From: "Mike Pagano" <mpagano@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/linux-patches:5.6 commit in: /
Date: Wed, 20 May 2020 11:35:45 +0000 (UTC) [thread overview]
Message-ID: <1589974524.d63cc5104b3bda1cd127301cdf13bc6d8d0c7d9e.mpagano@gentoo> (raw)
commit: d63cc5104b3bda1cd127301cdf13bc6d8d0c7d9e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 20 11:35:24 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 20 11:35:24 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d63cc510
Linux patch 5.6.14 and removal of redundant patch
Removed x86: Fix early boot crash on gcc-10
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 12 +-
1013_linux-5.6.14.patch | 7349 ++++++++++++++++++++++++++++
1700_x86-gcc-10-early-boot-crash-fix.patch | 131 -
3 files changed, 7357 insertions(+), 135 deletions(-)
diff --git a/0000_README b/0000_README
index 6a6ec25..3a37e9d 100644
--- a/0000_README
+++ b/0000_README
@@ -95,6 +95,14 @@ Patch: 1012_linux-5.6.13.patch
From: http://www.kernel.org
Desc: Linux 5.6.13
+Patch: 1013_linux-5.6.14.patch
+From: http://www.kernel.org
+Desc: Linux 5.6.14
+
+Patch: 1013_linux-5.6.14.patch
+From: http://www.kernel.org
+Desc: Linux 5.6.14
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
@@ -103,10 +111,6 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
-Patch: 1700_x86-gcc-10-early-boot-crash-fix.patch
-From: https://https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/patch/?id=f670269a42bfdd2c83a1118cc3d1b475547eac22
-Desc: x86: Fix early boot crash on gcc-10,
-
Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
diff --git a/1013_linux-5.6.14.patch b/1013_linux-5.6.14.patch
new file mode 100644
index 0000000..da7d2c2
--- /dev/null
+++ b/1013_linux-5.6.14.patch
@@ -0,0 +1,7349 @@
+diff --git a/Documentation/core-api/printk-formats.rst b/Documentation/core-api/printk-formats.rst
+index 8ebe46b1af39..5dfcc4592b23 100644
+--- a/Documentation/core-api/printk-formats.rst
++++ b/Documentation/core-api/printk-formats.rst
+@@ -112,6 +112,20 @@ used when printing stack backtraces. The specifier takes into
+ consideration the effect of compiler optimisations which may occur
+ when tail-calls are used and marked with the noreturn GCC attribute.
+
++Probed Pointers from BPF / tracing
++----------------------------------
++
++::
++
++ %pks kernel string
++ %pus user string
++
++The ``k`` and ``u`` specifiers are used for printing prior probed memory from
++either kernel memory (k) or user memory (u). The subsequent ``s`` specifier
++results in printing a string. For direct use in regular vsnprintf() the (k)
++and (u) annotation is ignored, however, when used out of BPF's bpf_trace_printk(),
++for example, it reads the memory it is pointing to without faulting.
++
+ Kernel Pointers
+ ---------------
+
+diff --git a/Documentation/devicetree/bindings/dma/fsl-edma.txt b/Documentation/devicetree/bindings/dma/fsl-edma.txt
+index e77b08ebcd06..ee1754739b4b 100644
+--- a/Documentation/devicetree/bindings/dma/fsl-edma.txt
++++ b/Documentation/devicetree/bindings/dma/fsl-edma.txt
+@@ -10,7 +10,8 @@ Required properties:
+ - compatible :
+ - "fsl,vf610-edma" for eDMA used similar to that on Vybrid vf610 SoC
+ - "fsl,imx7ulp-edma" for eDMA2 used similar to that on i.mx7ulp
+- - "fsl,fsl,ls1028a-edma" for eDMA used similar to that on Vybrid vf610 SoC
++ - "fsl,ls1028a-edma" followed by "fsl,vf610-edma" for eDMA used on the
++ LS1028A SoC.
+ - reg : Specifies base physical address(s) and size of the eDMA registers.
+ The 1st region is eDMA control register's address and size.
+ The 2nd and the 3rd regions are programmable channel multiplexing
+diff --git a/Makefile b/Makefile
+index d252219666fd..713f93cceffe 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 6
+-SUBLEVEL = 13
++SUBLEVEL = 14
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+
+@@ -708,12 +708,9 @@ else ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+ KBUILD_CFLAGS += -Os
+ endif
+
+-ifdef CONFIG_CC_DISABLE_WARN_MAYBE_UNINITIALIZED
+-KBUILD_CFLAGS += -Wno-maybe-uninitialized
+-endif
+-
+ # Tell gcc to never replace conditional load with a non-conditional one
+ KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0)
++KBUILD_CFLAGS += $(call cc-option,-fno-allow-store-data-races)
+
+ include scripts/Makefile.kcov
+ include scripts/Makefile.gcc-plugins
+@@ -861,6 +858,17 @@ KBUILD_CFLAGS += -Wno-pointer-sign
+ # disable stringop warnings in gcc 8+
+ KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
+
++# We'll want to enable this eventually, but it's not going away for 5.7 at least
++KBUILD_CFLAGS += $(call cc-disable-warning, zero-length-bounds)
++KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds)
++KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow)
++
++# Another good warning that we'll want to enable eventually
++KBUILD_CFLAGS += $(call cc-disable-warning, restrict)
++
++# Enabled with W=2, disabled by default as noisy
++KBUILD_CFLAGS += $(call cc-disable-warning, maybe-uninitialized)
++
+ # disable invalid "can't wrap" optimizations for signed / pointers
+ KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow)
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 5f5ee16f07a3..a341511f014c 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -172,6 +172,7 @@
+ #address-cells = <1>;
+ ranges = <0x51000000 0x51000000 0x3000
+ 0x0 0x20000000 0x10000000>;
++ dma-ranges;
+ /**
+ * To enable PCI endpoint mode, disable the pcie1_rc
+ * node and enable pcie1_ep mode.
+@@ -185,7 +186,6 @@
+ device_type = "pci";
+ ranges = <0x81000000 0 0 0x03000 0 0x00010000
+ 0x82000000 0 0x20013000 0x13000 0 0xffed000>;
+- dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ bus-range = <0x00 0xff>;
+ #interrupt-cells = <1>;
+ num-lanes = <1>;
+@@ -230,6 +230,7 @@
+ #address-cells = <1>;
+ ranges = <0x51800000 0x51800000 0x3000
+ 0x0 0x30000000 0x10000000>;
++ dma-ranges;
+ status = "disabled";
+ pcie2_rc: pcie@51800000 {
+ reg = <0x51800000 0x2000>, <0x51802000 0x14c>, <0x1000 0x2000>;
+@@ -240,7 +241,6 @@
+ device_type = "pci";
+ ranges = <0x81000000 0 0 0x03000 0 0x00010000
+ 0x82000000 0 0x30013000 0x13000 0 0xffed000>;
+- dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ bus-range = <0x00 0xff>;
+ #interrupt-cells = <1>;
+ num-lanes = <1>;
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts b/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
+index 0cd75dadf292..188639738dc3 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
++++ b/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
+@@ -75,8 +75,8 @@
+ imx27-phycard-s-rdk {
+ pinctrl_i2c1: i2c1grp {
+ fsl,pins = <
+- MX27_PAD_I2C2_SDA__I2C2_SDA 0x0
+- MX27_PAD_I2C2_SCL__I2C2_SCL 0x0
++ MX27_PAD_I2C_DATA__I2C_DATA 0x0
++ MX27_PAD_I2C_CLK__I2C_CLK 0x0
+ >;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts b/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts
+index 0d594e4bd559..a1173bf5bff5 100644
+--- a/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts
++++ b/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts
+@@ -38,7 +38,7 @@
+ };
+
+ &switch_ports {
+- /delete-node/ port@2;
++ /delete-node/ port@3;
+ };
+
+ &touchscreen {
+diff --git a/arch/arm/boot/dts/r8a73a4.dtsi b/arch/arm/boot/dts/r8a73a4.dtsi
+index a5cd31229fbd..a3ba722a9d7f 100644
+--- a/arch/arm/boot/dts/r8a73a4.dtsi
++++ b/arch/arm/boot/dts/r8a73a4.dtsi
+@@ -131,7 +131,14 @@
+ cmt1: timer@e6130000 {
+ compatible = "renesas,r8a73a4-cmt1", "renesas,rcar-gen2-cmt1";
+ reg = <0 0xe6130000 0 0x1004>;
+- interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&mstp3_clks R8A73A4_CLK_CMT1>;
+ clock-names = "fck";
+ power-domains = <&pd_c5>;
+diff --git a/arch/arm/boot/dts/r8a7740.dtsi b/arch/arm/boot/dts/r8a7740.dtsi
+index ebc1ff64f530..90feb2cf9960 100644
+--- a/arch/arm/boot/dts/r8a7740.dtsi
++++ b/arch/arm/boot/dts/r8a7740.dtsi
+@@ -479,7 +479,7 @@
+ cpg_clocks: cpg_clocks@e6150000 {
+ compatible = "renesas,r8a7740-cpg-clocks";
+ reg = <0xe6150000 0x10000>;
+- clocks = <&extal1_clk>, <&extalr_clk>;
++ clocks = <&extal1_clk>, <&extal2_clk>, <&extalr_clk>;
+ #clock-cells = <1>;
+ clock-output-names = "system", "pllc0", "pllc1",
+ "pllc2", "r",
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
+index abe04f4ad7d8..eeaa95baaa10 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
+@@ -2204,7 +2204,7 @@
+ reg = <0x0 0xff400000 0x0 0x40000>;
+ interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clkc CLKID_USB1_DDR_BRIDGE>;
+- clock-names = "ddr";
++ clock-names = "otg";
+ phys = <&usb2_phy1>;
+ phy-names = "usb2-phy";
+ dr_mode = "peripheral";
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi
+index 554863429aa6..e2094575f528 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi
+@@ -152,6 +152,10 @@
+ clock-latency = <50000>;
+ };
+
++&frddr_a {
++ status = "okay";
++};
++
+ &frddr_b {
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts
+index ccd0bced01e8..2e66d6418a59 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts
+@@ -545,7 +545,7 @@
+ &usb {
+ status = "okay";
+ dr_mode = "host";
+- vbus-regulator = <&usb_pwr_en>;
++ vbus-supply = <&usb_pwr_en>;
+ };
+
+ &usb2_phy0 {
+diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+index a44b5438e842..882e913436ca 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+@@ -661,7 +661,7 @@
+ reg = <0x30bd0000 0x10000>;
+ interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk IMX8MN_CLK_SDMA1_ROOT>,
+- <&clk IMX8MN_CLK_SDMA1_ROOT>;
++ <&clk IMX8MN_CLK_AHB>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+ fsl,sdma-ram-script-name = "imx/sdma/sdma-imx7d.bin";
+diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
+index fff6115f2670..a85b85d85a5f 100644
+--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
+@@ -658,8 +658,8 @@
+ s11 {
+ qcom,saw-leader;
+ regulator-always-on;
+- regulator-min-microvolt = <1230000>;
+- regulator-max-microvolt = <1230000>;
++ regulator-min-microvolt = <980000>;
++ regulator-max-microvolt = <980000>;
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77980.dtsi b/arch/arm64/boot/dts/renesas/r8a77980.dtsi
+index b340fb469999..1692bc95129e 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77980.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77980.dtsi
+@@ -1318,6 +1318,7 @@
+ ipmmu_vip0: mmu@e7b00000 {
+ compatible = "renesas,ipmmu-r8a77980";
+ reg = <0 0xe7b00000 0 0x1000>;
++ renesas,ipmmu-main = <&ipmmu_mm 4>;
+ power-domains = <&sysc R8A77980_PD_ALWAYS_ON>;
+ #iommu-cells = <1>;
+ };
+@@ -1325,6 +1326,7 @@
+ ipmmu_vip1: mmu@e7960000 {
+ compatible = "renesas,ipmmu-r8a77980";
+ reg = <0 0xe7960000 0 0x1000>;
++ renesas,ipmmu-main = <&ipmmu_mm 11>;
+ power-domains = <&sysc R8A77980_PD_ALWAYS_ON>;
+ #iommu-cells = <1>;
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
+index 49c4b96da3d4..6abc6f4a86cf 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
+@@ -92,7 +92,7 @@
+ &i2c1 {
+ status = "okay";
+
+- rk805: rk805@18 {
++ rk805: pmic@18 {
+ compatible = "rockchip,rk805";
+ reg = <0x18>;
+ interrupt-parent = <&gpio2>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+index 62936b432f9a..304fad1a0b57 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+@@ -169,7 +169,7 @@
+ &i2c1 {
+ status = "okay";
+
+- rk805: rk805@18 {
++ rk805: pmic@18 {
+ compatible = "rockchip,rk805";
+ reg = <0x18>;
+ interrupt-parent = <&gpio2>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index 33cc21fcf4c1..5c4238a80144 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -410,7 +410,7 @@
+ reset-names = "usb3-otg";
+ status = "disabled";
+
+- usbdrd_dwc3_0: dwc3 {
++ usbdrd_dwc3_0: usb@fe800000 {
+ compatible = "snps,dwc3";
+ reg = <0x0 0xfe800000 0x0 0x100000>;
+ interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -446,7 +446,7 @@
+ reset-names = "usb3-otg";
+ status = "disabled";
+
+- usbdrd_dwc3_1: dwc3 {
++ usbdrd_dwc3_1: usb@fe900000 {
+ compatible = "snps,dwc3";
+ reg = <0x0 0xfe900000 0x0 0x100000>;
+ interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH 0>;
+diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c
+index 8e9c924423b4..a0b144cfaea7 100644
+--- a/arch/arm64/kernel/machine_kexec.c
++++ b/arch/arm64/kernel/machine_kexec.c
+@@ -177,6 +177,7 @@ void machine_kexec(struct kimage *kimage)
+ * the offline CPUs. Therefore, we must use the __* variant here.
+ */
+ __flush_icache_range((uintptr_t)reboot_code_buffer,
++ (uintptr_t)reboot_code_buffer +
+ arm64_relocate_new_kernel_size);
+
+ /* Flush the kimage list and its buffers. */
+diff --git a/arch/powerpc/include/asm/book3s/32/kup.h b/arch/powerpc/include/asm/book3s/32/kup.h
+index 3c0ba22dc360..db0a1c281587 100644
+--- a/arch/powerpc/include/asm/book3s/32/kup.h
++++ b/arch/powerpc/include/asm/book3s/32/kup.h
+@@ -75,7 +75,7 @@
+
+ .macro kuap_check current, gpr
+ #ifdef CONFIG_PPC_KUAP_DEBUG
+- lwz \gpr2, KUAP(thread)
++ lwz \gpr, KUAP(thread)
+ 999: twnei \gpr, 0
+ EMIT_BUG_ENTRY 999b, __FILE__, __LINE__, (BUGFLAG_WARNING | BUGFLAG_ONCE)
+ #endif
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 2f500debae21..0969285996cb 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -166,13 +166,17 @@ do { \
+ ({ \
+ long __pu_err; \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
++ __typeof__(*(ptr)) __pu_val = (x); \
++ __typeof__(size) __pu_size = (size); \
++ \
+ if (!is_kernel_addr((unsigned long)__pu_addr)) \
+ might_fault(); \
+- __chk_user_ptr(ptr); \
++ __chk_user_ptr(__pu_addr); \
+ if (do_allow) \
+- __put_user_size((x), __pu_addr, (size), __pu_err); \
++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
+ else \
+- __put_user_size_allowed((x), __pu_addr, (size), __pu_err); \
++ __put_user_size_allowed(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ \
+ __pu_err; \
+ })
+
+@@ -180,9 +184,13 @@ do { \
+ ({ \
+ long __pu_err = -EFAULT; \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
++ __typeof__(*(ptr)) __pu_val = (x); \
++ __typeof__(size) __pu_size = (size); \
++ \
+ might_fault(); \
+- if (access_ok(__pu_addr, size)) \
+- __put_user_size((x), __pu_addr, (size), __pu_err); \
++ if (access_ok(__pu_addr, __pu_size)) \
++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ \
+ __pu_err; \
+ })
+
+@@ -190,8 +198,12 @@ do { \
+ ({ \
+ long __pu_err; \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
+- __chk_user_ptr(ptr); \
+- __put_user_size((x), __pu_addr, (size), __pu_err); \
++ __typeof__(*(ptr)) __pu_val = (x); \
++ __typeof__(size) __pu_size = (size); \
++ \
++ __chk_user_ptr(__pu_addr); \
++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ \
+ __pu_err; \
+ })
+
+@@ -283,15 +295,18 @@ do { \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+- __chk_user_ptr(ptr); \
++ __typeof__(size) __gu_size = (size); \
++ \
++ __chk_user_ptr(__gu_addr); \
+ if (!is_kernel_addr((unsigned long)__gu_addr)) \
+ might_fault(); \
+ barrier_nospec(); \
+ if (do_allow) \
+- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ else \
+- __get_user_size_allowed(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ (x) = (__typeof__(*(ptr)))__gu_val; \
++ \
+ __gu_err; \
+ })
+
+@@ -300,12 +315,15 @@ do { \
+ long __gu_err = -EFAULT; \
+ __long_type(*(ptr)) __gu_val = 0; \
+ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(size) __gu_size = (size); \
++ \
+ might_fault(); \
+- if (access_ok(__gu_addr, (size))) { \
++ if (access_ok(__gu_addr, __gu_size)) { \
+ barrier_nospec(); \
+- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ } \
+ (x) = (__force __typeof__(*(ptr)))__gu_val; \
++ \
+ __gu_err; \
+ })
+
+@@ -314,10 +332,13 @@ do { \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+- __chk_user_ptr(ptr); \
++ __typeof__(size) __gu_size = (size); \
++ \
++ __chk_user_ptr(__gu_addr); \
+ barrier_nospec(); \
+- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ (x) = (__force __typeof__(*(ptr)))__gu_val; \
++ \
+ __gu_err; \
+ })
+
+diff --git a/arch/powerpc/kernel/ima_arch.c b/arch/powerpc/kernel/ima_arch.c
+index e34116255ced..957abd592075 100644
+--- a/arch/powerpc/kernel/ima_arch.c
++++ b/arch/powerpc/kernel/ima_arch.c
+@@ -19,12 +19,12 @@ bool arch_ima_get_secureboot(void)
+ * to be stored as an xattr or as an appended signature.
+ *
+ * To avoid duplicate signature verification as much as possible, the IMA
+- * policy rule for module appraisal is added only if CONFIG_MODULE_SIG_FORCE
++ * policy rule for module appraisal is added only if CONFIG_MODULE_SIG
+ * is not enabled.
+ */
+ static const char *const secure_rules[] = {
+ "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
+-#ifndef CONFIG_MODULE_SIG_FORCE
++#ifndef CONFIG_MODULE_SIG
+ "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
+ #endif
+ NULL
+@@ -50,7 +50,7 @@ static const char *const secure_and_trusted_rules[] = {
+ "measure func=KEXEC_KERNEL_CHECK template=ima-modsig",
+ "measure func=MODULE_CHECK template=ima-modsig",
+ "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
+-#ifndef CONFIG_MODULE_SIG_FORCE
++#ifndef CONFIG_MODULE_SIG
+ "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
+ #endif
+ NULL
+diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
+index a3951567118a..e7f8f9f1b3f4 100644
+--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
+@@ -218,11 +218,11 @@ V_FUNCTION_BEGIN(__kernel_clock_getres)
+ blr
+
+ /*
+- * invalid clock
++ * syscall fallback
+ */
+ 99:
+- li r3, EINVAL
+- crset so
++ li r0,__NR_clock_getres
++ sc
+ blr
+ .cfi_endproc
+ V_FUNCTION_END(__kernel_clock_getres)
+diff --git a/arch/riscv/include/asm/perf_event.h b/arch/riscv/include/asm/perf_event.h
+index 0234048b12bc..062efd3a1d5d 100644
+--- a/arch/riscv/include/asm/perf_event.h
++++ b/arch/riscv/include/asm/perf_event.h
+@@ -12,19 +12,14 @@
+ #include <linux/ptrace.h>
+ #include <linux/interrupt.h>
+
++#ifdef CONFIG_RISCV_BASE_PMU
+ #define RISCV_BASE_COUNTERS 2
+
+ /*
+ * The RISCV_MAX_COUNTERS parameter should be specified.
+ */
+
+-#ifdef CONFIG_RISCV_BASE_PMU
+ #define RISCV_MAX_COUNTERS 2
+-#endif
+-
+-#ifndef RISCV_MAX_COUNTERS
+-#error "Please provide a valid RISCV_MAX_COUNTERS for the PMU."
+-#endif
+
+ /*
+ * These are the indexes of bits in counteren register *minus* 1,
+@@ -82,6 +77,7 @@ struct riscv_pmu {
+ int irq;
+ };
+
++#endif
+ #ifdef CONFIG_PERF_EVENTS
+ #define perf_arch_bpf_user_pt_regs(regs) (struct user_regs_struct *)regs
+ #endif
+diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile
+index f40205cb9a22..1dcc095dc23c 100644
+--- a/arch/riscv/kernel/Makefile
++++ b/arch/riscv/kernel/Makefile
+@@ -38,7 +38,7 @@ obj-$(CONFIG_MODULE_SECTIONS) += module-sections.o
+ obj-$(CONFIG_FUNCTION_TRACER) += mcount.o ftrace.o
+ obj-$(CONFIG_DYNAMIC_FTRACE) += mcount-dyn.o
+
+-obj-$(CONFIG_PERF_EVENTS) += perf_event.o
++obj-$(CONFIG_RISCV_BASE_PMU) += perf_event.o
+ obj-$(CONFIG_PERF_EVENTS) += perf_callchain.o
+ obj-$(CONFIG_HAVE_PERF_REGS) += perf_regs.o
+ obj-$(CONFIG_RISCV_SBI) += sbi.o
+diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
+index 33b16f4212f7..a4ee3a0e7d20 100644
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -33,15 +33,15 @@ $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE
+ $(call if_changed,vdsold)
+
+ # We also create a special relocatable object that should mirror the symbol
+-# table and layout of the linked DSO. With ld -R we can then refer to
+-# these symbols in the kernel code rather than hand-coded addresses.
++# table and layout of the linked DSO. With ld --just-symbols we can then
++# refer to these symbols in the kernel code rather than hand-coded addresses.
+
+ SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \
+ -Wl,--build-id -Wl,--hash-style=both
+ $(obj)/vdso-dummy.o: $(src)/vdso.lds $(obj)/rt_sigreturn.o FORCE
+ $(call if_changed,vdsold)
+
+-LDFLAGS_vdso-syms.o := -r -R
++LDFLAGS_vdso-syms.o := -r --just-symbols
+ $(obj)/vdso-syms.o: $(obj)/vdso-dummy.o FORCE
+ $(call if_changed,ld)
+
+diff --git a/arch/x86/include/asm/ftrace.h b/arch/x86/include/asm/ftrace.h
+index 85be2f506272..89af0d2c62aa 100644
+--- a/arch/x86/include/asm/ftrace.h
++++ b/arch/x86/include/asm/ftrace.h
+@@ -56,6 +56,12 @@ struct dyn_arch_ftrace {
+
+ #ifndef __ASSEMBLY__
+
++#if defined(CONFIG_FUNCTION_TRACER) && defined(CONFIG_DYNAMIC_FTRACE)
++extern void set_ftrace_ops_ro(void);
++#else
++static inline void set_ftrace_ops_ro(void) { }
++#endif
++
+ #define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+ static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
+ {
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 7ba99c0759cf..c121b8f24597 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -574,6 +574,7 @@ struct kvm_vcpu_arch {
+ unsigned long cr4;
+ unsigned long cr4_guest_owned_bits;
+ unsigned long cr8;
++ u32 host_pkru;
+ u32 pkru;
+ u32 hflags;
+ u64 efer;
+diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
+index 91e29b6a86a5..9804a7957f4e 100644
+--- a/arch/x86/include/asm/stackprotector.h
++++ b/arch/x86/include/asm/stackprotector.h
+@@ -55,8 +55,13 @@
+ /*
+ * Initialize the stackprotector canary value.
+ *
+- * NOTE: this must only be called from functions that never return,
++ * NOTE: this must only be called from functions that never return
+ * and it must always be inlined.
++ *
++ * In addition, it should be called from a compilation unit for which
++ * stack protector is disabled. Alternatively, the caller should not end
++ * with a function call which gets tail-call optimized as that would
++ * lead to checking a modified canary value.
+ */
+ static __always_inline void boot_init_stack_canary(void)
+ {
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 37a0aeaf89e7..b0e641793be4 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -407,7 +407,8 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
+
+ set_vm_flush_reset_perms(trampoline);
+
+- set_memory_ro((unsigned long)trampoline, npages);
++ if (likely(system_state != SYSTEM_BOOTING))
++ set_memory_ro((unsigned long)trampoline, npages);
+ set_memory_x((unsigned long)trampoline, npages);
+ return (unsigned long)trampoline;
+ fail:
+@@ -415,6 +416,32 @@ fail:
+ return 0;
+ }
+
++void set_ftrace_ops_ro(void)
++{
++ struct ftrace_ops *ops;
++ unsigned long start_offset;
++ unsigned long end_offset;
++ unsigned long npages;
++ unsigned long size;
++
++ do_for_each_ftrace_op(ops, ftrace_ops_list) {
++ if (!(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP))
++ continue;
++
++ if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) {
++ start_offset = (unsigned long)ftrace_regs_caller;
++ end_offset = (unsigned long)ftrace_regs_caller_end;
++ } else {
++ start_offset = (unsigned long)ftrace_caller;
++ end_offset = (unsigned long)ftrace_epilogue;
++ }
++ size = end_offset - start_offset;
++ size = size + RET_SIZE + sizeof(void *);
++ npages = DIV_ROUND_UP(size, PAGE_SIZE);
++ set_memory_ro((unsigned long)ops->trampoline, npages);
++ } while_for_each_ftrace_op(ops);
++}
++
+ static unsigned long calc_trampoline_call_offset(bool save_regs)
+ {
+ unsigned long start_offset;
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 69881b2d446c..9674321ce3a3 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -262,6 +262,14 @@ static void notrace start_secondary(void *unused)
+
+ wmb();
+ cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
++
++ /*
++ * Prevent tail call to cpu_startup_entry() because the stack protector
++ * guard has been changed a couple of function calls up, in
++ * boot_init_stack_canary() and must not be checked before tail calling
++ * another function.
++ */
++ prevent_tail_call_optimization();
+ }
+
+ /**
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 80537dcbddef..9414f02a55ea 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -611,23 +611,23 @@ EXPORT_SYMBOL_GPL(unwind_next_frame);
+ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ struct pt_regs *regs, unsigned long *first_frame)
+ {
+- if (!orc_init)
+- goto done;
+-
+ memset(state, 0, sizeof(*state));
+ state->task = task;
+
++ if (!orc_init)
++ goto err;
++
+ /*
+ * Refuse to unwind the stack of a task while it's executing on another
+ * CPU. This check is racy, but that's ok: the unwinder has other
+ * checks to prevent it from going off the rails.
+ */
+ if (task_on_another_cpu(task))
+- goto done;
++ goto err;
+
+ if (regs) {
+ if (user_mode(regs))
+- goto done;
++ goto the_end;
+
+ state->ip = regs->ip;
+ state->sp = regs->sp;
+@@ -660,6 +660,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ * generate some kind of backtrace if this happens.
+ */
+ void *next_page = (void *)PAGE_ALIGN((unsigned long)state->sp);
++ state->error = true;
+ if (get_stack_info(next_page, state->task, &state->stack_info,
+ &state->stack_mask))
+ return;
+@@ -685,8 +686,9 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+
+ return;
+
+-done:
++err:
++ state->error = true;
++the_end:
+ state->stack_info.type = STACK_TYPE_UNKNOWN;
+- return;
+ }
+ EXPORT_SYMBOL_GPL(__unwind_start);
+diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
+index eec7b2d93104..3a2f05ef51fa 100644
+--- a/arch/x86/kvm/vmx/nested.c
++++ b/arch/x86/kvm/vmx/nested.c
+@@ -5504,6 +5504,23 @@ static bool nested_vmx_exit_handled_vmcs_access(struct kvm_vcpu *vcpu,
+ return 1 & (b >> (field & 7));
+ }
+
++static bool nested_vmx_exit_handled_mtf(struct vmcs12 *vmcs12)
++{
++ u32 entry_intr_info = vmcs12->vm_entry_intr_info_field;
++
++ if (nested_cpu_has_mtf(vmcs12))
++ return true;
++
++ /*
++ * An MTF VM-exit may be injected into the guest by setting the
++ * interruption-type to 7 (other event) and the vector field to 0. Such
++ * is the case regardless of the 'monitor trap flag' VM-execution
++ * control.
++ */
++ return entry_intr_info == (INTR_INFO_VALID_MASK
++ | INTR_TYPE_OTHER_EVENT);
++}
++
+ /*
+ * Return 1 if we should exit from L2 to L1 to handle an exit, or 0 if we
+ * should handle it ourselves in L0 (and then continue L2). Only call this
+@@ -5618,7 +5635,7 @@ bool nested_vmx_exit_reflected(struct kvm_vcpu *vcpu, u32 exit_reason)
+ case EXIT_REASON_MWAIT_INSTRUCTION:
+ return nested_cpu_has(vmcs12, CPU_BASED_MWAIT_EXITING);
+ case EXIT_REASON_MONITOR_TRAP_FLAG:
+- return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_TRAP_FLAG);
++ return nested_vmx_exit_handled_mtf(vmcs12);
+ case EXIT_REASON_MONITOR_INSTRUCTION:
+ return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_EXITING);
+ case EXIT_REASON_PAUSE_INSTRUCTION:
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index c1ffe7d24f83..a83c94a971ee 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -1380,7 +1380,6 @@ void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+
+ vmx_vcpu_pi_load(vcpu, cpu);
+
+- vmx->host_pkru = read_pkru();
+ vmx->host_debugctlmsr = get_debugctlmsr();
+ }
+
+@@ -6538,11 +6537,6 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
+
+ kvm_load_guest_xsave_state(vcpu);
+
+- if (static_cpu_has(X86_FEATURE_PKU) &&
+- kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+- vcpu->arch.pkru != vmx->host_pkru)
+- __write_pkru(vcpu->arch.pkru);
+-
+ pt_guest_enter(vmx);
+
+ atomic_switch_perf_msrs(vmx);
+@@ -6631,18 +6625,6 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
+
+ pt_guest_exit(vmx);
+
+- /*
+- * eager fpu is enabled if PKEY is supported and CR4 is switched
+- * back on host, so it is safe to read guest PKRU from current
+- * XSAVE.
+- */
+- if (static_cpu_has(X86_FEATURE_PKU) &&
+- kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) {
+- vcpu->arch.pkru = rdpkru();
+- if (vcpu->arch.pkru != vmx->host_pkru)
+- __write_pkru(vmx->host_pkru);
+- }
+-
+ kvm_load_host_xsave_state(vcpu);
+
+ vmx->nested.nested_run_pending = 0;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 17650bda4331..7f3371a39ed0 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -809,11 +809,25 @@ void kvm_load_guest_xsave_state(struct kvm_vcpu *vcpu)
+ vcpu->arch.ia32_xss != host_xss)
+ wrmsrl(MSR_IA32_XSS, vcpu->arch.ia32_xss);
+ }
++
++ if (static_cpu_has(X86_FEATURE_PKU) &&
++ (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) ||
++ (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU)) &&
++ vcpu->arch.pkru != vcpu->arch.host_pkru)
++ __write_pkru(vcpu->arch.pkru);
+ }
+ EXPORT_SYMBOL_GPL(kvm_load_guest_xsave_state);
+
+ void kvm_load_host_xsave_state(struct kvm_vcpu *vcpu)
+ {
++ if (static_cpu_has(X86_FEATURE_PKU) &&
++ (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) ||
++ (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU))) {
++ vcpu->arch.pkru = rdpkru();
++ if (vcpu->arch.pkru != vcpu->arch.host_pkru)
++ __write_pkru(vcpu->arch.host_pkru);
++ }
++
+ if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE)) {
+
+ if (vcpu->arch.xcr0 != host_xcr0)
+@@ -3529,6 +3543,9 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+
+ kvm_x86_ops->vcpu_load(vcpu, cpu);
+
++ /* Save host pkru register if supported */
++ vcpu->arch.host_pkru = read_pkru();
++
+ /* Apply any externally detected TSC adjustments (due to suspend) */
+ if (unlikely(vcpu->arch.tsc_offset_adjustment)) {
+ adjust_tsc_offset_host(vcpu, vcpu->arch.tsc_offset_adjustment);
+@@ -3722,7 +3739,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu,
+ unsigned bank_num = mcg_cap & 0xff, bank;
+
+ r = -EINVAL;
+- if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS)
++ if (!bank_num || bank_num > KVM_MAX_MCE_BANKS)
+ goto out;
+ if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000))
+ goto out;
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index abbdecb75fad..023e1ec5e153 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -54,6 +54,7 @@
+ #include <asm/init.h>
+ #include <asm/uv/uv.h>
+ #include <asm/setup.h>
++#include <asm/ftrace.h>
+
+ #include "mm_internal.h"
+
+@@ -1288,6 +1289,8 @@ void mark_rodata_ro(void)
+ all_end = roundup((unsigned long)_brk_end, PMD_SIZE);
+ set_memory_nx(text_end, (all_end - text_end) >> PAGE_SHIFT);
+
++ set_ftrace_ops_ro();
++
+ #ifdef CONFIG_CPA_DEBUG
+ printk(KERN_INFO "Testing CPA: undo %lx-%lx\n", start, end);
+ set_memory_rw(start, (end-start) >> PAGE_SHIFT);
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index 802ee5bba66c..0cebe5db691d 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -92,6 +92,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void)
+ cpu_bringup();
+ boot_init_stack_canary();
+ cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
++ prevent_tail_call_optimization();
+ }
+
+ void xen_smp_intr_free_pv(unsigned int cpu)
+diff --git a/crypto/lrw.c b/crypto/lrw.c
+index 63c485c0d8a6..9b20fc4b2efb 100644
+--- a/crypto/lrw.c
++++ b/crypto/lrw.c
+@@ -287,7 +287,7 @@ static void exit_tfm(struct crypto_skcipher *tfm)
+ crypto_free_skcipher(ctx->child);
+ }
+
+-static void free(struct skcipher_instance *inst)
++static void free_inst(struct skcipher_instance *inst)
+ {
+ crypto_drop_skcipher(skcipher_instance_ctx(inst));
+ kfree(inst);
+@@ -400,7 +400,7 @@ static int create(struct crypto_template *tmpl, struct rtattr **tb)
+ inst->alg.encrypt = encrypt;
+ inst->alg.decrypt = decrypt;
+
+- inst->free = free;
++ inst->free = free_inst;
+
+ err = skcipher_register_instance(tmpl, inst);
+ if (err)
+diff --git a/crypto/xts.c b/crypto/xts.c
+index 29efa15f1495..983dae2bb2db 100644
+--- a/crypto/xts.c
++++ b/crypto/xts.c
+@@ -322,7 +322,7 @@ static void exit_tfm(struct crypto_skcipher *tfm)
+ crypto_free_cipher(ctx->tweak);
+ }
+
+-static void free(struct skcipher_instance *inst)
++static void free_inst(struct skcipher_instance *inst)
+ {
+ crypto_drop_skcipher(skcipher_instance_ctx(inst));
+ kfree(inst);
+@@ -434,7 +434,7 @@ static int create(struct crypto_template *tmpl, struct rtattr **tb)
+ inst->alg.encrypt = encrypt;
+ inst->alg.decrypt = decrypt;
+
+- inst->free = free;
++ inst->free = free_inst;
+
+ err = skcipher_register_instance(tmpl, inst);
+ if (err)
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 35dd2f1fb0e6..03b3067811c9 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -2042,23 +2042,31 @@ void acpi_ec_set_gpe_wake_mask(u8 action)
+ acpi_set_gpe_wake_mask(NULL, first_ec->gpe, action);
+ }
+
+-bool acpi_ec_other_gpes_active(void)
+-{
+- return acpi_any_gpe_status_set(first_ec ? first_ec->gpe : U32_MAX);
+-}
+-
+ bool acpi_ec_dispatch_gpe(void)
+ {
+ u32 ret;
+
+ if (!first_ec)
++ return acpi_any_gpe_status_set(U32_MAX);
++
++ /*
++ * Report wakeup if the status bit is set for any enabled GPE other
++ * than the EC one.
