diff --git a/patch/kernel/sunxi-dev/0139-Bluetooth-Add-new-quirk-for-broken-local-ext-feature.patch.disabled b/patch/kernel/sunxi-dev/0139-Bluetooth-Add-new-quirk-for-broken-local-ext-feature.patch similarity index 100% rename from patch/kernel/sunxi-dev/0139-Bluetooth-Add-new-quirk-for-broken-local-ext-feature.patch.disabled rename to patch/kernel/sunxi-dev/0139-Bluetooth-Add-new-quirk-for-broken-local-ext-feature.patch diff --git a/patch/kernel/sunxi-dev/0140-Bluetooth-hci_h5-Add-support-for-reset-GPIO.patch.disabled b/patch/kernel/sunxi-dev/0140-Bluetooth-hci_h5-Add-support-for-reset-GPIO.patch similarity index 100% rename from patch/kernel/sunxi-dev/0140-Bluetooth-hci_h5-Add-support-for-reset-GPIO.patch.disabled rename to patch/kernel/sunxi-dev/0140-Bluetooth-hci_h5-Add-support-for-reset-GPIO.patch diff --git a/patch/kernel/sunxi-dev/0141-dt-bindings-net-bluetooth-Add-rtl8723bs-bluetooth.patch.disabled b/patch/kernel/sunxi-dev/0141-dt-bindings-net-bluetooth-Add-rtl8723bs-bluetooth.patch similarity index 100% rename from patch/kernel/sunxi-dev/0141-dt-bindings-net-bluetooth-Add-rtl8723bs-bluetooth.patch.disabled rename to patch/kernel/sunxi-dev/0141-dt-bindings-net-bluetooth-Add-rtl8723bs-bluetooth.patch diff --git a/patch/kernel/sunxi-dev/0143-Bluetooth-btrtl-add-support-for-the-RTL8723CS.patch.disabled b/patch/kernel/sunxi-dev/0143-Bluetooth-btrtl-add-support-for-the-RTL8723CS.patch similarity index 100% rename from patch/kernel/sunxi-dev/0143-Bluetooth-btrtl-add-support-for-the-RTL8723CS.patch.disabled rename to patch/kernel/sunxi-dev/0143-Bluetooth-btrtl-add-support-for-the-RTL8723CS.patch diff --git a/patch/kernel/sunxi-dev/0144-arm64-allwinner-a64-enable-Bluetooth-On-Pinebook.patch.disabled b/patch/kernel/sunxi-dev/0144-arm64-allwinner-a64-enable-Bluetooth-On-Pinebook.patch similarity index 100% rename from patch/kernel/sunxi-dev/0144-arm64-allwinner-a64-enable-Bluetooth-On-Pinebook.patch.disabled rename to patch/kernel/sunxi-dev/0144-arm64-allwinner-a64-enable-Bluetooth-On-Pinebook.patch diff --git a/patch/kernel/sunxi-dev/0145-arm64-allwinner-a64-enable-Bluetooth-On-Pine64.patch.disabled b/patch/kernel/sunxi-dev/0145-arm64-allwinner-a64-enable-Bluetooth-On-Pine64.patch similarity index 100% rename from patch/kernel/sunxi-dev/0145-arm64-allwinner-a64-enable-Bluetooth-On-Pine64.patch.disabled rename to patch/kernel/sunxi-dev/0145-arm64-allwinner-a64-enable-Bluetooth-On-Pine64.patch diff --git a/patch/kernel/sunxi-dev/0146-arm64-allwinner-a64-enable-Bluetooth-On-SoPine-baseb.patch.disabled b/patch/kernel/sunxi-dev/0146-arm64-allwinner-a64-enable-Bluetooth-On-SoPine-baseb.patch similarity index 100% rename from patch/kernel/sunxi-dev/0146-arm64-allwinner-a64-enable-Bluetooth-On-SoPine-baseb.patch.disabled rename to patch/kernel/sunxi-dev/0146-arm64-allwinner-a64-enable-Bluetooth-On-SoPine-baseb.patch diff --git a/patch/kernel/sunxi-dev/board-h6-clk-sunxi-ng-fix-H6-bus-clocks-divider-position.patch b/patch/kernel/sunxi-dev/board-h6-clk-sunxi-ng-fix-H6-bus-clocks-divider-position.patch deleted file mode 100644 index b2c882d83..000000000 --- a/patch/kernel/sunxi-dev/board-h6-clk-sunxi-ng-fix-H6-bus-clocks-divider-position.patch +++ /dev/null @@ -1,36 +0,0 @@ -diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c -index bdbfe78fe133..0f7a0ffd3f70 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c -+++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c -@@ -224,7 +224,7 @@ static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ahb2_clk, "psi-ahb1-ahb2", - psi_ahb1_ahb2_parents, - 0x510, - 0, 5, /* M */ -- 16, 2, /* P */ -+ 8, 2, /* P */ - 24, 2, /* mux */ - 0); - -@@ -233,19 +233,19 @@ static const char * const ahb3_apb1_apb2_parents[] = { "osc24M", "osc32k", - "pll-periph0" }; - static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c, - 0, 5, /* M */ -- 16, 2, /* P */ -+ 8, 2, /* P */ - 24, 2, /* mux */ - 0); - - static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520, - 0, 5, /* M */ -- 16, 2, /* P */ -+ 8, 2, /* P */ - 24, 2, /* mux */ - 0); - - static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524, - 0, 5, /* M */ -- 16, 2, /* P */ -+ 8, 2, /* P */ - 24, 2, /* mux */ - 0); - diff --git a/patch/kernel/sunxi-dev/patch-4.19.2-3.patch b/patch/kernel/sunxi-dev/patch-4.19.2-3.patch new file mode 100644 index 000000000..3650f86f0 --- /dev/null +++ b/patch/kernel/sunxi-dev/patch-4.19.2-3.patch @@ -0,0 +1,6344 @@ +diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt +index 51c136c821bf..eef7d9d259e8 100644 +--- a/Documentation/filesystems/overlayfs.txt ++++ b/Documentation/filesystems/overlayfs.txt +@@ -286,6 +286,12 @@ pointed by REDIRECT. This should not be possible on local system as setting + "trusted." xattrs will require CAP_SYS_ADMIN. But it should be possible + for untrusted layers like from a pen drive. + ++Note: redirect_dir={off|nofollow|follow(*)} conflicts with metacopy=on, and ++results in an error. ++ ++(*) redirect_dir=follow only conflicts with metacopy=on if upperdir=... is ++given. ++ + Sharing and copying layers + -------------------------- + +diff --git a/Makefile b/Makefile +index c8fe567f18ab..e4064fa16f11 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 2 ++SUBLEVEL = 3 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/alpha/include/asm/termios.h b/arch/alpha/include/asm/termios.h +index 6a8c53dec57e..b7c77bb1bfd2 100644 +--- a/arch/alpha/include/asm/termios.h ++++ b/arch/alpha/include/asm/termios.h +@@ -73,9 +73,15 @@ + }) + + #define user_termios_to_kernel_termios(k, u) \ +- copy_from_user(k, u, sizeof(struct termios)) ++ copy_from_user(k, u, sizeof(struct termios2)) + + #define kernel_termios_to_user_termios(u, k) \ ++ copy_to_user(u, k, sizeof(struct termios2)) ++ ++#define user_termios_to_kernel_termios_1(k, u) \ ++ copy_from_user(k, u, sizeof(struct termios)) ++ ++#define kernel_termios_to_user_termios_1(u, k) \ + copy_to_user(u, k, sizeof(struct termios)) + + #endif /* _ALPHA_TERMIOS_H */ +diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h +index 3729d92d3fa8..dc8c20ac7191 100644 +--- a/arch/alpha/include/uapi/asm/ioctls.h ++++ b/arch/alpha/include/uapi/asm/ioctls.h +@@ -32,6 +32,11 @@ + #define TCXONC _IO('t', 30) + #define TCFLSH _IO('t', 31) + ++#define TCGETS2 _IOR('T', 42, struct termios2) ++#define TCSETS2 _IOW('T', 43, struct termios2) ++#define TCSETSW2 _IOW('T', 44, struct termios2) ++#define TCSETSF2 _IOW('T', 45, struct termios2) ++ + #define TIOCSWINSZ _IOW('t', 103, struct winsize) + #define TIOCGWINSZ _IOR('t', 104, struct winsize) + #define TIOCSTART _IO('t', 110) /* start output, like ^Q */ +diff --git a/arch/alpha/include/uapi/asm/termbits.h b/arch/alpha/include/uapi/asm/termbits.h +index de6c8360fbe3..4575ba34a0ea 100644 +--- a/arch/alpha/include/uapi/asm/termbits.h ++++ b/arch/alpha/include/uapi/asm/termbits.h +@@ -26,6 +26,19 @@ struct termios { + speed_t c_ospeed; /* output speed */ + }; + ++/* Alpha has identical termios and termios2 */ ++ ++struct termios2 { ++ tcflag_t c_iflag; /* input mode flags */ ++ tcflag_t c_oflag; /* output mode flags */ ++ tcflag_t c_cflag; /* control mode flags */ ++ tcflag_t c_lflag; /* local mode flags */ ++ cc_t c_cc[NCCS]; /* control characters */ ++ cc_t c_line; /* line discipline (== c_cc[19]) */ ++ speed_t c_ispeed; /* input speed */ ++ speed_t c_ospeed; /* output speed */ ++}; ++ + /* Alpha has matching termios and ktermios */ + + struct ktermios { +@@ -152,6 +165,7 @@ struct ktermios { + #define B3000000 00034 + #define B3500000 00035 + #define B4000000 00036 ++#define BOTHER 00037 + + #define CSIZE 00001400 + #define CS5 00000000 +@@ -169,6 +183,9 @@ struct ktermios { + #define CMSPAR 010000000000 /* mark or space (stick) parity */ + #define CRTSCTS 020000000000 /* flow control */ + ++#define CIBAUD 07600000 ++#define IBSHIFT 16 ++ + /* c_lflag bits */ + #define ISIG 0x00000080 + #define ICANON 0x00000100 +diff --git a/arch/arm/boot/dts/imx6ull-pinfunc.h b/arch/arm/boot/dts/imx6ull-pinfunc.h +index fdc46bb09cc1..3c12a6fb0b61 100644 +--- a/arch/arm/boot/dts/imx6ull-pinfunc.h ++++ b/arch/arm/boot/dts/imx6ull-pinfunc.h +@@ -14,14 +14,23 @@ + * The pin function ID is a tuple of + * + */ ++/* signals common for i.MX6UL and i.MX6ULL */ ++#undef MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX ++#define MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6 ++#undef MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX ++#define MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7 ++#undef MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS ++#define MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5 ++#undef MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS ++#define MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6 ++#undef MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS ++#define MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7 ++ ++/* signals for i.MX6ULL only */ + #define MX6ULL_PAD_UART1_TX_DATA__UART5_DTE_RX 0x0084 0x0310 0x0644 0x9 0x4 + #define MX6ULL_PAD_UART1_RX_DATA__UART5_DCE_RX 0x0088 0x0314 0x0644 0x9 0x5 + #define MX6ULL_PAD_UART1_CTS_B__UART5_DCE_RTS 0x008C 0x0318 0x0640 0x9 0x3 + #define MX6ULL_PAD_UART1_RTS_B__UART5_DTE_RTS 0x0090 0x031C 0x0640 0x9 0x4 +-#define MX6ULL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6 +-#define MX6ULL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7 +-#define MX6ULL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5 +-#define MX6ULL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6 + #define MX6ULL_PAD_ENET2_RX_DATA0__EPDC_SDDO08 0x00E4 0x0370 0x0000 0x9 0x0 + #define MX6ULL_PAD_ENET2_RX_DATA1__EPDC_SDDO09 0x00E8 0x0374 0x0000 0x9 0x0 + #define MX6ULL_PAD_ENET2_RX_EN__EPDC_SDDO10 0x00EC 0x0378 0x0000 0x9 0x0 +@@ -55,7 +64,6 @@ + #define MX6ULL_PAD_CSI_DATA00__ESAI_TX_HF_CLK 0x01E4 0x0470 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA01__ESAI_RX_HF_CLK 0x01E8 0x0474 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA02__ESAI_RX_FS 0x01EC 0x0478 0x0000 0x9 0x0 +-#define MX6ULL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7 + #define MX6ULL_PAD_CSI_DATA03__ESAI_RX_CLK 0x01F0 0x047C 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0 +diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig +index 7eca43ff69bb..f4c2e993bba3 100644 +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -409,6 +409,7 @@ CONFIG_ZISOFS=y + CONFIG_UDF_FS=m + CONFIG_MSDOS_FS=m + CONFIG_VFAT_FS=y ++CONFIG_TMPFS_POSIX_ACL=y + CONFIG_JFFS2_FS=y + CONFIG_UBIFS_FS=y + CONFIG_NFS_FS=y +diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S +index 6fe52819e014..339eb17c9808 100644 +--- a/arch/arm/mm/proc-v7.S ++++ b/arch/arm/mm/proc-v7.S +@@ -112,7 +112,7 @@ ENTRY(cpu_v7_hvc_switch_mm) + hvc #0 + ldmfd sp!, {r0 - r3} + b cpu_v7_switch_mm +-ENDPROC(cpu_v7_smc_switch_mm) ++ENDPROC(cpu_v7_hvc_switch_mm) + #endif + ENTRY(cpu_v7_iciallu_switch_mm) + mov r3, #0 +diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi +index bc6c141d7372..5089aa64088f 100644 +--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi ++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi +@@ -137,6 +137,9 @@ + reset-names = "stmmaceth", "stmmaceth-ocp"; + clocks = <&clkmgr STRATIX10_EMAC0_CLK>; + clock-names = "stmmaceth"; ++ tx-fifo-depth = <16384>; ++ rx-fifo-depth = <16384>; ++ snps,multicast-filter-bins = <256>; + status = "disabled"; + }; + +@@ -150,6 +153,9 @@ + reset-names = "stmmaceth", "stmmaceth-ocp"; + clocks = <&clkmgr STRATIX10_EMAC1_CLK>; + clock-names = "stmmaceth"; ++ tx-fifo-depth = <16384>; ++ rx-fifo-depth = <16384>; ++ snps,multicast-filter-bins = <256>; + status = "disabled"; + }; + +@@ -163,6 +169,9 @@ + reset-names = "stmmaceth", "stmmaceth-ocp"; + clocks = <&clkmgr STRATIX10_EMAC2_CLK>; + clock-names = "stmmaceth"; ++ tx-fifo-depth = <16384>; ++ rx-fifo-depth = <16384>; ++ snps,multicast-filter-bins = <256>; + status = "disabled"; + }; + +diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts +index 6edc4fa9fd42..7c661753bfaf 100644 +--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts ++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts +@@ -76,7 +76,7 @@ + phy-mode = "rgmii"; + phy-handle = <&phy0>; + +- max-frame-size = <3800>; ++ max-frame-size = <9000>; + + mdio0 { + #address-cells = <1>; +diff --git a/arch/mips/include/asm/mach-loongson64/irq.h b/arch/mips/include/asm/mach-loongson64/irq.h +index 3644b68c0ccc..be9f727a9328 100644 +--- a/arch/mips/include/asm/mach-loongson64/irq.h ++++ b/arch/mips/include/asm/mach-loongson64/irq.h +@@ -10,7 +10,7 @@ + #define MIPS_CPU_IRQ_BASE 56 + + #define LOONGSON_UART_IRQ (MIPS_CPU_IRQ_BASE + 2) /* UART */ +-#define LOONGSON_HT1_IRQ (MIPS_CPU_IRQ_BASE + 3) /* HT1 */ ++#define LOONGSON_BRIDGE_IRQ (MIPS_CPU_IRQ_BASE + 3) /* CASCADE */ + #define LOONGSON_TIMER_IRQ (MIPS_CPU_IRQ_BASE + 7) /* CPU Timer */ + + #define LOONGSON_HT1_CFG_BASE loongson_sysconf.ht_control_base +diff --git a/arch/mips/kernel/crash.c b/arch/mips/kernel/crash.c +index d455363d51c3..4c07a43a3242 100644 +--- a/arch/mips/kernel/crash.c ++++ b/arch/mips/kernel/crash.c +@@ -36,6 +36,9 @@ static void crash_shutdown_secondary(void *passed_regs) + if (!cpu_online(cpu)) + return; + ++ /* We won't be sent IPIs any more. */ ++ set_cpu_online(cpu, false); ++ + local_irq_disable(); + if (!cpumask_test_cpu(cpu, &cpus_in_crash)) + crash_save_cpu(regs, cpu); +diff --git a/arch/mips/kernel/machine_kexec.c b/arch/mips/kernel/machine_kexec.c +index 8b574bcd39ba..4b3726e4fe3a 100644 +--- a/arch/mips/kernel/machine_kexec.c ++++ b/arch/mips/kernel/machine_kexec.c +@@ -118,6 +118,9 @@ machine_kexec(struct kimage *image) + *ptr = (unsigned long) phys_to_virt(*ptr); + } + ++ /* Mark offline BEFORE disabling local irq. */ ++ set_cpu_online(smp_processor_id(), false); ++ + /* + * we do not want to be bothered. + */ +diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c +index cbeb20f9fc95..5605061f5f98 100644 +--- a/arch/mips/loongson64/loongson-3/irq.c ++++ b/arch/mips/loongson64/loongson-3/irq.c +@@ -96,51 +96,8 @@ void mach_irq_dispatch(unsigned int pending) + } + } + +-static struct irqaction cascade_irqaction = { +- .handler = no_action, +- .flags = IRQF_NO_SUSPEND, +- .name = "cascade", +-}; +- +-static inline void mask_loongson_irq(struct irq_data *d) +-{ +- clear_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE)); +- irq_disable_hazard(); +- +- /* Workaround: UART IRQ may deliver to any core */ +- if (d->irq == LOONGSON_UART_IRQ) { +- int cpu = smp_processor_id(); +- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; +- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; +- u64 intenclr_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_INTENCLR); +- u64 introuter_lpc_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_LPC); +- +- *(volatile u32 *)intenclr_addr = 1 << 10; +- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<irq == LOONGSON_UART_IRQ) { +- int cpu = smp_processor_id(); +- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; +- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; +- u64 intenset_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_INTENSET); +- u64 introuter_lpc_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_LPC); +- +- *(volatile u32 *)intenset_addr = 1 << 10; +- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<irq - MIPS_CPU_IRQ_BASE)); +- irq_enable_hazard(); +-} ++static inline void mask_loongson_irq(struct irq_data *d) { } ++static inline void unmask_loongson_irq(struct irq_data *d) { } + + /* For MIPS IRQs which shared by all cores */ + static struct irq_chip loongson_irq_chip = { +@@ -183,12 +140,11 @@ void __init mach_init_irq(void) + chip->irq_set_affinity = plat_set_irq_affinity; + + irq_set_chip_and_handler(LOONGSON_UART_IRQ, +- &loongson_irq_chip, handle_level_irq); +- +- /* setup HT1 irq */ +- setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction); ++ &loongson_irq_chip, handle_percpu_irq); ++ irq_set_chip_and_handler(LOONGSON_BRIDGE_IRQ, ++ &loongson_irq_chip, handle_percpu_irq); + +- set_c0_status(STATUSF_IP2 | STATUSF_IP6); ++ set_c0_status(STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP6); + } + + #ifdef CONFIG_HOTPLUG_CPU +diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c +index f1e92bf743c2..3c3b1e6abb53 100644 +--- a/arch/mips/pci/pci-legacy.c ++++ b/arch/mips/pci/pci-legacy.c +@@ -127,8 +127,12 @@ static void pcibios_scanbus(struct pci_controller *hose) + if (pci_has_flag(PCI_PROBE_ONLY)) { + pci_bus_claim_resources(bus); + } else { ++ struct pci_bus *child; ++ + pci_bus_size_bridges(bus); + pci_bus_assign_resources(bus); ++ list_for_each_entry(child, &bus->children, node) ++ pcie_bus_configure_settings(child); + } + pci_bus_add_devices(bus); + } +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 11a1acba164a..d2824b0cc142 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -238,7 +238,11 @@ cpu-as-$(CONFIG_4xx) += -Wa,-m405 + cpu-as-$(CONFIG_ALTIVEC) += $(call as-option,-Wa$(comma)-maltivec) + cpu-as-$(CONFIG_E200) += -Wa,-me200 + cpu-as-$(CONFIG_E500) += -Wa,-me500 +-cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4 ++ ++# When using '-many -mpower4' gas will first try and find a matching power4 ++# mnemonic and failing that it will allow any valid mnemonic that GAS knows ++# about. GCC will pass -many to GAS when assembling, clang does not. ++cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4 -Wa,-many + cpu-as-$(CONFIG_PPC_E500MC) += $(call as-option,-Wa$(comma)-me500mc) + + KBUILD_AFLAGS += $(cpu-as-y) +diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S +index dcf2f15e6797..32dfe6d083f3 100644 +--- a/arch/powerpc/boot/crt0.S ++++ b/arch/powerpc/boot/crt0.S +@@ -47,8 +47,10 @@ p_end: .long _end + p_pstack: .long _platform_stack_top + #endif + +- .weak _zimage_start + .globl _zimage_start ++ /* Clang appears to require the .weak directive to be after the symbol ++ * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */ ++ .weak _zimage_start + _zimage_start: + .globl _zimage_start_lib + _zimage_start_lib: +diff --git a/arch/powerpc/include/asm/mmu-8xx.h b/arch/powerpc/include/asm/mmu-8xx.h +index 4f547752ae79..193f53116c7a 100644 +--- a/arch/powerpc/include/asm/mmu-8xx.h ++++ b/arch/powerpc/include/asm/mmu-8xx.h +@@ -34,20 +34,12 @@ + * respectively NA for All or X for Supervisor and no access for User. + * Then we use the APG to say whether accesses are according to Page rules or + * "all Supervisor" rules (Access to all) +- * We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP: +- * When that bit is not set access is done iaw "all user" +- * which means no access iaw page rules. +- * Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED +- * 0x => No access => 11 (all accesses performed as user iaw page definition) +- * 10 => No user => 01 (all accesses performed according to page definition) +- * 11 => User => 00 (all accesses performed as supervisor iaw page definition) ++ * Therefore, we define 2 APG groups. lsb is _PMD_USER ++ * 0 => No user => 01 (all accesses performed according to page definition) ++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition) + * We define all 16 groups so that all other bits of APG can take any value + */ +-#ifdef CONFIG_SWAP +-#define MI_APG_INIT 0xf4f4f4f4 +-#else + #define MI_APG_INIT 0x44444444 +-#endif + + /* The effective page number register. When read, contains the information + * about the last instruction TLB miss. When MI_RPN is written, bits in +@@ -115,20 +107,12 @@ + * Supervisor and no access for user and NA for ALL. + * Then we use the APG to say whether accesses are according to Page rules or + * "all Supervisor" rules (Access to all) +- * We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP: +- * When that bit is not set access is done iaw "all user" +- * which means no access iaw page rules. +- * Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED +- * 0x => No access => 11 (all accesses performed as user iaw page definition) +- * 10 => No user => 01 (all accesses performed according to page definition) +- * 11 => User => 00 (all accesses performed as supervisor iaw page definition) ++ * Therefore, we define 2 APG groups. lsb is _PMD_USER ++ * 0 => No user => 01 (all accesses performed according to page definition) ++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition) + * We define all 16 groups so that all other bits of APG can take any value + */ +-#ifdef CONFIG_SWAP +-#define MD_APG_INIT 0xf4f4f4f4 +-#else + #define MD_APG_INIT 0x44444444 +-#endif + + /* The effective page number register. When read, contains the information + * about the last instruction TLB miss. When MD_RPN is written, bits in +@@ -180,12 +164,6 @@ + */ + #define SPRN_M_TW 799 + +-/* APGs */ +-#define M_APG0 0x00000000 +-#define M_APG1 0x00000020 +-#define M_APG2 0x00000040 +-#define M_APG3 0x00000060 +- + #ifdef CONFIG_PPC_MM_SLICES + #include + #define SLICE_ARRAY_SIZE (1 << (32 - SLICE_LOW_SHIFT - 1)) +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index 6ebba3e48b01..c72767a5327a 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -169,6 +169,11 @@ static size_t eeh_dump_dev_log(struct eeh_dev *edev, char *buf, size_t len) + int n = 0, l = 0; + char buffer[128]; + ++ if (!pdn) { ++ pr_warn("EEH: Note: No error log for absent device.\n"); ++ return 0; ++ } ++ + n += scnprintf(buf+n, len-n, "%04x:%02x:%02x.%01x\n", + pdn->phb->global_number, pdn->busno, + PCI_SLOT(pdn->devfn), PCI_FUNC(pdn->devfn)); +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index 6582f824d620..81d4574d1f37 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -353,13 +353,14 @@ _ENTRY(ITLBMiss_cmp) + #if defined(ITLB_MISS_KERNEL) || defined(CONFIG_HUGETLB_PAGE) + mtcr r12 + #endif +- +-#ifdef CONFIG_SWAP +- rlwinm r11, r10, 31, _PAGE_ACCESSED >> 1 +-#endif + /* Load the MI_TWC with the attributes for this "segment." */ + mtspr SPRN_MI_TWC, r11 /* Set segment attributes */ + ++#ifdef CONFIG_SWAP ++ rlwinm r11, r10, 32-5, _PAGE_PRESENT ++ and r11, r11, r10 ++ rlwimi r10, r11, 0, _PAGE_PRESENT ++#endif + li r11, RPN_PATTERN | 0x200 + /* The Linux PTE won't go exactly into the MMU TLB. + * Software indicator bits 20 and 23 must be clear. +@@ -470,14 +471,22 @@ _ENTRY(DTLBMiss_jmp) + * above. + */ + rlwimi r11, r10, 0, _PAGE_GUARDED +-#ifdef CONFIG_SWAP +- /* _PAGE_ACCESSED has to be set. We use second APG bit for that, 0 +- * on that bit will represent a Non Access group +- */ +- rlwinm r11, r10, 31, _PAGE_ACCESSED >> 1 +-#endif + mtspr SPRN_MD_TWC, r11 + ++ /* Both _PAGE_ACCESSED and _PAGE_PRESENT has to be set. ++ * We also need to know if the insn is a load/store, so: ++ * Clear _PAGE_PRESENT and load that which will ++ * trap into DTLB Error with store bit set accordinly. ++ */ ++ /* PRESENT=0x1, ACCESSED=0x20 ++ * r11 = ((r10 & PRESENT) & ((r10 & ACCESSED) >> 5)); ++ * r10 = (r10 & ~PRESENT) | r11; ++ */ ++#ifdef CONFIG_SWAP ++ rlwinm r11, r10, 32-5, _PAGE_PRESENT ++ and r11, r11, r10 ++ rlwimi r10, r11, 0, _PAGE_PRESENT ++#endif + /* The Linux PTE won't go exactly into the MMU TLB. + * Software indicator bits 24, 25, 26, and 27 must be + * set. All other Linux PTE bits control the behavior +@@ -637,8 +646,8 @@ InstructionBreakpoint: + */ + DTLBMissIMMR: + mtcr r12 +- /* Set 512k byte guarded page and mark it valid and accessed */ +- li r10, MD_PS512K | MD_GUARDED | MD_SVALID | M_APG2 ++ /* Set 512k byte guarded page and mark it valid */ ++ li r10, MD_PS512K | MD_GUARDED | MD_SVALID + mtspr SPRN_MD_TWC, r10 + mfspr r10, SPRN_IMMR /* Get current IMMR */ + rlwinm r10, r10, 0, 0xfff80000 /* Get 512 kbytes boundary */ +@@ -656,8 +665,8 @@ _ENTRY(dtlb_miss_exit_2) + + DTLBMissLinear: + mtcr r12 +- /* Set 8M byte page and mark it valid and accessed */ +- li r11, MD_PS8MEG | MD_SVALID | M_APG2 ++ /* Set 8M byte page and mark it valid */ ++ li r11, MD_PS8MEG | MD_SVALID + mtspr SPRN_MD_TWC, r11 + rlwinm r10, r10, 0, 0x0f800000 /* 8xx supports max 256Mb RAM */ + ori r10, r10, 0xf0 | MD_SPS16K | _PAGE_PRIVILEGED | _PAGE_DIRTY | \ +@@ -675,8 +684,8 @@ _ENTRY(dtlb_miss_exit_3) + #ifndef CONFIG_PIN_TLB_TEXT + ITLBMissLinear: + mtcr r12 +- /* Set 8M byte page and mark it valid,accessed */ +- li r11, MI_PS8MEG | MI_SVALID | M_APG2 ++ /* Set 8M byte page and mark it valid */ ++ li r11, MI_PS8MEG | MI_SVALID + mtspr SPRN_MI_TWC, r11 + rlwinm r10, r10, 0, 0x0f800000 /* 8xx supports max 256Mb RAM */ + ori r10, r10, 0xf0 | MI_SPS16K | _PAGE_PRIVILEGED | _PAGE_DIRTY | \ +@@ -960,7 +969,7 @@ initial_mmu: + ori r8, r8, MI_EVALID /* Mark it valid */ + mtspr SPRN_MI_EPN, r8 + li r8, MI_PS8MEG /* Set 8M byte page */ +- ori r8, r8, MI_SVALID | M_APG2 /* Make it valid, APG 2 */ ++ ori r8, r8, MI_SVALID /* Make it valid */ + mtspr SPRN_MI_TWC, r8 + li r8, MI_BOOTINIT /* Create RPN for address 0 */ + mtspr SPRN_MI_RPN, r8 /* Store TLB entry */ +@@ -987,7 +996,7 @@ initial_mmu: + ori r8, r8, MD_EVALID /* Mark it valid */ + mtspr SPRN_MD_EPN, r8 + li r8, MD_PS512K | MD_GUARDED /* Set 512k byte page */ +- ori r8, r8, MD_SVALID | M_APG2 /* Make it valid and accessed */ ++ ori r8, r8, MD_SVALID /* Make it valid */ + mtspr SPRN_MD_TWC, r8 + mr r8, r9 /* Create paddr for TLB */ + ori r8, r8, MI_BOOTINIT|0x2 /* Inhibit cache -- Cort */ +diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c +index 2c53de9f3b6a..8661eea78503 100644 +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -680,7 +680,14 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, + + case R_PPC64_REL32: + /* 32 bits relative (used by relative exception tables) */ +- *(u32 *)location = value - (unsigned long)location; ++ /* Convert value to relative */ ++ value -= (unsigned long)location; ++ if (value + 0x80000000 > 0xffffffff) { ++ pr_err("%s: REL32 %li out of range!\n", ++ me->name, (long int)value); ++ return -ENOEXEC; ++ } ++ *(u32 *)location = value; + break; + + case R_PPC64_TOCSAVE: +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index c85adb858271..8689a02b7df8 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -767,12 +767,17 @@ void machine_check_exception(struct pt_regs *regs) + if (check_io_access(regs)) + goto bail; + +- die("Machine check", regs, SIGBUS); +- + /* Must die if the interrupt is not recoverable */ + if (!(regs->msr & MSR_RI)) + nmi_panic(regs, "Unrecoverable Machine check"); + ++ if (!nested) ++ nmi_exit(); ++ ++ die("Machine check", regs, SIGBUS); ++ ++ return; ++ + bail: + if (!nested) + nmi_exit(); +diff --git a/arch/powerpc/mm/8xx_mmu.c b/arch/powerpc/mm/8xx_mmu.c +index cf77d755246d..5d53684c2ebd 100644 +--- a/arch/powerpc/mm/8xx_mmu.c ++++ b/arch/powerpc/mm/8xx_mmu.c +@@ -79,7 +79,7 @@ void __init MMU_init_hw(void) + for (; i < 32 && mem >= LARGE_PAGE_SIZE_8M; i++) { + mtspr(SPRN_MD_CTR, ctr | (i << 8)); + mtspr(SPRN_MD_EPN, (unsigned long)__va(addr) | MD_EVALID); +- mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID | M_APG2); ++ mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID); + mtspr(SPRN_MD_RPN, addr | flags | _PAGE_PRESENT); + addr += LARGE_PAGE_SIZE_8M; + mem -= LARGE_PAGE_SIZE_8M; +diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c +index 876e2a3c79f2..bdf33b989f98 100644 +--- a/arch/powerpc/mm/dump_linuxpagetables.c ++++ b/arch/powerpc/mm/dump_linuxpagetables.c +@@ -418,12 +418,13 @@ static void walk_pagetables(struct pg_state *st) + unsigned int i; + unsigned long addr; + ++ addr = st->start_address; ++ + /* + * Traverse the linux pagetable structure and dump pages that are in + * the hash pagetable. + */ +- for (i = 0; i < PTRS_PER_PGD; i++, pgd++) { +- addr = KERN_VIRT_START + i * PGDIR_SIZE; ++ for (i = 0; i < PTRS_PER_PGD; i++, pgd++, addr += PGDIR_SIZE) { + if (!pgd_none(*pgd) && !pgd_huge(*pgd)) + /* pgd exists */ + walk_pud(st, pgd, addr); +@@ -472,9 +473,14 @@ static int ptdump_show(struct seq_file *m, void *v) + { + struct pg_state st = { + .seq = m, +- .start_address = KERN_VIRT_START, + .marker = address_markers, + }; ++ ++ if (radix_enabled()) ++ st.start_address = PAGE_OFFSET; ++ else ++ st.start_address = KERN_VIRT_START; ++ + /* Traverse kernel page tables */ + walk_pagetables(&st); + note_page(&st, 0, 0, 0); +diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c +index e87f9ef9115b..7296a42eb62e 100644 +--- a/arch/powerpc/mm/hugetlbpage.c ++++ b/arch/powerpc/mm/hugetlbpage.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -112,6 +113,8 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t *hpdp, + for (i = i - 1 ; i >= 0; i--, hpdp--) + *hpdp = __hugepd(0); + kmem_cache_free(cachep, new); ++ } else { ++ kmemleak_ignore(new); + } + spin_unlock(ptl); + return 0; +diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c +index 205fe557ca10..4f213ba33491 100644 +--- a/arch/powerpc/mm/slice.c ++++ b/arch/powerpc/mm/slice.c +@@ -61,6 +61,13 @@ static void slice_print_mask(const char *label, const struct slice_mask *mask) { + + #endif + ++static inline bool slice_addr_is_low(unsigned long addr) ++{ ++ u64 tmp = (u64)addr; ++ ++ return tmp < SLICE_LOW_TOP; ++} ++ + static void slice_range_to_mask(unsigned long start, unsigned long len, + struct slice_mask *ret) + { +@@ -70,7 +77,7 @@ static void slice_range_to_mask(unsigned long start, unsigned long len, + if (SLICE_NUM_HIGH) + bitmap_zero(ret->high_slices, SLICE_NUM_HIGH); + +- if (start < SLICE_LOW_TOP) { ++ if (slice_addr_is_low(start)) { + unsigned long mend = min(end, + (unsigned long)(SLICE_LOW_TOP - 1)); + +@@ -78,7 +85,7 @@ static void slice_range_to_mask(unsigned long start, unsigned long len, + - (1u << GET_LOW_SLICE_INDEX(start)); + } + +- if ((start + len) > SLICE_LOW_TOP) { ++ if (SLICE_NUM_HIGH && !slice_addr_is_low(end)) { + unsigned long start_index = GET_HIGH_SLICE_INDEX(start); + unsigned long align_end = ALIGN(end, (1UL << SLICE_HIGH_SHIFT)); + unsigned long count = GET_HIGH_SLICE_INDEX(align_end) - start_index; +@@ -133,7 +140,7 @@ static void slice_mask_for_free(struct mm_struct *mm, struct slice_mask *ret, + if (!slice_low_has_vma(mm, i)) + ret->low_slices |= 1u << i; + +- if (high_limit <= SLICE_LOW_TOP) ++ if (slice_addr_is_low(high_limit - 1)) + return; + + for (i = 0; i < GET_HIGH_SLICE_INDEX(high_limit); i++) +@@ -182,7 +189,7 @@ static bool slice_check_range_fits(struct mm_struct *mm, + unsigned long end = start + len - 1; + u64 low_slices = 0; + +- if (start < SLICE_LOW_TOP) { ++ if (slice_addr_is_low(start)) { + unsigned long mend = min(end, + (unsigned long)(SLICE_LOW_TOP - 1)); + +@@ -192,7 +199,7 @@ static bool slice_check_range_fits(struct mm_struct *mm, + if ((low_slices & available->low_slices) != low_slices) + return false; + +- if (SLICE_NUM_HIGH && ((start + len) > SLICE_LOW_TOP)) { ++ if (SLICE_NUM_HIGH && !slice_addr_is_low(end)) { + unsigned long start_index = GET_HIGH_SLICE_INDEX(start); + unsigned long align_end = ALIGN(end, (1UL << SLICE_HIGH_SHIFT)); + unsigned long count = GET_HIGH_SLICE_INDEX(align_end) - start_index; +@@ -303,7 +310,7 @@ static bool slice_scan_available(unsigned long addr, + int end, unsigned long *boundary_addr) + { + unsigned long slice; +- if (addr < SLICE_LOW_TOP) { ++ if (slice_addr_is_low(addr)) { + slice = GET_LOW_SLICE_INDEX(addr); + *boundary_addr = (slice + end) << SLICE_LOW_SHIFT; + return !!(available->low_slices & (1u << slice)); +@@ -706,7 +713,7 @@ unsigned int get_slice_psize(struct mm_struct *mm, unsigned long addr) + + VM_BUG_ON(radix_enabled()); + +- if (addr < SLICE_LOW_TOP) { ++ if (slice_addr_is_low(addr)) { + psizes = mm->context.low_slices_psize; + index = GET_LOW_SLICE_INDEX(addr); + } else { +diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c +index 15fe5f0c8665..ae5d568e267f 100644 +--- a/arch/powerpc/mm/tlb_nohash.c ++++ b/arch/powerpc/mm/tlb_nohash.c +@@ -503,6 +503,9 @@ static void setup_page_sizes(void) + for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) { + struct mmu_psize_def *def = &mmu_psize_defs[psize]; + ++ if (!def->shift) ++ continue; ++ + if (tlb1ps & (1U << (def->shift - 10))) { + def->flags |= MMU_PAGE_SIZE_DIRECT; + +diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c +index 51dc398ae3f7..a29fdf8a2e56 100644 +--- a/arch/powerpc/platforms/powernv/memtrace.c ++++ b/arch/powerpc/platforms/powernv/memtrace.c +@@ -90,17 +90,15 @@ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages) + walk_memory_range(start_pfn, end_pfn, (void *)MEM_OFFLINE, + change_memblock_state); + +- lock_device_hotplug(); +- remove_memory(nid, start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT); +- unlock_device_hotplug(); + + return true; + } + + static u64 memtrace_alloc_node(u32 nid, u64 size) + { +- u64 start_pfn, end_pfn, nr_pages; ++ u64 start_pfn, end_pfn, nr_pages, pfn; + u64 base_pfn; ++ u64 bytes = memory_block_size_bytes(); + + if (!node_spanned_pages(nid)) + return 0; +@@ -113,8 +111,21 @@ static u64 memtrace_alloc_node(u32 nid, u64 size) + end_pfn = round_down(end_pfn - nr_pages, nr_pages); + + for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) { +- if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) ++ if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) { ++ /* ++ * Remove memory in memory block size chunks so that ++ * iomem resources are always split to the same size and ++ * we never try to remove memory that spans two iomem ++ * resources. ++ */ ++ lock_device_hotplug(); ++ end_pfn = base_pfn + nr_pages; ++ for (pfn = base_pfn; pfn < end_pfn; pfn += bytes>> PAGE_SHIFT) { ++ remove_memory(nid, pfn << PAGE_SHIFT, bytes); ++ } ++ unlock_device_hotplug(); + return base_pfn << PAGE_SHIFT; ++ } + } + + return 0; +diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h +index 3a17107594c8..eb786f90f2d3 100644 +--- a/arch/x86/include/asm/mce.h ++++ b/arch/x86/include/asm/mce.h +@@ -216,6 +216,8 @@ static inline int umc_normaddr_to_sysaddr(u64 norm_addr, u16 nid, u8 umc, u64 *s + + int mce_available(struct cpuinfo_x86 *c); + bool mce_is_memory_error(struct mce *m); ++bool mce_is_correctable(struct mce *m); ++int mce_usable_address(struct mce *m); + + DECLARE_PER_CPU(unsigned, mce_exception_count); + DECLARE_PER_CPU(unsigned, mce_poll_count); +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 953b3ce92dcc..cdbedeb3f3db 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -485,7 +485,7 @@ static void mce_report_event(struct pt_regs *regs) + * be somewhat complicated (e.g. segment offset would require an instruction + * parser). So only support physical addresses up to page granuality for now. + */ +-static int mce_usable_address(struct mce *m) ++int mce_usable_address(struct mce *m) + { + if (!