From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 68DC9138239 for ; Tue, 30 Mar 2021 12:59:30 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 85B26E0A07; Tue, 30 Mar 2021 12:59:29 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 3314EE0A07 for ; Tue, 30 Mar 2021 12:59:29 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 50CD2335D95 for ; Tue, 30 Mar 2021 12:59:27 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id B434047 for ; Tue, 30 Mar 2021 12:59:25 +0000 (UTC) From: "Alice Ferrazzi" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Alice Ferrazzi" Message-ID: <1617109146.108134da29067339961bcf2b2c914f57da0a7c8f.alicef@gentoo> Subject: [gentoo-commits] proj/linux-patches:5.11 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1010_linux-5.11.11.patch X-VCS-Directories: / X-VCS-Committer: alicef X-VCS-Committer-Name: Alice Ferrazzi X-VCS-Revision: 108134da29067339961bcf2b2c914f57da0a7c8f X-VCS-Branch: 5.11 Date: Tue, 30 Mar 2021 12:59:25 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 69c12dd3-8c80-432f-9d8c-fa4f2d6abbc7 X-Archives-Hash: b1873eb66e471219b99889d8d1c82a0d commit: 108134da29067339961bcf2b2c914f57da0a7c8f Author: Alice Ferrazzi gentoo org> AuthorDate: Tue Mar 30 12:59:00 2021 +0000 Commit: Alice Ferrazzi gentoo org> CommitDate: Tue Mar 30 12:59:06 2021 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=108134da linux patch 5.11.11 Signed-off-by: Alice Ferrazzi gentoo.org> 0000_README | 4 + 1010_linux-5.11.11.patch | 10590 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 10594 insertions(+) diff --git a/0000_README b/0000_README index a188a3c..49fee78 100644 --- a/0000_README +++ b/0000_README @@ -83,6 +83,10 @@ Patch: 1009_linux-5.11.10.patch From: http://www.kernel.org Desc: Linux 5.11.10 +Patch: 1010_linux-5.11.11.patch +From: http://www.kernel.org +Desc: Linux 5.11.11 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1010_linux-5.11.11.patch b/1010_linux-5.11.11.patch new file mode 100644 index 0000000..bbd15f5 --- /dev/null +++ b/1010_linux-5.11.11.patch @@ -0,0 +1,10590 @@ +diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst +index 5570887a2dce2..66d38520e65a1 100644 +--- a/Documentation/virt/kvm/api.rst ++++ b/Documentation/virt/kvm/api.rst +@@ -4831,8 +4831,10 @@ If an MSR access is not permitted through the filtering, it generates a + allows user space to deflect and potentially handle various MSR accesses + into user space. + +-If a vCPU is in running state while this ioctl is invoked, the vCPU may +-experience inconsistent filtering behavior on MSR accesses. ++Note, invoking this ioctl with a vCPU is running is inherently racy. However, ++KVM does guarantee that vCPUs will see either the previous filter or the new ++filter, e.g. MSRs with identical settings in both the old and new filter will ++have deterministic behavior. + + + 5. The kvm_run structure +diff --git a/Makefile b/Makefile +index 824d15c14be02..7578e0d9622fb 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 11 +-SUBLEVEL = 10 ++SUBLEVEL = 11 + EXTRAVERSION = + NAME = 💕 Valentine's Day Edition 💕 + +@@ -265,7 +265,8 @@ no-dot-config-targets := $(clean-targets) \ + $(version_h) headers headers_% archheaders archscripts \ + %asm-generic kernelversion %src-pkg dt_binding_check \ + outputmakefile +-no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease ++no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease \ ++ image_name + single-targets := %.a %.i %.ko %.lds %.ll %.lst %.mod %.o %.s %.symtypes %/ + + config-build := +diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts +index 73b6b1f89de99..775ceb3acb6c0 100644 +--- a/arch/arm/boot/dts/at91-sam9x60ek.dts ++++ b/arch/arm/boot/dts/at91-sam9x60ek.dts +@@ -334,14 +334,6 @@ + }; + + &pinctrl { +- atmel,mux-mask = < +- /* A B C */ +- 0xFFFFFE7F 0xC0E0397F 0xEF00019D /* pioA */ +- 0x03FFFFFF 0x02FC7E68 0x00780000 /* pioB */ +- 0xffffffff 0xF83FFFFF 0xB800F3FC /* pioC */ +- 0x003FFFFF 0x003F8000 0x00000000 /* pioD */ +- >; +- + adc { + pinctrl_adc_default: adc_default { + atmel,pins = ; +diff --git a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi +index 1b1163858b1d1..e3251f3e3eaa2 100644 +--- a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi ++++ b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi +@@ -84,8 +84,8 @@ + pinctrl-0 = <&pinctrl_macb0_default>; + phy-mode = "rmii"; + +- ethernet-phy@0 { +- reg = <0x0>; ++ ethernet-phy@7 { ++ reg = <0x7>; + interrupt-parent = <&pioA>; + interrupts = ; + pinctrl-names = "default"; +diff --git a/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts b/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts +index ecbb2cc5b9ab4..79cc45728cd2d 100644 +--- a/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts ++++ b/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts +@@ -14,5 +14,6 @@ + }; + + &gpmi { ++ fsl,use-minimum-ecc; + status = "okay"; + }; +diff --git a/arch/arm/boot/dts/sam9x60.dtsi b/arch/arm/boot/dts/sam9x60.dtsi +index 84066c1298df9..ec45ced3cde68 100644 +--- a/arch/arm/boot/dts/sam9x60.dtsi ++++ b/arch/arm/boot/dts/sam9x60.dtsi +@@ -606,6 +606,15 @@ + compatible = "microchip,sam9x60-pinctrl", "atmel,at91sam9x5-pinctrl", "atmel,at91rm9200-pinctrl", "simple-bus"; + ranges = <0xfffff400 0xfffff400 0x800>; + ++ /* mux-mask corresponding to sam9x60 SoC in TFBGA228L package */ ++ atmel,mux-mask = < ++ /* A B C */ ++ 0xffffffff 0xffe03fff 0xef00019d /* pioA */ ++ 0x03ffffff 0x02fc7e7f 0x00780000 /* pioB */ ++ 0xffffffff 0xffffffff 0xf83fffff /* pioC */ ++ 0x003fffff 0x003f8000 0x00000000 /* pioD */ ++ >; ++ + pioA: gpio@fffff400 { + compatible = "microchip,sam9x60-gpio", "atmel,at91sam9x5-gpio", "atmel,at91rm9200-gpio"; + reg = <0xfffff400 0x200>; +diff --git a/arch/arm/mach-omap2/sr_device.c b/arch/arm/mach-omap2/sr_device.c +index 62df666c2bd0b..17b66f0d0deef 100644 +--- a/arch/arm/mach-omap2/sr_device.c ++++ b/arch/arm/mach-omap2/sr_device.c +@@ -88,34 +88,26 @@ static void __init sr_set_nvalues(struct omap_volt_data *volt_data, + + extern struct omap_sr_data omap_sr_pdata[]; + +-static int __init sr_dev_init(struct omap_hwmod *oh, void *user) ++static int __init sr_init_by_name(const char *name, const char *voltdm) + { + struct omap_sr_data *sr_data = NULL; + struct omap_volt_data *volt_data; +- struct omap_smartreflex_dev_attr *sr_dev_attr; + static int i; + +- if (!strncmp(oh->name, "smartreflex_mpu_iva", 20) || +- !strncmp(oh->name, "smartreflex_mpu", 16)) ++ if (!strncmp(name, "smartreflex_mpu_iva", 20) || ++ !strncmp(name, "smartreflex_mpu", 16)) + sr_data = &omap_sr_pdata[OMAP_SR_MPU]; +- else if (!strncmp(oh->name, "smartreflex_core", 17)) ++ else if (!strncmp(name, "smartreflex_core", 17)) + sr_data = &omap_sr_pdata[OMAP_SR_CORE]; +- else if (!strncmp(oh->name, "smartreflex_iva", 16)) ++ else if (!strncmp(name, "smartreflex_iva", 16)) + sr_data = &omap_sr_pdata[OMAP_SR_IVA]; + + if (!sr_data) { +- pr_err("%s: Unknown instance %s\n", __func__, oh->name); ++ pr_err("%s: Unknown instance %s\n", __func__, name); + return -EINVAL; + } + +- sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr; +- if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) { +- pr_err("%s: No voltage domain specified for %s. Cannot initialize\n", +- __func__, oh->name); +- goto exit; +- } +- +- sr_data->name = oh->name; ++ sr_data->name = name; + if (cpu_is_omap343x()) + sr_data->ip_type = 1; + else +@@ -136,10 +128,10 @@ static int __init sr_dev_init(struct omap_hwmod *oh, void *user) + } + } + +- sr_data->voltdm = voltdm_lookup(sr_dev_attr->sensor_voltdm_name); ++ sr_data->voltdm = voltdm_lookup(voltdm); + if (!sr_data->voltdm) { + pr_err("%s: Unable to get voltage domain pointer for VDD %s\n", +- __func__, sr_dev_attr->sensor_voltdm_name); ++ __func__, voltdm); + goto exit; + } + +@@ -160,6 +152,20 @@ exit: + return 0; + } + ++static int __init sr_dev_init(struct omap_hwmod *oh, void *user) ++{ ++ struct omap_smartreflex_dev_attr *sr_dev_attr; ++ ++ sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr; ++ if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) { ++ pr_err("%s: No voltage domain specified for %s. Cannot initialize\n", ++ __func__, oh->name); ++ return 0; ++ } ++ ++ return sr_init_by_name(oh->name, sr_dev_attr->sensor_voltdm_name); ++} ++ + /* + * API to be called from board files to enable smartreflex + * autocompensation at init. +@@ -169,7 +175,42 @@ void __init omap_enable_smartreflex_on_init(void) + sr_enable_on_init = true; + } + ++static const char * const omap4_sr_instances[] = { ++ "mpu", ++ "iva", ++ "core", ++}; ++ ++static const char * const dra7_sr_instances[] = { ++ "mpu", ++ "core", ++}; ++ + int __init omap_devinit_smartreflex(void) + { ++ const char * const *sr_inst; ++ int i, nr_sr = 0; ++ ++ if (soc_is_omap44xx()) { ++ sr_inst = omap4_sr_instances; ++ nr_sr = ARRAY_SIZE(omap4_sr_instances); ++ ++ } else if (soc_is_dra7xx()) { ++ sr_inst = dra7_sr_instances; ++ nr_sr = ARRAY_SIZE(dra7_sr_instances); ++ } ++ ++ if (nr_sr) { ++ const char *name, *voltdm; ++ ++ for (i = 0; i < nr_sr; i++) { ++ name = kasprintf(GFP_KERNEL, "smartreflex_%s", sr_inst[i]); ++ voltdm = sr_inst[i]; ++ sr_init_by_name(name, voltdm); ++ } ++ ++ return 0; ++ } ++ + return omap_hwmod_for_each_by_class("smartreflex", sr_dev_init, NULL); + } +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi +index 626b709d1fb90..03de3a34276af 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi +@@ -192,6 +192,7 @@ + ranges = <0x0 0x00 0x1700000 0x100000>; + reg = <0x00 0x1700000 0x0 0x100000>; + interrupts = ; ++ dma-coherent; + + sec_jr0: jr@10000 { + compatible = "fsl,sec-v5.4-job-ring", +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi +index bbae4b353d3ff..c3c34e519e90c 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi +@@ -322,6 +322,7 @@ + ranges = <0x0 0x00 0x1700000 0x100000>; + reg = <0x00 0x1700000 0x0 0x100000>; + interrupts = <0 75 0x4>; ++ dma-coherent; + + sec_jr0: jr@10000 { + compatible = "fsl,sec-v5.4-job-ring", +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi +index 565934cbfa280..719451ee09d0b 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi +@@ -325,6 +325,7 @@ + ranges = <0x0 0x00 0x1700000 0x100000>; + reg = <0x00 0x1700000 0x0 0x100000>; + interrupts = ; ++ dma-coherent; + + sec_jr0: jr@10000 { + compatible = "fsl,sec-v5.4-job-ring", +diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c +index e6e284265f19d..58303a9ec32c4 100644 +--- a/arch/arm64/kernel/crash_dump.c ++++ b/arch/arm64/kernel/crash_dump.c +@@ -64,5 +64,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, + ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) + { + memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count); ++ *ppos += count; ++ + return count; + } +diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c +index fa56af1a59c39..dbce0dcf4cc06 100644 +--- a/arch/arm64/kernel/stacktrace.c ++++ b/arch/arm64/kernel/stacktrace.c +@@ -199,8 +199,9 @@ void show_stack(struct task_struct *tsk, unsigned long *sp, const char *loglvl) + + #ifdef CONFIG_STACKTRACE + +-void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, +- struct task_struct *task, struct pt_regs *regs) ++noinline void arch_stack_walk(stack_trace_consume_fn consume_entry, ++ void *cookie, struct task_struct *task, ++ struct pt_regs *regs) + { + struct stackframe frame; + +@@ -208,8 +209,8 @@ void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, + start_backtrace(&frame, regs->regs[29], regs->pc); + else if (task == current) + start_backtrace(&frame, +- (unsigned long)__builtin_frame_address(0), +- (unsigned long)arch_stack_walk); ++ (unsigned long)__builtin_frame_address(1), ++ (unsigned long)__builtin_return_address(0)); + else + start_backtrace(&frame, thread_saved_fp(task), + thread_saved_pc(task)); +diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h +index 6c6f16e409a87..0d23c00493018 100644 +--- a/arch/ia64/include/asm/syscall.h ++++ b/arch/ia64/include/asm/syscall.h +@@ -32,7 +32,7 @@ static inline void syscall_rollback(struct task_struct *task, + static inline long syscall_get_error(struct task_struct *task, + struct pt_regs *regs) + { +- return regs->r10 == -1 ? regs->r8:0; ++ return regs->r10 == -1 ? -regs->r8:0; + } + + static inline long syscall_get_return_value(struct task_struct *task, +diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c +index c3490ee2daa58..e14f5653393ac 100644 +--- a/arch/ia64/kernel/ptrace.c ++++ b/arch/ia64/kernel/ptrace.c +@@ -2013,27 +2013,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data) + { + struct syscall_get_set_args *args = data; + struct pt_regs *pt = args->regs; +- unsigned long *krbs, cfm, ndirty; ++ unsigned long *krbs, cfm, ndirty, nlocals, nouts; + int i, count; + + if (unw_unwind_to_user(info) < 0) + return; + ++ /* ++ * We get here via a few paths: ++ * - break instruction: cfm is shared with caller. ++ * syscall args are in out= regs, locals are non-empty. ++ * - epsinstruction: cfm is set by br.call ++ * locals don't exist. ++ * ++ * For both cases argguments are reachable in cfm.sof - cfm.sol. ++ * CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ] ++ */ + cfm = pt->cr_ifs; ++ nlocals = (cfm >> 7) & 0x7f; /* aka sol */ ++ nouts = (cfm & 0x7f) - nlocals; /* aka sof - sol */ + krbs = (unsigned long *)info->task + IA64_RBS_OFFSET/8; + ndirty = ia64_rse_num_regs(krbs, krbs + (pt->loadrs >> 19)); + + count = 0; + if (in_syscall(pt)) +- count = min_t(int, args->n, cfm & 0x7f); ++ count = min_t(int, args->n, nouts); + ++ /* Iterate over outs. */ + for (i = 0; i < count; i++) { ++ int j = ndirty + nlocals + i + args->i; + if (args->rw) +- *ia64_rse_skip_regs(krbs, ndirty + i + args->i) = +- args->args[i]; ++ *ia64_rse_skip_regs(krbs, j) = args->args[i]; + else +- args->args[i] = *ia64_rse_skip_regs(krbs, +- ndirty + i + args->i); ++ args->args[i] = *ia64_rse_skip_regs(krbs, j); + } + + if (!args->rw) { +diff --git a/arch/powerpc/include/asm/dcr-native.h b/arch/powerpc/include/asm/dcr-native.h +index 7141ccea8c94e..a92059964579b 100644 +--- a/arch/powerpc/include/asm/dcr-native.h ++++ b/arch/powerpc/include/asm/dcr-native.h +@@ -53,8 +53,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) + #define mfdcr(rn) \ + ({unsigned int rval; \ + if (__builtin_constant_p(rn) && rn < 1024) \ +- asm volatile("mfdcr %0," __stringify(rn) \ +- : "=r" (rval)); \ ++ asm volatile("mfdcr %0, %1" : "=r" (rval) \ ++ : "n" (rn)); \ + else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ + rval = mfdcrx(rn); \ + else \ +@@ -64,8 +64,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) + #define mtdcr(rn, v) \ + do { \ + if (__builtin_constant_p(rn) && rn < 1024) \ +- asm volatile("mtdcr " __stringify(rn) ",%0" \ +- : : "r" (v)); \ ++ asm volatile("mtdcr %0, %1" \ ++ : : "n" (rn), "r" (v)); \ + else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ + mtdcrx(rn, v); \ + else \ +diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c +index d92e5eaa4c1d7..a850dccd78ea1 100644 +--- a/arch/sparc/kernel/traps_64.c ++++ b/arch/sparc/kernel/traps_64.c +@@ -275,14 +275,13 @@ bool is_no_fault_exception(struct pt_regs *regs) + asi = (regs->tstate >> 24); /* saved %asi */ + else + asi = (insn >> 5); /* immediate asi */ +- if ((asi & 0xf2) == ASI_PNF) { +- if (insn & 0x1000000) { /* op3[5:4]=3 */ +- handle_ldf_stq(insn, regs); +- return true; +- } else if (insn & 0x200000) { /* op3[2], stores */ ++ if ((asi & 0xf6) == ASI_PNF) { ++ if (insn & 0x200000) /* op3[2], stores */ + return false; +- } +- handle_ld_nf(insn, regs); ++ if (insn & 0x1000000) /* op3[5:4]=3 (fp) */ ++ handle_ldf_stq(insn, regs); ++ else ++ handle_ld_nf(insn, regs); + return true; + } + } +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 3d6616f6f6ef8..e0cfd620b2934 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -894,6 +894,12 @@ enum kvm_irqchip_mode { + KVM_IRQCHIP_SPLIT, /* created with KVM_CAP_SPLIT_IRQCHIP */ + }; + ++struct kvm_x86_msr_filter { ++ u8 count; ++ bool default_allow:1; ++ struct msr_bitmap_range ranges[16]; ++}; ++ + #define APICV_INHIBIT_REASON_DISABLE 0 + #define APICV_INHIBIT_REASON_HYPERV 1 + #define APICV_INHIBIT_REASON_NESTED 2 +@@ -989,14 +995,12 @@ struct kvm_arch { + bool guest_can_read_msr_platform_info; + bool exception_payload_enabled; + ++ bool bus_lock_detection_enabled; ++ + /* Deflect RDMSR and WRMSR to user space when they trigger a #GP */ + u32 user_space_msr_mask; + +- struct { +- u8 count; +- bool default_allow:1; +- struct msr_bitmap_range ranges[16]; +- } msr_filter; ++ struct kvm_x86_msr_filter __rcu *msr_filter; + + struct kvm_pmu_event_filter *pmu_event_filter; + struct task_struct *nx_lpage_recovery_thread; +diff --git a/arch/x86/include/asm/static_call.h b/arch/x86/include/asm/static_call.h +index c37f11999d0c0..cbb67b6030f97 100644 +--- a/arch/x86/include/asm/static_call.h ++++ b/arch/x86/include/asm/static_call.h +@@ -37,4 +37,11 @@ + #define ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name) \ + __ARCH_DEFINE_STATIC_CALL_TRAMP(name, "ret; nop; nop; nop; nop") + ++ ++#define ARCH_ADD_TRAMP_KEY(name) \ ++ asm(".pushsection .static_call_tramp_key, \"a\" \n" \ ++ ".long " STATIC_CALL_TRAMP_STR(name) " - . \n" \ ++ ".long " STATIC_CALL_KEY_STR(name) " - . \n" \ ++ ".popsection \n") ++ + #endif /* _ASM_STATIC_CALL_H */ +diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h +index 7068e4bb057d9..1a162e559753b 100644 +--- a/arch/x86/include/asm/xen/page.h ++++ b/arch/x86/include/asm/xen/page.h +@@ -86,18 +86,6 @@ clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops, + } + #endif + +-/* +- * The maximum amount of extra memory compared to the base size. The +- * main scaling factor is the size of struct page. At extreme ratios +- * of base:extra, all the base memory can be filled with page +- * structures for the extra memory, leaving no space for anything +- * else. +- * +- * 10x seems like a reasonable balance between scaling flexibility and +- * leaving a practically usable system. +- */ +-#define XEN_EXTRA_MEM_RATIO (10) +- + /* + * Helper functions to write or read unsigned long values to/from + * memory, when the access may fault. +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index b967c1c774a1f..f37f5c1430cfd 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1523,35 +1523,44 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); + + bool kvm_msr_allowed(struct kvm_vcpu *vcpu, u32 index, u32 type) + { ++ struct kvm_x86_msr_filter *msr_filter; ++ struct msr_bitmap_range *ranges; + struct kvm *kvm = vcpu->kvm; +- struct msr_bitmap_range *ranges = kvm->arch.msr_filter.ranges; +- u32 count = kvm->arch.msr_filter.count; +- u32 i; +- bool r = kvm->arch.msr_filter.default_allow; ++ bool allowed; + int idx; ++ u32 i; + +- /* MSR filtering not set up or x2APIC enabled, allow everything */ +- if (!count || (index >= 0x800 && index <= 0x8ff)) ++ /* x2APIC MSRs do not support filtering. */ ++ if (index >= 0x800 && index <= 0x8ff) + return true; + +- /* Prevent collision with set_msr_filter */ + idx = srcu_read_lock(&kvm->srcu); + +- for (i = 0; i < count; i++) { ++ msr_filter = srcu_dereference(kvm->arch.msr_filter, &kvm->srcu); ++ if (!msr_filter) { ++ allowed = true; ++ goto out; ++ } ++ ++ allowed = msr_filter->default_allow; ++ ranges = msr_filter->ranges; ++ ++ for (i = 0; i < msr_filter->count; i++) { + u32 start = ranges[i].base; + u32 end = start + ranges[i].nmsrs; + u32 flags = ranges[i].flags; + unsigned long *bitmap = ranges[i].bitmap; + + if ((index >= start) && (index < end) && (flags & type)) { +- r = !!test_bit(index - start, bitmap); ++ allowed = !!test_bit(index - start, bitmap); + break; + } + } + ++out: + srcu_read_unlock(&kvm->srcu, idx); + +- return r; ++ return allowed; + } + EXPORT_SYMBOL_GPL(kvm_msr_allowed); + +@@ -5315,25 +5324,34 @@ split_irqchip_unlock: + return r; + } + +-static void kvm_clear_msr_filter(struct kvm *kvm) ++static struct kvm_x86_msr_filter *kvm_alloc_msr_filter(bool default_allow) ++{ ++ struct kvm_x86_msr_filter *msr_filter; ++ ++ msr_filter = kzalloc(sizeof(*msr_filter), GFP_KERNEL_ACCOUNT); ++ if (!msr_filter) ++ return NULL; ++ ++ msr_filter->default_allow = default_allow; ++ return msr_filter; ++} ++ ++static void kvm_free_msr_filter(struct kvm_x86_msr_filter *msr_filter) + { + u32 i; +- u32 count = kvm->arch.msr_filter.count; +- struct msr_bitmap_range ranges[16]; + +- mutex_lock(&kvm->lock); +- kvm->arch.msr_filter.count = 0; +- memcpy(ranges, kvm->arch.msr_filter.ranges, count * sizeof(ranges[0])); +- mutex_unlock(&kvm->lock); +- synchronize_srcu(&kvm->srcu); ++ if (!msr_filter) ++ return; ++ ++ for (i = 0; i < msr_filter->count; i++) ++ kfree(msr_filter->ranges[i].bitmap); + +- for (i = 0; i < count; i++) +- kfree(ranges[i].bitmap); ++ kfree(msr_filter); + } + +-static int kvm_add_msr_filter(struct kvm *kvm, struct kvm_msr_filter_range *user_range) ++static int kvm_add_msr_filter(struct kvm_x86_msr_filter *msr_filter, ++ struct kvm_msr_filter_range *user_range) + { +- struct msr_bitmap_range *ranges = kvm->arch.msr_filter.ranges; + struct msr_bitmap_range range; + unsigned long *bitmap = NULL; + size_t bitmap_size; +@@ -5367,11 +5385,9 @@ static int kvm_add_msr_filter(struct kvm *kvm, struct kvm_msr_filter_range *user + goto err; + } + +- /* Everything ok, add this range identifier to our global pool */ +- ranges[kvm->arch.msr_filter.count] = range; +- /* Make sure we filled the array before we tell anyone to walk it */ +- smp_wmb(); +- kvm->arch.msr_filter.count++; ++ /* Everything ok, add this range identifier. */ ++ msr_filter->ranges[msr_filter->count] = range; ++ msr_filter->count++; + + return 0; + err: +@@ -5382,10 +5398,11 @@ err: + static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) + { + struct kvm_msr_filter __user *user_msr_filter = argp; ++ struct kvm_x86_msr_filter *new_filter, *old_filter; + struct kvm_msr_filter filter; + bool default_allow; +- int r = 0; + bool empty = true; ++ int r = 0; + u32 i; + + if (copy_from_user(&filter, user_msr_filter, sizeof(filter))) +@@ -5398,25 +5415,32 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) + if (empty && !default_allow) + return -EINVAL; + +- kvm_clear_msr_filter(kvm); +- +- kvm->arch.msr_filter.default_allow = default_allow; ++ new_filter = kvm_alloc_msr_filter(default_allow); ++ if (!new_filter) ++ return -ENOMEM; + +- /* +- * Protect from concurrent calls to this function that could trigger +- * a TOCTOU violation on kvm->arch.msr_filter.count. +- */ +- mutex_lock(&kvm->lock); + for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) { +- r = kvm_add_msr_filter(kvm, &filter.ranges[i]); +- if (r) +- break; ++ r = kvm_add_msr_filter(new_filter, &filter.ranges[i]); ++ if (r) { ++ kvm_free_msr_filter(new_filter); ++ return r; ++ } + } + ++ mutex_lock(&kvm->lock); ++ ++ /* The per-VM filter is protected by kvm->lock... */ ++ old_filter = srcu_dereference_check(kvm->arch.msr_filter, &kvm->srcu, 1); ++ ++ rcu_assign_pointer(kvm->arch.msr_filter, new_filter); ++ synchronize_srcu(&kvm->srcu); ++ ++ kvm_free_msr_filter(old_filter); ++ + kvm_make_all_cpus_request(kvm, KVM_REQ_MSR_FILTER_CHANGED); + mutex_unlock(&kvm->lock); + +- return r; ++ return 0; + } + + long kvm_arch_vm_ioctl(struct file *filp, +@@ -10536,8 +10560,6 @@ void kvm_arch_pre_destroy_vm(struct kvm *kvm) + + void kvm_arch_destroy_vm(struct kvm *kvm) + { +- u32 i; +- + if (current->mm == kvm->mm) { + /* + * Free memory regions allocated on behalf of userspace, +@@ -10554,8 +10576,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm) + } + if (kvm_x86_ops.vm_destroy) + kvm_x86_ops.vm_destroy(kvm); +- for (i = 0; i < kvm->arch.msr_filter.count; i++) +- kfree(kvm->arch.msr_filter.ranges[i].bitmap); ++ kvm_free_msr_filter(srcu_dereference_check(kvm->arch.msr_filter, &kvm->srcu, 1)); + kvm_pic_destroy(kvm); + kvm_ioapic_destroy(kvm); + kvm_free_vcpus(kvm); +diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c +index c3d5f0236f353..868fd69814bff 100644 +--- a/arch/x86/mm/mem_encrypt.c ++++ b/arch/x86/mm/mem_encrypt.c +@@ -262,7 +262,7 @@ static void __init __set_clr_pte_enc(pte_t *kpte, int level, bool enc) + if (pgprot_val(old_prot) == pgprot_val(new_prot)) + return; + +- pa = pfn << page_level_shift(level); ++ pa = pfn << PAGE_SHIFT; + size = page_level_size(level); + + /* +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 796506dcfc42e..023ac12f54a29 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -1735,7 +1735,7 @@ static int invoke_bpf_mod_ret(const struct btf_func_model *m, u8 **pprog, + * add rsp, 8 // skip eth_type_trans's frame + * ret // return to its caller + */ +-int arch_prepare_bpf_trampoline(void *image, void *image_end, ++int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *image_end, + const struct btf_func_model *m, u32 flags, + struct bpf_tramp_progs *tprogs, + void *orig_call) +@@ -1774,6 +1774,15 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, + + save_regs(m, &prog, nr_args, stack_size); + ++ if (flags & BPF_TRAMP_F_CALL_ORIG) { ++ /* arg1: mov rdi, im */ ++ emit_mov_imm64(&prog, BPF_REG_1, (long) im >> 32, (u32) (long) im); ++ if (emit_call(&prog, __bpf_tramp_enter, prog)) { ++ ret = -EINVAL; ++ goto cleanup; ++ } ++ } ++ + if (fentry->nr_progs) + if (invoke_bpf(m, &prog, fentry, stack_size)) + return -EINVAL; +@@ -1792,8 +1801,7 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, + } + + if (flags & BPF_TRAMP_F_CALL_ORIG) { +- if (fentry->nr_progs || fmod_ret->nr_progs) +- restore_regs(m, &prog, nr_args, stack_size); ++ restore_regs(m, &prog, nr_args, stack_size); + + /* call original function */ + if (emit_call(&prog, orig_call, prog)) { +@@ -1802,6 +1810,9 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, + } + /* remember return value in a stack for bpf prog to access */ + emit_stx(&prog, BPF_DW, BPF_REG_FP, BPF_REG_0, -8); ++ im->ip_after_call = prog; ++ memcpy(prog, ideal_nops[NOP_ATOMIC5], X86_PATCH_SIZE); ++ prog += X86_PATCH_SIZE; + } + + if (fmod_ret->nr_progs) { +@@ -1832,9 +1843,17 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, + * the return value is only updated on the stack and still needs to be + * restored to R0. + */ +- if (flags & BPF_TRAMP_F_CALL_ORIG) ++ if (flags & BPF_TRAMP_F_CALL_ORIG) { ++ im->ip_epilogue = prog; ++ /* arg1: mov rdi, im */ ++ emit_mov_imm64(&prog, BPF_REG_1, (long) im >> 32, (u32) (long) im); ++ if (emit_call(&prog, __bpf_tramp_exit, prog)) { ++ ret = -EINVAL; ++ goto cleanup; ++ } + /* restore original return value back into RAX */ + emit_ldx(&prog, BPF_DW, BPF_REG_0, BPF_REG_FP, -8); ++ } + + EMIT1(0x5B); /* pop rbx */ + EMIT1(0xC9); /* leave */ +diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c +index a3cc33091f46c..8bdba2564cf9b 100644 +--- a/arch/x86/xen/p2m.c ++++ b/arch/x86/xen/p2m.c +@@ -98,8 +98,8 @@ EXPORT_SYMBOL_GPL(xen_p2m_size); + unsigned long xen_max_p2m_pfn __read_mostly; + EXPORT_SYMBOL_GPL(xen_max_p2m_pfn); + +-#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT +-#define P2M_LIMIT CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT ++#ifdef CONFIG_XEN_MEMORY_HOTPLUG_LIMIT ++#define P2M_LIMIT CONFIG_XEN_MEMORY_HOTPLUG_LIMIT + #else + #define P2M_LIMIT 0 + #endif +@@ -416,9 +416,6 @@ void __init xen_vmalloc_p2m_tree(void) + xen_p2m_last_pfn = xen_max_p2m_pfn; + + p2m_limit = (phys_addr_t)P2M_LIMIT * 1024 * 1024 * 1024 / PAGE_SIZE; +- if (!p2m_limit && IS_ENABLED(CONFIG_XEN_UNPOPULATED_ALLOC)) +- p2m_limit = xen_start_info->nr_pages * XEN_EXTRA_MEM_RATIO; +- + vm.flags = VM_ALLOC; + vm.size = ALIGN(sizeof(unsigned long) * max(xen_max_p2m_pfn, p2m_limit), + PMD_SIZE * PMDS_PER_MID_PAGE); +diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c +index 1a3b75652fa4f..8bfc103301077 100644 +--- a/arch/x86/xen/setup.c ++++ b/arch/x86/xen/setup.c +@@ -59,6 +59,18 @@ static struct { + } xen_remap_buf __initdata __aligned(PAGE_SIZE); + static unsigned long xen_remap_mfn __initdata = INVALID_P2M_ENTRY; + ++/* ++ * The maximum amount of extra memory compared to the base size. The ++ * main scaling factor is the size of struct page. At extreme ratios ++ * of base:extra, all the base memory can be filled with page ++ * structures for the extra memory, leaving no space for anything ++ * else. ++ * ++ * 10x seems like a reasonable balance between scaling flexibility and ++ * leaving a practically usable system. ++ */ ++#define EXTRA_MEM_RATIO (10) ++ + static bool xen_512gb_limit __initdata = IS_ENABLED(CONFIG_XEN_512GB); + + static void __init xen_parse_512gb(void) +@@ -778,13 +790,13 @@ char * __init xen_memory_setup(void) + extra_pages += max_pages - max_pfn; + + /* +- * Clamp the amount of extra memory to a XEN_EXTRA_MEM_RATIO ++ * Clamp the amount of extra memory to a EXTRA_MEM_RATIO + * factor the base size. + * + * Make sure we have no memory above max_pages, as this area + * isn't handled by the p2m management. + */ +- extra_pages = min3(XEN_EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)), ++ extra_pages = min3(EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)), + extra_pages, max_pages - max_pfn); + i = 0; + addr = xen_e820_table.entries[0].addr; +diff --git a/block/blk-cgroup-rwstat.c b/block/blk-cgroup-rwstat.c +index 85d5790ac49b0..3304e841df7ce 100644 +--- a/block/blk-cgroup-rwstat.c ++++ b/block/blk-cgroup-rwstat.c +@@ -109,6 +109,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol, + + lockdep_assert_held(&blkg->q->queue_lock); + ++ memset(sum, 0, sizeof(*sum)); + rcu_read_lock(); + blkg_for_each_descendant_pre(pos_blkg, pos_css, blkg) { + struct blkg_rwstat *rwstat; +@@ -122,7 +123,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol, + rwstat = (void *)pos_blkg + off; + + for (i = 0; i < BLKG_RWSTAT_NR; i++) +- sum->cnt[i] = blkg_rwstat_read_counter(rwstat, i); ++ sum->cnt[i] += blkg_rwstat_read_counter(rwstat, i); + } + rcu_read_unlock(); + } +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 808768f6b174c..756473295f19b 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -383,6 +383,14 @@ unsigned int blk_recalc_rq_segments(struct request *rq) + switch (bio_op(rq->bio)) { + case REQ_OP_DISCARD: + case REQ_OP_SECURE_ERASE: ++ if (queue_max_discard_segments(rq->q) > 1) { ++ struct bio *bio = rq->bio; ++ ++ for_each_bio(bio) ++ nr_phys_segs++; ++ return nr_phys_segs; ++ } ++ return 1; + case REQ_OP_WRITE_ZEROES: + return 0; + case REQ_OP_WRITE_SAME: +diff --git a/block/blk-zoned.c b/block/blk-zoned.c +index df0ecf6790d35..fc925f73d694a 100644 +--- a/block/blk-zoned.c ++++ b/block/blk-zoned.c +@@ -240,7 +240,7 @@ int blkdev_zone_mgmt(struct block_device *bdev, enum req_opf op, + */ + if (op == REQ_OP_ZONE_RESET && + blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) { +- bio->bi_opf = REQ_OP_ZONE_RESET_ALL; ++ bio->bi_opf = REQ_OP_ZONE_RESET_ALL | REQ_SYNC; + break; + } + +diff --git a/block/genhd.c b/block/genhd.c +index 07a0ef741de19..12940cfa68afc 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -658,10 +658,8 @@ static void register_disk(struct device *parent, struct gendisk *disk, + kobject_create_and_add("holders", &ddev->kobj); + disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj); + +- if (disk->flags & GENHD_FL_HIDDEN) { +- dev_set_uevent_suppress(ddev, 0); ++ if (disk->flags & GENHD_FL_HIDDEN) + return; +- } + + disk_scan_partitions(disk); + +diff --git a/drivers/acpi/acpica/nsaccess.c b/drivers/acpi/acpica/nsaccess.c +index 3f045b5953b2e..a0c1a665dfc12 100644 +--- a/drivers/acpi/acpica/nsaccess.c ++++ b/drivers/acpi/acpica/nsaccess.c +@@ -99,13 +99,12 @@ acpi_status acpi_ns_root_initialize(void) + * just create and link the new node(s) here. + */ + new_node = +- ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_namespace_node)); ++ acpi_ns_create_node(*ACPI_CAST_PTR(u32, init_val->name)); + if (!new_node) { + status = AE_NO_MEMORY; + goto unlock_and_exit; + } + +- ACPI_COPY_NAMESEG(new_node->name.ascii, init_val->name); + new_node->descriptor_type = ACPI_DESC_TYPE_NAMED; + new_node->type = init_val->type; + +diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h +index e6a5d997241c4..cb8f70842249e 100644 +--- a/drivers/acpi/internal.h ++++ b/drivers/acpi/internal.h +@@ -9,6 +9,8 @@ + #ifndef _ACPI_INTERNAL_H_ + #define _ACPI_INTERNAL_H_ + ++#include ++ + #define PREFIX "ACPI: " + + int early_acpi_osi_init(void); +@@ -96,9 +98,11 @@ void acpi_scan_table_handler(u32 event, void *table, void *context); + + extern struct list_head acpi_bus_id_list; + ++#define ACPI_MAX_DEVICE_INSTANCES 4096 ++ + struct acpi_device_bus_id { + const char *bus_id; +- unsigned int instance_no; ++ struct ida instance_ida; + struct list_head node; + }; + +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 22566b4b3150a..a4fdf61b06444 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -482,9 +482,8 @@ static void acpi_device_del(struct acpi_device *device) + list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) + if (!strcmp(acpi_device_bus_id->bus_id, + acpi_device_hid(device))) { +- if (acpi_device_bus_id->instance_no > 0) +- acpi_device_bus_id->instance_no--; +- else { ++ ida_simple_remove(&acpi_device_bus_id->instance_ida, device->pnp.instance_no); ++ if (ida_is_empty(&acpi_device_bus_id->instance_ida)) { + list_del(&acpi_device_bus_id->node); + kfree_const(acpi_device_bus_id->bus_id); + kfree(acpi_device_bus_id); +@@ -623,12 +622,38 @@ void acpi_bus_put_acpi_device(struct acpi_device *adev) + put_device(&adev->dev); + } + ++static struct acpi_device_bus_id *acpi_device_bus_id_match(const char *dev_id) ++{ ++ struct acpi_device_bus_id *acpi_device_bus_id; ++ ++ /* Find suitable bus_id and instance number in acpi_bus_id_list. */ ++ list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) { ++ if (!strcmp(acpi_device_bus_id->bus_id, dev_id)) ++ return acpi_device_bus_id; ++ } ++ return NULL; ++} ++ ++static int acpi_device_set_name(struct acpi_device *device, ++ struct acpi_device_bus_id *acpi_device_bus_id) ++{ ++ struct ida *instance_ida = &acpi_device_bus_id->instance_ida; ++ int result; ++ ++ result = ida_simple_get(instance_ida, 0, ACPI_MAX_DEVICE_INSTANCES, GFP_KERNEL); ++ if (result < 0) ++ return result; ++ ++ device->pnp.instance_no = result; ++ dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, result); ++ return 0; ++} ++ + int acpi_device_add(struct acpi_device *device, + void (*release)(struct device *)) + { ++ struct acpi_device_bus_id *acpi_device_bus_id; + int result; +- struct acpi_device_bus_id *acpi_device_bus_id, *new_bus_id; +- int found = 0; + + if (device->handle) { + acpi_status status; +@@ -654,41 +679,38 @@ int acpi_device_add(struct acpi_device *device, + INIT_LIST_HEAD(&device->del_list); + mutex_init(&device->physical_node_lock); + +- new_bus_id = kzalloc(sizeof(struct acpi_device_bus_id), GFP_KERNEL); +- if (!new_bus_id) { +- pr_err(PREFIX "Memory allocation error\n"); +- result = -ENOMEM; +- goto err_detach; +- } +- + mutex_lock(&acpi_device_lock); +- /* +- * Find suitable bus_id and instance number in acpi_bus_id_list +- * If failed, create one and link it into acpi_bus_id_list +- */ +- list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) { +- if (!strcmp(acpi_device_bus_id->bus_id, +- acpi_device_hid(device))) { +- acpi_device_bus_id->instance_no++; +- found = 1; +- kfree(new_bus_id); +- break; ++ ++ acpi_device_bus_id = acpi_device_bus_id_match(acpi_device_hid(device)); ++ if (acpi_device_bus_id) { ++ result = acpi_device_set_name(device, acpi_device_bus_id); ++ if (result) ++ goto err_unlock; ++ } else { ++ acpi_device_bus_id = kzalloc(sizeof(*acpi_device_bus_id), ++ GFP_KERNEL); ++ if (!acpi_device_bus_id) { ++ result = -ENOMEM; ++ goto err_unlock; + } +- } +- if (!found) { +- acpi_device_bus_id = new_bus_id; + acpi_device_bus_id->bus_id = + kstrdup_const(acpi_device_hid(device), GFP_KERNEL); + if (!acpi_device_bus_id->bus_id) { +- pr_err(PREFIX "Memory allocation error for bus id\n"); ++ kfree(acpi_device_bus_id); + result = -ENOMEM; +- goto err_free_new_bus_id; ++ goto err_unlock; ++ } ++ ++ ida_init(&acpi_device_bus_id->instance_ida); ++ ++ result = acpi_device_set_name(device, acpi_device_bus_id); ++ if (result) { ++ kfree(acpi_device_bus_id); ++ goto err_unlock; + } + +- acpi_device_bus_id->instance_no = 0; + list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); + } +- dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, acpi_device_bus_id->instance_no); + + if (device->parent) + list_add_tail(&device->node, &device->parent->children); +@@ -720,13 +742,9 @@ int acpi_device_add(struct acpi_device *device, + list_del(&device->node); + list_del(&device->wakeup_list); + +- err_free_new_bus_id: +- if (!found) +- kfree(new_bus_id); +- ++ err_unlock: + mutex_unlock(&acpi_device_lock); + +- err_detach: + acpi_detach_data(device->handle, acpi_scan_drop_device); + return result; + } +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 811d298637cb2..83cd4c95faf0d 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -147,6 +147,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + }, + }, + { ++ .callback = video_detect_force_vendor, + .ident = "Sony VPCEH3U1E", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), +diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c +index 316a9947541fe..b574cce98dc36 100644 +--- a/drivers/atm/eni.c ++++ b/drivers/atm/eni.c +@@ -2260,7 +2260,8 @@ out: + return rc; + + err_eni_release: +- eni_do_release(dev); ++ dev->phy = NULL; ++ iounmap(ENI_DEV(dev)->ioaddr); + err_unregister: + atm_dev_deregister(dev); + err_free_consistent: +diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c +index 3c081b6171a8f..bfca7b8a6f31e 100644 +--- a/drivers/atm/idt77105.c ++++ b/drivers/atm/idt77105.c +@@ -262,7 +262,7 @@ static int idt77105_start(struct atm_dev *dev) + { + unsigned long flags; + +- if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL))) ++ if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL))) + return -ENOMEM; + PRIV(dev)->dev = dev; + spin_lock_irqsave(&idt77105_priv_lock, flags); +@@ -337,7 +337,7 @@ static int idt77105_stop(struct atm_dev *dev) + else + idt77105_all = walk->next; + dev->phy = NULL; +- dev->dev_data = NULL; ++ dev->phy_data = NULL; + kfree(walk); + break; + } +diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c +index d7277c26e4232..32d7aa141d966 100644 +--- a/drivers/atm/lanai.c ++++ b/drivers/atm/lanai.c +@@ -2233,6 +2233,7 @@ static int lanai_dev_open(struct atm_dev *atmdev) + conf1_write(lanai); + #endif + iounmap(lanai->base); ++ lanai->base = NULL; + error_pci: + pci_disable_device(lanai->pci); + error: +@@ -2245,6 +2246,8 @@ static int lanai_dev_open(struct atm_dev *atmdev) + static void lanai_dev_close(struct atm_dev *atmdev) + { + struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data; ++ if (lanai->base==NULL) ++ return; + printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n", + lanai->number); + lanai_timed_poll_stop(lanai); +@@ -2552,7 +2555,7 @@ static int lanai_init_one(struct pci_dev *pci, + struct atm_dev *atmdev; + int result; + +- lanai = kmalloc(sizeof(*lanai), GFP_KERNEL); ++ lanai = kzalloc(sizeof(*lanai), GFP_KERNEL); + if (lanai == NULL) { + printk(KERN_ERR DEV_LABEL + ": couldn't allocate dev_data structure!\n"); +diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c +index 7850758b5bb82..239852d855589 100644 +--- a/drivers/atm/uPD98402.c ++++ b/drivers/atm/uPD98402.c +@@ -211,7 +211,7 @@ static void uPD98402_int(struct atm_dev *dev) + static int uPD98402_start(struct atm_dev *dev) + { + DPRINTK("phy_start\n"); +- if (!(dev->dev_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL))) ++ if (!