From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 6D0DB1382C5 for ; Wed, 20 May 2020 11:35:50 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id A7C03E08EB; Wed, 20 May 2020 11:35:49 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 370FCE08EB for ; Wed, 20 May 2020 11:35:49 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 48F4B34F22D for ; Wed, 20 May 2020 11:35:47 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id EDFDC24E for ; Wed, 20 May 2020 11:35:45 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1589974524.d63cc5104b3bda1cd127301cdf13bc6d8d0c7d9e.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:5.6 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1013_linux-5.6.14.patch 1700_x86-gcc-10-early-boot-crash-fix.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: d63cc5104b3bda1cd127301cdf13bc6d8d0c7d9e X-VCS-Branch: 5.6 Date: Wed, 20 May 2020 11:35:45 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: d4873d69-9ba3-4199-a23e-102f4187ac23 X-Archives-Hash: 7c017c24a4272f1279af09de3d458764 commit: d63cc5104b3bda1cd127301cdf13bc6d8d0c7d9e Author: Mike Pagano gentoo org> AuthorDate: Wed May 20 11:35:24 2020 +0000 Commit: Mike Pagano gentoo org> CommitDate: Wed May 20 11:35:24 2020 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d63cc510 Linux patch 5.6.14 and removal of redundant patch Removed x86: Fix early boot crash on gcc-10 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 12 +- 1013_linux-5.6.14.patch | 7349 ++++++++++++++++++++++++++++ 1700_x86-gcc-10-early-boot-crash-fix.patch | 131 - 3 files changed, 7357 insertions(+), 135 deletions(-) diff --git a/0000_README b/0000_README index 6a6ec25..3a37e9d 100644 --- a/0000_README +++ b/0000_README @@ -95,6 +95,14 @@ Patch: 1012_linux-5.6.13.patch From: http://www.kernel.org Desc: Linux 5.6.13 +Patch: 1013_linux-5.6.14.patch +From: http://www.kernel.org +Desc: Linux 5.6.14 + +Patch: 1013_linux-5.6.14.patch +From: http://www.kernel.org +Desc: Linux 5.6.14 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. @@ -103,10 +111,6 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/ Desc: Enable link security restrictions by default. -Patch: 1700_x86-gcc-10-early-boot-crash-fix.patch -From: https://https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/patch/?id=f670269a42bfdd2c83a1118cc3d1b475547eac22 -Desc: x86: Fix early boot crash on gcc-10, - Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758 diff --git a/1013_linux-5.6.14.patch b/1013_linux-5.6.14.patch new file mode 100644 index 0000000..da7d2c2 --- /dev/null +++ b/1013_linux-5.6.14.patch @@ -0,0 +1,7349 @@ +diff --git a/Documentation/core-api/printk-formats.rst b/Documentation/core-api/printk-formats.rst +index 8ebe46b1af39..5dfcc4592b23 100644 +--- a/Documentation/core-api/printk-formats.rst ++++ b/Documentation/core-api/printk-formats.rst +@@ -112,6 +112,20 @@ used when printing stack backtraces. The specifier takes into + consideration the effect of compiler optimisations which may occur + when tail-calls are used and marked with the noreturn GCC attribute. + ++Probed Pointers from BPF / tracing ++---------------------------------- ++ ++:: ++ ++ %pks kernel string ++ %pus user string ++ ++The ``k`` and ``u`` specifiers are used for printing prior probed memory from ++either kernel memory (k) or user memory (u). The subsequent ``s`` specifier ++results in printing a string. For direct use in regular vsnprintf() the (k) ++and (u) annotation is ignored, however, when used out of BPF's bpf_trace_printk(), ++for example, it reads the memory it is pointing to without faulting. ++ + Kernel Pointers + --------------- + +diff --git a/Documentation/devicetree/bindings/dma/fsl-edma.txt b/Documentation/devicetree/bindings/dma/fsl-edma.txt +index e77b08ebcd06..ee1754739b4b 100644 +--- a/Documentation/devicetree/bindings/dma/fsl-edma.txt ++++ b/Documentation/devicetree/bindings/dma/fsl-edma.txt +@@ -10,7 +10,8 @@ Required properties: + - compatible : + - "fsl,vf610-edma" for eDMA used similar to that on Vybrid vf610 SoC + - "fsl,imx7ulp-edma" for eDMA2 used similar to that on i.mx7ulp +- - "fsl,fsl,ls1028a-edma" for eDMA used similar to that on Vybrid vf610 SoC ++ - "fsl,ls1028a-edma" followed by "fsl,vf610-edma" for eDMA used on the ++ LS1028A SoC. + - reg : Specifies base physical address(s) and size of the eDMA registers. + The 1st region is eDMA control register's address and size. + The 2nd and the 3rd regions are programmable channel multiplexing +diff --git a/Makefile b/Makefile +index d252219666fd..713f93cceffe 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 6 +-SUBLEVEL = 13 ++SUBLEVEL = 14 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +@@ -708,12 +708,9 @@ else ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE + KBUILD_CFLAGS += -Os + endif + +-ifdef CONFIG_CC_DISABLE_WARN_MAYBE_UNINITIALIZED +-KBUILD_CFLAGS += -Wno-maybe-uninitialized +-endif +- + # Tell gcc to never replace conditional load with a non-conditional one + KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0) ++KBUILD_CFLAGS += $(call cc-option,-fno-allow-store-data-races) + + include scripts/Makefile.kcov + include scripts/Makefile.gcc-plugins +@@ -861,6 +858,17 @@ KBUILD_CFLAGS += -Wno-pointer-sign + # disable stringop warnings in gcc 8+ + KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation) + ++# We'll want to enable this eventually, but it's not going away for 5.7 at least ++KBUILD_CFLAGS += $(call cc-disable-warning, zero-length-bounds) ++KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds) ++KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow) ++ ++# Another good warning that we'll want to enable eventually ++KBUILD_CFLAGS += $(call cc-disable-warning, restrict) ++ ++# Enabled with W=2, disabled by default as noisy ++KBUILD_CFLAGS += $(call cc-disable-warning, maybe-uninitialized) ++ + # disable invalid "can't wrap" optimizations for signed / pointers + KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow) + +diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi +index 5f5ee16f07a3..a341511f014c 100644 +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -172,6 +172,7 @@ + #address-cells = <1>; + ranges = <0x51000000 0x51000000 0x3000 + 0x0 0x20000000 0x10000000>; ++ dma-ranges; + /** + * To enable PCI endpoint mode, disable the pcie1_rc + * node and enable pcie1_ep mode. +@@ -185,7 +186,6 @@ + device_type = "pci"; + ranges = <0x81000000 0 0 0x03000 0 0x00010000 + 0x82000000 0 0x20013000 0x13000 0 0xffed000>; +- dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; + bus-range = <0x00 0xff>; + #interrupt-cells = <1>; + num-lanes = <1>; +@@ -230,6 +230,7 @@ + #address-cells = <1>; + ranges = <0x51800000 0x51800000 0x3000 + 0x0 0x30000000 0x10000000>; ++ dma-ranges; + status = "disabled"; + pcie2_rc: pcie@51800000 { + reg = <0x51800000 0x2000>, <0x51802000 0x14c>, <0x1000 0x2000>; +@@ -240,7 +241,6 @@ + device_type = "pci"; + ranges = <0x81000000 0 0 0x03000 0 0x00010000 + 0x82000000 0 0x30013000 0x13000 0 0xffed000>; +- dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; + bus-range = <0x00 0xff>; + #interrupt-cells = <1>; + num-lanes = <1>; +diff --git a/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts b/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts +index 0cd75dadf292..188639738dc3 100644 +--- a/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts ++++ b/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts +@@ -75,8 +75,8 @@ + imx27-phycard-s-rdk { + pinctrl_i2c1: i2c1grp { + fsl,pins = < +- MX27_PAD_I2C2_SDA__I2C2_SDA 0x0 +- MX27_PAD_I2C2_SCL__I2C2_SCL 0x0 ++ MX27_PAD_I2C_DATA__I2C_DATA 0x0 ++ MX27_PAD_I2C_CLK__I2C_CLK 0x0 + >; + }; + +diff --git a/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts b/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts +index 0d594e4bd559..a1173bf5bff5 100644 +--- a/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts ++++ b/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts +@@ -38,7 +38,7 @@ + }; + + &switch_ports { +- /delete-node/ port@2; ++ /delete-node/ port@3; + }; + + &touchscreen { +diff --git a/arch/arm/boot/dts/r8a73a4.dtsi b/arch/arm/boot/dts/r8a73a4.dtsi +index a5cd31229fbd..a3ba722a9d7f 100644 +--- a/arch/arm/boot/dts/r8a73a4.dtsi ++++ b/arch/arm/boot/dts/r8a73a4.dtsi +@@ -131,7 +131,14 @@ + cmt1: timer@e6130000 { + compatible = "renesas,r8a73a4-cmt1", "renesas,rcar-gen2-cmt1"; + reg = <0 0xe6130000 0 0x1004>; +- interrupts = ; ++ interrupts = , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; + clocks = <&mstp3_clks R8A73A4_CLK_CMT1>; + clock-names = "fck"; + power-domains = <&pd_c5>; +diff --git a/arch/arm/boot/dts/r8a7740.dtsi b/arch/arm/boot/dts/r8a7740.dtsi +index ebc1ff64f530..90feb2cf9960 100644 +--- a/arch/arm/boot/dts/r8a7740.dtsi ++++ b/arch/arm/boot/dts/r8a7740.dtsi +@@ -479,7 +479,7 @@ + cpg_clocks: cpg_clocks@e6150000 { + compatible = "renesas,r8a7740-cpg-clocks"; + reg = <0xe6150000 0x10000>; +- clocks = <&extal1_clk>, <&extalr_clk>; ++ clocks = <&extal1_clk>, <&extal2_clk>, <&extalr_clk>; + #clock-cells = <1>; + clock-output-names = "system", "pllc0", "pllc1", + "pllc2", "r", +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +index abe04f4ad7d8..eeaa95baaa10 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +@@ -2204,7 +2204,7 @@ + reg = <0x0 0xff400000 0x0 0x40000>; + interrupts = ; + clocks = <&clkc CLKID_USB1_DDR_BRIDGE>; +- clock-names = "ddr"; ++ clock-names = "otg"; + phys = <&usb2_phy1>; + phy-names = "usb2-phy"; + dr_mode = "peripheral"; +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi +index 554863429aa6..e2094575f528 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi +@@ -152,6 +152,10 @@ + clock-latency = <50000>; + }; + ++&frddr_a { ++ status = "okay"; ++}; ++ + &frddr_b { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts +index ccd0bced01e8..2e66d6418a59 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts +@@ -545,7 +545,7 @@ + &usb { + status = "okay"; + dr_mode = "host"; +- vbus-regulator = <&usb_pwr_en>; ++ vbus-supply = <&usb_pwr_en>; + }; + + &usb2_phy0 { +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index a44b5438e842..882e913436ca 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -661,7 +661,7 @@ + reg = <0x30bd0000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SDMA1_ROOT>, +- <&clk IMX8MN_CLK_SDMA1_ROOT>; ++ <&clk IMX8MN_CLK_AHB>; + clock-names = "ipg", "ahb"; + #dma-cells = <3>; + fsl,sdma-ram-script-name = "imx/sdma/sdma-imx7d.bin"; +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +index fff6115f2670..a85b85d85a5f 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +@@ -658,8 +658,8 @@ + s11 { + qcom,saw-leader; + regulator-always-on; +- regulator-min-microvolt = <1230000>; +- regulator-max-microvolt = <1230000>; ++ regulator-min-microvolt = <980000>; ++ regulator-max-microvolt = <980000>; + }; + }; + +diff --git a/arch/arm64/boot/dts/renesas/r8a77980.dtsi b/arch/arm64/boot/dts/renesas/r8a77980.dtsi +index b340fb469999..1692bc95129e 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77980.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a77980.dtsi +@@ -1318,6 +1318,7 @@ + ipmmu_vip0: mmu@e7b00000 { + compatible = "renesas,ipmmu-r8a77980"; + reg = <0 0xe7b00000 0 0x1000>; ++ renesas,ipmmu-main = <&ipmmu_mm 4>; + power-domains = <&sysc R8A77980_PD_ALWAYS_ON>; + #iommu-cells = <1>; + }; +@@ -1325,6 +1326,7 @@ + ipmmu_vip1: mmu@e7960000 { + compatible = "renesas,ipmmu-r8a77980"; + reg = <0 0xe7960000 0 0x1000>; ++ renesas,ipmmu-main = <&ipmmu_mm 11>; + power-domains = <&sysc R8A77980_PD_ALWAYS_ON>; + #iommu-cells = <1>; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts +index 49c4b96da3d4..6abc6f4a86cf 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts +@@ -92,7 +92,7 @@ + &i2c1 { + status = "okay"; + +- rk805: rk805@18 { ++ rk805: pmic@18 { + compatible = "rockchip,rk805"; + reg = <0x18>; + interrupt-parent = <&gpio2>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts +index 62936b432f9a..304fad1a0b57 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts +@@ -169,7 +169,7 @@ + &i2c1 { + status = "okay"; + +- rk805: rk805@18 { ++ rk805: pmic@18 { + compatible = "rockchip,rk805"; + reg = <0x18>; + interrupt-parent = <&gpio2>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index 33cc21fcf4c1..5c4238a80144 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -410,7 +410,7 @@ + reset-names = "usb3-otg"; + status = "disabled"; + +- usbdrd_dwc3_0: dwc3 { ++ usbdrd_dwc3_0: usb@fe800000 { + compatible = "snps,dwc3"; + reg = <0x0 0xfe800000 0x0 0x100000>; + interrupts = ; +@@ -446,7 +446,7 @@ + reset-names = "usb3-otg"; + status = "disabled"; + +- usbdrd_dwc3_1: dwc3 { ++ usbdrd_dwc3_1: usb@fe900000 { + compatible = "snps,dwc3"; + reg = <0x0 0xfe900000 0x0 0x100000>; + interrupts = ; +diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c +index 8e9c924423b4..a0b144cfaea7 100644 +--- a/arch/arm64/kernel/machine_kexec.c ++++ b/arch/arm64/kernel/machine_kexec.c +@@ -177,6 +177,7 @@ void machine_kexec(struct kimage *kimage) + * the offline CPUs. Therefore, we must use the __* variant here. + */ + __flush_icache_range((uintptr_t)reboot_code_buffer, ++ (uintptr_t)reboot_code_buffer + + arm64_relocate_new_kernel_size); + + /* Flush the kimage list and its buffers. */ +diff --git a/arch/powerpc/include/asm/book3s/32/kup.h b/arch/powerpc/include/asm/book3s/32/kup.h +index 3c0ba22dc360..db0a1c281587 100644 +--- a/arch/powerpc/include/asm/book3s/32/kup.h ++++ b/arch/powerpc/include/asm/book3s/32/kup.h +@@ -75,7 +75,7 @@ + + .macro kuap_check current, gpr + #ifdef CONFIG_PPC_KUAP_DEBUG +- lwz \gpr2, KUAP(thread) ++ lwz \gpr, KUAP(thread) + 999: twnei \gpr, 0 + EMIT_BUG_ENTRY 999b, __FILE__, __LINE__, (BUGFLAG_WARNING | BUGFLAG_ONCE) + #endif +diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h +index 2f500debae21..0969285996cb 100644 +--- a/arch/powerpc/include/asm/uaccess.h ++++ b/arch/powerpc/include/asm/uaccess.h +@@ -166,13 +166,17 @@ do { \ + ({ \ + long __pu_err; \ + __typeof__(*(ptr)) __user *__pu_addr = (ptr); \ ++ __typeof__(*(ptr)) __pu_val = (x); \ ++ __typeof__(size) __pu_size = (size); \ ++ \ + if (!is_kernel_addr((unsigned long)__pu_addr)) \ + might_fault(); \ +- __chk_user_ptr(ptr); \ ++ __chk_user_ptr(__pu_addr); \ + if (do_allow) \ +- __put_user_size((x), __pu_addr, (size), __pu_err); \ ++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \ + else \ +- __put_user_size_allowed((x), __pu_addr, (size), __pu_err); \ ++ __put_user_size_allowed(__pu_val, __pu_addr, __pu_size, __pu_err); \ ++ \ + __pu_err; \ + }) + +@@ -180,9 +184,13 @@ do { \ + ({ \ + long __pu_err = -EFAULT; \ + __typeof__(*(ptr)) __user *__pu_addr = (ptr); \ ++ __typeof__(*(ptr)) __pu_val = (x); \ ++ __typeof__(size) __pu_size = (size); \ ++ \ + might_fault(); \ +- if (access_ok(__pu_addr, size)) \ +- __put_user_size((x), __pu_addr, (size), __pu_err); \ ++ if (access_ok(__pu_addr, __pu_size)) \ ++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \ ++ \ + __pu_err; \ + }) + +@@ -190,8 +198,12 @@ do { \ + ({ \ + long __pu_err; \ + __typeof__(*(ptr)) __user *__pu_addr = (ptr); \ +- __chk_user_ptr(ptr); \ +- __put_user_size((x), __pu_addr, (size), __pu_err); \ ++ __typeof__(*(ptr)) __pu_val = (x); \ ++ __typeof__(size) __pu_size = (size); \ ++ \ ++ __chk_user_ptr(__pu_addr); \ ++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \ ++ \ + __pu_err; \ + }) + +@@ -283,15 +295,18 @@ do { \ + long __gu_err; \ + __long_type(*(ptr)) __gu_val; \ + __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ +- __chk_user_ptr(ptr); \ ++ __typeof__(size) __gu_size = (size); \ ++ \ ++ __chk_user_ptr(__gu_addr); \ + if (!is_kernel_addr((unsigned long)__gu_addr)) \ + might_fault(); \ + barrier_nospec(); \ + if (do_allow) \ +- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ ++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \ + else \ +- __get_user_size_allowed(__gu_val, __gu_addr, (size), __gu_err); \ ++ __get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \ + (x) = (__typeof__(*(ptr)))__gu_val; \ ++ \ + __gu_err; \ + }) + +@@ -300,12 +315,15 @@ do { \ + long __gu_err = -EFAULT; \ + __long_type(*(ptr)) __gu_val = 0; \ + __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ ++ __typeof__(size) __gu_size = (size); \ ++ \ + might_fault(); \ +- if (access_ok(__gu_addr, (size))) { \ ++ if (access_ok(__gu_addr, __gu_size)) { \ + barrier_nospec(); \ +- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ ++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \ + } \ + (x) = (__force __typeof__(*(ptr)))__gu_val; \ ++ \ + __gu_err; \ + }) + +@@ -314,10 +332,13 @@ do { \ + long __gu_err; \ + __long_type(*(ptr)) __gu_val; \ + __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ +- __chk_user_ptr(ptr); \ ++ __typeof__(size) __gu_size = (size); \ ++ \ ++ __chk_user_ptr(__gu_addr); \ + barrier_nospec(); \ +- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ ++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \ + (x) = (__force __typeof__(*(ptr)))__gu_val; \ ++ \ + __gu_err; \ + }) + +diff --git a/arch/powerpc/kernel/ima_arch.c b/arch/powerpc/kernel/ima_arch.c +index e34116255ced..957abd592075 100644 +--- a/arch/powerpc/kernel/ima_arch.c ++++ b/arch/powerpc/kernel/ima_arch.c +@@ -19,12 +19,12 @@ bool arch_ima_get_secureboot(void) + * to be stored as an xattr or as an appended signature. + * + * To avoid duplicate signature verification as much as possible, the IMA +- * policy rule for module appraisal is added only if CONFIG_MODULE_SIG_FORCE ++ * policy rule for module appraisal is added only if CONFIG_MODULE_SIG + * is not enabled. + */ + static const char *const secure_rules[] = { + "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", +-#ifndef CONFIG_MODULE_SIG_FORCE ++#ifndef CONFIG_MODULE_SIG + "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", + #endif + NULL +@@ -50,7 +50,7 @@ static const char *const secure_and_trusted_rules[] = { + "measure func=KEXEC_KERNEL_CHECK template=ima-modsig", + "measure func=MODULE_CHECK template=ima-modsig", + "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", +-#ifndef CONFIG_MODULE_SIG_FORCE ++#ifndef CONFIG_MODULE_SIG + "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", + #endif + NULL +diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S +index a3951567118a..e7f8f9f1b3f4 100644 +--- a/arch/powerpc/kernel/vdso32/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S +@@ -218,11 +218,11 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + blr + + /* +- * invalid clock ++ * syscall fallback + */ + 99: +- li r3, EINVAL +- crset so ++ li r0,__NR_clock_getres ++ sc + blr + .cfi_endproc + V_FUNCTION_END(__kernel_clock_getres) +diff --git a/arch/riscv/include/asm/perf_event.h b/arch/riscv/include/asm/perf_event.h +index 0234048b12bc..062efd3a1d5d 100644 +--- a/arch/riscv/include/asm/perf_event.h ++++ b/arch/riscv/include/asm/perf_event.h +@@ -12,19 +12,14 @@ + #include + #include + ++#ifdef CONFIG_RISCV_BASE_PMU + #define RISCV_BASE_COUNTERS 2 + + /* + * The RISCV_MAX_COUNTERS parameter should be specified. + */ + +-#ifdef CONFIG_RISCV_BASE_PMU + #define RISCV_MAX_COUNTERS 2 +-#endif +- +-#ifndef RISCV_MAX_COUNTERS +-#error "Please provide a valid RISCV_MAX_COUNTERS for the PMU." +-#endif + + /* + * These are the indexes of bits in counteren register *minus* 1, +@@ -82,6 +77,7 @@ struct riscv_pmu { + int irq; + }; + ++#endif + #ifdef CONFIG_PERF_EVENTS + #define perf_arch_bpf_user_pt_regs(regs) (struct user_regs_struct *)regs + #endif +diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile +index f40205cb9a22..1dcc095dc23c 100644 +--- a/arch/riscv/kernel/Makefile ++++ b/arch/riscv/kernel/Makefile +@@ -38,7 +38,7 @@ obj-$(CONFIG_MODULE_SECTIONS) += module-sections.o + obj-$(CONFIG_FUNCTION_TRACER) += mcount.o ftrace.o + obj-$(CONFIG_DYNAMIC_FTRACE) += mcount-dyn.o + +-obj-$(CONFIG_PERF_EVENTS) += perf_event.o ++obj-$(CONFIG_RISCV_BASE_PMU) += perf_event.o + obj-$(CONFIG_PERF_EVENTS) += perf_callchain.o + obj-$(CONFIG_HAVE_PERF_REGS) += perf_regs.o + obj-$(CONFIG_RISCV_SBI) += sbi.o +diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile +index 33b16f4212f7..a4ee3a0e7d20 100644 +--- a/arch/riscv/kernel/vdso/Makefile ++++ b/arch/riscv/kernel/vdso/Makefile +@@ -33,15 +33,15 @@ $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE + $(call if_changed,vdsold) + + # We also create a special relocatable object that should mirror the symbol +-# table and layout of the linked DSO. With ld -R we can then refer to +-# these symbols in the kernel code rather than hand-coded addresses. ++# table and layout of the linked DSO. With ld --just-symbols we can then ++# refer to these symbols in the kernel code rather than hand-coded addresses. + + SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \ + -Wl,--build-id -Wl,--hash-style=both + $(obj)/vdso-dummy.o: $(src)/vdso.lds $(obj)/rt_sigreturn.o FORCE + $(call if_changed,vdsold) + +-LDFLAGS_vdso-syms.o := -r -R ++LDFLAGS_vdso-syms.o := -r --just-symbols + $(obj)/vdso-syms.o: $(obj)/vdso-dummy.o FORCE + $(call if_changed,ld) + +diff --git a/arch/x86/include/asm/ftrace.h b/arch/x86/include/asm/ftrace.h +index 85be2f506272..89af0d2c62aa 100644 +--- a/arch/x86/include/asm/ftrace.h ++++ b/arch/x86/include/asm/ftrace.h +@@ -56,6 +56,12 @@ struct dyn_arch_ftrace { + + #ifndef __ASSEMBLY__ + ++#if defined(CONFIG_FUNCTION_TRACER) && defined(CONFIG_DYNAMIC_FTRACE) ++extern void set_ftrace_ops_ro(void); ++#else ++static inline void set_ftrace_ops_ro(void) { } ++#endif ++ + #define ARCH_HAS_SYSCALL_MATCH_SYM_NAME + static inline bool arch_syscall_match_sym_name(const char *sym, const char *name) + { +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 7ba99c0759cf..c121b8f24597 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -574,6 +574,7 @@ struct kvm_vcpu_arch { + unsigned long cr4; + unsigned long cr4_guest_owned_bits; + unsigned long cr8; ++ u32 host_pkru; + u32 pkru; + u32 hflags; + u64 efer; +diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h +index 91e29b6a86a5..9804a7957f4e 100644 +--- a/arch/x86/include/asm/stackprotector.h ++++ b/arch/x86/include/asm/stackprotector.h +@@ -55,8 +55,13 @@ + /* + * Initialize the stackprotector canary value. + * +- * NOTE: this must only be called from functions that never return, ++ * NOTE: this must only be called from functions that never return + * and it must always be inlined. ++ * ++ * In addition, it should be called from a compilation unit for which ++ * stack protector is disabled. Alternatively, the caller should not end ++ * with a function call which gets tail-call optimized as that would ++ * lead to checking a modified canary value. + */ + static __always_inline void boot_init_stack_canary(void) + { +diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c +index 37a0aeaf89e7..b0e641793be4 100644 +--- a/arch/x86/kernel/ftrace.c ++++ b/arch/x86/kernel/ftrace.c +@@ -407,7 +407,8 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size) + + set_vm_flush_reset_perms(trampoline); + +- set_memory_ro((unsigned long)trampoline, npages); ++ if (likely(system_state != SYSTEM_BOOTING)) ++ set_memory_ro((unsigned long)trampoline, npages); + set_memory_x((unsigned long)trampoline, npages); + return (unsigned long)trampoline; + fail: +@@ -415,6 +416,32 @@ fail: + return 0; + } + ++void set_ftrace_ops_ro(void) ++{ ++ struct ftrace_ops *ops; ++ unsigned long start_offset; ++ unsigned long end_offset; ++ unsigned long npages; ++ unsigned long size; ++ ++ do_for_each_ftrace_op(ops, ftrace_ops_list) { ++ if (!(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP)) ++ continue; ++ ++ if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) { ++ start_offset = (unsigned long)ftrace_regs_caller; ++ end_offset = (unsigned long)ftrace_regs_caller_end; ++ } else { ++ start_offset = (unsigned long)ftrace_caller; ++ end_offset = (unsigned long)ftrace_epilogue; ++ } ++ size = end_offset - start_offset; ++ size = size + RET_SIZE + sizeof(void *); ++ npages = DIV_ROUND_UP(size, PAGE_SIZE); ++ set_memory_ro((unsigned long)ops->trampoline, npages); ++ } while_for_each_ftrace_op(ops); ++} ++ + static unsigned long calc_trampoline_call_offset(bool save_regs) + { + unsigned long start_offset; +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 69881b2d446c..9674321ce3a3 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -262,6 +262,14 @@ static void notrace start_secondary(void *unused) + + wmb(); + cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); ++ ++ /* ++ * Prevent tail call to cpu_startup_entry() because the stack protector ++ * guard has been changed a couple of function calls up, in ++ * boot_init_stack_canary() and must not be checked before tail calling ++ * another function. ++ */ ++ prevent_tail_call_optimization(); + } + + /** +diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c +index 80537dcbddef..9414f02a55ea 100644 +--- a/arch/x86/kernel/unwind_orc.c ++++ b/arch/x86/kernel/unwind_orc.c +@@ -611,23 +611,23 @@ EXPORT_SYMBOL_GPL(unwind_next_frame); + void __unwind_start(struct unwind_state *state, struct task_struct *task, + struct pt_regs *regs, unsigned long *first_frame) + { +- if (!orc_init) +- goto done; +- + memset(state, 0, sizeof(*state)); + state->task = task; + ++ if (!orc_init) ++ goto err; ++ + /* + * Refuse to unwind the stack of a task while it's executing on another + * CPU. This check is racy, but that's ok: the unwinder has other + * checks to prevent it from going off the rails. + */ + if (task_on_another_cpu(task)) +- goto done; ++ goto err; + + if (regs) { + if (user_mode(regs)) +- goto done; ++ goto the_end; + + state->ip = regs->ip; + state->sp = regs->sp; +@@ -660,6 +660,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, + * generate some kind of backtrace if this happens. + */ + void *next_page = (void *)PAGE_ALIGN((unsigned long)state->sp); ++ state->error = true; + if (get_stack_info(next_page, state->task, &state->stack_info, + &state->stack_mask)) + return; +@@ -685,8 +686,9 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, + + return; + +-done: ++err: ++ state->error = true; ++the_end: + state->stack_info.type = STACK_TYPE_UNKNOWN; +- return; + } + EXPORT_SYMBOL_GPL(__unwind_start); +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index eec7b2d93104..3a2f05ef51fa 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -5504,6 +5504,23 @@ static bool nested_vmx_exit_handled_vmcs_access(struct kvm_vcpu *vcpu, + return 1 & (b >> (field & 7)); + } + ++static bool nested_vmx_exit_handled_mtf(struct vmcs12 *vmcs12) ++{ ++ u32 entry_intr_info = vmcs12->vm_entry_intr_info_field; ++ ++ if (nested_cpu_has_mtf(vmcs12)) ++ return true; ++ ++ /* ++ * An MTF VM-exit may be injected into the guest by setting the ++ * interruption-type to 7 (other event) and the vector field to 0. Such ++ * is the case regardless of the 'monitor trap flag' VM-execution ++ * control. ++ */ ++ return entry_intr_info == (INTR_INFO_VALID_MASK ++ | INTR_TYPE_OTHER_EVENT); ++} ++ + /* + * Return 1 if we should exit from L2 to L1 to handle an exit, or 0 if we + * should handle it ourselves in L0 (and then continue L2). Only call this +@@ -5618,7 +5635,7 @@ bool nested_vmx_exit_reflected(struct kvm_vcpu *vcpu, u32 exit_reason) + case EXIT_REASON_MWAIT_INSTRUCTION: + return nested_cpu_has(vmcs12, CPU_BASED_MWAIT_EXITING); + case EXIT_REASON_MONITOR_TRAP_FLAG: +- return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_TRAP_FLAG); ++ return nested_vmx_exit_handled_mtf(vmcs12); + case EXIT_REASON_MONITOR_INSTRUCTION: + return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_EXITING); + case EXIT_REASON_PAUSE_INSTRUCTION: +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index c1ffe7d24f83..a83c94a971ee 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -1380,7 +1380,6 @@ void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu) + + vmx_vcpu_pi_load(vcpu, cpu); + +- vmx->host_pkru = read_pkru(); + vmx->host_debugctlmsr = get_debugctlmsr(); + } + +@@ -6538,11 +6537,6 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu) + + kvm_load_guest_xsave_state(vcpu); + +- if (static_cpu_has(X86_FEATURE_PKU) && +- kvm_read_cr4_bits(vcpu, X86_CR4_PKE) && +- vcpu->arch.pkru != vmx->host_pkru) +- __write_pkru(vcpu->arch.pkru); +- + pt_guest_enter(vmx); + + atomic_switch_perf_msrs(vmx); +@@ -6631,18 +6625,6 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu) + + pt_guest_exit(vmx); + +- /* +- * eager fpu is enabled if PKEY is supported and CR4 is switched +- * back on host, so it is safe to read guest PKRU from current +- * XSAVE. +- */ +- if (static_cpu_has(X86_FEATURE_PKU) && +- kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) { +- vcpu->arch.pkru = rdpkru(); +- if (vcpu->arch.pkru != vmx->host_pkru) +- __write_pkru(vmx->host_pkru); +- } +- + kvm_load_host_xsave_state(vcpu); + + vmx->nested.nested_run_pending = 0; +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 17650bda4331..7f3371a39ed0 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -809,11 +809,25 @@ void kvm_load_guest_xsave_state(struct kvm_vcpu *vcpu) + vcpu->arch.ia32_xss != host_xss) + wrmsrl(MSR_IA32_XSS, vcpu->arch.ia32_xss); + } ++ ++ if (static_cpu_has(X86_FEATURE_PKU) && ++ (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) || ++ (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU)) && ++ vcpu->arch.pkru != vcpu->arch.host_pkru) ++ __write_pkru(vcpu->arch.pkru); + } + EXPORT_SYMBOL_GPL(kvm_load_guest_xsave_state); + + void kvm_load_host_xsave_state(struct kvm_vcpu *vcpu) + { ++ if (static_cpu_has(X86_FEATURE_PKU) && ++ (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) || ++ (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU))) { ++ vcpu->arch.pkru = rdpkru(); ++ if (vcpu->arch.pkru != vcpu->arch.host_pkru) ++ __write_pkru(vcpu->arch.host_pkru); ++ } ++ + if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE)) { + + if (vcpu->arch.xcr0 != host_xcr0) +@@ -3529,6 +3543,9 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu) + + kvm_x86_ops->vcpu_load(vcpu, cpu); + ++ /* Save host pkru register if supported */ ++ vcpu->arch.host_pkru = read_pkru(); ++ + /* Apply any externally detected TSC adjustments (due to suspend) */ + if (unlikely(vcpu->arch.tsc_offset_adjustment)) { + adjust_tsc_offset_host(vcpu, vcpu->arch.tsc_offset_adjustment); +@@ -3722,7 +3739,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu, + unsigned bank_num = mcg_cap & 0xff, bank; + + r = -EINVAL; +- if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS) ++ if (!bank_num || bank_num > KVM_MAX_MCE_BANKS) + goto out; + if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000)) + goto out; +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index abbdecb75fad..023e1ec5e153 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -54,6 +54,7 @@ + #include + #include + #include ++#include + + #include "mm_internal.h" + +@@ -1288,6 +1289,8 @@ void mark_rodata_ro(void) + all_end = roundup((unsigned long)_brk_end, PMD_SIZE); + set_memory_nx(text_end, (all_end - text_end) >> PAGE_SHIFT); + ++ set_ftrace_ops_ro(); ++ + #ifdef