From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 6D518138334 for ; Sat, 15 Sep 2018 10:12:59 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 5337BE092D; Sat, 15 Sep 2018 10:12:58 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id DB31BE08ED for ; Sat, 15 Sep 2018 10:12:57 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 48A6B335CBF for ; Sat, 15 Sep 2018 10:12:56 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id F2D003A1 for ; Sat, 15 Sep 2018 10:12:54 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1537006366.f69bd2c4a51cabfc16f5a44334d1cd82613e7157.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.18 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1007_linux-4.18.8.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: f69bd2c4a51cabfc16f5a44334d1cd82613e7157 X-VCS-Branch: 4.18 Date: Sat, 15 Sep 2018 10:12:54 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: eddb0af4-d33a-4488-86b6-6b48f342cd49 X-Archives-Hash: cb0173457158adfefec2433562dfecb3 commit: f69bd2c4a51cabfc16f5a44334d1cd82613e7157 Author: Mike Pagano gentoo org> AuthorDate: Sat Sep 15 10:12:46 2018 +0000 Commit: Mike Pagano gentoo org> CommitDate: Sat Sep 15 10:12:46 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f69bd2c4 Linux patch 4.18.8 0000_README | 4 + 1007_linux-4.18.8.patch | 6654 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 6658 insertions(+) diff --git a/0000_README b/0000_README index f3682ca..597262e 100644 --- a/0000_README +++ b/0000_README @@ -71,6 +71,10 @@ Patch: 1006_linux-4.18.7.patch From: http://www.kernel.org Desc: Linux 4.18.7 +Patch: 1007_linux-4.18.8.patch +From: http://www.kernel.org +Desc: Linux 4.18.8 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1007_linux-4.18.8.patch b/1007_linux-4.18.8.patch new file mode 100644 index 0000000..8a888c7 --- /dev/null +++ b/1007_linux-4.18.8.patch @@ -0,0 +1,6654 @@ +diff --git a/Makefile b/Makefile +index 711b04d00e49..0d73431f66cd 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 18 +-SUBLEVEL = 7 ++SUBLEVEL = 8 + EXTRAVERSION = + NAME = Merciless Moray + +diff --git a/arch/arm/mach-rockchip/Kconfig b/arch/arm/mach-rockchip/Kconfig +index fafd3d7f9f8c..8ca926522026 100644 +--- a/arch/arm/mach-rockchip/Kconfig ++++ b/arch/arm/mach-rockchip/Kconfig +@@ -17,6 +17,7 @@ config ARCH_ROCKCHIP + select ARM_GLOBAL_TIMER + select CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK + select ZONE_DMA if ARM_LPAE ++ select PM + help + Support for Rockchip's Cortex-A9 Single-to-Quad-Core-SoCs + containing the RK2928, RK30xx and RK31xx series. +diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms +index d5aeac351fc3..21a715ad8222 100644 +--- a/arch/arm64/Kconfig.platforms ++++ b/arch/arm64/Kconfig.platforms +@@ -151,6 +151,7 @@ config ARCH_ROCKCHIP + select GPIOLIB + select PINCTRL + select PINCTRL_ROCKCHIP ++ select PM + select ROCKCHIP_TIMER + help + This enables support for the ARMv8 based Rockchip chipsets, +diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h +index 16b077801a5f..a4a718dbfec6 100644 +--- a/arch/powerpc/include/asm/topology.h ++++ b/arch/powerpc/include/asm/topology.h +@@ -92,6 +92,7 @@ extern int stop_topology_update(void); + extern int prrn_is_enabled(void); + extern int find_and_online_cpu_nid(int cpu); + extern int timed_topology_update(int nsecs); ++extern void __init shared_proc_topology_init(void); + #else + static inline int start_topology_update(void) + { +@@ -113,6 +114,10 @@ static inline int timed_topology_update(int nsecs) + { + return 0; + } ++ ++#ifdef CONFIG_SMP ++static inline void shared_proc_topology_init(void) {} ++#endif + #endif /* CONFIG_NUMA && CONFIG_PPC_SPLPAR */ + + #include +diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h +index 468653ce844c..327f6112fe8e 100644 +--- a/arch/powerpc/include/asm/uaccess.h ++++ b/arch/powerpc/include/asm/uaccess.h +@@ -250,10 +250,17 @@ do { \ + } \ + } while (0) + ++/* ++ * This is a type: either unsigned long, if the argument fits into ++ * that type, or otherwise unsigned long long. ++ */ ++#define __long_type(x) \ ++ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL)) ++ + #define __get_user_nocheck(x, ptr, size) \ + ({ \ + long __gu_err; \ +- unsigned long __gu_val; \ ++ __long_type(*(ptr)) __gu_val; \ + const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ + __chk_user_ptr(ptr); \ + if (!is_kernel_addr((unsigned long)__gu_addr)) \ +@@ -267,7 +274,7 @@ do { \ + #define __get_user_check(x, ptr, size) \ + ({ \ + long __gu_err = -EFAULT; \ +- unsigned long __gu_val = 0; \ ++ __long_type(*(ptr)) __gu_val = 0; \ + const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ + might_fault(); \ + if (access_ok(VERIFY_READ, __gu_addr, (size))) { \ +@@ -281,7 +288,7 @@ do { \ + #define __get_user_nosleep(x, ptr, size) \ + ({ \ + long __gu_err; \ +- unsigned long __gu_val; \ ++ __long_type(*(ptr)) __gu_val; \ + const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ + __chk_user_ptr(ptr); \ + barrier_nospec(); \ +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index 285c6465324a..f817342aab8f 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -1526,6 +1526,8 @@ TRAMP_REAL_BEGIN(stf_barrier_fallback) + TRAMP_REAL_BEGIN(rfi_flush_fallback) + SET_SCRATCH0(r13); + GET_PACA(r13); ++ std r1,PACA_EXRFI+EX_R12(r13) ++ ld r1,PACAKSAVE(r13) + std r9,PACA_EXRFI+EX_R9(r13) + std r10,PACA_EXRFI+EX_R10(r13) + std r11,PACA_EXRFI+EX_R11(r13) +@@ -1560,12 +1562,15 @@ TRAMP_REAL_BEGIN(rfi_flush_fallback) + ld r9,PACA_EXRFI+EX_R9(r13) + ld r10,PACA_EXRFI+EX_R10(r13) + ld r11,PACA_EXRFI+EX_R11(r13) ++ ld r1,PACA_EXRFI+EX_R12(r13) + GET_SCRATCH0(r13); + rfid + + TRAMP_REAL_BEGIN(hrfi_flush_fallback) + SET_SCRATCH0(r13); + GET_PACA(r13); ++ std r1,PACA_EXRFI+EX_R12(r13) ++ ld r1,PACAKSAVE(r13) + std r9,PACA_EXRFI+EX_R9(r13) + std r10,PACA_EXRFI+EX_R10(r13) + std r11,PACA_EXRFI+EX_R11(r13) +@@ -1600,6 +1605,7 @@ TRAMP_REAL_BEGIN(hrfi_flush_fallback) + ld r9,PACA_EXRFI+EX_R9(r13) + ld r10,PACA_EXRFI+EX_R10(r13) + ld r11,PACA_EXRFI+EX_R11(r13) ++ ld r1,PACA_EXRFI+EX_R12(r13) + GET_SCRATCH0(r13); + hrfid + +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index 4794d6b4f4d2..b3142c7b9c31 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -1156,6 +1156,11 @@ void __init smp_cpus_done(unsigned int max_cpus) + if (smp_ops && smp_ops->bringup_done) + smp_ops->bringup_done(); + ++ /* ++ * On a shared LPAR, associativity needs to be requested. ++ * Hence, get numa topology before dumping cpu topology ++ */ ++ shared_proc_topology_init(); + dump_numa_cpu_topology(); + + /* +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index 0c7e05d89244..35ac5422903a 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -1078,7 +1078,6 @@ static int prrn_enabled; + static void reset_topology_timer(void); + static int topology_timer_secs = 1; + static int topology_inited; +-static int topology_update_needed; + + /* + * Change polling interval for associativity changes. +@@ -1306,11 +1305,8 @@ int numa_update_cpu_topology(bool cpus_locked) + struct device *dev; + int weight, new_nid, i = 0; + +- if (!prrn_enabled && !vphn_enabled) { +- if (!topology_inited) +- topology_update_needed = 1; ++ if (!prrn_enabled && !vphn_enabled && topology_inited) + return 0; +- } + + weight = cpumask_weight(&cpu_associativity_changes_mask); + if (!weight) +@@ -1423,7 +1419,6 @@ int numa_update_cpu_topology(bool cpus_locked) + + out: + kfree(updates); +- topology_update_needed = 0; + return changed; + } + +@@ -1551,6 +1546,15 @@ int prrn_is_enabled(void) + return prrn_enabled; + } + ++void __init shared_proc_topology_init(void) ++{ ++ if (lppaca_shared_proc(get_lppaca())) { ++ bitmap_fill(cpumask_bits(&cpu_associativity_changes_mask), ++ nr_cpumask_bits); ++ numa_update_cpu_topology(false); ++ } ++} ++ + static int topology_read(struct seq_file *file, void *v) + { + if (vphn_enabled || prrn_enabled) +@@ -1608,10 +1612,6 @@ static int topology_update_init(void) + return -ENOMEM; + + topology_inited = 1; +- if (topology_update_needed) +- bitmap_fill(cpumask_bits(&cpu_associativity_changes_mask), +- nr_cpumask_bits); +- + return 0; + } + device_initcall(topology_update_init); +diff --git a/arch/powerpc/platforms/85xx/t1042rdb_diu.c b/arch/powerpc/platforms/85xx/t1042rdb_diu.c +index 58fa3d319f1c..dac36ba82fea 100644 +--- a/arch/powerpc/platforms/85xx/t1042rdb_diu.c ++++ b/arch/powerpc/platforms/85xx/t1042rdb_diu.c +@@ -9,8 +9,10 @@ + * option) any later version. + */ + ++#include + #include + #include ++#include + #include + #include + +@@ -150,3 +152,5 @@ static int __init t1042rdb_diu_init(void) + } + + early_initcall(t1042rdb_diu_init); ++ ++MODULE_LICENSE("GPL"); +diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c +index 2edc673be137..99d1152ae224 100644 +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -371,7 +371,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs) + int len, error_log_length; + + error_log_length = 8 + rtas_error_extended_log_length(h); +- len = max_t(int, error_log_length, RTAS_ERROR_LOG_MAX); ++ len = min_t(int, error_log_length, RTAS_ERROR_LOG_MAX); + memset(global_mce_data_buf, 0, RTAS_ERROR_LOG_MAX); + memcpy(global_mce_data_buf, h, len); + errhdr = (struct rtas_error_log *)global_mce_data_buf; +diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c +index eb69a5186243..280e964e1aa8 100644 +--- a/arch/powerpc/sysdev/mpic_msgr.c ++++ b/arch/powerpc/sysdev/mpic_msgr.c +@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev) + + /* IO map the message register block. */ + of_address_to_resource(np, 0, &rsrc); +- msgr_block_addr = ioremap(rsrc.start, rsrc.end - rsrc.start); ++ msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc)); + if (!msgr_block_addr) { + dev_err(&dev->dev, "Failed to iomap MPIC message registers"); + return -EFAULT; +diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile +index f6561b783b61..eed1c137f618 100644 +--- a/arch/riscv/kernel/vdso/Makefile ++++ b/arch/riscv/kernel/vdso/Makefile +@@ -52,8 +52,8 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE + # Add -lgcc so rv32 gets static muldi3 and lshrdi3 definitions. + # Make sure only to export the intended __vdso_xxx symbol offsets. + quiet_cmd_vdsold = VDSOLD $@ +- cmd_vdsold = $(CC) $(KCFLAGS) $(call cc-option, -no-pie) -nostdlib $(SYSCFLAGS_$(@F)) \ +- -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp -lgcc && \ ++ cmd_vdsold = $(CC) $(KBUILD_CFLAGS) $(call cc-option, -no-pie) -nostdlib -nostartfiles $(SYSCFLAGS_$(@F)) \ ++ -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp && \ + $(CROSS_COMPILE)objcopy \ + $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@ + +diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c +index 9f5ea9d87069..9b0216d571ad 100644 +--- a/arch/s390/kernel/crash_dump.c ++++ b/arch/s390/kernel/crash_dump.c +@@ -404,11 +404,13 @@ static void *get_vmcoreinfo_old(unsigned long *size) + if (copy_oldmem_kernel(nt_name, addr + sizeof(note), + sizeof(nt_name) - 1)) + return NULL; +- if (strcmp(nt_name, "VMCOREINFO") != 0) ++ if (strcmp(nt_name, VMCOREINFO_NOTE_NAME) != 0) + return NULL; + vmcoreinfo = kzalloc_panic(note.n_descsz); +- if (copy_oldmem_kernel(vmcoreinfo, addr + 24, note.n_descsz)) ++ if (copy_oldmem_kernel(vmcoreinfo, addr + 24, note.n_descsz)) { ++ kfree(vmcoreinfo); + return NULL; ++ } + *size = note.n_descsz; + return vmcoreinfo; + } +@@ -418,15 +420,20 @@ static void *get_vmcoreinfo_old(unsigned long *size) + */ + static void *nt_vmcoreinfo(void *ptr) + { ++ const char *name = VMCOREINFO_NOTE_NAME; + unsigned long size; + void *vmcoreinfo; + + vmcoreinfo = os_info_old_entry(OS_INFO_VMCOREINFO, &size); +- if (!vmcoreinfo) +- vmcoreinfo = get_vmcoreinfo_old(&size); ++ if (vmcoreinfo) ++ return nt_init_name(ptr, 0, vmcoreinfo, size, name); ++ ++ vmcoreinfo = get_vmcoreinfo_old(&size); + if (!vmcoreinfo) + return ptr; +- return nt_init_name(ptr, 0, vmcoreinfo, size, "VMCOREINFO"); ++ ptr = nt_init_name(ptr, 0, vmcoreinfo, size, name); ++ kfree(vmcoreinfo); ++ return ptr; + } + + /* +diff --git a/arch/um/Makefile b/arch/um/Makefile +index e54dda8a0363..de340e41f3b2 100644 +--- a/arch/um/Makefile ++++ b/arch/um/Makefile +@@ -122,8 +122,7 @@ archheaders: + $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.asm-generic \ + kbuild-file=$(HOST_DIR)/include/uapi/asm/Kbuild \ + obj=$(HOST_DIR)/include/generated/uapi/asm +- $(Q)$(MAKE) KBUILD_SRC= ARCH=$(HEADER_ARCH) archheaders +- ++ $(Q)$(MAKE) -f $(srctree)/Makefile ARCH=$(HEADER_ARCH) archheaders + + archprepare: include/generated/user_constants.h + +diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h +index 8c7b3e5a2d01..3a17107594c8 100644 +--- a/arch/x86/include/asm/mce.h ++++ b/arch/x86/include/asm/mce.h +@@ -148,6 +148,7 @@ enum mce_notifier_prios { + MCE_PRIO_LOWEST = 0, + }; + ++struct notifier_block; + extern void mce_register_decode_chain(struct notifier_block *nb); + extern void mce_unregister_decode_chain(struct notifier_block *nb); + +diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h +index bb035a4cbc8c..9eeb1359ec75 100644 +--- a/arch/x86/include/asm/pgtable-3level.h ++++ b/arch/x86/include/asm/pgtable-3level.h +@@ -2,6 +2,8 @@ + #ifndef _ASM_X86_PGTABLE_3LEVEL_H + #define _ASM_X86_PGTABLE_3LEVEL_H + ++#include ++ + /* + * Intel Physical Address Extension (PAE) Mode - three-level page + * tables on PPro+ CPUs. +@@ -147,10 +149,7 @@ static inline pte_t native_ptep_get_and_clear(pte_t *ptep) + { + pte_t res; + +- /* xchg acts as a barrier before the setting of the high bits */ +- res.pte_low = xchg(&ptep->pte_low, 0); +- res.pte_high = ptep->pte_high; +- ptep->pte_high = 0; ++ res.pte = (pteval_t)arch_atomic64_xchg((atomic64_t *)ptep, 0); + + return res; + } +diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c +index 74392d9d51e0..a10481656d82 100644 +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -1343,7 +1343,7 @@ device_initcall(init_tsc_clocksource); + + void __init tsc_early_delay_calibrate(void) + { +- unsigned long lpj; ++ u64 lpj; + + if (!boot_cpu_has(X86_FEATURE_TSC)) + return; +@@ -1355,7 +1355,7 @@ void __init tsc_early_delay_calibrate(void) + if (!tsc_khz) + return; + +- lpj = tsc_khz * 1000; ++ lpj = (u64)tsc_khz * 1000; + do_div(lpj, HZ); + loops_per_jiffy = lpj; + } +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index a44e568363a4..42f1ba92622a 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -221,6 +221,17 @@ static const u64 shadow_acc_track_saved_bits_mask = PT64_EPT_READABLE_MASK | + PT64_EPT_EXECUTABLE_MASK; + static const u64 shadow_acc_track_saved_bits_shift = PT64_SECOND_AVAIL_BITS_SHIFT; + ++/* ++ * This mask must be set on all non-zero Non-Present or Reserved SPTEs in order ++ * to guard against L1TF attacks. ++ */ ++static u64 __read_mostly shadow_nonpresent_or_rsvd_mask; ++ ++/* ++ * The number of high-order 1 bits to use in the mask above. ++ */ ++static const u64 shadow_nonpresent_or_rsvd_mask_len = 5; ++ + static void mmu_spte_set(u64 *sptep, u64 spte); + + void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask, u64 mmio_value) +@@ -308,9 +319,13 @@ static void mark_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, u64 gfn, + { + unsigned int gen = kvm_current_mmio_generation(vcpu); + u64 mask = generation_mmio_spte_mask(gen); ++ u64 gpa = gfn << PAGE_SHIFT; + + access &= ACC_WRITE_MASK | ACC_USER_MASK; +- mask |= shadow_mmio_value | access | gfn << PAGE_SHIFT; ++ mask |= shadow_mmio_value | access; ++ mask |= gpa | shadow_nonpresent_or_rsvd_mask; ++ mask |= (gpa & shadow_nonpresent_or_rsvd_mask) ++ << shadow_nonpresent_or_rsvd_mask_len; + + trace_mark_mmio_spte(sptep, gfn, access, gen); + mmu_spte_set(sptep, mask); +@@ -323,8 +338,14 @@ static bool is_mmio_spte(u64 spte) + + static gfn_t get_mmio_spte_gfn(u64 spte) + { +- u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask; +- return (spte & ~mask) >> PAGE_SHIFT; ++ u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask | ++ shadow_nonpresent_or_rsvd_mask; ++ u64 gpa = spte & ~mask; ++ ++ gpa |= (spte >> shadow_nonpresent_or_rsvd_mask_len) ++ & shadow_nonpresent_or_rsvd_mask; ++ ++ return gpa >> PAGE_SHIFT; + } + + static unsigned get_mmio_spte_access(u64 spte) +@@ -381,7 +402,7 @@ void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask, + } + EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes); + +-static void kvm_mmu_clear_all_pte_masks(void) ++static void kvm_mmu_reset_all_pte_masks(void) + { + shadow_user_mask = 0; + shadow_accessed_mask = 0; +@@ -391,6 +412,18 @@ static void kvm_mmu_clear_all_pte_masks(void) + shadow_mmio_mask = 0; + shadow_present_mask = 0; + shadow_acc_track_mask = 0; ++ ++ /* ++ * If the CPU has 46 or less physical address bits, then set an ++ * appropriate mask to guard against L1TF attacks. Otherwise, it is ++ * assumed that the CPU is not vulnerable to L1TF. ++ */ ++ if (boot_cpu_data.x86_phys_bits < ++ 52 - shadow_nonpresent_or_rsvd_mask_len) ++ shadow_nonpresent_or_rsvd_mask = ++ rsvd_bits(boot_cpu_data.x86_phys_bits - ++ shadow_nonpresent_or_rsvd_mask_len, ++ boot_cpu_data.x86_phys_bits - 1); + } + + static int is_cpuid_PSE36(void) +@@ -5500,7 +5533,7 @@ int kvm_mmu_module_init(void) + { + int ret = -ENOMEM; + +- kvm_mmu_clear_all_pte_masks(); ++ kvm_mmu_reset_all_pte_masks(); + + pte_list_desc_cache = kmem_cache_create("pte_list_desc", + sizeof(struct pte_list_desc), +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index bedabcf33a3e..9869bfd0c601 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -939,17 +939,21 @@ struct vcpu_vmx { + /* + * loaded_vmcs points to the VMCS currently used in this vcpu. For a + * non-nested (L1) guest, it always points to vmcs01. For a nested +- * guest (L2), it points to a different VMCS. ++ * guest (L2), it points to a different VMCS. loaded_cpu_state points ++ * to the VMCS whose state is loaded into the CPU registers that only ++ * need to be switched when transitioning to/from the kernel; a NULL ++ * value indicates that host state is loaded. + */ + struct loaded_vmcs vmcs01; + struct loaded_vmcs *loaded_vmcs; ++ struct loaded_vmcs *loaded_cpu_state; + bool __launched; /* temporary, used in vmx_vcpu_run */ + struct msr_autoload { + struct vmx_msrs guest; + struct vmx_msrs host; + } msr_autoload; ++ + struct { +- int loaded; + u16 fs_sel, gs_sel, ldt_sel; + #ifdef CONFIG_X86_64 + u16 ds_sel, es_sel; +@@ -2750,10 +2754,11 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu) + #endif + int i; + +- if (vmx->host_state.loaded) ++ if (vmx->loaded_cpu_state) + return; + +- vmx->host_state.loaded = 1; ++ vmx->loaded_cpu_state = vmx->loaded_vmcs; ++ + /* + * Set host fs and gs selectors. Unfortunately, 22.2.3 does not + * allow segment selectors with cpl > 0 or ti == 1. +@@ -2815,11 +2820,14 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu) + + static void __vmx_load_host_state(struct vcpu_vmx *vmx) + { +- if (!vmx->host_state.loaded) ++ if (!vmx->loaded_cpu_state) + return; + ++ WARN_ON_ONCE(vmx->loaded_cpu_state != vmx->loaded_vmcs); ++ + ++vmx->vcpu.stat.host_state_reload; +- vmx->host_state.loaded = 0; ++ vmx->loaded_cpu_state = NULL; ++ + #ifdef CONFIG_X86_64 + if (is_long_mode(&vmx->vcpu)) + rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base); +@@ -8115,7 +8123,7 @@ static int handle_vmon(struct kvm_vcpu *vcpu) + + /* CPL=0 must be checked manually. */ + if (vmx_get_cpl(vcpu)) { +- kvm_queue_exception(vcpu, UD_VECTOR); ++ kvm_inject_gp(vcpu, 0); + return 1; + } + +@@ -8179,7 +8187,7 @@ static int handle_vmon(struct kvm_vcpu *vcpu) + static int nested_vmx_check_permission(struct kvm_vcpu *vcpu) + { + if (vmx_get_cpl(vcpu)) { +- kvm_queue_exception(vcpu, UD_VECTOR); ++ kvm_inject_gp(vcpu, 0); + return 0; + } + +@@ -10517,8 +10525,8 @@ static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs) + return; + + cpu = get_cpu(); +- vmx->loaded_vmcs = vmcs; + vmx_vcpu_put(vcpu); ++ vmx->loaded_vmcs = vmcs; + vmx_vcpu_load(vcpu, cpu); + put_cpu(); + } +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 24c84aa87049..94cd63081471 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6506,20 +6506,22 @@ static void kvm_set_mmio_spte_mask(void) + * Set the reserved bits and the present bit of an paging-structure + * entry to generate page fault with PFER.RSV = 1. + */ +- /* Mask the reserved physical address bits. */ +- mask = rsvd_bits(maxphyaddr, 51); ++ ++ /* ++ * Mask the uppermost physical address bit, which would be reserved as ++ * long as the supported physical address width is less than 52. ++ */ ++ mask = 1ull << 51; + + /* Set the present bit. */ + mask |= 1ull; + +-#ifdef CONFIG_X86_64 + /* + * If reserved bit is not supported, clear the present bit to disable + * mmio page fault. + */ +- if (maxphyaddr == 52) ++ if (IS_ENABLED(CONFIG_X86_64) && maxphyaddr == 52) + mask &= ~1ull; +-#endif + + kvm_mmu_set_mmio_spte_mask(mask, mask); + } +diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c +index 2c30cabfda90..071d82ec9abb 100644 +--- a/arch/x86/xen/mmu_pv.c ++++ b/arch/x86/xen/mmu_pv.c +@@ -434,14 +434,13 @@ static void xen_set_pud(pud_t *ptr, pud_t val) + static void xen_set_pte_atomic(pte_t *ptep, pte_t pte) + { + trace_xen_mmu_set_pte_atomic(ptep, pte); +- set_64bit((u64 *)ptep, native_pte_val(pte)); ++ __xen_set_pte(ptep, pte); + } + + static void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep) + { + trace_xen_mmu_pte_clear(mm, addr, ptep); +- if (!xen_batched_set_pte(ptep, native_make_pte(0))) +- native_pte_clear(mm, addr, ptep); ++ __xen_set_pte(ptep, native_make_pte(0)); + } + + static void xen_pmd_clear(pmd_t *pmdp) +@@ -1571,7 +1570,7 @@ static void __init xen_set_pte_init(pte_t *ptep, pte_t pte) + pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) & + pte_val_ma(pte)); + #endif +- native_set_pte(ptep, pte); ++ __xen_set_pte(ptep, pte); + } + + /* Early in boot, while setting up the initial pagetable, assume +diff --git a/block/bio.c b/block/bio.c +index 047c5dca6d90..ff94640bc734 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -156,7 +156,7 @@ out: + + unsigned int bvec_nr_vecs(unsigned short idx) + { +- return bvec_slabs[idx].nr_vecs; ++ return bvec_slabs[--idx].nr_vecs; + } + + void bvec_free(mempool_t *pool, struct bio_vec *bv, unsigned int idx) +diff --git a/block/blk-core.c b/block/blk-core.c +index 1646ea85dade..746a5eac4541 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -2159,7 +2159,9 @@ static inline bool should_fail_request(struct hd_struct *part, + + static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part) + { +- if (part->policy && op_is_write(bio_op(bio))) { ++ const int op = bio_op(bio); ++ ++ if (part->policy && (op_is_write(op) && !op_is_flush(op))) { + char b[BDEVNAME_SIZE]; + + WARN_ONCE(1, +diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c +index 3de0836163c2..d5f2c21d8531 100644 +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -23,6 +23,9 @@ bool blk_mq_has_free_tags(struct blk_mq_tags *tags) + + /* + * If a previously inactive queue goes active, bump the active user count. ++ * We need to do this before try to allocate driver tag, then even if fail ++ * to get tag when first time, the other shared-tag users could reserve ++ * budget for it. + */ + bool __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx) + { +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 654b0dc7e001..2f9e14361673 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -285,7 +285,7 @@ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data, + rq->tag = -1; + rq->internal_tag = tag; + } else { +- if (blk_mq_tag_busy(data->hctx)) { ++ if (data->hctx->flags & BLK_MQ_F_TAG_SHARED) { + rq_flags = RQF_MQ_INFLIGHT; + atomic_inc(&data->hctx->nr_active); + } +@@ -367,6 +367,8 @@ static struct request *blk_mq_get_request(struct request_queue *q, + if (!op_is_flush(op) && e->type->ops.mq.limit_depth && + !(data->flags & BLK_MQ_REQ_RESERVED)) + e->type->ops.mq.limit_depth(op, data); ++ } else { ++ blk_mq_tag_busy(data->hctx); + } + + tag = blk_mq_get_tag(data); +@@ -970,6 +972,7 @@ bool blk_mq_get_driver_tag(struct request *rq, struct blk_mq_hw_ctx **hctx, + .hctx = blk_mq_map_queue(rq->q, rq->mq_ctx->cpu), + .flags = wait ? 0 : BLK_MQ_REQ_NOWAIT, + }; ++ bool shared; + + might_sleep_if(wait); + +@@ -979,9 +982,10 @@ bool blk_mq_get_driver_tag(struct request *rq, struct blk_mq_hw_ctx **hctx, + if (blk_mq_tag_is_reserved(data.hctx->sched_tags, rq->internal_tag)) + data.flags |= BLK_MQ_REQ_RESERVED; + ++ shared = blk_mq_tag_busy(data.hctx); + rq->tag = blk_mq_get_tag(&data); + if (rq->tag >= 0) { +- if (blk_mq_tag_busy(data.hctx)) { ++ if (shared) { + rq->rq_flags |= RQF_MQ_INFLIGHT; + atomic_inc(&data.hctx->nr_active); + } +diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c +index 82b6c27b3245..f6f180f3aa1c 100644 +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -4735,12 +4735,13 @@ USEC_SHOW_FUNCTION(cfq_target_latency_us_show, cfqd->cfq_target_latency); + static ssize_t __FUNC(struct elevator_queue *e, const char *page, size_t count) \ + { \ + struct cfq_data *cfqd = e->elevator_data; \ +- unsigned int __data; \ ++ unsigned int __data, __min = (MIN), __max = (MAX); \ ++ \ + cfq_var_store(&__data, (page)); \ +- if (__data < (MIN)) \ +- __data = (MIN); \ +- else if (__data > (MAX)) \ +- __data = (MAX); \ ++ if (__data < __min) \ ++ __data = __min; \ ++ else if (__data > __max) \ ++ __data = __max; \ + if (__CONV) \ + *(__PTR) = (u64)__data * NSEC_PER_MSEC; \ + else \ +@@ -4769,12 +4770,13 @@ STORE_FUNCTION(cfq_target_latency_store, &cfqd->cfq_target_latency, 1, UINT_MAX, + static ssize_t __FUNC(struct elevator_queue *e, const char *page, size_t count) \ + { \ + struct cfq_data *cfqd = e->elevator_data; \ +- unsigned int __data; \ ++ unsigned int __data, __min = (MIN), __max = (MAX); \ ++ \ + cfq_var_store(&__data, (page)); \ +- if (__data < (MIN)) \ +- __data = (MIN); \ +- else if (__data > (MAX)) \ +- __data = (MAX); \ ++ if (__data < __min) \ ++ __data = __min; \ ++ else if (__data > __max) \ ++ __data = __max; \ + *(__PTR) = (u64)__data * NSEC_PER_USEC; \ + return count; \ + } +diff --git a/drivers/acpi/acpica/hwregs.c b/drivers/acpi/acpica/hwregs.c +index 3de794bcf8fa..69603ba52a3a 100644 +--- a/drivers/acpi/acpica/hwregs.c ++++ b/drivers/acpi/acpica/hwregs.c +@@ -528,13 +528,18 @@ acpi_status acpi_hw_register_read(u32 register_id, u32 *return_value) + + status = + acpi_hw_read(&value64, &acpi_gbl_FADT.xpm2_control_block); +- value = (u32)value64; ++ if (ACPI_SUCCESS(status)) { ++ value = (u32)value64; ++ } + break; + + case ACPI_REGISTER_PM_TIMER: /* 32-bit access */ + + status = acpi_hw_read(&value64, &acpi_gbl_FADT.xpm_timer_block); +- value = (u32)value64; ++ if (ACPI_SUCCESS(status)) { ++ value = (u32)value64; ++ } ++ + break; + + case ACPI_REGISTER_SMI_COMMAND_BLOCK: /* 8-bit access */ +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 970dd87d347c..6799d00dd790 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -1612,7 +1612,8 @@ static int acpi_add_single_object(struct acpi_device **child, + * Note this must be done before the get power-/wakeup_dev-flags calls. + */ + if (type == ACPI_BUS_TYPE_DEVICE) +- acpi_bus_get_status(device); ++ if (acpi_bus_get_status(device) < 0) ++ acpi_set_device_status(device, 0); + + acpi_bus_get_power_flags(device); + acpi_bus_get_wakeup_device_flags(device); +@@ -1690,7 +1691,7 @@ static int acpi_bus_type_and_status(acpi_handle handle, int *type, + * acpi_add_single_object updates this once we've an acpi_device + * so that acpi_bus_get_status' quirk handling can be used. + */ +- *sta = 0; ++ *sta = ACPI_STA_DEFAULT; + break; + case ACPI_TYPE_PROCESSOR: + *type = ACPI_BUS_TYPE_PROCESSOR; +diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c +index 2a8634a52856..5a628148f3f0 100644 +--- a/drivers/clk/rockchip/clk-rk3399.c ++++ b/drivers/clk/rockchip/clk-rk3399.c +@@ -1523,6 +1523,7 @@ static const char *const rk3399_pmucru_critical_clocks[] __initconst = { + "pclk_pmu_src", + "fclk_cm0s_src_pmu", + "clk_timer_src_pmu", ++ "pclk_rkpwm_pmu", + }; + + static void __init rk3399_clk_init(struct device_node *np) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index 7dcbac8af9a7..b60aa7d43cb7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -1579,9 +1579,9 @@ struct amdgpu_device { + DECLARE_HASHTABLE(mn_hash, 7); + + /* tracking pinned memory */ +- u64 vram_pin_size; +- u64 invisible_pin_size; +- u64 gart_pin_size; ++ atomic64_t vram_pin_size; ++ atomic64_t visible_pin_size; ++ atomic64_t gart_pin_size; + + /* amdkfd interface */ + struct kfd_dev *kfd; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 9c85a90be293..5a196ec49be8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -257,7 +257,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev, + return; + } + +- total_vram = adev->gmc.real_vram_size - adev->vram_pin_size; ++ total_vram = adev->gmc.real_vram_size - atomic64_read(&adev->vram_pin_size); + used_vram = amdgpu_vram_mgr_usage(&adev->mman.bdev.man[TTM_PL_VRAM]); + free_vram = used_vram >= total_vram ? 0 : total_vram - used_vram; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 91517b166a3b..063f9aa96946 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -494,13 +494,13 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + case AMDGPU_INFO_VRAM_GTT: { + struct drm_amdgpu_info_vram_gtt vram_gtt; + +- vram_gtt.vram_size = adev->gmc.real_vram_size; +- vram_gtt.vram_size -= adev->vram_pin_size; +- vram_gtt.vram_cpu_accessible_size = adev->gmc.visible_vram_size; +- vram_gtt.vram_cpu_accessible_size -= (adev->vram_pin_size - adev->invisible_pin_size); ++ vram_gtt.vram_size = adev->gmc.real_vram_size - ++ atomic64_read(&adev->vram_pin_size); ++ vram_gtt.vram_cpu_accessible_size = adev->gmc.visible_vram_size - ++ atomic64_read(&adev->visible_pin_size); + vram_gtt.gtt_size = adev->mman.bdev.man[TTM_PL_TT].size; + vram_gtt.gtt_size *= PAGE_SIZE; +- vram_gtt.gtt_size -= adev->gart_pin_size; ++ vram_gtt.gtt_size -= atomic64_read(&adev->gart_pin_size); + return copy_to_user(out, &vram_gtt, + min((size_t)size, sizeof(vram_gtt))) ? -EFAULT : 0; + } +@@ -509,17 +509,16 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + + memset(&mem, 0, sizeof(mem)); + mem.vram.total_heap_size = adev->gmc.real_vram_size; +- mem.vram.usable_heap_size = +- adev->gmc.real_vram_size - adev->vram_pin_size; ++ mem.vram.usable_heap_size = adev->gmc.real_vram_size - ++ atomic64_read(&adev->vram_pin_size); + mem.vram.heap_usage = + amdgpu_vram_mgr_usage(&adev->mman.bdev.man[TTM_PL_VRAM]); + mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4; + + mem.cpu_accessible_vram.total_heap_size = + adev->gmc.visible_vram_size; +- mem.cpu_accessible_vram.usable_heap_size = +- adev->gmc.visible_vram_size - +- (adev->vram_pin_size - adev->invisible_pin_size); ++ mem.cpu_accessible_vram.usable_heap_size = adev->gmc.visible_vram_size - ++ atomic64_read(&adev->visible_pin_size); + mem.cpu_accessible_vram.heap_usage = + amdgpu_vram_mgr_vis_usage(&adev->mman.bdev.man[TTM_PL_VRAM]); + mem.cpu_accessible_vram.max_allocation = +@@ -527,8 +526,8 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + + mem.gtt.total_heap_size = adev->mman.bdev.man[TTM_PL_TT].size; + mem.gtt.total_heap_size *= PAGE_SIZE; +- mem.gtt.usable_heap_size = mem.gtt.total_heap_size +- - adev->gart_pin_size; ++ mem.gtt.usable_heap_size = mem.gtt.total_heap_size - ++ atomic64_read(&adev->gart_pin_size); + mem.gtt.heap_usage = + amdgpu_gtt_mgr_usage(&adev->mman.bdev.man[TTM_PL_TT]); + mem.gtt.max_allocation = mem.gtt.usable_heap_size * 3 / 4; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index 3526efa8960e..3873c3353020 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -50,11 +50,35 @@ static bool amdgpu_need_backup(struct amdgpu_device *adev) + return true; + } + ++/** ++ * amdgpu_bo_subtract_pin_size - Remove BO from pin_size accounting ++ * ++ * @bo: &amdgpu_bo buffer object ++ * ++ * This function is called when a BO stops being pinned, and updates the ++ * &amdgpu_device pin_size values accordingly. ++ */ ++static void amdgpu_bo_subtract_pin_size(struct amdgpu_bo *bo) ++{ ++ struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev); ++ ++ if (bo->tbo.mem.mem_type == TTM_PL_VRAM) { ++ atomic64_sub(amdgpu_bo_size(bo), &adev->vram_pin_size); ++ atomic64_sub(amdgpu_vram_mgr_bo_visible_size(bo), ++ &adev->visible_pin_size); ++ } else if (bo->tbo.mem.mem_type == TTM_PL_TT) { ++ atomic64_sub(amdgpu_bo_size(bo), &adev->gart_pin_size); ++ } ++} ++ + static void amdgpu_ttm_bo_destroy(struct ttm_buffer_object *tbo) + { + struct amdgpu_device *adev = amdgpu_ttm_adev(tbo->bdev); + struct amdgpu_bo *bo = ttm_to_amdgpu_bo(tbo); + ++ if (bo->pin_count > 0) ++ amdgpu_bo_subtract_pin_size(bo); ++ + if (bo->kfd_bo) + amdgpu_amdkfd_unreserve_system_memory_limit(bo); + +@@ -761,10 +785,11 @@ int amdgpu_bo_pin_restricted(struct amdgpu_bo *bo, u32 domain, + + domain = amdgpu_mem_type_to_domain(bo->tbo.mem.mem_type); + if (domain == AMDGPU_GEM_DOMAIN_VRAM) { +- adev->vram_pin_size += amdgpu_bo_size(bo); +- adev->invisible_pin_size += amdgpu_vram_mgr_bo_invisible_size(bo); ++ atomic64_add(amdgpu_bo_size(bo), &adev->vram_pin_size); ++ atomic64_add(amdgpu_vram_mgr_bo_visible_size(bo), ++ &adev->visible_pin_size); + } else if (domain == AMDGPU_GEM_DOMAIN_GTT) { +- adev->gart_pin_size += amdgpu_bo_size(bo); ++ atomic64_add(amdgpu_bo_size(bo), &adev->gart_pin_size); + } + + error: +@@ -790,12 +815,7 @@ int amdgpu_bo_unpin(struct amdgpu_bo *bo) + if (bo->pin_count) + return 0; + +- if (bo->tbo.mem.mem_type == TTM_PL_VRAM) { +- adev->vram_pin_size -= amdgpu_bo_size(bo); +- adev->invisible_pin_size -= amdgpu_vram_mgr_bo_invisible_size(bo); +- } else if (bo->tbo.mem.mem_type == TTM_PL_TT) { +- adev->gart_pin_size -= amdgpu_bo_size(bo); +- } ++ amdgpu_bo_subtract_pin_size(bo); + + for (i = 0; i < bo->placement.num_placement; i++) { + bo->placements[i].lpfn = 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +index a44c3d58fef4..2ec20348b983 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +@@ -1157,7 +1157,7 @@ static ssize_t amdgpu_hwmon_show_vddnb(struct device *dev, + int r, size = sizeof(vddnb); + + /* only APUs have vddnb */ +- if (adev->flags & AMD_IS_APU) ++ if (!(adev->flags & AMD_IS_APU)) + return -EINVAL; + + /* Can't get voltage when the card is off */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 9f1a5bd39ae8..5b39d1399630 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -131,6 +131,11 @@ psp_cmd_submit_buf(struct psp_context *psp, + msleep(1); + } + ++ if (ucode) { ++ ucode->tmr_mc_addr_lo = psp->cmd_buf_mem->resp.fw_addr_lo; ++ ucode->tmr_mc_addr_hi = psp->cmd_buf_mem->resp.fw_addr_hi; ++ } ++ + return ret; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +index 86a0715d9431..1cafe8d83a4d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +@@ -53,9 +53,8 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev, + int fd, + enum drm_sched_priority priority) + { +- struct file *filp = fcheck(fd); ++ struct file *filp = fget(fd); + struct drm_file *file; +- struct pid *pid; + struct amdgpu_fpriv *fpriv; + struct amdgpu_ctx *ctx; + uint32_t id; +@@ -63,20 +62,12 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev, + if (!filp) + return -EINVAL; + +- pid = get_pid(((struct drm_file *)filp->private_data)->pid); ++ file = filp->private_data; ++ fpriv = file->driver_priv; ++ idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id) ++ amdgpu_ctx_priority_override(ctx, priority); + +- mutex_lock(&adev->ddev->filelist_mutex); +- list_for_each_entry(file, &adev->ddev->filelist, lhead) { +- if (file->pid != pid) +- continue; +- +- fpriv = file->driver_priv; +- idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id) +- amdgpu_ctx_priority_override(ctx, priority); +- } +- mutex_unlock(&adev->ddev->filelist_mutex); +- +- put_pid(pid); ++ fput(filp); + + return 0; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h +index e5da4654b630..8b3cc6687769 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h +@@ -73,7 +73,7 @@ bool amdgpu_gtt_mgr_has_gart_addr(struct ttm_mem_reg *mem); + uint64_t amdgpu_gtt_mgr_usage(struct ttm_mem_type_manager *man); + int amdgpu_gtt_mgr_recover(struct ttm_mem_type_manager *man); + +-u64 amdgpu_vram_mgr_bo_invisible_size(struct amdgpu_bo *bo); ++u64 amdgpu_vram_mgr_bo_visible_size(struct amdgpu_bo *bo); + uint64_t amdgpu_vram_mgr_usage(struct ttm_mem_type_manager *man); + uint64_t amdgpu_vram_mgr_vis_usage(struct ttm_mem_type_manager *man); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h +index 08e38579af24..bdc472b6e641 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h +@@ -194,6 +194,7 @@ enum AMDGPU_UCODE_ID { + AMDGPU_UCODE_ID_SMC, + AMDGPU_UCODE_ID_UVD, + AMDGPU_UCODE_ID_VCE, ++ AMDGPU_UCODE_ID_VCN, + AMDGPU_UCODE_ID_MAXIMUM, + }; + +@@ -226,6 +227,9 @@ struct amdgpu_firmware_info { + void *kaddr; + /* ucode_size_bytes */ + uint32_t ucode_size; ++ /* starting tmr mc address */ ++ uint32_t tmr_mc_addr_lo; ++ uint32_t tmr_mc_addr_hi; + }; + + void amdgpu_ucode_print_mc_hdr(const struct common_firmware_header *hdr); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +index 1b4ad9b2a755..bee49991c1ff 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +@@ -111,9 +111,10 @@ int amdgpu_vcn_sw_init(struct amdgpu_device *adev) + version_major, version_minor, family_id); + } + +- bo_size = AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8) +- + AMDGPU_VCN_STACK_SIZE + AMDGPU_VCN_HEAP_SIZE ++ bo_size = AMDGPU_VCN_STACK_SIZE + AMDGPU_VCN_HEAP_SIZE + + AMDGPU_VCN_SESSION_SIZE * 40; ++ if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) ++ bo_size += AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8); + r = amdgpu_bo_create_kernel(adev, bo_size, PAGE_SIZE, + AMDGPU_GEM_DOMAIN_VRAM, &adev->vcn.vcpu_bo, + &adev->vcn.gpu_addr, &adev->vcn.cpu_addr); +@@ -187,11 +188,13 @@ int amdgpu_vcn_resume(struct amdgpu_device *adev) + unsigned offset; + + hdr = (const struct common_firmware_header *)adev->vcn.fw->data; +- offset = le32_to_cpu(hdr->ucode_array_offset_bytes); +- memcpy_toio(adev->vcn.cpu_addr, adev->vcn.fw->data + offset, +- le32_to_cpu(hdr->ucode_size_bytes)); +- size -= le32_to_cpu(hdr->ucode_size_bytes); +- ptr += le32_to_cpu(hdr->ucode_size_bytes); ++ if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) { ++ offset = le32_to_cpu(hdr->ucode_array_offset_bytes); ++ memcpy_toio(adev->vcn.cpu_addr, adev->vcn.fw->data + offset, ++ le32_to_cpu(hdr->ucode_size_bytes)); ++ size -= le32_to_cpu(hdr->ucode_size_bytes); ++ ptr += le32_to_cpu(hdr->ucode_size_bytes); ++ } + memset_io(ptr, 0, size); + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +index b6333f92ba45..ef4784458800 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +@@ -97,33 +97,29 @@ static u64 amdgpu_vram_mgr_vis_size(struct amdgpu_device *adev, + } + + /** +- * amdgpu_vram_mgr_bo_invisible_size - CPU invisible BO size ++ * amdgpu_vram_mgr_bo_visible_size - CPU visible BO size + * + * @bo: &amdgpu_bo buffer object (must be in VRAM) + * + * Returns: +- * How much of the given &amdgpu_bo buffer object lies in CPU invisible VRAM. ++ * How much of the given &amdgpu_bo buffer object lies in CPU visible VRAM. + */ +-u64 amdgpu_vram_mgr_bo_invisible_size(struct amdgpu_bo *bo) ++u64 amdgpu_vram_mgr_bo_visible_size(struct amdgpu_bo *bo) + { + struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev); + struct ttm_mem_reg *mem = &bo->tbo.mem; + struct drm_mm_node *nodes = mem->mm_node; + unsigned pages = mem->num_pages; +- u64 usage = 0; ++ u64 usage; + + if (adev->gmc.visible_vram_size == adev->gmc.real_vram_size) +- return 0; ++ return amdgpu_bo_size(bo); + + if (mem->start >= adev->gmc.visible_vram_size >> PAGE_SHIFT) +- return amdgpu_bo_size(bo); ++ return 0; + +- while (nodes && pages) { +- usage += nodes->size << PAGE_SHIFT; +- usage -= amdgpu_vram_mgr_vis_size(adev, nodes); +- pages -= nodes->size; +- ++nodes; +- } ++ for (usage = 0; nodes && pages; pages -= nodes->size, nodes++) ++ usage += amdgpu_vram_mgr_vis_size(adev, nodes); + + return usage; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index a69153435ea7..8f0ac805ecd2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -3433,7 +3433,7 @@ static void gfx_v9_0_enter_rlc_safe_mode(struct amdgpu_device *adev) + + /* wait for RLC_SAFE_MODE */ + for (i = 0; i < adev->usec_timeout; i++) { +- if (!REG_GET_FIELD(SOC15_REG_OFFSET(GC, 0, mmRLC_SAFE_MODE), RLC_SAFE_MODE, CMD)) ++ if (!REG_GET_FIELD(RREG32_SOC15(GC, 0, mmRLC_SAFE_MODE), RLC_SAFE_MODE, CMD)) + break; + udelay(1); + } +diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c +index 0ff136d02d9b..02be34e72ed9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c +@@ -88,6 +88,9 @@ psp_v10_0_get_fw_type(struct amdgpu_firmware_info *ucode, enum psp_gfx_fw_type * + case AMDGPU_UCODE_ID_VCE: + *type = GFX_FW_TYPE_VCE; + break; ++ case AMDGPU_UCODE_ID_VCN: ++ *type = GFX_FW_TYPE_VCN; ++ break; + case AMDGPU_UCODE_ID_MAXIMUM: + default: + return -EINVAL; +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c +index bfddf97dd13e..a16eebc05d12 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c +@@ -1569,7 +1569,6 @@ static const struct amdgpu_ring_funcs uvd_v6_0_ring_phys_funcs = { + static const struct amdgpu_ring_funcs uvd_v6_0_ring_vm_funcs = { + .type = AMDGPU_RING_TYPE_UVD, + .align_mask = 0xf, +- .nop = PACKET0(mmUVD_NO_OP, 0), + .support_64bit_ptrs = false, + .get_rptr = uvd_v6_0_ring_get_rptr, + .get_wptr = uvd_v6_0_ring_get_wptr, +@@ -1587,7 +1586,7 @@ static const struct amdgpu_ring_funcs uvd_v6_0_ring_vm_funcs = { + .emit_hdp_flush = uvd_v6_0_ring_emit_hdp_flush, + .test_ring = uvd_v6_0_ring_test_ring, + .test_ib = amdgpu_uvd_ring_test_ib, +- .insert_nop = amdgpu_ring_insert_nop, ++ .insert_nop = uvd_v6_0_ring_insert_nop, + .pad_ib = amdgpu_ring_generic_pad_ib, + .begin_use = amdgpu_uvd_ring_begin_use, + .end_use = amdgpu_uvd_ring_end_use, +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c +index 29684c3ea4ef..700119168067 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c +@@ -90,6 +90,16 @@ static int vcn_v1_0_sw_init(void *handle) + if (r) + return r; + ++ if (adev->firmware.load_type == AMDGPU_FW_LOAD_PSP) { ++ const struct common_firmware_header *hdr; ++ hdr = (const struct common_firmware_header *)adev->vcn.fw->data; ++ adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].ucode_id = AMDGPU_UCODE_ID_VCN; ++ adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw; ++ adev->firmware.fw_size += ++ ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE); ++ DRM_INFO("PSP loading VCN firmware\n"); ++ } ++ + r = amdgpu_vcn_resume(adev); + if (r) + return r; +@@ -241,26 +251,38 @@ static int vcn_v1_0_resume(void *handle) + static void vcn_v1_0_mc_resume(struct amdgpu_device *adev) + { + uint32_t size = AMDGPU_GPU_PAGE_ALIGN(adev->vcn.fw->size + 4); +- +- WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_LOW, ++ uint32_t offset; ++ ++ if (adev->firmware.load_type == AMDGPU_FW_LOAD_PSP) { ++ WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_LOW, ++ (adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].tmr_mc_addr_lo)); ++ WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_HIGH, ++ (adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].tmr_mc_addr_hi)); ++ WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET0, 0); ++ offset = 0; ++ } else { ++ WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_LOW, + lower_32_bits(adev->vcn.gpu_addr)); +- WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_HIGH, ++ WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_HIGH, + upper_32_bits(adev->vcn.gpu_addr)); +- WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET0, +- AMDGPU_UVD_FIRMWARE_OFFSET >> 3); ++ offset = size; ++ WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET0, ++ AMDGPU_UVD_FIRMWARE_OFFSET >> 3); ++ } ++ + WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_SIZE0, size); + + WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE1_64BIT_BAR_LOW, +- lower_32_bits(adev->vcn.gpu_addr + size)); ++ lower_32_bits(adev->vcn.gpu_addr + offset)); + WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE1_64BIT_BAR_HIGH, +- upper_32_bits(adev->vcn.gpu_addr + size)); ++ upper_32_bits(adev->vcn.gpu_addr + offset)); + WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET1, 0); + WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_SIZE1, AMDGPU_VCN_HEAP_SIZE); + + WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE2_64BIT_BAR_LOW, +- lower_32_bits(adev->vcn.gpu_addr + size + AMDGPU_VCN_HEAP_SIZE)); ++ lower_32_bits(adev->vcn.gpu_addr + offset + AMDGPU_VCN_HEAP_SIZE)); + WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE2_64BIT_BAR_HIGH, +- upper_32_bits(adev->vcn.gpu_addr + size + AMDGPU_VCN_HEAP_SIZE)); ++ upper_32_bits(adev->vcn.gpu_addr + offset + AMDGPU_VCN_HEAP_SIZE)); + WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET2, 0); + WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_SIZE2, + AMDGPU_VCN_STACK_SIZE + (AMDGPU_VCN_SESSION_SIZE * 40)); +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 770c6b24be0b..e484d0a94bdc 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1334,6 +1334,7 @@ amdgpu_dm_register_backlight_device(struct amdgpu_display_manager *dm) + struct backlight_properties props = { 0 }; + + props.max_brightness = AMDGPU_MAX_BL_LEVEL; ++ props.brightness = AMDGPU_MAX_BL_LEVEL; + props.type = BACKLIGHT_RAW; + + snprintf(bl_name, sizeof(bl_name), "amdgpu_bl%d", +@@ -2123,13 +2124,8 @@ convert_color_depth_from_display_info(const struct drm_connector *connector) + static enum dc_aspect_ratio + get_aspect_ratio(const struct drm_display_mode *mode_in) + { +- int32_t width = mode_in->crtc_hdisplay * 9; +- int32_t height = mode_in->crtc_vdisplay * 16; +- +- if ((width - height) < 10 && (width - height) > -10) +- return ASPECT_RATIO_16_9; +- else +- return ASPECT_RATIO_4_3; ++ /* 1-1 mapping, since both enums follow the HDMI spec. */ ++ return (enum dc_aspect_ratio) mode_in->picture_aspect_ratio; + } + + static enum dc_color_space +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c +index 52f2c01349e3..9bfb040352e9 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c +@@ -98,10 +98,16 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name, + */ + void amdgpu_dm_crtc_handle_crc_irq(struct drm_crtc *crtc) + { +- struct dm_crtc_state *crtc_state = to_dm_crtc_state(crtc->state); +- struct dc_stream_state *stream_state = crtc_state->stream; ++ struct dm_crtc_state *crtc_state; ++ struct dc_stream_state *stream_state; + uint32_t crcs[3]; + ++ if (crtc == NULL) ++ return; ++ ++ crtc_state = to_dm_crtc_state(crtc->state); ++ stream_state = crtc_state->stream; ++ + /* Early return if CRC capture is not enabled. */ + if (!crtc_state->crc_enabled) + return; +diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table.c b/drivers/gpu/drm/amd/display/dc/bios/command_table.c +index 651e1fd4622f..a558bfaa0c46 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/command_table.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/command_table.c +@@ -808,6 +808,24 @@ static enum bp_result transmitter_control_v1_5( + * (=1: 8bpp, =1.25: 10bpp, =1.5:12bpp, =2: 16bpp) + * LVDS mode: usPixelClock = pixel clock + */ ++ if (cntl->signal == SIGNAL_TYPE_HDMI_TYPE_A) { ++ switch (cntl->color_depth) { ++ case COLOR_DEPTH_101010: ++ params.usSymClock = ++ cpu_to_le16((le16_to_cpu(params.usSymClock) * 30) / 24); ++ break; ++ case COLOR_DEPTH_121212: ++ params.usSymClock = ++ cpu_to_le16((le16_to_cpu(params.usSymClock) * 36) / 24); ++ break; ++ case COLOR_DEPTH_161616: ++ params.usSymClock = ++ cpu_to_le16((le16_to_cpu(params.usSymClock) * 48) / 24); ++ break; ++ default: ++ break; ++ } ++ } + + if (EXEC_BIOS_CMD_TABLE(UNIPHYTransmitterControl, params)) + result = BP_RESULT_OK; +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 2fa521812d23..8a7890b03d97 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -728,6 +728,17 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason) + break; + case EDID_NO_RESPONSE: + DC_LOG_ERROR("No EDID read.\n"); ++ ++ /* ++ * Abort detection for non-DP connectors if we have ++ * no EDID ++ * ++ * DP needs to report as connected if HDP is high ++ * even if we have no EDID in order to go to ++ * fail-safe mode ++ */ ++ if (!dc_is_dp_signal(link->connector_signal)) ++ return false; + default: + break; + } +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index 751f3ac9d921..754b4c2fc90a 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -268,24 +268,30 @@ bool resource_construct( + + return true; + } ++static int find_matching_clock_source( ++ const struct resource_pool *pool, ++ struct clock_source *clock_source) ++{ + ++ int i; ++ ++ for (i = 0; i < pool->clk_src_count; i++) { ++ if (pool->clock_sources[i] == clock_source) ++ return i; ++ } ++ return -1; ++} + + void resource_unreference_clock_source( + struct resource_context *res_ctx, + const struct resource_pool *pool, + struct clock_source *clock_source) + { +- int i; +- +- for (i = 0; i < pool->clk_src_count; i++) { +- if (pool->clock_sources[i] != clock_source) +- continue; ++ int i = find_matching_clock_source(pool, clock_source); + ++ if (i > -1) + res_ctx->clock_source_ref_count[i]--; + +- break; +- } +- + if (pool->dp_clock_source == clock_source) + res_ctx->dp_clock_source_ref_count--; + } +@@ -295,19 +301,31 @@ void resource_reference_clock_source( + const struct resource_pool *pool, + struct clock_source *clock_source) + { +- int i; +- for (i = 0; i < pool->clk_src_count; i++) { +- if (pool->clock_sources[i] != clock_source) +- continue; ++ int i = find_matching_clock_source(pool, clock_source); + ++ if (i > -1) + res_ctx->clock_source_ref_count[i]++; +- break; +- } + + if (pool->dp_clock_source == clock_source) + res_ctx->dp_clock_source_ref_count++; + } + ++int resource_get_clock_source_reference( ++ struct resource_context *res_ctx, ++ const struct resource_pool *pool, ++ struct clock_source *clock_source) ++{ ++ int i = find_matching_clock_source(pool, clock_source); ++ ++ if (i > -1) ++ return res_ctx->clock_source_ref_count[i]; ++ ++ if (pool->dp_clock_source == clock_source) ++ return res_ctx->dp_clock_source_ref_count; ++ ++ return -1; ++} ++ + bool resource_are_streams_timing_synchronizable( + struct dc_stream_state *stream1, + struct dc_stream_state *stream2) +@@ -330,6 +348,9 @@ bool resource_are_streams_timing_synchronizable( + != stream2->timing.pix_clk_khz) + return false; + ++ if (stream1->clamping.c_depth != stream2->clamping.c_depth) ++ return false; ++ + if (stream1->phy_pix_clk != stream2->phy_pix_clk + && (!dc_is_dp_signal(stream1->signal) + || !dc_is_dp_signal(stream2->signal))) +@@ -337,6 +358,20 @@ bool resource_are_streams_timing_synchronizable( + + return true; + } ++static bool is_dp_and_hdmi_sharable( ++ struct dc_stream_state *stream1, ++ struct dc_stream_state *stream2) ++{ ++ if (stream1->ctx->dc->caps.disable_dp_clk_share) ++ return false; ++ ++ if (stream1->clamping.c_depth != COLOR_DEPTH_888 || ++ stream2->clamping.c_depth != COLOR_DEPTH_888) ++ return false; ++ ++ return true; ++ ++} + + static bool is_sharable_clk_src( + const struct pipe_ctx *pipe_with_clk_src, +@@ -348,7 +383,10 @@ static bool is_sharable_clk_src( + if (pipe_with_clk_src->stream->signal == SIGNAL_TYPE_VIRTUAL) + return false; + +- if (dc_is_dp_signal(pipe_with_clk_src->stream->signal)) ++ if (dc_is_dp_signal(pipe_with_clk_src->stream->signal) || ++ (dc_is_dp_signal(pipe->stream->signal) && ++ !is_dp_and_hdmi_sharable(pipe_with_clk_src->stream, ++ pipe->stream))) + return false; + + if (dc_is_hdmi_signal(pipe_with_clk_src->stream->signal) +diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h +index 53c71296f3dd..efe155d50668 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc.h ++++ b/drivers/gpu/drm/amd/display/dc/dc.h +@@ -77,6 +77,7 @@ struct dc_caps { + bool dual_link_dvi; + bool post_blend_color_processing; + bool force_dp_tps4_for_cp2520; ++ bool disable_dp_clk_share; + }; + + struct dc_dcc_surface_param { +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c +index dbe3b26b6d9e..f6ec1d3dfd0c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c +@@ -919,7 +919,7 @@ void dce110_link_encoder_enable_tmds_output( + enum bp_result result; + + /* Enable the PHY */ +- ++ cntl.connector_obj_id = enc110->base.connector; + cntl.action = TRANSMITTER_CONTROL_ENABLE; + cntl.engine_id = enc->preferred_engine; + cntl.transmitter = enc110->base.transmitter; +@@ -961,7 +961,7 @@ void dce110_link_encoder_enable_dp_output( + * We need to set number of lanes manually. + */ + configure_encoder(enc110, link_settings); +- ++ cntl.connector_obj_id = enc110->base.connector; + cntl.action = TRANSMITTER_CONTROL_ENABLE; + cntl.engine_id = enc->preferred_engine; + cntl.transmitter = enc110->base.transmitter; +diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c +index 344dd2e69e7c..aa2f03eb46fe 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c +@@ -884,7 +884,7 @@ static bool construct( + dc->caps.i2c_speed_in_khz = 40; + dc->caps.max_cursor_size = 128; + dc->caps.dual_link_dvi = true; +- ++ dc->caps.disable_dp_clk_share = true; + for (i = 0; i < pool->base.pipe_count; i++) { + pool->base.timing_generators[i] = + dce100_timing_generator_create( +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_compressor.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_compressor.c +index e2994d337044..111c4921987f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_compressor.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_compressor.c +@@ -143,7 +143,7 @@ static void wait_for_fbc_state_changed( + struct dce110_compressor *cp110, + bool enabled) + { +- uint8_t counter = 0; ++ uint16_t counter = 0; + uint32_t addr = mmFBC_STATUS; + uint32_t value; + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index c29052b6da5a..7c0b1d7aa9b8 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -1939,7 +1939,9 @@ static void dce110_reset_hw_ctx_wrap( + pipe_ctx_old->plane_res.mi->funcs->free_mem_input( + pipe_ctx_old->plane_res.mi, dc->current_state->stream_count); + +- if (old_clk) ++ if (old_clk && 0 == resource_get_clock_source_reference(&context->res_ctx, ++ dc->res_pool, ++ old_clk)) + old_clk->funcs->cs_power_down(old_clk); + + dc->hwss.disable_plane(dc, pipe_ctx_old); +diff --git a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c +index 48a068964722..6f4992bdc9ce 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c +@@ -902,6 +902,7 @@ static bool dce80_construct( + } + + dc->caps.max_planes = pool->base.pipe_count; ++ dc->caps.disable_dp_clk_share = true; + + if (!resource_construct(num_virtual_links, dc, &pool->base, + &res_create_funcs)) +@@ -1087,6 +1088,7 @@ static bool dce81_construct( + } + + dc->caps.max_planes = pool->base.pipe_count; ++ dc->caps.disable_dp_clk_share = true; + + if (!resource_construct(num_virtual_links, dc, &pool->base, + &res_create_funcs)) +@@ -1268,6 +1270,7 @@ static bool dce83_construct( + } + + dc->caps.max_planes = pool->base.pipe_count; ++ dc->caps.disable_dp_clk_share = true; + + if (!resource_construct(num_virtual_links, dc, &pool->base, + &res_create_funcs)) +diff --git a/drivers/gpu/drm/amd/display/dc/inc/resource.h b/drivers/gpu/drm/amd/display/dc/inc/resource.h +index 640a647f4611..abf42a7d0859 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/resource.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/resource.h +@@ -102,6 +102,11 @@ void resource_reference_clock_source( + const struct resource_pool *pool, + struct clock_source *clock_source); + ++int resource_get_clock_source_reference( ++ struct resource_context *res_ctx, ++ const struct resource_pool *pool, ++ struct clock_source *clock_source); ++ + bool resource_are_streams_timing_synchronizable( + struct dc_stream_state *stream1, + struct dc_stream_state *stream2); +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c +index c952845833d7..5e19f5977eb1 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c +@@ -403,6 +403,49 @@ static const struct gpu_pt_config_reg DIDTConfig_Polaris12[] = { + { ixDIDT_SQ_CTRL1, DIDT_SQ_CTRL1__MAX_POWER_MASK, DIDT_SQ_CTRL1__MAX_POWER__SHIFT, 0xffff, GPU_CONFIGREG_DIDT_IND }, + + { ixDIDT_SQ_CTRL_OCP, DIDT_SQ_CTRL_OCP__UNUSED_0_MASK, DIDT_SQ_CTRL_OCP__UNUSED_0__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL_OCP, DIDT_SQ_CTRL_OCP__OCP_MAX_POWER_MASK, DIDT_SQ_CTRL_OCP__OCP_MAX_POWER__SHIFT, 0xffff, GPU_CONFIGREG_DIDT_IND }, ++ ++ { ixDIDT_SQ_CTRL2, DIDT_SQ_CTRL2__MAX_POWER_DELTA_MASK, DIDT_SQ_CTRL2__MAX_POWER_DELTA__SHIFT, 0x3853, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL2, DIDT_SQ_CTRL2__UNUSED_0_MASK, DIDT_SQ_CTRL2__UNUSED_0__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL2, DIDT_SQ_CTRL2__SHORT_TERM_INTERVAL_SIZE_MASK, DIDT_SQ_CTRL2__SHORT_TERM_INTERVAL_SIZE__SHIFT, 0x005a, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL2, DIDT_SQ_CTRL2__UNUSED_1_MASK, DIDT_SQ_CTRL2__UNUSED_1__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL2, DIDT_SQ_CTRL2__LONG_TERM_INTERVAL_RATIO_MASK, DIDT_SQ_CTRL2__LONG_TERM_INTERVAL_RATIO__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL2, DIDT_SQ_CTRL2__UNUSED_2_MASK, DIDT_SQ_CTRL2__UNUSED_2__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ ++ { ixDIDT_SQ_STALL_CTRL, DIDT_SQ_STALL_CTRL__DIDT_STALL_CTRL_ENABLE_MASK, DIDT_SQ_STALL_CTRL__DIDT_STALL_CTRL_ENABLE__SHIFT, 0x0001, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_STALL_CTRL, DIDT_SQ_STALL_CTRL__DIDT_STALL_DELAY_HI_MASK, DIDT_SQ_STALL_CTRL__DIDT_STALL_DELAY_HI__SHIFT, 0x0001, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_STALL_CTRL, DIDT_SQ_STALL_CTRL__DIDT_STALL_DELAY_LO_MASK, DIDT_SQ_STALL_CTRL__DIDT_STALL_DELAY_LO__SHIFT, 0x0001, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_STALL_CTRL, DIDT_SQ_STALL_CTRL__DIDT_HI_POWER_THRESHOLD_MASK, DIDT_SQ_STALL_CTRL__DIDT_HI_POWER_THRESHOLD__SHIFT, 0x0ebb, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_STALL_CTRL, DIDT_SQ_STALL_CTRL__UNUSED_0_MASK, DIDT_SQ_STALL_CTRL__UNUSED_0__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ ++ { ixDIDT_SQ_TUNING_CTRL, DIDT_SQ_TUNING_CTRL__DIDT_TUNING_ENABLE_MASK, DIDT_SQ_TUNING_CTRL__DIDT_TUNING_ENABLE__SHIFT, 0x0001, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_TUNING_CTRL, DIDT_SQ_TUNING_CTRL__MAX_POWER_DELTA_HI_MASK, DIDT_SQ_TUNING_CTRL__MAX_POWER_DELTA_HI__SHIFT, 0x3853, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_TUNING_CTRL, DIDT_SQ_TUNING_CTRL__MAX_POWER_DELTA_LO_MASK, DIDT_SQ_TUNING_CTRL__MAX_POWER_DELTA_LO__SHIFT, 0x3153, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_TUNING_CTRL, DIDT_SQ_TUNING_CTRL__UNUSED_0_MASK, DIDT_SQ_TUNING_CTRL__UNUSED_0__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ ++ { ixDIDT_SQ_CTRL0, DIDT_SQ_CTRL0__DIDT_CTRL_EN_MASK, DIDT_SQ_CTRL0__DIDT_CTRL_EN__SHIFT, 0x0001, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL0, DIDT_SQ_CTRL0__USE_REF_CLOCK_MASK, DIDT_SQ_CTRL0__USE_REF_CLOCK__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL0, DIDT_SQ_CTRL0__PHASE_OFFSET_MASK, DIDT_SQ_CTRL0__PHASE_OFFSET__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL0, DIDT_SQ_CTRL0__DIDT_CTRL_RST_MASK, DIDT_SQ_CTRL0__DIDT_CTRL_RST__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL0, DIDT_SQ_CTRL0__DIDT_CLK_EN_OVERRIDE_MASK, DIDT_SQ_CTRL0__DIDT_CLK_EN_OVERRIDE__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL0, DIDT_SQ_CTRL0__DIDT_MAX_STALLS_ALLOWED_HI_MASK, DIDT_SQ_CTRL0__DIDT_MAX_STALLS_ALLOWED_HI__SHIFT, 0x0010, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL0, DIDT_SQ_CTRL0__DIDT_MAX_STALLS_ALLOWED_LO_MASK, DIDT_SQ_CTRL0__DIDT_MAX_STALLS_ALLOWED_LO__SHIFT, 0x0010, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_SQ_CTRL0, DIDT_SQ_CTRL0__UNUSED_0_MASK, DIDT_SQ_CTRL0__UNUSED_0__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ ++ { ixDIDT_TD_WEIGHT0_3, DIDT_TD_WEIGHT0_3__WEIGHT0_MASK, DIDT_TD_WEIGHT0_3__WEIGHT0__SHIFT, 0x000a, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_TD_WEIGHT0_3, DIDT_TD_WEIGHT0_3__WEIGHT1_MASK, DIDT_TD_WEIGHT0_3__WEIGHT1__SHIFT, 0x0010, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_TD_WEIGHT0_3, DIDT_TD_WEIGHT0_3__WEIGHT2_MASK, DIDT_TD_WEIGHT0_3__WEIGHT2__SHIFT, 0x0017, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_TD_WEIGHT0_3, DIDT_TD_WEIGHT0_3__WEIGHT3_MASK, DIDT_TD_WEIGHT0_3__WEIGHT3__SHIFT, 0x002f, GPU_CONFIGREG_DIDT_IND }, ++ ++ { ixDIDT_TD_WEIGHT4_7, DIDT_TD_WEIGHT4_7__WEIGHT4_MASK, DIDT_TD_WEIGHT4_7__WEIGHT4__SHIFT, 0x0046, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_TD_WEIGHT4_7, DIDT_TD_WEIGHT4_7__WEIGHT5_MASK, DIDT_TD_WEIGHT4_7__WEIGHT5__SHIFT, 0x005d, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_TD_WEIGHT4_7, DIDT_TD_WEIGHT4_7__WEIGHT6_MASK, DIDT_TD_WEIGHT4_7__WEIGHT6__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_TD_WEIGHT4_7, DIDT_TD_WEIGHT4_7__WEIGHT7_MASK, DIDT_TD_WEIGHT4_7__WEIGHT7__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ ++ { ixDIDT_TD_CTRL1, DIDT_TD_CTRL1__MIN_POWER_MASK, DIDT_TD_CTRL1__MIN_POWER__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, ++ { ixDIDT_TD_CTRL1, DIDT_TD_CTRL1__MAX_POWER_MASK, DIDT_TD_CTRL1__MAX_POWER__SHIFT, 0xffff, GPU_CONFIGREG_DIDT_IND }, ++ ++ { ixDIDT_TD_CTRL_OCP, DIDT_TD_CTRL_OCP__UNUSED_0_MASK, DIDT_TD_CTRL_OCP__UNUSED_0__SHIFT, 0x0000, GPU_CONFIGREG_DIDT_IND }, + { ixDIDT_TD_CTRL_OCP, DIDT_TD_CTRL_OCP__OCP_MAX_POWER_MASK, DIDT_TD_CTRL_OCP__OCP_MAX_POWER__SHIFT, 0x00ff, GPU_CONFIGREG_DIDT_IND }, + + { ixDIDT_TD_CTRL2, DIDT_TD_CTRL2__MAX_POWER_DELTA_MASK, DIDT_TD_CTRL2__MAX_POWER_DELTA__SHIFT, 0x3fff, GPU_CONFIGREG_DIDT_IND }, +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c +index 50690c72b2ea..617557bd8c24 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c +@@ -244,6 +244,7 @@ static int smu8_initialize_dpm_defaults(struct pp_hwmgr *hwmgr) + return 0; + } + ++/* convert form 8bit vid to real voltage in mV*4 */ + static uint32_t smu8_convert_8Bit_index_to_voltage( + struct pp_hwmgr *hwmgr, uint16_t voltage) + { +@@ -1702,13 +1703,13 @@ static int smu8_read_sensor(struct pp_hwmgr *hwmgr, int idx, + case AMDGPU_PP_SENSOR_VDDNB: + tmp = (cgs_read_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixSMUSVI_NB_CURRENTVID) & + CURRENT_NB_VID_MASK) >> CURRENT_NB_VID__SHIFT; +- vddnb = smu8_convert_8Bit_index_to_voltage(hwmgr, tmp); ++ vddnb = smu8_convert_8Bit_index_to_voltage(hwmgr, tmp) / 4; + *((uint32_t *)value) = vddnb; + return 0; + case AMDGPU_PP_SENSOR_VDDGFX: + tmp = (cgs_read_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixSMUSVI_GFX_CURRENTVID) & + CURRENT_GFX_VID_MASK) >> CURRENT_GFX_VID__SHIFT; +- vddgfx = smu8_convert_8Bit_index_to_voltage(hwmgr, (u16)tmp); ++ vddgfx = smu8_convert_8Bit_index_to_voltage(hwmgr, (u16)tmp) / 4; + *((uint32_t *)value) = vddgfx; + return 0; + case AMDGPU_PP_SENSOR_UVD_VCLK: +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c +index c98e5de777cd..fcd2808874bf 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c +@@ -490,7 +490,7 @@ static int vega12_get_number_dpm_level(struct pp_hwmgr *hwmgr, + static int vega12_get_dpm_frequency_by_index(struct pp_hwmgr *hwmgr, + PPCLK_e clkID, uint32_t index, uint32_t *clock) + { +- int result; ++ int result = 0; + + /* + *SMU expects the Clock ID to be in the top 16 bits. +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index a5808382bdf0..c7b4481c90d7 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -116,6 +116,9 @@ static const struct edid_quirk { + /* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */ + { "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC }, + ++ /* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */ ++ { "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC }, ++ + /* Belinea 10 15 55 */ + { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 }, + { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 }, +@@ -163,8 +166,9 @@ static const struct edid_quirk { + /* Rotel RSX-1058 forwards sink's EDID but only does HDMI 1.1*/ + { "ETR", 13896, EDID_QUIRK_FORCE_8BPC }, + +- /* HTC Vive VR Headset */ ++ /* HTC Vive and Vive Pro VR Headsets */ + { "HVR", 0xaa01, EDID_QUIRK_NON_DESKTOP }, ++ { "HVR", 0xaa02, EDID_QUIRK_NON_DESKTOP }, + + /* Oculus Rift DK1, DK2, and CV1 VR Headsets */ + { "OVR", 0x0001, EDID_QUIRK_NON_DESKTOP }, +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +index 686f6552db48..3ef440b235e5 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +@@ -799,6 +799,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu) + + free_buffer: + etnaviv_cmdbuf_free(&gpu->buffer); ++ gpu->buffer.suballoc = NULL; + destroy_iommu: + etnaviv_iommu_destroy(gpu->mmu); + gpu->mmu = NULL; +diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c +index 9c449b8d8eab..015f9e93419d 100644 +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -919,7 +919,6 @@ static int i915_driver_init_early(struct drm_i915_private *dev_priv, + spin_lock_init(&dev_priv->uncore.lock); + + mutex_init(&dev_priv->sb_lock); +- mutex_init(&dev_priv->modeset_restore_lock); + mutex_init(&dev_priv->av_mutex); + mutex_init(&dev_priv->wm.wm_mutex); + mutex_init(&dev_priv->pps_mutex); +@@ -1560,11 +1559,6 @@ static int i915_drm_suspend(struct drm_device *dev) + pci_power_t opregion_target_state; + int error; + +- /* ignore lid events during suspend */ +- mutex_lock(&dev_priv->modeset_restore_lock); +- dev_priv->modeset_restore = MODESET_SUSPENDED; +- mutex_unlock(&dev_priv->modeset_restore_lock); +- + disable_rpm_wakeref_asserts(dev_priv); + + /* We do a lot of poking in a lot of registers, make sure they work +@@ -1764,10 +1758,6 @@ static int i915_drm_resume(struct drm_device *dev) + + intel_fbdev_set_suspend(dev, FBINFO_STATE_RUNNING, false); + +- mutex_lock(&dev_priv->modeset_restore_lock); +- dev_priv->modeset_restore = MODESET_DONE; +- mutex_unlock(&dev_priv->modeset_restore_lock); +- + intel_opregion_notify_adapter(dev_priv, PCI_D0); + + enable_rpm_wakeref_asserts(dev_priv); +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 71e1aa54f774..7c22fac3aa04 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -1003,12 +1003,6 @@ struct i915_gem_mm { + #define I915_ENGINE_DEAD_TIMEOUT (4 * HZ) /* Seqno, head and subunits dead */ + #define I915_SEQNO_DEAD_TIMEOUT (12 * HZ) /* Seqno dead with active head */ + +-enum modeset_restore { +- MODESET_ON_LID_OPEN, +- MODESET_DONE, +- MODESET_SUSPENDED, +-}; +- + #define DP_AUX_A 0x40 + #define DP_AUX_B 0x10 + #define DP_AUX_C 0x20 +@@ -1740,8 +1734,6 @@ struct drm_i915_private { + + unsigned long quirks; + +- enum modeset_restore modeset_restore; +- struct mutex modeset_restore_lock; + struct drm_atomic_state *modeset_restore_state; + struct drm_modeset_acquire_ctx reset_ctx; + +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 7720569f2024..6e048ee88e3f 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -8825,6 +8825,7 @@ enum skl_power_gate { + #define TRANS_MSA_10_BPC (2<<5) + #define TRANS_MSA_12_BPC (3<<5) + #define TRANS_MSA_16_BPC (4<<5) ++#define TRANS_MSA_CEA_RANGE (1<<3) + + /* LCPLL Control */ + #define LCPLL_CTL _MMIO(0x130040) +diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c +index fed26d6e4e27..e195c287c263 100644 +--- a/drivers/gpu/drm/i915/intel_ddi.c ++++ b/drivers/gpu/drm/i915/intel_ddi.c +@@ -1659,6 +1659,10 @@ void intel_ddi_set_pipe_settings(const struct intel_crtc_state *crtc_state) + WARN_ON(transcoder_is_dsi(cpu_transcoder)); + + temp = TRANS_MSA_SYNC_CLK; ++ ++ if (crtc_state->limited_color_range) ++ temp |= TRANS_MSA_CEA_RANGE; ++ + switch (crtc_state->pipe_bpp) { + case 18: + temp |= TRANS_MSA_6_BPC; +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 16faea30114a..8e465095fe06 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -4293,18 +4293,6 @@ intel_dp_needs_link_retrain(struct intel_dp *intel_dp) + return !drm_dp_channel_eq_ok(link_status, intel_dp->lane_count); + } + +-/* +- * If display is now connected check links status, +- * there has been known issues of link loss triggering +- * long pulse. +- * +- * Some sinks (eg. ASUS PB287Q) seem to perform some +- * weird HPD ping pong during modesets. So we can apparently +- * end up with HPD going low during a modeset, and then +- * going back up soon after. And once that happens we must +- * retrain the link to get a picture. That's in case no +- * userspace component reacted to intermittent HPD dip. +- */ + int intel_dp_retrain_link(struct intel_encoder *encoder, + struct drm_modeset_acquire_ctx *ctx) + { +@@ -4794,7 +4782,8 @@ intel_dp_unset_edid(struct intel_dp *intel_dp) + } + + static int +-intel_dp_long_pulse(struct intel_connector *connector) ++intel_dp_long_pulse(struct intel_connector *connector, ++ struct drm_modeset_acquire_ctx *ctx) + { + struct drm_i915_private *dev_priv = to_i915(connector->base.dev); + struct intel_dp *intel_dp = intel_attached_dp(&connector->base); +@@ -4853,6 +4842,22 @@ intel_dp_long_pulse(struct intel_connector *connector) + */ + status = connector_status_disconnected; + goto out; ++ } else { ++ /* ++ * If display is now connected check links status, ++ * there has been known issues of link loss triggering ++ * long pulse. ++ * ++ * Some sinks (eg. ASUS PB287Q) seem to perform some ++ * weird HPD ping pong during modesets. So we can apparently ++ * end up with HPD going low during a modeset, and then ++ * going back up soon after. And once that happens we must ++ * retrain the link to get a picture. That's in case no ++ * userspace component reacted to intermittent HPD dip. ++ */ ++ struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base; ++ ++ intel_dp_retrain_link(encoder, ctx); + } + + /* +@@ -4914,7 +4919,7 @@ intel_dp_detect(struct drm_connector *connector, + return ret; + } + +- status = intel_dp_long_pulse(intel_dp->attached_connector); ++ status = intel_dp_long_pulse(intel_dp->attached_connector, ctx); + } + + intel_dp->detect_done = false; +diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c +index d8cb53ef4351..c8640959a7fc 100644 +--- a/drivers/gpu/drm/i915/intel_hdmi.c ++++ b/drivers/gpu/drm/i915/intel_hdmi.c +@@ -933,8 +933,12 @@ static int intel_hdmi_hdcp_write(struct intel_digital_port *intel_dig_port, + + ret = i2c_transfer(adapter, &msg, 1); + if (ret == 1) +- return 0; +- return ret >= 0 ? -EIO : ret; ++ ret = 0; ++ else if (ret >= 0) ++ ret = -EIO; ++ ++ kfree(write_buf); ++ return ret; + } + + static +diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c +index b4941101f21a..cdf19553ffac 100644 +--- a/drivers/gpu/drm/i915/intel_lpe_audio.c ++++ b/drivers/gpu/drm/i915/intel_lpe_audio.c +@@ -127,9 +127,7 @@ lpe_audio_platdev_create(struct drm_i915_private *dev_priv) + return platdev; + } + +- pm_runtime_forbid(&platdev->dev); +- pm_runtime_set_active(&platdev->dev); +- pm_runtime_enable(&platdev->dev); ++ pm_runtime_no_callbacks(&platdev->dev); + + return platdev; + } +diff --git a/drivers/gpu/drm/i915/intel_lspcon.c b/drivers/gpu/drm/i915/intel_lspcon.c +index 8ae8f42f430a..6b6758419fb3 100644 +--- a/drivers/gpu/drm/i915/intel_lspcon.c ++++ b/drivers/gpu/drm/i915/intel_lspcon.c +@@ -74,7 +74,7 @@ static enum drm_lspcon_mode lspcon_wait_mode(struct intel_lspcon *lspcon, + DRM_DEBUG_KMS("Waiting for LSPCON mode %s to settle\n", + lspcon_mode_name(mode)); + +- wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode, 100); ++ wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode, 400); + if (current_mode != mode) + DRM_ERROR("LSPCON mode hasn't settled\n"); + +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index 48f618dc9abb..63d7faa99946 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -44,8 +44,6 @@ + /* Private structure for the integrated LVDS support */ + struct intel_lvds_connector { + struct intel_connector base; +- +- struct notifier_block lid_notifier; + }; + + struct intel_lvds_pps { +@@ -454,26 +452,9 @@ static bool intel_lvds_compute_config(struct intel_encoder *intel_encoder, + return true; + } + +-/* +- * Detect the LVDS connection. +- * +- * Since LVDS doesn't have hotlug, we use the lid as a proxy. Open means +- * connected and closed means disconnected. We also send hotplug events as +- * needed, using lid status notification from the input layer. +- */ + static enum drm_connector_status + intel_lvds_detect(struct drm_connector *connector, bool force) + { +- struct drm_i915_private *dev_priv = to_i915(connector->dev); +- enum drm_connector_status status; +- +- DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", +- connector->base.id, connector->name); +- +- status = intel_panel_detect(dev_priv); +- if (status != connector_status_unknown) +- return status; +- + return connector_status_connected; + } + +@@ -498,117 +479,6 @@ static int intel_lvds_get_modes(struct drm_connector *connector) + return 1; + } + +-static int intel_no_modeset_on_lid_dmi_callback(const struct dmi_system_id *id) +-{ +- DRM_INFO("Skipping forced modeset for %s\n", id->ident); +- return 1; +-} +- +-/* The GPU hangs up on these systems if modeset is performed on LID open */ +-static const struct dmi_system_id intel_no_modeset_on_lid[] = { +- { +- .callback = intel_no_modeset_on_lid_dmi_callback, +- .ident = "Toshiba Tecra A11", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), +- DMI_MATCH(DMI_PRODUCT_NAME, "TECRA A11"), +- }, +- }, +- +- { } /* terminating entry */ +-}; +- +-/* +- * Lid events. Note the use of 'modeset': +- * - we set it to MODESET_ON_LID_OPEN on lid close, +- * and set it to MODESET_DONE on open +- * - we use it as a "only once" bit (ie we ignore +- * duplicate events where it was already properly set) +- * - the suspend/resume paths will set it to +- * MODESET_SUSPENDED and ignore the lid open event, +- * because they restore the mode ("lid open"). +- */ +-static int intel_lid_notify(struct notifier_block *nb, unsigned long val, +- void *unused) +-{ +- struct intel_lvds_connector *lvds_connector = +- container_of(nb, struct intel_lvds_connector, lid_notifier); +- struct drm_connector *connector = &lvds_connector->base.base; +- struct drm_device *dev = connector->dev; +- struct drm_i915_private *dev_priv = to_i915(dev); +- +- if (dev->switch_power_state != DRM_SWITCH_POWER_ON) +- return NOTIFY_OK; +- +- mutex_lock(&dev_priv->modeset_restore_lock); +- if (dev_priv->modeset_restore == MODESET_SUSPENDED) +- goto exit; +- /* +- * check and update the status of LVDS connector after receiving +- * the LID nofication event. +- */ +- connector->status = connector->funcs->detect(connector, false); +- +- /* Don't force modeset on machines where it causes a GPU lockup */ +- if (dmi_check_system(intel_no_modeset_on_lid)) +- goto exit; +- if (!acpi_lid_open()) { +- /* do modeset on next lid open event */ +- dev_priv->modeset_restore = MODESET_ON_LID_OPEN; +- goto exit; +- } +- +- if (dev_priv->modeset_restore == MODESET_DONE) +- goto exit; +- +- /* +- * Some old platform's BIOS love to wreak havoc while the lid is closed. +- * We try to detect this here and undo any damage. The split for PCH +- * platforms is rather conservative and a bit arbitrary expect that on +- * those platforms VGA disabling requires actual legacy VGA I/O access, +- * and as part of the cleanup in the hw state restore we also redisable +- * the vga plane. +- */ +- if (!HAS_PCH_SPLIT(dev_priv)) +- intel_display_resume(dev); +- +- dev_priv->modeset_restore = MODESET_DONE; +- +-exit: +- mutex_unlock(&dev_priv->modeset_restore_lock); +- return NOTIFY_OK; +-} +- +-static int +-intel_lvds_connector_register(struct drm_connector *connector) +-{ +- struct intel_lvds_connector *lvds = to_lvds_connector(connector); +- int ret; +- +- ret = intel_connector_register(connector); +- if (ret) +- return ret; +- +- lvds->lid_notifier.notifier_call = intel_lid_notify; +- if (acpi_lid_notifier_register(&lvds->lid_notifier)) { +- DRM_DEBUG_KMS("lid notifier registration failed\n"); +- lvds->lid_notifier.notifier_call = NULL; +- } +- +- return 0; +-} +- +-static void +-intel_lvds_connector_unregister(struct drm_connector *connector) +-{ +- struct intel_lvds_connector *lvds = to_lvds_connector(connector); +- +- if (lvds->lid_notifier.notifier_call) +- acpi_lid_notifier_unregister(&lvds->lid_notifier); +- +- intel_connector_unregister(connector); +-} +- + /** + * intel_lvds_destroy - unregister and free LVDS structures + * @connector: connector to free +@@ -641,8 +511,8 @@ static const struct drm_connector_funcs intel_lvds_connector_funcs = { + .fill_modes = drm_helper_probe_single_connector_modes, + .atomic_get_property = intel_digital_connector_atomic_get_property, + .atomic_set_property = intel_digital_connector_atomic_set_property, +- .late_register = intel_lvds_connector_register, +- .early_unregister = intel_lvds_connector_unregister, ++ .late_register = intel_connector_register, ++ .early_unregister = intel_connector_unregister, + .destroy = intel_lvds_destroy, + .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, + .atomic_duplicate_state = intel_digital_connector_duplicate_state, +@@ -1108,8 +978,6 @@ void intel_lvds_init(struct drm_i915_private *dev_priv) + * 2) check for VBT data + * 3) check to see if LVDS is already on + * if none of the above, no panel +- * 4) make sure lid is open +- * if closed, act like it's not there for now + */ + + /* +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index 2121345a61af..78ce3d232c4d 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -486,6 +486,31 @@ static void vop_line_flag_irq_disable(struct vop *vop) + spin_unlock_irqrestore(&vop->irq_lock, flags); + } + ++static int vop_core_clks_enable(struct vop *vop) ++{ ++ int ret; ++ ++ ret = clk_enable(vop->hclk); ++ if (ret < 0) ++ return ret; ++ ++ ret = clk_enable(vop->aclk); ++ if (ret < 0) ++ goto err_disable_hclk; ++ ++ return 0; ++ ++err_disable_hclk: ++ clk_disable(vop->hclk); ++ return ret; ++} ++ ++static void vop_core_clks_disable(struct vop *vop) ++{ ++ clk_disable(vop->aclk); ++ clk_disable(vop->hclk); ++} ++ + static int vop_enable(struct drm_crtc *crtc) + { + struct vop *vop = to_vop(crtc); +@@ -497,17 +522,13 @@ static int vop_enable(struct drm_crtc *crtc) + return ret; + } + +- ret = clk_enable(vop->hclk); ++ ret = vop_core_clks_enable(vop); + if (WARN_ON(ret < 0)) + goto err_put_pm_runtime; + + ret = clk_enable(vop->dclk); + if (WARN_ON(ret < 0)) +- goto err_disable_hclk; +- +- ret = clk_enable(vop->aclk); +- if (WARN_ON(ret < 0)) +- goto err_disable_dclk; ++ goto err_disable_core; + + /* + * Slave iommu shares power, irq and clock with vop. It was associated +@@ -519,7 +540,7 @@ static int vop_enable(struct drm_crtc *crtc) + if (ret) { + DRM_DEV_ERROR(vop->dev, + "failed to attach dma mapping, %d\n", ret); +- goto err_disable_aclk; ++ goto err_disable_dclk; + } + + spin_lock(&vop->reg_lock); +@@ -552,18 +573,14 @@ static int vop_enable(struct drm_crtc *crtc) + + spin_unlock(&vop->reg_lock); + +- enable_irq(vop->irq); +- + drm_crtc_vblank_on(crtc); + + return 0; + +-err_disable_aclk: +- clk_disable(vop->aclk); + err_disable_dclk: + clk_disable(vop->dclk); +-err_disable_hclk: +- clk_disable(vop->hclk); ++err_disable_core: ++ vop_core_clks_disable(vop); + err_put_pm_runtime: + pm_runtime_put_sync(vop->dev); + return ret; +@@ -599,8 +616,6 @@ static void vop_crtc_atomic_disable(struct drm_crtc *crtc, + + vop_dsp_hold_valid_irq_disable(vop); + +- disable_irq(vop->irq); +- + vop->is_enabled = false; + + /* +@@ -609,8 +624,7 @@ static void vop_crtc_atomic_disable(struct drm_crtc *crtc, + rockchip_drm_dma_detach_device(vop->drm_dev, vop->dev); + + clk_disable(vop->dclk); +- clk_disable(vop->aclk); +- clk_disable(vop->hclk); ++ vop_core_clks_disable(vop); + pm_runtime_put(vop->dev); + mutex_unlock(&vop->vop_lock); + +@@ -1177,6 +1191,18 @@ static irqreturn_t vop_isr(int irq, void *data) + uint32_t active_irqs; + int ret = IRQ_NONE; + ++ /* ++ * The irq is shared with the iommu. If the runtime-pm state of the ++ * vop-device is disabled the irq has to be targeted at the iommu. ++ */ ++ if (!pm_runtime_get_if_in_use(vop->dev)) ++ return IRQ_NONE; ++ ++ if (vop_core_clks_enable(vop)) { ++ DRM_DEV_ERROR_RATELIMITED(vop->dev, "couldn't enable clocks\n"); ++ goto out; ++ } ++ + /* + * interrupt register has interrupt status, enable and clear bits, we + * must hold irq_lock to avoid a race with enable/disable_vblank(). +@@ -1192,7 +1218,7 @@ static irqreturn_t vop_isr(int irq, void *data) + + /* This is expected for vop iommu irqs, since the irq is shared */ + if (!active_irqs) +- return IRQ_NONE; ++ goto out_disable; + + if (active_irqs & DSP_HOLD_VALID_INTR) { + complete(&vop->dsp_hold_completion); +@@ -1218,6 +1244,10 @@ static irqreturn_t vop_isr(int irq, void *data) + DRM_DEV_ERROR(vop->dev, "Unknown VOP IRQs: %#02x\n", + active_irqs); + ++out_disable: ++ vop_core_clks_disable(vop); ++out: ++ pm_runtime_put(vop->dev); + return ret; + } + +@@ -1596,9 +1626,6 @@ static int vop_bind(struct device *dev, struct device *master, void *data) + if (ret) + goto err_disable_pm_runtime; + +- /* IRQ is initially disabled; it gets enabled in power_on */ +- disable_irq(vop->irq); +- + return 0; + + err_disable_pm_runtime: +diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c +index e67f4ea28c0e..051b8be3dc0f 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_lvds.c ++++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c +@@ -363,8 +363,10 @@ static int rockchip_lvds_bind(struct device *dev, struct device *master, + of_property_read_u32(endpoint, "reg", &endpoint_id); + ret = drm_of_find_panel_or_bridge(dev->of_node, 1, endpoint_id, + &lvds->panel, &lvds->bridge); +- if (!ret) ++ if (!ret) { ++ of_node_put(endpoint); + break; ++ } + } + if (!child_count) { + DRM_DEV_ERROR(dev, "lvds port does not have any children\n"); +diff --git a/drivers/hid/hid-redragon.c b/drivers/hid/hid-redragon.c +index daf59578bf93..73c9d4c4fa34 100644 +--- a/drivers/hid/hid-redragon.c ++++ b/drivers/hid/hid-redragon.c +@@ -44,29 +44,6 @@ static __u8 *redragon_report_fixup(struct hid_device *hdev, __u8 *rdesc, + return rdesc; + } + +-static int redragon_probe(struct hid_device *dev, +- const struct hid_device_id *id) +-{ +- int ret; +- +- ret = hid_parse(dev); +- if (ret) { +- hid_err(dev, "parse failed\n"); +- return ret; +- } +- +- /* do not register unused input device */ +- if (dev->maxapplication == 1) +- return 0; +- +- ret = hid_hw_start(dev, HID_CONNECT_DEFAULT); +- if (ret) { +- hid_err(dev, "hw start failed\n"); +- return ret; +- } +- +- return 0; +-} + static const struct hid_device_id redragon_devices[] = { + {HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_REDRAGON_ASURA)}, + {} +@@ -77,8 +54,7 @@ MODULE_DEVICE_TABLE(hid, redragon_devices); + static struct hid_driver redragon_driver = { + .name = "redragon", + .id_table = redragon_devices, +- .report_fixup = redragon_report_fixup, +- .probe = redragon_probe ++ .report_fixup = redragon_report_fixup + }; + + module_hid_driver(redragon_driver); +diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c +index b8f303dea305..32affd3fa8bd 100644 +--- a/drivers/i2c/i2c-core-acpi.c ++++ b/drivers/i2c/i2c-core-acpi.c +@@ -453,8 +453,12 @@ static int acpi_gsb_i2c_read_bytes(struct i2c_client *client, + else + dev_err(&client->adapter->dev, "i2c read %d bytes from client@%#x starting at reg %#x failed, error: %d\n", + data_len, client->addr, cmd, ret); +- } else { ++ /* 2 transfers must have completed successfully */ ++ } else if (ret == 2) { + memcpy(data, buffer, data_len); ++ ret = 0; ++ } else { ++ ret = -EIO; + } + + kfree(buffer); +@@ -595,8 +599,6 @@ i2c_acpi_space_handler(u32 function, acpi_physical_address command, + if (action == ACPI_READ) { + status = acpi_gsb_i2c_read_bytes(client, command, + gsb->data, info->access_length); +- if (status > 0) +- status = 0; + } else { + status = acpi_gsb_i2c_write_bytes(client, command, + gsb->data, info->access_length); +diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c +index fbe7198a715a..bedd5fba33b0 100644 +--- a/drivers/infiniband/hw/hfi1/affinity.c ++++ b/drivers/infiniband/hw/hfi1/affinity.c +@@ -198,7 +198,7 @@ int node_affinity_init(void) + while ((dev = pci_get_device(ids->vendor, ids->device, dev))) { + node = pcibus_to_node(dev->bus); + if (node < 0) +- node = numa_node_id(); ++ goto out; + + hfi1_per_node_cntr[node]++; + } +@@ -206,6 +206,18 @@ int node_affinity_init(void) + } + + return 0; ++ ++out: ++ /* ++ * Invalid PCI NUMA node information found, note it, and populate ++ * our database 1:1. ++ */ ++ pr_err("HFI: Invalid PCI NUMA node. Performance may be affected\n"); ++ pr_err("HFI: System BIOS may need to be upgraded\n"); ++ for (node = 0; node < node_affinity.num_possible_nodes; node++) ++ hfi1_per_node_cntr[node] = 1; ++ ++ return 0; + } + + static void node_affinity_destroy(struct hfi1_affinity_node *entry) +@@ -622,8 +634,14 @@ int hfi1_dev_affinity_init(struct hfi1_devdata *dd) + int curr_cpu, possible, i, ret; + bool new_entry = false; + +- if (node < 0) +- node = numa_node_id(); ++ /* ++ * If the BIOS does not have the NUMA node information set, select ++ * NUMA 0 so we get consistent performance. ++ */ ++ if (node < 0) { ++ dd_dev_err(dd, "Invalid PCI NUMA node. Performance may be affected\n"); ++ node = 0; ++ } + dd->node = node; + + local_mask = cpumask_of_node(dd->node); +diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c +index b9f2c871ff9a..e11c149da04d 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_pd.c ++++ b/drivers/infiniband/hw/hns/hns_roce_pd.c +@@ -37,7 +37,7 @@ + + static int hns_roce_pd_alloc(struct hns_roce_dev *hr_dev, unsigned long *pdn) + { +- return hns_roce_bitmap_alloc(&hr_dev->pd_bitmap, pdn); ++ return hns_roce_bitmap_alloc(&hr_dev->pd_bitmap, pdn) ? -ENOMEM : 0; + } + + static void hns_roce_pd_free(struct hns_roce_dev *hr_dev, unsigned long pdn) +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index baaf906f7c2e..97664570c5ac 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -115,7 +115,10 @@ static int hns_roce_reserve_range_qp(struct hns_roce_dev *hr_dev, int cnt, + { + struct hns_roce_qp_table *qp_table = &hr_dev->qp_table; + +- return hns_roce_bitmap_alloc_range(&qp_table->bitmap, cnt, align, base); ++ return hns_roce_bitmap_alloc_range(&qp_table->bitmap, cnt, align, ++ base) ? ++ -ENOMEM : ++ 0; + } + + enum hns_roce_qp_state to_hns_roce_state(enum ib_qp_state state) +diff --git a/drivers/input/input.c b/drivers/input/input.c +index 6365c1958264..3304aaaffe87 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -480,11 +480,19 @@ EXPORT_SYMBOL(input_inject_event); + */ + void input_alloc_absinfo(struct input_dev *dev) + { +- if (!dev->absinfo) +- dev->absinfo = kcalloc(ABS_CNT, sizeof(*dev->absinfo), +- GFP_KERNEL); ++ if (dev->absinfo) ++ return; + +- WARN(!dev->absinfo, "%s(): kcalloc() failed?\n", __func__); ++ dev->absinfo = kcalloc(ABS_CNT, sizeof(*dev->absinfo), GFP_KERNEL); ++ if (!dev->absinfo) { ++ dev_err(dev->dev.parent ?: &dev->dev, ++ "%s: unable to allocate memory\n", __func__); ++ /* ++ * We will handle this allocation failure in ++ * input_register_device() when we refuse to register input ++ * device with ABS bits but without absinfo. ++ */ ++ } + } + EXPORT_SYMBOL(input_alloc_absinfo); + +diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c +index af4a8e7fcd27..3b05117118c3 100644 +--- a/drivers/iommu/omap-iommu.c ++++ b/drivers/iommu/omap-iommu.c +@@ -550,7 +550,7 @@ static u32 *iopte_alloc(struct omap_iommu *obj, u32 *iopgd, + + pte_ready: + iopte = iopte_offset(iopgd, da); +- *pt_dma = virt_to_phys(iopte); ++ *pt_dma = iopgd_page_paddr(iopgd); + dev_vdbg(obj->dev, + "%s: da:%08x pgd:%p *pgd:%08x pte:%p *pte:%08x\n", + __func__, da, iopgd, *iopgd, iopte, *iopte); +@@ -738,7 +738,7 @@ static size_t iopgtable_clear_entry_core(struct omap_iommu *obj, u32 da) + } + bytes *= nent; + memset(iopte, 0, nent * sizeof(*iopte)); +- pt_dma = virt_to_phys(iopte); ++ pt_dma = iopgd_page_paddr(iopgd); + flush_iopte_range(obj->dev, pt_dma, pt_offset, nent); + + /* +diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c +index 054cd2c8e9c8..2b1724e8d307 100644 +--- a/drivers/iommu/rockchip-iommu.c ++++ b/drivers/iommu/rockchip-iommu.c +@@ -521,10 +521,11 @@ static irqreturn_t rk_iommu_irq(int irq, void *dev_id) + u32 int_status; + dma_addr_t iova; + irqreturn_t ret = IRQ_NONE; +- int i; ++ int i, err; + +- if (WARN_ON(!pm_runtime_get_if_in_use(iommu->dev))) +- return 0; ++ err = pm_runtime_get_if_in_use(iommu->dev); ++ if (WARN_ON_ONCE(err <= 0)) ++ return ret; + + if (WARN_ON(clk_bulk_enable(iommu->num_clocks, iommu->clocks))) + goto out; +@@ -620,11 +621,15 @@ static void rk_iommu_zap_iova(struct rk_iommu_domain *rk_domain, + spin_lock_irqsave(&rk_domain->iommus_lock, flags); + list_for_each(pos, &rk_domain->iommus) { + struct rk_iommu *iommu; ++ int ret; + + iommu = list_entry(pos, struct rk_iommu, node); + + /* Only zap TLBs of IOMMUs that are powered on. */ +- if (pm_runtime_get_if_in_use(iommu->dev)) { ++ ret = pm_runtime_get_if_in_use(iommu->dev); ++ if (WARN_ON_ONCE(ret < 0)) ++ continue; ++ if (ret) { + WARN_ON(clk_bulk_enable(iommu->num_clocks, + iommu->clocks)); + rk_iommu_zap_lines(iommu, iova, size); +@@ -891,6 +896,7 @@ static void rk_iommu_detach_device(struct iommu_domain *domain, + struct rk_iommu *iommu; + struct rk_iommu_domain *rk_domain = to_rk_domain(domain); + unsigned long flags; ++ int ret; + + /* Allow 'virtual devices' (eg drm) to detach from domain */ + iommu = rk_iommu_from_dev(dev); +@@ -909,7 +915,9 @@ static void rk_iommu_detach_device(struct iommu_domain *domain, + list_del_init(&iommu->node); + spin_unlock_irqrestore(&rk_domain->iommus_lock, flags); + +- if (pm_runtime_get_if_in_use(iommu->dev)) { ++ ret = pm_runtime_get_if_in_use(iommu->dev); ++ WARN_ON_ONCE(ret < 0); ++ if (ret > 0) { + rk_iommu_disable(iommu); + pm_runtime_put(iommu->dev); + } +@@ -946,7 +954,8 @@ static int rk_iommu_attach_device(struct iommu_domain *domain, + list_add_tail(&iommu->node, &rk_domain->iommus); + spin_unlock_irqrestore(&rk_domain->iommus_lock, flags); + +- if (!pm_runtime_get_if_in_use(iommu->dev)) ++ ret = pm_runtime_get_if_in_use(iommu->dev); ++ if (!ret || WARN_ON_ONCE(ret < 0)) + return 0; + + ret = rk_iommu_enable(iommu); +@@ -1152,17 +1161,6 @@ static int rk_iommu_probe(struct platform_device *pdev) + if (iommu->num_mmu == 0) + return PTR_ERR(iommu->bases[0]); + +- i = 0; +- while ((irq = platform_get_irq(pdev, i++)) != -ENXIO) { +- if (irq < 0) +- return irq; +- +- err = devm_request_irq(iommu->dev, irq, rk_iommu_irq, +- IRQF_SHARED, dev_name(dev), iommu); +- if (err) +- return err; +- } +- + iommu->reset_disabled = device_property_read_bool(dev, + "rockchip,disable-mmu-reset"); + +@@ -1219,6 +1217,19 @@ static int rk_iommu_probe(struct platform_device *pdev) + + pm_runtime_enable(dev); + ++ i = 0; ++ while ((irq = platform_get_irq(pdev, i++)) != -ENXIO) { ++ if (irq < 0) ++ return irq; ++ ++ err = devm_request_irq(iommu->dev, irq, rk_iommu_irq, ++ IRQF_SHARED, dev_name(dev), iommu); ++ if (err) { ++ pm_runtime_disable(dev); ++ goto err_remove_sysfs; ++ } ++ } ++ + return 0; + err_remove_sysfs: + iommu_device_sysfs_remove(&iommu->iommu); +diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c +index faf734ff4cf3..0f6e30e9009d 100644 +--- a/drivers/irqchip/irq-bcm7038-l1.c ++++ b/drivers/irqchip/irq-bcm7038-l1.c +@@ -217,6 +217,7 @@ static int bcm7038_l1_set_affinity(struct irq_data *d, + return 0; + } + ++#ifdef CONFIG_SMP + static void bcm7038_l1_cpu_offline(struct irq_data *d) + { + struct cpumask *mask = irq_data_get_affinity_mask(d); +@@ -241,6 +242,7 @@ static void bcm7038_l1_cpu_offline(struct irq_data *d) + } + irq_set_affinity_locked(d, &new_affinity, false); + } ++#endif + + static int __init bcm7038_l1_init_one(struct device_node *dn, + unsigned int idx, +@@ -293,7 +295,9 @@ static struct irq_chip bcm7038_l1_irq_chip = { + .irq_mask = bcm7038_l1_mask, + .irq_unmask = bcm7038_l1_unmask, + .irq_set_affinity = bcm7038_l1_set_affinity, ++#ifdef CONFIG_SMP + .irq_cpu_offline = bcm7038_l1_cpu_offline, ++#endif + }; + + static int bcm7038_l1_map(struct irq_domain *d, unsigned int virq, +diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c +index 3a7e8905a97e..880e48947576 100644 +--- a/drivers/irqchip/irq-stm32-exti.c ++++ b/drivers/irqchip/irq-stm32-exti.c +@@ -602,17 +602,24 @@ stm32_exti_host_data *stm32_exti_host_init(const struct stm32_exti_drv_data *dd, + sizeof(struct stm32_exti_chip_data), + GFP_KERNEL); + if (!host_data->chips_data) +- return NULL; ++ goto free_host_data; + + host_data->base = of_iomap(node, 0); + if (!host_data->base) { + pr_err("%pOF: Unable to map registers\n", node); +- return NULL; ++ goto free_chips_data; + } + + stm32_host_data = host_data; + + return host_data; ++ ++free_chips_data: ++ kfree(host_data->chips_data); ++free_host_data: ++ kfree(host_data); ++ ++ return NULL; + } + + static struct +@@ -664,10 +671,8 @@ static int __init stm32_exti_init(const struct stm32_exti_drv_data *drv_data, + struct irq_domain *domain; + + host_data = stm32_exti_host_init(drv_data, node); +- if (!host_data) { +- ret = -ENOMEM; +- goto out_free_mem; +- } ++ if (!host_data) ++ return -ENOMEM; + + domain = irq_domain_add_linear(node, drv_data->bank_nr * IRQS_PER_BANK, + &irq_exti_domain_ops, NULL); +@@ -724,7 +729,6 @@ out_free_domain: + irq_domain_remove(domain); + out_unmap: + iounmap(host_data->base); +-out_free_mem: + kfree(host_data->chips_data); + kfree(host_data); + return ret; +@@ -751,10 +755,8 @@ __init stm32_exti_hierarchy_init(const struct stm32_exti_drv_data *drv_data, + } + + host_data = stm32_exti_host_init(drv_data, node); +- if (!host_data) { +- ret = -ENOMEM; +- goto out_free_mem; +- } ++ if (!host_data) ++ return -ENOMEM; + + for (i = 0; i < drv_data->bank_nr; i++) + stm32_exti_chip_init(host_data, i, node); +@@ -776,7 +778,6 @@ __init stm32_exti_hierarchy_init(const struct stm32_exti_drv_data *drv_data, + + out_unmap: + iounmap(host_data->base); +-out_free_mem: + kfree(host_data->chips_data); + kfree(host_data); + return ret; +diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c +index 3c7547a3c371..d7b9cdafd1c3 100644 +--- a/drivers/md/dm-kcopyd.c ++++ b/drivers/md/dm-kcopyd.c +@@ -487,6 +487,8 @@ static int run_complete_job(struct kcopyd_job *job) + if (atomic_dec_and_test(&kc->nr_jobs)) + wake_up(&kc->destroyq); + ++ cond_resched(); ++ + return 0; + } + +diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c +index 2a87b0d2f21f..a530972c5a7e 100644 +--- a/drivers/mfd/sm501.c ++++ b/drivers/mfd/sm501.c +@@ -715,6 +715,7 @@ sm501_create_subdev(struct sm501_devdata *sm, char *name, + smdev->pdev.name = name; + smdev->pdev.id = sm->pdev_id; + smdev->pdev.dev.parent = sm->dev; ++ smdev->pdev.dev.coherent_dma_mask = 0xffffffff; + + if (res_count) { + smdev->pdev.resource = (struct resource *)(smdev+1); +diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c +index 94d7a865b135..7504f430c011 100644 +--- a/drivers/mtd/ubi/vtbl.c ++++ b/drivers/mtd/ubi/vtbl.c +@@ -578,6 +578,16 @@ static int init_volumes(struct ubi_device *ubi, + vol->ubi = ubi; + reserved_pebs += vol->reserved_pebs; + ++ /* ++ * We use ubi->peb_count and not vol->reserved_pebs because ++ * we want to keep the code simple. Otherwise we'd have to ++ * resize/check the bitmap upon volume resize too. ++ * Allocating a few bytes more does not hurt. ++ */ ++ err = ubi_fastmap_init_checkmap(vol, ubi->peb_count); ++ if (err) ++ return err; ++ + /* + * In case of dynamic volume UBI knows nothing about how many + * data is stored there. So assume the whole volume is used. +@@ -620,16 +630,6 @@ static int init_volumes(struct ubi_device *ubi, + (long long)(vol->used_ebs - 1) * vol->usable_leb_size; + vol->used_bytes += av->last_data_size; + vol->last_eb_bytes = av->last_data_size; +- +- /* +- * We use ubi->peb_count and not vol->reserved_pebs because +- * we want to keep the code simple. Otherwise we'd have to +- * resize/check the bitmap upon volume resize too. +- * Allocating a few bytes more does not hurt. +- */ +- err = ubi_fastmap_init_checkmap(vol, ubi->peb_count); +- if (err) +- return err; + } + + /* And add the layout volume */ +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 4394c1162be4..4fdf3d33aa59 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -5907,12 +5907,12 @@ unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp) + return bp->hw_resc.max_cp_rings; + } + +-void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max) ++unsigned int bnxt_get_max_func_cp_rings_for_en(struct bnxt *bp) + { +- bp->hw_resc.max_cp_rings = max; ++ return bp->hw_resc.max_cp_rings - bnxt_get_ulp_msix_num(bp); + } + +-unsigned int bnxt_get_max_func_irqs(struct bnxt *bp) ++static unsigned int bnxt_get_max_func_irqs(struct bnxt *bp) + { + struct bnxt_hw_resc *hw_resc = &bp->hw_resc; + +@@ -8492,7 +8492,8 @@ static void _bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx, + + *max_tx = hw_resc->max_tx_rings; + *max_rx = hw_resc->max_rx_rings; +- *max_cp = min_t(int, hw_resc->max_irqs, hw_resc->max_cp_rings); ++ *max_cp = min_t(int, bnxt_get_max_func_cp_rings_for_en(bp), ++ hw_resc->max_irqs); + *max_cp = min_t(int, *max_cp, hw_resc->max_stat_ctxs); + max_ring_grps = hw_resc->max_hw_ring_grps; + if (BNXT_CHIP_TYPE_NITRO_A0(bp) && BNXT_PF(bp)) { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 91575ef97c8c..ea1246a94b38 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1468,8 +1468,7 @@ int bnxt_hwrm_set_coal(struct bnxt *); + unsigned int bnxt_get_max_func_stat_ctxs(struct bnxt *bp); + void bnxt_set_max_func_stat_ctxs(struct bnxt *bp, unsigned int max); + unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp); +-void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max); +-unsigned int bnxt_get_max_func_irqs(struct bnxt *bp); ++unsigned int bnxt_get_max_func_cp_rings_for_en(struct bnxt *bp); + int bnxt_get_avail_msix(struct bnxt *bp, int num); + int bnxt_reserve_rings(struct bnxt *bp); + void bnxt_tx_disable(struct bnxt *bp); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +index a64910892c25..2c77004a022b 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -451,7 +451,7 @@ static int bnxt_hwrm_func_vf_resc_cfg(struct bnxt *bp, int num_vfs) + + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_VF_RESOURCE_CFG, -1, -1); + +- vf_cp_rings = hw_resc->max_cp_rings - bp->cp_nr_rings; ++ vf_cp_rings = bnxt_get_max_func_cp_rings_for_en(bp) - bp->cp_nr_rings; + vf_stat_ctx = hw_resc->max_stat_ctxs - bp->num_stat_ctxs; + if (bp->flags & BNXT_FLAG_AGG_RINGS) + vf_rx_rings = hw_resc->max_rx_rings - bp->rx_nr_rings * 2; +@@ -544,7 +544,8 @@ static int bnxt_hwrm_func_cfg(struct bnxt *bp, int num_vfs) + max_stat_ctxs = hw_resc->max_stat_ctxs; + + /* Remaining rings are distributed equally amongs VF's for now */ +- vf_cp_rings = (hw_resc->max_cp_rings - bp->cp_nr_rings) / num_vfs; ++ vf_cp_rings = (bnxt_get_max_func_cp_rings_for_en(bp) - ++ bp->cp_nr_rings) / num_vfs; + vf_stat_ctx = (max_stat_ctxs - bp->num_stat_ctxs) / num_vfs; + if (bp->flags & BNXT_FLAG_AGG_RINGS) + vf_rx_rings = (hw_resc->max_rx_rings - bp->rx_nr_rings * 2) / +@@ -638,7 +639,7 @@ static int bnxt_sriov_enable(struct bnxt *bp, int *num_vfs) + */ + vfs_supported = *num_vfs; + +- avail_cp = hw_resc->max_cp_rings - bp->cp_nr_rings; ++ avail_cp = bnxt_get_max_func_cp_rings_for_en(bp) - bp->cp_nr_rings; + avail_stat = hw_resc->max_stat_ctxs - bp->num_stat_ctxs; + avail_cp = min_t(int, avail_cp, avail_stat); + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +index 840f6e505f73..4209cfd73971 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id, + edev->ulp_tbl[ulp_id].msix_requested = avail_msix; + } + bnxt_fill_msix_vecs(bp, ent); +- bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix); + edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED; + return avail_msix; + } +@@ -178,7 +177,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id) + { + struct net_device *dev = edev->net; + struct bnxt *bp = netdev_priv(dev); +- int max_cp_rings, msix_requested; + + ASSERT_RTNL(); + if (ulp_id != BNXT_ROCE_ULP) +@@ -187,9 +185,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id) + if (!(edev->flags & BNXT_EN_FLAG_MSIX_REQUESTED)) + return 0; + +- max_cp_rings = bnxt_get_max_func_cp_rings(bp); +- msix_requested = edev->ulp_tbl[ulp_id].msix_requested; +- bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested); + edev->ulp_tbl[ulp_id].msix_requested = 0; + edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED; + if (netif_running(dev)) { +@@ -220,21 +215,6 @@ int bnxt_get_ulp_msix_base(struct bnxt *bp) + return 0; + } + +-void bnxt_subtract_ulp_resources(struct bnxt *bp, int ulp_id) +-{ +- ASSERT_RTNL(); +- if (bnxt_ulp_registered(bp->edev, ulp_id)) { +- struct bnxt_en_dev *edev = bp->edev; +- unsigned int msix_req, max; +- +- msix_req = edev->ulp_tbl[ulp_id].msix_requested; +- max = bnxt_get_max_func_cp_rings(bp); +- bnxt_set_max_func_cp_rings(bp, max - msix_req); +- max = bnxt_get_max_func_stat_ctxs(bp); +- bnxt_set_max_func_stat_ctxs(bp, max - 1); +- } +-} +- + static int bnxt_send_msg(struct bnxt_en_dev *edev, int ulp_id, + struct bnxt_fw_msg *fw_msg) + { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h +index df48ac71729f..d9bea37cd211 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h +@@ -90,7 +90,6 @@ static inline bool bnxt_ulp_registered(struct bnxt_en_dev *edev, int ulp_id) + + int bnxt_get_ulp_msix_num(struct bnxt *bp); + int bnxt_get_ulp_msix_base(struct bnxt *bp); +-void bnxt_subtract_ulp_resources(struct bnxt *bp, int ulp_id); + void bnxt_ulp_stop(struct bnxt *bp); + void bnxt_ulp_start(struct bnxt *bp); + void bnxt_ulp_sriov_cfg(struct bnxt *bp, int num_vfs); +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +index b773bc07edf7..14b49612aa86 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +@@ -186,6 +186,9 @@ struct bcmgenet_mib_counters { + #define UMAC_MAC1 0x010 + #define UMAC_MAX_FRAME_LEN 0x014 + ++#define UMAC_MODE 0x44 ++#define MODE_LINK_STATUS (1 << 5) ++ + #define UMAC_EEE_CTRL 0x064 + #define EN_LPI_RX_PAUSE (1 << 0) + #define EN_LPI_TX_PFC (1 << 1) +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index 5333274a283c..4241ae928d4a 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -115,8 +115,14 @@ void bcmgenet_mii_setup(struct net_device *dev) + static int bcmgenet_fixed_phy_link_update(struct net_device *dev, + struct fixed_phy_status *status) + { +- if (dev && dev->phydev && status) +- status->link = dev->phydev->link; ++ struct bcmgenet_priv *priv; ++ u32 reg; ++ ++ if (dev && dev->phydev && status) { ++ priv = netdev_priv(dev); ++ reg = bcmgenet_umac_readl(priv, UMAC_MODE); ++ status->link = !!(reg & MODE_LINK_STATUS); ++ } + + return 0; + } +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index a6c911bb5ce2..515d96e32143 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -481,11 +481,6 @@ static int macb_mii_probe(struct net_device *dev) + + if (np) { + if (of_phy_is_fixed_link(np)) { +- if (of_phy_register_fixed_link(np) < 0) { +- dev_err(&bp->pdev->dev, +- "broken fixed-link specification\n"); +- return -ENODEV; +- } + bp->phy_node = of_node_get(np); + } else { + bp->phy_node = of_parse_phandle(np, "phy-handle", 0); +@@ -568,7 +563,7 @@ static int macb_mii_init(struct macb *bp) + { + struct macb_platform_data *pdata; + struct device_node *np; +- int err; ++ int err = -ENXIO; + + /* Enable management port */ + macb_writel(bp, NCR, MACB_BIT(MPE)); +@@ -591,12 +586,23 @@ static int macb_mii_init(struct macb *bp) + dev_set_drvdata(&bp->dev->dev, bp->mii_bus); + + np = bp->pdev->dev.of_node; +- if (pdata) +- bp->mii_bus->phy_mask = pdata->phy_mask; ++ if (np && of_phy_is_fixed_link(np)) { ++ if (of_phy_register_fixed_link(np) < 0) { ++ dev_err(&bp->pdev->dev, ++ "broken fixed-link specification %pOF\n", np); ++ goto err_out_free_mdiobus; ++ } ++ ++ err = mdiobus_register(bp->mii_bus); ++ } else { ++ if (pdata) ++ bp->mii_bus->phy_mask = pdata->phy_mask; ++ ++ err = of_mdiobus_register(bp->mii_bus, np); ++ } + +- err = of_mdiobus_register(bp->mii_bus, np); + if (err) +- goto err_out_free_mdiobus; ++ goto err_out_free_fixed_link; + + err = macb_mii_probe(bp->dev); + if (err) +@@ -606,6 +612,7 @@ static int macb_mii_init(struct macb *bp) + + err_out_unregister_bus: + mdiobus_unregister(bp->mii_bus); ++err_out_free_fixed_link: + if (np && of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + err_out_free_mdiobus: +@@ -1957,14 +1964,17 @@ static void macb_reset_hw(struct macb *bp) + { + struct macb_queue *queue; + unsigned int q; ++ u32 ctrl = macb_readl(bp, NCR); + + /* Disable RX and TX (XXX: Should we halt the transmission + * more gracefully?) + */ +- macb_writel(bp, NCR, 0); ++ ctrl &= ~(MACB_BIT(RE) | MACB_BIT(TE)); + + /* Clear the stats registers (XXX: Update stats first?) */ +- macb_writel(bp, NCR, MACB_BIT(CLRSTAT)); ++ ctrl |= MACB_BIT(CLRSTAT); ++ ++ macb_writel(bp, NCR, ctrl); + + /* Clear all status flags */ + macb_writel(bp, TSR, -1); +@@ -2152,7 +2162,7 @@ static void macb_init_hw(struct macb *bp) + } + + /* Enable TX and RX */ +- macb_writel(bp, NCR, MACB_BIT(RE) | MACB_BIT(TE) | MACB_BIT(MPE)); ++ macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(RE) | MACB_BIT(TE)); + } + + /* The hash address register is 64 bits long and takes up two +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index d318d35e598f..6fd7ea8074b0 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3911,7 +3911,7 @@ static bool hclge_is_all_function_id_zero(struct hclge_desc *desc) + #define HCLGE_FUNC_NUMBER_PER_DESC 6 + int i, j; + +- for (i = 0; i < HCLGE_DESC_NUMBER; i++) ++ for (i = 1; i < HCLGE_DESC_NUMBER; i++) + for (j = 0; j < HCLGE_FUNC_NUMBER_PER_DESC; j++) + if (desc[i].data[j]) + return false; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c +index 9f7932e423b5..6315e8ad8467 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c +@@ -208,6 +208,8 @@ int hclge_mac_start_phy(struct hclge_dev *hdev) + if (!phydev) + return 0; + ++ phydev->supported &= ~SUPPORTED_FIBRE; ++ + ret = phy_connect_direct(netdev, phydev, + hclge_mac_adjust_link, + PHY_INTERFACE_MODE_SGMII); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c +index 86478a6b99c5..c8c315eb5128 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c +@@ -139,14 +139,15 @@ int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param, + struct mlx5_wq_ctrl *wq_ctrl) + { + u32 sq_strides_offset; ++ u32 rq_pg_remainder; + int err; + + mlx5_fill_fbc(MLX5_GET(qpc, qpc, log_rq_stride) + 4, + MLX5_GET(qpc, qpc, log_rq_size), + &wq->rq.fbc); + +- sq_strides_offset = +- ((wq->rq.fbc.frag_sz_m1 + 1) % PAGE_SIZE) / MLX5_SEND_WQE_BB; ++ rq_pg_remainder = mlx5_wq_cyc_get_byte_size(&wq->rq) % PAGE_SIZE; ++ sq_strides_offset = rq_pg_remainder / MLX5_SEND_WQE_BB; + + mlx5_fill_fbc_offset(ilog2(MLX5_SEND_WQE_BB), + MLX5_GET(qpc, qpc, log_sq_size), +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +index 4a519d8edec8..3500c79e29cd 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +@@ -433,6 +433,8 @@ mlxsw_sp_netdevice_ipip_ul_event(struct mlxsw_sp *mlxsw_sp, + void + mlxsw_sp_port_vlan_router_leave(struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan); + void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif); ++void mlxsw_sp_rif_destroy_by_dev(struct mlxsw_sp *mlxsw_sp, ++ struct net_device *dev); + + /* spectrum_kvdl.c */ + int mlxsw_sp_kvdl_init(struct mlxsw_sp *mlxsw_sp); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 77b2adb29341..cb43d17097fa 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -6228,6 +6228,17 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif) + mlxsw_sp_vr_put(mlxsw_sp, vr); + } + ++void mlxsw_sp_rif_destroy_by_dev(struct mlxsw_sp *mlxsw_sp, ++ struct net_device *dev) ++{ ++ struct mlxsw_sp_rif *rif; ++ ++ rif = mlxsw_sp_rif_find_by_dev(mlxsw_sp, dev); ++ if (!rif) ++ return; ++ mlxsw_sp_rif_destroy(rif); ++} ++ + static void + mlxsw_sp_rif_subport_params_init(struct mlxsw_sp_rif_params *params, + struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan) +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index eea5666a86b2..6cb43dda8232 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -160,6 +160,24 @@ bool mlxsw_sp_bridge_device_is_offloaded(const struct mlxsw_sp *mlxsw_sp, + return !!mlxsw_sp_bridge_device_find(mlxsw_sp->bridge, br_dev); + } + ++static int mlxsw_sp_bridge_device_upper_rif_destroy(struct net_device *dev, ++ void *data) ++{ ++ struct mlxsw_sp *mlxsw_sp = data; ++ ++ mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, dev); ++ return 0; ++} ++ ++static void mlxsw_sp_bridge_device_rifs_destroy(struct mlxsw_sp *mlxsw_sp, ++ struct net_device *dev) ++{ ++ mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, dev); ++ netdev_walk_all_upper_dev_rcu(dev, ++ mlxsw_sp_bridge_device_upper_rif_destroy, ++ mlxsw_sp); ++} ++ + static struct mlxsw_sp_bridge_device * + mlxsw_sp_bridge_device_create(struct mlxsw_sp_bridge *bridge, + struct net_device *br_dev) +@@ -198,6 +216,8 @@ static void + mlxsw_sp_bridge_device_destroy(struct mlxsw_sp_bridge *bridge, + struct mlxsw_sp_bridge_device *bridge_device) + { ++ mlxsw_sp_bridge_device_rifs_destroy(bridge->mlxsw_sp, ++ bridge_device->dev); + list_del(&bridge_device->list); + if (bridge_device->vlan_enabled) + bridge->vlan_enabled_exists = false; +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +index d4c27f849f9b..c2a9e64bc57b 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +@@ -227,29 +227,16 @@ done: + spin_unlock_bh(&nn->reconfig_lock); + } + +-/** +- * nfp_net_reconfig() - Reconfigure the firmware +- * @nn: NFP Net device to reconfigure +- * @update: The value for the update field in the BAR config +- * +- * Write the update word to the BAR and ping the reconfig queue. The +- * poll until the firmware has acknowledged the update by zeroing the +- * update word. +- * +- * Return: Negative errno on error, 0 on success +- */ +-int nfp_net_reconfig(struct nfp_net *nn, u32 update) ++static void nfp_net_reconfig_sync_enter(struct nfp_net *nn) + { + bool cancelled_timer = false; + u32 pre_posted_requests; +- int ret; + + spin_lock_bh(&nn->reconfig_lock); + + nn->reconfig_sync_present = true; + + if (nn->reconfig_timer_active) { +- del_timer(&nn->reconfig_timer); + nn->reconfig_timer_active = false; + cancelled_timer = true; + } +@@ -258,14 +245,43 @@ int nfp_net_reconfig(struct nfp_net *nn, u32 update) + + spin_unlock_bh(&nn->reconfig_lock); + +- if (cancelled_timer) ++ if (cancelled_timer) { ++ del_timer_sync(&nn->reconfig_timer); + nfp_net_reconfig_wait(nn, nn->reconfig_timer.expires); ++ } + + /* Run the posted reconfigs which were issued before we started */ + if (pre_posted_requests) { + nfp_net_reconfig_start(nn, pre_posted_requests); + nfp_net_reconfig_wait(nn, jiffies + HZ * NFP_NET_POLL_TIMEOUT); + } ++} ++ ++static void nfp_net_reconfig_wait_posted(struct nfp_net *nn) ++{ ++ nfp_net_reconfig_sync_enter(nn); ++ ++ spin_lock_bh(&nn->reconfig_lock); ++ nn->reconfig_sync_present = false; ++ spin_unlock_bh(&nn->reconfig_lock); ++} ++ ++/** ++ * nfp_net_reconfig() - Reconfigure the firmware ++ * @nn: NFP Net device to reconfigure ++ * @update: The value for the update field in the BAR config ++ * ++ * Write the update word to the BAR and ping the reconfig queue. The ++ * poll until the firmware has acknowledged the update by zeroing the ++ * update word. ++ * ++ * Return: Negative errno on error, 0 on success ++ */ ++int nfp_net_reconfig(struct nfp_net *nn, u32 update) ++{ ++ int ret; ++ ++ nfp_net_reconfig_sync_enter(nn); + + nfp_net_reconfig_start(nn, update); + ret = nfp_net_reconfig_wait(nn, jiffies + HZ * NFP_NET_POLL_TIMEOUT); +@@ -3609,6 +3625,7 @@ struct nfp_net *nfp_net_alloc(struct pci_dev *pdev, bool needs_netdev, + */ + void nfp_net_free(struct nfp_net *nn) + { ++ WARN_ON(timer_pending(&nn->reconfig_timer) || nn->reconfig_posted); + if (nn->dp.netdev) + free_netdev(nn->dp.netdev); + else +@@ -3893,4 +3910,5 @@ void nfp_net_clean(struct nfp_net *nn) + return; + + unregister_netdev(nn->dp.netdev); ++ nfp_net_reconfig_wait_posted(nn); + } +diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +index 353f1c129af1..059ba9429e51 100644 +--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c ++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +@@ -2384,26 +2384,20 @@ static int qlge_update_hw_vlan_features(struct net_device *ndev, + return status; + } + +-static netdev_features_t qlge_fix_features(struct net_device *ndev, +- netdev_features_t features) +-{ +- int err; +- +- /* Update the behavior of vlan accel in the adapter */ +- err = qlge_update_hw_vlan_features(ndev, features); +- if (err) +- return err; +- +- return features; +-} +- + static int qlge_set_features(struct net_device *ndev, + netdev_features_t features) + { + netdev_features_t changed = ndev->features ^ features; ++ int err; ++ ++ if (changed & NETIF_F_HW_VLAN_CTAG_RX) { ++ /* Update the behavior of vlan accel in the adapter */ ++ err = qlge_update_hw_vlan_features(ndev, features); ++ if (err) ++ return err; + +- if (changed & NETIF_F_HW_VLAN_CTAG_RX) + qlge_vlan_mode(ndev, features); ++ } + + return 0; + } +@@ -4719,7 +4713,6 @@ static const struct net_device_ops qlge_netdev_ops = { + .ndo_set_mac_address = qlge_set_mac_address, + .ndo_validate_addr = eth_validate_addr, + .ndo_tx_timeout = qlge_tx_timeout, +- .ndo_fix_features = qlge_fix_features, + .ndo_set_features = qlge_set_features, + .ndo_vlan_rx_add_vid = qlge_vlan_rx_add_vid, + .ndo_vlan_rx_kill_vid = qlge_vlan_rx_kill_vid, +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 9ceb34bac3a9..e5eb361b973c 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -303,6 +303,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = { + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8161), 0, 0, RTL_CFG_1 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8167), 0, 0, RTL_CFG_0 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_1 }, ++ { PCI_DEVICE(PCI_VENDOR_ID_NCUBE, 0x8168), 0, 0, RTL_CFG_1 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 }, + { PCI_VENDOR_ID_DLINK, 0x4300, + PCI_VENDOR_ID_DLINK, 0x4b10, 0, 0, RTL_CFG_1 }, +@@ -5038,7 +5039,7 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp) + rtl_hw_reset(tp); + } + +-static void rtl_set_rx_tx_config_registers(struct rtl8169_private *tp) ++static void rtl_set_tx_config_registers(struct rtl8169_private *tp) + { + /* Set DMA burst size and Interframe Gap Time */ + RTL_W32(tp, TxConfig, (TX_DMA_BURST << TxDMAShift) | +@@ -5149,12 +5150,14 @@ static void rtl_hw_start(struct rtl8169_private *tp) + + rtl_set_rx_max_size(tp); + rtl_set_rx_tx_desc_registers(tp); +- rtl_set_rx_tx_config_registers(tp); ++ rtl_set_tx_config_registers(tp); + RTL_W8(tp, Cfg9346, Cfg9346_Lock); + + /* Initially a 10 us delay. Turned it into a PCI commit. - FR */ + RTL_R8(tp, IntrMask); + RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb); ++ rtl_init_rxcfg(tp); ++ + rtl_set_rx_mode(tp->dev); + /* no early-rx interrupts */ + RTL_W16(tp, MultiIntr, RTL_R16(tp, MultiIntr) & 0xf000); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h +index 76649adf8fb0..c0a855b7ab3b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h +@@ -112,7 +112,6 @@ struct stmmac_priv { + u32 tx_count_frames; + u32 tx_coal_frames; + u32 tx_coal_timer; +- bool tx_timer_armed; + + int tx_coalesce; + int hwts_tx_en; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index ef6a8d39db2f..c579d98b9666 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -3126,16 +3126,13 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + * element in case of no SG. + */ + priv->tx_count_frames += nfrags + 1; +- if (likely(priv->tx_coal_frames > priv->tx_count_frames) && +- !priv->tx_timer_armed) { ++ if (likely(priv->tx_coal_frames > priv->tx_count_frames)) { + mod_timer(&priv->txtimer, + STMMAC_COAL_TIMER(priv->tx_coal_timer)); +- priv->tx_timer_armed = true; + } else { + priv->tx_count_frames = 0; + stmmac_set_tx_ic(priv, desc); + priv->xstats.tx_set_ic_bit++; +- priv->tx_timer_armed = false; + } + + skb_tx_timestamp(skb); +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index dd1d6e115145..6d74cde68163 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1939,12 +1940,16 @@ static int netvsc_register_vf(struct net_device *vf_netdev) + { + struct net_device *ndev; + struct net_device_context *net_device_ctx; ++ struct device *pdev = vf_netdev->dev.parent; + struct netvsc_device *netvsc_dev; + int ret; + + if (vf_netdev->addr_len != ETH_ALEN) + return NOTIFY_DONE; + ++ if (!pdev || !dev_is_pci(pdev) || dev_is_pf(pdev)) ++ return NOTIFY_DONE; ++ + /* + * We will use the MAC address to locate the synthetic interface to + * associate with the VF interface. If we don't find a matching +@@ -2101,6 +2106,16 @@ static int netvsc_probe(struct hv_device *dev, + + memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN); + ++ /* We must get rtnl lock before scheduling nvdev->subchan_work, ++ * otherwise netvsc_subchan_work() can get rtnl lock first and wait ++ * all subchannels to show up, but that may not happen because ++ * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer() ++ * -> ... -> device_add() -> ... -> __device_attach() can't get ++ * the device lock, so all the subchannels can't be processed -- ++ * finally netvsc_subchan_work() hangs for ever. ++ */ ++ rtnl_lock(); ++ + if (nvdev->num_chn > 1) + schedule_work(&nvdev->subchan_work); + +@@ -2119,7 +2134,6 @@ static int netvsc_probe(struct hv_device *dev, + else + net->max_mtu = ETH_DATA_LEN; + +- rtnl_lock(); + ret = register_netdevice(net); + if (ret != 0) { + pr_err("Unable to register netdev.\n"); +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 2a58607a6aea..1b07bb5e110d 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5214,8 +5214,8 @@ static int rtl8152_probe(struct usb_interface *intf, + netdev->hw_features &= ~NETIF_F_RXCSUM; + } + +- if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x3011 && +- udev->serial && !strcmp(udev->serial, "000001000000")) { ++ if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x3011 && udev->serial && ++ (!strcmp(udev->serial, "000001000000") || !strcmp(udev->serial, "000002000000"))) { + dev_info(&udev->dev, "Dell TB16 Dock, disable RX aggregation"); + set_bit(DELL_TB_RX_AGG_BUG, &tp->flags); + } +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index b6122aad639e..7569f9af8d47 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -6926,15 +6926,15 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr, + cfg->d11inf.io_type = (u8)io_type; + brcmu_d11_attach(&cfg->d11inf); + +- err = brcmf_setup_wiphy(wiphy, ifp); +- if (err < 0) +- goto priv_out; +- + /* regulatory notifer below needs access to cfg so + * assign it now. + */ + drvr->config = cfg; + ++ err = brcmf_setup_wiphy(wiphy, ifp); ++ if (err < 0) ++ goto priv_out; ++ + brcmf_dbg(INFO, "Registering custom regulatory\n"); + wiphy->reg_notifier = brcmf_cfg80211_reg_notifier; + wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG; +diff --git a/drivers/pci/controller/pci-mvebu.c b/drivers/pci/controller/pci-mvebu.c +index 23e270839e6a..f00df2384985 100644 +--- a/drivers/pci/controller/pci-mvebu.c ++++ b/drivers/pci/controller/pci-mvebu.c +@@ -1219,7 +1219,7 @@ static int mvebu_pcie_probe(struct platform_device *pdev) + pcie->realio.start = PCIBIOS_MIN_IO; + pcie->realio.end = min_t(resource_size_t, + IO_SPACE_LIMIT, +- resource_size(&pcie->io)); ++ resource_size(&pcie->io) - 1); + } else + pcie->realio = pcie->io; + +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index b2857865c0aa..a1a243ee36bb 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1725,7 +1725,7 @@ int pci_setup_device(struct pci_dev *dev) + static void pci_configure_mps(struct pci_dev *dev) + { + struct pci_dev *bridge = pci_upstream_bridge(dev); +- int mps, p_mps, rc; ++ int mps, mpss, p_mps, rc; + + if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge)) + return; +@@ -1753,6 +1753,14 @@ static void pci_configure_mps(struct pci_dev *dev) + if (pcie_bus_config != PCIE_BUS_DEFAULT) + return; + ++ mpss = 128 << dev->pcie_mpss; ++ if (mpss < p_mps && pci_pcie_type(bridge) == PCI_EXP_TYPE_ROOT_PORT) { ++ pcie_set_mps(bridge, mpss); ++ pci_info(dev, "Upstream bridge's Max Payload Size set to %d (was %d, max %d)\n", ++ mpss, p_mps, 128 << bridge->pcie_mpss); ++ p_mps = pcie_get_mps(bridge); ++ } ++ + rc = pcie_set_mps(dev, p_mps); + if (rc) { + pci_warn(dev, "can't set Max Payload Size to %d; if necessary, use \"pci=pcie_bus_safe\" and report a bug\n", +@@ -1761,7 +1769,7 @@ static void pci_configure_mps(struct pci_dev *dev) + } + + pci_info(dev, "Max Payload Size set to %d (was %d, max %d)\n", +- p_mps, mps, 128 << dev->pcie_mpss); ++ p_mps, mps, mpss); + } + + static struct hpp_type0 pci_default_type0 = { +diff --git a/drivers/pinctrl/pinctrl-axp209.c b/drivers/pinctrl/pinctrl-axp209.c +index a52779f33ad4..afd0b533c40a 100644 +--- a/drivers/pinctrl/pinctrl-axp209.c ++++ b/drivers/pinctrl/pinctrl-axp209.c +@@ -316,7 +316,7 @@ static const struct pinctrl_ops axp20x_pctrl_ops = { + .get_group_pins = axp20x_group_pins, + }; + +-static void axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask, ++static int axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask, + unsigned int mask_len, + struct axp20x_pinctrl_function *func, + const struct pinctrl_pin_desc *pins) +@@ -331,18 +331,22 @@ static void axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask, + func->groups = devm_kcalloc(dev, + ngroups, sizeof(const char *), + GFP_KERNEL); ++ if (!func->groups) ++ return -ENOMEM; + group = func->groups; + for_each_set_bit(bit, &mask_cpy, mask_len) { + *group = pins[bit].name; + group++; + } + } ++ ++ return 0; + } + +-static void axp20x_build_funcs_groups(struct platform_device *pdev) ++static int axp20x_build_funcs_groups(struct platform_device *pdev) + { + struct axp20x_pctl *pctl = platform_get_drvdata(pdev); +- int i, pin, npins = pctl->desc->npins; ++ int i, ret, pin, npins = pctl->desc->npins; + + pctl->funcs[AXP20X_FUNC_GPIO_OUT].name = "gpio_out"; + pctl->funcs[AXP20X_FUNC_GPIO_OUT].muxval = AXP20X_MUX_GPIO_OUT; +@@ -366,13 +370,19 @@ static void axp20x_build_funcs_groups(struct platform_device *pdev) + pctl->funcs[i].groups[pin] = pctl->desc->pins[pin].name; + } + +- axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->ldo_mask, ++ ret = axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->ldo_mask, + npins, &pctl->funcs[AXP20X_FUNC_LDO], + pctl->desc->pins); ++ if (ret) ++ return ret; + +- axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->adc_mask, ++ ret = axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->adc_mask, + npins, &pctl->funcs[AXP20X_FUNC_ADC], + pctl->desc->pins); ++ if (ret) ++ return ret; ++ ++ return 0; + } + + static const struct of_device_id axp20x_pctl_match[] = { +@@ -424,7 +434,11 @@ static int axp20x_pctl_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, pctl); + +- axp20x_build_funcs_groups(pdev); ++ ret = axp20x_build_funcs_groups(pdev); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to build groups\n"); ++ return ret; ++ } + + pctrl_desc = devm_kzalloc(&pdev->dev, sizeof(*pctrl_desc), GFP_KERNEL); + if (!pctrl_desc) +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 136ff2b4cce5..db2af09067db 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -496,6 +496,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, + { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, + { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ ++ { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ + { KE_END, 0}, + }; + +diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c +index b5b890127479..b7dfe06261f1 100644 +--- a/drivers/platform/x86/intel_punit_ipc.c ++++ b/drivers/platform/x86/intel_punit_ipc.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + +diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c +index 822860b4801a..c1ed641b3e26 100644 +--- a/drivers/pwm/pwm-meson.c ++++ b/drivers/pwm/pwm-meson.c +@@ -458,7 +458,6 @@ static int meson_pwm_init_channels(struct meson_pwm *meson, + struct meson_pwm_channel *channels) + { + struct device *dev = meson->chip.dev; +- struct device_node *np = dev->of_node; + struct clk_init_data init; + unsigned int i; + char name[255]; +@@ -467,7 +466,7 @@ static int meson_pwm_init_channels(struct meson_pwm *meson, + for (i = 0; i < meson->chip.npwm; i++) { + struct meson_pwm_channel *channel = &channels[i]; + +- snprintf(name, sizeof(name), "%pOF#mux%u", np, i); ++ snprintf(name, sizeof(name), "%s#mux%u", dev_name(dev), i); + + init.name = name; + init.ops = &clk_mux_ops; +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index bbf95b78ef5d..43e3398c9268 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -1780,6 +1780,9 @@ static void dasd_eckd_uncheck_device(struct dasd_device *device) + struct dasd_eckd_private *private = device->private; + int i; + ++ if (!private) ++ return; ++ + dasd_alias_disconnect_device_from_lcu(device); + private->ned = NULL; + private->sneq = NULL; +@@ -2035,8 +2038,11 @@ static int dasd_eckd_basic_to_ready(struct dasd_device *device) + + static int dasd_eckd_online_to_ready(struct dasd_device *device) + { +- cancel_work_sync(&device->reload_device); +- cancel_work_sync(&device->kick_validate); ++ if (cancel_work_sync(&device->reload_device)) ++ dasd_put_device(device); ++ if (cancel_work_sync(&device->kick_validate)) ++ dasd_put_device(device); ++ + return 0; + }; + +diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c +index 80e5b283fd81..1391e5f35918 100644 +--- a/drivers/scsi/aic94xx/aic94xx_init.c ++++ b/drivers/scsi/aic94xx/aic94xx_init.c +@@ -1030,8 +1030,10 @@ static int __init aic94xx_init(void) + + aic94xx_transport_template = + sas_domain_attach_transport(&aic94xx_transport_functions); +- if (!aic94xx_transport_template) ++ if (!aic94xx_transport_template) { ++ err = -ENOMEM; + goto out_destroy_caches; ++ } + + err = pci_register_driver(&aic94xx_pci_driver); + if (err) +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index e40a2c0a9543..d3da39a9f567 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -5446,11 +5446,11 @@ static int ni_E_init(struct comedi_device *dev, + /* Digital I/O (PFI) subdevice */ + s = &dev->subdevices[NI_PFI_DIO_SUBDEV]; + s->type = COMEDI_SUBD_DIO; +- s->subdev_flags = SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL; + s->maxdata = 1; + if (devpriv->is_m_series) { + s->n_chan = 16; + s->insn_bits = ni_pfi_insn_bits; ++ s->subdev_flags = SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL; + + ni_writew(dev, s->state, NI_M_PFI_DO_REG); + for (i = 0; i < NUM_PFI_OUTPUT_SELECT_REGS; ++i) { +@@ -5459,6 +5459,7 @@ static int ni_E_init(struct comedi_device *dev, + } + } else { + s->n_chan = 10; ++ s->subdev_flags = SDF_INTERNAL; + } + s->insn_config = ni_pfi_insn_config; + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index ed3114556fda..560ed8711706 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -951,7 +951,7 @@ static void vhost_iotlb_notify_vq(struct vhost_dev *d, + list_for_each_entry_safe(node, n, &d->pending_list, node) { + struct vhost_iotlb_msg *vq_msg = &node->msg.iotlb; + if (msg->iova <= vq_msg->iova && +- msg->iova + msg->size - 1 > vq_msg->iova && ++ msg->iova + msg->size - 1 >= vq_msg->iova && + vq_msg->type == VHOST_IOTLB_MISS) { + vhost_poll_queue(&node->vq->poll); + list_del(&node->node); +diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c +index 2780886e8ba3..de062fb201bc 100644 +--- a/drivers/virtio/virtio_pci_legacy.c ++++ b/drivers/virtio/virtio_pci_legacy.c +@@ -122,6 +122,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev, + struct virtqueue *vq; + u16 num; + int err; ++ u64 q_pfn; + + /* Select the queue we're interested in */ + iowrite16(index, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_SEL); +@@ -141,9 +142,17 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev, + if (!vq) + return ERR_PTR(-ENOMEM); + ++ q_pfn = virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT; ++ if (q_pfn >> 32) { ++ dev_err(&vp_dev->pci_dev->dev, ++ "platform bug: legacy virtio-mmio must not be used with RAM above 0x%llxGB\n", ++ 0x1ULL << (32 + PAGE_SHIFT - 30)); ++ err = -E2BIG; ++ goto out_del_vq; ++ } ++ + /* activate the queue */ +- iowrite32(virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT, +- vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN); ++ iowrite32(q_pfn, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN); + + vq->priv = (void __force *)vp_dev->ioaddr + VIRTIO_PCI_QUEUE_NOTIFY; + +@@ -160,6 +169,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev, + + out_deactivate: + iowrite32(0, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN); ++out_del_vq: + vring_del_virtqueue(vq); + return ERR_PTR(err); + } +diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c +index b437fccd4e62..294f35ce9e46 100644 +--- a/drivers/xen/xen-balloon.c ++++ b/drivers/xen/xen-balloon.c +@@ -81,7 +81,7 @@ static void watch_target(struct xenbus_watch *watch, + static_max = new_target; + else + static_max >>= PAGE_SHIFT - 10; +- target_diff = xen_pv_domain() ? 0 ++ target_diff = (xen_pv_domain() || xen_initial_domain()) ? 0 + : static_max - balloon_stats.target_pages; + } + +diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c +index a3fdb4fe967d..daf45472bef9 100644 +--- a/fs/btrfs/check-integrity.c ++++ b/fs/btrfs/check-integrity.c +@@ -1539,7 +1539,12 @@ static int btrfsic_map_block(struct btrfsic_state *state, u64 bytenr, u32 len, + } + + device = multi->stripes[0].dev; +- block_ctx_out->dev = btrfsic_dev_state_lookup(device->bdev->bd_dev); ++ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state) || ++ !device->bdev || !device->name) ++ block_ctx_out->dev = NULL; ++ else ++ block_ctx_out->dev = btrfsic_dev_state_lookup( ++ device->bdev->bd_dev); + block_ctx_out->dev_bytenr = multi->stripes[0].physical; + block_ctx_out->start = bytenr; + block_ctx_out->len = len; +diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c +index e2ba0419297a..d20b244623f2 100644 +--- a/fs/btrfs/dev-replace.c ++++ b/fs/btrfs/dev-replace.c +@@ -676,6 +676,12 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, + + btrfs_rm_dev_replace_unblocked(fs_info); + ++ /* ++ * Increment dev_stats_ccnt so that btrfs_run_dev_stats() will ++ * update on-disk dev stats value during commit transaction ++ */ ++ atomic_inc(&tgt_device->dev_stats_ccnt); ++ + /* + * this is again a consistent state where no dev_replace procedure + * is running, the target device is part of the filesystem, the +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 8aab7a6c1e58..53cac20650d8 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -10687,7 +10687,7 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info) + /* Don't want to race with allocators so take the groups_sem */ + down_write(&space_info->groups_sem); + spin_lock(&block_group->lock); +- if (block_group->reserved || ++ if (block_group->reserved || block_group->pinned || + btrfs_block_group_used(&block_group->item) || + block_group->ro || + list_is_singular(&block_group->list)) { +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 879b76fa881a..be94c65bb4d2 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) + struct mapping_node *node = NULL; + struct reloc_control *rc = fs_info->reloc_ctl; + +- spin_lock(&rc->reloc_root_tree.lock); +- rb_node = tree_search(&rc->reloc_root_tree.rb_root, +- root->node->start); +- if (rb_node) { +- node = rb_entry(rb_node, struct mapping_node, rb_node); +- rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ if (rc) { ++ spin_lock(&rc->reloc_root_tree.lock); ++ rb_node = tree_search(&rc->reloc_root_tree.rb_root, ++ root->node->start); ++ if (rb_node) { ++ node = rb_entry(rb_node, struct mapping_node, rb_node); ++ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ } ++ spin_unlock(&rc->reloc_root_tree.lock); ++ if (!node) ++ return; ++ BUG_ON((struct btrfs_root *)node->data != root); + } +- spin_unlock(&rc->reloc_root_tree.lock); +- +- if (!node) +- return; +- BUG_ON((struct btrfs_root *)node->data != root); + + spin_lock(&fs_info->trans_lock); + list_del_init(&root->root_list); +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index bddfc28b27c0..9b25f29d0e73 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -892,6 +892,8 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags, + char *device_name, *opts, *orig, *p; + int error = 0; + ++ lockdep_assert_held(&uuid_mutex); ++ + if (!options) + return 0; + +@@ -1526,12 +1528,6 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type, + if (!(flags & SB_RDONLY)) + mode |= FMODE_WRITE; + +- error = btrfs_parse_early_options(data, mode, fs_type, +- &fs_devices); +- if (error) { +- return ERR_PTR(error); +- } +- + security_init_mnt_opts(&new_sec_opts); + if (data) { + error = parse_security_options(data, &new_sec_opts); +@@ -1539,10 +1535,6 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type, + return ERR_PTR(error); + } + +- error = btrfs_scan_one_device(device_name, mode, fs_type, &fs_devices); +- if (error) +- goto error_sec_opts; +- + /* + * Setup a dummy root and fs_info for test/set super. This is because + * we don't actually fill this stuff out until open_ctree, but we need +@@ -1555,8 +1547,6 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type, + goto error_sec_opts; + } + +- fs_info->fs_devices = fs_devices; +- + fs_info->super_copy = kzalloc(BTRFS_SUPER_INFO_SIZE, GFP_KERNEL); + fs_info->super_for_commit = kzalloc(BTRFS_SUPER_INFO_SIZE, GFP_KERNEL); + security_init_mnt_opts(&fs_info->security_opts); +@@ -1565,7 +1555,23 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type, + goto error_fs_info; + } + ++ mutex_lock(&uuid_mutex); ++ error = btrfs_parse_early_options(data, mode, fs_type, &fs_devices); ++ if (error) { ++ mutex_unlock(&uuid_mutex); ++ goto error_fs_info; ++ } ++ ++ error = btrfs_scan_one_device(device_name, mode, fs_type, &fs_devices); ++ if (error) { ++ mutex_unlock(&uuid_mutex); ++ goto error_fs_info; ++ } ++ ++ fs_info->fs_devices = fs_devices; ++ + error = btrfs_open_devices(fs_devices, mode, fs_type); ++ mutex_unlock(&uuid_mutex); + if (error) + goto error_fs_info; + +@@ -2234,15 +2240,21 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd, + + switch (cmd) { + case BTRFS_IOC_SCAN_DEV: ++ mutex_lock(&uuid_mutex); + ret = btrfs_scan_one_device(vol->name, FMODE_READ, + &btrfs_root_fs_type, &fs_devices); ++ mutex_unlock(&uuid_mutex); + break; + case BTRFS_IOC_DEVICES_READY: ++ mutex_lock(&uuid_mutex); + ret = btrfs_scan_one_device(vol->name, FMODE_READ, + &btrfs_root_fs_type, &fs_devices); +- if (ret) ++ if (ret) { ++ mutex_unlock(&uuid_mutex); + break; ++ } + ret = !(fs_devices->num_devices == fs_devices->total_devices); ++ mutex_unlock(&uuid_mutex); + break; + case BTRFS_IOC_GET_SUPPORTED_FEATURES: + ret = btrfs_ioctl_get_supported_features((void __user*)arg); +@@ -2368,7 +2380,7 @@ static __cold void btrfs_interface_exit(void) + + static void __init btrfs_print_mod_info(void) + { +- pr_info("Btrfs loaded, crc32c=%s" ++ static const char options[] = "" + #ifdef CONFIG_BTRFS_DEBUG + ", debug=on" + #endif +@@ -2381,8 +2393,8 @@ static void __init btrfs_print_mod_info(void) + #ifdef CONFIG_BTRFS_FS_REF_VERIFY + ", ref-verify=on" + #endif +- "\n", +- crc32c_impl()); ++ ; ++ pr_info("Btrfs loaded, crc32c=%s%s\n", crc32c_impl(), options); + } + + static int __init init_btrfs_fs(void) +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index 8d40e7dd8c30..d014af352ce0 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -396,9 +396,22 @@ static int check_leaf(struct btrfs_fs_info *fs_info, struct extent_buffer *leaf, + * skip this check for relocation trees. + */ + if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) { ++ u64 owner = btrfs_header_owner(leaf); + struct btrfs_root *check_root; + +- key.objectid = btrfs_header_owner(leaf); ++ /* These trees must never be empty */ ++ if (owner == BTRFS_ROOT_TREE_OBJECTID || ++ owner == BTRFS_CHUNK_TREE_OBJECTID || ++ owner == BTRFS_EXTENT_TREE_OBJECTID || ++ owner == BTRFS_DEV_TREE_OBJECTID || ++ owner == BTRFS_FS_TREE_OBJECTID || ++ owner == BTRFS_DATA_RELOC_TREE_OBJECTID) { ++ generic_err(fs_info, leaf, 0, ++ "invalid root, root %llu must never be empty", ++ owner); ++ return -EUCLEAN; ++ } ++ key.objectid = owner; + key.type = BTRFS_ROOT_ITEM_KEY; + key.offset = (u64)-1; + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 1da162928d1a..5304b8d6ceb8 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -634,44 +634,48 @@ static void pending_bios_fn(struct btrfs_work *work) + * devices. + */ + static void btrfs_free_stale_devices(const char *path, +- struct btrfs_device *skip_dev) ++ struct btrfs_device *skip_device) + { +- struct btrfs_fs_devices *fs_devs, *tmp_fs_devs; +- struct btrfs_device *dev, *tmp_dev; ++ struct btrfs_fs_devices *fs_devices, *tmp_fs_devices; ++ struct btrfs_device *device, *tmp_device; + +- list_for_each_entry_safe(fs_devs, tmp_fs_devs, &fs_uuids, fs_list) { +- +- if (fs_devs->opened) ++ list_for_each_entry_safe(fs_devices, tmp_fs_devices, &fs_uuids, fs_list) { ++ mutex_lock(&fs_devices->device_list_mutex); ++ if (fs_devices->opened) { ++ mutex_unlock(&fs_devices->device_list_mutex); + continue; ++ } + +- list_for_each_entry_safe(dev, tmp_dev, +- &fs_devs->devices, dev_list) { ++ list_for_each_entry_safe(device, tmp_device, ++ &fs_devices->devices, dev_list) { + int not_found = 0; + +- if (skip_dev && skip_dev == dev) ++ if (skip_device && skip_device == device) + continue; +- if (path && !dev->name) ++ if (path && !device->name) + continue; + + rcu_read_lock(); + if (path) +- not_found = strcmp(rcu_str_deref(dev->name), ++ not_found = strcmp(rcu_str_deref(device->name), + path); + rcu_read_unlock(); + if (not_found) + continue; + + /* delete the stale device */ +- if (fs_devs->num_devices == 1) { +- btrfs_sysfs_remove_fsid(fs_devs); +- list_del(&fs_devs->fs_list); +- free_fs_devices(fs_devs); ++ fs_devices->num_devices--; ++ list_del(&device->dev_list); ++ btrfs_free_device(device); ++ ++ if (fs_devices->num_devices == 0) + break; +- } else { +- fs_devs->num_devices--; +- list_del(&dev->dev_list); +- btrfs_free_device(dev); +- } ++ } ++ mutex_unlock(&fs_devices->device_list_mutex); ++ if (fs_devices->num_devices == 0) { ++ btrfs_sysfs_remove_fsid(fs_devices); ++ list_del(&fs_devices->fs_list); ++ free_fs_devices(fs_devices); + } + } + } +@@ -750,7 +754,8 @@ error_brelse: + * error pointer when failed + */ + static noinline struct btrfs_device *device_list_add(const char *path, +- struct btrfs_super_block *disk_super) ++ struct btrfs_super_block *disk_super, ++ bool *new_device_added) + { + struct btrfs_device *device; + struct btrfs_fs_devices *fs_devices; +@@ -764,21 +769,26 @@ static noinline struct btrfs_device *device_list_add(const char *path, + if (IS_ERR(fs_devices)) + return ERR_CAST(fs_devices); + ++ mutex_lock(&fs_devices->device_list_mutex); + list_add(&fs_devices->fs_list, &fs_uuids); + + device = NULL; + } else { ++ mutex_lock(&fs_devices->device_list_mutex); + device = find_device(fs_devices, devid, + disk_super->dev_item.uuid); + } + + if (!device) { +- if (fs_devices->opened) ++ if (fs_devices->opened) { ++ mutex_unlock(&fs_devices->device_list_mutex); + return ERR_PTR(-EBUSY); ++ } + + device = btrfs_alloc_device(NULL, &devid, + disk_super->dev_item.uuid); + if (IS_ERR(device)) { ++ mutex_unlock(&fs_devices->device_list_mutex); + /* we can safely leave the fs_devices entry around */ + return device; + } +@@ -786,17 +796,16 @@ static noinline struct btrfs_device *device_list_add(const char *path, + name = rcu_string_strdup(path, GFP_NOFS); + if (!name) { + btrfs_free_device(device); ++ mutex_unlock(&fs_devices->device_list_mutex); + return ERR_PTR(-ENOMEM); + } + rcu_assign_pointer(device->name, name); + +- mutex_lock(&fs_devices->device_list_mutex); + list_add_rcu(&device->dev_list, &fs_devices->devices); + fs_devices->num_devices++; +- mutex_unlock(&fs_devices->device_list_mutex); + + device->fs_devices = fs_devices; +- btrfs_free_stale_devices(path, device); ++ *new_device_added = true; + + if (disk_super->label[0]) + pr_info("BTRFS: device label %s devid %llu transid %llu %s\n", +@@ -840,12 +849,15 @@ static noinline struct btrfs_device *device_list_add(const char *path, + * with larger generation number or the last-in if + * generation are equal. + */ ++ mutex_unlock(&fs_devices->device_list_mutex); + return ERR_PTR(-EEXIST); + } + + name = rcu_string_strdup(path, GFP_NOFS); +- if (!name) ++ if (!name) { ++ mutex_unlock(&fs_devices->device_list_mutex); + return ERR_PTR(-ENOMEM); ++ } + rcu_string_free(device->name); + rcu_assign_pointer(device->name, name); + if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) { +@@ -865,6 +877,7 @@ static noinline struct btrfs_device *device_list_add(const char *path, + + fs_devices->total_devices = btrfs_super_num_devices(disk_super); + ++ mutex_unlock(&fs_devices->device_list_mutex); + return device; + } + +@@ -1146,7 +1159,8 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices, + { + int ret; + +- mutex_lock(&uuid_mutex); ++ lockdep_assert_held(&uuid_mutex); ++ + mutex_lock(&fs_devices->device_list_mutex); + if (fs_devices->opened) { + fs_devices->opened++; +@@ -1156,7 +1170,6 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices, + ret = open_fs_devices(fs_devices, flags, holder); + } + mutex_unlock(&fs_devices->device_list_mutex); +- mutex_unlock(&uuid_mutex); + + return ret; + } +@@ -1221,12 +1234,15 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder, + struct btrfs_fs_devices **fs_devices_ret) + { + struct btrfs_super_block *disk_super; ++ bool new_device_added = false; + struct btrfs_device *device; + struct block_device *bdev; + struct page *page; + int ret = 0; + u64 bytenr; + ++ lockdep_assert_held(&uuid_mutex); ++ + /* + * we would like to check all the supers, but that would make + * a btrfs mount succeed after a mkfs from a different FS. +@@ -1245,13 +1261,14 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder, + goto error_bdev_put; + } + +- mutex_lock(&uuid_mutex); +- device = device_list_add(path, disk_super); +- if (IS_ERR(device)) ++ device = device_list_add(path, disk_super, &new_device_added); ++ if (IS_ERR(device)) { + ret = PTR_ERR(device); +- else ++ } else { + *fs_devices_ret = device->fs_devices; +- mutex_unlock(&uuid_mutex); ++ if (new_device_added) ++ btrfs_free_stale_devices(path, device); ++ } + + btrfs_release_disk_super(page); + +@@ -2029,6 +2046,9 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path, + + cur_devices->num_devices--; + cur_devices->total_devices--; ++ /* Update total_devices of the parent fs_devices if it's seed */ ++ if (cur_devices != fs_devices) ++ fs_devices->total_devices--; + + if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) + cur_devices->missing_devices--; +@@ -6563,10 +6583,14 @@ static int read_one_chunk(struct btrfs_fs_info *fs_info, struct btrfs_key *key, + write_lock(&map_tree->map_tree.lock); + ret = add_extent_mapping(&map_tree->map_tree, em, 0); + write_unlock(&map_tree->map_tree.lock); +- BUG_ON(ret); /* Tree corruption */ ++ if (ret < 0) { ++ btrfs_err(fs_info, ++ "failed to add chunk map, start=%llu len=%llu: %d", ++ em->start, em->len, ret); ++ } + free_extent_map(em); + +- return 0; ++ return ret; + } + + static void fill_device_from_item(struct extent_buffer *leaf, +diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c +index 991bfb271908..b20297988fe0 100644 +--- a/fs/cifs/cifs_debug.c ++++ b/fs/cifs/cifs_debug.c +@@ -383,6 +383,10 @@ static ssize_t cifs_stats_proc_write(struct file *file, + atomic_set(&totBufAllocCount, 0); + atomic_set(&totSmBufAllocCount, 0); + #endif /* CONFIG_CIFS_STATS2 */ ++ spin_lock(&GlobalMid_Lock); ++ GlobalMaxActiveXid = 0; ++ GlobalCurrentXid = 0; ++ spin_unlock(&GlobalMid_Lock); + spin_lock(&cifs_tcp_ses_lock); + list_for_each(tmp1, &cifs_tcp_ses_list) { + server = list_entry(tmp1, struct TCP_Server_Info, +@@ -395,6 +399,10 @@ static ssize_t cifs_stats_proc_write(struct file *file, + struct cifs_tcon, + tcon_list); + atomic_set(&tcon->num_smbs_sent, 0); ++ spin_lock(&tcon->stat_lock); ++ tcon->bytes_read = 0; ++ tcon->bytes_written = 0; ++ spin_unlock(&tcon->stat_lock); + if (server->ops->clear_stats) + server->ops->clear_stats(tcon); + } +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 5df2c0698cda..9d02563b2147 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3031,11 +3031,15 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info) + } + + #ifdef CONFIG_CIFS_SMB311 +- if ((volume_info->linux_ext) && (ses->server->posix_ext_supported)) { +- if (ses->server->vals->protocol_id == SMB311_PROT_ID) { ++ if (volume_info->linux_ext) { ++ if (ses->server->posix_ext_supported) { + tcon->posix_extensions = true; + printk_once(KERN_WARNING + "SMB3.11 POSIX Extensions are experimental\n"); ++ } else { ++ cifs_dbg(VFS, "Server does not support mounting with posix SMB3.11 extensions.\n"); ++ rc = -EOPNOTSUPP; ++ goto out_fail; + } + } + #endif /* 311 */ +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 3ff7cec2da81..239215dcc00b 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -240,6 +240,13 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr) + if (clc_len == len + 1) + return 0; + ++ /* ++ * Some windows servers (win2016) will pad also the final ++ * PDU in a compound to 8 bytes. ++ */ ++ if (((clc_len + 7) & ~7) == len) ++ return 0; ++ + /* + * MacOS server pads after SMB2.1 write response with 3 bytes + * of junk. Other servers match RFC1001 len to actual +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index ffce77e00a58..44e511a35559 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -360,7 +360,7 @@ smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, + total_len); + + if (tcon != NULL) { +-#ifdef CONFIG_CIFS_STATS2 ++#ifdef CONFIG_CIFS_STATS + uint16_t com_code = le16_to_cpu(smb2_command); + cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); + #endif +@@ -1928,7 +1928,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, + { + struct smb_rqst rqst; + struct smb2_create_req *req; +- struct smb2_create_rsp *rsp; ++ struct smb2_create_rsp *rsp = NULL; + struct TCP_Server_Info *server; + struct cifs_ses *ses = tcon->ses; + struct kvec iov[3]; /* make sure at least one for each open context */ +@@ -1943,27 +1943,31 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, + char *pc_buf = NULL; + int flags = 0; + unsigned int total_len; +- __le16 *path = cifs_convert_path_to_utf16(full_path, cifs_sb); +- +- if (!path) +- return -ENOMEM; ++ __le16 *utf16_path = NULL; + + cifs_dbg(FYI, "mkdir\n"); + ++ /* resource #1: path allocation */ ++ utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); ++ if (!utf16_path) ++ return -ENOMEM; ++ + if (ses && (ses->server)) + server = ses->server; +- else +- return -EIO; ++ else { ++ rc = -EIO; ++ goto err_free_path; ++ } + ++ /* resource #2: request */ + rc = smb2_plain_req_init(SMB2_CREATE, tcon, (void **) &req, &total_len); +- + if (rc) +- return rc; ++ goto err_free_path; ++ + + if (smb3_encryption_required(tcon)) + flags |= CIFS_TRANSFORM_REQ; + +- + req->ImpersonationLevel = IL_IMPERSONATION; + req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); + /* File attributes ignored on open (used in create though) */ +@@ -1992,50 +1996,44 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, + req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; + rc = alloc_path_with_tree_prefix(©_path, ©_size, + &name_len, +- tcon->treeName, path); +- if (rc) { +- cifs_small_buf_release(req); +- return rc; +- } ++ tcon->treeName, utf16_path); ++ if (rc) ++ goto err_free_req; ++ + req->NameLength = cpu_to_le16(name_len * 2); + uni_path_len = copy_size; +- path = copy_path; ++ /* free before overwriting resource */ ++ kfree(utf16_path); ++ utf16_path = copy_path; + } else { +- uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; ++ uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; + /* MUST set path len (NameLength) to 0 opening root of share */ + req->NameLength = cpu_to_le16(uni_path_len - 2); + if (uni_path_len % 8 != 0) { + copy_size = roundup(uni_path_len, 8); + copy_path = kzalloc(copy_size, GFP_KERNEL); + if (!copy_path) { +- cifs_small_buf_release(req); +- return -ENOMEM; ++ rc = -ENOMEM; ++ goto err_free_req; + } +- memcpy((char *)copy_path, (const char *)path, ++ memcpy((char *)copy_path, (const char *)utf16_path, + uni_path_len); + uni_path_len = copy_size; +- path = copy_path; ++ /* free before overwriting resource */ ++ kfree(utf16_path); ++ utf16_path = copy_path; + } + } + + iov[1].iov_len = uni_path_len; +- iov[1].iov_base = path; ++ iov[1].iov_base = utf16_path; + req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; + + if (tcon->posix_extensions) { +- if (n_iov > 2) { +- struct create_context *ccontext = +- (struct create_context *)iov[n_iov-1].iov_base; +- ccontext->Next = +- cpu_to_le32(iov[n_iov-1].iov_len); +- } +- ++ /* resource #3: posix buf */ + rc = add_posix_context(iov, &n_iov, mode); +- if (rc) { +- cifs_small_buf_release(req); +- kfree(copy_path); +- return rc; +- } ++ if (rc) ++ goto err_free_req; + pc_buf = iov[n_iov-1].iov_base; + } + +@@ -2044,32 +2042,33 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, + rqst.rq_iov = iov; + rqst.rq_nvec = n_iov; + +- rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, +- &rsp_iov); +- +- cifs_small_buf_release(req); +- rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; +- +- if (rc != 0) { ++ /* resource #4: response buffer */ ++ rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov); ++ if (rc) { + cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); + trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, +- CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES, rc); +- goto smb311_mkdir_exit; +- } else +- trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, +- ses->Suid, CREATE_NOT_FILE, +- FILE_WRITE_ATTRIBUTES); ++ CREATE_NOT_FILE, ++ FILE_WRITE_ATTRIBUTES, rc); ++ goto err_free_rsp_buf; ++ } ++ ++ rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; ++ trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ++ ses->Suid, CREATE_NOT_FILE, ++ FILE_WRITE_ATTRIBUTES); + + SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); + + /* Eventually save off posix specific response info and timestaps */ + +-smb311_mkdir_exit: +- kfree(copy_path); +- kfree(pc_buf); ++err_free_rsp_buf: + free_rsp_buf(resp_buftype, rsp); ++ kfree(pc_buf); ++err_free_req: ++ cifs_small_buf_release(req); ++err_free_path: ++ kfree(utf16_path); + return rc; +- + } + #endif /* SMB311 */ + +diff --git a/fs/dcache.c b/fs/dcache.c +index ceb7b491d1b9..d19a0dc46c04 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -292,7 +292,8 @@ void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry + spin_unlock(&dentry->d_lock); + name->name = p->name; + } else { +- memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN); ++ memcpy(name->inline_name, dentry->d_iname, ++ dentry->d_name.len + 1); + spin_unlock(&dentry->d_lock); + name->name = name->inline_name; + } +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 8f931d699287..b61954d40c25 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2149,8 +2149,12 @@ static void f2fs_write_failed(struct address_space *mapping, loff_t to) + + if (to > i_size) { + down_write(&F2FS_I(inode)->i_mmap_sem); ++ down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); ++ + truncate_pagecache(inode, i_size); + f2fs_truncate_blocks(inode, i_size, true); ++ ++ up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + up_write(&F2FS_I(inode)->i_mmap_sem); + } + } +@@ -2490,6 +2494,10 @@ static int f2fs_set_data_page_dirty(struct page *page) + if (!PageUptodate(page)) + SetPageUptodate(page); + ++ /* don't remain PG_checked flag which was set during GC */ ++ if (is_cold_data(page)) ++ clear_cold_data(page); ++ + if (f2fs_is_atomic_file(inode) && !f2fs_is_commit_atomic_write(inode)) { + if (!IS_ATOMIC_WRITTEN_PAGE(page)) { + f2fs_register_inmem_page(inode, page); +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 6880c6f78d58..3ffa341cf586 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -782,22 +782,26 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr) + } + + if (attr->ia_valid & ATTR_SIZE) { +- if (attr->ia_size <= i_size_read(inode)) { +- down_write(&F2FS_I(inode)->i_mmap_sem); +- truncate_setsize(inode, attr->ia_size); ++ bool to_smaller = (attr->ia_size <= i_size_read(inode)); ++ ++ down_write(&F2FS_I(inode)->i_mmap_sem); ++ down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); ++ ++ truncate_setsize(inode, attr->ia_size); ++ ++ if (to_smaller) + err = f2fs_truncate(inode); +- up_write(&F2FS_I(inode)->i_mmap_sem); +- if (err) +- return err; +- } else { +- /* +- * do not trim all blocks after i_size if target size is +- * larger than i_size. +- */ +- down_write(&F2FS_I(inode)->i_mmap_sem); +- truncate_setsize(inode, attr->ia_size); +- up_write(&F2FS_I(inode)->i_mmap_sem); ++ /* ++ * do not trim all blocks after i_size if target size is ++ * larger than i_size. ++ */ ++ up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); ++ up_write(&F2FS_I(inode)->i_mmap_sem); + ++ if (err) ++ return err; ++ ++ if (!to_smaller) { + /* should convert inline inode here */ + if (!f2fs_may_inline_data(inode)) { + err = f2fs_convert_inline_inode(inode); +@@ -944,13 +948,18 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len) + + blk_start = (loff_t)pg_start << PAGE_SHIFT; + blk_end = (loff_t)pg_end << PAGE_SHIFT; ++ + down_write(&F2FS_I(inode)->i_mmap_sem); ++ down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); ++ + truncate_inode_pages_range(mapping, blk_start, + blk_end - 1); + + f2fs_lock_op(sbi); + ret = f2fs_truncate_hole(inode, pg_start, pg_end); + f2fs_unlock_op(sbi); ++ ++ up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + up_write(&F2FS_I(inode)->i_mmap_sem); + } + } +@@ -1295,8 +1304,6 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, + if (ret) + goto out_sem; + +- truncate_pagecache_range(inode, offset, offset + len - 1); +- + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; + +@@ -1326,12 +1333,19 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, + unsigned int end_offset; + pgoff_t end; + ++ down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); ++ ++ truncate_pagecache_range(inode, ++ (loff_t)index << PAGE_SHIFT, ++ ((loff_t)pg_end << PAGE_SHIFT) - 1); ++ + f2fs_lock_op(sbi); + + set_new_dnode(&dn, inode, NULL, NULL, 0); + ret = f2fs_get_dnode_of_data(&dn, index, ALLOC_NODE); + if (ret) { + f2fs_unlock_op(sbi); ++ up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + goto out; + } + +@@ -1340,7 +1354,9 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, + + ret = f2fs_do_zero_range(&dn, index, end); + f2fs_put_dnode(&dn); ++ + f2fs_unlock_op(sbi); ++ up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + + f2fs_balance_fs(sbi, dn.node_changed); + +diff --git a/fs/fat/cache.c b/fs/fat/cache.c +index e9bed49df6b7..78d501c1fb65 100644 +--- a/fs/fat/cache.c ++++ b/fs/fat/cache.c +@@ -225,7 +225,8 @@ static inline void cache_init(struct fat_cache_id *cid, int fclus, int dclus) + int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) + { + struct super_block *sb = inode->i_sb; +- const int limit = sb->s_maxbytes >> MSDOS_SB(sb)->cluster_bits; ++ struct msdos_sb_info *sbi = MSDOS_SB(sb); ++ const int limit = sb->s_maxbytes >> sbi->cluster_bits; + struct fat_entry fatent; + struct fat_cache_id cid; + int nr; +@@ -234,6 +235,12 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) + + *fclus = 0; + *dclus = MSDOS_I(inode)->i_start; ++ if (!fat_valid_entry(sbi, *dclus)) { ++ fat_fs_error_ratelimit(sb, ++ "%s: invalid start cluster (i_pos %lld, start %08x)", ++ __func__, MSDOS_I(inode)->i_pos, *dclus); ++ return -EIO; ++ } + if (cluster == 0) + return 0; + +@@ -250,9 +257,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) + /* prevent the infinite loop of cluster chain */ + if (*fclus > limit) { + fat_fs_error_ratelimit(sb, +- "%s: detected the cluster chain loop" +- " (i_pos %lld)", __func__, +- MSDOS_I(inode)->i_pos); ++ "%s: detected the cluster chain loop (i_pos %lld)", ++ __func__, MSDOS_I(inode)->i_pos); + nr = -EIO; + goto out; + } +@@ -262,9 +268,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) + goto out; + else if (nr == FAT_ENT_FREE) { + fat_fs_error_ratelimit(sb, +- "%s: invalid cluster chain (i_pos %lld)", +- __func__, +- MSDOS_I(inode)->i_pos); ++ "%s: invalid cluster chain (i_pos %lld)", ++ __func__, MSDOS_I(inode)->i_pos); + nr = -EIO; + goto out; + } else if (nr == FAT_ENT_EOF) { +diff --git a/fs/fat/fat.h b/fs/fat/fat.h +index 8fc1093da47d..a0a00f3734bc 100644 +--- a/fs/fat/fat.h ++++ b/fs/fat/fat.h +@@ -348,6 +348,11 @@ static inline void fatent_brelse(struct fat_entry *fatent) + fatent->fat_inode = NULL; + } + ++static inline bool fat_valid_entry(struct msdos_sb_info *sbi, int entry) ++{ ++ return FAT_START_ENT <= entry && entry < sbi->max_cluster; ++} ++ + extern void fat_ent_access_init(struct super_block *sb); + extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent, + int entry); +diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c +index bac10de678cc..3aef8630a4b9 100644 +--- a/fs/fat/fatent.c ++++ b/fs/fat/fatent.c +@@ -23,7 +23,7 @@ static void fat12_ent_blocknr(struct super_block *sb, int entry, + { + struct msdos_sb_info *sbi = MSDOS_SB(sb); + int bytes = entry + (entry >> 1); +- WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry); ++ WARN_ON(!fat_valid_entry(sbi, entry)); + *offset = bytes & (sb->s_blocksize - 1); + *blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits); + } +@@ -33,7 +33,7 @@ static void fat_ent_blocknr(struct super_block *sb, int entry, + { + struct msdos_sb_info *sbi = MSDOS_SB(sb); + int bytes = (entry << sbi->fatent_shift); +- WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry); ++ WARN_ON(!fat_valid_entry(sbi, entry)); + *offset = bytes & (sb->s_blocksize - 1); + *blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits); + } +@@ -353,7 +353,7 @@ int fat_ent_read(struct inode *inode, struct fat_entry *fatent, int entry) + int err, offset; + sector_t blocknr; + +- if (entry < FAT_START_ENT || sbi->max_cluster <= entry) { ++ if (!fat_valid_entry(sbi, entry)) { + fatent_brelse(fatent); + fat_fs_error(sb, "invalid access to FAT (entry 0x%08x)", entry); + return -EIO; +diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c +index ad04a5741016..9a8772465a90 100644 +--- a/fs/hfs/brec.c ++++ b/fs/hfs/brec.c +@@ -75,9 +75,10 @@ int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len) + if (!fd->bnode) { + if (!tree->root) + hfs_btree_inc_height(tree); +- fd->bnode = hfs_bnode_find(tree, tree->leaf_head); +- if (IS_ERR(fd->bnode)) +- return PTR_ERR(fd->bnode); ++ node = hfs_bnode_find(tree, tree->leaf_head); ++ if (IS_ERR(node)) ++ return PTR_ERR(node); ++ fd->bnode = node; + fd->record = -1; + } + new_node = NULL; +diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c +index b5254378f011..cd017d7dbdfa 100644 +--- a/fs/hfsplus/dir.c ++++ b/fs/hfsplus/dir.c +@@ -78,13 +78,13 @@ again: + cpu_to_be32(HFSP_HARDLINK_TYPE) && + entry.file.user_info.fdCreator == + cpu_to_be32(HFSP_HFSPLUS_CREATOR) && ++ HFSPLUS_SB(sb)->hidden_dir && + (entry.file.create_date == + HFSPLUS_I(HFSPLUS_SB(sb)->hidden_dir)-> + create_date || + entry.file.create_date == + HFSPLUS_I(d_inode(sb->s_root))-> +- create_date) && +- HFSPLUS_SB(sb)->hidden_dir) { ++ create_date)) { + struct qstr str; + char name[32]; + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index a6c0f54c48c3..80abba550bfa 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -524,8 +524,10 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent) + goto out_put_root; + if (!hfs_brec_read(&fd, &entry, sizeof(entry))) { + hfs_find_exit(&fd); +- if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) ++ if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) { ++ err = -EINVAL; + goto out_put_root; ++ } + inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id)); + if (IS_ERR(inode)) { + err = PTR_ERR(inode); +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 464db0c0f5c8..ff98e2a3f3cc 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -7734,7 +7734,7 @@ static int nfs4_sp4_select_mode(struct nfs_client *clp, + } + out: + clp->cl_sp4_flags = flags; +- return 0; ++ return ret; + } + + struct nfs41_exchange_id_data { +diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c +index e64ecb9f2720..66c373230e60 100644 +--- a/fs/proc/kcore.c ++++ b/fs/proc/kcore.c +@@ -384,8 +384,10 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff) + phdr->p_flags = PF_R|PF_W|PF_X; + phdr->p_offset = kc_vaddr_to_offset(m->addr) + dataoff; + phdr->p_vaddr = (size_t)m->addr; +- if (m->type == KCORE_RAM || m->type == KCORE_TEXT) ++ if (m->type == KCORE_RAM) + phdr->p_paddr = __pa(m->addr); ++ else if (m->type == KCORE_TEXT) ++ phdr->p_paddr = __pa_symbol(m->addr); + else + phdr->p_paddr = (elf_addr_t)-1; + phdr->p_filesz = phdr->p_memsz = m->size; +diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c +index cfb6674331fd..0651646dd04d 100644 +--- a/fs/proc/vmcore.c ++++ b/fs/proc/vmcore.c +@@ -225,6 +225,7 @@ out_unlock: + return ret; + } + ++#ifdef CONFIG_MMU + static int vmcoredd_mmap_dumps(struct vm_area_struct *vma, unsigned long dst, + u64 start, size_t size) + { +@@ -259,6 +260,7 @@ out_unlock: + mutex_unlock(&vmcoredd_mutex); + return ret; + } ++#endif /* CONFIG_MMU */ + #endif /* CONFIG_PROC_VMCORE_DEVICE_DUMP */ + + /* Read from the ELF header and then the crash dump. On error, negative value is +diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h +index ae4811fecc1f..6d670bd9ab6b 100644 +--- a/fs/reiserfs/reiserfs.h ++++ b/fs/reiserfs/reiserfs.h +@@ -271,7 +271,7 @@ struct reiserfs_journal_list { + + struct mutex j_commit_mutex; + unsigned int j_trans_id; +- time_t j_timestamp; ++ time64_t j_timestamp; /* write-only but useful for crash dump analysis */ + struct reiserfs_list_bitmap *j_list_bitmap; + struct buffer_head *j_commit_bh; /* commit buffer head */ + struct reiserfs_journal_cnode *j_realblock; +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index 29502238e510..bf85e152af05 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -3082,4 +3082,6 @@ + + #define PCI_VENDOR_ID_OCZ 0x1b85 + ++#define PCI_VENDOR_ID_NCUBE 0x10ff ++ + #endif /* _LINUX_PCI_IDS_H */ +diff --git a/include/net/tcp.h b/include/net/tcp.h +index cd3ecda9386a..106e01c721e6 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -2023,6 +2023,10 @@ int tcp_set_ulp_id(struct sock *sk, const int ulp); + void tcp_get_available_ulp(char *buf, size_t len); + void tcp_cleanup_ulp(struct sock *sk); + ++#define MODULE_ALIAS_TCP_ULP(name) \ ++ __MODULE_INFO(alias, alias_userspace, name); \ ++ __MODULE_INFO(alias, alias_tcp_ulp, "tcp-ulp-" name) ++ + /* Call BPF_SOCK_OPS program that returns an int. If the return value + * is < 0, then the BPF op failed (for example if the loaded BPF + * program does not support the chosen operation or there is no BPF +diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h +index 7b8c9e19bad1..910cc4334b21 100644 +--- a/include/uapi/linux/keyctl.h ++++ b/include/uapi/linux/keyctl.h +@@ -65,7 +65,7 @@ + + /* keyctl structures */ + struct keyctl_dh_params { +- __s32 private; ++ __s32 dh_private; + __s32 prime; + __s32 base; + }; +diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c +index 76efe9a183f5..fc5b103512e7 100644 +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -196,19 +196,21 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos) + { + struct bpf_map *map = seq_file_to_map(m); + void *key = map_iter(m)->key; ++ void *prev_key; + + if (map_iter(m)->done) + return NULL; + + if (unlikely(v == SEQ_START_TOKEN)) +- goto done; ++ prev_key = NULL; ++ else ++ prev_key = key; + +- if (map->ops->map_get_next_key(map, key, key)) { ++ if (map->ops->map_get_next_key(map, prev_key, key)) { + map_iter(m)->done = true; + return NULL; + } + +-done: + ++(*pos); + return key; + } +diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c +index c4d75c52b4fc..58899601fccf 100644 +--- a/kernel/bpf/sockmap.c ++++ b/kernel/bpf/sockmap.c +@@ -58,6 +58,7 @@ struct bpf_stab { + struct bpf_map map; + struct sock **sock_map; + struct bpf_sock_progs progs; ++ raw_spinlock_t lock; + }; + + struct bucket { +@@ -89,9 +90,9 @@ enum smap_psock_state { + + struct smap_psock_map_entry { + struct list_head list; ++ struct bpf_map *map; + struct sock **entry; + struct htab_elem __rcu *hash_link; +- struct bpf_htab __rcu *htab; + }; + + struct smap_psock { +@@ -343,13 +344,18 @@ static void bpf_tcp_close(struct sock *sk, long timeout) + e = psock_map_pop(sk, psock); + while (e) { + if (e->entry) { +- osk = cmpxchg(e->entry, sk, NULL); ++ struct bpf_stab *stab = container_of(e->map, struct bpf_stab, map); ++ ++ raw_spin_lock_bh(&stab->lock); ++ osk = *e->entry; + if (osk == sk) { ++ *e->entry = NULL; + smap_release_sock(psock, sk); + } ++ raw_spin_unlock_bh(&stab->lock); + } else { + struct htab_elem *link = rcu_dereference(e->hash_link); +- struct bpf_htab *htab = rcu_dereference(e->htab); ++ struct bpf_htab *htab = container_of(e->map, struct bpf_htab, map); + struct hlist_head *head; + struct htab_elem *l; + struct bucket *b; +@@ -370,6 +376,7 @@ static void bpf_tcp_close(struct sock *sk, long timeout) + } + raw_spin_unlock_bh(&b->lock); + } ++ kfree(e); + e = psock_map_pop(sk, psock); + } + rcu_read_unlock(); +@@ -1644,6 +1651,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr) + return ERR_PTR(-ENOMEM); + + bpf_map_init_from_attr(&stab->map, attr); ++ raw_spin_lock_init(&stab->lock); + + /* make sure page count doesn't overflow */ + cost = (u64) stab->map.max_entries * sizeof(struct sock *); +@@ -1678,8 +1686,10 @@ static void smap_list_map_remove(struct smap_psock *psock, + + spin_lock_bh(&psock->maps_lock); + list_for_each_entry_safe(e, tmp, &psock->maps, list) { +- if (e->entry == entry) ++ if (e->entry == entry) { + list_del(&e->list); ++ kfree(e); ++ } + } + spin_unlock_bh(&psock->maps_lock); + } +@@ -1693,8 +1703,10 @@ static void smap_list_hash_remove(struct smap_psock *psock, + list_for_each_entry_safe(e, tmp, &psock->maps, list) { + struct htab_elem *c = rcu_dereference(e->hash_link); + +- if (c == hash_link) ++ if (c == hash_link) { + list_del(&e->list); ++ kfree(e); ++ } + } + spin_unlock_bh(&psock->maps_lock); + } +@@ -1714,14 +1726,15 @@ static void sock_map_free(struct bpf_map *map) + * and a grace period expire to ensure psock is really safe to remove. + */ + rcu_read_lock(); ++ raw_spin_lock_bh(&stab->lock); + for (i = 0; i < stab->map.max_entries; i++) { + struct smap_psock *psock; + struct sock *sock; + +- sock = xchg(&stab->sock_map[i], NULL); ++ sock = stab->sock_map[i]; + if (!sock) + continue; +- ++ stab->sock_map[i] = NULL; + psock = smap_psock_sk(sock); + /* This check handles a racing sock event that can get the + * sk_callback_lock before this case but after xchg happens +@@ -1733,6 +1746,7 @@ static void sock_map_free(struct bpf_map *map) + smap_release_sock(psock, sock); + } + } ++ raw_spin_unlock_bh(&stab->lock); + rcu_read_unlock(); + + sock_map_remove_complete(stab); +@@ -1776,19 +1790,23 @@ static int sock_map_delete_elem(struct bpf_map *map, void *key) + if (k >= map->max_entries) + return -EINVAL; + +- sock = xchg(&stab->sock_map[k], NULL); ++ raw_spin_lock_bh(&stab->lock); ++ sock = stab->sock_map[k]; ++ stab->sock_map[k] = NULL; ++ raw_spin_unlock_bh(&stab->lock); + if (!sock) + return -EINVAL; + + psock = smap_psock_sk(sock); + if (!psock) +- goto out; +- +- if (psock->bpf_parse) ++ return 0; ++ if (psock->bpf_parse) { ++ write_lock_bh(&sock->sk_callback_lock); + smap_stop_sock(psock, sock); ++ write_unlock_bh(&sock->sk_callback_lock); ++ } + smap_list_map_remove(psock, &stab->sock_map[k]); + smap_release_sock(psock, sock); +-out: + return 0; + } + +@@ -1824,11 +1842,9 @@ out: + static int __sock_map_ctx_update_elem(struct bpf_map *map, + struct bpf_sock_progs *progs, + struct sock *sock, +- struct sock **map_link, + void *key) + { + struct bpf_prog *verdict, *parse, *tx_msg; +- struct smap_psock_map_entry *e = NULL; + struct smap_psock *psock; + bool new = false; + int err = 0; +@@ -1901,14 +1917,6 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map, + new = true; + } + +- if (map_link) { +- e = kzalloc(sizeof(*e), GFP_ATOMIC | __GFP_NOWARN); +- if (!e) { +- err = -ENOMEM; +- goto out_free; +- } +- } +- + /* 3. At this point we have a reference to a valid psock that is + * running. Attach any BPF programs needed. + */ +@@ -1930,17 +1938,6 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map, + write_unlock_bh(&sock->sk_callback_lock); + } + +- /* 4. Place psock in sockmap for use and stop any programs on +- * the old sock assuming its not the same sock we are replacing +- * it with. Because we can only have a single set of programs if +- * old_sock has a strp we can stop it. +- */ +- if (map_link) { +- e->entry = map_link; +- spin_lock_bh(&psock->maps_lock); +- list_add_tail(&e->list, &psock->maps); +- spin_unlock_bh(&psock->maps_lock); +- } + return err; + out_free: + smap_release_sock(psock, sock); +@@ -1951,7 +1948,6 @@ out_progs: + } + if (tx_msg) + bpf_prog_put(tx_msg); +- kfree(e); + return err; + } + +@@ -1961,36 +1957,57 @@ static int sock_map_ctx_update_elem(struct bpf_sock_ops_kern *skops, + { + struct bpf_stab *stab = container_of(map, struct bpf_stab, map); + struct bpf_sock_progs *progs = &stab->progs; +- struct sock *osock, *sock; ++ struct sock *osock, *sock = skops->sk; ++ struct smap_psock_map_entry *e; ++ struct smap_psock *psock; + u32 i = *(u32 *)key; + int err; + + if (unlikely(flags > BPF_EXIST)) + return -EINVAL; +- + if (unlikely(i >= stab->map.max_entries)) + return -E2BIG; + +- sock = READ_ONCE(stab->sock_map[i]); +- if (flags == BPF_EXIST && !sock) +- return -ENOENT; +- else if (flags == BPF_NOEXIST && sock) +- return -EEXIST; ++ e = kzalloc(sizeof(*e), GFP_ATOMIC | __GFP_NOWARN); ++ if (!e) ++ return -ENOMEM; + +- sock = skops->sk; +- err = __sock_map_ctx_update_elem(map, progs, sock, &stab->sock_map[i], +- key); ++ err = __sock_map_ctx_update_elem(map, progs, sock, key); + if (err) + goto out; + +- osock = xchg(&stab->sock_map[i], sock); +- if (osock) { +- struct smap_psock *opsock = smap_psock_sk(osock); ++ /* psock guaranteed to be present. */ ++ psock = smap_psock_sk(sock); ++ raw_spin_lock_bh(&stab->lock); ++ osock = stab->sock_map[i]; ++ if (osock && flags == BPF_NOEXIST) { ++ err = -EEXIST; ++ goto out_unlock; ++ } ++ if (!osock && flags == BPF_EXIST) { ++ err = -ENOENT; ++ goto out_unlock; ++ } + +- smap_list_map_remove(opsock, &stab->sock_map[i]); +- smap_release_sock(opsock, osock); ++ e->entry = &stab->sock_map[i]; ++ e->map = map; ++ spin_lock_bh(&psock->maps_lock); ++ list_add_tail(&e->list, &psock->maps); ++ spin_unlock_bh(&psock->maps_lock); ++ ++ stab->sock_map[i] = sock; ++ if (osock) { ++ psock = smap_psock_sk(osock); ++ smap_list_map_remove(psock, &stab->sock_map[i]); ++ smap_release_sock(psock, osock); + } ++ raw_spin_unlock_bh(&stab->lock); ++ return 0; ++out_unlock: ++ smap_release_sock(psock, sock); ++ raw_spin_unlock_bh(&stab->lock); + out: ++ kfree(e); + return err; + } + +@@ -2353,7 +2370,7 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops, + b = __select_bucket(htab, hash); + head = &b->head; + +- err = __sock_map_ctx_update_elem(map, progs, sock, NULL, key); ++ err = __sock_map_ctx_update_elem(map, progs, sock, key); + if (err) + goto err; + +@@ -2379,8 +2396,7 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops, + } + + rcu_assign_pointer(e->hash_link, l_new); +- rcu_assign_pointer(e->htab, +- container_of(map, struct bpf_htab, map)); ++ e->map = map; + spin_lock_bh(&psock->maps_lock); + list_add_tail(&e->list, &psock->maps); + spin_unlock_bh(&psock->maps_lock); +diff --git a/kernel/fork.c b/kernel/fork.c +index 1b27babc4c78..8ed48ca2cc43 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -549,8 +549,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, + goto out; + } + /* a new mm has just been created */ +- arch_dup_mmap(oldmm, mm); +- retval = 0; ++ retval = arch_dup_mmap(oldmm, mm); + out: + up_write(&mm->mmap_sem); + flush_tlb_mm(oldmm); +@@ -1417,7 +1416,9 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk) + return -ENOMEM; + + atomic_set(&sig->count, 1); ++ spin_lock_irq(¤t->sighand->siglock); + memcpy(sig->action, current->sighand->action, sizeof(sig->action)); ++ spin_unlock_irq(¤t->sighand->siglock); + return 0; + } + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 5f78c6e41796..0280deac392e 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -2652,6 +2652,9 @@ void flush_workqueue(struct workqueue_struct *wq) + if (WARN_ON(!wq_online)) + return; + ++ lock_map_acquire(&wq->lockdep_map); ++ lock_map_release(&wq->lockdep_map); ++ + mutex_lock(&wq->mutex); + + /* +@@ -2843,7 +2846,8 @@ reflush: + } + EXPORT_SYMBOL_GPL(drain_workqueue); + +-static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr) ++static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr, ++ bool from_cancel) + { + struct worker *worker = NULL; + struct worker_pool *pool; +@@ -2885,7 +2889,8 @@ static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr) + * workqueues the deadlock happens when the rescuer stalls, blocking + * forward progress. + */ +- if (pwq->wq->saved_max_active == 1 || pwq->wq->rescuer) { ++ if (!from_cancel && ++ (pwq->wq->saved_max_active == 1 || pwq->wq->rescuer)) { + lock_map_acquire(&pwq->wq->lockdep_map); + lock_map_release(&pwq->wq->lockdep_map); + } +@@ -2896,6 +2901,27 @@ already_gone: + return false; + } + ++static bool __flush_work(struct work_struct *work, bool from_cancel) ++{ ++ struct wq_barrier barr; ++ ++ if (WARN_ON(!wq_online)) ++ return false; ++ ++ if (!from_cancel) { ++ lock_map_acquire(&work->lockdep_map); ++ lock_map_release(&work->lockdep_map); ++ } ++ ++ if (start_flush_work(work, &barr, from_cancel)) { ++ wait_for_completion(&barr.done); ++ destroy_work_on_stack(&barr.work); ++ return true; ++ } else { ++ return false; ++ } ++} ++ + /** + * flush_work - wait for a work to finish executing the last queueing instance + * @work: the work to flush +@@ -2909,18 +2935,7 @@ already_gone: + */ + bool flush_work(struct work_struct *work) + { +- struct wq_barrier barr; +- +- if (WARN_ON(!wq_online)) +- return false; +- +- if (start_flush_work(work, &barr)) { +- wait_for_completion(&barr.done); +- destroy_work_on_stack(&barr.work); +- return true; +- } else { +- return false; +- } ++ return __flush_work(work, false); + } + EXPORT_SYMBOL_GPL(flush_work); + +@@ -2986,7 +3001,7 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork) + * isn't executing. + */ + if (wq_online) +- flush_work(work); ++ __flush_work(work, true); + + clear_work_data(work); + +diff --git a/lib/debugobjects.c b/lib/debugobjects.c +index 994be4805cec..24c1df0d7466 100644 +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -360,9 +360,12 @@ static void debug_object_is_on_stack(void *addr, int onstack) + + limit++; + if (is_on_stack) +- pr_warn("object is on stack, but not annotated\n"); ++ pr_warn("object %p is on stack %p, but NOT annotated.\n", addr, ++ task_stack_page(current)); + else +- pr_warn("object is not on stack, but annotated\n"); ++ pr_warn("object %p is NOT on stack %p, but annotated.\n", addr, ++ task_stack_page(current)); ++ + WARN_ON(1); + } + +diff --git a/mm/Kconfig b/mm/Kconfig +index ce95491abd6a..94af022b7f3d 100644 +--- a/mm/Kconfig ++++ b/mm/Kconfig +@@ -635,7 +635,7 @@ config DEFERRED_STRUCT_PAGE_INIT + bool "Defer initialisation of struct pages to kthreads" + default n + depends on NO_BOOTMEM +- depends on !FLATMEM ++ depends on SPARSEMEM + depends on !NEED_PER_CPU_KM + help + Ordinarily all struct pages are initialised during early boot in a +diff --git a/mm/fadvise.c b/mm/fadvise.c +index afa41491d324..2d8376e3c640 100644 +--- a/mm/fadvise.c ++++ b/mm/fadvise.c +@@ -72,8 +72,12 @@ int ksys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice) + goto out; + } + +- /* Careful about overflows. Len == 0 means "as much as possible" */ +- endbyte = offset + len; ++ /* ++ * Careful about overflows. Len == 0 means "as much as possible". Use ++ * unsigned math because signed overflows are undefined and UBSan ++ * complains. ++ */ ++ endbyte = (u64)offset + (u64)len; + if (!len || endbyte < len) + endbyte = -1; + else +diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c +index ef456395645a..7fb60dd4be79 100644 +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -199,15 +199,14 @@ static void p9_mux_poll_stop(struct p9_conn *m) + static void p9_conn_cancel(struct p9_conn *m, int err) + { + struct p9_req_t *req, *rtmp; +- unsigned long flags; + LIST_HEAD(cancel_list); + + p9_debug(P9_DEBUG_ERROR, "mux %p err %d\n", m, err); + +- spin_lock_irqsave(&m->client->lock, flags); ++ spin_lock(&m->client->lock); + + if (m->err) { +- spin_unlock_irqrestore(&m->client->lock, flags); ++ spin_unlock(&m->client->lock); + return; + } + +@@ -219,7 +218,6 @@ static void p9_conn_cancel(struct p9_conn *m, int err) + list_for_each_entry_safe(req, rtmp, &m->unsent_req_list, req_list) { + list_move(&req->req_list, &cancel_list); + } +- spin_unlock_irqrestore(&m->client->lock, flags); + + list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) { + p9_debug(P9_DEBUG_ERROR, "call back req %p\n", req); +@@ -228,6 +226,7 @@ static void p9_conn_cancel(struct p9_conn *m, int err) + req->t_err = err; + p9_client_cb(m->client, req, REQ_STATUS_ERROR); + } ++ spin_unlock(&m->client->lock); + } + + static __poll_t +@@ -375,8 +374,9 @@ static void p9_read_work(struct work_struct *work) + if (m->req->status != REQ_STATUS_ERROR) + status = REQ_STATUS_RCVD; + list_del(&m->req->req_list); +- spin_unlock(&m->client->lock); ++ /* update req->status while holding client->lock */ + p9_client_cb(m->client, m->req, status); ++ spin_unlock(&m->client->lock); + m->rc.sdata = NULL; + m->rc.offset = 0; + m->rc.capacity = 0; +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index 4c2da2513c8b..2dc1c293092b 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -571,7 +571,7 @@ static int p9_virtio_probe(struct virtio_device *vdev) + chan->vq = virtio_find_single_vq(vdev, req_done, "requests"); + if (IS_ERR(chan->vq)) { + err = PTR_ERR(chan->vq); +- goto out_free_vq; ++ goto out_free_chan; + } + chan->vq->vdev->priv = chan; + spin_lock_init(&chan->lock); +@@ -624,6 +624,7 @@ out_free_tag: + kfree(tag); + out_free_vq: + vdev->config->del_vqs(vdev); ++out_free_chan: + kfree(chan); + fail: + return err; +diff --git a/net/core/xdp.c b/net/core/xdp.c +index 6771f1855b96..2657056130a4 100644 +--- a/net/core/xdp.c ++++ b/net/core/xdp.c +@@ -95,23 +95,15 @@ static void __xdp_rxq_info_unreg_mem_model(struct xdp_rxq_info *xdp_rxq) + { + struct xdp_mem_allocator *xa; + int id = xdp_rxq->mem.id; +- int err; + + if (id == 0) + return; + + mutex_lock(&mem_id_lock); + +- xa = rhashtable_lookup(mem_id_ht, &id, mem_id_rht_params); +- if (!xa) { +- mutex_unlock(&mem_id_lock); +- return; +- } +- +- err = rhashtable_remove_fast(mem_id_ht, &xa->node, mem_id_rht_params); +- WARN_ON(err); +- +- call_rcu(&xa->rcu, __xdp_mem_allocator_rcu_free); ++ xa = rhashtable_lookup_fast(mem_id_ht, &id, mem_id_rht_params); ++ if (xa && !rhashtable_remove_fast(mem_id_ht, &xa->node, mem_id_rht_params)) ++ call_rcu(&xa->rcu, __xdp_mem_allocator_rcu_free); + + mutex_unlock(&mem_id_lock); + } +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 2d8efeecf619..055f4bbba86b 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -1511,11 +1511,14 @@ nla_put_failure: + + static void erspan_setup(struct net_device *dev) + { ++ struct ip_tunnel *t = netdev_priv(dev); ++ + ether_setup(dev); + dev->netdev_ops = &erspan_netdev_ops; + dev->priv_flags &= ~IFF_TX_SKB_SHARING; + dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; + ip_tunnel_setup(dev, erspan_net_id); ++ t->erspan_ver = 1; + } + + static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = { +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 3b2711e33e4c..488b201851d7 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -2516,6 +2516,12 @@ static int __net_init tcp_sk_init(struct net *net) + if (res) + goto fail; + sock_set_flag(sk, SOCK_USE_WRITE_QUEUE); ++ ++ /* Please enforce IP_DF and IPID==0 for RST and ++ * ACK sent in SYN-RECV and TIME-WAIT state. ++ */ ++ inet_sk(sk)->pmtudisc = IP_PMTUDISC_DO; ++ + *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk; + } + +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 1dda1341a223..b690132f5da2 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -184,8 +184,9 @@ kill: + inet_twsk_deschedule_put(tw); + return TCP_TW_SUCCESS; + } ++ } else { ++ inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN); + } +- inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN); + + if (tmp_opt.saw_tstamp) { + tcptw->tw_ts_recent = tmp_opt.rcv_tsval; +diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c +index 622caa4039e0..a5995bb2eaca 100644 +--- a/net/ipv4/tcp_ulp.c ++++ b/net/ipv4/tcp_ulp.c +@@ -51,7 +51,7 @@ static const struct tcp_ulp_ops *__tcp_ulp_find_autoload(const char *name) + #ifdef CONFIG_MODULES + if (!ulp && capable(CAP_NET_ADMIN)) { + rcu_read_unlock(); +- request_module("%s", name); ++ request_module("tcp-ulp-%s", name); + rcu_read_lock(); + ulp = tcp_ulp_find(name); + } +@@ -129,6 +129,8 @@ void tcp_cleanup_ulp(struct sock *sk) + if (icsk->icsk_ulp_ops->release) + icsk->icsk_ulp_ops->release(sk); + module_put(icsk->icsk_ulp_ops->owner); ++ ++ icsk->icsk_ulp_ops = NULL; + } + + /* Change upper layer protocol for socket */ +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index d212738e9d10..5516f55e214b 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -198,6 +198,8 @@ void fib6_info_destroy_rcu(struct rcu_head *head) + } + } + ++ lwtstate_put(f6i->fib6_nh.nh_lwtstate); ++ + if (f6i->fib6_nh.nh_dev) + dev_put(f6i->fib6_nh.nh_dev); + +@@ -987,7 +989,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, + fib6_clean_expires(iter); + else + fib6_set_expires(iter, rt->expires); +- fib6_metric_set(iter, RTAX_MTU, rt->fib6_pmtu); ++ ++ if (rt->fib6_pmtu) ++ fib6_metric_set(iter, RTAX_MTU, ++ rt->fib6_pmtu); + return -EEXIST; + } + /* If we have the same destination and the same metric, +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index cd2cfb04e5d8..7ec997fcbc43 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1776,6 +1776,7 @@ static void ip6gre_netlink_parms(struct nlattr *data[], + if (data[IFLA_GRE_COLLECT_METADATA]) + parms->collect_md = true; + ++ parms->erspan_ver = 1; + if (data[IFLA_GRE_ERSPAN_VER]) + parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]); + +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index c72ae3a4fe09..c31a7c4a9249 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -481,7 +481,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + } + + mtu = dst_mtu(dst); +- if (!skb->ignore_df && skb->len > mtu) { ++ if (skb->len > mtu) { + skb_dst_update_pmtu(skb, mtu); + + if (skb->protocol == htons(ETH_P_IPV6)) { +@@ -1102,7 +1102,8 @@ static void __net_exit vti6_destroy_tunnels(struct vti6_net *ip6n, + } + + t = rtnl_dereference(ip6n->tnls_wc[0]); +- unregister_netdevice_queue(t->dev, list); ++ if (t) ++ unregister_netdevice_queue(t->dev, list); + } + + static int __net_init vti6_init_net(struct net *net) +@@ -1114,6 +1115,8 @@ static int __net_init vti6_init_net(struct net *net) + ip6n->tnls[0] = ip6n->tnls_wc; + ip6n->tnls[1] = ip6n->tnls_r_l; + ++ if (!net_has_fallback_tunnels(net)) ++ return 0; + err = -ENOMEM; + ip6n->fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6_vti0", + NET_NAME_UNKNOWN, vti6_dev_setup); +diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c +index 0fe61ede77c6..c3c6b09acdc4 100644 +--- a/net/ipv6/netfilter/ip6t_rpfilter.c ++++ b/net/ipv6/netfilter/ip6t_rpfilter.c +@@ -26,6 +26,12 @@ static bool rpfilter_addr_unicast(const struct in6_addr *addr) + return addr_type & IPV6_ADDR_UNICAST; + } + ++static bool rpfilter_addr_linklocal(const struct in6_addr *addr) ++{ ++ int addr_type = ipv6_addr_type(addr); ++ return addr_type & IPV6_ADDR_LINKLOCAL; ++} ++ + static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, + const struct net_device *dev, u8 flags) + { +@@ -48,7 +54,11 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, + } + + fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; +- if ((flags & XT_RPFILTER_LOOSE) == 0) ++ ++ if (rpfilter_addr_linklocal(&iph->saddr)) { ++ lookup_flags |= RT6_LOOKUP_F_IFACE; ++ fl6.flowi6_oif = dev->ifindex; ++ } else if ((flags & XT_RPFILTER_LOOSE) == 0) + fl6.flowi6_oif = dev->ifindex; + + rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags); +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 7208c16302f6..18e00ce1719a 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -956,7 +956,7 @@ static void ip6_rt_init_dst(struct rt6_info *rt, struct fib6_info *ort) + rt->dst.error = 0; + rt->dst.output = ip6_output; + +- if (ort->fib6_type == RTN_LOCAL) { ++ if (ort->fib6_type == RTN_LOCAL || ort->fib6_type == RTN_ANYCAST) { + rt->dst.input = ip6_input; + } else if (ipv6_addr_type(&ort->fib6_dst.addr) & IPV6_ADDR_MULTICAST) { + rt->dst.input = ip6_mc_input; +@@ -996,7 +996,6 @@ static void ip6_rt_copy_init(struct rt6_info *rt, struct fib6_info *ort) + rt->rt6i_src = ort->fib6_src; + #endif + rt->rt6i_prefsrc = ort->fib6_prefsrc; +- rt->dst.lwtstate = lwtstate_get(ort->fib6_nh.nh_lwtstate); + } + + static struct fib6_node* fib6_backtrack(struct fib6_node *fn, +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 0679dd101e72..7ca926a03b81 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1972,13 +1972,20 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int + if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) { + /* the destination server is not available */ + +- if (sysctl_expire_nodest_conn(ipvs)) { ++ __u32 flags = cp->flags; ++ ++ /* when timer already started, silently drop the packet.*/ ++ if (timer_pending(&cp->timer)) ++ __ip_vs_conn_put(cp); ++ else ++ ip_vs_conn_put(cp); ++ ++ if (sysctl_expire_nodest_conn(ipvs) && ++ !