++ */
++ if (acpi_any_gpe_status_set(first_ec->gpe))
++ return true;
++
++ if (ec_no_wakeup)
+ return false;
+
++ /*
++ * Dispatch the EC GPE in-band, but do not report wakeup in any case
++ * to allow the caller to process events properly after that.
++ */
+ ret = acpi_dispatch_gpe(NULL, first_ec->gpe);
+- if (ret == ACPI_INTERRUPT_HANDLED) {
++ if (ret == ACPI_INTERRUPT_HANDLED)
+ pm_pr_dbg("EC GPE dispatched\n");
+- return true;
+- }
++
+ return false;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index d44c591c4ee4..3616daec650b 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -202,7 +202,6 @@ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit);
+
+ #ifdef CONFIG_PM_SLEEP
+ void acpi_ec_flush_work(void);
+-bool acpi_ec_other_gpes_active(void);
+ bool acpi_ec_dispatch_gpe(void);
+ #endif
+
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 4edc8a3ce40f..3850704570c0 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -1013,20 +1013,10 @@ static bool acpi_s2idle_wake(void)
+ if (acpi_check_wakeup_handlers())
+ return true;
+
+- /*
+- * If the status bit is set for any enabled GPE other than the
+- * EC one, the wakeup is regarded as a genuine one.
+- */
+- if (acpi_ec_other_gpes_active())
++ /* Check non-EC GPE wakeups and dispatch the EC GPE. */
++ if (acpi_ec_dispatch_gpe())
+ return true;
+
+- /*
+- * If the EC GPE status bit has not been set, the wakeup is
+- * regarded as a spurious one.
+- */
+- if (!acpi_ec_dispatch_gpe())
+- return false;
+-
+ /*
+ * Cancel the wakeup and process all pending events in case
+ * there are any wakeup ones in there.
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 0736248999b0..d52f33881ab6 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -32,6 +32,15 @@ struct virtio_blk_vq {
+ } ____cacheline_aligned_in_smp;
+
+ struct virtio_blk {
++ /*
++ * This mutex must be held by anything that may run after
++ * virtblk_remove() sets vblk->vdev to NULL.
++ *
++ * blk-mq, virtqueue processing, and sysfs attribute code paths are
++ * shut down before vblk->vdev is set to NULL and therefore do not need
++ * to hold this mutex.
++ */
++ struct mutex vdev_mutex;
+ struct virtio_device *vdev;
+
+ /* The disk structure for the kernel. */
+@@ -43,6 +52,13 @@ struct virtio_blk {
+ /* Process context for config space updates */
+ struct work_struct config_work;
+
++ /*
++ * Tracks references from block_device_operations open/release and
++ * virtio_driver probe/remove so this object can be freed once no
++ * longer in use.
++ */
++ refcount_t refs;
++
+ /* What host tells us, plus 2 for header & tailer. */
+ unsigned int sg_elems;
+
+@@ -294,10 +310,55 @@ out:
+ return err;
+ }
+
++static void virtblk_get(struct virtio_blk *vblk)
++{
++ refcount_inc(&vblk->refs);
++}
++
++static void virtblk_put(struct virtio_blk *vblk)
++{
++ if (refcount_dec_and_test(&vblk->refs)) {
++ ida_simple_remove(&vd_index_ida, vblk->index);
++ mutex_destroy(&vblk->vdev_mutex);
++ kfree(vblk);
++ }
++}
++
++static int virtblk_open(struct block_device *bd, fmode_t mode)
++{
++ struct virtio_blk *vblk = bd->bd_disk->private_data;
++ int ret = 0;
++
++ mutex_lock(&vblk->vdev_mutex);
++
++ if (vblk->vdev)
++ virtblk_get(vblk);
++ else
++ ret = -ENXIO;
++
++ mutex_unlock(&vblk->vdev_mutex);
++ return ret;
++}
++
++static void virtblk_release(struct gendisk *disk, fmode_t mode)
++{
++ struct virtio_blk *vblk = disk->private_data;
++
++ virtblk_put(vblk);
++}
++
+ /* We provide getgeo only to please some old bootloader/partitioning tools */
+ static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo)
+ {
+ struct virtio_blk *vblk = bd->bd_disk->private_data;
++ int ret = 0;
++
++ mutex_lock(&vblk->vdev_mutex);
++
++ if (!vblk->vdev) {
++ ret = -ENXIO;
++ goto out;
++ }
+
+ /* see if the host passed in geometry config */
+ if (virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_GEOMETRY)) {
+@@ -313,11 +374,15 @@ static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo)
+ geo->sectors = 1 << 5;
+ geo->cylinders = get_capacity(bd->bd_disk) >> 11;
+ }
+- return 0;
++out:
++ mutex_unlock(&vblk->vdev_mutex);
++ return ret;
+ }
+
+ static const struct block_device_operations virtblk_fops = {
+ .owner = THIS_MODULE,
++ .open = virtblk_open,
++ .release = virtblk_release,
+ .getgeo = virtblk_getgeo,
+ };
+
+@@ -657,6 +722,10 @@ static int virtblk_probe(struct virtio_device *vdev)
+ goto out_free_index;
+ }
+
++ /* This reference is dropped in virtblk_remove(). */
++ refcount_set(&vblk->refs, 1);
++ mutex_init(&vblk->vdev_mutex);
++
+ vblk->vdev = vdev;
+ vblk->sg_elems = sg_elems;
+
+@@ -822,8 +891,6 @@ out:
+ static void virtblk_remove(struct virtio_device *vdev)
+ {
+ struct virtio_blk *vblk = vdev->priv;
+- int index = vblk->index;
+- int refc;
+
+ /* Make sure no work handler is accessing the device. */
+ flush_work(&vblk->config_work);
+@@ -833,18 +900,21 @@ static void virtblk_remove(struct virtio_device *vdev)
+
+ blk_mq_free_tag_set(&vblk->tag_set);
+
++ mutex_lock(&vblk->vdev_mutex);
++
+ /* Stop all the virtqueues. */
+ vdev->config->reset(vdev);
+
+- refc = kref_read(&disk_to_dev(vblk->disk)->kobj.kref);
++ /* Virtqueues are stopped, nothing can use vblk->vdev anymore. */
++ vblk->vdev = NULL;
++
+ put_disk(vblk->disk);
+ vdev->config->del_vqs(vdev);
+ kfree(vblk->vqs);
+- kfree(vblk);
+
+- /* Only free device id if we don't have any users */
+- if (refc == 1)
+- ida_simple_remove(&vd_index_ida, index);
++ mutex_unlock(&vblk->vdev_mutex);
++
++ virtblk_put(vblk);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 305544b68b8a..f22b7aed6e64 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3512,6 +3512,9 @@ static int __clk_core_init(struct clk_core *core)
+ out:
+ clk_pm_runtime_put(core);
+ unlock:
++ if (ret)
++ hlist_del_init(&core->child_node);
++
+ clk_prepare_unlock();
+
+ if (!ret)
+diff --git a/drivers/clk/rockchip/clk-rk3228.c b/drivers/clk/rockchip/clk-rk3228.c
+index d17cfb7a3ff4..d7243c09cc84 100644
+--- a/drivers/clk/rockchip/clk-rk3228.c
++++ b/drivers/clk/rockchip/clk-rk3228.c
+@@ -156,8 +156,6 @@ PNAME(mux_i2s_out_p) = { "i2s1_pre", "xin12m" };
+ PNAME(mux_i2s2_p) = { "i2s2_src", "i2s2_frac", "xin12m" };
+ PNAME(mux_sclk_spdif_p) = { "sclk_spdif_src", "spdif_frac", "xin12m" };
+
+-PNAME(mux_aclk_gpu_pre_p) = { "cpll_gpu", "gpll_gpu", "hdmiphy_gpu", "usb480m_gpu" };
+-
+ PNAME(mux_uart0_p) = { "uart0_src", "uart0_frac", "xin24m" };
+ PNAME(mux_uart1_p) = { "uart1_src", "uart1_frac", "xin24m" };
+ PNAME(mux_uart2_p) = { "uart2_src", "uart2_frac", "xin24m" };
+@@ -468,16 +466,9 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = {
+ RK2928_CLKSEL_CON(24), 6, 10, DFLAGS,
+ RK2928_CLKGATE_CON(2), 8, GFLAGS),
+
+- GATE(0, "cpll_gpu", "cpll", 0,
+- RK2928_CLKGATE_CON(3), 13, GFLAGS),
+- GATE(0, "gpll_gpu", "gpll", 0,
+- RK2928_CLKGATE_CON(3), 13, GFLAGS),
+- GATE(0, "hdmiphy_gpu", "hdmiphy", 0,
+- RK2928_CLKGATE_CON(3), 13, GFLAGS),
+- GATE(0, "usb480m_gpu", "usb480m", 0,
++ COMPOSITE(0, "aclk_gpu_pre", mux_pll_src_4plls_p, 0,
++ RK2928_CLKSEL_CON(34), 5, 2, MFLAGS, 0, 5, DFLAGS,
+ RK2928_CLKGATE_CON(3), 13, GFLAGS),
+- COMPOSITE_NOGATE(0, "aclk_gpu_pre", mux_aclk_gpu_pre_p, 0,
+- RK2928_CLKSEL_CON(34), 5, 2, MFLAGS, 0, 5, DFLAGS),
+
+ COMPOSITE(SCLK_SPI0, "sclk_spi0", mux_pll_src_2plls_p, 0,
+ RK2928_CLKSEL_CON(25), 8, 1, MFLAGS, 0, 7, DFLAGS,
+@@ -582,8 +573,8 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = {
+ GATE(0, "pclk_peri_noc", "pclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(12), 2, GFLAGS),
+
+ /* PD_GPU */
+- GATE(ACLK_GPU, "aclk_gpu", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(13), 14, GFLAGS),
+- GATE(0, "aclk_gpu_noc", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(13), 15, GFLAGS),
++ GATE(ACLK_GPU, "aclk_gpu", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(7), 14, GFLAGS),
++ GATE(0, "aclk_gpu_noc", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(7), 15, GFLAGS),
+
+ /* PD_BUS */
+ GATE(0, "sclk_initmem_mbist", "aclk_cpu", 0, RK2928_CLKGATE_CON(8), 1, GFLAGS),
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index 062266034d84..9019624e37bc 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -461,7 +461,6 @@ static char * __init clkctrl_get_name(struct device_node *np)
+ return name;
+ }
+ }
+- of_node_put(np);
+
+ return NULL;
+ }
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index c81e1ff29069..b4c014464a20 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -1058,7 +1058,7 @@ static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b,
+
+ update_turbo_state();
+ if (global.turbo_disabled) {
+- pr_warn("Turbo disabled by BIOS or unavailable on processor\n");
++ pr_notice_once("Turbo disabled by BIOS or unavailable on processor\n");
+ mutex_unlock(&intel_pstate_limits_lock);
+ mutex_unlock(&intel_pstate_driver_lock);
+ return -EPERM;
+diff --git a/drivers/dma/mmp_tdma.c b/drivers/dma/mmp_tdma.c
+index 10117f271b12..d683232d7fea 100644
+--- a/drivers/dma/mmp_tdma.c
++++ b/drivers/dma/mmp_tdma.c
+@@ -363,6 +363,8 @@ static void mmp_tdma_free_descriptor(struct mmp_tdma_chan *tdmac)
+ gen_pool_free(gpool, (unsigned long)tdmac->desc_arr,
+ size);
+ tdmac->desc_arr = NULL;
++ if (tdmac->status == DMA_ERROR)
++ tdmac->status = DMA_COMPLETE;
+
+ return;
+ }
+@@ -443,7 +445,8 @@ static struct dma_async_tx_descriptor *mmp_tdma_prep_dma_cyclic(
+ if (!desc)
+ goto err_out;
+
+- mmp_tdma_config_write(chan, direction, &tdmac->slave_config);
++ if (mmp_tdma_config_write(chan, direction, &tdmac->slave_config))
++ goto err_out;
+
+ while (buf < buf_len) {
+ desc = &tdmac->desc_arr[i];
+diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
+index 581e7a290d98..a3b0b4c56a19 100644
+--- a/drivers/dma/pch_dma.c
++++ b/drivers/dma/pch_dma.c
+@@ -865,6 +865,7 @@ static int pch_dma_probe(struct pci_dev *pdev,
+ }
+
+ pci_set_master(pdev);
++ pd->dma.dev = &pdev->dev;
+
+ err = request_irq(pdev->irq, pd_irq, IRQF_SHARED, DRV_NAME, pd);
+ if (err) {
+@@ -880,7 +881,6 @@ static int pch_dma_probe(struct pci_dev *pdev,
+ goto err_free_irq;
+ }
+
+- pd->dma.dev = &pdev->dev;
+
+ INIT_LIST_HEAD(&pd->dma.channels);
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index a9c5d5cc9f2b..5d5f1d0ce16c 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -1229,16 +1229,16 @@ static enum dma_status xilinx_dma_tx_status(struct dma_chan *dchan,
+ return ret;
+
+ spin_lock_irqsave(&chan->lock, flags);
+-
+- desc = list_last_entry(&chan->active_list,
+- struct xilinx_dma_tx_descriptor, node);
+- /*
+- * VDMA and simple mode do not support residue reporting, so the
+- * residue field will always be 0.
+- */
+- if (chan->has_sg && chan->xdev->dma_config->dmatype != XDMA_TYPE_VDMA)
+- residue = xilinx_dma_get_residue(chan, desc);
+-
++ if (!list_empty(&chan->active_list)) {
++ desc = list_last_entry(&chan->active_list,
++ struct xilinx_dma_tx_descriptor, node);
++ /*
++ * VDMA and simple mode do not support residue reporting, so the
++ * residue field will always be 0.
++ */
++ if (chan->has_sg && chan->xdev->dma_config->dmatype != XDMA_TYPE_VDMA)
++ residue = xilinx_dma_get_residue(chan, desc);
++ }
+ spin_unlock_irqrestore(&chan->lock, flags);
+
+ dma_set_residue(txstate, residue);
+diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
+index 31f9f0e369b9..55b031d2c989 100644
+--- a/drivers/firmware/efi/tpm.c
++++ b/drivers/firmware/efi/tpm.c
+@@ -16,7 +16,7 @@
+ int efi_tpm_final_log_size;
+ EXPORT_SYMBOL(efi_tpm_final_log_size);
+
+-static int tpm2_calc_event_log_size(void *data, int count, void *size_info)
++static int __init tpm2_calc_event_log_size(void *data, int count, void *size_info)
+ {
+ struct tcg_pcr_event2_head *header;
+ int event_size, size = 0;
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 5638b4e5355f..4269ea9a817e 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -531,7 +531,7 @@ static int pca953x_gpio_set_config(struct gpio_chip *gc, unsigned int offset,
+ {
+ struct pca953x_chip *chip = gpiochip_get_data(gc);
+
+- switch (config) {
++ switch (pinconf_to_config_param(config)) {
+ case PIN_CONFIG_BIAS_PULL_UP:
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+ return pca953x_gpio_set_pull_up_down(chip, offset, config);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+index 2672dc64a310..6a76ab16500f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+@@ -133,8 +133,7 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev,
+ u32 cpp;
+ u64 flags = AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED |
+ AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS |
+- AMDGPU_GEM_CREATE_VRAM_CLEARED |
+- AMDGPU_GEM_CREATE_CPU_GTT_USWC;
++ AMDGPU_GEM_CREATE_VRAM_CLEARED;
+
+ info = drm_get_format_info(adev->ddev, mode_cmd);
+ cpp = info->cpp[0];
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 73337e658aff..906648fca9ef 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -1177,6 +1177,8 @@ static const struct amdgpu_gfxoff_quirk amdgpu_gfxoff_quirk_list[] = {
+ { 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc8 },
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=207171 */
+ { 0x1002, 0x15dd, 0x103c, 0x83e7, 0xd3 },
++ /* GFXOFF is unstable on C6 parts with a VBIOS 113-RAVEN-114 */
++ { 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc6 },
+ { 0, 0, 0, 0, 0 },
+ };
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 8136a58deb39..5e27a67fbc58 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -7716,6 +7716,7 @@ static int dm_update_plane_state(struct dc *dc,
+ struct drm_crtc_state *old_crtc_state, *new_crtc_state;
+ struct dm_crtc_state *dm_new_crtc_state, *dm_old_crtc_state;
+ struct dm_plane_state *dm_new_plane_state, *dm_old_plane_state;
++ struct amdgpu_crtc *new_acrtc;
+ bool needs_reset;
+ int ret = 0;
+
+@@ -7725,9 +7726,30 @@ static int dm_update_plane_state(struct dc *dc,
+ dm_new_plane_state = to_dm_plane_state(new_plane_state);
+ dm_old_plane_state = to_dm_plane_state(old_plane_state);
+
+- /*TODO Implement atomic check for cursor plane */
+- if (plane->type == DRM_PLANE_TYPE_CURSOR)
++ /*TODO Implement better atomic check for cursor plane */
++ if (plane->type == DRM_PLANE_TYPE_CURSOR) {
++ if (!enable || !new_plane_crtc ||
++ drm_atomic_plane_disabling(plane->state, new_plane_state))
++ return 0;
++
++ new_acrtc = to_amdgpu_crtc(new_plane_crtc);
++
++ if ((new_plane_state->crtc_w > new_acrtc->max_cursor_width) ||
++ (new_plane_state->crtc_h > new_acrtc->max_cursor_height)) {
++ DRM_DEBUG_ATOMIC("Bad cursor size %d x %d\n",
++ new_plane_state->crtc_w, new_plane_state->crtc_h);
++ return -EINVAL;
++ }
++
++ if (new_plane_state->crtc_x <= -new_acrtc->max_cursor_width ||
++ new_plane_state->crtc_y <= -new_acrtc->max_cursor_height) {
++ DRM_DEBUG_ATOMIC("Bad cursor position %d, %d\n",
++ new_plane_state->crtc_x, new_plane_state->crtc_y);
++ return -EINVAL;
++ }
++
+ return 0;
++ }
+
+ needs_reset = should_reset_plane(state, plane, old_plane_state,
+ new_plane_state);
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index fd9e69634c50..1b6c75a4dd60 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -2885,6 +2885,12 @@ bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd
+ sizeof(hpd_irq_dpcd_data),
+ "Status: ");
+
++ for (i = 0; i < MAX_PIPES; i++) {
++ pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i];
++ if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link)
++ link->dc->hwss.blank_stream(pipe_ctx);
++ }
++
+ for (i = 0; i < MAX_PIPES; i++) {
+ pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i];
+ if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link)
+@@ -2904,6 +2910,12 @@ bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd
+ if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
+ dc_link_reallocate_mst_payload(link);
+
++ for (i = 0; i < MAX_PIPES; i++) {
++ pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i];
++ if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link)
++ link->dc->hwss.unblank_stream(pipe_ctx, &previous_link_settings);
++ }
++
+ status = false;
+ if (out_link_loss)
+ *out_link_loss = true;
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+index 6ddbb00ed37a..8c20e9e907b2 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+@@ -239,24 +239,24 @@ static void delay_cursor_until_vupdate(struct pipe_ctx *pipe_ctx, struct dc *dc)
+ struct dc_stream_state *stream = pipe_ctx->stream;
+ unsigned int us_per_line;
+
+- if (stream->ctx->asic_id.chip_family == FAMILY_RV &&
+- ASICREV_IS_RAVEN(stream->ctx->asic_id.hw_internal_rev)) {
++ if (!dc->hwss.get_vupdate_offset_from_vsync)
++ return;
+
+- vupdate_line = dc->hwss.get_vupdate_offset_from_vsync(pipe_ctx);
+- if (!dc_stream_get_crtc_position(dc, &stream, 1, &vpos, &nvpos))
+- return;
++ vupdate_line = dc->hwss.get_vupdate_offset_from_vsync(pipe_ctx);
++ if (!dc_stream_get_crtc_position(dc, &stream, 1, &vpos, &nvpos))
++ return;
+
+- if (vpos >= vupdate_line)
+- return;
++ if (vpos >= vupdate_line)
++ return;
+
+- us_per_line = stream->timing.h_total * 10000 / stream->timing.pix_clk_100hz;
+- lines_to_vupdate = vupdate_line - vpos;
+- us_to_vupdate = lines_to_vupdate * us_per_line;
++ us_per_line =
++ stream->timing.h_total * 10000 / stream->timing.pix_clk_100hz;
++ lines_to_vupdate = vupdate_line - vpos;
++ us_to_vupdate = lines_to_vupdate * us_per_line;
+
+- /* 70 us is a conservative estimate of cursor update time*/
+- if (us_to_vupdate < 70)
+- udelay(us_to_vupdate);
+- }
++ /* 70 us is a conservative estimate of cursor update time*/
++ if (us_to_vupdate < 70)
++ udelay(us_to_vupdate);
+ #endif
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+index a444fed94184..ad422e00f9fe 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+@@ -2306,7 +2306,8 @@ void dcn20_fpga_init_hw(struct dc *dc)
+
+ REG_UPDATE(DCHUBBUB_GLOBAL_TIMER_CNTL, DCHUBBUB_GLOBAL_TIMER_REFDIV, 2);
+ REG_UPDATE(DCHUBBUB_GLOBAL_TIMER_CNTL, DCHUBBUB_GLOBAL_TIMER_ENABLE, 1);
+- REG_WRITE(REFCLK_CNTL, 0);
++ if (REG(REFCLK_CNTL))
++ REG_WRITE(REFCLK_CNTL, 0);
+ //
+
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+index 33d0a176841a..122d3e734c59 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+@@ -250,7 +250,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = {
+ .dram_channel_width_bytes = 4,
+ .fabric_datapath_to_dcn_data_return_bytes = 32,
+ .dcn_downspread_percent = 0.5,
+- .downspread_percent = 0.5,
++ .downspread_percent = 0.38,
+ .dram_page_open_time_ns = 50.0,
+ .dram_rw_turnaround_time_ns = 17.5,
+ .dram_return_buffer_per_channel_bytes = 8192,
+diff --git a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+index c195575366a3..e4e5a53b2b4e 100644
+--- a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
++++ b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+@@ -1435,7 +1435,8 @@ static int pp_get_asic_baco_capability(void *handle, bool *cap)
+ if (!hwmgr)
+ return -EINVAL;
+
+- if (!hwmgr->pm_en || !hwmgr->hwmgr_func->get_asic_baco_capability)
++ if (!(hwmgr->not_vf && amdgpu_dpm) ||
++ !hwmgr->hwmgr_func->get_asic_baco_capability)
+ return 0;
+
+ mutex_lock(&hwmgr->smu_lock);
+@@ -1469,7 +1470,8 @@ static int pp_set_asic_baco_state(void *handle, int state)
+ if (!hwmgr)
+ return -EINVAL;
+
+- if (!hwmgr->pm_en || !hwmgr->hwmgr_func->set_asic_baco_state)
++ if (!(hwmgr->not_vf && amdgpu_dpm) ||
++ !hwmgr->hwmgr_func->set_asic_baco_state)
+ return 0;
+
+ mutex_lock(&hwmgr->smu_lock);
+diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
+index 2fe594952748..d3c58026d55e 100644
+--- a/drivers/gpu/drm/i915/display/intel_ddi.c
++++ b/drivers/gpu/drm/i915/display/intel_ddi.c
+@@ -3545,9 +3545,6 @@ static void hsw_ddi_pre_enable_dp(struct intel_encoder *encoder,
+ intel_dp_set_link_params(intel_dp, crtc_state->port_clock,
+ crtc_state->lane_count, is_mst);
+
+- intel_dp->regs.dp_tp_ctl = DP_TP_CTL(port);
+- intel_dp->regs.dp_tp_status = DP_TP_STATUS(port);
+-
+ intel_edp_panel_on(intel_dp);
+
+ intel_ddi_clk_select(encoder, crtc_state);
+@@ -4269,12 +4266,18 @@ void intel_ddi_get_config(struct intel_encoder *encoder,
+ struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
+ struct intel_crtc *intel_crtc = to_intel_crtc(pipe_config->uapi.crtc);
+ enum transcoder cpu_transcoder = pipe_config->cpu_transcoder;
++ struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
+ u32 temp, flags = 0;
+
+ /* XXX: DSI transcoder paranoia */
+ if (WARN_ON(transcoder_is_dsi(cpu_transcoder)))
+ return;
+
++ if (INTEL_GEN(dev_priv) >= 12) {
++ intel_dp->regs.dp_tp_ctl = TGL_DP_TP_CTL(cpu_transcoder);
++ intel_dp->regs.dp_tp_status = TGL_DP_TP_STATUS(cpu_transcoder);
++ }
++
+ intel_dsc_get_config(encoder, pipe_config);
+
+ temp = I915_READ(TRANS_DDI_FUNC_CTL(cpu_transcoder));
+@@ -4492,6 +4495,7 @@ static const struct drm_encoder_funcs intel_ddi_funcs = {
+ static struct intel_connector *
+ intel_ddi_init_dp_connector(struct intel_digital_port *intel_dig_port)
+ {
++ struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev);
+ struct intel_connector *connector;
+ enum port port = intel_dig_port->base.port;
+
+@@ -4502,6 +4506,10 @@ intel_ddi_init_dp_connector(struct intel_digital_port *intel_dig_port)
+ intel_dig_port->dp.output_reg = DDI_BUF_CTL(port);
+ intel_dig_port->dp.prepare_link_retrain =
+ intel_ddi_prepare_link_retrain;
++ if (INTEL_GEN(dev_priv) < 12) {
++ intel_dig_port->dp.regs.dp_tp_ctl = DP_TP_CTL(port);
++ intel_dig_port->dp.regs.dp_tp_status = DP_TP_STATUS(port);
++ }
+
+ if (!intel_dp_init_connector(intel_dig_port, connector)) {
+ kfree(connector);
+diff --git a/drivers/gpu/drm/i915/display/intel_display_power.c b/drivers/gpu/drm/i915/display/intel_display_power.c
+index 46c40db992dd..5895b8c7662e 100644
+--- a/drivers/gpu/drm/i915/display/intel_display_power.c
++++ b/drivers/gpu/drm/i915/display/intel_display_power.c
+@@ -4068,7 +4068,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = {
+ {
+ .name = "AUX D TBT1",
+ .domains = TGL_AUX_D_TBT1_IO_POWER_DOMAINS,
+- .ops = &hsw_power_well_ops,
++ .ops = &icl_tc_phy_aux_power_well_ops,
+ .id = DISP_PW_ID_NONE,
+ {
+ .hsw.regs = &icl_aux_power_well_regs,
+@@ -4079,7 +4079,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = {
+ {
+ .name = "AUX E TBT2",
+ .domains = TGL_AUX_E_TBT2_IO_POWER_DOMAINS,
+- .ops = &hsw_power_well_ops,
++ .ops = &icl_tc_phy_aux_power_well_ops,
+ .id = DISP_PW_ID_NONE,
+ {
+ .hsw.regs = &icl_aux_power_well_regs,
+@@ -4090,7 +4090,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = {
+ {
+ .name = "AUX F TBT3",
+ .domains = TGL_AUX_F_TBT3_IO_POWER_DOMAINS,
+- .ops = &hsw_power_well_ops,
++ .ops = &icl_tc_phy_aux_power_well_ops,
+ .id = DISP_PW_ID_NONE,
+ {
+ .hsw.regs = &icl_aux_power_well_regs,
+@@ -4101,7 +4101,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = {
+ {
+ .name = "AUX G TBT4",
+ .domains = TGL_AUX_G_TBT4_IO_POWER_DOMAINS,
+- .ops = &hsw_power_well_ops,
++ .ops = &icl_tc_phy_aux_power_well_ops,
+ .id = DISP_PW_ID_NONE,
+ {
+ .hsw.regs = &icl_aux_power_well_regs,
+@@ -4112,7 +4112,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = {
+ {
+ .name = "AUX H TBT5",
+ .domains = TGL_AUX_H_TBT5_IO_POWER_DOMAINS,
+- .ops = &hsw_power_well_ops,
++ .ops = &icl_tc_phy_aux_power_well_ops,
+ .id = DISP_PW_ID_NONE,
+ {
+ .hsw.regs = &icl_aux_power_well_regs,
+@@ -4123,7 +4123,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = {
+ {
+ .name = "AUX I TBT6",
+ .domains = TGL_AUX_I_TBT6_IO_POWER_DOMAINS,
+- .ops = &hsw_power_well_ops,
++ .ops = &icl_tc_phy_aux_power_well_ops,
+ .id = DISP_PW_ID_NONE,
+ {
+ .hsw.regs = &icl_aux_power_well_regs,
+diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
+index c7424e2a04a3..fa3a9e9e0b29 100644
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -2492,9 +2492,6 @@ static void intel_dp_prepare(struct intel_encoder *encoder,
+ intel_crtc_has_type(pipe_config,
+ INTEL_OUTPUT_DP_MST));
+
+- intel_dp->regs.dp_tp_ctl = DP_TP_CTL(port);
+- intel_dp->regs.dp_tp_status = DP_TP_STATUS(port);
+-
+ /*
+ * There are four kinds of DP registers:
+ *
+@@ -7616,6 +7613,8 @@ bool intel_dp_init(struct drm_i915_private *dev_priv,
+
+ intel_dig_port->dp.output_reg = output_reg;
+ intel_dig_port->max_lanes = 4;
++ intel_dig_port->dp.regs.dp_tp_ctl = DP_TP_CTL(port);
++ intel_dig_port->dp.regs.dp_tp_status = DP_TP_STATUS(port);
+
+ intel_encoder->type = INTEL_OUTPUT_DP;
+ intel_encoder->power_domain = intel_port_to_power_domain(port);
+diff --git a/drivers/gpu/drm/i915/display/intel_fbc.c b/drivers/gpu/drm/i915/display/intel_fbc.c
+index a1048ece541e..b6d5e7defa5b 100644
+--- a/drivers/gpu/drm/i915/display/intel_fbc.c
++++ b/drivers/gpu/drm/i915/display/intel_fbc.c
+@@ -478,8 +478,7 @@ static int intel_fbc_alloc_cfb(struct drm_i915_private *dev_priv,
+ if (!ret)
+ goto err_llb;
+ else if (ret > 1) {
+- DRM_INFO("Reducing the compressed framebuffer size. This may lead to less power savings than a non-reduced-size. Try to increase stolen memory size if available in BIOS.\n");
+-
++ DRM_INFO_ONCE("Reducing the compressed framebuffer size. This may lead to less power savings than a non-reduced-size. Try to increase stolen memory size if available in BIOS.\n");
+ }
+
+ fbc->threshold = ret;
+diff --git a/drivers/gpu/drm/i915/display/intel_sprite.c b/drivers/gpu/drm/i915/display/intel_sprite.c
+index fca77ec1e0dd..f55404a94eba 100644
+--- a/drivers/gpu/drm/i915/display/intel_sprite.c
++++ b/drivers/gpu/drm/i915/display/intel_sprite.c
+@@ -2754,19 +2754,25 @@ static bool skl_plane_format_mod_supported(struct drm_plane *_plane,
+ }
+ }
+
+-static bool gen12_plane_supports_mc_ccs(enum plane_id plane_id)
++static bool gen12_plane_supports_mc_ccs(struct drm_i915_private *dev_priv,
++ enum plane_id plane_id)
+ {
++ /* Wa_14010477008:tgl[a0..c0] */
++ if (IS_TGL_REVID(dev_priv, TGL_REVID_A0, TGL_REVID_C0))
++ return false;
++
+ return plane_id < PLANE_SPRITE4;
+ }
+
+ static bool gen12_plane_format_mod_supported(struct drm_plane *_plane,
+ u32 format, u64 modifier)
+ {
++ struct drm_i915_private *dev_priv = to_i915(_plane->dev);
+ struct intel_plane *plane = to_intel_plane(_plane);
+
+ switch (modifier) {
+ case I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS:
+- if (!gen12_plane_supports_mc_ccs(plane->id))
++ if (!gen12_plane_supports_mc_ccs(dev_priv, plane->id))
+ return false;
+ /* fall through */
+ case DRM_FORMAT_MOD_LINEAR:
+@@ -2935,9 +2941,10 @@ static const u32 *icl_get_plane_formats(struct drm_i915_private *dev_priv,
+ }
+ }
+
+-static const u64 *gen12_get_plane_modifiers(enum plane_id plane_id)
++static const u64 *gen12_get_plane_modifiers(struct drm_i915_private *dev_priv,
++ enum plane_id plane_id)
+ {
+- if (gen12_plane_supports_mc_ccs(plane_id))
++ if (gen12_plane_supports_mc_ccs(dev_priv, plane_id))
+ return gen12_plane_format_modifiers_mc_ccs;
+ else
+ return gen12_plane_format_modifiers_rc_ccs;
+@@ -3008,7 +3015,7 @@ skl_universal_plane_create(struct drm_i915_private *dev_priv,
+
+ plane->has_ccs = skl_plane_has_ccs(dev_priv, pipe, plane_id);
+ if (INTEL_GEN(dev_priv) >= 12) {
+- modifiers = gen12_get_plane_modifiers(plane_id);
++ modifiers = gen12_get_plane_modifiers(dev_priv, plane_id);
+ plane_funcs = &gen12_plane_funcs;
+ } else {
+ if (plane->has_ccs)
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_domain.c b/drivers/gpu/drm/i915/gem/i915_gem_domain.c
+index 0cc40e77bbd2..4f96c8788a2e 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_domain.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_domain.c
+@@ -368,7 +368,6 @@ static void i915_gem_object_bump_inactive_ggtt(struct drm_i915_gem_object *obj)
+ struct drm_i915_private *i915 = to_i915(obj->base.dev);
+ struct i915_vma *vma;
+
+- GEM_BUG_ON(!i915_gem_object_has_pinned_pages(obj));
+ if (!atomic_read(&obj->bind_count))
+ return;
+
+@@ -400,12 +399,8 @@ static void i915_gem_object_bump_inactive_ggtt(struct drm_i915_gem_object *obj)
+ void
+ i915_gem_object_unpin_from_display_plane(struct i915_vma *vma)
+ {
+- struct drm_i915_gem_object *obj = vma->obj;
+-
+- assert_object_held(obj);
+-
+ /* Bump the LRU to try and avoid premature eviction whilst flipping */
+- i915_gem_object_bump_inactive_ggtt(obj);
++ i915_gem_object_bump_inactive_ggtt(vma->obj);
+
+ i915_vma_unpin(vma);
+ }
+diff --git a/drivers/gpu/drm/i915/gt/intel_engine.h b/drivers/gpu/drm/i915/gt/intel_engine.h
+index 5df003061e44..beb3211a6249 100644
+--- a/drivers/gpu/drm/i915/gt/intel_engine.h
++++ b/drivers/gpu/drm/i915/gt/intel_engine.h
+@@ -338,13 +338,4 @@ intel_engine_has_preempt_reset(const struct intel_engine_cs *engine)
+ return intel_engine_has_preemption(engine);
+ }
+
+-static inline bool
+-intel_engine_has_timeslices(const struct intel_engine_cs *engine)
+-{
+- if (!IS_ACTIVE(CONFIG_DRM_I915_TIMESLICE_DURATION))
+- return false;
+-
+- return intel_engine_has_semaphores(engine);
+-}
+-
+ #endif /* _INTEL_RINGBUFFER_H_ */
+diff --git a/drivers/gpu/drm/i915/gt/intel_engine_types.h b/drivers/gpu/drm/i915/gt/intel_engine_types.h
+index 92be41a6903c..4ea067e1508a 100644
+--- a/drivers/gpu/drm/i915/gt/intel_engine_types.h
++++ b/drivers/gpu/drm/i915/gt/intel_engine_types.h
+@@ -473,10 +473,11 @@ struct intel_engine_cs {
+ #define I915_ENGINE_SUPPORTS_STATS BIT(1)
+ #define I915_ENGINE_HAS_PREEMPTION BIT(2)
+ #define I915_ENGINE_HAS_SEMAPHORES BIT(3)
+-#define I915_ENGINE_NEEDS_BREADCRUMB_TASKLET BIT(4)
+-#define I915_ENGINE_IS_VIRTUAL BIT(5)
+-#define I915_ENGINE_HAS_RELATIVE_MMIO BIT(6)
+-#define I915_ENGINE_REQUIRES_CMD_PARSER BIT(7)
++#define I915_ENGINE_HAS_TIMESLICES BIT(4)
++#define I915_ENGINE_NEEDS_BREADCRUMB_TASKLET BIT(5)
++#define I915_ENGINE_IS_VIRTUAL BIT(6)
++#define I915_ENGINE_HAS_RELATIVE_MMIO BIT(7)
++#define I915_ENGINE_REQUIRES_CMD_PARSER BIT(8)
+ unsigned int flags;
+
+ /*
+@@ -573,6 +574,15 @@ intel_engine_has_semaphores(const struct intel_engine_cs *engine)
+ return engine->flags & I915_ENGINE_HAS_SEMAPHORES;
+ }
+
++static inline bool
++intel_engine_has_timeslices(const struct intel_engine_cs *engine)
++{
++ if (!IS_ACTIVE(CONFIG_DRM_I915_TIMESLICE_DURATION))
++ return false;
++
++ return engine->flags & I915_ENGINE_HAS_TIMESLICES;
++}
++
+ static inline bool
+ intel_engine_needs_breadcrumb_tasklet(const struct intel_engine_cs *engine)
+ {
+diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c
+index 31455eceeb0c..637c03ee1a57 100644
+--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
+@@ -1626,6 +1626,9 @@ static void defer_request(struct i915_request *rq, struct list_head * const pl)
+ struct i915_request *w =
+ container_of(p->waiter, typeof(*w), sched);
+
++ if (p->flags & I915_DEPENDENCY_WEAK)
++ continue;
++
+ /* Leave semaphores spinning on the other engines */
+ if (w->engine != rq->engine)
+ continue;
+@@ -4194,8 +4197,11 @@ void intel_execlists_set_default_submission(struct intel_engine_cs *engine)
+ engine->flags |= I915_ENGINE_SUPPORTS_STATS;
+ if (!intel_vgpu_active(engine->i915)) {
+ engine->flags |= I915_ENGINE_HAS_SEMAPHORES;
+- if (HAS_LOGICAL_RING_PREEMPTION(engine->i915))
++ if (HAS_LOGICAL_RING_PREEMPTION(engine->i915)) {
+ engine->flags |= I915_ENGINE_HAS_PREEMPTION;
++ if (IS_ACTIVE(CONFIG_DRM_I915_TIMESLICE_DURATION))
++ engine->flags |= I915_ENGINE_HAS_TIMESLICES;
++ }
+ }
+
+ if (INTEL_GEN(engine->i915) >= 12)
+diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
+index 685d1e04a5ff..709ad181bc94 100644
+--- a/drivers/gpu/drm/i915/gvt/scheduler.c
++++ b/drivers/gpu/drm/i915/gvt/scheduler.c
+@@ -375,7 +375,11 @@ static void set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload,
+ for (i = 0; i < GVT_RING_CTX_NR_PDPS; i++) {
+ struct i915_page_directory * const pd =
+ i915_pd_entry(ppgtt->pd, i);
+-
++ /* skip now as current i915 ppgtt alloc won't allocate
++ top level pdp for non 4-level table, won't impact
++ shadow ppgtt. */
++ if (!pd)
++ break;
+ px_dma(pd) = mm->ppgtt_mm.shadow_pdps[i];
+ }
+ }
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 810e3ccd56ec..dff134265112 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1601,6 +1601,8 @@ IS_SUBPLATFORM(const struct drm_i915_private *i915,
+ (IS_ICELAKE(p) && IS_REVID(p, since, until))
+
+ #define TGL_REVID_A0 0x0
++#define TGL_REVID_B0 0x1
++#define TGL_REVID_C0 0x2
+
+ #define IS_TGL_REVID(p, since, until) \
+ (IS_TIGERLAKE(p) && IS_REVID(p, since, until))
+diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
+index 0697bedebeef..d99df9c33708 100644
+--- a/drivers/gpu/drm/i915/i915_gem_evict.c
++++ b/drivers/gpu/drm/i915/i915_gem_evict.c
+@@ -130,6 +130,13 @@ search_again:
+ active = NULL;
+ INIT_LIST_HEAD(&eviction_list);
+ list_for_each_entry_safe(vma, next, &vm->bound_list, vm_link) {
++ if (vma == active) { /* now seen this vma twice */
++ if (flags & PIN_NONBLOCK)
++ break;
++
++ active = ERR_PTR(-EAGAIN);
++ }
++
+ /*
+ * We keep this list in a rough least-recently scanned order
+ * of active elements (inactive elements are cheap to reap).