CONFIG_CPA_DEBUG + printk(KERN_INFO "Testing CPA: undo %lx-%lx\n", start, end); + set_memory_rw(start, (end-start) >> PAGE_SHIFT); +diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c +index 802ee5bba66c..0cebe5db691d 100644 +--- a/arch/x86/xen/smp_pv.c ++++ b/arch/x86/xen/smp_pv.c +@@ -92,6 +92,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void) + cpu_bringup(); + boot_init_stack_canary(); + cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); ++ prevent_tail_call_optimization(); + } + + void xen_smp_intr_free_pv(unsigned int cpu) +diff --git a/crypto/lrw.c b/crypto/lrw.c +index 63c485c0d8a6..9b20fc4b2efb 100644 +--- a/crypto/lrw.c ++++ b/crypto/lrw.c +@@ -287,7 +287,7 @@ static void exit_tfm(struct crypto_skcipher *tfm) + crypto_free_skcipher(ctx->child); + } + +-static void free(struct skcipher_instance *inst) ++static void free_inst(struct skcipher_instance *inst) + { + crypto_drop_skcipher(skcipher_instance_ctx(inst)); + kfree(inst); +@@ -400,7 +400,7 @@ static int create(struct crypto_template *tmpl, struct rtattr **tb) + inst->alg.encrypt = encrypt; + inst->alg.decrypt = decrypt; + +- inst->free = free; ++ inst->free = free_inst; + + err = skcipher_register_instance(tmpl, inst); + if (err) +diff --git a/crypto/xts.c b/crypto/xts.c +index 29efa15f1495..983dae2bb2db 100644 +--- a/crypto/xts.c ++++ b/crypto/xts.c +@@ -322,7 +322,7 @@ static void exit_tfm(struct crypto_skcipher *tfm) + crypto_free_cipher(ctx->tweak); + } + +-static void free(struct skcipher_instance *inst) ++static void free_inst(struct skcipher_instance *inst) + { + crypto_drop_skcipher(skcipher_instance_ctx(inst)); + kfree(inst); +@@ -434,7 +434,7 @@ static int create(struct crypto_template *tmpl, struct rtattr **tb) + inst->alg.encrypt = encrypt; + inst->alg.decrypt = decrypt; + +- inst->free = free; ++ inst->free = free_inst; + + err = skcipher_register_instance(tmpl, inst); + if (err) +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 35dd2f1fb0e6..03b3067811c9 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -2042,23 +2042,31 @@ void acpi_ec_set_gpe_wake_mask(u8 action) + acpi_set_gpe_wake_mask(NULL, first_ec->gpe, action); + } + +-bool acpi_ec_other_gpes_active(void) +-{ +- return acpi_any_gpe_status_set(first_ec ? first_ec->gpe : U32_MAX); +-} +- + bool acpi_ec_dispatch_gpe(void) + { + u32 ret; + + if (!first_ec) ++ return acpi_any_gpe_status_set(U32_MAX); ++ ++ /* ++ * Report wakeup if the status bit is set for any enabled GPE other ++ * than the EC one. ++ */ ++ if (acpi_any_gpe_status_set(first_ec->gpe)) ++ return true; ++ ++ if (ec_no_wakeup) + return false; + ++ /* ++ * Dispatch the EC GPE in-band, but do not report wakeup in any case ++ * to allow the caller to process events properly after that. ++ */ + ret = acpi_dispatch_gpe(NULL, first_ec->gpe); +- if (ret == ACPI_INTERRUPT_HANDLED) { ++ if (ret == ACPI_INTERRUPT_HANDLED) + pm_pr_dbg("EC GPE dispatched\n"); +- return true; +- } ++ + return false; + } + #endif /* CONFIG_PM_SLEEP */ +diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h +index d44c591c4ee4..3616daec650b 100644 +--- a/drivers/acpi/internal.h ++++ b/drivers/acpi/internal.h +@@ -202,7 +202,6 @@ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit); + + #ifdef CONFIG_PM_SLEEP + void acpi_ec_flush_work(void); +-bool acpi_ec_other_gpes_active(void); + bool acpi_ec_dispatch_gpe(void); + #endif + +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 4edc8a3ce40f..3850704570c0 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -1013,20 +1013,10 @@ static bool acpi_s2idle_wake(void) + if (acpi_check_wakeup_handlers()) + return true; + +- /* +- * If the status bit is set for any enabled GPE other than the +- * EC one, the wakeup is regarded as a genuine one. +- */ +- if (acpi_ec_other_gpes_active()) ++ /* Check non-EC GPE wakeups and dispatch the EC GPE. */ ++ if (acpi_ec_dispatch_gpe()) + return true; + +- /* +- * If the EC GPE status bit has not been set, the wakeup is +- * regarded as a spurious one. +- */ +- if (!acpi_ec_dispatch_gpe()) +- return false; +- + /* + * Cancel the wakeup and process all pending events in case + * there are any wakeup ones in there. +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 0736248999b0..d52f33881ab6 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -32,6 +32,15 @@ struct virtio_blk_vq { + } ____cacheline_aligned_in_smp; + + struct virtio_blk { ++ /* ++ * This mutex must be held by anything that may run after ++ * virtblk_remove() sets vblk->vdev to NULL. ++ * ++ * blk-mq, virtqueue processing, and sysfs attribute code paths are ++ * shut down before vblk->vdev is set to NULL and therefore do not need ++ * to hold this mutex. ++ */ ++ struct mutex vdev_mutex; + struct virtio_device *vdev; + + /* The disk structure for the kernel. */ +@@ -43,6 +52,13 @@ struct virtio_blk { + /* Process context for config space updates */ + struct work_struct config_work; + ++ /* ++ * Tracks references from block_device_operations open/release and ++ * virtio_driver probe/remove so this object can be freed once no ++ * longer in use. ++ */ ++ refcount_t refs; ++ + /* What host tells us, plus 2 for header & tailer. */ + unsigned int sg_elems; + +@@ -294,10 +310,55 @@ out: + return err; + } + ++static void virtblk_get(struct virtio_blk *vblk) ++{ ++ refcount_inc(&vblk->refs); ++} ++ ++static void virtblk_put(struct virtio_blk *vblk) ++{ ++ if (refcount_dec_and_test(&vblk->refs)) { ++ ida_simple_remove(&vd_index_ida, vblk->index); ++ mutex_destroy(&vblk->vdev_mutex); ++ kfree(vblk); ++ } ++} ++ ++static int virtblk_open(struct block_device *bd, fmode_t mode) ++{ ++ struct virtio_blk *vblk = bd->bd_disk->private_data; ++ int ret = 0; ++ ++ mutex_lock(&vblk->vdev_mutex); ++ ++ if (vblk->vdev) ++ virtblk_get(vblk); ++ else ++ ret = -ENXIO; ++ ++ mutex_unlock(&vblk->vdev_mutex); ++ return ret; ++} ++ ++static void virtblk_release(struct gendisk *disk, fmode_t mode) ++{ ++ struct virtio_blk *vblk = disk->private_data; ++ ++ virtblk_put(vblk); ++} ++ + /* We provide getgeo only to please some old bootloader/partitioning tools */ + static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo) + { + struct virtio_blk *vblk = bd->bd_disk->private_data; ++ int ret = 0; ++ ++ mutex_lock(&vblk->vdev_mutex); ++ ++ if (!vblk->vdev) { ++ ret = -ENXIO; ++ goto out; ++ } + + /* see if the host passed in geometry config */ + if (virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_GEOMETRY)) { +@@ -313,11 +374,15 @@ static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo) + geo->sectors = 1 << 5; + geo->cylinders = get_capacity(bd->bd_disk) >> 11; + } +- return 0; ++out: ++ mutex_unlock(&vblk->vdev_mutex); ++ return ret; + } + + static const struct block_device_operations virtblk_fops = { + .owner = THIS_MODULE, ++ .open = virtblk_open, ++ .release = virtblk_release, + .getgeo = virtblk_getgeo, + }; + +@@ -657,6 +722,10 @@ static int virtblk_probe(struct virtio_device *vdev) + goto out_free_index; + } + ++ /* This reference is dropped in virtblk_remove(). */ ++ refcount_set(&vblk->refs, 1); ++ mutex_init(&vblk->vdev_mutex); ++ + vblk->vdev = vdev; + vblk->sg_elems = sg_elems; + +@@ -822,8 +891,6 @@ out: + static void virtblk_remove(struct virtio_device *vdev) + { + struct virtio_blk *vblk = vdev->priv; +- int index = vblk->index; +- int refc; + + /* Make sure no work handler is accessing the device. */ + flush_work(&vblk->config_work); +@@ -833,18 +900,21 @@ static void virtblk_remove(struct virtio_device *vdev) + + blk_mq_free_tag_set(&vblk->tag_set); + ++ mutex_lock(&vblk->vdev_mutex); ++ + /* Stop all the virtqueues. */ + vdev->config->reset(vdev); + +- refc = kref_read(&disk_to_dev(vblk->disk)->kobj.kref); ++ /* Virtqueues are stopped, nothing can use vblk->vdev anymore. */ ++ vblk->vdev = NULL; ++ + put_disk(vblk->disk); + vdev->config->del_vqs(vdev); + kfree(vblk->vqs); +- kfree(vblk); + +- /* Only free device id if we don't have any users */ +- if (refc == 1) +- ida_simple_remove(&vd_index_ida, index); ++ mutex_unlock(&vblk->vdev_mutex); ++ ++ virtblk_put(vblk); + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 305544b68b8a..f22b7aed6e64 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -3512,6 +3512,9 @@ static int __clk_core_init(struct clk_core *core) + out: + clk_pm_runtime_put(core); + unlock: ++ if (ret) ++ hlist_del_init(&core->child_node); ++ + clk_prepare_unlock(); + + if (!ret) +diff --git a/drivers/clk/rockchip/clk-rk3228.c b/drivers/clk/rockchip/clk-rk3228.c +index d17cfb7a3ff4..d7243c09cc84 100644 +--- a/drivers/clk/rockchip/clk-rk3228.c ++++ b/drivers/clk/rockchip/clk-rk3228.c +@@ -156,8 +156,6 @@ PNAME(mux_i2s_out_p) = { "i2s1_pre", "xin12m" }; + PNAME(mux_i2s2_p) = { "i2s2_src", "i2s2_frac", "xin12m" }; + PNAME(mux_sclk_spdif_p) = { "sclk_spdif_src", "spdif_frac", "xin12m" }; + +-PNAME(mux_aclk_gpu_pre_p) = { "cpll_gpu", "gpll_gpu", "hdmiphy_gpu", "usb480m_gpu" }; +- + PNAME(mux_uart0_p) = { "uart0_src", "uart0_frac", "xin24m" }; + PNAME(mux_uart1_p) = { "uart1_src", "uart1_frac", "xin24m" }; + PNAME(mux_uart2_p) = { "uart2_src", "uart2_frac", "xin24m" }; +@@ -468,16 +466,9 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = { + RK2928_CLKSEL_CON(24), 6, 10, DFLAGS, + RK2928_CLKGATE_CON(2), 8, GFLAGS), + +- GATE(0, "cpll_gpu", "cpll", 0, +- RK2928_CLKGATE_CON(3), 13, GFLAGS), +- GATE(0, "gpll_gpu", "gpll", 0, +- RK2928_CLKGATE_CON(3), 13, GFLAGS), +- GATE(0, "hdmiphy_gpu", "hdmiphy", 0, +- RK2928_CLKGATE_CON(3), 13, GFLAGS), +- GATE(0, "usb480m_gpu", "usb480m", 0, ++ COMPOSITE(0, "aclk_gpu_pre", mux_pll_src_4plls_p, 0, ++ RK2928_CLKSEL_CON(34), 5, 2, MFLAGS, 0, 5, DFLAGS, + RK2928_CLKGATE_CON(3), 13, GFLAGS), +- COMPOSITE_NOGATE(0, "aclk_gpu_pre", mux_aclk_gpu_pre_p, 0, +- RK2928_CLKSEL_CON(34), 5, 2, MFLAGS, 0, 5, DFLAGS), + + COMPOSITE(SCLK_SPI0, "sclk_spi0", mux_pll_src_2plls_p, 0, + RK2928_CLKSEL_CON(25), 8, 1, MFLAGS, 0, 7, DFLAGS, +@@ -582,8 +573,8 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = { + GATE(0, "pclk_peri_noc", "pclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(12), 2, GFLAGS), + + /* PD_GPU */ +- GATE(ACLK_GPU, "aclk_gpu", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(13), 14, GFLAGS), +- GATE(0, "aclk_gpu_noc", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(13), 15, GFLAGS), ++ GATE(ACLK_GPU, "aclk_gpu", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(7), 14, GFLAGS), ++ GATE(0, "aclk_gpu_noc", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(7), 15, GFLAGS), + + /* PD_BUS */ + GATE(0, "sclk_initmem_mbist", "aclk_cpu", 0, RK2928_CLKGATE_CON(8), 1, GFLAGS), +diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c +index 062266034d84..9019624e37bc 100644 +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -461,7 +461,6 @@ static char * __init clkctrl_get_name(struct device_node *np) + return name; + } + } +- of_node_put(np); + + return NULL; + } +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index c81e1ff29069..b4c014464a20 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -1058,7 +1058,7 @@ static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b, + + update_turbo_state(); + if (global.turbo_disabled) { +- pr_warn("Turbo disabled by BIOS or unavailable on processor\n"); ++ pr_notice_once("Turbo disabled by BIOS or unavailable on processor\n"); + mutex_unlock(&intel_pstate_limits_lock); + mutex_unlock(&intel_pstate_driver_lock); + return -EPERM; +diff --git a/drivers/dma/mmp_tdma.c b/drivers/dma/mmp_tdma.c +index 10117f271b12..d683232d7fea 100644 +--- a/drivers/dma/mmp_tdma.c ++++ b/drivers/dma/mmp_tdma.c +@@ -363,6 +363,8 @@ static void mmp_tdma_free_descriptor(struct mmp_tdma_chan *tdmac) + gen_pool_free(gpool, (unsigned long)tdmac->desc_arr, + size); + tdmac->desc_arr = NULL; ++ if (tdmac->status == DMA_ERROR) ++ tdmac->status = DMA_COMPLETE; + + return; + } +@@ -443,7 +445,8 @@ static struct dma_async_tx_descriptor *mmp_tdma_prep_dma_cyclic( + if (!desc) + goto err_out; + +- mmp_tdma_config_write(chan, direction, &tdmac->slave_config); ++ if (mmp_tdma_config_write(chan, direction, &tdmac->slave_config)) ++ goto err_out; + + while (buf < buf_len) { + desc = &tdmac->desc_arr[i]; +diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c +index 581e7a290d98..a3b0b4c56a19 100644 +--- a/drivers/dma/pch_dma.c ++++ b/drivers/dma/pch_dma.c +@@ -865,6 +865,7 @@ static int pch_dma_probe(struct pci_dev *pdev, + } + + pci_set_master(pdev); ++ pd->dma.dev = &pdev->dev; + + err = request_irq(pdev->irq, pd_irq, IRQF_SHARED, DRV_NAME, pd); + if (err) { +@@ -880,7 +881,6 @@ static int pch_dma_probe(struct pci_dev *pdev, + goto err_free_irq; + } + +- pd->dma.dev = &pdev->dev; + + INIT_LIST_HEAD(&pd->dma.channels); + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index a9c5d5cc9f2b..5d5f1d0ce16c 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -1229,16 +1229,16 @@ static enum dma_status xilinx_dma_tx_status(struct dma_chan *dchan, + return ret; + + spin_lock_irqsave(&chan->lock, flags); +- +- desc = list_last_entry(&chan->active_list, +- struct xilinx_dma_tx_descriptor, node); +- /* +- * VDMA and simple mode do not support residue reporting, so the +- * residue field will always be 0. +- */ +- if (chan->has_sg && chan->xdev->dma_config->dmatype != XDMA_TYPE_VDMA) +- residue = xilinx_dma_get_residue(chan, desc); +- ++ if (!list_empty(&chan->active_list)) { ++ desc = list_last_entry(&chan->active_list, ++ struct xilinx_dma_tx_descriptor, node); ++ /* ++ * VDMA and simple mode do not support residue reporting, so the ++ * residue field will always be 0. ++ */ ++ if (chan->has_sg && chan->xdev->dma_config->dmatype != XDMA_TYPE_VDMA) ++ residue = xilinx_dma_get_residue(chan, desc); ++ } + spin_unlock_irqrestore(&chan->lock, flags); + + dma_set_residue(txstate, residue); +diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c +index 31f9f0e369b9..55b031d2c989 100644 +--- a/drivers/firmware/efi/tpm.c ++++ b/drivers/firmware/efi/tpm.c +@@ -16,7 +16,7 @@ + int efi_tpm_final_log_size; + EXPORT_SYMBOL(efi_tpm_final_log_size); + +-static int tpm2_calc_event_log_size(void *data, int count, void *size_info) ++static int __init tpm2_calc_event_log_size(void *data, int count, void *size_info) + { + struct tcg_pcr_event2_head *header; + int event_size, size = 0; +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 5638b4e5355f..4269ea9a817e 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -531,7 +531,7 @@ static int pca953x_gpio_set_config(struct gpio_chip *gc, unsigned int offset, + { + struct pca953x_chip *chip = gpiochip_get_data(gc); + +- switch (config) { ++ switch (pinconf_to_config_param(config)) { + case PIN_CONFIG_BIAS_PULL_UP: + case PIN_CONFIG_BIAS_PULL_DOWN: + return pca953x_gpio_set_pull_up_down(chip, offset, config); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +index 2672dc64a310..6a76ab16500f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +@@ -133,8 +133,7 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev, + u32 cpp; + u64 flags = AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED | + AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS | +- AMDGPU_GEM_CREATE_VRAM_CLEARED | +- AMDGPU_GEM_CREATE_CPU_GTT_USWC; ++ AMDGPU_GEM_CREATE_VRAM_CLEARED; + + info = drm_get_format_info(adev->ddev, mode_cmd); + cpp = info->cpp[0]; +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 73337e658aff..906648fca9ef 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -1177,6 +1177,8 @@ static const struct amdgpu_gfxoff_quirk amdgpu_gfxoff_quirk_list[] = { + { 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc8 }, + /* https://bugzilla.kernel.org/show_bug.cgi?id=207171 */ + { 0x1002, 0x15dd, 0x103c, 0x83e7, 0xd3 }, ++ /* GFXOFF is unstable on C6 parts with a VBIOS 113-RAVEN-114 */ ++ { 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc6 }, + { 0, 0, 0, 0, 0 }, + }; + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 8136a58deb39..5e27a67fbc58 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -7716,6 +7716,7 @@ static int dm_update_plane_state(struct dc *dc, + struct drm_crtc_state *old_crtc_state, *new_crtc_state; + struct dm_crtc_state *dm_new_crtc_state, *dm_old_crtc_state; + struct dm_plane_state *dm_new_plane_state, *dm_old_plane_state; ++ struct amdgpu_crtc *new_acrtc; + bool needs_reset; + int ret = 0; + +@@ -7725,9 +7726,30 @@ static int dm_update_plane_state(struct dc *dc, + dm_new_plane_state = to_dm_plane_state(new_plane_state); + dm_old_plane_state = to_dm_plane_state(old_plane_state); + +- /*TODO Implement atomic check for cursor plane */ +- if (plane->type == DRM_PLANE_TYPE_CURSOR) ++ /*TODO Implement better atomic check for cursor plane */ ++ if (plane->type == DRM_PLANE_TYPE_CURSOR) { ++ if (!enable || !new_plane_crtc || ++ drm_atomic_plane_disabling(plane->state, new_plane_state)) ++ return 0; ++ ++ new_acrtc = to_amdgpu_crtc(new_plane_crtc); ++ ++ if ((new_plane_state->crtc_w > new_acrtc->max_cursor_width) || ++ (new_plane_state->crtc_h > new_acrtc->max_cursor_height)) { ++ DRM_DEBUG_ATOMIC("Bad cursor size %d x %d\n", ++ new_plane_state->crtc_w, new_plane_state->crtc_h); ++ return -EINVAL; ++ } ++ ++ if (new_plane_state->crtc_x <= -new_acrtc->max_cursor_width || ++ new_plane_state->crtc_y <= -new_acrtc->max_cursor_height) { ++ DRM_DEBUG_ATOMIC("Bad cursor position %d, %d\n", ++ new_plane_state->crtc_x, new_plane_state->crtc_y); ++ return -EINVAL; ++ } ++ + return 0; ++ } + + needs_reset = should_reset_plane(state, plane, old_plane_state, + new_plane_state); +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index fd9e69634c50..1b6c75a4dd60 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -2885,6 +2885,12 @@ bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd + sizeof(hpd_irq_dpcd_data), + "Status: "); + ++ for (i = 0; i < MAX_PIPES; i++) { ++ pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i]; ++ if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link) ++ link->dc->hwss.blank_stream(pipe_ctx); ++ } ++ + for (i = 0; i < MAX_PIPES; i++) { + pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i]; + if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link) +@@ -2904,6 +2910,12 @@ bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd + if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) + dc_link_reallocate_mst_payload(link); + ++ for (i = 0; i < MAX_PIPES; i++) { ++ pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i]; ++ if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link) ++ link->dc->hwss.unblank_stream(pipe_ctx, &previous_link_settings); ++ } ++ + status = false; + if (out_link_loss) + *out_link_loss = true; +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +index 6ddbb00ed37a..8c20e9e907b2 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +@@ -239,24 +239,24 @@ static void delay_cursor_until_vupdate(struct pipe_ctx *pipe_ctx, struct dc *dc) + struct dc_stream_state *stream = pipe_ctx->stream; + unsigned int us_per_line; + +- if (stream->ctx->asic_id.chip_family == FAMILY_RV && +- ASICREV_IS_RAVEN(stream->ctx->asic_id.hw_internal_rev)) { ++ if (!dc->hwss.get_vupdate_offset_from_vsync) ++ return; + +- vupdate_line = dc->hwss.get_vupdate_offset_from_vsync(pipe_ctx); +- if (!dc_stream_get_crtc_position(dc, &stream, 1, &vpos, &nvpos)) +- return; ++ vupdate_line = dc->hwss.get_vupdate_offset_from_vsync(pipe_ctx); ++ if (!dc_stream_get_crtc_position(dc, &stream, 1, &vpos, &nvpos)) ++ return; + +- if (vpos >= vupdate_line) +- return; ++ if (vpos >= vupdate_line) ++ return; + +- us_per_line = stream->timing.h_total * 10000 / stream->timing.pix_clk_100hz; +- lines_to_vupdate = vupdate_line - vpos; +- us_to_vupdate = lines_to_vupdate * us_per_line; ++ us_per_line = ++ stream->timing.h_total * 10000 / stream->timing.pix_clk_100hz; ++ lines_to_vupdate = vupdate_line - vpos; ++ us_to_vupdate = lines_to_vupdate * us_per_line; + +- /* 70 us is a conservative estimate of cursor update time*/ +- if (us_to_vupdate < 70) +- udelay(us_to_vupdate); +- } ++ /* 70 us is a conservative estimate of cursor update time*/ ++ if (us_to_vupdate < 70) ++ udelay(us_to_vupdate); + #endif + } + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +index a444fed94184..ad422e00f9fe 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +@@ -2306,7 +2306,8 @@ void dcn20_fpga_init_hw(struct dc *dc) + + REG_UPDATE(DCHUBBUB_GLOBAL_TIMER_CNTL, DCHUBBUB_GLOBAL_TIMER_REFDIV, 2); + REG_UPDATE(DCHUBBUB_GLOBAL_TIMER_CNTL, DCHUBBUB_GLOBAL_TIMER_ENABLE, 1); +- REG_WRITE(REFCLK_CNTL, 0); ++ if (REG(REFCLK_CNTL)) ++ REG_WRITE(REFCLK_CNTL, 0); + // + + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +index 33d0a176841a..122d3e734c59 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +@@ -250,7 +250,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = { + .dram_channel_width_bytes = 4, + .fabric_datapath_to_dcn_data_return_bytes = 32, + .dcn_downspread_percent = 0.5, +- .downspread_percent = 0.5, ++ .downspread_percent = 0.38, + .dram_page_open_time_ns = 50.0, + .dram_rw_turnaround_time_ns = 17.5, + .dram_return_buffer_per_channel_bytes = 8192, +diff --git a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c +index c195575366a3..e4e5a53b2b4e 100644 +--- a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c ++++ b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c +@@ -1435,7 +1435,8 @@ static int pp_get_asic_baco_capability(void *handle, bool *cap) + if (!hwmgr) + return -EINVAL; + +- if (!hwmgr->pm_en || !hwmgr->hwmgr_func->get_asic_baco_capability) ++ if (!(hwmgr->not_vf && amdgpu_dpm) || ++ !hwmgr->hwmgr_func->get_asic_baco_capability) + return 0; + + mutex_lock(&hwmgr->smu_lock); +@@ -1469,7 +1470,8 @@ static int pp_set_asic_baco_state(void *handle, int state) + if (!hwmgr) + return -EINVAL; + +- if (!hwmgr->pm_en || !hwmgr->hwmgr_func->set_asic_baco_state) ++ if (!(hwmgr->not_vf && amdgpu_dpm) || ++ !hwmgr->hwmgr_func->set_asic_baco_state) + return 0; + + mutex_lock(&hwmgr->smu_lock); +diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c +index 2fe594952748..d3c58026d55e 100644 +--- a/drivers/gpu/drm/i915/display/intel_ddi.c ++++ b/drivers/gpu/drm/i915/display/intel_ddi.c +@@ -3545,9 +3545,6 @@ static void hsw_ddi_pre_enable_dp(struct intel_encoder *encoder, + intel_dp_set_link_params(intel_dp, crtc_state->port_clock, + crtc_state->lane_count, is_mst); + +- intel_dp->regs.dp_tp_ctl = DP_TP_CTL(port); +- intel_dp->regs.dp_tp_status = DP_TP_STATUS(port); +- + intel_edp_panel_on(intel_dp); + + intel_ddi_clk_select(encoder, crtc_state); +@@ -4269,12 +4266,18 @@ void intel_ddi_get_config(struct intel_encoder *encoder, + struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); + struct intel_crtc *intel_crtc = to_intel_crtc(pipe_config->uapi.crtc); + enum transcoder cpu_transcoder = pipe_config->cpu_transcoder; ++ struct intel_dp *intel_dp = enc_to_intel_dp(encoder); + u32 temp, flags = 0; + + /* XXX: DSI transcoder paranoia */ + if (WARN_ON(transcoder_is_dsi(cpu_transcoder))) + return; + ++ if (INTEL_GEN(dev_priv) >= 12) { ++ intel_dp->regs.dp_tp_ctl = TGL_DP_TP_CTL(cpu_transcoder); ++ intel_dp->regs.dp_tp_status = TGL_DP_TP_STATUS(cpu_transcoder); ++ } ++ + intel_dsc_get_config(encoder, pipe_config); + + temp = I915_READ(TRANS_DDI_FUNC_CTL(cpu_transcoder)); +@@ -4492,6 +4495,7 @@ static const struct drm_encoder_funcs intel_ddi_funcs = { + static struct intel_connector * + intel_ddi_init_dp_connector(struct intel_digital_port *intel_dig_port) + { ++ struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev); + struct intel_connector *connector; + enum port port = intel_dig_port->base.port; + +@@ -4502,6 +4506,10 @@ intel_ddi_init_dp_connector(struct intel_digital_port *intel_dig_port) + intel_dig_port->dp.output_reg = DDI_BUF_CTL(port); + intel_dig_port->dp.prepare_link_retrain = + intel_ddi_prepare_link_retrain; ++ if (INTEL_GEN(dev_priv) < 12) { ++ intel_dig_port->dp.regs.dp_tp_ctl = DP_TP_CTL(port); ++ intel_dig_port->dp.regs.dp_tp_status = DP_TP_STATUS(port); ++ } + + if (!intel_dp_init_connector(intel_dig_port, connector)) { + kfree(connector); +diff --git a/drivers/gpu/drm/i915/display/intel_display_power.c b/drivers/gpu/drm/i915/display/intel_display_power.c +index 46c40db992dd..5895b8c7662e 100644 +--- a/drivers/gpu/drm/i915/display/intel_display_power.c ++++ b/drivers/gpu/drm/i915/display/intel_display_power.c +@@ -4068,7 +4068,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = { + { + .name = "AUX D TBT1", + .domains = TGL_AUX_D_TBT1_IO_POWER_DOMAINS, +- .ops = &hsw_power_well_ops, ++ .ops = &icl_tc_phy_aux_power_well_ops, + .id = DISP_PW_ID_NONE, + { + .hsw.regs = &icl_aux_power_well_regs, +@@ -4079,7 +4079,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = { + { + .name = "AUX E TBT2", + .domains = TGL_AUX_E_TBT2_IO_POWER_DOMAINS, +- .ops = &hsw_power_well_ops, ++ .ops = &icl_tc_phy_aux_power_well_ops, + .id = DISP_PW_ID_NONE, + { + .hsw.regs = &icl_aux_power_well_regs, +@@ -4090,7 +4090,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = { + { + .name = "AUX F TBT3", + .domains = TGL_AUX_F_TBT3_IO_POWER_DOMAINS, +- .ops = &hsw_power_well_ops, ++ .ops = &icl_tc_phy_aux_power_well_ops, + .id = DISP_PW_ID_NONE, + { + .hsw.regs = &icl_aux_power_well_regs, +@@ -4101,7 +4101,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = { + { + .name = "AUX G TBT4", + .domains = TGL_AUX_G_TBT4_IO_POWER_DOMAINS, +- .ops = &hsw_power_well_ops, ++ .ops = &icl_tc_phy_aux_power_well_ops, + .id = DISP_PW_ID_NONE, + { + .hsw.regs = &icl_aux_power_well_regs, +@@ -4112,7 +4112,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = { + { + .name = "AUX H TBT5", + .domains = TGL_AUX_H_TBT5_IO_POWER_DOMAINS, +- .ops = &hsw_power_well_ops, ++ .ops = &icl_tc_phy_aux_power_well_ops, + .id = DISP_PW_ID_NONE, + { + .hsw.regs = &icl_aux_power_well_regs, +@@ -4123,7 +4123,7 @@ static const struct i915_power_well_desc tgl_power_wells[] = { + { + .name = "AUX I TBT6", + .domains = TGL_AUX_I_TBT6_IO_POWER_DOMAINS, +- .ops = &hsw_power_well_ops, ++ .ops = &icl_tc_phy_aux_power_well_ops, + .id = DISP_PW_ID_NONE, + { + .hsw.regs = &icl_aux_power_well_regs, +diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c +index c7424e2a04a3..fa3a9e9e0b29 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -2492,9 +2492,6 @@ static void intel_dp_prepare(struct intel_encoder *encoder, + intel_crtc_has_type(pipe_config, + INTEL_OUTPUT_DP_MST)); + +- intel_dp->regs.dp_tp_ctl = DP_TP_CTL(port); +- intel_dp->regs.dp_tp_status = DP_TP_STATUS(port); +- + /* + * There are four kinds of DP registers: + * +@@ -7616,6 +7613,8 @@ bool intel_dp_init(struct drm_i915_private *dev_priv, + + intel_dig_port->dp.output_reg = output_reg; + intel_dig_port->max_lanes = 4; ++ intel_dig_port->dp.regs.dp_tp_ctl = DP_TP_CTL(port); ++ intel_dig_port->dp.regs.dp_tp_status = DP_TP_STATUS(port); + + intel_encoder->type = INTEL_OUTPUT_DP; + intel_encoder->power_domain = intel_port_to_power_domain(port); +diff --git a/drivers/gpu/drm/i915/display/intel_fbc.c b/drivers/gpu/drm/i915/display/intel_fbc.c +index a1048ece541e..b6d5e7defa5b 100644 +--- a/drivers/gpu/drm/i915/display/intel_fbc.c ++++ b/drivers/gpu/drm/i915/display/intel_fbc.c +@@ -478,8 +478,7 @@ static int intel_fbc_alloc_cfb(struct drm_i915_private *dev_priv, + if (!ret) + goto err_llb; + else if (ret > 1) { +- DRM_INFO("Reducing the compressed framebuffer size. This may lead to less power savings than a non-reduced-size. Try to increase stolen memory size if available in BIOS.\n"); +- ++ DRM_INFO_ONCE("Reducing the compressed framebuffer size. This may lead to less power savings than a non-reduced-size. Try to increase stolen memory size if available in BIOS.\n"); + } + + fbc->threshold = ret; +diff --git a/drivers/gpu/drm/i915/display/intel_sprite.c b/drivers/gpu/drm/i915/display/intel_sprite.c +index fca77ec1e0dd..f55404a94eba 100644 +--- a/drivers/gpu/drm/i915/display/intel_sprite.c ++++ b/drivers/gpu/drm/i915/display/intel_sprite.c +@@ -2754,19 +2754,25 @@ static bool skl_plane_format_mod_supported(struct drm_plane *_plane, + } + } + +-static bool gen12_plane_supports_mc_ccs(enum plane_id plane_id) ++static bool gen12_plane_supports_mc_ccs(struct drm_i915_private *dev_priv, ++ enum plane_id plane_id) + { ++ /* Wa_14010477008:tgl[a0..c0] */ ++ if (IS_TGL_REVID(dev_priv, TGL_REVID_A0, TGL_REVID_C0)) ++ return false; ++ + return plane_id < PLANE_SPRITE4; + } + + static bool gen12_plane_format_mod_supported(struct drm_plane *_plane, + u32 format, u64 modifier) + { ++ struct drm_i915_private *dev_priv = to_i915(_plane->dev); + struct intel_plane *plane = to_intel_plane(_plane); + + switch (modifier) { + case I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS: +- if (!gen12_plane_supports_mc_ccs(plane->id)) ++ if (!gen12_plane_supports_mc_ccs(dev_priv, plane->id)) + return false; + /* fall through */ + case DRM_FORMAT_MOD_LINEAR: +@@ -2935,9 +2941,10 @@ static const u32 *icl_get_plane_formats(struct drm_i915_private *dev_priv, + } + } + +-static const u64 *gen12_get_plane_modifiers(enum plane_id plane_id) ++static const u64 *gen12_get_plane_modifiers(struct drm_i915_private *dev_priv, ++ enum plane_id plane_id) + { +- if (gen12_plane_supports_mc_ccs(plane_id)) ++ if (gen12_plane_supports_mc_ccs(dev_priv, plane_id)) + return gen12_plane_format_modifiers_mc_ccs; + else + return gen12_plane_format_modifiers_rc_ccs; +@@ -3008,7 +3015,7 @@ skl_universal_plane_create(struct drm_i915_private *dev_priv, + + plane->has_ccs = skl_plane_has_ccs(dev_priv, pipe, plane_id); + if (INTEL_GEN(dev_priv) >= 12) { +- modifiers = gen12_get_plane_modifiers(plane_id); ++ modifiers = gen12_get_plane_modifiers(dev_priv, plane_id); + plane_funcs = &gen12_plane_funcs; + } else { + if (plane->has_ccs) +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_domain.c b/drivers/gpu/drm/i915/gem/i915_gem_domain.c +index 0cc40e77bbd2..4f96c8788a2e 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_domain.