(dev->phy_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL))) + return -ENOMEM; + spin_lock_init(&PRIV(dev)->lock); + memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats)); +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index bfda153b1a41d..5ef67bacb585e 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -305,7 +305,7 @@ static int rpm_get_suppliers(struct device *dev) + return 0; + } + +-static void rpm_put_suppliers(struct device *dev) ++static void __rpm_put_suppliers(struct device *dev, bool try_to_suspend) + { + struct device_link *link; + +@@ -313,10 +313,30 @@ static void rpm_put_suppliers(struct device *dev) + device_links_read_lock_held()) { + + while (refcount_dec_not_one(&link->rpm_active)) +- pm_runtime_put(link->supplier); ++ pm_runtime_put_noidle(link->supplier); ++ ++ if (try_to_suspend) ++ pm_request_idle(link->supplier); + } + } + ++static void rpm_put_suppliers(struct device *dev) ++{ ++ __rpm_put_suppliers(dev, true); ++} ++ ++static void rpm_suspend_suppliers(struct device *dev) ++{ ++ struct device_link *link; ++ int idx = device_links_read_lock(); ++ ++ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node, ++ device_links_read_lock_held()) ++ pm_request_idle(link->supplier); ++ ++ device_links_read_unlock(idx); ++} ++ + /** + * __rpm_callback - Run a given runtime PM callback for a given device. + * @cb: Runtime PM callback to run. +@@ -344,8 +364,10 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + idx = device_links_read_lock(); + + retval = rpm_get_suppliers(dev); +- if (retval) ++ if (retval) { ++ rpm_put_suppliers(dev); + goto fail; ++ } + + device_links_read_unlock(idx); + } +@@ -368,9 +390,9 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + || (dev->power.runtime_status == RPM_RESUMING && retval))) { + idx = device_links_read_lock(); + +- fail: +- rpm_put_suppliers(dev); ++ __rpm_put_suppliers(dev, false); + ++fail: + device_links_read_unlock(idx); + } + +@@ -642,8 +664,11 @@ static int rpm_suspend(struct device *dev, int rpmflags) + goto out; + } + ++ if (dev->power.irq_safe) ++ goto out; ++ + /* Maybe the parent is now able to suspend. */ +- if (parent && !parent->power.ignore_children && !dev->power.irq_safe) { ++ if (parent && !parent->power.ignore_children) { + spin_unlock(&dev->power.lock); + + spin_lock(&parent->power.lock); +@@ -652,6 +677,14 @@ static int rpm_suspend(struct device *dev, int rpmflags) + + spin_lock(&dev->power.lock); + } ++ /* Maybe the suppliers are now able to suspend. */ ++ if (dev->power.links_count > 0) { ++ spin_unlock_irq(&dev->power.lock); ++ ++ rpm_suspend_suppliers(dev); ++ ++ spin_lock_irq(&dev->power.lock); ++ } + + out: + trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval); +diff --git a/drivers/block/umem.c b/drivers/block/umem.c +index 2b95d7b33b918..5eb44e4a91eeb 100644 +--- a/drivers/block/umem.c ++++ b/drivers/block/umem.c +@@ -877,6 +877,7 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + if (card->mm_pages[0].desc == NULL || + card->mm_pages[1].desc == NULL) { + dev_printk(KERN_ERR, &card->dev->dev, "alloc failed\n"); ++ ret = -ENOMEM; + goto failed_alloc; + } + reset_page(&card->mm_pages[0]); +@@ -888,8 +889,10 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + spin_lock_init(&card->lock); + + card->queue = blk_alloc_queue(NUMA_NO_NODE); +- if (!card->queue) ++ if (!card->queue) { ++ ret = -ENOMEM; + goto failed_alloc; ++ } + + tasklet_init(&card->tasklet, process_page, (unsigned long)card); + +diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c +index da16121140cab..3874233f7194d 100644 +--- a/drivers/block/xen-blkback/blkback.c ++++ b/drivers/block/xen-blkback/blkback.c +@@ -891,7 +891,7 @@ next: + out: + for (i = last_map; i < num; i++) { + /* Don't zap current batch's valid persistent grants. */ +- if(i >= last_map + segs_to_map) ++ if(i >= map_until) + pages[i]->persistent_gnt = NULL; + pages[i]->handle = BLKBACK_INVALID_HANDLE; + } +diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c +index b040447575adc..dcfb32ee5cb60 100644 +--- a/drivers/bus/omap_l3_noc.c ++++ b/drivers/bus/omap_l3_noc.c +@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev) + */ + l3->debug_irq = platform_get_irq(pdev, 0); + ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler, +- 0x0, "l3-dbg-irq", l3); ++ IRQF_NO_THREAD, "l3-dbg-irq", l3); + if (ret) { + dev_err(l3->dev, "request_irq failed for %d\n", + l3->debug_irq); +@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) + + l3->app_irq = platform_get_irq(pdev, 1); + ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler, +- 0x0, "l3-app-irq", l3); ++ IRQF_NO_THREAD, "l3-app-irq", l3); + if (ret) + dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq); + +diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c +index 88e896abb6631..da8b627ca156c 100644 +--- a/drivers/clk/qcom/gcc-sc7180.c ++++ b/drivers/clk/qcom/gcc-sc7180.c +@@ -620,7 +620,7 @@ static struct clk_rcg2 gcc_sdcc1_apps_clk_src = { + .name = "gcc_sdcc1_apps_clk_src", + .parent_data = gcc_parent_data_1, + .num_parents = 5, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +@@ -642,7 +642,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = { + .name = "gcc_sdcc1_ice_core_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = 4, +- .ops = &clk_rcg2_floor_ops, ++ .ops = &clk_rcg2_ops, + }, + }; + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index bd2db0188cbb0..91e6a0c10dbf9 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -103,6 +103,8 @@ static const struct of_device_id whitelist[] __initconst = { + static const struct of_device_id blacklist[] __initconst = { + { .compatible = "allwinner,sun50i-h6", }, + ++ { .compatible = "arm,vexpress", }, ++ + { .compatible = "calxeda,highbank", }, + { .compatible = "calxeda,ecx-2000", }, + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 495f779b2ab99..1aacd2a5a1fd5 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -174,7 +174,7 @@ static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio, + int ret, value; + + ret = request_threaded_irq(event->irq, NULL, event->handler, +- event->irqflags, "ACPI:Event", event); ++ event->irqflags | IRQF_ONESHOT, "ACPI:Event", event); + if (ret) { + dev_err(acpi_gpio->chip->parent, + "Failed to setup interrupt handler for %d\n", +diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig +index af6c6d214d916..f0c0ccdc8a10a 100644 +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -232,6 +232,7 @@ source "drivers/gpu/drm/arm/Kconfig" + config DRM_RADEON + tristate "ATI Radeon" + depends on DRM && PCI && MMU ++ depends on AGP || !AGP + select FW_LOADER + select DRM_KMS_HELPER + select DRM_TTM +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index bc5b644ddda34..eacfca7762491 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2666,7 +2666,7 @@ static int amdgpu_device_ip_suspend_phase1(struct amdgpu_device *adev) + { + int i, r; + +- if (adev->in_poweroff_reboot_com || ++ if (adev->in_poweroff_reboot_com || adev->in_hibernate || + !amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) { + amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE); + amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE); +@@ -3727,7 +3727,11 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon) + + amdgpu_fence_driver_suspend(adev); + +- if (adev->in_poweroff_reboot_com || ++ /* ++ * TODO: Need figure out the each GNB IP idle off dependency and then ++ * improve the AMDGPU suspend/resume sequence for system-wide Sx entry/exit. ++ */ ++ if (adev->in_poweroff_reboot_com || adev->in_hibernate || + !amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) + r = amdgpu_device_ip_suspend_phase2(adev); + else +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 1aed641a3eecc..82cb2ade83b00 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -1102,6 +1102,7 @@ static const struct pci_device_id pciidlist[] = { + {0x1002, 0x73A3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, + {0x1002, 0x73AB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, + {0x1002, 0x73AE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, ++ {0x1002, 0x73AF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, + {0x1002, 0x73BF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, + + /* Van Gogh */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +index 0bf7d36c6686d..5b716404eee1b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +@@ -146,7 +146,7 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev, + size = mode_cmd->pitches[0] * height; + aligned_size = ALIGN(size, PAGE_SIZE); + ret = amdgpu_gem_object_create(adev, aligned_size, 0, domain, flags, +- ttm_bo_type_kernel, NULL, &gobj); ++ ttm_bo_type_device, NULL, &gobj); + if (ret) { + pr_err("failed to allocate framebuffer (%d)\n", aligned_size); + return -ENOMEM; +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 1d26e82602f75..ad4afbc37d516 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4616,6 +4616,7 @@ static int fill_dc_plane_attributes(struct amdgpu_device *adev, + dc_plane_state->global_alpha_value = plane_info.global_alpha_value; + dc_plane_state->dcc = plane_info.dcc; + dc_plane_state->layer_index = plane_info.layer_index; // Always returns 0 ++ dc_plane_state->flip_int_enabled = true; + + /* + * Always set input transfer function, since plane state is refreshed +diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h +index 3aedadb34548e..414b44b4ced4a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc.h ++++ b/drivers/gpu/drm/amd/display/dc/dc.h +@@ -889,6 +889,7 @@ struct dc_plane_state { + int layer_index; + + union surface_update_flags update_flags; ++ bool flip_int_enabled; + /* private to DC core */ + struct dc_plane_status status; + struct dc_context *ctx; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c +index 9e796dfeac204..714c71a5fbde3 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c +@@ -1257,6 +1257,16 @@ void hubp1_soft_reset(struct hubp *hubp, bool reset) + REG_UPDATE(DCHUBP_CNTL, HUBP_DISABLE, reset ? 1 : 0); + } + ++void hubp1_set_flip_int(struct hubp *hubp) ++{ ++ struct dcn10_hubp *hubp1 = TO_DCN10_HUBP(hubp); ++ ++ REG_UPDATE(DCSURF_SURFACE_FLIP_INTERRUPT, ++ SURFACE_FLIP_INT_MASK, 1); ++ ++ return; ++} ++ + void hubp1_init(struct hubp *hubp) + { + //do nothing +@@ -1290,6 +1300,7 @@ static const struct hubp_funcs dcn10_hubp_funcs = { + .dmdata_load = NULL, + .hubp_soft_reset = hubp1_soft_reset, + .hubp_in_blank = hubp1_in_blank, ++ .hubp_set_flip_int = hubp1_set_flip_int, + }; + + /*****************************************/ +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h +index a9a6ed7f4f993..e2f2f6995935f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h +@@ -74,6 +74,7 @@ + SRI(DCSURF_SURFACE_EARLIEST_INUSE_C, HUBPREQ, id),\ + SRI(DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C, HUBPREQ, id),\ + SRI(DCSURF_SURFACE_CONTROL, HUBPREQ, id),\ ++ SRI(DCSURF_SURFACE_FLIP_INTERRUPT, HUBPREQ, id),\ + SRI(HUBPRET_CONTROL, HUBPRET, id),\ + SRI(DCN_EXPANSION_MODE, HUBPREQ, id),\ + SRI(DCHUBP_REQ_SIZE_CONFIG, HUBP, id),\ +@@ -183,6 +184,7 @@ + uint32_t DCSURF_SURFACE_EARLIEST_INUSE_C; \ + uint32_t DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C; \ + uint32_t DCSURF_SURFACE_CONTROL; \ ++ uint32_t DCSURF_SURFACE_FLIP_INTERRUPT; \ + uint32_t HUBPRET_CONTROL; \ + uint32_t DCN_EXPANSION_MODE; \ + uint32_t DCHUBP_REQ_SIZE_CONFIG; \ +@@ -332,6 +334,7 @@ + HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_META_SURFACE_TMZ_C, mask_sh),\ + HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_SURFACE_DCC_EN, mask_sh),\ + HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_SURFACE_DCC_IND_64B_BLK, mask_sh),\ ++ HUBP_SF(HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT, SURFACE_FLIP_INT_MASK, mask_sh),\ + HUBP_SF(HUBPRET0_HUBPRET_CONTROL, DET_BUF_PLANE1_BASE_ADDRESS, mask_sh),\ + HUBP_SF(HUBPRET0_HUBPRET_CONTROL, CROSSBAR_SRC_CB_B, mask_sh),\ + HUBP_SF(HUBPRET0_HUBPRET_CONTROL, CROSSBAR_SRC_CR_R, mask_sh),\ +@@ -531,6 +534,7 @@ + type PRIMARY_SURFACE_DCC_IND_64B_BLK;\ + type SECONDARY_SURFACE_DCC_EN;\ + type SECONDARY_SURFACE_DCC_IND_64B_BLK;\ ++ type SURFACE_FLIP_INT_MASK;\ + type DET_BUF_PLANE1_BASE_ADDRESS;\ + type CROSSBAR_SRC_CB_B;\ + type CROSSBAR_SRC_CR_R;\ +@@ -777,4 +781,6 @@ void hubp1_read_state_common(struct hubp *hubp); + bool hubp1_in_blank(struct hubp *hubp); + void hubp1_soft_reset(struct hubp *hubp, bool reset); + ++void hubp1_set_flip_int(struct hubp *hubp); ++ + #endif +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index 017b67b830e66..3e86e042de0de 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -2195,6 +2195,13 @@ static void dcn10_enable_plane( + if (dc->debug.sanity_checks) { + hws->funcs.verify_allow_pstate_change_high(dc); + } ++ ++ if (!pipe_ctx->top_pipe ++ && pipe_ctx->plane_state ++ && pipe_ctx->plane_state->flip_int_enabled ++ && pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int) ++ pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int(pipe_ctx->plane_res.hubp); ++ + } + + void dcn10_program_gamut_remap(struct pipe_ctx *pipe_ctx) +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c +index 0df0da2e6a4d0..bec7059f6d5d1 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c +@@ -1597,6 +1597,7 @@ static struct hubp_funcs dcn20_hubp_funcs = { + .validate_dml_output = hubp2_validate_dml_output, + .hubp_in_blank = hubp1_in_blank, + .hubp_soft_reset = hubp1_soft_reset, ++ .hubp_set_flip_int = hubp1_set_flip_int, + }; + + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +index 09b9732424e15..077ba9cf69c5a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +@@ -1146,6 +1146,12 @@ void dcn20_enable_plane( + pipe_ctx->plane_res.hubp->funcs->hubp_set_vm_system_aperture_settings(pipe_ctx->plane_res.hubp, &apt); + } + ++ if (!pipe_ctx->top_pipe ++ && pipe_ctx->plane_state ++ && pipe_ctx->plane_state->flip_int_enabled ++ && pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int) ++ pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int(pipe_ctx->plane_res.hubp); ++ + // if (dc->debug.sanity_checks) { + // dcn10_verify_allow_pstate_change_high(dc); + // } +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c +index 15c2ff264ff60..1a347484cf2a1 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c +@@ -341,8 +341,7 @@ void enc2_hw_init(struct link_encoder *enc) + } else { + AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, 0x103d1110); + +- AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c4d); +- ++ AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c7a); + } + + //AUX_DPHY_TX_REF_CONTROL'AUX_TX_REF_DIV HW default is 0x32; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c +index f9045852728fe..b0c9180b808f6 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c +@@ -838,6 +838,7 @@ static struct hubp_funcs dcn21_hubp_funcs = { + .hubp_set_flip_control_surface_gsl = hubp2_set_flip_control_surface_gsl, + .hubp_init = hubp21_init, + .validate_dml_output = hubp21_validate_dml_output, ++ .hubp_set_flip_int = hubp1_set_flip_int, + }; + + bool hubp21_construct( +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +index 4caeab6a09b3d..4a3df13c9e49a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +@@ -296,7 +296,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = { + .num_banks = 8, + .num_chans = 4, + .vmm_page_size_bytes = 4096, +- .dram_clock_change_latency_us = 11.72, ++ .dram_clock_change_latency_us = 23.84, + .return_bus_width_bytes = 64, + .dispclk_dppclk_vco_speed_mhz = 3600, + .xfc_bus_transport_time_us = 4, +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c +index 88ffa9ff1ed15..f246125232482 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c +@@ -511,6 +511,7 @@ static struct hubp_funcs dcn30_hubp_funcs = { + .hubp_init = hubp3_init, + .hubp_in_blank = hubp1_in_blank, + .hubp_soft_reset = hubp1_soft_reset, ++ .hubp_set_flip_int = hubp1_set_flip_int, + }; + + bool hubp3_construct( +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +index 5e126fdf6ec10..7ec8936346b27 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +@@ -2601,6 +2601,19 @@ static const struct resource_funcs dcn30_res_pool_funcs = { + .patch_unknown_plane_state = dcn20_patch_unknown_plane_state, + }; + ++#define CTX ctx ++ ++#define REG(reg_name) \ ++ (DCN_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name) ++ ++static uint32_t read_pipe_fuses(struct dc_context *ctx) ++{ ++ uint32_t value = REG_READ(CC_DC_PIPE_DIS); ++ /* Support for max 6 pipes */ ++ value = value & 0x3f; ++ return value; ++} ++ + static bool dcn30_resource_construct( + uint8_t num_virtual_links, + struct dc *dc, +@@ -2610,6 +2623,15 @@ static bool dcn30_resource_construct( + struct dc_context *ctx = dc->ctx; + struct irq_service_init_data init_data; + struct ddc_service_init_data ddc_init_data; ++ uint32_t pipe_fuses = read_pipe_fuses(ctx); ++ uint32_t num_pipes = 0; ++ ++ if (!(pipe_fuses == 0 || pipe_fuses == 0x3e)) { ++ BREAK_TO_DEBUGGER(); ++ dm_error("DC: Unexpected fuse recipe for navi2x !\n"); ++ /* fault to single pipe */ ++ pipe_fuses = 0x3e; ++ } + + DC_FP_START(); + +@@ -2739,6 +2761,15 @@ static bool dcn30_resource_construct( + /* PP Lib and SMU interfaces */ + init_soc_bounding_box(dc, pool); + ++ num_pipes = dcn3_0_ip.max_num_dpp; ++ ++ for (i = 0; i < dcn3_0_ip.max_num_dpp; i++) ++ if (pipe_fuses & 1 << i) ++ num_pipes--; ++ ++ dcn3_0_ip.max_num_dpp = num_pipes; ++ dcn3_0_ip.max_num_otg = num_pipes; ++ + dml_init_instance(&dc->dml, &dcn3_0_soc, &dcn3_0_ip, DML_PROJECT_DCN30); + + /* IRQ */ +diff --git a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c +index 35f5bf08ae96e..23bc208cbfa42 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c +@@ -1722,12 +1722,106 @@ static void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *b + dml_init_instance(&dc->dml, &dcn3_01_soc, &dcn3_01_ip, DML_PROJECT_DCN30); + } + ++static void calculate_wm_set_for_vlevel( ++ int vlevel, ++ struct wm_range_table_entry *table_entry, ++ struct dcn_watermarks *wm_set, ++ struct display_mode_lib *dml, ++ display_e2e_pipe_params_st *pipes, ++ int pipe_cnt) ++{ ++ double dram_clock_change_latency_cached = dml->soc.dram_clock_change_latency_us; ++ ++ ASSERT(vlevel < dml->soc.num_states); ++ /* only pipe 0 is read for voltage and dcf/soc clocks */ ++ pipes[0].clks_cfg.voltage = vlevel; ++ pipes[0].clks_cfg.dcfclk_mhz = dml->soc.clock_limits[vlevel].dcfclk_mhz; ++ pipes[0].clks_cfg.socclk_mhz = dml->soc.clock_limits[vlevel].socclk_mhz; ++ ++ dml->soc.dram_clock_change_latency_us = table_entry->pstate_latency_us; ++ dml->soc.sr_exit_time_us = table_entry->sr_exit_time_us; ++ dml->soc.sr_enter_plus_exit_time_us = table_entry->sr_enter_plus_exit_time_us; ++ ++ wm_set->urgent_ns = get_wm_urgent(dml, pipes, pipe_cnt) * 1000; ++ wm_set->cstate_pstate.cstate_enter_plus_exit_ns = get_wm_stutter_enter_exit(dml, pipes, pipe_cnt) * 1000; ++ wm_set->cstate_pstate.cstate_exit_ns = get_wm_stutter_exit(dml, pipes, pipe_cnt) * 1000; ++ wm_set->cstate_pstate.pstate_change_ns = get_wm_dram_clock_change(dml, pipes, pipe_cnt) * 1000; ++ wm_set->pte_meta_urgent_ns = get_wm_memory_trip(dml, pipes, pipe_cnt) * 1000; ++ wm_set->frac_urg_bw_nom = get_fraction_of_urgent_bandwidth(dml, pipes, pipe_cnt) * 1000; ++ wm_set->frac_urg_bw_flip = get_fraction_of_urgent_bandwidth_imm_flip(dml, pipes, pipe_cnt) * 1000; ++ wm_set->urgent_latency_ns = get_urgent_latency(dml, pipes, pipe_cnt) * 1000; ++ dml->soc.dram_clock_change_latency_us = dram_clock_change_latency_cached; ++ ++} ++ ++static void dcn301_calculate_wm_and_dlg( ++ struct dc *dc, struct dc_state *context, ++ display_e2e_pipe_params_st *pipes, ++ int pipe_cnt, ++ int vlevel_req) ++{ ++ int i, pipe_idx; ++ int vlevel, vlevel_max; ++ struct wm_range_table_entry *table_entry; ++ struct clk_bw_params *bw_params = dc->clk_mgr->bw_params; ++ ++ ASSERT(bw_params); ++ ++ vlevel_max = bw_params->clk_table.num_entries - 1; ++ ++ /* WM Set D */ ++ table_entry = &bw_params->wm_table.entries[WM_D]; ++ if (table_entry->wm_type == WM_TYPE_RETRAINING) ++ vlevel = 0; ++ else ++ vlevel = vlevel_max; ++ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.d, ++ &context->bw_ctx.dml, pipes, pipe_cnt); ++ /* WM Set C */ ++ table_entry = &bw_params->wm_table.entries[WM_C]; ++ vlevel = min(max(vlevel_req, 2), vlevel_max); ++ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.c, ++ &context->bw_ctx.dml, pipes, pipe_cnt); ++ /* WM Set B */ ++ table_entry = &bw_params->wm_table.entries[WM_B]; ++ vlevel = min(max(vlevel_req, 1), vlevel_max); ++ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.b, ++ &context->bw_ctx.dml, pipes, pipe_cnt); ++ ++ /* WM Set A */ ++ table_entry = &bw_params->wm_table.entries[WM_A]; ++ vlevel = min(vlevel_req, vlevel_max); ++ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.a, ++ &context->bw_ctx.dml, pipes, pipe_cnt); ++ ++ for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) { ++ if (!context->res_ctx.pipe_ctx[i].stream) ++ continue; ++ ++ pipes[pipe_idx].clks_cfg.dispclk_mhz = get_dispclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt); ++ pipes[pipe_idx].clks_cfg.dppclk_mhz = get_dppclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx); ++ ++ if (dc->config.forced_clocks) { ++ pipes[pipe_idx].clks_cfg.dispclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dispclk_mhz; ++ pipes[pipe_idx].clks_cfg.dppclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dppclk_mhz; ++ } ++ if (dc->debug.min_disp_clk_khz > pipes[pipe_idx].clks_cfg.dispclk_mhz * 1000) ++ pipes[pipe_idx].clks_cfg.dispclk_mhz = dc->debug.min_disp_clk_khz / 1000.0; ++ if (dc->debug.min_dpp_clk_khz > pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000) ++ pipes[pipe_idx].clks_cfg.dppclk_mhz = dc->debug.min_dpp_clk_khz / 1000.0; ++ ++ pipe_idx++; ++ } ++ ++ dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel); ++} ++ + static struct resource_funcs dcn301_res_pool_funcs = { + .destroy = dcn301_destroy_resource_pool, + .link_enc_create = dcn301_link_encoder_create, + .panel_cntl_create = dcn301_panel_cntl_create, + .validate_bandwidth = dcn30_validate_bandwidth, +- .calculate_wm_and_dlg = dcn30_calculate_wm_and_dlg, ++ .calculate_wm_and_dlg = dcn301_calculate_wm_and_dlg, + .populate_dml_pipes = dcn30_populate_dml_pipes_from_context, + .acquire_idle_pipe_for_layer = dcn20_acquire_idle_pipe_for_layer, + .add_stream_to_ctx = dcn30_add_stream_to_ctx, +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h b/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h +index 22f3f643ed1b8..346dcd87dc106 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h +@@ -191,6 +191,8 @@ struct hubp_funcs { + bool (*hubp_in_blank)(struct hubp *hubp); + void (*hubp_soft_reset)(struct hubp *hubp, bool reset); + ++ void (*hubp_set_flip_int)(struct hubp *hubp); ++ + }; + + #endif +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +index d7794370cb5a1..72cb67d50e4ae 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +@@ -587,6 +587,48 @@ static int smu7_force_switch_to_arbf0(struct pp_hwmgr *hwmgr) + tmp, MC_CG_ARB_FREQ_F0); + } + ++static uint16_t smu7_override_pcie_speed(struct pp_hwmgr *hwmgr) ++{ ++ struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); ++ uint16_t pcie_gen = 0; ++ ++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4 && ++ adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN4) ++ pcie_gen = 3; ++ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3 && ++ adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3) ++ pcie_gen = 2; ++ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 && ++ adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2) ++ pcie_gen = 1; ++ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1 && ++ adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1) ++ pcie_gen = 0; ++ ++ return pcie_gen; ++} ++ ++static uint16_t smu7_override_pcie_width(struct pp_hwmgr *hwmgr) ++{ ++ struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); ++ uint16_t pcie_width = 0; ++ ++ if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X16) ++ pcie_width = 16; ++ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X12) ++ pcie_width = 12; ++ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X8) ++ pcie_width = 8; ++ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X4) ++ pcie_width = 4; ++ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X2) ++ pcie_width = 2; ++ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X1) ++ pcie_width = 1; ++ ++ return pcie_width; ++} ++ + static int smu7_setup_default_pcie_table(struct pp_hwmgr *hwmgr) + { + struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend); +@@ -683,6 +725,11 @@ static int smu7_setup_default_pcie_table(struct pp_hwmgr *hwmgr) + PP_Min_PCIEGen), + get_pcie_lane_support(data->pcie_lane_cap, + PP_Max_PCIELane)); ++ ++ if (data->pcie_dpm_key_disabled) ++ phm_setup_pcie_table_entry(&data->dpm_table.pcie_speed_table, ++ data->dpm_table.pcie_speed_table.count, ++ smu7_override_pcie_speed(hwmgr), smu7_override_pcie_width(hwmgr)); + } + return 0; + } +@@ -1248,6 +1295,13 @@ static int smu7_start_dpm(struct pp_hwmgr *hwmgr) + NULL)), + "Failed to enable pcie DPM during DPM Start Function!", + return -EINVAL); ++ } else { ++ PP_ASSERT_WITH_CODE( ++ (0 == smum_send_msg_to_smc(hwmgr, ++ PPSMC_MSG_PCIeDPM_Disable, ++ NULL)), ++ "Failed to disble pcie DPM during DPM Start Function!", ++ return -EINVAL); + } + + if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps, +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +index c7a01ea9ed647..892f08f2ba429 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +@@ -54,6 +54,9 @@ + #include "smuio/smuio_9_0_offset.h" + #include "smuio/smuio_9_0_sh_mask.h" + ++#define smnPCIE_LC_SPEED_CNTL 0x11140290 ++#define smnPCIE_LC_LINK_WIDTH_CNTL 0x11140288 ++ + #define HBM_MEMORY_CHANNEL_WIDTH 128 + + static const uint32_t channel_number[] = {1, 2, 0, 4, 0, 8, 0, 16, 2}; +@@ -443,8 +446,7 @@ static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr) + if (PP_CAP(PHM_PlatformCaps_VCEDPM)) + data->smu_features[GNLD_DPM_VCE].supported = true; + +- if (!data->registry_data.pcie_dpm_key_disabled) +- data->smu_features[GNLD_DPM_LINK].supported = true; ++ data->smu_features[GNLD_DPM_LINK].supported = true; + + if (!data->registry_data.dcefclk_dpm_key_disabled) + data->smu_features[GNLD_DPM_DCEFCLK].supported = true; +@@ -1545,6 +1547,13 @@ static int vega10_override_pcie_parameters(struct pp_hwmgr *hwmgr) + pp_table->PcieLaneCount[i] = pcie_width; + } + ++ if (data->registry_data.pcie_dpm_key_disabled) { ++ for (i = 0; i < NUM_LINK_LEVELS; i++) { ++ pp_table->PcieGenSpeed[i] = pcie_gen; ++ pp_table->PcieLaneCount[i] = pcie_width; ++ } ++ } ++ + return 0; + } + +@@ -2967,6 +2976,14 @@ static int vega10_start_dpm(struct pp_hwmgr *hwmgr, uint32_t bitmap) + } + } + ++ if (data->registry_data.pcie_dpm_key_disabled) { ++ PP_ASSERT_WITH_CODE(!vega10_enable_smc_features(hwmgr, ++ false, data->smu_features[GNLD_DPM_LINK].smu_feature_bitmap), ++ "Attempt to Disable Link DPM feature Failed!", return -EINVAL); ++ data->smu_features[GNLD_DPM_LINK].enabled = false; ++ data->smu_features[GNLD_DPM_LINK].supported = false; ++ } ++ + return 0; + } + +@@ -4585,6 +4602,24 @@ static int vega10_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe + return 0; + } + ++static int vega10_get_current_pcie_link_width_level(struct pp_hwmgr *hwmgr) ++{ ++ struct amdgpu_device *adev = hwmgr->adev; ++ ++ return (RREG32_PCIE(smnPCIE_LC_LINK_WIDTH_CNTL) & ++ PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK) ++ >> PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT; ++} ++ ++static int vega10_get_current_pcie_link_speed_level(struct pp_hwmgr *hwmgr) ++{ ++ struct amdgpu_device *adev = hwmgr->adev; ++ ++ return (RREG32_PCIE(smnPCIE_LC_SPEED_CNTL) & ++ PSWUSP0_PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK) ++ >> PSWUSP0_PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT; ++} ++ + static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, + enum pp_clock_type type, char *buf) + { +@@ -4593,8 +4628,9 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, + struct vega10_single_dpm_table *mclk_table = &(data->dpm_table.mem_table); + struct vega10_single_dpm_table *soc_table = &(data->dpm_table.soc_table); + struct vega10_single_dpm_table *dcef_table = &(data->dpm_table.dcef_table); +- struct vega10_pcie_table *pcie_table = &(data->dpm_table.pcie_table); + struct vega10_odn_clock_voltage_dependency_table *podn_vdd_dep = NULL; ++ uint32_t gen_speed, lane_width, current_gen_speed, current_lane_width; ++ PPTable_t *pptable = &(data->smc_state_table.pp_table); + + int i, now, size = 0, count = 0; + +@@ -4651,15 +4687,31 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, + "*" : ""); + break; + case PP_PCIE: +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentLinkIndex, &now); +- +- for (i = 0; i < pcie_table->count; i++) +- size += sprintf(buf + size, "%d: %s %s\n", i, +- (pcie_table->pcie_gen[i] == 0) ? "2.5GT/s, x1" : +- (pcie_table->pcie_gen[i] == 1) ? "5.0GT/s, x16" : +- (pcie_table->pcie_gen[i] == 2) ? "8.0GT/s, x16" : "", +- (i == now) ? "*" : ""); ++ current_gen_speed = ++ vega10_get_current_pcie_link_speed_level(hwmgr); ++ current_lane_width = ++ vega10_get_current_pcie_link_width_level(hwmgr); ++ for (i = 0; i < NUM_LINK_LEVELS; i++) { ++ gen_speed = pptable->PcieGenSpeed[i]; ++ lane_width = pptable->PcieLaneCount[i]; ++ ++ size += sprintf(buf + size, "%d: %s %s %s\n", i, ++ (gen_speed == 0) ? "2.5GT/s," : ++ (gen_speed == 1) ? "5.0GT/s," : ++ (gen_speed == 2) ? "8.0GT/s," : ++ (gen_speed == 3) ? "16.0GT/s," : "", ++ (lane_width == 1) ? "x1" : ++ (lane_width == 2) ? "x2" : ++ (lane_width == 3) ? "x4" : ++ (lane_width == 4) ? "x8" : ++ (lane_width == 5) ? "x12" : ++ (lane_width == 6) ? "x16" : "", ++ (current_gen_speed == gen_speed) && ++ (current_lane_width == lane_width) ? ++ "*" : ""); ++ } + break; ++ + case OD_SCLK: + if (hwmgr->od_enabled) { + size = sprintf(buf, "%s:\n", "OD_SCLK"); +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c +index 62076035029ac..e68651fb7ca4c 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c +@@ -133,6 +133,7 @@ static void vega12_set_default_registry_data(struct pp_hwmgr *hwmgr) + data->registry_data.auto_wattman_debug = 0; + data->registry_data.auto_wattman_sample_period = 100; + data->registry_data.auto_wattman_threshold = 50; ++ data->registry_data.pcie_dpm_key_disabled = !(hwmgr->feature_mask & PP_PCIE_DPM_MASK); + } + + static int vega12_set_features_platform_caps(struct pp_hwmgr *hwmgr) +@@ -539,6 +540,29 @@ static int vega12_override_pcie_parameters(struct pp_hwmgr *hwmgr) + pp_table->PcieLaneCount[i] = pcie_width_arg; + } + ++ /* override to the highest if it's disabled from ppfeaturmask */ ++ if (data->registry_data.pcie_dpm_key_disabled) { ++ for (i = 0; i < NUM_LINK_LEVELS; i++) { ++ smu_pcie_arg = (i << 16) | (pcie_gen << 8) | pcie_width; ++ ret = smum_send_msg_to_smc_with_parameter(hwmgr, ++ PPSMC_MSG_OverridePcieParameters, smu_pcie_arg, ++ NULL); ++ PP_ASSERT_WITH_CODE(!ret, ++ "[OverridePcieParameters] Attempt to override pcie params failed!", ++ return ret); ++ ++ pp_table->PcieGenSpeed[i] = pcie_gen; ++ pp_table->PcieLaneCount[i] = pcie_width; ++ } ++ ret = vega12_enable_smc_features(hwmgr, ++ false, ++ data->smu_features[GNLD_DPM_LINK].smu_feature_bitmap); ++ PP_ASSERT_WITH_CODE(!ret, ++ "Attempt to Disable DPM LINK Failed!", ++ return ret); ++ data->smu_features[GNLD_DPM_LINK].enabled = false; ++ data->smu_features[GNLD_DPM_LINK].supported = false; ++ } + return 0; + } + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +index 251979c059c8b..60cde0c528257 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +@@ -171,6 +171,7 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr) + data->registry_data.gfxoff_controlled_by_driver = 1; + data->gfxoff_allowed = false; + data->counter_gfxoff = 0; ++ data->registry_data.pcie_dpm_key_disabled = !(hwmgr->feature_mask & PP_PCIE_DPM_MASK); + } + + static int vega20_set_features_platform_caps(struct pp_hwmgr *hwmgr) +@@ -885,6 +886,30 @@ static int vega20_override_pcie_parameters(struct pp_hwmgr *hwmgr) + pp_table->PcieLaneCount[i] = pcie_width_arg; + } + ++ /* override to the highest if it's disabled from ppfeaturmask */ ++ if (data->registry_data.pcie_dpm_key_disabled) { ++ for (i = 0; i < NUM_LINK_LEVELS; i++) { ++ smu_pcie_arg = (i << 16) | (pcie_gen << 8) | pcie_width; ++ ret = smum_send_msg_to_smc_with_parameter(hwmgr, ++ PPSMC_MSG_OverridePcieParameters, smu_pcie_arg, ++ NULL); ++ PP_ASSERT_WITH_CODE(!ret, ++ "[OverridePcieParameters] Attempt to override pcie params failed!", ++ return ret); ++ ++ pp_table->PcieGenSpeed[i] = pcie_gen; ++ pp_table->PcieLaneCount[i] = pcie_width; ++ } ++ ret = vega20_enable_smc_features(hwmgr, ++ false, ++ data->smu_features[GNLD_DPM_LINK].smu_feature_bitmap); ++ PP_ASSERT_WITH_CODE(!ret, ++ "Attempt to Disable DPM LINK Failed!", ++ return ret); ++ data->smu_features[GNLD_DPM_LINK].enabled = false; ++ data->smu_features[GNLD_DPM_LINK].supported = false; ++ } ++ + return 0; + } + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index 6d38c5c17f23e..a9e696d05b33d 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -689,7 +689,7 @@ static int etnaviv_gem_userptr_get_pages(struct etnaviv_gem_object *etnaviv_obj) + struct page **pages = pvec + pinned; + + ret = pin_user_pages_fast(ptr, num_pages, +- !userptr->ro ? FOLL_WRITE : 0, pages); ++ FOLL_WRITE | FOLL_FORCE, pages); + if (ret < 0) { + unpin_user_pages(pvec, pinned); + kvfree(pvec); +diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.c b/drivers/gpu/drm/i915/display/intel_vdsc.c +index e2716a67b2816..d017d341c5934 100644 +--- a/drivers/gpu/drm/i915/display/intel_vdsc.c ++++ b/drivers/gpu/drm/i915/display/intel_vdsc.c +@@ -1016,20 +1016,14 @@ static i915_reg_t dss_ctl1_reg(const struct intel_crtc_state *crtc_state) + { + enum pipe pipe = to_intel_crtc(crtc_state->uapi.crtc)->pipe; + +- if (crtc_state->cpu_transcoder == TRANSCODER_EDP) +- return DSS_CTL1; +- +- return ICL_PIPE_DSS_CTL1(pipe); ++ return is_pipe_dsc(crtc_state) ? ICL_PIPE_DSS_CTL1(pipe) : DSS_CTL1; + } + + static i915_reg_t dss_ctl2_reg(const struct intel_crtc_state *crtc_state) + { + enum pipe pipe = to_intel_crtc(crtc_state->uapi.crtc)->pipe; + +- if (crtc_state->cpu_transcoder == TRANSCODER_EDP) +- return DSS_CTL2; +- +- return ICL_PIPE_DSS_CTL2(pipe); ++ return is_pipe_dsc(crtc_state) ? ICL_PIPE_DSS_CTL2(pipe) : DSS_CTL2; + } + + void intel_dsc_enable(struct intel_encoder *encoder, +diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +index 7fb36b12fe7a2..6614f67364862 100644 +--- a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c ++++ b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +@@ -316,7 +316,18 @@ void i915_vma_revoke_fence(struct i915_vma *vma) + WRITE_ONCE(fence->vma, NULL); + vma->fence = NULL; + +- with_intel_runtime_pm_if_in_use(fence_to_uncore(fence)->rpm, wakeref) ++ /* ++ * Skip the write to HW if and only if the device is currently ++ * suspended. ++ * ++ * If the driver does not currently hold a wakeref (if_in_use == 0), ++ * the device may currently be runtime suspended, or it may be woken ++ * up before the suspend takes place. If the device is not suspended ++ * (powered down) and we skip clearing the fence register, the HW is ++ * left in an undefined state where we may end up with multiple ++ * registers overlapping. ++ */ ++ with_intel_runtime_pm_if_active(fence_to_uncore(fence)->rpm, wakeref) + fence_write(fence); + } + +diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c +index 153ca9e65382e..8b725efb2254c 100644 +--- a/drivers/gpu/drm/i915/intel_runtime_pm.c ++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c +@@ -412,12 +412,20 @@ intel_wakeref_t intel_runtime_pm_get(struct intel_runtime_pm *rpm) + } + + /** +- * intel_runtime_pm_get_if_in_use - grab a runtime pm reference if device in use ++ * __intel_runtime_pm_get_if_active - grab a runtime pm reference if device is active + * @rpm: the intel_runtime_pm structure ++ * @ignore_usecount: get a ref even if dev->power.usage_count is 0 + * + * This function grabs a device-level runtime pm reference if the device is +- * already in use and ensures that it is powered up. It is illegal to try +- * and access the HW should intel_runtime_pm_get_if_in_use() report failure. ++ * already active and ensures that it is powered up. It is illegal to try ++ * and access the HW should intel_runtime_pm_get_if_active() report failure. ++ * ++ * If @ignore_usecount=true, a reference will be acquired even if there is no ++ * user requiring the device to be powered up (dev->power.usage_count == 0). ++ * If the function returns false in this case then it's guaranteed that the ++ * device's runtime suspend hook has been called already or that it will be ++ * called (and hence it's also guaranteed that the device's runtime resume ++ * hook will be called eventually). + * + * Any runtime pm reference obtained by this function must have a symmetric + * call to intel_runtime_pm_put() to release the reference again. +@@ -425,7 +433,8 @@ intel_wakeref_t intel_runtime_pm_get(struct intel_runtime_pm *rpm) + * Returns: the wakeref cookie to pass to intel_runtime_pm_put(), evaluates + * as True if the wakeref was acquired, or False otherwise. + */ +-intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm) ++static intel_wakeref_t __intel_runtime_pm_get_if_active(struct intel_runtime_pm *rpm, ++ bool ignore_usecount) + { + if (IS_ENABLED(CONFIG_PM)) { + /* +@@ -434,7 +443,7 @@ intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm) + * function, since the power state is undefined. This applies + * atm to the late/early system suspend/resume handlers. + */ +- if (pm_runtime_get_if_in_use(rpm->kdev) <= 0) ++ if (pm_runtime_get_if_active(rpm->kdev, ignore_usecount) <= 0) + return 0; + } + +@@ -443,6 +452,16 @@ intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm) + return track_intel_runtime_pm_wakeref(rpm); + } + ++intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm) ++{ ++ return __intel_runtime_pm_get_if_active(rpm, false); ++} ++ ++intel_wakeref_t intel_runtime_pm_get_if_active(struct intel_runtime_pm *rpm) ++{ ++ return __intel_runtime_pm_get_if_active(rpm, true); ++} ++ + /** + * intel_runtime_pm_get_noresume - grab a runtime pm reference + * @rpm: the intel_runtime_pm structure +diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.h b/drivers/gpu/drm/i915/intel_runtime_pm.h +index ae64ff14c6425..1e4ddd11c12bb 100644 +--- a/drivers/gpu/drm/i915/intel_runtime_pm.h ++++ b/drivers/gpu/drm/i915/intel_runtime_pm.h +@@ -177,6 +177,7 @@ void intel_runtime_pm_driver_release(struct intel_runtime_pm *rpm); + + intel_wakeref_t intel_runtime_pm_get(struct intel_runtime_pm *rpm); + intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm); ++intel_wakeref_t intel_runtime_pm_get_if_active(struct intel_runtime_pm *rpm); + intel_wakeref_t intel_runtime_pm_get_noresume(struct intel_runtime_pm *rpm); + intel_wakeref_t intel_runtime_pm_get_raw(struct intel_runtime_pm *rpm); + +@@ -188,6 +189,10 @@ intel_wakeref_t intel_runtime_pm_get_raw(struct intel_runtime_pm *rpm); + for ((wf) = intel_runtime_pm_get_if_in_use(rpm); (wf); \ + intel_runtime_pm_put((rpm), (wf)), (wf) = 0) + ++#define with_intel_runtime_pm_if_active(rpm, wf) \ ++ for ((wf) = intel_runtime_pm_get_if_active(rpm); (wf); \ ++ intel_runtime_pm_put((rpm), (wf)), (wf) = 0) ++ + void intel_runtime_pm_put_unchecked(struct intel_runtime_pm *rpm); + #if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM) + void intel_runtime_pm_put(struct intel_runtime_pm *rpm, intel_wakeref_t wref); +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c +index a45fe95aff494..3dc65877fa10d 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c +@@ -163,7 +163,7 @@ struct msm_dsi_pll *msm_dsi_pll_init(struct platform_device *pdev, + break; + case MSM_DSI_PHY_7NM: + case MSM_DSI_PHY_7NM_V4_1: +- pll = msm_dsi_pll_7nm_init(pdev, id); ++ pll = msm_dsi_pll_7nm_init(pdev, type, id); + break; + default: + pll = ERR_PTR(-ENXIO); +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h +index 3405982a092c4..bbecb1de5678e 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h +@@ -117,10 +117,12 @@ msm_dsi_pll_10nm_init(struct platform_device *pdev, int id) + } + #endif + #ifdef CONFIG_DRM_MSM_DSI_7NM_PHY +-struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id); ++struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, ++ enum msm_dsi_phy_type type, int id); + #else + static inline struct msm_dsi_pll * +-msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) ++msm_dsi_pll_7nm_init(struct platform_device *pdev, ++ enum msm_dsi_phy_type type, int id) + { + return ERR_PTR(-ENODEV); + } +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c +index 93bf142e4a4e6..c1f6708367ae9 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c +@@ -852,7 +852,8 @@ err_base_clk_hw: + return ret; + } + +-struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) ++struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, ++ enum msm_dsi_phy_type type, int id) + { + struct dsi_pll_7nm *pll_7nm; + struct msm_dsi_pll *pll; +@@ -885,7 +886,7 @@ struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) + pll = &pll_7nm->base; + pll->min_rate = 1000000000UL; + pll->max_rate = 3500000000UL; +- if (pll->type == MSM_DSI_PHY_7NM_V4_1) { ++ if (type == MSM_DSI_PHY_7NM_V4_1) { + pll->min_rate = 600000000UL; + pll->max_rate = (unsigned long)5000000000ULL; + /* workaround for max rate overflowing on 32-bit builds: */ +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 94525ac76d4e6..a5c6b8c233366 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -1072,6 +1072,10 @@ static int __maybe_unused msm_pm_resume(struct device *dev) + static int __maybe_unused msm_pm_prepare(struct device *dev) + { + struct drm_device *ddev = dev_get_drvdata(dev); ++ struct msm_drm_private *priv = ddev ? ddev->dev_private : NULL; ++ ++ if (!priv || !priv->kms) ++ return 0; + + return drm_mode_config_helper_suspend(ddev); + } +@@ -1079,6 +1083,10 @@ static int __maybe_unused msm_pm_prepare(struct device *dev) + static void __maybe_unused msm_pm_complete(struct device *dev) + { + struct drm_device *ddev = dev_get_drvdata(dev); ++ struct msm_drm_private *priv = ddev ? ddev->dev_private : NULL; ++ ++ if (!priv || !priv->kms) ++ return; + + drm_mode_config_helper_resume(ddev); + } +@@ -1311,6 +1319,10 @@ static int msm_pdev_remove(struct platform_device *pdev) + static void msm_pdev_shutdown(struct platform_device *pdev) + { + struct drm_device *drm = platform_get_drvdata(pdev); ++ struct msm_drm_private *priv = drm ? drm->dev_private : NULL; ++ ++ if (!priv || !priv->kms) ++ return; + + drm_atomic_helper_shutdown(drm); + } +diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c +index 5f4f09a601d4c..f601e91241ac8 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c +@@ -2663,9 +2663,20 @@ nv50_display_create(struct drm_device *dev) + else + nouveau_display(dev)->format_modifiers = disp50xx_modifiers; + +- if (disp->disp->object.oclass >= GK104_DISP) { ++ /* FIXME: 256x256 cursors are supported on Kepler, however unlike Maxwell and later ++ * generations Kepler requires that we use small pages (4K) for cursor scanout surfaces. The ++ * proper fix for this is to teach nouveau to migrate fbs being used for the cursor plane to ++ * small page allocations in prepare_fb(). When this is implemented, we should also force ++ * large pages (128K) for ovly fbs in order to fix Kepler ovlys. ++ * But until then, just limit cursors to 128x128 - which is small enough to avoid ever using ++ * large pages. ++ */ ++ if (disp->disp->object.oclass >= GM107_DISP) { + dev->mode_config.cursor_width = 256; + dev->mode_config.cursor_height = 256; ++ } else if (disp->disp->object.oclass >= GK104_DISP) { ++ dev->mode_config.cursor_width = 128; ++ dev->mode_config.cursor_height = 128; + } else { + dev->mode_config.cursor_width = 64; + dev->mode_config.cursor_height = 64; +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 8769e7aa097f4..81903749d2415 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -3610,13 +3610,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) + ep->com.local_addr.ss_family == AF_INET) { + err = cxgb4_remove_server_filter( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], false); + } else { + struct sockaddr_in6 *sin6; + c4iw_init_wr_wait(ep->com.wr_waitp); + err = cxgb4_remove_server( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], true); + if (err) + goto done; + err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp, +diff --git a/drivers/irqchip/irq-ingenic-tcu.c b/drivers/irqchip/irq-ingenic-tcu.c +index 7a7222d4c19c0..b938d1d04d96e 100644 +--- a/drivers/irqchip/irq-ingenic-tcu.c ++++ b/drivers/irqchip/irq-ingenic-tcu.c +@@ -179,5 +179,6 @@ err_free_tcu: + } + IRQCHIP_DECLARE(jz4740_tcu_irq, "ingenic,jz4740-tcu", ingenic_tcu_irq_init); + IRQCHIP_DECLARE(jz4725b_tcu_irq, "ingenic,jz4725b-tcu", ingenic_tcu_irq_init); ++IRQCHIP_DECLARE(jz4760_tcu_irq, "ingenic,jz4760-tcu", ingenic_tcu_irq_init); + IRQCHIP_DECLARE(jz4770_tcu_irq, "ingenic,jz4770-tcu", ingenic_tcu_irq_init); + IRQCHIP_DECLARE(x1000_tcu_irq, "ingenic,x1000-tcu", ingenic_tcu_irq_init); +diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c +index b61a8901ef722..ea36bb00be80b 100644 +--- a/drivers/irqchip/irq-ingenic.c ++++ b/drivers/irqchip/irq-ingenic.c +@@ -155,6 +155,7 @@ static int __init intc_2chip_of_init(struct device_node *node, + { + return ingenic_intc_of_init(node, 2); + } ++IRQCHIP_DECLARE(jz4760_intc, "ingenic,jz4760-intc", intc_2chip_of_init); + IRQCHIP_DECLARE(jz4770_intc, "ingenic,jz4770-intc", intc_2chip_of_init); + IRQCHIP_DECLARE(jz4775_intc, "ingenic,jz4775-intc", intc_2chip_of_init); + IRQCHIP_DECLARE(jz4780_intc, "ingenic,jz4780-intc", intc_2chip_of_init); +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index 5e306bba43751..1ca65b434f1fa 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -529,7 +529,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_ + * Grab our output buffer. + */ + nl = orig_nl = get_result_buffer(param, param_size, &len); +- if (len < needed) { ++ if (len < needed || len < sizeof(nl->dev)) { + param->flags |= DM_BUFFER_FULL_FLAG; + goto out; + } +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 77086db8b9200..7291fd3106ffb 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -1380,6 +1380,13 @@ static int device_not_zoned_model(struct dm_target *ti, struct dm_dev *dev, + return !q || blk_queue_zoned_model(q) != *zoned_model; + } + ++/* ++ * Check the device zoned model based on the target feature flag. If the target ++ * has the DM_TARGET_ZONED_HM feature flag set, host-managed zoned devices are ++ * also accepted but all devices must have the same zoned model. If the target ++ * has the DM_TARGET_MIXED_ZONED_MODEL feature set, the devices can have any ++ * zoned model with all zoned devices having the same zone size. ++ */ + static bool dm_table_supports_zoned_model(struct dm_table *t, + enum blk_zoned_model zoned_model) + { +@@ -1389,13 +1396,15 @@ static bool dm_table_supports_zoned_model(struct dm_table *t, + for (i = 0; i < dm_table_get_num_targets(t); i++) { + ti = dm_table_get_target(t, i); + +- if (zoned_model == BLK_ZONED_HM && +- !dm_target_supports_zoned_hm(ti->type)) +- return false; +- +- if (!ti->type->iterate_devices || +- ti->type->iterate_devices(ti, device_not_zoned_model, &zoned_model)) +- return false; ++ if (dm_target_supports_zoned_hm(ti->type)) { ++ if (!ti->type->iterate_devices || ++ ti->type->iterate_devices(ti, device_not_zoned_model, ++ &zoned_model)) ++ return false; ++ } else if (!dm_target_supports_mixed_zoned_model(ti->type)) { ++ if (zoned_model == BLK_ZONED_HM) ++ return false; ++ } + } + + return true; +@@ -1407,9 +1416,17 @@ static int device_not_matches_zone_sectors(struct dm_target *ti, struct dm_dev * + struct request_queue *q = bdev_get_queue(dev->bdev); + unsigned int *zone_sectors = data; + ++ if (!blk_queue_is_zoned(q)) ++ return 0; ++ + return !q || blk_queue_zone_sectors(q) != *zone_sectors; + } + ++/* ++ * Check consistency of zoned model and zone sectors across all targets. For ++ * zone sectors, if the destination device is a zoned block device, it shall ++ * have the specified zone_sectors. ++ */ + static int validate_hardware_zoned_model(struct dm_table *table, + enum blk_zoned_model zoned_model, + unsigned int zone_sectors) +@@ -1428,7 +1445,7 @@ static int validate_hardware_zoned_model(struct dm_table *table, + return -EINVAL; + + if (dm_table_any_dev_attr(table, device_not_matches_zone_sectors, &zone_sectors)) { +- DMERR("%s: zone sectors is not consistent across all devices", ++ DMERR("%s: zone sectors is not consistent across all zoned devices", + dm_device_name(table->md)); + return -EINVAL; + } +diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c +index 6b8e5bdd8526d..808a98ef624c3 100644 +--- a/drivers/md/dm-verity-target.c ++++ b/drivers/md/dm-verity-target.c +@@ -34,7 +34,7 @@ + #define DM_VERITY_OPT_IGN_ZEROES "ignore_zero_blocks" + #define DM_VERITY_OPT_AT_MOST_ONCE "check_at_most_once" + +-#define DM_VERITY_OPTS_MAX (2 + DM_VERITY_OPTS_FEC + \ ++#define DM_VERITY_OPTS_MAX (3 + DM_VERITY_OPTS_FEC + \ + DM_VERITY_ROOT_HASH_VERIFICATION_OPTS) + + static unsigned dm_verity_prefetch_cluster = DM_VERITY_DEFAULT_PREFETCH_SIZE; +diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c +index 697f9de37355e..7e88df64d197b 100644 +--- a/drivers/md/dm-zoned-target.c ++++ b/drivers/md/dm-zoned-target.c +@@ -1143,7 +1143,7 @@ static int dmz_message(struct dm_target *ti, unsigned int argc, char **argv, + static struct target_type dmz_type = { + .name = "zoned", + .version = {2, 0, 0}, +- .features = DM_TARGET_SINGLETON | DM_TARGET_ZONED_HM, ++ .features = DM_TARGET_SINGLETON | DM_TARGET_MIXED_ZONED_MODEL, + .module = THIS_MODULE, + .ctr = dmz_ctr, + .dtr = dmz_dtr, +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 6f03adc128495..09542eabf725a 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2016,7 +2016,10 @@ static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t, + if (size != dm_get_size(md)) + memset(&md->geometry, 0, sizeof(md->geometry)); + +- set_capacity_and_notify(md->disk, size); ++ if (!get_capacity(md->disk)) ++ set_capacity(md->disk, size); ++ else ++ set_capacity_and_notify(md->disk, size); + + dm_table_event_callback(t, event_callback, md); + +diff --git a/drivers/mfd/intel_quark_i2c_gpio.c b/drivers/mfd/intel_quark_i2c_gpio.c +index fe8ca945f3672..b67cb0a3ab053 100644 +--- a/drivers/mfd/intel_quark_i2c_gpio.c ++++ b/drivers/mfd/intel_quark_i2c_gpio.c +@@ -72,7 +72,8 @@ static const struct dmi_system_id dmi_platform_info[] = { + {} + }; + +-static const struct resource intel_quark_i2c_res[] = { ++/* This is used as a place holder and will be modified at run-time */ ++static struct resource intel_quark_i2c_res[] = { + [INTEL_QUARK_IORES_MEM] = { + .flags = IORESOURCE_MEM, + }, +@@ -85,7 +86,8 @@ static struct mfd_cell_acpi_match intel_quark_acpi_match_i2c = { + .adr = MFD_ACPI_MATCH_I2C, + }; + +-static const struct resource intel_quark_gpio_res[] = { ++/* This is used as a place holder and will be modified at run-time */ ++static struct resource intel_quark_gpio_res[] = { + [INTEL_QUARK_IORES_MEM] = { + .flags = IORESOURCE_MEM, + }, +diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c +index 69d04eca767f5..82c0306a9210a 100644 +--- a/drivers/misc/habanalabs/common/device.c ++++ b/drivers/misc/habanalabs/common/device.c +@@ -93,12 +93,19 @@ void hl_hpriv_put(struct hl_fpriv *hpriv) + static int hl_device_release(struct inode *inode, struct file *filp) + { + struct hl_fpriv *hpriv = filp->private_data; ++ struct hl_device *hdev = hpriv->hdev; ++ ++ filp->private_data = NULL; ++ ++ if (!hdev) { ++ pr_crit("Closing FD after device was removed. Memory leak will occur and it is advised to reboot.