+@@ -145,21 +152,12 @@ search_again:
+ * To notice when we complete one full cycle, we record the
+ * first active element seen, before moving it to the tail.
+ */
+- if (i915_vma_is_active(vma)) {
+- if (vma == active) {
+- if (flags & PIN_NONBLOCK)
+- break;
+-
+- active = ERR_PTR(-EAGAIN);
+- }
+-
+- if (active != ERR_PTR(-EAGAIN)) {
+- if (!active)
+- active = vma;
++ if (active != ERR_PTR(-EAGAIN) && i915_vma_is_active(vma)) {
++ if (!active)
++ active = vma;
+
+- list_move_tail(&vma->vm_link, &vm->bound_list);
+- continue;
+- }
++ list_move_tail(&vma->vm_link, &vm->bound_list);
++ continue;
+ }
+
+ if (mark_free(&scan, vma, flags, &eviction_list))
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index c6f02b0b6c7a..52825ae8301b 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -3324,7 +3324,7 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv)
+ u32 de_pipe_masked = gen8_de_pipe_fault_mask(dev_priv) |
+ GEN8_PIPE_CDCLK_CRC_DONE;
+ u32 de_pipe_enables;
+- u32 de_port_masked = GEN8_AUX_CHANNEL_A;
++ u32 de_port_masked = gen8_de_port_aux_mask(dev_priv);
+ u32 de_port_enables;
+ u32 de_misc_masked = GEN8_DE_EDP_PSR;
+ enum pipe pipe;
+@@ -3332,18 +3332,8 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv)
+ if (INTEL_GEN(dev_priv) <= 10)
+ de_misc_masked |= GEN8_DE_MISC_GSE;
+
+- if (INTEL_GEN(dev_priv) >= 9) {
+- de_port_masked |= GEN9_AUX_CHANNEL_B | GEN9_AUX_CHANNEL_C |
+- GEN9_AUX_CHANNEL_D;
+- if (IS_GEN9_LP(dev_priv))
+- de_port_masked |= BXT_DE_PORT_GMBUS;
+- }
+-
+- if (INTEL_GEN(dev_priv) >= 11)
+- de_port_masked |= ICL_AUX_CHANNEL_E;
+-
+- if (IS_CNL_WITH_PORT_F(dev_priv) || INTEL_GEN(dev_priv) >= 11)
+- de_port_masked |= CNL_AUX_CHANNEL_F;
++ if (IS_GEN9_LP(dev_priv))
++ de_port_masked |= BXT_DE_PORT_GMBUS;
+
+ de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK |
+ GEN8_PIPE_FIFO_UNDERRUN;
+diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c
+index a18b2a244706..32ab154db788 100644
+--- a/drivers/gpu/drm/i915/i915_request.c
++++ b/drivers/gpu/drm/i915/i915_request.c
+@@ -951,7 +951,9 @@ i915_request_await_request(struct i915_request *to, struct i915_request *from)
+ return 0;
+
+ if (to->engine->schedule) {
+- ret = i915_sched_node_add_dependency(&to->sched, &from->sched);
++ ret = i915_sched_node_add_dependency(&to->sched,
++ &from->sched,
++ I915_DEPENDENCY_EXTERNAL);
+ if (ret < 0)
+ return ret;
+ }
+@@ -1084,7 +1086,9 @@ __i915_request_await_execution(struct i915_request *to,
+
+ /* Couple the dependency tree for PI on this exposed to->fence */
+ if (to->engine->schedule) {
+- err = i915_sched_node_add_dependency(&to->sched, &from->sched);
++ err = i915_sched_node_add_dependency(&to->sched,
++ &from->sched,
++ I915_DEPENDENCY_WEAK);
+ if (err < 0)
+ return err;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_scheduler.c b/drivers/gpu/drm/i915/i915_scheduler.c
+index 34b654b4e58a..8e419d897c2b 100644
+--- a/drivers/gpu/drm/i915/i915_scheduler.c
++++ b/drivers/gpu/drm/i915/i915_scheduler.c
+@@ -455,7 +455,8 @@ bool __i915_sched_node_add_dependency(struct i915_sched_node *node,
+ }
+
+ int i915_sched_node_add_dependency(struct i915_sched_node *node,
+- struct i915_sched_node *signal)
++ struct i915_sched_node *signal,
++ unsigned long flags)
+ {
+ struct i915_dependency *dep;
+
+@@ -464,8 +465,7 @@ int i915_sched_node_add_dependency(struct i915_sched_node *node,
+ return -ENOMEM;
+
+ if (!__i915_sched_node_add_dependency(node, signal, dep,
+- I915_DEPENDENCY_EXTERNAL |
+- I915_DEPENDENCY_ALLOC))
++ flags | I915_DEPENDENCY_ALLOC))
+ i915_dependency_free(dep);
+
+ return 0;
+diff --git a/drivers/gpu/drm/i915/i915_scheduler.h b/drivers/gpu/drm/i915/i915_scheduler.h
+index d1dc4efef77b..6f0bf00fc569 100644
+--- a/drivers/gpu/drm/i915/i915_scheduler.h
++++ b/drivers/gpu/drm/i915/i915_scheduler.h
+@@ -34,7 +34,8 @@ bool __i915_sched_node_add_dependency(struct i915_sched_node *node,
+ unsigned long flags);
+
+ int i915_sched_node_add_dependency(struct i915_sched_node *node,
+- struct i915_sched_node *signal);
++ struct i915_sched_node *signal,
++ unsigned long flags);
+
+ void i915_sched_node_fini(struct i915_sched_node *node);
+
+diff --git a/drivers/gpu/drm/i915/i915_scheduler_types.h b/drivers/gpu/drm/i915/i915_scheduler_types.h
+index d18e70550054..7186875088a0 100644
+--- a/drivers/gpu/drm/i915/i915_scheduler_types.h
++++ b/drivers/gpu/drm/i915/i915_scheduler_types.h
+@@ -78,6 +78,7 @@ struct i915_dependency {
+ unsigned long flags;
+ #define I915_DEPENDENCY_ALLOC BIT(0)
+ #define I915_DEPENDENCY_EXTERNAL BIT(1)
++#define I915_DEPENDENCY_WEAK BIT(2)
+ };
+
+ #endif /* _I915_SCHEDULER_TYPES_H_ */
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index bd2d30ecc030..53c7b1a1b355 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -4722,7 +4722,7 @@ static void skl_compute_plane_wm(const struct intel_crtc_state *crtc_state,
+ * WaIncreaseLatencyIPCEnabled: kbl,cfl
+ * Display WA #1141: kbl,cfl
+ */
+- if ((IS_KABYLAKE(dev_priv) || IS_COFFEELAKE(dev_priv)) ||
++ if ((IS_KABYLAKE(dev_priv) || IS_COFFEELAKE(dev_priv)) &&
+ dev_priv->ipc_enabled)
+ latency += 4;
+
+diff --git a/drivers/gpu/drm/qxl/qxl_image.c b/drivers/gpu/drm/qxl/qxl_image.c
+index 43688ecdd8a0..60ab7151b84d 100644
+--- a/drivers/gpu/drm/qxl/qxl_image.c
++++ b/drivers/gpu/drm/qxl/qxl_image.c
+@@ -212,7 +212,8 @@ qxl_image_init_helper(struct qxl_device *qdev,
+ break;
+ default:
+ DRM_ERROR("unsupported image bit depth\n");
+- return -EINVAL; /* TODO: cleanup */
++ qxl_bo_kunmap_atomic_page(qdev, image_bo, ptr);
++ return -EINVAL;
+ }
+ image->u.bitmap.flags = QXL_BITMAP_TOP_DOWN;
+ image->u.bitmap.x = width;
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index a75fcb113172..2b6d77ca3dfc 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -719,7 +719,7 @@ static void sun6i_dsi_encoder_enable(struct drm_encoder *encoder)
+ struct drm_display_mode *mode = &encoder->crtc->state->adjusted_mode;
+ struct sun6i_dsi *dsi = encoder_to_sun6i_dsi(encoder);
+ struct mipi_dsi_device *device = dsi->device;
+- union phy_configure_opts opts = { 0 };
++ union phy_configure_opts opts = { };
+ struct phy_configure_opts_mipi_dphy *cfg = &opts.mipi_dphy;
+ u16 delay;
+
+diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
+index bd268028fb3d..583cd6e0ae27 100644
+--- a/drivers/gpu/drm/tegra/drm.c
++++ b/drivers/gpu/drm/tegra/drm.c
+@@ -1039,6 +1039,7 @@ void tegra_drm_free(struct tegra_drm *tegra, size_t size, void *virt,
+
+ static bool host1x_drm_wants_iommu(struct host1x_device *dev)
+ {
++ struct host1x *host1x = dev_get_drvdata(dev->dev.parent);
+ struct iommu_domain *domain;
+
+ /*
+@@ -1076,7 +1077,7 @@ static bool host1x_drm_wants_iommu(struct host1x_device *dev)
+ * sufficient and whether or not the host1x is attached to an IOMMU
+ * doesn't matter.
+ */
+- if (!domain && dma_get_mask(dev->dev.parent) <= DMA_BIT_MASK(32))
++ if (!domain && host1x_get_dma_mask(host1x) <= DMA_BIT_MASK(32))
+ return true;
+
+ return domain != NULL;
+diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
+index 388bcc2889aa..40a4b9f8b861 100644
+--- a/drivers/gpu/host1x/dev.c
++++ b/drivers/gpu/host1x/dev.c
+@@ -502,6 +502,19 @@ static void __exit tegra_host1x_exit(void)
+ }
+ module_exit(tegra_host1x_exit);
+
++/**
++ * host1x_get_dma_mask() - query the supported DMA mask for host1x
++ * @host1x: host1x instance
++ *
++ * Note that this returns the supported DMA mask for host1x, which can be
++ * different from the applicable DMA mask under certain circumstances.
++ */
++u64 host1x_get_dma_mask(struct host1x *host1x)
++{
++ return host1x->info->dma_mask;
++}
++EXPORT_SYMBOL(host1x_get_dma_mask);
++
+ MODULE_AUTHOR("Thierry Reding <thierry.reding@avionic-design.de>");
+ MODULE_AUTHOR("Terje Bergstrom <tbergstrom@nvidia.com>");
+ MODULE_DESCRIPTION("Host1x driver for Tegra products");
+diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c
+index 53b517dbe7e6..4af2fc309c28 100644
+--- a/drivers/hwmon/da9052-hwmon.c
++++ b/drivers/hwmon/da9052-hwmon.c
+@@ -244,9 +244,9 @@ static ssize_t da9052_tsi_show(struct device *dev,
+ int channel = to_sensor_dev_attr(devattr)->index;
+ int ret;
+
+- mutex_lock(&hwmon->hwmon_lock);
++ mutex_lock(&hwmon->da9052->auxadc_lock);
+ ret = __da9052_read_tsi(dev, channel);
+- mutex_unlock(&hwmon->hwmon_lock);
++ mutex_unlock(&hwmon->da9052->auxadc_lock);
+
+ if (ret < 0)
+ return ret;
+diff --git a/drivers/hwmon/drivetemp.c b/drivers/hwmon/drivetemp.c
+index 9179460c2d9d..0d4f3d97ffc6 100644
+--- a/drivers/hwmon/drivetemp.c
++++ b/drivers/hwmon/drivetemp.c
+@@ -346,7 +346,7 @@ static int drivetemp_identify_sata(struct drivetemp_data *st)
+ st->have_temp_highest = temp_is_valid(buf[SCT_STATUS_TEMP_HIGHEST]);
+
+ if (!have_sct_data_table)
+- goto skip_sct;
++ goto skip_sct_data;
+
+ /* Request and read temperature history table */
+ memset(buf, '\0', sizeof(st->smartdata));
+diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
+index 17bfedd24cc3..4619629b958c 100644
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -1536,8 +1536,11 @@ int ib_cache_setup_one(struct ib_device *device)
+ if (err)
+ return err;
+
+- rdma_for_each_port (device, p)
+- ib_cache_update(device, p, true);
++ rdma_for_each_port (device, p) {
++ err = ib_cache_update(device, p, true);
++ if (err)
++ return err;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
+index 9eec26d10d7b..e16105be2eb2 100644
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -1292,11 +1292,10 @@ static int res_get_common_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
+ has_cap_net_admin = netlink_capable(skb, CAP_NET_ADMIN);
+
+ ret = fill_func(msg, has_cap_net_admin, res, port);
+-
+- rdma_restrack_put(res);
+ if (ret)
+ goto err_free;
+
++ rdma_restrack_put(res);
+ nlmsg_end(msg, nlh);
+ ib_device_put(device);
+ return rdma_nl_unicast(sock_net(skb->sk), msg, NETLINK_CB(skb).portid);
+diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
+index 177333d8bcda..bf8e149d3191 100644
+--- a/drivers/infiniband/core/rdma_core.c
++++ b/drivers/infiniband/core/rdma_core.c
+@@ -459,7 +459,8 @@ alloc_begin_fd_uobject(const struct uverbs_api_object *obj,
+ struct ib_uobject *uobj;
+ struct file *filp;
+
+- if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release))
++ if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release &&
++ fd_type->fops->release != &uverbs_async_event_release))
+ return ERR_PTR(-EINVAL);
+
+ new_fd = get_unused_fd_flags(O_CLOEXEC);
+diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
+index 7df71983212d..3d189c7ee59e 100644
+--- a/drivers/infiniband/core/uverbs.h
++++ b/drivers/infiniband/core/uverbs.h
+@@ -219,6 +219,7 @@ void ib_uverbs_init_event_queue(struct ib_uverbs_event_queue *ev_queue);
+ void ib_uverbs_init_async_event_file(struct ib_uverbs_async_event_file *ev_file);
+ void ib_uverbs_free_event_queue(struct ib_uverbs_event_queue *event_queue);
+ void ib_uverbs_flow_resources_free(struct ib_uflow_resources *uflow_res);
++int uverbs_async_event_release(struct inode *inode, struct file *filp);
+
+ int ib_alloc_ucontext(struct uverbs_attr_bundle *attrs);
+ int ib_init_ucontext(struct uverbs_attr_bundle *attrs);
+@@ -227,6 +228,9 @@ void ib_uverbs_release_ucq(struct ib_uverbs_completion_event_file *ev_file,
+ struct ib_ucq_object *uobj);
+ void ib_uverbs_release_uevent(struct ib_uevent_object *uobj);
+ void ib_uverbs_release_file(struct kref *ref);
++void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file,
++ __u64 element, __u64 event,
++ struct list_head *obj_list, u32 *counter);
+
+ void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context);
+ void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr);
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 17fc25db0311..1bab8de14757 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -346,7 +346,7 @@ const struct file_operations uverbs_async_event_fops = {
+ .owner = THIS_MODULE,
+ .read = ib_uverbs_async_event_read,
+ .poll = ib_uverbs_async_event_poll,
+- .release = uverbs_uobject_fd_release,
++ .release = uverbs_async_event_release,
+ .fasync = ib_uverbs_async_event_fasync,
+ .llseek = no_llseek,
+ };
+@@ -386,10 +386,9 @@ void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context)
+ kill_fasync(&ev_queue->async_queue, SIGIO, POLL_IN);
+ }
+
+-static void
+-ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file,
+- __u64 element, __u64 event, struct list_head *obj_list,
+- u32 *counter)
++void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file,
++ __u64 element, __u64 event,
++ struct list_head *obj_list, u32 *counter)
+ {
+ struct ib_uverbs_event *entry;
+ unsigned long flags;
+@@ -1187,9 +1186,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
+ */
+ mutex_unlock(&uverbs_dev->lists_mutex);
+
+- ib_uverbs_async_handler(READ_ONCE(file->async_file), 0,
+- IB_EVENT_DEVICE_FATAL, NULL, NULL);
+-
+ uverbs_destroy_ufile_hw(file, RDMA_REMOVE_DRIVER_REMOVE);
+ kref_put(&file->ref, ib_uverbs_release_file);
+
+diff --git a/drivers/infiniband/core/uverbs_std_types_async_fd.c b/drivers/infiniband/core/uverbs_std_types_async_fd.c
+index 82ec0806b34b..61899eaf1f91 100644
+--- a/drivers/infiniband/core/uverbs_std_types_async_fd.c
++++ b/drivers/infiniband/core/uverbs_std_types_async_fd.c
+@@ -26,10 +26,38 @@ static int uverbs_async_event_destroy_uobj(struct ib_uobject *uobj,
+ container_of(uobj, struct ib_uverbs_async_event_file, uobj);
+
+ ib_unregister_event_handler(&event_file->event_handler);
+- ib_uverbs_free_event_queue(&event_file->ev_queue);
++
++ if (why == RDMA_REMOVE_DRIVER_REMOVE)
++ ib_uverbs_async_handler(event_file, 0, IB_EVENT_DEVICE_FATAL,
++ NULL, NULL);
+ return 0;
+ }
+
++int uverbs_async_event_release(struct inode *inode, struct file *filp)
++{
++ struct ib_uverbs_async_event_file *event_file;
++ struct ib_uobject *uobj = filp->private_data;
++ int ret;
++
++ if (!uobj)
++ return uverbs_uobject_fd_release(inode, filp);
++
++ event_file =
++ container_of(uobj, struct ib_uverbs_async_event_file, uobj);
++
++ /*
++ * The async event FD has to deliver IB_EVENT_DEVICE_FATAL even after
++ * disassociation, so cleaning the event list must only happen after
++ * release. The user knows it has reached the end of the event stream
++ * when it sees IB_EVENT_DEVICE_FATAL.
++ */
++ uverbs_uobject_get(uobj);
++ ret = uverbs_uobject_fd_release(inode, filp);
++ ib_uverbs_free_event_queue(&event_file->ev_queue);
++ uverbs_uobject_put(uobj);
++ return ret;
++}
++
+ DECLARE_UVERBS_NAMED_METHOD(
+ UVERBS_METHOD_ASYNC_EVENT_ALLOC,
+ UVERBS_ATTR_FD(UVERBS_ATTR_ASYNC_EVENT_ALLOC_FD_HANDLE,
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index d69dece3b1d5..30e08bcc9afb 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2891,8 +2891,7 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
+ srqidx = ABORT_RSS_SRQIDX_G(
+ be32_to_cpu(req->srqidx_status));
+ if (srqidx) {
+- complete_cached_srq_buffers(ep,
+- req->srqidx_status);
++ complete_cached_srq_buffers(ep, srqidx);
+ } else {
+ /* Hold ep ref until finish_peer_abort() */
+ c4iw_get_ep(&ep->com);
+@@ -3878,8 +3877,8 @@ static int read_tcb_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+ return 0;
+ }
+
+- ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W,
+- TCB_RQ_START_S);
++ ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M,
++ TCB_RQ_START_S);
+ cleanup:
+ pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx);
+
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index 13e4203497b3..a92346e88628 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -589,10 +589,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+
+ set_comp_state(pq, cq, info.comp_idx, QUEUED, 0);
+ pq->state = SDMA_PKT_Q_ACTIVE;
+- /* Send the first N packets in the request to buy us some time */
+- ret = user_sdma_send_pkts(req, pcount);
+- if (unlikely(ret < 0 && ret != -EBUSY))
+- goto free_req;
+
+ /*
+ * This is a somewhat blocking send implementation.
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
+index 55a1fbf0e670..ae8b97c30665 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
+@@ -534,7 +534,7 @@ void i40iw_manage_arp_cache(struct i40iw_device *iwdev,
+ int arp_index;
+
+ arp_index = i40iw_arp_table(iwdev, ip_addr, ipv4, mac_addr, action);
+- if (arp_index == -1)
++ if (arp_index < 0)
+ return;
+ cqp_request = i40iw_get_cqp_request(&iwdev->cqp, false);
+ if (!cqp_request)
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 26425dd2d960..a2b1f6af5ba3 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -2891,6 +2891,7 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp,
+ int send_size;
+ int header_size;
+ int spc;
++ int err;
+ int i;
+
+ if (wr->wr.opcode != IB_WR_SEND)
+@@ -2925,7 +2926,9 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp,
+
+ sqp->ud_header.lrh.virtual_lane = 0;
+ sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED);
+- ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey);
++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey);
++ if (err)
++ return err;
+ sqp->ud_header.bth.pkey = cpu_to_be16(pkey);
+ if (sqp->qp.mlx4_ib_qp_type == MLX4_IB_QPT_TUN_SMI_OWNER)
+ sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn);
+@@ -3212,9 +3215,14 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, const struct ib_ud_wr *wr,
+ }
+ sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED);
+ if (!sqp->qp.ibqp.qp_num)
+- ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, &pkey);
++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index,
++ &pkey);
+ else
+- ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, &pkey);
++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index,
++ &pkey);
++ if (err)
++ return err;
++
+ sqp->ud_header.bth.pkey = cpu_to_be16(pkey);
+ sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn);
+ sqp->ud_header.bth.psn = cpu_to_be32((sqp->send_psn++) & ((1 << 24) - 1));
+diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c
+index 48f48122ddcb..6a413d73b95d 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mmap.c
++++ b/drivers/infiniband/sw/rxe/rxe_mmap.c
+@@ -151,7 +151,7 @@ struct rxe_mmap_info *rxe_create_mmap_info(struct rxe_dev *rxe, u32 size,
+
+ ip = kmalloc(sizeof(*ip), GFP_KERNEL);
+ if (!ip)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ size = PAGE_ALIGN(size);
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c
+index ff92704de32f..245040c3a35d 100644
+--- a/drivers/infiniband/sw/rxe/rxe_queue.c
++++ b/drivers/infiniband/sw/rxe/rxe_queue.c
+@@ -45,12 +45,15 @@ int do_mmap_info(struct rxe_dev *rxe, struct mminfo __user *outbuf,
+
+ if (outbuf) {
+ ip = rxe_create_mmap_info(rxe, buf_size, udata, buf);
+- if (!ip)
++ if (IS_ERR(ip)) {
++ err = PTR_ERR(ip);
+ goto err1;
++ }
+
+- err = copy_to_user(outbuf, &ip->info, sizeof(ip->info));
+- if (err)
++ if (copy_to_user(outbuf, &ip->info, sizeof(ip->info))) {
++ err = -EFAULT;
+ goto err2;
++ }
+
+ spin_lock_bh(&rxe->pending_lock);
+ list_add(&ip->pending_mmaps, &rxe->pending_mmaps);
+@@ -64,7 +67,7 @@ int do_mmap_info(struct rxe_dev *rxe, struct mminfo __user *outbuf,
+ err2:
+ kfree(ip);
+ err1:
+- return -EINVAL;
++ return err;
+ }
+
+ inline void rxe_queue_reset(struct rxe_queue *q)
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 20cce366e951..500d0a8c966f 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -101,6 +101,8 @@ struct kmem_cache *amd_iommu_irq_cache;
+ static void update_domain(struct protection_domain *domain);
+ static int protection_domain_init(struct protection_domain *domain);
+ static void detach_device(struct device *dev);
++static void update_and_flush_device_table(struct protection_domain *domain,
++ struct domain_pgtable *pgtable);
+
+ /****************************************************************************
+ *
+@@ -151,6 +153,26 @@ static struct protection_domain *to_pdomain(struct iommu_domain *dom)
+ return container_of(dom, struct protection_domain, domain);
+ }
+
++static void amd_iommu_domain_get_pgtable(struct protection_domain *domain,
++ struct domain_pgtable *pgtable)
++{
++ u64 pt_root = atomic64_read(&domain->pt_root);
++
++ pgtable->root = (u64 *)(pt_root & PAGE_MASK);
++ pgtable->mode = pt_root & 7; /* lowest 3 bits encode pgtable mode */
++}
++
++static u64 amd_iommu_domain_encode_pgtable(u64 *root, int mode)
++{
++ u64 pt_root;
++
++ /* lowest 3 bits encode pgtable mode */
++ pt_root = mode & 7;
++ pt_root |= (u64)root;
++
++ return pt_root;
++}
++
+ static struct iommu_dev_data *alloc_dev_data(u16 devid)
+ {
+ struct iommu_dev_data *dev_data;
+@@ -1397,13 +1419,18 @@ static struct page *free_sub_pt(unsigned long root, int mode,
+
+ static void free_pagetable(struct protection_domain *domain)
+ {
+- unsigned long root = (unsigned long)domain->pt_root;
++ struct domain_pgtable pgtable;
+ struct page *freelist = NULL;
++ unsigned long root;
+
+- BUG_ON(domain->mode < PAGE_MODE_NONE ||
+- domain->mode > PAGE_MODE_6_LEVEL);
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++ atomic64_set(&domain->pt_root, 0);
+
+- freelist = free_sub_pt(root, domain->mode, freelist);
++ BUG_ON(pgtable.mode < PAGE_MODE_NONE ||
++ pgtable.mode > PAGE_MODE_6_LEVEL);
++
++ root = (unsigned long)pgtable.root;
++ freelist = free_sub_pt(root, pgtable.mode, freelist);
+
+ free_page_list(freelist);
+ }
+@@ -1417,24 +1444,36 @@ static bool increase_address_space(struct protection_domain *domain,
+ unsigned long address,
+ gfp_t gfp)
+ {
++ struct domain_pgtable pgtable;
+ unsigned long flags;
+ bool ret = false;
+- u64 *pte;
++ u64 *pte, root;
+
+ spin_lock_irqsave(&domain->lock, flags);
+
+- if (address <= PM_LEVEL_SIZE(domain->mode) ||
+- WARN_ON_ONCE(domain->mode == PAGE_MODE_6_LEVEL))
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++
++ if (address <= PM_LEVEL_SIZE(pgtable.mode) ||
++ WARN_ON_ONCE(pgtable.mode == PAGE_MODE_6_LEVEL))
+ goto out;
+
+ pte = (void *)get_zeroed_page(gfp);
+ if (!pte)
+ goto out;
+
+- *pte = PM_LEVEL_PDE(domain->mode,
+- iommu_virt_to_phys(domain->pt_root));
+- domain->pt_root = pte;
+- domain->mode += 1;
++ *pte = PM_LEVEL_PDE(pgtable.mode, iommu_virt_to_phys(pgtable.root));
++
++ pgtable.root = pte;
++ pgtable.mode += 1;
++ update_and_flush_device_table(domain, &pgtable);
++ domain_flush_complete(domain);
++
++ /*
++ * Device Table needs to be updated and flushed before the new root can
++ * be published.