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_domain.c +@@ -368,7 +368,6 @@ static void i915_gem_object_bump_inactive_ggtt(struct drm_i915_gem_object *obj) + struct drm_i915_private *i915 = to_i915(obj->base.dev); + struct i915_vma *vma; + +- GEM_BUG_ON(!i915_gem_object_has_pinned_pages(obj)); + if (!atomic_read(&obj->bind_count)) + return; + +@@ -400,12 +399,8 @@ static void i915_gem_object_bump_inactive_ggtt(struct drm_i915_gem_object *obj) + void + i915_gem_object_unpin_from_display_plane(struct i915_vma *vma) + { +- struct drm_i915_gem_object *obj = vma->obj; +- +- assert_object_held(obj); +- + /* Bump the LRU to try and avoid premature eviction whilst flipping */ +- i915_gem_object_bump_inactive_ggtt(obj); ++ i915_gem_object_bump_inactive_ggtt(vma->obj); + + i915_vma_unpin(vma); + } +diff --git a/drivers/gpu/drm/i915/gt/intel_engine.h b/drivers/gpu/drm/i915/gt/intel_engine.h +index 5df003061e44..beb3211a6249 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine.h ++++ b/drivers/gpu/drm/i915/gt/intel_engine.h +@@ -338,13 +338,4 @@ intel_engine_has_preempt_reset(const struct intel_engine_cs *engine) + return intel_engine_has_preemption(engine); + } + +-static inline bool +-intel_engine_has_timeslices(const struct intel_engine_cs *engine) +-{ +- if (!IS_ACTIVE(CONFIG_DRM_I915_TIMESLICE_DURATION)) +- return false; +- +- return intel_engine_has_semaphores(engine); +-} +- + #endif /* _INTEL_RINGBUFFER_H_ */ +diff --git a/drivers/gpu/drm/i915/gt/intel_engine_types.h b/drivers/gpu/drm/i915/gt/intel_engine_types.h +index 92be41a6903c..4ea067e1508a 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine_types.h ++++ b/drivers/gpu/drm/i915/gt/intel_engine_types.h +@@ -473,10 +473,11 @@ struct intel_engine_cs { + #define I915_ENGINE_SUPPORTS_STATS BIT(1) + #define I915_ENGINE_HAS_PREEMPTION BIT(2) + #define I915_ENGINE_HAS_SEMAPHORES BIT(3) +-#define I915_ENGINE_NEEDS_BREADCRUMB_TASKLET BIT(4) +-#define I915_ENGINE_IS_VIRTUAL BIT(5) +-#define I915_ENGINE_HAS_RELATIVE_MMIO BIT(6) +-#define I915_ENGINE_REQUIRES_CMD_PARSER BIT(7) ++#define I915_ENGINE_HAS_TIMESLICES BIT(4) ++#define I915_ENGINE_NEEDS_BREADCRUMB_TASKLET BIT(5) ++#define I915_ENGINE_IS_VIRTUAL BIT(6) ++#define I915_ENGINE_HAS_RELATIVE_MMIO BIT(7) ++#define I915_ENGINE_REQUIRES_CMD_PARSER BIT(8) + unsigned int flags; + + /* +@@ -573,6 +574,15 @@ intel_engine_has_semaphores(const struct intel_engine_cs *engine) + return engine->flags & I915_ENGINE_HAS_SEMAPHORES; + } + ++static inline bool ++intel_engine_has_timeslices(const struct intel_engine_cs *engine) ++{ ++ if (!IS_ACTIVE(CONFIG_DRM_I915_TIMESLICE_DURATION)) ++ return false; ++ ++ return engine->flags & I915_ENGINE_HAS_TIMESLICES; ++} ++ + static inline bool + intel_engine_needs_breadcrumb_tasklet(const struct intel_engine_cs *engine) + { +diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c +index 31455eceeb0c..637c03ee1a57 100644 +--- a/drivers/gpu/drm/i915/gt/intel_lrc.c ++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c +@@ -1626,6 +1626,9 @@ static void defer_request(struct i915_request *rq, struct list_head * const pl) + struct i915_request *w = + container_of(p->waiter, typeof(*w), sched); + ++ if (p->flags & I915_DEPENDENCY_WEAK) ++ continue; ++ + /* Leave semaphores spinning on the other engines */ + if (w->engine != rq->engine) + continue; +@@ -4194,8 +4197,11 @@ void intel_execlists_set_default_submission(struct intel_engine_cs *engine) + engine->flags |= I915_ENGINE_SUPPORTS_STATS; + if (!intel_vgpu_active(engine->i915)) { + engine->flags |= I915_ENGINE_HAS_SEMAPHORES; +- if (HAS_LOGICAL_RING_PREEMPTION(engine->i915)) ++ if (HAS_LOGICAL_RING_PREEMPTION(engine->i915)) { + engine->flags |= I915_ENGINE_HAS_PREEMPTION; ++ if (IS_ACTIVE(CONFIG_DRM_I915_TIMESLICE_DURATION)) ++ engine->flags |= I915_ENGINE_HAS_TIMESLICES; ++ } + } + + if (INTEL_GEN(engine->i915) >= 12) +diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c +index 685d1e04a5ff..709ad181bc94 100644 +--- a/drivers/gpu/drm/i915/gvt/scheduler.c ++++ b/drivers/gpu/drm/i915/gvt/scheduler.c +@@ -375,7 +375,11 @@ static void set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload, + for (i = 0; i < GVT_RING_CTX_NR_PDPS; i++) { + struct i915_page_directory * const pd = + i915_pd_entry(ppgtt->pd, i); +- ++ /* skip now as current i915 ppgtt alloc won't allocate ++ top level pdp for non 4-level table, won't impact ++ shadow ppgtt. */ ++ if (!pd) ++ break; + px_dma(pd) = mm->ppgtt_mm.shadow_pdps[i]; + } + } +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 810e3ccd56ec..dff134265112 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -1601,6 +1601,8 @@ IS_SUBPLATFORM(const struct drm_i915_private *i915, + (IS_ICELAKE(p) && IS_REVID(p, since, until)) + + #define TGL_REVID_A0 0x0 ++#define TGL_REVID_B0 0x1 ++#define TGL_REVID_C0 0x2 + + #define IS_TGL_REVID(p, since, until) \ + (IS_TIGERLAKE(p) && IS_REVID(p, since, until)) +diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c +index 0697bedebeef..d99df9c33708 100644 +--- a/drivers/gpu/drm/i915/i915_gem_evict.c ++++ b/drivers/gpu/drm/i915/i915_gem_evict.c +@@ -130,6 +130,13 @@ search_again: + active = NULL; + INIT_LIST_HEAD(&eviction_list); + list_for_each_entry_safe(vma, next, &vm->bound_list, vm_link) { ++ if (vma == active) { /* now seen this vma twice */ ++ if (flags & PIN_NONBLOCK) ++ break; ++ ++ active = ERR_PTR(-EAGAIN); ++ } ++ + /* + * We keep this list in a rough least-recently scanned order + * of active elements (inactive elements are cheap to reap). +@@ -145,21 +152,12 @@ search_again: + * To notice when we complete one full cycle, we record the + * first active element seen, before moving it to the tail. + */ +- if (i915_vma_is_active(vma)) { +- if (vma == active) { +- if (flags & PIN_NONBLOCK) +- break; +- +- active = ERR_PTR(-EAGAIN); +- } +- +- if (active != ERR_PTR(-EAGAIN)) { +- if (!active) +- active = vma; ++ if (active != ERR_PTR(-EAGAIN) && i915_vma_is_active(vma)) { ++ if (!active) ++ active = vma; + +- list_move_tail(&vma->vm_link, &vm->bound_list); +- continue; +- } ++ list_move_tail(&vma->vm_link, &vm->bound_list); ++ continue; + } + + if (mark_free(&scan, vma, flags, &eviction_list)) +diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c +index c6f02b0b6c7a..52825ae8301b 100644 +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -3324,7 +3324,7 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv) + u32 de_pipe_masked = gen8_de_pipe_fault_mask(dev_priv) | + GEN8_PIPE_CDCLK_CRC_DONE; + u32 de_pipe_enables; +- u32 de_port_masked = GEN8_AUX_CHANNEL_A; ++ u32 de_port_masked = gen8_de_port_aux_mask(dev_priv); + u32 de_port_enables; + u32 de_misc_masked = GEN8_DE_EDP_PSR; + enum pipe pipe; +@@ -3332,18 +3332,8 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv) + if (INTEL_GEN(dev_priv) <= 10) + de_misc_masked |= GEN8_DE_MISC_GSE; + +- if (INTEL_GEN(dev_priv) >= 9) { +- de_port_masked |= GEN9_AUX_CHANNEL_B | GEN9_AUX_CHANNEL_C | +- GEN9_AUX_CHANNEL_D; +- if (IS_GEN9_LP(dev_priv)) +- de_port_masked |= BXT_DE_PORT_GMBUS; +- } +- +- if (INTEL_GEN(dev_priv) >= 11) +- de_port_masked |= ICL_AUX_CHANNEL_E; +- +- if (IS_CNL_WITH_PORT_F(dev_priv) || INTEL_GEN(dev_priv) >= 11) +- de_port_masked |= CNL_AUX_CHANNEL_F; ++ if (IS_GEN9_LP(dev_priv)) ++ de_port_masked |= BXT_DE_PORT_GMBUS; + + de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK | + GEN8_PIPE_FIFO_UNDERRUN; +diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c +index a18b2a244706..32ab154db788 100644 +--- a/drivers/gpu/drm/i915/i915_request.c ++++ b/drivers/gpu/drm/i915/i915_request.c +@@ -951,7 +951,9 @@ i915_request_await_request(struct i915_request *to, struct i915_request *from) + return 0; + + if (to->engine->schedule) { +- ret = i915_sched_node_add_dependency(&to->sched, &from->sched); ++ ret = i915_sched_node_add_dependency(&to->sched, ++ &from->sched, ++ I915_DEPENDENCY_EXTERNAL); + if (ret < 0) + return ret; + } +@@ -1084,7 +1086,9 @@ __i915_request_await_execution(struct i915_request *to, + + /* Couple the dependency tree for PI on this exposed to->fence */ + if (to->engine->schedule) { +- err = i915_sched_node_add_dependency(&to->sched, &from->sched); ++ err = i915_sched_node_add_dependency(&to->sched, ++ &from->sched, ++ I915_DEPENDENCY_WEAK); + if (err < 0) + return err; + } +diff --git a/drivers/gpu/drm/i915/i915_scheduler.c b/drivers/gpu/drm/i915/i915_scheduler.c +index 34b654b4e58a..8e419d897c2b 100644 +--- a/drivers/gpu/drm/i915/i915_scheduler.c ++++ b/drivers/gpu/drm/i915/i915_scheduler.c +@@ -455,7 +455,8 @@ bool __i915_sched_node_add_dependency(struct i915_sched_node *node, + } + + int i915_sched_node_add_dependency(struct i915_sched_node *node, +- struct i915_sched_node *signal) ++ struct i915_sched_node *signal, ++ unsigned long flags) + { + struct i915_dependency *dep; + +@@ -464,8 +465,7 @@ int i915_sched_node_add_dependency(struct i915_sched_node *node, + return -ENOMEM; + + if (!__i915_sched_node_add_dependency(node, signal, dep, +- I915_DEPENDENCY_EXTERNAL | +- I915_DEPENDENCY_ALLOC)) ++ flags | I915_DEPENDENCY_ALLOC)) + i915_dependency_free(dep); + + return 0; +diff --git a/drivers/gpu/drm/i915/i915_scheduler.h b/drivers/gpu/drm/i915/i915_scheduler.h +index d1dc4efef77b..6f0bf00fc569 100644 +--- a/drivers/gpu/drm/i915/i915_scheduler.h ++++ b/drivers/gpu/drm/i915/i915_scheduler.h +@@ -34,7 +34,8 @@ bool __i915_sched_node_add_dependency(struct i915_sched_node *node, + unsigned long flags); + + int i915_sched_node_add_dependency(struct i915_sched_node *node, +- struct i915_sched_node *signal); ++ struct i915_sched_node *signal, ++ unsigned long flags); + + void i915_sched_node_fini(struct i915_sched_node *node); + +diff --git a/drivers/gpu/drm/i915/i915_scheduler_types.h b/drivers/gpu/drm/i915/i915_scheduler_types.h +index d18e70550054..7186875088a0 100644 +--- a/drivers/gpu/drm/i915/i915_scheduler_types.h ++++ b/drivers/gpu/drm/i915/i915_scheduler_types.h +@@ -78,6 +78,7 @@ struct i915_dependency { + unsigned long flags; + #define I915_DEPENDENCY_ALLOC BIT(0) + #define I915_DEPENDENCY_EXTERNAL BIT(1) ++#define I915_DEPENDENCY_WEAK BIT(2) + }; + + #endif /* _I915_SCHEDULER_TYPES_H_ */ +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index bd2d30ecc030..53c7b1a1b355 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -4722,7 +4722,7 @@ static void skl_compute_plane_wm(const struct intel_crtc_state *crtc_state, + * WaIncreaseLatencyIPCEnabled: kbl,cfl + * Display WA #1141: kbl,cfl + */ +- if ((IS_KABYLAKE(dev_priv) || IS_COFFEELAKE(dev_priv)) || ++ if ((IS_KABYLAKE(dev_priv) || IS_COFFEELAKE(dev_priv)) && + dev_priv->ipc_enabled) + latency += 4; + +diff --git a/drivers/gpu/drm/qxl/qxl_image.c b/drivers/gpu/drm/qxl/qxl_image.c +index 43688ecdd8a0..60ab7151b84d 100644 +--- a/drivers/gpu/drm/qxl/qxl_image.c ++++ b/drivers/gpu/drm/qxl/qxl_image.c +@@ -212,7 +212,8 @@ qxl_image_init_helper(struct qxl_device *qdev, + break; + default: + DRM_ERROR("unsupported image bit depth\n"); +- return -EINVAL; /* TODO: cleanup */ ++ qxl_bo_kunmap_atomic_page(qdev, image_bo, ptr); ++ return -EINVAL; + } + image->u.bitmap.flags = QXL_BITMAP_TOP_DOWN; + image->u.bitmap.x = width; +diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +index a75fcb113172..2b6d77ca3dfc 100644 +--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c ++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +@@ -719,7 +719,7 @@ static void sun6i_dsi_encoder_enable(struct drm_encoder *encoder) + struct drm_display_mode *mode = &encoder->crtc->state->adjusted_mode; + struct sun6i_dsi *dsi = encoder_to_sun6i_dsi(encoder); + struct mipi_dsi_device *device = dsi->device; +- union phy_configure_opts opts = { 0 }; ++ union phy_configure_opts opts = { }; + struct phy_configure_opts_mipi_dphy *cfg = &opts.mipi_dphy; + u16 delay; + +diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c +index bd268028fb3d..583cd6e0ae27 100644 +--- a/drivers/gpu/drm/tegra/drm.c ++++ b/drivers/gpu/drm/tegra/drm.c +@@ -1039,6 +1039,7 @@ void tegra_drm_free(struct tegra_drm *tegra, size_t size, void *virt, + + static bool host1x_drm_wants_iommu(struct host1x_device *dev) + { ++ struct host1x *host1x = dev_get_drvdata(dev->dev.parent); + struct iommu_domain *domain; + + /* +@@ -1076,7 +1077,7 @@ static bool host1x_drm_wants_iommu(struct host1x_device *dev) + * sufficient and whether or not the host1x is attached to an IOMMU + * doesn't matter. + */ +- if (!domain && dma_get_mask(dev->dev.parent) <= DMA_BIT_MASK(32)) ++ if (!domain && host1x_get_dma_mask(host1x) <= DMA_BIT_MASK(32)) + return true; + + return domain != NULL; +diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c +index 388bcc2889aa..40a4b9f8b861 100644 +--- a/drivers/gpu/host1x/dev.c ++++ b/drivers/gpu/host1x/dev.c +@@ -502,6 +502,19 @@ static void __exit tegra_host1x_exit(void) + } + module_exit(tegra_host1x_exit); + ++/** ++ * host1x_get_dma_mask() - query the supported DMA mask for host1x ++ * @host1x: host1x instance ++ * ++ * Note that this returns the supported DMA mask for host1x, which can be ++ * different from the applicable DMA mask under certain circumstances. ++ */ ++u64 host1x_get_dma_mask(struct host1x *host1x) ++{ ++ return host1x->info->dma_mask; ++} ++EXPORT_SYMBOL(host1x_get_dma_mask); ++ + MODULE_AUTHOR("Thierry Reding "); + MODULE_AUTHOR("Terje Bergstrom "); + MODULE_DESCRIPTION("Host1x driver for Tegra products"); +diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c +index 53b517dbe7e6..4af2fc309c28 100644 +--- a/drivers/hwmon/da9052-hwmon.c ++++ b/drivers/hwmon/da9052-hwmon.c +@@ -244,9 +244,9 @@ static ssize_t da9052_tsi_show(struct device *dev, + int channel = to_sensor_dev_attr(devattr)->index; + int ret; + +- mutex_lock(&hwmon->hwmon_lock); ++ mutex_lock(&hwmon->da9052->auxadc_lock); + ret = __da9052_read_tsi(dev, channel); +- mutex_unlock(&hwmon->hwmon_lock); ++ mutex_unlock(&hwmon->da9052->auxadc_lock); + + if (ret < 0) + return ret; +diff --git a/drivers/hwmon/drivetemp.c b/drivers/hwmon/drivetemp.c +index 9179460c2d9d..0d4f3d97ffc6 100644 +--- a/drivers/hwmon/drivetemp.c ++++ b/drivers/hwmon/drivetemp.c +@@ -346,7 +346,7 @@ static int drivetemp_identify_sata(struct drivetemp_data *st) + st->have_temp_highest = temp_is_valid(buf[SCT_STATUS_TEMP_HIGHEST]); + + if (!have_sct_data_table) +- goto skip_sct; ++ goto skip_sct_data; + + /* Request and read temperature history table */ + memset(buf, '\0', sizeof(st->smartdata)); +diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c +index 17bfedd24cc3..4619629b958c 100644 +--- a/drivers/infiniband/core/cache.c ++++ b/drivers/infiniband/core/cache.c +@@ -1536,8 +1536,11 @@ int ib_cache_setup_one(struct ib_device *device) + if (err) + return err; + +- rdma_for_each_port (device, p) +- ib_cache_update(device, p, true); ++ rdma_for_each_port (device, p) { ++ err = ib_cache_update(device, p, true); ++ if (err) ++ return err; ++ } + + return 0; + } +diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c +index 9eec26d10d7b..e16105be2eb2 100644 +--- a/drivers/infiniband/core/nldev.c ++++ b/drivers/infiniband/core/nldev.c +@@ -1292,11 +1292,10 @@ static int res_get_common_doit(struct sk_buff *skb, struct nlmsghdr *nlh, + has_cap_net_admin = netlink_capable(skb, CAP_NET_ADMIN); + + ret = fill_func(msg, has_cap_net_admin, res, port); +- +- rdma_restrack_put(res); + if (ret) + goto err_free; + ++ rdma_restrack_put(res); + nlmsg_end(msg, nlh); + ib_device_put(device); + return rdma_nl_unicast(sock_net(skb->sk), msg, NETLINK_CB(skb).portid); +diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c +index 177333d8bcda..bf8e149d3191 100644 +--- a/drivers/infiniband/core/rdma_core.c ++++ b/drivers/infiniband/core/rdma_core.c +@@ -459,7 +459,8 @@ alloc_begin_fd_uobject(const struct uverbs_api_object *obj, + struct ib_uobject *uobj; + struct file *filp; + +- if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release)) ++ if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release && ++ fd_type->fops->release != &uverbs_async_event_release)) + return ERR_PTR(-EINVAL); + + new_fd = get_unused_fd_flags(O_CLOEXEC); +diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h +index 7df71983212d..3d189c7ee59e 100644 +--- a/drivers/infiniband/core/uverbs.h ++++ b/drivers/infiniband/core/uverbs.h +@@ -219,6 +219,7 @@ void ib_uverbs_init_event_queue(struct ib_uverbs_event_queue *ev_queue); + void ib_uverbs_init_async_event_file(struct ib_uverbs_async_event_file *ev_file); + void ib_uverbs_free_event_queue(struct ib_uverbs_event_queue *event_queue); + void ib_uverbs_flow_resources_free(struct ib_uflow_resources *uflow_res); ++int uverbs_async_event_release(struct inode *inode, struct file *filp); + + int ib_alloc_ucontext(struct uverbs_attr_bundle *attrs); + int ib_init_ucontext(struct uverbs_attr_bundle *attrs); +@@ -227,6 +228,9 @@ void ib_uverbs_release_ucq(struct ib_uverbs_completion_event_file *ev_file, + struct ib_ucq_object *uobj); + void ib_uverbs_release_uevent(struct ib_uevent_object *uobj); + void ib_uverbs_release_file(struct kref *ref); ++void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file, ++ __u64 element, __u64 event, ++ struct list_head *obj_list, u32 *counter); + + void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context); + void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr); +diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c +index 17fc25db0311..1bab8de14757 100644 +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -346,7 +346,7 @@ const struct file_operations uverbs_async_event_fops = { + .owner = THIS_MODULE, + .read = ib_uverbs_async_event_read, + .poll = ib_uverbs_async_event_poll, +- .release = uverbs_uobject_fd_release, ++ .release = uverbs_async_event_release, + .fasync = ib_uverbs_async_event_fasync, + .llseek = no_llseek, + }; +@@ -386,10 +386,9 @@ void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context) + kill_fasync(&ev_queue->async_queue, SIGIO, POLL_IN); + } + +-static void +-ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file, +- __u64 element, __u64 event, struct list_head *obj_list, +- u32 *counter) ++void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file, ++ __u64 element, __u64 event, ++ struct list_head *obj_list, u32 *counter) + { + struct ib_uverbs_event *entry; + unsigned long flags; +@@ -1187,9 +1186,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev, + */ + mutex_unlock(&uverbs_dev->lists_mutex); + +- ib_uverbs_async_handler(READ_ONCE(file->async_file), 0, +- IB_EVENT_DEVICE_FATAL, NULL, NULL); +- + uverbs_destroy_ufile_hw(file, RDMA_REMOVE_DRIVER_REMOVE); + kref_put(&file->ref, ib_uverbs_release_file); + +diff --git a/drivers/infiniband/core/uverbs_std_types_async_fd.c b/drivers/infiniband/core/uverbs_std_types_async_fd.c +index 82ec0806b34b..61899eaf1f91 100644 +--- a/drivers/infiniband/core/uverbs_std_types_async_fd.c ++++ b/drivers/infiniband/core/uverbs_std_types_async_fd.c +@@ -26,10 +26,38 @@ static int uverbs_async_event_destroy_uobj(struct ib_uobject *uobj, + container_of(uobj, struct ib_uverbs_async_event_file, uobj); + + ib_unregister_event_handler(&event_file->event_handler); +- ib_uverbs_free_event_queue(&event_file->ev_queue); ++ ++ if (why == RDMA_REMOVE_DRIVER_REMOVE) ++ ib_uverbs_async_handler(event_file, 0, IB_EVENT_DEVICE_FATAL, ++ NULL, NULL); + return 0; + } + ++int uverbs_async_event_release(struct inode *inode, struct file *filp) ++{ ++ struct ib_uverbs_async_event_file *event_file; ++ struct ib_uobject *uobj = filp->private_data; ++ int ret; ++ ++ if (!uobj) ++ return uverbs_uobject_fd_release(inode, filp); ++ ++ event_file = ++ container_of(uobj, struct ib_uverbs_async_event_file, uobj); ++ ++ /* ++ * The async event FD has to deliver IB_EVENT_DEVICE_FATAL even after ++ * disassociation, so cleaning the event list must only happen after ++ * release. The user knows it has reached the end of the event stream ++ * when it sees IB_EVENT_DEVICE_FATAL. ++ */ ++ uverbs_uobject_get(uobj); ++ ret = uverbs_uobject_fd_release(inode, filp); ++ ib_uverbs_free_event_queue(&event_file->ev_queue); ++ uverbs_uobject_put(uobj); ++ return ret; ++} ++ + DECLARE_UVERBS_NAMED_METHOD( + UVERBS_METHOD_ASYNC_EVENT_ALLOC, + UVERBS_ATTR_FD(UVERBS_ATTR_ASYNC_EVENT_ALLOC_FD_HANDLE, +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index d69dece3b1d5..30e08bcc9afb 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2891,8 +2891,7 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb) + srqidx = ABORT_RSS_SRQIDX_G( + be32_to_cpu(req->srqidx_status)); + if (srqidx) { +- complete_cached_srq_buffers(ep, +- req->srqidx_status); ++ complete_cached_srq_buffers(ep, srqidx); + } else { + /* Hold ep ref until finish_peer_abort() */ + c4iw_get_ep(&ep->com); +@@ -3878,8 +3877,8 @@ static int read_tcb_rpl(struct c4iw_dev *dev, struct sk_buff *skb) + return 0; + } + +- ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W, +- TCB_RQ_START_S); ++ ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M, ++ TCB_RQ_START_S); + cleanup: + pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx); + +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index 13e4203497b3..a92346e88628 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -589,10 +589,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + + set_comp_state(pq, cq, info.comp_idx, QUEUED, 0); + pq->state = SDMA_PKT_Q_ACTIVE; +- /* Send the first N packets in the request to buy us some time */ +- ret = user_sdma_send_pkts(req, pcount); +- if (unlikely(ret < 0 && ret != -EBUSY)) +- goto free_req; + + /* + * This is a somewhat blocking send implementation. +diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c +index 55a1fbf0e670..ae8b97c30665 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c +@@ -534,7 +534,7 @@ void i40iw_manage_arp_cache(struct i40iw_device *iwdev, + int arp_index; + + arp_index = i40iw_arp_table(iwdev, ip_addr, ipv4, mac_addr, action); +- if (arp_index == -1) ++ if (arp_index < 0) + return; + cqp_request = i40iw_get_cqp_request(&iwdev->cqp, false); + if (!cqp_request) +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 26425dd2d960..a2b1f6af5ba3 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -2891,6 +2891,7 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp, + int send_size; + int header_size; + int spc; ++ int err; + int i; + + if (wr->wr.opcode != IB_WR_SEND) +@@ -2925,7 +2926,9 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp, + + sqp->ud_header.lrh.virtual_lane = 0; + sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); +- ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); ++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); ++ if (err) ++ return err; + sqp->ud_header.bth.pkey = cpu_to_be16(pkey); + if (sqp->qp.mlx4_ib_qp_type == MLX4_IB_QPT_TUN_SMI_OWNER) + sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); +@@ -3212,9 +3215,14 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, const struct ib_ud_wr *wr, + } + sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); + if (!sqp->qp.ibqp.qp_num) +- ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, &pkey); ++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, ++ &pkey); + else +- ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, &pkey); ++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, ++ &pkey); ++ if (err) ++ return err; ++ + sqp->ud_header.bth.pkey = cpu_to_be16(pkey); + sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); + sqp->ud_header.bth.psn = cpu_to_be32((sqp->send_psn++) & ((1 << 24) - 1)); +diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c +index 48f48122ddcb..6a413d73b95d 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mmap.c ++++ b/drivers/infiniband/sw/rxe/rxe_mmap.c +@@ -151,7 +151,7 @@ struct rxe_mmap_info *rxe_create_mmap_info(struct rxe_dev *rxe, u32 size, + + ip = kmalloc(sizeof(*ip), GFP_KERNEL); + if (!ip) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + size = PAGE_ALIGN(size); + +diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c +index ff92704de32f..245040c3a35d 100644 +--- a/drivers/infiniband/sw/rxe/rxe_queue.c ++++ b/drivers/infiniband/sw/rxe/rxe_queue.c +@@ -45,12 +45,15 @@ int do_mmap_info(struct rxe_dev *rxe, struct mminfo __user *outbuf, + + if (outbuf) { + ip = rxe_create_mmap_info(rxe, buf_size, udata, buf); +- if (!ip) ++ if (IS_ERR(ip)) { ++ err = PTR_ERR(ip); + goto err1; ++ } + +- err = copy_to_user(outbuf, &ip->info, sizeof(ip->info)); +- if (err) ++ if (copy_to_user(outbuf, &ip->info, sizeof(ip->info))) { ++ err = -EFAULT; + goto err2; ++ } + + spin_lock_bh(&rxe->pending_lock); + list_add(&ip->pending_mmaps, &rxe->pending_mmaps); +@@ -64,7 +67,7 @@ int do_mmap_info(struct rxe_dev *rxe, struct mminfo __user *outbuf, + err2: + kfree(ip); + err1: +- return -EINVAL; ++ return err; + } + + inline void rxe_queue_reset(struct rxe_queue *q) +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 20cce366e951..500d0a8c966f 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -101,6 +101,8 @@ struct kmem_cache *amd_iommu_irq_cache; + static void update_domain(struct protection_domain *domain); + static int protection_domain_init(struct protection_domain *domain); + static void detach_device(struct device *dev); ++static void update_and_flush_device_table(struct protection_domain *domain, ++ struct domain_pgtable *pgtable); + + /**************************************************************************** + * +@@ -151,6 +153,26 @@ static struct protection_domain *to_pdomain(struct iommu_domain *dom) + return container_of(dom, struct protection_domain, domain); + } + ++static void amd_iommu_domain_get_pgtable(struct protection_domain *domain, ++ struct domain_pgtable *pgtable) ++{ ++ u64 pt_root = atomic64_read(&domain->pt_root); ++ ++ pgtable->root = (u64 *)(pt_root & PAGE_MASK); ++ pgtable->mode = pt_root & 7; /* lowest 3 bits encode pgtable mode */ ++} ++ ++static u64 amd_iommu_domain_encode_pgtable(u64 *root, int mode) ++{ ++ u64 pt_root; ++ ++ /* lowest 3 bits encode pgtable mode */ ++ pt_root = mode & 7; ++ pt_root |= (u64)root; ++ ++ return pt_root; ++} ++ + static struct iommu_dev_data *alloc_dev_data(u16 devid) + { + struct iommu_dev_data *dev_data; +@@ -1397,13 +1419,18 @@ static struct page *free_sub_pt(unsigned long root, int mode, + + static void free_pagetable(struct protection_domain *domain) + { +- unsigned long root = (unsigned long)domain->pt_root; ++ struct domain_pgtable pgtable; + struct page *freelist = NULL; ++ unsigned long root; + +- BUG_ON(domain->mode < PAGE_MODE_NONE || +- domain->mode > PAGE_MODE_6_LEVEL); ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ atomic64_set(&domain->pt_root, 0); + +- freelist = free_sub_pt(root, domain->mode, freelist); ++ BUG_ON(pgtable.mode < PAGE_MODE_NONE || ++ pgtable.mode > PAGE_MODE_6_LEVEL); ++ ++ root = (unsigned long)pgtable.root; ++ freelist = free_sub_pt(root, pgtable.mode, freelist); + + free_page_list(freelist); + } +@@ -1417,24 +1444,36 @@ static bool increase_address_space(struct protection_domain *domain, + unsigned long address, + gfp_t gfp) + { ++ struct domain_pgtable pgtable; + unsigned long flags; + bool ret = false; +- u64 *pte; ++ u64 *pte, root; + + spin_lock_irqsave(&domain->lock, flags); + +- if (address <= PM_LEVEL_SIZE(domain->mode) || +- WARN_ON_ONCE(domain->mode == PAGE_MODE_6_LEVEL)) ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ ++ if (address <= PM_LEVEL_SIZE(pgtable.mode) || ++ WARN_ON_ONCE(pgtable.mode == PAGE_MODE_6_LEVEL)) + goto out; + + pte = (void *)get_zeroed_page(gfp); + if (!pte) + goto out; + +- *pte = PM_LEVEL_PDE(domain->mode, +- iommu_virt_to_phys(domain->pt_root)); +- domain->pt_root = pte; +- domain->mode += 1; ++ *pte = PM_LEVEL_PDE(pgtable.mode, iommu_virt_to_phys(pgtable.root)); ++ ++ pgtable.root = pte; ++ pgtable.mode += 1; ++ update_and_flush_device_table(domain, &pgtable); ++ domain_flush_complete(domain); ++ ++ /* ++ * Device Table needs to be updated and flushed before the new root can ++ * be published. ++ */ ++ root = amd_iommu_domain_encode_pgtable(pte, pgtable.mode); ++ atomic64_set(&domain->pt_root, root); + + ret = true; + +@@ -1451,16 +1490,22 @@ static u64 *alloc_pte(struct protection_domain *domain, + gfp_t gfp, + bool *updated) + { ++ struct domain_pgtable pgtable; + int level, end_lvl; + u64 *pte, *page; + + BUG_ON(!is_power_of_2(page_size)); + +- while (address > PM_LEVEL_SIZE(domain->mode)) ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ ++ while (address > PM_LEVEL_SIZE(pgtable.mode)) { + *updated = increase_address_space(domain, address, gfp) || *updated; ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ } ++ + +- level = domain->mode - 1; +- pte = &domain->pt_root[PM_LEVEL_INDEX(level, address)]; ++ level = pgtable.mode - 1; ++ pte = &pgtable.root[PM_LEVEL_INDEX(level, address)]; + address = PAGE_SIZE_ALIGN(address, page_size); + end_lvl = PAGE_SIZE_LEVEL(page_size); + +@@ -1536,16 +1581,19 @@ static u64 *fetch_pte(struct protection_domain *domain, + unsigned long address, + unsigned long *page_size) + { ++ struct domain_pgtable pgtable; + int level; + u64 *pte; + + *page_size = 0; + +- if (address > PM_LEVEL_SIZE(domain->mode)) ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ ++ if (address > PM_LEVEL_SIZE(pgtable.mode)) + return NULL; + +- level = domain->mode - 1; +- pte = &domain->pt_root[PM_LEVEL_INDEX(level, address)]; ++ level = pgtable.mode - 1; ++ pte = &pgtable.root[PM_LEVEL_INDEX(level, address)]; + *page_size = PTE_LEVEL_PAGE_SIZE(level); + + while (level > 0) { +@@ -1806,6 +1854,7 @@ static void dma_ops_domain_free(struct protection_domain *domain) + static struct protection_domain *dma_ops_domain_alloc(void) + { + struct protection_domain *domain; ++ u64 *pt_root, root; + + domain = kzalloc(sizeof(struct protection_domain), GFP_KERNEL); + if (!domain) +@@ -1814,12 +1863,14 @@ static struct protection_domain *dma_ops_domain_alloc(void) + if (protection_domain_init(domain)) + goto free_domain; + +- domain->mode = PAGE_MODE_3_LEVEL; +- domain->pt_root = (void *)get_zeroed_page(GFP_KERNEL); +- domain->flags = PD_DMA_OPS_MASK; +- if (!domain->pt_root) ++ pt_root = (void *)get_zeroed_page(GFP_KERNEL); ++ if (!pt_root) + goto free_domain; + ++ root = amd_iommu_domain_encode_pgtable(pt_root, PAGE_MODE_3_LEVEL); ++ atomic64_set(&domain->pt_root, root); ++ domain->flags = PD_DMA_OPS_MASK; ++ + if (iommu_get_dma_cookie(&domain->domain) == -ENOMEM) + goto free_domain; + +@@ -1841,16 +1892,17 @@ static bool dma_ops_domain(struct protection_domain *domain) + } + + static void set_dte_entry(u16 devid, struct protection_domain *domain, ++ struct domain_pgtable *pgtable, + bool ats, bool ppr) + { + u64 pte_root = 0; + u64 flags = 0; + u32 old_domid; + +- if (domain->mode != PAGE_MODE_NONE) +- pte_root = iommu_virt_to_phys(domain->pt_root); ++ if (pgtable->mode != PAGE_MODE_NONE) ++ pte_root = iommu_virt_to_phys(pgtable->root); + +- pte_root |= (domain->mode & DEV_ENTRY_MODE_MASK) ++ pte_root |= (pgtable->mode & DEV_ENTRY_MODE_MASK) + << DEV_ENTRY_MODE_SHIFT; + pte_root |= DTE_FLAG_IR | DTE_FLAG_IW | DTE_FLAG_V | DTE_FLAG_TV; + +@@ -1923,6 +1975,7 @@ static void clear_dte_entry(u16 devid) + static void do_attach(struct iommu_dev_data *dev_data, + struct protection_domain *domain) + { ++ struct domain_pgtable pgtable; + struct amd_iommu *iommu; + bool ats; + +@@ -1938,7 +1991,9 @@ static void do_attach(struct iommu_dev_data *dev_data, + domain->dev_cnt += 1; + + /* Update device table */ +- set_dte_entry(dev_data->devid, domain, ats, dev_data->iommu_v2); ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ set_dte_entry(dev_data->devid, domain, &pgtable, ++ ats, dev_data->iommu_v2); + clone_aliases(dev_data->pdev); + + device_flush_dte(dev_data); +@@ -2249,22 +2304,34 @@ static int amd_iommu_domain_get_attr(struct iommu_domain *domain, + * + *****************************************************************************/ + +-static void update_device_table(struct protection_domain *domain) ++static void update_device_table(struct protection_domain *domain, ++ struct domain_pgtable *pgtable) + { + struct iommu_dev_data *dev_data; + + list_for_each_entry(dev_data, &domain->dev_list, list) { +- set_dte_entry(dev_data->devid, domain, dev_data->ats.enabled, +- dev_data->iommu_v2); ++ set_dte_entry(dev_data->devid, domain, pgtable, ++ dev_data->ats.enabled, dev_data->iommu_v2); + clone_aliases(dev_data->pdev); + } + } + ++static