\n"); ++ put_pid(hpriv->taskpid); ++ return 0; ++ } + + hl_cb_mgr_fini(hpriv->hdev, &hpriv->cb_mgr); + hl_ctx_mgr_fini(hpriv->hdev, &hpriv->ctx_mgr); + +- filp->private_data = NULL; +- + hl_hpriv_put(hpriv); + + return 0; +@@ -107,15 +114,20 @@ static int hl_device_release(struct inode *inode, struct file *filp) + static int hl_device_release_ctrl(struct inode *inode, struct file *filp) + { + struct hl_fpriv *hpriv = filp->private_data; +- struct hl_device *hdev; ++ struct hl_device *hdev = hpriv->hdev; + + filp->private_data = NULL; + +- hdev = hpriv->hdev; ++ if (!hdev) { ++ pr_err("Closing FD after device was removed\n"); ++ goto out; ++ } + + mutex_lock(&hdev->fpriv_list_lock); + list_del(&hpriv->dev_node); + mutex_unlock(&hdev->fpriv_list_lock); ++out: ++ put_pid(hpriv->taskpid); + + kfree(hpriv); + +@@ -134,8 +146,14 @@ static int hl_device_release_ctrl(struct inode *inode, struct file *filp) + static int hl_mmap(struct file *filp, struct vm_area_struct *vma) + { + struct hl_fpriv *hpriv = filp->private_data; ++ struct hl_device *hdev = hpriv->hdev; + unsigned long vm_pgoff; + ++ if (!hdev) { ++ pr_err_ratelimited("Trying to mmap after device was removed! Please close FD\n"); ++ return -ENODEV; ++ } ++ + vm_pgoff = vma->vm_pgoff; + vma->vm_pgoff = HL_MMAP_OFFSET_VALUE_GET(vm_pgoff); + +@@ -882,6 +900,16 @@ wait_for_processes: + return -EBUSY; + } + ++static void device_disable_open_processes(struct hl_device *hdev) ++{ ++ struct hl_fpriv *hpriv; ++ ++ mutex_lock(&hdev->fpriv_list_lock); ++ list_for_each_entry(hpriv, &hdev->fpriv_list, dev_node) ++ hpriv->hdev = NULL; ++ mutex_unlock(&hdev->fpriv_list_lock); ++} ++ + /* + * hl_device_reset - reset the device + * +@@ -1536,8 +1564,10 @@ void hl_device_fini(struct hl_device *hdev) + HL_PENDING_RESET_LONG_SEC); + + rc = device_kill_open_processes(hdev, HL_PENDING_RESET_LONG_SEC); +- if (rc) ++ if (rc) { + dev_crit(hdev->dev, "Failed to kill all open processes\n"); ++ device_disable_open_processes(hdev); ++ } + + hl_cb_pool_fini(hdev); + +diff --git a/drivers/misc/habanalabs/common/habanalabs_ioctl.c b/drivers/misc/habanalabs/common/habanalabs_ioctl.c +index d25892d61ec9d..0805e1173d54e 100644 +--- a/drivers/misc/habanalabs/common/habanalabs_ioctl.c ++++ b/drivers/misc/habanalabs/common/habanalabs_ioctl.c +@@ -5,6 +5,8 @@ + * All Rights Reserved. + */ + ++#define pr_fmt(fmt) "habanalabs: " fmt ++ + #include + #include "habanalabs.h" + +@@ -667,6 +669,11 @@ long hl_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) + const struct hl_ioctl_desc *ioctl = NULL; + unsigned int nr = _IOC_NR(cmd); + ++ if (!hdev) { ++ pr_err_ratelimited("Sending ioctl after device was removed! Please close FD\n"); ++ return -ENODEV; ++ } ++ + if ((nr >= HL_COMMAND_START) && (nr < HL_COMMAND_END)) { + ioctl = &hl_ioctls[nr]; + } else { +@@ -685,6 +692,11 @@ long hl_ioctl_control(struct file *filep, unsigned int cmd, unsigned long arg) + const struct hl_ioctl_desc *ioctl = NULL; + unsigned int nr = _IOC_NR(cmd); + ++ if (!hdev) { ++ pr_err_ratelimited("Sending ioctl after device was removed! Please close FD\n"); ++ return -ENODEV; ++ } ++ + if (nr == _IOC_NR(HL_IOCTL_INFO)) { + ioctl = &hl_ioctls_control[nr]; + } else { +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 63f48b016ecd8..716d1a5bf17b7 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { + .brp_inc = 1, + }; + +-static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_enable(priv->device); +-} +- +-static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_disable(priv->device); +-} +- + static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv) + { + if (priv->device) +@@ -1335,7 +1323,6 @@ static const struct net_device_ops c_can_netdev_ops = { + + int register_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); + int err; + + /* Deactivate pins to prevent DRA7 DCAN IP from being +@@ -1345,28 +1332,19 @@ int register_c_can_dev(struct net_device *dev) + */ + pinctrl_pm_select_sleep_state(dev->dev.parent); + +- c_can_pm_runtime_enable(priv); +- + dev->flags |= IFF_ECHO; /* we support local echo */ + dev->netdev_ops = &c_can_netdev_ops; + + err = register_candev(dev); +- if (err) +- c_can_pm_runtime_disable(priv); +- else ++ if (!err) + devm_can_led_init(dev); +- + return err; + } + EXPORT_SYMBOL_GPL(register_c_can_dev); + + void unregister_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); +- + unregister_candev(dev); +- +- c_can_pm_runtime_disable(priv); + } + EXPORT_SYMBOL_GPL(unregister_c_can_dev); + +diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c +index 406b4847e5dc3..7efb60b508762 100644 +--- a/drivers/net/can/c_can/c_can_pci.c ++++ b/drivers/net/can/c_can/c_can_pci.c +@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) + { + struct net_device *dev = pci_get_drvdata(pdev); + struct c_can_priv *priv = netdev_priv(dev); ++ void __iomem *addr = priv->base; + + unregister_c_can_dev(dev); + + free_c_can_dev(dev); + +- pci_iounmap(pdev, priv->base); ++ pci_iounmap(pdev, addr); + pci_disable_msi(pdev); + pci_clear_master(pdev); + pci_release_regions(pdev); +diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c +index 05f425ceb53a2..47b251b1607ce 100644 +--- a/drivers/net/can/c_can/c_can_platform.c ++++ b/drivers/net/can/c_can/c_can_platform.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -386,6 +387,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, dev); + SET_NETDEV_DEV(dev, &pdev->dev); + ++ pm_runtime_enable(priv->device); + ret = register_c_can_dev(dev); + if (ret) { + dev_err(&pdev->dev, "registering %s failed (err=%d)\n", +@@ -398,6 +400,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + return 0; + + exit_free_device: ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + exit: + dev_err(&pdev->dev, "probe failed\n"); +@@ -408,9 +411,10 @@ exit: + static int c_can_plat_remove(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); ++ struct c_can_priv *priv = netdev_priv(dev); + + unregister_c_can_dev(dev); +- ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + + return 0; +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index c73e2a65c9044..2a4f12c3c28b0 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -1255,6 +1255,7 @@ static void can_dellink(struct net_device *dev, struct list_head *head) + + static struct rtnl_link_ops can_link_ops __read_mostly = { + .kind = "can", ++ .netns_refund = true, + .maxtype = IFLA_CAN_MAX, + .policy = can_policy, + .setup = can_setup, +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 2893297555eba..a9502fbc6dd67 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -697,9 +697,15 @@ static int flexcan_chip_disable(struct flexcan_priv *priv) + static int flexcan_chip_freeze(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate; ++ unsigned int timeout; ++ u32 bitrate = priv->can.bittiming.bitrate; + u32 reg; + ++ if (bitrate) ++ timeout = 1000 * 1000 * 10 / bitrate; ++ else ++ timeout = FLEXCAN_TIMEOUT_US / 10; ++ + reg = priv->read(®s->mcr); + reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT; + priv->write(reg, ®s->mcr); +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 969cedb9b0b60..0d77c60f775e5 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -57,6 +57,7 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices"); + #define KVASER_PCIEFD_KCAN_STAT_REG 0x418 + #define KVASER_PCIEFD_KCAN_MODE_REG 0x41c + #define KVASER_PCIEFD_KCAN_BTRN_REG 0x420 ++#define KVASER_PCIEFD_KCAN_BUS_LOAD_REG 0x424 + #define KVASER_PCIEFD_KCAN_BTRD_REG 0x428 + #define KVASER_PCIEFD_KCAN_PWM_REG 0x430 + /* Loopback control register */ +@@ -949,6 +950,9 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie) + timer_setup(&can->bec_poll_timer, kvaser_pciefd_bec_poll_timer, + 0); + ++ /* Disable Bus load reporting */ ++ iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_BUS_LOAD_REG); ++ + tx_npackets = ioread32(can->reg_base + + KVASER_PCIEFD_KCAN_TX_NPACKETS_REG); + if (((tx_npackets >> KVASER_PCIEFD_KCAN_TX_NPACKETS_MAX_SHIFT) & +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index da551fd0f5026..44b3f4b3aea5c 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -501,9 +501,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) + } + + while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) { +- if (rxfs & RXFS_RFL) +- netdev_warn(dev, "Rx FIFO 0 Message Lost\n"); +- + m_can_read_fifo(dev, rxfs); + + quota--; +@@ -876,7 +873,7 @@ static int m_can_rx_peripheral(struct net_device *dev) + { + struct m_can_classdev *cdev = netdev_priv(dev); + +- m_can_rx_handler(dev, 1); ++ m_can_rx_handler(dev, M_CAN_NAPI_WEIGHT); + + m_can_enable_all_interrupts(cdev); + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index f504b6858ed29..52100d4fe5a25 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -1070,13 +1070,6 @@ static int b53_setup(struct dsa_switch *ds) + b53_disable_port(ds, port); + } + +- /* Let DSA handle the case were multiple bridges span the same switch +- * device and different VLAN awareness settings are requested, which +- * would be breaking filtering semantics for any of the other bridge +- * devices. (not hardware supported) +- */ +- ds->vlan_filtering_is_global = true; +- + return b53_setup_devlink_resources(ds); + } + +@@ -2627,6 +2620,13 @@ struct b53_device *b53_switch_alloc(struct device *base, + ds->configure_vlan_while_not_filtering = true; + ds->untag_bridge_pvid = true; + dev->vlan_enabled = ds->configure_vlan_while_not_filtering; ++ /* Let DSA handle the case were multiple bridges span the same switch ++ * device and different VLAN awareness settings are requested, which ++ * would be breaking filtering semantics for any of the other bridge ++ * devices. (not hardware supported) ++ */ ++ ds->vlan_filtering_is_global = true; ++ + mutex_init(&dev->reg_mutex); + mutex_init(&dev->stats_mutex); + +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index edb0a1027b38f..510324916e916 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -584,8 +584,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port) + * in bits 15:8 and the patch level in bits 7:0 which is exactly what + * the REG_PHY_REVISION register layout is. + */ +- +- return priv->hw_params.gphy_rev; ++ if (priv->int_phy_mask & BIT(port)) ++ return priv->hw_params.gphy_rev; ++ else ++ return 0; + } + + static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port, +diff --git a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c +index 1b7e8c91b5417..423d6d78d15c7 100644 +--- a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c ++++ b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c +@@ -727,7 +727,7 @@ static int chcr_ktls_cpl_set_tcb_rpl(struct adapter *adap, unsigned char *input) + kvfree(tx_info); + return 0; + } +- tx_info->open_state = false; ++ tx_info->open_state = CH_KTLS_OPEN_SUCCESS; + spin_unlock(&tx_info->lock); + + complete(&tx_info->completion); +diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c +index a95e95ce94386..252adfa5d837b 100644 +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -1507,7 +1507,7 @@ dm9000_probe(struct platform_device *pdev) + goto out; + } + +- db->irq_wake = platform_get_irq(pdev, 1); ++ db->irq_wake = platform_get_irq_optional(pdev, 1); + if (db->irq_wake >= 0) { + dev_dbg(db->dev, "wakeup irq %d\n", db->irq_wake); + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 88bfe21079386..04421aec2dfd6 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1337,6 +1337,7 @@ static int ftgmac100_poll(struct napi_struct *napi, int budget) + */ + if (unlikely(priv->need_mac_restart)) { + ftgmac100_start_hw(priv); ++ priv->need_mac_restart = false; + + /* Re-enable "bad" interrupts */ + iowrite32(FTGMAC100_INT_BAD, +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +index de0d20b0f489c..00938f7960a43 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h ++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +@@ -234,6 +234,8 @@ enum enetc_bdr_type {TX, RX}; + #define ENETC_PM0_MAXFRM 0x8014 + #define ENETC_SET_TX_MTU(val) ((val) << 16) + #define ENETC_SET_MAXFRM(val) ((val) & 0xffff) ++#define ENETC_PM0_RX_FIFO 0x801c ++#define ENETC_PM0_RX_FIFO_VAL 1 + + #define ENETC_PM_IMDIO_BASE 0x8030 + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +index ca02f033bea21..224fc37a6757c 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +@@ -490,6 +490,12 @@ static void enetc_configure_port_mac(struct enetc_hw *hw) + + enetc_port_wr(hw, ENETC_PM1_CMD_CFG, ENETC_PM0_CMD_PHY_TX_EN | + ENETC_PM0_CMD_TXP | ENETC_PM0_PROMISC); ++ ++ /* On LS1028A, the MAC RX FIFO defaults to 2, which is too high ++ * and may lead to RX lock-up under traffic. Set it to 1 instead, ++ * as recommended by the hardware team. ++ */ ++ enetc_port_wr(hw, ENETC_PM0_RX_FIFO, ENETC_PM0_RX_FIFO_VAL); + } + + static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode) +diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c +index 2e344aada4c60..1753807cbf97e 100644 +--- a/drivers/net/ethernet/freescale/fec_ptp.c ++++ b/drivers/net/ethernet/freescale/fec_ptp.c +@@ -377,9 +377,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) + u64 ns; + unsigned long flags; + ++ mutex_lock(&adapter->ptp_clk_mutex); ++ /* Check the ptp clock */ ++ if (!adapter->ptp_clk_on) { ++ mutex_unlock(&adapter->ptp_clk_mutex); ++ return -EINVAL; ++ } + spin_lock_irqsave(&adapter->tmreg_lock, flags); + ns = timecounter_read(&adapter->tc); + spin_unlock_irqrestore(&adapter->tmreg_lock, flags); ++ mutex_unlock(&adapter->ptp_clk_mutex); + + *ts = ns_to_timespec64(ns); + +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index d391a45cebb66..4fab2ee5bbf58 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -2391,6 +2391,10 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, + if (lstatus & BD_LFLAG(RXBD_LAST)) + size -= skb->len; + ++ WARN(size < 0, "gianfar: rx fragment size underflow"); ++ if (size < 0) ++ return false; ++ + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, + rxb->page_offset + RXBUF_ALIGNMENT, + size, GFAR_RXB_TRUESIZE); +@@ -2553,6 +2557,17 @@ static int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, + if (lstatus & BD_LFLAG(RXBD_EMPTY)) + break; + ++ /* lost RXBD_LAST descriptor due to overrun */ ++ if (skb && ++ (lstatus & BD_LFLAG(RXBD_FIRST))) { ++ /* discard faulty buffer */ ++ dev_kfree_skb(skb); ++ skb = NULL; ++ rx_queue->stats.rx_dropped++; ++ ++ /* can continue normally */ ++ } ++ + /* order rx buffer descriptor reads */ + rmb(); + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 858cb293152a9..8bce5f1510bec 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -1663,8 +1663,10 @@ static int hns_nic_clear_all_rx_fetch(struct net_device *ndev) + for (j = 0; j < fetch_num; j++) { + /* alloc one skb and init */ + skb = hns_assemble_skb(ndev); +- if (!skb) ++ if (!skb) { ++ ret = -ENOMEM; + goto out; ++ } + rd = &tx_ring_data(priv, skb->queue_mapping); + hns_nic_net_xmit_hw(ndev, skb, rd); + +diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c +index 88faf05e23baf..0b1e890dd583b 100644 +--- a/drivers/net/ethernet/intel/e1000e/82571.c ++++ b/drivers/net/ethernet/intel/e1000e/82571.c +@@ -899,6 +899,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) + } else { + data &= ~IGP02E1000_PM_D0_LPLU; + ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data); ++ if (ret_val) ++ return ret_val; + /* LPLU and SmartSpeed are mutually exclusive. LPLU is used + * during Dx states where the power conservation is most + * important. During driver activity we should enable +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index e9b82c209c2df..a0948002ddf85 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -5974,15 +5974,19 @@ static void e1000_reset_task(struct work_struct *work) + struct e1000_adapter *adapter; + adapter = container_of(work, struct e1000_adapter, reset_task); + ++ rtnl_lock(); + /* don't run the task if already down */ +- if (test_bit(__E1000_DOWN, &adapter->state)) ++ if (test_bit(__E1000_DOWN, &adapter->state)) { ++ rtnl_unlock(); + return; ++ } + + if (!(adapter->flags & FLAG_RESTART_NOW)) { + e1000e_dump(adapter); + e_err("Reset adapter unexpectedly\n"); + } + e1000e_reinit_locked(adapter); ++ rtnl_unlock(); + } + + /** +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 0a867d64d4675..dc5b3c06d1e01 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1776,7 +1776,8 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter) + goto err_alloc; + } + +- if (iavf_process_config(adapter)) ++ err = iavf_process_config(adapter); ++ if (err) + goto err_alloc; + adapter->current_op = VIRTCHNL_OP_UNKNOWN; + +diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c +index 3124a3bf519a8..952e41a1e001e 100644 +--- a/drivers/net/ethernet/intel/ice/ice_base.c ++++ b/drivers/net/ethernet/intel/ice/ice_base.c +@@ -418,6 +418,8 @@ int ice_setup_rx_ctx(struct ice_ring *ring) + writel(0, ring->tail); + + if (ring->xsk_pool) { ++ bool ok; ++ + if (!xsk_buff_can_alloc(ring->xsk_pool, num_bufs)) { + dev_warn(dev, "XSK buffer pool does not provide enough addresses to fill %d buffers on Rx ring %d\n", + num_bufs, ring->q_index); +@@ -426,8 +428,8 @@ int ice_setup_rx_ctx(struct ice_ring *ring) + return 0; + } + +- err = ice_alloc_rx_bufs_zc(ring, num_bufs); +- if (err) ++ ok = ice_alloc_rx_bufs_zc(ring, num_bufs); ++ if (!ok) + dev_info(dev, "Failed to allocate some buffers on XSK buffer pool enabled Rx ring %d (pf_q %d)\n", + ring->q_index, pf_q); + return 0; +diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c +index 1782146db6448..69ee1a8e87abb 100644 +--- a/drivers/net/ethernet/intel/ice/ice_xsk.c ++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c +@@ -408,18 +408,18 @@ xsk_pool_if_up: + * This function allocates a number of Rx buffers from the fill ring + * or the internal recycle mechanism and places them on the Rx ring. + * +- * Returns false if all allocations were successful, true if any fail. ++ * Returns true if all allocations were successful, false if any fail. + */ + bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count) + { + union ice_32b_rx_flex_desc *rx_desc; + u16 ntu = rx_ring->next_to_use; + struct ice_rx_buf *rx_buf; +- bool ret = false; ++ bool ok = true; + dma_addr_t dma; + + if (!count) +- return false; ++ return true; + + rx_desc = ICE_RX_DESC(rx_ring, ntu); + rx_buf = &rx_ring->rx_buf[ntu]; +@@ -427,7 +427,7 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count) + do { + rx_buf->xdp = xsk_buff_alloc(rx_ring->xsk_pool); + if (!rx_buf->xdp) { +- ret = true; ++ ok = false; + break; + } + +@@ -452,7 +452,7 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count) + ice_release_rx_desc(rx_ring, ntu); + } + +- return ret; ++ return ok; + } + + /** +diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h +index aaa954aae5744..7bda8c5edea5d 100644 +--- a/drivers/net/ethernet/intel/igb/igb.h ++++ b/drivers/net/ethernet/intel/igb/igb.h +@@ -748,8 +748,8 @@ void igb_ptp_suspend(struct igb_adapter *adapter); + void igb_ptp_rx_hang(struct igb_adapter *adapter); + void igb_ptp_tx_hang(struct igb_adapter *adapter); + void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb); +-void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, +- struct sk_buff *skb); ++int igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, ++ struct sk_buff *skb); + int igb_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr); + int igb_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr); + void igb_set_flag_queue_pairs(struct igb_adapter *, const u32); +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 03f78fdb0dcdd..0e8c17f7af28a 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8232,7 +8232,8 @@ static inline bool igb_page_is_reserved(struct page *page) + return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page); + } + +-static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer) ++static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer, ++ int rx_buf_pgcnt) + { + unsigned int pagecnt_bias = rx_buffer->pagecnt_bias; + struct page *page = rx_buffer->page; +@@ -8243,7 +8244,7 @@ static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer) + + #if (PAGE_SIZE < 8192) + /* if we are only owner of page we can reuse it */ +- if (unlikely((page_ref_count(page) - pagecnt_bias) > 1)) ++ if (unlikely((rx_buf_pgcnt - pagecnt_bias) > 1)) + return false; + #else + #define IGB_LAST_OFFSET \ +@@ -8319,9 +8320,10 @@ static struct sk_buff *igb_construct_skb(struct igb_ring *rx_ring, + return NULL; + + if (unlikely(igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP))) { +- igb_ptp_rx_pktstamp(rx_ring->q_vector, xdp->data, skb); +- xdp->data += IGB_TS_HDR_LEN; +- size -= IGB_TS_HDR_LEN; ++ if (!igb_ptp_rx_pktstamp(rx_ring->q_vector, xdp->data, skb)) { ++ xdp->data += IGB_TS_HDR_LEN; ++ size -= IGB_TS_HDR_LEN; ++ } + } + + /* Determine available headroom for copy */ +@@ -8382,8 +8384,8 @@ static struct sk_buff *igb_build_skb(struct igb_ring *rx_ring, + + /* pull timestamp out of packet data */ + if (igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP)) { +- igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb); +- __skb_pull(skb, IGB_TS_HDR_LEN); ++ if (!igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb)) ++ __skb_pull(skb, IGB_TS_HDR_LEN); + } + + /* update buffer offset */ +@@ -8632,11 +8634,17 @@ static unsigned int igb_rx_offset(struct igb_ring *rx_ring) + } + + static struct igb_rx_buffer *igb_get_rx_buffer(struct igb_ring *rx_ring, +- const unsigned int size) ++ const unsigned int size, int *rx_buf_pgcnt) + { + struct igb_rx_buffer *rx_buffer; + + rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean]; ++ *rx_buf_pgcnt = ++#if (PAGE_SIZE < 8192) ++ page_count(rx_buffer->page); ++#else ++ 0; ++#endif + prefetchw(rx_buffer->page); + + /* we are reusing so sync this buffer for CPU use */ +@@ -8652,9 +8660,9 @@ static struct igb_rx_buffer *igb_get_rx_buffer(struct igb_ring *rx_ring, + } + + static void igb_put_rx_buffer(struct igb_ring *rx_ring, +- struct igb_rx_buffer *rx_buffer) ++ struct igb_rx_buffer *rx_buffer, int rx_buf_pgcnt) + { +- if (igb_can_reuse_rx_page(rx_buffer)) { ++ if (igb_can_reuse_rx_page(rx_buffer, rx_buf_pgcnt)) { + /* hand second half of page back to the ring */ + igb_reuse_rx_page(rx_ring, rx_buffer); + } else { +@@ -8681,6 +8689,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget) + u16 cleaned_count = igb_desc_unused(rx_ring); + unsigned int xdp_xmit = 0; + struct xdp_buff xdp; ++ int rx_buf_pgcnt; + + xdp.rxq = &rx_ring->xdp_rxq; + +@@ -8711,7 +8720,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget) + */ + dma_rmb(); + +- rx_buffer = igb_get_rx_buffer(rx_ring, size); ++ rx_buffer = igb_get_rx_buffer(rx_ring, size, &rx_buf_pgcnt); + + /* retrieve a buffer from the ring */ + if (!skb) { +@@ -8754,7 +8763,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget) + break; + } + +- igb_put_rx_buffer(rx_ring, rx_buffer); ++ igb_put_rx_buffer(rx_ring, rx_buffer, rx_buf_pgcnt); + cleaned_count++; + + /* fetch next buffer in frame if non-eop */ +diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c +index 7cc5428c3b3d2..86a576201f5ff 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ptp.c ++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c +@@ -856,6 +856,9 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter) + dev_kfree_skb_any(skb); + } + ++#define IGB_RET_PTP_DISABLED 1 ++#define IGB_RET_PTP_INVALID 2 ++ + /** + * igb_ptp_rx_pktstamp - retrieve Rx per packet timestamp + * @q_vector: Pointer to interrupt specific structure +@@ -864,19 +867,29 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter) + * + * This function is meant to retrieve a timestamp from the first buffer of an + * incoming frame. The value is stored in little endian format starting on +- * byte 8. ++ * byte 8 ++ * ++ * Returns: 0 if success, nonzero if failure + **/ +-void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, +- struct sk_buff *skb) ++int igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, ++ struct sk_buff *skb) + { +- __le64 *regval = (__le64 *)va; + struct igb_adapter *adapter = q_vector->adapter; ++ __le64 *regval = (__le64 *)va; + int adjust = 0; + ++ if (!(adapter->ptp_flags & IGB_PTP_ENABLED)) ++ return IGB_RET_PTP_DISABLED; ++ + /* The timestamp is recorded in little endian format. + * DWORD: 0 1 2 3 + * Field: Reserved Reserved SYSTIML SYSTIMH + */ ++ ++ /* check reserved dwords are zero, be/le doesn't matter for zero */ ++ if (regval[0]) ++ return IGB_RET_PTP_INVALID; ++ + igb_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), + le64_to_cpu(regval[1])); + +@@ -896,6 +909,8 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, + } + skb_hwtstamps(skb)->hwtstamp = + ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust); ++ ++ return 0; + } + + /** +@@ -906,13 +921,15 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, + * This function is meant to retrieve a timestamp from the internal registers + * of the adapter and store it in the skb. + **/ +-void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, +- struct sk_buff *skb) ++void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb) + { + struct igb_adapter *adapter = q_vector->adapter; + struct e1000_hw *hw = &adapter->hw; +- u64 regval; + int adjust = 0; ++ u64 regval; ++ ++ if (!(adapter->ptp_flags & IGB_PTP_ENABLED)) ++ return; + + /* If this bit is set, then the RX registers contain the time stamp. No + * other packet will be time stamped until we read these registers, so +diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h +index 35baae900c1fd..6dca67d9c25d8 100644 +--- a/drivers/net/ethernet/intel/igc/igc.h ++++ b/drivers/net/ethernet/intel/igc/igc.h +@@ -545,7 +545,7 @@ void igc_ptp_init(struct igc_adapter *adapter); + void igc_ptp_reset(struct igc_adapter *adapter); + void igc_ptp_suspend(struct igc_adapter *adapter); + void igc_ptp_stop(struct igc_adapter *adapter); +-void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, void *va, ++void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, __le32 *va, + struct sk_buff *skb); + int igc_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr); + int igc_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr); +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index ec8cd69d49928..da259cd59adda 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -1695,6 +1695,9 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev, + Autoneg); + } + ++ /* Set pause flow control settings */ ++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); ++ + switch (hw->fc.requested_mode) { + case igc_fc_full: + ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); +@@ -1709,9 +1712,7 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev, + Asym_Pause); + break; + default: +- ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, +- Asym_Pause); ++ break; + } + + status = pm_runtime_suspended(&adapter->pdev->dev) ? +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index afd6a62da29dd..93874e930abf4 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -3847,10 +3847,19 @@ static void igc_reset_task(struct work_struct *work) + + adapter = container_of(work, struct igc_adapter, reset_task); + ++ rtnl_lock(); ++ /* If we're already down or resetting, just bail */ ++ if (test_bit(__IGC_DOWN, &adapter->state) || ++ test_bit(__IGC_RESETTING, &adapter->state)) { ++ rtnl_unlock(); ++ return; ++ } ++ + igc_rings_dump(adapter); + igc_regs_dump(adapter); + netdev_err(adapter->netdev, "Reset adapter\n"); + igc_reinit_locked(adapter); ++ rtnl_unlock(); + } + + /** +diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c +index ac0b9c85da7ca..545f4d0e67cf4 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ptp.c ++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c +@@ -152,46 +152,54 @@ static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, + } + + /** +- * igc_ptp_rx_pktstamp - retrieve Rx per packet timestamp ++ * igc_ptp_rx_pktstamp - Retrieve timestamp from Rx packet buffer + * @q_vector: Pointer to interrupt specific structure + * @va: Pointer to address containing Rx buffer + * @skb: Buffer containing timestamp and packet + * +- * This function is meant to retrieve the first timestamp from the +- * first buffer of an incoming frame. The value is stored in little +- * endian format starting on byte 0. There's a second timestamp +- * starting on byte 8. +- **/ +-void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, void *va, ++ * This function retrieves the timestamp saved in the beginning of packet ++ * buffer. While two timestamps are available, one in timer0 reference and the ++ * other in timer1 reference, this function considers only the timestamp in ++ * timer0 reference. ++ */ ++void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, __le32 *va, + struct sk_buff *skb) + { + struct igc_adapter *adapter = q_vector->adapter; +- __le64 *regval = (__le64 *)va; +- int adjust = 0; +- +- /* The timestamp is recorded in little endian format. +- * DWORD: | 0 | 1 | 2 | 3 +- * Field: | Timer0 Low | Timer0 High | Timer1 Low | Timer1 High ++ u64 regval; ++ int adjust; ++ ++ /* Timestamps are saved in little endian at the beginning of the packet ++ * buffer following the layout: ++ * ++ * DWORD: | 0 | 1 | 2 | 3 | ++ * Field: | Timer1 SYSTIML | Timer1 SYSTIMH | Timer0 SYSTIML | Timer0 SYSTIMH | ++ * ++ * SYSTIML holds the nanoseconds part while SYSTIMH holds the seconds ++ * part of the timestamp. + */ +- igc_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), +- le64_to_cpu(regval[0])); +- +- /* adjust timestamp for the RX latency based on link speed */ +- if (adapter->hw.mac.type == igc_i225) { +- switch (adapter->link_speed) { +- case SPEED_10: +- adjust = IGC_I225_RX_LATENCY_10; +- break; +- case SPEED_100: +- adjust = IGC_I225_RX_LATENCY_100; +- break; +- case SPEED_1000: +- adjust = IGC_I225_RX_LATENCY_1000; +- break; +- case SPEED_2500: +- adjust = IGC_I225_RX_LATENCY_2500; +- break; +- } ++ regval = le32_to_cpu(va[2]); ++ regval |= (u64)le32_to_cpu(va[3]) << 32; ++ igc_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), regval); ++ ++ /* Adjust timestamp for the RX latency based on link speed */ ++ switch (adapter->link_speed) { ++ case SPEED_10: ++ adjust = IGC_I225_RX_LATENCY_10; ++ break; ++ case SPEED_100: ++ adjust = IGC_I225_RX_LATENCY_100; ++ break; ++ case SPEED_1000: ++ adjust = IGC_I225_RX_LATENCY_1000; ++ break; ++ case SPEED_2500: ++ adjust = IGC_I225_RX_LATENCY_2500; ++ break; ++ default: ++ adjust = 0; ++ netdev_warn_once(adapter->netdev, "Imprecise timestamp\n"); ++ break; + } + skb_hwtstamps(skb)->hwtstamp = + ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust); +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 393d1c2cd8539..e9c2d28efc815 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -9582,8 +9582,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter *adapter, + ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask); + err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter, + input->sw_idx, queue); +- if (!err) +- ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx); ++ if (err) ++ goto err_out_w_lock; ++ ++ ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx); + spin_unlock(&adapter->fdir_perfect_lock); + + if ((uhtid != 0x800) && (adapter->jump_tables[uhtid])) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h +index b192692b4fc4b..5c372d2c24a16 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h +@@ -13499,8 +13499,6 @@ static struct npc_mcam_kex npc_mkex_default = { + [NPC_LT_LC_IP] = { + /* SIP+DIP: 8 bytes, KW2[63:0] */ + KEX_LD_CFG(0x07, 0xc, 0x1, 0x0, 0x10), +- /* TOS: 1 byte, KW1[63:56] */ +- KEX_LD_CFG(0x0, 0x1, 0x1, 0x0, 0xf), + }, + /* Layer C: IPv6 */ + [NPC_LT_LC_IP6] = { +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index e8fd712860a16..e3fc6d1c0ec31 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -2358,8 +2358,10 @@ static void rvu_unregister_interrupts(struct rvu *rvu) + INTR_MASK(rvu->hw->total_pfs) & ~1ULL); + + for (irq = 0; irq < rvu->num_vec; irq++) { +- if (rvu->irq_allocated[irq]) ++ if (rvu->irq_allocated[irq]) { + free_irq(pci_irq_vector(rvu->pdev, irq), rvu); ++ rvu->irq_allocated[irq] = false; ++ } + } + + pci_free_irq_vectors(rvu->pdev); +@@ -2873,8 +2875,8 @@ static void rvu_remove(struct pci_dev *pdev) + struct rvu *rvu = pci_get_drvdata(pdev); + + rvu_dbg_exit(rvu); +- rvu_unregister_interrupts(rvu); + rvu_unregister_dl(rvu); ++ rvu_unregister_interrupts(rvu); + rvu_flr_wq_destroy(rvu); + rvu_cgx_exit(rvu); + rvu_fwdata_exit(rvu); +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +index bb3fdaf337519..0488651a68d06 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +@@ -150,12 +150,14 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + char __user *buffer, + size_t count, loff_t *ppos) + { +- int index, off = 0, flag = 0, go_back = 0, off_prev; ++ int index, off = 0, flag = 0, go_back = 0, len = 0; + struct rvu *rvu = filp->private_data; + int lf, pf, vf, pcifunc; + struct rvu_block block; + int bytes_not_copied; ++ int lf_str_size = 12; + int buf_size = 2048; ++ char *lfs; + char *buf; + + /* don't allow partial reads */ +@@ -165,12 +167,20 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + buf = kzalloc(buf_size, GFP_KERNEL); + if (!buf) + return -ENOSPC; +- off += scnprintf(&buf[off], buf_size - 1 - off, "\npcifunc\t\t"); ++ ++ lfs = kzalloc(lf_str_size, GFP_KERNEL); ++ if (!lfs) { ++ kfree(buf); ++ return -ENOMEM; ++ } ++ off += scnprintf(&buf[off], buf_size - 1 - off, "%-*s", lf_str_size, ++ "pcifunc"); + for (index = 0; index < BLK_COUNT; index++) +- if (strlen(rvu->hw->block[index].name)) +- off += scnprintf(&buf[off], buf_size - 1 - off, +- "%*s\t", (index - 1) * 2, +- rvu->hw->block[index].name); ++ if (strlen(rvu->hw->block[index].name)) { ++ off += scnprintf(&buf[off], buf_size - 1 - off, ++ "%-*s", lf_str_size, ++ rvu->hw->block[index].name); ++ } + off += scnprintf(&buf[off], buf_size - 1 - off, "\n"); + for (pf = 0; pf < rvu->hw->total_pfs; pf++) { + for (vf = 0; vf <= rvu->hw->total_vfs; vf++) { +@@ -179,14 +189,15 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + continue; + + if (vf) { ++ sprintf(lfs, "PF%d:VF%d", pf, vf - 1); + go_back = scnprintf(&buf[off], + buf_size - 1 - off, +- "PF%d:VF%d\t\t", pf, +- vf - 1); ++ "%-*s", lf_str_size, lfs); + } else { ++ sprintf(lfs, "PF%d", pf); + go_back = scnprintf(&buf[off], + buf_size - 1 - off, +- "PF%d\t\t", pf); ++ "%-*s", lf_str_size, lfs); + } + + off += go_back; +@@ -194,20 +205,22 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + block = rvu->hw->block[index]; + if (!strlen(block.name)) + continue; +- off_prev = off; ++ len = 0; ++ lfs[len] = '\0'; + for (lf = 0; lf < block.lf.max; lf++) { + if (block.fn_map[lf] != pcifunc) + continue; + flag = 1; +- off += scnprintf(&buf[off], buf_size - 1 +- - off, "%3d,", lf); ++ len += sprintf(&lfs[len], "%d,", lf); + } +- if (flag && off_prev != off) +- off--; +- else +- go_back++; ++ ++ if (flag) ++ len--; ++ lfs[len] = '\0'; + off += scnprintf(&buf[off], buf_size - 1 - off, +- "\t"); ++ "%-*s", lf_str_size, lfs); ++ if (!strlen(lfs)) ++ go_back += lf_str_size; + } + if (!flag) + off -= go_back; +@@ -219,6 +232,7 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + } + + bytes_not_copied = copy_to_user(buffer, buf, off); ++ kfree(lfs); + kfree(buf); + + if (bytes_not_copied) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 5cf9b7a907ae0..b81539f3b2ac8 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -2490,10 +2490,10 @@ int rvu_mbox_handler_npc_mcam_free_counter(struct rvu *rvu, + index = find_next_bit(mcam->bmap, mcam->bmap_entries, entry); + if (index >= mcam->bmap_entries) + break; ++ entry = index + 1; + if (mcam->entry2cntr_map[index] != req->cntr) + continue; + +- entry = index + 1; + npc_unmap_mcam_entry_and_cntr(rvu, mcam, blkaddr, + index, req->cntr); + } +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 634d60655a74a..07e841df56781 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1625,6 +1625,7 @@ int otx2_stop(struct net_device *netdev) + struct otx2_nic *pf = netdev_priv(netdev); + struct otx2_cq_poll *cq_poll = NULL; + struct otx2_qset *qset = &pf->qset; ++ struct otx2_rss_info *rss; + int qidx, vec, wrk; + + netif_carrier_off(netdev); +@@ -1637,6 +1638,10 @@ int otx2_stop(struct net_device *netdev) + /* First stop packet Rx/Tx */ + otx2_rxtx_enable(pf, false); + ++ /* Clear RSS enable flag */ ++ rss = &pf->hw.rss_info; ++ rss->enable = false; ++ + /* Cleanup Queue IRQ */ + vec = pci_irq_vector(pf->pdev, + pf->hw.nix_msixoff + NIX_LF_QINT_VEC_START); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index 055baf3b6cb10..f258f2f9b8cff 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -90,14 +90,15 @@ struct page_pool; + MLX5_MPWRQ_LOG_WQE_SZ - PAGE_SHIFT : 0) + #define MLX5_MPWRQ_PAGES_PER_WQE BIT(MLX5_MPWRQ_WQE_PAGE_ORDER) + +-#define MLX5_MTT_OCTW(npages) (ALIGN(npages, 8) / 2) ++#define MLX5_ALIGN_MTTS(mtts) (ALIGN(mtts, 8)) ++#define MLX5_ALIGNED_MTTS_OCTW(mtts) ((mtts) / 2) ++#define MLX5_MTT_OCTW(mtts) (MLX5_ALIGNED_MTTS_OCTW(MLX5_ALIGN_MTTS(mtts))) + /* Add another page to MLX5E_REQUIRED_WQE_MTTS as a buffer between + * WQEs, This page will absorb write overflow by the hardware, when + * receiving packets larger than MTU. These oversize packets are + * dropped by the driver at a later stage. + */ +-#define MLX5E_REQUIRED_WQE_MTTS (ALIGN(MLX5_MPWRQ_PAGES_PER_WQE + 1, 8)) +-#define MLX5E_LOG_ALIGNED_MPWQE_PPW (ilog2(MLX5E_REQUIRED_WQE_MTTS)) ++#define MLX5E_REQUIRED_WQE_MTTS (MLX5_ALIGN_MTTS(MLX5_MPWRQ_PAGES_PER_WQE + 1)) + #define MLX5E_REQUIRED_MTTS(wqes) (wqes * MLX5E_REQUIRED_WQE_MTTS) + #define MLX5E_MAX_RQ_NUM_MTTS \ + ((1 << 16) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */ +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +index 24e2c0d955b99..b42396df3111d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +@@ -1182,7 +1182,8 @@ int mlx5_tc_ct_add_no_trk_match(struct mlx5_flow_spec *spec) + + mlx5e_tc_match_to_reg_get_match(spec, CTSTATE_TO_REG, + &ctstate, &ctstate_mask); +- if (ctstate_mask) ++ ++ if ((ctstate & ctstate_mask) == MLX5_CT_STATE_TRK_BIT) + return -EOPNOTSUPP; + + ctstate_mask |= MLX5_CT_STATE_TRK_BIT; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c +index e472ed0eacfbc..7ed3f9f79f11a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c +@@ -227,6 +227,10 @@ static int mlx5e_tc_tun_parse_geneve_options(struct mlx5e_priv *priv, + option_key = (struct geneve_opt *)&enc_opts.key->data[0]; + option_mask = (struct geneve_opt *)&enc_opts.mask->data[0]; + ++ if (option_mask->opt_class == 0 && option_mask->type == 0 && ++ !memchr_inv(option_mask->opt_data, 0, option_mask->length * 4)) ++ return 0; ++ + if (option_key->length > max_tlv_option_data_len) { + NL_SET_ERR_MSG_MOD(extack, + "Matching on GENEVE options: unsupported option len"); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index 8612c388db7d3..c9d01e705ab29 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1876,6 +1876,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + { + struct mlx5e_priv *priv = netdev_priv(netdev); + struct mlx5_core_dev *mdev = priv->mdev; ++ int err; + + if (!MLX5_CAP_GEN(mdev, cqe_compression)) + return -EOPNOTSUPP; +@@ -1885,7 +1886,10 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + return -EINVAL; + } + +- mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ err = mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ if (err) ++ return err; ++ + priv->channels.params.rx_cqe_compress_def = enable; + + return 0; +@@ -1993,8 +1997,13 @@ static int set_pflag_tx_port_ts(struct net_device *netdev, bool enable) + */ + + if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) { ++ struct mlx5e_params old_params; ++ ++ old_params = priv->channels.params; + priv->channels.params = new_channels.params; + err = mlx5e_num_channels_changed(priv); ++ if (err) ++ priv->channels.params = old_params; + goto out; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index a2e0b548bf570..aaa5a56b44c7c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -305,9 +305,9 @@ static int mlx5e_create_rq_umr_mkey(struct mlx5_core_dev *mdev, struct mlx5e_rq + rq->wqe_overflow.addr); + } + +-static inline u64 mlx5e_get_mpwqe_offset(struct mlx5e_rq *rq, u16 wqe_ix) ++static u64 mlx5e_get_mpwqe_offset(u16 wqe_ix) + { +- return (wqe_ix << MLX5E_LOG_ALIGNED_MPWQE_PPW) << PAGE_SHIFT; ++ return MLX5E_REQUIRED_MTTS(wqe_ix) << PAGE_SHIFT; + } + + static void mlx5e_init_frags_partition(struct mlx5e_rq *rq) +@@ -547,7 +547,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c, + mlx5_wq_ll_get_wqe(&rq->mpwqe.wq, i); + u32 byte_count = + rq->mpwqe.num_strides << rq->mpwqe.log_stride_sz; +- u64 dma_offset = mlx5e_get_mpwqe_offset(rq, i); ++ u64 dma_offset = mlx5e_get_mpwqe_offset(i); + + wqe->data[0].addr = cpu_to_be64(dma_offset + rq->buff.headroom); + wqe->data[0].byte_count = cpu_to_be32(byte_count); +@@ -2443,8 +2443,10 @@ void mlx5e_close_channels(struct mlx5e_channels *chs) + { + int i; + +- if (chs->port_ptp) ++ if (chs->port_ptp) { + mlx5e_port_ptp_close(chs->port_ptp); ++ chs->port_ptp = NULL; ++ } + + for (i = 0; i < chs->num; i++) + mlx5e_close_channel(chs->c[i]); +@@ -3701,10 +3703,17 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) + } + + if (mlx5e_is_uplink_rep(priv)) { ++ struct mlx5e_vport_stats *vstats = &priv->stats.vport; ++ + stats->rx_packets = PPORT_802_3_GET(pstats, a_frames_received_ok); + stats->rx_bytes = PPORT_802_3_GET(pstats, a_octets_received_ok); + stats->tx_packets = PPORT_802_3_GET(pstats, a_frames_transmitted_ok); + stats->tx_bytes = PPORT_802_3_GET(pstats, a_octets_transmitted_ok); ++ ++ /* vport multicast also counts packets that are dropped due to steering ++ * or rx out of buffer ++ */ ++ stats->multicast = VPORT_COUNTER_GET(vstats, received_eth_multicast.packets); + } else { + mlx5e_fold_sw_stats64(priv, stats); + } +@@ -4548,8 +4557,10 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog) + struct mlx5e_channel *c = priv->channels.c[i]; + + mlx5e_rq_replace_xdp_prog(&c->rq, prog); +- if (test_bit(MLX5E_CHANNEL_STATE_XSK, c->state)) ++ if (test_bit(MLX5E_CHANNEL_STATE_XSK, c->state)) { ++ bpf_prog_inc(prog); + mlx5e_rq_replace_xdp_prog(&c->xskrq, prog); ++ } + } + + unlock: +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +index 4864deed9dc94..b2e71a045df01 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -505,7 +505,6 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix) + struct mlx5e_icosq *sq = rq->icosq; + struct mlx5_wq_cyc *wq = &sq->wq; + struct mlx5e_umr_wqe *umr_wqe; +- u16 xlt_offset = ix << (MLX5E_LOG_ALIGNED_MPWQE_PPW - 1); + u16 pi; + int err; + int i; +@@ -536,7 +535,8 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix) + umr_wqe->ctrl.opmod_idx_opcode = + cpu_to_be32((sq->pc << MLX5_WQE_CTRL_WQE_INDEX_SHIFT) | + MLX5_OPCODE_UMR); +- umr_wqe->uctrl.xlt_offset = cpu_to_be16(xlt_offset); ++ umr_wqe->uctrl.xlt_offset = ++ cpu_to_be16(MLX5_ALIGNED_MTTS_OCTW(MLX5E_REQUIRED_MTTS(ix))); + + sq->db.wqe_info[pi] = (struct mlx5e_icosq_wqe_info) { + .wqe_type = MLX5E_ICOSQ_WQE_UMR_RX, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 717fbaa6ce736..24fa399b15770 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -2595,6 +2595,16 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, + *match_level = MLX5_MATCH_L4; + } + ++ /* Currenlty supported only for MPLS over UDP */ ++ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_MPLS) && ++ !netif_is_bareudp(filter_dev)) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "Matching on MPLS is supported only for MPLS over UDP"); ++ netdev_err(priv->netdev, ++ "Matching on MPLS is supported only for MPLS over UDP\n"); ++ return -EOPNOTSUPP; ++ } ++ + return 0; + } + +@@ -3198,6 +3208,37 @@ static int is_action_keys_supported(const struct flow_action_entry *act, + return 0; + } + ++static bool modify_tuple_supported(bool modify_tuple, bool ct_clear, ++ bool ct_flow, struct netlink_ext_ack *extack, ++ struct mlx5e_priv *priv, ++ struct mlx5_flow_spec *spec) ++{ ++ if (!modify_tuple || ct_clear) ++ return true; ++ ++ if (ct_flow) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "can't offload tuple modification with non-clear ct()"); ++ netdev_info(priv->netdev, ++ "can't offload tuple modification with non-clear ct()"); ++ return false; ++ } ++ ++ /* Add ct_state=-trk match so it will be offloaded for non ct flows ++ * (or after clear action), as otherwise, since the tuple is changed, ++ * we can't restore ct state ++ */ ++ if (mlx5_tc_ct_add_no_trk_match(spec)) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "can't offload tuple modification with ct matches and no ct(clear) action"); ++ netdev_info(priv->netdev, ++ "can't offload tuple modification with ct matches and no ct(clear) action"); ++ return false; ++ } ++ ++ return true; ++} ++ + static bool modify_header_match_supported(struct mlx5e_priv *priv, + struct mlx5_flow_spec *spec, + struct flow_action *flow_action, +@@ -3236,18 +3277,9 @@ static bool modify_header_match_supported(struct mlx5e_priv *priv, + return err; + } + +- /* Add ct_state=-trk match so it will be offloaded for non ct flows +- * (or after clear action), as otherwise, since the tuple is changed, +- * we can't restore ct state +- */ +- if (!ct_clear && modify_tuple && +- mlx5_tc_ct_add_no_trk_match(spec)) { +- NL_SET_ERR_MSG_MOD(extack, +- "can't offload tuple modify header with ct matches"); +- netdev_info(priv->netdev, +- "can't offload tuple modify header with ct matches"); ++ if (!modify_tuple_supported(modify_tuple, ct_clear, ct_flow, extack, ++ priv, spec)) + return false; +- } + + ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol); + if (modify_ip_header && ip_proto != IPPROTO_TCP && +@@ -5040,7 +5072,8 @@ static int apply_police_params(struct mlx5e_priv *priv, u64 rate, + */ + if (rate) { + rate = (rate * BITS_PER_BYTE) + 500000; +- rate_mbps = max_t(u64, do_div(rate, 1000000), 1); ++ do_div(rate, 1000000); ++ rate_mbps = max_t(u32, rate, 1); + } + + err = mlx5_esw_modify_vport_rate(esw, vport_num, rate_mbps); +diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +index 5defd31d481c2..aa06fcb38f8b9 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +@@ -327,8 +327,14 @@ int nfp_compile_flow_metadata(struct nfp_app *app, + goto err_free_ctx_entry; + } + ++ /* Do net allocate a mask-id for pre_tun_rules. These flows are used to ++ * configure the pre_tun table and are never actually send to the ++ * firmware as an add-flow message. This causes the mask-id allocation ++ * on the firmware to get out of sync if allocated here. ++ */ + new_mask_id = 0; +- if (!nfp_check_mask_add(app, nfp_flow->mask_data, ++ if (!nfp_flow->pre_tun_rule.dev && ++ !nfp_check_mask_add(app, nfp_flow->mask_data, + nfp_flow->meta.mask_len, + &nfp_flow->meta.flags, &new_mask_id)) { + NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot allocate a new mask id"); +@@ -359,7 +365,8 @@ int nfp_compile_flow_metadata(struct nfp_app *app, + goto err_remove_mask; + } + +- if (!nfp_check_mask_remove(app, nfp_flow->mask_data, ++ if (!nfp_flow->pre_tun_rule.dev && ++ !nfp_check_mask_remove(app, nfp_flow->mask_data, + nfp_flow->meta.mask_len, + NULL, &new_mask_id)) { + NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot release mask id"); +@@ -374,8 +381,10 @@ int nfp_compile_flow_metadata(struct nfp_app *app, + return 0; + + err_remove_mask: +- nfp_check_mask_remove(app, nfp_flow->mask_data, nfp_flow->meta.mask_len, +- NULL, &new_mask_id); ++ if (!nfp_flow->pre_tun_rule.dev) ++ nfp_check_mask_remove(app, nfp_flow->mask_data, ++ nfp_flow->meta.mask_len, ++ NULL, &new_mask_id); + err_remove_rhash: + WARN_ON_ONCE(rhashtable_remove_fast(&priv->stats_ctx_table, + &ctx_entry->ht_node, +@@ -406,9 +415,10 @@ int nfp_modify_flow_metadata(struct nfp_app *app, + + __nfp_modify_flow_metadata(priv, nfp_flow); + +- nfp_check_mask_remove(app, nfp_flow->mask_data, +- nfp_flow->meta.mask_len, &nfp_flow->meta.flags, +- &new_mask_id); ++ if (!nfp_flow->pre_tun_rule.dev) ++ nfp_check_mask_remove(app, nfp_flow->mask_data, ++ nfp_flow->meta.mask_len, &nfp_flow->meta.flags, ++ &new_mask_id); + + /* Update flow payload with mask ids. */ + nfp_flow->unmasked_data[NFP_FL_MASK_ID_LOCATION] = new_mask_id; +diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c +index 1c59aff2163c7..d72225d64a75d 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c +@@ -1142,6 +1142,12 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, + return -EOPNOTSUPP; + } + ++ if (!(key_layer & NFP_FLOWER_LAYER_IPV4) && ++ !(key_layer & NFP_FLOWER_LAYER_IPV6)) { ++ NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: match on ipv4/ipv6 eth_type must be present"); ++ return -EOPNOTSUPP; ++ } ++ + /* Skip fields known to exist. */ + mask += sizeof(struct nfp_flower_meta_tci); + ext += sizeof(struct nfp_flower_meta_tci); +@@ -1152,6 +1158,13 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, + mask += sizeof(struct nfp_flower_in_port); + ext += sizeof(struct nfp_flower_in_port); + ++ /* Ensure destination MAC address matches pre_tun_dev. */ ++ mac = (struct nfp_flower_mac_mpls *)ext; ++ if (memcmp(&mac->mac_dst[0], flow->pre_tun_rule.dev->dev_addr, 6)) { ++ NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: dest MAC must match output dev MAC"); ++ return -EOPNOTSUPP; ++ } ++ + /* Ensure destination MAC address is fully matched. */ + mac = (struct nfp_flower_mac_mpls *)mask; + if (!is_broadcast_ether_addr(&mac->mac_dst[0])) { +@@ -1159,6 +1172,11 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, + return -EOPNOTSUPP; + } + ++ if (mac->mpls_lse) { ++ NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: MPLS not supported"); ++ return -EOPNOTSUPP; ++ } ++ + mask += sizeof(struct nfp_flower_mac_mpls); + ext += sizeof(struct nfp_flower_mac_mpls); + if (key_layer & NFP_FLOWER_LAYER_IPV4 || +diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +index 7248d248f6041..d19c02e991145 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +@@ -16,8 +16,9 @@ + #define NFP_FL_MAX_ROUTES 32 + + #define NFP_TUN_PRE_TUN_RULE_LIMIT 32 +-#define NFP_TUN_PRE_TUN_RULE_DEL 0x1 +-#define NFP_TUN_PRE_TUN_IDX_BIT 0x8 ++#define NFP_TUN_PRE_TUN_RULE_DEL BIT(0) ++#define NFP_TUN_PRE_TUN_IDX_BIT BIT(3) ++#define NFP_TUN_PRE_TUN_IPV6_BIT BIT(7) + + /** + * struct nfp_tun_pre_run_rule - rule matched before decap +@@ -1268,6 +1269,7 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app, + { + struct nfp_flower_priv *app_priv = app->priv; + struct nfp_tun_offloaded_mac *mac_entry; ++ struct nfp_flower_meta_tci *key_meta; + struct nfp_tun_pre_tun_rule payload; + struct net_device *internal_dev; + int err; +@@ -1290,6 +1292,15 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app, + if (!mac_entry) + return -ENOENT; + ++ /* Set/clear IPV6 bit. cpu_to_be16() swap will lead to MSB being ++ * set/clear for port_idx. ++ */ ++ key_meta = (struct nfp_flower_meta_tci *)flow->unmasked_data; ++ if (key_meta->nfp_flow_key_layer & NFP_FLOWER_LAYER_IPV6) ++ mac_entry->index |= NFP_TUN_PRE_TUN_IPV6_BIT; ++ else ++ mac_entry->index &= ~NFP_TUN_PRE_TUN_IPV6_BIT; ++ + payload.port_idx = cpu_to_be16(mac_entry->index); + + /* Copy mac id and vlan to flow - dev may not exist at delete time. */ +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +index ac4cd5d82e696..b7601cadcb8c1 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -1079,15 +1079,17 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb) + { + int sg_elems = q->lif->qtype_info[IONIC_QTYPE_TXQ].max_sg_elems; + struct ionic_tx_stats *stats = q_to_tx_stats(q); ++ int ndescs; + int err; + +- /* If TSO, need roundup(skb->len/mss) descs */ ++ /* Each desc is mss long max, so a descriptor for each gso_seg */ + if (skb_is_gso(skb)) +- return (skb->len / skb_shinfo(skb)->gso_size) + 1; ++ ndescs = skb_shinfo(skb)->gso_segs; ++ else ++ ndescs = 1; + +- /* If non-TSO, just need 1 desc and nr_frags sg elems */ + if (skb_shinfo(skb)->nr_frags <= sg_elems) +- return 1; ++ return ndescs; + + /* Too many frags, so linearize */ + err = skb_linearize(skb); +@@ -1096,8 +1098,7 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb) + + stats->linearize++; + +- /* Need 1 desc and zero sg elems */ +- return 1; ++ return ndescs; + } + + static int ionic_maybe_stop_tx(struct ionic_queue *q, int ndescs) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +index 7760a3394e93c..7ecb3dfe30bd2 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +@@ -1425,6 +1425,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + + if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) { + vfree(fw_dump->tmpl_hdr); ++ fw_dump->tmpl_hdr = NULL; + + if (qlcnic_83xx_md_check_extended_dump_capability(adapter)) + extended = !qlcnic_83xx_extend_md_capab(adapter); +@@ -1443,6 +1444,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + struct qlcnic_83xx_dump_template_hdr *hdr; + + hdr = fw_dump->tmpl_hdr; ++ if (!hdr) ++ return; + hdr->drv_cap_mask = 0x1f; + fw_dump->cap_mask = 0x1f; + dev_info(&pdev->dev, +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index ea265b428c2f3..7c1a057dcf3d6 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4677,6 +4677,9 @@ static void rtl8169_down(struct rtl8169_private *tp) + + rtl8169_update_counters(tp); + ++ pci_clear_master(tp->pci_dev); ++ rtl_pci_commit(tp); ++ + rtl8169_cleanup(tp, true); + + rtl_pll_power_down(tp); +@@ -4684,6 +4687,7 @@ static void rtl8169_down(struct rtl8169_private *tp) + + static void rtl8169_up(struct rtl8169_private *tp) + { ++ pci_set_master(tp->pci_dev); + rtl_pll_power_up(tp); + rtl8169_init_phy(tp); + napi_enable(&tp->napi); +@@ -5348,8 +5352,6 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + + rtl_hw_reset(tp); + +- pci_set_master(pdev); +- + rc = rtl_alloc_irq(tp); + if (rc < 0) { + dev_err(&pdev->dev, "Can't allocate interrupt\n"); +diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c +index 19d20a6d0d445..3e172fc649761 100644 +--- a/drivers/net/ethernet/socionext/netsec.c ++++ b/drivers/net/ethernet/socionext/netsec.c +@@ -1718,14 +1718,17 @@ static int netsec_netdev_init(struct net_device *ndev) + goto err1; + + /* set phy power down */ +- data = netsec_phy_read(priv->mii_bus, priv->phy_addr, MII_BMCR) | +- BMCR_PDOWN; +- netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, data); ++ data = netsec_phy_read(priv->mii_bus, priv->phy_addr, MII_BMCR); ++ netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, ++ data | BMCR_PDOWN); + + ret = netsec_reset_hardware(priv, true); + if (ret) + goto err2; + ++ /* Restore phy power state */ ++ netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, data); ++ + spin_lock_init(&priv->desc_ring[NETSEC_RING_TX].lock); + spin_lock_init(&priv->desc_ring[NETSEC_RING_RX].lock); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +index a5e0eff4a3874..9f5ccf1a0a540 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -1217,6 +1217,8 @@ static int sun8i_dwmac_probe(struct platform_device *pdev) + plat_dat->init = sun8i_dwmac_init; + plat_dat->exit = sun8i_dwmac_exit; + plat_dat->setup = sun8i_dwmac_setup; ++ plat_dat->tx_fifo_size = 4096; ++ plat_dat->rx_fifo_size = 16384; + + ret = sun8i_dwmac_set_syscon(&pdev->dev, plat_dat); + if (ret) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +index 2ecd3a8a690c2..cbf4429fb1d23 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +@@ -402,19 +402,53 @@ static void dwmac4_rd_set_tx_ic(struct dma_desc *p) + p->des2 |= cpu_to_le32(TDES2_INTERRUPT_ON_COMPLETION); + } + +-static void dwmac4_display_ring(void *head, unsigned int size, bool rx) ++static void dwmac4_display_ring(void *head, unsigned int size, bool rx, ++ dma_addr_t dma_rx_phy, unsigned int desc_size) + { +- struct dma_desc *p = (struct dma_desc *)head; ++ dma_addr_t dma_addr; + int i; + + pr_info("%s descriptor ring:\n", rx ? "RX" : "TX"); + +- for (i = 0; i < size; i++) { +- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", +- i, (unsigned int)virt_to_phys(p), +- le32_to_cpu(p->des0), le32_to_cpu(p->des1), +- le32_to_cpu(p->des2), le32_to_cpu(p->des3)); +- p++; ++ if (desc_size == sizeof(struct dma_desc)) { ++ struct dma_desc *p = (struct dma_desc *)head; ++ ++ for (i = 0; i < size; i++) { ++ dma_addr = dma_rx_phy + i * sizeof(*p); ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, ++ le32_to_cpu(p->des0), le32_to_cpu(p->des1), ++ le32_to_cpu(p->des2), le32_to_cpu(p->des3)); ++ p++; ++ } ++ } else if (desc_size == sizeof(struct dma_extended_desc)) { ++ struct dma_extended_desc *extp = (struct dma_extended_desc *)head; ++ ++ for (i = 0; i < size; i++) { ++ dma_addr = dma_rx_phy + i * sizeof(*extp); ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, ++ le32_to_cpu(extp->basic.des0), le32_to_cpu(extp->basic.des1), ++ le32_to_cpu(extp->basic.des2), le32_to_cpu(extp->basic.des3), ++ le32_to_cpu(extp->des4), le32_to_cpu(extp->des5), ++ le32_to_cpu(extp->des6), le32_to_cpu(extp->des7)); ++ extp++; ++ } ++ } else if (desc_size == sizeof(struct dma_edesc)) { ++ struct dma_edesc *ep = (struct dma_edesc *)head; ++ ++ for (i = 0; i < size; i++) { ++ dma_addr = dma_rx_phy + i * sizeof(*ep); ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, ++ le32_to_cpu(ep->des4), le32_to_cpu(ep->des5), ++ le32_to_cpu(ep->des6), le32_to_cpu(ep->des7), ++ le32_to_cpu(ep->basic.des0), le32_to_cpu(ep->basic.des1), ++ le32_to_cpu(ep->basic.des2), le32_to_cpu(ep->basic.des3)); ++ ep++; ++ } ++ } else { ++ pr_err("unsupported descriptor!"); + } + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +index d02cec296f51e..6650edfab5bc4 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -417,19 +417,22 @@ static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc, + } + } + +-static void enh_desc_display_ring(void *head, unsigned int size, bool rx) ++static void enh_desc_display_ring(void *head, unsigned int size, bool rx, ++ dma_addr_t dma_rx_phy, unsigned int desc_size) + { + struct dma_extended_desc *ep = (struct dma_extended_desc *)head; ++ dma_addr_t dma_addr; + int i; + + pr_info("Extended %s descriptor ring:\n", rx ? "RX" : "TX"); + + for (i = 0; i < size; i++) { + u64 x; ++ dma_addr = dma_rx_phy + i * sizeof(*ep); + + x = *(u64 *)ep; +- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", +- i, (unsigned int)virt_to_phys(ep), ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, + (unsigned int)x, (unsigned int)(x >> 32), + ep->basic.des2, ep->basic.des3); + ep++; +diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h +index 15d7b82611896..979ac9fca23c7 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h ++++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h +@@ -78,7 +78,8 @@ struct stmmac_desc_ops { + /* get rx timestamp status */ + int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats); + /* Display ring */ +- void (*display_ring)(void *head, unsigned int size, bool rx); ++ void (*display_ring)(void *head, unsigned int size, bool rx, ++ dma_addr_t dma_rx_phy, unsigned int desc_size); + /* set MSS via context descriptor */ + void (*set_mss)(struct dma_desc *p, unsigned int mss); + /* get descriptor skbuff address */ +diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +index f083360e4ba67..98ef43f35802a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +@@ -269,19 +269,22 @@ static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats) + return 1; + } + +-static void ndesc_display_ring(void *head, unsigned int size, bool rx) ++static void ndesc_display_ring(void *head, unsigned int size, bool rx, ++ dma_addr_t dma_rx_phy, unsigned int desc_size) + { + struct dma_desc *p = (struct dma_desc *)head; ++ dma_addr_t dma_addr; + int i; + + pr_info("%s descriptor ring:\n", rx ? "RX" : "TX"); + + for (i = 0; i < size; i++) { + u64 x; ++ dma_addr = dma_rx_phy + i * sizeof(*p); + + x = *(u64 *)p; +- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x", +- i, (unsigned int)virt_to_phys(p), ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x", ++ i, &dma_addr, + (unsigned int)x, (unsigned int)(x >> 32), + p->des2, p->des3); + p++; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index e87961432a793..4749bd0af1607 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1133,6 +1133,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) + static void stmmac_display_rx_rings(struct stmmac_priv *priv) + { + u32 rx_cnt = priv->plat->rx_queues_to_use; ++ unsigned int desc_size; + void *head_rx; + u32 queue; + +@@ -1142,19 +1143,24 @@ static void stmmac_display_rx_rings(struct stmmac_priv *priv) + + pr_info("\tRX Queue %u rings\n", queue); + +- if (priv->extend_desc) ++ if (priv->extend_desc) { + head_rx = (void *)rx_q->dma_erx; +- else ++ desc_size = sizeof(struct dma_extended_desc); ++ } else { + head_rx = (void *)rx_q->dma_rx; ++ desc_size = sizeof(struct dma_desc); ++ } + + /* Display RX ring */ +- stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true); ++ stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true, ++ rx_q->dma_rx_phy, desc_size); + } + } + + static void stmmac_display_tx_rings(struct stmmac_priv *priv) + { + u32 tx_cnt = priv->plat->tx_queues_to_use; ++ unsigned int desc_size; + void *head_tx; + u32 queue; + +@@ -1164,14 +1170,19 @@ static void stmmac_display_tx_rings(struct stmmac_priv *priv) + + pr_info("\tTX Queue %d rings\n", queue); + +- if (priv->extend_desc) ++ if (priv->extend_desc) { + head_tx = (void *)tx_q->dma_etx; +- else if (tx_q->tbs & STMMAC_TBS_AVAIL) ++ desc_size = sizeof(struct dma_extended_desc); ++ } else if (tx_q->tbs & STMMAC_TBS_AVAIL) { + head_tx = (void *)tx_q->dma_entx; +- else ++ desc_size = sizeof(struct dma_edesc); ++ } else { + head_tx = (void *)tx_q->dma_tx; ++ desc_size = sizeof(struct dma_desc); ++ } + +- stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false); ++ stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false, ++ tx_q->dma_tx_phy, desc_size); + } + } + +@@ -3740,18 +3751,23 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) + unsigned int count = 0, error = 0, len = 0; + int status = 0, coe = priv->hw->rx_csum; + unsigned int next_entry = rx_q->cur_rx; ++ unsigned int desc_size; + struct sk_buff *skb = NULL; + + if (netif_msg_rx_status(priv)) { + void *rx_head; + + netdev_dbg(priv->dev, "%s: descriptor ring:\n", __func__); +- if (priv->extend_desc) ++ if (priv->extend_desc) { + rx_head = (void *)rx_q->dma_erx; +- else ++ desc_size = sizeof(struct dma_extended_desc); ++ } else { + rx_head = (void *)rx_q->dma_rx; ++ desc_size = sizeof(struct dma_desc); ++ } + +- stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true); ++ stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true, ++ rx_q->dma_rx_phy, desc_size); + } + while (count < limit) { + unsigned int buf1_len = 0, buf2_len = 0; +@@ -4319,24 +4335,27 @@ static int stmmac_set_mac_address(struct net_device *ndev, void *addr) + static struct dentry *stmmac_fs_dir; + + static void sysfs_display_ring(void *head, int size, int extend_desc, +- struct seq_file *seq) ++ struct seq_file *seq, dma_addr_t dma_phy_addr) + { + int i; + struct dma_extended_desc *ep = (struct dma_extended_desc *)head; + struct dma_desc *p = (struct dma_desc *)head; ++ dma_addr_t dma_addr; + + for (i = 0; i < size; i++) { + if (extend_desc) { +- seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", +- i, (unsigned int)virt_to_phys(ep), ++ dma_addr = dma_phy_addr + i * sizeof(*ep); ++ seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, + le32_to_cpu(ep->basic.des0), + le32_to_cpu(ep->basic.des1), + le32_to_cpu(ep->basic.des2), + le32_to_cpu(ep->basic.des3)); + ep++; + } else { +- seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", +- i, (unsigned int)virt_to_phys(p), ++ dma_addr = dma_phy_addr + i * sizeof(*p); ++ seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, + le32_to_cpu(p->des0), le32_to_cpu(p->des1), + le32_to_cpu(p->des2), le32_to_cpu(p->des3)); + p++; +@@ -4364,11 +4383,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v) + if (priv->extend_desc) { + seq_printf(seq, "Extended descriptor ring:\n"); + sysfs_display_ring((void *)rx_q->dma_erx, +- priv->dma_rx_size, 1, seq); ++ priv->dma_rx_size, 1, seq, rx_q->dma_rx_phy); + } else { + seq_printf(seq, "Descriptor ring:\n"); + sysfs_display_ring((void *)rx_q->dma_rx, +- priv->dma_rx_size, 0, seq); ++ priv->dma_rx_size, 0, seq, rx_q->dma_rx_phy); + } + } + +@@ -4380,11 +4399,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v) + if (priv->extend_desc) { + seq_printf(seq, "Extended descriptor ring:\n"); + sysfs_display_ring((void *)tx_q->dma_etx, +- priv->dma_tx_size, 1, seq); ++ priv->dma_tx_size, 1, seq, tx_q->dma_tx_phy); + } else if (!(tx_q->tbs & STMMAC_TBS_AVAIL)) { + seq_printf(seq, "Descriptor ring:\n"); + sysfs_display_ring((void *)tx_q->dma_tx, +- priv->dma_tx_size, 0, seq); ++ priv->dma_tx_size, 0, seq, tx_q->dma_tx_phy); + } + } + +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 68695d4afacd5..707ccdd03b19e 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -3931,8 +3931,6 @@ static void niu_xmac_interrupt(struct niu *np) + mp->rx_mcasts += RXMAC_MC_FRM_CNT_COUNT; + if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP) + mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT; +- if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP) +- mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT; + if (val & XRXMAC_STATUS_RXHIST1_CNT_EXP) + mp->rx_hist_cnt1 += RXMAC_HIST_CNT1_COUNT; + if (val & XRXMAC_STATUS_RXHIST2_CNT_EXP) +diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c +index b8f4f419173f9..d054c6e83b1c9 100644 +--- a/drivers/net/ethernet/tehuti/tehuti.c ++++ b/drivers/net/ethernet/tehuti/tehuti.c +@@ -2044,6 +2044,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + /*bdx_hw_reset(priv); */ + if (bdx_read_mac(priv)) { + pr_err("load MAC address failed\n"); ++ err = -EFAULT; + goto err_out_iomap; + } + SET_NETDEV_DEV(ndev, &pdev->dev); +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index b4a0bfce5b762..4cd701a9277d7 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -1835,7 +1835,7 @@ static int axienet_probe(struct platform_device *pdev) + if (IS_ERR(lp->regs)) { + dev_err(&pdev->dev, "could not map Axi Ethernet regs.\n"); + ret = PTR_ERR(lp->regs); +- goto free_netdev; ++ goto cleanup_clk; + } + lp->regs_start = ethres->start; + +@@ -1910,12 +1910,12 @@ static int axienet_probe(struct platform_device *pdev) + break; + default: + ret = -EINVAL; +- goto free_netdev; ++ goto cleanup_clk; + } + } else { + ret = of_get_phy_mode(pdev->dev.of_node, &lp->phy_mode); + if (ret) +- goto free_netdev; ++ goto cleanup_clk; + } + + /* Find the DMA node, map the DMA registers, and decode the DMA IRQs */ +@@ -1928,7 +1928,7 @@ static int axienet_probe(struct platform_device *pdev) + dev_err(&pdev->dev, + "unable to get DMA resource\n"); + of_node_put(np); +- goto free_netdev; ++ goto cleanup_clk; + } + lp->dma_regs = devm_ioremap_resource(&pdev->dev, + &dmares); +@@ -1948,12 +1948,12 @@ static int axienet_probe(struct platform_device *pdev) + if (IS_ERR(lp->dma_regs)) { + dev_err(&pdev->dev, "could not map DMA regs\n"); + ret = PTR_ERR(lp->dma_regs); +- goto free_netdev; ++ goto cleanup_clk; + } + if ((lp->rx_irq <= 0) || (lp->tx_irq <= 0)) { + dev_err(&pdev->dev, "could not determine irqs\n"); + ret = -ENOMEM; +- goto free_netdev; ++ goto cleanup_clk; + } + + /* Autodetect the need for 64-bit DMA pointers. +@@ -1983,7 +1983,7 @@ static int axienet_probe(struct platform_device *pdev) + ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(addr_width)); + if (ret) { + dev_err(&pdev->dev, "No suitable DMA available\n"); +- goto free_netdev; ++ goto cleanup_clk; + } + + /* Check for Ethernet core IRQ (optional) */ +@@ -2014,12 +2014,12 @@ static int axienet_probe(struct platform_device *pdev) + if (!lp->phy_node) { + dev_err(&pdev->dev, "phy-handle required for 1000BaseX/SGMII\n"); + ret = -EINVAL; +- goto free_netdev; ++ goto cleanup_mdio; + } + lp->pcs_phy = of_mdio_find_device(lp->phy_node); + if (!lp->pcs_phy) { + ret = -EPROBE_DEFER; +- goto free_netdev; ++ goto cleanup_mdio; + } + lp->phylink_config.pcs_poll = true; + } +@@ -2033,17 +2033,30 @@ static int axienet_probe(struct platform_device *pdev) + if (IS_ERR(lp->phylink)) { + ret = PTR_ERR(lp->phylink); + dev_err(&pdev->dev, "phylink_create error (%i)\n", ret); +- goto free_netdev; ++ goto cleanup_mdio; + } + + ret = register_netdev(lp->ndev); + if (ret) { + dev_err(lp->dev, "register_netdev() error (%i)\n", ret); +- goto free_netdev; ++ goto cleanup_phylink; + } + + return 0; + ++cleanup_phylink: ++ phylink_destroy(lp->phylink); ++ ++cleanup_mdio: ++ if (lp->pcs_phy) ++ put_device(&lp->pcs_phy->dev); ++ if (lp->mii_bus) ++ axienet_mdio_teardown(lp); ++ of_node_put(lp->phy_node); ++ ++cleanup_clk: ++ clk_disable_unprepare(lp->clk); ++ + free_netdev: + free_netdev(ndev); + +diff --git a/drivers/net/ipa/ipa_qmi.c b/drivers/net/ipa/ipa_qmi.c +index 2fc64483f2753..e594bf3b600f0 100644 +--- a/drivers/net/ipa/ipa_qmi.c ++++ b/drivers/net/ipa/ipa_qmi.c +@@ -249,6 +249,7 @@ static const struct qmi_msg_handler ipa_server_msg_handlers[] = { + .decoded_size = IPA_QMI_DRIVER_INIT_COMPLETE_REQ_SZ, + .fn = ipa_server_driver_init_complete, + }, ++ { }, + }; + + /* Handle an INIT_DRIVER response message from the modem. */ +@@ -269,6 +270,7 @@ static const struct qmi_msg_handler ipa_client_msg_handlers[] = { + .decoded_size = IPA_QMI_INIT_DRIVER_RSP_SZ, + .fn = ipa_client_init_driver, + }, ++ { }, + }; + + /* Return a pointer to an init modem driver request structure, which contains +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index 8a4ec3222168c..07a98c3249421 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -26,7 +26,46 @@ MODULE_DESCRIPTION("Broadcom PHY driver"); + MODULE_AUTHOR("Maciej W. Rozycki"); + MODULE_LICENSE("GPL"); + +-static int bcm54xx_config_clock_delay(struct phy_device *phydev); ++static int bcm54xx_config_clock_delay(struct phy_device *phydev) ++{ ++ int rc, val; ++ ++ /* handling PHY's internal RX clock delay */ ++ val = bcm54xx_auxctl_read(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC); ++ val |= MII_BCM54XX_AUXCTL_MISC_WREN; ++ if (phydev->interface == PHY_INTERFACE_MODE_RGMII || ++ phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) { ++ /* Disable RGMII RXC-RXD skew */ ++ val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; ++ } ++ if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || ++ phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) { ++ /* Enable RGMII RXC-RXD skew */ ++ val |= MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; ++ } ++ rc = bcm54xx_auxctl_write(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC, ++ val); ++ if (rc < 0) ++ return rc; ++ ++ /* handling PHY's internal TX clock delay */ ++ val = bcm_phy_read_shadow(phydev, BCM54810_SHD_CLK_CTL); ++ if (phydev->interface == PHY_INTERFACE_MODE_RGMII || ++ phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) { ++ /* Disable internal TX clock delay */ ++ val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN; ++ } ++ if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || ++ phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) { ++ /* Enable internal TX clock delay */ ++ val |= BCM54810_SHD_CLK_CTL_GTXCLK_EN; ++ } ++ rc = bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val); ++ if (rc < 0) ++ return rc; ++ ++ return 0; ++} + + static int bcm54210e_config_init(struct phy_device *phydev) + { +@@ -64,45 +103,62 @@ static int bcm54612e_config_init(struct phy_device *phydev) + return 0; + } + +-static int bcm54xx_config_clock_delay(struct phy_device *phydev) ++static int bcm54616s_config_init(struct phy_device *phydev) + { + int rc, val; + +- /* handling PHY's internal RX clock delay */ ++ if (phydev->interface != PHY_INTERFACE_MODE_SGMII && ++ phydev->interface != PHY_INTERFACE_MODE_1000BASEX) ++ return 0; ++ ++ /* Ensure proper interface mode is selected. */ ++ /* Disable RGMII mode */ + val = bcm54xx_auxctl_read(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC); ++ if (val < 0) ++ return val; ++ val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN; + val |= MII_BCM54XX_AUXCTL_MISC_WREN; +- if (phydev->interface == PHY_INTERFACE_MODE_RGMII || +- phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) { +- /* Disable RGMII RXC-RXD skew */ +- val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; +- } +- if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || +- phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) { +- /* Enable RGMII RXC-RXD skew */ +- val |= MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; +- } + rc = bcm54xx_auxctl_write(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC, + val); + if (rc < 0) + return rc; + +- /* handling PHY's internal TX clock delay */ +- val = bcm_phy_read_shadow(phydev, BCM54810_SHD_CLK_CTL); +- if (phydev->interface == PHY_INTERFACE_MODE_RGMII || +- phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) { +- /* Disable internal TX clock delay */ +- val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN; +- } +- if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || +- phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) { +- /* Enable internal TX clock delay */ +- val |= BCM54810_SHD_CLK_CTL_GTXCLK_EN; +- } +- rc = bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val); ++ /* Select 1000BASE-X register set (primary SerDes) */ ++ val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_MODE); ++ if (val < 0) ++ return val; ++ val |= BCM54XX_SHD_MODE_1000BX; ++ rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val); + if (rc < 0) + return rc; + +- return 0; ++ /* Power down SerDes interface */ ++ rc = phy_set_bits(phydev, MII_BMCR, BMCR_PDOWN); ++ if (rc < 0) ++ return rc; ++ ++ /* Select proper interface mode */ ++ val &= ~BCM54XX_SHD_INTF_SEL_MASK; ++ val |= phydev->interface == PHY_INTERFACE_MODE_SGMII ? ++ BCM54XX_SHD_INTF_SEL_SGMII : ++ BCM54XX_SHD_INTF_SEL_GBIC; ++ rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val); ++ if (rc < 0) ++ return rc; ++ ++ /* Power up SerDes interface */ ++ rc = phy_clear_bits(phydev, MII_BMCR, BMCR_PDOWN); ++ if (rc < 0) ++ return rc; ++ ++ /* Select copper register set */ ++ val &= ~BCM54XX_SHD_MODE_1000BX; ++ rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val); ++ if (rc < 0) ++ return rc; ++ ++ /* Power up copper interface */ ++ return phy_clear_bits(phydev, MII_BMCR, BMCR_PDOWN); + } + + /* Needs SMDSP clock enabled via bcm54xx_phydsp_config() */ +@@ -283,15 +339,21 @@ static int bcm54xx_config_init(struct phy_device *phydev) + + bcm54xx_adjust_rxrefclk(phydev); + +- if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E) { ++ switch (BRCM_PHY_MODEL(phydev)) { ++ case PHY_ID_BCM50610: ++ case PHY_ID_BCM50610M: ++ err = bcm54xx_config_clock_delay(phydev); ++ break; ++ case PHY_ID_BCM54210E: + err = bcm54210e_config_init(phydev); +- if (err) +- return err; +- } else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54612E) { ++ break; ++ case PHY_ID_BCM54612E: + err = bcm54612e_config_init(phydev); +- if (err) +- return err; +- } else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54810) { ++ break; ++ case PHY_ID_BCM54616S: ++ err = bcm54616s_config_init(phydev); ++ break; ++ case PHY_ID_BCM54810: + /* For BCM54810, we need to disable BroadR-Reach function */ + val = bcm_phy_read_exp(phydev, + BCM54810_EXP_BROADREACH_LRE_MISC_CTL); +@@ -299,9 +361,10 @@ static int bcm54xx_config_init(struct phy_device *phydev) + err = bcm_phy_write_exp(phydev, + BCM54810_EXP_BROADREACH_LRE_MISC_CTL, + val); +- if (err < 0) +- return err; ++ break; + } ++ if (err) ++ return err; + + bcm54xx_phydsp_config(phydev); + +@@ -332,6 +395,11 @@ static int bcm54xx_resume(struct phy_device *phydev) + if (ret < 0) + return ret; + ++ /* Upon exiting power down, the PHY remains in an internal reset state ++ * for 40us ++ */ ++ fsleep(40); ++ + return bcm54xx_config_init(phydev); + } + +@@ -475,7 +543,7 @@ static int bcm5481_config_aneg(struct phy_device *phydev) + + static int bcm54616s_probe(struct phy_device *phydev) + { +- int val, intf_sel; ++ int val; + + val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_MODE); + if (val < 0) +@@ -487,8 +555,7 @@ static int bcm54616s_probe(struct phy_device *phydev) + * RGMII-1000Base-X is properly supported, but RGMII-100Base-FX + * support is still missing as of now. + */ +- intf_sel = (val & BCM54XX_SHD_INTF_SEL_MASK) >> 1; +- if (intf_sel == 1) { ++ if ((val & BCM54XX_SHD_INTF_SEL_MASK) == BCM54XX_SHD_INTF_SEL_RGMII) { + val = bcm_phy_read_shadow(phydev, BCM54616S_SHD_100FX_CTRL); + if (val < 0) + return val; +@@ -500,6 +567,8 @@ static int bcm54616s_probe(struct phy_device *phydev) + */ + if (!