++ */
++ root = amd_iommu_domain_encode_pgtable(pte, pgtable.mode);
++ atomic64_set(&domain->pt_root, root);
+
+ ret = true;
+
+@@ -1451,16 +1490,22 @@ static u64 *alloc_pte(struct protection_domain *domain,
+ gfp_t gfp,
+ bool *updated)
+ {
++ struct domain_pgtable pgtable;
+ int level, end_lvl;
+ u64 *pte, *page;
+
+ BUG_ON(!is_power_of_2(page_size));
+
+- while (address > PM_LEVEL_SIZE(domain->mode))
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++
++ while (address > PM_LEVEL_SIZE(pgtable.mode)) {
+ *updated = increase_address_space(domain, address, gfp) || *updated;
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++ }
++
+
+- level = domain->mode - 1;
+- pte = &domain->pt_root[PM_LEVEL_INDEX(level, address)];
++ level = pgtable.mode - 1;
++ pte = &pgtable.root[PM_LEVEL_INDEX(level, address)];
+ address = PAGE_SIZE_ALIGN(address, page_size);
+ end_lvl = PAGE_SIZE_LEVEL(page_size);
+
+@@ -1536,16 +1581,19 @@ static u64 *fetch_pte(struct protection_domain *domain,
+ unsigned long address,
+ unsigned long *page_size)
+ {
++ struct domain_pgtable pgtable;
+ int level;
+ u64 *pte;
+
+ *page_size = 0;
+
+- if (address > PM_LEVEL_SIZE(domain->mode))
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++
++ if (address > PM_LEVEL_SIZE(pgtable.mode))
+ return NULL;
+
+- level = domain->mode - 1;
+- pte = &domain->pt_root[PM_LEVEL_INDEX(level, address)];
++ level = pgtable.mode - 1;
++ pte = &pgtable.root[PM_LEVEL_INDEX(level, address)];
+ *page_size = PTE_LEVEL_PAGE_SIZE(level);
+
+ while (level > 0) {
+@@ -1806,6 +1854,7 @@ static void dma_ops_domain_free(struct protection_domain *domain)
+ static struct protection_domain *dma_ops_domain_alloc(void)
+ {
+ struct protection_domain *domain;
++ u64 *pt_root, root;
+
+ domain = kzalloc(sizeof(struct protection_domain), GFP_KERNEL);
+ if (!domain)
+@@ -1814,12 +1863,14 @@ static struct protection_domain *dma_ops_domain_alloc(void)
+ if (protection_domain_init(domain))
+ goto free_domain;
+
+- domain->mode = PAGE_MODE_3_LEVEL;
+- domain->pt_root = (void *)get_zeroed_page(GFP_KERNEL);
+- domain->flags = PD_DMA_OPS_MASK;
+- if (!domain->pt_root)
++ pt_root = (void *)get_zeroed_page(GFP_KERNEL);
++ if (!pt_root)
+ goto free_domain;
+
++ root = amd_iommu_domain_encode_pgtable(pt_root, PAGE_MODE_3_LEVEL);
++ atomic64_set(&domain->pt_root, root);
++ domain->flags = PD_DMA_OPS_MASK;
++
+ if (iommu_get_dma_cookie(&domain->domain) == -ENOMEM)
+ goto free_domain;
+
+@@ -1841,16 +1892,17 @@ static bool dma_ops_domain(struct protection_domain *domain)
+ }
+
+ static void set_dte_entry(u16 devid, struct protection_domain *domain,
++ struct domain_pgtable *pgtable,
+ bool ats, bool ppr)
+ {
+ u64 pte_root = 0;
+ u64 flags = 0;
+ u32 old_domid;
+
+- if (domain->mode != PAGE_MODE_NONE)
+- pte_root = iommu_virt_to_phys(domain->pt_root);
++ if (pgtable->mode != PAGE_MODE_NONE)
++ pte_root = iommu_virt_to_phys(pgtable->root);
+
+- pte_root |= (domain->mode & DEV_ENTRY_MODE_MASK)
++ pte_root |= (pgtable->mode & DEV_ENTRY_MODE_MASK)
+ << DEV_ENTRY_MODE_SHIFT;
+ pte_root |= DTE_FLAG_IR | DTE_FLAG_IW | DTE_FLAG_V | DTE_FLAG_TV;
+
+@@ -1923,6 +1975,7 @@ static void clear_dte_entry(u16 devid)
+ static void do_attach(struct iommu_dev_data *dev_data,
+ struct protection_domain *domain)
+ {
++ struct domain_pgtable pgtable;
+ struct amd_iommu *iommu;
+ bool ats;
+
+@@ -1938,7 +1991,9 @@ static void do_attach(struct iommu_dev_data *dev_data,
+ domain->dev_cnt += 1;
+
+ /* Update device table */
+- set_dte_entry(dev_data->devid, domain, ats, dev_data->iommu_v2);
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++ set_dte_entry(dev_data->devid, domain, &pgtable,
++ ats, dev_data->iommu_v2);
+ clone_aliases(dev_data->pdev);
+
+ device_flush_dte(dev_data);
+@@ -2249,22 +2304,34 @@ static int amd_iommu_domain_get_attr(struct iommu_domain *domain,
+ *
+ *****************************************************************************/
+
+-static void update_device_table(struct protection_domain *domain)
++static void update_device_table(struct protection_domain *domain,
++ struct domain_pgtable *pgtable)
+ {
+ struct iommu_dev_data *dev_data;
+
+ list_for_each_entry(dev_data, &domain->dev_list, list) {
+- set_dte_entry(dev_data->devid, domain, dev_data->ats.enabled,
+- dev_data->iommu_v2);
++ set_dte_entry(dev_data->devid, domain, pgtable,
++ dev_data->ats.enabled, dev_data->iommu_v2);
+ clone_aliases(dev_data->pdev);
+ }
+ }
+
++static void update_and_flush_device_table(struct protection_domain *domain,
++ struct domain_pgtable *pgtable)
++{
++ update_device_table(domain, pgtable);
++ domain_flush_devices(domain);
++}
++
+ static void update_domain(struct protection_domain *domain)
+ {
+- update_device_table(domain);
++ struct domain_pgtable pgtable;
+
+- domain_flush_devices(domain);
++ /* Update device table */
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++ update_and_flush_device_table(domain, &pgtable);
++
++ /* Flush domain TLB(s) and wait for completion */
+ domain_flush_tlb_pde(domain);
+ }
+
+@@ -2375,6 +2442,7 @@ out_err:
+ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type)
+ {
+ struct protection_domain *pdomain;
++ u64 *pt_root, root;
+
+ switch (type) {
+ case IOMMU_DOMAIN_UNMANAGED:
+@@ -2382,13 +2450,15 @@ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type)
+ if (!pdomain)
+ return NULL;
+
+- pdomain->mode = PAGE_MODE_3_LEVEL;
+- pdomain->pt_root = (void *)get_zeroed_page(GFP_KERNEL);
+- if (!pdomain->pt_root) {
++ pt_root = (void *)get_zeroed_page(GFP_KERNEL);
++ if (!pt_root) {
+ protection_domain_free(pdomain);
+ return NULL;
+ }
+
++ root = amd_iommu_domain_encode_pgtable(pt_root, PAGE_MODE_3_LEVEL);
++ atomic64_set(&pdomain->pt_root, root);
++
+ pdomain->domain.geometry.aperture_start = 0;
+ pdomain->domain.geometry.aperture_end = ~0ULL;
+ pdomain->domain.geometry.force_aperture = true;
+@@ -2406,7 +2476,7 @@ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type)
+ if (!pdomain)
+ return NULL;
+
+- pdomain->mode = PAGE_MODE_NONE;
++ atomic64_set(&pdomain->pt_root, PAGE_MODE_NONE);
+ break;
+ default:
+ return NULL;
+@@ -2418,6 +2488,7 @@ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type)
+ static void amd_iommu_domain_free(struct iommu_domain *dom)
+ {
+ struct protection_domain *domain;
++ struct domain_pgtable pgtable;
+
+ domain = to_pdomain(dom);
+
+@@ -2435,7 +2506,9 @@ static void amd_iommu_domain_free(struct iommu_domain *dom)
+ dma_ops_domain_free(domain);
+ break;
+ default:
+- if (domain->mode != PAGE_MODE_NONE)
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++
++ if (pgtable.mode != PAGE_MODE_NONE)
+ free_pagetable(domain);
+
+ if (domain->flags & PD_IOMMUV2_MASK)
+@@ -2518,10 +2591,12 @@ static int amd_iommu_map(struct iommu_domain *dom, unsigned long iova,
+ gfp_t gfp)
+ {
+ struct protection_domain *domain = to_pdomain(dom);
++ struct domain_pgtable pgtable;
+ int prot = 0;
+ int ret;
+
+- if (domain->mode == PAGE_MODE_NONE)
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++ if (pgtable.mode == PAGE_MODE_NONE)
+ return -EINVAL;
+
+ if (iommu_prot & IOMMU_READ)
+@@ -2541,8 +2616,10 @@ static size_t amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova,
+ struct iommu_iotlb_gather *gather)
+ {
+ struct protection_domain *domain = to_pdomain(dom);
++ struct domain_pgtable pgtable;
+
+- if (domain->mode == PAGE_MODE_NONE)
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++ if (pgtable.mode == PAGE_MODE_NONE)
+ return 0;
+
+ return iommu_unmap_page(domain, iova, page_size);
+@@ -2553,9 +2630,11 @@ static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom,
+ {
+ struct protection_domain *domain = to_pdomain(dom);
+ unsigned long offset_mask, pte_pgsize;
++ struct domain_pgtable pgtable;
+ u64 *pte, __pte;
+
+- if (domain->mode == PAGE_MODE_NONE)
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++ if (pgtable.mode == PAGE_MODE_NONE)
+ return iova;
+
+ pte = fetch_pte(domain, iova, &pte_pgsize);
+@@ -2708,16 +2787,26 @@ EXPORT_SYMBOL(amd_iommu_unregister_ppr_notifier);
+ void amd_iommu_domain_direct_map(struct iommu_domain *dom)
+ {
+ struct protection_domain *domain = to_pdomain(dom);
++ struct domain_pgtable pgtable;
+ unsigned long flags;
++ u64 pt_root;
+
+ spin_lock_irqsave(&domain->lock, flags);
+
++ /* First save pgtable configuration*/
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++
+ /* Update data structure */
+- domain->mode = PAGE_MODE_NONE;
++ pt_root = amd_iommu_domain_encode_pgtable(NULL, PAGE_MODE_NONE);
++ atomic64_set(&domain->pt_root, pt_root);
+
+ /* Make changes visible to IOMMUs */
+ update_domain(domain);
+
++ /* Restore old pgtable in domain->ptroot to free page-table */
++ pt_root = amd_iommu_domain_encode_pgtable(pgtable.root, pgtable.mode);
++ atomic64_set(&domain->pt_root, pt_root);
++
+ /* Page-table is not visible to IOMMU anymore, so free it */
+ free_pagetable(domain);
+
+@@ -2908,9 +2997,11 @@ static u64 *__get_gcr3_pte(u64 *root, int level, int pasid, bool alloc)
+ static int __set_gcr3(struct protection_domain *domain, int pasid,
+ unsigned long cr3)
+ {
++ struct domain_pgtable pgtable;
+ u64 *pte;
+
+- if (domain->mode != PAGE_MODE_NONE)
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++ if (pgtable.mode != PAGE_MODE_NONE)
+ return -EINVAL;
+
+ pte = __get_gcr3_pte(domain->gcr3_tbl, domain->glx, pasid, true);
+@@ -2924,9 +3015,11 @@ static int __set_gcr3(struct protection_domain *domain, int pasid,
+
+ static int __clear_gcr3(struct protection_domain *domain, int pasid)
+ {
++ struct domain_pgtable pgtable;
+ u64 *pte;
+
+- if (domain->mode != PAGE_MODE_NONE)
++ amd_iommu_domain_get_pgtable(domain, &pgtable);
++ if (pgtable.mode != PAGE_MODE_NONE)
+ return -EINVAL;
+
+ pte = __get_gcr3_pte(domain->gcr3_tbl, domain->glx, pasid, false);
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index ca8c4522045b..7a8fdec138bd 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -468,8 +468,7 @@ struct protection_domain {
+ iommu core code */
+ spinlock_t lock; /* mostly used to lock the page table*/
+ u16 id; /* the domain id written to the device table */
+- int mode; /* paging mode (0-6 levels) */
+- u64 *pt_root; /* page table root pointer */
++ atomic64_t pt_root; /* pgtable root and pgtable mode */
+ int glx; /* Number of levels for GCR3 table */
+ u64 *gcr3_tbl; /* Guest CR3 table */
+ unsigned long flags; /* flags to find out type of domain */
+@@ -477,6 +476,12 @@ struct protection_domain {
+ unsigned dev_iommu[MAX_IOMMUS]; /* per-IOMMU reference count */
+ };
+
++/* For decocded pt_root */
++struct domain_pgtable {
++ int mode;
++ u64 *root;
++};
++
+ /*
+ * Structure where we save information about one hardware AMD IOMMU in the
+ * system.
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 663d87924e5e..32db16f6debc 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1417,6 +1417,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req)
+ struct mmc_request *mrq = &mqrq->brq.mrq;
+ struct request_queue *q = req->q;
+ struct mmc_host *host = mq->card->host;
++ enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
+ unsigned long flags;
+ bool put_card;
+ int err;
+@@ -1446,7 +1447,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req)
+
+ spin_lock_irqsave(&mq->lock, flags);
+
+- mq->in_flight[mmc_issue_type(mq, req)] -= 1;
++ mq->in_flight[issue_type] -= 1;
+
+ put_card = (mmc_tot_in_flight(mq) == 0);
+
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 9edc08685e86..9c0ccb3744c2 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -107,11 +107,10 @@ static enum blk_eh_timer_return mmc_cqe_timed_out(struct request *req)
+ case MMC_ISSUE_DCMD:
+ if (host->cqe_ops->cqe_timeout(host, mrq, &recovery_needed)) {
+ if (recovery_needed)
+- __mmc_cqe_recovery_notifier(mq);
++ mmc_cqe_recovery_notifier(mrq);
+ return BLK_EH_RESET_TIMER;
+ }
+- /* No timeout (XXX: huh? comment doesn't make much sense) */
+- blk_mq_complete_request(req);
++ /* The request has gone already */
+ return BLK_EH_DONE;
+ default:
+ /* Timeout is handled by mmc core */
+@@ -125,18 +124,13 @@ static enum blk_eh_timer_return mmc_mq_timed_out(struct request *req,
+ struct request_queue *q = req->q;
+ struct mmc_queue *mq = q->queuedata;
+ unsigned long flags;
+- int ret;
++ bool ignore_tout;
+
+ spin_lock_irqsave(&mq->lock, flags);
+-
+- if (mq->recovery_needed || !mq->use_cqe)
+- ret = BLK_EH_RESET_TIMER;
+- else
+- ret = mmc_cqe_timed_out(req);
+-
++ ignore_tout = mq->recovery_needed || !mq->use_cqe;
+ spin_unlock_irqrestore(&mq->lock, flags);
+
+- return ret;
++ return ignore_tout ? BLK_EH_RESET_TIMER : mmc_cqe_timed_out(req);
+ }
+
+ static void mmc_mq_recovery_handler(struct work_struct *work)
+diff --git a/drivers/mmc/host/alcor.c b/drivers/mmc/host/alcor.c
+index 1aee485d56d4..026ca9194ce5 100644
+--- a/drivers/mmc/host/alcor.c
++++ b/drivers/mmc/host/alcor.c
+@@ -1104,7 +1104,7 @@ static int alcor_pci_sdmmc_drv_probe(struct platform_device *pdev)
+
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to get irq for data line\n");
+- return ret;
++ goto free_host;
+ }
+
+ mutex_init(&host->cmd_mutex);
+@@ -1116,6 +1116,10 @@ static int alcor_pci_sdmmc_drv_probe(struct platform_device *pdev)
+ dev_set_drvdata(&pdev->dev, host);
+ mmc_add_host(mmc);
+ return 0;
++
++free_host:
++ mmc_free_host(mmc);
++ return ret;
+ }
+
+ static int alcor_pci_sdmmc_drv_remove(struct platform_device *pdev)
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 2a2173d953f5..7da47196c596 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -605,10 +605,12 @@ static int sdhci_acpi_emmc_amd_probe_slot(struct platform_device *pdev,
+ }
+
+ static const struct sdhci_acpi_slot sdhci_acpi_slot_amd_emmc = {
+- .chip = &sdhci_acpi_chip_amd,
+- .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE,
+- .quirks = SDHCI_QUIRK_32BIT_DMA_ADDR | SDHCI_QUIRK_32BIT_DMA_SIZE |
+- SDHCI_QUIRK_32BIT_ADMA_SIZE,
++ .chip = &sdhci_acpi_chip_amd,
++ .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE,
++ .quirks = SDHCI_QUIRK_32BIT_DMA_ADDR |
++ SDHCI_QUIRK_32BIT_DMA_SIZE |
++ SDHCI_QUIRK_32BIT_ADMA_SIZE,
++ .quirks2 = SDHCI_QUIRK2_BROKEN_64_BIT_DMA,
+ .probe_slot = sdhci_acpi_emmc_amd_probe_slot,
+ };
+
+diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c
+index ce15a05f23d4..fd76aa672e02 100644
+--- a/drivers/mmc/host/sdhci-pci-gli.c
++++ b/drivers/mmc/host/sdhci-pci-gli.c
+@@ -26,6 +26,9 @@
+ #define SDHCI_GLI_9750_DRIVING_2 GENMASK(27, 26)
+ #define GLI_9750_DRIVING_1_VALUE 0xFFF
+ #define GLI_9750_DRIVING_2_VALUE 0x3
++#define SDHCI_GLI_9750_SEL_1 BIT(29)
++#define SDHCI_GLI_9750_SEL_2 BIT(31)
++#define SDHCI_GLI_9750_ALL_RST (BIT(24)|BIT(25)|BIT(28)|BIT(30))
+
+ #define SDHCI_GLI_9750_PLL 0x864
+ #define SDHCI_GLI_9750_PLL_TX2_INV BIT(23)
+@@ -122,6 +125,8 @@ static void gli_set_9750(struct sdhci_host *host)
+ GLI_9750_DRIVING_1_VALUE);
+ driving_value |= FIELD_PREP(SDHCI_GLI_9750_DRIVING_2,
+ GLI_9750_DRIVING_2_VALUE);
++ driving_value &= ~(SDHCI_GLI_9750_SEL_1|SDHCI_GLI_9750_SEL_2|SDHCI_GLI_9750_ALL_RST);
++ driving_value |= SDHCI_GLI_9750_SEL_2;
+ sdhci_writel(host, driving_value, SDHCI_GLI_9750_DRIVING);
+
+ sw_ctrl_value &= ~SDHCI_GLI_9750_SW_CTRL_4;
+@@ -334,6 +339,18 @@ static u32 sdhci_gl9750_readl(struct sdhci_host *host, int reg)
+ return value;
+ }
+
++#ifdef CONFIG_PM_SLEEP
++static int sdhci_pci_gli_resume(struct sdhci_pci_chip *chip)
++{
++ struct sdhci_pci_slot *slot = chip->slots[0];
++
++ pci_free_irq_vectors(slot->chip->pdev);
++ gli_pcie_enable_msi(slot);
++
++ return sdhci_pci_resume_host(chip);
++}
++#endif
++
+ static const struct sdhci_ops sdhci_gl9755_ops = {
+ .set_clock = sdhci_set_clock,
+ .enable_dma = sdhci_pci_enable_dma,
+@@ -348,6 +365,9 @@ const struct sdhci_pci_fixes sdhci_gl9755 = {
+ .quirks2 = SDHCI_QUIRK2_BROKEN_DDR50,
+ .probe_slot = gli_probe_slot_gl9755,
+ .ops = &sdhci_gl9755_ops,
++#ifdef CONFIG_PM_SLEEP
++ .resume = sdhci_pci_gli_resume,
++#endif
+ };
+
+ static const struct sdhci_ops sdhci_gl9750_ops = {
+@@ -366,4 +386,7 @@ const struct sdhci_pci_fixes sdhci_gl9750 = {
+ .quirks2 = SDHCI_QUIRK2_BROKEN_DDR50,
+ .probe_slot = gli_probe_slot_gl9750,
+ .ops = &sdhci_gl9750_ops,
++#ifdef CONFIG_PM_SLEEP
++ .resume = sdhci_pci_gli_resume,
++#endif
+ };
+diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
+index fdcb70b9f0e4..400207c5c7de 100644
+--- a/drivers/net/dsa/dsa_loop.c
++++ b/drivers/net/dsa/dsa_loop.c
+@@ -360,6 +360,7 @@ static void __exit dsa_loop_exit(void)
+ }
+ module_exit(dsa_loop_exit);
+
++MODULE_SOFTDEP("pre: dsa_loop_bdinfo");
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Florian Fainelli");
+ MODULE_DESCRIPTION("DSA loopback driver");
+diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
+index 9e895ab586d5..a7780c06fa65 100644
+--- a/drivers/net/dsa/ocelot/felix.c
++++ b/drivers/net/dsa/ocelot/felix.c
+@@ -397,6 +397,7 @@ static int felix_init_structs(struct felix *felix, int num_phys_ports)
+ ocelot->stats_layout = felix->info->stats_layout;
+ ocelot->num_stats = felix->info->num_stats;
+ ocelot->shared_queue_sz = felix->info->shared_queue_sz;
++ ocelot->num_mact_rows = felix->info->num_mact_rows;
+ ocelot->ops = felix->info->ops;
+
+ port_phy_modes = kcalloc(num_phys_ports, sizeof(phy_interface_t),
+diff --git a/drivers/net/dsa/ocelot/felix.h b/drivers/net/dsa/ocelot/felix.h
+index 3a7580015b62..8771d40324f1 100644
+--- a/drivers/net/dsa/ocelot/felix.h
++++ b/drivers/net/dsa/ocelot/felix.h
+@@ -15,6 +15,7 @@ struct felix_info {
+ const u32 *const *map;
+ const struct ocelot_ops *ops;
+ int shared_queue_sz;
++ int num_mact_rows;
+ const struct ocelot_stat_layout *stats_layout;
+ unsigned int num_stats;
+ int num_ports;
+diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c
+index 2c812b481778..edc1a67c002b 100644
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -1090,6 +1090,7 @@ struct felix_info felix_info_vsc9959 = {
+ .stats_layout = vsc9959_stats_layout,
+ .num_stats = ARRAY_SIZE(vsc9959_stats_layout),
+ .shared_queue_sz = 128 * 1024,
++ .num_mact_rows = 2048,
+ .num_ports = 6,
+ .switch_pci_bar = 4,
+ .imdio_pci_bar = 0,
+diff --git a/drivers/net/ethernet/broadcom/Kconfig b/drivers/net/ethernet/broadcom/Kconfig
+index 53055ce5dfd6..2a69c0d06f3c 100644
+--- a/drivers/net/ethernet/broadcom/Kconfig
++++ b/drivers/net/ethernet/broadcom/Kconfig
+@@ -69,6 +69,7 @@ config BCMGENET
+ select BCM7XXX_PHY
+ select MDIO_BCM_UNIMAC
+ select DIMLIB
++ select BROADCOM_PHY if ARCH_BCM2835
+ help
+ This driver supports the built-in Ethernet MACs found in the
+ Broadcom BCM7xxx Set Top Box family chipset.
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+index 7ff147e89426..d9bbaa734d98 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -86,7 +86,7 @@ static void free_rx_fd(struct dpaa2_eth_priv *priv,
+ for (i = 1; i < DPAA2_ETH_MAX_SG_ENTRIES; i++) {
+ addr = dpaa2_sg_get_addr(&sgt[i]);
+ sg_vaddr = dpaa2_iova_to_virt(priv->iommu_domain, addr);
+- dma_unmap_page(dev, addr, DPAA2_ETH_RX_BUF_SIZE,
++ dma_unmap_page(dev, addr, priv->rx_buf_size,
+ DMA_BIDIRECTIONAL);
+
+ free_pages((unsigned long)sg_vaddr, 0);
+@@ -144,7 +144,7 @@ static struct sk_buff *build_frag_skb(struct dpaa2_eth_priv *priv,
+ /* Get the address and length from the S/G entry */
+ sg_addr = dpaa2_sg_get_addr(sge);
+ sg_vaddr = dpaa2_iova_to_virt(priv->iommu_domain, sg_addr);
+- dma_unmap_page(dev, sg_addr, DPAA2_ETH_RX_BUF_SIZE,
++ dma_unmap_page(dev, sg_addr, priv->rx_buf_size,
+ DMA_BIDIRECTIONAL);
+
+ sg_length = dpaa2_sg_get_len(sge);
+@@ -185,7 +185,7 @@ static struct sk_buff *build_frag_skb(struct dpaa2_eth_priv *priv,
+ (page_address(page) - page_address(head_page));
+
+ skb_add_rx_frag(skb, i - 1, head_page, page_offset,
+- sg_length, DPAA2_ETH_RX_BUF_SIZE);
++ sg_length, priv->rx_buf_size);
+ }
+
+ if (dpaa2_sg_is_final(sge))
+@@ -211,7 +211,7 @@ static void free_bufs(struct dpaa2_eth_priv *priv, u64 *buf_array, int count)
+
+ for (i = 0; i < count; i++) {
+ vaddr = dpaa2_iova_to_virt(priv->iommu_domain, buf_array[i]);
+- dma_unmap_page(dev, buf_array[i], DPAA2_ETH_RX_BUF_SIZE,
++ dma_unmap_page(dev, buf_array[i], priv->rx_buf_size,
+ DMA_BIDIRECTIONAL);
+ free_pages((unsigned long)vaddr, 0);
+ }
+@@ -335,7 +335,7 @@ static u32 run_xdp(struct dpaa2_eth_priv *priv,
+ break;
+ case XDP_REDIRECT:
+ dma_unmap_page(priv->net_dev->dev.parent, addr,
+- DPAA2_ETH_RX_BUF_SIZE, DMA_BIDIRECTIONAL);
++ priv->rx_buf_size, DMA_BIDIRECTIONAL);
+ ch->buf_count--;
+ xdp.data_hard_start = vaddr;
+ err = xdp_do_redirect(priv->net_dev, &xdp, xdp_prog);
+@@ -374,7 +374,7 @@ static void dpaa2_eth_rx(struct dpaa2_eth_priv *priv,
+ trace_dpaa2_rx_fd(priv->net_dev, fd);
+
+ vaddr = dpaa2_iova_to_virt(priv->iommu_domain, addr);
+- dma_sync_single_for_cpu(dev, addr, DPAA2_ETH_RX_BUF_SIZE,
++ dma_sync_single_for_cpu(dev, addr, priv->rx_buf_size,
+ DMA_BIDIRECTIONAL);
+
+ fas = dpaa2_get_fas(vaddr, false);
+@@ -393,13 +393,13 @@ static void dpaa2_eth_rx(struct dpaa2_eth_priv *priv,
+ return;
+ }
+
+- dma_unmap_page(dev, addr, DPAA2_ETH_RX_BUF_SIZE,
++ dma_unmap_page(dev, addr, priv->rx_buf_size,
+ DMA_BIDIRECTIONAL);
+ skb = build_linear_skb(ch, fd, vaddr);
+ } else if (fd_format == dpaa2_fd_sg) {
+ WARN_ON(priv->xdp_prog);
+
+- dma_unmap_page(dev, addr, DPAA2_ETH_RX_BUF_SIZE,
++ dma_unmap_page(dev, addr, priv->rx_buf_size,
+ DMA_BIDIRECTIONAL);
+ skb = build_frag_skb(priv, ch, buf_data);
+ free_pages((unsigned long)vaddr, 0);
+@@ -974,7 +974,7 @@ static int add_bufs(struct dpaa2_eth_priv *priv,
+ if (!page)
+ goto err_alloc;
+
+- addr = dma_map_page(dev, page, 0, DPAA2_ETH_RX_BUF_SIZE,
++ addr = dma_map_page(dev, page, 0, priv->rx_buf_size,
+ DMA_BIDIRECTIONAL);
+ if (unlikely(dma_mapping_error(dev, addr)))
+ goto err_map;
+@@ -984,7 +984,7 @@ static int add_bufs(struct dpaa2_eth_priv *priv,
+ /* tracing point */
+ trace_dpaa2_eth_buf_seed(priv->net_dev,
+ page, DPAA2_ETH_RX_BUF_RAW_SIZE,
+- addr, DPAA2_ETH_RX_BUF_SIZE,
++ addr, priv->rx_buf_size,
+ bpid);
+ }
+
+@@ -1715,7 +1715,7 @@ static bool xdp_mtu_valid(struct dpaa2_eth_priv *priv, int mtu)
+ int mfl, linear_mfl;
+
+ mfl = DPAA2_ETH_L2_MAX_FRM(mtu);
+- linear_mfl = DPAA2_ETH_RX_BUF_SIZE - DPAA2_ETH_RX_HWA_SIZE -
++ linear_mfl = priv->rx_buf_size - DPAA2_ETH_RX_HWA_SIZE -
+ dpaa2_eth_rx_head_room(priv) - XDP_PACKET_HEADROOM;
+
+ if (mfl > linear_mfl) {
+@@ -2457,6 +2457,11 @@ static int set_buffer_layout(struct dpaa2_eth_priv *priv)
+ else
+ rx_buf_align = DPAA2_ETH_RX_BUF_ALIGN;
+
++ /* We need to ensure that the buffer size seen by WRIOP is a multiple
++ * of 64 or 256 bytes depending on the WRIOP version.
++ */
++ priv->rx_buf_size = ALIGN_DOWN(DPAA2_ETH_RX_BUF_SIZE, rx_buf_align);
++
+ /* tx buffer */
+ buf_layout.private_data_size = DPAA2_ETH_SWA_SIZE;
+ buf_layout.pass_timestamp = true;
+@@ -3121,7 +3126,7 @@ static int bind_dpni(struct dpaa2_eth_priv *priv)
+ pools_params.num_dpbp = 1;
+ pools_params.pools[0].dpbp_id = priv->dpbp_dev->obj_desc.id;
+ pools_params.pools[0].backup_pool = 0;
+- pools_params.pools[0].buffer_size = DPAA2_ETH_RX_BUF_SIZE;
++ pools_params.pools[0].buffer_size = priv->rx_buf_size;
+ err = dpni_set_pools(priv->mc_io, 0, priv->mc_token, &pools_params);
+ if (err) {
+ dev_err(dev, "dpni_set_pools() failed\n");
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
+index 7635db3ef903..13242bf5b427 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
+@@ -382,6 +382,7 @@ struct dpaa2_eth_priv {
+ u16 tx_data_offset;
+
+ struct fsl_mc_device *dpbp_dev;
++ u16 rx_buf_size;
+ u16 bpid;
+ struct iommu_domain *iommu_domain;
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
+index 96676abcebd5..c53f091af2cf 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
+@@ -625,7 +625,7 @@ static int num_rules(struct dpaa2_eth_priv *priv)
+
+ static int update_cls_rule(struct net_device *net_dev,
+ struct ethtool_rx_flow_spec *new_fs,
+- int location)
++ unsigned int location)
+ {
+ struct dpaa2_eth_priv *priv = netdev_priv(net_dev);
+ struct dpaa2_eth_cls_rule *rule;
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
+index 8995e32dd1c0..992908e6eebf 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
+@@ -45,6 +45,8 @@
+
+ #define MGMT_MSG_TIMEOUT 5000
+
++#define SET_FUNC_PORT_MGMT_TIMEOUT 25000
++
+ #define mgmt_to_pfhwdev(pf_mgmt) \
+ container_of(pf_mgmt, struct hinic_pfhwdev, pf_to_mgmt)
+
+@@ -238,12 +240,13 @@ static int msg_to_mgmt_sync(struct hinic_pf_to_mgmt *pf_to_mgmt,
+ u8 *buf_in, u16 in_size,
+ u8 *buf_out, u16 *out_size,
+ enum mgmt_direction_type direction,
+- u16 resp_msg_id)
++ u16 resp_msg_id, u32 timeout)
+ {
+ struct hinic_hwif *hwif = pf_to_mgmt->hwif;
+ struct pci_dev *pdev = hwif->pdev;
+ struct hinic_recv_msg *recv_msg;
+ struct completion *recv_done;
++ unsigned long timeo;
+ u16 msg_id;
+ int err;
+
+@@ -267,8 +270,9 @@ static int msg_to_mgmt_sync(struct hinic_pf_to_mgmt *pf_to_mgmt,
+ goto unlock_sync_msg;
+ }
+
+- if (!wait_for_completion_timeout(recv_done,
+- msecs_to_jiffies(MGMT_MSG_TIMEOUT))) {
++ timeo = msecs_to_jiffies(timeout ? timeout : MGMT_MSG_TIMEOUT);
++
++ if (!wait_for_completion_timeout(recv_done, timeo)) {
+ dev_err(&pdev->dev, "MGMT timeout, MSG id = %d\n", msg_id);
+ err = -ETIMEDOUT;
+ goto unlock_sync_msg;
+@@ -342,6 +346,7 @@ int hinic_msg_to_mgmt(struct hinic_pf_to_mgmt *pf_to_mgmt,
+ {
+ struct hinic_hwif *hwif = pf_to_mgmt->hwif;
+ struct pci_dev *pdev = hwif->pdev;
++ u32 timeout = 0;
+
+ if (sync != HINIC_MGMT_MSG_SYNC) {
+ dev_err(&pdev->dev, "Invalid MGMT msg type\n");
+@@ -353,9 +358,12 @@ int hinic_msg_to_mgmt(struct hinic_pf_to_mgmt *pf_to_mgmt,
+ return -EINVAL;
+ }
+
++ if (cmd == HINIC_PORT_CMD_SET_FUNC_STATE)
++ timeout = SET_FUNC_PORT_MGMT_TIMEOUT;
++
+ return msg_to_mgmt_sync(pf_to_mgmt, mod, cmd, buf_in, in_size,
+ buf_out, out_size, MGMT_DIRECT_SEND,
+- MSG_NOT_RESP);
++ MSG_NOT_RESP, timeout);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+index 13560975c103..63b92f6cc856 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+@@ -483,7 +483,6 @@ static int hinic_close(struct net_device *netdev)
+ {
+ struct hinic_dev *nic_dev = netdev_priv(netdev);
+ unsigned int flags;
+- int err;
+
+ down(&nic_dev->mgmt_lock);
+
+@@ -497,20 +496,9 @@ static int hinic_close(struct net_device *netdev)
+
+ up(&nic_dev->mgmt_lock);
+
+- err = hinic_port_set_func_state(nic_dev, HINIC_FUNC_PORT_DISABLE);
+- if (err) {
+- netif_err(nic_dev, drv, netdev,
+- "Failed to set func port state\n");
+- nic_dev->flags |= (flags & HINIC_INTF_UP);
+- return err;
+- }
++ hinic_port_set_state(nic_dev, HINIC_PORT_DISABLE);
+
+- err = hinic_port_set_state(nic_dev, HINIC_PORT_DISABLE);
+- if (err) {
+- netif_err(nic_dev, drv, netdev, "Failed to set port state\n");
+- nic_dev->flags |= (flags & HINIC_INTF_UP);
+- return err;
+- }
++ hinic_port_set_func_state(nic_dev, HINIC_FUNC_PORT_DISABLE);
+
+ if (nic_dev->flags & HINIC_RSS_ENABLE) {
+ hinic_rss_deinit(nic_dev);
+diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
+index e1651756bf9d..f70bb81e1ed6 100644
+--- a/drivers/net/ethernet/moxa/moxart_ether.c
++++ b/drivers/net/ethernet/moxa/moxart_ether.c
+@@ -564,7 +564,7 @@ static int moxart_remove(struct platform_device *pdev)
+ struct net_device *ndev = platform_get_drvdata(pdev);
+
+ unregister_netdev(ndev);
+- free_irq(ndev->irq, ndev);
++ devm_free_irq(&pdev->dev, ndev->irq, ndev);
+ moxart_mac_free_memory(ndev);
+ free_netdev(ndev);
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index b14286dc49fb..419e2ce2eac0 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1016,10 +1016,8 @@ int ocelot_fdb_dump(struct ocelot *ocelot, int port,
+ {
+ int i, j;
+
+- /* Loop through all the mac tables entries. There are 1024 rows of 4
+- * entries.
+- */
+- for (i = 0; i < 1024; i++) {
++ /* Loop through all the mac tables entries. */
++ for (i = 0; i < ocelot->num_mact_rows; i++) {
+ for (j = 0; j < 4; j++) {
+ struct ocelot_mact_entry entry;
+ bool is_static;
+@@ -1446,8 +1444,15 @@ static void ocelot_port_attr_stp_state_set(struct ocelot *ocelot, int port,
+
+ void ocelot_set_ageing_time(struct ocelot *ocelot, unsigned int msecs)
+ {
+- ocelot_write(ocelot, ANA_AUTOAGE_AGE_PERIOD(msecs / 2),
+- ANA_AUTOAGE);
++ unsigned int age_period = ANA_AUTOAGE_AGE_PERIOD(msecs / 2000);
++
++ /* Setting AGE_PERIOD to zero effectively disables automatic aging,
++ * which is clearly not what our intention is. So avoid that.
++ */
++ if (!age_period)
++ age_period = 1;
++
++ ocelot_rmw(ocelot, age_period, ANA_AUTOAGE_AGE_PERIOD_M, ANA_AUTOAGE);
+ }
+ EXPORT_SYMBOL(ocelot_set_ageing_time);
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_regs.c b/drivers/net/ethernet/mscc/ocelot_regs.c
+index b88b5899b227..7d4fd1b6adda 100644
+--- a/drivers/net/ethernet/mscc/ocelot_regs.c
++++ b/drivers/net/ethernet/mscc/ocelot_regs.c
+@@ -431,6 +431,7 @@ int ocelot_chip_init(struct ocelot *ocelot, const struct ocelot_ops *ops)
+ ocelot->stats_layout = ocelot_stats_layout;
+ ocelot->num_stats = ARRAY_SIZE(ocelot_stats_layout);
+ ocelot->shared_queue_sz = 224 * 1024;
++ ocelot->num_mact_rows = 1024;
+ ocelot->ops = ops;
+
+ ret = ocelot_regfields_init(ocelot, ocelot_regfields);
+diff --git a/drivers/net/ethernet/natsemi/jazzsonic.c b/drivers/net/ethernet/natsemi/jazzsonic.c
+index 51fa82b429a3..40970352d208 100644
+--- a/drivers/net/ethernet/natsemi/jazzsonic.c
++++ b/drivers/net/ethernet/natsemi/jazzsonic.c
+@@ -235,11 +235,13 @@ static int jazz_sonic_probe(struct platform_device *pdev)
+
+ err = register_netdev(dev);
+ if (err)
+- goto out1;
++ goto undo_probe1;
+
+ return 0;
+
+-out1:
++undo_probe1:
++ dma_free_coherent(lp->device, SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
++ lp->descriptors, lp->descriptors_laddr);
+ release_mem_region(dev->base_addr, SONIC_MEM_SIZE);
+ out:
+ free_netdev(dev);
+diff --git a/drivers/net/ethernet/netronome/nfp/abm/main.c b/drivers/net/ethernet/netronome/nfp/abm/main.c
+index 354efffac0f9..bdbf0726145e 100644
+--- a/drivers/net/ethernet/netronome/nfp/abm/main.c
++++ b/drivers/net/ethernet/netronome/nfp/abm/main.c
+@@ -333,8 +333,10 @@ nfp_abm_vnic_alloc(struct nfp_app *app, struct nfp_net *nn, unsigned int id)
+ goto err_free_alink;
+
+ alink->prio_map = kzalloc(abm->prio_map_len, GFP_KERNEL);
+- if (!alink->prio_map)
++ if (!alink->prio_map) {
++ err = -ENOMEM;
+ goto err_free_alink;
++ }
+
+ /* This is a multi-host app, make sure MAC/PHY is up, but don't
+ * make the MAC/PHY state follow the state of any of the ports.