void update_and_flush_device_table(struct protection_domain *domain, ++ struct domain_pgtable *pgtable) ++{ ++ update_device_table(domain, pgtable); ++ domain_flush_devices(domain); ++} ++ + static void update_domain(struct protection_domain *domain) + { +- update_device_table(domain); ++ struct domain_pgtable pgtable; + +- domain_flush_devices(domain); ++ /* Update device table */ ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ update_and_flush_device_table(domain, &pgtable); ++ ++ /* Flush domain TLB(s) and wait for completion */ + domain_flush_tlb_pde(domain); + } + +@@ -2375,6 +2442,7 @@ out_err: + static struct iommu_domain *amd_iommu_domain_alloc(unsigned type) + { + struct protection_domain *pdomain; ++ u64 *pt_root, root; + + switch (type) { + case IOMMU_DOMAIN_UNMANAGED: +@@ -2382,13 +2450,15 @@ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type) + if (!pdomain) + return NULL; + +- pdomain->mode = PAGE_MODE_3_LEVEL; +- pdomain->pt_root = (void *)get_zeroed_page(GFP_KERNEL); +- if (!pdomain->pt_root) { ++ pt_root = (void *)get_zeroed_page(GFP_KERNEL); ++ if (!pt_root) { + protection_domain_free(pdomain); + return NULL; + } + ++ root = amd_iommu_domain_encode_pgtable(pt_root, PAGE_MODE_3_LEVEL); ++ atomic64_set(&pdomain->pt_root, root); ++ + pdomain->domain.geometry.aperture_start = 0; + pdomain->domain.geometry.aperture_end = ~0ULL; + pdomain->domain.geometry.force_aperture = true; +@@ -2406,7 +2476,7 @@ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type) + if (!pdomain) + return NULL; + +- pdomain->mode = PAGE_MODE_NONE; ++ atomic64_set(&pdomain->pt_root, PAGE_MODE_NONE); + break; + default: + return NULL; +@@ -2418,6 +2488,7 @@ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type) + static void amd_iommu_domain_free(struct iommu_domain *dom) + { + struct protection_domain *domain; ++ struct domain_pgtable pgtable; + + domain = to_pdomain(dom); + +@@ -2435,7 +2506,9 @@ static void amd_iommu_domain_free(struct iommu_domain *dom) + dma_ops_domain_free(domain); + break; + default: +- if (domain->mode != PAGE_MODE_NONE) ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ ++ if (pgtable.mode != PAGE_MODE_NONE) + free_pagetable(domain); + + if (domain->flags & PD_IOMMUV2_MASK) +@@ -2518,10 +2591,12 @@ static int amd_iommu_map(struct iommu_domain *dom, unsigned long iova, + gfp_t gfp) + { + struct protection_domain *domain = to_pdomain(dom); ++ struct domain_pgtable pgtable; + int prot = 0; + int ret; + +- if (domain->mode == PAGE_MODE_NONE) ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ if (pgtable.mode == PAGE_MODE_NONE) + return -EINVAL; + + if (iommu_prot & IOMMU_READ) +@@ -2541,8 +2616,10 @@ static size_t amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova, + struct iommu_iotlb_gather *gather) + { + struct protection_domain *domain = to_pdomain(dom); ++ struct domain_pgtable pgtable; + +- if (domain->mode == PAGE_MODE_NONE) ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ if (pgtable.mode == PAGE_MODE_NONE) + return 0; + + return iommu_unmap_page(domain, iova, page_size); +@@ -2553,9 +2630,11 @@ static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom, + { + struct protection_domain *domain = to_pdomain(dom); + unsigned long offset_mask, pte_pgsize; ++ struct domain_pgtable pgtable; + u64 *pte, __pte; + +- if (domain->mode == PAGE_MODE_NONE) ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ if (pgtable.mode == PAGE_MODE_NONE) + return iova; + + pte = fetch_pte(domain, iova, &pte_pgsize); +@@ -2708,16 +2787,26 @@ EXPORT_SYMBOL(amd_iommu_unregister_ppr_notifier); + void amd_iommu_domain_direct_map(struct iommu_domain *dom) + { + struct protection_domain *domain = to_pdomain(dom); ++ struct domain_pgtable pgtable; + unsigned long flags; ++ u64 pt_root; + + spin_lock_irqsave(&domain->lock, flags); + ++ /* First save pgtable configuration*/ ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ + /* Update data structure */ +- domain->mode = PAGE_MODE_NONE; ++ pt_root = amd_iommu_domain_encode_pgtable(NULL, PAGE_MODE_NONE); ++ atomic64_set(&domain->pt_root, pt_root); + + /* Make changes visible to IOMMUs */ + update_domain(domain); + ++ /* Restore old pgtable in domain->ptroot to free page-table */ ++ pt_root = amd_iommu_domain_encode_pgtable(pgtable.root, pgtable.mode); ++ atomic64_set(&domain->pt_root, pt_root); ++ + /* Page-table is not visible to IOMMU anymore, so free it */ + free_pagetable(domain); + +@@ -2908,9 +2997,11 @@ static u64 *__get_gcr3_pte(u64 *root, int level, int pasid, bool alloc) + static int __set_gcr3(struct protection_domain *domain, int pasid, + unsigned long cr3) + { ++ struct domain_pgtable pgtable; + u64 *pte; + +- if (domain->mode != PAGE_MODE_NONE) ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ if (pgtable.mode != PAGE_MODE_NONE) + return -EINVAL; + + pte = __get_gcr3_pte(domain->gcr3_tbl, domain->glx, pasid, true); +@@ -2924,9 +3015,11 @@ static int __set_gcr3(struct protection_domain *domain, int pasid, + + static int __clear_gcr3(struct protection_domain *domain, int pasid) + { ++ struct domain_pgtable pgtable; + u64 *pte; + +- if (domain->mode != PAGE_MODE_NONE) ++ amd_iommu_domain_get_pgtable(domain, &pgtable); ++ if (pgtable.mode != PAGE_MODE_NONE) + return -EINVAL; + + pte = __get_gcr3_pte(domain->gcr3_tbl, domain->glx, pasid, false); +diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h +index ca8c4522045b..7a8fdec138bd 100644 +--- a/drivers/iommu/amd_iommu_types.h ++++ b/drivers/iommu/amd_iommu_types.h +@@ -468,8 +468,7 @@ struct protection_domain { + iommu core code */ + spinlock_t lock; /* mostly used to lock the page table*/ + u16 id; /* the domain id written to the device table */ +- int mode; /* paging mode (0-6 levels) */ +- u64 *pt_root; /* page table root pointer */ ++ atomic64_t pt_root; /* pgtable root and pgtable mode */ + int glx; /* Number of levels for GCR3 table */ + u64 *gcr3_tbl; /* Guest CR3 table */ + unsigned long flags; /* flags to find out type of domain */ +@@ -477,6 +476,12 @@ struct protection_domain { + unsigned dev_iommu[MAX_IOMMUS]; /* per-IOMMU reference count */ + }; + ++/* For decocded pt_root */ ++struct domain_pgtable { ++ int mode; ++ u64 *root; ++}; ++ + /* + * Structure where we save information about one hardware AMD IOMMU in the + * system. +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 663d87924e5e..32db16f6debc 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -1417,6 +1417,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req) + struct mmc_request *mrq = &mqrq->brq.mrq; + struct request_queue *q = req->q; + struct mmc_host *host = mq->card->host; ++ enum mmc_issue_type issue_type = mmc_issue_type(mq, req); + unsigned long flags; + bool put_card; + int err; +@@ -1446,7 +1447,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req) + + spin_lock_irqsave(&mq->lock, flags); + +- mq->in_flight[mmc_issue_type(mq, req)] -= 1; ++ mq->in_flight[issue_type] -= 1; + + put_card = (mmc_tot_in_flight(mq) == 0); + +diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c +index 9edc08685e86..9c0ccb3744c2 100644 +--- a/drivers/mmc/core/queue.c ++++ b/drivers/mmc/core/queue.c +@@ -107,11 +107,10 @@ static enum blk_eh_timer_return mmc_cqe_timed_out(struct request *req) + case MMC_ISSUE_DCMD: + if (host->cqe_ops->cqe_timeout(host, mrq, &recovery_needed)) { + if (recovery_needed) +- __mmc_cqe_recovery_notifier(mq); ++ mmc_cqe_recovery_notifier(mrq); + return BLK_EH_RESET_TIMER; + } +- /* No timeout (XXX: huh? comment doesn't make much sense) */ +- blk_mq_complete_request(req); ++ /* The request has gone already */ + return BLK_EH_DONE; + default: + /* Timeout is handled by mmc core */ +@@ -125,18 +124,13 @@ static enum blk_eh_timer_return mmc_mq_timed_out(struct request *req, + struct request_queue *q = req->q; + struct mmc_queue *mq = q->queuedata; + unsigned long flags; +- int ret; ++ bool ignore_tout; + + spin_lock_irqsave(&mq->lock, flags); +- +- if (mq->recovery_needed || !mq->use_cqe) +- ret = BLK_EH_RESET_TIMER; +- else +- ret = mmc_cqe_timed_out(req); +- ++ ignore_tout = mq->recovery_needed || !mq->use_cqe; + spin_unlock_irqrestore(&mq->lock, flags); + +- return ret; ++ return ignore_tout ? BLK_EH_RESET_TIMER : mmc_cqe_timed_out(req); + } + + static void mmc_mq_recovery_handler(struct work_struct *work) +diff --git a/drivers/mmc/host/alcor.c b/drivers/mmc/host/alcor.c +index 1aee485d56d4..026ca9194ce5 100644 +--- a/drivers/mmc/host/alcor.c ++++ b/drivers/mmc/host/alcor.c +@@ -1104,7 +1104,7 @@ static int alcor_pci_sdmmc_drv_probe(struct platform_device *pdev) + + if (ret) { + dev_err(&pdev->dev, "Failed to get irq for data line\n"); +- return ret; ++ goto free_host; + } + + mutex_init(&host->cmd_mutex); +@@ -1116,6 +1116,10 @@ static int alcor_pci_sdmmc_drv_probe(struct platform_device *pdev) + dev_set_drvdata(&pdev->dev, host); + mmc_add_host(mmc); + return 0; ++ ++free_host: ++ mmc_free_host(mmc); ++ return ret; + } + + static int alcor_pci_sdmmc_drv_remove(struct platform_device *pdev) +diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c +index 2a2173d953f5..7da47196c596 100644 +--- a/drivers/mmc/host/sdhci-acpi.c ++++ b/drivers/mmc/host/sdhci-acpi.c +@@ -605,10 +605,12 @@ static int sdhci_acpi_emmc_amd_probe_slot(struct platform_device *pdev, + } + + static const struct sdhci_acpi_slot sdhci_acpi_slot_amd_emmc = { +- .chip = &sdhci_acpi_chip_amd, +- .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE, +- .quirks = SDHCI_QUIRK_32BIT_DMA_ADDR | SDHCI_QUIRK_32BIT_DMA_SIZE | +- SDHCI_QUIRK_32BIT_ADMA_SIZE, ++ .chip = &sdhci_acpi_chip_amd, ++ .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE, ++ .quirks = SDHCI_QUIRK_32BIT_DMA_ADDR | ++ SDHCI_QUIRK_32BIT_DMA_SIZE | ++ SDHCI_QUIRK_32BIT_ADMA_SIZE, ++ .quirks2 = SDHCI_QUIRK2_BROKEN_64_BIT_DMA, + .probe_slot = sdhci_acpi_emmc_amd_probe_slot, + }; + +diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c +index ce15a05f23d4..fd76aa672e02 100644 +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -26,6 +26,9 @@ + #define SDHCI_GLI_9750_DRIVING_2 GENMASK(27, 26) + #define GLI_9750_DRIVING_1_VALUE 0xFFF + #define GLI_9750_DRIVING_2_VALUE 0x3 ++#define SDHCI_GLI_9750_SEL_1 BIT(29) ++#define SDHCI_GLI_9750_SEL_2 BIT(31) ++#define SDHCI_GLI_9750_ALL_RST (BIT(24)|BIT(25)|BIT(28)|BIT(30)) + + #define SDHCI_GLI_9750_PLL 0x864 + #define SDHCI_GLI_9750_PLL_TX2_INV BIT(23) +@@ -122,6 +125,8 @@ static void gli_set_9750(struct sdhci_host *host) + GLI_9750_DRIVING_1_VALUE); + driving_value |= FIELD_PREP(SDHCI_GLI_9750_DRIVING_2, + GLI_9750_DRIVING_2_VALUE); ++ driving_value &= ~(SDHCI_GLI_9750_SEL_1|SDHCI_GLI_9750_SEL_2|SDHCI_GLI_9750_ALL_RST); ++ driving_value |= SDHCI_GLI_9750_SEL_2; + sdhci_writel(host, driving_value, SDHCI_GLI_9750_DRIVING); + + sw_ctrl_value &= ~SDHCI_GLI_9750_SW_CTRL_4; +@@ -334,6 +339,18 @@ static u32 sdhci_gl9750_readl(struct sdhci_host *host, int reg) + return value; + } + ++#ifdef CONFIG_PM_SLEEP ++static int sdhci_pci_gli_resume(struct sdhci_pci_chip *chip) ++{ ++ struct sdhci_pci_slot *slot = chip->slots[0]; ++ ++ pci_free_irq_vectors(slot->chip->pdev); ++ gli_pcie_enable_msi(slot); ++ ++ return sdhci_pci_resume_host(chip); ++} ++#endif ++ + static const struct sdhci_ops sdhci_gl9755_ops = { + .set_clock = sdhci_set_clock, + .enable_dma = sdhci_pci_enable_dma, +@@ -348,6 +365,9 @@ const struct sdhci_pci_fixes sdhci_gl9755 = { + .quirks2 = SDHCI_QUIRK2_BROKEN_DDR50, + .probe_slot = gli_probe_slot_gl9755, + .ops = &sdhci_gl9755_ops, ++#ifdef CONFIG_PM_SLEEP ++ .resume = sdhci_pci_gli_resume, ++#endif + }; + + static const struct sdhci_ops sdhci_gl9750_ops = { +@@ -366,4 +386,7 @@ const struct sdhci_pci_fixes sdhci_gl9750 = { + .quirks2 = SDHCI_QUIRK2_BROKEN_DDR50, + .probe_slot = gli_probe_slot_gl9750, + .ops = &sdhci_gl9750_ops, ++#ifdef CONFIG_PM_SLEEP ++ .resume = sdhci_pci_gli_resume, ++#endif + }; +diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c +index fdcb70b9f0e4..400207c5c7de 100644 +--- a/drivers/net/dsa/dsa_loop.c ++++ b/drivers/net/dsa/dsa_loop.c +@@ -360,6 +360,7 @@ static void __exit dsa_loop_exit(void) + } + module_exit(dsa_loop_exit); + ++MODULE_SOFTDEP("pre: dsa_loop_bdinfo"); + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Florian Fainelli"); + MODULE_DESCRIPTION("DSA loopback driver"); +diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c +index 9e895ab586d5..a7780c06fa65 100644 +--- a/drivers/net/dsa/ocelot/felix.c ++++ b/drivers/net/dsa/ocelot/felix.c +@@ -397,6 +397,7 @@ static int felix_init_structs(struct felix *felix, int num_phys_ports) + ocelot->stats_layout = felix->info->stats_layout; + ocelot->num_stats = felix->info->num_stats; + ocelot->shared_queue_sz = felix->info->shared_queue_sz; ++ ocelot->num_mact_rows = felix->info->num_mact_rows; + ocelot->ops = felix->info->ops; + + port_phy_modes = kcalloc(num_phys_ports, sizeof(phy_interface_t), +diff --git a/drivers/net/dsa/ocelot/felix.h b/drivers/net/dsa/ocelot/felix.h +index 3a7580015b62..8771d40324f1 100644 +--- a/drivers/net/dsa/ocelot/felix.h ++++ b/drivers/net/dsa/ocelot/felix.h +@@ -15,6 +15,7 @@ struct felix_info { + const u32 *const *map; + const struct ocelot_ops *ops; + int shared_queue_sz; ++ int num_mact_rows; + const struct ocelot_stat_layout *stats_layout; + unsigned int num_stats; + int num_ports; +diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c +index 2c812b481778..edc1a67c002b 100644 +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -1090,6 +1090,7 @@ struct felix_info felix_info_vsc9959 = { + .stats_layout = vsc9959_stats_layout, + .num_stats = ARRAY_SIZE(vsc9959_stats_layout), + .shared_queue_sz = 128 * 1024, ++ .num_mact_rows = 2048, + .num_ports = 6, + .switch_pci_bar = 4, + .imdio_pci_bar = 0, +diff --git a/drivers/net/ethernet/broadcom/Kconfig b/drivers/net/ethernet/broadcom/Kconfig +index 53055ce5dfd6..2a69c0d06f3c 100644 +--- a/drivers/net/ethernet/broadcom/Kconfig ++++ b/drivers/net/ethernet/broadcom/Kconfig +@@ -69,6 +69,7 @@ config BCMGENET + select BCM7XXX_PHY + select MDIO_BCM_UNIMAC + select DIMLIB ++ select BROADCOM_PHY if ARCH_BCM2835 + help + This driver supports the built-in Ethernet MACs found in the + Broadcom BCM7xxx Set Top Box family chipset. +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 7ff147e89426..d9bbaa734d98 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -86,7 +86,7 @@ static void free_rx_fd(struct dpaa2_eth_priv *priv, + for (i = 1; i < DPAA2_ETH_MAX_SG_ENTRIES; i++) { + addr = dpaa2_sg_get_addr(&sgt[i]); + sg_vaddr = dpaa2_iova_to_virt(priv->iommu_domain, addr); +- dma_unmap_page(dev, addr, DPAA2_ETH_RX_BUF_SIZE, ++ dma_unmap_page(dev, addr, priv->rx_buf_size, + DMA_BIDIRECTIONAL); + + free_pages((unsigned long)sg_vaddr, 0); +@@ -144,7 +144,7 @@ static struct sk_buff *build_frag_skb(struct dpaa2_eth_priv *priv, + /* Get the address and length from the S/G entry */ + sg_addr = dpaa2_sg_get_addr(sge); + sg_vaddr = dpaa2_iova_to_virt(priv->iommu_domain, sg_addr); +- dma_unmap_page(dev, sg_addr, DPAA2_ETH_RX_BUF_SIZE, ++ dma_unmap_page(dev, sg_addr, priv->rx_buf_size, + DMA_BIDIRECTIONAL); + + sg_length = dpaa2_sg_get_len(sge); +@@ -185,7 +185,7 @@ static struct sk_buff *build_frag_skb(struct dpaa2_eth_priv *priv, + (page_address(page) - page_address(head_page)); + + skb_add_rx_frag(skb, i - 1, head_page, page_offset, +- sg_length, DPAA2_ETH_RX_BUF_SIZE); ++ sg_length, priv->rx_buf_size); + } + + if (dpaa2_sg_is_final(sge)) +@@ -211,7 +211,7 @@ static void free_bufs(struct dpaa2_eth_priv *priv, u64 *buf_array, int count) + + for (i = 0; i < count; i++) { + vaddr = dpaa2_iova_to_virt(priv->iommu_domain, buf_array[i]); +- dma_unmap_page(dev, buf_array[i], DPAA2_ETH_RX_BUF_SIZE, ++ dma_unmap_page(dev, buf_array[i], priv->rx_buf_size, + DMA_BIDIRECTIONAL); + free_pages((unsigned long)vaddr, 0); + } +@@ -335,7 +335,7 @@ static u32 run_xdp(struct dpaa2_eth_priv *priv, + break; + case XDP_REDIRECT: + dma_unmap_page(priv->net_dev->dev.parent, addr, +- DPAA2_ETH_RX_BUF_SIZE, DMA_BIDIRECTIONAL); ++ priv->rx_buf_size, DMA_BIDIRECTIONAL); + ch->buf_count--; + xdp.data_hard_start = vaddr; + err = xdp_do_redirect(priv->net_dev, &xdp, xdp_prog); +@@ -374,7 +374,7 @@ static void dpaa2_eth_rx(struct dpaa2_eth_priv *priv, + trace_dpaa2_rx_fd(priv->net_dev, fd); + + vaddr = dpaa2_iova_to_virt(priv->iommu_domain, addr); +- dma_sync_single_for_cpu(dev, addr, DPAA2_ETH_RX_BUF_SIZE, ++ dma_sync_single_for_cpu(dev, addr, priv->rx_buf_size, + DMA_BIDIRECTIONAL); + + fas = dpaa2_get_fas(vaddr, false); +@@ -393,13 +393,13 @@ static void dpaa2_eth_rx(struct dpaa2_eth_priv *priv, + return; + } + +- dma_unmap_page(dev, addr, DPAA2_ETH_RX_BUF_SIZE, ++ dma_unmap_page(dev, addr, priv->rx_buf_size, + DMA_BIDIRECTIONAL); + skb = build_linear_skb(ch, fd, vaddr); + } else if (fd_format == dpaa2_fd_sg) { + WARN_ON(priv->xdp_prog); + +- dma_unmap_page(dev, addr, DPAA2_ETH_RX_BUF_SIZE, ++ dma_unmap_page(dev, addr, priv->rx_buf_size, + DMA_BIDIRECTIONAL); + skb = build_frag_skb(priv, ch, buf_data); + free_pages((unsigned long)vaddr, 0); +@@ -974,7 +974,7 @@ static int add_bufs(struct dpaa2_eth_priv *priv, + if (!page) + goto err_alloc; + +- addr = dma_map_page(dev, page, 0, DPAA2_ETH_RX_BUF_SIZE, ++ addr = dma_map_page(dev, page, 0, priv->rx_buf_size, + DMA_BIDIRECTIONAL); + if (unlikely(dma_mapping_error(dev, addr))) + goto err_map; +@@ -984,7 +984,7 @@ static int add_bufs(struct dpaa2_eth_priv *priv, + /* tracing point */ + trace_dpaa2_eth_buf_seed(priv->net_dev, + page, DPAA2_ETH_RX_BUF_RAW_SIZE, +- addr, DPAA2_ETH_RX_BUF_SIZE, ++ addr, priv->rx_buf_size, + bpid); + } + +@@ -1715,7 +1715,7 @@ static bool xdp_mtu_valid(struct dpaa2_eth_priv *priv, int mtu) + int mfl, linear_mfl; + + mfl = DPAA2_ETH_L2_MAX_FRM(mtu); +- linear_mfl = DPAA2_ETH_RX_BUF_SIZE - DPAA2_ETH_RX_HWA_SIZE - ++ linear_mfl = priv->rx_buf_size - DPAA2_ETH_RX_HWA_SIZE - + dpaa2_eth_rx_head_room(priv) - XDP_PACKET_HEADROOM; + + if (mfl > linear_mfl) { +@@ -2457,6 +2457,11 @@ static int set_buffer_layout(struct dpaa2_eth_priv *priv) + else + rx_buf_align = DPAA2_ETH_RX_BUF_ALIGN; + ++ /* We need to ensure that the buffer size seen by WRIOP is a multiple ++ * of 64 or 256 bytes depending on the WRIOP version. ++ */ ++ priv->rx_buf_size = ALIGN_DOWN(DPAA2_ETH_RX_BUF_SIZE, rx_buf_align); ++ + /* tx buffer */ + buf_layout.private_data_size = DPAA2_ETH_SWA_SIZE; + buf_layout.pass_timestamp = true; +@@ -3121,7 +3126,7 @@ static int bind_dpni(struct dpaa2_eth_priv *priv) + pools_params.num_dpbp = 1; + pools_params.pools[0].dpbp_id = priv->dpbp_dev->obj_desc.id; + pools_params.pools[0].backup_pool = 0; +- pools_params.pools[0].buffer_size = DPAA2_ETH_RX_BUF_SIZE; ++ pools_params.pools[0].buffer_size = priv->rx_buf_size; + err = dpni_set_pools(priv->mc_io, 0, priv->mc_token, &pools_params); + if (err) { + dev_err(dev, "dpni_set_pools() failed\n"); +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h +index 7635db3ef903..13242bf5b427 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h +@@ -382,6 +382,7 @@ struct dpaa2_eth_priv { + u16 tx_data_offset; + + struct fsl_mc_device *dpbp_dev; ++ u16 rx_buf_size; + u16 bpid; + struct iommu_domain *iommu_domain; + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c +index 96676abcebd5..c53f091af2cf 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c +@@ -625,7 +625,7 @@ static int num_rules(struct dpaa2_eth_priv *priv) + + static int update_cls_rule(struct net_device *net_dev, + struct ethtool_rx_flow_spec *new_fs, +- int location) ++ unsigned int location) + { + struct dpaa2_eth_priv *priv = netdev_priv(net_dev); + struct dpaa2_eth_cls_rule *rule; +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c +index 8995e32dd1c0..992908e6eebf 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c +@@ -45,6 +45,8 @@ + + #define MGMT_MSG_TIMEOUT 5000 + ++#define SET_FUNC_PORT_MGMT_TIMEOUT 25000 ++ + #define mgmt_to_pfhwdev(pf_mgmt) \ + container_of(pf_mgmt, struct hinic_pfhwdev, pf_to_mgmt) + +@@ -238,12 +240,13 @@ static int msg_to_mgmt_sync(struct hinic_pf_to_mgmt *pf_to_mgmt, + u8 *buf_in, u16 in_size, + u8 *buf_out, u16 *out_size, + enum mgmt_direction_type direction, +- u16 resp_msg_id) ++ u16 resp_msg_id, u32 timeout) + { + struct hinic_hwif *hwif = pf_to_mgmt->hwif; + struct pci_dev *pdev = hwif->pdev; + struct hinic_recv_msg *recv_msg; + struct completion *recv_done; ++ unsigned long timeo; + u16 msg_id; + int err; + +@@ -267,8 +270,9 @@ static int msg_to_mgmt_sync(struct hinic_pf_to_mgmt *pf_to_mgmt, + goto unlock_sync_msg; + } + +- if (!wait_for_completion_timeout(recv_done, +- msecs_to_jiffies(MGMT_MSG_TIMEOUT))) { ++ timeo = msecs_to_jiffies(timeout ? timeout : MGMT_MSG_TIMEOUT); ++ ++ if (!wait_for_completion_timeout(recv_done, timeo)) { + dev_err(&pdev->dev, "MGMT timeout, MSG id = %d\n", msg_id); + err = -ETIMEDOUT; + goto unlock_sync_msg; +@@ -342,6 +346,7 @@ int hinic_msg_to_mgmt(struct hinic_pf_to_mgmt *pf_to_mgmt, + { + struct hinic_hwif *hwif = pf_to_mgmt->hwif; + struct pci_dev *pdev = hwif->pdev; ++ u32 timeout = 0; + + if (sync != HINIC_MGMT_MSG_SYNC) { + dev_err(&pdev->dev, "Invalid MGMT msg type\n"); +@@ -353,9 +358,12 @@ int hinic_msg_to_mgmt(struct hinic_pf_to_mgmt *pf_to_mgmt, + return -EINVAL; + } + ++ if (cmd == HINIC_PORT_CMD_SET_FUNC_STATE) ++ timeout = SET_FUNC_PORT_MGMT_TIMEOUT; ++ + return msg_to_mgmt_sync(pf_to_mgmt, mod, cmd, buf_in, in_size, + buf_out, out_size, MGMT_DIRECT_SEND, +- MSG_NOT_RESP); ++ MSG_NOT_RESP, timeout); + } + + /** +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c +index 13560975c103..63b92f6cc856 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c +@@ -483,7 +483,6 @@ static int hinic_close(struct net_device *netdev) + { + struct hinic_dev *nic_dev = netdev_priv(netdev); + unsigned int flags; +- int err; + + down(&nic_dev->mgmt_lock); + +@@ -497,20 +496,9 @@ static int hinic_close(struct net_device *netdev) + + up(&nic_dev->mgmt_lock); + +- err = hinic_port_set_func_state(nic_dev, HINIC_FUNC_PORT_DISABLE); +- if (err) { +- netif_err(nic_dev, drv, netdev, +- "Failed to set func port state\n"); +- nic_dev->flags |= (flags & HINIC_INTF_UP); +- return err; +- } ++ hinic_port_set_state(nic_dev, HINIC_PORT_DISABLE); + +- err = hinic_port_set_state(nic_dev, HINIC_PORT_DISABLE); +- if (err) { +- netif_err(nic_dev, drv, netdev, "Failed to set port state\n"); +- nic_dev->flags |= (flags & HINIC_INTF_UP); +- return err; +- } ++ hinic_port_set_func_state(nic_dev, HINIC_FUNC_PORT_DISABLE); + + if (nic_dev->flags & HINIC_RSS_ENABLE) { + hinic_rss_deinit(nic_dev); +diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c +index e1651756bf9d..f70bb81e1ed6 100644 +--- a/drivers/net/ethernet/moxa/moxart_ether.c ++++ b/drivers/net/ethernet/moxa/moxart_ether.c +@@ -564,7 +564,7 @@ static int moxart_remove(struct platform_device *pdev) + struct net_device *ndev = platform_get_drvdata(pdev); + + unregister_netdev(ndev); +- free_irq(ndev->irq, ndev); ++ devm_free_irq(&pdev->dev, ndev->irq, ndev); + moxart_mac_free_memory(ndev); + free_netdev(ndev); + +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index b14286dc49fb..419e2ce2eac0 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -1016,10 +1016,8 @@ int ocelot_fdb_dump(struct ocelot *ocelot, int port, + { + int i, j; + +- /* Loop through all the mac tables entries. There are 1024 rows of 4 +- * entries. +- */ +- for (i = 0; i < 1024; i++) { ++ /* Loop through all the mac tables entries. */ ++ for (i = 0; i < ocelot->num_mact_rows; i++) { + for (j = 0; j < 4; j++) { + struct ocelot_mact_entry entry; + bool is_static; +@@ -1446,8 +1444,15 @@ static void ocelot_port_attr_stp_state_set(struct ocelot *ocelot, int port, + + void ocelot_set_ageing_time(struct ocelot *ocelot, unsigned int msecs) + { +- ocelot_write(ocelot, ANA_AUTOAGE_AGE_PERIOD(msecs / 2), +- ANA_AUTOAGE); ++ unsigned int age_period = ANA_AUTOAGE_AGE_PERIOD(msecs / 2000); ++ ++ /* Setting AGE_PERIOD to zero effectively disables automatic aging, ++ * which is clearly not what our intention is. So avoid that. ++ */ ++ if (!age_period) ++ age_period = 1; ++ ++ ocelot_rmw(ocelot, age_period, ANA_AUTOAGE_AGE_PERIOD_M, ANA_AUTOAGE); + } + EXPORT_SYMBOL(ocelot_set_ageing_time); + +diff --git a/drivers/net/ethernet/mscc/ocelot_regs.c b/drivers/net/ethernet/mscc/ocelot_regs.c +index b88b5899b227..7d4fd1b6adda 100644 +--- a/drivers/net/ethernet/mscc/ocelot_regs.c ++++ b/drivers/net/ethernet/mscc/ocelot_regs.c +@@ -431,6 +431,7 @@ int ocelot_chip_init(struct ocelot *ocelot, const struct ocelot_ops *ops) + ocelot->stats_layout = ocelot_stats_layout; + ocelot->num_stats = ARRAY_SIZE(ocelot_stats_layout); + ocelot->shared_queue_sz = 224 * 1024; ++ ocelot->num_mact_rows = 1024; + ocelot->ops = ops; + + ret = ocelot_regfields_init(ocelot, ocelot_regfields); +diff --git a/drivers/net/ethernet/natsemi/jazzsonic.c b/drivers/net/ethernet/natsemi/jazzsonic.c +index 51fa82b429a3..40970352d208 100644 +--- a/drivers/net/ethernet/natsemi/jazzsonic.c ++++ b/drivers/net/ethernet/natsemi/jazzsonic.c +@@ -235,11 +235,13 @@ static int jazz_sonic_probe(struct platform_device *pdev) + + err = register_netdev(dev); + if (err) +- goto out1; ++ goto undo_probe1; + + return 0; + +-out1: ++undo_probe1: ++ dma_free_coherent(lp->device, SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode), ++ lp->descriptors, lp->descriptors_laddr); + release_mem_region(dev->base_addr, SONIC_MEM_SIZE); + out: + free_netdev(dev); +diff --git a/drivers/net/ethernet/netronome/nfp/abm/main.c b/drivers/net/ethernet/netronome/nfp/abm/main.c +index 354efffac0f9..bdbf0726145e 100644 +--- a/drivers/net/ethernet/netronome/nfp/abm/main.c ++++ b/drivers/net/ethernet/netronome/nfp/abm/main.c +@@ -333,8 +333,10 @@ nfp_abm_vnic_alloc(struct nfp_app *app, struct nfp_net *nn, unsigned int id) + goto err_free_alink; + + alink->prio_map = kzalloc(abm->prio_map_len, GFP_KERNEL); +- if (!alink->prio_map) ++ if (!alink->prio_map) { ++ err = -ENOMEM; + goto err_free_alink; ++ } + + /* This is a multi-host app, make sure MAC/PHY is up, but don't + * make the MAC/PHY state follow the state of any of the ports. +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 6b633e9d76da..07a6b609f741 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -2127,6 +2127,8 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp) + { 0x7cf, 0x348, RTL_GIGA_MAC_VER_07 }, + { 0x7cf, 0x248, RTL_GIGA_MAC_VER_07 }, + { 0x7cf, 0x340, RTL_GIGA_MAC_VER_13 }, ++ /* RTL8401, reportedly works if treated as RTL8101e */ ++ { 0x7cf, 0x240, RTL_GIGA_MAC_VER_13 }, + { 0x7cf, 0x343, RTL_GIGA_MAC_VER_10 }, + { 0x7cf, 0x342, RTL_GIGA_MAC_VER_16 }, + { 0x7c8, 0x348, RTL_GIGA_MAC_VER_09 }, +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c +index e0a5fe83d8e0..bfc4a92f1d92 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c +@@ -75,6 +75,11 @@ struct ethqos_emac_por { + unsigned int value; + }; + ++struct ethqos_emac_driver_data { ++ const struct ethqos_emac_por *por; ++ unsigned int num_por; ++}; ++ + struct qcom_ethqos { + struct platform_device *pdev; + void __iomem *rgmii_base; +@@ -171,6 +176,11 @@ static const struct ethqos_emac_por emac_v2_3_0_por[] = { + { .offset = RGMII_IO_MACRO_CONFIG2, .value = 0x00002060 }, + }; + ++static const struct ethqos_emac_driver_data emac_v2_3_0_data = { ++ .por = emac_v2_3_0_por, ++ .num_por = ARRAY_SIZE(emac_v2_3_0_por), ++}; ++ + static int ethqos_dll_configure(struct qcom_ethqos *ethqos) + { + unsigned int val; +@@ -442,6 +452,7 @@ static int qcom_ethqos_probe(struct platform_device *pdev) + struct device_node *np = pdev->dev.of_node; + struct plat_stmmacenet_data *plat_dat; + struct stmmac_resources stmmac_res; ++ const struct ethqos_emac_driver_data *data; + struct qcom_ethqos *ethqos; + struct resource *res; + int ret; +@@ -471,7 +482,9 @@ static int qcom_ethqos_probe(struct platform_device *pdev) + goto err_mem; + } + +- ethqos->por = of_device_get_match_data(&pdev->dev); ++ data = of_device_get_match_data(&pdev->dev); ++ ethqos->por = data->por; ++ ethqos->num_por = data->num_por; + + ethqos->rgmii_clk = devm_clk_get(&pdev->dev, "rgmii"); + if (IS_ERR(ethqos->rgmii_clk)) { +@@ -526,7 +539,7 @@ static int qcom_ethqos_remove(struct platform_device *pdev) + } + + static const struct of_device_id qcom_ethqos_match[] = { +- { .compatible = "qcom,qcs404-ethqos", .data = &emac_v2_3_0_por}, ++ { .compatible = "qcom,qcs404-ethqos", .data = &emac_v2_3_0_data}, + { } + }; + MODULE_DEVICE_TABLE(of, qcom_ethqos_match); +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +index 494c859b4ade..67ba67ed0cb9 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +@@ -624,7 +624,7 @@ int dwmac5_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, + total_offset += offset; + } + +- total_ctr = cfg->ctr[0] + cfg->ctr[1] * 1000000000; ++ total_ctr = cfg->ctr[0] + cfg->ctr[1] * 1000000000ULL; + total_ctr += total_offset; + + ctr_low = do_div(total_ctr, 1000000000); +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 2c0a24c606fc..28a5d46ad526 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -710,7 +710,8 @@ no_memory: + goto drop; + } + +-static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t netvsc_start_xmit(struct sk_buff *skb, ++ struct net_device *ndev) + { + return netvsc_xmit(skb, ndev, false); + } +diff --git a/drivers/net/phy/microchip_t1.c b/drivers/net/phy/microchip_t1.c +index 001def4509c2..fed3e395f18e 100644 +--- a/drivers/net/phy/microchip_t1.c ++++ b/drivers/net/phy/microchip_t1.c +@@ -3,9 +3,21 @@ + + #include + #include ++#include + #include + #include + ++/* External Register Control Register */ ++#define LAN87XX_EXT_REG_CTL (0x14) ++#define LAN87XX_EXT_REG_CTL_RD_CTL (0x1000) ++#define LAN87XX_EXT_REG_CTL_WR_CTL (0x0800) ++ ++/* External Register Read Data Register */ ++#define LAN87XX_EXT_REG_RD_DATA (0x15) ++ ++/* External Register Write Data Register */ ++#define LAN87XX_EXT_REG_WR_DATA (0x16) ++ + /* Interrupt Source Register */ + #define LAN87XX_INTERRUPT_SOURCE (0x18) + +@@ -14,9 +26,160 @@ + #define LAN87XX_MASK_LINK_UP (0x0004) + #define LAN87XX_MASK_LINK_DOWN (0x0002) + ++/* phyaccess nested types */ ++#define PHYACC_ATTR_MODE_READ 0 ++#define PHYACC_ATTR_MODE_WRITE 1 ++#define PHYACC_ATTR_MODE_MODIFY 2 ++ ++#define PHYACC_ATTR_BANK_SMI 0 ++#define PHYACC_ATTR_BANK_MISC 1 ++#define PHYACC_ATTR_BANK_PCS 2 ++#define PHYACC_ATTR_BANK_AFE 3 ++#define PHYACC_ATTR_BANK_MAX 7 ++ + #define DRIVER_AUTHOR "Nisar Sayed " + #define DRIVER_DESC "Microchip LAN87XX T1 PHY driver" + ++struct access_ereg_val { ++ u8 mode; ++ u8 bank; ++ u8 offset; ++ u16 val; ++ u16 mask; ++}; ++ ++static int access_ereg(struct phy_device *phydev, u8 mode, u8 bank, ++ u8 offset, u16 val) ++{ ++ u16 ereg = 0; ++ int rc = 0; ++ ++ if (mode > PHYACC_ATTR_MODE_WRITE || bank > PHYACC_ATTR_BANK_MAX) ++ return -EINVAL; ++ ++ if (bank == PHYACC_ATTR_BANK_SMI) { ++ if (mode == PHYACC_ATTR_MODE_WRITE) ++ rc = phy_write(phydev, offset, val); ++ else ++ rc = phy_read(phydev, offset); ++ return rc; ++ } ++ ++ if (mode == PHYACC_ATTR_MODE_WRITE) { ++ ereg = LAN87XX_EXT_REG_CTL_WR_CTL; ++ rc = phy_write(phydev, LAN87XX_EXT_REG_WR_DATA, val); ++ if (rc < 0) ++ return rc; ++ } else { ++ ereg = LAN87XX_EXT_REG_CTL_RD_CTL; ++ } ++ ++ ereg |= (bank << 8) | offset; ++ ++ rc = phy_write(phydev, LAN87XX_EXT_REG_CTL, ereg); ++ if (rc < 0) ++ return rc; ++ ++ if (mode == PHYACC_ATTR_MODE_READ) ++ rc = phy_read(phydev, LAN87XX_EXT_REG_RD_DATA); ++ ++ return rc; ++} ++ ++static int access_ereg_modify_changed(struct phy_device *phydev, ++ u8 bank, u8 offset, u16 val, u16 mask) ++{ ++ int new = 0, rc = 0; ++ ++ if (bank > PHYACC_ATTR_BANK_MAX) ++ return -EINVAL; ++ ++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_READ, bank, offset, val); ++ if (rc < 0) ++ return rc; ++ ++ new = val | (rc & (mask ^ 0xFFFF)); ++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_WRITE, bank, offset, new); ++ ++ return rc; ++} ++ ++static int lan87xx_phy_init(struct phy_device *phydev) ++{ ++ static const struct access_ereg_val init[] = { ++ /* TX Amplitude = 5 */ ++ {PHYACC_ATTR_MODE_MODIFY, PHYACC_ATTR_BANK_AFE, 0x0B, ++ 0x000A, 0x001E}, ++ /* Clear SMI interrupts */ ++ {PHYACC_ATTR_MODE_READ, PHYACC_ATTR_BANK_SMI, 0x18, ++ 0, 0}, ++ /* Clear MISC interrupts */ ++ {PHYACC_ATTR_MODE_READ, PHYACC_ATTR_BANK_MISC, 0x08, ++ 0, 0}, ++ /* Turn on TC10 Ring Oscillator (ROSC) */ ++ {PHYACC_ATTR_MODE_MODIFY, PHYACC_ATTR_BANK_MISC, 0x20, ++ 0x0020, 0x0020}, ++ /* WUR Detect Length to 1.2uS, LPC Detect Length to 1.09uS */ ++ {PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_PCS, 0x20, ++ 0x283C, 0}, ++ /* Wake_In Debounce Length to 39uS, Wake_Out Length to 79uS */ ++ {PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_MISC, 0x21, ++ 0x274F, 0}, ++ /* Enable Auto Wake Forward to Wake_Out, ROSC on, Sleep, ++ * and Wake_In to wake PHY ++ */ ++ {PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_MISC, 0x20, ++ 0x80A7, 0}, ++ /* Enable WUP Auto Fwd, Enable Wake on MDI, Wakeup Debouncer ++ * to 128 uS ++ */ ++ {PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_MISC, 0x24, ++ 0xF110, 0}, ++ /* Enable HW Init */ ++ {PHYACC_ATTR_MODE_MODIFY, PHYACC_ATTR_BANK_SMI, 0x1A, ++ 0x0100, 0x0100}, ++ }; ++ int rc, i; ++ ++ /* Start manual initialization procedures in Managed Mode */ ++ rc = access_ereg_modify_changed(phydev, PHYACC_ATTR_BANK_SMI, ++ 0x1a, 0x0000, 0x0100); ++ if (rc < 0) ++ return rc; ++ ++ /* Soft Reset the SMI block */ ++ rc = access_ereg_modify_changed(phydev, PHYACC_ATTR_BANK_SMI, ++ 0x00, 0x8000, 0x8000); ++ if (rc < 0) ++ return rc; ++ ++ /* Check to see if the self-clearing bit is cleared */ ++ usleep_range(1000, 2000); ++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_READ, ++ PHYACC_ATTR_BANK_SMI, 0x00, 0); ++ if (rc < 0) ++ return rc; ++ if ((rc & 0x8000) != 0) ++ return -ETIMEDOUT; ++ ++ /* PHY Initialization */ ++ for (i = 0; i < ARRAY_SIZE(init); i++) { ++ if (init[i].mode == PHYACC_ATTR_MODE_MODIFY) { ++ rc = access_ereg_modify_changed(phydev, init[i].bank, ++ init[i].offset, ++ init[i].val, ++ init[i].mask); ++ } else { ++ rc = access_ereg(phydev, init[i].mode, init[i].bank, ++ init[i].offset, init[i].val); ++ } ++ if (rc < 0) ++ return rc; ++ } ++ ++ return 0; ++} ++ + static int lan87xx_phy_config_intr(struct phy_device *phydev) + { + int rc, val = 0; +@@ -40,6 +203,13 @@ static int lan87xx_phy_ack_interrupt(struct phy_device *phydev) + return rc < 0 ? rc : 0; + } + ++static int lan87xx_config_init(struct phy_device *phydev) ++{ ++ int rc = lan87xx_phy_init(phydev); ++ ++ return rc < 0 ? rc : 0; ++} ++ + static struct phy_driver microchip_t1_phy_driver[] = { + { + .phy_id = 0x0007c150, +@@ -48,6 +218,7 @@ static struct phy_driver microchip_t1_phy_driver[] = { + + .features = PHY_BASIC_T1_FEATURES, + ++ .config_init = lan87xx_config_init, + .config_aneg = genphy_config_aneg, + + .ack_interrupt = lan87xx_phy_ack_interrupt, +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index 355bfdef48d2..594d97d3c8ab 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -1132,9 +1132,11 @@ int phy_ethtool_set_eee(struct phy_device *phydev, struct ethtool_eee *data) + /* Restart autonegotiation so the new modes get sent to the + * link partner. + */ +- ret = phy_restart_aneg(phydev); +- if (ret < 0) +- return ret; ++ if (phydev->autoneg == AUTONEG_ENABLE) { ++ ret = phy_restart_aneg(phydev); ++ if (ret < 0) ++ return ret; ++ } + } + + return 0; +diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c +index d760a36db28c..beedaad08255 100644 +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -490,6 +490,9 @@ static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, + if (!skb) + goto out; + ++ if (skb->pkt_type != PACKET_HOST) ++ goto abort; ++ + if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) + goto abort; + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 2fe7a3188282..f7129bc898cc 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1231,9 +1231,11 @@ static bool try_fill_recv(struct virtnet_info *vi, struct receive_queue *rq, + break; + } while (rq->vq->num_free); + if (virtqueue_kick_prepare(rq->vq) && virtqueue_notify(rq->vq)) { +- u64_stats_update_begin(&rq->stats.syncp); ++ unsigned long flags; ++ ++ flags = u64_stats_update_begin_irqsave(&rq->stats.syncp); + rq->stats.kicks++; +- u64_stats_update_end(&rq->stats.syncp); ++ u64_stats_update_end_irqrestore(&rq->stats.syncp, flags); + } + + return !oom; +diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c +index b409642f168d..9b821c9cbd16 100644 +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -1286,6 +1286,7 @@ static const struct gpio_chip byt_gpio_chip = { + .direction_output = byt_gpio_direction_output, + .get = byt_gpio_get, + .set = byt_gpio_set, ++ .set_config = gpiochip_generic_config, + .dbg_show = byt_gpio_dbg_show, + }; + +diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c +index 4c74fdde576d..1093a6105d40 100644 +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -1479,11 +1479,15 @@ static void chv_gpio_irq_handler(struct irq_desc *desc) + struct chv_pinctrl *pctrl = gpiochip_get_data(gc); + struct irq_chip *chip = irq_desc_get_chip(desc); + unsigned long pending; ++ unsigned long flags; + u32 intr_line; + + chained_irq_enter(chip, desc); + ++ raw_spin_lock_irqsave(&chv_lock, flags); + pending = readl(pctrl->regs + CHV_INTSTAT); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); ++ + for_each_set_bit(intr_line, &pending, pctrl->community->nirqs) { + unsigned int irq, offset; + +diff --git a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c +index 330c8f077b73..4d7a86a5a37b 100644 +--- a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c ++++ b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c +@@ -15,17 +15,18 @@ + + #include "pinctrl-intel.h" + +-#define SPT_PAD_OWN 0x020 +-#define SPT_PADCFGLOCK 0x0a0 +-#define SPT_HOSTSW_OWN 0x0d0 +-#define SPT_GPI_IS 0x100 +-#define SPT_GPI_IE 0x120 ++#define SPT_PAD_OWN 0x020 ++#define SPT_H_PADCFGLOCK 0x090 ++#define SPT_LP_PADCFGLOCK 0x0a0 ++#define SPT_HOSTSW_OWN 0x0d0 ++#define SPT_GPI_IS 0x100 ++#define SPT_GPI_IE 0x120 + + #define SPT_COMMUNITY(b, s, e) \ + { \ + .barno = (b), \ + .padown_offset = SPT_PAD_OWN, \ +- .padcfglock_offset = SPT_PADCFGLOCK, \ ++ .padcfglock_offset = SPT_LP_PADCFGLOCK, \ + .hostown_offset = SPT_HOSTSW_OWN, \ + .is_offset = SPT_GPI_IS, \ + .ie_offset = SPT_GPI_IE, \ +@@ -47,7 +48,7 @@ + { \ + .barno = (b), \ + .padown_offset = SPT_PAD_OWN, \ +- .padcfglock_offset = SPT_PADCFGLOCK, \ ++ .padcfglock_offset = SPT_H_PADCFGLOCK, \ + .hostown_offset = SPT_HOSTSW_OWN, \ + .is_offset = SPT_GPI_IS, \ + .ie_offset = SPT_GPI_IE, \ +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 1a948c3f54b7..9f1c9951949e 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -692,7 +692,7 @@ static void msm_gpio_update_dual_edge_pos(struct msm_pinctrl *pctrl, + + pol = msm_readl_intr_cfg(pctrl, g); + pol ^= BIT(g->intr_polarity_bit); +- msm_writel_intr_cfg(val, pctrl, g); ++ msm_writel_intr_cfg(pol, pctrl, g); + + val2 = msm_readl_io(pctrl, g) & BIT(g->in_bit); + intstat = msm_readl_intr_status(pctrl, g); +diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c +index 4fc2056bd227..e615dc240150 100644 +--- a/drivers/s390/net/ism_drv.c ++++ b/drivers/s390/net/ism_drv.c +@@ -521,8 +521,10 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + ism->smcd = smcd_alloc_dev(&pdev->dev, dev_name(&pdev->dev), &ism_ops, + ISM_NR_DMBS); +- if (!ism->smcd) ++ if (!ism->smcd) { ++ ret = -ENOMEM; + goto err_resource; ++ } + + ism->smcd->priv = ism; + ret = ism_dev_init(ism); +diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c +index 3574dbb09366..a5cccbd5d356 100644 +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -2548,7 +2548,7 @@ found: + link_trb = priv_req->trb; + + /* Update ring only if removed request is on pending_req_list list */ +- if (req_on_hw_ring) { ++ if (req_on_hw_ring && link_trb) { + link_trb->buffer = TRB_BUFFER(priv_ep->trb_pool_dma + + ((priv_req->end_trb + 1) * TRB_SIZE)); + link_trb->control = (link_trb->control & TRB_CYCLE) | +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 6833c918abce..d93d94d7ff50 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -217,6 +217,7 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma) + { + struct usb_memory *usbm = NULL; + struct usb_dev_state *ps = file->private_data; ++ struct usb_hcd *hcd = bus_to_hcd(ps->dev->bus); + size_t size = vma->vm_end - vma->vm_start; + void *mem; + unsigned long flags; +@@ -250,11 +251,19 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma) + usbm->vma_use_count = 1; + INIT_LIST_HEAD(&usbm->memlist); + +- if (remap_pfn_range(vma, vma->vm_start, +- virt_to_phys(usbm->mem) >> PAGE_SHIFT, +- size, vma->vm_page_prot) < 0) { +- dec_usb_memory_use_count(usbm, &usbm->vma_use_count); +- return -EAGAIN; ++ if (hcd->localmem_pool || !hcd_uses_dma(hcd)) { ++ if (remap_pfn_range(vma, vma->vm_start, ++ virt_to_phys(usbm->mem) >> PAGE_SHIFT, ++ size, vma->vm_page_prot) < 0) { ++ dec_usb_memory_use_count(usbm, &usbm->vma_use_count); ++ return -EAGAIN; ++ } ++ } else { ++ if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle, ++ size)) { ++ dec_usb_memory_use_count(usbm, &usbm->vma_use_count); ++ return -EAGAIN; ++ } + } + + vma->vm_flags |= VM_IO; +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 2b6565c06c23..fc748c731832 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -39,6 +39,7 @@ + + #define USB_VENDOR_GENESYS_LOGIC 0x05e3 + #define USB_VENDOR_SMSC 0x0424 ++#define USB_PRODUCT_USB5534B 0x5534 + #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01 + #define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02 + +@@ -5621,8 +5622,11 @@ out_hdev_lock: + } + + static const struct usb_device_id hub_id_table[] = { +- { .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_CLASS, ++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR ++ | USB_DEVICE_ID_MATCH_PRODUCT ++ | USB_DEVICE_ID_MATCH_INT_CLASS, + .idVendor = USB_VENDOR_SMSC, ++ .idProduct = USB_PRODUCT_USB5534B, + .bInterfaceClass = USB_CLASS_HUB, + .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND}, + { .match_flags = USB_DEVICE_ID_MATCH_VENDOR +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index bc1cf6d0412a..7e9643d25b14 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2483,9 +2483,6 @@ static int dwc3_gadget_ep_reclaim_trb_sg(struct dwc3_ep *dep, + for_each_sg(sg, s, pending, i) { + trb = &dep->trb_pool[dep->trb_dequeue]; + +- if (trb->ctrl & DWC3_TRB_CTRL_HWO) +- break; +- + req->sg = sg_next(s); + req->num_pending_sgs--; + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 32b637e3e1fa..6a9aa4413d64 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -260,6 +260,9 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item, + char *name; + int ret; + ++ if (strlen(page) < len) ++ return -EOVERFLOW; ++ + name = kstrdup(page, GFP_KERNEL); + if (!name) + return -ENOMEM; +diff --git a/drivers/usb/gadget/legacy/audio.c b/drivers/usb/gadget/legacy/audio.c +index dd81fd538cb8..a748ed0842e8 100644 +--- a/drivers/usb/gadget/legacy/audio.c ++++ b/drivers/usb/gadget/legacy/audio.c +@@ -300,8 +300,10 @@ static int audio_bind(struct usb_composite_dev *cdev) + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(cdev->gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto fail; ++ } + usb_otg_descriptor_init(cdev->gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; +diff --git a/drivers/usb/gadget/legacy/cdc2.c b/drivers/usb/gadget/legacy/cdc2.c +index 8d7a556ece30..563363aba48f 100644 +--- a/drivers/usb/gadget/legacy/cdc2.c ++++ b/drivers/usb/gadget/legacy/cdc2.c +@@ -179,8 +179,10 @@ static int cdc_bind(struct usb_composite_dev *cdev) + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto fail1; ++ } + usb_otg_descriptor_init(gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; +diff --git a/drivers/usb/gadget/legacy/ncm.c b/drivers/usb/gadget/legacy/ncm.c +index c61e71ba7045..0f1b45e3abd1 100644 +--- a/drivers/usb/gadget/legacy/ncm.c ++++ b/drivers/usb/gadget/legacy/ncm.c +@@ -156,8 +156,10 @@ static int gncm_bind(struct usb_composite_dev *cdev) + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto fail; ++ } + usb_otg_descriptor_init(gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; +diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c +index a8273b589456..5af0fe9c61d7 100644 +--- a/drivers/usb/gadget/udc/net2272.c ++++ b/drivers/usb/gadget/udc/net2272.c +@@ -2647,6 +2647,8 @@ net2272_plat_probe(struct platform_device *pdev) + err_req: + release_mem_region(base, len); + err: ++ kfree(dev); ++ + return ret; + } + +diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c +index 634c2c19a176..a22d190d00a0 100644 +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -3740,11 +3740,11 @@ static int __maybe_unused tegra_xudc_suspend(struct device *dev) + + flush_work(&xudc->usb_role_sw_work); + +- /* Forcibly disconnect before powergating. */ +- tegra_xudc_device_mode_off(xudc); +- +- if (!pm_runtime_status_suspended(dev)) ++ if (!pm_runtime_status_suspended(dev)) { ++ /* Forcibly disconnect before powergating. */ ++ tegra_xudc_device_mode_off(xudc); + tegra_xudc_powergate(xudc); ++ } + + pm_runtime_disable(dev); + +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 315b4552693c..52c625c02341 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -363,6 +363,7 @@ static int xhci_plat_remove(struct platform_device *dev) + struct clk *reg_clk = xhci->reg_clk; + struct usb_hcd *shared_hcd = xhci->shared_hcd; + ++ pm_runtime_get_sync(&dev->dev); + xhci->xhc_state |= XHCI_STATE_REMOVING; + + usb_remove_hcd(shared_hcd); +@@ -376,8 +377,9 @@ static int xhci_plat_remove(struct platform_device *dev) + clk_disable_unprepare(reg_clk); + usb_put_hcd(hcd); + +- pm_runtime_set_suspended(&dev->dev); + pm_runtime_disable(&dev->dev); ++ pm_runtime_put_noidle(&dev->dev); ++ pm_runtime_set_suspended(&dev->dev); + + return 0; + } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 2fbc00c0a6e8..49f3f3ce7737 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3425,8 +3425,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, + /* New sg entry */ + --num_sgs; + sent_len -= block_len; +- if (num_sgs != 0) { +- sg = sg_next(sg); ++ sg = sg_next(sg); ++ if (num_sgs != 0 && sg) { + block_len = sg_dma_len(sg); + addr = (u64) sg_dma_address(sg); + addr += sent_len; +diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c +index 1dc97f2d6201..d3d78176b23c 100644 +--- a/fs/cachefiles/rdwr.c ++++ b/fs/cachefiles/rdwr.c +@@ -398,7 +398,7 @@ int cachefiles_read_or_alloc_page(struct fscache_retrieval *op, + struct inode *inode; + sector_t block; + unsigned shift; +- int ret; ++ int ret, ret2; + + object = container_of(op->op.object, + struct cachefiles_object, fscache); +@@ -430,8 +430,8 @@ int cachefiles_read_or_alloc_page(struct fscache_retrieval *op, + block = page->index; + block <<= shift; + +- ret = bmap(inode, &block); +- ASSERT(ret < 0); ++ ret2 = bmap(inode, &block); ++ ASSERT(ret2 == 0); + + _debug("%llx -> %llx", + (unsigned long long) (page->index << shift), +@@ -739,8 +739,8 @@ int cachefiles_read_or_alloc_pages(struct fscache_retrieval *op, + block = page->index; + block <<= shift; + +- ret = bmap(inode, &block); +- ASSERT(!ret); ++ ret2 = bmap(inode, &block); ++ ASSERT(ret2 == 0); + + _debug("%llx -> %llx", + (unsigned long long) (page->index << shift), +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 6f6fb3606a5d..a4545aa04efc 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -2138,8 +2138,8 @@ cifs_writev_requeue(struct cifs_writedata *wdata) + } + } + ++ kref_put(&wdata2->refcount, cifs_writedata_release); + if (rc) { +- kref_put(&wdata2->refcount, cifs_writedata_release); + if (is_retryable_error(rc)) + continue; + i += nr_pages; +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index b0a097274cfe..f5a481089893 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1857,34 +1857,33 @@ fetch_events: + * event delivery. + */ + init_wait(&wait); +- write_lock_irq(&ep->lock); +- __add_wait_queue_exclusive(&ep->wq, &wait); +- write_unlock_irq(&ep->lock); + ++ write_lock_irq(&ep->lock); + /* +- * We don't want to sleep if the ep_poll_callback() sends us +- * a wakeup in between. That's why we set the task state +- * to TASK_INTERRUPTIBLE before doing the checks. ++ * Barrierless variant, waitqueue_active() is called under ++ * the same lock on wakeup ep_poll_callback() side, so it ++ * is safe to avoid an explicit barrier. + */ +- set_current_state(TASK_INTERRUPTIBLE); ++ __set_current_state(TASK_INTERRUPTIBLE); ++ + /* +- * Always short-circuit for fatal signals to allow +- * threads to make a timely exit without the chance of +- * finding more events available and fetching +- * repeatedly. ++ * Do the final check under the lock. ep_scan_ready_list() ++ * plays with two lists (->rdllist and ->ovflist) and there ++ * is always a race when both lists are empty for short ++ * period of time although events are pending, so lock is ++ * important. + */ +- if (fatal_signal_pending(current)) { +- res = -EINTR; +- break; ++ eavail = ep_events_available(ep); ++ if (!eavail) { ++ if (signal_pending(current)) ++ res = -EINTR; ++ else ++ __add_wait_queue_exclusive(&ep->wq, &wait); + } ++ write_unlock_irq(&ep->lock); + +- eavail = ep_events_available(ep); +- if (eavail) +- break; +- if (signal_pending(current)) { +- res = -EINTR; ++ if (eavail || res) + break; +- } + + if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) { + timed_out = 1; +@@ -1905,6 +1904,15 @@ fetch_events: + } + + send_events: ++ if (fatal_signal_pending(current)) { ++ /* ++ * Always short-circuit for fatal signals to allow ++ * threads to make a timely exit without the chance of ++ * finding more events available and fetching ++ * repeatedly. ++ */ ++ res = -EINTR; ++ } + /* + * Try to transfer events to user space. In case we get 0 events and + * there's still timeout left over, we go trying again in search of +diff --git a/fs/exec.c b/fs/exec.c +index a58625f27652..77603ceed51f 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1277,6 +1277,8 @@ int flush_old_exec(struct linux_binprm * bprm) + */ + set_mm_exe_file(bprm->mm, bprm->file); + ++ would_dump(bprm, bprm->file); ++ + /* + * Release all of the old mmap stuff + */ +@@ -1820,8 +1822,6 @@ static int __do_execve_file(int fd, struct filename *filename, + if (retval < 0) + goto out; + +- would_dump(bprm, bprm->file); +- + retval = exec_binprm(bprm); + if (retval < 0) + goto out; +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 08f6fbb3655e..31ed26435625 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -528,10 +528,12 @@ lower_metapath: + + /* Advance in metadata tree. */ + (mp->mp_list[hgt])++; +- if (mp->mp_list[hgt] >= sdp->sd_inptrs) { +- if (!hgt) ++ if (hgt) { ++ if (mp->mp_list[hgt] >= sdp->sd_inptrs) ++ goto lower_metapath; ++ } else { ++ if (mp->mp_list[hgt] >= sdp->sd_diptrs) + break; +- goto lower_metapath; + } + + fill_up_metapath: +@@ -876,10 +878,9 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, + ret = -ENOENT; + goto unlock; + } else { +- /* report a hole */ + iomap->offset = pos; + iomap->length = length; +- goto do_alloc; ++ goto hole_found; + } + } + iomap->length = size; +@@ -933,8 +934,6 @@ unlock: + return ret; + + do_alloc: +- iomap->addr = IOMAP_NULL_ADDR; +- iomap->type = IOMAP_HOLE; + if (flags & IOMAP_REPORT) { + if (pos >= size) + ret = -ENOENT; +@@ -956,6 +955,9 @@ do_alloc: + if (pos < size && height == ip->i_height) + ret = gfs2_hole_size(inode, lblock, len, mp, iomap); + } ++hole_found: ++ iomap->addr = IOMAP_NULL_ADDR; ++ iomap->type = IOMAP_HOLE; + goto out; + } + +diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c +index c090d5ad3f22..3a020bdc358c 100644 +--- a/fs/gfs2/lops.c ++++ b/fs/gfs2/lops.c +@@ -259,7 +259,7 @@ static struct bio *gfs2_log_alloc_bio(struct gfs2_sbd *sdp, u64 blkno, + struct super_block *sb = sdp->sd_vfs; + struct bio *bio = bio_alloc(GFP_NOIO, BIO_MAX_PAGES); + +- bio->bi_iter.bi_sector = blkno << (sb->s_blocksize_bits - 9); ++ bio->bi_iter.bi_sector = blkno << sdp->sd_fsb2bb_shift; + bio_set_dev(bio, sb->s_bdev); + bio->bi_end_io = end_io; + bio->bi_private = sdp; +@@ -505,7 +505,7 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head, + unsigned int bsize = sdp->sd_sb.sb_bsize, off; + unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift; + unsigned int shift = PAGE_SHIFT - bsize_shift; +- unsigned int readahead_blocks = BIO_MAX_PAGES << shift; ++ unsigned int max_bio_size = 2 * 1024 * 1024; + struct gfs2_journal_extent *je; + int sz, ret = 0; + struct bio *bio = NULL; +@@ -533,12 +533,17 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head, + off = 0; + } + +- if (!bio || (bio_chained && !off)) { ++ if (!bio || (bio_chained && !off) || ++ bio->bi_iter.bi_size >= max_bio_size) { + /* start new bio */ + } else { +- sz = bio_add_page(bio, page, bsize, off); +- if (sz == bsize) +- goto block_added; ++ sector_t sector = dblock << sdp->sd_fsb2bb_shift; ++ ++ if (bio_end_sector(bio) == sector) { ++ sz = bio_add_page(bio, page, bsize, off); ++ if (sz == bsize) ++ goto block_added; ++ } + if (off) { + unsigned int blocks = + (PAGE_SIZE - off) >> bsize_shift; +@@ -564,7 +569,7 @@ block_added: + off += bsize; + if (off == PAGE_SIZE) + page = NULL; +- if (blocks_submitted < blocks_read + readahead_blocks) { ++ if (blocks_submitted < 2 * max_bio_size >> bsize_shift) { + /* Keep at least one bio in flight */ + continue; + } +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 9690c845a3e4..832e042531bc 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -4258,7 +4258,7 @@ static int io_req_defer(struct io_kiocb *req, const struct io_uring_sqe *sqe) + int ret; + + /* Still need defer if there is pending req in defer list. */ +- if (!req_need_defer(req) && list_empty(&ctx->defer_list)) ++ if (!req_need_defer(req) && list_empty_careful(&ctx->defer_list)) + return 0; + + if (!req->io && io_alloc_async_ctx(req)) +@@ -6451,7 +6451,7 @@ static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx) + * it could cause shutdown to hang. + */ + while (ctx->sqo_thread && !wq_has_sleeper(&ctx->sqo_wait)) +- cpu_relax(); ++ cond_resched(); + + io_kill_timeouts(ctx); + io_poll_remove_all(ctx); +diff --git a/fs/ioctl.c b/fs/ioctl.c +index 282d45be6f45..5e80b40bc1b5 100644 +--- a/fs/ioctl.c ++++ b/fs/ioctl.c +@@ -55,6 +55,7 @@ EXPORT_SYMBOL(vfs_ioctl); + static int ioctl_fibmap(struct file *filp, int __user *p) + { + struct inode *inode = file_inode(filp); ++ struct super_block *sb = inode->i_sb; + int error, ur_block; + sector_t block; + +@@ -71,6 +72,13 @@ static int ioctl_fibmap(struct file *filp, int __user *p) + block = ur_block; + error = bmap(inode, &block); + ++ if (block > INT_MAX) { ++ error = -ERANGE; ++ pr_warn_ratelimited("[%s/%d] FS: %s File: %pD4 would truncate fibmap result\n", ++ current->comm, task_pid_nr(current), ++ sb->s_id, filp); ++ } ++ + if (error) + ur_block = 0; + else +diff --git a/fs/iomap/fiemap.c b/fs/iomap/fiemap.c +index bccf305ea9ce..d55e8f491a5e 100644 +--- a/fs/iomap/fiemap.c ++++ b/fs/iomap/fiemap.c +@@ -117,10 +117,7 @@ iomap_bmap_actor(struct inode *inode, loff_t pos, loff_t length, + + if (iomap->type == IOMAP_MAPPED) { + addr = (pos - iomap->offset + iomap->addr) >> inode->i_blkbits; +- if (addr > INT_MAX) +- WARN(1, "would truncate bmap result\n"); +- else +- *bno = addr; ++ *bno = addr; + } + return 0; + } +diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c +index 1abf126c2df4..a60df88efc40 100644 +--- a/fs/nfs/fscache.c ++++ b/fs/nfs/fscache.c +@@ -118,8 +118,6 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int + + nfss->fscache_key = NULL; + nfss->fscache = NULL; +- if (!(nfss->options & NFS_OPTION_FSCACHE)) +- return; + if (!uniq) { + uniq = ""; + ulen = 1; +@@ -188,7 +186,8 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int + /* create a cache index for looking up filehandles */ + nfss->fscache = fscache_acquire_cookie(nfss->nfs_client->fscache, + &nfs_fscache_super_index_def, +- key, sizeof(*key) + ulen, ++ &key->key, ++ sizeof(key->key) + ulen, + NULL, 0, + nfss, 0, true); + dfprintk(FSCACHE, "NFS: get superblock cookie (0x%p/0x%p)\n", +@@ -226,6 +225,19 @@ void nfs_fscache_release_super_cookie(struct super_block *sb) + } + } + ++static void nfs_fscache_update_auxdata(struct nfs_fscache_inode_auxdata *auxdata, ++ struct nfs_inode *nfsi) ++{ ++ memset(auxdata, 0, sizeof(*auxdata)); ++ auxdata->mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; ++ auxdata->mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; ++ auxdata->ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; ++ auxdata->ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; ++ ++ if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4) ++ auxdata->change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode); ++} ++ + /* + * Initialise the per-inode cache cookie pointer for an NFS inode. + */ +@@ -239,14 +251,7 @@ void nfs_fscache_init_inode(struct inode *inode) + if (!(nfss->fscache && S_ISREG(inode->i_mode))) + return; + +- memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; +- auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; +- auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; +- auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; +- +- if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4) +- auxdata.change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode); ++ nfs_fscache_update_auxdata(&auxdata, nfsi); + + nfsi->fscache = fscache_acquire_cookie(NFS_SB(inode->i_sb)->fscache, + &nfs_fscache_inode_object_def, +@@ -266,11 +271,7 @@ void nfs_fscache_clear_inode(struct inode *inode) + + dfprintk(FSCACHE, "NFS: clear cookie (0x%p/0x%p)\n", nfsi, cookie); + +- memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; +- auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; +- auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; +- auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; ++ nfs_fscache_update_auxdata(&auxdata, nfsi); + fscache_relinquish_cookie(cookie, &auxdata, false); + nfsi->fscache = NULL; + } +@@ -310,11 +311,7 @@ void nfs_fscache_open_file(struct inode *inode, struct file *filp) + if (!fscache_cookie_valid(cookie)) + return; + +- memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; +- auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; +- auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; +- auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; ++ nfs_fscache_update_auxdata(&auxdata, nfsi); + + if (inode_is_open_for_write(inode)) { + dfprintk(FSCACHE, "NFS: nfsi 0x%p disabling cache\n", nfsi); +diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c +index 35c8cb2d7637..dda5c3e65d8d 100644 +--- a/fs/nfs/mount_clnt.c ++++ b/fs/nfs/mount_clnt.c +@@ -30,6 +30,7 @@ + #define encode_dirpath_sz (1 + XDR_QUADLEN(MNTPATHLEN)) + #define MNT_status_sz (1) + #define MNT_fhandle_sz XDR_QUADLEN(NFS2_FHSIZE) ++#define MNT_fhandlev3_sz XDR_QUADLEN(NFS3_FHSIZE) + #define MNT_authflav3_sz (1 + NFS_MAX_SECFLAVORS) + + /* +@@ -37,7 +38,7 @@ + */ + #define MNT_enc_dirpath_sz encode_dirpath_sz + #define MNT_dec_mountres_sz (MNT_status_sz + MNT_fhandle_sz) +-#define MNT_dec_mountres3_sz (MNT_status_sz + MNT_fhandle_sz + \ ++#define MNT_dec_mountres3_sz (MNT_status_sz + MNT_fhandlev3_sz + \ + MNT_authflav3_sz) + + /* +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index f7723d221945..459c7fb5d103 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -734,9 +734,9 @@ nfs4_get_open_state(struct inode *inode, struct nfs4_state_owner *owner) + state = new; + state->owner = owner; + atomic_inc(&owner->so_count); +- list_add_rcu(&state->inode_states, &nfsi->open_states); + ihold(inode); + state->inode = inode; ++ list_add_rcu(&state->inode_states, &nfsi->open_states); + spin_unlock(&inode->i_lock); + /* Note: The reclaim code dictates that we add stateless + * and read-only stateids to the end of the list */ +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index dada09b391c6..c0d5240b8a0a 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -1154,7 +1154,6 @@ static void nfs_get_cache_cookie(struct super_block *sb, + uniq = ctx->fscache_uniq; + ulen = strlen(ctx->fscache_uniq); + } +- return; + } + + nfs_fscache_get_super_cookie(sb, uniq, ulen); +diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c +index f5d30573f4a9..deb13f0a0f7d 100644 +--- a/fs/notify/fanotify/fanotify.c ++++ b/fs/notify/fanotify/fanotify.c +@@ -171,6 +171,13 @@ static u32 fanotify_group_event_mask(struct fsnotify_group *group, + if (!fsnotify_iter_should_report_type(iter_info, type)) + continue; + mark = iter_info->marks[type]; ++ /* ++ * If the event is on dir and this mark doesn't care about ++ * events on dir, don't send it! ++ */ ++ if (event_mask & FS_ISDIR && !(mark->mask & FS_ISDIR)) ++ continue; ++ + /* + * If the event is for a child and this mark doesn't care about + * events on a child, don't send it! +@@ -203,10 +210,6 @@ static u32 fanotify_group_event_mask(struct fsnotify_group *group, + user_mask &= ~FAN_ONDIR; + } + +- if (event_mask & FS_ISDIR && +- !