slot(0, 0, PCI_DEVFN(0, 0)); -- if (!rdev || !pci_match_id(pmc_pci_ids, rdev)) -+ if (!rdev || !pci_match_id(pmc_pci_ids, rdev)) { -+ pci_dev_put(rdev); - return -ENODEV; -+ } - - dev->cpu_id = rdev->device; - err = pci_write_config_dword(rdev, AMD_PMC_SMU_INDEX_ADDRESS, AMD_PMC_BASE_ADDR_LO); - if (err) { - dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMC_SMU_INDEX_ADDRESS); -+ pci_dev_put(rdev); - return pcibios_err_to_errno(err); - } - - err = pci_read_config_dword(rdev, AMD_PMC_SMU_INDEX_DATA, &val); -- if (err) -+ if (err) { -+ pci_dev_put(rdev); - return pcibios_err_to_errno(err); -+ } - - base_addr_lo = val & AMD_PMC_BASE_ADDR_HI_MASK; - - err = pci_write_config_dword(rdev, AMD_PMC_SMU_INDEX_ADDRESS, AMD_PMC_BASE_ADDR_HI); - if (err) { - dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMC_SMU_INDEX_ADDRESS); -+ pci_dev_put(rdev); - return pcibios_err_to_errno(err); - } - - err = pci_read_config_dword(rdev, AMD_PMC_SMU_INDEX_DATA, &val); -- if (err) -+ if (err) { -+ pci_dev_put(rdev); - return pcibios_err_to_errno(err); -+ } - - base_addr_hi = val & AMD_PMC_BASE_ADDR_LO_MASK; - pci_dev_put(rdev); -diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c -index c7eb9a10c680d..3101eab0adddb 100644 ---- a/drivers/s390/block/dasd.c -+++ b/drivers/s390/block/dasd.c -@@ -3068,7 +3068,8 @@ static blk_status_t do_dasd_request(struct blk_mq_hw_ctx *hctx, - - basedev = block->base; - spin_lock_irq(&dq->lock); -- if (basedev->state < DASD_STATE_READY) { -+ if (basedev->state < DASD_STATE_READY || -+ test_bit(DASD_FLAG_OFFLINE, &basedev->flags)) { - DBF_DEV_EVENT(DBF_ERR, basedev, - "device not ready for request %p", req); - rc = BLK_STS_IOERR; -@@ -3503,8 +3504,6 @@ void dasd_generic_remove(struct ccw_device *cdev) - struct dasd_device *device; - struct dasd_block *block; - -- cdev->handler = NULL; -- - device = dasd_device_from_cdev(cdev); - if (IS_ERR(device)) { - dasd_remove_sysfs_files(cdev); -@@ -3523,6 +3522,7 @@ void dasd_generic_remove(struct ccw_device *cdev) - * no quite down yet. - */ - dasd_set_target_state(device, DASD_STATE_NEW); -+ cdev->handler = NULL; - /* dasd_delete_device destroys the device reference. */ - block = device->block; - dasd_delete_device(device); -diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c -index 68106be4ba7a1..767ac41686fe2 100644 ---- a/drivers/s390/cio/vfio_ccw_ops.c -+++ b/drivers/s390/cio/vfio_ccw_ops.c -@@ -543,7 +543,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struct mdev_device *mdev, - if (ret) - return ret; - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0; - } - case VFIO_DEVICE_GET_REGION_INFO: - { -@@ -561,7 +561,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struct mdev_device *mdev, - if (ret) - return ret; - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0; - } - case VFIO_DEVICE_GET_IRQ_INFO: - { -@@ -582,7 +582,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struct mdev_device *mdev, - if (info.count == -1) - return -EINVAL; - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0; - } - case VFIO_DEVICE_SET_IRQS: - { -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index 41fc2e4135fe1..1ffdd411201cd 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -1286,7 +1286,7 @@ static int vfio_ap_mdev_get_device_info(unsigned long arg) - info.num_regions = 0; - info.num_irqs = 0; - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0; - } - - static ssize_t vfio_ap_mdev_ioctl(struct mdev_device *mdev, -diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h -index 28f637042d444..7aed775ee874e 100644 ---- a/drivers/s390/net/qeth_core.h -+++ b/drivers/s390/net/qeth_core.h -@@ -436,7 +436,7 @@ struct qeth_qdio_out_buffer { - int is_header[QDIO_MAX_ELEMENTS_PER_BUFFER]; - - struct qeth_qdio_out_q *q; -- struct qeth_qdio_out_buffer *next_pending; -+ struct list_head list_entry; - }; - - struct qeth_card; -@@ -500,6 +500,7 @@ struct qeth_qdio_out_q { - struct qdio_buffer *qdio_bufs[QDIO_MAX_BUFFERS_PER_Q]; - struct qeth_qdio_out_buffer *bufs[QDIO_MAX_BUFFERS_PER_Q]; - struct qdio_outbuf_state *bufstates; /* convenience pointer */ -+ struct list_head pending_bufs; - struct qeth_out_q_stats stats; - spinlock_t lock; - unsigned int priority; -diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c -index cf18d87da41e2..5e4dcc9aae1b6 100644 ---- a/drivers/s390/net/qeth_core_main.c -+++ b/drivers/s390/net/qeth_core_main.c -@@ -73,8 +73,6 @@ static void qeth_free_qdio_queues(struct qeth_card *card); - static void qeth_notify_skbs(struct qeth_qdio_out_q *queue, - struct qeth_qdio_out_buffer *buf, - enum iucv_tx_notify notification); --static void qeth_tx_complete_buf(struct qeth_qdio_out_buffer *buf, bool error, -- int budget); - - static void qeth_close_dev_handler(struct work_struct *work) - { -@@ -465,41 +463,6 @@ static enum iucv_tx_notify qeth_compute_cq_notification(int sbalf15, - return n; - } - --static void qeth_cleanup_handled_pending(struct qeth_qdio_out_q *q, int bidx, -- int forced_cleanup) --{ -- if (q->card->options.cq != QETH_CQ_ENABLED) -- return; -- -- if (q->bufs[bidx]->next_pending != NULL) { -- struct qeth_qdio_out_buffer *head = q->bufs[bidx]; -- struct qeth_qdio_out_buffer *c = q->bufs[bidx]->next_pending; -- -- while (c) { -- if (forced_cleanup || -- atomic_read(&c->state) == QETH_QDIO_BUF_EMPTY) { -- struct qeth_qdio_out_buffer *f = c; -- -- QETH_CARD_TEXT(f->q->card, 5, "fp"); -- QETH_CARD_TEXT_(f->q->card, 5, "%lx", (long) f); -- /* release here to avoid interleaving between -- outbound tasklet and inbound tasklet -- regarding notifications and lifecycle */ -- qeth_tx_complete_buf(c, forced_cleanup, 0); -- -- c = f->next_pending; -- WARN_ON_ONCE(head->next_pending != f); -- head->next_pending = c; -- kmem_cache_free(qeth_qdio_outbuf_cache, f); -- } else { -- head = c; -- c = c->next_pending; -- } -- -- } -- } --} -- - static void qeth_qdio_handle_aob(struct qeth_card *card, - unsigned long phys_aob_addr) - { -@@ -507,6 +470,7 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, - struct qaob *aob; - struct qeth_qdio_out_buffer *buffer; - enum iucv_tx_notify notification; -+ struct qeth_qdio_out_q *queue; - unsigned int i; - - aob = (struct qaob *) phys_to_virt(phys_aob_addr); -@@ -537,7 +501,7 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, - qeth_notify_skbs(buffer->q, buffer, notification); - - /* Free dangling allocations. The attached skbs are handled by -- * qeth_cleanup_handled_pending(). -+ * qeth_tx_complete_pending_bufs(). - */ - for (i = 0; - i < aob->sb_count && i < QETH_MAX_BUFFER_ELEMENTS(card); -@@ -549,7 +513,9 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, - buffer->is_header[i] = 0; - } - -+ queue = buffer->q; - atomic_set(&buffer->state, QETH_QDIO_BUF_EMPTY); -+ napi_schedule(&queue->napi); - break; - default: - WARN_ON_ONCE(1); -@@ -1420,9 +1386,6 @@ static void qeth_tx_complete_buf(struct qeth_qdio_out_buffer *buf, bool error, - struct qeth_qdio_out_q *queue = buf->q; - struct sk_buff *skb; - -- if (atomic_read(&buf->state) == QETH_QDIO_BUF_PENDING) -- qeth_notify_skbs(queue, buf, TX_NOTIFY_GENERALERROR); -- - /* Empty buffer? */ - if (buf->next_element_to_fill == 0) - return; -@@ -1484,14 +1447,38 @@ static void qeth_clear_output_buffer(struct qeth_qdio_out_q *queue, - atomic_set(&buf->state, QETH_QDIO_BUF_EMPTY); - } - -+static void qeth_tx_complete_pending_bufs(struct qeth_card *card, -+ struct qeth_qdio_out_q *queue, -+ bool drain) -+{ -+ struct qeth_qdio_out_buffer *buf, *tmp; -+ -+ list_for_each_entry_safe(buf, tmp, &queue->pending_bufs, list_entry) { -+ if (drain || atomic_read(&buf->state) == QETH_QDIO_BUF_EMPTY) { -+ QETH_CARD_TEXT(card, 5, "fp"); -+ QETH_CARD_TEXT_(card, 5, "%lx", (long) buf); -+ -+ if (drain) -+ qeth_notify_skbs(queue, buf, -+ TX_NOTIFY_GENERALERROR); -+ qeth_tx_complete_buf(buf, drain, 0); -+ -+ list_del(&buf->list_entry); -+ kmem_cache_free(qeth_qdio_outbuf_cache, buf); -+ } -+ } -+} -+ - static void qeth_drain_output_queue(struct qeth_qdio_out_q *q, bool free) - { - int j; - -+ qeth_tx_complete_pending_bufs(q->card, q, true); -+ - for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j) { - if (!q->bufs[j]) - continue; -- qeth_cleanup_handled_pending(q, j, 1); -+ - qeth_clear_output_buffer(q, q->bufs[j], true, 0); - if (free) { - kmem_cache_free(qeth_qdio_outbuf_cache, q->bufs[j]); -@@ -2611,7 +2598,6 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx) - skb_queue_head_init(&newbuf->skb_list); - lockdep_set_class(&newbuf->skb_list.lock, &qdio_out_skb_queue_key); - newbuf->q = q; -- newbuf->next_pending = q->bufs[bidx]; - atomic_set(&newbuf->state, QETH_QDIO_BUF_EMPTY); - q->bufs[bidx] = newbuf; - return 0; -@@ -2630,15 +2616,28 @@ static void qeth_free_output_queue(struct qeth_qdio_out_q *q) - static struct qeth_qdio_out_q *qeth_alloc_output_queue(void) - { - struct qeth_qdio_out_q *q = kzalloc(sizeof(*q), GFP_KERNEL); -+ unsigned int i; - - if (!q) - return NULL; - -- if (qdio_alloc_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q)) { -- kfree(q); -- return NULL; -+ if (qdio_alloc_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q)) -+ goto err_qdio_bufs; -+ -+ for (i = 0; i < QDIO_MAX_BUFFERS_PER_Q; i++) { -+ if (qeth_init_qdio_out_buf(q, i)) -+ goto err_out_bufs; - } -+ - return q; -+ -+err_out_bufs: -+ while (i > 0) -+ kmem_cache_free(qeth_qdio_outbuf_cache, q->bufs[--i]); -+ qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q); -+err_qdio_bufs: -+ kfree(q); -+ return NULL; - } - - static void qeth_tx_completion_timer(struct timer_list *timer) -@@ -2651,7 +2650,7 @@ static void qeth_tx_completion_timer(struct timer_list *timer) - - static int qeth_alloc_qdio_queues(struct qeth_card *card) - { -- int i, j; -+ unsigned int i; - - QETH_CARD_TEXT(card, 2, "allcqdbf"); - -@@ -2680,18 +2679,12 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card) - card->qdio.out_qs[i] = queue; - queue->card = card; - queue->queue_no = i; -+ INIT_LIST_HEAD(&queue->pending_bufs); - spin_lock_init(&queue->lock); - timer_setup(&queue->timer, qeth_tx_completion_timer, 0); - queue->coalesce_usecs = QETH_TX_COALESCE_USECS; - queue->max_coalesced_frames = QETH_TX_MAX_COALESCED_FRAMES; - queue->priority = QETH_QIB_PQUE_PRIO_DEFAULT; -- -- /* give outbound qeth_qdio_buffers their qdio_buffers */ -- for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j) { -- WARN_ON(queue->bufs[j]); -- if (qeth_init_qdio_out_buf(queue, j)) -- goto out_freeoutqbufs; -- } - } - - /* completion */ -@@ -2700,13 +2693,6 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card) - - return 0; - --out_freeoutqbufs: -- while (j > 0) { -- --j; -- kmem_cache_free(qeth_qdio_outbuf_cache, -- card->qdio.out_qs[i]->bufs[j]); -- card->qdio.out_qs[i]->bufs[j] = NULL; -- } - out_freeoutq: - while (i > 0) { - qeth_free_output_queue(card->qdio.out_qs[--i]); -@@ -6100,6 +6086,8 @@ static void qeth_iqd_tx_complete(struct qeth_qdio_out_q *queue, - qeth_schedule_recovery(card); - } - -+ list_add(&buffer->list_entry, -+ &queue->pending_bufs); - /* Skip clearing the buffer: */ - return; - case QETH_QDIO_BUF_QAOB_OK: -@@ -6155,6 +6143,8 @@ static int qeth_tx_poll(struct napi_struct *napi, int budget) - unsigned int bytes = 0; - int completed; - -+ qeth_tx_complete_pending_bufs(card, queue, false); -+ - if (qeth_out_queue_is_empty(queue)) { - napi_complete(napi); - return 0; -@@ -6187,7 +6177,6 @@ static int qeth_tx_poll(struct napi_struct *napi, int budget) - - qeth_handle_send_error(card, buffer, error); - qeth_iqd_tx_complete(queue, bidx, error, budget); -- qeth_cleanup_handled_pending(queue, bidx, false); - } - - netdev_tx_completed_queue(txq, packets, bytes); -@@ -7239,9 +7228,7 @@ int qeth_open(struct net_device *dev) - card->data.state = CH_STATE_UP; - netif_tx_start_all_queues(dev); - -- napi_enable(&card->napi); - local_bh_disable(); -- napi_schedule(&card->napi); - if (IS_IQD(card)) { - struct qeth_qdio_out_q *queue; - unsigned int i; -@@ -7253,8 +7240,12 @@ int qeth_open(struct net_device *dev) - napi_schedule(&queue->napi); - } - } -+ -+ napi_enable(&card->napi); -+ napi_schedule(&card->napi); - /* kick-start the NAPI softirq: */ - local_bh_enable(); -+ - return 0; - } - EXPORT_SYMBOL_GPL(qeth_open); -@@ -7264,6 +7255,11 @@ int qeth_stop(struct net_device *dev) - struct qeth_card *card = dev->ml_priv; - - QETH_CARD_TEXT(card, 4, "qethstop"); -+ -+ napi_disable(&card->napi); -+ cancel_delayed_work_sync(&card->buffer_reclaim_work); -+ qdio_stop_irq(CARD_DDEV(card)); -+ - if (IS_IQD(card)) { - struct qeth_qdio_out_q *queue; - unsigned int i; -@@ -7284,10 +7280,6 @@ int qeth_stop(struct net_device *dev) - netif_tx_disable(dev); - } - -- napi_disable(&card->napi); -- cancel_delayed_work_sync(&card->buffer_reclaim_work); -- qdio_stop_irq(CARD_DDEV(card)); -- - return 0; - } - EXPORT_SYMBOL_GPL(qeth_stop); -diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c -index 1851015299b3a..af40de7e51e7d 100644 ---- a/drivers/scsi/libiscsi.c -+++ b/drivers/scsi/libiscsi.c -@@ -1532,14 +1532,9 @@ check_mgmt: - } - rc = iscsi_prep_scsi_cmd_pdu(conn->task); - if (rc) { -- if (rc == -ENOMEM || rc == -EACCES) { -- spin_lock_bh(&conn->taskqueuelock); -- list_add_tail(&conn->task->running, -- &conn->cmdqueue); -- conn->task = NULL; -- spin_unlock_bh(&conn->taskqueuelock); -- goto done; -- } else -+ if (rc == -ENOMEM || rc == -EACCES) -+ fail_scsi_task(conn->task, DID_IMM_RETRY); -+ else - fail_scsi_task(conn->task, DID_ABORT); - spin_lock_bh(&conn->taskqueuelock); - continue; -diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c -index dd15246d5b037..ea43dff40a856 100644 ---- a/drivers/scsi/pm8001/pm8001_hwi.c -+++ b/drivers/scsi/pm8001/pm8001_hwi.c -@@ -3038,8 +3038,8 @@ void pm8001_mpi_set_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb) - complete(pm8001_ha->nvmd_completion); - pm8001_dbg(pm8001_ha, MSG, "Set nvm data complete!\n"); - if ((dlen_status & NVMD_STAT) != 0) { -- pm8001_dbg(pm8001_ha, FAIL, "Set nvm data error!\n"); -- return; -+ pm8001_dbg(pm8001_ha, FAIL, "Set nvm data error %x\n", -+ dlen_status); - } - ccb->task = NULL; - ccb->ccb_tag = 0xFFFFFFFF; -@@ -3062,11 +3062,17 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb) - - pm8001_dbg(pm8001_ha, MSG, "Get nvm data complete!\n"); - if ((dlen_status & NVMD_STAT) != 0) { -- pm8001_dbg(pm8001_ha, FAIL, "Get nvm data error!\n"); -+ pm8001_dbg(pm8001_ha, FAIL, "Get nvm data error %x\n", -+ dlen_status); - complete(pm8001_ha->nvmd_completion); -+ /* We should free tag during failure also, the tag is not being -+ * freed by requesting path anywhere. -+ */ -+ ccb->task = NULL; -+ ccb->ccb_tag = 0xFFFFFFFF; -+ pm8001_tag_free(pm8001_ha, tag); - return; - } -- - if (ir_tds_bn_dps_das_nvm & IPMode) { - /* indirect mode - IR bit set */ - pm8001_dbg(pm8001_ha, MSG, "Get NVMD success, IR=1\n"); -diff --git a/drivers/scsi/ufs/ufs-sysfs.c b/drivers/scsi/ufs/ufs-sysfs.c -index 08e72b7eef6aa..50e90416262bc 100644 ---- a/drivers/scsi/ufs/ufs-sysfs.c -+++ b/drivers/scsi/ufs/ufs-sysfs.c -@@ -792,7 +792,8 @@ static ssize_t _pname##_show(struct device *dev, \ - struct scsi_device *sdev = to_scsi_device(dev); \ - struct ufs_hba *hba = shost_priv(sdev->host); \ - u8 lun = ufshcd_scsi_to_upiu_lun(sdev->lun); \ -- if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun)) \ -+ if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, \ -+ _duname##_DESC_PARAM##_puname)) \ - return -EINVAL; \ - return ufs_sysfs_read_desc_param(hba, QUERY_DESC_IDN_##_duname, \ - lun, _duname##_DESC_PARAM##_puname, buf, _size); \ -diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h -index 14dfda735adf5..580aa56965d06 100644 ---- a/drivers/scsi/ufs/ufs.h -+++ b/drivers/scsi/ufs/ufs.h -@@ -552,13 +552,15 @@ struct ufs_dev_info { - * @return: true if the lun has a matching unit descriptor, false otherwise - */ - static inline bool ufs_is_valid_unit_desc_lun(struct ufs_dev_info *dev_info, -- u8 lun) -+ u8 lun, u8 param_offset) - { - if (!dev_info || !dev_info->max_lu_supported) { - pr_err("Max General LU supported by UFS isn't initialized\n"); - return false; - } -- -+ /* WB is available only for the logical unit from 0 to 7 */ -+ if (param_offset == UNIT_DESC_PARAM_WB_BUF_ALLOC_UNITS) -+ return lun < UFS_UPIU_MAX_WB_LUN_ID; - return lun == UFS_UPIU_RPMB_WLUN || (lun < dev_info->max_lu_supported); - } - -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index 428b9e0ac47e9..16e1bd1aa49d5 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -1184,19 +1184,30 @@ static int ufshcd_clock_scaling_prepare(struct ufs_hba *hba) - */ - ufshcd_scsi_block_requests(hba); - down_write(&hba->clk_scaling_lock); -- if (ufshcd_wait_for_doorbell_clr(hba, DOORBELL_CLR_TOUT_US)) { -+ -+ if (!hba->clk_scaling.is_allowed || -+ ufshcd_wait_for_doorbell_clr(hba, DOORBELL_CLR_TOUT_US)) { - ret = -EBUSY; - up_write(&hba->clk_scaling_lock); - ufshcd_scsi_unblock_requests(hba); -+ goto out; - } - -+ /* let's not get into low power until clock scaling is completed */ -+ ufshcd_hold(hba, false); -+ -+out: - return ret; - } - --static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba) -+static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba, bool writelock) - { -- up_write(&hba->clk_scaling_lock); -+ if (writelock) -+ up_write(&hba->clk_scaling_lock); -+ else -+ up_read(&hba->clk_scaling_lock); - ufshcd_scsi_unblock_requests(hba); -+ ufshcd_release(hba); - } - - /** -@@ -1211,13 +1222,11 @@ static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba) - static int ufshcd_devfreq_scale(struct ufs_hba *hba, bool scale_up) - { - int ret = 0; -- -- /* let's not get into low power until clock scaling is completed */ -- ufshcd_hold(hba, false); -+ bool is_writelock = true; - - ret = ufshcd_clock_scaling_prepare(hba); - if (ret) -- goto out; -+ return ret; - - /* scale down the gear before scaling down clocks */ - if (!scale_up) { -@@ -1243,14 +1252,12 @@ static int ufshcd_devfreq_scale(struct ufs_hba *hba, bool scale_up) - } - - /* Enable Write Booster if we have scaled up else disable it */ -- up_write(&hba->clk_scaling_lock); -+ downgrade_write(&hba->clk_scaling_lock); -+ is_writelock = false; - ufshcd_wb_ctrl(hba, scale_up); -- down_write(&hba->clk_scaling_lock); - - out_unprepare: -- ufshcd_clock_scaling_unprepare(hba); --out: -- ufshcd_release(hba); -+ ufshcd_clock_scaling_unprepare(hba, is_writelock); - return ret; - } - -@@ -1524,7 +1531,7 @@ static ssize_t ufshcd_clkscale_enable_show(struct device *dev, - { - struct ufs_hba *hba = dev_get_drvdata(dev); - -- return snprintf(buf, PAGE_SIZE, "%d\n", hba->clk_scaling.is_allowed); -+ return snprintf(buf, PAGE_SIZE, "%d\n", hba->clk_scaling.is_enabled); - } - - static ssize_t ufshcd_clkscale_enable_store(struct device *dev, -@@ -1538,7 +1545,7 @@ static ssize_t ufshcd_clkscale_enable_store(struct device *dev, - return -EINVAL; - - value = !!value; -- if (value == hba->clk_scaling.is_allowed) -+ if (value == hba->clk_scaling.is_enabled) - goto out; - - pm_runtime_get_sync(hba->dev); -@@ -1547,7 +1554,7 @@ static ssize_t ufshcd_clkscale_enable_store(struct device *dev, - cancel_work_sync(&hba->clk_scaling.suspend_work); - cancel_work_sync(&hba->clk_scaling.resume_work); - -- hba->clk_scaling.is_allowed = value; -+ hba->clk_scaling.is_enabled = value; - - if (value) { - ufshcd_resume_clkscaling(hba); -@@ -1885,8 +1892,6 @@ static void ufshcd_init_clk_scaling(struct ufs_hba *hba) - snprintf(wq_name, sizeof(wq_name), "ufs_clkscaling_%d", - hba->host->host_no); - hba->clk_scaling.workq = create_singlethread_workqueue(wq_name); -- -- ufshcd_clkscaling_init_sysfs(hba); - } - - static void ufshcd_exit_clk_scaling(struct ufs_hba *hba) -@@ -1894,6 +1899,8 @@ static void ufshcd_exit_clk_scaling(struct ufs_hba *hba) - if (!ufshcd_is_clkscaling_supported(hba)) - return; - -+ if (hba->clk_scaling.enable_attr.attr.name) -+ device_remove_file(hba->dev, &hba->clk_scaling.enable_attr); - destroy_workqueue(hba->clk_scaling.workq); - ufshcd_devfreq_remove(hba); - } -@@ -1958,7 +1965,7 @@ static void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba) - if (!hba->clk_scaling.active_reqs++) - queue_resume_work = true; - -- if (!hba->clk_scaling.is_allowed || hba->pm_op_in_progress) -+ if (!hba->clk_scaling.is_enabled || hba->pm_op_in_progress) - return; - - if (queue_resume_work) -@@ -3427,7 +3434,7 @@ static inline int ufshcd_read_unit_desc_param(struct ufs_hba *hba, - * Unit descriptors are only available for general purpose LUs (LUN id - * from 0 to 7) and RPMB Well known LU. - */ -- if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun)) -+ if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, param_offset)) - return -EOPNOTSUPP; - - return ufshcd_read_desc_param(hba, QUERY_DESC_IDN_UNIT, lun, -@@ -5744,18 +5751,24 @@ static void ufshcd_err_handling_prepare(struct ufs_hba *hba) - ufshcd_vops_resume(hba, pm_op); - } else { - ufshcd_hold(hba, false); -- if (hba->clk_scaling.is_allowed) { -+ if (hba->clk_scaling.is_enabled) { - cancel_work_sync(&hba->clk_scaling.suspend_work); - cancel_work_sync(&hba->clk_scaling.resume_work); - ufshcd_suspend_clkscaling(hba); - } -+ down_write(&hba->clk_scaling_lock); -+ hba->clk_scaling.is_allowed = false; -+ up_write(&hba->clk_scaling_lock); - } - } - - static void ufshcd_err_handling_unprepare(struct ufs_hba *hba) - { - ufshcd_release(hba); -- if (hba->clk_scaling.is_allowed) -+ down_write(&hba->clk_scaling_lock); -+ hba->clk_scaling.is_allowed = true; -+ up_write(&hba->clk_scaling_lock); -+ if (hba->clk_scaling.is_enabled) - ufshcd_resume_clkscaling(hba); - pm_runtime_put(hba->dev); - } -@@ -7741,12 +7754,14 @@ static int ufshcd_add_lus(struct ufs_hba *hba) - sizeof(struct ufs_pa_layer_attr)); - hba->clk_scaling.saved_pwr_info.is_valid = true; - if (!hba->devfreq) { -+ hba->clk_scaling.is_allowed = true; - ret = ufshcd_devfreq_init(hba); - if (ret) - goto out; -- } - -- hba->clk_scaling.is_allowed = true; -+ hba->clk_scaling.is_enabled = true; -+ ufshcd_clkscaling_init_sysfs(hba); -+ } - } - - ufs_bsg_probe(hba); -@@ -8661,11 +8676,14 @@ static int ufshcd_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op) - ufshcd_hold(hba, false); - hba->clk_gating.is_suspended = true; - -- if (hba->clk_scaling.is_allowed) { -+ if (hba->clk_scaling.is_enabled) { - cancel_work_sync(&hba->clk_scaling.suspend_work); - cancel_work_sync(&hba->clk_scaling.resume_work); - ufshcd_suspend_clkscaling(hba); - } -+ down_write(&hba->clk_scaling_lock); -+ hba->clk_scaling.is_allowed = false; -+ up_write(&hba->clk_scaling_lock); - - if (req_dev_pwr_mode == UFS_ACTIVE_PWR_MODE && - req_link_state == UIC_LINK_ACTIVE_STATE) { -@@ -8762,8 +8780,6 @@ disable_clks: - goto out; - - set_link_active: -- if (hba->clk_scaling.is_allowed) -- ufshcd_resume_clkscaling(hba); - ufshcd_vreg_set_hpm(hba); - /* - * Device hardware reset is required to exit DeepSleep. Also, for -@@ -8787,7 +8803,10 @@ set_dev_active: - if (!ufshcd_set_dev_pwr_mode(hba, UFS_ACTIVE_PWR_MODE)) - ufshcd_disable_auto_bkops(hba); - enable_gating: -- if (hba->clk_scaling.is_allowed) -+ down_write(&hba->clk_scaling_lock); -+ hba->clk_scaling.is_allowed = true; -+ up_write(&hba->clk_scaling_lock); -+ if (hba->clk_scaling.is_enabled) - ufshcd_resume_clkscaling(hba); - hba->clk_gating.is_suspended = false; - hba->dev_info.b_rpm_dev_flush_capable = false; -@@ -8891,7 +8910,10 @@ static int ufshcd_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) - - hba->clk_gating.is_suspended = false; - -- if (hba->clk_scaling.is_allowed) -+ down_write(&hba->clk_scaling_lock); -+ hba->clk_scaling.is_allowed = true; -+ up_write(&hba->clk_scaling_lock); -+ if (hba->clk_scaling.is_enabled) - ufshcd_resume_clkscaling(hba); - - /* Enable Auto-Hibernate if configured */ -@@ -8917,8 +8939,6 @@ disable_vreg: - ufshcd_vreg_set_lpm(hba); - disable_irq_and_vops_clks: - ufshcd_disable_irq(hba); -- if (hba->clk_scaling.is_allowed) -- ufshcd_suspend_clkscaling(hba); - ufshcd_setup_clocks(hba, false); - if (ufshcd_is_clkgating_allowed(hba)) { - hba->clk_gating.state = CLKS_OFF; -@@ -9155,8 +9175,6 @@ void ufshcd_remove(struct ufs_hba *hba) - - ufshcd_exit_clk_scaling(hba); - ufshcd_exit_clk_gating(hba); -- if (ufshcd_is_clkscaling_supported(hba)) -- device_remove_file(hba->dev, &hba->clk_scaling.enable_attr); - ufshcd_hba_exit(hba); - } - EXPORT_SYMBOL_GPL(ufshcd_remove); -diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h -index 1885ec9126c44..7d0b00f237614 100644 ---- a/drivers/scsi/ufs/ufshcd.h -+++ b/drivers/scsi/ufs/ufshcd.h -@@ -419,7 +419,10 @@ struct ufs_saved_pwr_info { - * @suspend_work: worker to suspend devfreq - * @resume_work: worker to resume devfreq - * @min_gear: lowest HS gear to scale down to -- * @is_allowed: tracks if scaling is currently allowed or not -+ * @is_enabled: tracks if scaling is currently enabled or not, controlled by -+ clkscale_enable sysfs node -+ * @is_allowed: tracks if scaling is currently allowed or not, used to block -+ clock scaling which is not invoked from devfreq governor - * @is_busy_started: tracks if busy period has started or not - * @is_suspended: tracks if devfreq is suspended or not - */ -@@ -434,6 +437,7 @@ struct ufs_clk_scaling { - struct work_struct suspend_work; - struct work_struct resume_work; - u32 min_gear; -+ bool is_enabled; - bool is_allowed; - bool is_busy_started; - bool is_suspended; -diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c -index 6eeb39669a866..53c4311cc6ab5 100644 ---- a/drivers/spi/spi-stm32.c -+++ b/drivers/spi/spi-stm32.c -@@ -928,8 +928,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) - mask |= STM32H7_SPI_SR_RXP; - - if (!(sr & mask)) { -- dev_dbg(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n", -- sr, ier); -+ dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n", -+ sr, ier); - spin_unlock_irqrestore(&spi->lock, flags); - return IRQ_NONE; - } -@@ -956,15 +956,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) - } - - if (sr & STM32H7_SPI_SR_OVR) { -- dev_warn(spi->dev, "Overrun: received value discarded\n"); -- if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0))) -- stm32h7_spi_read_rxfifo(spi, false); -- /* -- * If overrun is detected while using DMA, it means that -- * something went wrong, so stop the current transfer -- */ -- if (spi->cur_usedma) -- end = true; -+ dev_err(spi->dev, "Overrun: RX data lost\n"); -+ end = true; - } - - if (sr & STM32H7_SPI_SR_EOT) { -diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c -index 35b75f0c9200b..81a246fbcc01f 100644 ---- a/drivers/staging/comedi/drivers/addi_apci_1032.c -+++ b/drivers/staging/comedi/drivers/addi_apci_1032.c -@@ -260,6 +260,7 @@ static irqreturn_t apci1032_interrupt(int irq, void *d) - struct apci1032_private *devpriv = dev->private; - struct comedi_subdevice *s = dev->read_subdev; - unsigned int ctrl; -+ unsigned short val; - - /* check interrupt is from this device */ - if ((inl(devpriv->amcc_iobase + AMCC_OP_REG_INTCSR) & -@@ -275,7 +276,8 @@ static irqreturn_t apci1032_interrupt(int irq, void *d) - outl(ctrl & ~APCI1032_CTRL_INT_ENA, dev->iobase + APCI1032_CTRL_REG); - - s->state = inl(dev->iobase + APCI1032_STATUS_REG) & 0xffff; -- comedi_buf_write_samples(s, &s->state, 1); -+ val = s->state; -+ comedi_buf_write_samples(s, &val, 1); - comedi_handle_events(dev, s); - - /* enable the interrupt */ -diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c -index 11efb21555e39..b04c15dcfb575 100644 ---- a/drivers/staging/comedi/drivers/addi_apci_1500.c -+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c -@@ -208,7 +208,7 @@ static irqreturn_t apci1500_interrupt(int irq, void *d) - struct comedi_device *dev = d; - struct apci1500_private *devpriv = dev->private; - struct comedi_subdevice *s = dev->read_subdev; -- unsigned int status = 0; -+ unsigned short status = 0; - unsigned int val; - - val = inl(devpriv->amcc + AMCC_OP_REG_INTCSR); -@@ -238,14 +238,14 @@ static irqreturn_t apci1500_interrupt(int irq, void *d) - * - * Mask Meaning - * ---------- ------------------------------------------ -- * 0x00000001 Event 1 has occurred -- * 0x00000010 Event 2 has occurred -- * 0x00000100 Counter/timer 1 has run down (not implemented) -- * 0x00001000 Counter/timer 2 has run down (not implemented) -- * 0x00010000 Counter 3 has run down (not implemented) -- * 0x00100000 Watchdog has run down (not implemented) -- * 0x01000000 Voltage error -- * 0x10000000 Short-circuit error -+ * 0b00000001 Event 1 has occurred -+ * 0b00000010 Event 2 has occurred -+ * 0b00000100 Counter/timer 1 has run down (not implemented) -+ * 0b00001000 Counter/timer 2 has run down (not implemented) -+ * 0b00010000 Counter 3 has run down (not implemented) -+ * 0b00100000 Watchdog has run down (not implemented) -+ * 0b01000000 Voltage error -+ * 0b10000000 Short-circuit error - */ - comedi_buf_write_samples(s, &status, 1); - comedi_handle_events(dev, s); -diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c -index 692893c7e5c3d..090607760be6b 100644 ---- a/drivers/staging/comedi/drivers/adv_pci1710.c -+++ b/drivers/staging/comedi/drivers/adv_pci1710.c -@@ -300,11 +300,11 @@ static int pci1710_ai_eoc(struct comedi_device *dev, - static int pci1710_ai_read_sample(struct comedi_device *dev, - struct comedi_subdevice *s, - unsigned int cur_chan, -- unsigned int *val) -+ unsigned short *val) - { - const struct boardtype *board = dev->board_ptr; - struct pci1710_private *devpriv = dev->private; -- unsigned int sample; -+ unsigned short sample; - unsigned int chan; - - sample = inw(dev->iobase + PCI171X_AD_DATA_REG); -@@ -345,7 +345,7 @@ static int pci1710_ai_insn_read(struct comedi_device *dev, - pci1710_ai_setup_chanlist(dev, s, &insn->chanspec, 1, 1); - - for (i = 0; i < insn->n; i++) { -- unsigned int val; -+ unsigned short val; - - /* start conversion */ - outw(0, dev->iobase + PCI171X_SOFTTRG_REG); -@@ -395,7 +395,7 @@ static void pci1710_handle_every_sample(struct comedi_device *dev, - { - struct comedi_cmd *cmd = &s->async->cmd; - unsigned int status; -- unsigned int val; -+ unsigned short val; - int ret; - - status = inw(dev->iobase + PCI171X_STATUS_REG); -@@ -455,7 +455,7 @@ static void pci1710_handle_fifo(struct comedi_device *dev, - } - - for (i = 0; i < devpriv->max_samples; i++) { -- unsigned int val; -+ unsigned short val; - int ret; - - ret = pci1710_ai_read_sample(dev, s, s->async->cur_chan, &val); -diff --git a/drivers/staging/comedi/drivers/das6402.c b/drivers/staging/comedi/drivers/das6402.c -index 04e224f8b7793..96f4107b8054d 100644 ---- a/drivers/staging/comedi/drivers/das6402.c -+++ b/drivers/staging/comedi/drivers/das6402.c -@@ -186,7 +186,7 @@ static irqreturn_t das6402_interrupt(int irq, void *d) - if (status & DAS6402_STATUS_FFULL) { - async->events |= COMEDI_CB_OVERFLOW; - } else if (status & DAS6402_STATUS_FFNE) { -- unsigned int val; -+ unsigned short val; - - val = das6402_ai_read_sample(dev, s); - comedi_buf_write_samples(s, &val, 1); -diff --git a/drivers/staging/comedi/drivers/das800.c b/drivers/staging/comedi/drivers/das800.c -index 4ea100ff6930f..2881808d6606c 100644 ---- a/drivers/staging/comedi/drivers/das800.c -+++ b/drivers/staging/comedi/drivers/das800.c -@@ -427,7 +427,7 @@ static irqreturn_t das800_interrupt(int irq, void *d) - struct comedi_cmd *cmd; - unsigned long irq_flags; - unsigned int status; -- unsigned int val; -+ unsigned short val; - bool fifo_empty; - bool fifo_overflow; - int i; -diff --git a/drivers/staging/comedi/drivers/dmm32at.c b/drivers/staging/comedi/drivers/dmm32at.c -index 17e6018918bbf..56682f01242fd 100644 ---- a/drivers/staging/comedi/drivers/dmm32at.c -+++ b/drivers/staging/comedi/drivers/dmm32at.c -@@ -404,7 +404,7 @@ static irqreturn_t dmm32at_isr(int irq, void *d) - { - struct comedi_device *dev = d; - unsigned char intstat; -- unsigned int val; -+ unsigned short val; - int i; - - if (!dev->attached) { -diff --git a/drivers/staging/comedi/drivers/me4000.c b/drivers/staging/comedi/drivers/me4000.c -index 726e40dc17b62..0d3d4cafce2e8 100644 ---- a/drivers/staging/comedi/drivers/me4000.c -+++ b/drivers/staging/comedi/drivers/me4000.c -@@ -924,7 +924,7 @@ static irqreturn_t me4000_ai_isr(int irq, void *dev_id) - struct comedi_subdevice *s = dev->read_subdev; - int i; - int c = 0; -- unsigned int lval; -+ unsigned short lval; - - if (!dev->attached) - return IRQ_NONE; -diff --git a/drivers/staging/comedi/drivers/pcl711.c b/drivers/staging/comedi/drivers/pcl711.c -index 2dbf69e309650..bd6f42fe9e3ca 100644 ---- a/drivers/staging/comedi/drivers/pcl711.c -+++ b/drivers/staging/comedi/drivers/pcl711.c -@@ -184,7 +184,7 @@ static irqreturn_t pcl711_interrupt(int irq, void *d) - struct comedi_device *dev = d; - struct comedi_subdevice *s = dev->read_subdev; - struct comedi_cmd *cmd = &s->async->cmd; -- unsigned int data; -+ unsigned short data; - - if (!dev->attached) { - dev_err(dev->class_dev, "spurious interrupt\n"); -diff --git a/drivers/staging/comedi/drivers/pcl818.c b/drivers/staging/comedi/drivers/pcl818.c -index 63e3011158f23..f4b4a686c710f 100644 ---- a/drivers/staging/comedi/drivers/pcl818.c -+++ b/drivers/staging/comedi/drivers/pcl818.c -@@ -423,7 +423,7 @@ static int pcl818_ai_eoc(struct comedi_device *dev, - - static bool pcl818_ai_write_sample(struct comedi_device *dev, - struct comedi_subdevice *s, -- unsigned int chan, unsigned int val) -+ unsigned int chan, unsigned short val) - { - struct pcl818_private *devpriv = dev->private; - struct comedi_cmd *cmd = &s->async->cmd; -diff --git a/drivers/staging/ks7010/ks_wlan_net.c b/drivers/staging/ks7010/ks_wlan_net.c -index dc09cc6e1c478..09e7b4cd0138c 100644 ---- a/drivers/staging/ks7010/ks_wlan_net.c -+++ b/drivers/staging/ks7010/ks_wlan_net.c -@@ -1120,6 +1120,7 @@ static int ks_wlan_set_scan(struct net_device *dev, - { - struct ks_wlan_private *priv = netdev_priv(dev); - struct iw_scan_req *req = NULL; -+ int len; - - if (priv->sleep_mode == SLP_SLEEP) - return -EPERM; -@@ -1129,8 +1130,9 @@ static int ks_wlan_set_scan(struct net_device *dev, - if (wrqu->data.length == sizeof(struct iw_scan_req) && - wrqu->data.flags & IW_SCAN_THIS_ESSID) { - req = (struct iw_scan_req *)extra; -- priv->scan_ssid_len = req->essid_len; -- memcpy(priv->scan_ssid, req->essid, priv->scan_ssid_len); -+ len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE); -+ priv->scan_ssid_len = len; -+ memcpy(priv->scan_ssid, req->essid, len); - } else { - priv->scan_ssid_len = 0; - } -diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c -index fa1e34a0d4561..182bb944c9b3b 100644 ---- a/drivers/staging/rtl8188eu/core/rtw_ap.c -+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c -@@ -791,6 +791,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len) - p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_SSID, &ie_len, - pbss_network->ie_length - _BEACON_IE_OFFSET_); - if (p && ie_len > 0) { -+ ie_len = min_t(int, ie_len, sizeof(pbss_network->ssid.ssid)); - memset(&pbss_network->ssid, 0, sizeof(struct ndis_802_11_ssid)); - memcpy(pbss_network->ssid.ssid, p + 2, ie_len); - pbss_network->ssid.ssid_length = ie_len; -@@ -811,6 +812,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len) - p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_SUPP_RATES, &ie_len, - pbss_network->ie_length - _BEACON_IE_OFFSET_); - if (p) { -+ ie_len = min_t(int, ie_len, NDIS_802_11_LENGTH_RATES_EX); - memcpy(supportRate, p + 2, ie_len); - supportRateNum = ie_len; - } -@@ -819,6 +821,8 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len) - p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_EXT_SUPP_RATES, - &ie_len, pbss_network->ie_length - _BEACON_IE_OFFSET_); - if (p) { -+ ie_len = min_t(int, ie_len, -+ NDIS_802_11_LENGTH_RATES_EX - supportRateNum); - memcpy(supportRate + supportRateNum, p + 2, ie_len); - supportRateNum += ie_len; - } -@@ -934,6 +938,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len) - - pht_cap->mcs.rx_mask[0] = 0xff; - pht_cap->mcs.rx_mask[1] = 0x0; -+ ie_len = min_t(int, ie_len, sizeof(pmlmepriv->htpriv.ht_cap)); - memcpy(&pmlmepriv->htpriv.ht_cap, p + 2, ie_len); - } - -diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c -index 6f42f13a71fa7..f92fcb623a2cc 100644 ---- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c -+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c -@@ -1133,9 +1133,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a, - break; - } - sec_len = *(pos++); len -= 1; -- if (sec_len > 0 && sec_len <= len) { -+ if (sec_len > 0 && -+ sec_len <= len && -+ sec_len <= 32) { - ssid[ssid_index].ssid_length = sec_len; -- memcpy(ssid[ssid_index].ssid, pos, ssid[ssid_index].ssid_length); -+ memcpy(ssid[ssid_index].ssid, pos, sec_len); - ssid_index++; - } - pos += sec_len; -diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c -index 16bcee13f64b5..407effde5e71a 100644 ---- a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c -+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c -@@ -406,9 +406,10 @@ static int _rtl92e_wx_set_scan(struct net_device *dev, - struct iw_scan_req *req = (struct iw_scan_req *)b; - - if (req->essid_len) { -- ieee->current_network.ssid_len = req->essid_len; -- memcpy(ieee->current_network.ssid, req->essid, -- req->essid_len); -+ int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE); -+ -+ ieee->current_network.ssid_len = len; -+ memcpy(ieee->current_network.ssid, req->essid, len); - } - } - -diff --git a/drivers/staging/rtl8192u/r8192U_wx.c b/drivers/staging/rtl8192u/r8192U_wx.c -index d853586705fc9..77bf88696a844 100644 ---- a/drivers/staging/rtl8192u/r8192U_wx.c -+++ b/drivers/staging/rtl8192u/r8192U_wx.c -@@ -331,8 +331,10 @@ static int r8192_wx_set_scan(struct net_device *dev, struct iw_request_info *a, - struct iw_scan_req *req = (struct iw_scan_req *)b; - - if (req->essid_len) { -- ieee->current_network.ssid_len = req->essid_len; -- memcpy(ieee->current_network.ssid, req->essid, req->essid_len); -+ int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE); -+ -+ ieee->current_network.ssid_len = len; -+ memcpy(ieee->current_network.ssid, req->essid, len); - } - } - -diff --git a/drivers/staging/rtl8712/rtl871x_cmd.c b/drivers/staging/rtl8712/rtl871x_cmd.c -index 18116469bd316..75716f59044d9 100644 ---- a/drivers/staging/rtl8712/rtl871x_cmd.c -+++ b/drivers/staging/rtl8712/rtl871x_cmd.c -@@ -192,8 +192,10 @@ u8 r8712_sitesurvey_cmd(struct _adapter *padapter, - psurveyPara->ss_ssidlen = 0; - memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1); - if (pssid && pssid->SsidLength) { -- memcpy(psurveyPara->ss_ssid, pssid->Ssid, pssid->SsidLength); -- psurveyPara->ss_ssidlen = cpu_to_le32(pssid->SsidLength); -+ int len = min_t(int, pssid->SsidLength, IW_ESSID_MAX_SIZE); -+ -+ memcpy(psurveyPara->ss_ssid, pssid->Ssid, len); -+ psurveyPara->ss_ssidlen = cpu_to_le32(len); - } - set_fwstate(pmlmepriv, _FW_UNDER_SURVEY); - r8712_enqueue_cmd(pcmdpriv, ph2c); -diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c -index cbaa7a4897483..2a661b04cd255 100644 ---- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c -+++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c -@@ -924,7 +924,7 @@ static int r871x_wx_set_priv(struct net_device *dev, - struct iw_point *dwrq = (struct iw_point *)awrq; - - len = dwrq->length; -- ext = memdup_user(dwrq->pointer, len); -+ ext = strndup_user(dwrq->pointer, len); - if (IS_ERR(ext)) - return PTR_ERR(ext); - -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index 14db5e568f22b..d4cc43afe05b8 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -3739,6 +3739,7 @@ core_scsi3_pri_read_keys(struct se_cmd *cmd) - spin_unlock(&dev->t10_pr.registration_lock); - - put_unaligned_be32(add_len, &buf[4]); -+ target_set_cmd_data_length(cmd, 8 + add_len); - - transport_kunmap_data_sg(cmd); - -@@ -3757,7 +3758,7 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd) - struct t10_pr_registration *pr_reg; - unsigned char *buf; - u64 pr_res_key; -- u32 add_len = 16; /* Hardcoded to 16 when a reservation is held. */ -+ u32 add_len = 0; - - if (cmd->data_length < 8) { - pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u" -@@ -3775,8 +3776,9 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd) - pr_reg = dev->dev_pr_res_holder; - if (pr_reg) { - /* -- * Set the hardcoded Additional Length -+ * Set the Additional Length to 16 when a reservation is held - */ -+ add_len = 16; - put_unaligned_be32(add_len, &buf[4]); - - if (cmd->data_length < 22) -@@ -3812,6 +3814,8 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd) - (pr_reg->pr_res_type & 0x0f); - } - -+ target_set_cmd_data_length(cmd, 8 + add_len); -+ - err: - spin_unlock(&dev->dev_reservation_lock); - transport_kunmap_data_sg(cmd); -@@ -3830,7 +3834,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd) - struct se_device *dev = cmd->se_dev; - struct t10_reservation *pr_tmpl = &dev->t10_pr; - unsigned char *buf; -- u16 add_len = 8; /* Hardcoded to 8. */ -+ u16 len = 8; /* Hardcoded to 8. */ - - if (cmd->data_length < 6) { - pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:" -@@ -3842,7 +3846,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd) - if (!buf) - return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; - -- put_unaligned_be16(add_len, &buf[0]); -+ put_unaligned_be16(len, &buf[0]); - buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */ - buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */ - buf[2] |= 0x04; /* ATP_C: All Target Ports Capable bit */ -@@ -3871,6 +3875,8 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd) - buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */ - buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */ - -+ target_set_cmd_data_length(cmd, len); -+ - transport_kunmap_data_sg(cmd); - - return 0; -@@ -4031,6 +4037,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd) - * Set ADDITIONAL_LENGTH - */ - put_unaligned_be32(add_len, &buf[4]); -+ target_set_cmd_data_length(cmd, 8 + add_len); - - transport_kunmap_data_sg(cmd); - -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index fca4bd079d02c..8a4d58fdc9fe2 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -879,11 +879,9 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status) - } - EXPORT_SYMBOL(target_complete_cmd); - --void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length) -+void target_set_cmd_data_length(struct se_cmd *cmd, int length) - { -- if ((scsi_status == SAM_STAT_GOOD || -- cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) && -- length < cmd->data_length) { -+ if (length < cmd->data_length) { - if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) { - cmd->residual_count += cmd->data_length - length; - } else { -@@ -893,6 +891,15 @@ void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int len - - cmd->data_length = length; - } -+} -+EXPORT_SYMBOL(target_set_cmd_data_length); -+ -+void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length) -+{ -+ if (scsi_status == SAM_STAT_GOOD || -+ cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) { -+ target_set_cmd_data_length(cmd, length); -+ } - - target_complete_cmd(cmd, scsi_status); - } -diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c -index 9795b2e8b0b2c..1b61d26bb7afe 100644 ---- a/drivers/tty/serial/max310x.c -+++ b/drivers/tty/serial/max310x.c -@@ -1056,9 +1056,9 @@ static int max310x_startup(struct uart_port *port) - max310x_port_update(port, MAX310X_MODE1_REG, - MAX310X_MODE1_TRNSCVCTRL_BIT, 0); - -- /* Reset FIFOs */ -- max310x_port_write(port, MAX310X_MODE2_REG, -- MAX310X_MODE2_FIFORST_BIT); -+ /* Configure MODE2 register & Reset FIFOs*/ -+ val = MAX310X_MODE2_RXEMPTINV_BIT | MAX310X_MODE2_FIFORST_BIT; -+ max310x_port_write(port, MAX310X_MODE2_REG, val); - max310x_port_update(port, MAX310X_MODE2_REG, - MAX310X_MODE2_FIFORST_BIT, 0); - -@@ -1086,27 +1086,8 @@ static int max310x_startup(struct uart_port *port) - /* Clear IRQ status register */ - max310x_port_read(port, MAX310X_IRQSTS_REG); - -- /* -- * Let's ask for an interrupt after a timeout equivalent to -- * the receiving time of 4 characters after the last character -- * has been received. -- */ -- max310x_port_write(port, MAX310X_RXTO_REG, 4); -- -- /* -- * Make sure we also get RX interrupts when the RX FIFO is -- * filling up quickly, so get an interrupt when half of the RX -- * FIFO has been filled in. -- */ -- max310x_port_write(port, MAX310X_FIFOTRIGLVL_REG, -- MAX310X_FIFOTRIGLVL_RX(MAX310X_FIFO_SIZE / 2)); -- -- /* Enable RX timeout interrupt in LSR */ -- max310x_port_write(port, MAX310X_LSR_IRQEN_REG, -- MAX310X_LSR_RXTO_BIT); -- -- /* Enable LSR, RX FIFO trigger, CTS change interrupts */ -- val = MAX310X_IRQ_LSR_BIT | MAX310X_IRQ_RXFIFO_BIT | MAX310X_IRQ_TXEMPTY_BIT; -+ /* Enable RX, TX, CTS change interrupts */ -+ val = MAX310X_IRQ_RXEMPTY_BIT | MAX310X_IRQ_TXEMPTY_BIT; - max310x_port_write(port, MAX310X_IRQEN_REG, val | MAX310X_IRQ_CTS_BIT); - - return 0; -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 781905745812e..2f4e5174e78c8 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1929,6 +1929,11 @@ static const struct usb_device_id acm_ids[] = { - .driver_info = SEND_ZERO_PACKET, - }, - -+ /* Exclude Goodix Fingerprint Reader */ -+ { USB_DEVICE(0x27c6, 0x5395), -+ .driver_info = IGNORE_DEVICE, -+ }, -+ - /* control interfaces without any protocol set */ - { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, - USB_CDC_PROTO_NONE) }, -diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c -index c9f6e97582885..f27b4aecff3d4 100644 ---- a/drivers/usb/class/usblp.c -+++ b/drivers/usb/class/usblp.c -@@ -494,16 +494,24 @@ static int usblp_release(struct inode *inode, struct file *file) - /* No kernel lock - fine */ - static __poll_t usblp_poll(struct file *file, struct poll_table_struct *wait) - { -- __poll_t ret; -+ struct usblp *usblp = file->private_data; -+ __poll_t ret = 0; - unsigned long flags; - -- struct usblp *usblp = file->private_data; - /* Should we check file->f_mode & FMODE_WRITE before poll_wait()? */ - poll_wait(file, &usblp->rwait, wait); - poll_wait(file, &usblp->wwait, wait); -+ -+ mutex_lock(&usblp->mut); -+ if (!usblp->present) -+ ret |= EPOLLHUP; -+ mutex_unlock(&usblp->mut); -+ - spin_lock_irqsave(&usblp->lock, flags); -- ret = ((usblp->bidir && usblp->rcomplete) ? EPOLLIN | EPOLLRDNORM : 0) | -- ((usblp->no_paper || usblp->wcomplete) ? EPOLLOUT | EPOLLWRNORM : 0); -+ if (usblp->bidir && usblp->rcomplete) -+ ret |= EPOLLIN | EPOLLRDNORM; -+ if (usblp->no_paper || usblp->wcomplete) -+ ret |= EPOLLOUT | EPOLLWRNORM; - spin_unlock_irqrestore(&usblp->lock, flags); - return ret; - } -diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c -index 8f07b05161009..a566bb494e246 100644 ---- a/drivers/usb/core/usb.c -+++ b/drivers/usb/core/usb.c -@@ -748,6 +748,38 @@ void usb_put_intf(struct usb_interface *intf) - } - EXPORT_SYMBOL_GPL(usb_put_intf); - -+/** -+ * usb_intf_get_dma_device - acquire a reference on the usb interface's DMA endpoint -+ * @intf: the usb interface -+ * -+ * While a USB device cannot perform DMA operations by itself, many USB -+ * controllers can. A call to usb_intf_get_dma_device() returns the DMA endpoint -+ * for the given USB interface, if any. The returned device structure must be -+ * released with put_device(). -+ * -+ * See also usb_get_dma_device(). -+ * -+ * Returns: A reference to the usb interface's DMA endpoint; or NULL if none -+ * exists. -+ */ -+struct device *usb_intf_get_dma_device(struct usb_interface *intf) -+{ -+ struct usb_device *udev = interface_to_usbdev(intf); -+ struct device *dmadev; -+ -+ if (!udev->bus) -+ return NULL; -+ -+ dmadev = get_device(udev->bus->sysdev); -+ if (!dmadev || !dmadev->dma_mask) { -+ put_device(dmadev); -+ return NULL; -+ } -+ -+ return dmadev; -+} -+EXPORT_SYMBOL_GPL(usb_intf_get_dma_device); -+ - /* USB device locking - * - * USB devices and interfaces are locked using the semaphore in their -diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c -index c703d552bbcfc..c00c4fa139b88 100644 ---- a/drivers/usb/dwc3/dwc3-qcom.c -+++ b/drivers/usb/dwc3/dwc3-qcom.c -@@ -60,12 +60,14 @@ struct dwc3_acpi_pdata { - int dp_hs_phy_irq_index; - int dm_hs_phy_irq_index; - int ss_phy_irq_index; -+ bool is_urs; - }; - - struct dwc3_qcom { - struct device *dev; - void __iomem *qscratch_base; - struct platform_device *dwc3; -+ struct platform_device *urs_usb; - struct clk **clks; - int num_clocks; - struct reset_control *resets; -@@ -356,8 +358,10 @@ static int dwc3_qcom_suspend(struct dwc3_qcom *qcom) - if (ret) - dev_warn(qcom->dev, "failed to disable interconnect: %d\n", ret); - -+ if (device_may_wakeup(qcom->dev)) -+ dwc3_qcom_enable_interrupts(qcom); -+ - qcom->is_suspended = true; -- dwc3_qcom_enable_interrupts(qcom); - - return 0; - } -@@ -370,7 +374,8 @@ static int dwc3_qcom_resume(struct dwc3_qcom *qcom) - if (!qcom->is_suspended) - return 0; - -- dwc3_qcom_disable_interrupts(qcom); -+ if (device_may_wakeup(qcom->dev)) -+ dwc3_qcom_disable_interrupts(qcom); - - for (i = 0; i < qcom->num_clocks; i++) { - ret = clk_prepare_enable(qcom->clks[i]); -@@ -429,13 +434,15 @@ static void dwc3_qcom_select_utmi_clk(struct dwc3_qcom *qcom) - static int dwc3_qcom_get_irq(struct platform_device *pdev, - const char *name, int num) - { -+ struct dwc3_qcom *qcom = platform_get_drvdata(pdev); -+ struct platform_device *pdev_irq = qcom->urs_usb ? qcom->urs_usb : pdev; - struct device_node *np = pdev->dev.of_node; - int ret; - - if (np) -- ret = platform_get_irq_byname(pdev, name); -+ ret = platform_get_irq_byname(pdev_irq, name); - else -- ret = platform_get_irq(pdev, num); -+ ret = platform_get_irq(pdev_irq, num); - - return ret; - } -@@ -568,6 +575,8 @@ static int dwc3_qcom_acpi_register_core(struct platform_device *pdev) - struct dwc3_qcom *qcom = platform_get_drvdata(pdev); - struct device *dev = &pdev->dev; - struct resource *res, *child_res = NULL; -+ struct platform_device *pdev_irq = qcom->urs_usb ? qcom->urs_usb : -+ pdev; - int irq; - int ret; - -@@ -597,7 +606,7 @@ static int dwc3_qcom_acpi_register_core(struct platform_device *pdev) - child_res[0].end = child_res[0].start + - qcom->acpi_pdata->dwc3_core_base_size; - -- irq = platform_get_irq(pdev, 0); -+ irq = platform_get_irq(pdev_irq, 0); - child_res[1].flags = IORESOURCE_IRQ; - child_res[1].start = child_res[1].end = irq; - -@@ -639,16 +648,46 @@ static int dwc3_qcom_of_register_core(struct platform_device *pdev) - ret = of_platform_populate(np, NULL, NULL, dev); - if (ret) { - dev_err(dev, "failed to register dwc3 core - %d\n", ret); -- return ret; -+ goto node_put; - } - - qcom->dwc3 = of_find_device_by_node(dwc3_np); - if (!qcom->dwc3) { -+ ret = -ENODEV; - dev_err(dev, "failed to get dwc3 platform device\n"); -- return -ENODEV; - } - -- return 0; -+node_put: -+ of_node_put(dwc3_np); -+ -+ return ret; -+} -+ -+static struct platform_device * -+dwc3_qcom_create_urs_usb_platdev(struct device *dev) -+{ -+ struct fwnode_handle *fwh; -+ struct acpi_device *adev; -+ char name[8]; -+ int ret; -+ int id; -+ -+ /* Figure out device id */ -+ ret = sscanf(fwnode_get_name(dev->fwnode), "URS%d", &id); -+ if (!ret) -+ return NULL; -+ -+ /* Find the child using name */ -+ snprintf(name, sizeof(name), "USB%d", id); -+ fwh = fwnode_get_named_child_node(dev->fwnode, name); -+ if (!fwh) -+ return NULL; -+ -+ adev = to_acpi_device_node(fwh); -+ if (!adev) -+ return NULL; -+ -+ return acpi_create_platform_device(adev, NULL); - } - - static int dwc3_qcom_probe(struct platform_device *pdev) -@@ -715,6 +754,14 @@ static int dwc3_qcom_probe(struct platform_device *pdev) - qcom->acpi_pdata->qscratch_base_offset; - parent_res->end = parent_res->start + - qcom->acpi_pdata->qscratch_base_size; -+ -+ if (qcom->acpi_pdata->is_urs) { -+ qcom->urs_usb = dwc3_qcom_create_urs_usb_platdev(dev); -+ if (!qcom->urs_usb) { -+ dev_err(dev, "failed to create URS USB platdev\n"); -+ return -ENODEV; -+ } -+ } - } - - qcom->qscratch_base = devm_ioremap_resource(dev, parent_res); -@@ -877,8 +924,22 @@ static const struct dwc3_acpi_pdata sdm845_acpi_pdata = { - .ss_phy_irq_index = 2 - }; - -+static const struct dwc3_acpi_pdata sdm845_acpi_urs_pdata = { -+ .qscratch_base_offset = SDM845_QSCRATCH_BASE_OFFSET, -+ .qscratch_base_size = SDM845_QSCRATCH_SIZE, -+ .dwc3_core_base_size = SDM845_DWC3_CORE_SIZE, -+ .hs_phy_irq_index = 1, -+ .dp_hs_phy_irq_index = 4, -+ .dm_hs_phy_irq_index = 3, -+ .ss_phy_irq_index = 2, -+ .is_urs = true, -+}; -+ - static const struct acpi_device_id dwc3_qcom_acpi_match[] = { - { "QCOM2430", (unsigned long)&sdm845_acpi_pdata }, -+ { "QCOM0304", (unsigned long)&sdm845_acpi_urs_pdata }, -+ { "QCOM0497", (unsigned long)&sdm845_acpi_urs_pdata }, -+ { "QCOM04A6", (unsigned long)&sdm845_acpi_pdata }, - { }, - }; - MODULE_DEVICE_TABLE(acpi, dwc3_qcom_acpi_match); -diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c -index 00d346965f7a5..560382e0a8f38 100644 ---- a/drivers/usb/gadget/function/f_uac1.c -+++ b/drivers/usb/gadget/function/f_uac1.c -@@ -499,6 +499,7 @@ static void f_audio_disable(struct usb_function *f) - uac1->as_out_alt = 0; - uac1->as_in_alt = 0; - -+ u_audio_stop_playback(&uac1->g_audio); - u_audio_stop_capture(&uac1->g_audio); - } - -diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c -index 5d960b6603b6f..6f03e944e0e31 100644 ---- a/drivers/usb/gadget/function/f_uac2.c -+++ b/drivers/usb/gadget/function/f_uac2.c -@@ -478,7 +478,7 @@ static int set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts, - } - - max_size_bw = num_channels(chmask) * ssize * -- DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1))); -+ ((srate / (factor / (1 << (ep_desc->bInterval - 1)))) + 1); - ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw, - max_size_ep)); - -diff --git a/drivers/usb/gadget/function/u_ether_configfs.h b/drivers/usb/gadget/function/u_ether_configfs.h -index bd92b57030131..f982e18a5a789 100644 ---- a/drivers/usb/gadget/function/u_ether_configfs.h -+++ b/drivers/usb/gadget/function/u_ether_configfs.h -@@ -169,12 +169,11 @@ out: \ - size_t len) \ - { \ - struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \ -- int ret; \ -+ int ret = -EINVAL; \ - u8 val; \ - \ - mutex_lock(&opts->lock); \ -- ret = sscanf(page, "%02hhx", &val); \ -- if (ret > 0) { \ -+ if (sscanf(page, "%02hhx", &val) > 0) { \ - opts->_n_ = val; \ - ret = len; \ - } \ -diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c -index f1ea51476add0..1d3ebb07ccd4d 100644 ---- a/drivers/usb/gadget/udc/s3c2410_udc.c -+++ b/drivers/usb/gadget/udc/s3c2410_udc.c -@@ -1773,8 +1773,8 @@ static int s3c2410_udc_probe(struct platform_device *pdev) - udc_info = dev_get_platdata(&pdev->dev); - - base_addr = devm_platform_ioremap_resource(pdev, 0); -- if (!base_addr) { -- retval = -ENOMEM; -+ if (IS_ERR(base_addr)) { -+ retval = PTR_ERR(base_addr); - goto err_mem; - } - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index 84da8406d5b42..5bbccc9a0179f 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -66,6 +66,7 @@ - #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 - #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242 - #define PCI_DEVICE_ID_ASMEDIA_2142_XHCI 0x2142 -+#define PCI_DEVICE_ID_ASMEDIA_3242_XHCI 0x3242 - - static const char hcd_name[] = "xhci_hcd"; - -@@ -276,11 +277,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) - xhci->quirks |= XHCI_BROKEN_STREAMS; - if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && -- pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) -+ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) { - xhci->quirks |= XHCI_TRUST_TX_LENGTH; -+ xhci->quirks |= XHCI_NO_64BIT_SUPPORT; -+ } - if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && - (pdev->device == PCI_DEVICE_ID_ASMEDIA_1142_XHCI || -- pdev->device == PCI_DEVICE_ID_ASMEDIA_2142_XHCI)) -+ pdev->device == PCI_DEVICE_ID_ASMEDIA_2142_XHCI || -+ pdev->device == PCI_DEVICE_ID_ASMEDIA_3242_XHCI)) - xhci->quirks |= XHCI_NO_64BIT_SUPPORT; - - if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && -@@ -295,6 +299,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - pdev->device == 0x9026) - xhci->quirks |= XHCI_RESET_PLL_ON_DISCONNECT; - -+ if (pdev->vendor == PCI_VENDOR_ID_AMD && -+ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2 || -+ pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4)) -+ xhci->quirks |= XHCI_NO_SOFT_RETRY; -+ - if (xhci->quirks & XHCI_RESET_ON_RESUME) - xhci_dbg_trace(xhci, trace_xhci_dbg_quirks, - "QUIRK: Resetting on resume"); -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 89c3be9917f66..02ea65db80f34 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2307,7 +2307,8 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td, - remaining = 0; - break; - case COMP_USB_TRANSACTION_ERROR: -- if ((ep_ring->err_count++ > MAX_SOFT_RETRY) || -+ if (xhci->quirks & XHCI_NO_SOFT_RETRY || -+ (ep_ring->err_count++ > MAX_SOFT_RETRY) || - le32_to_cpu(slot_ctx->tt_info) & TT_SLOT) - break; - *status = 0; -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 345a221028c6f..fd84ca7534e0d 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -883,44 +883,42 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci) - xhci_set_cmd_ring_deq(xhci); - } - --static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci) -+/* -+ * Disable port wake bits if do_wakeup is not set. -+ * -+ * Also clear a possible internal port wake state left hanging for ports that -+ * detected termination but never successfully enumerated (trained to 0U). -+ * Internal wake causes immediate xHCI wake after suspend. PORT_CSC write done -+ * at enumeration clears this wake, force one here as well for unconnected ports -+ */ -+ -+static void xhci_disable_hub_port_wake(struct xhci_hcd *xhci, -+ struct xhci_hub *rhub, -+ bool do_wakeup) - { -- struct xhci_port **ports; -- int port_index; - unsigned long flags; - u32 t1, t2, portsc; -+ int i; - - spin_lock_irqsave(&xhci->lock, flags); - -- /* disable usb3 ports Wake bits */ -- port_index = xhci->usb3_rhub.num_ports; -- ports = xhci->usb3_rhub.ports; -- while (port_index--) { -- t1 = readl(ports[port_index]->addr); -- portsc = t1; -- t1 = xhci_port_state_to_neutral(t1); -- t2 = t1 & ~PORT_WAKE_BITS; -- if (t1 != t2) { -- writel(t2, ports[port_index]->addr); -- xhci_dbg(xhci, "disable wake bits port %d-%d, portsc: 0x%x, write: 0x%x\n", -- xhci->usb3_rhub.hcd->self.busnum, -- port_index + 1, portsc, t2); -- } -- } -+ for (i = 0; i < rhub->num_ports; i++) { -+ portsc = readl(rhub->ports[i]->addr); -+ t1 = xhci_port_state_to_neutral(portsc); -+ t2 = t1; -+ -+ /* clear wake bits if do_wake is not set */ -+ if (!do_wakeup) -+ t2 &= ~PORT_WAKE_BITS; -+ -+ /* Don't touch csc bit if connected or connect change is set */ -+ if (!(portsc & (PORT_CSC | PORT_CONNECT))) -+ t2 |= PORT_CSC; - -- /* disable usb2 ports Wake bits */ -- port_index = xhci->usb2_rhub.num_ports; -- ports = xhci->usb2_rhub.ports; -- while (port_index--) { -- t1 = readl(ports[port_index]->addr); -- portsc = t1; -- t1 = xhci_port_state_to_neutral(t1); -- t2 = t1 & ~PORT_WAKE_BITS; - if (t1 != t2) { -- writel(t2, ports[port_index]->addr); -- xhci_dbg(xhci, "disable wake bits port %d-%d, portsc: 0x%x, write: 0x%x\n", -- xhci->usb2_rhub.hcd->self.busnum, -- port_index + 1, portsc, t2); -+ writel(t2, rhub->ports[i]->addr); -+ xhci_dbg(xhci, "config port %d-%d wake bits, portsc: 0x%x, write: 0x%x\n", -+ rhub->hcd->self.busnum, i + 1, portsc, t2); - } - } - spin_unlock_irqrestore(&xhci->lock, flags); -@@ -983,8 +981,8 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) - return -EINVAL; - - /* Clear root port wake on bits if wakeup not allowed. */ -- if (!do_wakeup) -- xhci_disable_port_wake_on_bits(xhci); -+ xhci_disable_hub_port_wake(xhci, &xhci->usb3_rhub, do_wakeup); -+ xhci_disable_hub_port_wake(xhci, &xhci->usb2_rhub, do_wakeup); - - if (!HCD_HW_ACCESSIBLE(hcd)) - return 0; -@@ -1088,6 +1086,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) - struct usb_hcd *secondary_hcd; - int retval = 0; - bool comp_timer_running = false; -+ bool pending_portevent = false; - - if (!hcd->state) - return 0; -@@ -1226,13 +1225,22 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) - - done: - if (retval == 0) { -- /* Resume root hubs only when have pending events. */ -- if (xhci_pending_portevent(xhci)) { -+ /* -+ * Resume roothubs only if there are pending events. -+ * USB 3 devices resend U3 LFPS wake after a 100ms delay if -+ * the first wake signalling failed, give it that chance. -+ */ -+ pending_portevent = xhci_pending_portevent(xhci); -+ if (!pending_portevent) { -+ msleep(120); -+ pending_portevent = xhci_pending_portevent(xhci); -+ } -+ -+ if (pending_portevent) { - usb_hcd_resume_root_hub(xhci->shared_hcd); - usb_hcd_resume_root_hub(hcd); - } - } -- - /* - * If system is subject to the Quirk, Compliance Mode Timer needs to - * be re-initialized Always after a system resume. Ports are subject -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 07ff95016f119..3190fd570c579 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1883,6 +1883,7 @@ struct xhci_hcd { - #define XHCI_SKIP_PHY_INIT BIT_ULL(37) - #define XHCI_DISABLE_SPARSE BIT_ULL(38) - #define XHCI_SG_TRB_CACHE_SIZE_QUIRK BIT_ULL(39) -+#define XHCI_NO_SOFT_RETRY BIT_ULL(40) - - unsigned int num_active_eps; - unsigned int limit_active_eps; -diff --git a/drivers/usb/renesas_usbhs/pipe.c b/drivers/usb/renesas_usbhs/pipe.c -index e7334b7fb3a62..75fff2e4cbc65 100644 ---- a/drivers/usb/renesas_usbhs/pipe.c -+++ b/drivers/usb/renesas_usbhs/pipe.c -@@ -746,6 +746,8 @@ struct usbhs_pipe *usbhs_pipe_malloc(struct usbhs_priv *priv, - - void usbhs_pipe_free(struct usbhs_pipe *pipe) - { -+ usbhsp_pipe_select(pipe); -+ usbhsp_pipe_cfg_set(pipe, 0xFFFF, 0); - usbhsp_put_pipe(pipe); - } - -diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c -index 28deaaec581f6..f26861246f653 100644 ---- a/drivers/usb/serial/ch341.c -+++ b/drivers/usb/serial/ch341.c -@@ -86,6 +86,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1a86, 0x7522) }, - { USB_DEVICE(0x1a86, 0x7523) }, - { USB_DEVICE(0x4348, 0x5523) }, -+ { USB_DEVICE(0x9986, 0x7523) }, - { }, - }; - MODULE_DEVICE_TABLE(usb, id_table); -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 7bec1e730b209..6947d5f4cb5e9 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -146,6 +146,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ - { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ -+ { USB_DEVICE(0x10C4, 0x88D8) }, /* Acuity Brands nLight Air Adapter */ - { USB_DEVICE(0x10C4, 0x88FB) }, /* CESINEL MEDCAL STII Network Analyzer */ - { USB_DEVICE(0x10C4, 0x8938) }, /* CESINEL MEDCAL S II Network Analyzer */ - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ -@@ -202,6 +203,8 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ - { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART interface */ - { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */ -+ { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */ -+ { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface */ - { USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */ - { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ - { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ -diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c -index ba5d8df695189..4b48ef4adbeb6 100644 ---- a/drivers/usb/serial/io_edgeport.c -+++ b/drivers/usb/serial/io_edgeport.c -@@ -3003,26 +3003,32 @@ static int edge_startup(struct usb_serial *serial) - response = -ENODEV; - } - -- usb_free_urb(edge_serial->interrupt_read_urb); -- kfree(edge_serial->interrupt_in_buffer); -- -- usb_free_urb(edge_serial->read_urb); -- kfree(edge_serial->bulk_in_buffer); -- -- kfree(edge_serial); -- -- return response; -+ goto error; - } - - /* start interrupt read for this edgeport this interrupt will - * continue as long as the edgeport is connected */ - response = usb_submit_urb(edge_serial->interrupt_read_urb, - GFP_KERNEL); -- if (response) -+ if (response) { - dev_err(ddev, "%s - Error %d submitting control urb\n", - __func__, response); -+ -+ goto error; -+ } - } - return response; -+ -+error: -+ usb_free_urb(edge_serial->interrupt_read_urb); -+ kfree(edge_serial->interrupt_in_buffer); -+ -+ usb_free_urb(edge_serial->read_urb); -+ kfree(edge_serial->bulk_in_buffer); -+ -+ kfree(edge_serial); -+ -+ return response; - } - - -diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c -index 2305d425e6c9a..8f1de1fbbeedf 100644 ---- a/drivers/usb/usbip/stub_dev.c -+++ b/drivers/usb/usbip/stub_dev.c -@@ -46,6 +46,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a - int sockfd = 0; - struct socket *socket; - int rv; -+ struct task_struct *tcp_rx = NULL; -+ struct task_struct *tcp_tx = NULL; - - if (!sdev) { - dev_err(dev, "sdev is null\n"); -@@ -69,23 +71,47 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a - } - - socket = sockfd_lookup(sockfd, &err); -- if (!socket) -+ if (!socket) { -+ dev_err(dev, "failed to lookup sock"); - goto err; -+ } - -- sdev->ud.tcp_socket = socket; -- sdev->ud.sockfd = sockfd; -+ if (socket->type != SOCK_STREAM) { -+ dev_err(dev, "Expecting SOCK_STREAM - found %d", -+ socket->type); -+ goto sock_err; -+ } - -+ /* unlock and create threads and get tasks */ - spin_unlock_irq(&sdev->ud.lock); -+ tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx"); -+ if (IS_ERR(tcp_rx)) { -+ sockfd_put(socket); -+ return -EINVAL; -+ } -+ tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx"); -+ if (IS_ERR(tcp_tx)) { -+ kthread_stop(tcp_rx); -+ sockfd_put(socket); -+ return -EINVAL; -+ } - -- sdev->ud.tcp_rx = kthread_get_run(stub_rx_loop, &sdev->ud, -- "stub_rx"); -- sdev->ud.tcp_tx = kthread_get_run(stub_tx_loop, &sdev->ud, -- "stub_tx"); -+ /* get task structs now */ -+ get_task_struct(tcp_rx); -+ get_task_struct(tcp_tx); - -+ /* lock and update sdev->ud state */ - spin_lock_irq(&sdev->ud.lock); -+ sdev->ud.tcp_socket = socket; -+ sdev->ud.sockfd = sockfd; -+ sdev->ud.tcp_rx = tcp_rx; -+ sdev->ud.tcp_tx = tcp_tx; - sdev->ud.status = SDEV_ST_USED; - spin_unlock_irq(&sdev->ud.lock); - -+ wake_up_process(sdev->ud.tcp_rx); -+ wake_up_process(sdev->ud.tcp_tx); -+ - } else { - dev_info(dev, "stub down\n"); - -@@ -100,6 +126,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a - - return count; - -+sock_err: -+ sockfd_put(socket); - err: - spin_unlock_irq(&sdev->ud.lock); - return -EINVAL; -diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c -index be37aec250c2b..e64ea314930be 100644 ---- a/drivers/usb/usbip/vhci_sysfs.c -+++ b/drivers/usb/usbip/vhci_sysfs.c -@@ -312,6 +312,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, - struct vhci *vhci; - int err; - unsigned long flags; -+ struct task_struct *tcp_rx = NULL; -+ struct task_struct *tcp_tx = NULL; - - /* - * @rhport: port number of vhci_hcd -@@ -349,12 +351,35 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, - - /* Extract socket from fd. */ - socket = sockfd_lookup(sockfd, &err); -- if (!socket) -+ if (!socket) { -+ dev_err(dev, "failed to lookup sock"); - return -EINVAL; -+ } -+ if (socket->type != SOCK_STREAM) { -+ dev_err(dev, "Expecting SOCK_STREAM - found %d", -+ socket->type); -+ sockfd_put(socket); -+ return -EINVAL; -+ } -+ -+ /* create threads before locking */ -+ tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx"); -+ if (IS_ERR(tcp_rx)) { -+ sockfd_put(socket); -+ return -EINVAL; -+ } -+ tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx"); -+ if (IS_ERR(tcp_tx)) { -+ kthread_stop(tcp_rx); -+ sockfd_put(socket); -+ return -EINVAL; -+ } - -- /* now need lock until setting vdev status as used */ -+ /* get task structs now */ -+ get_task_struct(tcp_rx); -+ get_task_struct(tcp_tx); - -- /* begin a lock */ -+ /* now begin lock until setting vdev status set */ - spin_lock_irqsave(&vhci->lock, flags); - spin_lock(&vdev->ud.lock); - -@@ -364,6 +389,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, - spin_unlock_irqrestore(&vhci->lock, flags); - - sockfd_put(socket); -+ kthread_stop_put(tcp_rx); -+ kthread_stop_put(tcp_tx); - - dev_err(dev, "port %d already used\n", rhport); - /* -@@ -382,14 +409,16 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, - vdev->speed = speed; - vdev->ud.sockfd = sockfd; - vdev->ud.tcp_socket = socket; -+ vdev->ud.tcp_rx = tcp_rx; -+ vdev->ud.tcp_tx = tcp_tx; - vdev->ud.status = VDEV_ST_NOTASSIGNED; - - spin_unlock(&vdev->ud.lock); - spin_unlock_irqrestore(&vhci->lock, flags); - /* end the lock */ - -- vdev->ud.tcp_rx = kthread_get_run(vhci_rx_loop, &vdev->ud, "vhci_rx"); -- vdev->ud.tcp_tx = kthread_get_run(vhci_tx_loop, &vdev->ud, "vhci_tx"); -+ wake_up_process(vdev->ud.tcp_rx); -+ wake_up_process(vdev->ud.tcp_tx); - - rh_port_connect(vdev, speed); - -diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c -index 100f680c572ae..a3ec39fc61778 100644 ---- a/drivers/usb/usbip/vudc_sysfs.c -+++ b/drivers/usb/usbip/vudc_sysfs.c -@@ -90,8 +90,9 @@ unlock: - } - static BIN_ATTR_RO(dev_desc, sizeof(struct usb_device_descriptor)); - --static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *attr, -- const char *in, size_t count) -+static ssize_t usbip_sockfd_store(struct device *dev, -+ struct device_attribute *attr, -+ const char *in, size_t count) - { - struct vudc *udc = (struct vudc *) dev_get_drvdata(dev); - int rv; -@@ -100,6 +101,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a - struct socket *socket; - unsigned long flags; - int ret; -+ struct task_struct *tcp_rx = NULL; -+ struct task_struct *tcp_tx = NULL; - - rv = kstrtoint(in, 0, &sockfd); - if (rv != 0) -@@ -138,24 +141,54 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a - goto unlock_ud; - } - -- udc->ud.tcp_socket = socket; -+ if (socket->type != SOCK_STREAM) { -+ dev_err(dev, "Expecting SOCK_STREAM - found %d", -+ socket->type); -+ ret = -EINVAL; -+ goto sock_err; -+ } - -+ /* unlock and create threads and get tasks */ - spin_unlock_irq(&udc->ud.lock); - spin_unlock_irqrestore(&udc->lock, flags); - -- udc->ud.tcp_rx = kthread_get_run(&v_rx_loop, -- &udc->ud, "vudc_rx"); -- udc->ud.tcp_tx = kthread_get_run(&v_tx_loop, -- &udc->ud, "vudc_tx"); -+ tcp_rx = kthread_create(&v_rx_loop, &udc->ud, "vudc_rx"); -+ if (IS_ERR(tcp_rx)) { -+ sockfd_put(socket); -+ return -EINVAL; -+ } -+ tcp_tx = kthread_create(&v_tx_loop, &udc->ud, "vudc_tx"); -+ if (IS_ERR(tcp_tx)) { -+ kthread_stop(tcp_rx); -+ sockfd_put(socket); -+ return -EINVAL; -+ } -+ -+ /* get task structs now */ -+ get_task_struct(tcp_rx); -+ get_task_struct(tcp_tx); - -+ /* lock and update udc->ud state */ - spin_lock_irqsave(&udc->lock, flags); - spin_lock_irq(&udc->ud.lock); -+ -+ udc->ud.tcp_socket = socket; -+ udc->ud.tcp_rx = tcp_rx; -+ udc->ud.tcp_rx = tcp_tx; - udc->ud.status = SDEV_ST_USED; -+ - spin_unlock_irq(&udc->ud.lock); - - ktime_get_ts64(&udc->start_time); - v_start_timer(udc); - udc->connected = 1; -+ -+ spin_unlock_irqrestore(&udc->lock, flags); -+ -+ wake_up_process(udc->ud.tcp_rx); -+ wake_up_process(udc->ud.tcp_tx); -+ return count; -+ - } else { - if (!udc->connected) { - dev_err(dev, "Device not connected"); -@@ -177,6 +210,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a - - return count; - -+sock_err: -+ sockfd_put(socket); - unlock_ud: - spin_unlock_irq(&udc->ud.lock); - unlock: -diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c -index da87f3a1e351b..b8f2f971c2f0f 100644 ---- a/drivers/xen/events/events_2l.c -+++ b/drivers/xen/events/events_2l.c -@@ -47,6 +47,11 @@ static unsigned evtchn_2l_max_channels(void) - return EVTCHN_2L_NR_CHANNELS; - } - -+static void evtchn_2l_remove(evtchn_port_t evtchn, unsigned int cpu) -+{ -+ clear_bit(evtchn, BM(per_cpu(cpu_evtchn_mask, cpu))); -+} -+ - static void evtchn_2l_bind_to_cpu(evtchn_port_t evtchn, unsigned int cpu, - unsigned int old_cpu) - { -@@ -72,12 +77,6 @@ static bool evtchn_2l_is_pending(evtchn_port_t port) - return sync_test_bit(port, BM(&s->evtchn_pending[0])); - } - --static bool evtchn_2l_test_and_set_mask(evtchn_port_t port) --{ -- struct shared_info *s = HYPERVISOR_shared_info; -- return sync_test_and_set_bit(port, BM(&s->evtchn_mask[0])); --} -- - static void evtchn_2l_mask(evtchn_port_t port) - { - struct shared_info *s = HYPERVISOR_shared_info; -@@ -355,18 +354,27 @@ static void evtchn_2l_resume(void) - EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD); - } - -+static int evtchn_2l_percpu_deinit(unsigned int cpu) -+{ -+ memset(per_cpu(cpu_evtchn_mask, cpu), 0, sizeof(xen_ulong_t) * -+ EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD); -+ -+ return 0; -+} -+ - static const struct evtchn_ops evtchn_ops_2l = { - .max_channels = evtchn_2l_max_channels, - .nr_channels = evtchn_2l_max_channels, -+ .remove = evtchn_2l_remove, - .bind_to_cpu = evtchn_2l_bind_to_cpu, - .clear_pending = evtchn_2l_clear_pending, - .set_pending = evtchn_2l_set_pending, - .is_pending = evtchn_2l_is_pending, -- .test_and_set_mask = evtchn_2l_test_and_set_mask, - .mask = evtchn_2l_mask, - .unmask = evtchn_2l_unmask, - .handle_events = evtchn_2l_handle_events, - .resume = evtchn_2l_resume, -+ .percpu_deinit = evtchn_2l_percpu_deinit, - }; - - void __init xen_evtchn_2l_init(void) -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index e850f79351cbb..d9148609bd09a 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -97,13 +97,19 @@ struct irq_info { - short refcnt; - u8 spurious_cnt; - u8 is_accounted; -- enum xen_irq_type type; /* type */ -+ short type; /* type: IRQT_* */ -+ u8 mask_reason; /* Why is event channel masked */ -+#define EVT_MASK_REASON_EXPLICIT 0x01 -+#define EVT_MASK_REASON_TEMPORARY 0x02 -+#define EVT_MASK_REASON_EOI_PENDING 0x04 -+ u8 is_active; /* Is event just being handled? */ - unsigned irq; - evtchn_port_t evtchn; /* event channel */ - unsigned short cpu; /* cpu bound */ - unsigned short eoi_cpu; /* EOI must happen on this cpu-1 */ - unsigned int irq_epoch; /* If eoi_cpu valid: irq_epoch of event */ - u64 eoi_time; /* Time in jiffies when to EOI. */ -+ spinlock_t lock; - - union { - unsigned short virq; -@@ -152,6 +158,7 @@ static DEFINE_RWLOCK(evtchn_rwlock); - * evtchn_rwlock - * IRQ-desc lock - * percpu eoi_list_lock -+ * irq_info->lock - */ - - static LIST_HEAD(xen_irq_list_head); -@@ -302,6 +309,8 @@ static int xen_irq_info_common_setup(struct irq_info *info, - info->irq = irq; - info->evtchn = evtchn; - info->cpu = cpu; -+ info->mask_reason = EVT_MASK_REASON_EXPLICIT; -+ spin_lock_init(&info->lock); - - ret = set_evtchn_to_irq(evtchn, irq); - if (ret < 0) -@@ -368,6 +377,7 @@ static int xen_irq_info_pirq_setup(unsigned irq, - static void xen_irq_info_cleanup(struct irq_info *info) - { - set_evtchn_to_irq(info->evtchn, -1); -+ xen_evtchn_port_remove(info->evtchn, info->cpu); - info->evtchn = 0; - channels_on_cpu_dec(info); - } -@@ -449,6 +459,34 @@ unsigned int cpu_from_evtchn(evtchn_port_t evtchn) - return ret; - } - -+static void do_mask(struct irq_info *info, u8 reason) -+{ -+ unsigned long flags; -+ -+ spin_lock_irqsave(&info->lock, flags); -+ -+ if (!info->mask_reason) -+ mask_evtchn(info->evtchn); -+ -+ info->mask_reason |= reason; -+ -+ spin_unlock_irqrestore(&info->lock, flags); -+} -+ -+static void do_unmask(struct irq_info *info, u8 reason) -+{ -+ unsigned long flags; -+ -+ spin_lock_irqsave(&info->lock, flags); -+ -+ info->mask_reason &= ~reason; -+ -+ if (!info->mask_reason) -+ unmask_evtchn(info->evtchn); -+ -+ spin_unlock_irqrestore(&info->lock, flags); -+} -+ - #ifdef CONFIG_X86 - static bool pirq_check_eoi_map(unsigned irq) - { -@@ -585,7 +623,7 @@ static void xen_irq_lateeoi_locked(struct irq_info *info, bool spurious) - } - - info->eoi_time = 0; -- unmask_evtchn(evtchn); -+ do_unmask(info, EVT_MASK_REASON_EOI_PENDING); - } - - static void xen_irq_lateeoi_worker(struct work_struct *work) -@@ -754,6 +792,12 @@ static void xen_evtchn_close(evtchn_port_t port) - BUG(); - } - -+static void event_handler_exit(struct irq_info *info) -+{ -+ smp_store_release(&info->is_active, 0); -+ clear_evtchn(info->evtchn); -+} -+ - static void pirq_query_unmask(int irq) - { - struct physdev_irq_status_query irq_status; -@@ -772,14 +816,15 @@ static void pirq_query_unmask(int irq) - - static void eoi_pirq(struct irq_data *data) - { -- evtchn_port_t evtchn = evtchn_from_irq(data->irq); -+ struct irq_info *info = info_for_irq(data->irq); -+ evtchn_port_t evtchn = info ? info->evtchn : 0; - struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) }; - int rc = 0; - - if (!VALID_EVTCHN(evtchn)) - return; - -- clear_evtchn(evtchn); -+ event_handler_exit(info); - - if (pirq_needs_eoi(data->irq)) { - rc = HYPERVISOR_physdev_op(PHYSDEVOP_eoi, &eoi); -@@ -830,7 +875,8 @@ static unsigned int __startup_pirq(unsigned int irq) - goto err; - - out: -- unmask_evtchn(evtchn); -+ do_unmask(info, EVT_MASK_REASON_EXPLICIT); -+ - eoi_pirq(irq_get_irq_data(irq)); - - return 0; -@@ -857,7 +903,7 @@ static void shutdown_pirq(struct irq_data *data) - if (!VALID_EVTCHN(evtchn)) - return; - -- mask_evtchn(evtchn); -+ do_mask(info, EVT_MASK_REASON_EXPLICIT); - xen_evtchn_close(evtchn); - xen_irq_info_cleanup(info); - } -@@ -1602,6 +1648,8 @@ void handle_irq_for_port(evtchn_port_t port, struct evtchn_loop_ctrl *ctrl) - } - - info = info_for_irq(irq); -+ if (xchg_acquire(&info->is_active, 1)) -+ return; - - if (ctrl->defer_eoi) { - info->eoi_cpu = smp_processor_id(); -@@ -1690,10 +1738,10 @@ void rebind_evtchn_irq(evtchn_port_t evtchn, int irq) - } - - /* Rebind an evtchn so that it gets delivered to a specific cpu */ --static int xen_rebind_evtchn_to_cpu(evtchn_port_t evtchn, unsigned int tcpu) -+static int xen_rebind_evtchn_to_cpu(struct irq_info *info, unsigned int tcpu) - { - struct evtchn_bind_vcpu bind_vcpu; -- int masked; -+ evtchn_port_t evtchn = info ? info->evtchn : 0; - - if (!VALID_EVTCHN(evtchn)) - return -1; -@@ -1709,7 +1757,7 @@ static int xen_rebind_evtchn_to_cpu(evtchn_port_t evtchn, unsigned int tcpu) - * Mask the event while changing the VCPU binding to prevent - * it being delivered on an unexpected VCPU. - */ -- masked = test_and_set_mask(evtchn); -+ do_mask(info, EVT_MASK_REASON_TEMPORARY); - - /* - * If this fails, it usually just indicates that we're dealing with a -@@ -1719,8 +1767,7 @@ static int xen_rebind_evtchn_to_cpu(evtchn_port_t evtchn, unsigned int tcpu) - if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) - bind_evtchn_to_cpu(evtchn, tcpu, false); - -- if (!masked) -- unmask_evtchn(evtchn); -+ do_unmask(info, EVT_MASK_REASON_TEMPORARY); - - return 0; - } -@@ -1759,7 +1806,7 @@ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest, - unsigned int tcpu = select_target_cpu(dest); - int ret; - -- ret = xen_rebind_evtchn_to_cpu(evtchn_from_irq(data->irq), tcpu); -+ ret = xen_rebind_evtchn_to_cpu(info_for_irq(data->irq), tcpu); - if (!ret) - irq_data_update_effective_affinity(data, cpumask_of(tcpu)); - -@@ -1768,28 +1815,29 @@ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest, - - static void enable_dynirq(struct irq_data *data) - { -- evtchn_port_t evtchn = evtchn_from_irq(data->irq); -+ struct irq_info *info = info_for_irq(data->irq); -+ evtchn_port_t evtchn = info ? info->evtchn : 0; - - if (VALID_EVTCHN(evtchn)) -- unmask_evtchn(evtchn); -+ do_unmask(info, EVT_MASK_REASON_EXPLICIT); - } - - static void disable_dynirq(struct irq_data *data) - { -- evtchn_port_t evtchn = evtchn_from_irq(data->irq); -+ struct irq_info *info = info_for_irq(data->irq); -+ evtchn_port_t evtchn = info ? info->evtchn : 0; - - if (VALID_EVTCHN(evtchn)) -- mask_evtchn(evtchn); -+ do_mask(info, EVT_MASK_REASON_EXPLICIT); - } - - static void ack_dynirq(struct irq_data *data) - { -- evtchn_port_t evtchn = evtchn_from_irq(data->irq); -+ struct irq_info *info = info_for_irq(data->irq); -+ evtchn_port_t evtchn = info ? info->evtchn : 0; - -- if (!VALID_EVTCHN(evtchn)) -- return; -- -- clear_evtchn(evtchn); -+ if (VALID_EVTCHN(evtchn)) -+ event_handler_exit(info); - } - - static void mask_ack_dynirq(struct irq_data *data) -@@ -1798,18 +1846,39 @@ static void mask_ack_dynirq(struct irq_data *data) - ack_dynirq(data); - } - -+static void lateeoi_ack_dynirq(struct irq_data *data) -+{ -+ struct irq_info *info = info_for_irq(data->irq); -+ evtchn_port_t evtchn = info ? info->evtchn : 0; -+ -+ if (VALID_EVTCHN(evtchn)) { -+ do_mask(info, EVT_MASK_REASON_EOI_PENDING); -+ event_handler_exit(info); -+ } -+} -+ -+static void lateeoi_mask_ack_dynirq(struct irq_data *data) -+{ -+ struct irq_info *info = info_for_irq(data->irq); -+ evtchn_port_t evtchn = info ? info->evtchn : 0; -+ -+ if (VALID_EVTCHN(evtchn)) { -+ do_mask(info, EVT_MASK_REASON_EXPLICIT); -+ event_handler_exit(info); -+ } -+} -+ - static int retrigger_dynirq(struct irq_data *data) - { -- evtchn_port_t evtchn = evtchn_from_irq(data->irq); -- int masked; -+ struct irq_info *info = info_for_irq(data->irq); -+ evtchn_port_t evtchn = info ? info->evtchn : 0; - - if (!VALID_EVTCHN(evtchn)) - return 0; - -- masked = test_and_set_mask(evtchn); -+ do_mask(info, EVT_MASK_REASON_TEMPORARY); - set_evtchn(evtchn); -- if (!masked) -- unmask_evtchn(evtchn); -+ do_unmask(info, EVT_MASK_REASON_TEMPORARY); - - return 1; - } -@@ -1908,10 +1977,11 @@ static void restore_cpu_ipis(unsigned int cpu) - /* Clear an irq's pending state, in preparation for polling on it */ - void xen_clear_irq_pending(int irq) - { -- evtchn_port_t evtchn = evtchn_from_irq(irq); -+ struct irq_info *info = info_for_irq(irq); -+ evtchn_port_t evtchn = info ? info->evtchn : 0; - - if (VALID_EVTCHN(evtchn)) -- clear_evtchn(evtchn); -+ event_handler_exit(info); - } - EXPORT_SYMBOL(xen_clear_irq_pending); - void xen_set_irq_pending(int irq) -@@ -2023,8 +2093,8 @@ static struct irq_chip xen_lateeoi_chip __read_mostly = { - .irq_mask = disable_dynirq, - .irq_unmask = enable_dynirq, - -- .irq_ack = mask_ack_dynirq, -- .irq_mask_ack = mask_ack_dynirq, -+ .irq_ack = lateeoi_ack_dynirq, -+ .irq_mask_ack = lateeoi_mask_ack_dynirq, - - .irq_set_affinity = set_affinity_irq, - .irq_retrigger = retrigger_dynirq, -diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c -index b234f1766810c..ad9fe51d3fb33 100644 ---- a/drivers/xen/events/events_fifo.c -+++ b/drivers/xen/events/events_fifo.c -@@ -209,12 +209,6 @@ static bool evtchn_fifo_is_pending(evtchn_port_t port) - return sync_test_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word)); - } - --static bool evtchn_fifo_test_and_set_mask(evtchn_port_t port) --{ -- event_word_t *word = event_word_from_port(port); -- return sync_test_and_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word)); --} -- - static void evtchn_fifo_mask(evtchn_port_t port) - { - event_word_t *word = event_word_from_port(port); -@@ -423,7 +417,6 @@ static const struct evtchn_ops evtchn_ops_fifo = { - .clear_pending = evtchn_fifo_clear_pending, - .set_pending = evtchn_fifo_set_pending, - .is_pending = evtchn_fifo_is_pending, -- .test_and_set_mask = evtchn_fifo_test_and_set_mask, - .mask = evtchn_fifo_mask, - .unmask = evtchn_fifo_unmask, - .handle_events = evtchn_fifo_handle_events, -diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h -index 0a97c0549db76..4d3398eff9cdf 100644 ---- a/drivers/xen/events/events_internal.h -+++ b/drivers/xen/events/events_internal.h -@@ -14,13 +14,13 @@ struct evtchn_ops { - unsigned (*nr_channels)(void); - - int (*setup)(evtchn_port_t port); -+ void (*remove)(evtchn_port_t port, unsigned int cpu); - void (*bind_to_cpu)(evtchn_port_t evtchn, unsigned int cpu, - unsigned int old_cpu); - - void (*clear_pending)(evtchn_port_t port); - void (*set_pending)(evtchn_port_t port); - bool (*is_pending)(evtchn_port_t port); -- bool (*test_and_set_mask)(evtchn_port_t port); - void (*mask)(evtchn_port_t port); - void (*unmask)(evtchn_port_t port); - -@@ -54,6 +54,13 @@ static inline int xen_evtchn_port_setup(evtchn_port_t evtchn) - return 0; - } - -+static inline void xen_evtchn_port_remove(evtchn_port_t evtchn, -+ unsigned int cpu) -+{ -+ if (evtchn_ops->remove) -+ evtchn_ops->remove(evtchn, cpu); -+} -+ - static inline void xen_evtchn_port_bind_to_cpu(evtchn_port_t evtchn, - unsigned int cpu, - unsigned int old_cpu) -@@ -76,11 +83,6 @@ static inline bool test_evtchn(evtchn_port_t port) - return evtchn_ops->is_pending(port); - } - --static inline bool test_and_set_mask(evtchn_port_t port) --{ -- return evtchn_ops->test_and_set_mask(port); --} -- - static inline void mask_evtchn(evtchn_port_t port) - { - return evtchn_ops->mask(port); -diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c -index 3880a82da1dc5..11b5bf2419555 100644 ---- a/fs/binfmt_misc.c -+++ b/fs/binfmt_misc.c -@@ -647,12 +647,24 @@ static ssize_t bm_register_write(struct file *file, const char __user *buffer, - struct super_block *sb = file_inode(file)->i_sb; - struct dentry *root = sb->s_root, *dentry; - int err = 0; -+ struct file *f = NULL; - - e = create_entry(buffer, count); - - if (IS_ERR(e)) - return PTR_ERR(e); - -+ if (e->flags & MISC_FMT_OPEN_FILE) { -+ f = open_exec(e->interpreter); -+ if (IS_ERR(f)) { -+ pr_notice("register: failed to install interpreter file %s\n", -+ e->interpreter); -+ kfree(e); -+ return PTR_ERR(f); -+ } -+ e->interp_file = f; -+ } -+ - inode_lock(d_inode(root)); - dentry = lookup_one_len(e->name, root, strlen(e->name)); - err = PTR_ERR(dentry); -@@ -676,21 +688,6 @@ static ssize_t bm_register_write(struct file *file, const char __user *buffer, - goto out2; - } - -- if (e->flags & MISC_FMT_OPEN_FILE) { -- struct file *f; -- -- f = open_exec(e->interpreter); -- if (IS_ERR(f)) { -- err = PTR_ERR(f); -- pr_notice("register: failed to install interpreter file %s\n", e->interpreter); -- simple_release_fs(&bm_mnt, &entry_count); -- iput(inode); -- inode = NULL; -- goto out2; -- } -- e->interp_file = f; -- } -- - e->dentry = dget(dentry); - inode->i_private = e; - inode->i_fop = &bm_entry_operations; -@@ -707,6 +704,8 @@ out: - inode_unlock(d_inode(root)); - - if (err) { -+ if (f) -+ filp_close(f, NULL); - kfree(e); - return err; - } -diff --git a/fs/block_dev.c b/fs/block_dev.c -index 235b5042672e9..c33151020bcd7 100644 ---- a/fs/block_dev.c -+++ b/fs/block_dev.c -@@ -118,13 +118,22 @@ int truncate_bdev_range(struct block_device *bdev, fmode_t mode, - if (!(mode & FMODE_EXCL)) { - int err = bd_prepare_to_claim(bdev, truncate_bdev_range); - if (err) -- return err; -+ goto invalidate; - } - - truncate_inode_pages_range(bdev->bd_inode->i_mapping, lstart, lend); - if (!