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 6b633e9d76da..07a6b609f741 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2127,6 +2127,8 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp)
+ { 0x7cf, 0x348, RTL_GIGA_MAC_VER_07 },
+ { 0x7cf, 0x248, RTL_GIGA_MAC_VER_07 },
+ { 0x7cf, 0x340, RTL_GIGA_MAC_VER_13 },
++ /* RTL8401, reportedly works if treated as RTL8101e */
++ { 0x7cf, 0x240, RTL_GIGA_MAC_VER_13 },
+ { 0x7cf, 0x343, RTL_GIGA_MAC_VER_10 },
+ { 0x7cf, 0x342, RTL_GIGA_MAC_VER_16 },
+ { 0x7c8, 0x348, RTL_GIGA_MAC_VER_09 },
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+index e0a5fe83d8e0..bfc4a92f1d92 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+@@ -75,6 +75,11 @@ struct ethqos_emac_por {
+ unsigned int value;
+ };
+
++struct ethqos_emac_driver_data {
++ const struct ethqos_emac_por *por;
++ unsigned int num_por;
++};
++
+ struct qcom_ethqos {
+ struct platform_device *pdev;
+ void __iomem *rgmii_base;
+@@ -171,6 +176,11 @@ static const struct ethqos_emac_por emac_v2_3_0_por[] = {
+ { .offset = RGMII_IO_MACRO_CONFIG2, .value = 0x00002060 },
+ };
+
++static const struct ethqos_emac_driver_data emac_v2_3_0_data = {
++ .por = emac_v2_3_0_por,
++ .num_por = ARRAY_SIZE(emac_v2_3_0_por),
++};
++
+ static int ethqos_dll_configure(struct qcom_ethqos *ethqos)
+ {
+ unsigned int val;
+@@ -442,6 +452,7 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
+ struct device_node *np = pdev->dev.of_node;
+ struct plat_stmmacenet_data *plat_dat;
+ struct stmmac_resources stmmac_res;
++ const struct ethqos_emac_driver_data *data;
+ struct qcom_ethqos *ethqos;
+ struct resource *res;
+ int ret;
+@@ -471,7 +482,9 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
+ goto err_mem;
+ }
+
+- ethqos->por = of_device_get_match_data(&pdev->dev);
++ data = of_device_get_match_data(&pdev->dev);
++ ethqos->por = data->por;
++ ethqos->num_por = data->num_por;
+
+ ethqos->rgmii_clk = devm_clk_get(&pdev->dev, "rgmii");
+ if (IS_ERR(ethqos->rgmii_clk)) {
+@@ -526,7 +539,7 @@ static int qcom_ethqos_remove(struct platform_device *pdev)
+ }
+
+ static const struct of_device_id qcom_ethqos_match[] = {
+- { .compatible = "qcom,qcs404-ethqos", .data = &emac_v2_3_0_por},
++ { .compatible = "qcom,qcs404-ethqos", .data = &emac_v2_3_0_data},
+ { }
+ };
+ MODULE_DEVICE_TABLE(of, qcom_ethqos_match);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+index 494c859b4ade..67ba67ed0cb9 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+@@ -624,7 +624,7 @@ int dwmac5_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg,
+ total_offset += offset;
+ }
+
+- total_ctr = cfg->ctr[0] + cfg->ctr[1] * 1000000000;
++ total_ctr = cfg->ctr[0] + cfg->ctr[1] * 1000000000ULL;
+ total_ctr += total_offset;
+
+ ctr_low = do_div(total_ctr, 1000000000);
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 2c0a24c606fc..28a5d46ad526 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -710,7 +710,8 @@ no_memory:
+ goto drop;
+ }
+
+-static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t netvsc_start_xmit(struct sk_buff *skb,
++ struct net_device *ndev)
+ {
+ return netvsc_xmit(skb, ndev, false);
+ }
+diff --git a/drivers/net/phy/microchip_t1.c b/drivers/net/phy/microchip_t1.c
+index 001def4509c2..fed3e395f18e 100644
+--- a/drivers/net/phy/microchip_t1.c
++++ b/drivers/net/phy/microchip_t1.c
+@@ -3,9 +3,21 @@
+
+ #include <linux/kernel.h>
+ #include <linux/module.h>
++#include <linux/delay.h>
+ #include <linux/mii.h>
+ #include <linux/phy.h>
+
++/* External Register Control Register */
++#define LAN87XX_EXT_REG_CTL (0x14)
++#define LAN87XX_EXT_REG_CTL_RD_CTL (0x1000)
++#define LAN87XX_EXT_REG_CTL_WR_CTL (0x0800)
++
++/* External Register Read Data Register */
++#define LAN87XX_EXT_REG_RD_DATA (0x15)
++
++/* External Register Write Data Register */
++#define LAN87XX_EXT_REG_WR_DATA (0x16)
++
+ /* Interrupt Source Register */
+ #define LAN87XX_INTERRUPT_SOURCE (0x18)
+
+@@ -14,9 +26,160 @@
+ #define LAN87XX_MASK_LINK_UP (0x0004)
+ #define LAN87XX_MASK_LINK_DOWN (0x0002)
+
++/* phyaccess nested types */
++#define PHYACC_ATTR_MODE_READ 0
++#define PHYACC_ATTR_MODE_WRITE 1
++#define PHYACC_ATTR_MODE_MODIFY 2
++
++#define PHYACC_ATTR_BANK_SMI 0
++#define PHYACC_ATTR_BANK_MISC 1
++#define PHYACC_ATTR_BANK_PCS 2
++#define PHYACC_ATTR_BANK_AFE 3
++#define PHYACC_ATTR_BANK_MAX 7
++
+ #define DRIVER_AUTHOR "Nisar Sayed <nisar.sayed@microchip.com>"
+ #define DRIVER_DESC "Microchip LAN87XX T1 PHY driver"
+
++struct access_ereg_val {
++ u8 mode;
++ u8 bank;
++ u8 offset;
++ u16 val;
++ u16 mask;
++};
++
++static int access_ereg(struct phy_device *phydev, u8 mode, u8 bank,
++ u8 offset, u16 val)
++{
++ u16 ereg = 0;
++ int rc = 0;
++
++ if (mode > PHYACC_ATTR_MODE_WRITE || bank > PHYACC_ATTR_BANK_MAX)
++ return -EINVAL;
++
++ if (bank == PHYACC_ATTR_BANK_SMI) {
++ if (mode == PHYACC_ATTR_MODE_WRITE)
++ rc = phy_write(phydev, offset, val);
++ else
++ rc = phy_read(phydev, offset);
++ return rc;
++ }
++
++ if (mode == PHYACC_ATTR_MODE_WRITE) {
++ ereg = LAN87XX_EXT_REG_CTL_WR_CTL;
++ rc = phy_write(phydev, LAN87XX_EXT_REG_WR_DATA, val);
++ if (rc < 0)
++ return rc;
++ } else {
++ ereg = LAN87XX_EXT_REG_CTL_RD_CTL;
++ }
++
++ ereg |= (bank << 8) | offset;
++
++ rc = phy_write(phydev, LAN87XX_EXT_REG_CTL, ereg);
++ if (rc < 0)
++ return rc;
++
++ if (mode == PHYACC_ATTR_MODE_READ)
++ rc = phy_read(phydev, LAN87XX_EXT_REG_RD_DATA);
++
++ return rc;
++}
++
++static int access_ereg_modify_changed(struct phy_device *phydev,
++ u8 bank, u8 offset, u16 val, u16 mask)
++{
++ int new = 0, rc = 0;
++
++ if (bank > PHYACC_ATTR_BANK_MAX)
++ return -EINVAL;
++
++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_READ, bank, offset, val);
++ if (rc < 0)
++ return rc;
++
++ new = val | (rc & (mask ^ 0xFFFF));
++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_WRITE, bank, offset, new);
++
++ return rc;
++}
++
++static int lan87xx_phy_init(struct phy_device *phydev)
++{
++ static const struct access_ereg_val init[] = {
++ /* TX Amplitude = 5 */
++ {PHYACC_ATTR_MODE_MODIFY, PHYACC_ATTR_BANK_AFE, 0x0B,
++ 0x000A, 0x001E},
++ /* Clear SMI interrupts */
++ {PHYACC_ATTR_MODE_READ, PHYACC_ATTR_BANK_SMI, 0x18,
++ 0, 0},
++ /* Clear MISC interrupts */
++ {PHYACC_ATTR_MODE_READ, PHYACC_ATTR_BANK_MISC, 0x08,
++ 0, 0},
++ /* Turn on TC10 Ring Oscillator (ROSC) */
++ {PHYACC_ATTR_MODE_MODIFY, PHYACC_ATTR_BANK_MISC, 0x20,
++ 0x0020, 0x0020},
++ /* WUR Detect Length to 1.2uS, LPC Detect Length to 1.09uS */
++ {PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_PCS, 0x20,
++ 0x283C, 0},
++ /* Wake_In Debounce Length to 39uS, Wake_Out Length to 79uS */
++ {PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_MISC, 0x21,
++ 0x274F, 0},
++ /* Enable Auto Wake Forward to Wake_Out, ROSC on, Sleep,
++ * and Wake_In to wake PHY
++ */
++ {PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_MISC, 0x20,
++ 0x80A7, 0},
++ /* Enable WUP Auto Fwd, Enable Wake on MDI, Wakeup Debouncer
++ * to 128 uS
++ */
++ {PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_MISC, 0x24,
++ 0xF110, 0},
++ /* Enable HW Init */
++ {PHYACC_ATTR_MODE_MODIFY, PHYACC_ATTR_BANK_SMI, 0x1A,
++ 0x0100, 0x0100},
++ };
++ int rc, i;
++
++ /* Start manual initialization procedures in Managed Mode */
++ rc = access_ereg_modify_changed(phydev, PHYACC_ATTR_BANK_SMI,
++ 0x1a, 0x0000, 0x0100);
++ if (rc < 0)
++ return rc;
++
++ /* Soft Reset the SMI block */
++ rc = access_ereg_modify_changed(phydev, PHYACC_ATTR_BANK_SMI,
++ 0x00, 0x8000, 0x8000);
++ if (rc < 0)
++ return rc;
++
++ /* Check to see if the self-clearing bit is cleared */
++ usleep_range(1000, 2000);
++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_READ,
++ PHYACC_ATTR_BANK_SMI, 0x00, 0);
++ if (rc < 0)
++ return rc;
++ if ((rc & 0x8000) != 0)
++ return -ETIMEDOUT;
++
++ /* PHY Initialization */
++ for (i = 0; i < ARRAY_SIZE(init); i++) {
++ if (init[i].mode == PHYACC_ATTR_MODE_MODIFY) {
++ rc = access_ereg_modify_changed(phydev, init[i].bank,
++ init[i].offset,
++ init[i].val,
++ init[i].mask);
++ } else {
++ rc = access_ereg(phydev, init[i].mode, init[i].bank,
++ init[i].offset, init[i].val);
++ }
++ if (rc < 0)
++ return rc;
++ }
++
++ return 0;
++}
++
+ static int lan87xx_phy_config_intr(struct phy_device *phydev)
+ {
+ int rc, val = 0;
+@@ -40,6 +203,13 @@ static int lan87xx_phy_ack_interrupt(struct phy_device *phydev)
+ return rc < 0 ? rc : 0;
+ }
+
++static int lan87xx_config_init(struct phy_device *phydev)
++{
++ int rc = lan87xx_phy_init(phydev);
++
++ return rc < 0 ? rc : 0;
++}
++
+ static struct phy_driver microchip_t1_phy_driver[] = {
+ {
+ .phy_id = 0x0007c150,
+@@ -48,6 +218,7 @@ static struct phy_driver microchip_t1_phy_driver[] = {
+
+ .features = PHY_BASIC_T1_FEATURES,
+
++ .config_init = lan87xx_config_init,
+ .config_aneg = genphy_config_aneg,
+
+ .ack_interrupt = lan87xx_phy_ack_interrupt,
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index 355bfdef48d2..594d97d3c8ab 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -1132,9 +1132,11 @@ int phy_ethtool_set_eee(struct phy_device *phydev, struct ethtool_eee *data)
+ /* Restart autonegotiation so the new modes get sent to the
+ * link partner.
+ */
+- ret = phy_restart_aneg(phydev);
+- if (ret < 0)
+- return ret;
++ if (phydev->autoneg == AUTONEG_ENABLE) {
++ ret = phy_restart_aneg(phydev);
++ if (ret < 0)
++ return ret;
++ }
+ }
+
+ return 0;
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index d760a36db28c..beedaad08255 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -490,6 +490,9 @@ static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev,
+ if (!skb)
+ goto out;
+
++ if (skb->pkt_type != PACKET_HOST)
++ goto abort;
++
+ if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
+ goto abort;
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 2fe7a3188282..f7129bc898cc 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1231,9 +1231,11 @@ static bool try_fill_recv(struct virtnet_info *vi, struct receive_queue *rq,
+ break;
+ } while (rq->vq->num_free);
+ if (virtqueue_kick_prepare(rq->vq) && virtqueue_notify(rq->vq)) {
+- u64_stats_update_begin(&rq->stats.syncp);
++ unsigned long flags;
++
++ flags = u64_stats_update_begin_irqsave(&rq->stats.syncp);
+ rq->stats.kicks++;
+- u64_stats_update_end(&rq->stats.syncp);
++ u64_stats_update_end_irqrestore(&rq->stats.syncp, flags);
+ }
+
+ return !oom;
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index b409642f168d..9b821c9cbd16 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -1286,6 +1286,7 @@ static const struct gpio_chip byt_gpio_chip = {
+ .direction_output = byt_gpio_direction_output,
+ .get = byt_gpio_get,
+ .set = byt_gpio_set,
++ .set_config = gpiochip_generic_config,
+ .dbg_show = byt_gpio_dbg_show,
+ };
+
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 4c74fdde576d..1093a6105d40 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1479,11 +1479,15 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)
+ struct chv_pinctrl *pctrl = gpiochip_get_data(gc);
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+ unsigned long pending;
++ unsigned long flags;
+ u32 intr_line;
+
+ chained_irq_enter(chip, desc);
+
++ raw_spin_lock_irqsave(&chv_lock, flags);
+ pending = readl(pctrl->regs + CHV_INTSTAT);
++ raw_spin_unlock_irqrestore(&chv_lock, flags);
++
+ for_each_set_bit(intr_line, &pending, pctrl->community->nirqs) {
+ unsigned int irq, offset;
+
+diff --git a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
+index 330c8f077b73..4d7a86a5a37b 100644
+--- a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
++++ b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
+@@ -15,17 +15,18 @@
+
+ #include "pinctrl-intel.h"
+
+-#define SPT_PAD_OWN 0x020
+-#define SPT_PADCFGLOCK 0x0a0
+-#define SPT_HOSTSW_OWN 0x0d0
+-#define SPT_GPI_IS 0x100
+-#define SPT_GPI_IE 0x120
++#define SPT_PAD_OWN 0x020
++#define SPT_H_PADCFGLOCK 0x090
++#define SPT_LP_PADCFGLOCK 0x0a0
++#define SPT_HOSTSW_OWN 0x0d0
++#define SPT_GPI_IS 0x100
++#define SPT_GPI_IE 0x120
+
+ #define SPT_COMMUNITY(b, s, e) \
+ { \
+ .barno = (b), \
+ .padown_offset = SPT_PAD_OWN, \
+- .padcfglock_offset = SPT_PADCFGLOCK, \
++ .padcfglock_offset = SPT_LP_PADCFGLOCK, \
+ .hostown_offset = SPT_HOSTSW_OWN, \
+ .is_offset = SPT_GPI_IS, \
+ .ie_offset = SPT_GPI_IE, \
+@@ -47,7 +48,7 @@
+ { \
+ .barno = (b), \
+ .padown_offset = SPT_PAD_OWN, \
+- .padcfglock_offset = SPT_PADCFGLOCK, \
++ .padcfglock_offset = SPT_H_PADCFGLOCK, \
+ .hostown_offset = SPT_HOSTSW_OWN, \
+ .is_offset = SPT_GPI_IS, \
+ .ie_offset = SPT_GPI_IE, \
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index 1a948c3f54b7..9f1c9951949e 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -692,7 +692,7 @@ static void msm_gpio_update_dual_edge_pos(struct msm_pinctrl *pctrl,
+
+ pol = msm_readl_intr_cfg(pctrl, g);
+ pol ^= BIT(g->intr_polarity_bit);
+- msm_writel_intr_cfg(val, pctrl, g);
++ msm_writel_intr_cfg(pol, pctrl, g);
+
+ val2 = msm_readl_io(pctrl, g) & BIT(g->in_bit);
+ intstat = msm_readl_intr_status(pctrl, g);
+diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
+index 4fc2056bd227..e615dc240150 100644
+--- a/drivers/s390/net/ism_drv.c
++++ b/drivers/s390/net/ism_drv.c
+@@ -521,8 +521,10 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ ism->smcd = smcd_alloc_dev(&pdev->dev, dev_name(&pdev->dev), &ism_ops,
+ ISM_NR_DMBS);
+- if (!ism->smcd)
++ if (!ism->smcd) {
++ ret = -ENOMEM;
+ goto err_resource;
++ }
+
+ ism->smcd->priv = ism;
+ ret = ism_dev_init(ism);
+diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
+index 3574dbb09366..a5cccbd5d356 100644
+--- a/drivers/usb/cdns3/gadget.c
++++ b/drivers/usb/cdns3/gadget.c
+@@ -2548,7 +2548,7 @@ found:
+ link_trb = priv_req->trb;
+
+ /* Update ring only if removed request is on pending_req_list list */
+- if (req_on_hw_ring) {
++ if (req_on_hw_ring && link_trb) {
+ link_trb->buffer = TRB_BUFFER(priv_ep->trb_pool_dma +
+ ((priv_req->end_trb + 1) * TRB_SIZE));
+ link_trb->control = (link_trb->control & TRB_CYCLE) |
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 6833c918abce..d93d94d7ff50 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -217,6 +217,7 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+ struct usb_memory *usbm = NULL;
+ struct usb_dev_state *ps = file->private_data;
++ struct usb_hcd *hcd = bus_to_hcd(ps->dev->bus);
+ size_t size = vma->vm_end - vma->vm_start;
+ void *mem;
+ unsigned long flags;
+@@ -250,11 +251,19 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
+ usbm->vma_use_count = 1;
+ INIT_LIST_HEAD(&usbm->memlist);
+
+- if (remap_pfn_range(vma, vma->vm_start,
+- virt_to_phys(usbm->mem) >> PAGE_SHIFT,
+- size, vma->vm_page_prot) < 0) {
+- dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
+- return -EAGAIN;
++ if (hcd->localmem_pool || !hcd_uses_dma(hcd)) {
++ if (remap_pfn_range(vma, vma->vm_start,
++ virt_to_phys(usbm->mem) >> PAGE_SHIFT,
++ size, vma->vm_page_prot) < 0) {
++ dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
++ return -EAGAIN;
++ }
++ } else {
++ if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle,
++ size)) {
++ dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
++ return -EAGAIN;
++ }
+ }
+
+ vma->vm_flags |= VM_IO;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 2b6565c06c23..fc748c731832 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -39,6 +39,7 @@
+
+ #define USB_VENDOR_GENESYS_LOGIC 0x05e3
+ #define USB_VENDOR_SMSC 0x0424
++#define USB_PRODUCT_USB5534B 0x5534
+ #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01
+ #define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02
+
+@@ -5621,8 +5622,11 @@ out_hdev_lock:
+ }
+
+ static const struct usb_device_id hub_id_table[] = {
+- { .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_CLASS,
++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++ | USB_DEVICE_ID_MATCH_PRODUCT
++ | USB_DEVICE_ID_MATCH_INT_CLASS,
+ .idVendor = USB_VENDOR_SMSC,
++ .idProduct = USB_PRODUCT_USB5534B,
+ .bInterfaceClass = USB_CLASS_HUB,
+ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
+ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index bc1cf6d0412a..7e9643d25b14 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2483,9 +2483,6 @@ static int dwc3_gadget_ep_reclaim_trb_sg(struct dwc3_ep *dep,
+ for_each_sg(sg, s, pending, i) {
+ trb = &dep->trb_pool[dep->trb_dequeue];
+
+- if (trb->ctrl & DWC3_TRB_CTRL_HWO)
+- break;
+-
+ req->sg = sg_next(s);
+ req->num_pending_sgs--;
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 32b637e3e1fa..6a9aa4413d64 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -260,6 +260,9 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item,
+ char *name;
+ int ret;
+
++ if (strlen(page) < len)
++ return -EOVERFLOW;
++
+ name = kstrdup(page, GFP_KERNEL);
+ if (!name)
+ return -ENOMEM;
+diff --git a/drivers/usb/gadget/legacy/audio.c b/drivers/usb/gadget/legacy/audio.c
+index dd81fd538cb8..a748ed0842e8 100644
+--- a/drivers/usb/gadget/legacy/audio.c
++++ b/drivers/usb/gadget/legacy/audio.c
+@@ -300,8 +300,10 @@ static int audio_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(cdev->gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail;
++ }
+ usb_otg_descriptor_init(cdev->gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+diff --git a/drivers/usb/gadget/legacy/cdc2.c b/drivers/usb/gadget/legacy/cdc2.c
+index 8d7a556ece30..563363aba48f 100644
+--- a/drivers/usb/gadget/legacy/cdc2.c
++++ b/drivers/usb/gadget/legacy/cdc2.c
+@@ -179,8 +179,10 @@ static int cdc_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail1;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+diff --git a/drivers/usb/gadget/legacy/ncm.c b/drivers/usb/gadget/legacy/ncm.c
+index c61e71ba7045..0f1b45e3abd1 100644
+--- a/drivers/usb/gadget/legacy/ncm.c
++++ b/drivers/usb/gadget/legacy/ncm.c
+@@ -156,8 +156,10 @@ static int gncm_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
+index a8273b589456..5af0fe9c61d7 100644
+--- a/drivers/usb/gadget/udc/net2272.c
++++ b/drivers/usb/gadget/udc/net2272.c
+@@ -2647,6 +2647,8 @@ net2272_plat_probe(struct platform_device *pdev)
+ err_req:
+ release_mem_region(base, len);
+ err:
++ kfree(dev);
++
+ return ret;
+ }
+
+diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c
+index 634c2c19a176..a22d190d00a0 100644
+--- a/drivers/usb/gadget/udc/tegra-xudc.c
++++ b/drivers/usb/gadget/udc/tegra-xudc.c
+@@ -3740,11 +3740,11 @@ static int __maybe_unused tegra_xudc_suspend(struct device *dev)
+
+ flush_work(&xudc->usb_role_sw_work);
+
+- /* Forcibly disconnect before powergating. */
+- tegra_xudc_device_mode_off(xudc);
+-
+- if (!pm_runtime_status_suspended(dev))
++ if (!pm_runtime_status_suspended(dev)) {
++ /* Forcibly disconnect before powergating. */
++ tegra_xudc_device_mode_off(xudc);
+ tegra_xudc_powergate(xudc);
++ }
+
+ pm_runtime_disable(dev);
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 315b4552693c..52c625c02341 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -363,6 +363,7 @@ static int xhci_plat_remove(struct platform_device *dev)
+ struct clk *reg_clk = xhci->reg_clk;
+ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
++ pm_runtime_get_sync(&dev->dev);
+ xhci->xhc_state |= XHCI_STATE_REMOVING;
+
+ usb_remove_hcd(shared_hcd);
+@@ -376,8 +377,9 @@ static int xhci_plat_remove(struct platform_device *dev)
+ clk_disable_unprepare(reg_clk);
+ usb_put_hcd(hcd);
+
+- pm_runtime_set_suspended(&dev->dev);
+ pm_runtime_disable(&dev->dev);
++ pm_runtime_put_noidle(&dev->dev);
++ pm_runtime_set_suspended(&dev->dev);
+
+ return 0;
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 2fbc00c0a6e8..49f3f3ce7737 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3425,8 +3425,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ /* New sg entry */
+ --num_sgs;
+ sent_len -= block_len;
+- if (num_sgs != 0) {
+- sg = sg_next(sg);
++ sg = sg_next(sg);
++ if (num_sgs != 0 && sg) {
+ block_len = sg_dma_len(sg);
+ addr = (u64) sg_dma_address(sg);
+ addr += sent_len;
+diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
+index 1dc97f2d6201..d3d78176b23c 100644
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -398,7 +398,7 @@ int cachefiles_read_or_alloc_page(struct fscache_retrieval *op,
+ struct inode *inode;
+ sector_t block;
+ unsigned shift;
+- int ret;
++ int ret, ret2;
+
+ object = container_of(op->op.object,
+ struct cachefiles_object, fscache);
+@@ -430,8 +430,8 @@ int cachefiles_read_or_alloc_page(struct fscache_retrieval *op,
+ block = page->index;
+ block <<= shift;
+
+- ret = bmap(inode, &block);
+- ASSERT(ret < 0);
++ ret2 = bmap(inode, &block);
++ ASSERT(ret2 == 0);
+
+ _debug("%llx -> %llx",
+ (unsigned long long) (page->index << shift),
+@@ -739,8 +739,8 @@ int cachefiles_read_or_alloc_pages(struct fscache_retrieval *op,
+ block = page->index;
+ block <<= shift;
+
+- ret = bmap(inode, &block);
+- ASSERT(!ret);
++ ret2 = bmap(inode, &block);
++ ASSERT(ret2 == 0);
+
+ _debug("%llx -> %llx",
+ (unsigned long long) (page->index << shift),
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 6f6fb3606a5d..a4545aa04efc 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -2138,8 +2138,8 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+ }
+ }
+
++ kref_put(&wdata2->refcount, cifs_writedata_release);
+ if (rc) {
+- kref_put(&wdata2->refcount, cifs_writedata_release);
+ if (is_retryable_error(rc))
+ continue;
+ i += nr_pages;
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index b0a097274cfe..f5a481089893 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1857,34 +1857,33 @@ fetch_events:
+ * event delivery.
+ */
+ init_wait(&wait);
+- write_lock_irq(&ep->lock);
+- __add_wait_queue_exclusive(&ep->wq, &wait);
+- write_unlock_irq(&ep->lock);
+
++ write_lock_irq(&ep->lock);
+ /*
+- * We don't want to sleep if the ep_poll_callback() sends us
+- * a wakeup in between. That's why we set the task state
+- * to TASK_INTERRUPTIBLE before doing the checks.
++ * Barrierless variant, waitqueue_active() is called under
++ * the same lock on wakeup ep_poll_callback() side, so it
++ * is safe to avoid an explicit barrier.
+ */
+- set_current_state(TASK_INTERRUPTIBLE);
++ __set_current_state(TASK_INTERRUPTIBLE);
++
+ /*
+- * Always short-circuit for fatal signals to allow
+- * threads to make a timely exit without the chance of
+- * finding more events available and fetching
+- * repeatedly.
++ * Do the final check under the lock. ep_scan_ready_list()
++ * plays with two lists (->rdllist and ->ovflist) and there
++ * is always a race when both lists are empty for short
++ * period of time although events are pending, so lock is
++ * important.
+ */
+- if (fatal_signal_pending(current)) {
+- res = -EINTR;
+- break;
++ eavail = ep_events_available(ep);
++ if (!eavail) {
++ if (signal_pending(current))
++ res = -EINTR;
++ else
++ __add_wait_queue_exclusive(&ep->wq, &wait);
+ }
++ write_unlock_irq(&ep->lock);
+
+- eavail = ep_events_available(ep);
+- if (eavail)
+- break;
+- if (signal_pending(current)) {
+- res = -EINTR;
++ if (eavail || res)
+ break;
+- }
+
+ if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) {
+ timed_out = 1;
+@@ -1905,6 +1904,15 @@ fetch_events:
+ }
+
+ send_events:
++ if (fatal_signal_pending(current)) {
++ /*
++ * Always short-circuit for fatal signals to allow
++ * threads to make a timely exit without the chance of
++ * finding more events available and fetching
++ * repeatedly.
++ */
++ res = -EINTR;
++ }
+ /*
+ * Try to transfer events to user space. In case we get 0 events and
+ * there's still timeout left over, we go trying again in search of
+diff --git a/fs/exec.c b/fs/exec.c
+index a58625f27652..77603ceed51f 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1277,6 +1277,8 @@ int flush_old_exec(struct linux_binprm * bprm)
+ */
+ set_mm_exe_file(bprm->mm, bprm->file);
+
++ would_dump(bprm, bprm->file);
++
+ /*
+ * Release all of the old mmap stuff
+ */
+@@ -1820,8 +1822,6 @@ static int __do_execve_file(int fd, struct filename *filename,
+ if (retval < 0)
+ goto out;
+
+- would_dump(bprm, bprm->file);
+-
+ retval = exec_binprm(bprm);
+ if (retval < 0)
+ goto out;
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 08f6fbb3655e..31ed26435625 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -528,10 +528,12 @@ lower_metapath:
+
+ /* Advance in metadata tree. */
+ (mp->mp_list[hgt])++;
+- if (mp->mp_list[hgt] >= sdp->sd_inptrs) {
+- if (!hgt)
++ if (hgt) {
++ if (mp->mp_list[hgt] >= sdp->sd_inptrs)
++ goto lower_metapath;
++ } else {
++ if (mp->mp_list[hgt] >= sdp->sd_diptrs)
+ break;
+- goto lower_metapath;
+ }
+
+ fill_up_metapath:
+@@ -876,10 +878,9 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length,
+ ret = -ENOENT;
+ goto unlock;
+ } else {
+- /* report a hole */
+ iomap->offset = pos;
+ iomap->length = length;
+- goto do_alloc;
++ goto hole_found;
+ }
+ }
+ iomap->length = size;
+@@ -933,8 +934,6 @@ unlock:
+ return ret;
+
+ do_alloc:
+- iomap->addr = IOMAP_NULL_ADDR;
+- iomap->type = IOMAP_HOLE;
+ if (flags & IOMAP_REPORT) {
+ if (pos >= size)
+ ret = -ENOENT;
+@@ -956,6 +955,9 @@ do_alloc:
+ if (pos < size && height == ip->i_height)
+ ret = gfs2_hole_size(inode, lblock, len, mp, iomap);
+ }
++hole_found:
++ iomap->addr = IOMAP_NULL_ADDR;
++ iomap->type = IOMAP_HOLE;
+ goto out;
+ }
+
+diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
+index c090d5ad3f22..3a020bdc358c 100644
+--- a/fs/gfs2/lops.c
++++ b/fs/gfs2/lops.c
+@@ -259,7 +259,7 @@ static struct bio *gfs2_log_alloc_bio(struct gfs2_sbd *sdp, u64 blkno,
+ struct super_block *sb = sdp->sd_vfs;
+ struct bio *bio = bio_alloc(GFP_NOIO, BIO_MAX_PAGES);
+
+- bio->bi_iter.bi_sector = blkno << (sb->s_blocksize_bits - 9);
++ bio->bi_iter.bi_sector = blkno << sdp->sd_fsb2bb_shift;
+ bio_set_dev(bio, sb->s_bdev);
+ bio->bi_end_io = end_io;
+ bio->bi_private = sdp;
+@@ -505,7 +505,7 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head,
+ unsigned int bsize = sdp->sd_sb.sb_bsize, off;
+ unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift;
+ unsigned int shift = PAGE_SHIFT - bsize_shift;
+- unsigned int readahead_blocks = BIO_MAX_PAGES << shift;
++ unsigned int max_bio_size = 2 * 1024 * 1024;
+ struct gfs2_journal_extent *je;
+ int sz, ret = 0;
+ struct bio *bio = NULL;
+@@ -533,12 +533,17 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head,
+ off = 0;
+ }
+
+- if (!bio || (bio_chained && !off)) {
++ if (!bio || (bio_chained && !off) ||
++ bio->bi_iter.bi_size >= max_bio_size) {
+ /* start new bio */
+ } else {
+- sz = bio_add_page(bio, page, bsize, off);
+- if (sz == bsize)
+- goto block_added;
++ sector_t sector = dblock << sdp->sd_fsb2bb_shift;
++
++ if (bio_end_sector(bio) == sector) {
++ sz = bio_add_page(bio, page, bsize, off);
++ if (sz == bsize)
++ goto block_added;
++ }
+ if (off) {
+ unsigned int blocks =
+ (PAGE_SIZE - off) >> bsize_shift;
+@@ -564,7 +569,7 @@ block_added:
+ off += bsize;
+ if (off == PAGE_SIZE)
+ page = NULL;
+- if (blocks_submitted < blocks_read + readahead_blocks) {
++ if (blocks_submitted < 2 * max_bio_size >> bsize_shift) {
+ /* Keep at least one bio in flight */
+ continue;
+ }
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 9690c845a3e4..832e042531bc 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -4258,7 +4258,7 @@ static int io_req_defer(struct io_kiocb *req, const struct io_uring_sqe *sqe)
+ int ret;
+
+ /* Still need defer if there is pending req in defer list. */
+- if (!req_need_defer(req) && list_empty(&ctx->defer_list))
++ if (!req_need_defer(req) && list_empty_careful(&ctx->defer_list))
+ return 0;
+
+ if (!req->io && io_alloc_async_ctx(req))
+@@ -6451,7 +6451,7 @@ static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
+ * it could cause shutdown to hang.
+ */
+ while (ctx->sqo_thread && !wq_has_sleeper(&ctx->sqo_wait))
+- cpu_relax();
++ cond_resched();
+
+ io_kill_timeouts(ctx);
+ io_poll_remove_all(ctx);
+diff --git a/fs/ioctl.c b/fs/ioctl.c
+index 282d45be6f45..5e80b40bc1b5 100644
+--- a/fs/ioctl.c
++++ b/fs/ioctl.c
+@@ -55,6 +55,7 @@ EXPORT_SYMBOL(vfs_ioctl);
+ static int ioctl_fibmap(struct file *filp, int __user *p)
+ {
+ struct inode *inode = file_inode(filp);
++ struct super_block *sb = inode->i_sb;
+ int error, ur_block;
+ sector_t block;
+
+@@ -71,6 +72,13 @@ static int ioctl_fibmap(struct file *filp, int __user *p)
+ block = ur_block;
+ error = bmap(inode, &block);
+
++ if (block > INT_MAX) {
++ error = -ERANGE;
++ pr_warn_ratelimited("[%s/%d] FS: %s File: %pD4 would truncate fibmap result\n",
++ current->comm, task_pid_nr(current),
++ sb->s_id, filp);
++ }
++
+ if (error)
+ ur_block = 0;
+ else
+diff --git a/fs/iomap/fiemap.c b/fs/iomap/fiemap.c
+index bccf305ea9ce..d55e8f491a5e 100644
+--- a/fs/iomap/fiemap.c
++++ b/fs/iomap/fiemap.c
+@@ -117,10 +117,7 @@ iomap_bmap_actor(struct inode *inode, loff_t pos, loff_t length,
+
+ if (iomap->type == IOMAP_MAPPED) {
+ addr = (pos - iomap->offset + iomap->addr) >> inode->i_blkbits;
+- if (addr > INT_MAX)
+- WARN(1, "would truncate bmap result\n");
+- else
+- *bno = addr;
++ *bno = addr;
+ }
+ return 0;
+ }
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index 1abf126c2df4..a60df88efc40 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -118,8 +118,6 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int
+
+ nfss->fscache_key = NULL;
+ nfss->fscache = NULL;
+- if (!(nfss->options & NFS_OPTION_FSCACHE))
+- return;
+ if (!uniq) {
+ uniq = "";
+ ulen = 1;
+@@ -188,7 +186,8 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int
+ /* create a cache index for looking up filehandles */
+ nfss->fscache = fscache_acquire_cookie(nfss->nfs_client->fscache,
+ &nfs_fscache_super_index_def,
+- key, sizeof(*key) + ulen,
++ &key->key,
++ sizeof(key->key) + ulen,
+ NULL, 0,
+ nfss, 0, true);
+ dfprintk(FSCACHE, "NFS: get superblock cookie (0x%p/0x%p)\n",
+@@ -226,6 +225,19 @@ void nfs_fscache_release_super_cookie(struct super_block *sb)
+ }
+ }
+
++static void nfs_fscache_update_auxdata(struct nfs_fscache_inode_auxdata *auxdata,
++ struct nfs_inode *nfsi)
++{
++ memset(auxdata, 0, sizeof(*auxdata));
++ auxdata->mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec;
++ auxdata->mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
++ auxdata->ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec;
++ auxdata->ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
++
++ if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4)
++ auxdata->change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode);
++}
++
+ /*
+ * Initialise the per-inode cache cookie pointer for an NFS inode.
+ */
+@@ -239,14 +251,7 @@ void nfs_fscache_init_inode(struct inode *inode)
+ if (!(nfss->fscache && S_ISREG(inode->i_mode)))
+ return;
+
+- memset(&auxdata, 0, sizeof(auxdata));
+- auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec;
+- auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
+- auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec;
+- auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
+-
+- if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4)
+- auxdata.change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode);
++ nfs_fscache_update_auxdata(&auxdata, nfsi);
+
+ nfsi->fscache = fscache_acquire_cookie(NFS_SB(inode->i_sb)->fscache,
+ &nfs_fscache_inode_object_def,
+@@ -266,11 +271,7 @@ void nfs_fscache_clear_inode(struct inode *inode)
+
+ dfprintk(FSCACHE, "NFS: clear cookie (0x%p/0x%p)\n", nfsi, cookie);
+
+- memset(&auxdata, 0, sizeof(auxdata));
+- auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec;
+- auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
+- auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec;
+- auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
++ nfs_fscache_update_auxdata(&auxdata, nfsi);
+ fscache_relinquish_cookie(cookie, &auxdata, false);
+ nfsi->fscache = NULL;
+ }
+@@ -310,11 +311,7 @@ void nfs_fscache_open_file(struct inode *inode, struct file *filp)
+ if (!fscache_cookie_valid(cookie))
+ return;
+
+- memset(&auxdata, 0, sizeof(auxdata));
+- auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec;
+- auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
+- auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec;
+- auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
++ nfs_fscache_update_auxdata(&auxdata, nfsi);
+
+ if (inode_is_open_for_write(inode)) {
+ dfprintk(FSCACHE, "NFS: nfsi 0x%p disabling cache\n", nfsi);
+diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
+index 35c8cb2d7637..dda5c3e65d8d 100644
+--- a/fs/nfs/mount_clnt.c
++++ b/fs/nfs/mount_clnt.c
+@@ -30,6 +30,7 @@
+ #define encode_dirpath_sz (1 + XDR_QUADLEN(MNTPATHLEN))
+ #define MNT_status_sz (1)
+ #define MNT_fhandle_sz XDR_QUADLEN(NFS2_FHSIZE)
++#define MNT_fhandlev3_sz XDR_QUADLEN(NFS3_FHSIZE)
+ #define MNT_authflav3_sz (1 + NFS_MAX_SECFLAVORS)
+
+ /*
+@@ -37,7 +38,7 @@
+ */
+ #define MNT_enc_dirpath_sz encode_dirpath_sz
+ #define MNT_dec_mountres_sz (MNT_status_sz + MNT_fhandle_sz)
+-#define MNT_dec_mountres3_sz (MNT_status_sz + MNT_fhandle_sz + \
++#define MNT_dec_mountres3_sz (MNT_status_sz + MNT_fhandlev3_sz + \
+ MNT_authflav3_sz)
+
+ /*
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index f7723d221945..459c7fb5d103 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -734,9 +734,9 @@ nfs4_get_open_state(struct inode *inode, struct nfs4_state_owner *owner)
+ state = new;
+ state->owner = owner;
+ atomic_inc(&owner->so_count);
+- list_add_rcu(&state->inode_states, &nfsi->open_states);
+ ihold(inode);
+ state->inode = inode;
++ list_add_rcu(&state->inode_states, &nfsi->open_states);
+ spin_unlock(&inode->i_lock);
+ /* Note: The reclaim code dictates that we add stateless
+ * and read-only stateids to the end of the list */
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index dada09b391c6..c0d5240b8a0a 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1154,7 +1154,6 @@ static void nfs_get_cache_cookie(struct super_block *sb,
+ uniq = ctx->fscache_uniq;
+ ulen = strlen(ctx->fscache_uniq);
+ }
+- return;
+ }
+
+ nfs_fscache_get_super_cookie(sb, uniq, ulen);
+diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
+index f5d30573f4a9..deb13f0a0f7d 100644
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -171,6 +171,13 @@ static u32 fanotify_group_event_mask(struct fsnotify_group *group,
+ if (!fsnotify_iter_should_report_type(iter_info, type))
+ continue;
+ mark = iter_info->marks[type];
++ /*
++ * If the event is on dir and this mark doesn't care about
++ * events on dir, don't send it!