(marks_mask & FS_ISDIR & ~marks_ignored_mask)) +- return 0; +- + return test_mask & user_mask; + } + +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 034b0a644efc..448c91bf543b 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const int *off) + /* &a[0] degrades to a pointer: a different type from an array */ + #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) + ++/* ++ * This is needed in functions which generate the stack canary, see ++ * arch/x86/kernel/smpboot.c::start_secondary() for an example. ++ */ ++#define prevent_tail_call_optimization() mb() ++ + #endif /* __LINUX_COMPILER_H */ +diff --git a/include/linux/fs.h b/include/linux/fs.h +index abedbffe2c9e..872ee2131589 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -978,7 +978,7 @@ struct file_handle { + __u32 handle_bytes; + int handle_type; + /* file identifier */ +- unsigned char f_handle[0]; ++ unsigned char f_handle[]; + }; + + static inline struct file *get_file(struct file *f) +diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h +index db95244a62d4..ab4bd15cbcdb 100644 +--- a/include/linux/ftrace.h ++++ b/include/linux/ftrace.h +@@ -210,6 +210,29 @@ struct ftrace_ops { + #endif + }; + ++extern struct ftrace_ops __rcu *ftrace_ops_list; ++extern struct ftrace_ops ftrace_list_end; ++ ++/* ++ * Traverse the ftrace_global_list, invoking all entries. The reason that we ++ * can use rcu_dereference_raw_check() is that elements removed from this list ++ * are simply leaked, so there is no need to interact with a grace-period ++ * mechanism. The rcu_dereference_raw_check() calls are needed to handle ++ * concurrent insertions into the ftrace_global_list. ++ * ++ * Silly Alpha and silly pointer-speculation compiler optimizations! ++ */ ++#define do_for_each_ftrace_op(op, list) \ ++ op = rcu_dereference_raw_check(list); \ ++ do ++ ++/* ++ * Optimized for just a single item in the list (as that is the normal case). ++ */ ++#define while_for_each_ftrace_op(op) \ ++ while (likely(op = rcu_dereference_raw_check((op)->next)) && \ ++ unlikely((op) != &ftrace_list_end)) ++ + /* + * Type of the current tracing. + */ +diff --git a/include/linux/host1x.h b/include/linux/host1x.h +index 62d216ff1097..c230b4e70d75 100644 +--- a/include/linux/host1x.h ++++ b/include/linux/host1x.h +@@ -17,9 +17,12 @@ enum host1x_class { + HOST1X_CLASS_GR3D = 0x60, + }; + ++struct host1x; + struct host1x_client; + struct iommu_group; + ++u64 host1x_get_dma_mask(struct host1x *host1x); ++ + /** + * struct host1x_client_ops - host1x client operations + * @init: host1x client initialization code +diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h +index e9ba01336d4e..bc5a3621a9d7 100644 +--- a/include/linux/memcontrol.h ++++ b/include/linux/memcontrol.h +@@ -783,6 +783,8 @@ static inline void memcg_memory_event(struct mem_cgroup *memcg, + atomic_long_inc(&memcg->memory_events[event]); + cgroup_file_notify(&memcg->events_file); + ++ if (!cgroup_subsys_on_dfl(memory_cgrp_subsys)) ++ break; + if (cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_LOCAL_EVENTS) + break; + } while ((memcg = parent_mem_cgroup(memcg)) && +diff --git a/include/linux/pnp.h b/include/linux/pnp.h +index 3b12fd28af78..fc4df3ccefc9 100644 +--- a/include/linux/pnp.h ++++ b/include/linux/pnp.h +@@ -220,10 +220,8 @@ struct pnp_card { + #define global_to_pnp_card(n) list_entry(n, struct pnp_card, global_list) + #define protocol_to_pnp_card(n) list_entry(n, struct pnp_card, protocol_list) + #define to_pnp_card(n) container_of(n, struct pnp_card, dev) +-#define pnp_for_each_card(card) \ +- for((card) = global_to_pnp_card(pnp_cards.next); \ +- (card) != global_to_pnp_card(&pnp_cards); \ +- (card) = global_to_pnp_card((card)->global_list.next)) ++#define pnp_for_each_card(card) \ ++ list_for_each_entry(card, &pnp_cards, global_list) + + struct pnp_card_link { + struct pnp_card *card; +@@ -276,14 +274,9 @@ struct pnp_dev { + #define card_to_pnp_dev(n) list_entry(n, struct pnp_dev, card_list) + #define protocol_to_pnp_dev(n) list_entry(n, struct pnp_dev, protocol_list) + #define to_pnp_dev(n) container_of(n, struct pnp_dev, dev) +-#define pnp_for_each_dev(dev) \ +- for((dev) = global_to_pnp_dev(pnp_global.next); \ +- (dev) != global_to_pnp_dev(&pnp_global); \ +- (dev) = global_to_pnp_dev((dev)->global_list.next)) +-#define card_for_each_dev(card,dev) \ +- for((dev) = card_to_pnp_dev((card)->devices.next); \ +- (dev) != card_to_pnp_dev(&(card)->devices); \ +- (dev) = card_to_pnp_dev((dev)->card_list.next)) ++#define pnp_for_each_dev(dev) list_for_each_entry(dev, &pnp_global, global_list) ++#define card_for_each_dev(card, dev) \ ++ list_for_each_entry(dev, &(card)->devices, card_list) + #define pnp_dev_name(dev) (dev)->name + + static inline void *pnp_get_drvdata(struct pnp_dev *pdev) +@@ -437,14 +430,10 @@ struct pnp_protocol { + }; + + #define to_pnp_protocol(n) list_entry(n, struct pnp_protocol, protocol_list) +-#define protocol_for_each_card(protocol,card) \ +- for((card) = protocol_to_pnp_card((protocol)->cards.next); \ +- (card) != protocol_to_pnp_card(&(protocol)->cards); \ +- (card) = protocol_to_pnp_card((card)->protocol_list.next)) +-#define protocol_for_each_dev(protocol,dev) \ +- for((dev) = protocol_to_pnp_dev((protocol)->devices.next); \ +- (dev) != protocol_to_pnp_dev(&(protocol)->devices); \ +- (dev) = protocol_to_pnp_dev((dev)->protocol_list.next)) ++#define protocol_for_each_card(protocol, card) \ ++ list_for_each_entry(card, &(protocol)->cards, protocol_list) ++#define protocol_for_each_dev(protocol, dev) \ ++ list_for_each_entry(dev, &(protocol)->devices, protocol_list) + + extern struct bus_type pnp_bus_type; + +diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h +index 14d61bba0b79..71db17927a9d 100644 +--- a/include/linux/skmsg.h ++++ b/include/linux/skmsg.h +@@ -187,6 +187,7 @@ static inline void sk_msg_xfer(struct sk_msg *dst, struct sk_msg *src, + dst->sg.data[which] = src->sg.data[which]; + dst->sg.data[which].length = size; + dst->sg.size += size; ++ src->sg.size -= size; + src->sg.data[which].length -= size; + src->sg.data[which].offset += size; + } +diff --git a/include/linux/sunrpc/gss_api.h b/include/linux/sunrpc/gss_api.h +index 48c1b1674cbf..bc07e51f20d1 100644 +--- a/include/linux/sunrpc/gss_api.h ++++ b/include/linux/sunrpc/gss_api.h +@@ -21,6 +21,7 @@ + struct gss_ctx { + struct gss_api_mech *mech_type; + void *internal_ctx_id; ++ unsigned int slack, align; + }; + + #define GSS_C_NO_BUFFER ((struct xdr_netobj) 0) +@@ -66,6 +67,7 @@ u32 gss_wrap( + u32 gss_unwrap( + struct gss_ctx *ctx_id, + int offset, ++ int len, + struct xdr_buf *inbuf); + u32 gss_delete_sec_context( + struct gss_ctx **ctx_id); +@@ -126,6 +128,7 @@ struct gss_api_ops { + u32 (*gss_unwrap)( + struct gss_ctx *ctx_id, + int offset, ++ int len, + struct xdr_buf *buf); + void (*gss_delete_sec_context)( + void *internal_ctx_id); +diff --git a/include/linux/sunrpc/gss_krb5.h b/include/linux/sunrpc/gss_krb5.h +index c1d77dd8ed41..e8f8ffe7448b 100644 +--- a/include/linux/sunrpc/gss_krb5.h ++++ b/include/linux/sunrpc/gss_krb5.h +@@ -83,7 +83,7 @@ struct gss_krb5_enctype { + u32 (*encrypt_v2) (struct krb5_ctx *kctx, u32 offset, + struct xdr_buf *buf, + struct page **pages); /* v2 encryption function */ +- u32 (*decrypt_v2) (struct krb5_ctx *kctx, u32 offset, ++ u32 (*decrypt_v2) (struct krb5_ctx *kctx, u32 offset, u32 len, + struct xdr_buf *buf, u32 *headskip, + u32 *tailskip); /* v2 decryption function */ + }; +@@ -255,7 +255,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx_id, int offset, + struct xdr_buf *outbuf, struct page **pages); + + u32 +-gss_unwrap_kerberos(struct gss_ctx *ctx_id, int offset, ++gss_unwrap_kerberos(struct gss_ctx *ctx_id, int offset, int len, + struct xdr_buf *buf); + + +@@ -312,7 +312,7 @@ gss_krb5_aes_encrypt(struct krb5_ctx *kctx, u32 offset, + struct page **pages); + + u32 +-gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, ++gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len, + struct xdr_buf *buf, u32 *plainoffset, + u32 *plainlen); + +diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h +index b41f34977995..ae2b1449dc09 100644 +--- a/include/linux/sunrpc/xdr.h ++++ b/include/linux/sunrpc/xdr.h +@@ -184,6 +184,7 @@ xdr_adjust_iovec(struct kvec *iov, __be32 *p) + extern void xdr_shift_buf(struct xdr_buf *, size_t); + extern void xdr_buf_from_iov(struct kvec *, struct xdr_buf *); + extern int xdr_buf_subsegment(struct xdr_buf *, struct xdr_buf *, unsigned int, unsigned int); ++extern void xdr_buf_trim(struct xdr_buf *, unsigned int); + extern int xdr_buf_read_mic(struct xdr_buf *, struct xdr_netobj *, unsigned int); + extern int read_bytes_from_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int); + extern int write_bytes_to_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int); +diff --git a/include/linux/tty.h b/include/linux/tty.h +index bd5fe0e907e8..a99e9b8e4e31 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -66,7 +66,7 @@ struct tty_buffer { + int read; + int flags; + /* Data points here */ +- unsigned long data[0]; ++ unsigned long data[]; + }; + + /* Values for .flags field of tty_buffer */ +diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h +index 9f551f3b69c6..90690e37a56f 100644 +--- a/include/net/netfilter/nf_conntrack.h ++++ b/include/net/netfilter/nf_conntrack.h +@@ -87,7 +87,7 @@ struct nf_conn { + struct hlist_node nat_bysource; + #endif + /* all members below initialized via memset */ +- u8 __nfct_init_offset[0]; ++ struct { } __nfct_init_offset; + + /* If we were expected by an expectation, this will be it */ + struct nf_conn *master; +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index c30f914867e6..f1f8acb14b67 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -407,6 +407,7 @@ struct tcf_block { + struct mutex lock; + struct list_head chain_list; + u32 index; /* block index for shared blocks */ ++ u32 classid; /* which class this block belongs to */ + refcount_t refcnt; + struct net *net; + struct Qdisc *q; +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 2edb73c27962..00a57766e16e 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1421,6 +1421,19 @@ static inline int tcp_full_space(const struct sock *sk) + return tcp_win_from_space(sk, READ_ONCE(sk->sk_rcvbuf)); + } + ++/* We provision sk_rcvbuf around 200% of sk_rcvlowat. ++ * If 87.5 % (7/8) of the space has been consumed, we want to override ++ * SO_RCVLOWAT constraint, since we are receiving skbs with too small ++ * len/truesize ratio. ++ */ ++static inline bool tcp_rmem_pressure(const struct sock *sk) ++{ ++ int rcvbuf = READ_ONCE(sk->sk_rcvbuf); ++ int threshold = rcvbuf - (rcvbuf >> 3); ++ ++ return atomic_read(&sk->sk_rmem_alloc) > threshold; ++} ++ + extern void tcp_openreq_init_rwin(struct request_sock *req, + const struct sock *sk_listener, + const struct dst_entry *dst); +diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h +index f8e1955c86f1..7b5382e10bd2 100644 +--- a/include/soc/mscc/ocelot.h ++++ b/include/soc/mscc/ocelot.h +@@ -437,6 +437,7 @@ struct ocelot { + unsigned int num_stats; + + int shared_queue_sz; ++ int num_mact_rows; + + struct net_device *hw_bridge_dev; + u16 bridge_mask; +diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h +index a36b7227a15a..334842daa904 100644 +--- a/include/sound/rawmidi.h ++++ b/include/sound/rawmidi.h +@@ -61,6 +61,7 @@ struct snd_rawmidi_runtime { + size_t avail_min; /* min avail for wakeup */ + size_t avail; /* max used buffer for wakeup */ + size_t xruns; /* over/underruns counter */ ++ int buffer_ref; /* buffer reference count */ + /* misc */ + spinlock_t lock; + wait_queue_head_t sleep; +diff --git a/include/trace/events/rpcrdma.h b/include/trace/events/rpcrdma.h +index fa14adf24235..43158151821c 100644 +--- a/include/trace/events/rpcrdma.h ++++ b/include/trace/events/rpcrdma.h +@@ -721,11 +721,10 @@ TRACE_EVENT(xprtrdma_prepsend_failed, + + TRACE_EVENT(xprtrdma_post_send, + TP_PROTO( +- const struct rpcrdma_req *req, +- int status ++ const struct rpcrdma_req *req + ), + +- TP_ARGS(req, status), ++ TP_ARGS(req), + + TP_STRUCT__entry( + __field(const void *, req) +@@ -734,7 +733,6 @@ TRACE_EVENT(xprtrdma_post_send, + __field(unsigned int, client_id) + __field(int, num_sge) + __field(int, signaled) +- __field(int, status) + ), + + TP_fast_assign( +@@ -747,15 +745,13 @@ TRACE_EVENT(xprtrdma_post_send, + __entry->sc = req->rl_sendctx; + __entry->num_sge = req->rl_wr.num_sge; + __entry->signaled = req->rl_wr.send_flags & IB_SEND_SIGNALED; +- __entry->status = status; + ), + +- TP_printk("task:%u@%u req=%p sc=%p (%d SGE%s) %sstatus=%d", ++ TP_printk("task:%u@%u req=%p sc=%p (%d SGE%s) %s", + __entry->task_id, __entry->client_id, + __entry->req, __entry->sc, __entry->num_sge, + (__entry->num_sge == 1 ? "" : "s"), +- (__entry->signaled ? "signaled " : ""), +- __entry->status ++ (__entry->signaled ? "signaled" : "") + ) + ); + +diff --git a/init/Kconfig b/init/Kconfig +index 4f717bfdbfe2..ef59c5c36cdb 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -36,22 +36,6 @@ config TOOLS_SUPPORT_RELR + config CC_HAS_ASM_INLINE + def_bool $(success,echo 'void foo(void) { asm inline (""); }' | $(CC) -x c - -c -o /dev/null) + +-config CC_HAS_WARN_MAYBE_UNINITIALIZED +- def_bool $(cc-option,-Wmaybe-uninitialized) +- help +- GCC >= 4.7 supports this option. +- +-config CC_DISABLE_WARN_MAYBE_UNINITIALIZED +- bool +- depends on CC_HAS_WARN_MAYBE_UNINITIALIZED +- default CC_IS_GCC && GCC_VERSION < 40900 # unreliable for GCC < 4.9 +- help +- GCC's -Wmaybe-uninitialized is not reliable by definition. +- Lots of false positive warnings are produced in some cases. +- +- If this option is enabled, -Wno-maybe-uninitialzed is passed +- to the compiler to suppress maybe-uninitialized warnings. +- + config CONSTRUCTORS + bool + depends on !UML +@@ -1249,14 +1233,12 @@ config CC_OPTIMIZE_FOR_PERFORMANCE + config CC_OPTIMIZE_FOR_PERFORMANCE_O3 + bool "Optimize more for performance (-O3)" + depends on ARC +- imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives + help + Choosing this option will pass "-O3" to your compiler to optimize + the kernel yet more for performance. + + config CC_OPTIMIZE_FOR_SIZE + bool "Optimize for size (-Os)" +- imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives + help + Choosing this option will pass "-Os" to your compiler resulting + in a smaller kernel. +diff --git a/init/initramfs.c b/init/initramfs.c +index 8ec1be4d7d51..7a38012e1af7 100644 +--- a/init/initramfs.c ++++ b/init/initramfs.c +@@ -542,7 +542,7 @@ void __weak free_initrd_mem(unsigned long start, unsigned long end) + } + + #ifdef CONFIG_KEXEC_CORE +-static bool kexec_free_initrd(void) ++static bool __init kexec_free_initrd(void) + { + unsigned long crashk_start = (unsigned long)__va(crashk_res.start); + unsigned long crashk_end = (unsigned long)__va(crashk_res.end); +diff --git a/init/main.c b/init/main.c +index 9c7948b3763a..6bcad75d60ad 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -257,6 +257,47 @@ static int __init loglevel(char *str) + + early_param("loglevel", loglevel); + ++#ifdef CONFIG_BLK_DEV_INITRD ++static void * __init get_boot_config_from_initrd(u32 *_size, u32 *_csum) ++{ ++ u32 size, csum; ++ char *data; ++ u32 *hdr; ++ ++ if (!initrd_end) ++ return NULL; ++ ++ data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN; ++ if (memcmp(data, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN)) ++ return NULL; ++ ++ hdr = (u32 *)(data - 8); ++ size = hdr[0]; ++ csum = hdr[1]; ++ ++ data = ((void *)hdr) - size; ++ if ((unsigned long)data < initrd_start) { ++ pr_err("bootconfig size %d is greater than initrd size %ld\n", ++ size, initrd_end - initrd_start); ++ return NULL; ++ } ++ ++ /* Remove bootconfig from initramfs/initrd */ ++ initrd_end = (unsigned long)data; ++ if (_size) ++ *_size = size; ++ if (_csum) ++ *_csum = csum; ++ ++ return data; ++} ++#else ++static void * __init get_boot_config_from_initrd(u32 *_size, u32 *_csum) ++{ ++ return NULL; ++} ++#endif ++ + #ifdef CONFIG_BOOT_CONFIG + + char xbc_namebuf[XBC_KEYLEN_MAX] __initdata; +@@ -355,9 +396,11 @@ static void __init setup_boot_config(const char *cmdline) + static char tmp_cmdline[COMMAND_LINE_SIZE] __initdata; + u32 size, csum; + char *data, *copy; +- u32 *hdr; + int ret; + ++ /* Cut out the bootconfig data even if we have no bootconfig option */ ++ data = get_boot_config_from_initrd(&size, &csum); ++ + strlcpy(tmp_cmdline, boot_command_line, COMMAND_LINE_SIZE); + parse_args("bootconfig", tmp_cmdline, NULL, 0, 0, 0, NULL, + bootconfig_params); +@@ -365,16 +408,10 @@ static void __init setup_boot_config(const char *cmdline) + if (!bootconfig_found) + return; + +- if (!initrd_end) +- goto not_found; +- +- data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN; +- if (memcmp(data, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN)) +- goto not_found; +- +- hdr = (u32 *)(data - 8); +- size = hdr[0]; +- csum = hdr[1]; ++ if (!data) { ++ pr_err("'bootconfig' found on command line, but no bootconfig found\n"); ++ return; ++ } + + if (size >= XBC_DATA_MAX) { + pr_err("bootconfig size %d greater than max size %d\n", +@@ -382,10 +419,6 @@ static void __init setup_boot_config(const char *cmdline) + return; + } + +- data = ((void *)hdr) - size; +- if ((unsigned long)data < initrd_start) +- goto not_found; +- + if (boot_config_checksum((unsigned char *)data, size) != csum) { + pr_err("bootconfig checksum failed\n"); + return; +@@ -411,11 +444,15 @@ static void __init setup_boot_config(const char *cmdline) + extra_init_args = xbc_make_cmdline("init"); + } + return; +-not_found: +- pr_err("'bootconfig' found on command line, but no bootconfig found\n"); + } ++ + #else +-#define setup_boot_config(cmdline) do { } while (0) ++ ++static void __init setup_boot_config(const char *cmdline) ++{ ++ /* Remove bootconfig data from initrd */ ++ get_boot_config_from_initrd(NULL, NULL); ++} + + static int __init warn_bootconfig(char *str) + { +@@ -995,6 +1032,8 @@ asmlinkage __visible void __init start_kernel(void) + + /* Do the rest non-__init'ed, we're now alive */ + arch_call_rest_init(); ++ ++ prevent_tail_call_optimization(); + } + + /* Call all constructor functions linked into the kernel. */ +diff --git a/ipc/util.c b/ipc/util.c +index 2d70f25f64b8..c4a67982ec00 100644 +--- a/ipc/util.c ++++ b/ipc/util.c +@@ -764,21 +764,21 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, + total++; + } + +- *new_pos = pos + 1; ++ ipc = NULL; + if (total >= ids->in_use) +- return NULL; ++ goto out; + + for (; pos < ipc_mni; pos++) { + ipc = idr_find(&ids->ipcs_idr, pos); + if (ipc != NULL) { + rcu_read_lock(); + ipc_lock_object(ipc); +- return ipc; ++ break; + } + } +- +- /* Out of range - return NULL to terminate iteration */ +- return NULL; ++out: ++ *new_pos = pos + 1; ++ return ipc; + } + + static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos) +diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c +index 95d77770353c..1d6120fd5ba6 100644 +--- a/kernel/bpf/arraymap.c ++++ b/kernel/bpf/arraymap.c +@@ -486,7 +486,12 @@ static int array_map_mmap(struct bpf_map *map, struct vm_area_struct *vma) + if (!(map->map_flags & BPF_F_MMAPABLE)) + return -EINVAL; + +- return remap_vmalloc_range(vma, array_map_vmalloc_addr(array), pgoff); ++ if (vma->vm_pgoff * PAGE_SIZE + (vma->vm_end - vma->vm_start) > ++ PAGE_ALIGN((u64)array->map.max_entries * array->elem_size)) ++ return -EINVAL; ++ ++ return remap_vmalloc_range(vma, array_map_vmalloc_addr(array), ++ vma->vm_pgoff + pgoff); + } + + const struct bpf_map_ops array_map_ops = { +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 3b92aea18ae7..e04ea4c8f935 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1480,8 +1480,10 @@ static int map_lookup_and_delete_elem(union bpf_attr *attr) + if (err) + goto free_value; + +- if (copy_to_user(uvalue, value, value_size) != 0) ++ if (copy_to_user(uvalue, value, value_size) != 0) { ++ err = -EFAULT; + goto free_value; ++ } + + err = 0; + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 1c53ccbd5b5d..c1bb5be530e9 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6498,6 +6498,22 @@ static int check_return_code(struct bpf_verifier_env *env) + return 0; + range = tnum_const(0); + break; ++ case BPF_PROG_TYPE_TRACING: ++ switch (env->prog->expected_attach_type) { ++ case BPF_TRACE_FENTRY: ++ case BPF_TRACE_FEXIT: ++ range = tnum_const(0); ++ break; ++ case BPF_TRACE_RAW_TP: ++ return 0; ++ default: ++ return -ENOTSUPP; ++ } ++ break; ++ case BPF_PROG_TYPE_EXT: ++ /* freplace program can return anything as its return value ++ * depends on the to-be-replaced kernel func or bpf program. ++ */ + default: + return 0; + } +diff --git a/kernel/fork.c b/kernel/fork.c +index d90af13431c7..c9ba2b7bfef9 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2486,11 +2486,11 @@ long do_fork(unsigned long clone_flags, + int __user *child_tidptr) + { + struct kernel_clone_args args = { +- .flags = (clone_flags & ~CSIGNAL), ++ .flags = (lower_32_bits(clone_flags) & ~CSIGNAL), + .pidfd = parent_tidptr, + .child_tid = child_tidptr, + .parent_tid = parent_tidptr, +- .exit_signal = (clone_flags & CSIGNAL), ++ .exit_signal = (lower_32_bits(clone_flags) & CSIGNAL), + .stack = stack_start, + .stack_size = stack_size, + }; +@@ -2508,8 +2508,9 @@ long do_fork(unsigned long clone_flags, + pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags) + { + struct kernel_clone_args args = { +- .flags = ((flags | CLONE_VM | CLONE_UNTRACED) & ~CSIGNAL), +- .exit_signal = (flags & CSIGNAL), ++ .flags = ((lower_32_bits(flags) | CLONE_VM | ++ CLONE_UNTRACED) & ~CSIGNAL), ++ .exit_signal = (lower_32_bits(flags) & CSIGNAL), + .stack = (unsigned long)fn, + .stack_size = (unsigned long)arg, + }; +@@ -2570,11 +2571,11 @@ SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp, + #endif + { + struct kernel_clone_args args = { +- .flags = (clone_flags & ~CSIGNAL), ++ .flags = (lower_32_bits(clone_flags) & ~CSIGNAL), + .pidfd = parent_tidptr, + .child_tid = child_tidptr, + .parent_tid = parent_tidptr, +- .exit_signal = (clone_flags & CSIGNAL), ++ .exit_signal = (lower_32_bits(clone_flags) & CSIGNAL), + .stack = newsp, + .tls = tls, + }; +diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig +index 402eef84c859..743647005f64 100644 +--- a/kernel/trace/Kconfig ++++ b/kernel/trace/Kconfig +@@ -466,7 +466,6 @@ config PROFILE_ANNOTATED_BRANCHES + config PROFILE_ALL_BRANCHES + bool "Profile all if conditionals" if !FORTIFY_SOURCE + select TRACE_BRANCH_PROFILING +- imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives + help + This tracer profiles all branch conditions. Every if () + taken in the kernel is recorded whether it hit or miss. +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 68250d433bd7..b899a2d7e900 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -325,17 +325,15 @@ static const struct bpf_func_proto *bpf_get_probe_write_proto(void) + + /* + * Only limited trace_printk() conversion specifiers allowed: +- * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %s ++ * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %pks %pus %s + */ + BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1, + u64, arg2, u64, arg3) + { ++ int i, mod[3] = {}, fmt_cnt = 0; ++ char buf[64], fmt_ptype; ++ void *unsafe_ptr = NULL; + bool str_seen = false; +- int mod[3] = {}; +- int fmt_cnt = 0; +- u64 unsafe_addr; +- char buf[64]; +- int i; + + /* + * bpf_check()->check_func_arg()->check_stack_boundary() +@@ -361,40 +359,71 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1, + if (fmt[i] == 'l') { + mod[fmt_cnt]++; + i++; +- } else if (fmt[i] == 'p' || fmt[i] == 's') { ++ } else if (fmt[i] == 'p') { + mod[fmt_cnt]++; ++ if ((fmt[i + 1] == 'k' || ++ fmt[i + 1] == 'u') && ++ fmt[i + 2] == 's') { ++ fmt_ptype = fmt[i + 1]; ++ i += 2; ++ goto fmt_str; ++ } ++ + /* disallow any further format extensions */ + if (fmt[i + 1] != 0 && + !isspace(fmt[i + 1]) && + !ispunct(fmt[i + 1])) + return -EINVAL; +- fmt_cnt++; +- if (fmt[i] == 's') { +- if (str_seen) +- /* allow only one '%s' per fmt string */ +- return -EINVAL; +- str_seen = true; +- +- switch (fmt_cnt) { +- case 1: +- unsafe_addr = arg1; +- arg1 = (long) buf; +- break; +- case 2: +- unsafe_addr = arg2; +- arg2 = (long) buf; +- break; +- case 3: +- unsafe_addr = arg3; +- arg3 = (long) buf; +- break; +- } +- buf[0] = 0; +- strncpy_from_unsafe(buf, +- (void *) (long) unsafe_addr, ++ ++ goto fmt_next; ++ } else if (fmt[i] == 's') { ++ mod[fmt_cnt]++; ++ fmt_ptype = fmt[i]; ++fmt_str: ++ if (str_seen) ++ /* allow only one '%s' per fmt string */ ++ return -EINVAL; ++ str_seen = true; ++ ++ if (fmt[i + 1] != 0 && ++ !isspace(fmt[i + 1]) && ++ !ispunct(fmt[i + 1])) ++ return -EINVAL; ++ ++ switch (fmt_cnt) { ++ case 0: ++ unsafe_ptr = (void *)(long)arg1; ++ arg1 = (long)buf; ++ break; ++ case 1: ++ unsafe_ptr = (void *)(long)arg2; ++ arg2 = (long)buf; ++ break; ++ case 2: ++ unsafe_ptr = (void *)(long)arg3; ++ arg3 = (long)buf; ++ break; ++ } ++ ++ buf[0] = 0; ++ switch (fmt_ptype) { ++ case 's': ++#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE ++ strncpy_from_unsafe(buf, unsafe_ptr, + sizeof(buf)); ++ break; ++#endif ++ case 'k': ++ strncpy_from_unsafe_strict(buf, unsafe_ptr, ++ sizeof(buf)); ++ break; ++ case 'u': ++ strncpy_from_unsafe_user(buf, ++ (__force void __user *)unsafe_ptr, ++ sizeof(buf)); ++ break; + } +- continue; ++ goto fmt_next; + } + + if (fmt[i] == 'l') { +@@ -405,6 +434,7 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1, + if (fmt[i] != 'i' && fmt[i] != 'd' && + fmt[i] != 'u' && fmt[i] != 'x') + return -EINVAL; ++fmt_next: + fmt_cnt++; + } + +diff --git a/kernel/trace/ftrace_internal.h b/kernel/trace/ftrace_internal.h +index 0456e0a3dab1..382775edf690 100644 +--- a/kernel/trace/ftrace_internal.h ++++ b/kernel/trace/ftrace_internal.h +@@ -4,28 +4,6 @@ + + #ifdef CONFIG_FUNCTION_TRACER + +-/* +- * Traverse the ftrace_global_list, invoking all entries. The reason that we +- * can use rcu_dereference_raw_check() is that elements removed from this list +- * are simply leaked, so there is no need to interact with a grace-period +- * mechanism. The rcu_dereference_raw_check() calls are needed to handle +- * concurrent insertions into the ftrace_global_list. +- * +- * Silly Alpha and silly pointer-speculation compiler optimizations! +- */ +-#define do_for_each_ftrace_op(op, list) \ +- op = rcu_dereference_raw_check(list); \ +- do +- +-/* +- * Optimized for just a single item in the list (as that is the normal case). +- */ +-#define while_for_each_ftrace_op(op) \ +- while (likely(op = rcu_dereference_raw_check((op)->next)) && \ +- unlikely((op) != &ftrace_list_end)) +- +-extern struct ftrace_ops __rcu *ftrace_ops_list; +-extern struct ftrace_ops ftrace_list_end; + extern struct mutex ftrace_lock; + extern struct ftrace_ops global_ops; + +diff --git a/kernel/trace/preemptirq_delay_test.c b/kernel/trace/preemptirq_delay_test.c +index c4c86de63cf9..312d1a0ca3b6 100644 +--- a/kernel/trace/preemptirq_delay_test.c ++++ b/kernel/trace/preemptirq_delay_test.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + static ulong delay = 100; + static char test_mode[12] = "irq"; +@@ -28,6 +29,8 @@ MODULE_PARM_DESC(delay, "Period in microseconds (100 us default)"); + MODULE_PARM_DESC(test_mode, "Mode of the test such as preempt, irq, or alternate (default irq)"); + MODULE_PARM_DESC(burst_size, "The size of a burst (default 1)"); + ++static struct completion done; ++ + #define MIN(x, y) ((x) < (y) ? (x) : (y)) + + static void busy_wait(ulong time) +@@ -114,6 +117,8 @@ static int preemptirq_delay_run(void *data) + for (i = 0; i < s; i++) + (testfuncs[i])(i); + ++ complete(&done); ++ + set_current_state(TASK_INTERRUPTIBLE); + while (!kthread_should_stop()) { + schedule(); +@@ -128,15 +133,18 @@ static int preemptirq_delay_run(void *data) + static int preemptirq_run_test(void) + { + struct task_struct *task; +- + char task_name[50]; + ++ init_completion(&done); ++ + snprintf(task_name, sizeof(task_name), "%s_test", test_mode); + task = kthread_run(preemptirq_delay_run, NULL, task_name); + if (IS_ERR(task)) + return PTR_ERR(task); +- if (task) ++ if (task) { ++ wait_for_completion(&done); + kthread_stop(task); ++ } + return 0; + } + +diff --git a/kernel/umh.c b/kernel/umh.c +index 11bf5eea474c..3474d6aa55d8 100644 +--- a/kernel/umh.c ++++ b/kernel/umh.c +@@ -475,6 +475,12 @@ static void umh_clean_and_save_pid(struct subprocess_info *info) + { + struct umh_info *umh_info = info->data; + ++ /* cleanup if umh_pipe_setup() was successful but exec failed */ ++ if (info->pid && info->retval) { ++ fput(umh_info->pipe_to_umh); ++ fput(umh_info->pipe_from_umh); ++ } ++ + argv_free(info->argv); + umh_info->pid = info->pid; + } +diff --git a/lib/vsprintf.c b/lib/vsprintf.c +index 7c488a1ce318..532b6606a18a 100644 +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -2168,6 +2168,10 @@ char *fwnode_string(char *buf, char *end, struct fwnode_handle *fwnode, + * f full name + * P node name, including a possible unit address + * - 'x' For printing the address. Equivalent to "%lx". ++ * - '[ku]s' For a BPF/tracing related format specifier, e.g. used out of ++ * bpf_trace_printk() where [ku] prefix specifies either kernel (k) ++ * or user (u) memory to probe, and: ++ * s a string, equivalent to "%s" on direct vsnprintf() use + * + * ** When making changes please also update: + * Documentation/core-api/printk-formats.rst +@@ -2251,6 +2255,14 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, + if (!IS_ERR(ptr)) + break; + return err_ptr(buf, end, ptr, spec); ++ case 'u': ++ case 'k': ++ switch (fmt[1]) { ++ case 's': ++ return string(buf, end, ptr, spec); ++ default: ++ return error_string(buf, end, "(einval)", spec); ++ } + } + + /* default is to _not_ leak addresses, hash before printing */ +diff --git a/mm/shmem.c b/mm/shmem.c +index 7406f91f8a52..153d889e32d1 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2184,7 +2184,11 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user) + struct shmem_inode_info *info = SHMEM_I(inode); + int retval = -ENOMEM; + +- spin_lock_irq(&info->lock); ++ /* ++ * What serializes the accesses to info->flags? ++ * ipc_lock_object() when called from shmctl_do_lock(), ++ * no serialization needed when called from shm_destroy(). ++ */ + if (lock && !(info->flags & VM_LOCKED)) { + if (!user_shm_lock(inode->i_size, user)) + goto out_nomem; +@@ -2199,7 +2203,6 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user) + retval = 0; + + out_nomem: +- spin_unlock_irq(&info->lock); + return retval; + } + +diff --git a/net/core/dev.c b/net/core/dev.c +index 77c154107b0d..c7047b40f569 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -8890,11 +8890,13 @@ static void netdev_sync_lower_features(struct net_device *upper, + netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n", + &feature, lower->name); + lower->wanted_features &= ~feature; +- netdev_update_features(lower); ++ __netdev_update_features(lower); + + if (unlikely(lower->features & feature)) + netdev_WARN(upper, "failed to disable %pNF on %s!