(m->status & MCI_STATUS_ADDRV)) + return 0; +@@ -505,6 +505,7 @@ static int mce_usable_address(struct mce *m) + + return 1; + } ++EXPORT_SYMBOL_GPL(mce_usable_address); + + bool mce_is_memory_error(struct mce *m) + { +@@ -534,7 +535,7 @@ bool mce_is_memory_error(struct mce *m) + } + EXPORT_SYMBOL_GPL(mce_is_memory_error); + +-static bool mce_is_correctable(struct mce *m) ++bool mce_is_correctable(struct mce *m) + { + if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED) + return false; +@@ -544,6 +545,7 @@ static bool mce_is_correctable(struct mce *m) + + return true; + } ++EXPORT_SYMBOL_GPL(mce_is_correctable); + + static bool cec_add_mce(struct mce *m) + { +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +index ad12733f6058..852e74e48890 100644 +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -285,6 +286,16 @@ static void __init ms_hyperv_init_platform(void) + if (efi_enabled(EFI_BOOT)) + x86_platform.get_nmi_reason = hv_get_nmi_reason; + ++ /* ++ * Hyper-V VMs have a PIT emulation quirk such that zeroing the ++ * counter register during PIT shutdown restarts the PIT. So it ++ * continues to interrupt @18.2 HZ. Setting i8253_clear_counter ++ * to false tells pit_shutdown() not to zero the counter so that ++ * the PIT really is shutdown. Generation 2 VMs don't have a PIT, ++ * and setting this value has no effect. ++ */ ++ i8253_clear_counter_on_shutdown = false; ++ + #if IS_ENABLED(CONFIG_HYPERV) + /* + * Setup the hook to get control post apic initialization. +diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c +index 8e005329648b..d805202c63cd 100644 +--- a/arch/x86/kernel/cpu/vmware.c ++++ b/arch/x86/kernel/cpu/vmware.c +@@ -77,7 +77,7 @@ static __init int setup_vmw_sched_clock(char *s) + } + early_param("no-vmw-sched-clock", setup_vmw_sched_clock); + +-static unsigned long long vmware_sched_clock(void) ++static unsigned long long notrace vmware_sched_clock(void) + { + unsigned long long ns; + +diff --git a/arch/x86/um/shared/sysdep/ptrace_32.h b/arch/x86/um/shared/sysdep/ptrace_32.h +index b94a108de1dc..ae00d22bce02 100644 +--- a/arch/x86/um/shared/sysdep/ptrace_32.h ++++ b/arch/x86/um/shared/sysdep/ptrace_32.h +@@ -10,20 +10,10 @@ + + static inline void update_debugregs(int seq) {} + +-/* syscall emulation path in ptrace */ +- +-#ifndef PTRACE_SYSEMU +-#define PTRACE_SYSEMU 31 +-#endif +- + void set_using_sysemu(int value); + int get_using_sysemu(void); + extern int sysemu_supported; + +-#ifndef PTRACE_SYSEMU_SINGLESTEP +-#define PTRACE_SYSEMU_SINGLESTEP 32 +-#endif +- + #define UPT_SYSCALL_ARG1(r) UPT_BX(r) + #define UPT_SYSCALL_ARG2(r) UPT_CX(r) + #define UPT_SYSCALL_ARG3(r) UPT_DX(r) +diff --git a/arch/xtensa/boot/Makefile b/arch/xtensa/boot/Makefile +index dc9e0ba7122c..294846117fc2 100644 +--- a/arch/xtensa/boot/Makefile ++++ b/arch/xtensa/boot/Makefile +@@ -33,7 +33,7 @@ uImage: $(obj)/uImage + boot-elf boot-redboot: $(addprefix $(obj)/,$(subdir-y)) + $(Q)$(MAKE) $(build)=$(obj)/$@ $(MAKECMDGOALS) + +-OBJCOPYFLAGS = --strip-all -R .comment -R .note.gnu.build-id -O binary ++OBJCOPYFLAGS = --strip-all -R .comment -R .notes -O binary + + vmlinux.bin: vmlinux FORCE + $(call if_changed,objcopy) +diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h +index e4ccb88b7996..677bc76c1d70 100644 +--- a/arch/xtensa/include/asm/processor.h ++++ b/arch/xtensa/include/asm/processor.h +@@ -23,7 +23,11 @@ + # error Linux requires the Xtensa Windowed Registers Option. + #endif + +-#define ARCH_SLAB_MINALIGN XCHAL_DATA_WIDTH ++/* Xtensa ABI requires stack alignment to be at least 16 */ ++ ++#define STACK_ALIGN (XCHAL_DATA_WIDTH > 16 ? XCHAL_DATA_WIDTH : 16) ++ ++#define ARCH_SLAB_MINALIGN STACK_ALIGN + + /* + * User space process size: 1 GB. +diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S +index 2f76118ecf62..9053a5622d2c 100644 +--- a/arch/xtensa/kernel/head.S ++++ b/arch/xtensa/kernel/head.S +@@ -88,9 +88,12 @@ _SetupMMU: + initialize_mmu + #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY + rsr a2, excsave1 +- movi a3, 0x08000000 ++ movi a3, XCHAL_KSEG_PADDR ++ bltu a2, a3, 1f ++ sub a2, a2, a3 ++ movi a3, XCHAL_KSEG_SIZE + bgeu a2, a3, 1f +- movi a3, 0xd0000000 ++ movi a3, XCHAL_KSEG_CACHED_VADDR + add a2, a2, a3 + wsr a2, excsave1 + 1: +diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S +index a1c3edb8ad56..fa926995d2a3 100644 +--- a/arch/xtensa/kernel/vmlinux.lds.S ++++ b/arch/xtensa/kernel/vmlinux.lds.S +@@ -131,6 +131,7 @@ SECTIONS + .fixup : { *(.fixup) } + + EXCEPTION_TABLE(16) ++ NOTES + /* Data section */ + + _sdata = .; +diff --git a/block/blk-core.c b/block/blk-core.c +index cff0a60ee200..eb8b52241453 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -793,9 +793,8 @@ void blk_cleanup_queue(struct request_queue *q) + * dispatch may still be in-progress since we dispatch requests + * from more than one contexts. + * +- * No need to quiesce queue if it isn't initialized yet since +- * blk_freeze_queue() should be enough for cases of passthrough +- * request. ++ * We rely on driver to deal with the race in case that queue ++ * initialization isn't done. + */ + if (q->mq_ops && blk_queue_init_done(q)) + blk_mq_quiesce_queue(q); +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index 0e89b5457cab..ceeb2eaf28cf 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -83,7 +83,7 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_cipher rcipher; + +- strlcpy(rcipher.type, "cipher", sizeof(rcipher.type)); ++ strncpy(rcipher.type, "cipher", sizeof(rcipher.type)); + + rcipher.blocksize = alg->cra_blocksize; + rcipher.min_keysize = alg->cra_cipher.cia_min_keysize; +@@ -102,7 +102,7 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_comp rcomp; + +- strlcpy(rcomp.type, "compression", sizeof(rcomp.type)); ++ strncpy(rcomp.type, "compression", sizeof(rcomp.type)); + if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS, + sizeof(struct crypto_report_comp), &rcomp)) + goto nla_put_failure; +@@ -116,7 +116,7 @@ static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_acomp racomp; + +- strlcpy(racomp.type, "acomp", sizeof(racomp.type)); ++ strncpy(racomp.type, "acomp", sizeof(racomp.type)); + + if (nla_put(skb, CRYPTOCFGA_REPORT_ACOMP, + sizeof(struct crypto_report_acomp), &racomp)) +@@ -131,7 +131,7 @@ static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_akcipher rakcipher; + +- strlcpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); ++ strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); + + if (nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER, + sizeof(struct crypto_report_akcipher), &rakcipher)) +@@ -146,7 +146,7 @@ static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_kpp rkpp; + +- strlcpy(rkpp.type, "kpp", sizeof(rkpp.type)); ++ strncpy(rkpp.type, "kpp", sizeof(rkpp.type)); + + if (nla_put(skb, CRYPTOCFGA_REPORT_KPP, + sizeof(struct crypto_report_kpp), &rkpp)) +@@ -160,10 +160,10 @@ nla_put_failure: + static int crypto_report_one(struct crypto_alg *alg, + struct crypto_user_alg *ualg, struct sk_buff *skb) + { +- strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); +- strlcpy(ualg->cru_driver_name, alg->cra_driver_name, ++ strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); ++ strncpy(ualg->cru_driver_name, alg->cra_driver_name, + sizeof(ualg->cru_driver_name)); +- strlcpy(ualg->cru_module_name, module_name(alg->cra_module), ++ strncpy(ualg->cru_module_name, module_name(alg->cra_module), + sizeof(ualg->cru_module_name)); + + ualg->cru_type = 0; +@@ -176,7 +176,7 @@ static int crypto_report_one(struct crypto_alg *alg, + if (alg->cra_flags & CRYPTO_ALG_LARVAL) { + struct crypto_report_larval rl; + +- strlcpy(rl.type, "larval", sizeof(rl.type)); ++ strncpy(rl.type, "larval", sizeof(rl.type)); + if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL, + sizeof(struct crypto_report_larval), &rl)) + goto nla_put_failure; +diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c +index 78f9de260d5f..e9fb0bf3c8d2 100644 +--- a/drivers/acpi/acpica/dsopcode.c ++++ b/drivers/acpi/acpica/dsopcode.c +@@ -417,10 +417,6 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state, + ACPI_FORMAT_UINT64(obj_desc->region.address), + obj_desc->region.length)); + +- status = acpi_ut_add_address_range(obj_desc->region.space_id, +- obj_desc->region.address, +- obj_desc->region.length, node); +- + /* Now the address and length are valid for this opregion */ + + obj_desc->region.flags |= AOPOBJ_DATA_VALID; +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 19b641208d86..c5d15752dfb3 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2845,9 +2845,9 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc) + return rc; + + if (ars_status_process_records(acpi_desc)) +- return -ENOMEM; ++ dev_err(acpi_desc->dev, "Failed to process ARS records\n"); + +- return 0; ++ return rc; + } + + static int ars_register(struct acpi_nfit_desc *acpi_desc, +diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c +index e9626bf6ca29..d6c1b10f6c25 100644 +--- a/drivers/acpi/nfit/mce.c ++++ b/drivers/acpi/nfit/mce.c +@@ -25,8 +25,12 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val, + struct acpi_nfit_desc *acpi_desc; + struct nfit_spa *nfit_spa; + +- /* We only care about memory errors */ +- if (!mce_is_memory_error(mce)) ++ /* We only care about uncorrectable memory errors */ ++ if (!mce_is_memory_error(mce) || mce_is_correctable(mce)) ++ return NOTIFY_DONE; ++ ++ /* Verify the address reported in the MCE is valid. */ ++ if (!mce_usable_address(mce)) + return NOTIFY_DONE; + + /* +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 6e594644cb1d..a7f5202a4815 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4553,7 +4553,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + /* These specific Samsung models/firmware-revs do not handle LPM well */ + { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, }, + { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, }, +- { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, }, ++ { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM, }, + + /* devices that don't properly handle queued TRIM commands */ + { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index a1d6b5597c17..66921427d109 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -1636,6 +1636,11 @@ static const struct attribute_group zram_disk_attr_group = { + .attrs = zram_disk_attrs, + }; + ++static const struct attribute_group *zram_disk_attr_groups[] = { ++ &zram_disk_attr_group, ++ NULL, ++}; ++ + /* + * Allocate and initialize new zram device. the function returns + * '>= 0' device_id upon success, and negative value otherwise. +@@ -1716,24 +1721,15 @@ static int zram_add(void) + + zram->disk->queue->backing_dev_info->capabilities |= + (BDI_CAP_STABLE_WRITES | BDI_CAP_SYNCHRONOUS_IO); ++ disk_to_dev(zram->disk)->groups = zram_disk_attr_groups; + add_disk(zram->disk); + +- ret = sysfs_create_group(&disk_to_dev(zram->disk)->kobj, +- &zram_disk_attr_group); +- if (ret < 0) { +- pr_err("Error creating sysfs group for device %d\n", +- device_id); +- goto out_free_disk; +- } + strlcpy(zram->compressor, default_compressor, sizeof(zram->compressor)); + + zram_debugfs_register(zram); + pr_info("Added device: %s\n", zram->disk->disk_name); + return device_id; + +-out_free_disk: +- del_gendisk(zram->disk); +- put_disk(zram->disk); + out_free_queue: + blk_cleanup_queue(queue); + out_free_idr: +@@ -1762,16 +1758,6 @@ static int zram_remove(struct zram *zram) + mutex_unlock(&bdev->bd_mutex); + + zram_debugfs_unregister(zram); +- /* +- * Remove sysfs first, so no one will perform a disksize +- * store while we destroy the devices. This also helps during +- * hot_remove -- zram_reset_device() is the last holder of +- * ->init_lock, no later/concurrent disksize_store() or any +- * other sysfs handlers are possible. +- */ +- sysfs_remove_group(&disk_to_dev(zram->disk)->kobj, +- &zram_disk_attr_group); +- + /* Make sure all the pending I/O are finished */ + fsync_bdev(bdev); + zram_reset_device(zram); +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index a5d5a96479bf..10802d1fc554 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -2445,7 +2445,7 @@ static int cdrom_ioctl_select_disc(struct cdrom_device_info *cdi, + return -ENOSYS; + + if (arg != CDSL_CURRENT && arg != CDSL_NONE) { +- if ((int)arg >= cdi->capacity) ++ if (arg >= cdi->capacity) + return -EINVAL; + } + +diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c +index 72b6091eb7b9..dc7fbc796cb6 100644 +--- a/drivers/clk/at91/clk-pll.c ++++ b/drivers/clk/at91/clk-pll.c +@@ -133,6 +133,9 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hw, + { + struct clk_pll *pll = to_clk_pll(hw); + ++ if (!pll->div || !pll->mul) ++ return 0; ++ + return (parent_rate / pll->div) * (pll->mul + 1); + } + +diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c +index d44e0eea31ec..0934d3724495 100644 +--- a/drivers/clk/clk-s2mps11.c ++++ b/drivers/clk/clk-s2mps11.c +@@ -245,6 +245,36 @@ static const struct platform_device_id s2mps11_clk_id[] = { + }; + MODULE_DEVICE_TABLE(platform, s2mps11_clk_id); + ++#ifdef CONFIG_OF ++/* ++ * Device is instantiated through parent MFD device and device matching is done ++ * through platform_device_id. ++ * ++ * However if device's DT node contains proper clock compatible and driver is ++ * built as a module, then the *module* matching will be done trough DT aliases. ++ * This requires of_device_id table. In the same time this will not change the ++ * actual *device* matching so do not add .of_match_table. ++ */ ++static const struct of_device_id s2mps11_dt_match[] = { ++ { ++ .compatible = "samsung,s2mps11-clk", ++ .data = (void *)S2MPS11X, ++ }, { ++ .compatible = "samsung,s2mps13-clk", ++ .data = (void *)S2MPS13X, ++ }, { ++ .compatible = "samsung,s2mps14-clk", ++ .data = (void *)S2MPS14X, ++ }, { ++ .compatible = "samsung,s5m8767-clk", ++ .data = (void *)S5M8767X, ++ }, { ++ /* Sentinel */ ++ }, ++}; ++MODULE_DEVICE_TABLE(of, s2mps11_dt_match); ++#endif ++ + static struct platform_driver s2mps11_clk_driver = { + .driver = { + .name = "s2mps11-clk", +diff --git a/drivers/clk/hisilicon/reset.c b/drivers/clk/hisilicon/reset.c +index 2a5015c736ce..43e82fa64422 100644 +--- a/drivers/clk/hisilicon/reset.c ++++ b/drivers/clk/hisilicon/reset.c +@@ -109,9 +109,8 @@ struct hisi_reset_controller *hisi_reset_init(struct platform_device *pdev) + return NULL; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- rstc->membase = devm_ioremap(&pdev->dev, +- res->start, resource_size(res)); +- if (!rstc->membase) ++ rstc->membase = devm_ioremap_resource(&pdev->dev, res); ++ if (IS_ERR(rstc->membase)) + return NULL; + + spin_lock_init(&rstc->lock); +diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c +index 00ce62ad6416..8cf74fc423e6 100644 +--- a/drivers/clk/meson/axg.c ++++ b/drivers/clk/meson/axg.c +@@ -319,6 +319,7 @@ static struct clk_regmap axg_fclk_div2 = { + .ops = &clk_regmap_gate_ops, + .parent_names = (const char *[]){ "fclk_div2_div" }, + .num_parents = 1, ++ .flags = CLK_IS_CRITICAL, + }, + }; + +@@ -343,6 +344,18 @@ static struct clk_regmap axg_fclk_div3 = { + .ops = &clk_regmap_gate_ops, + .parent_names = (const char *[]){ "fclk_div3_div" }, + .num_parents = 1, ++ /* ++ * FIXME: ++ * This clock, as fdiv2, is used by the SCPI FW and is required ++ * by the platform to operate correctly. ++ * Until the following condition are met, we need this clock to ++ * be marked as critical: ++ * a) The SCPI generic driver claims and enable all the clocks ++ * it needs ++ * b) CCF has a clock hand-off mechanism to make the sure the ++ * clock stays on until the proper driver comes along ++ */ ++ .flags = CLK_IS_CRITICAL, + }, + }; + +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index 86d3ae58e84c..6435d86118f1 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -522,6 +522,18 @@ static struct clk_regmap gxbb_fclk_div3 = { + .ops = &clk_regmap_gate_ops, + .parent_names = (const char *[]){ "fclk_div3_div" }, + .num_parents = 1, ++ /* ++ * FIXME: ++ * This clock, as fdiv2, is used by the SCPI FW and is required ++ * by the platform to operate correctly. ++ * Until the following condition are met, we need this clock to ++ * be marked as critical: ++ * a) The SCPI generic driver claims and enable all the clocks ++ * it needs ++ * b) CCF has a clock hand-off mechanism to make the sure the ++ * clock stays on until the proper driver comes along ++ */ ++ .flags = CLK_IS_CRITICAL, + }, + }; + +diff --git a/drivers/clk/rockchip/clk-ddr.c b/drivers/clk/rockchip/clk-ddr.c +index e8075359366b..ebce5260068b 100644 +--- a/drivers/clk/rockchip/clk-ddr.c ++++ b/drivers/clk/rockchip/clk-ddr.c +@@ -80,16 +80,12 @@ static long rockchip_ddrclk_sip_round_rate(struct clk_hw *hw, + static u8 rockchip_ddrclk_get_parent(struct clk_hw *hw) + { + struct rockchip_ddrclk *ddrclk = to_rockchip_ddrclk_hw(hw); +- int num_parents = clk_hw_get_num_parents(hw); + u32 val; + + val = clk_readl(ddrclk->reg_base + + ddrclk->mux_offset) >> ddrclk->mux_shift; + val &= GENMASK(ddrclk->mux_width - 1, 0); + +- if (val >= num_parents) +- return -EINVAL; +- + return val; + } + +diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c +index 252366a5231f..2c5426607790 100644 +--- a/drivers/clk/rockchip/clk-rk3328.c ++++ b/drivers/clk/rockchip/clk-rk3328.c +@@ -813,22 +813,22 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = { + MMC(SCLK_SDMMC_DRV, "sdmmc_drv", "clk_sdmmc", + RK3328_SDMMC_CON0, 1), + MMC(SCLK_SDMMC_SAMPLE, "sdmmc_sample", "clk_sdmmc", +- RK3328_SDMMC_CON1, 1), ++ RK3328_SDMMC_CON1, 0), + + MMC(SCLK_SDIO_DRV, "sdio_drv", "clk_sdio", + RK3328_SDIO_CON0, 1), + MMC(SCLK_SDIO_SAMPLE, "sdio_sample", "clk_sdio", +- RK3328_SDIO_CON1, 1), ++ RK3328_SDIO_CON1, 0), + + MMC(SCLK_EMMC_DRV, "emmc_drv", "clk_emmc", + RK3328_EMMC_CON0, 1), + MMC(SCLK_EMMC_SAMPLE, "emmc_sample", "clk_emmc", +- RK3328_EMMC_CON1, 1), ++ RK3328_EMMC_CON1, 0), + + MMC(SCLK_SDMMC_EXT_DRV, "sdmmc_ext_drv", "clk_sdmmc_ext", + RK3328_SDMMC_EXT_CON0, 1), + MMC(SCLK_SDMMC_EXT_SAMPLE, "sdmmc_ext_sample", "clk_sdmmc_ext", +- RK3328_SDMMC_EXT_CON1, 1), ++ RK3328_SDMMC_EXT_CON1, 0), + }; + + static const char *const rk3328_critical_clocks[] __initconst = { +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +index bdbfe78fe133..0f7a0ffd3f70 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +@@ -224,7 +224,7 @@ static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ahb2_clk, "psi-ahb1-ahb2", + psi_ahb1_ahb2_parents, + 0x510, + 0, 5, /* M */ +- 16, 2, /* P */ ++ 8, 2, /* P */ + 24, 2, /* mux */ + 0); + +@@ -233,19 +233,19 @@ static const char * const ahb3_apb1_apb2_parents[] = { "osc24M", "osc32k", + "pll-periph0" }; + static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c, + 0, 5, /* M */ +- 16, 2, /* P */ ++ 8, 2, /* P */ + 24, 2, /* mux */ + 0); + + static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520, + 0, 5, /* M */ +- 16, 2, /* P */ ++ 8, 2, /* P */ + 24, 2, /* mux */ + 0); + + static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524, + 0, 5, /* M */ +- 16, 2, /* P */ ++ 8, 2, /* P */ + 24, 2, /* mux */ + 0); + +diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c +index 9c38895542f4..d4350bb10b83 100644 +--- a/drivers/clocksource/i8253.c ++++ b/drivers/clocksource/i8253.c +@@ -20,6 +20,13 @@ + DEFINE_RAW_SPINLOCK(i8253_lock); + EXPORT_SYMBOL(i8253_lock); + ++/* ++ * Handle PIT quirk in pit_shutdown() where zeroing the counter register ++ * restarts the PIT, negating the shutdown. On platforms with the quirk, ++ * platform specific code can set this to false. ++ */ ++bool i8253_clear_counter_on_shutdown __ro_after_init = true; ++ + #ifdef CONFIG_CLKSRC_I8253 + /* + * Since the PIT overflows every tick, its not very useful +@@ -109,8 +116,11 @@ static int pit_shutdown(struct clock_event_device *evt) + raw_spin_lock(&i8253_lock); + + outb_p(0x30, PIT_MODE); +- outb_p(0, PIT_CH0); +- outb_p(0, PIT_CH0); ++ ++ if (i8253_clear_counter_on_shutdown) { ++ outb_p(0, PIT_CH0); ++ outb_p(0, PIT_CH0); ++ } + + raw_spin_unlock(&i8253_lock); + return 0; +diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c +index 073557f433eb..df564d783216 100644 +--- a/drivers/cpuidle/cpuidle-arm.c ++++ b/drivers/cpuidle/cpuidle-arm.c +@@ -103,13 +103,6 @@ static int __init arm_idle_init_cpu(int cpu) + goto out_kfree_drv; + } + +- ret = cpuidle_register_driver(drv); +- if (ret) { +- if (ret != -EBUSY) +- pr_err("Failed to register cpuidle driver\n"); +- goto out_kfree_drv; +- } +- + /* + * Call arch CPU operations in order to initialize + * idle states suspend back-end specific data +@@ -117,15 +110,20 @@ static int __init arm_idle_init_cpu(int cpu) + ret = arm_cpuidle_init(cpu); + + /* +- * Skip the cpuidle device initialization if the reported ++ * Allow the initialization to continue for other CPUs, if the reported + * failure is a HW misconfiguration/breakage (-ENXIO). + */ +- if (ret == -ENXIO) +- return 0; +- + if (ret) { + pr_err("CPU %d failed to init idle CPU ops\n", cpu); +- goto out_unregister_drv; ++ ret = ret == -ENXIO ? 0 : ret; ++ goto out_kfree_drv; ++ } ++ ++ ret = cpuidle_register_driver(drv); ++ if (ret) { ++ if (ret != -EBUSY) ++ pr_err("Failed to register cpuidle driver\n"); ++ goto out_kfree_drv; + } + + dev = kzalloc(sizeof(*dev), GFP_KERNEL); +diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c +index f7d6d690116e..cdc4f9a171d9 100644 +--- a/drivers/crypto/hisilicon/sec/sec_algs.c ++++ b/drivers/crypto/hisilicon/sec/sec_algs.c +@@ -732,6 +732,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + int *splits_in_nents; + int *splits_out_nents = NULL; + struct sec_request_el *el, *temp; ++ bool split = skreq->src != skreq->dst; + + mutex_init(&sec_req->lock); + sec_req->req_base = &skreq->base; +@@ -750,7 +751,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + if (ret) + goto err_free_split_sizes; + +- if (skreq->src != skreq->dst) { ++ if (split) { + sec_req->len_out = sg_nents(skreq->dst); + ret = sec_map_and_split_sg(skreq->dst, split_sizes, steps, + &splits_out, &splits_out_nents, +@@ -785,8 +786,9 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + split_sizes[i], + skreq->src != skreq->dst, + splits_in[i], splits_in_nents[i], +- splits_out[i], +- splits_out_nents[i], info); ++ split ? splits_out[i] : NULL, ++ split ? splits_out_nents[i] : 0, ++ info); + if (IS_ERR(el)) { + ret = PTR_ERR(el); + goto err_free_elements; +@@ -806,13 +808,6 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + * more refined but this is unlikely to happen so no need. + */ + +- /* Cleanup - all elements in pointer arrays have been coppied */ +- kfree(splits_in_nents); +- kfree(splits_in); +- kfree(splits_out_nents); +- kfree(splits_out); +- kfree(split_sizes); +- + /* Grab a big lock for a long time to avoid concurrency issues */ + mutex_lock(&queue->queuelock); + +@@ -827,13 +822,13 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + (!queue->havesoftqueue || + kfifo_avail(&queue->softqueue) > steps)) || + !list_empty(&ctx->backlog)) { ++ ret = -EBUSY; + if ((skreq->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) { + list_add_tail(&sec_req->backlog_head, &ctx->backlog); + mutex_unlock(&queue->queuelock); +- return -EBUSY; ++ goto out; + } + +- ret = -EBUSY; + mutex_unlock(&queue->queuelock); + goto err_free_elements; + } +@@ -842,7 +837,15 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + if (ret) + goto err_free_elements; + +- return -EINPROGRESS; ++ ret = -EINPROGRESS; ++out: ++ /* Cleanup - all elements in pointer arrays have been copied */ ++ kfree(splits_in_nents); ++ kfree(splits_in); ++ kfree(splits_out_nents); ++ kfree(splits_out); ++ kfree(split_sizes); ++ return ret; + + err_free_elements: + list_for_each_entry_safe(el, temp, &sec_req->elements, head) { +@@ -854,7 +857,7 @@ err_free_elements: + crypto_skcipher_ivsize(atfm), + DMA_BIDIRECTIONAL); + err_unmap_out_sg: +- if (skreq->src != skreq->dst) ++ if (split) + sec_unmap_sg_on_err(skreq->dst, steps, splits_out, + splits_out_nents, sec_req->len_out, + info->dev); +diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c +index 8830fa601e45..0c0d2312f4a8 100644 +--- a/drivers/firmware/efi/libstub/fdt.c ++++ b/drivers/firmware/efi/libstub/fdt.c +@@ -158,6 +158,10 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt, + return efi_status; + } + } ++ ++ /* shrink the FDT back to its minimum size */ ++ fdt_pack(fdt); ++ + return EFI_SUCCESS; + + fdt_set_fail: +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index 353993218f21..f008804f0b97 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -358,7 +358,9 @@ out: + * + * Checks the acpi event and if it matches an atif event, + * handles it. +- * Returns NOTIFY code ++ * ++ * Returns: ++ * NOTIFY_BAD or NOTIFY_DONE, depending on the event. + */ + static int amdgpu_atif_handler(struct amdgpu_device *adev, + struct acpi_bus_event *event) +@@ -372,11 +374,16 @@ static int amdgpu_atif_handler(struct amdgpu_device *adev, + if (strcmp(event->device_class, ACPI_VIDEO_CLASS) != 0) + return NOTIFY_DONE; + ++ /* Is this actually our event? */ + if (!atif || + !atif->notification_cfg.enabled || +- event->type != atif->notification_cfg.command_code) +- /* Not our event */ +- return NOTIFY_DONE; ++ event->type != atif->notification_cfg.command_code) { ++ /* These events will generate keypresses otherwise */ ++ if (event->type == ACPI_VIDEO_NOTIFY_PROBE) ++ return NOTIFY_BAD; ++ else ++ return NOTIFY_DONE; ++ } + + if (atif->functions.sbios_requests) { + struct atif_sbios_requests req; +@@ -385,7 +392,7 @@ static int amdgpu_atif_handler(struct amdgpu_device *adev, + count = amdgpu_atif_get_sbios_requests(atif, &req); + + if (count <= 0) +- return NOTIFY_DONE; ++ return NOTIFY_BAD; + + DRM_DEBUG_DRIVER("ATIF: %d pending SBIOS requests\n", count); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c +index d472a2c8399f..b80243d3972e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c +@@ -67,7 +67,8 @@ int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp, + unsigned i; + int r; + +- if (num_entries > SIZE_MAX / sizeof(struct amdgpu_bo_list_entry)) ++ if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list)) ++ / sizeof(struct amdgpu_bo_list_entry)) + return -EINVAL; + + size = sizeof(struct amdgpu_bo_list); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c +index 3a072a7a39f0..df9b173c3d0b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c +@@ -574,7 +574,7 @@ void amdgpu_vmid_mgr_init(struct amdgpu_device *adev) + /* skip over VMID 0, since it is the system VM */ + for (j = 1; j < id_mgr->num_ids; ++j) { + amdgpu_vmid_reset(adev, i, j); +- amdgpu_sync_create(&id_mgr->ids[i].active); ++ amdgpu_sync_create(&id_mgr->ids[j].active); + list_add_tail(&id_mgr->ids[j].list, &id_mgr->ids_lru); + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +index 391e2f7c03aa..f823d4baf044 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -66,6 +66,7 @@ int amdgpu_job_alloc(struct amdgpu_device *adev, unsigned num_ibs, + amdgpu_sync_create(&(*job)->sync); + amdgpu_sync_create(&(*job)->sched_sync); + (*job)->vram_lost_counter = atomic_read(&adev->vram_lost_counter); ++ (*job)->vm_pd_addr = AMDGPU_BO_INVALID_OFFSET; + + return 0; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +index f55f72a37ca8..c29d519fa381 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +@@ -277,6 +277,7 @@ amdgpu_ucode_get_load_type(struct amdgpu_device *adev, int load_type) + case CHIP_PITCAIRN: + case CHIP_VERDE: + case CHIP_OLAND: ++ case CHIP_HAINAN: + return AMDGPU_FW_LOAD_DIRECT; + #endif + #ifdef CONFIG_DRM_AMDGPU_CIK +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index b17771dd5ce7..6a84526e20e0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -714,7 +714,8 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + } + + gds_switch_needed &= !!ring->funcs->emit_gds_switch; +- vm_flush_needed &= !!ring->funcs->emit_vm_flush; ++ vm_flush_needed &= !!ring->funcs->emit_vm_flush && ++ job->vm_pd_addr != AMDGPU_BO_INVALID_OFFSET; + pasid_mapping_needed &= adev->gmc.gmc_funcs->emit_pasid_mapping && + ring->funcs->emit_wreg; + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 6ae050dc3220..9045e6fa0780 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -1120,9 +1120,6 @@ static enum surface_update_type get_plane_info_update_type(const struct dc_surfa + */ + update_flags->bits.bpp_change = 1; + +- if (u->gamma && dce_use_lut(u->plane_info->format)) +- update_flags->bits.gamma_change = 1; +- + if (memcmp(&u->plane_info->tiling_info, &u->surface->tiling_info, + sizeof(union dc_tiling_info)) != 0) { + update_flags->bits.swizzle_change = 1; +@@ -1139,7 +1136,6 @@ static enum surface_update_type get_plane_info_update_type(const struct dc_surfa + if (update_flags->bits.rotation_change + || update_flags->bits.stereo_format_change + || update_flags->bits.pixel_format_change +- || update_flags->bits.gamma_change + || update_flags->bits.bpp_change + || update_flags->bits.bandwidth_change + || update_flags->bits.output_tf_change) +@@ -1229,13 +1225,26 @@ static enum surface_update_type det_surface_update(const struct dc *dc, + if (u->coeff_reduction_factor) + update_flags->bits.coeff_reduction_change = 1; + ++ if (u->gamma) { ++ enum surface_pixel_format format = SURFACE_PIXEL_FORMAT_GRPH_BEGIN; ++ ++ if (u->plane_info) ++ format = u->plane_info->format; ++ else if (u->surface) ++ format = u->surface->format; ++ ++ if (dce_use_lut(format)) ++ update_flags->bits.gamma_change = 1; ++ } ++ + if (update_flags->bits.in_transfer_func_change) { + type = UPDATE_TYPE_MED; + elevate_update_type(&overall_type, type); + } + + if (update_flags->bits.input_csc_change +- || update_flags->bits.coeff_reduction_change) { ++ || update_flags->bits.coeff_reduction_change ++ || update_flags->bits.gamma_change) { + type = UPDATE_TYPE_FULL; + elevate_update_type(&overall_type, type); + } +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c +index fb1f373d08a1..e798241fae37 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c +@@ -466,6 +466,9 @@ static void dce12_update_clocks(struct dccg *dccg, + { + struct dm_pp_clock_for_voltage_req clock_voltage_req = {0}; + ++ /* TODO: Investigate why this is needed to fix display corruption. */ ++ new_clocks->dispclk_khz = new_clocks->dispclk_khz * 115 / 100; ++ + if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, dccg->clks.dispclk_khz)) { + clock_voltage_req.clk_type = DM_PP_CLOCK_TYPE_DISPLAY_CLK; + clock_voltage_req.clocks_in_khz = new_clocks->dispclk_khz; +diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +index bf29733958c3..962900932bee 100644 +--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c ++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +@@ -1069,10 +1069,14 @@ static void build_evenly_distributed_points( + struct dividers dividers) + { + struct gamma_pixel *p = points; +- struct gamma_pixel *p_last = p + numberof_points - 1; ++ struct gamma_pixel *p_last; + + uint32_t i = 0; + ++ // This function should not gets called with 0 as a parameter ++ ASSERT(numberof_points > 0); ++ p_last = p + numberof_points - 1; ++ + do { + struct fixed31_32 value = dc_fixpt_from_fraction(i, + numberof_points - 1); +@@ -1083,7 +1087,7 @@ static void build_evenly_distributed_points( + + ++p; + ++i; +- } while (i != numberof_points); ++ } while (i < numberof_points); + + p->r = dc_fixpt_div(p_last->r, dividers.divider1); + p->g = dc_fixpt_div(p_last->g, dividers.divider1); +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c +index 0adfc5392cd3..c9a15baf2c10 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c +@@ -1222,14 +1222,17 @@ static int smu8_dpm_force_dpm_level(struct pp_hwmgr *hwmgr, + + static int smu8_dpm_powerdown_uvd(struct pp_hwmgr *hwmgr) + { +- if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) ++ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) { ++ smu8_nbdpm_pstate_enable_disable(hwmgr, true, true); + return smum_send_msg_to_smc(hwmgr, PPSMC_MSG_UVDPowerOFF); ++ } + return 0; + } + + static int smu8_dpm_powerup_uvd(struct pp_hwmgr *hwmgr) + { + if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) { ++ smu8_nbdpm_pstate_enable_disable(hwmgr, false, true); + return smum_send_msg_to_smc_with_parameter( + hwmgr, + PPSMC_MSG_UVDPowerON, +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +index fbe3ef4ee45c..924788772b07 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +@@ -2268,11 +2268,13 @@ static uint32_t ci_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU7_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case LowSclkInterruptThreshold: + return offsetof(SMU7_Discrete_DpmTable, LowSclkInterruptT); + } ++ break; + } + pr_debug("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c +index 18048f8e2f13..40df5c2706cc 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c +@@ -2330,6 +2330,7 @@ static uint32_t fiji_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU73_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case UvdBootLevel: +@@ -2339,6 +2340,7 @@ static uint32_t fiji_get_offsetof(uint32_t type, uint32_t member) + case LowSclkInterruptThreshold: + return offsetof(SMU73_Discrete_DpmTable, LowSclkInterruptThreshold); + } ++ break; + } + pr_warn("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c +index 9299b93aa09a..302ca7745723 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c +@@ -2236,11 +2236,13 @@ static uint32_t iceland_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU71_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case LowSclkInterruptThreshold: + return offsetof(SMU71_Discrete_DpmTable, LowSclkInterruptThreshold); + } ++ break; + } + pr_warn("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c +index 7dabc6c456e1..697c8d92bd53 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c +@@ -2618,6 +2618,7 @@ static uint32_t tonga_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU72_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case UvdBootLevel: +@@ -2627,6 +2628,7 @@ static uint32_t tonga_get_offsetof(uint32_t type, uint32_t member) + case LowSclkInterruptThreshold: + return offsetof(SMU72_Discrete_DpmTable, LowSclkInterruptThreshold); + } ++ break; + } + pr_warn("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c +index 57420d7caa4e..59113fdd1c1c 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c +@@ -2184,6 +2184,7 @@ static uint32_t vegam_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU75_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case UvdBootLevel: +@@ -2193,6 +2194,7 @@ static uint32_t vegam_get_offsetof(uint32_t type, uint32_t member) + case LowSclkInterruptThreshold: + return offsetof(SMU75_Discrete_DpmTable, LowSclkInterruptThreshold); + } ++ break; + } + pr_warn("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 7780567aa669..d708472d93c4 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1274,6 +1274,9 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_ + mutex_lock(&mgr->lock); + mstb = mgr->mst_primary; + ++ if (!mstb) ++ goto out; ++ + for (i = 0; i < lct - 1; i++) { + int shift = (i % 2) ? 