(mode & FMODE_EXCL)) - bd_abort_claiming(bdev, truncate_bdev_range); - return 0; -+ -+invalidate: -+ /* -+ * Someone else has handle exclusively open. Try invalidating instead. -+ * The 'end' argument is inclusive so the rounding is safe. -+ */ -+ return invalidate_inode_pages2_range(bdev->bd_inode->i_mapping, -+ lstart >> PAGE_SHIFT, -+ lend >> PAGE_SHIFT); - } - EXPORT_SYMBOL(truncate_bdev_range); - -diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c -index ab883e84e116b..8a6a1772590bf 100644 ---- a/fs/cifs/cifsfs.c -+++ b/fs/cifs/cifsfs.c -@@ -290,7 +290,7 @@ cifs_statfs(struct dentry *dentry, struct kstatfs *buf) - rc = server->ops->queryfs(xid, tcon, cifs_sb, buf); - - free_xid(xid); -- return 0; -+ return rc; - } - - static long cifs_fallocate(struct file *file, int mode, loff_t off, loff_t len) -diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h -index 50fcb65920e80..089a3916c639f 100644 ---- a/fs/cifs/cifsglob.h -+++ b/fs/cifs/cifsglob.h -@@ -256,7 +256,7 @@ struct smb_version_operations { - /* verify the message */ - int (*check_message)(char *, unsigned int, struct TCP_Server_Info *); - bool (*is_oplock_break)(char *, struct TCP_Server_Info *); -- int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *); -+ int (*handle_cancelled_mid)(struct mid_q_entry *, struct TCP_Server_Info *); - void (*downgrade_oplock)(struct TCP_Server_Info *server, - struct cifsInodeInfo *cinode, __u32 oplock, - unsigned int epoch, bool *purge_cache); -@@ -1701,10 +1701,11 @@ static inline bool is_retryable_error(int error) - #define CIFS_NO_RSP_BUF 0x040 /* no response buffer required */ - - /* Type of request operation */ --#define CIFS_ECHO_OP 0x080 /* echo request */ --#define CIFS_OBREAK_OP 0x0100 /* oplock break request */ --#define CIFS_NEG_OP 0x0200 /* negotiate request */ --#define CIFS_OP_MASK 0x0380 /* mask request type */ -+#define CIFS_ECHO_OP 0x080 /* echo request */ -+#define CIFS_OBREAK_OP 0x0100 /* oplock break request */ -+#define CIFS_NEG_OP 0x0200 /* negotiate request */ -+#define CIFS_CP_CREATE_CLOSE_OP 0x0400 /* compound create+close request */ -+#define CIFS_OP_MASK 0x0780 /* mask request type */ - - #define CIFS_HAS_CREDITS 0x0400 /* already has credits */ - #define CIFS_TRANSFORM_REQ 0x0800 /* transform request before sending */ -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 1439d3c9ff773..70d0f0388af47 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -1405,6 +1405,11 @@ smbd_connected: - tcp_ses->min_offload = ctx->min_offload; - tcp_ses->tcpStatus = CifsNeedNegotiate; - -+ if ((ctx->max_credits < 20) || (ctx->max_credits > 60000)) -+ tcp_ses->max_credits = SMB2_MAX_CREDITS_AVAILABLE; -+ else -+ tcp_ses->max_credits = ctx->max_credits; -+ - tcp_ses->nr_targets = 1; - tcp_ses->ignore_signature = ctx->ignore_signature; - /* thread spawned, put it on the list */ -@@ -2806,11 +2811,6 @@ static int mount_get_conns(struct smb3_fs_context *ctx, struct cifs_sb_info *cif - - *nserver = server; - -- if ((ctx->max_credits < 20) || (ctx->max_credits > 60000)) -- server->max_credits = SMB2_MAX_CREDITS_AVAILABLE; -- else -- server->max_credits = ctx->max_credits; -- - /* get a reference to a SMB session */ - ses = cifs_get_smb_ses(server, ctx); - if (IS_ERR(ses)) { -diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c -index 213465718fa89..dea4959989b50 100644 ---- a/fs/cifs/sess.c -+++ b/fs/cifs/sess.c -@@ -230,6 +230,7 @@ cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses, - ctx.noautotune = ses->server->noautotune; - ctx.sockopt_tcp_nodelay = ses->server->tcp_nodelay; - ctx.echo_interval = ses->server->echo_interval / HZ; -+ ctx.max_credits = ses->server->max_credits; - - /* - * This will be used for encoding/decoding user/domain/pw -diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c -index 1f900b81c34ae..a718dc77e604e 100644 ---- a/fs/cifs/smb2inode.c -+++ b/fs/cifs/smb2inode.c -@@ -358,6 +358,7 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - if (cfile) - goto after_close; - /* Close */ -+ flags |= CIFS_CP_CREATE_CLOSE_OP; - rqst[num_rqst].rq_iov = &vars->close_iov[0]; - rqst[num_rqst].rq_nvec = 1; - rc = SMB2_close_init(tcon, server, -diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c -index 60d4bd1eae2b3..d9073b569e174 100644 ---- a/fs/cifs/smb2misc.c -+++ b/fs/cifs/smb2misc.c -@@ -844,14 +844,14 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, - } - - int --smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server) -+smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server) - { -- struct smb2_sync_hdr *sync_hdr = (struct smb2_sync_hdr *)buffer; -- struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer; -+ struct smb2_sync_hdr *sync_hdr = mid->resp_buf; -+ struct smb2_create_rsp *rsp = mid->resp_buf; - struct cifs_tcon *tcon; - int rc; - -- if (sync_hdr->Command != SMB2_CREATE || -+ if ((mid->optype & CIFS_CP_CREATE_CLOSE_OP) || sync_hdr->Command != SMB2_CREATE || - sync_hdr->Status != STATUS_SUCCESS) - return 0; - -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index f19274857292b..463e81c35c428 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -1164,7 +1164,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, - struct TCP_Server_Info *server = cifs_pick_channel(ses); - __le16 *utf16_path = NULL; - int ea_name_len = strlen(ea_name); -- int flags = 0; -+ int flags = CIFS_CP_CREATE_CLOSE_OP; - int len; - struct smb_rqst rqst[3]; - int resp_buftype[3]; -@@ -1542,7 +1542,7 @@ smb2_ioctl_query_info(const unsigned int xid, - struct smb_query_info qi; - struct smb_query_info __user *pqi; - int rc = 0; -- int flags = 0; -+ int flags = CIFS_CP_CREATE_CLOSE_OP; - struct smb2_query_info_rsp *qi_rsp = NULL; - struct smb2_ioctl_rsp *io_rsp = NULL; - void *buffer = NULL; -@@ -2516,7 +2516,7 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon, - { - struct cifs_ses *ses = tcon->ses; - struct TCP_Server_Info *server = cifs_pick_channel(ses); -- int flags = 0; -+ int flags = CIFS_CP_CREATE_CLOSE_OP; - struct smb_rqst rqst[3]; - int resp_buftype[3]; - struct kvec rsp_iov[3]; -@@ -2914,7 +2914,7 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, - unsigned int sub_offset; - unsigned int print_len; - unsigned int print_offset; -- int flags = 0; -+ int flags = CIFS_CP_CREATE_CLOSE_OP; - struct smb_rqst rqst[3]; - int resp_buftype[3]; - struct kvec rsp_iov[3]; -@@ -3096,7 +3096,7 @@ smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon, - struct cifs_open_parms oparms; - struct cifs_fid fid; - struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); -- int flags = 0; -+ int flags = CIFS_CP_CREATE_CLOSE_OP; - struct smb_rqst rqst[3]; - int resp_buftype[3]; - struct kvec rsp_iov[3]; -diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h -index 9565e27681a54..a2eb34a8d9c91 100644 ---- a/fs/cifs/smb2proto.h -+++ b/fs/cifs/smb2proto.h -@@ -246,8 +246,7 @@ extern int SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, - extern int smb2_handle_cancelled_close(struct cifs_tcon *tcon, - __u64 persistent_fid, - __u64 volatile_fid); --extern int smb2_handle_cancelled_mid(char *buffer, -- struct TCP_Server_Info *server); -+extern int smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server); - void smb2_cancelled_close_fid(struct work_struct *work); - extern int SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_file_id, u64 volatile_file_id, -diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c -index 4a2b836eb0177..14ecf1a9f11a3 100644 ---- a/fs/cifs/transport.c -+++ b/fs/cifs/transport.c -@@ -101,7 +101,7 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) - if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && - server->ops->handle_cancelled_mid) -- server->ops->handle_cancelled_mid(midEntry->resp_buf, server); -+ server->ops->handle_cancelled_mid(midEntry, server); - - midEntry->mid_state = MID_FREE; - atomic_dec(&midCount); -diff --git a/fs/configfs/file.c b/fs/configfs/file.c -index 1f0270229d7b7..da8351d1e4552 100644 ---- a/fs/configfs/file.c -+++ b/fs/configfs/file.c -@@ -378,7 +378,7 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type - - attr = to_attr(dentry); - if (!attr) -- goto out_put_item; -+ goto out_free_buffer; - - if (type & CONFIGFS_ITEM_BIN_ATTR) { - buffer->bin_attr = to_bin_attr(dentry); -@@ -391,7 +391,7 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type - /* Grab the module reference for this attribute if we have one */ - error = -ENODEV; - if (!try_module_get(buffer->owner)) -- goto out_put_item; -+ goto out_free_buffer; - - error = -EACCES; - if (!buffer->item->ci_type) -@@ -435,8 +435,6 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type - - out_put_module: - module_put(buffer->owner); --out_put_item: -- config_item_put(buffer->item); - out_free_buffer: - up_read(&frag->frag_sem); - kfree(buffer); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 9a6f9875aa349..2ae0af1c88c78 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -4875,7 +4875,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - - set_task_ioprio(sbi->s_journal->j_task, journal_ioprio); - -- sbi->s_journal->j_commit_callback = ext4_journal_commit_callback; - sbi->s_journal->j_submit_inode_data_buffers = - ext4_journal_submit_inode_data_buffers; - sbi->s_journal->j_finish_inode_data_buffers = -@@ -4987,6 +4986,14 @@ no_journal: - goto failed_mount5; - } - -+ /* -+ * We can only set up the journal commit callback once -+ * mballoc is initialized -+ */ -+ if (sbi->s_journal) -+ sbi->s_journal->j_commit_callback = -+ ext4_journal_commit_callback; -+ - block = ext4_count_free_clusters(sb); - ext4_free_blocks_count_set(sbi->s_es, - EXT4_C2B(sbi, block)); -diff --git a/fs/io_uring.c b/fs/io_uring.c -index 241313278e5a5..00ef0b90d1491 100644 ---- a/fs/io_uring.c -+++ b/fs/io_uring.c -@@ -8891,7 +8891,8 @@ static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx, - } - - /* SQPOLL thread does its own polling */ -- if (!(ctx->flags & IORING_SETUP_SQPOLL) && !files) { -+ if ((!(ctx->flags & IORING_SETUP_SQPOLL) && !files) || -+ (ctx->sq_data && ctx->sq_data->thread == current)) { - while (!list_empty_careful(&ctx->iopoll_list)) { - io_iopoll_try_reap_events(ctx); - ret = true; -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index ef827ae193d22..4db3018776f68 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -1401,6 +1401,15 @@ out_force: - goto out; - } - -+static void nfs_mark_dir_for_revalidate(struct inode *inode) -+{ -+ struct nfs_inode *nfsi = NFS_I(inode); -+ -+ spin_lock(&inode->i_lock); -+ nfsi->cache_validity |= NFS_INO_REVAL_PAGECACHE; -+ spin_unlock(&inode->i_lock); -+} -+ - /* - * We judge how long we want to trust negative - * dentries by looking at the parent inode mtime. -@@ -1435,19 +1444,14 @@ nfs_lookup_revalidate_done(struct inode *dir, struct dentry *dentry, - __func__, dentry); - return 1; - case 0: -- nfs_mark_for_revalidate(dir); -- if (inode && S_ISDIR(inode->i_mode)) { -- /* Purge readdir caches. */ -- nfs_zap_caches(inode); -- /* -- * We can't d_drop the root of a disconnected tree: -- * its d_hash is on the s_anon list and d_drop() would hide -- * it from shrink_dcache_for_unmount(), leading to busy -- * inodes on unmount and further oopses. -- */ -- if (IS_ROOT(dentry)) -- return 1; -- } -+ /* -+ * We can't d_drop the root of a disconnected tree: -+ * its d_hash is on the s_anon list and d_drop() would hide -+ * it from shrink_dcache_for_unmount(), leading to busy -+ * inodes on unmount and further oopses. -+ */ -+ if (inode && IS_ROOT(dentry)) -+ return 1; - dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is invalid\n", - __func__, dentry); - return 0; -@@ -1525,6 +1529,13 @@ out: - nfs_free_fattr(fattr); - nfs_free_fhandle(fhandle); - nfs4_label_free(label); -+ -+ /* -+ * If the lookup failed despite the dentry change attribute being -+ * a match, then we should revalidate the directory cache. -+ */ -+ if (!ret && nfs_verify_change_attribute(dir, dentry->d_time)) -+ nfs_mark_dir_for_revalidate(dir); - return nfs_lookup_revalidate_done(dir, dentry, inode, ret); - } - -@@ -1567,7 +1578,7 @@ nfs_do_lookup_revalidate(struct inode *dir, struct dentry *dentry, - error = nfs_lookup_verify_inode(inode, flags); - if (error) { - if (error == -ESTALE) -- nfs_zap_caches(dir); -+ nfs_mark_dir_for_revalidate(dir); - goto out_bad; - } - nfs_advise_use_readdirplus(dir); -@@ -2064,7 +2075,6 @@ out: - dput(parent); - return d; - out_error: -- nfs_mark_for_revalidate(dir); - d = ERR_PTR(error); - goto out; - } -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index fc8bbfd9beb36..7eb44f37558cb 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -5972,7 +5972,7 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf, - return ret; - if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL)) - return -ENOENT; -- return 0; -+ return label.len; - } - - static int nfs4_get_security_label(struct inode *inode, void *buf, -diff --git a/fs/pnode.h b/fs/pnode.h -index 26f74e092bd98..988f1aa9b02ae 100644 ---- a/fs/pnode.h -+++ b/fs/pnode.h -@@ -12,7 +12,7 @@ - - #define IS_MNT_SHARED(m) ((m)->mnt.mnt_flags & MNT_SHARED) - #define IS_MNT_SLAVE(m) ((m)->mnt_master) --#define IS_MNT_NEW(m) (!(m)->mnt_ns) -+#define IS_MNT_NEW(m) (!(m)->mnt_ns || is_anon_ns((m)->mnt_ns)) - #define CLEAR_MNT_SHARED(m) ((m)->mnt.mnt_flags &= ~MNT_SHARED) - #define IS_MNT_UNBINDABLE(m) ((m)->mnt.mnt_flags & MNT_UNBINDABLE) - #define IS_MNT_MARKED(m) ((m)->mnt.mnt_flags & MNT_MARKED) -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index bb89c3e43212b..0dd2f93ac0480 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -544,11 +544,14 @@ static int udf_do_extend_file(struct inode *inode, - - udf_write_aext(inode, last_pos, &last_ext->extLocation, - last_ext->extLength, 1); -+ - /* -- * We've rewritten the last extent but there may be empty -- * indirect extent after it - enter it. -+ * We've rewritten the last extent. If we are going to add -+ * more extents, we may need to enter possible following -+ * empty indirect extent. - */ -- udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0); -+ if (new_block_bytes || prealloc_len) -+ udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0); - } - - /* Managed to do everything necessary? */ -diff --git a/include/linux/acpi.h b/include/linux/acpi.h -index 053bf05fb1f76..b20568c440013 100644 ---- a/include/linux/acpi.h -+++ b/include/linux/acpi.h -@@ -1072,19 +1072,25 @@ void __acpi_handle_debug(struct _ddebug *descriptor, acpi_handle handle, const c - #if defined(CONFIG_ACPI) && defined(CONFIG_GPIOLIB) - bool acpi_gpio_get_irq_resource(struct acpi_resource *ares, - struct acpi_resource_gpio **agpio); --int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index); -+int acpi_dev_gpio_irq_get_by(struct acpi_device *adev, const char *name, int index); - #else - static inline bool acpi_gpio_get_irq_resource(struct acpi_resource *ares, - struct acpi_resource_gpio **agpio) - { - return false; - } --static inline int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index) -+static inline int acpi_dev_gpio_irq_get_by(struct acpi_device *adev, -+ const char *name, int index) - { - return -ENXIO; - } - #endif - -+static inline int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index) -+{ -+ return acpi_dev_gpio_irq_get_by(adev, NULL, index); -+} -+ - /* Device properties */ - - #ifdef CONFIG_ACPI -diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h -index fc61cf4eff1c9..ce7393d397e18 100644 ---- a/include/linux/can/skb.h -+++ b/include/linux/can/skb.h -@@ -49,8 +49,12 @@ static inline void can_skb_reserve(struct sk_buff *skb) - - static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk) - { -- if (sk) { -- sock_hold(sk); -+ /* If the socket has already been closed by user space, the -+ * refcount may already be 0 (and the socket will be freed -+ * after the last TX skb has been freed). So only increase -+ * socket refcount if the refcount is > 0. -+ */ -+ if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) { - skb->destructor = sock_efree; - skb->sk = sk; - } -diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h -index 98cff1b4b088c..189149de77a9d 100644 ---- a/include/linux/compiler-clang.h -+++ b/include/linux/compiler-clang.h -@@ -41,6 +41,12 @@ - #define __no_sanitize_thread - #endif - -+#if defined(CONFIG_ARCH_USE_BUILTIN_BSWAP) -+#define __HAVE_BUILTIN_BSWAP32__ -+#define __HAVE_BUILTIN_BSWAP64__ -+#define __HAVE_BUILTIN_BSWAP16__ -+#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */ -+ - #if __has_feature(undefined_behavior_sanitizer) - /* GCC does not have __SANITIZE_UNDEFINED__ */ - #define __no_sanitize_undefined \ -diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h -index ef49307611d21..c73b25bc92134 100644 ---- a/include/linux/gpio/consumer.h -+++ b/include/linux/gpio/consumer.h -@@ -674,6 +674,8 @@ struct acpi_gpio_mapping { - * get GpioIo type explicitly, this quirk may be used. - */ - #define ACPI_GPIO_QUIRK_ONLY_GPIOIO BIT(1) -+/* Use given pin as an absolute GPIO number in the system */ -+#define ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER BIT(2) - - unsigned int quirks; - }; -diff --git a/include/linux/memblock.h b/include/linux/memblock.h -index b93c44b9121ec..7643d2dfa9594 100644 ---- a/include/linux/memblock.h -+++ b/include/linux/memblock.h -@@ -460,7 +460,7 @@ static inline void memblock_free_late(phys_addr_t base, phys_addr_t size) - /* - * Set the allocation direction to bottom-up or top-down. - */ --static inline void memblock_set_bottom_up(bool enable) -+static inline __init void memblock_set_bottom_up(bool enable) - { - memblock.bottom_up = enable; - } -@@ -470,7 +470,7 @@ static inline void memblock_set_bottom_up(bool enable) - * if this is true, that said, memblock will allocate memory - * in bottom-up direction. - */ --static inline bool memblock_bottom_up(void) -+static inline __init bool memblock_bottom_up(void) - { - return memblock.bottom_up; - } -diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h -index eeb0b52203e92..3e1a43c9f6641 100644 ---- a/include/linux/memcontrol.h -+++ b/include/linux/memcontrol.h -@@ -1072,9 +1072,7 @@ static inline void memcg_memory_event_mm(struct mm_struct *mm, - rcu_read_unlock(); - } - --#ifdef CONFIG_TRANSPARENT_HUGEPAGE --void mem_cgroup_split_huge_fixup(struct page *head); --#endif -+void split_page_memcg(struct page *head, unsigned int nr); - - #else /* CONFIG_MEMCG */ - -@@ -1416,7 +1414,7 @@ unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order, - return 0; - } - --static inline void mem_cgroup_split_huge_fixup(struct page *head) -+static inline void split_page_memcg(struct page *head, unsigned int nr) - { - } - -diff --git a/include/linux/memory.h b/include/linux/memory.h -index 439a89e758d87..4da95e684e20f 100644 ---- a/include/linux/memory.h -+++ b/include/linux/memory.h -@@ -27,9 +27,8 @@ struct memory_block { - unsigned long start_section_nr; - unsigned long state; /* serialized by the dev->lock */ - int online_type; /* for passing data to online routine */ -- int phys_device; /* to which fru does this belong? */ -- struct device dev; - int nid; /* NID for this memory block */ -+ struct device dev; - }; - - int arch_get_memory_phys_device(unsigned long start_pfn); -diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h -index 9a38f579bc764..419a4d77de000 100644 ---- a/include/linux/perf_event.h -+++ b/include/linux/perf_event.h -@@ -606,6 +606,7 @@ struct swevent_hlist { - #define PERF_ATTACH_TASK 0x04 - #define PERF_ATTACH_TASK_DATA 0x08 - #define PERF_ATTACH_ITRACE 0x10 -+#define PERF_ATTACH_SCHED_CB 0x20 - - struct perf_cgroup; - struct perf_buffer; -@@ -872,6 +873,7 @@ struct perf_cpu_context { - struct list_head cgrp_cpuctx_entry; - #endif - -+ struct list_head sched_cb_entry; - int sched_cb_usage; - - int online; -diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h -index 8fcdfa52eb4be..dad92f9e4eac8 100644 ---- a/include/linux/pgtable.h -+++ b/include/linux/pgtable.h -@@ -912,6 +912,10 @@ static inline void ptep_modify_prot_commit(struct vm_area_struct *vma, - #define pgprot_device pgprot_noncached - #endif - -+#ifndef pgprot_mhp -+#define pgprot_mhp(prot) (prot) -+#endif -+ - #ifdef CONFIG_MMU - #ifndef pgprot_modify - #define pgprot_modify pgprot_modify -diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h -index 1ae08b8462a41..90b2a0bce11ca 100644 ---- a/include/linux/sched/mm.h -+++ b/include/linux/sched/mm.h -@@ -140,7 +140,8 @@ static inline bool in_vfork(struct task_struct *tsk) - * another oom-unkillable task does this it should blame itself. - */ - rcu_read_lock(); -- ret = tsk->vfork_done && tsk->real_parent->mm == tsk->mm; -+ ret = tsk->vfork_done && -+ rcu_dereference(tsk->real_parent)->mm == tsk->mm; - rcu_read_unlock(); - - return ret; -diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h -index 2f7bb92b4c9ee..f61e34fbaaea4 100644 ---- a/include/linux/seqlock.h -+++ b/include/linux/seqlock.h -@@ -664,10 +664,7 @@ typedef struct { - * seqcount_latch_init() - runtime initializer for seqcount_latch_t - * @s: Pointer to the seqcount_latch_t instance - */ --static inline void seqcount_latch_init(seqcount_latch_t *s) --{ -- seqcount_init(&s->seqcount); --} -+#define seqcount_latch_init(s) seqcount_init(&(s)->seqcount) - - /** - * raw_read_seqcount_latch() - pick even/odd latch data copy -diff --git a/include/linux/stop_machine.h b/include/linux/stop_machine.h -index 30577c3aecf81..46fb3ebdd16e4 100644 ---- a/include/linux/stop_machine.h -+++ b/include/linux/stop_machine.h -@@ -128,7 +128,7 @@ int stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data, - const struct cpumask *cpus); - #else /* CONFIG_SMP || CONFIG_HOTPLUG_CPU */ - --static inline int stop_machine_cpuslocked(cpu_stop_fn_t fn, void *data, -+static __always_inline int stop_machine_cpuslocked(cpu_stop_fn_t fn, void *data, - const struct cpumask *cpus) - { - unsigned long flags; -@@ -139,14 +139,15 @@ static inline int stop_machine_cpuslocked(cpu_stop_fn_t fn, void *data, - return ret; - } - --static inline int stop_machine(cpu_stop_fn_t fn, void *data, -- const struct cpumask *cpus) -+static __always_inline int -+stop_machine(cpu_stop_fn_t fn, void *data, const struct cpumask *cpus) - { - return stop_machine_cpuslocked(fn, data, cpus); - } - --static inline int stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data, -- const struct cpumask *cpus) -+static __always_inline int -+stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data, -+ const struct cpumask *cpus) - { - return stop_machine(fn, data, cpus); - } -diff --git a/include/linux/textsearch.h b/include/linux/textsearch.h -index 13770cfe33ad8..6673e4d4ac2e1 100644 ---- a/include/linux/textsearch.h -+++ b/include/linux/textsearch.h -@@ -23,7 +23,7 @@ struct ts_config; - struct ts_state - { - unsigned int offset; -- char cb[40]; -+ char cb[48]; - }; - - /** -diff --git a/include/linux/usb.h b/include/linux/usb.h -index 7d72c4e0713c1..d6a41841b93e4 100644 ---- a/include/linux/usb.h -+++ b/include/linux/usb.h -@@ -746,6 +746,8 @@ extern int usb_lock_device_for_reset(struct usb_device *udev, - extern int usb_reset_device(struct usb_device *dev); - extern void usb_queue_reset_device(struct usb_interface *dev); - -+extern struct device *usb_intf_get_dma_device(struct usb_interface *intf); -+ - #ifdef CONFIG_ACPI - extern int usb_acpi_set_power_state(struct usb_device *hdev, int index, - bool enable); -diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h -index e8a924eeea3d0..6b5fcfa1e5553 100644 ---- a/include/linux/virtio_net.h -+++ b/include/linux/virtio_net.h -@@ -79,8 +79,13 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, - if (gso_type && skb->network_header) { - struct flow_keys_basic keys; - -- if (!skb->protocol) -+ if (!skb->protocol) { -+ __be16 protocol = dev_parse_header_protocol(skb); -+ - virtio_net_hdr_set_proto(skb, hdr); -+ if (protocol && protocol != skb->protocol) -+ return -EINVAL; -+ } - retry: - if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys, - NULL, 0, 0, 0, -diff --git a/include/media/rc-map.h b/include/media/rc-map.h -index 999b750bc6b88..30f138ebab6f0 100644 ---- a/include/media/rc-map.h -+++ b/include/media/rc-map.h -@@ -175,6 +175,13 @@ struct rc_map_list { - struct rc_map map; - }; - -+#ifdef CONFIG_MEDIA_CEC_RC -+/* -+ * rc_map_list from rc-cec.c -+ */ -+extern struct rc_map_list cec_map; -+#endif -+ - /* Routines from rc-map.c */ - - /** -diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h -index 6336780d83a75..ce2fba49c95da 100644 ---- a/include/target/target_core_backend.h -+++ b/include/target/target_core_backend.h -@@ -72,6 +72,7 @@ int transport_backend_register(const struct target_backend_ops *); - void target_backend_unregister(const struct target_backend_ops *); - - void target_complete_cmd(struct se_cmd *, u8); -+void target_set_cmd_data_length(struct se_cmd *, int); - void target_complete_cmd_with_length(struct se_cmd *, u8, int); - - void transport_copy_sense_to_cmd(struct se_cmd *, unsigned char *); -diff --git a/include/uapi/linux/l2tp.h b/include/uapi/linux/l2tp.h -index 30c80d5ba4bfc..bab8c97086111 100644 ---- a/include/uapi/linux/l2tp.h -+++ b/include/uapi/linux/l2tp.h -@@ -145,6 +145,7 @@ enum { - L2TP_ATTR_RX_ERRORS, /* u64 */ - L2TP_ATTR_STATS_PAD, - L2TP_ATTR_RX_COOKIE_DISCARDS, /* u64 */ -+ L2TP_ATTR_RX_INVALID, /* u64 */ - __L2TP_ATTR_STATS_MAX, - }; - -diff --git a/include/uapi/linux/netfilter/nfnetlink_cthelper.h b/include/uapi/linux/netfilter/nfnetlink_cthelper.h -index a13137afc4299..70af02092d16e 100644 ---- a/include/uapi/linux/netfilter/nfnetlink_cthelper.h -+++ b/include/uapi/linux/netfilter/nfnetlink_cthelper.h -@@ -5,7 +5,7 @@ - #define NFCT_HELPER_STATUS_DISABLED 0 - #define NFCT_HELPER_STATUS_ENABLED 1 - --enum nfnl_acct_msg_types { -+enum nfnl_cthelper_msg_types { - NFNL_MSG_CTHELPER_NEW, - NFNL_MSG_CTHELPER_GET, - NFNL_MSG_CTHELPER_DEL, -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 55d18791a72de..8425dbc1d239e 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -385,6 +385,7 @@ static DEFINE_MUTEX(perf_sched_mutex); - static atomic_t perf_sched_count; - - static DEFINE_PER_CPU(atomic_t, perf_cgroup_events); -+static DEFINE_PER_CPU(int, perf_sched_cb_usages); - static DEFINE_PER_CPU(struct pmu_event_list, pmu_sb_events); - - static atomic_t nr_mmap_events __read_mostly; -@@ -3474,11 +3475,16 @@ unlock: - } - } - -+static DEFINE_PER_CPU(struct list_head, sched_cb_list); -+ - void perf_sched_cb_dec(struct pmu *pmu) - { - struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context); - -- --cpuctx->sched_cb_usage; -+ this_cpu_dec(perf_sched_cb_usages); -+ -+ if (!--cpuctx->sched_cb_usage) -+ list_del(&cpuctx->sched_cb_entry); - } - - -@@ -3486,7 +3492,10 @@ void perf_sched_cb_inc(struct pmu *pmu) - { - struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context); - -- cpuctx->sched_cb_usage++; -+ if (!cpuctx->sched_cb_usage++) -+ list_add(&cpuctx->sched_cb_entry, this_cpu_ptr(&sched_cb_list)); -+ -+ this_cpu_inc(perf_sched_cb_usages); - } - - /* -@@ -3515,6 +3524,24 @@ static void __perf_pmu_sched_task(struct perf_cpu_context *cpuctx, bool sched_in - perf_ctx_unlock(cpuctx, cpuctx->task_ctx); - } - -+static void perf_pmu_sched_task(struct task_struct *prev, -+ struct task_struct *next, -+ bool sched_in) -+{ -+ struct perf_cpu_context *cpuctx; -+ -+ if (prev == next) -+ return; -+ -+ list_for_each_entry(cpuctx, this_cpu_ptr(&sched_cb_list), sched_cb_entry) { -+ /* will be handled in perf_event_context_sched_in/out */ -+ if (cpuctx->task_ctx) -+ continue; -+ -+ __perf_pmu_sched_task(cpuctx, sched_in); -+ } -+} -+ - static void perf_event_switch(struct task_struct *task, - struct task_struct *next_prev, bool sched_in); - -@@ -3537,6 +3564,9 @@ void __perf_event_task_sched_out(struct task_struct *task, - { - int ctxn; - -+ if (__this_cpu_read(perf_sched_cb_usages)) -+ perf_pmu_sched_task(task, next, false); -+ - if (atomic_read(&nr_switch_events)) - perf_event_switch(task, next, false); - -@@ -3845,6 +3875,9 @@ void __perf_event_task_sched_in(struct task_struct *prev, - - if (atomic_read(&nr_switch_events)) - perf_event_switch(task, prev, true); -+ -+ if (__this_cpu_read(perf_sched_cb_usages)) -+ perf_pmu_sched_task(prev, task, true); - } - - static u64 perf_calculate_period(struct perf_event *event, u64 nsec, u64 count) -@@ -4669,7 +4702,7 @@ static void unaccount_event(struct perf_event *event) - if (event->parent) - return; - -- if (event->attach_state & PERF_ATTACH_TASK) -+ if (event->attach_state & (PERF_ATTACH_TASK | PERF_ATTACH_SCHED_CB)) - dec = true; - if (event->attr.mmap || event->attr.mmap_data) - atomic_dec(&nr_mmap_events); -@@ -11168,7 +11201,7 @@ static void account_event(struct perf_event *event) - if (event->parent) - return; - -- if (event->attach_state & PERF_ATTACH_TASK) -+ if (event->attach_state & (PERF_ATTACH_TASK | PERF_ATTACH_SCHED_CB)) - inc = true; - if (event->attr.mmap || event->attr.mmap_data) - atomic_inc(&nr_mmap_events); -@@ -12960,6 +12993,7 @@ static void __init perf_event_init_all_cpus(void) - #ifdef CONFIG_CGROUP_PERF - INIT_LIST_HEAD(&per_cpu(cgrp_cpuctx_list, cpu)); - #endif -+ INIT_LIST_HEAD(&per_cpu(sched_cb_list, cpu)); - } - } - -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index fa1f83083a58b..f0056507a373d 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -1862,8 +1862,13 @@ struct migration_arg { - struct set_affinity_pending *pending; - }; - -+/* -+ * @refs: number of wait_for_completion() -+ * @stop_pending: is @stop_work in use -+ */ - struct set_affinity_pending { - refcount_t refs; -+ unsigned int stop_pending; - struct completion done; - struct cpu_stop_work stop_work; - struct migration_arg arg; -@@ -1898,8 +1903,8 @@ static struct rq *__migrate_task(struct rq *rq, struct rq_flags *rf, - */ - static int migration_cpu_stop(void *data) - { -- struct set_affinity_pending *pending; - struct migration_arg *arg = data; -+ struct set_affinity_pending *pending = arg->pending; - struct task_struct *p = arg->task; - int dest_cpu = arg->dest_cpu; - struct rq *rq = this_rq(); -@@ -1921,7 +1926,6 @@ static int migration_cpu_stop(void *data) - raw_spin_lock(&p->pi_lock); - rq_lock(rq, &rf); - -- pending = p->migration_pending; - /* - * If task_rq(p) != rq, it cannot be migrated here, because we're - * holding rq->lock, if p->on_rq == 0 it cannot get enqueued because -@@ -1932,21 +1936,14 @@ static int migration_cpu_stop(void *data) - goto out; - - if (pending) { -- p->migration_pending = NULL; -+ if (p->migration_pending == pending) -+ p->migration_pending = NULL; - complete = true; - } - -- /* migrate_enable() -- we must not race against SCA */ - if (dest_cpu < 0) { -- /* -- * When this was migrate_enable() but we no longer -- * have a @pending, a concurrent SCA 'fixed' things -- * and we should be valid again. Nothing to do. -- */ -- if (!pending) { -- WARN_ON_ONCE(!cpumask_test_cpu(task_cpu(p), &p->cpus_mask)); -+ if (cpumask_test_cpu(task_cpu(p), &p->cpus_mask)) - goto out; -- } - - dest_cpu = cpumask_any_distribute(&p->cpus_mask); - } -@@ -1956,7 +1953,14 @@ static int migration_cpu_stop(void *data) - else - p->wake_cpu = dest_cpu; - -- } else if (dest_cpu < 0 || pending) { -+ /* -+ * XXX __migrate_task() can fail, at which point we might end -+ * up running on a dodgy CPU, AFAICT this can only happen -+ * during CPU hotplug, at which point we'll get pushed out -+ * anyway, so it's probably not a big deal. -+ */ -+ -+ } else if (pending) { - /* - * This happens when we get migrated between migrate_enable()'s - * preempt_enable() and scheduling the stopper task. At that -@@ -1971,43 +1975,32 @@ static int migration_cpu_stop(void *data) - * ->pi_lock, so the allowed mask is stable - if it got - * somewhere allowed, we're done. - */ -- if (pending && cpumask_test_cpu(task_cpu(p), p->cpus_ptr)) { -- p->migration_pending = NULL; -+ if (cpumask_test_cpu(task_cpu(p), p->cpus_ptr)) { -+ if (p->migration_pending == pending) -+ p->migration_pending = NULL; - complete = true; - goto out; - } - -- /* -- * When this was migrate_enable() but we no longer have an -- * @pending, a concurrent SCA 'fixed' things and we should be -- * valid again. Nothing to do. -- */ -- if (!pending) { -- WARN_ON_ONCE(!cpumask_test_cpu(task_cpu(p), &p->cpus_mask)); -- goto out; -- } -- - /* - * When migrate_enable() hits a rq mis-match we can't reliably - * determine is_migration_disabled() and so have to chase after - * it. - */ -+ WARN_ON_ONCE(!pending->stop_pending); - task_rq_unlock(rq, p, &rf); - stop_one_cpu_nowait(task_cpu(p), migration_cpu_stop, - &pending->arg, &pending->stop_work); - return 0; - } - out: -+ if (pending) -+ pending->stop_pending = false; - task_rq_unlock(rq, p, &rf); - - if (complete) - complete_all(&pending->done); - -- /* For pending->{arg,stop_work} */ -- pending = arg->pending; -- if (pending && refcount_dec_and_test(&pending->refs)) -- wake_up_var(&pending->refs); -- - return 0; - } - -@@ -2194,11 +2187,7 @@ static int affine_move_task(struct rq *rq, struct task_struct *p, struct rq_flag - int dest_cpu, unsigned int flags) - { - struct set_affinity_pending my_pending = { }, *pending = NULL; -- struct migration_arg arg = { -- .task = p, -- .dest_cpu = dest_cpu, -- }; -- bool complete = false; -+ bool stop_pending, complete = false; - - /* Can the task run on the task's current CPU? If so, we're done */ - if (cpumask_test_cpu(task_cpu(p), &p->cpus_mask)) { -@@ -2210,12 +2199,16 @@ static int affine_move_task(struct rq *rq, struct task_struct *p, struct rq_flag - push_task = get_task_struct(p); - } - -+ /* -+ * If there are pending waiters, but no pending stop_work, -+ * then complete now. -+ */ - pending = p->migration_pending; -- if (pending) { -- refcount_inc(&pending->refs); -+ if (pending && !pending->stop_pending) { - p->migration_pending = NULL; - complete = true; - } -+ - task_rq_unlock(rq, p, rf); - - if (push_task) { -@@ -2224,7 +2217,7 @@ static int affine_move_task(struct rq *rq, struct task_struct *p, struct rq_flag - } - - if (complete) -- goto do_complete; -+ complete_all(&pending->done); - - return 0; - } -@@ -2235,6 +2228,12 @@ static int affine_move_task(struct rq *rq, struct task_struct *p, struct rq_flag - /* Install the request */ - refcount_set(&my_pending.refs, 1); - init_completion(&my_pending.done); -+ my_pending.arg = (struct migration_arg) { -+ .task = p, -+ .dest_cpu = -1, /* any */ -+ .pending = &my_pending, -+ }; -+ - p->migration_pending = &my_pending; - } else { - pending = p->migration_pending; -@@ -2259,45 +2258,41 @@ static int affine_move_task(struct rq *rq, struct task_struct *p, struct rq_flag - return -EINVAL; - } - -- if (flags & SCA_MIGRATE_ENABLE) { -- -- refcount_inc(&pending->refs); /* pending->{arg,stop_work} */ -- p->migration_flags &= ~MDF_PUSH; -- task_rq_unlock(rq, p, rf); -- -- pending->arg = (struct migration_arg) { -- .task = p, -- .dest_cpu = -1, -- .pending = pending, -- }; -- -- stop_one_cpu_nowait(cpu_of(rq), migration_cpu_stop, -- &pending->arg, &pending->stop_work); -- -- return 0; -- } -- - if (task_running(rq, p) || p->state == TASK_WAKING) { - /* -- * Lessen races (and headaches) by delegating -- * is_migration_disabled(p) checks to the stopper, which will -- * run on the same CPU as said p. -+ * MIGRATE_ENABLE gets here because 'p == current', but for -+ * anything else we cannot do is_migration_disabled(), punt -+ * and have the stopper function handle it all race-free. - */ -+ stop_pending = pending->stop_pending; -+ if (!stop_pending) -+ pending->stop_pending = true; -+ -+ if (flags & SCA_MIGRATE_ENABLE) -+ p->migration_flags &= ~MDF_PUSH; -+ - task_rq_unlock(rq, p, rf); -- stop_one_cpu(cpu_of(rq), migration_cpu_stop, &arg); - -+ if (!stop_pending) { -+ stop_one_cpu_nowait(cpu_of(rq), migration_cpu_stop, -+ &pending->arg, &pending->stop_work); -+ } -+ -+ if (flags & SCA_MIGRATE_ENABLE) -+ return 0; - } else { - - if (!is_migration_disabled(p)) { - if (task_on_rq_queued(p)) - rq = move_queued_task(rq, rf, p, dest_cpu); - -- p->migration_pending = NULL; -- complete = true; -+ if (!pending->stop_pending) { -+ p->migration_pending = NULL; -+ complete = true; -+ } - } - task_rq_unlock(rq, p, rf); - --do_complete: - if (complete) - complete_all(&pending->done); - } -@@ -2305,7 +2300,7 @@ do_complete: - wait_for_completion(&pending->done); - - if (refcount_dec_and_test(&pending->refs)) -- wake_up_var(&pending->refs); -+ wake_up_var(&pending->refs); /* No UaF, just an address */ - - /* - * Block the original owner of &pending until all subsequent callers -@@ -2313,6 +2308,9 @@ do_complete: - */ - wait_var_event(&my_pending.refs, !refcount_read(&my_pending.refs)); - -+ /* ARGH */ -+ WARN_ON_ONCE(my_pending.stop_pending); -+ - return 0; - } - -diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c -index 08ae45ad9261d..f311bf85d2116 100644 ---- a/kernel/sched/membarrier.c -+++ b/kernel/sched/membarrier.c -@@ -471,9 +471,7 @@ static int sync_runqueues_membarrier_state(struct mm_struct *mm) - } - rcu_read_unlock(); - -- preempt_disable(); -- smp_call_function_many(tmpmask, ipi_sync_rq_state, mm, 1); -- preempt_enable(); -+ on_each_cpu_mask(tmpmask, ipi_sync_rq_state, mm, true); - - free_cpumask_var(tmpmask); - cpus_read_unlock(); -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index c9fbdd848138c..62fbd09b5dc1c 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -2962,7 +2962,7 @@ static struct ctl_table vm_table[] = { - .data = &block_dump, - .maxlen = sizeof(block_dump), - .mode = 0644, -- .proc_handler = proc_dointvec, -+ .proc_handler = proc_dointvec_minmax, - .extra1 = SYSCTL_ZERO, - }, - { -@@ -2970,7 +2970,7 @@ static struct ctl_table vm_table[] = { - .data = &sysctl_vfs_cache_pressure, - .maxlen = sizeof(sysctl_vfs_cache_pressure), - .mode = 0644, -- .proc_handler = proc_dointvec, -+ .proc_handler = proc_dointvec_minmax, - .extra1 = SYSCTL_ZERO, - }, - #if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \ -@@ -2980,7 +2980,7 @@ static struct ctl_table vm_table[] = { - .data = &sysctl_legacy_va_layout, - .maxlen = sizeof(sysctl_legacy_va_layout), - .mode = 0644, -- .proc_handler = proc_dointvec, -+ .proc_handler = proc_dointvec_minmax, - .extra1 = SYSCTL_ZERO, - }, - #endif -@@ -2990,7 +2990,7 @@ static struct ctl_table vm_table[] = { - .data = &node_reclaim_mode, - .maxlen = sizeof(node_reclaim_mode), - .mode = 0644, -- .proc_handler = proc_dointvec, -+ .proc_handler = proc_dointvec_minmax, - .extra1 = SYSCTL_ZERO, - }, - { -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index 743c852e10f23..788b9d137de4c 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -546,8 +546,11 @@ static ktime_t __hrtimer_next_event_base(struct hrtimer_cpu_base *cpu_base, - } - - /* -- * Recomputes cpu_base::*next_timer and returns the earliest expires_next but -- * does not set cpu_base::*expires_next, that is done by hrtimer_reprogram. -+ * Recomputes cpu_base::*next_timer and returns the earliest expires_next -+ * but does not set cpu_base::*expires_next, that is done by -+ * hrtimer[_force]_reprogram and hrtimer_interrupt only. When updating -+ * cpu_base::*expires_next right away, reprogramming logic would no longer -+ * work. - * - * When a softirq is pending, we can ignore the HRTIMER_ACTIVE_SOFT bases, - * those timers will get run whenever the softirq gets handled, at the end of -@@ -588,6 +591,37 @@ __hrtimer_get_next_event(struct hrtimer_cpu_base *cpu_base, unsigned int active_ - return expires_next; - } - -+static ktime_t hrtimer_update_next_event(struct hrtimer_cpu_base *cpu_base) -+{ -+ ktime_t expires_next, soft = KTIME_MAX; -+ -+ /* -+ * If the soft interrupt has already been activated, ignore the -+ * soft bases. They will be handled in the already raised soft -+ * interrupt. -+ */ -+ if (!cpu_base->softirq_activated) { -+ soft = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_SOFT); -+ /* -+ * Update the soft expiry time. clock_settime() might have -+ * affected it. -+ */ -+ cpu_base->softirq_expires_next = soft; -+ } -+ -+ expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_HARD); -+ /* -+ * If a softirq timer is expiring first, update cpu_base->next_timer -+ * and program the hardware with the soft expiry time. -+ */ -+ if (expires_next > soft) { -+ cpu_base->next_timer = cpu_base->softirq_next_timer; -+ expires_next = soft; -+ } -+ -+ return expires_next; -+} -+ - static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base) - { - ktime_t *offs_real = &base->clock_base[HRTIMER_BASE_REALTIME].offset; -@@ -628,23 +662,7 @@ hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal) - { - ktime_t expires_next; - -- /* -- * Find the current next expiration time. -- */ -- expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_ALL); -- -- if (cpu_base->next_timer && cpu_base->next_timer->is_soft) { -- /* -- * When the softirq is activated, hrtimer has to be -- * programmed with the first hard hrtimer because soft -- * timer interrupt could occur too late. -- */ -- if (cpu_base->softirq_activated) -- expires_next = __hrtimer_get_next_event(cpu_base, -- HRTIMER_ACTIVE_HARD); -- else -- cpu_base->softirq_expires_next = expires_next; -- } -+ expires_next = hrtimer_update_next_event(cpu_base); - - if (skip_equal && expires_next == cpu_base->expires_next) - return; -@@ -1644,8 +1662,8 @@ retry: - - __hrtimer_run_queues(cpu_base, now, flags, HRTIMER_ACTIVE_HARD); - -- /* Reevaluate the clock bases for the next expiry */ -- expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_ALL); -+ /* Reevaluate the clock bases for the [soft] next expiry */ -+ expires_next = hrtimer_update_next_event(cpu_base); - /* - * Store the new expiry value so the migration code can verify - * against it. -diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan -index f5fa4ba126bf6..0d3b7940cf430 100644 ---- a/lib/Kconfig.kasan -+++ b/lib/Kconfig.kasan -@@ -156,6 +156,7 @@ config KASAN_STACK_ENABLE - - config KASAN_STACK - int -+ depends on KASAN_GENERIC || KASAN_SW_TAGS - default 1 if KASAN_STACK_ENABLE || CC_IS_GCC - default 0 - -diff --git a/lib/logic_pio.c b/lib/logic_pio.c -index f32fe481b4922..07b4b9a1f54b6 100644 ---- a/lib/logic_pio.c -+++ b/lib/logic_pio.c -@@ -28,6 +28,8 @@ static DEFINE_MUTEX(io_range_mutex); - * @new_range: pointer to the IO range to be registered. - * - * Returns 0 on success, the error code in case of failure. -+ * If the range already exists, -EEXIST will be returned, which should be -+ * considered a success. - * - * Register a new IO range node in the IO range list. - */ -@@ -51,6 +53,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range) - list_for_each_entry(range, &io_range_list, list) { - if (range->fwnode == new_range->fwnode) { - /* range already there */ -+ ret = -EEXIST; - goto end_register; - } - if (range->flags == LOGIC_PIO_CPU_MMIO && -diff --git a/lib/test_kasan.c b/lib/test_kasan.c -index 2947274cc2d30..5a2f104ca13f8 100644 ---- a/lib/test_kasan.c -+++ b/lib/test_kasan.c -@@ -737,13 +737,13 @@ static void kasan_bitops_tags(struct kunit *test) - return; - } - -- /* Allocation size will be rounded to up granule size, which is 16. */ -- bits = kzalloc(sizeof(*bits), GFP_KERNEL); -+ /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */ -+ bits = kzalloc(48, GFP_KERNEL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); - -- /* Do the accesses past the 16 allocated bytes. */ -- kasan_bitops_modify(test, BITS_PER_LONG, &bits[1]); -- kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, &bits[1]); -+ /* Do the accesses past the 48 allocated bytes, but within the redone. */ -+ kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48); -+ kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48); - - kfree(bits); - } -diff --git a/mm/highmem.c b/mm/highmem.c -index 874b732b120ce..86f2b9495f9cf 100644 ---- a/mm/highmem.c -+++ b/mm/highmem.c -@@ -368,20 +368,24 @@ void zero_user_segments(struct page *page, unsigned start1, unsigned end1, - - BUG_ON(end1 > page_size(page) || end2 > page_size(page)); - -+ if (start1 >= end1) -+ start1 = end1 = 0; -+ if (start2 >= end2) -+ start2 = end2 = 0; -+ - for (i = 0; i < compound_nr(page); i++) { - void *kaddr = NULL; - -- if (start1 < PAGE_SIZE || start2 < PAGE_SIZE) -- kaddr = kmap_atomic(page + i); -- - if (start1 >= PAGE_SIZE) { - start1 -= PAGE_SIZE; - end1 -= PAGE_SIZE; - } else { - unsigned this_end = min_t(unsigned, end1, PAGE_SIZE); - -- if (end1 > start1) -+ if (end1 > start1) { -+ kaddr = kmap_atomic(page + i); - memset(kaddr + start1, 0, this_end - start1); -+ } - end1 -= this_end; - start1 = 0; - } -@@ -392,8 +396,11 @@ void zero_user_segments(struct page *page, unsigned start1, unsigned end1, - } else { - unsigned this_end = min_t(unsigned, end2, PAGE_SIZE); - -- if (end2 > start2) -+ if (end2 > start2) { -+ if (!kaddr) -+ kaddr = kmap_atomic(page + i); - memset(kaddr + start2, 0, this_end - start2); -+ } - end2 -= this_end; - start2 = 0; - } -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 91ca9b103ee52..f3affe860e2be 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -2465,7 +2465,7 @@ static void __split_huge_page(struct page *page, struct list_head *list, - int i; - - /* complete memcg works before add pages to LRU */ -- mem_cgroup_split_huge_fixup(head); -+ split_page_memcg(head, nr); - - if (PageAnon(head) && PageSwapCache(head)) { - swp_entry_t entry = { .val = page_private(head) }; -diff --git a/mm/madvise.c b/mm/madvise.c -index 6a660858784b8..a9bcd16b5d956 100644 ---- a/mm/madvise.c -+++ b/mm/madvise.c -@@ -1197,12 +1197,22 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec, - goto release_task; - } - -- mm = mm_access(task, PTRACE_MODE_ATTACH_FSCREDS); -+ /* Require PTRACE_MODE_READ to avoid leaking ASLR metadata. */ -+ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - if (IS_ERR_OR_NULL(mm)) { - ret = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; - goto release_task; - } - -+ /* -+ * Require CAP_SYS_NICE for influencing process performance. Note that -+ * only non-destructive hints are currently supported. -+ */ -+ if (!capable(CAP_SYS_NICE)) { -+ ret = -EPERM; -+ goto release_mm; -+ } -+ - total_len = iov_iter_count(&iter); - - while (iov_iter_count(&iter)) { -@@ -1217,6 +1227,7 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec, - if (ret == 0) - ret = total_len - iov_iter_count(&iter); - -+release_mm: - mmput(mm); - release_task: - put_task_struct(task); -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index d76a1f9c0e552..aa9b9536649ab 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -3296,24 +3296,21 @@ void obj_cgroup_uncharge(struct obj_cgroup *objcg, size_t size) - - #endif /* CONFIG_MEMCG_KMEM */ - --#ifdef CONFIG_TRANSPARENT_HUGEPAGE - /* -- * Because page_memcg(head) is not set on compound tails, set it now. -+ * Because page_memcg(head) is not set on tails, set it now. - */ --void mem_cgroup_split_huge_fixup(struct page *head) -+void split_page_memcg(struct page *head, unsigned int nr) - { - struct mem_cgroup *memcg = page_memcg(head); - int i; - -- if (mem_cgroup_disabled()) -+ if (mem_cgroup_disabled() || !memcg) - return; - -- for (i = 1; i < HPAGE_PMD_NR; i++) { -- css_get(&memcg->css); -- head[i].memcg_data = (unsigned long)memcg; -- } -+ for (i = 1; i < nr; i++) -+ head[i].memcg_data = head->memcg_data; -+ css_get_many(&memcg->css, nr - 1); - } --#endif /* CONFIG_TRANSPARENT_HUGEPAGE */ - - #ifdef CONFIG_MEMCG_SWAP - /** -diff --git a/mm/memory.c b/mm/memory.c -index c05d4c4c03d6d..97e1d045f236f 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -3092,6 +3092,14 @@ static vm_fault_t do_wp_page(struct vm_fault *vmf) - return handle_userfault(vmf, VM_UFFD_WP); - } - -+ /* -+ * Userfaultfd write-protect can defer flushes. Ensure the TLB -+ * is flushed in this case before copying. -+ */ -+ if (unlikely(userfaultfd_wp(vmf->vma) && -+ mm_tlb_flush_pending(vmf->vma->vm_mm))) -+ flush_tlb_page(vmf->vma, vmf->address); -+ - vmf->page = vm_normal_page(vma, vmf->address, vmf->orig_pte); - if (!vmf->page) { - /* -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index f9d57b9be8c71..fc16732d07f7f 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1019,7 +1019,7 @@ static int online_memory_block(struct memory_block *mem, void *arg) - */ - int __ref add_memory_resource(int nid, struct resource *res, mhp_t mhp_flags) - { -- struct mhp_params params = { .pgprot = PAGE_KERNEL }; -+ struct mhp_params params = { .pgprot = pgprot_mhp(PAGE_KERNEL) }; - u64 start, size; - bool new_node = false; - int ret; -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 519a60d5b6f7d..a723e81a5da2f 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -1281,6 +1281,12 @@ static __always_inline bool free_pages_prepare(struct page *page, - - kernel_poison_pages(page, 1 << order); - -+ /* -+ * With hardware tag-based KASAN, memory tags must be set before the -+ * page becomes unavailable via debug_pagealloc or arch_free_page. -+ */ -+ kasan_free_nondeferred_pages(page, order); -+ - /* - * arch_free_page() can make the page's contents inaccessible. s390 - * does this. So nothing which can access the page's contents should -@@ -1290,8 +1296,6 @@ static __always_inline bool free_pages_prepare(struct page *page, - - debug_pagealloc_unmap_pages(page, 1 << order); - -- kasan_free_nondeferred_pages(page, order); -- - return true; - } - -@@ -3309,6 +3313,7 @@ void split_page(struct page *page, unsigned int order) - for (i = 1; i < (1 << order); i++) - set_page_refcounted(page + i); - split_page_owner(page, 1 << order); -+ split_page_memcg(page, 1 << order); - } - EXPORT_SYMBOL_GPL(split_page); - -@@ -6257,13 +6262,66 @@ static void __meminit zone_init_free_lists(struct zone *zone) - } - } - -+#if !defined(CONFIG_FLAT_NODE_MEM_MAP) -+/* -+ * Only struct pages that correspond to ranges defined by memblock.memory -+ * are zeroed and initialized by going through __init_single_page() during -+ * memmap_init_zone(). -+ * -+ * But, there could be struct pages that correspond to holes in -+ * memblock.memory. This can happen because of the following reasons: -+ * - physical memory bank size is not necessarily the exact multiple of the -+ * arbitrary section size -+ * - early reserved memory may not be listed in memblock.memory -+ * - memory layouts defined with memmap= kernel parameter may not align -+ * nicely with memmap sections -+ * -+ * Explicitly initialize those struct pages so that: -+ * - PG_Reserved is set -+ * - zone and node links point to zone and node that span the page if the -+ * hole is in the middle of a zone -+ * - zone and node links point to adjacent zone/node if the hole falls on -+ * the zone boundary; the pages in such holes will be prepended to the -+ * zone/node above the hole except for the trailing pages in the last -+ * section that will be appended to the zone/node below. -+ */ -+static u64 __meminit init_unavailable_range(unsigned long spfn, -+ unsigned long epfn, -+ int zone, int node) -+{ -+ unsigned long pfn; -+ u64 pgcnt = 0; -+ -+ for (pfn = spfn; pfn < epfn; pfn++) { -+ if (!pfn_valid(ALIGN_DOWN(pfn, pageblock_nr_pages))) { -+ pfn = ALIGN_DOWN(pfn, pageblock_nr_pages) -+ + pageblock_nr_pages - 1; -+ continue; -+ } -+ __init_single_page(pfn_to_page(pfn), pfn, zone, node); -+ __SetPageReserved(pfn_to_page(pfn)); -+ pgcnt++; -+ } -+ -+ return pgcnt; -+} -+#else -+static inline u64 init_unavailable_range(unsigned long spfn, unsigned long epfn, -+ int zone, int node) -+{ -+ return 0; -+} -+#endif -+ - void __meminit __weak memmap_init(unsigned long size, int nid, - unsigned long zone, - unsigned long range_start_pfn) - { -+ static unsigned long hole_pfn; - unsigned long start_pfn, end_pfn; - unsigned long range_end_pfn = range_start_pfn + size; - int i; -+ u64 pgcnt = 0; - - for_each_mem_pfn_range(i, nid, &start_pfn, &end_pfn, NULL) { - start_pfn = clamp(start_pfn, range_start_pfn, range_end_pfn); -@@ -6274,7 +6332,29 @@ void __meminit __weak memmap_init(unsigned long size, int nid, - memmap_init_zone(size, nid, zone, start_pfn, range_end_pfn, - MEMINIT_EARLY, NULL, MIGRATE_MOVABLE); - } -+ -+ if (hole_pfn < start_pfn) -+ pgcnt += init_unavailable_range(hole_pfn, start_pfn, -+ zone, nid); -+ hole_pfn = end_pfn; - } -+ -+#ifdef CONFIG_SPARSEMEM -+ /* -+ * Initialize the hole in the range [zone_end_pfn, section_end]. -+ * If zone boundary falls in the middle of a section, this hole -+ * will be re-initialized during the call to this function for the -+ * higher zone. -+ */ -+ end_pfn = round_up(range_end_pfn, PAGES_PER_SECTION); -+ if (hole_pfn < end_pfn) -+ pgcnt += init_unavailable_range(hole_pfn, end_pfn, -+ zone, nid); -+#endif -+ -+ if (pgcnt) -+ pr_info(" %s zone: %llu pages in unavailable ranges\n", -+ zone_names[zone], pgcnt); - } - - static int zone_batchsize(struct zone *zone) -@@ -7075,88 +7155,6 @@ void __init free_area_init_memoryless_node(int nid) - free_area_init_node(nid); - } - --#if !defined(CONFIG_FLAT_NODE_MEM_MAP) --/* -- * Initialize all valid struct pages in the range [spfn, epfn) and mark them -- * PageReserved(). Return the number of struct pages that were initialized. -- */ --static u64 __init init_unavailable_range(unsigned long spfn, unsigned long epfn) --{ -- unsigned long pfn; -- u64 pgcnt = 0; -- -- for (pfn = spfn; pfn < epfn; pfn++) { -- if (!pfn_valid(ALIGN_DOWN(pfn, pageblock_nr_pages))) { -- pfn = ALIGN_DOWN(pfn, pageblock_nr_pages) -- + pageblock_nr_pages - 1; -- continue; -- } -- /* -- * Use a fake node/zone (0) for now. Some of these pages -- * (in memblock.reserved but not in memblock.memory) will -- * get re-initialized via reserve_bootmem_region() later. -- */ -- __init_single_page(pfn_to_page(pfn), pfn, 0, 0); -- __SetPageReserved(pfn_to_page(pfn)); -- pgcnt++; -- } -- -- return pgcnt; --} -- --/* -- * Only struct pages that are backed by physical memory are zeroed and -- * initialized by going through __init_single_page(). But, there are some -- * struct pages which are reserved in memblock allocator and their fields -- * may be accessed (for example page_to_pfn() on some configuration accesses -- * flags). We must explicitly initialize those struct pages. -- * -- * This function also addresses a similar issue where struct pages are left -- * uninitialized because the physical address range is not covered by -- * memblock.memory or memblock.reserved. That could happen when memblock -- * layout is manually configured via memmap=, or when the highest physical -- * address (max_pfn) does not end on a section boundary. -- */ --static void __init init_unavailable_mem(void) --{ -- phys_addr_t start, end; -- u64 i, pgcnt; -- phys_addr_t next = 0; -- -- /* -- * Loop through unavailable ranges not covered by memblock.memory. -- */ -- pgcnt = 0; -- for_each_mem_range(i, &start, &end) { -- if (next < start) -- pgcnt += init_unavailable_range(PFN_DOWN(next), -- PFN_UP(start)); -- next = end; -- } -- -- /* -- * Early sections always have a fully populated memmap for the whole -- * section - see pfn_valid(). If the last section has holes at the -- * end and that section is marked "online", the memmap will be -- * considered initialized. Make sure that memmap has a well defined -- * state. -- */ -- pgcnt += init_unavailable_range(PFN_DOWN(next), -- round_up(max_pfn, PAGES_PER_SECTION)); -- -- /* -- * Struct pages that do not have backing memory. This could be because -- * firmware is using some of this memory, or for some other reasons. -- */ -- if (pgcnt) -- pr_info("Zeroed struct page in unavailable ranges: %lld pages", pgcnt); --} --#else --static inline void __init init_unavailable_mem(void) --{ --} --#endif /* !CONFIG_FLAT_NODE_MEM_MAP */ -- - #if MAX_NUMNODES > 1 - /* - * Figure out the number of possible node ids. -@@ -7580,7 +7578,6 @@ void __init free_area_init(unsigned long *max_zone_pfn) - /* Initialise every node */ - mminit_verify_pageflags_layout(); - setup_nr_node_ids(); -- init_unavailable_mem(); - for_each_online_node(nid) { - pg_data_t *pgdat = NODE_DATA(nid); - free_area_init_node(nid); -diff --git a/mm/slub.c b/mm/slub.c -index 69dacc61b8435..c86037b382531 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -1973,7 +1973,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n, - - t = acquire_slab(s, n, page, object == NULL, &objects); - if (!t) -- continue; /* cmpxchg raced */ -+ break; - - available += objects; - if (!object) { -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 28b8242f18d79..2b784d62a9fe7 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -3622,6 +3622,8 @@ unsigned int skb_find_text(struct sk_buff *skb, unsigned int from, - struct ts_state state; - unsigned int ret; - -+ BUILD_BUG_ON(sizeof(struct skb_seq_state) > sizeof(state.cb)); -+ - config->get_next_block = skb_ts_get_next_block; - config->finish = skb_ts_finish; - -diff --git a/net/dsa/tag_mtk.c b/net/dsa/tag_mtk.c -index 38dcdded74c05..59748487664fe 100644 ---- a/net/dsa/tag_mtk.c -+++ b/net/dsa/tag_mtk.c -@@ -13,6 +13,7 @@ - #define MTK_HDR_LEN 4 - #define MTK_HDR_XMIT_UNTAGGED 0 - #define MTK_HDR_XMIT_TAGGED_TPID_8100 1 -+#define MTK_HDR_XMIT_TAGGED_TPID_88A8 2 - #define MTK_HDR_RECV_SOURCE_PORT_MASK GENMASK(2, 0) - #define MTK_HDR_XMIT_DP_BIT_MASK GENMASK(5, 0) - #define MTK_HDR_XMIT_SA_DIS BIT(6) -@@ -21,8 +22,8 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb, - struct net_device *dev) - { - struct dsa_port *dp = dsa_slave_to_port(dev); -+ u8 xmit_tpid; - u8 *mtk_tag; -- bool is_vlan_skb = true; - unsigned char *dest = eth_hdr(skb)->h_dest; - bool is_multicast_skb = is_multicast_ether_addr(dest) && - !is_broadcast_ether_addr(dest); -@@ -33,10 +34,17 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb, - * the both special and VLAN tag at the same time and then look up VLAN - * table with VID. - */ -- if (!skb_vlan_tagged(skb)) { -+ switch (skb->protocol) { -+ case htons(ETH_P_8021Q): -+ xmit_tpid = MTK_HDR_XMIT_TAGGED_TPID_8100; -+ break; -+ case htons(ETH_P_8021AD): -+ xmit_tpid = MTK_HDR_XMIT_TAGGED_TPID_88A8; -+ break; -+ default: -+ xmit_tpid = MTK_HDR_XMIT_UNTAGGED; - skb_push(skb, MTK_HDR_LEN); - memmove(skb->data, skb->data + MTK_HDR_LEN, 2 * ETH_ALEN); -- is_vlan_skb = false; - } - - mtk_tag = skb->data + 2 * ETH_ALEN; -@@ -44,8 +52,7 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb, - /* Mark tag attribute on special tag insertion to notify hardware - * whether that's a combined special tag with 802.1Q header. - */ -- mtk_tag[0] = is_vlan_skb ? MTK_HDR_XMIT_TAGGED_TPID_8100 : -- MTK_HDR_XMIT_UNTAGGED; -+ mtk_tag[0] = xmit_tpid; - mtk_tag[1] = (1 << dp->index) & MTK_HDR_XMIT_DP_BIT_MASK; - - /* Disable SA learning for multicast frames */ -@@ -53,7 +60,7 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb, - mtk_tag[1] |= MTK_HDR_XMIT_SA_DIS; - - /* Tag control information is kept for 802.1Q */ -- if (!is_vlan_skb) { -+ if (xmit_tpid == MTK_HDR_XMIT_UNTAGGED) { - mtk_tag[2] = 0; - mtk_tag[3] = 0; - } -diff --git a/net/dsa/tag_rtl4_a.c b/net/dsa/tag_rtl4_a.c -index c17d39b4a1a04..e9176475bac89 100644 ---- a/net/dsa/tag_rtl4_a.c -+++ b/net/dsa/tag_rtl4_a.c -@@ -35,14 +35,12 @@ static struct sk_buff *rtl4a_tag_xmit(struct sk_buff *skb, - struct net_device *dev) - { - struct dsa_port *dp = dsa_slave_to_port(dev); -+ __be16 *p; - u8 *tag; -- u16 *p; - u16 out; - - /* Pad out to at least 60 bytes */ -- if (unlikely(eth_skb_pad(skb))) -- return NULL; -- if (skb_cow_head(skb, RTL4_A_HDR_LEN) < 0) -+ if (unlikely(__skb_put_padto(skb, ETH_ZLEN, false))) - return NULL; - - netdev_dbg(dev, "add realtek tag to package to port %d\n", -@@ -53,13 +51,13 @@ static struct sk_buff *rtl4a_tag_xmit(struct sk_buff *skb, - tag = skb->data + 2 * ETH_ALEN; - - /* Set Ethertype */ -- p = (u16 *)tag; -+ p = (__be16 *)tag; - *p = htons(RTL4_A_ETHERTYPE); - - out = (RTL4_A_PROTOCOL_RTL8366RB << 12) | (2 << 8); -- /* The lower bits is the port numer */ -+ /* The lower bits is the port number */ - out |= (u8)dp->index; -- p = (u16 *)(tag + 2); -+ p = (__be16 *)(tag + 2); - *p = htons(out); - - return skb; -diff --git a/net/ethtool/channels.c b/net/ethtool/channels.c -index 25a9e566ef5cd..6a070dc8e4b0d 100644 ---- a/net/ethtool/channels.c -+++ b/net/ethtool/channels.c -@@ -116,10 +116,9 @@ int ethnl_set_channels(struct sk_buff *skb, struct genl_info *info) - struct ethtool_channels channels = {}; - struct ethnl_req_info req_info = {}; - struct nlattr **tb = info->attrs; -- const struct nlattr *err_attr; -+ u32 err_attr, max_rx_in_use = 0; - const struct ethtool_ops *ops; - struct net_device *dev; -- u32 max_rx_in_use = 0; - int ret; - - ret = ethnl_parse_header_dev_get(&req_info, -@@ -157,34 +156,35 @@ int ethnl_set_channels(struct sk_buff *skb, struct genl_info *info) - - /* ensure new channel counts are within limits */ - if (channels.rx_count > channels.max_rx) -- err_attr = tb[ETHTOOL_A_CHANNELS_RX_COUNT]; -+ err_attr = ETHTOOL_A_CHANNELS_RX_COUNT; - else if (channels.tx_count > channels.max_tx) -- err_attr = tb[ETHTOOL_A_CHANNELS_TX_COUNT]; -+ err_attr = ETHTOOL_A_CHANNELS_TX_COUNT; - else if (channels.other_count > channels.max_other) -- err_attr = tb[ETHTOOL_A_CHANNELS_OTHER_COUNT]; -+ err_attr = ETHTOOL_A_CHANNELS_OTHER_COUNT; - else if (channels.combined_count > channels.max_combined) -- err_attr = tb[ETHTOOL_A_CHANNELS_COMBINED_COUNT]; -+ err_attr = ETHTOOL_A_CHANNELS_COMBINED_COUNT; - else -- err_attr = NULL; -+ err_attr = 0; - if (err_attr) { - ret = -EINVAL; -- NL_SET_ERR_MSG_ATTR(info->extack, err_attr, -+ NL_SET_ERR_MSG_ATTR(info->extack, tb[err_attr], - "requested channel count exceeds maximum"); - goto out_ops; - } - - /* ensure there is at least one RX and one TX channel */ - if (!channels.combined_count && !channels.rx_count) -- err_attr = tb[ETHTOOL_A_CHANNELS_RX_COUNT]; -+ err_attr = ETHTOOL_A_CHANNELS_RX_COUNT; - else if (!channels.combined_count && !channels.tx_count) -- err_attr = tb[ETHTOOL_A_CHANNELS_TX_COUNT]; -+ err_attr = ETHTOOL_A_CHANNELS_TX_COUNT; - else -- err_attr = NULL; -+ err_attr = 0; - if (err_attr) { - if (mod_combined) -- err_attr = tb[ETHTOOL_A_CHANNELS_COMBINED_COUNT]; -+ err_attr = ETHTOOL_A_CHANNELS_COMBINED_COUNT; - ret = -EINVAL; -- NL_SET_ERR_MSG_ATTR(info->extack, err_attr, "requested channel counts would result in no RX or TX channel being configured"); -+ NL_SET_ERR_MSG_ATTR(info->extack, tb[err_attr], -+ "requested channel counts would result in no RX or TX channel being configured"); - goto out_ops; - } - -diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c -index 471d33a0d095f..be09c7669a799 100644 ---- a/net/ipv4/cipso_ipv4.c -+++ b/net/ipv4/cipso_ipv4.c -@@ -519,16 +519,10 @@ int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info) - ret_val = -ENOENT; - goto doi_remove_return; - } -- if (!refcount_dec_and_test(&doi_def->refcount)) { -- spin_unlock(&cipso_v4_doi_list_lock); -- ret_val = -EBUSY; -- goto doi_remove_return; -- } - list_del_rcu(&doi_def->list); - spin_unlock(&cipso_v4_doi_list_lock); - -- cipso_v4_cache_invalidate(); -- call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); -+ cipso_v4_doi_putdef(doi_def); - ret_val = 0; - - doi_remove_return: -@@ -585,9 +579,6 @@ void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def) - - if (!refcount_dec_and_test(&doi_def->refcount)) - return; -- spin_lock(&cipso_v4_doi_list_lock); -- list_del_rcu(&doi_def->list); -- spin_unlock(&cipso_v4_doi_list_lock); - - cipso_v4_cache_invalidate(); - call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index 76a420c76f16e..f6cc26de5ed30 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -502,8 +502,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, - if (!skb_is_gso(skb) && - (inner_iph->frag_off & htons(IP_DF)) && - mtu < pkt_size) { -- memset(IPCB(skb), 0, sizeof(*IPCB(skb))); -- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); -+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); - return -E2BIG; - } - } -@@ -527,7 +526,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, - - if (!skb_is_gso(skb) && mtu >= IPV6_MIN_MTU && - mtu < pkt_size) { -- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); - return -E2BIG; - } - } -diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c -index abc171e79d3e4..eb207089ece0b 100644 ---- a/net/ipv4/ip_vti.c -+++ b/net/ipv4/ip_vti.c -@@ -238,13 +238,13 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, - if (skb->len > mtu) { - skb_dst_update_pmtu_no_confirm(skb, mtu); - if (skb->protocol == htons(ETH_P_IP)) { -- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, -- htonl(mtu)); -+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, -+ htonl(mtu)); - } else { - if (mtu < IPV6_MIN_MTU) - mtu = IPV6_MIN_MTU; - -- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); - } - - dst_release(dst); -diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c -index e53e43aef7854..bad4037d257bc 100644 ---- a/net/ipv4/nexthop.c -+++ b/net/ipv4/nexthop.c -@@ -1364,7 +1364,7 @@ out: - - /* rtnl */ - /* remove all nexthops tied to a device being deleted */ --static void nexthop_flush_dev(struct net_device *dev) -+static void nexthop_flush_dev(struct net_device *dev, unsigned long event) - { - unsigned int hash = nh_dev_hashfn(dev->ifindex); - struct net *net = dev_net(dev); -@@ -1376,6 +1376,10 @@ static void nexthop_flush_dev(struct net_device *dev) - if (nhi->fib_nhc.nhc_dev != dev) - continue; - -+ if (nhi->reject_nh && -+ (event == NETDEV_DOWN || event == NETDEV_CHANGE)) -+ continue; -+ - remove_nexthop(net, nhi->nh_parent, NULL); - } - } -@@ -2122,11 +2126,11 @@ static int nh_netdev_event(struct notifier_block *this, - switch (event) { - case NETDEV_DOWN: - case NETDEV_UNREGISTER: -- nexthop_flush_dev(dev); -+ nexthop_flush_dev(dev, event); - break; - case NETDEV_CHANGE: - if (!(dev_get_flags(dev) & (IFF_RUNNING | IFF_LOWER_UP))) -- nexthop_flush_dev(dev); -+ nexthop_flush_dev(dev, event); - break; - case NETDEV_CHANGEMTU: - info_ext = ptr; -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 32545ecf2ab10..1b10c54ce4718 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -3431,16 +3431,23 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, - break; - - case TCP_QUEUE_SEQ: -- if (sk->sk_state != TCP_CLOSE) -+ if (sk->sk_state != TCP_CLOSE) { - err = -EPERM; -- else if (tp->repair_queue == TCP_SEND_QUEUE) -- WRITE_ONCE(tp->write_seq, val); -- else if (tp->repair_queue == TCP_RECV_QUEUE) { -- WRITE_ONCE(tp->rcv_nxt, val); -- WRITE_ONCE(tp->copied_seq, val); -- } -- else -+ } else if (tp->repair_queue == TCP_SEND_QUEUE) { -+ if (!tcp_rtx_queue_empty(sk)) -+ err = -EPERM; -+ else -+ WRITE_ONCE(tp->write_seq, val); -+ } else if (tp->repair_queue == TCP_RECV_QUEUE) { -+ if (tp->rcv_nxt != tp->copied_seq) { -+ err = -EPERM; -+ } else { -+ WRITE_ONCE(tp->rcv_nxt, val); -+ WRITE_ONCE(tp->copied_seq, val); -+ } -+ } else { - err = -EINVAL; -+ } - break; - - case TCP_REPAIR_OPTIONS: -@@ -4088,7 +4095,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level, - - if (get_user(len, optlen)) - return -EFAULT; -- if (len < offsetofend(struct tcp_zerocopy_receive, length)) -+ if (len < 0 || -+ len < offsetofend(struct tcp_zerocopy_receive, length)) - return -EINVAL; - if (len > sizeof(zc)) { - len = sizeof(zc); -diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c -index cfc872689b997..ab770f7ccb307 100644 ---- a/net/ipv4/udp_offload.c -+++ b/net/ipv4/udp_offload.c -@@ -525,7 +525,7 @@ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb, - } - - if (!sk || NAPI_GRO_CB(skb)->encap_mark || -- (skb->ip_summed != CHECKSUM_PARTIAL && -+ (uh->check && skb->ip_summed != CHECKSUM_PARTIAL && - NAPI_GRO_CB(skb)->csum_cnt == 0 && - !NAPI_GRO_CB(skb)->csum_valid) || - !udp_sk(sk)->gro_receive) -diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c -index 51184a70ac7e5..1578ed9e97d89 100644 ---- a/net/ipv6/calipso.c -+++ b/net/ipv6/calipso.c -@@ -83,6 +83,9 @@ struct calipso_map_cache_entry { - - static struct calipso_map_cache_bkt *calipso_cache; - -+static void calipso_cache_invalidate(void); -+static void calipso_doi_putdef(struct calipso_doi *doi_def); -+ - /* Label Mapping Cache Functions - */ - -@@ -444,15 +447,10 @@ static int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info) - ret_val = -ENOENT; - goto doi_remove_return; - } -- if (!refcount_dec_and_test(&doi_def->refcount)) { -- spin_unlock(&calipso_doi_list_lock); -- ret_val = -EBUSY; -- goto doi_remove_return; -- } - list_del_rcu(&doi_def->list); - spin_unlock(&calipso_doi_list_lock); - -- call_rcu(&doi_def->rcu, calipso_doi_free_rcu); -+ calipso_doi_putdef(doi_def); - ret_val = 0; - - doi_remove_return: -@@ -508,10 +506,8 @@ static void calipso_doi_putdef(struct calipso_doi *doi_def) - - if (!refcount_dec_and_test(&doi_def->refcount)) - return; -- spin_lock(&calipso_doi_list_lock); -- list_del_rcu(&doi_def->list); -- spin_unlock(&calipso_doi_list_lock); - -+ calipso_cache_invalidate(); - call_rcu(&doi_def->rcu, calipso_doi_free_rcu); - } - -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index c3bc89b6b1a1a..1baf43aacb2e4 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -678,8 +678,8 @@ static int prepare_ip6gre_xmit_ipv6(struct sk_buff *skb, - - tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset]; - if (tel->encap_limit == 0) { -- icmpv6_send(skb, ICMPV6_PARAMPROB, -- ICMPV6_HDR_FIELD, offset + 2); -+ icmpv6_ndo_send(skb, ICMPV6_PARAMPROB, -+ ICMPV6_HDR_FIELD, offset + 2); - return -1; - } - *encap_limit = tel->encap_limit - 1; -@@ -805,8 +805,8 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev) - if (err != 0) { - /* XXX: send ICMP error even if DF is not set. */ - if (err == -EMSGSIZE) -- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, -- htonl(mtu)); -+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, -+ htonl(mtu)); - return -1; - } - -@@ -837,7 +837,7 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev) - &mtu, skb->protocol); - if (err != 0) { - if (err == -EMSGSIZE) -- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); - return -1; - } - -@@ -1063,10 +1063,10 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, - /* XXX: send ICMP error even if DF is not set. */ - if (err == -EMSGSIZE) { - if (skb->protocol == htons(ETH_P_IP)) -- icmp_send(skb, ICMP_DEST_UNREACH, -- ICMP_FRAG_NEEDED, htonl(mtu)); -+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, -+ ICMP_FRAG_NEEDED, htonl(mtu)); - else -- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); - } - - goto tx_err; -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index a7950baa05e51..3fa0eca5a06f8 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -1332,8 +1332,8 @@ ipxip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, - - tel = (void *)&skb_network_header(skb)[offset]; - if (tel->encap_limit == 0) { -- icmpv6_send(skb, ICMPV6_PARAMPROB, -- ICMPV6_HDR_FIELD, offset + 2); -+ icmpv6_ndo_send(skb, ICMPV6_PARAMPROB, -+ ICMPV6_HDR_FIELD, offset + 2); - return -1; - } - encap_limit = tel->encap_limit - 1; -@@ -1385,11 +1385,11 @@ ipxip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, - if (err == -EMSGSIZE) - switch (protocol) { - case IPPROTO_IPIP: -- icmp_send(skb, ICMP_DEST_UNREACH, -- ICMP_FRAG_NEEDED, htonl(mtu)); -+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, -+ ICMP_FRAG_NEEDED, htonl(mtu)); - break; - case IPPROTO_IPV6: -- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); - break; - default: - break; -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 0225fd6941925..f10e7a72ea624 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -521,10 +521,10 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) - if (mtu < IPV6_MIN_MTU) - mtu = IPV6_MIN_MTU; - -- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); - } else { -- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, -- htonl(mtu)); -+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, -+ htonl(mtu)); - } - - err = -EMSGSIZE; -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 93636867aee28..63ccd9f2dcccf 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -987,7 +987,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, - skb_dst_update_pmtu_no_confirm(skb, mtu); - - if (skb->len > mtu && !skb_is_gso(skb)) { -- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); - ip_rt_put(rt); - goto tx_error; - } -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index 7be5103ff2a84..203890e378cb0 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -649,9 +649,9 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, - /* Parse and check optional cookie */ - if (session->peer_cookie_len > 0) { - if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) { -- pr_warn_ratelimited("%s: cookie mismatch (%u/%u). Discarding.\n", -- tunnel->name, tunnel->tunnel_id, -- session->session_id); -+ pr_debug_ratelimited("%s: cookie mismatch (%u/%u). Discarding.\n", -+ tunnel->name, tunnel->tunnel_id, -+ session->session_id); - atomic_long_inc(&session->stats.rx_cookie_discards); - goto discard; - } -@@ -702,8 +702,8 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, - * If user has configured mandatory sequence numbers, discard. - */ - if (session->recv_seq) { -- pr_warn_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n", -- session->name); -+ pr_debug_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n", -+ session->name); - atomic_long_inc(&session->stats.rx_seq_discards); - goto discard; - } -@@ -718,8 +718,8 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, - session->send_seq = 0; - l2tp_session_set_header_len(session, tunnel->version); - } else if (session->send_seq) { -- pr_warn_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n", -- session->name); -+ pr_debug_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n", -+ session->name); - atomic_long_inc(&session->stats.rx_seq_discards); - goto discard; - } -@@ -809,9 +809,9 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb) - - /* Short packet? */ - if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) { -- pr_warn_ratelimited("%s: recv short packet (len=%d)\n", -- tunnel->name, skb->len); -- goto error; -+ pr_debug_ratelimited("%s: recv short packet (len=%d)\n", -+ tunnel->name, skb->len); -+ goto invalid; - } - - /* Point to L2TP header */ -@@ -824,9 +824,9 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb) - /* Check protocol version */ - version = hdrflags & L2TP_HDR_VER_MASK; - if (version != tunnel->version) { -- pr_warn_ratelimited("%s: recv protocol version mismatch: got %d expected %d\n", -- tunnel->name, version, tunnel->version); -- goto error; -+ pr_debug_ratelimited("%s: recv protocol version mismatch: got %d expected %d\n", -+ tunnel->name, version, tunnel->version); -+ goto invalid; - } - - /* Get length of L2TP packet */ -@@ -834,7 +834,7 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb) - - /* If type is control packet, it is handled by userspace. */ - if (hdrflags & L2TP_HDRFLAG_T) -- goto error; -+ goto pass; - - /* Skip flags */ - ptr += 2; -@@ -863,21 +863,24 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb) - l2tp_session_dec_refcount(session); - - /* Not found? Pass to userspace to deal with */ -- pr_warn_ratelimited("%s: no session found (%u/%u). Passing up.\n", -- tunnel->name, tunnel_id, session_id); -- goto error; -+ pr_debug_ratelimited("%s: no session found (%u/%u). Passing up.\n", -+ tunnel->name, tunnel_id, session_id); -+ goto pass; - } - - if (tunnel->version == L2TP_HDR_VER_3 && - l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) -- goto error; -+ goto invalid; - - l2tp_recv_common(session, skb, ptr, optr, hdrflags, length); - l2tp_session_dec_refcount(session); - - return 0; - --error: -+invalid: -+ atomic_long_inc(&tunnel->stats.rx_invalid); -+ -+pass: - /* Put UDP header back */ - __skb_push(skb, sizeof(struct udphdr)); - -diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h -index cb21d906343e8..98ea98eb9567b 100644 ---- a/net/l2tp/l2tp_core.h -+++ b/net/l2tp/l2tp_core.h -@@ -39,6 +39,7 @@ struct l2tp_stats { - atomic_long_t rx_oos_packets; - atomic_long_t rx_errors; - atomic_long_t rx_cookie_discards; -+ atomic_long_t rx_invalid; - }; - - struct l2tp_tunnel; -diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c -index 83956c9ee1fcc..96eb91be9238b 100644 ---- a/net/l2tp/l2tp_netlink.c -+++ b/net/l2tp/l2tp_netlink.c -@@ -428,6 +428,9 @@ static int l2tp_nl_tunnel_send(struct sk_buff *skb, u32 portid, u32 seq, int fla - L2TP_ATTR_STATS_PAD) || - nla_put_u64_64bit(skb, L2TP_ATTR_RX_ERRORS, - atomic_long_read(&tunnel->stats.rx_errors), -+ L2TP_ATTR_STATS_PAD) || -+ nla_put_u64_64bit(skb, L2TP_ATTR_RX_INVALID, -+ atomic_long_read(&tunnel->stats.rx_invalid), - L2TP_ATTR_STATS_PAD)) - goto nla_put_failure; - nla_nest_end(skb, nest); -@@ -771,6 +774,9 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl - L2TP_ATTR_STATS_PAD) || - nla_put_u64_64bit(skb, L2TP_ATTR_RX_ERRORS, - atomic_long_read(&session->stats.rx_errors), -+ L2TP_ATTR_STATS_PAD) || -+ nla_put_u64_64bit(skb, L2TP_ATTR_RX_INVALID, -+ atomic_long_read(&session->stats.rx_invalid), - L2TP_ATTR_STATS_PAD)) - goto nla_put_failure; - nla_nest_end(skb, nest); -diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c -index b1690149b6fa0..1482259de9b5d 100644 ---- a/net/mpls/mpls_gso.c -+++ b/net/mpls/mpls_gso.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - - static struct sk_buff *mpls_gso_segment(struct sk_buff *skb, - netdev_features_t features) -@@ -27,6 +28,8 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb, - - skb_reset_network_header(skb); - mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb); -+ if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN)) -+ goto out; - if (unlikely(!pskb_may_pull(skb, mpls_hlen))) - goto out; - -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index b51872b9dd619..056846eb2e5bd 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -114,11 +114,7 @@ static int __mptcp_socket_create(struct mptcp_sock *msk) - list_add(&subflow->node, &msk->conn_list); - sock_hold(ssock->sk); - subflow->request_mptcp = 1; -- -- /* accept() will wait on first subflow sk_wq, and we always wakes up -- * via msk->sk_socket -- */ -- RCU_INIT_POINTER(msk->first->sk_wq, &sk->sk_socket->wq); -+ mptcp_sock_graft(msk->first, sk->sk_socket); - - return 0; - } -@@ -1180,6 +1176,7 @@ static bool mptcp_tx_cache_refill(struct sock *sk, int size, - */ - while (skbs->qlen > 1) { - skb = __skb_dequeue_tail(skbs); -+ *total_ts -= skb->truesize; - __kfree_skb(skb); - } - return skbs->qlen > 0; -@@ -2114,8 +2111,7 @@ static struct sock *mptcp_subflow_get_retrans(const struct mptcp_sock *msk) - void __mptcp_close_ssk(struct sock *sk, struct sock *ssk, - struct mptcp_subflow_context *subflow) - { -- bool dispose_socket = false; -- struct socket *sock; -+ struct mptcp_sock *msk = mptcp_sk(sk); - - list_del(&subflow->node); - -@@ -2124,11 +2120,8 @@ void __mptcp_close_ssk(struct sock *sk, struct sock *ssk, - /* if we are invoked by the msk cleanup code, the subflow is - * already orphaned - */ -- sock = ssk->sk_socket; -- if (sock) { -- dispose_socket = sock != sk->sk_socket; -+ if (ssk->sk_socket) - sock_orphan(ssk); -- } - - subflow->disposable = 1; - -@@ -2146,10 +2139,11 @@ void __mptcp_close_ssk(struct sock *sk, struct sock *ssk, - __sock_put(ssk); - } - release_sock(ssk); -- if (dispose_socket) -- iput(SOCK_INODE(sock)); - - sock_put(ssk); -+ -+ if (ssk == msk->last_snd) -+ msk->last_snd = NULL; - } - - static unsigned int mptcp_sync_mss(struct sock *sk, u32 pmtu) -@@ -2535,6 +2529,12 @@ static void __mptcp_destroy_sock(struct sock *sk) - - pr_debug("msk=%p", msk); - -+ /* dispose the ancillatory tcp socket, if any */ -+ if (msk->subflow) { -+ iput(SOCK_INODE(msk->subflow)); -+ msk->subflow = NULL; -+ } -+ - /* be sure to always acquire the join list lock, to sync vs - * mptcp_finish_join(). - */ -@@ -2585,20 +2585,10 @@ cleanup: - inet_csk(sk)->icsk_mtup.probe_timestamp = tcp_jiffies32; - list_for_each_entry(subflow, &mptcp_sk(sk)->conn_list, node) { - struct sock *ssk = mptcp_subflow_tcp_sock(subflow); -- bool slow, dispose_socket; -- struct socket *sock; -+ bool slow = lock_sock_fast(ssk); - -- slow = lock_sock_fast(ssk); -- sock = ssk->sk_socket; -- dispose_socket = sock && sock != sk->sk_socket; - sock_orphan(ssk); - unlock_sock_fast(ssk, slow); -- -- /* for the outgoing subflows we additionally need to free -- * the associated socket -- */ -- if (dispose_socket) -- iput(SOCK_INODE(sock)); - } - sock_orphan(sk); - -@@ -3040,7 +3030,7 @@ void mptcp_finish_connect(struct sock *ssk) - mptcp_rcv_space_init(msk, ssk); - } - --static void mptcp_sock_graft(struct sock *sk, struct socket *parent) -+void mptcp_sock_graft(struct sock *sk, struct socket *parent) - { - write_lock_bh(&sk->sk_callback_lock); - rcu_assign_pointer(sk->sk_wq, &parent->wq); -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index d6ca1a5b94fc0..18fef4273bdc6 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -50,14 +50,15 @@ - #define TCPOLEN_MPTCP_DSS_MAP64 14 - #define TCPOLEN_MPTCP_DSS_CHECKSUM 2 - #define TCPOLEN_MPTCP_ADD_ADDR 16 --#define TCPOLEN_MPTCP_ADD_ADDR_PORT 20 -+#define TCPOLEN_MPTCP_ADD_ADDR_PORT 18 - #define TCPOLEN_MPTCP_ADD_ADDR_BASE 8 --#define TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT 12 -+#define TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT 10 - #define TCPOLEN_MPTCP_ADD_ADDR6 28 --#define TCPOLEN_MPTCP_ADD_ADDR6_PORT 32 -+#define TCPOLEN_MPTCP_ADD_ADDR6_PORT 30 - #define TCPOLEN_MPTCP_ADD_ADDR6_BASE 20 --#define TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT 24 --#define TCPOLEN_MPTCP_PORT_LEN 4 -+#define TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT 22 -+#define TCPOLEN_MPTCP_PORT_LEN 2 -+#define TCPOLEN_MPTCP_PORT_ALIGN 2 - #define TCPOLEN_MPTCP_RM_ADDR_BASE 4 - #define TCPOLEN_MPTCP_FASTCLOSE 12 - -@@ -459,6 +460,7 @@ void mptcp_subflow_shutdown(struct sock *sk, struct sock *ssk, int how); - void __mptcp_close_ssk(struct sock *sk, struct sock *ssk, - struct mptcp_subflow_context *subflow); - void mptcp_subflow_reset(struct sock *ssk); -+void mptcp_sock_graft(struct sock *sk, struct socket *parent); - - /* called with sk socket lock held */ - int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc, -@@ -587,8 +589,9 @@ static inline unsigned int mptcp_add_addr_len(int family, bool echo, bool port) - len = TCPOLEN_MPTCP_ADD_ADDR6_BASE; - if (!echo) - len += MPTCPOPT_THMAC_LEN; -+ /* account for 2 trailing 'nop' options */ - if (port) -- len += TCPOLEN_MPTCP_PORT_LEN; -+ len += TCPOLEN_MPTCP_PORT_LEN + TCPOLEN_MPTCP_PORT_ALIGN; - - return len; - } -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index 9d28f6e3dc49a..c3090003a17bd 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -1165,12 +1165,16 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc, - if (err && err != -EINPROGRESS) - goto failed_unlink; - -+ /* discard the subflow socket */ -+ mptcp_sock_graft(ssk, sk->sk_socket); -+ iput(SOCK_INODE(sf)); - return err; - - failed_unlink: - spin_lock_bh(&msk->join_list_lock); - list_del(&subflow->node); - spin_unlock_bh(&msk->join_list_lock); -+ sock_put(mptcp_subflow_tcp_sock(subflow)); - - failed: - subflow->disposable = 1; -diff --git a/net/netfilter/nf_nat_proto.c b/net/netfilter/nf_nat_proto.c -index e87b6bd6b3cdb..4731d21fc3ad8 100644 ---- a/net/netfilter/nf_nat_proto.c -+++ b/net/netfilter/nf_nat_proto.c -@@ -646,8 +646,8 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb, - } - - static unsigned int --nf_nat_ipv4_in(void *priv, struct sk_buff *skb, -- const struct nf_hook_state *state) -+nf_nat_ipv4_pre_routing(void *priv, struct sk_buff *skb, -+ const struct nf_hook_state *state) - { - unsigned int ret; - __be32 daddr = ip_hdr(skb)->daddr; -@@ -659,6 +659,23 @@ nf_nat_ipv4_in(void *priv, struct sk_buff *skb, - return ret; - } - -+static unsigned int -+nf_nat_ipv4_local_in(void *priv, struct sk_buff *skb, -+ const struct nf_hook_state *state) -+{ -+ __be32 saddr = ip_hdr(skb)->saddr; -+ struct sock *sk = skb->sk; -+ unsigned int ret; -+ -+ ret = nf_nat_ipv4_fn(priv, skb, state); -+ -+ if (ret == NF_ACCEPT && sk && saddr != ip_hdr(skb)->saddr && -+ !inet_sk_transparent(sk)) -+ skb_orphan(skb); /* TCP edemux obtained wrong socket */ -+ -+ return ret; -+} -+ - static unsigned int - nf_nat_ipv4_out(void *priv, struct sk_buff *skb, - const struct nf_hook_state *state) -@@ -736,7 +753,7 @@ nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb, - static const struct nf_hook_ops nf_nat_ipv4_ops[] = { - /* Before packet filtering, change destination */ - { -- .hook = nf_nat_ipv4_in, -+ .hook = nf_nat_ipv4_pre_routing, - .pf = NFPROTO_IPV4, - .hooknum = NF_INET_PRE_ROUTING, - .priority = NF_IP_PRI_NAT_DST, -@@ -757,7 +774,7 @@ static const struct nf_hook_ops nf_nat_ipv4_ops[] = { - }, - /* After packet filtering, change source */ - { -- .hook = nf_nat_ipv4_fn, -+ .hook = nf_nat_ipv4_local_in, - .pf = NFPROTO_IPV4, - .hooknum = NF_INET_LOCAL_IN, - .priority = NF_IP_PRI_NAT_SRC, -diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c -index acce622582e3d..bce6ca203d462 100644 ---- a/net/netfilter/x_tables.c -+++ b/net/netfilter/x_tables.c -@@ -330,6 +330,7 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp) - const struct xt_match *m; - int have_rev = 0; - -+ mutex_lock(&xt[af].mutex); - list_for_each_entry(m, &xt[af].match, list) { - if (strcmp(m->name, name) == 0) { - if (m->revision > *bestp) -@@ -338,6 +339,7 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp) - have_rev = 1; - } - } -+ mutex_unlock(&xt[af].mutex); - - if (af != NFPROTO_UNSPEC && !have_rev) - return match_revfn(NFPROTO_UNSPEC, name, revision, bestp); -@@ -350,6 +352,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp) - const struct xt_target *t; - int have_rev = 0; - -+ mutex_lock(&xt[af].mutex); - list_for_each_entry(t, &xt[af].target, list) { - if (strcmp(t->name, name) == 0) { - if (t->revision > *bestp) -@@ -358,6 +361,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp) - have_rev = 1; - } - } -+ mutex_unlock(&xt[af].mutex); - - if (af != NFPROTO_UNSPEC && !have_rev) - return target_revfn(NFPROTO_UNSPEC, name, revision, bestp); -@@ -371,12 +375,10 @@ int xt_find_revision(u8 af, const char *name, u8 revision, int target, - { - int have_rev, best = -1; - -- mutex_lock(&xt[af].mutex); - if (target == 1) - have_rev = target_revfn(af, name, revision, &best); - else - have_rev = match_revfn(af, name, revision, &best); -- mutex_unlock(&xt[af].mutex); - - /* Nothing at all? Return 0 to try loading module. */ - if (best == -1) { -diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c -index 726dda95934c6..4f50a64315cf0 100644 ---- a/net/netlabel/netlabel_cipso_v4.c -+++ b/net/netlabel/netlabel_cipso_v4.c -@@ -575,6 +575,7 @@ list_start: - - break; - } -+ cipso_v4_doi_putdef(doi_def); - rcu_read_unlock(); - - genlmsg_end(ans_skb, data); -@@ -583,12 +584,14 @@ list_start: - list_retry: - /* XXX - this limit is a guesstimate */ - if (nlsze_mult < 4) { -+ cipso_v4_doi_putdef(doi_def); - rcu_read_unlock(); - kfree_skb(ans_skb); - nlsze_mult *= 2; - goto list_start; - } - list_failure_lock: -+ cipso_v4_doi_putdef(doi_def); - rcu_read_unlock(); - list_failure: - kfree_skb(ans_skb); -diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c -index b34358282f379..ac2a4a7711da4 100644 ---- a/net/qrtr/qrtr.c -+++ b/net/qrtr/qrtr.c -@@ -958,8 +958,10 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) - plen = (len + 3) & ~3; - skb = sock_alloc_send_skb(sk, plen + QRTR_HDR_MAX_SIZE, - msg->msg_flags & MSG_DONTWAIT, &rc); -- if (!skb) -+ if (!skb) { -+ rc = -ENOMEM; - goto out_node; -+ } - - skb_reserve(skb, QRTR_HDR_MAX_SIZE); - -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index 6fe4e5cc807c9..5f90ee76fd416 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -2167,7 +2167,7 @@ static int tc_dump_tclass_qdisc(struct Qdisc *q, struct sk_buff *skb, - - static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb, - struct tcmsg *tcm, struct netlink_callback *cb, -- int *t_p, int s_t) -+ int *t_p, int s_t, bool recur) - { - struct Qdisc *q; - int b; -@@ -2178,7 +2178,7 @@ static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb, - if (tc_dump_tclass_qdisc(root, skb, tcm, cb, t_p, s_t) < 0) - return -1; - -- if (!qdisc_dev(root)) -+ if (!qdisc_dev(root) || !recur) - return 0; - - if (tcm->tcm_parent) { -@@ -2213,13 +2213,13 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb) - s_t = cb->args[0]; - t = 0; - -- if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t) < 0) -+ if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t, true) < 0) - goto done; - - dev_queue = dev_ingress_queue(dev); - if (dev_queue && - tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb, -- &t, s_t) < 0) -+ &t, s_t, false) < 0) - goto done; - - done: -diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c -index cf702a5f7fe5d..39ed0e0afe6d9 100644 ---- a/net/sunrpc/sched.c -+++ b/net/sunrpc/sched.c -@@ -963,8 +963,11 @@ void rpc_execute(struct rpc_task *task) - - rpc_set_active(task); - rpc_make_runnable(rpciod_workqueue, task); -- if (!is_async) -+ if (!is_async) { -+ unsigned int pflags = memalloc_nofs_save(); - __rpc_execute(task); -+ memalloc_nofs_restore(pflags); -+ } - } - - static void rpc_async_schedule(struct work_struct *work) -diff --git a/samples/bpf/xdpsock_user.c b/samples/bpf/xdpsock_user.c -index db0cb73513a58..1e2a1105d0e67 100644 ---- a/samples/bpf/xdpsock_user.c -+++ b/samples/bpf/xdpsock_user.c -@@ -1699,5 +1699,7 @@ int main(int argc, char **argv) - - xdpsock_cleanup(); - -+ munmap(bufs, NUM_FRAMES * opt_xsk_frame_size); -+ - return 0; - } -diff --git a/security/commoncap.c b/security/commoncap.c -index 78598be45f101..26c1cb725dcbe 100644 ---- a/security/commoncap.c -+++ b/security/commoncap.c -@@ -500,8 +500,7 @@ int cap_convert_nscap(struct dentry *dentry, const void **ivalue, size_t size) - __u32 magic, nsmagic; - struct inode *inode = d_backing_inode(dentry); - struct user_namespace *task_ns = current_user_ns(), -- *fs_ns = inode->i_sb->s_user_ns, -- *ancestor; -+ *fs_ns = inode->i_sb->s_user_ns; - kuid_t rootid; - size_t newsize; - -@@ -524,15 +523,6 @@ int cap_convert_nscap(struct dentry *dentry, const void **ivalue, size_t size) - if (nsrootid == -1) - return -EINVAL; - -- /* -- * Do not allow allow adding a v3 filesystem capability xattr -- * if the rootid field is ambiguous. -- */ -- for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) { -- if (from_kuid(ancestor, rootid) == 0) -- return -EINVAL; -- } -- - newsize = sizeof(struct vfs_ns_cap_data); - nscap = kmalloc(newsize, GFP_ATOMIC); - if (!nscap) -diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c -index 6a85645663759..17a25e453f60c 100644 ---- a/sound/pci/hda/hda_bind.c -+++ b/sound/pci/hda/hda_bind.c -@@ -47,6 +47,10 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev) - if (codec->bus->shutdown) - return; - -+ /* ignore unsol events during system suspend/resume */ -+ if (codec->core.dev.power.power_state.event != PM_EVENT_ON) -+ return; -+ - if (codec->patch_ops.unsol_event) - codec->patch_ops.unsol_event(codec, ev); - } -diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c -index 80016b7b6849e..b972d59eb1ec2 100644 ---- a/sound/pci/hda/hda_controller.c -+++ b/sound/pci/hda/hda_controller.c -@@ -609,13 +609,6 @@ static int azx_pcm_open(struct snd_pcm_substream *substream) - 20, - 178000000); - -- /* by some reason, the playback stream stalls on PulseAudio with -- * tsched=1 when a capture stream triggers. Until we figure out the -- * real cause, disable tsched mode by telling the PCM info flag. -- */ -- if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND) -- runtime->hw.info |= SNDRV_PCM_INFO_BATCH; -- - if (chip->align_buffer_size) - /* constrain buffer sizes to be multiple of 128 - bytes. This is more efficient in terms of memory -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 1233d4ee8a39d..253d538251ae1 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -1026,6 +1026,8 @@ static int azx_prepare(struct device *dev) - chip = card->private_data; - chip->pm_prepared = 1; - -+ flush_work(&azx_bus(chip)->unsol_work); -+ - /* HDA controller always requires different WAKEEN for runtime suspend - * and system suspend, so don't use direct-complete here. - */ -diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c -index 7e62aed172a9f..65057a1845598 100644 ---- a/sound/pci/hda/patch_ca0132.c -+++ b/sound/pci/hda/patch_ca0132.c -@@ -1309,6 +1309,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = { - SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D), - SND_PCI_QUIRK(0x1102, 0x0018, "Recon3D", QUIRK_R3D), - SND_PCI_QUIRK(0x1102, 0x0051, "Sound Blaster AE-5", QUIRK_AE5), -+ SND_PCI_QUIRK(0x1102, 0x0191, "Sound Blaster AE-5 Plus", QUIRK_AE5), - SND_PCI_QUIRK(0x1102, 0x0081, "Sound Blaster AE-7", QUIRK_AE7), - {} - }; -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index d49cc4409d59c..a980a4eda51c9 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -149,6 +149,21 @@ static int cx_auto_vmaster_mute_led(struct led_classdev *led_cdev, - return 0; - } - -+static void cxt_init_gpio_led(struct hda_codec *codec) -+{ -+ struct conexant_spec *spec = codec->spec; -+ unsigned int mask = spec->gpio_mute_led_mask | spec->gpio_mic_led_mask; -+ -+ if (mask) { -+ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK, -+ mask); -+ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION, -+ mask); -+ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, -+ spec->gpio_led); -+ } -+} -+ - static int cx_auto_init(struct hda_codec *codec) - { - struct conexant_spec *spec = codec->spec; -@@ -156,6 +171,7 @@ static int cx_auto_init(struct hda_codec *codec) - if (!spec->dynamic_eapd) - cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, true); - -+ cxt_init_gpio_led(codec); - snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT); - - return 0; -@@ -215,6 +231,7 @@ enum { - CXT_FIXUP_HP_SPECTRE, - CXT_FIXUP_HP_GATE_MIC, - CXT_FIXUP_MUTE_LED_GPIO, -+ CXT_FIXUP_HP_ZBOOK_MUTE_LED, - CXT_FIXUP_HEADSET_MIC, - CXT_FIXUP_HP_MIC_NO_PRESENCE, - }; -@@ -654,31 +671,36 @@ static int cxt_gpio_micmute_update(struct led_classdev *led_cdev, - return 0; - } - -- --static void cxt_fixup_mute_led_gpio(struct hda_codec *codec, -- const struct hda_fixup *fix, int action) -+static void cxt_setup_mute_led(struct hda_codec *codec, -+ unsigned int mute, unsigned int mic_mute) - { - struct conexant_spec *spec = codec->spec; -- static const struct hda_verb gpio_init[] = { -- { 0x01, AC_VERB_SET_GPIO_MASK, 0x03 }, -- { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x03 }, -- {} -- }; - -- if (action == HDA_FIXUP_ACT_PRE_PROBE) { -+ spec->gpio_led = 0; -+ spec->mute_led_polarity = 0; -+ if (mute) { - snd_hda_gen_add_mute_led_cdev(codec, cxt_gpio_mute_update); -- spec->gpio_led = 0; -- spec->mute_led_polarity = 0; -- spec->gpio_mute_led_mask = 0x01; -- spec->gpio_mic_led_mask = 0x02; -+ spec->gpio_mute_led_mask = mute; -+ } -+ if (mic_mute) { - snd_hda_gen_add_micmute_led_cdev(codec, cxt_gpio_micmute_update); -+ spec->gpio_mic_led_mask = mic_mute; - } -- snd_hda_add_verbs(codec, gpio_init); -- if (spec->gpio_led) -- snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, -- spec->gpio_led); - } - -+static void cxt_fixup_mute_led_gpio(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ if (action == HDA_FIXUP_ACT_PRE_PROBE) -+ cxt_setup_mute_led(codec, 0x01, 0x02); -+} -+ -+static void cxt_fixup_hp_zbook_mute_led(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ if (action == HDA_FIXUP_ACT_PRE_PROBE) -+ cxt_setup_mute_led(codec, 0x10, 0x20); -+} - - /* ThinkPad X200 & co with cxt5051 */ - static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { -@@ -839,6 +861,10 @@ static const struct hda_fixup cxt_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = cxt_fixup_mute_led_gpio, - }, -+ [CXT_FIXUP_HP_ZBOOK_MUTE_LED] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = cxt_fixup_hp_zbook_mute_led, -+ }, - [CXT_FIXUP_HEADSET_MIC] = { - .type = HDA_FIXUP_FUNC, - .v.func = cxt_fixup_headset_mic, -@@ -917,6 +943,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { - SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO), -+ SND_PCI_QUIRK(0x103c, 0x8427, "HP ZBook Studio G5", CXT_FIXUP_HP_ZBOOK_MUTE_LED), - SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE), -@@ -956,6 +983,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = { - { .id = CXT_FIXUP_MUTE_LED_EAPD, .name = "mute-led-eapd" }, - { .