(val & BCM54616S_100FX_MODE)) + phydev->dev_flags |= PHY_BCM_FLAGS_MODE_1000BX; ++ ++ phydev->port = PORT_FIBRE; + } + + return 0; +diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c +index 423952cb9e1cd..f7a2ec150e542 100644 +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -555,6 +555,9 @@ static int dp83822_probe(struct phy_device *phydev) + + dp83822_of_init(phydev); + ++ if (dp83822->fx_enabled) ++ phydev->port = PORT_FIBRE; ++ + return 0; + } + +diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c +index b30bc142d82e5..755220c6451fb 100644 +--- a/drivers/net/phy/dp83869.c ++++ b/drivers/net/phy/dp83869.c +@@ -855,6 +855,10 @@ static int dp83869_probe(struct phy_device *phydev) + if (ret) + return ret; + ++ if (dp83869->mode == DP83869_RGMII_100_BASE || ++ dp83869->mode == DP83869_RGMII_1000_BASE) ++ phydev->port = PORT_FIBRE; ++ + return dp83869_config_init(phydev); + } + +diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c +index 0ee23d29c0d42..bde3356a2f86e 100644 +--- a/drivers/net/phy/lxt.c ++++ b/drivers/net/phy/lxt.c +@@ -292,6 +292,7 @@ static int lxt973_probe(struct phy_device *phydev) + phy_write(phydev, MII_BMCR, val); + /* Remember that the port is in fiber mode. */ + phydev->priv = lxt973_probe; ++ phydev->port = PORT_FIBRE; + } else { + phydev->priv = NULL; + } +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index 620052c023a56..2afef45d15b12 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -1552,6 +1552,7 @@ static int marvell_read_status_page(struct phy_device *phydev, int page) + phydev->asym_pause = 0; + phydev->speed = SPEED_UNKNOWN; + phydev->duplex = DUPLEX_UNKNOWN; ++ phydev->port = fiber ? PORT_FIBRE : PORT_TP; + + if (phydev->autoneg == AUTONEG_ENABLE) + err = marvell_read_status_page_an(phydev, fiber, status); +diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c +index 1901ba277413d..b1bb9b8e1e4ed 100644 +--- a/drivers/net/phy/marvell10g.c ++++ b/drivers/net/phy/marvell10g.c +@@ -631,6 +631,7 @@ static int mv3310_read_status_10gbaser(struct phy_device *phydev) + phydev->link = 1; + phydev->speed = SPEED_10000; + phydev->duplex = DUPLEX_FULL; ++ phydev->port = PORT_FIBRE; + + return 0; + } +@@ -690,6 +691,7 @@ static int mv3310_read_status_copper(struct phy_device *phydev) + + phydev->duplex = cssr1 & MV_PCS_CSSR1_DUPLEX_FULL ? + DUPLEX_FULL : DUPLEX_HALF; ++ phydev->port = PORT_TP; + phydev->mdix = cssr1 & MV_PCS_CSSR1_MDIX ? + ETH_TP_MDI_X : ETH_TP_MDI; + +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 57f8021b70af5..a6c691938f946 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -341,14 +341,19 @@ static int kszphy_config_init(struct phy_device *phydev) + return kszphy_config_reset(phydev); + } + ++static int ksz8041_fiber_mode(struct phy_device *phydev) ++{ ++ struct device_node *of_node = phydev->mdio.dev.of_node; ++ ++ return of_property_read_bool(of_node, "micrel,fiber-mode"); ++} ++ + static int ksz8041_config_init(struct phy_device *phydev) + { + __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, }; + +- struct device_node *of_node = phydev->mdio.dev.of_node; +- + /* Limit supported and advertised modes in fiber mode */ +- if (of_property_read_bool(of_node, "micrel,fiber-mode")) { ++ if (ksz8041_fiber_mode(phydev)) { + phydev->dev_flags |= MICREL_PHY_FXEN; + linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, mask); + linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Half_BIT, mask); +@@ -1176,6 +1181,9 @@ static int kszphy_probe(struct phy_device *phydev) + } + } + ++ if (ksz8041_fiber_mode(phydev)) ++ phydev->port = PORT_FIBRE; ++ + /* Support legacy board-file configuration */ + if (phydev->dev_flags & MICREL_PHY_50MHZ_CLK) { + priv->rmii_ref_clk_sel = true; +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index b79c4068ee619..c93c295db3dc2 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -310,7 +310,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev, + if (phydev->interface == PHY_INTERFACE_MODE_MOCA) + cmd->base.port = PORT_BNC; + else +- cmd->base.port = PORT_MII; ++ cmd->base.port = phydev->port; + cmd->base.transceiver = phy_is_internal(phydev) ? + XCVR_INTERNAL : XCVR_EXTERNAL; + cmd->base.phy_address = phydev->mdio.addr; +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 1c6ae845e03f2..d2fd54e4c6123 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -576,6 +576,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + dev->pause = 0; + dev->asym_pause = 0; + dev->link = 0; ++ dev->port = PORT_TP; + dev->interface = PHY_INTERFACE_MODE_GMII; + + dev->autoneg = AUTONEG_ENABLE; +@@ -1382,6 +1383,14 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, + + phydev->state = PHY_READY; + ++ /* Port is set to PORT_TP by default and the actual PHY driver will set ++ * it to different value depending on the PHY configuration. If we have ++ * the generic PHY driver we can't figure it out, thus set the old ++ * legacy PORT_MII value. ++ */ ++ if (using_genphy) ++ phydev->port = PORT_MII; ++ + /* Initial carrier state is off as the phy is about to be + * (re)initialized. + */ +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 84f6e197f965d..add9156601af8 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -472,7 +472,7 @@ static void phylink_major_config(struct phylink *pl, bool restart, + err = pl->mac_ops->mac_finish(pl->config, pl->cur_link_an_mode, + state->interface); + if (err < 0) +- phylink_err(pl, "mac_prepare failed: %pe\n", ++ phylink_err(pl, "mac_finish failed: %pe\n", + ERR_PTR(err)); + } + } +diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c +index 02e6bbb17b15d..8d1f69dad6031 100644 +--- a/drivers/net/usb/cdc-phonet.c ++++ b/drivers/net/usb/cdc-phonet.c +@@ -387,6 +387,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i + + err = register_netdev(dev); + if (err) { ++ /* Set disconnected flag so that disconnect() returns early. */ ++ pnd->disconnected = 1; + usb_driver_release_interface(&usbpn_driver, data_intf); + goto out; + } +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 67cd6986634fb..390d9e1fa7fe7 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3016,29 +3016,6 @@ static void __rtl_set_wol(struct r8152 *tp, u32 wolopts) + device_set_wakeup_enable(&tp->udev->dev, false); + } + +-static void r8153_mac_clk_spd(struct r8152 *tp, bool enable) +-{ +- /* MAC clock speed down */ +- if (enable) { +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, +- ALDPS_SPDWN_RATIO); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, +- EEE_SPDWN_RATIO); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, +- PKT_AVAIL_SPDWN_EN | SUSPEND_SPDWN_EN | +- U1U2_SPDWN_EN | L1_SPDWN_EN); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, +- PWRSAVE_SPDWN_EN | RXDV_SPDWN_EN | TX10MIDLE_EN | +- TP100_SPDWN_EN | TP500_SPDWN_EN | EEE_SPDWN_EN | +- TP1000_SPDWN_EN); +- } else { +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0); +- } +-} +- + static void r8153_u1u2en(struct r8152 *tp, bool enable) + { + u8 u1u2[8]; +@@ -3338,11 +3315,9 @@ static void rtl8153_runtime_enable(struct r8152 *tp, bool enable) + if (enable) { + r8153_u1u2en(tp, false); + r8153_u2p3en(tp, false); +- r8153_mac_clk_spd(tp, true); + rtl_runtime_suspend_enable(tp, true); + } else { + rtl_runtime_suspend_enable(tp, false); +- r8153_mac_clk_spd(tp, false); + + switch (tp->version) { + case RTL_VER_03: +@@ -4678,7 +4653,6 @@ static void r8153_first_init(struct r8152 *tp) + { + u32 ocp_data; + +- r8153_mac_clk_spd(tp, false); + rxdy_gated_en(tp, true); + r8153_teredo_off(tp); + +@@ -4729,8 +4703,6 @@ static void r8153_enter_oob(struct r8152 *tp) + { + u32 ocp_data; + +- r8153_mac_clk_spd(tp, true); +- + ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL); + ocp_data &= ~NOW_IS_OOB; + ocp_write_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL, ocp_data); +@@ -5456,10 +5428,15 @@ static void r8153_init(struct r8152 *tp) + + ocp_write_word(tp, MCU_TYPE_USB, USB_CONNECT_TIMER, 0x0001); + ++ /* MAC clock speed down */ ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0); ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0); ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0); ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0); ++ + r8153_power_cut_en(tp, false); + rtl_runtime_suspend_enable(tp, false); + r8153_u1u2en(tp, true); +- r8153_mac_clk_spd(tp, false); + usb_enable_lpm(tp->udev); + + ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6); +@@ -6525,7 +6502,10 @@ static int rtl_ops_init(struct r8152 *tp) + ops->in_nway = rtl8153_in_nway; + ops->hw_phy_cfg = r8153_hw_phy_cfg; + ops->autosuspend_en = rtl8153_runtime_enable; +- tp->rx_buf_sz = 32 * 1024; ++ if (tp->udev->speed < USB_SPEED_SUPER) ++ tp->rx_buf_sz = 16 * 1024; ++ else ++ tp->rx_buf_sz = 32 * 1024; + tp->eee_en = true; + tp->eee_adv = MDIO_EEE_1000T | MDIO_EEE_100TX; + break; +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 02bfcdf50a7ac..36abe756282ea 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -301,8 +301,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) + if (rxq < rcv->real_num_rx_queues) { + rq = &rcv_priv->rq[rxq]; + rcv_xdp = rcu_access_pointer(rq->xdp_prog); +- if (rcv_xdp) +- skb_record_rx_queue(skb, rxq); ++ skb_record_rx_queue(skb, rxq); + } + + skb_tx_timestamp(skb); +diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c +index dca97cd7c4e75..7eac6a3e1cdee 100644 +--- a/drivers/net/wan/fsl_ucc_hdlc.c ++++ b/drivers/net/wan/fsl_ucc_hdlc.c +@@ -204,14 +204,18 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) + priv->rx_skbuff = kcalloc(priv->rx_ring_size, + sizeof(*priv->rx_skbuff), + GFP_KERNEL); +- if (!priv->rx_skbuff) ++ if (!priv->rx_skbuff) { ++ ret = -ENOMEM; + goto free_ucc_pram; ++ } + + priv->tx_skbuff = kcalloc(priv->tx_ring_size, + sizeof(*priv->tx_skbuff), + GFP_KERNEL); +- if (!priv->tx_skbuff) ++ if (!priv->tx_skbuff) { ++ ret = -ENOMEM; + goto free_rx_skbuff; ++ } + + priv->skb_curtx = 0; + priv->skb_dirtytx = 0; +diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c +index 4aaa6388b9ee0..5a6a945f6c814 100644 +--- a/drivers/net/wan/hdlc_x25.c ++++ b/drivers/net/wan/hdlc_x25.c +@@ -23,6 +23,8 @@ + + struct x25_state { + x25_hdlc_proto settings; ++ bool up; ++ spinlock_t up_lock; /* Protects "up" */ + }; + + static int x25_ioctl(struct net_device *dev, struct ifreq *ifr); +@@ -104,6 +106,8 @@ static void x25_data_transmit(struct net_device *dev, struct sk_buff *skb) + + static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) + { ++ hdlc_device *hdlc = dev_to_hdlc(dev); ++ struct x25_state *x25st = state(hdlc); + int result; + + /* There should be a pseudo header of 1 byte added by upper layers. +@@ -114,11 +118,19 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_OK; + } + ++ spin_lock_bh(&x25st->up_lock); ++ if (!x25st->up) { ++ spin_unlock_bh(&x25st->up_lock); ++ kfree_skb(skb); ++ return NETDEV_TX_OK; ++ } ++ + switch (skb->data[0]) { + case X25_IFACE_DATA: /* Data to be transmitted */ + skb_pull(skb, 1); + if ((result = lapb_data_request(dev, skb)) != LAPB_OK) + dev_kfree_skb(skb); ++ spin_unlock_bh(&x25st->up_lock); + return NETDEV_TX_OK; + + case X25_IFACE_CONNECT: +@@ -147,6 +159,7 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) + break; + } + ++ spin_unlock_bh(&x25st->up_lock); + dev_kfree_skb(skb); + return NETDEV_TX_OK; + } +@@ -164,6 +177,7 @@ static int x25_open(struct net_device *dev) + .data_transmit = x25_data_transmit, + }; + hdlc_device *hdlc = dev_to_hdlc(dev); ++ struct x25_state *x25st = state(hdlc); + struct lapb_parms_struct params; + int result; + +@@ -190,6 +204,10 @@ static int x25_open(struct net_device *dev) + if (result != LAPB_OK) + return -EINVAL; + ++ spin_lock_bh(&x25st->up_lock); ++ x25st->up = true; ++ spin_unlock_bh(&x25st->up_lock); ++ + return 0; + } + +@@ -197,6 +215,13 @@ static int x25_open(struct net_device *dev) + + static void x25_close(struct net_device *dev) + { ++ hdlc_device *hdlc = dev_to_hdlc(dev); ++ struct x25_state *x25st = state(hdlc); ++ ++ spin_lock_bh(&x25st->up_lock); ++ x25st->up = false; ++ spin_unlock_bh(&x25st->up_lock); ++ + lapb_unregister(dev); + } + +@@ -205,15 +230,28 @@ static void x25_close(struct net_device *dev) + static int x25_rx(struct sk_buff *skb) + { + struct net_device *dev = skb->dev; ++ hdlc_device *hdlc = dev_to_hdlc(dev); ++ struct x25_state *x25st = state(hdlc); + + if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) { + dev->stats.rx_dropped++; + return NET_RX_DROP; + } + +- if (lapb_data_received(dev, skb) == LAPB_OK) ++ spin_lock_bh(&x25st->up_lock); ++ if (!x25st->up) { ++ spin_unlock_bh(&x25st->up_lock); ++ kfree_skb(skb); ++ dev->stats.rx_dropped++; ++ return NET_RX_DROP; ++ } ++ ++ if (lapb_data_received(dev, skb) == LAPB_OK) { ++ spin_unlock_bh(&x25st->up_lock); + return NET_RX_SUCCESS; ++ } + ++ spin_unlock_bh(&x25st->up_lock); + dev->stats.rx_errors++; + dev_kfree_skb_any(skb); + return NET_RX_DROP; +@@ -298,6 +336,8 @@ static int x25_ioctl(struct net_device *dev, struct ifreq *ifr) + return result; + + memcpy(&state(hdlc)->settings, &new_settings, size); ++ state(hdlc)->up = false; ++ spin_lock_init(&state(hdlc)->up_lock); + + /* There's no header_ops so hard_header_len should be 0. */ + dev->hard_header_len = 0; +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index 9bf13994c036b..680c899a96d77 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -345,7 +345,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, + }; + struct ieee80211_hw *hw; + int len, n = 0, ret = -ENOMEM; +- struct mt76_queue_entry e; + struct mt76_txwi_cache *t; + struct sk_buff *iter; + dma_addr_t addr; +@@ -387,6 +386,11 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, + } + tx_info.nbuf = n; + ++ if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) { ++ ret = -ENOMEM; ++ goto unmap; ++ } ++ + dma_sync_single_for_cpu(dev->dev, t->dma_addr, dev->drv->txwi_size, + DMA_TO_DEVICE); + ret = dev->drv->tx_prepare_skb(dev, txwi, q->qid, wcid, sta, &tx_info); +@@ -395,11 +399,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, + if (ret < 0) + goto unmap; + +- if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) { +- ret = -ENOMEM; +- goto unmap; +- } +- + return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf, + tx_info.info, tx_info.skb, t); + +@@ -415,9 +414,7 @@ free: + dev->test.tx_done--; + #endif + +- e.skb = tx_info.skb; +- e.txwi = t; +- dev->drv->tx_complete_skb(dev, &e); ++ dev_kfree_skb(tx_info.skb); + mt76_put_txwi(dev, t); + return ret; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +index 1b4d65310b887..c9dd6867e1251 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +@@ -957,11 +957,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + } + txp->nbuf = nbuf; + +- /* pass partial skb header to fw */ +- tx_info->buf[1].len = MT_CT_PARSE_LEN; +- tx_info->buf[1].skip_unmap = true; +- tx_info->nbuf = MT_CT_DMA_BUF_NUM; +- + txp->flags = cpu_to_le16(MT_CT_INFO_APPLY_TXD | MT_CT_INFO_FROM_HOST); + + if (!key) +@@ -999,6 +994,11 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + txp->rept_wds_wcid = cpu_to_le16(0x3ff); + tx_info->skb = DMA_DUMMY_DATA; + ++ /* pass partial skb header to fw */ ++ tx_info->buf[1].len = MT_CT_PARSE_LEN; ++ tx_info->buf[1].skip_unmap = true; ++ tx_info->nbuf = MT_CT_DMA_BUF_NUM; ++ + return 0; + } + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index f848ba16427eb..6199bce5d3a4f 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -366,6 +366,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved) + return true; + + nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD; ++ nvme_req(req)->flags |= NVME_REQ_CANCELLED; + blk_mq_complete_request(req); + return true; + } +@@ -1425,7 +1426,7 @@ static int nvme_identify_ns(struct nvme_ctrl *ctrl, unsigned nsid, + goto out_free_id; + } + +- error = -ENODEV; ++ error = NVME_SC_INVALID_NS | NVME_SC_DNR; + if ((*id)->ncap == 0) /* namespace not allocated or attached */ + goto out_free_id; + +@@ -4011,7 +4012,7 @@ static void nvme_ns_remove_by_nsid(struct nvme_ctrl *ctrl, u32 nsid) + static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids) + { + struct nvme_id_ns *id; +- int ret = -ENODEV; ++ int ret = NVME_SC_INVALID_NS | NVME_SC_DNR; + + if (test_bit(NVME_NS_DEAD, &ns->flags)) + goto out; +@@ -4020,7 +4021,7 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids) + if (ret) + goto out; + +- ret = -ENODEV; ++ ret = NVME_SC_INVALID_NS | NVME_SC_DNR; + if (!nvme_ns_ids_equal(&ns->head->ids, ids)) { + dev_err(ns->ctrl->device, + "identifiers changed for nsid %d\n", ns->head->ns_id); +@@ -4038,7 +4039,7 @@ out: + * + * TODO: we should probably schedule a delayed retry here. + */ +- if (ret && ret != -ENOMEM && !(ret > 0 && !(ret & NVME_SC_DNR))) ++ if (ret > 0 && (ret & NVME_SC_DNR)) + nvme_ns_remove(ns); + } + +@@ -4068,6 +4069,12 @@ static void nvme_validate_or_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) + nsid); + break; + } ++ if (!nvme_multi_css(ctrl)) { ++ dev_warn(ctrl->device, ++ "command set not reported for nsid: %d\n", ++ nsid); ++ break; ++ } + nvme_alloc_ns(ctrl, nsid, &ids); + break; + default: +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 7ec6869b3e5b1..ca75338f23675 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1956,7 +1956,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req) + sizeof(op->rsp_iu), DMA_FROM_DEVICE); + + if (opstate == FCPOP_STATE_ABORTED) +- status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1); ++ status = cpu_to_le16(NVME_SC_HOST_ABORTED_CMD << 1); + else if (freq->status) { + status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1); + dev_info(ctrl->ctrl.device, +@@ -2443,6 +2443,7 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved) + struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl); + struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req); + ++ op->nreq.flags |= NVME_REQ_CANCELLED; + __nvme_fc_abort_op(ctrl, op); + return true; + } +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 806a5d071ef65..514dfd6300353 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3242,6 +3242,7 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, + { PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */ + .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY | ++ NVME_QUIRK_DISABLE_WRITE_ZEROES| + NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */ + .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, }, +diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c +index 06b6b742bb213..6c1f3ab7649c7 100644 +--- a/drivers/nvme/target/rdma.c ++++ b/drivers/nvme/target/rdma.c +@@ -802,9 +802,8 @@ static void nvmet_rdma_write_data_done(struct ib_cq *cq, struct ib_wc *wc) + nvmet_req_uninit(&rsp->req); + nvmet_rdma_release_rsp(rsp); + if (wc->status != IB_WC_WR_FLUSH_ERR) { +- pr_info("RDMA WRITE for CQE 0x%p failed with status %s (%d).\n", +- wc->wr_cqe, ib_wc_status_msg(wc->status), +- wc->status); ++ pr_info("RDMA WRITE for CQE failed with status %s (%d).\n", ++ ib_wc_status_msg(wc->status), wc->status); + nvmet_rdma_error_comp(queue); + } + return; +diff --git a/drivers/platform/x86/dell-wmi-sysman/enum-attributes.c b/drivers/platform/x86/dell-wmi-sysman/enum-attributes.c +index 80f4b7785c6c9..091e48c217ed8 100644 +--- a/drivers/platform/x86/dell-wmi-sysman/enum-attributes.c ++++ b/drivers/platform/x86/dell-wmi-sysman/enum-attributes.c +@@ -185,5 +185,8 @@ void exit_enum_attributes(void) + sysfs_remove_group(wmi_priv.enumeration_data[instance_id].attr_name_kobj, + &enumeration_attr_group); + } ++ wmi_priv.enumeration_instances_count = 0; ++ + kfree(wmi_priv.enumeration_data); ++ wmi_priv.enumeration_data = NULL; + } +diff --git a/drivers/platform/x86/dell-wmi-sysman/int-attributes.c b/drivers/platform/x86/dell-wmi-sysman/int-attributes.c +index 75aedbb733be2..8a49ba6e44f9a 100644 +--- a/drivers/platform/x86/dell-wmi-sysman/int-attributes.c ++++ b/drivers/platform/x86/dell-wmi-sysman/int-attributes.c +@@ -175,5 +175,8 @@ void exit_int_attributes(void) + sysfs_remove_group(wmi_priv.integer_data[instance_id].attr_name_kobj, + &integer_attr_group); + } ++ wmi_priv.integer_instances_count = 0; ++ + kfree(wmi_priv.integer_data); ++ wmi_priv.integer_data = NULL; + } +diff --git a/drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c b/drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c +index 3abcd95477c07..834b3e82ad9f9 100644 +--- a/drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c ++++ b/drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c +@@ -183,5 +183,8 @@ void exit_po_attributes(void) + sysfs_remove_group(wmi_priv.po_data[instance_id].attr_name_kobj, + &po_attr_group); + } ++ wmi_priv.po_instances_count = 0; ++ + kfree(wmi_priv.po_data); ++ wmi_priv.po_data = NULL; + } +diff --git a/drivers/platform/x86/dell-wmi-sysman/string-attributes.c b/drivers/platform/x86/dell-wmi-sysman/string-attributes.c +index ac75dce88a4c4..552537852459a 100644 +--- a/drivers/platform/x86/dell-wmi-sysman/string-attributes.c ++++ b/drivers/platform/x86/dell-wmi-sysman/string-attributes.c +@@ -155,5 +155,8 @@ void exit_str_attributes(void) + sysfs_remove_group(wmi_priv.str_data[instance_id].attr_name_kobj, + &str_attr_group); + } ++ wmi_priv.str_instances_count = 0; ++ + kfree(wmi_priv.str_data); ++ wmi_priv.str_data = NULL; + } +diff --git a/drivers/platform/x86/dell-wmi-sysman/sysman.c b/drivers/platform/x86/dell-wmi-sysman/sysman.c +index cb81010ba1a21..7410ccae650c2 100644 +--- a/drivers/platform/x86/dell-wmi-sysman/sysman.c ++++ b/drivers/platform/x86/dell-wmi-sysman/sysman.c +@@ -210,25 +210,17 @@ static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot); + */ + static int create_attributes_level_sysfs_files(void) + { +- int ret = sysfs_create_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); ++ int ret; + +- if (ret) { +- pr_debug("could not create reset_bios file\n"); ++ ret = sysfs_create_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); ++ if (ret) + return ret; +- } + + ret = sysfs_create_file(&wmi_priv.main_dir_kset->kobj, &pending_reboot.attr); +- if (ret) { +- pr_debug("could not create changing_pending_reboot file\n"); +- sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); +- } +- return ret; +-} ++ if (ret) ++ return ret; + +-static void release_reset_bios_data(void) +-{ +- sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); +- sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &pending_reboot.attr); ++ return 0; + } + + static ssize_t wmi_sysman_attr_show(struct kobject *kobj, struct attribute *attr, +@@ -373,8 +365,6 @@ static void destroy_attribute_objs(struct kset *kset) + */ + static void release_attributes_data(void) + { +- release_reset_bios_data(); +- + mutex_lock(&wmi_priv.mutex); + exit_enum_attributes(); + exit_int_attributes(); +@@ -386,11 +376,13 @@ static void release_attributes_data(void) + wmi_priv.authentication_dir_kset = NULL; + } + if (wmi_priv.main_dir_kset) { ++ sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); ++ sysfs_remove_file(&wmi_priv.main_dir_kset->kobj, &pending_reboot.attr); + destroy_attribute_objs(wmi_priv.main_dir_kset); + kset_unregister(wmi_priv.main_dir_kset); ++ wmi_priv.main_dir_kset = NULL; + } + mutex_unlock(&wmi_priv.mutex); +- + } + + /** +@@ -497,7 +489,6 @@ nextobj: + + err_attr_init: + mutex_unlock(&wmi_priv.mutex); +- release_attributes_data(); + kfree(obj); + return retval; + } +@@ -513,102 +504,91 @@ static int __init sysman_init(void) + } + + ret = init_bios_attr_set_interface(); +- if (ret || !wmi_priv.bios_attr_wdev) { +- pr_debug("failed to initialize set interface\n"); +- goto fail_set_interface; +- } ++ if (ret) ++ return ret; + + ret = init_bios_attr_pass_interface(); +- if (ret || !wmi_priv.password_attr_wdev) { +- pr_debug("failed to initialize pass interface\n"); +- goto fail_pass_interface; ++ if (ret) ++ goto err_exit_bios_attr_set_interface; ++ ++ if (!wmi_priv.bios_attr_wdev || !wmi_priv.password_attr_wdev) { ++ pr_debug("failed to find set or pass interface\n"); ++ ret = -ENODEV; ++ goto err_exit_bios_attr_pass_interface; + } + + ret = class_register(&firmware_attributes_class); + if (ret) +- goto fail_class; ++ goto err_exit_bios_attr_pass_interface; + + wmi_priv.class_dev = device_create(&firmware_attributes_class, NULL, MKDEV(0, 0), + NULL, "%s", DRIVER_NAME); + if (IS_ERR(wmi_priv.class_dev)) { + ret = PTR_ERR(wmi_priv.class_dev); +- goto fail_classdev; ++ goto err_unregister_class; + } + + wmi_priv.main_dir_kset = kset_create_and_add("attributes", NULL, + &wmi_priv.class_dev->kobj); + if (!wmi_priv.main_dir_kset) { + ret = -ENOMEM; +- goto fail_main_kset; ++ goto err_destroy_classdev; + } + + wmi_priv.authentication_dir_kset = kset_create_and_add("authentication", NULL, + &wmi_priv.class_dev->kobj); + if (!wmi_priv.authentication_dir_kset) { + ret = -ENOMEM; +- goto fail_authentication_kset; ++ goto err_release_attributes_data; + } + + ret = create_attributes_level_sysfs_files(); + if (ret) { + pr_debug("could not create reset BIOS attribute\n"); +- goto fail_reset_bios; ++ goto err_release_attributes_data; + } + + ret = init_bios_attributes(ENUM, DELL_WMI_BIOS_ENUMERATION_ATTRIBUTE_GUID); + if (ret) { + pr_debug("failed to populate enumeration type attributes\n"); +- goto fail_create_group; ++ goto err_release_attributes_data; + } + + ret = init_bios_attributes(INT, DELL_WMI_BIOS_INTEGER_ATTRIBUTE_GUID); + if (ret) { + pr_debug("failed to populate integer type attributes\n"); +- goto fail_create_group; ++ goto err_release_attributes_data; + } + + ret = init_bios_attributes(STR, DELL_WMI_BIOS_STRING_ATTRIBUTE_GUID); + if (ret) { + pr_debug("failed to populate string type attributes\n"); +- goto fail_create_group; ++ goto err_release_attributes_data; + } + + ret = init_bios_attributes(PO, DELL_WMI_BIOS_PASSOBJ_ATTRIBUTE_GUID); + if (ret) { + pr_debug("failed to populate pass object type attributes\n"); +- goto fail_create_group; ++ goto err_release_attributes_data; + } + + return 0; + +-fail_create_group: ++err_release_attributes_data: + release_attributes_data(); + +-fail_reset_bios: +- if (wmi_priv.authentication_dir_kset) { +- kset_unregister(wmi_priv.authentication_dir_kset); +- wmi_priv.authentication_dir_kset = NULL; +- } +- +-fail_authentication_kset: +- if (wmi_priv.main_dir_kset) { +- kset_unregister(wmi_priv.main_dir_kset); +- wmi_priv.main_dir_kset = NULL; +- } +- +-fail_main_kset: ++err_destroy_classdev: + device_destroy(&firmware_attributes_class, MKDEV(0, 0)); + +-fail_classdev: ++err_unregister_class: + class_unregister(&firmware_attributes_class); + +-fail_class: ++err_exit_bios_attr_pass_interface: + exit_bios_attr_pass_interface(); + +-fail_pass_interface: ++err_exit_bios_attr_set_interface: + exit_bios_attr_set_interface(); + +-fail_set_interface: + return ret; + } + +diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c +index 30a9062d2b4b8..a90c32d072da3 100644 +--- a/drivers/platform/x86/intel-vbtn.c ++++ b/drivers/platform/x86/intel-vbtn.c +@@ -47,8 +47,16 @@ static const struct key_entry intel_vbtn_keymap[] = { + }; + + static const struct key_entry intel_vbtn_switchmap[] = { +- { KE_SW, 0xCA, { .sw = { SW_DOCK, 1 } } }, /* Docked */ +- { KE_SW, 0xCB, { .sw = { SW_DOCK, 0 } } }, /* Undocked */ ++ /* ++ * SW_DOCK should only be reported for docking stations, but DSDTs using the ++ * intel-vbtn code, always seem to use this for 2-in-1s / convertibles and set ++ * SW_DOCK=1 when in laptop-mode (in tandem with setting SW_TABLET_MODE=0). ++ * This causes userspace to think the laptop is docked to a port-replicator ++ * and to disable suspend-on-lid-close, which is undesirable. ++ * Map the dock events to KEY_IGNORE to avoid this broken SW_DOCK reporting. ++ */ ++ { KE_IGNORE, 0xCA, { .sw = { SW_DOCK, 1 } } }, /* Docked */ ++ { KE_IGNORE, 0xCB, { .sw = { SW_DOCK, 0 } } }, /* Undocked */ + { KE_SW, 0xCC, { .sw = { SW_TABLET_MODE, 1 } } }, /* Tablet */ + { KE_SW, 0xCD, { .sw = { SW_TABLET_MODE, 0 } } }, /* Laptop */ + }; +diff --git a/drivers/platform/x86/intel_pmt_crashlog.c b/drivers/platform/x86/intel_pmt_crashlog.c +index 97dd749c8290d..92d315a16cfd3 100644 +--- a/drivers/platform/x86/intel_pmt_crashlog.c ++++ b/drivers/platform/x86/intel_pmt_crashlog.c +@@ -23,18 +23,17 @@ + #define CRASH_TYPE_OOBMSM 1 + + /* Control Flags */ +-#define CRASHLOG_FLAG_DISABLE BIT(27) ++#define CRASHLOG_FLAG_DISABLE BIT(28) + + /* +- * Bits 28 and 29 control the state of bit 31. ++ * Bits 29 and 30 control the state of bit 31. + * +- * Bit 28 will clear bit 31, if set, allowing a new crashlog to be captured. +- * Bit 29 will immediately trigger a crashlog to be generated, setting bit 31. +- * Bit 30 is read-only and reserved as 0. ++ * Bit 29 will clear bit 31, if set, allowing a new crashlog to be captured. ++ * Bit 30 will immediately trigger a crashlog to be generated, setting bit 31. + * Bit 31 is the read-only status with a 1 indicating log is complete. + */ +-#define CRASHLOG_FLAG_TRIGGER_CLEAR BIT(28) +-#define CRASHLOG_FLAG_TRIGGER_EXECUTE BIT(29) ++#define CRASHLOG_FLAG_TRIGGER_CLEAR BIT(29) ++#define CRASHLOG_FLAG_TRIGGER_EXECUTE BIT(30) + #define CRASHLOG_FLAG_TRIGGER_COMPLETE BIT(31) + #define CRASHLOG_FLAG_TRIGGER_MASK GENMASK(31, 28) + +diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c +index 37a2abbe85c72..0fd3da36f62e0 100644 +--- a/drivers/regulator/qcom-rpmh-regulator.c ++++ b/drivers/regulator/qcom-rpmh-regulator.c +@@ -726,8 +726,8 @@ static const struct rpmh_vreg_hw_data pmic5_ftsmps510 = { + static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = { + .regulator_type = VRM, + .ops = &rpmh_regulator_vrm_ops, +- .voltage_range = REGULATOR_LINEAR_RANGE(2800000, 0, 4, 16000), +- .n_voltages = 5, ++ .voltage_range = REGULATOR_LINEAR_RANGE(320000, 0, 235, 16000), ++ .n_voltages = 236, + .pmic_mode_map = pmic_mode_map_pmic5_smps, + .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode, + }; +@@ -901,7 +901,7 @@ static const struct rpmh_vreg_init_data pm8350_vreg_data[] = { + }; + + static const struct rpmh_vreg_init_data pm8350c_vreg_data[] = { +- RPMH_VREG("smps1", "smp%s1", &pmic5_hfsmps510, "vdd-s1"), ++ RPMH_VREG("smps1", "smp%s1", &pmic5_hfsmps515, "vdd-s1"), + RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps510, "vdd-s2"), + RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps510, "vdd-s3"), + RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps510, "vdd-s4"), +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 6e23dc3209feb..340d435ac0ce3 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -7789,14 +7789,18 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) + ioc->pend_os_device_add_sz++; + ioc->pend_os_device_add = kzalloc(ioc->pend_os_device_add_sz, + GFP_KERNEL); +- if (!ioc->pend_os_device_add) ++ if (!ioc->pend_os_device_add) { ++ r = -ENOMEM; + goto out_free_resources; ++ } + + ioc->device_remove_in_progress_sz = ioc->pend_os_device_add_sz; + ioc->device_remove_in_progress = + kzalloc(ioc->device_remove_in_progress_sz, GFP_KERNEL); +- if (!ioc->device_remove_in_progress) ++ if (!ioc->device_remove_in_progress) { ++ r = -ENOMEM; + goto out_free_resources; ++ } + + ioc->fwfault_debug = mpt3sas_fwfault_debug; + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 47ad64b066236..69c5b5ee2169b 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -1675,6 +1675,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi) + if (!qedi->global_queues[i]) { + QEDI_ERR(&qedi->dbg_ctx, + "Unable to allocation global queue %d.\n", i); ++ status = -ENOMEM; + goto mem_alloc_failure; + } + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 0d09480b66cd3..17f541030f5be 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3223,8 +3223,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, + if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) || + (cmd->sess && cmd->sess->deleted)) { + cmd->state = QLA_TGT_STATE_PROCESSED; +- res = 0; +- goto free; ++ return 0; + } + + ql_dbg_qp(ql_dbg_tgt, qpair, 0xe018, +@@ -3235,8 +3234,9 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, + + res = qlt_pre_xmit_response(cmd, &prm, xmit_type, scsi_status, + &full_req_cnt); +- if (unlikely(res != 0)) +- goto free; ++ if (unlikely(res != 0)) { ++ return res; ++ } + + spin_lock_irqsave(qpair->qp_lock_ptr, flags); + +@@ -3256,8 +3256,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, + vha->flags.online, qla2x00_reset_active(vha), + cmd->reset_count, qpair->chip_reset); + spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); +- res = 0; +- goto free; ++ return 0; + } + + /* Does F/W have an IOCBs for this request */ +@@ -3360,8 +3359,6 @@ out_unmap_unlock: + qlt_unmap_sg(vha, cmd); + spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); + +-free: +- vha->hw->tgt.tgt_ops->free_cmd(cmd); + return res; + } + EXPORT_SYMBOL(qlt_xmit_response); +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index b55fc768a2a7a..8b4890cdd4ca1 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -644,7 +644,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd) + { + struct qla_tgt_cmd *cmd = container_of(se_cmd, + struct qla_tgt_cmd, se_cmd); +- struct scsi_qla_host *vha = cmd->vha; + + if (cmd->aborted) { + /* Cmd can loop during Q-full. tcm_qla2xxx_aborted_task +@@ -657,7 +656,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd) + cmd->se_cmd.transport_state, + cmd->se_cmd.t_state, + cmd->se_cmd.se_cmd_flags); +- vha->hw->tgt.tgt_ops->free_cmd(cmd); + return 0; + } + +@@ -685,7 +683,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) + { + struct qla_tgt_cmd *cmd = container_of(se_cmd, + struct qla_tgt_cmd, se_cmd); +- struct scsi_qla_host *vha = cmd->vha; + int xmit_type = QLA_TGT_XMIT_STATUS; + + if (cmd->aborted) { +@@ -699,7 +696,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) + cmd, kref_read(&cmd->se_cmd.cmd_kref), + cmd->se_cmd.transport_state, cmd->se_cmd.t_state, + cmd->se_cmd.se_cmd_flags); +- vha->hw->tgt.tgt_ops->free_cmd(cmd); + return 0; + } + cmd->bufflen = se_cmd->data_length; +diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c +index 2206b1e4b7740..e55201f64c100 100644 +--- a/drivers/scsi/ufs/ufs-qcom.c ++++ b/drivers/scsi/ufs/ufs-qcom.c +@@ -253,12 +253,17 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba) + { + int ret = 0; + struct ufs_qcom_host *host = ufshcd_get_variant(hba); ++ bool reenable_intr = false; + + if (!host->core_reset) { + dev_warn(hba->dev, "%s: reset control not set\n", __func__); + goto out; + } + ++ reenable_intr = hba->is_irq_enabled; ++ disable_irq(hba->irq); ++ hba->is_irq_enabled = false; ++ + ret = reset_control_assert(host->core_reset); + if (ret) { + dev_err(hba->dev, "%s: core_reset assert failed, err = %d\n", +@@ -280,6 +285,11 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba) + + usleep_range(1000, 1100); + ++ if (reenable_intr) { ++ enable_irq(hba->irq); ++ hba->is_irq_enabled = true; ++ } ++ + out: + return ret; + } +diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c +index bf1468e5bccba..51143a68a8896 100644 +--- a/drivers/soc/ti/omap_prm.c ++++ b/drivers/soc/ti/omap_prm.c +@@ -332,7 +332,7 @@ static const struct omap_prm_data dra7_prm_data[] = { + { + .name = "l3init", .base = 0x4ae07300, + .pwrstctrl = 0x0, .pwrstst = 0x4, .dmap = &omap_prm_alwon, +- .rstctrl = 0x10, .rstst = 0x14, .rstmap = rst_map_012, ++ .rstctrl = 0x10, .rstst = 0x14, .rstmap = rst_map_01, + .clkdm_name = "pcie" + }, + { +@@ -830,8 +830,12 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev, + reset->prm->data->name, id); + + exit: +- if (reset->clkdm) ++ if (reset->clkdm) { ++ /* At least dra7 iva needs a delay before clkdm idle */ ++ if (has_rstst) ++ udelay(1); + pdata->clkdm_allow_idle(reset->clkdm); ++ } + + return ret; + } +diff --git a/drivers/staging/rtl8192e/Kconfig b/drivers/staging/rtl8192e/Kconfig +index 03fcc23516fd3..6e7d84ac06f50 100644 +--- a/drivers/staging/rtl8192e/Kconfig ++++ b/drivers/staging/rtl8192e/Kconfig +@@ -26,6 +26,7 @@ config RTLLIB_CRYPTO_CCMP + config RTLLIB_CRYPTO_TKIP + tristate "Support for rtllib TKIP crypto" + depends on RTLLIB ++ select CRYPTO + select CRYPTO_LIB_ARC4 + select CRYPTO_MICHAEL_MIC + default y +diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig +index 41645fe6ad48a..ea0efd290c372 100644 +--- a/drivers/xen/Kconfig ++++ b/drivers/xen/Kconfig +@@ -50,11 +50,11 @@ config XEN_BALLOON_MEMORY_HOTPLUG + + SUBSYSTEM=="memory", ACTION=="add", RUN+="/bin/sh -c '[ -f /sys$devpath/state ] && echo online > /sys$devpath/state'" + +-config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT ++config XEN_MEMORY_HOTPLUG_LIMIT + int "Hotplugged memory limit (in GiB) for a PV guest" + default 512 + depends on XEN_HAVE_PVMMU +- depends on XEN_BALLOON_MEMORY_HOTPLUG ++ depends on MEMORY_HOTPLUG + help + Maxmium amount of memory (in GiB) that a PV guest can be + expanded to when using memory hotplug. +diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c +index 324f646d6e5e2..02a68b04e43f9 100644 +--- a/fs/btrfs/dev-replace.c ++++ b/fs/btrfs/dev-replace.c +@@ -80,6 +80,9 @@ int btrfs_init_dev_replace(struct btrfs_fs_info *fs_info) + struct btrfs_dev_replace_item *ptr; + u64 src_devid; + ++ if (!dev_root) ++ return 0; ++ + path = btrfs_alloc_path(); + if (!path) { + ret = -ENOMEM; +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 07a2b4f69b10e..3cb73a0d12d0c 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -2300,8 +2300,9 @@ static int btrfs_read_roots(struct btrfs_fs_info *fs_info) + } else { + set_bit(BTRFS_ROOT_TRACK_DIRTY, &root->state); + fs_info->dev_root = root; +- btrfs_init_devices_late(fs_info); + } ++ /* Initialize fs_info for all devices in any case */ ++ btrfs_init_devices_late(fs_info); + + /* If IGNOREDATACSUMS is set don't bother reading the csum root. */ + if (!btrfs_test_opt(fs_info, IGNOREDATACSUMS)) { +@@ -2913,6 +2914,21 @@ int btrfs_start_pre_rw_mount(struct btrfs_fs_info *fs_info) + } + } + ++ /* ++ * btrfs_find_orphan_roots() is responsible for finding all the dead ++ * roots (with 0 refs), flag them with BTRFS_ROOT_DEAD_TREE and load ++ * them into the fs_info->fs_roots_radix tree. This must be done before ++ * calling btrfs_orphan_cleanup() on the tree root. If we don't do it ++ * first, then btrfs_orphan_cleanup() will delete a dead root's orphan ++ * item before the root's tree is deleted - this means that if we unmount ++ * or crash before the deletion completes, on the next mount we will not ++ * delete what remains of the tree because the orphan item does not ++ * exists anymore, which is what tells us we have a pending deletion. ++ */ ++ ret = btrfs_find_orphan_roots(fs_info); ++ if (ret) ++ goto out; ++ + ret = btrfs_cleanup_fs_roots(fs_info); + if (ret) + goto out; +@@ -2972,7 +2988,6 @@ int btrfs_start_pre_rw_mount(struct btrfs_fs_info *fs_info) + } + } + +- ret = btrfs_find_orphan_roots(fs_info); + out: + return ret; + } +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index df25d3e300f07..fe723eadced79 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2947,11 +2947,13 @@ void btrfs_writepage_endio_finish_ordered(struct page *page, u64 start, + * @bio_offset: offset to the beginning of the bio (in bytes) + * @page: page where is the data to be verified + * @pgoff: offset inside the page ++ * @start: logical offset in the file + * + * The length of such check is always one sector size. + */ + static int check_data_csum(struct inode *inode, struct btrfs_io_bio *io_bio, +- u32 bio_offset, struct page *page, u32 pgoff) ++ u32 bio_offset, struct page *page, u32 pgoff, ++ u64 start) + { + struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + SHASH_DESC_ON_STACK(shash, fs_info->csum_shash); +@@ -2978,8 +2980,8 @@ static int check_data_csum(struct inode *inode, struct btrfs_io_bio *io_bio, + kunmap_atomic(kaddr); + return 0; + zeroit: +- btrfs_print_data_csum_error(BTRFS_I(inode), page_offset(page) + pgoff, +- csum, csum_expected, io_bio->mirror_num); ++ btrfs_print_data_csum_error(BTRFS_I(inode), start, csum, csum_expected, ++ io_bio->mirror_num); + if (io_bio->device) + btrfs_dev_stat_inc_and_print(io_bio->device, + BTRFS_DEV_STAT_CORRUPTION_ERRS); +@@ -3032,7 +3034,8 @@ int btrfs_verify_data_csum(struct btrfs_io_bio *io_bio, u32 bio_offset, + pg_off += sectorsize, bio_offset += sectorsize) { + int ret; + +- ret = check_data_csum(inode, io_bio, bio_offset, page, pg_off); ++ ret = check_data_csum(inode, io_bio, bio_offset, page, pg_off, ++ page_offset(page) + pg_off); + if (ret < 0) + return -EIO; + } +@@ -7742,7 +7745,8 @@ static blk_status_t btrfs_check_read_dio_bio(struct inode *inode, + ASSERT(pgoff < PAGE_SIZE); + if (uptodate && + (!csum || !check_data_csum(inode, io_bio, +- bio_offset, bvec.bv_page, pgoff))) { ++ bio_offset, bvec.bv_page, ++ pgoff, start))) { + clean_io_failure(fs_info, failure_tree, io_tree, + start, bvec.bv_page, + btrfs_ino(BTRFS_I(inode)), +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 14ff388fd3bda..f0b9ef13153ad 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -226,7 +226,6 @@ static void __del_qgroup_rb(struct btrfs_fs_info *fs_info, + { + struct btrfs_qgroup_list *list; + +- btrfs_sysfs_del_one_qgroup(fs_info, qgroup); + list_del(&qgroup->dirty); + while (!list_empty(&qgroup->groups)) { + list = list_first_entry(&qgroup->groups, +@@ -243,7 +242,6 @@ static void __del_qgroup_rb(struct btrfs_fs_info *fs_info, + list_del(&list->next_member); + kfree(list); + } +- kfree(qgroup); + } + + /* must be called with qgroup_lock held */ +@@ -569,6 +567,8 @@ void btrfs_free_qgroup_config(struct btrfs_fs_info *fs_info) + qgroup = rb_entry(n, struct btrfs_qgroup, node); + rb_erase(n, &fs_info->qgroup_tree); + __del_qgroup_rb(fs_info, qgroup); ++ btrfs_sysfs_del_one_qgroup(fs_info, qgroup); ++ kfree(qgroup); + } + /* + * We call btrfs_free_qgroup_config() when unmounting +@@ -1578,6 +1578,14 @@ int btrfs_remove_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid) + spin_lock(&fs_info->qgroup_lock); + del_qgroup_rb(fs_info, qgroupid); + spin_unlock(&fs_info->qgroup_lock); ++ ++ /* ++ * Remove the qgroup from sysfs now without holding the qgroup_lock ++ * spinlock, since the sysfs_remove_group() function needs to take ++ * the mutex kernfs_mutex through kernfs_remove_by_name_ns(). ++ */ ++ btrfs_sysfs_del_one_qgroup(fs_info, qgroup); ++ kfree(qgroup); + out: + mutex_unlock(&fs_info->qgroup_ioctl_lock); + return ret; +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index d6c24c8ad7499..93f2b030fb9d4 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -7282,6 +7282,9 @@ static int btrfs_device_init_dev_stats(struct btrfs_device *device, + int item_size; + int i, ret, slot; + ++ if (!device->fs_info->dev_root) ++ return 0; ++ + key.objectid = BTRFS_DEV_STATS_OBJECTID; + key.type = BTRFS_PERSISTENT_ITEM_KEY; + key.offset = device->devid; +diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c +index e027c718ca01a..8ffc40e84a594 100644 +--- a/fs/cachefiles/rdwr.c ++++ b/fs/cachefiles/rdwr.c +@@ -24,17 +24,16 @@ static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode, + container_of(wait, struct cachefiles_one_read, monitor); + struct cachefiles_object *object; + struct fscache_retrieval *op = monitor->op; +- struct wait_bit_key *key = _key; ++ struct wait_page_key *key = _key; + struct page *page = wait->private; + + ASSERT(key); + + _enter("{%lu},%u,%d,{%p,%u}", + monitor->netfs_page->index, mode, sync, +- key->flags, key->bit_nr); ++ key->page, key->bit_nr); + +- if (key->flags != &page->flags || +- key->bit_nr != PG_locked) ++ if (key->page != page || key->bit_nr != PG_locked) + return 0; + + _debug("--- monitor %p %lx ---", page, page->flags); +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 089a3916c639f..ca1af03e93709 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -915,8 +915,8 @@ struct cifs_ses { + bool binding:1; /* are we binding the session? */ + __u16 session_flags; + __u8 smb3signingkey[SMB3_SIGN_KEY_SIZE]; +- __u8 smb3encryptionkey[SMB3_SIGN_KEY_SIZE]; +- __u8 smb3decryptionkey[SMB3_SIGN_KEY_SIZE]; ++ __u8 smb3encryptionkey[SMB3_ENC_DEC_KEY_SIZE]; ++ __u8 smb3decryptionkey[SMB3_ENC_DEC_KEY_SIZE]; + __u8 preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE]; + + __u8 binding_preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE]; +diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h +index 64fe5a47b5e87..9adc74bd9f8fa 100644 +--- a/fs/cifs/cifspdu.h ++++ b/fs/cifs/cifspdu.h +@@ -147,6 +147,11 @@ + */ + #define SMB3_SIGN_KEY_SIZE (16) + ++/* ++ * Size of the smb3 encryption/decryption keys ++ */ ++#define SMB3_ENC_DEC_KEY_SIZE (32) ++ + #define CIFS_CLIENT_CHALLENGE_SIZE (8) + #define CIFS_SERVER_CHALLENGE_SIZE (8) + #define CIFS_HMAC_MD5_HASH_SIZE (16) +diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h +index 99a1951a01ec2..d9a990c991213 100644 +--- a/fs/cifs/smb2glob.h ++++ b/fs/cifs/smb2glob.h +@@ -58,6 +58,7 @@ + #define SMB2_HMACSHA256_SIZE (32) + #define SMB2_CMACAES_SIZE (16) + #define SMB3_SIGNKEY_SIZE (16) ++#define SMB3_GCM128_CRYPTKEY_SIZE (16) + #define SMB3_GCM256_CRYPTKEY_SIZE (32) + + /* Maximum buffer size value we can send with 1 credit */ +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 463e81c35c428..7b614a7096cd2 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -2007,6 +2007,7 @@ smb2_duplicate_extents(const unsigned int xid, + { + int rc; + unsigned int ret_data_len; ++ struct inode *inode; + struct duplicate_extents_to_file dup_ext_buf; + struct cifs_tcon *tcon = tlink_tcon(trgtfile->tlink); + +@@ -2023,10 +2024,21 @@ smb2_duplicate_extents(const unsigned int xid, + cifs_dbg(FYI, "Duplicate extents: src off %lld dst off %lld len %lld\n", + src_off, dest_off, len); + +- rc = smb2_set_file_size(xid, tcon, trgtfile, dest_off + len, false); +- if (rc) +- goto duplicate_extents_out; ++ inode = d_inode(trgtfile->dentry); ++ if (inode->i_size < dest_off + len) { ++ rc = smb2_set_file_size(xid, tcon, trgtfile, dest_off + len, false); ++ if (rc) ++ goto duplicate_extents_out; + ++ /* ++ * Although also could set plausible allocation size (i_blocks) ++ * here in addition to setting the file size, in reflink ++ * it is likely that the target file is sparse. Its allocation ++ * size will be queried on next revalidate, but it is important ++ * to make sure that file's cached size is updated immediately ++ */ ++ cifs_setsize(inode, dest_off + len); ++ } + rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, + trgtfile->fid.volatile_fid, + FSCTL_DUPLICATE_EXTENTS_TO_FILE, +@@ -4097,7 +4109,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) + if (ses->Suid == ses_id) { + ses_enc_key = enc ? ses->smb3encryptionkey : + ses->smb3decryptionkey; +- memcpy(key, ses_enc_key, SMB3_SIGN_KEY_SIZE); ++ memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE); + spin_unlock(&cifs_tcp_ses_lock); + return 0; + } +@@ -4124,7 +4136,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + int rc = 0; + struct scatterlist *sg; + u8 sign[SMB2_SIGNATURE_SIZE] = {}; +- u8 key[SMB3_SIGN_KEY_SIZE]; ++ u8 key[SMB3_ENC_DEC_KEY_SIZE]; + struct aead_request *req; + char *iv; + unsigned int iv_len; +@@ -4148,10 +4160,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + tfm = enc ? server->secmech.ccmaesencrypt : + server->secmech.ccmaesdecrypt; + +- if (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM) ++ if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || ++ (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) + rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE); + else +- rc = crypto_aead_setkey(tfm, key, SMB3_SIGN_KEY_SIZE); ++ rc = crypto_aead_setkey(tfm, key, SMB3_GCM128_CRYPTKEY_SIZE); + + if (rc) { + cifs_server_dbg(VFS, "%s: Failed to set aead key %d\n", __func__, rc); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 794fc3b68b4f9..6a1af5545f674 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -4033,8 +4033,7 @@ smb2_async_readv(struct cifs_readdata *rdata) + if (rdata->credits.value > 0) { + shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, + SMB2_MAX_BUFFER_SIZE)); +- shdr->CreditRequest = +- cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); ++ shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); + + rc = adjust_credits(server, &rdata->credits, rdata->bytes); + if (rc) +@@ -4340,8 +4339,7 @@ smb2_async_writev(struct cifs_writedata *wdata, + if (wdata->credits.value > 0) { + shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, + SMB2_MAX_BUFFER_SIZE)); +- shdr->CreditRequest = +- cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); ++ shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); + + rc = adjust_credits(server, &wdata->credits, wdata->bytes); + if (rc) +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index ebccd71cc60a3..e6fa76ab70be7 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -298,7 +298,8 @@ static int generate_key(struct cifs_ses *ses, struct kvec label, + { + unsigned char zero = 0x0; + __u8 i[4] = {0, 0, 0, 1}; +- __u8 L[4] = {0, 0, 0, 128}; ++ __u8 L128[4] = {0, 0, 0, 128}; ++ __u8 L256[4] = {0, 0, 1, 0}; + int rc = 0; + unsigned char prfhash[SMB2_HMACSHA256_SIZE]; + unsigned char *hashptr = prfhash; +@@ -354,8 +355,14 @@ static int generate_key(struct cifs_ses *ses, struct kvec label, + goto smb3signkey_ret; + } + +- rc = crypto_shash_update(&server->secmech.sdeschmacsha256->shash, +- L, 4); ++ if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || ++ (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) { ++ rc = crypto_shash_update(&server->secmech.sdeschmacsha256->shash, ++ L256, 4); ++ } else { ++ rc = crypto_shash_update(&server->secmech.sdeschmacsha256->shash, ++ L128, 4); ++ } + if (rc) { + cifs_server_dbg(VFS, "%s: Could not update with L\n", __func__); + goto smb3signkey_ret; +@@ -390,6 +397,9 @@ generate_smb3signingkey(struct cifs_ses *ses, + const struct derivation_triplet *ptriplet) + { + int rc; ++#ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS ++ struct TCP_Server_Info *server = ses->server; ++#endif + + /* + * All channels use the same encryption/decryption keys but +@@ -422,11 +432,11 @@ generate_smb3signingkey(struct cifs_ses *ses, + rc = generate_key(ses, ptriplet->encryption.label, + ptriplet->encryption.context, + ses->smb3encryptionkey, +- SMB3_SIGN_KEY_SIZE); ++ SMB3_ENC_DEC_KEY_SIZE); + rc = generate_key(ses, ptriplet->decryption.label, + ptriplet->decryption.context, + ses->smb3decryptionkey, +- SMB3_SIGN_KEY_SIZE); ++ SMB3_ENC_DEC_KEY_SIZE); + if (rc) + return rc; + } +@@ -442,14 +452,23 @@ generate_smb3signingkey(struct cifs_ses *ses, + */ + cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), + &ses->Suid); ++ cifs_dbg(VFS, "Cipher type %d\n", server->cipher_type); + cifs_dbg(VFS, "Session Key %*ph\n", + SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); + cifs_dbg(VFS, "Signing Key %*ph\n", + SMB3_SIGN_KEY_SIZE, ses->smb3signingkey); +- cifs_dbg(VFS, "ServerIn Key %*ph\n", +- SMB3_SIGN_KEY_SIZE, ses->smb3encryptionkey); +- cifs_dbg(VFS, "ServerOut Key %*ph\n", +- SMB3_SIGN_KEY_SIZE, ses->smb3decryptionkey); ++ if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || ++ (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) { ++ cifs_dbg(VFS, "ServerIn Key %*ph\n", ++ SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3encryptionkey); ++ cifs_dbg(VFS, "ServerOut Key %*ph\n", ++ SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3decryptionkey); ++ } else { ++ cifs_dbg(VFS, "ServerIn Key %*ph\n", ++ SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3encryptionkey); ++ cifs_dbg(VFS, "ServerOut Key %*ph\n", ++ SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3decryptionkey); ++ } + #endif + return rc; + } +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 64fccb8809ecb..13d685f0ac8e4 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -1185,7 +1185,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + } + if (rc != 0) { + for (; i < num_rqst; i++) { +- cifs_server_dbg(VFS, "Cancelling wait for mid %llu cmd: %d\n", ++ cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n", + midQ[i]->mid, le16_to_cpu(midQ[i]->command)); + send_cancel(server, &rqst[i], midQ[i]); + spin_lock(&GlobalMid_Lock); +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 99bf091fee10e..a02fadf4fc84e 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2709,8 +2709,15 @@ static int ext4_mb_init_backend(struct super_block *sb) + } + + if (ext4_has_feature_flex_bg(sb)) { +- /* a single flex group is supposed to be read by a single IO */ +- sbi->s_mb_prefetch = min(1 << sbi->s_es->s_log_groups_per_flex, ++ /* a single flex group is supposed to be read by a single IO. ++ * 2 ^ s_log_groups_per_flex != UINT_MAX as s_mb_prefetch is ++ * unsigned integer, so the maximum shift is 32. ++ */ ++ if (sbi->s_es->s_log_groups_per_flex >= 32) { ++ ext4_msg(sb, KERN_ERR, "too many log groups per flexible block group"); ++ goto err_freesgi; ++ } ++ sbi->s_mb_prefetch = min_t(uint, 1 << sbi->s_es->s_log_groups_per_flex, + BLK_MAX_SEGMENT_SIZE >> (sb->s_blocksize_bits - 9)); + sbi->s_mb_prefetch *= 8; /* 8 prefetch IOs in flight at most */ + } else { +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 6aef74f7c9eea..6c1018223c54a 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1462,6 +1462,9 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value, + if (!ce) + return NULL; + ++ WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) && ++ !