++ */
++ if (event_mask & FS_ISDIR && !(mark->mask & FS_ISDIR))
++ continue;
++
+ /*
+ * If the event is for a child and this mark doesn't care about
+ * events on a child, don't send it!
+@@ -203,10 +210,6 @@ static u32 fanotify_group_event_mask(struct fsnotify_group *group,
+ user_mask &= ~FAN_ONDIR;
+ }
+
+- if (event_mask & FS_ISDIR &&
+- !(marks_mask & FS_ISDIR & ~marks_ignored_mask))
+- return 0;
+-
+ return test_mask & user_mask;
+ }
+
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 034b0a644efc..448c91bf543b 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const int *off)
+ /* &a[0] degrades to a pointer: a different type from an array */
+ #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+
++/*
++ * This is needed in functions which generate the stack canary, see
++ * arch/x86/kernel/smpboot.c::start_secondary() for an example.
++ */
++#define prevent_tail_call_optimization() mb()
++
+ #endif /* __LINUX_COMPILER_H */
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index abedbffe2c9e..872ee2131589 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -978,7 +978,7 @@ struct file_handle {
+ __u32 handle_bytes;
+ int handle_type;
+ /* file identifier */
+- unsigned char f_handle[0];
++ unsigned char f_handle[];
+ };
+
+ static inline struct file *get_file(struct file *f)
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index db95244a62d4..ab4bd15cbcdb 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -210,6 +210,29 @@ struct ftrace_ops {
+ #endif
+ };
+
++extern struct ftrace_ops __rcu *ftrace_ops_list;
++extern struct ftrace_ops ftrace_list_end;
++
++/*
++ * Traverse the ftrace_global_list, invoking all entries. The reason that we
++ * can use rcu_dereference_raw_check() is that elements removed from this list
++ * are simply leaked, so there is no need to interact with a grace-period
++ * mechanism. The rcu_dereference_raw_check() calls are needed to handle
++ * concurrent insertions into the ftrace_global_list.
++ *
++ * Silly Alpha and silly pointer-speculation compiler optimizations!
++ */
++#define do_for_each_ftrace_op(op, list) \
++ op = rcu_dereference_raw_check(list); \
++ do
++
++/*
++ * Optimized for just a single item in the list (as that is the normal case).
++ */
++#define while_for_each_ftrace_op(op) \
++ while (likely(op = rcu_dereference_raw_check((op)->next)) && \
++ unlikely((op) != &ftrace_list_end))
++
+ /*
+ * Type of the current tracing.
+ */
+diff --git a/include/linux/host1x.h b/include/linux/host1x.h
+index 62d216ff1097..c230b4e70d75 100644
+--- a/include/linux/host1x.h
++++ b/include/linux/host1x.h
+@@ -17,9 +17,12 @@ enum host1x_class {
+ HOST1X_CLASS_GR3D = 0x60,
+ };
+
++struct host1x;
+ struct host1x_client;
+ struct iommu_group;
+
++u64 host1x_get_dma_mask(struct host1x *host1x);
++
+ /**
+ * struct host1x_client_ops - host1x client operations
+ * @init: host1x client initialization code
+diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
+index e9ba01336d4e..bc5a3621a9d7 100644
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -783,6 +783,8 @@ static inline void memcg_memory_event(struct mem_cgroup *memcg,
+ atomic_long_inc(&memcg->memory_events[event]);
+ cgroup_file_notify(&memcg->events_file);
+
++ if (!cgroup_subsys_on_dfl(memory_cgrp_subsys))
++ break;
+ if (cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_LOCAL_EVENTS)
+ break;
+ } while ((memcg = parent_mem_cgroup(memcg)) &&
+diff --git a/include/linux/pnp.h b/include/linux/pnp.h
+index 3b12fd28af78..fc4df3ccefc9 100644
+--- a/include/linux/pnp.h
++++ b/include/linux/pnp.h
+@@ -220,10 +220,8 @@ struct pnp_card {
+ #define global_to_pnp_card(n) list_entry(n, struct pnp_card, global_list)
+ #define protocol_to_pnp_card(n) list_entry(n, struct pnp_card, protocol_list)
+ #define to_pnp_card(n) container_of(n, struct pnp_card, dev)
+-#define pnp_for_each_card(card) \
+- for((card) = global_to_pnp_card(pnp_cards.next); \
+- (card) != global_to_pnp_card(&pnp_cards); \
+- (card) = global_to_pnp_card((card)->global_list.next))
++#define pnp_for_each_card(card) \
++ list_for_each_entry(card, &pnp_cards, global_list)
+
+ struct pnp_card_link {
+ struct pnp_card *card;
+@@ -276,14 +274,9 @@ struct pnp_dev {
+ #define card_to_pnp_dev(n) list_entry(n, struct pnp_dev, card_list)
+ #define protocol_to_pnp_dev(n) list_entry(n, struct pnp_dev, protocol_list)
+ #define to_pnp_dev(n) container_of(n, struct pnp_dev, dev)
+-#define pnp_for_each_dev(dev) \
+- for((dev) = global_to_pnp_dev(pnp_global.next); \
+- (dev) != global_to_pnp_dev(&pnp_global); \
+- (dev) = global_to_pnp_dev((dev)->global_list.next))
+-#define card_for_each_dev(card,dev) \
+- for((dev) = card_to_pnp_dev((card)->devices.next); \
+- (dev) != card_to_pnp_dev(&(card)->devices); \
+- (dev) = card_to_pnp_dev((dev)->card_list.next))
++#define pnp_for_each_dev(dev) list_for_each_entry(dev, &pnp_global, global_list)
++#define card_for_each_dev(card, dev) \
++ list_for_each_entry(dev, &(card)->devices, card_list)
+ #define pnp_dev_name(dev) (dev)->name
+
+ static inline void *pnp_get_drvdata(struct pnp_dev *pdev)
+@@ -437,14 +430,10 @@ struct pnp_protocol {
+ };
+
+ #define to_pnp_protocol(n) list_entry(n, struct pnp_protocol, protocol_list)
+-#define protocol_for_each_card(protocol,card) \
+- for((card) = protocol_to_pnp_card((protocol)->cards.next); \
+- (card) != protocol_to_pnp_card(&(protocol)->cards); \
+- (card) = protocol_to_pnp_card((card)->protocol_list.next))
+-#define protocol_for_each_dev(protocol,dev) \
+- for((dev) = protocol_to_pnp_dev((protocol)->devices.next); \
+- (dev) != protocol_to_pnp_dev(&(protocol)->devices); \
+- (dev) = protocol_to_pnp_dev((dev)->protocol_list.next))
++#define protocol_for_each_card(protocol, card) \
++ list_for_each_entry(card, &(protocol)->cards, protocol_list)
++#define protocol_for_each_dev(protocol, dev) \
++ list_for_each_entry(dev, &(protocol)->devices, protocol_list)
+
+ extern struct bus_type pnp_bus_type;
+
+diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
+index 14d61bba0b79..71db17927a9d 100644
+--- a/include/linux/skmsg.h
++++ b/include/linux/skmsg.h
+@@ -187,6 +187,7 @@ static inline void sk_msg_xfer(struct sk_msg *dst, struct sk_msg *src,
+ dst->sg.data[which] = src->sg.data[which];
+ dst->sg.data[which].length = size;
+ dst->sg.size += size;
++ src->sg.size -= size;
+ src->sg.data[which].length -= size;
+ src->sg.data[which].offset += size;
+ }
+diff --git a/include/linux/sunrpc/gss_api.h b/include/linux/sunrpc/gss_api.h
+index 48c1b1674cbf..bc07e51f20d1 100644
+--- a/include/linux/sunrpc/gss_api.h
++++ b/include/linux/sunrpc/gss_api.h
+@@ -21,6 +21,7 @@
+ struct gss_ctx {
+ struct gss_api_mech *mech_type;
+ void *internal_ctx_id;
++ unsigned int slack, align;
+ };
+
+ #define GSS_C_NO_BUFFER ((struct xdr_netobj) 0)
+@@ -66,6 +67,7 @@ u32 gss_wrap(
+ u32 gss_unwrap(
+ struct gss_ctx *ctx_id,
+ int offset,
++ int len,
+ struct xdr_buf *inbuf);
+ u32 gss_delete_sec_context(
+ struct gss_ctx **ctx_id);
+@@ -126,6 +128,7 @@ struct gss_api_ops {
+ u32 (*gss_unwrap)(
+ struct gss_ctx *ctx_id,
+ int offset,
++ int len,
+ struct xdr_buf *buf);
+ void (*gss_delete_sec_context)(
+ void *internal_ctx_id);
+diff --git a/include/linux/sunrpc/gss_krb5.h b/include/linux/sunrpc/gss_krb5.h
+index c1d77dd8ed41..e8f8ffe7448b 100644
+--- a/include/linux/sunrpc/gss_krb5.h
++++ b/include/linux/sunrpc/gss_krb5.h
+@@ -83,7 +83,7 @@ struct gss_krb5_enctype {
+ u32 (*encrypt_v2) (struct krb5_ctx *kctx, u32 offset,
+ struct xdr_buf *buf,
+ struct page **pages); /* v2 encryption function */
+- u32 (*decrypt_v2) (struct krb5_ctx *kctx, u32 offset,
++ u32 (*decrypt_v2) (struct krb5_ctx *kctx, u32 offset, u32 len,
+ struct xdr_buf *buf, u32 *headskip,
+ u32 *tailskip); /* v2 decryption function */
+ };
+@@ -255,7 +255,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx_id, int offset,
+ struct xdr_buf *outbuf, struct page **pages);
+
+ u32
+-gss_unwrap_kerberos(struct gss_ctx *ctx_id, int offset,
++gss_unwrap_kerberos(struct gss_ctx *ctx_id, int offset, int len,
+ struct xdr_buf *buf);
+
+
+@@ -312,7 +312,7 @@ gss_krb5_aes_encrypt(struct krb5_ctx *kctx, u32 offset,
+ struct page **pages);
+
+ u32
+-gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset,
++gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len,
+ struct xdr_buf *buf, u32 *plainoffset,
+ u32 *plainlen);
+
+diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
+index b41f34977995..ae2b1449dc09 100644
+--- a/include/linux/sunrpc/xdr.h
++++ b/include/linux/sunrpc/xdr.h
+@@ -184,6 +184,7 @@ xdr_adjust_iovec(struct kvec *iov, __be32 *p)
+ extern void xdr_shift_buf(struct xdr_buf *, size_t);
+ extern void xdr_buf_from_iov(struct kvec *, struct xdr_buf *);
+ extern int xdr_buf_subsegment(struct xdr_buf *, struct xdr_buf *, unsigned int, unsigned int);
++extern void xdr_buf_trim(struct xdr_buf *, unsigned int);
+ extern int xdr_buf_read_mic(struct xdr_buf *, struct xdr_netobj *, unsigned int);
+ extern int read_bytes_from_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int);
+ extern int write_bytes_to_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int);
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index bd5fe0e907e8..a99e9b8e4e31 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -66,7 +66,7 @@ struct tty_buffer {
+ int read;
+ int flags;
+ /* Data points here */
+- unsigned long data[0];
++ unsigned long data[];
+ };
+
+ /* Values for .flags field of tty_buffer */
+diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
+index 9f551f3b69c6..90690e37a56f 100644
+--- a/include/net/netfilter/nf_conntrack.h
++++ b/include/net/netfilter/nf_conntrack.h
+@@ -87,7 +87,7 @@ struct nf_conn {
+ struct hlist_node nat_bysource;
+ #endif
+ /* all members below initialized via memset */
+- u8 __nfct_init_offset[0];
++ struct { } __nfct_init_offset;
+
+ /* If we were expected by an expectation, this will be it */
+ struct nf_conn *master;
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index c30f914867e6..f1f8acb14b67 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -407,6 +407,7 @@ struct tcf_block {
+ struct mutex lock;
+ struct list_head chain_list;
+ u32 index; /* block index for shared blocks */
++ u32 classid; /* which class this block belongs to */
+ refcount_t refcnt;
+ struct net *net;
+ struct Qdisc *q;
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 2edb73c27962..00a57766e16e 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1421,6 +1421,19 @@ static inline int tcp_full_space(const struct sock *sk)
+ return tcp_win_from_space(sk, READ_ONCE(sk->sk_rcvbuf));
+ }
+
++/* We provision sk_rcvbuf around 200% of sk_rcvlowat.
++ * If 87.5 % (7/8) of the space has been consumed, we want to override
++ * SO_RCVLOWAT constraint, since we are receiving skbs with too small
++ * len/truesize ratio.
++ */
++static inline bool tcp_rmem_pressure(const struct sock *sk)
++{
++ int rcvbuf = READ_ONCE(sk->sk_rcvbuf);
++ int threshold = rcvbuf - (rcvbuf >> 3);
++
++ return atomic_read(&sk->sk_rmem_alloc) > threshold;
++}
++
+ extern void tcp_openreq_init_rwin(struct request_sock *req,
+ const struct sock *sk_listener,
+ const struct dst_entry *dst);
+diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h
+index f8e1955c86f1..7b5382e10bd2 100644
+--- a/include/soc/mscc/ocelot.h
++++ b/include/soc/mscc/ocelot.h
+@@ -437,6 +437,7 @@ struct ocelot {
+ unsigned int num_stats;
+
+ int shared_queue_sz;
++ int num_mact_rows;
+
+ struct net_device *hw_bridge_dev;
+ u16 bridge_mask;
+diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h
+index a36b7227a15a..334842daa904 100644
+--- a/include/sound/rawmidi.h
++++ b/include/sound/rawmidi.h
+@@ -61,6 +61,7 @@ struct snd_rawmidi_runtime {
+ size_t avail_min; /* min avail for wakeup */
+ size_t avail; /* max used buffer for wakeup */
+ size_t xruns; /* over/underruns counter */
++ int buffer_ref; /* buffer reference count */
+ /* misc */
+ spinlock_t lock;
+ wait_queue_head_t sleep;
+diff --git a/include/trace/events/rpcrdma.h b/include/trace/events/rpcrdma.h
+index fa14adf24235..43158151821c 100644
+--- a/include/trace/events/rpcrdma.h
++++ b/include/trace/events/rpcrdma.h
+@@ -721,11 +721,10 @@ TRACE_EVENT(xprtrdma_prepsend_failed,
+
+ TRACE_EVENT(xprtrdma_post_send,
+ TP_PROTO(
+- const struct rpcrdma_req *req,
+- int status
++ const struct rpcrdma_req *req
+ ),
+
+- TP_ARGS(req, status),
++ TP_ARGS(req),
+
+ TP_STRUCT__entry(
+ __field(const void *, req)
+@@ -734,7 +733,6 @@ TRACE_EVENT(xprtrdma_post_send,
+ __field(unsigned int, client_id)
+ __field(int, num_sge)
+ __field(int, signaled)
+- __field(int, status)
+ ),
+
+ TP_fast_assign(
+@@ -747,15 +745,13 @@ TRACE_EVENT(xprtrdma_post_send,
+ __entry->sc = req->rl_sendctx;
+ __entry->num_sge = req->rl_wr.num_sge;
+ __entry->signaled = req->rl_wr.send_flags & IB_SEND_SIGNALED;
+- __entry->status = status;
+ ),
+
+- TP_printk("task:%u@%u req=%p sc=%p (%d SGE%s) %sstatus=%d",
++ TP_printk("task:%u@%u req=%p sc=%p (%d SGE%s) %s",
+ __entry->task_id, __entry->client_id,
+ __entry->req, __entry->sc, __entry->num_sge,
+ (__entry->num_sge == 1 ? "" : "s"),
+- (__entry->signaled ? "signaled " : ""),
+- __entry->status
++ (__entry->signaled ? "signaled" : "")
+ )
+ );
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 4f717bfdbfe2..ef59c5c36cdb 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -36,22 +36,6 @@ config TOOLS_SUPPORT_RELR
+ config CC_HAS_ASM_INLINE
+ def_bool $(success,echo 'void foo(void) { asm inline (""); }' | $(CC) -x c - -c -o /dev/null)
+
+-config CC_HAS_WARN_MAYBE_UNINITIALIZED
+- def_bool $(cc-option,-Wmaybe-uninitialized)
+- help
+- GCC >= 4.7 supports this option.
+-
+-config CC_DISABLE_WARN_MAYBE_UNINITIALIZED
+- bool
+- depends on CC_HAS_WARN_MAYBE_UNINITIALIZED
+- default CC_IS_GCC && GCC_VERSION < 40900 # unreliable for GCC < 4.9
+- help
+- GCC's -Wmaybe-uninitialized is not reliable by definition.
+- Lots of false positive warnings are produced in some cases.
+-
+- If this option is enabled, -Wno-maybe-uninitialzed is passed
+- to the compiler to suppress maybe-uninitialized warnings.
+-
+ config CONSTRUCTORS
+ bool
+ depends on !UML
+@@ -1249,14 +1233,12 @@ config CC_OPTIMIZE_FOR_PERFORMANCE
+ config CC_OPTIMIZE_FOR_PERFORMANCE_O3
+ bool "Optimize more for performance (-O3)"
+ depends on ARC
+- imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives
+ help
+ Choosing this option will pass "-O3" to your compiler to optimize
+ the kernel yet more for performance.
+
+ config CC_OPTIMIZE_FOR_SIZE
+ bool "Optimize for size (-Os)"
+- imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives
+ help
+ Choosing this option will pass "-Os" to your compiler resulting
+ in a smaller kernel.
+diff --git a/init/initramfs.c b/init/initramfs.c
+index 8ec1be4d7d51..7a38012e1af7 100644
+--- a/init/initramfs.c
++++ b/init/initramfs.c
+@@ -542,7 +542,7 @@ void __weak free_initrd_mem(unsigned long start, unsigned long end)
+ }
+
+ #ifdef CONFIG_KEXEC_CORE
+-static bool kexec_free_initrd(void)
++static bool __init kexec_free_initrd(void)
+ {
+ unsigned long crashk_start = (unsigned long)__va(crashk_res.start);
+ unsigned long crashk_end = (unsigned long)__va(crashk_res.end);
+diff --git a/init/main.c b/init/main.c
+index 9c7948b3763a..6bcad75d60ad 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -257,6 +257,47 @@ static int __init loglevel(char *str)
+
+ early_param("loglevel", loglevel);
+
++#ifdef CONFIG_BLK_DEV_INITRD
++static void * __init get_boot_config_from_initrd(u32 *_size, u32 *_csum)
++{
++ u32 size, csum;
++ char *data;
++ u32 *hdr;
++
++ if (!initrd_end)
++ return NULL;
++
++ data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
++ if (memcmp(data, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN))
++ return NULL;
++
++ hdr = (u32 *)(data - 8);
++ size = hdr[0];
++ csum = hdr[1];
++
++ data = ((void *)hdr) - size;
++ if ((unsigned long)data < initrd_start) {
++ pr_err("bootconfig size %d is greater than initrd size %ld\n",
++ size, initrd_end - initrd_start);
++ return NULL;
++ }
++
++ /* Remove bootconfig from initramfs/initrd */
++ initrd_end = (unsigned long)data;
++ if (_size)
++ *_size = size;
++ if (_csum)
++ *_csum = csum;
++
++ return data;
++}
++#else
++static void * __init get_boot_config_from_initrd(u32 *_size, u32 *_csum)
++{
++ return NULL;
++}
++#endif
++
+ #ifdef CONFIG_BOOT_CONFIG
+
+ char xbc_namebuf[XBC_KEYLEN_MAX] __initdata;
+@@ -355,9 +396,11 @@ static void __init setup_boot_config(const char *cmdline)
+ static char tmp_cmdline[COMMAND_LINE_SIZE] __initdata;
+ u32 size, csum;
+ char *data, *copy;
+- u32 *hdr;
+ int ret;
+
++ /* Cut out the bootconfig data even if we have no bootconfig option */
++ data = get_boot_config_from_initrd(&size, &csum);
++
+ strlcpy(tmp_cmdline, boot_command_line, COMMAND_LINE_SIZE);
+ parse_args("bootconfig", tmp_cmdline, NULL, 0, 0, 0, NULL,
+ bootconfig_params);
+@@ -365,16 +408,10 @@ static void __init setup_boot_config(const char *cmdline)
+ if (!bootconfig_found)
+ return;
+
+- if (!initrd_end)
+- goto not_found;
+-
+- data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
+- if (memcmp(data, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN))
+- goto not_found;
+-
+- hdr = (u32 *)(data - 8);
+- size = hdr[0];
+- csum = hdr[1];
++ if (!data) {
++ pr_err("'bootconfig' found on command line, but no bootconfig found\n");
++ return;
++ }
+
+ if (size >= XBC_DATA_MAX) {
+ pr_err("bootconfig size %d greater than max size %d\n",
+@@ -382,10 +419,6 @@ static void __init setup_boot_config(const char *cmdline)
+ return;
+ }
+
+- data = ((void *)hdr) - size;
+- if ((unsigned long)data < initrd_start)
+- goto not_found;
+-
+ if (boot_config_checksum((unsigned char *)data, size) != csum) {
+ pr_err("bootconfig checksum failed\n");
+ return;
+@@ -411,11 +444,15 @@ static void __init setup_boot_config(const char *cmdline)
+ extra_init_args = xbc_make_cmdline("init");
+ }
+ return;
+-not_found:
+- pr_err("'bootconfig' found on command line, but no bootconfig found\n");
+ }
++
+ #else
+-#define setup_boot_config(cmdline) do { } while (0)
++
++static void __init setup_boot_config(const char *cmdline)
++{
++ /* Remove bootconfig data from initrd */
++ get_boot_config_from_initrd(NULL, NULL);
++}
+
+ static int __init warn_bootconfig(char *str)
+ {
+@@ -995,6 +1032,8 @@ asmlinkage __visible void __init start_kernel(void)
+
+ /* Do the rest non-__init'ed, we're now alive */
+ arch_call_rest_init();
++
++ prevent_tail_call_optimization();
+ }
+
+ /* Call all constructor functions linked into the kernel. */
+diff --git a/ipc/util.c b/ipc/util.c
+index 2d70f25f64b8..c4a67982ec00 100644
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -764,21 +764,21 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
+ total++;
+ }
+
+- *new_pos = pos + 1;
++ ipc = NULL;
+ if (total >= ids->in_use)
+- return NULL;
++ goto out;
+
+ for (; pos < ipc_mni; pos++) {
+ ipc = idr_find(&ids->ipcs_idr, pos);
+ if (ipc != NULL) {
+ rcu_read_lock();
+ ipc_lock_object(ipc);
+- return ipc;
++ break;
+ }
+ }
+-
+- /* Out of range - return NULL to terminate iteration */
+- return NULL;
++out:
++ *new_pos = pos + 1;
++ return ipc;
+ }
+
+ static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos)
+diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
+index 95d77770353c..1d6120fd5ba6 100644
+--- a/kernel/bpf/arraymap.c
++++ b/kernel/bpf/arraymap.c
+@@ -486,7 +486,12 @@ static int array_map_mmap(struct bpf_map *map, struct vm_area_struct *vma)
+ if (!(map->map_flags & BPF_F_MMAPABLE))
+ return -EINVAL;
+
+- return remap_vmalloc_range(vma, array_map_vmalloc_addr(array), pgoff);
++ if (vma->vm_pgoff * PAGE_SIZE + (vma->vm_end - vma->vm_start) >
++ PAGE_ALIGN((u64)array->map.max_entries * array->elem_size))
++ return -EINVAL;
++
++ return remap_vmalloc_range(vma, array_map_vmalloc_addr(array),
++ vma->vm_pgoff + pgoff);
+ }
+
+ const struct bpf_map_ops array_map_ops = {
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 3b92aea18ae7..e04ea4c8f935 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1480,8 +1480,10 @@ static int map_lookup_and_delete_elem(union bpf_attr *attr)
+ if (err)
+ goto free_value;
+
+- if (copy_to_user(uvalue, value, value_size) != 0)
++ if (copy_to_user(uvalue, value, value_size) != 0) {
++ err = -EFAULT;
+ goto free_value;
++ }
+
+ err = 0;
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 1c53ccbd5b5d..c1bb5be530e9 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6498,6 +6498,22 @@ static int check_return_code(struct bpf_verifier_env *env)
+ return 0;
+ range = tnum_const(0);
+ break;
++ case BPF_PROG_TYPE_TRACING:
++ switch (env->prog->expected_attach_type) {
++ case BPF_TRACE_FENTRY:
++ case BPF_TRACE_FEXIT:
++ range = tnum_const(0);
++ break;
++ case BPF_TRACE_RAW_TP:
++ return 0;
++ default:
++ return -ENOTSUPP;
++ }
++ break;
++ case BPF_PROG_TYPE_EXT:
++ /* freplace program can return anything as its return value
++ * depends on the to-be-replaced kernel func or bpf program.
++ */
+ default:
+ return 0;
+ }
+diff --git a/kernel/fork.c b/kernel/fork.c
+index d90af13431c7..c9ba2b7bfef9 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -2486,11 +2486,11 @@ long do_fork(unsigned long clone_flags,
+ int __user *child_tidptr)
+ {
+ struct kernel_clone_args args = {
+- .flags = (clone_flags & ~CSIGNAL),
++ .flags = (lower_32_bits(clone_flags) & ~CSIGNAL),
+ .pidfd = parent_tidptr,
+ .child_tid = child_tidptr,
+ .parent_tid = parent_tidptr,
+- .exit_signal = (clone_flags & CSIGNAL),
++ .exit_signal = (lower_32_bits(clone_flags) & CSIGNAL),
+ .stack = stack_start,
+ .stack_size = stack_size,
+ };
+@@ -2508,8 +2508,9 @@ long do_fork(unsigned long clone_flags,
+ pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
+ {
+ struct kernel_clone_args args = {
+- .flags = ((flags | CLONE_VM | CLONE_UNTRACED) & ~CSIGNAL),
+- .exit_signal = (flags & CSIGNAL),
++ .flags = ((lower_32_bits(flags) | CLONE_VM |
++ CLONE_UNTRACED) & ~CSIGNAL),
++ .exit_signal = (lower_32_bits(flags) & CSIGNAL),
+ .stack = (unsigned long)fn,
+ .stack_size = (unsigned long)arg,
+ };
+@@ -2570,11 +2571,11 @@ SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,
+ #endif
+ {
+ struct kernel_clone_args args = {
+- .flags = (clone_flags & ~CSIGNAL),
++ .flags = (lower_32_bits(clone_flags) & ~CSIGNAL),
+ .pidfd = parent_tidptr,
+ .child_tid = child_tidptr,
+ .parent_tid = parent_tidptr,
+- .exit_signal = (clone_flags & CSIGNAL),
++ .exit_signal = (lower_32_bits(clone_flags) & CSIGNAL),
+ .stack = newsp,
+ .tls = tls,
+ };
+diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
+index 402eef84c859..743647005f64 100644
+--- a/kernel/trace/Kconfig
++++ b/kernel/trace/Kconfig
+@@ -466,7 +466,6 @@ config PROFILE_ANNOTATED_BRANCHES
+ config PROFILE_ALL_BRANCHES
+ bool "Profile all if conditionals" if !FORTIFY_SOURCE
+ select TRACE_BRANCH_PROFILING
+- imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives
+ help
+ This tracer profiles all branch conditions. Every if ()
+ taken in the kernel is recorded whether it hit or miss.
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 68250d433bd7..b899a2d7e900 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -325,17 +325,15 @@ static const struct bpf_func_proto *bpf_get_probe_write_proto(void)
+
+ /*
+ * Only limited trace_printk() conversion specifiers allowed:
+- * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %s
++ * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %pks %pus %s
+ */
+ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
+ u64, arg2, u64, arg3)
+ {
++ int i, mod[3] = {}, fmt_cnt = 0;
++ char buf[64], fmt_ptype;
++ void *unsafe_ptr = NULL;
+ bool str_seen = false;
+- int mod[3] = {};
+- int fmt_cnt = 0;
+- u64 unsafe_addr;
+- char buf[64];
+- int i;
+
+ /*
+ * bpf_check()->check_func_arg()->check_stack_boundary()
+@@ -361,40 +359,71 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
+ if (fmt[i] == 'l') {
+ mod[fmt_cnt]++;
+ i++;
+- } else if (fmt[i] == 'p' || fmt[i] == 's') {
++ } else if (fmt[i] == 'p') {
+ mod[fmt_cnt]++;
++ if ((fmt[i + 1] == 'k' ||
++ fmt[i + 1] == 'u') &&
++ fmt[i + 2] == 's') {
++ fmt_ptype = fmt[i + 1];
++ i += 2;
++ goto fmt_str;
++ }
++
+ /* disallow any further format extensions */
+ if (fmt[i + 1] != 0 &&
+ !isspace(fmt[i + 1]) &&
+ !ispunct(fmt[i + 1]))
+ return -EINVAL;
+- fmt_cnt++;
+- if (fmt[i] == 's') {
+- if (str_seen)
+- /* allow only one '%s' per fmt string */
+- return -EINVAL;
+- str_seen = true;
+-
+- switch (fmt_cnt) {
+- case 1:
+- unsafe_addr = arg1;
+- arg1 = (long) buf;
+- break;
+- case 2:
+- unsafe_addr = arg2;
+- arg2 = (long) buf;
+- break;
+- case 3:
+- unsafe_addr = arg3;
+- arg3 = (long) buf;
+- break;
+- }
+- buf[0] = 0;
+- strncpy_from_unsafe(buf,
+- (void *) (long) unsafe_addr,
++
++ goto fmt_next;
++ } else if (fmt[i] == 's') {
++ mod[fmt_cnt]++;
++ fmt_ptype = fmt[i];
++fmt_str:
++ if (str_seen)
++ /* allow only one '%s' per fmt string */
++ return -EINVAL;
++ str_seen = true;
++
++ if (fmt[i + 1] != 0 &&
++ !isspace(fmt[i + 1]) &&
++ !ispunct(fmt[i + 1]))
++ return -EINVAL;
++
++ switch (fmt_cnt) {
++ case 0:
++ unsafe_ptr = (void *)(long)arg1;
++ arg1 = (long)buf;
++ break;
++ case 1:
++ unsafe_ptr = (void *)(long)arg2;
++ arg2 = (long)buf;
++ break;
++ case 2:
++ unsafe_ptr = (void *)(long)arg3;
++ arg3 = (long)buf;
++ break;
++ }
++
++ buf[0] = 0;
++ switch (fmt_ptype) {
++ case 's':
++#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
++ strncpy_from_unsafe(buf, unsafe_ptr,
+ sizeof(buf));
++ break;
++#endif
++ case 'k':
++ strncpy_from_unsafe_strict(buf, unsafe_ptr,
++ sizeof(buf));
++ break;
++ case 'u':
++ strncpy_from_unsafe_user(buf,
++ (__force void __user *)unsafe_ptr,
++ sizeof(buf));
++ break;
+ }
+- continue;
++ goto fmt_next;
+ }
+
+ if (fmt[i] == 'l') {
+@@ -405,6 +434,7 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
+ if (fmt[i] != 'i' && fmt[i] != 'd' &&
+ fmt[i] != 'u' && fmt[i] != 'x')
+ return -EINVAL;
++fmt_next:
+ fmt_cnt++;
+ }
+
+diff --git a/kernel/trace/ftrace_internal.h b/kernel/trace/ftrace_internal.h
+index 0456e0a3dab1..382775edf690 100644
+--- a/kernel/trace/ftrace_internal.h
++++ b/kernel/trace/ftrace_internal.h
+@@ -4,28 +4,6 @@
+
+ #ifdef CONFIG_FUNCTION_TRACER
+
+-/*
+- * Traverse the ftrace_global_list, invoking all entries. The reason that we
+- * can use rcu_dereference_raw_check() is that elements removed from this list
+- * are simply leaked, so there is no need to interact with a grace-period
+- * mechanism. The rcu_dereference_raw_check() calls are needed to handle
+- * concurrent insertions into the ftrace_global_list.
+- *
+- * Silly Alpha and silly pointer-speculation compiler optimizations!
+- */
+-#define do_for_each_ftrace_op(op, list) \
+- op = rcu_dereference_raw_check(list); \
+- do
+-
+-/*
+- * Optimized for just a single item in the list (as that is the normal case).
+- */
+-#define while_for_each_ftrace_op(op) \
+- while (likely(op = rcu_dereference_raw_check((op)->next)) && \
+- unlikely((op) != &ftrace_list_end))
+-
+-extern struct ftrace_ops __rcu *ftrace_ops_list;
+-extern struct ftrace_ops ftrace_list_end;
+ extern struct mutex ftrace_lock;
+ extern struct ftrace_ops global_ops;
+
+diff --git a/kernel/trace/preemptirq_delay_test.c b/kernel/trace/preemptirq_delay_test.c
+index c4c86de63cf9..312d1a0ca3b6 100644
+--- a/kernel/trace/preemptirq_delay_test.c
++++ b/kernel/trace/preemptirq_delay_test.c
+@@ -16,6 +16,7 @@
+ #include <linux/printk.h>
+ #include <linux/string.h>
+ #include <linux/sysfs.h>
++#include <linux/completion.h>
+
+ static ulong delay = 100;
+ static char test_mode[12] = "irq";
+@@ -28,6 +29,8 @@ MODULE_PARM_DESC(delay, "Period in microseconds (100 us default)");
+ MODULE_PARM_DESC(test_mode, "Mode of the test such as preempt, irq, or alternate (default irq)");
+ MODULE_PARM_DESC(burst_size, "The size of a burst (default 1)");
+
++static struct completion done;
++
+ #define MIN(x, y) ((x) < (y) ? (x) : (y))
+
+ static void busy_wait(ulong time)
+@@ -114,6 +117,8 @@ static int preemptirq_delay_run(void *data)
+ for (i = 0; i < s; i++)
+ (testfuncs[i])(i);
+
++ complete(&done);
++
+ set_current_state(TASK_INTERRUPTIBLE);
+ while (!kthread_should_stop()) {
+ schedule();
+@@ -128,15 +133,18 @@ static int preemptirq_delay_run(void *data)
+ static int preemptirq_run_test(void)
+ {
+ struct task_struct *task;
+-
+ char task_name[50];
+
++ init_completion(&done);
++
+ snprintf(task_name, sizeof(task_name), "%s_test", test_mode);
+ task = kthread_run(preemptirq_delay_run, NULL, task_name);
+ if (IS_ERR(task))
+ return PTR_ERR(task);
+- if (task)
++ if (task) {
++ wait_for_completion(&done);
+ kthread_stop(task);
++ }
+ return 0;
+ }
+
+diff --git a/kernel/umh.c b/kernel/umh.c
+index 11bf5eea474c..3474d6aa55d8 100644
+--- a/kernel/umh.c
++++ b/kernel/umh.c
+@@ -475,6 +475,12 @@ static void umh_clean_and_save_pid(struct subprocess_info *info)
+ {
+ struct umh_info *umh_info = info->data;
+
++ /* cleanup if umh_pipe_setup() was successful but exec failed */
++ if (info->pid && info->retval) {
++ fput(umh_info->pipe_to_umh);
++ fput(umh_info->pipe_from_umh);
++ }
++
+ argv_free(info->argv);
+ umh_info->pid = info->pid;
+ }
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index 7c488a1ce318..532b6606a18a 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -2168,6 +2168,10 @@ char *fwnode_string(char *buf, char *end, struct fwnode_handle *fwnode,
+ * f full name
+ * P node name, including a possible unit address
+ * - 'x' For printing the address. Equivalent to "%lx".