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" }, - { .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" }, -+ { .id = CXT_FIXUP_HP_ZBOOK_MUTE_LED, .name = "hp-zbook-mute-led" }, - { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" }, - {} - }; -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index e405be7929e31..d6387106619ff 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -2472,6 +2472,18 @@ static void generic_hdmi_free(struct hda_codec *codec) - } - - #ifdef CONFIG_PM -+static int generic_hdmi_suspend(struct hda_codec *codec) -+{ -+ struct hdmi_spec *spec = codec->spec; -+ int pin_idx; -+ -+ for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) { -+ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx); -+ cancel_delayed_work_sync(&per_pin->work); -+ } -+ return 0; -+} -+ - static int generic_hdmi_resume(struct hda_codec *codec) - { - struct hdmi_spec *spec = codec->spec; -@@ -2495,6 +2507,7 @@ static const struct hda_codec_ops generic_hdmi_patch_ops = { - .build_controls = generic_hdmi_build_controls, - .unsol_event = hdmi_unsol_event, - #ifdef CONFIG_PM -+ .suspend = generic_hdmi_suspend, - .resume = generic_hdmi_resume, - #endif - }; -diff --git a/sound/usb/card.c b/sound/usb/card.c -index e08fbf8e3ee0f..3007922a8ed86 100644 ---- a/sound/usb/card.c -+++ b/sound/usb/card.c -@@ -831,6 +831,9 @@ static int usb_audio_probe(struct usb_interface *intf, - snd_media_device_create(chip, intf); - } - -+ if (quirk) -+ chip->quirk_type = quirk->type; -+ - usb_chip[chip->index] = chip; - chip->intf[chip->num_interfaces] = intf; - chip->num_interfaces++; -@@ -905,6 +908,9 @@ static void usb_audio_disconnect(struct usb_interface *intf) - } - } - -+ if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND) -+ usb_enable_autosuspend(interface_to_usbdev(intf)); -+ - chip->num_interfaces--; - if (chip->num_interfaces <= 0) { - usb_chip[chip->index] = NULL; -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 737b2729c0d37..d3001fb18141f 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -547,7 +547,7 @@ static int setup_disable_autosuspend(struct snd_usb_audio *chip, - struct usb_driver *driver, - const struct snd_usb_audio_quirk *quirk) - { -- driver->supports_autosuspend = 0; -+ usb_disable_autosuspend(interface_to_usbdev(iface)); - return 1; /* Continue with creating streams and mixer */ - } - -@@ -1520,6 +1520,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) - case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */ - case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */ - case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */ -+ case USB_ID(0x413c, 0xa506): /* Dell AE515 sound bar */ - return true; - } - -@@ -1670,6 +1671,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe, - && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) - msleep(20); - -+ /* -+ * Plantronics headsets (C320, C320-M, etc) need a delay to avoid -+ * random microhpone failures. -+ */ -+ if (USB_ID_VENDOR(chip->usb_id) == 0x047f && -+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) -+ msleep(20); -+ - /* Zoom R16/24, many Logitech(at least H650e/H570e/BCC950), - * Jabra 550a, Kingston HyperX needs a tiny delay here, - * otherwise requests like get/set frequency return -diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h -index 215c1771dd570..60b9dd7df6bb7 100644 ---- a/sound/usb/usbaudio.h -+++ b/sound/usb/usbaudio.h -@@ -27,6 +27,7 @@ struct snd_usb_audio { - struct snd_card *card; - struct usb_interface *intf[MAX_CARD_INTERFACES]; - u32 usb_id; -+ uint16_t quirk_type; - struct mutex mutex; - unsigned int system_suspend; - atomic_t active; -diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c -index 7409d7860aa6c..80d966cfcaa14 100644 ---- a/tools/bpf/resolve_btfids/main.c -+++ b/tools/bpf/resolve_btfids/main.c -@@ -260,6 +260,11 @@ static struct btf_id *add_symbol(struct rb_root *root, char *name, size_t size) - return btf_id__add(root, id, false); - } - -+/* Older libelf.h and glibc elf.h might not yet define the ELF compression types. */ -+#ifndef SHF_COMPRESSED -+#define SHF_COMPRESSED (1 << 11) /* Section with compressed data. */ -+#endif -+ - /* - * The data of compressed section should be aligned to 4 - * (for 32bit) or 8 (for 64 bit) bytes. The binutils ld -diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c -index e3e41ceeb1bc6..06746d96742f3 100644 ---- a/tools/lib/bpf/xsk.c -+++ b/tools/lib/bpf/xsk.c -@@ -535,15 +535,16 @@ static int xsk_lookup_bpf_maps(struct xsk_socket *xsk) - if (fd < 0) - continue; - -+ memset(&map_info, 0, map_len); - err = bpf_obj_get_info_by_fd(fd, &map_info, &map_len); - if (err) { - close(fd); - continue; - } - -- if (!strcmp(map_info.name, "xsks_map")) { -+ if (!strncmp(map_info.name, "xsks_map", sizeof(map_info.name))) { - ctx->xsks_map_fd = fd; -- continue; -+ break; - } - - close(fd); -diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf -index 62f3deb1d3a8b..e41a8f9b99d2d 100644 ---- a/tools/perf/Makefile.perf -+++ b/tools/perf/Makefile.perf -@@ -600,7 +600,7 @@ arch_errno_hdr_dir := $(srctree)/tools - arch_errno_tbl := $(srctree)/tools/perf/trace/beauty/arch_errno_names.sh - - $(arch_errno_name_array): $(arch_errno_tbl) -- $(Q)$(SHELL) '$(arch_errno_tbl)' $(firstword $(CC)) $(arch_errno_hdr_dir) > $@ -+ $(Q)$(SHELL) '$(arch_errno_tbl)' '$(patsubst -%,,$(CC))' $(arch_errno_hdr_dir) > $@ - - sync_file_range_arrays := $(beauty_outdir)/sync_file_range_arrays.c - sync_file_range_tbls := $(srctree)/tools/perf/trace/beauty/sync_file_range.sh -diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c -index 80907bc32683a..f564b210d7614 100644 ---- a/tools/perf/util/sort.c -+++ b/tools/perf/util/sort.c -@@ -3033,7 +3033,7 @@ int output_field_add(struct perf_hpp_list *list, char *tok) - if (strncasecmp(tok, sd->name, strlen(tok))) - continue; - -- if (sort__mode != SORT_MODE__MEMORY) -+ if (sort__mode != SORT_MODE__BRANCH) - return -EINVAL; - - return __sort_dimension__add_output(list, sd); -@@ -3045,7 +3045,7 @@ int output_field_add(struct perf_hpp_list *list, char *tok) - if (strncasecmp(tok, sd->name, strlen(tok))) - continue; - -- if (sort__mode != SORT_MODE__BRANCH) -+ if (sort__mode != SORT_MODE__MEMORY) - return -EINVAL; - - return __sort_dimension__add_output(list, sd); -diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c -index f507dff713c9f..8a01af783310a 100644 ---- a/tools/perf/util/trace-event-read.c -+++ b/tools/perf/util/trace-event-read.c -@@ -361,6 +361,7 @@ static int read_saved_cmdline(struct tep_handle *pevent) - pr_debug("error reading saved cmdlines\n"); - goto out; - } -+ buf[ret] = '\0'; - - parse_saved_cmdline(pevent, buf, size); - ret = 0; -diff --git a/tools/testing/selftests/bpf/progs/netif_receive_skb.c b/tools/testing/selftests/bpf/progs/netif_receive_skb.c -index 6b670039ea679..1d8918dfbd3ff 100644 ---- a/tools/testing/selftests/bpf/progs/netif_receive_skb.c -+++ b/tools/testing/selftests/bpf/progs/netif_receive_skb.c -@@ -16,6 +16,13 @@ bool skip = false; - #define STRSIZE 2048 - #define EXPECTED_STRSIZE 256 - -+#if defined(bpf_target_s390) -+/* NULL points to a readable struct lowcore on s390, so take the last page */ -+#define BADPTR ((void *)0xFFFFFFFFFFFFF000ULL) -+#else -+#define BADPTR 0 -+#endif -+ - #ifndef ARRAY_SIZE - #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) - #endif -@@ -113,11 +120,11 @@ int BPF_PROG(trace_netif_receive_skb, struct sk_buff *skb) - } - - /* Check invalid ptr value */ -- p.ptr = 0; -+ p.ptr = BADPTR; - __ret = bpf_snprintf_btf(str, STRSIZE, &p, sizeof(p), 0); - if (__ret >= 0) { -- bpf_printk("printing NULL should generate error, got (%d)", -- __ret); -+ bpf_printk("printing %llx should generate error, got (%d)", -+ (unsigned long long)BADPTR, __ret); - ret = -ERANGE; - } - -diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c -index a621b58ab079d..9afe947cfae95 100644 ---- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c -+++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c -@@ -446,10 +446,8 @@ int _geneve_get_tunnel(struct __sk_buff *skb) - } - - ret = bpf_skb_get_tunnel_opt(skb, &gopt, sizeof(gopt)); -- if (ret < 0) { -- ERROR(ret); -- return TC_ACT_SHOT; -- } -+ if (ret < 0) -+ gopt.opt_class = 0; - - bpf_trace_printk(fmt, sizeof(fmt), - key.tunnel_id, key.remote_ipv4, gopt.opt_class); -diff --git a/tools/testing/selftests/bpf/verifier/array_access.c b/tools/testing/selftests/bpf/verifier/array_access.c -index bed53b561e044..1b138cd2b187d 100644 ---- a/tools/testing/selftests/bpf/verifier/array_access.c -+++ b/tools/testing/selftests/bpf/verifier/array_access.c -@@ -250,12 +250,13 @@ - BPF_MOV64_IMM(BPF_REG_5, 0), - BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, - BPF_FUNC_csum_diff), -+ BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff), - BPF_EXIT_INSN(), - }, - .prog_type = BPF_PROG_TYPE_SCHED_CLS, - .fixup_map_array_ro = { 3 }, - .result = ACCEPT, -- .retval = -29, -+ .retval = 65507, - }, - { - "invalid write map access into a read-only array 1", -diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh -index 197e769c2ed16..f8cda822c1cec 100755 ---- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh -+++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh -@@ -86,11 +86,20 @@ test_ip6gretap() - - test_gretap_stp() - { -+ # Sometimes after mirror installation, the neighbor's state is not valid. -+ # The reason is that there is no SW datapath activity related to the -+ # neighbor for the remote GRE address. Therefore whether the corresponding -+ # neighbor will be valid is a matter of luck, and the test is thus racy. -+ # Set the neighbor's state to permanent, so it would be always valid. -+ ip neigh replace 192.0.2.130 lladdr $(mac_get $h3) \ -+ nud permanent dev br2 - full_test_span_gre_stp gt4 $swp3.555 "mirror to gretap" - } - - test_ip6gretap_stp() - { -+ ip neigh replace 2001:db8:2::2 lladdr $(mac_get $h3) \ -+ nud permanent dev br2 - full_test_span_gre_stp gt6 $swp3.555 "mirror to ip6gretap" - } - diff --git a/patch/kernel/archive/sunxi-5.11/patch-5.11.7-8.patch b/patch/kernel/archive/sunxi-5.11/patch-5.11.7-8.patch deleted file mode 100644 index 62c2850e4b..0000000000 --- a/patch/kernel/archive/sunxi-5.11/patch-5.11.7-8.patch +++ /dev/null @@ -1,1700 +0,0 @@ -diff --git a/Makefile b/Makefile -index 6ba32b82c4802..d8a39ece170dd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 11 --SUBLEVEL = 7 -+SUBLEVEL = 8 - EXTRAVERSION = - NAME = 💕 Valentine's Day Edition 💕 - -diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h -index a7f5a1bbc8aca..f97e4a4595618 100644 ---- a/arch/arm64/include/asm/el2_setup.h -+++ b/arch/arm64/include/asm/el2_setup.h -@@ -111,7 +111,7 @@ - .endm - - /* Virtual CPU ID registers */ --.macro __init_el2_nvhe_idregs -+.macro __init_el2_idregs - mrs x0, midr_el1 - mrs x1, mpidr_el1 - msr vpidr_el2, x0 -@@ -163,6 +163,7 @@ - __init_el2_stage2 - __init_el2_gicv3 - __init_el2_hstr -+ __init_el2_idregs - - /* - * When VHE is not in use, early init of EL2 needs to be done here. -@@ -171,7 +172,6 @@ - * will be done via the _EL1 system register aliases in __cpu_setup. - */ - .ifeqs "\mode", "nvhe" -- __init_el2_nvhe_idregs - __init_el2_nvhe_cptr - __init_el2_nvhe_sve - __init_el2_nvhe_prepare_eret -diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S -index d1436c37008b4..57aef3f5a81e2 100644 ---- a/arch/x86/crypto/aesni-intel_asm.S -+++ b/arch/x86/crypto/aesni-intel_asm.S -@@ -2715,25 +2715,18 @@ SYM_FUNC_END(aesni_ctr_enc) - pxor CTR, IV; - - /* -- * void aesni_xts_crypt8(const struct crypto_aes_ctx *ctx, u8 *dst, -- * const u8 *src, bool enc, le128 *iv) -+ * void aesni_xts_encrypt(const struct crypto_aes_ctx *ctx, u8 *dst, -+ * const u8 *src, unsigned int len, le128 *iv) - */ --SYM_FUNC_START(aesni_xts_crypt8) -+SYM_FUNC_START(aesni_xts_encrypt) - FRAME_BEGIN -- testb %cl, %cl -- movl $0, %ecx -- movl $240, %r10d -- leaq _aesni_enc4, %r11 -- leaq _aesni_dec4, %rax -- cmovel %r10d, %ecx -- cmoveq %rax, %r11 - - movdqa .Lgf128mul_x_ble_mask, GF128MUL_MASK - movups (IVP), IV - - mov 480(KEYP), KLEN -- addq %rcx, KEYP - -+.Lxts_enc_loop4: - movdqa IV, STATE1 - movdqu 0x00(INP), INC - pxor INC, STATE1 -@@ -2757,71 +2750,103 @@ SYM_FUNC_START(aesni_xts_crypt8) - pxor INC, STATE4 - movdqu IV, 0x30(OUTP) - -- CALL_NOSPEC r11 -+ call _aesni_enc4 - - movdqu 0x00(OUTP), INC - pxor INC, STATE1 - movdqu STATE1, 0x00(OUTP) - -- _aesni_gf128mul_x_ble() -- movdqa IV, STATE1 -- movdqu 0x40(INP), INC -- pxor INC, STATE1 -- movdqu IV, 0x40(OUTP) -- - movdqu 0x10(OUTP), INC - pxor INC, STATE2 - movdqu STATE2, 0x10(OUTP) - -- _aesni_gf128mul_x_ble() -- movdqa IV, STATE2 -- movdqu 0x50(INP), INC -- pxor INC, STATE2 -- movdqu IV, 0x50(OUTP) -- - movdqu 0x20(OUTP), INC - pxor INC, STATE3 - movdqu STATE3, 0x20(OUTP) - -- _aesni_gf128mul_x_ble() -- movdqa IV, STATE3 -- movdqu 0x60(INP), INC -- pxor INC, STATE3 -- movdqu IV, 0x60(OUTP) -- - movdqu 0x30(OUTP), INC - pxor INC, STATE4 - movdqu STATE4, 0x30(OUTP) - - _aesni_gf128mul_x_ble() -- movdqa IV, STATE4 -- movdqu 0x70(INP), INC -- pxor INC, STATE4 -- movdqu IV, 0x70(OUTP) - -- _aesni_gf128mul_x_ble() -+ add $64, INP -+ add $64, OUTP -+ sub $64, LEN -+ ja .Lxts_enc_loop4 -+ - movups IV, (IVP) - -- CALL_NOSPEC r11 -+ FRAME_END -+ ret -+SYM_FUNC_END(aesni_xts_encrypt) -+ -+/* -+ * void aesni_xts_decrypt(const struct crypto_aes_ctx *ctx, u8 *dst, -+ * const u8 *src, unsigned int len, le128 *iv) -+ */ -+SYM_FUNC_START(aesni_xts_decrypt) -+ FRAME_BEGIN -+ -+ movdqa .Lgf128mul_x_ble_mask, GF128MUL_MASK -+ movups (IVP), IV -+ -+ mov 480(KEYP), KLEN -+ add $240, KEYP - -- movdqu 0x40(OUTP), INC -+.Lxts_dec_loop4: -+ movdqa IV, STATE1 -+ movdqu 0x00(INP), INC - pxor INC, STATE1 -- movdqu STATE1, 0x40(OUTP) -+ movdqu IV, 0x00(OUTP) - -- movdqu 0x50(OUTP), INC -+ _aesni_gf128mul_x_ble() -+ movdqa IV, STATE2 -+ movdqu 0x10(INP), INC -+ pxor INC, STATE2 -+ movdqu IV, 0x10(OUTP) -+ -+ _aesni_gf128mul_x_ble() -+ movdqa IV, STATE3 -+ movdqu 0x20(INP), INC -+ pxor INC, STATE3 -+ movdqu IV, 0x20(OUTP) -+ -+ _aesni_gf128mul_x_ble() -+ movdqa IV, STATE4 -+ movdqu 0x30(INP), INC -+ pxor INC, STATE4 -+ movdqu IV, 0x30(OUTP) -+ -+ call _aesni_dec4 -+ -+ movdqu 0x00(OUTP), INC -+ pxor INC, STATE1 -+ movdqu STATE1, 0x00(OUTP) -+ -+ movdqu 0x10(OUTP), INC - pxor INC, STATE2 -- movdqu STATE2, 0x50(OUTP) -+ movdqu STATE2, 0x10(OUTP) - -- movdqu 0x60(OUTP), INC -+ movdqu 0x20(OUTP), INC - pxor INC, STATE3 -- movdqu STATE3, 0x60(OUTP) -+ movdqu STATE3, 0x20(OUTP) - -- movdqu 0x70(OUTP), INC -+ movdqu 0x30(OUTP), INC - pxor INC, STATE4 -- movdqu STATE4, 0x70(OUTP) -+ movdqu STATE4, 0x30(OUTP) -+ -+ _aesni_gf128mul_x_ble() -+ -+ add $64, INP -+ add $64, OUTP -+ sub $64, LEN -+ ja .Lxts_dec_loop4 -+ -+ movups IV, (IVP) - - FRAME_END - ret --SYM_FUNC_END(aesni_xts_crypt8) -+SYM_FUNC_END(aesni_xts_decrypt) - - #endif -diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c -index f9a1d98e75349..be891fdf8d174 100644 ---- a/arch/x86/crypto/aesni-intel_glue.c -+++ b/arch/x86/crypto/aesni-intel_glue.c -@@ -97,6 +97,12 @@ asmlinkage void aesni_cbc_dec(struct crypto_aes_ctx *ctx, u8 *out, - #define AVX_GEN2_OPTSIZE 640 - #define AVX_GEN4_OPTSIZE 4096 - -+asmlinkage void aesni_xts_encrypt(const struct crypto_aes_ctx *ctx, u8 *out, -+ const u8 *in, unsigned int len, u8 *iv); -+ -+asmlinkage void aesni_xts_decrypt(const struct crypto_aes_ctx *ctx, u8 *out, -+ const u8 *in, unsigned int len, u8 *iv); -+ - #ifdef CONFIG_X86_64 - - static void (*aesni_ctr_enc_tfm)(struct crypto_aes_ctx *ctx, u8 *out, -@@ -104,9 +110,6 @@ static void (*aesni_ctr_enc_tfm)(struct crypto_aes_ctx *ctx, u8 *out, - asmlinkage void aesni_ctr_enc(struct crypto_aes_ctx *ctx, u8 *out, - const u8 *in, unsigned int len, u8 *iv); - --asmlinkage void aesni_xts_crypt8(const struct crypto_aes_ctx *ctx, u8 *out, -- const u8 *in, bool enc, le128 *iv); -- - /* asmlinkage void aesni_gcm_enc() - * void *ctx, AES Key schedule. Starts on a 16 byte boundary. - * struct gcm_context_data. May be uninitialized. -@@ -547,14 +550,14 @@ static void aesni_xts_dec(const void *ctx, u8 *dst, const u8 *src, le128 *iv) - glue_xts_crypt_128bit_one(ctx, dst, src, iv, aesni_dec); - } - --static void aesni_xts_enc8(const void *ctx, u8 *dst, const u8 *src, le128 *iv) -+static void aesni_xts_enc32(const void *ctx, u8 *dst, const u8 *src, le128 *iv) - { -- aesni_xts_crypt8(ctx, dst, src, true, iv); -+ aesni_xts_encrypt(ctx, dst, src, 32 * AES_BLOCK_SIZE, (u8 *)iv); - } - --static void aesni_xts_dec8(const void *ctx, u8 *dst, const u8 *src, le128 *iv) -+static void aesni_xts_dec32(const void *ctx, u8 *dst, const u8 *src, le128 *iv) - { -- aesni_xts_crypt8(ctx, dst, src, false, iv); -+ aesni_xts_decrypt(ctx, dst, src, 32 * AES_BLOCK_SIZE, (u8 *)iv); - } - - static const struct common_glue_ctx aesni_enc_xts = { -@@ -562,8 +565,8 @@ static const struct common_glue_ctx aesni_enc_xts = { - .fpu_blocks_limit = 1, - - .funcs = { { -- .num_blocks = 8, -- .fn_u = { .xts = aesni_xts_enc8 } -+ .num_blocks = 32, -+ .fn_u = { .xts = aesni_xts_enc32 } - }, { - .num_blocks = 1, - .fn_u = { .xts = aesni_xts_enc } -@@ -575,8 +578,8 @@ static const struct common_glue_ctx aesni_dec_xts = { - .fpu_blocks_limit = 1, - - .funcs = { { -- .num_blocks = 8, -- .fn_u = { .xts = aesni_xts_dec8 } -+ .num_blocks = 32, -+ .fn_u = { .xts = aesni_xts_dec32 } - }, { - .num_blocks = 1, - .fn_u = { .xts = aesni_xts_dec } -diff --git a/arch/x86/kvm/mmu/mmu_internal.h b/arch/x86/kvm/mmu/mmu_internal.h -index bfc6389edc28a..cf101b73a3603 100644 ---- a/arch/x86/kvm/mmu/mmu_internal.h -+++ b/arch/x86/kvm/mmu/mmu_internal.h -@@ -76,12 +76,15 @@ static inline struct kvm_mmu_page *sptep_to_sp(u64 *sptep) - static inline bool kvm_vcpu_ad_need_write_protect(struct kvm_vcpu *vcpu) - { - /* -- * When using the EPT page-modification log, the GPAs in the log -- * would come from L2 rather than L1. Therefore, we need to rely -- * on write protection to record dirty pages. This also bypasses -- * PML, since writes now result in a vmexit. -+ * When using the EPT page-modification log, the GPAs in the CPU dirty -+ * log would come from L2 rather than L1. Therefore, we need to rely -+ * on write protection to record dirty pages, which bypasses PML, since -+ * writes now result in a vmexit. Note, the check on CPU dirty logging -+ * being enabled is mandatory as the bits used to denote WP-only SPTEs -+ * are reserved for NPT w/ PAE (32-bit KVM). - */ -- return vcpu->arch.mmu == &vcpu->arch.guest_mmu; -+ return vcpu->arch.mmu == &vcpu->arch.guest_mmu && -+ kvm_x86_ops.cpu_dirty_log_size; - } - - bool is_nx_huge_page_enabled(void); -diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c -index 5492b66a81532..31f8aa2c40ed8 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.c -+++ b/drivers/infiniband/ulp/srp/ib_srp.c -@@ -3628,7 +3628,7 @@ static ssize_t srp_create_target(struct device *dev, - struct srp_rdma_ch *ch; - struct srp_device *srp_dev = host->srp_dev; - struct ib_device *ibdev = srp_dev->dev; -- int ret, node_idx, node, cpu, i; -+ int ret, i, ch_idx; - unsigned int max_sectors_per_mr, mr_per_cmd = 0; - bool multich = false; - uint32_t max_iu_len; -@@ -3753,81 +3753,61 @@ static ssize_t srp_create_target(struct device *dev, - goto out; - - ret = -ENOMEM; -- if (target->ch_count == 0) -+ if (target->ch_count == 0) { - target->ch_count = -- max_t(unsigned int, num_online_nodes(), -- min(ch_count ?: -- min(4 * num_online_nodes(), -- ibdev->num_comp_vectors), -- num_online_cpus())); -+ min(ch_count ?: -+ max(4 * num_online_nodes(), -+ ibdev->num_comp_vectors), -+ num_online_cpus()); -+ } -+ - target->ch = kcalloc(target->ch_count, sizeof(*target->ch), - GFP_KERNEL); - if (!target->ch) - goto out; - -- node_idx = 0; -- for_each_online_node(node) { -- const int ch_start = (node_idx * target->ch_count / -- num_online_nodes()); -- const int ch_end = ((node_idx + 1) * target->ch_count / -- num_online_nodes()); -- const int cv_start = node_idx * ibdev->num_comp_vectors / -- num_online_nodes(); -- const int cv_end = (node_idx + 1) * ibdev->num_comp_vectors / -- num_online_nodes(); -- int cpu_idx = 0; -- -- for_each_online_cpu(cpu) { -- if (cpu_to_node(cpu) != node) -- continue; -- if (ch_start + cpu_idx >= ch_end) -- continue; -- ch = &target->ch[ch_start + cpu_idx]; -- ch->target = target; -- ch->comp_vector = cv_start == cv_end ? cv_start : -- cv_start + cpu_idx % (cv_end - cv_start); -- spin_lock_init(&ch->lock); -- INIT_LIST_HEAD(&ch->free_tx); -- ret = srp_new_cm_id(ch); -- if (ret) -- goto err_disconnect; -+ for (ch_idx = 0; ch_idx < target->ch_count; ++ch_idx) { -+ ch = &target->ch[ch_idx]; -+ ch->target = target; -+ ch->comp_vector = ch_idx % ibdev->num_comp_vectors; -+ spin_lock_init(&ch->lock); -+ INIT_LIST_HEAD(&ch->free_tx); -+ ret = srp_new_cm_id(ch); -+ if (ret) -+ goto err_disconnect; - -- ret = srp_create_ch_ib(ch); -- if (ret) -- goto err_disconnect; -+ ret = srp_create_ch_ib(ch); -+ if (ret) -+ goto err_disconnect; - -- ret = srp_alloc_req_data(ch); -- if (ret) -- goto err_disconnect; -+ ret = srp_alloc_req_data(ch); -+ if (ret) -+ goto err_disconnect; - -- ret = srp_connect_ch(ch, max_iu_len, multich); -- if (ret) { -- char dst[64]; -- -- if (target->using_rdma_cm) -- snprintf(dst, sizeof(dst), "%pIS", -- &target->rdma_cm.dst); -- else -- snprintf(dst, sizeof(dst), "%pI6", -- target->ib_cm.orig_dgid.raw); -- shost_printk(KERN_ERR, target->scsi_host, -- PFX "Connection %d/%d to %s failed\n", -- ch_start + cpu_idx, -- target->ch_count, dst); -- if (node_idx == 0 && cpu_idx == 0) { -- goto free_ch; -- } else { -- srp_free_ch_ib(target, ch); -- srp_free_req_data(target, ch); -- target->ch_count = ch - target->ch; -- goto connected; -- } -- } -+ ret = srp_connect_ch(ch, max_iu_len, multich); -+ if (ret) { -+ char dst[64]; - -- multich = true; -- cpu_idx++; -+ if (target->using_rdma_cm) -+ snprintf(dst, sizeof(dst), "%pIS", -+ &target->rdma_cm.dst); -+ else -+ snprintf(dst, sizeof(dst), "%pI6", -+ target->ib_cm.orig_dgid.raw); -+ shost_printk(KERN_ERR, target->scsi_host, -+ PFX "Connection %d/%d to %s failed\n", -+ ch_idx, -+ target->ch_count, dst); -+ if (ch_idx == 0) { -+ goto free_ch; -+ } else { -+ srp_free_ch_ib(target, ch); -+ srp_free_req_data(target, ch); -+ target->ch_count = ch - target->ch; -+ goto connected; -+ } - } -- node_idx++; -+ multich = true; - } - - connected: -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index 95c7fa171e35a..f504b6858ed29 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -510,6 +510,19 @@ void b53_imp_vlan_setup(struct dsa_switch *ds, int cpu_port) - } - EXPORT_SYMBOL(b53_imp_vlan_setup); - -+static void b53_port_set_learning(struct b53_device *dev, int port, -+ bool learning) -+{ -+ u16 reg; -+ -+ b53_read16(dev, B53_CTRL_PAGE, B53_DIS_LEARNING, ®); -+ if (learning) -+ reg &= ~BIT(port); -+ else -+ reg |= BIT(port); -+ b53_write16(dev, B53_CTRL_PAGE, B53_DIS_LEARNING, reg); -+} -+ - int b53_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy) - { - struct b53_device *dev = ds->priv; -@@ -523,6 +536,7 @@ int b53_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy) - cpu_port = dsa_to_port(ds, port)->cpu_dp->index; - - b53_br_egress_floods(ds, port, true, true); -+ b53_port_set_learning(dev, port, false); - - if (dev->ops->irq_enable) - ret = dev->ops->irq_enable(dev, port); -@@ -656,6 +670,7 @@ static void b53_enable_cpu_port(struct b53_device *dev, int port) - b53_brcm_hdr_setup(dev->ds, port); - - b53_br_egress_floods(dev->ds, port, true, true); -+ b53_port_set_learning(dev, port, false); - } - - static void b53_enable_mib(struct b53_device *dev) -@@ -1839,6 +1854,8 @@ int b53_br_join(struct dsa_switch *ds, int port, struct net_device *br) - b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(port), pvlan); - dev->ports[port].vlan_ctl_mask = pvlan; - -+ b53_port_set_learning(dev, port, true); -+ - return 0; - } - EXPORT_SYMBOL(b53_br_join); -@@ -1886,6 +1903,7 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct net_device *br) - vl->untag |= BIT(port) | BIT(cpu_port); - b53_set_vlan_entry(dev, pvid, vl); - } -+ b53_port_set_learning(dev, port, false); - } - EXPORT_SYMBOL(b53_br_leave); - -diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h -index c90985c294a2e..b2c539a421545 100644 ---- a/drivers/net/dsa/b53/b53_regs.h -+++ b/drivers/net/dsa/b53/b53_regs.h -@@ -115,6 +115,7 @@ - #define B53_UC_FLOOD_MASK 0x32 - #define B53_MC_FLOOD_MASK 0x34 - #define B53_IPMC_FLOOD_MASK 0x36 -+#define B53_DIS_LEARNING 0x3c - - /* - * Override Ports 0-7 State on devices with xMII interfaces (8 bit) -diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c -index 445226720ff29..edb0a1027b38f 100644 ---- a/drivers/net/dsa/bcm_sf2.c -+++ b/drivers/net/dsa/bcm_sf2.c -@@ -222,23 +222,10 @@ static int bcm_sf2_port_setup(struct dsa_switch *ds, int port, - reg &= ~P_TXQ_PSM_VDD(port); - core_writel(priv, reg, CORE_MEM_PSM_VDD_CTRL); - -- /* Enable learning */ -- reg = core_readl(priv, CORE_DIS_LEARN); -- reg &= ~BIT(port); -- core_writel(priv, reg, CORE_DIS_LEARN); -- - /* Enable Broadcom tags for that port if requested */ -- if (priv->brcm_tag_mask & BIT(port)) { -+ if (priv->brcm_tag_mask & BIT(port)) - b53_brcm_hdr_setup(ds, port); - -- /* Disable learning on ASP port */ -- if (port == 7) { -- reg = core_readl(priv, CORE_DIS_LEARN); -- reg |= BIT(port); -- core_writel(priv, reg, CORE_DIS_LEARN); -- } -- } -- - /* Configure Traffic Class to QoS mapping, allow each priority to map - * to a different queue number - */ -diff --git a/drivers/regulator/pca9450-regulator.c b/drivers/regulator/pca9450-regulator.c -index cb29421d745aa..d38109cc3a011 100644 ---- a/drivers/regulator/pca9450-regulator.c -+++ b/drivers/regulator/pca9450-regulator.c -@@ -5,6 +5,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -32,6 +33,7 @@ struct pca9450_regulator_desc { - struct pca9450 { - struct device *dev; - struct regmap *regmap; -+ struct gpio_desc *sd_vsel_gpio; - enum pca9450_chip_type type; - unsigned int rcnt; - int irq; -@@ -795,6 +797,34 @@ static int pca9450_i2c_probe(struct i2c_client *i2c, - return ret; - } - -+ /* Clear PRESET_EN bit in BUCK123_DVS to use DVS registers */ -+ ret = regmap_clear_bits(pca9450->regmap, PCA9450_REG_BUCK123_DVS, -+ BUCK123_PRESET_EN); -+ if (ret) { -+ dev_err(&i2c->dev, "Failed to clear PRESET_EN bit: %d\n", ret); -+ return ret; -+ } -+ -+ /* Set reset behavior on assertion of WDOG_B signal */ -+ ret = regmap_update_bits(pca9450->regmap, PCA9450_REG_RESET_CTRL, -+ WDOG_B_CFG_MASK, WDOG_B_CFG_COLD_LDO12); -+ if (ret) { -+ dev_err(&i2c->dev, "Failed to set WDOG_B reset behavior\n"); -+ return ret; -+ } -+ -+ /* -+ * The driver uses the LDO5CTRL_H register to control the LDO5 regulator. -+ * This is only valid if the SD_VSEL input of the PMIC is high. Let's -+ * check if the pin is available as GPIO and set it to high. -+ */ -+ pca9450->sd_vsel_gpio = gpiod_get_optional(pca9450->dev, "sd-vsel", GPIOD_OUT_HIGH); -+ -+ if (IS_ERR(pca9450->sd_vsel_gpio)) { -+ dev_err(&i2c->dev, "Failed to get SD_VSEL GPIO\n"); -+ return ret; -+ } -+ - dev_info(&i2c->dev, "%s probed.\n", - type == PCA9450_TYPE_PCA9450A ? "pca9450a" : "pca9450bc"); - -diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h -index 7c4b8cb93f9fd..103dfc2fa62ee 100644 ---- a/fs/fuse/fuse_i.h -+++ b/fs/fuse/fuse_i.h -@@ -863,6 +863,7 @@ static inline u64 fuse_get_attr_version(struct fuse_conn *fc) - - static inline void fuse_make_bad(struct inode *inode) - { -+ remove_inode_hash(inode); - set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); - } - -diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c -index 61fce59cb4d38..f2c6bbe5cdb81 100644 ---- a/fs/gfs2/ops_fstype.c -+++ b/fs/gfs2/ops_fstype.c -@@ -1084,6 +1084,7 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc) - int silent = fc->sb_flags & SB_SILENT; - struct gfs2_sbd *sdp; - struct gfs2_holder mount_gh; -+ struct gfs2_holder freeze_gh; - int error; - - sdp = init_sbd(sb); -@@ -1195,25 +1196,18 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc) - goto fail_per_node; - } - -- if (sb_rdonly(sb)) { -- struct gfs2_holder freeze_gh; -+ error = gfs2_freeze_lock(sdp, &freeze_gh, 0); -+ if (error) -+ goto fail_per_node; - -- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, -- LM_FLAG_NOEXP | GL_EXACT, -- &freeze_gh); -- if (error) { -- fs_err(sdp, "can't make FS RO: %d\n", error); -- goto fail_per_node; -- } -- gfs2_glock_dq_uninit(&freeze_gh); -- } else { -+ if (!sb_rdonly(sb)) - error = gfs2_make_fs_rw(sdp); -- if (error) { -- fs_err(sdp, "can't make FS RW: %d\n", error); -- goto fail_per_node; -- } -- } - -+ gfs2_freeze_unlock(&freeze_gh); -+ if (error) { -+ fs_err(sdp, "can't make FS RW: %d\n", error); -+ goto fail_per_node; -+ } - gfs2_glock_dq_uninit(&mount_gh); - gfs2_online_uevent(sdp); - return 0; -@@ -1514,6 +1508,12 @@ static int gfs2_reconfigure(struct fs_context *fc) - fc->sb_flags |= SB_RDONLY; - - if ((sb->s_flags ^ fc->sb_flags) & SB_RDONLY) { -+ struct gfs2_holder freeze_gh; -+ -+ error = gfs2_freeze_lock(sdp, &freeze_gh, 0); -+ if (error) -+ return -EINVAL; -+ - if (fc->sb_flags & SB_RDONLY) { - error = gfs2_make_fs_ro(sdp); - if (error) -@@ -1523,6 +1523,7 @@ static int gfs2_reconfigure(struct fs_context *fc) - if (error) - errorfc(fc, "unable to remount read-write"); - } -+ gfs2_freeze_unlock(&freeze_gh); - } - sdp->sd_args = *newargs; - -diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c -index a3c1911862f01..8f9c6480a5df4 100644 ---- a/fs/gfs2/recovery.c -+++ b/fs/gfs2/recovery.c -@@ -470,9 +470,7 @@ void gfs2_recover_func(struct work_struct *work) - - /* Acquire a shared hold on the freeze lock */ - -- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, -- LM_FLAG_NOEXP | LM_FLAG_PRIORITY | -- GL_EXACT, &thaw_gh); -+ error = gfs2_freeze_lock(sdp, &thaw_gh, LM_FLAG_PRIORITY); - if (error) - goto fail_gunlock_ji; - -@@ -524,7 +522,7 @@ void gfs2_recover_func(struct work_struct *work) - clean_journal(jd, &head); - up_read(&sdp->sd_log_flush_lock); - -- gfs2_glock_dq_uninit(&thaw_gh); -+ gfs2_freeze_unlock(&thaw_gh); - t_rep = ktime_get(); - fs_info(sdp, "jid=%u: Journal replayed in %lldms [jlck:%lldms, " - "jhead:%lldms, tlck:%lldms, replay:%lldms]\n", -@@ -546,7 +544,7 @@ void gfs2_recover_func(struct work_struct *work) - goto done; - - fail_gunlock_thaw: -- gfs2_glock_dq_uninit(&thaw_gh); -+ gfs2_freeze_unlock(&thaw_gh); - fail_gunlock_ji: - if (jlocked) { - gfs2_glock_dq_uninit(&ji_gh); -diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c -index 2f56acc41c049..754ea2a137b4f 100644 ---- a/fs/gfs2/super.c -+++ b/fs/gfs2/super.c -@@ -165,7 +165,6 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) - { - struct gfs2_inode *ip = GFS2_I(sdp->sd_jdesc->jd_inode); - struct gfs2_glock *j_gl = ip->i_gl; -- struct gfs2_holder freeze_gh; - struct gfs2_log_header_host head; - int error; - -@@ -173,12 +172,6 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) - if (error) - return error; - -- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, -- LM_FLAG_NOEXP | GL_EXACT, -- &freeze_gh); -- if (error) -- goto fail_threads; -- - j_gl->gl_ops->go_inval(j_gl, DIO_METADATA); - if (gfs2_withdrawn(sdp)) { - error = -EIO; -@@ -205,13 +198,9 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) - - set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); - -- gfs2_glock_dq_uninit(&freeze_gh); -- - return 0; - - fail: -- gfs2_glock_dq_uninit(&freeze_gh); --fail_threads: - if (sdp->sd_quotad_process) - kthread_stop(sdp->sd_quotad_process); - sdp->sd_quotad_process = NULL; -@@ -452,7 +441,7 @@ static int gfs2_lock_fs_check_clean(struct gfs2_sbd *sdp) - } - - if (error) -- gfs2_glock_dq_uninit(&sdp->sd_freeze_gh); -+ gfs2_freeze_unlock(&sdp->sd_freeze_gh); - - out: - while (!list_empty(&list)) { -@@ -609,30 +598,9 @@ out: - - int gfs2_make_fs_ro(struct gfs2_sbd *sdp) - { -- struct gfs2_holder freeze_gh; - int error = 0; - int log_write_allowed = test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); - -- gfs2_holder_mark_uninitialized(&freeze_gh); -- if (sdp->sd_freeze_gl && -- !gfs2_glock_is_locked_by_me(sdp->sd_freeze_gl)) { -- if (!log_write_allowed) { -- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, -- LM_ST_SHARED, LM_FLAG_TRY | -- LM_FLAG_NOEXP | GL_EXACT, -- &freeze_gh); -- if (error == GLR_TRYFAILED) -- error = 0; -- } else { -- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, -- LM_ST_SHARED, -- LM_FLAG_NOEXP | GL_EXACT, -- &freeze_gh); -- if (error && !gfs2_withdrawn(sdp)) -- return error; -- } -- } -- - gfs2_flush_delete_work(sdp); - if (!log_write_allowed && current == sdp->sd_quotad_process) - fs_warn(sdp, "The quotad daemon is withdrawing.\n"); -@@ -661,9 +629,6 @@ int gfs2_make_fs_ro(struct gfs2_sbd *sdp) - atomic_read(&sdp->sd_reserving_log) == 0, - HZ * 5); - } -- if (gfs2_holder_initialized(&freeze_gh)) -- gfs2_glock_dq_uninit(&freeze_gh); -- - gfs2_quota_cleanup(sdp); - - if (!log_write_allowed) -@@ -772,10 +737,8 @@ void gfs2_freeze_func(struct work_struct *work) - struct super_block *sb = sdp->sd_vfs; - - atomic_inc(&sb->s_active); -- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, -- LM_FLAG_NOEXP | GL_EXACT, &freeze_gh); -+ error = gfs2_freeze_lock(sdp, &freeze_gh, 0); - if (error) { -- fs_info(sdp, "GFS2: couldn't get freeze lock : %d\n", error); - gfs2_assert_withdraw(sdp, 0); - } else { - atomic_set(&sdp->sd_freeze_state, SFS_UNFROZEN); -@@ -785,7 +748,7 @@ void gfs2_freeze_func(struct work_struct *work) - error); - gfs2_assert_withdraw(sdp, 0); - } -- gfs2_glock_dq_uninit(&freeze_gh); -+ gfs2_freeze_unlock(&freeze_gh); - } - deactivate_super(sb); - clear_bit_unlock(SDF_FS_FROZEN, &sdp->sd_flags); -@@ -853,7 +816,7 @@ static int gfs2_unfreeze(struct super_block *sb) - return 0; - } - -- gfs2_glock_dq_uninit(&sdp->sd_freeze_gh); -+ gfs2_freeze_unlock(&sdp->sd_freeze_gh); - mutex_unlock(&sdp->sd_freeze_mutex); - return wait_on_bit(&sdp->sd_flags, SDF_FS_FROZEN, TASK_INTERRUPTIBLE); - } -diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c -index 574bea29f21ee..dc4985429cf2d 100644 ---- a/fs/gfs2/util.c -+++ b/fs/gfs2/util.c -@@ -91,19 +91,50 @@ out_unlock: - return error; - } - -+/** -+ * gfs2_freeze_lock - hold the freeze glock -+ * @sdp: the superblock -+ * @freeze_gh: pointer to the requested holder -+ * @caller_flags: any additional flags needed by the caller -+ */ -+int gfs2_freeze_lock(struct gfs2_sbd *sdp, struct gfs2_holder *freeze_gh, -+ int caller_flags) -+{ -+ int flags = LM_FLAG_NOEXP | GL_EXACT | caller_flags; -+ int error; -+ -+ error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, flags, -+ freeze_gh); -+ if (error && error != GLR_TRYFAILED) -+ fs_err(sdp, "can't lock the freeze lock: %d\n", error); -+ return error; -+} -+ -+void gfs2_freeze_unlock(struct gfs2_holder *freeze_gh) -+{ -+ if (gfs2_holder_initialized(freeze_gh)) -+ gfs2_glock_dq_uninit(freeze_gh); -+} -+ - static void signal_our_withdraw(struct gfs2_sbd *sdp) - { - struct gfs2_glock *live_gl = sdp->sd_live_gh.gh_gl; -- struct inode *inode = sdp->sd_jdesc->jd_inode; -- struct gfs2_inode *ip = GFS2_I(inode); -- struct gfs2_glock *i_gl = ip->i_gl; -- u64 no_formal_ino = ip->i_no_formal_ino; -+ struct inode *inode; -+ struct gfs2_inode *ip; -+ struct gfs2_glock *i_gl; -+ u64 no_formal_ino; -+ int log_write_allowed = test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); - int ret = 0; - int tries; - -- if (test_bit(SDF_NORECOVERY, &sdp->sd_flags)) -+ if (test_bit(SDF_NORECOVERY, &sdp->sd_flags) || !sdp->sd_jdesc) - return; - -+ inode = sdp->sd_jdesc->jd_inode; -+ ip = GFS2_I(inode); -+ i_gl = ip->i_gl; -+ no_formal_ino = ip->i_no_formal_ino; -+ - /* Prevent any glock dq until withdraw recovery is complete */ - set_bit(SDF_WITHDRAW_RECOVERY, &sdp->sd_flags); - /* -@@ -118,8 +149,21 @@ static void signal_our_withdraw(struct gfs2_sbd *sdp) - * therefore we need to clear SDF_JOURNAL_LIVE manually. - */ - clear_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); -- if (!sb_rdonly(sdp->sd_vfs)) -- ret = gfs2_make_fs_ro(sdp); -+ if (!sb_rdonly(sdp->sd_vfs)) { -+ struct gfs2_holder freeze_gh; -+ -+ gfs2_holder_mark_uninitialized(&freeze_gh); -+ if (sdp->sd_freeze_gl && -+ !gfs2_glock_is_locked_by_me(sdp->sd_freeze_gl)) { -+ ret = gfs2_freeze_lock(sdp, &freeze_gh, -+ log_write_allowed ? 0 : LM_FLAG_TRY); -+ if (ret == GLR_TRYFAILED) -+ ret = 0; -+ } -+ if (!ret) -+ ret = gfs2_make_fs_ro(sdp); -+ gfs2_freeze_unlock(&freeze_gh); -+ } - - if (sdp->sd_lockstruct.ls_ops->lm_lock == NULL) { /* lock_nolock */ - if (!ret) -diff --git a/fs/gfs2/util.h b/fs/gfs2/util.h -index a4443dd8a94b9..69e1a0ae5a4dc 100644 ---- a/fs/gfs2/util.h -+++ b/fs/gfs2/util.h -@@ -149,6 +149,9 @@ int gfs2_io_error_i(struct gfs2_sbd *sdp, const char *function, - - extern int check_journal_clean(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd, - bool verbose); -+extern int gfs2_freeze_lock(struct gfs2_sbd *sdp, -+ struct gfs2_holder *freeze_gh, int caller_flags); -+extern void gfs2_freeze_unlock(struct gfs2_holder *freeze_gh); - - #define gfs2_io_error(sdp) \ - gfs2_io_error_i((sdp), __func__, __FILE__, __LINE__) -diff --git a/fs/io_uring.c b/fs/io_uring.c -index 00ef0b90d1491..262fd4cfd3ad5 100644 ---- a/fs/io_uring.c -+++ b/fs/io_uring.c -@@ -1823,18 +1823,22 @@ static bool __io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force, - return all_flushed; - } - --static void io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force, -+static bool io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force, - struct task_struct *tsk, - struct files_struct *files) - { -+ bool ret = true; -+ - if (test_bit(0, &ctx->cq_check_overflow)) { - /* iopoll syncs against uring_lock, not completion_lock */ - if (ctx->flags & IORING_SETUP_IOPOLL) - mutex_lock(&ctx->uring_lock); -- __io_cqring_overflow_flush(ctx, force, tsk, files); -+ ret = __io_cqring_overflow_flush(ctx, force, tsk, files); - if (ctx->flags & IORING_SETUP_IOPOLL) - mutex_unlock(&ctx->uring_lock); - } -+ -+ return ret; - } - - static void __io_cqring_fill_event(struct io_kiocb *req, long res, long cflags) -@@ -2717,6 +2721,13 @@ static bool io_rw_reissue(struct io_kiocb *req, long res) - return false; - if ((res != -EAGAIN && res != -EOPNOTSUPP) || io_wq_current_is_worker()) - return false; -+ /* -+ * If ref is dying, we might be running poll reap from the exit work. -+ * Don't attempt to reissue from that path, just let it fail with -+ * -EAGAIN. -+ */ -+ if (percpu_ref_is_dying(&req->ctx->refs)) -+ return false; - - lockdep_assert_held(&req->ctx->uring_lock); - -@@ -3507,7 +3518,6 @@ static int io_read(struct io_kiocb *req, bool force_nonblock, - else - kiocb->ki_flags |= IOCB_NOWAIT; - -- - /* If the file doesn't support async, just async punt */ - no_async = force_nonblock && !io_file_supports_async(req->file, READ); - if (no_async) -@@ -3519,9 +3529,7 @@ static int io_read(struct io_kiocb *req, bool force_nonblock, - - ret = io_iter_do_read(req, iter); - -- if (!ret) { -- goto done; -- } else if (ret == -EIOCBQUEUED) { -+ if (ret == -EIOCBQUEUED) { - ret = 0; - goto out_free; - } else if (ret == -EAGAIN) { -@@ -3535,7 +3543,7 @@ static int io_read(struct io_kiocb *req, bool force_nonblock, - iov_iter_revert(iter, io_size - iov_iter_count(iter)); - ret = 0; - goto copy_iov; -- } else if (ret < 0) { -+ } else if (ret <= 0) { - /* make sure -ERESTARTSYS -> -EINTR is done */ - goto done; - } -@@ -3579,6 +3587,7 @@ retry: - goto out_free; - } else if (ret > 0 && ret < io_size) { - /* we got some bytes, but not all. retry. */ -+ kiocb->ki_flags &= ~IOCB_WAITQ; - goto retry; - } - done: -@@ -7201,6 +7210,25 @@ static int io_run_task_work_sig(void) - return -EINTR; - } - -+/* when returns >0, the caller should retry */ -+static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx, -+ struct io_wait_queue *iowq, -+ signed long *timeout) -+{ -+ int ret; -+ -+ /* make sure we run task_work before checking for signals */ -+ ret = io_run_task_work_sig(); -+ if (ret || io_should_wake(iowq)) -+ return ret; -+ /* let the caller flush overflows, retry */ -+ if (test_bit(0, &ctx->cq_check_overflow)) -+ return 1; -+ -+ *timeout = schedule_timeout(*timeout); -+ return !*timeout ? -ETIME : 1; -+} -+ - /* - * Wait until events become available, if we don't already have some. The - * application must reap them itself, as they reside on the shared cq ring. -@@ -7219,9 +7247,8 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, - .to_wait = min_events, - }; - struct io_rings *rings = ctx->rings; -- struct timespec64 ts; -- signed long timeout = 0; -- int ret = 0; -+ signed long timeout = MAX_SCHEDULE_TIMEOUT; -+ int ret; - - do { - io_cqring_overflow_flush(ctx, false, NULL, NULL); -@@ -7245,6 +7272,8 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, - } - - if (uts) { -+ struct timespec64 ts; -+ - if (get_timespec64(&ts, uts)) - return -EFAULT; - timeout = timespec64_to_jiffies(&ts); -@@ -7253,34 +7282,17 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, - iowq.nr_timeouts = atomic_read(&ctx->cq_timeouts); - trace_io_uring_cqring_wait(ctx, min_events); - do { -- io_cqring_overflow_flush(ctx, false, NULL, NULL); -- prepare_to_wait_exclusive(&ctx->wait, &iowq.wq, -- TASK_INTERRUPTIBLE); -- /* make sure we run task_work before checking for signals */ -- ret = io_run_task_work_sig(); -- if (ret > 0) { -- finish_wait(&ctx->wait, &iowq.wq); -- continue; -- } -- else if (ret < 0) -+ /* if we can't even flush overflow, don't wait for more */ -+ if (!io_cqring_overflow_flush(ctx, false, NULL, NULL)) { -+ ret = -EBUSY; - break; -- if (io_should_wake(&iowq)) -- break; -- if (test_bit(0, &ctx->cq_check_overflow)) { -- finish_wait(&ctx->wait, &iowq.wq); -- continue; - } -- if (uts) { -- timeout = schedule_timeout(timeout); -- if (timeout == 0) { -- ret = -ETIME; -- break; -- } -- } else { -- schedule(); -- } -- } while (1); -- finish_wait(&ctx->wait, &iowq.wq); -+ prepare_to_wait_exclusive(&ctx->wait, &iowq.wq, -+ TASK_INTERRUPTIBLE); -+ ret = io_cqring_wait_schedule(ctx, &iowq, &timeout); -+ finish_wait(&ctx->wait, &iowq.wq); -+ cond_resched(); -+ } while (ret > 0); - - restore_saved_sigmask_unless(ret == -EINTR); - -diff --git a/fs/locks.c b/fs/locks.c -index 99ca97e81b7a9..6125d2de39b8b 100644 ---- a/fs/locks.c -+++ b/fs/locks.c -@@ -1808,9 +1808,6 @@ check_conflicting_open(struct file *filp, const long arg, int flags) - - if (flags & FL_LAYOUT) - return 0; -- if (flags & FL_DELEG) -- /* We leave these checks to the caller. */ -- return 0; - - if (arg == F_RDLCK) - return inode_is_open_for_write(inode) ? -EAGAIN : 0; -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 1d2cd6a88f61d..cf8b91b1ed373 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -4945,31 +4945,6 @@ static struct file_lock *nfs4_alloc_init_lease(struct nfs4_delegation *dp, - return fl; - } - --static int nfsd4_check_conflicting_opens(struct nfs4_client *clp, -- struct nfs4_file *fp) --{ -- struct nfs4_clnt_odstate *co; -- struct file *f = fp->fi_deleg_file->nf_file; -- struct inode *ino = locks_inode(f); -- int writes = atomic_read(&ino->i_writecount); -- -- if (fp->fi_fds[O_WRONLY]) -- writes--; -- if (fp->fi_fds[O_RDWR]) -- writes--; -- if (writes > 0) -- return -EAGAIN; -- spin_lock(&fp->fi_lock); -- list_for_each_entry(co, &fp->fi_clnt_odstate, co_perfile) { -- if (co->co_client != clp) { -- spin_unlock(&fp->fi_lock); -- return -EAGAIN; -- } -- } -- spin_unlock(&fp->fi_lock); -- return 0; --} -- - static struct nfs4_delegation * - nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh, - struct nfs4_file *fp, struct nfs4_clnt_odstate *odstate) -@@ -4989,12 +4964,9 @@ nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh, - - nf = find_readable_file(fp); - if (!nf) { -- /* -- * We probably could attempt another open and get a read -- * delegation, but for now, don't bother until the -- * client actually sends us one. -- */ -- return ERR_PTR(-EAGAIN); -+ /* We should always have a readable file here */ -+ WARN_ON_ONCE(1); -+ return ERR_PTR(-EBADF); - } - spin_lock(&state_lock); - spin_lock(&fp->fi_lock); -@@ -5024,19 +4996,11 @@ nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh, - if (!fl) - goto out_clnt_odstate; - -- status = nfsd4_check_conflicting_opens(clp, fp); -- if (status) { -- locks_free_lock(fl); -- goto out_clnt_odstate; -- } - status = vfs_setlease(fp->fi_deleg_file->nf_file, fl->fl_type, &fl, NULL); - if (fl) - locks_free_lock(fl); - if (status) - goto out_clnt_odstate; -- status = nfsd4_check_conflicting_opens(clp, fp); -- if (status) -- goto out_clnt_odstate; - - spin_lock(&state_lock); - spin_lock(&fp->fi_lock); -@@ -5118,6 +5082,17 @@ nfs4_open_delegation(struct svc_fh *fh, struct nfsd4_open *open, - goto out_no_deleg; - if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED)) - goto out_no_deleg; -+ /* -+ * Also, if the file was opened for write or -+ * create, there's a good chance the client's -+ * about to write to it, resulting in an -+ * immediate recall (since we don't support -+ * write delegations): -+ */ -+ if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE) -+ goto out_no_deleg; -+ if (open->op_create == NFS4_OPEN_CREATE) -+ goto out_no_deleg; - break; - default: - goto out_no_deleg; -diff --git a/include/linux/regulator/pca9450.h b/include/linux/regulator/pca9450.h -index 1bbd3014f9067..71902f41c9199 100644 ---- a/include/linux/regulator/pca9450.h -+++ b/include/linux/regulator/pca9450.h -@@ -147,6 +147,9 @@ enum { - #define BUCK6_FPWM 0x04 - #define BUCK6_ENMODE_MASK 0x03 - -+/* PCA9450_REG_BUCK123_PRESET_EN bit */ -+#define BUCK123_PRESET_EN 0x80 -+ - /* PCA9450_BUCK1OUT_DVS0 bits */ - #define BUCK1OUT_DVS0_MASK 0x7F - #define BUCK1OUT_DVS0_DEFAULT 0x14 -@@ -216,4 +219,11 @@ enum { - #define IRQ_THERM_105 0x02 - #define IRQ_THERM_125 0x01 - -+/* PCA9450_REG_RESET_CTRL bits */ -+#define WDOG_B_CFG_MASK 0xC0 -+#define WDOG_B_CFG_NONE 0x00 -+#define WDOG_B_CFG_WARM 0x40 -+#define WDOG_B_CFG_COLD_LDO12 0x80 -+#define WDOG_B_CFG_COLD 0xC0 -+ - #endif /* __LINUX_REG_PCA9450_H__ */ -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 33683eafea90e..ab23dfb9df1b1 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -5389,10 +5389,14 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, - { - bool mask_to_left = (opcode == BPF_ADD && off_is_neg) || - (opcode == BPF_SUB && !off_is_neg); -- u32 off; -+ u32 off, max; - - switch (ptr_reg->type) { - case PTR_TO_STACK: -+ /* Offset 0 is out-of-bounds, but acceptable start for the -+ * left direction, see BPF_REG_FP. -+ */ -+ max = MAX_BPF_STACK + mask_to_left; - /* Indirect variable offset stack access is prohibited in - * unprivileged mode so it's not handled here. - */ -@@ -5400,16 +5404,17 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, - if (mask_to_left) - *ptr_limit = MAX_BPF_STACK + off; - else -- *ptr_limit = -off; -- return 0; -+ *ptr_limit = -off - 1; -+ return *ptr_limit >= max ? -ERANGE : 0; - case PTR_TO_MAP_VALUE: -+ max = ptr_reg->map_ptr->value_size; - if (mask_to_left) { - *ptr_limit = ptr_reg->umax_value + ptr_reg->off; - } else { - off = ptr_reg->smin_value + ptr_reg->off; -- *ptr_limit = ptr_reg->map_ptr->value_size - off; -+ *ptr_limit = ptr_reg->map_ptr->value_size - off - 1; - } -- return 0; -+ return *ptr_limit >= max ? -ERANGE : 0; - default: - return -EINVAL; - } -@@ -5462,6 +5467,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, - u32 alu_state, alu_limit; - struct bpf_reg_state tmp; - bool ret; -+ int err; - - if (can_skip_alu_sanitation(env, insn)) - return 0; -@@ -5477,10 +5483,13 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, - alu_state |= ptr_is_dst_reg ? - BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST; - -- if (retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg)) -- return 0; -- if (update_alu_sanitation_state(aux, alu_state, alu_limit)) -- return -EACCES; -+ err = retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg); -+ if (err < 0) -+ return err; -+ -+ err = update_alu_sanitation_state(aux, alu_state, alu_limit); -+ if (err < 0) -+ return err; - do_sim: - /* Simulate and find potential out-of-bounds access under - * speculative execution from truncation as a result of -@@ -5596,7 +5605,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, - case BPF_ADD: - ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0); - if (ret < 0) { -- verbose(env, "R%d tried to add from different maps or paths\n", dst); -+ verbose(env, "R%d tried to add from different maps, paths, or prohibited types\n", dst); - return ret; - } - /* We can take a fixed offset as long as it doesn't overflow -@@ -5651,7 +5660,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, - case BPF_SUB: - ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0); - if (ret < 0) { -- verbose(env, "R%d tried to sub from different maps or paths\n", dst); -+ verbose(env, "R%d tried to sub from different maps, paths, or prohibited types\n", dst); - return ret; - } - if (dst_reg == off_reg) { -@@ -11079,7 +11088,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) - off_reg = issrc ? insn->src_reg : insn->dst_reg; - if (isneg) - *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1); -- *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1); -+ *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit); - *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg); - *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg); - *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0); -diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c -index da2ed576f2899..1c01c3bcbf5aa 100644 ---- a/net/mptcp/pm.c -+++ b/net/mptcp/pm.c -@@ -20,6 +20,8 @@ int mptcp_pm_announce_addr(struct mptcp_sock *msk, - - pr_debug("msk=%p, local_id=%d", msk, addr->id); - -+ lockdep_assert_held(&msk->pm.lock); -+ - if (add_addr) { - pr_warn("addr_signal error, add_addr=%d", add_addr); - return -EINVAL; -@@ -188,8 +190,7 @@ void mptcp_pm_add_addr_received(struct mptcp_sock *msk, - - void mptcp_pm_add_addr_send_ack(struct mptcp_sock *msk) - { -- if (!mptcp_pm_should_add_signal_ipv6(msk) && -- !mptcp_pm_should_add_signal_port(msk)) -+ if (!mptcp_pm_should_add_signal(msk)) - return; - - mptcp_pm_schedule_work(msk, MPTCP_PM_ADD_ADDR_SEND_ACK); -diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c -index a6d983d80576a..71c41b9488619 100644 ---- a/net/mptcp/pm_netlink.c -+++ b/net/mptcp/pm_netlink.c -@@ -134,6 +134,8 @@ select_local_address(const struct pm_nl_pernet *pernet, - { - struct mptcp_pm_addr_entry *entry, *ret = NULL; - -+ msk_owned_by_me(msk); -+ - rcu_read_lock(); - __mptcp_flush_join_list(msk); - list_for_each_entry_rcu(entry, &pernet->local_addr_list, list) { -@@ -191,6 +193,8 @@ lookup_anno_list_by_saddr(struct mptcp_sock *msk, - { - struct mptcp_pm_add_entry *entry; - -+ lockdep_assert_held(&msk->pm.lock); -+ - list_for_each_entry(entry, &msk->pm.anno_list, list) { - if (addresses_equal(&entry->addr, addr, false)) - return entry; -@@ -266,6 +270,8 @@ static bool mptcp_pm_alloc_anno_list(struct mptcp_sock *msk, - struct sock *sk = (struct sock *)msk; - struct net *net = sock_net(sk); - -+ lockdep_assert_held(&msk->pm.lock); -+ - if (lookup_anno_list_by_saddr(msk, &entry->addr)) - return false; - -@@ -408,8 +414,10 @@ void mptcp_pm_nl_add_addr_send_ack(struct mptcp_sock *msk) - { - struct mptcp_subflow_context *subflow; - -- if (!mptcp_pm_should_add_signal_ipv6(msk) && -- !mptcp_pm_should_add_signal_port(msk)) -+ msk_owned_by_me(msk); -+ lockdep_assert_held(&msk->pm.lock); -+ -+ if (!mptcp_pm_should_add_signal(msk)) - return; - - __mptcp_flush_join_list(msk); -@@ -419,10 +427,9 @@ void mptcp_pm_nl_add_addr_send_ack(struct mptcp_sock *msk) - u8 add_addr; - - spin_unlock_bh(&msk->pm.lock); -- if (mptcp_pm_should_add_signal_ipv6(msk)) -- pr_debug("send ack for add_addr6"); -- if (mptcp_pm_should_add_signal_port(msk)) -- pr_debug("send ack for add_addr_port"); -+ pr_debug("send ack for add_addr%s%s", -+ mptcp_pm_should_add_signal_ipv6(msk) ? " [ipv6]" : "", -+ mptcp_pm_should_add_signal_port(msk) ? " [port]" : ""); - - lock_sock(ssk); - tcp_send_ack(ssk); -@@ -445,6 +452,8 @@ void mptcp_pm_nl_rm_addr_received(struct mptcp_sock *msk) - - pr_debug("address rm_id %d", msk->pm.rm_id); - -+ msk_owned_by_me(msk); -+ - if (!msk->pm.rm_id) - return; - -@@ -480,6 +489,8 @@ void mptcp_pm_nl_rm_subflow_received(struct mptcp_sock *msk, u8 rm_id) - - pr_debug("subflow rm_id %d", rm_id); - -+ msk_owned_by_me(msk); -+ - if (!rm_id) - return; - -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index 056846eb2e5bd..7345df40385ab 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -2100,6 +2100,14 @@ static struct sock *mptcp_subflow_get_retrans(const struct mptcp_sock *msk) - return backup; - } - -+static void mptcp_dispose_initial_subflow(struct mptcp_sock *msk) -+{ -+ if (msk->subflow) { -+ iput(SOCK_INODE(msk->subflow)); -+ msk->subflow = NULL; -+ } -+} -+ - /* subflow sockets can be either outgoing (connect) or incoming - * (accept). - * -@@ -2144,6 +2152,9 @@ void __mptcp_close_ssk(struct sock *sk, struct sock *ssk, - - if (ssk == msk->last_snd) - msk->last_snd = NULL; -+ -+ if (msk->subflow && ssk == msk->subflow->sk) -+ mptcp_dispose_initial_subflow(msk); - } - - static unsigned int mptcp_sync_mss(struct sock *sk, u32 pmtu) -@@ -2186,6 +2197,8 @@ static void __mptcp_close_subflow(struct mptcp_sock *msk) - { - struct mptcp_subflow_context *subflow, *tmp; - -+ might_sleep(); -+ - list_for_each_entry_safe(subflow, tmp, &msk->conn_list, node) { - struct sock *ssk = mptcp_subflow_tcp_sock(subflow); - -@@ -2529,11 +2542,7 @@ static void __mptcp_destroy_sock(struct sock *sk) - - pr_debug("msk=%p", msk); - -- /* dispose the ancillatory tcp socket, if any */ -- if (msk->subflow) { -- iput(SOCK_INODE(msk->subflow)); -- msk->subflow = NULL; -- } -+ might_sleep(); - - /* be sure to always acquire the join list lock, to sync vs - * mptcp_finish_join(). -@@ -2559,6 +2568,7 @@ static void __mptcp_destroy_sock(struct sock *sk) - sk_stream_kill_queues(sk); - xfrm_sk_free_policy(sk); - sk_refcnt_debug_release(sk); -+ mptcp_dispose_initial_subflow(msk); - sock_put(sk); - } - -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index 18fef4273bdc6..c374345ad1349 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -286,6 +286,11 @@ struct mptcp_sock { - #define mptcp_for_each_subflow(__msk, __subflow) \ - list_for_each_entry(__subflow, &((__msk)->conn_list), node) - -+static inline void msk_owned_by_me(const struct mptcp_sock *msk) -+{ -+ sock_owned_by_me((const struct sock *)msk); -+} -+ - static inline struct mptcp_sock *mptcp_sk(const struct sock *sk) - { - return (struct mptcp_sock *)sk; -diff --git a/tools/testing/selftests/bpf/verifier/bounds_deduction.c b/tools/testing/selftests/bpf/verifier/bounds_deduction.c -index 1fd07a4f27ac2..c162498a64fc6 100644 ---- a/tools/testing/selftests/bpf/verifier/bounds_deduction.c -+++ b/tools/testing/selftests/bpf/verifier/bounds_deduction.c -@@ -6,8 +6,9 @@ - BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), - BPF_EXIT_INSN(), - }, -- .result = REJECT, -+ .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", - .errstr = "R0 tried to subtract pointer from scalar", -+ .result = REJECT, - }, - { - "check deducing bounds from const, 2", -@@ -20,6 +21,8 @@ - BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0), - BPF_EXIT_INSN(), - }, -+ .errstr_unpriv = "R1 tried to sub from different maps, paths, or prohibited types", -+ .result_unpriv = REJECT, - .result = ACCEPT, - .retval = 1, - }, -@@ -31,8 +34,9 @@ - BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), - BPF_EXIT_INSN(), - }, -- .result = REJECT, -+ .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", - .errstr = "R0 tried to subtract pointer from scalar", -+ .result = REJECT, - }, - { - "check deducing bounds from const, 4", -@@ -45,6 +49,8 @@ - BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0), - BPF_EXIT_INSN(), - }, -+ .errstr_unpriv = "R1 tried to sub from different maps, paths, or prohibited types", -+ .result_unpriv = REJECT, - .result = ACCEPT, - }, - { -@@ -55,8 +61,9 @@ - BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), - BPF_EXIT_INSN(), - }, -- .result = REJECT, -+ .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", - .errstr = "R0 tried to subtract pointer from scalar", -+ .result = REJECT, - }, - { - "check deducing bounds from const, 6", -@@ -67,8 +74,9 @@ - BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), - BPF_EXIT_INSN(), - }, -- .result = REJECT, -+ .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", - .errstr = "R0 tried to subtract pointer from scalar", -+ .result = REJECT, - }, - { - "check deducing bounds from const, 7", -@@ -80,8 +88,9 @@ - offsetof(struct __sk_buff, mark)), - BPF_EXIT_INSN(), - }, -- .result = REJECT, -+ .errstr_unpriv = "R1 tried to sub from different maps, paths, or prohibited types", - .errstr = "dereference of modified ctx ptr", -+ .result = REJECT, - .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, - }, - { -@@ -94,8 +103,9 @@ - offsetof(struct __sk_buff, mark)), - BPF_EXIT_INSN(), - }, -- .result = REJECT, -+ .errstr_unpriv = "R1 tried to add from different maps, paths, or prohibited types", - .errstr = "dereference of modified ctx ptr", -+ .result = REJECT, - .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, - }, - { -@@ -106,8 +116,9 @@ - BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), - BPF_EXIT_INSN(), - }, -- .result = REJECT, -+ .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", - .errstr = "R0 tried to subtract pointer from scalar", -+ .result = REJECT, - }, - { - "check deducing bounds from const, 10", -@@ -119,6 +130,6 @@ - BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), - BPF_EXIT_INSN(), - }, -- .result = REJECT, - .errstr = "math between ctx pointer and register with unbounded min value is not allowed", -+ .result = REJECT, - }, -diff --git a/tools/testing/selftests/bpf/verifier/map_ptr.c b/tools/testing/selftests/bpf/verifier/map_ptr.c -index b117bdd3806d8..6f610cfddae53 100644 ---- a/tools/testing/selftests/bpf/verifier/map_ptr.c -+++ b/tools/testing/selftests/bpf/verifier/map_ptr.c -@@ -75,6 +75,8 @@ - BPF_EXIT_INSN(), - }, - .fixup_map_hash_16b = { 4 }, -+ .result_unpriv = REJECT, -+ .errstr_unpriv = "R1 tried to add from different maps, paths, or prohibited types", - .result = ACCEPT, - }, - { -@@ -91,5 +93,7 @@ - BPF_EXIT_INSN(), - }, - .fixup_map_hash_16b = { 4 }, -+ .result_unpriv = REJECT, -+ .errstr_unpriv = "R1 tried to add from different maps, paths, or prohibited types", - .result = ACCEPT, - }, -diff --git a/tools/testing/selftests/bpf/verifier/unpriv.c b/tools/testing/selftests/bpf/verifier/unpriv.c -index a3fe0fbaed41a..2df9871b169d4 100644 ---- a/tools/testing/selftests/bpf/verifier/unpriv.c -+++ b/tools/testing/selftests/bpf/verifier/unpriv.c -@@ -496,7 +496,7 @@ - .result = ACCEPT, - }, - { -- "unpriv: adding of fp", -+ "unpriv: adding of fp, reg", - .insns = { - BPF_MOV64_IMM(BPF_REG_0, 0), - BPF_MOV64_IMM(BPF_REG_1, 0), -@@ -504,6 +504,19 @@ - BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8), - BPF_EXIT_INSN(), - }, -+ .errstr_unpriv = "R1 tried to add from different maps, paths, or prohibited types", -+ .result_unpriv = REJECT, -+ .result = ACCEPT, -+}, -+{ -+ "unpriv: adding of fp, imm", -+ .insns = { -+ BPF_MOV64_IMM(BPF_REG_0, 0), -+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), -+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0), -+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8), -+ BPF_EXIT_INSN(), -+ }, - .errstr_unpriv = "R1 stack pointer arithmetic goes out of range", - .result_unpriv = REJECT, - .result = ACCEPT, -diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c -index ed4e76b246499..feb91266db39a 100644 ---- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c -+++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c -@@ -169,7 +169,7 @@ - .fixup_map_array_48b = { 1 }, - .result = ACCEPT, - .result_unpriv = REJECT, -- .errstr_unpriv = "R2 tried to add from different maps or paths", -+ .errstr_unpriv = "R2 tried to add from different maps, paths, or prohibited types", - .retval = 0, - }, - { -@@ -516,6 +516,27 @@ - .result = ACCEPT, - .retval = 0xabcdef12, - }, -+{ -+ "map access: value_ptr += N, value_ptr -= N known scalar", -+ .insns = { -+ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), -+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), -+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), -+ BPF_LD_MAP_FD(BPF_REG_1, 0), -+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), -+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), -+ BPF_MOV32_IMM(BPF_REG_1, 0x12345678), -+ BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0), -+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2), -+ BPF_MOV64_IMM(BPF_REG_1, 2), -+ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), -+ BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0), -+ BPF_EXIT_INSN(), -+ }, -+ .fixup_map_array_48b = { 3 }, -+ .result = ACCEPT, -+ .retval = 0x12345678, -+}, - { - "map access: unknown scalar += value_ptr, 1", - .insns = { diff --git a/patch/kernel/archive/sunxi-5.11/patch-5.11.8-9.patch b/patch/kernel/archive/sunxi-5.11/patch-5.11.8-9.patch deleted file mode 100644 index 35816e36b1..0000000000 --- a/patch/kernel/archive/sunxi-5.11/patch-5.11.8-9.patch +++ /dev/null @@ -1,3608 +0,0 @@ -diff --git a/MAINTAINERS b/MAINTAINERS -index bfc1b86e3e733..b6ab9c1a21198 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -1169,7 +1169,7 @@ M: Joel Fernandes - M: Christian Brauner - M: Hridya Valsaraju - M: Suren Baghdasaryan --L: devel@driverdev.osuosl.org -+L: linux-kernel@vger.kernel.org - S: Supported - T: git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git - F: drivers/android/ -@@ -8079,7 +8079,6 @@ F: drivers/crypto/hisilicon/sec2/sec_main.c - - HISILICON STAGING DRIVERS FOR HIKEY 960/970 - M: Mauro Carvalho Chehab --L: devel@driverdev.osuosl.org - S: Maintained - F: drivers/staging/hikey9xx/ - -@@ -16911,7 +16910,7 @@ F: drivers/staging/vt665?/ - - STAGING SUBSYSTEM - M: Greg Kroah-Hartman --L: devel@driverdev.osuosl.org -+L: linux-staging@lists.linux.dev - S: Supported - T: git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git - F: drivers/staging/ -@@ -18993,7 +18992,7 @@ VME SUBSYSTEM - M: Martyn Welch - M: Manohar Vanga - M: Greg Kroah-Hartman --L: devel@driverdev.osuosl.org -+L: linux-kernel@vger.kernel.org - S: Maintained - T: git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git - F: Documentation/driver-api/vme.rst -diff --git a/Makefile b/Makefile -index d8a39ece170dd..23403c8e08385 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 11 --SUBLEVEL = 8 -+SUBLEVEL = 9 - EXTRAVERSION = - NAME = 💕 Valentine's Day Edition 💕 - -@@ -1248,15 +1248,17 @@ endef - define filechk_version.h - if [ $(SUBLEVEL) -gt 255 ]; then \ - echo \#define LINUX_VERSION_CODE $(shell \ -- expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 255); \ -+ expr $(VERSION) \* 65536 + $(PATCHLEVEL) \* 256 + 255); \ - else \ - echo \#define LINUX_VERSION_CODE $(shell \ -- expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + $(SUBLEVEL)); \ -+ expr $(VERSION) \* 65536 + $(PATCHLEVEL) \* 256 + $(SUBLEVEL)); \ - fi; \ - echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + \ - ((c) > 255 ? 255 : (c)))' - endef - -+$(version_h): PATCHLEVEL := $(if $(PATCHLEVEL), $(PATCHLEVEL), 0) -+$(version_h): SUBLEVEL := $(if $(SUBLEVEL), $(SUBLEVEL), 0) - $(version_h): FORCE - $(call filechk,version.h) - $(Q)rm -f $(old_version_h) -diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h -index 7897d16e09904..727d4b3219379 100644 ---- a/arch/powerpc/include/asm/cpu_has_feature.h -+++ b/arch/powerpc/include/asm/cpu_has_feature.h -@@ -7,7 +7,7 @@ - #include - #include - --static inline bool early_cpu_has_feature(unsigned long feature) -+static __always_inline bool early_cpu_has_feature(unsigned long feature) - { - return !!((CPU_FTRS_ALWAYS & feature) || - (CPU_FTRS_POSSIBLE & cur_cpu_spec->cpu_features & feature)); -@@ -46,7 +46,7 @@ static __always_inline bool cpu_has_feature(unsigned long feature) - return static_branch_likely(&cpu_feature_keys[i]); - } - #else --static inline bool cpu_has_feature(unsigned long feature) -+static __always_inline bool cpu_has_feature(unsigned long feature) - { - return early_cpu_has_feature(feature); - } -diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S -index a6e29f880e0e3..d21d08140a5eb 100644 ---- a/arch/powerpc/kernel/vdso32/gettimeofday.S -+++ b/arch/powerpc/kernel/vdso32/gettimeofday.S -@@ -65,3 +65,14 @@ V_FUNCTION_END(__kernel_clock_getres) - V_FUNCTION_BEGIN(__kernel_time) - cvdso_call_time __c_kernel_time - V_FUNCTION_END(__kernel_time) -+ -+/* Routines for restoring integer registers, called by the compiler. */ -+/* Called with r11 pointing to the stack header word of the caller of the */ -+/* function, just beyond the end of the integer restore area. */ -+_GLOBAL(_restgpr_31_x) -+_GLOBAL(_rest32gpr_31_x) -+ lwz r0,4(r11) -+ lwz r31,-4(r11) -+ mtlr r0 -+ mr r1,r11 -+ blr -diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig -index e0a34eb5ed3b3..e6d569ae817d2 100644 ---- a/arch/riscv/Kconfig -+++ b/arch/riscv/Kconfig -@@ -87,7 +87,6 @@ config RISCV - select PCI_MSI if PCI - select RISCV_INTC - select RISCV_TIMER if RISCV_SBI -- select SPARSEMEM_STATIC if 32BIT - select SPARSE_IRQ - select SYSCTL_EXCEPTION_TRACE - select THREAD_INFO_IN_TASK -@@ -148,7 +147,8 @@ config ARCH_FLATMEM_ENABLE - config ARCH_SPARSEMEM_ENABLE - def_bool y - depends on MMU -- select SPARSEMEM_VMEMMAP_ENABLE -+ select SPARSEMEM_STATIC if 32BIT && SPARSMEM -+ select SPARSEMEM_VMEMMAP_ENABLE if 64BIT - - config ARCH_SELECT_MEMORY_MODEL - def_bool ARCH_SPARSEMEM_ENABLE -diff --git a/arch/riscv/include/asm/sbi.h b/arch/riscv/include/asm/sbi.h -index 653edb25d4957..c0fdb05ffa0b2 100644 ---- a/arch/riscv/include/asm/sbi.h -+++ b/arch/riscv/include/asm/sbi.h -@@ -51,10 +51,10 @@ enum sbi_ext_rfence_fid { - SBI_EXT_RFENCE_REMOTE_FENCE_I = 0, - SBI_EXT_RFENCE_REMOTE_SFENCE_VMA, - SBI_EXT_RFENCE_REMOTE_SFENCE_VMA_ASID, -- SBI_EXT_RFENCE_REMOTE_HFENCE_GVMA, - SBI_EXT_RFENCE_REMOTE_HFENCE_GVMA_VMID, -- SBI_EXT_RFENCE_REMOTE_HFENCE_VVMA, -+ SBI_EXT_RFENCE_REMOTE_HFENCE_GVMA, - SBI_EXT_RFENCE_REMOTE_HFENCE_VVMA_ASID, -+ SBI_EXT_RFENCE_REMOTE_HFENCE_VVMA, - }; - - enum sbi_ext_hsm_fid { -diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c -index c7c0655dd45b0..968202561d470 100644 ---- a/arch/riscv/kernel/setup.c -+++ b/arch/riscv/kernel/setup.c -@@ -147,7 +147,8 @@ static void __init init_resources(void) - bss_res.end = __pa_symbol(__bss_stop) - 1; - bss_res.flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY; - -- mem_res_sz = (memblock.memory.cnt + memblock.reserved.cnt) * sizeof(*mem_res); -+ /* + 1 as memblock_alloc() might increase memblock.reserved.cnt */ -+ mem_res_sz = (memblock.memory.cnt + memblock.reserved.cnt + 1) * sizeof(*mem_res); - mem_res = memblock_alloc(mem_res_sz, SMP_CACHE_BYTES); - if (!mem_res) - panic("%s: Failed to allocate %zu bytes\n", __func__, mem_res_sz); -diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h -index 212628932ddc1..a75d94a9bcb2f 100644 ---- a/arch/s390/include/asm/pci.h -+++ b/arch/s390/include/asm/pci.h -@@ -201,8 +201,8 @@ extern unsigned int s390_pci_no_rid; - Prototypes - ----------------------------------------------------------------------------- */ - /* Base stuff */ --int zpci_create_device(struct zpci_dev *); --void zpci_remove_device(struct zpci_dev *zdev); -+int zpci_create_device(u32 fid, u32 fh, enum zpci_state state); -+void zpci_remove_device(struct zpci_dev *zdev, bool set_error); - int zpci_enable_device(struct zpci_dev *); - int zpci_disable_device(struct zpci_dev *); - int zpci_register_ioat(struct zpci_dev *, u8, u64, u64, u64); -@@ -212,7 +212,7 @@ void zpci_remove_reserved_devices(void); - /* CLP */ - int clp_setup_writeback_mio(void); - int clp_scan_pci_devices(void); --int clp_add_pci_device(u32, u32, int); -+int clp_query_pci_fn(struct zpci_dev *zdev); - int clp_enable_fh(struct zpci_dev *, u8); - int clp_disable_fh(struct zpci_dev *); - int clp_get_state(u32 fid, enum zpci_state *state); -diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c -index 978a35ea6081f..9b3c5978b6683 100644 ---- a/arch/s390/kernel/vtime.c -+++ b/arch/s390/kernel/vtime.c -@@ -217,7 +217,7 @@ void vtime_flush(struct task_struct *tsk) - avg_steal = S390_lowcore.avg_steal_timer / 2; - if ((s64) steal > 0) { - S390_lowcore.steal_timer = 0; -- account_steal_time(steal); -+ account_steal_time(cputime_to_nsecs(steal)); - avg_steal += steal; - } - S390_lowcore.avg_steal_timer = avg_steal; -diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c -index 41df8fcfddde2..91064077526df 100644 ---- a/arch/s390/pci/pci.c -+++ b/arch/s390/pci/pci.c -@@ -682,56 +682,101 @@ int zpci_disable_device(struct zpci_dev *zdev) - } - EXPORT_SYMBOL_GPL(zpci_disable_device); - --void zpci_remove_device(struct zpci_dev *zdev) -+/* zpci_remove_device - Removes the given zdev from the PCI core -+ * @zdev: the zdev to be removed from the PCI core -+ * @set_error: if true the device's error state is set to permanent failure -+ * -+ * Sets a zPCI device to a configured but offline state; the zPCI -+ * device is still accessible through its hotplug slot and the zPCI -+ * API but is removed from the common code PCI bus, making it -+ * no longer available to drivers. -+ */ -+void zpci_remove_device(struct zpci_dev *zdev, bool set_error) - { - struct zpci_bus *zbus = zdev->zbus; - struct pci_dev *pdev; - -+ if (!zdev->zbus->bus) -+ return; -+ - pdev = pci_get_slot(zbus->bus, zdev->devfn); - if (pdev) { -- if (pdev->is_virtfn) -- return zpci_iov_remove_virtfn(pdev, zdev->vfn); -+ if (set_error) -+ pdev->error_state = pci_channel_io_perm_failure; -+ if (pdev->is_virtfn) { -+ zpci_iov_remove_virtfn(pdev, zdev->vfn); -+ /* balance pci_get_slot */ -+ pci_dev_put(pdev); -+ return; -+ } - pci_stop_and_remove_bus_device_locked(pdev); -+ /* balance pci_get_slot */ -+ pci_dev_put(pdev); - } - } - --int zpci_create_device(struct zpci_dev *zdev) -+/** -+ * zpci_create_device() - Create a new zpci_dev and add it to the zbus -+ * @fid: Function ID of the device to be created -+ * @fh: Current Function Handle of the device to be created -+ * @state: Initial state after creation either Standby or Configured -+ * -+ * Creates a new zpci device and adds it to its, possibly newly created, zbus -+ * as well as zpci_list. -+ * -+ * Returns: 0 on success, an error value otherwise -+ */ -+int zpci_create_device(u32 fid, u32 fh, enum zpci_state state) - { -+ struct zpci_dev *zdev; - int rc; - -- kref_init(&zdev->kref); -+ zpci_dbg(3, "add fid:%x, fh:%x, c:%d\n", fid, fh, state); -+ zdev = kzalloc(sizeof(*zdev), GFP_KERNEL); -+ if (!zdev) -+ return -ENOMEM; - -- spin_lock(&zpci_list_lock); -- list_add_tail(&zdev->entry, &zpci_list); -- spin_unlock(&zpci_list_lock); -+ /* FID and Function Handle are the static/dynamic identifiers */ -+ zdev->fid = fid; -+ zdev->fh = fh; - -- rc = zpci_init_iommu(zdev); -+ /* Query function properties and update zdev */ -+ rc = clp_query_pci_fn(zdev); - if (rc) -- goto out; -+ goto error; -+ zdev->state = state; - -+ kref_init(&zdev->kref); - mutex_init(&zdev->lock); -+ -+ rc = zpci_init_iommu(zdev); -+ if (rc) -+ goto error; -+ - if (zdev->state == ZPCI_FN_STATE_CONFIGURED) { - rc = zpci_enable_device(zdev); - if (rc) -- goto out_destroy_iommu; -+ goto error_destroy_iommu; - } - - rc = zpci_bus_device_register(zdev, &pci_root_ops); - if (rc) -- goto out_disable; -+ goto error_disable; -+ -+ spin_lock(&zpci_list_lock); -+ list_add_tail(&zdev->entry, &zpci_list); -+ spin_unlock(&zpci_list_lock); - - return 0; - --out_disable: -+error_disable: - if (zdev->state == ZPCI_FN_STATE_ONLINE) - zpci_disable_device(zdev); -- --out_destroy_iommu: -+error_destroy_iommu: - zpci_destroy_iommu(zdev); --out: -- spin_lock(&zpci_list_lock); -- list_del(&zdev->entry); -- spin_unlock(&zpci_list_lock); -+error: -+ zpci_dbg(0, "add fid:%x, rc:%d\n", fid, rc); -+ kfree(zdev); - return rc; - } - -@@ -740,7 +785,7 @@ void zpci_release_device(struct kref *kref) - struct zpci_dev *zdev = container_of(kref, struct zpci_dev, kref); - - if (zdev->zbus->bus) -- zpci_remove_device(zdev); -+ zpci_remove_device(zdev, false); - - switch (zdev->state) { - case ZPCI_FN_STATE_ONLINE: -diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c -index 153720d21ae7f..d3331596ddbe1 100644 ---- a/arch/s390/pci/pci_clp.c -+++ b/arch/s390/pci/pci_clp.c -@@ -181,7 +181,7 @@ static int clp_store_query_pci_fn(struct zpci_dev *zdev, - return 0; - } - --static int clp_query_pci_fn(struct zpci_dev *zdev, u32 fh) -+int clp_query_pci_fn(struct zpci_dev *zdev) - { - struct clp_req_rsp_query_pci *rrb; - int rc; -@@ -194,7 +194,7 @@ static int clp_query_pci_fn(struct zpci_dev *zdev, u32 fh) - rrb->request.hdr.len = sizeof(rrb->request); - rrb->request.hdr.cmd = CLP_QUERY_PCI_FN; - rrb->response.hdr.len = sizeof(rrb->response); -- rrb->request.fh = fh; -+ rrb->request.fh = zdev->fh; - - rc = clp_req(rrb, CLP_LPS_PCI); - if (!rc && rrb->response.hdr.rsp == CLP_RC_OK) { -@@ -212,40 +212,6 @@ out: - return rc; - } - --int clp_add_pci_device(u32 fid, u32 fh, int configured) --{ -- struct zpci_dev *zdev; -- int rc = -ENOMEM; -- -- zpci_dbg(3, "add fid:%x, fh:%x, c:%d\n", fid, fh, configured); -- zdev = kzalloc(sizeof(*zdev), GFP_KERNEL); -- if (!zdev) -- goto error; -- -- zdev->fh = fh; -- zdev->fid = fid; -- -- /* Query function properties and update zdev */ -- rc = clp_query_pci_fn(zdev, fh); -- if (rc) -- goto error; -- -- if (configured) -- zdev->state = ZPCI_FN_STATE_CONFIGURED; -- else -- zdev->state = ZPCI_FN_STATE_STANDBY; -- -- rc = zpci_create_device(zdev); -- if (rc) -- goto error; -- return 0; -- --error: -- zpci_dbg(0, "add fid:%x, rc:%d\n", fid, rc); -- kfree(zdev); -- return rc; --} -- - static int clp_refresh_fh(u32 fid); - /* - * Enable/Disable a given PCI function and update its function handle if -@@ -408,7 +374,7 @@ static void __clp_add(struct clp_fh_list_entry *entry, void *data) - - zdev = get_zdev_by_fid(entry->fid); - if (!zdev) -- clp_add_pci_device(entry->fid, entry->fh, entry->config_state); -+ zpci_create_device(entry->fid, entry->fh, entry->config_state); - } - - int clp_scan_pci_devices(void) -diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c -index 9a6bae503fe61..ac0c65cdd69d9 100644 ---- a/arch/s390/pci/pci_event.c -+++ b/arch/s390/pci/pci_event.c -@@ -76,20 +76,17 @@ void zpci_event_error(void *data) - static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf) - { - struct zpci_dev *zdev = get_zdev_by_fid(ccdf->fid); -- struct pci_dev *pdev = NULL; - enum zpci_state state; -+ struct pci_dev *pdev; - int ret; - -- if (zdev && zdev->zbus && zdev->zbus->bus) -- pdev = pci_get_slot(zdev->zbus->bus, zdev->devfn); -- - zpci_err("avail CCDF:\n"); - zpci_err_hex(ccdf, sizeof(*ccdf)); - - switch (ccdf->pec) { - case 0x0301: /* Reserved|Standby -> Configured */ - if (!zdev) { -- ret = clp_add_pci_device(ccdf->fid, ccdf->fh, 1); -+ zpci_create_device(ccdf->fid, ccdf->fh, ZPCI_FN_STATE_CONFIGURED); - break; - } - /* the configuration request may be stale */ -@@ -116,7 +113,7 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf) - break; - case 0x0302: /* Reserved -> Standby */ - if (!zdev) { -- clp_add_pci_device(ccdf->fid, ccdf->fh, 0); -+ zpci_create_device(ccdf->fid, ccdf->fh, ZPCI_FN_STATE_STANDBY); - break; - } - zdev->fh = ccdf->fh; -@@ -124,8 +121,7 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf) - case 0x0303: /* Deconfiguration requested */ - if (!zdev) - break; -- if (pdev) -- zpci_remove_device(zdev); -+ zpci_remove_device(zdev, false); - - ret = zpci_disable_device(zdev); - if (ret) -@@ -140,12 +136,10 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf) - case 0x0304: /* Configured -> Standby|Reserved */ - if (!zdev) - break; -- if (pdev) { -- /* Give the driver a hint that the function is -- * already unusable. */ -- pdev->error_state = pci_channel_io_perm_failure; -- zpci_remove_device(zdev); -- } -+ /* Give the driver a hint that the function is -+ * already unusable. -+ */ -+ zpci_remove_device(zdev, true); - - zdev->fh = ccdf->fh; - zpci_disable_device(zdev); -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index d3f5cf70c1a09..bfd42e0853ed6 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -3575,6 +3575,9 @@ static int intel_pmu_hw_config(struct perf_event *event) - return ret; - - if (event->attr.precise_ip) { -+ if ((event->attr.config & INTEL_ARCH_EVENT_MASK) == INTEL_FIXED_VLBR_EVENT) -+ return -EINVAL; -+ - if (!(event->attr.freq || (event->attr.wakeup_events && !event->attr.watermark))) { - event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD; - if (!(event->attr.sample_type & -diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c -index 67dbc91bccfee..6e84e79bea720 100644 ---- a/arch/x86/events/intel/ds.c -+++ b/arch/x86/events/intel/ds.c -@@ -1899,7 +1899,7 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs, struct perf_sample_d - */ - if (!pebs_status && cpuc->pebs_enabled && - !