0 : 4; + int port_num = (rad[i / 2] >> shift) & 0xf; +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index fe9c6c731e87..ee4a5e1221f1 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -30,6 +30,12 @@ struct drm_dmi_panel_orientation_data { + int orientation; + }; + ++static const struct drm_dmi_panel_orientation_data acer_s1003 = { ++ .width = 800, ++ .height = 1280, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data asus_t100ha = { + .width = 800, + .height = 1280, +@@ -67,7 +73,13 @@ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = { + }; + + static const struct dmi_system_id orientation_data[] = { +- { /* Asus T100HA */ ++ { /* Acer One 10 (S1003) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), ++ }, ++ .driver_data = (void *)&acer_s1003, ++ }, { /* Asus T100HA */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"), +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c +index 69e9b431bf1f..e5a9fae31ab7 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c +@@ -93,7 +93,7 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job) + * If the GPU managed to complete this jobs fence, the timout is + * spurious. Bail out. + */ +- if (fence_completed(gpu, submit->out_fence->seqno)) ++ if (dma_fence_is_signaled(submit->out_fence)) + return; + + /* +diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +index b92595c477ef..8bd29075ae4e 100644 +--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c ++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +@@ -122,6 +122,7 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper, + hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj); + if (IS_ERR(hi_fbdev->fb)) { + ret = PTR_ERR(hi_fbdev->fb); ++ hi_fbdev->fb = NULL; + DRM_ERROR("failed to initialize framebuffer: %d\n", ret); + goto out_release_fbi; + } +diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h +index 7a9b36176efb..bfb6f652b09f 100644 +--- a/drivers/gpu/drm/i915/gvt/gtt.h ++++ b/drivers/gpu/drm/i915/gvt/gtt.h +@@ -35,7 +35,6 @@ + #define _GVT_GTT_H_ + + #define I915_GTT_PAGE_SHIFT 12 +-#define I915_GTT_PAGE_MASK (~(I915_GTT_PAGE_SIZE - 1)) + + struct intel_vgpu_mm; + +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index fcc73a6ab503..47cc932e23a7 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1122,11 +1122,7 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj, + offset = offset_in_page(args->offset); + for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { + struct page *page = i915_gem_object_get_page(obj, idx); +- int length; +- +- length = remain; +- if (offset + length > PAGE_SIZE) +- length = PAGE_SIZE - offset; ++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); + + ret = shmem_pread(page, offset, length, user_data, + page_to_phys(page) & obj_do_bit17_swizzling, +@@ -1570,11 +1566,7 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj, + offset = offset_in_page(args->offset); + for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { + struct page *page = i915_gem_object_get_page(obj, idx); +- int length; +- +- length = remain; +- if (offset + length > PAGE_SIZE) +- length = PAGE_SIZE - offset; ++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); + + ret = shmem_pwrite(page, offset, length, user_data, + page_to_phys(page) & obj_do_bit17_swizzling, +diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +index 3f0c612d42e7..679bbae52945 100644 +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -458,7 +458,7 @@ eb_validate_vma(struct i915_execbuffer *eb, + * any non-page-aligned or non-canonical addresses. + */ + if (unlikely(entry->flags & EXEC_OBJECT_PINNED && +- entry->offset != gen8_canonical_addr(entry->offset & PAGE_MASK))) ++ entry->offset != gen8_canonical_addr(entry->offset & I915_GTT_PAGE_MASK))) + return -EINVAL; + + /* pad_to_size was once a reserved field, so sanitize it */ +diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c +index f00c7fbef79e..294a143b85f5 100644 +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -1768,7 +1768,7 @@ static void gen6_dump_ppgtt(struct i915_hw_ppgtt *base, struct seq_file *m) + if (i == 4) + continue; + +- seq_printf(m, "\t\t(%03d, %04d) %08lx: ", ++ seq_printf(m, "\t\t(%03d, %04d) %08llx: ", + pde, pte, + (pde * GEN6_PTES + pte) * PAGE_SIZE); + for (i = 0; i < 4; i++) { +diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h +index 2a116a91420b..680e0dc5db4b 100644 +--- a/drivers/gpu/drm/i915/i915_gem_gtt.h ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.h +@@ -42,13 +42,15 @@ + #include "i915_selftest.h" + #include "i915_timeline.h" + +-#define I915_GTT_PAGE_SIZE_4K BIT(12) +-#define I915_GTT_PAGE_SIZE_64K BIT(16) +-#define I915_GTT_PAGE_SIZE_2M BIT(21) ++#define I915_GTT_PAGE_SIZE_4K BIT_ULL(12) ++#define I915_GTT_PAGE_SIZE_64K BIT_ULL(16) ++#define I915_GTT_PAGE_SIZE_2M BIT_ULL(21) + + #define I915_GTT_PAGE_SIZE I915_GTT_PAGE_SIZE_4K + #define I915_GTT_MAX_PAGE_SIZE I915_GTT_PAGE_SIZE_2M + ++#define I915_GTT_PAGE_MASK -I915_GTT_PAGE_SIZE ++ + #define I915_GTT_MIN_ALIGNMENT I915_GTT_PAGE_SIZE + + #define I915_FENCE_REG_NONE -1 +@@ -662,20 +664,20 @@ int i915_gem_gtt_insert(struct i915_address_space *vm, + u64 start, u64 end, unsigned int flags); + + /* Flags used by pin/bind&friends. */ +-#define PIN_NONBLOCK BIT(0) +-#define PIN_MAPPABLE BIT(1) +-#define PIN_ZONE_4G BIT(2) +-#define PIN_NONFAULT BIT(3) +-#define PIN_NOEVICT BIT(4) +- +-#define PIN_MBZ BIT(5) /* I915_VMA_PIN_OVERFLOW */ +-#define PIN_GLOBAL BIT(6) /* I915_VMA_GLOBAL_BIND */ +-#define PIN_USER BIT(7) /* I915_VMA_LOCAL_BIND */ +-#define PIN_UPDATE BIT(8) +- +-#define PIN_HIGH BIT(9) +-#define PIN_OFFSET_BIAS BIT(10) +-#define PIN_OFFSET_FIXED BIT(11) ++#define PIN_NONBLOCK BIT_ULL(0) ++#define PIN_MAPPABLE BIT_ULL(1) ++#define PIN_ZONE_4G BIT_ULL(2) ++#define PIN_NONFAULT BIT_ULL(3) ++#define PIN_NOEVICT BIT_ULL(4) ++ ++#define PIN_MBZ BIT_ULL(5) /* I915_VMA_PIN_OVERFLOW */ ++#define PIN_GLOBAL BIT_ULL(6) /* I915_VMA_GLOBAL_BIND */ ++#define PIN_USER BIT_ULL(7) /* I915_VMA_LOCAL_BIND */ ++#define PIN_UPDATE BIT_ULL(8) ++ ++#define PIN_HIGH BIT_ULL(9) ++#define PIN_OFFSET_BIAS BIT_ULL(10) ++#define PIN_OFFSET_FIXED BIT_ULL(11) + #define PIN_OFFSET_MASK (-I915_GTT_PAGE_SIZE) + + #endif +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 9e63cd47b60f..5b544cb38148 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -2097,8 +2097,12 @@ enum i915_power_well_id { + + /* ICL PHY DFLEX registers */ + #define PORT_TX_DFLEXDPMLE1 _MMIO(0x1638C0) +-#define DFLEXDPMLE1_DPMLETC_MASK(n) (0xf << (4 * (n))) +-#define DFLEXDPMLE1_DPMLETC(n, x) ((x) << (4 * (n))) ++#define DFLEXDPMLE1_DPMLETC_MASK(tc_port) (0xf << (4 * (tc_port))) ++#define DFLEXDPMLE1_DPMLETC_ML0(tc_port) (1 << (4 * (tc_port))) ++#define DFLEXDPMLE1_DPMLETC_ML1_0(tc_port) (3 << (4 * (tc_port))) ++#define DFLEXDPMLE1_DPMLETC_ML3(tc_port) (8 << (4 * (tc_port))) ++#define DFLEXDPMLE1_DPMLETC_ML3_2(tc_port) (12 << (4 * (tc_port))) ++#define DFLEXDPMLE1_DPMLETC_ML3_0(tc_port) (15 << (4 * (tc_port))) + + /* BXT PHY Ref registers */ + #define _PORT_REF_DW3_A 0x16218C +diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c +index 769f3f586661..ee3ca2de983b 100644 +--- a/drivers/gpu/drm/i915/intel_audio.c ++++ b/drivers/gpu/drm/i915/intel_audio.c +@@ -144,6 +144,9 @@ static const struct { + /* HDMI N/CTS table */ + #define TMDS_297M 297000 + #define TMDS_296M 296703 ++#define TMDS_594M 594000 ++#define TMDS_593M 593407 ++ + static const struct { + int sample_rate; + int clock; +@@ -164,6 +167,20 @@ static const struct { + { 176400, TMDS_297M, 18816, 247500 }, + { 192000, TMDS_296M, 23296, 281250 }, + { 192000, TMDS_297M, 20480, 247500 }, ++ { 44100, TMDS_593M, 8918, 937500 }, ++ { 44100, TMDS_594M, 9408, 990000 }, ++ { 48000, TMDS_593M, 5824, 562500 }, ++ { 48000, TMDS_594M, 6144, 594000 }, ++ { 32000, TMDS_593M, 5824, 843750 }, ++ { 32000, TMDS_594M, 3072, 445500 }, ++ { 88200, TMDS_593M, 17836, 937500 }, ++ { 88200, TMDS_594M, 18816, 990000 }, ++ { 96000, TMDS_593M, 11648, 562500 }, ++ { 96000, TMDS_594M, 12288, 594000 }, ++ { 176400, TMDS_593M, 35672, 937500 }, ++ { 176400, TMDS_594M, 37632, 990000 }, ++ { 192000, TMDS_593M, 23296, 562500 }, ++ { 192000, TMDS_594M, 24576, 594000 }, + }; + + /* get AUD_CONFIG_PIXEL_CLOCK_HDMI_* value for mode */ +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index d2951096bca0..3bd44d042a1d 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -2754,20 +2754,33 @@ intel_set_plane_visible(struct intel_crtc_state *crtc_state, + + plane_state->base.visible = visible; + +- /* FIXME pre-g4x don't work like this */ +- if (visible) { ++ if (visible) + crtc_state->base.plane_mask |= drm_plane_mask(&plane->base); +- crtc_state->active_planes |= BIT(plane->id); +- } else { ++ else + crtc_state->base.plane_mask &= ~drm_plane_mask(&plane->base); +- crtc_state->active_planes &= ~BIT(plane->id); +- } + + DRM_DEBUG_KMS("%s active planes 0x%x\n", + crtc_state->base.crtc->name, + crtc_state->active_planes); + } + ++static void fixup_active_planes(struct intel_crtc_state *crtc_state) ++{ ++ struct drm_i915_private *dev_priv = to_i915(crtc_state->base.crtc->dev); ++ struct drm_plane *plane; ++ ++ /* ++ * Active_planes aliases if multiple "primary" or cursor planes ++ * have been used on the same (or wrong) pipe. plane_mask uses ++ * unique ids, hence we can use that to reconstruct active_planes. ++ */ ++ crtc_state->active_planes = 0; ++ ++ drm_for_each_plane_mask(plane, &dev_priv->drm, ++ crtc_state->base.plane_mask) ++ crtc_state->active_planes |= BIT(to_intel_plane(plane)->id); ++} ++ + static void intel_plane_disable_noatomic(struct intel_crtc *crtc, + struct intel_plane *plane) + { +@@ -2777,6 +2790,7 @@ static void intel_plane_disable_noatomic(struct intel_crtc *crtc, + to_intel_plane_state(plane->base.state); + + intel_set_plane_visible(crtc_state, plane_state, false); ++ fixup_active_planes(crtc_state); + + if (plane->id == PLANE_PRIMARY) + intel_pre_disable_primary_noatomic(&crtc->base); +@@ -2795,7 +2809,6 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc, + struct drm_i915_gem_object *obj; + struct drm_plane *primary = intel_crtc->base.primary; + struct drm_plane_state *plane_state = primary->state; +- struct drm_crtc_state *crtc_state = intel_crtc->base.state; + struct intel_plane *intel_plane = to_intel_plane(primary); + struct intel_plane_state *intel_state = + to_intel_plane_state(plane_state); +@@ -2885,10 +2898,6 @@ valid_fb: + plane_state->fb = fb; + plane_state->crtc = &intel_crtc->base; + +- intel_set_plane_visible(to_intel_crtc_state(crtc_state), +- to_intel_plane_state(plane_state), +- true); +- + atomic_or(to_intel_plane(primary)->frontbuffer_bit, + &obj->frontbuffer_bits); + } +@@ -12630,17 +12639,12 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) + intel_check_cpu_fifo_underruns(dev_priv); + intel_check_pch_fifo_underruns(dev_priv); + +- if (!new_crtc_state->active) { +- /* +- * Make sure we don't call initial_watermarks +- * for ILK-style watermark updates. +- * +- * No clue what this is supposed to achieve. +- */ +- if (INTEL_GEN(dev_priv) >= 9) +- dev_priv->display.initial_watermarks(intel_state, +- to_intel_crtc_state(new_crtc_state)); +- } ++ /* FIXME unify this for all platforms */ ++ if (!new_crtc_state->active && ++ !HAS_GMCH_DISPLAY(dev_priv) && ++ dev_priv->display.initial_watermarks) ++ dev_priv->display.initial_watermarks(intel_state, ++ to_intel_crtc_state(new_crtc_state)); + } + } + +@@ -14573,7 +14577,7 @@ static int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + fb->height < SKL_MIN_YUV_420_SRC_H || + (fb->width % 4) != 0 || (fb->height % 4) != 0)) { + DRM_DEBUG_KMS("src dimensions not correct for NV12\n"); +- return -EINVAL; ++ goto err; + } + + for (i = 0; i < fb->format->num_planes; i++) { +@@ -15365,17 +15369,6 @@ void i830_disable_pipe(struct drm_i915_private *dev_priv, enum pipe pipe) + POSTING_READ(DPLL(pipe)); + } + +-static bool intel_plane_mapping_ok(struct intel_crtc *crtc, +- struct intel_plane *plane) +-{ +- enum pipe pipe; +- +- if (!plane->get_hw_state(plane, &pipe)) +- return true; +- +- return pipe == crtc->pipe; +-} +- + static void + intel_sanitize_plane_mapping(struct drm_i915_private *dev_priv) + { +@@ -15387,13 +15380,20 @@ intel_sanitize_plane_mapping(struct drm_i915_private *dev_priv) + for_each_intel_crtc(&dev_priv->drm, crtc) { + struct intel_plane *plane = + to_intel_plane(crtc->base.primary); ++ struct intel_crtc *plane_crtc; ++ enum pipe pipe; + +- if (intel_plane_mapping_ok(crtc, plane)) ++ if (!plane->get_hw_state(plane, &pipe)) ++ continue; ++ ++ if (pipe == crtc->pipe) + continue; + + DRM_DEBUG_KMS("%s attached to the wrong pipe, disabling plane\n", + plane->base.name); +- intel_plane_disable_noatomic(crtc, plane); ++ ++ plane_crtc = intel_get_crtc_for_pipe(dev_priv, pipe); ++ intel_plane_disable_noatomic(plane_crtc, plane); + } + } + +@@ -15441,13 +15441,9 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc, + I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK); + } + +- /* restore vblank interrupts to correct state */ +- drm_crtc_vblank_reset(&crtc->base); + if (crtc->active) { + struct intel_plane *plane; + +- drm_crtc_vblank_on(&crtc->base); +- + /* Disable everything but the primary plane */ + for_each_intel_plane_on_crtc(dev, crtc, plane) { + const struct intel_plane_state *plane_state = +@@ -15565,23 +15561,32 @@ void i915_redisable_vga(struct drm_i915_private *dev_priv) + } + + /* FIXME read out full plane state for all planes */ +-static void readout_plane_state(struct intel_crtc *crtc) ++static void readout_plane_state(struct drm_i915_private *dev_priv) + { +- struct drm_i915_private *dev_priv = to_i915(crtc->base.dev); +- struct intel_crtc_state *crtc_state = +- to_intel_crtc_state(crtc->base.state); + struct intel_plane *plane; ++ struct intel_crtc *crtc; + +- for_each_intel_plane_on_crtc(&dev_priv->drm, crtc, plane) { ++ for_each_intel_plane(&dev_priv->drm, plane) { + struct intel_plane_state *plane_state = + to_intel_plane_state(plane->base.state); +- enum pipe pipe; ++ struct intel_crtc_state *crtc_state; ++ enum pipe pipe = PIPE_A; + bool visible; + + visible = plane->get_hw_state(plane, &pipe); + ++ crtc = intel_get_crtc_for_pipe(dev_priv, pipe); ++ crtc_state = to_intel_crtc_state(crtc->base.state); ++ + intel_set_plane_visible(crtc_state, plane_state, visible); + } ++ ++ for_each_intel_crtc(&dev_priv->drm, crtc) { ++ struct intel_crtc_state *crtc_state = ++ to_intel_crtc_state(crtc->base.state); ++ ++ fixup_active_planes(crtc_state); ++ } + } + + static void intel_modeset_readout_hw_state(struct drm_device *dev) +@@ -15613,13 +15618,13 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev) + if (crtc_state->base.active) + dev_priv->active_crtcs |= 1 << crtc->pipe; + +- readout_plane_state(crtc); +- + DRM_DEBUG_KMS("[CRTC:%d:%s] hw state readout: %s\n", + crtc->base.base.id, crtc->base.name, + enableddisabled(crtc_state->base.active)); + } + ++ readout_plane_state(dev_priv); ++ + for (i = 0; i < dev_priv->num_shared_dpll; i++) { + struct intel_shared_dpll *pll = &dev_priv->shared_dplls[i]; + +@@ -15789,7 +15794,6 @@ intel_modeset_setup_hw_state(struct drm_device *dev, + struct drm_modeset_acquire_ctx *ctx) + { + struct drm_i915_private *dev_priv = to_i915(dev); +- enum pipe pipe; + struct intel_crtc *crtc; + struct intel_encoder *encoder; + int i; +@@ -15800,15 +15804,23 @@ intel_modeset_setup_hw_state(struct drm_device *dev, + /* HW state is read out, now we need to sanitize this mess. */ + get_encoder_power_domains(dev_priv); + +- intel_sanitize_plane_mapping(dev_priv); ++ /* ++ * intel_sanitize_plane_mapping() may need to do vblank ++ * waits, so we need vblank interrupts restored beforehand. ++ */ ++ for_each_intel_crtc(&dev_priv->drm, crtc) { ++ drm_crtc_vblank_reset(&crtc->base); + +- for_each_intel_encoder(dev, encoder) { +- intel_sanitize_encoder(encoder); ++ if (crtc->active) ++ drm_crtc_vblank_on(&crtc->base); + } + +- for_each_pipe(dev_priv, pipe) { +- crtc = intel_get_crtc_for_pipe(dev_priv, pipe); ++ intel_sanitize_plane_mapping(dev_priv); + ++ for_each_intel_encoder(dev, encoder) ++ intel_sanitize_encoder(encoder); ++ ++ for_each_intel_crtc(&dev_priv->drm, crtc) { + intel_sanitize_crtc(crtc, ctx); + intel_dump_pipe_config(crtc, crtc->config, + "[setup_hw_state]"); +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 1193202766a2..f92079e19de8 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -401,6 +401,22 @@ static bool intel_dp_link_params_valid(struct intel_dp *intel_dp, int link_rate, + return true; + } + ++static bool intel_dp_can_link_train_fallback_for_edp(struct intel_dp *intel_dp, ++ int link_rate, ++ uint8_t lane_count) ++{ ++ const struct drm_display_mode *fixed_mode = ++ intel_dp->attached_connector->panel.fixed_mode; ++ int mode_rate, max_rate; ++ ++ mode_rate = intel_dp_link_required(fixed_mode->clock, 18); ++ max_rate = intel_dp_max_data_rate(link_rate, lane_count); ++ if (mode_rate > max_rate) ++ return false; ++ ++ return true; ++} ++ + int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp, + int link_rate, uint8_t lane_count) + { +@@ -410,9 +426,23 @@ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp, + intel_dp->num_common_rates, + link_rate); + if (index > 0) { ++ if (intel_dp_is_edp(intel_dp) && ++ !intel_dp_can_link_train_fallback_for_edp(intel_dp, ++ intel_dp->common_rates[index - 1], ++ lane_count)) { ++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n"); ++ return 0; ++ } + intel_dp->max_link_rate = intel_dp->common_rates[index - 1]; + intel_dp->max_link_lane_count = lane_count; + } else if (lane_count > 1) { ++ if (intel_dp_is_edp(intel_dp) && ++ !intel_dp_can_link_train_fallback_for_edp(intel_dp, ++ intel_dp_max_common_rate(intel_dp), ++ lane_count >> 1)) { ++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n"); ++ return 0; ++ } + intel_dp->max_link_rate = intel_dp_max_common_rate(intel_dp); + intel_dp->max_link_lane_count = lane_count >> 1; + } else { +@@ -4709,19 +4739,13 @@ intel_dp_long_pulse(struct intel_connector *connector, + */ + status = connector_status_disconnected; + goto out; +- } else { +- /* +- * If display is now connected check links status, +- * there has been known issues of link loss triggering +- * long pulse. +- * +- * Some sinks (eg. ASUS PB287Q) seem to perform some +- * weird HPD ping pong during modesets. So we can apparently +- * end up with HPD going low during a modeset, and then +- * going back up soon after. And once that happens we must +- * retrain the link to get a picture. That's in case no +- * userspace component reacted to intermittent HPD dip. +- */ ++ } ++ ++ /* ++ * Some external monitors do not signal loss of link synchronization ++ * with an IRQ_HPD, so force a link status check. ++ */ ++ if (!intel_dp_is_edp(intel_dp)) { + struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base; + + intel_dp_retrain_link(encoder, ctx); +diff --git a/drivers/gpu/drm/i915/intel_dp_link_training.c b/drivers/gpu/drm/i915/intel_dp_link_training.c +index 4da6e33c7fa1..329309a085cb 100644 +--- a/drivers/gpu/drm/i915/intel_dp_link_training.c ++++ b/drivers/gpu/drm/i915/intel_dp_link_training.c +@@ -352,22 +352,14 @@ intel_dp_start_link_train(struct intel_dp *intel_dp) + return; + + failure_handling: +- /* Dont fallback and prune modes if its eDP */ +- if (!intel_dp_is_edp(intel_dp)) { +- DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d", +- intel_connector->base.base.id, +- intel_connector->base.name, +- intel_dp->link_rate, intel_dp->lane_count); +- if (!intel_dp_get_link_train_fallback_values(intel_dp, +- intel_dp->link_rate, +- intel_dp->lane_count)) +- /* Schedule a Hotplug Uevent to userspace to start modeset */ +- schedule_work(&intel_connector->modeset_retry_work); +- } else { +- DRM_ERROR("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d", +- intel_connector->base.base.id, +- intel_connector->base.name, +- intel_dp->link_rate, intel_dp->lane_count); +- } ++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d", ++ intel_connector->base.base.id, ++ intel_connector->base.name, ++ intel_dp->link_rate, intel_dp->lane_count); ++ if (!intel_dp_get_link_train_fallback_values(intel_dp, ++ intel_dp->link_rate, ++ intel_dp->lane_count)) ++ /* Schedule a Hotplug Uevent to userspace to start modeset */ ++ schedule_work(&intel_connector->modeset_retry_work); + return; + } +diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c +index 4ecd65375603..1fec0c71b4d9 100644 +--- a/drivers/gpu/drm/i915/intel_dp_mst.c ++++ b/drivers/gpu/drm/i915/intel_dp_mst.c +@@ -38,11 +38,11 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder, + struct intel_dp_mst_encoder *intel_mst = enc_to_mst(&encoder->base); + struct intel_digital_port *intel_dig_port = intel_mst->primary; + struct intel_dp *intel_dp = &intel_dig_port->dp; +- struct intel_connector *connector = +- to_intel_connector(conn_state->connector); ++ struct drm_connector *connector = conn_state->connector; ++ void *port = to_intel_connector(connector)->port; + struct drm_atomic_state *state = pipe_config->base.state; + int bpp; +- int lane_count, slots; ++ int lane_count, slots = 0; + const struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode; + int mst_pbn; + bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc, +@@ -70,17 +70,23 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder, + + pipe_config->port_clock = intel_dp_max_link_rate(intel_dp); + +- if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, connector->port)) ++ if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, port)) + pipe_config->has_audio = true; + + mst_pbn = drm_dp_calc_pbn_mode(adjusted_mode->crtc_clock, bpp); + pipe_config->pbn = mst_pbn; + +- slots = drm_dp_atomic_find_vcpi_slots(state, &intel_dp->mst_mgr, +- connector->port, mst_pbn); +- if (slots < 0) { +- DRM_DEBUG_KMS("failed finding vcpi slots:%d\n", slots); +- return false; ++ /* Zombie connectors can't have VCPI slots */ ++ if (READ_ONCE(connector->registered)) { ++ slots = drm_dp_atomic_find_vcpi_slots(state, ++ &intel_dp->mst_mgr, ++ port, ++ mst_pbn); ++ if (slots < 0) { ++ DRM_DEBUG_KMS("failed finding vcpi slots:%d\n", ++ slots); ++ return false; ++ } + } + + intel_link_compute_m_n(bpp, lane_count, +@@ -311,9 +317,8 @@ static int intel_dp_mst_get_ddc_modes(struct drm_connector *connector) + struct edid *edid; + int ret; + +- if (!intel_dp) { ++ if (!READ_ONCE(connector->registered)) + return intel_connector_update_modes(connector, NULL); +- } + + edid = drm_dp_mst_get_edid(connector, &intel_dp->mst_mgr, intel_connector->port); + ret = intel_connector_update_modes(connector, edid); +@@ -328,9 +333,10 @@ intel_dp_mst_detect(struct drm_connector *connector, bool force) + struct intel_connector *intel_connector = to_intel_connector(connector); + struct intel_dp *intel_dp = intel_connector->mst_port; + +- if (!intel_dp) ++ if (!READ_ONCE(connector->registered)) + return connector_status_disconnected; +- return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, intel_connector->port); ++ return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, ++ intel_connector->port); + } + + static void +@@ -370,7 +376,7 @@ intel_dp_mst_mode_valid(struct drm_connector *connector, + int bpp = 24; /* MST uses fixed bpp */ + int max_rate, mode_rate, max_lanes, max_link_clock; + +- if (!intel_dp) ++ if (!READ_ONCE(connector->registered)) + return MODE_ERROR; + + if (mode->flags & DRM_MODE_FLAG_DBLSCAN) +@@ -402,7 +408,7 @@ static struct drm_encoder *intel_mst_atomic_best_encoder(struct drm_connector *c + struct intel_dp *intel_dp = intel_connector->mst_port; + struct intel_crtc *crtc = to_intel_crtc(state->crtc); + +- if (!intel_dp) ++ if (!READ_ONCE(connector->registered)) + return NULL; + return &intel_dp->mst_encoders[crtc->pipe]->base.base; + } +@@ -452,6 +458,10 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo + if (!intel_connector) + return NULL; + ++ intel_connector->get_hw_state = intel_dp_mst_get_hw_state; ++ intel_connector->mst_port = intel_dp; ++ intel_connector->port = port; ++ + connector = &intel_connector->base; + ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs, + DRM_MODE_CONNECTOR_DisplayPort); +@@ -462,10 +472,6 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo + + drm_connector_helper_add(connector, &intel_dp_mst_connector_helper_funcs); + +- intel_connector->get_hw_state = intel_dp_mst_get_hw_state; +- intel_connector->mst_port = intel_dp; +- intel_connector->port = port; +- + for_each_pipe(dev_priv, pipe) { + struct drm_encoder *enc = + &intel_dp->mst_encoders[pipe]->base.base; +@@ -503,7 +509,6 @@ static void intel_dp_register_mst_connector(struct drm_connector *connector) + static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + struct drm_connector *connector) + { +- struct intel_connector *intel_connector = to_intel_connector(connector); + struct drm_i915_private *dev_priv = to_i915(connector->dev); + + DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", connector->base.id, connector->name); +@@ -512,10 +517,6 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + if (dev_priv->fbdev) + drm_fb_helper_remove_one_connector(&dev_priv->fbdev->helper, + connector); +- /* prevent race with the check in ->detect */ +- drm_modeset_lock(&connector->dev->mode_config.connection_mutex, NULL); +- intel_connector->mst_port = NULL; +- drm_modeset_unlock(&connector->dev->mode_config.connection_mutex); + + drm_connector_put(connector); + } +diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c +index 648a13c6043c..9a8018130237 100644 +--- a/drivers/gpu/drm/i915/intel_hotplug.c ++++ b/drivers/gpu/drm/i915/intel_hotplug.c +@@ -228,7 +228,9 @@ static void intel_hpd_irq_storm_reenable_work(struct work_struct *work) + drm_for_each_connector_iter(connector, &conn_iter) { + struct intel_connector *intel_connector = to_intel_connector(connector); + +- if (intel_connector->encoder->hpd_pin == pin) { ++ /* Don't check MST ports, they don't have pins */ ++ if (!intel_connector->mst_port && ++ intel_connector->encoder->hpd_pin == pin) { + if (connector->polled != intel_connector->polled) + DRM_DEBUG_DRIVER("Reenabling HPD on connector %s\n", + connector->name); +@@ -395,37 +397,54 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv, + struct intel_encoder *encoder; + bool storm_detected = false; + bool queue_dig = false, queue_hp = false; ++ u32 long_hpd_pulse_mask = 0; ++ u32 short_hpd_pulse_mask = 0; ++ enum hpd_pin pin; + + if (!pin_mask) + return; + + spin_lock(&dev_priv->irq_lock); ++ ++ /* ++ * Determine whether ->hpd_pulse() exists for each pin, and ++ * whether we have a short or a long pulse. This is needed ++ * as each pin may have up to two encoders (HDMI and DP) and ++ * only the one of them (DP) will have ->hpd_pulse(). ++ */ + for_each_intel_encoder(&dev_priv->drm, encoder) { +- enum hpd_pin pin = encoder->hpd_pin; + bool has_hpd_pulse = intel_encoder_has_hpd_pulse(encoder); ++ enum port port = encoder->port; ++ bool long_hpd; + ++ pin = encoder->hpd_pin; + if (!(BIT(pin) & pin_mask)) + continue; + +- if (has_hpd_pulse) { +- bool long_hpd = long_mask & BIT(pin); +- enum port port = encoder->port; ++ if (!has_hpd_pulse) ++ continue; + +- DRM_DEBUG_DRIVER("digital hpd port %c - %s\n", port_name(port), +- long_hpd ? "long" : "short"); +- /* +- * For long HPD pulses we want to have the digital queue happen, +- * but we still want HPD storm detection to function. +- */ +- queue_dig = true; +- if (long_hpd) { +- dev_priv->hotplug.long_port_mask |= (1 << port); +- } else { +- /* for short HPD just trigger the digital queue */ +- dev_priv->hotplug.short_port_mask |= (1 << port); +- continue; +- } ++ long_hpd = long_mask & BIT(pin); ++ ++ DRM_DEBUG_DRIVER("digital hpd port %c - %s\n", port_name(port), ++ long_hpd ? "long" : "short"); ++ queue_dig = true; ++ ++ if (long_hpd) { ++ long_hpd_pulse_mask |= BIT(pin); ++ dev_priv->hotplug.long_port_mask |= BIT(port); ++ } else { ++ short_hpd_pulse_mask |= BIT(pin); ++ dev_priv->hotplug.short_port_mask |= BIT(port); + } ++ } ++ ++ /* Now process each pin just once */ ++ for_each_hpd_pin(pin) { ++ bool long_hpd; ++ ++ if (!