++ * - '[ku]s' For a BPF/tracing related format specifier, e.g. used out of
++ * bpf_trace_printk() where [ku] prefix specifies either kernel (k)
++ * or user (u) memory to probe, and:
++ * s a string, equivalent to "%s" on direct vsnprintf() use
+ *
+ * ** When making changes please also update:
+ * Documentation/core-api/printk-formats.rst
+@@ -2251,6 +2255,14 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
+ if (!IS_ERR(ptr))
+ break;
+ return err_ptr(buf, end, ptr, spec);
++ case 'u':
++ case 'k':
++ switch (fmt[1]) {
++ case 's':
++ return string(buf, end, ptr, spec);
++ default:
++ return error_string(buf, end, "(einval)", spec);
++ }
+ }
+
+ /* default is to _not_ leak addresses, hash before printing */
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 7406f91f8a52..153d889e32d1 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2184,7 +2184,11 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
+ struct shmem_inode_info *info = SHMEM_I(inode);
+ int retval = -ENOMEM;
+
+- spin_lock_irq(&info->lock);
++ /*
++ * What serializes the accesses to info->flags?
++ * ipc_lock_object() when called from shmctl_do_lock(),
++ * no serialization needed when called from shm_destroy().
++ */
+ if (lock && !(info->flags & VM_LOCKED)) {
+ if (!user_shm_lock(inode->i_size, user))
+ goto out_nomem;
+@@ -2199,7 +2203,6 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
+ retval = 0;
+
+ out_nomem:
+- spin_unlock_irq(&info->lock);
+ return retval;
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 77c154107b0d..c7047b40f569 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8890,11 +8890,13 @@ static void netdev_sync_lower_features(struct net_device *upper,
+ netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n",
+ &feature, lower->name);
+ lower->wanted_features &= ~feature;
+- netdev_update_features(lower);
++ __netdev_update_features(lower);
+
+ if (unlikely(lower->features & feature))
+ netdev_WARN(upper, "failed to disable %pNF on %s!\n",
+ &feature, lower->name);
++ else
++ netdev_features_change(lower);
+ }
+ }
+ }
+diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
+index 31700e0c3928..04d8e8779384 100644
+--- a/net/core/drop_monitor.c
++++ b/net/core/drop_monitor.c
+@@ -212,6 +212,7 @@ static void sched_send_work(struct timer_list *t)
+ static void trace_drop_common(struct sk_buff *skb, void *location)
+ {
+ struct net_dm_alert_msg *msg;
++ struct net_dm_drop_point *point;
+ struct nlmsghdr *nlh;
+ struct nlattr *nla;
+ int i;
+@@ -230,11 +231,13 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
+ nlh = (struct nlmsghdr *)dskb->data;
+ nla = genlmsg_data(nlmsg_data(nlh));
+ msg = nla_data(nla);
++ point = msg->points;
+ for (i = 0; i < msg->entries; i++) {
+- if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
+- msg->points[i].count++;
++ if (!memcmp(&location, &point->pc, sizeof(void *))) {
++ point->count++;
+ goto out;
+ }
++ point++;
+ }
+ if (msg->entries == dm_hit_limit)
+ goto out;
+@@ -243,8 +246,8 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
+ */
+ __nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point));
+ nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
+- memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
+- msg->points[msg->entries].count = 1;
++ memcpy(point->pc, &location, sizeof(void *));
++ point->count = 1;
+ msg->entries++;
+
+ if (!timer_pending(&data->send_timer)) {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index c180871e606d..083fbe92662e 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2590,8 +2590,8 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
+ }
+ pop = 0;
+ } else if (pop >= sge->length - a) {
+- sge->length = a;
+ pop -= (sge->length - a);
++ sge->length = a;
+ }
+ }
+
+diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
+index 8881dd943dd0..9bd4cab7d510 100644
+--- a/net/core/netprio_cgroup.c
++++ b/net/core/netprio_cgroup.c
+@@ -236,6 +236,8 @@ static void net_prio_attach(struct cgroup_taskset *tset)
+ struct task_struct *p;
+ struct cgroup_subsys_state *css;
+
++ cgroup_sk_alloc_disable();
++
+ cgroup_taskset_for_each(p, css, tset) {
+ void *v = (void *)(unsigned long)css->id;
+
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 0bd10a1f477f..a23094b050f8 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1258,7 +1258,8 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
+ return ret_val;
+ }
+
+- secattr->flags |= NETLBL_SECATTR_MLS_CAT;
++ if (secattr->attr.mls.cat)
++ secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+ }
+
+ return 0;
+@@ -1439,7 +1440,8 @@ static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
+ return ret_val;
+ }
+
+- secattr->flags |= NETLBL_SECATTR_MLS_CAT;
++ if (secattr->attr.mls.cat)
++ secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+ }
+
+ return 0;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index ebe7060d0fc9..ef6b70774fe1 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -915,7 +915,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
+ /* Check for load limit; set rate_last to the latest sent
+ * redirect.
+ */
+- if (peer->rate_tokens == 0 ||
++ if (peer->n_redirects == 0 ||
+ time_after(jiffies,
+ (peer->rate_last +
+ (ip_rt_redirect_load << peer->n_redirects)))) {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index dc77c303e6f7..06aad5e09459 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -476,9 +476,17 @@ static void tcp_tx_timestamp(struct sock *sk, u16 tsflags)
+ static inline bool tcp_stream_is_readable(const struct tcp_sock *tp,
+ int target, struct sock *sk)
+ {
+- return (READ_ONCE(tp->rcv_nxt) - READ_ONCE(tp->copied_seq) >= target) ||
+- (sk->sk_prot->stream_memory_read ?
+- sk->sk_prot->stream_memory_read(sk) : false);
++ int avail = READ_ONCE(tp->rcv_nxt) - READ_ONCE(tp->copied_seq);
++
++ if (avail > 0) {
++ if (avail >= target)
++ return true;
++ if (tcp_rmem_pressure(sk))
++ return true;
++ }
++ if (sk->sk_prot->stream_memory_read)
++ return sk->sk_prot->stream_memory_read(sk);
++ return false;
+ }
+
+ /*
+@@ -1756,10 +1764,11 @@ static int tcp_zerocopy_receive(struct sock *sk,
+
+ down_read(¤t->mm->mmap_sem);
+
+- ret = -EINVAL;
+ vma = find_vma(current->mm, address);
+- if (!vma || vma->vm_start > address || vma->vm_ops != &tcp_vm_ops)
+- goto out;
++ if (!vma || vma->vm_start > address || vma->vm_ops != &tcp_vm_ops) {
++ up_read(¤t->mm->mmap_sem);
++ return -EINVAL;
++ }
+ zc->length = min_t(unsigned long, zc->length, vma->vm_end - address);
+
+ tp = tcp_sk(sk);
+@@ -2154,13 +2163,15 @@ skip_copy:
+ tp->urg_data = 0;
+ tcp_fast_path_check(sk);
+ }
+- if (used + offset < skb->len)
+- continue;
+
+ if (TCP_SKB_CB(skb)->has_rxtstamp) {
+ tcp_update_recv_tstamps(skb, &tss);
+ cmsg_flags |= 2;
+ }
++
++ if (used + offset < skb->len)
++ continue;
++
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+ goto found_fin_ok;
+ if (!(flags & MSG_PEEK))
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index 8a01428f80c1..69b025408390 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -121,14 +121,17 @@ int tcp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ struct sk_psock *psock;
+ int copied, ret;
+
++ if (unlikely(flags & MSG_ERRQUEUE))
++ return inet_recv_error(sk, msg, len, addr_len);
++
+ psock = sk_psock_get(sk);
+ if (unlikely(!psock))
+ return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
+- if (unlikely(flags & MSG_ERRQUEUE))
+- return inet_recv_error(sk, msg, len, addr_len);
+ if (!skb_queue_empty(&sk->sk_receive_queue) &&
+- sk_psock_queue_empty(psock))
++ sk_psock_queue_empty(psock)) {
++ sk_psock_put(sk, psock);
+ return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
++ }
+ lock_sock(sk);
+ msg_bytes_ready:
+ copied = __tcp_bpf_recvmsg(sk, psock, msg, len, flags);
+@@ -200,7 +203,6 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock,
+
+ if (!ret) {
+ msg->sg.start = i;
+- msg->sg.size -= apply_bytes;
+ sk_psock_queue_msg(psock, tmp);
+ sk_psock_data_ready(sk, psock);
+ } else {
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 6b6b57000dad..e17d396102ce 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4761,7 +4761,8 @@ void tcp_data_ready(struct sock *sk)
+ const struct tcp_sock *tp = tcp_sk(sk);
+ int avail = tp->rcv_nxt - tp->copied_seq;
+
+- if (avail < sk->sk_rcvlowat && !sock_flag(sk, SOCK_DONE))
++ if (avail < sk->sk_rcvlowat && !tcp_rmem_pressure(sk) &&
++ !sock_flag(sk, SOCK_DONE))
+ return;
+
+ sk->sk_data_ready(sk);
+diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
+index 221c81f85cbf..8d3f66c310db 100644
+--- a/net/ipv6/calipso.c
++++ b/net/ipv6/calipso.c
+@@ -1047,7 +1047,8 @@ static int calipso_opt_getattr(const unsigned char *calipso,
+ goto getattr_return;
+ }
+
+- secattr->flags |= NETLBL_SECATTR_MLS_CAT;
++ if (secattr->attr.mls.cat)
++ secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+ }
+
+ secattr->type = NETLBL_NLTYPE_CALIPSO;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 42d0596dd398..21ee5bcaeb91 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2725,8 +2725,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+ const struct in6_addr *daddr, *saddr;
+ struct rt6_info *rt6 = (struct rt6_info *)dst;
+
+- if (dst_metric_locked(dst, RTAX_MTU))
+- return;
++ /* Note: do *NOT* check dst_metric_locked(dst, RTAX_MTU)
++ * IPv6 pmtu discovery isn't optional, so 'mtu lock' cannot disable it.
++ * [see also comment in rt6_mtu_change_route()]
++ */
+
+ if (iph) {
+ daddr = &iph->daddr;
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index 65122edf60aa..b89bd70f890a 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -633,6 +633,16 @@ int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock)
+ if (err)
+ return err;
+
++ /* the newly created socket really belongs to the owning MPTCP master
++ * socket, even if for additional subflows the allocation is performed
++ * by a kernel workqueue. Adjust inode references, so that the
++ * procfs/diag interaces really show this one belonging to the correct
++ * user.
++ */
++ SOCK_INODE(sf)->i_ino = SOCK_INODE(sk->sk_socket)->i_ino;
++ SOCK_INODE(sf)->i_uid = SOCK_INODE(sk->sk_socket)->i_uid;
++ SOCK_INODE(sf)->i_gid = SOCK_INODE(sk->sk_socket)->i_gid;
++
+ subflow = mptcp_subflow_ctx(sf->sk);
+ pr_debug("subflow=%p", subflow);
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 1927fc296f95..d11a58348133 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1517,9 +1517,9 @@ __nf_conntrack_alloc(struct net *net,
+ ct->status = 0;
+ ct->timeout = 0;
+ write_pnet(&ct->ct_net, net);
+- memset(&ct->__nfct_init_offset[0], 0,
++ memset(&ct->__nfct_init_offset, 0,
+ offsetof(struct nf_conn, proto) -
+- offsetof(struct nf_conn, __nfct_init_offset[0]));
++ offsetof(struct nf_conn, __nfct_init_offset));
+
+ nf_ct_zone_add(ct, zone);
+
+@@ -2137,8 +2137,19 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
+ nf_conntrack_lock(lockp);
+ if (*bucket < nf_conntrack_htable_size) {
+ hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnnode) {
+- if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
++ if (NF_CT_DIRECTION(h) != IP_CT_DIR_REPLY)
+ continue;
++ /* All nf_conn objects are added to hash table twice, one
++ * for original direction tuple, once for the reply tuple.
++ *
++ * Exception: In the IPS_NAT_CLASH case, only the reply
++ * tuple is added (the original tuple already existed for
++ * a different object).
++ *
++ * We only need to call the iterator once for each
++ * conntrack, so we just use the 'reply' direction
++ * tuple while iterating.
++ */
+ ct = nf_ct_tuplehash_to_ctrack(h);
+ if (iter(ct, data))
+ goto found;
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 70ebebaf5bc1..0ee78a166378 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -271,7 +271,7 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
+
+ if (nf_flow_has_expired(flow))
+ flow_offload_fixup_ct(flow->ct);
+- else if (test_bit(NF_FLOW_TEARDOWN, &flow->flags))
++ else
+ flow_offload_fixup_ct_timeout(flow->ct);
+
+ flow_offload_free(flow);
+@@ -348,8 +348,10 @@ static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
+ {
+ struct nf_flowtable *flow_table = data;
+
+- if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct) ||
+- test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
++ if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct))
++ set_bit(NF_FLOW_TEARDOWN, &flow->flags);
++
++ if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
+ if (test_bit(NF_FLOW_HW, &flow->flags)) {
+ if (!test_bit(NF_FLOW_HW_DYING, &flow->flags))
+ nf_flow_offload_del(flow_table, flow);
+diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
+index 46d976969ca3..accbb54c2b71 100644
+--- a/net/netfilter/nft_set_rbtree.c
++++ b/net/netfilter/nft_set_rbtree.c
+@@ -79,6 +79,10 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set
+ parent = rcu_dereference_raw(parent->rb_left);
+ continue;
+ }
++
++ if (nft_set_elem_expired(&rbe->ext))
++ return false;
++
+ if (nft_rbtree_interval_end(rbe)) {
+ if (nft_set_is_anonymous(set))
+ return false;
+@@ -94,6 +98,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set
+
+ if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
+ nft_set_elem_active(&interval->ext, genmask) &&
++ !nft_set_elem_expired(&interval->ext) &&
+ nft_rbtree_interval_start(interval)) {
+ *ext = &interval->ext;
+ return true;
+@@ -154,6 +159,9 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set,
+ continue;
+ }
+
++ if (nft_set_elem_expired(&rbe->ext))
++ return false;
++
+ if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) ||
+ (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) ==
+ (flags & NFT_SET_ELEM_INTERVAL_END)) {
+@@ -170,6 +178,7 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set,
+
+ if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
+ nft_set_elem_active(&interval->ext, genmask) &&
++ !nft_set_elem_expired(&interval->ext) &&
+ ((!nft_rbtree_interval_end(interval) &&
+ !(flags & NFT_SET_ELEM_INTERVAL_END)) ||
+ (nft_rbtree_interval_end(interval) &&
+@@ -418,6 +427,8 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,
+
+ if (iter->count < iter->skip)
+ goto cont;
++ if (nft_set_elem_expired(&rbe->ext))
++ goto cont;
+ if (!nft_set_elem_active(&rbe->ext, iter->genmask))
+ goto cont;
+
+diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
+index 409a3ae47ce2..5e1239cef000 100644
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -734,6 +734,12 @@ int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
+ if ((off & (BITS_PER_LONG - 1)) != 0)
+ return -EINVAL;
+
++ /* a null catmap is equivalent to an empty one */
++ if (!catmap) {
++ *offset = (u32)-1;
++ return 0;
++ }
++
+ if (off < catmap->startbit) {
+ off = catmap->startbit;
+ *offset = off;
+diff --git a/net/rds/message.c b/net/rds/message.c
+index 50f13f1d4ae0..2d43e13d6dd5 100644
+--- a/net/rds/message.c
++++ b/net/rds/message.c
+@@ -308,26 +308,20 @@ out:
+ /*
+ * RDS ops use this to grab SG entries from the rm's sg pool.
+ */
+-struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents,
+- int *ret)
++struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents)
+ {
+ struct scatterlist *sg_first = (struct scatterlist *) &rm[1];
+ struct scatterlist *sg_ret;
+
+- if (WARN_ON(!ret))
+- return NULL;
+-
+ if (nents <= 0) {
+ pr_warn("rds: alloc sgs failed! nents <= 0\n");
+- *ret = -EINVAL;
+- return NULL;
++ return ERR_PTR(-EINVAL);
+ }
+
+ if (rm->m_used_sgs + nents > rm->m_total_sgs) {
+ pr_warn("rds: alloc sgs failed! total %d used %d nents %d\n",
+ rm->m_total_sgs, rm->m_used_sgs, nents);
+- *ret = -ENOMEM;
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+ sg_ret = &sg_first[rm->m_used_sgs];
+@@ -343,7 +337,6 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
+ unsigned int i;
+ int num_sgs = DIV_ROUND_UP(total_len, PAGE_SIZE);
+ int extra_bytes = num_sgs * sizeof(struct scatterlist);
+- int ret;
+
+ rm = rds_message_alloc(extra_bytes, GFP_NOWAIT);
+ if (!rm)
+@@ -352,10 +345,10 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
+ set_bit(RDS_MSG_PAGEVEC, &rm->m_flags);
+ rm->m_inc.i_hdr.h_len = cpu_to_be32(total_len);
+ rm->data.op_nents = DIV_ROUND_UP(total_len, PAGE_SIZE);
+- rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs, &ret);
+- if (!rm->data.op_sg) {
++ rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
++ if (IS_ERR(rm->data.op_sg)) {
+ rds_message_put(rm);
+- return ERR_PTR(ret);
++ return ERR_CAST(rm->data.op_sg);
+ }
+
+ for (i = 0; i < rm->data.op_nents; ++i) {
+diff --git a/net/rds/rdma.c b/net/rds/rdma.c
+index 585e6b3b69ce..554ea7f0277f 100644
+--- a/net/rds/rdma.c
++++ b/net/rds/rdma.c
+@@ -664,9 +664,11 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+ op->op_odp_mr = NULL;
+
+ WARN_ON(!nr_pages);
+- op->op_sg = rds_message_alloc_sgs(rm, nr_pages, &ret);
+- if (!op->op_sg)
++ op->op_sg = rds_message_alloc_sgs(rm, nr_pages);
++ if (IS_ERR(op->op_sg)) {
++ ret = PTR_ERR(op->op_sg);
+ goto out_pages;
++ }
+
+ if (op->op_notify || op->op_recverr) {
+ /* We allocate an uninitialized notifier here, because
+@@ -905,9 +907,11 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm,
+ rm->atomic.op_silent = !!(args->flags & RDS_RDMA_SILENT);
+ rm->atomic.op_active = 1;
+ rm->atomic.op_recverr = rs->rs_recverr;
+- rm->atomic.op_sg = rds_message_alloc_sgs(rm, 1, &ret);
+- if (!rm->atomic.op_sg)
++ rm->atomic.op_sg = rds_message_alloc_sgs(rm, 1);
++ if (IS_ERR(rm->atomic.op_sg)) {
++ ret = PTR_ERR(rm->atomic.op_sg);
+ goto err;
++ }
+
+ /* verify 8 byte-aligned */
+ if (args->local_addr & 0x7) {
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index e4a603523083..b8b7ad766046 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -852,8 +852,7 @@ rds_conn_connecting(struct rds_connection *conn)
+
+ /* message.c */
+ struct rds_message *rds_message_alloc(unsigned int nents, gfp_t gfp);
+-struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents,
+- int *ret);
++struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents);
+ int rds_message_copy_from_user(struct rds_message *rm, struct iov_iter *from,
+ bool zcopy);
+ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned int total_len);
+diff --git a/net/rds/send.c b/net/rds/send.c
+index 82dcd8b84fe7..68e2bdb08fd0 100644
+--- a/net/rds/send.c
++++ b/net/rds/send.c
+@@ -1274,9 +1274,11 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
+
+ /* Attach data to the rm */
+ if (payload_len) {
+- rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs, &ret);
+- if (!rm->data.op_sg)
++ rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
++ if (IS_ERR(rm->data.op_sg)) {
++ ret = PTR_ERR(rm->data.op_sg);
+ goto out;
++ }
+ ret = rds_message_copy_from_user(rm, &msg->msg_iter, zcopy);
+ if (ret)
+ goto out;
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index c2cdd0fc2e70..68c8fc6f535c 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -2005,6 +2005,7 @@ replay:
+ err = PTR_ERR(block);
+ goto errout;
+ }
++ block->classid = parent;
+
+ chain_index = tca[TCA_CHAIN] ? nla_get_u32(tca[TCA_CHAIN]) : 0;
+ if (chain_index > TC_ACT_EXT_VAL_MASK) {
+@@ -2547,12 +2548,10 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
+ return skb->len;
+
+ parent = tcm->tcm_parent;
+- if (!parent) {
++ if (!parent)
+ q = dev->qdisc;
+- parent = q->handle;
+- } else {
++ else
+ q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent));
+- }
+ if (!q)
+ goto out;
+ cops = q->ops->cl_ops;
+@@ -2568,6 +2567,7 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
+ block = cops->tcf_block(q, cl, NULL);
+ if (!block)
+ goto out;
++ parent = block->classid;
+ if (tcf_block_shared(block))
+ q = NULL;
+ }
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 2dc740acb3bf..a7ad150fd4ee 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -2030,7 +2030,6 @@ gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred,
+ struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf;
+ struct kvec *head = rqstp->rq_rcv_buf.head;
+ struct rpc_auth *auth = cred->cr_auth;
+- unsigned int savedlen = rcv_buf->len;
+ u32 offset, opaque_len, maj_stat;
+ __be32 *p;
+
+@@ -2041,9 +2040,9 @@ gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred,
+ offset = (u8 *)(p) - (u8 *)head->iov_base;
+ if (offset + opaque_len > rcv_buf->len)
+ goto unwrap_failed;
+- rcv_buf->len = offset + opaque_len;
+
+- maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, rcv_buf);
++ maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
++ offset + opaque_len, rcv_buf);
+ if (maj_stat == GSS_S_CONTEXT_EXPIRED)
+ clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+ if (maj_stat != GSS_S_COMPLETE)
+@@ -2057,10 +2056,9 @@ gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred,
+ */
+ xdr_init_decode(xdr, rcv_buf, p, rqstp);
+
+- auth->au_rslack = auth->au_verfsize + 2 +
+- XDR_QUADLEN(savedlen - rcv_buf->len);
+- auth->au_ralign = auth->au_verfsize + 2 +
+- XDR_QUADLEN(savedlen - rcv_buf->len);
++ auth->au_rslack = auth->au_verfsize + 2 + ctx->gc_gss_ctx->slack;
++ auth->au_ralign = auth->au_verfsize + 2 + ctx->gc_gss_ctx->align;
++
+ return 0;
+ unwrap_failed:
+ trace_rpcgss_unwrap_failed(task);
+diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
+index 6f2d30d7b766..e7180da1fc6a 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
++++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
+@@ -851,8 +851,8 @@ out_err:
+ }
+
+ u32
+-gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf,
+- u32 *headskip, u32 *tailskip)
++gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len,
++ struct xdr_buf *buf, u32 *headskip, u32 *tailskip)
+ {
+ struct xdr_buf subbuf;
+ u32 ret = 0;
+@@ -881,7 +881,7 @@ gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf,
+
+ /* create a segment skipping the header and leaving out the checksum */
+ xdr_buf_subsegment(buf, &subbuf, offset + GSS_KRB5_TOK_HDR_LEN,
+- (buf->len - offset - GSS_KRB5_TOK_HDR_LEN -
++ (len - offset - GSS_KRB5_TOK_HDR_LEN -
+ kctx->gk5e->cksumlength));
+
+ nblocks = (subbuf.len + blocksize - 1) / blocksize;
+@@ -926,7 +926,7 @@ gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf,
+ goto out_err;
+
+ /* Get the packet's hmac value */
+- ret = read_bytes_from_xdr_buf(buf, buf->len - kctx->gk5e->cksumlength,
++ ret = read_bytes_from_xdr_buf(buf, len - kctx->gk5e->cksumlength,
+ pkt_hmac, kctx->gk5e->cksumlength);
+ if (ret)
+ goto out_err;
+diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
+index 6c1920eed771..cf0fd170ac18 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
++++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
+@@ -261,7 +261,9 @@ gss_wrap_kerberos_v1(struct krb5_ctx *kctx, int offset,
+ }
+
+ static u32
+-gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
++gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, int len,
++ struct xdr_buf *buf, unsigned int *slack,
++ unsigned int *align)
+ {
+ int signalg;
+ int sealalg;
+@@ -279,12 +281,13 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
+ u32 conflen = kctx->gk5e->conflen;
+ int crypt_offset;
+ u8 *cksumkey;
++ unsigned int saved_len = buf->len;
+
+ dprintk("RPC: gss_unwrap_kerberos\n");
+
+ ptr = (u8 *)buf->head[0].iov_base + offset;
+ if (g_verify_token_header(&kctx->mech_used, &bodysize, &ptr,
+- buf->len - offset))
++ len - offset))
+ return GSS_S_DEFECTIVE_TOKEN;
+
+ if ((ptr[0] != ((KG_TOK_WRAP_MSG >> 8) & 0xff)) ||
+@@ -324,6 +327,7 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
+ (!kctx->initiate && direction != 0))
+ return GSS_S_BAD_SIG;
+
++ buf->len = len;
+ if (kctx->enctype == ENCTYPE_ARCFOUR_HMAC) {
+ struct crypto_sync_skcipher *cipher;
+ int err;
+@@ -376,11 +380,15 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
+ data_len = (buf->head[0].iov_base + buf->head[0].iov_len) - data_start;
+ memmove(orig_start, data_start, data_len);
+ buf->head[0].iov_len -= (data_start - orig_start);
+- buf->len -= (data_start - orig_start);
++ buf->len = len - (data_start - orig_start);
+
+ if (gss_krb5_remove_padding(buf, blocksize))
+ return GSS_S_DEFECTIVE_TOKEN;
+
++ /* slack must include room for krb5 padding */
++ *slack = XDR_QUADLEN(saved_len - buf->len);
++ /* The GSS blob always precedes the RPC message payload */
++ *align = *slack;
+ return GSS_S_COMPLETE;
+ }
+
+@@ -486,7 +494,9 @@ gss_wrap_kerberos_v2(struct krb5_ctx *kctx, u32 offset,
+ }
+
+ static u32
+-gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
++gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, int len,
++ struct xdr_buf *buf, unsigned int *slack,
++ unsigned int *align)
+ {
+ time64_t now;
+ u8 *ptr;
+@@ -532,7 +542,7 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
+ if (rrc != 0)
+ rotate_left(offset + 16, buf, rrc);
+
+- err = (*kctx->gk5e->decrypt_v2)(kctx, offset, buf,
++ err = (*kctx->gk5e->decrypt_v2)(kctx, offset, len, buf,
+ &headskip, &tailskip);
+ if (err)
+ return GSS_S_FAILURE;
+@@ -542,7 +552,7 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
+ * it against the original
+ */
+ err = read_bytes_from_xdr_buf(buf,
+- buf->len - GSS_KRB5_TOK_HDR_LEN - tailskip,
++ len - GSS_KRB5_TOK_HDR_LEN - tailskip,
+ decrypted_hdr, GSS_KRB5_TOK_HDR_LEN);
+ if (err) {
+ dprintk("%s: error %u getting decrypted_hdr\n", __func__, err);
+@@ -568,18 +578,19 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
+ * Note that buf->head[0].iov_len may indicate the available
+ * head buffer space rather than that actually occupied.
+ */
+- movelen = min_t(unsigned int, buf->head[0].iov_len, buf->len);
++ movelen = min_t(unsigned int, buf->head[0].iov_len, len);
+ movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
+- if (offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
+- buf->head[0].iov_len)
+- return GSS_S_FAILURE;
++ BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
++ buf->head[0].iov_len);
+ memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen);
+ buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
+- buf->len -= GSS_KRB5_TOK_HDR_LEN + headskip;
++ buf->len = len - GSS_KRB5_TOK_HDR_LEN + headskip;
+
+ /* Trim off the trailing "extra count" and checksum blob */
+- buf->len -= ec + GSS_KRB5_TOK_HDR_LEN + tailskip;
++ xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
+
++ *align = XDR_QUADLEN(GSS_KRB5_TOK_HDR_LEN + headskip);
++ *slack = *align + XDR_QUADLEN(ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
+ return GSS_S_COMPLETE;
+ }
+
+@@ -603,7 +614,8 @@ gss_wrap_kerberos(struct gss_ctx *gctx, int offset,
+ }
+
+ u32
+-gss_unwrap_kerberos(struct gss_ctx *gctx, int offset, struct xdr_buf *buf)
++gss_unwrap_kerberos(struct gss_ctx *gctx, int offset,
++ int len, struct xdr_buf *buf)
+ {
+ struct krb5_ctx *kctx = gctx->internal_ctx_id;
+
+@@ -613,9 +625,11 @@ gss_unwrap_kerberos(struct gss_ctx *gctx, int offset, struct xdr_buf *buf)
+ case ENCTYPE_DES_CBC_RAW:
+ case ENCTYPE_DES3_CBC_RAW:
+ case ENCTYPE_ARCFOUR_HMAC:
+- return gss_unwrap_kerberos_v1(kctx, offset, buf);
++ return gss_unwrap_kerberos_v1(kctx, offset, len, buf,
++ &gctx->slack, &gctx->align);
+ case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
+ case ENCTYPE_AES256_CTS_HMAC_SHA1_96:
+- return gss_unwrap_kerberos_v2(kctx, offset, buf);
++ return gss_unwrap_kerberos_v2(kctx, offset, len, buf,
++ &gctx->slack, &gctx->align);
+ }
+ }
+diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
+index db550bfc2642..69316ab1b9fa 100644
+--- a/net/sunrpc/auth_gss/gss_mech_switch.c
++++ b/net/sunrpc/auth_gss/gss_mech_switch.c
+@@ -411,10 +411,11 @@ gss_wrap(struct gss_ctx *ctx_id,
+ u32
+ gss_unwrap(struct gss_ctx *ctx_id,
+ int offset,
++ int len,
+ struct xdr_buf *buf)
+ {
+ return ctx_id->mech_type->gm_ops
+- ->gss_unwrap(ctx_id, offset, buf);
++ ->gss_unwrap(ctx_id, offset, len, buf);
+ }
+
+
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index 65b67b257302..322fd48887f9 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -900,7 +900,7 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct g
+ if (svc_getnl(&buf->head[0]) != seq)
+ goto out;
+ /* trim off the mic and padding at the end before returning */
+- buf->len -= 4 + round_up_to_quad(mic.len);
++ xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4);
+ stat = 0;
+ out:
+ kfree(mic.data);
+@@ -928,7 +928,7 @@ static int
+ unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
+ {
+ u32 priv_len, maj_stat;
+- int pad, saved_len, remaining_len, offset;
++ int pad, remaining_len, offset;
+
+ clear_bit(RQ_SPLICE_OK, &rqstp->rq_flags);
+
+@@ -948,12 +948,8 @@ unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gs
+ buf->len -= pad;
+ fix_priv_head(buf, pad);
+
+- /* Maybe it would be better to give gss_unwrap a length parameter: */
+- saved_len = buf->len;
+- buf->len = priv_len;
+- maj_stat = gss_unwrap(ctx, 0, buf);
++ maj_stat = gss_unwrap(ctx, 0, priv_len, buf);
+ pad = priv_len - buf->len;
+- buf->len = saved_len;
+ buf->len -= pad;
+ /* The upper layers assume the buffer is aligned on 4-byte boundaries.
+ * In the krb5p case, at least, the data ends up offset, so we need to
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 7324b21f923e..3ceaefb2f0bc 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -2416,6 +2416,11 @@ rpc_check_timeout(struct rpc_task *task)
+ {
+ struct rpc_clnt *clnt = task->tk_client;
+
++ if (RPC_SIGNALLED(task)) {
++ rpc_call_rpcerror(task, -ERESTARTSYS);
++ return;
++ }
++
+ if (xprt_adjust_timeout(task->tk_rqstp) == 0)
+ return;
+
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index e5497dc2475b..f6da616267ce 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -1150,6 +1150,47 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
+ }
+ EXPORT_SYMBOL_GPL(xdr_buf_subsegment);
+
++/**
++ * xdr_buf_trim - lop at most "len" bytes off the end of "buf"
++ * @buf: buf to be trimmed
++ * @len: number of bytes to reduce "buf" by
++ *
++ * Trim an xdr_buf by the given number of bytes by fixing up the lengths. Note
++ * that it's possible that we'll trim less than that amount if the xdr_buf is
++ * too small, or if (for instance) it's all in the head and the parser has
++ * already read too far into it.
++ */
++void xdr_buf_trim(struct xdr_buf *buf, unsigned int len)
++{
++ size_t cur;
++ unsigned int trim = len;
++
++ if (buf->tail[0].iov_len) {
++ cur = min_t(size_t, buf->tail[0].iov_len, trim);
++ buf->tail[0].iov_len -= cur;
++ trim -= cur;
++ if (!trim)
++ goto fix_len;
++ }
++
++ if (buf->page_len) {
++ cur = min_t(unsigned int, buf->page_len, trim);
++ buf->page_len -= cur;
++ trim -= cur;
++ if (!trim)
++ goto fix_len;
++ }
++
++ if (buf->head[0].iov_len) {
++ cur = min_t(size_t, buf->head[0].iov_len, trim);
++ buf->head[0].iov_len -= cur;
++ trim -= cur;
++ }
++fix_len:
++ buf->len -= (len - trim);
++}
++EXPORT_SYMBOL_GPL(xdr_buf_trim);
++
+ static void __read_bytes_from_xdr_buf(struct xdr_buf *subbuf, void *obj, unsigned int len)
+ {
+ unsigned int this_len;
+diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
+index 1a0ae0c61353..4b43910a6ed2 100644
+--- a/net/sunrpc/xprtrdma/backchannel.c
++++ b/net/sunrpc/xprtrdma/backchannel.c
+@@ -115,7 +115,7 @@ int xprt_rdma_bc_send_reply(struct rpc_rqst *rqst)
+ if (rc < 0)
+ goto failed_marshal;
+
+- if (rpcrdma_ep_post(&r_xprt->rx_ia, &r_xprt->rx_ep, req))
++ if (rpcrdma_post_sends(r_xprt, req))
+ goto drop_connection;
+ return 0;
+
+diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
+index 125297c9aa3e..79059d48f52b 100644
+--- a/net/sunrpc/xprtrdma/frwr_ops.c
++++ b/net/sunrpc/xprtrdma/frwr_ops.c
+@@ -372,18 +372,22 @@ static void frwr_wc_fastreg(struct ib_cq *cq, struct ib_wc *wc)
+ }
+
+ /**
+- * frwr_send - post Send WR containing the RPC Call message
+- * @ia: interface adapter
+- * @req: Prepared RPC Call
++ * frwr_send - post Send WRs containing the RPC Call message
++ * @r_xprt: controlling transport instance
++ * @req: prepared RPC Call
+ *
+ * For FRWR, chain any FastReg WRs to the Send WR. Only a
+ * single ib_post_send call is needed to register memory
+ * and then post the Send WR.
+ *
+- * Returns the result of ib_post_send.
++ * Returns the return code from ib_post_send.
++ *
++ * Caller must hold the transport send lock to ensure that the
++ * pointers to the transport's rdma_cm_id and QP are stable.