(cpuc->pebs_enabled & (cpuc->pebs_enabled-1))) -- pebs_status = cpuc->pebs_enabled; -+ pebs_status = p->status = cpuc->pebs_enabled; - - bit = find_first_bit((unsigned long *)&pebs_status, - x86_pmu.max_pebs_events); -diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index c20a52b5534b4..c66df6368909f 100644 ---- a/arch/x86/include/asm/processor.h -+++ b/arch/x86/include/asm/processor.h -@@ -552,15 +552,6 @@ static inline void arch_thread_struct_whitelist(unsigned long *offset, - *size = fpu_kernel_xstate_size; - } - --/* -- * Thread-synchronous status. -- * -- * This is different from the flags in that nobody else -- * ever touches our thread-synchronous status, so we don't -- * have to worry about atomic accesses. -- */ --#define TS_COMPAT 0x0002 /* 32bit syscall active (64BIT)*/ -- - static inline void - native_load_sp0(unsigned long sp0) - { -diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h -index 0d751d5da702e..30d1d187019f8 100644 ---- a/arch/x86/include/asm/thread_info.h -+++ b/arch/x86/include/asm/thread_info.h -@@ -205,10 +205,31 @@ static inline int arch_within_stack_frames(const void * const stack, - - #endif - -+/* -+ * Thread-synchronous status. -+ * -+ * This is different from the flags in that nobody else -+ * ever touches our thread-synchronous status, so we don't -+ * have to worry about atomic accesses. -+ */ -+#define TS_COMPAT 0x0002 /* 32bit syscall active (64BIT)*/ -+ -+#ifndef __ASSEMBLY__ - #ifdef CONFIG_COMPAT - #define TS_I386_REGS_POKED 0x0004 /* regs poked by 32-bit ptracer */ -+#define TS_COMPAT_RESTART 0x0008 -+ -+#define arch_set_restart_data arch_set_restart_data -+ -+static inline void arch_set_restart_data(struct restart_block *restart) -+{ -+ struct thread_info *ti = current_thread_info(); -+ if (ti->status & TS_COMPAT) -+ ti->status |= TS_COMPAT_RESTART; -+ else -+ ti->status &= ~TS_COMPAT_RESTART; -+} - #endif --#ifndef __ASSEMBLY__ - - #ifdef CONFIG_X86_32 - #define in_ia32_syscall() true -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index 7f4c081f59f0c..2745c24453f2b 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -2334,6 +2334,11 @@ static int cpuid_to_apicid[] = { - [0 ... NR_CPUS - 1] = -1, - }; - -+bool arch_match_cpu_phys_id(int cpu, u64 phys_id) -+{ -+ return phys_id == cpuid_to_apicid[cpu]; -+} -+ - #ifdef CONFIG_SMP - /** - * apic_id_is_primary_thread - Check whether APIC ID belongs to a primary thread -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index e4ab4804b20df..04ef995d1200a 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -1032,6 +1032,16 @@ static int mp_map_pin_to_irq(u32 gsi, int idx, int ioapic, int pin, - if (idx >= 0 && test_bit(mp_irqs[idx].srcbus, mp_bus_not_pci)) { - irq = mp_irqs[idx].srcbusirq; - legacy = mp_is_legacy_irq(irq); -+ /* -+ * IRQ2 is unusable for historical reasons on systems which -+ * have a legacy PIC. See the comment vs. IRQ2 further down. -+ * -+ * If this gets removed at some point then the related code -+ * in lapic_assign_system_vectors() needs to be adjusted as -+ * well. -+ */ -+ if (legacy && irq == PIC_CASCADE_IR) -+ return -EINVAL; - } - - mutex_lock(&ioapic_mutex); -diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c -index ea794a083c44e..6c26d2c3a2e4c 100644 ---- a/arch/x86/kernel/signal.c -+++ b/arch/x86/kernel/signal.c -@@ -766,30 +766,8 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs) - - static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs) - { -- /* -- * This function is fundamentally broken as currently -- * implemented. -- * -- * The idea is that we want to trigger a call to the -- * restart_block() syscall and that we want in_ia32_syscall(), -- * in_x32_syscall(), etc. to match whatever they were in the -- * syscall being restarted. We assume that the syscall -- * instruction at (regs->ip - 2) matches whatever syscall -- * instruction we used to enter in the first place. -- * -- * The problem is that we can get here when ptrace pokes -- * syscall-like values into regs even if we're not in a syscall -- * at all. -- * -- * For now, we maintain historical behavior and guess based on -- * stored state. We could do better by saving the actual -- * syscall arch in restart_block or (with caveats on x32) by -- * checking if regs->ip points to 'int $0x80'. The current -- * behavior is incorrect if a tracer has a different bitness -- * than the tracee. -- */ - #ifdef CONFIG_IA32_EMULATION -- if (current_thread_info()->status & (TS_COMPAT|TS_I386_REGS_POKED)) -+ if (current_thread_info()->status & TS_COMPAT_RESTART) - return __NR_ia32_restart_syscall; - #endif - #ifdef CONFIG_X86_X32_ABI -diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c -index 87682dcb64ec3..bfda153b1a41d 100644 ---- a/drivers/base/power/runtime.c -+++ b/drivers/base/power/runtime.c -@@ -325,22 +325,22 @@ static void rpm_put_suppliers(struct device *dev) - static int __rpm_callback(int (*cb)(struct device *), struct device *dev) - __releases(&dev->power.lock) __acquires(&dev->power.lock) - { -- bool use_links = dev->power.links_count > 0; -- bool get = false; - int retval, idx; -- bool put; -+ bool use_links = dev->power.links_count > 0; - - if (dev->power.irq_safe) { - spin_unlock(&dev->power.lock); -- } else if (!use_links) { -- spin_unlock_irq(&dev->power.lock); - } else { -- get = dev->power.runtime_status == RPM_RESUMING; -- - spin_unlock_irq(&dev->power.lock); - -- /* Resume suppliers if necessary. */ -- if (get) { -+ /* -+ * Resume suppliers if necessary. -+ * -+ * The device's runtime PM status cannot change until this -+ * routine returns, so it is safe to read the status outside of -+ * the lock. -+ */ -+ if (use_links && dev->power.runtime_status == RPM_RESUMING) { - idx = device_links_read_lock(); - - retval = rpm_get_suppliers(dev); -@@ -355,36 +355,24 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) - - if (dev->power.irq_safe) { - spin_lock(&dev->power.lock); -- return retval; -- } -- -- spin_lock_irq(&dev->power.lock); -- -- if (!use_links) -- return retval; -- -- /* -- * If the device is suspending and the callback has returned success, -- * drop the usage counters of the suppliers that have been reference -- * counted on its resume. -- * -- * Do that if the resume fails too. -- */ -- put = dev->power.runtime_status == RPM_SUSPENDING && !retval; -- if (put) -- __update_runtime_status(dev, RPM_SUSPENDED); -- else -- put = get && retval; -- -- if (put) { -- spin_unlock_irq(&dev->power.lock); -- -- idx = device_links_read_lock(); -+ } else { -+ /* -+ * If the device is suspending and the callback has returned -+ * success, drop the usage counters of the suppliers that have -+ * been reference counted on its resume. -+ * -+ * Do that if resume fails too. -+ */ -+ if (use_links -+ && ((dev->power.runtime_status == RPM_SUSPENDING && !retval) -+ || (dev->power.runtime_status == RPM_RESUMING && retval))) { -+ idx = device_links_read_lock(); - --fail: -- rpm_put_suppliers(dev); -+ fail: -+ rpm_put_suppliers(dev); - -- device_links_read_unlock(idx); -+ device_links_read_unlock(idx); -+ } - - spin_lock_irq(&dev->power.lock); - } -diff --git a/drivers/counter/stm32-timer-cnt.c b/drivers/counter/stm32-timer-cnt.c -index ef2a974a2f105..75bc401fdd189 100644 ---- a/drivers/counter/stm32-timer-cnt.c -+++ b/drivers/counter/stm32-timer-cnt.c -@@ -31,7 +31,7 @@ struct stm32_timer_cnt { - struct counter_device counter; - struct regmap *regmap; - struct clk *clk; -- u32 ceiling; -+ u32 max_arr; - bool enabled; - struct stm32_timer_regs bak; - }; -@@ -44,13 +44,14 @@ struct stm32_timer_cnt { - * @STM32_COUNT_ENCODER_MODE_3: counts on both TI1FP1 and TI2FP2 edges - */ - enum stm32_count_function { -- STM32_COUNT_SLAVE_MODE_DISABLED = -1, -+ STM32_COUNT_SLAVE_MODE_DISABLED, - STM32_COUNT_ENCODER_MODE_1, - STM32_COUNT_ENCODER_MODE_2, - STM32_COUNT_ENCODER_MODE_3, - }; - - static enum counter_count_function stm32_count_functions[] = { -+ [STM32_COUNT_SLAVE_MODE_DISABLED] = COUNTER_COUNT_FUNCTION_INCREASE, - [STM32_COUNT_ENCODER_MODE_1] = COUNTER_COUNT_FUNCTION_QUADRATURE_X2_A, - [STM32_COUNT_ENCODER_MODE_2] = COUNTER_COUNT_FUNCTION_QUADRATURE_X2_B, - [STM32_COUNT_ENCODER_MODE_3] = COUNTER_COUNT_FUNCTION_QUADRATURE_X4, -@@ -73,8 +74,10 @@ static int stm32_count_write(struct counter_device *counter, - const unsigned long val) - { - struct stm32_timer_cnt *const priv = counter->priv; -+ u32 ceiling; - -- if (val > priv->ceiling) -+ regmap_read(priv->regmap, TIM_ARR, &ceiling); -+ if (val > ceiling) - return -EINVAL; - - return regmap_write(priv->regmap, TIM_CNT, val); -@@ -90,6 +93,9 @@ static int stm32_count_function_get(struct counter_device *counter, - regmap_read(priv->regmap, TIM_SMCR, &smcr); - - switch (smcr & TIM_SMCR_SMS) { -+ case 0: -+ *function = STM32_COUNT_SLAVE_MODE_DISABLED; -+ return 0; - case 1: - *function = STM32_COUNT_ENCODER_MODE_1; - return 0; -@@ -99,9 +105,9 @@ static int stm32_count_function_get(struct counter_device *counter, - case 3: - *function = STM32_COUNT_ENCODER_MODE_3; - return 0; -+ default: -+ return -EINVAL; - } -- -- return -EINVAL; - } - - static int stm32_count_function_set(struct counter_device *counter, -@@ -112,6 +118,9 @@ static int stm32_count_function_set(struct counter_device *counter, - u32 cr1, sms; - - switch (function) { -+ case STM32_COUNT_SLAVE_MODE_DISABLED: -+ sms = 0; -+ break; - case STM32_COUNT_ENCODER_MODE_1: - sms = 1; - break; -@@ -122,8 +131,7 @@ static int stm32_count_function_set(struct counter_device *counter, - sms = 3; - break; - default: -- sms = 0; -- break; -+ return -EINVAL; - } - - /* Store enable status */ -@@ -131,10 +139,6 @@ static int stm32_count_function_set(struct counter_device *counter, - - regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0); - -- /* TIMx_ARR register shouldn't be buffered (ARPE=0) */ -- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0); -- regmap_write(priv->regmap, TIM_ARR, priv->ceiling); -- - regmap_update_bits(priv->regmap, TIM_SMCR, TIM_SMCR_SMS, sms); - - /* Make sure that registers are updated */ -@@ -185,11 +189,13 @@ static ssize_t stm32_count_ceiling_write(struct counter_device *counter, - if (ret) - return ret; - -+ if (ceiling > priv->max_arr) -+ return -ERANGE; -+ - /* TIMx_ARR register shouldn't be buffered (ARPE=0) */ - regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0); - regmap_write(priv->regmap, TIM_ARR, ceiling); - -- priv->ceiling = ceiling; - return len; - } - -@@ -274,31 +280,36 @@ static int stm32_action_get(struct counter_device *counter, - size_t function; - int err; - -- /* Default action mode (e.g. STM32_COUNT_SLAVE_MODE_DISABLED) */ -- *action = STM32_SYNAPSE_ACTION_NONE; -- - err = stm32_count_function_get(counter, count, &function); - if (err) -- return 0; -+ return err; - - switch (function) { -+ case STM32_COUNT_SLAVE_MODE_DISABLED: -+ /* counts on internal clock when CEN=1 */ -+ *action = STM32_SYNAPSE_ACTION_NONE; -+ return 0; - case STM32_COUNT_ENCODER_MODE_1: - /* counts up/down on TI1FP1 edge depending on TI2FP2 level */ - if (synapse->signal->id == count->synapses[0].signal->id) - *action = STM32_SYNAPSE_ACTION_BOTH_EDGES; -- break; -+ else -+ *action = STM32_SYNAPSE_ACTION_NONE; -+ return 0; - case STM32_COUNT_ENCODER_MODE_2: - /* counts up/down on TI2FP2 edge depending on TI1FP1 level */ - if (synapse->signal->id == count->synapses[1].signal->id) - *action = STM32_SYNAPSE_ACTION_BOTH_EDGES; -- break; -+ else -+ *action = STM32_SYNAPSE_ACTION_NONE; -+ return 0; - case STM32_COUNT_ENCODER_MODE_3: - /* counts up/down on both TI1FP1 and TI2FP2 edges */ - *action = STM32_SYNAPSE_ACTION_BOTH_EDGES; -- break; -+ return 0; -+ default: -+ return -EINVAL; - } -- -- return 0; - } - - static const struct counter_ops stm32_timer_cnt_ops = { -@@ -359,7 +370,7 @@ static int stm32_timer_cnt_probe(struct platform_device *pdev) - - priv->regmap = ddata->regmap; - priv->clk = ddata->clk; -- priv->ceiling = ddata->max_arr; -+ priv->max_arr = ddata->max_arr; - - priv->counter.name = dev_name(dev); - priv->counter.parent = dev; -diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c -index df3f9bcab581c..4b7ee3fa9224f 100644 ---- a/drivers/firmware/efi/efi.c -+++ b/drivers/firmware/efi/efi.c -@@ -927,7 +927,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) - } - - /* first try to find a slot in an existing linked list entry */ -- for (prsv = efi_memreserve_root->next; prsv; prsv = rsv->next) { -+ for (prsv = efi_memreserve_root->next; prsv; ) { - rsv = memremap(prsv, sizeof(*rsv), MEMREMAP_WB); - index = atomic_fetch_add_unless(&rsv->count, 1, rsv->size); - if (index < rsv->size) { -@@ -937,6 +937,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) - memunmap(rsv); - return efi_mem_reserve_iomem(addr, size); - } -+ prsv = rsv->next; - memunmap(rsv); - } - -diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c -index 41c1d00bf933c..abdc8a6a39631 100644 ---- a/drivers/firmware/efi/vars.c -+++ b/drivers/firmware/efi/vars.c -@@ -484,6 +484,10 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *), - } - } - -+ break; -+ case EFI_UNSUPPORTED: -+ err = -EOPNOTSUPP; -+ status = EFI_NOT_FOUND; - break; - case EFI_NOT_FOUND: - break; -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index e4cfa27f6893d..a4a47305574cb 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -573,6 +573,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, - struct lock_class_key *lock_key, - struct lock_class_key *request_key) - { -+ struct fwnode_handle *fwnode = gc->parent ? dev_fwnode(gc->parent) : NULL; - unsigned long flags; - int ret = 0; - unsigned i; -@@ -602,6 +603,12 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, - gc->of_node = gdev->dev.of_node; - #endif - -+ /* -+ * Assign fwnode depending on the result of the previous calls, -+ * if none of them succeed, assign it to the parent's one. -+ */ -+ gdev->dev.fwnode = dev_fwnode(&gdev->dev) ?: fwnode; -+ - gdev->id = ida_alloc(&gpio_ida, GFP_KERNEL); - if (gdev->id < 0) { - ret = gdev->id; -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -index 480d928cb1ca6..09b9732424e15 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -@@ -1501,38 +1501,8 @@ static void dcn20_update_dchubp_dpp( - if (pipe_ctx->update_flags.bits.enable || pipe_ctx->update_flags.bits.opp_changed - || pipe_ctx->stream->update_flags.bits.gamut_remap - || pipe_ctx->stream->update_flags.bits.out_csc) { -- struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc; -- -- if (mpc->funcs->set_gamut_remap) { -- int i; -- int mpcc_id = hubp->inst; -- struct mpc_grph_gamut_adjustment adjust; -- bool enable_remap_dpp = false; -- -- memset(&adjust, 0, sizeof(adjust)); -- adjust.gamut_adjust_type = GRAPHICS_GAMUT_ADJUST_TYPE_BYPASS; -- -- /* save the enablement of gamut remap for dpp */ -- enable_remap_dpp = pipe_ctx->stream->gamut_remap_matrix.enable_remap; -- -- /* force bypass gamut remap for dpp/cm */ -- pipe_ctx->stream->gamut_remap_matrix.enable_remap = false; -- dc->hwss.program_gamut_remap(pipe_ctx); -- -- /* restore gamut remap flag and use this remap into mpc */ -- pipe_ctx->stream->gamut_remap_matrix.enable_remap = enable_remap_dpp; -- -- /* build remap matrix for top plane if enabled */ -- if (enable_remap_dpp && pipe_ctx->top_pipe == NULL) { -- adjust.gamut_adjust_type = GRAPHICS_GAMUT_ADJUST_TYPE_SW; -- for (i = 0; i < CSC_TEMPERATURE_MATRIX_SIZE; i++) -- adjust.temperature_matrix[i] = -- pipe_ctx->stream->gamut_remap_matrix.matrix[i]; -- } -- mpc->funcs->set_gamut_remap(mpc, mpcc_id, &adjust); -- } else -- /* dpp/cm gamut remap*/ -- dc->hwss.program_gamut_remap(pipe_ctx); -+ /* dpp/cm gamut remap*/ -+ dc->hwss.program_gamut_remap(pipe_ctx); - - /*call the dcn2 method which uses mpc csc*/ - dc->hwss.program_output_csc(dc, -diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -index 94ee2cab26b7c..4caeab6a09b3d 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -@@ -1595,6 +1595,11 @@ static void update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param - dcn2_1_soc.num_chans = bw_params->num_channels; - - ASSERT(clk_table->num_entries); -+ /* Copy dcn2_1_soc.clock_limits to clock_limits to avoid copying over null states later */ -+ for (i = 0; i < dcn2_1_soc.num_states + 1; i++) { -+ clock_limits[i] = dcn2_1_soc.clock_limits[i]; -+ } -+ - for (i = 0; i < clk_table->num_entries; i++) { - /* loop backwards*/ - for (closest_clk_lvl = 0, j = dcn2_1_soc.num_states - 1; j >= 0; j--) { -diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c -index 41a1d0e9b7e20..e0df9b0065f9c 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c -@@ -113,6 +113,7 @@ bool cm3_helper_translate_curve_to_hw_format( - struct pwl_result_data *rgb_resulted; - struct pwl_result_data *rgb; - struct pwl_result_data *rgb_plus_1; -+ struct pwl_result_data *rgb_minus_1; - struct fixed31_32 end_value; - - int32_t region_start, region_end; -@@ -140,7 +141,7 @@ bool cm3_helper_translate_curve_to_hw_format( - region_start = -MAX_LOW_POINT; - region_end = NUMBER_REGIONS - MAX_LOW_POINT; - } else { -- /* 10 segments -+ /* 11 segments - * segment is from 2^-10 to 2^0 - * There are less than 256 points, for optimization - */ -@@ -154,9 +155,10 @@ bool cm3_helper_translate_curve_to_hw_format( - seg_distr[7] = 4; - seg_distr[8] = 4; - seg_distr[9] = 4; -+ seg_distr[10] = 1; - - region_start = -10; -- region_end = 0; -+ region_end = 1; - } - - for (i = region_end - region_start; i < MAX_REGIONS_NUMBER ; i++) -@@ -189,6 +191,10 @@ bool cm3_helper_translate_curve_to_hw_format( - rgb_resulted[hw_points - 1].green = output_tf->tf_pts.green[start_index]; - rgb_resulted[hw_points - 1].blue = output_tf->tf_pts.blue[start_index]; - -+ rgb_resulted[hw_points].red = rgb_resulted[hw_points - 1].red; -+ rgb_resulted[hw_points].green = rgb_resulted[hw_points - 1].green; -+ rgb_resulted[hw_points].blue = rgb_resulted[hw_points - 1].blue; -+ - // All 3 color channels have same x - corner_points[0].red.x = dc_fixpt_pow(dc_fixpt_from_int(2), - dc_fixpt_from_int(region_start)); -@@ -259,15 +265,18 @@ bool cm3_helper_translate_curve_to_hw_format( - - rgb = rgb_resulted; - rgb_plus_1 = rgb_resulted + 1; -+ rgb_minus_1 = rgb; - - i = 1; - while (i != hw_points + 1) { -- if (dc_fixpt_lt(rgb_plus_1->red, rgb->red)) -- rgb_plus_1->red = rgb->red; -- if (dc_fixpt_lt(rgb_plus_1->green, rgb->green)) -- rgb_plus_1->green = rgb->green; -- if (dc_fixpt_lt(rgb_plus_1->blue, rgb->blue)) -- rgb_plus_1->blue = rgb->blue; -+ if (i >= hw_points - 1) { -+ if (dc_fixpt_lt(rgb_plus_1->red, rgb->red)) -+ rgb_plus_1->red = dc_fixpt_add(rgb->red, rgb_minus_1->delta_red); -+ if (dc_fixpt_lt(rgb_plus_1->green, rgb->green)) -+ rgb_plus_1->green = dc_fixpt_add(rgb->green, rgb_minus_1->delta_green); -+ if (dc_fixpt_lt(rgb_plus_1->blue, rgb->blue)) -+ rgb_plus_1->blue = dc_fixpt_add(rgb->blue, rgb_minus_1->delta_blue); -+ } - - rgb->delta_red = dc_fixpt_sub(rgb_plus_1->red, rgb->red); - rgb->delta_green = dc_fixpt_sub(rgb_plus_1->green, rgb->green); -@@ -283,6 +292,7 @@ bool cm3_helper_translate_curve_to_hw_format( - } - - ++rgb_plus_1; -+ rgb_minus_1 = rgb; - ++rgb; - ++i; - } -diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c -index 649c26518d26d..8d9ab4a91544b 100644 ---- a/drivers/gpu/drm/i915/i915_perf.c -+++ b/drivers/gpu/drm/i915/i915_perf.c -@@ -600,7 +600,6 @@ static int append_oa_sample(struct i915_perf_stream *stream, - { - int report_size = stream->oa_buffer.format_size; - struct drm_i915_perf_record_header header; -- u32 sample_flags = stream->sample_flags; - - header.type = DRM_I915_PERF_RECORD_SAMPLE; - header.pad = 0; -@@ -614,10 +613,8 @@ static int append_oa_sample(struct i915_perf_stream *stream, - return -EFAULT; - buf += sizeof(header); - -- if (sample_flags & SAMPLE_OA_REPORT) { -- if (copy_to_user(buf, report, report_size)) -- return -EFAULT; -- } -+ if (copy_to_user(buf, report, report_size)) -+ return -EFAULT; - - (*offset) += header.size; - -@@ -2678,7 +2675,7 @@ static void i915_oa_stream_enable(struct i915_perf_stream *stream) - - stream->perf->ops.oa_enable(stream); - -- if (stream->periodic) -+ if (stream->sample_flags & SAMPLE_OA_REPORT) - hrtimer_start(&stream->poll_check_timer, - ns_to_ktime(stream->poll_oa_period), - HRTIMER_MODE_REL_PINNED); -@@ -2741,7 +2738,7 @@ static void i915_oa_stream_disable(struct i915_perf_stream *stream) - { - stream->perf->ops.oa_disable(stream); - -- if (stream->periodic) -+ if (stream->sample_flags & SAMPLE_OA_REPORT) - hrtimer_cancel(&stream->poll_check_timer); - } - -@@ -3024,7 +3021,7 @@ static ssize_t i915_perf_read(struct file *file, - * disabled stream as an error. In particular it might otherwise lead - * to a deadlock for blocking file descriptors... - */ -- if (!stream->enabled) -+ if (!stream->enabled || !(stream->sample_flags & SAMPLE_OA_REPORT)) - return -EIO; - - if (!(file->f_flags & O_NONBLOCK)) { -diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c -index 22073e77fdf9a..a76eb2c14e8c5 100644 ---- a/drivers/gpu/drm/ttm/ttm_bo.c -+++ b/drivers/gpu/drm/ttm/ttm_bo.c -@@ -514,7 +514,7 @@ static void ttm_bo_release(struct kref *kref) - * shrinkers, now that they are queued for - * destruction. - */ -- if (bo->pin_count) { -+ if (WARN_ON(bo->pin_count)) { - bo->pin_count = 0; - ttm_bo_del_from_lru(bo); - ttm_bo_add_mem_to_lru(bo, &bo->mem); -diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig -index 15587a1bc80d0..be1f73166a32b 100644 ---- a/drivers/iio/adc/Kconfig -+++ b/drivers/iio/adc/Kconfig -@@ -266,6 +266,8 @@ config ADI_AXI_ADC - select IIO_BUFFER - select IIO_BUFFER_HW_CONSUMER - select IIO_BUFFER_DMAENGINE -+ depends on HAS_IOMEM -+ depends on OF - help - Say yes here to build support for Analog Devices Generic - AXI ADC IP core. The IP core is used for interfacing with -@@ -923,6 +925,7 @@ config STM32_ADC_CORE - depends on ARCH_STM32 || COMPILE_TEST - depends on OF - depends on REGULATOR -+ depends on HAS_IOMEM - select IIO_BUFFER - select MFD_STM32_TIMERS - select IIO_STM32_TIMER_TRIGGER -diff --git a/drivers/iio/adc/ab8500-gpadc.c b/drivers/iio/adc/ab8500-gpadc.c -index 1bb987a4acbab..8d81505282dd3 100644 ---- a/drivers/iio/adc/ab8500-gpadc.c -+++ b/drivers/iio/adc/ab8500-gpadc.c -@@ -918,7 +918,7 @@ static int ab8500_gpadc_read_raw(struct iio_dev *indio_dev, - return processed; - - /* Return millivolt or milliamps or millicentigrades */ -- *val = processed * 1000; -+ *val = processed; - return IIO_VAL_INT; - } - -diff --git a/drivers/iio/adc/ad7949.c b/drivers/iio/adc/ad7949.c -index 5d597e5050f68..1b4b3203e4285 100644 ---- a/drivers/iio/adc/ad7949.c -+++ b/drivers/iio/adc/ad7949.c -@@ -91,7 +91,7 @@ static int ad7949_spi_read_channel(struct ad7949_adc_chip *ad7949_adc, int *val, - int ret; - int i; - int bits_per_word = ad7949_adc->resolution; -- int mask = GENMASK(ad7949_adc->resolution, 0); -+ int mask = GENMASK(ad7949_adc->resolution - 1, 0); - struct spi_message msg; - struct spi_transfer tx[] = { - { -diff --git a/drivers/iio/adc/qcom-spmi-vadc.c b/drivers/iio/adc/qcom-spmi-vadc.c -index b0388f8a69f42..7e7d408452eca 100644 ---- a/drivers/iio/adc/qcom-spmi-vadc.c -+++ b/drivers/iio/adc/qcom-spmi-vadc.c -@@ -598,7 +598,7 @@ static const struct vadc_channels vadc_chans[] = { - VADC_CHAN_NO_SCALE(P_MUX16_1_3, 1) - - VADC_CHAN_NO_SCALE(LR_MUX1_BAT_THERM, 0) -- VADC_CHAN_NO_SCALE(LR_MUX2_BAT_ID, 0) -+ VADC_CHAN_VOLT(LR_MUX2_BAT_ID, 0, SCALE_DEFAULT) - VADC_CHAN_NO_SCALE(LR_MUX3_XO_THERM, 0) - VADC_CHAN_NO_SCALE(LR_MUX4_AMUX_THM1, 0) - VADC_CHAN_NO_SCALE(LR_MUX5_AMUX_THM2, 0) -diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c -index dfa31a23500f0..ac90be03332af 100644 ---- a/drivers/iio/gyro/mpu3050-core.c -+++ b/drivers/iio/gyro/mpu3050-core.c -@@ -551,6 +551,8 @@ static irqreturn_t mpu3050_trigger_handler(int irq, void *p) - MPU3050_FIFO_R, - &fifo_values[offset], - toread); -+ if (ret) -+ goto out_trigger_unlock; - - dev_dbg(mpu3050->dev, - "%04x %04x %04x %04x %04x\n", -diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c -index 52f605114ef77..d62705448ae25 100644 ---- a/drivers/iio/humidity/hid-sensor-humidity.c -+++ b/drivers/iio/humidity/hid-sensor-humidity.c -@@ -15,7 +15,10 @@ - struct hid_humidity_state { - struct hid_sensor_common common_attributes; - struct hid_sensor_hub_attribute_info humidity_attr; -- s32 humidity_data; -+ struct { -+ s32 humidity_data; -+ u64 timestamp __aligned(8); -+ } scan; - int scale_pre_decml; - int scale_post_decml; - int scale_precision; -@@ -125,9 +128,8 @@ static int humidity_proc_event(struct hid_sensor_hub_device *hsdev, - struct hid_humidity_state *humid_st = iio_priv(indio_dev); - - if (atomic_read(&humid_st->common_attributes.data_ready)) -- iio_push_to_buffers_with_timestamp(indio_dev, -- &humid_st->humidity_data, -- iio_get_time_ns(indio_dev)); -+ iio_push_to_buffers_with_timestamp(indio_dev, &humid_st->scan, -+ iio_get_time_ns(indio_dev)); - - return 0; - } -@@ -142,7 +144,7 @@ static int humidity_capture_sample(struct hid_sensor_hub_device *hsdev, - - switch (usage_id) { - case HID_USAGE_SENSOR_ATMOSPHERIC_HUMIDITY: -- humid_st->humidity_data = *(s32 *)raw_data; -+ humid_st->scan.humidity_data = *(s32 *)raw_data; - - return 0; - default: -diff --git a/drivers/iio/imu/adis16400.c b/drivers/iio/imu/adis16400.c -index 54af2ed664f6f..785a4ce606d89 100644 ---- a/drivers/iio/imu/adis16400.c -+++ b/drivers/iio/imu/adis16400.c -@@ -462,8 +462,7 @@ static int adis16400_initial_setup(struct iio_dev *indio_dev) - if (ret) - goto err_ret; - -- ret = sscanf(indio_dev->name, "adis%u\n", &device_id); -- if (ret != 1) { -+ if (sscanf(indio_dev->name, "adis%u\n", &device_id) != 1) { - ret = -EINVAL; - goto err_ret; - } -diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c -index 330cf359e0b81..e9e00ce0c6d4d 100644 ---- a/drivers/iio/light/hid-sensor-prox.c -+++ b/drivers/iio/light/hid-sensor-prox.c -@@ -23,6 +23,9 @@ struct prox_state { - struct hid_sensor_common common_attributes; - struct hid_sensor_hub_attribute_info prox_attr; - u32 human_presence; -+ int scale_pre_decml; -+ int scale_post_decml; -+ int scale_precision; - }; - - /* Channel definitions */ -@@ -93,8 +96,9 @@ static int prox_read_raw(struct iio_dev *indio_dev, - ret_type = IIO_VAL_INT; - break; - case IIO_CHAN_INFO_SCALE: -- *val = prox_state->prox_attr.units; -- ret_type = IIO_VAL_INT; -+ *val = prox_state->scale_pre_decml; -+ *val2 = prox_state->scale_post_decml; -+ ret_type = prox_state->scale_precision; - break; - case IIO_CHAN_INFO_OFFSET: - *val = hid_sensor_convert_exponent( -@@ -234,6 +238,11 @@ static int prox_parse_report(struct platform_device *pdev, - HID_USAGE_SENSOR_HUMAN_PRESENCE, - &st->common_attributes.sensitivity); - -+ st->scale_precision = hid_sensor_format_scale( -+ hsdev->usage, -+ &st->prox_attr, -+ &st->scale_pre_decml, &st->scale_post_decml); -+ - return ret; - } - -diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c -index 81688f1b932f1..da9a247097fa2 100644 ---- a/drivers/iio/temperature/hid-sensor-temperature.c -+++ b/drivers/iio/temperature/hid-sensor-temperature.c -@@ -15,7 +15,10 @@ - struct temperature_state { - struct hid_sensor_common common_attributes; - struct hid_sensor_hub_attribute_info temperature_attr; -- s32 temperature_data; -+ struct { -+ s32 temperature_data; -+ u64 timestamp __aligned(8); -+ } scan; - int scale_pre_decml; - int scale_post_decml; - int scale_precision; -@@ -32,7 +35,7 @@ static const struct iio_chan_spec temperature_channels[] = { - BIT(IIO_CHAN_INFO_SAMP_FREQ) | - BIT(IIO_CHAN_INFO_HYSTERESIS), - }, -- IIO_CHAN_SOFT_TIMESTAMP(3), -+ IIO_CHAN_SOFT_TIMESTAMP(1), - }; - - /* Adjust channel real bits based on report descriptor */ -@@ -123,9 +126,8 @@ static int temperature_proc_event(struct hid_sensor_hub_device *hsdev, - struct temperature_state *temp_st = iio_priv(indio_dev); - - if (atomic_read(&temp_st->common_attributes.data_ready)) -- iio_push_to_buffers_with_timestamp(indio_dev, -- &temp_st->temperature_data, -- iio_get_time_ns(indio_dev)); -+ iio_push_to_buffers_with_timestamp(indio_dev, &temp_st->scan, -+ iio_get_time_ns(indio_dev)); - - return 0; - } -@@ -140,7 +142,7 @@ static int temperature_capture_sample(struct hid_sensor_hub_device *hsdev, - - switch (usage_id) { - case HID_USAGE_SENSOR_DATA_ENVIRONMENTAL_TEMPERATURE: -- temp_st->temperature_data = *(s32 *)raw_data; -+ temp_st->scan.temperature_data = *(s32 *)raw_data; - return 0; - default: - return -EINVAL; -diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c -index 01da76dc1caa8..78339b0bb8e58 100644 ---- a/drivers/iommu/amd/init.c -+++ b/drivers/iommu/amd/init.c -@@ -2712,7 +2712,6 @@ static int __init early_amd_iommu_init(void) - struct acpi_table_header *ivrs_base; - acpi_status status; - int i, remap_cache_sz, ret = 0; -- u32 pci_id; - - if (!amd_iommu_detected) - return -ENODEV; -@@ -2802,16 +2801,6 @@ static int __init early_amd_iommu_init(void) - if (ret) - goto out; - -- /* Disable IOMMU if there's Stoney Ridge graphics */ -- for (i = 0; i < 32; i++) { -- pci_id = read_pci_config(0, i, 0, 0); -- if ((pci_id & 0xffff) == 0x1002 && (pci_id >> 16) == 0x98e4) { -- pr_info("Disable IOMMU on Stoney Ridge\n"); -- amd_iommu_disabled = true; -- break; -- } -- } -- - /* Disable any previously enabled IOMMUs */ - if (!is_kdump_kernel() || amd_iommu_disabled) - disable_iommus(); -@@ -2879,6 +2868,7 @@ static bool detect_ivrs(void) - { - struct acpi_table_header *ivrs_base; - acpi_status status; -+ int i; - - status = acpi_get_table("IVRS", 0, &ivrs_base); - if (status == AE_NOT_FOUND) -@@ -2891,6 +2881,17 @@ static bool detect_ivrs(void) - - acpi_put_table(ivrs_base); - -+ /* Don't use IOMMU if there is Stoney Ridge graphics */ -+ for (i = 0; i < 32; i++) { -+ u32 pci_id; -+ -+ pci_id = read_pci_config(0, i, 0, 0); -+ if ((pci_id & 0xffff) == 0x1002 && (pci_id >> 16) == 0x98e4) { -+ pr_info("Disable IOMMU on Stoney Ridge\n"); -+ return false; -+ } -+ } -+ - /* Make sure ACS will be enabled during PCI probe */ - pci_request_acs(); - -@@ -2917,12 +2918,12 @@ static int __init state_next(void) - } - break; - case IOMMU_IVRS_DETECTED: -- ret = early_amd_iommu_init(); -- init_state = ret ? IOMMU_INIT_ERROR : IOMMU_ACPI_FINISHED; -- if (init_state == IOMMU_ACPI_FINISHED && amd_iommu_disabled) { -- pr_info("AMD IOMMU disabled\n"); -+ if (amd_iommu_disabled) { - init_state = IOMMU_CMDLINE_DISABLED; - ret = -EINVAL; -+ } else { -+ ret = early_amd_iommu_init(); -+ init_state = ret ? IOMMU_INIT_ERROR : IOMMU_ACPI_FINISHED; - } - break; - case IOMMU_ACPI_FINISHED: -@@ -3000,8 +3001,11 @@ int __init amd_iommu_prepare(void) - amd_iommu_irq_remap = true; - - ret = iommu_go_to_state(IOMMU_ACPI_FINISHED); -- if (ret) -+ if (ret) { -+ amd_iommu_irq_remap = false; - return ret; -+ } -+ - return amd_iommu_irq_remap ? 0 : -ENODEV; - } - -diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c -index 97eb62f667d22..602aab98c0794 100644 ---- a/drivers/iommu/tegra-smmu.c -+++ b/drivers/iommu/tegra-smmu.c -@@ -849,12 +849,11 @@ static struct iommu_device *tegra_smmu_probe_device(struct device *dev) - smmu = tegra_smmu_find(args.np); - if (smmu) { - err = tegra_smmu_configure(smmu, dev, &args); -- of_node_put(args.np); - -- if (err < 0) -+ if (err < 0) { -+ of_node_put(args.np); - return ERR_PTR(err); -- -- break; -+ } - } - - of_node_put(args.np); -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 129e2b6bd6d3f..f848ba16427eb 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -1948,30 +1948,18 @@ static void nvme_config_discard(struct gendisk *disk, struct nvme_ns *ns) - blk_queue_max_write_zeroes_sectors(queue, UINT_MAX); - } - --static void nvme_config_write_zeroes(struct gendisk *disk, struct nvme_ns *ns) -+/* -+ * Even though NVMe spec explicitly states that MDTS is not applicable to the -+ * write-zeroes, we are cautious and limit the size to the controllers -+ * max_hw_sectors value, which is based on the MDTS field and possibly other -+ * limiting factors. -+ */ -+static void nvme_config_write_zeroes(struct request_queue *q, -+ struct nvme_ctrl *ctrl) - { -- u64 max_blocks; -- -- if (!(ns->ctrl->oncs & NVME_CTRL_ONCS_WRITE_ZEROES) || -- (ns->ctrl->quirks & NVME_QUIRK_DISABLE_WRITE_ZEROES)) -- return; -- /* -- * Even though NVMe spec explicitly states that MDTS is not -- * applicable to the write-zeroes:- "The restriction does not apply to -- * commands that do not transfer data between the host and the -- * controller (e.g., Write Uncorrectable ro Write Zeroes command).". -- * In order to be more cautious use controller's max_hw_sectors value -- * to configure the maximum sectors for the write-zeroes which is -- * configured based on the controller's MDTS field in the -- * nvme_init_identify() if available. -- */ -- if (ns->ctrl->max_hw_sectors == UINT_MAX) -- max_blocks = (u64)USHRT_MAX + 1; -- else -- max_blocks = ns->ctrl->max_hw_sectors + 1; -- -- blk_queue_max_write_zeroes_sectors(disk->queue, -- nvme_lba_to_sect(ns, max_blocks)); -+ if ((ctrl->oncs & NVME_CTRL_ONCS_WRITE_ZEROES) && -+ !(ctrl->quirks & NVME_QUIRK_DISABLE_WRITE_ZEROES)) -+ blk_queue_max_write_zeroes_sectors(q, ctrl->max_hw_sectors); - } - - static bool nvme_ns_ids_valid(struct nvme_ns_ids *ids) -@@ -2143,7 +2131,7 @@ static void nvme_update_disk_info(struct gendisk *disk, - set_capacity_and_notify(disk, capacity); - - nvme_config_discard(disk, ns); -- nvme_config_write_zeroes(disk, ns); -+ nvme_config_write_zeroes(disk->queue, ns->ctrl); - - if ((id->nsattr & NVME_NS_ATTR_RO) || - test_bit(NVME_NS_FORCE_RO, &ns->flags)) -diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c -index 746392eade455..0c3da10c1f29c 100644 ---- a/drivers/nvme/host/rdma.c -+++ b/drivers/nvme/host/rdma.c -@@ -736,8 +736,11 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl) - return ret; - - ctrl->ctrl.queue_count = nr_io_queues + 1; -- if (ctrl->ctrl.queue_count < 2) -- return 0; -+ if (ctrl->ctrl.queue_count < 2) { -+ dev_err(ctrl->ctrl.device, -+ "unable to set any I/O queues\n"); -+ return -ENOMEM; -+ } - - dev_info(ctrl->ctrl.device, - "creating %d I/O queues.\n", nr_io_queues); -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index 30d24a5a5b826..c6958e5bc91d5 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -287,7 +287,7 @@ static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req, - * directly, otherwise queue io_work. Also, only do that if we - * are on the same cpu, so we don't introduce contention. - */ -- if (queue->io_cpu == __smp_processor_id() && -+ if (queue->io_cpu == raw_smp_processor_id() && - sync && empty && mutex_trylock(&queue->send_mutex)) { - queue->more_requests = !last; - nvme_tcp_send_all(queue); -@@ -568,6 +568,13 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req, - req->pdu_len = le32_to_cpu(pdu->r2t_length); - req->pdu_sent = 0; - -+ if (unlikely(!req->pdu_len)) { -+ dev_err(queue->ctrl->ctrl.device, -+ "req %d r2t len is %u, probably a bug...\n", -+ rq->tag, req->pdu_len); -+ return -EPROTO; -+ } -+ - if (unlikely(req->data_sent + req->pdu_len > req->data_len)) { - dev_err(queue->ctrl->ctrl.device, - "req %d r2t len %u exceeded data len %u (%zu sent)\n", -@@ -1748,8 +1755,11 @@ static int nvme_tcp_alloc_io_queues(struct nvme_ctrl *ctrl) - return ret; - - ctrl->queue_count = nr_io_queues + 1; -- if (ctrl->queue_count < 2) -- return 0; -+ if (ctrl->queue_count < 2) { -+ dev_err(ctrl->device, -+ "unable to set any I/O queues\n"); -+ return -ENOMEM; -+ } - - dev_info(ctrl->device, - "creating %d I/O queues.\n", nr_io_queues); -diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c -index 8ce4d59cc9e75..870d06cfd815a 100644 ---- a/drivers/nvme/target/core.c -+++ b/drivers/nvme/target/core.c -@@ -1107,9 +1107,20 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl) - { - lockdep_assert_held(&ctrl->lock); - -- if (nvmet_cc_iosqes(ctrl->cc) != NVME_NVM_IOSQES || -- nvmet_cc_iocqes(ctrl->cc) != NVME_NVM_IOCQES || -- nvmet_cc_mps(ctrl->cc) != 0 || -+ /* -+ * Only I/O controllers should verify iosqes,iocqes. -+ * Strictly speaking, the spec says a discovery controller -+ * should verify iosqes,iocqes are zeroed, however that -+ * would break backwards compatibility, so don't enforce it. -+ */ -+ if (ctrl->subsys->type != NVME_NQN_DISC && -+ (nvmet_cc_iosqes(ctrl->cc) != NVME_NVM_IOSQES || -+ nvmet_cc_iocqes(ctrl->cc) != NVME_NVM_IOCQES)) { -+ ctrl->csts = NVME_CSTS_CFS; -+ return; -+ } -+ -+ if (nvmet_cc_mps(ctrl->cc) != 0 || - nvmet_cc_ams(ctrl->cc) != 0 || - nvmet_cc_css(ctrl->cc) != 0) { - ctrl->csts = NVME_CSTS_CFS; -diff --git a/drivers/pci/hotplug/rpadlpar_sysfs.c b/drivers/pci/hotplug/rpadlpar_sysfs.c -index cdbfa5df3a51f..dbfa0b55d31a5 100644 ---- a/drivers/pci/hotplug/rpadlpar_sysfs.c -+++ b/drivers/pci/hotplug/rpadlpar_sysfs.c -@@ -34,12 +34,11 @@ static ssize_t add_slot_store(struct kobject *kobj, struct kobj_attribute *attr, - if (nbytes >= MAX_DRC_NAME_LEN) - return 0; - -- memcpy(drc_name, buf, nbytes); -+ strscpy(drc_name, buf, nbytes + 1); - - end = strchr(drc_name, '\n'); -- if (!end) -- end = &drc_name[nbytes]; -- *end = '\0'; -+ if (end) -+ *end = '\0'; - - rc = dlpar_add_slot(drc_name); - if (rc) -@@ -65,12 +64,11 @@ static ssize_t remove_slot_store(struct kobject *kobj, - if (nbytes >= MAX_DRC_NAME_LEN) - return 0; - -- memcpy(drc_name, buf, nbytes); -+ strscpy(drc_name, buf, nbytes + 1); - - end = strchr(drc_name, '\n'); -- if (!end) -- end = &drc_name[nbytes]; -- *end = '\0'; -+ if (end) -+ *end = '\0'; - - rc = dlpar_remove_slot(drc_name); - if (rc) -diff --git a/drivers/pci/hotplug/s390_pci_hpc.c b/drivers/pci/hotplug/s390_pci_hpc.c -index c9e790c74051f..a047c421debe2 100644 ---- a/drivers/pci/hotplug/s390_pci_hpc.c -+++ b/drivers/pci/hotplug/s390_pci_hpc.c -@@ -93,8 +93,9 @@ static int disable_slot(struct hotplug_slot *hotplug_slot) - pci_dev_put(pdev); - return -EBUSY; - } -+ pci_dev_put(pdev); - -- zpci_remove_device(zdev); -+ zpci_remove_device(zdev, false); - - rc = zpci_disable_device(zdev); - if (rc) -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index bc79a017e1a21..46a8f2d1d2b83 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -2421,7 +2421,7 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, - memset(dstbuf, 0, 33); - size = (nbytes < 32) ? nbytes : 32; - if (copy_from_user(dstbuf, buf, size)) -- return 0; -+ return -EFAULT; - - if (dent == phba->debug_InjErrLBA) { - if ((dstbuf[0] == 'o') && (dstbuf[1] == 'f') && -@@ -2430,7 +2430,7 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, - } - - if ((tmp == 0) && (kstrtoull(dstbuf, 0, &tmp))) -- return 0; -+ return -EINVAL; - - if (dent == phba->debug_writeGuard) - phba->lpfc_injerr_wgrd_cnt = (uint32_t)tmp; -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index c8b09a81834d6..72439d6aa0578 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -407,7 +407,7 @@ mpt3sas_get_port_by_id(struct MPT3SAS_ADAPTER *ioc, - * And add this object to port_table_list. - */ - if (!ioc->multipath_on_hba) { -- port = kzalloc(sizeof(struct hba_port), GFP_KERNEL); -+ port = kzalloc(sizeof(struct hba_port), GFP_ATOMIC); - if (!port) - return NULL; - -diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c -index 4adf9ded296aa..329fd025c7189 100644 ---- a/drivers/scsi/myrs.c -+++ b/drivers/scsi/myrs.c -@@ -2273,12 +2273,12 @@ static void myrs_cleanup(struct myrs_hba *cs) - if (cs->mmio_base) { - cs->disable_intr(cs); - iounmap(cs->mmio_base); -+ cs->mmio_base = NULL; - } - if (cs->irq) - free_irq(cs->irq, cs); - if (cs->io_addr) - release_region(cs->io_addr, 0x80); -- iounmap(cs->mmio_base); - pci_set_drvdata(pdev, NULL); - pci_disable_device(pdev); - scsi_host_put(cs->host); -diff --git a/drivers/scsi/ufs/ufs-mediatek.c b/drivers/scsi/ufs/ufs-mediatek.c -index c55202b92a43a..a981f261b3043 100644 ---- a/drivers/scsi/ufs/ufs-mediatek.c -+++ b/drivers/scsi/ufs/ufs-mediatek.c -@@ -911,7 +911,7 @@ static void ufs_mtk_vreg_set_lpm(struct ufs_hba *hba, bool lpm) - if (!hba->vreg_info.vccq2 || !hba->vreg_info.vcc) - return; - -- if (lpm & !hba->vreg_info.vcc->enabled) -+ if (lpm && !hba->vreg_info.vcc->enabled) - regulator_set_mode(hba->vreg_info.vccq2->reg, - REGULATOR_MODE_IDLE); - else if (!lpm) -diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c -index 826b01f346246..2e1255bf1b429 100644 ---- a/drivers/spi/spi-cadence-quadspi.c -+++ b/drivers/spi/spi-cadence-quadspi.c -@@ -1198,6 +1198,7 @@ static int cqspi_probe(struct platform_device *pdev) - cqspi = spi_master_get_devdata(master); - - cqspi->pdev = pdev; -+ platform_set_drvdata(pdev, cqspi); - - /* Obtain configuration from OF. */ - ret = cqspi_of_get_pdata(cqspi); -diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c -index a8572f49d3adc..0fc2dae329e54 100644 ---- a/drivers/thunderbolt/switch.c -+++ b/drivers/thunderbolt/switch.c -@@ -762,12 +762,6 @@ static int tb_init_port(struct tb_port *port) - - tb_dump_port(port->sw->tb, &port->config); - -- /* Control port does not need HopID allocation */ -- if (port->port) { -- ida_init(&port->in_hopids); -- ida_init(&port->out_hopids); -- } -- - INIT_LIST_HEAD(&port->list); - return 0; - -@@ -1789,10 +1783,8 @@ static void tb_switch_release(struct device *dev) - dma_port_free(sw->dma_port); - - tb_switch_for_each_port(sw, port) { -- if (!port->disabled) { -- ida_destroy(&port->in_hopids); -- ida_destroy(&port->out_hopids); -- } -+ ida_destroy(&port->in_hopids); -+ ida_destroy(&port->out_hopids); - } - - kfree(sw->uuid); -@@ -1972,6 +1964,12 @@ struct tb_switch *tb_switch_alloc(struct tb *tb, struct device *parent, - /* minimum setup for tb_find_cap and tb_drom_read to work */ - sw->ports[i].sw = sw; - sw->ports[i].port = i; -+ -+ /* Control port does not need HopID allocation */ -+ if (i) { -+ ida_init(&sw->ports[i].in_hopids); -+ ida_init(&sw->ports[i].out_hopids); -+ } - } - - ret = tb_switch_find_vse_cap(sw, TB_VSE_CAP_PLUG_EVENTS); -diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c -index 51d5b031cada5..9932b1870e56f 100644 ---- a/drivers/thunderbolt/tb.c -+++ b/drivers/thunderbolt/tb.c -@@ -138,6 +138,10 @@ static void tb_discover_tunnels(struct tb_switch *sw) - parent->boot = true; - parent = tb_switch_parent(parent); - } -+ } else if (tb_tunnel_is_dp(tunnel)) { -+ /* Keep the domain from powering down */ -+ pm_runtime_get_sync(&tunnel->src_port->sw->dev); -+ pm_runtime_get_sync(&tunnel->dst_port->sw->dev); - } - - list_add_tail(&tunnel->list, &tcm->tunnel_list); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 56f7235bc068c..2a86ad4b12b34 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -783,8 +783,6 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) - - trace_dwc3_gadget_ep_disable(dep); - -- dwc3_remove_requests(dwc, dep); -- - /* make sure HW endpoint isn't stalled */ - if (dep->flags & DWC3_EP_STALL) - __dwc3_gadget_ep_set_halt(dep, 0, false); -@@ -803,6 +801,8 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) - dep->endpoint.desc = NULL; - } - -+ dwc3_remove_requests(dwc, dep); -+ - return 0; - } - -@@ -1617,7 +1617,7 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req) - { - struct dwc3 *dwc = dep->dwc; - -- if (!dep->endpoint.desc || !dwc->pullups_connected) { -+ if (!dep->endpoint.desc || !dwc->pullups_connected || !dwc->connected) { - dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n", - dep->name); - return -ESHUTDOWN; -@@ -2125,6 +2125,17 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) - } - } - -+ /* -+ * Check the return value for successful resume, or error. For a -+ * successful resume, the DWC3 runtime PM resume routine will handle -+ * the run stop sequence, so avoid duplicate operations here. -+ */ -+ ret = pm_runtime_get_sync(dwc->dev); -+ if (!ret || ret < 0) { -+ pm_runtime_put(dwc->dev); -+ return 0; -+ } -+ - /* - * Synchronize any pending event handling before executing the controller - * halt routine. -@@ -2139,6 +2150,7 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) - if (!is_on) { - u32 count; - -+ dwc->connected = false; - /* - * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a - * Section 4.1.8 Table 4-7, it states that for a device-initiated -@@ -2169,6 +2181,7 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) - - ret = dwc3_gadget_run_stop(dwc, is_on, false); - spin_unlock_irqrestore(&dwc->lock, flags); -+ pm_runtime_put(dwc->dev); - - return ret; - } -@@ -3254,8 +3267,6 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) - { - u32 reg; - -- dwc->connected = true; -- - /* - * WORKAROUND: DWC3 revisions <1.88a have an issue which - * would cause a missing Disconnect Event if there's a -@@ -3295,6 +3306,7 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) - * transfers." - */ - dwc3_stop_active_transfers(dwc); -+ dwc->connected = true; - - reg = dwc3_readl(dwc->regs, DWC3_DCTL); - reg &= ~DWC3_DCTL_TSTCTRL_MASK; -diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c -index 36ffb43f9c1a0..9b7fa53d6642b 100644 ---- a/drivers/usb/gadget/configfs.c -+++ b/drivers/usb/gadget/configfs.c -@@ -97,6 +97,8 @@ struct gadget_config_name { - struct list_head list; - }; - -+#define USB_MAX_STRING_WITH_NULL_LEN (USB_MAX_STRING_LEN+1) -+ - static int usb_string_copy(const char *s, char **s_copy) - { - int ret; -@@ -106,12 +108,16 @@ static int usb_string_copy(const char *s, char **s_copy) - if (ret > USB_MAX_STRING_LEN) - return -EOVERFLOW; - -- str = kstrdup(s, GFP_KERNEL); -- if (!str) -- return -ENOMEM; -+ if (copy) { -+ str = copy; -+ } else { -+ str = kmalloc(USB_MAX_STRING_WITH_NULL_LEN, GFP_KERNEL); -+ if (!str) -+ return -ENOMEM; -+ } -+ strcpy(str, s); - if (str[ret - 1] == '\n') - str[ret - 1] = '\0'; -- kfree(copy); - *s_copy = str; - return 0; - } -diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c -index 5eb895b19c558..f4304ce69350e 100644 ---- a/drivers/usb/storage/transport.c -+++ b/drivers/usb/storage/transport.c -@@ -656,6 +656,13 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us) - need_auto_sense = 1; - } - -+ /* Some devices (Kindle) require another command after SYNC CACHE */ -+ if ((us->fflags & US_FL_SENSE_AFTER_SYNC) && -+ srb->cmnd[0] == SYNCHRONIZE_CACHE) { -+ usb_stor_dbg(us, "-- sense after SYNC CACHE\n"); -+ need_auto_sense = 1; -+ } -+ - /* - * If we have a failure, we're going to do a REQUEST_SENSE - * automatically. Note that we differentiate between a command -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 5732e9691f08f..efa972be2ee34 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -2211,6 +2211,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_READ_DISC_INFO ), - -+/* -+ * Reported by Matthias Schwarzott -+ * The Amazon Kindle treats SYNCHRONIZE CACHE as an indication that -+ * the host may be finished with it, and automatically ejects its -+ * emulated media unless it receives another command within one second. -+ */ -+UNUSUAL_DEV( 0x1949, 0x0004, 0x0000, 0x9999, -+ "Amazon", -+ "Kindle", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_SENSE_AFTER_SYNC ), -+ - /* - * Reported by Oliver Neukum - * This device morphes spontaneously into another device if the access -diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c -index 22a85b396f698..3cd4859ffab58 100644 ---- a/drivers/usb/typec/tcpm/tcpm.c -+++ b/drivers/usb/typec/tcpm/tcpm.c -@@ -797,6 +797,7 @@ static int tcpm_set_current_limit(struct tcpm_port *port, u32 max_ma, u32 mv) - - port->supply_voltage = mv; - port->current_limit = max_ma; -+ power_supply_changed(port->psy); - - if (port->tcpc->set_current_limit) - ret = port->tcpc->set_current_limit(port->tcpc, max_ma, mv); -@@ -2345,6 +2346,7 @@ static int tcpm_pd_select_pdo(struct tcpm_port *port, int *sink_pdo, - - port->pps_data.supported = false; - port->usb_type = POWER_SUPPLY_USB_TYPE_PD; -+ power_supply_changed(port->psy); - - /* - * Select the source PDO providing the most power which has a -@@ -2369,6 +2371,7 @@ static int tcpm_pd_select_pdo(struct tcpm_port *port, int *sink_pdo, - port->pps_data.supported = true; - port->usb_type = - POWER_SUPPLY_USB_TYPE_PD_PPS; -+ power_supply_changed(port->psy); - } - continue; - default: -@@ -2526,6 +2529,7 @@ static unsigned int tcpm_pd_select_pps_apdo(struct tcpm_port *port) - port->pps_data.out_volt)); - port->pps_data.op_curr = min(port->pps_data.max_curr, - port->pps_data.op_curr); -+ power_supply_changed(port->psy); - } - - return src_pdo; -@@ -2761,6 +2765,7 @@ static int tcpm_set_charge(struct tcpm_port *port, bool charge) - return ret; - } - port->vbus_charge = charge; -+ power_supply_changed(port->psy); - return 0; - } - -@@ -2935,6 +2940,7 @@ static void tcpm_reset_port(struct tcpm_port *port) - port->try_src_count = 0; - port->try_snk_count = 0; - port->usb_type = POWER_SUPPLY_USB_TYPE_C; -+ power_supply_changed(port->psy); - port->nr_sink_caps = 0; - port->sink_cap_done = false; - if (port->tcpc->enable_frs) -@@ -5129,7 +5135,7 @@ static int tcpm_psy_set_prop(struct power_supply *psy, - ret = -EINVAL; - break; - } -- -+ power_supply_changed(port->psy); - return ret; - } - -@@ -5281,6 +5287,7 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc) - err = devm_tcpm_psy_register(port); - if (err) - goto out_role_sw_put; -+ power_supply_changed(port->psy); - - port->typec_port = typec_register_port(port->dev, &port->typec_caps); - if (IS_ERR(port->typec_port)) { -diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c -index 6e6ef63175237..29bd1c5a283cd 100644 ---- a/drivers/usb/typec/tps6598x.c -+++ b/drivers/usb/typec/tps6598x.c -@@ -64,7 +64,6 @@ enum { - struct tps6598x_rx_identity_reg { - u8 status; - struct usb_pd_identity identity; -- u32 vdo[3]; - } __packed; - - /* Standard Task return codes */ -diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c -index a3ec39fc61778..7383a543c6d12 100644 ---- a/drivers/usb/usbip/vudc_sysfs.c -+++ b/drivers/usb/usbip/vudc_sysfs.c -@@ -174,7 +174,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, - - udc->ud.tcp_socket = socket; - udc->ud.tcp_rx = tcp_rx; -- udc->ud.tcp_rx = tcp_tx; -+ udc->ud.tcp_tx = tcp_tx; - udc->ud.status = SDEV_ST_USED; - - spin_unlock_irq(&udc->ud.lock); -diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig -index 5533df91b257d..90c0525b1e0cf 100644 ---- a/drivers/vfio/Kconfig -+++ b/drivers/vfio/Kconfig -@@ -21,7 +21,7 @@ config VFIO_VIRQFD - - menuconfig VFIO - tristate "VFIO Non-Privileged userspace driver framework" -- depends on IOMMU_API -+ select IOMMU_API - select VFIO_IOMMU_TYPE1 if (X86 || S390 || ARM || ARM64) - help - VFIO provides a framework for secure userspace device drivers. -diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c -index ef688c8c0e0e6..e0a27e3362935 100644 ---- a/drivers/vhost/vdpa.c -+++ b/drivers/vhost/vdpa.c -@@ -308,8 +308,10 @@ static long vhost_vdpa_get_vring_num(struct vhost_vdpa *v, u16 __user *argp) - - static void vhost_vdpa_config_put(struct vhost_vdpa *v) - { -- if (v->config_ctx) -+ if (v->config_ctx) { - eventfd_ctx_put(v->config_ctx); -+ v->config_ctx = NULL; -+ } - } - - static long vhost_vdpa_set_config_call(struct vhost_vdpa *v, u32 __user *argp) -@@ -329,8 +331,12 @@ static long vhost_vdpa_set_config_call(struct vhost_vdpa *v, u32 __user *argp) - if (!IS_ERR_OR_NULL(ctx)) - eventfd_ctx_put(ctx); - -- if (IS_ERR(v->config_ctx)) -- return PTR_ERR(v->config_ctx); -+ if (IS_ERR(v->config_ctx)) { -+ long ret = PTR_ERR(v->config_ctx); -+ -+ v->config_ctx = NULL; -+ return ret; -+ } - - v->vdpa->config->set_config_cb(v->vdpa, &cb); - -@@ -900,14 +906,10 @@ err: - - static void vhost_vdpa_clean_irq(struct vhost_vdpa *v) - { -- struct vhost_virtqueue *vq; - int i; - -- for (i = 0; i < v->nvqs; i++) { -- vq = &v->vqs[i]; -- if (vq->call_ctx.producer.irq) -- irq_bypass_unregister_producer(&vq->call_ctx.producer); -- } -+ for (i = 0; i < v->nvqs; i++) -+ vhost_vdpa_unsetup_vq_irq(v, i); - } - - static int vhost_vdpa_release(struct inode *inode, struct file *filep) -diff --git a/fs/afs/dir.c b/fs/afs/dir.c -index 7bd659ad959ec..7cb0604e2841f 100644 ---- a/fs/afs/dir.c -+++ b/fs/afs/dir.c -@@ -69,7 +69,6 @@ const struct inode_operations afs_dir_inode_operations = { - .permission = afs_permission, - .getattr = afs_getattr, - .setattr = afs_setattr, -- .listxattr = afs_listxattr, - }; - - const struct address_space_operations afs_dir_aops = { -diff --git a/fs/afs/file.c b/fs/afs/file.c -index 85f5adf21aa08..960b64268623e 100644 ---- a/fs/afs/file.c -+++ b/fs/afs/file.c -@@ -43,7 +43,6 @@ const struct inode_operations afs_file_inode_operations = { - .getattr = afs_getattr, - .setattr = afs_setattr, - .permission = afs_permission, -- .listxattr = afs_listxattr, - }; - - const struct address_space_operations afs_fs_aops = { -diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c -index 97cab12b0a6c2..71c58723763d2 100644 ---- a/fs/afs/fs_operation.c -+++ b/fs/afs/fs_operation.c -@@ -181,10 +181,13 @@ void afs_wait_for_operation(struct afs_operation *op) - if (test_bit(AFS_SERVER_FL_IS_YFS, &op->server->flags) && - op->ops->issue_yfs_rpc) - op->ops->issue_yfs_rpc(op); -- else -+ else if (op->ops->issue_afs_rpc) - op->ops->issue_afs_rpc(op); -+ else -+ op->ac.error = -ENOTSUPP; - -- op->error = afs_wait_for_call_to_complete(op->call, &op->ac); -+ if (op->call) -+ op->error = afs_wait_for_call_to_complete(op->call, &op->ac); - } - - switch (op->error) { -diff --git a/fs/afs/inode.c b/fs/afs/inode.c -index b0d7b892090da..1d03eb1920ec0 100644 ---- a/fs/afs/inode.c -+++ b/fs/afs/inode.c -@@ -27,7 +27,6 @@ - - static const struct inode_operations afs_symlink_inode_operations = { - .get_link = page_get_link, -- .listxattr = afs_listxattr, - }; - - static noinline void dump_vnode(struct afs_vnode *vnode, struct afs_vnode *parent_vnode) -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index 0d150a29e39ec..525ef075fcd90 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -1508,7 +1508,6 @@ extern int afs_launder_page(struct page *); - * xattr.c - */ - extern const struct xattr_handler *afs_xattr_handlers[]; --extern ssize_t afs_listxattr(struct dentry *, char *, size_t); - - /* - * yfsclient.c -diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c -index 052dab2f5c03a..bbb2c210d139d 100644 ---- a/fs/afs/mntpt.c -+++ b/fs/afs/mntpt.c -@@ -32,7 +32,6 @@ const struct inode_operations afs_mntpt_inode_operations = { - .lookup = afs_mntpt_lookup, - .readlink = page_readlink, - .getattr = afs_getattr, -- .listxattr = afs_listxattr, - }; - - const struct inode_operations afs_autocell_inode_operations = { -diff --git a/fs/afs/xattr.c b/fs/afs/xattr.c -index 95c573dcda116..6a29337bd562f 100644 ---- a/fs/afs/xattr.c -+++ b/fs/afs/xattr.c -@@ -11,29 +11,6 @@ - #include - #include "internal.h" - --static const char afs_xattr_list[] = -- "afs.acl\0" -- "afs.cell\0" -- "afs.fid\0" -- "afs.volume\0" -- "afs.yfs.acl\0" -- "afs.yfs.acl_inherited\0" -- "afs.yfs.acl_num_cleaned\0" -- "afs.yfs.vol_acl"; -- --/* -- * Retrieve a list of the supported xattrs. -- */ --ssize_t afs_listxattr(struct dentry *dentry, char *buffer, size_t size) --{ -- if (size == 0) -- return sizeof(afs_xattr_list); -- if (size < sizeof(afs_xattr_list)) -- return -ERANGE; -- memcpy(buffer, afs_xattr_list, sizeof(afs_xattr_list)); -- return sizeof(afs_xattr_list); --} -- - /* - * Deal with the result of a successful fetch ACL operation. - */ -@@ -230,6 +207,8 @@ static int afs_xattr_get_yfs(const struct xattr_handler *handler, - else - ret = -ERANGE; - } -+ } else if (ret == -ENOTSUPP) { -+ ret = -ENODATA; - } - - error_yacl: -@@ -254,6 +233,7 @@ static int afs_xattr_set_yfs(const struct xattr_handler *handler, - { - struct afs_operation *op; - struct afs_vnode *vnode = AFS_FS_I(inode); -+ int ret; - - if (flags == XATTR_CREATE || - strcmp(name, "acl") != 0) -@@ -268,7 +248,10 @@ static int afs_xattr_set_yfs(const struct xattr_handler *handler, - return afs_put_operation(op); - - op->ops = &yfs_store_opaque_acl2_operation; -- return afs_do_sync_operation(op); -+ ret = afs_do_sync_operation(op); -+ if (ret == -ENOTSUPP) -+ ret = -ENODATA; -+ return ret; - } - - static const struct xattr_handler afs_xattr_yfs_handler = { -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 40bf27a65c5d5..33fe5d839c110 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -1365,7 +1365,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq) - "failed to read tree block %llu from get_old_root", - logical); - } else { -+ btrfs_tree_read_lock(old); - eb = btrfs_clone_extent_buffer(old); -+ btrfs_tree_read_unlock(old); - free_extent_buffer(old); - } - } else if (old_root) { -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 9b4f75568261e..df25d3e300f07 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -8806,7 +8806,7 @@ int __init btrfs_init_cachep(void) - - btrfs_free_space_bitmap_cachep = kmem_cache_create("btrfs_free_space_bitmap", - PAGE_SIZE, PAGE_SIZE, -- SLAB_RED_ZONE, NULL); -+ SLAB_MEM_SPREAD, NULL); - if (!btrfs_free_space_bitmap_cachep) - goto fail; - -diff --git a/fs/cifs/fs_context.c b/fs/cifs/fs_context.c -index 798c32cab146f..3a26ad47b220c 100644 ---- a/fs/cifs/fs_context.c -+++ b/fs/cifs/fs_context.c -@@ -1175,9 +1175,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, - pr_warn_once("Witness protocol support is experimental\n"); - break; - case Opt_rootfs: --#ifdef CONFIG_CIFS_ROOT -- ctx->rootfs = true; -+#ifndef CONFIG_CIFS_ROOT -+ cifs_dbg(VFS, "rootfs support requires CONFIG_CIFS_ROOT config option\n"); -+ goto cifs_parse_mount_err; - #endif -+ ctx->rootfs = true; - break; - case Opt_posixpaths: - if (result.negated) -diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c -index a83b3a8ffaacc..cbff8a7e36a99 100644 ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -2383,7 +2383,7 @@ int cifs_getattr(const struct path *path, struct kstat *stat, - * We need to be sure that all dirty pages are written and the server - * has actual ctime, mtime and file length. - */ -- if ((request_mask & (STATX_CTIME | STATX_MTIME | STATX_SIZE)) && -+ if ((request_mask & (STATX_CTIME | STATX_MTIME | STATX_SIZE | STATX_BLOCKS)) && - !CIFS_CACHE_READ(CIFS_I(inode)) && - inode->i_mapping && inode->i_mapping->nrpages != 0) { - rc = filemap_fdatawait(inode->i_mapping); -@@ -2573,6 +2573,14 @@ set_size_out: - if (rc == 0) { - cifsInode->server_eof = attrs->ia_size; - cifs_setsize(inode, attrs->ia_size); -+ /* -+ * i_blocks is not related to (i_size / i_blksize), but instead -+ * 512 byte (2**9) size is required for calculating num blocks. -+ * Until we can query the server for actual allocation size, -+ * this is best estimate we have for blocks allocated for a file -+ * Number of blocks must be rounded up so size 1 is not 0 blocks -+ */ -+ inode->i_blocks = (512 - 1 + attrs->ia_size) >> 9; - - /* - * The man page of truncate says if the size changed, -diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c -index 14ecf1a9f11a3..64fccb8809ecb 100644 ---- a/fs/cifs/transport.c -+++ b/fs/cifs/transport.c -@@ -1171,9 +1171,12 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, - /* - * Compounding is never used during session establish. - */ -- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) -+ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) { -+ mutex_lock(&server->srv_mutex); - smb311_update_preauth_hash(ses, rqst[0].rq_iov, - rqst[0].rq_nvec); -+ mutex_unlock(&server->srv_mutex); -+ } - - for (i = 0; i < num_rqst; i++) { - rc = wait_for_response(server, midQ[i]); -@@ -1241,7 +1244,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, - .iov_base = resp_iov[0].iov_base, - .iov_len = resp_iov[0].iov_len - }; -+ mutex_lock(&server->srv_mutex); - smb311_update_preauth_hash(ses, &iov, 1); -+ mutex_unlock(&server->srv_mutex); - } - - out: -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 2866d249f3d26..e5c81593d972c 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -2792,6 +2792,8 @@ void __ext4_fc_track_link(handle_t *handle, struct inode *inode, - struct dentry *dentry); - void ext4_fc_track_unlink(handle_t *handle, struct dentry *dentry); - void ext4_fc_track_link(handle_t *handle, struct dentry *dentry); -+void __ext4_fc_track_create(handle_t *handle, struct inode *inode, -+ struct dentry *dentry); - void ext4_fc_track_create(handle_t *handle, struct dentry *dentry); - void ext4_fc_track_inode(handle_t *handle, struct inode *inode); - void ext4_fc_mark_ineligible(struct super_block *sb, int reason); -diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c -index 0a14a7c87bf82..62e9e5535fa76 100644 ---- a/fs/ext4/fast_commit.c -+++ b/fs/ext4/fast_commit.c -@@ -513,10 +513,10 @@ void ext4_fc_track_link(handle_t *handle, struct dentry *dentry) - __ext4_fc_track_link(handle, d_inode(dentry), dentry); - } - --void ext4_fc_track_create(handle_t *handle, struct dentry *dentry) -+void __ext4_fc_track_create(handle_t *handle, struct inode *inode, -+ struct dentry *dentry) - { - struct __track_dentry_update_args args; -- struct inode *inode = d_inode(dentry); - int ret; - - args.dentry = dentry; -@@ -527,6 +527,11 @@ void ext4_fc_track_create(handle_t *handle, struct dentry *dentry) - trace_ext4_fc_track_create(inode, dentry, ret); - } - -+void ext4_fc_track_create(handle_t *handle, struct dentry *dentry) -+{ -+ __ext4_fc_track_create(handle, d_inode(dentry), dentry); -+} -+ - /* __track_fn for inode tracking */ - static int __track_inode(struct inode *inode, void *arg, bool update) - { -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index c173c84058561..ed498538a7499 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -5029,7 +5029,7 @@ static int ext4_do_update_inode(handle_t *handle, - struct ext4_inode_info *ei = EXT4_I(inode); - struct buffer_head *bh = iloc->bh; - struct super_block *sb = inode->i_sb; -- int err = 0, rc, block; -+ int err = 0, block; - int need_datasync = 0, set_large_file = 0; - uid_t i_uid; - gid_t i_gid; -@@ -5141,9 +5141,9 @@ static int ext4_do_update_inode(handle_t *handle, - bh->b_data); - - BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata"); -- rc = ext4_handle_dirty_metadata(handle, NULL, bh); -- if (!err) -- err = rc; -+ err = ext4_handle_dirty_metadata(handle, NULL, bh); -+ if (err) -+ goto out_brelse; - ext4_clear_inode_state(inode, EXT4_STATE_NEW); - if (set_large_file) { - BUFFER_TRACE(EXT4_SB(sb)->s_sbh, "get write access"); -@@ -5389,8 +5389,10 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) - inode->i_gid = attr->ia_gid; - error = ext4_mark_inode_dirty(handle, inode); - ext4_journal_stop(handle); -- if (unlikely(error)) -+ if (unlikely(error)) { -+ ext4_fc_stop_update(inode); - return error; -+ } - } - - if (attr->ia_valid & ATTR_SIZE) { -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index df0368d578b16..078f26f4b56e3 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -3601,6 +3601,31 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent, - return retval; - } - -+static void ext4_resetent(handle_t *handle, struct ext4_renament *ent, -+ unsigned ino, unsigned file_type) -+{ -+ struct ext4_renament old = *ent; -+ int retval = 0; -+ -+ /* -+ * old->de could have moved from under us during make indexed dir, -+ * so the old->de may no longer valid and need to find it again -+ * before reset old inode info. -+ */ -+ old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, NULL); -+ if (IS_ERR(old.bh)) -+ retval = PTR_ERR(old.bh); -+ if (!old.bh) -+ retval = -ENOENT; -+ if (retval) { -+ ext4_std_error(old.dir->i_sb, retval); -+ return; -+ } -+ -+ ext4_setent(handle, &old, ino, file_type); -+ brelse(old.bh); -+} -+ - static int ext4_find_delete_entry(handle_t *handle, struct inode *dir, - const struct qstr *d_name) - { -@@ -3836,6 +3861,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, - retval = ext4_mark_inode_dirty(handle, whiteout); - if (unlikely(retval)) - goto end_rename; -+ - } - if (!new.bh) { - retval = ext4_add_entry(handle, new.dentry, old.inode); -@@ -3909,6 +3935,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, - ext4_fc_track_unlink(handle, new.dentry); - __ext4_fc_track_link(handle, old.inode, new.dentry); - __ext4_fc_track_unlink(handle, old.inode, old.dentry); -+ if (whiteout) -+ __ext4_fc_track_create(handle, whiteout, old.dentry); - } - - if (new.inode) { -@@ -3923,8 +3951,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, - end_rename: - if (whiteout) { - if (retval) { -- ext4_setent(handle, &old, -- old.inode->i_ino, old_file_type); -+ ext4_resetent(handle, &old, -+ old.inode->i_ino, old_file_type); - drop_nlink(whiteout); - } - unlock_new_inode(whiteout); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 2ae0af1c88c78..a1353b0825ea3 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -5149,8 +5149,8 @@ failed_mount_wq: - failed_mount3a: - ext4_es_unregister_shrinker(sbi); - failed_mount3: -- del_timer_sync(&sbi->s_err_report); - flush_work(&sbi->s_error_work); -+ del_timer_sync(&sbi->s_err_report); - if (sbi->s_mmp_tsk) - kthread_stop(sbi->s_mmp_tsk); - failed_mount2: -diff --git a/fs/ext4/verity.c b/fs/ext4/verity.c -index 5b7ba8f711538..00e3cbde472e4 100644 ---- a/fs/ext4/verity.c -+++ b/fs/ext4/verity.c -@@ -201,55 +201,76 @@ static int ext4_end_enable_verity(struct file *filp, const void *desc, - struct inode *inode = file_inode(filp); - const int credits = 2; /* superblock and inode for ext4_orphan_del() */ - handle_t *handle; -+ struct ext4_iloc iloc; - int err = 0; -- int err2; - -- if (desc != NULL) { -- /* Succeeded; write the verity descriptor. */ -- err = ext4_write_verity_descriptor(inode, desc, desc_size, -- merkle_tree_size); -- -- /* Write all pages before clearing VERITY_IN_PROGRESS. */ -- if (!err) -- err = filemap_write_and_wait(inode->i_mapping); -- } -+ /* -+ * If an error already occurred (which fs/verity/ signals by passing -+ * desc == NULL), then only clean-up is needed. -+ */ -+ if (desc == NULL) -+ goto cleanup; - -- /* If we failed, truncate anything we wrote past i_size. */ -- if (desc == NULL || err) -- ext4_truncate(inode); -+ /* Append the verity descriptor. */ -+ err = ext4_write_verity_descriptor(inode, desc, desc_size, -+ merkle_tree_size); -+ if (err) -+ goto cleanup; - - /* -- * We must always clean up by clearing EXT4_STATE_VERITY_IN_PROGRESS and -- * deleting the inode from the orphan list, even if something failed. -- * If everything succeeded, we'll also set the verity bit in the same -- * transaction. -+ * Write all pages (both data and verity metadata). Note that this must -+ * happen before clearing EXT4_STATE_VERITY_IN_PROGRESS; otherwise pages -+ * beyond i_size won't be written properly. For crash consistency, this -+ * also must happen before the verity inode flag gets persisted. - */ -+ err = filemap_write_and_wait(inode->i_mapping); -+ if (err) -+ goto cleanup; - -- ext4_clear_inode_state(inode, EXT4_STATE_VERITY_IN_PROGRESS); -+ /* -+ * Finally, set the verity inode flag and remove the inode from the -+ * orphan list (in a single transaction). -+ */ - - handle = ext4_journal_start(inode, EXT4_HT_INODE, credits); - if (IS_ERR(handle)) { -- ext4_orphan_del(NULL, inode); -- return PTR_ERR(handle); -+ err = PTR_ERR(handle); -+ goto cleanup; - } - -- err2 = ext4_orphan_del(handle, inode); -- if (err2) -- goto out_stop; -+ err = ext4_orphan_del(handle, inode); -+ if (err) -+ goto stop_and_cleanup; - -- if (desc != NULL && !err) { -- struct ext4_iloc iloc; -+ err = ext4_reserve_inode_write(handle, inode, &iloc); -+ if (err) -+ goto stop_and_cleanup; - -- err = ext4_reserve_inode_write(handle, inode, &iloc); -- if (err) -- goto out_stop; -- ext4_set_inode_flag(inode, EXT4_INODE_VERITY); -- ext4_set_inode_flags(inode, false); -- err = ext4_mark_iloc_dirty(handle, inode, &iloc); -- } --out_stop: -+ ext4_set_inode_flag(inode, EXT4_INODE_VERITY); -+ ext4_set_inode_flags(inode, false); -+ err = ext4_mark_iloc_dirty(handle, inode, &iloc); -+ if (err) -+ goto stop_and_cleanup; -+ -+ ext4_journal_stop(handle); -+ -+ ext4_clear_inode_state(inode, EXT4_STATE_VERITY_IN_PROGRESS); -+ return 0; -+ -+stop_and_cleanup: - ext4_journal_stop(handle); -- return err ?: err2; -+cleanup: -+ /* -+ * Verity failed to be enabled, so clean up by truncating any verity -+ * metadata that was written beyond i_size (both from cache and from -+ * disk), removing the inode from the orphan list (if it wasn't done -+ * already), and clearing EXT4_STATE_VERITY_IN_PROGRESS. -+ */ -+ truncate_inode_pages(inode->i_mapping, inode->i_size); -+ ext4_truncate(inode); -+ ext4_orphan_del(NULL, inode); -+ ext4_clear_inode_state(inode, EXT4_STATE_VERITY_IN_PROGRESS); -+ return err; - } - - static int ext4_get_verity_descriptor_location(struct inode *inode, -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index 372208500f4e7..6aef74f7c9eea 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -2400,7 +2400,7 @@ retry_inode: - * external inode if possible. - */ - if (ext4_has_feature_ea_inode(inode->i_sb) && -- !i.in_inode) { -+ i.value_len && !i.in_inode) { - i.in_inode = 1; - goto retry_inode; - } -diff --git a/fs/io_uring.c b/fs/io_uring.c -index 262fd4cfd3ad5..ef078182e7ca4 100644 ---- a/fs/io_uring.c -+++ b/fs/io_uring.c -@@ -2221,6 +2221,7 @@ static void __io_req_task_submit(struct io_kiocb *req) - __io_req_task_cancel(req, -EFAULT); - mutex_unlock(&ctx->uring_lock); - -+ ctx->flags &= ~IORING_SETUP_R_DISABLED; - if (ctx->flags & IORING_SETUP_SQPOLL) - io_sq_thread_drop_mm_files(); - } -@@ -8965,6 +8966,8 @@ static void io_disable_sqo_submit(struct io_ring_ctx *ctx) - { - mutex_lock(&ctx->uring_lock); - ctx->sqo_dead = 1; -+ if (ctx->flags & IORING_SETUP_R_DISABLED) -+ io_sq_offload_start(ctx); - mutex_unlock(&ctx->uring_lock); - - /* make sure callers enter the ring to get error */ -@@ -9980,10 +9983,7 @@ static int io_register_enable_rings(struct io_ring_ctx *ctx) - if (ctx->restrictions.registered) - ctx->restricted = 1; - -- ctx->flags &= ~IORING_SETUP_R_DISABLED; -- - io_sq_offload_start(ctx); -- - return 0; - } - -diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c -index 53fcbf79bdca3..7629248fdd532 100644 ---- a/fs/nfsd/filecache.c -+++ b/fs/nfsd/filecache.c -@@ -898,6 +898,8 @@ nfsd_file_find_locked(struct inode *inode, unsigned int may_flags, - continue; - if (!nfsd_match_cred(nf->nf_cred, current_cred())) - continue; -+ if (!test_bit(NFSD_FILE_HASHED, &nf->nf_flags)) -+ continue; - if (nfsd_file_get(nf) != NULL) - return nf; - } -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index 8d6d2678abade..3581ce737e853 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -1304,7 +1304,7 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct nfsd_file *src, - struct nfsd_file *dst) - { - nfs42_ssc_close(src->nf_file); -- /* 'src' is freed by nfsd4_do_async_copy */ -+ fput(src->nf_file); - nfsd_file_put(dst); - mntput(ss_mnt); - } -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index cf8b91b1ed373..a501bb9a2fac1 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -5372,7 +5372,7 @@ nfs4_laundromat(struct nfsd_net *nn) - idr_for_each_entry(&nn->s2s_cp_stateids, cps_t, i) { - cps = container_of(cps_t, struct nfs4_cpntf_state, cp_stateid); - if (cps->cp_stateid.sc_type == NFS4_COPYNOTIFY_STID && -- cps->cpntf_time > cutoff) -+ cps->cpntf_time < cutoff) - _free_cpntf_state_locked(nn, cps); - } - spin_unlock(&nn->s2s_cp_lock); -diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c -index 93a217e4f5630..14658b009f1bb 100644 ---- a/fs/pstore/inode.c -+++ b/fs/pstore/inode.c -@@ -467,7 +467,7 @@ static struct dentry *pstore_mount(struct file_system_type *fs_type, - static void pstore_kill_sb(struct super_block *sb) - { - mutex_lock(&pstore_sb_lock); -- WARN_ON(pstore_sb != sb); -+ WARN_ON(pstore_sb && pstore_sb != sb); - - kill_litter_super(sb); - pstore_sb = NULL; -diff --git a/fs/select.c b/fs/select.c -index 37aaa8317f3ae..945896d0ac9e7 100644 ---- a/fs/select.c -+++ b/fs/select.c -@@ -1055,10 +1055,9 @@ static long do_restart_poll(struct restart_block *restart_block) - - ret = do_sys_poll(ufds, nfds, to); - -- if (ret == -ERESTARTNOHAND) { -- restart_block->fn = do_restart_poll; -- ret = -ERESTART_RESTARTBLOCK; -- } -+ if (ret == -ERESTARTNOHAND) -+ ret = set_restart_fn(restart_block, do_restart_poll); -+ - return ret; - } - -@@ -1080,7 +1079,6 @@ SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds, - struct restart_block *restart_block; - - restart_block = ¤t->restart_block; -- restart_block->fn = do_restart_poll; - restart_block->poll.ufds = ufds; - restart_block->poll.nfds = nfds; - -@@ -1091,7 +1089,7 @@ SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds, - } else - restart_block->poll.has_timeout = 0; - -- ret = -ERESTART_RESTARTBLOCK; -+ ret = set_restart_fn(restart_block, do_restart_poll); - } - return ret; - } -diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c -index 3fe933b1010c3..2243dc1fb48fe 100644 ---- a/fs/zonefs/super.c -+++ b/fs/zonefs/super.c -@@ -159,6 +159,21 @@ static int zonefs_writepages(struct address_space *mapping, - return iomap_writepages(mapping, wbc, &wpc, &zonefs_writeback_ops); - } - -+static int zonefs_swap_activate(struct swap_info_struct *sis, -+ struct file *swap_file, sector_t *span) -+{ -+ struct inode *inode = file_inode(swap_file); -+ struct zonefs_inode_info *zi = ZONEFS_I(inode); -+ -+ if (zi->i_ztype != ZONEFS_ZTYPE_CNV) { -+ zonefs_err(inode->i_sb, -+ "swap file: not a conventional zone file\n"); -+ return -EINVAL; -+ } -+ -+ return iomap_swapfile_activate(sis, swap_file, span, &zonefs_iomap_ops); -+} -+ - static const struct address_space_operations zonefs_file_aops = { - .readpage = zonefs_readpage, - .readahead = zonefs_readahead, -@@ -171,6 +186,7 @@ static const struct address_space_operations zonefs_file_aops = { - .is_partially_uptodate = iomap_is_partially_uptodate, - .error_remove_page = generic_error_remove_page, - .direct_IO = noop_direct_IO, -+ .swap_activate = zonefs_swap_activate, - }; - - static void zonefs_update_stats(struct inode *inode, loff_t new_isize) -@@ -719,6 +735,68 @@ out_release: - return ret; - } - -+/* -+ * Do not exceed the LFS limits nor the file zone size. If pos is under the -+ * limit it becomes a short access. If it exceeds the limit, return -EFBIG. -+ */ -+static loff_t zonefs_write_check_limits(struct file *file, loff_t pos, -+ loff_t count) -+{ -+ struct inode *inode = file_inode(file); -+ struct zonefs_inode_info *zi = ZONEFS_I(inode); -+ loff_t limit = rlimit(RLIMIT_FSIZE); -+ loff_t max_size = zi->i_max_size; -+ -+ if (limit != RLIM_INFINITY) { -+ if (pos >= limit) { -+ send_sig(SIGXFSZ, current, 0); -+ return -EFBIG; -+ } -+ count = min(count, limit - pos); -+ } -+ -+ if (!(file->f_flags & O_LARGEFILE)) -+ max_size = min_t(loff_t, MAX_NON_LFS, max_size); -+ -+ if (unlikely(pos >= max_size)) -+ return -EFBIG; -+ -+ return min(count, max_size - pos); -+} -+ -+static ssize_t zonefs_write_checks(struct kiocb *iocb, struct iov_iter *from) -+{ -+ struct file *file = iocb->ki_filp; -+ struct inode *inode = file_inode(file); -+ struct zonefs_inode_info *zi = ZONEFS_I(inode); -+ loff_t count; -+ -+ if (IS_SWAPFILE(inode)) -+ return -ETXTBSY; -+ -+ if (!iov_iter_count(from)) -+ return 0; -+ -+ if ((iocb->ki_flags & IOCB_NOWAIT) && !(iocb->ki_flags & IOCB_DIRECT)) -+ return -EINVAL; -+ -+ if (iocb->ki_flags & IOCB_APPEND) { -+ if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) -+ return -EINVAL; -+ mutex_lock(&zi->i_truncate_mutex); -+ iocb->ki_pos = zi->i_wpoffset; -+ mutex_unlock(&zi->i_truncate_mutex); -+ } -+ -+ count = zonefs_write_check_limits(file, iocb->ki_pos, -+ iov_iter_count(from)); -+ if (count < 0) -+ return count; -+ -+ iov_iter_truncate(from, count); -+ return iov_iter_count(from); -+} -+ - /* - * Handle direct writes. For sequential zone files, this is the only possible - * write path. For these files, check that the user is issuing writes -@@ -736,8 +814,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) - struct super_block *sb = inode->i_sb; - bool sync = is_sync_kiocb(iocb); - bool append = false; -- size_t count; -- ssize_t ret; -+ ssize_t ret, count; - - /* - * For async direct IOs to sequential zone files, refuse IOCB_NOWAIT -@@ -755,12 +832,11 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) - inode_lock(inode); - } - -- ret = generic_write_checks(iocb, from); -- if (ret <= 0) -+ count = zonefs_write_checks(iocb, from); -+ if (count <= 0) { -+ ret = count; - goto inode_unlock; -- -- iov_iter_truncate(from, zi->i_max_size - iocb->ki_pos); -- count = iov_iter_count(from); -+ } - - if ((iocb->ki_pos | count) & (sb->s_blocksize - 1)) { - ret = -EINVAL; -@@ -820,12 +896,10 @@ static ssize_t zonefs_file_buffered_write(struct kiocb *iocb, - inode_lock(inode); - } - -- ret = generic_write_checks(iocb, from); -+ ret = zonefs_write_checks(iocb, from); - if (ret <= 0) - goto inode_unlock; - -- iov_iter_truncate(from, zi->i_max_size - iocb->ki_pos); -- - ret = iomap_file_buffered_write(iocb, from, &zonefs_iomap_ops); - if (ret > 0) - iocb->ki_pos += ret; -@@ -958,9 +1032,7 @@ static int zonefs_open_zone(struct inode *inode) - - mutex_lock(&zi->i_truncate_mutex); - -- zi->i_wr_refcnt++; -- if (zi->i_wr_refcnt == 1) { -- -+ if (!zi->i_wr_refcnt) { - if (atomic_inc_return(&sbi->s_open_zones) > sbi->s_max_open_zones) { - atomic_dec(&sbi->s_open_zones); - ret = -EBUSY; -@@ -970,7 +1042,6 @@ static int zonefs_open_zone(struct inode *inode) - if (i_size_read(inode) < zi->i_max_size) { - ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_OPEN); - if (ret) { -- zi->i_wr_refcnt--; - atomic_dec(&sbi->s_open_zones); - goto unlock; - } -@@ -978,6 +1049,8 @@ static int zonefs_open_zone(struct inode *inode) - } - } - -+ zi->i_wr_refcnt++; -+ - unlock: - mutex_unlock(&zi->i_truncate_mutex); - -diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h -index 2564e66e67d74..b5bef31991967 100644 ---- a/include/drm/ttm/ttm_bo_api.h -+++ b/include/drm/ttm/ttm_bo_api.h -@@ -600,6 +600,7 @@ static inline bool ttm_bo_uses_embedded_gem_object(struct ttm_buffer_object *bo) - static inline void ttm_bo_pin(struct ttm_buffer_object *bo) - { - dma_resv_assert_held(bo->base.resv); -+ WARN_ON_ONCE(!kref_read(&bo->kref)); - ++bo->pin_count; - } - -@@ -612,8 +613,11 @@ static inline void ttm_bo_pin(struct ttm_buffer_object *bo) - static inline void ttm_bo_unpin(struct ttm_buffer_object *bo) - { - dma_resv_assert_held(bo->base.resv); -- WARN_ON_ONCE(!bo->pin_count); -- --bo->pin_count; -+ WARN_ON_ONCE(!kref_read(&bo->kref)); -+ if (bo->pin_count) -+ --bo->pin_count; -+ else -+ WARN_ON_ONCE(true); - } - - int ttm_mem_evict_first(struct ttm_bo_device *bdev, -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 763b816ba19ca..119262585e9b3 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -72,8 +72,10 @@ typedef void *efi_handle_t; - */ - typedef guid_t efi_guid_t __aligned(__alignof__(u32)); - --#define EFI_GUID(a,b,c,d0,d1,d2,d3,d4,d5,d6,d7) \ -- GUID_INIT(a, b, c, d0, d1, d2, d3, d4, d5, d6, d7) -+#define EFI_GUID(a, b, c, d...) (efi_guid_t){ { \ -+ (a) & 0xff, ((a) >> 8) & 0xff, ((a) >> 16) & 0xff, ((a) >> 24) & 0xff, \ -+ (b) & 0xff, ((b) >> 8) & 0xff, \ -+ (c) & 0xff, ((c) >> 8) & 0xff, d } } - - /* - * Generic EFI table header -diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h -index 9b2158c69275e..157762db9d4bf 100644 ---- a/include/linux/thread_info.h -+++ b/include/linux/thread_info.h -@@ -11,6 +11,7 @@ - #include - #include - #include -+#include - - #ifdef CONFIG_THREAD_INFO_IN_TASK - /* -@@ -59,6 +60,18 @@ enum syscall_work_bit { - - #ifdef __KERNEL__ - -+#ifndef arch_set_restart_data -+#define arch_set_restart_data(restart) do { } while (0) -+#endif -+ -+static inline long set_restart_fn(struct restart_block *restart, -+ long (*fn)(struct restart_block *)) -+{ -+ restart->fn = fn; -+ arch_set_restart_data(restart); -+ return -ERESTART_RESTARTBLOCK; -+} -+ - #ifndef THREAD_ALIGN - #define THREAD_ALIGN THREAD_SIZE - #endif -diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h -index 6b03fdd69d274..712363c7a2e8e 100644 ---- a/include/linux/usb_usual.h -+++ b/include/linux/usb_usual.h -@@ -86,6 +86,8 @@ - /* lies about caching, so always sync */ \ - US_FLAG(NO_SAME, 0x40000000) \ - /* Cannot handle WRITE_SAME */ \ -+ US_FLAG(SENSE_AFTER_SYNC, 0x80000000) \ -+ /* Do REQUEST_SENSE after SYNCHRONIZE_CACHE */ \ - - #define US_FLAG(name, value) US_FL_##name = value , - enum { US_DO_ALL_FLAGS }; -diff --git a/kernel/futex.c b/kernel/futex.c -index 45a13eb8894e5..ab3df9e86a1fc 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -2728,14 +2728,13 @@ retry: - goto out; - - restart = ¤t->restart_block; -- restart->fn = futex_wait_restart; - restart->futex.uaddr = uaddr; - restart->futex.val = val; - restart->futex.time = *abs_time; - restart->futex.bitset = bitset; - restart->futex.flags = flags | FLAGS_HAS_TIMEOUT; - -- ret = -ERESTART_RESTARTBLOCK; -+ ret = set_restart_fn(restart, futex_wait_restart); - - out: - if (to) { -diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c -index dec3f73e8db92..21ea370fccda7 100644 ---- a/kernel/irq/manage.c -+++ b/kernel/irq/manage.c -@@ -1142,11 +1142,15 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action) - irqreturn_t ret; - - local_bh_disable(); -+ if (!IS_ENABLED(CONFIG_PREEMPT_RT)) -+ local_irq_disable(); - ret = action->thread_fn(action->irq, action->dev_id); - if (ret == IRQ_HANDLED) - atomic_inc(&desc->threads_handled); - - irq_finalize_oneshot(desc, action); -+ if (!IS_ENABLED(CONFIG_PREEMPT_RT)) -+ local_irq_enable(); - local_bh_enable(); - return ret; - } -diff --git a/kernel/jump_label.c b/kernel/jump_label.c -index c6a39d662935e..ba39fbb1f8e73 100644 ---- a/kernel/jump_label.c -+++ b/kernel/jump_label.c -@@ -407,6 +407,14 @@ static bool jump_label_can_update(struct jump_entry *entry, bool init) - return false; - - if (!kernel_text_address(jump_entry_code(entry))) { -+ /* -+ * This skips patching built-in __exit, which -+ * is part of init_section_contains() but is -+ * not part of kernel_text_address(). -+ * -+ * Skipping built-in __exit is fine since it -+ * will never be executed. -+ */ - WARN_ONCE(!jump_entry_is_init(entry), - "can't patch jump_label at %pS", - (void *)jump_entry_code(entry)); -diff --git a/kernel/static_call.c b/kernel/static_call.c -index 84565c2a41b8f..db914da6e7854 100644 ---- a/kernel/static_call.c -+++ b/kernel/static_call.c -@@ -182,7 +182,16 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) - } - - if (!kernel_text_address((unsigned long)site_addr)) { -- WARN_ONCE(1, "can't patch static call site at %pS", -+ /* -+ * This skips patching built-in __exit, which -+ * is part of init_section_contains() but is -+ * not part of kernel_text_address(). -+ * -+ * Skipping built-in __exit is fine since it -+ * will never be executed. -+ */ -+ WARN_ONCE(!static_call_is_init(site), -+ "can't patch static call site at %pS", - site_addr); - continue; - } -diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c -index f4ace1bf83828..daeaa7140d0aa 100644 ---- a/kernel/time/alarmtimer.c -+++ b/kernel/time/alarmtimer.c -@@ -848,9 +848,9 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, - if (flags == TIMER_ABSTIME) - return -ERESTARTNOHAND; - -- restart->fn = alarm_timer_nsleep_restart; - restart->nanosleep.clockid = type; - restart->nanosleep.expires = exp; -+ set_restart_fn(restart, alarm_timer_nsleep_restart); - return ret; - } - -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index 788b9d137de4c..5c9d968187ae8 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -1957,9 +1957,9 @@ long hrtimer_nanosleep(ktime_t rqtp, const enum hrtimer_mode mode, - } - - restart = ¤t->restart_block; -- restart->fn = hrtimer_nanosleep_restart; - restart->nanosleep.clockid = t.timer.base->clockid; - restart->nanosleep.expires = hrtimer_get_expires_tv64(&t.timer); -+ set_restart_fn(restart, hrtimer_nanosleep_restart); - out: - destroy_hrtimer_on_stack(&t.timer); - return ret; -diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c -index a71758e34e456..9abe15255bc4e 100644 ---- a/kernel/time/posix-cpu-timers.c -+++ b/kernel/time/posix-cpu-timers.c -@@ -1480,8 +1480,8 @@ static int posix_cpu_nsleep(const clockid_t which_clock, int flags, - if (flags & TIMER_ABSTIME) - return -ERESTARTNOHAND; - -- restart_block->fn = posix_cpu_nsleep_restart; - restart_block->nanosleep.clockid = which_clock; -+ set_restart_fn(restart_block, posix_cpu_nsleep_restart); - } - return error; - } -diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c -index ac2a4a7711da4..edb6ac17cecab 100644 ---- a/net/qrtr/qrtr.c -+++ b/net/qrtr/qrtr.c -@@ -439,7 +439,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) - if (len == 0 || len & 3) - return -EINVAL; - -- skb = netdev_alloc_skb(NULL, len); -+ skb = __netdev_alloc_skb(NULL, len, GFP_ATOMIC | __GFP_NOWARN); - if (!skb) - return -ENOMEM; - -diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c -index 4187745887f0f..7034b4755fa18 100644 ---- a/net/sunrpc/svc.c -+++ b/net/sunrpc/svc.c -@@ -1413,7 +1413,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) - - sendit: - if (svc_authorise(rqstp)) -- goto close; -+ goto close_xprt; - return 1; /* Caller can now send it */ - - release_dropit: -@@ -1425,6 +1425,8 @@ release_dropit: - return 0; - - close: -+ svc_authorise(rqstp); -+close_xprt: - if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) - svc_close_xprt(rqstp->rq_xprt); - dprintk("svc: svc_process close\n"); -@@ -1433,7 +1435,7 @@ release_dropit: - err_short_len: - svc_printk(rqstp, "short len %zd, dropping request\n", - argv->iov_len); -- goto close; -+ goto close_xprt; - - err_bad_rpc: - serv->sv_stats->rpcbadfmt++; -diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c -index dcc50ae545506..3cdd71a8df1e7 100644 ---- a/net/sunrpc/svc_xprt.c -+++ b/net/sunrpc/svc_xprt.c -@@ -1060,7 +1060,7 @@ static int svc_close_list(struct svc_serv *serv, struct list_head *xprt_list, st - struct svc_xprt *xprt; - int ret = 0; - -- spin_lock(&serv->sv_lock); -+ spin_lock_bh(&serv->sv_lock); - list_for_each_entry(xprt, xprt_list, xpt_list) { - if (xprt->xpt_net != net) - continue; -@@ -1068,7 +1068,7 @@ static int svc_close_list(struct svc_serv *serv, struct list_head *xprt_list, st - set_bit(XPT_CLOSE, &xprt->xpt_flags); - svc_xprt_enqueue(xprt); - } -- spin_unlock(&serv->sv_lock); -+ spin_unlock_bh(&serv->sv_lock); - return ret; - } - -diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c -index 63f8be974df20..8186ab6f99f19 100644 ---- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c -+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c -@@ -252,9 +252,9 @@ xprt_setup_rdma_bc(struct xprt_create *args) - xprt->timeout = &xprt_rdma_bc_timeout; - xprt_set_bound(xprt); - xprt_set_connected(xprt); -- xprt->bind_timeout = RPCRDMA_BIND_TO; -- xprt->reestablish_timeout = RPCRDMA_INIT_REEST_TO; -- xprt->idle_timeout = RPCRDMA_IDLE_DISC_TO; -+ xprt->bind_timeout = 0; -+ xprt->reestablish_timeout = 0; -+ xprt->idle_timeout = 0; - - xprt->prot = XPRT_TRANSPORT_BC_RDMA; - xprt->ops = &xprt_rdma_bc_procs; -diff --git a/sound/firewire/dice/dice-stream.c b/sound/firewire/dice/dice-stream.c -index 8e0c0380b4c4b..1a14c083e8cea 100644 ---- a/sound/firewire/dice/dice-stream.c -+++ b/sound/firewire/dice/dice-stream.c -@@ -493,11 +493,10 @@ void snd_dice_stream_stop_duplex(struct snd_dice *dice) - struct reg_params tx_params, rx_params; - - if (dice->substreams_counter == 0) { -- if (get_register_params(dice, &tx_params, &rx_params) >= 0) { -- amdtp_domain_stop(&dice->domain); -+ if (get_register_params(dice, &tx_params, &rx_params) >= 0) - finish_session(dice, &tx_params, &rx_params); -- } - -+ amdtp_domain_stop(&dice->domain); - release_resources(dice); - } - } -diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index 8060cc86dfea3..96903295a9677 100644 ---- a/sound/pci/hda/hda_generic.c -+++ b/sound/pci/hda/hda_generic.c -@@ -4065,7 +4065,7 @@ static int add_micmute_led_hook(struct hda_codec *codec) - - spec->micmute_led.led_mode = MICMUTE_LED_FOLLOW_MUTE; - spec->micmute_led.capture = 0; -- spec->micmute_led.led_value = 0; -+ spec->micmute_led.led_value = -1; - spec->micmute_led.old_hook = spec->cap_sync_hook; - spec->cap_sync_hook = update_micmute_led; - if (!snd_hda_gen_add_kctl(spec, NULL, &micmute_led_mode_ctl)) -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index b47504fa8dfd0..316b9b4ccb32d 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4225,6 +4225,12 @@ static void alc_fixup_hp_gpio_led(struct hda_codec *codec, - } - } - -+static void alc236_fixup_hp_gpio_led(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ alc_fixup_hp_gpio_led(codec, action, 0x02, 0x01); -+} -+ - static void alc269_fixup_hp_gpio_led(struct hda_codec *codec, - const struct hda_fixup *fix, int action) - { -@@ -6381,6 +6387,7 @@ enum { - ALC294_FIXUP_ASUS_GX502_VERBS, - ALC285_FIXUP_HP_GPIO_LED, - ALC285_FIXUP_HP_MUTE_LED, -+ ALC236_FIXUP_HP_GPIO_LED, - ALC236_FIXUP_HP_MUTE_LED, - ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, - ALC295_FIXUP_ASUS_MIC_NO_PRESENCE, -@@ -7616,6 +7623,10 @@ static const struct hda_fixup alc269_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc285_fixup_hp_mute_led, - }, -+ [ALC236_FIXUP_HP_GPIO_LED] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc236_fixup_hp_gpio_led, -+ }, - [ALC236_FIXUP_HP_MUTE_LED] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc236_fixup_hp_mute_led, -@@ -8045,9 +8056,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8783, "HP ZBook Fury 15 G7 Mobile Workstation", - ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x87f4, "HP", ALC287_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP), -+ SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x884c, "HP EliteBook 840 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), - SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), - SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), -@@ -8242,7 +8256,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101), - SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */ - SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), - SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE), - SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802), - SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X), -diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c -index 472caad17012e..85a1d00894a9c 100644 ---- a/sound/soc/codecs/ak4458.c -+++ b/sound/soc/codecs/ak4458.c -@@ -812,6 +812,7 @@ static const struct of_device_id ak4458_of_match[] = { - { .compatible = "asahi-kasei,ak4497", .data = &ak4497_drvdata}, - { }, - }; -+MODULE_DEVICE_TABLE(of, ak4458_of_match); - - static struct i2c_driver ak4458_i2c_driver = { - .driver = { -diff --git a/sound/soc/codecs/ak5558.c b/sound/soc/codecs/ak5558.c -index 8a32b0139cb0c..85bdd05341803 100644 ---- a/sound/soc/codecs/ak5558.c -+++ b/sound/soc/codecs/ak5558.c -@@ -419,6 +419,7 @@ static const struct of_device_id ak5558_i2c_dt_ids[] __maybe_unused = { - { .compatible = "asahi-kasei,ak5558"}, - { } - }; -+MODULE_DEVICE_TABLE(of, ak5558_i2c_dt_ids); - - static struct i2c_driver ak5558_i2c_driver = { - .driver = { -diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c -index 91e6890d6efcb..3d6976a3d9e42 100644 ---- a/sound/soc/codecs/lpass-va-macro.c -+++ b/sound/soc/codecs/lpass-va-macro.c -@@ -189,7 +189,6 @@ struct va_macro { - struct device *dev; - unsigned long active_ch_mask[VA_MACRO_MAX_DAIS]; - unsigned long active_ch_cnt[VA_MACRO_MAX_DAIS]; -- unsigned long active_decimator[VA_MACRO_MAX_DAIS]; - u16 dmic_clk_div; - - int dec_mode[VA_MACRO_NUM_DECIMATORS]; -@@ -549,11 +548,9 @@ static int va_macro_tx_mixer_put(struct snd_kcontrol *kcontrol, - if (enable) { - set_bit(dec_id, &va->active_ch_mask[dai_id]); - va->active_ch_cnt[dai_id]++; -- va->active_decimator[dai_id] = dec_id; - } else { - clear_bit(dec_id, &va->active_ch_mask[dai_id]); - va->active_ch_cnt[dai_id]--; -- va->active_decimator[dai_id] = -1; - } - - snd_soc_dapm_mixer_update_power(widget->dapm, kcontrol, enable, update); -@@ -880,18 +877,19 @@ static int va_macro_digital_mute(struct snd_soc_dai *dai, int mute, int stream) - struct va_macro *va = snd_soc_component_get_drvdata(component); - u16 tx_vol_ctl_reg, decimator; - -- decimator = va->active_decimator[dai->id]; -- -- tx_vol_ctl_reg = CDC_VA_TX0_TX_PATH_CTL + -- VA_MACRO_TX_PATH_OFFSET * decimator; -- if (mute) -- snd_soc_component_update_bits(component, tx_vol_ctl_reg, -- CDC_VA_TX_PATH_PGA_MUTE_EN_MASK, -- CDC_VA_TX_PATH_PGA_MUTE_EN); -- else -- snd_soc_component_update_bits(component, tx_vol_ctl_reg, -- CDC_VA_TX_PATH_PGA_MUTE_EN_MASK, -- CDC_VA_TX_PATH_PGA_MUTE_DISABLE); -+ for_each_set_bit(decimator, &va->active_ch_mask[dai->id], -+ VA_MACRO_DEC_MAX) { -+ tx_vol_ctl_reg = CDC_VA_TX0_TX_PATH_CTL + -+ VA_MACRO_TX_PATH_OFFSET * decimator; -+ if (mute) -+ snd_soc_component_update_bits(component, tx_vol_ctl_reg, -+ CDC_VA_TX_PATH_PGA_MUTE_EN_MASK, -+ CDC_VA_TX_PATH_PGA_MUTE_EN); -+ else -+ snd_soc_component_update_bits(component, tx_vol_ctl_reg, -+ CDC_VA_TX_PATH_PGA_MUTE_EN_MASK, -+ CDC_VA_TX_PATH_PGA_MUTE_DISABLE); -+ } - - return 0; - } -diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c -index 25f1df214ca5d..cd59aa4393738 100644 ---- a/sound/soc/codecs/lpass-wsa-macro.c -+++ b/sound/soc/codecs/lpass-wsa-macro.c -@@ -1214,14 +1214,16 @@ static int wsa_macro_enable_mix_path(struct snd_soc_dapm_widget *w, - struct snd_kcontrol *kcontrol, int event) - { - struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); -- u16 gain_reg; -+ u16 path_reg, gain_reg; - int val; - -- switch (w->reg) { -- case CDC_WSA_RX0_RX_PATH_MIX_CTL: -+ switch (w->shift) { -+ case WSA_MACRO_RX_MIX0: -+ path_reg = CDC_WSA_RX0_RX_PATH_MIX_CTL; - gain_reg = CDC_WSA_RX0_RX_VOL_MIX_CTL; - break; -- case CDC_WSA_RX1_RX_PATH_MIX_CTL: -+ case WSA_MACRO_RX_MIX1: -+ path_reg = CDC_WSA_RX1_RX_PATH_MIX_CTL; - gain_reg = CDC_WSA_RX1_RX_VOL_MIX_CTL; - break; - default: -@@ -1234,7 +1236,7 @@ static int wsa_macro_enable_mix_path(struct snd_soc_dapm_widget *w, - snd_soc_component_write(component, gain_reg, val); - break; - case SND_SOC_DAPM_POST_PMD: -- snd_soc_component_update_bits(component, w->reg, -+ snd_soc_component_update_bits(component, path_reg, - CDC_WSA_RX_PATH_MIX_CLK_EN_MASK, - CDC_WSA_RX_PATH_MIX_CLK_DISABLE); - break; -@@ -2071,14 +2073,14 @@ static const struct snd_soc_dapm_widget wsa_macro_dapm_widgets[] = { - SND_SOC_DAPM_MUX("WSA_RX0 INP0", SND_SOC_NOPM, 0, 0, &rx0_prim_inp0_mux), - SND_SOC_DAPM_MUX("WSA_RX0 INP1", SND_SOC_NOPM, 0, 0, &rx0_prim_inp1_mux), - SND_SOC_DAPM_MUX("WSA_RX0 INP2", SND_SOC_NOPM, 0, 0, &rx0_prim_inp2_mux), -- SND_SOC_DAPM_MUX_E("WSA_RX0 MIX INP", CDC_WSA_RX0_RX_PATH_MIX_CTL, -- 0, 0, &rx0_mix_mux, wsa_macro_enable_mix_path, -+ SND_SOC_DAPM_MUX_E("WSA_RX0 MIX INP", SND_SOC_NOPM, WSA_MACRO_RX_MIX0, -+ 0, &rx0_mix_mux, wsa_macro_enable_mix_path, - SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), - SND_SOC_DAPM_MUX("WSA_RX1 INP0", SND_SOC_NOPM, 0, 0, &rx1_prim_inp0_mux), - SND_SOC_DAPM_MUX("WSA_RX1 INP1", SND_SOC_NOPM, 0, 0, &rx1_prim_inp1_mux), - SND_SOC_DAPM_MUX("WSA_RX1 INP2", SND_SOC_NOPM, 0, 0, &rx1_prim_inp2_mux), -- SND_SOC_DAPM_MUX_E("WSA_RX1 MIX INP", CDC_WSA_RX1_RX_PATH_MIX_CTL, -- 0, 0, &rx1_mix_mux, wsa_macro_enable_mix_path, -+ SND_SOC_DAPM_MUX_E("WSA_RX1 MIX INP", SND_SOC_NOPM, WSA_MACRO_RX_MIX1, -+ 0, &rx1_mix_mux, wsa_macro_enable_mix_path, - SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), - - SND_SOC_DAPM_MIXER_E("WSA_RX INT0 MIX", SND_SOC_NOPM, 0, 0, NULL, 0, -diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c -index 40f682f5dab8b..d18ae5e3ee809 100644 ---- a/sound/soc/codecs/wcd934x.c -+++ b/sound/soc/codecs/wcd934x.c -@@ -1873,6 +1873,12 @@ static int wcd934x_set_channel_map(struct snd_soc_dai *dai, - - wcd = snd_soc_component_get_drvdata(dai->component); - -+ if (tx_num > WCD934X_TX_MAX || rx_num > WCD934X_RX_MAX) { -+ dev_err(wcd->dev, "Invalid tx %d or rx %d channel count\n", -+ tx_num, rx_num); -+ return -EINVAL; -+ } -+ - if (!tx_slot || !rx_slot) { - dev_err(wcd->dev, "Invalid tx_slot=%p, rx_slot=%p\n", - tx_slot, rx_slot); -diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c -index 404be27c15fed..1d774c876c52e 100644 ---- a/sound/soc/fsl/fsl_ssi.c -+++ b/sound/soc/fsl/fsl_ssi.c -@@ -878,6 +878,7 @@ static int fsl_ssi_hw_free(struct snd_pcm_substream *substream, - static int _fsl_ssi_set_dai_fmt(struct fsl_ssi *ssi, unsigned int fmt) - { - u32 strcr = 0, scr = 0, stcr, srcr, mask; -+ unsigned int slots; - - ssi->dai_fmt = fmt; - -@@ -909,10 +910,11 @@ static int _fsl_ssi_set_dai_fmt(struct fsl_ssi *ssi, unsigned int fmt) - return -EINVAL; - } - -+ slots = ssi->slots ? : 2; - regmap_update_bits(ssi->regs, REG_SSI_STCCR, -- SSI_SxCCR_DC_MASK, SSI_SxCCR_DC(2)); -+ SSI_SxCCR_DC_MASK, SSI_SxCCR_DC(slots)); - regmap_update_bits(ssi->regs, REG_SSI_SRCCR, -- SSI_SxCCR_DC_MASK, SSI_SxCCR_DC(2)); -+ SSI_SxCCR_DC_MASK, SSI_SxCCR_DC(slots)); - - /* Data on rising edge of bclk, frame low, 1clk before data */ - strcr |= SSI_STCR_TFSI | SSI_STCR_TSCKP | SSI_STCR_TEFS; -diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c -index ab31045cfc952..6cada4c1e283b 100644 ---- a/sound/soc/generic/simple-card-utils.c -+++ b/sound/soc/generic/simple-card-utils.c -@@ -172,15 +172,16 @@ int asoc_simple_parse_clk(struct device *dev, - * or device's module clock. - */ - clk = devm_get_clk_from_child(dev, node, NULL); -- if (IS_ERR(clk)) -- clk = devm_get_clk_from_child(dev, dlc->of_node, NULL); -- - if (!IS_ERR(clk)) { -- simple_dai->clk = clk; - simple_dai->sysclk = clk_get_rate(clk); -- } else if (!of_property_read_u32(node, "system-clock-frequency", -- &val)) { -+ -+ simple_dai->clk = clk; -+ } else if (!of_property_read_u32(node, "system-clock-frequency", &val)) { - simple_dai->sysclk = val; -+ } else { -+ clk = devm_get_clk_from_child(dev, dlc->of_node, NULL); -+ if (!IS_ERR(clk)) -+ simple_dai->sysclk = clk_get_rate(clk); - } - - if (of_property_read_bool(node, "system-clock-direction-out")) -diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c -index f00d4e417b6cf..21d2e1cba3803 100644 ---- a/sound/soc/intel/boards/bytcr_rt5640.c -+++ b/sound/soc/intel/boards/bytcr_rt5640.c -@@ -577,7 +577,7 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { - }, - .