(BIT(pin) & pin_mask)) ++ continue; + + if (dev_priv->hotplug.stats[pin].state == HPD_DISABLED) { + /* +@@ -442,11 +461,22 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv, + if (dev_priv->hotplug.stats[pin].state != HPD_ENABLED) + continue; + +- if (!has_hpd_pulse) { ++ /* ++ * Delegate to ->hpd_pulse() if one of the encoders for this ++ * pin has it, otherwise let the hotplug_work deal with this ++ * pin directly. ++ */ ++ if (((short_hpd_pulse_mask | long_hpd_pulse_mask) & BIT(pin))) { ++ long_hpd = long_hpd_pulse_mask & BIT(pin); ++ } else { + dev_priv->hotplug.event_bits |= BIT(pin); ++ long_hpd = true; + queue_hp = true; + } + ++ if (!long_hpd) ++ continue; ++ + if (intel_hpd_irq_storm_detect(dev_priv, pin)) { + dev_priv->hotplug.event_bits &= ~BIT(pin); + storm_detected = true; +diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c +index cdf19553ffac..5d5336fbe7b0 100644 +--- a/drivers/gpu/drm/i915/intel_lpe_audio.c ++++ b/drivers/gpu/drm/i915/intel_lpe_audio.c +@@ -297,8 +297,10 @@ void intel_lpe_audio_teardown(struct drm_i915_private *dev_priv) + lpe_audio_platdev_destroy(dev_priv); + + irq_free_desc(dev_priv->lpe_audio.irq); +-} + ++ dev_priv->lpe_audio.irq = -1; ++ dev_priv->lpe_audio.platdev = NULL; ++} + + /** + * intel_lpe_audio_notify() - notify lpe audio event +diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c +index 174479232e94..75ea87ebf9b0 100644 +--- a/drivers/gpu/drm/i915/intel_lrc.c ++++ b/drivers/gpu/drm/i915/intel_lrc.c +@@ -424,7 +424,8 @@ static u64 execlists_update_context(struct i915_request *rq) + + reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail); + +- /* True 32b PPGTT with dynamic page allocation: update PDP ++ /* ++ * True 32b PPGTT with dynamic page allocation: update PDP + * registers and point the unallocated PDPs to scratch page. + * PML4 is allocated during ppgtt init, so this is not needed + * in 48-bit mode. +@@ -432,6 +433,17 @@ static u64 execlists_update_context(struct i915_request *rq) + if (ppgtt && !i915_vm_is_48bit(&ppgtt->vm)) + execlists_update_context_pdps(ppgtt, reg_state); + ++ /* ++ * Make sure the context image is complete before we submit it to HW. ++ * ++ * Ostensibly, writes (including the WCB) should be flushed prior to ++ * an uncached write such as our mmio register access, the empirical ++ * evidence (esp. on Braswell) suggests that the WC write into memory ++ * may not be visible to the HW prior to the completion of the UC ++ * register write and that we may begin execution from the context ++ * before its image is complete leading to invalid PD chasing. ++ */ ++ wmb(); + return ce->lrc_desc; + } + +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c +index 6a8f27d0a742..3b8218dd9bb1 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -91,6 +91,7 @@ static int + gen4_render_ring_flush(struct i915_request *rq, u32 mode) + { + u32 cmd, *cs; ++ int i; + + /* + * read/write caches: +@@ -127,12 +128,45 @@ gen4_render_ring_flush(struct i915_request *rq, u32 mode) + cmd |= MI_INVALIDATE_ISP; + } + +- cs = intel_ring_begin(rq, 2); ++ i = 2; ++ if (mode & EMIT_INVALIDATE) ++ i += 20; ++ ++ cs = intel_ring_begin(rq, i); + if (IS_ERR(cs)) + return PTR_ERR(cs); + + *cs++ = cmd; +- *cs++ = MI_NOOP; ++ ++ /* ++ * A random delay to let the CS invalidate take effect? Without this ++ * delay, the GPU relocation path fails as the CS does not see ++ * the updated contents. Just as important, if we apply the flushes ++ * to the EMIT_FLUSH branch (i.e. immediately after the relocation ++ * write and before the invalidate on the next batch), the relocations ++ * still fail. This implies that is a delay following invalidation ++ * that is required to reset the caches as opposed to a delay to ++ * ensure the memory is written. ++ */ ++ if (mode & EMIT_INVALIDATE) { ++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE; ++ *cs++ = i915_ggtt_offset(rq->engine->scratch) | ++ PIPE_CONTROL_GLOBAL_GTT; ++ *cs++ = 0; ++ *cs++ = 0; ++ ++ for (i = 0; i < 12; i++) ++ *cs++ = MI_FLUSH; ++ ++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE; ++ *cs++ = i915_ggtt_offset(rq->engine->scratch) | ++ PIPE_CONTROL_GLOBAL_GTT; ++ *cs++ = 0; ++ *cs++ = 0; ++ } ++ ++ *cs++ = cmd; ++ + intel_ring_advance(rq, cs); + + return 0; +diff --git a/drivers/gpu/drm/i915/selftests/huge_pages.c b/drivers/gpu/drm/i915/selftests/huge_pages.c +index 7efb326badcd..704572c2e6a2 100644 +--- a/drivers/gpu/drm/i915/selftests/huge_pages.c ++++ b/drivers/gpu/drm/i915/selftests/huge_pages.c +@@ -549,7 +549,7 @@ static int igt_mock_ppgtt_misaligned_dma(void *arg) + err = igt_check_page_sizes(vma); + + if (vma->page_sizes.gtt != I915_GTT_PAGE_SIZE_4K) { +- pr_err("page_sizes.gtt=%u, expected %lu\n", ++ pr_err("page_sizes.gtt=%u, expected %llu\n", + vma->page_sizes.gtt, I915_GTT_PAGE_SIZE_4K); + err = -EINVAL; + } +diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c +index 8e2e269db97e..127d81513671 100644 +--- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c +@@ -1337,7 +1337,7 @@ static int igt_gtt_reserve(void *arg) + GEM_BUG_ON(!drm_mm_node_allocated(&vma->node)); + if (vma->node.start != total || + vma->node.size != 2*I915_GTT_PAGE_SIZE) { +- pr_err("i915_gem_gtt_reserve (pass 1) placement failed, found (%llx + %llx), expected (%llx + %lx)\n", ++ pr_err("i915_gem_gtt_reserve (pass 1) placement failed, found (%llx + %llx), expected (%llx + %llx)\n", + vma->node.start, vma->node.size, + total, 2*I915_GTT_PAGE_SIZE); + err = -EINVAL; +@@ -1386,7 +1386,7 @@ static int igt_gtt_reserve(void *arg) + GEM_BUG_ON(!drm_mm_node_allocated(&vma->node)); + if (vma->node.start != total || + vma->node.size != 2*I915_GTT_PAGE_SIZE) { +- pr_err("i915_gem_gtt_reserve (pass 2) placement failed, found (%llx + %llx), expected (%llx + %lx)\n", ++ pr_err("i915_gem_gtt_reserve (pass 2) placement failed, found (%llx + %llx), expected (%llx + %llx)\n", + vma->node.start, vma->node.size, + total, 2*I915_GTT_PAGE_SIZE); + err = -EINVAL; +@@ -1430,7 +1430,7 @@ static int igt_gtt_reserve(void *arg) + GEM_BUG_ON(!drm_mm_node_allocated(&vma->node)); + if (vma->node.start != offset || + vma->node.size != 2*I915_GTT_PAGE_SIZE) { +- pr_err("i915_gem_gtt_reserve (pass 3) placement failed, found (%llx + %llx), expected (%llx + %lx)\n", ++ pr_err("i915_gem_gtt_reserve (pass 3) placement failed, found (%llx + %llx), expected (%llx + %llx)\n", + vma->node.start, vma->node.size, + offset, 2*I915_GTT_PAGE_SIZE); + err = -EINVAL; +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index da1363a0c54d..93d70f4a2154 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -633,8 +633,7 @@ static int adreno_get_legacy_pwrlevels(struct device *dev) + struct device_node *child, *node; + int ret; + +- node = of_find_compatible_node(dev->of_node, NULL, +- "qcom,gpu-pwrlevels"); ++ node = of_get_compatible_child(dev->of_node, "qcom,gpu-pwrlevels"); + if (!node) { + dev_err(dev, "Could not find the GPU powerlevels\n"); + return -ENXIO; +@@ -655,6 +654,8 @@ static int adreno_get_legacy_pwrlevels(struct device *dev) + dev_pm_opp_add(dev, val, 0); + } + ++ of_node_put(node); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index 80cbf75bc2ff..cd02eae884cc 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -1535,8 +1535,7 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, + cnt++; + + dst = drm_plane_state_dest(pstate); +- if (!drm_rect_intersect(&clip, &dst) || +- !drm_rect_equals(&clip, &dst)) { ++ if (!drm_rect_intersect(&clip, &dst)) { + DPU_ERROR("invalid vertical/horizontal destination\n"); + DPU_ERROR("display: " DRM_RECT_FMT " plane: " + DRM_RECT_FMT "\n", DRM_RECT_ARG(&crtc_rect), +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +index 7dd6bd2d6d37..74cc204b07e8 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +@@ -450,7 +450,7 @@ static void _dpu_kms_initialize_dsi(struct drm_device *dev, + int i, rc; + + /*TODO: Support two independent DSI connectors */ +- encoder = dpu_encoder_init(dev, DRM_MODE_CONNECTOR_DSI); ++ encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_DSI); + if (IS_ERR_OR_NULL(encoder)) { + DPU_ERROR("encoder init failed for dsi display\n"); + return; +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +index b640e39ebaca..4ac2b0c669b7 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +@@ -1254,7 +1254,7 @@ static int dpu_plane_sspp_atomic_update(struct drm_plane *plane, + const struct dpu_format *fmt; + struct drm_crtc *crtc; + struct drm_framebuffer *fb; +- struct drm_rect src, dst; ++ int ret, min_scale; + + if (!plane) { + DPU_ERROR("invalid plane\n"); +@@ -1293,21 +1293,29 @@ static int dpu_plane_sspp_atomic_update(struct drm_plane *plane, + pdpu->is_rt_pipe = (dpu_crtc_get_client_type(crtc) != NRT_CLIENT); + _dpu_plane_set_qos_ctrl(plane, false, DPU_PLANE_QOS_PANIC_CTRL); + +- src.x1 = state->src_x >> 16; +- src.y1 = state->src_y >> 16; +- src.x2 = src.x1 + (state->src_w >> 16); +- src.y2 = src.y1 + (state->src_h >> 16); ++ min_scale = FRAC_16_16(1, pdpu->pipe_sblk->maxdwnscale); ++ ret = drm_atomic_helper_check_plane_state(state, crtc->state, min_scale, ++ pdpu->pipe_sblk->maxupscale << 16, ++ true, false); ++ if (ret) { ++ DPU_ERROR_PLANE(pdpu, "Check plane state failed (%d)\n", ret); ++ return ret; ++ } + +- dst = drm_plane_state_dest(state); ++ DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT ++ ", %4.4s ubwc %d\n", fb->base.id, DRM_RECT_FP_ARG(&state->src), ++ crtc->base.id, DRM_RECT_ARG(&state->dst), ++ (char *)&fmt->base.pixel_format, DPU_FORMAT_IS_UBWC(fmt)); + +- DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FMT "->crtc%u " DRM_RECT_FMT +- ", %4.4s ubwc %d\n", fb->base.id, DRM_RECT_ARG(&src), +- crtc->base.id, DRM_RECT_ARG(&dst), +- (char *)&fmt->base.pixel_format, +- DPU_FORMAT_IS_UBWC(fmt)); ++ pdpu->pipe_cfg.src_rect = state->src; ++ ++ /* state->src is 16.16, src_rect is not */ ++ pdpu->pipe_cfg.src_rect.x1 >>= 16; ++ pdpu->pipe_cfg.src_rect.x2 >>= 16; ++ pdpu->pipe_cfg.src_rect.y1 >>= 16; ++ pdpu->pipe_cfg.src_rect.y2 >>= 16; + +- pdpu->pipe_cfg.src_rect = src; +- pdpu->pipe_cfg.dst_rect = dst; ++ pdpu->pipe_cfg.dst_rect = state->dst; + + _dpu_plane_setup_scaler(pdpu, pstate, fmt, false); + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +index 7d306c5acd09..273cbbe27c2e 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +@@ -259,7 +259,6 @@ static void mdp5_plane_cleanup_fb(struct drm_plane *plane, + msm_framebuffer_cleanup(fb, kms->aspace); + } + +-#define FRAC_16_16(mult, div) (((mult) << 16) / (div)) + static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, + struct drm_plane_state *state) + { +diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h +index 8e510d5c758a..9d11f321f5a9 100644 +--- a/drivers/gpu/drm/msm/msm_drv.h ++++ b/drivers/gpu/drm/msm/msm_drv.h +@@ -62,6 +62,8 @@ struct msm_gem_vma; + #define MAX_BRIDGES 8 + #define MAX_CONNECTORS 8 + ++#define FRAC_16_16(mult, div) (((mult) << 16) / (div)) ++ + struct msm_file_private { + rwlock_t queuelock; + struct list_head submitqueues; +diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c +index 5e808cfec345..46e6b82f7b66 100644 +--- a/drivers/gpu/drm/msm/msm_gpu.c ++++ b/drivers/gpu/drm/msm/msm_gpu.c +@@ -367,8 +367,8 @@ static void msm_gpu_crashstate_capture(struct msm_gpu *gpu, + msm_gpu_devcoredump_read, msm_gpu_devcoredump_free); + } + #else +-static void msm_gpu_crashstate_capture(struct msm_gpu *gpu, char *comm, +- char *cmd) ++static void msm_gpu_crashstate_capture(struct msm_gpu *gpu, ++ struct msm_gem_submit *submit, char *comm, char *cmd) + { + } + #endif +diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c +index 041e7daf8a33..faf7009c0a3c 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c +@@ -843,22 +843,16 @@ nv50_mstc_atomic_best_encoder(struct drm_connector *connector, + { + struct nv50_head *head = nv50_head(connector_state->crtc); + struct nv50_mstc *mstc = nv50_mstc(connector); +- if (mstc->port) { +- struct nv50_mstm *mstm = mstc->mstm; +- return &mstm->msto[head->base.index]->encoder; +- } +- return NULL; ++ ++ return &mstc->mstm->msto[head->base.index]->encoder; + } + + static struct drm_encoder * + nv50_mstc_best_encoder(struct drm_connector *connector) + { + struct nv50_mstc *mstc = nv50_mstc(connector); +- if (mstc->port) { +- struct nv50_mstm *mstm = mstc->mstm; +- return &mstm->msto[0]->encoder; +- } +- return NULL; ++ ++ return &mstc->mstm->msto[0]->encoder; + } + + static enum drm_mode_status +diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c +index 408b955e5c39..6dd72bc32897 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c ++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c +@@ -116,7 +116,7 @@ nv40_backlight_init(struct drm_connector *connector) + &nv40_bl_ops, &props); + + if (IS_ERR(bd)) { +- if (bl_connector.id > 0) ++ if (bl_connector.id >= 0) + ida_simple_remove(&bl_ida, bl_connector.id); + return PTR_ERR(bd); + } +@@ -249,7 +249,7 @@ nv50_backlight_init(struct drm_connector *connector) + nv_encoder, ops, &props); + + if (IS_ERR(bd)) { +- if (bl_connector.id > 0) ++ if (bl_connector.id >= 0) + ida_simple_remove(&bl_ida, bl_connector.id); + return PTR_ERR(bd); + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c +index d02e183717dc..5c14d6ac855d 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c +@@ -801,6 +801,7 @@ acr_r352_load(struct nvkm_acr *_acr, struct nvkm_falcon *falcon, + bl = acr->hsbl_unload_blob; + } else { + nvkm_error(_acr->subdev, "invalid secure boot blob!\n"); ++ kfree(bl_desc); + return -EINVAL; + } + +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index f92fe205550b..e884183c018a 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -285,6 +285,17 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait) + } + + txn->last_pat->next_pa = 0; ++ /* ensure that the written descriptors are visible to DMM */ ++ wmb(); ++ ++ /* ++ * NOTE: the wmb() above should be enough, but there seems to be a bug ++ * in OMAP's memory barrier implementation, which in some rare cases may ++ * cause the writes not to be observable after wmb(). ++ */ ++ ++ /* read back to ensure the data is in RAM */ ++ readl(&txn->last_pat->next_pa); + + /* write to PAT_DESCR to clear out any pending transaction */ + dmm_write(dmm, 0x0, reg[PAT_DESCR][engine->id]); +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c +index f0bc7cc0e913..fb46df56f0c4 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c +@@ -516,12 +516,22 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu) + + dev->mode_config.min_width = 0; + dev->mode_config.min_height = 0; +- dev->mode_config.max_width = 4095; +- dev->mode_config.max_height = 2047; + dev->mode_config.normalize_zpos = true; + dev->mode_config.funcs = &rcar_du_mode_config_funcs; + dev->mode_config.helper_private = &rcar_du_mode_config_helper; + ++ if (rcdu->info->gen < 3) { ++ dev->mode_config.max_width = 4095; ++ dev->mode_config.max_height = 2047; ++ } else { ++ /* ++ * The Gen3 DU uses the VSP1 for memory access, and is limited ++ * to frame sizes of 8190x8190. ++ */ ++ dev->mode_config.max_width = 8190; ++ dev->mode_config.max_height = 8190; ++ } ++ + rcdu->num_crtcs = hweight8(rcdu->info->channels_mask); + + ret = rcar_du_properties_init(rcdu); +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c +index f814d37b1db2..05368fa4f956 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c +@@ -442,6 +442,11 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev) + return 0; + } + ++static void rockchip_drm_platform_shutdown(struct platform_device *pdev) ++{ ++ rockchip_drm_platform_remove(pdev); ++} ++ + static const struct of_device_id rockchip_drm_dt_ids[] = { + { .compatible = "rockchip,display-subsystem", }, + { /* sentinel */ }, +@@ -451,6 +456,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids); + static struct platform_driver rockchip_drm_platform_driver = { + .probe = rockchip_drm_platform_probe, + .remove = rockchip_drm_platform_remove, ++ .shutdown = rockchip_drm_platform_shutdown, + .driver = { + .name = "rockchip-drm", + .of_match_table = rockchip_drm_dt_ids, +diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c +index 33d51281272b..fcdbac4a56e3 100644 +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -635,8 +635,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + if (info[i]->config[j] & HWMON_T_INPUT) { + err = hwmon_thermal_add_sensor(dev, + hwdev, j); +- if (err) +- goto free_device; ++ if (err) { ++ device_unregister(hdev); ++ goto ida_remove; ++ } + } + } + } +@@ -644,8 +646,6 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + + return hdev; + +-free_device: +- device_unregister(hdev); + free_hwmon: + kfree(hwdev); + ida_remove: +diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c +index 2566b4d8b342..73856c2a8ac0 100644 +--- a/drivers/input/touchscreen/wm97xx-core.c ++++ b/drivers/input/touchscreen/wm97xx-core.c +@@ -929,7 +929,8 @@ static int __init wm97xx_init(void) + + static void __exit wm97xx_exit(void) + { +- driver_unregister(&wm97xx_driver); ++ if (IS_BUILTIN(CONFIG_AC97_BUS)) ++ driver_unregister(&wm97xx_driver); + platform_driver_unregister(&wm97xx_mfd_driver); + } + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 071f4bc240ca..7b662bd1c7a0 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -223,8 +223,10 @@ struct ov5640_dev { + int power_count; + + struct v4l2_mbus_framefmt fmt; ++ bool pending_fmt_change; + + const struct ov5640_mode_info *current_mode; ++ const struct ov5640_mode_info *last_mode; + enum ov5640_frame_rate current_fr; + struct v4l2_fract frame_interval; + +@@ -255,7 +257,7 @@ static inline struct v4l2_subdev *ctrl_to_sd(struct v4l2_ctrl *ctrl) + * should be identified and removed to speed register load time + * over i2c. + */ +- ++/* YUV422 UYVY VGA@30fps */ + static const struct reg_value ov5640_init_setting_30fps_VGA[] = { + {0x3103, 0x11, 0, 0}, {0x3008, 0x82, 0, 5}, {0x3008, 0x42, 0, 0}, + {0x3103, 0x03, 0, 0}, {0x3017, 0x00, 0, 0}, {0x3018, 0x00, 0, 0}, +@@ -1613,10 +1615,10 @@ static int ov5640_set_mode_direct(struct ov5640_dev *sensor, + return __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_exp, exposure); + } + +-static int ov5640_set_mode(struct ov5640_dev *sensor, +- const struct ov5640_mode_info *orig_mode) ++static int ov5640_set_mode(struct ov5640_dev *sensor) + { + const struct ov5640_mode_info *mode = sensor->current_mode; ++ const struct ov5640_mode_info *orig_mode = sensor->last_mode; + enum ov5640_downsize_mode dn_mode, orig_dn_mode; + s32 exposure; + int ret; +@@ -1673,6 +1675,7 @@ static int ov5640_set_mode(struct ov5640_dev *sensor, + return ret; + + sensor->pending_mode_change = false; ++ sensor->last_mode = mode; + + return 0; + } +@@ -1689,6 +1692,7 @@ static int ov5640_restore_mode(struct ov5640_dev *sensor) + ret = ov5640_load_regs(sensor, &ov5640_mode_init_data); + if (ret < 0) + return ret; ++ sensor->last_mode = &ov5640_mode_init_data; + + ret = ov5640_mod_reg(sensor, OV5640_REG_SYS_ROOT_DIVIDER, 0x3f, + (ilog2(OV5640_SCLK2X_ROOT_DIVIDER_DEFAULT) << 2) | +@@ -1697,7 +1701,7 @@ static int ov5640_restore_mode(struct ov5640_dev *sensor) + return ret; + + /* now restore the last capture mode */ +- ret = ov5640_set_mode(sensor, &ov5640_mode_init_data); ++ ret = ov5640_set_mode(sensor); + if (ret < 0) + return ret; + +@@ -1968,9 +1972,12 @@ static int ov5640_set_fmt(struct v4l2_subdev *sd, + + if (new_mode != sensor->current_mode) { + sensor->current_mode = new_mode; +- sensor->fmt = *mbus_fmt; + sensor->pending_mode_change = true; + } ++ if (mbus_fmt->code != sensor->fmt.code) { ++ sensor->fmt = *mbus_fmt; ++ sensor->pending_fmt_change = true; ++ } + out: + mutex_unlock(&sensor->lock); + return ret; +@@ -2541,13 +2548,16 @@ static int ov5640_s_stream(struct v4l2_subdev *sd, int enable) + + if (sensor->streaming == !enable) { + if (enable && sensor->pending_mode_change) { +- ret = ov5640_set_mode(sensor, sensor->current_mode); ++ ret = ov5640_set_mode(sensor); + if (ret) + goto out; ++ } + ++ if (enable && sensor->pending_fmt_change) { + ret = ov5640_set_framefmt(sensor, &sensor->fmt); + if (ret) + goto out; ++ sensor->pending_fmt_change = false; + } + + if (sensor->ep.bus_type == V4L2_MBUS_CSI2) +@@ -2642,9 +2652,14 @@ static int ov5640_probe(struct i2c_client *client, + return -ENOMEM; + + sensor->i2c_client = client; ++ ++ /* ++ * default init sequence initialize sensor to ++ * YUV422 UYVY VGA@30fps ++ */ + fmt = &sensor->fmt; +- fmt->code = ov5640_formats[0].code; +- fmt->colorspace = ov5640_formats[0].colorspace; ++ fmt->code = MEDIA_BUS_FMT_UYVY8_2X8; ++ fmt->colorspace = V4L2_COLORSPACE_SRGB; + fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace); + fmt->quantization = V4L2_QUANTIZATION_FULL_RANGE; + fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace); +@@ -2656,7 +2671,7 @@ static int ov5640_probe(struct i2c_client *client, + sensor->current_fr = OV5640_30_FPS; + sensor->current_mode = + &ov5640_mode_data[OV5640_30_FPS][OV5640_MODE_VGA_640_480]; +- sensor->pending_mode_change = true; ++ sensor->last_mode = sensor->current_mode; + + sensor->ae_target = 52; + +diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c +index 805bd9c65940..8b450fc53202 100644 +--- a/drivers/media/i2c/tvp5150.c ++++ b/drivers/media/i2c/tvp5150.c +@@ -901,9 +901,6 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd, + + /* tvp5150 has some special limits */ + rect.left = clamp(rect.left, 0, TVP5150_MAX_CROP_LEFT); +- rect.width = clamp_t(unsigned int, rect.width, +- TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left, +- TVP5150_H_MAX - rect.left); + rect.top = clamp(rect.top, 0, TVP5150_MAX_CROP_TOP); + + /* Calculate height based on current standard */ +@@ -917,9 +914,16 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd, + else + hmax = TVP5150_V_MAX_OTHERS; + +- rect.height = clamp_t(unsigned int, rect.height, ++ /* ++ * alignments: ++ * - width = 2 due to UYVY colorspace ++ * - height, image = no special alignment ++ */ ++ v4l_bound_align_image(&rect.width, ++ TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left, ++ TVP5150_H_MAX - rect.left, 1, &rect.height, + hmax - TVP5150_MAX_CROP_TOP - rect.top, +- hmax - rect.top); ++ hmax - rect.top, 0, 0); + + tvp5150_write(sd, TVP5150_VERT_BLANKING_START, rect.top); + tvp5150_write(sd, TVP5150_VERT_BLANKING_STOP, +diff --git a/drivers/media/pci/cx23885/altera-ci.c b/drivers/media/pci/cx23885/altera-ci.c +index 62bc8049b320..198c05e83f5c 100644 +--- a/drivers/media/pci/cx23885/altera-ci.c ++++ b/drivers/media/pci/cx23885/altera-ci.c +@@ -665,6 +665,10 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr) + } + + temp_int = append_internal(inter); ++ if (!temp_int) { ++ ret = -ENOMEM; ++ goto err; ++ } + inter->filts_used = 1; + inter->dev = config->dev; + inter->fpga_rw = config->fpga_rw; +@@ -699,6 +703,7 @@ err: + __func__, ret); + + kfree(pid_filt); ++ kfree(inter); + + return ret; + } +@@ -733,6 +738,10 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr) + } + + temp_int = append_internal(inter); ++ if (!temp_int) { ++ ret = -ENOMEM; ++ goto err; ++ } + inter->cis_used = 1; + inter->dev = config->dev; + inter->fpga_rw = config->fpga_rw; +@@ -801,6 +810,7 @@ err: + ci_dbg_print("%s: Cannot initialize CI: Error %d.\n", __func__, ret); + + kfree(state); ++ kfree(inter); + + return ret; + } +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index 726b3b93a486..bf7b8417c27f 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -1804,7 +1804,8 @@ static int coda_s_ctrl(struct v4l2_ctrl *ctrl) + break; + case V4L2_CID_MPEG_VIDEO_H264_PROFILE: + /* TODO: switch between baseline and constrained baseline */ +- ctx->params.h264_profile_idc = 66; ++ if (ctx->inst_type == CODA_INST_ENCODER) ++ ctx->params.h264_profile_idc = 66; + break; + case V4L2_CID_MPEG_VIDEO_H264_LEVEL: + /* nothing to do, this is set by the encoder */ +diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig +index e514d57a0419..aa983422aa97 100644 +--- a/drivers/mtd/devices/Kconfig ++++ b/drivers/mtd/devices/Kconfig +@@ -207,7 +207,7 @@ comment "Disk-On-Chip Device Drivers" + config MTD_DOCG3 + tristate "M-Systems Disk-On-Chip G3" + select BCH +- select BCH_CONST_PARAMS ++ select BCH_CONST_PARAMS if !MTD_NAND_BCH + select BITREVERSE + help + This provides an MTD device driver for the M-Systems DiskOnChip +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index 8e714fbfa521..6e9cbd1a0b6d 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -996,7 +996,7 @@ static int cqspi_direct_read_execute(struct spi_nor *nor, u_char *buf, + err_unmap: + dma_unmap_single(nor->dev, dma_dst, len, DMA_DEV_TO_MEM); + +- return 0; ++ return ret; + } + + static ssize_t cqspi_read(struct spi_nor *nor, loff_t from, +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index ee28ec9e0aba..3c597569cfae 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3111,13 +3111,13 @@ static int bond_slave_netdev_event(unsigned long event, + case NETDEV_CHANGE: + /* For 802.3ad mode only: + * Getting invalid Speed/Duplex values here will put slave +- * in weird state. So mark it as link-down for the time ++ * in weird state. So mark it as link-fail for the time + * being and let link-monitoring (miimon) set it right when + * correct speeds/duplex are available. + */ + if (bond_update_speed_duplex(slave) && + BOND_MODE(bond) == BOND_MODE_8023AD) +- slave->link = BOND_LINK_DOWN; ++ slave->link = BOND_LINK_FAIL; + + if (BOND_MODE(bond) == BOND_MODE_8023AD) + bond_3ad_adapter_speed_duplex_changed(slave); +diff --git a/drivers/of/of_numa.c b/drivers/of/of_numa.c +index 27d9b4bba535..2411ed3c7303 100644 +--- a/drivers/of/of_numa.c ++++ b/drivers/of/of_numa.c +@@ -115,9 +115,14 @@ static int __init of_numa_parse_distance_map_v1(struct device_node *map) + distance = of_read_number(matrix, 1); + matrix++; + ++ if ((nodea == nodeb && distance != LOCAL_DISTANCE) || ++ (nodea != nodeb && distance <= LOCAL_DISTANCE)) { ++ pr_err("Invalid distance[node%d -> node%d] = %d\n", ++ nodea, nodeb, distance); ++ return -EINVAL; ++ } ++ + numa_set_distance(nodea, nodeb, distance); +- pr_debug("distance[node%d -> node%d] = %d\n", +- nodea, nodeb, distance); + + /* Set default distance of node B->A same as A->B */ + if (nodeb > nodea) +diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c +index e79f2a181ad2..b9ec4a16db1f 100644 +--- a/drivers/rtc/hctosys.c ++++ b/drivers/rtc/hctosys.c +@@ -50,8 +50,10 @@ static int __init rtc_hctosys(void) + tv64.tv_sec = rtc_tm_to_time64(&tm); + + #if BITS_PER_LONG == 32 +- if (tv64.tv_sec > INT_MAX) ++ if (tv64.tv_sec > INT_MAX) { ++ err = -ERANGE; + goto err_read; ++ } + #endif + + err = do_settimeofday64(&tv64); +diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c +index c11a89be292c..4a9fd8d944d6 100644 +--- a/drivers/scsi/qla2xxx/qla_bsg.c ++++ b/drivers/scsi/qla2xxx/qla_bsg.c +@@ -2487,7 +2487,7 @@ qla24xx_bsg_request(struct bsg_job *bsg_job) + vha = shost_priv(host); + } + +- if (qla2x00_reset_active(vha)) { ++ if (qla2x00_chip_is_down(vha)) { + ql_dbg(ql_dbg_user, vha, 0x709f, + "BSG: ISP abort active/needed -- cmd=%d.\n", + bsg_request->msgcode); +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index a0038d879b9d..de3f2a097451 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3261,6 +3261,9 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res) + "Async done-%s res %x, WWPN %8phC \n", + sp->name, res, fcport->port_name); + ++ if (res == QLA_FUNCTION_TIMEOUT) ++ return; ++ + if (res == (DID_ERROR << 16)) { + /* entry status error */ + goto done; +@@ -4444,9 +4447,9 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp) + sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout; + qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2); + +- rspsz = sizeof(struct ct_sns_gpnft_rsp) + +- ((vha->hw->max_fibre_devices - 1) * +- sizeof(struct ct_sns_gpn_ft_data)); ++ rspsz = sp->u.iocb_cmd.u.ctarg.rsp_size; ++ memset(sp->u.iocb_cmd.u.ctarg.rsp, 0, sp->u.iocb_cmd.u.ctarg.rsp_size); ++ memset(sp->u.iocb_cmd.u.ctarg.req, 0, sp->u.iocb_cmd.u.ctarg.req_size); + + ct_sns = (struct ct_sns_pkt *)sp->u.iocb_cmd.u.ctarg.req; + /* CT_IU preamble */ +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index b934977c5c26..5352c9bbcaf7 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -52,12 +52,14 @@ qla2x00_sp_timeout(struct timer_list *t) + struct srb_iocb *iocb; + struct req_que *req; + unsigned long flags; ++ struct qla_hw_data *ha = sp->vha->hw; + +- spin_lock_irqsave(sp->qpair->qp_lock_ptr, flags); ++ WARN_ON(irqs_disabled()); ++ spin_lock_irqsave(&ha->hardware_lock, flags); + req = sp->qpair->req; + req->outstanding_cmds[sp->handle] = NULL; + iocb = &sp->u.iocb_cmd; +- spin_unlock_irqrestore(sp->qpair->qp_lock_ptr, flags); ++ spin_unlock_irqrestore(&ha->hardware_lock, flags); + iocb->timeout(sp); + } + +@@ -972,6 +974,15 @@ void qla24xx_async_gpdb_sp_done(void *s, int res) + + fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE); + ++ if (res == QLA_FUNCTION_TIMEOUT) ++ return; ++ ++ if (res == QLA_FUNCTION_TIMEOUT) { ++ dma_pool_free(sp->vha->hw->s_dma_pool, sp->u.iocb_cmd.u.mbx.in, ++ sp->u.iocb_cmd.u.mbx.in_dma); ++ return; ++ } ++ + memset(&ea, 0, sizeof(ea)); + ea.event = FCME_GPDB_DONE; + ea.fcport = fcport; +@@ -1788,6 +1799,8 @@ qla24xx_async_abort_cmd(srb_t *cmd_sp, bool wait) + wait_for_completion(&abt_iocb->u.abt.comp); + rval = abt_iocb->u.abt.comp_status == CS_COMPLETE ? + QLA_SUCCESS : QLA_FUNCTION_FAILED; ++ } else { ++ goto done; + } + + done_free_sp: +@@ -1952,25 +1965,15 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea) + cid.b.rsvd_1 = 0; + + ql_dbg(ql_dbg_disc, vha, 0x20ec, +- "%s %d %8phC LoopID 0x%x in use post gnl\n", ++ "%s %d %8phC lid %#x in use with pid %06x post gnl\n", + __func__, __LINE__, ea->fcport->port_name, +- ea->fcport->loop_id); ++ ea->fcport->loop_id, cid.b24); + +- if (IS_SW_RESV_ADDR(cid)) { +- set_bit(ea->fcport->loop_id, vha->hw->loop_id_map); +- ea->fcport->loop_id = FC_NO_LOOP_ID; +- } else { +- qla2x00_clear_loop_id(ea->fcport); +- } ++ set_bit(ea->fcport->loop_id, vha->hw->loop_id_map); ++ ea->fcport->loop_id = FC_NO_LOOP_ID; + qla24xx_post_gnl_work(vha, ea->fcport); + break; + case MBS_PORT_ID_USED: +- ql_dbg(ql_dbg_disc, vha, 0x20ed, +- "%s %d %8phC NPortId %02x%02x%02x inuse post gidpn\n", +- __func__, __LINE__, ea->fcport->port_name, +- ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area, +- ea->fcport->d_id.b.al_pa); +- + lid = ea->iop[1] & 0xffff; + qlt_find_sess_invalidate_other(vha, + wwn_to_u64(ea->fcport->port_name), +@@ -4711,6 +4714,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags) + fcport->loop_id = FC_NO_LOOP_ID; + qla2x00_set_fcport_state(fcport, FCS_UNCONFIGURED); + fcport->supported_classes = FC_COS_UNSPECIFIED; ++ fcport->fp_speed = PORT_SPEED_UNKNOWN; + + fcport->ct_desc.ct_sns = dma_alloc_coherent(&vha->hw->pdev->dev, + sizeof(struct ct_sns_pkt), &fcport->ct_desc.ct_sns_dma, +@@ -6682,7 +6686,7 @@ qla2x00_abort_isp(scsi_qla_host_t *vha) + * The next call disables the board + * completely. + */ +- ha->isp_ops->reset_adapter(vha); ++ qla2x00_abort_isp_cleanup(vha); + vha->flags.online = 0; + clear_bit(ISP_ABORT_RETRY, + &vha->dpc_flags); +@@ -7142,7 +7146,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vha) + } + icb->firmware_options_2 &= cpu_to_le32( + ~(BIT_3 | BIT_2 | BIT_1 | BIT_0)); +- vha->flags.process_response_queue = 0; + if (ha->zio_mode != QLA_ZIO_DISABLED) { + ha->zio_mode = QLA_ZIO_MODE_6; + +@@ -7153,7 +7156,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vha) + icb->firmware_options_2 |= cpu_to_le32( + (uint32_t)ha->zio_mode); + icb->interrupt_delay_timer = cpu_to_le16(ha->zio_timer); +- vha->flags.process_response_queue = 1; + } + + if (rval) { +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 42ac8e097419..119927220299 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -1526,12 +1526,6 @@ qla24xx_start_scsi(srb_t *sp) + + /* Set chip new ring index. */ + WRT_REG_DWORD(req->req_q_in, req->ring_index); +- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr); +- +- /* Manage unprocessed RIO/ZIO commands in response queue. */ +- if (vha->flags.process_response_queue && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED) +- qla24xx_process_response_queue(vha, rsp); + + spin_unlock_irqrestore(&ha->hardware_lock, flags); + return QLA_SUCCESS; +@@ -1725,12 +1719,6 @@ qla24xx_dif_start_scsi(srb_t *sp) + + /* Set chip new ring index. */ + WRT_REG_DWORD(req->req_q_in, req->ring_index); +- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr); +- +- /* Manage unprocessed RIO/ZIO commands in response queue. */ +- if (vha->flags.process_response_queue && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED) +- qla24xx_process_response_queue(vha, rsp); + + spin_unlock_irqrestore(&ha->hardware_lock, flags); + +@@ -1880,11 +1868,6 @@ qla2xxx_start_scsi_mq(srb_t *sp) + /* Set chip new ring index. */ + WRT_REG_DWORD(req->req_q_in, req->ring_index); + +- /* Manage unprocessed RIO/ZIO commands in response queue. */ +- if (vha->flags.process_response_queue && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED) +- qla24xx_process_response_queue(vha, rsp); +- + spin_unlock_irqrestore(&qpair->qp_lock, flags); + return QLA_SUCCESS; + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 596a9b214df1..84f57f075455 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -3762,10 +3762,7 @@ qla2x00_set_idma_speed(scsi_qla_host_t *vha, uint16_t loop_id, + mcp->mb[0] = MBC_PORT_PARAMS; + mcp->mb[1] = loop_id; + mcp->mb[2] = BIT_0; +- if (IS_CNA_CAPABLE(vha->hw)) +- mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0); +- else +- mcp->mb[3] = port_speed & (BIT_2|BIT_1|BIT_0); ++ mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0); + mcp->mb[9] = vha->vp_idx; + mcp->out_mb = MBX_9|MBX_3|MBX_2|MBX_1|MBX_0; + mcp->in_mb = MBX_3|MBX_1|MBX_0; +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 20d9dc39f0fb..e6545cb9a2c1 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -607,7 +607,7 @@ void qla_nvme_abort(struct qla_hw_data *ha, struct srb *sp, int res) + { + int rval; + +- if (!test_bit(ABORT_ISP_ACTIVE, &sp->vha->dpc_flags)) { ++ if (ha->flags.fw_started) { + rval = ha->isp_ops->abort_command(sp); + if (!rval && !qla_nvme_wait_on_command(sp)) + ql_log(ql_log_warn, NULL, 0x2112, +@@ -660,9 +660,6 @@ void qla_nvme_delete(struct scsi_qla_host *vha) + __func__, fcport); + + nvme_fc_set_remoteport_devloss(fcport->nvme_remote_port, 0); +- init_completion(&fcport->nvme_del_done); +- nvme_fc_unregister_remoteport(fcport->nvme_remote_port); +- wait_for_completion(&fcport->nvme_del_done); + } + + if (vha->nvme_local_port) { +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 42b8f0d3e580..ae9fd2d01004 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -4808,10 +4808,10 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e) + fcport->d_id = e->u.new_sess.id; + fcport->flags |= FCF_FABRIC_DEVICE; + fcport->fw_login_state = DSC_LS_PLOGI_PEND; +- if (e->u.new_sess.fc4_type == FS_FC4TYPE_FCP) ++ if (e->u.new_sess.fc4_type & FS_FC4TYPE_FCP) + fcport->fc4_type = FC4_TYPE_FCP_SCSI; + +- if (e->u.new_sess.fc4_type == FS_FC4TYPE_NVME) { ++ if (e->u.new_sess.fc4_type & FS_FC4TYPE_NVME) { + fcport->fc4_type = FC4_TYPE_OTHER; + fcport->fc4f_nvme = FC4_TYPE_NVME; + } +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 8c811b251d42..d2888b30a8a3 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1261,7 +1261,8 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess) + qla24xx_chk_fcp_state(sess); + + ql_dbg(ql_dbg_tgt, sess->vha, 0xe001, +- "Scheduling sess %p for deletion\n", sess); ++ "Scheduling sess %p for deletion %8phC\n", ++ sess, sess->port_name); + + INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn); + WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work)); +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index e03d12a5f986..64e2d859f633 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -718,10 +718,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) + cmd->sg_cnt = 0; + cmd->offset = 0; + cmd->dma_data_direction = target_reverse_dma_direction(se_cmd); +- if (cmd->trc_flags & TRC_XMIT_STATUS) { +- pr_crit("Multiple calls for status = %p.