(current->flags & PF_MEMALLOC_NOFS)); ++ + ea_data = kvmalloc(value_len, GFP_KERNEL); + if (!ea_data) { + mb_cache_entry_put(ea_inode_cache, ce); +@@ -2327,6 +2330,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index, + error = -ENOSPC; + goto cleanup; + } ++ WARN_ON_ONCE(!(current->flags & PF_MEMALLOC_NOFS)); + } + + error = ext4_reserve_inode_write(handle, inode, &is.iloc); +diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c +index 2e9314091c81d..1955dea999f79 100644 +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -935,12 +935,16 @@ static void trans_drain(struct gfs2_trans *tr) + while (!list_empty(head)) { + bd = list_first_entry(head, struct gfs2_bufdata, bd_list); + list_del_init(&bd->bd_list); ++ if (!list_empty(&bd->bd_ail_st_list)) ++ gfs2_remove_from_ail(bd); + kmem_cache_free(gfs2_bufdata_cachep, bd); + } + head = &tr->tr_databuf; + while (!list_empty(head)) { + bd = list_first_entry(head, struct gfs2_bufdata, bd_list); + list_del_init(&bd->bd_list); ++ if (!list_empty(&bd->bd_ail_st_list)) ++ gfs2_remove_from_ail(bd); + kmem_cache_free(gfs2_bufdata_cachep, bd); + } + } +diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c +index 6d4bf7ea7b3be..7f850ff6a05de 100644 +--- a/fs/gfs2/trans.c ++++ b/fs/gfs2/trans.c +@@ -134,6 +134,8 @@ static struct gfs2_bufdata *gfs2_alloc_bufdata(struct gfs2_glock *gl, + bd->bd_bh = bh; + bd->bd_gl = gl; + INIT_LIST_HEAD(&bd->bd_list); ++ INIT_LIST_HEAD(&bd->bd_ail_st_list); ++ INIT_LIST_HEAD(&bd->bd_ail_gl_list); + bh->b_private = bd; + return bd; + } +diff --git a/fs/io_uring.c b/fs/io_uring.c +index ef078182e7ca4..5c4378694d541 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -4214,6 +4214,7 @@ static int io_remove_buffers(struct io_kiocb *req, bool force_nonblock, + static int io_provide_buffers_prep(struct io_kiocb *req, + const struct io_uring_sqe *sqe) + { ++ unsigned long size; + struct io_provide_buf *p = &req->pbuf; + u64 tmp; + +@@ -4227,7 +4228,8 @@ static int io_provide_buffers_prep(struct io_kiocb *req, + p->addr = READ_ONCE(sqe->addr); + p->len = READ_ONCE(sqe->len); + +- if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs))) ++ size = (unsigned long)p->len * p->nbufs; ++ if (!access_ok(u64_to_user_ptr(p->addr), size)) + return -EFAULT; + + p->bgid = READ_ONCE(sqe->buf_group); +@@ -8861,11 +8863,11 @@ static bool io_cancel_task_cb(struct io_wq_work *work, void *data) + return ret; + } + +-static void io_cancel_defer_files(struct io_ring_ctx *ctx, ++static bool io_cancel_defer_files(struct io_ring_ctx *ctx, + struct task_struct *task, + struct files_struct *files) + { +- struct io_defer_entry *de = NULL; ++ struct io_defer_entry *de; + LIST_HEAD(list); + + spin_lock_irq(&ctx->completion_lock); +@@ -8876,6 +8878,8 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx, + } + } + spin_unlock_irq(&ctx->completion_lock); ++ if (list_empty(&list)) ++ return false; + + while (!list_empty(&list)) { + de = list_first_entry(&list, struct io_defer_entry, list); +@@ -8885,6 +8889,7 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx, + io_req_complete(de->req, -ECANCELED); + kfree(de); + } ++ return true; + } + + static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx, +@@ -8912,6 +8917,7 @@ static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx, + } + } + ++ ret |= io_cancel_defer_files(ctx, task, files); + ret |= io_poll_remove_all(ctx, task, files); + ret |= io_kill_timeouts(ctx, task, files); + ret |= io_run_task_work(); +@@ -8992,8 +8998,6 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx, + io_sq_thread_park(ctx->sq_data); + } + +- io_cancel_defer_files(ctx, task, files); +- + io_uring_cancel_files(ctx, task, files); + if (!files) + io_uring_try_cancel_requests(ctx, task, NULL); +diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig +index e2a488d403a61..14a72224b6571 100644 +--- a/fs/nfs/Kconfig ++++ b/fs/nfs/Kconfig +@@ -127,7 +127,7 @@ config PNFS_BLOCK + config PNFS_FLEXFILE_LAYOUT + tristate + depends on NFS_V4_1 && NFS_V3 +- default m ++ default NFS_V4 + + config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN + string "NFSv4.1 Implementation ID Domain" +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index ca10072644ff2..ed1c83738c30d 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -36,6 +36,7 @@ + #define NFS3_pagepad_sz (1) /* Page padding */ + #define NFS3_fhandle_sz (1+16) + #define NFS3_fh_sz (NFS3_fhandle_sz) /* shorthand */ ++#define NFS3_post_op_fh_sz (1+NFS3_fh_sz) + #define NFS3_sattr_sz (15) + #define NFS3_filename_sz (1+(NFS3_MAXNAMLEN>>2)) + #define NFS3_path_sz (1+(NFS3_MAXPATHLEN>>2)) +@@ -73,7 +74,7 @@ + #define NFS3_readlinkres_sz (1+NFS3_post_op_attr_sz+1+NFS3_pagepad_sz) + #define NFS3_readres_sz (1+NFS3_post_op_attr_sz+3+NFS3_pagepad_sz) + #define NFS3_writeres_sz (1+NFS3_wcc_data_sz+4) +-#define NFS3_createres_sz (1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) ++#define NFS3_createres_sz (1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) + #define NFS3_renameres_sz (1+(2 * NFS3_wcc_data_sz)) + #define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) + #define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2+NFS3_pagepad_sz) +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 7eb44f37558cb..95d3b8540f8ed 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5896,6 +5896,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl + unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE); + int ret, i; + ++ /* You can't remove system.nfs4_acl: */ ++ if (buflen == 0) ++ return -EINVAL; + if (!nfs4_server_supports_acls(server)) + return -EOPNOTSUPP; + if (npages > ARRAY_SIZE(pages)) +diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c +index eb02072d28dd6..723763746238d 100644 +--- a/fs/squashfs/export.c ++++ b/fs/squashfs/export.c +@@ -152,14 +152,18 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb, + start = le64_to_cpu(table[n]); + end = le64_to_cpu(table[n + 1]); + +- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { ++ if (start >= end ++ || (end - start) > ++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { + kfree(table); + return ERR_PTR(-EINVAL); + } + } + + start = le64_to_cpu(table[indexes - 1]); +- if (start >= lookup_table_start || (lookup_table_start - start) > SQUASHFS_METADATA_SIZE) { ++ if (start >= lookup_table_start || ++ (lookup_table_start - start) > ++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { + kfree(table); + return ERR_PTR(-EINVAL); + } +diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c +index 11581bf31af41..ea5387679723f 100644 +--- a/fs/squashfs/id.c ++++ b/fs/squashfs/id.c +@@ -97,14 +97,16 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb, + start = le64_to_cpu(table[n]); + end = le64_to_cpu(table[n + 1]); + +- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { ++ if (start >= end || (end - start) > ++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { + kfree(table); + return ERR_PTR(-EINVAL); + } + } + + start = le64_to_cpu(table[indexes - 1]); +- if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) { ++ if (start >= id_table_start || (id_table_start - start) > ++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { + kfree(table); + return ERR_PTR(-EINVAL); + } +diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h +index 8d64edb80ebf0..b3fdc8212c5f5 100644 +--- a/fs/squashfs/squashfs_fs.h ++++ b/fs/squashfs/squashfs_fs.h +@@ -17,6 +17,7 @@ + + /* size of metadata (inode and directory) blocks */ + #define SQUASHFS_METADATA_SIZE 8192 ++#define SQUASHFS_BLOCK_OFFSET 2 + + /* default size of block device I/O */ + #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE +diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c +index ead66670b41a5..087cab8c78f4e 100644 +--- a/fs/squashfs/xattr_id.c ++++ b/fs/squashfs/xattr_id.c +@@ -109,14 +109,16 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start, + start = le64_to_cpu(table[n]); + end = le64_to_cpu(table[n + 1]); + +- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { ++ if (start >= end || (end - start) > ++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { + kfree(table); + return ERR_PTR(-EINVAL); + } + } + + start = le64_to_cpu(table[indexes - 1]); +- if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) { ++ if (start >= table_start || (table_start - start) > ++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { + kfree(table); + return ERR_PTR(-EINVAL); + } +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index 6d1879bf94403..37dac195adbb4 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -233,6 +233,7 @@ struct acpi_pnp_type { + + struct acpi_device_pnp { + acpi_bus_id bus_id; /* Object name */ ++ int instance_no; /* Instance number of this object */ + struct acpi_pnp_type type; /* ID type */ + acpi_bus_address bus_address; /* _ADR */ + char *unique_id; /* _UID */ +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index 34d8287cd7749..d7efbc5490e8c 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -393,7 +393,10 @@ + . = ALIGN(8); \ + __start_static_call_sites = .; \ + KEEP(*(.static_call_sites)) \ +- __stop_static_call_sites = .; ++ __stop_static_call_sites = .; \ ++ __start_static_call_tramp_key = .; \ ++ KEEP(*(.static_call_tramp_key)) \ ++ __stop_static_call_tramp_key = .; + + /* + * Allow architectures to handle ro_after_init data on their +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 6e585dbc10df3..564ebf91793ed 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + struct bpf_verifier_env; + struct bpf_verifier_log; +@@ -563,7 +564,8 @@ struct bpf_tramp_progs { + * fentry = a set of program to run before calling original function + * fexit = a set of program to run after original function + */ +-int arch_prepare_bpf_trampoline(void *image, void *image_end, ++struct bpf_tramp_image; ++int arch_prepare_bpf_trampoline(struct bpf_tramp_image *tr, void *image, void *image_end, + const struct btf_func_model *m, u32 flags, + struct bpf_tramp_progs *tprogs, + void *orig_call); +@@ -572,6 +574,8 @@ u64 notrace __bpf_prog_enter(void); + void notrace __bpf_prog_exit(struct bpf_prog *prog, u64 start); + void notrace __bpf_prog_enter_sleepable(void); + void notrace __bpf_prog_exit_sleepable(void); ++void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr); ++void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr); + + struct bpf_ksym { + unsigned long start; +@@ -590,6 +594,18 @@ enum bpf_tramp_prog_type { + BPF_TRAMP_REPLACE, /* more than MAX */ + }; + ++struct bpf_tramp_image { ++ void *image; ++ struct bpf_ksym ksym; ++ struct percpu_ref pcref; ++ void *ip_after_call; ++ void *ip_epilogue; ++ union { ++ struct rcu_head rcu; ++ struct work_struct work; ++ }; ++}; ++ + struct bpf_trampoline { + /* hlist for trampoline_table */ + struct hlist_node hlist; +@@ -612,9 +628,8 @@ struct bpf_trampoline { + /* Number of attached programs. A counter per kind. */ + int progs_cnt[BPF_TRAMP_MAX]; + /* Executable image of trampoline */ +- void *image; ++ struct bpf_tramp_image *cur_image; + u64 selector; +- struct bpf_ksym ksym; + }; + + struct bpf_attach_target_info { +@@ -698,6 +713,8 @@ void bpf_image_ksym_add(void *data, struct bpf_ksym *ksym); + void bpf_image_ksym_del(struct bpf_ksym *ksym); + void bpf_ksym_add(struct bpf_ksym *ksym); + void bpf_ksym_del(struct bpf_ksym *ksym); ++int bpf_jit_charge_modmem(u32 pages); ++void bpf_jit_uncharge_modmem(u32 pages); + #else + static inline int bpf_trampoline_link_prog(struct bpf_prog *prog, + struct bpf_trampoline *tr) +@@ -788,7 +805,6 @@ struct bpf_prog_aux { + bool func_proto_unreliable; + bool sleepable; + bool tail_call_reachable; +- enum bpf_tramp_prog_type trampoline_prog_type; + struct hlist_node tramp_hlist; + /* BTF_KIND_FUNC_PROTO for valid attach_btf_id */ + const struct btf_type *attach_func_proto; +@@ -1066,7 +1082,7 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array, + struct bpf_prog *include_prog, + struct bpf_prog_array **new_array); + +-#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null) \ ++#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null, set_cg_storage) \ + ({ \ + struct bpf_prog_array_item *_item; \ + struct bpf_prog *_prog; \ +@@ -1079,7 +1095,8 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array, + goto _out; \ + _item = &_array->items[0]; \ + while ((_prog = READ_ONCE(_item->prog))) { \ +- bpf_cgroup_storage_set(_item->cgroup_storage); \ ++ if (set_cg_storage) \ ++ bpf_cgroup_storage_set(_item->cgroup_storage); \ + _ret &= func(_prog, ctx); \ + _item++; \ + } \ +@@ -1140,10 +1157,10 @@ _out: \ + }) + + #define BPF_PROG_RUN_ARRAY(array, ctx, func) \ +- __BPF_PROG_RUN_ARRAY(array, ctx, func, false) ++ __BPF_PROG_RUN_ARRAY(array, ctx, func, false, true) + + #define BPF_PROG_RUN_ARRAY_CHECK(array, ctx, func) \ +- __BPF_PROG_RUN_ARRAY(array, ctx, func, true) ++ __BPF_PROG_RUN_ARRAY(array, ctx, func, true, false) + + #ifdef CONFIG_BPF_SYSCALL + DECLARE_PER_CPU(int, bpf_prog_active); +diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h +index d0bd226d6bd96..54665952d6ade 100644 +--- a/include/linux/brcmphy.h ++++ b/include/linux/brcmphy.h +@@ -136,6 +136,7 @@ + + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC 0x07 + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_WIRESPEED_EN 0x0010 ++#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN 0x0080 + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN 0x0100 + #define MII_BCM54XX_AUXCTL_MISC_FORCE_AMDIX 0x0200 + #define MII_BCM54XX_AUXCTL_MISC_WREN 0x8000 +@@ -222,6 +223,9 @@ + /* 11111: Mode Control Register */ + #define BCM54XX_SHD_MODE 0x1f + #define BCM54XX_SHD_INTF_SEL_MASK GENMASK(2, 1) /* INTERF_SEL[1:0] */ ++#define BCM54XX_SHD_INTF_SEL_RGMII 0x02 ++#define BCM54XX_SHD_INTF_SEL_SGMII 0x04 ++#define BCM54XX_SHD_INTF_SEL_GBIC 0x06 + #define BCM54XX_SHD_MODE_1000BX BIT(0) /* Enable 1000-X registers */ + + /* +diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h +index d2d7f9b6a2761..50cc070cb1f7c 100644 +--- a/include/linux/device-mapper.h ++++ b/include/linux/device-mapper.h +@@ -246,7 +246,11 @@ struct target_type { + #define dm_target_passes_integrity(type) ((type)->features & DM_TARGET_PASSES_INTEGRITY) + + /* +- * Indicates that a target supports host-managed zoned block devices. ++ * Indicates support for zoned block devices: ++ * - DM_TARGET_ZONED_HM: the target also supports host-managed zoned ++ * block devices but does not support combining different zoned models. ++ * - DM_TARGET_MIXED_ZONED_MODEL: the target supports combining multiple ++ * devices with different zoned models. + */ + #define DM_TARGET_ZONED_HM 0x00000040 + #define dm_target_supports_zoned_hm(type) ((type)->features & DM_TARGET_ZONED_HM) +@@ -257,6 +261,15 @@ struct target_type { + #define DM_TARGET_NOWAIT 0x00000080 + #define dm_target_supports_nowait(type) ((type)->features & DM_TARGET_NOWAIT) + ++#ifdef CONFIG_BLK_DEV_ZONED ++#define DM_TARGET_MIXED_ZONED_MODEL 0x00000200 ++#define dm_target_supports_mixed_zoned_model(type) \ ++ ((type)->features & DM_TARGET_MIXED_ZONED_MODEL) ++#else ++#define DM_TARGET_MIXED_ZONED_MODEL 0x00000000 ++#define dm_target_supports_mixed_zoned_model(type) (false) ++#endif ++ + struct dm_target { + struct dm_table *table; + struct target_type *type; +diff --git a/include/linux/hugetlb_cgroup.h b/include/linux/hugetlb_cgroup.h +index 2ad6e92f124ad..0bff345c4bc68 100644 +--- a/include/linux/hugetlb_cgroup.h ++++ b/include/linux/hugetlb_cgroup.h +@@ -113,6 +113,11 @@ static inline bool hugetlb_cgroup_disabled(void) + return !cgroup_subsys_enabled(hugetlb_cgrp_subsys); + } + ++static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg) ++{ ++ css_put(&h_cg->css); ++} ++ + extern int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages, + struct hugetlb_cgroup **ptr); + extern int hugetlb_cgroup_charge_cgroup_rsvd(int idx, unsigned long nr_pages, +@@ -138,7 +143,8 @@ extern void hugetlb_cgroup_uncharge_counter(struct resv_map *resv, + + extern void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv, + struct file_region *rg, +- unsigned long nr_pages); ++ unsigned long nr_pages, ++ bool region_del); + + extern void hugetlb_cgroup_file_init(void) __init; + extern void hugetlb_cgroup_migrate(struct page *oldhpage, +@@ -147,7 +153,8 @@ extern void hugetlb_cgroup_migrate(struct page *oldhpage, + #else + static inline void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv, + struct file_region *rg, +- unsigned long nr_pages) ++ unsigned long nr_pages, ++ bool region_del) + { + } + +@@ -185,6 +192,10 @@ static inline bool hugetlb_cgroup_disabled(void) + return true; + } + ++static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg) ++{ ++} ++ + static inline int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages, + struct hugetlb_cgroup **ptr) + { +diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h +index 96556c64c95da..10c94a3936ca7 100644 +--- a/include/linux/if_macvlan.h ++++ b/include/linux/if_macvlan.h +@@ -43,13 +43,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan, + if (likely(success)) { + struct vlan_pcpu_stats *pcpu_stats; + +- pcpu_stats = this_cpu_ptr(vlan->pcpu_stats); ++ pcpu_stats = get_cpu_ptr(vlan->pcpu_stats); + u64_stats_update_begin(&pcpu_stats->syncp); + pcpu_stats->rx_packets++; + pcpu_stats->rx_bytes += len; + if (multicast) + pcpu_stats->rx_multicast++; + u64_stats_update_end(&pcpu_stats->syncp); ++ put_cpu_ptr(vlan->pcpu_stats); + } else { + this_cpu_inc(vlan->pcpu_stats->rx_errors); + } +diff --git a/include/linux/memblock.h b/include/linux/memblock.h +index 7643d2dfa9594..4ce9c8f9e6843 100644 +--- a/include/linux/memblock.h ++++ b/include/linux/memblock.h +@@ -460,7 +460,7 @@ static inline void memblock_free_late(phys_addr_t base, phys_addr_t size) + /* + * Set the allocation direction to bottom-up or top-down. + */ +-static inline __init void memblock_set_bottom_up(bool enable) ++static inline __init_memblock void memblock_set_bottom_up(bool enable) + { + memblock.bottom_up = enable; + } +@@ -470,7 +470,7 @@ static inline __init void memblock_set_bottom_up(bool enable) + * if this is true, that said, memblock will allocate memory + * in bottom-up direction. + */ +-static inline __init bool memblock_bottom_up(void) ++static inline __init_memblock bool memblock_bottom_up(void) + { + return memblock.bottom_up; + } +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 24b292fce8e59..992c18d5e85d7 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -1431,16 +1431,28 @@ static inline bool cpupid_match_pid(struct task_struct *task, int cpupid) + + #if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) + ++/* ++ * KASAN per-page tags are stored xor'ed with 0xff. This allows to avoid ++ * setting tags for all pages to native kernel tag value 0xff, as the default ++ * value 0x00 maps to 0xff. ++ */ ++ + static inline u8 page_kasan_tag(const struct page *page) + { +- if (kasan_enabled()) +- return (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK; +- return 0xff; ++ u8 tag = 0xff; ++ ++ if (kasan_enabled()) { ++ tag = (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK; ++ tag ^= 0xff; ++ } ++ ++ return tag; + } + + static inline void page_kasan_tag_set(struct page *page, u8 tag) + { + if (kasan_enabled()) { ++ tag ^= 0xff; + page->flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT); + page->flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT; + } +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 07d9acb5b19c4..61c77cfff8c28 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -23,6 +23,7 @@ + #endif + #define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) + ++#define INIT_PASID 0 + + struct address_space; + struct mem_cgroup; +diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h +index b8200782dedeb..1a6a9eb6d3fac 100644 +--- a/include/linux/mmu_notifier.h ++++ b/include/linux/mmu_notifier.h +@@ -169,11 +169,11 @@ struct mmu_notifier_ops { + * the last refcount is dropped. + * + * If blockable argument is set to false then the callback cannot +- * sleep and has to return with -EAGAIN. 0 should be returned +- * otherwise. Please note that if invalidate_range_start approves +- * a non-blocking behavior then the same applies to +- * invalidate_range_end. +- * ++ * sleep and has to return with -EAGAIN if sleeping would be required. ++ * 0 should be returned otherwise. Please note that notifiers that can ++ * fail invalidate_range_start are not allowed to implement ++ * invalidate_range_end, as there is no mechanism for informing the ++ * notifier that its start failed. + */ + int (*invalidate_range_start)(struct mmu_notifier *subscription, + const struct mmu_notifier_range *range); +diff --git a/include/linux/mutex.h b/include/linux/mutex.h +index dcd185cbfe793..4d671fba3cab4 100644 +--- a/include/linux/mutex.h ++++ b/include/linux/mutex.h +@@ -185,7 +185,7 @@ extern void mutex_lock_io(struct mutex *lock); + # define mutex_lock_interruptible_nested(lock, subclass) mutex_lock_interruptible(lock) + # define mutex_lock_killable_nested(lock, subclass) mutex_lock_killable(lock) + # define mutex_lock_nest_lock(lock, nest_lock) mutex_lock(lock) +-# define mutex_lock_io_nested(lock, subclass) mutex_lock(lock) ++# define mutex_lock_io_nested(lock, subclass) mutex_lock_io(lock) + #endif + + /* +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 8ebb641937571..8ec48466410a6 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -227,7 +227,7 @@ struct xt_table { + unsigned int valid_hooks; + + /* Man behind the curtain... */ +- struct xt_table_info __rcu *private; ++ struct xt_table_info *private; + + /* Set this to THIS_MODULE if you are a module, otherwise NULL */ + struct module *me; +@@ -376,7 +376,7 @@ static inline unsigned int xt_write_recseq_begin(void) + * since addend is most likely 1 + */ + __this_cpu_add(xt_recseq.sequence, addend); +- smp_wmb(); ++ smp_mb(); + + return addend; + } +@@ -448,9 +448,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu) + + struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *); + +-struct xt_table_info +-*xt_table_get_private_protected(const struct xt_table *table); +- + #ifdef CONFIG_COMPAT + #include + +diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h +index d5570deff4003..b032f094a7827 100644 +--- a/include/linux/pagemap.h ++++ b/include/linux/pagemap.h +@@ -559,7 +559,6 @@ static inline pgoff_t linear_page_index(struct vm_area_struct *vma, + return pgoff; + } + +-/* This has the same layout as wait_bit_key - see fs/cachefiles/rdwr.c */ + struct wait_page_key { + struct page *page; + int bit_nr; +diff --git a/include/linux/phy.h b/include/linux/phy.h +index 9effb511acde3..d0e64f3b53b99 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -499,6 +499,7 @@ struct macsec_ops; + * + * @speed: Current link speed + * @duplex: Current duplex ++ * @port: Current port + * @pause: Current pause + * @asym_pause: Current asymmetric pause + * @supported: Combined MAC/PHY supported linkmodes +@@ -577,6 +578,7 @@ struct phy_device { + */ + int speed; + int duplex; ++ int port; + int pause; + int asym_pause; + u8 master_slave_get; +diff --git a/include/linux/static_call.h b/include/linux/static_call.h +index 695da4c9b3381..04e6042d252d3 100644 +--- a/include/linux/static_call.h ++++ b/include/linux/static_call.h +@@ -107,26 +107,10 @@ extern void arch_static_call_transform(void *site, void *tramp, void *func, bool + + #define STATIC_CALL_TRAMP_ADDR(name) &STATIC_CALL_TRAMP(name) + +-/* +- * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from +- * the symbol table so that objtool can reference it when it generates the +- * .static_call_sites section. +- */ +-#define __static_call(name) \ +-({ \ +- __ADDRESSABLE(STATIC_CALL_KEY(name)); \ +- &STATIC_CALL_TRAMP(name); \ +-}) +- + #else + #define STATIC_CALL_TRAMP_ADDR(name) NULL + #endif + +- +-#define DECLARE_STATIC_CALL(name, func) \ +- extern struct static_call_key STATIC_CALL_KEY(name); \ +- extern typeof(func) STATIC_CALL_TRAMP(name); +- + #define static_call_update(name, func) \ + ({ \ + BUILD_BUG_ON(!__same_type(*(func), STATIC_CALL_TRAMP(name))); \ +@@ -154,6 +138,12 @@ struct static_call_key { + }; + }; + ++/* For finding the key associated with a trampoline */ ++struct static_call_tramp_key { ++ s32 tramp; ++ s32 key; ++}; ++ + extern void __static_call_update(struct static_call_key *key, void *tramp, void *func); + extern int static_call_mod_init(struct module *mod); + extern int static_call_text_reserved(void *start, void *end); +@@ -174,17 +164,23 @@ extern int static_call_text_reserved(void *start, void *end); + }; \ + ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name) + +-#define static_call(name) __static_call(name) + #define static_call_cond(name) (void)__static_call(name) + + #define EXPORT_STATIC_CALL(name) \ + EXPORT_SYMBOL(STATIC_CALL_KEY(name)); \ + EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)) +- + #define EXPORT_STATIC_CALL_GPL(name) \ + EXPORT_SYMBOL_GPL(STATIC_CALL_KEY(name)); \ + EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)) + ++/* Leave the key unexported, so modules can't change static call targets: */ ++#define EXPORT_STATIC_CALL_TRAMP(name) \ ++ EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)); \ ++ ARCH_ADD_TRAMP_KEY(name) ++#define EXPORT_STATIC_CALL_TRAMP_GPL(name) \ ++ EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)); \ ++ ARCH_ADD_TRAMP_KEY(name) ++ + #elif defined(CONFIG_HAVE_STATIC_CALL) + + static inline int static_call_init(void) { return 0; } +@@ -207,7 +203,6 @@ struct static_call_key { + }; \ + ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name) + +-#define static_call(name) __static_call(name) + #define static_call_cond(name) (void)__static_call(name) + + static inline +@@ -227,11 +222,16 @@ static inline int static_call_text_reserved(void *start, void *end) + #define EXPORT_STATIC_CALL(name) \ + EXPORT_SYMBOL(STATIC_CALL_KEY(name)); \ + EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)) +- + #define EXPORT_STATIC_CALL_GPL(name) \ + EXPORT_SYMBOL_GPL(STATIC_CALL_KEY(name)); \ + EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)) + ++/* Leave the key unexported, so modules can't change static call targets: */ ++#define EXPORT_STATIC_CALL_TRAMP(name) \ ++ EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)) ++#define EXPORT_STATIC_CALL_TRAMP_GPL(name) \ ++ EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)) ++ + #else /* Generic implementation */ + + static inline int static_call_init(void) { return 0; } +@@ -252,9 +252,6 @@ struct static_call_key { + .func = NULL, \ + } + +-#define static_call(name) \ +- ((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func)) +- + static inline void __static_call_nop(void) { } + + /* +diff --git a/include/linux/static_call_types.h b/include/linux/static_call_types.h +index 89135bb35bf76..ae5662d368b98 100644 +--- a/include/linux/static_call_types.h ++++ b/include/linux/static_call_types.h +@@ -4,11 +4,13 @@ + + #include + #include ++#include + + #define STATIC_CALL_KEY_PREFIX __SCK__ + #define STATIC_CALL_KEY_PREFIX_STR __stringify(STATIC_CALL_KEY_PREFIX) + #define STATIC_CALL_KEY_PREFIX_LEN (sizeof(STATIC_CALL_KEY_PREFIX_STR) - 1) + #define STATIC_CALL_KEY(name) __PASTE(STATIC_CALL_KEY_PREFIX, name) ++#define STATIC_CALL_KEY_STR(name) __stringify(STATIC_CALL_KEY(name)) + + #define STATIC_CALL_TRAMP_PREFIX __SCT__ + #define STATIC_CALL_TRAMP_PREFIX_STR __stringify(STATIC_CALL_TRAMP_PREFIX) +@@ -32,4 +34,52 @@ struct static_call_site { + s32 key; + }; + ++#define DECLARE_STATIC_CALL(name, func) \ ++ extern struct static_call_key STATIC_CALL_KEY(name); \ ++ extern typeof(func) STATIC_CALL_TRAMP(name); ++ ++#ifdef CONFIG_HAVE_STATIC_CALL ++ ++#define __raw_static_call(name) (&STATIC_CALL_TRAMP(name)) ++ ++#ifdef CONFIG_HAVE_STATIC_CALL_INLINE ++ ++/* ++ * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from ++ * the symbol table so that objtool can reference it when it generates the ++ * .static_call_sites section. ++ */ ++#define __STATIC_CALL_ADDRESSABLE(name) \ ++ __ADDRESSABLE(STATIC_CALL_KEY(name)) ++ ++#define __static_call(name) \ ++({ \ ++ __STATIC_CALL_ADDRESSABLE(name); \ ++ __raw_static_call(name); \ ++}) ++ ++#else /* !CONFIG_HAVE_STATIC_CALL_INLINE */ ++ ++#define __STATIC_CALL_ADDRESSABLE(name) ++#define __static_call(name) __raw_static_call(name) ++ ++#endif /* CONFIG_HAVE_STATIC_CALL_INLINE */ ++ ++#ifdef MODULE ++#define __STATIC_CALL_MOD_ADDRESSABLE(name) ++#define static_call_mod(name) __raw_static_call(name) ++#else ++#define __STATIC_CALL_MOD_ADDRESSABLE(name) __STATIC_CALL_ADDRESSABLE(name) ++#define static_call_mod(name) __static_call(name) ++#endif ++ ++#define static_call(name) __static_call(name) ++ ++#else ++ ++#define static_call(name) \ ++ ((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func)) ++ ++#endif /* CONFIG_HAVE_STATIC_CALL */ ++ + #endif /* _STATIC_CALL_TYPES_H */ +diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h +index c6abb79501b33..e81856c0ba134 100644 +--- a/include/linux/u64_stats_sync.h ++++ b/include/linux/u64_stats_sync.h +@@ -115,12 +115,13 @@ static inline void u64_stats_inc(u64_stats_t *p) + } + #endif + ++#if BITS_PER_LONG == 32 && defined(CONFIG_SMP) ++#define u64_stats_init(syncp) seqcount_init(&(syncp)->seq) ++#else + static inline void u64_stats_init(struct u64_stats_sync *syncp) + { +-#if BITS_PER_LONG == 32 && defined(CONFIG_SMP) +- seqcount_init(&syncp->seq); +-#endif + } ++#endif + + static inline void u64_stats_update_begin(struct u64_stats_sync *syncp) + { +diff --git a/include/linux/usermode_driver.h b/include/linux/usermode_driver.h +index 073a9e0ec07d0..ad970416260dd 100644 +--- a/include/linux/usermode_driver.h ++++ b/include/linux/usermode_driver.h +@@ -14,5 +14,6 @@ struct umd_info { + int umd_load_blob(struct umd_info *info, const void *data, size_t len); + int umd_unload_blob(struct umd_info *info); + int fork_usermode_driver(struct umd_info *info); ++void umd_cleanup_helper(struct umd_info *info); + + #endif /* __LINUX_USERMODE_DRIVER_H__ */ +diff --git a/include/net/dst.h b/include/net/dst.h +index 10f0a83998672..8d7cf51766c4b 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -533,4 +533,15 @@ static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu) + dst->ops->update_pmtu(dst, NULL, skb, mtu, false); + } + ++struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie); ++void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, ++ struct sk_buff *skb, u32 mtu, bool confirm_neigh); ++void dst_blackhole_redirect(struct dst_entry *dst, struct sock *sk, ++ struct sk_buff *skb); ++u32 *dst_blackhole_cow_metrics(struct dst_entry *dst, unsigned long old); ++struct neighbour *dst_blackhole_neigh_lookup(const struct dst_entry *dst, ++ struct sk_buff *skb, ++ const void *daddr); ++unsigned int dst_blackhole_mtu(const struct dst_entry *dst); ++ + #endif /* _NET_DST_H */ +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index 111d7771b2081..aa92af3dd444d 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -284,7 +284,7 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk) + return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog; + } + +-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); ++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); + void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req); + + static inline void inet_csk_prepare_for_destroy_sock(struct sock *sk) +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 4b6ecf5326238..6799f95eea650 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -1531,6 +1531,7 @@ struct nft_trans_flowtable { + struct nft_flowtable *flowtable; + bool update; + struct list_head hook_list; ++ u32 flags; + }; + + #define nft_trans_flowtable(trans) \ +@@ -1539,6 +1540,8 @@ struct nft_trans_flowtable { + (((struct nft_trans_flowtable *)trans->data)->update) + #define nft_trans_flowtable_hooks(trans) \ + (((struct nft_trans_flowtable *)trans->data)->hook_list) ++#define nft_trans_flowtable_flags(trans) \ ++ (((struct nft_trans_flowtable *)trans->data)->flags) + + int __init nft_chain_filter_init(void); + void nft_chain_filter_fini(void); +diff --git a/include/net/nexthop.h b/include/net/nexthop.h +index 226930d66b637..abd620103cec1 100644 +--- a/include/net/nexthop.h ++++ b/include/net/nexthop.h +@@ -400,6 +400,7 @@ static inline struct fib_nh *fib_info_nh(struct fib_info *fi, int nhsel) + int fib6_check_nexthop(struct nexthop *nh, struct fib6_config *cfg, + struct netlink_ext_ack *extack); + ++/* Caller should either hold rcu_read_lock(), or RTNL. */ + static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh) + { + struct nh_info *nhi; +@@ -420,6 +421,29 @@ static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh) + return NULL; + } + ++/* Variant of nexthop_fib6_nh(). ++ * Caller should either hold rcu_read_lock_bh(), or RTNL. ++ */ ++static inline struct fib6_nh *nexthop_fib6_nh_bh(struct nexthop *nh) ++{ ++ struct nh_info *nhi; ++ ++ if (nh->is_group) { ++ struct nh_group *nh_grp; ++ ++ nh_grp = rcu_dereference_bh_rtnl(nh->nh_grp); ++ nh = nexthop_mpath_select(nh_grp, 0); ++ if (!nh) ++ return NULL; ++ } ++ ++ nhi = rcu_dereference_bh_rtnl(nh->nh_info); ++ if (nhi->family == AF_INET6) ++ return &nhi->fib6_nh; ++ ++ return NULL; ++} ++ + static inline struct net_device *fib6_info_nh_dev(struct fib6_info *f6i) + { + struct fib6_nh *fib6_nh; +diff --git a/include/net/red.h b/include/net/red.h +index 932f0d79d60cb..9e6647c4ccd1f 100644 +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -168,7 +168,8 @@ static inline void red_set_vars(struct red_vars *v) + v->qcount = -1; + } + +-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log) ++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, ++ u8 Scell_log, u8 *stab) + { + if (fls(qth_min) + Wlog > 32) + return false; +@@ -178,6 +179,13 @@ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_ + return false; + if (qth_max < qth_min) + return false; ++ if (stab) { ++ int i; ++ ++ for (i = 0; i < RED_STAB_SIZE; i++) ++ if (stab[i] >= 32) ++ return false; ++ } + return true; + } + +diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h +index e2091bb2b3a8e..4da61c950e931 100644 +--- a/include/net/rtnetlink.h ++++ b/include/net/rtnetlink.h +@@ -33,6 +33,7 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh) + * + * @list: Used internally + * @kind: Identifier ++ * @netns_refund: Physical device, move to init_net on netns exit + * @maxtype: Highest device specific netlink attribute number + * @policy: Netlink policy for device specific attribute validation + * @validate: Optional validation function for netlink/changelink parameters +@@ -64,6 +65,7 @@ struct rtnl_link_ops { + size_t priv_size; + void (*setup)(struct net_device *dev); + ++ bool netns_refund; + unsigned int maxtype; + const struct nla_policy *policy; + int (*validate)(struct nlattr *tb[], +diff --git a/include/uapi/linux/psample.h b/include/uapi/linux/psample.h +index aea26ab1431c1..bff5032c98df4 100644 +--- a/include/uapi/linux/psample.h ++++ b/include/uapi/linux/psample.h +@@ -3,7 +3,6 @@ + #define __UAPI_PSAMPLE_H + + enum { +- /* sampled packet metadata */ + PSAMPLE_ATTR_IIFINDEX, + PSAMPLE_ATTR_OIFINDEX, + PSAMPLE_ATTR_ORIGSIZE, +@@ -11,10 +10,8 @@ enum { + PSAMPLE_ATTR_GROUP_SEQ, + PSAMPLE_ATTR_SAMPLE_RATE, + PSAMPLE_ATTR_DATA, +- PSAMPLE_ATTR_TUNNEL, +- +- /* commands attributes */ + PSAMPLE_ATTR_GROUP_REFCOUNT, ++ PSAMPLE_ATTR_TUNNEL, + + __PSAMPLE_ATTR_MAX + }; +diff --git a/kernel/bpf/bpf_inode_storage.c b/kernel/bpf/bpf_inode_storage.c +index 6639640523c0b..b58b2efb9b431 100644 +--- a/kernel/bpf/bpf_inode_storage.c ++++ b/kernel/bpf/bpf_inode_storage.c +@@ -109,7 +109,7 @@ static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key) + fd = *(int *)key; + f = fget_raw(fd); + if (!f) +- return NULL; ++ return ERR_PTR(-EBADF); + + sdata = inode_storage_lookup(f->f_inode, map, true); + fput(f); +diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c +index 1a666a975416c..70f6fd4fa3056 100644 +--- a/kernel/bpf/bpf_struct_ops.c ++++ b/kernel/bpf/bpf_struct_ops.c +@@ -430,7 +430,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, + + tprogs[BPF_TRAMP_FENTRY].progs[0] = prog; + tprogs[BPF_TRAMP_FENTRY].nr_progs = 1; +- err = arch_prepare_bpf_trampoline(image, ++ err = arch_prepare_bpf_trampoline(NULL, image, + st_map->image + PAGE_SIZE, + &st_ops->func_models[i], 0, + tprogs, NULL); +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 261f8692d0d2a..1de87fcaeabdb 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -817,7 +817,7 @@ static int __init bpf_jit_charge_init(void) + } + pure_initcall(bpf_jit_charge_init); + +-static int bpf_jit_charge_modmem(u32 pages) ++int bpf_jit_charge_modmem(u32 pages) + { + if (atomic_long_add_return(pages, &bpf_jit_current) > + (bpf_jit_limit >> PAGE_SHIFT)) { +@@ -830,7 +830,7 @@ static int bpf_jit_charge_modmem(u32 pages) + return 0; + } + +-static void bpf_jit_uncharge_modmem(u32 pages) ++void bpf_jit_uncharge_modmem(u32 pages) + { + atomic_long_sub(pages, &bpf_jit_current); + } +diff --git a/kernel/bpf/preload/bpf_preload_kern.c b/kernel/bpf/preload/bpf_preload_kern.c +index 79c5772465f14..53736e52c1dfa 100644 +--- a/kernel/bpf/preload/bpf_preload_kern.c ++++ b/kernel/bpf/preload/bpf_preload_kern.c +@@ -60,9 +60,12 @@ static int finish(void) + &magic, sizeof(magic), &pos); + if (n != sizeof(magic)) + return -EPIPE; ++ + tgid = umd_ops.info.tgid; +- wait_event(tgid->wait_pidfd, thread_group_exited(tgid)); +- umd_ops.info.tgid = NULL; ++ if (tgid) { ++ wait_event(tgid->wait_pidfd, thread_group_exited(tgid)); ++ umd_cleanup_helper(&umd_ops.info); ++ } + return 0; + } + +@@ -80,10 +83,18 @@ static int __init load_umd(void) + + static void __exit fini_umd(void) + { ++ struct pid *tgid; ++ + bpf_preload_ops = NULL; ++ + /* kill UMD in case it's still there due to earlier error */ +- kill_pid(umd_ops.info.tgid, SIGKILL, 1); +- umd_ops.info.tgid = NULL; ++ tgid = umd_ops.info.tgid; ++ if (tgid) { ++ kill_pid(tgid, SIGKILL, 1); ++ ++ wait_event(tgid->wait_pidfd, thread_group_exited(tgid)); ++ umd_cleanup_helper(&umd_ops.info); ++ } + umd_unload_blob(&umd_ops.info); + } + late_initcall(load_umd); +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index e5999d86c76ea..32ca33539052b 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -854,6 +854,11 @@ static int map_create(union bpf_attr *attr) + err = PTR_ERR(btf); + goto free_map; + } ++ if (btf_is_kernel(btf)) { ++ btf_put(btf); ++ err = -EACCES; ++ goto free_map; ++ } + map->btf = btf; + + if (attr->btf_value_type_id) { +diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c +index 35c5887d82ffe..986dabc3d11f0 100644 +--- a/kernel/bpf/trampoline.c ++++ b/kernel/bpf/trampoline.c +@@ -57,19 +57,10 @@ void bpf_image_ksym_del(struct bpf_ksym *ksym) + PAGE_SIZE, true, ksym->name); + } + +-static void bpf_trampoline_ksym_add(struct bpf_trampoline *tr) +-{ +- struct bpf_ksym *ksym = &tr->ksym; +- +- snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu", tr->key); +- bpf_image_ksym_add(tr->image, ksym); +-} +- + static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) + { + struct bpf_trampoline *tr; + struct hlist_head *head; +- void *image; + int i; + + mutex_lock(&trampoline_mutex); +@@ -84,14 +75,6 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) + if (!tr) + goto out; + +- /* is_root was checked earlier. No need for bpf_jit_charge_modmem() */ +- image = bpf_jit_alloc_exec_page(); +- if (!image) { +- kfree(tr); +- tr = NULL; +- goto out; +- } +- + tr->key = key; + INIT_HLIST_NODE(&tr->hlist); + hlist_add_head(&tr->hlist, head); +@@ -99,9 +82,6 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) + mutex_init(&tr->mutex); + for (i = 0; i < BPF_TRAMP_MAX; i++) + INIT_HLIST_HEAD(&tr->progs_hlist[i]); +- tr->image = image; +- INIT_LIST_HEAD_RCU(&tr->ksym.lnode); +- bpf_trampoline_ksym_add(tr); + out: + mutex_unlock(&trampoline_mutex); + return tr; +@@ -185,10 +165,142 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total) + return tprogs; + } + ++static void __bpf_tramp_image_put_deferred(struct work_struct *work) ++{ ++ struct bpf_tramp_image *im; ++ ++ im = container_of(work, struct bpf_tramp_image, work); ++ bpf_image_ksym_del(&im->ksym); ++ bpf_jit_free_exec(im->image); ++ bpf_jit_uncharge_modmem(1); ++ percpu_ref_exit(&im->pcref); ++ kfree_rcu(im, rcu); ++} ++ ++/* callback, fexit step 3 or fentry step 2 */ ++static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu) ++{ ++ struct bpf_tramp_image *im; ++ ++ im = container_of(rcu, struct bpf_tramp_image, rcu); ++ INIT_WORK(&im->work, __bpf_tramp_image_put_deferred); ++ schedule_work(&im->work); ++} ++ ++/* callback, fexit step 2. Called after percpu_ref_kill confirms. */ ++static void __bpf_tramp_image_release(struct percpu_ref *pcref) ++{ ++ struct bpf_tramp_image *im; ++ ++ im = container_of(pcref, struct bpf_tramp_image, pcref); ++ call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu); ++} ++ ++/* callback, fexit or fentry step 1 */ ++static void __bpf_tramp_image_put_rcu_tasks(struct rcu_head *rcu) ++{ ++ struct bpf_tramp_image *im; ++ ++ im = container_of(rcu, struct bpf_tramp_image, rcu); ++ if (im->ip_after_call) ++ /* the case of fmod_ret/fexit trampoline and CONFIG_PREEMPTION=y */ ++ percpu_ref_kill(&im->pcref); ++ else ++ /* the case of fentry trampoline */ ++ call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu); ++} ++ ++static void bpf_tramp_image_put(struct bpf_tramp_image *im) ++{ ++ /* The trampoline image that calls original function is using: ++ * rcu_read_lock_trace to protect sleepable bpf progs ++ * rcu_read_lock to protect normal bpf progs ++ * percpu_ref to protect trampoline itself ++ * rcu tasks to protect trampoline asm not covered by percpu_ref ++ * (which are few asm insns before __bpf_tramp_enter and ++ * after __bpf_tramp_exit) ++ * ++ * The trampoline is unreachable before bpf_tramp_image_put(). ++ * ++ * First, patch the trampoline to avoid calling into fexit progs. ++ * The progs will be freed even if the original function is still ++ * executing or sleeping. ++ * In case of CONFIG_PREEMPT=y use call_rcu_tasks() to wait on ++ * first few asm instructions to execute and call into ++ * __bpf_tramp_enter->percpu_ref_get. ++ * Then use percpu_ref_kill to wait for the trampoline and the original ++ * function to finish. ++ * Then use call_rcu_tasks() to make sure few asm insns in ++ * the trampoline epilogue are done as well. ++ * ++ * In !PREEMPT case the task that got interrupted in the first asm ++ * insns won't go through an RCU quiescent state which the ++ * percpu_ref_kill will be waiting for. Hence the first ++ * call_rcu_tasks() is not necessary. ++ */ ++ if (im->ip_after_call) { ++ int err = bpf_arch_text_poke(im->ip_after_call, BPF_MOD_JUMP, ++ NULL, im->ip_epilogue); ++ WARN_ON(err); ++ if (IS_ENABLED(CONFIG_PREEMPTION)) ++ call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu_tasks); ++ else ++ percpu_ref_kill(&im->pcref); ++ return; ++ } ++ ++ /* The trampoline without fexit and fmod_ret progs doesn't call original ++ * function and doesn't use percpu_ref. ++ * Use call_rcu_tasks_trace() to wait for sleepable progs to finish. ++ * Then use call_rcu_tasks() to wait for the rest of trampoline asm ++ * and normal progs. ++ */ ++ call_rcu_tasks_trace(&im->rcu, __bpf_tramp_image_put_rcu_tasks); ++} ++ ++static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx) ++{ ++ struct bpf_tramp_image *im; ++ struct bpf_ksym *ksym; ++ void *image; ++ int err = -ENOMEM; ++ ++ im = kzalloc(sizeof(*im), GFP_KERNEL); ++ if (!im) ++ goto out; ++ ++ err = bpf_jit_charge_modmem(1); ++ if (err) ++ goto out_free_im; ++ ++ err = -ENOMEM; ++ im->image = image = bpf_jit_alloc_exec_page(); ++ if (!image) ++ goto out_uncharge; ++ ++ err = percpu_ref_init(&im->pcref, __bpf_tramp_image_release, 0, GFP_KERNEL); ++ if (err) ++ goto out_free_image; ++ ++ ksym = &im->ksym; ++ INIT_LIST_HEAD_RCU(&ksym->lnode); ++ snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu_%u", key, idx); ++ bpf_image_ksym_add(image, ksym); ++ return im; ++ ++out_free_image: ++ bpf_jit_free_exec(im->image); ++out_uncharge: ++ bpf_jit_uncharge_modmem(1); ++out_free_im: ++ kfree(im); ++out: ++ return ERR_PTR(err); ++} ++ + static int bpf_trampoline_update(struct bpf_trampoline *tr) + { +- void *old_image = tr->image + ((tr->selector + 1) & 1) * PAGE_SIZE/2; +- void *new_image = tr->image + (tr->selector & 1) * PAGE_SIZE/2; ++ struct bpf_tramp_image *im; + struct bpf_tramp_progs *tprogs; + u32 flags = BPF_TRAMP_F_RESTORE_REGS; + int err, total; +@@ -198,41 +310,42 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) + return PTR_ERR(tprogs); + + if (total == 0) { +- err = unregister_fentry(tr, old_image); ++ err = unregister_fentry(tr, tr->cur_image->image); ++ bpf_tramp_image_put(tr->cur_image); ++ tr->cur_image = NULL; + tr->selector = 0; + goto out; + } + ++ im = bpf_tramp_image_alloc(tr->key, tr->selector); ++ if (IS_ERR(im)) { ++ err = PTR_ERR(im); ++ goto out; ++ } ++ + if (tprogs[BPF_TRAMP_FEXIT].nr_progs || + tprogs[BPF_TRAMP_MODIFY_RETURN].nr_progs) + flags = BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_SKIP_FRAME; + +- /* Though the second half of trampoline page is unused a task could be +- * preempted in the middle of the first half of trampoline and two +- * updates to trampoline would change the code from underneath the +- * preempted task. Hence wait for tasks to voluntarily schedule or go +- * to userspace. +- * The same trampoline can hold both sleepable and non-sleepable progs. +- * synchronize_rcu_tasks_trace() is needed to make sure all sleepable +- * programs finish executing. +- * Wait for these two grace periods together. +- */ +- synchronize_rcu_mult(call_rcu_tasks, call_rcu_tasks_trace); +- +- err = arch_prepare_bpf_trampoline(new_image, new_image + PAGE_SIZE / 2, ++ err = arch_prepare_bpf_trampoline(im, im->image, im->image + PAGE_SIZE, + &tr->func.model, flags, tprogs, + tr->func.addr); + if (err < 0) + goto out; + +- if (tr->selector) ++ WARN_ON(tr->cur_image && tr->selector == 0); ++ WARN_ON(!tr->cur_image && tr->selector); ++ if (tr->cur_image) + /* progs already running at this address */ +- err = modify_fentry(tr, old_image, new_image); ++ err = modify_fentry(tr, tr->cur_image->image, im->image); + else + /* first time registering */ +- err = register_fentry(tr, new_image); ++ err = register_fentry(tr, im->image); + if (err) + goto out; ++ if (tr->cur_image) ++ bpf_tramp_image_put(tr->cur_image); ++ tr->cur_image = im; + tr->selector++; + out: + kfree(tprogs); +@@ -364,17 +477,12 @@ void bpf_trampoline_put(struct bpf_trampoline *tr) + goto out; + if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FEXIT]))) + goto out; +- bpf_image_ksym_del(&tr->ksym); +- /* This code will be executed when all bpf progs (both sleepable and +- * non-sleepable) went through +- * bpf_prog_put()->call_rcu[_tasks_trace]()->bpf_prog_free_deferred(). +- * Hence no need for another synchronize_rcu_tasks_trace() here, +- * but synchronize_rcu_tasks() is still needed, since trampoline +- * may not have had any sleepable programs and we need to wait +- * for tasks to get out of trampoline code before freeing it. ++ /* This code will be executed even when the last bpf_tramp_image ++ * is alive. All progs are detached from the trampoline and the ++ * trampoline image is patched with jmp into epilogue to skip ++ * fexit progs. The fentry-only trampoline will be freed via ++ * multiple rcu callbacks. + */ +- synchronize_rcu_tasks(); +- bpf_jit_free_exec(tr->image); + hlist_del(&tr->hlist); + kfree(tr); + out: +@@ -433,8 +541,18 @@ void notrace __bpf_prog_exit_sleepable(void) + rcu_read_unlock_trace(); + } + ++void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr) ++{ ++ percpu_ref_get(&tr->pcref); ++} ++ ++void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr) ++{ ++ percpu_ref_put(&tr->pcref); ++} ++ + int __weak +-arch_prepare_bpf_trampoline(void *image, void *image_end, ++arch_prepare_bpf_trampoline(struct bpf_tramp_image *tr, void *image, void *image_end, + const struct btf_func_model *m, u32 flags, + struct bpf_tramp_progs *tprogs, + void *orig_call) +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index ab23dfb9df1b1..5b233e911c2c2 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -8580,6 +8580,10 @@ static int check_btf_info(struct bpf_verifier_env *env, + btf = btf_get_by_fd(attr->prog_btf_fd); + if (IS_ERR(btf)) + return PTR_ERR(btf); ++ if (btf_is_kernel(btf)) { ++ btf_put(btf); ++ return -EACCES; ++ } + env->prog->aux->btf = btf; + + err = check_btf_func(env, attr, uattr); +diff --git a/kernel/fork.c b/kernel/fork.c +index d66cd1014211b..808af2cc8ab68 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -994,6 +994,13 @@ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p) + #endif + } + ++static void mm_init_pasid(struct mm_struct *mm) ++{ ++#ifdef CONFIG_IOMMU_SUPPORT ++ mm->pasid = INIT_PASID; ++#endif ++} ++ + static void mm_init_uprobes_state(struct mm_struct *mm) + { + #ifdef CONFIG_UPROBES +@@ -1024,6 +1031,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, + mm_init_cpumask(mm); + mm_init_aio(mm); + mm_init_owner(mm, p); ++ mm_init_pasid(mm); + RCU_INIT_POINTER(mm->exe_file, NULL); + mmu_notifier_subscriptions_init(mm); + init_tlb_flush_pending(mm); +diff --git a/kernel/gcov/clang.c b/kernel/gcov/clang.c +index c94b820a1b62c..8743150db2acc 100644 +--- a/kernel/gcov/clang.c ++++ b/kernel/gcov/clang.c +@@ -75,7 +75,9 @@ struct gcov_fn_info { + + u32 num_counters; + u64 *counters; ++#if CONFIG_CLANG_VERSION < 110000 + const char *function_name; ++#endif + }; + + static struct gcov_info *current_info; +@@ -105,6 +107,7 @@ void llvm_gcov_init(llvm_gcov_callback writeout, llvm_gcov_callback flush) + } + EXPORT_SYMBOL(llvm_gcov_init); + ++#if CONFIG_CLANG_VERSION < 110000 + void llvm_gcda_start_file(const char *orig_filename, const char version[4], + u32 checksum) + { +@@ -113,7 +116,17 @@ void llvm_gcda_start_file(const char *orig_filename, const char version[4], + current_info->checksum = checksum; + } + EXPORT_SYMBOL(llvm_gcda_start_file); ++#else ++void llvm_gcda_start_file(const char *orig_filename, u32 version, u32 checksum) ++{ ++ current_info->filename = orig_filename; ++ current_info->version = version; ++ current_info->checksum = checksum; ++} ++EXPORT_SYMBOL(llvm_gcda_start_file); ++#endif + ++#if CONFIG_CLANG_VERSION < 110000 + void llvm_gcda_emit_function(u32 ident, const char *function_name, + u32 func_checksum, u8 use_extra_checksum, u32 cfg_checksum) + { +@@ -133,6 +146,24 @@ void llvm_gcda_emit_function(u32 ident, const char *function_name, + list_add_tail(&info->head, ¤t_info->functions); + } + EXPORT_SYMBOL(llvm_gcda_emit_function); ++#else ++void llvm_gcda_emit_function(u32 ident, u32 func_checksum, ++ u8 use_extra_checksum, u32 cfg_checksum) ++{ ++ struct gcov_fn_info *info = kzalloc(sizeof(*info), GFP_KERNEL); ++ ++ if (!info) ++ return; ++ ++ INIT_LIST_HEAD(&info->head); ++ info->ident = ident; ++ info->checksum = func_checksum; ++ info->use_extra_checksum = use_extra_checksum; ++ info->cfg_checksum = cfg_checksum; ++ list_add_tail(&info->head, ¤t_info->functions); ++} ++EXPORT_SYMBOL(llvm_gcda_emit_function); ++#endif + + void llvm_gcda_emit_arcs(u32 num_counters, u64 *counters) + { +@@ -295,6 +326,7 @@ void gcov_info_add(struct gcov_info *dst, struct gcov_info *src) + } + } + ++#if CONFIG_CLANG_VERSION < 110000 + static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn) + { + size_t cv_size; /* counter values size */ +@@ -322,6 +354,28 @@ err_name: + kfree(fn_dup); + return NULL; + } ++#else ++static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn) ++{ ++ size_t cv_size; /* counter values size */ ++ struct gcov_fn_info *fn_dup = kmemdup(fn, sizeof(*fn), ++ GFP_KERNEL); ++ if (!fn_dup) ++ return NULL; ++ INIT_LIST_HEAD(&fn_dup->head); ++ ++ cv_size = fn->num_counters * sizeof(fn->counters[0]); ++ fn_dup->counters = vmalloc(cv_size); ++ if (!fn_dup->counters) { ++ kfree(fn_dup); ++ return NULL; ++ } ++ ++ memcpy(fn_dup->counters, fn->counters, cv_size); ++ ++ return fn_dup; ++} ++#endif + + /** + * gcov_info_dup - duplicate profiling data set +@@ -362,6 +416,7 @@ err: + * gcov_info_free - release memory for profiling data set duplicate + * @info: profiling data set duplicate to free + */ ++#if CONFIG_CLANG_VERSION < 110000 + void gcov_info_free(struct gcov_info *info) + { + struct gcov_fn_info *fn, *tmp; +@@ -375,6 +430,20 @@ void gcov_info_free(struct gcov_info *info) + kfree(info->filename); + kfree(info); + } ++#else ++void gcov_info_free(struct gcov_info *info) ++{ ++ struct gcov_fn_info *fn, *tmp; ++ ++ list_for_each_entry_safe(fn, tmp, &info->functions, head) { ++ vfree(fn->counters); ++ list_del(&fn->head); ++ kfree(fn); ++ } ++ kfree(info->filename); ++ kfree(info); ++} ++#endif + + #define ITER_STRIDE PAGE_SIZE + +diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c +index 1358fa4abfa83..0f4530b3a8cd9 100644 +--- a/kernel/power/energy_model.c ++++ b/kernel/power/energy_model.c +@@ -98,7 +98,7 @@ static int __init em_debug_init(void) + + return 0; + } +-core_initcall(em_debug_init); ++fs_initcall(em_debug_init); + #else /* CONFIG_DEBUG_FS */ + static void em_debug_create_pd(struct device *dev) {} + static void em_debug_remove_pd(struct device *dev) {} +diff --git a/kernel/static_call.c b/kernel/static_call.c +index db914da6e7854..49efbdc5b4800 100644 +--- a/kernel/static_call.c ++++ b/kernel/static_call.c +@@ -12,6 +12,8 @@ + + extern struct static_call_site __start_static_call_sites[], + __stop_static_call_sites[]; ++extern struct static_call_tramp_key __start_static_call_tramp_key[], ++ __stop_static_call_tramp_key[]; + + static bool static_call_initialized; + +@@ -33,27 +35,30 @@ static inline void *static_call_addr(struct static_call_site *site) + return (void *)((long)site->addr + (long)&site->addr); + } + ++static inline unsigned long __static_call_key(const struct static_call_site *site) ++{ ++ return (long)site->key + (long)&site->key; ++} + + static inline struct static_call_key *static_call_key(const struct static_call_site *site) + { +- return (struct static_call_key *) +- (((long)site->key + (long)&site->key) & ~STATIC_CALL_SITE_FLAGS); ++ return (void *)(__static_call_key(site) & ~STATIC_CALL_SITE_FLAGS); + } + + /* These assume the key is word-aligned. */ + static inline bool static_call_is_init(struct static_call_site *site) + { +- return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_INIT; ++ return __static_call_key(site) & STATIC_CALL_SITE_INIT; + } + + static inline bool static_call_is_tail(struct static_call_site *site) + { +- return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_TAIL; ++ return __static_call_key(site) & STATIC_CALL_SITE_TAIL; + } + + static inline void static_call_set_init(struct static_call_site *site) + { +- site->key = ((long)static_call_key(site) | STATIC_CALL_SITE_INIT) - ++ site->key = (__static_call_key(site) | STATIC_CALL_SITE_INIT) - + (long)&site->key; + } + +@@ -197,7 +202,7 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) + } + + arch_static_call_transform(site_addr, NULL, func, +- static_call_is_tail(site)); ++ static_call_is_tail(site)); + } + } + +@@ -332,10 +337,60 @@ static int __static_call_mod_text_reserved(void *start, void *end) + return ret; + } + ++static unsigned long tramp_key_lookup(unsigned long addr) ++{ ++ struct static_call_tramp_key *start = __start_static_call_tramp_key; ++ struct static_call_tramp_key *stop = __stop_static_call_tramp_key; ++ struct static_call_tramp_key *tramp_key; ++ ++ for (tramp_key = start; tramp_key != stop; tramp_key++) { ++ unsigned long tramp; ++ ++ tramp = (long)tramp_key->tramp + (long)&tramp_key->tramp; ++ if (tramp == addr) ++ return (long)tramp_key->key + (long)&tramp_key->key; ++ } ++ ++ return 0; ++} ++ + static int static_call_add_module(struct module *mod) + { +- return __static_call_init(mod, mod->static_call_sites, +- mod->static_call_sites + mod->num_static_call_sites); ++ struct static_call_site *start = mod->static_call_sites; ++ struct static_call_site *stop = start + mod->num_static_call_sites; ++ struct static_call_site *site; ++ ++ for (site = start; site != stop; site++) { ++ unsigned long s_key = __static_call_key(site); ++ unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS; ++ unsigned long key; ++ ++ /* ++ * Is the key is exported, 'addr' points to the key, which ++ * means modules are allowed to call static_call_update() on ++ * it. ++ * ++ * Otherwise, the key isn't exported, and 'addr' points to the ++ * trampoline so we need to lookup the key. ++ * ++ * We go through this dance to prevent crazy modules from ++ * abusing sensitive static calls. ++ */ ++ if (!kernel_text_address(addr)) ++ continue; ++ ++ key = tramp_key_lookup(addr); ++ if (!key) { ++ pr_warn("Failed to fixup __raw_static_call() usage at: %ps\n", ++ static_call_addr(site)); ++ return -EINVAL; ++ } ++ ++ key |= s_key & STATIC_CALL_SITE_FLAGS; ++ site->key = key - (long)&site->key; ++ } ++ ++ return __static_call_init(mod, start, stop); + } + + static void static_call_del_module(struct module *mod) +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 4d8e355755491..b7e29db127fa2 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -5045,6 +5045,20 @@ struct ftrace_direct_func *ftrace_find_direct_func(unsigned long addr) + return NULL; + } + ++static struct ftrace_direct_func *ftrace_alloc_direct_func(unsigned long addr) ++{ ++ struct ftrace_direct_func *direct; ++ ++ direct = kmalloc(sizeof(*direct), GFP_KERNEL); ++ if (!direct) ++ return NULL; ++ direct->addr = addr; ++ direct->count = 0; ++ list_add_rcu(&direct->next, &ftrace_direct_funcs); ++ ftrace_direct_func_count++; ++ return direct; ++} ++ + /** + * register_ftrace_direct - Call a custom trampoline directly + * @ip: The address of the nop at the beginning of a function +@@ -5120,15 +5134,11 @@ int register_ftrace_direct(unsigned long ip, unsigned long addr) + + direct = ftrace_find_direct_func(addr); + if (!direct) { +- direct = kmalloc(sizeof(*direct), GFP_KERNEL); ++ direct = ftrace_alloc_direct_func(addr); + if (!direct) { + kfree(entry); + goto out_unlock; + } +- direct->addr = addr; +- direct->count = 0; +- list_add_rcu(&direct->next, &ftrace_direct_funcs); +- ftrace_direct_func_count++; + } + + entry->ip = ip; +@@ -5329,6 +5339,7 @@ int __weak ftrace_modify_direct_caller(struct ftrace_func_entry *entry, + int modify_ftrace_direct(unsigned long ip, + unsigned long old_addr, unsigned long new_addr) + { ++ struct ftrace_direct_func *direct, *new_direct = NULL; + struct ftrace_func_entry *entry; + struct dyn_ftrace *rec; + int ret = -ENODEV; +@@ -5344,6 +5355,20 @@ int modify_ftrace_direct(unsigned long ip, + if (entry->direct != old_addr) + goto out_unlock; + ++ direct = ftrace_find_direct_func(old_addr); ++ if (WARN_ON(!direct)) ++ goto out_unlock; ++ if (direct->count > 1) { ++ ret = -ENOMEM; ++ new_direct = ftrace_alloc_direct_func(new_addr); ++ if (!new_direct) ++ goto out_unlock; ++ direct->count--; ++ new_direct->count++; ++ } else { ++ direct->addr = new_addr; ++ } ++ + /* + * If there's no other ftrace callback on the rec->ip location, + * then it can be changed directly by the architecture. +@@ -5357,6 +5382,14 @@ int modify_ftrace_direct(unsigned long ip, + ret = 0; + } + ++ if (unlikely(ret && new_direct)) { ++ direct->count++; ++ list_del_rcu(&new_direct->next); ++ synchronize_rcu_tasks(); ++ kfree(new_direct); ++ ftrace_direct_func_count--; ++ } ++ + out_unlock: + mutex_unlock(&ftrace_lock); + mutex_unlock(&direct_mutex); +diff --git a/kernel/usermode_driver.c b/kernel/usermode_driver.c +index 0b35212ffc3d0..bb7bb3b478abf 100644 +--- a/kernel/usermode_driver.c ++++ b/kernel/usermode_driver.c +@@ -139,13 +139,22 @@ static void umd_cleanup(struct subprocess_info *info) + struct umd_info *umd_info = info->data; + + /* cleanup if umh_setup() was successful but exec failed */ +- if (info->retval) { +- fput(umd_info->pipe_to_umh); +- fput(umd_info->pipe_from_umh); +- put_pid(umd_info->tgid); +- umd_info->tgid = NULL; +- } ++ if (info->retval) ++ umd_cleanup_helper(umd_info); ++} ++ ++/** ++ * umd_cleanup_helper - release the resources which were allocated in umd_setup ++ * @info: information about usermode driver ++ */ ++void umd_cleanup_helper(struct umd_info *info) ++{ ++ fput(info->pipe_to_umh); ++ fput(info->pipe_from_umh); ++ put_pid(info->tgid); ++ info->tgid = NULL; + } ++EXPORT_SYMBOL_GPL(umd_cleanup_helper); + + /** + * fork_usermode_driver - fork a usermode driver +diff --git a/mm/highmem.c b/mm/highmem.c +index 86f2b9495f9cf..6ef8f5e05e7e5 100644 +--- a/mm/highmem.c ++++ b/mm/highmem.c +@@ -618,7 +618,7 @@ void __kmap_local_sched_out(void) + int idx; + + /* With debug all even slots are unmapped and act as guard */ +- if (IS_ENABLED(CONFIG_DEBUG_HIGHMEM) && !(i & 0x01)) { ++ if (IS_ENABLED(CONFIG_DEBUG_KMAP_LOCAL) && !(i & 0x01)) { + WARN_ON_ONCE(!pte_none(pteval)); + continue; + } +@@ -654,7 +654,7 @@ void __kmap_local_sched_in(void) + int idx; + + /* With debug all even slots are unmapped and act as guard */ +- if (IS_ENABLED(CONFIG_DEBUG_HIGHMEM) && !(i & 0x01)) { ++ if (IS_ENABLED(CONFIG_DEBUG_KMAP_LOCAL) && !(i & 0x01)) { + WARN_ON_ONCE(!pte_none(pteval)); + continue; + } +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 1690e8db5b0de..8e89b277ffcc3 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -285,6 +285,17 @@ static void record_hugetlb_cgroup_uncharge_info(struct hugetlb_cgroup *h_cg, + nrg->reservation_counter = + &h_cg->rsvd_hugepage[hstate_index(h)]; + nrg->css = &h_cg->css; ++ /* ++ * The caller will hold exactly one h_cg->css reference for the ++ * whole contiguous reservation region. But this area might be ++ * scattered when there are already some file_regions reside in ++ * it. As a result, many file_regions may share only one css ++ * reference. In order to ensure that one file_region must hold ++ * exactly one h_cg->css reference, we should do css_get for ++ * each file_region and leave the reference held by caller ++ * untouched. ++ */ ++ css_get(&h_cg->css); + if (!resv->pages_per_hpage) + resv->pages_per_hpage = pages_per_huge_page(h); + /* pages_per_hpage should be the same for all entries in +@@ -298,6 +309,14 @@ static void record_hugetlb_cgroup_uncharge_info(struct hugetlb_cgroup *h_cg, + #endif + } + ++static void put_uncharge_info(struct file_region *rg) ++{ ++#ifdef CONFIG_CGROUP_HUGETLB ++ if (rg->css) ++ css_put(rg->css); ++#endif ++} ++ + static bool has_same_uncharge_info(struct file_region *rg, + struct file_region *org) + { +@@ -321,6 +340,7 @@ static void coalesce_file_region(struct resv_map *resv, struct file_region *rg) + prg->to = rg->to; + + list_del(&rg->link); ++ put_uncharge_info(rg); + kfree(rg); + + rg = prg; +@@ -332,6 +352,7 @@ static void coalesce_file_region(struct resv_map *resv, struct file_region *rg) + nrg->from = rg->from; + + list_del(&rg->link); ++ put_uncharge_info(rg); + kfree(rg); + } + } +@@ -664,7 +685,7 @@ retry: + + del += t - f; + hugetlb_cgroup_uncharge_file_region( +- resv, rg, t - f); ++ resv, rg, t - f, false); + + /* New entry for end of split region */ + nrg->from = t; +@@ -685,7 +706,7 @@ retry: + if (f <= rg->from && t >= rg->to) { /* Remove entire region */ + del += rg->to - rg->from; + hugetlb_cgroup_uncharge_file_region(resv, rg, +- rg->to - rg->from); ++ rg->to - rg->from, true); + list_del(&rg->link); + kfree(rg); + continue; +@@ -693,13 +714,13 @@ retry: + + if (f <= rg->from) { /* Trim beginning of region */ + hugetlb_cgroup_uncharge_file_region(resv, rg, +- t - rg->from); ++ t - rg->from, false); + + del += t - rg->from; + rg->from = t; + } else { /* Trim end of region */ + hugetlb_cgroup_uncharge_file_region(resv, rg, +- rg->to - f); ++ rg->to - f, false); + + del += rg->to - f; + rg->to = f; +@@ -5191,6 +5212,10 @@ int hugetlb_reserve_pages(struct inode *inode, + */ + long rsv_adjust; + ++ /* ++ * hugetlb_cgroup_uncharge_cgroup_rsvd() will put the ++ * reference to h_cg->css. See comment below for detail. ++ */ + hugetlb_cgroup_uncharge_cgroup_rsvd( + hstate_index(h), + (chg - add) * pages_per_huge_page(h), h_cg); +@@ -5198,6 +5223,14 @@ int hugetlb_reserve_pages(struct inode *inode, + rsv_adjust = hugepage_subpool_put_pages(spool, + chg - add); + hugetlb_acct_memory(h, -rsv_adjust); ++ } else if (h_cg) { ++ /* ++ * The file_regions will hold their own reference to ++ * h_cg->css. So we should release the reference held ++ * via hugetlb_cgroup_charge_cgroup_rsvd() when we are ++ * done. ++ */ ++ hugetlb_cgroup_put_rsvd_cgroup(h_cg); + } + } + return 0; +diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c +index 9182848dda3e0..1348819f546cb 100644 +--- a/mm/hugetlb_cgroup.c ++++ b/mm/hugetlb_cgroup.c +@@ -391,7 +391,8 @@ void hugetlb_cgroup_uncharge_counter(struct resv_map *resv, unsigned long start, + + void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv, + struct file_region *rg, +- unsigned long nr_pages) ++ unsigned long nr_pages, ++ bool region_del) + { + if (hugetlb_cgroup_disabled() || !resv || !rg || !nr_pages) + return; +@@ -400,7 +401,12 @@ void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv, + !resv->reservation_counter) { + page_counter_uncharge(rg->reservation_counter, + nr_pages * resv->pages_per_hpage); +- css_put(rg->css); ++ /* ++ * Only do css_put(rg->css) when we delete the entire region ++ * because one file_region must hold exactly one css reference. ++ */ ++ if (region_del) ++ css_put(rg->css); + } + } + +diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c +index 61ee40ed804ee..459d195d2ff64 100644 +--- a/mm/mmu_notifier.c ++++ b/mm/mmu_notifier.c +@@ -501,10 +501,33 @@ static int mn_hlist_invalidate_range_start( + ""); + WARN_ON(mmu_notifier_range_blockable(range) || + _ret != -EAGAIN); ++ /* ++ * We call all the notifiers on any EAGAIN, ++ * there is no way for a notifier to know if ++ * its start method failed, thus a start that ++ * does EAGAIN can't also do end. ++ */ ++ WARN_ON(ops->invalidate_range_end); + ret = _ret; + } + } + } ++ ++ if (ret) { ++ /* ++ * Must be non-blocking to get here. If there are multiple ++ * notifiers and one or more failed start, any that succeeded ++ * start are expecting their end to be called. Do so now. ++ */ ++ hlist_for_each_entry_rcu(subscription, &subscriptions->list, ++ hlist, srcu_read_lock_held(&srcu)) { ++ if (!subscription->ops->invalidate_range_end) ++ continue; ++ ++ subscription->ops->invalidate_range_end(subscription, ++ range); ++ } ++ } + srcu_read_unlock(&srcu, id); + + return ret; +diff --git a/mm/z3fold.c b/mm/z3fold.c +index dacb0d70fa61c..36d810cac99d0 100644 +--- a/mm/z3fold.c ++++ b/mm/z3fold.c +@@ -1353,8 +1353,22 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) + page = list_entry(pos, struct page, lru); + + zhdr = page_address(page); +- if (test_bit(PAGE_HEADLESS, &page->private)) ++ if (test_bit(PAGE_HEADLESS, &page->private)) { ++ /* ++ * For non-headless pages, we wait to do this ++ * until we have the page lock to avoid racing ++ * with __z3fold_alloc(). Headless pages don't ++ * have a lock (and __z3fold_alloc() will never ++ * see them), but we still need to test and set ++ * PAGE_CLAIMED to avoid racing with ++ * z3fold_free(), so just do it now before ++ * leaving the loop. ++ */ ++ if (test_and_set_bit(PAGE_CLAIMED, &page->private)) ++ continue; ++ + break; ++ } + + if (kref_get_unless_zero(&zhdr->refcount) == 0) { + zhdr = NULL; +diff --git a/net/bridge/br_switchdev.c b/net/bridge/br_switchdev.c +index 015209bf44aa4..3c42095fa75fd 100644 +--- a/net/bridge/br_switchdev.c ++++ b/net/bridge/br_switchdev.c +@@ -123,6 +123,8 @@ br_switchdev_fdb_notify(const struct net_bridge_fdb_entry *fdb, int type) + { + if (!fdb->dst) + return; ++ if (test_bit(BR_FDB_LOCAL, &fdb->flags)) ++ return; + + switch (type) { + case RTM_DELNEIGH: +diff --git a/net/can/isotp.c b/net/can/isotp.c +index 3ef7f78e553bc..15ea1234d4573 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -196,7 +196,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) + nskb->dev = dev; + can_skb_set_owner(nskb, sk); + ncf = (struct canfd_frame *)nskb->data; +- skb_put(nskb, so->ll.mtu); ++ skb_put_zero(nskb, so->ll.mtu); + + /* create & send flow control reply */ + ncf->can_id = so->txid; +@@ -215,8 +215,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) + if (ae) + ncf->data[0] = so->opt.ext_address; + +- if (so->ll.mtu == CANFD_MTU) +- ncf->flags = so->ll.tx_flags; ++ ncf->flags = so->ll.tx_flags; + + can_send_ret = can_send(nskb, 1); + if (can_send_ret) +@@ -780,7 +779,7 @@ isotp_tx_burst: + can_skb_prv(skb)->skbcnt = 0; + + cf = (struct canfd_frame *)skb->data; +- skb_put(skb, so->ll.mtu); ++ skb_put_zero(skb, so->ll.mtu); + + /* create consecutive frame */ + isotp_fill_dataframe(cf, so, ae, 0); +@@ -790,8 +789,7 @@ isotp_tx_burst: + so->tx.sn %= 16; + so->tx.bs++; + +- if (so->ll.mtu == CANFD_MTU) +- cf->flags = so->ll.tx_flags; ++ cf->flags = so->ll.tx_flags; + + skb->dev = dev; + can_skb_set_owner(skb, sk); +@@ -897,7 +895,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + so->tx.idx = 0; + + cf = (struct canfd_frame *)skb->data; +- skb_put(skb, so->ll.mtu); ++ skb_put_zero(skb, so->ll.mtu); + + /* check for single frame transmission depending on TX_DL */ + if (size <= so->tx.ll_dl - SF_PCI_SZ4 - ae - off) { +@@ -939,8 +937,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + } + + /* send the first or only CAN frame */ +- if (so->ll.mtu == CANFD_MTU) +- cf->flags = so->ll.tx_flags; ++ cf->flags = so->ll.tx_flags; + + skb->dev = dev; + skb->sk = sk; +@@ -1228,7 +1225,8 @@ static int isotp_setsockopt(struct socket *sock, int level, int optname, + if (ll.mtu != CAN_MTU && ll.mtu != CANFD_MTU) + return -EINVAL; + +- if (ll.mtu == CAN_MTU && ll.tx_dl > CAN_MAX_DLEN) ++ if (ll.mtu == CAN_MTU && ++ (ll.tx_dl > CAN_MAX_DLEN || ll.tx_flags != 0)) + return -EINVAL; + + memcpy(&so->ll, &ll, sizeof(ll)); +diff --git a/net/core/dev.c b/net/core/dev.c +index a5a1dbe66b762..9e3be2ae86532 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1182,6 +1182,18 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf) + return -ENOMEM; + + for_each_netdev(net, d) { ++ struct netdev_name_node *name_node; ++ list_for_each_entry(name_node, &d->name_node->list, list) { ++ if (!sscanf(name_node->name, name, &i)) ++ continue; ++ if (i < 0 || i >= max_netdevices) ++ continue; ++ ++ /* avoid cases where sscanf is not exact inverse of printf */ ++ snprintf(buf, IFNAMSIZ, name, i); ++ if (!strncmp(buf, name_node->name, IFNAMSIZ)) ++ set_bit(i, inuse); ++ } + if (!sscanf(d->name, name, &i)) + continue; + if (i < 0 || i >= max_netdevices) +@@ -11182,7 +11194,7 @@ static void __net_exit default_device_exit(struct net *net) + continue; + + /* Leave virtual devices for the generic cleanup */ +- if (dev->rtnl_link_ops) ++ if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund) + continue; + + /* Push remaining network devices to init_net */ +diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c +index 571f191c06d94..db65ce62b625a 100644 +--- a/net/core/drop_monitor.c ++++ b/net/core/drop_monitor.c +@@ -1053,6 +1053,20 @@ static int net_dm_hw_monitor_start(struct netlink_ext_ack *extack) + return 0; + + err_module_put: ++ for_each_possible_cpu(cpu) { ++ struct per_cpu_dm_data *hw_data = &per_cpu(dm_hw_cpu_data, cpu); ++ struct sk_buff *skb; ++ ++ del_timer_sync(&hw_data->send_timer); ++ cancel_work_sync(&hw_data->dm_alert_work); ++ while ((skb = __skb_dequeue(&hw_data->drop_queue))) { ++ struct devlink_trap_metadata *hw_metadata; ++ ++ hw_metadata = NET_DM_SKB_CB(skb)->hw_metadata; ++ net_dm_hw_metadata_free(hw_metadata); ++ consume_skb(skb); ++ } ++ } + module_put(THIS_MODULE); + return rc; + } +@@ -1134,6 +1148,15 @@ static int net_dm_trace_on_set(struct netlink_ext_ack *extack) + err_unregister_trace: + unregister_trace_kfree_skb(ops->kfree_skb_probe, NULL); + err_module_put: ++ for_each_possible_cpu(cpu) { ++ struct per_cpu_dm_data *data = &per_cpu(dm_cpu_data, cpu); ++ struct sk_buff *skb; ++ ++ del_timer_sync(&data->send_timer); ++ cancel_work_sync(&data->dm_alert_work); ++ while ((skb = __skb_dequeue(&data->drop_queue))) ++ consume_skb(skb); ++ } + module_put(THIS_MODULE); + return rc; + } +diff --git a/net/core/dst.c b/net/core/dst.c +index 0c01bd8d9d81e..fb3bcba87744d 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -237,37 +237,62 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old) + } + EXPORT_SYMBOL(__dst_destroy_metrics_generic); + +-static struct dst_ops md_dst_ops = { +- .family = AF_UNSPEC, +-}; ++struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie) ++{ ++ return NULL; ++} + +-static int dst_md_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb) ++u32 *dst_blackhole_cow_metrics(struct dst_entry *dst, unsigned long old) + { +- WARN_ONCE(1, "Attempting to call output on metadata dst\n"); +- kfree_skb(skb); +- return 0; ++ return NULL; + } + +-static int dst_md_discard(struct sk_buff *skb) ++struct neighbour *dst_blackhole_neigh_lookup(const struct dst_entry *dst, ++ struct sk_buff *skb, ++ const void *daddr) + { +- WARN_ONCE(1, "Attempting to call input on metadata dst\n"); +- kfree_skb(skb); +- return 0; ++ return NULL; ++} ++ ++void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) ++{ ++} ++EXPORT_SYMBOL_GPL(dst_blackhole_update_pmtu); ++ ++void dst_blackhole_redirect(struct dst_entry *dst, struct sock *sk, ++ struct sk_buff *skb) ++{ ++} ++EXPORT_SYMBOL_GPL(dst_blackhole_redirect); ++ ++unsigned int dst_blackhole_mtu(const struct dst_entry *dst) ++{ ++ unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); ++ ++ return mtu ? : dst->dev->mtu; + } ++EXPORT_SYMBOL_GPL(dst_blackhole_mtu); ++ ++static struct dst_ops dst_blackhole_ops = { ++ .family = AF_UNSPEC, ++ .neigh_lookup = dst_blackhole_neigh_lookup, ++ .check = dst_blackhole_check, ++ .cow_metrics = dst_blackhole_cow_metrics, ++ .update_pmtu = dst_blackhole_update_pmtu, ++ .redirect = dst_blackhole_redirect, ++ .mtu = dst_blackhole_mtu, ++}; + + static void __metadata_dst_init(struct metadata_dst *md_dst, + enum metadata_type type, u8 optslen) +- + { + struct dst_entry *dst; + + dst = &md_dst->dst; +- dst_init(dst, &md_dst_ops, NULL, 1, DST_OBSOLETE_NONE, ++ dst_init(dst, &dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, + DST_METADATA | DST_NOCOUNT); +- +- dst->input = dst_md_discard; +- dst->output = dst_md_discard_out; +- + memset(dst + 1, 0, sizeof(*md_dst) + optslen - sizeof(*dst)); + md_dst->type = type; + } +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index 6f1adba6695fc..7a06d43016175 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -175,7 +175,7 @@ void skb_flow_get_icmp_tci(const struct sk_buff *skb, + * avoid confusion with packets without such field + */ + if (icmp_has_id(ih->type)) +- key_icmp->id = ih->un.echo.id ? : 1; ++ key_icmp->id = ih->un.echo.id ? ntohs(ih->un.echo.id) : 1; + else + key_icmp->id = 0; + } +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index 1f73603913f5a..2be5c69824f94 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -319,6 +319,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb) + if (!ipv6_unicast_destination(skb)) + return 0; /* discard, don't send a reset here */ + ++ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { ++ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); ++ return 0; ++ } ++ + if (dccp_bad_service_code(sk, service)) { + dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE; + goto drop; +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 6bd7ca09af03d..fd472eae4f5ca 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -705,12 +705,15 @@ static bool reqsk_queue_unlink(struct request_sock *req) + return found; + } + +-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) ++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) + { +- if (reqsk_queue_unlink(req)) { ++ bool unlinked = reqsk_queue_unlink(req); ++ ++ if (unlinked) { + reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req); + reqsk_put(req); + } ++ return unlinked; + } + EXPORT_SYMBOL(inet_csk_reqsk_queue_drop); + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index c576a63d09db1..d1e04d2b5170e 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct arpt_entry **)private->jumpstack[cpu]; +@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + * (other than comefrom, which userspace doesn't care +@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct arpt_entry *e; + struct xt_counters *counters; +- struct xt_table_info *private = xt_table_get_private_protected(table); ++ struct xt_table_info *private = table->private; + int ret = 0; + void *loc_cpu_entry; + +@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user, const int *len) + t = xt_request_find_table_lock(net, NFPROTO_ARP, name); + if (!IS_ERR(t)) { + struct arpt_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, + + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + + if (get.size == private->size) + ret = copy_entries_to_user(private->size, +@@ -1017,7 +1017,7 @@ static int do_add_counters(struct net *net, sockptr_t arg, unsigned int len) + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1330,7 +1330,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +@@ -1379,7 +1379,7 @@ static int compat_get_entries(struct net *net, + xt_compat_lock(NFPROTO_ARP); + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + + ret = compat_table_info(private, &info); +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index e8f6f9d862376..f15bc21d73016 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb, + WARN_ON(!(table->valid_hooks & (1 << hook))); + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ipt_entry **)private->jumpstack[cpu]; +@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ipt_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + int ret = 0; + const void *loc_cpu_entry; + +@@ -964,7 +964,7 @@ static int get_info(struct net *net, void __user *user, const int *len) + t = xt_request_find_table_lock(net, AF_INET, name); + if (!IS_ERR(t)) { + struct ipt_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1018,7 +1018,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1173,7 +1173,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1543,7 +1543,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +@@ -1589,7 +1589,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr, + xt_compat_lock(AF_INET); + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index e26652ff7059d..983b4db1868fd 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -2682,44 +2682,15 @@ out: + return rth; + } + +-static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie) +-{ +- return NULL; +-} +- +-static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst) +-{ +- unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); +- +- return mtu ? : dst->dev->mtu; +-} +- +-static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu, +- bool confirm_neigh) +-{ +-} +- +-static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb) +-{ +-} +- +-static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst, +- unsigned long old) +-{ +- return NULL; +-} +- + static struct dst_ops ipv4_dst_blackhole_ops = { +- .family = AF_INET, +- .check = ipv4_blackhole_dst_check, +- .mtu = ipv4_blackhole_mtu, +- .default_advmss = ipv4_default_advmss, +- .update_pmtu = ipv4_rt_blackhole_update_pmtu, +- .redirect = ipv4_rt_blackhole_redirect, +- .cow_metrics = ipv4_rt_blackhole_cow_metrics, +- .neigh_lookup = ipv4_neigh_lookup, ++ .family = AF_INET, ++ .default_advmss = ipv4_default_advmss, ++ .neigh_lookup = ipv4_neigh_lookup, ++ .check = dst_blackhole_check, ++ .cow_metrics = dst_blackhole_cow_metrics, ++ .update_pmtu = dst_blackhole_update_pmtu, ++ .redirect = dst_blackhole_redirect, ++ .mtu = dst_blackhole_mtu, + }; + + struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig) +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 0055ae0a3bf84..7513ba45553db 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -804,8 +804,11 @@ embryonic_reset: + tcp_reset(sk, skb); + } + if (!fastopen) { +- inet_csk_reqsk_queue_drop(sk, req); +- __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); ++ bool unlinked = inet_csk_reqsk_queue_drop(sk, req); ++ ++ if (unlinked) ++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); ++ *req_stolen = !unlinked; + } + return NULL; + } +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index f43e275557251..1fb79dbde0cb3 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -2485,7 +2485,7 @@ static int ipv6_route_native_seq_show(struct seq_file *seq, void *v) + const struct net_device *dev; + + if (rt->nh) +- fib6_nh = nexthop_fib6_nh(rt->nh); ++ fib6_nh = nexthop_fib6_nh_bh(rt->nh); + + seq_printf(seq, "%pi6 %02x ", &rt->fib6_dst.addr, rt->fib6_dst.plen); + +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index e96304d8a4a7f..06d60662717d1 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -245,16 +245,6 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev, + if (ipv6_addr_is_multicast(&hdr->saddr)) + goto err; + +- /* While RFC4291 is not explicit about v4mapped addresses +- * in IPv6 headers, it seems clear linux dual-stack +- * model can not deal properly with these. +- * Security models could be fooled by ::ffff:127.0.0.1 for example. +- * +- * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02 +- */ +- if (ipv6_addr_v4mapped(&hdr->saddr)) +- goto err; +- + skb->transport_header = skb->network_header + sizeof(*hdr); + IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr); + +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 0d453fa9e327b..2e2119bfcf137 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ip6t_entry **)private->jumpstack[cpu]; +@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ip6t_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + int ret = 0; + const void *loc_cpu_entry; + +@@ -980,7 +980,7 @@ static int get_info(struct net *net, void __user *user, const int *len) + t = xt_request_find_table_lock(net, AF_INET6, name); + if (!IS_ERR(t)) { + struct ip6t_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1035,7 +1035,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- struct xt_table_info *private = xt_table_get_private_protected(t); ++ struct xt_table_info *private = t->private; + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1189,7 +1189,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1552,7 +1552,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +@@ -1598,7 +1598,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr, + xt_compat_lock(AF_INET6); + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 188e114b29b4a..0bbfaa55e3c89 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -258,34 +258,16 @@ static struct dst_ops ip6_dst_ops_template = { + .confirm_neigh = ip6_confirm_neigh, + }; + +-static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst) +-{ +- unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); +- +- return mtu ? : dst->dev->mtu; +-} +- +-static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu, +- bool confirm_neigh) +-{ +-} +- +-static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb) +-{ +-} +- + static struct dst_ops ip6_dst_blackhole_ops = { +- .family = AF_INET6, +- .destroy = ip6_dst_destroy, +- .check = ip6_dst_check, +- .mtu = ip6_blackhole_mtu, +- .default_advmss = ip6_default_advmss, +- .update_pmtu = ip6_rt_blackhole_update_pmtu, +- .redirect = ip6_rt_blackhole_redirect, +- .cow_metrics = dst_cow_metrics_generic, +- .neigh_lookup = ip6_dst_neigh_lookup, ++ .family = AF_INET6, ++ .default_advmss = ip6_default_advmss, ++ .neigh_lookup = ip6_dst_neigh_lookup, ++ .check = ip6_dst_check, ++ .destroy = ip6_dst_destroy, ++ .cow_metrics = dst_cow_metrics_generic, ++ .update_pmtu = dst_blackhole_update_pmtu, ++ .redirect = dst_blackhole_redirect, ++ .mtu = dst_blackhole_mtu, + }; + + static const u32 ip6_template_metrics[RTAX_MAX] = { +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 0e1509b02cb30..c07e5e8d557bb 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1175,6 +1175,11 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb) + if (!ipv6_unicast_destination(skb)) + goto drop; + ++ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { ++ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); ++ return 0; ++ } ++ + return tcp_conn_request(&tcp6_request_sock_ops, + &tcp_request_sock_ipv6_ops, sk, skb); + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index c4c70e30ad7f0..68a0de02b5618 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2950,14 +2950,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy, + continue; + + for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) { +- if (~sdata->rc_rateidx_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) { + sdata->rc_has_mcs_mask[i] = true; + break; + } + } + + for (j = 0; j < NL80211_VHT_NSS_MAX; j++) { +- if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) { + sdata->rc_has_vht_mcs_mask[i] = true; + break; + } +diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c +index 1f552f374e97d..a7ac53a2f00d8 100644 +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -1874,6 +1874,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata) + + /* remove beacon */ + kfree(sdata->u.ibss.ie); ++ sdata->u.ibss.ie = NULL; ++ sdata->u.ibss.ie_len = 0; + + /* on the next join, re-program HT parameters */ + memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa)); +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 0e4d950cf907b..9db648a91a4f6 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -5071,7 +5071,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata, + he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, + ies->data, ies->len); + if (he_oper_ie && +- he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3])) ++ he_oper_ie[1] >= ieee80211_he_oper_size(&he_oper_ie[3])) + he_oper = (void *)(he_oper_ie + 3); + else + he_oper = NULL; +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 8d3ae6b2f95ff..f4507a7089653 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -968,7 +968,7 @@ static void ieee80211_parse_extension_element(u32 *crc, + break; + case WLAN_EID_EXT_HE_OPERATION: + if (len >= sizeof(*elems->he_operation) && +- len == ieee80211_he_oper_size(data) - 1) { ++ len >= ieee80211_he_oper_size(data) - 1) { + if (crc) + *crc = crc32_be(*crc, (void *)elem, + elem->datalen + 2); +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index 2e26e39169b82..37ef0bf098f6d 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -555,15 +555,15 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb, + } + + static u64 add_addr_generate_hmac(u64 key1, u64 key2, u8 addr_id, +- struct in_addr *addr) ++ struct in_addr *addr, u16 port) + { + u8 hmac[SHA256_DIGEST_SIZE]; + u8 msg[7]; + + msg[0] = addr_id; + memcpy(&msg[1], &addr->s_addr, 4); +- msg[5] = 0; +- msg[6] = 0; ++ msg[5] = port >> 8; ++ msg[6] = port & 0xFF; + + mptcp_crypto_hmac_sha(key1, key2, msg, 7, hmac); + +@@ -572,15 +572,15 @@ static u64 add_addr_generate_hmac(u64 key1, u64 key2, u8 addr_id, + + #if IS_ENABLED(CONFIG_MPTCP_IPV6) + static u64 add_addr6_generate_hmac(u64 key1, u64 key2, u8 addr_id, +- struct in6_addr *addr) ++ struct in6_addr *addr, u16 port) + { + u8 hmac[SHA256_DIGEST_SIZE]; + u8 msg[19]; + + msg[0] = addr_id; + memcpy(&msg[1], &addr->s6_addr, 16); +- msg[17] = 0; +- msg[18] = 0; ++ msg[17] = port >> 8; ++ msg[18] = port & 0xFF; + + mptcp_crypto_hmac_sha(key1, key2, msg, 19, hmac); + +@@ -634,7 +634,8 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * + opts->ahmac = add_addr_generate_hmac(msk->local_key, + msk->remote_key, + opts->addr_id, +- &opts->addr); ++ &opts->addr, ++ opts->port); + } + } + #if IS_ENABLED(CONFIG_MPTCP_IPV6) +@@ -645,7 +646,8 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * + opts->ahmac = add_addr6_generate_hmac(msk->local_key, + msk->remote_key, + opts->addr_id, +- &opts->addr6); ++ &opts->addr6, ++ opts->port); + } + } + #endif +@@ -922,12 +924,14 @@ static bool add_addr_hmac_valid(struct mptcp_sock *msk, + if (mp_opt->family == MPTCP_ADDR_IPVERSION_4) + hmac = add_addr_generate_hmac(msk->remote_key, + msk->local_key, +- mp_opt->addr_id, &mp_opt->addr); ++ mp_opt->addr_id, &mp_opt->addr, ++ mp_opt->port); + #if IS_ENABLED(CONFIG_MPTCP_IPV6) + else + hmac = add_addr6_generate_hmac(msk->remote_key, + msk->local_key, +- mp_opt->addr_id, &mp_opt->addr6); ++ mp_opt->addr_id, &mp_opt->addr6, ++ mp_opt->port); + #endif + + pr_debug("msk=%p, ahmac=%llu, mp_opt->ahmac=%llu\n", +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index c3090003a17bd..96e040951cd40 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -440,6 +440,11 @@ static int subflow_v6_conn_request(struct sock *sk, struct sk_buff *skb) + if (!ipv6_unicast_destination(skb)) + goto drop; + ++ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { ++ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); ++ return 0; ++ } ++ + return tcp_conn_request(&mptcp_subflow_request_sock_ops, + &subflow_request_sock_ipv6_ops, sk, skb); + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 84caf3316946d..e0c566b3df902 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -2969,6 +2969,7 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb, + memset(&m, 0xFF, sizeof(m)); + memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3)); + m.src.u.all = mask->src.u.all; ++ m.src.l3num = tuple->src.l3num; + m.dst.protonum = tuple->dst.protonum; + + nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK); +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 4a4acbba78ff7..b03feb6e1226a 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -506,7 +506,7 @@ int nf_flow_table_init(struct nf_flowtable *flowtable) + { + int err; + +- INIT_DEFERRABLE_WORK(&flowtable->gc_work, nf_flow_offload_work_gc); ++ INIT_DELAYED_WORK(&flowtable->gc_work, nf_flow_offload_work_gc); + flow_block_init(&flowtable->flow_block); + init_rwsem(&flowtable->flow_block_lock); + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 8ee9f40cc0ea2..24a7a6b17268c 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6808,6 +6808,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, + struct nft_hook *hook, *next; + struct nft_trans *trans; + bool unregister = false; ++ u32 flags; + int err; + + err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK], +@@ -6822,6 +6823,17 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, + } + } + ++ if (nla[NFTA_FLOWTABLE_FLAGS]) { ++ flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); ++ if (flags & ~NFT_FLOWTABLE_MASK) ++ return -EOPNOTSUPP; ++ if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^ ++ (flags & NFT_FLOWTABLE_HW_OFFLOAD)) ++ return -EOPNOTSUPP; ++ } else { ++ flags = flowtable->data.flags; ++ } ++ + err = nft_register_flowtable_net_hooks(ctx->net, ctx->table, + &flowtable_hook.list, flowtable); + if (err < 0) +@@ -6835,6 +6847,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, + goto err_flowtable_update_hook; + } + ++ nft_trans_flowtable_flags(trans) = flags; + nft_trans_flowtable(trans) = flowtable; + nft_trans_flowtable_update(trans) = true; + INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); +@@ -6929,8 +6942,10 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk, + if (nla[NFTA_FLOWTABLE_FLAGS]) { + flowtable->data.flags = + ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); +- if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) ++ if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) { ++ err = -EOPNOTSUPP; + goto err3; ++ } + } + + write_pnet(&flowtable->data.net, net); +@@ -8142,6 +8157,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + break; + case NFT_MSG_NEWFLOWTABLE: + if (nft_trans_flowtable_update(trans)) { ++ nft_trans_flowtable(trans)->data.flags = ++ nft_trans_flowtable_flags(trans); + nf_tables_flowtable_notify(&trans->ctx, + nft_trans_flowtable(trans), + &nft_trans_flowtable_hooks(trans), +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index bce6ca203d462..6bd31a7a27fc5 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1351,14 +1351,6 @@ struct xt_counters *xt_counters_alloc(unsigned int counters) + } + EXPORT_SYMBOL(xt_counters_alloc); + +-struct xt_table_info +-*xt_table_get_private_protected(const struct xt_table *table) +-{ +- return rcu_dereference_protected(table->private, +- mutex_is_locked(&xt[table->af].mutex)); +-} +-EXPORT_SYMBOL(xt_table_get_private_protected); +- + struct xt_table_info * + xt_replace_table(struct xt_table *table, + unsigned int num_counters, +@@ -1366,6 +1358,7 @@ xt_replace_table(struct xt_table *table, + int *error) + { + struct xt_table_info *private; ++ unsigned int cpu; + int ret; + + ret = xt_jumpstack_alloc(newinfo); +@@ -1375,20 +1368,47 @@ xt_replace_table(struct xt_table *table, + } + + /* Do the substitution. */ +- private = xt_table_get_private_protected(table); ++ local_bh_disable(); ++ private = table->private; + + /* Check inside lock: is the old number correct? */ + if (num_counters != private->number) { + pr_debug("num_counters != table->private->number (%u/%u)\n", + num_counters, private->number); ++ local_bh_enable(); + *error = -EAGAIN; + return NULL; + } + + newinfo->initial_entries = private->initial_entries; ++ /* ++ * Ensure contents of newinfo are visible before assigning to ++ * private. ++ */ ++ smp_wmb(); ++ table->private = newinfo; ++ ++ /* make sure all cpus see new ->private value */ ++ smp_mb(); + +- rcu_assign_pointer(table->private, newinfo); +- synchronize_rcu(); ++ /* ++ * Even though table entries have now been swapped, other CPU's ++ * may still be using the old entries... ++ */ ++ local_bh_enable(); ++ ++ /* ... so wait for even xt_recseq on all cpus */ ++ for_each_possible_cpu(cpu) { ++ seqcount_t *s = &per_cpu(xt_recseq, cpu); ++ u32 seq = raw_read_seqcount(s); ++ ++ if (seq & 1) { ++ do { ++ cond_resched(); ++ cpu_relax(); ++ } while (seq == raw_read_seqcount(s)); ++ } ++ } + + audit_log_nfcfg(table->name, table->af, private->number, + !private->number ? AUDIT_XT_OP_REGISTER : +@@ -1424,12 +1444,12 @@ struct xt_table *xt_register_table(struct net *net, + } + + /* Simplifies replace_table code. */ +- rcu_assign_pointer(table->private, bootstrap); ++ table->private = bootstrap; + + if (!xt_replace_table(table, 0, newinfo, &ret)) + goto unlock; + +- private = xt_table_get_private_protected(table); ++ private = table->private; + pr_debug("table->private->number = %u\n", private->number); + + /* save number of initial entries */ +@@ -1452,8 +1472,7 @@ void *xt_unregister_table(struct xt_table *table) + struct xt_table_info *private; + + mutex_lock(&xt[table->af].mutex); +- private = xt_table_get_private_protected(table); +- RCU_INIT_POINTER(table->private, NULL); ++ private = table->private; + list_del(&table->list); + mutex_unlock(&xt[table->af].mutex); + audit_log_nfcfg(table->name, table->af, private->number, +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c +index edb6ac17cecab..dfc820ee553a0 100644 +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -1058,6 +1058,11 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg, + rc = copied; + + if (addr) { ++ /* There is an anonymous 2-byte hole after sq_family, ++ * make sure to clear it. ++ */ ++ memset(addr, 0, sizeof(*addr)); ++ + addr->sq_family = AF_QIPCRTR; + addr->sq_node = cb->src_node; + addr->sq_port = cb->src_port; +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 46c1b3e9f66a5..14316ba9b3b32 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -1432,7 +1432,7 @@ static int fl_set_key_ct(struct nlattr **tb, + &mask->ct_state, TCA_FLOWER_KEY_CT_STATE_MASK, + sizeof(key->ct_state)); + +- err = fl_validate_ct_state(mask->ct_state, ++ err = fl_validate_ct_state(key->ct_state & mask->ct_state, + tb[TCA_FLOWER_KEY_CT_STATE_MASK], + extack); + if (err) +diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c +index 50f680f03a547..2adbd945bf15a 100644 +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -345,6 +345,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + struct sk_buff **old = NULL; + unsigned int mask; + u32 max_P; ++ u8 *stab; + + if (opt == NULL) + return -EINVAL; +@@ -361,8 +362,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + max_P = tb[TCA_CHOKE_MAX_P] ? nla_get_u32(tb[TCA_CHOKE_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_CHOKE_PARMS]); +- +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) ++ stab = nla_data(tb[TCA_CHOKE_STAB]); ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) + return -EINVAL; + + if (ctl->limit > CHOKE_MAX_QUEUE) +@@ -412,7 +413,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + + red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, + ctl->Plog, ctl->Scell_log, +- nla_data(tb[TCA_CHOKE_STAB]), ++ stab, + max_P); + red_set_vars(&q->vars); + +diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c +index e0bc77533acc3..f4132dc25ac05 100644 +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -480,7 +480,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp, + struct gred_sched *table = qdisc_priv(sch); + struct gred_sched_data *q = table->tab[dp]; + +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) { ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) { + NL_SET_ERR_MSG_MOD(extack, "invalid RED parameters"); + return -EINVAL; + } +diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c +index b4ae34d7aa965..40adf1f07a82d 100644 +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -242,6 +242,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, + unsigned char flags; + int err; + u32 max_P; ++ u8 *stab; + + if (tb[TCA_RED_PARMS] == NULL || + tb[TCA_RED_STAB] == NULL) +@@ -250,7 +251,9 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, + max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_RED_PARMS]); +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) ++ stab = nla_data(tb[TCA_RED_STAB]); ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ++ ctl->Scell_log, stab)) + return -EINVAL; + + err = red_get_flags(ctl->flags, TC_RED_HISTORIC_FLAGS, +@@ -288,7 +291,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, + red_set_parms(&q->parms, + ctl->qth_min, ctl->qth_max, ctl->Wlog, + ctl->Plog, ctl->Scell_log, +- nla_data(tb[TCA_RED_STAB]), ++ stab, + max_P); + red_set_vars(&q->vars); + +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index b25e51440623b..066754a18569b 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -647,7 +647,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) + } + + if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, +- ctl_v1->Wlog, ctl_v1->Scell_log)) ++ ctl_v1->Wlog, ctl_v1->Scell_log, NULL)) + return -EINVAL; + if (ctl_v1 && ctl_v1->qth_min) { + p = kmalloc(sizeof(*p), GFP_KERNEL); +diff --git a/net/sctp/output.c b/net/sctp/output.c +index 6614c9fdc51e5..a6aa17df09efb 100644 +--- a/net/sctp/output.c ++++ b/net/sctp/output.c +@@ -584,13 +584,6 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp) + goto out; + } + +- rcu_read_lock(); +- if (__sk_dst_get(sk) != tp->dst) { +- dst_hold(tp->dst); +- sk_setup_caps(sk, tp->dst); +- } +- rcu_read_unlock(); +- + /* pack up chunks */ + pkt_count = sctp_packet_pack(packet, head, gso, gfp); + if (!pkt_count) { +diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c +index 3fd06a27105dd..5cb1aa5f067bc 100644 +--- a/net/sctp/outqueue.c ++++ b/net/sctp/outqueue.c +@@ -1135,6 +1135,7 @@ static void sctp_outq_flush_data(struct sctp_flush_ctx *ctx, + + static void sctp_outq_flush_transports(struct sctp_flush_ctx *ctx) + { ++ struct sock *sk = ctx->asoc->base.sk; + struct list_head *ltransport; + struct sctp_packet *packet; + struct sctp_transport *t; +@@ -1144,6 +1145,12 @@ static void sctp_outq_flush_transports(struct sctp_flush_ctx *ctx) + t = list_entry(ltransport, struct sctp_transport, send_ready); + packet = &t->packet; + if (!sctp_packet_empty(packet)) { ++ rcu_read_lock(); ++ if (t->dst && __sk_dst_get(sk) != t->dst) { ++ dst_hold(t->dst); ++ sk_setup_caps(sk, t->dst); ++ } ++ rcu_read_unlock(); + error = sctp_packet_transmit(packet, ctx->gfp); + if (error < 0) + ctx->q->asoc->base.sk->sk_err = -error; +diff --git a/net/tipc/node.c b/net/tipc/node.c +index 008670d1f43e1..136338b85504b 100644 +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -2895,17 +2895,22 @@ int tipc_nl_node_dump_monitor_peer(struct sk_buff *skb, + + #ifdef CONFIG_TIPC_CRYPTO + static int tipc_nl_retrieve_key(struct nlattr **attrs, +- struct tipc_aead_key **key) ++ struct tipc_aead_key **pkey) + { + struct nlattr *attr = attrs[TIPC_NLA_NODE_KEY]; ++ struct tipc_aead_key *key; + + if (!attr) + return -ENODATA; + +- *key = (struct tipc_aead_key *)nla_data(attr); +- if (nla_len(attr) < tipc_aead_key_size(*key)) ++ if (nla_len(attr) < sizeof(*key)) ++ return -EINVAL; ++ key = (struct tipc_aead_key *)nla_data(attr); ++ if (key->keylen > TIPC_AEAD_KEYLEN_MAX || ++ nla_len(attr) < tipc_aead_key_size(key)) + return -EINVAL; + ++ *pkey = key; + return 0; + } + +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 5546710d8ac1a..bc7fb9bf3351e 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -755,6 +755,7 @@ static struct sock *__vsock_create(struct net *net, + vsk->buffer_size = psk->buffer_size; + vsk->buffer_min_size = psk->buffer_min_size; + vsk->buffer_max_size = psk->buffer_max_size; ++ security_sk_clone(parent, sk); + } else { + vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN); + vsk->owner = get_current_cred(); +diff --git a/scripts/dummy-tools/gcc b/scripts/dummy-tools/gcc +index 5c113cad56017..0d0589cf8184e 100755 +--- a/scripts/dummy-tools/gcc ++++ b/scripts/dummy-tools/gcc +@@ -85,3 +85,8 @@ if arg_contain -print-file-name=plugin "$@"; then + echo $plugin_dir + exit 0 + fi ++ ++# inverted return value ++if arg_contain -D__SIZEOF_INT128__=0 "$@"; then ++ exit 1 ++fi +diff --git a/security/integrity/iint.c b/security/integrity/iint.c +index 1d20003243c3f..0ba01847e836c 100644 +--- a/security/integrity/iint.c ++++ b/security/integrity/iint.c +@@ -98,6 +98,14 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode) + struct rb_node *node, *parent = NULL; + struct integrity_iint_cache *iint, *test_iint; + ++ /* ++ * The integrity's "iint_cache" is initialized at security_init(), ++ * unless it is not included in the ordered list of LSMs enabled ++ * on the boot command line. ++ */ ++ if (!iint_cache) ++ panic("%s: lsm=integrity required.\n", __func__); ++ + iint = integrity_iint_find(inode); + if (iint) + return iint; +diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h +index 3cc8bab31ea85..63ca6e79daeb9 100644 +--- a/security/selinux/include/security.h ++++ b/security/selinux/include/security.h +@@ -219,14 +219,21 @@ static inline bool selinux_policycap_genfs_seclabel_symlinks(void) + return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS]); + } + ++struct selinux_policy_convert_data; ++ ++struct selinux_load_state { ++ struct selinux_policy *policy; ++ struct selinux_policy_convert_data *convert_data; ++}; ++ + int security_mls_enabled(struct selinux_state *state); + int security_load_policy(struct selinux_state *state, +- void *data, size_t len, +- struct selinux_policy **newpolicyp); ++ void *data, size_t len, ++ struct selinux_load_state *load_state); + void selinux_policy_commit(struct selinux_state *state, +- struct selinux_policy *newpolicy); ++ struct selinux_load_state *load_state); + void selinux_policy_cancel(struct selinux_state *state, +- struct selinux_policy *policy); ++ struct selinux_load_state *load_state); + int security_read_policy(struct selinux_state *state, + void **data, size_t *len); + +diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c +index 4bde570d56a2c..2b745ae8cb981 100644 +--- a/security/selinux/selinuxfs.c ++++ b/security/selinux/selinuxfs.c +@@ -616,7 +616,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, + + { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; +- struct selinux_policy *newpolicy; ++ struct selinux_load_state load_state; + ssize_t length; + void *data = NULL; + +@@ -642,23 +642,22 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, + if (copy_from_user(data, buf, count) != 0) + goto out; + +- length = security_load_policy(fsi->state, data, count, &newpolicy); ++ length = security_load_policy(fsi->state, data, count, &load_state); + if (length) { + pr_warn_ratelimited("SELinux: failed to load policy\n"); + goto out; + } + +- length = sel_make_policy_nodes(fsi, newpolicy); ++ length = sel_make_policy_nodes(fsi, load_state.policy); + if (length) { +- selinux_policy_cancel(fsi->state, newpolicy); +- goto out1; ++ selinux_policy_cancel(fsi->state, &load_state); ++ goto out; + } + +- selinux_policy_commit(fsi->state, newpolicy); ++ selinux_policy_commit(fsi->state, &load_state); + + length = count; + +-out1: + audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD, + "auid=%u ses=%u lsm=selinux res=1", + from_kuid(&init_user_ns, audit_get_loginuid(current)), +diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c +index 597b79703584e..8d9bbd39ab9a8 100644 +--- a/security/selinux/ss/services.c ++++ b/security/selinux/ss/services.c +@@ -66,6 +66,17 @@ + #include "audit.h" + #include "policycap_names.h" + ++struct convert_context_args { ++ struct selinux_state *state; ++ struct policydb *oldp; ++ struct policydb *newp; ++}; ++ ++struct selinux_policy_convert_data { ++ struct convert_context_args args; ++ struct sidtab_convert_params sidtab_params; ++}; ++ + /* Forward declaration. */ + static int context_struct_to_string(struct policydb *policydb, + struct context *context, +@@ -1973,12 +1984,6 @@ static inline int convert_context_handle_invalid_context( + return 0; + } + +-struct convert_context_args { +- struct selinux_state *state; +- struct policydb *oldp; +- struct policydb *newp; +-}; +- + /* + * Convert the values in the security context + * structure `oldc' from the values specified +@@ -2158,7 +2163,7 @@ static void selinux_policy_cond_free(struct selinux_policy *policy) + } + + void selinux_policy_cancel(struct selinux_state *state, +- struct selinux_policy *policy) ++ struct selinux_load_state *load_state) + { + struct selinux_policy *oldpolicy; + +@@ -2166,7 +2171,8 @@ void selinux_policy_cancel(struct selinux_state *state, + lockdep_is_held(&state->policy_mutex)); + + sidtab_cancel_convert(oldpolicy->sidtab); +- selinux_policy_free(policy); ++ selinux_policy_free(load_state->policy); ++ kfree(load_state->convert_data); + } + + static void selinux_notify_policy_change(struct selinux_state *state, +@@ -2181,9 +2187,9 @@ static void selinux_notify_policy_change(struct selinux_state *state, + } + + void selinux_policy_commit(struct selinux_state *state, +- struct selinux_policy *newpolicy) ++ struct selinux_load_state *load_state) + { +- struct selinux_policy *oldpolicy; ++ struct selinux_policy *oldpolicy, *newpolicy = load_state->policy; + u32 seqno; + + oldpolicy = rcu_dereference_protected(state->policy, +@@ -2223,6 +2229,7 @@ void selinux_policy_commit(struct selinux_state *state, + /* Free the old policy */ + synchronize_rcu(); + selinux_policy_free(oldpolicy); ++ kfree(load_state->convert_data); + + /* Notify others of the policy change */ + selinux_notify_policy_change(state, seqno); +@@ -2239,11 +2246,10 @@ void selinux_policy_commit(struct selinux_state *state, + * loading the new policy. + */ + int security_load_policy(struct selinux_state *state, void *data, size_t len, +- struct selinux_policy **newpolicyp) ++ struct selinux_load_state *load_state) + { + struct selinux_policy *newpolicy, *oldpolicy; +- struct sidtab_convert_params convert_params; +- struct convert_context_args args; ++ struct selinux_policy_convert_data *convert_data; + int rc = 0; + struct policy_file file = { data, len }, *fp = &file; + +@@ -2273,10 +2279,10 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len, + goto err_mapping; + } + +- + if (!selinux_initialized(state)) { + /* First policy load, so no need to preserve state from old policy */ +- *newpolicyp = newpolicy; ++ load_state->policy = newpolicy; ++ load_state->convert_data = NULL; + return 0; + } + +@@ -2290,29 +2296,38 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len, + goto err_free_isids; + } + ++ convert_data = kmalloc(sizeof(*convert_data), GFP_KERNEL); ++ if (!convert_data) { ++ rc = -ENOMEM; ++ goto err_free_isids; ++ } ++ + /* + * Convert the internal representations of contexts + * in the new SID table. + */ +- args.state = state; +- args.oldp = &oldpolicy->policydb; +- args.newp = &newpolicy->policydb; ++ convert_data->args.state = state; ++ convert_data->args.oldp = &oldpolicy->policydb; ++ convert_data->args.newp = &newpolicy->policydb; + +- convert_params.func = convert_context; +- convert_params.args = &args; +- convert_params.target = newpolicy->sidtab; ++ convert_data->sidtab_params.func = convert_context; ++ convert_data->sidtab_params.args = &convert_data->args; ++ convert_data->sidtab_params.target = newpolicy->sidtab; + +- rc = sidtab_convert(oldpolicy->sidtab, &convert_params); ++ rc = sidtab_convert(oldpolicy->sidtab, &convert_data->sidtab_params); + if (rc) { + pr_err("SELinux: unable to convert the internal" + " representation of contexts in the new SID" + " table\n"); +- goto err_free_isids; ++ goto err_free_convert_data; + } + +- *newpolicyp = newpolicy; ++ load_state->policy = newpolicy; ++ load_state->convert_data = convert_data; + return 0; + ++err_free_convert_data: ++ kfree(convert_data); + err_free_isids: + sidtab_destroy(newpolicy->sidtab); + err_mapping: +diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c +index d053beccfaec3..e2237239d922a 100644 +--- a/sound/hda/intel-nhlt.c ++++ b/sound/hda/intel-nhlt.c +@@ -39,6 +39,11 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) + if (!nhlt) + return 0; + ++ if (nhlt->header.length <= sizeof(struct acpi_table_header)) { ++ dev_warn(dev, "Invalid DMIC description table\n"); ++ return 0; ++ } ++ + for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++, + epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) { + +diff --git a/tools/include/linux/static_call_types.h b/tools/include/linux/static_call_types.h +index 89135bb35bf76..ae5662d368b98 100644 +--- a/tools/include/linux/static_call_types.h ++++ b/tools/include/linux/static_call_types.h +@@ -4,11 +4,13 @@ + + #include + #include ++#include + + #define STATIC_CALL_KEY_PREFIX __SCK__ + #define STATIC_CALL_KEY_PREFIX_STR __stringify(STATIC_CALL_KEY_PREFIX) + #define STATIC_CALL_KEY_PREFIX_LEN (sizeof(STATIC_CALL_KEY_PREFIX_STR) - 1) + #define STATIC_CALL_KEY(name) __PASTE(STATIC_CALL_KEY_PREFIX, name) ++#define STATIC_CALL_KEY_STR(name) __stringify(STATIC_CALL_KEY(name)) + + #define STATIC_CALL_TRAMP_PREFIX __SCT__ + #define STATIC_CALL_TRAMP_PREFIX_STR __stringify(STATIC_CALL_TRAMP_PREFIX) +@@ -32,4 +34,52 @@ struct static_call_site { + s32 key; + }; + ++#define DECLARE_STATIC_CALL(name, func) \ ++ extern struct static_call_key STATIC_CALL_KEY(name); \ ++ extern typeof(func) STATIC_CALL_TRAMP(name); ++ ++#ifdef CONFIG_HAVE_STATIC_CALL ++ ++#define __raw_static_call(name) (&STATIC_CALL_TRAMP(name)) ++ ++#ifdef CONFIG_HAVE_STATIC_CALL_INLINE ++ ++/* ++ * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from ++ * the symbol table so that objtool can reference it when it generates the ++ * .static_call_sites section. ++ */ ++#define __STATIC_CALL_ADDRESSABLE(name) \ ++ __ADDRESSABLE(STATIC_CALL_KEY(name)) ++ ++#define __static_call(name) \ ++({ \ ++ __STATIC_CALL_ADDRESSABLE(name); \ ++ __raw_static_call(name); \ ++}) ++ ++#else /* !CONFIG_HAVE_STATIC_CALL_INLINE */ ++ ++#define __STATIC_CALL_ADDRESSABLE(name) ++#define __static_call(name) __raw_static_call(name) ++ ++#endif /* CONFIG_HAVE_STATIC_CALL_INLINE */ ++ ++#ifdef MODULE ++#define __STATIC_CALL_MOD_ADDRESSABLE(name) ++#define static_call_mod(name) __raw_static_call(name) ++#else ++#define __STATIC_CALL_MOD_ADDRESSABLE(name) __STATIC_CALL_ADDRESSABLE(name) ++#define static_call_mod(name) __static_call(name) ++#endif ++ ++#define static_call(name) __static_call(name) ++ ++#else ++ ++#define static_call(name) \ ++ ((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func)) ++ ++#endif /* CONFIG_HAVE_STATIC_CALL */ ++ + #endif /* _STATIC_CALL_TYPES_H */ +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index 55bd78b3496fb..310f647c2d5b6 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -236,7 +236,7 @@ define do_install + if [ ! -d '$(DESTDIR_SQ)$2' ]; then \ + $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \ + fi; \ +- $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2' ++ $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2' + endef + + install_lib: all_cmd +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index 2f9d685bd522c..0911aea4cdbe5 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -462,7 +462,7 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr) + return err; + + case BTF_KIND_ARRAY: +- return btf_dump_order_type(d, btf_array(t)->type, through_ptr); ++ return btf_dump_order_type(d, btf_array(t)->type, false); + + case BTF_KIND_STRUCT: + case BTF_KIND_UNION: { +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index a0d4fc4de4027..8913e5e7bedb0 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1180,7 +1180,8 @@ static int bpf_object__elf_init(struct bpf_object *obj) + if (!elf_rawdata(elf_getscn(obj->efile.elf, obj->efile.shstrndx), NULL)) { + pr_warn("elf: failed to get section names strings from %s: %s\n", + obj->path, elf_errmsg(-1)); +- return -LIBBPF_ERRNO__FORMAT; ++ err = -LIBBPF_ERRNO__FORMAT; ++ goto errout; + } + + /* Old LLVM set e_machine to EM_NONE */ +diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c +index 4dd73de00b6f1..d2cb28e9ef52e 100644 +--- a/tools/lib/bpf/netlink.c ++++ b/tools/lib/bpf/netlink.c +@@ -40,7 +40,7 @@ static int libbpf_netlink_open(__u32 *nl_pid) + memset(&sa, 0, sizeof(sa)); + sa.nl_family = AF_NETLINK; + +- sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); ++ sock = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE); + if (sock < 0) + return -errno; + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index dc24aac08edd6..5c83f73ad6687 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -502,8 +502,21 @@ static int create_static_call_sections(struct objtool_file *file) + + key_sym = find_symbol_by_name(file->elf, tmp); + if (!key_sym) { +- WARN("static_call: can't find static_call_key symbol: %s", tmp); +- return -1; ++ if (!module) { ++ WARN("static_call: can't find static_call_key symbol: %s", tmp); ++ return -1; ++ } ++ ++ /* ++ * For modules(), the key might not be exported, which ++ * means the module can make static calls but isn't ++ * allowed to change them. ++ * ++ * In that case we temporarily set the key to be the ++ * trampoline address. This is fixed up in ++ * static_call_add_module(). ++ */ ++ key_sym = insn->call_dest; + } + free(key_name); + +diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c +index a608784981399..2723082f38170 100644 +--- a/tools/perf/util/auxtrace.c ++++ b/tools/perf/util/auxtrace.c +@@ -298,10 +298,6 @@ static int auxtrace_queues__queue_buffer(struct auxtrace_queues *queues, + queue->set = true; + queue->tid = buffer->tid; + queue->cpu = buffer->cpu; +- } else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) { +- pr_err("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n", +- queue->cpu, queue->tid, buffer->cpu, buffer->tid); +- return -EINVAL; + } + + buffer->buffer_nr = queues->next_buffer_nr++; +diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c +index 2947e3f3c6d9d..dda0a6a3173d3 100644 +--- a/tools/perf/util/synthetic-events.c ++++ b/tools/perf/util/synthetic-events.c +@@ -384,7 +384,7 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool, + + while (!io.eof) { + static const char anonstr[] = "//anon"; +- size_t size; ++ size_t size, aligned_size; + + /* ensure null termination since stack will be reused. */ + event->mmap2.filename[0] = '\0'; +@@ -444,11 +444,12 @@ out: + } + + size = strlen(event->mmap2.filename) + 1; +- size = PERF_ALIGN(size, sizeof(u64)); ++ aligned_size = PERF_ALIGN(size, sizeof(u64)); + event->mmap2.len -= event->mmap.start; + event->mmap2.header.size = (sizeof(event->mmap2) - +- (sizeof(event->mmap2.filename) - size)); +- memset(event->mmap2.filename + size, 0, machine->id_hdr_size); ++ (sizeof(event->mmap2.filename) - aligned_size)); ++ memset(event->mmap2.filename + size, 0, machine->id_hdr_size + ++ (aligned_size - size)); + event->mmap2.header.size += machine->id_hdr_size; + event->mmap2.pid = tgid; + event->mmap2.tid = pid; +diff --git a/tools/testing/kunit/configs/broken_on_uml.config b/tools/testing/kunit/configs/broken_on_uml.config +index a7f0603d33f62..690870043ac0e 100644 +--- a/tools/testing/kunit/configs/broken_on_uml.config ++++ b/tools/testing/kunit/configs/broken_on_uml.config +@@ -40,3 +40,5 @@ + # CONFIG_RESET_BRCMSTB_RESCAL is not set + # CONFIG_RESET_INTEL_GW is not set + # CONFIG_ADI_AXI_ADC is not set ++# CONFIG_DEBUG_PAGEALLOC is not set ++# CONFIG_PAGE_POISONING is not set +diff --git a/tools/testing/selftests/arm64/fp/sve-ptrace.c b/tools/testing/selftests/arm64/fp/sve-ptrace.c +index b2282be6f9384..612d3899614ac 100644 +--- a/tools/testing/selftests/arm64/fp/sve-ptrace.c ++++ b/tools/testing/selftests/arm64/fp/sve-ptrace.c +@@ -332,5 +332,5 @@ int main(void) + + ksft_print_cnts(); + +- return 0; ++ return ret; + } +diff --git a/tools/testing/selftests/bpf/prog_tests/fexit_sleep.c b/tools/testing/selftests/bpf/prog_tests/fexit_sleep.c +new file mode 100644 +index 0000000000000..6c4d42a2386f4 +--- /dev/null ++++ b/tools/testing/selftests/bpf/prog_tests/fexit_sleep.c +@@ -0,0 +1,82 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* Copyright (c) 2021 Facebook */ ++#define _GNU_SOURCE ++#include ++#include ++#include ++#include ++#include ++#include "fexit_sleep.skel.h" ++ ++static int do_sleep(void *skel) ++{ ++ struct fexit_sleep *fexit_skel = skel; ++ struct timespec ts1 = { .tv_nsec = 1 }; ++ struct timespec ts2 = { .tv_sec = 10 }; ++ ++ fexit_skel->bss->pid = getpid(); ++ (void)syscall(__NR_nanosleep, &ts1, NULL); ++ (void)syscall(__NR_nanosleep, &ts2, NULL); ++ return 0; ++} ++ ++#define STACK_SIZE (1024 * 1024) ++static char child_stack[STACK_SIZE]; ++ ++void test_fexit_sleep(void) ++{ ++ struct fexit_sleep *fexit_skel = NULL; ++ int wstatus, duration = 0; ++ pid_t cpid; ++ int err, fexit_cnt; ++ ++ fexit_skel = fexit_sleep__open_and_load(); ++ if (CHECK(!fexit_skel, "fexit_skel_load", "fexit skeleton failed\n")) ++ goto cleanup; ++ ++ err = fexit_sleep__attach(fexit_skel); ++ if (CHECK(err, "fexit_attach", "fexit attach failed: %d\n", err)) ++ goto cleanup; ++ ++ cpid = clone(do_sleep, child_stack + STACK_SIZE, CLONE_FILES | SIGCHLD, fexit_skel); ++ if (CHECK(cpid == -1, "clone", strerror(errno))) ++ goto cleanup; ++ ++ /* wait until first sys_nanosleep ends and second sys_nanosleep starts */ ++ while (READ_ONCE(fexit_skel->bss->fentry_cnt) != 2); ++ fexit_cnt = READ_ONCE(fexit_skel->bss->fexit_cnt); ++ if (CHECK(fexit_cnt != 1, "fexit_cnt", "%d", fexit_cnt)) ++ goto cleanup; ++ ++ /* close progs and detach them. That will trigger two nop5->jmp5 rewrites ++ * in the trampolines to skip nanosleep_fexit prog. ++ * The nanosleep_fentry prog will get detached first. ++ * The nanosleep_fexit prog will get detached second. ++ * Detaching will trigger freeing of both progs JITed images. ++ * There will be two dying bpf_tramp_image-s, but only the initial ++ * bpf_tramp_image (with both _fentry and _fexit progs will be stuck ++ * waiting for percpu_ref_kill to confirm). The other one ++ * will be freed quickly. ++ */ ++ close(bpf_program__fd(fexit_skel->progs.nanosleep_fentry)); ++ close(bpf_program__fd(fexit_skel->progs.nanosleep_fexit)); ++ fexit_sleep__detach(fexit_skel); ++ ++ /* kill the thread to unwind sys_nanosleep stack through the trampoline */ ++ kill(cpid, 9); ++ ++ if (CHECK(waitpid(cpid, &wstatus, 0) == -1, "waitpid", strerror(errno))) ++ goto cleanup; ++ if (CHECK(WEXITSTATUS(wstatus) != 0, "exitstatus", "failed")) ++ goto cleanup; ++ ++ /* The bypassed nanosleep_fexit prog shouldn't have executed. ++ * Unlike progs the maps were not freed and directly accessible. ++ */ ++ fexit_cnt = READ_ONCE(fexit_skel->bss->fexit_cnt); ++ if (CHECK(fexit_cnt != 1, "fexit_cnt", "%d", fexit_cnt)) ++ goto cleanup; ++ ++cleanup: ++ fexit_sleep__destroy(fexit_skel); ++} +diff --git a/tools/testing/selftests/bpf/progs/fexit_sleep.c b/tools/testing/selftests/bpf/progs/fexit_sleep.c +new file mode 100644 +index 0000000000000..03a672d76353a +--- /dev/null ++++ b/tools/testing/selftests/bpf/progs/fexit_sleep.c +@@ -0,0 +1,31 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* Copyright (c) 2021 Facebook */ ++#include "vmlinux.h" ++#include ++#include ++ ++char LICENSE[] SEC("license") = "GPL"; ++ ++int pid = 0; ++int fentry_cnt = 0; ++int fexit_cnt = 0; ++ ++SEC("fentry/__x64_sys_nanosleep") ++int BPF_PROG(nanosleep_fentry, const struct pt_regs *regs) ++{ ++ if ((int)bpf_get_current_pid_tgid() != pid) ++ return 0; ++ ++ fentry_cnt++; ++ return 0; ++} ++ ++SEC("fexit/__x64_sys_nanosleep") ++int BPF_PROG(nanosleep_fexit, const struct pt_regs *regs, int ret) ++{ ++ if ((int)bpf_get_current_pid_tgid() != pid) ++ return 0; ++ ++ fexit_cnt++; ++ return 0; ++} +diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +index 9afe947cfae95..ba6eadfec5653 100644 +--- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +@@ -508,10 +508,8 @@ int _ip6geneve_get_tunnel(struct __sk_buff *skb) + } + + ret = bpf_skb_get_tunnel_opt(skb, &gopt, sizeof(gopt)); +- if (ret < 0) { +- ERROR(ret); +- return TC_ACT_SHOT; +- } ++ if (ret < 0) ++ gopt.opt_class = 0; + + bpf_trace_printk(fmt, sizeof(fmt), + key.tunnel_id, key.remote_ipv4, gopt.opt_class); +diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh +index ce6bea9675c07..0ccb1dda099ae 100755 +--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh ++++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh +@@ -658,7 +658,7 @@ test_ecn_decap() + # In accordance with INET_ECN_decapsulate() + __test_ecn_decap 00 00 0x00 + __test_ecn_decap 01 01 0x01 +- __test_ecn_decap 02 01 0x02 ++ __test_ecn_decap 02 01 0x01 + __test_ecn_decap 01 03 0x03 + __test_ecn_decap 02 03 0x03 + test_ecn_decap_error +diff --git a/tools/testing/selftests/net/reuseaddr_ports_exhausted.c b/tools/testing/selftests/net/reuseaddr_ports_exhausted.c +index 7b01b7c2ec104..066efd30e2946 100644 +--- a/tools/testing/selftests/net/reuseaddr_ports_exhausted.c ++++ b/tools/testing/selftests/net/reuseaddr_ports_exhausted.c +@@ -30,25 +30,25 @@ struct reuse_opts { + }; + + struct reuse_opts unreusable_opts[12] = { +- {0, 0, 0, 0}, +- {0, 0, 0, 1}, +- {0, 0, 1, 0}, +- {0, 0, 1, 1}, +- {0, 1, 0, 0}, +- {0, 1, 0, 1}, +- {0, 1, 1, 0}, +- {0, 1, 1, 1}, +- {1, 0, 0, 0}, +- {1, 0, 0, 1}, +- {1, 0, 1, 0}, +- {1, 0, 1, 1}, ++ {{0, 0}, {0, 0}}, ++ {{0, 0}, {0, 1}}, ++ {{0, 0}, {1, 0}}, ++ {{0, 0}, {1, 1}}, ++ {{0, 1}, {0, 0}}, ++ {{0, 1}, {0, 1}}, ++ {{0, 1}, {1, 0}}, ++ {{0, 1}, {1, 1}}, ++ {{1, 0}, {0, 0}}, ++ {{1, 0}, {0, 1}}, ++ {{1, 0}, {1, 0}}, ++ {{1, 0}, {1, 1}}, + }; + + struct reuse_opts reusable_opts[4] = { +- {1, 1, 0, 0}, +- {1, 1, 0, 1}, +- {1, 1, 1, 0}, +- {1, 1, 1, 1}, ++ {{1, 1}, {0, 0}}, ++ {{1, 1}, {0, 1}}, ++ {{1, 1}, {1, 0}}, ++ {{1, 1}, {1, 1}}, + }; + + int bind_port(struct __test_metadata *_metadata, int reuseaddr, int reuseport)