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | - BYT_RT5640_JD_SRC_JD1_IN4P | -- BYT_RT5640_OVCD_TH_1500UA | -+ BYT_RT5640_OVCD_TH_2000UA | - BYT_RT5640_OVCD_SF_0P75 | - BYT_RT5640_MCLK_EN), - }, -diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c -index d55851d2049e2..cd4fb77e9d519 100644 ---- a/sound/soc/qcom/lpass-cpu.c -+++ b/sound/soc/qcom/lpass-cpu.c -@@ -737,7 +737,7 @@ static void of_lpass_cpu_parse_dai_data(struct device *dev, - - for_each_child_of_node(dev->of_node, node) { - ret = of_property_read_u32(node, "reg", &id); -- if (ret || id < 0 || id >= data->variant->num_dai) { -+ if (ret || id < 0) { - dev_err(dev, "valid dai id not found: %d\n", ret); - continue; - } -diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c -index 6c2760e27ea6f..153e9b2de0b53 100644 ---- a/sound/soc/qcom/sdm845.c -+++ b/sound/soc/qcom/sdm845.c -@@ -27,18 +27,18 @@ - #define SPK_TDM_RX_MASK 0x03 - #define NUM_TDM_SLOTS 8 - #define SLIM_MAX_TX_PORTS 16 --#define SLIM_MAX_RX_PORTS 16 -+#define SLIM_MAX_RX_PORTS 13 - #define WCD934X_DEFAULT_MCLK_RATE 9600000 - - struct sdm845_snd_data { - struct snd_soc_jack jack; - bool jack_setup; -- bool stream_prepared[SLIM_MAX_RX_PORTS]; -+ bool stream_prepared[AFE_PORT_MAX]; - struct snd_soc_card *card; - uint32_t pri_mi2s_clk_count; - uint32_t sec_mi2s_clk_count; - uint32_t quat_tdm_clk_count; -- struct sdw_stream_runtime *sruntime[SLIM_MAX_RX_PORTS]; -+ struct sdw_stream_runtime *sruntime[AFE_PORT_MAX]; - }; - - static unsigned int tdm_slot_offset[8] = {0, 4, 8, 12, 16, 20, 24, 28}; -diff --git a/sound/soc/sof/intel/hda-dsp.c b/sound/soc/sof/intel/hda-dsp.c -index 1799fc56a3e41..012bac41fee0a 100644 ---- a/sound/soc/sof/intel/hda-dsp.c -+++ b/sound/soc/sof/intel/hda-dsp.c -@@ -207,7 +207,7 @@ int hda_dsp_core_power_down(struct snd_sof_dev *sdev, unsigned int core_mask) - - ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, - HDA_DSP_REG_ADSPCS, adspcs, -- !(adspcs & HDA_DSP_ADSPCS_SPA_MASK(core_mask)), -+ !(adspcs & HDA_DSP_ADSPCS_CPA_MASK(core_mask)), - HDA_DSP_REG_POLL_INTERVAL_US, - HDA_DSP_PD_TIMEOUT * USEC_PER_MSEC); - if (ret < 0) -diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c -index 509a9b2564230..de6bc501f1b5f 100644 ---- a/sound/soc/sof/intel/hda.c -+++ b/sound/soc/sof/intel/hda.c -@@ -896,6 +896,7 @@ free_streams: - /* dsp_unmap: not currently used */ - iounmap(sdev->bar[HDA_DSP_BAR]); - hdac_bus_unmap: -+ platform_device_unregister(hdev->dmic_dev); - iounmap(bus->remap_addr); - hda_codec_i915_exit(sdev); - err: -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index 448de77f43fd8..5171b3dc1eb9e 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -2883,7 +2883,7 @@ static int snd_djm_controls_put(struct snd_kcontrol *kctl, struct snd_ctl_elem_v - u8 group = (private_value & SND_DJM_GROUP_MASK) >> SND_DJM_GROUP_SHIFT; - u16 value = elem->value.enumerated.item[0]; - -- kctl->private_value = ((device << SND_DJM_DEVICE_SHIFT) | -+ kctl->private_value = (((unsigned long)device << SND_DJM_DEVICE_SHIFT) | - (group << SND_DJM_GROUP_SHIFT) | - value); - -@@ -2921,7 +2921,7 @@ static int snd_djm_controls_create(struct usb_mixer_interface *mixer, - value = device->controls[i].default_value; - knew.name = device->controls[i].name; - knew.private_value = ( -- (device_idx << SND_DJM_DEVICE_SHIFT) | -+ ((unsigned long)device_idx << SND_DJM_DEVICE_SHIFT) | - (i << SND_DJM_GROUP_SHIFT) | - value); - err = snd_djm_controls_update(mixer, device_idx, i, value); diff --git a/patch/kernel/archive/sunxi-5.11/patch-5.11.9-10.patch b/patch/kernel/archive/sunxi-5.11/patch-5.11.9-10.patch deleted file mode 100644 index 9d2fc8e043..0000000000 --- a/patch/kernel/archive/sunxi-5.11/patch-5.11.9-10.patch +++ /dev/null @@ -1,52 +0,0 @@ -diff --git a/Makefile b/Makefile -index 23403c8e08385..824d15c14be02 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 11 --SUBLEVEL = 9 -+SUBLEVEL = 10 - EXTRAVERSION = - NAME = 💕 Valentine's Day Edition 💕 - -diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c -index a76eb2c14e8c5..22073e77fdf9a 100644 ---- a/drivers/gpu/drm/ttm/ttm_bo.c -+++ b/drivers/gpu/drm/ttm/ttm_bo.c -@@ -514,7 +514,7 @@ static void ttm_bo_release(struct kref *kref) - * shrinkers, now that they are queued for - * destruction. - */ -- if (WARN_ON(bo->pin_count)) { -+ if (bo->pin_count) { - bo->pin_count = 0; - ttm_bo_del_from_lru(bo); - ttm_bo_add_mem_to_lru(bo, &bo->mem); -diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h -index b5bef31991967..2564e66e67d74 100644 ---- a/include/drm/ttm/ttm_bo_api.h -+++ b/include/drm/ttm/ttm_bo_api.h -@@ -600,7 +600,6 @@ static inline bool ttm_bo_uses_embedded_gem_object(struct ttm_buffer_object *bo) - static inline void ttm_bo_pin(struct ttm_buffer_object *bo) - { - dma_resv_assert_held(bo->base.resv); -- WARN_ON_ONCE(!kref_read(&bo->kref)); - ++bo->pin_count; - } - -@@ -613,11 +612,8 @@ static inline void ttm_bo_pin(struct ttm_buffer_object *bo) - static inline void ttm_bo_unpin(struct ttm_buffer_object *bo) - { - dma_resv_assert_held(bo->base.resv); -- WARN_ON_ONCE(!kref_read(&bo->kref)); -- if (bo->pin_count) -- --bo->pin_count; -- else -- WARN_ON_ONCE(true); -+ WARN_ON_ONCE(!bo->pin_count); -+ --bo->pin_count; - } - - int ttm_mem_evict_first(struct ttm_bo_device *bdev, diff --git a/patch/kernel/archive/sunxi-5.11/r-patch-5.11.10-11.patch b/patch/kernel/archive/sunxi-5.11/r-patch-5.11.10-11.patch deleted file mode 100644 index f20bcd1704..0000000000 --- a/patch/kernel/archive/sunxi-5.11/r-patch-5.11.10-11.patch +++ /dev/null @@ -1,10498 +0,0 @@ -diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst -index 5570887a2dce2..66d38520e65a1 100644 ---- a/Documentation/virt/kvm/api.rst -+++ b/Documentation/virt/kvm/api.rst -@@ -4831,8 +4831,10 @@ If an MSR access is not permitted through the filtering, it generates a - allows user space to deflect and potentially handle various MSR accesses - into user space. - --If a vCPU is in running state while this ioctl is invoked, the vCPU may --experience inconsistent filtering behavior on MSR accesses. -+Note, invoking this ioctl with a vCPU is running is inherently racy. However, -+KVM does guarantee that vCPUs will see either the previous filter or the new -+filter, e.g. MSRs with identical settings in both the old and new filter will -+have deterministic behavior. - - - 5. The kvm_run structure -diff --git a/Makefile b/Makefile -index 824d15c14be02..7578e0d9622fb 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 11 --SUBLEVEL = 10 -+SUBLEVEL = 11 - EXTRAVERSION = - NAME = 💕 Valentine's Day Edition 💕 - -@@ -265,7 +265,8 @@ no-dot-config-targets := $(clean-targets) \ - $(version_h) headers headers_% archheaders archscripts \ - %asm-generic kernelversion %src-pkg dt_binding_check \ - outputmakefile --no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease -+no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease \ -+ image_name - single-targets := %.a %.i %.ko %.lds %.ll %.lst %.mod %.o %.s %.symtypes %/ - - config-build := -diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts -index 73b6b1f89de99..775ceb3acb6c0 100644 ---- a/arch/arm/boot/dts/at91-sam9x60ek.dts -+++ b/arch/arm/boot/dts/at91-sam9x60ek.dts -@@ -334,14 +334,6 @@ - }; - - &pinctrl { -- atmel,mux-mask = < -- /* A B C */ -- 0xFFFFFE7F 0xC0E0397F 0xEF00019D /* pioA */ -- 0x03FFFFFF 0x02FC7E68 0x00780000 /* pioB */ -- 0xffffffff 0xF83FFFFF 0xB800F3FC /* pioC */ -- 0x003FFFFF 0x003F8000 0x00000000 /* pioD */ -- >; -- - adc { - pinctrl_adc_default: adc_default { - atmel,pins = ; -diff --git a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi -index 1b1163858b1d1..e3251f3e3eaa2 100644 ---- a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi -+++ b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi -@@ -84,8 +84,8 @@ - pinctrl-0 = <&pinctrl_macb0_default>; - phy-mode = "rmii"; - -- ethernet-phy@0 { -- reg = <0x0>; -+ ethernet-phy@7 { -+ reg = <0x7>; - interrupt-parent = <&pioA>; - interrupts = ; - pinctrl-names = "default"; -diff --git a/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts b/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts -index ecbb2cc5b9ab4..79cc45728cd2d 100644 ---- a/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts -+++ b/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts -@@ -14,5 +14,6 @@ - }; - - &gpmi { -+ fsl,use-minimum-ecc; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/sam9x60.dtsi b/arch/arm/boot/dts/sam9x60.dtsi -index 84066c1298df9..ec45ced3cde68 100644 ---- a/arch/arm/boot/dts/sam9x60.dtsi -+++ b/arch/arm/boot/dts/sam9x60.dtsi -@@ -606,6 +606,15 @@ - compatible = "microchip,sam9x60-pinctrl", "atmel,at91sam9x5-pinctrl", "atmel,at91rm9200-pinctrl", "simple-bus"; - ranges = <0xfffff400 0xfffff400 0x800>; - -+ /* mux-mask corresponding to sam9x60 SoC in TFBGA228L package */ -+ atmel,mux-mask = < -+ /* A B C */ -+ 0xffffffff 0xffe03fff 0xef00019d /* pioA */ -+ 0x03ffffff 0x02fc7e7f 0x00780000 /* pioB */ -+ 0xffffffff 0xffffffff 0xf83fffff /* pioC */ -+ 0x003fffff 0x003f8000 0x00000000 /* pioD */ -+ >; -+ - pioA: gpio@fffff400 { - compatible = "microchip,sam9x60-gpio", "atmel,at91sam9x5-gpio", "atmel,at91rm9200-gpio"; - reg = <0xfffff400 0x200>; -diff --git a/arch/arm/mach-omap2/sr_device.c b/arch/arm/mach-omap2/sr_device.c -index 62df666c2bd0b..17b66f0d0deef 100644 ---- a/arch/arm/mach-omap2/sr_device.c -+++ b/arch/arm/mach-omap2/sr_device.c -@@ -88,34 +88,26 @@ static void __init sr_set_nvalues(struct omap_volt_data *volt_data, - - extern struct omap_sr_data omap_sr_pdata[]; - --static int __init sr_dev_init(struct omap_hwmod *oh, void *user) -+static int __init sr_init_by_name(const char *name, const char *voltdm) - { - struct omap_sr_data *sr_data = NULL; - struct omap_volt_data *volt_data; -- struct omap_smartreflex_dev_attr *sr_dev_attr; - static int i; - -- if (!strncmp(oh->name, "smartreflex_mpu_iva", 20) || -- !strncmp(oh->name, "smartreflex_mpu", 16)) -+ if (!strncmp(name, "smartreflex_mpu_iva", 20) || -+ !strncmp(name, "smartreflex_mpu", 16)) - sr_data = &omap_sr_pdata[OMAP_SR_MPU]; -- else if (!strncmp(oh->name, "smartreflex_core", 17)) -+ else if (!strncmp(name, "smartreflex_core", 17)) - sr_data = &omap_sr_pdata[OMAP_SR_CORE]; -- else if (!strncmp(oh->name, "smartreflex_iva", 16)) -+ else if (!strncmp(name, "smartreflex_iva", 16)) - sr_data = &omap_sr_pdata[OMAP_SR_IVA]; - - if (!sr_data) { -- pr_err("%s: Unknown instance %s\n", __func__, oh->name); -+ pr_err("%s: Unknown instance %s\n", __func__, name); - return -EINVAL; - } - -- sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr; -- if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) { -- pr_err("%s: No voltage domain specified for %s. Cannot initialize\n", -- __func__, oh->name); -- goto exit; -- } -- -- sr_data->name = oh->name; -+ sr_data->name = name; - if (cpu_is_omap343x()) - sr_data->ip_type = 1; - else -@@ -136,10 +128,10 @@ static int __init sr_dev_init(struct omap_hwmod *oh, void *user) - } - } - -- sr_data->voltdm = voltdm_lookup(sr_dev_attr->sensor_voltdm_name); -+ sr_data->voltdm = voltdm_lookup(voltdm); - if (!sr_data->voltdm) { - pr_err("%s: Unable to get voltage domain pointer for VDD %s\n", -- __func__, sr_dev_attr->sensor_voltdm_name); -+ __func__, voltdm); - goto exit; - } - -@@ -160,6 +152,20 @@ exit: - return 0; - } - -+static int __init sr_dev_init(struct omap_hwmod *oh, void *user) -+{ -+ struct omap_smartreflex_dev_attr *sr_dev_attr; -+ -+ sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr; -+ if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) { -+ pr_err("%s: No voltage domain specified for %s. Cannot initialize\n", -+ __func__, oh->name); -+ return 0; -+ } -+ -+ return sr_init_by_name(oh->name, sr_dev_attr->sensor_voltdm_name); -+} -+ - /* - * API to be called from board files to enable smartreflex - * autocompensation at init. -@@ -169,7 +175,42 @@ void __init omap_enable_smartreflex_on_init(void) - sr_enable_on_init = true; - } - -+static const char * const omap4_sr_instances[] = { -+ "mpu", -+ "iva", -+ "core", -+}; -+ -+static const char * const dra7_sr_instances[] = { -+ "mpu", -+ "core", -+}; -+ - int __init omap_devinit_smartreflex(void) - { -+ const char * const *sr_inst; -+ int i, nr_sr = 0; -+ -+ if (soc_is_omap44xx()) { -+ sr_inst = omap4_sr_instances; -+ nr_sr = ARRAY_SIZE(omap4_sr_instances); -+ -+ } else if (soc_is_dra7xx()) { -+ sr_inst = dra7_sr_instances; -+ nr_sr = ARRAY_SIZE(dra7_sr_instances); -+ } -+ -+ if (nr_sr) { -+ const char *name, *voltdm; -+ -+ for (i = 0; i < nr_sr; i++) { -+ name = kasprintf(GFP_KERNEL, "smartreflex_%s", sr_inst[i]); -+ voltdm = sr_inst[i]; -+ sr_init_by_name(name, voltdm); -+ } -+ -+ return 0; -+ } -+ - return omap_hwmod_for_each_by_class("smartreflex", sr_dev_init, NULL); - } -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi -index 626b709d1fb90..03de3a34276af 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi -@@ -192,6 +192,7 @@ - ranges = <0x0 0x00 0x1700000 0x100000>; - reg = <0x00 0x1700000 0x0 0x100000>; - interrupts = ; -+ dma-coherent; - - sec_jr0: jr@10000 { - compatible = "fsl,sec-v5.4-job-ring", -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi -index bbae4b353d3ff..c3c34e519e90c 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi -@@ -322,6 +322,7 @@ - ranges = <0x0 0x00 0x1700000 0x100000>; - reg = <0x00 0x1700000 0x0 0x100000>; - interrupts = <0 75 0x4>; -+ dma-coherent; - - sec_jr0: jr@10000 { - compatible = "fsl,sec-v5.4-job-ring", -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi -index 565934cbfa280..719451ee09d0b 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi -@@ -325,6 +325,7 @@ - ranges = <0x0 0x00 0x1700000 0x100000>; - reg = <0x00 0x1700000 0x0 0x100000>; - interrupts = ; -+ dma-coherent; - - sec_jr0: jr@10000 { - compatible = "fsl,sec-v5.4-job-ring", -diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c -index e6e284265f19d..58303a9ec32c4 100644 ---- a/arch/arm64/kernel/crash_dump.c -+++ b/arch/arm64/kernel/crash_dump.c -@@ -64,5 +64,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, - ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) - { - memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count); -+ *ppos += count; -+ - return count; - } -diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c -index fa56af1a59c39..dbce0dcf4cc06 100644 ---- a/arch/arm64/kernel/stacktrace.c -+++ b/arch/arm64/kernel/stacktrace.c -@@ -199,8 +199,9 @@ void show_stack(struct task_struct *tsk, unsigned long *sp, const char *loglvl) - - #ifdef CONFIG_STACKTRACE - --void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, -- struct task_struct *task, struct pt_regs *regs) -+noinline void arch_stack_walk(stack_trace_consume_fn consume_entry, -+ void *cookie, struct task_struct *task, -+ struct pt_regs *regs) - { - struct stackframe frame; - -@@ -208,8 +209,8 @@ void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, - start_backtrace(&frame, regs->regs[29], regs->pc); - else if (task == current) - start_backtrace(&frame, -- (unsigned long)__builtin_frame_address(0), -- (unsigned long)arch_stack_walk); -+ (unsigned long)__builtin_frame_address(1), -+ (unsigned long)__builtin_return_address(0)); - else - start_backtrace(&frame, thread_saved_fp(task), - thread_saved_pc(task)); -diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h -index 6c6f16e409a87..0d23c00493018 100644 ---- a/arch/ia64/include/asm/syscall.h -+++ b/arch/ia64/include/asm/syscall.h -@@ -32,7 +32,7 @@ static inline void syscall_rollback(struct task_struct *task, - static inline long syscall_get_error(struct task_struct *task, - struct pt_regs *regs) - { -- return regs->r10 == -1 ? regs->r8:0; -+ return regs->r10 == -1 ? -regs->r8:0; - } - - static inline long syscall_get_return_value(struct task_struct *task, -diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c -index c3490ee2daa58..e14f5653393ac 100644 ---- a/arch/ia64/kernel/ptrace.c -+++ b/arch/ia64/kernel/ptrace.c -@@ -2013,27 +2013,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data) - { - struct syscall_get_set_args *args = data; - struct pt_regs *pt = args->regs; -- unsigned long *krbs, cfm, ndirty; -+ unsigned long *krbs, cfm, ndirty, nlocals, nouts; - int i, count; - - if (unw_unwind_to_user(info) < 0) - return; - -+ /* -+ * We get here via a few paths: -+ * - break instruction: cfm is shared with caller. -+ * syscall args are in out= regs, locals are non-empty. -+ * - epsinstruction: cfm is set by br.call -+ * locals don't exist. -+ * -+ * For both cases argguments are reachable in cfm.sof - cfm.sol. -+ * CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ] -+ */ - cfm = pt->cr_ifs; -+ nlocals = (cfm >> 7) & 0x7f; /* aka sol */ -+ nouts = (cfm & 0x7f) - nlocals; /* aka sof - sol */ - krbs = (unsigned long *)info->task + IA64_RBS_OFFSET/8; - ndirty = ia64_rse_num_regs(krbs, krbs + (pt->loadrs >> 19)); - - count = 0; - if (in_syscall(pt)) -- count = min_t(int, args->n, cfm & 0x7f); -+ count = min_t(int, args->n, nouts); - -+ /* Iterate over outs. */ - for (i = 0; i < count; i++) { -+ int j = ndirty + nlocals + i + args->i; - if (args->rw) -- *ia64_rse_skip_regs(krbs, ndirty + i + args->i) = -- args->args[i]; -+ *ia64_rse_skip_regs(krbs, j) = args->args[i]; - else -- args->args[i] = *ia64_rse_skip_regs(krbs, -- ndirty + i + args->i); -+ args->args[i] = *ia64_rse_skip_regs(krbs, j); - } - - if (!args->rw) { -diff --git a/arch/powerpc/include/asm/dcr-native.h b/arch/powerpc/include/asm/dcr-native.h -index 7141ccea8c94e..a92059964579b 100644 ---- a/arch/powerpc/include/asm/dcr-native.h -+++ b/arch/powerpc/include/asm/dcr-native.h -@@ -53,8 +53,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) - #define mfdcr(rn) \ - ({unsigned int rval; \ - if (__builtin_constant_p(rn) && rn < 1024) \ -- asm volatile("mfdcr %0," __stringify(rn) \ -- : "=r" (rval)); \ -+ asm volatile("mfdcr %0, %1" : "=r" (rval) \ -+ : "n" (rn)); \ - else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ - rval = mfdcrx(rn); \ - else \ -@@ -64,8 +64,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) - #define mtdcr(rn, v) \ - do { \ - if (__builtin_constant_p(rn) && rn < 1024) \ -- asm volatile("mtdcr " __stringify(rn) ",%0" \ -- : : "r" (v)); \ -+ asm volatile("mtdcr %0, %1" \ -+ : : "n" (rn), "r" (v)); \ - else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ - mtdcrx(rn, v); \ - else \ -diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c -index d92e5eaa4c1d7..a850dccd78ea1 100644 ---- a/arch/sparc/kernel/traps_64.c -+++ b/arch/sparc/kernel/traps_64.c -@@ -275,14 +275,13 @@ bool is_no_fault_exception(struct pt_regs *regs) - asi = (regs->tstate >> 24); /* saved %asi */ - else - asi = (insn >> 5); /* immediate asi */ -- if ((asi & 0xf2) == ASI_PNF) { -- if (insn & 0x1000000) { /* op3[5:4]=3 */ -- handle_ldf_stq(insn, regs); -- return true; -- } else if (insn & 0x200000) { /* op3[2], stores */ -+ if ((asi & 0xf6) == ASI_PNF) { -+ if (insn & 0x200000) /* op3[2], stores */ - return false; -- } -- handle_ld_nf(insn, regs); -+ if (insn & 0x1000000) /* op3[5:4]=3 (fp) */ -+ handle_ldf_stq(insn, regs); -+ else -+ handle_ld_nf(insn, regs); - return true; - } - } -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 3d6616f6f6ef8..e0cfd620b2934 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -894,6 +894,12 @@ enum kvm_irqchip_mode { - KVM_IRQCHIP_SPLIT, /* created with KVM_CAP_SPLIT_IRQCHIP */ - }; - -+struct kvm_x86_msr_filter { -+ u8 count; -+ bool default_allow:1; -+ struct msr_bitmap_range ranges[16]; -+}; -+ - #define APICV_INHIBIT_REASON_DISABLE 0 - #define APICV_INHIBIT_REASON_HYPERV 1 - #define APICV_INHIBIT_REASON_NESTED 2 -@@ -989,14 +995,12 @@ struct kvm_arch { - bool guest_can_read_msr_platform_info; - bool exception_payload_enabled; - -+ bool bus_lock_detection_enabled; -+ - /* Deflect RDMSR and WRMSR to user space when they trigger a #GP */ - u32 user_space_msr_mask; - -- struct { -- u8 count; -- bool default_allow:1; -- struct msr_bitmap_range ranges[16]; -- } msr_filter; -+ struct kvm_x86_msr_filter __rcu *msr_filter; - - struct kvm_pmu_event_filter *pmu_event_filter; - struct task_struct *nx_lpage_recovery_thread; -diff --git a/arch/x86/include/asm/static_call.h b/arch/x86/include/asm/static_call.h -index c37f11999d0c0..cbb67b6030f97 100644 ---- a/arch/x86/include/asm/static_call.h -+++ b/arch/x86/include/asm/static_call.h -@@ -37,4 +37,11 @@ - #define ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name) \ - __ARCH_DEFINE_STATIC_CALL_TRAMP(name, "ret; nop; nop; nop; nop") - -+ -+#define ARCH_ADD_TRAMP_KEY(name) \ -+ asm(".pushsection .static_call_tramp_key, \"a\" \n" \ -+ ".long " STATIC_CALL_TRAMP_STR(name) " - . \n" \ -+ ".long " STATIC_CALL_KEY_STR(name) " - . \n" \ -+ ".popsection \n") -+ - #endif /* _ASM_STATIC_CALL_H */ -diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h -index 7068e4bb057d9..1a162e559753b 100644 ---- a/arch/x86/include/asm/xen/page.h -+++ b/arch/x86/include/asm/xen/page.h -@@ -86,18 +86,6 @@ clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops, - } - #endif - --/* -- * The maximum amount of extra memory compared to the base size. The -- * main scaling factor is the size of struct page. At extreme ratios -- * of base:extra, all the base memory can be filled with page -- * structures for the extra memory, leaving no space for anything -- * else. -- * -- * 10x seems like a reasonable balance between scaling flexibility and -- * leaving a practically usable system. -- */ --#define XEN_EXTRA_MEM_RATIO (10) -- - /* - * Helper functions to write or read unsigned long values to/from - * memory, when the access may fault. -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index b967c1c774a1f..f37f5c1430cfd 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -1523,35 +1523,44 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); - - bool kvm_msr_allowed(struct kvm_vcpu *vcpu, u32 index, u32 type) - { -+ struct kvm_x86_msr_filter *msr_filter; -+ struct msr_bitmap_range *ranges; - struct kvm *kvm = vcpu->kvm; -- struct msr_bitmap_range *ranges = kvm->arch.msr_filter.ranges; -- u32 count = kvm->arch.msr_filter.count; -- u32 i; -- bool r = kvm->arch.msr_filter.default_allow; -+ bool allowed; - int idx; -+ u32 i; - -- /* MSR filtering not set up or x2APIC enabled, allow everything */ -- if (!count || (index >= 0x800 && index <= 0x8ff)) -+ /* x2APIC MSRs do not support filtering. */ -+ if (index >= 0x800 && index <= 0x8ff) - return true; - -- /* Prevent collision with set_msr_filter */ - idx = srcu_read_lock(&kvm->srcu); - -- for (i = 0; i < count; i++) { -+ msr_filter = srcu_dereference(kvm->arch.msr_filter, &kvm->srcu); -+ if (!msr_filter) { -+ allowed = true; -+ goto out; -+ } -+ -+ allowed = msr_filter->default_allow; -+ ranges = msr_filter->ranges; -+ -+ for (i = 0; i < msr_filter->count; i++) { - u32 start = ranges[i].base; - u32 end = start + ranges[i].nmsrs; - u32 flags = ranges[i].flags; - unsigned long *bitmap = ranges[i].bitmap; - - if ((index >= start) && (index < end) && (flags & type)) { -- r = !!test_bit(index - start, bitmap); -+ allowed = !!test_bit(index - start, bitmap); - break; - } - } - -+out: - srcu_read_unlock(&kvm->srcu, idx); - -- return r; -+ return allowed; - } - EXPORT_SYMBOL_GPL(kvm_msr_allowed); - -@@ -5315,25 +5324,34 @@ split_irqchip_unlock: - return r; - } - --static void kvm_clear_msr_filter(struct kvm *kvm) -+static struct kvm_x86_msr_filter *kvm_alloc_msr_filter(bool default_allow) -+{ -+ struct kvm_x86_msr_filter *msr_filter; -+ -+ msr_filter = kzalloc(sizeof(*msr_filter), GFP_KERNEL_ACCOUNT); -+ if (!msr_filter) -+ return NULL; -+ -+ msr_filter->default_allow = default_allow; -+ return msr_filter; -+} -+ -+static void kvm_free_msr_filter(struct kvm_x86_msr_filter *msr_filter) - { - u32 i; -- u32 count = kvm->arch.msr_filter.count; -- struct msr_bitmap_range ranges[16]; - -- mutex_lock(&kvm->lock); -- kvm->arch.msr_filter.count = 0; -- memcpy(ranges, kvm->arch.msr_filter.ranges, count * sizeof(ranges[0])); -- mutex_unlock(&kvm->lock); -- synchronize_srcu(&kvm->srcu); -+ if (!msr_filter) -+ return; -+ -+ for (i = 0; i < msr_filter->count; i++) -+ kfree(msr_filter->ranges[i].bitmap); - -- for (i = 0; i < count; i++) -- kfree(ranges[i].bitmap); -+ kfree(msr_filter); - } - --static int kvm_add_msr_filter(struct kvm *kvm, struct kvm_msr_filter_range *user_range) -+static int kvm_add_msr_filter(struct kvm_x86_msr_filter *msr_filter, -+ struct kvm_msr_filter_range *user_range) - { -- struct msr_bitmap_range *ranges = kvm->arch.msr_filter.ranges; - struct msr_bitmap_range range; - unsigned long *bitmap = NULL; - size_t bitmap_size; -@@ -5367,11 +5385,9 @@ static int kvm_add_msr_filter(struct kvm *kvm, struct kvm_msr_filter_range *user - goto err; - } - -- /* Everything ok, add this range identifier to our global pool */ -- ranges[kvm->arch.msr_filter.count] = range; -- /* Make sure we filled the array before we tell anyone to walk it */ -- smp_wmb(); -- kvm->arch.msr_filter.count++; -+ /* Everything ok, add this range identifier. */ -+ msr_filter->ranges[msr_filter->count] = range; -+ msr_filter->count++; - - return 0; - err: -@@ -5382,10 +5398,11 @@ err: - static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) - { - struct kvm_msr_filter __user *user_msr_filter = argp; -+ struct kvm_x86_msr_filter *new_filter, *old_filter; - struct kvm_msr_filter filter; - bool default_allow; -- int r = 0; - bool empty = true; -+ int r = 0; - u32 i; - - if (copy_from_user(&filter, user_msr_filter, sizeof(filter))) -@@ -5398,25 +5415,32 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) - if (empty && !default_allow) - return -EINVAL; - -- kvm_clear_msr_filter(kvm); -- -- kvm->arch.msr_filter.default_allow = default_allow; -+ new_filter = kvm_alloc_msr_filter(default_allow); -+ if (!new_filter) -+ return -ENOMEM; - -- /* -- * Protect from concurrent calls to this function that could trigger -- * a TOCTOU violation on kvm->arch.msr_filter.count. -- */ -- mutex_lock(&kvm->lock); - for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) { -- r = kvm_add_msr_filter(kvm, &filter.ranges[i]); -- if (r) -- break; -+ r = kvm_add_msr_filter(new_filter, &filter.ranges[i]); -+ if (r) { -+ kvm_free_msr_filter(new_filter); -+ return r; -+ } - } - -+ mutex_lock(&kvm->lock); -+ -+ /* The per-VM filter is protected by kvm->lock... */ -+ old_filter = srcu_dereference_check(kvm->arch.msr_filter, &kvm->srcu, 1); -+ -+ rcu_assign_pointer(kvm->arch.msr_filter, new_filter); -+ synchronize_srcu(&kvm->srcu); -+ -+ kvm_free_msr_filter(old_filter); -+ - kvm_make_all_cpus_request(kvm, KVM_REQ_MSR_FILTER_CHANGED); - mutex_unlock(&kvm->lock); - -- return r; -+ return 0; - } - - long kvm_arch_vm_ioctl(struct file *filp, -@@ -10536,8 +10560,6 @@ void kvm_arch_pre_destroy_vm(struct kvm *kvm) - - void kvm_arch_destroy_vm(struct kvm *kvm) - { -- u32 i; -- - if (current->mm == kvm->mm) { - /* - * Free memory regions allocated on behalf of userspace, -@@ -10554,8 +10576,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm) - } - if (kvm_x86_ops.vm_destroy) - kvm_x86_ops.vm_destroy(kvm); -- for (i = 0; i < kvm->arch.msr_filter.count; i++) -- kfree(kvm->arch.msr_filter.ranges[i].bitmap); -+ kvm_free_msr_filter(srcu_dereference_check(kvm->arch.msr_filter, &kvm->srcu, 1)); - kvm_pic_destroy(kvm); - kvm_ioapic_destroy(kvm); - kvm_free_vcpus(kvm); -diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c -index c3d5f0236f353..868fd69814bff 100644 ---- a/arch/x86/mm/mem_encrypt.c -+++ b/arch/x86/mm/mem_encrypt.c -@@ -262,7 +262,7 @@ static void __init __set_clr_pte_enc(pte_t *kpte, int level, bool enc) - if (pgprot_val(old_prot) == pgprot_val(new_prot)) - return; - -- pa = pfn << page_level_shift(level); -+ pa = pfn << PAGE_SHIFT; - size = page_level_size(level); - - /* -diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index 796506dcfc42e..023ac12f54a29 100644 ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -1735,7 +1735,7 @@ static int invoke_bpf_mod_ret(const struct btf_func_model *m, u8 **pprog, - * add rsp, 8 // skip eth_type_trans's frame - * ret // return to its caller - */ --int arch_prepare_bpf_trampoline(void *image, void *image_end, -+int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *image_end, - const struct btf_func_model *m, u32 flags, - struct bpf_tramp_progs *tprogs, - void *orig_call) -@@ -1774,6 +1774,15 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, - - save_regs(m, &prog, nr_args, stack_size); - -+ if (flags & BPF_TRAMP_F_CALL_ORIG) { -+ /* arg1: mov rdi, im */ -+ emit_mov_imm64(&prog, BPF_REG_1, (long) im >> 32, (u32) (long) im); -+ if (emit_call(&prog, __bpf_tramp_enter, prog)) { -+ ret = -EINVAL; -+ goto cleanup; -+ } -+ } -+ - if (fentry->nr_progs) - if (invoke_bpf(m, &prog, fentry, stack_size)) - return -EINVAL; -@@ -1792,8 +1801,7 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, - } - - if (flags & BPF_TRAMP_F_CALL_ORIG) { -- if (fentry->nr_progs || fmod_ret->nr_progs) -- restore_regs(m, &prog, nr_args, stack_size); -+ restore_regs(m, &prog, nr_args, stack_size); - - /* call original function */ - if (emit_call(&prog, orig_call, prog)) { -@@ -1802,6 +1810,9 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, - } - /* remember return value in a stack for bpf prog to access */ - emit_stx(&prog, BPF_DW, BPF_REG_FP, BPF_REG_0, -8); -+ im->ip_after_call = prog; -+ memcpy(prog, ideal_nops[NOP_ATOMIC5], X86_PATCH_SIZE); -+ prog += X86_PATCH_SIZE; - } - - if (fmod_ret->nr_progs) { -@@ -1832,9 +1843,17 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, - * the return value is only updated on the stack and still needs to be - * restored to R0. - */ -- if (flags & BPF_TRAMP_F_CALL_ORIG) -+ if (flags & BPF_TRAMP_F_CALL_ORIG) { -+ im->ip_epilogue = prog; -+ /* arg1: mov rdi, im */ -+ emit_mov_imm64(&prog, BPF_REG_1, (long) im >> 32, (u32) (long) im); -+ if (emit_call(&prog, __bpf_tramp_exit, prog)) { -+ ret = -EINVAL; -+ goto cleanup; -+ } - /* restore original return value back into RAX */ - emit_ldx(&prog, BPF_DW, BPF_REG_0, BPF_REG_FP, -8); -+ } - - EMIT1(0x5B); /* pop rbx */ - EMIT1(0xC9); /* leave */ -diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c -index a3cc33091f46c..8bdba2564cf9b 100644 ---- a/arch/x86/xen/p2m.c -+++ b/arch/x86/xen/p2m.c -@@ -98,8 +98,8 @@ EXPORT_SYMBOL_GPL(xen_p2m_size); - unsigned long xen_max_p2m_pfn __read_mostly; - EXPORT_SYMBOL_GPL(xen_max_p2m_pfn); - --#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT --#define P2M_LIMIT CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT -+#ifdef CONFIG_XEN_MEMORY_HOTPLUG_LIMIT -+#define P2M_LIMIT CONFIG_XEN_MEMORY_HOTPLUG_LIMIT - #else - #define P2M_LIMIT 0 - #endif -@@ -416,9 +416,6 @@ void __init xen_vmalloc_p2m_tree(void) - xen_p2m_last_pfn = xen_max_p2m_pfn; - - p2m_limit = (phys_addr_t)P2M_LIMIT * 1024 * 1024 * 1024 / PAGE_SIZE; -- if (!p2m_limit && IS_ENABLED(CONFIG_XEN_UNPOPULATED_ALLOC)) -- p2m_limit = xen_start_info->nr_pages * XEN_EXTRA_MEM_RATIO; -- - vm.flags = VM_ALLOC; - vm.size = ALIGN(sizeof(unsigned long) * max(xen_max_p2m_pfn, p2m_limit), - PMD_SIZE * PMDS_PER_MID_PAGE); -diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c -index 1a3b75652fa4f..8bfc103301077 100644 ---- a/arch/x86/xen/setup.c -+++ b/arch/x86/xen/setup.c -@@ -59,6 +59,18 @@ static struct { - } xen_remap_buf __initdata __aligned(PAGE_SIZE); - static unsigned long xen_remap_mfn __initdata = INVALID_P2M_ENTRY; - -+/* -+ * The maximum amount of extra memory compared to the base size. The -+ * main scaling factor is the size of struct page. At extreme ratios -+ * of base:extra, all the base memory can be filled with page -+ * structures for the extra memory, leaving no space for anything -+ * else. -+ * -+ * 10x seems like a reasonable balance between scaling flexibility and -+ * leaving a practically usable system. -+ */ -+#define EXTRA_MEM_RATIO (10) -+ - static bool xen_512gb_limit __initdata = IS_ENABLED(CONFIG_XEN_512GB); - - static void __init xen_parse_512gb(void) -@@ -778,13 +790,13 @@ char * __init xen_memory_setup(void) - extra_pages += max_pages - max_pfn; - - /* -- * Clamp the amount of extra memory to a XEN_EXTRA_MEM_RATIO -+ * Clamp the amount of extra memory to a EXTRA_MEM_RATIO - * factor the base size. - * - * Make sure we have no memory above max_pages, as this area - * isn't handled by the p2m management. - */ -- extra_pages = min3(XEN_EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)), -+ extra_pages = min3(EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)), - extra_pages, max_pages - max_pfn); - i = 0; - addr = xen_e820_table.entries[0].addr; -diff --git a/block/blk-cgroup-rwstat.c b/block/blk-cgroup-rwstat.c -index 85d5790ac49b0..3304e841df7ce 100644 ---- a/block/blk-cgroup-rwstat.c -+++ b/block/blk-cgroup-rwstat.c -@@ -109,6 +109,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol, - - lockdep_assert_held(&blkg->q->queue_lock); - -+ memset(sum, 0, sizeof(*sum)); - rcu_read_lock(); - blkg_for_each_descendant_pre(pos_blkg, pos_css, blkg) { - struct blkg_rwstat *rwstat; -@@ -122,7 +123,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol, - rwstat = (void *)pos_blkg + off; - - for (i = 0; i < BLKG_RWSTAT_NR; i++) -- sum->cnt[i] = blkg_rwstat_read_counter(rwstat, i); -+ sum->cnt[i] += blkg_rwstat_read_counter(rwstat, i); - } - rcu_read_unlock(); - } -diff --git a/block/blk-merge.c b/block/blk-merge.c -index 808768f6b174c..756473295f19b 100644 ---- a/block/blk-merge.c -+++ b/block/blk-merge.c -@@ -383,6 +383,14 @@ unsigned int blk_recalc_rq_segments(struct request *rq) - switch (bio_op(rq->bio)) { - case REQ_OP_DISCARD: - case REQ_OP_SECURE_ERASE: -+ if (queue_max_discard_segments(rq->q) > 1) { -+ struct bio *bio = rq->bio; -+ -+ for_each_bio(bio) -+ nr_phys_segs++; -+ return nr_phys_segs; -+ } -+ return 1; - case REQ_OP_WRITE_ZEROES: - return 0; - case REQ_OP_WRITE_SAME: -diff --git a/block/blk-zoned.c b/block/blk-zoned.c -index df0ecf6790d35..fc925f73d694a 100644 ---- a/block/blk-zoned.c -+++ b/block/blk-zoned.c -@@ -240,7 +240,7 @@ int blkdev_zone_mgmt(struct block_device *bdev, enum req_opf op, - */ - if (op == REQ_OP_ZONE_RESET && - blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) { -- bio->bi_opf = REQ_OP_ZONE_RESET_ALL; -+ bio->bi_opf = REQ_OP_ZONE_RESET_ALL | REQ_SYNC; - break; - } - -diff --git a/block/genhd.c b/block/genhd.c -index 07a0ef741de19..12940cfa68afc 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -658,10 +658,8 @@ static void register_disk(struct device *parent, struct gendisk *disk, - kobject_create_and_add("holders", &ddev->kobj); - disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj); - -- if (disk->flags & GENHD_FL_HIDDEN) { -- dev_set_uevent_suppress(ddev, 0); -+ if (disk->flags & GENHD_FL_HIDDEN) - return; -- } - - disk_scan_partitions(disk); - -diff --git a/drivers/acpi/acpica/nsaccess.c b/drivers/acpi/acpica/nsaccess.c -index 3f045b5953b2e..a0c1a665dfc12 100644 ---- a/drivers/acpi/acpica/nsaccess.c -+++ b/drivers/acpi/acpica/nsaccess.c -@@ -99,13 +99,12 @@ acpi_status acpi_ns_root_initialize(void) - * just create and link the new node(s) here. - */ - new_node = -- ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_namespace_node)); -+ acpi_ns_create_node(*ACPI_CAST_PTR(u32, init_val->name)); - if (!new_node) { - status = AE_NO_MEMORY; - goto unlock_and_exit; - } - -- ACPI_COPY_NAMESEG(new_node->name.ascii, init_val->name); - new_node->descriptor_type = ACPI_DESC_TYPE_NAMED; - new_node->type = init_val->type; - -diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h -index e6a5d997241c4..cb8f70842249e 100644 ---- a/drivers/acpi/internal.h -+++ b/drivers/acpi/internal.h -@@ -9,6 +9,8 @@ - #ifndef _ACPI_INTERNAL_H_ - #define _ACPI_INTERNAL_H_ - -+#include -+ - #define PREFIX "ACPI: " - - int early_acpi_osi_init(void); -@@ -96,9 +98,11 @@ void acpi_scan_table_handler(u32 event, void *table, void *context); - - extern struct list_head acpi_bus_id_list; - -+#define ACPI_MAX_DEVICE_INSTANCES 4096 -+ - struct acpi_device_bus_id { - const char *bus_id; -- unsigned int instance_no; -+ struct ida instance_ida; - struct list_head node; - }; - -diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c -index 22566b4b3150a..a4fdf61b06444 100644 ---- a/drivers/acpi/scan.c -+++ b/drivers/acpi/scan.c -@@ -482,9 +482,8 @@ static void acpi_device_del(struct acpi_device *device) - list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) - if (!strcmp(acpi_device_bus_id->bus_id, - acpi_device_hid(device))) { -- if (acpi_device_bus_id->instance_no > 0) -- acpi_device_bus_id->instance_no--; -- else { -+ ida_simple_remove(&acpi_device_bus_id->instance_ida, device->pnp.instance_no); -+ if (ida_is_empty(&acpi_device_bus_id->instance_ida)) { - list_del(&acpi_device_bus_id->node); - kfree_const(acpi_device_bus_id->bus_id); - kfree(acpi_device_bus_id); -@@ -623,12 +622,38 @@ void acpi_bus_put_acpi_device(struct acpi_device *adev) - put_device(&adev->dev); - } - -+static struct acpi_device_bus_id *acpi_device_bus_id_match(const char *dev_id) -+{ -+ struct acpi_device_bus_id *acpi_device_bus_id; -+ -+ /* Find suitable bus_id and instance number in acpi_bus_id_list. */ -+ list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) { -+ if (!strcmp(acpi_device_bus_id->bus_id, dev_id)) -+ return acpi_device_bus_id; -+ } -+ return NULL; -+} -+ -+static int acpi_device_set_name(struct acpi_device *device, -+ struct acpi_device_bus_id *acpi_device_bus_id) -+{ -+ struct ida *instance_ida = &acpi_device_bus_id->instance_ida; -+ int result; -+ -+ result = ida_simple_get(instance_ida, 0, ACPI_MAX_DEVICE_INSTANCES, GFP_KERNEL); -+ if (result < 0) -+ return result; -+ -+ device->pnp.instance_no = result; -+ dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, result); -+ return 0; -+} -+ - int acpi_device_add(struct acpi_device *device, - void (*release)(struct device *)) - { -+ struct acpi_device_bus_id *acpi_device_bus_id; - int result; -- struct acpi_device_bus_id *acpi_device_bus_id, *new_bus_id; -- int found = 0; - - if (device->handle) { - acpi_status status; -@@ -654,41 +679,38 @@ int acpi_device_add(struct acpi_device *device, - INIT_LIST_HEAD(&device->del_list); - mutex_init(&device->physical_node_lock); - -- new_bus_id = kzalloc(sizeof(struct acpi_device_bus_id), GFP_KERNEL); -- if (!new_bus_id) { -- pr_err(PREFIX "Memory allocation error\n"); -- result = -ENOMEM; -- goto err_detach; -- } -- - mutex_lock(&acpi_device_lock); -- /* -- * Find suitable bus_id and instance number in acpi_bus_id_list -- * If failed, create one and link it into acpi_bus_id_list -- */ -- list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) { -- if (!strcmp(acpi_device_bus_id->bus_id, -- acpi_device_hid(device))) { -- acpi_device_bus_id->instance_no++; -- found = 1; -- kfree(new_bus_id); -- break; -+ -+ acpi_device_bus_id = acpi_device_bus_id_match(acpi_device_hid(device)); -+ if (acpi_device_bus_id) { -+ result = acpi_device_set_name(device, acpi_device_bus_id); -+ if (result) -+ goto err_unlock; -+ } else { -+ acpi_device_bus_id = kzalloc(sizeof(*acpi_device_bus_id), -+ GFP_KERNEL); -+ if (!acpi_device_bus_id) { -+ result = -ENOMEM; -+ goto err_unlock; - } -- } -- if (!found) { -- acpi_device_bus_id = new_bus_id; - acpi_device_bus_id->bus_id = - kstrdup_const(acpi_device_hid(device), GFP_KERNEL); - if (!acpi_device_bus_id->bus_id) { -- pr_err(PREFIX "Memory allocation error for bus id\n"); -+ kfree(acpi_device_bus_id); - result = -ENOMEM; -- goto err_free_new_bus_id; -+ goto err_unlock; -+ } -+ -+ ida_init(&acpi_device_bus_id->instance_ida); -+ -+ result = acpi_device_set_name(device, acpi_device_bus_id); -+ if (result) { -+ kfree(acpi_device_bus_id); -+ goto err_unlock; - } - -- acpi_device_bus_id->instance_no = 0; - list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); - } -- dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, acpi_device_bus_id->instance_no); - - if (device->parent) - list_add_tail(&device->node, &device->parent->children); -@@ -720,13 +742,9 @@ int acpi_device_add(struct acpi_device *device, - list_del(&device->node); - list_del(&device->wakeup_list); - -- err_free_new_bus_id: -- if (!found) -- kfree(new_bus_id); -- -+ err_unlock: - mutex_unlock(&acpi_device_lock); - -- err_detach: - acpi_detach_data(device->handle, acpi_scan_drop_device); - return result; - } -diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c -index 811d298637cb2..83cd4c95faf0d 100644 ---- a/drivers/acpi/video_detect.c -+++ b/drivers/acpi/video_detect.c -@@ -147,6 +147,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = { - }, - }, - { -+ .callback = video_detect_force_vendor, - .ident = "Sony VPCEH3U1E", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), -diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c -index 316a9947541fe..b574cce98dc36 100644 ---- a/drivers/atm/eni.c -+++ b/drivers/atm/eni.c -@@ -2260,7 +2260,8 @@ out: - return rc; - - err_eni_release: -- eni_do_release(dev); -+ dev->phy = NULL; -+ iounmap(ENI_DEV(dev)->ioaddr); - err_unregister: - atm_dev_deregister(dev); - err_free_consistent: -diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c -index 3c081b6171a8f..bfca7b8a6f31e 100644 ---- a/drivers/atm/idt77105.c -+++ b/drivers/atm/idt77105.c -@@ -262,7 +262,7 @@ static int idt77105_start(struct atm_dev *dev) - { - unsigned long flags; - -- if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL))) -+ if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL))) - return -ENOMEM; - PRIV(dev)->dev = dev; - spin_lock_irqsave(&idt77105_priv_lock, flags); -@@ -337,7 +337,7 @@ static int idt77105_stop(struct atm_dev *dev) - else - idt77105_all = walk->next; - dev->phy = NULL; -- dev->dev_data = NULL; -+ dev->phy_data = NULL; - kfree(walk); - break; - } -diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c -index d7277c26e4232..32d7aa141d966 100644 ---- a/drivers/atm/lanai.c -+++ b/drivers/atm/lanai.c -@@ -2233,6 +2233,7 @@ static int lanai_dev_open(struct atm_dev *atmdev) - conf1_write(lanai); - #endif - iounmap(lanai->base); -+ lanai->base = NULL; - error_pci: - pci_disable_device(lanai->pci); - error: -@@ -2245,6 +2246,8 @@ static int lanai_dev_open(struct atm_dev *atmdev) - static void lanai_dev_close(struct atm_dev *atmdev) - { - struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data; -+ if (lanai->base==NULL) -+ return; - printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n", - lanai->number); - lanai_timed_poll_stop(lanai); -@@ -2552,7 +2555,7 @@ static int lanai_init_one(struct pci_dev *pci, - struct atm_dev *atmdev; - int result; - -- lanai = kmalloc(sizeof(*lanai), GFP_KERNEL); -+ lanai = kzalloc(sizeof(*lanai), GFP_KERNEL); - if (lanai == NULL) { - printk(KERN_ERR DEV_LABEL - ": couldn't allocate dev_data structure!\n"); -diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c -index 7850758b5bb82..239852d855589 100644 ---- a/drivers/atm/uPD98402.c -+++ b/drivers/atm/uPD98402.c -@@ -211,7 +211,7 @@ static void uPD98402_int(struct atm_dev *dev) - static int uPD98402_start(struct atm_dev *dev) - { - DPRINTK("phy_start\n"); -- if (!(dev->dev_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL))) -+ if (!(dev->phy_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL))) - return -ENOMEM; - spin_lock_init(&PRIV(dev)->lock); - memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats)); -diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c -index bfda153b1a41d..5ef67bacb585e 100644 ---- a/drivers/base/power/runtime.c -+++ b/drivers/base/power/runtime.c -@@ -305,7 +305,7 @@ static int rpm_get_suppliers(struct device *dev) - return 0; - } - --static void rpm_put_suppliers(struct device *dev) -+static void __rpm_put_suppliers(struct device *dev, bool try_to_suspend) - { - struct device_link *link; - -@@ -313,10 +313,30 @@ static void rpm_put_suppliers(struct device *dev) - device_links_read_lock_held()) { - - while (refcount_dec_not_one(&link->rpm_active)) -- pm_runtime_put(link->supplier); -+ pm_runtime_put_noidle(link->supplier); -+ -+ if (try_to_suspend) -+ pm_request_idle(link->supplier); - } - } - -+static void rpm_put_suppliers(struct device *dev) -+{ -+ __rpm_put_suppliers(dev, true); -+} -+ -+static void rpm_suspend_suppliers(struct device *dev) -+{ -+ struct device_link *link; -+ int idx = device_links_read_lock(); -+ -+ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node, -+ device_links_read_lock_held()) -+ pm_request_idle(link->supplier); -+ -+ device_links_read_unlock(idx); -+} -+ - /** - * __rpm_callback - Run a given runtime PM callback for a given device. - * @cb: Runtime PM callback to run. -@@ -344,8 +364,10 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) - idx = device_links_read_lock(); - - retval = rpm_get_suppliers(dev); -- if (retval) -+ if (retval) { -+ rpm_put_suppliers(dev); - goto fail; -+ } - - device_links_read_unlock(idx); - } -@@ -368,9 +390,9 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) - || (dev->power.runtime_status == RPM_RESUMING && retval))) { - idx = device_links_read_lock(); - -- fail: -- rpm_put_suppliers(dev); -+ __rpm_put_suppliers(dev, false); - -+fail: - device_links_read_unlock(idx); - } - -@@ -642,8 +664,11 @@ static int rpm_suspend(struct device *dev, int rpmflags) - goto out; - } - -+ if (dev->power.irq_safe) -+ goto out; -+ - /* Maybe the parent is now able to suspend. */ -- if (parent && !parent->power.ignore_children && !dev->power.irq_safe) { -+ if (parent && !parent->power.ignore_children) { - spin_unlock(&dev->power.lock); - - spin_lock(&parent->power.lock); -@@ -652,6 +677,14 @@ static int rpm_suspend(struct device *dev, int rpmflags) - - spin_lock(&dev->power.lock); - } -+ /* Maybe the suppliers are now able to suspend. */ -+ if (dev->power.links_count > 0) { -+ spin_unlock_irq(&dev->power.lock); -+ -+ rpm_suspend_suppliers(dev); -+ -+ spin_lock_irq(&dev->power.lock); -+ } - - out: - trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval); -diff --git a/drivers/block/umem.c b/drivers/block/umem.c -index 2b95d7b33b918..5eb44e4a91eeb 100644 ---- a/drivers/block/umem.c -+++ b/drivers/block/umem.c -@@ -877,6 +877,7 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) - if (card->mm_pages[0].desc == NULL || - card->mm_pages[1].desc == NULL) { - dev_printk(KERN_ERR, &card->dev->dev, "alloc failed\n"); -+ ret = -ENOMEM; - goto failed_alloc; - } - reset_page(&card->mm_pages[0]); -@@ -888,8 +889,10 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) - spin_lock_init(&card->lock); - - card->queue = blk_alloc_queue(NUMA_NO_NODE); -- if (!card->queue) -+ if (!card->queue) { -+ ret = -ENOMEM; - goto failed_alloc; -+ } - - tasklet_init(&card->tasklet, process_page, (unsigned long)card); - -diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c -index da16121140cab..3874233f7194d 100644 ---- a/drivers/block/xen-blkback/blkback.c -+++ b/drivers/block/xen-blkback/blkback.c -@@ -891,7 +891,7 @@ next: - out: - for (i = last_map; i < num; i++) { - /* Don't zap current batch's valid persistent grants. */ -- if(i >= last_map + segs_to_map) -+ if(i >= map_until) - pages[i]->persistent_gnt = NULL; - pages[i]->handle = BLKBACK_INVALID_HANDLE; - } -diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c -index b040447575adc..dcfb32ee5cb60 100644 ---- a/drivers/bus/omap_l3_noc.c -+++ b/drivers/bus/omap_l3_noc.c -@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev) - */ - l3->debug_irq = platform_get_irq(pdev, 0); - ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler, -- 0x0, "l3-dbg-irq", l3); -+ IRQF_NO_THREAD, "l3-dbg-irq", l3); - if (ret) { - dev_err(l3->dev, "request_irq failed for %d\n", - l3->debug_irq); -@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) - - l3->app_irq = platform_get_irq(pdev, 1); - ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler, -- 0x0, "l3-app-irq", l3); -+ IRQF_NO_THREAD, "l3-app-irq", l3); - if (ret) - dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq); - -diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c -index 88e896abb6631..da8b627ca156c 100644 ---- a/drivers/clk/qcom/gcc-sc7180.c -+++ b/drivers/clk/qcom/gcc-sc7180.c -@@ -620,7 +620,7 @@ static struct clk_rcg2 gcc_sdcc1_apps_clk_src = { - .name = "gcc_sdcc1_apps_clk_src", - .parent_data = gcc_parent_data_1, - .num_parents = 5, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_floor_ops, - }, - }; - -@@ -642,7 +642,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = { - .name = "gcc_sdcc1_ice_core_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = 4, -- .ops = &clk_rcg2_floor_ops, -+ .ops = &clk_rcg2_ops, - }, - }; - -diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c -index bd2db0188cbb0..91e6a0c10dbf9 100644 ---- a/drivers/cpufreq/cpufreq-dt-platdev.c -+++ b/drivers/cpufreq/cpufreq-dt-platdev.c -@@ -103,6 +103,8 @@ static const struct of_device_id whitelist[] __initconst = { - static const struct of_device_id blacklist[] __initconst = { - { .compatible = "allwinner,sun50i-h6", }, - -+ { .compatible = "arm,vexpress", }, -+ - { .compatible = "calxeda,highbank", }, - { .compatible = "calxeda,ecx-2000", }, - -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index 495f779b2ab99..1aacd2a5a1fd5 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -174,7 +174,7 @@ static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio, - int ret, value; - - ret = request_threaded_irq(event->irq, NULL, event->handler, -- event->irqflags, "ACPI:Event", event); -+ event->irqflags | IRQF_ONESHOT, "ACPI:Event", event); - if (ret) { - dev_err(acpi_gpio->chip->parent, - "Failed to setup interrupt handler for %d\n", -diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig -index af6c6d214d916..f0c0ccdc8a10a 100644 ---- a/drivers/gpu/drm/Kconfig -+++ b/drivers/gpu/drm/Kconfig -@@ -232,6 +232,7 @@ source "drivers/gpu/drm/arm/Kconfig" - config DRM_RADEON - tristate "ATI Radeon" - depends on DRM && PCI && MMU -+ depends on AGP || !AGP - select FW_LOADER - select DRM_KMS_HELPER - select DRM_TTM -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index bc5b644ddda34..eacfca7762491 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -2666,7 +2666,7 @@ static int amdgpu_device_ip_suspend_phase1(struct amdgpu_device *adev) - { - int i, r; - -- if (adev->in_poweroff_reboot_com || -+ if (adev->in_poweroff_reboot_com || adev->in_hibernate || - !amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) { - amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE); - amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE); -@@ -3727,7 +3727,11 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon) - - amdgpu_fence_driver_suspend(adev); - -- if (adev->in_poweroff_reboot_com || -+ /* -+ * TODO: Need figure out the each GNB IP idle off dependency and then -+ * improve the AMDGPU suspend/resume sequence for system-wide Sx entry/exit. -+ */ -+ if (adev->in_poweroff_reboot_com || adev->in_hibernate || - !amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) - r = amdgpu_device_ip_suspend_phase2(adev); - else -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index 1aed641a3eecc..82cb2ade83b00 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -1102,6 +1102,7 @@ static const struct pci_device_id pciidlist[] = { - {0x1002, 0x73A3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, - {0x1002, 0x73AB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, - {0x1002, 0x73AE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, -+ {0x1002, 0x73AF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, - {0x1002, 0x73BF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, - - /* Van Gogh */ -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c -index 0bf7d36c6686d..5b716404eee1b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c -@@ -146,7 +146,7 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev, - size = mode_cmd->pitches[0] * height; - aligned_size = ALIGN(size, PAGE_SIZE); - ret = amdgpu_gem_object_create(adev, aligned_size, 0, domain, flags, -- ttm_bo_type_kernel, NULL, &gobj); -+ ttm_bo_type_device, NULL, &gobj); - if (ret) { - pr_err("failed to allocate framebuffer (%d)\n", aligned_size); - return -ENOMEM; -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 1d26e82602f75..ad4afbc37d516 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -4616,6 +4616,7 @@ static int fill_dc_plane_attributes(struct amdgpu_device *adev, - dc_plane_state->global_alpha_value = plane_info.global_alpha_value; - dc_plane_state->dcc = plane_info.dcc; - dc_plane_state->layer_index = plane_info.layer_index; // Always returns 0 -+ dc_plane_state->flip_int_enabled = true; - - /* - * Always set input transfer function, since plane state is refreshed -diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h -index 3aedadb34548e..414b44b4ced4a 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc.h -+++ b/drivers/gpu/drm/amd/display/dc/dc.h -@@ -889,6 +889,7 @@ struct dc_plane_state { - int layer_index; - - union surface_update_flags update_flags; -+ bool flip_int_enabled; - /* private to DC core */ - struct dc_plane_status status; - struct dc_context *ctx; -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c -index 9e796dfeac204..714c71a5fbde3 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c -@@ -1257,6 +1257,16 @@ void hubp1_soft_reset(struct hubp *hubp, bool reset) - REG_UPDATE(DCHUBP_CNTL, HUBP_DISABLE, reset ? 1 : 0); - } - -+void hubp1_set_flip_int(struct hubp *hubp) -+{ -+ struct dcn10_hubp *hubp1 = TO_DCN10_HUBP(hubp); -+ -+ REG_UPDATE(DCSURF_SURFACE_FLIP_INTERRUPT, -+ SURFACE_FLIP_INT_MASK, 1); -+ -+ return; -+} -+ - void hubp1_init(struct hubp *hubp) - { - //do nothing -@@ -1290,6 +1300,7 @@ static const struct hubp_funcs dcn10_hubp_funcs = { - .dmdata_load = NULL, - .hubp_soft_reset = hubp1_soft_reset, - .hubp_in_blank = hubp1_in_blank, -+ .hubp_set_flip_int = hubp1_set_flip_int, - }; - - /*****************************************/ -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h -index a9a6ed7f4f993..e2f2f6995935f 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h -@@ -74,6 +74,7 @@ - SRI(DCSURF_SURFACE_EARLIEST_INUSE_C, HUBPREQ, id),\ - SRI(DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C, HUBPREQ, id),\ - SRI(DCSURF_SURFACE_CONTROL, HUBPREQ, id),\ -+ SRI(DCSURF_SURFACE_FLIP_INTERRUPT, HUBPREQ, id),\ - SRI(HUBPRET_CONTROL, HUBPRET, id),\ - SRI(DCN_EXPANSION_MODE, HUBPREQ, id),\ - SRI(DCHUBP_REQ_SIZE_CONFIG, HUBP, id),\ -@@ -183,6 +184,7 @@ - uint32_t DCSURF_SURFACE_EARLIEST_INUSE_C; \ - uint32_t DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C; \ - uint32_t DCSURF_SURFACE_CONTROL; \ -+ uint32_t DCSURF_SURFACE_FLIP_INTERRUPT; \ - uint32_t HUBPRET_CONTROL; \ - uint32_t DCN_EXPANSION_MODE; \ - uint32_t DCHUBP_REQ_SIZE_CONFIG; \ -@@ -332,6 +334,7 @@ - HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_META_SURFACE_TMZ_C, mask_sh),\ - HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_SURFACE_DCC_EN, mask_sh),\ - HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_SURFACE_DCC_IND_64B_BLK, mask_sh),\ -+ HUBP_SF(HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT, SURFACE_FLIP_INT_MASK, mask_sh),\ - HUBP_SF(HUBPRET0_HUBPRET_CONTROL, DET_BUF_PLANE1_BASE_ADDRESS, mask_sh),\ - HUBP_SF(HUBPRET0_HUBPRET_CONTROL, CROSSBAR_SRC_CB_B, mask_sh),\ - HUBP_SF(HUBPRET0_HUBPRET_CONTROL, CROSSBAR_SRC_CR_R, mask_sh),\ -@@ -531,6 +534,7 @@ - type PRIMARY_SURFACE_DCC_IND_64B_BLK;\ - type SECONDARY_SURFACE_DCC_EN;\ - type SECONDARY_SURFACE_DCC_IND_64B_BLK;\ -+ type SURFACE_FLIP_INT_MASK;\ - type DET_BUF_PLANE1_BASE_ADDRESS;\ - type CROSSBAR_SRC_CB_B;\ - type CROSSBAR_SRC_CR_R;\ -@@ -777,4 +781,6 @@ void hubp1_read_state_common(struct hubp *hubp); - bool hubp1_in_blank(struct hubp *hubp); - void hubp1_soft_reset(struct hubp *hubp, bool reset); - -+void hubp1_set_flip_int(struct hubp *hubp); -+ - #endif -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -index 017b67b830e66..3e86e042de0de 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -@@ -2195,6 +2195,13 @@ static void dcn10_enable_plane( - if (dc->debug.sanity_checks) { - hws->funcs.verify_allow_pstate_change_high(dc); - } -+ -+ if (!pipe_ctx->top_pipe -+ && pipe_ctx->plane_state -+ && pipe_ctx->plane_state->flip_int_enabled -+ && pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int) -+ pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int(pipe_ctx->plane_res.hubp); -+ - } - - void dcn10_program_gamut_remap(struct pipe_ctx *pipe_ctx) -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c -index 0df0da2e6a4d0..bec7059f6d5d1 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c -@@ -1597,6 +1597,7 @@ static struct hubp_funcs dcn20_hubp_funcs = { - .validate_dml_output = hubp2_validate_dml_output, - .hubp_in_blank = hubp1_in_blank, - .hubp_soft_reset = hubp1_soft_reset, -+ .hubp_set_flip_int = hubp1_set_flip_int, - }; - - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -index 09b9732424e15..077ba9cf69c5a 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -@@ -1146,6 +1146,12 @@ void dcn20_enable_plane( - pipe_ctx->plane_res.hubp->funcs->hubp_set_vm_system_aperture_settings(pipe_ctx->plane_res.hubp, &apt); - } - -+ if (!pipe_ctx->top_pipe -+ && pipe_ctx->plane_state -+ && pipe_ctx->plane_state->flip_int_enabled -+ && pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int) -+ pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int(pipe_ctx->plane_res.hubp); -+ - // if (dc->debug.sanity_checks) { - // dcn10_verify_allow_pstate_change_high(dc); - // } -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c -index 15c2ff264ff60..1a347484cf2a1 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c -@@ -341,8 +341,7 @@ void enc2_hw_init(struct link_encoder *enc) - } else { - AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, 0x103d1110); - -- AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c4d); -- -+ AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c7a); - } - - //AUX_DPHY_TX_REF_CONTROL'AUX_TX_REF_DIV HW default is 0x32; -diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c -index f9045852728fe..b0c9180b808f6 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c -@@ -838,6 +838,7 @@ static struct hubp_funcs dcn21_hubp_funcs = { - .hubp_set_flip_control_surface_gsl = hubp2_set_flip_control_surface_gsl, - .hubp_init = hubp21_init, - .validate_dml_output = hubp21_validate_dml_output, -+ .hubp_set_flip_int = hubp1_set_flip_int, - }; - - bool hubp21_construct( -diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -index 4caeab6a09b3d..4a3df13c9e49a 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -@@ -296,7 +296,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = { - .num_banks = 8, - .num_chans = 4, - .vmm_page_size_bytes = 4096, -- .dram_clock_change_latency_us = 11.72, -+ .dram_clock_change_latency_us = 23.84, - .return_bus_width_bytes = 64, - .dispclk_dppclk_vco_speed_mhz = 3600, - .xfc_bus_transport_time_us = 4, -diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c -index 88ffa9ff1ed15..f246125232482 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c -@@ -511,6 +511,7 @@ static struct hubp_funcs dcn30_hubp_funcs = { - .hubp_init = hubp3_init, - .hubp_in_blank = hubp1_in_blank, - .hubp_soft_reset = hubp1_soft_reset, -+ .hubp_set_flip_int = hubp1_set_flip_int, - }; - - bool hubp3_construct( -diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c -index 5e126fdf6ec10..7ec8936346b27 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c -@@ -2601,6 +2601,19 @@ static const struct resource_funcs dcn30_res_pool_funcs = { - .patch_unknown_plane_state = dcn20_patch_unknown_plane_state, - }; - -+#define CTX ctx -+ -+#define REG(reg_name) \ -+ (DCN_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name) -+ -+static uint32_t read_pipe_fuses(struct dc_context *ctx) -+{ -+ uint32_t value = REG_READ(CC_DC_PIPE_DIS); -+ /* Support for max 6 pipes */ -+ value = value & 0x3f; -+ return value; -+} -+ - static bool dcn30_resource_construct( - uint8_t num_virtual_links, - struct dc *dc, -@@ -2610,6 +2623,15 @@ static bool dcn30_resource_construct( - struct dc_context *ctx = dc->ctx; - struct irq_service_init_data init_data; - struct ddc_service_init_data ddc_init_data; -+ uint32_t pipe_fuses = read_pipe_fuses(ctx); -+ uint32_t num_pipes = 0; -+ -+ if (!(pipe_fuses == 0 || pipe_fuses == 0x3e)) { -+ BREAK_TO_DEBUGGER(); -+ dm_error("DC: Unexpected fuse recipe for navi2x !\n"); -+ /* fault to single pipe */ -+ pipe_fuses = 0x3e; -+ } - - DC_FP_START(); - -@@ -2739,6 +2761,15 @@ static bool dcn30_resource_construct( - /* PP Lib and SMU interfaces */ - init_soc_bounding_box(dc, pool); - -+ num_pipes = dcn3_0_ip.max_num_dpp; -+ -+ for (i = 0; i < dcn3_0_ip.max_num_dpp; i++) -+ if (pipe_fuses & 1 << i) -+ num_pipes--; -+ -+ dcn3_0_ip.max_num_dpp = num_pipes; -+ dcn3_0_ip.max_num_otg = num_pipes; -+ - dml_init_instance(&dc->dml, &dcn3_0_soc, &dcn3_0_ip, DML_PROJECT_DCN30); - - /* IRQ */ -diff --git a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c -index 35f5bf08ae96e..23bc208cbfa42 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c -@@ -1722,12 +1722,106 @@ static void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *b - dml_init_instance(&dc->dml, &dcn3_01_soc, &dcn3_01_ip, DML_PROJECT_DCN30); - } - -+static void calculate_wm_set_for_vlevel( -+ int vlevel, -+ struct wm_range_table_entry *table_entry, -+ struct dcn_watermarks *wm_set, -+ struct display_mode_lib *dml, -+ display_e2e_pipe_params_st *pipes, -+ int pipe_cnt) -+{ -+ double dram_clock_change_latency_cached = dml->soc.dram_clock_change_latency_us; -+ -+ ASSERT(vlevel < dml->soc.num_states); -+ /* only pipe 0 is read for voltage and dcf/soc clocks */ -+ pipes[0].clks_cfg.voltage = vlevel; -+ pipes[0].clks_cfg.dcfclk_mhz = dml->soc.clock_limits[vlevel].dcfclk_mhz; -+ pipes[0].clks_cfg.socclk_mhz = dml->soc.clock_limits[vlevel].socclk_mhz; -+ -+ dml->soc.dram_clock_change_latency_us = table_entry->pstate_latency_us; -+ dml->soc.sr_exit_time_us = table_entry->sr_exit_time_us; -+ dml->soc.sr_enter_plus_exit_time_us = table_entry->sr_enter_plus_exit_time_us; -+ -+ wm_set->urgent_ns = get_wm_urgent(dml, pipes, pipe_cnt) * 1000; -+ wm_set->cstate_pstate.cstate_enter_plus_exit_ns = get_wm_stutter_enter_exit(dml, pipes, pipe_cnt) * 1000; -+ wm_set->cstate_pstate.cstate_exit_ns = get_wm_stutter_exit(dml, pipes, pipe_cnt) * 1000; -+ wm_set->cstate_pstate.pstate_change_ns = get_wm_dram_clock_change(dml, pipes, pipe_cnt) * 1000; -+ wm_set->pte_meta_urgent_ns = get_wm_memory_trip(dml, pipes, pipe_cnt) * 1000; -+ wm_set->frac_urg_bw_nom = get_fraction_of_urgent_bandwidth(dml, pipes, pipe_cnt) * 1000; -+ wm_set->frac_urg_bw_flip = get_fraction_of_urgent_bandwidth_imm_flip(dml, pipes, pipe_cnt) * 1000; -+ wm_set->urgent_latency_ns = get_urgent_latency(dml, pipes, pipe_cnt) * 1000; -+ dml->soc.dram_clock_change_latency_us = dram_clock_change_latency_cached; -+ -+} -+ -+static void dcn301_calculate_wm_and_dlg( -+ struct dc *dc, struct dc_state *context, -+ display_e2e_pipe_params_st *pipes, -+ int pipe_cnt, -+ int vlevel_req) -+{ -+ int i, pipe_idx; -+ int vlevel, vlevel_max; -+ struct wm_range_table_entry *table_entry; -+ struct clk_bw_params *bw_params = dc->clk_mgr->bw_params; -+ -+ ASSERT(bw_params); -+ -+ vlevel_max = bw_params->clk_table.num_entries - 1; -+ -+ /* WM Set D */ -+ table_entry = &bw_params->wm_table.entries[WM_D]; -+ if (table_entry->wm_type == WM_TYPE_RETRAINING) -+ vlevel = 0; -+ else -+ vlevel = vlevel_max; -+ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.d, -+ &context->bw_ctx.dml, pipes, pipe_cnt); -+ /* WM Set C */ -+ table_entry = &bw_params->wm_table.entries[WM_C]; -+ vlevel = min(max(vlevel_req, 2), vlevel_max); -+ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.c, -+ &context->bw_ctx.dml, pipes, pipe_cnt); -+ /* WM Set B */ -+ table_entry = &bw_params->wm_table.entries[WM_B]; -+ vlevel = min(max(vlevel_req, 1), vlevel_max); -+ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.b, -+ &context->bw_ctx.dml, pipes, pipe_cnt); -+ -+ /* WM Set A */ -+ table_entry = &bw_params->wm_table.entries[WM_A]; -+ vlevel = min(vlevel_req, vlevel_max); -+ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.a, -+ &context->bw_ctx.dml, pipes, pipe_cnt); -+ -+ for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) { -+ if (!context->res_ctx.pipe_ctx[i].stream) -+ continue; -+ -+ pipes[pipe_idx].clks_cfg.dispclk_mhz = get_dispclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt); -+ pipes[pipe_idx].clks_cfg.dppclk_mhz = get_dppclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx); -+ -+ if (dc->config.forced_clocks) { -+ pipes[pipe_idx].clks_cfg.dispclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dispclk_mhz; -+ pipes[pipe_idx].clks_cfg.dppclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dppclk_mhz; -+ } -+ if (dc->debug.min_disp_clk_khz > pipes[pipe_idx].clks_cfg.dispclk_mhz * 1000) -+ pipes[pipe_idx].clks_cfg.dispclk_mhz = dc->debug.min_disp_clk_khz / 1000.0; -+ if (dc->debug.min_dpp_clk_khz > pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000) -+ pipes[pipe_idx].clks_cfg.dppclk_mhz = dc->debug.min_dpp_clk_khz / 1000.0; -+ -+ pipe_idx++; -+ } -+ -+ dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel); -+} -+ - static struct resource_funcs dcn301_res_pool_funcs = { - .destroy = dcn301_destroy_resource_pool, - .link_enc_create = dcn301_link_encoder_create, - .panel_cntl_create = dcn301_panel_cntl_create, - .validate_bandwidth = dcn30_validate_bandwidth, -- .calculate_wm_and_dlg = dcn30_calculate_wm_and_dlg, -+ .calculate_wm_and_dlg = dcn301_calculate_wm_and_dlg, - .populate_dml_pipes = dcn30_populate_dml_pipes_from_context, - .acquire_idle_pipe_for_layer = dcn20_acquire_idle_pipe_for_layer, - .add_stream_to_ctx = dcn30_add_stream_to_ctx, -diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h b/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h -index 22f3f643ed1b8..346dcd87dc106 100644 ---- a/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h -+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h -@@ -191,6 +191,8 @@ struct hubp_funcs { - bool (*hubp_in_blank)(struct hubp *hubp); - void (*hubp_soft_reset)(struct hubp *hubp, bool reset); - -+ void (*hubp_set_flip_int)(struct hubp *hubp); -+ - }; - - #endif -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -index d7794370cb5a1..72cb67d50e4ae 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -@@ -587,6 +587,48 @@ static int smu7_force_switch_to_arbf0(struct pp_hwmgr *hwmgr) - tmp, MC_CG_ARB_FREQ_F0); - } - -+static uint16_t smu7_override_pcie_speed(struct pp_hwmgr *hwmgr) -+{ -+ struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); -+ uint16_t pcie_gen = 0; -+ -+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4 && -+ adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN4) -+ pcie_gen = 3; -+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3 && -+ adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3) -+ pcie_gen = 2; -+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 && -+ adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2) -+ pcie_gen = 1; -+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1 && -+ adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1) -+ pcie_gen = 0; -+ -+ return pcie_gen; -+} -+ -+static uint16_t smu7_override_pcie_width(struct pp_hwmgr *hwmgr) -+{ -+ struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); -+ uint16_t pcie_width = 0; -+ -+ if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X16) -+ pcie_width = 16; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X12) -+ pcie_width = 12; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X8) -+ pcie_width = 8; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X4) -+ pcie_width = 4; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X2) -+ pcie_width = 2; -+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X1) -+ pcie_width = 1; -+ -+ return pcie_width; -+} -+ - static int smu7_setup_default_pcie_table(struct pp_hwmgr *hwmgr) - { - struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend); -@@ -683,6 +725,11 @@ static int smu7_setup_default_pcie_table(struct pp_hwmgr *hwmgr) - PP_Min_PCIEGen), - get_pcie_lane_support(data->pcie_lane_cap, - PP_Max_PCIELane)); -+ -+ if (data->pcie_dpm_key_disabled) -+ phm_setup_pcie_table_entry(&data->dpm_table.pcie_speed_table, -+ data->dpm_table.pcie_speed_table.count, -+ smu7_override_pcie_speed(hwmgr), smu7_override_pcie_width(hwmgr)); - } - return 0; - } -@@ -1248,6 +1295,13 @@ static int smu7_start_dpm(struct pp_hwmgr *hwmgr) - NULL)), - "Failed to enable pcie DPM during DPM Start Function!", - return -EINVAL); -+ } else { -+ PP_ASSERT_WITH_CODE( -+ (0 == smum_send_msg_to_smc(hwmgr, -+ PPSMC_MSG_PCIeDPM_Disable, -+ NULL)), -+ "Failed to disble pcie DPM during DPM Start Function!", -+ return -EINVAL); - } - - if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps, -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c -index c7a01ea9ed647..892f08f2ba429 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c -@@ -54,6 +54,9 @@ - #include "smuio/smuio_9_0_offset.h" - #include "smuio/smuio_9_0_sh_mask.h" - -+#define smnPCIE_LC_SPEED_CNTL 0x11140290 -+#define smnPCIE_LC_LINK_WIDTH_CNTL 0x11140288 -+ - #define HBM_MEMORY_CHANNEL_WIDTH 128 - - static const uint32_t channel_number[] = {1, 2, 0, 4, 0, 8, 0, 16, 2}; -@@ -443,8 +446,7 @@ static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr) - if (PP_CAP(PHM_PlatformCaps_VCEDPM)) - data->smu_features[GNLD_DPM_VCE].supported = true; - -- if (!data->registry_data.pcie_dpm_key_disabled) -- data->smu_features[GNLD_DPM_LINK].supported = true; -+ data->smu_features[GNLD_DPM_LINK].supported = true; - - if (!data->registry_data.dcefclk_dpm_key_disabled) - data->smu_features[GNLD_DPM_DCEFCLK].supported = true; -@@ -1545,6 +1547,13 @@ static int vega10_override_pcie_parameters(struct pp_hwmgr *hwmgr) - pp_table->PcieLaneCount[i] = pcie_width; - } - -+ if (data->registry_data.pcie_dpm_key_disabled) { -+ for (i = 0; i < NUM_LINK_LEVELS; i++) { -+ pp_table->PcieGenSpeed[i] = pcie_gen; -+ pp_table->PcieLaneCount[i] = pcie_width; -+ } -+ } -+ - return 0; - } - -@@ -2967,6 +2976,14 @@ static int vega10_start_dpm(struct pp_hwmgr *hwmgr, uint32_t bitmap) - } - } - -+ if (data->registry_data.pcie_dpm_key_disabled) { -+ PP_ASSERT_WITH_CODE(!vega10_enable_smc_features(hwmgr, -+ false, data->smu_features[GNLD_DPM_LINK].smu_feature_bitmap), -+ "Attempt to Disable Link DPM feature Failed!", return -EINVAL); -+ data->smu_features[GNLD_DPM_LINK].enabled = false; -+ data->smu_features[GNLD_DPM_LINK].supported = false; -+ } -+ - return 0; - } - -@@ -4585,6 +4602,24 @@ static int vega10_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe - return 0; - } - -+static int vega10_get_current_pcie_link_width_level(struct pp_hwmgr *hwmgr) -+{ -+ struct amdgpu_device *adev = hwmgr->adev; -+ -+ return (RREG32_PCIE(smnPCIE_LC_LINK_WIDTH_CNTL) & -+ PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK) -+ >> PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT; -+} -+ -+static int vega10_get_current_pcie_link_speed_level(struct pp_hwmgr *hwmgr) -+{ -+ struct amdgpu_device *adev = hwmgr->adev; -+ -+ return (RREG32_PCIE(smnPCIE_LC_SPEED_CNTL) & -+ PSWUSP0_PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK) -+ >> PSWUSP0_PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT; -+} -+ - static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, - enum pp_clock_type type, char *buf) - { -@@ -4593,8 +4628,9 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, - struct vega10_single_dpm_table *mclk_table = &(data->dpm_table.mem_table); - struct vega10_single_dpm_table *soc_table = &(data->dpm_table.soc_table); - struct vega10_single_dpm_table *dcef_table = &(data->dpm_table.dcef_table); -- struct vega10_pcie_table *pcie_table = &(data->dpm_table.pcie_table); - struct vega10_odn_clock_voltage_dependency_table *podn_vdd_dep = NULL; -+ uint32_t gen_speed, lane_width, current_gen_speed, current_lane_width; -+ PPTable_t *pptable = &(data->smc_state_table.pp_table); - - int i, now, size = 0, count = 0; - -@@ -4651,15 +4687,31 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, - "*" : ""); - break; - case PP_PCIE: -- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentLinkIndex, &now); -- -- for (i = 0; i < pcie_table->count; i++) -- size += sprintf(buf + size, "%d: %s %s\n", i, -- (pcie_table->pcie_gen[i] == 0) ? "2.5GT/s, x1" : -- (pcie_table->pcie_gen[i] == 1) ? "5.0GT/s, x16" : -- (pcie_table->pcie_gen[i] == 2) ? "8.0GT/s, x16" : "", -- (i == now) ? "*" : ""); -+ current_gen_speed = -+ vega10_get_current_pcie_link_speed_level(hwmgr); -+ current_lane_width = -+ vega10_get_current_pcie_link_width_level(hwmgr); -+ for (i = 0; i < NUM_LINK_LEVELS; i++) { -+ gen_speed = pptable->PcieGenSpeed[i]; -+ lane_width = pptable->PcieLaneCount[i]; -+ -+ size += sprintf(buf + size, "%d: %s %s %s\n", i, -+ (gen_speed == 0) ? "2.5GT/s," : -+ (gen_speed == 1) ? "5.0GT/s," : -+ (gen_speed == 2) ? "8.0GT/s," : -+ (gen_speed == 3) ? "16.0GT/s," : "", -+ (lane_width == 1) ? "x1" : -+ (lane_width == 2) ? "x2" : -+ (lane_width == 3) ? "x4" : -+ (lane_width == 4) ? "x8" : -+ (lane_width == 5) ? "x12" : -+ (lane_width == 6) ? "x16" : "", -+ (current_gen_speed == gen_speed) && -+ (current_lane_width == lane_width) ? -+ "*" : ""); -+ } - break; -+ - case OD_SCLK: - if (hwmgr->od_enabled) { - size = sprintf(buf, "%s:\n", "OD_SCLK"); -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c -index 62076035029ac..e68651fb7ca4c 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c -@@ -133,6 +133,7 @@ static void vega12_set_default_registry_data(struct pp_hwmgr *hwmgr) - data->registry_data.auto_wattman_debug = 0; - data->registry_data.auto_wattman_sample_period = 100; - data->registry_data.auto_wattman_threshold = 50; -+ data->registry_data.pcie_dpm_key_disabled = !(hwmgr->feature_mask & PP_PCIE_DPM_MASK); - } - - static int vega12_set_features_platform_caps(struct pp_hwmgr *hwmgr) -@@ -539,6 +540,29 @@ static int vega12_override_pcie_parameters(struct pp_hwmgr *hwmgr) - pp_table->PcieLaneCount[i] = pcie_width_arg; - } - -+ /* override to the highest if it's disabled from ppfeaturmask */ -+ if (data->registry_data.pcie_dpm_key_disabled) { -+ for (i = 0; i < NUM_LINK_LEVELS; i++) { -+ smu_pcie_arg = (i << 16) | (pcie_gen << 8) | pcie_width; -+ ret = smum_send_msg_to_smc_with_parameter(hwmgr, -+ PPSMC_MSG_OverridePcieParameters, smu_pcie_arg, -+ NULL); -+ PP_ASSERT_WITH_CODE(!ret, -+ "[OverridePcieParameters] Attempt to override pcie params failed!", -+ return ret); -+ -+ pp_table->PcieGenSpeed[i] = pcie_gen; -+ pp_table->PcieLaneCount[i] = pcie_width; -+ } -+ ret = vega12_enable_smc_features(hwmgr, -+ false, -+ data->smu_features[GNLD_DPM_LINK].smu_feature_bitmap); -+ PP_ASSERT_WITH_CODE(!ret, -+ "Attempt to Disable DPM LINK Failed!", -+ return ret); -+ data->smu_features[GNLD_DPM_LINK].enabled = false; -+ data->smu_features[GNLD_DPM_LINK].supported = false; -+ } - return 0; - } - -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c -index 251979c059c8b..60cde0c528257 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c -@@ -171,6 +171,7 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr) - data->registry_data.gfxoff_controlled_by_driver = 1; - data->gfxoff_allowed = false; - data->counter_gfxoff = 0; -+ data->registry_data.pcie_dpm_key_disabled = !(hwmgr->feature_mask & PP_PCIE_DPM_MASK); - } - - static int vega20_set_features_platform_caps(struct pp_hwmgr *hwmgr) -@@ -885,6 +886,30 @@ static int vega20_override_pcie_parameters(struct pp_hwmgr *hwmgr) - pp_table->PcieLaneCount[i] = pcie_width_arg; - } - -+ /* override to the highest if it's disabled from ppfeaturmask */ -+ if (data->registry_data.pcie_dpm_key_disabled) { -+ for (i = 0; i < NUM_LINK_LEVELS; i++) { -+ smu_pcie_arg = (i << 16) | (pcie_gen << 8) | pcie_width; -+ ret = smum_send_msg_to_smc_with_parameter(hwmgr, -+ PPSMC_MSG_OverridePcieParameters, smu_pcie_arg, -+ NULL); -+ PP_ASSERT_WITH_CODE(!ret, -+ "[OverridePcieParameters] Attempt to override pcie params failed!", -+ return ret); -+ -+ pp_table->PcieGenSpeed[i] = pcie_gen; -+ pp_table->PcieLaneCount[i] = pcie_width; -+ } -+ ret = vega20_enable_smc_features(hwmgr, -+ false, -+ data->smu_features[GNLD_DPM_LINK].smu_feature_bitmap); -+ PP_ASSERT_WITH_CODE(!ret, -+ "Attempt to Disable DPM LINK Failed!", -+ return ret); -+ data->smu_features[GNLD_DPM_LINK].enabled = false; -+ data->smu_features[GNLD_DPM_LINK].supported = false; -+ } -+ - return 0; - } - -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c -index 6d38c5c17f23e..a9e696d05b33d 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c -@@ -689,7 +689,7 @@ static int etnaviv_gem_userptr_get_pages(struct etnaviv_gem_object *etnaviv_obj) - struct page **pages = pvec + pinned; - - ret = pin_user_pages_fast(ptr, num_pages, -- !userptr->ro ? FOLL_WRITE : 0, pages); -+ FOLL_WRITE | FOLL_FORCE, pages); - if (ret < 0) { - unpin_user_pages(pvec, pinned); - kvfree(pvec); -diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.c b/drivers/gpu/drm/i915/display/intel_vdsc.c -index e2716a67b2816..d017d341c5934 100644 ---- a/drivers/gpu/drm/i915/display/intel_vdsc.c -+++ b/drivers/gpu/drm/i915/display/intel_vdsc.c -@@ -1016,20 +1016,14 @@ static i915_reg_t dss_ctl1_reg(const struct intel_crtc_state *crtc_state) - { - enum pipe pipe = to_intel_crtc(crtc_state->uapi.crtc)->pipe; - -- if (crtc_state->cpu_transcoder == TRANSCODER_EDP) -- return DSS_CTL1; -- -- return ICL_PIPE_DSS_CTL1(pipe); -+ return is_pipe_dsc(crtc_state) ? ICL_PIPE_DSS_CTL1(pipe) : DSS_CTL1; - } - - static i915_reg_t dss_ctl2_reg(const struct intel_crtc_state *crtc_state) - { - enum pipe pipe = to_intel_crtc(crtc_state->uapi.crtc)->pipe; - -- if (crtc_state->cpu_transcoder == TRANSCODER_EDP) -- return DSS_CTL2; -- -- return ICL_PIPE_DSS_CTL2(pipe); -+ return is_pipe_dsc(crtc_state) ? ICL_PIPE_DSS_CTL2(pipe) : DSS_CTL2; - } - - void intel_dsc_enable(struct intel_encoder *encoder, -diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c -index 7fb36b12fe7a2..6614f67364862 100644 ---- a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c -+++ b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c -@@ -316,7 +316,18 @@ void i915_vma_revoke_fence(struct i915_vma *vma) - WRITE_ONCE(fence->vma, NULL); - vma->fence = NULL; - -- with_intel_runtime_pm_if_in_use(fence_to_uncore(fence)->rpm, wakeref) -+ /* -+ * Skip the write to HW if and only if the device is currently -+ * suspended. -+ * -+ * If the driver does not currently hold a wakeref (if_in_use == 0), -+ * the device may currently be runtime suspended, or it may be woken -+ * up before the suspend takes place. If the device is not suspended -+ * (powered down) and we skip clearing the fence register, the HW is -+ * left in an undefined state where we may end up with multiple -+ * registers overlapping. -+ */ -+ with_intel_runtime_pm_if_active(fence_to_uncore(fence)->rpm, wakeref) - fence_write(fence); - } - -diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c -index 153ca9e65382e..8b725efb2254c 100644 ---- a/drivers/gpu/drm/i915/intel_runtime_pm.c -+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c -@@ -412,12 +412,20 @@ intel_wakeref_t intel_runtime_pm_get(struct intel_runtime_pm *rpm) - } - - /** -- * intel_runtime_pm_get_if_in_use - grab a runtime pm reference if device in use -+ * __intel_runtime_pm_get_if_active - grab a runtime pm reference if device is active - * @rpm: the intel_runtime_pm structure -+ * @ignore_usecount: get a ref even if dev->power.usage_count is 0 - * - * This function grabs a device-level runtime pm reference if the device is -- * already in use and ensures that it is powered up. It is illegal to try -- * and access the HW should intel_runtime_pm_get_if_in_use() report failure. -+ * already active and ensures that it is powered up. It is illegal to try -+ * and access the HW should intel_runtime_pm_get_if_active() report failure. -+ * -+ * If @ignore_usecount=true, a reference will be acquired even if there is no -+ * user requiring the device to be powered up (dev->power.usage_count == 0). -+ * If the function returns false in this case then it's guaranteed that the -+ * device's runtime suspend hook has been called already or that it will be -+ * called (and hence it's also guaranteed that the device's runtime resume -+ * hook will be called eventually). - * - * Any runtime pm reference obtained by this function must have a symmetric - * call to intel_runtime_pm_put() to release the reference again. -@@ -425,7 +433,8 @@ intel_wakeref_t intel_runtime_pm_get(struct intel_runtime_pm *rpm) - * Returns: the wakeref cookie to pass to intel_runtime_pm_put(), evaluates - * as True if the wakeref was acquired, or False otherwise. - */ --intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm) -+static intel_wakeref_t __intel_runtime_pm_get_if_active(struct intel_runtime_pm *rpm, -+ bool ignore_usecount) - { - if (IS_ENABLED(CONFIG_PM)) { - /* -@@ -434,7 +443,7 @@ intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm) - * function, since the power state is undefined. This applies - * atm to the late/early system suspend/resume handlers. - */ -- if (pm_runtime_get_if_in_use(rpm->kdev) <= 0) -+ if (pm_runtime_get_if_active(rpm->kdev, ignore_usecount) <= 0) - return 0; - } - -@@ -443,6 +452,16 @@ intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm) - return track_intel_runtime_pm_wakeref(rpm); - } - -+intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm) -+{ -+ return __intel_runtime_pm_get_if_active(rpm, false); -+} -+ -+intel_wakeref_t intel_runtime_pm_get_if_active(struct intel_runtime_pm *rpm) -+{ -+ return __intel_runtime_pm_get_if_active(rpm, true); -+} -+ - /** - * intel_runtime_pm_get_noresume - grab a runtime pm reference - * @rpm: the intel_runtime_pm structure -diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.h b/drivers/gpu/drm/i915/intel_runtime_pm.h -index ae64ff14c6425..1e4ddd11c12bb 100644 ---- a/drivers/gpu/drm/i915/intel_runtime_pm.h -+++ b/drivers/gpu/drm/i915/intel_runtime_pm.h -@@ -177,6 +177,7 @@ void intel_runtime_pm_driver_release(struct intel_runtime_pm *rpm); - - intel_wakeref_t intel_runtime_pm_get(struct intel_runtime_pm *rpm); - intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm); -+intel_wakeref_t intel_runtime_pm_get_if_active(struct intel_runtime_pm *rpm); - intel_wakeref_t intel_runtime_pm_get_noresume(struct intel_runtime_pm *rpm); - intel_wakeref_t intel_runtime_pm_get_raw(struct intel_runtime_pm *rpm); - -@@ -188,6 +189,10 @@ intel_wakeref_t intel_runtime_pm_get_raw(struct intel_runtime_pm *rpm); - for ((wf) = intel_runtime_pm_get_if_in_use(rpm); (wf); \ - intel_runtime_pm_put((rpm), (wf)), (wf) = 0) - -+#define with_intel_runtime_pm_if_active(rpm, wf) \ -+ for ((wf) = intel_runtime_pm_get_if_active(rpm); (wf); \ -+ intel_runtime_pm_put((rpm), (wf)), (wf) = 0) -+ - void intel_runtime_pm_put_unchecked(struct intel_runtime_pm *rpm); - #if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM) - void intel_runtime_pm_put(struct intel_runtime_pm *rpm, intel_wakeref_t wref); -diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c -index a45fe95aff494..3dc65877fa10d 100644 ---- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c -+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c -@@ -163,7 +163,7 @@ struct msm_dsi_pll *msm_dsi_pll_init(struct platform_device *pdev, - break; - case MSM_DSI_PHY_7NM: - case MSM_DSI_PHY_7NM_V4_1: -- pll = msm_dsi_pll_7nm_init(pdev, id); -+ pll = msm_dsi_pll_7nm_init(pdev, type, id); - break; - default: - pll = ERR_PTR(-ENXIO); -diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h -index 3405982a092c4..bbecb1de5678e 100644 ---- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h -+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h -@@ -117,10 +117,12 @@ msm_dsi_pll_10nm_init(struct platform_device *pdev, int id) - } - #endif - #ifdef CONFIG_DRM_MSM_DSI_7NM_PHY --struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id); -+struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, -+ enum msm_dsi_phy_type type, int id); - #else - static inline struct msm_dsi_pll * --msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) -+msm_dsi_pll_7nm_init(struct platform_device *pdev, -+ enum msm_dsi_phy_type type, int id) - { - return ERR_PTR(-ENODEV); - } -diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c -index 93bf142e4a4e6..c1f6708367ae9 100644 ---- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c -+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c -@@ -852,7 +852,8 @@ err_base_clk_hw: - return ret; - } - --struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) -+struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, -+ enum msm_dsi_phy_type type, int id) - { - struct dsi_pll_7nm *pll_7nm; - struct msm_dsi_pll *pll; -@@ -885,7 +886,7 @@ struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) - pll = &pll_7nm->base; - pll->min_rate = 1000000000UL; - pll->max_rate = 3500000000UL; -- if (pll->type == MSM_DSI_PHY_7NM_V4_1) { -+ if (type == MSM_DSI_PHY_7NM_V4_1) { - pll->min_rate = 600000000UL; - pll->max_rate = (unsigned long)5000000000ULL; - /* workaround for max rate overflowing on 32-bit builds: */ -diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c -index 94525ac76d4e6..a5c6b8c233366 100644 ---- a/drivers/gpu/drm/msm/msm_drv.c -+++ b/drivers/gpu/drm/msm/msm_drv.c -@@ -1072,6 +1072,10 @@ static int __maybe_unused msm_pm_resume(struct device *dev) - static int __maybe_unused msm_pm_prepare(struct device *dev) - { - struct drm_device *ddev = dev_get_drvdata(dev); -+ struct msm_drm_private *priv = ddev ? ddev->dev_private : NULL; -+ -+ if (!priv || !priv->kms) -+ return 0; - - return drm_mode_config_helper_suspend(ddev); - } -@@ -1079,6 +1083,10 @@ static int __maybe_unused msm_pm_prepare(struct device *dev) - static void __maybe_unused msm_pm_complete(struct device *dev) - { - struct drm_device *ddev = dev_get_drvdata(dev); -+ struct msm_drm_private *priv = ddev ? ddev->dev_private : NULL; -+ -+ if (!priv || !priv->kms) -+ return; - - drm_mode_config_helper_resume(ddev); - } -@@ -1311,6 +1319,10 @@ static int msm_pdev_remove(struct platform_device *pdev) - static void msm_pdev_shutdown(struct platform_device *pdev) - { - struct drm_device *drm = platform_get_drvdata(pdev); -+ struct msm_drm_private *priv = drm ? drm->dev_private : NULL; -+ -+ if (!priv || !priv->kms) -+ return; - - drm_atomic_helper_shutdown(drm); - } -diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c -index 5f4f09a601d4c..f601e91241ac8 100644 ---- a/drivers/gpu/drm/nouveau/dispnv50/disp.c -+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c -@@ -2663,9 +2663,20 @@ nv50_display_create(struct drm_device *dev) - else - nouveau_display(dev)->format_modifiers = disp50xx_modifiers; - -- if (disp->disp->object.oclass >= GK104_DISP) { -+ /* FIXME: 256x256 cursors are supported on Kepler, however unlike Maxwell and later -+ * generations Kepler requires that we use small pages (4K) for cursor scanout surfaces. The -+ * proper fix for this is to teach nouveau to migrate fbs being used for the cursor plane to -+ * small page allocations in prepare_fb(). When this is implemented, we should also force -+ * large pages (128K) for ovly fbs in order to fix Kepler ovlys. -+ * But until then, just limit cursors to 128x128 - which is small enough to avoid ever using -+ * large pages. -+ */ -+ if (disp->disp->object.oclass >= GM107_DISP) { - dev->mode_config.cursor_width = 256; - dev->mode_config.cursor_height = 256; -+ } else if (disp->disp->object.oclass >= GK104_DISP) { -+ dev->mode_config.cursor_width = 128; -+ dev->mode_config.cursor_height = 128; - } else { - dev->mode_config.cursor_width = 64; - dev->mode_config.cursor_height = 64; -diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c -index 8769e7aa097f4..81903749d2415 100644 ---- a/drivers/infiniband/hw/cxgb4/cm.c -+++ b/drivers/infiniband/hw/cxgb4/cm.c -@@ -3610,13 +3610,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) - ep->com.local_addr.ss_family == AF_INET) { - err = cxgb4_remove_server_filter( - ep->com.dev->rdev.lldi.ports[0], ep->stid, -- ep->com.dev->rdev.lldi.rxq_ids[0], 0); -+ ep->com.dev->rdev.lldi.rxq_ids[0], false); - } else { - struct sockaddr_in6 *sin6; - c4iw_init_wr_wait(ep->com.wr_waitp); - err = cxgb4_remove_server( - ep->com.dev->rdev.lldi.ports[0], ep->stid, -- ep->com.dev->rdev.lldi.rxq_ids[0], 0); -+ ep->com.dev->rdev.lldi.rxq_ids[0], true); - if (err) - goto done; - err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp, -diff --git a/drivers/irqchip/irq-ingenic-tcu.c b/drivers/irqchip/irq-ingenic-tcu.c -index 7a7222d4c19c0..b938d1d04d96e 100644 ---- a/drivers/irqchip/irq-ingenic-tcu.c -+++ b/drivers/irqchip/irq-ingenic-tcu.c -@@ -179,5 +179,6 @@ err_free_tcu: - } - IRQCHIP_DECLARE(jz4740_tcu_irq, "ingenic,jz4740-tcu", ingenic_tcu_irq_init); - IRQCHIP_DECLARE(jz4725b_tcu_irq, "ingenic,jz4725b-tcu", ingenic_tcu_irq_init); -+IRQCHIP_DECLARE(jz4760_tcu_irq, "ingenic,jz4760-tcu", ingenic_tcu_irq_init); - IRQCHIP_DECLARE(jz4770_tcu_irq, "ingenic,jz4770-tcu", ingenic_tcu_irq_init); - IRQCHIP_DECLARE(x1000_tcu_irq, "ingenic,x1000-tcu", ingenic_tcu_irq_init); -diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c -index b61a8901ef722..ea36bb00be80b 100644 ---- a/drivers/irqchip/irq-ingenic.c -+++ b/drivers/irqchip/irq-ingenic.c -@@ -155,6 +155,7 @@ static int __init intc_2chip_of_init(struct device_node *node, - { - return ingenic_intc_of_init(node, 2); - } -+IRQCHIP_DECLARE(jz4760_intc, "ingenic,jz4760-intc", intc_2chip_of_init); - IRQCHIP_DECLARE(jz4770_intc, "ingenic,jz4770-intc", intc_2chip_of_init); - IRQCHIP_DECLARE(jz4775_intc, "ingenic,jz4775-intc", intc_2chip_of_init); - IRQCHIP_DECLARE(jz4780_intc, "ingenic,jz4780-intc", intc_2chip_of_init); -diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c -index 5e306bba43751..1ca65b434f1fa 100644 ---- a/drivers/md/dm-ioctl.c -+++ b/drivers/md/dm-ioctl.c -@@ -529,7 +529,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_ - * Grab our output buffer. - */ - nl = orig_nl = get_result_buffer(param, param_size, &len); -- if (len < needed) { -+ if (len < needed || len < sizeof(nl->dev)) { - param->flags |= DM_BUFFER_FULL_FLAG; - goto out; - } -diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c -index 77086db8b9200..7291fd3106ffb 100644 ---- a/drivers/md/dm-table.c -+++ b/drivers/md/dm-table.c -@@ -1380,6 +1380,13 @@ static int device_not_zoned_model(struct dm_target *ti, struct dm_dev *dev, - return !q || blk_queue_zoned_model(q) != *zoned_model; - } - -+/* -+ * Check the device zoned model based on the target feature flag. If the target -+ * has the DM_TARGET_ZONED_HM feature flag set, host-managed zoned devices are -+ * also accepted but all devices must have the same zoned model. If the target -+ * has the DM_TARGET_MIXED_ZONED_MODEL feature set, the devices can have any -+ * zoned model with all zoned devices having the same zone size. -+ */ - static bool dm_table_supports_zoned_model(struct dm_table *t, - enum blk_zoned_model zoned_model) - { -@@ -1389,13 +1396,15 @@ static bool dm_table_supports_zoned_model(struct dm_table *t, - for (i = 0; i < dm_table_get_num_targets(t); i++) { - ti = dm_table_get_target(t, i); - -- if (zoned_model == BLK_ZONED_HM && -- !dm_target_supports_zoned_hm(ti->type)) -- return false; -- -- if (!ti->type->iterate_devices || -- ti->type->iterate_devices(ti, device_not_zoned_model, &zoned_model)) -- return false; -+ if (dm_target_supports_zoned_hm(ti->type)) { -+ if (!ti->type->iterate_devices || -+ ti->type->iterate_devices(ti, device_not_zoned_model, -+ &zoned_model)) -+ return false; -+ } else if (!dm_target_supports_mixed_zoned_model(ti->type)) { -+ if (zoned_model == BLK_ZONED_HM) -+ return false; -+ } - } - - return true; -@@ -1407,9 +1416,17 @@ static int device_not_matches_zone_sectors(struct dm_target *ti, struct dm_dev * - struct request_queue *q = bdev_get_queue(dev->bdev); - unsigned int *zone_sectors = data; - -+ if (!blk_queue_is_zoned(q)) -+ return 0; -+ - return !q || blk_queue_zone_sectors(q) != *zone_sectors; - } - -+/* -+ * Check consistency of zoned model and zone sectors across all targets. For -+ * zone sectors, if the destination device is a zoned block device, it shall -+ * have the specified zone_sectors. -+ */ - static int validate_hardware_zoned_model(struct dm_table *table, - enum blk_zoned_model zoned_model, - unsigned int zone_sectors) -@@ -1428,7 +1445,7 @@ static int validate_hardware_zoned_model(struct dm_table *table, - return -EINVAL; - - if (dm_table_any_dev_attr(table, device_not_matches_zone_sectors, &zone_sectors)) { -- DMERR("%s: zone sectors is not consistent across all devices", -+ DMERR("%s: zone sectors is not consistent across all zoned devices", - dm_device_name(table->md)); - return -EINVAL; - } -diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c -index 6b8e5bdd8526d..808a98ef624c3 100644 ---- a/drivers/md/dm-verity-target.c -+++ b/drivers/md/dm-verity-target.c -@@ -34,7 +34,7 @@ - #define DM_VERITY_OPT_IGN_ZEROES "ignore_zero_blocks" - #define DM_VERITY_OPT_AT_MOST_ONCE "check_at_most_once" - --#define DM_VERITY_OPTS_MAX (2 + DM_VERITY_OPTS_FEC + \ -+#define DM_VERITY_OPTS_MAX (3 + DM_VERITY_OPTS_FEC + \ - DM_VERITY_ROOT_HASH_VERIFICATION_OPTS) - - static unsigned dm_verity_prefetch_cluster = DM_VERITY_DEFAULT_PREFETCH_SIZE; -diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c -index 697f9de37355e..7e88df64d197b 100644 ---- a/drivers/md/dm-zoned-target.c -+++ b/drivers/md/dm-zoned-target.c -@@ -1143,7 +1143,7 @@ static int dmz_message(struct dm_target *ti, unsigned int argc, char **argv, - static struct target_type dmz_type = { - .name = "zoned", - .version = {2, 0, 0}, -- .features = DM_TARGET_SINGLETON | DM_TARGET_ZONED_HM, -+ .features = DM_TARGET_SINGLETON | DM_TARGET_MIXED_ZONED_MODEL, - .module = THIS_MODULE, - .ctr = dmz_ctr, - .dtr = dmz_dtr, -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 6f03adc128495..09542eabf725a 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -2016,7 +2016,10 @@ static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t, - if (size != dm_get_size(md)) - memset(&md->geometry, 0, sizeof(md->geometry)); - -- set_capacity_and_notify(md->disk, size); -+ if (!get_capacity(md->disk)) -+ set_capacity(md->disk, size); -+ else -+ set_capacity_and_notify(md->disk, size); - - dm_table_event_callback(t, event_callback, md); - -diff --git a/drivers/mfd/intel_quark_i2c_gpio.c b/drivers/mfd/intel_quark_i2c_gpio.c -index fe8ca945f3672..b67cb0a3ab053 100644 ---- a/drivers/mfd/intel_quark_i2c_gpio.c -+++ b/drivers/mfd/intel_quark_i2c_gpio.c -@@ -72,7 +72,8 @@ static const struct dmi_system_id dmi_platform_info[] = { - {} - }; - --static const struct resource intel_quark_i2c_res[] = { -+/* This is used as a place holder and will be modified at run-time */ -+static struct resource intel_quark_i2c_res[] = { - [INTEL_QUARK_IORES_MEM] = { - .flags = IORESOURCE_MEM, - }, -@@ -85,7 +86,8 @@ static struct mfd_cell_acpi_match intel_quark_acpi_match_i2c = { - .adr = MFD_ACPI_MATCH_I2C, - }; - --static const struct resource intel_quark_gpio_res[] = { -+/* This is used as a place holder and will be modified at run-time */ -+static struct resource intel_quark_gpio_res[] = { - [INTEL_QUARK_IORES_MEM] = { - .flags = IORESOURCE_MEM, - }, -diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c -index 69d04eca767f5..82c0306a9210a 100644 ---- a/drivers/misc/habanalabs/common/device.c -+++ b/drivers/misc/habanalabs/common/device.c -@@ -93,12 +93,19 @@ void hl_hpriv_put(struct hl_fpriv *hpriv) - static int hl_device_release(struct inode *inode, struct file *filp) - { - struct hl_fpriv *hpriv = filp->private_data; -+ struct hl_device *hdev = hpriv->hdev; -+ -+ filp->private_data = NULL; -+ -+ if (!hdev) { -+ pr_crit("Closing FD after device was removed. Memory leak will occur and it is advised to reboot.\n"); -+ put_pid(hpriv->taskpid); -+ return 0; -+ } - - hl_cb_mgr_fini(hpriv->hdev, &hpriv->cb_mgr); - hl_ctx_mgr_fini(hpriv->hdev, &hpriv->ctx_mgr); - -- filp->private_data = NULL; -- - hl_hpriv_put(hpriv); - - return 0; -@@ -107,15 +114,20 @@ static int hl_device_release(struct inode *inode, struct file *filp) - static int hl_device_release_ctrl(struct inode *inode, struct file *filp) - { - struct hl_fpriv *hpriv = filp->private_data; -- struct hl_device *hdev; -+ struct hl_device *hdev = hpriv->hdev; - - filp->private_data = NULL; - -- hdev = hpriv->hdev; -+ if (!hdev) { -+ pr_err("Closing FD after device was removed\n"); -+ goto out; -+ } - - mutex_lock(&hdev->fpriv_list_lock); - list_del(&hpriv->dev_node); - mutex_unlock(&hdev->fpriv_list_lock); -+out: -+ put_pid(hpriv->taskpid); - - kfree(hpriv); - -@@ -134,8 +146,14 @@ static int hl_device_release_ctrl(struct inode *inode, struct file *filp) - static int hl_mmap(struct file *filp, struct vm_area_struct *vma) - { - struct hl_fpriv *hpriv = filp->private_data; -+ struct hl_device *hdev = hpriv->hdev; - unsigned long vm_pgoff; - -+ if (!hdev) { -+ pr_err_ratelimited("Trying to mmap after device was removed! Please close FD\n"); -+ return -ENODEV; -+ } -+ - vm_pgoff = vma->vm_pgoff; - vma->vm_pgoff = HL_MMAP_OFFSET_VALUE_GET(vm_pgoff); - -@@ -882,6 +900,16 @@ wait_for_processes: - return -EBUSY; - } - -+static void device_disable_open_processes(struct hl_device *hdev) -+{ -+ struct hl_fpriv *hpriv; -+ -+ mutex_lock(&hdev->fpriv_list_lock); -+ list_for_each_entry(hpriv, &hdev->fpriv_list, dev_node) -+ hpriv->hdev = NULL; -+ mutex_unlock(&hdev->fpriv_list_lock); -+} -+ - /* - * hl_device_reset - reset the device - * -@@ -1536,8 +1564,10 @@ void hl_device_fini(struct hl_device *hdev) - HL_PENDING_RESET_LONG_SEC); - - rc = device_kill_open_processes(hdev, HL_PENDING_RESET_LONG_SEC); -- if (rc) -+ if (rc) { - dev_crit(hdev->dev, "Failed to kill all open processes\n"); -+ device_disable_open_processes(hdev); -+ } - - hl_cb_pool_fini(hdev); - -diff --git a/drivers/misc/habanalabs/common/habanalabs_ioctl.c b/drivers/misc/habanalabs/common/habanalabs_ioctl.c -index d25892d61ec9d..0805e1173d54e 100644 ---- a/drivers/misc/habanalabs/common/habanalabs_ioctl.c -+++ b/drivers/misc/habanalabs/common/habanalabs_ioctl.c -@@ -5,6 +5,8 @@ - * All Rights Reserved. - */ - -+#define pr_fmt(fmt) "habanalabs: " fmt -+ - #include - #include "habanalabs.h" - -@@ -667,6 +669,11 @@ long hl_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) - const struct hl_ioctl_desc *ioctl = NULL; - unsigned int nr = _IOC_NR(cmd); - -+ if (!hdev) { -+ pr_err_ratelimited("Sending ioctl after device was removed! Please close FD\n"); -+ return -ENODEV; -+ } -+ - if ((nr >= HL_COMMAND_START) && (nr < HL_COMMAND_END)) { - ioctl = &hl_ioctls[nr]; - } else { -@@ -685,6 +692,11 @@ long hl_ioctl_control(struct file *filep, unsigned int cmd, unsigned long arg) - const struct hl_ioctl_desc *ioctl = NULL; - unsigned int nr = _IOC_NR(cmd); - -+ if (!hdev) { -+ pr_err_ratelimited("Sending ioctl after device was removed! Please close FD\n"); -+ return -ENODEV; -+ } -+ - if (nr == _IOC_NR(HL_IOCTL_INFO)) { - ioctl = &hl_ioctls_control[nr]; - } else { -diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c -index 63f48b016ecd8..716d1a5bf17b7 100644 ---- a/drivers/net/can/c_can/c_can.c -+++ b/drivers/net/can/c_can/c_can.c -@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { - .brp_inc = 1, - }; - --static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv) --{ -- if (priv->device) -- pm_runtime_enable(priv->device); --} -- --static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv) --{ -- if (priv->device) -- pm_runtime_disable(priv->device); --} -- - static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv) - { - if (priv->device) -@@ -1335,7 +1323,6 @@ static const struct net_device_ops c_can_netdev_ops = { - - int register_c_can_dev(struct net_device *dev) - { -- struct c_can_priv *priv = netdev_priv(dev); - int err; - - /* Deactivate pins to prevent DRA7 DCAN IP from being -@@ -1345,28 +1332,19 @@ int register_c_can_dev(struct net_device *dev) - */ - pinctrl_pm_select_sleep_state(dev->dev.parent); - -- c_can_pm_runtime_enable(priv); -- - dev->flags |= IFF_ECHO; /* we support local echo */ - dev->netdev_ops = &c_can_netdev_ops; - - err = register_candev(dev); -- if (err) -- c_can_pm_runtime_disable(priv); -- else -+ if (!err) - devm_can_led_init(dev); -- - return err; - } - EXPORT_SYMBOL_GPL(register_c_can_dev); - - void unregister_c_can_dev(struct net_device *dev) - { -- struct c_can_priv *priv = netdev_priv(dev); -- - unregister_candev(dev); -- -- c_can_pm_runtime_disable(priv); - } - EXPORT_SYMBOL_GPL(unregister_c_can_dev); - -diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c -index 406b4847e5dc3..7efb60b508762 100644 ---- a/drivers/net/can/c_can/c_can_pci.c -+++ b/drivers/net/can/c_can/c_can_pci.c -@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) - { - struct net_device *dev = pci_get_drvdata(pdev); - struct c_can_priv *priv = netdev_priv(dev); -+ void __iomem *addr = priv->base; - - unregister_c_can_dev(dev); - - free_c_can_dev(dev); - -- pci_iounmap(pdev, priv->base); -+ pci_iounmap(pdev, addr); - pci_disable_msi(pdev); - pci_clear_master(pdev); - pci_release_regions(pdev); -diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c -index 05f425ceb53a2..47b251b1607ce 100644 ---- a/drivers/net/can/c_can/c_can_platform.c -+++ b/drivers/net/can/c_can/c_can_platform.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -386,6 +387,7 @@ static int c_can_plat_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, dev); - SET_NETDEV_DEV(dev, &pdev->dev); - -+ pm_runtime_enable(priv->device); - ret = register_c_can_dev(dev); - if (ret) { - dev_err(&pdev->dev, "registering %s failed (err=%d)\n", -@@ -398,6 +400,7 @@ static int c_can_plat_probe(struct platform_device *pdev) - return 0; - - exit_free_device: -+ pm_runtime_disable(priv->device); - free_c_can_dev(dev); - exit: - dev_err(&pdev->dev, "probe failed\n"); -@@ -408,9 +411,10 @@ exit: - static int c_can_plat_remove(struct platform_device *pdev) - { - struct net_device *dev = platform_get_drvdata(pdev); -+ struct c_can_priv *priv = netdev_priv(dev); - - unregister_c_can_dev(dev); -- -+ pm_runtime_disable(priv->device); - free_c_can_dev(dev); - - return 0; -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index c73e2a65c9044..2a4f12c3c28b0 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -1255,6 +1255,7 @@ static void can_dellink(struct net_device *dev, struct list_head *head) - - static struct rtnl_link_ops can_link_ops __read_mostly = { - .kind = "can", -+ .netns_refund = true, - .maxtype = IFLA_CAN_MAX, - .policy = can_policy, - .setup = can_setup, -diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c -index 2893297555eba..a9502fbc6dd67 100644 ---- a/drivers/net/can/flexcan.c -+++ b/drivers/net/can/flexcan.c -@@ -697,9 +697,15 @@ static int flexcan_chip_disable(struct flexcan_priv *priv) - static int flexcan_chip_freeze(struct flexcan_priv *priv) - { - struct flexcan_regs __iomem *regs = priv->regs; -- unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate; -+ unsigned int timeout; -+ u32 bitrate = priv->can.bittiming.bitrate; - u32 reg; - -+ if (bitrate) -+ timeout = 1000 * 1000 * 10 / bitrate; -+ else -+ timeout = FLEXCAN_TIMEOUT_US / 10; -+ - reg = priv->read(®s->mcr); - reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT; - priv->write(reg, ®s->mcr); -diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c -index 969cedb9b0b60..0d77c60f775e5 100644 ---- a/drivers/net/can/kvaser_pciefd.c -+++ b/drivers/net/can/kvaser_pciefd.c -@@ -57,6 +57,7 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices"); - #define KVASER_PCIEFD_KCAN_STAT_REG 0x418 - #define KVASER_PCIEFD_KCAN_MODE_REG 0x41c - #define KVASER_PCIEFD_KCAN_BTRN_REG 0x420 -+#define KVASER_PCIEFD_KCAN_BUS_LOAD_REG 0x424 - #define KVASER_PCIEFD_KCAN_BTRD_REG 0x428 - #define KVASER_PCIEFD_KCAN_PWM_REG 0x430 - /* Loopback control register */ -@@ -949,6 +950,9 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie) - timer_setup(&can->bec_poll_timer, kvaser_pciefd_bec_poll_timer, - 0); - -+ /* Disable Bus load reporting */ -+ iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_BUS_LOAD_REG); -+ - tx_npackets = ioread32(can->reg_base + - KVASER_PCIEFD_KCAN_TX_NPACKETS_REG); - if (((tx_npackets >> KVASER_PCIEFD_KCAN_TX_NPACKETS_MAX_SHIFT) & -diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c -index da551fd0f5026..44b3f4b3aea5c 100644 ---- a/drivers/net/can/m_can/m_can.c -+++ b/drivers/net/can/m_can/m_can.c -@@ -501,9 +501,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) - } - - while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) { -- if (rxfs & RXFS_RFL) -- netdev_warn(dev, "Rx FIFO 0 Message Lost\n"); -- - m_can_read_fifo(dev, rxfs); - - quota--; -@@ -876,7 +873,7 @@ static int m_can_rx_peripheral(struct net_device *dev) - { - struct m_can_classdev *cdev = netdev_priv(dev); - -- m_can_rx_handler(dev, 1); -+ m_can_rx_handler(dev, M_CAN_NAPI_WEIGHT); - - m_can_enable_all_interrupts(cdev); - -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index f504b6858ed29..52100d4fe5a25 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -1070,13 +1070,6 @@ static int b53_setup(struct dsa_switch *ds) - b53_disable_port(ds, port); - } - -- /* Let DSA handle the case were multiple bridges span the same switch -- * device and different VLAN awareness settings are requested, which -- * would be breaking filtering semantics for any of the other bridge -- * devices. (not hardware supported) -- */ -- ds->vlan_filtering_is_global = true; -- - return b53_setup_devlink_resources(ds); - } - -@@ -2627,6 +2620,13 @@ struct b53_device *b53_switch_alloc(struct device *base, - ds->configure_vlan_while_not_filtering = true; - ds->untag_bridge_pvid = true; - dev->vlan_enabled = ds->configure_vlan_while_not_filtering; -+ /* Let DSA handle the case were multiple bridges span the same switch -+ * device and different VLAN awareness settings are requested, which -+ * would be breaking filtering semantics for any of the other bridge -+ * devices. (not hardware supported) -+ */ -+ ds->vlan_filtering_is_global = true; -+ - mutex_init(&dev->reg_mutex); - mutex_init(&dev->stats_mutex); - -diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c -index edb0a1027b38f..510324916e916 100644 ---- a/drivers/net/dsa/bcm_sf2.c -+++ b/drivers/net/dsa/bcm_sf2.c -@@ -584,8 +584,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port) - * in bits 15:8 and the patch level in bits 7:0 which is exactly what - * the REG_PHY_REVISION register layout is. - */ -- -- return priv->hw_params.gphy_rev; -+ if (priv->int_phy_mask & BIT(port)) -+ return priv->hw_params.gphy_rev; -+ else -+ return 0; - } - - static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port, -diff --git a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c -index 1b7e8c91b5417..423d6d78d15c7 100644 ---- a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c -+++ b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c -@@ -727,7 +727,7 @@ static int chcr_ktls_cpl_set_tcb_rpl(struct adapter *adap, unsigned char *input) - kvfree(tx_info); - return 0; - } -- tx_info->open_state = false; -+ tx_info->open_state = CH_KTLS_OPEN_SUCCESS; - spin_unlock(&tx_info->lock); - - complete(&tx_info->completion); -diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c -index a95e95ce94386..252adfa5d837b 100644 ---- a/drivers/net/ethernet/davicom/dm9000.c -+++ b/drivers/net/ethernet/davicom/dm9000.c -@@ -1507,7 +1507,7 @@ dm9000_probe(struct platform_device *pdev) - goto out; - } - -- db->irq_wake = platform_get_irq(pdev, 1); -+ db->irq_wake = platform_get_irq_optional(pdev, 1); - if (db->irq_wake >= 0) { - dev_dbg(db->dev, "wakeup irq %d\n", db->irq_wake); - -diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c -index 88bfe21079386..04421aec2dfd6 100644 ---- a/drivers/net/ethernet/faraday/ftgmac100.c -+++ b/drivers/net/ethernet/faraday/ftgmac100.c -@@ -1337,6 +1337,7 @@ static int ftgmac100_poll(struct napi_struct *napi, int budget) - */ - if (unlikely(priv->need_mac_restart)) { - ftgmac100_start_hw(priv); -+ priv->need_mac_restart = false; - - /* Re-enable "bad" interrupts */ - iowrite32(FTGMAC100_INT_BAD, -diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h -index de0d20b0f489c..00938f7960a43 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h -+++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h -@@ -234,6 +234,8 @@ enum enetc_bdr_type {TX, RX}; - #define ENETC_PM0_MAXFRM 0x8014 - #define ENETC_SET_TX_MTU(val) ((val) << 16) - #define ENETC_SET_MAXFRM(val) ((val) & 0xffff) -+#define ENETC_PM0_RX_FIFO 0x801c -+#define ENETC_PM0_RX_FIFO_VAL 1 - - #define ENETC_PM_IMDIO_BASE 0x8030 - -diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c -index ca02f033bea21..224fc37a6757c 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c -@@ -490,6 +490,12 @@ static void enetc_configure_port_mac(struct enetc_hw *hw) - - enetc_port_wr(hw, ENETC_PM1_CMD_CFG, ENETC_PM0_CMD_PHY_TX_EN | - ENETC_PM0_CMD_TXP | ENETC_PM0_PROMISC); -+ -+ /* On LS1028A, the MAC RX FIFO defaults to 2, which is too high -+ * and may lead to RX lock-up under traffic. Set it to 1 instead, -+ * as recommended by the hardware team. -+ */ -+ enetc_port_wr(hw, ENETC_PM0_RX_FIFO, ENETC_PM0_RX_FIFO_VAL); - } - - static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode) -diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c -index 2e344aada4c60..1753807cbf97e 100644 ---- a/drivers/net/ethernet/freescale/fec_ptp.c -+++ b/drivers/net/ethernet/freescale/fec_ptp.c -@@ -377,9 +377,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) - u64 ns; - unsigned long flags; - -+ mutex_lock(&adapter->ptp_clk_mutex); -+ /* Check the ptp clock */ -+ if (!adapter->ptp_clk_on) { -+ mutex_unlock(&adapter->ptp_clk_mutex); -+ return -EINVAL; -+ } - spin_lock_irqsave(&adapter->tmreg_lock, flags); - ns = timecounter_read(&adapter->tc); - spin_unlock_irqrestore(&adapter->tmreg_lock, flags); -+ mutex_unlock(&adapter->ptp_clk_mutex); - - *ts = ns_to_timespec64(ns); - -diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c -index d391a45cebb66..4fab2ee5bbf58 100644 ---- a/drivers/net/ethernet/freescale/gianfar.c -+++ b/drivers/net/ethernet/freescale/gianfar.c -@@ -2391,6 +2391,10 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, - if (lstatus & BD_LFLAG(RXBD_LAST)) - size -= skb->len; - -+ WARN(size < 0, "gianfar: rx fragment size underflow"); -+ if (size < 0) -+ return false; -+ - skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, - rxb->page_offset + RXBUF_ALIGNMENT, - size, GFAR_RXB_TRUESIZE); -@@ -2553,6 +2557,17 @@ static int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, - if (lstatus & BD_LFLAG(RXBD_EMPTY)) - break; - -+ /* lost RXBD_LAST descriptor due to overrun */ -+ if (skb && -+ (lstatus & BD_LFLAG(RXBD_FIRST))) { -+ /* discard faulty buffer */ -+ dev_kfree_skb(skb); -+ skb = NULL; -+ rx_queue->stats.rx_dropped++; -+ -+ /* can continue normally */ -+ } -+ - /* order rx buffer descriptor reads */ - rmb(); - -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -index 858cb293152a9..8bce5f1510bec 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -@@ -1663,8 +1663,10 @@ static int hns_nic_clear_all_rx_fetch(struct net_device *ndev) - for (j = 0; j < fetch_num; j++) { - /* alloc one skb and init */ - skb = hns_assemble_skb(ndev); -- if (!skb) -+ if (!skb) { -+ ret = -ENOMEM; - goto out; -+ } - rd = &tx_ring_data(priv, skb->queue_mapping); - hns_nic_net_xmit_hw(ndev, skb, rd); - -diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c -index 88faf05e23baf..0b1e890dd583b 100644 ---- a/drivers/net/ethernet/intel/e1000e/82571.c -+++ b/drivers/net/ethernet/intel/e1000e/82571.c -@@ -899,6 +899,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) - } else { - data &= ~IGP02E1000_PM_D0_LPLU; - ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data); -+ if (ret_val) -+ return ret_val; - /* LPLU and SmartSpeed are mutually exclusive. LPLU is used - * during Dx states where the power conservation is most - * important. During driver activity we should enable -diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c -index e9b82c209c2df..a0948002ddf85 100644 ---- a/drivers/net/ethernet/intel/e1000e/netdev.c -+++ b/drivers/net/ethernet/intel/e1000e/netdev.c -@@ -5974,15 +5974,19 @@ static void e1000_reset_task(struct work_struct *work) - struct e1000_adapter *adapter; - adapter = container_of(work, struct e1000_adapter, reset_task); - -+ rtnl_lock(); - /* don't run the task if already down */ -- if (test_bit(__E1000_DOWN, &adapter->state)) -+ if (test_bit(__E1000_DOWN, &adapter->state)) { -+ rtnl_unlock(); - return; -+ } - - if (!(adapter->flags & FLAG_RESTART_NOW)) { - e1000e_dump(adapter); - e_err("Reset adapter unexpectedly\n"); - } - e1000e_reinit_locked(adapter); -+ rtnl_unlock(); - } - - /** -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index 0a867d64d4675..dc5b3c06d1e01 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -1776,7 +1776,8 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter) - goto err_alloc; - } - -- if (iavf_process_config(adapter)) -+ err = iavf_process_config(adapter); -+ if (err) - goto err_alloc; - adapter->current_op = VIRTCHNL_OP_UNKNOWN; - -diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c -index 3124a3bf519a8..952e41a1e001e 100644 ---- a/drivers/net/ethernet/intel/ice/ice_base.c -+++ b/drivers/net/ethernet/intel/ice/ice_base.c -@@ -418,6 +418,8 @@ int ice_setup_rx_ctx(struct ice_ring *ring) - writel(0, ring->tail); - - if (ring->xsk_pool) { -+ bool ok; -+ - if (!xsk_buff_can_alloc(ring->xsk_pool, num_bufs)) { - dev_warn(dev, "XSK buffer pool does not provide enough addresses to fill %d buffers on Rx ring %d\n", - num_bufs, ring->q_index); -@@ -426,8 +428,8 @@ int ice_setup_rx_ctx(struct ice_ring *ring) - return 0; - } - -- err = ice_alloc_rx_bufs_zc(ring, num_bufs); -- if (err) -+ ok = ice_alloc_rx_bufs_zc(ring, num_bufs); -+ if (!ok) - dev_info(dev, "Failed to allocate some buffers on XSK buffer pool enabled Rx ring %d (pf_q %d)\n", - ring->q_index, pf_q); - return 0; -diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c -index 1782146db6448..69ee1a8e87abb 100644 ---- a/drivers/net/ethernet/intel/ice/ice_xsk.c -+++ b/drivers/net/ethernet/intel/ice/ice_xsk.c -@@ -408,18 +408,18 @@ xsk_pool_if_up: - * This function allocates a number of Rx buffers from the fill ring - * or the internal recycle mechanism and places them on the Rx ring. - * -- * Returns false if all allocations were successful, true if any fail. -+ * Returns true if all allocations were successful, false if any fail. - */ - bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count) - { - union ice_32b_rx_flex_desc *rx_desc; - u16 ntu = rx_ring->next_to_use; - struct ice_rx_buf *rx_buf; -- bool ret = false; -+ bool ok = true; - dma_addr_t dma; - - if (!count) -- return false; -+ return true; - - rx_desc = ICE_RX_DESC(rx_ring, ntu); - rx_buf = &rx_ring->rx_buf[ntu]; -@@ -427,7 +427,7 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count) - do { - rx_buf->xdp = xsk_buff_alloc(rx_ring->xsk_pool); - if (!rx_buf->xdp) { -- ret = true; -+ ok = false; - break; - } - -@@ -452,7 +452,7 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count) - ice_release_rx_desc(rx_ring, ntu); - } - -- return ret; -+ return ok; - } - - /** -diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h -index aaa954aae5744..7bda8c5edea5d 100644 ---- a/drivers/net/ethernet/intel/igb/igb.h -+++ b/drivers/net/ethernet/intel/igb/igb.h -@@ -748,8 +748,8 @@ void igb_ptp_suspend(struct igb_adapter *adapter); - void igb_ptp_rx_hang(struct igb_adapter *adapter); - void igb_ptp_tx_hang(struct igb_adapter *adapter); - void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb); --void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, -- struct sk_buff *skb); -+int igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, -+ struct sk_buff *skb); - int igb_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr); - int igb_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr); - void igb_set_flag_queue_pairs(struct igb_adapter *, const u32); -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index 03f78fdb0dcdd..0e8c17f7af28a 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -8232,7 +8232,8 @@ static inline bool igb_page_is_reserved(struct page *page) - return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page); - } - --static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer) -+static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer, -+ int rx_buf_pgcnt) - { - unsigned int pagecnt_bias = rx_buffer->pagecnt_bias; - struct page *page = rx_buffer->page; -@@ -8243,7 +8244,7 @@ static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer) - - #if (PAGE_SIZE < 8192) - /* if we are only owner of page we can reuse it */ -- if (unlikely((page_ref_count(page) - pagecnt_bias) > 1)) -+ if (unlikely((rx_buf_pgcnt - pagecnt_bias) > 1)) - return false; - #else - #define IGB_LAST_OFFSET \ -@@ -8319,9 +8320,10 @@ static struct sk_buff *igb_construct_skb(struct igb_ring *rx_ring, - return NULL; - - if (unlikely(igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP))) { -- igb_ptp_rx_pktstamp(rx_ring->q_vector, xdp->data, skb); -- xdp->data += IGB_TS_HDR_LEN; -- size -= IGB_TS_HDR_LEN; -+ if (!igb_ptp_rx_pktstamp(rx_ring->q_vector, xdp->data, skb)) { -+ xdp->data += IGB_TS_HDR_LEN; -+ size -= IGB_TS_HDR_LEN; -+ } - } - - /* Determine available headroom for copy */ -@@ -8382,8 +8384,8 @@ static struct sk_buff *igb_build_skb(struct igb_ring *rx_ring, - - /* pull timestamp out of packet data */ - if (igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP)) { -- igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb); -- __skb_pull(skb, IGB_TS_HDR_LEN); -+ if (!igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb)) -+ __skb_pull(skb, IGB_TS_HDR_LEN); - } - - /* update buffer offset */ -@@ -8632,11 +8634,17 @@ static unsigned int igb_rx_offset(struct igb_ring *rx_ring) - } - - static struct igb_rx_buffer *igb_get_rx_buffer(struct igb_ring *rx_ring, -- const unsigned int size) -+ const unsigned int size, int *rx_buf_pgcnt) - { - struct igb_rx_buffer *rx_buffer; - - rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean]; -+ *rx_buf_pgcnt = -+#if (PAGE_SIZE < 8192) -+ page_count(rx_buffer->page); -+#else -+ 0; -+#endif - prefetchw(rx_buffer->page); - - /* we are reusing so sync this buffer for CPU use */ -@@ -8652,9 +8660,9 @@ static struct igb_rx_buffer *igb_get_rx_buffer(struct igb_ring *rx_ring, - } - - static void igb_put_rx_buffer(struct igb_ring *rx_ring, -- struct igb_rx_buffer *rx_buffer) -+ struct igb_rx_buffer *rx_buffer, int rx_buf_pgcnt) - { -- if (igb_can_reuse_rx_page(rx_buffer)) { -+ if (igb_can_reuse_rx_page(rx_buffer, rx_buf_pgcnt)) { - /* hand second half of page back to the ring */ - igb_reuse_rx_page(rx_ring, rx_buffer); - } else { -@@ -8681,6 +8689,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget) - u16 cleaned_count = igb_desc_unused(rx_ring); - unsigned int xdp_xmit = 0; - struct xdp_buff xdp; -+ int rx_buf_pgcnt; - - xdp.rxq = &rx_ring->xdp_rxq; - -@@ -8711,7 +8720,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget) - */ - dma_rmb(); - -- rx_buffer = igb_get_rx_buffer(rx_ring, size); -+ rx_buffer = igb_get_rx_buffer(rx_ring, size, &rx_buf_pgcnt); - - /* retrieve a buffer from the ring */ - if (!skb) { -@@ -8754,7 +8763,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget) - break; - } - -- igb_put_rx_buffer(rx_ring, rx_buffer); -+ igb_put_rx_buffer(rx_ring, rx_buffer, rx_buf_pgcnt); - cleaned_count++; - - /* fetch next buffer in frame if non-eop */ -diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c -index 7cc5428c3b3d2..86a576201f5ff 100644 ---- a/drivers/net/ethernet/intel/igb/igb_ptp.c -+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c -@@ -856,6 +856,9 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter) - dev_kfree_skb_any(skb); - } - -+#define IGB_RET_PTP_DISABLED 1 -+#define IGB_RET_PTP_INVALID 2 -+ - /** - * igb_ptp_rx_pktstamp - retrieve Rx per packet timestamp - * @q_vector: Pointer to interrupt specific structure -@@ -864,19 +867,29 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter) - * - * This function is meant to retrieve a timestamp from the first buffer of an - * incoming frame. The value is stored in little endian format starting on -- * byte 8. -+ * byte 8 -+ * -+ * Returns: 0 if success, nonzero if failure - **/ --void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, -- struct sk_buff *skb) -+int igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, -+ struct sk_buff *skb) - { -- __le64 *regval = (__le64 *)va; - struct igb_adapter *adapter = q_vector->adapter; -+ __le64 *regval = (__le64 *)va; - int adjust = 0; - -+ if (!(adapter->ptp_flags & IGB_PTP_ENABLED)) -+ return IGB_RET_PTP_DISABLED; -+ - /* The timestamp is recorded in little endian format. - * DWORD: 0 1 2 3 - * Field: Reserved Reserved SYSTIML SYSTIMH - */ -+ -+ /* check reserved dwords are zero, be/le doesn't matter for zero */ -+ if (regval[0]) -+ return IGB_RET_PTP_INVALID; -+ - igb_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), - le64_to_cpu(regval[1])); - -@@ -896,6 +909,8 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, - } - skb_hwtstamps(skb)->hwtstamp = - ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust); -+ -+ return 0; - } - - /** -@@ -906,13 +921,15 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, - * This function is meant to retrieve a timestamp from the internal registers - * of the adapter and store it in the skb. - **/ --void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, -- struct sk_buff *skb) -+void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb) - { - struct igb_adapter *adapter = q_vector->adapter; - struct e1000_hw *hw = &adapter->hw; -- u64 regval; - int adjust = 0; -+ u64 regval; -+ -+ if (!(adapter->ptp_flags & IGB_PTP_ENABLED)) -+ return; - - /* If this bit is set, then the RX registers contain the time stamp. No - * other packet will be time stamped until we read these registers, so -diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h -index 35baae900c1fd..6dca67d9c25d8 100644 ---- a/drivers/net/ethernet/intel/igc/igc.h -+++ b/drivers/net/ethernet/intel/igc/igc.h -@@ -545,7 +545,7 @@ void igc_ptp_init(struct igc_adapter *adapter); - void igc_ptp_reset(struct igc_adapter *adapter); - void igc_ptp_suspend(struct igc_adapter *adapter); - void igc_ptp_stop(struct igc_adapter *adapter); --void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, void *va, -+void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, __le32 *va, - struct sk_buff *skb); - int igc_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr); - int igc_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr); -diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c -index ec8cd69d49928..da259cd59adda 100644 ---- a/drivers/net/ethernet/intel/igc/igc_ethtool.c -+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c -@@ -1695,6 +1695,9 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev, - Autoneg); - } - -+ /* Set pause flow control settings */ -+ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); -+ - switch (hw->fc.requested_mode) { - case igc_fc_full: - ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); -@@ -1709,9 +1712,7 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev, - Asym_Pause); - break; - default: -- ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); -- ethtool_link_ksettings_add_link_mode(cmd, advertising, -- Asym_Pause); -+ break; - } - - status = pm_runtime_suspended(&adapter->pdev->dev) ? -diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c -index afd6a62da29dd..93874e930abf4 100644 ---- a/drivers/net/ethernet/intel/igc/igc_main.c -+++ b/drivers/net/ethernet/intel/igc/igc_main.c -@@ -3847,10 +3847,19 @@ static void igc_reset_task(struct work_struct *work) - - adapter = container_of(work, struct igc_adapter, reset_task); - -+ rtnl_lock(); -+ /* If we're already down or resetting, just bail */ -+ if (test_bit(__IGC_DOWN, &adapter->state) || -+ test_bit(__IGC_RESETTING, &adapter->state)) { -+ rtnl_unlock(); -+ return; -+ } -+ - igc_rings_dump(adapter); - igc_regs_dump(adapter); - netdev_err(adapter->netdev, "Reset adapter\n"); - igc_reinit_locked(adapter); -+ rtnl_unlock(); - } - - /** -diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c -index ac0b9c85da7ca..545f4d0e67cf4 100644 ---- a/drivers/net/ethernet/intel/igc/igc_ptp.c -+++ b/drivers/net/ethernet/intel/igc/igc_ptp.c -@@ -152,46 +152,54 @@ static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, - } - - /** -- * igc_ptp_rx_pktstamp - retrieve Rx per packet timestamp -+ * igc_ptp_rx_pktstamp - Retrieve timestamp from Rx packet buffer - * @q_vector: Pointer to interrupt specific structure - * @va: Pointer to address containing Rx buffer - * @skb: Buffer containing timestamp and packet - * -- * This function is meant to retrieve the first timestamp from the -- * first buffer of an incoming frame. The value is stored in little -- * endian format starting on byte 0. There's a second timestamp -- * starting on byte 8. -- **/ --void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, void *va, -+ * This function retrieves the timestamp saved in the beginning of packet -+ * buffer. While two timestamps are available, one in timer0 reference and the -+ * other in timer1 reference, this function considers only the timestamp in -+ * timer0 reference. -+ */ -+void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, __le32 *va, - struct sk_buff *skb) - { - struct igc_adapter *adapter = q_vector->adapter; -- __le64 *regval = (__le64 *)va; -- int adjust = 0; -- -- /* The timestamp is recorded in little endian format. -- * DWORD: | 0 | 1 | 2 | 3 -- * Field: | Timer0 Low | Timer0 High | Timer1 Low | Timer1 High -+ u64 regval; -+ int adjust; -+ -+ /* Timestamps are saved in little endian at the beginning of the packet -+ * buffer following the layout: -+ * -+ * DWORD: | 0 | 1 | 2 | 3 | -+ * Field: | Timer1 SYSTIML | Timer1 SYSTIMH | Timer0 SYSTIML | Timer0 SYSTIMH | -+ * -+ * SYSTIML holds the nanoseconds part while SYSTIMH holds the seconds -+ * part of the timestamp. - */ -- igc_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), -- le64_to_cpu(regval[0])); -- -- /* adjust timestamp for the RX latency based on link speed */ -- if (adapter->hw.mac.type == igc_i225) { -- switch (adapter->link_speed) { -- case SPEED_10: -- adjust = IGC_I225_RX_LATENCY_10; -- break; -- case SPEED_100: -- adjust = IGC_I225_RX_LATENCY_100; -- break; -- case SPEED_1000: -- adjust = IGC_I225_RX_LATENCY_1000; -- break; -- case SPEED_2500: -- adjust = IGC_I225_RX_LATENCY_2500; -- break; -- } -+ regval = le32_to_cpu(va[2]); -+ regval |= (u64)le32_to_cpu(va[3]) << 32; -+ igc_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), regval); -+ -+ /* Adjust timestamp for the RX latency based on link speed */ -+ switch (adapter->link_speed) { -+ case SPEED_10: -+ adjust = IGC_I225_RX_LATENCY_10; -+ break; -+ case SPEED_100: -+ adjust = IGC_I225_RX_LATENCY_100; -+ break; -+ case SPEED_1000: -+ adjust = IGC_I225_RX_LATENCY_1000; -+ break; -+ case SPEED_2500: -+ adjust = IGC_I225_RX_LATENCY_2500; -+ break; -+ default: -+ adjust = 0; -+ netdev_warn_once(adapter->netdev, "Imprecise timestamp\n"); -+ break; - } - skb_hwtstamps(skb)->hwtstamp = - ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust); -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index 393d1c2cd8539..e9c2d28efc815 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -9582,8 +9582,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter *adapter, - ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask); - err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter, - input->sw_idx, queue); -- if (!err) -- ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx); -+ if (err) -+ goto err_out_w_lock; -+ -+ ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx); - spin_unlock(&adapter->fdir_perfect_lock); - - if ((uhtid != 0x800) && (adapter->jump_tables[uhtid])) -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h -index b192692b4fc4b..5c372d2c24a16 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h -@@ -13499,8 +13499,6 @@ static struct npc_mcam_kex npc_mkex_default = { - [NPC_LT_LC_IP] = { - /* SIP+DIP: 8 bytes, KW2[63:0] */ - KEX_LD_CFG(0x07, 0xc, 0x1, 0x0, 0x10), -- /* TOS: 1 byte, KW1[63:56] */ -- KEX_LD_CFG(0x0, 0x1, 0x1, 0x0, 0xf), - }, - /* Layer C: IPv6 */ - [NPC_LT_LC_IP6] = { -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c -index e8fd712860a16..e3fc6d1c0ec31 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c -@@ -2358,8 +2358,10 @@ static void rvu_unregister_interrupts(struct rvu *rvu) - INTR_MASK(rvu->hw->total_pfs) & ~1ULL); - - for (irq = 0; irq < rvu->num_vec; irq++) { -- if (rvu->irq_allocated[irq]) -+ if (rvu->irq_allocated[irq]) { - free_irq(pci_irq_vector(rvu->pdev, irq), rvu); -+ rvu->irq_allocated[irq] = false; -+ } - } - - pci_free_irq_vectors(rvu->pdev); -@@ -2873,8 +2875,8 @@ static void rvu_remove(struct pci_dev *pdev) - struct rvu *rvu = pci_get_drvdata(pdev); - - rvu_dbg_exit(rvu); -- rvu_unregister_interrupts(rvu); - rvu_unregister_dl(rvu); -+ rvu_unregister_interrupts(rvu); - rvu_flr_wq_destroy(rvu); - rvu_cgx_exit(rvu); - rvu_fwdata_exit(rvu); -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c -index bb3fdaf337519..0488651a68d06 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c -@@ -150,12 +150,14 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, - char __user *buffer, - size_t count, loff_t *ppos) - { -- int index, off = 0, flag = 0, go_back = 0, off_prev; -+ int index, off = 0, flag = 0, go_back = 0, len = 0; - struct rvu *rvu = filp->private_data; - int lf, pf, vf, pcifunc; - struct rvu_block block; - int bytes_not_copied; -+ int lf_str_size = 12; - int buf_size = 2048; -+ char *lfs; - char *buf; - - /* don't allow partial reads */ -@@ -165,12 +167,20 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, - buf = kzalloc(buf_size, GFP_KERNEL); - if (!buf) - return -ENOSPC; -- off += scnprintf(&buf[off], buf_size - 1 - off, "\npcifunc\t\t"); -+ -+ lfs = kzalloc(lf_str_size, GFP_KERNEL); -+ if (!lfs) { -+ kfree(buf); -+ return -ENOMEM; -+ } -+ off += scnprintf(&buf[off], buf_size - 1 - off, "%-*s", lf_str_size, -+ "pcifunc"); - for (index = 0; index < BLK_COUNT; index++) -- if (strlen(rvu->hw->block[index].name)) -- off += scnprintf(&buf[off], buf_size - 1 - off, -- "%*s\t", (index - 1) * 2, -- rvu->hw->block[index].name); -+ if (strlen(rvu->hw->block[index].name)) { -+ off += scnprintf(&buf[off], buf_size - 1 - off, -+ "%-*s", lf_str_size, -+ rvu->hw->block[index].name); -+ } - off += scnprintf(&buf[off], buf_size - 1 - off, "\n"); - for (pf = 0; pf < rvu->hw->total_pfs; pf++) { - for (vf = 0; vf <= rvu->hw->total_vfs; vf++) { -@@ -179,14 +189,15 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, - continue; - - if (vf) { -+ sprintf(lfs, "PF%d:VF%d", pf, vf - 1); - go_back = scnprintf(&buf[off], - buf_size - 1 - off, -- "PF%d:VF%d\t\t", pf, -- vf - 1); -+ "%-*s", lf_str_size, lfs); - } else { -+ sprintf(lfs, "PF%d", pf); - go_back = scnprintf(&buf[off], - buf_size - 1 - off, -- "PF%d\t\t", pf); -+ "%-*s", lf_str_size, lfs); - } - - off += go_back; -@@ -194,20 +205,22 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, - block = rvu->hw->block[index]; - if (!strlen(block.name)) - continue; -- off_prev = off; -+ len = 0; -+ lfs[len] = '\0'; - for (lf = 0; lf < block.lf.max; lf++) { - if (block.fn_map[lf] != pcifunc) - continue; - flag = 1; -- off += scnprintf(&buf[off], buf_size - 1 -- - off, "%3d,", lf); -+ len += sprintf(&lfs[len], "%d,", lf); - } -- if (flag && off_prev != off) -- off--; -- else -- go_back++; -+ -+ if (flag) -+ len--; -+ lfs[len] = '\0'; - off += scnprintf(&buf[off], buf_size - 1 - off, -- "\t"); -+ "%-*s", lf_str_size, lfs); -+ if (!strlen(lfs)) -+ go_back += lf_str_size; - } - if (!flag) - off -= go_back; -@@ -219,6 +232,7 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, - } - - bytes_not_copied = copy_to_user(buffer, buf, off); -+ kfree(lfs); - kfree(buf); - - if (bytes_not_copied) -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -index 5cf9b7a907ae0..b81539f3b2ac8 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -@@ -2490,10 +2490,10 @@ int rvu_mbox_handler_npc_mcam_free_counter(struct rvu *rvu, - index = find_next_bit(mcam->bmap, mcam->bmap_entries, entry); - if (index >= mcam->bmap_entries) - break; -+ entry = index + 1; - if (mcam->entry2cntr_map[index] != req->cntr) - continue; - -- entry = index + 1; - npc_unmap_mcam_entry_and_cntr(rvu, mcam, blkaddr, - index, req->cntr); - } -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -index 634d60655a74a..07e841df56781 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -@@ -1625,6 +1625,7 @@ int otx2_stop(struct net_device *netdev) - struct otx2_nic *pf = netdev_priv(netdev); - struct otx2_cq_poll *cq_poll = NULL; - struct otx2_qset *qset = &pf->qset; -+ struct otx2_rss_info *rss; - int qidx, vec, wrk; - - netif_carrier_off(netdev); -@@ -1637,6 +1638,10 @@ int otx2_stop(struct net_device *netdev) - /* First stop packet Rx/Tx */ - otx2_rxtx_enable(pf, false); - -+ /* Clear RSS enable flag */ -+ rss = &pf->hw.rss_info; -+ rss->enable = false; -+ - /* Cleanup Queue IRQ */ - vec = pci_irq_vector(pf->pdev, - pf->hw.nix_msixoff + NIX_LF_QINT_VEC_START); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 055baf3b6cb10..f258f2f9b8cff 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -90,14 +90,15 @@ struct page_pool; - MLX5_MPWRQ_LOG_WQE_SZ - PAGE_SHIFT : 0) - #define MLX5_MPWRQ_PAGES_PER_WQE BIT(MLX5_MPWRQ_WQE_PAGE_ORDER) - --#define MLX5_MTT_OCTW(npages) (ALIGN(npages, 8) / 2) -+#define MLX5_ALIGN_MTTS(mtts) (ALIGN(mtts, 8)) -+#define MLX5_ALIGNED_MTTS_OCTW(mtts) ((mtts) / 2) -+#define MLX5_MTT_OCTW(mtts) (MLX5_ALIGNED_MTTS_OCTW(MLX5_ALIGN_MTTS(mtts))) - /* Add another page to MLX5E_REQUIRED_WQE_MTTS as a buffer between - * WQEs, This page will absorb write overflow by the hardware, when - * receiving packets larger than MTU. These oversize packets are - * dropped by the driver at a later stage. - */ --#define MLX5E_REQUIRED_WQE_MTTS (ALIGN(MLX5_MPWRQ_PAGES_PER_WQE + 1, 8)) --#define MLX5E_LOG_ALIGNED_MPWQE_PPW (ilog2(MLX5E_REQUIRED_WQE_MTTS)) -+#define MLX5E_REQUIRED_WQE_MTTS (MLX5_ALIGN_MTTS(MLX5_MPWRQ_PAGES_PER_WQE + 1)) - #define MLX5E_REQUIRED_MTTS(wqes) (wqes * MLX5E_REQUIRED_WQE_MTTS) - #define MLX5E_MAX_RQ_NUM_MTTS \ - ((1 << 16) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c -index 24e2c0d955b99..b42396df3111d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c -@@ -1182,7 +1182,8 @@ int mlx5_tc_ct_add_no_trk_match(struct mlx5_flow_spec *spec) - - mlx5e_tc_match_to_reg_get_match(spec, CTSTATE_TO_REG, - &ctstate, &ctstate_mask); -- if (ctstate_mask) -+ -+ if ((ctstate & ctstate_mask) == MLX5_CT_STATE_TRK_BIT) - return -EOPNOTSUPP; - - ctstate_mask |= MLX5_CT_STATE_TRK_BIT; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c -index e472ed0eacfbc..7ed3f9f79f11a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c -@@ -227,6 +227,10 @@ static int mlx5e_tc_tun_parse_geneve_options(struct mlx5e_priv *priv, - option_key = (struct geneve_opt *)&enc_opts.key->data[0]; - option_mask = (struct geneve_opt *)&enc_opts.mask->data[0]; - -+ if (option_mask->opt_class == 0 && option_mask->type == 0 && -+ !memchr_inv(option_mask->opt_data, 0, option_mask->length * 4)) -+ return 0; -+ - if (option_key->length > max_tlv_option_data_len) { - NL_SET_ERR_MSG_MOD(extack, - "Matching on GENEVE options: unsupported option len"); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 8612c388db7d3..c9d01e705ab29 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -1876,6 +1876,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, - { - struct mlx5e_priv *priv = netdev_priv(netdev); - struct mlx5_core_dev *mdev = priv->mdev; -+ int err; - - if (!MLX5_CAP_GEN(mdev, cqe_compression)) - return -EOPNOTSUPP; -@@ -1885,7 +1886,10 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, - return -EINVAL; - } - -- mlx5e_modify_rx_cqe_compression_locked(priv, enable); -+ err = mlx5e_modify_rx_cqe_compression_locked(priv, enable); -+ if (err) -+ return err; -+ - priv->channels.params.rx_cqe_compress_def = enable; - - return 0; -@@ -1993,8 +1997,13 @@ static int set_pflag_tx_port_ts(struct net_device *netdev, bool enable) - */ - - if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) { -+ struct mlx5e_params old_params; -+ -+ old_params = priv->channels.params; - priv->channels.params = new_channels.params; - err = mlx5e_num_channels_changed(priv); -+ if (err) -+ priv->channels.params = old_params; - goto out; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index a2e0b548bf570..aaa5a56b44c7c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -305,9 +305,9 @@ static int mlx5e_create_rq_umr_mkey(struct mlx5_core_dev *mdev, struct mlx5e_rq - rq->wqe_overflow.addr); - } - --static inline u64 mlx5e_get_mpwqe_offset(struct mlx5e_rq *rq, u16 wqe_ix) -+static u64 mlx5e_get_mpwqe_offset(u16 wqe_ix) - { -- return (wqe_ix << MLX5E_LOG_ALIGNED_MPWQE_PPW) << PAGE_SHIFT; -+ return MLX5E_REQUIRED_MTTS(wqe_ix) << PAGE_SHIFT; - } - - static void mlx5e_init_frags_partition(struct mlx5e_rq *rq) -@@ -547,7 +547,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c, - mlx5_wq_ll_get_wqe(&rq->mpwqe.wq, i); - u32 byte_count = - rq->mpwqe.num_strides << rq->mpwqe.log_stride_sz; -- u64 dma_offset = mlx5e_get_mpwqe_offset(rq, i); -+ u64 dma_offset = mlx5e_get_mpwqe_offset(i); - - wqe->data[0].addr = cpu_to_be64(dma_offset + rq->buff.headroom); - wqe->data[0].byte_count = cpu_to_be32(byte_count); -@@ -2443,8 +2443,10 @@ void mlx5e_close_channels(struct mlx5e_channels *chs) - { - int i; - -- if (chs->port_ptp) -+ if (chs->port_ptp) { - mlx5e_port_ptp_close(chs->port_ptp); -+ chs->port_ptp = NULL; -+ } - - for (i = 0; i < chs->num; i++) - mlx5e_close_channel(chs->c[i]); -@@ -3701,10 +3703,17 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) - } - - if (mlx5e_is_uplink_rep(priv)) { -+ struct mlx5e_vport_stats *vstats = &priv->stats.vport; -+ - stats->rx_packets = PPORT_802_3_GET(pstats, a_frames_received_ok); - stats->rx_bytes = PPORT_802_3_GET(pstats, a_octets_received_ok); - stats->tx_packets = PPORT_802_3_GET(pstats, a_frames_transmitted_ok); - stats->tx_bytes = PPORT_802_3_GET(pstats, a_octets_transmitted_ok); -+ -+ /* vport multicast also counts packets that are dropped due to steering -+ * or rx out of buffer -+ */ -+ stats->multicast = VPORT_COUNTER_GET(vstats, received_eth_multicast.packets); - } else { - mlx5e_fold_sw_stats64(priv, stats); - } -@@ -4548,8 +4557,10 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog) - struct mlx5e_channel *c = priv->channels.c[i]; - - mlx5e_rq_replace_xdp_prog(&c->rq, prog); -- if (test_bit(MLX5E_CHANNEL_STATE_XSK, c->state)) -+ if (test_bit(MLX5E_CHANNEL_STATE_XSK, c->state)) { -+ bpf_prog_inc(prog); - mlx5e_rq_replace_xdp_prog(&c->xskrq, prog); -+ } - } - - unlock: -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 4864deed9dc94..b2e71a045df01 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -505,7 +505,6 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix) - struct mlx5e_icosq *sq = rq->icosq; - struct mlx5_wq_cyc *wq = &sq->wq; - struct mlx5e_umr_wqe *umr_wqe; -- u16 xlt_offset = ix << (MLX5E_LOG_ALIGNED_MPWQE_PPW - 1); - u16 pi; - int err; - int i; -@@ -536,7 +535,8 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix) - umr_wqe->ctrl.opmod_idx_opcode = - cpu_to_be32((sq->pc << MLX5_WQE_CTRL_WQE_INDEX_SHIFT) | - MLX5_OPCODE_UMR); -- umr_wqe->uctrl.xlt_offset = cpu_to_be16(xlt_offset); -+ umr_wqe->uctrl.xlt_offset = -+ cpu_to_be16(MLX5_ALIGNED_MTTS_OCTW(MLX5E_REQUIRED_MTTS(ix))); - - sq->db.wqe_info[pi] = (struct mlx5e_icosq_wqe_info) { - .wqe_type = MLX5E_ICOSQ_WQE_UMR_RX, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index 717fbaa6ce736..24fa399b15770 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -2595,6 +2595,16 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, - *match_level = MLX5_MATCH_L4; - } - -+ /* Currenlty supported only for MPLS over UDP */ -+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_MPLS) && -+ !netif_is_bareudp(filter_dev)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Matching on MPLS is supported only for MPLS over UDP"); -+ netdev_err(priv->netdev, -+ "Matching on MPLS is supported only for MPLS over UDP\n"); -+ return -EOPNOTSUPP; -+ } -+ - return 0; - } - -@@ -3198,6 +3208,37 @@ static int is_action_keys_supported(const struct flow_action_entry *act, - return 0; - } - -+static bool modify_tuple_supported(bool modify_tuple, bool ct_clear, -+ bool ct_flow, struct netlink_ext_ack *extack, -+ struct mlx5e_priv *priv, -+ struct mlx5_flow_spec *spec) -+{ -+ if (!modify_tuple || ct_clear) -+ return true; -+ -+ if (ct_flow) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "can't offload tuple modification with non-clear ct()"); -+ netdev_info(priv->netdev, -+ "can't offload tuple modification with non-clear ct()"); -+ return false; -+ } -+ -+ /* Add ct_state=-trk match so it will be offloaded for non ct flows -+ * (or after clear action), as otherwise, since the tuple is changed, -+ * we can't restore ct state -+ */ -+ if (mlx5_tc_ct_add_no_trk_match(spec)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "can't offload tuple modification with ct matches and no ct(clear) action"); -+ netdev_info(priv->netdev, -+ "can't offload tuple modification with ct matches and no ct(clear) action"); -+ return false; -+ } -+ -+ return true; -+} -+ - static bool modify_header_match_supported(struct mlx5e_priv *priv, - struct mlx5_flow_spec *spec, - struct flow_action *flow_action, -@@ -3236,18 +3277,9 @@ static bool modify_header_match_supported(struct mlx5e_priv *priv, - return err; - } - -- /* Add ct_state=-trk match so it will be offloaded for non ct flows -- * (or after clear action), as otherwise, since the tuple is changed, -- * we can't restore ct state -- */ -- if (!ct_clear && modify_tuple && -- mlx5_tc_ct_add_no_trk_match(spec)) { -- NL_SET_ERR_MSG_MOD(extack, -- "can't offload tuple modify header with ct matches"); -- netdev_info(priv->netdev, -- "can't offload tuple modify header with ct matches"); -+ if (!modify_tuple_supported(modify_tuple, ct_clear, ct_flow, extack, -+ priv, spec)) - return false; -- } - - ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol); - if (modify_ip_header && ip_proto != IPPROTO_TCP && -@@ -5040,7 +5072,8 @@ static int apply_police_params(struct mlx5e_priv *priv, u64 rate, - */ - if (rate) { - rate = (rate * BITS_PER_BYTE) + 500000; -- rate_mbps = max_t(u64, do_div(rate, 1000000), 1); -+ do_div(rate, 1000000); -+ rate_mbps = max_t(u32, rate, 1); - } - - err = mlx5_esw_modify_vport_rate(esw, vport_num, rate_mbps); -diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c -index 5defd31d481c2..aa06fcb38f8b9 100644 ---- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c -+++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c -@@ -327,8 +327,14 @@ int nfp_compile_flow_metadata(struct nfp_app *app, - goto err_free_ctx_entry; - } - -+ /* Do net allocate a mask-id for pre_tun_rules. These flows are used to -+ * configure the pre_tun table and are never actually send to the -+ * firmware as an add-flow message. This causes the mask-id allocation -+ * on the firmware to get out of sync if allocated here. -+ */ - new_mask_id = 0; -- if (!nfp_check_mask_add(app, nfp_flow->mask_data, -+ if (!nfp_flow->pre_tun_rule.dev && -+ !nfp_check_mask_add(app, nfp_flow->mask_data, - nfp_flow->meta.mask_len, - &nfp_flow->meta.flags, &new_mask_id)) { - NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot allocate a new mask id"); -@@ -359,7 +365,8 @@ int nfp_compile_flow_metadata(struct nfp_app *app, - goto err_remove_mask; - } - -- if (!nfp_check_mask_remove(app, nfp_flow->mask_data, -+ if (!nfp_flow->pre_tun_rule.dev && -+ !nfp_check_mask_remove(app, nfp_flow->mask_data, - nfp_flow->meta.mask_len, - NULL, &new_mask_id)) { - NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot release mask id"); -@@ -374,8 +381,10 @@ int nfp_compile_flow_metadata(struct nfp_app *app, - return 0; - - err_remove_mask: -- nfp_check_mask_remove(app, nfp_flow->mask_data, nfp_flow->meta.mask_len, -- NULL, &new_mask_id); -+ if (!nfp_flow->pre_tun_rule.dev) -+ nfp_check_mask_remove(app, nfp_flow->mask_data, -+ nfp_flow->meta.mask_len, -+ NULL, &new_mask_id); - err_remove_rhash: - WARN_ON_ONCE(rhashtable_remove_fast(&priv->stats_ctx_table, - &ctx_entry->ht_node, -@@ -406,9 +415,10 @@ int nfp_modify_flow_metadata(struct nfp_app *app, - - __nfp_modify_flow_metadata(priv, nfp_flow); - -- nfp_check_mask_remove(app, nfp_flow->mask_data, -- nfp_flow->meta.mask_len, &nfp_flow->meta.flags, -- &new_mask_id); -+ if (!nfp_flow->pre_tun_rule.dev) -+ nfp_check_mask_remove(app, nfp_flow->mask_data, -+ nfp_flow->meta.mask_len, &nfp_flow->meta.flags, -+ &new_mask_id); - - /* Update flow payload with mask ids. */ - nfp_flow->unmasked_data[NFP_FL_MASK_ID_LOCATION] = new_mask_id; -diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c -index 1c59aff2163c7..d72225d64a75d 100644 ---- a/drivers/net/ethernet/netronome/nfp/flower/offload.c -+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c -@@ -1142,6 +1142,12 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, - return -EOPNOTSUPP; - } - -+ if (!(key_layer & NFP_FLOWER_LAYER_IPV4) && -+ !(key_layer & NFP_FLOWER_LAYER_IPV6)) { -+ NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: match on ipv4/ipv6 eth_type must be present"); -+ return -EOPNOTSUPP; -+ } -+ - /* Skip fields known to exist. */ - mask += sizeof(struct nfp_flower_meta_tci); - ext += sizeof(struct nfp_flower_meta_tci); -@@ -1152,6 +1158,13 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, - mask += sizeof(struct nfp_flower_in_port); - ext += sizeof(struct nfp_flower_in_port); - -+ /* Ensure destination MAC address matches pre_tun_dev. */ -+ mac = (struct nfp_flower_mac_mpls *)ext; -+ if (memcmp(&mac->mac_dst[0], flow->pre_tun_rule.dev->dev_addr, 6)) { -+ NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: dest MAC must match output dev MAC"); -+ return -EOPNOTSUPP; -+ } -+ - /* Ensure destination MAC address is fully matched. */ - mac = (struct nfp_flower_mac_mpls *)mask; - if (!is_broadcast_ether_addr(&mac->mac_dst[0])) { -@@ -1159,6 +1172,11 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, - return -EOPNOTSUPP; - } - -+ if (mac->mpls_lse) { -+ NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: MPLS not supported"); -+ return -EOPNOTSUPP; -+ } -+ - mask += sizeof(struct nfp_flower_mac_mpls); - ext += sizeof(struct nfp_flower_mac_mpls); - if (key_layer & NFP_FLOWER_LAYER_IPV4 || -diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c -index 7248d248f6041..d19c02e991145 100644 ---- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c -+++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c -@@ -16,8 +16,9 @@ - #define NFP_FL_MAX_ROUTES 32 - - #define NFP_TUN_PRE_TUN_RULE_LIMIT 32 --#define NFP_TUN_PRE_TUN_RULE_DEL 0x1 --#define NFP_TUN_PRE_TUN_IDX_BIT 0x8 -+#define NFP_TUN_PRE_TUN_RULE_DEL BIT(0) -+#define NFP_TUN_PRE_TUN_IDX_BIT BIT(3) -+#define NFP_TUN_PRE_TUN_IPV6_BIT BIT(7) - - /** - * struct nfp_tun_pre_run_rule - rule matched before decap -@@ -1268,6 +1269,7 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app, - { - struct nfp_flower_priv *app_priv = app->priv; - struct nfp_tun_offloaded_mac *mac_entry; -+ struct nfp_flower_meta_tci *key_meta; - struct nfp_tun_pre_tun_rule payload; - struct net_device *internal_dev; - int err; -@@ -1290,6 +1292,15 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app, - if (!mac_entry) - return -ENOENT; - -+ /* Set/clear IPV6 bit. cpu_to_be16() swap will lead to MSB being -+ * set/clear for port_idx. -+ */ -+ key_meta = (struct nfp_flower_meta_tci *)flow->unmasked_data; -+ if (key_meta->nfp_flow_key_layer & NFP_FLOWER_LAYER_IPV6) -+ mac_entry->index |= NFP_TUN_PRE_TUN_IPV6_BIT; -+ else -+ mac_entry->index &= ~NFP_TUN_PRE_TUN_IPV6_BIT; -+ - payload.port_idx = cpu_to_be16(mac_entry->index); - - /* Copy mac id and vlan to flow - dev may not exist at delete time. */ -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c -index ac4cd5d82e696..b7601cadcb8c1 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c -@@ -1079,15 +1079,17 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb) - { - int sg_elems = q->lif->qtype_info[IONIC_QTYPE_TXQ].max_sg_elems; - struct ionic_tx_stats *stats = q_to_tx_stats(q); -+ int ndescs; - int err; - -- /* If TSO, need roundup(skb->len/mss) descs */ -+ /* Each desc is mss long max, so a descriptor for each gso_seg */ - if (skb_is_gso(skb)) -- return (skb->len / skb_shinfo(skb)->gso_size) + 1; -+ ndescs = skb_shinfo(skb)->gso_segs; -+ else -+ ndescs = 1; - -- /* If non-TSO, just need 1 desc and nr_frags sg elems */ - if (skb_shinfo(skb)->nr_frags <= sg_elems) -- return 1; -+ return ndescs; - - /* Too many frags, so linearize */ - err = skb_linearize(skb); -@@ -1096,8 +1098,7 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb) - - stats->linearize++; - -- /* Need 1 desc and zero sg elems */ -- return 1; -+ return ndescs; - } - - static int ionic_maybe_stop_tx(struct ionic_queue *q, int ndescs) -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c -index 7760a3394e93c..7ecb3dfe30bd2 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c -@@ -1425,6 +1425,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) - - if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) { - vfree(fw_dump->tmpl_hdr); -+ fw_dump->tmpl_hdr = NULL; - - if (qlcnic_83xx_md_check_extended_dump_capability(adapter)) - extended = !qlcnic_83xx_extend_md_capab(adapter); -@@ -1443,6 +1444,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) - struct qlcnic_83xx_dump_template_hdr *hdr; - - hdr = fw_dump->tmpl_hdr; -+ if (!hdr) -+ return; - hdr->drv_cap_mask = 0x1f; - fw_dump->cap_mask = 0x1f; - dev_info(&pdev->dev, -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index ea265b428c2f3..7c1a057dcf3d6 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -4677,6 +4677,9 @@ static void rtl8169_down(struct rtl8169_private *tp) - - rtl8169_update_counters(tp); - -+ pci_clear_master(tp->pci_dev); -+ rtl_pci_commit(tp); -+ - rtl8169_cleanup(tp, true); - - rtl_pll_power_down(tp); -@@ -4684,6 +4687,7 @@ static void rtl8169_down(struct rtl8169_private *tp) - - static void rtl8169_up(struct rtl8169_private *tp) - { -+ pci_set_master(tp->pci_dev); - rtl_pll_power_up(tp); - rtl8169_init_phy(tp); - napi_enable(&tp->napi); -@@ -5348,8 +5352,6 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - - rtl_hw_reset(tp); - -- pci_set_master(pdev); -- - rc = rtl_alloc_irq(tp); - if (rc < 0) { - dev_err(&pdev->dev, "Can't allocate interrupt\n"); -diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c -index 19d20a6d0d445..3e172fc649761 100644 ---- a/drivers/net/ethernet/socionext/netsec.c -+++ b/drivers/net/ethernet/socionext/netsec.c -@@ -1718,14 +1718,17 @@ static int netsec_netdev_init(struct net_device *ndev) - goto err1; - - /* set phy power down */ -- data = netsec_phy_read(priv->mii_bus, priv->phy_addr, MII_BMCR) | -- BMCR_PDOWN; -- netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, data); -+ data = netsec_phy_read(priv->mii_bus, priv->phy_addr, MII_BMCR); -+ netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, -+ data | BMCR_PDOWN); - - ret = netsec_reset_hardware(priv, true); - if (ret) - goto err2; - -+ /* Restore phy power state */ -+ netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, data); -+ - spin_lock_init(&priv->desc_ring[NETSEC_RING_TX].lock); - spin_lock_init(&priv->desc_ring[NETSEC_RING_RX].lock); - -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -index a5e0eff4a3874..9f5ccf1a0a540 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -@@ -1217,6 +1217,8 @@ static int sun8i_dwmac_probe(struct platform_device *pdev) - plat_dat->init = sun8i_dwmac_init; - plat_dat->exit = sun8i_dwmac_exit; - plat_dat->setup = sun8i_dwmac_setup; -+ plat_dat->tx_fifo_size = 4096; -+ plat_dat->rx_fifo_size = 16384; - - ret = sun8i_dwmac_set_syscon(&pdev->dev, plat_dat); - if (ret) -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c -index 2ecd3a8a690c2..cbf4429fb1d23 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c -@@ -402,19 +402,53 @@ static void dwmac4_rd_set_tx_ic(struct dma_desc *p) - p->des2 |= cpu_to_le32(TDES2_INTERRUPT_ON_COMPLETION); - } - --static void dwmac4_display_ring(void *head, unsigned int size, bool rx) -+static void dwmac4_display_ring(void *head, unsigned int size, bool rx, -+ dma_addr_t dma_rx_phy, unsigned int desc_size) - { -- struct dma_desc *p = (struct dma_desc *)head; -+ dma_addr_t dma_addr; - int i; - - pr_info("%s descriptor ring:\n", rx ? "RX" : "TX"); - -- for (i = 0; i < size; i++) { -- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", -- i, (unsigned int)virt_to_phys(p), -- le32_to_cpu(p->des0), le32_to_cpu(p->des1), -- le32_to_cpu(p->des2), le32_to_cpu(p->des3)); -- p++; -+ if (desc_size == sizeof(struct dma_desc)) { -+ struct dma_desc *p = (struct dma_desc *)head; -+ -+ for (i = 0; i < size; i++) { -+ dma_addr = dma_rx_phy + i * sizeof(*p); -+ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", -+ i, &dma_addr, -+ le32_to_cpu(p->des0), le32_to_cpu(p->des1), -+ le32_to_cpu(p->des2), le32_to_cpu(p->des3)); -+ p++; -+ } -+ } else if (desc_size == sizeof(struct dma_extended_desc)) { -+ struct dma_extended_desc *extp = (struct dma_extended_desc *)head; -+ -+ for (i = 0; i < size; i++) { -+ dma_addr = dma_rx_phy + i * sizeof(*extp); -+ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n", -+ i, &dma_addr, -+ le32_to_cpu(extp->basic.des0), le32_to_cpu(extp->basic.des1), -+ le32_to_cpu(extp->basic.des2), le32_to_cpu(extp->basic.des3), -+ le32_to_cpu(extp->des4), le32_to_cpu(extp->des5), -+ le32_to_cpu(extp->des6), le32_to_cpu(extp->des7)); -+ extp++; -+ } -+ } else if (desc_size == sizeof(struct dma_edesc)) { -+ struct dma_edesc *ep = (struct dma_edesc *)head; -+ -+ for (i = 0; i < size; i++) { -+ dma_addr = dma_rx_phy + i * sizeof(*ep); -+ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n", -+ i, &dma_addr, -+ le32_to_cpu(ep->des4), le32_to_cpu(ep->des5), -+ le32_to_cpu(ep->des6), le32_to_cpu(ep->des7), -+ le32_to_cpu(ep->basic.des0), le32_to_cpu(ep->basic.des1), -+ le32_to_cpu(ep->basic.des2), le32_to_cpu(ep->basic.des3)); -+ ep++; -+ } -+ } else { -+ pr_err("unsupported descriptor!"); - } - } - -diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -index d02cec296f51e..6650edfab5bc4 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -@@ -417,19 +417,22 @@ static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc, - } - } - --static void enh_desc_display_ring(void *head, unsigned int size, bool rx) -+static void enh_desc_display_ring(void *head, unsigned int size, bool rx, -+ dma_addr_t dma_rx_phy, unsigned int desc_size) - { - struct dma_extended_desc *ep = (struct dma_extended_desc *)head; -+ dma_addr_t dma_addr; - int i; - - pr_info("Extended %s descriptor ring:\n", rx ? "RX" : "TX"); - - for (i = 0; i < size; i++) { - u64 x; -+ dma_addr = dma_rx_phy + i * sizeof(*ep); - - x = *(u64 *)ep; -- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", -- i, (unsigned int)virt_to_phys(ep), -+ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", -+ i, &dma_addr, - (unsigned int)x, (unsigned int)(x >> 32), - ep->basic.des2, ep->basic.des3); - ep++; -diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h -index 15d7b82611896..979ac9fca23c7 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/hwif.h -+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h -@@ -78,7 +78,8 @@ struct stmmac_desc_ops { - /* get rx timestamp status */ - int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats); - /* Display ring */ -- void (*display_ring)(void *head, unsigned int size, bool rx); -+ void (*display_ring)(void *head, unsigned int size, bool rx, -+ dma_addr_t dma_rx_phy, unsigned int desc_size); - /* set MSS via context descriptor */ - void (*set_mss)(struct dma_desc *p, unsigned int mss); - /* get descriptor skbuff address */ -diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -index f083360e4ba67..98ef43f35802a 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -@@ -269,19 +269,22 @@ static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats) - return 1; - } - --static void ndesc_display_ring(void *head, unsigned int size, bool rx) -+static void ndesc_display_ring(void *head, unsigned int size, bool rx, -+ dma_addr_t dma_rx_phy, unsigned int desc_size) - { - struct dma_desc *p = (struct dma_desc *)head; -+ dma_addr_t dma_addr; - int i; - - pr_info("%s descriptor ring:\n", rx ? "RX" : "TX"); - - for (i = 0; i < size; i++) { - u64 x; -+ dma_addr = dma_rx_phy + i * sizeof(*p); - - x = *(u64 *)p; -- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x", -- i, (unsigned int)virt_to_phys(p), -+ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x", -+ i, &dma_addr, - (unsigned int)x, (unsigned int)(x >> 32), - p->des2, p->des3); - p++; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index e87961432a793..4749bd0af1607 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -1133,6 +1133,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) - static void stmmac_display_rx_rings(struct stmmac_priv *priv) - { - u32 rx_cnt = priv->plat->rx_queues_to_use; -+ unsigned int desc_size; - void *head_rx; - u32 queue; - -@@ -1142,19 +1143,24 @@ static void stmmac_display_rx_rings(struct stmmac_priv *priv) - - pr_info("\tRX Queue %u rings\n", queue); - -- if (priv->extend_desc) -+ if (priv->extend_desc) { - head_rx = (void *)rx_q->dma_erx; -- else -+ desc_size = sizeof(struct dma_extended_desc); -+ } else { - head_rx = (void *)rx_q->dma_rx; -+ desc_size = sizeof(struct dma_desc); -+ } - - /* Display RX ring */ -- stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true); -+ stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true, -+ rx_q->dma_rx_phy, desc_size); - } - } - - static void stmmac_display_tx_rings(struct stmmac_priv *priv) - { - u32 tx_cnt = priv->plat->tx_queues_to_use; -+ unsigned int desc_size; - void *head_tx; - u32 queue; - -@@ -1164,14 +1170,19 @@ static void stmmac_display_tx_rings(struct stmmac_priv *priv) - - pr_info("\tTX Queue %d rings\n", queue); - -- if (priv->extend_desc) -+ if (priv->extend_desc) { - head_tx = (void *)tx_q->dma_etx; -- else if (tx_q->tbs & STMMAC_TBS_AVAIL) -+ desc_size = sizeof(struct dma_extended_desc); -+ } else if (tx_q->tbs & STMMAC_TBS_AVAIL) { - head_tx = (void *)tx_q->dma_entx; -- else -+ desc_size = sizeof(struct dma_edesc); -+ } else { - head_tx = (void *)tx_q->dma_tx; -+ desc_size = sizeof(struct dma_desc); -+ } - -- stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false); -+ stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false, -+ tx_q->dma_tx_phy, desc_size); - } - } - -@@ -3740,18 +3751,23 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) - unsigned int count = 0, error = 0, len = 0; - int status = 0, coe = priv->hw->rx_csum; - unsigned int next_entry = rx_q->cur_rx; -+ unsigned int desc_size; - struct sk_buff *skb = NULL; - - if (netif_msg_rx_status(priv)) { - void *rx_head; - - netdev_dbg(priv->dev, "%s: descriptor ring:\n", __func__); -- if (priv->extend_desc) -+ if (priv->extend_desc) { - rx_head = (void *)rx_q->dma_erx; -- else -+ desc_size = sizeof(struct dma_extended_desc); -+ } else { - rx_head = (void *)rx_q->dma_rx; -+ desc_size = sizeof(struct dma_desc); -+ } - -- stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true); -+ stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true, -+ rx_q->dma_rx_phy, desc_size); - } - while (count < limit) { - unsigned int buf1_len = 0, buf2_len = 0; -@@ -4319,24 +4335,27 @@ static int stmmac_set_mac_address(struct net_device *ndev, void *addr) - static struct dentry *stmmac_fs_dir; - - static void sysfs_display_ring(void *head, int size, int extend_desc, -- struct seq_file *seq) -+ struct seq_file *seq, dma_addr_t dma_phy_addr) - { - int i; - struct dma_extended_desc *ep = (struct dma_extended_desc *)head; - struct dma_desc *p = (struct dma_desc *)head; -+ dma_addr_t dma_addr; - - for (i = 0; i < size; i++) { - if (extend_desc) { -- seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", -- i, (unsigned int)virt_to_phys(ep), -+ dma_addr = dma_phy_addr + i * sizeof(*ep); -+ seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", -+ i, &dma_addr, - le32_to_cpu(ep->basic.des0), - le32_to_cpu(ep->basic.des1), - le32_to_cpu(ep->basic.des2), - le32_to_cpu(ep->basic.des3)); - ep++; - } else { -- seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", -- i, (unsigned int)virt_to_phys(p), -+ dma_addr = dma_phy_addr + i * sizeof(*p); -+ seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", -+ i, &dma_addr, - le32_to_cpu(p->des0), le32_to_cpu(p->des1), - le32_to_cpu(p->des2), le32_to_cpu(p->des3)); - p++; -@@ -4364,11 +4383,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v) - if (priv->extend_desc) { - seq_printf(seq, "Extended descriptor ring:\n"); - sysfs_display_ring((void *)rx_q->dma_erx, -- priv->dma_rx_size, 1, seq); -+ priv->dma_rx_size, 1, seq, rx_q->dma_rx_phy); - } else { - seq_printf(seq, "Descriptor ring:\n"); - sysfs_display_ring((void *)rx_q->dma_rx, -- priv->dma_rx_size, 0, seq); -+ priv->dma_rx_size, 0, seq, rx_q->dma_rx_phy); - } - } - -@@ -4380,11 +4399,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v) - if (priv->extend_desc) { - seq_printf(seq, "Extended descriptor ring:\n"); - sysfs_display_ring((void *)tx_q->dma_etx, -- priv->dma_tx_size, 1, seq); -+ priv->dma_tx_size, 1, seq, tx_q->dma_tx_phy); - } else if (!(tx_q->tbs & STMMAC_TBS_AVAIL)) { - seq_printf(seq, "Descriptor ring:\n"); - sysfs_display_ring((void *)tx_q->dma_tx, -- priv->dma_tx_size, 0, seq); -+ priv->dma_tx_size, 0, seq, tx_q->dma_tx_phy); - } - } - -diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c -index 68695d4afacd5..707ccdd03b19e 100644 ---- a/drivers/net/ethernet/sun/niu.c -+++ b/drivers/net/ethernet/sun/niu.c -@@ -3931,8 +3931,6 @@ static void niu_xmac_interrupt(struct niu *np) - mp->rx_mcasts += RXMAC_MC_FRM_CNT_COUNT; - if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP) - mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT; -- if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP) -- mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT; - if (val & XRXMAC_STATUS_RXHIST1_CNT_EXP) - mp->rx_hist_cnt1 += RXMAC_HIST_CNT1_COUNT; - if (val & XRXMAC_STATUS_RXHIST2_CNT_EXP) -diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c -index b8f4f419173f9..d054c6e83b1c9 100644 ---- a/drivers/net/ethernet/tehuti/tehuti.c -+++ b/drivers/net/ethernet/tehuti/tehuti.c -@@ -2044,6 +2044,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - /*bdx_hw_reset(priv); */ - if (bdx_read_mac(priv)) { - pr_err("load MAC address failed\n"); -+ err = -EFAULT; - goto err_out_iomap; - } - SET_NETDEV_DEV(ndev, &pdev->dev); -diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -index b4a0bfce5b762..4cd701a9277d7 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -@@ -1835,7 +1835,7 @@ static int axienet_probe(struct platform_device *pdev) - if (IS_ERR(lp->regs)) { - dev_err(&pdev->dev, "could not map Axi Ethernet regs.\n"); - ret = PTR_ERR(lp->regs); -- goto free_netdev; -+ goto cleanup_clk; - } - lp->regs_start = ethres->start; - -@@ -1910,12 +1910,12 @@ static int axienet_probe(struct platform_device *pdev) - break; - default: - ret = -EINVAL; -- goto free_netdev; -+ goto cleanup_clk; - } - } else { - ret = of_get_phy_mode(pdev->dev.of_node, &lp->phy_mode); - if (ret) -- goto free_netdev; -+ goto cleanup_clk; - } - - /* Find the DMA node, map the DMA registers, and decode the DMA IRQs */ -@@ -1928,7 +1928,7 @@ static int axienet_probe(struct platform_device *pdev) - dev_err(&pdev->dev, - "unable to get DMA resource\n"); - of_node_put(np); -- goto free_netdev; -+ goto cleanup_clk; - } - lp->dma_regs = devm_ioremap_resource(&pdev->dev, - &dmares); -@@ -1948,12 +1948,12 @@ static int axienet_probe(struct platform_device *pdev) - if (IS_ERR(lp->dma_regs)) { - dev_err(&pdev->dev, "could not map DMA regs\n"); - ret = PTR_ERR(lp->dma_regs); -- goto free_netdev; -+ goto cleanup_clk; - } - if ((lp->rx_irq <= 0) || (lp->tx_irq <= 0)) { - dev_err(&pdev->dev, "could not determine irqs\n"); - ret = -ENOMEM; -- goto free_netdev; -+ goto cleanup_clk; - } - - /* Autodetect the need for 64-bit DMA pointers. -@@ -1983,7 +1983,7 @@ static int axienet_probe(struct platform_device *pdev) - ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(addr_width)); - if (ret) { - dev_err(&pdev->dev, "No suitable DMA available\n"); -- goto free_netdev; -+ goto cleanup_clk; - } - - /* Check for Ethernet core IRQ (optional) */ -@@ -2014,12 +2014,12 @@ static int axienet_probe(struct platform_device *pdev) - if (!lp->phy_node) { - dev_err(&pdev->dev, "phy-handle required for 1000BaseX/SGMII\n"); - ret = -EINVAL; -- goto free_netdev; -+ goto cleanup_mdio; - } - lp->pcs_phy = of_mdio_find_device(lp->phy_node); - if (!lp->pcs_phy) { - ret = -EPROBE_DEFER; -- goto free_netdev; -+ goto cleanup_mdio; - } - lp->phylink_config.pcs_poll = true; - } -@@ -2033,17 +2033,30 @@ static int axienet_probe(struct platform_device *pdev) - if (IS_ERR(lp->phylink)) { - ret = PTR_ERR(lp->phylink); - dev_err(&pdev->dev, "phylink_create error (%i)\n", ret); -- goto free_netdev; -+ goto cleanup_mdio; - } - - ret = register_netdev(lp->ndev); - if (ret) { - dev_err(lp->dev, "register_netdev() error (%i)\n", ret); -- goto free_netdev; -+ goto cleanup_phylink; - } - - return 0; - -+cleanup_phylink: -+ phylink_destroy(lp->phylink); -+ -+cleanup_mdio: -+ if (lp->pcs_phy) -+ put_device(&lp->pcs_phy->dev); -+ if (lp->mii_bus) -+ axienet_mdio_teardown(lp); -+ of_node_put(lp->phy_node); -+ -+cleanup_clk: -+ clk_disable_unprepare(lp->clk); -+ - free_netdev: - free_netdev(ndev); - -diff --git a/drivers/net/ipa/ipa_qmi.c b/drivers/net/ipa/ipa_qmi.c -index 2fc64483f2753..e594bf3b600f0 100644 ---- a/drivers/net/ipa/ipa_qmi.c -+++ b/drivers/net/ipa/ipa_qmi.c -@@ -249,6 +249,7 @@ static const struct qmi_msg_handler ipa_server_msg_handlers[] = { - .decoded_size = IPA_QMI_DRIVER_INIT_COMPLETE_REQ_SZ, - .fn = ipa_server_driver_init_complete, - }, -+ { }, - }; - - /* Handle an INIT_DRIVER response message from the modem. */ -@@ -269,6 +270,7 @@ static const struct qmi_msg_handler ipa_client_msg_handlers[] = { - .decoded_size = IPA_QMI_INIT_DRIVER_RSP_SZ, - .fn = ipa_client_init_driver, - }, -+ { }, - }; - - /* Return a pointer to an init modem driver request structure, which contains -diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c -index 8a4ec3222168c..07a98c3249421 100644 ---- a/drivers/net/phy/broadcom.c -+++ b/drivers/net/phy/broadcom.c -@@ -26,7 +26,46 @@ MODULE_DESCRIPTION("Broadcom PHY driver"); - MODULE_AUTHOR("Maciej W. Rozycki"); - MODULE_LICENSE("GPL"); - --static int bcm54xx_config_clock_delay(struct phy_device *phydev); -+static int bcm54xx_config_clock_delay(struct phy_device *phydev) -+{ -+ int rc, val; -+ -+ /* handling PHY's internal RX clock delay */ -+ val = bcm54xx_auxctl_read(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC); -+ val |= MII_BCM54XX_AUXCTL_MISC_WREN; -+ if (phydev->interface == PHY_INTERFACE_MODE_RGMII || -+ phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) { -+ /* Disable RGMII RXC-RXD skew */ -+ val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; -+ } -+ if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || -+ phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) { -+ /* Enable RGMII RXC-RXD skew */ -+ val |= MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; -+ } -+ rc = bcm54xx_auxctl_write(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC, -+ val); -+ if (rc < 0) -+ return rc; -+ -+ /* handling PHY's internal TX clock delay */ -+ val = bcm_phy_read_shadow(phydev, BCM54810_SHD_CLK_CTL); -+ if (phydev->interface == PHY_INTERFACE_MODE_RGMII || -+ phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) { -+ /* Disable internal TX clock delay */ -+ val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN; -+ } -+ if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || -+ phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) { -+ /* Enable internal TX clock delay */ -+ val |= BCM54810_SHD_CLK_CTL_GTXCLK_EN; -+ } -+ rc = bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val); -+ if (rc < 0) -+ return rc; -+ -+ return 0; -+} - - static int bcm54210e_config_init(struct phy_device *phydev) - { -@@ -64,45 +103,62 @@ static int bcm54612e_config_init(struct phy_device *phydev) - return 0; - } - --static int bcm54xx_config_clock_delay(struct phy_device *phydev) -+static int bcm54616s_config_init(struct phy_device *phydev) - { - int rc, val; - -- /* handling PHY's internal RX clock delay */ -+ if (phydev->interface != PHY_INTERFACE_MODE_SGMII && -+ phydev->interface != PHY_INTERFACE_MODE_1000BASEX) -+ return 0; -+ -+ /* Ensure proper interface mode is selected. */ -+ /* Disable RGMII mode */ - val = bcm54xx_auxctl_read(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC); -+ if (val < 0) -+ return val; -+ val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN; - val |= MII_BCM54XX_AUXCTL_MISC_WREN; -- if (phydev->interface == PHY_INTERFACE_MODE_RGMII || -- phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) { -- /* Disable RGMII RXC-RXD skew */ -- val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; -- } -- if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || -- phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) { -- /* Enable RGMII RXC-RXD skew */ -- val |= MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; -- } - rc = bcm54xx_auxctl_write(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC, - val); - if (rc < 0) - return rc; - -- /* handling PHY's internal TX clock delay */ -- val = bcm_phy_read_shadow(phydev, BCM54810_SHD_CLK_CTL); -- if (phydev->interface == PHY_INTERFACE_MODE_RGMII || -- phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) { -- /* Disable internal TX clock delay */ -- val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN; -- } -- if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || -- phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) { -- /* Enable internal TX clock delay */ -- val |= BCM54810_SHD_CLK_CTL_GTXCLK_EN; -- } -- rc = bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val); -+ /* Select 1000BASE-X register set (primary SerDes) */ -+ val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_MODE); -+ if (val < 0) -+ return val; -+ val |= BCM54XX_SHD_MODE_1000BX; -+ rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val); - if (rc < 0) - return rc; - -- return 0; -+ /* Power down SerDes interface */ -+ rc = phy_set_bits(phydev, MII_BMCR, BMCR_PDOWN); -+ if (rc < 0) -+ return rc; -+ -+ /* Select proper interface mode */ -+ val &= ~BCM54XX_SHD_INTF_SEL_MASK; -+ val |= phydev->interface == PHY_INTERFACE_MODE_SGMII ? -+ BCM54XX_SHD_INTF_SEL_SGMII : -+ BCM54XX_SHD_INTF_SEL_GBIC; -+ rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val); -+ if (rc < 0) -+ return rc; -+ -+ /* Power up SerDes interface */ -+ rc = phy_clear_bits(phydev, MII_BMCR, BMCR_PDOWN); -+ if (rc < 0) -+ return rc; -+ -+ /* Select copper register set */ -+ val &= ~BCM54XX_SHD_MODE_1000BX; -+ rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val); -+ if (rc < 0) -+ return rc; -+ -+ /* Power up copper interface */ -+ return phy_clear_bits(phydev, MII_BMCR, BMCR_PDOWN); - } - - /* Needs SMDSP clock enabled via bcm54xx_phydsp_config() */ -@@ -283,15 +339,21 @@ static int bcm54xx_config_init(struct phy_device *phydev) - - bcm54xx_adjust_rxrefclk(phydev); - -- if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E) { -+ switch (BRCM_PHY_MODEL(phydev)) { -+ case PHY_ID_BCM50610: -+ case PHY_ID_BCM50610M: -+ err = bcm54xx_config_clock_delay(phydev); -+ break; -+ case PHY_ID_BCM54210E: - err = bcm54210e_config_init(phydev); -- if (err) -- return err; -- } else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54612E) { -+ break; -+ case PHY_ID_BCM54612E: - err = bcm54612e_config_init(phydev); -- if (err) -- return err; -- } else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54810) { -+ break; -+ case PHY_ID_BCM54616S: -+ err = bcm54616s_config_init(phydev); -+ break; -+ case PHY_ID_BCM54810: - /* For BCM54810, we need to disable BroadR-Reach function */ - val = bcm_phy_read_exp(phydev, - BCM54810_EXP_BROADREACH_LRE_MISC_CTL); -@@ -299,9 +361,10 @@ static int bcm54xx_config_init(struct phy_device *phydev) - err = bcm_phy_write_exp(phydev, - BCM54810_EXP_BROADREACH_LRE_MISC_CTL, - val); -- if (err < 0) -- return err; -+ break; - } -+ if (err) -+ return err; - - bcm54xx_phydsp_config(phydev); - -@@ -332,6 +395,11 @@ static int bcm54xx_resume(struct phy_device *phydev) - if (ret < 0) - return ret; - -+ /* Upon exiting power down, the PHY remains in an internal reset state -+ * for 40us -+ */ -+ fsleep(40); -+ - return bcm54xx_config_init(phydev); - } - -@@ -475,7 +543,7 @@ static int bcm5481_config_aneg(struct phy_device *phydev) - - static int bcm54616s_probe(struct phy_device *phydev) - { -- int val, intf_sel; -+ int val; - - val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_MODE); - if (val < 0) -@@ -487,8 +555,7 @@ static int bcm54616s_probe(struct phy_device *phydev) - * RGMII-1000Base-X is properly supported, but RGMII-100Base-FX - * support is still missing as of now. - */ -- intf_sel = (val & BCM54XX_SHD_INTF_SEL_MASK) >> 1; -- if (intf_sel == 1) { -+ if ((val & BCM54XX_SHD_INTF_SEL_MASK) == BCM54XX_SHD_INTF_SEL_RGMII) { - val = bcm_phy_read_shadow(phydev, BCM54616S_SHD_100FX_CTRL); - if (val < 0) - return val; -@@ -500,6 +567,8 @@ static int bcm54616s_probe(struct phy_device *phydev) - */ - if (!(val & BCM54616S_100FX_MODE)) - phydev->dev_flags |= PHY_BCM_FLAGS_MODE_1000BX; -+ -+ phydev->port = PORT_FIBRE; - } - - return 0; -diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c -index 423952cb9e1cd..f7a2ec150e542 100644 ---- a/drivers/net/phy/dp83822.c -+++ b/drivers/net/phy/dp83822.c -@@ -555,6 +555,9 @@ static int dp83822_probe(struct phy_device *phydev) - - dp83822_of_init(phydev); - -+ if (dp83822->fx_enabled) -+ phydev->port = PORT_FIBRE; -+ - return 0; - } - -diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c -index b30bc142d82e5..755220c6451fb 100644 ---- a/drivers/net/phy/dp83869.c -+++ b/drivers/net/phy/dp83869.c -@@ -855,6 +855,10 @@ static int dp83869_probe(struct phy_device *phydev) - if (ret) - return ret; - -+ if (dp83869->mode == DP83869_RGMII_100_BASE || -+ dp83869->mode == DP83869_RGMII_1000_BASE) -+ phydev->port = PORT_FIBRE; -+ - return dp83869_config_init(phydev); - } - -diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c -index 0ee23d29c0d42..bde3356a2f86e 100644 ---- a/drivers/net/phy/lxt.c -+++ b/drivers/net/phy/lxt.c -@@ -292,6 +292,7 @@ static int lxt973_probe(struct phy_device *phydev) - phy_write(phydev, MII_BMCR, val); - /* Remember that the port is in fiber mode. */ - phydev->priv = lxt973_probe; -+ phydev->port = PORT_FIBRE; - } else { - phydev->priv = NULL; - } -diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c -index 620052c023a56..2afef45d15b12 100644 ---- a/drivers/net/phy/marvell.c -+++ b/drivers/net/phy/marvell.c -@@ -1552,6 +1552,7 @@ static int marvell_read_status_page(struct phy_device *phydev, int page) - phydev->asym_pause = 0; - phydev->speed = SPEED_UNKNOWN; - phydev->duplex = DUPLEX_UNKNOWN; -+ phydev->port = fiber ? PORT_FIBRE : PORT_TP; - - if (phydev->autoneg == AUTONEG_ENABLE) - err = marvell_read_status_page_an(phydev, fiber, status); -diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c -index 1901ba277413d..b1bb9b8e1e4ed 100644 ---- a/drivers/net/phy/marvell10g.c -+++ b/drivers/net/phy/marvell10g.c -@@ -631,6 +631,7 @@ static int mv3310_read_status_10gbaser(struct phy_device *phydev) - phydev->link = 1; - phydev->speed = SPEED_10000; - phydev->duplex = DUPLEX_FULL; -+ phydev->port = PORT_FIBRE; - - return 0; - } -@@ -690,6 +691,7 @@ static int mv3310_read_status_copper(struct phy_device *phydev) - - phydev->duplex = cssr1 & MV_PCS_CSSR1_DUPLEX_FULL ? - DUPLEX_FULL : DUPLEX_HALF; -+ phydev->port = PORT_TP; - phydev->mdix = cssr1 & MV_PCS_CSSR1_MDIX ? - ETH_TP_MDI_X : ETH_TP_MDI; - -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index 57f8021b70af5..a6c691938f946 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -341,14 +341,19 @@ static int kszphy_config_init(struct phy_device *phydev) - return kszphy_config_reset(phydev); - } - -+static int ksz8041_fiber_mode(struct phy_device *phydev) -+{ -+ struct device_node *of_node = phydev->mdio.dev.of_node; -+ -+ return of_property_read_bool(of_node, "micrel,fiber-mode"); -+} -+ - static int ksz8041_config_init(struct phy_device *phydev) - { - __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, }; - -- struct device_node *of_node = phydev->mdio.dev.of_node; -- - /* Limit supported and advertised modes in fiber mode */ -- if (of_property_read_bool(of_node, "micrel,fiber-mode")) { -+ if (ksz8041_fiber_mode(phydev)) { - phydev->dev_flags |= MICREL_PHY_FXEN; - linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, mask); - linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Half_BIT, mask); -@@ -1176,6 +1181,9 @@ static int kszphy_probe(struct phy_device *phydev) - } - } - -+ if (ksz8041_fiber_mode(phydev)) -+ phydev->port = PORT_FIBRE; -+ - /* Support legacy board-file configuration */ - if (phydev->dev_flags & MICREL_PHY_50MHZ_CLK) { - priv->rmii_ref_clk_sel = true; -diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c -index b79c4068ee619..c93c295db3dc2 100644 ---- a/drivers/net/phy/phy.c -+++ b/drivers/net/phy/phy.c -@@ -310,7 +310,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev, - if (phydev->interface == PHY_INTERFACE_MODE_MOCA) - cmd->base.port = PORT_BNC; - else -- cmd->base.port = PORT_MII; -+ cmd->base.port = phydev->port; - cmd->base.transceiver = phy_is_internal(phydev) ? - XCVR_INTERNAL : XCVR_EXTERNAL; - cmd->base.phy_address = phydev->mdio.addr; -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 1c6ae845e03f2..d2fd54e4c6123 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -576,6 +576,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, - dev->pause = 0; - dev->asym_pause = 0; - dev->link = 0; -+ dev->port = PORT_TP; - dev->interface = PHY_INTERFACE_MODE_GMII; - - dev->autoneg = AUTONEG_ENABLE; -@@ -1382,6 +1383,14 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, - - phydev->state = PHY_READY; - -+ /* Port is set to PORT_TP by default and the actual PHY driver will set -+ * it to different value depending on the PHY configuration. If we have -+ * the generic PHY driver we can't figure it out, thus set the old -+ * legacy PORT_MII value. -+ */ -+ if (using_genphy) -+ phydev->port = PORT_MII; -+ - /* Initial carrier state is off as the phy is about to be - * (re)initialized. - */ -diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c -index 84f6e197f965d..add9156601af8 100644 ---- a/drivers/net/phy/phylink.c -+++ b/drivers/net/phy/phylink.c -@@ -472,7 +472,7 @@ static void phylink_major_config(struct phylink *pl, bool restart, - err = pl->mac_ops->mac_finish(pl->config, pl->cur_link_an_mode, - state->interface); - if (err < 0) -- phylink_err(pl, "mac_prepare failed: %pe\n", -+ phylink_err(pl, "mac_finish failed: %pe\n", - ERR_PTR(err)); - } - } -diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c -index 02e6bbb17b15d..8d1f69dad6031 100644 ---- a/drivers/net/usb/cdc-phonet.c -+++ b/drivers/net/usb/cdc-phonet.c -@@ -387,6 +387,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i - - err = register_netdev(dev); - if (err) { -+ /* Set disconnected flag so that disconnect() returns early. */ -+ pnd->disconnected = 1; - usb_driver_release_interface(&usbpn_driver, data_intf); - goto out; - } -diff --git a/drivers/net/veth.c b/drivers/net/veth.c -index 02bfcdf50a7ac..36abe756282ea 100644 ---- a/drivers/net/veth.c -+++ b/drivers/net/veth.c -@@ -301,8 +301,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) - if (rxq < rcv->real_num_rx_queues) { - rq = &rcv_priv->rq[rxq]; - rcv_xdp = rcu_access_pointer(rq->xdp_prog); -- if (rcv_xdp) -- skb_record_rx_queue(skb, rxq); -+ skb_record_rx_queue(skb, rxq); - } - - skb_tx_timestamp(skb); -diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c -index dca97cd7c4e75..7eac6a3e1cdee 100644 ---- a/drivers/net/wan/fsl_ucc_hdlc.c -+++ b/drivers/net/wan/fsl_ucc_hdlc.c -@@ -204,14 +204,18 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) - priv->rx_skbuff = kcalloc(priv->rx_ring_size, - sizeof(*priv->rx_skbuff), - GFP_KERNEL); -- if (!priv->rx_skbuff) -+ if (!priv->rx_skbuff) { -+ ret = -ENOMEM; - goto free_ucc_pram; -+ } - - priv->tx_skbuff = kcalloc(priv->tx_ring_size, - sizeof(*priv->tx_skbuff), - GFP_KERNEL); -- if (!priv->tx_skbuff) -+ if (!priv->tx_skbuff) { -+ ret = -ENOMEM; - goto free_rx_skbuff; -+ } - - priv->skb_curtx = 0; - priv->skb_dirtytx = 0; -diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c -index 4aaa6388b9ee0..5a6a945f6c814 100644 ---- a/drivers/net/wan/hdlc_x25.c -+++ b/drivers/net/wan/hdlc_x25.c -@@ -23,6 +23,8 @@ - - struct x25_state { - x25_hdlc_proto settings; -+ bool up; -+ spinlock_t up_lock; /* Protects "up" */ - }; - - static int x25_ioctl(struct net_device *dev, struct ifreq *ifr); -@@ -104,6 +106,8 @@ static void x25_data_transmit(struct net_device *dev, struct sk_buff *skb) - - static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) - { -+ hdlc_device *hdlc = dev_to_hdlc(dev); -+ struct x25_state *x25st = state(hdlc); - int result; - - /* There should be a pseudo header of 1 byte added by upper layers. -@@ -114,11 +118,19 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) - return NETDEV_TX_OK; - } - -+ spin_lock_bh(&x25st->up_lock); -+ if (!x25st->up) { -+ spin_unlock_bh(&x25st->up_lock); -+ kfree_skb(skb); -+ return NETDEV_TX_OK; -+ } -+ - switch (skb->data[0]) { - case X25_IFACE_DATA: /* Data to be transmitted */ - skb_pull(skb, 1); - if ((result = lapb_data_request(dev, skb)) != LAPB_OK) - dev_kfree_skb(skb); -+ spin_unlock_bh(&x25st->up_lock); - return NETDEV_TX_OK; - - case X25_IFACE_CONNECT: -@@ -147,6 +159,7 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) - break; - } - -+ spin_unlock_bh(&x25st->up_lock); - dev_kfree_skb(skb); - return NETDEV_TX_OK; - } -@@ -164,6 +177,7 @@ static int x25_open(struct net_device *dev) - .data_transmit = x25_data_transmit, - }; - hdlc_device *hdlc = dev_to_hdlc(dev); -+ struct x25_state *x25st = state(hdlc); - struct lapb_parms_struct params; - int result; - -@@ -190,6 +204,10 @@ static int x25_open(struct net_device *dev) - if (result != LAPB_OK) - return -EINVAL; - -+ spin_lock_bh(&x25st->up_lock); -+ x25st->up = true; -+ spin_unlock_bh(&x25st->up_lock); -+ - return 0; - } - -@@ -197,6 +215,13 @@ static int x25_open(struct net_device *dev) - - static void x25_close(struct net_device *dev) - { -+ hdlc_device *hdlc = dev_to_hdlc(dev); -+ struct x25_state *x25st = state(hdlc); -+ -+ spin_lock_bh(&x25st->up_lock); -+ x25st->up = false; -+ spin_unlock_bh(&x25st->up_lock); -+ - lapb_unregister(dev); - } - -@@ -205,15 +230,28 @@ static void x25_close(struct net_device *dev) - static int x25_rx(struct sk_buff *skb) - { - struct net_device *dev = skb->dev; -+ hdlc_device *hdlc = dev_to_hdlc(dev); -+ struct x25_state *x25st = state(hdlc); - - if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) { - dev->stats.rx_dropped++; - return NET_RX_DROP; - } - -- if (lapb_data_received(dev, skb) == LAPB_OK) -+ spin_lock_bh(&x25st->up_lock); -+ if (!x25st->up) { -+ spin_unlock_bh(&x25st->up_lock); -+ kfree_skb(skb); -+ dev->stats.rx_dropped++; -+ return NET_RX_DROP; -+ } -+ -+ if (lapb_data_received(dev, skb) == LAPB_OK) { -+ spin_unlock_bh(&x25st->up_lock); - return NET_RX_SUCCESS; -+ } - -+ spin_unlock_bh(&x25st->up_lock); - dev->stats.rx_errors++; - dev_kfree_skb_any(skb); - return NET_RX_DROP; -@@ -298,6 +336,8 @@ static int x25_ioctl(struct net_device *dev, struct ifreq *ifr) - return result; - - memcpy(&state(hdlc)->settings, &new_settings, size); -+ state(hdlc)->up = false; -+ spin_lock_init(&state(hdlc)->up_lock); - - /* There's no header_ops so hard_header_len should be 0. */ - dev->hard_header_len = 0; -diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c -index 9bf13994c036b..680c899a96d77 100644 ---- a/drivers/net/wireless/mediatek/mt76/dma.c -+++ b/drivers/net/wireless/mediatek/mt76/dma.c -@@ -345,7 +345,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, - }; - struct ieee80211_hw *hw; - int len, n = 0, ret = -ENOMEM; -- struct mt76_queue_entry e; - struct mt76_txwi_cache *t; - struct sk_buff *iter; - dma_addr_t addr; -@@ -387,6 +386,11 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, - } - tx_info.nbuf = n; - -+ if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) { -+ ret = -ENOMEM; -+ goto unmap; -+ } -+ - dma_sync_single_for_cpu(dev->dev, t->dma_addr, dev->drv->txwi_size, - DMA_TO_DEVICE); - ret = dev->drv->tx_prepare_skb(dev, txwi, q->qid, wcid, sta, &tx_info); -@@ -395,11 +399,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, - if (ret < 0) - goto unmap; - -- if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) { -- ret = -ENOMEM; -- goto unmap; -- } -- - return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf, - tx_info.info, tx_info.skb, t); - -@@ -415,9 +414,7 @@ free: - dev->test.tx_done--; - #endif - -- e.skb = tx_info.skb; -- e.txwi = t; -- dev->drv->tx_complete_skb(dev, &e); -+ dev_kfree_skb(tx_info.skb); - mt76_put_txwi(dev, t); - return ret; - } -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c -index 1b4d65310b887..c9dd6867e1251 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c -@@ -957,11 +957,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, - } - txp->nbuf = nbuf; - -- /* pass partial skb header to fw */ -- tx_info->buf[1].len = MT_CT_PARSE_LEN; -- tx_info->buf[1].skip_unmap = true; -- tx_info->nbuf = MT_CT_DMA_BUF_NUM; -- - txp->flags = cpu_to_le16(MT_CT_INFO_APPLY_TXD | MT_CT_INFO_FROM_HOST); - - if (!key) -@@ -999,6 +994,11 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, - txp->rept_wds_wcid = cpu_to_le16(0x3ff); - tx_info->skb = DMA_DUMMY_DATA; - -+ /* pass partial skb header to fw */ -+ tx_info->buf[1].len = MT_CT_PARSE_LEN; -+ tx_info->buf[1].skip_unmap = true; -+ tx_info->nbuf = MT_CT_DMA_BUF_NUM; -+ - return 0; - } - -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index f848ba16427eb..6199bce5d3a4f 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -366,6 +366,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved) - return true; - - nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD; -+ nvme_req(req)->flags |= NVME_REQ_CANCELLED; - blk_mq_complete_request(req); - return true; - } -@@ -1425,7 +1426,7 @@ static int nvme_identify_ns(struct nvme_ctrl *ctrl, unsigned nsid, - goto out_free_id; - } - -- error = -ENODEV; -+ error = NVME_SC_INVALID_NS | NVME_SC_DNR; - if ((*id)->ncap == 0) /* namespace not allocated or attached */ - goto out_free_id; - -@@ -4011,7 +4012,7 @@ static void nvme_ns_remove_by_nsid(struct nvme_ctrl *ctrl, u32 nsid) - static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids) - { - struct nvme_id_ns *id; -- int ret = -ENODEV; -+ int ret = NVME_SC_INVALID_NS | NVME_SC_DNR; - - if (test_bit(NVME_NS_DEAD, &ns->flags)) - goto out; -@@ -4020,7 +4021,7 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids) - if (ret) - goto out; - -- ret = -ENODEV; -+ ret = NVME_SC_INVALID_NS | NVME_SC_DNR; - if (!nvme_ns_ids_equal(&ns->head->ids, ids)) { - dev_err(ns->ctrl->device, - "identifiers changed for nsid %d\n", ns->head->ns_id); -@@ -4038,7 +4039,7 @@ out: - * - * TODO: we should probably schedule a delayed retry here. - */ -- if (ret && ret != -ENOMEM && !(ret > 0 && !(ret & NVME_SC_DNR))) -+ if (ret > 0 && (ret & NVME_SC_DNR)) - nvme_ns_remove(ns); - } - -@@ -4068,6 +4069,12 @@ static void nvme_validate_or_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) - nsid); - break; - } -+ if (!nvme_multi_css(ctrl)) { -+ dev_warn(ctrl->device, -+ "command set not reported for nsid: %d\n", -+ nsid); -+ break; -+ } - nvme_alloc_ns(ctrl, nsid, &ids); - break; - default: -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index 7ec6869b3e5b1..ca75338f23675 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -1956,7 +1956,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req) - sizeof(op->rsp_iu), DMA_FROM_DEVICE); - - if (opstate == FCPOP_STATE_ABORTED) -- status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1); -+ status = cpu_to_le16(NVME_SC_HOST_ABORTED_CMD << 1); - else if (freq->status) { - status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1); - dev_info(ctrl->ctrl.device, -@@ -2443,6 +2443,7 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved) - struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl); - struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req); - -+ op->nreq.flags |= NVME_REQ_CANCELLED; - __nvme_fc_abort_op(ctrl, op); - return true; - } -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index 806a5d071ef65..514dfd6300353 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -3242,6 +3242,7 @@ static const struct pci_device_id nvme_id_table[] = { - .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, - { PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */ - .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY | -+ NVME_QUIRK_DISABLE_WRITE_ZEROES| - NVME_QUIRK_IGNORE_DEV_SUBNQN, }, - { PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */ - .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, }, -diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c -index 06b6b742bb213..6c1f3ab7649c7 100644 ---- a/drivers/nvme/target/rdma.c -+++ b/drivers/nvme/target/rdma.c -@@ -802,9 +802,8 @@ static void nvmet_rdma_write_data_done(struct ib_cq *cq, struct ib_wc *wc) - nvmet_req_uninit(&rsp->req); - nvmet_rdma_release_rsp(rsp); - if (wc->status != IB_WC_WR_FLUSH_ERR) { -- pr_info("RDMA WRITE for CQE 0x%p failed with status %s (%d).\n", -- wc->wr_cqe, ib_wc_status_msg(wc->status), -- wc->status); -+ pr_info("RDMA WRITE for CQE failed with status %s (%d).\n", -+ ib_wc_status_msg(wc->status), wc->status); - nvmet_rdma_error_comp(queue); - } - return; -diff --git a/drivers/platform/x86/dell-wmi-sysman/enum-attributes.c b/drivers/platform/x86/dell-wmi-sysman/enum-attributes.c -index 80f4b7785c6c9..091e48c217ed8 100644 ---- a/drivers/platform/x86/dell-wmi-sysman/enum-attributes.c -+++ b/drivers/platform/x86/dell-wmi-sysman/enum-attributes.c -@@ -185,5 +185,8 @@ void exit_enum_attributes(void) - sysfs_remove_group(wmi_priv.enumeration_data[instance_id].attr_name_kobj, - &enumeration_attr_group); - } -+ wmi_priv.enumeration_instances_count = 0; -+ - kfree(wmi_priv.enumeration_data); -+ wmi_priv.enumeration_data = NULL; - } -diff --git a/drivers/platform/x86/dell-wmi-sysman/int-attributes.c b/drivers/platform/x86/dell-wmi-sysman/int-attributes.c -index 75aedbb733be2..8a49ba6e44f9a 100644 ---- a/drivers/platform/x86/dell-wmi-sysman/int-attributes.c -+++ b/drivers/platform/x86/dell-wmi-sysman/int-attributes.c -@@ -175,5 +175,8 @@ void exit_int_attributes(void) - sysfs_remove_group(wmi_priv.integer_data[instance_id].attr_name_kobj, - &integer_attr_group); - } -+ wmi_priv.integer_instances_count = 0; -+ - kfree(wmi_priv.integer_data); -+ wmi_priv.integer_data = NULL; - } -diff --git a/drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c b/drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c -index 3abcd95477c07..834b3e82ad9f9 100644 ---- a/drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c -+++ b/drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c -@@ -183,5 +183,8 @@ void exit_po_attributes(void) - sysfs_remove_group(wmi_priv.po_data[instance_id].attr_name_kobj, - &po_attr_group); - } -+ wmi_priv.po_instances_count = 0; -+ - kfree(wmi_priv.po_data); -+ wmi_priv.po_data = NULL; - } -diff --git a/drivers/platform/x86/dell-wmi-sysman/string-attributes.c b/drivers/platform/x86/dell-wmi-sysman/string-attributes.c -index ac75dce88a4c4..552537852459a 100644 ---- a/drivers/platform/x86/dell-wmi-sysman/string-attributes.c -+++ b/drivers/platform/x86/dell-wmi-sysman/string-attributes.c -@@ -155,5 +155,8 @@ void exit_str_attributes(void) - sysfs_remove_group(wmi_priv.str_data[instance_id].attr_name_kobj, - &str_attr_group); - } -+ wmi_priv.str_instances_count = 0; -+ - kfree(wmi_priv.str_data); -+ wmi_priv.str_data = NULL; - } -diff --git a/drivers/platform/x86/dell-wmi-sysman/sysman.c b/drivers/platform/x86/dell-wmi-sysman/sysman.c -index cb81010ba1a21..7410ccae650c2 100644 ---- a/drivers/platform/x86/dell-wmi-sysman/sysman.c -+++ b/drivers/platform/x86/dell-wmi-sysman/sysman.c -@@ -210,25 +210,17 @@ static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot); - */ - static int create_attributes_level_sysfs_files(void) - { -- int ret = sysfs_create_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); -+ int ret; - -- if (ret) { -- pr_debug("could not create reset_bios file\n"); -+ ret = sysfs_create_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); -+ if (ret) - return ret; -- } - - ret = sysfs_create_file(&wmi_priv.main_dir_kset->kobj, &pending_reboot.attr); -- if (ret) { -- pr_debug("could not create changing_pending_reboot file\n"); -- sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); -- } -- return ret; --} -+ if (ret) -+ return ret; - --static void release_reset_bios_data(void) --{ -- sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); -- sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &pending_reboot.attr); -+ return 0; - } - - static ssize_t wmi_sysman_attr_show(struct kobject *kobj, struct attribute *attr, -@@ -373,8 +365,6 @@ static void destroy_attribute_objs(struct kset *kset) - */ - static void release_attributes_data(void) - { -- release_reset_bios_data(); -- - mutex_lock(&wmi_priv.mutex); - exit_enum_attributes(); - exit_int_attributes(); -@@ -386,11 +376,13 @@ static void release_attributes_data(void) - wmi_priv.authentication_dir_kset = NULL; - } - if (wmi_priv.main_dir_kset) { -+ sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); -+ sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &pending_reboot.attr); - destroy_attribute_objs(wmi_priv.main_dir_kset); - kset_unregister(wmi_priv.main_dir_kset); -+ wmi_priv.main_dir_kset = NULL; - } - mutex_unlock(&wmi_priv.mutex); -- - } - - /** -@@ -497,7 +489,6 @@ nextobj: - - err_attr_init: - mutex_unlock(&wmi_priv.mutex); -- release_attributes_data(); - kfree(obj); - return retval; - } -@@ -513,102 +504,91 @@ static int __init sysman_init(void) - } - - ret = init_bios_attr_set_interface(); -- if (ret || !wmi_priv.bios_attr_wdev) { -- pr_debug("failed to initialize set interface\n"); -- goto fail_set_interface; -- } -+ if (ret) -+ return ret; - - ret = init_bios_attr_pass_interface(); -- if (ret || !wmi_priv.password_attr_wdev) { -- pr_debug("failed to initialize pass interface\n"); -- goto fail_pass_interface; -+ if (ret) -+ goto err_exit_bios_attr_set_interface; -+ -+ if (!wmi_priv.bios_attr_wdev || !wmi_priv.password_attr_wdev) { -+ pr_debug("failed to find set or pass interface\n"); -+ ret = -ENODEV; -+ goto err_exit_bios_attr_pass_interface; - } - - ret = class_register(&firmware_attributes_class); - if (ret) -- goto fail_class; -+ goto err_exit_bios_attr_pass_interface; - - wmi_priv.class_dev = device_create(&firmware_attributes_class, NULL, MKDEV(0, 0), - NULL, "%s", DRIVER_NAME); - if (IS_ERR(wmi_priv.class_dev)) { - ret = PTR_ERR(wmi_priv.class_dev); -- goto fail_classdev; -+ goto err_unregister_class; - } - - wmi_priv.main_dir_kset = kset_create_and_add("attributes", NULL, - &wmi_priv.class_dev->kobj); - if (!wmi_priv.main_dir_kset) { - ret = -ENOMEM; -- goto fail_main_kset; -+ goto err_destroy_classdev; - } - - wmi_priv.authentication_dir_kset = kset_create_and_add("authentication", NULL, - &wmi_priv.class_dev->kobj); - if (!wmi_priv.authentication_dir_kset) { - ret = -ENOMEM; -- goto fail_authentication_kset; -+ goto err_release_attributes_data; - } - - ret = create_attributes_level_sysfs_files(); - if (ret) { - pr_debug("could not create reset BIOS attribute\n"); -- goto fail_reset_bios; -+ goto err_release_attributes_data; - } - - ret = init_bios_attributes(ENUM, DELL_WMI_BIOS_ENUMERATION_ATTRIBUTE_GUID); - if (ret) { - pr_debug("failed to populate enumeration type attributes\n"); -- goto fail_create_group; -+ goto err_release_attributes_data; - } - - ret = init_bios_attributes(INT, DELL_WMI_BIOS_INTEGER_ATTRIBUTE_GUID); - if (ret) { - pr_debug("failed to populate integer type attributes\n"); -- goto fail_create_group; -+ goto err_release_attributes_data; - } - - ret = init_bios_attributes(STR, DELL_WMI_BIOS_STRING_ATTRIBUTE_GUID); - if (ret) { - pr_debug("failed to populate string type attributes\n"); -- goto fail_create_group; -+ goto err_release_attributes_data; - } - - ret = init_bios_attributes(PO, DELL_WMI_BIOS_PASSOBJ_ATTRIBUTE_GUID); - if (ret) { - pr_debug("failed to populate pass object type attributes\n"); -- goto fail_create_group; -+ goto err_release_attributes_data; - } - - return 0; - --fail_create_group: -+err_release_attributes_data: - release_attributes_data(); - --fail_reset_bios: -- if (wmi_priv.authentication_dir_kset) { -- kset_unregister(wmi_priv.authentication_dir_kset); -- wmi_priv.authentication_dir_kset = NULL; -- } -- --fail_authentication_kset: -- if (wmi_priv.main_dir_kset) { -- kset_unregister(wmi_priv.main_dir_kset); -- wmi_priv.main_dir_kset = NULL; -- } -- --fail_main_kset: -+err_destroy_classdev: - device_destroy(&firmware_attributes_class, MKDEV(0, 0)); - --fail_classdev: -+err_unregister_class: - class_unregister(&firmware_attributes_class); - --fail_class: -+err_exit_bios_attr_pass_interface: - exit_bios_attr_pass_interface(); - --fail_pass_interface: -+err_exit_bios_attr_set_interface: - exit_bios_attr_set_interface(); - --fail_set_interface: - return ret; - } - -diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c -index 30a9062d2b4b8..a90c32d072da3 100644 ---- a/drivers/platform/x86/intel-vbtn.c -+++ b/drivers/platform/x86/intel-vbtn.c -@@ -47,8 +47,16 @@ static const struct key_entry intel_vbtn_keymap[] = { - }; - - static const struct key_entry intel_vbtn_switchmap[] = { -- { KE_SW, 0xCA, { .sw = { SW_DOCK, 1 } } }, /* Docked */ -- { KE_SW, 0xCB, { .sw = { SW_DOCK, 0 } } }, /* Undocked */ -+ /* -+ * SW_DOCK should only be reported for docking stations, but DSDTs using the -+ * intel-vbtn code, always seem to use this for 2-in-1s / convertibles and set -+ * SW_DOCK=1 when in laptop-mode (in tandem with setting SW_TABLET_MODE=0). -+ * This causes userspace to think the laptop is docked to a port-replicator -+ * and to disable suspend-on-lid-close, which is undesirable. -+ * Map the dock events to KEY_IGNORE to avoid this broken SW_DOCK reporting. -+ */ -+ { KE_IGNORE, 0xCA, { .sw = { SW_DOCK, 1 } } }, /* Docked */ -+ { KE_IGNORE, 0xCB, { .sw = { SW_DOCK, 0 } } }, /* Undocked */ - { KE_SW, 0xCC, { .sw = { SW_TABLET_MODE, 1 } } }, /* Tablet */ - { KE_SW, 0xCD, { .sw = { SW_TABLET_MODE, 0 } } }, /* Laptop */ - }; -diff --git a/drivers/platform/x86/intel_pmt_crashlog.c b/drivers/platform/x86/intel_pmt_crashlog.c -index 97dd749c8290d..92d315a16cfd3 100644 ---- a/drivers/platform/x86/intel_pmt_crashlog.c -+++ b/drivers/platform/x86/intel_pmt_crashlog.c -@@ -23,18 +23,17 @@ - #define CRASH_TYPE_OOBMSM 1 - - /* Control Flags */ --#define CRASHLOG_FLAG_DISABLE BIT(27) -+#define CRASHLOG_FLAG_DISABLE BIT(28) - - /* -- * Bits 28 and 29 control the state of bit 31. -+ * Bits 29 and 30 control the state of bit 31. - * -- * Bit 28 will clear bit 31, if set, allowing a new crashlog to be captured. -- * Bit 29 will immediately trigger a crashlog to be generated, setting bit 31. -- * Bit 30 is read-only and reserved as 0. -+ * Bit 29 will clear bit 31, if set, allowing a new crashlog to be captured. -+ * Bit 30 will immediately trigger a crashlog to be generated, setting bit 31. - * Bit 31 is the read-only status with a 1 indicating log is complete. - */ --#define CRASHLOG_FLAG_TRIGGER_CLEAR BIT(28) --#define CRASHLOG_FLAG_TRIGGER_EXECUTE BIT(29) -+#define CRASHLOG_FLAG_TRIGGER_CLEAR BIT(29) -+#define CRASHLOG_FLAG_TRIGGER_EXECUTE BIT(30) - #define CRASHLOG_FLAG_TRIGGER_COMPLETE BIT(31) - #define CRASHLOG_FLAG_TRIGGER_MASK GENMASK(31, 28) - -diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c -index 37a2abbe85c72..0fd3da36f62e0 100644 ---- a/drivers/regulator/qcom-rpmh-regulator.c -+++ b/drivers/regulator/qcom-rpmh-regulator.c -@@ -726,8 +726,8 @@ static const struct rpmh_vreg_hw_data pmic5_ftsmps510 = { - static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = { - .regulator_type = VRM, - .ops = &rpmh_regulator_vrm_ops, -- .voltage_range = REGULATOR_LINEAR_RANGE(2800000, 0, 4, 16000), -- .n_voltages = 5, -+ .voltage_range = REGULATOR_LINEAR_RANGE(320000, 0, 235, 16000), -+ .n_voltages = 236, - .pmic_mode_map = pmic_mode_map_pmic5_smps, - .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode, - }; -@@ -901,7 +901,7 @@ static const struct rpmh_vreg_init_data pm8350_vreg_data[] = { - }; - - static const struct rpmh_vreg_init_data pm8350c_vreg_data[] = { -- RPMH_VREG("smps1", "smp%s1", &pmic5_hfsmps510, "vdd-s1"), -+ RPMH_VREG("smps1", "smp%s1", &pmic5_hfsmps515, "vdd-s1"), - RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps510, "vdd-s2"), - RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps510, "vdd-s3"), - RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps510, "vdd-s4"), -diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c -index 6e23dc3209feb..340d435ac0ce3 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_base.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c -@@ -7789,14 +7789,18 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) - ioc->pend_os_device_add_sz++; - ioc->pend_os_device_add = kzalloc(ioc->pend_os_device_add_sz, - GFP_KERNEL); -- if (!ioc->pend_os_device_add) -+ if (!ioc->pend_os_device_add) { -+ r = -ENOMEM; - goto out_free_resources; -+ } - - ioc->device_remove_in_progress_sz = ioc->pend_os_device_add_sz; - ioc->device_remove_in_progress = - kzalloc(ioc->device_remove_in_progress_sz, GFP_KERNEL); -- if (!ioc->device_remove_in_progress) -+ if (!ioc->device_remove_in_progress) { -+ r = -ENOMEM; - goto out_free_resources; -+ } - - ioc->fwfault_debug = mpt3sas_fwfault_debug; - -diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c -index 47ad64b066236..69c5b5ee2169b 100644 ---- a/drivers/scsi/qedi/qedi_main.c -+++ b/drivers/scsi/qedi/qedi_main.c -@@ -1675,6 +1675,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi) - if (!qedi->global_queues[i]) { - QEDI_ERR(&qedi->dbg_ctx, - "Unable to allocation global queue %d.\n", i); -+ status = -ENOMEM; - goto mem_alloc_failure; - } - -diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c -index 0d09480b66cd3..17f541030f5be 100644 ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -3223,8 +3223,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, - if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) || - (cmd->sess && cmd->sess->deleted)) { - cmd->state = QLA_TGT_STATE_PROCESSED; -- res = 0; -- goto free; -+ return 0; - } - - ql_dbg_qp(ql_dbg_tgt, qpair, 0xe018, -@@ -3235,8 +3234,9 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, - - res = qlt_pre_xmit_response(cmd, &prm, xmit_type, scsi_status, - &full_req_cnt); -- if (unlikely(res != 0)) -- goto free; -+ if (unlikely(res != 0)) { -+ return res; -+ } - - spin_lock_irqsave(qpair->qp_lock_ptr, flags); - -@@ -3256,8 +3256,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, - vha->flags.online, qla2x00_reset_active(vha), - cmd->reset_count, qpair->chip_reset); - spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); -- res = 0; -- goto free; -+ return 0; - } - - /* Does F/W have an IOCBs for this request */ -@@ -3360,8 +3359,6 @@ out_unmap_unlock: - qlt_unmap_sg(vha, cmd); - spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); - --free: -- vha->hw->tgt.tgt_ops->free_cmd(cmd); - return res; - } - EXPORT_SYMBOL(qlt_xmit_response); -diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -index b55fc768a2a7a..8b4890cdd4ca1 100644 ---- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c -+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -@@ -644,7 +644,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd) - { - struct qla_tgt_cmd *cmd = container_of(se_cmd, - struct qla_tgt_cmd, se_cmd); -- struct scsi_qla_host *vha = cmd->vha; - - if (cmd->aborted) { - /* Cmd can loop during Q-full. tcm_qla2xxx_aborted_task -@@ -657,7 +656,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd) - cmd->se_cmd.transport_state, - cmd->se_cmd.t_state, - cmd->se_cmd.se_cmd_flags); -- vha->hw->tgt.tgt_ops->free_cmd(cmd); - return 0; - } - -@@ -685,7 +683,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) - { - struct qla_tgt_cmd *cmd = container_of(se_cmd, - struct qla_tgt_cmd, se_cmd); -- struct scsi_qla_host *vha = cmd->vha; - int xmit_type = QLA_TGT_XMIT_STATUS; - - if (cmd->aborted) { -@@ -699,7 +696,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) - cmd, kref_read(&cmd->se_cmd.cmd_kref), - cmd->se_cmd.transport_state, cmd->se_cmd.t_state, - cmd->se_cmd.se_cmd_flags); -- vha->hw->tgt.tgt_ops->free_cmd(cmd); - return 0; - } - cmd->bufflen = se_cmd->data_length; -diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c -index 2206b1e4b7740..e55201f64c100 100644 ---- a/drivers/scsi/ufs/ufs-qcom.c -+++ b/drivers/scsi/ufs/ufs-qcom.c -@@ -253,12 +253,17 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba) - { - int ret = 0; - struct ufs_qcom_host *host = ufshcd_get_variant(hba); -+ bool reenable_intr = false; - - if (!host->core_reset) { - dev_warn(hba->dev, "%s: reset control not set\n", __func__); - goto out; - } - -+ reenable_intr = hba->is_irq_enabled; -+ disable_irq(hba->irq); -+ hba->is_irq_enabled = false; -+ - ret = reset_control_assert(host->core_reset); - if (ret) { - dev_err(hba->dev, "%s: core_reset assert failed, err = %d\n", -@@ -280,6 +285,11 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba) - - usleep_range(1000, 1100); - -+ if (reenable_intr) { -+ enable_irq(hba->irq); -+ hba->is_irq_enabled = true; -+ } -+ - out: - return ret; - } -diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c -index bf1468e5bccba..51143a68a8896 100644 ---- a/drivers/soc/ti/omap_prm.c -+++ b/drivers/soc/ti/omap_prm.c -@@ -332,7 +332,7 @@ static const struct omap_prm_data dra7_prm_data[] = { - { - .name = "l3init", .base = 0x4ae07300, - .pwrstctrl = 0x0, .pwrstst = 0x4, .dmap = &omap_prm_alwon, -- .rstctrl = 0x10, .rstst = 0x14, .rstmap = rst_map_012, -+ .rstctrl = 0x10, .rstst = 0x14, .rstmap = rst_map_01, - .clkdm_name = "pcie" - }, - { -@@ -830,8 +830,12 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev, - reset->prm->data->name, id); - - exit: -- if (reset->clkdm) -+ if (reset->clkdm) { -+ /* At least dra7 iva needs a delay before clkdm idle */ -+ if (has_rstst) -+ udelay(1); - pdata->clkdm_allow_idle(reset->clkdm); -+ } - - return ret; - } -diff --git a/drivers/staging/rtl8192e/Kconfig b/drivers/staging/rtl8192e/Kconfig -index 03fcc23516fd3..6e7d84ac06f50 100644 ---- a/drivers/staging/rtl8192e/Kconfig -+++ b/drivers/staging/rtl8192e/Kconfig -@@ -26,6 +26,7 @@ config RTLLIB_CRYPTO_CCMP - config RTLLIB_CRYPTO_TKIP - tristate "Support for rtllib TKIP crypto" - depends on RTLLIB -+ select CRYPTO - select CRYPTO_LIB_ARC4 - select CRYPTO_MICHAEL_MIC - default y -diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig -index 41645fe6ad48a..ea0efd290c372 100644 ---- a/drivers/xen/Kconfig -+++ b/drivers/xen/Kconfig -@@ -50,11 +50,11 @@ config XEN_BALLOON_MEMORY_HOTPLUG - - SUBSYSTEM=="memory", ACTION=="add", RUN+="/bin/sh -c '[ -f /sys$devpath/state ] && echo online > /sys$devpath/state'" - --config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT -+config XEN_MEMORY_HOTPLUG_LIMIT - int "Hotplugged memory limit (in GiB) for a PV guest" - default 512 - depends on XEN_HAVE_PVMMU -- depends on XEN_BALLOON_MEMORY_HOTPLUG -+ depends on MEMORY_HOTPLUG - help - Maxmium amount of memory (in GiB) that a PV guest can be - expanded to when using memory hotplug. -diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c -index 324f646d6e5e2..02a68b04e43f9 100644 ---- a/fs/btrfs/dev-replace.c -+++ b/fs/btrfs/dev-replace.c -@@ -80,6 +80,9 @@ int btrfs_init_dev_replace(struct btrfs_fs_info *fs_info) - struct btrfs_dev_replace_item *ptr; - u64 src_devid; - -+ if (!dev_root) -+ return 0; -+ - path = btrfs_alloc_path(); - if (!path) { - ret = -ENOMEM; -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 07a2b4f69b10e..3cb73a0d12d0c 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -2300,8 +2300,9 @@ static int btrfs_read_roots(struct btrfs_fs_info *fs_info) - } else { - set_bit(BTRFS_ROOT_TRACK_DIRTY, &root->state); - fs_info->dev_root = root; -- btrfs_init_devices_late(fs_info); - } -+ /* Initialize fs_info for all devices in any case */ -+ btrfs_init_devices_late(fs_info); - - /* If IGNOREDATACSUMS is set don't bother reading the csum root. */ - if (!btrfs_test_opt(fs_info, IGNOREDATACSUMS)) { -@@ -2913,6 +2914,21 @@ int btrfs_start_pre_rw_mount(struct btrfs_fs_info *fs_info) - } - } - -+ /* -+ * btrfs_find_orphan_roots() is responsible for finding all the dead -+ * roots (with 0 refs), flag them with BTRFS_ROOT_DEAD_TREE and load -+ * them into the fs_info->fs_roots_radix tree. This must be done before -+ * calling btrfs_orphan_cleanup() on the tree root. If we don't do it -+ * first, then btrfs_orphan_cleanup() will delete a dead root's orphan -+ * item before the root's tree is deleted - this means that if we unmount -+ * or crash before the deletion completes, on the next mount we will not -+ * delete what remains of the tree because the orphan item does not -+ * exists anymore, which is what tells us we have a pending deletion. -+ */ -+ ret = btrfs_find_orphan_roots(fs_info); -+ if (ret) -+ goto out; -+ - ret = btrfs_cleanup_fs_roots(fs_info); - if (ret) - goto out; -@@ -2972,7 +2988,6 @@ int btrfs_start_pre_rw_mount(struct btrfs_fs_info *fs_info) - } - } - -- ret = btrfs_find_orphan_roots(fs_info); - out: - return ret; - } -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index df25d3e300f07..fe723eadced79 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -2947,11 +2947,13 @@ void btrfs_writepage_endio_finish_ordered(struct page *page, u64 start, - * @bio_offset: offset to the beginning of the bio (in bytes) - * @page: page where is the data to be verified - * @pgoff: offset inside the page -+ * @start: logical offset in the file - * - * The length of such check is always one sector size. - */ - static int check_data_csum(struct inode *inode, struct btrfs_io_bio *io_bio, -- u32 bio_offset, struct page *page, u32 pgoff) -+ u32 bio_offset, struct page *page, u32 pgoff, -+ u64 start) - { - struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); - SHASH_DESC_ON_STACK(shash, fs_info->csum_shash); -@@ -2978,8 +2980,8 @@ static int check_data_csum(struct inode *inode, struct btrfs_io_bio *io_bio, - kunmap_atomic(kaddr); - return 0; - zeroit: -- btrfs_print_data_csum_error(BTRFS_I(inode), page_offset(page) + pgoff, -- csum, csum_expected, io_bio->mirror_num); -+ btrfs_print_data_csum_error(BTRFS_I(inode), start, csum, csum_expected, -+ io_bio->mirror_num); - if (io_bio->device) - btrfs_dev_stat_inc_and_print(io_bio->device, - BTRFS_DEV_STAT_CORRUPTION_ERRS); -@@ -3032,7 +3034,8 @@ int btrfs_verify_data_csum(struct btrfs_io_bio *io_bio, u32 bio_offset, - pg_off += sectorsize, bio_offset += sectorsize) { - int ret; - -- ret = check_data_csum(inode, io_bio, bio_offset, page, pg_off); -+ ret = check_data_csum(inode, io_bio, bio_offset, page, pg_off, -+ page_offset(page) + pg_off); - if (ret < 0) - return -EIO; - } -@@ -7742,7 +7745,8 @@ static blk_status_t btrfs_check_read_dio_bio(struct inode *inode, - ASSERT(pgoff < PAGE_SIZE); - if (uptodate && - (!csum || !check_data_csum(inode, io_bio, -- bio_offset, bvec.bv_page, pgoff))) { -+ bio_offset, bvec.bv_page, -+ pgoff, start))) { - clean_io_failure(fs_info, failure_tree, io_tree, - start, bvec.bv_page, - btrfs_ino(BTRFS_I(inode)), -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index 14ff388fd3bda..f0b9ef13153ad 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -226,7 +226,6 @@ static void __del_qgroup_rb(struct btrfs_fs_info *fs_info, - { - struct btrfs_qgroup_list *list; - -- btrfs_sysfs_del_one_qgroup(fs_info, qgroup); - list_del(&qgroup->dirty); - while (!list_empty(&qgroup->groups)) { - list = list_first_entry(&qgroup->groups, -@@ -243,7 +242,6 @@ static void __del_qgroup_rb(struct btrfs_fs_info *fs_info, - list_del(&list->next_member); - kfree(list); - } -- kfree(qgroup); - } - - /* must be called with qgroup_lock held */ -@@ -569,6 +567,8 @@ void btrfs_free_qgroup_config(struct btrfs_fs_info *fs_info) - qgroup = rb_entry(n, struct btrfs_qgroup, node); - rb_erase(n, &fs_info->qgroup_tree); - __del_qgroup_rb(fs_info, qgroup); -+ btrfs_sysfs_del_one_qgroup(fs_info, qgroup); -+ kfree(qgroup); - } - /* - * We call btrfs_free_qgroup_config() when unmounting -@@ -1578,6 +1578,14 @@ int btrfs_remove_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid) - spin_lock(&fs_info->qgroup_lock); - del_qgroup_rb(fs_info, qgroupid); - spin_unlock(&fs_info->qgroup_lock); -+ -+ /* -+ * Remove the qgroup from sysfs now without holding the qgroup_lock -+ * spinlock, since the sysfs_remove_group() function needs to take -+ * the mutex kernfs_mutex through kernfs_remove_by_name_ns(). -+ */ -+ btrfs_sysfs_del_one_qgroup(fs_info, qgroup); -+ kfree(qgroup); - out: - mutex_unlock(&fs_info->qgroup_ioctl_lock); - return ret; -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index d6c24c8ad7499..93f2b030fb9d4 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -7282,6 +7282,9 @@ static int btrfs_device_init_dev_stats(struct btrfs_device *device, - int item_size; - int i, ret, slot; - -+ if (!device->fs_info->dev_root) -+ return 0; -+ - key.objectid = BTRFS_DEV_STATS_OBJECTID; - key.type = BTRFS_PERSISTENT_ITEM_KEY; - key.offset = device->devid; -diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c -index e027c718ca01a..8ffc40e84a594 100644 ---- a/fs/cachefiles/rdwr.c -+++ b/fs/cachefiles/rdwr.c -@@ -24,17 +24,16 @@ static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode, - container_of(wait, struct cachefiles_one_read, monitor); - struct cachefiles_object *object; - struct fscache_retrieval *op = monitor->op; -- struct wait_bit_key *key = _key; -+ struct wait_page_key *key = _key; - struct page *page = wait->private; - - ASSERT(key); - - _enter("{%lu},%u,%d,{%p,%u}", - monitor->netfs_page->index, mode, sync, -- key->flags, key->bit_nr); -+ key->page, key->bit_nr); - -- if (key->flags != &page->flags || -- key->bit_nr != PG_locked) -+ if (key->page != page || key->bit_nr != PG_locked) - return 0; - - _debug("--- monitor %p %lx ---", page, page->flags); -diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h -index 089a3916c639f..ca1af03e93709 100644 ---- a/fs/cifs/cifsglob.h -+++ b/fs/cifs/cifsglob.h -@@ -915,8 +915,8 @@ struct cifs_ses { - bool binding:1; /* are we binding the session? */ - __u16 session_flags; - __u8 smb3signingkey[SMB3_SIGN_KEY_SIZE]; -- __u8 smb3encryptionkey[SMB3_SIGN_KEY_SIZE]; -- __u8 smb3decryptionkey[SMB3_SIGN_KEY_SIZE]; -+ __u8 smb3encryptionkey[SMB3_ENC_DEC_KEY_SIZE]; -+ __u8 smb3decryptionkey[SMB3_ENC_DEC_KEY_SIZE]; - __u8 preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE]; - - __u8 binding_preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE]; -diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h -index 64fe5a47b5e87..9adc74bd9f8fa 100644 ---- a/fs/cifs/cifspdu.h -+++ b/fs/cifs/cifspdu.h -@@ -147,6 +147,11 @@ - */ - #define SMB3_SIGN_KEY_SIZE (16) - -+/* -+ * Size of the smb3 encryption/decryption keys -+ */ -+#define SMB3_ENC_DEC_KEY_SIZE (32) -+ - #define CIFS_CLIENT_CHALLENGE_SIZE (8) - #define CIFS_SERVER_CHALLENGE_SIZE (8) - #define CIFS_HMAC_MD5_HASH_SIZE (16) -diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h -index 99a1951a01ec2..d9a990c991213 100644 ---- a/fs/cifs/smb2glob.h -+++ b/fs/cifs/smb2glob.h -@@ -58,6 +58,7 @@ - #define SMB2_HMACSHA256_SIZE (32) - #define SMB2_CMACAES_SIZE (16) - #define SMB3_SIGNKEY_SIZE (16) -+#define SMB3_GCM128_CRYPTKEY_SIZE (16) - #define SMB3_GCM256_CRYPTKEY_SIZE (32) - - /* Maximum buffer size value we can send with 1 credit */ -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 463e81c35c428..7b614a7096cd2 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -2007,6 +2007,7 @@ smb2_duplicate_extents(const unsigned int xid, - { - int rc; - unsigned int ret_data_len; -+ struct inode *inode; - struct duplicate_extents_to_file dup_ext_buf; - struct cifs_tcon *tcon = tlink_tcon(trgtfile->tlink); - -@@ -2023,10 +2024,21 @@ smb2_duplicate_extents(const unsigned int xid, - cifs_dbg(FYI, "Duplicate extents: src off %lld dst off %lld len %lld\n", - src_off, dest_off, len); - -- rc = smb2_set_file_size(xid, tcon, trgtfile, dest_off + len, false); -- if (rc) -- goto duplicate_extents_out; -+ inode = d_inode(trgtfile->dentry); -+ if (inode->i_size < dest_off + len) { -+ rc = smb2_set_file_size(xid, tcon, trgtfile, dest_off + len, false); -+ if (rc) -+ goto duplicate_extents_out; - -+ /* -+ * Although also could set plausible allocation size (i_blocks) -+ * here in addition to setting the file size, in reflink -+ * it is likely that the target file is sparse. Its allocation -+ * size will be queried on next revalidate, but it is important -+ * to make sure that file's cached size is updated immediately -+ */ -+ cifs_setsize(inode, dest_off + len); -+ } - rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, - trgtfile->fid.volatile_fid, - FSCTL_DUPLICATE_EXTENTS_TO_FILE, -@@ -4097,7 +4109,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) - if (ses->Suid == ses_id) { - ses_enc_key = enc ? ses->smb3encryptionkey : - ses->smb3decryptionkey; -- memcpy(key, ses_enc_key, SMB3_SIGN_KEY_SIZE); -+ memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE); - spin_unlock(&cifs_tcp_ses_lock); - return 0; - } -@@ -4124,7 +4136,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, - int rc = 0; - struct scatterlist *sg; - u8 sign[SMB2_SIGNATURE_SIZE] = {}; -- u8 key[SMB3_SIGN_KEY_SIZE]; -+ u8 key[SMB3_ENC_DEC_KEY_SIZE]; - struct aead_request *req; - char *iv; - unsigned int iv_len; -@@ -4148,10 +4160,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, - tfm = enc ? server->secmech.ccmaesencrypt : - server->secmech.ccmaesdecrypt; - -- if (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM) -+ if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || -+ (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) - rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE); - else -- rc = crypto_aead_setkey(tfm, key, SMB3_SIGN_KEY_SIZE); -+ rc = crypto_aead_setkey(tfm, key, SMB3_GCM128_CRYPTKEY_SIZE); - - if (rc) { - cifs_server_dbg(VFS, "%s: Failed to set aead key %d\n", __func__, rc); -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 794fc3b68b4f9..6a1af5545f674 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -4033,8 +4033,7 @@ smb2_async_readv(struct cifs_readdata *rdata) - if (rdata->credits.value > 0) { - shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, - SMB2_MAX_BUFFER_SIZE)); -- shdr->CreditRequest = -- cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); -+ shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); - - rc = adjust_credits(server, &rdata->credits, rdata->bytes); - if (rc) -@@ -4340,8 +4339,7 @@ smb2_async_writev(struct cifs_writedata *wdata, - if (wdata->credits.value > 0) { - shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, - SMB2_MAX_BUFFER_SIZE)); -- shdr->CreditRequest = -- cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); -+ shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); - - rc = adjust_credits(server, &wdata->credits, wdata->bytes); - if (rc) -diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c -index ebccd71cc60a3..e6fa76ab70be7 100644 ---- a/fs/cifs/smb2transport.c -+++ b/fs/cifs/smb2transport.c -@@ -298,7 +298,8 @@ static int generate_key(struct cifs_ses *ses, struct kvec label, - { - unsigned char zero = 0x0; - __u8 i[4] = {0, 0, 0, 1}; -- __u8 L[4] = {0, 0, 0, 128}; -+ __u8 L128[4] = {0, 0, 0, 128}; -+ __u8 L256[4] = {0, 0, 1, 0}; - int rc = 0; - unsigned char prfhash[SMB2_HMACSHA256_SIZE]; - unsigned char *hashptr = prfhash; -@@ -354,8 +355,14 @@ static int generate_key(struct cifs_ses *ses, struct kvec label, - goto smb3signkey_ret; - } - -- rc = crypto_shash_update(&server->secmech.sdeschmacsha256->shash, -- L, 4); -+ if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || -+ (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) { -+ rc = crypto_shash_update(&server->secmech.sdeschmacsha256->shash, -+ L256, 4); -+ } else { -+ rc = crypto_shash_update(&server->secmech.sdeschmacsha256->shash, -+ L128, 4); -+ } - if (rc) { - cifs_server_dbg(VFS, "%s: Could not update with L\n", __func__); - goto smb3signkey_ret; -@@ -390,6 +397,9 @@ generate_smb3signingkey(struct cifs_ses *ses, - const struct derivation_triplet *ptriplet) - { - int rc; -+#ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS -+ struct TCP_Server_Info *server = ses->server; -+#endif - - /* - * All channels use the same encryption/decryption keys but -@@ -422,11 +432,11 @@ generate_smb3signingkey(struct cifs_ses *ses, - rc = generate_key(ses, ptriplet->encryption.label, - ptriplet->encryption.context, - ses->smb3encryptionkey, -- SMB3_SIGN_KEY_SIZE); -+ SMB3_ENC_DEC_KEY_SIZE); - rc = generate_key(ses, ptriplet->decryption.label, - ptriplet->decryption.context, - ses->smb3decryptionkey, -- SMB3_SIGN_KEY_SIZE); -+ SMB3_ENC_DEC_KEY_SIZE); - if (rc) - return rc; - } -@@ -442,14 +452,23 @@ generate_smb3signingkey(struct cifs_ses *ses, - */ - cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), - &ses->Suid); -+ cifs_dbg(VFS, "Cipher type %d\n", server->cipher_type); - cifs_dbg(VFS, "Session Key %*ph\n", - SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); - cifs_dbg(VFS, "Signing Key %*ph\n", - SMB3_SIGN_KEY_SIZE, ses->smb3signingkey); -- cifs_dbg(VFS, "ServerIn Key %*ph\n", -- SMB3_SIGN_KEY_SIZE, ses->smb3encryptionkey); -- cifs_dbg(VFS, "ServerOut Key %*ph\n", -- SMB3_SIGN_KEY_SIZE, ses->smb3decryptionkey); -+ if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || -+ (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) { -+ cifs_dbg(VFS, "ServerIn Key %*ph\n", -+ SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3encryptionkey); -+ cifs_dbg(VFS, "ServerOut Key %*ph\n", -+ SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3decryptionkey); -+ } else { -+ cifs_dbg(VFS, "ServerIn Key %*ph\n", -+ SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3encryptionkey); -+ cifs_dbg(VFS, "ServerOut Key %*ph\n", -+ SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3decryptionkey); -+ } - #endif - return rc; - } -diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c -index 64fccb8809ecb..13d685f0ac8e4 100644 ---- a/fs/cifs/transport.c -+++ b/fs/cifs/transport.c -@@ -1185,7 +1185,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, - } - if (rc != 0) { - for (; i < num_rqst; i++) { -- cifs_server_dbg(VFS, "Cancelling wait for mid %llu cmd: %d\n", -+ cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n", - midQ[i]->mid, le16_to_cpu(midQ[i]->command)); - send_cancel(server, &rqst[i], midQ[i]); - spin_lock(&GlobalMid_Lock); -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 99bf091fee10e..a02fadf4fc84e 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -2709,8 +2709,15 @@ static int ext4_mb_init_backend(struct super_block *sb) - } - - if (ext4_has_feature_flex_bg(sb)) { -- /* a single flex group is supposed to be read by a single IO */ -- sbi->s_mb_prefetch = min(1 << sbi->s_es->s_log_groups_per_flex, -+ /* a single flex group is supposed to be read by a single IO. -+ * 2 ^ s_log_groups_per_flex != UINT_MAX as s_mb_prefetch is -+ * unsigned integer, so the maximum shift is 32. -+ */ -+ if (sbi->s_es->s_log_groups_per_flex >= 32) { -+ ext4_msg(sb, KERN_ERR, "too many log groups per flexible block group"); -+ goto err_freesgi; -+ } -+ sbi->s_mb_prefetch = min_t(uint, 1 << sbi->s_es->s_log_groups_per_flex, - BLK_MAX_SEGMENT_SIZE >> (sb->s_blocksize_bits - 9)); - sbi->s_mb_prefetch *= 8; /* 8 prefetch IOs in flight at most */ - } else { -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index 6aef74f7c9eea..6c1018223c54a 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -1462,6 +1462,9 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value, - if (!ce) - return NULL; - -+ WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) && -+ !(current->flags & PF_MEMALLOC_NOFS)); -+ - ea_data = kvmalloc(value_len, GFP_KERNEL); - if (!ea_data) { - mb_cache_entry_put(ea_inode_cache, ce); -@@ -2327,6 +2330,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index, - error = -ENOSPC; - goto cleanup; - } -+ WARN_ON_ONCE(!(current->flags & PF_MEMALLOC_NOFS)); - } - - error = ext4_reserve_inode_write(handle, inode, &is.iloc); -diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c -index 2e9314091c81d..1955dea999f79 100644 ---- a/fs/gfs2/log.c -+++ b/fs/gfs2/log.c -@@ -935,12 +935,16 @@ static void trans_drain(struct gfs2_trans *tr) - while (!list_empty(head)) { - bd = list_first_entry(head, struct gfs2_bufdata, bd_list); - list_del_init(&bd->bd_list); -+ if (!list_empty(&bd->bd_ail_st_list)) -+ gfs2_remove_from_ail(bd); - kmem_cache_free(gfs2_bufdata_cachep, bd); - } - head = &tr->tr_databuf; - while (!list_empty(head)) { - bd = list_first_entry(head, struct gfs2_bufdata, bd_list); - list_del_init(&bd->bd_list); -+ if (!list_empty(&bd->bd_ail_st_list)) -+ gfs2_remove_from_ail(bd); - kmem_cache_free(gfs2_bufdata_cachep, bd); - } - } -diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c -index 6d4bf7ea7b3be..7f850ff6a05de 100644 ---- a/fs/gfs2/trans.c -+++ b/fs/gfs2/trans.c -@@ -134,6 +134,8 @@ static struct gfs2_bufdata *gfs2_alloc_bufdata(struct gfs2_glock *gl, - bd->bd_bh = bh; - bd->bd_gl = gl; - INIT_LIST_HEAD(&bd->bd_list); -+ INIT_LIST_HEAD(&bd->bd_ail_st_list); -+ INIT_LIST_HEAD(&bd->bd_ail_gl_list); - bh->b_private = bd; - return bd; - } -diff --git a/fs/io_uring.c b/fs/io_uring.c -index ef078182e7ca4..5c4378694d541 100644 ---- a/fs/io_uring.c -+++ b/fs/io_uring.c -@@ -4214,6 +4214,7 @@ static int io_remove_buffers(struct io_kiocb *req, bool force_nonblock, - static int io_provide_buffers_prep(struct io_kiocb *req, - const struct io_uring_sqe *sqe) - { -+ unsigned long size; - struct io_provide_buf *p = &req->pbuf; - u64 tmp; - -@@ -4227,7 +4228,8 @@ static int io_provide_buffers_prep(struct io_kiocb *req, - p->addr = READ_ONCE(sqe->addr); - p->len = READ_ONCE(sqe->len); - -- if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs))) -+ size = (unsigned long)p->len * p->nbufs; -+ if (!access_ok(u64_to_user_ptr(p->addr), size)) - return -EFAULT; - - p->bgid = READ_ONCE(sqe->buf_group); -@@ -8861,11 +8863,11 @@ static bool io_cancel_task_cb(struct io_wq_work *work, void *data) - return ret; - } - --static void io_cancel_defer_files(struct io_ring_ctx *ctx, -+static bool io_cancel_defer_files(struct io_ring_ctx *ctx, - struct task_struct *task, - struct files_struct *files) - { -- struct io_defer_entry *de = NULL; -+ struct io_defer_entry *de; - LIST_HEAD(list); - - spin_lock_irq(&ctx->completion_lock); -@@ -8876,6 +8878,8 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx, - } - } - spin_unlock_irq(&ctx->completion_lock); -+ if (list_empty(&list)) -+ return false; - - while (!list_empty(&list)) { - de = list_first_entry(&list, struct io_defer_entry, list); -@@ -8885,6 +8889,7 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx, - io_req_complete(de->req, -ECANCELED); - kfree(de); - } -+ return true; - } - - static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx, -@@ -8912,6 +8917,7 @@ static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx, - } - } - -+ ret |= io_cancel_defer_files(ctx, task, files); - ret |= io_poll_remove_all(ctx, task, files); - ret |= io_kill_timeouts(ctx, task, files); - ret |= io_run_task_work(); -@@ -8992,8 +8998,6 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx, - io_sq_thread_park(ctx->sq_data); - } - -- io_cancel_defer_files(ctx, task, files); -- - io_uring_cancel_files(ctx, task, files); - if (!files) - io_uring_try_cancel_requests(ctx, task, NULL); -diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig -index e2a488d403a61..14a72224b6571 100644 ---- a/fs/nfs/Kconfig -+++ b/fs/nfs/Kconfig -@@ -127,7 +127,7 @@ config PNFS_BLOCK - config PNFS_FLEXFILE_LAYOUT - tristate - depends on NFS_V4_1 && NFS_V3 -- default m -+ default NFS_V4 - - config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN - string "NFSv4.1 Implementation ID Domain" -diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c -index ca10072644ff2..ed1c83738c30d 100644 ---- a/fs/nfs/nfs3xdr.c -+++ b/fs/nfs/nfs3xdr.c -@@ -36,6 +36,7 @@ - #define NFS3_pagepad_sz (1) /* Page padding */ - #define NFS3_fhandle_sz (1+16) - #define NFS3_fh_sz (NFS3_fhandle_sz) /* shorthand */ -+#define NFS3_post_op_fh_sz (1+NFS3_fh_sz) - #define NFS3_sattr_sz (15) - #define NFS3_filename_sz (1+(NFS3_MAXNAMLEN>>2)) - #define NFS3_path_sz (1+(NFS3_MAXPATHLEN>>2)) -@@ -73,7 +74,7 @@ - #define NFS3_readlinkres_sz (1+NFS3_post_op_attr_sz+1+NFS3_pagepad_sz) - #define NFS3_readres_sz (1+NFS3_post_op_attr_sz+3+NFS3_pagepad_sz) - #define NFS3_writeres_sz (1+NFS3_wcc_data_sz+4) --#define NFS3_createres_sz (1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) -+#define NFS3_createres_sz (1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) - #define NFS3_renameres_sz (1+(2 * NFS3_wcc_data_sz)) - #define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) - #define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2+NFS3_pagepad_sz) -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 7eb44f37558cb..95d3b8540f8ed 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -5896,6 +5896,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl - unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE); - int ret, i; - -+ /* You can't remove system.nfs4_acl: */ -+ if (buflen == 0) -+ return -EINVAL; - if (!nfs4_server_supports_acls(server)) - return -EOPNOTSUPP; - if (npages > ARRAY_SIZE(pages)) -diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c -index eb02072d28dd6..723763746238d 100644 ---- a/fs/squashfs/export.c -+++ b/fs/squashfs/export.c -@@ -152,14 +152,18 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb, - start = le64_to_cpu(table[n]); - end = le64_to_cpu(table[n + 1]); - -- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { -+ if (start >= end -+ || (end - start) > -+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { - kfree(table); - return ERR_PTR(-EINVAL); - } - } - - start = le64_to_cpu(table[indexes - 1]); -- if (start >= lookup_table_start || (lookup_table_start - start) > SQUASHFS_METADATA_SIZE) { -+ if (start >= lookup_table_start || -+ (lookup_table_start - start) > -+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { - kfree(table); - return ERR_PTR(-EINVAL); - } -diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c -index 11581bf31af41..ea5387679723f 100644 ---- a/fs/squashfs/id.c -+++ b/fs/squashfs/id.c -@@ -97,14 +97,16 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb, - start = le64_to_cpu(table[n]); - end = le64_to_cpu(table[n + 1]); - -- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { -+ if (start >= end || (end - start) > -+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { - kfree(table); - return ERR_PTR(-EINVAL); - } - } - - start = le64_to_cpu(table[indexes - 1]); -- if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) { -+ if (start >= id_table_start || (id_table_start - start) > -+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { - kfree(table); - return ERR_PTR(-EINVAL); - } -diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h -index 8d64edb80ebf0..b3fdc8212c5f5 100644 ---- a/fs/squashfs/squashfs_fs.h -+++ b/fs/squashfs/squashfs_fs.h -@@ -17,6 +17,7 @@ - - /* size of metadata (inode and directory) blocks */ - #define SQUASHFS_METADATA_SIZE 8192 -+#define SQUASHFS_BLOCK_OFFSET 2 - - /* default size of block device I/O */ - #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE -diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c -index ead66670b41a5..087cab8c78f4e 100644 ---- a/fs/squashfs/xattr_id.c -+++ b/fs/squashfs/xattr_id.c -@@ -109,14 +109,16 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start, - start = le64_to_cpu(table[n]); - end = le64_to_cpu(table[n + 1]); - -- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { -+ if (start >= end || (end - start) > -+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { - kfree(table); - return ERR_PTR(-EINVAL); - } - } - - start = le64_to_cpu(table[indexes - 1]); -- if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) { -+ if (start >= table_start || (table_start - start) > -+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { - kfree(table); - return ERR_PTR(-EINVAL); - } -diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h -index 6d1879bf94403..37dac195adbb4 100644 ---- a/include/acpi/acpi_bus.h -+++ b/include/acpi/acpi_bus.h -@@ -233,6 +233,7 @@ struct acpi_pnp_type { - - struct acpi_device_pnp { - acpi_bus_id bus_id; /* Object name */ -+ int instance_no; /* Instance number of this object */ - struct acpi_pnp_type type; /* ID type */ - acpi_bus_address bus_address; /* _ADR */ - char *unique_id; /* _UID */ -diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h -index 34d8287cd7749..d7efbc5490e8c 100644 ---- a/include/asm-generic/vmlinux.lds.h -+++ b/include/asm-generic/vmlinux.lds.h -@@ -393,7 +393,10 @@ - . = ALIGN(8); \ - __start_static_call_sites = .; \ - KEEP(*(.static_call_sites)) \ -- __stop_static_call_sites = .; -+ __stop_static_call_sites = .; \ -+ __start_static_call_tramp_key = .; \ -+ KEEP(*(.static_call_tramp_key)) \ -+ __stop_static_call_tramp_key = .; - - /* - * Allow architectures to handle ro_after_init data on their -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 6e585dbc10df3..564ebf91793ed 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - - struct bpf_verifier_env; - struct bpf_verifier_log; -@@ -563,7 +564,8 @@ struct bpf_tramp_progs { - * fentry = a set of program to run before calling original function - * fexit = a set of program to run after original function - */ --int arch_prepare_bpf_trampoline(void *image, void *image_end, -+struct bpf_tramp_image; -+int arch_prepare_bpf_trampoline(struct bpf_tramp_image *tr, void *image, void *image_end, - const struct btf_func_model *m, u32 flags, - struct bpf_tramp_progs *tprogs, - void *orig_call); -@@ -572,6 +574,8 @@ u64 notrace __bpf_prog_enter(void); - void notrace __bpf_prog_exit(struct bpf_prog *prog, u64 start); - void notrace __bpf_prog_enter_sleepable(void); - void notrace __bpf_prog_exit_sleepable(void); -+void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr); -+void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr); - - struct bpf_ksym { - unsigned long start; -@@ -590,6 +594,18 @@ enum bpf_tramp_prog_type { - BPF_TRAMP_REPLACE, /* more than MAX */ - }; - -+struct bpf_tramp_image { -+ void *image; -+ struct bpf_ksym ksym; -+ struct percpu_ref pcref; -+ void *ip_after_call; -+ void *ip_epilogue; -+ union { -+ struct rcu_head rcu; -+ struct work_struct work; -+ }; -+}; -+ - struct bpf_trampoline { - /* hlist for trampoline_table */ - struct hlist_node hlist; -@@ -612,9 +628,8 @@ struct bpf_trampoline { - /* Number of attached programs. A counter per kind. */ - int progs_cnt[BPF_TRAMP_MAX]; - /* Executable image of trampoline */ -- void *image; -+ struct bpf_tramp_image *cur_image; - u64 selector; -- struct bpf_ksym ksym; - }; - - struct bpf_attach_target_info { -@@ -698,6 +713,8 @@ void bpf_image_ksym_add(void *data, struct bpf_ksym *ksym); - void bpf_image_ksym_del(struct bpf_ksym *ksym); - void bpf_ksym_add(struct bpf_ksym *ksym); - void bpf_ksym_del(struct bpf_ksym *ksym); -+int bpf_jit_charge_modmem(u32 pages); -+void bpf_jit_uncharge_modmem(u32 pages); - #else - static inline int bpf_trampoline_link_prog(struct bpf_prog *prog, - struct bpf_trampoline *tr) -@@ -788,7 +805,6 @@ struct bpf_prog_aux { - bool func_proto_unreliable; - bool sleepable; - bool tail_call_reachable; -- enum bpf_tramp_prog_type trampoline_prog_type; - struct hlist_node tramp_hlist; - /* BTF_KIND_FUNC_PROTO for valid attach_btf_id */ - const struct btf_type *attach_func_proto; -@@ -1066,7 +1082,7 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array, - struct bpf_prog *include_prog, - struct bpf_prog_array **new_array); - --#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null) \ -+#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null, set_cg_storage) \ - ({ \ - struct bpf_prog_array_item *_item; \ - struct bpf_prog *_prog; \ -@@ -1079,7 +1095,8 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array, - goto _out; \ - _item = &_array->items[0]; \ - while ((_prog = READ_ONCE(_item->prog))) { \ -- bpf_cgroup_storage_set(_item->cgroup_storage); \ -+ if (set_cg_storage) \ -+ bpf_cgroup_storage_set(_item->cgroup_storage); \ - _ret &= func(_prog, ctx); \ - _item++; \ - } \ -@@ -1140,10 +1157,10 @@ _out: \ - }) - - #define BPF_PROG_RUN_ARRAY(array, ctx, func) \ -- __BPF_PROG_RUN_ARRAY(array, ctx, func, false) -+ __BPF_PROG_RUN_ARRAY(array, ctx, func, false, true) - - #define BPF_PROG_RUN_ARRAY_CHECK(array, ctx, func) \ -- __BPF_PROG_RUN_ARRAY(array, ctx, func, true) -+ __BPF_PROG_RUN_ARRAY(array, ctx, func, true, false) - - #ifdef CONFIG_BPF_SYSCALL - DECLARE_PER_CPU(int, bpf_prog_active); -diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h -index d0bd226d6bd96..54665952d6ade 100644 ---- a/include/linux/brcmphy.h -+++ b/include/linux/brcmphy.h -@@ -136,6 +136,7 @@ - - #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC 0x07 - #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_WIRESPEED_EN 0x0010 -+#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN 0x0080 - #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN 0x0100 - #define MII_BCM54XX_AUXCTL_MISC_FORCE_AMDIX 0x0200 - #define MII_BCM54XX_AUXCTL_MISC_WREN 0x8000 -@@ -222,6 +223,9 @@ - /* 11111: Mode Control Register */ - #define BCM54XX_SHD_MODE 0x1f - #define BCM54XX_SHD_INTF_SEL_MASK GENMASK(2, 1) /* INTERF_SEL[1:0] */ -+#define BCM54XX_SHD_INTF_SEL_RGMII 0x02 -+#define BCM54XX_SHD_INTF_SEL_SGMII 0x04 -+#define BCM54XX_SHD_INTF_SEL_GBIC 0x06 - #define BCM54XX_SHD_MODE_1000BX BIT(0) /* Enable 1000-X registers */ - - /* -diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h -index d2d7f9b6a2761..50cc070cb1f7c 100644 ---- a/include/linux/device-mapper.h -+++ b/include/linux/device-mapper.h -@@ -246,7 +246,11 @@ struct target_type { - #define dm_target_passes_integrity(type) ((type)->features & DM_TARGET_PASSES_INTEGRITY) - - /* -- * Indicates that a target supports host-managed zoned block devices. -+ * Indicates support for zoned block devices: -+ * - DM_TARGET_ZONED_HM: the target also supports host-managed zoned -+ * block devices but does not support combining different zoned models. -+ * - DM_TARGET_MIXED_ZONED_MODEL: the target supports combining multiple -+ * devices with different zoned models. - */ - #define DM_TARGET_ZONED_HM 0x00000040 - #define dm_target_supports_zoned_hm(type) ((type)->features & DM_TARGET_ZONED_HM) -@@ -257,6 +261,15 @@ struct target_type { - #define DM_TARGET_NOWAIT 0x00000080 - #define dm_target_supports_nowait(type) ((type)->features & DM_TARGET_NOWAIT) - -+#ifdef CONFIG_BLK_DEV_ZONED -+#define DM_TARGET_MIXED_ZONED_MODEL 0x00000200 -+#define dm_target_supports_mixed_zoned_model(type) \ -+ ((type)->features & DM_TARGET_MIXED_ZONED_MODEL) -+#else -+#define DM_TARGET_MIXED_ZONED_MODEL 0x00000000 -+#define dm_target_supports_mixed_zoned_model(type) (false) -+#endif -+ - struct dm_target { - struct dm_table *table; - struct target_type *type; -diff --git a/include/linux/hugetlb_cgroup.h b/include/linux/hugetlb_cgroup.h -index 2ad6e92f124ad..0bff345c4bc68 100644 ---- a/include/linux/hugetlb_cgroup.h -+++ b/include/linux/hugetlb_cgroup.h -@@ -113,6 +113,11 @@ static inline bool hugetlb_cgroup_disabled(void) - return !cgroup_subsys_enabled(hugetlb_cgrp_subsys); - } - -+static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg) -+{ -+ css_put(&h_cg->css); -+} -+ - extern int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages, - struct hugetlb_cgroup **ptr); - extern int hugetlb_cgroup_charge_cgroup_rsvd(int idx, unsigned long nr_pages, -@@ -138,7 +143,8 @@ extern void hugetlb_cgroup_uncharge_counter(struct resv_map *resv, - - extern void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv, - struct file_region *rg, -- unsigned long nr_pages); -+ unsigned long nr_pages, -+ bool region_del); - - extern void hugetlb_cgroup_file_init(void) __init; - extern void hugetlb_cgroup_migrate(struct page *oldhpage, -@@ -147,7 +153,8 @@ extern void hugetlb_cgroup_migrate(struct page *oldhpage, - #else - static inline void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv, - struct file_region *rg, -- unsigned long nr_pages) -+ unsigned long nr_pages, -+ bool region_del) - { - } - -@@ -185,6 +192,10 @@ static inline bool hugetlb_cgroup_disabled(void) - return true; - } - -+static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg) -+{ -+} -+ - static inline int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages, - struct hugetlb_cgroup **ptr) - { -diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h -index 96556c64c95da..10c94a3936ca7 100644 ---- a/include/linux/if_macvlan.h -+++ b/include/linux/if_macvlan.h -@@ -43,13 +43,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan, - if (likely(success)) { - struct vlan_pcpu_stats *pcpu_stats; - -- pcpu_stats = this_cpu_ptr(vlan->pcpu_stats); -+ pcpu_stats = get_cpu_ptr(vlan->pcpu_stats); - u64_stats_update_begin(&pcpu_stats->syncp); - pcpu_stats->rx_packets++; - pcpu_stats->rx_bytes += len; - if (multicast) - pcpu_stats->rx_multicast++; - u64_stats_update_end(&pcpu_stats->syncp); -+ put_cpu_ptr(vlan->pcpu_stats); - } else { - this_cpu_inc(vlan->pcpu_stats->rx_errors); - } -diff --git a/include/linux/memblock.h b/include/linux/memblock.h -index 7643d2dfa9594..4ce9c8f9e6843 100644 ---- a/include/linux/memblock.h -+++ b/include/linux/memblock.h -@@ -460,7 +460,7 @@ static inline void memblock_free_late(phys_addr_t base, phys_addr_t size) - /* - * Set the allocation direction to bottom-up or top-down. - */ --static inline __init void memblock_set_bottom_up(bool enable) -+static inline __init_memblock void memblock_set_bottom_up(bool enable) - { - memblock.bottom_up = enable; - } -@@ -470,7 +470,7 @@ static inline __init void memblock_set_bottom_up(bool enable) - * if this is true, that said, memblock will allocate memory - * in bottom-up direction. - */ --static inline __init bool memblock_bottom_up(void) -+static inline __init_memblock bool memblock_bottom_up(void) - { - return memblock.bottom_up; - } -diff --git a/include/linux/mm.h b/include/linux/mm.h -index 24b292fce8e59..992c18d5e85d7 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1431,16 +1431,28 @@ static inline bool cpupid_match_pid(struct task_struct *task, int cpupid) - - #if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) - -+/* -+ * KASAN per-page tags are stored xor'ed with 0xff. This allows to avoid -+ * setting tags for all pages to native kernel tag value 0xff, as the default -+ * value 0x00 maps to 0xff. -+ */ -+ - static inline u8 page_kasan_tag(const struct page *page) - { -- if (kasan_enabled()) -- return (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK; -- return 0xff; -+ u8 tag = 0xff; -+ -+ if (kasan_enabled()) { -+ tag = (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK; -+ tag ^= 0xff; -+ } -+ -+ return tag; - } - - static inline void page_kasan_tag_set(struct page *page, u8 tag) - { - if (kasan_enabled()) { -+ tag ^= 0xff; - page->flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT); - page->flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT; - } -diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index 07d9acb5b19c4..61c77cfff8c28 100644 ---- a/include/linux/mm_types.h -+++ b/include/linux/mm_types.h -@@ -23,6 +23,7 @@ - #endif - #define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) - -+#define INIT_PASID 0 - - struct address_space; - struct mem_cgroup; -diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h -index b8200782dedeb..1a6a9eb6d3fac 100644 ---- a/include/linux/mmu_notifier.h -+++ b/include/linux/mmu_notifier.h -@@ -169,11 +169,11 @@ struct mmu_notifier_ops { - * the last refcount is dropped. - * - * If blockable argument is set to false then the callback cannot -- * sleep and has to return with -EAGAIN. 0 should be returned -- * otherwise. Please note that if invalidate_range_start approves -- * a non-blocking behavior then the same applies to -- * invalidate_range_end. -- * -+ * sleep and has to return with -EAGAIN if sleeping would be required. -+ * 0 should be returned otherwise. Please note that notifiers that can -+ * fail invalidate_range_start are not allowed to implement -+ * invalidate_range_end, as there is no mechanism for informing the -+ * notifier that its start failed. - */ - int (*invalidate_range_start)(struct mmu_notifier *subscription, - const struct mmu_notifier_range *range); -diff --git a/include/linux/mutex.h b/include/linux/mutex.h -index dcd185cbfe793..4d671fba3cab4 100644 ---- a/include/linux/mutex.h -+++ b/include/linux/mutex.h -@@ -185,7 +185,7 @@ extern void mutex_lock_io(struct mutex *lock); - # define mutex_lock_interruptible_nested(lock, subclass) mutex_lock_interruptible(lock) - # define mutex_lock_killable_nested(lock, subclass) mutex_lock_killable(lock) - # define mutex_lock_nest_lock(lock, nest_lock) mutex_lock(lock) --# define mutex_lock_io_nested(lock, subclass) mutex_lock(lock) -+# define mutex_lock_io_nested(lock, subclass) mutex_lock_io(lock) - #endif - - /* -diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h -index 8ebb641937571..8ec48466410a6 100644 ---- a/include/linux/netfilter/x_tables.h -+++ b/include/linux/netfilter/x_tables.h -@@ -227,7 +227,7 @@ struct xt_table { - unsigned int valid_hooks; - - /* Man behind the curtain... */ -- struct xt_table_info __rcu *private; -+ struct xt_table_info *private; - - /* Set this to THIS_MODULE if you are a module, otherwise NULL */ - struct module *me; -@@ -376,7 +376,7 @@ static inline unsigned int xt_write_recseq_begin(void) - * since addend is most likely 1 - */ - __this_cpu_add(xt_recseq.sequence, addend); -- smp_wmb(); -+ smp_mb(); - - return addend; - } -@@ -448,9 +448,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu) - - struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *); - --struct xt_table_info --*xt_table_get_private_protected(const struct xt_table *table); -- - #ifdef CONFIG_COMPAT - #include - -diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h -index d5570deff4003..b032f094a7827 100644 ---- a/include/linux/pagemap.h -+++ b/include/linux/pagemap.h -@@ -559,7 +559,6 @@ static inline pgoff_t linear_page_index(struct vm_area_struct *vma, - return pgoff; - } - --/* This has the same layout as wait_bit_key - see fs/cachefiles/rdwr.c */ - struct wait_page_key { - struct page *page; - int bit_nr; -diff --git a/include/linux/phy.h b/include/linux/phy.h -index 9effb511acde3..d0e64f3b53b99 100644 ---- a/include/linux/phy.h -+++ b/include/linux/phy.h -@@ -499,6 +499,7 @@ struct macsec_ops; - * - * @speed: Current link speed - * @duplex: Current duplex -+ * @port: Current port - * @pause: Current pause - * @asym_pause: Current asymmetric pause - * @supported: Combined MAC/PHY supported linkmodes -@@ -577,6 +578,7 @@ struct phy_device { - */ - int speed; - int duplex; -+ int port; - int pause; - int asym_pause; - u8 master_slave_get; -diff --git a/include/linux/static_call.h b/include/linux/static_call.h -index 695da4c9b3381..04e6042d252d3 100644 ---- a/include/linux/static_call.h -+++ b/include/linux/static_call.h -@@ -107,26 +107,10 @@ extern void arch_static_call_transform(void *site, void *tramp, void *func, bool - - #define STATIC_CALL_TRAMP_ADDR(name) &STATIC_CALL_TRAMP(name) - --/* -- * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from -- * the symbol table so that objtool can reference it when it generates the -- * .static_call_sites section. -- */ --#define __static_call(name) \ --({ \ -- __ADDRESSABLE(STATIC_CALL_KEY(name)); \ -- &STATIC_CALL_TRAMP(name); \ --}) -- - #else - #define STATIC_CALL_TRAMP_ADDR(name) NULL - #endif - -- --#define DECLARE_STATIC_CALL(name, func) \ -- extern struct static_call_key STATIC_CALL_KEY(name); \ -- extern typeof(func) STATIC_CALL_TRAMP(name); -- - #define static_call_update(name, func) \ - ({ \ - BUILD_BUG_ON(!__same_type(*(func), STATIC_CALL_TRAMP(name))); \ -@@ -154,6 +138,12 @@ struct static_call_key { - }; - }; - -+/* For finding the key associated with a trampoline */ -+struct static_call_tramp_key { -+ s32 tramp; -+ s32 key; -+}; -+ - extern void __static_call_update(struct static_call_key *key, void *tramp, void *func); - extern int static_call_mod_init(struct module *mod); - extern int static_call_text_reserved(void *start, void *end); -@@ -174,17 +164,23 @@ extern int static_call_text_reserved(void *start, void *end); - }; \ - ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name) - --#define static_call(name) __static_call(name) - #define static_call_cond(name) (void)__static_call(name) - - #define EXPORT_STATIC_CALL(name) \ - EXPORT_SYMBOL(STATIC_CALL_KEY(name)); \ - EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)) -- - #define EXPORT_STATIC_CALL_GPL(name) \ - EXPORT_SYMBOL_GPL(STATIC_CALL_KEY(name)); \ - EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)) - -+/* Leave the key unexported, so modules can't change static call targets: */ -+#define EXPORT_STATIC_CALL_TRAMP(name) \ -+ EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)); \ -+ ARCH_ADD_TRAMP_KEY(name) -+#define EXPORT_STATIC_CALL_TRAMP_GPL(name) \ -+ EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)); \ -+ ARCH_ADD_TRAMP_KEY(name) -+ - #elif defined(CONFIG_HAVE_STATIC_CALL) - - static inline int static_call_init(void) { return 0; } -@@ -207,7 +203,6 @@ struct static_call_key { - }; \ - ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name) - --#define static_call(name) __static_call(name) - #define static_call_cond(name) (void)__static_call(name) - - static inline -@@ -227,11 +222,16 @@ static inline int static_call_text_reserved(void *start, void *end) - #define EXPORT_STATIC_CALL(name) \ - EXPORT_SYMBOL(STATIC_CALL_KEY(name)); \ - EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)) -- - #define EXPORT_STATIC_CALL_GPL(name) \ - EXPORT_SYMBOL_GPL(STATIC_CALL_KEY(name)); \ - EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)) - -+/* Leave the key unexported, so modules can't change static call targets: */ -+#define EXPORT_STATIC_CALL_TRAMP(name) \ -+ EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)) -+#define EXPORT_STATIC_CALL_TRAMP_GPL(name) \ -+ EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)) -+ - #else /* Generic implementation */ - - static inline int static_call_init(void) { return 0; } -@@ -252,9 +252,6 @@ struct static_call_key { - .func = NULL, \ - } - --#define static_call(name) \ -- ((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func)) -- - static inline void __static_call_nop(void) { } - - /* -diff --git a/include/linux/static_call_types.h b/include/linux/static_call_types.h -index 89135bb35bf76..ae5662d368b98 100644 ---- a/include/linux/static_call_types.h -+++ b/include/linux/static_call_types.h -@@ -4,11 +4,13 @@ - - #include - #include -+#include - - #define STATIC_CALL_KEY_PREFIX __SCK__ - #define STATIC_CALL_KEY_PREFIX_STR __stringify(STATIC_CALL_KEY_PREFIX) - #define STATIC_CALL_KEY_PREFIX_LEN (sizeof(STATIC_CALL_KEY_PREFIX_STR) - 1) - #define STATIC_CALL_KEY(name) __PASTE(STATIC_CALL_KEY_PREFIX, name) -+#define STATIC_CALL_KEY_STR(name) __stringify(STATIC_CALL_KEY(name)) - - #define STATIC_CALL_TRAMP_PREFIX __SCT__ - #define STATIC_CALL_TRAMP_PREFIX_STR __stringify(STATIC_CALL_TRAMP_PREFIX) -@@ -32,4 +34,52 @@ struct static_call_site { - s32 key; - }; - -+#define DECLARE_STATIC_CALL(name, func) \ -+ extern struct static_call_key STATIC_CALL_KEY(name); \ -+ extern typeof(func) STATIC_CALL_TRAMP(name); -+ -+#ifdef CONFIG_HAVE_STATIC_CALL -+ -+#define __raw_static_call(name) (&STATIC_CALL_TRAMP(name)) -+ -+#ifdef CONFIG_HAVE_STATIC_CALL_INLINE -+ -+/* -+ * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from -+ * the symbol table so that objtool can reference it when it generates the -+ * .static_call_sites section. -+ */ -+#define __STATIC_CALL_ADDRESSABLE(name) \ -+ __ADDRESSABLE(STATIC_CALL_KEY(name)) -+ -+#define __static_call(name) \ -+({ \ -+ __STATIC_CALL_ADDRESSABLE(name); \ -+ __raw_static_call(name); \ -+}) -+ -+#else /* !CONFIG_HAVE_STATIC_CALL_INLINE */ -+ -+#define __STATIC_CALL_ADDRESSABLE(name) -+#define __static_call(name) __raw_static_call(name) -+ -+#endif /* CONFIG_HAVE_STATIC_CALL_INLINE */ -+ -+#ifdef MODULE -+#define __STATIC_CALL_MOD_ADDRESSABLE(name) -+#define static_call_mod(name) __raw_static_call(name) -+#else -+#define __STATIC_CALL_MOD_ADDRESSABLE(name) __STATIC_CALL_ADDRESSABLE(name) -+#define static_call_mod(name) __static_call(name) -+#endif -+ -+#define static_call(name) __static_call(name) -+ -+#else -+ -+#define static_call(name) \ -+ ((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func)) -+ -+#endif /* CONFIG_HAVE_STATIC_CALL */ -+ - #endif /* _STATIC_CALL_TYPES_H */ -diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h -index c6abb79501b33..e81856c0ba134 100644 ---- a/include/linux/u64_stats_sync.h -+++ b/include/linux/u64_stats_sync.h -@@ -115,12 +115,13 @@ static inline void u64_stats_inc(u64_stats_t *p) - } - #endif - -+#if BITS_PER_LONG == 32 && defined(CONFIG_SMP) -+#define u64_stats_init(syncp) seqcount_init(&(syncp)->seq) -+#else - static inline void u64_stats_init(struct u64_stats_sync *syncp) - { --#if BITS_PER_LONG == 32 && defined(CONFIG_SMP) -- seqcount_init(&syncp->seq); --#endif - } -+#endif - - static inline void u64_stats_update_begin(struct u64_stats_sync *syncp) - { -diff --git a/include/linux/usermode_driver.h b/include/linux/usermode_driver.h -index 073a9e0ec07d0..ad970416260dd 100644 ---- a/include/linux/usermode_driver.h -+++ b/include/linux/usermode_driver.h -@@ -14,5 +14,6 @@ struct umd_info { - int umd_load_blob(struct umd_info *info, const void *data, size_t len); - int umd_unload_blob(struct umd_info *info); - int fork_usermode_driver(struct umd_info *info); -+void umd_cleanup_helper(struct umd_info *info); - - #endif /* __LINUX_USERMODE_DRIVER_H__ */ -diff --git a/include/net/dst.h b/include/net/dst.h -index 10f0a83998672..8d7cf51766c4b 100644 ---- a/include/net/dst.h -+++ b/include/net/dst.h -@@ -533,4 +533,15 @@ static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu) - dst->ops->update_pmtu(dst, NULL, skb, mtu, false); - } - -+struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie); -+void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, -+ struct sk_buff *skb, u32 mtu, bool confirm_neigh); -+void dst_blackhole_redirect(struct dst_entry *dst, struct sock *sk, -+ struct sk_buff *skb); -+u32 *dst_blackhole_cow_metrics(struct dst_entry *dst, unsigned long old); -+struct neighbour *dst_blackhole_neigh_lookup(const struct dst_entry *dst, -+ struct sk_buff *skb, -+ const void *daddr); -+unsigned int dst_blackhole_mtu(const struct dst_entry *dst); -+ - #endif /* _NET_DST_H */ -diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h -index 111d7771b2081..aa92af3dd444d 100644 ---- a/include/net/inet_connection_sock.h -+++ b/include/net/inet_connection_sock.h -@@ -284,7 +284,7 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk) - return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog; - } - --void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); -+bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); - void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req); - - static inline void inet_csk_prepare_for_destroy_sock(struct sock *sk) -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index 4b6ecf5326238..6799f95eea650 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -1531,6 +1531,7 @@ struct nft_trans_flowtable { - struct nft_flowtable *flowtable; - bool update; - struct list_head hook_list; -+ u32 flags; - }; - - #define nft_trans_flowtable(trans) \ -@@ -1539,6 +1540,8 @@ struct nft_trans_flowtable { - (((struct nft_trans_flowtable *)trans->data)->update) - #define nft_trans_flowtable_hooks(trans) \ - (((struct nft_trans_flowtable *)trans->data)->hook_list) -+#define nft_trans_flowtable_flags(trans) \ -+ (((struct nft_trans_flowtable *)trans->data)->flags) - - int __init nft_chain_filter_init(void); - void nft_chain_filter_fini(void); -diff --git a/include/net/nexthop.h b/include/net/nexthop.h -index 226930d66b637..abd620103cec1 100644 ---- a/include/net/nexthop.h -+++ b/include/net/nexthop.h -@@ -400,6 +400,7 @@ static inline struct fib_nh *fib_info_nh(struct fib_info *fi, int nhsel) - int fib6_check_nexthop(struct nexthop *nh, struct fib6_config *cfg, - struct netlink_ext_ack *extack); - -+/* Caller should either hold rcu_read_lock(), or RTNL. */ - static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh) - { - struct nh_info *nhi; -@@ -420,6 +421,29 @@ static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh) - return NULL; - } - -+/* Variant of nexthop_fib6_nh(). -+ * Caller should either hold rcu_read_lock_bh(), or RTNL. -+ */ -+static inline struct fib6_nh *nexthop_fib6_nh_bh(struct nexthop *nh) -+{ -+ struct nh_info *nhi; -+ -+ if (nh->is_group) { -+ struct nh_group *nh_grp; -+ -+ nh_grp = rcu_dereference_bh_rtnl(nh->nh_grp); -+ nh = nexthop_mpath_select(nh_grp, 0); -+ if (!nh) -+ return NULL; -+ } -+ -+ nhi = rcu_dereference_bh_rtnl(nh->nh_info); -+ if (nhi->family == AF_INET6) -+ return &nhi->fib6_nh; -+ -+ return NULL; -+} -+ - static inline struct net_device *fib6_info_nh_dev(struct fib6_info *f6i) - { - struct fib6_nh *fib6_nh; -diff --git a/include/net/red.h b/include/net/red.h -index 932f0d79d60cb..9e6647c4ccd1f 100644 ---- a/include/net/red.h -+++ b/include/net/red.h -@@ -168,7 +168,8 @@ static inline void red_set_vars(struct red_vars *v) - v->qcount = -1; - } - --static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log) -+static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, -+ u8 Scell_log, u8 *stab) - { - if (fls(qth_min) + Wlog > 32) - return false; -@@ -178,6 +179,13 @@ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_ - return false; - if (qth_max < qth_min) - return false; -+ if (stab) { -+ int i; -+ -+ for (i = 0; i < RED_STAB_SIZE; i++) -+ if (stab[i] >= 32) -+ return false; -+ } - return true; - } - -diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h -index e2091bb2b3a8e..4da61c950e931 100644 ---- a/include/net/rtnetlink.h -+++ b/include/net/rtnetlink.h -@@ -33,6 +33,7 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh) - * - * @list: Used internally - * @kind: Identifier -+ * @netns_refund: Physical device, move to init_net on netns exit - * @maxtype: Highest device specific netlink attribute number - * @policy: Netlink policy for device specific attribute validation - * @validate: Optional validation function for netlink/changelink parameters -@@ -64,6 +65,7 @@ struct rtnl_link_ops { - size_t priv_size; - void (*setup)(struct net_device *dev); - -+ bool netns_refund; - unsigned int maxtype; - const struct nla_policy *policy; - int (*validate)(struct nlattr *tb[], -diff --git a/include/uapi/linux/psample.h b/include/uapi/linux/psample.h -index aea26ab1431c1..bff5032c98df4 100644 ---- a/include/uapi/linux/psample.h -+++ b/include/uapi/linux/psample.h -@@ -3,7 +3,6 @@ - #define __UAPI_PSAMPLE_H - - enum { -- /* sampled packet metadata */ - PSAMPLE_ATTR_IIFINDEX, - PSAMPLE_ATTR_OIFINDEX, - PSAMPLE_ATTR_ORIGSIZE, -@@ -11,10 +10,8 @@ enum { - PSAMPLE_ATTR_GROUP_SEQ, - PSAMPLE_ATTR_SAMPLE_RATE, - PSAMPLE_ATTR_DATA, -- PSAMPLE_ATTR_TUNNEL, -- -- /* commands attributes */ - PSAMPLE_ATTR_GROUP_REFCOUNT, -+ PSAMPLE_ATTR_TUNNEL, - - __PSAMPLE_ATTR_MAX - }; -diff --git a/kernel/bpf/bpf_inode_storage.c b/kernel/bpf/bpf_inode_storage.c -index 6639640523c0b..b58b2efb9b431 100644 ---- a/kernel/bpf/bpf_inode_storage.c -+++ b/kernel/bpf/bpf_inode_storage.c -@@ -109,7 +109,7 @@ static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key) - fd = *(int *)key; - f = fget_raw(fd); - if (!f) -- return NULL; -+ return ERR_PTR(-EBADF); - - sdata = inode_storage_lookup(f->f_inode, map, true); - fput(f); -diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c -index 1a666a975416c..70f6fd4fa3056 100644 ---- a/kernel/bpf/bpf_struct_ops.c -+++ b/kernel/bpf/bpf_struct_ops.c -@@ -430,7 +430,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, - - tprogs[BPF_TRAMP_FENTRY].progs[0] = prog; - tprogs[BPF_TRAMP_FENTRY].nr_progs = 1; -- err = arch_prepare_bpf_trampoline(image, -+ err = arch_prepare_bpf_trampoline(NULL, image, - st_map->image + PAGE_SIZE, - &st_ops->func_models[i], 0, - tprogs, NULL); -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 261f8692d0d2a..1de87fcaeabdb 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -817,7 +817,7 @@ static int __init bpf_jit_charge_init(void) - } - pure_initcall(bpf_jit_charge_init); - --static int bpf_jit_charge_modmem(u32 pages) -+int bpf_jit_charge_modmem(u32 pages) - { - if (atomic_long_add_return(pages, &bpf_jit_current) > - (bpf_jit_limit >> PAGE_SHIFT)) { -@@ -830,7 +830,7 @@ static int bpf_jit_charge_modmem(u32 pages) - return 0; - } - --static void bpf_jit_uncharge_modmem(u32 pages) -+void bpf_jit_uncharge_modmem(u32 pages) - { - atomic_long_sub(pages, &bpf_jit_current); - } -diff --git a/kernel/bpf/preload/bpf_preload_kern.c b/kernel/bpf/preload/bpf_preload_kern.c -index 79c5772465f14..53736e52c1dfa 100644 ---- a/kernel/bpf/preload/bpf_preload_kern.c -+++ b/kernel/bpf/preload/bpf_preload_kern.c -@@ -60,9 +60,12 @@ static int finish(void) - &magic, sizeof(magic), &pos); - if (n != sizeof(magic)) - return -EPIPE; -+ - tgid = umd_ops.info.tgid; -- wait_event(tgid->wait_pidfd, thread_group_exited(tgid)); -- umd_ops.info.tgid = NULL; -+ if (tgid) { -+ wait_event(tgid->wait_pidfd, thread_group_exited(tgid)); -+ umd_cleanup_helper(&umd_ops.info); -+ } - return 0; - } - -@@ -80,10 +83,18 @@ static int __init load_umd(void) - - static void __exit fini_umd(void) - { -+ struct pid *tgid; -+ - bpf_preload_ops = NULL; -+ - /* kill UMD in case it's still there due to earlier error */ -- kill_pid(umd_ops.info.tgid, SIGKILL, 1); -- umd_ops.info.tgid = NULL; -+ tgid = umd_ops.info.tgid; -+ if (tgid) { -+ kill_pid(tgid, SIGKILL, 1); -+ -+ wait_event(tgid->wait_pidfd, thread_group_exited(tgid)); -+ umd_cleanup_helper(&umd_ops.info); -+ } - umd_unload_blob(&umd_ops.info); - } - late_initcall(load_umd); -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index e5999d86c76ea..32ca33539052b 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -854,6 +854,11 @@ static int map_create(union bpf_attr *attr) - err = PTR_ERR(btf); - goto free_map; - } -+ if (btf_is_kernel(btf)) { -+ btf_put(btf); -+ err = -EACCES; -+ goto free_map; -+ } - map->btf = btf; - - if (attr->btf_value_type_id) { -diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c -index 35c5887d82ffe..986dabc3d11f0 100644 ---- a/kernel/bpf/trampoline.c -+++ b/kernel/bpf/trampoline.c -@@ -57,19 +57,10 @@ void bpf_image_ksym_del(struct bpf_ksym *ksym) - PAGE_SIZE, true, ksym->name); - } - --static void bpf_trampoline_ksym_add(struct bpf_trampoline *tr) --{ -- struct bpf_ksym *ksym = &tr->ksym; -- -- snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu", tr->key); -- bpf_image_ksym_add(tr->image, ksym); --} -- - static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) - { - struct bpf_trampoline *tr; - struct hlist_head *head; -- void *image; - int i; - - mutex_lock(&trampoline_mutex); -@@ -84,14 +75,6 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) - if (!tr) - goto out; - -- /* is_root was checked earlier. No need for bpf_jit_charge_modmem() */ -- image = bpf_jit_alloc_exec_page(); -- if (!image) { -- kfree(tr); -- tr = NULL; -- goto out; -- } -- - tr->key = key; - INIT_HLIST_NODE(&tr->hlist); - hlist_add_head(&tr->hlist, head); -@@ -99,9 +82,6 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) - mutex_init(&tr->mutex); - for (i = 0; i < BPF_TRAMP_MAX; i++) - INIT_HLIST_HEAD(&tr->progs_hlist[i]); -- tr->image = image; -- INIT_LIST_HEAD_RCU(&tr->ksym.lnode); -- bpf_trampoline_ksym_add(tr); - out: - mutex_unlock(&trampoline_mutex); - return tr; -@@ -185,10 +165,142 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total) - return tprogs; - } - -+static void __bpf_tramp_image_put_deferred(struct work_struct *work) -+{ -+ struct bpf_tramp_image *im; -+ -+ im = container_of(work, struct bpf_tramp_image, work); -+ bpf_image_ksym_del(&im->ksym); -+ bpf_jit_free_exec(im->image); -+ bpf_jit_uncharge_modmem(1); -+ percpu_ref_exit(&im->pcref); -+ kfree_rcu(im, rcu); -+} -+ -+/* callback, fexit step 3 or fentry step 2 */ -+static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu) -+{ -+ struct bpf_tramp_image *im; -+ -+ im = container_of(rcu, struct