\n", cmd); +- dump_stack(); +- } + cmd->trc_flags |= TRC_XMIT_STATUS; + + if (se_cmd->data_direction == DMA_FROM_DEVICE) { +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index eb97d2dd3651..b5f638286037 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -697,6 +697,12 @@ static bool scsi_end_request(struct request *req, blk_status_t error, + */ + scsi_mq_uninit_cmd(cmd); + ++ /* ++ * queue is still alive, so grab the ref for preventing it ++ * from being cleaned up during running queue. ++ */ ++ percpu_ref_get(&q->q_usage_counter); ++ + __blk_mq_end_request(req, error); + + if (scsi_target(sdev)->single_lun || +@@ -704,6 +710,8 @@ static bool scsi_end_request(struct request *req, blk_status_t error, + kblockd_schedule_work(&sdev->requeue_work); + else + blk_mq_run_hw_queues(q, true); ++ ++ percpu_ref_put(&q->q_usage_counter); + } else { + unsigned long flags; + +diff --git a/drivers/soc/ti/knav_qmss.h b/drivers/soc/ti/knav_qmss.h +index 3efc47e82973..bd040c29c4bf 100644 +--- a/drivers/soc/ti/knav_qmss.h ++++ b/drivers/soc/ti/knav_qmss.h +@@ -329,8 +329,8 @@ struct knav_range_ops { + }; + + struct knav_irq_info { +- int irq; +- u32 cpu_map; ++ int irq; ++ struct cpumask *cpu_mask; + }; + + struct knav_range_info { +diff --git a/drivers/soc/ti/knav_qmss_acc.c b/drivers/soc/ti/knav_qmss_acc.c +index 316e82e46f6c..2f7fb2dcc1d6 100644 +--- a/drivers/soc/ti/knav_qmss_acc.c ++++ b/drivers/soc/ti/knav_qmss_acc.c +@@ -205,18 +205,18 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range, + { + struct knav_device *kdev = range->kdev; + struct knav_acc_channel *acc; +- unsigned long cpu_map; ++ struct cpumask *cpu_mask; + int ret = 0, irq; + u32 old, new; + + if (range->flags & RANGE_MULTI_QUEUE) { + acc = range->acc; + irq = range->irqs[0].irq; +- cpu_map = range->irqs[0].cpu_map; ++ cpu_mask = range->irqs[0].cpu_mask; + } else { + acc = range->acc + queue; + irq = range->irqs[queue].irq; +- cpu_map = range->irqs[queue].cpu_map; ++ cpu_mask = range->irqs[queue].cpu_mask; + } + + old = acc->open_mask; +@@ -239,8 +239,8 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range, + acc->name, acc->name); + ret = request_irq(irq, knav_acc_int_handler, 0, acc->name, + range); +- if (!ret && cpu_map) { +- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map)); ++ if (!ret && cpu_mask) { ++ ret = irq_set_affinity_hint(irq, cpu_mask); + if (ret) { + dev_warn(range->kdev->dev, + "Failed to set IRQ affinity\n"); +diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c +index 6755f2af5619..ef36acc0e708 100644 +--- a/drivers/soc/ti/knav_qmss_queue.c ++++ b/drivers/soc/ti/knav_qmss_queue.c +@@ -118,19 +118,17 @@ static int knav_queue_setup_irq(struct knav_range_info *range, + struct knav_queue_inst *inst) + { + unsigned queue = inst->id - range->queue_base; +- unsigned long cpu_map; + int ret = 0, irq; + + if (range->flags & RANGE_HAS_IRQ) { + irq = range->irqs[queue].irq; +- cpu_map = range->irqs[queue].cpu_map; + ret = request_irq(irq, knav_queue_int_handler, 0, + inst->irq_name, inst); + if (ret) + return ret; + disable_irq(irq); +- if (cpu_map) { +- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map)); ++ if (range->irqs[queue].cpu_mask) { ++ ret = irq_set_affinity_hint(irq, range->irqs[queue].cpu_mask); + if (ret) { + dev_warn(range->kdev->dev, + "Failed to set IRQ affinity\n"); +@@ -1262,9 +1260,19 @@ static int knav_setup_queue_range(struct knav_device *kdev, + + range->num_irqs++; + +- if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3) +- range->irqs[i].cpu_map = +- (oirq.args[2] & 0x0000ff00) >> 8; ++ if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3) { ++ unsigned long mask; ++ int bit; ++ ++ range->irqs[i].cpu_mask = devm_kzalloc(dev, ++ cpumask_size(), GFP_KERNEL); ++ if (!range->irqs[i].cpu_mask) ++ return -ENOMEM; ++ ++ mask = (oirq.args[2] & 0x0000ff00) >> 8; ++ for_each_set_bit(bit, &mask, BITS_PER_LONG) ++ cpumask_set_cpu(bit, range->irqs[i].cpu_mask); ++ } + } + + range->num_irqs = min(range->num_irqs, range->num_queues); +diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c +index 8721f0a41d15..14da8cc2246a 100644 +--- a/drivers/staging/erofs/unzip_vle.c ++++ b/drivers/staging/erofs/unzip_vle.c +@@ -1490,6 +1490,7 @@ static erofs_off_t vle_get_logical_extent_head( + unsigned long long ofs; + const unsigned int clusterbits = EROFS_SB(inode->i_sb)->clusterbits; + const unsigned int clustersize = 1 << clusterbits; ++ unsigned int delta0; + + if (page->index != blkaddr) { + kunmap_atomic(*kaddr_iter); +@@ -1504,12 +1505,13 @@ static erofs_off_t vle_get_logical_extent_head( + di = *kaddr_iter + vle_extent_blkoff(inode, lcn); + switch (vle_cluster_type(di)) { + case Z_EROFS_VLE_CLUSTER_TYPE_NONHEAD: +- BUG_ON(!di->di_u.delta[0]); +- BUG_ON(lcn < di->di_u.delta[0]); ++ delta0 = le16_to_cpu(di->di_u.delta[0]); ++ DBG_BUGON(!delta0); ++ DBG_BUGON(lcn < delta0); + + ofs = vle_get_logical_extent_head(inode, + page_iter, kaddr_iter, +- lcn - di->di_u.delta[0], pcn, flags); ++ lcn - delta0, pcn, flags); + break; + case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN: + *flags ^= EROFS_MAP_ZIPPED; +diff --git a/drivers/staging/iio/adc/ad7606.c b/drivers/staging/iio/adc/ad7606.c +index 25b9fcd5e3a4..ce3351832fb1 100644 +--- a/drivers/staging/iio/adc/ad7606.c ++++ b/drivers/staging/iio/adc/ad7606.c +@@ -26,9 +26,12 @@ + + #include "ad7606.h" + +-/* Scales are computed as 2.5/2**16 and 5/2**16 respectively */ ++/* ++ * Scales are computed as 5000/32768 and 10000/32768 respectively, ++ * so that when applied to the raw values they provide mV values ++ */ + static const unsigned int scale_avail[2][2] = { +- {0, 38147}, {0, 76294} ++ {0, 152588}, {0, 305176} + }; + + static int ad7606_reset(struct ad7606_state *st) +diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c +index cf342eb58e10..ad7e28ab9a4f 100644 +--- a/drivers/staging/most/video/video.c ++++ b/drivers/staging/most/video/video.c +@@ -530,7 +530,7 @@ static int comp_disconnect_channel(struct most_interface *iface, + return 0; + } + +-static struct core_component comp_info = { ++static struct core_component comp = { + .name = "video", + .probe_channel = comp_probe_channel, + .disconnect_channel = comp_disconnect_channel, +@@ -565,7 +565,7 @@ static void __exit comp_exit(void) + } + spin_unlock_irq(&list_lock); + +- most_deregister_component(&comp_info); ++ most_deregister_component(&comp); + BUG_ON(!list_empty(&video_devices)); + } + +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index 6ab982309e6a..441778100887 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -1102,8 +1102,9 @@ void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev) + mutex_unlock(&thermal_list_lock); + + ida_simple_remove(&thermal_cdev_ida, cdev->id); +- device_unregister(&cdev->device); ++ device_del(&cdev->device); + thermal_cooling_device_destroy_sysfs(cdev); ++ put_device(&cdev->device); + } + EXPORT_SYMBOL_GPL(thermal_cooling_device_unregister); + +diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c +index af8beefe9b5c..877fd7f8a8ed 100644 +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -58,7 +58,7 @@ static int of_platform_serial_setup(struct platform_device *ofdev, + struct resource resource; + struct device_node *np = ofdev->dev.of_node; + u32 clk, spd, prop; +- int ret; ++ int ret, irq; + + memset(port, 0, sizeof *port); + +@@ -143,21 +143,27 @@ static int of_platform_serial_setup(struct platform_device *ofdev, + if (ret >= 0) + port->line = ret; + +- port->irq = irq_of_parse_and_map(np, 0); +- if (!port->irq) { +- ret = -EPROBE_DEFER; +- goto err_unprepare; ++ irq = of_irq_get(np, 0); ++ if (irq < 0) { ++ if (irq == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto err_unprepare; ++ } ++ /* IRQ support not mandatory */ ++ irq = 0; + } + ++ port->irq = irq; ++ + info->rst = devm_reset_control_get_optional_shared(&ofdev->dev, NULL); + if (IS_ERR(info->rst)) { + ret = PTR_ERR(info->rst); +- goto err_dispose; ++ goto err_unprepare; + } + + ret = reset_control_deassert(info->rst); + if (ret) +- goto err_dispose; ++ goto err_unprepare; + + port->type = type; + port->uartclk = clk; +@@ -184,8 +190,6 @@ static int of_platform_serial_setup(struct platform_device *ofdev, + port->handle_irq = fsl8250_handle_irq; + + return 0; +-err_dispose: +- irq_dispose_mapping(port->irq); + err_unprepare: + clk_disable_unprepare(info->clk); + err_pmruntime: +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index 243c96025053..47b41159a8bc 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -657,7 +657,7 @@ static void sc16is7xx_handle_tx(struct uart_port *port) + uart_write_wakeup(port); + } + +-static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) ++static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) + { + struct uart_port *port = &s->p[portno].port; + +@@ -666,7 +666,7 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) + + iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG); + if (iir & SC16IS7XX_IIR_NO_INT_BIT) +- break; ++ return false; + + iir &= SC16IS7XX_IIR_ID_MASK; + +@@ -688,16 +688,23 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) + port->line, iir); + break; + } +- } while (1); ++ } while (0); ++ return true; + } + + static void sc16is7xx_ist(struct kthread_work *ws) + { + struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work); +- int i; + +- for (i = 0; i < s->devtype->nr_uart; ++i) +- sc16is7xx_port_irq(s, i); ++ while (1) { ++ bool keep_polling = false; ++ int i; ++ ++ for (i = 0; i < s->devtype->nr_uart; ++i) ++ keep_polling |= sc16is7xx_port_irq(s, i); ++ if (!keep_polling) ++ break; ++ } + } + + static irqreturn_t sc16is7xx_irq(int irq, void *dev_id) +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index ab3f6e91853d..3649b83ef863 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -3102,6 +3102,7 @@ static struct uart_driver sci_uart_driver = { + static int sci_remove(struct platform_device *dev) + { + struct sci_port *port = platform_get_drvdata(dev); ++ unsigned int type = port->port.type; /* uart_remove_... clears it */ + + sci_ports_in_use &= ~BIT(port->port.line); + uart_remove_one_port(&sci_uart_driver, &port->port); +@@ -3112,8 +3113,7 @@ static int sci_remove(struct platform_device *dev) + sysfs_remove_file(&dev->dev.kobj, + &dev_attr_rx_fifo_trigger.attr); + } +- if (port->port.type == PORT_SCIFA || port->port.type == PORT_SCIFB || +- port->port.type == PORT_HSCIF) { ++ if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF) { + sysfs_remove_file(&dev->dev.kobj, + &dev_attr_rx_fifo_timeout.attr); + } +diff --git a/drivers/tty/tty_baudrate.c b/drivers/tty/tty_baudrate.c +index 7576ceace571..f438eaa68246 100644 +--- a/drivers/tty/tty_baudrate.c ++++ b/drivers/tty/tty_baudrate.c +@@ -77,7 +77,7 @@ speed_t tty_termios_baud_rate(struct ktermios *termios) + else + cbaud += 15; + } +- return baud_table[cbaud]; ++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud]; + } + EXPORT_SYMBOL(tty_termios_baud_rate); + +@@ -113,7 +113,7 @@ speed_t tty_termios_input_baud_rate(struct ktermios *termios) + else + cbaud += 15; + } +- return baud_table[cbaud]; ++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud]; + #else /* IBSHIFT */ + return tty_termios_baud_rate(termios); + #endif /* IBSHIFT */ +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 5e5da9acaf0a..252eef2c32f9 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -408,7 +408,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line) + mutex_lock(&tty_mutex); + /* Search through the tty devices to look for a match */ + list_for_each_entry(p, &tty_drivers, tty_drivers) { +- if (strncmp(name, p->name, len) != 0) ++ if (!len || strncmp(name, p->name, len) != 0) + continue; + stp = str; + if (*stp == ',') +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index c24bb690680b..e7e3ae13516d 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -964,7 +964,8 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + prot_bytes = vhost32_to_cpu(vq, v_req_pi.pi_bytesin); + } + /* +- * Set prot_iter to data_iter, and advance past any ++ * Set prot_iter to data_iter and truncate it to ++ * prot_bytes, and advance data_iter past any + * preceeding prot_bytes that may be present. + * + * Also fix up the exp_data_len to reflect only the +@@ -973,6 +974,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + if (prot_bytes) { + exp_data_len -= prot_bytes; + prot_iter = data_iter; ++ iov_iter_truncate(&prot_iter, prot_bytes); + iov_iter_advance(&data_iter, prot_bytes); + } + tag = vhost64_to_cpu(vq, v_req_pi.tag); +diff --git a/drivers/video/fbdev/aty/mach64_accel.c b/drivers/video/fbdev/aty/mach64_accel.c +index 2541a0e0de76..3ad46255f990 100644 +--- a/drivers/video/fbdev/aty/mach64_accel.c ++++ b/drivers/video/fbdev/aty/mach64_accel.c +@@ -127,7 +127,7 @@ void aty_init_engine(struct atyfb_par *par, struct fb_info *info) + + /* set host attributes */ + wait_for_fifo(13, par); +- aty_st_le32(HOST_CNTL, 0, par); ++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); + + /* set pattern attributes */ + aty_st_le32(PAT_REG0, 0, par); +@@ -233,7 +233,8 @@ void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area) + rotation = rotation24bpp(dx, direction); + } + +- wait_for_fifo(4, par); ++ wait_for_fifo(5, par); ++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); + aty_st_le32(DP_SRC, FRGD_SRC_BLIT, par); + aty_st_le32(SRC_Y_X, (sx << 16) | sy, par); + aty_st_le32(SRC_HEIGHT1_WIDTH1, (width << 16) | area->height, par); +@@ -269,7 +270,8 @@ void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect) + rotation = rotation24bpp(dx, DST_X_LEFT_TO_RIGHT); + } + +- wait_for_fifo(3, par); ++ wait_for_fifo(4, par); ++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); + aty_st_le32(DP_FRGD_CLR, color, par); + aty_st_le32(DP_SRC, + BKGD_SRC_BKGD_CLR | FRGD_SRC_FRGD_CLR | MONO_SRC_ONE, +@@ -284,7 +286,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + { + struct atyfb_par *par = (struct atyfb_par *) info->par; + u32 src_bytes, dx = image->dx, dy = image->dy, width = image->width; +- u32 pix_width_save, pix_width, host_cntl, rotation = 0, src, mix; ++ u32 pix_width, rotation = 0, src, mix; + + if (par->asleep) + return; +@@ -296,8 +298,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + return; + } + +- pix_width = pix_width_save = aty_ld_le32(DP_PIX_WIDTH, par); +- host_cntl = aty_ld_le32(HOST_CNTL, par) | HOST_BYTE_ALIGN; ++ pix_width = par->crtc.dp_pix_width; + + switch (image->depth) { + case 1: +@@ -345,7 +346,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + * since Rage 3D IIc we have DP_HOST_TRIPLE_EN bit + * this hwaccelerated triple has an issue with not aligned data + */ +- if (M64_HAS(HW_TRIPLE) && image->width % 8 == 0) ++ if (image->depth == 1 && M64_HAS(HW_TRIPLE) && image->width % 8 == 0) + pix_width |= DP_HOST_TRIPLE_EN; + } + +@@ -370,19 +371,18 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + mix = FRGD_MIX_D_XOR_S | BKGD_MIX_D; + } + +- wait_for_fifo(6, par); +- aty_st_le32(DP_WRITE_MASK, 0xFFFFFFFF, par); ++ wait_for_fifo(5, par); + aty_st_le32(DP_PIX_WIDTH, pix_width, par); + aty_st_le32(DP_MIX, mix, par); + aty_st_le32(DP_SRC, src, par); +- aty_st_le32(HOST_CNTL, host_cntl, par); ++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); + aty_st_le32(DST_CNTL, DST_Y_TOP_TO_BOTTOM | DST_X_LEFT_TO_RIGHT | rotation, par); + + draw_rect(dx, dy, width, image->height, par); + src_bytes = (((image->width * image->depth) + 7) / 8) * image->height; + + /* manual triple each pixel */ +- if (info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { ++ if (image->depth == 1 && info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { + int inbit, outbit, mult24, byte_id_in_dword, width; + u8 *pbitmapin = (u8*)image->data, *pbitmapout; + u32 hostdword; +@@ -415,7 +415,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + } + } + wait_for_fifo(1, par); +- aty_st_le32(HOST_DATA0, hostdword, par); ++ aty_st_le32(HOST_DATA0, le32_to_cpu(hostdword), par); + } + } else { + u32 *pbitmap, dwords = (src_bytes + 3) / 4; +@@ -424,8 +424,4 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + aty_st_le32(HOST_DATA0, get_unaligned_le32(pbitmap), par); + } + } +- +- /* restore pix_width */ +- wait_for_fifo(1, par); +- aty_st_le32(DP_PIX_WIDTH, pix_width_save, par); + } +diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c +index 5f2e48d41d72..ab3d5f5dbb00 100644 +--- a/fs/9p/vfs_file.c ++++ b/fs/9p/vfs_file.c +@@ -204,6 +204,14 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl) + break; + if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0) + break; ++ /* ++ * p9_client_lock_dotl overwrites flock.client_id with the ++ * server message, free and reuse the client name ++ */ ++ if (flock.client_id != fid->clnt->name) { ++ kfree(flock.client_id); ++ flock.client_id = fid->clnt->name; ++ } + } + + /* map 9p status to VFS status */ +@@ -235,6 +243,8 @@ out_unlock: + locks_lock_file_wait(filp, fl); + fl->fl_type = fl_type; + } ++ if (flock.client_id != fid->clnt->name) ++ kfree(flock.client_id); + out: + return res; + } +@@ -269,7 +279,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl) + + res = p9_client_getlock_dotl(fid, &glock); + if (res < 0) +- return res; ++ goto out; + /* map 9p lock type to os lock type */ + switch (glock.type) { + case P9_LOCK_TYPE_RDLCK: +@@ -290,7 +300,9 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl) + fl->fl_end = glock.start + glock.length - 1; + fl->fl_pid = -glock.proc_id; + } +- kfree(glock.client_id); ++out: ++ if (glock.client_id != fid->clnt->name) ++ kfree(glock.client_id); + return res; + } + +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 05dc3c17cb62..dc52ce5e495f 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -4359,13 +4359,23 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info, + unpin = pinned_extents; + again: + while (1) { ++ /* ++ * The btrfs_finish_extent_commit() may get the same range as ++ * ours between find_first_extent_bit and clear_extent_dirty. ++ * Hence, hold the unused_bg_unpin_mutex to avoid double unpin ++ * the same extent range. ++ */ ++ mutex_lock(&fs_info->unused_bg_unpin_mutex); + ret = find_first_extent_bit(unpin, 0, &start, &end, + EXTENT_DIRTY, NULL); +- if (ret) ++ if (ret) { ++ mutex_unlock(&fs_info->unused_bg_unpin_mutex); + break; ++ } + + clear_extent_dirty(unpin, start, end); + btrfs_error_unpin_extent_range(fs_info, start, end); ++ mutex_unlock(&fs_info->unused_bg_unpin_mutex); + cond_resched(); + } + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 83268d8f48c4..7158b5b77c9d 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1532,12 +1532,11 @@ out_check: + } + btrfs_release_path(path); + +- if (cur_offset <= end && cow_start == (u64)-1) { ++ if (cur_offset <= end && cow_start == (u64)-1) + cow_start = cur_offset; +- cur_offset = end; +- } + + if (cow_start != (u64)-1) { ++ cur_offset = end; + ret = cow_file_range(inode, locked_page, cow_start, end, end, + page_started, nr_written, 1, NULL); + if (ret) +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index bd4767f562cd..c9152155fcbf 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3489,6 +3489,8 @@ static int btrfs_extent_same_range(struct inode *src, u64 loff, u64 olen, + const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize; + + len = round_down(i_size_read(src), sz) - loff; ++ if (len == 0) ++ return 0; + olen = len; + } + } +@@ -4278,9 +4280,17 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src, + goto out_unlock; + if (len == 0) + olen = len = src->i_size - off; +- /* if we extend to eof, continue to block boundary */ +- if (off + len == src->i_size) ++ /* ++ * If we extend to eof, continue to block boundary if and only if the ++ * destination end offset matches the destination file's size, otherwise ++ * we would be corrupting data by placing the eof block into the middle ++ * of a file. ++ */ ++ if (off + len == src->i_size) { ++ if (!IS_ALIGNED(len, bs) && destoff + len < inode->i_size) ++ goto out_unlock; + len = ALIGN(src->i_size, bs) - off; ++ } + + if (len == 0) { + ret = 0; +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index db835635372f..d385778b628c 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -440,7 +440,7 @@ static int check_block_group_item(struct btrfs_fs_info *fs_info, + type != (BTRFS_BLOCK_GROUP_METADATA | + BTRFS_BLOCK_GROUP_DATA)) { + block_group_err(fs_info, leaf, slot, +-"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llu or 0x%llx", ++"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx", + type, hweight64(type), + BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA, + BTRFS_BLOCK_GROUP_SYSTEM, +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index d0bcfbfc0e3a..16ecb76fa53c 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -4399,6 +4399,23 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans, + logged_end = end; + + list_for_each_entry_safe(em, n, &tree->modified_extents, list) { ++ /* ++ * Skip extents outside our logging range. It's important to do ++ * it for correctness because if we don't ignore them, we may ++ * log them before their ordered extent completes, and therefore ++ * we could log them without logging their respective checksums ++ * (the checksum items are added to the csum tree at the very ++ * end of btrfs_finish_ordered_io()). Also leave such extents ++ * outside of our range in the list, since we may have another ++ * ranged fsync in the near future that needs them. If an extent ++ * outside our range corresponds to a hole, log it to avoid ++ * leaving gaps between extents (fsck will complain when we are ++ * not using the NO_HOLES feature). ++ */ ++ if ((em->start > end || em->start + em->len <= start) && ++ em->block_start != EXTENT_MAP_HOLE) ++ continue; ++ + list_del_init(&em->list); + /* + * Just an arbitrary number, this can be really CPU intensive +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index ebc7bdaed2d0..4055ab4d5c52 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1132,8 +1132,12 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in) + if (IS_ERR(realdn)) { + pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n", + PTR_ERR(realdn), dn, in, ceph_vinop(in)); +- dput(dn); +- dn = realdn; /* note realdn contains the error */ ++ dn = realdn; ++ /* ++ * Caller should release 'dn' in the case of error. ++ * If 'req->r_dentry' is passed to this function, ++ * caller should leave 'req->r_dentry' untouched. ++ */ + goto out; + } else if (realdn) { + dout("dn %p (%d) spliced with %p (%d) " +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index d767e993591d..244531d3065a 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5804,9 +5804,10 @@ int ext4_mark_iloc_dirty(handle_t *handle, + { + int err = 0; + +- if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) ++ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) { ++ put_bh(iloc->bh); + return -EIO; +- ++ } + if (IS_I_VERSION(inode)) + inode_inc_iversion(inode); + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 377d516c475f..ffa25753e929 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -126,6 +126,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, + if (!is_dx_block && type == INDEX) { + ext4_error_inode(inode, func, line, block, + "directory leaf block found instead of index block"); ++ brelse(bh); + return ERR_PTR(-EFSCORRUPTED); + } + if (!ext4_has_metadata_csum(inode->i_sb) || +@@ -2811,7 +2812,9 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode) + list_del_init(&EXT4_I(inode)->i_orphan); + mutex_unlock(&sbi->s_orphan_lock); + } +- } ++ } else ++ brelse(iloc.bh); ++ + jbd_debug(4, "superblock will point to %lu\n", inode->i_ino); + jbd_debug(4, "orphan inode %lu will point to %d\n", + inode->i_ino, NEXT_ORPHAN(inode)); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index ebbc663d0798..a5efee34415f 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -459,16 +459,18 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle, + + BUFFER_TRACE(bh, "get_write_access"); + err = ext4_journal_get_write_access(handle, bh); +- if (err) ++ if (err) { ++ brelse(bh); + return err; ++ } + ext4_debug("mark block bitmap %#04llx (+%llu/%u)\n", + first_cluster, first_cluster - start, count2); + ext4_set_bits(bh->b_data, first_cluster - start, count2); + + err = ext4_handle_dirty_metadata(handle, NULL, bh); ++ brelse(bh); + if (unlikely(err)) + return err; +- brelse(bh); + } + + return 0; +@@ -605,7 +607,6 @@ handle_bb: + bh = bclean(handle, sb, block); + if (IS_ERR(bh)) { + err = PTR_ERR(bh); +- bh = NULL; + goto out; + } + overhead = ext4_group_overhead_blocks(sb, group); +@@ -618,9 +619,9 @@ handle_bb: + ext4_mark_bitmap_end(EXT4_B2C(sbi, group_data[i].blocks_count), + sb->s_blocksize * 8, bh->b_data); + err = ext4_handle_dirty_metadata(handle, NULL, bh); ++ brelse(bh); + if (err) + goto out; +- brelse(bh); + + handle_ib: + if (bg_flags[i] & EXT4_BG_INODE_UNINIT) +@@ -635,18 +636,16 @@ handle_ib: + bh = bclean(handle, sb, block); + if (IS_ERR(bh)) { + err = PTR_ERR(bh); +- bh = NULL; + goto out; + } + + ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), + sb->s_blocksize * 8, bh->b_data); + err = ext4_handle_dirty_metadata(handle, NULL, bh); ++ brelse(bh); + if (err) + goto out; +- brelse(bh); + } +- bh = NULL; + + /* Mark group tables in block bitmap */ + for (j = 0; j < GROUP_TABLE_COUNT; j++) { +@@ -685,7 +684,6 @@ handle_ib: + } + + out: +- brelse(bh); + err2 = ext4_journal_stop(handle); + if (err2 && !err) + err = err2; +@@ -873,6 +871,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode, + err = ext4_handle_dirty_metadata(handle, NULL, gdb_bh); + if (unlikely(err)) { + ext4_std_error(sb, err); ++ iloc.bh = NULL; + goto exit_inode; + } + brelse(dind); +@@ -924,6 +923,7 @@ static int add_new_gdb_meta_bg(struct super_block *sb, + sizeof(struct buffer_head *), + GFP_NOFS); + if (!n_group_desc) { ++ brelse(gdb_bh); + err = -ENOMEM; + ext4_warning(sb, "not enough memory for %lu groups", + gdb_num + 1); +@@ -939,8 +939,6 @@ static int add_new_gdb_meta_bg(struct super_block *sb, + kvfree(o_group_desc); + BUFFER_TRACE(gdb_bh, "get_write_access"); + err = ext4_journal_get_write_access(handle, gdb_bh); +- if (unlikely(err)) +- brelse(gdb_bh); + return err; + } + +@@ -1124,8 +1122,10 @@ static void update_backups(struct super_block *sb, sector_t blk_off, char *data, + backup_block, backup_block - + ext4_group_first_block_no(sb, group)); + BUFFER_TRACE(bh, "get_write_access"); +- if ((err = ext4_journal_get_write_access(handle, bh))) ++ if ((err = ext4_journal_get_write_access(handle, bh))) { ++ brelse(bh); + break; ++ } + lock_buffer(bh); + memcpy(bh->b_data, data, size); + if (rest) +@@ -2023,7 +2023,7 @@ retry: + + err = ext4_alloc_flex_bg_array(sb, n_group + 1); + if (err) +- return err; ++ goto out; + + err = ext4_mb_alloc_groupinfo(sb, n_group + 1); + if (err) +@@ -2059,6 +2059,10 @@ retry: + n_blocks_count_retry = 0; + free_flex_gd(flex_gd); + flex_gd = NULL; ++ if (resize_inode) { ++ iput(resize_inode); ++ resize_inode = NULL; ++ } + goto retry; + } + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index d3d4643ab79b..8a149df1c6a1 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4074,6 +4074,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_groups_count = blocks_count; + sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count, + (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); ++ if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != ++ le32_to_cpu(es->s_inodes_count)) { ++ ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", ++ le32_to_cpu(es->s_inodes_count), ++ ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); ++ ret = -EINVAL; ++ goto failed_mount; ++ } + db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / + EXT4_DESC_PER_BLOCK(sb); + if (ext4_has_feature_meta_bg(sb)) { +@@ -4093,14 +4101,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + ret = -ENOMEM; + goto failed_mount; + } +- if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != +- le32_to_cpu(es->s_inodes_count)) { +- ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", +- le32_to_cpu(es->s_inodes_count), +- ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); +- ret = -EINVAL; +- goto failed_mount; +- } + + bgl_lock_init(sbi->s_blockgroup_lock); + +@@ -4509,6 +4509,7 @@ failed_mount6: + percpu_counter_destroy(&sbi->s_freeinodes_counter); + percpu_counter_destroy(&sbi->s_dirs_counter); + percpu_counter_destroy(&sbi->s_dirtyclusters_counter); ++ percpu_free_rwsem(&sbi->s_journal_flag_rwsem); + failed_mount5: + ext4_ext_release(sb); + ext4_release_system_zone(sb); +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index f36fc5d5b257..4380c8630539 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1388,6 +1388,12 @@ retry: + bh = ext4_getblk(handle, ea_inode, block, 0); + if (IS_ERR(bh)) + return PTR_ERR(bh); ++ if (!bh) { ++ WARN_ON_ONCE(1); ++ EXT4_ERROR_INODE(ea_inode, ++ "ext4_getblk() return bh = NULL"); ++ return -EFSCORRUPTED; ++ } + ret = ext4_journal_get_write_access(handle, bh); + if (ret) + goto out; +@@ -2276,8 +2282,10 @@ static struct buffer_head *ext4_xattr_get_block(struct inode *inode) + if (!bh) + return ERR_PTR(-EIO); + error = ext4_xattr_check_block(inode, bh); +- if (error) ++ if (error) { ++ brelse(bh); + return ERR_PTR(error); ++ } + return bh; + } + +@@ -2397,6 +2405,8 @@ retry_inode: + error = ext4_xattr_block_set(handle, inode, &i, &bs); + } else if (error == -ENOSPC) { + if (EXT4_I(inode)->i_file_acl && !bs.s.base) { ++ brelse(bs.bh); ++ bs.bh = NULL; + error = ext4_xattr_block_find(inode, &i, &bs); + if (error) + goto cleanup; +@@ -2617,6 +2627,8 @@ out: + kfree(buffer); + if (is) + brelse(is->iloc.bh); ++ if (bs) ++ brelse(bs->bh); + kfree(is); + kfree(bs); + +@@ -2696,7 +2708,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, + struct ext4_inode *raw_inode, handle_t *handle) + { + struct ext4_xattr_ibody_header *header; +- struct buffer_head *bh; + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); + static unsigned int mnt_count; + size_t min_offs; +@@ -2737,13 +2748,17 @@ retry: + * EA block can hold new_extra_isize bytes. + */ + if (EXT4_I(inode)->i_file_acl) { ++ struct buffer_head *bh; ++ + bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl); + error = -EIO; + if (!bh) + goto cleanup; + error = ext4_xattr_check_block(inode, bh); +- if (error) ++ if (error) { ++ brelse(bh); + goto cleanup; ++ } + base = BHDR(bh); + end = bh->b_data + bh->b_size; + min_offs = end - base; +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index 11ea2c4a38ab..bf0da0382c9e 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -129,9 +129,13 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background) + + static void fuse_drop_waiting(struct fuse_conn *fc) + { +- if (fc->connected) { +- atomic_dec(&fc->num_waiting); +- } else if (atomic_dec_and_test(&fc->num_waiting)) { ++ /* ++ * lockess check of fc->connected is okay, because atomic_dec_and_test() ++ * provides a memory barrier mached with the one in fuse_wait_aborted() ++ * to ensure no wake-up is missed. ++ */ ++ if (atomic_dec_and_test(&fc->num_waiting) && ++ !READ_ONCE(fc->connected)) { + /* wake up aborters */ + wake_up_all(&fc->blocked_waitq); + } +@@ -391,12 +395,19 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) + if (test_bit(FR_BACKGROUND, &req->flags)) { + spin_lock(&fc->lock); + clear_bit(FR_BACKGROUND, &req->flags); +- if (fc->num_background == fc->max_background) ++ if (fc->num_background == fc->max_background) { + fc->blocked = 0; +- +- /* Wake up next waiter, if any */ +- if (!fc->blocked && waitqueue_active(&fc->blocked_waitq)) + wake_up(&fc->blocked_waitq); ++ } else if (!fc->blocked) { ++ /* ++ * Wake up next waiter, if any. It's okay to use ++ * waitqueue_active(), as we've already synced up ++ * fc->blocked with waiters with the wake_up() call ++ * above. ++ */ ++ if (waitqueue_active(&fc->blocked_waitq)) ++ wake_up(&fc->blocked_waitq); ++ } + + if (fc->num_background == fc->congestion_threshold && fc->sb) { + clear_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC); +@@ -1311,12 +1322,14 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, + goto out_end; + } + list_move_tail(&req->list, &fpq->processing); +- spin_unlock(&fpq->lock); ++ __fuse_get_request(req); + set_bit(FR_SENT, &req->flags); ++ spin_unlock(&fpq->lock); + /* matches barrier in request_wait_answer() */ + smp_mb__after_atomic(); + if (test_bit(FR_INTERRUPTED, &req->flags)) + queue_interrupt(fiq, req); ++ fuse_put_request(fc, req); + + return reqsize; + +@@ -1715,8 +1728,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, + req->in.args[1].size = total_len; + + err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique); +- if (err) ++ if (err) { + fuse_retrieve_end(fc, req); ++ fuse_put_request(fc, req); ++ } + + return err; + } +@@ -1875,16 +1890,20 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud, + + /* Is it an interrupt reply? */ + if (req->intr_unique == oh.unique) { ++ __fuse_get_request(req); + spin_unlock(&fpq->lock); + + err = -EINVAL; +- if (nbytes != sizeof(struct fuse_out_header)) ++ if (nbytes != sizeof(struct fuse_out_header)) { ++ fuse_put_request(fc, req); + goto err_finish; ++ } + + if (oh.error == -ENOSYS) + fc->no_interrupt = 1; + else if (oh.error == -EAGAIN) + queue_interrupt(&fc->iq, req); ++ fuse_put_request(fc, req); + + fuse_copy_finish(cs); + return nbytes; +@@ -2152,6 +2171,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn); + + void fuse_wait_aborted(struct fuse_conn *fc) + { ++ /* matches implicit memory barrier in fuse_drop_waiting() */ ++ smp_mb(); + wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0); + } + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 32d0b883e74f..a0ffed34b85d 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -2913,10 +2913,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + } + + if (io->async) { ++ bool blocking = io->blocking; ++ + fuse_aio_complete(io, ret < 0 ? ret : 0, -1); + + /* we have a non-extending, async request, so return */ +- if (!io->blocking) ++ if (!blocking) + return -EIOCBQUEUED; + + wait_for_completion(&wait); +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 84544a4f012d..8748539c04ed 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1908,10 +1908,16 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length) + if (ret < 0) + goto out; + +- /* issue read-ahead on metadata */ +- if (mp.mp_aheight > 1) { +- for (; ret > 1; ret--) { +- metapointer_range(&mp, mp.mp_aheight - ret, ++ /* On the first pass, issue read-ahead on metadata. */ ++ if (mp.mp_aheight > 1 && strip_h == ip->i_height - 1) { ++ unsigned int height = mp.mp_aheight - 1; ++ ++ /* No read-ahead for data blocks. */ ++ if (mp.mp_aheight - 1 == strip_h) ++ height--; ++ ++ for (; height >= mp.mp_aheight - ret; height--) { ++ metapointer_range(&mp, height, + start_list, start_aligned, + end_list, end_aligned, + &start, &end); +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 1ad3256b9cbc..449d0cb45a84 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -725,6 +725,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) + + if (gl) { + glock_clear_object(gl, rgd); ++ gfs2_rgrp_brelse(rgd); + gfs2_glock_put(gl); + } + +@@ -1141,7 +1142,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd) + * @rgd: the struct gfs2_rgrpd describing the RG to read in + * + * Read in all of a Resource Group's header and bitmap blocks. +- * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps. ++ * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps. + * + * Returns: errno + */ +diff --git a/fs/inode.c b/fs/inode.c +index 42f6d25f32a5..65ae154df760 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -730,8 +730,11 @@ static enum lru_status inode_lru_isolate(struct list_head *item, + return LRU_REMOVED; + } + +- /* recently referenced inodes get one more pass */ +- if (inode->i_state & I_REFERENCED) { ++ /* ++ * Recently referenced inodes and inodes with many attached pages ++ * get one more pass. ++ */ ++ if (inode->i_state & I_REFERENCED || inode->i_data.nrpages > 1) { + inode->i_state &= ~I_REFERENCED; + spin_unlock(&inode->i_lock); + return LRU_ROTATE; +diff --git a/fs/ioctl.c b/fs/ioctl.c +index 2005529af560..0400297c8d72 100644 +--- a/fs/ioctl.c ++++ b/fs/ioctl.c +@@ -669,6 +669,9 @@ int do_vfs_ioctl(struct file *filp, unsigned int fd, unsigned int cmd, + return ioctl_fiemap(filp, arg); + + case FIGETBSZ: ++ /* anon_bdev filesystems may not have a block size */ ++ if (!inode->i_sb->s_blocksize) ++ return -EINVAL; + return put_user(inode->i_sb->s_blocksize, argp); + + case FICLONE: +diff --git a/fs/namespace.c b/fs/namespace.c +index 99186556f8d3..1fce41ba3535 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -695,9 +695,6 @@ static struct mountpoint *lookup_mountpoint(struct dentry *dentry) + + hlist_for_each_entry(mp, chain, m_hash) { + if (mp->m_dentry == dentry) { +- /* might be worth a WARN_ON() */ +- if (d_unlinked(dentry)) +- return ERR_PTR(-ENOENT); + mp->m_count++; + return mp; + } +@@ -711,6 +708,9 @@ static struct mountpoint *get_mountpoint(struct dentry *dentry) + int ret; + + if (d_mountpoint(dentry)) { ++ /* might be worth a WARN_ON() */ ++ if (d_unlinked(dentry)) ++ return ERR_PTR(-ENOENT); + mountpoint: + read_seqlock_excl(&mount_lock); + mp = lookup_mountpoint(dentry); +@@ -1540,8 +1540,13 @@ static int do_umount(struct mount *mnt, int flags) + + namespace_lock(); + lock_mount_hash(); +- event++; + ++ /* Recheck MNT_LOCKED with the locks held */ ++ retval = -EINVAL; ++ if (mnt->mnt.mnt_flags & MNT_LOCKED) ++ goto out; ++ ++ event++; + if (flags & MNT_DETACH) { + if (!list_empty(&mnt->mnt_list)) + umount_tree(mnt, UMOUNT_PROPAGATE); +@@ -1555,6 +1560,7 @@ static int do_umount(struct mount *mnt, int flags) + retval = 0; + } + } ++out: + unlock_mount_hash(); + namespace_unlock(); + return retval; +@@ -1645,7 +1651,7 @@ int ksys_umount(char __user *name, int flags) + goto dput_and_out; + if (!check_mnt(mnt)) + goto dput_and_out; +- if (mnt->mnt.mnt_flags & MNT_LOCKED) ++ if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */ + goto dput_and_out; + retval = -EPERM; + if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) +@@ -1728,8 +1734,14 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, + for (s = r; s; s = next_mnt(s, r)) { + if (!(flag & CL_COPY_UNBINDABLE) && + IS_MNT_UNBINDABLE(s)) { +- s = skip_mnt_tree(s); +- continue; ++ if (s->mnt.mnt_flags & MNT_LOCKED) { ++ /* Both unbindable and locked. */ ++ q = ERR_PTR(-EPERM); ++ goto out; ++ } else { ++ s = skip_mnt_tree(s); ++ continue; ++ } + } + if (!(flag & CL_COPY_MNT_NS_FILE) && + is_mnt_ns_file(s->mnt.mnt_root)) { +@@ -1782,7 +1794,7 @@ void drop_collected_mounts(struct vfsmount *mnt) + { + namespace_lock(); + lock_mount_hash(); +- umount_tree(real_mount(mnt), UMOUNT_SYNC); ++ umount_tree(real_mount(mnt), 0); + unlock_mount_hash(); + namespace_unlock(); + } +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 40a08cd483f0..18920152da14 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -2583,11 +2583,12 @@ static void nfs4_state_manager(struct nfs_client *clp) + nfs4_clear_state_manager_bit(clp); + /* Did we race with an attempt to give us more work? */ + if (clp->cl_state == 0) +- break; ++ return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) +- break; ++ return; + } while (refcount_read(&clp->cl_count) > 1); +- return; ++ goto out_drain; ++ + out_error: + if (strlen(section)) + section_sep = ": "; +@@ -2595,6 +2596,7 @@ out_error: + " with error %d\n", section_sep, section, + clp->cl_hostname, -status); + ssleep(1); ++out_drain: + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + } +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index b7bc6e1a85ac..9d6b4f0f1a25 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1037,6 +1037,9 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + { + __be32 status; + ++ if (!cstate->save_fh.fh_dentry) ++ return nfserr_nofilehandle; ++ + status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->save_fh, + src_stateid, RD_STATE, src, NULL); + if (status) { +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index 302cd7caa4a7..7578bd507c70 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -2412,8 +2412,16 @@ static int ocfs2_dio_end_io(struct kiocb *iocb, + /* this io's submitter should not have unlocked this before we could */ + BUG_ON(!ocfs2_iocb_is_rw_locked(iocb)); + +- if (bytes > 0 && private) +- ret = ocfs2_dio_end_io_write(inode, private, offset, bytes); ++ if (bytes <= 0) ++ mlog_ratelimited(ML_ERROR, "Direct IO failed, bytes = %lld", ++ (long long)bytes); ++ if (private) { ++ if (bytes > 0) ++ ret = ocfs2_dio_end_io_write(inode, private, offset, ++ bytes); ++ else ++ ocfs2_dio_free_write_ctx(inode, private); ++ } + + ocfs2_iocb_clear_rw_locked(iocb); + +diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h +index 308ea0eb35fd..a396096a5099 100644 +--- a/fs/ocfs2/cluster/masklog.h ++++ b/fs/ocfs2/cluster/masklog.h +@@ -178,6 +178,15 @@ do { \ + ##__VA_ARGS__); \ + } while (0) + ++#define mlog_ratelimited(mask, fmt, ...) \ ++do { \ ++ static DEFINE_RATELIMIT_STATE(_rs, \ ++ DEFAULT_RATELIMIT_INTERVAL, \ ++ DEFAULT_RATELIMIT_BURST); \ ++ if (__ratelimit(&_rs)) \ ++ mlog(mask, fmt, ##__VA_ARGS__); \ ++} while (0) ++ + #define mlog_errno(st) ({ \ + int _st = (st); \ + if (_st != -ERESTARTSYS && _st != -EINTR && \ +diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c +index b048d4fa3959..c121abbdfc7d 100644 +--- a/fs/ocfs2/dir.c ++++ b/fs/ocfs2/dir.c +@@ -1897,8 +1897,7 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode, + /* On error, skip the f_pos to the + next block. */ + ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1; +- brelse(bh); +- continue; ++ break; + } + if (le64_to_cpu(de->inode)) { + unsigned char d_type = DT_UNKNOWN; +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index 276914ae3c60..3bbde0a9f48f 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -463,6 +463,10 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode, + if (IS_ERR(upper)) + goto out_unlock; + ++ err = -ESTALE; ++ if (d_is_negative(upper) || !IS_WHITEOUT(d_inode(upper))) ++ goto out_dput; ++ + newdentry = ovl_create_temp(workdir, cattr); + err = PTR_ERR(newdentry); + if (IS_ERR(newdentry)) +@@ -663,6 +667,10 @@ static int ovl_link(struct dentry *old, struct inode *newdir, + if (err) + goto out_drop_write; + ++ err = ovl_copy_up(new->d_parent); ++ if (err) ++ goto out_drop_write; ++ + if (ovl_is_metacopy_dentry(old)) { + err = ovl_set_redirect(old, false); + if (err) +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index 9c0ca6a7becf..efd372312ef1 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -422,8 +422,10 @@ int ovl_verify_set_fh(struct dentry *dentry, const char *name, + + fh = ovl_encode_real_fh(real, is_upper); + err = PTR_ERR(fh); +- if (IS_ERR(fh)) ++ if (IS_ERR(fh)) { ++ fh = NULL; + goto fail; ++ } + + err = ovl_verify_fh(dentry, name, fh); + if (set && err == -ENODATA) +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 30adc9d408a0..0fb0a59a5e5c 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -472,6 +472,7 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config) + { + char *p; + int err; ++ bool metacopy_opt = false, redirect_opt = false; + + config->redirect_mode = kstrdup(ovl_redirect_mode_def(), GFP_KERNEL); + if (!config->redirect_mode) +@@ -516,6 +517,7 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config) + config->redirect_mode = match_strdup(&args[0]); + if (!config->redirect_mode) + return -ENOMEM; ++ redirect_opt = true; + break; + + case OPT_INDEX_ON: +@@ -548,6 +550,7 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config) + + case OPT_METACOPY_ON: + config->metacopy = true; ++ metacopy_opt = true; + break; + + case OPT_METACOPY_OFF: +@@ -572,13 +575,32 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config) + if (err) + return err; + +- /* metacopy feature with upper requires redirect_dir=on */ +- if (config->upperdir && config->metacopy && !config->redirect_dir) { +- pr_warn("overlayfs: metadata only copy up requires \"redirect_dir=on\", falling back to metacopy=off.\n"); +- config->metacopy = false; +- } else if (config->metacopy && !config->redirect_follow) { +- pr_warn("overlayfs: metadata only copy up requires \"redirect_dir=follow\" on non-upper mount, falling back to metacopy=off.\n"); +- config->metacopy = false; ++ /* ++ * This is to make the logic below simpler. It doesn't make any other ++ * difference, since config->redirect_dir is only used for upper. ++ */ ++ if (!config->upperdir && config->redirect_follow) ++ config->redirect_dir = true; ++ ++ /* Resolve metacopy -> redirect_dir dependency */ ++ if (config->metacopy && !config->redirect_dir) { ++ if (metacopy_opt && redirect_opt) { ++ pr_err("overlayfs: conflicting options: metacopy=on,redirect_dir=%s\n", ++ config->redirect_mode); ++ return -EINVAL; ++ } ++ if (redirect_opt) { ++ /* ++ * There was an explicit redirect_dir=... that resulted ++ * in this conflict. ++ */ ++ pr_info("overlayfs: disabling metacopy due to redirect_dir=%s\n", ++ config->redirect_mode); ++ config->metacopy = false; ++ } else { ++ /* Automatically enable redirect otherwise. */ ++ config->redirect_follow = config->redirect_dir = true; ++ } + } + + return 0; +diff --git a/fs/udf/super.c b/fs/udf/super.c +index 6f515651a2c2..b997e3116e37 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -613,14 +613,11 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options) + struct udf_options uopt; + struct udf_sb_info *sbi = UDF_SB(sb); + int error = 0; +- struct logicalVolIntegrityDescImpUse *lvidiu = udf_sb_lvidiu(sb); ++ ++ if (!(*flags & SB_RDONLY) && UDF_QUERY_FLAG(sb, UDF_FLAG_RW_INCOMPAT)) ++ return -EACCES; + + sync_filesystem(sb); +- if (lvidiu) { +- int write_rev = le16_to_cpu(lvidiu->minUDFWriteRev); +- if (write_rev > UDF_MAX_WRITE_VERSION && !(*flags & SB_RDONLY)) +- return -EACCES; +- } + + uopt.flags = sbi->s_flags; + uopt.uid = sbi->s_uid; +@@ -1257,6 +1254,7 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block) + ret = -EACCES; + goto out_bh; + } ++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT); + ret = udf_load_vat(sb, i, type1_idx); + if (ret < 0) + goto out_bh; +@@ -2155,10 +2153,12 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) + UDF_MAX_READ_VERSION); + ret = -EINVAL; + goto error_out; +- } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION && +- !sb_rdonly(sb)) { +- ret = -EACCES; +- goto error_out; ++ } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION) { ++ if (!sb_rdonly(sb)) { ++ ret = -EACCES; ++ goto error_out; ++ } ++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT); + } + + sbi->s_udfrev = minUDFWriteRev; +@@ -2176,10 +2176,12 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) + } + + if (sbi->s_partmaps[sbi->s_partition].s_partition_flags & +- UDF_PART_FLAG_READ_ONLY && +- !sb_rdonly(sb)) { +- ret = -EACCES; +- goto error_out; ++ UDF_PART_FLAG_READ_ONLY) { ++ if (!sb_rdonly(sb)) { ++ ret = -EACCES; ++ goto error_out; ++ } ++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT); + } + + if (udf_find_fileset(sb, &fileset, &rootdir)) { +diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h +index 9424d7cab790..d12e507e9eb2 100644 +--- a/fs/udf/udf_sb.h ++++ b/fs/udf/udf_sb.h +@@ -30,6 +30,8 @@ + #define UDF_FLAG_LASTBLOCK_SET 16 + #define UDF_FLAG_BLOCKSIZE_SET 17 + #define UDF_FLAG_INCONSISTENT 18 ++#define UDF_FLAG_RW_INCOMPAT 19 /* Set when we find RW incompatible ++ * feature */ + + #define UDF_PART_FLAG_UNALLOC_BITMAP 0x0001 + #define UDF_PART_FLAG_UNALLOC_TABLE 0x0002 +diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h +index 49c93b9308d7..68bb09c29ce8 100644 +--- a/include/linux/ceph/libceph.h ++++ b/include/linux/ceph/libceph.h +@@ -81,7 +81,13 @@ struct ceph_options { + + #define CEPH_MSG_MAX_FRONT_LEN (16*1024*1024) + #define CEPH_MSG_MAX_MIDDLE_LEN (16*1024*1024) +-#define CEPH_MSG_MAX_DATA_LEN (16*1024*1024) ++ ++/* ++ * Handle the largest possible rbd object in one message. ++ * There is no limit on the size of cephfs objects, but it has to obey ++ * rsize and wsize mount options anyway. ++ */ ++#define CEPH_MSG_MAX_DATA_LEN (32*1024*1024) + + #define CEPH_AUTH_NAME_DEFAULT "guest" + +diff --git a/include/linux/i8253.h b/include/linux/i8253.h +index e6bb36a97519..8336b2f6f834 100644 +--- a/include/linux/i8253.h ++++ b/include/linux/i8253.h +@@ -21,6 +21,7 @@ + #define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ) + + extern raw_spinlock_t i8253_lock; ++extern bool i8253_clear_counter_on_shutdown; + extern struct clock_event_device i8253_clockevent; + extern void clockevent_i8253_init(bool oneshot); + +diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h +index abe975c87b90..78b86dea2f29 100644 +--- a/include/linux/mtd/nand.h ++++ b/include/linux/mtd/nand.h +@@ -324,9 +324,8 @@ static inline unsigned int nanddev_ntargets(const struct nand_device *nand) + */ + static inline unsigned int nanddev_neraseblocks(const struct nand_device *nand) + { +- return (u64)nand->memorg.luns_per_target * +- nand->memorg.eraseblocks_per_lun * +- nand->memorg.pages_per_eraseblock; ++ return nand->memorg.ntargets * nand->memorg.luns_per_target * ++ nand->memorg.eraseblocks_per_lun; + } + + /** +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index 08f9247e9827..9003e29cde46 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -119,6 +119,8 @@ static inline int hardlockup_detector_perf_init(void) { return 0; } + void watchdog_nmi_stop(void); + void watchdog_nmi_start(void); + int watchdog_nmi_probe(void); ++int watchdog_nmi_enable(unsigned int cpu); ++void watchdog_nmi_disable(unsigned int cpu); + + /** + * touch_nmi_watchdog - restart NMI watchdog timeout. +diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h +index 01674b56e14f..71a87c36e2b6 100644 +--- a/include/uapi/linux/kfd_ioctl.h ++++ b/include/uapi/linux/kfd_ioctl.h +@@ -247,10 +247,10 @@ struct kfd_hsa_memory_exception_data { + + /* hw exception data */ + struct kfd_hsa_hw_exception_data { +- uint32_t reset_type; +- uint32_t reset_cause; +- uint32_t memory_lost; +- uint32_t gpu_id; ++ __u32 reset_type; ++ __u32 reset_cause; ++ __u32 memory_lost; ++ __u32 gpu_id; + }; + + /* Event data */ +diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h +index fd18c974a619..f6e798d42069 100644 +--- a/include/xen/xen-ops.h ++++ b/include/xen/xen-ops.h +@@ -41,7 +41,7 @@ int xen_setup_shutdown_event(void); + + extern unsigned long *xen_contiguous_bitmap; + +-#ifdef CONFIG_XEN_PV ++#if defined(CONFIG_XEN_PV) || defined(CONFIG_ARM) || defined(CONFIG_ARM64) + int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order, + unsigned int address_bits, + dma_addr_t *dma_handle); +diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c +index 6ad4a9fcbd6f..7921ae4fca8d 100644 +--- a/kernel/debug/kdb/kdb_bt.c ++++ b/kernel/debug/kdb/kdb_bt.c +@@ -179,14 +179,14 @@ kdb_bt(int argc, const char **argv) + kdb_printf("no process for cpu %ld\n", cpu); + return 0; + } +- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu)); ++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu)); + kdb_parse(buf); + return 0; + } + kdb_printf("btc: cpu status: "); + kdb_parse("cpu\n"); + for_each_online_cpu(cpu) { +- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu)); ++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu)); + kdb_parse(buf); + touch_nmi_watchdog(); + } +diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c +index 2ddfce8f1e8f..f338d23b112b 100644 +--- a/kernel/debug/kdb/kdb_main.c ++++ b/kernel/debug/kdb/kdb_main.c +@@ -1192,7 +1192,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, + if (reason == KDB_REASON_DEBUG) { + /* special case below */ + } else { +- kdb_printf("\nEntering kdb (current=0x%p, pid %d) ", ++ kdb_printf("\nEntering kdb (current=0x%px, pid %d) ", + kdb_current, kdb_current ? kdb_current->pid : 0); + #if defined(CONFIG_SMP) + kdb_printf("on processor %d ", raw_smp_processor_id()); +@@ -1208,7 +1208,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, + */ + switch (db_result) { + case KDB_DB_BPT: +- kdb_printf("\nEntering kdb (0x%p, pid %d) ", ++ kdb_printf("\nEntering kdb (0x%px, pid %d) ", + kdb_current, kdb_current->pid); + #if defined(CONFIG_SMP) + kdb_printf("on processor %d ", raw_smp_processor_id()); +@@ -2048,7 +2048,7 @@ static int kdb_lsmod(int argc, const char **argv) + if (mod->state == MODULE_STATE_UNFORMED) + continue; + +- kdb_printf("%-20s%8u 0x%p ", mod->name, ++ kdb_printf("%-20s%8u 0x%px ", mod->name, + mod->core_layout.size, (void *)mod); + #ifdef CONFIG_MODULE_UNLOAD + kdb_printf("%4d ", module_refcount(mod)); +@@ -2059,7 +2059,7 @@ static int kdb_lsmod(int argc, const char **argv) + kdb_printf(" (Loading)"); + else + kdb_printf(" (Live)"); +- kdb_printf(" 0x%p", mod->core_layout.base); ++ kdb_printf(" 0x%px", mod->core_layout.base); + + #ifdef CONFIG_MODULE_UNLOAD + { +@@ -2341,7 +2341,7 @@ void kdb_ps1(const struct task_struct *p) + return; + + cpu = kdb_process_cpu(p); +- kdb_printf("0x%p %8d %8d %d %4d %c 0x%p %c%s\n", ++ kdb_printf("0x%px %8d %8d %d %4d %c 0x%px %c%s\n", + (void *)p, p->pid, p->parent->pid, + kdb_task_has_cpu(p), kdb_process_cpu(p), + kdb_task_state_char(p), +@@ -2354,7 +2354,7 @@ void kdb_ps1(const struct task_struct *p) + } else { + if (KDB_TSK(cpu) != p) + kdb_printf(" Error: does not match running " +- "process table (0x%p)\n", KDB_TSK(cpu)); ++ "process table (0x%px)\n", KDB_TSK(cpu)); + } + } + } +@@ -2692,7 +2692,7 @@ int kdb_register_flags(char *cmd, + for_each_kdbcmd(kp, i) { + if (kp->cmd_name && (strcmp(kp->cmd_name, cmd) == 0)) { + kdb_printf("Duplicate kdb command registered: " +- "%s, func %p help %s\n", cmd, func, help); ++ "%s, func %px help %s\n", cmd, func, help); + return 1; + } + } +diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c +index 990b3cc526c8..987eb73284d2 100644 +--- a/kernel/debug/kdb/kdb_support.c ++++ b/kernel/debug/kdb/kdb_support.c +@@ -40,7 +40,7 @@ + int kdbgetsymval(const char *symname, kdb_symtab_t *symtab) + { + if (KDB_DEBUG(AR)) +- kdb_printf("kdbgetsymval: symname=%s, symtab=%p\n", symname, ++ kdb_printf("kdbgetsymval: symname=%s, symtab=%px\n", symname, + symtab); + memset(symtab, 0, sizeof(*symtab)); + symtab->sym_start = kallsyms_lookup_name(symname); +@@ -88,7 +88,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab) + char *knt1 = NULL; + + if (KDB_DEBUG(AR)) +- kdb_printf("kdbnearsym: addr=0x%lx, symtab=%p\n", addr, symtab); ++ kdb_printf("kdbnearsym: addr=0x%lx, symtab=%px\n", addr, symtab); + memset(symtab, 0, sizeof(*symtab)); + + if (addr < 4096) +@@ -149,7 +149,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab) + symtab->mod_name = "kernel"; + if (KDB_DEBUG(AR)) + kdb_printf("kdbnearsym: returns %d symtab->sym_start=0x%lx, " +- "symtab->mod_name=%p, symtab->sym_name=%p (%s)\n", ret, ++ "symtab->mod_name=%px, symtab->sym_name=%px (%s)\n", ret, + symtab->sym_start, symtab->mod_name, symtab->sym_name, + symtab->sym_name); + +@@ -887,13 +887,13 @@ void debug_kusage(void) + __func__, dah_first); + if (dah_first) { + h_used = (struct debug_alloc_header *)debug_alloc_pool; +- kdb_printf("%s: h_used %p size %d\n", __func__, h_used, ++ kdb_printf("%s: h_used %px size %d\n", __func__, h_used, + h_used->size); + } + do { + h_used = (struct debug_alloc_header *) + ((char *)h_free + dah_overhead + h_free->size); +- kdb_printf("%s: h_used %p size %d caller %p\n", ++ kdb_printf("%s: h_used %px size %d caller %px\n", + __func__, h_used, h_used->size, h_used->caller); + h_free = (struct debug_alloc_header *) + (debug_alloc_pool + h_free->next); +@@ -902,7 +902,7 @@ void debug_kusage(void) + ((char *)h_free + dah_overhead + h_free->size); + if ((char *)h_used - debug_alloc_pool != + sizeof(debug_alloc_pool_aligned)) +- kdb_printf("%s: h_used %p size %d caller %p\n", ++ kdb_printf("%s: h_used %px size %d caller %px\n", + __func__, h_used, h_used->size, h_used->caller); + out: + spin_unlock(&dap_lock); +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index c30032367aab..f9a0cd094b81 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -61,9 +61,23 @@ static nokprobe_inline bool trace_kprobe_within_module(struct trace_kprobe *tk, + return strncmp(mod->name, name, len) == 0 && name[len] == ':'; + } + +-static nokprobe_inline bool trace_kprobe_is_on_module(struct trace_kprobe *tk) ++static nokprobe_inline bool trace_kprobe_module_exist(struct trace_kprobe *tk) + { +- return !!strchr(trace_kprobe_symbol(tk), ':'); ++ char *p; ++ bool ret; ++ ++ if (!tk->symbol) ++ return false; ++ p = strchr(tk->symbol, ':'); ++ if (!p) ++ return true; ++ *p = '\0'; ++ mutex_lock(&module_mutex); ++ ret = !!find_module(tk->symbol); ++ mutex_unlock(&module_mutex); ++ *p = ':'; ++ ++ return ret; + } + + static nokprobe_inline unsigned long trace_kprobe_nhit(struct trace_kprobe *tk) +@@ -554,19 +568,13 @@ static int __register_trace_kprobe(struct trace_kprobe *tk) + else + ret = register_kprobe(&tk->rp.kp); + +- if (ret == 0) ++ if (ret == 0) { + tk->tp.flags |= TP_FLAG_REGISTERED; +- else { +- if (ret == -ENOENT && trace_kprobe_is_on_module(tk)) { +- pr_warn("This probe might be able to register after target module is loaded. Continue.\n"); +- ret = 0; +- } else if (ret == -EILSEQ) { +- pr_warn("Probing address(0x%p) is not an instruction boundary.\n", +- tk->rp.kp.addr); +- ret = -EINVAL; +- } ++ } else if (ret == -EILSEQ) { ++ pr_warn("Probing address(0x%p) is not an instruction boundary.\n", ++ tk->rp.kp.addr); ++ ret = -EINVAL; + } +- + return ret; + } + +@@ -629,6 +637,11 @@ static int register_trace_kprobe(struct trace_kprobe *tk) + + /* Register k*probe */ + ret = __register_trace_kprobe(tk); ++ if (ret == -ENOENT && !trace_kprobe_module_exist(tk)) { ++ pr_warn("This probe might be able to register after target module is loaded. Continue.\n"); ++ ret = 0; ++ } ++ + if (ret < 0) + unregister_kprobe_event(tk); + else +diff --git a/lib/ubsan.c b/lib/ubsan.c +index 59fee96c29a0..e4162f59a81c 100644 +--- a/lib/ubsan.c ++++ b/lib/ubsan.c +@@ -427,8 +427,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); + + +-void __noreturn +-__ubsan_handle_builtin_unreachable(struct unreachable_data *data) ++void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) + { + unsigned long flags; + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 7b5c0ad9a6bd..1931a3d9b282 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -3233,7 +3233,7 @@ static int is_hugetlb_entry_hwpoisoned(pte_t pte) + int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + struct vm_area_struct *vma) + { +- pte_t *src_pte, *dst_pte, entry; ++ pte_t *src_pte, *dst_pte, entry, dst_entry; + struct page *ptepage; + unsigned long addr; + int cow; +@@ -3261,15 +3261,30 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + break; + } + +- /* If the pagetables are shared don't copy or take references */ +- if (dst_pte == src_pte) ++ /* ++ * If the pagetables are shared don't copy or take references. ++ * dst_pte == src_pte is the common case of src/dest sharing. ++ * ++ * However, src could have 'unshared' and dst shares with ++ * another vma. If dst_pte !none, this implies sharing. ++ * Check here before taking page table lock, and once again ++ * after taking the lock below. ++ */ ++ dst_entry = huge_ptep_get(dst_pte); ++ if ((dst_pte == src_pte) || !huge_pte_none(dst_entry)) + continue; + + dst_ptl = huge_pte_lock(h, dst, dst_pte); + src_ptl = huge_pte_lockptr(h, src, src_pte); + spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); + entry = huge_ptep_get(src_pte); +- if (huge_pte_none(entry)) { /* skip none entry */ ++ dst_entry = huge_ptep_get(dst_pte); ++ if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) { ++ /* ++ * Skip if src entry none. Also, skip in the ++ * unlikely case dst entry !none as this implies ++ * sharing with another vma. ++ */ + ; + } else if (unlikely(is_hugetlb_entry_migration(entry) || + is_hugetlb_entry_hwpoisoned(entry))) { +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 38d94b703e9d..f3f919728f5c 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -587,6 +587,7 @@ int __remove_pages(struct zone *zone, unsigned long phys_start_pfn, + for (i = 0; i < sections_to_remove; i++) { + unsigned long pfn = phys_start_pfn + i*PAGES_PER_SECTION; + ++ cond_resched(); + ret = __remove_section(zone, __pfn_to_section(pfn), map_offset, + altmap); + map_offset = 0; +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index da858f794eb6..149b6f4cf023 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -2046,8 +2046,36 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, + nmask = policy_nodemask(gfp, pol); + if (!nmask || node_isset(hpage_node, *nmask)) { + mpol_cond_put(pol); +- page = __alloc_pages_node(hpage_node, +- gfp | __GFP_THISNODE, order); ++ /* ++ * We cannot invoke reclaim if __GFP_THISNODE ++ * is set. Invoking reclaim with ++ * __GFP_THISNODE set, would cause THP ++ * allocations to trigger heavy swapping ++ * despite there may be tons of free memory ++ * (including potentially plenty of THP ++ * already available in the buddy) on all the ++ * other NUMA nodes. ++ * ++ * At most we could invoke compaction when ++ * __GFP_THISNODE is set (but we would need to ++ * refrain from invoking reclaim even if ++ * compaction returned COMPACT_SKIPPED because ++ * there wasn't not enough memory to succeed ++ * compaction). For now just avoid ++ * __GFP_THISNODE instead of limiting the ++ * allocation path to a strict and single ++ * compaction invocation. ++ * ++ * Supposedly if direct reclaim was enabled by ++ * the caller, the app prefers THP regardless ++ * of the node it comes from so this would be ++ * more desiderable behavior than only ++ * providing THP originated from the local ++ * node in such case. ++ */ ++ if (!