\n", + &feature, lower->name); ++ else ++ netdev_features_change(lower); + } + } + } +diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c +index 31700e0c3928..04d8e8779384 100644 +--- a/net/core/drop_monitor.c ++++ b/net/core/drop_monitor.c +@@ -212,6 +212,7 @@ static void sched_send_work(struct timer_list *t) + static void trace_drop_common(struct sk_buff *skb, void *location) + { + struct net_dm_alert_msg *msg; ++ struct net_dm_drop_point *point; + struct nlmsghdr *nlh; + struct nlattr *nla; + int i; +@@ -230,11 +231,13 @@ static void trace_drop_common(struct sk_buff *skb, void *location) + nlh = (struct nlmsghdr *)dskb->data; + nla = genlmsg_data(nlmsg_data(nlh)); + msg = nla_data(nla); ++ point = msg->points; + for (i = 0; i < msg->entries; i++) { +- if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) { +- msg->points[i].count++; ++ if (!memcmp(&location, &point->pc, sizeof(void *))) { ++ point->count++; + goto out; + } ++ point++; + } + if (msg->entries == dm_hit_limit) + goto out; +@@ -243,8 +246,8 @@ static void trace_drop_common(struct sk_buff *skb, void *location) + */ + __nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point)); + nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point)); +- memcpy(msg->points[msg->entries].pc, &location, sizeof(void *)); +- msg->points[msg->entries].count = 1; ++ memcpy(point->pc, &location, sizeof(void *)); ++ point->count = 1; + msg->entries++; + + if (!timer_pending(&data->send_timer)) { +diff --git a/net/core/filter.c b/net/core/filter.c +index c180871e606d..083fbe92662e 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2590,8 +2590,8 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, + } + pop = 0; + } else if (pop >= sge->length - a) { +- sge->length = a; + pop -= (sge->length - a); ++ sge->length = a; + } + } + +diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c +index 8881dd943dd0..9bd4cab7d510 100644 +--- a/net/core/netprio_cgroup.c ++++ b/net/core/netprio_cgroup.c +@@ -236,6 +236,8 @@ static void net_prio_attach(struct cgroup_taskset *tset) + struct task_struct *p; + struct cgroup_subsys_state *css; + ++ cgroup_sk_alloc_disable(); ++ + cgroup_taskset_for_each(p, css, tset) { + void *v = (void *)(unsigned long)css->id; + +diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c +index 0bd10a1f477f..a23094b050f8 100644 +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -1258,7 +1258,8 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def, + return ret_val; + } + +- secattr->flags |= NETLBL_SECATTR_MLS_CAT; ++ if (secattr->attr.mls.cat) ++ secattr->flags |= NETLBL_SECATTR_MLS_CAT; + } + + return 0; +@@ -1439,7 +1440,8 @@ static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def, + return ret_val; + } + +- secattr->flags |= NETLBL_SECATTR_MLS_CAT; ++ if (secattr->attr.mls.cat) ++ secattr->flags |= NETLBL_SECATTR_MLS_CAT; + } + + return 0; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index ebe7060d0fc9..ef6b70774fe1 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -915,7 +915,7 @@ void ip_rt_send_redirect(struct sk_buff *skb) + /* Check for load limit; set rate_last to the latest sent + * redirect. + */ +- if (peer->rate_tokens == 0 || ++ if (peer->n_redirects == 0 || + time_after(jiffies, + (peer->rate_last + + (ip_rt_redirect_load << peer->n_redirects)))) { +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index dc77c303e6f7..06aad5e09459 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -476,9 +476,17 @@ static void tcp_tx_timestamp(struct sock *sk, u16 tsflags) + static inline bool tcp_stream_is_readable(const struct tcp_sock *tp, + int target, struct sock *sk) + { +- return (READ_ONCE(tp->rcv_nxt) - READ_ONCE(tp->copied_seq) >= target) || +- (sk->sk_prot->stream_memory_read ? +- sk->sk_prot->stream_memory_read(sk) : false); ++ int avail = READ_ONCE(tp->rcv_nxt) - READ_ONCE(tp->copied_seq); ++ ++ if (avail > 0) { ++ if (avail >= target) ++ return true; ++ if (tcp_rmem_pressure(sk)) ++ return true; ++ } ++ if (sk->sk_prot->stream_memory_read) ++ return sk->sk_prot->stream_memory_read(sk); ++ return false; + } + + /* +@@ -1756,10 +1764,11 @@ static int tcp_zerocopy_receive(struct sock *sk, + + down_read(¤t->mm->mmap_sem); + +- ret = -EINVAL; + vma = find_vma(current->mm, address); +- if (!vma || vma->vm_start > address || vma->vm_ops != &tcp_vm_ops) +- goto out; ++ if (!vma || vma->vm_start > address || vma->vm_ops != &tcp_vm_ops) { ++ up_read(¤t->mm->mmap_sem); ++ return -EINVAL; ++ } + zc->length = min_t(unsigned long, zc->length, vma->vm_end - address); + + tp = tcp_sk(sk); +@@ -2154,13 +2163,15 @@ skip_copy: + tp->urg_data = 0; + tcp_fast_path_check(sk); + } +- if (used + offset < skb->len) +- continue; + + if (TCP_SKB_CB(skb)->has_rxtstamp) { + tcp_update_recv_tstamps(skb, &tss); + cmsg_flags |= 2; + } ++ ++ if (used + offset < skb->len) ++ continue; ++ + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) + goto found_fin_ok; + if (!(flags & MSG_PEEK)) +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index 8a01428f80c1..69b025408390 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -121,14 +121,17 @@ int tcp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + struct sk_psock *psock; + int copied, ret; + ++ if (unlikely(flags & MSG_ERRQUEUE)) ++ return inet_recv_error(sk, msg, len, addr_len); ++ + psock = sk_psock_get(sk); + if (unlikely(!psock)) + return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); +- if (unlikely(flags & MSG_ERRQUEUE)) +- return inet_recv_error(sk, msg, len, addr_len); + if (!skb_queue_empty(&sk->sk_receive_queue) && +- sk_psock_queue_empty(psock)) ++ sk_psock_queue_empty(psock)) { ++ sk_psock_put(sk, psock); + return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); ++ } + lock_sock(sk); + msg_bytes_ready: + copied = __tcp_bpf_recvmsg(sk, psock, msg, len, flags); +@@ -200,7 +203,6 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock, + + if (!ret) { + msg->sg.start = i; +- msg->sg.size -= apply_bytes; + sk_psock_queue_msg(psock, tmp); + sk_psock_data_ready(sk, psock); + } else { +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 6b6b57000dad..e17d396102ce 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4761,7 +4761,8 @@ void tcp_data_ready(struct sock *sk) + const struct tcp_sock *tp = tcp_sk(sk); + int avail = tp->rcv_nxt - tp->copied_seq; + +- if (avail < sk->sk_rcvlowat && !sock_flag(sk, SOCK_DONE)) ++ if (avail < sk->sk_rcvlowat && !tcp_rmem_pressure(sk) && ++ !sock_flag(sk, SOCK_DONE)) + return; + + sk->sk_data_ready(sk); +diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c +index 221c81f85cbf..8d3f66c310db 100644 +--- a/net/ipv6/calipso.c ++++ b/net/ipv6/calipso.c +@@ -1047,7 +1047,8 @@ static int calipso_opt_getattr(const unsigned char *calipso, + goto getattr_return; + } + +- secattr->flags |= NETLBL_SECATTR_MLS_CAT; ++ if (secattr->attr.mls.cat) ++ secattr->flags |= NETLBL_SECATTR_MLS_CAT; + } + + secattr->type = NETLBL_NLTYPE_CALIPSO; +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 42d0596dd398..21ee5bcaeb91 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -2725,8 +2725,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, + const struct in6_addr *daddr, *saddr; + struct rt6_info *rt6 = (struct rt6_info *)dst; + +- if (dst_metric_locked(dst, RTAX_MTU)) +- return; ++ /* Note: do *NOT* check dst_metric_locked(dst, RTAX_MTU) ++ * IPv6 pmtu discovery isn't optional, so 'mtu lock' cannot disable it. ++ * [see also comment in rt6_mtu_change_route()] ++ */ + + if (iph) { + daddr = &iph->daddr; +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index 65122edf60aa..b89bd70f890a 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -633,6 +633,16 @@ int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock) + if (err) + return err; + ++ /* the newly created socket really belongs to the owning MPTCP master ++ * socket, even if for additional subflows the allocation is performed ++ * by a kernel workqueue. Adjust inode references, so that the ++ * procfs/diag interaces really show this one belonging to the correct ++ * user. ++ */ ++ SOCK_INODE(sf)->i_ino = SOCK_INODE(sk->sk_socket)->i_ino; ++ SOCK_INODE(sf)->i_uid = SOCK_INODE(sk->sk_socket)->i_uid; ++ SOCK_INODE(sf)->i_gid = SOCK_INODE(sk->sk_socket)->i_gid; ++ + subflow = mptcp_subflow_ctx(sf->sk); + pr_debug("subflow=%p", subflow); + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 1927fc296f95..d11a58348133 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1517,9 +1517,9 @@ __nf_conntrack_alloc(struct net *net, + ct->status = 0; + ct->timeout = 0; + write_pnet(&ct->ct_net, net); +- memset(&ct->__nfct_init_offset[0], 0, ++ memset(&ct->__nfct_init_offset, 0, + offsetof(struct nf_conn, proto) - +- offsetof(struct nf_conn, __nfct_init_offset[0])); ++ offsetof(struct nf_conn, __nfct_init_offset)); + + nf_ct_zone_add(ct, zone); + +@@ -2137,8 +2137,19 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data), + nf_conntrack_lock(lockp); + if (*bucket < nf_conntrack_htable_size) { + hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnnode) { +- if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL) ++ if (NF_CT_DIRECTION(h) != IP_CT_DIR_REPLY) + continue; ++ /* All nf_conn objects are added to hash table twice, one ++ * for original direction tuple, once for the reply tuple. ++ * ++ * Exception: In the IPS_NAT_CLASH case, only the reply ++ * tuple is added (the original tuple already existed for ++ * a different object). ++ * ++ * We only need to call the iterator once for each ++ * conntrack, so we just use the 'reply' direction ++ * tuple while iterating. ++ */ + ct = nf_ct_tuplehash_to_ctrack(h); + if (iter(ct, data)) + goto found; +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 70ebebaf5bc1..0ee78a166378 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -271,7 +271,7 @@ static void flow_offload_del(struct nf_flowtable *flow_table, + + if (nf_flow_has_expired(flow)) + flow_offload_fixup_ct(flow->ct); +- else if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) ++ else + flow_offload_fixup_ct_timeout(flow->ct); + + flow_offload_free(flow); +@@ -348,8 +348,10 @@ static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data) + { + struct nf_flowtable *flow_table = data; + +- if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct) || +- test_bit(NF_FLOW_TEARDOWN, &flow->flags)) { ++ if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct)) ++ set_bit(NF_FLOW_TEARDOWN, &flow->flags); ++ ++ if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) { + if (test_bit(NF_FLOW_HW, &flow->flags)) { + if (!test_bit(NF_FLOW_HW_DYING, &flow->flags)) + nf_flow_offload_del(flow_table, flow); +diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c +index 46d976969ca3..accbb54c2b71 100644 +--- a/net/netfilter/nft_set_rbtree.c ++++ b/net/netfilter/nft_set_rbtree.c +@@ -79,6 +79,10 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set + parent = rcu_dereference_raw(parent->rb_left); + continue; + } ++ ++ if (nft_set_elem_expired(&rbe->ext)) ++ return false; ++ + if (nft_rbtree_interval_end(rbe)) { + if (nft_set_is_anonymous(set)) + return false; +@@ -94,6 +98,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set + + if (set->flags & NFT_SET_INTERVAL && interval != NULL && + nft_set_elem_active(&interval->ext, genmask) && ++ !nft_set_elem_expired(&interval->ext) && + nft_rbtree_interval_start(interval)) { + *ext = &interval->ext; + return true; +@@ -154,6 +159,9 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, + continue; + } + ++ if (nft_set_elem_expired(&rbe->ext)) ++ return false; ++ + if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) || + (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) == + (flags & NFT_SET_ELEM_INTERVAL_END)) { +@@ -170,6 +178,7 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, + + if (set->flags & NFT_SET_INTERVAL && interval != NULL && + nft_set_elem_active(&interval->ext, genmask) && ++ !nft_set_elem_expired(&interval->ext) && + ((!nft_rbtree_interval_end(interval) && + !(flags & NFT_SET_ELEM_INTERVAL_END)) || + (nft_rbtree_interval_end(interval) && +@@ -418,6 +427,8 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx, + + if (iter->count < iter->skip) + goto cont; ++ if (nft_set_elem_expired(&rbe->ext)) ++ goto cont; + if (!nft_set_elem_active(&rbe->ext, iter->genmask)) + goto cont; + +diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c +index 409a3ae47ce2..5e1239cef000 100644 +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -734,6 +734,12 @@ int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, + if ((off & (BITS_PER_LONG - 1)) != 0) + return -EINVAL; + ++ /* a null catmap is equivalent to an empty one */ ++ if (!catmap) { ++ *offset = (u32)-1; ++ return 0; ++ } ++ + if (off < catmap->startbit) { + off = catmap->startbit; + *offset = off; +diff --git a/net/rds/message.c b/net/rds/message.c +index 50f13f1d4ae0..2d43e13d6dd5 100644 +--- a/net/rds/message.c ++++ b/net/rds/message.c +@@ -308,26 +308,20 @@ out: + /* + * RDS ops use this to grab SG entries from the rm's sg pool. + */ +-struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents, +- int *ret) ++struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents) + { + struct scatterlist *sg_first = (struct scatterlist *) &rm[1]; + struct scatterlist *sg_ret; + +- if (WARN_ON(!ret)) +- return NULL; +- + if (nents <= 0) { + pr_warn("rds: alloc sgs failed! nents <= 0\n"); +- *ret = -EINVAL; +- return NULL; ++ return ERR_PTR(-EINVAL); + } + + if (rm->m_used_sgs + nents > rm->m_total_sgs) { + pr_warn("rds: alloc sgs failed! total %d used %d nents %d\n", + rm->m_total_sgs, rm->m_used_sgs, nents); +- *ret = -ENOMEM; +- return NULL; ++ return ERR_PTR(-ENOMEM); + } + + sg_ret = &sg_first[rm->m_used_sgs]; +@@ -343,7 +337,6 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in + unsigned int i; + int num_sgs = DIV_ROUND_UP(total_len, PAGE_SIZE); + int extra_bytes = num_sgs * sizeof(struct scatterlist); +- int ret; + + rm = rds_message_alloc(extra_bytes, GFP_NOWAIT); + if (!rm) +@@ -352,10 +345,10 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in + set_bit(RDS_MSG_PAGEVEC, &rm->m_flags); + rm->m_inc.i_hdr.h_len = cpu_to_be32(total_len); + rm->data.op_nents = DIV_ROUND_UP(total_len, PAGE_SIZE); +- rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs, &ret); +- if (!rm->data.op_sg) { ++ rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs); ++ if (IS_ERR(rm->data.op_sg)) { + rds_message_put(rm); +- return ERR_PTR(ret); ++ return ERR_CAST(rm->data.op_sg); + } + + for (i = 0; i < rm->data.op_nents; ++i) { +diff --git a/net/rds/rdma.c b/net/rds/rdma.c +index 585e6b3b69ce..554ea7f0277f 100644 +--- a/net/rds/rdma.c ++++ b/net/rds/rdma.c +@@ -664,9 +664,11 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm, + op->op_odp_mr = NULL; + + WARN_ON(!nr_pages); +- op->op_sg = rds_message_alloc_sgs(rm, nr_pages, &ret); +- if (!op->op_sg) ++ op->op_sg = rds_message_alloc_sgs(rm, nr_pages); ++ if (IS_ERR(op->op_sg)) { ++ ret = PTR_ERR(op->op_sg); + goto out_pages; ++ } + + if (op->op_notify || op->op_recverr) { + /* We allocate an uninitialized notifier here, because +@@ -905,9 +907,11 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm, + rm->atomic.op_silent = !!(args->flags & RDS_RDMA_SILENT); + rm->atomic.op_active = 1; + rm->atomic.op_recverr = rs->rs_recverr; +- rm->atomic.op_sg = rds_message_alloc_sgs(rm, 1, &ret); +- if (!rm->atomic.op_sg) ++ rm->atomic.op_sg = rds_message_alloc_sgs(rm, 1); ++ if (IS_ERR(rm->atomic.op_sg)) { ++ ret = PTR_ERR(rm->atomic.op_sg); + goto err; ++ } + + /* verify 8 byte-aligned */ + if (args->local_addr & 0x7) { +diff --git a/net/rds/rds.h b/net/rds/rds.h +index e4a603523083..b8b7ad766046 100644 +--- a/net/rds/rds.h ++++ b/net/rds/rds.h +@@ -852,8 +852,7 @@ rds_conn_connecting(struct rds_connection *conn) + + /* message.c */ + struct rds_message *rds_message_alloc(unsigned int nents, gfp_t gfp); +-struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents, +- int *ret); ++struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents); + int rds_message_copy_from_user(struct rds_message *rm, struct iov_iter *from, + bool zcopy); + struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned int total_len); +diff --git a/net/rds/send.c b/net/rds/send.c +index 82dcd8b84fe7..68e2bdb08fd0 100644 +--- a/net/rds/send.c ++++ b/net/rds/send.c +@@ -1274,9 +1274,11 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len) + + /* Attach data to the rm */ + if (payload_len) { +- rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs, &ret); +- if (!rm->data.op_sg) ++ rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs); ++ if (IS_ERR(rm->data.op_sg)) { ++ ret = PTR_ERR(rm->data.op_sg); + goto out; ++ } + ret = rds_message_copy_from_user(rm, &msg->msg_iter, zcopy); + if (ret) + goto out; +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index c2cdd0fc2e70..68c8fc6f535c 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -2005,6 +2005,7 @@ replay: + err = PTR_ERR(block); + goto errout; + } ++ block->classid = parent; + + chain_index = tca[TCA_CHAIN] ? nla_get_u32(tca[TCA_CHAIN]) : 0; + if (chain_index > TC_ACT_EXT_VAL_MASK) { +@@ -2547,12 +2548,10 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb) + return skb->len; + + parent = tcm->tcm_parent; +- if (!parent) { ++ if (!parent) + q = dev->qdisc; +- parent = q->handle; +- } else { ++ else + q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent)); +- } + if (!q) + goto out; + cops = q->ops->cl_ops; +@@ -2568,6 +2567,7 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb) + block = cops->tcf_block(q, cl, NULL); + if (!block) + goto out; ++ parent = block->classid; + if (tcf_block_shared(block)) + q = NULL; + } +diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c +index 2dc740acb3bf..a7ad150fd4ee 100644 +--- a/net/sunrpc/auth_gss/auth_gss.c ++++ b/net/sunrpc/auth_gss/auth_gss.c +@@ -2030,7 +2030,6 @@ gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred, + struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf; + struct kvec *head = rqstp->rq_rcv_buf.head; + struct rpc_auth *auth = cred->cr_auth; +- unsigned int savedlen = rcv_buf->len; + u32 offset, opaque_len, maj_stat; + __be32 *p; + +@@ -2041,9 +2040,9 @@ gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred, + offset = (u8 *)(p) - (u8 *)head->iov_base; + if (offset + opaque_len > rcv_buf->len) + goto unwrap_failed; +- rcv_buf->len = offset + opaque_len; + +- maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, rcv_buf); ++ maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, ++ offset + opaque_len, rcv_buf); + if (maj_stat == GSS_S_CONTEXT_EXPIRED) + clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); + if (maj_stat != GSS_S_COMPLETE) +@@ -2057,10 +2056,9 @@ gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred, + */ + xdr_init_decode(xdr, rcv_buf, p, rqstp); + +- auth->au_rslack = auth->au_verfsize + 2 + +- XDR_QUADLEN(savedlen - rcv_buf->len); +- auth->au_ralign = auth->au_verfsize + 2 + +- XDR_QUADLEN(savedlen - rcv_buf->len); ++ auth->au_rslack = auth->au_verfsize + 2 + ctx->gc_gss_ctx->slack; ++ auth->au_ralign = auth->au_verfsize + 2 + ctx->gc_gss_ctx->align; ++ + return 0; + unwrap_failed: + trace_rpcgss_unwrap_failed(task); +diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c +index 6f2d30d7b766..e7180da1fc6a 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c ++++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c +@@ -851,8 +851,8 @@ out_err: + } + + u32 +-gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf, +- u32 *headskip, u32 *tailskip) ++gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len, ++ struct xdr_buf *buf, u32 *headskip, u32 *tailskip) + { + struct xdr_buf subbuf; + u32 ret = 0; +@@ -881,7 +881,7 @@ gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf, + + /* create a segment skipping the header and leaving out the checksum */ + xdr_buf_subsegment(buf, &subbuf, offset + GSS_KRB5_TOK_HDR_LEN, +- (buf->len - offset - GSS_KRB5_TOK_HDR_LEN - ++ (len - offset - GSS_KRB5_TOK_HDR_LEN - + kctx->gk5e->cksumlength)); + + nblocks = (subbuf.len + blocksize - 1) / blocksize; +@@ -926,7 +926,7 @@ gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf, + goto out_err; + + /* Get the packet's hmac value */ +- ret = read_bytes_from_xdr_buf(buf, buf->len - kctx->gk5e->cksumlength, ++ ret = read_bytes_from_xdr_buf(buf, len - kctx->gk5e->cksumlength, + pkt_hmac, kctx->gk5e->cksumlength); + if (ret) + goto out_err; +diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c +index 6c1920eed771..cf0fd170ac18 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c ++++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c +@@ -261,7 +261,9 @@ gss_wrap_kerberos_v1(struct krb5_ctx *kctx, int offset, + } + + static u32 +-gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf) ++gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, int len, ++ struct xdr_buf *buf, unsigned int *slack, ++ unsigned int *align) + { + int signalg; + int sealalg; +@@ -279,12 +281,13 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf) + u32 conflen = kctx->gk5e->conflen; + int crypt_offset; + u8 *cksumkey; ++ unsigned int saved_len = buf->len; + + dprintk("RPC: gss_unwrap_kerberos\n"); + + ptr = (u8 *)buf->head[0].iov_base + offset; + if (g_verify_token_header(&kctx->mech_used, &bodysize, &ptr, +- buf->len - offset)) ++ len - offset)) + return GSS_S_DEFECTIVE_TOKEN; + + if ((ptr[0] != ((KG_TOK_WRAP_MSG >> 8) & 0xff)) || +@@ -324,6 +327,7 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf) + (!kctx->initiate && direction != 0)) + return GSS_S_BAD_SIG; + ++ buf->len = len; + if (kctx->enctype == ENCTYPE_ARCFOUR_HMAC) { + struct crypto_sync_skcipher *cipher; + int err; +@@ -376,11 +380,15 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf) + data_len = (buf->head[0].iov_base + buf->head[0].iov_len) - data_start; + memmove(orig_start, data_start, data_len); + buf->head[0].iov_len -= (data_start - orig_start); +- buf->len -= (data_start - orig_start); ++ buf->len = len - (data_start - orig_start); + + if (gss_krb5_remove_padding(buf, blocksize)) + return GSS_S_DEFECTIVE_TOKEN; + ++ /* slack must include room for krb5 padding */ ++ *slack = XDR_QUADLEN(saved_len - buf->len); ++ /* The GSS blob always precedes the RPC message payload */ ++ *align = *slack; + return GSS_S_COMPLETE; + } + +@@ -486,7 +494,9 @@ gss_wrap_kerberos_v2(struct krb5_ctx *kctx, u32 offset, + } + + static u32 +-gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf) ++gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, int len, ++ struct xdr_buf *buf, unsigned int *slack, ++ unsigned int *align) + { + time64_t now; + u8 *ptr; +@@ -532,7 +542,7 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf) + if (rrc != 0) + rotate_left(offset + 16, buf, rrc); + +- err = (*kctx->gk5e->decrypt_v2)(kctx, offset, buf, ++ err = (*kctx->gk5e->decrypt_v2)(kctx, offset, len, buf, + &headskip, &tailskip); + if (err) + return GSS_S_FAILURE; +@@ -542,7 +552,7 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf) + * it against the original + */ + err = read_bytes_from_xdr_buf(buf, +- buf->len - GSS_KRB5_TOK_HDR_LEN - tailskip, ++ len - GSS_KRB5_TOK_HDR_LEN - tailskip, + decrypted_hdr, GSS_KRB5_TOK_HDR_LEN); + if (err) { + dprintk("%s: error %u getting decrypted_hdr\n", __func__, err); +@@ -568,18 +578,19 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf) + * Note that buf->head[0].iov_len may indicate the available + * head buffer space rather than that actually occupied. + */ +- movelen = min_t(unsigned int, buf->head[0].iov_len, buf->len); ++ movelen = min_t(unsigned int, buf->head[0].iov_len, len); + movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip; +- if (offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen > +- buf->head[0].iov_len) +- return GSS_S_FAILURE; ++ BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen > ++ buf->head[0].iov_len); + memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen); + buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip; +- buf->len -= GSS_KRB5_TOK_HDR_LEN + headskip; ++ buf->len = len - GSS_KRB5_TOK_HDR_LEN + headskip; + + /* Trim off the trailing "extra count" and checksum blob */ +- buf->len -= ec + GSS_KRB5_TOK_HDR_LEN + tailskip; ++ xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip); + ++ *align = XDR_QUADLEN(GSS_KRB5_TOK_HDR_LEN + headskip); ++ *slack = *align + XDR_QUADLEN(ec + GSS_KRB5_TOK_HDR_LEN + tailskip); + return GSS_S_COMPLETE; + } + +@@ -603,7 +614,8 @@ gss_wrap_kerberos(struct gss_ctx *gctx, int offset, + } + + u32 +-gss_unwrap_kerberos(struct gss_ctx *gctx, int offset, struct xdr_buf *buf) ++gss_unwrap_kerberos(struct gss_ctx *gctx, int offset, ++ int len, struct xdr_buf *buf) + { + struct krb5_ctx *kctx = gctx->internal_ctx_id; + +@@ -613,9 +625,11 @@ gss_unwrap_kerberos(struct gss_ctx *gctx, int offset, struct xdr_buf *buf) + case ENCTYPE_DES_CBC_RAW: + case ENCTYPE_DES3_CBC_RAW: + case ENCTYPE_ARCFOUR_HMAC: +- return gss_unwrap_kerberos_v1(kctx, offset, buf); ++ return gss_unwrap_kerberos_v1(kctx, offset, len, buf, ++ &gctx->slack, &gctx->align); + case ENCTYPE_AES128_CTS_HMAC_SHA1_96: + case ENCTYPE_AES256_CTS_HMAC_SHA1_96: +- return gss_unwrap_kerberos_v2(kctx, offset, buf); ++ return gss_unwrap_kerberos_v2(kctx, offset, len, buf, ++ &gctx->slack, &gctx->align); + } + } +diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c +index db550bfc2642..69316ab1b9fa 100644 +--- a/net/sunrpc/auth_gss/gss_mech_switch.c ++++ b/net/sunrpc/auth_gss/gss_mech_switch.c +@@ -411,10 +411,11 @@ gss_wrap(struct gss_ctx *ctx_id, + u32 + gss_unwrap(struct gss_ctx *ctx_id, + int offset, ++ int len, + struct xdr_buf *buf) + { + return ctx_id->mech_type->gm_ops +- ->gss_unwrap(ctx_id, offset, buf); ++ ->gss_unwrap(ctx_id, offset, len, buf); + } + + +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index 65b67b257302..322fd48887f9 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -900,7 +900,7 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct g + if (svc_getnl(&buf->head[0]) != seq) + goto out; + /* trim off the mic and padding at the end before returning */ +- buf->len -= 4 + round_up_to_quad(mic.len); ++ xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4); + stat = 0; + out: + kfree(mic.data); +@@ -928,7 +928,7 @@ static int + unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx) + { + u32 priv_len, maj_stat; +- int pad, saved_len, remaining_len, offset; ++ int pad, remaining_len, offset; + + clear_bit(RQ_SPLICE_OK, &rqstp->rq_flags); + +@@ -948,12 +948,8 @@ unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gs + buf->len -= pad; + fix_priv_head(buf, pad); + +- /* Maybe it would be better to give gss_unwrap a length parameter: */ +- saved_len = buf->len; +- buf->len = priv_len; +- maj_stat = gss_unwrap(ctx, 0, buf); ++ maj_stat = gss_unwrap(ctx, 0, priv_len, buf); + pad = priv_len - buf->len; +- buf->len = saved_len; + buf->len -= pad; + /* The upper layers assume the buffer is aligned on 4-byte boundaries. + * In the krb5p case, at least, the data ends up offset, so we need to +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 7324b21f923e..3ceaefb2f0bc 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2416,6 +2416,11 @@ rpc_check_timeout(struct rpc_task *task) + { + struct rpc_clnt *clnt = task->tk_client; + ++ if (RPC_SIGNALLED(task)) { ++ rpc_call_rpcerror(task, -ERESTARTSYS); ++ return; ++ } ++ + if (xprt_adjust_timeout(task->tk_rqstp) == 0) + return; + +diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c +index e5497dc2475b..f6da616267ce 100644 +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -1150,6 +1150,47 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, + } + EXPORT_SYMBOL_GPL(xdr_buf_subsegment); + ++/** ++ * xdr_buf_trim - lop at most "len" bytes off the end of "buf" ++ * @buf: buf to be trimmed ++ * @len: number of bytes to reduce "buf" by ++ * ++ * Trim an xdr_buf by the given number of bytes by fixing up the lengths. Note ++ * that it's possible that we'll trim less than that amount if the xdr_buf is ++ * too small, or if (for instance) it's all in the head and the parser has ++ * already read too far into it. ++ */ ++void xdr_buf_trim(struct xdr_buf *buf, unsigned int len) ++{ ++ size_t cur; ++ unsigned int trim = len; ++ ++ if (buf->tail[0].iov_len) { ++ cur = min_t(size_t, buf->tail[0].iov_len, trim); ++ buf->tail[0].iov_len -= cur; ++ trim -= cur; ++ if (!trim) ++ goto fix_len; ++ } ++ ++ if (buf->page_len) { ++ cur = min_t(unsigned int, buf->page_len, trim); ++ buf->page_len -= cur; ++ trim -= cur; ++ if (!trim) ++ goto fix_len; ++ } ++ ++ if (buf->head[0].iov_len) { ++ cur = min_t(size_t, buf->head[0].iov_len, trim); ++ buf->head[0].iov_len -= cur; ++ trim -= cur; ++ } ++fix_len: ++ buf->len -= (len - trim); ++} ++EXPORT_SYMBOL_GPL(xdr_buf_trim); ++ + static void __read_bytes_from_xdr_buf(struct xdr_buf *subbuf, void *obj, unsigned int len) + { + unsigned int this_len; +diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c +index 1a0ae0c61353..4b43910a6ed2 100644 +--- a/net/sunrpc/xprtrdma/backchannel.c ++++ b/net/sunrpc/xprtrdma/backchannel.c +@@ -115,7 +115,7 @@ int xprt_rdma_bc_send_reply(struct rpc_rqst *rqst) + if (rc < 0) + goto failed_marshal; + +- if (rpcrdma_ep_post(&r_xprt->rx_ia, &r_xprt->rx_ep, req)) ++ if (rpcrdma_post_sends(r_xprt, req)) + goto drop_connection; + return 0; + +diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c +index 125297c9aa3e..79059d48f52b 100644 +--- a/net/sunrpc/xprtrdma/frwr_ops.c ++++ b/net/sunrpc/xprtrdma/frwr_ops.c +@@ -372,18 +372,22 @@ static void frwr_wc_fastreg(struct ib_cq *cq, struct ib_wc *wc) + } + + /** +- * frwr_send - post Send WR containing the RPC Call message +- * @ia: interface adapter +- * @req: Prepared RPC Call ++ * frwr_send - post Send WRs containing the RPC Call message ++ * @r_xprt: controlling transport instance ++ * @req: prepared RPC Call + * + * For FRWR, chain any FastReg WRs to the Send WR. Only a + * single ib_post_send call is needed to register memory + * and then post the Send WR. + * +- * Returns the result of ib_post_send. ++ * Returns the return code from ib_post_send. ++ * ++ * Caller must hold the transport send lock to ensure that the ++ * pointers to the transport's rdma_cm_id and QP are stable. + */ +-int frwr_send(struct rpcrdma_ia *ia, struct rpcrdma_req *req) ++int frwr_send(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req) + { ++ struct rpcrdma_ia *ia = &r_xprt->rx_ia; + struct ib_send_wr *post_wr; + struct rpcrdma_mr *mr; + +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index 3cfeba68ee9a..46e7949788e1 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -694,7 +694,7 @@ xprt_rdma_send_request(struct rpc_rqst *rqst) + goto drop_connection; + rqst->rq_xtime = ktime_get(); + +- if (rpcrdma_ep_post(&r_xprt->rx_ia, &r_xprt->rx_ep, req)) ++ if (rpcrdma_post_sends(r_xprt, req)) + goto drop_connection; + + rqst->rq_xmit_bytes_sent += rqst->rq_snd_buf.len; +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 353f61ac8d51..a48b99f3682c 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -1502,20 +1502,17 @@ static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb) + } + + /** +- * rpcrdma_ep_post - Post WRs to a transport's Send Queue +- * @ia: transport's device information +- * @ep: transport's RDMA endpoint information ++ * rpcrdma_post_sends - Post WRs to a transport's Send Queue ++ * @r_xprt: controlling transport instance + * @req: rpcrdma_req containing the Send WR to post + * + * Returns 0 if the post was successful, otherwise -ENOTCONN + * is returned. + */ +-int +-rpcrdma_ep_post(struct rpcrdma_ia *ia, +- struct rpcrdma_ep *ep, +- struct rpcrdma_req *req) ++int rpcrdma_post_sends(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req) + { + struct ib_send_wr *send_wr = &req->rl_wr; ++ struct rpcrdma_ep *ep = &r_xprt->rx_ep; + int rc; + + if (!ep->rep_send_count || kref_read(&req->rl_kref) > 1) { +@@ -1526,8 +1523,8 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia, + --ep->rep_send_count; + } + +- rc = frwr_send(ia, req); +- trace_xprtrdma_post_send(req, rc); ++ trace_xprtrdma_post_send(req); ++ rc = frwr_send(r_xprt, req); + if (rc) + return -ENOTCONN; + return 0; +diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h +index 37d5080c250b..600574a0d838 100644 +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -469,8 +469,7 @@ void rpcrdma_ep_destroy(struct rpcrdma_xprt *r_xprt); + int rpcrdma_ep_connect(struct rpcrdma_ep *, struct rpcrdma_ia *); + void rpcrdma_ep_disconnect(struct rpcrdma_ep *, struct rpcrdma_ia *); + +-int rpcrdma_ep_post(struct rpcrdma_ia *, struct rpcrdma_ep *, +- struct rpcrdma_req *); ++int rpcrdma_post_sends(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req); + void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp); + + /* +@@ -544,7 +543,7 @@ struct rpcrdma_mr_seg *frwr_map(struct rpcrdma_xprt *r_xprt, + struct rpcrdma_mr_seg *seg, + int nsegs, bool writing, __be32 xid, + struct rpcrdma_mr *mr); +-int frwr_send(struct rpcrdma_ia *ia, struct rpcrdma_req *req); ++int frwr_send(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req); + void frwr_reminv(struct rpcrdma_rep *rep, struct list_head *mrs); + void frwr_unmap_sync(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req); + void frwr_unmap_async(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req); +diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c +index 3e8dea6e0a95..6dc3078649fa 100644 +--- a/scripts/kallsyms.c ++++ b/scripts/kallsyms.c +@@ -34,7 +34,7 @@ struct sym_entry { + unsigned int len; + unsigned int start_pos; + unsigned int percpu_absolute; +- unsigned char sym[0]; ++ unsigned char sym[]; + }; + + struct addr_range { +diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c +index 20dd08e1f675..2a688b711a9a 100644 +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -120,6 +120,17 @@ static void snd_rawmidi_input_event_work(struct work_struct *work) + runtime->event(runtime->substream); + } + ++/* buffer refcount management: call with runtime->lock held */ ++static inline void snd_rawmidi_buffer_ref(struct snd_rawmidi_runtime *runtime) ++{ ++ runtime->buffer_ref++; ++} ++ ++static inline void snd_rawmidi_buffer_unref(struct snd_rawmidi_runtime *runtime) ++{ ++ runtime->buffer_ref--; ++} ++ + static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream) + { + struct snd_rawmidi_runtime *runtime; +@@ -669,6 +680,11 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime, + if (!newbuf) + return -ENOMEM; + spin_lock_irq(&runtime->lock); ++ if (runtime->buffer_ref) { ++ spin_unlock_irq(&runtime->lock); ++ kvfree(newbuf); ++ return -EBUSY; ++ } + oldbuf = runtime->buffer; + runtime->buffer = newbuf; + runtime->buffer_size = params->buffer_size; +@@ -1019,8 +1035,10 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream, + long result = 0, count1; + struct snd_rawmidi_runtime *runtime = substream->runtime; + unsigned long appl_ptr; ++ int err = 0; + + spin_lock_irqsave(&runtime->lock, flags); ++ snd_rawmidi_buffer_ref(runtime); + while (count > 0 && runtime->avail) { + count1 = runtime->buffer_size - runtime->appl_ptr; + if (count1 > count) +@@ -1039,16 +1057,19 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream, + if (userbuf) { + spin_unlock_irqrestore(&runtime->lock, flags); + if (copy_to_user(userbuf + result, +- runtime->buffer + appl_ptr, count1)) { +- return result > 0 ? result : -EFAULT; +- } ++ runtime->buffer + appl_ptr, count1)) ++ err = -EFAULT; + spin_lock_irqsave(&runtime->lock, flags); ++ if (err) ++ goto out; + } + result += count1; + count -= count1; + } ++ out: ++ snd_rawmidi_buffer_unref(runtime); + spin_unlock_irqrestore(&runtime->lock, flags); +- return result; ++ return result > 0 ? result : err; + } + + long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream, +@@ -1342,6 +1363,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream, + return -EAGAIN; + } + } ++ snd_rawmidi_buffer_ref(runtime); + while (count > 0 && runtime->avail > 0) { + count1 = runtime->buffer_size - runtime->appl_ptr; + if (count1 > count) +@@ -1373,6 +1395,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream, + } + __end: + count1 = runtime->avail < runtime->buffer_size; ++ snd_rawmidi_buffer_unref(runtime); + spin_unlock_irqrestore(&runtime->lock, flags); + if (count1) + snd_rawmidi_output_trigger(substream, 1); +diff --git a/sound/firewire/amdtp-stream-trace.h b/sound/firewire/amdtp-stream-trace.h +index 16c7f6605511..26e7cb555d3c 100644 +--- a/sound/firewire/amdtp-stream-trace.h ++++ b/sound/firewire/amdtp-stream-trace.h +@@ -66,8 +66,7 @@ TRACE_EVENT(amdtp_packet, + __entry->irq, + __entry->index, + __print_array(__get_dynamic_array(cip_header), +- __get_dynamic_array_len(cip_header), +- sizeof(u8))) ++ __get_dynamic_array_len(cip_header), 1)) + ); + + #endif +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 0c1a59d5ad59..0f3250417b95 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2320,7 +2320,9 @@ static int generic_hdmi_build_controls(struct hda_codec *codec) + + for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) { + struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx); ++ struct hdmi_eld *pin_eld = &per_pin->sink_eld; + ++ pin_eld->eld_valid = false; + hdmi_present_sense(per_pin, 0); + } + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index da4863d7f7f2..d73c814358bf 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5743,6 +5743,15 @@ static void alc233_alc662_fixup_lenovo_dual_codecs(struct hda_codec *codec, + } + } + ++static void alc225_fixup_s3_pop_noise(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action != HDA_FIXUP_ACT_PRE_PROBE) ++ return; ++ ++ codec->power_save_node = 1; ++} ++ + /* Forcibly assign NID 0x03 to HP/LO while NID 0x02 to SPK for EQ */ + static void alc274_fixup_bind_dacs(struct hda_codec *codec, + const struct hda_fixup *fix, int action) +@@ -5847,6 +5856,7 @@ enum { + ALC269_FIXUP_HP_LINE1_MIC1_LED, + ALC269_FIXUP_INV_DMIC, + ALC269_FIXUP_LENOVO_DOCK, ++ ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST, + ALC269_FIXUP_NO_SHUTUP, + ALC286_FIXUP_SONY_MIC_NO_PRESENCE, + ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT, +@@ -5932,6 +5942,7 @@ enum { + ALC233_FIXUP_ACER_HEADSET_MIC, + ALC294_FIXUP_LENOVO_MIC_LOCATION, + ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE, ++ ALC225_FIXUP_S3_POP_NOISE, + ALC700_FIXUP_INTEL_REFERENCE, + ALC274_FIXUP_DELL_BIND_DACS, + ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, +@@ -5967,6 +5978,7 @@ enum { + ALC294_FIXUP_ASUS_DUAL_SPK, + ALC285_FIXUP_THINKPAD_HEADSET_JACK, + ALC294_FIXUP_ASUS_HPE, ++ ALC294_FIXUP_ASUS_COEF_1B, + ALC285_FIXUP_HP_GPIO_LED, + }; + +@@ -6165,6 +6177,12 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT + }, ++ [ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc269_fixup_limit_int_mic_boost, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_LENOVO_DOCK, ++ }, + [ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_pincfg_no_hp_to_lineout, +@@ -6817,6 +6835,12 @@ static const struct hda_fixup alc269_fixups[] = { + { } + }, + .chained = true, ++ .chain_id = ALC225_FIXUP_S3_POP_NOISE ++ }, ++ [ALC225_FIXUP_S3_POP_NOISE] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc225_fixup_s3_pop_noise, ++ .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC + }, + [ALC700_FIXUP_INTEL_REFERENCE] = { +@@ -7089,6 +7113,17 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC + }, ++ [ALC294_FIXUP_ASUS_COEF_1B] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* Set bit 10 to correct noisy output after reboot from ++ * Windows 10 (due to pop noise reduction?) ++ */ ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x1b }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x4e4b }, ++ { } ++ }, ++ }, + [ALC285_FIXUP_HP_GPIO_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_gpio_led, +@@ -7260,6 +7295,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B), + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), +@@ -7301,7 +7337,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE), +- SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST), + SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK), +@@ -7440,6 +7476,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC269_FIXUP_HEADSET_MODE, .name = "headset-mode"}, + {.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"}, + {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"}, ++ {.id = ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST, .name = "lenovo-dock-limit-boost"}, + {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"}, + {.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"}, + {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"}, +@@ -8084,8 +8121,6 @@ static int patch_alc269(struct hda_codec *codec) + spec->gen.mixer_nid = 0; + break; + case 0x10ec0225: +- codec->power_save_node = 1; +- /* fall through */ + case 0x10ec0295: + case 0x10ec0299: + spec->codec_variant = ALC269_TYPE_ALC225; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 0686e056e39b..732580bdc6a4 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1592,13 +1592,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe, + && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + msleep(20); + +- /* Zoom R16/24, Logitech H650e, Jabra 550a needs a tiny delay here, +- * otherwise requests like get/set frequency return as failed despite +- * actually succeeding. ++ /* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny ++ * delay here, otherwise requests like get/set frequency return as ++ * failed despite actually succeeding. + */ + if ((chip->usb_id == USB_ID(0x1686, 0x00dd) || + chip->usb_id == USB_ID(0x046d, 0x0a46) || +- chip->usb_id == USB_ID(0x0b0e, 0x0349)) && ++ chip->usb_id == USB_ID(0x0b0e, 0x0349) || ++ chip->usb_id == USB_ID(0x0951, 0x16ad)) && + (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + usleep_range(1000, 2000); + } +diff --git a/tools/testing/selftests/bpf/prog_tests/mmap.c b/tools/testing/selftests/bpf/prog_tests/mmap.c +index 16a814eb4d64..b0e789678aa4 100644 +--- a/tools/testing/selftests/bpf/prog_tests/mmap.c ++++ b/tools/testing/selftests/bpf/prog_tests/mmap.c +@@ -197,6 +197,15 @@ void test_mmap(void) + CHECK_FAIL(map_data->val[far] != 3 * 321); + + munmap(tmp2, 4 * page_size); ++ ++ /* map all 4 pages, but with pg_off=1 page, should fail */ ++ tmp1 = mmap(NULL, 4 * page_size, PROT_READ, MAP_SHARED | MAP_FIXED, ++ data_map_fd, page_size /* initial page shift */); ++ if (CHECK(tmp1 != MAP_FAILED, "adv_mmap7", "unexpected success")) { ++ munmap(tmp1, 4 * page_size); ++ goto cleanup; ++ } ++ + cleanup: + if (bss_mmaped) + CHECK_FAIL(munmap(bss_mmaped, bss_sz)); +diff --git a/tools/testing/selftests/bpf/progs/test_overhead.c b/tools/testing/selftests/bpf/progs/test_overhead.c +index bfe9fbcb9684..e15c7589695e 100644 +--- a/tools/testing/selftests/bpf/progs/test_overhead.c ++++ b/tools/testing/selftests/bpf/progs/test_overhead.c +@@ -33,13 +33,13 @@ int prog3(struct bpf_raw_tracepoint_args *ctx) + SEC("fentry/__set_task_comm") + int BPF_PROG(prog4, struct task_struct *tsk, const char *buf, bool exec) + { +- return !tsk; ++ return 0; + } + + SEC("fexit/__set_task_comm") + int BPF_PROG(prog5, struct task_struct *tsk, const char *buf, bool exec) + { +- return !tsk; ++ return 0; + } + + char _license[] SEC("license") = "GPL"; +diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest +index 063ecb290a5a..144308a757b7 100755 +--- a/tools/testing/selftests/ftrace/ftracetest ++++ b/tools/testing/selftests/ftrace/ftracetest +@@ -29,8 +29,25 @@ err_ret=1 + # kselftest skip code is 4 + err_skip=4 + ++# cgroup RT scheduling prevents chrt commands from succeeding, which ++# induces failures in test wakeup tests. Disable for the duration of ++# the tests. ++ ++readonly sched_rt_runtime=/proc/sys/kernel/sched_rt_runtime_us ++ ++sched_rt_runtime_orig=$(cat $sched_rt_runtime) ++ ++setup() { ++ echo -1 > $sched_rt_runtime ++} ++ ++cleanup() { ++ echo $sched_rt_runtime_orig > $sched_rt_runtime ++} ++ + errexit() { # message + echo "Error: $1" 1>&2 ++ cleanup + exit $err_ret + } + +@@ -39,6 +56,8 @@ if [ `id -u` -ne 0 ]; then + errexit "this must be run by root user" + fi + ++setup ++ + # Utilities + absdir() { # file_path + (cd `dirname $1`; pwd) +@@ -235,6 +254,7 @@ TOTAL_RESULT=0 + + INSTANCE= + CASENO=0 ++ + testcase() { # testfile + CASENO=$((CASENO+1)) + desc=`grep "^#[ \t]*description:" $1 | cut -f2 -d:` +@@ -406,5 +426,7 @@ prlog "# of unsupported: " `echo $UNSUPPORTED_CASES | wc -w` + prlog "# of xfailed: " `echo $XFAILED_CASES | wc -w` + prlog "# of undefined(test bug): " `echo $UNDEFINED_CASES | wc -w` + ++cleanup ++ + # if no error, return 0 + exit $TOTAL_RESULT +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc +index 1bcb67dcae26..81490ecaaa92 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc +@@ -38,7 +38,7 @@ for width in 64 32 16 8; do + echo 0 > events/kprobes/testprobe/enable + + : "Confirm the arguments is recorded in given types correctly" +- ARGS=`grep "testprobe" trace | sed -e 's/.* arg1=\(.*\) arg2=\(.*\) arg3=\(.*\) arg4=\(.*\)/\1 \2 \3 \4/'` ++ ARGS=`grep "testprobe" trace | head -n 1 | sed -e 's/.* arg1=\(.*\) arg2=\(.*\) arg3=\(.*\) arg4=\(.*\)/\1 \2 \3 \4/'` + check_types $ARGS $width + + : "Clear event for next loop" +diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c +index 5945f062d749..7b288eb391b8 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c ++++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c +@@ -415,18 +415,20 @@ static const struct vgic_register_region vgic_v2_dist_registers[] = { + vgic_mmio_read_enable, vgic_mmio_write_cenable, NULL, NULL, 1, + VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PENDING_SET, +- vgic_mmio_read_pending, vgic_mmio_write_spending, NULL, NULL, 1, ++ vgic_mmio_read_pending, vgic_mmio_write_spending, ++ NULL, vgic_uaccess_write_spending, 1, + VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PENDING_CLEAR, +- vgic_mmio_read_pending, vgic_mmio_write_cpending, NULL, NULL, 1, ++ vgic_mmio_read_pending, vgic_mmio_write_cpending, ++ NULL, vgic_uaccess_write_cpending, 1, + VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_ACTIVE_SET, + vgic_mmio_read_active, vgic_mmio_write_sactive, +- NULL, vgic_mmio_uaccess_write_sactive, 1, ++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_sactive, 1, + VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_ACTIVE_CLEAR, + vgic_mmio_read_active, vgic_mmio_write_cactive, +- NULL, vgic_mmio_uaccess_write_cactive, 1, ++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_cactive, 1, + VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PRI, + vgic_mmio_read_priority, vgic_mmio_write_priority, NULL, NULL, +diff --git a/virt/kvm/arm/vgic/vgic-mmio-v3.c b/virt/kvm/arm/vgic/vgic-mmio-v3.c +index ebc218840fc2..b1b066c148ce 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio-v3.c ++++ b/virt/kvm/arm/vgic/vgic-mmio-v3.c +@@ -494,11 +494,11 @@ static const struct vgic_register_region vgic_v3_dist_registers[] = { + VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_BITS_PER_IRQ_SHARED(GICD_ISACTIVER, + vgic_mmio_read_active, vgic_mmio_write_sactive, +- NULL, vgic_mmio_uaccess_write_sactive, 1, ++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_sactive, 1, + VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_BITS_PER_IRQ_SHARED(GICD_ICACTIVER, + vgic_mmio_read_active, vgic_mmio_write_cactive, +- NULL, vgic_mmio_uaccess_write_cactive, ++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_cactive, + 1, VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_BITS_PER_IRQ_SHARED(GICD_IPRIORITYR, + vgic_mmio_read_priority, vgic_mmio_write_priority, NULL, NULL, +@@ -566,12 +566,12 @@ static const struct vgic_register_region vgic_v3_rd_registers[] = { + VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_LENGTH_UACCESS(SZ_64K + GICR_ISACTIVER0, + vgic_mmio_read_active, vgic_mmio_write_sactive, +- NULL, vgic_mmio_uaccess_write_sactive, +- 4, VGIC_ACCESS_32bit), ++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_sactive, 4, ++ VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_LENGTH_UACCESS(SZ_64K + GICR_ICACTIVER0, + vgic_mmio_read_active, vgic_mmio_write_cactive, +- NULL, vgic_mmio_uaccess_write_cactive, +- 4, VGIC_ACCESS_32bit), ++ vgic_uaccess_read_active, vgic_mmio_uaccess_write_cactive, 4, ++ VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_LENGTH(SZ_64K + GICR_IPRIORITYR0, + vgic_mmio_read_priority, vgic_mmio_write_priority, 32, + VGIC_ACCESS_32bit | VGIC_ACCESS_8bit), +diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c +index e7abd05ea896..b6824bba8248 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio.c ++++ b/virt/kvm/arm/vgic/vgic-mmio.c +@@ -179,17 +179,6 @@ unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu, + return value; + } + +-/* Must be called with irq->irq_lock held */ +-static void vgic_hw_irq_spending(struct kvm_vcpu *vcpu, struct vgic_irq *irq, +- bool is_uaccess) +-{ +- if (is_uaccess) +- return; +- +- irq->pending_latch = true; +- vgic_irq_set_phys_active(irq, true); +-} +- + static bool is_vgic_v2_sgi(struct kvm_vcpu *vcpu, struct vgic_irq *irq) + { + return (vgic_irq_is_sgi(irq->intid) && +@@ -200,7 +189,6 @@ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu, + gpa_t addr, unsigned int len, + unsigned long val) + { +- bool is_uaccess = !kvm_get_running_vcpu(); + u32 intid = VGIC_ADDR_TO_INTID(addr, 1); + int i; + unsigned long flags; +@@ -215,22 +203,49 @@ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu, + } + + raw_spin_lock_irqsave(&irq->irq_lock, flags); ++ ++ irq->pending_latch = true; + if (irq->hw) +- vgic_hw_irq_spending(vcpu, irq, is_uaccess); +- else +- irq->pending_latch = true; ++ vgic_irq_set_phys_active(irq, true); ++ + vgic_queue_irq_unlock(vcpu->kvm, irq, flags); + vgic_put_irq(vcpu->kvm, irq); + } + } + +-/* Must be called with irq->irq_lock held */ +-static void vgic_hw_irq_cpending(struct kvm_vcpu *vcpu, struct vgic_irq *irq, +- bool is_uaccess) ++int vgic_uaccess_write_spending(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len, ++ unsigned long val) + { +- if (is_uaccess) +- return; ++ u32 intid = VGIC_ADDR_TO_INTID(addr, 1); ++ int i; ++ unsigned long flags; ++ ++ for_each_set_bit(i, &val, len * 8) { ++ struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i); ++ ++ raw_spin_lock_irqsave(&irq->irq_lock, flags); ++ irq->pending_latch = true; ++ ++ /* ++ * GICv2 SGIs are terribly broken. We can't restore ++ * the source of the interrupt, so just pick the vcpu ++ * itself as the source... ++ */ ++ if (is_vgic_v2_sgi(vcpu, irq)) ++ irq->source |= BIT(vcpu->vcpu_id); ++ ++ vgic_queue_irq_unlock(vcpu->kvm, irq, flags); ++ ++ vgic_put_irq(vcpu->kvm, irq); ++ } + ++ return 0; ++} ++ ++/* Must be called with irq->irq_lock held */ ++static void vgic_hw_irq_cpending(struct kvm_vcpu *vcpu, struct vgic_irq *irq) ++{ + irq->pending_latch = false; + + /* +@@ -253,7 +268,6 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu, + gpa_t addr, unsigned int len, + unsigned long val) + { +- bool is_uaccess = !kvm_get_running_vcpu(); + u32 intid = VGIC_ADDR_TO_INTID(addr, 1); + int i; + unsigned long flags; +@@ -270,7 +284,7 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu, + raw_spin_lock_irqsave(&irq->irq_lock, flags); + + if (irq->hw) +- vgic_hw_irq_cpending(vcpu, irq, is_uaccess); ++ vgic_hw_irq_cpending(vcpu, irq); + else + irq->pending_latch = false; + +@@ -279,8 +293,68 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu, + } + } + +-unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu, +- gpa_t addr, unsigned int len) ++int vgic_uaccess_write_cpending(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len, ++ unsigned long val) ++{ ++ u32 intid = VGIC_ADDR_TO_INTID(addr, 1); ++ int i; ++ unsigned long flags; ++ ++ for_each_set_bit(i, &val, len * 8) { ++ struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i); ++ ++ raw_spin_lock_irqsave(&irq->irq_lock, flags); ++ /* ++ * More fun with GICv2 SGIs! If we're clearing one of them ++ * from userspace, which source vcpu to clear? Let's not ++ * even think of it, and blow the whole set. ++ */ ++ if (is_vgic_v2_sgi(vcpu, irq)) ++ irq->source = 0; ++ ++ irq->pending_latch = false; ++ ++ raw_spin_unlock_irqrestore(&irq->irq_lock, flags); ++ ++ vgic_put_irq(vcpu->kvm, irq); ++ } ++ ++ return 0; ++} ++ ++/* ++ * If we are fiddling with an IRQ's active state, we have to make sure the IRQ ++ * is not queued on some running VCPU's LRs, because then the change to the ++ * active state can be overwritten when the VCPU's state is synced coming back ++ * from the guest. ++ * ++ * For shared interrupts as well as GICv3 private interrupts, we have to ++ * stop all the VCPUs because interrupts can be migrated while we don't hold ++ * the IRQ locks and we don't want to be chasing moving targets. ++ * ++ * For GICv2 private interrupts we don't have to do anything because ++ * userspace accesses to the VGIC state already require all VCPUs to be ++ * stopped, and only the VCPU itself can modify its private interrupts ++ * active state, which guarantees that the VCPU is not running. ++ */ ++static void vgic_access_active_prepare(struct kvm_vcpu *vcpu, u32 intid) ++{ ++ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 || ++ intid >= VGIC_NR_PRIVATE_IRQS) ++ kvm_arm_halt_guest(vcpu->kvm); ++} ++ ++/* See vgic_access_active_prepare */ ++static void vgic_access_active_finish(struct kvm_vcpu *vcpu, u32 intid) ++{ ++ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 || ++ intid >= VGIC_NR_PRIVATE_IRQS) ++ kvm_arm_resume_guest(vcpu->kvm); ++} ++ ++static unsigned long __vgic_mmio_read_active(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len) + { + u32 intid = VGIC_ADDR_TO_INTID(addr, 1); + u32 value = 0; +@@ -290,6 +364,10 @@ unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu, + for (i = 0; i < len * 8; i++) { + struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i); + ++ /* ++ * Even for HW interrupts, don't evaluate the HW state as ++ * all the guest is interested in is the virtual state. ++ */ + if (irq->active) + value |= (1U << i); + +@@ -299,6 +377,29 @@ unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu, + return value; + } + ++unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len) ++{ ++ u32 intid = VGIC_ADDR_TO_INTID(addr, 1); ++ u32 val; ++ ++ mutex_lock(&vcpu->kvm->lock); ++ vgic_access_active_prepare(vcpu, intid); ++ ++ val = __vgic_mmio_read_active(vcpu, addr, len); ++ ++ vgic_access_active_finish(vcpu, intid); ++ mutex_unlock(&vcpu->kvm->lock); ++ ++ return val; ++} ++ ++unsigned long vgic_uaccess_read_active(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len) ++{ ++ return __vgic_mmio_read_active(vcpu, addr, len); ++} ++ + /* Must be called with irq->irq_lock held */ + static void vgic_hw_irq_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq, + bool active, bool is_uaccess) +@@ -350,36 +451,6 @@ static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq, + raw_spin_unlock_irqrestore(&irq->irq_lock, flags); + } + +-/* +- * If we are fiddling with an IRQ's active state, we have to make sure the IRQ +- * is not queued on some running VCPU's LRs, because then the change to the +- * active state can be overwritten when the VCPU's state is synced coming back +- * from the guest. +- * +- * For shared interrupts, we have to stop all the VCPUs because interrupts can +- * be migrated while we don't hold the IRQ locks and we don't want to be +- * chasing moving targets. +- * +- * For private interrupts we don't have to do anything because userspace +- * accesses to the VGIC state already require all VCPUs to be stopped, and +- * only the VCPU itself can modify its private interrupts active state, which +- * guarantees that the VCPU is not running. +- */ +-static void vgic_change_active_prepare(struct kvm_vcpu *vcpu, u32 intid) +-{ +- if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 || +- intid >= VGIC_NR_PRIVATE_IRQS) +- kvm_arm_halt_guest(vcpu->kvm); +-} +- +-/* See vgic_change_active_prepare */ +-static void vgic_change_active_finish(struct kvm_vcpu *vcpu, u32 intid) +-{ +- if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 || +- intid >= VGIC_NR_PRIVATE_IRQS) +- kvm_arm_resume_guest(vcpu->kvm); +-} +- + static void __vgic_mmio_write_cactive(struct kvm_vcpu *vcpu, + gpa_t addr, unsigned int len, + unsigned long val) +@@ -401,11 +472,11 @@ void vgic_mmio_write_cactive(struct kvm_vcpu *vcpu, + u32 intid = VGIC_ADDR_TO_INTID(addr, 1); + + mutex_lock(&vcpu->kvm->lock); +- vgic_change_active_prepare(vcpu, intid); ++ vgic_access_active_prepare(vcpu, intid); + + __vgic_mmio_write_cactive(vcpu, addr, len, val); + +- vgic_change_active_finish(vcpu, intid); ++ vgic_access_active_finish(vcpu, intid); + mutex_unlock(&vcpu->kvm->lock); + } + +@@ -438,11 +509,11 @@ void vgic_mmio_write_sactive(struct kvm_vcpu *vcpu, + u32 intid = VGIC_ADDR_TO_INTID(addr, 1); + + mutex_lock(&vcpu->kvm->lock); +- vgic_change_active_prepare(vcpu, intid); ++ vgic_access_active_prepare(vcpu, intid); + + __vgic_mmio_write_sactive(vcpu, addr, len, val); + +- vgic_change_active_finish(vcpu, intid); ++ vgic_access_active_finish(vcpu, intid); + mutex_unlock(&vcpu->kvm->lock); + } + +diff --git a/virt/kvm/arm/vgic/vgic-mmio.h b/virt/kvm/arm/vgic/vgic-mmio.h +index 5af2aefad435..b127f889113e 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio.h ++++ b/virt/kvm/arm/vgic/vgic-mmio.h +@@ -149,9 +149,20 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu, + gpa_t addr, unsigned int len, + unsigned long val); + ++int vgic_uaccess_write_spending(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len, ++ unsigned long val); ++ ++int vgic_uaccess_write_cpending(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len, ++ unsigned long val); ++ + unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu, + gpa_t addr, unsigned int len); + ++unsigned long vgic_uaccess_read_active(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len); ++ + void vgic_mmio_write_cactive(struct kvm_vcpu *vcpu, + gpa_t addr, unsigned int len, + unsigned long val); diff --git a/1700_x86-gcc-10-early-boot-crash-fix.patch b/1700_x86-gcc-10-early-boot-crash-fix.patch deleted file mode 100644 index 8cdf651..0000000 --- a/1700_x86-gcc-10-early-boot-crash-fix.patch +++ /dev/null @@ -1,131 +0,0 @@ -From f670269a42bfdd2c83a1118cc3d1b475547eac22 Mon Sep 17 00:00:00 2001 -From: Borislav Petkov -Date: Wed, 22 Apr 2020 18:11:30 +0200 -Subject: x86: Fix early boot crash on gcc-10, next try -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -... or the odyssey of trying to disable the stack protector for the -function which generates the stack canary value. - -The whole story started with Sergei reporting a boot crash with a kernel -built with gcc-10: - - Kernel panic — not syncing: stack-protector: Kernel stack is corrupted in: start_secondary - CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5—00235—gfffb08b37df9 #139 - Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M—D3H, BIOS F12 11/14/2013 - Call Trace: - dump_stack - panic - ? start_secondary - __stack_chk_fail - start_secondary - secondary_startup_64 - -—-[ end Kernel panic — not syncing: stack—protector: Kernel stack is corrupted in: start_secondary - -This happens because gcc-10 tail-call optimizes the last function call -in start_secondary() - cpu_startup_entry() - and thus emits a stack -canary check which fails because the canary value changes after the -boot_init_stack_canary() call. - -To fix that, the initial attempt was to mark the one function which -generates the stack canary with: - - __attribute__((optimize("-fno-stack-protector"))) ... start_secondary(void *unused) - -however, using the optimize attribute doesn't work cumulatively -as the attribute does not add to but rather replaces previously -supplied optimization options - roughly all -fxxx options. - -The key one among them being -fno-omit-frame-pointer and thus leading to -not present frame pointer - frame pointer which the kernel needs. - -The next attempt to prevent compilers from tail-call optimizing -the last function call cpu_startup_entry(), shy of carving out -start_secondary() into a separate compilation unit and building it with --fno-stack-protector, is this one. - -The current solution is short and sweet, and reportedly, is supported by -both compilers so let's see how far we'll get this time. - -Reported-by: Sergei Trofimovich -Signed-off-by: Borislav Petkov -Reviewed-by: Nick Desaulniers -Reviewed-by: Kees Cook -Link: https://lkml.kernel.org/r/20200314164451.346497-1-slyfox@gentoo.org ---- - arch/x86/include/asm/stackprotector.h | 7 ++++++- - arch/x86/kernel/smpboot.c | 8 ++++++++ - arch/x86/xen/smp_pv.c | 1 + - include/linux/compiler.h | 6 ++++++ - 4 files changed, 21 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h -index 91e29b6a86a5..9804a7957f4e 100644 ---- a/arch/x86/include/asm/stackprotector.h -+++ b/arch/x86/include/asm/stackprotector.h -@@ -55,8 +55,13 @@ - /* - * Initialize the stackprotector canary value. - * -- * NOTE: this must only be called from functions that never return, -+ * NOTE: this must only be called from functions that never return - * and it must always be inlined. -+ * -+ * In addition, it should be called from a compilation unit for which -+ * stack protector is disabled. Alternatively, the caller should not end -+ * with a function call which gets tail-call optimized as that would -+ * lead to checking a modified canary value. - */ - static __always_inline void boot_init_stack_canary(void) - { -diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index fe3ab9632f3b..4f275ac7830b 100644 ---- a/arch/x86/kernel/smpboot.c -+++ b/arch/x86/kernel/smpboot.c -@@ -266,6 +266,14 @@ static void notrace start_secondary(void *unused) - - wmb(); - cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); -+ -+ /* -+ * Prevent tail call to cpu_startup_entry() because the stack protector -+ * guard has been changed a couple of function calls up, in -+ * boot_init_stack_canary() and must not be checked before tail calling -+ * another function. -+ */ -+ prevent_tail_call_optimization(); - } - - /** -diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c -index 8fb8a50a28b4..f2adb63b2d7c 100644 ---- a/arch/x86/xen/smp_pv.c -+++ b/arch/x86/xen/smp_pv.c -@@ -93,6 +93,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void) - cpu_bringup(); - boot_init_stack_canary(); - cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); -+ prevent_tail_call_optimization(); - } - - void xen_smp_intr_free_pv(unsigned int cpu) -diff --git a/include/linux/compiler.h b/include/linux/compiler.h -index 034b0a644efc..732754d96039 100644 ---- a/include/linux/compiler.h -+++ b/include/linux/compiler.h -@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const int *off) - /* &a[0] degrades to a pointer: a different type from an array */ - #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) - -+/* -+ * This is needed in functions which generate the stack canary, see -+ * arch/x86/kernel/smpboot.c::start_secondary() for an example. -+ */ -+#define prevent_tail_call_optimization() asm("") -+ - #endif /* __LINUX_COMPILER_H */ --- -cgit 1.2-0.3.lf.el7 -