(flags & IP_VS_CONN_F_ONE_PACKET)) { + /* try to expire the connection immediately */ + ip_vs_conn_expire_now(cp); + } +- /* don't restart its timer, and silently +- drop the packet. */ +- __ip_vs_conn_put(cp); ++ + return NF_DROP; + } + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 20a2e37c76d1..e952eedf44b4 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -821,6 +821,21 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[]) + #endif + } + ++static int ctnetlink_start(struct netlink_callback *cb) ++{ ++ const struct nlattr * const *cda = cb->data; ++ struct ctnetlink_filter *filter = NULL; ++ ++ if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) { ++ filter = ctnetlink_alloc_filter(cda); ++ if (IS_ERR(filter)) ++ return PTR_ERR(filter); ++ } ++ ++ cb->data = filter; ++ return 0; ++} ++ + static int ctnetlink_filter_match(struct nf_conn *ct, void *data) + { + struct ctnetlink_filter *filter = data; +@@ -1240,19 +1255,12 @@ static int ctnetlink_get_conntrack(struct net *net, struct sock *ctnl, + + if (nlh->nlmsg_flags & NLM_F_DUMP) { + struct netlink_dump_control c = { ++ .start = ctnetlink_start, + .dump = ctnetlink_dump_table, + .done = ctnetlink_done, ++ .data = (void *)cda, + }; + +- if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) { +- struct ctnetlink_filter *filter; +- +- filter = ctnetlink_alloc_filter(cda); +- if (IS_ERR(filter)) +- return PTR_ERR(filter); +- +- c.data = filter; +- } + return netlink_dump_start(ctnl, skb, nlh, &c); + } + +diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c +index a0e5adf0b3b6..8fa8bf7c48e6 100644 +--- a/net/netfilter/nfnetlink_acct.c ++++ b/net/netfilter/nfnetlink_acct.c +@@ -238,29 +238,33 @@ static const struct nla_policy filter_policy[NFACCT_FILTER_MAX + 1] = { + [NFACCT_FILTER_VALUE] = { .type = NLA_U32 }, + }; + +-static struct nfacct_filter * +-nfacct_filter_alloc(const struct nlattr * const attr) ++static int nfnl_acct_start(struct netlink_callback *cb) + { +- struct nfacct_filter *filter; ++ const struct nlattr *const attr = cb->data; + struct nlattr *tb[NFACCT_FILTER_MAX + 1]; ++ struct nfacct_filter *filter; + int err; + ++ if (!attr) ++ return 0; ++ + err = nla_parse_nested(tb, NFACCT_FILTER_MAX, attr, filter_policy, + NULL); + if (err < 0) +- return ERR_PTR(err); ++ return err; + + if (!tb[NFACCT_FILTER_MASK] || !tb[NFACCT_FILTER_VALUE]) +- return ERR_PTR(-EINVAL); ++ return -EINVAL; + + filter = kzalloc(sizeof(struct nfacct_filter), GFP_KERNEL); + if (!filter) +- return ERR_PTR(-ENOMEM); ++ return -ENOMEM; + + filter->mask = ntohl(nla_get_be32(tb[NFACCT_FILTER_MASK])); + filter->value = ntohl(nla_get_be32(tb[NFACCT_FILTER_VALUE])); ++ cb->data = filter; + +- return filter; ++ return 0; + } + + static int nfnl_acct_get(struct net *net, struct sock *nfnl, +@@ -275,18 +279,11 @@ static int nfnl_acct_get(struct net *net, struct sock *nfnl, + if (nlh->nlmsg_flags & NLM_F_DUMP) { + struct netlink_dump_control c = { + .dump = nfnl_acct_dump, ++ .start = nfnl_acct_start, + .done = nfnl_acct_done, ++ .data = (void *)tb[NFACCT_FILTER], + }; + +- if (tb[NFACCT_FILTER]) { +- struct nfacct_filter *filter; +- +- filter = nfacct_filter_alloc(tb[NFACCT_FILTER]); +- if (IS_ERR(filter)) +- return PTR_ERR(filter); +- +- c.data = filter; +- } + return netlink_dump_start(nfnl, skb, nlh, &c); + } + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index d0d8397c9588..aecadd471e1d 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1178,12 +1178,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) + if (sz < sizeof(*info) || sz >= XT_MAX_TABLE_SIZE) + return NULL; + +- /* __GFP_NORETRY is not fully supported by kvmalloc but it should +- * work reasonably well if sz is too large and bail out rather +- * than shoot all processes down before realizing there is nothing +- * more to reclaim. +- */ +- info = kvmalloc(sz, GFP_KERNEL | __GFP_NORETRY); ++ info = kvmalloc(sz, GFP_KERNEL_ACCOUNT); + if (!info) + return NULL; + +diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c +index d152e48ea371..8596eed6d9a8 100644 +--- a/net/rds/ib_frmr.c ++++ b/net/rds/ib_frmr.c +@@ -61,6 +61,7 @@ static struct rds_ib_mr *rds_ib_alloc_frmr(struct rds_ib_device *rds_ibdev, + pool->fmr_attr.max_pages); + if (IS_ERR(frmr->mr)) { + pr_warn("RDS/IB: %s failed to allocate MR", __func__); ++ err = PTR_ERR(frmr->mr); + goto out_no_cigar; + } + +diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c +index 20d7d36b2fc9..005cb21348c9 100644 +--- a/net/sched/act_ife.c ++++ b/net/sched/act_ife.c +@@ -265,10 +265,8 @@ static const char *ife_meta_id2name(u32 metaid) + #endif + + /* called when adding new meta information +- * under ife->tcf_lock for existing action + */ +-static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid, +- void *val, int len, bool exists) ++static int load_metaops_and_vet(u32 metaid, void *val, int len) + { + struct tcf_meta_ops *ops = find_ife_oplist(metaid); + int ret = 0; +@@ -276,13 +274,9 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid, + if (!ops) { + ret = -ENOENT; + #ifdef CONFIG_MODULES +- if (exists) +- spin_unlock_bh(&ife->tcf_lock); + rtnl_unlock(); + request_module("ife-meta-%s", ife_meta_id2name(metaid)); + rtnl_lock(); +- if (exists) +- spin_lock_bh(&ife->tcf_lock); + ops = find_ife_oplist(metaid); + #endif + } +@@ -299,24 +293,17 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid, + } + + /* called when adding new meta information +- * under ife->tcf_lock for existing action + */ +-static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval, +- int len, bool atomic) ++static int __add_metainfo(const struct tcf_meta_ops *ops, ++ struct tcf_ife_info *ife, u32 metaid, void *metaval, ++ int len, bool atomic, bool exists) + { + struct tcf_meta_info *mi = NULL; +- struct tcf_meta_ops *ops = find_ife_oplist(metaid); + int ret = 0; + +- if (!ops) +- return -ENOENT; +- + mi = kzalloc(sizeof(*mi), atomic ? GFP_ATOMIC : GFP_KERNEL); +- if (!mi) { +- /*put back what find_ife_oplist took */ +- module_put(ops->owner); ++ if (!mi) + return -ENOMEM; +- } + + mi->metaid = metaid; + mi->ops = ops; +@@ -324,17 +311,49 @@ static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval, + ret = ops->alloc(mi, metaval, atomic ? GFP_ATOMIC : GFP_KERNEL); + if (ret != 0) { + kfree(mi); +- module_put(ops->owner); + return ret; + } + } + ++ if (exists) ++ spin_lock_bh(&ife->tcf_lock); + list_add_tail(&mi->metalist, &ife->metalist); ++ if (exists) ++ spin_unlock_bh(&ife->tcf_lock); + + return ret; + } + +-static int use_all_metadata(struct tcf_ife_info *ife) ++static int add_metainfo_and_get_ops(const struct tcf_meta_ops *ops, ++ struct tcf_ife_info *ife, u32 metaid, ++ bool exists) ++{ ++ int ret; ++ ++ if (!try_module_get(ops->owner)) ++ return -ENOENT; ++ ret = __add_metainfo(ops, ife, metaid, NULL, 0, true, exists); ++ if (ret) ++ module_put(ops->owner); ++ return ret; ++} ++ ++static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval, ++ int len, bool exists) ++{ ++ const struct tcf_meta_ops *ops = find_ife_oplist(metaid); ++ int ret; ++ ++ if (!ops) ++ return -ENOENT; ++ ret = __add_metainfo(ops, ife, metaid, metaval, len, false, exists); ++ if (ret) ++ /*put back what find_ife_oplist took */ ++ module_put(ops->owner); ++ return ret; ++} ++ ++static int use_all_metadata(struct tcf_ife_info *ife, bool exists) + { + struct tcf_meta_ops *o; + int rc = 0; +@@ -342,7 +361,7 @@ static int use_all_metadata(struct tcf_ife_info *ife) + + read_lock(&ife_mod_lock); + list_for_each_entry(o, &ifeoplist, list) { +- rc = add_metainfo(ife, o->metaid, NULL, 0, true); ++ rc = add_metainfo_and_get_ops(o, ife, o->metaid, exists); + if (rc == 0) + installed += 1; + } +@@ -393,7 +412,6 @@ static void _tcf_ife_cleanup(struct tc_action *a) + struct tcf_meta_info *e, *n; + + list_for_each_entry_safe(e, n, &ife->metalist, metalist) { +- module_put(e->ops->owner); + list_del(&e->metalist); + if (e->metaval) { + if (e->ops->release) +@@ -401,6 +419,7 @@ static void _tcf_ife_cleanup(struct tc_action *a) + else + kfree(e->metaval); + } ++ module_put(e->ops->owner); + kfree(e); + } + } +@@ -419,7 +438,6 @@ static void tcf_ife_cleanup(struct tc_action *a) + kfree_rcu(p, rcu); + } + +-/* under ife->tcf_lock for existing action */ + static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb, + bool exists) + { +@@ -433,7 +451,7 @@ static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb, + val = nla_data(tb[i]); + len = nla_len(tb[i]); + +- rc = load_metaops_and_vet(ife, i, val, len, exists); ++ rc = load_metaops_and_vet(i, val, len); + if (rc != 0) + return rc; + +@@ -531,8 +549,6 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla, + p->eth_type = ife_type; + } + +- if (exists) +- spin_lock_bh(&ife->tcf_lock); + + if (ret == ACT_P_CREATED) + INIT_LIST_HEAD(&ife->metalist); +@@ -544,9 +560,6 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla, + metadata_parse_err: + if (ret == ACT_P_CREATED) + tcf_idr_release(*a, bind); +- +- if (exists) +- spin_unlock_bh(&ife->tcf_lock); + kfree(p); + return err; + } +@@ -561,18 +574,17 @@ metadata_parse_err: + * as we can. You better have at least one else we are + * going to bail out + */ +- err = use_all_metadata(ife); ++ err = use_all_metadata(ife, exists); + if (err) { + if (ret == ACT_P_CREATED) + tcf_idr_release(*a, bind); +- +- if (exists) +- spin_unlock_bh(&ife->tcf_lock); + kfree(p); + return err; + } + } + ++ if (exists) ++ spin_lock_bh(&ife->tcf_lock); + ife->tcf_action = parm->action; + if (exists) + spin_unlock_bh(&ife->tcf_lock); +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index 8a925c72db5f..bad475c87688 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -109,16 +109,18 @@ static int tcf_pedit_key_ex_dump(struct sk_buff *skb, + { + struct nlattr *keys_start = nla_nest_start(skb, TCA_PEDIT_KEYS_EX); + ++ if (!keys_start) ++ goto nla_failure; + for (; n > 0; n--) { + struct nlattr *key_start; + + key_start = nla_nest_start(skb, TCA_PEDIT_KEY_EX); ++ if (!key_start) ++ goto nla_failure; + + if (nla_put_u16(skb, TCA_PEDIT_KEY_EX_HTYPE, keys_ex->htype) || +- nla_put_u16(skb, TCA_PEDIT_KEY_EX_CMD, keys_ex->cmd)) { +- nlmsg_trim(skb, keys_start); +- return -EINVAL; +- } ++ nla_put_u16(skb, TCA_PEDIT_KEY_EX_CMD, keys_ex->cmd)) ++ goto nla_failure; + + nla_nest_end(skb, key_start); + +@@ -128,6 +130,9 @@ static int tcf_pedit_key_ex_dump(struct sk_buff *skb, + nla_nest_end(skb, keys_start); + + return 0; ++nla_failure: ++ nla_nest_cancel(skb, keys_start); ++ return -EINVAL; + } + + static int tcf_pedit_init(struct net *net, struct nlattr *nla, +@@ -395,7 +400,10 @@ static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a, + opt->bindcnt = p->tcf_bindcnt - bind; + + if (p->tcfp_keys_ex) { +- tcf_pedit_key_ex_dump(skb, p->tcfp_keys_ex, p->tcfp_nkeys); ++ if (tcf_pedit_key_ex_dump(skb, ++ p->tcfp_keys_ex, ++ p->tcfp_nkeys)) ++ goto nla_put_failure; + + if (nla_put(skb, TCA_PEDIT_PARMS_EX, s, opt)) + goto nla_put_failure; +diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c +index fb861f90fde6..260749956ef3 100644 +--- a/net/sched/cls_u32.c ++++ b/net/sched/cls_u32.c +@@ -912,6 +912,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, + struct nlattr *opt = tca[TCA_OPTIONS]; + struct nlattr *tb[TCA_U32_MAX + 1]; + u32 htid, flags = 0; ++ size_t sel_size; + int err; + #ifdef CONFIG_CLS_U32_PERF + size_t size; +@@ -1074,8 +1075,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, + } + + s = nla_data(tb[TCA_U32_SEL]); ++ sel_size = struct_size(s, keys, s->nkeys); ++ if (nla_len(tb[TCA_U32_SEL]) < sel_size) { ++ err = -EINVAL; ++ goto erridr; ++ } + +- n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL); ++ n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL); + if (n == NULL) { + err = -ENOBUFS; + goto erridr; +@@ -1090,7 +1096,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, + } + #endif + +- memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key)); ++ memcpy(&n->sel, s, sel_size); + RCU_INIT_POINTER(n->ht_up, ht); + n->handle = handle; + n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0; +diff --git a/net/sctp/proc.c b/net/sctp/proc.c +index ef5c9a82d4e8..a644292f9faf 100644 +--- a/net/sctp/proc.c ++++ b/net/sctp/proc.c +@@ -215,7 +215,6 @@ static const struct seq_operations sctp_eps_ops = { + struct sctp_ht_iter { + struct seq_net_private p; + struct rhashtable_iter hti; +- int start_fail; + }; + + static void *sctp_transport_seq_start(struct seq_file *seq, loff_t *pos) +@@ -224,7 +223,6 @@ static void *sctp_transport_seq_start(struct seq_file *seq, loff_t *pos) + + sctp_transport_walk_start(&iter->hti); + +- iter->start_fail = 0; + return sctp_transport_get_idx(seq_file_net(seq), &iter->hti, *pos); + } + +@@ -232,8 +230,6 @@ static void sctp_transport_seq_stop(struct seq_file *seq, void *v) + { + struct sctp_ht_iter *iter = seq->private; + +- if (iter->start_fail) +- return; + sctp_transport_walk_stop(&iter->hti); + } + +@@ -264,8 +260,6 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v) + } + + transport = (struct sctp_transport *)v; +- if (!sctp_transport_hold(transport)) +- return 0; + assoc = transport->asoc; + epb = &assoc->base; + sk = epb->sk; +@@ -322,8 +316,6 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v) + } + + transport = (struct sctp_transport *)v; +- if (!sctp_transport_hold(transport)) +- return 0; + assoc = transport->asoc; + + list_for_each_entry_rcu(tsp, &assoc->peer.transport_addr_list, +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index ce620e878538..50ee07cd20c4 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4881,9 +4881,14 @@ struct sctp_transport *sctp_transport_get_next(struct net *net, + break; + } + ++ if (!sctp_transport_hold(t)) ++ continue; ++ + if (net_eq(sock_net(t->asoc->base.sk), net) && + t->asoc->peer.primary_path == t) + break; ++ ++ sctp_transport_put(t); + } + + return t; +@@ -4893,13 +4898,18 @@ struct sctp_transport *sctp_transport_get_idx(struct net *net, + struct rhashtable_iter *iter, + int pos) + { +- void *obj = SEQ_START_TOKEN; ++ struct sctp_transport *t; + +- while (pos && (obj = sctp_transport_get_next(net, iter)) && +- !IS_ERR(obj)) +- pos--; ++ if (!pos) ++ return SEQ_START_TOKEN; + +- return obj; ++ while ((t = sctp_transport_get_next(net, iter)) && !IS_ERR(t)) { ++ if (!--pos) ++ break; ++ sctp_transport_put(t); ++ } ++ ++ return t; + } + + int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), +@@ -4958,8 +4968,6 @@ again: + + tsp = sctp_transport_get_idx(net, &hti, *pos + 1); + for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) { +- if (!sctp_transport_hold(tsp)) +- continue; + ret = cb(tsp, p); + if (ret) + break; +diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c +index 8654494b4d0a..834eb2b9e41b 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c ++++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c +@@ -169,7 +169,7 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen, + struct scatterlist sg[1]; + int err = -1; + u8 *checksumdata; +- u8 rc4salt[4]; ++ u8 *rc4salt; + struct crypto_ahash *md5; + struct crypto_ahash *hmac_md5; + struct ahash_request *req; +@@ -183,14 +183,18 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen, + return GSS_S_FAILURE; + } + ++ rc4salt = kmalloc_array(4, sizeof(*rc4salt), GFP_NOFS); ++ if (!rc4salt) ++ return GSS_S_FAILURE; ++ + if (arcfour_hmac_md5_usage_to_salt(usage, rc4salt)) { + dprintk("%s: invalid usage value %u\n", __func__, usage); +- return GSS_S_FAILURE; ++ goto out_free_rc4salt; + } + + checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS); + if (!checksumdata) +- return GSS_S_FAILURE; ++ goto out_free_rc4salt; + + md5 = crypto_alloc_ahash("md5", 0, CRYPTO_ALG_ASYNC); + if (IS_ERR(md5)) +@@ -258,6 +262,8 @@ out_free_md5: + crypto_free_ahash(md5); + out_free_cksum: + kfree(checksumdata); ++out_free_rc4salt: ++ kfree(rc4salt); + return err ? GSS_S_FAILURE : 0; + } + +diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c +index bebe88cae07b..ff968c7afef6 100644 +--- a/net/tipc/name_table.c ++++ b/net/tipc/name_table.c +@@ -980,20 +980,17 @@ int tipc_nl_name_table_dump(struct sk_buff *skb, struct netlink_callback *cb) + + struct tipc_dest *tipc_dest_find(struct list_head *l, u32 node, u32 port) + { +- u64 value = (u64)node << 32 | port; + struct tipc_dest *dst; + + list_for_each_entry(dst, l, list) { +- if (dst->value != value) +- continue; +- return dst; ++ if (dst->node == node && dst->port == port) ++ return dst; + } + return NULL; + } + + bool tipc_dest_push(struct list_head *l, u32 node, u32 port) + { +- u64 value = (u64)node << 32 | port; + struct tipc_dest *dst; + + if (tipc_dest_find(l, node, port)) +@@ -1002,7 +999,8 @@ bool tipc_dest_push(struct list_head *l, u32 node, u32 port) + dst = kmalloc(sizeof(*dst), GFP_ATOMIC); + if (unlikely(!dst)) + return false; +- dst->value = value; ++ dst->node = node; ++ dst->port = port; + list_add(&dst->list, l); + return true; + } +diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h +index 0febba41da86..892bd750b85f 100644 +--- a/net/tipc/name_table.h ++++ b/net/tipc/name_table.h +@@ -133,13 +133,8 @@ void tipc_nametbl_stop(struct net *net); + + struct tipc_dest { + struct list_head list; +- union { +- struct { +- u32 port; +- u32 node; +- }; +- u64 value; +- }; ++ u32 port; ++ u32 node; + }; + + struct tipc_dest *tipc_dest_find(struct list_head *l, u32 node, u32 port); +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index 930852c54d7a..0a5fa347135e 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2675,6 +2675,8 @@ void tipc_sk_reinit(struct net *net) + + rhashtable_walk_stop(&iter); + } while (tsk == ERR_PTR(-EAGAIN)); ++ ++ rhashtable_walk_exit(&iter); + } + + static struct tipc_sock *tipc_sk_lookup(struct net *net, u32 portid) +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 301f22430469..45188d920013 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -45,6 +45,7 @@ + MODULE_AUTHOR("Mellanox Technologies"); + MODULE_DESCRIPTION("Transport Layer Security Support"); + MODULE_LICENSE("Dual BSD/GPL"); ++MODULE_ALIAS_TCP_ULP("tls"); + + enum { + TLSV4, +diff --git a/samples/bpf/xdp_redirect_cpu_user.c b/samples/bpf/xdp_redirect_cpu_user.c +index 4b4d78fffe30..da9070889223 100644 +--- a/samples/bpf/xdp_redirect_cpu_user.c ++++ b/samples/bpf/xdp_redirect_cpu_user.c +@@ -679,8 +679,9 @@ int main(int argc, char **argv) + return EXIT_FAIL_OPTION; + } + +- /* Remove XDP program when program is interrupted */ ++ /* Remove XDP program when program is interrupted or killed */ + signal(SIGINT, int_exit); ++ signal(SIGTERM, int_exit); + + if (bpf_set_link_xdp_fd(ifindex, prog_fd[prog_num], xdp_flags) < 0) { + fprintf(stderr, "link set xdp fd failed\n"); +diff --git a/samples/bpf/xdp_rxq_info_user.c b/samples/bpf/xdp_rxq_info_user.c +index e4e9ba52bff0..bb278447299c 100644 +--- a/samples/bpf/xdp_rxq_info_user.c ++++ b/samples/bpf/xdp_rxq_info_user.c +@@ -534,8 +534,9 @@ int main(int argc, char **argv) + exit(EXIT_FAIL_BPF); + } + +- /* Remove XDP program when program is interrupted */ ++ /* Remove XDP program when program is interrupted or killed */ + signal(SIGINT, int_exit); ++ signal(SIGTERM, int_exit); + + if (bpf_set_link_xdp_fd(ifindex, prog_fd, xdp_flags) < 0) { + fprintf(stderr, "link set xdp fd failed\n"); +diff --git a/scripts/coccicheck b/scripts/coccicheck +index 9fedca611b7f..e04d328210ac 100755 +--- a/scripts/coccicheck ++++ b/scripts/coccicheck +@@ -128,9 +128,10 @@ run_cmd_parmap() { + fi + echo $@ >>$DEBUG_FILE + $@ 2>>$DEBUG_FILE +- if [[ $? -ne 0 ]]; then ++ err=$? ++ if [[ $err -ne 0 ]]; then + echo "coccicheck failed" +- exit $? ++ exit $err + fi + } + +diff --git a/scripts/depmod.sh b/scripts/depmod.sh +index 999d585eaa73..e5f0aad75b96 100755 +--- a/scripts/depmod.sh ++++ b/scripts/depmod.sh +@@ -15,9 +15,9 @@ if ! test -r System.map ; then + fi + + if [ -z $(command -v $DEPMOD) ]; then +- echo "'make modules_install' requires $DEPMOD. Please install it." >&2 ++ echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2 + echo "This is probably in the kmod package." >&2 +- exit 1 ++ exit 0 + fi + + # older versions of depmod require the version string to start with three +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 1663fb19343a..b95cf57782a3 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -672,7 +672,7 @@ static void handle_modversions(struct module *mod, struct elf_info *info, + if (ELF_ST_TYPE(sym->st_info) == STT_SPARC_REGISTER) + break; + if (symname[0] == '.') { +- char *munged = strdup(symname); ++ char *munged = NOFAIL(strdup(symname)); + munged[0] = '_'; + munged[1] = toupper(munged[1]); + symname = munged; +@@ -1318,7 +1318,7 @@ static Elf_Sym *find_elf_symbol2(struct elf_info *elf, Elf_Addr addr, + static char *sec2annotation(const char *s) + { + if (match(s, init_exit_sections)) { +- char *p = malloc(20); ++ char *p = NOFAIL(malloc(20)); + char *r = p; + + *p++ = '_'; +@@ -1338,7 +1338,7 @@ static char *sec2annotation(const char *s) + strcat(p, " "); + return r; + } else { +- return strdup(""); ++ return NOFAIL(strdup("")); + } + } + +@@ -2036,7 +2036,7 @@ void buf_write(struct buffer *buf, const char *s, int len) + { + if (buf->size - buf->pos < len) { + buf->size += len + SZ; +- buf->p = realloc(buf->p, buf->size); ++ buf->p = NOFAIL(realloc(buf->p, buf->size)); + } + strncpy(buf->p + buf->pos, s, len); + buf->pos += len; +diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c +index b0f9dc3f765a..1a7cec5d9cac 100644 +--- a/security/apparmor/policy_ns.c ++++ b/security/apparmor/policy_ns.c +@@ -255,7 +255,7 @@ static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name, + + ns = alloc_ns(parent->base.hname, name); + if (!ns) +- return NULL; ++ return ERR_PTR(-ENOMEM); + ns->level = parent->level + 1; + mutex_lock_nested(&ns->lock, ns->level); + error = __aafs_ns_mkdir(ns, ns_subns_dir(parent), name, dir); +diff --git a/security/keys/dh.c b/security/keys/dh.c +index b203f7758f97..1a68d27e72b4 100644 +--- a/security/keys/dh.c ++++ b/security/keys/dh.c +@@ -300,7 +300,7 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params, + } + dh_inputs.g_size = dlen; + +- dlen = dh_data_from_key(pcopy.private, &dh_inputs.key); ++ dlen = dh_data_from_key(pcopy.dh_private, &dh_inputs.key); + if (dlen < 0) { + ret = dlen; + goto out2; +diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c +index 79d3709b0671..0b66d7283b00 100644 +--- a/security/selinux/selinuxfs.c ++++ b/security/selinux/selinuxfs.c +@@ -1365,13 +1365,18 @@ static int sel_make_bools(struct selinux_fs_info *fsi) + + ret = -ENOMEM; + inode = sel_make_inode(dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR); +- if (!inode) ++ if (!inode) { ++ dput(dentry); + goto out; ++ } + + ret = -ENAMETOOLONG; + len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]); +- if (len >= PAGE_SIZE) ++ if (len >= PAGE_SIZE) { ++ dput(dentry); ++ iput(inode); + goto out; ++ } + + isec = (struct inode_security_struct *)inode->i_security; + ret = security_genfs_sid(fsi->state, "selinuxfs", page, +@@ -1586,8 +1591,10 @@ static int sel_make_avc_files(struct dentry *dir) + return -ENOMEM; + + inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode); +- if (!inode) ++ if (!inode) { ++ dput(dentry); + return -ENOMEM; ++ } + + inode->i_fop = files[i].ops; + inode->i_ino = ++fsi->last_ino; +@@ -1632,8 +1639,10 @@ static int sel_make_initcon_files(struct dentry *dir) + return -ENOMEM; + + inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO); +- if (!inode) ++ if (!inode) { ++ dput(dentry); + return -ENOMEM; ++ } + + inode->i_fop = &sel_initcon_ops; + inode->i_ino = i|SEL_INITCON_INO_OFFSET; +@@ -1733,8 +1742,10 @@ static int sel_make_perm_files(char *objclass, int classvalue, + + rc = -ENOMEM; + inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO); +- if (!inode) ++ if (!inode) { ++ dput(dentry); + goto out; ++ } + + inode->i_fop = &sel_perm_ops; + /* i+1 since perm values are 1-indexed */ +@@ -1763,8 +1774,10 @@ static int sel_make_class_dir_entries(char *classname, int index, + return -ENOMEM; + + inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO); +- if (!inode) ++ if (!inode) { ++ dput(dentry); + return -ENOMEM; ++ } + + inode->i_fop = &sel_class_ops; + inode->i_ino = sel_class_to_ino(index); +@@ -1838,8 +1851,10 @@ static int sel_make_policycap(struct selinux_fs_info *fsi) + return -ENOMEM; + + inode = sel_make_inode(fsi->sb, S_IFREG | 0444); +- if (inode == NULL) ++ if (inode == NULL) { ++ dput(dentry); + return -ENOMEM; ++ } + + inode->i_fop = &sel_policycap_ops; + inode->i_ino = iter | SEL_POLICYCAP_INO_OFFSET; +@@ -1932,8 +1947,10 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) + + ret = -ENOMEM; + inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO); +- if (!inode) ++ if (!inode) { ++ dput(dentry); + goto err; ++ } + + inode->i_ino = ++fsi->last_ino; + isec = (struct inode_security_struct *)inode->i_security; +diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c +index 8a0181a2db08..47feef30dadb 100644 +--- a/sound/soc/codecs/rt5677.c ++++ b/sound/soc/codecs/rt5677.c +@@ -5007,7 +5007,7 @@ static const struct regmap_config rt5677_regmap = { + }; + + static const struct of_device_id rt5677_of_match[] = { +- { .compatible = "realtek,rt5677", RT5677 }, ++ { .compatible = "realtek,rt5677", .data = (const void *)RT5677 }, + { } + }; + MODULE_DEVICE_TABLE(of, rt5677_of_match); +diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c +index 7fdfdf3f6e67..14f1b0c0d286 100644 +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -2432,6 +2432,7 @@ static int wm8994_set_dai_sysclk(struct snd_soc_dai *dai, + snd_soc_component_update_bits(component, WM8994_POWER_MANAGEMENT_2, + WM8994_OPCLK_ENA, 0); + } ++ break; + + default: + return -EINVAL; +diff --git a/tools/perf/arch/arm64/util/arm-spe.c b/tools/perf/arch/arm64/util/arm-spe.c +index 1120e39c1b00..5ccfce87e693 100644 +--- a/tools/perf/arch/arm64/util/arm-spe.c ++++ b/tools/perf/arch/arm64/util/arm-spe.c +@@ -194,6 +194,7 @@ struct auxtrace_record *arm_spe_recording_init(int *err, + sper->itr.read_finish = arm_spe_read_finish; + sper->itr.alignment = 0; + ++ *err = 0; + return &sper->itr; + } + +diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c +index 53d83d7e6a09..20e7d74d86cd 100644 +--- a/tools/perf/arch/powerpc/util/sym-handling.c ++++ b/tools/perf/arch/powerpc/util/sym-handling.c +@@ -141,8 +141,10 @@ void arch__post_process_probe_trace_events(struct perf_probe_event *pev, + for (i = 0; i < ntevs; i++) { + tev = &pev->tevs[i]; + map__for_each_symbol(map, sym, tmp) { +- if (map->unmap_ip(map, sym->start) == tev->point.address) ++ if (map->unmap_ip(map, sym->start) == tev->point.address) { + arch__fix_tev_from_maps(pev, tev, map, sym); ++ break; ++ } + } + } + } +diff --git a/tools/perf/util/namespaces.c b/tools/perf/util/namespaces.c +index 5be021701f34..cf8bd123cf73 100644 +--- a/tools/perf/util/namespaces.c ++++ b/tools/perf/util/namespaces.c +@@ -139,6 +139,9 @@ struct nsinfo *nsinfo__copy(struct nsinfo *nsi) + { + struct nsinfo *nnsi; + ++ if (nsi == NULL) ++ return NULL; ++ + nnsi = calloc(1, sizeof(*nnsi)); + if (nnsi != NULL) { + nnsi->pid = nsi->pid; +diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c +index 66d31de60b9a..9d7166dfad1e 100644 +--- a/tools/testing/selftests/powerpc/harness.c ++++ b/tools/testing/selftests/powerpc/harness.c +@@ -85,13 +85,13 @@ wait: + return status; + } + +-static void alarm_handler(int signum) ++static void sig_handler(int signum) + { +- /* Jut wake us up from waitpid */ ++ /* Just wake us up from waitpid */ + } + +-static struct sigaction alarm_action = { +- .sa_handler = alarm_handler, ++static struct sigaction sig_action = { ++ .sa_handler = sig_handler, + }; + + void test_harness_set_timeout(uint64_t time) +@@ -106,8 +106,14 @@ int test_harness(int (test_function)(void), char *name) + test_start(name); + test_set_git_version(GIT_VERSION); + +- if (sigaction(SIGALRM, &alarm_action, NULL)) { +- perror("sigaction"); ++ if (sigaction(SIGINT, &sig_action, NULL)) { ++ perror("sigaction (sigint)"); ++ test_error(name); ++ return 1; ++ } ++ ++ if (sigaction(SIGALRM, &sig_action, NULL)) { ++ perror("sigaction (sigalrm)"); + test_error(name); + return 1; + }