bpf_tramp_image, rcu); -+ INIT_WORK(&im->work, __bpf_tramp_image_put_deferred); -+ schedule_work(&im->work); -+} -+ -+/* callback, fexit step 2. Called after percpu_ref_kill confirms. */ -+static void __bpf_tramp_image_release(struct percpu_ref *pcref) -+{ -+ struct bpf_tramp_image *im; -+ -+ im = container_of(pcref, struct bpf_tramp_image, pcref); -+ call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu); -+} -+ -+/* callback, fexit or fentry step 1 */ -+static void __bpf_tramp_image_put_rcu_tasks(struct rcu_head *rcu) -+{ -+ struct bpf_tramp_image *im; -+ -+ im = container_of(rcu, struct bpf_tramp_image, rcu); -+ if (im->ip_after_call) -+ /* the case of fmod_ret/fexit trampoline and CONFIG_PREEMPTION=y */ -+ percpu_ref_kill(&im->pcref); -+ else -+ /* the case of fentry trampoline */ -+ call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu); -+} -+ -+static void bpf_tramp_image_put(struct bpf_tramp_image *im) -+{ -+ /* The trampoline image that calls original function is using: -+ * rcu_read_lock_trace to protect sleepable bpf progs -+ * rcu_read_lock to protect normal bpf progs -+ * percpu_ref to protect trampoline itself -+ * rcu tasks to protect trampoline asm not covered by percpu_ref -+ * (which are few asm insns before __bpf_tramp_enter and -+ * after __bpf_tramp_exit) -+ * -+ * The trampoline is unreachable before bpf_tramp_image_put(). -+ * -+ * First, patch the trampoline to avoid calling into fexit progs. -+ * The progs will be freed even if the original function is still -+ * executing or sleeping. -+ * In case of CONFIG_PREEMPT=y use call_rcu_tasks() to wait on -+ * first few asm instructions to execute and call into -+ * __bpf_tramp_enter->percpu_ref_get. -+ * Then use percpu_ref_kill to wait for the trampoline and the original -+ * function to finish. -+ * Then use call_rcu_tasks() to make sure few asm insns in -+ * the trampoline epilogue are done as well. -+ * -+ * In !PREEMPT case the task that got interrupted in the first asm -+ * insns won't go through an RCU quiescent state which the -+ * percpu_ref_kill will be waiting for. Hence the first -+ * call_rcu_tasks() is not necessary. -+ */ -+ if (im->ip_after_call) { -+ int err = bpf_arch_text_poke(im->ip_after_call, BPF_MOD_JUMP, -+ NULL, im->ip_epilogue); -+ WARN_ON(err); -+ if (IS_ENABLED(CONFIG_PREEMPTION)) -+ call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu_tasks); -+ else -+ percpu_ref_kill(&im->pcref); -+ return; -+ } -+ -+ /* The trampoline without fexit and fmod_ret progs doesn't call original -+ * function and doesn't use percpu_ref. -+ * Use call_rcu_tasks_trace() to wait for sleepable progs to finish. -+ * Then use call_rcu_tasks() to wait for the rest of trampoline asm -+ * and normal progs. -+ */ -+ call_rcu_tasks_trace(&im->rcu, __bpf_tramp_image_put_rcu_tasks); -+} -+ -+static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx) -+{ -+ struct bpf_tramp_image *im; -+ struct bpf_ksym *ksym; -+ void *image; -+ int err = -ENOMEM; -+ -+ im = kzalloc(sizeof(*im), GFP_KERNEL); -+ if (!im) -+ goto out; -+ -+ err = bpf_jit_charge_modmem(1); -+ if (err) -+ goto out_free_im; -+ -+ err = -ENOMEM; -+ im->image = image = bpf_jit_alloc_exec_page(); -+ if (!image) -+ goto out_uncharge; -+ -+ err = percpu_ref_init(&im->pcref, __bpf_tramp_image_release, 0, GFP_KERNEL); -+ if (err) -+ goto out_free_image; -+ -+ ksym = &im->ksym; -+ INIT_LIST_HEAD_RCU(&ksym->lnode); -+ snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu_%u", key, idx); -+ bpf_image_ksym_add(image, ksym); -+ return im; -+ -+out_free_image: -+ bpf_jit_free_exec(im->image); -+out_uncharge: -+ bpf_jit_uncharge_modmem(1); -+out_free_im: -+ kfree(im); -+out: -+ return ERR_PTR(err); -+} -+ - static int bpf_trampoline_update(struct bpf_trampoline *tr) - { -- void *old_image = tr->image + ((tr->selector + 1) & 1) * PAGE_SIZE/2; -- void *new_image = tr->image + (tr->selector & 1) * PAGE_SIZE/2; -+ struct bpf_tramp_image *im; - struct bpf_tramp_progs *tprogs; - u32 flags = BPF_TRAMP_F_RESTORE_REGS; - int err, total; -@@ -198,41 +310,42 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) - return PTR_ERR(tprogs); - - if (total == 0) { -- err = unregister_fentry(tr, old_image); -+ err = unregister_fentry(tr, tr->cur_image->image); -+ bpf_tramp_image_put(tr->cur_image); -+ tr->cur_image = NULL; - tr->selector = 0; - goto out; - } - -+ im = bpf_tramp_image_alloc(tr->key, tr->selector); -+ if (IS_ERR(im)) { -+ err = PTR_ERR(im); -+ goto out; -+ } -+ - if (tprogs[BPF_TRAMP_FEXIT].nr_progs || - tprogs[BPF_TRAMP_MODIFY_RETURN].nr_progs) - flags = BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_SKIP_FRAME; - -- /* Though the second half of trampoline page is unused a task could be -- * preempted in the middle of the first half of trampoline and two -- * updates to trampoline would change the code from underneath the -- * preempted task. Hence wait for tasks to voluntarily schedule or go -- * to userspace. -- * The same trampoline can hold both sleepable and non-sleepable progs. -- * synchronize_rcu_tasks_trace() is needed to make sure all sleepable -- * programs finish executing. -- * Wait for these two grace periods together. -- */ -- synchronize_rcu_mult(call_rcu_tasks, call_rcu_tasks_trace); -- -- err = arch_prepare_bpf_trampoline(new_image, new_image + PAGE_SIZE / 2, -+ err = arch_prepare_bpf_trampoline(im, im->image, im->image + PAGE_SIZE, - &tr->func.model, flags, tprogs, - tr->func.addr); - if (err < 0) - goto out; - -- if (tr->selector) -+ WARN_ON(tr->cur_image && tr->selector == 0); -+ WARN_ON(!tr->cur_image && tr->selector); -+ if (tr->cur_image) - /* progs already running at this address */ -- err = modify_fentry(tr, old_image, new_image); -+ err = modify_fentry(tr, tr->cur_image->image, im->image); - else - /* first time registering */ -- err = register_fentry(tr, new_image); -+ err = register_fentry(tr, im->image); - if (err) - goto out; -+ if (tr->cur_image) -+ bpf_tramp_image_put(tr->cur_image); -+ tr->cur_image = im; - tr->selector++; - out: - kfree(tprogs); -@@ -364,17 +477,12 @@ void bpf_trampoline_put(struct bpf_trampoline *tr) - goto out; - if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FEXIT]))) - goto out; -- bpf_image_ksym_del(&tr->ksym); -- /* This code will be executed when all bpf progs (both sleepable and -- * non-sleepable) went through -- * bpf_prog_put()->call_rcu[_tasks_trace]()->bpf_prog_free_deferred(). -- * Hence no need for another synchronize_rcu_tasks_trace() here, -- * but synchronize_rcu_tasks() is still needed, since trampoline -- * may not have had any sleepable programs and we need to wait -- * for tasks to get out of trampoline code before freeing it. -+ /* This code will be executed even when the last bpf_tramp_image -+ * is alive. All progs are detached from the trampoline and the -+ * trampoline image is patched with jmp into epilogue to skip -+ * fexit progs. The fentry-only trampoline will be freed via -+ * multiple rcu callbacks. - */ -- synchronize_rcu_tasks(); -- bpf_jit_free_exec(tr->image); - hlist_del(&tr->hlist); - kfree(tr); - out: -@@ -433,8 +541,18 @@ void notrace __bpf_prog_exit_sleepable(void) - rcu_read_unlock_trace(); - } - -+void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr) -+{ -+ percpu_ref_get(&tr->pcref); -+} -+ -+void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr) -+{ -+ percpu_ref_put(&tr->pcref); -+} -+ - int __weak --arch_prepare_bpf_trampoline(void *image, void *image_end, -+arch_prepare_bpf_trampoline(struct bpf_tramp_image *tr, void *image, void *image_end, - const struct btf_func_model *m, u32 flags, - struct bpf_tramp_progs *tprogs, - void *orig_call) -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index ab23dfb9df1b1..5b233e911c2c2 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -8580,6 +8580,10 @@ static int check_btf_info(struct bpf_verifier_env *env, - btf = btf_get_by_fd(attr->prog_btf_fd); - if (IS_ERR(btf)) - return PTR_ERR(btf); -+ if (btf_is_kernel(btf)) { -+ btf_put(btf); -+ return -EACCES; -+ } - env->prog->aux->btf = btf; - - err = check_btf_func(env, attr, uattr); -diff --git a/kernel/fork.c b/kernel/fork.c -index d66cd1014211b..808af2cc8ab68 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -994,6 +994,13 @@ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p) - #endif - } - -+static void mm_init_pasid(struct mm_struct *mm) -+{ -+#ifdef CONFIG_IOMMU_SUPPORT -+ mm->pasid = INIT_PASID; -+#endif -+} -+ - static void mm_init_uprobes_state(struct mm_struct *mm) - { - #ifdef CONFIG_UPROBES -@@ -1024,6 +1031,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, - mm_init_cpumask(mm); - mm_init_aio(mm); - mm_init_owner(mm, p); -+ mm_init_pasid(mm); - RCU_INIT_POINTER(mm->exe_file, NULL); - mmu_notifier_subscriptions_init(mm); - init_tlb_flush_pending(mm); -diff --git a/kernel/gcov/clang.c b/kernel/gcov/clang.c -index c94b820a1b62c..8743150db2acc 100644 ---- a/kernel/gcov/clang.c -+++ b/kernel/gcov/clang.c -@@ -75,7 +75,9 @@ struct gcov_fn_info { - - u32 num_counters; - u64 *counters; -+#if CONFIG_CLANG_VERSION < 110000 - const char *function_name; -+#endif - }; - - static struct gcov_info *current_info; -@@ -105,6 +107,7 @@ void llvm_gcov_init(llvm_gcov_callback writeout, llvm_gcov_callback flush) - } - EXPORT_SYMBOL(llvm_gcov_init); - -+#if CONFIG_CLANG_VERSION < 110000 - void llvm_gcda_start_file(const char *orig_filename, const char version[4], - u32 checksum) - { -@@ -113,7 +116,17 @@ void llvm_gcda_start_file(const char *orig_filename, const char version[4], - current_info->checksum = checksum; - } - EXPORT_SYMBOL(llvm_gcda_start_file); -+#else -+void llvm_gcda_start_file(const char *orig_filename, u32 version, u32 checksum) -+{ -+ current_info->filename = orig_filename; -+ current_info->version = version; -+ current_info->checksum = checksum; -+} -+EXPORT_SYMBOL(llvm_gcda_start_file); -+#endif - -+#if CONFIG_CLANG_VERSION < 110000 - void llvm_gcda_emit_function(u32 ident, const char *function_name, - u32 func_checksum, u8 use_extra_checksum, u32 cfg_checksum) - { -@@ -133,6 +146,24 @@ void llvm_gcda_emit_function(u32 ident, const char *function_name, - list_add_tail(&info->head, ¤t_info->functions); - } - EXPORT_SYMBOL(llvm_gcda_emit_function); -+#else -+void llvm_gcda_emit_function(u32 ident, u32 func_checksum, -+ u8 use_extra_checksum, u32 cfg_checksum) -+{ -+ struct gcov_fn_info *info = kzalloc(sizeof(*info), GFP_KERNEL); -+ -+ if (!info) -+ return; -+ -+ INIT_LIST_HEAD(&info->head); -+ info->ident = ident; -+ info->checksum = func_checksum; -+ info->use_extra_checksum = use_extra_checksum; -+ info->cfg_checksum = cfg_checksum; -+ list_add_tail(&info->head, ¤t_info->functions); -+} -+EXPORT_SYMBOL(llvm_gcda_emit_function); -+#endif - - void llvm_gcda_emit_arcs(u32 num_counters, u64 *counters) - { -@@ -295,6 +326,7 @@ void gcov_info_add(struct gcov_info *dst, struct gcov_info *src) - } - } - -+#if CONFIG_CLANG_VERSION < 110000 - static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn) - { - size_t cv_size; /* counter values size */ -@@ -322,6 +354,28 @@ err_name: - kfree(fn_dup); - return NULL; - } -+#else -+static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn) -+{ -+ size_t cv_size; /* counter values size */ -+ struct gcov_fn_info *fn_dup = kmemdup(fn, sizeof(*fn), -+ GFP_KERNEL); -+ if (!fn_dup) -+ return NULL; -+ INIT_LIST_HEAD(&fn_dup->head); -+ -+ cv_size = fn->num_counters * sizeof(fn->counters[0]); -+ fn_dup->counters = vmalloc(cv_size); -+ if (!fn_dup->counters) { -+ kfree(fn_dup); -+ return NULL; -+ } -+ -+ memcpy(fn_dup->counters, fn->counters, cv_size); -+ -+ return fn_dup; -+} -+#endif - - /** - * gcov_info_dup - duplicate profiling data set -@@ -362,6 +416,7 @@ err: - * gcov_info_free - release memory for profiling data set duplicate - * @info: profiling data set duplicate to free - */ -+#if CONFIG_CLANG_VERSION < 110000 - void gcov_info_free(struct gcov_info *info) - { - struct gcov_fn_info *fn, *tmp; -@@ -375,6 +430,20 @@ void gcov_info_free(struct gcov_info *info) - kfree(info->filename); - kfree(info); - } -+#else -+void gcov_info_free(struct gcov_info *info) -+{ -+ struct gcov_fn_info *fn, *tmp; -+ -+ list_for_each_entry_safe(fn, tmp, &info->functions, head) { -+ vfree(fn->counters); -+ list_del(&fn->head); -+ kfree(fn); -+ } -+ kfree(info->filename); -+ kfree(info); -+} -+#endif - - #define ITER_STRIDE PAGE_SIZE - -diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c -index 1358fa4abfa83..0f4530b3a8cd9 100644 ---- a/kernel/power/energy_model.c -+++ b/kernel/power/energy_model.c -@@ -98,7 +98,7 @@ static int __init em_debug_init(void) - - return 0; - } --core_initcall(em_debug_init); -+fs_initcall(em_debug_init); - #else /* CONFIG_DEBUG_FS */ - static void em_debug_create_pd(struct device *dev) {} - static void em_debug_remove_pd(struct device *dev) {} -diff --git a/kernel/static_call.c b/kernel/static_call.c -index db914da6e7854..49efbdc5b4800 100644 ---- a/kernel/static_call.c -+++ b/kernel/static_call.c -@@ -12,6 +12,8 @@ - - extern struct static_call_site __start_static_call_sites[], - __stop_static_call_sites[]; -+extern struct static_call_tramp_key __start_static_call_tramp_key[], -+ __stop_static_call_tramp_key[]; - - static bool static_call_initialized; - -@@ -33,27 +35,30 @@ static inline void *static_call_addr(struct static_call_site *site) - return (void *)((long)site->addr + (long)&site->addr); - } - -+static inline unsigned long __static_call_key(const struct static_call_site *site) -+{ -+ return (long)site->key + (long)&site->key; -+} - - static inline struct static_call_key *static_call_key(const struct static_call_site *site) - { -- return (struct static_call_key *) -- (((long)site->key + (long)&site->key) & ~STATIC_CALL_SITE_FLAGS); -+ return (void *)(__static_call_key(site) & ~STATIC_CALL_SITE_FLAGS); - } - - /* These assume the key is word-aligned. */ - static inline bool static_call_is_init(struct static_call_site *site) - { -- return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_INIT; -+ return __static_call_key(site) & STATIC_CALL_SITE_INIT; - } - - static inline bool static_call_is_tail(struct static_call_site *site) - { -- return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_TAIL; -+ return __static_call_key(site) & STATIC_CALL_SITE_TAIL; - } - - static inline void static_call_set_init(struct static_call_site *site) - { -- site->key = ((long)static_call_key(site) | STATIC_CALL_SITE_INIT) - -+ site->key = (__static_call_key(site) | STATIC_CALL_SITE_INIT) - - (long)&site->key; - } - -@@ -197,7 +202,7 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) - } - - arch_static_call_transform(site_addr, NULL, func, -- static_call_is_tail(site)); -+ static_call_is_tail(site)); - } - } - -@@ -332,10 +337,60 @@ static int __static_call_mod_text_reserved(void *start, void *end) - return ret; - } - -+static unsigned long tramp_key_lookup(unsigned long addr) -+{ -+ struct static_call_tramp_key *start = __start_static_call_tramp_key; -+ struct static_call_tramp_key *stop = __stop_static_call_tramp_key; -+ struct static_call_tramp_key *tramp_key; -+ -+ for (tramp_key = start; tramp_key != stop; tramp_key++) { -+ unsigned long tramp; -+ -+ tramp = (long)tramp_key->tramp + (long)&tramp_key->tramp; -+ if (tramp == addr) -+ return (long)tramp_key->key + (long)&tramp_key->key; -+ } -+ -+ return 0; -+} -+ - static int static_call_add_module(struct module *mod) - { -- return __static_call_init(mod, mod->static_call_sites, -- mod->static_call_sites + mod->num_static_call_sites); -+ struct static_call_site *start = mod->static_call_sites; -+ struct static_call_site *stop = start + mod->num_static_call_sites; -+ struct static_call_site *site; -+ -+ for (site = start; site != stop; site++) { -+ unsigned long s_key = __static_call_key(site); -+ unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS; -+ unsigned long key; -+ -+ /* -+ * Is the key is exported, 'addr' points to the key, which -+ * means modules are allowed to call static_call_update() on -+ * it. -+ * -+ * Otherwise, the key isn't exported, and 'addr' points to the -+ * trampoline so we need to lookup the key. -+ * -+ * We go through this dance to prevent crazy modules from -+ * abusing sensitive static calls. -+ */ -+ if (!kernel_text_address(addr)) -+ continue; -+ -+ key = tramp_key_lookup(addr); -+ if (!key) { -+ pr_warn("Failed to fixup __raw_static_call() usage at: %ps\n", -+ static_call_addr(site)); -+ return -EINVAL; -+ } -+ -+ key |= s_key & STATIC_CALL_SITE_FLAGS; -+ site->key = key - (long)&site->key; -+ } -+ -+ return __static_call_init(mod, start, stop); - } - - static void static_call_del_module(struct module *mod) -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 4d8e355755491..b7e29db127fa2 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -5045,6 +5045,20 @@ struct ftrace_direct_func *ftrace_find_direct_func(unsigned long addr) - return NULL; - } - -+static struct ftrace_direct_func *ftrace_alloc_direct_func(unsigned long addr) -+{ -+ struct ftrace_direct_func *direct; -+ -+ direct = kmalloc(sizeof(*direct), GFP_KERNEL); -+ if (!direct) -+ return NULL; -+ direct->addr = addr; -+ direct->count = 0; -+ list_add_rcu(&direct->next, &ftrace_direct_funcs); -+ ftrace_direct_func_count++; -+ return direct; -+} -+ - /** - * register_ftrace_direct - Call a custom trampoline directly - * @ip: The address of the nop at the beginning of a function -@@ -5120,15 +5134,11 @@ int register_ftrace_direct(unsigned long ip, unsigned long addr) - - direct = ftrace_find_direct_func(addr); - if (!direct) { -- direct = kmalloc(sizeof(*direct), GFP_KERNEL); -+ direct = ftrace_alloc_direct_func(addr); - if (!direct) { - kfree(entry); - goto out_unlock; - } -- direct->addr = addr; -- direct->count = 0; -- list_add_rcu(&direct->next, &ftrace_direct_funcs); -- ftrace_direct_func_count++; - } - - entry->ip = ip; -@@ -5329,6 +5339,7 @@ int __weak ftrace_modify_direct_caller(struct ftrace_func_entry *entry, - int modify_ftrace_direct(unsigned long ip, - unsigned long old_addr, unsigned long new_addr) - { -+ struct ftrace_direct_func *direct, *new_direct = NULL; - struct ftrace_func_entry *entry; - struct dyn_ftrace *rec; - int ret = -ENODEV; -@@ -5344,6 +5355,20 @@ int modify_ftrace_direct(unsigned long ip, - if (entry->direct != old_addr) - goto out_unlock; - -+ direct = ftrace_find_direct_func(old_addr); -+ if (WARN_ON(!direct)) -+ goto out_unlock; -+ if (direct->count > 1) { -+ ret = -ENOMEM; -+ new_direct = ftrace_alloc_direct_func(new_addr); -+ if (!new_direct) -+ goto out_unlock; -+ direct->count--; -+ new_direct->count++; -+ } else { -+ direct->addr = new_addr; -+ } -+ - /* - * If there's no other ftrace callback on the rec->ip location, - * then it can be changed directly by the architecture. -@@ -5357,6 +5382,14 @@ int modify_ftrace_direct(unsigned long ip, - ret = 0; - } - -+ if (unlikely(ret && new_direct)) { -+ direct->count++; -+ list_del_rcu(&new_direct->next); -+ synchronize_rcu_tasks(); -+ kfree(new_direct); -+ ftrace_direct_func_count--; -+ } -+ - out_unlock: - mutex_unlock(&ftrace_lock); - mutex_unlock(&direct_mutex); -diff --git a/kernel/usermode_driver.c b/kernel/usermode_driver.c -index 0b35212ffc3d0..bb7bb3b478abf 100644 ---- a/kernel/usermode_driver.c -+++ b/kernel/usermode_driver.c -@@ -139,13 +139,22 @@ static void umd_cleanup(struct subprocess_info *info) - struct umd_info *umd_info = info->data; - - /* cleanup if umh_setup() was successful but exec failed */ -- if (info->retval) { -- fput(umd_info->pipe_to_umh); -- fput(umd_info->pipe_from_umh); -- put_pid(umd_info->tgid); -- umd_info->tgid = NULL; -- } -+ if (info->retval) -+ umd_cleanup_helper(umd_info); -+} -+ -+/** -+ * umd_cleanup_helper - release the resources which were allocated in umd_setup -+ * @info: information about usermode driver -+ */ -+void umd_cleanup_helper(struct umd_info *info) -+{ -+ fput(info->pipe_to_umh); -+ fput(info->pipe_from_umh); -+ put_pid(info->tgid); -+ info->tgid = NULL; - } -+EXPORT_SYMBOL_GPL(umd_cleanup_helper); - - /** - * fork_usermode_driver - fork a usermode driver -diff --git a/mm/highmem.c b/mm/highmem.c -index 86f2b9495f9cf..6ef8f5e05e7e5 100644 ---- a/mm/highmem.c -+++ b/mm/highmem.c -@@ -618,7 +618,7 @@ void __kmap_local_sched_out(void) - int idx; - - /* With debug all even slots are unmapped and act as guard */ -- if (IS_ENABLED(CONFIG_DEBUG_HIGHMEM) && !(i & 0x01)) { -+ if (IS_ENABLED(CONFIG_DEBUG_KMAP_LOCAL) && !(i & 0x01)) { - WARN_ON_ONCE(!pte_none(pteval)); - continue; - } -@@ -654,7 +654,7 @@ void __kmap_local_sched_in(void) - int idx; - - /* With debug all even slots are unmapped and act as guard */ -- if (IS_ENABLED(CONFIG_DEBUG_HIGHMEM) && !(i & 0x01)) { -+ if (IS_ENABLED(CONFIG_DEBUG_KMAP_LOCAL) && !(i & 0x01)) { - WARN_ON_ONCE(!pte_none(pteval)); - continue; - } -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 1690e8db5b0de..8e89b277ffcc3 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -285,6 +285,17 @@ static void record_hugetlb_cgroup_uncharge_info(struct hugetlb_cgroup *h_cg, - nrg->reservation_counter = - &h_cg->rsvd_hugepage[hstate_index(h)]; - nrg->css = &h_cg->css; -+ /* -+ * The caller will hold exactly one h_cg->css reference for the -+ * whole contiguous reservation region. But this area might be -+ * scattered when there are already some file_regions reside in -+ * it. As a result, many file_regions may share only one css -+ * reference. In order to ensure that one file_region must hold -+ * exactly one h_cg->css reference, we should do css_get for -+ * each file_region and leave the reference held by caller -+ * untouched. -+ */ -+ css_get(&h_cg->css); - if (!resv->pages_per_hpage) - resv->pages_per_hpage = pages_per_huge_page(h); - /* pages_per_hpage should be the same for all entries in -@@ -298,6 +309,14 @@ static void record_hugetlb_cgroup_uncharge_info(struct hugetlb_cgroup *h_cg, - #endif - } - -+static void put_uncharge_info(struct file_region *rg) -+{ -+#ifdef CONFIG_CGROUP_HUGETLB -+ if (rg->css) -+ css_put(rg->css); -+#endif -+} -+ - static bool has_same_uncharge_info(struct file_region *rg, - struct file_region *org) - { -@@ -321,6 +340,7 @@ static void coalesce_file_region(struct resv_map *resv, struct file_region *rg) - prg->to = rg->to; - - list_del(&rg->link); -+ put_uncharge_info(rg); - kfree(rg); - - rg = prg; -@@ -332,6 +352,7 @@ static void coalesce_file_region(struct resv_map *resv, struct file_region *rg) - nrg->from = rg->from; - - list_del(&rg->link); -+ put_uncharge_info(rg); - kfree(rg); - } - } -@@ -664,7 +685,7 @@ retry: - - del += t - f; - hugetlb_cgroup_uncharge_file_region( -- resv, rg, t - f); -+ resv, rg, t - f, false); - - /* New entry for end of split region */ - nrg->from = t; -@@ -685,7 +706,7 @@ retry: - if (f <= rg->from && t >= rg->to) { /* Remove entire region */ - del += rg->to - rg->from; - hugetlb_cgroup_uncharge_file_region(resv, rg, -- rg->to - rg->from); -+ rg->to - rg->from, true); - list_del(&rg->link); - kfree(rg); - continue; -@@ -693,13 +714,13 @@ retry: - - if (f <= rg->from) { /* Trim beginning of region */ - hugetlb_cgroup_uncharge_file_region(resv, rg, -- t - rg->from); -+ t - rg->from, false); - - del += t - rg->from; - rg->from = t; - } else { /* Trim end of region */ - hugetlb_cgroup_uncharge_file_region(resv, rg, -- rg->to - f); -+ rg->to - f, false); - - del += rg->to - f; - rg->to = f; -@@ -5191,6 +5212,10 @@ int hugetlb_reserve_pages(struct inode *inode, - */ - long rsv_adjust; - -+ /* -+ * hugetlb_cgroup_uncharge_cgroup_rsvd() will put the -+ * reference to h_cg->css. See comment below for detail. -+ */ - hugetlb_cgroup_uncharge_cgroup_rsvd( - hstate_index(h), - (chg - add) * pages_per_huge_page(h), h_cg); -@@ -5198,6 +5223,14 @@ int hugetlb_reserve_pages(struct inode *inode, - rsv_adjust = hugepage_subpool_put_pages(spool, - chg - add); - hugetlb_acct_memory(h, -rsv_adjust); -+ } else if (h_cg) { -+ /* -+ * The file_regions will hold their own reference to -+ * h_cg->css. So we should release the reference held -+ * via hugetlb_cgroup_charge_cgroup_rsvd() when we are -+ * done. -+ */ -+ hugetlb_cgroup_put_rsvd_cgroup(h_cg); - } - } - return 0; -diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c -index 9182848dda3e0..1348819f546cb 100644 ---- a/mm/hugetlb_cgroup.c -+++ b/mm/hugetlb_cgroup.c -@@ -391,7 +391,8 @@ void hugetlb_cgroup_uncharge_counter(struct resv_map *resv, unsigned long start, - - void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv, - struct file_region *rg, -- unsigned long nr_pages) -+ unsigned long nr_pages, -+ bool region_del) - { - if (hugetlb_cgroup_disabled() || !resv || !rg || !nr_pages) - return; -@@ -400,7 +401,12 @@ void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv, - !resv->reservation_counter) { - page_counter_uncharge(rg->reservation_counter, - nr_pages * resv->pages_per_hpage); -- css_put(rg->css); -+ /* -+ * Only do css_put(rg->css) when we delete the entire region -+ * because one file_region must hold exactly one css reference. -+ */ -+ if (region_del) -+ css_put(rg->css); - } - } - -diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c -index 61ee40ed804ee..459d195d2ff64 100644 ---- a/mm/mmu_notifier.c -+++ b/mm/mmu_notifier.c -@@ -501,10 +501,33 @@ static int mn_hlist_invalidate_range_start( - ""); - WARN_ON(mmu_notifier_range_blockable(range) || - _ret != -EAGAIN); -+ /* -+ * We call all the notifiers on any EAGAIN, -+ * there is no way for a notifier to know if -+ * its start method failed, thus a start that -+ * does EAGAIN can't also do end. -+ */ -+ WARN_ON(ops->invalidate_range_end); - ret = _ret; - } - } - } -+ -+ if (ret) { -+ /* -+ * Must be non-blocking to get here. If there are multiple -+ * notifiers and one or more failed start, any that succeeded -+ * start are expecting their end to be called. Do so now. -+ */ -+ hlist_for_each_entry_rcu(subscription, &subscriptions->list, -+ hlist, srcu_read_lock_held(&srcu)) { -+ if (!subscription->ops->invalidate_range_end) -+ continue; -+ -+ subscription->ops->invalidate_range_end(subscription, -+ range); -+ } -+ } - srcu_read_unlock(&srcu, id); - - return ret; -diff --git a/mm/z3fold.c b/mm/z3fold.c -index dacb0d70fa61c..36d810cac99d0 100644 ---- a/mm/z3fold.c -+++ b/mm/z3fold.c -@@ -1353,8 +1353,22 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) - page = list_entry(pos, struct page, lru); - - zhdr = page_address(page); -- if (test_bit(PAGE_HEADLESS, &page->private)) -+ if (test_bit(PAGE_HEADLESS, &page->private)) { -+ /* -+ * For non-headless pages, we wait to do this -+ * until we have the page lock to avoid racing -+ * with __z3fold_alloc(). Headless pages don't -+ * have a lock (and __z3fold_alloc() will never -+ * see them), but we still need to test and set -+ * PAGE_CLAIMED to avoid racing with -+ * z3fold_free(), so just do it now before -+ * leaving the loop. -+ */ -+ if (test_and_set_bit(PAGE_CLAIMED, &page->private)) -+ continue; -+ - break; -+ } - - if (kref_get_unless_zero(&zhdr->refcount) == 0) { - zhdr = NULL; -diff --git a/net/bridge/br_switchdev.c b/net/bridge/br_switchdev.c -index 015209bf44aa4..3c42095fa75fd 100644 ---- a/net/bridge/br_switchdev.c -+++ b/net/bridge/br_switchdev.c -@@ -123,6 +123,8 @@ br_switchdev_fdb_notify(const struct net_bridge_fdb_entry *fdb, int type) - { - if (!fdb->dst) - return; -+ if (test_bit(BR_FDB_LOCAL, &fdb->flags)) -+ return; - - switch (type) { - case RTM_DELNEIGH: -diff --git a/net/can/isotp.c b/net/can/isotp.c -index 3ef7f78e553bc..15ea1234d4573 100644 ---- a/net/can/isotp.c -+++ b/net/can/isotp.c -@@ -196,7 +196,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) - nskb->dev = dev; - can_skb_set_owner(nskb, sk); - ncf = (struct canfd_frame *)nskb->data; -- skb_put(nskb, so->ll.mtu); -+ skb_put_zero(nskb, so->ll.mtu); - - /* create & send flow control reply */ - ncf->can_id = so->txid; -@@ -215,8 +215,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) - if (ae) - ncf->data[0] = so->opt.ext_address; - -- if (so->ll.mtu == CANFD_MTU) -- ncf->flags = so->ll.tx_flags; -+ ncf->flags = so->ll.tx_flags; - - can_send_ret = can_send(nskb, 1); - if (can_send_ret) -@@ -780,7 +779,7 @@ isotp_tx_burst: - can_skb_prv(skb)->skbcnt = 0; - - cf = (struct canfd_frame *)skb->data; -- skb_put(skb, so->ll.mtu); -+ skb_put_zero(skb, so->ll.mtu); - - /* create consecutive frame */ - isotp_fill_dataframe(cf, so, ae, 0); -@@ -790,8 +789,7 @@ isotp_tx_burst: - so->tx.sn %= 16; - so->tx.bs++; - -- if (so->ll.mtu == CANFD_MTU) -- cf->flags = so->ll.tx_flags; -+ cf->flags = so->ll.tx_flags; - - skb->dev = dev; - can_skb_set_owner(skb, sk); -@@ -897,7 +895,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) - so->tx.idx = 0; - - cf = (struct canfd_frame *)skb->data; -- skb_put(skb, so->ll.mtu); -+ skb_put_zero(skb, so->ll.mtu); - - /* check for single frame transmission depending on TX_DL */ - if (size <= so->tx.ll_dl - SF_PCI_SZ4 - ae - off) { -@@ -939,8 +937,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) - } - - /* send the first or only CAN frame */ -- if (so->ll.mtu == CANFD_MTU) -- cf->flags = so->ll.tx_flags; -+ cf->flags = so->ll.tx_flags; - - skb->dev = dev; - skb->sk = sk; -@@ -1228,7 +1225,8 @@ static int isotp_setsockopt(struct socket *sock, int level, int optname, - if (ll.mtu != CAN_MTU && ll.mtu != CANFD_MTU) - return -EINVAL; - -- if (ll.mtu == CAN_MTU && ll.tx_dl > CAN_MAX_DLEN) -+ if (ll.mtu == CAN_MTU && -+ (ll.tx_dl > CAN_MAX_DLEN || ll.tx_flags != 0)) - return -EINVAL; - - memcpy(&so->ll, &ll, sizeof(ll)); -diff --git a/net/core/dev.c b/net/core/dev.c -index a5a1dbe66b762..9e3be2ae86532 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1182,6 +1182,18 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf) - return -ENOMEM; - - for_each_netdev(net, d) { -+ struct netdev_name_node *name_node; -+ list_for_each_entry(name_node, &d->name_node->list, list) { -+ if (!sscanf(name_node->name, name, &i)) -+ continue; -+ if (i < 0 || i >= max_netdevices) -+ continue; -+ -+ /* avoid cases where sscanf is not exact inverse of printf */ -+ snprintf(buf, IFNAMSIZ, name, i); -+ if (!strncmp(buf, name_node->name, IFNAMSIZ)) -+ set_bit(i, inuse); -+ } - if (!sscanf(d->name, name, &i)) - continue; - if (i < 0 || i >= max_netdevices) -@@ -11182,7 +11194,7 @@ static void __net_exit default_device_exit(struct net *net) - continue; - - /* Leave virtual devices for the generic cleanup */ -- if (dev->rtnl_link_ops) -+ if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund) - continue; - - /* Push remaining network devices to init_net */ -diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c -index 571f191c06d94..db65ce62b625a 100644 ---- a/net/core/drop_monitor.c -+++ b/net/core/drop_monitor.c -@@ -1053,6 +1053,20 @@ static int net_dm_hw_monitor_start(struct netlink_ext_ack *extack) - return 0; - - err_module_put: -+ for_each_possible_cpu(cpu) { -+ struct per_cpu_dm_data *hw_data = &per_cpu(dm_hw_cpu_data, cpu); -+ struct sk_buff *skb; -+ -+ del_timer_sync(&hw_data->send_timer); -+ cancel_work_sync(&hw_data->dm_alert_work); -+ while ((skb = __skb_dequeue(&hw_data->drop_queue))) { -+ struct devlink_trap_metadata *hw_metadata; -+ -+ hw_metadata = NET_DM_SKB_CB(skb)->hw_metadata; -+ net_dm_hw_metadata_free(hw_metadata); -+ consume_skb(skb); -+ } -+ } - module_put(THIS_MODULE); - return rc; - } -@@ -1134,6 +1148,15 @@ static int net_dm_trace_on_set(struct netlink_ext_ack *extack) - err_unregister_trace: - unregister_trace_kfree_skb(ops->kfree_skb_probe, NULL); - err_module_put: -+ for_each_possible_cpu(cpu) { -+ struct per_cpu_dm_data *data = &per_cpu(dm_cpu_data, cpu); -+ struct sk_buff *skb; -+ -+ del_timer_sync(&data->send_timer); -+ cancel_work_sync(&data->dm_alert_work); -+ while ((skb = __skb_dequeue(&data->drop_queue))) -+ consume_skb(skb); -+ } - module_put(THIS_MODULE); - return rc; - } -diff --git a/net/core/dst.c b/net/core/dst.c -index 0c01bd8d9d81e..fb3bcba87744d 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -237,37 +237,62 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old) - } - EXPORT_SYMBOL(__dst_destroy_metrics_generic); - --static struct dst_ops md_dst_ops = { -- .family = AF_UNSPEC, --}; -+struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie) -+{ -+ return NULL; -+} - --static int dst_md_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb) -+u32 *dst_blackhole_cow_metrics(struct dst_entry *dst, unsigned long old) - { -- WARN_ONCE(1, "Attempting to call output on metadata dst\n"); -- kfree_skb(skb); -- return 0; -+ return NULL; - } - --static int dst_md_discard(struct sk_buff *skb) -+struct neighbour *dst_blackhole_neigh_lookup(const struct dst_entry *dst, -+ struct sk_buff *skb, -+ const void *daddr) - { -- WARN_ONCE(1, "Attempting to call input on metadata dst\n"); -- kfree_skb(skb); -- return 0; -+ return NULL; -+} -+ -+void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh) -+{ -+} -+EXPORT_SYMBOL_GPL(dst_blackhole_update_pmtu); -+ -+void dst_blackhole_redirect(struct dst_entry *dst, struct sock *sk, -+ struct sk_buff *skb) -+{ -+} -+EXPORT_SYMBOL_GPL(dst_blackhole_redirect); -+ -+unsigned int dst_blackhole_mtu(const struct dst_entry *dst) -+{ -+ unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); -+ -+ return mtu ? : dst->dev->mtu; - } -+EXPORT_SYMBOL_GPL(dst_blackhole_mtu); -+ -+static struct dst_ops dst_blackhole_ops = { -+ .family = AF_UNSPEC, -+ .neigh_lookup = dst_blackhole_neigh_lookup, -+ .check = dst_blackhole_check, -+ .cow_metrics = dst_blackhole_cow_metrics, -+ .update_pmtu = dst_blackhole_update_pmtu, -+ .redirect = dst_blackhole_redirect, -+ .mtu = dst_blackhole_mtu, -+}; - - static void __metadata_dst_init(struct metadata_dst *md_dst, - enum metadata_type type, u8 optslen) -- - { - struct dst_entry *dst; - - dst = &md_dst->dst; -- dst_init(dst, &md_dst_ops, NULL, 1, DST_OBSOLETE_NONE, -+ dst_init(dst, &dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, - DST_METADATA | DST_NOCOUNT); -- -- dst->input = dst_md_discard; -- dst->output = dst_md_discard_out; -- - memset(dst + 1, 0, sizeof(*md_dst) + optslen - sizeof(*dst)); - md_dst->type = type; - } -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 6f1adba6695fc..7a06d43016175 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -175,7 +175,7 @@ void skb_flow_get_icmp_tci(const struct sk_buff *skb, - * avoid confusion with packets without such field - */ - if (icmp_has_id(ih->type)) -- key_icmp->id = ih->un.echo.id ? : 1; -+ key_icmp->id = ih->un.echo.id ? ntohs(ih->un.echo.id) : 1; - else - key_icmp->id = 0; - } -diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c -index 1f73603913f5a..2be5c69824f94 100644 ---- a/net/dccp/ipv6.c -+++ b/net/dccp/ipv6.c -@@ -319,6 +319,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb) - if (!ipv6_unicast_destination(skb)) - return 0; /* discard, don't send a reset here */ - -+ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { -+ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); -+ return 0; -+ } -+ - if (dccp_bad_service_code(sk, service)) { - dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE; - goto drop; -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 6bd7ca09af03d..fd472eae4f5ca 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -705,12 +705,15 @@ static bool reqsk_queue_unlink(struct request_sock *req) - return found; - } - --void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) -+bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) - { -- if (reqsk_queue_unlink(req)) { -+ bool unlinked = reqsk_queue_unlink(req); -+ -+ if (unlinked) { - reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req); - reqsk_put(req); - } -+ return unlinked; - } - EXPORT_SYMBOL(inet_csk_reqsk_queue_drop); - -diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c -index c576a63d09db1..d1e04d2b5170e 100644 ---- a/net/ipv4/netfilter/arp_tables.c -+++ b/net/ipv4/netfilter/arp_tables.c -@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, - - local_bh_disable(); - addend = xt_write_recseq_begin(); -- private = rcu_access_pointer(table->private); -+ private = READ_ONCE(table->private); /* Address dependency. */ - cpu = smp_processor_id(); - table_base = private->entries; - jumpstack = (struct arpt_entry **)private->jumpstack[cpu]; -@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) - { - unsigned int countersize; - struct xt_counters *counters; -- const struct xt_table_info *private = xt_table_get_private_protected(table); -+ const struct xt_table_info *private = table->private; - - /* We need atomic snapshot of counters: rest doesn't change - * (other than comefrom, which userspace doesn't care -@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size, - unsigned int off, num; - const struct arpt_entry *e; - struct xt_counters *counters; -- struct xt_table_info *private = xt_table_get_private_protected(table); -+ struct xt_table_info *private = table->private; - int ret = 0; - void *loc_cpu_entry; - -@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user, const int *len) - t = xt_request_find_table_lock(net, NFPROTO_ARP, name); - if (!IS_ERR(t)) { - struct arpt_getinfo info; -- const struct xt_table_info *private = xt_table_get_private_protected(t); -+ const struct xt_table_info *private = t->private; - #ifdef CONFIG_COMPAT - struct xt_table_info tmp; - -@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, - - t = xt_find_table_lock(net, NFPROTO_ARP, get.name); - if (!IS_ERR(t)) { -- const struct xt_table_info *private = xt_table_get_private_protected(t); -+ const struct xt_table_info *private = t->private; - - if (get.size == private->size) - ret = copy_entries_to_user(private->size, -@@ -1017,7 +1017,7 @@ static int do_add_counters(struct net *net, sockptr_t arg, unsigned int len) - } - - local_bh_disable(); -- private = xt_table_get_private_protected(t); -+ private = t->private; - if (private->number != tmp.num_counters) { - ret = -EINVAL; - goto unlock_up_free; -@@ -1330,7 +1330,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, - void __user *userptr) - { - struct xt_counters *counters; -- const struct xt_table_info *private = xt_table_get_private_protected(table); -+ const struct xt_table_info *private = table->private; - void __user *pos; - unsigned int size; - int ret = 0; -@@ -1379,7 +1379,7 @@ static int compat_get_entries(struct net *net, - xt_compat_lock(NFPROTO_ARP); - t = xt_find_table_lock(net, NFPROTO_ARP, get.name); - if (!IS_ERR(t)) { -- const struct xt_table_info *private = xt_table_get_private_protected(t); -+ const struct xt_table_info *private = t->private; - struct xt_table_info info; - - ret = compat_table_info(private, &info); -diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c -index e8f6f9d862376..f15bc21d73016 100644 ---- a/net/ipv4/netfilter/ip_tables.c -+++ b/net/ipv4/netfilter/ip_tables.c -@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb, - WARN_ON(!(table->valid_hooks & (1 << hook))); - local_bh_disable(); - addend = xt_write_recseq_begin(); -- private = rcu_access_pointer(table->private); -+ private = READ_ONCE(table->private); /* Address dependency. */ - cpu = smp_processor_id(); - table_base = private->entries; - jumpstack = (struct ipt_entry **)private->jumpstack[cpu]; -@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) - { - unsigned int countersize; - struct xt_counters *counters; -- const struct xt_table_info *private = xt_table_get_private_protected(table); -+ const struct xt_table_info *private = table->private; - - /* We need atomic snapshot of counters: rest doesn't change - (other than comefrom, which userspace doesn't care -@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size, - unsigned int off, num; - const struct ipt_entry *e; - struct xt_counters *counters; -- const struct xt_table_info *private = xt_table_get_private_protected(table); -+ const struct xt_table_info *private = table->private; - int ret = 0; - const void *loc_cpu_entry; - -@@ -964,7 +964,7 @@ static int get_info(struct net *net, void __user *user, const int *len) - t = xt_request_find_table_lock(net, AF_INET, name); - if (!IS_ERR(t)) { - struct ipt_getinfo info; -- const struct xt_table_info *private = xt_table_get_private_protected(t); -+ const struct xt_table_info *private = t->private; - #ifdef CONFIG_COMPAT - struct xt_table_info tmp; - -@@ -1018,7 +1018,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, - - t = xt_find_table_lock(net, AF_INET, get.name); - if (!IS_ERR(t)) { -- const struct xt_table_info *private = xt_table_get_private_protected(t); -+ const struct xt_table_info *private = t->private; - if (get.size == private->size) - ret = copy_entries_to_user(private->size, - t, uptr->entrytable); -@@ -1173,7 +1173,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) - } - - local_bh_disable(); -- private = xt_table_get_private_protected(t); -+ private = t->private; - if (private->number != tmp.num_counters) { - ret = -EINVAL; - goto unlock_up_free; -@@ -1543,7 +1543,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, - void __user *userptr) - { - struct xt_counters *counters; -- const struct xt_table_info *private = xt_table_get_private_protected(table); -+ const struct xt_table_info *private = table->private; - void __user *pos; - unsigned int size; - int ret = 0; -@@ -1589,7 +1589,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr, - xt_compat_lock(AF_INET); - t = xt_find_table_lock(net, AF_INET, get.name); - if (!IS_ERR(t)) { -- const struct xt_table_info *private = xt_table_get_private_protected(t); -+ const struct xt_table_info *private = t->private; - struct xt_table_info info; - ret = compat_table_info(private, &info); - if (!ret && get.size == info.size) -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index e26652ff7059d..983b4db1868fd 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -2682,44 +2682,15 @@ out: - return rth; - } - --static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie) --{ -- return NULL; --} -- --static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst) --{ -- unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); -- -- return mtu ? : dst->dev->mtu; --} -- --static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu, -- bool confirm_neigh) --{ --} -- --static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb) --{ --} -- --static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst, -- unsigned long old) --{ -- return NULL; --} -- - static struct dst_ops ipv4_dst_blackhole_ops = { -- .family = AF_INET, -- .check = ipv4_blackhole_dst_check, -- .mtu = ipv4_blackhole_mtu, -- .default_advmss = ipv4_default_advmss, -- .update_pmtu = ipv4_rt_blackhole_update_pmtu, -- .redirect = ipv4_rt_blackhole_redirect, -- .cow_metrics = ipv4_rt_blackhole_cow_metrics, -- .neigh_lookup = ipv4_neigh_lookup, -+ .family = AF_INET, -+ .default_advmss = ipv4_default_advmss, -+ .neigh_lookup = ipv4_neigh_lookup, -+ .check = dst_blackhole_check, -+ .cow_metrics = dst_blackhole_cow_metrics, -+ .update_pmtu = dst_blackhole_update_pmtu, -+ .redirect = dst_blackhole_redirect, -+ .mtu = dst_blackhole_mtu, - }; - - struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig) -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index 0055ae0a3bf84..7513ba45553db 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -804,8 +804,11 @@ embryonic_reset: - tcp_reset(sk, skb); - } - if (!fastopen) { -- inet_csk_reqsk_queue_drop(sk, req); -- __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); -+ bool unlinked = inet_csk_reqsk_queue_drop(sk, req); -+ -+ if (unlinked) -+ __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); -+ *req_stolen = !unlinked; - } - return NULL; - } -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index f43e275557251..1fb79dbde0cb3 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -2485,7 +2485,7 @@ static int ipv6_route_native_seq_show(struct seq_file *seq, void *v) - const struct net_device *dev; - - if (rt->nh) -- fib6_nh = nexthop_fib6_nh(rt->nh); -+ fib6_nh = nexthop_fib6_nh_bh(rt->nh); - - seq_printf(seq, "%pi6 %02x ", &rt->fib6_dst.addr, rt->fib6_dst.plen); - -diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c -index e96304d8a4a7f..06d60662717d1 100644 ---- a/net/ipv6/ip6_input.c -+++ b/net/ipv6/ip6_input.c -@@ -245,16 +245,6 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev, - if (ipv6_addr_is_multicast(&hdr->saddr)) - goto err; - -- /* While RFC4291 is not explicit about v4mapped addresses -- * in IPv6 headers, it seems clear linux dual-stack -- * model can not deal properly with these. -- * Security models could be fooled by ::ffff:127.0.0.1 for example. -- * -- * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02 -- */ -- if (ipv6_addr_v4mapped(&hdr->saddr)) -- goto err; -- - skb->transport_header = skb->network_header + sizeof(*hdr); - IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr); - -diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c -index 0d453fa9e327b..2e2119bfcf137 100644 ---- a/net/ipv6/netfilter/ip6_tables.c -+++ b/net/ipv6/netfilter/ip6_tables.c -@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb, - - local_bh_disable(); - addend = xt_write_recseq_begin(); -- private = rcu_access_pointer(table->private); -+ private = READ_ONCE(table->private); /* Address dependency. */ - cpu = smp_processor_id(); - table_base = private->entries; - jumpstack = (struct ip6t_entry **)private->jumpstack[cpu]; -@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) - { - unsigned int countersize; - struct xt_counters *counters; -- const struct xt_table_info *private = xt_table_get_private_protected(table); -+ const struct xt_table_info *private = table->private; - - /* We need atomic snapshot of counters: rest doesn't change - (other than comefrom, which userspace doesn't care -@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size, - unsigned int off, num; - const struct ip6t_entry *e; - struct xt_counters *counters; -- const struct xt_table_info *private = xt_table_get_private_protected(table); -+ const struct xt_table_info *private = table->private; - int ret = 0; - const void *loc_cpu_entry; - -@@ -980,7 +980,7 @@ static int get_info(struct net *net, void __user *user, const int *len) - t = xt_request_find_table_lock(net, AF_INET6, name); - if (!IS_ERR(t)) { - struct ip6t_getinfo info; -- const struct xt_table_info *private = xt_table_get_private_protected(t); -+ const struct xt_table_info *private = t->private; - #ifdef CONFIG_COMPAT - struct xt_table_info tmp; - -@@ -1035,7 +1035,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, - - t = xt_find_table_lock(net, AF_INET6, get.name); - if (!IS_ERR(t)) { -- struct xt_table_info *private = xt_table_get_private_protected(t); -+ struct xt_table_info *private = t->private; - if (get.size == private->size) - ret = copy_entries_to_user(private->size, - t, uptr->entrytable); -@@ -1189,7 +1189,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) - } - - local_bh_disable(); -- private = xt_table_get_private_protected(t); -+ private = t->private; - if (private->number != tmp.num_counters) { - ret = -EINVAL; - goto unlock_up_free; -@@ -1552,7 +1552,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, - void __user *userptr) - { - struct xt_counters *counters; -- const struct xt_table_info *private = xt_table_get_private_protected(table); -+ const struct xt_table_info *private = table->private; - void __user *pos; - unsigned int size; - int ret = 0; -@@ -1598,7 +1598,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr, - xt_compat_lock(AF_INET6); - t = xt_find_table_lock(net, AF_INET6, get.name); - if (!IS_ERR(t)) { -- const struct xt_table_info *private = xt_table_get_private_protected(t); -+ const struct xt_table_info *private = t->private; - struct xt_table_info info; - ret = compat_table_info(private, &info); - if (!ret && get.size == info.size) -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 188e114b29b4a..0bbfaa55e3c89 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -258,34 +258,16 @@ static struct dst_ops ip6_dst_ops_template = { - .confirm_neigh = ip6_confirm_neigh, - }; - --static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst) --{ -- unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); -- -- return mtu ? : dst->dev->mtu; --} -- --static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu, -- bool confirm_neigh) --{ --} -- --static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb) --{ --} -- - static struct dst_ops ip6_dst_blackhole_ops = { -- .family = AF_INET6, -- .destroy = ip6_dst_destroy, -- .check = ip6_dst_check, -- .mtu = ip6_blackhole_mtu, -- .default_advmss = ip6_default_advmss, -- .update_pmtu = ip6_rt_blackhole_update_pmtu, -- .redirect = ip6_rt_blackhole_redirect, -- .cow_metrics = dst_cow_metrics_generic, -- .neigh_lookup = ip6_dst_neigh_lookup, -+ .family = AF_INET6, -+ .default_advmss = ip6_default_advmss, -+ .neigh_lookup = ip6_dst_neigh_lookup, -+ .check = ip6_dst_check, -+ .destroy = ip6_dst_destroy, -+ .cow_metrics = dst_cow_metrics_generic, -+ .update_pmtu = dst_blackhole_update_pmtu, -+ .redirect = dst_blackhole_redirect, -+ .mtu = dst_blackhole_mtu, - }; - - static const u32 ip6_template_metrics[RTAX_MAX] = { -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 0e1509b02cb30..c07e5e8d557bb 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1175,6 +1175,11 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb) - if (!ipv6_unicast_destination(skb)) - goto drop; - -+ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { -+ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); -+ return 0; -+ } -+ - return tcp_conn_request(&tcp6_request_sock_ops, - &tcp_request_sock_ipv6_ops, sk, skb); - -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index c4c70e30ad7f0..68a0de02b5618 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -2950,14 +2950,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy, - continue; - - for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) { -- if (~sdata->rc_rateidx_mcs_mask[i][j]) { -+ if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) { - sdata->rc_has_mcs_mask[i] = true; - break; - } - } - - for (j = 0; j < NL80211_VHT_NSS_MAX; j++) { -- if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { -+ if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) { - sdata->rc_has_vht_mcs_mask[i] = true; - break; - } -diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c -index 1f552f374e97d..a7ac53a2f00d8 100644 ---- a/net/mac80211/ibss.c -+++ b/net/mac80211/ibss.c -@@ -1874,6 +1874,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata) - - /* remove beacon */ - kfree(sdata->u.ibss.ie); -+ sdata->u.ibss.ie = NULL; -+ sdata->u.ibss.ie_len = 0; - - /* on the next join, re-program HT parameters */ - memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa)); -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 0e4d950cf907b..9db648a91a4f6 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -5071,7 +5071,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata, - he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, - ies->data, ies->len); - if (he_oper_ie && -- he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3])) -+ he_oper_ie[1] >= ieee80211_he_oper_size(&he_oper_ie[3])) - he_oper = (void *)(he_oper_ie + 3); - else - he_oper = NULL; -diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index 8d3ae6b2f95ff..f4507a7089653 100644 ---- a/net/mac80211/util.c -+++ b/net/mac80211/util.c -@@ -968,7 +968,7 @@ static void ieee80211_parse_extension_element(u32 *crc, - break; - case WLAN_EID_EXT_HE_OPERATION: - if (len >= sizeof(*elems->he_operation) && -- len == ieee80211_he_oper_size(data) - 1) { -+ len >= ieee80211_he_oper_size(data) - 1) { - if (crc) - *crc = crc32_be(*crc, (void *)elem, - elem->datalen + 2); -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index 2e26e39169b82..37ef0bf098f6d 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -555,15 +555,15 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb, - } - - static u64 add_addr_generate_hmac(u64 key1, u64 key2, u8 addr_id, -- struct in_addr *addr) -+ struct in_addr *addr, u16 port) - { - u8 hmac[SHA256_DIGEST_SIZE]; - u8 msg[7]; - - msg[0] = addr_id; - memcpy(&msg[1], &addr->s_addr, 4); -- msg[5] = 0; -- msg[6] = 0; -+ msg[5] = port >> 8; -+ msg[6] = port & 0xFF; - - mptcp_crypto_hmac_sha(key1, key2, msg, 7, hmac); - -@@ -572,15 +572,15 @@ static u64 add_addr_generate_hmac(u64 key1, u64 key2, u8 addr_id, - - #if IS_ENABLED(CONFIG_MPTCP_IPV6) - static u64 add_addr6_generate_hmac(u64 key1, u64 key2, u8 addr_id, -- struct in6_addr *addr) -+ struct in6_addr *addr, u16 port) - { - u8 hmac[SHA256_DIGEST_SIZE]; - u8 msg[19]; - - msg[0] = addr_id; - memcpy(&msg[1], &addr->s6_addr, 16); -- msg[17] = 0; -- msg[18] = 0; -+ msg[17] = port >> 8; -+ msg[18] = port & 0xFF; - - mptcp_crypto_hmac_sha(key1, key2, msg, 19, hmac); - -@@ -634,7 +634,8 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * - opts->ahmac = add_addr_generate_hmac(msk->local_key, - msk->remote_key, - opts->addr_id, -- &opts->addr); -+ &opts->addr, -+ opts->port); - } - } - #if IS_ENABLED(CONFIG_MPTCP_IPV6) -@@ -645,7 +646,8 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * - opts->ahmac = add_addr6_generate_hmac(msk->local_key, - msk->remote_key, - opts->addr_id, -- &opts->addr6); -+ &opts->addr6, -+ opts->port); - } - } - #endif -@@ -922,12 +924,14 @@ static bool add_addr_hmac_valid(struct mptcp_sock *msk, - if (mp_opt->family == MPTCP_ADDR_IPVERSION_4) - hmac = add_addr_generate_hmac(msk->remote_key, - msk->local_key, -- mp_opt->addr_id, &mp_opt->addr); -+ mp_opt->addr_id, &mp_opt->addr, -+ mp_opt->port); - #if IS_ENABLED(CONFIG_MPTCP_IPV6) - else - hmac = add_addr6_generate_hmac(msk->remote_key, - msk->local_key, -- mp_opt->addr_id, &mp_opt->addr6); -+ mp_opt->addr_id, &mp_opt->addr6, -+ mp_opt->port); - #endif - - pr_debug("msk=%p, ahmac=%llu, mp_opt->ahmac=%llu\n", -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index c3090003a17bd..96e040951cd40 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -440,6 +440,11 @@ static int subflow_v6_conn_request(struct sock *sk, struct sk_buff *skb) - if (!ipv6_unicast_destination(skb)) - goto drop; - -+ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { -+ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); -+ return 0; -+ } -+ - return tcp_conn_request(&mptcp_subflow_request_sock_ops, - &subflow_request_sock_ipv6_ops, sk, skb); - -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index 84caf3316946d..e0c566b3df902 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -2969,6 +2969,7 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb, - memset(&m, 0xFF, sizeof(m)); - memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3)); - m.src.u.all = mask->src.u.all; -+ m.src.l3num = tuple->src.l3num; - m.dst.protonum = tuple->dst.protonum; - - nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK); -diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c -index 4a4acbba78ff7..b03feb6e1226a 100644 ---- a/net/netfilter/nf_flow_table_core.c -+++ b/net/netfilter/nf_flow_table_core.c -@@ -506,7 +506,7 @@ int nf_flow_table_init(struct nf_flowtable *flowtable) - { - int err; - -- INIT_DEFERRABLE_WORK(&flowtable->gc_work, nf_flow_offload_work_gc); -+ INIT_DELAYED_WORK(&flowtable->gc_work, nf_flow_offload_work_gc); - flow_block_init(&flowtable->flow_block); - init_rwsem(&flowtable->flow_block_lock); - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 8ee9f40cc0ea2..24a7a6b17268c 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -6808,6 +6808,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, - struct nft_hook *hook, *next; - struct nft_trans *trans; - bool unregister = false; -+ u32 flags; - int err; - - err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK], -@@ -6822,6 +6823,17 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, - } - } - -+ if (nla[NFTA_FLOWTABLE_FLAGS]) { -+ flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); -+ if (flags & ~NFT_FLOWTABLE_MASK) -+ return -EOPNOTSUPP; -+ if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^ -+ (flags & NFT_FLOWTABLE_HW_OFFLOAD)) -+ return -EOPNOTSUPP; -+ } else { -+ flags = flowtable->data.flags; -+ } -+ - err = nft_register_flowtable_net_hooks(ctx->net, ctx->table, - &flowtable_hook.list, flowtable); - if (err < 0) -@@ -6835,6 +6847,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, - goto err_flowtable_update_hook; - } - -+ nft_trans_flowtable_flags(trans) = flags; - nft_trans_flowtable(trans) = flowtable; - nft_trans_flowtable_update(trans) = true; - INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); -@@ -6929,8 +6942,10 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk, - if (nla[NFTA_FLOWTABLE_FLAGS]) { - flowtable->data.flags = - ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); -- if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) -+ if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) { -+ err = -EOPNOTSUPP; - goto err3; -+ } - } - - write_pnet(&flowtable->data.net, net); -@@ -8142,6 +8157,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) - break; - case NFT_MSG_NEWFLOWTABLE: - if (nft_trans_flowtable_update(trans)) { -+ nft_trans_flowtable(trans)->data.flags = -+ nft_trans_flowtable_flags(trans); - nf_tables_flowtable_notify(&trans->ctx, - nft_trans_flowtable(trans), - &nft_trans_flowtable_hooks(trans), -diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c -index bce6ca203d462..6bd31a7a27fc5 100644 ---- a/net/netfilter/x_tables.c -+++ b/net/netfilter/x_tables.c -@@ -1351,14 +1351,6 @@ struct xt_counters *xt_counters_alloc(unsigned int counters) - } - EXPORT_SYMBOL(xt_counters_alloc); - --struct xt_table_info --*xt_table_get_private_protected(const struct xt_table *table) --{ -- return rcu_dereference_protected(table->private, -- mutex_is_locked(&xt[table->af].mutex)); --} --EXPORT_SYMBOL(xt_table_get_private_protected); -- - struct xt_table_info * - xt_replace_table(struct xt_table *table, - unsigned int num_counters, -@@ -1366,6 +1358,7 @@ xt_replace_table(struct xt_table *table, - int *error) - { - struct xt_table_info *private; -+ unsigned int cpu; - int ret; - - ret = xt_jumpstack_alloc(newinfo); -@@ -1375,20 +1368,47 @@ xt_replace_table(struct xt_table *table, - } - - /* Do the substitution. */ -- private = xt_table_get_private_protected(table); -+ local_bh_disable(); -+ private = table->private; - - /* Check inside lock: is the old number correct? */ - if (num_counters != private->number) { - pr_debug("num_counters != table->private->number (%u/%u)\n", - num_counters, private->number); -+ local_bh_enable(); - *error = -EAGAIN; - return NULL; - } - - newinfo->initial_entries = private->initial_entries; -+ /* -+ * Ensure contents of newinfo are visible before assigning to -+ * private. -+ */ -+ smp_wmb(); -+ table->private = newinfo; -+ -+ /* make sure all cpus see new ->private value */ -+ smp_mb(); - -- rcu_assign_pointer(table->private, newinfo); -- synchronize_rcu(); -+ /* -+ * Even though table entries have now been swapped, other CPU's -+ * may still be using the old entries... -+ */ -+ local_bh_enable(); -+ -+ /* ... so wait for even xt_recseq on all cpus */ -+ for_each_possible_cpu(cpu) { -+ seqcount_t *s = &per_cpu(xt_recseq, cpu); -+ u32 seq = raw_read_seqcount(s); -+ -+ if (seq & 1) { -+ do { -+ cond_resched(); -+ cpu_relax(); -+ } while (seq == raw_read_seqcount(s)); -+ } -+ } - - audit_log_nfcfg(table->name, table->af, private->number, - !private->number ? AUDIT_XT_OP_REGISTER : -@@ -1424,12 +1444,12 @@ struct xt_table *xt_register_table(struct net *net, - } - - /* Simplifies replace_table code. */ -- rcu_assign_pointer(table->private, bootstrap); -+ table->private = bootstrap; - - if (!xt_replace_table(table, 0, newinfo, &ret)) - goto unlock; - -- private = xt_table_get_private_protected(table); -+ private = table->private; - pr_debug("table->private->number = %u\n", private->number); - - /* save number of initial entries */ -@@ -1452,8 +1472,7 @@ void *xt_unregister_table(struct xt_table *table) - struct xt_table_info *private; - - mutex_lock(&xt[table->af].mutex); -- private = xt_table_get_private_protected(table); -- RCU_INIT_POINTER(table->private, NULL); -+ private = table->private; - list_del(&table->list); - mutex_unlock(&xt[table->af].mutex); - audit_log_nfcfg(table->name, table->af, private->number, -diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c -index edb6ac17cecab..dfc820ee553a0 100644 ---- a/net/qrtr/qrtr.c -+++ b/net/qrtr/qrtr.c -@@ -1058,6 +1058,11 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg, - rc = copied; - - if (addr) { -+ /* There is an anonymous 2-byte hole after sq_family, -+ * make sure to clear it. -+ */ -+ memset(addr, 0, sizeof(*addr)); -+ - addr->sq_family = AF_QIPCRTR; - addr->sq_node = cb->src_node; - addr->sq_port = cb->src_port; -diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c -index 46c1b3e9f66a5..14316ba9b3b32 100644 ---- a/net/sched/cls_flower.c -+++ b/net/sched/cls_flower.c -@@ -1432,7 +1432,7 @@ static int fl_set_key_ct(struct nlattr **tb, - &mask->ct_state, TCA_FLOWER_KEY_CT_STATE_MASK, - sizeof(key->ct_state)); - -- err = fl_validate_ct_state(mask->ct_state, -+ err = fl_validate_ct_state(key->ct_state & mask->ct_state, - tb[TCA_FLOWER_KEY_CT_STATE_MASK], - extack); - if (err) -diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c -index 50f680f03a547..2adbd945bf15a 100644 ---- a/net/sched/sch_choke.c -+++ b/net/sched/sch_choke.c -@@ -345,6 +345,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, - struct sk_buff **old = NULL; - unsigned int mask; - u32 max_P; -+ u8 *stab; - - if (opt == NULL) - return -EINVAL; -@@ -361,8 +362,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, - max_P = tb[TCA_CHOKE_MAX_P] ? nla_get_u32(tb[TCA_CHOKE_MAX_P]) : 0; - - ctl = nla_data(tb[TCA_CHOKE_PARMS]); -- -- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) -+ stab = nla_data(tb[TCA_CHOKE_STAB]); -+ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) - return -EINVAL; - - if (ctl->limit > CHOKE_MAX_QUEUE) -@@ -412,7 +413,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, - - red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, - ctl->Plog, ctl->Scell_log, -- nla_data(tb[TCA_CHOKE_STAB]), -+ stab, - max_P); - red_set_vars(&q->vars); - -diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c -index e0bc77533acc3..f4132dc25ac05 100644 ---- a/net/sched/sch_gred.c -+++ b/net/sched/sch_gred.c -@@ -480,7 +480,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp, - struct gred_sched *table = qdisc_priv(sch); - struct gred_sched_data *q = table->tab[dp]; - -- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) { -+ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) { - NL_SET_ERR_MSG_MOD(extack, "invalid RED parameters"); - return -EINVAL; - } -diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c -index b4ae34d7aa965..40adf1f07a82d 100644 ---- a/net/sched/sch_red.c -+++ b/net/sched/sch_red.c -@@ -242,6 +242,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, - unsigned char flags; - int err; - u32 max_P; -+ u8 *stab; - - if (tb[TCA_RED_PARMS] == NULL || - tb[TCA_RED_STAB] == NULL) -@@ -250,7 +251,9 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, - max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; - - ctl = nla_data(tb[TCA_RED_PARMS]); -- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) -+ stab = nla_data(tb[TCA_RED_STAB]); -+ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, -+ ctl->Scell_log, stab)) - return -EINVAL; - - err = red_get_flags(ctl->flags, TC_RED_HISTORIC_FLAGS, -@@ -288,7 +291,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, - red_set_parms(&q->parms, - ctl->qth_min, ctl->qth_max, ctl->Wlog, - ctl->Plog, ctl->Scell_log, -- nla_data(tb[TCA_RED_STAB]), -+ stab, - max_P); - red_set_vars(&q->vars); - -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index b25e51440623b..066754a18569b 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -647,7 +647,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) - } - - if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, -- ctl_v1->Wlog, ctl_v1->Scell_log)) -+ ctl_v1->Wlog, ctl_v1->Scell_log, NULL)) - return -EINVAL; - if (ctl_v1 && ctl_v1->qth_min) { - p = kmalloc(sizeof(*p), GFP_KERNEL); -diff --git a/net/sctp/output.c b/net/sctp/output.c -index 6614c9fdc51e5..a6aa17df09efb 100644 ---- a/net/sctp/output.c -+++ b/net/sctp/output.c -@@ -584,13 +584,6 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp) - goto out; - } - -- rcu_read_lock(); -- if (__sk_dst_get(sk) != tp->dst) { -- dst_hold(tp->dst); -- sk_setup_caps(sk, tp->dst); -- } -- rcu_read_unlock(); -- - /* pack up chunks */ - pkt_count = sctp_packet_pack(packet, head, gso, gfp); - if (!pkt_count) { -diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c -index 3fd06a27105dd..5cb1aa5f067bc 100644 ---- a/net/sctp/outqueue.c -+++ b/net/sctp/outqueue.c -@@ -1135,6 +1135,7 @@ static void sctp_outq_flush_data(struct sctp_flush_ctx *ctx, - - static void sctp_outq_flush_transports(struct sctp_flush_ctx *ctx) - { -+ struct sock *sk = ctx->asoc->base.sk; - struct list_head *ltransport; - struct sctp_packet *packet; - struct sctp_transport *t; -@@ -1144,6 +1145,12 @@ static void sctp_outq_flush_transports(struct sctp_flush_ctx *ctx) - t = list_entry(ltransport, struct sctp_transport, send_ready); - packet = &t->packet; - if (!sctp_packet_empty(packet)) { -+ rcu_read_lock(); -+ if (t->dst && __sk_dst_get(sk) != t->dst) { -+ dst_hold(t->dst); -+ sk_setup_caps(sk, t->dst); -+ } -+ rcu_read_unlock(); - error = sctp_packet_transmit(packet, ctx->gfp); - if (error < 0) - ctx->q->asoc->base.sk->sk_err = -error; -diff --git a/net/tipc/node.c b/net/tipc/node.c -index 008670d1f43e1..136338b85504b 100644 ---- a/net/tipc/node.c -+++ b/net/tipc/node.c -@@ -2895,17 +2895,22 @@ int tipc_nl_node_dump_monitor_peer(struct sk_buff *skb, - - #ifdef CONFIG_TIPC_CRYPTO - static int tipc_nl_retrieve_key(struct nlattr **attrs, -- struct tipc_aead_key **key) -+ struct tipc_aead_key **pkey) - { - struct nlattr *attr = attrs[TIPC_NLA_NODE_KEY]; -+ struct tipc_aead_key *key; - - if (!attr) - return -ENODATA; - -- *key = (struct tipc_aead_key *)nla_data(attr); -- if (nla_len(attr) < tipc_aead_key_size(*key)) -+ if (nla_len(attr) < sizeof(*key)) -+ return -EINVAL; -+ key = (struct tipc_aead_key *)nla_data(attr); -+ if (key->keylen > TIPC_AEAD_KEYLEN_MAX || -+ nla_len(attr) < tipc_aead_key_size(key)) - return -EINVAL; - -+ *pkey = key; - return 0; - } - -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index 5546710d8ac1a..bc7fb9bf3351e 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -755,6 +755,7 @@ static struct sock *__vsock_create(struct net *net, - vsk->buffer_size = psk->buffer_size; - vsk->buffer_min_size = psk->buffer_min_size; - vsk->buffer_max_size = psk->buffer_max_size; -+ security_sk_clone(parent, sk); - } else { - vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN); - vsk->owner = get_current_cred(); -diff --git a/scripts/dummy-tools/gcc b/scripts/dummy-tools/gcc -index 5c113cad56017..0d0589cf8184e 100755 ---- a/scripts/dummy-tools/gcc -+++ b/scripts/dummy-tools/gcc -@@ -85,3 +85,8 @@ if arg_contain -print-file-name=plugin "$@"; then - echo $plugin_dir - exit 0 - fi -+ -+# inverted return value -+if arg_contain -D__SIZEOF_INT128__=0 "$@"; then -+ exit 1 -+fi -diff --git a/security/integrity/iint.c b/security/integrity/iint.c -index 1d20003243c3f..0ba01847e836c 100644 ---- a/security/integrity/iint.c -+++ b/security/integrity/iint.c -@@ -98,6 +98,14 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode) - struct rb_node *node, *parent = NULL; - struct integrity_iint_cache *iint, *test_iint; - -+ /* -+ * The integrity's "iint_cache" is initialized at security_init(), -+ * unless it is not included in the ordered list of LSMs enabled -+ * on the boot command line. -+ */ -+ if (!iint_cache) -+ panic("%s: lsm=integrity required.\n", __func__); -+ - iint = integrity_iint_find(inode); - if (iint) - return iint; -diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h -index 3cc8bab31ea85..63ca6e79daeb9 100644 ---- a/security/selinux/include/security.h -+++ b/security/selinux/include/security.h -@@ -219,14 +219,21 @@ static inline bool selinux_policycap_genfs_seclabel_symlinks(void) - return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS]); - } - -+struct selinux_policy_convert_data; -+ -+struct selinux_load_state { -+ struct selinux_policy *policy; -+ struct selinux_policy_convert_data *convert_data; -+}; -+ - int security_mls_enabled(struct selinux_state *state); - int security_load_policy(struct selinux_state *state, -- void *data, size_t len, -- struct selinux_policy **newpolicyp); -+ void *data, size_t len, -+ struct selinux_load_state *load_state); - void selinux_policy_commit(struct selinux_state *state, -- struct selinux_policy *newpolicy); -+ struct selinux_load_state *load_state); - void selinux_policy_cancel(struct selinux_state *state, -- struct selinux_policy *policy); -+ struct selinux_load_state *load_state); - int security_read_policy(struct selinux_state *state, - void **data, size_t *len); - -diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c -index 4bde570d56a2c..2b745ae8cb981 100644 ---- a/security/selinux/selinuxfs.c -+++ b/security/selinux/selinuxfs.c -@@ -616,7 +616,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, - - { - struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; -- struct selinux_policy *newpolicy; -+ struct selinux_load_state load_state; - ssize_t length; - void *data = NULL; - -@@ -642,23 +642,22 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, - if (copy_from_user(data, buf, count) != 0) - goto out; - -- length = security_load_policy(fsi->state, data, count, &newpolicy); -+ length = security_load_policy(fsi->state, data, count, &load_state); - if (length) { - pr_warn_ratelimited("SELinux: failed to load policy\n"); - goto out; - } - -- length = sel_make_policy_nodes(fsi, newpolicy); -+ length = sel_make_policy_nodes(fsi, load_state.policy); - if (length) { -- selinux_policy_cancel(fsi->state, newpolicy); -- goto out1; -+ selinux_policy_cancel(fsi->state, &load_state); -+ goto out; - } - -- selinux_policy_commit(fsi->state, newpolicy); -+ selinux_policy_commit(fsi->state, &load_state); - - length = count; - --out1: - audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD, - "auid=%u ses=%u lsm=selinux res=1", - from_kuid(&init_user_ns, audit_get_loginuid(current)), -diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c -index 597b79703584e..8d9bbd39ab9a8 100644 ---- a/security/selinux/ss/services.c -+++ b/security/selinux/ss/services.c -@@ -66,6 +66,17 @@ - #include "audit.h" - #include "policycap_names.h" - -+struct convert_context_args { -+ struct selinux_state *state; -+ struct policydb *oldp; -+ struct policydb *newp; -+}; -+ -+struct selinux_policy_convert_data { -+ struct convert_context_args args; -+ struct sidtab_convert_params sidtab_params; -+}; -+ - /* Forward declaration. */ - static int context_struct_to_string(struct policydb *policydb, - struct context *context, -@@ -1973,12 +1984,6 @@ static inline int convert_context_handle_invalid_context( - return 0; - } - --struct convert_context_args { -- struct selinux_state *state; -- struct policydb *oldp; -- struct policydb *newp; --}; -- - /* - * Convert the values in the security context - * structure `oldc' from the values specified -@@ -2158,7 +2163,7 @@ static void selinux_policy_cond_free(struct selinux_policy *policy) - } - - void selinux_policy_cancel(struct selinux_state *state, -- struct selinux_policy *policy) -+ struct selinux_load_state *load_state) - { - struct selinux_policy *oldpolicy; - -@@ -2166,7 +2171,8 @@ void selinux_policy_cancel(struct selinux_state *state, - lockdep_is_held(&state->policy_mutex)); - - sidtab_cancel_convert(oldpolicy->sidtab); -- selinux_policy_free(policy); -+ selinux_policy_free(load_state->policy); -+ kfree(load_state->convert_data); - } - - static void selinux_notify_policy_change(struct selinux_state *state, -@@ -2181,9 +2187,9 @@ static void selinux_notify_policy_change(struct selinux_state *state, - } - - void selinux_policy_commit(struct selinux_state *state, -- struct selinux_policy *newpolicy) -+ struct selinux_load_state *load_state) - { -- struct selinux_policy *oldpolicy; -+ struct selinux_policy *oldpolicy, *newpolicy = load_state->policy; - u32 seqno; - - oldpolicy = rcu_dereference_protected(state->policy, -@@ -2223,6 +2229,7 @@ void selinux_policy_commit(struct selinux_state *state, - /* Free the old policy */ - synchronize_rcu(); - selinux_policy_free(oldpolicy); -+ kfree(load_state->convert_data); - - /* Notify others of the policy change */ - selinux_notify_policy_change(state, seqno); -@@ -2239,11 +2246,10 @@ void selinux_policy_commit(struct selinux_state *state, - * loading the new policy. - */ - int security_load_policy(struct selinux_state *state, void *data, size_t len, -- struct selinux_policy **newpolicyp) -+ struct selinux_load_state *load_state) - { - struct selinux_policy *newpolicy, *oldpolicy; -- struct sidtab_convert_params convert_params; -- struct convert_context_args args; -+ struct selinux_policy_convert_data *convert_data; - int rc = 0; - struct policy_file file = { data, len }, *fp = &file; - -@@ -2273,10 +2279,10 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len, - goto err_mapping; - } - -- - if (!selinux_initialized(state)) { - /* First policy load, so no need to preserve state from old policy */ -- *newpolicyp = newpolicy; -+ load_state->policy = newpolicy; -+ load_state->convert_data = NULL; - return 0; - } - -@@ -2290,29 +2296,38 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len, - goto err_free_isids; - } - -+ convert_data = kmalloc(sizeof(*convert_data), GFP_KERNEL); -+ if (!convert_data) { -+ rc = -ENOMEM; -+ goto err_free_isids; -+ } -+ - /* - * Convert the internal representations of contexts - * in the new SID table. - */ -- args.state = state; -- args.oldp = &oldpolicy->policydb; -- args.newp = &newpolicy->policydb; -+ convert_data->args.state = state; -+ convert_data->args.oldp = &oldpolicy->policydb; -+ convert_data->args.newp = &newpolicy->policydb; - -- convert_params.func = convert_context; -- convert_params.args = &args; -- convert_params.target = newpolicy->sidtab; -+ convert_data->sidtab_params.func = convert_context; -+ convert_data->sidtab_params.args = &convert_data->args; -+ convert_data->sidtab_params.target = newpolicy->sidtab; - -- rc = sidtab_convert(oldpolicy->sidtab, &convert_params); -+ rc = sidtab_convert(oldpolicy->sidtab, &convert_data->sidtab_params); - if (rc) { - pr_err("SELinux: unable to convert the internal" - " representation of contexts in the new SID" - " table\n"); -- goto err_free_isids; -+ goto err_free_convert_data; - } - -- *newpolicyp = newpolicy; -+ load_state->policy = newpolicy; -+ load_state->convert_data = convert_data; - return 0; - -+err_free_convert_data: -+ kfree(convert_data); - err_free_isids: - sidtab_destroy(newpolicy->sidtab); - err_mapping: -diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c -index d053beccfaec3..e2237239d922a 100644 ---- a/sound/hda/intel-nhlt.c -+++ b/sound/hda/intel-nhlt.c -@@ -39,6 +39,11 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) - if (!nhlt) - return 0; - -+ if (nhlt->header.length <= sizeof(struct acpi_table_header)) { -+ dev_warn(dev, "Invalid DMIC description table\n"); -+ return 0; -+ } -+ - for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++, - epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) { - -diff --git a/tools/include/linux/static_call_types.h b/tools/include/linux/static_call_types.h -index 89135bb35bf76..ae5662d368b98 100644 ---- a/tools/include/linux/static_call_types.h -+++ b/tools/include/linux/static_call_types.h -@@ -4,11 +4,13 @@ - - #include - #include -+#include - - #define STATIC_CALL_KEY_PREFIX __SCK__ - #define STATIC_CALL_KEY_PREFIX_STR __stringify(STATIC_CALL_KEY_PREFIX) - #define STATIC_CALL_KEY_PREFIX_LEN (sizeof(STATIC_CALL_KEY_PREFIX_STR) - 1) - #define STATIC_CALL_KEY(name) __PASTE(STATIC_CALL_KEY_PREFIX, name) -+#define STATIC_CALL_KEY_STR(name) __stringify(STATIC_CALL_KEY(name)) - - #define STATIC_CALL_TRAMP_PREFIX __SCT__ - #define STATIC_CALL_TRAMP_PREFIX_STR __stringify(STATIC_CALL_TRAMP_PREFIX) -@@ -32,4 +34,52 @@ struct static_call_site { - s32 key; - }; - -+#define DECLARE_STATIC_CALL(name, func) \ -+ extern struct static_call_key STATIC_CALL_KEY(name); \ -+ extern typeof(func) STATIC_CALL_TRAMP(name); -+ -+#ifdef CONFIG_HAVE_STATIC_CALL -+ -+#define __raw_static_call(name) (&STATIC_CALL_TRAMP(name)) -+ -+#ifdef CONFIG_HAVE_STATIC_CALL_INLINE -+ -+/* -+ * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from -+ * the symbol table so that objtool can reference it when it generates the -+ * .static_call_sites section. -+ */ -+#define __STATIC_CALL_ADDRESSABLE(name) \ -+ __ADDRESSABLE(STATIC_CALL_KEY(name)) -+ -+#define __static_call(name) \ -+({ \ -+ __STATIC_CALL_ADDRESSABLE(name); \ -+ __raw_static_call(name); \ -+}) -+ -+#else /* !CONFIG_HAVE_STATIC_CALL_INLINE */ -+ -+#define __STATIC_CALL_ADDRESSABLE(name) -+#define __static_call(name) __raw_static_call(name) -+ -+#endif /* CONFIG_HAVE_STATIC_CALL_INLINE */ -+ -+#ifdef MODULE -+#define __STATIC_CALL_MOD_ADDRESSABLE(name) -+#define static_call_mod(name) __raw_static_call(name) -+#else -+#define __STATIC_CALL_MOD_ADDRESSABLE(name) __STATIC_CALL_ADDRESSABLE(name) -+#define static_call_mod(name) __static_call(name) -+#endif -+ -+#define static_call(name) __static_call(name) -+ -+#else -+ -+#define static_call(name) \ -+ ((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func)) -+ -+#endif /* CONFIG_HAVE_STATIC_CALL */ -+ - #endif /* _STATIC_CALL_TYPES_H */ -diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile -index 55bd78b3496fb..310f647c2d5b6 100644 ---- a/tools/lib/bpf/Makefile -+++ b/tools/lib/bpf/Makefile -@@ -236,7 +236,7 @@ define do_install - if [ ! -d '$(DESTDIR_SQ)$2' ]; then \ - $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \ - fi; \ -- $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2' -+ $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2' - endef - - install_lib: all_cmd -diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c -index 2f9d685bd522c..0911aea4cdbe5 100644 ---- a/tools/lib/bpf/btf_dump.c -+++ b/tools/lib/bpf/btf_dump.c -@@ -462,7 +462,7 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr) - return err; - - case BTF_KIND_ARRAY: -- return btf_dump_order_type(d, btf_array(t)->type, through_ptr); -+ return btf_dump_order_type(d, btf_array(t)->type, false); - - case BTF_KIND_STRUCT: - case BTF_KIND_UNION: { -diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c -index a0d4fc4de4027..8913e5e7bedb0 100644 ---- a/tools/lib/bpf/libbpf.c -+++ b/tools/lib/bpf/libbpf.c -@@ -1180,7 +1180,8 @@ static int bpf_object__elf_init(struct bpf_object *obj) - if (!elf_rawdata(elf_getscn(obj->efile.elf, obj->efile.shstrndx), NULL)) { - pr_warn("elf: failed to get section names strings from %s: %s\n", - obj->path, elf_errmsg(-1)); -- return -LIBBPF_ERRNO__FORMAT; -+ err = -LIBBPF_ERRNO__FORMAT; -+ goto errout; - } - - /* Old LLVM set e_machine to EM_NONE */ -diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c -index 4dd73de00b6f1..d2cb28e9ef52e 100644 ---- a/tools/lib/bpf/netlink.c -+++ b/tools/lib/bpf/netlink.c -@@ -40,7 +40,7 @@ static int libbpf_netlink_open(__u32 *nl_pid) - memset(&sa, 0, sizeof(sa)); - sa.nl_family = AF_NETLINK; - -- sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); -+ sock = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE); - if (sock < 0) - return -errno; - -diff --git a/tools/objtool/check.c b/tools/objtool/check.c -index dc24aac08edd6..5c83f73ad6687 100644 ---- a/tools/objtool/check.c -+++ b/tools/objtool/check.c -@@ -502,8 +502,21 @@ static int create_static_call_sections(struct objtool_file *file) - - key_sym = find_symbol_by_name(file->elf, tmp); - if (!key_sym) { -- WARN("static_call: can't find static_call_key symbol: %s", tmp); -- return -1; -+ if (!module) { -+ WARN("static_call: can't find static_call_key symbol: %s", tmp); -+ return -1; -+ } -+ -+ /* -+ * For modules(), the key might not be exported, which -+ * means the module can make static calls but isn't -+ * allowed to change them. -+ * -+ * In that case we temporarily set the key to be the -+ * trampoline address. This is fixed up in -+ * static_call_add_module(). -+ */ -+ key_sym = insn->call_dest; - } - free(key_name); - -diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c -index a608784981399..2723082f38170 100644 ---- a/tools/perf/util/auxtrace.c -+++ b/tools/perf/util/auxtrace.c -@@ -298,10 +298,6 @@ static int auxtrace_queues__queue_buffer(struct auxtrace_queues *queues, - queue->set = true; - queue->tid = buffer->tid; - queue->cpu = buffer->cpu; -- } else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) { -- pr_err("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n", -- queue->cpu, queue->tid, buffer->cpu, buffer->tid); -- return -EINVAL; - } - - buffer->buffer_nr = queues->next_buffer_nr++; -diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c -index 2947e3f3c6d9d..dda0a6a3173d3 100644 ---- a/tools/perf/util/synthetic-events.c -+++ b/tools/perf/util/synthetic-events.c -@@ -384,7 +384,7 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool, - - while (!io.eof) { - static const char anonstr[] = "//anon"; -- size_t size; -+ size_t size, aligned_size; - - /* ensure null termination since stack will be reused. */ - event->mmap2.filename[0] = '\0'; -@@ -444,11 +444,12 @@ out: - } - - size = strlen(event->mmap2.filename) + 1; -- size = PERF_ALIGN(size, sizeof(u64)); -+ aligned_size = PERF_ALIGN(size, sizeof(u64)); - event->mmap2.len -= event->mmap.start; - event->mmap2.header.size = (sizeof(event->mmap2) - -- (sizeof(event->mmap2.filename) - size)); -- memset(event->mmap2.filename + size, 0, machine->id_hdr_size); -+ (sizeof(event->mmap2.filename) - aligned_size)); -+ memset(event->mmap2.filename + size, 0, machine->id_hdr_size + -+ (aligned_size - size)); - event->mmap2.header.size += machine->id_hdr_size; - event->mmap2.pid = tgid; - event->mmap2.tid = pid; -diff --git a/tools/testing/kunit/configs/broken_on_uml.config b/tools/testing/kunit/configs/broken_on_uml.config -index a7f0603d33f62..690870043ac0e 100644 ---- a/tools/testing/kunit/configs/broken_on_uml.config -+++ b/tools/testing/kunit/configs/broken_on_uml.config -@@ -40,3 +40,5 @@ - # CONFIG_RESET_BRCMSTB_RESCAL is not set - # CONFIG_RESET_INTEL_GW is not set - # CONFIG_ADI_AXI_ADC is not set -+# CONFIG_DEBUG_PAGEALLOC is not set -+# CONFIG_PAGE_POISONING is not set -diff --git a/tools/testing/selftests/arm64/fp/sve-ptrace.c b/tools/testing/selftests/arm64/fp/sve-ptrace.c -index b2282be6f9384..612d3899614ac 100644 ---- a/tools/testing/selftests/arm64/fp/sve-ptrace.c -+++ b/tools/testing/selftests/arm64/fp/sve-ptrace.c -@@ -332,5 +332,5 @@ int main(void) - - ksft_print_cnts(); - -- return 0; -+ return ret; - } -diff --git a/tools/testing/selftests/bpf/prog_tests/fexit_sleep.c b/tools/testing/selftests/bpf/prog_tests/fexit_sleep.c -new file mode 100644 -index 0000000000000..6c4d42a2386f4 ---- /dev/null -+++ b/tools/testing/selftests/bpf/prog_tests/fexit_sleep.c -@@ -0,0 +1,82 @@ -+// SPDX-License-Identifier: GPL-2.0 -+/* Copyright (c) 2021 Facebook */ -+#define _GNU_SOURCE -+#include -+#include -+#include -+#include -+#include -+#include "fexit_sleep.skel.h" -+ -+static int do_sleep(void *skel) -+{ -+ struct fexit_sleep *fexit_skel = skel; -+ struct timespec ts1 = { .tv_nsec = 1 }; -+ struct timespec ts2 = { .tv_sec = 10 }; -+ -+ fexit_skel->bss->pid = getpid(); -+ (void)syscall(__NR_nanosleep, &ts1, NULL); -+ (void)syscall(__NR_nanosleep, &ts2, NULL); -+ return 0; -+} -+ -+#define STACK_SIZE (1024 * 1024) -+static char child_stack[STACK_SIZE]; -+ -+void test_fexit_sleep(void) -+{ -+ struct fexit_sleep *fexit_skel = NULL; -+ int wstatus, duration = 0; -+ pid_t cpid; -+ int err, fexit_cnt; -+ -+ fexit_skel = fexit_sleep__open_and_load(); -+ if (CHECK(!fexit_skel, "fexit_skel_load", "fexit skeleton failed\n")) -+ goto cleanup; -+ -+ err = fexit_sleep__attach(fexit_skel); -+ if (CHECK(err, "fexit_attach", "fexit attach failed: %d\n", err)) -+ goto cleanup; -+ -+ cpid = clone(do_sleep, child_stack + STACK_SIZE, CLONE_FILES | SIGCHLD, fexit_skel); -+ if (CHECK(cpid == -1, "clone", strerror(errno))) -+ goto cleanup; -+ -+ /* wait until first sys_nanosleep ends and second sys_nanosleep starts */ -+ while (READ_ONCE(fexit_skel->bss->fentry_cnt) != 2); -+ fexit_cnt = READ_ONCE(fexit_skel->bss->fexit_cnt); -+ if (CHECK(fexit_cnt != 1, "fexit_cnt", "%d", fexit_cnt)) -+ goto cleanup; -+ -+ /* close progs and detach them. That will trigger two nop5->jmp5 rewrites -+ * in the trampolines to skip nanosleep_fexit prog. -+ * The nanosleep_fentry prog will get detached first. -+ * The nanosleep_fexit prog will get detached second. -+ * Detaching will trigger freeing of both progs JITed images. -+ * There will be two dying bpf_tramp_image-s, but only the initial -+ * bpf_tramp_image (with both _fentry and _fexit progs will be stuck -+ * waiting for percpu_ref_kill to confirm). The other one -+ * will be freed quickly. -+ */ -+ close(bpf_program__fd(fexit_skel->progs.nanosleep_fentry)); -+ close(bpf_program__fd(fexit_skel->progs.nanosleep_fexit)); -+ fexit_sleep__detach(fexit_skel); -+ -+ /* kill the thread to unwind sys_nanosleep stack through the trampoline */ -+ kill(cpid, 9); -+ -+ if (CHECK(waitpid(cpid, &wstatus, 0) == -1, "waitpid", strerror(errno))) -+ goto cleanup; -+ if (CHECK(WEXITSTATUS(wstatus) != 0, "exitstatus", "failed")) -+ goto cleanup; -+ -+ /* The bypassed nanosleep_fexit prog shouldn't have executed. -+ * Unlike progs the maps were not freed and directly accessible. -+ */ -+ fexit_cnt = READ_ONCE(fexit_skel->bss->fexit_cnt); -+ if (CHECK(fexit_cnt != 1, "fexit_cnt", "%d", fexit_cnt)) -+ goto cleanup; -+ -+cleanup: -+ fexit_sleep__destroy(fexit_skel); -+} -diff --git a/tools/testing/selftests/bpf/progs/fexit_sleep.c b/tools/testing/selftests/bpf/progs/fexit_sleep.c -new file mode 100644 -index 0000000000000..03a672d76353a ---- /dev/null -+++ b/tools/testing/selftests/bpf/progs/fexit_sleep.c -@@ -0,0 +1,31 @@ -+// SPDX-License-Identifier: GPL-2.0 -+/* Copyright (c) 2021 Facebook */ -+#include "vmlinux.h" -+#include -+#include -+ -+char LICENSE[] SEC("license") = "GPL"; -+ -+int pid = 0; -+int fentry_cnt = 0; -+int fexit_cnt = 0; -+ -+SEC("fentry/__x64_sys_nanosleep") -+int BPF_PROG(nanosleep_fentry, const struct pt_regs *regs) -+{ -+ if ((int)bpf_get_current_pid_tgid() != pid) -+ return 0; -+ -+ fentry_cnt++; -+ return 0; -+} -+ -+SEC("fexit/__x64_sys_nanosleep") -+int BPF_PROG(nanosleep_fexit, const struct pt_regs *regs, int ret) -+{ -+ if ((int)bpf_get_current_pid_tgid() != pid) -+ return 0; -+ -+ fexit_cnt++; -+ return 0; -+} -diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c -index 9afe947cfae95..ba6eadfec5653 100644 ---- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c -+++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c -@@ -508,10 +508,8 @@ int _ip6geneve_get_tunnel(struct __sk_buff *skb) - } - - ret = bpf_skb_get_tunnel_opt(skb, &gopt, sizeof(gopt)); -- if (ret < 0) { -- ERROR(ret); -- return TC_ACT_SHOT; -- } -+ if (ret < 0) -+ gopt.opt_class = 0; - - bpf_trace_printk(fmt, sizeof(fmt), - key.tunnel_id, key.remote_ipv4, gopt.opt_class); -diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh -index ce6bea9675c07..0ccb1dda099ae 100755 ---- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh -+++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh -@@ -658,7 +658,7 @@ test_ecn_decap() - # In accordance with INET_ECN_decapsulate() - __test_ecn_decap 00 00 0x00 - __test_ecn_decap 01 01 0x01 -- __test_ecn_decap 02 01 0x02 -+ __test_ecn_decap 02 01 0x01 - __test_ecn_decap 01 03 0x03 - __test_ecn_decap 02 03 0x03 - test_ecn_decap_error -diff --git a/tools/testing/selftests/net/reuseaddr_ports_exhausted.c b/tools/testing/selftests/net/reuseaddr_ports_exhausted.c -index 7b01b7c2ec104..066efd30e2946 100644 ---- a/tools/testing/selftests/net/reuseaddr_ports_exhausted.c -+++ b/tools/testing/selftests/net/reuseaddr_ports_exhausted.c -@@ -30,25 +30,25 @@ struct reuse_opts { - }; - - struct reuse_opts unreusable_opts[12] = { -- {0, 0, 0, 0}, -- {0, 0, 0, 1}, -- {0, 0, 1, 0}, -- {0, 0, 1, 1}, -- {0, 1, 0, 0}, -- {0, 1, 0, 1}, -- {0, 1, 1, 0}, -- {0, 1, 1, 1}, -- {1, 0, 0, 0}, -- {1, 0, 0, 1}, -- {1, 0, 1, 0}, -- {1, 0, 1, 1}, -+ {{0, 0}, {0, 0}}, -+ {{0, 0}, {0, 1}}, -+ {{0, 0}, {1, 0}}, -+ {{0, 0}, {1, 1}}, -+ {{0, 1}, {0, 0}}, -+ {{0, 1}, {0, 1}}, -+ {{0, 1}, {1, 0}}, -+ {{0, 1}, {1, 1}}, -+ {{1, 0}, {0, 0}}, -+ {{1, 0}, {0, 1}}, -+ {{1, 0}, {1, 0}}, -+ {{1, 0}, {1, 1}}, - }; - - struct reuse_opts reusable_opts[4] = { -- {1, 1, 0, 0}, -- {1, 1, 0, 1}, -- {1, 1, 1, 0}, -- {1, 1, 1, 1}, -+ {{1, 1}, {0, 0}}, -+ {{1, 1}, {0, 1}}, -+ {{1, 1}, {1, 0}}, -+ {{1, 1}, {1, 1}}, - }; - - int bind_port(struct __test_metadata *_metadata, int reuseaddr, int reuseport)