(gfp & __GFP_DIRECT_RECLAIM)) ++ gfp |= __GFP_THISNODE; ++ page = __alloc_pages_node(hpage_node, gfp, order); + goto out; + } + } +diff --git a/mm/swapfile.c b/mm/swapfile.c +index d954b71c4f9c..8810a6d7d67f 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -2820,7 +2820,7 @@ static struct swap_info_struct *alloc_swap_info(void) + unsigned int type; + int i; + +- p = kzalloc(sizeof(*p), GFP_KERNEL); ++ p = kvzalloc(sizeof(*p), GFP_KERNEL); + if (!p) + return ERR_PTR(-ENOMEM); + +@@ -2831,7 +2831,7 @@ static struct swap_info_struct *alloc_swap_info(void) + } + if (type >= MAX_SWAPFILES) { + spin_unlock(&swap_lock); +- kfree(p); ++ kvfree(p); + return ERR_PTR(-EPERM); + } + if (type >= nr_swapfiles) { +@@ -2845,7 +2845,7 @@ static struct swap_info_struct *alloc_swap_info(void) + smp_wmb(); + nr_swapfiles++; + } else { +- kfree(p); ++ kvfree(p); + p = swap_info[type]; + /* + * Do not memset this entry: a racing procfs swap_next() +diff --git a/net/9p/protocol.c b/net/9p/protocol.c +index 4a1e1dd30b52..ee32bbf12675 100644 +--- a/net/9p/protocol.c ++++ b/net/9p/protocol.c +@@ -46,10 +46,15 @@ p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...); + void p9stat_free(struct p9_wstat *stbuf) + { + kfree(stbuf->name); ++ stbuf->name = NULL; + kfree(stbuf->uid); ++ stbuf->uid = NULL; + kfree(stbuf->gid); ++ stbuf->gid = NULL; + kfree(stbuf->muid); ++ stbuf->muid = NULL; + kfree(stbuf->extension); ++ stbuf->extension = NULL; + } + EXPORT_SYMBOL(p9stat_free); + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index a676d5f76bdc..277d02a8cac8 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1073,19 +1073,22 @@ static unsigned int early_drop_list(struct net *net, + return drops; + } + +-static noinline int early_drop(struct net *net, unsigned int _hash) ++static noinline int early_drop(struct net *net, unsigned int hash) + { +- unsigned int i; ++ unsigned int i, bucket; + + for (i = 0; i < NF_CT_EVICTION_RANGE; i++) { + struct hlist_nulls_head *ct_hash; +- unsigned int hash, hsize, drops; ++ unsigned int hsize, drops; + + rcu_read_lock(); + nf_conntrack_get_ht(&ct_hash, &hsize); +- hash = reciprocal_scale(_hash++, hsize); ++ if (!i) ++ bucket = reciprocal_scale(hash, hsize); ++ else ++ bucket = (bucket + 1) % hsize; + +- drops = early_drop_list(net, &ct_hash[hash]); ++ drops = early_drop_list(net, &ct_hash[bucket]); + rcu_read_unlock(); + + if (drops) { +diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c +index 30afbd236656..b53cc0960b5d 100644 +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -639,11 +639,10 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len) + WARN_ON_ONCE(xdr->iov); + return; + } +- if (fraglen) { ++ if (fraglen) + xdr->end = head->iov_base + head->iov_len; +- xdr->page_ptr--; +- } + /* (otherwise assume xdr->end is already set) */ ++ xdr->page_ptr--; + head->iov_len = len; + buf->len = len; + xdr->p = head->iov_base + head->iov_len; +diff --git a/scripts/spdxcheck.py b/scripts/spdxcheck.py +index 839e190bbd7a..5056fb3b897d 100755 +--- a/scripts/spdxcheck.py ++++ b/scripts/spdxcheck.py +@@ -168,7 +168,6 @@ class id_parser(object): + self.curline = 0 + try: + for line in fd: +- line = line.decode(locale.getpreferredencoding(False), errors='ignore') + self.curline += 1 + if self.curline > maxlines: + break +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 18b98b5e1e3c..fe251c6f09f1 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -5318,6 +5318,9 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname, + addr_buf = address; + + while (walk_size < addrlen) { ++ if (walk_size + sizeof(sa_family_t) > addrlen) ++ return -EINVAL; ++ + addr = addr_buf; + switch (addr->sa_family) { + case AF_UNSPEC: +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index 2ae640257fdb..ca577658e890 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -244,6 +244,27 @@ static void cs_etm__free(struct perf_session *session) + zfree(&aux); + } + ++static u8 cs_etm__cpu_mode(struct cs_etm_queue *etmq, u64 address) ++{ ++ struct machine *machine; ++ ++ machine = etmq->etm->machine; ++ ++ if (address >= etmq->etm->kernel_start) { ++ if (machine__is_host(machine)) ++ return PERF_RECORD_MISC_KERNEL; ++ else ++ return PERF_RECORD_MISC_GUEST_KERNEL; ++ } else { ++ if (machine__is_host(machine)) ++ return PERF_RECORD_MISC_USER; ++ else if (perf_guest) ++ return PERF_RECORD_MISC_GUEST_USER; ++ else ++ return PERF_RECORD_MISC_HYPERVISOR; ++ } ++} ++ + static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u64 address, + size_t size, u8 *buffer) + { +@@ -258,10 +279,7 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u64 address, + return -1; + + machine = etmq->etm->machine; +- if (address >= etmq->etm->kernel_start) +- cpumode = PERF_RECORD_MISC_KERNEL; +- else +- cpumode = PERF_RECORD_MISC_USER; ++ cpumode = cs_etm__cpu_mode(etmq, address); + + thread = etmq->thread; + if (!thread) { +@@ -653,7 +671,7 @@ static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq, + struct perf_sample sample = {.ip = 0,}; + + event->sample.header.type = PERF_RECORD_SAMPLE; +- event->sample.header.misc = PERF_RECORD_MISC_USER; ++ event->sample.header.misc = cs_etm__cpu_mode(etmq, addr); + event->sample.header.size = sizeof(struct perf_event_header); + + sample.ip = addr; +@@ -665,7 +683,7 @@ static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq, + sample.cpu = etmq->packet->cpu; + sample.flags = 0; + sample.insn_len = 1; +- sample.cpumode = event->header.misc; ++ sample.cpumode = event->sample.header.misc; + + if (etm->synth_opts.last_branch) { + cs_etm__copy_last_branch_rb(etmq); +@@ -706,12 +724,15 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq) + u64 nr; + struct branch_entry entries; + } dummy_bs; ++ u64 ip; ++ ++ ip = cs_etm__last_executed_instr(etmq->prev_packet); + + event->sample.header.type = PERF_RECORD_SAMPLE; +- event->sample.header.misc = PERF_RECORD_MISC_USER; ++ event->sample.header.misc = cs_etm__cpu_mode(etmq, ip); + event->sample.header.size = sizeof(struct perf_event_header); + +- sample.ip = cs_etm__last_executed_instr(etmq->prev_packet); ++ sample.ip = ip; + sample.pid = etmq->pid; + sample.tid = etmq->tid; + sample.addr = cs_etm__first_executed_instr(etmq->packet); +@@ -720,7 +741,7 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq) + sample.period = 1; + sample.cpu = etmq->packet->cpu; + sample.flags = 0; +- sample.cpumode = PERF_RECORD_MISC_USER; ++ sample.cpumode = event->sample.header.misc; + + /* + * perf report cannot handle events without a branch stack +diff --git a/tools/perf/util/intel-bts.c b/tools/perf/util/intel-bts.c +index 7f0c83b6332b..7127bc917fc5 100644 +--- a/tools/perf/util/intel-bts.c ++++ b/tools/perf/util/intel-bts.c +@@ -269,6 +269,13 @@ static int intel_bts_do_fix_overlap(struct auxtrace_queue *queue, + return 0; + } + ++static inline u8 intel_bts_cpumode(struct intel_bts *bts, uint64_t ip) ++{ ++ return machine__kernel_ip(bts->machine, ip) ? ++ PERF_RECORD_MISC_KERNEL : ++ PERF_RECORD_MISC_USER; ++} ++ + static int intel_bts_synth_branch_sample(struct intel_bts_queue *btsq, + struct branch *branch) + { +@@ -281,12 +288,8 @@ static int intel_bts_synth_branch_sample(struct intel_bts_queue *btsq, + bts->num_events++ <= bts->synth_opts.initial_skip) + return 0; + +- event.sample.header.type = PERF_RECORD_SAMPLE; +- event.sample.header.misc = PERF_RECORD_MISC_USER; +- event.sample.header.size = sizeof(struct perf_event_header); +- +- sample.cpumode = PERF_RECORD_MISC_USER; + sample.ip = le64_to_cpu(branch->from); ++ sample.cpumode = intel_bts_cpumode(bts, sample.ip); + sample.pid = btsq->pid; + sample.tid = btsq->tid; + sample.addr = le64_to_cpu(branch->to); +@@ -298,6 +301,10 @@ static int intel_bts_synth_branch_sample(struct intel_bts_queue *btsq, + sample.insn_len = btsq->intel_pt_insn.length; + memcpy(sample.insn, btsq->intel_pt_insn.buf, INTEL_PT_INSN_BUF_SZ); + ++ event.sample.header.type = PERF_RECORD_SAMPLE; ++ event.sample.header.misc = sample.cpumode; ++ event.sample.header.size = sizeof(struct perf_event_header); ++ + if (bts->synth_opts.inject) { + event.sample.header.size = bts->branches_event_size; + ret = perf_event__synthesize_sample(&event, +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index aec68908d604..4f48bc11a29c 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -407,6 +407,13 @@ intel_pt_cache_lookup(struct dso *dso, struct machine *machine, u64 offset) + return auxtrace_cache__lookup(dso->auxtrace_cache, offset); + } + ++static inline u8 intel_pt_cpumode(struct intel_pt *pt, uint64_t ip) ++{ ++ return ip >= pt->kernel_start ? ++ PERF_RECORD_MISC_KERNEL : ++ PERF_RECORD_MISC_USER; ++} ++ + static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn, + uint64_t *insn_cnt_ptr, uint64_t *ip, + uint64_t to_ip, uint64_t max_insn_cnt, +@@ -429,10 +436,7 @@ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn, + if (to_ip && *ip == to_ip) + goto out_no_cache; + +- if (*ip >= ptq->pt->kernel_start) +- cpumode = PERF_RECORD_MISC_KERNEL; +- else +- cpumode = PERF_RECORD_MISC_USER; ++ cpumode = intel_pt_cpumode(ptq->pt, *ip); + + thread = ptq->thread; + if (!thread) { +@@ -759,7 +763,8 @@ static struct intel_pt_queue *intel_pt_alloc_queue(struct intel_pt *pt, + if (pt->synth_opts.callchain) { + size_t sz = sizeof(struct ip_callchain); + +- sz += pt->synth_opts.callchain_sz * sizeof(u64); ++ /* Add 1 to callchain_sz for callchain context */ ++ sz += (pt->synth_opts.callchain_sz + 1) * sizeof(u64); + ptq->chain = zalloc(sz); + if (!ptq->chain) + goto out_free; +@@ -1053,15 +1058,11 @@ static void intel_pt_prep_b_sample(struct intel_pt *pt, + union perf_event *event, + struct perf_sample *sample) + { +- event->sample.header.type = PERF_RECORD_SAMPLE; +- event->sample.header.misc = PERF_RECORD_MISC_USER; +- event->sample.header.size = sizeof(struct perf_event_header); +- + if (!pt->timeless_decoding) + sample->time = tsc_to_perf_time(ptq->timestamp, &pt->tc); + +- sample->cpumode = PERF_RECORD_MISC_USER; + sample->ip = ptq->state->from_ip; ++ sample->cpumode = intel_pt_cpumode(pt, sample->ip); + sample->pid = ptq->pid; + sample->tid = ptq->tid; + sample->addr = ptq->state->to_ip; +@@ -1070,6 +1071,10 @@ static void intel_pt_prep_b_sample(struct intel_pt *pt, + sample->flags = ptq->flags; + sample->insn_len = ptq->insn_len; + memcpy(sample->insn, ptq->insn, INTEL_PT_INSN_BUF_SZ); ++ ++ event->sample.header.type = PERF_RECORD_SAMPLE; ++ event->sample.header.misc = sample->cpumode; ++ event->sample.header.size = sizeof(struct perf_event_header); + } + + static int intel_pt_inject_event(union perf_event *event, +@@ -1155,7 +1160,8 @@ static void intel_pt_prep_sample(struct intel_pt *pt, + + if (pt->synth_opts.callchain) { + thread_stack__sample(ptq->thread, ptq->chain, +- pt->synth_opts.callchain_sz, sample->ip); ++ pt->synth_opts.callchain_sz + 1, ++ sample->ip, pt->kernel_start); + sample->callchain = ptq->chain; + } + +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index 111ae858cbcb..8ee8ab39d8ac 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -2140,6 +2140,27 @@ static int resolve_lbr_callchain_sample(struct thread *thread, + return 0; + } + ++static int find_prev_cpumode(struct ip_callchain *chain, struct thread *thread, ++ struct callchain_cursor *cursor, ++ struct symbol **parent, ++ struct addr_location *root_al, ++ u8 *cpumode, int ent) ++{ ++ int err = 0; ++ ++ while (--ent >= 0) { ++ u64 ip = chain->ips[ent]; ++ ++ if (ip >= PERF_CONTEXT_MAX) { ++ err = add_callchain_ip(thread, cursor, parent, ++ root_al, cpumode, ip, ++ false, NULL, NULL, 0); ++ break; ++ } ++ } ++ return err; ++} ++ + static int thread__resolve_callchain_sample(struct thread *thread, + struct callchain_cursor *cursor, + struct perf_evsel *evsel, +@@ -2246,6 +2267,12 @@ static int thread__resolve_callchain_sample(struct thread *thread, + } + + check_calls: ++ if (callchain_param.order != ORDER_CALLEE) { ++ err = find_prev_cpumode(chain, thread, cursor, parent, root_al, ++ &cpumode, chain->nr - first_call); ++ if (err) ++ return (err < 0) ? err : 0; ++ } + for (i = first_call, nr_entries = 0; + i < chain_nr && nr_entries < max_stack; i++) { + u64 ip; +@@ -2260,9 +2287,15 @@ check_calls: + continue; + #endif + ip = chain->ips[j]; +- + if (ip < PERF_CONTEXT_MAX) + ++nr_entries; ++ else if (callchain_param.order != ORDER_CALLEE) { ++ err = find_prev_cpumode(chain, thread, cursor, parent, ++ root_al, &cpumode, j); ++ if (err) ++ return (err < 0) ? err : 0; ++ continue; ++ } + + err = add_callchain_ip(thread, cursor, parent, + root_al, &cpumode, ip, +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index 7799788f662f..7e49baad304d 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -773,7 +773,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu) + + if (!is_arm_pmu_core(name)) { + pname = pe->pmu ? pe->pmu : "cpu"; +- if (strncmp(pname, name, strlen(pname))) ++ if (strcmp(pname, name)) + continue; + } + +diff --git a/tools/perf/util/thread-stack.c b/tools/perf/util/thread-stack.c +index dd17d6a38d3a..a5669d05e91f 100644 +--- a/tools/perf/util/thread-stack.c ++++ b/tools/perf/util/thread-stack.c +@@ -285,20 +285,46 @@ void thread_stack__free(struct thread *thread) + } + } + ++static inline u64 callchain_context(u64 ip, u64 kernel_start) ++{ ++ return ip < kernel_start ? PERF_CONTEXT_USER : PERF_CONTEXT_KERNEL; ++} ++ + void thread_stack__sample(struct thread *thread, struct ip_callchain *chain, +- size_t sz, u64 ip) ++ size_t sz, u64 ip, u64 kernel_start) + { +- size_t i; ++ u64 context = callchain_context(ip, kernel_start); ++ u64 last_context; ++ size_t i, j; + +- if (!thread || !thread->ts) +- chain->nr = 1; +- else +- chain->nr = min(sz, thread->ts->cnt + 1); ++ if (sz < 2) { ++ chain->nr = 0; ++ return; ++ } + +- chain->ips[0] = ip; ++ chain->ips[0] = context; ++ chain->ips[1] = ip; ++ ++ if (!thread || !thread->ts) { ++ chain->nr = 2; ++ return; ++ } ++ ++ last_context = context; ++ ++ for (i = 2, j = 1; i < sz && j <= thread->ts->cnt; i++, j++) { ++ ip = thread->ts->stack[thread->ts->cnt - j].ret_addr; ++ context = callchain_context(ip, kernel_start); ++ if (context != last_context) { ++ if (i >= sz - 1) ++ break; ++ chain->ips[i++] = context; ++ last_context = context; ++ } ++ chain->ips[i] = ip; ++ } + +- for (i = 1; i < chain->nr; i++) +- chain->ips[i] = thread->ts->stack[thread->ts->cnt - i].ret_addr; ++ chain->nr = i; + } + + struct call_return_processor * +diff --git a/tools/perf/util/thread-stack.h b/tools/perf/util/thread-stack.h +index b7e41c4ebfdd..f97c00a8c251 100644 +--- a/tools/perf/util/thread-stack.h ++++ b/tools/perf/util/thread-stack.h +@@ -84,7 +84,7 @@ int thread_stack__event(struct thread *thread, u32 flags, u64 from_ip, + u64 to_ip, u16 insn_len, u64 trace_nr); + void thread_stack__set_trace_nr(struct thread *thread, u64 trace_nr); + void thread_stack__sample(struct thread *thread, struct ip_callchain *chain, +- size_t sz, u64 ip); ++ size_t sz, u64 ip, u64 kernel_start); + int thread_stack__flush(struct thread *thread); + void thread_stack__free(struct thread *thread); + size_t thread_stack__depth(struct thread *thread); +diff --git a/tools/testing/selftests/powerpc/tm/tm-tmspr.c b/tools/testing/selftests/powerpc/tm/tm-tmspr.c +index 2bda81c7bf23..df1d7d4b1c89 100644 +--- a/tools/testing/selftests/powerpc/tm/tm-tmspr.c ++++ b/tools/testing/selftests/powerpc/tm/tm-tmspr.c +@@ -98,7 +98,7 @@ void texasr(void *in) + + int test_tmspr() + { +- pthread_t thread; ++ pthread_t *thread; + int thread_num; + unsigned long i; + +@@ -107,21 +107,28 @@ int test_tmspr() + /* To cause some context switching */ + thread_num = 10 * sysconf(_SC_NPROCESSORS_ONLN); + ++ thread = malloc(thread_num * sizeof(pthread_t)); ++ if (thread == NULL) ++ return EXIT_FAILURE; ++ + /* Test TFIAR and TFHAR */ +- for (i = 0 ; i < thread_num ; i += 2){ +- if (pthread_create(&thread, NULL, (void*)tfiar_tfhar, (void *)i)) ++ for (i = 0; i < thread_num; i += 2) { ++ if (pthread_create(&thread[i], NULL, (void *)tfiar_tfhar, ++ (void *)i)) + return EXIT_FAILURE; + } +- if (pthread_join(thread, NULL) != 0) +- return EXIT_FAILURE; +- + /* Test TEXASR */ +- for (i = 0 ; i < thread_num ; i++){ +- if (pthread_create(&thread, NULL, (void*)texasr, (void *)i)) ++ for (i = 1; i < thread_num; i += 2) { ++ if (pthread_create(&thread[i], NULL, (void *)texasr, (void *)i)) + return EXIT_FAILURE; + } +- if (pthread_join(thread, NULL) != 0) +- return EXIT_FAILURE; ++ ++ for (i = 0; i < thread_num; i++) { ++ if (pthread_join(thread[i], NULL) != 0) ++ return EXIT_FAILURE; ++ } ++ ++ free(thread); + + if (passed) + return 0; diff --git a/patch/kernel/sunxi-dev/patch-4.19.3-4.patch b/patch/kernel/sunxi-dev/patch-4.19.3-4.patch new file mode 100644 index 000000000..6ff628e84 --- /dev/null +++ b/patch/kernel/sunxi-dev/patch-4.19.3-4.patch @@ -0,0 +1,1733 @@ +diff --git a/Makefile b/Makefile +index e4064fa16f11..1f3c7adeea63 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 3 ++SUBLEVEL = 4 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 53eb14a65610..40bdaea97fe7 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -35,10 +35,12 @@ static void __init spectre_v2_select_mitigation(void); + static void __init ssb_select_mitigation(void); + static void __init l1tf_select_mitigation(void); + +-/* The base value of the SPEC_CTRL MSR that always has to be preserved. */ +-u64 x86_spec_ctrl_base; ++/* ++ * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any ++ * writes to SPEC_CTRL contain whatever reserved bits have been set. ++ */ ++u64 __ro_after_init x86_spec_ctrl_base; + EXPORT_SYMBOL_GPL(x86_spec_ctrl_base); +-static DEFINE_MUTEX(spec_ctrl_mutex); + + /* + * The vendor and possibly platform specific bits which can be modified in +@@ -323,46 +325,6 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void) + return cmd; + } + +-static bool stibp_needed(void) +-{ +- if (spectre_v2_enabled == SPECTRE_V2_NONE) +- return false; +- +- if (!boot_cpu_has(X86_FEATURE_STIBP)) +- return false; +- +- return true; +-} +- +-static void update_stibp_msr(void *info) +-{ +- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); +-} +- +-void arch_smt_update(void) +-{ +- u64 mask; +- +- if (!stibp_needed()) +- return; +- +- mutex_lock(&spec_ctrl_mutex); +- mask = x86_spec_ctrl_base; +- if (cpu_smt_control == CPU_SMT_ENABLED) +- mask |= SPEC_CTRL_STIBP; +- else +- mask &= ~SPEC_CTRL_STIBP; +- +- if (mask != x86_spec_ctrl_base) { +- pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n", +- cpu_smt_control == CPU_SMT_ENABLED ? +- "Enabling" : "Disabling"); +- x86_spec_ctrl_base = mask; +- on_each_cpu(update_stibp_msr, NULL, 1); +- } +- mutex_unlock(&spec_ctrl_mutex); +-} +- + static void __init spectre_v2_select_mitigation(void) + { + enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); +@@ -462,9 +424,6 @@ specv2_set_mode: + setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW); + pr_info("Enabling Restricted Speculation for firmware calls\n"); + } +- +- /* Enable STIBP if appropriate */ +- arch_smt_update(); + } + + #undef pr_fmt +@@ -855,8 +814,6 @@ static ssize_t l1tf_show_state(char *buf) + static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, + char *buf, unsigned int bug) + { +- int ret; +- + if (!boot_cpu_has_bug(bug)) + return sprintf(buf, "Not affected\n"); + +@@ -874,12 +831,10 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr + return sprintf(buf, "Mitigation: __user pointer sanitization\n"); + + case X86_BUG_SPECTRE_V2: +- ret = sprintf(buf, "%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], ++ return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], + boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "", + boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "", +- (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "", + spectre_v2_module_string()); +- return ret; + + case X86_BUG_SPEC_STORE_BYPASS: + return sprintf(buf, "%s\n", ssb_strings[ssb_mode]); +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 54e0ca6ed730..86b6464b4525 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -1117,11 +1117,6 @@ static int ksz_switch_init(struct ksz_device *dev) + { + int i; + +- mutex_init(&dev->reg_mutex); +- mutex_init(&dev->stats_mutex); +- mutex_init(&dev->alu_mutex); +- mutex_init(&dev->vlan_mutex); +- + dev->ds->ops = &ksz_switch_ops; + + for (i = 0; i < ARRAY_SIZE(ksz_switch_chips); i++) { +@@ -1206,6 +1201,11 @@ int ksz_switch_register(struct ksz_device *dev) + if (dev->pdata) + dev->chip_id = dev->pdata->chip_id; + ++ mutex_init(&dev->reg_mutex); ++ mutex_init(&dev->stats_mutex); ++ mutex_init(&dev->alu_mutex); ++ mutex_init(&dev->vlan_mutex); ++ + if (ksz_switch_detect(dev)) + return -EINVAL; + +diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c +index d721ccf7d8be..38e399e0f30e 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.c ++++ b/drivers/net/dsa/mv88e6xxx/global1.c +@@ -567,6 +567,8 @@ int mv88e6xxx_g1_stats_clear(struct mv88e6xxx_chip *chip) + if (err) + return err; + ++ /* Keep the histogram mode bits */ ++ val &= MV88E6XXX_G1_STATS_OP_HIST_RX_TX; + val |= MV88E6XXX_G1_STATS_OP_BUSY | MV88E6XXX_G1_STATS_OP_FLUSH_ALL; + + err = mv88e6xxx_g1_write(chip, MV88E6XXX_G1_STATS_OP, val); +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index c57238fce863..7b6859e4924e 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -1897,9 +1897,6 @@ static void bcm_sysport_netif_start(struct net_device *dev) + intrl2_1_mask_clear(priv, 0xffffffff); + else + intrl2_0_mask_clear(priv, INTRL2_0_TDMA_MBDONE_MASK); +- +- /* Last call before we start the real business */ +- netif_tx_start_all_queues(dev); + } + + static void rbuf_init(struct bcm_sysport_priv *priv) +@@ -2045,6 +2042,8 @@ static int bcm_sysport_open(struct net_device *dev) + + bcm_sysport_netif_start(dev); + ++ netif_tx_start_all_queues(dev); ++ + return 0; + + out_clear_rx_int: +@@ -2068,7 +2067,7 @@ static void bcm_sysport_netif_stop(struct net_device *dev) + struct bcm_sysport_priv *priv = netdev_priv(dev); + + /* stop all software from updating hardware */ +- netif_tx_stop_all_queues(dev); ++ netif_tx_disable(dev); + napi_disable(&priv->napi); + cancel_work_sync(&priv->dim.dim.work); + phy_stop(dev->phydev); +@@ -2654,12 +2653,12 @@ static int __maybe_unused bcm_sysport_suspend(struct device *d) + if (!netif_running(dev)) + return 0; + ++ netif_device_detach(dev); ++ + bcm_sysport_netif_stop(dev); + + phy_suspend(dev->phydev); + +- netif_device_detach(dev); +- + /* Disable UniMAC RX */ + umac_enable_set(priv, CMD_RX_EN, 0); + +@@ -2743,8 +2742,6 @@ static int __maybe_unused bcm_sysport_resume(struct device *d) + goto out_free_rx_ring; + } + +- netif_device_attach(dev); +- + /* RX pipe enable */ + topctrl_writel(priv, 0, RX_FLUSH_CNTL); + +@@ -2789,6 +2786,8 @@ static int __maybe_unused bcm_sysport_resume(struct device *d) + + bcm_sysport_netif_start(dev); + ++ netif_device_attach(dev); ++ + return 0; + + out_free_rx_ring: +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 20c1681bb1af..2d6f090bf644 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2855,7 +2855,6 @@ static void bcmgenet_netif_start(struct net_device *dev) + + umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, true); + +- netif_tx_start_all_queues(dev); + bcmgenet_enable_tx_napi(priv); + + /* Monitor link interrupts now */ +@@ -2937,6 +2936,8 @@ static int bcmgenet_open(struct net_device *dev) + + bcmgenet_netif_start(dev); + ++ netif_tx_start_all_queues(dev); ++ + return 0; + + err_irq1: +@@ -2958,7 +2959,7 @@ static void bcmgenet_netif_stop(struct net_device *dev) + struct bcmgenet_priv *priv = netdev_priv(dev); + + bcmgenet_disable_tx_napi(priv); +- netif_tx_stop_all_queues(dev); ++ netif_tx_disable(dev); + + /* Disable MAC receive */ + umac_enable_set(priv, CMD_RX_EN, false); +@@ -3620,13 +3621,13 @@ static int bcmgenet_suspend(struct device *d) + if (!netif_running(dev)) + return 0; + ++ netif_device_detach(dev); ++ + bcmgenet_netif_stop(dev); + + if (!device_may_wakeup(d)) + phy_suspend(dev->phydev); + +- netif_device_detach(dev); +- + /* Prepare the device for Wake-on-LAN and switch to the slow clock */ + if (device_may_wakeup(d) && priv->wolopts) { + ret = bcmgenet_power_down(priv, GENET_POWER_WOL_MAGIC); +@@ -3700,8 +3701,6 @@ static int bcmgenet_resume(struct device *d) + /* Always enable ring 16 - descriptor ring */ + bcmgenet_enable_dma(priv, dma_ctrl); + +- netif_device_attach(dev); +- + if (!device_may_wakeup(d)) + phy_resume(dev->phydev); + +@@ -3710,6 +3709,8 @@ static int bcmgenet_resume(struct device *d) + + bcmgenet_netif_start(dev); + ++ netif_device_attach(dev); ++ + return 0; + + out_clk_disable: +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index e6f28c7942ab..a12962702611 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -12426,6 +12426,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e + { + struct tg3 *tp = netdev_priv(dev); + int i, irq_sync = 0, err = 0; ++ bool reset_phy = false; + + if ((ering->rx_pending > tp->rx_std_ring_mask) || + (ering->rx_jumbo_pending > tp->rx_jmb_ring_mask) || +@@ -12457,7 +12458,13 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e + + if (netif_running(dev)) { + tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); +- err = tg3_restart_hw(tp, false); ++ /* Reset PHY to avoid PHY lock up */ ++ if (tg3_asic_rev(tp) == ASIC_REV_5717 || ++ tg3_asic_rev(tp) == ASIC_REV_5719 || ++ tg3_asic_rev(tp) == ASIC_REV_5720) ++ reset_phy = true; ++ ++ err = tg3_restart_hw(tp, reset_phy); + if (!err) + tg3_netif_start(tp); + } +@@ -12491,6 +12498,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam + { + struct tg3 *tp = netdev_priv(dev); + int err = 0; ++ bool reset_phy = false; + + if (tp->link_config.autoneg == AUTONEG_ENABLE) + tg3_warn_mgmt_link_flap(tp); +@@ -12581,7 +12589,13 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam + + if (netif_running(dev)) { + tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); +- err = tg3_restart_hw(tp, false); ++ /* Reset PHY to avoid PHY lock up */ ++ if (tg3_asic_rev(tp) == ASIC_REV_5717 || ++ tg3_asic_rev(tp) == ASIC_REV_5719 || ++ tg3_asic_rev(tp) == ASIC_REV_5720) ++ reset_phy = true; ++ ++ err = tg3_restart_hw(tp, reset_phy); + if (!err) + tg3_netif_start(tp); + } +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 699ef942b615..7661064c815b 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1545,7 +1545,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + tx_crq.v1.sge_len = cpu_to_be32(skb->len); + tx_crq.v1.ioba = cpu_to_be64(data_dma_addr); + +- if (adapter->vlan_header_insertion) { ++ if (adapter->vlan_header_insertion && skb_vlan_tag_present(skb)) { + tx_crq.v1.flags2 |= IBMVNIC_TX_VLAN_INSERT; + tx_crq.v1.vlan_id = cpu_to_be16(skb->vlan_tci); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index 0f189f873859..16ceeb1b2c9d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -566,6 +566,7 @@ struct mlx5e_rq { + + unsigned long state; + int ix; ++ unsigned int hw_mtu; + + struct net_dim dim; /* Dynamic Interrupt Moderation */ + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c +index 24e3b564964f..12e1682f940b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c +@@ -88,10 +88,8 @@ int mlx5e_port_linkspeed(struct mlx5_core_dev *mdev, u32 *speed) + + eth_proto_oper = MLX5_GET(ptys_reg, out, eth_proto_oper); + *speed = mlx5e_port_ptys2speed(eth_proto_oper); +- if (!(*speed)) { +- mlx5_core_warn(mdev, "cannot get port speed\n"); ++ if (!(*speed)) + err = -EINVAL; +- } + + return err; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +index c047da8752da..eac245a93f91 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +@@ -130,8 +130,10 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu) + int err; + + err = mlx5e_port_linkspeed(priv->mdev, &speed); +- if (err) ++ if (err) { ++ mlx5_core_warn(priv->mdev, "cannot get port speed\n"); + return 0; ++ } + + xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100; + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index f291d1bf1558..faa84b45e20a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -492,6 +492,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c, + rq->channel = c; + rq->ix = c->ix; + rq->mdev = mdev; ++ rq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); + rq->stats = &c->priv->channel_stats[c->ix].rq; + + rq->xdp_prog = params->xdp_prog ? bpf_prog_inc(params->xdp_prog) : NULL; +@@ -1610,13 +1611,15 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev, + int err; + u32 i; + ++ err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn); ++ if (err) ++ return err; ++ + err = mlx5_cqwq_create(mdev, ¶m->wq, param->cqc, &cq->wq, + &cq->wq_ctrl); + if (err) + return err; + +- mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn); +- + mcq->cqe_sz = 64; + mcq->set_ci_db = cq->wq_ctrl.db.db; + mcq->arm_db = cq->wq_ctrl.db.db + 1; +@@ -1674,6 +1677,10 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param) + int eqn; + int err; + ++ err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used); ++ if (err) ++ return err; ++ + inlen = MLX5_ST_SZ_BYTES(create_cq_in) + + sizeof(u64) * cq->wq_ctrl.buf.npages; + in = kvzalloc(inlen, GFP_KERNEL); +@@ -1687,8 +1694,6 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param) + mlx5_fill_page_frag_array(&cq->wq_ctrl.buf, + (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas)); + +- mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used); +- + MLX5_SET(cqc, cqc, cq_period_mode, param->cq_period_mode); + MLX5_SET(cqc, cqc, c_eqn, eqn); + MLX5_SET(cqc, cqc, uar_page, mdev->priv.uar->index); +@@ -1908,6 +1913,10 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix, + int err; + int eqn; + ++ err = mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq); ++ if (err) ++ return err; ++ + c = kvzalloc_node(sizeof(*c), GFP_KERNEL, cpu_to_node(cpu)); + if (!c) + return -ENOMEM; +@@ -1924,7 +1933,6 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix, + c->xdp = !!params->xdp_prog; + c->stats = &priv->channel_stats[ix].ch; + +- mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq); + c->irq_desc = irq_to_desc(irq); + + netif_napi_add(netdev, &c->napi, mlx5e_napi_poll, 64); +@@ -3566,6 +3574,7 @@ static int set_feature_cvlan_filter(struct net_device *netdev, bool enable) + return 0; + } + ++#ifdef CONFIG_MLX5_ESWITCH + static int set_feature_tc_num_filters(struct net_device *netdev, bool enable) + { + struct mlx5e_priv *priv = netdev_priv(netdev); +@@ -3578,6 +3587,7 @@ static int set_feature_tc_num_filters(struct net_device *netdev, bool enable) + + return 0; + } ++#endif + + static int set_feature_rx_all(struct net_device *netdev, bool enable) + { +@@ -3676,7 +3686,9 @@ static int mlx5e_set_features(struct net_device *netdev, + err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro); + err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER, + set_feature_cvlan_filter); ++#ifdef CONFIG_MLX5_ESWITCH + err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_TC, set_feature_tc_num_filters); ++#endif + err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXALL, set_feature_rx_all); + err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXFCS, set_feature_rx_fcs); + err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_RX, set_feature_rx_vlan); +@@ -3747,10 +3759,11 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu, + } + + if (params->rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ) { ++ bool is_linear = mlx5e_rx_mpwqe_is_linear_skb(priv->mdev, &new_channels.params); + u8 ppw_old = mlx5e_mpwqe_log_pkts_per_wqe(params); + u8 ppw_new = mlx5e_mpwqe_log_pkts_per_wqe(&new_channels.params); + +- reset = reset && (ppw_old != ppw_new); ++ reset = reset && (is_linear || (ppw_old != ppw_new)); + } + + if (!reset) { +@@ -4685,7 +4698,9 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) + FT_CAP(modify_root) && + FT_CAP(identified_miss_table_mode) && + FT_CAP(flow_table_modify)) { ++#ifdef CONFIG_MLX5_ESWITCH + netdev->hw_features |= NETIF_F_HW_TC; ++#endif + #ifdef CONFIG_MLX5_EN_ARFS + netdev->hw_features |= NETIF_F_NTUPLE; + #endif +@@ -4958,11 +4973,21 @@ int mlx5e_attach_netdev(struct mlx5e_priv *priv) + { + struct mlx5_core_dev *mdev = priv->mdev; + const struct mlx5e_profile *profile; ++ int max_nch; + int err; + + profile = priv->profile; + clear_bit(MLX5E_STATE_DESTROYING, &priv->state); + ++ /* max number of channels may have changed */ ++ max_nch = mlx5e_get_max_num_channels(priv->mdev); ++ if (priv->channels.params.num_channels > max_nch) { ++ mlx5_core_warn(priv->mdev, "MLX5E: Reducing number of channels to %d\n", max_nch); ++ priv->channels.params.num_channels = max_nch; ++ mlx5e_build_default_indir_rqt(priv->channels.params.indirection_rqt, ++ MLX5E_INDIR_RQT_SIZE, max_nch); ++ } ++ + err = profile->init_tx(priv); + if (err) + goto out; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +index a144146b769c..d543a5cff049 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -1064,6 +1064,12 @@ mlx5e_skb_from_cqe_mpwrq_linear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi, + u32 frag_size; + bool consumed; + ++ /* Check packet size. Note LRO doesn't use linear SKB */ ++ if (unlikely(cqe_bcnt > rq->hw_mtu)) { ++ rq->stats->oversize_pkts_sw_drop++; ++ return NULL; ++ } ++ + va = page_address(di->page) + head_offset; + data = va + rx_headroom; + frag_size = MLX5_SKB_FRAG_SZ(rx_headroom + cqe_bcnt32); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c +index 35ded91203f5..4382ef85488c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c +@@ -98,18 +98,17 @@ static int mlx5e_test_link_speed(struct mlx5e_priv *priv) + return 1; + } + +-#ifdef CONFIG_INET +-/* loopback test */ +-#define MLX5E_TEST_PKT_SIZE (MLX5E_RX_MAX_HEAD - NET_IP_ALIGN) +-static const char mlx5e_test_text[ETH_GSTRING_LEN] = "MLX5E SELF TEST"; +-#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL +- + struct mlx5ehdr { + __be32 version; + __be64 magic; +- char text[ETH_GSTRING_LEN]; + }; + ++#ifdef CONFIG_INET ++/* loopback test */ ++#define MLX5E_TEST_PKT_SIZE (sizeof(struct ethhdr) + sizeof(struct iphdr) +\ ++ sizeof(struct udphdr) + sizeof(struct mlx5ehdr)) ++#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL ++ + static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv) + { + struct sk_buff *skb = NULL; +@@ -117,10 +116,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv) + struct ethhdr *ethh; + struct udphdr *udph; + struct iphdr *iph; +- int datalen, iplen; +- +- datalen = MLX5E_TEST_PKT_SIZE - +- (sizeof(*ethh) + sizeof(*iph) + sizeof(*udph)); ++ int iplen; + + skb = netdev_alloc_skb(priv->netdev, MLX5E_TEST_PKT_SIZE); + if (!skb) { +@@ -149,7 +145,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv) + /* Fill UDP header */ + udph->source = htons(9); + udph->dest = htons(9); /* Discard Protocol */ +- udph->len = htons(datalen + sizeof(struct udphdr)); ++ udph->len = htons(sizeof(struct mlx5ehdr) + sizeof(struct udphdr)); + udph->check = 0; + + /* Fill IP header */ +@@ -157,7 +153,8 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv) + iph->ttl = 32; + iph->version = 4; + iph->protocol = IPPROTO_UDP; +- iplen = sizeof(struct iphdr) + sizeof(struct udphdr) + datalen; ++ iplen = sizeof(struct iphdr) + sizeof(struct udphdr) + ++ sizeof(struct mlx5ehdr); + iph->tot_len = htons(iplen); + iph->frag_off = 0; + iph->saddr = 0; +@@ -170,9 +167,6 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv) + mlxh = skb_put(skb, sizeof(*mlxh)); + mlxh->version = 0; + mlxh->magic = cpu_to_be64(MLX5E_TEST_MAGIC); +- strlcpy(mlxh->text, mlx5e_test_text, sizeof(mlxh->text)); +- datalen -= sizeof(*mlxh); +- skb_put_zero(skb, datalen); + + skb->csum = 0; + skb->ip_summed = CHECKSUM_PARTIAL; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +index 6839481f7697..d57d51c4e658 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +@@ -82,6 +82,7 @@ static const struct counter_desc sw_stats_desc[] = { + { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) }, + { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_cqes) }, + { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_strides) }, ++ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_oversize_pkts_sw_drop) }, + { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_buff_alloc_err) }, + { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_blks) }, + { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_pkts) }, +@@ -158,6 +159,7 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv) + s->rx_wqe_err += rq_stats->wqe_err; + s->rx_mpwqe_filler_cqes += rq_stats->mpwqe_filler_cqes; + s->rx_mpwqe_filler_strides += rq_stats->mpwqe_filler_strides; ++ s->rx_oversize_pkts_sw_drop += rq_stats->oversize_pkts_sw_drop; + s->rx_buff_alloc_err += rq_stats->buff_alloc_err; + s->rx_cqe_compress_blks += rq_stats->cqe_compress_blks; + s->rx_cqe_compress_pkts += rq_stats->cqe_compress_pkts; +@@ -1148,6 +1150,7 @@ static const struct counter_desc rq_stats_desc[] = { + { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, wqe_err) }, + { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_cqes) }, + { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_strides) }, ++ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, oversize_pkts_sw_drop) }, + { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, buff_alloc_err) }, + { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_blks) }, + { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) }, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h +index a4c035aedd46..c1064af9d54c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h +@@ -95,6 +95,7 @@ struct mlx5e_sw_stats { + u64 rx_wqe_err; + u64 rx_mpwqe_filler_cqes; + u64 rx_mpwqe_filler_strides; ++ u64 rx_oversize_pkts_sw_drop; + u64 rx_buff_alloc_err; + u64 rx_cqe_compress_blks; + u64 rx_cqe_compress_pkts; +@@ -190,6 +191,7 @@ struct mlx5e_rq_stats { + u64 wqe_err; + u64 mpwqe_filler_cqes; + u64 mpwqe_filler_strides; ++ u64 oversize_pkts_sw_drop; + u64 buff_alloc_err; + u64 cqe_compress_blks; + u64 cqe_compress_pkts; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 85796727093e..3092c59c0dc7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -1310,31 +1310,21 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, + inner_headers); + } + +- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) { +- struct flow_dissector_key_eth_addrs *key = ++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) { ++ struct flow_dissector_key_basic *key = + skb_flow_dissector_target(f->dissector, +- FLOW_DISSECTOR_KEY_ETH_ADDRS, ++ FLOW_DISSECTOR_KEY_BASIC, + f->key); +- struct flow_dissector_key_eth_addrs *mask = ++ struct flow_dissector_key_basic *mask = + skb_flow_dissector_target(f->dissector, +- FLOW_DISSECTOR_KEY_ETH_ADDRS, ++ FLOW_DISSECTOR_KEY_BASIC, + f->mask); ++ MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype, ++ ntohs(mask->n_proto)); ++ MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype, ++ ntohs(key->n_proto)); + +- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c, +- dmac_47_16), +- mask->dst); +- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, +- dmac_47_16), +- key->dst); +- +- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c, +- smac_47_16), +- mask->src); +- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, +- smac_47_16), +- key->src); +- +- if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst)) ++ if (mask->n_proto) + *match_level = MLX5_MATCH_L2; + } + +@@ -1368,9 +1358,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, + + *match_level = MLX5_MATCH_L2; + } +- } else { ++ } else if (*match_level != MLX5_MATCH_NONE) { + MLX5_SET(fte_match_set_lyr_2_4, headers_c, svlan_tag, 1); + MLX5_SET(fte_match_set_lyr_2_4, headers_c, cvlan_tag, 1); ++ *match_level = MLX5_MATCH_L2; + } + + if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CVLAN)) { +@@ -1408,21 +1399,31 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, + } + } + +- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) { +- struct flow_dissector_key_basic *key = ++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) { ++ struct flow_dissector_key_eth_addrs *key = + skb_flow_dissector_target(f->dissector, +- FLOW_DISSECTOR_KEY_BASIC, ++ FLOW_DISSECTOR_KEY_ETH_ADDRS, + f->key); +- struct flow_dissector_key_basic *mask = ++ struct flow_dissector_key_eth_addrs *mask = + skb_flow_dissector_target(f->dissector, +- FLOW_DISSECTOR_KEY_BASIC, ++ FLOW_DISSECTOR_KEY_ETH_ADDRS, + f->mask); +- MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype, +- ntohs(mask->n_proto)); +- MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype, +- ntohs(key->n_proto)); + +- if (mask->n_proto) ++ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c, ++ dmac_47_16), ++ mask->dst); ++ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, ++ dmac_47_16), ++ key->dst); ++ ++ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c, ++ smac_47_16), ++ mask->src); ++ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, ++ smac_47_16), ++ key->src); ++ ++ if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst)) + *match_level = MLX5_MATCH_L2; + } + +@@ -1449,10 +1450,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, + + /* the HW doesn't need L3 inline to match on frag=no */ + if (!