+ */
+-int frwr_send(struct rpcrdma_ia *ia, struct rpcrdma_req *req)
++int frwr_send(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
+ {
++ struct rpcrdma_ia *ia = &r_xprt->rx_ia;
+ struct ib_send_wr *post_wr;
+ struct rpcrdma_mr *mr;
+
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index 3cfeba68ee9a..46e7949788e1 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -694,7 +694,7 @@ xprt_rdma_send_request(struct rpc_rqst *rqst)
+ goto drop_connection;
+ rqst->rq_xtime = ktime_get();
+
+- if (rpcrdma_ep_post(&r_xprt->rx_ia, &r_xprt->rx_ep, req))
++ if (rpcrdma_post_sends(r_xprt, req))
+ goto drop_connection;
+
+ rqst->rq_xmit_bytes_sent += rqst->rq_snd_buf.len;
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 353f61ac8d51..a48b99f3682c 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -1502,20 +1502,17 @@ static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb)
+ }
+
+ /**
+- * rpcrdma_ep_post - Post WRs to a transport's Send Queue
+- * @ia: transport's device information
+- * @ep: transport's RDMA endpoint information
++ * rpcrdma_post_sends - Post WRs to a transport's Send Queue
++ * @r_xprt: controlling transport instance
+ * @req: rpcrdma_req containing the Send WR to post
+ *
+ * Returns 0 if the post was successful, otherwise -ENOTCONN
+ * is returned.
+ */
+-int
+-rpcrdma_ep_post(struct rpcrdma_ia *ia,
+- struct rpcrdma_ep *ep,
+- struct rpcrdma_req *req)
++int rpcrdma_post_sends(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
+ {
+ struct ib_send_wr *send_wr = &req->rl_wr;
++ struct rpcrdma_ep *ep = &r_xprt->rx_ep;
+ int rc;
+
+ if (!ep->rep_send_count || kref_read(&req->rl_kref) > 1) {
+@@ -1526,8 +1523,8 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia,
+ --ep->rep_send_count;
+ }
+
+- rc = frwr_send(ia, req);
+- trace_xprtrdma_post_send(req, rc);
++ trace_xprtrdma_post_send(req);
++ rc = frwr_send(r_xprt, req);
+ if (rc)
+ return -ENOTCONN;
+ return 0;
+diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
+index 37d5080c250b..600574a0d838 100644
+--- a/net/sunrpc/xprtrdma/xprt_rdma.h
++++ b/net/sunrpc/xprtrdma/xprt_rdma.h
+@@ -469,8 +469,7 @@ void rpcrdma_ep_destroy(struct rpcrdma_xprt *r_xprt);
+ int rpcrdma_ep_connect(struct rpcrdma_ep *, struct rpcrdma_ia *);
+ void rpcrdma_ep_disconnect(struct rpcrdma_ep *, struct rpcrdma_ia *);
+
+-int rpcrdma_ep_post(struct rpcrdma_ia *, struct rpcrdma_ep *,
+- struct rpcrdma_req *);
++int rpcrdma_post_sends(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req);
+ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp);
+
+ /*
+@@ -544,7 +543,7 @@ struct rpcrdma_mr_seg *frwr_map(struct rpcrdma_xprt *r_xprt,
+ struct rpcrdma_mr_seg *seg,
+ int nsegs, bool writing, __be32 xid,
+ struct rpcrdma_mr *mr);
+-int frwr_send(struct rpcrdma_ia *ia, struct rpcrdma_req *req);
++int frwr_send(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req);
+ void frwr_reminv(struct rpcrdma_rep *rep, struct list_head *mrs);
+ void frwr_unmap_sync(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req);
+ void frwr_unmap_async(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req);
+diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
+index 3e8dea6e0a95..6dc3078649fa 100644
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -34,7 +34,7 @@ struct sym_entry {
+ unsigned int len;
+ unsigned int start_pos;
+ unsigned int percpu_absolute;
+- unsigned char sym[0];
++ unsigned char sym[];
+ };
+
+ struct addr_range {
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 20dd08e1f675..2a688b711a9a 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -120,6 +120,17 @@ static void snd_rawmidi_input_event_work(struct work_struct *work)
+ runtime->event(runtime->substream);
+ }
+
++/* buffer refcount management: call with runtime->lock held */
++static inline void snd_rawmidi_buffer_ref(struct snd_rawmidi_runtime *runtime)
++{
++ runtime->buffer_ref++;
++}
++
++static inline void snd_rawmidi_buffer_unref(struct snd_rawmidi_runtime *runtime)
++{
++ runtime->buffer_ref--;
++}
++
+ static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream)
+ {
+ struct snd_rawmidi_runtime *runtime;
+@@ -669,6 +680,11 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime,
+ if (!newbuf)
+ return -ENOMEM;
+ spin_lock_irq(&runtime->lock);
++ if (runtime->buffer_ref) {
++ spin_unlock_irq(&runtime->lock);
++ kvfree(newbuf);
++ return -EBUSY;
++ }
+ oldbuf = runtime->buffer;
+ runtime->buffer = newbuf;
+ runtime->buffer_size = params->buffer_size;
+@@ -1019,8 +1035,10 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
+ long result = 0, count1;
+ struct snd_rawmidi_runtime *runtime = substream->runtime;
+ unsigned long appl_ptr;
++ int err = 0;
+
+ spin_lock_irqsave(&runtime->lock, flags);
++ snd_rawmidi_buffer_ref(runtime);
+ while (count > 0 && runtime->avail) {
+ count1 = runtime->buffer_size - runtime->appl_ptr;
+ if (count1 > count)
+@@ -1039,16 +1057,19 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
+ if (userbuf) {
+ spin_unlock_irqrestore(&runtime->lock, flags);
+ if (copy_to_user(userbuf + result,
+- runtime->buffer + appl_ptr, count1)) {
+- return result > 0 ? result : -EFAULT;
+- }
++ runtime->buffer + appl_ptr, count1))
++ err = -EFAULT;
+ spin_lock_irqsave(&runtime->lock, flags);
++ if (err)
++ goto out;
+ }
+ result += count1;
+ count -= count1;
+ }
++ out:
++ snd_rawmidi_buffer_unref(runtime);
+ spin_unlock_irqrestore(&runtime->lock, flags);
+- return result;
++ return result > 0 ? result : err;
+ }
+
+ long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream,
+@@ -1342,6 +1363,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ return -EAGAIN;
+ }
+ }
++ snd_rawmidi_buffer_ref(runtime);
+ while (count > 0 && runtime->avail > 0) {
+ count1 = runtime->buffer_size - runtime->appl_ptr;
+ if (count1 > count)
+@@ -1373,6 +1395,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ }
+ __end:
+ count1 = runtime->avail < runtime->buffer_size;
++ snd_rawmidi_buffer_unref(runtime);
+ spin_unlock_irqrestore(&runtime->lock, flags);
+ if (count1)
+ snd_rawmidi_output_trigger(substream, 1);
+diff --git a/sound/firewire/amdtp-stream-trace.h b/sound/firewire/amdtp-stream-trace.h
+index 16c7f6605511..26e7cb555d3c 100644
+--- a/sound/firewire/amdtp-stream-trace.h
++++ b/sound/firewire/amdtp-stream-trace.h
+@@ -66,8 +66,7 @@ TRACE_EVENT(amdtp_packet,
+ __entry->irq,
+ __entry->index,
+ __print_array(__get_dynamic_array(cip_header),
+- __get_dynamic_array_len(cip_header),
+- sizeof(u8)))
++ __get_dynamic_array_len(cip_header), 1))
+ );
+
+ #endif
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 0c1a59d5ad59..0f3250417b95 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2320,7 +2320,9 @@ static int generic_hdmi_build_controls(struct hda_codec *codec)
+
+ for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
+ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
++ struct hdmi_eld *pin_eld = &per_pin->sink_eld;
+
++ pin_eld->eld_valid = false;
+ hdmi_present_sense(per_pin, 0);
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index da4863d7f7f2..d73c814358bf 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5743,6 +5743,15 @@ static void alc233_alc662_fixup_lenovo_dual_codecs(struct hda_codec *codec,
+ }
+ }
+
++static void alc225_fixup_s3_pop_noise(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++
++ codec->power_save_node = 1;
++}
++
+ /* Forcibly assign NID 0x03 to HP/LO while NID 0x02 to SPK for EQ */
+ static void alc274_fixup_bind_dacs(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+@@ -5847,6 +5856,7 @@ enum {
+ ALC269_FIXUP_HP_LINE1_MIC1_LED,
+ ALC269_FIXUP_INV_DMIC,
+ ALC269_FIXUP_LENOVO_DOCK,
++ ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST,
+ ALC269_FIXUP_NO_SHUTUP,
+ ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
+ ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
+@@ -5932,6 +5942,7 @@ enum {
+ ALC233_FIXUP_ACER_HEADSET_MIC,
+ ALC294_FIXUP_LENOVO_MIC_LOCATION,
+ ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
++ ALC225_FIXUP_S3_POP_NOISE,
+ ALC700_FIXUP_INTEL_REFERENCE,
+ ALC274_FIXUP_DELL_BIND_DACS,
+ ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+@@ -5967,6 +5978,7 @@ enum {
+ ALC294_FIXUP_ASUS_DUAL_SPK,
+ ALC285_FIXUP_THINKPAD_HEADSET_JACK,
+ ALC294_FIXUP_ASUS_HPE,
++ ALC294_FIXUP_ASUS_COEF_1B,
+ ALC285_FIXUP_HP_GPIO_LED,
+ };
+
+@@ -6165,6 +6177,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT
+ },
++ [ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc269_fixup_limit_int_mic_boost,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_LENOVO_DOCK,
++ },
+ [ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
+@@ -6817,6 +6835,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ { }
+ },
+ .chained = true,
++ .chain_id = ALC225_FIXUP_S3_POP_NOISE
++ },
++ [ALC225_FIXUP_S3_POP_NOISE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc225_fixup_s3_pop_noise,
++ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+ },
+ [ALC700_FIXUP_INTEL_REFERENCE] = {
+@@ -7089,6 +7113,17 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
+ },
++ [ALC294_FIXUP_ASUS_COEF_1B] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Set bit 10 to correct noisy output after reboot from
++ * Windows 10 (due to pop noise reduction?)
++ */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x1b },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x4e4b },
++ { }
++ },
++ },
+ [ALC285_FIXUP_HP_GPIO_LED] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_gpio_led,
+@@ -7260,6 +7295,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
++ SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B),
+ SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+@@ -7301,7 +7337,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
+- SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
+@@ -7440,6 +7476,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC269_FIXUP_HEADSET_MODE, .name = "headset-mode"},
+ {.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"},
+ {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
++ {.id = ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST, .name = "lenovo-dock-limit-boost"},
+ {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
+ {.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"},
+ {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
+@@ -8084,8 +8121,6 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->gen.mixer_nid = 0;
+ break;
+ case 0x10ec0225:
+- codec->power_save_node = 1;
+- /* fall through */
+ case 0x10ec0295:
+ case 0x10ec0299:
+ spec->codec_variant = ALC269_TYPE_ALC225;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 0686e056e39b..732580bdc6a4 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1592,13 +1592,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ msleep(20);
+
+- /* Zoom R16/24, Logitech H650e, Jabra 550a needs a tiny delay here,
+- * otherwise requests like get/set frequency return as failed despite
+- * actually succeeding.
++ /* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny
++ * delay here, otherwise requests like get/set frequency return as
++ * failed despite actually succeeding.
+ */
+ if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
+ chip->usb_id == USB_ID(0x046d, 0x0a46) ||
+- chip->usb_id == USB_ID(0x0b0e, 0x0349)) &&
++ chip->usb_id == USB_ID(0x0b0e, 0x0349) ||
++ chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ usleep_range(1000, 2000);
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/mmap.c b/tools/testing/selftests/bpf/prog_tests/mmap.c
+index 16a814eb4d64..b0e789678aa4 100644
+--- a/tools/testing/selftests/bpf/prog_tests/mmap.c
++++ b/tools/testing/selftests/bpf/prog_tests/mmap.c
+@@ -197,6 +197,15 @@ void test_mmap(void)
+ CHECK_FAIL(map_data->val[far] != 3 * 321);
+
+ munmap(tmp2, 4 * page_size);
++
++ /* map all 4 pages, but with pg_off=1 page, should fail */
++ tmp1 = mmap(NULL, 4 * page_size, PROT_READ, MAP_SHARED | MAP_FIXED,
++ data_map_fd, page_size /* initial page shift */);
++ if (CHECK(tmp1 != MAP_FAILED, "adv_mmap7", "unexpected success")) {
++ munmap(tmp1, 4 * page_size);
++ goto cleanup;
++ }
++
+ cleanup:
+ if (bss_mmaped)
+ CHECK_FAIL(munmap(bss_mmaped, bss_sz));
+diff --git a/tools/testing/selftests/bpf/progs/test_overhead.c b/tools/testing/selftests/bpf/progs/test_overhead.c
+index bfe9fbcb9684..e15c7589695e 100644
+--- a/tools/testing/selftests/bpf/progs/test_overhead.c
++++ b/tools/testing/selftests/bpf/progs/test_overhead.c
+@@ -33,13 +33,13 @@ int prog3(struct bpf_raw_tracepoint_args *ctx)
+ SEC("fentry/__set_task_comm")
+ int BPF_PROG(prog4, struct task_struct *tsk, const char *buf, bool exec)
+ {
+- return !tsk;
++ return 0;
+ }
+
+ SEC("fexit/__set_task_comm")
+ int BPF_PROG(prog5, struct task_struct *tsk, const char *buf, bool exec)
+ {
+- return !tsk;
++ return 0;
+ }
+
+ char _license[] SEC("license") = "GPL";
+diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest
+index 063ecb290a5a..144308a757b7 100755
+--- a/tools/testing/selftests/ftrace/ftracetest
++++ b/tools/testing/selftests/ftrace/ftracetest
+@@ -29,8 +29,25 @@ err_ret=1
+ # kselftest skip code is 4
+ err_skip=4
+
++# cgroup RT scheduling prevents chrt commands from succeeding, which
++# induces failures in test wakeup tests. Disable for the duration of
++# the tests.
++
++readonly sched_rt_runtime=/proc/sys/kernel/sched_rt_runtime_us
++
++sched_rt_runtime_orig=$(cat $sched_rt_runtime)
++
++setup() {
++ echo -1 > $sched_rt_runtime
++}
++
++cleanup() {
++ echo $sched_rt_runtime_orig > $sched_rt_runtime
++}
++
+ errexit() { # message
+ echo "Error: $1" 1>&2
++ cleanup
+ exit $err_ret
+ }
+
+@@ -39,6 +56,8 @@ if [ `id -u` -ne 0 ]; then
+ errexit "this must be run by root user"
+ fi
+
++setup
++
+ # Utilities
+ absdir() { # file_path
+ (cd `dirname $1`; pwd)
+@@ -235,6 +254,7 @@ TOTAL_RESULT=0
+
+ INSTANCE=
+ CASENO=0
++
+ testcase() { # testfile
+ CASENO=$((CASENO+1))
+ desc=`grep "^#[ \t]*description:" $1 | cut -f2 -d:`
+@@ -406,5 +426,7 @@ prlog "# of unsupported: " `echo $UNSUPPORTED_CASES | wc -w`
+ prlog "# of xfailed: " `echo $XFAILED_CASES | wc -w`
+ prlog "# of undefined(test bug): " `echo $UNDEFINED_CASES | wc -w`
+
++cleanup
++
+ # if no error, return 0
+ exit $TOTAL_RESULT
+diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc
+index 1bcb67dcae26..81490ecaaa92 100644
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc
+@@ -38,7 +38,7 @@ for width in 64 32 16 8; do
+ echo 0 > events/kprobes/testprobe/enable
+
+ : "Confirm the arguments is recorded in given types correctly"
+- ARGS=`grep "testprobe" trace | sed -e 's/.* arg1=\(.*\) arg2=\(.*\) arg3=\(.*\) arg4=\(.*\)/\1 \2 \3 \4/'`
++ ARGS=`grep "testprobe" trace | head -n 1 | sed -e 's/.* arg1=\(.*\) arg2=\(.*\) arg3=\(.*\) arg4=\(.*\)/\1 \2 \3 \4/'`
+ check_types $ARGS $width
+
+ : "Clear event for next loop"
+diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
+index 5945f062d749..7b288eb391b8 100644
+--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
++++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
+@@ -415,18 +415,20 @@ static const struct vgic_register_region vgic_v2_dist_registers[] = {
+ vgic_mmio_read_enable, vgic_mmio_write_cenable, NULL, NULL, 1,
+ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PENDING_SET,
+- vgic_mmio_read_pending, vgic_mmio_write_spending, NULL, NULL, 1,
++ vgic_mmio_read_pending, vgic_mmio_write_spending,
++ NULL, vgic_uaccess_write_spending, 1,
+ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PENDING_CLEAR,
+- vgic_mmio_read_pending, vgic_mmio_write_cpending, NULL, NULL, 1,
++ vgic_mmio_read_pending, vgic_mmio_write_cpending,
++ NULL, vgic_uaccess_write_cpending, 1,
+ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_ACTIVE_SET,
+ vgic_mmio_read_active, vgic_mmio_write_sactive,
+- NULL, vgic_mmio_uaccess_write_sactive, 1,
++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_sactive, 1,
+ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_ACTIVE_CLEAR,
+ vgic_mmio_read_active, vgic_mmio_write_cactive,
+- NULL, vgic_mmio_uaccess_write_cactive, 1,
++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_cactive, 1,
+ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PRI,
+ vgic_mmio_read_priority, vgic_mmio_write_priority, NULL, NULL,
+diff --git a/virt/kvm/arm/vgic/vgic-mmio-v3.c b/virt/kvm/arm/vgic/vgic-mmio-v3.c
+index ebc218840fc2..b1b066c148ce 100644
+--- a/virt/kvm/arm/vgic/vgic-mmio-v3.c
++++ b/virt/kvm/arm/vgic/vgic-mmio-v3.c
+@@ -494,11 +494,11 @@ static const struct vgic_register_region vgic_v3_dist_registers[] = {
+ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_BITS_PER_IRQ_SHARED(GICD_ISACTIVER,
+ vgic_mmio_read_active, vgic_mmio_write_sactive,
+- NULL, vgic_mmio_uaccess_write_sactive, 1,
++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_sactive, 1,
+ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_BITS_PER_IRQ_SHARED(GICD_ICACTIVER,
+ vgic_mmio_read_active, vgic_mmio_write_cactive,
+- NULL, vgic_mmio_uaccess_write_cactive,
++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_cactive,
+ 1, VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_BITS_PER_IRQ_SHARED(GICD_IPRIORITYR,
+ vgic_mmio_read_priority, vgic_mmio_write_priority, NULL, NULL,
+@@ -566,12 +566,12 @@ static const struct vgic_register_region vgic_v3_rd_registers[] = {
+ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_LENGTH_UACCESS(SZ_64K + GICR_ISACTIVER0,
+ vgic_mmio_read_active, vgic_mmio_write_sactive,
+- NULL, vgic_mmio_uaccess_write_sactive,
+- 4, VGIC_ACCESS_32bit),
++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_sactive, 4,
++ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_LENGTH_UACCESS(SZ_64K + GICR_ICACTIVER0,
+ vgic_mmio_read_active, vgic_mmio_write_cactive,
+- NULL, vgic_mmio_uaccess_write_cactive,
+- 4, VGIC_ACCESS_32bit),
++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_cactive, 4,
++ VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_LENGTH(SZ_64K + GICR_IPRIORITYR0,
+ vgic_mmio_read_priority, vgic_mmio_write_priority, 32,
+ VGIC_ACCESS_32bit | VGIC_ACCESS_8bit),
+diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
+index e7abd05ea896..b6824bba8248 100644
+--- a/virt/kvm/arm/vgic/vgic-mmio.c
++++ b/virt/kvm/arm/vgic/vgic-mmio.c
+@@ -179,17 +179,6 @@ unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu,
+ return value;
+ }
+
+-/* Must be called with irq->irq_lock held */
+-static void vgic_hw_irq_spending(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
+- bool is_uaccess)
+-{
+- if (is_uaccess)
+- return;
+-
+- irq->pending_latch = true;
+- vgic_irq_set_phys_active(irq, true);
+-}
+-
+ static bool is_vgic_v2_sgi(struct kvm_vcpu *vcpu, struct vgic_irq *irq)
+ {
+ return (vgic_irq_is_sgi(irq->intid) &&
+@@ -200,7 +189,6 @@ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
+ gpa_t addr, unsigned int len,
+ unsigned long val)
+ {
+- bool is_uaccess = !kvm_get_running_vcpu();
+ u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
+ int i;
+ unsigned long flags;
+@@ -215,22 +203,49 @@ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
+ }
+
+ raw_spin_lock_irqsave(&irq->irq_lock, flags);
++
++ irq->pending_latch = true;
+ if (irq->hw)
+- vgic_hw_irq_spending(vcpu, irq, is_uaccess);
+- else
+- irq->pending_latch = true;
++ vgic_irq_set_phys_active(irq, true);
++
+ vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
+ vgic_put_irq(vcpu->kvm, irq);
+ }
+ }
+
+-/* Must be called with irq->irq_lock held */
+-static void vgic_hw_irq_cpending(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
+- bool is_uaccess)
++int vgic_uaccess_write_spending(struct kvm_vcpu *vcpu,
++ gpa_t addr, unsigned int len,
++ unsigned long val)
+ {
+- if (is_uaccess)
+- return;
++ u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
++ int i;
++ unsigned long flags;
++
++ for_each_set_bit(i, &val, len * 8) {
++ struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
++
++ raw_spin_lock_irqsave(&irq->irq_lock, flags);
++ irq->pending_latch = true;
++
++ /*
++ * GICv2 SGIs are terribly broken. We can't restore
++ * the source of the interrupt, so just pick the vcpu
++ * itself as the source...
++ */
++ if (is_vgic_v2_sgi(vcpu, irq))
++ irq->source |= BIT(vcpu->vcpu_id);
++
++ vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
++
++ vgic_put_irq(vcpu->kvm, irq);
++ }
+
++ return 0;
++}
++
++/* Must be called with irq->irq_lock held */
++static void vgic_hw_irq_cpending(struct kvm_vcpu *vcpu, struct vgic_irq *irq)
++{
+ irq->pending_latch = false;
+
+ /*
+@@ -253,7 +268,6 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu,
+ gpa_t addr, unsigned int len,
+ unsigned long val)
+ {
+- bool is_uaccess = !kvm_get_running_vcpu();
+ u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
+ int i;
+ unsigned long flags;
+@@ -270,7 +284,7 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu,
+ raw_spin_lock_irqsave(&irq->irq_lock, flags);
+
+ if (irq->hw)
+- vgic_hw_irq_cpending(vcpu, irq, is_uaccess);
++ vgic_hw_irq_cpending(vcpu, irq);
+ else
+ irq->pending_latch = false;
+
+@@ -279,8 +293,68 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu,
+ }
+ }
+
+-unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
+- gpa_t addr, unsigned int len)
++int vgic_uaccess_write_cpending(struct kvm_vcpu *vcpu,
++ gpa_t addr, unsigned int len,
++ unsigned long val)
++{
++ u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
++ int i;
++ unsigned long flags;
++
++ for_each_set_bit(i, &val, len * 8) {
++ struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
++
++ raw_spin_lock_irqsave(&irq->irq_lock, flags);
++ /*
++ * More fun with GICv2 SGIs! If we're clearing one of them
++ * from userspace, which source vcpu to clear? Let's not
++ * even think of it, and blow the whole set.
++ */
++ if (is_vgic_v2_sgi(vcpu, irq))
++ irq->source = 0;
++
++ irq->pending_latch = false;
++
++ raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
++
++ vgic_put_irq(vcpu->kvm, irq);
++ }
++
++ return 0;
++}
++
++/*
++ * If we are fiddling with an IRQ's active state, we have to make sure the IRQ
++ * is not queued on some running VCPU's LRs, because then the change to the
++ * active state can be overwritten when the VCPU's state is synced coming back
++ * from the guest.
++ *
++ * For shared interrupts as well as GICv3 private interrupts, we have to
++ * stop all the VCPUs because interrupts can be migrated while we don't hold
++ * the IRQ locks and we don't want to be chasing moving targets.
++ *
++ * For GICv2 private interrupts we don't have to do anything because
++ * userspace accesses to the VGIC state already require all VCPUs to be
++ * stopped, and only the VCPU itself can modify its private interrupts
++ * active state, which guarantees that the VCPU is not running.
++ */
++static void vgic_access_active_prepare(struct kvm_vcpu *vcpu, u32 intid)
++{
++ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
++ intid >= VGIC_NR_PRIVATE_IRQS)
++ kvm_arm_halt_guest(vcpu->kvm);
++}
++
++/* See vgic_access_active_prepare */
++static void vgic_access_active_finish(struct kvm_vcpu *vcpu, u32 intid)
++{
++ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
++ intid >= VGIC_NR_PRIVATE_IRQS)
++ kvm_arm_resume_guest(vcpu->kvm);
++}
++
++static unsigned long __vgic_mmio_read_active(struct kvm_vcpu *vcpu,
++ gpa_t addr, unsigned int len)
+ {
+ u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
+ u32 value = 0;
+@@ -290,6 +364,10 @@ unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
+ for (i = 0; i < len * 8; i++) {
+ struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
+
++ /*
++ * Even for HW interrupts, don't evaluate the HW state as
++ * all the guest is interested in is the virtual state.
++ */
+ if (irq->active)
+ value |= (1U << i);
+
+@@ -299,6 +377,29 @@ unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
+ return value;
+ }
+
++unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
++ gpa_t addr, unsigned int len)
++{
++ u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
++ u32 val;
++
++ mutex_lock(&vcpu->kvm->lock);
++ vgic_access_active_prepare(vcpu, intid);
++
++ val = __vgic_mmio_read_active(vcpu, addr, len);
++
++ vgic_access_active_finish(vcpu, intid);
++ mutex_unlock(&vcpu->kvm->lock);
++
++ return val;
++}
++
++unsigned long vgic_uaccess_read_active(struct kvm_vcpu *vcpu,
++ gpa_t addr, unsigned int len)
++{
++ return __vgic_mmio_read_active(vcpu, addr, len);
++}
++
+ /* Must be called with irq->irq_lock held */
+ static void vgic_hw_irq_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
+ bool active, bool is_uaccess)
+@@ -350,36 +451,6 @@ static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
+ raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
+ }
+
+-/*
+- * If we are fiddling with an IRQ's active state, we have to make sure the IRQ
+- * is not queued on some running VCPU's LRs, because then the change to the
+- * active state can be overwritten when the VCPU's state is synced coming back
+- * from the guest.
+- *
+- * For shared interrupts, we have to stop all the VCPUs because interrupts can
+- * be migrated while we don't hold the IRQ locks and we don't want to be
+- * chasing moving targets.
+- *
+- * For private interrupts we don't have to do anything because userspace
+- * accesses to the VGIC state already require all VCPUs to be stopped, and
+- * only the VCPU itself can modify its private interrupts active state, which
+- * guarantees that the VCPU is not running.
+- */
+-static void vgic_change_active_prepare(struct kvm_vcpu *vcpu, u32 intid)
+-{
+- if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
+- intid >= VGIC_NR_PRIVATE_IRQS)
+- kvm_arm_halt_guest(vcpu->kvm);
+-}
+-
+-/* See vgic_change_active_prepare */
+-static void vgic_change_active_finish(struct kvm_vcpu *vcpu, u32 intid)
+-{
+- if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
+- intid >= VGIC_NR_PRIVATE_IRQS)
+- kvm_arm_resume_guest(vcpu->kvm);
+-}
+-
+ static void __vgic_mmio_write_cactive(struct kvm_vcpu *vcpu,
+ gpa_t addr, unsigned int len,
+ unsigned long val)
+@@ -401,11 +472,11 @@ void vgic_mmio_write_cactive(struct kvm_vcpu *vcpu,
+ u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
+
+ mutex_lock(&vcpu->kvm->lock);
+- vgic_change_active_prepare(vcpu, intid);
++ vgic_access_active_prepare(vcpu, intid);
+
+ __vgic_mmio_write_cactive(vcpu, addr, len, val);
+
+- vgic_change_active_finish(vcpu, intid);
++ vgic_access_active_finish(vcpu, intid);
+ mutex_unlock(&vcpu->kvm->lock);
+ }
+
+@@ -438,11 +509,11 @@ void vgic_mmio_write_sactive(struct kvm_vcpu *vcpu,
+ u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
+
+ mutex_lock(&vcpu->kvm->lock);
+- vgic_change_active_prepare(vcpu, intid);
++ vgic_access_active_prepare(vcpu, intid);
+
+ __vgic_mmio_write_sactive(vcpu, addr, len, val);
+
+- vgic_change_active_finish(vcpu, intid);
++ vgic_access_active_finish(vcpu, intid);
+ mutex_unlock(&vcpu->kvm->lock);
+ }
+
+diff --git a/virt/kvm/arm/vgic/vgic-mmio.h b/virt/kvm/arm/vgic/vgic-mmio.h
+index 5af2aefad435..b127f889113e 100644
+--- a/virt/kvm/arm/vgic/vgic-mmio.h
++++ b/virt/kvm/arm/vgic/vgic-mmio.h
+@@ -149,9 +149,20 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu,
+ gpa_t addr, unsigned int len,
+ unsigned long val);
+
++int vgic_uaccess_write_spending(struct kvm_vcpu *vcpu,
++ gpa_t addr, unsigned int len,
++ unsigned long val);
++
++int vgic_uaccess_write_cpending(struct kvm_vcpu *vcpu,
++ gpa_t addr, unsigned int len,
++ unsigned long val);
++
+ unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
+ gpa_t addr, unsigned int len);
+
++unsigned long vgic_uaccess_read_active(struct kvm_vcpu *vcpu,
++ gpa_t addr, unsigned int len);
++
+ void vgic_mmio_write_cactive(struct kvm_vcpu *vcpu,
+ gpa_t addr, unsigned int len,
+ unsigned long val);
diff --git a/1700_x86-gcc-10-early-boot-crash-fix.patch b/1700_x86-gcc-10-early-boot-crash-fix.patch
deleted file mode 100644
index 8cdf651..0000000
--- a/1700_x86-gcc-10-early-boot-crash-fix.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-From f670269a42bfdd2c83a1118cc3d1b475547eac22 Mon Sep 17 00:00:00 2001
-From: Borislav Petkov <bp@suse.de>
-Date: Wed, 22 Apr 2020 18:11:30 +0200
-Subject: x86: Fix early boot crash on gcc-10, next try
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-... or the odyssey of trying to disable the stack protector for the
-function which generates the stack canary value.
-
-The whole story started with Sergei reporting a boot crash with a kernel
-built with gcc-10:
-
- Kernel panic — not syncing: stack-protector: Kernel stack is corrupted in: start_secondary
- CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5—00235—gfffb08b37df9 #139
- Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M—D3H, BIOS F12 11/14/2013
- Call Trace:
- dump_stack
- panic
- ? start_secondary
- __stack_chk_fail
- start_secondary
- secondary_startup_64
- -—-[ end Kernel panic — not syncing: stack—protector: Kernel stack is corrupted in: start_secondary
-
-This happens because gcc-10 tail-call optimizes the last function call
-in start_secondary() - cpu_startup_entry() - and thus emits a stack
-canary check which fails because the canary value changes after the
-boot_init_stack_canary() call.
-
-To fix that, the initial attempt was to mark the one function which
-generates the stack canary with:
-
- __attribute__((optimize("-fno-stack-protector"))) ... start_secondary(void *unused)
-
-however, using the optimize attribute doesn't work cumulatively
-as the attribute does not add to but rather replaces previously
-supplied optimization options - roughly all -fxxx options.
-
-The key one among them being -fno-omit-frame-pointer and thus leading to
-not present frame pointer - frame pointer which the kernel needs.
-
-The next attempt to prevent compilers from tail-call optimizing
-the last function call cpu_startup_entry(), shy of carving out
-start_secondary() into a separate compilation unit and building it with
--fno-stack-protector, is this one.
-
-The current solution is short and sweet, and reportedly, is supported by
-both compilers so let's see how far we'll get this time.
-
-Reported-by: Sergei Trofimovich <slyfox@gentoo.org>
-Signed-off-by: Borislav Petkov <bp@suse.de>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Reviewed-by: Kees Cook <keescook@chromium.org>
-Link: https://lkml.kernel.org/r/20200314164451.346497-1-slyfox@gentoo.org
----
- arch/x86/include/asm/stackprotector.h | 7 ++++++-
- arch/x86/kernel/smpboot.c | 8 ++++++++
- arch/x86/xen/smp_pv.c | 1 +
- include/linux/compiler.h | 6 ++++++
- 4 files changed, 21 insertions(+), 1 deletion(-)
-
-diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
-index 91e29b6a86a5..9804a7957f4e 100644
---- a/arch/x86/include/asm/stackprotector.h
-+++ b/arch/x86/include/asm/stackprotector.h
-@@ -55,8 +55,13 @@
- /*
- * Initialize the stackprotector canary value.
- *
-- * NOTE: this must only be called from functions that never return,
-+ * NOTE: this must only be called from functions that never return
- * and it must always be inlined.
-+ *
-+ * In addition, it should be called from a compilation unit for which
-+ * stack protector is disabled. Alternatively, the caller should not end
-+ * with a function call which gets tail-call optimized as that would
-+ * lead to checking a modified canary value.
- */
- static __always_inline void boot_init_stack_canary(void)
- {
-diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index fe3ab9632f3b..4f275ac7830b 100644
---- a/arch/x86/kernel/smpboot.c
-+++ b/arch/x86/kernel/smpboot.c
-@@ -266,6 +266,14 @@ static void notrace start_secondary(void *unused)
-
- wmb();
- cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
-+
-+ /*
-+ * Prevent tail call to cpu_startup_entry() because the stack protector
-+ * guard has been changed a couple of function calls up, in
-+ * boot_init_stack_canary() and must not be checked before tail calling
-+ * another function.
-+ */
-+ prevent_tail_call_optimization();
- }
-
- /**
-diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
-index 8fb8a50a28b4..f2adb63b2d7c 100644
---- a/arch/x86/xen/smp_pv.c
-+++ b/arch/x86/xen/smp_pv.c
-@@ -93,6 +93,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void)
- cpu_bringup();
- boot_init_stack_canary();
- cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
-+ prevent_tail_call_optimization();
- }
-
- void xen_smp_intr_free_pv(unsigned int cpu)
-diff --git a/include/linux/compiler.h b/include/linux/compiler.h
-index 034b0a644efc..732754d96039 100644
---- a/include/linux/compiler.h
-+++ b/include/linux/compiler.h
-@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const int *off)
- /* &a[0] degrades to a pointer: a different type from an array */
- #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
-
-+/*
-+ * This is needed in functions which generate the stack canary, see
-+ * arch/x86/kernel/smpboot.c::start_secondary() for an example.
-+ */
-+#define prevent_tail_call_optimization() asm("")
-+
- #endif /* __LINUX_COMPILER_H */
---
-cgit 1.2-0.3.lf.el7
-
next reply other threads:[~2020-05-20 11:35 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-20 11:35 Mike Pagano [this message]
-- strict thread matches above, loose matches on Subject: below --
2020-06-17 16:41 [gentoo-commits] proj/linux-patches:5.6 commit in: / Mike Pagano
2020-06-10 19:41 Mike Pagano
2020-06-07 21:54 Mike Pagano
2020-06-03 11:44 Mike Pagano
2020-05-27 16:32 Mike Pagano
2020-05-20 23:13 Mike Pagano
2020-05-14 11:34 Mike Pagano
2020-05-13 16:48 Mike Pagano
2020-05-13 12:06 Mike Pagano
2020-05-11 22:46 Mike Pagano
2020-05-09 19:45 Mike Pagano
2020-05-06 11:47 Mike Pagano
2020-05-02 19:25 Mike Pagano
2020-05-02 13:26 Mike Pagano
2020-04-29 17:55 Mike Pagano
2020-04-23 11:56 Mike Pagano
2020-04-21 11:24 Mike Pagano
2020-04-17 14:50 Mike Pagano
2020-04-15 15:40 Mike Pagano
2020-04-13 12:21 Mike Pagano
2020-04-12 15:29 Mike Pagano
2020-04-08 17:39 Mike Pagano
2020-04-08 12:45 Mike Pagano
2020-04-02 11:37 Mike Pagano
2020-04-02 11:35 Mike Pagano
2020-04-01 12:06 Mike Pagano
2020-03-30 12:31 Mike Pagano
2020-03-30 11:33 Mike Pagano
2020-03-30 11:15 Mike Pagano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1589974524.d63cc5104b3bda1cd127301cdf13bc6d8d0c7d9e.mpagano@gentoo \
--to=mpagano@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox