From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 9BA3E138334 for ; Wed, 20 Jun 2018 19:44:21 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 6DABEE0B13; Wed, 20 Jun 2018 19:44:20 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id A1F06E0B13 for ; Wed, 20 Jun 2018 19:44:19 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id E8459335CF5 for ; Wed, 20 Jun 2018 19:44:17 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 6A4CD2A1 for ; Wed, 20 Jun 2018 19:44:16 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1529523847.39d0fad6ec600bb1c3d7cb58750a0f1f96b7bf7b.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.16 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1016_linux-4.16.17.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 39d0fad6ec600bb1c3d7cb58750a0f1f96b7bf7b X-VCS-Branch: 4.16 Date: Wed, 20 Jun 2018 19:44:16 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 038f9073-5035-4d8b-9bdb-a0cd2f815dc9 X-Archives-Hash: 1ac8a44286e4f8f52a7a5f2b44fbea86 commit: 39d0fad6ec600bb1c3d7cb58750a0f1f96b7bf7b Author: Mike Pagano gentoo org> AuthorDate: Wed Jun 20 19:44:07 2018 +0000 Commit: Mike Pagano gentoo org> CommitDate: Wed Jun 20 19:44:07 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=39d0fad6 Linux patch 4.16.17 0000_README | 4 + 1016_linux-4.16.17.patch | 10919 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 10923 insertions(+) diff --git a/0000_README b/0000_README index 83e0c3b..c683722 100644 --- a/0000_README +++ b/0000_README @@ -107,6 +107,10 @@ Patch: 1015_linux-4.16.16.patch From: http://www.kernel.org Desc: Linux 4.16.16 +Patch: 1016_linux-4.16.17.patch +From: http://www.kernel.org +Desc: Linux 4.16.17 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1016_linux-4.16.17.patch b/1016_linux-4.16.17.patch new file mode 100644 index 0000000..c408309 --- /dev/null +++ b/1016_linux-4.16.17.patch @@ -0,0 +1,10919 @@ +diff --git a/Documentation/devicetree/bindings/display/panel/panel-common.txt b/Documentation/devicetree/bindings/display/panel/panel-common.txt +index 557fa765adcb..5d2519af4bb5 100644 +--- a/Documentation/devicetree/bindings/display/panel/panel-common.txt ++++ b/Documentation/devicetree/bindings/display/panel/panel-common.txt +@@ -38,7 +38,7 @@ Display Timings + require specific display timings. The panel-timing subnode expresses those + timings as specified in the timing subnode section of the display timing + bindings defined in +- Documentation/devicetree/bindings/display/display-timing.txt. ++ Documentation/devicetree/bindings/display/panel/display-timing.txt. + + + Connectivity +diff --git a/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt b/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt +index 891db41e9420..98d7898fcd78 100644 +--- a/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt ++++ b/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt +@@ -25,6 +25,7 @@ Required Properties: + - "renesas,dmac-r8a7794" (R-Car E2) + - "renesas,dmac-r8a7795" (R-Car H3) + - "renesas,dmac-r8a7796" (R-Car M3-W) ++ - "renesas,dmac-r8a77965" (R-Car M3-N) + - "renesas,dmac-r8a77970" (R-Car V3M) + + - reg: base address and length of the registers block for the DMAC +diff --git a/Documentation/devicetree/bindings/net/renesas,ravb.txt b/Documentation/devicetree/bindings/net/renesas,ravb.txt +index b4dc455eb155..d159807c2155 100644 +--- a/Documentation/devicetree/bindings/net/renesas,ravb.txt ++++ b/Documentation/devicetree/bindings/net/renesas,ravb.txt +@@ -17,6 +17,7 @@ Required properties: + + - "renesas,etheravb-r8a7795" for the R8A7795 SoC. + - "renesas,etheravb-r8a7796" for the R8A7796 SoC. ++ - "renesas,etheravb-r8a77965" for the R8A77965 SoC. + - "renesas,etheravb-r8a77970" for the R8A77970 SoC. + - "renesas,etheravb-r8a77980" for the R8A77980 SoC. + - "renesas,etheravb-r8a77995" for the R8A77995 SoC. +diff --git a/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt +index 09789fdfa749..4dc4c354c72b 100644 +--- a/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt +@@ -55,9 +55,9 @@ pins it needs, and how they should be configured, with regard to muxer + configuration, drive strength and pullups. If one of these options is + not set, its actual value will be unspecified. + +-This driver supports the generic pin multiplexing and configuration +-bindings. For details on each properties, you can refer to +-./pinctrl-bindings.txt. ++Allwinner A1X Pin Controller supports the generic pin multiplexing and ++configuration bindings. For details on each properties, you can refer to ++ ./pinctrl-bindings.txt. + + Required sub-node properties: + - pins +diff --git a/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt b/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt +index 8ff65fa632fd..c06c045126fc 100644 +--- a/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt ++++ b/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt +@@ -21,7 +21,7 @@ Required properties: + - interrupts : identifier to the device interrupt + - clocks : a list of phandle + clock-specifier pairs, one for each + entry in clock names. +-- clocks-names : ++- clock-names : + * "xtal" for external xtal clock identifier + * "pclk" for the bus core clock, either the clk81 clock or the gate clock + * "baud" for the source of the baudrate generator, can be either the xtal +diff --git a/Documentation/devicetree/bindings/serial/mvebu-uart.txt b/Documentation/devicetree/bindings/serial/mvebu-uart.txt +index 2ae2fee7e023..b7e0e32b9ac6 100644 +--- a/Documentation/devicetree/bindings/serial/mvebu-uart.txt ++++ b/Documentation/devicetree/bindings/serial/mvebu-uart.txt +@@ -24,7 +24,7 @@ Required properties: + - Must contain two elements for the extended variant of the IP + (marvell,armada-3700-uart-ext): "uart-tx" and "uart-rx", + respectively the UART TX interrupt and the UART RX interrupt. A +- corresponding interrupts-names property must be defined. ++ corresponding interrupt-names property must be defined. + - For backward compatibility reasons, a single element interrupts + property is also supported for the standard variant of the IP, + containing only the UART sum interrupt. This form is deprecated +diff --git a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt +index cf504d0380ae..88f947c47adc 100644 +--- a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt ++++ b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt +@@ -41,6 +41,8 @@ Required properties: + - "renesas,hscif-r8a7795" for R8A7795 (R-Car H3) HSCIF compatible UART. + - "renesas,scif-r8a7796" for R8A7796 (R-Car M3-W) SCIF compatible UART. + - "renesas,hscif-r8a7796" for R8A7796 (R-Car M3-W) HSCIF compatible UART. ++ - "renesas,scif-r8a77965" for R8A77965 (R-Car M3-N) SCIF compatible UART. ++ - "renesas,hscif-r8a77965" for R8A77965 (R-Car M3-N) HSCIF compatible UART. + - "renesas,scif-r8a77970" for R8A77970 (R-Car V3M) SCIF compatible UART. + - "renesas,hscif-r8a77970" for R8A77970 (R-Car V3M) HSCIF compatible UART. + - "renesas,scif-r8a77995" for R8A77995 (R-Car D3) SCIF compatible UART. +diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt +index ae850d6c0ad3..8ff7eadc8bef 100644 +--- a/Documentation/devicetree/bindings/vendor-prefixes.txt ++++ b/Documentation/devicetree/bindings/vendor-prefixes.txt +@@ -181,6 +181,7 @@ karo Ka-Ro electronics GmbH + keithkoep Keith & Koep GmbH + keymile Keymile GmbH + khadas Khadas ++kiebackpeter Kieback & Peter GmbH + kinetic Kinetic Technologies + kingnovel Kingnovel Technology Co., Ltd. + kosagi Sutajio Ko-Usagi PTE Ltd. +diff --git a/Makefile b/Makefile +index 55554f392115..02a4f7f8c613 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 16 +-SUBLEVEL = 16 ++SUBLEVEL = 17 + EXTRAVERSION = + NAME = Fearless Coyote + +diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile +index 45a6b9b7af2a..6a4e7341ecd3 100644 +--- a/arch/arm/boot/compressed/Makefile ++++ b/arch/arm/boot/compressed/Makefile +@@ -117,11 +117,9 @@ ccflags-y := -fpic -mno-single-pic-base -fno-builtin -I$(obj) + asflags-y := -DZIMAGE + + # Supply kernel BSS size to the decompressor via a linker symbol. +-KBSS_SZ = $(shell $(CROSS_COMPILE)nm $(obj)/../../../../vmlinux | \ +- perl -e 'while (<>) { \ +- $$bss_start=hex($$1) if /^([[:xdigit:]]+) B __bss_start$$/; \ +- $$bss_end=hex($$1) if /^([[:xdigit:]]+) B __bss_stop$$/; \ +- }; printf "%d\n", $$bss_end - $$bss_start;') ++KBSS_SZ = $(shell echo $$(($$($(CROSS_COMPILE)nm $(obj)/../../../../vmlinux | \ ++ sed -n -e 's/^\([^ ]*\) [AB] __bss_start$$/-0x\1/p' \ ++ -e 's/^\([^ ]*\) [AB] __bss_stop$$/+0x\1/p') )) ) + LDFLAGS_vmlinux = --defsym _kernel_bss_size=$(KBSS_SZ) + # Supply ZRELADDR to the decompressor via a linker symbol. + ifneq ($(CONFIG_AUTO_ZRELADDR),y) +diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S +index 45c8823c3750..517e0e18f0b8 100644 +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -29,19 +29,19 @@ + #if defined(CONFIG_DEBUG_ICEDCC) + + #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_V6K) || defined(CONFIG_CPU_V7) +- .macro loadsp, rb, tmp ++ .macro loadsp, rb, tmp1, tmp2 + .endm + .macro writeb, ch, rb + mcr p14, 0, \ch, c0, c5, 0 + .endm + #elif defined(CONFIG_CPU_XSCALE) +- .macro loadsp, rb, tmp ++ .macro loadsp, rb, tmp1, tmp2 + .endm + .macro writeb, ch, rb + mcr p14, 0, \ch, c8, c0, 0 + .endm + #else +- .macro loadsp, rb, tmp ++ .macro loadsp, rb, tmp1, tmp2 + .endm + .macro writeb, ch, rb + mcr p14, 0, \ch, c1, c0, 0 +@@ -57,7 +57,7 @@ + .endm + + #if defined(CONFIG_ARCH_SA1100) +- .macro loadsp, rb, tmp ++ .macro loadsp, rb, tmp1, tmp2 + mov \rb, #0x80000000 @ physical base address + #ifdef CONFIG_DEBUG_LL_SER3 + add \rb, \rb, #0x00050000 @ Ser3 +@@ -66,8 +66,8 @@ + #endif + .endm + #else +- .macro loadsp, rb, tmp +- addruart \rb, \tmp ++ .macro loadsp, rb, tmp1, tmp2 ++ addruart \rb, \tmp1, \tmp2 + .endm + #endif + #endif +@@ -561,8 +561,6 @@ not_relocated: mov r0, #0 + bl decompress_kernel + bl cache_clean_flush + bl cache_off +- mov r1, r7 @ restore architecture number +- mov r2, r8 @ restore atags pointer + + #ifdef CONFIG_ARM_VIRT_EXT + mrs r0, spsr @ Get saved CPU boot mode +@@ -1297,7 +1295,7 @@ phex: adr r3, phexbuf + b 1b + + @ puts corrupts {r0, r1, r2, r3} +-puts: loadsp r3, r1 ++puts: loadsp r3, r2, r1 + 1: ldrb r2, [r0], #1 + teq r2, #0 + moveq pc, lr +@@ -1314,8 +1312,8 @@ puts: loadsp r3, r1 + @ putc corrupts {r0, r1, r2, r3} + putc: + mov r2, r0 ++ loadsp r3, r1, r0 + mov r0, #0 +- loadsp r3, r1 + b 2b + + @ memdump corrupts {r0, r1, r2, r3, r10, r11, r12, lr} +@@ -1365,6 +1363,8 @@ __hyp_reentry_vectors: + + __enter_kernel: + mov r0, #0 @ must be 0 ++ mov r1, r7 @ restore architecture number ++ mov r2, r8 @ restore atags pointer + ARM( mov pc, r4 ) @ call kernel + M_CLASS( add r4, r4, #1 ) @ enter in Thumb mode for M class + THUMB( bx r4 ) @ entry point is always ARM for A/R classes +diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi +index 699fdf94d139..9fe4f5a6379e 100644 +--- a/arch/arm/boot/dts/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi +@@ -69,7 +69,7 @@ + timer@20200 { + compatible = "arm,cortex-a9-global-timer"; + reg = <0x20200 0x100>; +- interrupts = ; ++ interrupts = ; + clocks = <&periph_clk>; + }; + +diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi +index c66cf7895363..3cf97f4dac24 100644 +--- a/arch/arm/boot/dts/da850.dtsi ++++ b/arch/arm/boot/dts/da850.dtsi +@@ -46,8 +46,6 @@ + pmx_core: pinmux@14120 { + compatible = "pinctrl-single"; + reg = <0x14120 0x50>; +- #address-cells = <1>; +- #size-cells = <0>; + #pinctrl-cells = <2>; + pinctrl-single,bit-per-mux; + pinctrl-single,register-width = <32>; +diff --git a/arch/arm/boot/dts/dm8148-evm.dts b/arch/arm/boot/dts/dm8148-evm.dts +index d6657b3bae84..85d7b5148b0a 100644 +--- a/arch/arm/boot/dts/dm8148-evm.dts ++++ b/arch/arm/boot/dts/dm8148-evm.dts +@@ -10,7 +10,7 @@ + + / { + model = "DM8148 EVM"; +- compatible = "ti,dm8148-evm", "ti,dm8148"; ++ compatible = "ti,dm8148-evm", "ti,dm8148", "ti,dm814"; + + memory@80000000 { + device_type = "memory"; +diff --git a/arch/arm/boot/dts/dm8148-t410.dts b/arch/arm/boot/dts/dm8148-t410.dts +index 63883b3479f9..6418f9cdbe83 100644 +--- a/arch/arm/boot/dts/dm8148-t410.dts ++++ b/arch/arm/boot/dts/dm8148-t410.dts +@@ -9,7 +9,7 @@ + + / { + model = "HP t410 Smart Zero Client"; +- compatible = "hp,t410", "ti,dm8148"; ++ compatible = "hp,t410", "ti,dm8148", "ti,dm814"; + + memory@80000000 { + device_type = "memory"; +diff --git a/arch/arm/boot/dts/dm8168-evm.dts b/arch/arm/boot/dts/dm8168-evm.dts +index c72a2132aa82..1d030d567307 100644 +--- a/arch/arm/boot/dts/dm8168-evm.dts ++++ b/arch/arm/boot/dts/dm8168-evm.dts +@@ -10,7 +10,7 @@ + + / { + model = "DM8168 EVM"; +- compatible = "ti,dm8168-evm", "ti,dm8168"; ++ compatible = "ti,dm8168-evm", "ti,dm8168", "ti,dm816"; + + memory@80000000 { + device_type = "memory"; +diff --git a/arch/arm/boot/dts/dra62x-j5eco-evm.dts b/arch/arm/boot/dts/dra62x-j5eco-evm.dts +index fee0547f7302..31b824ad5d29 100644 +--- a/arch/arm/boot/dts/dra62x-j5eco-evm.dts ++++ b/arch/arm/boot/dts/dra62x-j5eco-evm.dts +@@ -10,7 +10,7 @@ + + / { + model = "DRA62x J5 Eco EVM"; +- compatible = "ti,dra62x-j5eco-evm", "ti,dra62x", "ti,dm8148"; ++ compatible = "ti,dra62x-j5eco-evm", "ti,dra62x", "ti,dm8148", "ti,dm814"; + + memory@80000000 { + device_type = "memory"; +diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts +index 5306b78de0ca..380afcafeb16 100644 +--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts ++++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts +@@ -518,7 +518,7 @@ + }; + + touchscreen@20 { +- compatible = "syna,rmi4_i2c"; ++ compatible = "syna,rmi4-i2c"; + reg = <0x20>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_ts>; +@@ -536,8 +536,8 @@ + + rmi4-f11@11 { + reg = <0x11>; +- touch-inverted-y; +- touch-swapped-x-y; ++ touchscreen-inverted-y; ++ touchscreen-swapped-x-y; + syna,sensor-type = <1>; + }; + }; +diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi +index a30ee9fcb3ae..4fabe4e9283f 100644 +--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi ++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi +@@ -26,7 +26,7 @@ + gpio = <&gpio1 3 0>; /* gpio_3 */ + startup-delay-us = <70000>; + enable-active-high; +- vin-supply = <&vmmc2>; ++ vin-supply = <&vaux3>; + }; + + /* HS USB Host PHY on PORT 1 */ +@@ -82,6 +82,7 @@ + twl_audio: audio { + compatible = "ti,twl4030-audio"; + codec { ++ ti,hs_extmute_gpio = <&gpio2 25 GPIO_ACTIVE_HIGH>; + }; + }; + }; +@@ -195,6 +196,7 @@ + pinctrl-single,pins = < + OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ + OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ ++ OMAP3_CORE1_IOPAD(0x20ba, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs6.gpio_57 */ + >; + }; + }; +@@ -209,7 +211,7 @@ + }; + wl127x_gpio: pinmux_wl127x_gpio_pin { + pinctrl-single,pins = < +- OMAP3_WKUP_IOPAD(0x2a0c, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */ ++ OMAP3_WKUP_IOPAD(0x2a0a, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */ + OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */ + >; + }; +@@ -244,6 +246,11 @@ + #include "twl4030.dtsi" + #include "twl4030_omap3.dtsi" + ++&vaux3 { ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++}; ++ + &twl { + twl_power: power { + compatible = "ti,twl4030-power-idle-osc-off", "ti,twl4030-power-idle"; +diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi +index 475904894b86..e554b6e039f3 100644 +--- a/arch/arm/boot/dts/omap4.dtsi ++++ b/arch/arm/boot/dts/omap4.dtsi +@@ -163,10 +163,10 @@ + + cm2: cm2@8000 { + compatible = "ti,omap4-cm2", "simple-bus"; +- reg = <0x8000 0x3000>; ++ reg = <0x8000 0x2000>; + #address-cells = <1>; + #size-cells = <1>; +- ranges = <0 0x8000 0x3000>; ++ ranges = <0 0x8000 0x2000>; + + cm2_clocks: clocks { + #address-cells = <1>; +@@ -250,11 +250,11 @@ + + prm: prm@6000 { + compatible = "ti,omap4-prm"; +- reg = <0x6000 0x3000>; ++ reg = <0x6000 0x2000>; + interrupts = ; + #address-cells = <1>; + #size-cells = <1>; +- ranges = <0 0x6000 0x3000>; ++ ranges = <0 0x6000 0x2000>; + + prm_clocks: clocks { + #address-cells = <1>; +diff --git a/arch/arm/include/uapi/asm/siginfo.h b/arch/arm/include/uapi/asm/siginfo.h +deleted file mode 100644 +index d0513880be21..000000000000 +--- a/arch/arm/include/uapi/asm/siginfo.h ++++ /dev/null +@@ -1,13 +0,0 @@ +-#ifndef __ASM_SIGINFO_H +-#define __ASM_SIGINFO_H +- +-#include +- +-/* +- * SIGFPE si_codes +- */ +-#ifdef __KERNEL__ +-#define FPE_FIXME 0 /* Broken dup of SI_USER */ +-#endif /* __KERNEL__ */ +- +-#endif +diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c +index 6b38d7a634c1..c15318431986 100644 +--- a/arch/arm/kernel/machine_kexec.c ++++ b/arch/arm/kernel/machine_kexec.c +@@ -95,6 +95,27 @@ void machine_crash_nonpanic_core(void *unused) + cpu_relax(); + } + ++void crash_smp_send_stop(void) ++{ ++ static int cpus_stopped; ++ unsigned long msecs; ++ ++ if (cpus_stopped) ++ return; ++ ++ atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); ++ smp_call_function(machine_crash_nonpanic_core, NULL, false); ++ msecs = 1000; /* Wait at most a second for the other cpus to stop */ ++ while ((atomic_read(&waiting_for_crash_ipi) > 0) && msecs) { ++ mdelay(1); ++ msecs--; ++ } ++ if (atomic_read(&waiting_for_crash_ipi) > 0) ++ pr_warn("Non-crashing CPUs did not react to IPI\n"); ++ ++ cpus_stopped = 1; ++} ++ + static void machine_kexec_mask_interrupts(void) + { + unsigned int i; +@@ -120,19 +141,8 @@ static void machine_kexec_mask_interrupts(void) + + void machine_crash_shutdown(struct pt_regs *regs) + { +- unsigned long msecs; +- + local_irq_disable(); +- +- atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); +- smp_call_function(machine_crash_nonpanic_core, NULL, false); +- msecs = 1000; /* Wait at most a second for the other cpus to stop */ +- while ((atomic_read(&waiting_for_crash_ipi) > 0) && msecs) { +- mdelay(1); +- msecs--; +- } +- if (atomic_read(&waiting_for_crash_ipi) > 0) +- pr_warn("Non-crashing CPUs did not react to IPI\n"); ++ crash_smp_send_stop(); + + crash_save_cpu(regs, smp_processor_id()); + machine_kexec_mask_interrupts(); +diff --git a/arch/arm/mach-davinci/board-da830-evm.c b/arch/arm/mach-davinci/board-da830-evm.c +index f673cd7a6766..fb7c44cdadcb 100644 +--- a/arch/arm/mach-davinci/board-da830-evm.c ++++ b/arch/arm/mach-davinci/board-da830-evm.c +@@ -205,12 +205,17 @@ static const short da830_evm_mmc_sd_pins[] = { + -1 + }; + ++#define DA830_MMCSD_WP_PIN GPIO_TO_PIN(2, 1) ++#define DA830_MMCSD_CD_PIN GPIO_TO_PIN(2, 2) ++ + static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { + /* gpio chip 1 contains gpio range 32-63 */ +- GPIO_LOOKUP("davinci_gpio.1", 2, "cd", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.1", 1, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_CD_PIN, "cd", ++ GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_WP_PIN, "wp", ++ GPIO_ACTIVE_LOW), + }, + }; + +diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c +index d898a94f6eae..631363293887 100644 +--- a/arch/arm/mach-davinci/board-da850-evm.c ++++ b/arch/arm/mach-davinci/board-da850-evm.c +@@ -763,12 +763,17 @@ static const short da850_evm_mcasp_pins[] __initconst = { + -1 + }; + ++#define DA850_MMCSD_CD_PIN GPIO_TO_PIN(4, 0) ++#define DA850_MMCSD_WP_PIN GPIO_TO_PIN(4, 1) ++ + static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { + /* gpio chip 2 contains gpio range 64-95 */ +- GPIO_LOOKUP("davinci_gpio.2", 0, "cd", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.2", 1, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd", ++ GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp", ++ GPIO_ACTIVE_LOW), + }, + }; + +diff --git a/arch/arm/mach-davinci/board-dm355-evm.c b/arch/arm/mach-davinci/board-dm355-evm.c +index d6b11907380c..9aedec083dbf 100644 +--- a/arch/arm/mach-davinci/board-dm355-evm.c ++++ b/arch/arm/mach-davinci/board-dm355-evm.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -109,12 +110,15 @@ static struct platform_device davinci_nand_device = { + }, + }; + ++#define DM355_I2C_SDA_PIN GPIO_TO_PIN(0, 15) ++#define DM355_I2C_SCL_PIN GPIO_TO_PIN(0, 14) ++ + static struct gpiod_lookup_table i2c_recovery_gpiod_table = { +- .dev_id = "i2c_davinci", ++ .dev_id = "i2c_davinci.1", + .table = { +- GPIO_LOOKUP("davinci_gpio", 15, "sda", ++ GPIO_LOOKUP("davinci_gpio.0", DM355_I2C_SDA_PIN, "sda", + GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), +- GPIO_LOOKUP("davinci_gpio", 14, "scl", ++ GPIO_LOOKUP("davinci_gpio.0", DM355_I2C_SCL_PIN, "scl", + GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), + }, + }; +@@ -179,11 +183,16 @@ static struct resource dm355evm_dm9000_rsrc[] = { + }, + }; + ++static struct dm9000_plat_data dm335evm_dm9000_platdata; ++ + static struct platform_device dm355evm_dm9000 = { + .name = "dm9000", + .id = -1, + .resource = dm355evm_dm9000_rsrc, + .num_resources = ARRAY_SIZE(dm355evm_dm9000_rsrc), ++ .dev = { ++ .platform_data = &dm335evm_dm9000_platdata, ++ }, + }; + + static struct tvp514x_platform_data tvp5146_pdata = { +diff --git a/arch/arm/mach-davinci/board-dm644x-evm.c b/arch/arm/mach-davinci/board-dm644x-evm.c +index 85e6fb33b1ee..50b246e315d1 100644 +--- a/arch/arm/mach-davinci/board-dm644x-evm.c ++++ b/arch/arm/mach-davinci/board-dm644x-evm.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -596,12 +597,15 @@ static struct i2c_board_info __initdata i2c_info[] = { + }, + }; + ++#define DM644X_I2C_SDA_PIN GPIO_TO_PIN(2, 12) ++#define DM644X_I2C_SCL_PIN GPIO_TO_PIN(2, 11) ++ + static struct gpiod_lookup_table i2c_recovery_gpiod_table = { +- .dev_id = "i2c_davinci", ++ .dev_id = "i2c_davinci.1", + .table = { +- GPIO_LOOKUP("davinci_gpio", 44, "sda", ++ GPIO_LOOKUP("davinci_gpio.0", DM644X_I2C_SDA_PIN, "sda", + GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), +- GPIO_LOOKUP("davinci_gpio", 43, "scl", ++ GPIO_LOOKUP("davinci_gpio.0", DM644X_I2C_SCL_PIN, "scl", + GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), + }, + }; +diff --git a/arch/arm/mach-davinci/board-dm646x-evm.c b/arch/arm/mach-davinci/board-dm646x-evm.c +index cb0a41e83582..4c458f714101 100644 +--- a/arch/arm/mach-davinci/board-dm646x-evm.c ++++ b/arch/arm/mach-davinci/board-dm646x-evm.c +@@ -534,11 +534,12 @@ static struct vpif_display_config dm646x_vpif_display_config = { + .set_clock = set_vpif_clock, + .subdevinfo = dm646x_vpif_subdev, + .subdev_count = ARRAY_SIZE(dm646x_vpif_subdev), ++ .i2c_adapter_id = 1, + .chan_config[0] = { + .outputs = dm6467_ch0_outputs, + .output_count = ARRAY_SIZE(dm6467_ch0_outputs), + }, +- .card_name = "DM646x EVM", ++ .card_name = "DM646x EVM Video Display", + }; + + /** +@@ -676,6 +677,7 @@ static struct vpif_capture_config dm646x_vpif_capture_cfg = { + .setup_input_channel_mode = setup_vpif_input_channel_mode, + .subdev_info = vpif_capture_sdev_info, + .subdev_count = ARRAY_SIZE(vpif_capture_sdev_info), ++ .i2c_adapter_id = 1, + .chan_config[0] = { + .inputs = dm6467_ch0_inputs, + .input_count = ARRAY_SIZE(dm6467_ch0_inputs), +@@ -696,6 +698,7 @@ static struct vpif_capture_config dm646x_vpif_capture_cfg = { + .fid_pol = 0, + }, + }, ++ .card_name = "DM646x EVM Video Capture", + }; + + static void __init evm_init_video(void) +diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c +index 62eb7d668890..10a027253250 100644 +--- a/arch/arm/mach-davinci/board-omapl138-hawk.c ++++ b/arch/arm/mach-davinci/board-omapl138-hawk.c +@@ -123,12 +123,16 @@ static const short hawk_mmcsd0_pins[] = { + -1 + }; + ++#define DA850_HAWK_MMCSD_CD_PIN GPIO_TO_PIN(3, 12) ++#define DA850_HAWK_MMCSD_WP_PIN GPIO_TO_PIN(3, 13) ++ + static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { +- /* CD: gpio3_12: gpio60: chip 1 contains gpio range 32-63*/ +- GPIO_LOOKUP("davinci_gpio.0", 28, "cd", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.0", 29, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_CD_PIN, "cd", ++ GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_WP_PIN, "wp", ++ GPIO_ACTIVE_LOW), + }, + }; + +diff --git a/arch/arm/mach-davinci/dm646x.c b/arch/arm/mach-davinci/dm646x.c +index 6fc06a6ad4f8..137227b33397 100644 +--- a/arch/arm/mach-davinci/dm646x.c ++++ b/arch/arm/mach-davinci/dm646x.c +@@ -495,7 +495,8 @@ static u8 dm646x_default_priorities[DAVINCI_N_AINTC_IRQ] = { + [IRQ_DM646X_MCASP0TXINT] = 7, + [IRQ_DM646X_MCASP0RXINT] = 7, + [IRQ_DM646X_RESERVED_3] = 7, +- [IRQ_DM646X_MCASP1TXINT] = 7, /* clockevent */ ++ [IRQ_DM646X_MCASP1TXINT] = 7, ++ [IRQ_TINT0_TINT12] = 7, /* clockevent */ + [IRQ_TINT0_TINT34] = 7, /* clocksource */ + [IRQ_TINT1_TINT12] = 7, /* DSP timer */ + [IRQ_TINT1_TINT34] = 7, /* system tick */ +diff --git a/arch/arm/mach-keystone/pm_domain.c b/arch/arm/mach-keystone/pm_domain.c +index fe57e2692629..abca83d22ff3 100644 +--- a/arch/arm/mach-keystone/pm_domain.c ++++ b/arch/arm/mach-keystone/pm_domain.c +@@ -29,6 +29,7 @@ static struct dev_pm_domain keystone_pm_domain = { + + static struct pm_clk_notifier_block platform_domain_notifier = { + .pm_domain = &keystone_pm_domain, ++ .con_ids = { NULL }, + }; + + static const struct of_device_id of_keystone_table[] = { +diff --git a/arch/arm/mach-omap1/ams-delta-fiq.c b/arch/arm/mach-omap1/ams-delta-fiq.c +index 793a24a53c52..d7ca9e2b40d2 100644 +--- a/arch/arm/mach-omap1/ams-delta-fiq.c ++++ b/arch/arm/mach-omap1/ams-delta-fiq.c +@@ -58,22 +58,24 @@ static irqreturn_t deferred_fiq(int irq, void *dev_id) + irq_num = gpio_to_irq(gpio); + fiq_count = fiq_buffer[FIQ_CNT_INT_00 + gpio]; + +- while (irq_counter[gpio] < fiq_count) { +- if (gpio != AMS_DELTA_GPIO_PIN_KEYBRD_CLK) { +- struct irq_data *d = irq_get_irq_data(irq_num); +- +- /* +- * It looks like handle_edge_irq() that +- * OMAP GPIO edge interrupts default to, +- * expects interrupt already unmasked. +- */ +- if (irq_chip && irq_chip->irq_unmask) ++ if (irq_counter[gpio] < fiq_count && ++ gpio != AMS_DELTA_GPIO_PIN_KEYBRD_CLK) { ++ struct irq_data *d = irq_get_irq_data(irq_num); ++ ++ /* ++ * handle_simple_irq() that OMAP GPIO edge ++ * interrupts default to since commit 80ac93c27441 ++ * requires interrupt already acked and unmasked. ++ */ ++ if (irq_chip) { ++ if (irq_chip->irq_ack) ++ irq_chip->irq_ack(d); ++ if (irq_chip->irq_unmask) + irq_chip->irq_unmask(d); + } +- generic_handle_irq(irq_num); +- +- irq_counter[gpio]++; + } ++ for (; irq_counter[gpio] < fiq_count; irq_counter[gpio]++) ++ generic_handle_irq(irq_num); + } + return IRQ_HANDLED; + } +diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c +index 76eb6ec5f157..1e6a967cd2d5 100644 +--- a/arch/arm/mach-omap2/powerdomain.c ++++ b/arch/arm/mach-omap2/powerdomain.c +@@ -188,7 +188,7 @@ static int _pwrdm_state_switch(struct powerdomain *pwrdm, int flag) + ((prev & OMAP_POWERSTATE_MASK) << 0)); + trace_power_domain_target_rcuidle(pwrdm->name, + trace_state, +- smp_processor_id()); ++ raw_smp_processor_id()); + } + break; + default: +@@ -518,7 +518,7 @@ int pwrdm_set_next_pwrst(struct powerdomain *pwrdm, u8 pwrst) + if (arch_pwrdm && arch_pwrdm->pwrdm_set_next_pwrst) { + /* Trace the pwrdm desired target state */ + trace_power_domain_target_rcuidle(pwrdm->name, pwrst, +- smp_processor_id()); ++ raw_smp_processor_id()); + /* Program the pwrdm desired target state */ + ret = arch_pwrdm->pwrdm_set_next_pwrst(pwrdm, pwrst); + } +diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c +index 4c375e11ae95..af4ee2cef2f9 100644 +--- a/arch/arm/vfp/vfpmodule.c ++++ b/arch/arm/vfp/vfpmodule.c +@@ -257,7 +257,7 @@ static void vfp_raise_exceptions(u32 exceptions, u32 inst, u32 fpscr, struct pt_ + + if (exceptions == VFP_EXCEPTION_ERROR) { + vfp_panic("unhandled bounce", inst); +- vfp_raise_sigfpe(FPE_FIXME, regs); ++ vfp_raise_sigfpe(FPE_FLTINV, regs); + return; + } + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi +index aeb6d21a3bec..afc4001689fd 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi +@@ -248,3 +248,7 @@ + pinctrl-0 = <&uart_ao_a_pins>; + pinctrl-names = "default"; + }; ++ ++&usb0 { ++ status = "okay"; ++}; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +index 9671f1e3c74a..40c674317987 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +@@ -271,3 +271,15 @@ + pinctrl-0 = <&uart_ao_a_pins>; + pinctrl-names = "default"; + }; ++ ++&usb0 { ++ status = "okay"; ++}; ++ ++&usb2_phy0 { ++ /* ++ * even though the schematics don't show it: ++ * HDMI_5V is also used as supply for the USB VBUS. ++ */ ++ phy-supply = <&hdmi_5v>; ++}; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts +index 271f14279180..0fdebcc698a6 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts +@@ -251,3 +251,7 @@ + pinctrl-0 = <&uart_ao_a_pins>; + pinctrl-names = "default"; + }; ++ ++&usb0 { ++ status = "okay"; ++}; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi +index 7005068346a0..26de81a24fd5 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi +@@ -185,3 +185,7 @@ + pinctrl-0 = <&uart_ao_a_pins>; + pinctrl-names = "default"; + }; ++ ++&usb0 { ++ status = "okay"; ++}; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +index c8514110b9da..7f542992850f 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +@@ -57,6 +57,67 @@ + no-map; + }; + }; ++ ++ soc { ++ usb0: usb@c9000000 { ++ status = "disabled"; ++ compatible = "amlogic,meson-gxl-dwc3"; ++ #address-cells = <2>; ++ #size-cells = <2>; ++ ranges; ++ ++ clocks = <&clkc CLKID_USB>; ++ clock-names = "usb_general"; ++ resets = <&reset RESET_USB_OTG>; ++ reset-names = "usb_otg"; ++ ++ dwc3: dwc3@c9000000 { ++ compatible = "snps,dwc3"; ++ reg = <0x0 0xc9000000 0x0 0x100000>; ++ interrupts = ; ++ dr_mode = "host"; ++ maximum-speed = "high-speed"; ++ snps,dis_u2_susphy_quirk; ++ phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>; ++ }; ++ }; ++ }; ++}; ++ ++&apb { ++ usb2_phy0: phy@78000 { ++ compatible = "amlogic,meson-gxl-usb2-phy"; ++ #phy-cells = <0>; ++ reg = <0x0 0x78000 0x0 0x20>; ++ clocks = <&clkc CLKID_USB>; ++ clock-names = "phy"; ++ resets = <&reset RESET_USB_OTG>; ++ reset-names = "phy"; ++ status = "okay"; ++ }; ++ ++ usb2_phy1: phy@78020 { ++ compatible = "amlogic,meson-gxl-usb2-phy"; ++ #phy-cells = <0>; ++ reg = <0x0 0x78020 0x0 0x20>; ++ clocks = <&clkc CLKID_USB>; ++ clock-names = "phy"; ++ resets = <&reset RESET_USB_OTG>; ++ reset-names = "phy"; ++ status = "okay"; ++ }; ++ ++ usb3_phy: phy@78080 { ++ compatible = "amlogic,meson-gxl-usb3-phy"; ++ #phy-cells = <0>; ++ reg = <0x0 0x78080 0x0 0x20>; ++ interrupts = ; ++ clocks = <&clkc CLKID_USB>, <&clkc_AO CLKID_AO_CEC_32K>; ++ clock-names = "phy", "peripheral"; ++ resets = <&reset RESET_USB_OTG>, <&reset RESET_USB_OTG>; ++ reset-names = "phy", "peripheral"; ++ status = "okay"; ++ }; + }; + + ðmac { +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +index 1448c3dba08e..572b01ae8de1 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +@@ -413,3 +413,7 @@ + status = "okay"; + vref-supply = <&vddio_ao18>; + }; ++ ++&usb0 { ++ status = "okay"; ++}; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi +index 19a798d2ae2f..fc53ed7afc11 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi +@@ -117,6 +117,19 @@ + }; + }; + ++&apb { ++ usb2_phy2: phy@78040 { ++ compatible = "amlogic,meson-gxl-usb2-phy"; ++ #phy-cells = <0>; ++ reg = <0x0 0x78040 0x0 0x20>; ++ clocks = <&clkc CLKID_USB>; ++ clock-names = "phy"; ++ resets = <&reset RESET_USB_OTG>; ++ reset-names = "phy"; ++ status = "okay"; ++ }; ++}; ++ + &clkc_AO { + compatible = "amlogic,meson-gxm-aoclkc", "amlogic,meson-gx-aoclkc"; + }; +@@ -137,3 +150,7 @@ + &hdmi_tx { + compatible = "amlogic,meson-gxm-dw-hdmi", "amlogic,meson-gx-dw-hdmi"; + }; ++ ++&dwc3 { ++ phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>, <&usb2_phy2>; ++}; +diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi +index 4b5465da81d8..8c68e0c26f1b 100644 +--- a/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi ++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi +@@ -36,11 +36,11 @@ + #size-cells = <1>; + ranges = <0x0 0x0 0x67d00000 0x00800000>; + +- sata0: ahci@210000 { ++ sata0: ahci@0 { + compatible = "brcm,iproc-ahci", "generic-ahci"; +- reg = <0x00210000 0x1000>; ++ reg = <0x00000000 0x1000>; + reg-names = "ahci"; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -52,9 +52,9 @@ + }; + }; + +- sata_phy0: sata_phy@212100 { ++ sata_phy0: sata_phy@2100 { + compatible = "brcm,iproc-sr-sata-phy"; +- reg = <0x00212100 0x1000>; ++ reg = <0x00002100 0x1000>; + reg-names = "phy"; + #address-cells = <1>; + #size-cells = <0>; +@@ -66,11 +66,11 @@ + }; + }; + +- sata1: ahci@310000 { ++ sata1: ahci@10000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; +- reg = <0x00310000 0x1000>; ++ reg = <0x00010000 0x1000>; + reg-names = "ahci"; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -82,9 +82,9 @@ + }; + }; + +- sata_phy1: sata_phy@312100 { ++ sata_phy1: sata_phy@12100 { + compatible = "brcm,iproc-sr-sata-phy"; +- reg = <0x00312100 0x1000>; ++ reg = <0x00012100 0x1000>; + reg-names = "phy"; + #address-cells = <1>; + #size-cells = <0>; +@@ -96,11 +96,11 @@ + }; + }; + +- sata2: ahci@120000 { ++ sata2: ahci@20000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; +- reg = <0x00120000 0x1000>; ++ reg = <0x00020000 0x1000>; + reg-names = "ahci"; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -112,9 +112,9 @@ + }; + }; + +- sata_phy2: sata_phy@122100 { ++ sata_phy2: sata_phy@22100 { + compatible = "brcm,iproc-sr-sata-phy"; +- reg = <0x00122100 0x1000>; ++ reg = <0x00022100 0x1000>; + reg-names = "phy"; + #address-cells = <1>; + #size-cells = <0>; +@@ -126,11 +126,11 @@ + }; + }; + +- sata3: ahci@130000 { ++ sata3: ahci@30000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; +- reg = <0x00130000 0x1000>; ++ reg = <0x00030000 0x1000>; + reg-names = "ahci"; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -142,9 +142,9 @@ + }; + }; + +- sata_phy3: sata_phy@132100 { ++ sata_phy3: sata_phy@32100 { + compatible = "brcm,iproc-sr-sata-phy"; +- reg = <0x00132100 0x1000>; ++ reg = <0x00032100 0x1000>; + reg-names = "phy"; + #address-cells = <1>; + #size-cells = <0>; +@@ -156,11 +156,11 @@ + }; + }; + +- sata4: ahci@330000 { ++ sata4: ahci@100000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; +- reg = <0x00330000 0x1000>; ++ reg = <0x00100000 0x1000>; + reg-names = "ahci"; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -172,9 +172,9 @@ + }; + }; + +- sata_phy4: sata_phy@332100 { ++ sata_phy4: sata_phy@102100 { + compatible = "brcm,iproc-sr-sata-phy"; +- reg = <0x00332100 0x1000>; ++ reg = <0x00102100 0x1000>; + reg-names = "phy"; + #address-cells = <1>; + #size-cells = <0>; +@@ -186,11 +186,11 @@ + }; + }; + +- sata5: ahci@400000 { ++ sata5: ahci@110000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; +- reg = <0x00400000 0x1000>; ++ reg = <0x00110000 0x1000>; + reg-names = "ahci"; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -202,9 +202,9 @@ + }; + }; + +- sata_phy5: sata_phy@402100 { ++ sata_phy5: sata_phy@112100 { + compatible = "brcm,iproc-sr-sata-phy"; +- reg = <0x00402100 0x1000>; ++ reg = <0x00112100 0x1000>; + reg-names = "phy"; + #address-cells = <1>; + #size-cells = <0>; +@@ -216,11 +216,11 @@ + }; + }; + +- sata6: ahci@410000 { ++ sata6: ahci@120000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; +- reg = <0x00410000 0x1000>; ++ reg = <0x00120000 0x1000>; + reg-names = "ahci"; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -232,9 +232,9 @@ + }; + }; + +- sata_phy6: sata_phy@412100 { ++ sata_phy6: sata_phy@122100 { + compatible = "brcm,iproc-sr-sata-phy"; +- reg = <0x00412100 0x1000>; ++ reg = <0x00122100 0x1000>; + reg-names = "phy"; + #address-cells = <1>; + #size-cells = <0>; +@@ -246,11 +246,11 @@ + }; + }; + +- sata7: ahci@420000 { ++ sata7: ahci@130000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; +- reg = <0x00420000 0x1000>; ++ reg = <0x00130000 0x1000>; + reg-names = "ahci"; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -262,9 +262,9 @@ + }; + }; + +- sata_phy7: sata_phy@422100 { ++ sata_phy7: sata_phy@132100 { + compatible = "brcm,iproc-sr-sata-phy"; +- reg = <0x00422100 0x1000>; ++ reg = <0x00132100 0x1000>; + reg-names = "phy"; + #address-cells = <1>; + #size-cells = <0>; +diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi b/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi +index a8baad7b80df..13f57fff1477 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi +@@ -46,7 +46,7 @@ + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <0x0>; + interrupt-parent = <&gpio>; +- interrupts = ; ++ interrupts = ; + }; + }; + }; +diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi +index cd7c2d0a1f64..4939ab25b506 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi ++++ b/arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi +@@ -330,7 +330,7 @@ + mmc-ddr-1_8v; + mmc-hs200-1_8v; + mmc-pwrseq = <&emmc_pwrseq>; +- cdns,phy-input-delay-legacy = <4>; ++ cdns,phy-input-delay-legacy = <9>; + cdns,phy-input-delay-mmc-highspeed = <2>; + cdns,phy-input-delay-mmc-ddr = <3>; + cdns,phy-dll-delay-sdclk = <21>; +diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +index 8a3276ba2da1..ef8b9a4d8910 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi ++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +@@ -435,7 +435,7 @@ + mmc-ddr-1_8v; + mmc-hs200-1_8v; + mmc-pwrseq = <&emmc_pwrseq>; +- cdns,phy-input-delay-legacy = <4>; ++ cdns,phy-input-delay-legacy = <9>; + cdns,phy-input-delay-mmc-highspeed = <2>; + cdns,phy-input-delay-mmc-ddr = <3>; + cdns,phy-dll-delay-sdclk = <21>; +diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +index 234fc58cc599..a1724f7e70fa 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi ++++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +@@ -336,7 +336,7 @@ + mmc-ddr-1_8v; + mmc-hs200-1_8v; + mmc-pwrseq = <&emmc_pwrseq>; +- cdns,phy-input-delay-legacy = <4>; ++ cdns,phy-input-delay-legacy = <9>; + cdns,phy-input-delay-mmc-highspeed = <2>; + cdns,phy-input-delay-mmc-ddr = <3>; + cdns,phy-dll-delay-sdclk = <21>; +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 8e32a6f28f00..be1e2174bb66 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -75,6 +75,7 @@ + #define ARM_CPU_IMP_CAVIUM 0x43 + #define ARM_CPU_IMP_BRCM 0x42 + #define ARM_CPU_IMP_QCOM 0x51 ++#define ARM_CPU_IMP_NVIDIA 0x4E + + #define ARM_CPU_PART_AEM_V8 0xD0F + #define ARM_CPU_PART_FOUNDATION 0xD00 +@@ -98,6 +99,9 @@ + #define QCOM_CPU_PART_FALKOR 0xC00 + #define QCOM_CPU_PART_KRYO 0x200 + ++#define NVIDIA_CPU_PART_DENVER 0x003 ++#define NVIDIA_CPU_PART_CARMEL 0x004 ++ + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) + #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) + #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) +@@ -112,6 +116,8 @@ + #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1) + #define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR) + #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO) ++#define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) ++#define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) + + #ifndef __ASSEMBLY__ + +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index 9ae31f7e2243..b3fb0ccd6010 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -249,15 +250,20 @@ static struct perf_event *ptrace_hbp_get_event(unsigned int note_type, + + switch (note_type) { + case NT_ARM_HW_BREAK: +- if (idx < ARM_MAX_BRP) +- bp = tsk->thread.debug.hbp_break[idx]; ++ if (idx >= ARM_MAX_BRP) ++ goto out; ++ idx = array_index_nospec(idx, ARM_MAX_BRP); ++ bp = tsk->thread.debug.hbp_break[idx]; + break; + case NT_ARM_HW_WATCH: +- if (idx < ARM_MAX_WRP) +- bp = tsk->thread.debug.hbp_watch[idx]; ++ if (idx >= ARM_MAX_WRP) ++ goto out; ++ idx = array_index_nospec(idx, ARM_MAX_WRP); ++ bp = tsk->thread.debug.hbp_watch[idx]; + break; + } + ++out: + return bp; + } + +@@ -1458,9 +1464,7 @@ static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num, + { + int ret; + u32 kdata; +- mm_segment_t old_fs = get_fs(); + +- set_fs(KERNEL_DS); + /* Watchpoint */ + if (num < 0) { + ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata); +@@ -1471,7 +1475,6 @@ static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num, + } else { + ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata); + } +- set_fs(old_fs); + + if (!ret) + ret = put_user(kdata, data); +@@ -1484,7 +1487,6 @@ static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num, + { + int ret; + u32 kdata = 0; +- mm_segment_t old_fs = get_fs(); + + if (num == 0) + return 0; +@@ -1493,12 +1495,10 @@ static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num, + if (ret) + return ret; + +- set_fs(KERNEL_DS); + if (num < 0) + ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata); + else + ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata); +- set_fs(old_fs); + + return ret; + } +diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c +index eb2d15147e8d..e904f4ed49ff 100644 +--- a/arch/arm64/kernel/traps.c ++++ b/arch/arm64/kernel/traps.c +@@ -243,7 +243,8 @@ void arm64_skip_faulting_instruction(struct pt_regs *regs, unsigned long size) + * If we were single stepping, we want to get the step exception after + * we return from the trap. + */ +- user_fastforward_single_step(current); ++ if (user_mode(regs)) ++ user_fastforward_single_step(current); + } + + static LIST_HEAD(undef_hook); +diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c +index dabfc1ecda3d..12145874c02b 100644 +--- a/arch/arm64/mm/kasan_init.c ++++ b/arch/arm64/mm/kasan_init.c +@@ -204,7 +204,7 @@ void __init kasan_init(void) + clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END); + + kasan_map_populate(kimg_shadow_start, kimg_shadow_end, +- pfn_to_nid(virt_to_pfn(lm_alias(_text)))); ++ early_pfn_to_nid(virt_to_pfn(lm_alias(_text)))); + + kasan_populate_zero_shadow((void *)KASAN_SHADOW_START, + (void *)mod_shadow_start); +@@ -224,7 +224,7 @@ void __init kasan_init(void) + + kasan_map_populate((unsigned long)kasan_mem_to_shadow(start), + (unsigned long)kasan_mem_to_shadow(end), +- pfn_to_nid(virt_to_pfn(start))); ++ early_pfn_to_nid(virt_to_pfn(start))); + } + + /* +diff --git a/arch/hexagon/include/asm/io.h b/arch/hexagon/include/asm/io.h +index 9e8621d94ee9..e17262ad125e 100644 +--- a/arch/hexagon/include/asm/io.h ++++ b/arch/hexagon/include/asm/io.h +@@ -216,6 +216,12 @@ static inline void memcpy_toio(volatile void __iomem *dst, const void *src, + memcpy((void *) dst, src, count); + } + ++static inline void memset_io(volatile void __iomem *addr, int value, ++ size_t size) ++{ ++ memset((void __force *)addr, value, size); ++} ++ + #define PCI_IO_ADDR (volatile void __iomem *) + + /* +diff --git a/arch/hexagon/lib/checksum.c b/arch/hexagon/lib/checksum.c +index 617506d1a559..7cd0a2259269 100644 +--- a/arch/hexagon/lib/checksum.c ++++ b/arch/hexagon/lib/checksum.c +@@ -199,3 +199,4 @@ csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum) + memcpy(dst, src, len); + return csum_partial(dst, len, sum); + } ++EXPORT_SYMBOL(csum_partial_copy_nocheck); +diff --git a/arch/mips/boot/dts/img/boston.dts b/arch/mips/boot/dts/img/boston.dts +index 2cd49b60e030..f7aad80c69ab 100644 +--- a/arch/mips/boot/dts/img/boston.dts ++++ b/arch/mips/boot/dts/img/boston.dts +@@ -51,6 +51,8 @@ + ranges = <0x02000000 0 0x40000000 + 0x40000000 0 0x40000000>; + ++ bus-range = <0x00 0xff>; ++ + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pci0_intc 1>, + <0 0 0 2 &pci0_intc 2>, +@@ -79,6 +81,8 @@ + ranges = <0x02000000 0 0x20000000 + 0x20000000 0 0x20000000>; + ++ bus-range = <0x00 0xff>; ++ + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pci1_intc 1>, + <0 0 0 2 &pci1_intc 2>, +@@ -107,6 +111,8 @@ + ranges = <0x02000000 0 0x16000000 + 0x16000000 0 0x100000>; + ++ bus-range = <0x00 0xff>; ++ + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pci2_intc 1>, + <0 0 0 2 &pci2_intc 2>, +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h +index 0cbf3af37eca..a7d0b836f2f7 100644 +--- a/arch/mips/include/asm/io.h ++++ b/arch/mips/include/asm/io.h +@@ -307,7 +307,7 @@ static inline void iounmap(const volatile void __iomem *addr) + #if defined(CONFIG_CPU_CAVIUM_OCTEON) || defined(CONFIG_LOONGSON3_ENHANCEMENT) + #define war_io_reorder_wmb() wmb() + #else +-#define war_io_reorder_wmb() do { } while (0) ++#define war_io_reorder_wmb() barrier() + #endif + + #define __BUILD_MEMORY_SINGLE(pfx, bwlq, type, irq) \ +@@ -377,6 +377,8 @@ static inline type pfx##read##bwlq(const volatile void __iomem *mem) \ + BUG(); \ + } \ + \ ++ /* prevent prefetching of coherent DMA data prematurely */ \ ++ rmb(); \ + return pfx##ioswab##bwlq(__mem, __val); \ + } + +diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c +index d4240aa7f8b1..0f9ccd76a8ea 100644 +--- a/arch/parisc/kernel/drivers.c ++++ b/arch/parisc/kernel/drivers.c +@@ -448,7 +448,8 @@ static int match_by_id(struct device * dev, void * data) + * Checks all the children of @parent for a matching @id. If none + * found, it allocates a new device and returns it. + */ +-static struct parisc_device * alloc_tree_node(struct device *parent, char id) ++static struct parisc_device * __init alloc_tree_node( ++ struct device *parent, char id) + { + struct match_id_data d = { + .id = id, +@@ -825,8 +826,8 @@ void walk_lower_bus(struct parisc_device *dev) + * devices which are not physically connected (such as extra serial & + * keyboard ports). This problem is not yet solved. + */ +-static void walk_native_bus(unsigned long io_io_low, unsigned long io_io_high, +- struct device *parent) ++static void __init walk_native_bus(unsigned long io_io_low, ++ unsigned long io_io_high, struct device *parent) + { + int i, devices_found = 0; + unsigned long hpa = io_io_low; +diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c +index 4065b5e48c9d..5e26dbede5fc 100644 +--- a/arch/parisc/kernel/smp.c ++++ b/arch/parisc/kernel/smp.c +@@ -423,8 +423,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle) + } + + #ifdef CONFIG_PROC_FS +-int __init +-setup_profiling_timer(unsigned int multiplier) ++int setup_profiling_timer(unsigned int multiplier) + { + return -EINVAL; + } +diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c +index f7e684560186..42a873226a04 100644 +--- a/arch/parisc/kernel/time.c ++++ b/arch/parisc/kernel/time.c +@@ -205,7 +205,7 @@ static int __init rtc_init(void) + device_initcall(rtc_init); + #endif + +-void read_persistent_clock(struct timespec *ts) ++void read_persistent_clock64(struct timespec64 *ts) + { + static struct pdc_tod tod_data; + if (pdc_tod_read(&tod_data) == 0) { +diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h +index 9f421641a35c..16b077801a5f 100644 +--- a/arch/powerpc/include/asm/topology.h ++++ b/arch/powerpc/include/asm/topology.h +@@ -91,6 +91,7 @@ extern int start_topology_update(void); + extern int stop_topology_update(void); + extern int prrn_is_enabled(void); + extern int find_and_online_cpu_nid(int cpu); ++extern int timed_topology_update(int nsecs); + #else + static inline int start_topology_update(void) + { +@@ -108,16 +109,12 @@ static inline int find_and_online_cpu_nid(int cpu) + { + return 0; + } ++static inline int timed_topology_update(int nsecs) ++{ ++ return 0; ++} + #endif /* CONFIG_NUMA && CONFIG_PPC_SPLPAR */ + +-#if defined(CONFIG_HOTPLUG_CPU) || defined(CONFIG_NEED_MULTIPLE_NODES) +-#if defined(CONFIG_PPC_SPLPAR) +-extern int timed_topology_update(int nsecs); +-#else +-#define timed_topology_update(nsecs) +-#endif /* CONFIG_PPC_SPLPAR */ +-#endif /* CONFIG_HOTPLUG_CPU || CONFIG_NEED_MULTIPLE_NODES */ +- + #include + + #ifdef CONFIG_SMP +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index c27557aff394..e96b8e1cbd8c 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -864,6 +864,17 @@ static void init_fallback_flush(void) + int cpu; + + l1d_size = ppc64_caches.l1d.size; ++ ++ /* ++ * If there is no d-cache-size property in the device tree, l1d_size ++ * could be zero. That leads to the loop in the asm wrapping around to ++ * 2^64-1, and then walking off the end of the fallback area and ++ * eventually causing a page fault which is fatal. Just default to ++ * something vaguely sane. ++ */ ++ if (!l1d_size) ++ l1d_size = (64 * 1024); ++ + limit = min(ppc64_bolted_size(), ppc64_rma_size); + + /* +diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c +index 6038e2e7aee0..876d4f294fdd 100644 +--- a/arch/powerpc/kvm/booke.c ++++ b/arch/powerpc/kvm/booke.c +@@ -305,6 +305,13 @@ void kvmppc_core_queue_fpunavail(struct kvm_vcpu *vcpu) + kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_FP_UNAVAIL); + } + ++#ifdef CONFIG_ALTIVEC ++void kvmppc_core_queue_vec_unavail(struct kvm_vcpu *vcpu) ++{ ++ kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_ALTIVEC_UNAVAIL); ++} ++#endif ++ + void kvmppc_core_queue_dec(struct kvm_vcpu *vcpu) + { + kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_DECREMENTER); +diff --git a/arch/powerpc/platforms/cell/spufs/sched.c b/arch/powerpc/platforms/cell/spufs/sched.c +index 9033c8194eda..ccc421503363 100644 +--- a/arch/powerpc/platforms/cell/spufs/sched.c ++++ b/arch/powerpc/platforms/cell/spufs/sched.c +@@ -1093,7 +1093,7 @@ static int show_spu_loadavg(struct seq_file *s, void *private) + LOAD_INT(c), LOAD_FRAC(c), + count_active_contexts(), + atomic_read(&nr_spu_contexts), +- idr_get_cursor(&task_active_pid_ns(current)->idr)); ++ idr_get_cursor(&task_active_pid_ns(current)->idr) - 1); + return 0; + } + +diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c +index de470caf0784..fc222a0c2ac4 100644 +--- a/arch/powerpc/platforms/powernv/memtrace.c ++++ b/arch/powerpc/platforms/powernv/memtrace.c +@@ -82,19 +82,6 @@ static const struct file_operations memtrace_fops = { + .open = simple_open, + }; + +-static void flush_memory_region(u64 base, u64 size) +-{ +- unsigned long line_size = ppc64_caches.l1d.size; +- u64 end = base + size; +- u64 addr; +- +- base = round_down(base, line_size); +- end = round_up(end, line_size); +- +- for (addr = base; addr < end; addr += line_size) +- asm volatile("dcbf 0,%0" : "=r" (addr) :: "memory"); +-} +- + static int check_memblock_online(struct memory_block *mem, void *arg) + { + if (mem->state != MEM_ONLINE) +@@ -132,10 +119,6 @@ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages) + walk_memory_range(start_pfn, end_pfn, (void *)MEM_OFFLINE, + change_memblock_state); + +- /* RCU grace period? */ +- flush_memory_region((u64)__va(start_pfn << PAGE_SHIFT), +- nr_pages << PAGE_SHIFT); +- + lock_device_hotplug(); + remove_memory(nid, start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT); + unlock_device_hotplug(); +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index 04807c7f64cc..1225d9add766 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -11,6 +11,7 @@ config RISCV + select ARCH_WANT_FRAME_POINTERS + select CLONE_BACKWARDS + select COMMON_CLK ++ select DMA_DIRECT_OPS + select GENERIC_CLOCKEVENTS + select GENERIC_CPU_DEVICES + select GENERIC_IRQ_SHOW +@@ -88,9 +89,6 @@ config PGTABLE_LEVELS + config HAVE_KPROBES + def_bool n + +-config DMA_DIRECT_OPS +- def_bool y +- + menu "Platform type" + + choice +diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile +index 324568d33921..f6561b783b61 100644 +--- a/arch/riscv/kernel/vdso/Makefile ++++ b/arch/riscv/kernel/vdso/Makefile +@@ -52,7 +52,7 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE + # Add -lgcc so rv32 gets static muldi3 and lshrdi3 definitions. + # Make sure only to export the intended __vdso_xxx symbol offsets. + quiet_cmd_vdsold = VDSOLD $@ +- cmd_vdsold = $(CC) $(KCFLAGS) -nostdlib $(SYSCFLAGS_$(@F)) \ ++ cmd_vdsold = $(CC) $(KCFLAGS) $(call cc-option, -no-pie) -nostdlib $(SYSCFLAGS_$(@F)) \ + -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp -lgcc && \ + $(CROSS_COMPILE)objcopy \ + $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@ +diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig +index 97fe29316476..1851eaeee131 100644 +--- a/arch/sh/Kconfig ++++ b/arch/sh/Kconfig +@@ -9,6 +9,7 @@ config SUPERH + select HAVE_IDE if HAS_IOPORT_MAP + select HAVE_MEMBLOCK + select HAVE_MEMBLOCK_NODE_MAP ++ select NO_BOOTMEM + select ARCH_DISCARD_MEMBLOCK + select HAVE_OPROFILE + select HAVE_GENERIC_DMA_COHERENT +diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c +index 4205f6d42b69..a5bd03642678 100644 +--- a/arch/sh/kernel/cpu/sh2/probe.c ++++ b/arch/sh/kernel/cpu/sh2/probe.c +@@ -43,7 +43,11 @@ void __ref cpu_probe(void) + #endif + + #if defined(CONFIG_CPU_J2) ++#if defined(CONFIG_SMP) + unsigned cpu = hard_smp_processor_id(); ++#else ++ unsigned cpu = 0; ++#endif + if (cpu == 0) of_scan_flat_dt(scan_cache, NULL); + if (j2_ccr_base) __raw_writel(0x80000303, j2_ccr_base + 4*cpu); + if (cpu != 0) return; +diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c +index b95c411d0333..b075b030218a 100644 +--- a/arch/sh/kernel/setup.c ++++ b/arch/sh/kernel/setup.c +@@ -11,7 +11,6 @@ + #include + #include + #include +-#include + #include + #include + #include +diff --git a/arch/sh/mm/init.c b/arch/sh/mm/init.c +index ce0bbaa7e404..4034035fbede 100644 +--- a/arch/sh/mm/init.c ++++ b/arch/sh/mm/init.c +@@ -211,59 +211,15 @@ void __init allocate_pgdat(unsigned int nid) + + NODE_DATA(nid) = __va(phys); + memset(NODE_DATA(nid), 0, sizeof(struct pglist_data)); +- +- NODE_DATA(nid)->bdata = &bootmem_node_data[nid]; + #endif + + NODE_DATA(nid)->node_start_pfn = start_pfn; + NODE_DATA(nid)->node_spanned_pages = end_pfn - start_pfn; + } + +-static void __init bootmem_init_one_node(unsigned int nid) +-{ +- unsigned long total_pages, paddr; +- unsigned long end_pfn; +- struct pglist_data *p; +- +- p = NODE_DATA(nid); +- +- /* Nothing to do.. */ +- if (!p->node_spanned_pages) +- return; +- +- end_pfn = pgdat_end_pfn(p); +- +- total_pages = bootmem_bootmap_pages(p->node_spanned_pages); +- +- paddr = memblock_alloc(total_pages << PAGE_SHIFT, PAGE_SIZE); +- if (!paddr) +- panic("Can't allocate bootmap for nid[%d]\n", nid); +- +- init_bootmem_node(p, paddr >> PAGE_SHIFT, p->node_start_pfn, end_pfn); +- +- free_bootmem_with_active_regions(nid, end_pfn); +- +- /* +- * XXX Handle initial reservations for the system memory node +- * only for the moment, we'll refactor this later for handling +- * reservations in other nodes. +- */ +- if (nid == 0) { +- struct memblock_region *reg; +- +- /* Reserve the sections we're already using. */ +- for_each_memblock(reserved, reg) { +- reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT); +- } +- } +- +- sparse_memory_present_with_active_regions(nid); +-} +- + static void __init do_init_bootmem(void) + { + struct memblock_region *reg; +- int i; + + /* Add active regions with valid PFNs. */ + for_each_memblock(memory, reg) { +@@ -279,9 +235,12 @@ static void __init do_init_bootmem(void) + + plat_mem_setup(); + +- for_each_online_node(i) +- bootmem_init_one_node(i); ++ for_each_memblock(memory, reg) { ++ int nid = memblock_get_region_node(reg); + ++ memory_present(nid, memblock_region_memory_base_pfn(reg), ++ memblock_region_memory_end_pfn(reg)); ++ } + sparse_init(); + } + +@@ -322,7 +281,6 @@ void __init paging_init(void) + { + unsigned long max_zone_pfns[MAX_NR_ZONES]; + unsigned long vaddr, end; +- int nid; + + sh_mv.mv_mem_init(); + +@@ -377,21 +335,7 @@ void __init paging_init(void) + kmap_coherent_init(); + + memset(max_zone_pfns, 0, sizeof(max_zone_pfns)); +- +- for_each_online_node(nid) { +- pg_data_t *pgdat = NODE_DATA(nid); +- unsigned long low, start_pfn; +- +- start_pfn = pgdat->bdata->node_min_pfn; +- low = pgdat->bdata->node_low_pfn; +- +- if (max_zone_pfns[ZONE_NORMAL] < low) +- max_zone_pfns[ZONE_NORMAL] = low; +- +- printk("Node %u: start_pfn = 0x%lx, low = 0x%lx\n", +- nid, start_pfn, low); +- } +- ++ max_zone_pfns[ZONE_NORMAL] = max_low_pfn; + free_area_init_nodes(max_zone_pfns); + } + +diff --git a/arch/sh/mm/numa.c b/arch/sh/mm/numa.c +index 05713d190247..830e8b3684e4 100644 +--- a/arch/sh/mm/numa.c ++++ b/arch/sh/mm/numa.c +@@ -8,7 +8,6 @@ + * for more details. + */ + #include +-#include + #include + #include + #include +@@ -26,9 +25,7 @@ EXPORT_SYMBOL_GPL(node_data); + */ + void __init setup_bootmem_node(int nid, unsigned long start, unsigned long end) + { +- unsigned long bootmap_pages; + unsigned long start_pfn, end_pfn; +- unsigned long bootmem_paddr; + + /* Don't allow bogus node assignment */ + BUG_ON(nid >= MAX_NUMNODES || nid <= 0); +@@ -48,25 +45,9 @@ void __init setup_bootmem_node(int nid, unsigned long start, unsigned long end) + SMP_CACHE_BYTES, end)); + memset(NODE_DATA(nid), 0, sizeof(struct pglist_data)); + +- NODE_DATA(nid)->bdata = &bootmem_node_data[nid]; + NODE_DATA(nid)->node_start_pfn = start_pfn; + NODE_DATA(nid)->node_spanned_pages = end_pfn - start_pfn; + +- /* Node-local bootmap */ +- bootmap_pages = bootmem_bootmap_pages(end_pfn - start_pfn); +- bootmem_paddr = memblock_alloc_base(bootmap_pages << PAGE_SHIFT, +- PAGE_SIZE, end); +- init_bootmem_node(NODE_DATA(nid), bootmem_paddr >> PAGE_SHIFT, +- start_pfn, end_pfn); +- +- free_bootmem_with_active_regions(nid, end_pfn); +- +- /* Reserve the pgdat and bootmap space with the bootmem allocator */ +- reserve_bootmem_node(NODE_DATA(nid), start_pfn << PAGE_SHIFT, +- sizeof(struct pglist_data), BOOTMEM_DEFAULT); +- reserve_bootmem_node(NODE_DATA(nid), bootmem_paddr, +- bootmap_pages << PAGE_SHIFT, BOOTMEM_DEFAULT); +- + /* It's up */ + node_set_online(nid); + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 39cd0b36c790..9296b41ac342 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3331,7 +3331,8 @@ static void intel_pmu_cpu_starting(int cpu) + + cpuc->lbr_sel = NULL; + +- flip_smm_bit(&x86_pmu.attr_freeze_on_smi); ++ if (x86_pmu.version > 1) ++ flip_smm_bit(&x86_pmu.attr_freeze_on_smi); + + if (!cpuc->shared_regs) + return; +@@ -3494,6 +3495,8 @@ static __initconst const struct x86_pmu core_pmu = { + .cpu_dying = intel_pmu_cpu_dying, + }; + ++static struct attribute *intel_pmu_attrs[]; ++ + static __initconst const struct x86_pmu intel_pmu = { + .name = "Intel", + .handle_irq = intel_pmu_handle_irq, +@@ -3524,6 +3527,8 @@ static __initconst const struct x86_pmu intel_pmu = { + .format_attrs = intel_arch3_formats_attr, + .events_sysfs_show = intel_event_sysfs_show, + ++ .attrs = intel_pmu_attrs, ++ + .cpu_prepare = intel_pmu_cpu_prepare, + .cpu_starting = intel_pmu_cpu_starting, + .cpu_dying = intel_pmu_cpu_dying, +@@ -3902,8 +3907,6 @@ __init int intel_pmu_init(void) + + x86_pmu.max_pebs_events = min_t(unsigned, MAX_PEBS_EVENTS, x86_pmu.num_counters); + +- +- x86_pmu.attrs = intel_pmu_attrs; + /* + * Quirk: v2 perfmon does not report fixed-purpose events, so + * assume at least 3 events, when not running in a hypervisor: +diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h +index b3e32b010ab1..c2c01f84df75 100644 +--- a/arch/x86/include/asm/insn.h ++++ b/arch/x86/include/asm/insn.h +@@ -208,4 +208,22 @@ static inline int insn_offset_immediate(struct insn *insn) + return insn_offset_displacement(insn) + insn->displacement.nbytes; + } + ++#define POP_SS_OPCODE 0x1f ++#define MOV_SREG_OPCODE 0x8e ++ ++/* ++ * Intel SDM Vol.3A 6.8.3 states; ++ * "Any single-step trap that would be delivered following the MOV to SS ++ * instruction or POP to SS instruction (because EFLAGS.TF is 1) is ++ * suppressed." ++ * This function returns true if @insn is MOV SS or POP SS. On these ++ * instructions, single stepping is suppressed. ++ */ ++static inline int insn_masking_exception(struct insn *insn) ++{ ++ return insn->opcode.bytes[0] == POP_SS_OPCODE || ++ (insn->opcode.bytes[0] == MOV_SREG_OPCODE && ++ X86_MODRM_REG(insn->modrm.bytes[0]) == 2); ++} ++ + #endif /* _ASM_X86_INSN_H */ +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 4b0539a52c4c..e2201c9c3f20 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -1019,6 +1019,7 @@ struct kvm_x86_ops { + + bool (*has_wbinvd_exit)(void); + ++ u64 (*read_l1_tsc_offset)(struct kvm_vcpu *vcpu); + void (*write_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset); + + void (*get_exit_info)(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2); +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index c895f38a7a5e..0b2330e19169 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -751,6 +751,9 @@ static const struct _tlb_table intel_tlb_table[] = { + { 0x5d, TLB_DATA_4K_4M, 256, " TLB_DATA 4 KByte and 4 MByte pages" }, + { 0x61, TLB_INST_4K, 48, " TLB_INST 4 KByte pages, full associative" }, + { 0x63, TLB_DATA_1G, 4, " TLB_DATA 1 GByte pages, 4-way set associative" }, ++ { 0x6b, TLB_DATA_4K, 256, " TLB_DATA 4 KByte pages, 8-way associative" }, ++ { 0x6c, TLB_DATA_2M_4M, 128, " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" }, ++ { 0x6d, TLB_DATA_1G, 16, " TLB_DATA 1 GByte pages, fully associative" }, + { 0x76, TLB_INST_2M_4M, 8, " TLB_INST 2-MByte or 4-MByte pages, fully associative" }, + { 0xb0, TLB_INST_4K, 128, " TLB_INST 4 KByte pages, 4-way set associative" }, + { 0xb1, TLB_INST_2M_4M, 4, " TLB_INST 2M pages, 4-way, 8 entries or 4M pages, 4-way entries" }, +diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c +index fb095ba0c02f..f24cd9f1799a 100644 +--- a/arch/x86/kernel/kexec-bzimage64.c ++++ b/arch/x86/kernel/kexec-bzimage64.c +@@ -398,11 +398,10 @@ static void *bzImage64_load(struct kimage *image, char *kernel, + * little bit simple + */ + efi_map_sz = efi_get_runtime_map_size(); +- efi_map_sz = ALIGN(efi_map_sz, 16); + params_cmdline_sz = sizeof(struct boot_params) + cmdline_len + + MAX_ELFCOREHDR_STR_LEN; + params_cmdline_sz = ALIGN(params_cmdline_sz, 16); +- kbuf.bufsz = params_cmdline_sz + efi_map_sz + ++ kbuf.bufsz = params_cmdline_sz + ALIGN(efi_map_sz, 16) + + sizeof(struct setup_data) + + sizeof(struct efi_setup_data); + +@@ -410,7 +409,7 @@ static void *bzImage64_load(struct kimage *image, char *kernel, + if (!params) + return ERR_PTR(-ENOMEM); + efi_map_offset = params_cmdline_sz; +- efi_setup_data_offset = efi_map_offset + efi_map_sz; ++ efi_setup_data_offset = efi_map_offset + ALIGN(efi_map_sz, 16); + + /* Copy setup header onto bootparams. Documentation/x86/boot.txt */ + setup_header_size = 0x0202 + kernel[0x0201] - setup_hdr_offset; +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 0715f827607c..6f4d42377fe5 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -370,6 +370,10 @@ int __copy_instruction(u8 *dest, u8 *src, u8 *real, struct insn *insn) + if (insn->opcode.bytes[0] == BREAKPOINT_INSTRUCTION) + return 0; + ++ /* We should not singlestep on the exception masking instructions */ ++ if (insn_masking_exception(insn)) ++ return 0; ++ + #ifdef CONFIG_X86_64 + /* Only x86_64 has RIP relative instructions */ + if (insn_rip_relative(insn)) { +diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c +index 85c7ef23d99f..c84bb5396958 100644 +--- a/arch/x86/kernel/uprobes.c ++++ b/arch/x86/kernel/uprobes.c +@@ -299,6 +299,10 @@ static int uprobe_init_insn(struct arch_uprobe *auprobe, struct insn *insn, bool + if (is_prefix_bad(insn)) + return -ENOTSUPP; + ++ /* We should not singlestep on the exception masking instructions */ ++ if (insn_masking_exception(insn)) ++ return -ENOTSUPP; ++ + if (x86_64) + good_insns = good_insns_64; + else +diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c +index dc97f2544b6f..5d13abecb384 100644 +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -1223,7 +1223,7 @@ static int kvm_hv_hypercall_complete_userspace(struct kvm_vcpu *vcpu) + struct kvm_run *run = vcpu->run; + + kvm_hv_hypercall_set_result(vcpu, run->hyperv.u.hcall.result); +- return 1; ++ return kvm_skip_emulated_instruction(vcpu); + } + + int kvm_hv_hypercall(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index dbbd762359a9..569aa55d0aba 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -1313,12 +1313,23 @@ static void init_sys_seg(struct vmcb_seg *seg, uint32_t type) + seg->base = 0; + } + ++static u64 svm_read_l1_tsc_offset(struct kvm_vcpu *vcpu) ++{ ++ struct vcpu_svm *svm = to_svm(vcpu); ++ ++ if (is_guest_mode(vcpu)) ++ return svm->nested.hsave->control.tsc_offset; ++ ++ return vcpu->arch.tsc_offset; ++} ++ + static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset) + { + struct vcpu_svm *svm = to_svm(vcpu); + u64 g_tsc_offset = 0; + + if (is_guest_mode(vcpu)) { ++ /* Write L1's TSC offset. */ + g_tsc_offset = svm->vmcb->control.tsc_offset - + svm->nested.hsave->control.tsc_offset; + svm->nested.hsave->control.tsc_offset = offset; +@@ -3188,6 +3199,7 @@ static int nested_svm_vmexit(struct vcpu_svm *svm) + /* Restore the original control entries */ + copy_vmcb_control_area(vmcb, hsave); + ++ svm->vcpu.arch.tsc_offset = svm->vmcb->control.tsc_offset; + kvm_clear_exception_queue(&svm->vcpu); + kvm_clear_interrupt_queue(&svm->vcpu); + +@@ -3348,10 +3360,12 @@ static void enter_svm_guest_mode(struct vcpu_svm *svm, u64 vmcb_gpa, + /* We don't want to see VMMCALLs from a nested guest */ + clr_intercept(svm, INTERCEPT_VMMCALL); + ++ svm->vcpu.arch.tsc_offset += nested_vmcb->control.tsc_offset; ++ svm->vmcb->control.tsc_offset = svm->vcpu.arch.tsc_offset; ++ + svm->vmcb->control.virt_ext = nested_vmcb->control.virt_ext; + svm->vmcb->control.int_vector = nested_vmcb->control.int_vector; + svm->vmcb->control.int_state = nested_vmcb->control.int_state; +- svm->vmcb->control.tsc_offset += nested_vmcb->control.tsc_offset; + svm->vmcb->control.event_inj = nested_vmcb->control.event_inj; + svm->vmcb->control.event_inj_err = nested_vmcb->control.event_inj_err; + +@@ -3901,12 +3915,6 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + struct vcpu_svm *svm = to_svm(vcpu); + + switch (msr_info->index) { +- case MSR_IA32_TSC: { +- msr_info->data = svm->vmcb->control.tsc_offset + +- kvm_scale_tsc(vcpu, rdtsc()); +- +- break; +- } + case MSR_STAR: + msr_info->data = svm->vmcb->save.star; + break; +@@ -4066,9 +4074,6 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) + svm->vmcb->save.g_pat = data; + mark_dirty(svm->vmcb, VMCB_NPT); + break; +- case MSR_IA32_TSC: +- kvm_write_tsc(vcpu, msr); +- break; + case MSR_IA32_SPEC_CTRL: + if (!msr->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS)) +@@ -5142,9 +5147,8 @@ static int svm_update_pi_irte(struct kvm *kvm, unsigned int host_irq, + } + + if (!ret && svm) { +- trace_kvm_pi_irte_update(svm->vcpu.vcpu_id, +- host_irq, e->gsi, +- vcpu_info.vector, ++ trace_kvm_pi_irte_update(host_irq, svm->vcpu.vcpu_id, ++ e->gsi, vcpu_info.vector, + vcpu_info.pi_desc_addr, set); + } + +@@ -6967,6 +6971,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { + + .has_wbinvd_exit = svm_has_wbinvd_exit, + ++ .read_l1_tsc_offset = svm_read_l1_tsc_offset, + .write_tsc_offset = svm_write_tsc_offset, + + .set_tdp_cr3 = set_tdp_cr3, +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index e3b589e28264..c779f0970126 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2638,18 +2638,15 @@ static void setup_msrs(struct vcpu_vmx *vmx) + vmx_update_msr_bitmap(&vmx->vcpu); + } + +-/* +- * reads and returns guest's timestamp counter "register" +- * guest_tsc = (host_tsc * tsc multiplier) >> 48 + tsc_offset +- * -- Intel TSC Scaling for Virtualization White Paper, sec 1.3 +- */ +-static u64 guest_read_tsc(struct kvm_vcpu *vcpu) ++static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu) + { +- u64 host_tsc, tsc_offset; ++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu); + +- host_tsc = rdtsc(); +- tsc_offset = vmcs_read64(TSC_OFFSET); +- return kvm_scale_tsc(vcpu, host_tsc) + tsc_offset; ++ if (is_guest_mode(vcpu) && ++ (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)) ++ return vcpu->arch.tsc_offset - vmcs12->tsc_offset; ++ ++ return vcpu->arch.tsc_offset; + } + + /* +@@ -3272,9 +3269,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + #endif + case MSR_EFER: + return kvm_get_msr_common(vcpu, msr_info); +- case MSR_IA32_TSC: +- msr_info->data = guest_read_tsc(vcpu); +- break; + case MSR_IA32_SPEC_CTRL: + if (!msr_info->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) +@@ -3392,9 +3386,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + return 1; + vmcs_write64(GUEST_BNDCFGS, data); + break; +- case MSR_IA32_TSC: +- kvm_write_tsc(vcpu, msr_info); +- break; + case MSR_IA32_SPEC_CTRL: + if (!msr_info->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) +@@ -4281,12 +4272,6 @@ static void vmx_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa) + __vmx_flush_tlb(vcpu, to_vmx(vcpu)->vpid, invalidate_gpa); + } + +-static void vmx_flush_tlb_ept_only(struct kvm_vcpu *vcpu) +-{ +- if (enable_ept) +- vmx_flush_tlb(vcpu, true); +-} +- + static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu) + { + ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits; +@@ -9039,7 +9024,7 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set) + } else { + sec_exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE; + sec_exec_control |= SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES; +- vmx_flush_tlb_ept_only(vcpu); ++ vmx_flush_tlb(vcpu, true); + } + vmcs_write32(SECONDARY_VM_EXEC_CONTROL, sec_exec_control); + +@@ -9067,7 +9052,7 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa) + !nested_cpu_has2(get_vmcs12(&vmx->vcpu), + SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) { + vmcs_write64(APIC_ACCESS_ADDR, hpa); +- vmx_flush_tlb_ept_only(vcpu); ++ vmx_flush_tlb(vcpu, true); + } + } + +@@ -10338,6 +10323,16 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, + return true; + } + ++static int nested_vmx_check_apic_access_controls(struct kvm_vcpu *vcpu, ++ struct vmcs12 *vmcs12) ++{ ++ if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES) && ++ !page_address_valid(vcpu, vmcs12->apic_access_addr)) ++ return -EINVAL; ++ else ++ return 0; ++} ++ + static int nested_vmx_check_apicv_controls(struct kvm_vcpu *vcpu, + struct vmcs12 *vmcs12) + { +@@ -10906,11 +10901,8 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12, + vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat); + } + +- if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING) +- vmcs_write64(TSC_OFFSET, +- vcpu->arch.tsc_offset + vmcs12->tsc_offset); +- else +- vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset); ++ vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset); ++ + if (kvm_has_tsc_control) + decache_tsc_multiplier(vmx); + +@@ -10952,7 +10944,7 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12, + } + } else if (nested_cpu_has2(vmcs12, + SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) { +- vmx_flush_tlb_ept_only(vcpu); ++ vmx_flush_tlb(vcpu, true); + } + + /* +@@ -11006,6 +10998,9 @@ static int check_vmentry_prereqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) + if (nested_vmx_check_msr_bitmap_controls(vcpu, vmcs12)) + return VMXERR_ENTRY_INVALID_CONTROL_FIELD; + ++ if (nested_vmx_check_apic_access_controls(vcpu, vmcs12)) ++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD; ++ + if (nested_vmx_check_tpr_shadow_controls(vcpu, vmcs12)) + return VMXERR_ENTRY_INVALID_CONTROL_FIELD; + +@@ -11124,6 +11119,7 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry) + struct vmcs12 *vmcs12 = get_vmcs12(vcpu); + u32 msr_entry_idx; + u32 exit_qual; ++ int r; + + enter_guest_mode(vcpu); + +@@ -11133,26 +11129,21 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry) + vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02); + vmx_segment_cache_clear(vmx); + +- if (prepare_vmcs02(vcpu, vmcs12, from_vmentry, &exit_qual)) { +- leave_guest_mode(vcpu); +- vmx_switch_vmcs(vcpu, &vmx->vmcs01); +- nested_vmx_entry_failure(vcpu, vmcs12, +- EXIT_REASON_INVALID_STATE, exit_qual); +- return 1; +- } ++ if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING) ++ vcpu->arch.tsc_offset += vmcs12->tsc_offset; ++ ++ r = EXIT_REASON_INVALID_STATE; ++ if (prepare_vmcs02(vcpu, vmcs12, from_vmentry, &exit_qual)) ++ goto fail; + + nested_get_vmcs12_pages(vcpu, vmcs12); + ++ r = EXIT_REASON_MSR_LOAD_FAIL; + msr_entry_idx = nested_vmx_load_msr(vcpu, + vmcs12->vm_entry_msr_load_addr, + vmcs12->vm_entry_msr_load_count); +- if (msr_entry_idx) { +- leave_guest_mode(vcpu); +- vmx_switch_vmcs(vcpu, &vmx->vmcs01); +- nested_vmx_entry_failure(vcpu, vmcs12, +- EXIT_REASON_MSR_LOAD_FAIL, msr_entry_idx); +- return 1; +- } ++ if (msr_entry_idx) ++ goto fail; + + /* + * Note no nested_vmx_succeed or nested_vmx_fail here. At this point +@@ -11161,6 +11152,14 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry) + * the success flag) when L2 exits (see nested_vmx_vmexit()). + */ + return 0; ++ ++fail: ++ if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING) ++ vcpu->arch.tsc_offset -= vmcs12->tsc_offset; ++ leave_guest_mode(vcpu); ++ vmx_switch_vmcs(vcpu, &vmx->vmcs01); ++ nested_vmx_entry_failure(vcpu, vmcs12, r, exit_qual); ++ return 1; + } + + /* +@@ -11732,6 +11731,9 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, + + leave_guest_mode(vcpu); + ++ if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING) ++ vcpu->arch.tsc_offset -= vmcs12->tsc_offset; ++ + if (likely(!vmx->fail)) { + if (exit_reason == -1) + sync_vmcs12(vcpu, vmcs12); +@@ -11769,7 +11771,7 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, + } else if (!nested_cpu_has_ept(vmcs12) && + nested_cpu_has2(vmcs12, + SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) { +- vmx_flush_tlb_ept_only(vcpu); ++ vmx_flush_tlb(vcpu, true); + } + + /* This is needed for same reason as it was needed in prepare_vmcs02 */ +@@ -12237,7 +12239,7 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq, + vcpu_info.pi_desc_addr = __pa(vcpu_to_pi_desc(vcpu)); + vcpu_info.vector = irq.vector; + +- trace_kvm_pi_irte_update(vcpu->vcpu_id, host_irq, e->gsi, ++ trace_kvm_pi_irte_update(host_irq, vcpu->vcpu_id, e->gsi, + vcpu_info.vector, vcpu_info.pi_desc_addr, set); + + if (set) +@@ -12410,6 +12412,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = { + + .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit, + ++ .read_l1_tsc_offset = vmx_read_l1_tsc_offset, + .write_tsc_offset = vmx_write_tsc_offset, + + .set_tdp_cr3 = vmx_set_cr3, +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index cf08ac8a910c..f3a1f9f3fb29 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -112,7 +112,7 @@ module_param(ignore_msrs, bool, S_IRUGO | S_IWUSR); + static bool __read_mostly report_ignored_msrs = true; + module_param(report_ignored_msrs, bool, S_IRUGO | S_IWUSR); + +-unsigned int min_timer_period_us = 500; ++unsigned int min_timer_period_us = 200; + module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR); + + static bool __read_mostly kvmclock_periodic_sync = true; +@@ -1459,7 +1459,7 @@ static void kvm_track_tsc_matching(struct kvm_vcpu *vcpu) + + static void update_ia32_tsc_adjust_msr(struct kvm_vcpu *vcpu, s64 offset) + { +- u64 curr_offset = vcpu->arch.tsc_offset; ++ u64 curr_offset = kvm_x86_ops->read_l1_tsc_offset(vcpu); + vcpu->arch.ia32_tsc_adjust_msr += offset - curr_offset; + } + +@@ -1501,7 +1501,9 @@ static u64 kvm_compute_tsc_offset(struct kvm_vcpu *vcpu, u64 target_tsc) + + u64 kvm_read_l1_tsc(struct kvm_vcpu *vcpu, u64 host_tsc) + { +- return vcpu->arch.tsc_offset + kvm_scale_tsc(vcpu, host_tsc); ++ u64 tsc_offset = kvm_x86_ops->read_l1_tsc_offset(vcpu); ++ ++ return tsc_offset + kvm_scale_tsc(vcpu, host_tsc); + } + EXPORT_SYMBOL_GPL(kvm_read_l1_tsc); + +@@ -2331,6 +2333,9 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + return 1; + vcpu->arch.smbase = data; + break; ++ case MSR_IA32_TSC: ++ kvm_write_tsc(vcpu, msr_info); ++ break; + case MSR_SMI_COUNT: + if (!msr_info->host_initiated) + return 1; +@@ -2570,6 +2575,9 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + case MSR_IA32_UCODE_REV: + msr_info->data = vcpu->arch.microcode_version; + break; ++ case MSR_IA32_TSC: ++ msr_info->data = kvm_scale_tsc(vcpu, rdtsc()) + vcpu->arch.tsc_offset; ++ break; + case MSR_MTRRcap: + case 0x200 ... 0x2ff: + return kvm_mtrr_get_msr(vcpu, msr_info->index, &msr_info->data); +@@ -6545,12 +6553,13 @@ void kvm_vcpu_deactivate_apicv(struct kvm_vcpu *vcpu) + int kvm_emulate_hypercall(struct kvm_vcpu *vcpu) + { + unsigned long nr, a0, a1, a2, a3, ret; +- int op_64_bit, r; +- +- r = kvm_skip_emulated_instruction(vcpu); ++ int op_64_bit; + +- if (kvm_hv_hypercall_enabled(vcpu->kvm)) +- return kvm_hv_hypercall(vcpu); ++ if (kvm_hv_hypercall_enabled(vcpu->kvm)) { ++ if (!kvm_hv_hypercall(vcpu)) ++ return 0; ++ goto out; ++ } + + nr = kvm_register_read(vcpu, VCPU_REGS_RAX); + a0 = kvm_register_read(vcpu, VCPU_REGS_RBX); +@@ -6571,7 +6580,7 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu) + + if (kvm_x86_ops->get_cpl(vcpu) != 0) { + ret = -KVM_EPERM; +- goto out; ++ goto out_error; + } + + switch (nr) { +@@ -6591,12 +6600,14 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu) + ret = -KVM_ENOSYS; + break; + } +-out: ++out_error: + if (!op_64_bit) + ret = (u32)ret; + kvm_register_write(vcpu, VCPU_REGS_RAX, ret); ++ ++out: + ++vcpu->stat.hypercalls; +- return r; ++ return kvm_skip_emulated_instruction(vcpu); + } + EXPORT_SYMBOL_GPL(kvm_emulate_hypercall); + +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index ce5b2ebd5701..6609cb6c91af 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -992,7 +992,17 @@ xadd: if (is_imm8(insn->off)) + break; + + case BPF_JMP | BPF_JA: +- jmp_offset = addrs[i + insn->off] - addrs[i]; ++ if (insn->off == -1) ++ /* -1 jmp instructions will always jump ++ * backwards two bytes. Explicitly handling ++ * this case avoids wasting too many passes ++ * when there are long sequences of replaced ++ * dead code. ++ */ ++ jmp_offset = -2; ++ else ++ jmp_offset = addrs[i + insn->off] - addrs[i]; ++ + if (!jmp_offset) + /* optimize out nop jumps */ + break; +@@ -1191,6 +1201,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + for (pass = 0; pass < 20 || image; pass++) { + proglen = do_jit(prog, addrs, image, oldproglen, &ctx); + if (proglen <= 0) { ++out_image: + image = NULL; + if (header) + bpf_jit_binary_free(header); +@@ -1201,8 +1212,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + if (proglen != oldproglen) { + pr_err("bpf_jit: proglen=%d != oldproglen=%d\n", + proglen, oldproglen); +- prog = orig_prog; +- goto out_addrs; ++ goto out_image; + } + break; + } +@@ -1239,7 +1249,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + prog = orig_prog; + } + +- if (!prog->is_func || extra_pass) { ++ if (!image || !prog->is_func || extra_pass) { + out_addrs: + kfree(addrs); + kfree(jit_data); +diff --git a/arch/x86/xen/enlighten_hvm.c b/arch/x86/xen/enlighten_hvm.c +index 826898701045..19c1ff542387 100644 +--- a/arch/x86/xen/enlighten_hvm.c ++++ b/arch/x86/xen/enlighten_hvm.c +@@ -65,6 +65,19 @@ static void __init xen_hvm_init_mem_mapping(void) + { + early_memunmap(HYPERVISOR_shared_info, PAGE_SIZE); + HYPERVISOR_shared_info = __va(PFN_PHYS(shared_info_pfn)); ++ ++ /* ++ * The virtual address of the shared_info page has changed, so ++ * the vcpu_info pointer for VCPU 0 is now stale. ++ * ++ * The prepare_boot_cpu callback will re-initialize it via ++ * xen_vcpu_setup, but we can't rely on that to be called for ++ * old Xen versions (xen_have_vector_callback == 0). ++ * ++ * It is, in any case, bad to have a stale vcpu_info pointer ++ * so reset it now. ++ */ ++ xen_vcpu_info_reset(0); + } + + static void __init init_hvm_pv_info(void) +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index c2033a232a44..58d030517b0f 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -1142,18 +1142,16 @@ int blkcg_init_queue(struct request_queue *q) + rcu_read_lock(); + spin_lock_irq(q->queue_lock); + blkg = blkg_create(&blkcg_root, q, new_blkg); ++ if (IS_ERR(blkg)) ++ goto err_unlock; ++ q->root_blkg = blkg; ++ q->root_rl.blkg = blkg; + spin_unlock_irq(q->queue_lock); + rcu_read_unlock(); + + if (preloaded) + radix_tree_preload_end(); + +- if (IS_ERR(blkg)) +- return PTR_ERR(blkg); +- +- q->root_blkg = blkg; +- q->root_rl.blkg = blkg; +- + ret = blk_throtl_init(q); + if (ret) { + spin_lock_irq(q->queue_lock); +@@ -1161,6 +1159,13 @@ int blkcg_init_queue(struct request_queue *q) + spin_unlock_irq(q->queue_lock); + } + return ret; ++ ++err_unlock: ++ spin_unlock_irq(q->queue_lock); ++ rcu_read_unlock(); ++ if (preloaded) ++ radix_tree_preload_end(); ++ return PTR_ERR(blkg); + } + + /** +@@ -1367,17 +1372,12 @@ void blkcg_deactivate_policy(struct request_queue *q, + __clear_bit(pol->plid, q->blkcg_pols); + + list_for_each_entry(blkg, &q->blkg_list, q_node) { +- /* grab blkcg lock too while removing @pd from @blkg */ +- spin_lock(&blkg->blkcg->lock); +- + if (blkg->pd[pol->plid]) { + if (pol->pd_offline_fn) + pol->pd_offline_fn(blkg->pd[pol->plid]); + pol->pd_free_fn(blkg->pd[pol->plid]); + blkg->pd[pol->plid] = NULL; + } +- +- spin_unlock(&blkg->blkcg->lock); + } + + spin_unlock_irq(q->queue_lock); +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 96de7aa4f62a..00e16588b169 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -118,6 +118,25 @@ void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part, + blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight, &mi); + } + ++static void blk_mq_check_inflight_rw(struct blk_mq_hw_ctx *hctx, ++ struct request *rq, void *priv, ++ bool reserved) ++{ ++ struct mq_inflight *mi = priv; ++ ++ if (rq->part == mi->part) ++ mi->inflight[rq_data_dir(rq)]++; ++} ++ ++void blk_mq_in_flight_rw(struct request_queue *q, struct hd_struct *part, ++ unsigned int inflight[2]) ++{ ++ struct mq_inflight mi = { .part = part, .inflight = inflight, }; ++ ++ inflight[0] = inflight[1] = 0; ++ blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight_rw, &mi); ++} ++ + void blk_freeze_queue_start(struct request_queue *q) + { + int freeze_depth; +diff --git a/block/blk-mq.h b/block/blk-mq.h +index 88c558f71819..ecc86b6efdec 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -185,7 +185,9 @@ static inline bool blk_mq_hw_queue_mapped(struct blk_mq_hw_ctx *hctx) + } + + void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part, +- unsigned int inflight[2]); ++ unsigned int inflight[2]); ++void blk_mq_in_flight_rw(struct request_queue *q, struct hd_struct *part, ++ unsigned int inflight[2]); + + static inline void blk_mq_put_dispatch_budget(struct blk_mq_hw_ctx *hctx) + { +diff --git a/block/genhd.c b/block/genhd.c +index 9656f9e9f99e..8f34897159f5 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -82,6 +82,18 @@ void part_in_flight(struct request_queue *q, struct hd_struct *part, + } + } + ++void part_in_flight_rw(struct request_queue *q, struct hd_struct *part, ++ unsigned int inflight[2]) ++{ ++ if (q->mq_ops) { ++ blk_mq_in_flight_rw(q, part, inflight); ++ return; ++ } ++ ++ inflight[0] = atomic_read(&part->in_flight[0]); ++ inflight[1] = atomic_read(&part->in_flight[1]); ++} ++ + struct hd_struct *__disk_get_part(struct gendisk *disk, int partno) + { + struct disk_part_tbl *ptbl = rcu_dereference(disk->part_tbl); +diff --git a/block/partition-generic.c b/block/partition-generic.c +index 08dabcd8b6ae..db57cced9b98 100644 +--- a/block/partition-generic.c ++++ b/block/partition-generic.c +@@ -145,13 +145,15 @@ ssize_t part_stat_show(struct device *dev, + jiffies_to_msecs(part_stat_read(p, time_in_queue))); + } + +-ssize_t part_inflight_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++ssize_t part_inflight_show(struct device *dev, struct device_attribute *attr, ++ char *buf) + { + struct hd_struct *p = dev_to_part(dev); ++ struct request_queue *q = part_to_disk(p)->queue; ++ unsigned int inflight[2]; + +- return sprintf(buf, "%8u %8u\n", atomic_read(&p->in_flight[0]), +- atomic_read(&p->in_flight[1])); ++ part_in_flight_rw(q, p, inflight); ++ return sprintf(buf, "%8u %8u\n", inflight[0], inflight[1]); + } + + #ifdef CONFIG_FAIL_MAKE_REQUEST +diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c +index ebb626ffb5fa..4bde16fb97d8 100644 +--- a/drivers/acpi/acpi_watchdog.c ++++ b/drivers/acpi/acpi_watchdog.c +@@ -12,23 +12,64 @@ + #define pr_fmt(fmt) "ACPI: watchdog: " fmt + + #include ++#include + #include + #include + + #include "internal.h" + ++static const struct dmi_system_id acpi_watchdog_skip[] = { ++ { ++ /* ++ * On Lenovo Z50-70 there are two issues with the WDAT ++ * table. First some of the instructions use RTC SRAM ++ * to store persistent information. This does not work well ++ * with Linux RTC driver. Second, more important thing is ++ * that the instructions do not actually reset the system. ++ * ++ * On this particular system iTCO_wdt seems to work just ++ * fine so we prefer that over WDAT for now. ++ * ++ * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033. ++ */ ++ .ident = "Lenovo Z50-70", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "20354"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Z50-70"), ++ }, ++ }, ++ {} ++}; ++ ++static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void) ++{ ++ const struct acpi_table_wdat *wdat = NULL; ++ acpi_status status; ++ ++ if (acpi_disabled) ++ return NULL; ++ ++ if (dmi_check_system(acpi_watchdog_skip)) ++ return NULL; ++ ++ status = acpi_get_table(ACPI_SIG_WDAT, 0, ++ (struct acpi_table_header **)&wdat); ++ if (ACPI_FAILURE(status)) { ++ /* It is fine if there is no WDAT */ ++ return NULL; ++ } ++ ++ return wdat; ++} ++ + /** + * Returns true if this system should prefer ACPI based watchdog instead of + * the native one (which are typically the same hardware). + */ + bool acpi_has_watchdog(void) + { +- struct acpi_table_header hdr; +- +- if (acpi_disabled) +- return false; +- +- return ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_WDAT, 0, &hdr)); ++ return !!acpi_watchdog_get_wdat(); + } + EXPORT_SYMBOL_GPL(acpi_has_watchdog); + +@@ -41,12 +82,10 @@ void __init acpi_watchdog_init(void) + struct platform_device *pdev; + struct resource *resources; + size_t nresources = 0; +- acpi_status status; + int i; + +- status = acpi_get_table(ACPI_SIG_WDAT, 0, +- (struct acpi_table_header **)&wdat); +- if (ACPI_FAILURE(status)) { ++ wdat = acpi_watchdog_get_wdat(); ++ if (!wdat) { + /* It is fine if there is no WDAT */ + return; + } +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 8e63d937babb..807e1ae67b7c 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -2150,10 +2150,10 @@ int __init acpi_scan_init(void) + acpi_cmos_rtc_init(); + acpi_container_init(); + acpi_memory_hotplug_init(); ++ acpi_watchdog_init(); + acpi_pnp_init(); + acpi_int340x_thermal_init(); + acpi_amba_init(); +- acpi_watchdog_init(); + acpi_init_lpit(); + + acpi_scan_add_handler(&generic_device_handler); +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 46cde0912762..b7846d8d3e87 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -364,6 +364,19 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"), + }, + }, ++ /* ++ * ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using ++ * the Low Power S0 Idle firmware interface (see ++ * https://bugzilla.kernel.org/show_bug.cgi?id=199057). ++ */ ++ { ++ .callback = init_no_lps0, ++ .ident = "ThinkPad X1 Tablet(2016)", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), ++ }, ++ }, + {}, + }; + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 1d396b6e6000..738fb22978dd 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -699,7 +699,7 @@ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class, + + DPRINTK("ENTER\n"); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + rc = sata_link_hardreset(link, sata_ehc_deb_timing(&link->eh_context), + deadline, &online, NULL); +@@ -725,7 +725,7 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, + bool online; + int rc; + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + /* clear D2H reception area to properly wait for D2H FIS */ + ata_tf_init(link->device, &tf); +@@ -789,7 +789,7 @@ static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, + + DPRINTK("ENTER\n"); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + for (i = 0; i < 2; i++) { + u16 val; +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index a9d996e17d75..824bd399f02e 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -365,6 +365,13 @@ struct ahci_host_priv { + * be overridden anytime before the host is activated. + */ + void (*start_engine)(struct ata_port *ap); ++ /* ++ * Optional ahci_stop_engine override, if not set this gets set to the ++ * default ahci_stop_engine during ahci_save_initial_config, this can ++ * be overridden anytime before the host is activated. ++ */ ++ int (*stop_engine)(struct ata_port *ap); ++ + irqreturn_t (*irq_handler)(int irq, void *dev_instance); + + /* only required for per-port MSI(-X) support */ +diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c +index de7128d81e9c..0045dacd814b 100644 +--- a/drivers/ata/ahci_mvebu.c ++++ b/drivers/ata/ahci_mvebu.c +@@ -62,6 +62,60 @@ static void ahci_mvebu_regret_option(struct ahci_host_priv *hpriv) + writel(0x80, hpriv->mmio + AHCI_VENDOR_SPECIFIC_0_DATA); + } + ++/** ++ * ahci_mvebu_stop_engine ++ * ++ * @ap: Target ata port ++ * ++ * Errata Ref#226 - SATA Disk HOT swap issue when connected through ++ * Port Multiplier in FIS-based Switching mode. ++ * ++ * To avoid the issue, according to design, the bits[11:8, 0] of ++ * register PxFBS are cleared when Port Command and Status (0x18) bit[0] ++ * changes its value from 1 to 0, i.e. falling edge of Port ++ * Command and Status bit[0] sends PULSE that resets PxFBS ++ * bits[11:8; 0]. ++ * ++ * This function is used to override function of "ahci_stop_engine" ++ * from libahci.c by adding the mvebu work around(WA) to save PxFBS ++ * value before the PxCMD ST write of 0, then restore PxFBS value. ++ * ++ * Return: 0 on success; Error code otherwise. ++ */ ++int ahci_mvebu_stop_engine(struct ata_port *ap) ++{ ++ void __iomem *port_mmio = ahci_port_base(ap); ++ u32 tmp, port_fbs; ++ ++ tmp = readl(port_mmio + PORT_CMD); ++ ++ /* check if the HBA is idle */ ++ if ((tmp & (PORT_CMD_START | PORT_CMD_LIST_ON)) == 0) ++ return 0; ++ ++ /* save the port PxFBS register for later restore */ ++ port_fbs = readl(port_mmio + PORT_FBS); ++ ++ /* setting HBA to idle */ ++ tmp &= ~PORT_CMD_START; ++ writel(tmp, port_mmio + PORT_CMD); ++ ++ /* ++ * bit #15 PxCMD signal doesn't clear PxFBS, ++ * restore the PxFBS register right after clearing the PxCMD ST, ++ * no need to wait for the PxCMD bit #15. ++ */ ++ writel(port_fbs, port_mmio + PORT_FBS); ++ ++ /* wait for engine to stop. This could be as long as 500 msec */ ++ tmp = ata_wait_register(ap, port_mmio + PORT_CMD, ++ PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500); ++ if (tmp & PORT_CMD_LIST_ON) ++ return -EIO; ++ ++ return 0; ++} ++ + #ifdef CONFIG_PM_SLEEP + static int ahci_mvebu_suspend(struct platform_device *pdev, pm_message_t state) + { +@@ -112,6 +166,8 @@ static int ahci_mvebu_probe(struct platform_device *pdev) + if (rc) + return rc; + ++ hpriv->stop_engine = ahci_mvebu_stop_engine; ++ + if (of_device_is_compatible(pdev->dev.of_node, + "marvell,armada-380-ahci")) { + dram = mv_mbus_dram_info(); +diff --git a/drivers/ata/ahci_qoriq.c b/drivers/ata/ahci_qoriq.c +index 2685f28160f7..cfdef4d44ae9 100644 +--- a/drivers/ata/ahci_qoriq.c ++++ b/drivers/ata/ahci_qoriq.c +@@ -96,7 +96,7 @@ static int ahci_qoriq_hardreset(struct ata_link *link, unsigned int *class, + + DPRINTK("ENTER\n"); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + /* + * There is a errata on ls1021a Rev1.0 and Rev2.0 which is: +diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c +index c2b5941d9184..ad58da7c9aff 100644 +--- a/drivers/ata/ahci_xgene.c ++++ b/drivers/ata/ahci_xgene.c +@@ -165,7 +165,7 @@ static int xgene_ahci_restart_engine(struct ata_port *ap) + PORT_CMD_ISSUE, 0x0, 1, 100)) + return -EBUSY; + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + ahci_start_fis_rx(ap); + + /* +@@ -421,7 +421,7 @@ static int xgene_ahci_hardreset(struct ata_link *link, unsigned int *class, + portrxfis_saved = readl(port_mmio + PORT_FIS_ADDR); + portrxfishi_saved = readl(port_mmio + PORT_FIS_ADDR_HI); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + rc = xgene_ahci_do_hardreset(link, deadline, &online); + +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 7adcf3caabd0..e5d90977caec 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -560,6 +560,9 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv) + if (!hpriv->start_engine) + hpriv->start_engine = ahci_start_engine; + ++ if (!hpriv->stop_engine) ++ hpriv->stop_engine = ahci_stop_engine; ++ + if (!hpriv->irq_handler) + hpriv->irq_handler = ahci_single_level_irq_intr; + } +@@ -897,9 +900,10 @@ static void ahci_start_port(struct ata_port *ap) + static int ahci_deinit_port(struct ata_port *ap, const char **emsg) + { + int rc; ++ struct ahci_host_priv *hpriv = ap->host->private_data; + + /* disable DMA */ +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) { + *emsg = "failed to stop engine"; + return rc; +@@ -1310,7 +1314,7 @@ int ahci_kick_engine(struct ata_port *ap) + int busy, rc; + + /* stop engine */ +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) + goto out_restart; + +@@ -1549,7 +1553,7 @@ int ahci_do_hardreset(struct ata_link *link, unsigned int *class, + + DPRINTK("ENTER\n"); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + /* clear D2H reception area to properly wait for D2H FIS */ + ata_tf_init(link->device, &tf); +@@ -2075,14 +2079,14 @@ void ahci_error_handler(struct ata_port *ap) + + if (!(ap->pflags & ATA_PFLAG_FROZEN)) { + /* restart engine */ +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + hpriv->start_engine(ap); + } + + sata_pmp_error_handler(ap); + + if (!ata_dev_enabled(ap->link.device)) +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + } + EXPORT_SYMBOL_GPL(ahci_error_handler); + +@@ -2129,7 +2133,7 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + return; + + /* set DITO, MDAT, DETO and enable DevSlp, need to stop engine first */ +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) + return; + +@@ -2189,7 +2193,7 @@ static void ahci_enable_fbs(struct ata_port *ap) + return; + } + +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) + return; + +@@ -2222,7 +2226,7 @@ static void ahci_disable_fbs(struct ata_port *ap) + return; + } + +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) + return; + +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index c016829a38fd..513b260bcff1 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -175,8 +175,8 @@ static void ata_eh_handle_port_resume(struct ata_port *ap) + { } + #endif /* CONFIG_PM */ + +-static void __ata_ehi_pushv_desc(struct ata_eh_info *ehi, const char *fmt, +- va_list args) ++static __printf(2, 0) void __ata_ehi_pushv_desc(struct ata_eh_info *ehi, ++ const char *fmt, va_list args) + { + ehi->desc_len += vscnprintf(ehi->desc + ehi->desc_len, + ATA_EH_DESC_LEN - ehi->desc_len, +diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c +index aafb8cc03523..e67815b896fc 100644 +--- a/drivers/ata/sata_highbank.c ++++ b/drivers/ata/sata_highbank.c +@@ -410,7 +410,7 @@ static int ahci_highbank_hardreset(struct ata_link *link, unsigned int *class, + int rc; + int retry = 100; + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + /* clear D2H reception area to properly wait for D2H FIS */ + ata_tf_init(link->device, &tf); +diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c +index c381c8e396fc..79d8c84693a1 100644 +--- a/drivers/char/agp/uninorth-agp.c ++++ b/drivers/char/agp/uninorth-agp.c +@@ -195,7 +195,7 @@ static int uninorth_insert_memory(struct agp_memory *mem, off_t pg_start, int ty + return 0; + } + +-int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type) ++static int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type) + { + size_t i; + u32 *gp; +@@ -470,7 +470,7 @@ static int uninorth_free_gatt_table(struct agp_bridge_data *bridge) + return 0; + } + +-void null_cache_flush(void) ++static void null_cache_flush(void) + { + mb(); + } +diff --git a/drivers/clk/clk-mux.c b/drivers/clk/clk-mux.c +index 39cabe157163..4f6a048aece6 100644 +--- a/drivers/clk/clk-mux.c ++++ b/drivers/clk/clk-mux.c +@@ -101,10 +101,18 @@ static int clk_mux_set_parent(struct clk_hw *hw, u8 index) + return 0; + } + ++static int clk_mux_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) ++{ ++ struct clk_mux *mux = to_clk_mux(hw); ++ ++ return clk_mux_determine_rate_flags(hw, req, mux->flags); ++} ++ + const struct clk_ops clk_mux_ops = { + .get_parent = clk_mux_get_parent, + .set_parent = clk_mux_set_parent, +- .determine_rate = __clk_mux_determine_rate, ++ .determine_rate = clk_mux_determine_rate, + }; + EXPORT_SYMBOL_GPL(clk_mux_ops); + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 5698d2fac1af..665b64f0b0f8 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -426,9 +426,9 @@ static bool mux_is_better_rate(unsigned long rate, unsigned long now, + return now <= rate && now > best; + } + +-static int +-clk_mux_determine_rate_flags(struct clk_hw *hw, struct clk_rate_request *req, +- unsigned long flags) ++int clk_mux_determine_rate_flags(struct clk_hw *hw, ++ struct clk_rate_request *req, ++ unsigned long flags) + { + struct clk_core *core = hw->core, *parent, *best_parent = NULL; + int i, num_parents, ret; +@@ -488,6 +488,7 @@ clk_mux_determine_rate_flags(struct clk_hw *hw, struct clk_rate_request *req, + + return 0; + } ++EXPORT_SYMBOL_GPL(clk_mux_determine_rate_flags); + + struct clk *__clk_lookup(const char *name) + { +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index 85c118164469..c95034584747 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -461,7 +461,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + clk_set_rate(clks[IMX6UL_CLK_AHB], 99000000); + + /* Change periph_pre clock to pll2_bus to adjust AXI rate to 264MHz */ +- clk_set_parent(clks[IMX6UL_CLK_PERIPH_CLK2_SEL], clks[IMX6UL_CLK_PLL3_USB_OTG]); ++ clk_set_parent(clks[IMX6UL_CLK_PERIPH_CLK2_SEL], clks[IMX6UL_CLK_OSC]); + clk_set_parent(clks[IMX6UL_CLK_PERIPH], clks[IMX6UL_CLK_PERIPH_CLK2]); + clk_set_parent(clks[IMX6UL_CLK_PERIPH_PRE], clks[IMX6UL_CLK_PLL2_BUS]); + clk_set_parent(clks[IMX6UL_CLK_PERIPH], clks[IMX6UL_CLK_PERIPH_PRE]); +diff --git a/drivers/clocksource/timer-imx-tpm.c b/drivers/clocksource/timer-imx-tpm.c +index 557ed25b42e3..d175b9545581 100644 +--- a/drivers/clocksource/timer-imx-tpm.c ++++ b/drivers/clocksource/timer-imx-tpm.c +@@ -20,6 +20,7 @@ + #define TPM_SC 0x10 + #define TPM_SC_CMOD_INC_PER_CNT (0x1 << 3) + #define TPM_SC_CMOD_DIV_DEFAULT 0x3 ++#define TPM_SC_TOF_MASK (0x1 << 7) + #define TPM_CNT 0x14 + #define TPM_MOD 0x18 + #define TPM_STATUS 0x1c +@@ -29,6 +30,7 @@ + #define TPM_C0SC_MODE_SHIFT 2 + #define TPM_C0SC_MODE_MASK 0x3c + #define TPM_C0SC_MODE_SW_COMPARE 0x4 ++#define TPM_C0SC_CHF_MASK (0x1 << 7) + #define TPM_C0V 0x24 + + static void __iomem *timer_base; +@@ -205,9 +207,13 @@ static int __init tpm_timer_init(struct device_node *np) + * 4) Channel0 disabled + * 5) DMA transfers disabled + */ ++ /* make sure counter is disabled */ + writel(0, timer_base + TPM_SC); ++ /* TOF is W1C */ ++ writel(TPM_SC_TOF_MASK, timer_base + TPM_SC); + writel(0, timer_base + TPM_CNT); +- writel(0, timer_base + TPM_C0SC); ++ /* CHF is W1C */ ++ writel(TPM_C0SC_CHF_MASK, timer_base + TPM_C0SC); + + /* increase per cnt, div 8 by default */ + writel(TPM_SC_CMOD_INC_PER_CNT | TPM_SC_CMOD_DIV_DEFAULT, +diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm +index a8bec064d14a..ebde031ebd50 100644 +--- a/drivers/cpufreq/Kconfig.arm ++++ b/drivers/cpufreq/Kconfig.arm +@@ -70,16 +70,6 @@ config ARM_BRCMSTB_AVS_CPUFREQ + + Say Y, if you have a Broadcom SoC with AVS support for DFS or DVFS. + +-config ARM_BRCMSTB_AVS_CPUFREQ_DEBUG +- bool "Broadcom STB AVS CPUfreq driver sysfs debug capability" +- depends on ARM_BRCMSTB_AVS_CPUFREQ +- help +- Enabling this option turns on debug support via sysfs under +- /sys/kernel/debug/brcmstb-avs-cpufreq. It is possible to read all and +- write some AVS mailbox registers through sysfs entries. +- +- If in doubt, say N. +- + config ARM_EXYNOS5440_CPUFREQ + tristate "SAMSUNG EXYNOS5440" + depends on SOC_EXYNOS5440 +diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c +index 7281a2c19c36..726fb4db139e 100644 +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -49,13 +49,6 @@ + #include + #include + +-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG +-#include +-#include +-#include +-#include +-#endif +- + /* Max number of arguments AVS calls take */ + #define AVS_MAX_CMD_ARGS 4 + /* +@@ -182,88 +175,11 @@ struct private_data { + void __iomem *base; + void __iomem *avs_intr_base; + struct device *dev; +-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG +- struct dentry *debugfs; +-#endif + struct completion done; + struct semaphore sem; + struct pmap pmap; + }; + +-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG +- +-enum debugfs_format { +- DEBUGFS_NORMAL, +- DEBUGFS_FLOAT, +- DEBUGFS_REV, +-}; +- +-struct debugfs_data { +- struct debugfs_entry *entry; +- struct private_data *priv; +-}; +- +-struct debugfs_entry { +- char *name; +- u32 offset; +- fmode_t mode; +- enum debugfs_format format; +-}; +- +-#define DEBUGFS_ENTRY(name, mode, format) { \ +- #name, AVS_MBOX_##name, mode, format \ +-} +- +-/* +- * These are used for debugfs only. Otherwise we use AVS_MBOX_PARAM() directly. +- */ +-#define AVS_MBOX_PARAM1 AVS_MBOX_PARAM(0) +-#define AVS_MBOX_PARAM2 AVS_MBOX_PARAM(1) +-#define AVS_MBOX_PARAM3 AVS_MBOX_PARAM(2) +-#define AVS_MBOX_PARAM4 AVS_MBOX_PARAM(3) +- +-/* +- * This table stores the name, access permissions and offset for each hardware +- * register and is used to generate debugfs entries. +- */ +-static struct debugfs_entry debugfs_entries[] = { +- DEBUGFS_ENTRY(COMMAND, S_IWUSR, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(STATUS, S_IWUSR, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(VOLTAGE0, 0, DEBUGFS_FLOAT), +- DEBUGFS_ENTRY(TEMP0, 0, DEBUGFS_FLOAT), +- DEBUGFS_ENTRY(PV0, 0, DEBUGFS_FLOAT), +- DEBUGFS_ENTRY(MV0, 0, DEBUGFS_FLOAT), +- DEBUGFS_ENTRY(PARAM1, S_IWUSR, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(PARAM2, S_IWUSR, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(PARAM3, S_IWUSR, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(PARAM4, S_IWUSR, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(REVISION, 0, DEBUGFS_REV), +- DEBUGFS_ENTRY(PSTATE, 0, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(HEARTBEAT, 0, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(MAGIC, S_IWUSR, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(SIGMA_HVT, 0, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(SIGMA_SVT, 0, DEBUGFS_NORMAL), +- DEBUGFS_ENTRY(VOLTAGE1, 0, DEBUGFS_FLOAT), +- DEBUGFS_ENTRY(TEMP1, 0, DEBUGFS_FLOAT), +- DEBUGFS_ENTRY(PV1, 0, DEBUGFS_FLOAT), +- DEBUGFS_ENTRY(MV1, 0, DEBUGFS_FLOAT), +- DEBUGFS_ENTRY(FREQUENCY, 0, DEBUGFS_NORMAL), +-}; +- +-static int brcm_avs_target_index(struct cpufreq_policy *, unsigned int); +- +-static char *__strtolower(char *s) +-{ +- char *p; +- +- for (p = s; *p; p++) +- *p = tolower(*p); +- +- return s; +-} +- +-#endif /* CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG */ +- + static void __iomem *__map_region(const char *name) + { + struct device_node *np; +@@ -516,238 +432,6 @@ brcm_avs_get_freq_table(struct device *dev, struct private_data *priv) + return table; + } + +-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG +- +-#define MANT(x) (unsigned int)(abs((x)) / 1000) +-#define FRAC(x) (unsigned int)(abs((x)) - abs((x)) / 1000 * 1000) +- +-static int brcm_avs_debug_show(struct seq_file *s, void *data) +-{ +- struct debugfs_data *dbgfs = s->private; +- void __iomem *base; +- u32 val, offset; +- +- if (!dbgfs) { +- seq_puts(s, "No device pointer\n"); +- return 0; +- } +- +- base = dbgfs->priv->base; +- offset = dbgfs->entry->offset; +- val = readl(base + offset); +- switch (dbgfs->entry->format) { +- case DEBUGFS_NORMAL: +- seq_printf(s, "%u\n", val); +- break; +- case DEBUGFS_FLOAT: +- seq_printf(s, "%d.%03d\n", MANT(val), FRAC(val)); +- break; +- case DEBUGFS_REV: +- seq_printf(s, "%c.%c.%c.%c\n", (val >> 24 & 0xff), +- (val >> 16 & 0xff), (val >> 8 & 0xff), +- val & 0xff); +- break; +- } +- seq_printf(s, "0x%08x\n", val); +- +- return 0; +-} +- +-#undef MANT +-#undef FRAC +- +-static ssize_t brcm_avs_seq_write(struct file *file, const char __user *buf, +- size_t size, loff_t *ppos) +-{ +- struct seq_file *s = file->private_data; +- struct debugfs_data *dbgfs = s->private; +- struct private_data *priv = dbgfs->priv; +- void __iomem *base, *avs_intr_base; +- bool use_issue_command = false; +- unsigned long val, offset; +- char str[128]; +- int ret; +- char *str_ptr = str; +- +- if (size >= sizeof(str)) +- return -E2BIG; +- +- memset(str, 0, sizeof(str)); +- ret = copy_from_user(str, buf, size); +- if (ret) +- return ret; +- +- base = priv->base; +- avs_intr_base = priv->avs_intr_base; +- offset = dbgfs->entry->offset; +- /* +- * Special case writing to "command" entry only: if the string starts +- * with a 'c', we use the driver's __issue_avs_command() function. +- * Otherwise, we perform a raw write. This should allow testing of raw +- * access as well as using the higher level function. (Raw access +- * doesn't clear the firmware return status after issuing the command.) +- */ +- if (str_ptr[0] == 'c' && offset == AVS_MBOX_COMMAND) { +- use_issue_command = true; +- str_ptr++; +- } +- if (kstrtoul(str_ptr, 0, &val) != 0) +- return -EINVAL; +- +- /* +- * Setting the P-state is a special case. We need to update the CPU +- * frequency we report. +- */ +- if (val == AVS_CMD_SET_PSTATE) { +- struct cpufreq_policy *policy; +- unsigned int pstate; +- +- policy = cpufreq_cpu_get(smp_processor_id()); +- /* Read back the P-state we are about to set */ +- pstate = readl(base + AVS_MBOX_PARAM(0)); +- if (use_issue_command) { +- ret = brcm_avs_target_index(policy, pstate); +- return ret ? ret : size; +- } +- policy->cur = policy->freq_table[pstate].frequency; +- } +- +- if (use_issue_command) { +- ret = __issue_avs_command(priv, val, false, NULL); +- } else { +- /* Locking here is not perfect, but is only for debug. */ +- ret = down_interruptible(&priv->sem); +- if (ret) +- return ret; +- +- writel(val, base + offset); +- /* We have to wake up the firmware to process a command. */ +- if (offset == AVS_MBOX_COMMAND) +- writel(AVS_CPU_L2_INT_MASK, +- avs_intr_base + AVS_CPU_L2_SET0); +- up(&priv->sem); +- } +- +- return ret ? ret : size; +-} +- +-static struct debugfs_entry *__find_debugfs_entry(const char *name) +-{ +- int i; +- +- for (i = 0; i < ARRAY_SIZE(debugfs_entries); i++) +- if (strcasecmp(debugfs_entries[i].name, name) == 0) +- return &debugfs_entries[i]; +- +- return NULL; +-} +- +-static int brcm_avs_debug_open(struct inode *inode, struct file *file) +-{ +- struct debugfs_data *data; +- fmode_t fmode; +- int ret; +- +- /* +- * seq_open(), which is called by single_open(), clears "write" access. +- * We need write access to some files, so we preserve our access mode +- * and restore it. +- */ +- fmode = file->f_mode; +- /* +- * Check access permissions even for root. We don't want to be writing +- * to read-only registers. Access for regular users has already been +- * checked by the VFS layer. +- */ +- if ((fmode & FMODE_WRITER) && !(inode->i_mode & S_IWUSR)) +- return -EACCES; +- +- data = kmalloc(sizeof(*data), GFP_KERNEL); +- if (!data) +- return -ENOMEM; +- /* +- * We use the same file system operations for all our debug files. To +- * produce specific output, we look up the file name upon opening a +- * debugfs entry and map it to a memory offset. This offset is then used +- * in the generic "show" function to read a specific register. +- */ +- data->entry = __find_debugfs_entry(file->f_path.dentry->d_iname); +- data->priv = inode->i_private; +- +- ret = single_open(file, brcm_avs_debug_show, data); +- if (ret) +- kfree(data); +- file->f_mode = fmode; +- +- return ret; +-} +- +-static int brcm_avs_debug_release(struct inode *inode, struct file *file) +-{ +- struct seq_file *seq_priv = file->private_data; +- struct debugfs_data *data = seq_priv->private; +- +- kfree(data); +- return single_release(inode, file); +-} +- +-static const struct file_operations brcm_avs_debug_ops = { +- .open = brcm_avs_debug_open, +- .read = seq_read, +- .write = brcm_avs_seq_write, +- .llseek = seq_lseek, +- .release = brcm_avs_debug_release, +-}; +- +-static void brcm_avs_cpufreq_debug_init(struct platform_device *pdev) +-{ +- struct private_data *priv = platform_get_drvdata(pdev); +- struct dentry *dir; +- int i; +- +- if (!priv) +- return; +- +- dir = debugfs_create_dir(BRCM_AVS_CPUFREQ_NAME, NULL); +- if (IS_ERR_OR_NULL(dir)) +- return; +- priv->debugfs = dir; +- +- for (i = 0; i < ARRAY_SIZE(debugfs_entries); i++) { +- /* +- * The DEBUGFS_ENTRY macro generates uppercase strings. We +- * convert them to lowercase before creating the debugfs +- * entries. +- */ +- char *entry = __strtolower(debugfs_entries[i].name); +- fmode_t mode = debugfs_entries[i].mode; +- +- if (!debugfs_create_file(entry, S_IFREG | S_IRUGO | mode, +- dir, priv, &brcm_avs_debug_ops)) { +- priv->debugfs = NULL; +- debugfs_remove_recursive(dir); +- break; +- } +- } +-} +- +-static void brcm_avs_cpufreq_debug_exit(struct platform_device *pdev) +-{ +- struct private_data *priv = platform_get_drvdata(pdev); +- +- if (priv && priv->debugfs) { +- debugfs_remove_recursive(priv->debugfs); +- priv->debugfs = NULL; +- } +-} +- +-#else +- +-static void brcm_avs_cpufreq_debug_init(struct platform_device *pdev) {} +-static void brcm_avs_cpufreq_debug_exit(struct platform_device *pdev) {} +- +-#endif /* CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG */ +- + /* + * To ensure the right firmware is running we need to + * - check the MAGIC matches what we expect +@@ -1020,11 +704,8 @@ static int brcm_avs_cpufreq_probe(struct platform_device *pdev) + return ret; + + brcm_avs_driver.driver_data = pdev; +- ret = cpufreq_register_driver(&brcm_avs_driver); +- if (!ret) +- brcm_avs_cpufreq_debug_init(pdev); + +- return ret; ++ return cpufreq_register_driver(&brcm_avs_driver); + } + + static int brcm_avs_cpufreq_remove(struct platform_device *pdev) +@@ -1036,8 +717,6 @@ static int brcm_avs_cpufreq_remove(struct platform_device *pdev) + if (ret) + return ret; + +- brcm_avs_cpufreq_debug_exit(pdev); +- + priv = platform_get_drvdata(pdev); + iounmap(priv->base); + iounmap(priv->avs_intr_base); +diff --git a/drivers/firmware/efi/libstub/arm64-stub.c b/drivers/firmware/efi/libstub/arm64-stub.c +index b9bd827caa22..1b4d465cc5d9 100644 +--- a/drivers/firmware/efi/libstub/arm64-stub.c ++++ b/drivers/firmware/efi/libstub/arm64-stub.c +@@ -97,6 +97,16 @@ efi_status_t handle_kernel_image(efi_system_table_t *sys_table_arg, + u32 offset = !IS_ENABLED(CONFIG_DEBUG_ALIGN_RODATA) ? + (phys_seed >> 32) & mask : TEXT_OFFSET; + ++ /* ++ * With CONFIG_RANDOMIZE_TEXT_OFFSET=y, TEXT_OFFSET may not ++ * be a multiple of EFI_KIMG_ALIGN, and we must ensure that ++ * we preserve the misalignment of 'offset' relative to ++ * EFI_KIMG_ALIGN so that statically allocated objects whose ++ * alignment exceeds PAGE_SIZE appear correctly aligned in ++ * memory. ++ */ ++ offset |= TEXT_OFFSET % EFI_KIMG_ALIGN; ++ + /* + * If KASLR is enabled, and we have some randomness available, + * locate the kernel at a randomized offset in physical memory. +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +index 09d35051fdd6..3fabf9f97022 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +@@ -419,9 +419,11 @@ int amdgpu_ctx_wait_prev_fence(struct amdgpu_ctx *ctx, unsigned ring_id) + + if (other) { + signed long r; +- r = dma_fence_wait_timeout(other, false, MAX_SCHEDULE_TIMEOUT); ++ r = dma_fence_wait(other, true); + if (r < 0) { +- DRM_ERROR("Error (%ld) waiting for fence!\n", r); ++ if (r != -ERESTARTSYS) ++ DRM_ERROR("Error (%ld) waiting for fence!\n", r); ++ + return r; + } + } +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +index 62c3d9cd6ef1..0492aff87382 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +@@ -748,12 +748,13 @@ static int kfd_ioctl_get_clock_counters(struct file *filep, + struct timespec64 time; + + dev = kfd_device_by_id(args->gpu_id); +- if (dev == NULL) +- return -EINVAL; +- +- /* Reading GPU clock counter from KGD */ +- args->gpu_clock_counter = +- dev->kfd2kgd->get_gpu_clock_counter(dev->kgd); ++ if (dev) ++ /* Reading GPU clock counter from KGD */ ++ args->gpu_clock_counter = ++ dev->kfd2kgd->get_gpu_clock_counter(dev->kgd); ++ else ++ /* Node without GPU resource */ ++ args->gpu_clock_counter = 0; + + /* No access to rdtsc. Using raw monotonic time */ + getrawmonotonic64(&time); +diff --git a/drivers/gpu/drm/drm_dumb_buffers.c b/drivers/gpu/drm/drm_dumb_buffers.c +index 39ac15ce4702..9e2ae02f31e0 100644 +--- a/drivers/gpu/drm/drm_dumb_buffers.c ++++ b/drivers/gpu/drm/drm_dumb_buffers.c +@@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, + return -EINVAL; + + /* overflow checks for 32bit size calculations */ +- /* NOTE: DIV_ROUND_UP() can overflow */ ++ if (args->bpp > U32_MAX - 8) ++ return -EINVAL; + cpp = DIV_ROUND_UP(args->bpp, 8); +- if (!cpp || cpp > 0xffffffffU / args->width) ++ if (cpp > U32_MAX / args->width) + return -EINVAL; + stride = cpp * args->width; +- if (args->height > 0xffffffffU / stride) ++ if (args->height > U32_MAX / stride) + return -EINVAL; + + /* test for wrap-around */ +diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c +index dc5d79465f9b..66b7cc2128e7 100644 +--- a/drivers/gpu/drm/exynos/exynos_mixer.c ++++ b/drivers/gpu/drm/exynos/exynos_mixer.c +@@ -485,7 +485,7 @@ static void vp_video_buffer(struct mixer_context *ctx, + chroma_addr[1] = chroma_addr[0] + 0x40; + } else { + luma_addr[1] = luma_addr[0] + fb->pitches[0]; +- chroma_addr[1] = chroma_addr[0] + fb->pitches[0]; ++ chroma_addr[1] = chroma_addr[0] + fb->pitches[1]; + } + } else { + luma_addr[1] = 0; +@@ -494,6 +494,7 @@ static void vp_video_buffer(struct mixer_context *ctx, + + spin_lock_irqsave(&ctx->reg_slock, flags); + ++ vp_reg_write(ctx, VP_SHADOW_UPDATE, 1); + /* interlace or progressive scan mode */ + val = (test_bit(MXR_BIT_INTERLACE, &ctx->flags) ? ~0 : 0); + vp_reg_writemask(ctx, VP_MODE, val, VP_MODE_LINE_SKIP); +@@ -507,21 +508,23 @@ static void vp_video_buffer(struct mixer_context *ctx, + vp_reg_write(ctx, VP_IMG_SIZE_Y, VP_IMG_HSIZE(fb->pitches[0]) | + VP_IMG_VSIZE(fb->height)); + /* chroma plane for NV12/NV21 is half the height of the luma plane */ +- vp_reg_write(ctx, VP_IMG_SIZE_C, VP_IMG_HSIZE(fb->pitches[0]) | ++ vp_reg_write(ctx, VP_IMG_SIZE_C, VP_IMG_HSIZE(fb->pitches[1]) | + VP_IMG_VSIZE(fb->height / 2)); + + vp_reg_write(ctx, VP_SRC_WIDTH, state->src.w); +- vp_reg_write(ctx, VP_SRC_HEIGHT, state->src.h); + vp_reg_write(ctx, VP_SRC_H_POSITION, + VP_SRC_H_POSITION_VAL(state->src.x)); +- vp_reg_write(ctx, VP_SRC_V_POSITION, state->src.y); +- + vp_reg_write(ctx, VP_DST_WIDTH, state->crtc.w); + vp_reg_write(ctx, VP_DST_H_POSITION, state->crtc.x); ++ + if (test_bit(MXR_BIT_INTERLACE, &ctx->flags)) { ++ vp_reg_write(ctx, VP_SRC_HEIGHT, state->src.h / 2); ++ vp_reg_write(ctx, VP_SRC_V_POSITION, state->src.y / 2); + vp_reg_write(ctx, VP_DST_HEIGHT, state->crtc.h / 2); + vp_reg_write(ctx, VP_DST_V_POSITION, state->crtc.y / 2); + } else { ++ vp_reg_write(ctx, VP_SRC_HEIGHT, state->src.h); ++ vp_reg_write(ctx, VP_SRC_V_POSITION, state->src.y); + vp_reg_write(ctx, VP_DST_HEIGHT, state->crtc.h); + vp_reg_write(ctx, VP_DST_V_POSITION, state->crtc.y); + } +@@ -711,6 +714,15 @@ static irqreturn_t mixer_irq_handler(int irq, void *arg) + + /* interlace scan need to check shadow register */ + if (test_bit(MXR_BIT_INTERLACE, &ctx->flags)) { ++ if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags) && ++ vp_reg_read(ctx, VP_SHADOW_UPDATE)) ++ goto out; ++ ++ base = mixer_reg_read(ctx, MXR_CFG); ++ shadow = mixer_reg_read(ctx, MXR_CFG_S); ++ if (base != shadow) ++ goto out; ++ + base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(0)); + shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(0)); + if (base != shadow) +diff --git a/drivers/gpu/drm/exynos/regs-mixer.h b/drivers/gpu/drm/exynos/regs-mixer.h +index c311f571bdf9..189cfa2470a8 100644 +--- a/drivers/gpu/drm/exynos/regs-mixer.h ++++ b/drivers/gpu/drm/exynos/regs-mixer.h +@@ -47,6 +47,7 @@ + #define MXR_MO 0x0304 + #define MXR_RESOLUTION 0x0310 + ++#define MXR_CFG_S 0x2004 + #define MXR_GRAPHIC0_BASE_S 0x2024 + #define MXR_GRAPHIC1_BASE_S 0x2044 + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index 0f7324a686ca..d729b2b4b66d 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -740,7 +740,7 @@ static inline enum dsi_cmd_dst_format dsi_get_cmd_fmt( + switch (mipi_fmt) { + case MIPI_DSI_FMT_RGB888: return CMD_DST_FORMAT_RGB888; + case MIPI_DSI_FMT_RGB666_PACKED: +- case MIPI_DSI_FMT_RGB666: return VID_DST_FORMAT_RGB666; ++ case MIPI_DSI_FMT_RGB666: return CMD_DST_FORMAT_RGB666; + case MIPI_DSI_FMT_RGB565: return CMD_DST_FORMAT_RGB565; + default: return CMD_DST_FORMAT_RGB888; + } +diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c +index c178563fcd4d..456622b46335 100644 +--- a/drivers/gpu/drm/msm/msm_fbdev.c ++++ b/drivers/gpu/drm/msm/msm_fbdev.c +@@ -92,8 +92,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper, + + if (IS_ERR(fb)) { + dev_err(dev->dev, "failed to allocate fb\n"); +- ret = PTR_ERR(fb); +- goto fail; ++ return PTR_ERR(fb); + } + + bo = msm_framebuffer_bo(fb, 0); +@@ -151,13 +150,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper, + + fail_unlock: + mutex_unlock(&dev->struct_mutex); +-fail: +- +- if (ret) { +- if (fb) +- drm_framebuffer_remove(fb); +- } +- ++ drm_framebuffer_remove(fb); + return ret; + } + +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index 07376de9ff4c..37ec3411297b 100644 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -132,17 +132,19 @@ static void put_pages(struct drm_gem_object *obj) + struct msm_gem_object *msm_obj = to_msm_bo(obj); + + if (msm_obj->pages) { +- /* For non-cached buffers, ensure the new pages are clean +- * because display controller, GPU, etc. are not coherent: +- */ +- if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED)) +- dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl, +- msm_obj->sgt->nents, DMA_BIDIRECTIONAL); ++ if (msm_obj->sgt) { ++ /* For non-cached buffers, ensure the new ++ * pages are clean because display controller, ++ * GPU, etc. are not coherent: ++ */ ++ if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED)) ++ dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl, ++ msm_obj->sgt->nents, ++ DMA_BIDIRECTIONAL); + +- if (msm_obj->sgt) + sg_free_table(msm_obj->sgt); +- +- kfree(msm_obj->sgt); ++ kfree(msm_obj->sgt); ++ } + + if (use_pages(obj)) + drm_gem_put_pages(obj, msm_obj->pages, true, false); +diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4.c b/drivers/gpu/drm/omapdrm/dss/hdmi4.c +index bf914f2ac99e..f3d7decbbe24 100644 +--- a/drivers/gpu/drm/omapdrm/dss/hdmi4.c ++++ b/drivers/gpu/drm/omapdrm/dss/hdmi4.c +@@ -665,7 +665,7 @@ static int hdmi_audio_config(struct device *dev, + struct omap_dss_audio *dss_audio) + { + struct omap_hdmi *hd = dev_get_drvdata(dev); +- int ret; ++ int ret = 0; + + mutex_lock(&hd->lock); + +diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c +index 35ed2add6189..813ba42f2753 100644 +--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c ++++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c +@@ -922,8 +922,13 @@ int hdmi4_core_init(struct platform_device *pdev, struct hdmi_core_data *core) + { + const struct hdmi4_features *features; + struct resource *res; ++ const struct soc_device_attribute *soc; + +- features = soc_device_match(hdmi4_soc_devices)->data; ++ soc = soc_device_match(hdmi4_soc_devices); ++ if (!soc) ++ return -ENODEV; ++ ++ features = soc->data; + core->cts_swmode = features->cts_swmode; + core->audio_use_mclk = features->audio_use_mclk; + +diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi5.c b/drivers/gpu/drm/omapdrm/dss/hdmi5.c +index 689cda41858b..dc36274bdc15 100644 +--- a/drivers/gpu/drm/omapdrm/dss/hdmi5.c ++++ b/drivers/gpu/drm/omapdrm/dss/hdmi5.c +@@ -660,7 +660,7 @@ static int hdmi_audio_config(struct device *dev, + struct omap_dss_audio *dss_audio) + { + struct omap_hdmi *hd = dev_get_drvdata(dev); +- int ret; ++ int ret = 0; + + mutex_lock(&hd->lock); + +diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c b/drivers/gpu/drm/omapdrm/omap_connector.c +index a0d7b1d905e8..5cde26ac937b 100644 +--- a/drivers/gpu/drm/omapdrm/omap_connector.c ++++ b/drivers/gpu/drm/omapdrm/omap_connector.c +@@ -121,6 +121,9 @@ static int omap_connector_get_modes(struct drm_connector *connector) + if (dssdrv->read_edid) { + void *edid = kzalloc(MAX_EDID, GFP_KERNEL); + ++ if (!edid) ++ return 0; ++ + if ((dssdrv->read_edid(dssdev, edid, MAX_EDID) > 0) && + drm_edid_is_valid(edid)) { + drm_mode_connector_update_edid_property( +@@ -139,6 +142,9 @@ static int omap_connector_get_modes(struct drm_connector *connector) + struct drm_display_mode *mode = drm_mode_create(dev); + struct videomode vm = {0}; + ++ if (!mode) ++ return 0; ++ + dssdrv->get_timings(dssdev, &vm); + + drm_display_mode_from_videomode(&vm, mode); +@@ -200,6 +206,10 @@ static int omap_connector_mode_valid(struct drm_connector *connector, + if (!r) { + /* check if vrefresh is still valid */ + new_mode = drm_mode_duplicate(dev, mode); ++ ++ if (!new_mode) ++ return MODE_BAD; ++ + new_mode->clock = vm.pixelclock / 1000; + new_mode->vrefresh = 0; + if (mode->vrefresh == drm_mode_vrefresh(new_mode)) +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index 4be0c94673f5..17d1baee522b 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -401,12 +401,16 @@ int tiler_unpin(struct tiler_block *block) + struct tiler_block *tiler_reserve_2d(enum tiler_fmt fmt, uint16_t w, + uint16_t h, uint16_t align) + { +- struct tiler_block *block = kzalloc(sizeof(*block), GFP_KERNEL); ++ struct tiler_block *block; + u32 min_align = 128; + int ret; + unsigned long flags; + u32 slot_bytes; + ++ block = kzalloc(sizeof(*block), GFP_KERNEL); ++ if (!block) ++ return ERR_PTR(-ENOMEM); ++ + BUG_ON(!validfmt(fmt)); + + /* convert width/height to slots */ +diff --git a/drivers/gpu/drm/omapdrm/tcm-sita.c b/drivers/gpu/drm/omapdrm/tcm-sita.c +index 661362d072f7..ebfdb38b4616 100644 +--- a/drivers/gpu/drm/omapdrm/tcm-sita.c ++++ b/drivers/gpu/drm/omapdrm/tcm-sita.c +@@ -90,7 +90,7 @@ static int l2r_t2b(uint16_t w, uint16_t h, uint16_t a, int16_t offset, + { + int i; + unsigned long index; +- bool area_free; ++ bool area_free = false; + unsigned long slots_per_band = PAGE_SIZE / slot_bytes; + unsigned long bit_offset = (offset > 0) ? offset / slot_bytes : 0; + unsigned long curr_bit = bit_offset; +diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c +index 72c9dbd81d7f..f185812970da 100644 +--- a/drivers/gpu/drm/vc4/vc4_dpi.c ++++ b/drivers/gpu/drm/vc4/vc4_dpi.c +@@ -96,7 +96,6 @@ struct vc4_dpi { + struct platform_device *pdev; + + struct drm_encoder *encoder; +- struct drm_connector *connector; + + void __iomem *regs; + +@@ -164,14 +163,31 @@ static void vc4_dpi_encoder_disable(struct drm_encoder *encoder) + + static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) + { ++ struct drm_device *dev = encoder->dev; + struct drm_display_mode *mode = &encoder->crtc->mode; + struct vc4_dpi_encoder *vc4_encoder = to_vc4_dpi_encoder(encoder); + struct vc4_dpi *dpi = vc4_encoder->dpi; ++ struct drm_connector_list_iter conn_iter; ++ struct drm_connector *connector = NULL, *connector_scan; + u32 dpi_c = DPI_ENABLE | DPI_OUTPUT_ENABLE_MODE; + int ret; + +- if (dpi->connector->display_info.num_bus_formats) { +- u32 bus_format = dpi->connector->display_info.bus_formats[0]; ++ /* Look up the connector attached to DPI so we can get the ++ * bus_format. Ideally the bridge would tell us the ++ * bus_format we want, but it doesn't yet, so assume that it's ++ * uniform throughout the bridge chain. ++ */ ++ drm_connector_list_iter_begin(dev, &conn_iter); ++ drm_for_each_connector_iter(connector_scan, &conn_iter) { ++ if (connector_scan->encoder == encoder) { ++ connector = connector_scan; ++ break; ++ } ++ } ++ drm_connector_list_iter_end(&conn_iter); ++ ++ if (connector && connector->display_info.num_bus_formats) { ++ u32 bus_format = connector->display_info.bus_formats[0]; + + switch (bus_format) { + case MEDIA_BUS_FMT_RGB888_1X24: +@@ -199,6 +215,9 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) + DRM_ERROR("Unknown media bus format %d\n", bus_format); + break; + } ++ } else { ++ /* Default to 24bit if no connector found. */ ++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, DPI_FORMAT); + } + + if (mode->flags & DRM_MODE_FLAG_NHSYNC) +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 19c499f5623d..84ace3b62bb0 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -448,10 +448,11 @@ config HID_LENOVO + select NEW_LEDS + select LEDS_CLASS + ---help--- +- Support for Lenovo devices that are not fully compliant with HID standard. ++ Support for IBM/Lenovo devices that are not fully compliant with HID standard. + +- Say Y if you want support for the non-compliant features of the Lenovo +- Thinkpad standalone keyboards, e.g: ++ Say Y if you want support for horizontal scrolling of the IBM/Lenovo ++ Scrollpoint mice or the non-compliant features of the Lenovo Thinkpad ++ standalone keyboards, e.g: + - ThinkPad USB Keyboard with TrackPoint (supports extra LEDs and trackpoint + configuration) + - ThinkPad Compact Bluetooth Keyboard with TrackPoint (supports Fn keys) +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index c631d2c8988d..a026cc76f4f1 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -546,6 +546,13 @@ + #define USB_VENDOR_ID_HUION 0x256c + #define USB_DEVICE_ID_HUION_TABLET 0x006e + ++#define USB_VENDOR_ID_IBM 0x04b3 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_III 0x3100 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_PRO 0x3103 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL 0x3105 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL 0x3108 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO 0x3109 ++ + #define USB_VENDOR_ID_IDEACOM 0x1cb6 + #define USB_DEVICE_ID_IDEACOM_IDC6650 0x6650 + #define USB_DEVICE_ID_IDEACOM_IDC6651 0x6651 +@@ -678,6 +685,7 @@ + #define USB_DEVICE_ID_LENOVO_TPKBD 0x6009 + #define USB_DEVICE_ID_LENOVO_CUSBKBD 0x6047 + #define USB_DEVICE_ID_LENOVO_CBTKBD 0x6048 ++#define USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL 0x6049 + #define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067 + #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085 + #define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3 +@@ -958,6 +966,7 @@ + #define USB_DEVICE_ID_SIS817_TOUCH 0x0817 + #define USB_DEVICE_ID_SIS_TS 0x1013 + #define USB_DEVICE_ID_SIS1030_TOUCH 0x1030 ++#define USB_DEVICE_ID_SIS10FB_TOUCH 0x10fb + + #define USB_VENDOR_ID_SKYCABLE 0x1223 + #define USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER 0x3F07 +diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c +index 1ac4ff4d57a6..643b6eb54442 100644 +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -6,6 +6,17 @@ + * + * Copyright (c) 2012 Bernhard Seibold + * Copyright (c) 2014 Jamie Lentin ++ * ++ * Linux IBM/Lenovo Scrollpoint mouse driver: ++ * - IBM Scrollpoint III ++ * - IBM Scrollpoint Pro ++ * - IBM Scrollpoint Optical ++ * - IBM Scrollpoint Optical 800dpi ++ * - IBM Scrollpoint Optical 800dpi Pro ++ * - Lenovo Scrollpoint Optical ++ * ++ * Copyright (c) 2012 Peter De Wachter ++ * Copyright (c) 2018 Peter Ganzhorn + */ + + /* +@@ -160,6 +171,17 @@ static int lenovo_input_mapping_cptkbd(struct hid_device *hdev, + return 0; + } + ++static int lenovo_input_mapping_scrollpoint(struct hid_device *hdev, ++ struct hid_input *hi, struct hid_field *field, ++ struct hid_usage *usage, unsigned long **bit, int *max) ++{ ++ if (usage->hid == HID_GD_Z) { ++ hid_map_usage(hi, usage, bit, max, EV_REL, REL_HWHEEL); ++ return 1; ++ } ++ return 0; ++} ++ + static int lenovo_input_mapping(struct hid_device *hdev, + struct hid_input *hi, struct hid_field *field, + struct hid_usage *usage, unsigned long **bit, int *max) +@@ -172,6 +194,14 @@ static int lenovo_input_mapping(struct hid_device *hdev, + case USB_DEVICE_ID_LENOVO_CBTKBD: + return lenovo_input_mapping_cptkbd(hdev, hi, field, + usage, bit, max); ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_III: ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_PRO: ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL: ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL: ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO: ++ case USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL: ++ return lenovo_input_mapping_scrollpoint(hdev, hi, field, ++ usage, bit, max); + default: + return 0; + } +@@ -883,6 +913,12 @@ static const struct hid_device_id lenovo_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CUSBKBD) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CBTKBD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPPRODOCK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_III) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_PRO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL) }, + { } + }; + +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index fd9f70a8b813..4c0d2491db08 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -174,6 +174,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { I2C_VENDOR_ID_RAYD, I2C_PRODUCT_ID_RAYD_3118, + I2C_HID_QUIRK_RESEND_REPORT_DESCR }, ++ { USB_VENDOR_ID_SIS_TOUCH, USB_DEVICE_ID_SIS10FB_TOUCH, ++ I2C_HID_QUIRK_RESEND_REPORT_DESCR }, + { 0, 0 } + }; + +diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c +index f272cdd9bd55..2623a567ffba 100644 +--- a/drivers/hid/intel-ish-hid/ishtp/bus.c ++++ b/drivers/hid/intel-ish-hid/ishtp/bus.c +@@ -418,7 +418,7 @@ static struct ishtp_cl_device *ishtp_bus_add_device(struct ishtp_device *dev, + list_del(&device->device_link); + spin_unlock_irqrestore(&dev->device_list_lock, flags); + dev_err(dev->devc, "Failed to register ISHTP client device\n"); +- kfree(device); ++ put_device(&device->dev); + return NULL; + } + +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index b54ef1ffcbec..ee7a37eb159a 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -1213,8 +1213,10 @@ static int __wacom_devm_sysfs_create_group(struct wacom *wacom, + devres->root = root; + + error = sysfs_create_group(devres->root, group); +- if (error) ++ if (error) { ++ devres_free(devres); + return error; ++ } + + devres_add(&wacom->hdev->dev, devres); + +diff --git a/drivers/i2c/busses/i2c-pmcmsp.c b/drivers/i2c/busses/i2c-pmcmsp.c +index 2aa0e83174c5..dae8ac618a52 100644 +--- a/drivers/i2c/busses/i2c-pmcmsp.c ++++ b/drivers/i2c/busses/i2c-pmcmsp.c +@@ -564,10 +564,10 @@ static int pmcmsptwi_master_xfer(struct i2c_adapter *adap, + * TODO: We could potentially loop and retry in the case + * of MSP_TWI_XFER_TIMEOUT. + */ +- return -1; ++ return -EIO; + } + +- return 0; ++ return num; + } + + static u32 pmcmsptwi_i2c_func(struct i2c_adapter *adapter) +diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c +index 25fcc3c1e32b..4053259bccb8 100644 +--- a/drivers/i2c/busses/i2c-sprd.c ++++ b/drivers/i2c/busses/i2c-sprd.c +@@ -86,6 +86,7 @@ struct sprd_i2c { + u32 count; + int irq; + int err; ++ bool is_suspended; + }; + + static void sprd_i2c_set_count(struct sprd_i2c *i2c_dev, u32 count) +@@ -283,6 +284,9 @@ static int sprd_i2c_master_xfer(struct i2c_adapter *i2c_adap, + struct sprd_i2c *i2c_dev = i2c_adap->algo_data; + int im, ret; + ++ if (i2c_dev->is_suspended) ++ return -EBUSY; ++ + ret = pm_runtime_get_sync(i2c_dev->dev); + if (ret < 0) + return ret; +@@ -364,13 +368,12 @@ static irqreturn_t sprd_i2c_isr_thread(int irq, void *dev_id) + struct sprd_i2c *i2c_dev = dev_id; + struct i2c_msg *msg = i2c_dev->msg; + bool ack = !(readl(i2c_dev->base + I2C_STATUS) & I2C_RX_ACK); +- u32 i2c_count = readl(i2c_dev->base + I2C_COUNT); + u32 i2c_tran; + + if (msg->flags & I2C_M_RD) + i2c_tran = i2c_dev->count >= I2C_FIFO_FULL_THLD; + else +- i2c_tran = i2c_count; ++ i2c_tran = i2c_dev->count; + + /* + * If we got one ACK from slave when writing data, and we did not +@@ -408,14 +411,13 @@ static irqreturn_t sprd_i2c_isr(int irq, void *dev_id) + { + struct sprd_i2c *i2c_dev = dev_id; + struct i2c_msg *msg = i2c_dev->msg; +- u32 i2c_count = readl(i2c_dev->base + I2C_COUNT); + bool ack = !(readl(i2c_dev->base + I2C_STATUS) & I2C_RX_ACK); + u32 i2c_tran; + + if (msg->flags & I2C_M_RD) + i2c_tran = i2c_dev->count >= I2C_FIFO_FULL_THLD; + else +- i2c_tran = i2c_count; ++ i2c_tran = i2c_dev->count; + + /* + * If we did not get one ACK from slave when writing data, then we +@@ -586,11 +588,23 @@ static int sprd_i2c_remove(struct platform_device *pdev) + + static int __maybe_unused sprd_i2c_suspend_noirq(struct device *pdev) + { ++ struct sprd_i2c *i2c_dev = dev_get_drvdata(pdev); ++ ++ i2c_lock_adapter(&i2c_dev->adap); ++ i2c_dev->is_suspended = true; ++ i2c_unlock_adapter(&i2c_dev->adap); ++ + return pm_runtime_force_suspend(pdev); + } + + static int __maybe_unused sprd_i2c_resume_noirq(struct device *pdev) + { ++ struct sprd_i2c *i2c_dev = dev_get_drvdata(pdev); ++ ++ i2c_lock_adapter(&i2c_dev->adap); ++ i2c_dev->is_suspended = false; ++ i2c_unlock_adapter(&i2c_dev->adap); ++ + return pm_runtime_force_resume(pdev); + } + +diff --git a/drivers/i2c/busses/i2c-viperboard.c b/drivers/i2c/busses/i2c-viperboard.c +index e4be86b3de9a..7235c7302bb7 100644 +--- a/drivers/i2c/busses/i2c-viperboard.c ++++ b/drivers/i2c/busses/i2c-viperboard.c +@@ -337,7 +337,7 @@ static int vprbrd_i2c_xfer(struct i2c_adapter *i2c, struct i2c_msg *msgs, + } + mutex_unlock(&vb->lock); + } +- return 0; ++ return num; + error: + mutex_unlock(&vb->lock); + return error; +diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig +index 8517d6ea91a6..6154da184fc1 100644 +--- a/drivers/infiniband/Kconfig ++++ b/drivers/infiniband/Kconfig +@@ -62,9 +62,12 @@ config INFINIBAND_ON_DEMAND_PAGING + pages on demand instead. + + config INFINIBAND_ADDR_TRANS +- bool ++ bool "RDMA/CM" + depends on INFINIBAND + default y ++ ---help--- ++ Support for RDMA communication manager (CM). ++ This allows for a generic connection abstraction over RDMA. + + config INFINIBAND_ADDR_TRANS_CONFIGFS + bool +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index a5367c5efbe7..b5a7897eb180 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -420,6 +420,8 @@ struct cma_hdr { + #define CMA_VERSION 0x00 + + struct cma_req_info { ++ struct sockaddr_storage listen_addr_storage; ++ struct sockaddr_storage src_addr_storage; + struct ib_device *device; + int port; + union ib_gid local_gid; +@@ -899,7 +901,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv, + { + struct ib_qp_attr qp_attr; + int qp_attr_mask, ret; +- union ib_gid sgid; + + mutex_lock(&id_priv->qp_mutex); + if (!id_priv->id.qp) { +@@ -922,12 +923,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv, + if (ret) + goto out; + +- ret = ib_query_gid(id_priv->id.device, id_priv->id.port_num, +- rdma_ah_read_grh(&qp_attr.ah_attr)->sgid_index, +- &sgid, NULL); +- if (ret) +- goto out; +- + BUG_ON(id_priv->cma_dev->device != id_priv->id.device); + + if (conn_param) +@@ -1373,11 +1368,11 @@ static bool validate_net_dev(struct net_device *net_dev, + } + + static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event, +- const struct cma_req_info *req) ++ struct cma_req_info *req) + { +- struct sockaddr_storage listen_addr_storage, src_addr_storage; +- struct sockaddr *listen_addr = (struct sockaddr *)&listen_addr_storage, +- *src_addr = (struct sockaddr *)&src_addr_storage; ++ struct sockaddr *listen_addr = ++ (struct sockaddr *)&req->listen_addr_storage; ++ struct sockaddr *src_addr = (struct sockaddr *)&req->src_addr_storage; + struct net_device *net_dev; + const union ib_gid *gid = req->has_gid ? &req->local_gid : NULL; + int err; +@@ -1392,11 +1387,6 @@ static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event, + if (!net_dev) + return ERR_PTR(-ENODEV); + +- if (!validate_net_dev(net_dev, listen_addr, src_addr)) { +- dev_put(net_dev); +- return ERR_PTR(-EHOSTUNREACH); +- } +- + return net_dev; + } + +@@ -1532,15 +1522,51 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id, + } + } + ++ /* ++ * Net namespace might be getting deleted while route lookup, ++ * cm_id lookup is in progress. Therefore, perform netdevice ++ * validation, cm_id lookup under rcu lock. ++ * RCU lock along with netdevice state check, synchronizes with ++ * netdevice migrating to different net namespace and also avoids ++ * case where net namespace doesn't get deleted while lookup is in ++ * progress. ++ * If the device state is not IFF_UP, its properties such as ifindex ++ * and nd_net cannot be trusted to remain valid without rcu lock. ++ * net/core/dev.c change_net_namespace() ensures to synchronize with ++ * ongoing operations on net device after device is closed using ++ * synchronize_net(). ++ */ ++ rcu_read_lock(); ++ if (*net_dev) { ++ /* ++ * If netdevice is down, it is likely that it is administratively ++ * down or it might be migrating to different namespace. ++ * In that case avoid further processing, as the net namespace ++ * or ifindex may change. ++ */ ++ if (((*net_dev)->flags & IFF_UP) == 0) { ++ id_priv = ERR_PTR(-EHOSTUNREACH); ++ goto err; ++ } ++ ++ if (!validate_net_dev(*net_dev, ++ (struct sockaddr *)&req.listen_addr_storage, ++ (struct sockaddr *)&req.src_addr_storage)) { ++ id_priv = ERR_PTR(-EHOSTUNREACH); ++ goto err; ++ } ++ } ++ + bind_list = cma_ps_find(*net_dev ? dev_net(*net_dev) : &init_net, + rdma_ps_from_service_id(req.service_id), + cma_port_from_service_id(req.service_id)); + id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev); ++err: ++ rcu_read_unlock(); + if (IS_ERR(id_priv) && *net_dev) { + dev_put(*net_dev); + *net_dev = NULL; + } +- + return id_priv; + } + +diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c +index 81528f64061a..cb0fecc958b5 100644 +--- a/drivers/infiniband/core/iwpm_util.c ++++ b/drivers/infiniband/core/iwpm_util.c +@@ -114,7 +114,7 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr, + struct sockaddr_storage *mapped_sockaddr, + u8 nl_client) + { +- struct hlist_head *hash_bucket_head; ++ struct hlist_head *hash_bucket_head = NULL; + struct iwpm_mapping_info *map_info; + unsigned long flags; + int ret = -EINVAL; +@@ -142,6 +142,9 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr, + } + } + spin_unlock_irqrestore(&iwpm_mapinfo_lock, flags); ++ ++ if (!hash_bucket_head) ++ kfree(map_info); + return ret; + } + +diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c +index c50596f7f98a..b28452a55a08 100644 +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -59,7 +59,7 @@ module_param_named(recv_queue_size, mad_recvq_size, int, 0444); + MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests"); + + static struct list_head ib_mad_port_list; +-static u32 ib_mad_client_id = 0; ++static atomic_t ib_mad_client_id = ATOMIC_INIT(0); + + /* Port list lock */ + static DEFINE_SPINLOCK(ib_mad_port_list_lock); +@@ -377,7 +377,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device, + } + + spin_lock_irqsave(&port_priv->reg_lock, flags); +- mad_agent_priv->agent.hi_tid = ++ib_mad_client_id; ++ mad_agent_priv->agent.hi_tid = atomic_inc_return(&ib_mad_client_id); + + /* + * Make sure MAD registration (if supplied) +diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c +index 339b85145044..6a71cdf1fe33 100644 +--- a/drivers/infiniband/core/uverbs_ioctl.c ++++ b/drivers/infiniband/core/uverbs_ioctl.c +@@ -191,6 +191,15 @@ static int uverbs_validate_kernel_mandatory(const struct uverbs_method_spec *met + return -EINVAL; + } + ++ for (; i < method_spec->num_buckets; i++) { ++ struct uverbs_attr_spec_hash *attr_spec_bucket = ++ method_spec->attr_buckets[i]; ++ ++ if (!bitmap_empty(attr_spec_bucket->mandatory_attrs_bitmask, ++ attr_spec_bucket->num_attrs)) ++ return -EINVAL; ++ } ++ + return 0; + } + +diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c +index a97055dd4fbd..b5fab55cc275 100644 +--- a/drivers/infiniband/hw/hfi1/affinity.c ++++ b/drivers/infiniband/hw/hfi1/affinity.c +@@ -412,7 +412,6 @@ static void hfi1_cleanup_sdma_notifier(struct hfi1_msix_entry *msix) + static int get_irq_affinity(struct hfi1_devdata *dd, + struct hfi1_msix_entry *msix) + { +- int ret; + cpumask_var_t diff; + struct hfi1_affinity_node *entry; + struct cpu_mask_set *set = NULL; +@@ -424,10 +423,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd, + extra[0] = '\0'; + cpumask_clear(&msix->mask); + +- ret = zalloc_cpumask_var(&diff, GFP_KERNEL); +- if (!ret) +- return -ENOMEM; +- + entry = node_affinity_lookup(dd->node); + + switch (msix->type) { +@@ -458,6 +453,9 @@ static int get_irq_affinity(struct hfi1_devdata *dd, + * finds its CPU here. + */ + if (cpu == -1 && set) { ++ if (!zalloc_cpumask_var(&diff, GFP_KERNEL)) ++ return -ENOMEM; ++ + if (cpumask_equal(&set->mask, &set->used)) { + /* + * We've used up all the CPUs, bump up the generation +@@ -469,6 +467,8 @@ static int get_irq_affinity(struct hfi1_devdata *dd, + cpumask_andnot(diff, &set->mask, &set->used); + cpu = cpumask_first(diff); + cpumask_set_cpu(cpu, &set->used); ++ ++ free_cpumask_var(diff); + } + + cpumask_set_cpu(cpu, &msix->mask); +@@ -482,7 +482,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd, + hfi1_setup_sdma_notifier(msix); + } + +- free_cpumask_var(diff); + return 0; + } + +diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c +index b27fe75c7102..6309edf811df 100644 +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -88,9 +88,9 @@ + * pio buffers per ctxt, etc.) Zero means use one user context per CPU. + */ + int num_user_contexts = -1; +-module_param_named(num_user_contexts, num_user_contexts, uint, S_IRUGO); ++module_param_named(num_user_contexts, num_user_contexts, int, 0444); + MODULE_PARM_DESC( +- num_user_contexts, "Set max number of user contexts to use"); ++ num_user_contexts, "Set max number of user contexts to use (default: -1 will use the real (non-HT) CPU count)"); + + uint krcvqs[RXE_NUM_DATA_VL]; + int krcvqsset; +@@ -1209,30 +1209,49 @@ static void finalize_asic_data(struct hfi1_devdata *dd, + kfree(ad); + } + +-static void __hfi1_free_devdata(struct kobject *kobj) ++/** ++ * hfi1_clean_devdata - cleans up per-unit data structure ++ * @dd: pointer to a valid devdata structure ++ * ++ * It cleans up all data structures set up by ++ * by hfi1_alloc_devdata(). ++ */ ++static void hfi1_clean_devdata(struct hfi1_devdata *dd) + { +- struct hfi1_devdata *dd = +- container_of(kobj, struct hfi1_devdata, kobj); + struct hfi1_asic_data *ad; + unsigned long flags; + + spin_lock_irqsave(&hfi1_devs_lock, flags); +- idr_remove(&hfi1_unit_table, dd->unit); +- list_del(&dd->list); ++ if (!list_empty(&dd->list)) { ++ idr_remove(&hfi1_unit_table, dd->unit); ++ list_del_init(&dd->list); ++ } + ad = release_asic_data(dd); + spin_unlock_irqrestore(&hfi1_devs_lock, flags); +- if (ad) +- finalize_asic_data(dd, ad); ++ ++ finalize_asic_data(dd, ad); + free_platform_config(dd); + rcu_barrier(); /* wait for rcu callbacks to complete */ + free_percpu(dd->int_counter); + free_percpu(dd->rcv_limit); + free_percpu(dd->send_schedule); + free_percpu(dd->tx_opstats); ++ dd->int_counter = NULL; ++ dd->rcv_limit = NULL; ++ dd->send_schedule = NULL; ++ dd->tx_opstats = NULL; + sdma_clean(dd, dd->num_sdma); + rvt_dealloc_device(&dd->verbs_dev.rdi); + } + ++static void __hfi1_free_devdata(struct kobject *kobj) ++{ ++ struct hfi1_devdata *dd = ++ container_of(kobj, struct hfi1_devdata, kobj); ++ ++ hfi1_clean_devdata(dd); ++} ++ + static struct kobj_type hfi1_devdata_type = { + .release = __hfi1_free_devdata, + }; +@@ -1333,9 +1352,7 @@ struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra) + return dd; + + bail: +- if (!list_empty(&dd->list)) +- list_del_init(&dd->list); +- rvt_dealloc_device(&dd->verbs_dev.rdi); ++ hfi1_clean_devdata(dd); + return ERR_PTR(ret); + } + +diff --git a/drivers/infiniband/hw/hfi1/platform.c b/drivers/infiniband/hw/hfi1/platform.c +index d486355880cb..cbf7faa5038c 100644 +--- a/drivers/infiniband/hw/hfi1/platform.c ++++ b/drivers/infiniband/hw/hfi1/platform.c +@@ -199,6 +199,7 @@ void free_platform_config(struct hfi1_devdata *dd) + { + /* Release memory allocated for eprom or fallback file read. */ + kfree(dd->platform_config.data); ++ dd->platform_config.data = NULL; + } + + void get_port_type(struct hfi1_pportdata *ppd) +diff --git a/drivers/infiniband/hw/hfi1/qsfp.c b/drivers/infiniband/hw/hfi1/qsfp.c +index 1869f639c3ae..b5966991d647 100644 +--- a/drivers/infiniband/hw/hfi1/qsfp.c ++++ b/drivers/infiniband/hw/hfi1/qsfp.c +@@ -204,6 +204,8 @@ static void clean_i2c_bus(struct hfi1_i2c_bus *bus) + + void clean_up_i2c(struct hfi1_devdata *dd, struct hfi1_asic_data *ad) + { ++ if (!ad) ++ return; + clean_i2c_bus(ad->i2c_bus0); + ad->i2c_bus0 = NULL; + clean_i2c_bus(ad->i2c_bus1); +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index 0eeabfbee192..0d8c113083ad 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -912,7 +912,7 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev, + obj_per_chunk = buf_chunk_size / obj_size; + num_hem = (nobj + obj_per_chunk - 1) / obj_per_chunk; + bt_chunk_num = bt_chunk_size / 8; +- if (table->type >= HEM_TYPE_MTT) ++ if (type >= HEM_TYPE_MTT) + num_bt_l0 = bt_chunk_num; + + table->hem = kcalloc(num_hem, sizeof(*table->hem), +@@ -920,7 +920,7 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev, + if (!table->hem) + goto err_kcalloc_hem_buf; + +- if (check_whether_bt_num_3(table->type, hop_num)) { ++ if (check_whether_bt_num_3(type, hop_num)) { + unsigned long num_bt_l1; + + num_bt_l1 = (num_hem + bt_chunk_num - 1) / +@@ -939,8 +939,8 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev, + goto err_kcalloc_l1_dma; + } + +- if (check_whether_bt_num_2(table->type, hop_num) || +- check_whether_bt_num_3(table->type, hop_num)) { ++ if (check_whether_bt_num_2(type, hop_num) || ++ check_whether_bt_num_3(type, hop_num)) { + table->bt_l0 = kcalloc(num_bt_l0, sizeof(*table->bt_l0), + GFP_KERNEL); + if (!table->bt_l0) +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index ec638778661c..3d056c67a339 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -71,6 +71,11 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, struct ib_send_wr *wr, + return -EINVAL; + } + ++ if (wr->opcode == IB_WR_RDMA_READ) { ++ dev_err(hr_dev->dev, "Not support inline data!\n"); ++ return -EINVAL; ++ } ++ + for (i = 0; i < wr->num_sge; i++) { + memcpy(wqe, ((void *)wr->sg_list[i].addr), + wr->sg_list[i].length); +@@ -148,7 +153,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, + ibqp->qp_type != IB_QPT_GSI && + ibqp->qp_type != IB_QPT_UD)) { + dev_err(dev, "Not supported QP(0x%x)type!\n", ibqp->qp_type); +- *bad_wr = NULL; ++ *bad_wr = wr; + return -EOPNOTSUPP; + } + +@@ -456,6 +461,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, + } else { + dev_err(dev, "Illegal qp_type(0x%x)\n", ibqp->qp_type); + spin_unlock_irqrestore(&qp->sq.lock, flags); ++ *bad_wr = wr; + return -EOPNOTSUPP; + } + } +@@ -3161,7 +3167,8 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp, + (cur_state == IB_QPS_RTR && new_state == IB_QPS_ERR) || + (cur_state == IB_QPS_RTS && new_state == IB_QPS_ERR) || + (cur_state == IB_QPS_SQD && new_state == IB_QPS_ERR) || +- (cur_state == IB_QPS_SQE && new_state == IB_QPS_ERR)) { ++ (cur_state == IB_QPS_SQE && new_state == IB_QPS_ERR) || ++ (cur_state == IB_QPS_ERR && new_state == IB_QPS_ERR)) { + /* Nothing */ + ; + } else { +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index 4975f3e6596e..32fafa7700e3 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -346,7 +346,7 @@ int mlx4_ib_umem_calc_optimal_mtt_size(struct ib_umem *umem, u64 start_va, + /* Add to the first block the misalignment that it suffers from. */ + total_len += (first_block_start & ((1ULL << block_shift) - 1ULL)); + last_block_end = current_block_start + current_block_len; +- last_block_aligned_end = round_up(last_block_end, 1 << block_shift); ++ last_block_aligned_end = round_up(last_block_end, 1ULL << block_shift); + total_len += (last_block_aligned_end - last_block_end); + + if (total_len & ((1ULL << block_shift) - 1ULL)) +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index c14ed9cc9c9e..cf7b4bda8597 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -4833,9 +4833,7 @@ static void mlx5_ib_stage_cong_debugfs_cleanup(struct mlx5_ib_dev *dev) + static int mlx5_ib_stage_uar_init(struct mlx5_ib_dev *dev) + { + dev->mdev->priv.uar = mlx5_get_uars_page(dev->mdev); +- if (!dev->mdev->priv.uar) +- return -ENOMEM; +- return 0; ++ return PTR_ERR_OR_ZERO(dev->mdev->priv.uar); + } + + static void mlx5_ib_stage_uar_cleanup(struct mlx5_ib_dev *dev) +diff --git a/drivers/infiniband/sw/rxe/rxe_opcode.c b/drivers/infiniband/sw/rxe/rxe_opcode.c +index 61927c165b59..4cf11063e0b5 100644 +--- a/drivers/infiniband/sw/rxe/rxe_opcode.c ++++ b/drivers/infiniband/sw/rxe/rxe_opcode.c +@@ -390,7 +390,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NUM_OPCODE] = { + .name = "IB_OPCODE_RC_SEND_ONLY_INV", + .mask = RXE_IETH_MASK | RXE_PAYLOAD_MASK | RXE_REQ_MASK + | RXE_COMP_MASK | RXE_RWR_MASK | RXE_SEND_MASK +- | RXE_END_MASK, ++ | RXE_END_MASK | RXE_START_MASK, + .length = RXE_BTH_BYTES + RXE_IETH_BYTES, + .offset = { + [RXE_BTH] = 0, +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 7bdaf71b8221..785199990457 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -728,7 +728,6 @@ int rxe_requester(void *arg) + rollback_state(wqe, qp, &rollback_wqe, rollback_psn); + + if (ret == -EAGAIN) { +- kfree_skb(skb); + rxe_run_task(&qp->req.task, 1); + goto exit; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index d37bb9b97569..e319bd904d30 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -742,7 +742,6 @@ static enum resp_states read_reply(struct rxe_qp *qp, + err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb); + if (err) { + pr_err("Failed sending RDMA reply.\n"); +- kfree_skb(skb); + return RESPST_ERR_RNR; + } + +@@ -954,10 +953,8 @@ static int send_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt, + } + + err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb); +- if (err) { ++ if (err) + pr_err_ratelimited("Failed sending ack\n"); +- kfree_skb(skb); +- } + + err1: + return err; +@@ -1150,7 +1147,6 @@ static enum resp_states duplicate_request(struct rxe_qp *qp, + if (rc) { + pr_err("Failed resending result. This flow is not handled - skb ignored\n"); + rxe_drop_ref(qp); +- kfree_skb(skb_copy); + rc = RESPST_CLEANUP; + goto out; + } +diff --git a/drivers/infiniband/ulp/srp/Kconfig b/drivers/infiniband/ulp/srp/Kconfig +index c74ee9633041..99db8fe5173a 100644 +--- a/drivers/infiniband/ulp/srp/Kconfig ++++ b/drivers/infiniband/ulp/srp/Kconfig +@@ -1,6 +1,6 @@ + config INFINIBAND_SRP + tristate "InfiniBand SCSI RDMA Protocol" +- depends on SCSI ++ depends on SCSI && INFINIBAND_ADDR_TRANS + select SCSI_SRP_ATTRS + ---help--- + Support for the SCSI RDMA Protocol over InfiniBand. This +diff --git a/drivers/infiniband/ulp/srpt/Kconfig b/drivers/infiniband/ulp/srpt/Kconfig +index 31ee83d528d9..fb8b7182f05e 100644 +--- a/drivers/infiniband/ulp/srpt/Kconfig ++++ b/drivers/infiniband/ulp/srpt/Kconfig +@@ -1,6 +1,6 @@ + config INFINIBAND_SRPT + tristate "InfiniBand SCSI RDMA Protocol target support" +- depends on INFINIBAND && TARGET_CORE ++ depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE + ---help--- + + Support for the SCSI RDMA Protocol (SRP) Target driver. The +diff --git a/drivers/input/rmi4/rmi_spi.c b/drivers/input/rmi4/rmi_spi.c +index 76edbf2c1bce..082defc329a8 100644 +--- a/drivers/input/rmi4/rmi_spi.c ++++ b/drivers/input/rmi4/rmi_spi.c +@@ -147,8 +147,11 @@ static int rmi_spi_xfer(struct rmi_spi_xport *rmi_spi, + if (len > RMI_SPI_XFER_SIZE_LIMIT) + return -EINVAL; + +- if (rmi_spi->xfer_buf_size < len) +- rmi_spi_manage_pools(rmi_spi, len); ++ if (rmi_spi->xfer_buf_size < len) { ++ ret = rmi_spi_manage_pools(rmi_spi, len); ++ if (ret < 0) ++ return ret; ++ } + + if (addr == 0) + /* +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 429b694405c7..fc149ea64be7 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -275,7 +275,8 @@ struct mxt_data { + char phys[64]; /* device physical location */ + const struct mxt_platform_data *pdata; + struct mxt_object *object_table; +- struct mxt_info info; ++ struct mxt_info *info; ++ void *raw_info_block; + unsigned int irq; + unsigned int max_x; + unsigned int max_y; +@@ -450,12 +451,13 @@ static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry) + { + u8 appmode = data->client->addr; + u8 bootloader; ++ u8 family_id = data->info ? data->info->family_id : 0; + + switch (appmode) { + case 0x4a: + case 0x4b: + /* Chips after 1664S use different scheme */ +- if (retry || data->info.family_id >= 0xa2) { ++ if (retry || family_id >= 0xa2) { + bootloader = appmode - 0x24; + break; + } +@@ -682,7 +684,7 @@ mxt_get_object(struct mxt_data *data, u8 type) + struct mxt_object *object; + int i; + +- for (i = 0; i < data->info.object_num; i++) { ++ for (i = 0; i < data->info->object_num; i++) { + object = data->object_table + i; + if (object->type == type) + return object; +@@ -1453,12 +1455,12 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg) + data_pos += offset; + } + +- if (cfg_info.family_id != data->info.family_id) { ++ if (cfg_info.family_id != data->info->family_id) { + dev_err(dev, "Family ID mismatch!\n"); + return -EINVAL; + } + +- if (cfg_info.variant_id != data->info.variant_id) { ++ if (cfg_info.variant_id != data->info->variant_id) { + dev_err(dev, "Variant ID mismatch!\n"); + return -EINVAL; + } +@@ -1503,7 +1505,7 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg) + + /* Malloc memory to store configuration */ + cfg_start_ofs = MXT_OBJECT_START + +- data->info.object_num * sizeof(struct mxt_object) + ++ data->info->object_num * sizeof(struct mxt_object) + + MXT_INFO_CHECKSUM_SIZE; + config_mem_size = data->mem_size - cfg_start_ofs; + config_mem = kzalloc(config_mem_size, GFP_KERNEL); +@@ -1554,20 +1556,6 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg) + return ret; + } + +-static int mxt_get_info(struct mxt_data *data) +-{ +- struct i2c_client *client = data->client; +- struct mxt_info *info = &data->info; +- int error; +- +- /* Read 7-byte info block starting at address 0 */ +- error = __mxt_read_reg(client, 0, sizeof(*info), info); +- if (error) +- return error; +- +- return 0; +-} +- + static void mxt_free_input_device(struct mxt_data *data) + { + if (data->input_dev) { +@@ -1582,9 +1570,10 @@ static void mxt_free_object_table(struct mxt_data *data) + video_unregister_device(&data->dbg.vdev); + v4l2_device_unregister(&data->dbg.v4l2); + #endif +- +- kfree(data->object_table); + data->object_table = NULL; ++ data->info = NULL; ++ kfree(data->raw_info_block); ++ data->raw_info_block = NULL; + kfree(data->msg_buf); + data->msg_buf = NULL; + data->T5_address = 0; +@@ -1600,34 +1589,18 @@ static void mxt_free_object_table(struct mxt_data *data) + data->max_reportid = 0; + } + +-static int mxt_get_object_table(struct mxt_data *data) ++static int mxt_parse_object_table(struct mxt_data *data, ++ struct mxt_object *object_table) + { + struct i2c_client *client = data->client; +- size_t table_size; +- struct mxt_object *object_table; +- int error; + int i; + u8 reportid; + u16 end_address; + +- table_size = data->info.object_num * sizeof(struct mxt_object); +- object_table = kzalloc(table_size, GFP_KERNEL); +- if (!object_table) { +- dev_err(&data->client->dev, "Failed to allocate memory\n"); +- return -ENOMEM; +- } +- +- error = __mxt_read_reg(client, MXT_OBJECT_START, table_size, +- object_table); +- if (error) { +- kfree(object_table); +- return error; +- } +- + /* Valid Report IDs start counting from 1 */ + reportid = 1; + data->mem_size = 0; +- for (i = 0; i < data->info.object_num; i++) { ++ for (i = 0; i < data->info->object_num; i++) { + struct mxt_object *object = object_table + i; + u8 min_id, max_id; + +@@ -1651,8 +1624,8 @@ static int mxt_get_object_table(struct mxt_data *data) + + switch (object->type) { + case MXT_GEN_MESSAGE_T5: +- if (data->info.family_id == 0x80 && +- data->info.version < 0x20) { ++ if (data->info->family_id == 0x80 && ++ data->info->version < 0x20) { + /* + * On mXT224 firmware versions prior to V2.0 + * read and discard unused CRC byte otherwise +@@ -1707,24 +1680,102 @@ static int mxt_get_object_table(struct mxt_data *data) + /* If T44 exists, T5 position has to be directly after */ + if (data->T44_address && (data->T5_address != data->T44_address + 1)) { + dev_err(&client->dev, "Invalid T44 position\n"); +- error = -EINVAL; +- goto free_object_table; ++ return -EINVAL; + } + + data->msg_buf = kcalloc(data->max_reportid, + data->T5_msg_size, GFP_KERNEL); +- if (!data->msg_buf) { +- dev_err(&client->dev, "Failed to allocate message buffer\n"); ++ if (!data->msg_buf) ++ return -ENOMEM; ++ ++ return 0; ++} ++ ++static int mxt_read_info_block(struct mxt_data *data) ++{ ++ struct i2c_client *client = data->client; ++ int error; ++ size_t size; ++ void *id_buf, *buf; ++ uint8_t num_objects; ++ u32 calculated_crc; ++ u8 *crc_ptr; ++ ++ /* If info block already allocated, free it */ ++ if (data->raw_info_block) ++ mxt_free_object_table(data); ++ ++ /* Read 7-byte ID information block starting at address 0 */ ++ size = sizeof(struct mxt_info); ++ id_buf = kzalloc(size, GFP_KERNEL); ++ if (!id_buf) ++ return -ENOMEM; ++ ++ error = __mxt_read_reg(client, 0, size, id_buf); ++ if (error) ++ goto err_free_mem; ++ ++ /* Resize buffer to give space for rest of info block */ ++ num_objects = ((struct mxt_info *)id_buf)->object_num; ++ size += (num_objects * sizeof(struct mxt_object)) ++ + MXT_INFO_CHECKSUM_SIZE; ++ ++ buf = krealloc(id_buf, size, GFP_KERNEL); ++ if (!buf) { + error = -ENOMEM; +- goto free_object_table; ++ goto err_free_mem; ++ } ++ id_buf = buf; ++ ++ /* Read rest of info block */ ++ error = __mxt_read_reg(client, MXT_OBJECT_START, ++ size - MXT_OBJECT_START, ++ id_buf + MXT_OBJECT_START); ++ if (error) ++ goto err_free_mem; ++ ++ /* Extract & calculate checksum */ ++ crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE; ++ data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16); ++ ++ calculated_crc = mxt_calculate_crc(id_buf, 0, ++ size - MXT_INFO_CHECKSUM_SIZE); ++ ++ /* ++ * CRC mismatch can be caused by data corruption due to I2C comms ++ * issue or else device is not using Object Based Protocol (eg i2c-hid) ++ */ ++ if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) { ++ dev_err(&client->dev, ++ "Info Block CRC error calculated=0x%06X read=0x%06X\n", ++ calculated_crc, data->info_crc); ++ error = -EIO; ++ goto err_free_mem; ++ } ++ ++ data->raw_info_block = id_buf; ++ data->info = (struct mxt_info *)id_buf; ++ ++ dev_info(&client->dev, ++ "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n", ++ data->info->family_id, data->info->variant_id, ++ data->info->version >> 4, data->info->version & 0xf, ++ data->info->build, data->info->object_num); ++ ++ /* Parse object table information */ ++ error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START); ++ if (error) { ++ dev_err(&client->dev, "Error %d parsing object table\n", error); ++ mxt_free_object_table(data); ++ goto err_free_mem; + } + +- data->object_table = object_table; ++ data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START); + + return 0; + +-free_object_table: +- mxt_free_object_table(data); ++err_free_mem: ++ kfree(id_buf); + return error; + } + +@@ -2039,7 +2090,7 @@ static int mxt_initialize(struct mxt_data *data) + int error; + + while (1) { +- error = mxt_get_info(data); ++ error = mxt_read_info_block(data); + if (!error) + break; + +@@ -2070,16 +2121,9 @@ static int mxt_initialize(struct mxt_data *data) + msleep(MXT_FW_RESET_TIME); + } + +- /* Get object table information */ +- error = mxt_get_object_table(data); +- if (error) { +- dev_err(&client->dev, "Error %d reading object table\n", error); +- return error; +- } +- + error = mxt_acquire_irq(data); + if (error) +- goto err_free_object_table; ++ return error; + + error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME, + &client->dev, GFP_KERNEL, data, +@@ -2087,14 +2131,10 @@ static int mxt_initialize(struct mxt_data *data) + if (error) { + dev_err(&client->dev, "Failed to invoke firmware loader: %d\n", + error); +- goto err_free_object_table; ++ return error; + } + + return 0; +- +-err_free_object_table: +- mxt_free_object_table(data); +- return error; + } + + static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep) +@@ -2155,7 +2195,7 @@ static int mxt_init_t7_power_cfg(struct mxt_data *data) + static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x, + unsigned int y) + { +- struct mxt_info *info = &data->info; ++ struct mxt_info *info = data->info; + struct mxt_dbg *dbg = &data->dbg; + unsigned int ofs, page; + unsigned int col = 0; +@@ -2483,7 +2523,7 @@ static const struct video_device mxt_video_device = { + + static void mxt_debug_init(struct mxt_data *data) + { +- struct mxt_info *info = &data->info; ++ struct mxt_info *info = data->info; + struct mxt_dbg *dbg = &data->dbg; + struct mxt_object *object; + int error; +@@ -2569,7 +2609,6 @@ static int mxt_configure_objects(struct mxt_data *data, + const struct firmware *cfg) + { + struct device *dev = &data->client->dev; +- struct mxt_info *info = &data->info; + int error; + + error = mxt_init_t7_power_cfg(data); +@@ -2594,11 +2633,6 @@ static int mxt_configure_objects(struct mxt_data *data, + + mxt_debug_init(data); + +- dev_info(dev, +- "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n", +- info->family_id, info->variant_id, info->version >> 4, +- info->version & 0xf, info->build, info->object_num); +- + return 0; + } + +@@ -2607,7 +2641,7 @@ static ssize_t mxt_fw_version_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct mxt_data *data = dev_get_drvdata(dev); +- struct mxt_info *info = &data->info; ++ struct mxt_info *info = data->info; + return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n", + info->version >> 4, info->version & 0xf, info->build); + } +@@ -2617,7 +2651,7 @@ static ssize_t mxt_hw_version_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct mxt_data *data = dev_get_drvdata(dev); +- struct mxt_info *info = &data->info; ++ struct mxt_info *info = data->info; + return scnprintf(buf, PAGE_SIZE, "%u.%u\n", + info->family_id, info->variant_id); + } +@@ -2656,7 +2690,7 @@ static ssize_t mxt_object_show(struct device *dev, + return -ENOMEM; + + error = 0; +- for (i = 0; i < data->info.object_num; i++) { ++ for (i = 0; i < data->info->object_num; i++) { + object = data->object_table + i; + + if (!mxt_object_readable(object->type)) +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index 9a7ffd13c7f0..4e3e3d2f51c8 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -1345,7 +1345,7 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, + struct qi_desc desc; + + if (mask) { +- BUG_ON(addr & ((1 << (VTD_PAGE_SHIFT + mask)) - 1)); ++ BUG_ON(addr & ((1ULL << (VTD_PAGE_SHIFT + mask)) - 1)); + addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1; + desc.high = QI_DEV_IOTLB_ADDR(addr) | QI_DEV_IOTLB_SIZE; + } else +diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c +index 66f69af2c219..3062a154a9fb 100644 +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -1136,7 +1136,7 @@ static void intel_ir_reconfigure_irte(struct irq_data *irqd, bool force) + irte->dest_id = IRTE_DEST(cfg->dest_apicid); + + /* Update the hardware only if the interrupt is in remapped mode. */ +- if (!force || ir_data->irq_2_iommu.mode == IRQ_REMAPPING) ++ if (force || ir_data->irq_2_iommu.mode == IRQ_REMAPPING) + modify_irte(&ir_data->irq_2_iommu, irte); + } + +diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c +index 87c34f607a75..f47678be6383 100644 +--- a/drivers/mtd/onenand/omap2.c ++++ b/drivers/mtd/onenand/omap2.c +@@ -377,56 +377,42 @@ static int omap2_onenand_read_bufferram(struct mtd_info *mtd, int area, + { + struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd); + struct onenand_chip *this = mtd->priv; +- dma_addr_t dma_src, dma_dst; +- int bram_offset; ++ struct device *dev = &c->pdev->dev; + void *buf = (void *)buffer; ++ dma_addr_t dma_src, dma_dst; ++ int bram_offset, err; + size_t xtra; +- int ret; + + bram_offset = omap2_onenand_bufferram_offset(mtd, area) + area + offset; +- if (bram_offset & 3 || (size_t)buf & 3 || count < 384) +- goto out_copy; +- +- /* panic_write() may be in an interrupt context */ +- if (in_interrupt() || oops_in_progress) ++ /* ++ * If the buffer address is not DMA-able, len is not long enough to make ++ * DMA transfers profitable or panic_write() may be in an interrupt ++ * context fallback to PIO mode. ++ */ ++ if (!virt_addr_valid(buf) || bram_offset & 3 || (size_t)buf & 3 || ++ count < 384 || in_interrupt() || oops_in_progress ) + goto out_copy; + +- if (buf >= high_memory) { +- struct page *p1; +- +- if (((size_t)buf & PAGE_MASK) != +- ((size_t)(buf + count - 1) & PAGE_MASK)) +- goto out_copy; +- p1 = vmalloc_to_page(buf); +- if (!p1) +- goto out_copy; +- buf = page_address(p1) + ((size_t)buf & ~PAGE_MASK); +- } +- + xtra = count & 3; + if (xtra) { + count -= xtra; + memcpy(buf + count, this->base + bram_offset + count, xtra); + } + ++ dma_dst = dma_map_single(dev, buf, count, DMA_FROM_DEVICE); + dma_src = c->phys_base + bram_offset; +- dma_dst = dma_map_single(&c->pdev->dev, buf, count, DMA_FROM_DEVICE); +- if (dma_mapping_error(&c->pdev->dev, dma_dst)) { +- dev_err(&c->pdev->dev, +- "Couldn't DMA map a %d byte buffer\n", +- count); +- goto out_copy; +- } + +- ret = omap2_onenand_dma_transfer(c, dma_src, dma_dst, count); +- dma_unmap_single(&c->pdev->dev, dma_dst, count, DMA_FROM_DEVICE); +- +- if (ret) { +- dev_err(&c->pdev->dev, "timeout waiting for DMA\n"); ++ if (dma_mapping_error(dev, dma_dst)) { ++ dev_err(dev, "Couldn't DMA map a %d byte buffer\n", count); + goto out_copy; + } + +- return 0; ++ err = omap2_onenand_dma_transfer(c, dma_src, dma_dst, count); ++ dma_unmap_single(dev, dma_dst, count, DMA_FROM_DEVICE); ++ if (!err) ++ return 0; ++ ++ dev_err(dev, "timeout waiting for DMA\n"); + + out_copy: + memcpy(buf, this->base + bram_offset, count); +@@ -439,49 +425,34 @@ static int omap2_onenand_write_bufferram(struct mtd_info *mtd, int area, + { + struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd); + struct onenand_chip *this = mtd->priv; +- dma_addr_t dma_src, dma_dst; +- int bram_offset; ++ struct device *dev = &c->pdev->dev; + void *buf = (void *)buffer; +- int ret; ++ dma_addr_t dma_src, dma_dst; ++ int bram_offset, err; + + bram_offset = omap2_onenand_bufferram_offset(mtd, area) + area + offset; +- if (bram_offset & 3 || (size_t)buf & 3 || count < 384) +- goto out_copy; +- +- /* panic_write() may be in an interrupt context */ +- if (in_interrupt() || oops_in_progress) ++ /* ++ * If the buffer address is not DMA-able, len is not long enough to make ++ * DMA transfers profitable or panic_write() may be in an interrupt ++ * context fallback to PIO mode. ++ */ ++ if (!virt_addr_valid(buf) || bram_offset & 3 || (size_t)buf & 3 || ++ count < 384 || in_interrupt() || oops_in_progress ) + goto out_copy; + +- if (buf >= high_memory) { +- struct page *p1; +- +- if (((size_t)buf & PAGE_MASK) != +- ((size_t)(buf + count - 1) & PAGE_MASK)) +- goto out_copy; +- p1 = vmalloc_to_page(buf); +- if (!p1) +- goto out_copy; +- buf = page_address(p1) + ((size_t)buf & ~PAGE_MASK); +- } +- +- dma_src = dma_map_single(&c->pdev->dev, buf, count, DMA_TO_DEVICE); ++ dma_src = dma_map_single(dev, buf, count, DMA_TO_DEVICE); + dma_dst = c->phys_base + bram_offset; +- if (dma_mapping_error(&c->pdev->dev, dma_src)) { +- dev_err(&c->pdev->dev, +- "Couldn't DMA map a %d byte buffer\n", +- count); +- return -1; +- } +- +- ret = omap2_onenand_dma_transfer(c, dma_src, dma_dst, count); +- dma_unmap_single(&c->pdev->dev, dma_src, count, DMA_TO_DEVICE); +- +- if (ret) { +- dev_err(&c->pdev->dev, "timeout waiting for DMA\n"); ++ if (dma_mapping_error(dev, dma_src)) { ++ dev_err(dev, "Couldn't DMA map a %d byte buffer\n", count); + goto out_copy; + } + +- return 0; ++ err = omap2_onenand_dma_transfer(c, dma_src, dma_dst, count); ++ dma_unmap_page(dev, dma_src, count, DMA_TO_DEVICE); ++ if (!err) ++ return 0; ++ ++ dev_err(dev, "timeout waiting for DMA\n"); + + out_copy: + memcpy(this->base + bram_offset, buf, count); +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index b1779566c5bb..3c71f1cb205f 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -605,7 +605,7 @@ void can_bus_off(struct net_device *dev) + { + struct can_priv *priv = netdev_priv(dev); + +- netdev_dbg(dev, "bus-off\n"); ++ netdev_info(dev, "bus-off\n"); + + netif_carrier_off(dev); + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index 32f6d2e24d66..1a1a6380c128 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -95,6 +95,7 @@ void aq_nic_cfg_start(struct aq_nic_s *self) + /*rss rings */ + cfg->vecs = min(cfg->aq_hw_caps->vecs, AQ_CFG_VECS_DEF); + cfg->vecs = min(cfg->vecs, num_online_cpus()); ++ cfg->vecs = min(cfg->vecs, self->irqvecs); + /* cfg->vecs should be power of 2 for RSS */ + if (cfg->vecs >= 8U) + cfg->vecs = 8U; +@@ -246,6 +247,8 @@ void aq_nic_ndev_init(struct aq_nic_s *self) + + self->ndev->hw_features |= aq_hw_caps->hw_features; + self->ndev->features = aq_hw_caps->hw_features; ++ self->ndev->vlan_features |= NETIF_F_HW_CSUM | NETIF_F_RXCSUM | ++ NETIF_F_RXHASH | NETIF_F_SG | NETIF_F_LRO; + self->ndev->priv_flags = aq_hw_caps->hw_priv_flags; + self->ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE; + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h +index 219b550d1665..faa533a0ec47 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h +@@ -80,6 +80,7 @@ struct aq_nic_s { + + struct pci_dev *pdev; + unsigned int msix_entry_mask; ++ u32 irqvecs; + }; + + static inline struct device *aq_nic_get_dev(struct aq_nic_s *self) +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +index ecc6306f940f..750007513f9d 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -267,16 +267,15 @@ static int aq_pci_probe(struct pci_dev *pdev, + numvecs = min(numvecs, num_online_cpus()); + /*enable interrupts */ + #if !AQ_CFG_FORCE_LEGACY_INT +- err = pci_alloc_irq_vectors(self->pdev, numvecs, numvecs, +- PCI_IRQ_MSIX); +- +- if (err < 0) { +- err = pci_alloc_irq_vectors(self->pdev, 1, 1, +- PCI_IRQ_MSI | PCI_IRQ_LEGACY); +- if (err < 0) +- goto err_hwinit; +- } ++ err = pci_alloc_irq_vectors(self->pdev, 1, numvecs, ++ PCI_IRQ_MSIX | PCI_IRQ_MSI | ++ PCI_IRQ_LEGACY); ++ ++ if (err < 0) ++ goto err_hwinit; ++ numvecs = err; + #endif ++ self->irqvecs = numvecs; + + /* net device init */ + aq_nic_cfg_start(self); +@@ -298,9 +297,9 @@ static int aq_pci_probe(struct pci_dev *pdev, + kfree(self->aq_hw); + err_ioremap: + free_netdev(ndev); +-err_pci_func: +- pci_release_regions(pdev); + err_ndev: ++ pci_release_regions(pdev); ++err_pci_func: + pci_disable_device(pdev); + return err; + } +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +index 57dcb957f27c..e95fb6b43187 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +@@ -5191,6 +5191,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + } + spin_lock_init(&adapter->mbox_lock); + INIT_LIST_HEAD(&adapter->mlist.list); ++ adapter->mbox_log->size = T4_OS_LOG_MBOX_CMDS; + pci_set_drvdata(pdev, adapter); + + if (func != ent->driver_data) { +@@ -5225,8 +5226,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + goto out_free_adapter; + } + +- adapter->mbox_log->size = T4_OS_LOG_MBOX_CMDS; +- + /* PCI device has been enabled */ + adapter->flags |= DEV_ENABLED; + memset(adapter->chan_map, 0xff, sizeof(adapter->chan_map)); +diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h +index 3e62692af011..fa5b30f547f6 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hnae.h ++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h +@@ -87,7 +87,7 @@ do { \ + + #define HNAE_AE_REGISTER 0x1 + +-#define RCB_RING_NAME_LEN 16 ++#define RCB_RING_NAME_LEN (IFNAMSIZ + 4) + + #define HNAE_LOWEST_LATENCY_COAL_PARAM 30 + #define HNAE_LOW_LATENCY_COAL_PARAM 80 +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index fd8e6937ee00..cd6d08399970 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1711,7 +1711,8 @@ static int do_reset(struct ibmvnic_adapter *adapter, + for (i = 0; i < adapter->req_rx_queues; i++) + napi_schedule(&adapter->napi[i]); + +- if (adapter->reset_reason != VNIC_RESET_FAILOVER) ++ if (adapter->reset_reason != VNIC_RESET_FAILOVER && ++ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM) + netdev_notify_peers(netdev); + + netif_carrier_on(netdev); +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index b88fae785369..33a052174c0f 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -1698,7 +1698,22 @@ static void igb_configure_cbs(struct igb_adapter *adapter, int queue, + WARN_ON(hw->mac.type != e1000_i210); + WARN_ON(queue < 0 || queue > 1); + +- if (enable) { ++ if (enable || queue == 0) { ++ /* i210 does not allow the queue 0 to be in the Strict ++ * Priority mode while the Qav mode is enabled, so, ++ * instead of disabling strict priority mode, we give ++ * queue 0 the maximum of credits possible. ++ * ++ * See section 8.12.19 of the i210 datasheet, "Note: ++ * Queue0 QueueMode must be set to 1b when ++ * TransmitMode is set to Qav." ++ */ ++ if (queue == 0 && !enable) { ++ /* max "linkspeed" idleslope in kbps */ ++ idleslope = 1000000; ++ hicredit = ETH_FRAME_LEN; ++ } ++ + set_tx_desc_fetch_prio(hw, queue, TX_QUEUE_PRIO_HIGH); + set_queue_mode(hw, queue, QUEUE_MODE_STREAM_RESERVATION); + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +index 93eacddb6704..336562a0685d 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +@@ -918,8 +918,8 @@ void ixgbe_init_ipsec_offload(struct ixgbe_adapter *adapter) + kfree(ipsec->ip_tbl); + kfree(ipsec->rx_tbl); + kfree(ipsec->tx_tbl); ++ kfree(ipsec); + err1: +- kfree(adapter->ipsec); + netdev_err(adapter->netdev, "Unable to allocate memory for SA tables"); + } + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c +index f470d0204771..14e3a801390b 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c +@@ -3427,6 +3427,9 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw) + hw->phy.sfp_setup_needed = false; + } + ++ if (status == IXGBE_ERR_SFP_NOT_SUPPORTED) ++ return status; ++ + /* Reset PHY */ + if (!hw->phy.reset_disable && hw->phy.ops.reset) + hw->phy.ops.reset(hw); +diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c +index 7f1083ce23da..7f5b9b6bf007 100644 +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -8332,12 +8332,12 @@ static int mvpp2_probe(struct platform_device *pdev) + if (IS_ERR(priv->axi_clk)) { + err = PTR_ERR(priv->axi_clk); + if (err == -EPROBE_DEFER) +- goto err_gop_clk; ++ goto err_mg_clk; + priv->axi_clk = NULL; + } else { + err = clk_prepare_enable(priv->axi_clk); + if (err < 0) +- goto err_gop_clk; ++ goto err_mg_clk; + } + + /* Get system's tclk rate */ +@@ -8351,7 +8351,7 @@ static int mvpp2_probe(struct platform_device *pdev) + if (priv->hw_version == MVPP22) { + err = dma_set_mask(&pdev->dev, MVPP2_DESC_DMA_MASK); + if (err) +- goto err_mg_clk; ++ goto err_axi_clk; + /* Sadly, the BM pools all share the same register to + * store the high 32 bits of their address. So they + * must all have the same high 32 bits, which forces +@@ -8359,14 +8359,14 @@ static int mvpp2_probe(struct platform_device *pdev) + */ + err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (err) +- goto err_mg_clk; ++ goto err_axi_clk; + } + + /* Initialize network controller */ + err = mvpp2_init(pdev, priv); + if (err < 0) { + dev_err(&pdev->dev, "failed to initialize controller\n"); +- goto err_mg_clk; ++ goto err_axi_clk; + } + + /* Initialize ports */ +@@ -8379,7 +8379,7 @@ static int mvpp2_probe(struct platform_device *pdev) + if (priv->port_count == 0) { + dev_err(&pdev->dev, "no ports enabled\n"); + err = -ENODEV; +- goto err_mg_clk; ++ goto err_axi_clk; + } + + /* Statistics must be gathered regularly because some of them (like +@@ -8407,8 +8407,9 @@ static int mvpp2_probe(struct platform_device *pdev) + mvpp2_port_remove(priv->port_list[i]); + i++; + } +-err_mg_clk: ++err_axi_clk: + clk_disable_unprepare(priv->axi_clk); ++err_mg_clk: + if (priv->hw_version == MVPP22) + clk_disable_unprepare(priv->mg_clk); + err_gop_clk: +diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c +index baaea6f1a9d8..6409957e1657 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c +@@ -242,18 +242,49 @@ nfp_flower_cmsg_process_one_rx(struct nfp_app *app, struct sk_buff *skb) + + void nfp_flower_cmsg_process_rx(struct work_struct *work) + { ++ struct sk_buff_head cmsg_joined; + struct nfp_flower_priv *priv; + struct sk_buff *skb; + + priv = container_of(work, struct nfp_flower_priv, cmsg_work); ++ skb_queue_head_init(&cmsg_joined); + +- while ((skb = skb_dequeue(&priv->cmsg_skbs))) ++ spin_lock_bh(&priv->cmsg_skbs_high.lock); ++ skb_queue_splice_tail_init(&priv->cmsg_skbs_high, &cmsg_joined); ++ spin_unlock_bh(&priv->cmsg_skbs_high.lock); ++ ++ spin_lock_bh(&priv->cmsg_skbs_low.lock); ++ skb_queue_splice_tail_init(&priv->cmsg_skbs_low, &cmsg_joined); ++ spin_unlock_bh(&priv->cmsg_skbs_low.lock); ++ ++ while ((skb = __skb_dequeue(&cmsg_joined))) + nfp_flower_cmsg_process_one_rx(priv->app, skb); + } + +-void nfp_flower_cmsg_rx(struct nfp_app *app, struct sk_buff *skb) ++static void ++nfp_flower_queue_ctl_msg(struct nfp_app *app, struct sk_buff *skb, int type) + { + struct nfp_flower_priv *priv = app->priv; ++ struct sk_buff_head *skb_head; ++ ++ if (type == NFP_FLOWER_CMSG_TYPE_PORT_REIFY || ++ type == NFP_FLOWER_CMSG_TYPE_PORT_MOD) ++ skb_head = &priv->cmsg_skbs_high; ++ else ++ skb_head = &priv->cmsg_skbs_low; ++ ++ if (skb_queue_len(skb_head) >= NFP_FLOWER_WORKQ_MAX_SKBS) { ++ nfp_flower_cmsg_warn(app, "Dropping queued control messages\n"); ++ dev_kfree_skb_any(skb); ++ return; ++ } ++ ++ skb_queue_tail(skb_head, skb); ++ schedule_work(&priv->cmsg_work); ++} ++ ++void nfp_flower_cmsg_rx(struct nfp_app *app, struct sk_buff *skb) ++{ + struct nfp_flower_cmsg_hdr *cmsg_hdr; + + cmsg_hdr = nfp_flower_cmsg_get_hdr(skb); +@@ -270,7 +301,6 @@ void nfp_flower_cmsg_rx(struct nfp_app *app, struct sk_buff *skb) + nfp_flower_rx_flow_stats(app, skb); + dev_consume_skb_any(skb); + } else { +- skb_queue_tail(&priv->cmsg_skbs, skb); +- schedule_work(&priv->cmsg_work); ++ nfp_flower_queue_ctl_msg(app, skb, cmsg_hdr->type); + } + } +diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h +index 329a9b6d453a..343f9117fb57 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h ++++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h +@@ -98,6 +98,8 @@ + #define NFP_FL_IPV4_TUNNEL_TYPE GENMASK(7, 4) + #define NFP_FL_IPV4_PRE_TUN_INDEX GENMASK(2, 0) + ++#define NFP_FLOWER_WORKQ_MAX_SKBS 30000 ++ + #define nfp_flower_cmsg_warn(app, fmt, args...) \ + do { \ + if (net_ratelimit()) \ +diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c +index 742d6f1575b5..646fc97f1f0b 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/main.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/main.c +@@ -358,7 +358,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv) + } + + SET_NETDEV_DEV(repr, &priv->nn->pdev->dev); +- nfp_net_get_mac_addr(app->pf, port); ++ nfp_net_get_mac_addr(app->pf, repr, port); + + cmsg_port_id = nfp_flower_cmsg_phys_port(phys_port); + err = nfp_repr_init(app, repr, +@@ -517,7 +517,8 @@ static int nfp_flower_init(struct nfp_app *app) + + app->priv = app_priv; + app_priv->app = app; +- skb_queue_head_init(&app_priv->cmsg_skbs); ++ skb_queue_head_init(&app_priv->cmsg_skbs_high); ++ skb_queue_head_init(&app_priv->cmsg_skbs_low); + INIT_WORK(&app_priv->cmsg_work, nfp_flower_cmsg_process_rx); + init_waitqueue_head(&app_priv->reify_wait_queue); + +@@ -544,7 +545,8 @@ static void nfp_flower_clean(struct nfp_app *app) + { + struct nfp_flower_priv *app_priv = app->priv; + +- skb_queue_purge(&app_priv->cmsg_skbs); ++ skb_queue_purge(&app_priv->cmsg_skbs_high); ++ skb_queue_purge(&app_priv->cmsg_skbs_low); + flush_work(&app_priv->cmsg_work); + + nfp_flower_metadata_cleanup(app); +diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h b/drivers/net/ethernet/netronome/nfp/flower/main.h +index 332ff0fdc038..1eca582c5846 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/main.h ++++ b/drivers/net/ethernet/netronome/nfp/flower/main.h +@@ -89,7 +89,10 @@ struct nfp_fl_stats_id { + * @mask_table: Hash table used to store masks + * @flow_table: Hash table used to store flower rules + * @cmsg_work: Workqueue for control messages processing +- * @cmsg_skbs: List of skbs for control message processing ++ * @cmsg_skbs_high: List of higher priority skbs for control message ++ * processing ++ * @cmsg_skbs_low: List of lower priority skbs for control message ++ * processing + * @nfp_mac_off_list: List of MAC addresses to offload + * @nfp_mac_index_list: List of unique 8-bit indexes for non NFP netdevs + * @nfp_ipv4_off_list: List of IPv4 addresses to offload +@@ -117,7 +120,8 @@ struct nfp_flower_priv { + DECLARE_HASHTABLE(mask_table, NFP_FLOWER_MASK_HASH_BITS); + DECLARE_HASHTABLE(flow_table, NFP_FLOWER_HASH_BITS); + struct work_struct cmsg_work; +- struct sk_buff_head cmsg_skbs; ++ struct sk_buff_head cmsg_skbs_high; ++ struct sk_buff_head cmsg_skbs_low; + struct list_head nfp_mac_off_list; + struct list_head nfp_mac_index_list; + struct list_head nfp_ipv4_off_list; +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c +index 2a2f2fbc8850..b9618c37403f 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c +@@ -69,7 +69,7 @@ int nfp_app_nic_vnic_alloc(struct nfp_app *app, struct nfp_net *nn, + if (err) + return err < 0 ? err : 0; + +- nfp_net_get_mac_addr(app->pf, nn->port); ++ nfp_net_get_mac_addr(app->pf, nn->dp.netdev, nn->port); + + return 0; + } +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.h b/drivers/net/ethernet/netronome/nfp/nfp_main.h +index add46e28212b..42211083b51f 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_main.h ++++ b/drivers/net/ethernet/netronome/nfp/nfp_main.h +@@ -171,7 +171,9 @@ void nfp_net_pci_remove(struct nfp_pf *pf); + int nfp_hwmon_register(struct nfp_pf *pf); + void nfp_hwmon_unregister(struct nfp_pf *pf); + +-void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port); ++void ++nfp_net_get_mac_addr(struct nfp_pf *pf, struct net_device *netdev, ++ struct nfp_port *port); + + bool nfp_ctrl_tx(struct nfp_net *nn, struct sk_buff *skb); + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c +index 15fa47f622aa..45cd2092e498 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c +@@ -67,23 +67,26 @@ + /** + * nfp_net_get_mac_addr() - Get the MAC address. + * @pf: NFP PF handle ++ * @netdev: net_device to set MAC address on + * @port: NFP port structure + * + * First try to get the MAC address from NSP ETH table. If that + * fails generate a random address. + */ +-void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port) ++void ++nfp_net_get_mac_addr(struct nfp_pf *pf, struct net_device *netdev, ++ struct nfp_port *port) + { + struct nfp_eth_table_port *eth_port; + + eth_port = __nfp_port_get_eth_port(port); + if (!eth_port) { +- eth_hw_addr_random(port->netdev); ++ eth_hw_addr_random(netdev); + return; + } + +- ether_addr_copy(port->netdev->dev_addr, eth_port->mac_addr); +- ether_addr_copy(port->netdev->perm_addr, eth_port->mac_addr); ++ ether_addr_copy(netdev->dev_addr, eth_port->mac_addr); ++ ether_addr_copy(netdev->perm_addr, eth_port->mac_addr); + } + + static struct nfp_eth_table_port * +@@ -511,16 +514,18 @@ static int nfp_net_pci_map_mem(struct nfp_pf *pf) + return PTR_ERR(mem); + } + +- min_size = NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index + 1); +- pf->mac_stats_mem = nfp_rtsym_map(pf->rtbl, "_mac_stats", +- "net.macstats", min_size, +- &pf->mac_stats_bar); +- if (IS_ERR(pf->mac_stats_mem)) { +- if (PTR_ERR(pf->mac_stats_mem) != -ENOENT) { +- err = PTR_ERR(pf->mac_stats_mem); +- goto err_unmap_ctrl; ++ if (pf->eth_tbl) { ++ min_size = NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index + 1); ++ pf->mac_stats_mem = nfp_rtsym_map(pf->rtbl, "_mac_stats", ++ "net.macstats", min_size, ++ &pf->mac_stats_bar); ++ if (IS_ERR(pf->mac_stats_mem)) { ++ if (PTR_ERR(pf->mac_stats_mem) != -ENOENT) { ++ err = PTR_ERR(pf->mac_stats_mem); ++ goto err_unmap_ctrl; ++ } ++ pf->mac_stats_mem = NULL; + } +- pf->mac_stats_mem = NULL; + } + + pf->vf_cfg_mem = nfp_net_pf_map_rtsym(pf, "net.vfcfg", +diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +index 99bb679a9801..2abee0fe3a7c 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c ++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +@@ -281,8 +281,7 @@ nfp_nsp_wait_reg(struct nfp_cpp *cpp, u64 *reg, u32 nsp_cpp, u64 addr, + if ((*reg & mask) == val) + return 0; + +- if (msleep_interruptible(25)) +- return -ERESTARTSYS; ++ msleep(25); + + if (time_after(start_time, wait_until)) + return -ETIMEDOUT; +diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c +index 893ef08a4b39..eaf50e6af6b3 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c +@@ -115,8 +115,7 @@ int qed_l2_alloc(struct qed_hwfn *p_hwfn) + + void qed_l2_setup(struct qed_hwfn *p_hwfn) + { +- if (p_hwfn->hw_info.personality != QED_PCI_ETH && +- p_hwfn->hw_info.personality != QED_PCI_ETH_ROCE) ++ if (!QED_IS_L2_PERSONALITY(p_hwfn)) + return; + + mutex_init(&p_hwfn->p_l2_info->lock); +@@ -126,8 +125,7 @@ void qed_l2_free(struct qed_hwfn *p_hwfn) + { + u32 i; + +- if (p_hwfn->hw_info.personality != QED_PCI_ETH && +- p_hwfn->hw_info.personality != QED_PCI_ETH_ROCE) ++ if (!QED_IS_L2_PERSONALITY(p_hwfn)) + return; + + if (!p_hwfn->p_l2_info) +diff --git a/drivers/net/ethernet/qlogic/qede/qede_rdma.c b/drivers/net/ethernet/qlogic/qede/qede_rdma.c +index 50b142fad6b8..1900bf7e67d1 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_rdma.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_rdma.c +@@ -238,7 +238,7 @@ qede_rdma_get_free_event_node(struct qede_dev *edev) + } + + if (!found) { +- event_node = kzalloc(sizeof(*event_node), GFP_KERNEL); ++ event_node = kzalloc(sizeof(*event_node), GFP_ATOMIC); + if (!event_node) { + DP_NOTICE(edev, + "qedr: Could not allocate memory for rdma work\n"); +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index 3bb6b66dc7bf..f9c25912eb98 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -720,6 +720,15 @@ static struct phy_driver broadcom_drivers[] = { + .get_strings = bcm_phy_get_strings, + .get_stats = bcm53xx_phy_get_stats, + .probe = bcm53xx_phy_probe, ++}, { ++ .phy_id = PHY_ID_BCM89610, ++ .phy_id_mask = 0xfffffff0, ++ .name = "Broadcom BCM89610", ++ .features = PHY_GBIT_FEATURES, ++ .flags = PHY_HAS_INTERRUPT, ++ .config_init = bcm54xx_config_init, ++ .ack_interrupt = bcm_phy_ack_intr, ++ .config_intr = bcm_phy_config_intr, + } }; + + module_phy_driver(broadcom_drivers); +@@ -741,6 +750,7 @@ static struct mdio_device_id __maybe_unused broadcom_tbl[] = { + { PHY_ID_BCMAC131, 0xfffffff0 }, + { PHY_ID_BCM5241, 0xfffffff0 }, + { PHY_ID_BCM5395, 0xfffffff0 }, ++ { PHY_ID_BCM89610, 0xfffffff0 }, + { } + }; + +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index 0e0978d8a0eb..febbeeecb078 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -1377,6 +1377,15 @@ static int m88e1318_set_wol(struct phy_device *phydev, + if (err < 0) + goto error; + ++ /* If WOL event happened once, the LED[2] interrupt pin ++ * will not be cleared unless we reading the interrupt status ++ * register. If interrupts are in use, the normal interrupt ++ * handling will clear the WOL event. Clear the WOL event ++ * before enabling it if !phy_interrupt_is_valid() ++ */ ++ if (!phy_interrupt_is_valid(phydev)) ++ phy_read(phydev, MII_M1011_IEVENT); ++ + /* Enable the WOL interrupt */ + err = __phy_modify(phydev, MII_88E1318S_PHY_CSIER, 0, + MII_88E1318S_PHY_CSIER_WOL_EIE); +diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c +index 0f293ef28935..a97ac8c12c4c 100644 +--- a/drivers/net/phy/microchip.c ++++ b/drivers/net/phy/microchip.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + #define DRIVER_AUTHOR "WOOJUNG HUH " + #define DRIVER_DESC "Microchip LAN88XX PHY driver" +@@ -30,6 +31,16 @@ struct lan88xx_priv { + __u32 wolopts; + }; + ++static int lan88xx_read_page(struct phy_device *phydev) ++{ ++ return __phy_read(phydev, LAN88XX_EXT_PAGE_ACCESS); ++} ++ ++static int lan88xx_write_page(struct phy_device *phydev, int page) ++{ ++ return __phy_write(phydev, LAN88XX_EXT_PAGE_ACCESS, page); ++} ++ + static int lan88xx_phy_config_intr(struct phy_device *phydev) + { + int rc; +@@ -66,6 +77,150 @@ static int lan88xx_suspend(struct phy_device *phydev) + return 0; + } + ++static int lan88xx_TR_reg_set(struct phy_device *phydev, u16 regaddr, ++ u32 data) ++{ ++ int val, save_page, ret = 0; ++ u16 buf; ++ ++ /* Save current page */ ++ save_page = phy_save_page(phydev); ++ if (save_page < 0) { ++ pr_warn("Failed to get current page\n"); ++ goto err; ++ } ++ ++ /* Switch to TR page */ ++ lan88xx_write_page(phydev, LAN88XX_EXT_PAGE_ACCESS_TR); ++ ++ ret = __phy_write(phydev, LAN88XX_EXT_PAGE_TR_LOW_DATA, ++ (data & 0xFFFF)); ++ if (ret < 0) { ++ pr_warn("Failed to write TR low data\n"); ++ goto err; ++ } ++ ++ ret = __phy_write(phydev, LAN88XX_EXT_PAGE_TR_HIGH_DATA, ++ (data & 0x00FF0000) >> 16); ++ if (ret < 0) { ++ pr_warn("Failed to write TR high data\n"); ++ goto err; ++ } ++ ++ /* Config control bits [15:13] of register */ ++ buf = (regaddr & ~(0x3 << 13));/* Clr [14:13] to write data in reg */ ++ buf |= 0x8000; /* Set [15] to Packet transmit */ ++ ++ ret = __phy_write(phydev, LAN88XX_EXT_PAGE_TR_CR, buf); ++ if (ret < 0) { ++ pr_warn("Failed to write data in reg\n"); ++ goto err; ++ } ++ ++ usleep_range(1000, 2000);/* Wait for Data to be written */ ++ val = __phy_read(phydev, LAN88XX_EXT_PAGE_TR_CR); ++ if (!(val & 0x8000)) ++ pr_warn("TR Register[0x%X] configuration failed\n", regaddr); ++err: ++ return phy_restore_page(phydev, save_page, ret); ++} ++ ++static void lan88xx_config_TR_regs(struct phy_device *phydev) ++{ ++ int err; ++ ++ /* Get access to Channel 0x1, Node 0xF , Register 0x01. ++ * Write 24-bit value 0x12B00A to register. Setting MrvlTrFix1000Kf, ++ * MrvlTrFix1000Kp, MasterEnableTR bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x0F82, 0x12B00A); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x0F82]\n"); ++ ++ /* Get access to Channel b'10, Node b'1101, Register 0x06. ++ * Write 24-bit value 0xD2C46F to register. Setting SSTrKf1000Slv, ++ * SSTrKp1000Mas bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x168C, 0xD2C46F); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x168C]\n"); ++ ++ /* Get access to Channel b'10, Node b'1111, Register 0x11. ++ * Write 24-bit value 0x620 to register. Setting rem_upd_done_thresh ++ * bits ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x17A2, 0x620); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x17A2]\n"); ++ ++ /* Get access to Channel b'10, Node b'1101, Register 0x10. ++ * Write 24-bit value 0xEEFFDD to register. Setting ++ * eee_TrKp1Long_1000, eee_TrKp2Long_1000, eee_TrKp3Long_1000, ++ * eee_TrKp1Short_1000,eee_TrKp2Short_1000, eee_TrKp3Short_1000 bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x16A0, 0xEEFFDD); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x16A0]\n"); ++ ++ /* Get access to Channel b'10, Node b'1101, Register 0x13. ++ * Write 24-bit value 0x071448 to register. Setting ++ * slv_lpi_tr_tmr_val1, slv_lpi_tr_tmr_val2 bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x16A6, 0x071448); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x16A6]\n"); ++ ++ /* Get access to Channel b'10, Node b'1101, Register 0x12. ++ * Write 24-bit value 0x13132F to register. Setting ++ * slv_sigdet_timer_val1, slv_sigdet_timer_val2 bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x16A4, 0x13132F); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x16A4]\n"); ++ ++ /* Get access to Channel b'10, Node b'1101, Register 0x14. ++ * Write 24-bit value 0x0 to register. Setting eee_3level_delay, ++ * eee_TrKf_freeze_delay bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x16A8, 0x0); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x16A8]\n"); ++ ++ /* Get access to Channel b'01, Node b'1111, Register 0x34. ++ * Write 24-bit value 0x91B06C to register. Setting ++ * FastMseSearchThreshLong1000, FastMseSearchThreshShort1000, ++ * FastMseSearchUpdGain1000 bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x0FE8, 0x91B06C); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x0FE8]\n"); ++ ++ /* Get access to Channel b'01, Node b'1111, Register 0x3E. ++ * Write 24-bit value 0xC0A028 to register. Setting ++ * FastMseKp2ThreshLong1000, FastMseKp2ThreshShort1000, ++ * FastMseKp2UpdGain1000, FastMseKp2ExitEn1000 bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x0FFC, 0xC0A028); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x0FFC]\n"); ++ ++ /* Get access to Channel b'01, Node b'1111, Register 0x35. ++ * Write 24-bit value 0x041600 to register. Setting ++ * FastMseSearchPhShNum1000, FastMseSearchClksPerPh1000, ++ * FastMsePhChangeDelay1000 bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x0FEA, 0x041600); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x0FEA]\n"); ++ ++ /* Get access to Channel b'10, Node b'1101, Register 0x03. ++ * Write 24-bit value 0x000004 to register. Setting TrFreeze bits. ++ */ ++ err = lan88xx_TR_reg_set(phydev, 0x1686, 0x000004); ++ if (err < 0) ++ pr_warn("Failed to Set Register[0x1686]\n"); ++} ++ + static int lan88xx_probe(struct phy_device *phydev) + { + struct device *dev = &phydev->mdio.dev; +@@ -132,6 +287,25 @@ static void lan88xx_set_mdix(struct phy_device *phydev) + phy_write(phydev, LAN88XX_EXT_PAGE_ACCESS, LAN88XX_EXT_PAGE_SPACE_0); + } + ++static int lan88xx_config_init(struct phy_device *phydev) ++{ ++ int val; ++ ++ genphy_config_init(phydev); ++ /*Zerodetect delay enable */ ++ val = phy_read_mmd(phydev, MDIO_MMD_PCS, ++ PHY_ARDENNES_MMD_DEV_3_PHY_CFG); ++ val |= PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_; ++ ++ phy_write_mmd(phydev, MDIO_MMD_PCS, PHY_ARDENNES_MMD_DEV_3_PHY_CFG, ++ val); ++ ++ /* Config DSP registers */ ++ lan88xx_config_TR_regs(phydev); ++ ++ return 0; ++} ++ + static int lan88xx_config_aneg(struct phy_device *phydev) + { + lan88xx_set_mdix(phydev); +@@ -151,7 +325,7 @@ static struct phy_driver microchip_phy_driver[] = { + .probe = lan88xx_probe, + .remove = lan88xx_remove, + +- .config_init = genphy_config_init, ++ .config_init = lan88xx_config_init, + .config_aneg = lan88xx_config_aneg, + + .ack_interrupt = lan88xx_phy_ack_interrupt, +@@ -160,6 +334,8 @@ static struct phy_driver microchip_phy_driver[] = { + .suspend = lan88xx_suspend, + .resume = genphy_resume, + .set_wol = lan88xx_set_wol, ++ .read_page = lan88xx_read_page, ++ .write_page = lan88xx_write_page, + } }; + + module_phy_driver(microchip_phy_driver); +diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig +index b979cf3bce65..88a8b5916624 100644 +--- a/drivers/nvme/host/Kconfig ++++ b/drivers/nvme/host/Kconfig +@@ -27,7 +27,7 @@ config NVME_FABRICS + + config NVME_RDMA + tristate "NVM Express over Fabrics RDMA host driver" +- depends on INFINIBAND && BLOCK ++ depends on INFINIBAND && INFINIBAND_ADDR_TRANS && BLOCK + select NVME_CORE + select NVME_FABRICS + select SG_POOL +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index df3d5051539d..4ae5be34131c 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -99,6 +99,7 @@ static struct class *nvme_subsys_class; + + static void nvme_ns_remove(struct nvme_ns *ns); + static int nvme_revalidate_disk(struct gendisk *disk); ++static void nvme_put_subsystem(struct nvme_subsystem *subsys); + + static __le32 nvme_get_log_dw10(u8 lid, size_t size) + { +@@ -353,6 +354,7 @@ static void nvme_free_ns_head(struct kref *ref) + ida_simple_remove(&head->subsys->ns_ida, head->instance); + list_del_init(&head->entry); + cleanup_srcu_struct(&head->srcu); ++ nvme_put_subsystem(head->subsys); + kfree(head); + } + +@@ -767,6 +769,7 @@ static int nvme_submit_user_cmd(struct request_queue *q, + ret = PTR_ERR(meta); + goto out_unmap; + } ++ req->cmd_flags |= REQ_INTEGRITY; + } + } + +@@ -2842,6 +2845,9 @@ static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl, + goto out_cleanup_srcu; + + list_add_tail(&head->entry, &ctrl->subsys->nsheads); ++ ++ kref_get(&ctrl->subsys->ref); ++ + return head; + out_cleanup_srcu: + cleanup_srcu_struct(&head->srcu); +@@ -2978,31 +2984,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) + if (nvme_init_ns_head(ns, nsid, id)) + goto out_free_id; + nvme_setup_streams_ns(ctrl, ns); +- +-#ifdef CONFIG_NVME_MULTIPATH +- /* +- * If multipathing is enabled we need to always use the subsystem +- * instance number for numbering our devices to avoid conflicts +- * between subsystems that have multiple controllers and thus use +- * the multipath-aware subsystem node and those that have a single +- * controller and use the controller node directly. +- */ +- if (ns->head->disk) { +- sprintf(disk_name, "nvme%dc%dn%d", ctrl->subsys->instance, +- ctrl->cntlid, ns->head->instance); +- flags = GENHD_FL_HIDDEN; +- } else { +- sprintf(disk_name, "nvme%dn%d", ctrl->subsys->instance, +- ns->head->instance); +- } +-#else +- /* +- * But without the multipath code enabled, multiple controller per +- * subsystems are visible as devices and thus we cannot use the +- * subsystem instance. +- */ +- sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance); +-#endif ++ nvme_set_disk_name(disk_name, ns, ctrl, &flags); + + if ((ctrl->quirks & NVME_QUIRK_LIGHTNVM) && id->vs[0] == 0x1) { + if (nvme_nvm_register(ns, disk_name, node)) { +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 124c458806df..7ae732a77fe8 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -668,6 +668,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->transport); + opts->transport = p; + break; + case NVMF_OPT_NQN: +@@ -676,6 +677,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->subsysnqn); + opts->subsysnqn = p; + nqnlen = strlen(opts->subsysnqn); + if (nqnlen >= NVMF_NQN_SIZE) { +@@ -698,6 +700,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->traddr); + opts->traddr = p; + break; + case NVMF_OPT_TRSVCID: +@@ -706,6 +709,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->trsvcid); + opts->trsvcid = p; + break; + case NVMF_OPT_QUEUE_SIZE: +@@ -792,6 +796,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -EINVAL; + goto out; + } ++ nvmf_host_put(opts->host); + opts->host = nvmf_host_add(p); + kfree(p); + if (!opts->host) { +@@ -817,6 +822,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->host_traddr); + opts->host_traddr = p; + break; + case NVMF_OPT_HOST_ID: +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 060f69e03427..0949633ac87c 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -15,10 +15,32 @@ + #include "nvme.h" + + static bool multipath = true; +-module_param(multipath, bool, 0644); ++module_param(multipath, bool, 0444); + MODULE_PARM_DESC(multipath, + "turn on native support for multiple controllers per subsystem"); + ++/* ++ * If multipathing is enabled we need to always use the subsystem instance ++ * number for numbering our devices to avoid conflicts between subsystems that ++ * have multiple controllers and thus use the multipath-aware subsystem node ++ * and those that have a single controller and use the controller node ++ * directly. ++ */ ++void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns, ++ struct nvme_ctrl *ctrl, int *flags) ++{ ++ if (!multipath) { ++ sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance); ++ } else if (ns->head->disk) { ++ sprintf(disk_name, "nvme%dc%dn%d", ctrl->subsys->instance, ++ ctrl->cntlid, ns->head->instance); ++ *flags = GENHD_FL_HIDDEN; ++ } else { ++ sprintf(disk_name, "nvme%dn%d", ctrl->subsys->instance, ++ ns->head->instance); ++ } ++} ++ + void nvme_failover_req(struct request *req) + { + struct nvme_ns *ns = req->q->queuedata; +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 0133f3d2ce94..011d67ba11d5 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -411,6 +411,8 @@ extern const struct attribute_group nvme_ns_id_attr_group; + extern const struct block_device_operations nvme_ns_head_ops; + + #ifdef CONFIG_NVME_MULTIPATH ++void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns, ++ struct nvme_ctrl *ctrl, int *flags); + void nvme_failover_req(struct request *req); + bool nvme_req_needs_failover(struct request *req, blk_status_t error); + void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl); +@@ -436,6 +438,16 @@ static inline void nvme_mpath_check_last_path(struct nvme_ns *ns) + } + + #else ++/* ++ * Without the multipath code enabled, multiple controller per subsystems are ++ * visible as devices and thus we cannot use the subsystem instance. ++ */ ++static inline void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns, ++ struct nvme_ctrl *ctrl, int *flags) ++{ ++ sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance); ++} ++ + static inline void nvme_failover_req(struct request *req) + { + } +diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig +index 5f4f8b16685f..3c7b61ddb0d1 100644 +--- a/drivers/nvme/target/Kconfig ++++ b/drivers/nvme/target/Kconfig +@@ -27,7 +27,7 @@ config NVME_TARGET_LOOP + + config NVME_TARGET_RDMA + tristate "NVMe over Fabrics RDMA target support" +- depends on INFINIBAND ++ depends on INFINIBAND && INFINIBAND_ADDR_TRANS + depends on NVME_TARGET + select SGL_ALLOC + help +diff --git a/drivers/pci/dwc/pcie-kirin.c b/drivers/pci/dwc/pcie-kirin.c +index 13d839bd6160..c1b396a36a20 100644 +--- a/drivers/pci/dwc/pcie-kirin.c ++++ b/drivers/pci/dwc/pcie-kirin.c +@@ -487,7 +487,7 @@ static int kirin_pcie_probe(struct platform_device *pdev) + return ret; + + kirin_pcie->gpio_id_reset = of_get_named_gpio(dev->of_node, +- "reset-gpio", 0); ++ "reset-gpios", 0); + if (kirin_pcie->gpio_id_reset < 0) + return -ENODEV; + +diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c +index b1ae1618fefe..fee9225ca559 100644 +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -1622,22 +1622,30 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq) + + if (!need_valid_mask) { + irq_base = devm_irq_alloc_descs(pctrl->dev, -1, 0, +- chip->ngpio, NUMA_NO_NODE); ++ community->npins, NUMA_NO_NODE); + if (irq_base < 0) { + dev_err(pctrl->dev, "Failed to allocate IRQ numbers\n"); + return irq_base; + } +- } else { +- irq_base = 0; + } + +- ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, irq_base, ++ ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0, + handle_bad_irq, IRQ_TYPE_NONE); + if (ret) { + dev_err(pctrl->dev, "failed to add IRQ chip\n"); + return ret; + } + ++ if (!need_valid_mask) { ++ for (i = 0; i < community->ngpio_ranges; i++) { ++ range = &community->gpio_ranges[i]; ++ ++ irq_domain_associate_many(chip->irq.domain, irq_base, ++ range->base, range->npins); ++ irq_base += range->npins; ++ } ++ } ++ + gpiochip_set_chained_irqchip(chip, &chv_gpio_irqchip, irq, + chv_gpio_irq_handler); + return 0; +diff --git a/drivers/pinctrl/meson/pinctrl-meson-axg.c b/drivers/pinctrl/meson/pinctrl-meson-axg.c +index 4b91ff74779b..99a6ceac8e53 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-axg.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-axg.c +@@ -898,7 +898,7 @@ static struct meson_bank meson_axg_periphs_banks[] = { + + static struct meson_bank meson_axg_aobus_banks[] = { + /* name first last irq pullen pull dir out in */ +- BANK("AO", GPIOAO_0, GPIOAO_9, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), ++ BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), + }; + + static struct meson_pmx_bank meson_axg_periphs_pmx_banks[] = { +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index 51a1b49760ea..6bfb47c18a15 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -168,8 +168,8 @@ config DELL_WMI + depends on DMI + depends on INPUT + depends on ACPI_VIDEO || ACPI_VIDEO = n ++ depends on DELL_SMBIOS + select DELL_WMI_DESCRIPTOR +- select DELL_SMBIOS + select INPUT_SPARSEKMAP + ---help--- + Say Y here if you want to support WMI-based hotkeys on Dell laptops. +diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c +index b4e5e725848d..5f5b57fcf792 100644 +--- a/drivers/remoteproc/qcom_q6v5_pil.c ++++ b/drivers/remoteproc/qcom_q6v5_pil.c +@@ -1088,6 +1088,7 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc) + dev_err(qproc->dev, "unable to resolve mba region\n"); + return ret; + } ++ of_node_put(node); + + qproc->mba_phys = r.start; + qproc->mba_size = resource_size(&r); +@@ -1105,6 +1106,7 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc) + dev_err(qproc->dev, "unable to resolve mpss region\n"); + return ret; + } ++ of_node_put(node); + + qproc->mpss_phys = qproc->mpss_reloc = r.start; + qproc->mpss_size = resource_size(&r); +diff --git a/drivers/reset/reset-uniphier.c b/drivers/reset/reset-uniphier.c +index e8bb023ff15e..3e3417c8bb9e 100644 +--- a/drivers/reset/reset-uniphier.c ++++ b/drivers/reset/reset-uniphier.c +@@ -107,7 +107,7 @@ static const struct uniphier_reset_data uniphier_ld20_sys_reset_data[] = { + UNIPHIER_RESETX(4, 0x200c, 2), /* eMMC */ + UNIPHIER_RESETX(6, 0x200c, 6), /* Ether */ + UNIPHIER_RESETX(8, 0x200c, 8), /* STDMAC (HSC) */ +- UNIPHIER_RESETX(12, 0x200c, 5), /* GIO (PCIe, USB3) */ ++ UNIPHIER_RESETX(14, 0x200c, 5), /* USB30 */ + UNIPHIER_RESETX(16, 0x200c, 12), /* USB30-PHY0 */ + UNIPHIER_RESETX(17, 0x200c, 13), /* USB30-PHY1 */ + UNIPHIER_RESETX(18, 0x200c, 14), /* USB30-PHY2 */ +@@ -122,8 +122,8 @@ static const struct uniphier_reset_data uniphier_pxs3_sys_reset_data[] = { + UNIPHIER_RESETX(2, 0x200c, 0), /* NAND */ + UNIPHIER_RESETX(4, 0x200c, 2), /* eMMC */ + UNIPHIER_RESETX(8, 0x200c, 12), /* STDMAC */ +- UNIPHIER_RESETX(12, 0x200c, 4), /* USB30 link (GIO0) */ +- UNIPHIER_RESETX(13, 0x200c, 5), /* USB31 link (GIO1) */ ++ UNIPHIER_RESETX(12, 0x200c, 4), /* USB30 link */ ++ UNIPHIER_RESETX(13, 0x200c, 5), /* USB31 link */ + UNIPHIER_RESETX(16, 0x200c, 16), /* USB30-PHY0 */ + UNIPHIER_RESETX(17, 0x200c, 18), /* USB30-PHY1 */ + UNIPHIER_RESETX(18, 0x200c, 20), /* USB30-PHY2 */ +diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c +index 64b6de9763ee..1efdf9ff8679 100644 +--- a/drivers/rpmsg/rpmsg_char.c ++++ b/drivers/rpmsg/rpmsg_char.c +@@ -581,4 +581,6 @@ static void rpmsg_chrdev_exit(void) + unregister_chrdev_region(rpmsg_major, RPMSG_DEV_MAX); + } + module_exit(rpmsg_chrdev_exit); ++ ++MODULE_ALIAS("rpmsg:rpmsg_chrdev"); + MODULE_LICENSE("GPL v2"); +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index c11a083cd956..086f172d404c 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -706,7 +706,6 @@ void qeth_clear_ipacmd_list(struct qeth_card *card) + qeth_put_reply(reply); + } + spin_unlock_irqrestore(&card->lock, flags); +- atomic_set(&card->write.irq_pending, 0); + } + EXPORT_SYMBOL_GPL(qeth_clear_ipacmd_list); + +@@ -1101,14 +1100,9 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + { + int rc; + int cstat, dstat; ++ struct qeth_cmd_buffer *iob = NULL; + struct qeth_channel *channel; + struct qeth_card *card; +- struct qeth_cmd_buffer *iob; +- +- if (__qeth_check_irb_error(cdev, intparm, irb)) +- return; +- cstat = irb->scsw.cmd.cstat; +- dstat = irb->scsw.cmd.dstat; + + card = CARD_FROM_CDEV(cdev); + if (!card) +@@ -1126,6 +1120,19 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + channel = &card->data; + QETH_CARD_TEXT(card, 5, "data"); + } ++ ++ if (qeth_intparm_is_iob(intparm)) ++ iob = (struct qeth_cmd_buffer *) __va((addr_t)intparm); ++ ++ if (__qeth_check_irb_error(cdev, intparm, irb)) { ++ /* IO was terminated, free its resources. */ ++ if (iob) ++ qeth_release_buffer(iob->channel, iob); ++ atomic_set(&channel->irq_pending, 0); ++ wake_up(&card->wait_q); ++ return; ++ } ++ + atomic_set(&channel->irq_pending, 0); + + if (irb->scsw.cmd.fctl & (SCSW_FCTL_CLEAR_FUNC)) +@@ -1149,6 +1156,10 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + /* we don't have to handle this further */ + intparm = 0; + } ++ ++ cstat = irb->scsw.cmd.cstat; ++ dstat = irb->scsw.cmd.dstat; ++ + if ((dstat & DEV_STAT_UNIT_EXCEP) || + (dstat & DEV_STAT_UNIT_CHECK) || + (cstat)) { +@@ -1187,11 +1198,8 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + channel->state == CH_STATE_UP) + __qeth_issue_next_read(card); + +- if (intparm) { +- iob = (struct qeth_cmd_buffer *) __va((addr_t)intparm); +- if (iob->callback) +- iob->callback(iob->channel, iob); +- } ++ if (iob && iob->callback) ++ iob->callback(iob->channel, iob); + + out: + wake_up(&card->wait_q); +@@ -1862,8 +1870,8 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel, + atomic_cmpxchg(&channel->irq_pending, 0, 1) == 0); + QETH_DBF_TEXT(SETUP, 6, "noirqpnd"); + spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags); +- rc = ccw_device_start(channel->ccwdev, +- &channel->ccw, (addr_t) iob, 0, 0); ++ rc = ccw_device_start_timeout(channel->ccwdev, &channel->ccw, ++ (addr_t) iob, 0, 0, QETH_TIMEOUT); + spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags); + + if (rc) { +@@ -1880,7 +1888,6 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel, + if (channel->state != CH_STATE_UP) { + rc = -ETIME; + QETH_DBF_TEXT_(SETUP, 2, "3err%d", rc); +- qeth_clear_cmd_buffers(channel); + } else + rc = 0; + return rc; +@@ -1934,8 +1941,8 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel, + atomic_cmpxchg(&channel->irq_pending, 0, 1) == 0); + QETH_DBF_TEXT(SETUP, 6, "noirqpnd"); + spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags); +- rc = ccw_device_start(channel->ccwdev, +- &channel->ccw, (addr_t) iob, 0, 0); ++ rc = ccw_device_start_timeout(channel->ccwdev, &channel->ccw, ++ (addr_t) iob, 0, 0, QETH_TIMEOUT); + spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags); + + if (rc) { +@@ -1956,7 +1963,6 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel, + QETH_DBF_MESSAGE(2, "%s IDX activate timed out\n", + dev_name(&channel->ccwdev->dev)); + QETH_DBF_TEXT_(SETUP, 2, "2err%d", -ETIME); +- qeth_clear_cmd_buffers(channel); + return -ETIME; + } + return qeth_idx_activate_get_answer(channel, idx_reply_cb); +@@ -2158,8 +2164,8 @@ int qeth_send_control_data(struct qeth_card *card, int len, + + QETH_CARD_TEXT(card, 6, "noirqpnd"); + spin_lock_irqsave(get_ccwdev_lock(card->write.ccwdev), flags); +- rc = ccw_device_start(card->write.ccwdev, &card->write.ccw, +- (addr_t) iob, 0, 0); ++ rc = ccw_device_start_timeout(CARD_WDEV(card), &card->write.ccw, ++ (addr_t) iob, 0, 0, event_timeout); + spin_unlock_irqrestore(get_ccwdev_lock(card->write.ccwdev), flags); + if (rc) { + QETH_DBF_MESSAGE(2, "%s qeth_send_control_data: " +@@ -2191,8 +2197,6 @@ int qeth_send_control_data(struct qeth_card *card, int len, + } + } + +- if (reply->rc == -EIO) +- goto error; + rc = reply->rc; + qeth_put_reply(reply); + return rc; +@@ -2203,9 +2207,6 @@ int qeth_send_control_data(struct qeth_card *card, int len, + list_del_init(&reply->list); + spin_unlock_irqrestore(&reply->card->lock, flags); + atomic_inc(&reply->received); +-error: +- atomic_set(&card->write.irq_pending, 0); +- qeth_release_buffer(iob->channel, iob); + rc = reply->rc; + qeth_put_reply(reply); + return rc; +diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h +index 619f897b4bb0..f4d1ec0b8f5a 100644 +--- a/drivers/s390/net/qeth_core_mpc.h ++++ b/drivers/s390/net/qeth_core_mpc.h +@@ -35,6 +35,18 @@ extern unsigned char IPA_PDU_HEADER[]; + #define QETH_HALT_CHANNEL_PARM -11 + #define QETH_RCD_PARM -12 + ++static inline bool qeth_intparm_is_iob(unsigned long intparm) ++{ ++ switch (intparm) { ++ case QETH_CLEAR_CHANNEL_PARM: ++ case QETH_HALT_CHANNEL_PARM: ++ case QETH_RCD_PARM: ++ case 0: ++ return false; ++ } ++ return true; ++} ++ + /*****************************************************************************/ + /* IP Assist related definitions */ + /*****************************************************************************/ +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 5ef4c978ad19..eb5ca4701cec 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -1339,8 +1339,8 @@ static int qeth_osn_send_control_data(struct qeth_card *card, int len, + qeth_prepare_control_data(card, len, iob); + QETH_CARD_TEXT(card, 6, "osnoirqp"); + spin_lock_irqsave(get_ccwdev_lock(card->write.ccwdev), flags); +- rc = ccw_device_start(card->write.ccwdev, &card->write.ccw, +- (addr_t) iob, 0, 0); ++ rc = ccw_device_start_timeout(CARD_WDEV(card), &card->write.ccw, ++ (addr_t) iob, 0, 0, QETH_IPA_TIMEOUT); + spin_unlock_irqrestore(get_ccwdev_lock(card->write.ccwdev), flags); + if (rc) { + QETH_DBF_MESSAGE(2, "qeth_osn_send_control_data: " +diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c +index 3b0c8b8a7634..066b5c3aaae6 100644 +--- a/drivers/s390/net/smsgiucv.c ++++ b/drivers/s390/net/smsgiucv.c +@@ -176,7 +176,7 @@ static struct device_driver smsg_driver = { + + static void __exit smsg_exit(void) + { +- cpcmd("SET SMSG IUCV", NULL, 0, NULL); ++ cpcmd("SET SMSG OFF", NULL, 0, NULL); + device_unregister(smsg_dev); + iucv_unregister(&smsg_handler, 1); + driver_unregister(&smsg_driver); +diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c +index edb7be786c65..9e8de1462593 100644 +--- a/drivers/scsi/isci/port_config.c ++++ b/drivers/scsi/isci/port_config.c +@@ -291,7 +291,7 @@ sci_mpc_agent_validate_phy_configuration(struct isci_host *ihost, + * Note: We have not moved the current phy_index so we will actually + * compare the startting phy with itself. + * This is expected and required to add the phy to the port. */ +- while (phy_index < SCI_MAX_PHYS) { ++ for (; phy_index < SCI_MAX_PHYS; phy_index++) { + if ((phy_mask & (1 << phy_index)) == 0) + continue; + sci_phy_get_sas_address(&ihost->phys[phy_index], +@@ -311,7 +311,6 @@ sci_mpc_agent_validate_phy_configuration(struct isci_host *ihost, + &ihost->phys[phy_index]); + + assigned_phy_mask |= (1 << phy_index); +- phy_index++; + } + + } +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 5ec3b74e8aed..2834171b5012 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -1124,12 +1124,12 @@ megasas_ioc_init_fusion(struct megasas_instance *instance) + goto fail_fw_init; + } + +- ret = 0; ++ return 0; + + fail_fw_init: + dev_err(&instance->pdev->dev, +- "Init cmd return status %s for SCSI host %d\n", +- ret ? "FAILED" : "SUCCESS", instance->host->host_no); ++ "Init cmd return status FAILED for SCSI host %d\n", ++ instance->host->host_no); + + return ret; + } +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index f4b52b44b966..65f6c94f2e9b 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2322,6 +2322,12 @@ iscsi_multicast_skb(struct sk_buff *skb, uint32_t group, gfp_t gfp) + return nlmsg_multicast(nls, skb, 0, group, gfp); + } + ++static int ++iscsi_unicast_skb(struct sk_buff *skb, u32 portid) ++{ ++ return nlmsg_unicast(nls, skb, portid); ++} ++ + int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr, + char *data, uint32_t data_size) + { +@@ -2524,14 +2530,11 @@ void iscsi_ping_comp_event(uint32_t host_no, struct iscsi_transport *transport, + EXPORT_SYMBOL_GPL(iscsi_ping_comp_event); + + static int +-iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi, +- void *payload, int size) ++iscsi_if_send_reply(u32 portid, int type, void *payload, int size) + { + struct sk_buff *skb; + struct nlmsghdr *nlh; + int len = nlmsg_total_size(size); +- int flags = multi ? NLM_F_MULTI : 0; +- int t = done ? NLMSG_DONE : type; + + skb = alloc_skb(len, GFP_ATOMIC); + if (!skb) { +@@ -2539,10 +2542,9 @@ iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi, + return -ENOMEM; + } + +- nlh = __nlmsg_put(skb, 0, 0, t, (len - sizeof(*nlh)), 0); +- nlh->nlmsg_flags = flags; ++ nlh = __nlmsg_put(skb, 0, 0, type, (len - sizeof(*nlh)), 0); + memcpy(nlmsg_data(nlh), payload, size); +- return iscsi_multicast_skb(skb, group, GFP_ATOMIC); ++ return iscsi_unicast_skb(skb, portid); + } + + static int +@@ -3470,6 +3472,7 @@ static int + iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + { + int err = 0; ++ u32 portid; + struct iscsi_uevent *ev = nlmsg_data(nlh); + struct iscsi_transport *transport = NULL; + struct iscsi_internal *priv; +@@ -3490,10 +3493,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + if (!try_module_get(transport->owner)) + return -EINVAL; + ++ portid = NETLINK_CB(skb).portid; ++ + switch (nlh->nlmsg_type) { + case ISCSI_UEVENT_CREATE_SESSION: + err = iscsi_if_create_session(priv, ep, ev, +- NETLINK_CB(skb).portid, ++ portid, + ev->u.c_session.initial_cmdsn, + ev->u.c_session.cmds_max, + ev->u.c_session.queue_depth); +@@ -3506,7 +3511,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + } + + err = iscsi_if_create_session(priv, ep, ev, +- NETLINK_CB(skb).portid, ++ portid, + ev->u.c_bound_session.initial_cmdsn, + ev->u.c_bound_session.cmds_max, + ev->u.c_bound_session.queue_depth); +@@ -3664,6 +3669,8 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + static void + iscsi_if_rx(struct sk_buff *skb) + { ++ u32 portid = NETLINK_CB(skb).portid; ++ + mutex_lock(&rx_queue_mutex); + while (skb->len >= NLMSG_HDRLEN) { + int err; +@@ -3699,8 +3706,8 @@ iscsi_if_rx(struct sk_buff *skb) + break; + if (ev->type == ISCSI_UEVENT_GET_CHAP && !err) + break; +- err = iscsi_if_send_reply(group, nlh->nlmsg_seq, +- nlh->nlmsg_type, 0, 0, ev, sizeof(*ev)); ++ err = iscsi_if_send_reply(portid, nlh->nlmsg_type, ++ ev, sizeof(*ev)); + } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH); + skb_pull(skb, rlen); + } +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 8c51d628b52e..a2ec0bc9e9fa 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1722,11 +1722,14 @@ static int storvsc_probe(struct hv_device *device, + max_targets = STORVSC_MAX_TARGETS; + max_channels = STORVSC_MAX_CHANNELS; + /* +- * On Windows8 and above, we support sub-channels for storage. ++ * On Windows8 and above, we support sub-channels for storage ++ * on SCSI and FC controllers. + * The number of sub-channels offerred is based on the number of + * VCPUs in the guest. + */ +- max_sub_channels = (num_cpus / storvsc_vcpus_per_sub_channel); ++ if (!dev_is_ide) ++ max_sub_channels = ++ (num_cpus - 1) / storvsc_vcpus_per_sub_channel; + } + + scsi_driver.can_queue = (max_outstanding_req_per_channel * +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index c374e3b5c678..777e5f1e52d1 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -609,7 +609,7 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, + break; + + case BTSTAT_ABORTQUEUE: +- cmd->result = (DID_ABORT << 16); ++ cmd->result = (DID_BUS_BUSY << 16); + break; + + case BTSTAT_SCSIPARITY: +diff --git a/drivers/soc/bcm/raspberrypi-power.c b/drivers/soc/bcm/raspberrypi-power.c +index fe96a8b956fb..f7ed1187518b 100644 +--- a/drivers/soc/bcm/raspberrypi-power.c ++++ b/drivers/soc/bcm/raspberrypi-power.c +@@ -45,7 +45,7 @@ struct rpi_power_domains { + struct rpi_power_domain_packet { + u32 domain; + u32 on; +-} __packet; ++}; + + /* + * Asks the firmware to enable or disable power on a specific power +diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c +index 7428091d3f5b..bd00b7cc8b78 100644 +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -184,6 +184,11 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) + struct bcm2835aux_spi *bs = spi_master_get_devdata(master); + irqreturn_t ret = IRQ_NONE; + ++ /* IRQ may be shared, so return if our interrupts are disabled */ ++ if (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_CNTL1) & ++ (BCM2835_AUX_SPI_CNTL1_TXEMPTY | BCM2835_AUX_SPI_CNTL1_IDLE))) ++ return ret; ++ + /* check if we have data to read */ + while (bs->rx_len && + (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & +diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c +index 5c9516ae4942..4a001634023e 100644 +--- a/drivers/spi/spi-cadence.c ++++ b/drivers/spi/spi-cadence.c +@@ -313,6 +313,14 @@ static void cdns_spi_fill_tx_fifo(struct cdns_spi *xspi) + + while ((trans_cnt < CDNS_SPI_FIFO_DEPTH) && + (xspi->tx_bytes > 0)) { ++ ++ /* When xspi in busy condition, bytes may send failed, ++ * then spi control did't work thoroughly, add one byte delay ++ */ ++ if (cdns_spi_read(xspi, CDNS_SPI_ISR) & ++ CDNS_SPI_IXR_TXFULL) ++ usleep_range(10, 20); ++ + if (xspi->txbuf) + cdns_spi_write(xspi, CDNS_SPI_TXD, *xspi->txbuf++); + else +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index c5dcfb434a49..584118ed12eb 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -283,6 +283,7 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p, + } + + k = min_t(int, k, ARRAY_SIZE(sh_msiof_spi_div_table) - 1); ++ brps = min_t(int, brps, 32); + + scr = sh_msiof_spi_div_table[k].brdv | SCR_BRPS(brps); + sh_msiof_write(p, TSCR, scr); +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index 0d99b242e82e..6cb933ecc084 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -890,6 +890,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, + bytes = min(bytes, data_len); + + if (!bio) { ++new_bio: + nr_vecs = min_t(int, BIO_MAX_PAGES, nr_pages); + nr_pages -= nr_vecs; + /* +@@ -931,6 +932,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, + * be allocated with pscsi_get_bio() above. + */ + bio = NULL; ++ goto new_bio; + } + + data_len -= bytes; +diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c +index 6c4b200a4560..9dbbb3c3bf35 100644 +--- a/drivers/tee/tee_core.c ++++ b/drivers/tee/tee_core.c +@@ -238,6 +238,17 @@ static int params_from_user(struct tee_context *ctx, struct tee_param *params, + if (IS_ERR(shm)) + return PTR_ERR(shm); + ++ /* ++ * Ensure offset + size does not overflow offset ++ * and does not overflow the size of the referred ++ * shared memory object. ++ */ ++ if ((ip.a + ip.b) < ip.a || ++ (ip.a + ip.b) > shm->size) { ++ tee_shm_put(shm); ++ return -EINVAL; ++ } ++ + params[n].u.memref.shm_offs = ip.a; + params[n].u.memref.size = ip.b; + params[n].u.memref.shm = shm; +diff --git a/drivers/thermal/int340x_thermal/int3403_thermal.c b/drivers/thermal/int340x_thermal/int3403_thermal.c +index 8a7f24dd9315..0c19fcd56a0d 100644 +--- a/drivers/thermal/int340x_thermal/int3403_thermal.c ++++ b/drivers/thermal/int340x_thermal/int3403_thermal.c +@@ -194,6 +194,7 @@ static int int3403_cdev_add(struct int3403_priv *priv) + return -EFAULT; + } + ++ priv->priv = obj; + obj->max_state = p->package.count - 1; + obj->cdev = + thermal_cooling_device_register(acpi_device_bid(priv->adev), +@@ -201,8 +202,6 @@ static int int3403_cdev_add(struct int3403_priv *priv) + if (IS_ERR(obj->cdev)) + result = PTR_ERR(obj->cdev); + +- priv->priv = obj; +- + kfree(buf.pointer); + /* TODO: add ACPI notification support */ + +diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c +index 0ee0c6d7f194..f4c42ac62789 100644 +--- a/drivers/usb/musb/musb_host.c ++++ b/drivers/usb/musb/musb_host.c +@@ -2530,8 +2530,11 @@ static int musb_bus_suspend(struct usb_hcd *hcd) + { + struct musb *musb = hcd_to_musb(hcd); + u8 devctl; ++ int ret; + +- musb_port_suspend(musb, true); ++ ret = musb_port_suspend(musb, true); ++ if (ret) ++ return ret; + + if (!is_host_active(musb)) + return 0; +diff --git a/drivers/usb/musb/musb_host.h b/drivers/usb/musb/musb_host.h +index 72392bbcd0a4..2999845632ce 100644 +--- a/drivers/usb/musb/musb_host.h ++++ b/drivers/usb/musb/musb_host.h +@@ -67,7 +67,7 @@ extern void musb_host_rx(struct musb *, u8); + extern void musb_root_disconnect(struct musb *musb); + extern void musb_host_resume_root_hub(struct musb *musb); + extern void musb_host_poke_root_hub(struct musb *musb); +-extern void musb_port_suspend(struct musb *musb, bool do_suspend); ++extern int musb_port_suspend(struct musb *musb, bool do_suspend); + extern void musb_port_reset(struct musb *musb, bool do_reset); + extern void musb_host_finish_resume(struct work_struct *work); + #else +@@ -99,7 +99,10 @@ static inline void musb_root_disconnect(struct musb *musb) {} + static inline void musb_host_resume_root_hub(struct musb *musb) {} + static inline void musb_host_poll_rh_status(struct musb *musb) {} + static inline void musb_host_poke_root_hub(struct musb *musb) {} +-static inline void musb_port_suspend(struct musb *musb, bool do_suspend) {} ++static inline int musb_port_suspend(struct musb *musb, bool do_suspend) ++{ ++ return 0; ++} + static inline void musb_port_reset(struct musb *musb, bool do_reset) {} + static inline void musb_host_finish_resume(struct work_struct *work) {} + #endif +diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c +index 5165d2b07ade..2f8dd9826e94 100644 +--- a/drivers/usb/musb/musb_virthub.c ++++ b/drivers/usb/musb/musb_virthub.c +@@ -48,14 +48,14 @@ void musb_host_finish_resume(struct work_struct *work) + spin_unlock_irqrestore(&musb->lock, flags); + } + +-void musb_port_suspend(struct musb *musb, bool do_suspend) ++int musb_port_suspend(struct musb *musb, bool do_suspend) + { + struct usb_otg *otg = musb->xceiv->otg; + u8 power; + void __iomem *mbase = musb->mregs; + + if (!is_host_active(musb)) +- return; ++ return 0; + + /* NOTE: this doesn't necessarily put PHY into low power mode, + * turning off its clock; that's a function of PHY integration and +@@ -66,16 +66,20 @@ void musb_port_suspend(struct musb *musb, bool do_suspend) + if (do_suspend) { + int retries = 10000; + +- power &= ~MUSB_POWER_RESUME; +- power |= MUSB_POWER_SUSPENDM; +- musb_writeb(mbase, MUSB_POWER, power); ++ if (power & MUSB_POWER_RESUME) ++ return -EBUSY; + +- /* Needed for OPT A tests */ +- power = musb_readb(mbase, MUSB_POWER); +- while (power & MUSB_POWER_SUSPENDM) { ++ if (!(power & MUSB_POWER_SUSPENDM)) { ++ power |= MUSB_POWER_SUSPENDM; ++ musb_writeb(mbase, MUSB_POWER, power); ++ ++ /* Needed for OPT A tests */ + power = musb_readb(mbase, MUSB_POWER); +- if (retries-- < 1) +- break; ++ while (power & MUSB_POWER_SUSPENDM) { ++ power = musb_readb(mbase, MUSB_POWER); ++ if (retries-- < 1) ++ break; ++ } + } + + musb_dbg(musb, "Root port suspended, power %02x", power); +@@ -111,6 +115,7 @@ void musb_port_suspend(struct musb *musb, bool do_suspend) + schedule_delayed_work(&musb->finish_resume_work, + msecs_to_jiffies(USB_RESUME_TIMEOUT)); + } ++ return 0; + } + + void musb_port_reset(struct musb *musb, bool do_reset) +diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c +index 2719f5d382f7..7b01648c85ca 100644 +--- a/drivers/usb/typec/tps6598x.c ++++ b/drivers/usb/typec/tps6598x.c +@@ -73,6 +73,7 @@ struct tps6598x { + struct device *dev; + struct regmap *regmap; + struct mutex lock; /* device lock */ ++ u8 i2c_protocol:1; + + struct typec_port *port; + struct typec_partner *partner; +@@ -80,19 +81,39 @@ struct tps6598x { + struct typec_capability typec_cap; + }; + ++static int ++tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len) ++{ ++ u8 data[len + 1]; ++ int ret; ++ ++ if (!tps->i2c_protocol) ++ return regmap_raw_read(tps->regmap, reg, val, len); ++ ++ ret = regmap_raw_read(tps->regmap, reg, data, sizeof(data)); ++ if (ret) ++ return ret; ++ ++ if (data[0] < len) ++ return -EIO; ++ ++ memcpy(val, &data[1], len); ++ return 0; ++} ++ + static inline int tps6598x_read16(struct tps6598x *tps, u8 reg, u16 *val) + { +- return regmap_raw_read(tps->regmap, reg, val, sizeof(u16)); ++ return tps6598x_block_read(tps, reg, val, sizeof(u16)); + } + + static inline int tps6598x_read32(struct tps6598x *tps, u8 reg, u32 *val) + { +- return regmap_raw_read(tps->regmap, reg, val, sizeof(u32)); ++ return tps6598x_block_read(tps, reg, val, sizeof(u32)); + } + + static inline int tps6598x_read64(struct tps6598x *tps, u8 reg, u64 *val) + { +- return regmap_raw_read(tps->regmap, reg, val, sizeof(u64)); ++ return tps6598x_block_read(tps, reg, val, sizeof(u64)); + } + + static inline int tps6598x_write16(struct tps6598x *tps, u8 reg, u16 val) +@@ -121,8 +142,8 @@ static int tps6598x_read_partner_identity(struct tps6598x *tps) + struct tps6598x_rx_identity_reg id; + int ret; + +- ret = regmap_raw_read(tps->regmap, TPS_REG_RX_IDENTITY_SOP, +- &id, sizeof(id)); ++ ret = tps6598x_block_read(tps, TPS_REG_RX_IDENTITY_SOP, ++ &id, sizeof(id)); + if (ret) + return ret; + +@@ -223,13 +244,13 @@ static int tps6598x_exec_cmd(struct tps6598x *tps, const char *cmd, + } while (val); + + if (out_len) { +- ret = regmap_raw_read(tps->regmap, TPS_REG_DATA1, +- out_data, out_len); ++ ret = tps6598x_block_read(tps, TPS_REG_DATA1, ++ out_data, out_len); + if (ret) + return ret; + val = out_data[0]; + } else { +- ret = regmap_read(tps->regmap, TPS_REG_DATA1, &val); ++ ret = tps6598x_block_read(tps, TPS_REG_DATA1, &val, sizeof(u8)); + if (ret) + return ret; + } +@@ -384,6 +405,16 @@ static int tps6598x_probe(struct i2c_client *client) + if (!vid) + return -ENODEV; + ++ /* ++ * Checking can the adapter handle SMBus protocol. If it can not, the ++ * driver needs to take care of block reads separately. ++ * ++ * FIXME: Testing with I2C_FUNC_I2C. regmap-i2c uses I2C protocol ++ * unconditionally if the adapter has I2C_FUNC_I2C set. ++ */ ++ if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) ++ tps->i2c_protocol = true; ++ + ret = tps6598x_read32(tps, TPS_REG_STATUS, &status); + if (ret < 0) + return ret; +diff --git a/drivers/usb/typec/ucsi/Makefile b/drivers/usb/typec/ucsi/Makefile +index b57891c1fd31..7afbea512207 100644 +--- a/drivers/usb/typec/ucsi/Makefile ++++ b/drivers/usb/typec/ucsi/Makefile +@@ -5,6 +5,6 @@ obj-$(CONFIG_TYPEC_UCSI) += typec_ucsi.o + + typec_ucsi-y := ucsi.o + +-typec_ucsi-$(CONFIG_FTRACE) += trace.o ++typec_ucsi-$(CONFIG_TRACING) += trace.o + + obj-$(CONFIG_UCSI_ACPI) += ucsi_acpi.o +diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c +index 81a84b3c1c50..728870c9e6b4 100644 +--- a/drivers/xen/xenbus/xenbus_dev_frontend.c ++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c +@@ -403,7 +403,7 @@ static int xenbus_command_reply(struct xenbus_file_priv *u, + { + struct { + struct xsd_sockmsg hdr; +- const char body[16]; ++ char body[16]; + } msg; + int rc; + +@@ -412,6 +412,7 @@ static int xenbus_command_reply(struct xenbus_file_priv *u, + msg.hdr.len = strlen(reply) + 1; + if (msg.hdr.len > sizeof(msg.body)) + return -E2BIG; ++ memcpy(&msg.body, reply, msg.hdr.len); + + mutex_lock(&u->reply_mutex); + rc = queue_reply(&u->read_buffers, &msg, sizeof(msg.hdr) + msg.hdr.len); +diff --git a/fs/afs/addr_list.c b/fs/afs/addr_list.c +index fd9f28b8a933..88391c7a8462 100644 +--- a/fs/afs/addr_list.c ++++ b/fs/afs/addr_list.c +@@ -121,7 +121,7 @@ struct afs_addr_list *afs_parse_text_addrs(const char *text, size_t len, + p = text; + do { + struct sockaddr_rxrpc *srx = &alist->addrs[alist->nr_addrs]; +- char tdelim = delim; ++ const char *q, *stop; + + if (*p == delim) { + p++; +@@ -130,28 +130,33 @@ struct afs_addr_list *afs_parse_text_addrs(const char *text, size_t len, + + if (*p == '[') { + p++; +- tdelim = ']'; ++ q = memchr(p, ']', end - p); ++ } else { ++ for (q = p; q < end; q++) ++ if (*q == '+' || *q == delim) ++ break; + } + +- if (in4_pton(p, end - p, ++ if (in4_pton(p, q - p, + (u8 *)&srx->transport.sin6.sin6_addr.s6_addr32[3], +- tdelim, &p)) { ++ -1, &stop)) { + srx->transport.sin6.sin6_addr.s6_addr32[0] = 0; + srx->transport.sin6.sin6_addr.s6_addr32[1] = 0; + srx->transport.sin6.sin6_addr.s6_addr32[2] = htonl(0xffff); +- } else if (in6_pton(p, end - p, ++ } else if (in6_pton(p, q - p, + srx->transport.sin6.sin6_addr.s6_addr, +- tdelim, &p)) { ++ -1, &stop)) { + /* Nothing to do */ + } else { + goto bad_address; + } + +- if (tdelim == ']') { +- if (p == end || *p != ']') +- goto bad_address; ++ if (stop != q) ++ goto bad_address; ++ ++ p = q; ++ if (q < end && *q == ']') + p++; +- } + + if (p < end) { + if (*p == '+') { +diff --git a/fs/afs/callback.c b/fs/afs/callback.c +index f4291b576054..96125c9e3e17 100644 +--- a/fs/afs/callback.c ++++ b/fs/afs/callback.c +@@ -23,36 +23,55 @@ + /* + * Set up an interest-in-callbacks record for a volume on a server and + * register it with the server. +- * - Called with volume->server_sem held. ++ * - Called with vnode->io_lock held. + */ + int afs_register_server_cb_interest(struct afs_vnode *vnode, +- struct afs_server_entry *entry) ++ struct afs_server_list *slist, ++ unsigned int index) + { +- struct afs_cb_interest *cbi = entry->cb_interest, *vcbi, *new, *x; ++ struct afs_server_entry *entry = &slist->servers[index]; ++ struct afs_cb_interest *cbi, *vcbi, *new, *old; + struct afs_server *server = entry->server; + + again: ++ if (vnode->cb_interest && ++ likely(vnode->cb_interest == entry->cb_interest)) ++ return 0; ++ ++ read_lock(&slist->lock); ++ cbi = afs_get_cb_interest(entry->cb_interest); ++ read_unlock(&slist->lock); ++ + vcbi = vnode->cb_interest; + if (vcbi) { +- if (vcbi == cbi) ++ if (vcbi == cbi) { ++ afs_put_cb_interest(afs_v2net(vnode), cbi); + return 0; ++ } + ++ /* Use a new interest in the server list for the same server ++ * rather than an old one that's still attached to a vnode. ++ */ + if (cbi && vcbi->server == cbi->server) { + write_seqlock(&vnode->cb_lock); +- vnode->cb_interest = afs_get_cb_interest(cbi); ++ old = vnode->cb_interest; ++ vnode->cb_interest = cbi; + write_sequnlock(&vnode->cb_lock); +- afs_put_cb_interest(afs_v2net(vnode), cbi); ++ afs_put_cb_interest(afs_v2net(vnode), old); + return 0; + } + ++ /* Re-use the one attached to the vnode. */ + if (!cbi && vcbi->server == server) { +- afs_get_cb_interest(vcbi); +- x = cmpxchg(&entry->cb_interest, cbi, vcbi); +- if (x != cbi) { +- cbi = x; +- afs_put_cb_interest(afs_v2net(vnode), vcbi); ++ write_lock(&slist->lock); ++ if (entry->cb_interest) { ++ write_unlock(&slist->lock); ++ afs_put_cb_interest(afs_v2net(vnode), cbi); + goto again; + } ++ ++ entry->cb_interest = cbi; ++ write_unlock(&slist->lock); + return 0; + } + } +@@ -72,13 +91,16 @@ int afs_register_server_cb_interest(struct afs_vnode *vnode, + list_add_tail(&new->cb_link, &server->cb_interests); + write_unlock(&server->cb_break_lock); + +- x = cmpxchg(&entry->cb_interest, cbi, new); +- if (x == cbi) { ++ write_lock(&slist->lock); ++ if (!entry->cb_interest) { ++ entry->cb_interest = afs_get_cb_interest(new); + cbi = new; ++ new = NULL; + } else { +- cbi = x; +- afs_put_cb_interest(afs_v2net(vnode), new); ++ cbi = afs_get_cb_interest(entry->cb_interest); + } ++ write_unlock(&slist->lock); ++ afs_put_cb_interest(afs_v2net(vnode), new); + } + + ASSERT(cbi); +@@ -88,11 +110,13 @@ int afs_register_server_cb_interest(struct afs_vnode *vnode, + */ + write_seqlock(&vnode->cb_lock); + +- vnode->cb_interest = afs_get_cb_interest(cbi); ++ old = vnode->cb_interest; ++ vnode->cb_interest = cbi; + vnode->cb_s_break = cbi->server->cb_s_break; + clear_bit(AFS_VNODE_CB_PROMISED, &vnode->flags); + + write_sequnlock(&vnode->cb_lock); ++ afs_put_cb_interest(afs_v2net(vnode), old); + return 0; + } + +diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c +index 41e277f57b20..c0b53bfef490 100644 +--- a/fs/afs/cmservice.c ++++ b/fs/afs/cmservice.c +@@ -341,7 +341,6 @@ static int afs_deliver_cb_init_call_back_state(struct afs_call *call) + */ + static int afs_deliver_cb_init_call_back_state3(struct afs_call *call) + { +- struct sockaddr_rxrpc srx; + struct afs_server *server; + struct afs_uuid *r; + unsigned loop; +@@ -398,8 +397,9 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call) + + /* we'll need the file server record as that tells us which set of + * vnodes to operate upon */ +- rxrpc_kernel_get_peer(call->net->socket, call->rxcall, &srx); +- server = afs_find_server(call->net, &srx); ++ rcu_read_lock(); ++ server = afs_find_server_by_uuid(call->net, call->request); ++ rcu_read_unlock(); + if (!server) + return -ENOTCONN; + call->cm_server = server; +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index f38d6a561a84..0aac3b5eb2ac 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -399,6 +399,7 @@ struct afs_server_list { + unsigned short index; /* Server currently in use */ + unsigned short vnovol_mask; /* Servers to be skipped due to VNOVOL */ + unsigned int seq; /* Set to ->servers_seq when installed */ ++ rwlock_t lock; + struct afs_server_entry servers[]; + }; + +@@ -605,13 +606,15 @@ extern void afs_init_callback_state(struct afs_server *); + extern void afs_break_callback(struct afs_vnode *); + extern void afs_break_callbacks(struct afs_server *, size_t,struct afs_callback[]); + +-extern int afs_register_server_cb_interest(struct afs_vnode *, struct afs_server_entry *); ++extern int afs_register_server_cb_interest(struct afs_vnode *, ++ struct afs_server_list *, unsigned int); + extern void afs_put_cb_interest(struct afs_net *, struct afs_cb_interest *); + extern void afs_clear_callback_interests(struct afs_net *, struct afs_server_list *); + + static inline struct afs_cb_interest *afs_get_cb_interest(struct afs_cb_interest *cbi) + { +- refcount_inc(&cbi->usage); ++ if (cbi) ++ refcount_inc(&cbi->usage); + return cbi; + } + +diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c +index ad1328d85526..9caf7410aff3 100644 +--- a/fs/afs/rotate.c ++++ b/fs/afs/rotate.c +@@ -179,7 +179,7 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc) + */ + if (fc->flags & AFS_FS_CURSOR_VNOVOL) { + fc->ac.error = -EREMOTEIO; +- goto failed; ++ goto next_server; + } + + write_lock(&vnode->volume->servers_lock); +@@ -201,7 +201,7 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc) + */ + if (vnode->volume->servers == fc->server_list) { + fc->ac.error = -EREMOTEIO; +- goto failed; ++ goto next_server; + } + + /* Try again */ +@@ -350,8 +350,8 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc) + * break request before we've finished decoding the reply and + * installing the vnode. + */ +- fc->ac.error = afs_register_server_cb_interest( +- vnode, &fc->server_list->servers[fc->index]); ++ fc->ac.error = afs_register_server_cb_interest(vnode, fc->server_list, ++ fc->index); + if (fc->ac.error < 0) + goto failed; + +@@ -369,8 +369,16 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc) + if (!test_bit(AFS_SERVER_FL_PROBED, &server->flags)) { + fc->ac.alist = afs_get_addrlist(alist); + +- if (!afs_probe_fileserver(fc)) +- goto failed; ++ if (!afs_probe_fileserver(fc)) { ++ switch (fc->ac.error) { ++ case -ENOMEM: ++ case -ERESTARTSYS: ++ case -EINTR: ++ goto failed; ++ default: ++ goto next_server; ++ } ++ } + } + + if (!fc->ac.alist) +diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c +index e1126659f043..e294a420d9db 100644 +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -41,6 +41,7 @@ int afs_open_socket(struct afs_net *net) + { + struct sockaddr_rxrpc srx; + struct socket *socket; ++ unsigned int min_level; + int ret; + + _enter(""); +@@ -60,6 +61,12 @@ int afs_open_socket(struct afs_net *net) + srx.transport.sin6.sin6_family = AF_INET6; + srx.transport.sin6.sin6_port = htons(AFS_CM_PORT); + ++ min_level = RXRPC_SECURITY_ENCRYPT; ++ ret = kernel_setsockopt(socket, SOL_RXRPC, RXRPC_MIN_SECURITY_LEVEL, ++ (void *)&min_level, sizeof(min_level)); ++ if (ret < 0) ++ goto error_2; ++ + ret = kernel_bind(socket, (struct sockaddr *) &srx, sizeof(srx)); + if (ret == -EADDRINUSE) { + srx.transport.sin6.sin6_port = 0; +diff --git a/fs/afs/server.c b/fs/afs/server.c +index 1880f1b6a9f1..90f1ae7c3a1f 100644 +--- a/fs/afs/server.c ++++ b/fs/afs/server.c +@@ -66,12 +66,6 @@ struct afs_server *afs_find_server(struct afs_net *net, + sizeof(struct in6_addr)); + if (diff == 0) + goto found; +- if (diff < 0) { +- // TODO: Sort the list +- //if (i == alist->nr_ipv4) +- // goto not_found; +- break; +- } + } + } + } else { +@@ -85,17 +79,10 @@ struct afs_server *afs_find_server(struct afs_net *net, + (u32)b->sin6_addr.s6_addr32[3]); + if (diff == 0) + goto found; +- if (diff < 0) { +- // TODO: Sort the list +- //if (i == 0) +- // goto not_found; +- break; +- } + } + } + } + +- //not_found: + server = NULL; + found: + if (server && !atomic_inc_not_zero(&server->usage)) +@@ -426,8 +413,15 @@ static void afs_gc_servers(struct afs_net *net, struct afs_server *gc_list) + } + write_sequnlock(&net->fs_lock); + +- if (deleted) ++ if (deleted) { ++ write_seqlock(&net->fs_addr_lock); ++ if (!hlist_unhashed(&server->addr4_link)) ++ hlist_del_rcu(&server->addr4_link); ++ if (!hlist_unhashed(&server->addr6_link)) ++ hlist_del_rcu(&server->addr6_link); ++ write_sequnlock(&net->fs_addr_lock); + afs_destroy_server(net, server); ++ } + } + } + +diff --git a/fs/afs/server_list.c b/fs/afs/server_list.c +index 0f8dc4c8f07c..8a5760aa5832 100644 +--- a/fs/afs/server_list.c ++++ b/fs/afs/server_list.c +@@ -49,6 +49,7 @@ struct afs_server_list *afs_alloc_server_list(struct afs_cell *cell, + goto error; + + refcount_set(&slist->usage, 1); ++ rwlock_init(&slist->lock); + + /* Make sure a records exists for each server in the list. */ + for (i = 0; i < vldb->nr_servers; i++) { +@@ -64,9 +65,11 @@ struct afs_server_list *afs_alloc_server_list(struct afs_cell *cell, + goto error_2; + } + +- /* Insertion-sort by server pointer */ ++ /* Insertion-sort by UUID */ + for (j = 0; j < slist->nr_servers; j++) +- if (slist->servers[j].server >= server) ++ if (memcmp(&slist->servers[j].server->uuid, ++ &server->uuid, ++ sizeof(server->uuid)) >= 0) + break; + if (j < slist->nr_servers) { + if (slist->servers[j].server == server) { +diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig +index e901ef6a4813..bda6175c2cbe 100644 +--- a/fs/cifs/Kconfig ++++ b/fs/cifs/Kconfig +@@ -198,7 +198,7 @@ config CIFS_SMB311 + + config CIFS_SMB_DIRECT + bool "SMB Direct support (Experimental)" +- depends on CIFS=m && INFINIBAND || CIFS=y && INFINIBAND=y ++ depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y + help + Enables SMB Direct experimental support for SMB 3.0, 3.02 and 3.1.1. + SMB Direct allows transferring SMB packets over RDMA. If unsure, +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 1c1940d90c96..097598543403 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -589,9 +589,15 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon, + + SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid); + ++ /* ++ * If ea_name is NULL (listxattr) and there are no EAs, return 0 as it's ++ * not an error. Otherwise, the specified ea_name was not found. ++ */ + if (!rc) + rc = move_smb2_ea_to_cifs(ea_data, buf_size, smb2_data, + SMB2_MAX_EA_BUF, ea_name); ++ else if (!ea_name && rc == -ENODATA) ++ rc = 0; + + kfree(smb2_data); + return rc; +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 8ae6a089489c..93d3f4a14b32 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -621,8 +621,8 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses) + + int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) + { +- int rc = 0; +- struct validate_negotiate_info_req vneg_inbuf; ++ int rc; ++ struct validate_negotiate_info_req *pneg_inbuf; + struct validate_negotiate_info_rsp *pneg_rsp = NULL; + u32 rsplen; + u32 inbuflen; /* max of 4 dialects */ +@@ -656,63 +656,69 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) + if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) + cifs_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); + +- vneg_inbuf.Capabilities = ++ pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS); ++ if (!pneg_inbuf) ++ return -ENOMEM; ++ ++ pneg_inbuf->Capabilities = + cpu_to_le32(tcon->ses->server->vals->req_capabilities); +- memcpy(vneg_inbuf.Guid, tcon->ses->server->client_guid, ++ memcpy(pneg_inbuf->Guid, tcon->ses->server->client_guid, + SMB2_CLIENT_GUID_SIZE); + + if (tcon->ses->sign) +- vneg_inbuf.SecurityMode = ++ pneg_inbuf->SecurityMode = + cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); + else if (global_secflags & CIFSSEC_MAY_SIGN) +- vneg_inbuf.SecurityMode = ++ pneg_inbuf->SecurityMode = + cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); + else +- vneg_inbuf.SecurityMode = 0; ++ pneg_inbuf->SecurityMode = 0; + + + if (strcmp(tcon->ses->server->vals->version_string, + SMB3ANY_VERSION_STRING) == 0) { +- vneg_inbuf.Dialects[0] = cpu_to_le16(SMB30_PROT_ID); +- vneg_inbuf.Dialects[1] = cpu_to_le16(SMB302_PROT_ID); +- vneg_inbuf.DialectCount = cpu_to_le16(2); ++ pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); ++ pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); ++ pneg_inbuf->DialectCount = cpu_to_le16(2); + /* structure is big enough for 3 dialects, sending only 2 */ +- inbuflen = sizeof(struct validate_negotiate_info_req) - 2; ++ inbuflen = sizeof(*pneg_inbuf) - ++ sizeof(pneg_inbuf->Dialects[0]); + } else if (strcmp(tcon->ses->server->vals->version_string, + SMBDEFAULT_VERSION_STRING) == 0) { +- vneg_inbuf.Dialects[0] = cpu_to_le16(SMB21_PROT_ID); +- vneg_inbuf.Dialects[1] = cpu_to_le16(SMB30_PROT_ID); +- vneg_inbuf.Dialects[2] = cpu_to_le16(SMB302_PROT_ID); +- vneg_inbuf.DialectCount = cpu_to_le16(3); ++ pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); ++ pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); ++ pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); ++ pneg_inbuf->DialectCount = cpu_to_le16(3); + /* structure is big enough for 3 dialects */ +- inbuflen = sizeof(struct validate_negotiate_info_req); ++ inbuflen = sizeof(*pneg_inbuf); + } else { + /* otherwise specific dialect was requested */ +- vneg_inbuf.Dialects[0] = ++ pneg_inbuf->Dialects[0] = + cpu_to_le16(tcon->ses->server->vals->protocol_id); +- vneg_inbuf.DialectCount = cpu_to_le16(1); ++ pneg_inbuf->DialectCount = cpu_to_le16(1); + /* structure is big enough for 3 dialects, sending only 1 */ +- inbuflen = sizeof(struct validate_negotiate_info_req) - 4; ++ inbuflen = sizeof(*pneg_inbuf) - ++ sizeof(pneg_inbuf->Dialects[0]) * 2; + } + + rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, + FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */, +- (char *)&vneg_inbuf, sizeof(struct validate_negotiate_info_req), +- (char **)&pneg_rsp, &rsplen); ++ (char *)pneg_inbuf, inbuflen, (char **)&pneg_rsp, &rsplen); + + if (rc != 0) { + cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc); +- return -EIO; ++ rc = -EIO; ++ goto out_free_inbuf; + } + +- if (rsplen != sizeof(struct validate_negotiate_info_rsp)) { ++ rc = -EIO; ++ if (rsplen != sizeof(*pneg_rsp)) { + cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n", + rsplen); + + /* relax check since Mac returns max bufsize allowed on ioctl */ +- if ((rsplen > CIFSMaxBufSize) +- || (rsplen < sizeof(struct validate_negotiate_info_rsp))) +- goto err_rsp_free; ++ if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) ++ goto out_free_rsp; + } + + /* check validate negotiate info response matches what we got earlier */ +@@ -729,15 +735,17 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) + goto vneg_out; + + /* validate negotiate successful */ ++ rc = 0; + cifs_dbg(FYI, "validate negotiate info successful\n"); +- kfree(pneg_rsp); +- return 0; ++ goto out_free_rsp; + + vneg_out: + cifs_dbg(VFS, "protocol revalidation - security settings mismatch\n"); +-err_rsp_free: ++out_free_rsp: + kfree(pneg_rsp); +- return -EIO; ++out_free_inbuf: ++ kfree(pneg_inbuf); ++ return rc; + } + + enum securityEnum +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 1b5cd3b8617c..a56abb46613e 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -833,8 +833,11 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses, + if (n_vec + 1 > CIFS_MAX_IOV_SIZE) { + new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1), + GFP_KERNEL); +- if (!new_iov) ++ if (!new_iov) { ++ /* otherwise cifs_send_recv below sets resp_buf_type */ ++ *resp_buf_type = CIFS_NO_BUFFER; + return -ENOMEM; ++ } + } else + new_iov = s_iov; + +diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c +index 846ca150d52e..4dd842f72846 100644 +--- a/fs/ecryptfs/crypto.c ++++ b/fs/ecryptfs/crypto.c +@@ -1997,6 +1997,16 @@ int ecryptfs_encrypt_and_encode_filename( + return rc; + } + ++static bool is_dot_dotdot(const char *name, size_t name_size) ++{ ++ if (name_size == 1 && name[0] == '.') ++ return true; ++ else if (name_size == 2 && name[0] == '.' && name[1] == '.') ++ return true; ++ ++ return false; ++} ++ + /** + * ecryptfs_decode_and_decrypt_filename - converts the encoded cipher text name to decoded plaintext + * @plaintext_name: The plaintext name +@@ -2021,13 +2031,21 @@ int ecryptfs_decode_and_decrypt_filename(char **plaintext_name, + size_t packet_size; + int rc = 0; + +- if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) +- && !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) +- && (name_size > ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE) +- && (strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX, +- ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE) == 0)) { +- const char *orig_name = name; +- size_t orig_name_size = name_size; ++ if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) && ++ !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)) { ++ if (is_dot_dotdot(name, name_size)) { ++ rc = ecryptfs_copy_filename(plaintext_name, ++ plaintext_name_size, ++ name, name_size); ++ goto out; ++ } ++ ++ if (name_size <= ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE || ++ strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX, ++ ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)) { ++ rc = -EINVAL; ++ goto out; ++ } + + name += ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE; + name_size -= ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE; +@@ -2047,12 +2065,9 @@ int ecryptfs_decode_and_decrypt_filename(char **plaintext_name, + decoded_name, + decoded_name_size); + if (rc) { +- printk(KERN_INFO "%s: Could not parse tag 70 packet " +- "from filename; copying through filename " +- "as-is\n", __func__); +- rc = ecryptfs_copy_filename(plaintext_name, +- plaintext_name_size, +- orig_name, orig_name_size); ++ ecryptfs_printk(KERN_DEBUG, ++ "%s: Could not parse tag 70 packet from filename\n", ++ __func__); + goto out_free; + } + } else { +diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c +index c74ed3ca3372..b76a9853325e 100644 +--- a/fs/ecryptfs/file.c ++++ b/fs/ecryptfs/file.c +@@ -82,17 +82,28 @@ ecryptfs_filldir(struct dir_context *ctx, const char *lower_name, + buf->sb, lower_name, + lower_namelen); + if (rc) { +- printk(KERN_ERR "%s: Error attempting to decode and decrypt " +- "filename [%s]; rc = [%d]\n", __func__, lower_name, +- rc); +- goto out; ++ if (rc != -EINVAL) { ++ ecryptfs_printk(KERN_DEBUG, ++ "%s: Error attempting to decode and decrypt filename [%s]; rc = [%d]\n", ++ __func__, lower_name, rc); ++ return rc; ++ } ++ ++ /* Mask -EINVAL errors as these are most likely due a plaintext ++ * filename present in the lower filesystem despite filename ++ * encryption being enabled. One unavoidable example would be ++ * the "lost+found" dentry in the root directory of an Ext4 ++ * filesystem. ++ */ ++ return 0; + } ++ + buf->caller->pos = buf->ctx.pos; + rc = !dir_emit(buf->caller, name, name_size, ino, d_type); + kfree(name); + if (!rc) + buf->entries_written++; +-out: ++ + return rc; + } + +diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c +index bc258a4402f6..ec3fba7d492f 100644 +--- a/fs/isofs/inode.c ++++ b/fs/isofs/inode.c +@@ -394,7 +394,10 @@ static int parse_options(char *options, struct iso9660_options *popt) + break; + #ifdef CONFIG_JOLIET + case Opt_iocharset: ++ kfree(popt->iocharset); + popt->iocharset = match_strdup(&args[0]); ++ if (!popt->iocharset) ++ return 0; + break; + #endif + case Opt_map_a: +diff --git a/fs/namespace.c b/fs/namespace.c +index c3ed9dc78655..cb20c4ee97fc 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -2810,7 +2810,7 @@ long do_mount(const char *dev_name, const char __user *dir_name, + mnt_flags |= MNT_NODIRATIME; + if (flags & MS_STRICTATIME) + mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME); +- if (flags & SB_RDONLY) ++ if (flags & MS_RDONLY) + mnt_flags |= MNT_READONLY; + + /* The default atime for remount is preservation */ +diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c +index 219b269c737e..613ec7e5a465 100644 +--- a/fs/notify/fsnotify.c ++++ b/fs/notify/fsnotify.c +@@ -192,8 +192,9 @@ static int send_to_group(struct inode *to_tell, + struct fsnotify_iter_info *iter_info) + { + struct fsnotify_group *group = NULL; +- __u32 inode_test_mask = 0; +- __u32 vfsmount_test_mask = 0; ++ __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD); ++ __u32 marks_mask = 0; ++ __u32 marks_ignored_mask = 0; + + if (unlikely(!inode_mark && !vfsmount_mark)) { + BUG(); +@@ -213,29 +214,25 @@ static int send_to_group(struct inode *to_tell, + /* does the inode mark tell us to do something? */ + if (inode_mark) { + group = inode_mark->group; +- inode_test_mask = (mask & ~FS_EVENT_ON_CHILD); +- inode_test_mask &= inode_mark->mask; +- inode_test_mask &= ~inode_mark->ignored_mask; ++ marks_mask |= inode_mark->mask; ++ marks_ignored_mask |= inode_mark->ignored_mask; + } + + /* does the vfsmount_mark tell us to do something? */ + if (vfsmount_mark) { +- vfsmount_test_mask = (mask & ~FS_EVENT_ON_CHILD); + group = vfsmount_mark->group; +- vfsmount_test_mask &= vfsmount_mark->mask; +- vfsmount_test_mask &= ~vfsmount_mark->ignored_mask; +- if (inode_mark) +- vfsmount_test_mask &= ~inode_mark->ignored_mask; ++ marks_mask |= vfsmount_mark->mask; ++ marks_ignored_mask |= vfsmount_mark->ignored_mask; + } + + pr_debug("%s: group=%p to_tell=%p mask=%x inode_mark=%p" +- " inode_test_mask=%x vfsmount_mark=%p vfsmount_test_mask=%x" ++ " vfsmount_mark=%p marks_mask=%x marks_ignored_mask=%x" + " data=%p data_is=%d cookie=%d\n", +- __func__, group, to_tell, mask, inode_mark, +- inode_test_mask, vfsmount_mark, vfsmount_test_mask, data, ++ __func__, group, to_tell, mask, inode_mark, vfsmount_mark, ++ marks_mask, marks_ignored_mask, data, + data_is, cookie); + +- if (!inode_test_mask && !vfsmount_test_mask) ++ if (!(test_mask & marks_mask & ~marks_ignored_mask)) + return 0; + + return group->ops->handle_event(group, to_tell, inode_mark, +diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c +index ab156e35ec00..1b1283f07941 100644 +--- a/fs/ocfs2/refcounttree.c ++++ b/fs/ocfs2/refcounttree.c +@@ -4250,10 +4250,11 @@ static int __ocfs2_reflink(struct dentry *old_dentry, + static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir, + struct dentry *new_dentry, bool preserve) + { +- int error; ++ int error, had_lock; + struct inode *inode = d_inode(old_dentry); + struct buffer_head *old_bh = NULL; + struct inode *new_orphan_inode = NULL; ++ struct ocfs2_lock_holder oh; + + if (!ocfs2_refcount_tree(OCFS2_SB(inode->i_sb))) + return -EOPNOTSUPP; +@@ -4295,6 +4296,14 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir, + goto out; + } + ++ had_lock = ocfs2_inode_lock_tracker(new_orphan_inode, NULL, 1, ++ &oh); ++ if (had_lock < 0) { ++ error = had_lock; ++ mlog_errno(error); ++ goto out; ++ } ++ + /* If the security isn't preserved, we need to re-initialize them. */ + if (!preserve) { + error = ocfs2_init_security_and_acl(dir, new_orphan_inode, +@@ -4302,14 +4311,15 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir, + if (error) + mlog_errno(error); + } +-out: + if (!error) { + error = ocfs2_mv_orphaned_inode_to_new(dir, new_orphan_inode, + new_dentry); + if (error) + mlog_errno(error); + } ++ ocfs2_inode_unlock_tracker(new_orphan_inode, 1, &oh, had_lock); + ++out: + if (new_orphan_inode) { + /* + * We need to open_unlock the inode no matter whether we +diff --git a/fs/proc/base.c b/fs/proc/base.c +index f034eccd8616..d256b24f7d28 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -1693,6 +1693,12 @@ void task_dump_owner(struct task_struct *task, umode_t mode, + kuid_t uid; + kgid_t gid; + ++ if (unlikely(task->flags & PF_KTHREAD)) { ++ *ruid = GLOBAL_ROOT_UID; ++ *rgid = GLOBAL_ROOT_GID; ++ return; ++ } ++ + /* Default to the tasks effective ownership */ + rcu_read_lock(); + cred = __task_cred(task); +diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c +index d1e82761de81..e64ecb9f2720 100644 +--- a/fs/proc/kcore.c ++++ b/fs/proc/kcore.c +@@ -209,25 +209,34 @@ kclist_add_private(unsigned long pfn, unsigned long nr_pages, void *arg) + { + struct list_head *head = (struct list_head *)arg; + struct kcore_list *ent; ++ struct page *p; ++ ++ if (!pfn_valid(pfn)) ++ return 1; ++ ++ p = pfn_to_page(pfn); ++ if (!memmap_valid_within(pfn, p, page_zone(p))) ++ return 1; + + ent = kmalloc(sizeof(*ent), GFP_KERNEL); + if (!ent) + return -ENOMEM; +- ent->addr = (unsigned long)__va((pfn << PAGE_SHIFT)); ++ ent->addr = (unsigned long)page_to_virt(p); + ent->size = nr_pages << PAGE_SHIFT; + +- /* Sanity check: Can happen in 32bit arch...maybe */ +- if (ent->addr < (unsigned long) __va(0)) ++ if (!virt_addr_valid(ent->addr)) + goto free_out; + + /* cut not-mapped area. ....from ppc-32 code. */ + if (ULONG_MAX - ent->addr < ent->size) + ent->size = ULONG_MAX - ent->addr; + +- /* cut when vmalloc() area is higher than direct-map area */ +- if (VMALLOC_START > (unsigned long)__va(0)) { +- if (ent->addr > VMALLOC_START) +- goto free_out; ++ /* ++ * We've already checked virt_addr_valid so we know this address ++ * is a valid pointer, therefore we can check against it to determine ++ * if we need to trim ++ */ ++ if (VMALLOC_START > ent->addr) { + if (VMALLOC_START - ent->addr < ent->size) + ent->size = VMALLOC_START - ent->addr; + } +diff --git a/fs/proc/loadavg.c b/fs/proc/loadavg.c +index a000d7547479..b572cc865b92 100644 +--- a/fs/proc/loadavg.c ++++ b/fs/proc/loadavg.c +@@ -24,7 +24,7 @@ static int loadavg_proc_show(struct seq_file *m, void *v) + LOAD_INT(avnrun[1]), LOAD_FRAC(avnrun[1]), + LOAD_INT(avnrun[2]), LOAD_FRAC(avnrun[2]), + nr_running(), nr_threads, +- idr_get_cursor(&task_active_pid_ns(current)->idr)); ++ idr_get_cursor(&task_active_pid_ns(current)->idr) - 1); + return 0; + } + +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index ec6d2983a5cb..dd1b2aeb01e8 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1329,9 +1329,11 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION + else if (is_swap_pmd(pmd)) { + swp_entry_t entry = pmd_to_swp_entry(pmd); ++ unsigned long offset = swp_offset(entry); + ++ offset += (addr & ~PMD_MASK) >> PAGE_SHIFT; + frame = swp_type(entry) | +- (swp_offset(entry) << MAX_SWAPFILES_SHIFT); ++ (offset << MAX_SWAPFILES_SHIFT); + flags |= PM_SWAP; + if (pmd_swp_soft_dirty(pmd)) + flags |= PM_SOFT_DIRTY; +@@ -1351,6 +1353,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + break; + if (pm->show_pfn && (flags & PM_PRESENT)) + frame++; ++ else if (flags & PM_SWAP) ++ frame += (1 << MAX_SWAPFILES_SHIFT); + } + spin_unlock(ptl); + return err; +diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h +index d3339dd48b1a..b324e01ccf2d 100644 +--- a/include/linux/brcmphy.h ++++ b/include/linux/brcmphy.h +@@ -25,6 +25,7 @@ + #define PHY_ID_BCM54612E 0x03625e60 + #define PHY_ID_BCM54616S 0x03625d10 + #define PHY_ID_BCM57780 0x03625d90 ++#define PHY_ID_BCM89610 0x03625cd0 + + #define PHY_ID_BCM7250 0xae025280 + #define PHY_ID_BCM7260 0xae025190 +diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h +index f711be6e8c44..f3ae6ae7e786 100644 +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -755,6 +755,9 @@ int __clk_mux_determine_rate(struct clk_hw *hw, + int __clk_determine_rate(struct clk_hw *core, struct clk_rate_request *req); + int __clk_mux_determine_rate_closest(struct clk_hw *hw, + struct clk_rate_request *req); ++int clk_mux_determine_rate_flags(struct clk_hw *hw, ++ struct clk_rate_request *req, ++ unsigned long flags); + void clk_hw_reparent(struct clk_hw *hw, struct clk_hw *new_parent); + void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate, + unsigned long max_rate); +diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h +index 2ec41a7eb54f..35e5954a5a15 100644 +--- a/include/linux/ethtool.h ++++ b/include/linux/ethtool.h +@@ -310,6 +310,8 @@ bool ethtool_convert_link_mode_to_legacy_u32(u32 *legacy_u32, + * fields should be ignored (use %__ETHTOOL_LINK_MODE_MASK_NBITS + * instead of the latter), any change to them will be overwritten + * by kernel. Returns a negative error code or zero. ++ * @get_fecparam: Get the network device Forward Error Correction parameters. ++ * @set_fecparam: Set the network device Forward Error Correction parameters. + * + * All operations are optional (i.e. the function pointer may be set + * to %NULL) and callers must take this into account. Callers must +diff --git a/include/linux/genhd.h b/include/linux/genhd.h +index c826b0b5232a..6cb8a5789668 100644 +--- a/include/linux/genhd.h ++++ b/include/linux/genhd.h +@@ -368,7 +368,9 @@ static inline void free_part_stats(struct hd_struct *part) + part_stat_add(cpu, gendiskp, field, -subnd) + + void part_in_flight(struct request_queue *q, struct hd_struct *part, +- unsigned int inflight[2]); ++ unsigned int inflight[2]); ++void part_in_flight_rw(struct request_queue *q, struct hd_struct *part, ++ unsigned int inflight[2]); + void part_dec_in_flight(struct request_queue *q, struct hd_struct *part, + int rw); + void part_inc_in_flight(struct request_queue *q, struct hd_struct *part, +diff --git a/include/linux/kthread.h b/include/linux/kthread.h +index c1961761311d..2803264c512f 100644 +--- a/include/linux/kthread.h ++++ b/include/linux/kthread.h +@@ -62,6 +62,7 @@ void *kthread_probe_data(struct task_struct *k); + int kthread_park(struct task_struct *k); + void kthread_unpark(struct task_struct *k); + void kthread_parkme(void); ++void kthread_park_complete(struct task_struct *k); + + int kthreadd(void *unused); + extern struct task_struct *kthreadd_task; +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 6930c63126c7..6d6e79c59e68 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -1045,13 +1045,7 @@ static inline int mmu_notifier_retry(struct kvm *kvm, unsigned long mmu_seq) + + #ifdef CONFIG_HAVE_KVM_IRQ_ROUTING + +-#ifdef CONFIG_S390 +-#define KVM_MAX_IRQ_ROUTES 4096 //FIXME: we can have more than that... +-#elif defined(CONFIG_ARM64) +-#define KVM_MAX_IRQ_ROUTES 4096 +-#else +-#define KVM_MAX_IRQ_ROUTES 1024 +-#endif ++#define KVM_MAX_IRQ_ROUTES 4096 /* might need extension/rework in the future */ + + bool kvm_arch_can_set_irq_routing(struct kvm *kvm); + int kvm_set_irq_routing(struct kvm *kvm, +diff --git a/include/linux/microchipphy.h b/include/linux/microchipphy.h +index eb492d47f717..8f9c90379732 100644 +--- a/include/linux/microchipphy.h ++++ b/include/linux/microchipphy.h +@@ -70,4 +70,12 @@ + #define LAN88XX_MMD3_CHIP_ID (32877) + #define LAN88XX_MMD3_CHIP_REV (32878) + ++/* DSP registers */ ++#define PHY_ARDENNES_MMD_DEV_3_PHY_CFG (0x806A) ++#define PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_ (0x2000) ++#define LAN88XX_EXT_PAGE_ACCESS_TR (0x52B5) ++#define LAN88XX_EXT_PAGE_TR_CR 16 ++#define LAN88XX_EXT_PAGE_TR_LOW_DATA 17 ++#define LAN88XX_EXT_PAGE_TR_HIGH_DATA 18 ++ + #endif /* _MICROCHIPPHY_H */ +diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h +index b5b43f94f311..01b990e4b228 100644 +--- a/include/linux/mtd/map.h ++++ b/include/linux/mtd/map.h +@@ -312,7 +312,7 @@ void map_destroy(struct mtd_info *mtd); + ({ \ + int i, ret = 1; \ + for (i = 0; i < map_words(map); i++) { \ +- if (((val1).x[i] & (val2).x[i]) != (val2).x[i]) { \ ++ if (((val1).x[i] & (val2).x[i]) != (val3).x[i]) { \ + ret = 0; \ + break; \ + } \ +diff --git a/include/linux/mtd/rawnand.h b/include/linux/mtd/rawnand.h +index 56c5570aadbe..694f718d012f 100644 +--- a/include/linux/mtd/rawnand.h ++++ b/include/linux/mtd/rawnand.h +@@ -824,12 +824,18 @@ struct nand_op_instr { + * tBERS (during an erase) which all of them are u64 values that cannot be + * divided by usual kernel macros and must be handled with the special + * DIV_ROUND_UP_ULL() macro. ++ * ++ * Cast to type of dividend is needed here to guarantee that the result won't ++ * be an unsigned long long when the dividend is an unsigned long (or smaller), ++ * which is what the compiler does when it sees ternary operator with 2 ++ * different return types (picks the largest type to make sure there's no ++ * loss). + */ +-#define __DIVIDE(dividend, divisor) ({ \ +- sizeof(dividend) == sizeof(u32) ? \ +- DIV_ROUND_UP(dividend, divisor) : \ +- DIV_ROUND_UP_ULL(dividend, divisor); \ +- }) ++#define __DIVIDE(dividend, divisor) ({ \ ++ (__typeof__(dividend))(sizeof(dividend) <= sizeof(unsigned long) ? \ ++ DIV_ROUND_UP(dividend, divisor) : \ ++ DIV_ROUND_UP_ULL(dividend, divisor)); \ ++ }) + #define PSEC_TO_NSEC(x) __DIVIDE(x, 1000) + #define PSEC_TO_MSEC(x) __DIVIDE(x, 1000000000) + +diff --git a/include/linux/percpu-rwsem.h b/include/linux/percpu-rwsem.h +index b1f37a89e368..79b99d653e03 100644 +--- a/include/linux/percpu-rwsem.h ++++ b/include/linux/percpu-rwsem.h +@@ -133,7 +133,7 @@ static inline void percpu_rwsem_release(struct percpu_rw_semaphore *sem, + lock_release(&sem->rw_sem.dep_map, 1, ip); + #ifdef CONFIG_RWSEM_SPIN_ON_OWNER + if (!read) +- sem->rw_sem.owner = NULL; ++ sem->rw_sem.owner = RWSEM_OWNER_UNKNOWN; + #endif + } + +@@ -141,6 +141,10 @@ static inline void percpu_rwsem_acquire(struct percpu_rw_semaphore *sem, + bool read, unsigned long ip) + { + lock_acquire(&sem->rw_sem.dep_map, 0, 1, read, 1, NULL, ip); ++#ifdef CONFIG_RWSEM_SPIN_ON_OWNER ++ if (!read) ++ sem->rw_sem.owner = current; ++#endif + } + + #endif +diff --git a/include/linux/rwsem.h b/include/linux/rwsem.h +index 56707d5ff6ad..ab93b6eae696 100644 +--- a/include/linux/rwsem.h ++++ b/include/linux/rwsem.h +@@ -44,6 +44,12 @@ struct rw_semaphore { + #endif + }; + ++/* ++ * Setting bit 0 of the owner field with other non-zero bits will indicate ++ * that the rwsem is writer-owned with an unknown owner. ++ */ ++#define RWSEM_OWNER_UNKNOWN ((struct task_struct *)-1L) ++ + extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *sem); + extern struct rw_semaphore *rwsem_down_read_failed_killable(struct rw_semaphore *sem); + extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *sem); +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 710508af02c8..8145cb4ee838 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -113,17 +113,36 @@ struct task_group; + + #ifdef CONFIG_DEBUG_ATOMIC_SLEEP + ++/* ++ * Special states are those that do not use the normal wait-loop pattern. See ++ * the comment with set_special_state(). ++ */ ++#define is_special_task_state(state) \ ++ ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_DEAD)) ++ + #define __set_current_state(state_value) \ + do { \ ++ WARN_ON_ONCE(is_special_task_state(state_value));\ + current->task_state_change = _THIS_IP_; \ + current->state = (state_value); \ + } while (0) ++ + #define set_current_state(state_value) \ + do { \ ++ WARN_ON_ONCE(is_special_task_state(state_value));\ + current->task_state_change = _THIS_IP_; \ + smp_store_mb(current->state, (state_value)); \ + } while (0) + ++#define set_special_state(state_value) \ ++ do { \ ++ unsigned long flags; /* may shadow */ \ ++ WARN_ON_ONCE(!is_special_task_state(state_value)); \ ++ raw_spin_lock_irqsave(¤t->pi_lock, flags); \ ++ current->task_state_change = _THIS_IP_; \ ++ current->state = (state_value); \ ++ raw_spin_unlock_irqrestore(¤t->pi_lock, flags); \ ++ } while (0) + #else + /* + * set_current_state() includes a barrier so that the write of current->state +@@ -145,8 +164,8 @@ struct task_group; + * + * The above is typically ordered against the wakeup, which does: + * +- * need_sleep = false; +- * wake_up_state(p, TASK_UNINTERRUPTIBLE); ++ * need_sleep = false; ++ * wake_up_state(p, TASK_UNINTERRUPTIBLE); + * + * Where wake_up_state() (and all other wakeup primitives) imply enough + * barriers to order the store of the variable against wakeup. +@@ -155,12 +174,33 @@ struct task_group; + * once it observes the TASK_UNINTERRUPTIBLE store the waking CPU can issue a + * TASK_RUNNING store which can collide with __set_current_state(TASK_RUNNING). + * +- * This is obviously fine, since they both store the exact same value. ++ * However, with slightly different timing the wakeup TASK_RUNNING store can ++ * also collide with the TASK_UNINTERRUPTIBLE store. Loosing that store is not ++ * a problem either because that will result in one extra go around the loop ++ * and our @cond test will save the day. + * + * Also see the comments of try_to_wake_up(). + */ +-#define __set_current_state(state_value) do { current->state = (state_value); } while (0) +-#define set_current_state(state_value) smp_store_mb(current->state, (state_value)) ++#define __set_current_state(state_value) \ ++ current->state = (state_value) ++ ++#define set_current_state(state_value) \ ++ smp_store_mb(current->state, (state_value)) ++ ++/* ++ * set_special_state() should be used for those states when the blocking task ++ * can not use the regular condition based wait-loop. In that case we must ++ * serialize against wakeups such that any possible in-flight TASK_RUNNING stores ++ * will not collide with our state change. ++ */ ++#define set_special_state(state_value) \ ++ do { \ ++ unsigned long flags; /* may shadow */ \ ++ raw_spin_lock_irqsave(¤t->pi_lock, flags); \ ++ current->state = (state_value); \ ++ raw_spin_unlock_irqrestore(¤t->pi_lock, flags); \ ++ } while (0) ++ + #endif + + /* Task command name length: */ +diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h +index 23b4f9cb82db..acf701e057af 100644 +--- a/include/linux/sched/signal.h ++++ b/include/linux/sched/signal.h +@@ -280,7 +280,7 @@ static inline void kernel_signal_stop(void) + { + spin_lock_irq(¤t->sighand->siglock); + if (current->jobctl & JOBCTL_STOP_DEQUEUED) +- __set_current_state(TASK_STOPPED); ++ set_special_state(TASK_STOPPED); + spin_unlock_irq(¤t->sighand->siglock); + + schedule(); +diff --git a/include/linux/stringhash.h b/include/linux/stringhash.h +index e8f0f852968f..c0c5c5b73dc0 100644 +--- a/include/linux/stringhash.h ++++ b/include/linux/stringhash.h +@@ -50,9 +50,9 @@ partial_name_hash(unsigned long c, unsigned long prevhash) + * losing bits). This also has the property (wanted by the dcache) + * that the msbits make a good hash table index. + */ +-static inline unsigned long end_name_hash(unsigned long hash) ++static inline unsigned int end_name_hash(unsigned long hash) + { +- return __hash_32((unsigned int)hash); ++ return hash_long(hash, 32); + } + + /* +diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h +index cb979ad90401..b86c4c367004 100644 +--- a/include/soc/bcm2835/raspberrypi-firmware.h ++++ b/include/soc/bcm2835/raspberrypi-firmware.h +@@ -125,13 +125,13 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node); + static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag, + void *data, size_t len) + { +- return 0; ++ return -ENOSYS; + } + + static inline int rpi_firmware_property_list(struct rpi_firmware *fw, + void *data, size_t tag_size) + { +- return 0; ++ return -ENOSYS; + } + + static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node) +diff --git a/init/main.c b/init/main.c +index 21efbf6ace93..dacaf589226a 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -981,6 +981,13 @@ __setup("rodata=", set_debug_rodata); + static void mark_readonly(void) + { + if (rodata_enabled) { ++ /* ++ * load_module() results in W+X mappings, which are cleaned up ++ * with call_rcu_sched(). Let's make sure that queued work is ++ * flushed so that we don't hit false positives looking for ++ * insecure pages which are W+X. ++ */ ++ rcu_barrier_sched(); + mark_rodata_ro(); + rodata_test(); + } else +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 43f95d190eea..d18c8bf4051b 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \ + (map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \ +@@ -102,12 +103,14 @@ const struct bpf_map_ops bpf_map_offload_ops = { + static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) + { + const struct bpf_map_ops *ops; ++ u32 type = attr->map_type; + struct bpf_map *map; + int err; + +- if (attr->map_type >= ARRAY_SIZE(bpf_map_types)) ++ if (type >= ARRAY_SIZE(bpf_map_types)) + return ERR_PTR(-EINVAL); +- ops = bpf_map_types[attr->map_type]; ++ type = array_index_nospec(type, ARRAY_SIZE(bpf_map_types)); ++ ops = bpf_map_types[type]; + if (!ops) + return ERR_PTR(-EINVAL); + +@@ -122,7 +125,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) + if (IS_ERR(map)) + return map; + map->ops = ops; +- map->map_type = attr->map_type; ++ map->map_type = type; + return map; + } + +@@ -869,11 +872,17 @@ static const struct bpf_prog_ops * const bpf_prog_types[] = { + + static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog) + { +- if (type >= ARRAY_SIZE(bpf_prog_types) || !bpf_prog_types[type]) ++ const struct bpf_prog_ops *ops; ++ ++ if (type >= ARRAY_SIZE(bpf_prog_types)) ++ return -EINVAL; ++ type = array_index_nospec(type, ARRAY_SIZE(bpf_prog_types)); ++ ops = bpf_prog_types[type]; ++ if (!ops) + return -EINVAL; + + if (!bpf_prog_is_dev_bound(prog->aux)) +- prog->aux->ops = bpf_prog_types[type]; ++ prog->aux->ops = ops; + else + prog->aux->ops = &bpf_offload_prog_ops; + prog->type = type; +diff --git a/kernel/kthread.c b/kernel/kthread.c +index cd50e99202b0..2017a39ab490 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -55,7 +55,6 @@ enum KTHREAD_BITS { + KTHREAD_IS_PER_CPU = 0, + KTHREAD_SHOULD_STOP, + KTHREAD_SHOULD_PARK, +- KTHREAD_IS_PARKED, + }; + + static inline void set_kthread_struct(void *kthread) +@@ -177,14 +176,12 @@ void *kthread_probe_data(struct task_struct *task) + + static void __kthread_parkme(struct kthread *self) + { +- __set_current_state(TASK_PARKED); +- while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) { +- if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags)) +- complete(&self->parked); ++ for (;;) { ++ set_current_state(TASK_PARKED); ++ if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags)) ++ break; + schedule(); +- __set_current_state(TASK_PARKED); + } +- clear_bit(KTHREAD_IS_PARKED, &self->flags); + __set_current_state(TASK_RUNNING); + } + +@@ -194,6 +191,11 @@ void kthread_parkme(void) + } + EXPORT_SYMBOL_GPL(kthread_parkme); + ++void kthread_park_complete(struct task_struct *k) ++{ ++ complete(&to_kthread(k)->parked); ++} ++ + static int kthread(void *_create) + { + /* Copy data: it's on kthread's stack */ +@@ -450,22 +452,15 @@ void kthread_unpark(struct task_struct *k) + { + struct kthread *kthread = to_kthread(k); + +- clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags); + /* +- * We clear the IS_PARKED bit here as we don't wait +- * until the task has left the park code. So if we'd +- * park before that happens we'd see the IS_PARKED bit +- * which might be about to be cleared. ++ * Newly created kthread was parked when the CPU was offline. ++ * The binding was lost and we need to set it again. + */ +- if (test_and_clear_bit(KTHREAD_IS_PARKED, &kthread->flags)) { +- /* +- * Newly created kthread was parked when the CPU was offline. +- * The binding was lost and we need to set it again. +- */ +- if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags)) +- __kthread_bind(k, kthread->cpu, TASK_PARKED); +- wake_up_state(k, TASK_PARKED); +- } ++ if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags)) ++ __kthread_bind(k, kthread->cpu, TASK_PARKED); ++ ++ clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags); ++ wake_up_state(k, TASK_PARKED); + } + EXPORT_SYMBOL_GPL(kthread_unpark); + +@@ -488,12 +483,13 @@ int kthread_park(struct task_struct *k) + if (WARN_ON(k->flags & PF_EXITING)) + return -ENOSYS; + +- if (!test_bit(KTHREAD_IS_PARKED, &kthread->flags)) { +- set_bit(KTHREAD_SHOULD_PARK, &kthread->flags); +- if (k != current) { +- wake_up_process(k); +- wait_for_completion(&kthread->parked); +- } ++ if (WARN_ON_ONCE(test_bit(KTHREAD_SHOULD_PARK, &kthread->flags))) ++ return -EBUSY; ++ ++ set_bit(KTHREAD_SHOULD_PARK, &kthread->flags); ++ if (k != current) { ++ wake_up_process(k); ++ wait_for_completion(&kthread->parked); + } + + return 0; +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index e795908f3607..a90336779375 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -352,16 +352,15 @@ static inline bool rwsem_can_spin_on_owner(struct rw_semaphore *sem) + struct task_struct *owner; + bool ret = true; + ++ BUILD_BUG_ON(!rwsem_has_anonymous_owner(RWSEM_OWNER_UNKNOWN)); ++ + if (need_resched()) + return false; + + rcu_read_lock(); + owner = READ_ONCE(sem->owner); +- if (!rwsem_owner_is_writer(owner)) { +- /* +- * Don't spin if the rwsem is readers owned. +- */ +- ret = !rwsem_owner_is_reader(owner); ++ if (!owner || !is_rwsem_owner_spinnable(owner)) { ++ ret = !owner; /* !owner is spinnable */ + goto done; + } + +@@ -382,11 +381,11 @@ static noinline bool rwsem_spin_on_owner(struct rw_semaphore *sem) + { + struct task_struct *owner = READ_ONCE(sem->owner); + +- if (!rwsem_owner_is_writer(owner)) +- goto out; ++ if (!is_rwsem_owner_spinnable(owner)) ++ return false; + + rcu_read_lock(); +- while (sem->owner == owner) { ++ while (owner && (READ_ONCE(sem->owner) == owner)) { + /* + * Ensure we emit the owner->on_cpu, dereference _after_ + * checking sem->owner still matches owner, if that fails, +@@ -408,12 +407,12 @@ static noinline bool rwsem_spin_on_owner(struct rw_semaphore *sem) + cpu_relax(); + } + rcu_read_unlock(); +-out: ++ + /* + * If there is a new owner or the owner is not set, we continue + * spinning. + */ +- return !rwsem_owner_is_reader(READ_ONCE(sem->owner)); ++ return is_rwsem_owner_spinnable(READ_ONCE(sem->owner)); + } + + static bool rwsem_optimistic_spin(struct rw_semaphore *sem) +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index f549c552dbf1..abbf506b1c72 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -217,5 +217,3 @@ void up_read_non_owner(struct rw_semaphore *sem) + EXPORT_SYMBOL(up_read_non_owner); + + #endif +- +- +diff --git a/kernel/locking/rwsem.h b/kernel/locking/rwsem.h +index a883b8f1fdc6..410ee7b9ac2c 100644 +--- a/kernel/locking/rwsem.h ++++ b/kernel/locking/rwsem.h +@@ -1,20 +1,24 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + /* + * The owner field of the rw_semaphore structure will be set to +- * RWSEM_READ_OWNED when a reader grabs the lock. A writer will clear ++ * RWSEM_READER_OWNED when a reader grabs the lock. A writer will clear + * the owner field when it unlocks. A reader, on the other hand, will + * not touch the owner field when it unlocks. + * +- * In essence, the owner field now has the following 3 states: ++ * In essence, the owner field now has the following 4 states: + * 1) 0 + * - lock is free or the owner hasn't set the field yet + * 2) RWSEM_READER_OWNED + * - lock is currently or previously owned by readers (lock is free + * or not set by owner yet) +- * 3) Other non-zero value +- * - a writer owns the lock ++ * 3) RWSEM_ANONYMOUSLY_OWNED bit set with some other bits set as well ++ * - lock is owned by an anonymous writer, so spinning on the lock ++ * owner should be disabled. ++ * 4) Other non-zero value ++ * - a writer owns the lock and other writers can spin on the lock owner. + */ +-#define RWSEM_READER_OWNED ((struct task_struct *)1UL) ++#define RWSEM_ANONYMOUSLY_OWNED (1UL << 0) ++#define RWSEM_READER_OWNED ((struct task_struct *)RWSEM_ANONYMOUSLY_OWNED) + + #ifdef CONFIG_RWSEM_SPIN_ON_OWNER + /* +@@ -45,14 +49,22 @@ static inline void rwsem_set_reader_owned(struct rw_semaphore *sem) + WRITE_ONCE(sem->owner, RWSEM_READER_OWNED); + } + +-static inline bool rwsem_owner_is_writer(struct task_struct *owner) ++/* ++ * Return true if the a rwsem waiter can spin on the rwsem's owner ++ * and steal the lock, i.e. the lock is not anonymously owned. ++ * N.B. !owner is considered spinnable. ++ */ ++static inline bool is_rwsem_owner_spinnable(struct task_struct *owner) + { +- return owner && owner != RWSEM_READER_OWNED; ++ return !((unsigned long)owner & RWSEM_ANONYMOUSLY_OWNED); + } + +-static inline bool rwsem_owner_is_reader(struct task_struct *owner) ++/* ++ * Return true if rwsem is owned by an anonymous writer or readers. ++ */ ++static inline bool rwsem_has_anonymous_owner(struct task_struct *owner) + { +- return owner == RWSEM_READER_OWNED; ++ return (unsigned long)owner & RWSEM_ANONYMOUSLY_OWNED; + } + #else + static inline void rwsem_set_owner(struct rw_semaphore *sem) +diff --git a/kernel/module.c b/kernel/module.c +index bbb45c038321..c3cc1f8615e1 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -3521,6 +3521,11 @@ static noinline int do_init_module(struct module *mod) + * walking this with preempt disabled. In all the failure paths, we + * call synchronize_sched(), but we don't want to slow down the success + * path, so use actual RCU here. ++ * Note that module_alloc() on most architectures creates W+X page ++ * mappings which won't be cleaned up until do_free_init() runs. Any ++ * code such as mark_rodata_ro() which depends on those mappings to ++ * be cleaned up needs to sync with the queued work - ie ++ * rcu_barrier_sched() + */ + call_rcu_sched(&freeinit->rcu, do_free_init); + mutex_unlock(&module_mutex); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 5f37ef9f6cd5..ce2716bccc8e 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -30,6 +30,8 @@ + #include + #include + ++#include ++ + #include + #include + #ifdef CONFIG_PARAVIRT +@@ -2733,20 +2735,28 @@ static struct rq *finish_task_switch(struct task_struct *prev) + membarrier_mm_sync_core_before_usermode(mm); + mmdrop(mm); + } +- if (unlikely(prev_state == TASK_DEAD)) { +- if (prev->sched_class->task_dead) +- prev->sched_class->task_dead(prev); ++ if (unlikely(prev_state & (TASK_DEAD|TASK_PARKED))) { ++ switch (prev_state) { ++ case TASK_DEAD: ++ if (prev->sched_class->task_dead) ++ prev->sched_class->task_dead(prev); + +- /* +- * Remove function-return probe instances associated with this +- * task and put them back on the free list. +- */ +- kprobe_flush_task(prev); ++ /* ++ * Remove function-return probe instances associated with this ++ * task and put them back on the free list. ++ */ ++ kprobe_flush_task(prev); ++ ++ /* Task is done with its stack. */ ++ put_task_stack(prev); + +- /* Task is done with its stack. */ +- put_task_stack(prev); ++ put_task_struct(prev); ++ break; + +- put_task_struct(prev); ++ case TASK_PARKED: ++ kthread_park_complete(prev); ++ break; ++ } + } + + tick_nohz_task_switch(); +@@ -3449,23 +3459,8 @@ static void __sched notrace __schedule(bool preempt) + + void __noreturn do_task_dead(void) + { +- /* +- * The setting of TASK_RUNNING by try_to_wake_up() may be delayed +- * when the following two conditions become true. +- * - There is race condition of mmap_sem (It is acquired by +- * exit_mm()), and +- * - SMI occurs before setting TASK_RUNINNG. +- * (or hypervisor of virtual machine switches to other guest) +- * As a result, we may become TASK_RUNNING after becoming TASK_DEAD +- * +- * To avoid it, we have to wait for releasing tsk->pi_lock which +- * is held by try_to_wake_up() +- */ +- raw_spin_lock_irq(¤t->pi_lock); +- raw_spin_unlock_irq(¤t->pi_lock); +- + /* Causes final put_task_struct in finish_task_switch(): */ +- __set_current_state(TASK_DEAD); ++ set_special_state(TASK_DEAD); + + /* Tell freezer to ignore us: */ + current->flags |= PF_NOFREEZE; +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 9df09782025c..a6b6b45a0c68 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -1121,7 +1121,7 @@ extern bool sched_rt_bandwidth_account(struct rt_rq *rt_rq); + * should be larger than 2^(64 - 20 - 8), which is more than 64 seconds. + * So, overflow is not an issue here. + */ +-u64 grub_reclaim(u64 delta, struct rq *rq, struct sched_dl_entity *dl_se) ++static u64 grub_reclaim(u64 delta, struct rq *rq, struct sched_dl_entity *dl_se) + { + u64 u_inact = rq->dl.this_bw - rq->dl.running_bw; /* Utot - Uact */ + u64 u_act; +@@ -2723,8 +2723,6 @@ bool dl_cpu_busy(unsigned int cpu) + #endif + + #ifdef CONFIG_SCHED_DEBUG +-extern void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq); +- + void print_dl_stats(struct seq_file *m, int cpu) + { + print_dl_rq(m, cpu, &cpu_rq(cpu)->dl); +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 84bf1a24a55a..cf52bf16aa7e 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -2691,8 +2691,6 @@ int sched_rr_handler(struct ctl_table *table, int write, + } + + #ifdef CONFIG_SCHED_DEBUG +-extern void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq); +- + void print_rt_stats(struct seq_file *m, int cpu) + { + rt_rq_iter_t iter; +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index fb5fc458547f..b0c98ff56071 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1986,8 +1986,9 @@ extern bool sched_debug_enabled; + extern void print_cfs_stats(struct seq_file *m, int cpu); + extern void print_rt_stats(struct seq_file *m, int cpu); + extern void print_dl_stats(struct seq_file *m, int cpu); +-extern void +-print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq); ++extern void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq); ++extern void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq); ++extern void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq); + #ifdef CONFIG_NUMA_BALANCING + extern void + show_numa_stats(struct task_struct *p, struct seq_file *m); +diff --git a/kernel/signal.c b/kernel/signal.c +index c6e4c83dc090..365aacb46aa6 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -1961,14 +1961,27 @@ static void ptrace_stop(int exit_code, int why, int clear_code, siginfo_t *info) + return; + } + ++ set_special_state(TASK_TRACED); ++ + /* + * We're committing to trapping. TRACED should be visible before + * TRAPPING is cleared; otherwise, the tracer might fail do_wait(). + * Also, transition to TRACED and updates to ->jobctl should be + * atomic with respect to siglock and should be done after the arch + * hook as siglock is released and regrabbed across it. ++ * ++ * TRACER TRACEE ++ * ++ * ptrace_attach() ++ * [L] wait_on_bit(JOBCTL_TRAPPING) [S] set_special_state(TRACED) ++ * do_wait() ++ * set_current_state() smp_wmb(); ++ * ptrace_do_wait() ++ * wait_task_stopped() ++ * task_stopped_code() ++ * [L] task_is_traced() [S] task_clear_jobctl_trapping(); + */ +- set_current_state(TASK_TRACED); ++ smp_wmb(); + + current->last_siginfo = info; + current->exit_code = exit_code; +@@ -2176,7 +2189,7 @@ static bool do_signal_stop(int signr) + if (task_participate_group_stop(current)) + notify = CLD_STOPPED; + +- __set_current_state(TASK_STOPPED); ++ set_special_state(TASK_STOPPED); + spin_unlock_irq(¤t->sighand->siglock); + + /* +diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c +index b7591261652d..64c0291b579c 100644 +--- a/kernel/stop_machine.c ++++ b/kernel/stop_machine.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + /* + * Structure to determine completion condition and record errors. May +@@ -65,27 +66,31 @@ static void cpu_stop_signal_done(struct cpu_stop_done *done) + } + + static void __cpu_stop_queue_work(struct cpu_stopper *stopper, +- struct cpu_stop_work *work) ++ struct cpu_stop_work *work, ++ struct wake_q_head *wakeq) + { + list_add_tail(&work->list, &stopper->works); +- wake_up_process(stopper->thread); ++ wake_q_add(wakeq, stopper->thread); + } + + /* queue @work to @stopper. if offline, @work is completed immediately */ + static bool cpu_stop_queue_work(unsigned int cpu, struct cpu_stop_work *work) + { + struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu); ++ DEFINE_WAKE_Q(wakeq); + unsigned long flags; + bool enabled; + + spin_lock_irqsave(&stopper->lock, flags); + enabled = stopper->enabled; + if (enabled) +- __cpu_stop_queue_work(stopper, work); ++ __cpu_stop_queue_work(stopper, work, &wakeq); + else if (work->done) + cpu_stop_signal_done(work->done); + spin_unlock_irqrestore(&stopper->lock, flags); + ++ wake_up_q(&wakeq); ++ + return enabled; + } + +@@ -229,6 +234,7 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1, + { + struct cpu_stopper *stopper1 = per_cpu_ptr(&cpu_stopper, cpu1); + struct cpu_stopper *stopper2 = per_cpu_ptr(&cpu_stopper, cpu2); ++ DEFINE_WAKE_Q(wakeq); + int err; + retry: + spin_lock_irq(&stopper1->lock); +@@ -252,8 +258,8 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1, + goto unlock; + + err = 0; +- __cpu_stop_queue_work(stopper1, work1); +- __cpu_stop_queue_work(stopper2, work2); ++ __cpu_stop_queue_work(stopper1, work1, &wakeq); ++ __cpu_stop_queue_work(stopper2, work2, &wakeq); + unlock: + spin_unlock(&stopper2->lock); + spin_unlock_irq(&stopper1->lock); +@@ -263,6 +269,9 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1, + cpu_relax(); + goto retry; + } ++ ++ wake_up_q(&wakeq); ++ + return err; + } + /** +diff --git a/lib/find_bit_benchmark.c b/lib/find_bit_benchmark.c +index 5985a25e6cbc..5367ffa5c18f 100644 +--- a/lib/find_bit_benchmark.c ++++ b/lib/find_bit_benchmark.c +@@ -132,7 +132,12 @@ static int __init find_bit_test(void) + test_find_next_bit(bitmap, BITMAP_LEN); + test_find_next_zero_bit(bitmap, BITMAP_LEN); + test_find_last_bit(bitmap, BITMAP_LEN); +- test_find_first_bit(bitmap, BITMAP_LEN); ++ ++ /* ++ * test_find_first_bit() may take some time, so ++ * traverse only part of bitmap to avoid soft lockup. ++ */ ++ test_find_first_bit(bitmap, BITMAP_LEN / 10); + test_find_next_and_bit(bitmap, bitmap2, BITMAP_LEN); + + pr_err("\nStart testing find_bit() with sparse bitmap\n"); +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 88719f53ae3b..b1b13c214e95 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -2192,7 +2192,7 @@ static void __memcg_schedule_kmem_cache_create(struct mem_cgroup *memcg, + { + struct memcg_kmem_cache_create_work *cw; + +- cw = kmalloc(sizeof(*cw), GFP_NOWAIT); ++ cw = kmalloc(sizeof(*cw), GFP_NOWAIT | __GFP_NOWARN); + if (!cw) + return; + +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 3726dc797847..a57788b0082e 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -669,7 +669,7 @@ static void vti6_link_config(struct ip6_tnl *t, bool keep_mtu) + else + mtu = ETH_DATA_LEN - LL_MAX_HEADER - sizeof(struct ipv6hdr); + +- dev->mtu = max_t(int, mtu, IPV6_MIN_MTU); ++ dev->mtu = max_t(int, mtu, IPV4_MIN_MTU); + } + + /** +@@ -881,7 +881,7 @@ static void vti6_dev_setup(struct net_device *dev) + dev->priv_destructor = vti6_dev_free; + + dev->type = ARPHRD_TUNNEL6; +- dev->min_mtu = IPV6_MIN_MTU; ++ dev->min_mtu = IPV4_MIN_MTU; + dev->max_mtu = IP_MAX_MTU - sizeof(struct ipv6hdr); + dev->flags |= IFF_NOARP; + dev->addr_len = sizeof(struct in6_addr); +diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig +index d395d1590699..94b2d286a1b2 100644 +--- a/net/ipv6/netfilter/Kconfig ++++ b/net/ipv6/netfilter/Kconfig +@@ -48,6 +48,34 @@ config NFT_CHAIN_ROUTE_IPV6 + fields such as the source, destination, flowlabel, hop-limit and + the packet mark. + ++if NF_NAT_IPV6 ++ ++config NFT_CHAIN_NAT_IPV6 ++ tristate "IPv6 nf_tables nat chain support" ++ help ++ This option enables the "nat" chain for IPv6 in nf_tables. This ++ chain type is used to perform Network Address Translation (NAT) ++ packet transformations such as the source, destination address and ++ source and destination ports. ++ ++config NFT_MASQ_IPV6 ++ tristate "IPv6 masquerade support for nf_tables" ++ depends on NFT_MASQ ++ select NF_NAT_MASQUERADE_IPV6 ++ help ++ This is the expression that provides IPv4 masquerading support for ++ nf_tables. ++ ++config NFT_REDIR_IPV6 ++ tristate "IPv6 redirect support for nf_tables" ++ depends on NFT_REDIR ++ select NF_NAT_REDIRECT ++ help ++ This is the expression that provides IPv4 redirect support for ++ nf_tables. ++ ++endif # NF_NAT_IPV6 ++ + config NFT_REJECT_IPV6 + select NF_REJECT_IPV6 + default NFT_REJECT +@@ -107,39 +135,12 @@ config NF_NAT_IPV6 + + if NF_NAT_IPV6 + +-config NFT_CHAIN_NAT_IPV6 +- depends on NF_TABLES_IPV6 +- tristate "IPv6 nf_tables nat chain support" +- help +- This option enables the "nat" chain for IPv6 in nf_tables. This +- chain type is used to perform Network Address Translation (NAT) +- packet transformations such as the source, destination address and +- source and destination ports. +- + config NF_NAT_MASQUERADE_IPV6 + tristate "IPv6 masquerade support" + help + This is the kernel functionality to provide NAT in the masquerade + flavour (automatic source address selection) for IPv6. + +-config NFT_MASQ_IPV6 +- tristate "IPv6 masquerade support for nf_tables" +- depends on NF_TABLES_IPV6 +- depends on NFT_MASQ +- select NF_NAT_MASQUERADE_IPV6 +- help +- This is the expression that provides IPv4 masquerading support for +- nf_tables. +- +-config NFT_REDIR_IPV6 +- tristate "IPv6 redirect support for nf_tables" +- depends on NF_TABLES_IPV6 +- depends on NFT_REDIR +- select NF_NAT_REDIRECT +- help +- This is the expression that provides IPv4 redirect support for +- nf_tables. +- + endif # NF_NAT_IPV6 + + config IP6_NF_IPTABLES +diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c +index 595c662a61e8..ac4295296514 100644 +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -8,6 +8,7 @@ + * Copyright 2007, Michael Wu + * Copyright 2007-2010, Intel Corporation + * Copyright(c) 2015-2017 Intel Deutschland GmbH ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -970,6 +971,9 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local, + + sta->ampdu_mlme.addba_req_num[tid] = 0; + ++ tid_tx->timeout = ++ le16_to_cpu(mgmt->u.action.u.addba_resp.timeout); ++ + if (tid_tx->timeout) { + mod_timer(&tid_tx->session_timer, + TU_TO_EXP_TIME(tid_tx->timeout)); +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 5f303abac5ad..b2457d560e7a 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -35,6 +35,7 @@ + #define IEEE80211_AUTH_TIMEOUT (HZ / 5) + #define IEEE80211_AUTH_TIMEOUT_LONG (HZ / 2) + #define IEEE80211_AUTH_TIMEOUT_SHORT (HZ / 10) ++#define IEEE80211_AUTH_TIMEOUT_SAE (HZ * 2) + #define IEEE80211_AUTH_MAX_TRIES 3 + #define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5) + #define IEEE80211_ASSOC_TIMEOUT (HZ / 5) +@@ -3788,16 +3789,19 @@ static int ieee80211_auth(struct ieee80211_sub_if_data *sdata) + tx_flags); + + if (tx_flags == 0) { +- auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT; +- auth_data->timeout_started = true; +- run_again(sdata, auth_data->timeout); ++ if (auth_data->algorithm == WLAN_AUTH_SAE) ++ auth_data->timeout = jiffies + ++ IEEE80211_AUTH_TIMEOUT_SAE; ++ else ++ auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT; + } else { + auth_data->timeout = + round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG); +- auth_data->timeout_started = true; +- run_again(sdata, auth_data->timeout); + } + ++ auth_data->timeout_started = true; ++ run_again(sdata, auth_data->timeout); ++ + return 0; + } + +@@ -3868,8 +3872,15 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata) + ifmgd->status_received = false; + if (ifmgd->auth_data && ieee80211_is_auth(fc)) { + if (status_acked) { +- ifmgd->auth_data->timeout = +- jiffies + IEEE80211_AUTH_TIMEOUT_SHORT; ++ if (ifmgd->auth_data->algorithm == ++ WLAN_AUTH_SAE) ++ ifmgd->auth_data->timeout = ++ jiffies + ++ IEEE80211_AUTH_TIMEOUT_SAE; ++ else ++ ifmgd->auth_data->timeout = ++ jiffies + ++ IEEE80211_AUTH_TIMEOUT_SHORT; + run_again(sdata, ifmgd->auth_data->timeout); + } else { + ifmgd->auth_data->timeout = jiffies - 1; +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 69722504e3e1..516b63db8d5d 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -4,6 +4,7 @@ + * Copyright 2006-2007 Jiri Benc + * Copyright 2007 Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -1138,7 +1139,7 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx, + } + + /* reset session timer */ +- if (reset_agg_timer && tid_tx->timeout) ++ if (reset_agg_timer) + tid_tx->last_tx = jiffies; + + return queued; +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index c853386b86ff..e6e6f4ce6322 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5741,7 +5741,7 @@ static void nft_chain_commit_update(struct nft_trans *trans) + struct nft_base_chain *basechain; + + if (nft_trans_chain_name(trans)) +- strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans)); ++ swap(trans->ctx.chain->name, nft_trans_chain_name(trans)); + + if (!nft_is_base_chain(trans->ctx.chain)) + return; +diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c +index eea1d8611b20..13b38ad0fa4a 100644 +--- a/net/rds/ib_cm.c ++++ b/net/rds/ib_cm.c +@@ -547,7 +547,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) + rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd, + ic->i_send_cq, ic->i_recv_cq); + +- return ret; ++ goto out; + + sends_out: + vfree(ic->i_sends); +@@ -572,6 +572,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) + ic->i_send_cq = NULL; + rds_ibdev_out: + rds_ib_remove_conn(rds_ibdev, conn); ++out: + rds_ib_dev_put(rds_ibdev); + + return ret; +diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c +index 0c9c18aa7c77..cfcedfcccf10 100644 +--- a/net/rxrpc/af_rxrpc.c ++++ b/net/rxrpc/af_rxrpc.c +@@ -310,7 +310,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock, + memset(&cp, 0, sizeof(cp)); + cp.local = rx->local; + cp.key = key; +- cp.security_level = 0; ++ cp.security_level = rx->min_sec_level; + cp.exclusive = false; + cp.upgrade = upgrade; + cp.service_id = srx->srx_service; +diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h +index 416688381eb7..0aa8c7ff1143 100644 +--- a/net/rxrpc/ar-internal.h ++++ b/net/rxrpc/ar-internal.h +@@ -464,6 +464,7 @@ enum rxrpc_call_flag { + RXRPC_CALL_SEND_PING, /* A ping will need to be sent */ + RXRPC_CALL_PINGING, /* Ping in process */ + RXRPC_CALL_RETRANS_TIMEOUT, /* Retransmission due to timeout occurred */ ++ RXRPC_CALL_BEGAN_RX_TIMER, /* We began the expect_rx_by timer */ + }; + + /* +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index 34db634594c4..c01a7fb280cc 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -971,7 +971,7 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call, + if (timo) { + unsigned long now = jiffies, expect_rx_by; + +- expect_rx_by = jiffies + timo; ++ expect_rx_by = now + timo; + WRITE_ONCE(call->expect_rx_by, expect_rx_by); + rxrpc_reduce_call_timer(call, expect_rx_by, now, + rxrpc_timer_set_for_normal); +diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c +index 38b99db30e54..2af42c7d5b82 100644 +--- a/net/rxrpc/local_object.c ++++ b/net/rxrpc/local_object.c +@@ -133,22 +133,49 @@ static int rxrpc_open_socket(struct rxrpc_local *local, struct net *net) + } + } + +- /* we want to receive ICMP errors */ +- opt = 1; +- ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR, +- (char *) &opt, sizeof(opt)); +- if (ret < 0) { +- _debug("setsockopt failed"); +- goto error; +- } ++ switch (local->srx.transport.family) { ++ case AF_INET: ++ /* we want to receive ICMP errors */ ++ opt = 1; ++ ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR, ++ (char *) &opt, sizeof(opt)); ++ if (ret < 0) { ++ _debug("setsockopt failed"); ++ goto error; ++ } + +- /* we want to set the don't fragment bit */ +- opt = IP_PMTUDISC_DO; +- ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER, +- (char *) &opt, sizeof(opt)); +- if (ret < 0) { +- _debug("setsockopt failed"); +- goto error; ++ /* we want to set the don't fragment bit */ ++ opt = IP_PMTUDISC_DO; ++ ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER, ++ (char *) &opt, sizeof(opt)); ++ if (ret < 0) { ++ _debug("setsockopt failed"); ++ goto error; ++ } ++ break; ++ ++ case AF_INET6: ++ /* we want to receive ICMP errors */ ++ opt = 1; ++ ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR, ++ (char *) &opt, sizeof(opt)); ++ if (ret < 0) { ++ _debug("setsockopt failed"); ++ goto error; ++ } ++ ++ /* we want to set the don't fragment bit */ ++ opt = IPV6_PMTUDISC_DO; ++ ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER, ++ (char *) &opt, sizeof(opt)); ++ if (ret < 0) { ++ _debug("setsockopt failed"); ++ goto error; ++ } ++ break; ++ ++ default: ++ BUG(); + } + + /* set the socket up */ +diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c +index cf73dc006c3b..8787ff39e4f8 100644 +--- a/net/rxrpc/output.c ++++ b/net/rxrpc/output.c +@@ -407,6 +407,17 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb, + rxrpc_timer_set_for_lost_ack); + } + } ++ ++ if (sp->hdr.seq == 1 && ++ !test_and_set_bit(RXRPC_CALL_BEGAN_RX_TIMER, ++ &call->flags)) { ++ unsigned long nowj = jiffies, expect_rx_by; ++ ++ expect_rx_by = nowj + call->next_rx_timo; ++ WRITE_ONCE(call->expect_rx_by, expect_rx_by); ++ rxrpc_reduce_call_timer(call, expect_rx_by, nowj, ++ rxrpc_timer_set_for_normal); ++ } + } + + rxrpc_set_keepalive(call); +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c +index 7a94ce92ffdc..28f9e1584ff3 100644 +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -223,6 +223,15 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call, + + ret = rxrpc_send_data_packet(call, skb, false); + if (ret < 0) { ++ switch (ret) { ++ case -ENETUNREACH: ++ case -EHOSTUNREACH: ++ case -ECONNREFUSED: ++ rxrpc_set_call_completion(call, ++ RXRPC_CALL_LOCAL_ERROR, ++ 0, ret); ++ goto out; ++ } + _debug("need instant resend %d", ret); + rxrpc_instant_resend(call, ix); + } else { +@@ -241,6 +250,7 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call, + rxrpc_timer_set_for_send); + } + ++out: + rxrpc_free_skb(skb, rxrpc_skb_tx_freed); + _leave(""); + } +diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c +index 5a3f691bb545..c8ba29535919 100644 +--- a/net/sched/act_skbedit.c ++++ b/net/sched/act_skbedit.c +@@ -121,7 +121,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, + return 0; + + if (!flags) { +- tcf_idr_release(*a, bind); ++ if (exists) ++ tcf_idr_release(*a, bind); + return -EINVAL; + } + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 5a983c9bea53..0132c08b0680 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1313,8 +1313,11 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page, + + smc = smc_sk(sk); + lock_sock(sk); +- if (sk->sk_state != SMC_ACTIVE) ++ if (sk->sk_state != SMC_ACTIVE) { ++ release_sock(sk); + goto out; ++ } ++ release_sock(sk); + if (smc->use_fallback) + rc = kernel_sendpage(smc->clcsock, page, offset, + size, flags); +@@ -1322,7 +1325,6 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page, + rc = sock_no_sendpage(sock, page, offset, size, flags); + + out: +- release_sock(sk); + return rc; + } + +diff --git a/net/sunrpc/xprtrdma/fmr_ops.c b/net/sunrpc/xprtrdma/fmr_ops.c +index d5f95bb39300..5679b5374dfb 100644 +--- a/net/sunrpc/xprtrdma/fmr_ops.c ++++ b/net/sunrpc/xprtrdma/fmr_ops.c +@@ -72,6 +72,7 @@ fmr_op_init_mr(struct rpcrdma_ia *ia, struct rpcrdma_mr *mr) + if (IS_ERR(mr->fmr.fm_mr)) + goto out_fmr_err; + ++ INIT_LIST_HEAD(&mr->mr_list); + return 0; + + out_fmr_err: +@@ -102,10 +103,6 @@ fmr_op_release_mr(struct rpcrdma_mr *mr) + LIST_HEAD(unmap_list); + int rc; + +- /* Ensure MW is not on any rl_registered list */ +- if (!list_empty(&mr->mr_list)) +- list_del(&mr->mr_list); +- + kfree(mr->fmr.fm_physaddrs); + kfree(mr->mr_sg); + +diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c +index 90f688f19783..4d11dc5190b8 100644 +--- a/net/sunrpc/xprtrdma/frwr_ops.c ++++ b/net/sunrpc/xprtrdma/frwr_ops.c +@@ -110,6 +110,7 @@ frwr_op_init_mr(struct rpcrdma_ia *ia, struct rpcrdma_mr *mr) + if (!mr->mr_sg) + goto out_list_err; + ++ INIT_LIST_HEAD(&mr->mr_list); + sg_init_table(mr->mr_sg, depth); + init_completion(&frwr->fr_linv_done); + return 0; +@@ -133,10 +134,6 @@ frwr_op_release_mr(struct rpcrdma_mr *mr) + { + int rc; + +- /* Ensure MR is not on any rl_registered list */ +- if (!list_empty(&mr->mr_list)) +- list_del(&mr->mr_list); +- + rc = ib_dereg_mr(mr->frwr.fr_mr); + if (rc) + pr_err("rpcrdma: final ib_dereg_mr for %p returned %i\n", +@@ -195,7 +192,7 @@ frwr_op_recover_mr(struct rpcrdma_mr *mr) + return; + + out_release: +- pr_err("rpcrdma: FRWR reset failed %d, %p release\n", rc, mr); ++ pr_err("rpcrdma: FRWR reset failed %d, %p released\n", rc, mr); + r_xprt->rx_stats.mrs_orphaned++; + + spin_lock(&r_xprt->rx_buf.rb_mrlock); +@@ -458,7 +455,7 @@ frwr_op_reminv(struct rpcrdma_rep *rep, struct list_head *mrs) + + list_for_each_entry(mr, mrs, mr_list) + if (mr->mr_handle == rep->rr_inv_rkey) { +- list_del(&mr->mr_list); ++ list_del_init(&mr->mr_list); + trace_xprtrdma_remoteinv(mr); + mr->frwr.fr_state = FRWR_IS_INVALID; + rpcrdma_mr_unmap_and_put(mr); +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 25b0ecbd37e2..20ad7bc1021c 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -1244,6 +1244,11 @@ rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf) + list_del(&mr->mr_all); + + spin_unlock(&buf->rb_mrlock); ++ ++ /* Ensure MW is not on any rl_registered list */ ++ if (!list_empty(&mr->mr_list)) ++ list_del(&mr->mr_list); ++ + ia->ri_ops->ro_release_mr(mr); + count++; + spin_lock(&buf->rb_mrlock); +diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h +index 430a6de8300e..99c96bf33fce 100644 +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -381,7 +381,7 @@ rpcrdma_mr_pop(struct list_head *list) + struct rpcrdma_mr *mr; + + mr = list_first_entry(list, struct rpcrdma_mr, mr_list); +- list_del(&mr->mr_list); ++ list_del_init(&mr->mr_list); + return mr; + } + +diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c +index 32dc33a94bc7..5453e564da82 100644 +--- a/net/tipc/monitor.c ++++ b/net/tipc/monitor.c +@@ -777,7 +777,7 @@ int __tipc_nl_add_monitor(struct net *net, struct tipc_nl_msg *msg, + + ret = tipc_bearer_get_name(net, bearer_name, bearer_id); + if (ret || !mon) +- return -EINVAL; ++ return 0; + + hdr = genlmsg_put(msg->skb, msg->portid, msg->seq, &tipc_genl_family, + NLM_F_MULTI, TIPC_NL_MON_GET); +diff --git a/net/tipc/node.c b/net/tipc/node.c +index 9036d8756e73..63f621e13d63 100644 +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -1863,6 +1863,7 @@ int tipc_nl_node_set_link(struct sk_buff *skb, struct genl_info *info) + int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info) + { + struct net *net = genl_info_net(info); ++ struct nlattr *attrs[TIPC_NLA_LINK_MAX + 1]; + struct tipc_nl_msg msg; + char *name; + int err; +@@ -1870,9 +1871,19 @@ int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info) + msg.portid = info->snd_portid; + msg.seq = info->snd_seq; + +- if (!info->attrs[TIPC_NLA_LINK_NAME]) ++ if (!info->attrs[TIPC_NLA_LINK]) + return -EINVAL; +- name = nla_data(info->attrs[TIPC_NLA_LINK_NAME]); ++ ++ err = nla_parse_nested(attrs, TIPC_NLA_LINK_MAX, ++ info->attrs[TIPC_NLA_LINK], ++ tipc_nl_link_policy, info->extack); ++ if (err) ++ return err; ++ ++ if (!attrs[TIPC_NLA_LINK_NAME]) ++ return -EINVAL; ++ ++ name = nla_data(attrs[TIPC_NLA_LINK_NAME]); + + msg.skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); + if (!msg.skb) +@@ -2145,8 +2156,8 @@ int tipc_nl_node_dump_monitor(struct sk_buff *skb, struct netlink_callback *cb) + struct net *net = sock_net(skb->sk); + u32 prev_bearer = cb->args[0]; + struct tipc_nl_msg msg; ++ int bearer_id; + int err; +- int i; + + if (prev_bearer == MAX_BEARERS) + return 0; +@@ -2156,16 +2167,13 @@ int tipc_nl_node_dump_monitor(struct sk_buff *skb, struct netlink_callback *cb) + msg.seq = cb->nlh->nlmsg_seq; + + rtnl_lock(); +- for (i = prev_bearer; i < MAX_BEARERS; i++) { +- prev_bearer = i; +- err = __tipc_nl_add_monitor(net, &msg, prev_bearer); ++ for (bearer_id = prev_bearer; bearer_id < MAX_BEARERS; bearer_id++) { ++ err = __tipc_nl_add_monitor(net, &msg, bearer_id); + if (err) +- goto out; ++ break; + } +- +-out: + rtnl_unlock(); +- cb->args[0] = prev_bearer; ++ cb->args[0] = bearer_id; + + return skb->len; + } +diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins +index b2a95af7df18..7f5c86246138 100644 +--- a/scripts/Makefile.gcc-plugins ++++ b/scripts/Makefile.gcc-plugins +@@ -14,7 +14,7 @@ ifdef CONFIG_GCC_PLUGINS + endif + + ifdef CONFIG_GCC_PLUGIN_SANCOV +- ifeq ($(CFLAGS_KCOV),) ++ ifeq ($(strip $(CFLAGS_KCOV)),) + # It is needed because of the gcc-plugin.sh and gcc version checks. + gcc-plugin-$(CONFIG_GCC_PLUGIN_SANCOV) += sancov_plugin.so + +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 44062bb7bf2f..f53922f4ee4e 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -1185,7 +1185,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + return irq; + } + +- ret = devm_request_irq(dev, irq, pm8916_mbhc_switch_irq_handler, ++ ret = devm_request_threaded_irq(dev, irq, NULL, ++ pm8916_mbhc_switch_irq_handler, + IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | + IRQF_ONESHOT, + "mbhc switch irq", priv); +@@ -1199,7 +1200,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + return irq; + } + +- ret = devm_request_irq(dev, irq, mbhc_btn_press_irq_handler, ++ ret = devm_request_threaded_irq(dev, irq, NULL, ++ mbhc_btn_press_irq_handler, + IRQF_TRIGGER_RISING | + IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + "mbhc btn press irq", priv); +@@ -1212,7 +1214,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + return irq; + } + +- ret = devm_request_irq(dev, irq, mbhc_btn_release_irq_handler, ++ ret = devm_request_threaded_irq(dev, irq, NULL, ++ mbhc_btn_release_irq_handler, + IRQF_TRIGGER_RISING | + IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + "mbhc btn release irq", priv); +diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c +index 198df016802f..74cb1d28e0f4 100644 +--- a/sound/soc/codecs/rt5514.c ++++ b/sound/soc/codecs/rt5514.c +@@ -89,6 +89,7 @@ static const struct reg_default rt5514_reg[] = { + {RT5514_PLL3_CALIB_CTRL5, 0x40220012}, + {RT5514_DELAY_BUF_CTRL1, 0x7fff006a}, + {RT5514_DELAY_BUF_CTRL3, 0x00000000}, ++ {RT5514_ASRC_IN_CTRL1, 0x00000003}, + {RT5514_DOWNFILTER0_CTRL1, 0x00020c2f}, + {RT5514_DOWNFILTER0_CTRL2, 0x00020c2f}, + {RT5514_DOWNFILTER0_CTRL3, 0x10000362}, +@@ -181,6 +182,7 @@ static bool rt5514_readable_register(struct device *dev, unsigned int reg) + case RT5514_PLL3_CALIB_CTRL5: + case RT5514_DELAY_BUF_CTRL1: + case RT5514_DELAY_BUF_CTRL3: ++ case RT5514_ASRC_IN_CTRL1: + case RT5514_DOWNFILTER0_CTRL1: + case RT5514_DOWNFILTER0_CTRL2: + case RT5514_DOWNFILTER0_CTRL3: +@@ -238,6 +240,7 @@ static bool rt5514_i2c_readable_register(struct device *dev, + case RT5514_DSP_MAPPING | RT5514_PLL3_CALIB_CTRL5: + case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL1: + case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL3: ++ case RT5514_DSP_MAPPING | RT5514_ASRC_IN_CTRL1: + case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL1: + case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL2: + case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL3: +diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig +index ceb105cbd461..addac2a8e52a 100644 +--- a/sound/soc/intel/Kconfig ++++ b/sound/soc/intel/Kconfig +@@ -72,24 +72,28 @@ config SND_SOC_INTEL_BAYTRAIL + for Baytrail Chromebooks but this option is now deprecated and is + not recommended, use SND_SST_ATOM_HIFI2_PLATFORM instead. + ++config SND_SST_ATOM_HIFI2_PLATFORM ++ tristate ++ select SND_SOC_COMPRESS ++ + config SND_SST_ATOM_HIFI2_PLATFORM_PCI +- tristate "PCI HiFi2 (Medfield, Merrifield) Platforms" ++ tristate "PCI HiFi2 (Merrifield) Platforms" + depends on X86 && PCI + select SND_SST_IPC_PCI +- select SND_SOC_COMPRESS ++ select SND_SST_ATOM_HIFI2_PLATFORM + help +- If you have a Intel Medfield or Merrifield/Edison platform, then ++ If you have a Intel Merrifield/Edison platform, then + enable this option by saying Y or m. Distros will typically not +- enable this option: Medfield devices are not available to +- developers and while Merrifield/Edison can run a mainline kernel with +- limited functionality it will require a firmware file which +- is not in the standard firmware tree ++ enable this option: while Merrifield/Edison can run a mainline ++ kernel with limited functionality it will require a firmware file ++ which is not in the standard firmware tree + +-config SND_SST_ATOM_HIFI2_PLATFORM ++config SND_SST_ATOM_HIFI2_PLATFORM_ACPI + tristate "ACPI HiFi2 (Baytrail, Cherrytrail) Platforms" ++ default ACPI + depends on X86 && ACPI + select SND_SST_IPC_ACPI +- select SND_SOC_COMPRESS ++ select SND_SST_ATOM_HIFI2_PLATFORM + select SND_SOC_ACPI_INTEL_MATCH + select IOSF_MBI + help +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index e5049fbfc4f1..30cdad2eab7f 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -510,7 +510,7 @@ static void remove_widget(struct snd_soc_component *comp, + */ + if (dobj->widget.kcontrol_type == SND_SOC_TPLG_TYPE_ENUM) { + /* enumerated widget mixer */ +- for (i = 0; i < w->num_kcontrols; i++) { ++ for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) { + struct snd_kcontrol *kcontrol = w->kcontrols[i]; + struct soc_enum *se = + (struct soc_enum *)kcontrol->private_value; +@@ -528,7 +528,7 @@ static void remove_widget(struct snd_soc_component *comp, + kfree(w->kcontrol_news); + } else { + /* volume mixer or bytes controls */ +- for (i = 0; i < w->num_kcontrols; i++) { ++ for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) { + struct snd_kcontrol *kcontrol = w->kcontrols[i]; + + if (dobj->widget.kcontrol_type +@@ -2571,7 +2571,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index) + + /* match index */ + if (dobj->index != index && +- dobj->index != SND_SOC_TPLG_INDEX_ALL) ++ index != SND_SOC_TPLG_INDEX_ALL) + continue; + + switch (dobj->type) { +diff --git a/tools/bpf/bpf_dbg.c b/tools/bpf/bpf_dbg.c +index 4f254bcc4423..61b9aa5d6415 100644 +--- a/tools/bpf/bpf_dbg.c ++++ b/tools/bpf/bpf_dbg.c +@@ -1063,7 +1063,7 @@ static int cmd_load_pcap(char *file) + + static int cmd_load(char *arg) + { +- char *subcmd, *cont, *tmp = strdup(arg); ++ char *subcmd, *cont = NULL, *tmp = strdup(arg); + int ret = CMD_OK; + + subcmd = strtok_r(tmp, " ", &cont); +@@ -1073,7 +1073,10 @@ static int cmd_load(char *arg) + bpf_reset(); + bpf_reset_breakpoints(); + +- ret = cmd_load_bpf(cont); ++ if (!cont) ++ ret = CMD_ERR; ++ else ++ ret = cmd_load_bpf(cont); + } else if (matches(subcmd, "pcap") == 0) { + ret = cmd_load_pcap(cont); + } else { +diff --git a/tools/objtool/arch/x86/include/asm/insn.h b/tools/objtool/arch/x86/include/asm/insn.h +index b3e32b010ab1..c2c01f84df75 100644 +--- a/tools/objtool/arch/x86/include/asm/insn.h ++++ b/tools/objtool/arch/x86/include/asm/insn.h +@@ -208,4 +208,22 @@ static inline int insn_offset_immediate(struct insn *insn) + return insn_offset_displacement(insn) + insn->displacement.nbytes; + } + ++#define POP_SS_OPCODE 0x1f ++#define MOV_SREG_OPCODE 0x8e ++ ++/* ++ * Intel SDM Vol.3A 6.8.3 states; ++ * "Any single-step trap that would be delivered following the MOV to SS ++ * instruction or POP to SS instruction (because EFLAGS.TF is 1) is ++ * suppressed." ++ * This function returns true if @insn is MOV SS or POP SS. On these ++ * instructions, single stepping is suppressed. ++ */ ++static inline int insn_masking_exception(struct insn *insn) ++{ ++ return insn->opcode.bytes[0] == POP_SS_OPCODE || ++ (insn->opcode.bytes[0] == MOV_SREG_OPCODE && ++ X86_MODRM_REG(insn->modrm.bytes[0]) == 2); ++} ++ + #endif /* _ASM_X86_INSN_H */ +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index b9f0a53dfa65..409d9d524bf9 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -212,6 +212,7 @@ static void cs_etm__free(struct perf_session *session) + for (i = 0; i < aux->num_cpu; i++) + zfree(&aux->metadata[i]); + ++ thread__zput(aux->unknown_thread); + zfree(&aux->metadata); + zfree(&aux); + } +@@ -980,6 +981,23 @@ int cs_etm__process_auxtrace_info(union perf_event *event, + etm->auxtrace.free = cs_etm__free; + session->auxtrace = &etm->auxtrace; + ++ etm->unknown_thread = thread__new(999999999, 999999999); ++ if (!etm->unknown_thread) ++ goto err_free_queues; ++ ++ /* ++ * Initialize list node so that at thread__zput() we can avoid ++ * segmentation fault at list_del_init(). ++ */ ++ INIT_LIST_HEAD(&etm->unknown_thread->node); ++ ++ err = thread__set_comm(etm->unknown_thread, "unknown", 0); ++ if (err) ++ goto err_delete_thread; ++ ++ if (thread__init_map_groups(etm->unknown_thread, etm->machine)) ++ goto err_delete_thread; ++ + if (dump_trace) { + cs_etm__print_auxtrace_info(auxtrace_info->priv, num_cpu); + return 0; +@@ -994,16 +1012,18 @@ int cs_etm__process_auxtrace_info(union perf_event *event, + + err = cs_etm__synth_events(etm, session); + if (err) +- goto err_free_queues; ++ goto err_delete_thread; + + err = auxtrace_queues__process_index(&etm->queues, session); + if (err) +- goto err_free_queues; ++ goto err_delete_thread; + + etm->data_queued = etm->queues.populated; + + return 0; + ++err_delete_thread: ++ thread__zput(etm->unknown_thread); + err_free_queues: + auxtrace_queues__free(&etm->queues); + session->auxtrace = NULL; +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index 57e38fdf0b34..60d0419bd41e 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -539,9 +539,10 @@ static bool pmu_is_uncore(const char *name) + + /* + * PMU CORE devices have different name other than cpu in sysfs on some +- * platforms. looking for possible sysfs files to identify as core device. ++ * platforms. ++ * Looking for possible sysfs files to identify the arm core device. + */ +-static int is_pmu_core(const char *name) ++static int is_arm_pmu_core(const char *name) + { + struct stat st; + char path[PATH_MAX]; +@@ -550,12 +551,6 @@ static int is_pmu_core(const char *name) + if (!sysfs) + return 0; + +- /* Look for cpu sysfs (x86 and others) */ +- scnprintf(path, PATH_MAX, "%s/bus/event_source/devices/cpu", sysfs); +- if ((stat(path, &st) == 0) && +- (strncmp(name, "cpu", strlen("cpu")) == 0)) +- return 1; +- + /* Look for cpu sysfs (specific to arm) */ + scnprintf(path, PATH_MAX, "%s/bus/event_source/devices/%s/cpus", + sysfs, name); +@@ -651,6 +646,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu) + struct pmu_events_map *map; + struct pmu_event *pe; + const char *name = pmu->name; ++ const char *pname; + + map = perf_pmu__find_map(pmu); + if (!map) +@@ -669,11 +665,9 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu) + break; + } + +- if (!is_pmu_core(name)) { +- /* check for uncore devices */ +- if (pe->pmu == NULL) +- continue; +- if (strncmp(pe->pmu, name, strlen(pe->pmu))) ++ if (!is_arm_pmu_core(name)) { ++ pname = pe->pmu ? pe->pmu : "cpu"; ++ if (strncmp(pname, name, strlen(pname))) + continue; + } + +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index cc065d4bfafc..902597b0e492 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -2094,16 +2094,14 @@ static bool symbol__read_kptr_restrict(void) + + int symbol__annotation_init(void) + { ++ if (symbol_conf.init_annotation) ++ return 0; ++ + if (symbol_conf.initialized) { + pr_err("Annotation needs to be init before symbol__init()\n"); + return -1; + } + +- if (symbol_conf.init_annotation) { +- pr_warning("Annotation being initialized multiple times\n"); +- return 0; +- } +- + symbol_conf.priv_size += sizeof(struct annotation); + symbol_conf.init_annotation = true; + return 0; +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc +new file mode 100644 +index 000000000000..c193dce611a2 +--- /dev/null ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc +@@ -0,0 +1,44 @@ ++#!/bin/sh ++# description: event trigger - test multiple actions on hist trigger ++ ++ ++do_reset() { ++ reset_trigger ++ echo > set_event ++ clear_trace ++} ++ ++fail() { #msg ++ do_reset ++ echo $1 ++ exit_fail ++} ++ ++if [ ! -f set_event ]; then ++ echo "event tracing is not supported" ++ exit_unsupported ++fi ++ ++if [ ! -f synthetic_events ]; then ++ echo "synthetic event is not supported" ++ exit_unsupported ++fi ++ ++clear_synthetic_events ++reset_tracer ++do_reset ++ ++echo "Test multiple actions on hist trigger" ++echo 'wakeup_latency u64 lat; pid_t pid' >> synthetic_events ++TRIGGER1=events/sched/sched_wakeup/trigger ++TRIGGER2=events/sched/sched_switch/trigger ++ ++echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="cyclictest"' > $TRIGGER1 ++echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0 if next_comm=="cyclictest"' >> $TRIGGER2 ++echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,next_pid) if next_comm=="cyclictest"' >> $TRIGGER2 ++echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,prev_pid) if next_comm=="cyclictest"' >> $TRIGGER2 ++echo 'hist:keys=next_pid if next_comm=="cyclictest"' >> $TRIGGER2 ++ ++do_reset ++ ++exit 0 +diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile +index d744991c0f4f..39f66bc29b82 100644 +--- a/tools/testing/selftests/x86/Makefile ++++ b/tools/testing/selftests/x86/Makefile +@@ -11,7 +11,7 @@ CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c) + + TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \ + check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \ +- protection_keys test_vdso test_vsyscall ++ protection_keys test_vdso test_vsyscall mov_ss_trap + TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \ + test_FCMOV test_FCOMI test_FISTTP \ + vdso_restorer +diff --git a/tools/testing/selftests/x86/mov_ss_trap.c b/tools/testing/selftests/x86/mov_ss_trap.c +new file mode 100644 +index 000000000000..3c3a022654f3 +--- /dev/null ++++ b/tools/testing/selftests/x86/mov_ss_trap.c +@@ -0,0 +1,285 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++/* ++ * mov_ss_trap.c: Exercise the bizarre side effects of a watchpoint on MOV SS ++ * ++ * This does MOV SS from a watchpointed address followed by various ++ * types of kernel entries. A MOV SS that hits a watchpoint will queue ++ * up a #DB trap but will not actually deliver that trap. The trap ++ * will be delivered after the next instruction instead. The CPU's logic ++ * seems to be: ++ * ++ * - Any fault: drop the pending #DB trap. ++ * - INT $N, INT3, INTO, SYSCALL, SYSENTER: enter the kernel and then ++ * deliver #DB. ++ * - ICEBP: enter the kernel but do not deliver the watchpoint trap ++ * - breakpoint: only one #DB is delivered (phew!) ++ * ++ * There are plenty of ways for a kernel to handle this incorrectly. This ++ * test tries to exercise all the cases. ++ * ++ * This should mostly cover CVE-2018-1087 and CVE-2018-8897. ++ */ ++#define _GNU_SOURCE ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define X86_EFLAGS_RF (1UL << 16) ++ ++#if __x86_64__ ++# define REG_IP REG_RIP ++#else ++# define REG_IP REG_EIP ++#endif ++ ++unsigned short ss; ++extern unsigned char breakpoint_insn[]; ++sigjmp_buf jmpbuf; ++static unsigned char altstack_data[SIGSTKSZ]; ++ ++static void enable_watchpoint(void) ++{ ++ pid_t parent = getpid(); ++ int status; ++ ++ pid_t child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ ++ if (child) { ++ if (waitpid(child, &status, 0) != child) ++ err(1, "waitpid for child"); ++ } else { ++ unsigned long dr0, dr1, dr7; ++ ++ dr0 = (unsigned long)&ss; ++ dr1 = (unsigned long)breakpoint_insn; ++ dr7 = ((1UL << 1) | /* G0 */ ++ (3UL << 16) | /* RW0 = read or write */ ++ (1UL << 18) | /* LEN0 = 2 bytes */ ++ (1UL << 3)); /* G1, RW1 = insn */ ++ ++ if (ptrace(PTRACE_ATTACH, parent, NULL, NULL) != 0) ++ err(1, "PTRACE_ATTACH"); ++ ++ if (waitpid(parent, &status, 0) != parent) ++ err(1, "waitpid for child"); ++ ++ if (ptrace(PTRACE_POKEUSER, parent, (void *)offsetof(struct user, u_debugreg[0]), dr0) != 0) ++ err(1, "PTRACE_POKEUSER DR0"); ++ ++ if (ptrace(PTRACE_POKEUSER, parent, (void *)offsetof(struct user, u_debugreg[1]), dr1) != 0) ++ err(1, "PTRACE_POKEUSER DR1"); ++ ++ if (ptrace(PTRACE_POKEUSER, parent, (void *)offsetof(struct user, u_debugreg[7]), dr7) != 0) ++ err(1, "PTRACE_POKEUSER DR7"); ++ ++ printf("\tDR0 = %lx, DR1 = %lx, DR7 = %lx\n", dr0, dr1, dr7); ++ ++ if (ptrace(PTRACE_DETACH, parent, NULL, NULL) != 0) ++ err(1, "PTRACE_DETACH"); ++ ++ exit(0); ++ } ++} ++ ++static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), ++ int flags) ++{ ++ struct sigaction sa; ++ memset(&sa, 0, sizeof(sa)); ++ sa.sa_sigaction = handler; ++ sa.sa_flags = SA_SIGINFO | flags; ++ sigemptyset(&sa.sa_mask); ++ if (sigaction(sig, &sa, 0)) ++ err(1, "sigaction"); ++} ++ ++static char const * const signames[] = { ++ [SIGSEGV] = "SIGSEGV", ++ [SIGBUS] = "SIBGUS", ++ [SIGTRAP] = "SIGTRAP", ++ [SIGILL] = "SIGILL", ++}; ++ ++static void sigtrap(int sig, siginfo_t *si, void *ctx_void) ++{ ++ ucontext_t *ctx = ctx_void; ++ ++ printf("\tGot SIGTRAP with RIP=%lx, EFLAGS.RF=%d\n", ++ (unsigned long)ctx->uc_mcontext.gregs[REG_IP], ++ !!(ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_RF)); ++} ++ ++static void handle_and_return(int sig, siginfo_t *si, void *ctx_void) ++{ ++ ucontext_t *ctx = ctx_void; ++ ++ printf("\tGot %s with RIP=%lx\n", signames[sig], ++ (unsigned long)ctx->uc_mcontext.gregs[REG_IP]); ++} ++ ++static void handle_and_longjmp(int sig, siginfo_t *si, void *ctx_void) ++{ ++ ucontext_t *ctx = ctx_void; ++ ++ printf("\tGot %s with RIP=%lx\n", signames[sig], ++ (unsigned long)ctx->uc_mcontext.gregs[REG_IP]); ++ ++ siglongjmp(jmpbuf, 1); ++} ++ ++int main() ++{ ++ unsigned long nr; ++ ++ asm volatile ("mov %%ss, %[ss]" : [ss] "=m" (ss)); ++ printf("\tSS = 0x%hx, &SS = 0x%p\n", ss, &ss); ++ ++ if (prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, 0, 0, 0) == 0) ++ printf("\tPR_SET_PTRACER_ANY succeeded\n"); ++ ++ printf("\tSet up a watchpoint\n"); ++ sethandler(SIGTRAP, sigtrap, 0); ++ enable_watchpoint(); ++ ++ printf("[RUN]\tRead from watched memory (should get SIGTRAP)\n"); ++ asm volatile ("mov %[ss], %[tmp]" : [tmp] "=r" (nr) : [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; INT3\n"); ++ asm volatile ("mov %[ss], %%ss; int3" :: [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; INT 3\n"); ++ asm volatile ("mov %[ss], %%ss; .byte 0xcd, 0x3" :: [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; CS CS INT3\n"); ++ asm volatile ("mov %[ss], %%ss; .byte 0x2e, 0x2e; int3" :: [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; CSx14 INT3\n"); ++ asm volatile ("mov %[ss], %%ss; .fill 14,1,0x2e; int3" :: [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; INT 4\n"); ++ sethandler(SIGSEGV, handle_and_return, SA_RESETHAND); ++ asm volatile ("mov %[ss], %%ss; int $4" :: [ss] "m" (ss)); ++ ++#ifdef __i386__ ++ printf("[RUN]\tMOV SS; INTO\n"); ++ sethandler(SIGSEGV, handle_and_return, SA_RESETHAND); ++ nr = -1; ++ asm volatile ("add $1, %[tmp]; mov %[ss], %%ss; into" ++ : [tmp] "+r" (nr) : [ss] "m" (ss)); ++#endif ++ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; ICEBP\n"); ++ ++ /* Some emulators (e.g. QEMU TCG) don't emulate ICEBP. */ ++ sethandler(SIGILL, handle_and_longjmp, SA_RESETHAND); ++ ++ asm volatile ("mov %[ss], %%ss; .byte 0xf1" :: [ss] "m" (ss)); ++ } ++ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; CLI\n"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND); ++ asm volatile ("mov %[ss], %%ss; cli" :: [ss] "m" (ss)); ++ } ++ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; #PF\n"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND); ++ asm volatile ("mov %[ss], %%ss; mov (-1), %[tmp]" ++ : [tmp] "=r" (nr) : [ss] "m" (ss)); ++ } ++ ++ /* ++ * INT $1: if #DB has DPL=3 and there isn't special handling, ++ * then the kernel will die. ++ */ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; INT 1\n"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND); ++ asm volatile ("mov %[ss], %%ss; int $1" :: [ss] "m" (ss)); ++ } ++ ++#ifdef __x86_64__ ++ /* ++ * In principle, we should test 32-bit SYSCALL as well, but ++ * the calling convention is so unpredictable that it's ++ * not obviously worth the effort. ++ */ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; SYSCALL\n"); ++ sethandler(SIGILL, handle_and_longjmp, SA_RESETHAND); ++ nr = SYS_getpid; ++ /* ++ * Toggle the high bit of RSP to make it noncanonical to ++ * strengthen this test on non-SMAP systems. ++ */ ++ asm volatile ("btc $63, %%rsp\n\t" ++ "mov %[ss], %%ss; syscall\n\t" ++ "btc $63, %%rsp" ++ : "+a" (nr) : [ss] "m" (ss) ++ : "rcx" ++#ifdef __x86_64__ ++ , "r11" ++#endif ++ ); ++ } ++#endif ++ ++ printf("[RUN]\tMOV SS; breakpointed NOP\n"); ++ asm volatile ("mov %[ss], %%ss; breakpoint_insn: nop" :: [ss] "m" (ss)); ++ ++ /* ++ * Invoking SYSENTER directly breaks all the rules. Just handle ++ * the SIGSEGV. ++ */ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; SYSENTER\n"); ++ stack_t stack = { ++ .ss_sp = altstack_data, ++ .ss_size = SIGSTKSZ, ++ }; ++ if (sigaltstack(&stack, NULL) != 0) ++ err(1, "sigaltstack"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND | SA_ONSTACK); ++ nr = SYS_getpid; ++ asm volatile ("mov %[ss], %%ss; SYSENTER" : "+a" (nr) ++ : [ss] "m" (ss) : "flags", "rcx" ++#ifdef __x86_64__ ++ , "r11" ++#endif ++ ); ++ ++ /* We're unreachable here. SYSENTER forgets RIP. */ ++ } ++ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; INT $0x80\n"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND); ++ nr = 20; /* compat getpid */ ++ asm volatile ("mov %[ss], %%ss; int $0x80" ++ : "+a" (nr) : [ss] "m" (ss) ++ : "flags" ++#ifdef __x86_64__ ++ , "r8", "r9", "r10", "r11" ++#endif ++ ); ++ } ++ ++ printf("[OK]\tI aten't dead\n"); ++ return 0; ++} +diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c +index 9c0325e1ea68..50f7e9272481 100644 +--- a/tools/testing/selftests/x86/mpx-mini-test.c ++++ b/tools/testing/selftests/x86/mpx-mini-test.c +@@ -368,6 +368,11 @@ static int expected_bnd_index = -1; + uint64_t shadow_plb[NR_MPX_BOUNDS_REGISTERS][2]; /* shadow MPX bound registers */ + unsigned long shadow_map[NR_MPX_BOUNDS_REGISTERS]; + ++/* Failed address bound checks: */ ++#ifndef SEGV_BNDERR ++# define SEGV_BNDERR 3 ++#endif ++ + /* + * The kernel is supposed to provide some information about the bounds + * exception in the siginfo. It should match what we have in the bounds +@@ -419,8 +424,6 @@ void handler(int signum, siginfo_t *si, void *vucontext) + br_count++; + dprintf1("#BR 0x%jx (total seen: %d)\n", status, br_count); + +-#define SEGV_BNDERR 3 /* failed address bound checks */ +- + dprintf2("Saw a #BR! status 0x%jx at %016lx br_reason: %jx\n", + status, ip, br_reason); + dprintf2("si_signo: %d\n", si->si_signo); +diff --git a/tools/testing/selftests/x86/pkey-helpers.h b/tools/testing/selftests/x86/pkey-helpers.h +index b3cb7670e026..254e5436bdd9 100644 +--- a/tools/testing/selftests/x86/pkey-helpers.h ++++ b/tools/testing/selftests/x86/pkey-helpers.h +@@ -26,30 +26,26 @@ static inline void sigsafe_printf(const char *format, ...) + { + va_list ap; + +- va_start(ap, format); + if (!dprint_in_signal) { ++ va_start(ap, format); + vprintf(format, ap); ++ va_end(ap); + } else { + int ret; +- int len = vsnprintf(dprint_in_signal_buffer, +- DPRINT_IN_SIGNAL_BUF_SIZE, +- format, ap); + /* +- * len is amount that would have been printed, +- * but actual write is truncated at BUF_SIZE. ++ * No printf() functions are signal-safe. ++ * They deadlock easily. Write the format ++ * string to get some output, even if ++ * incomplete. + */ +- if (len > DPRINT_IN_SIGNAL_BUF_SIZE) +- len = DPRINT_IN_SIGNAL_BUF_SIZE; +- ret = write(1, dprint_in_signal_buffer, len); ++ ret = write(1, format, strlen(format)); + if (ret < 0) +- abort(); ++ exit(1); + } +- va_end(ap); + } + #define dprintf_level(level, args...) do { \ + if (level <= DEBUG_LEVEL) \ + sigsafe_printf(args); \ +- fflush(NULL); \ + } while (0) + #define dprintf0(args...) dprintf_level(0, args) + #define dprintf1(args...) dprintf_level(1, args) +diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c +index f15aa5a76fe3..460b4bdf4c1e 100644 +--- a/tools/testing/selftests/x86/protection_keys.c ++++ b/tools/testing/selftests/x86/protection_keys.c +@@ -72,10 +72,9 @@ extern void abort_hooks(void); + test_nr, iteration_nr); \ + dprintf0("errno at assert: %d", errno); \ + abort_hooks(); \ +- assert(condition); \ ++ exit(__LINE__); \ + } \ + } while (0) +-#define raw_assert(cond) assert(cond) + + void cat_into_file(char *str, char *file) + { +@@ -87,12 +86,17 @@ void cat_into_file(char *str, char *file) + * these need to be raw because they are called under + * pkey_assert() + */ +- raw_assert(fd >= 0); ++ if (fd < 0) { ++ fprintf(stderr, "error opening '%s'\n", str); ++ perror("error: "); ++ exit(__LINE__); ++ } ++ + ret = write(fd, str, strlen(str)); + if (ret != strlen(str)) { + perror("write to file failed"); + fprintf(stderr, "filename: '%s' str: '%s'\n", file, str); +- raw_assert(0); ++ exit(__LINE__); + } + close(fd); + } +@@ -191,26 +195,30 @@ void lots_o_noops_around_write(int *write_to_me) + #ifdef __i386__ + + #ifndef SYS_mprotect_key +-# define SYS_mprotect_key 380 ++# define SYS_mprotect_key 380 + #endif ++ + #ifndef SYS_pkey_alloc +-# define SYS_pkey_alloc 381 +-# define SYS_pkey_free 382 ++# define SYS_pkey_alloc 381 ++# define SYS_pkey_free 382 + #endif +-#define REG_IP_IDX REG_EIP +-#define si_pkey_offset 0x14 ++ ++#define REG_IP_IDX REG_EIP ++#define si_pkey_offset 0x14 + + #else + + #ifndef SYS_mprotect_key +-# define SYS_mprotect_key 329 ++# define SYS_mprotect_key 329 + #endif ++ + #ifndef SYS_pkey_alloc +-# define SYS_pkey_alloc 330 +-# define SYS_pkey_free 331 ++# define SYS_pkey_alloc 330 ++# define SYS_pkey_free 331 + #endif +-#define REG_IP_IDX REG_RIP +-#define si_pkey_offset 0x20 ++ ++#define REG_IP_IDX REG_RIP ++#define si_pkey_offset 0x20 + + #endif + +@@ -225,8 +233,14 @@ void dump_mem(void *dumpme, int len_bytes) + } + } + +-#define SEGV_BNDERR 3 /* failed address bound checks */ +-#define SEGV_PKUERR 4 ++/* Failed address bound checks: */ ++#ifndef SEGV_BNDERR ++# define SEGV_BNDERR 3 ++#endif ++ ++#ifndef SEGV_PKUERR ++# define SEGV_PKUERR 4 ++#endif + + static char *si_code_str(int si_code) + { +@@ -289,13 +303,6 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext) + dump_mem(pkru_ptr - 128, 256); + pkey_assert(*pkru_ptr); + +- si_pkey_ptr = (u32 *)(((u8 *)si) + si_pkey_offset); +- dprintf1("si_pkey_ptr: %p\n", si_pkey_ptr); +- dump_mem(si_pkey_ptr - 8, 24); +- siginfo_pkey = *si_pkey_ptr; +- pkey_assert(siginfo_pkey < NR_PKEYS); +- last_si_pkey = siginfo_pkey; +- + if ((si->si_code == SEGV_MAPERR) || + (si->si_code == SEGV_ACCERR) || + (si->si_code == SEGV_BNDERR)) { +@@ -303,6 +310,13 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext) + exit(4); + } + ++ si_pkey_ptr = (u32 *)(((u8 *)si) + si_pkey_offset); ++ dprintf1("si_pkey_ptr: %p\n", si_pkey_ptr); ++ dump_mem((u8 *)si_pkey_ptr - 8, 24); ++ siginfo_pkey = *si_pkey_ptr; ++ pkey_assert(siginfo_pkey < NR_PKEYS); ++ last_si_pkey = siginfo_pkey; ++ + dprintf1("signal pkru from xsave: %08x\n", *pkru_ptr); + /* need __rdpkru() version so we do not do shadow_pkru checking */ + dprintf1("signal pkru from pkru: %08x\n", __rdpkru()); +@@ -311,22 +325,6 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext) + dprintf1("WARNING: set PRKU=0 to allow faulting instruction to continue\n"); + pkru_faults++; + dprintf1("<<<<==================================================\n"); +- return; +- if (trapno == 14) { +- fprintf(stderr, +- "ERROR: In signal handler, page fault, trapno = %d, ip = %016lx\n", +- trapno, ip); +- fprintf(stderr, "si_addr %p\n", si->si_addr); +- fprintf(stderr, "REG_ERR: %lx\n", +- (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]); +- exit(1); +- } else { +- fprintf(stderr, "unexpected trap %d! at 0x%lx\n", trapno, ip); +- fprintf(stderr, "si_addr %p\n", si->si_addr); +- fprintf(stderr, "REG_ERR: %lx\n", +- (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]); +- exit(2); +- } + dprint_in_signal = 0; + } + +@@ -393,10 +391,15 @@ pid_t fork_lazy_child(void) + return forkret; + } + +-#define PKEY_DISABLE_ACCESS 0x1 +-#define PKEY_DISABLE_WRITE 0x2 ++#ifndef PKEY_DISABLE_ACCESS ++# define PKEY_DISABLE_ACCESS 0x1 ++#endif ++ ++#ifndef PKEY_DISABLE_WRITE ++# define PKEY_DISABLE_WRITE 0x2 ++#endif + +-u32 pkey_get(int pkey, unsigned long flags) ++static u32 hw_pkey_get(int pkey, unsigned long flags) + { + u32 mask = (PKEY_DISABLE_ACCESS|PKEY_DISABLE_WRITE); + u32 pkru = __rdpkru(); +@@ -418,7 +421,7 @@ u32 pkey_get(int pkey, unsigned long flags) + return masked_pkru; + } + +-int pkey_set(int pkey, unsigned long rights, unsigned long flags) ++static int hw_pkey_set(int pkey, unsigned long rights, unsigned long flags) + { + u32 mask = (PKEY_DISABLE_ACCESS|PKEY_DISABLE_WRITE); + u32 old_pkru = __rdpkru(); +@@ -452,15 +455,15 @@ void pkey_disable_set(int pkey, int flags) + pkey, flags); + pkey_assert(flags & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE)); + +- pkey_rights = pkey_get(pkey, syscall_flags); ++ pkey_rights = hw_pkey_get(pkey, syscall_flags); + +- dprintf1("%s(%d) pkey_get(%d): %x\n", __func__, ++ dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__, + pkey, pkey, pkey_rights); + pkey_assert(pkey_rights >= 0); + + pkey_rights |= flags; + +- ret = pkey_set(pkey, pkey_rights, syscall_flags); ++ ret = hw_pkey_set(pkey, pkey_rights, syscall_flags); + assert(!ret); + /*pkru and flags have the same format */ + shadow_pkru |= flags << (pkey * 2); +@@ -468,8 +471,8 @@ void pkey_disable_set(int pkey, int flags) + + pkey_assert(ret >= 0); + +- pkey_rights = pkey_get(pkey, syscall_flags); +- dprintf1("%s(%d) pkey_get(%d): %x\n", __func__, ++ pkey_rights = hw_pkey_get(pkey, syscall_flags); ++ dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__, + pkey, pkey, pkey_rights); + + dprintf1("%s(%d) pkru: 0x%x\n", __func__, pkey, rdpkru()); +@@ -483,24 +486,24 @@ void pkey_disable_clear(int pkey, int flags) + { + unsigned long syscall_flags = 0; + int ret; +- int pkey_rights = pkey_get(pkey, syscall_flags); ++ int pkey_rights = hw_pkey_get(pkey, syscall_flags); + u32 orig_pkru = rdpkru(); + + pkey_assert(flags & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE)); + +- dprintf1("%s(%d) pkey_get(%d): %x\n", __func__, ++ dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__, + pkey, pkey, pkey_rights); + pkey_assert(pkey_rights >= 0); + + pkey_rights |= flags; + +- ret = pkey_set(pkey, pkey_rights, 0); ++ ret = hw_pkey_set(pkey, pkey_rights, 0); + /* pkru and flags have the same format */ + shadow_pkru &= ~(flags << (pkey * 2)); + pkey_assert(ret >= 0); + +- pkey_rights = pkey_get(pkey, syscall_flags); +- dprintf1("%s(%d) pkey_get(%d): %x\n", __func__, ++ pkey_rights = hw_pkey_get(pkey, syscall_flags); ++ dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__, + pkey, pkey, pkey_rights); + + dprintf1("%s(%d) pkru: 0x%x\n", __func__, pkey, rdpkru()); +@@ -674,10 +677,12 @@ int mprotect_pkey(void *ptr, size_t size, unsigned long orig_prot, + struct pkey_malloc_record { + void *ptr; + long size; ++ int prot; + }; + struct pkey_malloc_record *pkey_malloc_records; ++struct pkey_malloc_record *pkey_last_malloc_record; + long nr_pkey_malloc_records; +-void record_pkey_malloc(void *ptr, long size) ++void record_pkey_malloc(void *ptr, long size, int prot) + { + long i; + struct pkey_malloc_record *rec = NULL; +@@ -709,6 +714,8 @@ void record_pkey_malloc(void *ptr, long size) + (int)(rec - pkey_malloc_records), rec, ptr, size); + rec->ptr = ptr; + rec->size = size; ++ rec->prot = prot; ++ pkey_last_malloc_record = rec; + nr_pkey_malloc_records++; + } + +@@ -753,7 +760,7 @@ void *malloc_pkey_with_mprotect(long size, int prot, u16 pkey) + pkey_assert(ptr != (void *)-1); + ret = mprotect_pkey((void *)ptr, PAGE_SIZE, prot, pkey); + pkey_assert(!ret); +- record_pkey_malloc(ptr, size); ++ record_pkey_malloc(ptr, size, prot); + rdpkru(); + + dprintf1("%s() for pkey %d @ %p\n", __func__, pkey, ptr); +@@ -774,7 +781,7 @@ void *malloc_pkey_anon_huge(long size, int prot, u16 pkey) + size = ALIGN_UP(size, HPAGE_SIZE * 2); + ptr = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); + pkey_assert(ptr != (void *)-1); +- record_pkey_malloc(ptr, size); ++ record_pkey_malloc(ptr, size, prot); + mprotect_pkey(ptr, size, prot, pkey); + + dprintf1("unaligned ptr: %p\n", ptr); +@@ -847,7 +854,7 @@ void *malloc_pkey_hugetlb(long size, int prot, u16 pkey) + pkey_assert(ptr != (void *)-1); + mprotect_pkey(ptr, size, prot, pkey); + +- record_pkey_malloc(ptr, size); ++ record_pkey_malloc(ptr, size, prot); + + dprintf1("mmap()'d hugetlbfs for pkey %d @ %p\n", pkey, ptr); + return ptr; +@@ -869,7 +876,7 @@ void *malloc_pkey_mmap_dax(long size, int prot, u16 pkey) + + mprotect_pkey(ptr, size, prot, pkey); + +- record_pkey_malloc(ptr, size); ++ record_pkey_malloc(ptr, size, prot); + + dprintf1("mmap()'d for pkey %d @ %p\n", pkey, ptr); + close(fd); +@@ -918,13 +925,21 @@ void *malloc_pkey(long size, int prot, u16 pkey) + } + + int last_pkru_faults; ++#define UNKNOWN_PKEY -2 + void expected_pk_fault(int pkey) + { + dprintf2("%s(): last_pkru_faults: %d pkru_faults: %d\n", + __func__, last_pkru_faults, pkru_faults); + dprintf2("%s(%d): last_si_pkey: %d\n", __func__, pkey, last_si_pkey); + pkey_assert(last_pkru_faults + 1 == pkru_faults); +- pkey_assert(last_si_pkey == pkey); ++ ++ /* ++ * For exec-only memory, we do not know the pkey in ++ * advance, so skip this check. ++ */ ++ if (pkey != UNKNOWN_PKEY) ++ pkey_assert(last_si_pkey == pkey); ++ + /* + * The signal handler shold have cleared out PKRU to let the + * test program continue. We now have to restore it. +@@ -939,10 +954,11 @@ void expected_pk_fault(int pkey) + last_si_pkey = -1; + } + +-void do_not_expect_pk_fault(void) +-{ +- pkey_assert(last_pkru_faults == pkru_faults); +-} ++#define do_not_expect_pk_fault(msg) do { \ ++ if (last_pkru_faults != pkru_faults) \ ++ dprintf0("unexpected PK fault: %s\n", msg); \ ++ pkey_assert(last_pkru_faults == pkru_faults); \ ++} while (0) + + int test_fds[10] = { -1 }; + int nr_test_fds; +@@ -1151,12 +1167,15 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey) + pkey_assert(i < NR_PKEYS*2); + + /* +- * There are 16 pkeys supported in hardware. One is taken +- * up for the default (0) and another can be taken up by +- * an execute-only mapping. Ensure that we can allocate +- * at least 14 (16-2). ++ * There are 16 pkeys supported in hardware. Three are ++ * allocated by the time we get here: ++ * 1. The default key (0) ++ * 2. One possibly consumed by an execute-only mapping. ++ * 3. One allocated by the test code and passed in via ++ * 'pkey' to this function. ++ * Ensure that we can allocate at least another 13 (16-3). + */ +- pkey_assert(i >= NR_PKEYS-2); ++ pkey_assert(i >= NR_PKEYS-3); + + for (i = 0; i < nr_allocated_pkeys; i++) { + err = sys_pkey_free(allocated_pkeys[i]); +@@ -1165,6 +1184,35 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey) + } + } + ++/* ++ * pkey 0 is special. It is allocated by default, so you do not ++ * have to call pkey_alloc() to use it first. Make sure that it ++ * is usable. ++ */ ++void test_mprotect_with_pkey_0(int *ptr, u16 pkey) ++{ ++ long size; ++ int prot; ++ ++ assert(pkey_last_malloc_record); ++ size = pkey_last_malloc_record->size; ++ /* ++ * This is a bit of a hack. But mprotect() requires ++ * huge-page-aligned sizes when operating on hugetlbfs. ++ * So, make sure that we use something that's a multiple ++ * of a huge page when we can. ++ */ ++ if (size >= HPAGE_SIZE) ++ size = HPAGE_SIZE; ++ prot = pkey_last_malloc_record->prot; ++ ++ /* Use pkey 0 */ ++ mprotect_pkey(ptr, size, prot, 0); ++ ++ /* Make sure that we can set it back to the original pkey. */ ++ mprotect_pkey(ptr, size, prot, pkey); ++} ++ + void test_ptrace_of_child(int *ptr, u16 pkey) + { + __attribute__((__unused__)) int peek_result; +@@ -1228,7 +1276,7 @@ void test_ptrace_of_child(int *ptr, u16 pkey) + pkey_assert(ret != -1); + /* Now access from the current task, and expect NO exception: */ + peek_result = read_ptr(plain_ptr); +- do_not_expect_pk_fault(); ++ do_not_expect_pk_fault("read plain pointer after ptrace"); + + ret = ptrace(PTRACE_DETACH, child_pid, ignored, 0); + pkey_assert(ret != -1); +@@ -1241,12 +1289,9 @@ void test_ptrace_of_child(int *ptr, u16 pkey) + free(plain_ptr_unaligned); + } + +-void test_executing_on_unreadable_memory(int *ptr, u16 pkey) ++void *get_pointer_to_instructions(void) + { + void *p1; +- int scratch; +- int ptr_contents; +- int ret; + + p1 = ALIGN_PTR_UP(&lots_o_noops_around_write, PAGE_SIZE); + dprintf3("&lots_o_noops: %p\n", &lots_o_noops_around_write); +@@ -1256,7 +1301,23 @@ void test_executing_on_unreadable_memory(int *ptr, u16 pkey) + /* Point 'p1' at the *second* page of the function: */ + p1 += PAGE_SIZE; + ++ /* ++ * Try to ensure we fault this in on next touch to ensure ++ * we get an instruction fault as opposed to a data one ++ */ + madvise(p1, PAGE_SIZE, MADV_DONTNEED); ++ ++ return p1; ++} ++ ++void test_executing_on_unreadable_memory(int *ptr, u16 pkey) ++{ ++ void *p1; ++ int scratch; ++ int ptr_contents; ++ int ret; ++ ++ p1 = get_pointer_to_instructions(); + lots_o_noops_around_write(&scratch); + ptr_contents = read_ptr(p1); + dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents); +@@ -1272,12 +1333,55 @@ void test_executing_on_unreadable_memory(int *ptr, u16 pkey) + */ + madvise(p1, PAGE_SIZE, MADV_DONTNEED); + lots_o_noops_around_write(&scratch); +- do_not_expect_pk_fault(); ++ do_not_expect_pk_fault("executing on PROT_EXEC memory"); + ptr_contents = read_ptr(p1); + dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents); + expected_pk_fault(pkey); + } + ++void test_implicit_mprotect_exec_only_memory(int *ptr, u16 pkey) ++{ ++ void *p1; ++ int scratch; ++ int ptr_contents; ++ int ret; ++ ++ dprintf1("%s() start\n", __func__); ++ ++ p1 = get_pointer_to_instructions(); ++ lots_o_noops_around_write(&scratch); ++ ptr_contents = read_ptr(p1); ++ dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents); ++ ++ /* Use a *normal* mprotect(), not mprotect_pkey(): */ ++ ret = mprotect(p1, PAGE_SIZE, PROT_EXEC); ++ pkey_assert(!ret); ++ ++ dprintf2("pkru: %x\n", rdpkru()); ++ ++ /* Make sure this is an *instruction* fault */ ++ madvise(p1, PAGE_SIZE, MADV_DONTNEED); ++ lots_o_noops_around_write(&scratch); ++ do_not_expect_pk_fault("executing on PROT_EXEC memory"); ++ ptr_contents = read_ptr(p1); ++ dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents); ++ expected_pk_fault(UNKNOWN_PKEY); ++ ++ /* ++ * Put the memory back to non-PROT_EXEC. Should clear the ++ * exec-only pkey off the VMA and allow it to be readable ++ * again. Go to PROT_NONE first to check for a kernel bug ++ * that did not clear the pkey when doing PROT_NONE. ++ */ ++ ret = mprotect(p1, PAGE_SIZE, PROT_NONE); ++ pkey_assert(!ret); ++ ++ ret = mprotect(p1, PAGE_SIZE, PROT_READ|PROT_EXEC); ++ pkey_assert(!ret); ++ ptr_contents = read_ptr(p1); ++ do_not_expect_pk_fault("plain read on recently PROT_EXEC area"); ++} ++ + void test_mprotect_pkey_on_unsupported_cpu(int *ptr, u16 pkey) + { + int size = PAGE_SIZE; +@@ -1302,6 +1406,8 @@ void (*pkey_tests[])(int *ptr, u16 pkey) = { + test_kernel_gup_of_access_disabled_region, + test_kernel_gup_write_to_write_disabled_region, + test_executing_on_unreadable_memory, ++ test_implicit_mprotect_exec_only_memory, ++ test_mprotect_with_pkey_0, + test_ptrace_of_child, + test_pkey_syscalls_on_non_allocated_pkey, + test_pkey_syscalls_bad_args, +diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c +index e21e2f49b005..ffc587bf4742 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c ++++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c +@@ -14,6 +14,8 @@ + #include + #include + #include ++#include ++ + #include + #include + +@@ -324,6 +326,9 @@ static unsigned long vgic_mmio_read_apr(struct kvm_vcpu *vcpu, + + if (n > vgic_v3_max_apr_idx(vcpu)) + return 0; ++ ++ n = array_index_nospec(n, 4); ++ + /* GICv3 only uses ICH_AP1Rn for memory mapped (GICv2) guests */ + return vgicv3->vgic_ap1r[n]; + } +diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c +index 4232c40b34f8..b38360c6c7d2 100644 +--- a/virt/kvm/arm/vgic/vgic.c ++++ b/virt/kvm/arm/vgic/vgic.c +@@ -599,6 +599,7 @@ static void vgic_prune_ap_list(struct kvm_vcpu *vcpu) + + list_for_each_entry_safe(irq, tmp, &vgic_cpu->ap_list_head, ap_list) { + struct kvm_vcpu *target_vcpu, *vcpuA, *vcpuB; ++ bool target_vcpu_needs_kick = false; + + spin_lock(&irq->irq_lock); + +@@ -669,11 +670,18 @@ static void vgic_prune_ap_list(struct kvm_vcpu *vcpu) + list_del(&irq->ap_list); + irq->vcpu = target_vcpu; + list_add_tail(&irq->ap_list, &new_cpu->ap_list_head); ++ target_vcpu_needs_kick = true; + } + + spin_unlock(&irq->irq_lock); + spin_unlock(&vcpuB->arch.vgic_cpu.ap_list_lock); + spin_unlock_irqrestore(&vcpuA->arch.vgic_cpu.ap_list_lock, flags); ++ ++ if (target_vcpu_needs_kick) { ++ kvm_make_request(KVM_REQ_IRQ_PENDING, target_vcpu); ++ kvm_vcpu_kick(target_vcpu); ++ } ++ + goto retry; + } +