(key->flags & FLOW_DIS_IS_FRAGMENT)) +- *match_level = MLX5_INLINE_MODE_L2; ++ *match_level = MLX5_MATCH_L2; + /* *** L2 attributes parsing up to here *** */ + else +- *match_level = MLX5_INLINE_MODE_IP; ++ *match_level = MLX5_MATCH_L3; + } + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +index b8ee9101c506..b5a8769a5bfd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +@@ -83,8 +83,14 @@ struct mlx5_fpga_ipsec_rule { + }; + + static const struct rhashtable_params rhash_sa = { +- .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa), +- .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa), ++ /* Keep out "cmd" field from the key as it's ++ * value is not constant during the lifetime ++ * of the key object. ++ */ ++ .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) - ++ FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd), ++ .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) + ++ FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd), + .head_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hash), + .automatic_shrinking = true, + .min_size = 1, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +index e3797a44e074..5b7fe8264144 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +@@ -502,9 +502,9 @@ static int mlx5i_close(struct net_device *netdev) + + netif_carrier_off(epriv->netdev); + mlx5_fs_remove_rx_underlay_qpn(mdev, ipriv->qp.qpn); +- mlx5i_uninit_underlay_qp(epriv); + mlx5e_deactivate_priv_channels(epriv); + mlx5e_close_channels(&epriv->channels); ++ mlx5i_uninit_underlay_qp(epriv); + unlock: + mutex_unlock(&epriv->state_lock); + return 0; +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index 30bb2c533cec..ada644d90029 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -3519,7 +3519,6 @@ static int mlxsw_sp_cpu_policers_set(struct mlxsw_core *mlxsw_core) + burst_size = 7; + break; + case MLXSW_REG_HTGT_TRAP_GROUP_SP_IP2ME: +- is_bytes = true; + rate = 4 * 1024; + burst_size = 4; + break; +diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c +index 0afc3d335d56..d11c16aeb19a 100644 +--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c ++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c +@@ -234,7 +234,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev, + struct net_device *real_dev, + struct rmnet_endpoint *ep) + { +- struct rmnet_priv *priv; ++ struct rmnet_priv *priv = netdev_priv(rmnet_dev); + int rc; + + if (ep->egress_dev) +@@ -247,6 +247,8 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev, + rmnet_dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; + rmnet_dev->hw_features |= NETIF_F_SG; + ++ priv->real_dev = real_dev; ++ + rc = register_netdevice(rmnet_dev); + if (!rc) { + ep->egress_dev = rmnet_dev; +@@ -255,9 +257,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev, + + rmnet_dev->rtnl_link_ops = &rmnet_link_ops; + +- priv = netdev_priv(rmnet_dev); + priv->mux_id = id; +- priv->real_dev = real_dev; + + netdev_dbg(rmnet_dev, "rmnet dev created\n"); + } +diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c +index 33265747bf39..0fbcedcdf6e2 100644 +--- a/drivers/net/phy/mdio-gpio.c ++++ b/drivers/net/phy/mdio-gpio.c +@@ -63,7 +63,7 @@ static void mdio_dir(struct mdiobb_ctrl *ctrl, int dir) + * assume the pin serves as pull-up. If direction is + * output, the default value is high. + */ +- gpiod_set_value(bitbang->mdo, 1); ++ gpiod_set_value_cansleep(bitbang->mdo, 1); + return; + } + +@@ -78,7 +78,7 @@ static int mdio_get(struct mdiobb_ctrl *ctrl) + struct mdio_gpio_info *bitbang = + container_of(ctrl, struct mdio_gpio_info, ctrl); + +- return gpiod_get_value(bitbang->mdio); ++ return gpiod_get_value_cansleep(bitbang->mdio); + } + + static void mdio_set(struct mdiobb_ctrl *ctrl, int what) +@@ -87,9 +87,9 @@ static void mdio_set(struct mdiobb_ctrl *ctrl, int what) + container_of(ctrl, struct mdio_gpio_info, ctrl); + + if (bitbang->mdo) +- gpiod_set_value(bitbang->mdo, what); ++ gpiod_set_value_cansleep(bitbang->mdo, what); + else +- gpiod_set_value(bitbang->mdio, what); ++ gpiod_set_value_cansleep(bitbang->mdio, what); + } + + static void mdc_set(struct mdiobb_ctrl *ctrl, int what) +@@ -97,7 +97,7 @@ static void mdc_set(struct mdiobb_ctrl *ctrl, int what) + struct mdio_gpio_info *bitbang = + container_of(ctrl, struct mdio_gpio_info, ctrl); + +- gpiod_set_value(bitbang->mdc, what); ++ gpiod_set_value_cansleep(bitbang->mdc, what); + } + + static const struct mdiobb_ops mdio_gpio_ops = { +diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c +index 7fc8508b5231..271e8adc39f1 100644 +--- a/drivers/net/phy/realtek.c ++++ b/drivers/net/phy/realtek.c +@@ -220,7 +220,7 @@ static struct phy_driver realtek_drvs[] = { + .flags = PHY_HAS_INTERRUPT, + }, { + .phy_id = 0x001cc816, +- .name = "RTL8201F 10/100Mbps Ethernet", ++ .name = "RTL8201F Fast Ethernet", + .phy_id_mask = 0x001fffff, + .features = PHY_BASIC_FEATURES, + .flags = PHY_HAS_INTERRUPT, +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index c52207beef88..573620771154 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1527,6 +1527,7 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile, + + if (!rx_batched || (!more && skb_queue_empty(queue))) { + local_bh_disable(); ++ skb_record_rx_queue(skb, tfile->queue_index); + netif_receive_skb(skb); + local_bh_enable(); + return; +@@ -1546,8 +1547,11 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile, + struct sk_buff *nskb; + + local_bh_disable(); +- while ((nskb = __skb_dequeue(&process_queue))) ++ while ((nskb = __skb_dequeue(&process_queue))) { ++ skb_record_rx_queue(nskb, tfile->queue_index); + netif_receive_skb(nskb); ++ } ++ skb_record_rx_queue(skb, tfile->queue_index); + netif_receive_skb(skb); + local_bh_enable(); + } +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 262e7a3c23cb..f2d01cb6f958 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1321,6 +1321,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + dev->net->ethtool_ops = &smsc95xx_ethtool_ops; + dev->net->flags |= IFF_MULTICAST; + dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM; ++ dev->net->min_mtu = ETH_MIN_MTU; ++ dev->net->max_mtu = ETH_DATA_LEN; + dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; + + pdata->dev = dev; +@@ -1598,6 +1600,8 @@ static int smsc95xx_suspend(struct usb_interface *intf, pm_message_t message) + return ret; + } + ++ cancel_delayed_work_sync(&pdata->carrier_check); ++ + if (pdata->suspend_flags) { + netdev_warn(dev->net, "error during last resume\n"); + pdata->suspend_flags = 0; +@@ -1840,6 +1844,11 @@ done: + */ + if (ret && PMSG_IS_AUTO(message)) + usbnet_resume(intf); ++ ++ if (ret) ++ schedule_delayed_work(&pdata->carrier_check, ++ CARRIER_CHECK_DELAY); ++ + return ret; + } + +diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h +index 8c2caa370e0f..ab9242e51d9e 100644 +--- a/include/net/sctp/sctp.h ++++ b/include/net/sctp/sctp.h +@@ -608,4 +608,16 @@ static inline __u32 sctp_dst_mtu(const struct dst_entry *dst) + SCTP_DEFAULT_MINSEGMENT)); + } + ++static inline bool sctp_transport_pmtu_check(struct sctp_transport *t) ++{ ++ __u32 pmtu = sctp_dst_mtu(t->dst); ++ ++ if (t->pathmtu == pmtu) ++ return true; ++ ++ t->pathmtu = pmtu; ++ ++ return false; ++} ++ + #endif /* __net_sctp_h__ */ +diff --git a/include/uapi/linux/sctp.h b/include/uapi/linux/sctp.h +index 34dd3d497f2c..c81feb373d3e 100644 +--- a/include/uapi/linux/sctp.h ++++ b/include/uapi/linux/sctp.h +@@ -568,6 +568,8 @@ struct sctp_assoc_reset_event { + + #define SCTP_ASSOC_CHANGE_DENIED 0x0004 + #define SCTP_ASSOC_CHANGE_FAILED 0x0008 ++#define SCTP_STREAM_CHANGE_DENIED SCTP_ASSOC_CHANGE_DENIED ++#define SCTP_STREAM_CHANGE_FAILED SCTP_ASSOC_CHANGE_FAILED + struct sctp_stream_change_event { + __u16 strchange_type; + __u16 strchange_flags; +@@ -1151,6 +1153,7 @@ struct sctp_add_streams { + /* SCTP Stream schedulers */ + enum sctp_sched_type { + SCTP_SS_FCFS, ++ SCTP_SS_DEFAULT = SCTP_SS_FCFS, + SCTP_SS_PRIO, + SCTP_SS_RR, + SCTP_SS_MAX = SCTP_SS_RR +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 3adecda21444..0097acec1c71 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -2026,12 +2026,6 @@ static void cpuhp_online_cpu_device(unsigned int cpu) + kobject_uevent(&dev->kobj, KOBJ_ONLINE); + } + +-/* +- * Architectures that need SMT-specific errata handling during SMT hotplug +- * should override this. +- */ +-void __weak arch_smt_update(void) { }; +- + static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval) + { + int cpu, ret = 0; +@@ -2058,10 +2052,8 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval) + */ + cpuhp_offline_cpu_device(cpu); + } +- if (!ret) { ++ if (!ret) + cpu_smt_control = ctrlval; +- arch_smt_update(); +- } + cpu_maps_update_done(); + return ret; + } +@@ -2072,7 +2064,6 @@ static int cpuhp_smt_enable(void) + + cpu_maps_update_begin(); + cpu_smt_control = CPU_SMT_ENABLED; +- arch_smt_update(); + for_each_present_cpu(cpu) { + /* Skip online CPUs and CPUs on offline nodes */ + if (cpu_online(cpu) || !node_online(cpu_to_node(cpu))) +diff --git a/net/core/dev.c b/net/core/dev.c +index e16ba3625400..097c02101450 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5630,6 +5630,10 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb) + skb->vlan_tci = 0; + skb->dev = napi->dev; + skb->skb_iif = 0; ++ ++ /* eth_type_trans() assumes pkt_type is PACKET_HOST */ ++ skb->pkt_type = PACKET_HOST; ++ + skb->encapsulation = 0; + skb_shinfo(skb)->gso_type = 0; + skb->truesize = SKB_TRUESIZE(skb_end_offset(skb)); +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index ce9eeeb7c024..415b95f76b66 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -1026,8 +1026,8 @@ ip_proto_again: + break; + } + +- if (dissector_uses_key(flow_dissector, +- FLOW_DISSECTOR_KEY_PORTS)) { ++ if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS) && ++ !(key_control->flags & FLOW_DIS_IS_FRAGMENT)) { + key_ports = skb_flow_dissector_target(flow_dissector, + FLOW_DISSECTOR_KEY_PORTS, + target_container); +diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c +index bcb11f3a27c0..760a9e52e02b 100644 +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -178,21 +178,22 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, + } + + static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, +- void *arg) ++ void *arg, ++ struct inet_frag_queue **prev) + { + struct inet_frags *f = nf->f; + struct inet_frag_queue *q; +- int err; + + q = inet_frag_alloc(nf, f, arg); +- if (!q) ++ if (!q) { ++ *prev = ERR_PTR(-ENOMEM); + return NULL; +- ++ } + mod_timer(&q->timer, jiffies + nf->timeout); + +- err = rhashtable_insert_fast(&nf->rhashtable, &q->node, +- f->rhash_params); +- if (err < 0) { ++ *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key, ++ &q->node, f->rhash_params); ++ if (*prev) { + q->flags |= INET_FRAG_COMPLETE; + inet_frag_kill(q); + inet_frag_destroy(q); +@@ -204,22 +205,22 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, + /* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */ + struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key) + { +- struct inet_frag_queue *fq; ++ struct inet_frag_queue *fq = NULL, *prev; + + if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) + return NULL; + + rcu_read_lock(); + +- fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params); +- if (fq) { ++ prev = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params); ++ if (!prev) ++ fq = inet_frag_create(nf, key, &prev); ++ if (prev && !IS_ERR(prev)) { ++ fq = prev; + if (!refcount_inc_not_zero(&fq->refcnt)) + fq = NULL; +- rcu_read_unlock(); +- return fq; + } + rcu_read_unlock(); +- +- return inet_frag_create(nf, key); ++ return fq; + } + EXPORT_SYMBOL(inet_frag_find); +diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c +index dde671e97829..c248e0dccbe1 100644 +--- a/net/ipv4/ip_tunnel_core.c ++++ b/net/ipv4/ip_tunnel_core.c +@@ -80,7 +80,7 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb, + + iph->version = 4; + iph->ihl = sizeof(struct iphdr) >> 2; +- iph->frag_off = df; ++ iph->frag_off = ip_mtu_locked(&rt->dst) ? 0 : df; + iph->protocol = proto; + iph->tos = tos; + iph->daddr = dst; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 47e08c1b5bc3..72898cbef43d 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4371,6 +4371,7 @@ static bool tcp_try_coalesce(struct sock *sk, + if (TCP_SKB_CB(from)->has_rxtstamp) { + TCP_SKB_CB(to)->has_rxtstamp = true; + to->tstamp = from->tstamp; ++ skb_hwtstamps(to)->hwtstamp = skb_hwtstamps(from)->hwtstamp; + } + + return true; +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 1cf00d857fc1..a33681dc4796 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -2263,8 +2263,7 @@ static void ip6_link_failure(struct sk_buff *skb) + if (rt) { + rcu_read_lock(); + if (rt->rt6i_flags & RTF_CACHE) { +- if (dst_hold_safe(&rt->dst)) +- rt6_remove_exception_rt(rt); ++ rt6_remove_exception_rt(rt); + } else { + struct fib6_info *from; + struct fib6_node *fn; +@@ -2392,10 +2391,13 @@ EXPORT_SYMBOL_GPL(ip6_update_pmtu); + + void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu) + { ++ int oif = sk->sk_bound_dev_if; + struct dst_entry *dst; + +- ip6_update_pmtu(skb, sock_net(sk), mtu, +- sk->sk_bound_dev_if, sk->sk_mark, sk->sk_uid); ++ if (!oif && skb->dev) ++ oif = l3mdev_master_ifindex(skb->dev); ++ ++ ip6_update_pmtu(skb, sock_net(sk), mtu, oif, sk->sk_mark, sk->sk_uid); + + dst = __sk_dst_get(sk); + if (!dst || !dst->obsolete || +@@ -3266,8 +3268,8 @@ static int ip6_del_cached_rt(struct rt6_info *rt, struct fib6_config *cfg) + if (cfg->fc_flags & RTF_GATEWAY && + !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway)) + goto out; +- if (dst_hold_safe(&rt->dst)) +- rc = rt6_remove_exception_rt(rt); ++ ++ rc = rt6_remove_exception_rt(rt); + out: + return rc; + } +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 82cdf9020b53..26f1d435696a 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1490,12 +1490,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + goto err_sock; + } + +- sk = sock->sk; +- +- sock_hold(sk); +- tunnel->sock = sk; + tunnel->l2tp_net = net; +- + pn = l2tp_pernet(net); + + spin_lock_bh(&pn->l2tp_tunnel_list_lock); +@@ -1510,6 +1505,10 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); + spin_unlock_bh(&pn->l2tp_tunnel_list_lock); + ++ sk = sock->sk; ++ sock_hold(sk); ++ tunnel->sock = sk; ++ + if (tunnel->encap == L2TP_ENCAPTYPE_UDP) { + struct udp_tunnel_sock_cfg udp_cfg = { + .sk_user_data = tunnel, +diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h +index a6e6cae82c30..03e0fc8c183f 100644 +--- a/net/rxrpc/ar-internal.h ++++ b/net/rxrpc/ar-internal.h +@@ -611,6 +611,7 @@ struct rxrpc_call { + * not hard-ACK'd packet follows this. + */ + rxrpc_seq_t tx_top; /* Highest Tx slot allocated. */ ++ u16 tx_backoff; /* Delay to insert due to Tx failure */ + + /* TCP-style slow-start congestion control [RFC5681]. Since the SMSS + * is fixed, we keep these numbers in terms of segments (ie. DATA +diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c +index 8e7434e92097..468efc3660c0 100644 +--- a/net/rxrpc/call_event.c ++++ b/net/rxrpc/call_event.c +@@ -123,6 +123,7 @@ static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason, + else + ack_at = expiry; + ++ ack_at += READ_ONCE(call->tx_backoff); + ack_at += now; + if (time_before(ack_at, call->ack_at)) { + WRITE_ONCE(call->ack_at, ack_at); +@@ -311,6 +312,7 @@ void rxrpc_process_call(struct work_struct *work) + container_of(work, struct rxrpc_call, processor); + rxrpc_serial_t *send_ack; + unsigned long now, next, t; ++ unsigned int iterations = 0; + + rxrpc_see_call(call); + +@@ -319,6 +321,11 @@ void rxrpc_process_call(struct work_struct *work) + call->debug_id, rxrpc_call_states[call->state], call->events); + + recheck_state: ++ /* Limit the number of times we do this before returning to the manager */ ++ iterations++; ++ if (iterations > 5) ++ goto requeue; ++ + if (test_and_clear_bit(RXRPC_CALL_EV_ABORT, &call->events)) { + rxrpc_send_abort_packet(call); + goto recheck_state; +@@ -447,13 +454,16 @@ recheck_state: + rxrpc_reduce_call_timer(call, next, now, rxrpc_timer_restart); + + /* other events may have been raised since we started checking */ +- if (call->events && call->state < RXRPC_CALL_COMPLETE) { +- __rxrpc_queue_call(call); +- goto out; +- } ++ if (call->events && call->state < RXRPC_CALL_COMPLETE) ++ goto requeue; + + out_put: + rxrpc_put_call(call, rxrpc_call_put); + out: + _leave(""); ++ return; ++ ++requeue: ++ __rxrpc_queue_call(call); ++ goto out; + } +diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c +index a141ee3ab812..345dc1c5fe72 100644 +--- a/net/rxrpc/output.c ++++ b/net/rxrpc/output.c +@@ -34,6 +34,21 @@ struct rxrpc_abort_buffer { + + static const char rxrpc_keepalive_string[] = ""; + ++/* ++ * Increase Tx backoff on transmission failure and clear it on success. ++ */ ++static void rxrpc_tx_backoff(struct rxrpc_call *call, int ret) ++{ ++ if (ret < 0) { ++ u16 tx_backoff = READ_ONCE(call->tx_backoff); ++ ++ if (tx_backoff < HZ) ++ WRITE_ONCE(call->tx_backoff, tx_backoff + 1); ++ } else { ++ WRITE_ONCE(call->tx_backoff, 0); ++ } ++} ++ + /* + * Arrange for a keepalive ping a certain time after we last transmitted. This + * lets the far side know we're still interested in this call and helps keep +@@ -210,6 +225,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping, + else + trace_rxrpc_tx_packet(call->debug_id, &pkt->whdr, + rxrpc_tx_point_call_ack); ++ rxrpc_tx_backoff(call, ret); + + if (call->state < RXRPC_CALL_COMPLETE) { + if (ret < 0) { +@@ -218,7 +234,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping, + rxrpc_propose_ACK(call, pkt->ack.reason, + ntohs(pkt->ack.maxSkew), + ntohl(pkt->ack.serial), +- true, true, ++ false, true, + rxrpc_propose_ack_retry_tx); + } else { + spin_lock_bh(&call->lock); +@@ -300,7 +316,7 @@ int rxrpc_send_abort_packet(struct rxrpc_call *call) + else + trace_rxrpc_tx_packet(call->debug_id, &pkt.whdr, + rxrpc_tx_point_call_abort); +- ++ rxrpc_tx_backoff(call, ret); + + rxrpc_put_connection(conn); + return ret; +@@ -411,6 +427,7 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb, + else + trace_rxrpc_tx_packet(call->debug_id, &whdr, + rxrpc_tx_point_call_data_nofrag); ++ rxrpc_tx_backoff(call, ret); + if (ret == -EMSGSIZE) + goto send_fragmentable; + +@@ -445,9 +462,18 @@ done: + rxrpc_reduce_call_timer(call, expect_rx_by, nowj, + rxrpc_timer_set_for_normal); + } +- } + +- rxrpc_set_keepalive(call); ++ rxrpc_set_keepalive(call); ++ } else { ++ /* Cancel the call if the initial transmission fails, ++ * particularly if that's due to network routing issues that ++ * aren't going away anytime soon. The layer above can arrange ++ * the retransmission. ++ */ ++ if (!test_and_set_bit(RXRPC_CALL_BEGAN_RX_TIMER, &call->flags)) ++ rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR, ++ RX_USER_ABORT, ret); ++ } + + _leave(" = %d [%u]", ret, call->peer->maxdata); + return ret; +@@ -506,6 +532,7 @@ send_fragmentable: + else + trace_rxrpc_tx_packet(call->debug_id, &whdr, + rxrpc_tx_point_call_data_frag); ++ rxrpc_tx_backoff(call, ret); + + up_write(&conn->params.local->defrag_sem); + goto done; +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index ad99a99f11f6..ca535a8585bc 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -201,7 +201,8 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, + goto out_release; + } + } else { +- return err; ++ ret = err; ++ goto out_free; + } + + p = to_pedit(*a); +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 6fd9bdd93796..7fade7107f95 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -709,11 +709,23 @@ static int fl_set_enc_opt(struct nlattr **tb, struct fl_flow_key *key, + struct netlink_ext_ack *extack) + { + const struct nlattr *nla_enc_key, *nla_opt_key, *nla_opt_msk = NULL; +- int option_len, key_depth, msk_depth = 0; ++ int err, option_len, key_depth, msk_depth = 0; ++ ++ err = nla_validate_nested(tb[TCA_FLOWER_KEY_ENC_OPTS], ++ TCA_FLOWER_KEY_ENC_OPTS_MAX, ++ enc_opts_policy, extack); ++ if (err) ++ return err; + + nla_enc_key = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS]); + + if (tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]) { ++ err = nla_validate_nested(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK], ++ TCA_FLOWER_KEY_ENC_OPTS_MAX, ++ enc_opts_policy, extack); ++ if (err) ++ return err; ++ + nla_opt_msk = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]); + msk_depth = nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]); + } +diff --git a/net/sctp/output.c b/net/sctp/output.c +index 67939ad99c01..08601223b0bf 100644 +--- a/net/sctp/output.c ++++ b/net/sctp/output.c +@@ -118,6 +118,9 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag, + sctp_transport_route(tp, NULL, sp); + if (asoc->param_flags & SPP_PMTUD_ENABLE) + sctp_assoc_sync_pmtu(asoc); ++ } else if (!sctp_transport_pmtu_check(tp)) { ++ if (asoc->param_flags & SPP_PMTUD_ENABLE) ++ sctp_assoc_sync_pmtu(asoc); + } + + if (asoc->pmtu_pending) { +diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c +index 42191ed9902b..7bb8e5603298 100644 +--- a/net/sctp/outqueue.c ++++ b/net/sctp/outqueue.c +@@ -212,7 +212,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q) + INIT_LIST_HEAD(&q->retransmit); + INIT_LIST_HEAD(&q->sacked); + INIT_LIST_HEAD(&q->abandoned); +- sctp_sched_set_sched(asoc, SCTP_SS_FCFS); ++ sctp_sched_set_sched(asoc, SCTP_SS_DEFAULT); + } + + /* Free the outqueue structure and any related pending chunks. +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index c1693e28aed4..876393cf5ed6 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -3958,32 +3958,16 @@ static int sctp_setsockopt_pr_supported(struct sock *sk, + unsigned int optlen) + { + struct sctp_assoc_value params; +- struct sctp_association *asoc; +- int retval = -EINVAL; + + if (optlen != sizeof(params)) +- goto out; +- +- if (copy_from_user(¶ms, optval, optlen)) { +- retval = -EFAULT; +- goto out; +- } +- +- asoc = sctp_id2assoc(sk, params.assoc_id); +- if (asoc) { +- asoc->prsctp_enable = !!params.assoc_value; +- } else if (!params.assoc_id) { +- struct sctp_sock *sp = sctp_sk(sk); ++ return -EINVAL; + +- sp->ep->prsctp_enable = !!params.assoc_value; +- } else { +- goto out; +- } ++ if (copy_from_user(¶ms, optval, optlen)) ++ return -EFAULT; + +- retval = 0; ++ sctp_sk(sk)->ep->prsctp_enable = !!params.assoc_value; + +-out: +- return retval; ++ return 0; + } + + static int sctp_setsockopt_default_prinfo(struct sock *sk, +diff --git a/net/sctp/stream.c b/net/sctp/stream.c +index ffb940d3b57c..3892e7630f3a 100644 +--- a/net/sctp/stream.c ++++ b/net/sctp/stream.c +@@ -535,7 +535,6 @@ int sctp_send_add_streams(struct sctp_association *asoc, + goto out; + } + +- stream->incnt = incnt; + stream->outcnt = outcnt; + + asoc->strreset_outstanding = !!out + !!in; +diff --git a/net/tipc/discover.c b/net/tipc/discover.c +index 2830709957bd..c138d68e8a69 100644 +--- a/net/tipc/discover.c ++++ b/net/tipc/discover.c +@@ -166,7 +166,8 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d, + + /* Apply trial address if we just left trial period */ + if (!trial && !self) { +- tipc_net_finalize(net, tn->trial_addr); ++ tipc_sched_net_finalize(net, tn->trial_addr); ++ msg_set_prevnode(buf_msg(d->skb), tn->trial_addr); + msg_set_type(buf_msg(d->skb), DSC_REQ_MSG); + } + +@@ -300,14 +301,12 @@ static void tipc_disc_timeout(struct timer_list *t) + goto exit; + } + +- /* Trial period over ? */ +- if (!time_before(jiffies, tn->addr_trial_end)) { +- /* Did we just leave it ? */ +- if (!tipc_own_addr(net)) +- tipc_net_finalize(net, tn->trial_addr); +- +- msg_set_type(buf_msg(d->skb), DSC_REQ_MSG); +- msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net)); ++ /* Did we just leave trial period ? */ ++ if (!time_before(jiffies, tn->addr_trial_end) && !tipc_own_addr(net)) { ++ mod_timer(&d->timer, jiffies + TIPC_DISC_INIT); ++ spin_unlock_bh(&d->lock); ++ tipc_sched_net_finalize(net, tn->trial_addr); ++ return; + } + + /* Adjust timeout interval according to discovery phase */ +@@ -319,6 +318,8 @@ static void tipc_disc_timeout(struct timer_list *t) + d->timer_intv = TIPC_DISC_SLOW; + else if (!d->num_nodes && d->timer_intv > TIPC_DISC_FAST) + d->timer_intv = TIPC_DISC_FAST; ++ msg_set_type(buf_msg(d->skb), DSC_REQ_MSG); ++ msg_set_prevnode(buf_msg(d->skb), tn->trial_addr); + } + + mod_timer(&d->timer, jiffies + d->timer_intv); +diff --git a/net/tipc/link.c b/net/tipc/link.c +index 201c3b5bc96b..836727e363c4 100644 +--- a/net/tipc/link.c ++++ b/net/tipc/link.c +@@ -1594,14 +1594,17 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, + if (in_range(peers_prio, l->priority + 1, TIPC_MAX_LINK_PRI)) + l->priority = peers_prio; + +- /* ACTIVATE_MSG serves as PEER_RESET if link is already down */ +- if (msg_peer_stopping(hdr)) ++ /* If peer is going down we want full re-establish cycle */ ++ if (msg_peer_stopping(hdr)) { + rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT); +- else if ((mtyp == RESET_MSG) || !link_is_up(l)) ++ break; ++ } ++ /* ACTIVATE_MSG serves as PEER_RESET if link is already down */ ++ if (mtyp == RESET_MSG || !link_is_up(l)) + rc = tipc_link_fsm_evt(l, LINK_PEER_RESET_EVT); + + /* ACTIVATE_MSG takes up link if it was already locally reset */ +- if ((mtyp == ACTIVATE_MSG) && (l->state == LINK_ESTABLISHING)) ++ if (mtyp == ACTIVATE_MSG && l->state == LINK_ESTABLISHING) + rc = TIPC_LINK_UP_EVT; + + l->peer_session = msg_session(hdr); +diff --git a/net/tipc/net.c b/net/tipc/net.c +index 62199cf5a56c..f076edb74338 100644 +--- a/net/tipc/net.c ++++ b/net/tipc/net.c +@@ -104,6 +104,14 @@ + * - A local spin_lock protecting the queue of subscriber events. + */ + ++struct tipc_net_work { ++ struct work_struct work; ++ struct net *net; ++ u32 addr; ++}; ++ ++static void tipc_net_finalize(struct net *net, u32 addr); ++ + int tipc_net_init(struct net *net, u8 *node_id, u32 addr) + { + if (tipc_own_id(net)) { +@@ -119,17 +127,38 @@ int tipc_net_init(struct net *net, u8 *node_id, u32 addr) + return 0; + } + +-void tipc_net_finalize(struct net *net, u32 addr) ++static void tipc_net_finalize(struct net *net, u32 addr) + { + struct tipc_net *tn = tipc_net(net); + +- if (!cmpxchg(&tn->node_addr, 0, addr)) { +- tipc_set_node_addr(net, addr); +- tipc_named_reinit(net); +- tipc_sk_reinit(net); +- tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr, +- TIPC_CLUSTER_SCOPE, 0, addr); +- } ++ if (cmpxchg(&tn->node_addr, 0, addr)) ++ return; ++ tipc_set_node_addr(net, addr); ++ tipc_named_reinit(net); ++ tipc_sk_reinit(net); ++ tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr, ++ TIPC_CLUSTER_SCOPE, 0, addr); ++} ++ ++static void tipc_net_finalize_work(struct work_struct *work) ++{ ++ struct tipc_net_work *fwork; ++ ++ fwork = container_of(work, struct tipc_net_work, work); ++ tipc_net_finalize(fwork->net, fwork->addr); ++ kfree(fwork); ++} ++ ++void tipc_sched_net_finalize(struct net *net, u32 addr) ++{ ++ struct tipc_net_work *fwork = kzalloc(sizeof(*fwork), GFP_ATOMIC); ++ ++ if (!fwork) ++ return; ++ INIT_WORK(&fwork->work, tipc_net_finalize_work); ++ fwork->net = net; ++ fwork->addr = addr; ++ schedule_work(&fwork->work); + } + + void tipc_net_stop(struct net *net) +diff --git a/net/tipc/net.h b/net/tipc/net.h +index 09ad02b50bb1..b7f2e364eb99 100644 +--- a/net/tipc/net.h ++++ b/net/tipc/net.h +@@ -42,7 +42,7 @@ + extern const struct nla_policy tipc_nl_net_policy[]; + + int tipc_net_init(struct net *net, u8 *node_id, u32 addr); +-void tipc_net_finalize(struct net *net, u32 addr); ++void tipc_sched_net_finalize(struct net *net, u32 addr); + void tipc_net_stop(struct net *net); + int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb); + int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info); +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index 0bf8ad486c5e..366ce0bf2658 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -1548,16 +1548,17 @@ static void tipc_sk_set_orig_addr(struct msghdr *m, struct sk_buff *skb) + /** + * tipc_sk_anc_data_recv - optionally capture ancillary data for received message + * @m: descriptor for message info +- * @msg: received message header ++ * @skb: received message buffer + * @tsk: TIPC port associated with message + * + * Note: Ancillary data is not captured if not requested by receiver. + * + * Returns 0 if successful, otherwise errno + */ +-static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg, ++static int tipc_sk_anc_data_recv(struct msghdr *m, struct sk_buff *skb, + struct tipc_sock *tsk) + { ++ struct tipc_msg *msg; + u32 anc_data[3]; + u32 err; + u32 dest_type; +@@ -1566,6 +1567,7 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg, + + if (likely(m->msg_controllen == 0)) + return 0; ++ msg = buf_msg(skb); + + /* Optionally capture errored message object(s) */ + err = msg ? msg_errcode(msg) : 0; +@@ -1576,6 +1578,9 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg, + if (res) + return res; + if (anc_data[1]) { ++ if (skb_linearize(skb)) ++ return -ENOMEM; ++ msg = buf_msg(skb); + res = put_cmsg(m, SOL_TIPC, TIPC_RETDATA, anc_data[1], + msg_data(msg)); + if (res) +@@ -1737,9 +1742,10 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, + + /* Collect msg meta data, including error code and rejected data */ + tipc_sk_set_orig_addr(m, skb); +- rc = tipc_sk_anc_data_recv(m, hdr, tsk); ++ rc = tipc_sk_anc_data_recv(m, skb, tsk); + if (unlikely(rc)) + goto exit; ++ hdr = buf_msg(skb); + + /* Capture data if non-error msg, otherwise just set return value */ + if (likely(!err)) { +@@ -1849,9 +1855,10 @@ static int tipc_recvstream(struct socket *sock, struct msghdr *m, + /* Collect msg meta data, incl. error code and rejected data */ + if (!copied) { + tipc_sk_set_orig_addr(m, skb); +- rc = tipc_sk_anc_data_recv(m, hdr, tsk); ++ rc = tipc_sk_anc_data_recv(m, skb, tsk); + if (rc) + break; ++ hdr = buf_msg(skb); + } + + /* Copy data if msg ok, otherwise return error/partial data */