diff --git a/lib/configuration.sh b/lib/configuration.sh index 37a0ffbff..1a5ba6ad5 100644 --- a/lib/configuration.sh +++ b/lib/configuration.sh @@ -10,7 +10,7 @@ # common options # daily beta build contains date in subrevision if [[ $BETA == yes && -z $SUBREVISION ]]; then SUBREVISION="."$(date --date="tomorrow" +"%y%m%d"); fi -REVISION="5.82$SUBREVISION" # all boards have same revision +REVISION="5.83$SUBREVISION" # all boards have same revision ROOTPWD="1234" # Must be changed @first login [[ -z $MAINTAINER ]] && MAINTAINER="Igor Pecovnik" # deb signature [[ -z $MAINTAINERMAIL ]] && MAINTAINERMAIL="igor.pecovnik@****l.com" # deb signature diff --git a/patch/kernel/sunxi-dev/patch-5.0.7-8.patch b/patch/kernel/sunxi-dev/patch-5.0.7-8.patch new file mode 100644 index 000000000..6680fecfb --- /dev/null +++ b/patch/kernel/sunxi-dev/patch-5.0.7-8.patch @@ -0,0 +1,5075 @@ +diff --git a/Makefile b/Makefile +index af99c77c7066..f7666051de66 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 0 +-SUBLEVEL = 7 ++SUBLEVEL = 8 + EXTRAVERSION = + NAME = Shy Crocodile + +@@ -510,7 +510,7 @@ endif + ifneq ($(shell $(CC) --version 2>&1 | head -n 1 | grep clang),) + ifneq ($(CROSS_COMPILE),) + CLANG_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%)) +-GCC_TOOLCHAIN_DIR := $(dir $(shell which $(LD))) ++GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit)) + CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR) + GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..) + endif +diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts +index dce5be5df97b..edcff79879e7 100644 +--- a/arch/arm/boot/dts/am335x-evm.dts ++++ b/arch/arm/boot/dts/am335x-evm.dts +@@ -57,6 +57,24 @@ + enable-active-high; + }; + ++ /* TPS79501 */ ++ v1_8d_reg: fixedregulator-v1_8d { ++ compatible = "regulator-fixed"; ++ regulator-name = "v1_8d"; ++ vin-supply = <&vbat>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ ++ /* TPS79501 */ ++ v3_3d_reg: fixedregulator-v3_3d { ++ compatible = "regulator-fixed"; ++ regulator-name = "v3_3d"; ++ vin-supply = <&vbat>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ + matrix_keypad: matrix_keypad0 { + compatible = "gpio-matrix-keypad"; + debounce-delay-ms = <5>; +@@ -499,10 +517,10 @@ + status = "okay"; + + /* Regulators */ +- AVDD-supply = <&vaux2_reg>; +- IOVDD-supply = <&vaux2_reg>; +- DRVDD-supply = <&vaux2_reg>; +- DVDD-supply = <&vbat>; ++ AVDD-supply = <&v3_3d_reg>; ++ IOVDD-supply = <&v3_3d_reg>; ++ DRVDD-supply = <&v3_3d_reg>; ++ DVDD-supply = <&v1_8d_reg>; + }; + }; + +diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts +index b128998097ce..2c2d8b5b8cf5 100644 +--- a/arch/arm/boot/dts/am335x-evmsk.dts ++++ b/arch/arm/boot/dts/am335x-evmsk.dts +@@ -73,6 +73,24 @@ + enable-active-high; + }; + ++ /* TPS79518 */ ++ v1_8d_reg: fixedregulator-v1_8d { ++ compatible = "regulator-fixed"; ++ regulator-name = "v1_8d"; ++ vin-supply = <&vbat>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ ++ /* TPS78633 */ ++ v3_3d_reg: fixedregulator-v3_3d { ++ compatible = "regulator-fixed"; ++ regulator-name = "v3_3d"; ++ vin-supply = <&vbat>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ + leds { + pinctrl-names = "default"; + pinctrl-0 = <&user_leds_s0>; +@@ -501,10 +519,10 @@ + status = "okay"; + + /* Regulators */ +- AVDD-supply = <&vaux2_reg>; +- IOVDD-supply = <&vaux2_reg>; +- DRVDD-supply = <&vaux2_reg>; +- DVDD-supply = <&vbat>; ++ AVDD-supply = <&v3_3d_reg>; ++ IOVDD-supply = <&v3_3d_reg>; ++ DRVDD-supply = <&v3_3d_reg>; ++ DVDD-supply = <&v1_8d_reg>; + }; + }; + +diff --git a/arch/arm/boot/dts/rk3288-tinker.dtsi b/arch/arm/boot/dts/rk3288-tinker.dtsi +index aa107ee41b8b..ef653c3209bc 100644 +--- a/arch/arm/boot/dts/rk3288-tinker.dtsi ++++ b/arch/arm/boot/dts/rk3288-tinker.dtsi +@@ -254,6 +254,7 @@ + }; + + vccio_sd: LDO_REG5 { ++ regulator-boot-on; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + regulator-name = "vccio_sd"; +@@ -430,7 +431,7 @@ + bus-width = <4>; + cap-mmc-highspeed; + cap-sd-highspeed; +- card-detect-delay = <200>; ++ broken-cd; + disable-wp; /* wp not hooked up */ + pinctrl-names = "default"; + pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>; +diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi +index ca7d52daa8fb..09868dcee34b 100644 +--- a/arch/arm/boot/dts/rk3288.dtsi ++++ b/arch/arm/boot/dts/rk3288.dtsi +@@ -70,7 +70,7 @@ + compatible = "arm,cortex-a12"; + reg = <0x501>; + resets = <&cru SRST_CORE1>; +- operating-points = <&cpu_opp_table>; ++ operating-points-v2 = <&cpu_opp_table>; + #cooling-cells = <2>; /* min followed by max */ + clock-latency = <40000>; + clocks = <&cru ARMCLK>; +@@ -80,7 +80,7 @@ + compatible = "arm,cortex-a12"; + reg = <0x502>; + resets = <&cru SRST_CORE2>; +- operating-points = <&cpu_opp_table>; ++ operating-points-v2 = <&cpu_opp_table>; + #cooling-cells = <2>; /* min followed by max */ + clock-latency = <40000>; + clocks = <&cru ARMCLK>; +@@ -90,7 +90,7 @@ + compatible = "arm,cortex-a12"; + reg = <0x503>; + resets = <&cru SRST_CORE3>; +- operating-points = <&cpu_opp_table>; ++ operating-points-v2 = <&cpu_opp_table>; + #cooling-cells = <2>; /* min followed by max */ + clock-latency = <40000>; + clocks = <&cru ARMCLK>; +diff --git a/arch/arm/boot/dts/sama5d2-pinfunc.h b/arch/arm/boot/dts/sama5d2-pinfunc.h +index 1c01a6f843d8..28a2e45752fe 100644 +--- a/arch/arm/boot/dts/sama5d2-pinfunc.h ++++ b/arch/arm/boot/dts/sama5d2-pinfunc.h +@@ -518,7 +518,7 @@ + #define PIN_PC9__GPIO PINMUX_PIN(PIN_PC9, 0, 0) + #define PIN_PC9__FIQ PINMUX_PIN(PIN_PC9, 1, 3) + #define PIN_PC9__GTSUCOMP PINMUX_PIN(PIN_PC9, 2, 1) +-#define PIN_PC9__ISC_D0 PINMUX_PIN(PIN_PC9, 2, 1) ++#define PIN_PC9__ISC_D0 PINMUX_PIN(PIN_PC9, 3, 1) + #define PIN_PC9__TIOA4 PINMUX_PIN(PIN_PC9, 4, 2) + #define PIN_PC10 74 + #define PIN_PC10__GPIO PINMUX_PIN(PIN_PC10, 0, 0) +diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c +index c4c0a8ea11e4..ee410ae7369e 100644 +--- a/arch/arm/mach-omap1/board-ams-delta.c ++++ b/arch/arm/mach-omap1/board-ams-delta.c +@@ -182,6 +182,7 @@ static struct resource latch1_resources[] = { + + static struct bgpio_pdata latch1_pdata = { + .label = LATCH1_LABEL, ++ .base = -1, + .ngpio = LATCH1_NGPIO, + }; + +@@ -219,6 +220,7 @@ static struct resource latch2_resources[] = { + + static struct bgpio_pdata latch2_pdata = { + .label = LATCH2_LABEL, ++ .base = -1, + .ngpio = LATCH2_NGPIO, + }; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts +index 040b36ef0dd2..520ed8e474be 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts +@@ -46,8 +46,7 @@ + + vcc_host1_5v: vcc_otg_5v: vcc-host1-5v-regulator { + compatible = "regulator-fixed"; +- enable-active-high; +- gpio = <&gpio0 RK_PA2 GPIO_ACTIVE_HIGH>; ++ gpio = <&gpio0 RK_PA2 GPIO_ACTIVE_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&usb20_host_drv>; + regulator-name = "vcc_host1_5v"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index ecd7f19c3542..97aa65455b4a 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -1431,11 +1431,11 @@ + + sdmmc0 { + sdmmc0_clk: sdmmc0-clk { +- rockchip,pins = <1 RK_PA6 1 &pcfg_pull_none_4ma>; ++ rockchip,pins = <1 RK_PA6 1 &pcfg_pull_none_8ma>; + }; + + sdmmc0_cmd: sdmmc0-cmd { +- rockchip,pins = <1 RK_PA4 1 &pcfg_pull_up_4ma>; ++ rockchip,pins = <1 RK_PA4 1 &pcfg_pull_up_8ma>; + }; + + sdmmc0_dectn: sdmmc0-dectn { +@@ -1447,14 +1447,14 @@ + }; + + sdmmc0_bus1: sdmmc0-bus1 { +- rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_4ma>; ++ rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_8ma>; + }; + + sdmmc0_bus4: sdmmc0-bus4 { +- rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_4ma>, +- <1 RK_PA1 1 &pcfg_pull_up_4ma>, +- <1 RK_PA2 1 &pcfg_pull_up_4ma>, +- <1 RK_PA3 1 &pcfg_pull_up_4ma>; ++ rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_8ma>, ++ <1 RK_PA1 1 &pcfg_pull_up_8ma>, ++ <1 RK_PA2 1 &pcfg_pull_up_8ma>, ++ <1 RK_PA3 1 &pcfg_pull_up_8ma>; + }; + + sdmmc0_gpio: sdmmc0-gpio { +@@ -1628,50 +1628,50 @@ + rgmiim1_pins: rgmiim1-pins { + rockchip,pins = + /* mac_txclk */ +- <1 RK_PB4 2 &pcfg_pull_none_12ma>, ++ <1 RK_PB4 2 &pcfg_pull_none_8ma>, + /* mac_rxclk */ +- <1 RK_PB5 2 &pcfg_pull_none_2ma>, ++ <1 RK_PB5 2 &pcfg_pull_none_4ma>, + /* mac_mdio */ +- <1 RK_PC3 2 &pcfg_pull_none_2ma>, ++ <1 RK_PC3 2 &pcfg_pull_none_4ma>, + /* mac_txen */ +- <1 RK_PD1 2 &pcfg_pull_none_12ma>, ++ <1 RK_PD1 2 &pcfg_pull_none_8ma>, + /* mac_clk */ +- <1 RK_PC5 2 &pcfg_pull_none_2ma>, ++ <1 RK_PC5 2 &pcfg_pull_none_4ma>, + /* mac_rxdv */ +- <1 RK_PC6 2 &pcfg_pull_none_2ma>, ++ <1 RK_PC6 2 &pcfg_pull_none_4ma>, + /* mac_mdc */ +- <1 RK_PC7 2 &pcfg_pull_none_2ma>, ++ <1 RK_PC7 2 &pcfg_pull_none_4ma>, + /* mac_rxd1 */ +- <1 RK_PB2 2 &pcfg_pull_none_2ma>, ++ <1 RK_PB2 2 &pcfg_pull_none_4ma>, + /* mac_rxd0 */ +- <1 RK_PB3 2 &pcfg_pull_none_2ma>, ++ <1 RK_PB3 2 &pcfg_pull_none_4ma>, + /* mac_txd1 */ +- <1 RK_PB0 2 &pcfg_pull_none_12ma>, ++ <1 RK_PB0 2 &pcfg_pull_none_8ma>, + /* mac_txd0 */ +- <1 RK_PB1 2 &pcfg_pull_none_12ma>, ++ <1 RK_PB1 2 &pcfg_pull_none_8ma>, + /* mac_rxd3 */ +- <1 RK_PB6 2 &pcfg_pull_none_2ma>, ++ <1 RK_PB6 2 &pcfg_pull_none_4ma>, + /* mac_rxd2 */ +- <1 RK_PB7 2 &pcfg_pull_none_2ma>, ++ <1 RK_PB7 2 &pcfg_pull_none_4ma>, + /* mac_txd3 */ +- <1 RK_PC0 2 &pcfg_pull_none_12ma>, ++ <1 RK_PC0 2 &pcfg_pull_none_8ma>, + /* mac_txd2 */ +- <1 RK_PC1 2 &pcfg_pull_none_12ma>, ++ <1 RK_PC1 2 &pcfg_pull_none_8ma>, + + /* mac_txclk */ +- <0 RK_PB0 1 &pcfg_pull_none>, ++ <0 RK_PB0 1 &pcfg_pull_none_8ma>, + /* mac_txen */ +- <0 RK_PB4 1 &pcfg_pull_none>, ++ <0 RK_PB4 1 &pcfg_pull_none_8ma>, + /* mac_clk */ +- <0 RK_PD0 1 &pcfg_pull_none>, ++ <0 RK_PD0 1 &pcfg_pull_none_4ma>, + /* mac_txd1 */ +- <0 RK_PC0 1 &pcfg_pull_none>, ++ <0 RK_PC0 1 &pcfg_pull_none_8ma>, + /* mac_txd0 */ +- <0 RK_PC1 1 &pcfg_pull_none>, ++ <0 RK_PC1 1 &pcfg_pull_none_8ma>, + /* mac_txd3 */ +- <0 RK_PC7 1 &pcfg_pull_none>, ++ <0 RK_PC7 1 &pcfg_pull_none_8ma>, + /* mac_txd2 */ +- <0 RK_PC6 1 &pcfg_pull_none>; ++ <0 RK_PC6 1 &pcfg_pull_none_8ma>; + }; + + rmiim1_pins: rmiim1-pins { +diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h +index cccb83ad7fa8..e1d95f08f8e1 100644 +--- a/arch/arm64/include/asm/futex.h ++++ b/arch/arm64/include/asm/futex.h +@@ -30,8 +30,8 @@ do { \ + " prfm pstl1strm, %2\n" \ + "1: ldxr %w1, %2\n" \ + insn "\n" \ +-"2: stlxr %w3, %w0, %2\n" \ +-" cbnz %w3, 1b\n" \ ++"2: stlxr %w0, %w3, %2\n" \ ++" cbnz %w0, 1b\n" \ + " dmb ish\n" \ + "3:\n" \ + " .pushsection .fixup,\"ax\"\n" \ +@@ -50,30 +50,30 @@ do { \ + static inline int + arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr) + { +- int oldval = 0, ret, tmp; ++ int oldval, ret, tmp; + u32 __user *uaddr = __uaccess_mask_ptr(_uaddr); + + pagefault_disable(); + + switch (op) { + case FUTEX_OP_SET: +- __futex_atomic_op("mov %w0, %w4", ++ __futex_atomic_op("mov %w3, %w4", + ret, oldval, uaddr, tmp, oparg); + break; + case FUTEX_OP_ADD: +- __futex_atomic_op("add %w0, %w1, %w4", ++ __futex_atomic_op("add %w3, %w1, %w4", + ret, oldval, uaddr, tmp, oparg); + break; + case FUTEX_OP_OR: +- __futex_atomic_op("orr %w0, %w1, %w4", ++ __futex_atomic_op("orr %w3, %w1, %w4", + ret, oldval, uaddr, tmp, oparg); + break; + case FUTEX_OP_ANDN: +- __futex_atomic_op("and %w0, %w1, %w4", ++ __futex_atomic_op("and %w3, %w1, %w4", + ret, oldval, uaddr, tmp, ~oparg); + break; + case FUTEX_OP_XOR: +- __futex_atomic_op("eor %w0, %w1, %w4", ++ __futex_atomic_op("eor %w3, %w1, %w4", + ret, oldval, uaddr, tmp, oparg); + break; + default: +diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h +index 905e1bb0e7bd..cd9f4e9d04d3 100644 +--- a/arch/arm64/include/asm/module.h ++++ b/arch/arm64/include/asm/module.h +@@ -73,4 +73,9 @@ static inline bool is_forbidden_offset_for_adrp(void *place) + struct plt_entry get_plt_entry(u64 dst, void *pc); + bool plt_entries_equal(const struct plt_entry *a, const struct plt_entry *b); + ++static inline bool plt_entry_is_initialized(const struct plt_entry *e) ++{ ++ return e->adrp || e->add || e->br; ++} ++ + #endif /* __ASM_MODULE_H */ +diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c +index 8e4431a8821f..07b298120182 100644 +--- a/arch/arm64/kernel/ftrace.c ++++ b/arch/arm64/kernel/ftrace.c +@@ -107,8 +107,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + trampoline = get_plt_entry(addr, mod->arch.ftrace_trampoline); + if (!plt_entries_equal(mod->arch.ftrace_trampoline, + &trampoline)) { +- if (!plt_entries_equal(mod->arch.ftrace_trampoline, +- &(struct plt_entry){})) { ++ if (plt_entry_is_initialized(mod->arch.ftrace_trampoline)) { + pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n"); + return -EINVAL; + } +diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c +index 4e2fb877f8d5..92bfeb3e8d7c 100644 +--- a/arch/arm64/kernel/traps.c ++++ b/arch/arm64/kernel/traps.c +@@ -102,10 +102,16 @@ static void dump_instr(const char *lvl, struct pt_regs *regs) + void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk) + { + struct stackframe frame; +- int skip; ++ int skip = 0; + + pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk); + ++ if (regs) { ++ if (user_mode(regs)) ++ return; ++ skip = 1; ++ } ++ + if (!tsk) + tsk = current; + +@@ -126,7 +132,6 @@ void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk) + frame.graph = 0; + #endif + +- skip = !!regs; + printk("Call trace:\n"); + do { + /* skip until specified stack frame */ +@@ -176,15 +181,13 @@ static int __die(const char *str, int err, struct pt_regs *regs) + return ret; + + print_modules(); +- __show_regs(regs); + pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n", + TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), + end_of_stack(tsk)); ++ show_regs(regs); + +- if (!user_mode(regs)) { +- dump_backtrace(regs, tsk); ++ if (!user_mode(regs)) + dump_instr(KERN_EMERG, regs); +- } + + return ret; + } +diff --git a/arch/csky/include/asm/syscall.h b/arch/csky/include/asm/syscall.h +index d637445737b7..9a9cd81e66c1 100644 +--- a/arch/csky/include/asm/syscall.h ++++ b/arch/csky/include/asm/syscall.h +@@ -49,10 +49,11 @@ syscall_get_arguments(struct task_struct *task, struct pt_regs *regs, + if (i == 0) { + args[0] = regs->orig_a0; + args++; +- i++; + n--; ++ } else { ++ i--; + } +- memcpy(args, ®s->a1 + i * sizeof(regs->a1), n * sizeof(args[0])); ++ memcpy(args, ®s->a1 + i, n * sizeof(args[0])); + } + + static inline void +@@ -63,10 +64,11 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs, + if (i == 0) { + regs->orig_a0 = args[0]; + args++; +- i++; + n--; ++ } else { ++ i--; + } +- memcpy(®s->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0)); ++ memcpy(®s->a1 + i, args, n * sizeof(regs->a1)); + } + + static inline int +diff --git a/arch/parisc/include/asm/ptrace.h b/arch/parisc/include/asm/ptrace.h +index 2a27b275ab09..9ff033d261ab 100644 +--- a/arch/parisc/include/asm/ptrace.h ++++ b/arch/parisc/include/asm/ptrace.h +@@ -22,13 +22,14 @@ unsigned long profile_pc(struct pt_regs *); + + static inline unsigned long regs_return_value(struct pt_regs *regs) + { +- return regs->gr[20]; ++ return regs->gr[28]; + } + + static inline void instruction_pointer_set(struct pt_regs *regs, + unsigned long val) + { +- regs->iaoq[0] = val; ++ regs->iaoq[0] = val; ++ regs->iaoq[1] = val + 4; + } + + /* Query offset/name of register from its name/offset */ +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index eb39e7e380d7..841db71958cd 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -210,12 +210,6 @@ void __cpuidle arch_cpu_idle(void) + + static int __init parisc_idle_init(void) + { +- const char *marker; +- +- /* check QEMU/SeaBIOS marker in PAGE0 */ +- marker = (char *) &PAGE0->pad0; +- running_on_qemu = (memcmp(marker, "SeaBIOS", 8) == 0); +- + if (!running_on_qemu) + cpu_idle_poll_ctrl(1); + +diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c +index f2cf86ac279b..25946624ce6a 100644 +--- a/arch/parisc/kernel/setup.c ++++ b/arch/parisc/kernel/setup.c +@@ -396,6 +396,9 @@ void __init start_parisc(void) + int ret, cpunum; + struct pdc_coproc_cfg coproc_cfg; + ++ /* check QEMU/SeaBIOS marker in PAGE0 */ ++ running_on_qemu = (memcmp(&PAGE0->pad0, "SeaBIOS", 8) == 0); ++ + cpunum = smp_processor_id(); + + init_cpu_topology(); +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index 9e253ce27e08..4fee6c9887db 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -612,11 +612,17 @@ EXC_COMMON_BEGIN(data_access_slb_common) + ld r4,PACA_EXSLB+EX_DAR(r13) + std r4,_DAR(r1) + addi r3,r1,STACK_FRAME_OVERHEAD ++BEGIN_MMU_FTR_SECTION ++ /* HPT case, do SLB fault */ + bl do_slb_fault + cmpdi r3,0 + bne- 1f + b fast_exception_return + 1: /* Error case */ ++MMU_FTR_SECTION_ELSE ++ /* Radix case, access is outside page table range */ ++ li r3,-EFAULT ++ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX) + std r3,RESULT(r1) + bl save_nvgprs + RECONCILE_IRQ_STATE(r10, r11) +@@ -661,11 +667,17 @@ EXC_COMMON_BEGIN(instruction_access_slb_common) + EXCEPTION_PROLOG_COMMON(0x480, PACA_EXSLB) + ld r4,_NIP(r1) + addi r3,r1,STACK_FRAME_OVERHEAD ++BEGIN_MMU_FTR_SECTION ++ /* HPT case, do SLB fault */ + bl do_slb_fault + cmpdi r3,0 + bne- 1f + b fast_exception_return + 1: /* Error case */ ++MMU_FTR_SECTION_ELSE ++ /* Radix case, access is outside page table range */ ++ li r3,-EFAULT ++ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX) + std r3,RESULT(r1) + bl save_nvgprs + RECONCILE_IRQ_STATE(r10, r11) +diff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h +index bba3da6ef157..6ea9e1804233 100644 +--- a/arch/riscv/include/asm/syscall.h ++++ b/arch/riscv/include/asm/syscall.h +@@ -79,10 +79,11 @@ static inline void syscall_get_arguments(struct task_struct *task, + if (i == 0) { + args[0] = regs->orig_a0; + args++; +- i++; + n--; ++ } else { ++ i--; + } +- memcpy(args, ®s->a1 + i * sizeof(regs->a1), n * sizeof(args[0])); ++ memcpy(args, ®s->a1 + i, n * sizeof(args[0])); + } + + static inline void syscall_set_arguments(struct task_struct *task, +@@ -94,10 +95,11 @@ static inline void syscall_set_arguments(struct task_struct *task, + if (i == 0) { + regs->orig_a0 = args[0]; + args++; +- i++; + n--; +- } +- memcpy(®s->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0)); ++ } else { ++ i--; ++ } ++ memcpy(®s->a1 + i, args, n * sizeof(regs->a1)); + } + + static inline int syscall_get_arch(void) +diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c +index 7d2d7c801dba..0ecfac84ba91 100644 +--- a/arch/x86/events/amd/core.c ++++ b/arch/x86/events/amd/core.c +@@ -3,10 +3,14 @@ + #include + #include + #include ++#include + #include ++#include + + #include "../perf_event.h" + ++static DEFINE_PER_CPU(unsigned int, perf_nmi_counter); ++ + static __initconst const u64 amd_hw_cache_event_ids + [PERF_COUNT_HW_CACHE_MAX] + [PERF_COUNT_HW_CACHE_OP_MAX] +@@ -429,6 +433,132 @@ static void amd_pmu_cpu_dead(int cpu) + } + } + ++/* ++ * When a PMC counter overflows, an NMI is used to process the event and ++ * reset the counter. NMI latency can result in the counter being updated ++ * before the NMI can run, which can result in what appear to be spurious ++ * NMIs. This function is intended to wait for the NMI to run and reset ++ * the counter to avoid possible unhandled NMI messages. ++ */ ++#define OVERFLOW_WAIT_COUNT 50 ++ ++static void amd_pmu_wait_on_overflow(int idx) ++{ ++ unsigned int i; ++ u64 counter; ++ ++ /* ++ * Wait for the counter to be reset if it has overflowed. This loop ++ * should exit very, very quickly, but just in case, don't wait ++ * forever... ++ */ ++ for (i = 0; i < OVERFLOW_WAIT_COUNT; i++) { ++ rdmsrl(x86_pmu_event_addr(idx), counter); ++ if (counter & (1ULL << (x86_pmu.cntval_bits - 1))) ++ break; ++ ++ /* Might be in IRQ context, so can't sleep */ ++ udelay(1); ++ } ++} ++ ++static void amd_pmu_disable_all(void) ++{ ++ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); ++ int idx; ++ ++ x86_pmu_disable_all(); ++ ++ /* ++ * This shouldn't be called from NMI context, but add a safeguard here ++ * to return, since if we're in NMI context we can't wait for an NMI ++ * to reset an overflowed counter value. ++ */ ++ if (in_nmi()) ++ return; ++ ++ /* ++ * Check each counter for overflow and wait for it to be reset by the ++ * NMI if it has overflowed. This relies on the fact that all active ++ * counters are always enabled when this function is caled and ++ * ARCH_PERFMON_EVENTSEL_INT is always set. ++ */ ++ for (idx = 0; idx < x86_pmu.num_counters; idx++) { ++ if (!test_bit(idx, cpuc->active_mask)) ++ continue; ++ ++ amd_pmu_wait_on_overflow(idx); ++ } ++} ++ ++static void amd_pmu_disable_event(struct perf_event *event) ++{ ++ x86_pmu_disable_event(event); ++ ++ /* ++ * This can be called from NMI context (via x86_pmu_stop). The counter ++ * may have overflowed, but either way, we'll never see it get reset ++ * by the NMI if we're already in the NMI. And the NMI latency support ++ * below will take care of any pending NMI that might have been ++ * generated by the overflow. ++ */ ++ if (in_nmi()) ++ return; ++ ++ amd_pmu_wait_on_overflow(event->hw.idx); ++} ++ ++/* ++ * Because of NMI latency, if multiple PMC counters are active or other sources ++ * of NMIs are received, the perf NMI handler can handle one or more overflowed ++ * PMC counters outside of the NMI associated with the PMC overflow. If the NMI ++ * doesn't arrive at the LAPIC in time to become a pending NMI, then the kernel ++ * back-to-back NMI support won't be active. This PMC handler needs to take into ++ * account that this can occur, otherwise this could result in unknown NMI ++ * messages being issued. Examples of this is PMC overflow while in the NMI ++ * handler when multiple PMCs are active or PMC overflow while handling some ++ * other source of an NMI. ++ * ++ * Attempt to mitigate this by using the number of active PMCs to determine ++ * whether to return NMI_HANDLED if the perf NMI handler did not handle/reset ++ * any PMCs. The per-CPU perf_nmi_counter variable is set to a minimum of the ++ * number of active PMCs or 2. The value of 2 is used in case an NMI does not ++ * arrive at the LAPIC in time to be collapsed into an already pending NMI. ++ */ ++static int amd_pmu_handle_irq(struct pt_regs *regs) ++{ ++ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); ++ int active, handled; ++ ++ /* ++ * Obtain the active count before calling x86_pmu_handle_irq() since ++ * it is possible that x86_pmu_handle_irq() may make a counter ++ * inactive (through x86_pmu_stop). ++ */ ++ active = __bitmap_weight(cpuc->active_mask, X86_PMC_IDX_MAX); ++ ++ /* Process any counter overflows */ ++ handled = x86_pmu_handle_irq(regs); ++ ++ /* ++ * If a counter was handled, record the number of possible remaining ++ * NMIs that can occur. ++ */ ++ if (handled) { ++ this_cpu_write(perf_nmi_counter, ++ min_t(unsigned int, 2, active)); ++ ++ return handled; ++ } ++ ++ if (!this_cpu_read(perf_nmi_counter)) ++ return NMI_DONE; ++ ++ this_cpu_dec(perf_nmi_counter); ++ ++ return NMI_HANDLED; ++} ++ + static struct event_constraint * + amd_get_event_constraints(struct cpu_hw_events *cpuc, int idx, + struct perf_event *event) +@@ -621,11 +751,11 @@ static ssize_t amd_event_sysfs_show(char *page, u64 config) + + static __initconst const struct x86_pmu amd_pmu = { + .name = "AMD", +- .handle_irq = x86_pmu_handle_irq, +- .disable_all = x86_pmu_disable_all, ++ .handle_irq = amd_pmu_handle_irq, ++ .disable_all = amd_pmu_disable_all, + .enable_all = x86_pmu_enable_all, + .enable = x86_pmu_enable_event, +- .disable = x86_pmu_disable_event, ++ .disable = amd_pmu_disable_event, + .hw_config = amd_pmu_hw_config, + .schedule_events = x86_schedule_events, + .eventsel = MSR_K7_EVNTSEL0, +@@ -732,7 +862,7 @@ void amd_pmu_enable_virt(void) + cpuc->perf_ctr_virt_mask = 0; + + /* Reload all events */ +- x86_pmu_disable_all(); ++ amd_pmu_disable_all(); + x86_pmu_enable_all(0); + } + EXPORT_SYMBOL_GPL(amd_pmu_enable_virt); +@@ -750,7 +880,7 @@ void amd_pmu_disable_virt(void) + cpuc->perf_ctr_virt_mask = AMD64_EVENTSEL_HOSTONLY; + + /* Reload all events */ +- x86_pmu_disable_all(); ++ amd_pmu_disable_all(); + x86_pmu_enable_all(0); + } + EXPORT_SYMBOL_GPL(amd_pmu_disable_virt); +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index e2b1447192a8..81911e11a15d 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -1349,8 +1349,9 @@ void x86_pmu_stop(struct perf_event *event, int flags) + struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); + struct hw_perf_event *hwc = &event->hw; + +- if (__test_and_clear_bit(hwc->idx, cpuc->active_mask)) { ++ if (test_bit(hwc->idx, cpuc->active_mask)) { + x86_pmu.disable(event); ++ __clear_bit(hwc->idx, cpuc->active_mask); + cpuc->events[hwc->idx] = NULL; + WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED); + hwc->state |= PERF_HES_STOPPED; +@@ -1447,16 +1448,8 @@ int x86_pmu_handle_irq(struct pt_regs *regs) + apic_write(APIC_LVTPC, APIC_DM_NMI); + + for (idx = 0; idx < x86_pmu.num_counters; idx++) { +- if (!test_bit(idx, cpuc->active_mask)) { +- /* +- * Though we deactivated the counter some cpus +- * might still deliver spurious interrupts still +- * in flight. Catch them: +- */ +- if (__test_and_clear_bit(idx, cpuc->running)) +- handled++; ++ if (!test_bit(idx, cpuc->active_mask)) + continue; +- } + + event = cpuc->events[idx]; + +diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h +index ad7b210aa3f6..8e790ec219a5 100644 +--- a/arch/x86/include/asm/bitops.h ++++ b/arch/x86/include/asm/bitops.h +@@ -36,22 +36,17 @@ + * bit 0 is the LSB of addr; bit 32 is the LSB of (addr+1). + */ + +-#if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 1) +-/* Technically wrong, but this avoids compilation errors on some gcc +- versions. */ +-#define BITOP_ADDR(x) "=m" (*(volatile long *) (x)) +-#else +-#define BITOP_ADDR(x) "+m" (*(volatile long *) (x)) +-#endif ++#define RLONG_ADDR(x) "m" (*(volatile long *) (x)) ++#define WBYTE_ADDR(x) "+m" (*(volatile char *) (x)) + +-#define ADDR BITOP_ADDR(addr) ++#define ADDR RLONG_ADDR(addr) + + /* + * We do the locked ops that don't return the old value as + * a mask operation on a byte. + */ + #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr)) +-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3)) ++#define CONST_MASK_ADDR(nr, addr) WBYTE_ADDR((void *)(addr) + ((nr)>>3)) + #define CONST_MASK(nr) (1 << ((nr) & 7)) + + /** +@@ -79,7 +74,7 @@ set_bit(long nr, volatile unsigned long *addr) + : "memory"); + } else { + asm volatile(LOCK_PREFIX __ASM_SIZE(bts) " %1,%0" +- : BITOP_ADDR(addr) : "Ir" (nr) : "memory"); ++ : : RLONG_ADDR(addr), "Ir" (nr) : "memory"); + } + } + +@@ -94,7 +89,7 @@ set_bit(long nr, volatile unsigned long *addr) + */ + static __always_inline void __set_bit(long nr, volatile unsigned long *addr) + { +- asm volatile(__ASM_SIZE(bts) " %1,%0" : ADDR : "Ir" (nr) : "memory"); ++ asm volatile(__ASM_SIZE(bts) " %1,%0" : : ADDR, "Ir" (nr) : "memory"); + } + + /** +@@ -116,8 +111,7 @@ clear_bit(long nr, volatile unsigned long *addr) + : "iq" ((u8)~CONST_MASK(nr))); + } else { + asm volatile(LOCK_PREFIX __ASM_SIZE(btr) " %1,%0" +- : BITOP_ADDR(addr) +- : "Ir" (nr)); ++ : : RLONG_ADDR(addr), "Ir" (nr) : "memory"); + } + } + +@@ -137,7 +131,7 @@ static __always_inline void clear_bit_unlock(long nr, volatile unsigned long *ad + + static __always_inline void __clear_bit(long nr, volatile unsigned long *addr) + { +- asm volatile(__ASM_SIZE(btr) " %1,%0" : ADDR : "Ir" (nr)); ++ asm volatile(__ASM_SIZE(btr) " %1,%0" : : ADDR, "Ir" (nr) : "memory"); + } + + static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile unsigned long *addr) +@@ -145,7 +139,7 @@ static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile + bool negative; + asm volatile(LOCK_PREFIX "andb %2,%1" + CC_SET(s) +- : CC_OUT(s) (negative), ADDR ++ : CC_OUT(s) (negative), WBYTE_ADDR(addr) + : "ir" ((char) ~(1 << nr)) : "memory"); + return negative; + } +@@ -161,13 +155,9 @@ static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile + * __clear_bit() is non-atomic and implies release semantics before the memory + * operation. It can be used for an unlock if no other CPUs can concurrently + * modify other bits in the word. +- * +- * No memory barrier is required here, because x86 cannot reorder stores past +- * older loads. Same principle as spin_unlock. + */ + static __always_inline void __clear_bit_unlock(long nr, volatile unsigned long *addr) + { +- barrier(); + __clear_bit(nr, addr); + } + +@@ -182,7 +172,7 @@ static __always_inline void __clear_bit_unlock(long nr, volatile unsigned long * + */ + static __always_inline void __change_bit(long nr, volatile unsigned long *addr) + { +- asm volatile(__ASM_SIZE(btc) " %1,%0" : ADDR : "Ir" (nr)); ++ asm volatile(__ASM_SIZE(btc) " %1,%0" : : ADDR, "Ir" (nr) : "memory"); + } + + /** +@@ -202,8 +192,7 @@ static __always_inline void change_bit(long nr, volatile unsigned long *addr) + : "iq" ((u8)CONST_MASK(nr))); + } else { + asm volatile(LOCK_PREFIX __ASM_SIZE(btc) " %1,%0" +- : BITOP_ADDR(addr) +- : "Ir" (nr)); ++ : : RLONG_ADDR(addr), "Ir" (nr) : "memory"); + } + } + +@@ -248,8 +237,8 @@ static __always_inline bool __test_and_set_bit(long nr, volatile unsigned long * + + asm(__ASM_SIZE(bts) " %2,%1" + CC_SET(c) +- : CC_OUT(c) (oldbit), ADDR +- : "Ir" (nr)); ++ : CC_OUT(c) (oldbit) ++ : ADDR, "Ir" (nr) : "memory"); + return oldbit; + } + +@@ -288,8 +277,8 @@ static __always_inline bool __test_and_clear_bit(long nr, volatile unsigned long + + asm volatile(__ASM_SIZE(btr) " %2,%1" + CC_SET(c) +- : CC_OUT(c) (oldbit), ADDR +- : "Ir" (nr)); ++ : CC_OUT(c) (oldbit) ++ : ADDR, "Ir" (nr) : "memory"); + return oldbit; + } + +@@ -300,8 +289,8 @@ static __always_inline bool __test_and_change_bit(long nr, volatile unsigned lon + + asm volatile(__ASM_SIZE(btc) " %2,%1" + CC_SET(c) +- : CC_OUT(c) (oldbit), ADDR +- : "Ir" (nr) : "memory"); ++ : CC_OUT(c) (oldbit) ++ : ADDR, "Ir" (nr) : "memory"); + + return oldbit; + } +@@ -332,7 +321,7 @@ static __always_inline bool variable_test_bit(long nr, volatile const unsigned l + asm volatile(__ASM_SIZE(bt) " %2,%1" + CC_SET(c) + : CC_OUT(c) (oldbit) +- : "m" (*(unsigned long *)addr), "Ir" (nr)); ++ : "m" (*(unsigned long *)addr), "Ir" (nr) : "memory"); + + return oldbit; + } +diff --git a/arch/x86/include/asm/string_32.h b/arch/x86/include/asm/string_32.h +index 55d392c6bd29..2fd165f1cffa 100644 +--- a/arch/x86/include/asm/string_32.h ++++ b/arch/x86/include/asm/string_32.h +@@ -179,14 +179,7 @@ static inline void *__memcpy3d(void *to, const void *from, size_t len) + * No 3D Now! + */ + +-#if (__GNUC__ >= 4) + #define memcpy(t, f, n) __builtin_memcpy(t, f, n) +-#else +-#define memcpy(t, f, n) \ +- (__builtin_constant_p((n)) \ +- ? __constant_memcpy((t), (f), (n)) \ +- : __memcpy((t), (f), (n))) +-#endif + + #endif + #endif /* !CONFIG_FORTIFY_SOURCE */ +@@ -282,12 +275,7 @@ void *__constant_c_and_count_memset(void *s, unsigned long pattern, + + { + int d0, d1; +-#if __GNUC__ == 4 && __GNUC_MINOR__ == 0 +- /* Workaround for broken gcc 4.0 */ +- register unsigned long eax asm("%eax") = pattern; +-#else + unsigned long eax = pattern; +-#endif + + switch (count % 4) { + case 0: +@@ -321,15 +309,7 @@ void *__constant_c_and_count_memset(void *s, unsigned long pattern, + #define __HAVE_ARCH_MEMSET + extern void *memset(void *, int, size_t); + #ifndef CONFIG_FORTIFY_SOURCE +-#if (__GNUC__ >= 4) + #define memset(s, c, count) __builtin_memset(s, c, count) +-#else +-#define memset(s, c, count) \ +- (__builtin_constant_p(c) \ +- ? __constant_c_x_memset((s), (0x01010101UL * (unsigned char)(c)), \ +- (count)) \ +- : __memset((s), (c), (count))) +-#endif + #endif /* !CONFIG_FORTIFY_SOURCE */ + + #define __HAVE_ARCH_MEMSET16 +diff --git a/arch/x86/include/asm/string_64.h b/arch/x86/include/asm/string_64.h +index 4e4194e21a09..75314c3dbe47 100644 +--- a/arch/x86/include/asm/string_64.h ++++ b/arch/x86/include/asm/string_64.h +@@ -14,21 +14,6 @@ + extern void *memcpy(void *to, const void *from, size_t len); + extern void *__memcpy(void *to, const void *from, size_t len); + +-#ifndef CONFIG_FORTIFY_SOURCE +-#if (__GNUC__ == 4 && __GNUC_MINOR__ < 3) || __GNUC__ < 4 +-#define memcpy(dst, src, len) \ +-({ \ +- size_t __len = (len); \ +- void *__ret; \ +- if (__builtin_constant_p(len) && __len >= 64) \ +- __ret = __memcpy((dst), (src), __len); \ +- else \ +- __ret = __builtin_memcpy((dst), (src), __len); \ +- __ret; \ +-}) +-#endif +-#endif /* !CONFIG_FORTIFY_SOURCE */ +- + #define __HAVE_ARCH_MEMSET + void *memset(void *s, int c, size_t n); + void *__memset(void *s, int c, size_t n); +diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h +index ef05bea7010d..6b5c710846f5 100644 +--- a/arch/x86/include/asm/xen/hypercall.h ++++ b/arch/x86/include/asm/xen/hypercall.h +@@ -206,6 +206,9 @@ xen_single_call(unsigned int call, + __HYPERCALL_DECLS; + __HYPERCALL_5ARG(a1, a2, a3, a4, a5); + ++ if (call >= PAGE_SIZE / sizeof(hypercall_page[0])) ++ return -EINVAL; ++ + asm volatile(CALL_NOSPEC + : __HYPERCALL_5PARAM + : [thunk_target] "a" (&hypercall_page[call]) +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index f13a3a24d360..a9b8e38d78ad 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -6422,11 +6422,11 @@ e_free: + return ret; + } + +-static int get_num_contig_pages(int idx, struct page **inpages, +- unsigned long npages) ++static unsigned long get_num_contig_pages(unsigned long idx, ++ struct page **inpages, unsigned long npages) + { + unsigned long paddr, next_paddr; +- int i = idx + 1, pages = 1; ++ unsigned long i = idx + 1, pages = 1; + + /* find the number of contiguous pages starting from idx */ + paddr = __sme_page_pa(inpages[idx]); +@@ -6445,12 +6445,12 @@ static int get_num_contig_pages(int idx, struct page **inpages, + + static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) + { +- unsigned long vaddr, vaddr_end, next_vaddr, npages, size; ++ unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i; + struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; + struct kvm_sev_launch_update_data params; + struct sev_data_launch_update_data *data; + struct page **inpages; +- int i, ret, pages; ++ int ret; + + if (!sev_guest(kvm)) + return -ENOTTY; +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index f014e1aeee96..f90b3a948291 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -500,6 +500,17 @@ static void nested_vmx_disable_intercept_for_msr(unsigned long *msr_bitmap_l1, + } + } + ++static inline void enable_x2apic_msr_intercepts(unsigned long *msr_bitmap) { ++ int msr; ++ ++ for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) { ++ unsigned word = msr / BITS_PER_LONG; ++ ++ msr_bitmap[word] = ~0; ++ msr_bitmap[word + (0x800 / sizeof(long))] = ~0; ++ } ++} ++ + /* + * Merge L0's and L1's MSR bitmap, return false to indicate that + * we do not use the hardware. +@@ -541,39 +552,44 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, + return false; + + msr_bitmap_l1 = (unsigned long *)kmap(page); +- if (nested_cpu_has_apic_reg_virt(vmcs12)) { +- /* +- * L0 need not intercept reads for MSRs between 0x800 and 0x8ff, it +- * just lets the processor take the value from the virtual-APIC page; +- * take those 256 bits directly from the L1 bitmap. +- */ +- for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) { +- unsigned word = msr / BITS_PER_LONG; +- msr_bitmap_l0[word] = msr_bitmap_l1[word]; +- msr_bitmap_l0[word + (0x800 / sizeof(long))] = ~0; +- } +- } else { +- for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) { +- unsigned word = msr / BITS_PER_LONG; +- msr_bitmap_l0[word] = ~0; +- msr_bitmap_l0[word + (0x800 / sizeof(long))] = ~0; +- } +- } + +- nested_vmx_disable_intercept_for_msr( +- msr_bitmap_l1, msr_bitmap_l0, +- X2APIC_MSR(APIC_TASKPRI), +- MSR_TYPE_W); ++ /* ++ * To keep the control flow simple, pay eight 8-byte writes (sixteen ++ * 4-byte writes on 32-bit systems) up front to enable intercepts for ++ * the x2APIC MSR range and selectively disable them below. ++ */ ++ enable_x2apic_msr_intercepts(msr_bitmap_l0); ++ ++ if (nested_cpu_has_virt_x2apic_mode(vmcs12)) { ++ if (nested_cpu_has_apic_reg_virt(vmcs12)) { ++ /* ++ * L0 need not intercept reads for MSRs between 0x800 ++ * and 0x8ff, it just lets the processor take the value ++ * from the virtual-APIC page; take those 256 bits ++ * directly from the L1 bitmap. ++ */ ++ for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) { ++ unsigned word = msr / BITS_PER_LONG; ++ ++ msr_bitmap_l0[word] = msr_bitmap_l1[word]; ++ } ++ } + +- if (nested_cpu_has_vid(vmcs12)) { +- nested_vmx_disable_intercept_for_msr( +- msr_bitmap_l1, msr_bitmap_l0, +- X2APIC_MSR(APIC_EOI), +- MSR_TYPE_W); + nested_vmx_disable_intercept_for_msr( + msr_bitmap_l1, msr_bitmap_l0, +- X2APIC_MSR(APIC_SELF_IPI), +- MSR_TYPE_W); ++ X2APIC_MSR(APIC_TASKPRI), ++ MSR_TYPE_R | MSR_TYPE_W); ++ ++ if (nested_cpu_has_vid(vmcs12)) { ++ nested_vmx_disable_intercept_for_msr( ++ msr_bitmap_l1, msr_bitmap_l0, ++ X2APIC_MSR(APIC_EOI), ++ MSR_TYPE_W); ++ nested_vmx_disable_intercept_for_msr( ++ msr_bitmap_l1, msr_bitmap_l0, ++ X2APIC_MSR(APIC_SELF_IPI), ++ MSR_TYPE_W); ++ } + } + + if (spec_ctrl) +diff --git a/arch/xtensa/kernel/stacktrace.c b/arch/xtensa/kernel/stacktrace.c +index 174c11f13bba..b9f82510c650 100644 +--- a/arch/xtensa/kernel/stacktrace.c ++++ b/arch/xtensa/kernel/stacktrace.c +@@ -253,10 +253,14 @@ static int return_address_cb(struct stackframe *frame, void *data) + return 1; + } + ++/* ++ * level == 0 is for the return address from the caller of this function, ++ * not from this function itself. ++ */ + unsigned long return_address(unsigned level) + { + struct return_addr_data r = { +- .skip = level + 1, ++ .skip = level, + }; + walk_stackframe(stack_pointer(NULL), return_address_cb, &r); + return r.addr; +diff --git a/block/bio.c b/block/bio.c +index 4db1008309ed..a06f58bd4c72 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -1238,8 +1238,11 @@ struct bio *bio_copy_user_iov(struct request_queue *q, + } + } + +- if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes) ++ if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes) { ++ if (!map_data) ++ __free_page(page); + break; ++ } + + len -= bytes; + offset = 0; +diff --git a/block/blk-core.c b/block/blk-core.c +index 6b78ec56a4f2..5bde73a49399 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -1246,8 +1246,6 @@ static int blk_cloned_rq_check_limits(struct request_queue *q, + */ + blk_status_t blk_insert_cloned_request(struct request_queue *q, struct request *rq) + { +- blk_qc_t unused; +- + if (blk_cloned_rq_check_limits(q, rq)) + return BLK_STS_IOERR; + +@@ -1263,7 +1261,7 @@ blk_status_t blk_insert_cloned_request(struct request_queue *q, struct request * + * bypass a potential scheduler on the bottom device for + * insert. + */ +- return blk_mq_try_issue_directly(rq->mq_hctx, rq, &unused, true, true); ++ return blk_mq_request_issue_directly(rq, true); + } + EXPORT_SYMBOL_GPL(blk_insert_cloned_request); + +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index 140933e4a7d1..0c98b6c1ca49 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -423,10 +423,12 @@ void blk_mq_sched_insert_requests(struct blk_mq_hw_ctx *hctx, + * busy in case of 'none' scheduler, and this way may save + * us one extra enqueue & dequeue to sw queue. + */ +- if (!hctx->dispatch_busy && !e && !run_queue_async) ++ if (!hctx->dispatch_busy && !e && !run_queue_async) { + blk_mq_try_issue_list_directly(hctx, list); +- else +- blk_mq_insert_requests(hctx, ctx, list); ++ if (list_empty(list)) ++ return; ++ } ++ blk_mq_insert_requests(hctx, ctx, list); + } + + blk_mq_run_hw_queue(hctx, run_queue_async); +diff --git a/block/blk-mq.c b/block/blk-mq.c +index b9283b63d116..16f9675c57e6 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1805,74 +1805,76 @@ static blk_status_t __blk_mq_issue_directly(struct blk_mq_hw_ctx *hctx, + return ret; + } + +-blk_status_t blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx, ++static blk_status_t __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx, + struct request *rq, + blk_qc_t *cookie, +- bool bypass, bool last) ++ bool bypass_insert, bool last) + { + struct request_queue *q = rq->q; + bool run_queue = true; +- blk_status_t ret = BLK_STS_RESOURCE; +- int srcu_idx; +- bool force = false; + +- hctx_lock(hctx, &srcu_idx); + /* +- * hctx_lock is needed before checking quiesced flag. ++ * RCU or SRCU read lock is needed before checking quiesced flag. + * +- * When queue is stopped or quiesced, ignore 'bypass', insert +- * and return BLK_STS_OK to caller, and avoid driver to try to +- * dispatch again. ++ * When queue is stopped or quiesced, ignore 'bypass_insert' from ++ * blk_mq_request_issue_directly(), and return BLK_STS_OK to caller, ++ * and avoid driver to try to dispatch again. + */ +- if (unlikely(blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(q))) { ++ if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(q)) { + run_queue = false; +- bypass = false; +- goto out_unlock; ++ bypass_insert = false; ++ goto insert; + } + +- if (unlikely(q->elevator && !bypass)) +- goto out_unlock; ++ if (q->elevator && !bypass_insert) ++ goto insert; + + if (!blk_mq_get_dispatch_budget(hctx)) +- goto out_unlock; ++ goto insert; + + if (!blk_mq_get_driver_tag(rq)) { + blk_mq_put_dispatch_budget(hctx); +- goto out_unlock; ++ goto insert; + } + +- /* +- * Always add a request that has been through +- *.queue_rq() to the hardware dispatch list. +- */ +- force = true; +- ret = __blk_mq_issue_directly(hctx, rq, cookie, last); +-out_unlock: ++ return __blk_mq_issue_directly(hctx, rq, cookie, last); ++insert: ++ if (bypass_insert) ++ return BLK_STS_RESOURCE; ++ ++ blk_mq_request_bypass_insert(rq, run_queue); ++ return BLK_STS_OK; ++} ++ ++static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx, ++ struct request *rq, blk_qc_t *cookie) ++{ ++ blk_status_t ret; ++ int srcu_idx; ++ ++ might_sleep_if(hctx->flags & BLK_MQ_F_BLOCKING); ++ ++ hctx_lock(hctx, &srcu_idx); ++ ++ ret = __blk_mq_try_issue_directly(hctx, rq, cookie, false, true); ++ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) ++ blk_mq_request_bypass_insert(rq, true); ++ else if (ret != BLK_STS_OK) ++ blk_mq_end_request(rq, ret); ++ ++ hctx_unlock(hctx, srcu_idx); ++} ++ ++blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last) ++{ ++ blk_status_t ret; ++ int srcu_idx; ++ blk_qc_t unused_cookie; ++ struct blk_mq_hw_ctx *hctx = rq->mq_hctx; ++ ++ hctx_lock(hctx, &srcu_idx); ++ ret = __blk_mq_try_issue_directly(hctx, rq, &unused_cookie, true, last); + hctx_unlock(hctx, srcu_idx); +- switch (ret) { +- case BLK_STS_OK: +- break; +- case BLK_STS_DEV_RESOURCE: +- case BLK_STS_RESOURCE: +- if (force) { +- blk_mq_request_bypass_insert(rq, run_queue); +- /* +- * We have to return BLK_STS_OK for the DM +- * to avoid livelock. Otherwise, we return +- * the real result to indicate whether the +- * request is direct-issued successfully. +- */ +- ret = bypass ? BLK_STS_OK : ret; +- } else if (!bypass) { +- blk_mq_sched_insert_request(rq, false, +- run_queue, false); +- } +- break; +- default: +- if (!bypass) +- blk_mq_end_request(rq, ret); +- break; +- } + + return ret; + } +@@ -1880,20 +1882,22 @@ out_unlock: + void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx, + struct list_head *list) + { +- blk_qc_t unused; +- blk_status_t ret = BLK_STS_OK; +- + while (!list_empty(list)) { ++ blk_status_t ret; + struct request *rq = list_first_entry(list, struct request, + queuelist); + + list_del_init(&rq->queuelist); +- if (ret == BLK_STS_OK) +- ret = blk_mq_try_issue_directly(hctx, rq, &unused, +- false, ++ ret = blk_mq_request_issue_directly(rq, list_empty(list)); ++ if (ret != BLK_STS_OK) { ++ if (ret == BLK_STS_RESOURCE || ++ ret == BLK_STS_DEV_RESOURCE) { ++ blk_mq_request_bypass_insert(rq, + list_empty(list)); +- else +- blk_mq_sched_insert_request(rq, false, true, false); ++ break; ++ } ++ blk_mq_end_request(rq, ret); ++ } + } + + /* +@@ -1901,7 +1905,7 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx, + * the driver there was more coming, but that turned out to + * be a lie. + */ +- if (ret != BLK_STS_OK && hctx->queue->mq_ops->commit_rqs) ++ if (!list_empty(list) && hctx->queue->mq_ops->commit_rqs) + hctx->queue->mq_ops->commit_rqs(hctx); + } + +@@ -2014,13 +2018,13 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio) + if (same_queue_rq) { + data.hctx = same_queue_rq->mq_hctx; + blk_mq_try_issue_directly(data.hctx, same_queue_rq, +- &cookie, false, true); ++ &cookie); + } + } else if ((q->nr_hw_queues > 1 && is_sync) || (!q->elevator && + !data.hctx->dispatch_busy)) { + blk_mq_put_ctx(data.ctx); + blk_mq_bio_to_request(rq, bio); +- blk_mq_try_issue_directly(data.hctx, rq, &cookie, false, true); ++ blk_mq_try_issue_directly(data.hctx, rq, &cookie); + } else { + blk_mq_put_ctx(data.ctx); + blk_mq_bio_to_request(rq, bio); +diff --git a/block/blk-mq.h b/block/blk-mq.h +index d0b3dd54ef8d..a3a684a8c633 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -67,10 +67,8 @@ void blk_mq_request_bypass_insert(struct request *rq, bool run_queue); + void blk_mq_insert_requests(struct blk_mq_hw_ctx *hctx, struct blk_mq_ctx *ctx, + struct list_head *list); + +-blk_status_t blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx, +- struct request *rq, +- blk_qc_t *cookie, +- bool bypass, bool last); ++/* Used by blk_insert_cloned_request() to issue request directly */ ++blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last); + void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx, + struct list_head *list); + +diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c +index e10fec99a182..4424997ecf30 100644 +--- a/drivers/acpi/acpica/evgpe.c ++++ b/drivers/acpi/acpica/evgpe.c +@@ -81,8 +81,12 @@ acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info) + + ACPI_FUNCTION_TRACE(ev_enable_gpe); + +- /* Enable the requested GPE */ ++ /* Clear the GPE status */ ++ status = acpi_hw_clear_gpe(gpe_event_info); ++ if (ACPI_FAILURE(status)) ++ return_ACPI_STATUS(status); + ++ /* Enable the requested GPE */ + status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_ENABLE); + return_ACPI_STATUS(status); + } +diff --git a/drivers/acpi/acpica/nsobject.c b/drivers/acpi/acpica/nsobject.c +index 8638f43cfc3d..79d86da1c892 100644 +--- a/drivers/acpi/acpica/nsobject.c ++++ b/drivers/acpi/acpica/nsobject.c +@@ -186,6 +186,10 @@ void acpi_ns_detach_object(struct acpi_namespace_node *node) + } + } + ++ if (obj_desc->common.type == ACPI_TYPE_REGION) { ++ acpi_ut_remove_address_range(obj_desc->region.space_id, node); ++ } ++ + /* Clear the Node entry in all cases */ + + node->object = NULL; +diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig +index 2e2ffe7010aa..51c77f0e47b2 100644 +--- a/drivers/char/Kconfig ++++ b/drivers/char/Kconfig +@@ -351,7 +351,7 @@ config XILINX_HWICAP + + config R3964 + tristate "Siemens R3964 line discipline" +- depends on TTY ++ depends on TTY && BROKEN + ---help--- + This driver allows synchronous communication with devices using the + Siemens R3964 packet protocol. Unless you are dealing with special +diff --git a/drivers/clk/meson/meson-aoclk.c b/drivers/clk/meson/meson-aoclk.c +index 258c8d259ea1..f965845917e3 100644 +--- a/drivers/clk/meson/meson-aoclk.c ++++ b/drivers/clk/meson/meson-aoclk.c +@@ -65,20 +65,15 @@ int meson_aoclkc_probe(struct platform_device *pdev) + return ret; + } + +- /* Populate regmap */ +- for (clkid = 0; clkid < data->num_clks; clkid++) ++ /* ++ * Populate regmap and register all clks ++ */ ++ for (clkid = 0; clkid < data->num_clks; clkid++) { + data->clks[clkid]->map = regmap; + +- /* Register all clks */ +- for (clkid = 0; clkid < data->hw_data->num; clkid++) { +- if (!data->hw_data->hws[clkid]) +- continue; +- + ret = devm_clk_hw_register(dev, data->hw_data->hws[clkid]); +- if (ret) { +- dev_err(dev, "Clock registration failed\n"); ++ if (ret) + return ret; +- } + } + + return devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get, +diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c +index c7103dd2d8d5..563ab8590061 100644 +--- a/drivers/gpu/drm/i915/gvt/gtt.c ++++ b/drivers/gpu/drm/i915/gvt/gtt.c +@@ -1942,7 +1942,7 @@ void _intel_vgpu_mm_release(struct kref *mm_ref) + */ + void intel_vgpu_unpin_mm(struct intel_vgpu_mm *mm) + { +- atomic_dec(&mm->pincount); ++ atomic_dec_if_positive(&mm->pincount); + } + + /** +diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c +index 55bb7885e228..8fff49affc11 100644 +--- a/drivers/gpu/drm/i915/gvt/scheduler.c ++++ b/drivers/gpu/drm/i915/gvt/scheduler.c +@@ -1475,8 +1475,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id, + intel_runtime_pm_put(dev_priv); + } + +- if (ret && (vgpu_is_vm_unhealthy(ret))) { +- enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR); ++ if (ret) { ++ if (vgpu_is_vm_unhealthy(ret)) ++ enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR); + intel_vgpu_destroy_workload(workload); + return ERR_PTR(ret); + } +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 22a74608c6e4..dcd1df5322e8 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -1845,42 +1845,6 @@ intel_dp_compute_link_config_wide(struct intel_dp *intel_dp, + return false; + } + +-/* Optimize link config in order: max bpp, min lanes, min clock */ +-static bool +-intel_dp_compute_link_config_fast(struct intel_dp *intel_dp, +- struct intel_crtc_state *pipe_config, +- const struct link_config_limits *limits) +-{ +- struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode; +- int bpp, clock, lane_count; +- int mode_rate, link_clock, link_avail; +- +- for (bpp = limits->max_bpp; bpp >= limits->min_bpp; bpp -= 2 * 3) { +- mode_rate = intel_dp_link_required(adjusted_mode->crtc_clock, +- bpp); +- +- for (lane_count = limits->min_lane_count; +- lane_count <= limits->max_lane_count; +- lane_count <<= 1) { +- for (clock = limits->min_clock; clock <= limits->max_clock; clock++) { +- link_clock = intel_dp->common_rates[clock]; +- link_avail = intel_dp_max_data_rate(link_clock, +- lane_count); +- +- if (mode_rate <= link_avail) { +- pipe_config->lane_count = lane_count; +- pipe_config->pipe_bpp = bpp; +- pipe_config->port_clock = link_clock; +- +- return true; +- } +- } +- } +- } +- +- return false; +-} +- + static int intel_dp_dsc_compute_bpp(struct intel_dp *intel_dp, u8 dsc_max_bpc) + { + int i, num_bpc; +@@ -2013,15 +1977,13 @@ intel_dp_compute_link_config(struct intel_encoder *encoder, + limits.min_bpp = 6 * 3; + limits.max_bpp = intel_dp_compute_bpp(intel_dp, pipe_config); + +- if (intel_dp_is_edp(intel_dp) && intel_dp->edp_dpcd[0] < DP_EDP_14) { ++ if (intel_dp_is_edp(intel_dp)) { + /* + * Use the maximum clock and number of lanes the eDP panel +- * advertizes being capable of. The eDP 1.3 and earlier panels +- * are generally designed to support only a single clock and +- * lane configuration, and typically these values correspond to +- * the native resolution of the panel. With eDP 1.4 rate select +- * and DSC, this is decreasingly the case, and we need to be +- * able to select less than maximum link config. ++ * advertizes being capable of. The panels are generally ++ * designed to support only a single clock and lane ++ * configuration, and typically these values correspond to the ++ * native resolution of the panel. + */ + limits.min_lane_count = limits.max_lane_count; + limits.min_clock = limits.max_clock; +@@ -2035,22 +1997,11 @@ intel_dp_compute_link_config(struct intel_encoder *encoder, + intel_dp->common_rates[limits.max_clock], + limits.max_bpp, adjusted_mode->crtc_clock); + +- if (intel_dp_is_edp(intel_dp)) +- /* +- * Optimize for fast and narrow. eDP 1.3 section 3.3 and eDP 1.4 +- * section A.1: "It is recommended that the minimum number of +- * lanes be used, using the minimum link rate allowed for that +- * lane configuration." +- * +- * Note that we use the max clock and lane count for eDP 1.3 and +- * earlier, and fast vs. wide is irrelevant. +- */ +- ret = intel_dp_compute_link_config_fast(intel_dp, pipe_config, +- &limits); +- else +- /* Optimize for slow and wide. */ +- ret = intel_dp_compute_link_config_wide(intel_dp, pipe_config, +- &limits); ++ /* ++ * Optimize for slow and wide. This is the place to add alternative ++ * optimization policy. ++ */ ++ ret = intel_dp_compute_link_config_wide(intel_dp, pipe_config, &limits); + + /* enable compression if the mode doesn't fit available BW */ + if (!ret) { +diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +index dc47720c99ba..39d8509d96a0 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c ++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +@@ -48,8 +48,13 @@ static enum drm_mode_status + sun8i_dw_hdmi_mode_valid_h6(struct drm_connector *connector, + const struct drm_display_mode *mode) + { +- /* This is max for HDMI 2.0b (4K@60Hz) */ +- if (mode->clock > 594000) ++ /* ++ * Controller support maximum of 594 MHz, which correlates to ++ * 4K@60Hz 4:4:4 or RGB. However, for frequencies greater than ++ * 340 MHz scrambling has to be enabled. Because scrambling is ++ * not yet implemented, just limit to 340 MHz for now. ++ */ ++ if (mode->clock > 340000) + return MODE_CLOCK_HIGH; + + return MODE_OK; +diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c +index a63e3011e971..bd4f0b88bbd7 100644 +--- a/drivers/gpu/drm/udl/udl_drv.c ++++ b/drivers/gpu/drm/udl/udl_drv.c +@@ -51,6 +51,7 @@ static struct drm_driver driver = { + .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME, + .load = udl_driver_load, + .unload = udl_driver_unload, ++ .release = udl_driver_release, + + /* gem hooks */ + .gem_free_object_unlocked = udl_gem_free_object, +diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h +index e9e9b1ff678e..4ae67d882eae 100644 +--- a/drivers/gpu/drm/udl/udl_drv.h ++++ b/drivers/gpu/drm/udl/udl_drv.h +@@ -104,6 +104,7 @@ void udl_urb_completion(struct urb *urb); + + int udl_driver_load(struct drm_device *dev, unsigned long flags); + void udl_driver_unload(struct drm_device *dev); ++void udl_driver_release(struct drm_device *dev); + + int udl_fbdev_init(struct drm_device *dev); + void udl_fbdev_cleanup(struct drm_device *dev); +diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c +index 1b014d92855b..19055dda3140 100644 +--- a/drivers/gpu/drm/udl/udl_main.c ++++ b/drivers/gpu/drm/udl/udl_main.c +@@ -378,6 +378,12 @@ void udl_driver_unload(struct drm_device *dev) + udl_free_urb_list(dev); + + udl_fbdev_cleanup(dev); +- udl_modeset_cleanup(dev); + kfree(udl); + } ++ ++void udl_driver_release(struct drm_device *dev) ++{ ++ udl_modeset_cleanup(dev); ++ drm_dev_fini(dev); ++ kfree(dev); ++} +diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c +index f39a183d59c2..e7e946035027 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_object.c ++++ b/drivers/gpu/drm/virtio/virtgpu_object.c +@@ -28,10 +28,21 @@ + static int virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev, + uint32_t *resid) + { ++#if 0 + int handle = ida_alloc(&vgdev->resource_ida, GFP_KERNEL); + + if (handle < 0) + return handle; ++#else ++ static int handle; ++ ++ /* ++ * FIXME: dirty hack to avoid re-using IDs, virglrenderer ++ * can't deal with that. Needs fixing in virglrenderer, also ++ * should figure a better way to handle that in the guest. ++ */ ++ handle++; ++#endif + + *resid = handle + 1; + return 0; +@@ -39,7 +50,9 @@ static int virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev, + + static void virtio_gpu_resource_id_put(struct virtio_gpu_device *vgdev, uint32_t id) + { ++#if 0 + ida_free(&vgdev->resource_ida, id - 1); ++#endif + } + + static void virtio_gpu_ttm_bo_destroy(struct ttm_buffer_object *tbo) +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 15ed6177a7a3..f040c8a7f9a9 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -2608,8 +2608,9 @@ static int m560_raw_event(struct hid_device *hdev, u8 *data, int size) + input_report_rel(mydata->input, REL_Y, v); + + v = hid_snto32(data[6], 8); +- hidpp_scroll_counter_handle_scroll( +- &hidpp->vertical_wheel_counter, v); ++ if (v != 0) ++ hidpp_scroll_counter_handle_scroll( ++ &hidpp->vertical_wheel_counter, v); + + input_sync(mydata->input); + } +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 6f929bfa9fcd..d0f1dfe2bcbb 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1759,6 +1759,7 @@ config SENSORS_VT8231 + config SENSORS_W83773G + tristate "Nuvoton W83773G" + depends on I2C ++ select REGMAP_I2C + help + If you say yes here you get support for the Nuvoton W83773G hardware + monitoring chip. +diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c +index 391118c8aae8..c888f4aca45c 100644 +--- a/drivers/hwmon/occ/common.c ++++ b/drivers/hwmon/occ/common.c +@@ -889,6 +889,8 @@ static int occ_setup_sensor_attrs(struct occ *occ) + s++; + } + } ++ ++ s = (sensors->power.num_sensors * 4) + 1; + } else { + for (i = 0; i < sensors->power.num_sensors; ++i) { + s = i + 1; +@@ -917,11 +919,11 @@ static int occ_setup_sensor_attrs(struct occ *occ) + show_power, NULL, 3, i); + attr++; + } +- } + +- if (sensors->caps.num_sensors >= 1) { + s = sensors->power.num_sensors + 1; ++ } + ++ if (sensors->caps.num_sensors >= 1) { + snprintf(attr->name, sizeof(attr->name), "power%d_label", s); + attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL, + 0, 0); +diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c +index 4ee32964e1dd..948eb6e25219 100644 +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -560,7 +560,7 @@ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr, + struct ib_umem_odp *odp_mr = to_ib_umem_odp(mr->umem); + bool downgrade = flags & MLX5_PF_FLAGS_DOWNGRADE; + bool prefetch = flags & MLX5_PF_FLAGS_PREFETCH; +- u64 access_mask = ODP_READ_ALLOWED_BIT; ++ u64 access_mask; + u64 start_idx, page_mask; + struct ib_umem_odp *odp; + size_t size; +@@ -582,6 +582,7 @@ next_mr: + page_shift = mr->umem->page_shift; + page_mask = ~(BIT(page_shift) - 1); + start_idx = (io_virt - (mr->mmkey.iova & page_mask)) >> page_shift; ++ access_mask = ODP_READ_ALLOWED_BIT; + + if (prefetch && !downgrade && !mr->umem->writable) { + /* prefetch with write-access must +diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h +index 95c6d86ab5e8..c4ef1fceead6 100644 +--- a/drivers/md/dm-core.h ++++ b/drivers/md/dm-core.h +@@ -115,6 +115,7 @@ struct mapped_device { + struct srcu_struct io_barrier; + }; + ++void disable_discard(struct mapped_device *md); + void disable_write_same(struct mapped_device *md); + void disable_write_zeroes(struct mapped_device *md); + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 2e823252d797..f535fd8ac82d 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -913,7 +913,7 @@ static void copy_from_journal(struct dm_integrity_c *ic, unsigned section, unsig + static bool ranges_overlap(struct dm_integrity_range *range1, struct dm_integrity_range *range2) + { + return range1->logical_sector < range2->logical_sector + range2->n_sectors && +- range2->logical_sector + range2->n_sectors > range2->logical_sector; ++ range1->logical_sector + range1->n_sectors > range2->logical_sector; + } + + static bool add_new_range(struct dm_integrity_c *ic, struct dm_integrity_range *new_range, bool check_waiting) +@@ -959,8 +959,6 @@ static void remove_range_unlocked(struct dm_integrity_c *ic, struct dm_integrity + struct dm_integrity_range *last_range = + list_first_entry(&ic->wait_list, struct dm_integrity_range, wait_entry); + struct task_struct *last_range_task; +- if (!ranges_overlap(range, last_range)) +- break; + last_range_task = last_range->task; + list_del(&last_range->wait_entry); + if (!add_new_range(ic, last_range, false)) { +@@ -3185,7 +3183,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) + journal_watermark = val; + else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1) + sync_msec = val; +- else if (!memcmp(opt_string, "meta_device:", strlen("meta_device:"))) { ++ else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) { + if (ic->meta_dev) { + dm_put_device(ti, ic->meta_dev); + ic->meta_dev = NULL; +@@ -3204,17 +3202,17 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) + goto bad; + } + ic->sectors_per_block = val >> SECTOR_SHIFT; +- } else if (!memcmp(opt_string, "internal_hash:", strlen("internal_hash:"))) { ++ } else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) { + r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error, + "Invalid internal_hash argument"); + if (r) + goto bad; +- } else if (!memcmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) { ++ } else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) { + r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error, + "Invalid journal_crypt argument"); + if (r) + goto bad; +- } else if (!memcmp(opt_string, "journal_mac:", strlen("journal_mac:"))) { ++ } else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) { + r = get_alg_and_key(opt_string, &ic->journal_mac_alg, &ti->error, + "Invalid journal_mac argument"); + if (r) +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index a20531e5f3b4..582265e043a6 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -206,11 +206,14 @@ static void dm_done(struct request *clone, blk_status_t error, bool mapped) + } + + if (unlikely(error == BLK_STS_TARGET)) { +- if (req_op(clone) == REQ_OP_WRITE_SAME && +- !clone->q->limits.max_write_same_sectors) ++ if (req_op(clone) == REQ_OP_DISCARD && ++ !clone->q->limits.max_discard_sectors) ++ disable_discard(tio->md); ++ else if (req_op(clone) == REQ_OP_WRITE_SAME && ++ !clone->q->limits.max_write_same_sectors) + disable_write_same(tio->md); +- if (req_op(clone) == REQ_OP_WRITE_ZEROES && +- !clone->q->limits.max_write_zeroes_sectors) ++ else if (req_op(clone) == REQ_OP_WRITE_ZEROES && ++ !clone->q->limits.max_write_zeroes_sectors) + disable_write_zeroes(tio->md); + } + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 4b1be754cc41..eb257e4dcb1c 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -1852,6 +1852,36 @@ static bool dm_table_supports_secure_erase(struct dm_table *t) + return true; + } + ++static int device_requires_stable_pages(struct dm_target *ti, ++ struct dm_dev *dev, sector_t start, ++ sector_t len, void *data) ++{ ++ struct request_queue *q = bdev_get_queue(dev->bdev); ++ ++ return q && bdi_cap_stable_pages_required(q->backing_dev_info); ++} ++ ++/* ++ * If any underlying device requires stable pages, a table must require ++ * them as well. Only targets that support iterate_devices are considered: ++ * don't want error, zero, etc to require stable pages. ++ */ ++static bool dm_table_requires_stable_pages(struct dm_table *t) ++{ ++ struct dm_target *ti; ++ unsigned i; ++ ++ for (i = 0; i < dm_table_get_num_targets(t); i++) { ++ ti = dm_table_get_target(t, i); ++ ++ if (ti->type->iterate_devices && ++ ti->type->iterate_devices(ti, device_requires_stable_pages, NULL)) ++ return true; ++ } ++ ++ return false; ++} ++ + void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q, + struct queue_limits *limits) + { +@@ -1909,6 +1939,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q, + + dm_table_verify_integrity(t); + ++ /* ++ * Some devices don't use blk_integrity but still want stable pages ++ * because they do their own checksumming. ++ */ ++ if (dm_table_requires_stable_pages(t)) ++ q->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES; ++ else ++ q->backing_dev_info->capabilities &= ~BDI_CAP_STABLE_WRITES; ++ + /* + * Determine whether or not this queue's I/O timings contribute + * to the entropy pool, Only request-based targets use this. +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 515e6af9bed2..4986eea520b6 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -963,6 +963,15 @@ static void dec_pending(struct dm_io *io, blk_status_t error) + } + } + ++void disable_discard(struct mapped_device *md) ++{ ++ struct queue_limits *limits = dm_get_queue_limits(md); ++ ++ /* device doesn't really support DISCARD, disable it */ ++ limits->max_discard_sectors = 0; ++ blk_queue_flag_clear(QUEUE_FLAG_DISCARD, md->queue); ++} ++ + void disable_write_same(struct mapped_device *md) + { + struct queue_limits *limits = dm_get_queue_limits(md); +@@ -988,11 +997,14 @@ static void clone_endio(struct bio *bio) + dm_endio_fn endio = tio->ti->type->end_io; + + if (unlikely(error == BLK_STS_TARGET) && md->type != DM_TYPE_NVME_BIO_BASED) { +- if (bio_op(bio) == REQ_OP_WRITE_SAME && +- !bio->bi_disk->queue->limits.max_write_same_sectors) ++ if (bio_op(bio) == REQ_OP_DISCARD && ++ !bio->bi_disk->queue->limits.max_discard_sectors) ++ disable_discard(md); ++ else if (bio_op(bio) == REQ_OP_WRITE_SAME && ++ !bio->bi_disk->queue->limits.max_write_same_sectors) + disable_write_same(md); +- if (bio_op(bio) == REQ_OP_WRITE_ZEROES && +- !bio->bi_disk->queue->limits.max_write_zeroes_sectors) ++ else if (bio_op(bio) == REQ_OP_WRITE_ZEROES && ++ !bio->bi_disk->queue->limits.max_write_zeroes_sectors) + disable_write_zeroes(md); + } + +@@ -1060,15 +1072,7 @@ int dm_set_target_max_io_len(struct dm_target *ti, sector_t len) + return -EINVAL; + } + +- /* +- * BIO based queue uses its own splitting. When multipage bvecs +- * is switched on, size of the incoming bio may be too big to +- * be handled in some targets, such as crypt. +- * +- * When these targets are ready for the big bio, we can remove +- * the limit. +- */ +- ti->max_io_len = min_t(uint32_t, len, BIO_MAX_PAGES * PAGE_SIZE); ++ ti->max_io_len = (uint32_t) len; + + return 0; + } +diff --git a/drivers/mmc/host/alcor.c b/drivers/mmc/host/alcor.c +index 82a97866e0cf..7c8f203f9a24 100644 +--- a/drivers/mmc/host/alcor.c ++++ b/drivers/mmc/host/alcor.c +@@ -48,7 +48,6 @@ struct alcor_sdmmc_host { + struct mmc_command *cmd; + struct mmc_data *data; + unsigned int dma_on:1; +- unsigned int early_data:1; + + struct mutex cmd_mutex; + +@@ -144,8 +143,7 @@ static void alcor_data_set_dma(struct alcor_sdmmc_host *host) + host->sg_count--; + } + +-static void alcor_trigger_data_transfer(struct alcor_sdmmc_host *host, +- bool early) ++static void alcor_trigger_data_transfer(struct alcor_sdmmc_host *host) + { + struct alcor_pci_priv *priv = host->alcor_pci; + struct mmc_data *data = host->data; +@@ -155,13 +153,6 @@ static void alcor_trigger_data_transfer(struct alcor_sdmmc_host *host, + ctrl |= AU6601_DATA_WRITE; + + if (data->host_cookie == COOKIE_MAPPED) { +- if (host->early_data) { +- host->early_data = false; +- return; +- } +- +- host->early_data = early; +- + alcor_data_set_dma(host); + ctrl |= AU6601_DATA_DMA_MODE; + host->dma_on = 1; +@@ -231,6 +222,7 @@ static void alcor_prepare_sg_miter(struct alcor_sdmmc_host *host) + static void alcor_prepare_data(struct alcor_sdmmc_host *host, + struct mmc_command *cmd) + { ++ struct alcor_pci_priv *priv = host->alcor_pci; + struct mmc_data *data = cmd->data; + + if (!data) +@@ -248,7 +240,7 @@ static void alcor_prepare_data(struct alcor_sdmmc_host *host, + if (data->host_cookie != COOKIE_MAPPED) + alcor_prepare_sg_miter(host); + +- alcor_trigger_data_transfer(host, true); ++ alcor_write8(priv, 0, AU6601_DATA_XFER_CTRL); + } + + static void alcor_send_cmd(struct alcor_sdmmc_host *host, +@@ -435,7 +427,7 @@ static int alcor_cmd_irq_done(struct alcor_sdmmc_host *host, u32 intmask) + if (!host->data) + return false; + +- alcor_trigger_data_transfer(host, false); ++ alcor_trigger_data_transfer(host); + host->cmd = NULL; + return true; + } +@@ -456,7 +448,7 @@ static void alcor_cmd_irq_thread(struct alcor_sdmmc_host *host, u32 intmask) + if (!host->data) + alcor_request_complete(host, 1); + else +- alcor_trigger_data_transfer(host, false); ++ alcor_trigger_data_transfer(host); + host->cmd = NULL; + } + +@@ -487,15 +479,9 @@ static int alcor_data_irq_done(struct alcor_sdmmc_host *host, u32 intmask) + break; + case AU6601_INT_READ_BUF_RDY: + alcor_trf_block_pio(host, true); +- if (!host->blocks) +- break; +- alcor_trigger_data_transfer(host, false); + return 1; + case AU6601_INT_WRITE_BUF_RDY: + alcor_trf_block_pio(host, false); +- if (!host->blocks) +- break; +- alcor_trigger_data_transfer(host, false); + return 1; + case AU6601_INT_DMA_END: + if (!host->sg_count) +@@ -508,8 +494,14 @@ static int alcor_data_irq_done(struct alcor_sdmmc_host *host, u32 intmask) + break; + } + +- if (intmask & AU6601_INT_DATA_END) +- return 0; ++ if (intmask & AU6601_INT_DATA_END) { ++ if (!host->dma_on && host->blocks) { ++ alcor_trigger_data_transfer(host); ++ return 1; ++ } else { ++ return 0; ++ } ++ } + + return 1; + } +diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c +index c11c18a9aacb..9ec300ec94ba 100644 +--- a/drivers/mmc/host/sdhci-omap.c ++++ b/drivers/mmc/host/sdhci-omap.c +@@ -797,6 +797,43 @@ void sdhci_omap_reset(struct sdhci_host *host, u8 mask) + sdhci_reset(host, mask); + } + ++#define CMD_ERR_MASK (SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX |\ ++ SDHCI_INT_TIMEOUT) ++#define CMD_MASK (CMD_ERR_MASK | SDHCI_INT_RESPONSE) ++ ++static u32 sdhci_omap_irq(struct sdhci_host *host, u32 intmask) ++{ ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host); ++ ++ if (omap_host->is_tuning && host->cmd && !host->data_early && ++ (intmask & CMD_ERR_MASK)) { ++ ++ /* ++ * Since we are not resetting data lines during tuning ++ * operation, data error or data complete interrupts ++ * might still arrive. Mark this request as a failure ++ * but still wait for the data interrupt ++ */ ++ if (intmask & SDHCI_INT_TIMEOUT) ++ host->cmd->error = -ETIMEDOUT; ++ else ++ host->cmd->error = -EILSEQ; ++ ++ host->cmd = NULL; ++ ++ /* ++ * Sometimes command error interrupts and command complete ++ * interrupt will arrive together. Clear all command related ++ * interrupts here. ++ */ ++ sdhci_writel(host, intmask & CMD_MASK, SDHCI_INT_STATUS); ++ intmask &= ~CMD_MASK; ++ } ++ ++ return intmask; ++} ++ + static struct sdhci_ops sdhci_omap_ops = { + .set_clock = sdhci_omap_set_clock, + .set_power = sdhci_omap_set_power, +@@ -807,6 +844,7 @@ static struct sdhci_ops sdhci_omap_ops = { + .platform_send_init_74_clocks = sdhci_omap_init_74_clocks, + .reset = sdhci_omap_reset, + .set_uhs_signaling = sdhci_omap_set_uhs_signaling, ++ .irq = sdhci_omap_irq, + }; + + static int sdhci_omap_set_capabilities(struct sdhci_omap_host *omap_host) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 803f7990d32b..40ca339ec3df 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1129,6 +1129,8 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, + tpa_info = &rxr->rx_tpa[agg_id]; + + if (unlikely(cons != rxr->rx_next_cons)) { ++ netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n", ++ cons, rxr->rx_next_cons); + bnxt_sched_reset(bp, rxr); + return; + } +@@ -1581,15 +1583,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + } + + cons = rxcmp->rx_cmp_opaque; +- rx_buf = &rxr->rx_buf_ring[cons]; +- data = rx_buf->data; +- data_ptr = rx_buf->data_ptr; + if (unlikely(cons != rxr->rx_next_cons)) { + int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp); + ++ netdev_warn(bp->dev, "RX cons %x != expected cons %x\n", ++ cons, rxr->rx_next_cons); + bnxt_sched_reset(bp, rxr); + return rc1; + } ++ rx_buf = &rxr->rx_buf_ring[cons]; ++ data = rx_buf->data; ++ data_ptr = rx_buf->data_ptr; + prefetch(data_ptr); + + misc = le32_to_cpu(rxcmp->rx_cmp_misc_v1); +@@ -1606,11 +1610,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + + rx_buf->data = NULL; + if (rxcmp1->rx_cmp_cfa_code_errors_v2 & RX_CMP_L2_ERRORS) { ++ u32 rx_err = le32_to_cpu(rxcmp1->rx_cmp_cfa_code_errors_v2); ++ + bnxt_reuse_rx_data(rxr, cons, data); + if (agg_bufs) + bnxt_reuse_rx_agg_bufs(cpr, cp_cons, agg_bufs); + + rc = -EIO; ++ if (rx_err & RX_CMPL_ERRORS_BUFFER_ERROR_MASK) { ++ netdev_warn(bp->dev, "RX buffer error %x\n", rx_err); ++ bnxt_sched_reset(bp, rxr); ++ } + goto next_rx; + } + +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +index 503cfadff4ac..d4ee9f9c8c34 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -1328,10 +1328,11 @@ int nicvf_stop(struct net_device *netdev) + struct nicvf_cq_poll *cq_poll = NULL; + union nic_mbx mbx = {}; + +- cancel_delayed_work_sync(&nic->link_change_work); +- + /* wait till all queued set_rx_mode tasks completes */ +- drain_workqueue(nic->nicvf_rx_mode_wq); ++ if (nic->nicvf_rx_mode_wq) { ++ cancel_delayed_work_sync(&nic->link_change_work); ++ drain_workqueue(nic->nicvf_rx_mode_wq); ++ } + + mbx.msg.msg = NIC_MBOX_MSG_SHUTDOWN; + nicvf_send_msg_to_pf(nic, &mbx); +@@ -1452,7 +1453,8 @@ int nicvf_open(struct net_device *netdev) + struct nicvf_cq_poll *cq_poll = NULL; + + /* wait till all queued set_rx_mode tasks completes if any */ +- drain_workqueue(nic->nicvf_rx_mode_wq); ++ if (nic->nicvf_rx_mode_wq) ++ drain_workqueue(nic->nicvf_rx_mode_wq); + + netif_carrier_off(netdev); + +@@ -1550,10 +1552,12 @@ int nicvf_open(struct net_device *netdev) + /* Send VF config done msg to PF */ + nicvf_send_cfg_done(nic); + +- INIT_DELAYED_WORK(&nic->link_change_work, +- nicvf_link_status_check_task); +- queue_delayed_work(nic->nicvf_rx_mode_wq, +- &nic->link_change_work, 0); ++ if (nic->nicvf_rx_mode_wq) { ++ INIT_DELAYED_WORK(&nic->link_change_work, ++ nicvf_link_status_check_task); ++ queue_delayed_work(nic->nicvf_rx_mode_wq, ++ &nic->link_change_work, 0); ++ } + + return 0; + cleanup: +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 5ecbb1adcf3b..51cfe95f3e24 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1885,6 +1885,7 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter, + */ + adapter->state = VNIC_PROBED; + ++ reinit_completion(&adapter->init_done); + rc = init_crq_queue(adapter); + if (rc) { + netdev_err(adapter->netdev, +@@ -4625,7 +4626,7 @@ static int ibmvnic_reset_init(struct ibmvnic_adapter *adapter) + old_num_rx_queues = adapter->req_rx_queues; + old_num_tx_queues = adapter->req_tx_queues; + +- init_completion(&adapter->init_done); ++ reinit_completion(&adapter->init_done); + adapter->init_done_rc = 0; + ibmvnic_send_crq_init(adapter); + if (!wait_for_completion_timeout(&adapter->init_done, timeout)) { +@@ -4680,7 +4681,6 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter) + + adapter->from_passive_init = false; + +- init_completion(&adapter->init_done); + adapter->init_done_rc = 0; + ibmvnic_send_crq_init(adapter); + if (!wait_for_completion_timeout(&adapter->init_done, timeout)) { +@@ -4759,6 +4759,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id) + INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset); + INIT_LIST_HEAD(&adapter->rwi_list); + spin_lock_init(&adapter->rwi_lock); ++ init_completion(&adapter->init_done); + adapter->resetting = false; + + adapter->mac_change_pending = false; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +index eac245a93f91..4ab0d030b544 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +@@ -122,7 +122,9 @@ out: + return err; + } + +-/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B]) */ ++/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B]) ++ * minimum speed value is 40Gbps ++ */ + static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu) + { + u32 speed; +@@ -130,10 +132,9 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu) + int err; + + err = mlx5e_port_linkspeed(priv->mdev, &speed); +- if (err) { +- mlx5_core_warn(priv->mdev, "cannot get port speed\n"); +- return 0; +- } ++ if (err) ++ speed = SPEED_40000; ++ speed = max_t(u32, speed, SPEED_40000); + + xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100; + +@@ -142,7 +143,7 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu) + } + + static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer, +- u32 xoff, unsigned int mtu) ++ u32 xoff, unsigned int max_mtu) + { + int i; + +@@ -154,11 +155,12 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer, + } + + if (port_buffer->buffer[i].size < +- (xoff + mtu + (1 << MLX5E_BUFFER_CELL_SHIFT))) ++ (xoff + max_mtu + (1 << MLX5E_BUFFER_CELL_SHIFT))) + return -ENOMEM; + + port_buffer->buffer[i].xoff = port_buffer->buffer[i].size - xoff; +- port_buffer->buffer[i].xon = port_buffer->buffer[i].xoff - mtu; ++ port_buffer->buffer[i].xon = ++ port_buffer->buffer[i].xoff - max_mtu; + } + + return 0; +@@ -166,7 +168,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer, + + /** + * update_buffer_lossy() +- * mtu: device's MTU ++ * max_mtu: netdev's max_mtu + * pfc_en: current pfc configuration + * buffer: current prio to buffer mapping + * xoff: xoff value +@@ -183,7 +185,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer, + * Return 0 if no error. + * Set change to true if buffer configuration is modified. + */ +-static int update_buffer_lossy(unsigned int mtu, ++static int update_buffer_lossy(unsigned int max_mtu, + u8 pfc_en, u8 *buffer, u32 xoff, + struct mlx5e_port_buffer *port_buffer, + bool *change) +@@ -220,7 +222,7 @@ static int update_buffer_lossy(unsigned int mtu, + } + + if (changed) { +- err = update_xoff_threshold(port_buffer, xoff, mtu); ++ err = update_xoff_threshold(port_buffer, xoff, max_mtu); + if (err) + return err; + +@@ -230,6 +232,7 @@ static int update_buffer_lossy(unsigned int mtu, + return 0; + } + ++#define MINIMUM_MAX_MTU 9216 + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, +@@ -241,12 +244,14 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + bool update_prio2buffer = false; + u8 buffer[MLX5E_MAX_PRIORITY]; + bool update_buffer = false; ++ unsigned int max_mtu; + u32 total_used = 0; + u8 curr_pfc_en; + int err; + int i; + + mlx5e_dbg(HW, priv, "%s: change=%x\n", __func__, change); ++ max_mtu = max_t(unsigned int, priv->netdev->max_mtu, MINIMUM_MAX_MTU); + + err = mlx5e_port_query_buffer(priv, &port_buffer); + if (err) +@@ -254,7 +259,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + + if (change & MLX5E_PORT_BUFFER_CABLE_LEN) { + update_buffer = true; +- err = update_xoff_threshold(&port_buffer, xoff, mtu); ++ err = update_xoff_threshold(&port_buffer, xoff, max_mtu); + if (err) + return err; + } +@@ -264,7 +269,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + if (err) + return err; + +- err = update_buffer_lossy(mtu, pfc->pfc_en, buffer, xoff, ++ err = update_buffer_lossy(max_mtu, pfc->pfc_en, buffer, xoff, + &port_buffer, &update_buffer); + if (err) + return err; +@@ -276,8 +281,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + if (err) + return err; + +- err = update_buffer_lossy(mtu, curr_pfc_en, prio2buffer, xoff, +- &port_buffer, &update_buffer); ++ err = update_buffer_lossy(max_mtu, curr_pfc_en, prio2buffer, ++ xoff, &port_buffer, &update_buffer); + if (err) + return err; + } +@@ -301,7 +306,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + return -EINVAL; + + update_buffer = true; +- err = update_xoff_threshold(&port_buffer, xoff, mtu); ++ err = update_xoff_threshold(&port_buffer, xoff, max_mtu); + if (err) + return err; + } +@@ -309,7 +314,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + /* Need to update buffer configuration if xoff value is changed */ + if (!update_buffer && xoff != priv->dcbx.xoff) { + update_buffer = true; +- err = update_xoff_threshold(&port_buffer, xoff, mtu); ++ err = update_xoff_threshold(&port_buffer, xoff, max_mtu); + if (err) + return err; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c +index 3078491cc0d0..1539cf3de5dc 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c +@@ -45,7 +45,9 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev, + if (err) + return err; + ++ mutex_lock(&mdev->mlx5e_res.td.list_lock); + list_add(&tir->list, &mdev->mlx5e_res.td.tirs_list); ++ mutex_unlock(&mdev->mlx5e_res.td.list_lock); + + return 0; + } +@@ -53,8 +55,10 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev, + void mlx5e_destroy_tir(struct mlx5_core_dev *mdev, + struct mlx5e_tir *tir) + { ++ mutex_lock(&mdev->mlx5e_res.td.list_lock); + mlx5_core_destroy_tir(mdev, tir->tirn); + list_del(&tir->list); ++ mutex_unlock(&mdev->mlx5e_res.td.list_lock); + } + + static int mlx5e_create_mkey(struct mlx5_core_dev *mdev, u32 pdn, +@@ -114,6 +118,7 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev) + } + + INIT_LIST_HEAD(&mdev->mlx5e_res.td.tirs_list); ++ mutex_init(&mdev->mlx5e_res.td.list_lock); + + return 0; + +@@ -141,15 +146,17 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb) + { + struct mlx5_core_dev *mdev = priv->mdev; + struct mlx5e_tir *tir; +- int err = -ENOMEM; ++ int err = 0; + u32 tirn = 0; + int inlen; + void *in; + + inlen = MLX5_ST_SZ_BYTES(modify_tir_in); + in = kvzalloc(inlen, GFP_KERNEL); +- if (!in) ++ if (!in) { ++ err = -ENOMEM; + goto out; ++ } + + if (enable_uc_lb) + MLX5_SET(modify_tir_in, in, ctx.self_lb_block, +@@ -157,6 +164,7 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb) + + MLX5_SET(modify_tir_in, in, bitmask.self_lb_en, 1); + ++ mutex_lock(&mdev->mlx5e_res.td.list_lock); + list_for_each_entry(tir, &mdev->mlx5e_res.td.tirs_list, list) { + tirn = tir->tirn; + err = mlx5_core_modify_tir(mdev, tirn, in, inlen); +@@ -168,6 +176,7 @@ out: + kvfree(in); + if (err) + netdev_err(priv->netdev, "refresh tir(0x%x) failed, %d\n", tirn, err); ++ mutex_unlock(&mdev->mlx5e_res.td.list_lock); + + return err; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c +index 5cf5f2a9d51f..8de64e88c670 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c +@@ -217,15 +217,21 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq, + void *cmd; + int ret; + ++ rcu_read_lock(); ++ flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle)); ++ rcu_read_unlock(); ++ ++ if (!flow) { ++ WARN_ONCE(1, "Received NULL pointer for handle\n"); ++ return -EINVAL; ++ } ++ + buf = kzalloc(size, GFP_ATOMIC); + if (!buf) + return -ENOMEM; + + cmd = (buf + 1); + +- rcu_read_lock(); +- flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle)); +- rcu_read_unlock(); + mlx5_fpga_tls_flow_to_cmd(flow, cmd); + + MLX5_SET(tls_cmd, cmd, swid, ntohl(handle)); +@@ -238,6 +244,8 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq, + buf->complete = mlx_tls_kfree_complete; + + ret = mlx5_fpga_sbu_conn_sendmsg(mdev->fpga->tls->conn, buf); ++ if (ret < 0) ++ kfree(buf); + + return ret; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index be81b319b0dc..694edd899322 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -163,26 +163,6 @@ static struct mlx5_profile profile[] = { + .size = 8, + .limit = 4 + }, +- .mr_cache[16] = { +- .size = 8, +- .limit = 4 +- }, +- .mr_cache[17] = { +- .size = 8, +- .limit = 4 +- }, +- .mr_cache[18] = { +- .size = 8, +- .limit = 4 +- }, +- .mr_cache[19] = { +- .size = 4, +- .limit = 2 +- }, +- .mr_cache[20] = { +- .size = 4, +- .limit = 2 +- }, + }, + }; + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c +index 69d7aebda09b..73db94e55fd0 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c +@@ -196,7 +196,7 @@ static netdev_tx_t nfp_repr_xmit(struct sk_buff *skb, struct net_device *netdev) + ret = dev_queue_xmit(skb); + nfp_repr_inc_tx_stats(netdev, len, ret); + +- return ret; ++ return NETDEV_TX_OK; + } + + static int nfp_repr_stop(struct net_device *netdev) +@@ -384,7 +384,7 @@ int nfp_repr_init(struct nfp_app *app, struct net_device *netdev, + netdev->features &= ~(NETIF_F_TSO | NETIF_F_TSO6); + netdev->gso_max_segs = NFP_NET_LSO_MAX_SEGS; + +- netdev->priv_flags |= IFF_NO_QUEUE; ++ netdev->priv_flags |= IFF_NO_QUEUE | IFF_DISABLE_NETPOLL; + netdev->features |= NETIF_F_LLTX; + + if (nfp_app_has_tc(app)) { +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index f55d177ae894..365cddbfc684 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -5332,7 +5333,7 @@ static void rtl_hw_start_8168(struct rtl8169_private *tp) + tp->cp_cmd |= PktCntrDisable | INTT_1; + RTL_W16(tp, CPlusCmd, tp->cp_cmd); + +- RTL_W16(tp, IntrMitigate, 0x5151); ++ RTL_W16(tp, IntrMitigate, 0x5100); + + /* Work around for RxFIFO overflow. */ + if (tp->mac_version == RTL_GIGA_MAC_VER_11) { +@@ -7224,6 +7225,11 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + return rc; + } + ++ /* Disable ASPM completely as that cause random device stop working ++ * problems as well as full system hangs for some PCIe devices users. ++ */ ++ pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1); ++ + /* enable device (incl. PCI PM wakeup and hotplug setup) */ + rc = pcim_enable_device(pdev); + if (rc < 0) { +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index e859ae2e42d5..49f41b64077b 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -987,6 +987,7 @@ struct netvsc_device { + + wait_queue_head_t wait_drain; + bool destroy; ++ bool tx_disable; /* if true, do not wake up queue again */ + + /* Receive buffer allocated by us but manages by NetVSP */ + void *recv_buf; +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 813d195bbd57..e0dce373cdd9 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -110,6 +110,7 @@ static struct netvsc_device *alloc_net_device(void) + + init_waitqueue_head(&net_device->wait_drain); + net_device->destroy = false; ++ net_device->tx_disable = false; + + net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT; + net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT; +@@ -719,7 +720,7 @@ static void netvsc_send_tx_complete(struct net_device *ndev, + } else { + struct netdev_queue *txq = netdev_get_tx_queue(ndev, q_idx); + +- if (netif_tx_queue_stopped(txq) && ++ if (netif_tx_queue_stopped(txq) && !net_device->tx_disable && + (hv_get_avail_to_write_percent(&channel->outbound) > + RING_AVAIL_PERCENT_HIWATER || queue_sends < 1)) { + netif_tx_wake_queue(txq); +@@ -874,7 +875,8 @@ static inline int netvsc_send_pkt( + } else if (ret == -EAGAIN) { + netif_tx_stop_queue(txq); + ndev_ctx->eth_stats.stop_queue++; +- if (atomic_read(&nvchan->queue_sends) < 1) { ++ if (atomic_read(&nvchan->queue_sends) < 1 && ++ !net_device->tx_disable) { + netif_tx_wake_queue(txq); + ndev_ctx->eth_stats.wake_queue++; + ret = -ENOSPC; +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index cf4897043e83..b20fb0fb595b 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -109,6 +109,15 @@ static void netvsc_set_rx_mode(struct net_device *net) + rcu_read_unlock(); + } + ++static void netvsc_tx_enable(struct netvsc_device *nvscdev, ++ struct net_device *ndev) ++{ ++ nvscdev->tx_disable = false; ++ virt_wmb(); /* ensure queue wake up mechanism is on */ ++ ++ netif_tx_wake_all_queues(ndev); ++} ++ + static int netvsc_open(struct net_device *net) + { + struct net_device_context *ndev_ctx = netdev_priv(net); +@@ -129,7 +138,7 @@ static int netvsc_open(struct net_device *net) + rdev = nvdev->extension; + if (!rdev->link_state) { + netif_carrier_on(net); +- netif_tx_wake_all_queues(net); ++ netvsc_tx_enable(nvdev, net); + } + + if (vf_netdev) { +@@ -184,6 +193,17 @@ static int netvsc_wait_until_empty(struct netvsc_device *nvdev) + } + } + ++static void netvsc_tx_disable(struct netvsc_device *nvscdev, ++ struct net_device *ndev) ++{ ++ if (nvscdev) { ++ nvscdev->tx_disable = true; ++ virt_wmb(); /* ensure txq will not wake up after stop */ ++ } ++ ++ netif_tx_disable(ndev); ++} ++ + static int netvsc_close(struct net_device *net) + { + struct net_device_context *net_device_ctx = netdev_priv(net); +@@ -192,7 +212,7 @@ static int netvsc_close(struct net_device *net) + struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev); + int ret; + +- netif_tx_disable(net); ++ netvsc_tx_disable(nvdev, net); + + /* No need to close rndis filter if it is removed already */ + if (!nvdev) +@@ -920,7 +940,7 @@ static int netvsc_detach(struct net_device *ndev, + + /* If device was up (receiving) then shutdown */ + if (netif_running(ndev)) { +- netif_tx_disable(ndev); ++ netvsc_tx_disable(nvdev, ndev); + + ret = rndis_filter_close(nvdev); + if (ret) { +@@ -1908,7 +1928,7 @@ static void netvsc_link_change(struct work_struct *w) + if (rdev->link_state) { + rdev->link_state = false; + netif_carrier_on(net); +- netif_tx_wake_all_queues(net); ++ netvsc_tx_enable(net_device, net); + } else { + notify = true; + } +@@ -1918,7 +1938,7 @@ static void netvsc_link_change(struct work_struct *w) + if (!rdev->link_state) { + rdev->link_state = true; + netif_carrier_off(net); +- netif_tx_stop_all_queues(net); ++ netvsc_tx_disable(net_device, net); + } + kfree(event); + break; +@@ -1927,7 +1947,7 @@ static void netvsc_link_change(struct work_struct *w) + if (!rdev->link_state) { + rdev->link_state = true; + netif_carrier_off(net); +- netif_tx_stop_all_queues(net); ++ netvsc_tx_disable(net_device, net); + event->event = RNDIS_STATUS_MEDIA_CONNECT; + spin_lock_irqsave(&ndev_ctx->lock, flags); + list_add(&event->list, &ndev_ctx->reconfig_events); +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 74bebbdb4b15..9195f3476b1d 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1203,6 +1203,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ + {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ + {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */ ++ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */ + {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 6d1a1abbed27..cd15c32b2e43 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -1275,8 +1275,12 @@ static void vrf_setup(struct net_device *dev) + dev->priv_flags |= IFF_NO_QUEUE; + dev->priv_flags |= IFF_NO_RX_HANDLER; + +- dev->min_mtu = 0; +- dev->max_mtu = 0; ++ /* VRF devices do not care about MTU, but if the MTU is set ++ * too low then the ipv4 and ipv6 protocols are disabled ++ * which breaks networking. ++ */ ++ dev->min_mtu = IPV6_MIN_MTU; ++ dev->max_mtu = ETH_MAX_MTU; + } + + static int vrf_validate(struct nlattr *tb[], struct nlattr *data[], +diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c +index 3f3df4c29f6e..905282a8ddaa 100644 +--- a/drivers/pci/hotplug/pciehp_ctrl.c ++++ b/drivers/pci/hotplug/pciehp_ctrl.c +@@ -115,6 +115,10 @@ static void remove_board(struct controller *ctrl, bool safe_removal) + * removed from the slot/adapter. + */ + msleep(1000); ++ ++ /* Ignore link or presence changes caused by power off */ ++ atomic_and(~(PCI_EXP_SLTSTA_DLLSC | PCI_EXP_SLTSTA_PDC), ++ &ctrl->pending_events); + } + + /* turn off Green LED */ +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index e2a879e93d86..fba03a7d5c7f 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3877,6 +3877,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128, + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130, + quirk_dma_func1_alias); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9170, ++ quirk_dma_func1_alias); + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c47 + c57 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9172, + quirk_dma_func1_alias); +diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig +index 0840d27381ea..e0a04bfc873e 100644 +--- a/drivers/tty/Kconfig ++++ b/drivers/tty/Kconfig +@@ -441,4 +441,28 @@ config VCC + depends on SUN_LDOMS + help + Support for Sun logical domain consoles. ++ ++config LDISC_AUTOLOAD ++ bool "Automatically load TTY Line Disciplines" ++ default y ++ help ++ Historically the kernel has always automatically loaded any ++ line discipline that is in a kernel module when a user asks ++ for it to be loaded with the TIOCSETD ioctl, or through other ++ means. This is not always the best thing to do on systems ++ where you know you will not be using some of the more ++ "ancient" line disciplines, so prevent the kernel from doing ++ this unless the request is coming from a process with the ++ CAP_SYS_MODULE permissions. ++ ++ Say 'Y' here if you trust your userspace users to do the right ++ thing, or if you have only provided the line disciplines that ++ you know you will be using, or if you wish to continue to use ++ the traditional method of on-demand loading of these modules ++ by any user. ++ ++ This functionality can be changed at runtime with the ++ dev.tty.ldisc_autoload sysctl, this configuration option will ++ only set the default value of this functionality. ++ + endif # TTY +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 21ffcce16927..5fa250157025 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -513,6 +513,8 @@ static const struct file_operations hung_up_tty_fops = { + static DEFINE_SPINLOCK(redirect_lock); + static struct file *redirect; + ++extern void tty_sysctl_init(void); ++ + /** + * tty_wakeup - request more data + * @tty: terminal +@@ -3483,6 +3485,7 @@ void console_sysfs_notify(void) + */ + int __init tty_init(void) + { ++ tty_sysctl_init(); + cdev_init(&tty_cdev, &tty_fops); + if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) || + register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0) +diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c +index 45eda69b150c..e38f104db174 100644 +--- a/drivers/tty/tty_ldisc.c ++++ b/drivers/tty/tty_ldisc.c +@@ -156,6 +156,13 @@ static void put_ldops(struct tty_ldisc_ops *ldops) + * takes tty_ldiscs_lock to guard against ldisc races + */ + ++#if defined(CONFIG_LDISC_AUTOLOAD) ++ #define INITIAL_AUTOLOAD_STATE 1 ++#else ++ #define INITIAL_AUTOLOAD_STATE 0 ++#endif ++static int tty_ldisc_autoload = INITIAL_AUTOLOAD_STATE; ++ + static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc) + { + struct tty_ldisc *ld; +@@ -170,6 +177,8 @@ static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc) + */ + ldops = get_ldops(disc); + if (IS_ERR(ldops)) { ++ if (!capable(CAP_SYS_MODULE) && !tty_ldisc_autoload) ++ return ERR_PTR(-EPERM); + request_module("tty-ldisc-%d", disc); + ldops = get_ldops(disc); + if (IS_ERR(ldops)) +@@ -845,3 +854,41 @@ void tty_ldisc_deinit(struct tty_struct *tty) + tty_ldisc_put(tty->ldisc); + tty->ldisc = NULL; + } ++ ++static int zero; ++static int one = 1; ++static struct ctl_table tty_table[] = { ++ { ++ .procname = "ldisc_autoload", ++ .data = &tty_ldisc_autoload, ++ .maxlen = sizeof(tty_ldisc_autoload), ++ .mode = 0644, ++ .proc_handler = proc_dointvec, ++ .extra1 = &zero, ++ .extra2 = &one, ++ }, ++ { } ++}; ++ ++static struct ctl_table tty_dir_table[] = { ++ { ++ .procname = "tty", ++ .mode = 0555, ++ .child = tty_table, ++ }, ++ { } ++}; ++ ++static struct ctl_table tty_root_table[] = { ++ { ++ .procname = "dev", ++ .mode = 0555, ++ .child = tty_dir_table, ++ }, ++ { } ++}; ++ ++void tty_sysctl_init(void) ++{ ++ register_sysctl_table(tty_root_table); ++} +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index a0b07c331255..a38b65b97be0 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -871,6 +871,8 @@ static struct virtqueue *vring_create_virtqueue_split( + GFP_KERNEL|__GFP_NOWARN|__GFP_ZERO); + if (queue) + break; ++ if (!may_reduce_num) ++ return NULL; + } + + if (!num) +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 58a4c1217fa8..06ef48ad1998 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -298,10 +298,10 @@ static void blkdev_bio_end_io(struct bio *bio) + struct blkdev_dio *dio = bio->bi_private; + bool should_dirty = dio->should_dirty; + +- if (dio->multi_bio && !atomic_dec_and_test(&dio->ref)) { +- if (bio->bi_status && !dio->bio.bi_status) +- dio->bio.bi_status = bio->bi_status; +- } else { ++ if (bio->bi_status && !dio->bio.bi_status) ++ dio->bio.bi_status = bio->bi_status; ++ ++ if (!dio->multi_bio || atomic_dec_and_test(&dio->ref)) { + if (!dio->is_sync) { + struct kiocb *iocb = dio->iocb; + ssize_t ret; +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 6e1119496721..1d64a6b8e413 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -501,6 +501,16 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + ++ /* ++ * If the fs is mounted with nologreplay, which requires it to be ++ * mounted in RO mode as well, we can not allow discard on free space ++ * inside block groups, because log trees refer to extents that are not ++ * pinned in a block group's free space cache (pinning the extents is ++ * precisely the first phase of replaying a log tree). ++ */ ++ if (btrfs_test_opt(fs_info, NOLOGREPLAY)) ++ return -EROFS; ++ + rcu_read_lock(); + list_for_each_entry_rcu(device, &fs_info->fs_devices->devices, + dev_list) { +diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c +index dc6140013ae8..61d22a56c0ba 100644 +--- a/fs/btrfs/props.c ++++ b/fs/btrfs/props.c +@@ -366,11 +366,11 @@ int btrfs_subvol_inherit_props(struct btrfs_trans_handle *trans, + + static int prop_compression_validate(const char *value, size_t len) + { +- if (!strncmp("lzo", value, len)) ++ if (!strncmp("lzo", value, 3)) + return 0; +- else if (!strncmp("zlib", value, len)) ++ else if (!strncmp("zlib", value, 4)) + return 0; +- else if (!strncmp("zstd", value, len)) ++ else if (!strncmp("zstd", value, 4)) + return 0; + + return -EINVAL; +@@ -396,7 +396,7 @@ static int prop_compression_apply(struct inode *inode, + btrfs_set_fs_incompat(fs_info, COMPRESS_LZO); + } else if (!strncmp("zlib", value, 4)) { + type = BTRFS_COMPRESS_ZLIB; +- } else if (!strncmp("zstd", value, len)) { ++ } else if (!strncmp("zstd", value, 4)) { + type = BTRFS_COMPRESS_ZSTD; + btrfs_set_fs_incompat(fs_info, COMPRESS_ZSTD); + } else { +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index f2c0d863fb52..07cad54b84f1 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -559,6 +559,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root) + tcon->ses->server->echo_interval / HZ); + if (tcon->snapshot_time) + seq_printf(s, ",snapshot=%llu", tcon->snapshot_time); ++ if (tcon->handle_timeout) ++ seq_printf(s, ",handletimeout=%u", tcon->handle_timeout); + /* convert actimeo and display it in seconds */ + seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ); + +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 1b25e6e95d45..6c934ab3722b 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -59,6 +59,12 @@ + */ + #define CIFS_MAX_ACTIMEO (1 << 30) + ++/* ++ * Max persistent and resilient handle timeout (milliseconds). ++ * Windows durable max was 960000 (16 minutes) ++ */ ++#define SMB3_MAX_HANDLE_TIMEOUT 960000 ++ + /* + * MAX_REQ is the maximum number of requests that WE will send + * on one socket concurrently. +@@ -572,6 +578,7 @@ struct smb_vol { + struct nls_table *local_nls; + unsigned int echo_interval; /* echo interval in secs */ + __u64 snapshot_time; /* needed for timewarp tokens */ ++ __u32 handle_timeout; /* persistent and durable handle timeout in ms */ + unsigned int max_credits; /* smb3 max_credits 10 < credits < 60000 */ + }; + +@@ -1028,6 +1035,7 @@ struct cifs_tcon { + __u32 vol_serial_number; + __le64 vol_create_time; + __u64 snapshot_time; /* for timewarp tokens - timestamp of snapshot */ ++ __u32 handle_timeout; /* persistent and durable handle timeout in ms */ + __u32 ss_flags; /* sector size flags */ + __u32 perf_sector_size; /* best sector size for perf */ + __u32 max_chunks; +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 9d4e60123db4..44e6ec85f832 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -103,7 +103,7 @@ enum { + Opt_cruid, Opt_gid, Opt_file_mode, + Opt_dirmode, Opt_port, + Opt_blocksize, Opt_rsize, Opt_wsize, Opt_actimeo, +- Opt_echo_interval, Opt_max_credits, ++ Opt_echo_interval, Opt_max_credits, Opt_handletimeout, + Opt_snapshot, + + /* Mount options which take string value */ +@@ -208,6 +208,7 @@ static const match_table_t cifs_mount_option_tokens = { + { Opt_rsize, "rsize=%s" }, + { Opt_wsize, "wsize=%s" }, + { Opt_actimeo, "actimeo=%s" }, ++ { Opt_handletimeout, "handletimeout=%s" }, + { Opt_echo_interval, "echo_interval=%s" }, + { Opt_max_credits, "max_credits=%s" }, + { Opt_snapshot, "snapshot=%s" }, +@@ -1600,6 +1601,9 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, + + vol->actimeo = CIFS_DEF_ACTIMEO; + ++ /* Most clients set timeout to 0, allows server to use its default */ ++ vol->handle_timeout = 0; /* See MS-SMB2 spec section 2.2.14.2.12 */ ++ + /* offer SMB2.1 and later (SMB3 etc). Secure and widely accepted */ + vol->ops = &smb30_operations; + vol->vals = &smbdefault_values; +@@ -1998,6 +2002,18 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, + goto cifs_parse_mount_err; + } + break; ++ case Opt_handletimeout: ++ if (get_option_ul(args, &option)) { ++ cifs_dbg(VFS, "%s: Invalid handletimeout value\n", ++ __func__); ++ goto cifs_parse_mount_err; ++ } ++ vol->handle_timeout = option; ++ if (vol->handle_timeout > SMB3_MAX_HANDLE_TIMEOUT) { ++ cifs_dbg(VFS, "Invalid handle cache timeout, longer than 16 minutes\n"); ++ goto cifs_parse_mount_err; ++ } ++ break; + case Opt_echo_interval: + if (get_option_ul(args, &option)) { + cifs_dbg(VFS, "%s: Invalid echo interval value\n", +@@ -3164,6 +3180,8 @@ static int match_tcon(struct cifs_tcon *tcon, struct smb_vol *volume_info) + return 0; + if (tcon->snapshot_time != volume_info->snapshot_time) + return 0; ++ if (tcon->handle_timeout != volume_info->handle_timeout) ++ return 0; + return 1; + } + +@@ -3278,6 +3296,16 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info) + tcon->snapshot_time = volume_info->snapshot_time; + } + ++ if (volume_info->handle_timeout) { ++ if (ses->server->vals->protocol_id == 0) { ++ cifs_dbg(VFS, ++ "Use SMB2.1 or later for handle timeout option\n"); ++ rc = -EOPNOTSUPP; ++ goto out_fail; ++ } else ++ tcon->handle_timeout = volume_info->handle_timeout; ++ } ++ + tcon->ses = ses; + if (volume_info->password) { + tcon->password = kstrdup(volume_info->password, GFP_KERNEL); +diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c +index b204e84b87fb..b0e76d27d752 100644 +--- a/fs/cifs/smb2file.c ++++ b/fs/cifs/smb2file.c +@@ -68,7 +68,9 @@ smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, + + + if (oparms->tcon->use_resilient) { +- nr_ioctl_req.Timeout = 0; /* use server default (120 seconds) */ ++ /* default timeout is 0, servers pick default (120 seconds) */ ++ nr_ioctl_req.Timeout = ++ cpu_to_le32(oparms->tcon->handle_timeout); + nr_ioctl_req.Reserved = 0; + rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid, + fid->volatile_fid, FSCTL_LMR_REQUEST_RESILIENCY, +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 53642a237bf9..068febe37fe4 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1837,8 +1837,9 @@ add_lease_context(struct TCP_Server_Info *server, struct kvec *iov, + } + + static struct create_durable_v2 * +-create_durable_v2_buf(struct cifs_fid *pfid) ++create_durable_v2_buf(struct cifs_open_parms *oparms) + { ++ struct cifs_fid *pfid = oparms->fid; + struct create_durable_v2 *buf; + + buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL); +@@ -1852,7 +1853,14 @@ create_durable_v2_buf(struct cifs_fid *pfid) + (struct create_durable_v2, Name)); + buf->ccontext.NameLength = cpu_to_le16(4); + +- buf->dcontext.Timeout = 0; /* Should this be configurable by workload */ ++ /* ++ * NB: Handle timeout defaults to 0, which allows server to choose ++ * (most servers default to 120 seconds) and most clients default to 0. ++ * This can be overridden at mount ("handletimeout=") if the user wants ++ * a different persistent (or resilient) handle timeout for all opens ++ * opens on a particular SMB3 mount. ++ */ ++ buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); + buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); + generate_random_uuid(buf->dcontext.CreateGuid); + memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); +@@ -1905,7 +1913,7 @@ add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, + struct smb2_create_req *req = iov[0].iov_base; + unsigned int num = *num_iovec; + +- iov[num].iov_base = create_durable_v2_buf(oparms->fid); ++ iov[num].iov_base = create_durable_v2_buf(oparms); + if (iov[num].iov_base == NULL) + return -ENOMEM; + iov[num].iov_len = sizeof(struct create_durable_v2); +diff --git a/include/linux/bitrev.h b/include/linux/bitrev.h +index 50fb0dee23e8..d35b8ec1c485 100644 +--- a/include/linux/bitrev.h ++++ b/include/linux/bitrev.h +@@ -34,41 +34,41 @@ static inline u32 __bitrev32(u32 x) + + #define __constant_bitrev32(x) \ + ({ \ +- u32 __x = x; \ +- __x = (__x >> 16) | (__x << 16); \ +- __x = ((__x & (u32)0xFF00FF00UL) >> 8) | ((__x & (u32)0x00FF00FFUL) << 8); \ +- __x = ((__x & (u32)0xF0F0F0F0UL) >> 4) | ((__x & (u32)0x0F0F0F0FUL) << 4); \ +- __x = ((__x & (u32)0xCCCCCCCCUL) >> 2) | ((__x & (u32)0x33333333UL) << 2); \ +- __x = ((__x & (u32)0xAAAAAAAAUL) >> 1) | ((__x & (u32)0x55555555UL) << 1); \ +- __x; \ ++ u32 ___x = x; \ ++ ___x = (___x >> 16) | (___x << 16); \ ++ ___x = ((___x & (u32)0xFF00FF00UL) >> 8) | ((___x & (u32)0x00FF00FFUL) << 8); \ ++ ___x = ((___x & (u32)0xF0F0F0F0UL) >> 4) | ((___x & (u32)0x0F0F0F0FUL) << 4); \ ++ ___x = ((___x & (u32)0xCCCCCCCCUL) >> 2) | ((___x & (u32)0x33333333UL) << 2); \ ++ ___x = ((___x & (u32)0xAAAAAAAAUL) >> 1) | ((___x & (u32)0x55555555UL) << 1); \ ++ ___x; \ + }) + + #define __constant_bitrev16(x) \ + ({ \ +- u16 __x = x; \ +- __x = (__x >> 8) | (__x << 8); \ +- __x = ((__x & (u16)0xF0F0U) >> 4) | ((__x & (u16)0x0F0FU) << 4); \ +- __x = ((__x & (u16)0xCCCCU) >> 2) | ((__x & (u16)0x3333U) << 2); \ +- __x = ((__x & (u16)0xAAAAU) >> 1) | ((__x & (u16)0x5555U) << 1); \ +- __x; \ ++ u16 ___x = x; \ ++ ___x = (___x >> 8) | (___x << 8); \ ++ ___x = ((___x & (u16)0xF0F0U) >> 4) | ((___x & (u16)0x0F0FU) << 4); \ ++ ___x = ((___x & (u16)0xCCCCU) >> 2) | ((___x & (u16)0x3333U) << 2); \ ++ ___x = ((___x & (u16)0xAAAAU) >> 1) | ((___x & (u16)0x5555U) << 1); \ ++ ___x; \ + }) + + #define __constant_bitrev8x4(x) \ + ({ \ +- u32 __x = x; \ +- __x = ((__x & (u32)0xF0F0F0F0UL) >> 4) | ((__x & (u32)0x0F0F0F0FUL) << 4); \ +- __x = ((__x & (u32)0xCCCCCCCCUL) >> 2) | ((__x & (u32)0x33333333UL) << 2); \ +- __x = ((__x & (u32)0xAAAAAAAAUL) >> 1) | ((__x & (u32)0x55555555UL) << 1); \ +- __x; \ ++ u32 ___x = x; \ ++ ___x = ((___x & (u32)0xF0F0F0F0UL) >> 4) | ((___x & (u32)0x0F0F0F0FUL) << 4); \ ++ ___x = ((___x & (u32)0xCCCCCCCCUL) >> 2) | ((___x & (u32)0x33333333UL) << 2); \ ++ ___x = ((___x & (u32)0xAAAAAAAAUL) >> 1) | ((___x & (u32)0x55555555UL) << 1); \ ++ ___x; \ + }) + + #define __constant_bitrev8(x) \ + ({ \ +- u8 __x = x; \ +- __x = (__x >> 4) | (__x << 4); \ +- __x = ((__x & (u8)0xCCU) >> 2) | ((__x & (u8)0x33U) << 2); \ +- __x = ((__x & (u8)0xAAU) >> 1) | ((__x & (u8)0x55U) << 1); \ +- __x; \ ++ u8 ___x = x; \ ++ ___x = (___x >> 4) | (___x << 4); \ ++ ___x = ((___x & (u8)0xCCU) >> 2) | ((___x & (u8)0x33U) << 2); \ ++ ___x = ((___x & (u8)0xAAU) >> 1) | ((___x & (u8)0x55U) << 1); \ ++ ___x; \ + }) + + #define bitrev32(x) \ +diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h +index 83ae11cbd12c..7391f5fe4eda 100644 +--- a/include/linux/memcontrol.h ++++ b/include/linux/memcontrol.h +@@ -561,7 +561,10 @@ struct mem_cgroup *lock_page_memcg(struct page *page); + void __unlock_page_memcg(struct mem_cgroup *memcg); + void unlock_page_memcg(struct page *page); + +-/* idx can be of type enum memcg_stat_item or node_stat_item */ ++/* ++ * idx can be of type enum memcg_stat_item or node_stat_item. ++ * Keep in sync with memcg_exact_page_state(). ++ */ + static inline unsigned long memcg_page_state(struct mem_cgroup *memcg, + int idx) + { +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index 54299251d40d..4f001619f854 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -591,6 +591,8 @@ enum mlx5_pagefault_type_flags { + }; + + struct mlx5_td { ++ /* protects tirs list changes while tirs refresh */ ++ struct mutex list_lock; + struct list_head tirs_list; + u32 tdn; + }; +diff --git a/include/linux/string.h b/include/linux/string.h +index 7927b875f80c..6ab0a6fa512e 100644 +--- a/include/linux/string.h ++++ b/include/linux/string.h +@@ -150,6 +150,9 @@ extern void * memscan(void *,int,__kernel_size_t); + #ifndef __HAVE_ARCH_MEMCMP + extern int memcmp(const void *,const void *,__kernel_size_t); + #endif ++#ifndef __HAVE_ARCH_BCMP ++extern int bcmp(const void *,const void *,__kernel_size_t); ++#endif + #ifndef __HAVE_ARCH_MEMCHR + extern void * memchr(const void *,int,__kernel_size_t); + #endif +diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h +index fab02133a919..3dc70adfe5f5 100644 +--- a/include/linux/virtio_ring.h ++++ b/include/linux/virtio_ring.h +@@ -63,7 +63,7 @@ struct virtqueue; + /* + * Creates a virtqueue and allocates the descriptor ring. If + * may_reduce_num is set, then this may allocate a smaller ring than +- * expected. The caller should query virtqueue_get_ring_size to learn ++ * expected. The caller should query virtqueue_get_vring_size to learn + * the actual size of the ring. + */ + struct virtqueue *vring_create_virtqueue(unsigned int index, +diff --git a/include/net/ip.h b/include/net/ip.h +index be3cad9c2e4c..583526aad1d0 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -677,7 +677,7 @@ int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp, + unsigned char __user *data, int optlen); + void ip_options_undo(struct ip_options *opt); + void ip_forward_options(struct sk_buff *skb); +-int ip_options_rcv_srr(struct sk_buff *skb); ++int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev); + + /* + * Functions provided by ip_sockglue.c +diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h +index 99d4148e0f90..1c3126c14930 100644 +--- a/include/net/net_namespace.h ++++ b/include/net/net_namespace.h +@@ -58,6 +58,7 @@ struct net { + */ + spinlock_t rules_mod_lock; + ++ u32 hash_mix; + atomic64_t cookie_gen; + + struct list_head list; /* list of network namespaces */ +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 3d58acf94dd2..0612439909dc 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -691,10 +691,12 @@ static inline void nft_set_gc_batch_add(struct nft_set_gc_batch *gcb, + gcb->elems[gcb->head.cnt++] = elem; + } + ++struct nft_expr_ops; + /** + * struct nft_expr_type - nf_tables expression type + * + * @select_ops: function to select nft_expr_ops ++ * @release_ops: release nft_expr_ops + * @ops: default ops, used when no select_ops functions is present + * @list: used internally + * @name: Identifier +@@ -707,6 +709,7 @@ static inline void nft_set_gc_batch_add(struct nft_set_gc_batch *gcb, + struct nft_expr_type { + const struct nft_expr_ops *(*select_ops)(const struct nft_ctx *, + const struct nlattr * const tb[]); ++ void (*release_ops)(const struct nft_expr_ops *ops); + const struct nft_expr_ops *ops; + struct list_head list; + const char *name; +diff --git a/include/net/netns/hash.h b/include/net/netns/hash.h +index 16a842456189..d9b665151f3d 100644 +--- a/include/net/netns/hash.h ++++ b/include/net/netns/hash.h +@@ -2,16 +2,10 @@ + #ifndef __NET_NS_HASH_H__ + #define __NET_NS_HASH_H__ + +-#include +- +-struct net; ++#include + + static inline u32 net_hash_mix(const struct net *net) + { +-#ifdef CONFIG_NET_NS +- return (u32)(((unsigned long)net) >> ilog2(sizeof(*net))); +-#else +- return 0; +-#endif ++ return net->hash_mix; + } + #endif +diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c +index e960c4f46ee0..b07a2acc4eec 100644 +--- a/kernel/irq/chip.c ++++ b/kernel/irq/chip.c +@@ -1384,6 +1384,10 @@ int irq_chip_set_vcpu_affinity_parent(struct irq_data *data, void *vcpu_info) + int irq_chip_set_wake_parent(struct irq_data *data, unsigned int on) + { + data = data->parent_data; ++ ++ if (data->chip->flags & IRQCHIP_SKIP_SET_WAKE) ++ return 0; ++ + if (data->chip->irq_set_wake) + return data->chip->irq_set_wake(data, on); + +diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c +index 84fa255d0329..e16e022eae09 100644 +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -558,6 +558,7 @@ int __init early_irq_init(void) + alloc_masks(&desc[i], node); + raw_spin_lock_init(&desc[i].lock); + lockdep_set_class(&desc[i].lock, &irq_desc_lock_class); ++ mutex_init(&desc[i].request_mutex); + desc_set_defaults(i, &desc[i], node, NULL, NULL); + } + return arch_early_irq_init(); +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 310d0637fe4b..5e61a1a99e38 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -7713,10 +7713,10 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq) + if (cfs_rq->last_h_load_update == now) + return; + +- cfs_rq->h_load_next = NULL; ++ WRITE_ONCE(cfs_rq->h_load_next, NULL); + for_each_sched_entity(se) { + cfs_rq = cfs_rq_of(se); +- cfs_rq->h_load_next = se; ++ WRITE_ONCE(cfs_rq->h_load_next, se); + if (cfs_rq->last_h_load_update == now) + break; + } +@@ -7726,7 +7726,7 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq) + cfs_rq->last_h_load_update = now; + } + +- while ((se = cfs_rq->h_load_next) != NULL) { ++ while ((se = READ_ONCE(cfs_rq->h_load_next)) != NULL) { + load = cfs_rq->h_load; + load = div64_ul(load * se->avg.load_avg, + cfs_rq_load_avg(cfs_rq) + 1); +diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c +index 2c97e8c2d29f..0519a8805aab 100644 +--- a/kernel/time/alarmtimer.c ++++ b/kernel/time/alarmtimer.c +@@ -594,7 +594,7 @@ static ktime_t alarm_timer_remaining(struct k_itimer *timr, ktime_t now) + { + struct alarm *alarm = &timr->it.alarm.alarmtimer; + +- return ktime_sub(now, alarm->node.expires); ++ return ktime_sub(alarm->node.expires, now); + } + + /** +diff --git a/lib/string.c b/lib/string.c +index 38e4ca08e757..3ab861c1a857 100644 +--- a/lib/string.c ++++ b/lib/string.c +@@ -866,6 +866,26 @@ __visible int memcmp(const void *cs, const void *ct, size_t count) + EXPORT_SYMBOL(memcmp); + #endif + ++#ifndef __HAVE_ARCH_BCMP ++/** ++ * bcmp - returns 0 if and only if the buffers have identical contents. ++ * @a: pointer to first buffer. ++ * @b: pointer to second buffer. ++ * @len: size of buffers. ++ * ++ * The sign or magnitude of a non-zero return value has no particular ++ * meaning, and architectures may implement their own more efficient bcmp(). So ++ * while this particular implementation is a simple (tail) call to memcmp, do ++ * not rely on anything but whether the return value is zero or non-zero. ++ */ ++#undef bcmp ++int bcmp(const void *a, const void *b, size_t len) ++{ ++ return memcmp(a, b, len); ++} ++EXPORT_SYMBOL(bcmp); ++#endif ++ + #ifndef __HAVE_ARCH_MEMSCAN + /** + * memscan - Find a character in an area of memory. +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index faf357eaf0ce..8b03c698f86e 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -753,6 +753,21 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr, + spinlock_t *ptl; + + ptl = pmd_lock(mm, pmd); ++ if (!pmd_none(*pmd)) { ++ if (write) { ++ if (pmd_pfn(*pmd) != pfn_t_to_pfn(pfn)) { ++ WARN_ON_ONCE(!is_huge_zero_pmd(*pmd)); ++ goto out_unlock; ++ } ++ entry = pmd_mkyoung(*pmd); ++ entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma); ++ if (pmdp_set_access_flags(vma, addr, pmd, entry, 1)) ++ update_mmu_cache_pmd(vma, addr, pmd); ++ } ++ ++ goto out_unlock; ++ } ++ + entry = pmd_mkhuge(pfn_t_pmd(pfn, prot)); + if (pfn_t_devmap(pfn)) + entry = pmd_mkdevmap(entry); +@@ -764,11 +779,16 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr, + if (pgtable) { + pgtable_trans_huge_deposit(mm, pmd, pgtable); + mm_inc_nr_ptes(mm); ++ pgtable = NULL; + } + + set_pmd_at(mm, addr, pmd, entry); + update_mmu_cache_pmd(vma, addr, pmd); ++ ++out_unlock: + spin_unlock(ptl); ++ if (pgtable) ++ pte_free(mm, pgtable); + } + + vm_fault_t vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr, +@@ -819,6 +839,20 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr, + spinlock_t *ptl; + + ptl = pud_lock(mm, pud); ++ if (!pud_none(*pud)) { ++ if (write) { ++ if (pud_pfn(*pud) != pfn_t_to_pfn(pfn)) { ++ WARN_ON_ONCE(!is_huge_zero_pud(*pud)); ++ goto out_unlock; ++ } ++ entry = pud_mkyoung(*pud); ++ entry = maybe_pud_mkwrite(pud_mkdirty(entry), vma); ++ if (pudp_set_access_flags(vma, addr, pud, entry, 1)) ++ update_mmu_cache_pud(vma, addr, pud); ++ } ++ goto out_unlock; ++ } ++ + entry = pud_mkhuge(pfn_t_pud(pfn, prot)); + if (pfn_t_devmap(pfn)) + entry = pud_mkdevmap(entry); +@@ -828,6 +862,8 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr, + } + set_pud_at(mm, addr, pud, entry); + update_mmu_cache_pud(vma, addr, pud); ++ ++out_unlock: + spin_unlock(ptl); + } + +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 79a7d2a06bba..5bbf2de02a0f 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -3882,6 +3882,22 @@ struct wb_domain *mem_cgroup_wb_domain(struct bdi_writeback *wb) + return &memcg->cgwb_domain; + } + ++/* ++ * idx can be of type enum memcg_stat_item or node_stat_item. ++ * Keep in sync with memcg_exact_page(). ++ */ ++static unsigned long memcg_exact_page_state(struct mem_cgroup *memcg, int idx) ++{ ++ long x = atomic_long_read(&memcg->stat[idx]); ++ int cpu; ++ ++ for_each_online_cpu(cpu) ++ x += per_cpu_ptr(memcg->stat_cpu, cpu)->count[idx]; ++ if (x < 0) ++ x = 0; ++ return x; ++} ++ + /** + * mem_cgroup_wb_stats - retrieve writeback related stats from its memcg + * @wb: bdi_writeback in question +@@ -3907,10 +3923,10 @@ void mem_cgroup_wb_stats(struct bdi_writeback *wb, unsigned long *pfilepages, + struct mem_cgroup *memcg = mem_cgroup_from_css(wb->memcg_css); + struct mem_cgroup *parent; + +- *pdirty = memcg_page_state(memcg, NR_FILE_DIRTY); ++ *pdirty = memcg_exact_page_state(memcg, NR_FILE_DIRTY); + + /* this should eventually include NR_UNSTABLE_NFS */ +- *pwriteback = memcg_page_state(memcg, NR_WRITEBACK); ++ *pwriteback = memcg_exact_page_state(memcg, NR_WRITEBACK); + *pfilepages = mem_cgroup_nr_lru_pages(memcg, (1 << LRU_INACTIVE_FILE) | + (1 << LRU_ACTIVE_FILE)); + *pheadroom = PAGE_COUNTER_MAX; +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index ac92b2eb32b1..e4777614a8a0 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -599,6 +599,7 @@ static int br_ip4_multicast_add_group(struct net_bridge *br, + if (ipv4_is_local_multicast(group)) + return 0; + ++ memset(&br_group, 0, sizeof(br_group)); + br_group.u.ip4 = group; + br_group.proto = htons(ETH_P_IP); + br_group.vid = vid; +@@ -1489,6 +1490,7 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br, + + own_query = port ? &port->ip4_own_query : &br->ip4_own_query; + ++ memset(&br_group, 0, sizeof(br_group)); + br_group.u.ip4 = group; + br_group.proto = htons(ETH_P_IP); + br_group.vid = vid; +@@ -1512,6 +1514,7 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br, + + own_query = port ? &port->ip6_own_query : &br->ip6_own_query; + ++ memset(&br_group, 0, sizeof(br_group)); + br_group.u.ip6 = *group; + br_group.proto = htons(ETH_P_IPV6); + br_group.vid = vid; +diff --git a/net/core/dev.c b/net/core/dev.c +index 5d03889502eb..12824e007e06 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5014,8 +5014,10 @@ static inline void __netif_receive_skb_list_ptype(struct list_head *head, + if (pt_prev->list_func != NULL) + pt_prev->list_func(head, pt_prev, orig_dev); + else +- list_for_each_entry_safe(skb, next, head, list) ++ list_for_each_entry_safe(skb, next, head, list) { ++ skb_list_del_init(skb); + pt_prev->func(skb, skb->dev, pt_prev, orig_dev); ++ } + } + + static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemalloc) +diff --git a/net/core/ethtool.c b/net/core/ethtool.c +index 158264f7cfaf..3a7f19a61768 100644 +--- a/net/core/ethtool.c ++++ b/net/core/ethtool.c +@@ -1794,11 +1794,16 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr) + WARN_ON_ONCE(!ret); + + gstrings.len = ret; +- data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN)); +- if (gstrings.len && !data) +- return -ENOMEM; + +- __ethtool_get_strings(dev, gstrings.string_set, data); ++ if (gstrings.len) { ++ data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN)); ++ if (!data) ++ return -ENOMEM; ++ ++ __ethtool_get_strings(dev, gstrings.string_set, data); ++ } else { ++ data = NULL; ++ } + + ret = -EFAULT; + if (copy_to_user(useraddr, &gstrings, sizeof(gstrings))) +@@ -1894,11 +1899,15 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr) + return -EFAULT; + + stats.n_stats = n_stats; +- data = vzalloc(array_size(n_stats, sizeof(u64))); +- if (n_stats && !data) +- return -ENOMEM; + +- ops->get_ethtool_stats(dev, &stats, data); ++ if (n_stats) { ++ data = vzalloc(array_size(n_stats, sizeof(u64))); ++ if (!data) ++ return -ENOMEM; ++ ops->get_ethtool_stats(dev, &stats, data); ++ } else { ++ data = NULL; ++ } + + ret = -EFAULT; + if (copy_to_user(useraddr, &stats, sizeof(stats))) +@@ -1938,16 +1947,21 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr) + return -EFAULT; + + stats.n_stats = n_stats; +- data = vzalloc(array_size(n_stats, sizeof(u64))); +- if (n_stats && !data) +- return -ENOMEM; + +- if (dev->phydev && !ops->get_ethtool_phy_stats) { +- ret = phy_ethtool_get_stats(dev->phydev, &stats, data); +- if (ret < 0) +- return ret; ++ if (n_stats) { ++ data = vzalloc(array_size(n_stats, sizeof(u64))); ++ if (!data) ++ return -ENOMEM; ++ ++ if (dev->phydev && !ops->get_ethtool_phy_stats) { ++ ret = phy_ethtool_get_stats(dev->phydev, &stats, data); ++ if (ret < 0) ++ goto out; ++ } else { ++ ops->get_ethtool_phy_stats(dev, &stats, data); ++ } + } else { +- ops->get_ethtool_phy_stats(dev, &stats, data); ++ data = NULL; + } + + ret = -EFAULT; +diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c +index b02fb19df2cc..40c249c574c1 100644 +--- a/net/core/net_namespace.c ++++ b/net/core/net_namespace.c +@@ -304,6 +304,7 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) + + refcount_set(&net->count, 1); + refcount_set(&net->passive, 1); ++ get_random_bytes(&net->hash_mix, sizeof(u32)); + net->dev_base_seq = 1; + net->user_ns = user_ns; + idr_init(&net->netns_ids); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 2415d9cb9b89..ef2cd5712098 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3801,7 +3801,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) + unsigned int delta_truesize; + struct sk_buff *lp; + +- if (unlikely(p->len + len >= 65536)) ++ if (unlikely(p->len + len >= 65536 || NAPI_GRO_CB(skb)->flush)) + return -E2BIG; + + lp = NAPI_GRO_CB(p)->last; +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 6ae89f2b541b..2d5734079e6b 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -259,7 +259,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, + struct net *net = dev_net(skb->dev); + struct metadata_dst *tun_dst = NULL; + struct erspan_base_hdr *ershdr; +- struct erspan_metadata *pkt_md; + struct ip_tunnel_net *itn; + struct ip_tunnel *tunnel; + const struct iphdr *iph; +@@ -282,9 +281,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, + if (unlikely(!pskb_may_pull(skb, len))) + return PACKET_REJECT; + +- ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len); +- pkt_md = (struct erspan_metadata *)(ershdr + 1); +- + if (__iptunnel_pull_header(skb, + len, + htons(ETH_P_TEB), +@@ -292,8 +288,9 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, + goto drop; + + if (tunnel->collect_md) { ++ struct erspan_metadata *pkt_md, *md; + struct ip_tunnel_info *info; +- struct erspan_metadata *md; ++ unsigned char *gh; + __be64 tun_id; + __be16 flags; + +@@ -306,6 +303,14 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, + if (!tun_dst) + return PACKET_REJECT; + ++ /* skb can be uncloned in __iptunnel_pull_header, so ++ * old pkt_md is no longer valid and we need to reset ++ * it ++ */ ++ gh = skb_network_header(skb) + ++ skb_network_header_len(skb); ++ pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len + ++ sizeof(*ershdr)); + md = ip_tunnel_info_opts(&tun_dst->u.tun_info); + md->version = ver; + md2 = &md->u.md2; +diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c +index 1f4737b77067..ccf0d31b6ce5 100644 +--- a/net/ipv4/ip_input.c ++++ b/net/ipv4/ip_input.c +@@ -257,11 +257,10 @@ int ip_local_deliver(struct sk_buff *skb) + ip_local_deliver_finish); + } + +-static inline bool ip_rcv_options(struct sk_buff *skb) ++static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev) + { + struct ip_options *opt; + const struct iphdr *iph; +- struct net_device *dev = skb->dev; + + /* It looks as overkill, because not all + IP options require packet mangling. +@@ -297,7 +296,7 @@ static inline bool ip_rcv_options(struct sk_buff *skb) + } + } + +- if (ip_options_rcv_srr(skb)) ++ if (ip_options_rcv_srr(skb, dev)) + goto drop; + } + +@@ -353,7 +352,7 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk, + } + #endif + +- if (iph->ihl > 5 && ip_rcv_options(skb)) ++ if (iph->ihl > 5 && ip_rcv_options(skb, dev)) + goto drop; + + rt = skb_rtable(skb); +diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c +index 32a35043c9f5..3db31bb9df50 100644 +--- a/net/ipv4/ip_options.c ++++ b/net/ipv4/ip_options.c +@@ -612,7 +612,7 @@ void ip_forward_options(struct sk_buff *skb) + } + } + +-int ip_options_rcv_srr(struct sk_buff *skb) ++int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev) + { + struct ip_options *opt = &(IPCB(skb)->opt); + int srrspace, srrptr; +@@ -647,7 +647,7 @@ int ip_options_rcv_srr(struct sk_buff *skb) + + orefdst = skb->_skb_refdst; + skb_dst_set(skb, NULL); +- err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev); ++ err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, dev); + rt2 = skb_rtable(skb); + if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) { + skb_dst_drop(skb); +diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c +index cd4814f7e962..359da68d7c06 100644 +--- a/net/ipv4/tcp_dctcp.c ++++ b/net/ipv4/tcp_dctcp.c +@@ -67,11 +67,6 @@ static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA; + module_param(dctcp_alpha_on_init, uint, 0644); + MODULE_PARM_DESC(dctcp_alpha_on_init, "parameter for initial alpha value"); + +-static unsigned int dctcp_clamp_alpha_on_loss __read_mostly; +-module_param(dctcp_clamp_alpha_on_loss, uint, 0644); +-MODULE_PARM_DESC(dctcp_clamp_alpha_on_loss, +- "parameter for clamping alpha on loss"); +- + static struct tcp_congestion_ops dctcp_reno; + + static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca) +@@ -164,21 +159,23 @@ static void dctcp_update_alpha(struct sock *sk, u32 flags) + } + } + +-static void dctcp_state(struct sock *sk, u8 new_state) ++static void dctcp_react_to_loss(struct sock *sk) + { +- if (dctcp_clamp_alpha_on_loss && new_state == TCP_CA_Loss) { +- struct dctcp *ca = inet_csk_ca(sk); ++ struct dctcp *ca = inet_csk_ca(sk); ++ struct tcp_sock *tp = tcp_sk(sk); + +- /* If this extension is enabled, we clamp dctcp_alpha to +- * max on packet loss; the motivation is that dctcp_alpha +- * is an indicator to the extend of congestion and packet +- * loss is an indicator of extreme congestion; setting +- * this in practice turned out to be beneficial, and +- * effectively assumes total congestion which reduces the +- * window by half. +- */ +- ca->dctcp_alpha = DCTCP_MAX_ALPHA; +- } ++ ca->loss_cwnd = tp->snd_cwnd; ++ tp->snd_ssthresh = max(tp->snd_cwnd >> 1U, 2U); ++} ++ ++static void dctcp_state(struct sock *sk, u8 new_state) ++{ ++ if (new_state == TCP_CA_Recovery && ++ new_state != inet_csk(sk)->icsk_ca_state) ++ dctcp_react_to_loss(sk); ++ /* We handle RTO in dctcp_cwnd_event to ensure that we perform only ++ * one loss-adjustment per RTT. ++ */ + } + + static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev) +@@ -190,6 +187,9 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev) + case CA_EVENT_ECN_NO_CE: + dctcp_ece_ack_update(sk, ev, &ca->prior_rcv_nxt, &ca->ce_state); + break; ++ case CA_EVENT_LOSS: ++ dctcp_react_to_loss(sk); ++ break; + default: + /* Don't care for the rest. */ + break; +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 1aae9ab57fe9..00852f47a73d 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -2578,7 +2578,8 @@ static void __net_exit tcp_sk_exit(struct net *net) + { + int cpu; + +- module_put(net->ipv4.tcp_congestion_control->owner); ++ if (net->ipv4.tcp_congestion_control) ++ module_put(net->ipv4.tcp_congestion_control->owner); + + for_each_possible_cpu(cpu) + inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu)); +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 26f25b6e2833..438f1a5fd19a 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -524,11 +524,10 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi) + return PACKET_REJECT; + } + +-static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len, +- struct tnl_ptk_info *tpi) ++static int ip6erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, ++ int gre_hdr_len) + { + struct erspan_base_hdr *ershdr; +- struct erspan_metadata *pkt_md; + const struct ipv6hdr *ipv6h; + struct erspan_md2 *md2; + struct ip6_tnl *tunnel; +@@ -547,18 +546,16 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len, + if (unlikely(!pskb_may_pull(skb, len))) + return PACKET_REJECT; + +- ershdr = (struct erspan_base_hdr *)skb->data; +- pkt_md = (struct erspan_metadata *)(ershdr + 1); +- + if (__iptunnel_pull_header(skb, len, + htons(ETH_P_TEB), + false, false) < 0) + return PACKET_REJECT; + + if (tunnel->parms.collect_md) { ++ struct erspan_metadata *pkt_md, *md; + struct metadata_dst *tun_dst; + struct ip_tunnel_info *info; +- struct erspan_metadata *md; ++ unsigned char *gh; + __be64 tun_id; + __be16 flags; + +@@ -571,6 +568,14 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len, + if (!tun_dst) + return PACKET_REJECT; + ++ /* skb can be uncloned in __iptunnel_pull_header, so ++ * old pkt_md is no longer valid and we need to reset ++ * it ++ */ ++ gh = skb_network_header(skb) + ++ skb_network_header_len(skb); ++ pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len + ++ sizeof(*ershdr)); + info = &tun_dst->u.tun_info; + md = ip_tunnel_info_opts(info); + md->version = ver; +@@ -607,7 +612,7 @@ static int gre_rcv(struct sk_buff *skb) + + if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) || + tpi.proto == htons(ETH_P_ERSPAN2))) { +- if (ip6erspan_rcv(skb, hdr_len, &tpi) == PACKET_RCVD) ++ if (ip6erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD) + return 0; + goto out; + } +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 5f9fa0302b5a..e71227390bec 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -595,7 +595,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + inet6_sk(skb->sk) : NULL; + struct ipv6hdr *tmp_hdr; + struct frag_hdr *fh; +- unsigned int mtu, hlen, left, len; ++ unsigned int mtu, hlen, left, len, nexthdr_offset; + int hroom, troom; + __be32 frag_id; + int ptr, offset = 0, err = 0; +@@ -606,6 +606,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + goto fail; + hlen = err; + nexthdr = *prevhdr; ++ nexthdr_offset = prevhdr - skb_network_header(skb); + + mtu = ip6_skb_dst_mtu(skb); + +@@ -640,6 +641,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + (err = skb_checksum_help(skb))) + goto fail; + ++ prevhdr = skb_network_header(skb) + nexthdr_offset; + hroom = LL_RESERVED_SPACE(rt->dst.dev); + if (skb_has_frag_list(skb)) { + unsigned int first_len = skb_pagelen(skb); +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 0c6403cf8b52..ade1390c6348 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -627,7 +627,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, + eiph->daddr, eiph->saddr, 0, 0, + IPPROTO_IPIP, RT_TOS(eiph->tos), 0); +- if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL) { ++ if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL6) { + if (!IS_ERR(rt)) + ip_rt_put(rt); + goto out; +@@ -636,7 +636,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + } else { + if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, + skb2->dev) || +- skb_dst(skb2)->dev->type != ARPHRD_TUNNEL) ++ skb_dst(skb2)->dev->type != ARPHRD_TUNNEL6) + goto out; + } + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 07e21a82ce4c..b2109b74857d 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -669,6 +669,10 @@ static int ipip6_rcv(struct sk_buff *skb) + !net_eq(tunnel->net, dev_net(tunnel->dev)))) + goto out; + ++ /* skb can be uncloned in iptunnel_pull_header, so ++ * old iph is no longer valid ++ */ ++ iph = (const struct iphdr *)skb_mac_header(skb); + err = IP_ECN_decapsulate(iph, skb); + if (unlikely(err)) { + if (log_ecn_error) +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 571d824e4e24..b919db02c7f9 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -2054,14 +2054,14 @@ static int __init kcm_init(void) + if (err) + goto fail; + +- err = sock_register(&kcm_family_ops); +- if (err) +- goto sock_register_fail; +- + err = register_pernet_device(&kcm_net_ops); + if (err) + goto net_ops_fail; + ++ err = sock_register(&kcm_family_ops); ++ if (err) ++ goto sock_register_fail; ++ + err = kcm_proc_init(); + if (err) + goto proc_init_fail; +@@ -2069,12 +2069,12 @@ static int __init kcm_init(void) + return 0; + + proc_init_fail: +- unregister_pernet_device(&kcm_net_ops); +- +-net_ops_fail: + sock_unregister(PF_KCM); + + sock_register_fail: ++ unregister_pernet_device(&kcm_net_ops); ++ ++net_ops_fail: + proto_unregister(&kcm_proto); + + fail: +@@ -2090,8 +2090,8 @@ fail: + static void __exit kcm_exit(void) + { + kcm_proc_exit(); +- unregister_pernet_device(&kcm_net_ops); + sock_unregister(PF_KCM); ++ unregister_pernet_device(&kcm_net_ops); + proto_unregister(&kcm_proto); + destroy_workqueue(kcm_wq); + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index e1724f9d8b9d..acb124ce92ec 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2119,9 +2119,11 @@ err1: + static void nf_tables_expr_destroy(const struct nft_ctx *ctx, + struct nft_expr *expr) + { ++ const struct nft_expr_type *type = expr->ops->type; ++ + if (expr->ops->destroy) + expr->ops->destroy(ctx, expr); +- module_put(expr->ops->type->owner); ++ module_put(type->owner); + } + + struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, +@@ -2129,6 +2131,7 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, + { + struct nft_expr_info info; + struct nft_expr *expr; ++ struct module *owner; + int err; + + err = nf_tables_expr_parse(ctx, nla, &info); +@@ -2148,7 +2151,11 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, + err3: + kfree(expr); + err2: +- module_put(info.ops->type->owner); ++ owner = info.ops->type->owner; ++ if (info.ops->type->release_ops) ++ info.ops->type->release_ops(info.ops); ++ ++ module_put(owner); + err1: + return ERR_PTR(err); + } +@@ -2746,8 +2753,11 @@ err2: + nf_tables_rule_release(&ctx, rule); + err1: + for (i = 0; i < n; i++) { +- if (info[i].ops != NULL) ++ if (info[i].ops) { + module_put(info[i].ops->type->owner); ++ if (info[i].ops->type->release_ops) ++ info[i].ops->type->release_ops(info[i].ops); ++ } + } + kvfree(info); + return err; +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index 0a4bad55a8aa..469f9da5073b 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -22,23 +22,6 @@ + #include + #include + #include +-#include +- +-struct nft_xt { +- struct list_head head; +- struct nft_expr_ops ops; +- refcount_t refcnt; +- +- /* used only when transaction mutex is locked */ +- unsigned int listcnt; +- +- /* Unlike other expressions, ops doesn't have static storage duration. +- * nft core assumes they do. We use kfree_rcu so that nft core can +- * can check expr->ops->size even after nft_compat->destroy() frees +- * the nft_xt struct that holds the ops structure. +- */ +- struct rcu_head rcu_head; +-}; + + /* Used for matches where *info is larger than X byte */ + #define NFT_MATCH_LARGE_THRESH 192 +@@ -47,46 +30,6 @@ struct nft_xt_match_priv { + void *info; + }; + +-struct nft_compat_net { +- struct list_head nft_target_list; +- struct list_head nft_match_list; +-}; +- +-static unsigned int nft_compat_net_id __read_mostly; +-static struct nft_expr_type nft_match_type; +-static struct nft_expr_type nft_target_type; +- +-static struct nft_compat_net *nft_compat_pernet(struct net *net) +-{ +- return net_generic(net, nft_compat_net_id); +-} +- +-static void nft_xt_get(struct nft_xt *xt) +-{ +- /* refcount_inc() warns on 0 -> 1 transition, but we can't +- * init the reference count to 1 in .select_ops -- we can't +- * undo such an increase when another expression inside the same +- * rule fails afterwards. +- */ +- if (xt->listcnt == 0) +- refcount_set(&xt->refcnt, 1); +- else +- refcount_inc(&xt->refcnt); +- +- xt->listcnt++; +-} +- +-static bool nft_xt_put(struct nft_xt *xt) +-{ +- if (refcount_dec_and_test(&xt->refcnt)) { +- WARN_ON_ONCE(!list_empty(&xt->head)); +- kfree_rcu(xt, rcu_head); +- return true; +- } +- +- return false; +-} +- + static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, + const char *tablename) + { +@@ -281,7 +224,6 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + struct xt_target *target = expr->ops->data; + struct xt_tgchk_param par; + size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO])); +- struct nft_xt *nft_xt; + u16 proto = 0; + bool inv = false; + union nft_entry e = {}; +@@ -305,8 +247,6 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + if (!target->target) + return -EINVAL; + +- nft_xt = container_of(expr->ops, struct nft_xt, ops); +- nft_xt_get(nft_xt); + return 0; + } + +@@ -325,8 +265,8 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) + if (par.target->destroy != NULL) + par.target->destroy(&par); + +- if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) +- module_put(me); ++ module_put(me); ++ kfree(expr->ops); + } + + static int nft_extension_dump_info(struct sk_buff *skb, int attr, +@@ -499,7 +439,6 @@ __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + struct xt_match *match = expr->ops->data; + struct xt_mtchk_param par; + size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO])); +- struct nft_xt *nft_xt; + u16 proto = 0; + bool inv = false; + union nft_entry e = {}; +@@ -515,13 +454,7 @@ __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + + nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv); + +- ret = xt_check_match(&par, size, proto, inv); +- if (ret < 0) +- return ret; +- +- nft_xt = container_of(expr->ops, struct nft_xt, ops); +- nft_xt_get(nft_xt); +- return 0; ++ return xt_check_match(&par, size, proto, inv); + } + + static int +@@ -564,8 +497,8 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, + if (par.match->destroy != NULL) + par.match->destroy(&par); + +- if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) +- module_put(me); ++ module_put(me); ++ kfree(expr->ops); + } + + static void +@@ -574,18 +507,6 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) + __nft_match_destroy(ctx, expr, nft_expr_priv(expr)); + } + +-static void nft_compat_deactivate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- enum nft_trans_phase phase) +-{ +- struct nft_xt *xt = container_of(expr->ops, struct nft_xt, ops); +- +- if (phase == NFT_TRANS_ABORT || phase == NFT_TRANS_COMMIT) { +- if (--xt->listcnt == 0) +- list_del_init(&xt->head); +- } +-} +- + static void + nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) + { +@@ -780,19 +701,13 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = { + .cb = nfnl_nft_compat_cb, + }; + +-static bool nft_match_cmp(const struct xt_match *match, +- const char *name, u32 rev, u32 family) +-{ +- return strcmp(match->name, name) == 0 && match->revision == rev && +- (match->family == NFPROTO_UNSPEC || match->family == family); +-} ++static struct nft_expr_type nft_match_type; + + static const struct nft_expr_ops * + nft_match_select_ops(const struct nft_ctx *ctx, + const struct nlattr * const tb[]) + { +- struct nft_compat_net *cn; +- struct nft_xt *nft_match; ++ struct nft_expr_ops *ops; + struct xt_match *match; + unsigned int matchsize; + char *mt_name; +@@ -808,16 +723,6 @@ nft_match_select_ops(const struct nft_ctx *ctx, + rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); + family = ctx->family; + +- cn = nft_compat_pernet(ctx->net); +- +- /* Re-use the existing match if it's already loaded. */ +- list_for_each_entry(nft_match, &cn->nft_match_list, head) { +- struct xt_match *match = nft_match->ops.data; +- +- if (nft_match_cmp(match, mt_name, rev, family)) +- return &nft_match->ops; +- } +- + match = xt_request_find_match(family, mt_name, rev); + if (IS_ERR(match)) + return ERR_PTR(-ENOENT); +@@ -827,65 +732,62 @@ nft_match_select_ops(const struct nft_ctx *ctx, + goto err; + } + +- /* This is the first time we use this match, allocate operations */ +- nft_match = kzalloc(sizeof(struct nft_xt), GFP_KERNEL); +- if (nft_match == NULL) { ++ ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); ++ if (!ops) { + err = -ENOMEM; + goto err; + } + +- refcount_set(&nft_match->refcnt, 0); +- nft_match->ops.type = &nft_match_type; +- nft_match->ops.eval = nft_match_eval; +- nft_match->ops.init = nft_match_init; +- nft_match->ops.destroy = nft_match_destroy; +- nft_match->ops.deactivate = nft_compat_deactivate; +- nft_match->ops.dump = nft_match_dump; +- nft_match->ops.validate = nft_match_validate; +- nft_match->ops.data = match; ++ ops->type = &nft_match_type; ++ ops->eval = nft_match_eval; ++ ops->init = nft_match_init; ++ ops->destroy = nft_match_destroy; ++ ops->dump = nft_match_dump; ++ ops->validate = nft_match_validate; ++ ops->data = match; + + matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize)); + if (matchsize > NFT_MATCH_LARGE_THRESH) { + matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv)); + +- nft_match->ops.eval = nft_match_large_eval; +- nft_match->ops.init = nft_match_large_init; +- nft_match->ops.destroy = nft_match_large_destroy; +- nft_match->ops.dump = nft_match_large_dump; ++ ops->eval = nft_match_large_eval; ++ ops->init = nft_match_large_init; ++ ops->destroy = nft_match_large_destroy; ++ ops->dump = nft_match_large_dump; + } + +- nft_match->ops.size = matchsize; ++ ops->size = matchsize; + +- nft_match->listcnt = 0; +- list_add(&nft_match->head, &cn->nft_match_list); +- +- return &nft_match->ops; ++ return ops; + err: + module_put(match->me); + return ERR_PTR(err); + } + ++static void nft_match_release_ops(const struct nft_expr_ops *ops) ++{ ++ struct xt_match *match = ops->data; ++ ++ module_put(match->me); ++ kfree(ops); ++} ++ + static struct nft_expr_type nft_match_type __read_mostly = { + .name = "match", + .select_ops = nft_match_select_ops, ++ .release_ops = nft_match_release_ops, + .policy = nft_match_policy, + .maxattr = NFTA_MATCH_MAX, + .owner = THIS_MODULE, + }; + +-static bool nft_target_cmp(const struct xt_target *tg, +- const char *name, u32 rev, u32 family) +-{ +- return strcmp(tg->name, name) == 0 && tg->revision == rev && +- (tg->family == NFPROTO_UNSPEC || tg->family == family); +-} ++static struct nft_expr_type nft_target_type; + + static const struct nft_expr_ops * + nft_target_select_ops(const struct nft_ctx *ctx, + const struct nlattr * const tb[]) + { +- struct nft_compat_net *cn; +- struct nft_xt *nft_target; ++ struct nft_expr_ops *ops; + struct xt_target *target; + char *tg_name; + u32 rev, family; +@@ -905,18 +807,6 @@ nft_target_select_ops(const struct nft_ctx *ctx, + strcmp(tg_name, "standard") == 0) + return ERR_PTR(-EINVAL); + +- cn = nft_compat_pernet(ctx->net); +- /* Re-use the existing target if it's already loaded. */ +- list_for_each_entry(nft_target, &cn->nft_target_list, head) { +- struct xt_target *target = nft_target->ops.data; +- +- if (!target->target) +- continue; +- +- if (nft_target_cmp(target, tg_name, rev, family)) +- return &nft_target->ops; +- } +- + target = xt_request_find_target(family, tg_name, rev); + if (IS_ERR(target)) + return ERR_PTR(-ENOENT); +@@ -931,113 +821,55 @@ nft_target_select_ops(const struct nft_ctx *ctx, + goto err; + } + +- /* This is the first time we use this target, allocate operations */ +- nft_target = kzalloc(sizeof(struct nft_xt), GFP_KERNEL); +- if (nft_target == NULL) { ++ ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); ++ if (!ops) { + err = -ENOMEM; + goto err; + } + +- refcount_set(&nft_target->refcnt, 0); +- nft_target->ops.type = &nft_target_type; +- nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); +- nft_target->ops.init = nft_target_init; +- nft_target->ops.destroy = nft_target_destroy; +- nft_target->ops.deactivate = nft_compat_deactivate; +- nft_target->ops.dump = nft_target_dump; +- nft_target->ops.validate = nft_target_validate; +- nft_target->ops.data = target; ++ ops->type = &nft_target_type; ++ ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); ++ ops->init = nft_target_init; ++ ops->destroy = nft_target_destroy; ++ ops->dump = nft_target_dump; ++ ops->validate = nft_target_validate; ++ ops->data = target; + + if (family == NFPROTO_BRIDGE) +- nft_target->ops.eval = nft_target_eval_bridge; ++ ops->eval = nft_target_eval_bridge; + else +- nft_target->ops.eval = nft_target_eval_xt; +- +- nft_target->listcnt = 0; +- list_add(&nft_target->head, &cn->nft_target_list); ++ ops->eval = nft_target_eval_xt; + +- return &nft_target->ops; ++ return ops; + err: + module_put(target->me); + return ERR_PTR(err); + } + ++static void nft_target_release_ops(const struct nft_expr_ops *ops) ++{ ++ struct xt_target *target = ops->data; ++ ++ module_put(target->me); ++ kfree(ops); ++} ++ + static struct nft_expr_type nft_target_type __read_mostly = { + .name = "target", + .select_ops = nft_target_select_ops, ++ .release_ops = nft_target_release_ops, + .policy = nft_target_policy, + .maxattr = NFTA_TARGET_MAX, + .owner = THIS_MODULE, + }; + +-static int __net_init nft_compat_init_net(struct net *net) +-{ +- struct nft_compat_net *cn = nft_compat_pernet(net); +- +- INIT_LIST_HEAD(&cn->nft_target_list); +- INIT_LIST_HEAD(&cn->nft_match_list); +- +- return 0; +-} +- +-static void __net_exit nft_compat_exit_net(struct net *net) +-{ +- struct nft_compat_net *cn = nft_compat_pernet(net); +- struct nft_xt *xt, *next; +- +- if (list_empty(&cn->nft_match_list) && +- list_empty(&cn->nft_target_list)) +- return; +- +- /* If there was an error that caused nft_xt expr to not be initialized +- * fully and noone else requested the same expression later, the lists +- * contain 0-refcount entries that still hold module reference. +- * +- * Clean them here. +- */ +- mutex_lock(&net->nft.commit_mutex); +- list_for_each_entry_safe(xt, next, &cn->nft_target_list, head) { +- struct xt_target *target = xt->ops.data; +- +- list_del_init(&xt->head); +- +- if (refcount_read(&xt->refcnt)) +- continue; +- module_put(target->me); +- kfree(xt); +- } +- +- list_for_each_entry_safe(xt, next, &cn->nft_match_list, head) { +- struct xt_match *match = xt->ops.data; +- +- list_del_init(&xt->head); +- +- if (refcount_read(&xt->refcnt)) +- continue; +- module_put(match->me); +- kfree(xt); +- } +- mutex_unlock(&net->nft.commit_mutex); +-} +- +-static struct pernet_operations nft_compat_net_ops = { +- .init = nft_compat_init_net, +- .exit = nft_compat_exit_net, +- .id = &nft_compat_net_id, +- .size = sizeof(struct nft_compat_net), +-}; +- + static int __init nft_compat_module_init(void) + { + int ret; + +- ret = register_pernet_subsys(&nft_compat_net_ops); +- if (ret < 0) +- goto err_target; +- + ret = nft_register_expr(&nft_match_type); + if (ret < 0) +- goto err_pernet; ++ return ret; + + ret = nft_register_expr(&nft_target_type); + if (ret < 0) +@@ -1054,8 +886,6 @@ err_target: + nft_unregister_expr(&nft_target_type); + err_match: + nft_unregister_expr(&nft_match_type); +-err_pernet: +- unregister_pernet_subsys(&nft_compat_net_ops); + return ret; + } + +@@ -1064,7 +894,6 @@ static void __exit nft_compat_module_exit(void) + nfnetlink_subsys_unregister(&nfnl_compat_subsys); + nft_unregister_expr(&nft_target_type); + nft_unregister_expr(&nft_match_type); +- unregister_pernet_subsys(&nft_compat_net_ops); + } + + MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT); +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index 691da853bef5..4bdf5e3ac208 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -2306,14 +2306,14 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, + + struct sw_flow_actions *acts; + int new_acts_size; +- int req_size = NLA_ALIGN(attr_len); ++ size_t req_size = NLA_ALIGN(attr_len); + int next_offset = offsetof(struct sw_flow_actions, actions) + + (*sfa)->actions_len; + + if (req_size <= (ksize(*sfa) - next_offset)) + goto out; + +- new_acts_size = ksize(*sfa) * 2; ++ new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2); + + if (new_acts_size > MAX_ACTIONS_BUFSIZE) { + if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) { +diff --git a/net/rds/tcp.c b/net/rds/tcp.c +index c16f0a362c32..a729c47db781 100644 +--- a/net/rds/tcp.c ++++ b/net/rds/tcp.c +@@ -600,7 +600,7 @@ static void rds_tcp_kill_sock(struct net *net) + list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) { + struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net); + +- if (net != c_net || !tc->t_sock) ++ if (net != c_net) + continue; + if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) { + list_move_tail(&tc->t_tcp_node, &tmp_list); +diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c +index 1a0c682fd734..fd62fe6c8e73 100644 +--- a/net/sched/act_sample.c ++++ b/net/sched/act_sample.c +@@ -43,8 +43,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, + struct tc_action_net *tn = net_generic(net, sample_net_id); + struct nlattr *tb[TCA_SAMPLE_MAX + 1]; + struct psample_group *psample_group; ++ u32 psample_group_num, rate; + struct tc_sample *parm; +- u32 psample_group_num; + struct tcf_sample *s; + bool exists = false; + int ret, err; +@@ -80,6 +80,12 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, + return -EEXIST; + } + ++ rate = nla_get_u32(tb[TCA_SAMPLE_RATE]); ++ if (!rate) { ++ NL_SET_ERR_MSG(extack, "invalid sample rate"); ++ tcf_idr_release(*a, bind); ++ return -EINVAL; ++ } + psample_group_num = nla_get_u32(tb[TCA_SAMPLE_PSAMPLE_GROUP]); + psample_group = psample_group_get(net, psample_group_num); + if (!psample_group) { +@@ -91,7 +97,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, + + spin_lock_bh(&s->tcf_lock); + s->tcf_action = parm->action; +- s->rate = nla_get_u32(tb[TCA_SAMPLE_RATE]); ++ s->rate = rate; + s->psample_group_num = psample_group_num; + RCU_INIT_POINTER(s->psample_group, psample_group); + +diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c +index 0e408ee9dcec..5ba07cd11e31 100644 +--- a/net/sched/cls_matchall.c ++++ b/net/sched/cls_matchall.c +@@ -125,6 +125,11 @@ static void mall_destroy(struct tcf_proto *tp, struct netlink_ext_ack *extack) + + static void *mall_get(struct tcf_proto *tp, u32 handle) + { ++ struct cls_mall_head *head = rtnl_dereference(tp->root); ++ ++ if (head && head->handle == handle) ++ return head; ++ + return NULL; + } + +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index 6abc8b274270..951afdeea5e9 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -600,6 +600,7 @@ out: + static int sctp_v4_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr) + { + /* No address mapping for V4 sockets */ ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + return sizeof(struct sockaddr_in); + } + +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 21113bfd4eca..a5ae9c036b9c 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -90,7 +90,7 @@ static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt) + /* Flush Receives, then wait for deferred Reply work + * to complete. + */ +- ib_drain_qp(ia->ri_id->qp); ++ ib_drain_rq(ia->ri_id->qp); + drain_workqueue(buf->rb_completion_wq); + + /* Deferred Reply processing might have scheduled +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 7d4640d1fe9f..38e7deab6384 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client, + + /* fill the info fields */ + if (client_info->name[0]) +- strlcpy(client->name, client_info->name, sizeof(client->name)); ++ strscpy(client->name, client_info->name, sizeof(client->name)); + + client->filter = client_info->filter; + client->event_lost = client_info->event_lost; +@@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg) + /* set queue name */ + if (!info->name[0]) + snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue); +- strlcpy(q->name, info->name, sizeof(q->name)); ++ strscpy(q->name, info->name, sizeof(q->name)); + snd_use_lock_free(&q->use_lock); + + return 0; +@@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client, + queuefree(q); + return -EPERM; + } +- strlcpy(q->name, info->name, sizeof(q->name)); ++ strscpy(q->name, info->name, sizeof(q->name)); + queuefree(q); + + return 0; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index ece256a3b48f..2ec91085fa3e 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2142,6 +2142,8 @@ static struct snd_pci_quirk power_save_blacklist[] = { + SND_PCI_QUIRK(0x8086, 0x2040, "Intel DZ77BH-55K", 0), + /* https://bugzilla.kernel.org/show_bug.cgi?id=199607 */ + SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0), ++ /* https://bugs.launchpad.net/bugs/1821663 */ ++ SND_PCI_QUIRK(0x8086, 0x2064, "Intel SDP 8086:2064", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */ + SND_PCI_QUIRK(0x8086, 0x2068, "Intel NUC7i3BNB", 0), + /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */ +@@ -2150,6 +2152,8 @@ static struct snd_pci_quirk power_save_blacklist[] = { + SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */ + SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0), ++ /* https://bugs.launchpad.net/bugs/1821663 */ ++ SND_PCI_QUIRK(0x1631, 0xe017, "Packard Bell NEC IMEDIA 5204", 0), + {} + }; + #endif /* CONFIG_PM */ +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 00c27b3b8c14..84fae0df59e9 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -1864,8 +1864,8 @@ enum { + ALC887_FIXUP_BASS_CHMAP, + ALC1220_FIXUP_GB_DUAL_CODECS, + ALC1220_FIXUP_CLEVO_P950, +- ALC1220_FIXUP_SYSTEM76_ORYP5, +- ALC1220_FIXUP_SYSTEM76_ORYP5_PINS, ++ ALC1220_FIXUP_CLEVO_PB51ED, ++ ALC1220_FIXUP_CLEVO_PB51ED_PINS, + }; + + static void alc889_fixup_coef(struct hda_codec *codec, +@@ -2070,7 +2070,7 @@ static void alc1220_fixup_clevo_p950(struct hda_codec *codec, + static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec, + const struct hda_fixup *fix, int action); + +-static void alc1220_fixup_system76_oryp5(struct hda_codec *codec, ++static void alc1220_fixup_clevo_pb51ed(struct hda_codec *codec, + const struct hda_fixup *fix, + int action) + { +@@ -2322,18 +2322,18 @@ static const struct hda_fixup alc882_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc1220_fixup_clevo_p950, + }, +- [ALC1220_FIXUP_SYSTEM76_ORYP5] = { ++ [ALC1220_FIXUP_CLEVO_PB51ED] = { + .type = HDA_FIXUP_FUNC, +- .v.func = alc1220_fixup_system76_oryp5, ++ .v.func = alc1220_fixup_clevo_pb51ed, + }, +- [ALC1220_FIXUP_SYSTEM76_ORYP5_PINS] = { ++ [ALC1220_FIXUP_CLEVO_PB51ED_PINS] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { + { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */ + {} + }, + .chained = true, +- .chain_id = ALC1220_FIXUP_SYSTEM76_ORYP5, ++ .chain_id = ALC1220_FIXUP_CLEVO_PB51ED, + }, + }; + +@@ -2411,8 +2411,9 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950), +- SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS), +- SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS), ++ SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS), ++ SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS), ++ SND_PCI_QUIRK(0x1558, 0x65d1, "Tuxedo Book XC1509", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD), + SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD), + SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530), +@@ -5661,6 +5662,7 @@ enum { + ALC233_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE, + ALC233_FIXUP_LENOVO_MULTI_CODECS, ++ ALC233_FIXUP_ACER_HEADSET_MIC, + ALC294_FIXUP_LENOVO_MIC_LOCATION, + ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE, + ALC700_FIXUP_INTEL_REFERENCE, +@@ -6488,6 +6490,16 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc233_alc662_fixup_lenovo_dual_codecs, + }, ++ [ALC233_FIXUP_ACER_HEADSET_MIC] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC233_FIXUP_ASUS_MIC_NO_PRESENCE ++ }, + [ALC294_FIXUP_LENOVO_MIC_LOCATION] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -6735,6 +6747,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), +diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c +index afe67c865330..3623aa9a6f2e 100644 +--- a/sound/soc/fsl/fsl_esai.c ++++ b/sound/soc/fsl/fsl_esai.c +@@ -54,6 +54,8 @@ struct fsl_esai { + u32 fifo_depth; + u32 slot_width; + u32 slots; ++ u32 tx_mask; ++ u32 rx_mask; + u32 hck_rate[2]; + u32 sck_rate[2]; + bool hck_dir[2]; +@@ -361,21 +363,13 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask, + regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR, + ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots)); + +- regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMA, +- ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(tx_mask)); +- regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMB, +- ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(tx_mask)); +- + regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR, + ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots)); + +- regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMA, +- ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(rx_mask)); +- regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMB, +- ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(rx_mask)); +- + esai_priv->slot_width = slot_width; + esai_priv->slots = slots; ++ esai_priv->tx_mask = tx_mask; ++ esai_priv->rx_mask = rx_mask; + + return 0; + } +@@ -596,6 +590,7 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd, + bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; + u8 i, channels = substream->runtime->channels; + u32 pins = DIV_ROUND_UP(channels, esai_priv->slots); ++ u32 mask; + + switch (cmd) { + case SNDRV_PCM_TRIGGER_START: +@@ -608,15 +603,38 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd, + for (i = 0; tx && i < channels; i++) + regmap_write(esai_priv->regmap, REG_ESAI_ETDR, 0x0); + ++ /* ++ * When set the TE/RE in the end of enablement flow, there ++ * will be channel swap issue for multi data line case. ++ * In order to workaround this issue, we switch the bit ++ * enablement sequence to below sequence ++ * 1) clear the xSMB & xSMA: which is done in probe and ++ * stop state. ++ * 2) set TE/RE ++ * 3) set xSMB ++ * 4) set xSMA: xSMA is the last one in this flow, which ++ * will trigger esai to start. ++ */ + regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx), + tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, + tx ? ESAI_xCR_TE(pins) : ESAI_xCR_RE(pins)); ++ mask = tx ? esai_priv->tx_mask : esai_priv->rx_mask; ++ ++ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx), ++ ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(mask)); ++ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx), ++ ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(mask)); ++ + break; + case SNDRV_PCM_TRIGGER_SUSPEND: + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: + regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx), + tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, 0); ++ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx), ++ ESAI_xSMA_xS_MASK, 0); ++ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx), ++ ESAI_xSMB_xS_MASK, 0); + + /* Disable and reset FIFO */ + regmap_update_bits(esai_priv->regmap, REG_ESAI_xFCR(tx), +@@ -906,6 +924,15 @@ static int fsl_esai_probe(struct platform_device *pdev) + return ret; + } + ++ esai_priv->tx_mask = 0xFFFFFFFF; ++ esai_priv->rx_mask = 0xFFFFFFFF; ++ ++ /* Clear the TSMA, TSMB, RSMA, RSMB */ ++ regmap_write(esai_priv->regmap, REG_ESAI_TSMA, 0); ++ regmap_write(esai_priv->regmap, REG_ESAI_TSMB, 0); ++ regmap_write(esai_priv->regmap, REG_ESAI_RSMA, 0); ++ regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0); ++ + ret = devm_snd_soc_register_component(&pdev->dev, &fsl_esai_component, + &fsl_esai_dai, 1); + if (ret) { +diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +index 91a2436ce952..e9623da911d5 100644 +--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c ++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +@@ -711,9 +711,17 @@ static int sst_soc_probe(struct snd_soc_component *component) + return sst_dsp_init_v2_dpcm(component); + } + ++static void sst_soc_remove(struct snd_soc_component *component) ++{ ++ struct sst_data *drv = dev_get_drvdata(component->dev); ++ ++ drv->soc_card = NULL; ++} ++ + static const struct snd_soc_component_driver sst_soc_platform_drv = { + .name = DRV_NAME, + .probe = sst_soc_probe, ++ .remove = sst_soc_remove, + .ops = &sst_platform_ops, + .compr_ops = &sst_platform_compr_ops, + .pcm_new = sst_pcm_new, +diff --git a/sound/xen/xen_snd_front_alsa.c b/sound/xen/xen_snd_front_alsa.c +index a7f413cb704d..b14ab512c2ce 100644 +--- a/sound/xen/xen_snd_front_alsa.c ++++ b/sound/xen/xen_snd_front_alsa.c +@@ -441,7 +441,7 @@ static int shbuf_setup_backstore(struct xen_snd_front_pcm_stream_info *stream, + { + int i; + +- stream->buffer = alloc_pages_exact(stream->buffer_sz, GFP_KERNEL); ++ stream->buffer = alloc_pages_exact(buffer_sz, GFP_KERNEL); + if (!stream->buffer) + return -ENOMEM; + diff --git a/patch/kernel/sunxi-dev/patch-5.0.8-9.patch b/patch/kernel/sunxi-dev/patch-5.0.8-9.patch new file mode 100644 index 000000000..ca293958d --- /dev/null +++ b/patch/kernel/sunxi-dev/patch-5.0.8-9.patch @@ -0,0 +1,3652 @@ +diff --git a/Makefile b/Makefile +index f7666051de66..ef192ca04330 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 0 +-SUBLEVEL = 8 ++SUBLEVEL = 9 + EXTRAVERSION = + NAME = Shy Crocodile + +diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig +index 87b23b7fb781..aefcf7a4e17a 100644 +--- a/arch/arc/configs/hsdk_defconfig ++++ b/arch/arc/configs/hsdk_defconfig +@@ -8,6 +8,7 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y ++CONFIG_BLK_DEV_RAM=y + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y + # CONFIG_VM_EVENT_COUNTERS is not set +diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S +index 30e090625916..a72bbda2f7aa 100644 +--- a/arch/arc/kernel/head.S ++++ b/arch/arc/kernel/head.S +@@ -106,6 +106,7 @@ ENTRY(stext) + ; r2 = pointer to uboot provided cmdline or external DTB in mem + ; These are handled later in handle_uboot_args() + st r0, [@uboot_tag] ++ st r1, [@uboot_magic] + st r2, [@uboot_arg] + + ; setup "current" tsk and optionally cache it in dedicated r25 +diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c +index 7b2340996cf8..7b3a7b3b380c 100644 +--- a/arch/arc/kernel/setup.c ++++ b/arch/arc/kernel/setup.c +@@ -36,6 +36,7 @@ unsigned int intr_to_DE_cnt; + + /* Part of U-boot ABI: see head.S */ + int __initdata uboot_tag; ++int __initdata uboot_magic; + char __initdata *uboot_arg; + + const struct machine_desc *machine_desc; +@@ -497,6 +498,8 @@ static inline bool uboot_arg_invalid(unsigned long addr) + #define UBOOT_TAG_NONE 0 + #define UBOOT_TAG_CMDLINE 1 + #define UBOOT_TAG_DTB 2 ++/* We always pass 0 as magic from U-boot */ ++#define UBOOT_MAGIC_VALUE 0 + + void __init handle_uboot_args(void) + { +@@ -511,6 +514,11 @@ void __init handle_uboot_args(void) + goto ignore_uboot_args; + } + ++ if (uboot_magic != UBOOT_MAGIC_VALUE) { ++ pr_warn(IGNORE_ARGS "non zero uboot magic\n"); ++ goto ignore_uboot_args; ++ } ++ + if (uboot_tag != UBOOT_TAG_NONE && + uboot_arg_invalid((unsigned long)uboot_arg)) { + pr_warn(IGNORE_ARGS "invalid uboot arg: '%px'\n", uboot_arg); +diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c +index a50dc00d79a2..d0a05a3bdb96 100644 +--- a/arch/arm/kernel/patch.c ++++ b/arch/arm/kernel/patch.c +@@ -16,7 +16,7 @@ struct patch { + unsigned int insn; + }; + +-static DEFINE_SPINLOCK(patch_lock); ++static DEFINE_RAW_SPINLOCK(patch_lock); + + static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags) + __acquires(&patch_lock) +@@ -33,7 +33,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags) + return addr; + + if (flags) +- spin_lock_irqsave(&patch_lock, *flags); ++ raw_spin_lock_irqsave(&patch_lock, *flags); + else + __acquire(&patch_lock); + +@@ -48,7 +48,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags) + clear_fixmap(fixmap); + + if (flags) +- spin_unlock_irqrestore(&patch_lock, *flags); ++ raw_spin_unlock_irqrestore(&patch_lock, *flags); + else + __release(&patch_lock); + } +diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c +index 46eddbec8d9f..0ab95dd431b3 100644 +--- a/arch/mips/bcm47xx/workarounds.c ++++ b/arch/mips/bcm47xx/workarounds.c +@@ -24,6 +24,7 @@ void __init bcm47xx_workarounds(void) + case BCM47XX_BOARD_NETGEAR_WNR3500L: + bcm47xx_workarounds_enable_usb_power(12); + break; ++ case BCM47XX_BOARD_NETGEAR_WNDR3400V2: + case BCM47XX_BOARD_NETGEAR_WNDR3400_V3: + bcm47xx_workarounds_enable_usb_power(21); + break; +diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c +index d3f42b6bbdac..8a9cff1f129d 100644 +--- a/arch/x86/hyperv/hv_init.c ++++ b/arch/x86/hyperv/hv_init.c +@@ -102,9 +102,13 @@ static int hv_cpu_init(unsigned int cpu) + u64 msr_vp_index; + struct hv_vp_assist_page **hvp = &hv_vp_assist_page[smp_processor_id()]; + void **input_arg; ++ struct page *pg; + + input_arg = (void **)this_cpu_ptr(hyperv_pcpu_input_arg); +- *input_arg = page_address(alloc_page(GFP_KERNEL)); ++ pg = alloc_page(GFP_KERNEL); ++ if (unlikely(!pg)) ++ return -ENOMEM; ++ *input_arg = page_address(pg); + + hv_get_vp_index(msr_vp_index); + +diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c +index 58176b56354e..294ed4392a0e 100644 +--- a/arch/x86/kernel/aperture_64.c ++++ b/arch/x86/kernel/aperture_64.c +@@ -14,6 +14,7 @@ + #define pr_fmt(fmt) "AGP: " fmt + + #include ++#include + #include + #include + #include +@@ -57,7 +58,7 @@ int fallback_aper_force __initdata; + + int fix_aperture __initdata = 1; + +-#ifdef CONFIG_PROC_VMCORE ++#if defined(CONFIG_PROC_VMCORE) || defined(CONFIG_PROC_KCORE) + /* + * If the first kernel maps the aperture over e820 RAM, the kdump kernel will + * use the same range because it will remain configured in the northbridge. +@@ -66,20 +67,25 @@ int fix_aperture __initdata = 1; + */ + static unsigned long aperture_pfn_start, aperture_page_count; + +-static int gart_oldmem_pfn_is_ram(unsigned long pfn) ++static int gart_mem_pfn_is_ram(unsigned long pfn) + { + return likely((pfn < aperture_pfn_start) || + (pfn >= aperture_pfn_start + aperture_page_count)); + } + +-static void exclude_from_vmcore(u64 aper_base, u32 aper_order) ++static void __init exclude_from_core(u64 aper_base, u32 aper_order) + { + aperture_pfn_start = aper_base >> PAGE_SHIFT; + aperture_page_count = (32 * 1024 * 1024) << aper_order >> PAGE_SHIFT; +- WARN_ON(register_oldmem_pfn_is_ram(&gart_oldmem_pfn_is_ram)); ++#ifdef CONFIG_PROC_VMCORE ++ WARN_ON(register_oldmem_pfn_is_ram(&gart_mem_pfn_is_ram)); ++#endif ++#ifdef CONFIG_PROC_KCORE ++ WARN_ON(register_mem_pfn_is_ram(&gart_mem_pfn_is_ram)); ++#endif + } + #else +-static void exclude_from_vmcore(u64 aper_base, u32 aper_order) ++static void exclude_from_core(u64 aper_base, u32 aper_order) + { + } + #endif +@@ -474,7 +480,7 @@ out: + * may have allocated the range over its e820 RAM + * and fixed up the northbridge + */ +- exclude_from_vmcore(last_aper_base, last_aper_order); ++ exclude_from_core(last_aper_base, last_aper_order); + + return 1; + } +@@ -520,7 +526,7 @@ out: + * overlap with the first kernel's memory. We can't access the + * range through vmcore even though it should be part of the dump. + */ +- exclude_from_vmcore(aper_alloc, aper_order); ++ exclude_from_core(aper_alloc, aper_order); + + /* Fix up the north bridges */ + for (i = 0; i < amd_nb_bus_dev_ranges[i].dev_limit; i++) { +diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c +index d12226f60168..1d9b8aaea06c 100644 +--- a/arch/x86/kernel/cpu/cyrix.c ++++ b/arch/x86/kernel/cpu/cyrix.c +@@ -124,7 +124,7 @@ static void set_cx86_reorder(void) + setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */ + + /* Load/Store Serialize to mem access disable (=reorder it) */ +- setCx86_old(CX86_PCR0, getCx86_old(CX86_PCR0) & ~0x80); ++ setCx86(CX86_PCR0, getCx86(CX86_PCR0) & ~0x80); + /* set load/store serialize from 1GB to 4GB */ + ccr3 |= 0xe0; + setCx86(CX86_CCR3, ccr3); +@@ -135,11 +135,11 @@ static void set_cx86_memwb(void) + pr_info("Enable Memory-Write-back mode on Cyrix/NSC processor.\n"); + + /* CCR2 bit 2: unlock NW bit */ +- setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) & ~0x04); ++ setCx86(CX86_CCR2, getCx86(CX86_CCR2) & ~0x04); + /* set 'Not Write-through' */ + write_cr0(read_cr0() | X86_CR0_NW); + /* CCR2 bit 2: lock NW bit and set WT1 */ +- setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x14); ++ setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14); + } + + /* +@@ -153,14 +153,14 @@ static void geode_configure(void) + local_irq_save(flags); + + /* Suspend on halt power saving and enable #SUSP pin */ +- setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x88); ++ setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88); + + ccr3 = getCx86(CX86_CCR3); + setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */ + + + /* FPU fast, DTE cache, Mem bypass */ +- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x38); ++ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x38); + setCx86(CX86_CCR3, ccr3); /* disable MAPEN */ + + set_cx86_memwb(); +@@ -296,7 +296,7 @@ static void init_cyrix(struct cpuinfo_x86 *c) + /* GXm supports extended cpuid levels 'ala' AMD */ + if (c->cpuid_level == 2) { + /* Enable cxMMX extensions (GX1 Datasheet 54) */ +- setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7) | 1); ++ setCx86(CX86_CCR7, getCx86(CX86_CCR7) | 1); + + /* + * GXm : 0x30 ... 0x5f GXm datasheet 51 +@@ -319,7 +319,7 @@ static void init_cyrix(struct cpuinfo_x86 *c) + if (dir1 > 7) { + dir0_msn++; /* M II */ + /* Enable MMX extensions (App note 108) */ +- setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7)|1); ++ setCx86(CX86_CCR7, getCx86(CX86_CCR7)|1); + } else { + /* A 6x86MX - it has the bug. */ + set_cpu_bug(c, X86_BUG_COMA); +diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c +index dfd3aca82c61..fb32925a2e62 100644 +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -905,6 +905,8 @@ int __init hpet_enable(void) + return 0; + + hpet_set_mapping(); ++ if (!hpet_virt_address) ++ return 0; + + /* + * Read the period and check for a sane value: +diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c +index 34a5c1715148..2882fe1d2a78 100644 +--- a/arch/x86/kernel/hw_breakpoint.c ++++ b/arch/x86/kernel/hw_breakpoint.c +@@ -357,6 +357,7 @@ int hw_breakpoint_arch_parse(struct perf_event *bp, + #endif + default: + WARN_ON_ONCE(1); ++ return -EINVAL; + } + + /* +diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c +index 3482460d984d..1bfe5c6e6cfe 100644 +--- a/arch/x86/kernel/mpparse.c ++++ b/arch/x86/kernel/mpparse.c +@@ -598,8 +598,8 @@ static int __init smp_scan_config(unsigned long base, unsigned long length) + mpf_base = base; + mpf_found = true; + +- pr_info("found SMP MP-table at [mem %#010lx-%#010lx] mapped at [%p]\n", +- base, base + sizeof(*mpf) - 1, mpf); ++ pr_info("found SMP MP-table at [mem %#010lx-%#010lx]\n", ++ base, base + sizeof(*mpf) - 1); + + memblock_reserve(base, sizeof(*mpf)); + if (mpf->physptr) +diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c +index 2620baa1f699..507212d75ee2 100644 +--- a/block/blk-iolatency.c ++++ b/block/blk-iolatency.c +@@ -75,6 +75,7 @@ + #include + #include "blk-rq-qos.h" + #include "blk-stat.h" ++#include "blk.h" + + #define DEFAULT_SCALE_COOKIE 1000000U + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 9d66a47d32fb..49e16f009095 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -194,6 +194,7 @@ static struct workqueue_struct *ec_query_wq; + static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */ + static int EC_FLAGS_CORRECT_ECDT; /* Needs ECDT port address correction */ + static int EC_FLAGS_IGNORE_DSDT_GPE; /* Needs ECDT GPE as correction setting */ ++static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */ + + /* -------------------------------------------------------------------------- + * Logging/Debugging +@@ -499,6 +500,26 @@ static inline void __acpi_ec_disable_event(struct acpi_ec *ec) + ec_log_drv("event blocked"); + } + ++/* ++ * Process _Q events that might have accumulated in the EC. ++ * Run with locked ec mutex. ++ */ ++static void acpi_ec_clear(struct acpi_ec *ec) ++{ ++ int i, status; ++ u8 value = 0; ++ ++ for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) { ++ status = acpi_ec_query(ec, &value); ++ if (status || !value) ++ break; ++ } ++ if (unlikely(i == ACPI_EC_CLEAR_MAX)) ++ pr_warn("Warning: Maximum of %d stale EC events cleared\n", i); ++ else ++ pr_info("%d stale EC events cleared\n", i); ++} ++ + static void acpi_ec_enable_event(struct acpi_ec *ec) + { + unsigned long flags; +@@ -507,6 +528,10 @@ static void acpi_ec_enable_event(struct acpi_ec *ec) + if (acpi_ec_started(ec)) + __acpi_ec_enable_event(ec); + spin_unlock_irqrestore(&ec->lock, flags); ++ ++ /* Drain additional events if hardware requires that */ ++ if (EC_FLAGS_CLEAR_ON_RESUME) ++ acpi_ec_clear(ec); + } + + #ifdef CONFIG_PM_SLEEP +@@ -1820,6 +1845,31 @@ static int ec_flag_query_handshake(const struct dmi_system_id *id) + } + #endif + ++/* ++ * On some hardware it is necessary to clear events accumulated by the EC during ++ * sleep. These ECs stop reporting GPEs until they are manually polled, if too ++ * many events are accumulated. (e.g. Samsung Series 5/9 notebooks) ++ * ++ * https://bugzilla.kernel.org/show_bug.cgi?id=44161 ++ * ++ * Ideally, the EC should also be instructed NOT to accumulate events during ++ * sleep (which Windows seems to do somehow), but the interface to control this ++ * behaviour is not known at this time. ++ * ++ * Models known to be affected are Samsung 530Uxx/535Uxx/540Uxx/550Pxx/900Xxx, ++ * however it is very likely that other Samsung models are affected. ++ * ++ * On systems which don't accumulate _Q events during sleep, this extra check ++ * should be harmless. ++ */ ++static int ec_clear_on_resume(const struct dmi_system_id *id) ++{ ++ pr_debug("Detected system needing EC poll on resume.\n"); ++ EC_FLAGS_CLEAR_ON_RESUME = 1; ++ ec_event_clearing = ACPI_EC_EVT_TIMING_STATUS; ++ return 0; ++} ++ + /* + * Some ECDTs contain wrong register addresses. + * MSI MS-171F +@@ -1869,6 +1919,9 @@ static const struct dmi_system_id ec_dmi_table[] __initconst = { + ec_honor_ecdt_gpe, "ASUS X580VD", { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X580VD"),}, NULL}, ++ { ++ ec_clear_on_resume, "Samsung hardware", { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL}, + {}, + }; + +diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c +index 78db97687f26..c4b06cc075f9 100644 +--- a/drivers/acpi/utils.c ++++ b/drivers/acpi/utils.c +@@ -800,6 +800,7 @@ bool acpi_dev_present(const char *hid, const char *uid, s64 hrv) + match.hrv = hrv; + + dev = bus_find_device(&acpi_bus_type, NULL, &match, acpi_dev_match_cb); ++ put_device(dev); + return !!dev; + } + EXPORT_SYMBOL(acpi_dev_present); +diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c +index 9ad93ea42fdc..3cde351fb5c9 100644 +--- a/drivers/auxdisplay/hd44780.c ++++ b/drivers/auxdisplay/hd44780.c +@@ -280,6 +280,8 @@ static int hd44780_remove(struct platform_device *pdev) + struct charlcd *lcd = platform_get_drvdata(pdev); + + charlcd_unregister(lcd); ++ ++ kfree(lcd); + return 0; + } + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index 500de1dee967..a00ca6b8117b 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -1467,12 +1467,12 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev, + if (IS_ERR(gpd_data)) + return PTR_ERR(gpd_data); + +- genpd_lock(genpd); +- + ret = genpd->attach_dev ? genpd->attach_dev(genpd, dev) : 0; + if (ret) + goto out; + ++ genpd_lock(genpd); ++ + dev_pm_domain_set(dev, &genpd->domain); + + genpd->device_count++; +@@ -1480,9 +1480,8 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev, + + list_add_tail(&gpd_data->base.list_node, &genpd->dev_list); + +- out: + genpd_unlock(genpd); +- ++ out: + if (ret) + genpd_free_dev_data(dev, gpd_data); + else +@@ -1531,15 +1530,15 @@ static int genpd_remove_device(struct generic_pm_domain *genpd, + genpd->device_count--; + genpd->max_off_time_changed = true; + +- if (genpd->detach_dev) +- genpd->detach_dev(genpd, dev); +- + dev_pm_domain_set(dev, NULL); + + list_del_init(&pdd->list_node); + + genpd_unlock(genpd); + ++ if (genpd->detach_dev) ++ genpd->detach_dev(genpd, dev); ++ + genpd_free_dev_data(dev, gpd_data); + + return 0; +diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c +index 96670eefaeb2..6d415b20fb70 100644 +--- a/drivers/block/paride/pcd.c ++++ b/drivers/block/paride/pcd.c +@@ -314,6 +314,7 @@ static void pcd_init_units(void) + disk->queue = blk_mq_init_sq_queue(&cd->tag_set, &pcd_mq_ops, + 1, BLK_MQ_F_SHOULD_MERGE); + if (IS_ERR(disk->queue)) { ++ put_disk(disk); + disk->queue = NULL; + continue; + } +@@ -749,8 +750,14 @@ static int pcd_detect(void) + return 0; + + printk("%s: No CD-ROM drive found\n", name); +- for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) ++ for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) { ++ if (!cd->disk) ++ continue; ++ blk_cleanup_queue(cd->disk->queue); ++ cd->disk->queue = NULL; ++ blk_mq_free_tag_set(&cd->tag_set); + put_disk(cd->disk); ++ } + pi_unregister_driver(par_drv); + return -1; + } +@@ -1006,8 +1013,14 @@ static int __init pcd_init(void) + pcd_probe_capabilities(); + + if (register_blkdev(major, name)) { +- for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) ++ for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) { ++ if (!cd->disk) ++ continue; ++ ++ blk_cleanup_queue(cd->disk->queue); ++ blk_mq_free_tag_set(&cd->tag_set); + put_disk(cd->disk); ++ } + return -EBUSY; + } + +@@ -1028,6 +1041,9 @@ static void __exit pcd_exit(void) + int unit; + + for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) { ++ if (!cd->disk) ++ continue; ++ + if (cd->present) { + del_gendisk(cd->disk); + pi_release(cd->pi); +diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c +index e92e7a8eeeb2..35e6e271b219 100644 +--- a/drivers/block/paride/pf.c ++++ b/drivers/block/paride/pf.c +@@ -761,8 +761,14 @@ static int pf_detect(void) + return 0; + + printk("%s: No ATAPI disk detected\n", name); +- for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) ++ for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) { ++ if (!pf->disk) ++ continue; ++ blk_cleanup_queue(pf->disk->queue); ++ pf->disk->queue = NULL; ++ blk_mq_free_tag_set(&pf->tag_set); + put_disk(pf->disk); ++ } + pi_unregister_driver(par_drv); + return -1; + } +@@ -1025,8 +1031,13 @@ static int __init pf_init(void) + pf_busy = 0; + + if (register_blkdev(major, name)) { +- for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) ++ for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) { ++ if (!pf->disk) ++ continue; ++ blk_cleanup_queue(pf->disk->queue); ++ blk_mq_free_tag_set(&pf->tag_set); + put_disk(pf->disk); ++ } + return -EBUSY; + } + +@@ -1047,13 +1058,18 @@ static void __exit pf_exit(void) + int unit; + unregister_blkdev(major, name); + for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) { +- if (!pf->present) ++ if (!pf->disk) + continue; +- del_gendisk(pf->disk); ++ ++ if (pf->present) ++ del_gendisk(pf->disk); ++ + blk_cleanup_queue(pf->disk->queue); + blk_mq_free_tag_set(&pf->tag_set); + put_disk(pf->disk); +- pi_release(pf->pi); ++ ++ if (pf->present) ++ pi_release(pf->pi); + } + } + +diff --git a/drivers/crypto/axis/artpec6_crypto.c b/drivers/crypto/axis/artpec6_crypto.c +index f3442c2bdbdc..3c70004240d6 100644 +--- a/drivers/crypto/axis/artpec6_crypto.c ++++ b/drivers/crypto/axis/artpec6_crypto.c +@@ -284,6 +284,7 @@ enum artpec6_crypto_hash_flags { + + struct artpec6_crypto_req_common { + struct list_head list; ++ struct list_head complete_in_progress; + struct artpec6_crypto_dma_descriptors *dma; + struct crypto_async_request *req; + void (*complete)(struct crypto_async_request *req); +@@ -2045,7 +2046,8 @@ static int artpec6_crypto_prepare_aead(struct aead_request *areq) + return artpec6_crypto_dma_map_descs(common); + } + +-static void artpec6_crypto_process_queue(struct artpec6_crypto *ac) ++static void artpec6_crypto_process_queue(struct artpec6_crypto *ac, ++ struct list_head *completions) + { + struct artpec6_crypto_req_common *req; + +@@ -2056,7 +2058,7 @@ static void artpec6_crypto_process_queue(struct artpec6_crypto *ac) + list_move_tail(&req->list, &ac->pending); + artpec6_crypto_start_dma(req); + +- req->req->complete(req->req, -EINPROGRESS); ++ list_add_tail(&req->complete_in_progress, completions); + } + + /* +@@ -2086,6 +2088,11 @@ static void artpec6_crypto_task(unsigned long data) + struct artpec6_crypto *ac = (struct artpec6_crypto *)data; + struct artpec6_crypto_req_common *req; + struct artpec6_crypto_req_common *n; ++ struct list_head complete_done; ++ struct list_head complete_in_progress; ++ ++ INIT_LIST_HEAD(&complete_done); ++ INIT_LIST_HEAD(&complete_in_progress); + + if (list_empty(&ac->pending)) { + pr_debug("Spurious IRQ\n"); +@@ -2119,19 +2126,30 @@ static void artpec6_crypto_task(unsigned long data) + + pr_debug("Completing request %p\n", req); + +- list_del(&req->list); ++ list_move_tail(&req->list, &complete_done); + + artpec6_crypto_dma_unmap_all(req); + artpec6_crypto_copy_bounce_buffers(req); + + ac->pending_count--; + artpec6_crypto_common_destroy(req); +- req->complete(req->req); + } + +- artpec6_crypto_process_queue(ac); ++ artpec6_crypto_process_queue(ac, &complete_in_progress); + + spin_unlock_bh(&ac->queue_lock); ++ ++ /* Perform the completion callbacks without holding the queue lock ++ * to allow new request submissions from the callbacks. ++ */ ++ list_for_each_entry_safe(req, n, &complete_done, list) { ++ req->complete(req->req); ++ } ++ ++ list_for_each_entry_safe(req, n, &complete_in_progress, ++ complete_in_progress) { ++ req->req->complete(req->req, -EINPROGRESS); ++ } + } + + static void artpec6_crypto_complete_crypto(struct crypto_async_request *req) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 3a9b48b227ac..a7208ca0bfe3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -546,7 +546,7 @@ static int psp_load_fw(struct amdgpu_device *adev) + struct psp_context *psp = &adev->psp; + + if (amdgpu_sriov_vf(adev) && adev->in_gpu_reset) { +- psp_ring_destroy(psp, PSP_RING_TYPE__KM); ++ psp_ring_stop(psp, PSP_RING_TYPE__KM); /* should not destroy ring, only stop */ + goto skip_memalloc; + } + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c +index 47243165a082..ae90a99909ef 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c +@@ -323,57 +323,7 @@ static int init_mqd_hiq(struct mqd_manager *mm, void **mqd, + struct kfd_mem_obj **mqd_mem_obj, uint64_t *gart_addr, + struct queue_properties *q) + { +- uint64_t addr; +- struct cik_mqd *m; +- int retval; +- +- retval = kfd_gtt_sa_allocate(mm->dev, sizeof(struct cik_mqd), +- mqd_mem_obj); +- +- if (retval != 0) +- return -ENOMEM; +- +- m = (struct cik_mqd *) (*mqd_mem_obj)->cpu_ptr; +- addr = (*mqd_mem_obj)->gpu_addr; +- +- memset(m, 0, ALIGN(sizeof(struct cik_mqd), 256)); +- +- m->header = 0xC0310800; +- m->compute_pipelinestat_enable = 1; +- m->compute_static_thread_mgmt_se0 = 0xFFFFFFFF; +- m->compute_static_thread_mgmt_se1 = 0xFFFFFFFF; +- m->compute_static_thread_mgmt_se2 = 0xFFFFFFFF; +- m->compute_static_thread_mgmt_se3 = 0xFFFFFFFF; +- +- m->cp_hqd_persistent_state = DEFAULT_CP_HQD_PERSISTENT_STATE | +- PRELOAD_REQ; +- m->cp_hqd_quantum = QUANTUM_EN | QUANTUM_SCALE_1MS | +- QUANTUM_DURATION(10); +- +- m->cp_mqd_control = MQD_CONTROL_PRIV_STATE_EN; +- m->cp_mqd_base_addr_lo = lower_32_bits(addr); +- m->cp_mqd_base_addr_hi = upper_32_bits(addr); +- +- m->cp_hqd_ib_control = DEFAULT_MIN_IB_AVAIL_SIZE; +- +- /* +- * Pipe Priority +- * Identifies the pipe relative priority when this queue is connected +- * to the pipeline. The pipe priority is against the GFX pipe and HP3D. +- * In KFD we are using a fixed pipe priority set to CS_MEDIUM. +- * 0 = CS_LOW (typically below GFX) +- * 1 = CS_MEDIUM (typically between HP3D and GFX +- * 2 = CS_HIGH (typically above HP3D) +- */ +- m->cp_hqd_pipe_priority = 1; +- m->cp_hqd_queue_priority = 15; +- +- *mqd = m; +- if (gart_addr) +- *gart_addr = addr; +- retval = mm->update_mqd(mm, m, q); +- +- return retval; ++ return init_mqd(mm, mqd, mqd_mem_obj, gart_addr, q); + } + + static int update_mqd_hiq(struct mqd_manager *mm, void *mqd, +diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c +index 0573eab0e190..f35e4ab55b27 100644 +--- a/drivers/gpu/drm/exynos/exynos_mixer.c ++++ b/drivers/gpu/drm/exynos/exynos_mixer.c +@@ -20,6 +20,7 @@ + #include "regs-vp.h" + + #include ++#include + #include + #include + #include +@@ -352,15 +353,62 @@ static void mixer_cfg_vp_blend(struct mixer_context *ctx, unsigned int alpha) + mixer_reg_write(ctx, MXR_VIDEO_CFG, val); + } + +-static void mixer_vsync_set_update(struct mixer_context *ctx, bool enable) ++static bool mixer_is_synced(struct mixer_context *ctx) + { +- /* block update on vsync */ +- mixer_reg_writemask(ctx, MXR_STATUS, enable ? +- MXR_STATUS_SYNC_ENABLE : 0, MXR_STATUS_SYNC_ENABLE); ++ u32 base, shadow; + ++ if (ctx->mxr_ver == MXR_VER_16_0_33_0 || ++ ctx->mxr_ver == MXR_VER_128_0_0_184) ++ return !(mixer_reg_read(ctx, MXR_CFG) & ++ MXR_CFG_LAYER_UPDATE_COUNT_MASK); ++ ++ if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags) && ++ vp_reg_read(ctx, VP_SHADOW_UPDATE)) ++ return false; ++ ++ base = mixer_reg_read(ctx, MXR_CFG); ++ shadow = mixer_reg_read(ctx, MXR_CFG_S); ++ if (base != shadow) ++ return false; ++ ++ base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(0)); ++ shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(0)); ++ if (base != shadow) ++ return false; ++ ++ base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(1)); ++ shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(1)); ++ if (base != shadow) ++ return false; ++ ++ return true; ++} ++ ++static int mixer_wait_for_sync(struct mixer_context *ctx) ++{ ++ ktime_t timeout = ktime_add_us(ktime_get(), 100000); ++ ++ while (!mixer_is_synced(ctx)) { ++ usleep_range(1000, 2000); ++ if (ktime_compare(ktime_get(), timeout) > 0) ++ return -ETIMEDOUT; ++ } ++ return 0; ++} ++ ++static void mixer_disable_sync(struct mixer_context *ctx) ++{ ++ mixer_reg_writemask(ctx, MXR_STATUS, 0, MXR_STATUS_SYNC_ENABLE); ++} ++ ++static void mixer_enable_sync(struct mixer_context *ctx) ++{ ++ if (ctx->mxr_ver == MXR_VER_16_0_33_0 || ++ ctx->mxr_ver == MXR_VER_128_0_0_184) ++ mixer_reg_writemask(ctx, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE); ++ mixer_reg_writemask(ctx, MXR_STATUS, ~0, MXR_STATUS_SYNC_ENABLE); + if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags)) +- vp_reg_write(ctx, VP_SHADOW_UPDATE, enable ? +- VP_SHADOW_UPDATE_ENABLE : 0); ++ vp_reg_write(ctx, VP_SHADOW_UPDATE, VP_SHADOW_UPDATE_ENABLE); + } + + static void mixer_cfg_scan(struct mixer_context *ctx, int width, int height) +@@ -498,7 +546,6 @@ static void vp_video_buffer(struct mixer_context *ctx, + + spin_lock_irqsave(&ctx->reg_slock, flags); + +- vp_reg_write(ctx, VP_SHADOW_UPDATE, 1); + /* interlace or progressive scan mode */ + val = (test_bit(MXR_BIT_INTERLACE, &ctx->flags) ? ~0 : 0); + vp_reg_writemask(ctx, VP_MODE, val, VP_MODE_LINE_SKIP); +@@ -553,11 +600,6 @@ static void vp_video_buffer(struct mixer_context *ctx, + vp_regs_dump(ctx); + } + +-static void mixer_layer_update(struct mixer_context *ctx) +-{ +- mixer_reg_writemask(ctx, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE); +-} +- + static void mixer_graph_buffer(struct mixer_context *ctx, + struct exynos_drm_plane *plane) + { +@@ -640,11 +682,6 @@ static void mixer_graph_buffer(struct mixer_context *ctx, + mixer_cfg_layer(ctx, win, priority, true); + mixer_cfg_gfx_blend(ctx, win, pixel_alpha, state->base.alpha); + +- /* layer update mandatory for mixer 16.0.33.0 */ +- if (ctx->mxr_ver == MXR_VER_16_0_33_0 || +- ctx->mxr_ver == MXR_VER_128_0_0_184) +- mixer_layer_update(ctx); +- + spin_unlock_irqrestore(&ctx->reg_slock, flags); + + mixer_regs_dump(ctx); +@@ -709,7 +746,7 @@ static void mixer_win_reset(struct mixer_context *ctx) + static irqreturn_t mixer_irq_handler(int irq, void *arg) + { + struct mixer_context *ctx = arg; +- u32 val, base, shadow; ++ u32 val; + + spin_lock(&ctx->reg_slock); + +@@ -723,26 +760,9 @@ static irqreturn_t mixer_irq_handler(int irq, void *arg) + val &= ~MXR_INT_STATUS_VSYNC; + + /* interlace scan need to check shadow register */ +- if (test_bit(MXR_BIT_INTERLACE, &ctx->flags)) { +- if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags) && +- vp_reg_read(ctx, VP_SHADOW_UPDATE)) +- goto out; +- +- base = mixer_reg_read(ctx, MXR_CFG); +- shadow = mixer_reg_read(ctx, MXR_CFG_S); +- if (base != shadow) +- goto out; +- +- base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(0)); +- shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(0)); +- if (base != shadow) +- goto out; +- +- base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(1)); +- shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(1)); +- if (base != shadow) +- goto out; +- } ++ if (test_bit(MXR_BIT_INTERLACE, &ctx->flags) ++ && !mixer_is_synced(ctx)) ++ goto out; + + drm_crtc_handle_vblank(&ctx->crtc->base); + } +@@ -917,12 +937,14 @@ static void mixer_disable_vblank(struct exynos_drm_crtc *crtc) + + static void mixer_atomic_begin(struct exynos_drm_crtc *crtc) + { +- struct mixer_context *mixer_ctx = crtc->ctx; ++ struct mixer_context *ctx = crtc->ctx; + +- if (!test_bit(MXR_BIT_POWERED, &mixer_ctx->flags)) ++ if (!test_bit(MXR_BIT_POWERED, &ctx->flags)) + return; + +- mixer_vsync_set_update(mixer_ctx, false); ++ if (mixer_wait_for_sync(ctx)) ++ dev_err(ctx->dev, "timeout waiting for VSYNC\n"); ++ mixer_disable_sync(ctx); + } + + static void mixer_update_plane(struct exynos_drm_crtc *crtc, +@@ -964,7 +986,7 @@ static void mixer_atomic_flush(struct exynos_drm_crtc *crtc) + if (!test_bit(MXR_BIT_POWERED, &mixer_ctx->flags)) + return; + +- mixer_vsync_set_update(mixer_ctx, true); ++ mixer_enable_sync(mixer_ctx); + exynos_crtc_handle_event(crtc); + } + +@@ -979,7 +1001,7 @@ static void mixer_enable(struct exynos_drm_crtc *crtc) + + exynos_drm_pipe_clk_enable(crtc, true); + +- mixer_vsync_set_update(ctx, false); ++ mixer_disable_sync(ctx); + + mixer_reg_writemask(ctx, MXR_STATUS, ~0, MXR_STATUS_SOFT_RESET); + +@@ -992,7 +1014,7 @@ static void mixer_enable(struct exynos_drm_crtc *crtc) + + mixer_commit(ctx); + +- mixer_vsync_set_update(ctx, true); ++ mixer_enable_sync(ctx); + + set_bit(MXR_BIT_POWERED, &ctx->flags); + } +diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/volt.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/volt.h +index 8a0f85f5fc1a..6a765682fbfa 100644 +--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/volt.h ++++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/volt.h +@@ -38,6 +38,7 @@ int nvkm_volt_set_id(struct nvkm_volt *, u8 id, u8 min_id, u8 temp, + + int nv40_volt_new(struct nvkm_device *, int, struct nvkm_volt **); + int gf100_volt_new(struct nvkm_device *, int, struct nvkm_volt **); ++int gf117_volt_new(struct nvkm_device *, int, struct nvkm_volt **); + int gk104_volt_new(struct nvkm_device *, int, struct nvkm_volt **); + int gk20a_volt_new(struct nvkm_device *, int, struct nvkm_volt **); + int gm20b_volt_new(struct nvkm_device *, int, struct nvkm_volt **); +diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +index 88a52f6b39fe..7dfbbbc1beea 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c ++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +@@ -181,7 +181,7 @@ nouveau_debugfs_pstate_set(struct file *file, const char __user *ubuf, + } + + ret = pm_runtime_get_sync(drm->dev); +- if (IS_ERR_VALUE(ret) && ret != -EACCES) ++ if (ret < 0 && ret != -EACCES) + return ret; + ret = nvif_mthd(ctrl, NVIF_CONTROL_PSTATE_USER, &args, sizeof(args)); + pm_runtime_put_autosuspend(drm->dev); +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +index d9edb5785813..d75fa7678483 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +@@ -1613,7 +1613,7 @@ nvd7_chipset = { + .pci = gf106_pci_new, + .therm = gf119_therm_new, + .timer = nv41_timer_new, +- .volt = gf100_volt_new, ++ .volt = gf117_volt_new, + .ce[0] = gf100_ce_new, + .disp = gf119_disp_new, + .dma = gf119_dma_new, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/Kbuild b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/Kbuild +index bcd179ba11d0..146adcdd316a 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/Kbuild ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/Kbuild +@@ -2,6 +2,7 @@ nvkm-y += nvkm/subdev/volt/base.o + nvkm-y += nvkm/subdev/volt/gpio.o + nvkm-y += nvkm/subdev/volt/nv40.o + nvkm-y += nvkm/subdev/volt/gf100.o ++nvkm-y += nvkm/subdev/volt/gf117.o + nvkm-y += nvkm/subdev/volt/gk104.o + nvkm-y += nvkm/subdev/volt/gk20a.o + nvkm-y += nvkm/subdev/volt/gm20b.o +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gf117.c b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gf117.c +new file mode 100644 +index 000000000000..547a58f0aeac +--- /dev/null ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gf117.c +@@ -0,0 +1,60 @@ ++/* ++ * Copyright 2019 Ilia Mirkin ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a ++ * copy of this software and associated documentation files (the "Software"), ++ * to deal in the Software without restriction, including without limitation ++ * the rights to use, copy, modify, merge, publish, distribute, sublicense, ++ * and/or sell copies of the Software, and to permit persons to whom the ++ * Software is furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL ++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR ++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR ++ * OTHER DEALINGS IN THE SOFTWARE. ++ * ++ * Authors: Ilia Mirkin ++ */ ++#include "priv.h" ++ ++#include ++ ++static int ++gf117_volt_speedo_read(struct nvkm_volt *volt) ++{ ++ struct nvkm_device *device = volt->subdev.device; ++ struct nvkm_fuse *fuse = device->fuse; ++ ++ if (!fuse) ++ return -EINVAL; ++ ++ return nvkm_fuse_read(fuse, 0x3a8); ++} ++ ++static const struct nvkm_volt_func ++gf117_volt = { ++ .oneinit = gf100_volt_oneinit, ++ .vid_get = nvkm_voltgpio_get, ++ .vid_set = nvkm_voltgpio_set, ++ .speedo_read = gf117_volt_speedo_read, ++}; ++ ++int ++gf117_volt_new(struct nvkm_device *device, int index, struct nvkm_volt **pvolt) ++{ ++ struct nvkm_volt *volt; ++ int ret; ++ ++ ret = nvkm_volt_new_(&gf117_volt, device, index, &volt); ++ *pvolt = volt; ++ if (ret) ++ return ret; ++ ++ return nvkm_voltgpio_init(volt); ++} +diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c +index ca4ae45dd307..8e5724b63f1f 100644 +--- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c ++++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c +@@ -70,18 +70,12 @@ static inline struct innolux_panel *to_innolux_panel(struct drm_panel *panel) + static int innolux_panel_disable(struct drm_panel *panel) + { + struct innolux_panel *innolux = to_innolux_panel(panel); +- int err; + + if (!innolux->enabled) + return 0; + + backlight_disable(innolux->backlight); + +- err = mipi_dsi_dcs_set_display_off(innolux->link); +- if (err < 0) +- DRM_DEV_ERROR(panel->dev, "failed to set display off: %d\n", +- err); +- + innolux->enabled = false; + + return 0; +@@ -95,6 +89,11 @@ static int innolux_panel_unprepare(struct drm_panel *panel) + if (!innolux->prepared) + return 0; + ++ err = mipi_dsi_dcs_set_display_off(innolux->link); ++ if (err < 0) ++ DRM_DEV_ERROR(panel->dev, "failed to set display off: %d\n", ++ err); ++ + err = mipi_dsi_dcs_enter_sleep_mode(innolux->link); + if (err < 0) { + DRM_DEV_ERROR(panel->dev, "failed to enter sleep mode: %d\n", +diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c +index d5a23295dd80..bb7b58407039 100644 +--- a/drivers/gpu/drm/udl/udl_gem.c ++++ b/drivers/gpu/drm/udl/udl_gem.c +@@ -224,7 +224,7 @@ int udl_gem_mmap(struct drm_file *file, struct drm_device *dev, + *offset = drm_vma_node_offset_addr(&gobj->base.vma_node); + + out: +- drm_gem_object_put(&gobj->base); ++ drm_gem_object_put_unlocked(&gobj->base); + unlock: + mutex_unlock(&udl->gem_lock); + return ret; +diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c +index 45b2460f3166..e8819d750938 100644 +--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c ++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c +@@ -668,6 +668,10 @@ static const struct amba_id debug_ids[] = { + .id = 0x000bbd08, + .mask = 0x000fffff, + }, ++ { /* Debug for Cortex-A73 */ ++ .id = 0x000bbd09, ++ .mask = 0x000fffff, ++ }, + { 0, 0 }, + }; + +diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c +index 5344e8993b28..5866f358ea04 100644 +--- a/drivers/infiniband/hw/hfi1/qp.c ++++ b/drivers/infiniband/hw/hfi1/qp.c +@@ -833,7 +833,7 @@ void notify_error_qp(struct rvt_qp *qp) + write_seqlock(lock); + if (!list_empty(&priv->s_iowait.list) && + !(qp->s_flags & RVT_S_BUSY)) { +- qp->s_flags &= ~RVT_S_ANY_WAIT_IO; ++ qp->s_flags &= ~HFI1_S_ANY_WAIT_IO; + list_del_init(&priv->s_iowait.list); + priv->s_iowait.lock = NULL; + rvt_put_qp(qp); +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index 509e467843f6..f4cac63194d9 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -216,6 +216,26 @@ enum { + HNS_ROCE_DB_PER_PAGE = PAGE_SIZE / 4 + }; + ++enum hns_roce_reset_stage { ++ HNS_ROCE_STATE_NON_RST, ++ HNS_ROCE_STATE_RST_BEF_DOWN, ++ HNS_ROCE_STATE_RST_DOWN, ++ HNS_ROCE_STATE_RST_UNINIT, ++ HNS_ROCE_STATE_RST_INIT, ++ HNS_ROCE_STATE_RST_INITED, ++}; ++ ++enum hns_roce_instance_state { ++ HNS_ROCE_STATE_NON_INIT, ++ HNS_ROCE_STATE_INIT, ++ HNS_ROCE_STATE_INITED, ++ HNS_ROCE_STATE_UNINIT, ++}; ++ ++enum { ++ HNS_ROCE_RST_DIRECT_RETURN = 0, ++}; ++ + #define HNS_ROCE_CMD_SUCCESS 1 + + #define HNS_ROCE_PORT_DOWN 0 +@@ -898,6 +918,7 @@ struct hns_roce_dev { + spinlock_t bt_cmd_lock; + bool active; + bool is_reset; ++ unsigned long reset_cnt; + struct hns_roce_ib_iboe iboe; + + struct list_head pgdir_list; +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 543fa1504cd3..7ac06576d791 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -5800,6 +5800,7 @@ MODULE_DEVICE_TABLE(pci, hns_roce_hw_v2_pci_tbl); + static int hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev, + struct hnae3_handle *handle) + { ++ struct hns_roce_v2_priv *priv = hr_dev->priv; + const struct pci_device_id *id; + int i; + +@@ -5830,10 +5831,13 @@ static int hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev, + hr_dev->cmd_mod = 1; + hr_dev->loop_idc = 0; + ++ hr_dev->reset_cnt = handle->ae_algo->ops->ae_dev_reset_cnt(handle); ++ priv->handle = handle; ++ + return 0; + } + +-static int hns_roce_hw_v2_init_instance(struct hnae3_handle *handle) ++static int __hns_roce_hw_v2_init_instance(struct hnae3_handle *handle) + { + struct hns_roce_dev *hr_dev; + int ret; +@@ -5850,7 +5854,6 @@ static int hns_roce_hw_v2_init_instance(struct hnae3_handle *handle) + + hr_dev->pci_dev = handle->pdev; + hr_dev->dev = &handle->pdev->dev; +- handle->priv = hr_dev; + + ret = hns_roce_hw_v2_get_cfg(hr_dev, handle); + if (ret) { +@@ -5864,6 +5867,8 @@ static int hns_roce_hw_v2_init_instance(struct hnae3_handle *handle) + goto error_failed_get_cfg; + } + ++ handle->priv = hr_dev; ++ + return 0; + + error_failed_get_cfg: +@@ -5875,7 +5880,7 @@ error_failed_kzalloc: + return ret; + } + +-static void hns_roce_hw_v2_uninit_instance(struct hnae3_handle *handle, ++static void __hns_roce_hw_v2_uninit_instance(struct hnae3_handle *handle, + bool reset) + { + struct hns_roce_dev *hr_dev = (struct hns_roce_dev *)handle->priv; +@@ -5883,24 +5888,78 @@ static void hns_roce_hw_v2_uninit_instance(struct hnae3_handle *handle, + if (!hr_dev) + return; + ++ handle->priv = NULL; + hns_roce_exit(hr_dev); + kfree(hr_dev->priv); + ib_dealloc_device(&hr_dev->ib_dev); + } + ++static int hns_roce_hw_v2_init_instance(struct hnae3_handle *handle) ++{ ++ const struct hnae3_ae_ops *ops = handle->ae_algo->ops; ++ struct device *dev = &handle->pdev->dev; ++ int ret; ++ ++ handle->rinfo.instance_state = HNS_ROCE_STATE_INIT; ++ ++ if (ops->ae_dev_resetting(handle) || ops->get_hw_reset_stat(handle)) { ++ handle->rinfo.instance_state = HNS_ROCE_STATE_NON_INIT; ++ goto reset_chk_err; ++ } ++ ++ ret = __hns_roce_hw_v2_init_instance(handle); ++ if (ret) { ++ handle->rinfo.instance_state = HNS_ROCE_STATE_NON_INIT; ++ dev_err(dev, "RoCE instance init failed! ret = %d\n", ret); ++ if (ops->ae_dev_resetting(handle) || ++ ops->get_hw_reset_stat(handle)) ++ goto reset_chk_err; ++ else ++ return ret; ++ } ++ ++ handle->rinfo.instance_state = HNS_ROCE_STATE_INITED; ++ ++ ++ return 0; ++ ++reset_chk_err: ++ dev_err(dev, "Device is busy in resetting state.\n" ++ "please retry later.\n"); ++ ++ return -EBUSY; ++} ++ ++static void hns_roce_hw_v2_uninit_instance(struct hnae3_handle *handle, ++ bool reset) ++{ ++ if (handle->rinfo.instance_state != HNS_ROCE_STATE_INITED) ++ return; ++ ++ handle->rinfo.instance_state = HNS_ROCE_STATE_UNINIT; ++ ++ __hns_roce_hw_v2_uninit_instance(handle, reset); ++ ++ handle->rinfo.instance_state = HNS_ROCE_STATE_NON_INIT; ++} + static int hns_roce_hw_v2_reset_notify_down(struct hnae3_handle *handle) + { +- struct hns_roce_dev *hr_dev = (struct hns_roce_dev *)handle->priv; ++ struct hns_roce_dev *hr_dev; + struct ib_event event; + +- if (!hr_dev) { +- dev_err(&handle->pdev->dev, +- "Input parameter handle->priv is NULL!\n"); +- return -EINVAL; ++ if (handle->rinfo.instance_state != HNS_ROCE_STATE_INITED) { ++ set_bit(HNS_ROCE_RST_DIRECT_RETURN, &handle->rinfo.state); ++ return 0; + } + ++ handle->rinfo.reset_state = HNS_ROCE_STATE_RST_DOWN; ++ clear_bit(HNS_ROCE_RST_DIRECT_RETURN, &handle->rinfo.state); ++ ++ hr_dev = (struct hns_roce_dev *)handle->priv; ++ if (!hr_dev) ++ return 0; ++ + hr_dev->active = false; +- hr_dev->is_reset = true; + + event.event = IB_EVENT_DEVICE_FATAL; + event.device = &hr_dev->ib_dev; +@@ -5912,17 +5971,29 @@ static int hns_roce_hw_v2_reset_notify_down(struct hnae3_handle *handle) + + static int hns_roce_hw_v2_reset_notify_init(struct hnae3_handle *handle) + { ++ struct device *dev = &handle->pdev->dev; + int ret; + +- ret = hns_roce_hw_v2_init_instance(handle); ++ if (test_and_clear_bit(HNS_ROCE_RST_DIRECT_RETURN, ++ &handle->rinfo.state)) { ++ handle->rinfo.reset_state = HNS_ROCE_STATE_RST_INITED; ++ return 0; ++ } ++ ++ handle->rinfo.reset_state = HNS_ROCE_STATE_RST_INIT; ++ ++ dev_info(&handle->pdev->dev, "In reset process RoCE client reinit.\n"); ++ ret = __hns_roce_hw_v2_init_instance(handle); + if (ret) { + /* when reset notify type is HNAE3_INIT_CLIENT In reset notify + * callback function, RoCE Engine reinitialize. If RoCE reinit + * failed, we should inform NIC driver. + */ + handle->priv = NULL; +- dev_err(&handle->pdev->dev, +- "In reset process RoCE reinit failed %d.\n", ret); ++ dev_err(dev, "In reset process RoCE reinit failed %d.\n", ret); ++ } else { ++ handle->rinfo.reset_state = HNS_ROCE_STATE_RST_INITED; ++ dev_info(dev, "Reset done, RoCE client reinit finished.\n"); + } + + return ret; +@@ -5930,8 +6001,14 @@ static int hns_roce_hw_v2_reset_notify_init(struct hnae3_handle *handle) + + static int hns_roce_hw_v2_reset_notify_uninit(struct hnae3_handle *handle) + { ++ if (test_bit(HNS_ROCE_RST_DIRECT_RETURN, &handle->rinfo.state)) ++ return 0; ++ ++ handle->rinfo.reset_state = HNS_ROCE_STATE_RST_UNINIT; ++ dev_info(&handle->pdev->dev, "In reset process RoCE client uninit.\n"); + msleep(100); +- hns_roce_hw_v2_uninit_instance(handle, false); ++ __hns_roce_hw_v2_uninit_instance(handle, false); ++ + return 0; + } + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +index b72d0443c835..5398aa718cfc 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +@@ -1546,6 +1546,7 @@ struct hns_roce_link_table_entry { + #define HNS_ROCE_LINK_TABLE_NXT_PTR_M GENMASK(31, 20) + + struct hns_roce_v2_priv { ++ struct hnae3_handle *handle; + struct hns_roce_v2_cmq cmq; + struct hns_roce_link_table tsq; + struct hns_roce_link_table tpq; +diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c +index 59e978141ad4..e99177533930 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c +@@ -173,7 +173,12 @@ int i40iw_inetaddr_event(struct notifier_block *notifier, + + rcu_read_lock(); + in = __in_dev_get_rcu(upper_dev); +- local_ipaddr = ntohl(in->ifa_list->ifa_address); ++ ++ if (!in->ifa_list) ++ local_ipaddr = 0; ++ else ++ local_ipaddr = ntohl(in->ifa_list->ifa_address); ++ + rcu_read_unlock(); + } else { + local_ipaddr = ntohl(ifa->ifa_address); +@@ -185,6 +190,11 @@ int i40iw_inetaddr_event(struct notifier_block *notifier, + case NETDEV_UP: + /* Fall through */ + case NETDEV_CHANGEADDR: ++ ++ /* Just skip if no need to handle ARP cache */ ++ if (!local_ipaddr) ++ break; ++ + i40iw_manage_arp_cache(iwdev, + netdev->dev_addr, + &local_ipaddr, +diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c +index 782499abcd98..2a0b59a4b6eb 100644 +--- a/drivers/infiniband/hw/mlx4/alias_GUID.c ++++ b/drivers/infiniband/hw/mlx4/alias_GUID.c +@@ -804,8 +804,8 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev) + unsigned long flags; + + for (i = 0 ; i < dev->num_ports; i++) { +- cancel_delayed_work(&dev->sriov.alias_guid.ports_guid[i].alias_guid_work); + det = &sriov->alias_guid.ports_guid[i]; ++ cancel_delayed_work_sync(&det->alias_guid_work); + spin_lock_irqsave(&sriov->alias_guid.ag_work_lock, flags); + while (!list_empty(&det->cb_list)) { + cb_ctx = list_entry(det->cb_list.next, +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index dbd6824dfffa..53b1fbadc496 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -1534,6 +1534,9 @@ static void iommu_disable_protect_mem_regions(struct intel_iommu *iommu) + u32 pmen; + unsigned long flags; + ++ if (!cap_plmr(iommu->cap) && !cap_phmr(iommu->cap)) ++ return; ++ + raw_spin_lock_irqsave(&iommu->register_lock, flags); + pmen = readl(iommu->reg + DMAR_PMEN_REG); + pmen &= ~DMA_PMEN_EPM; +@@ -5328,7 +5331,7 @@ int intel_iommu_enable_pasid(struct intel_iommu *iommu, struct intel_svm_dev *sd + + ctx_lo = context[0].lo; + +- sdev->did = domain->iommu_did[iommu->seq_id]; ++ sdev->did = FLPT_DEFAULT_DID; + sdev->sid = PCI_DEVID(info->bus, info->devfn); + + if (!(ctx_lo & CONTEXT_PASIDE)) { +diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c +index 567b29c47608..98b6e1d4b1a6 100644 +--- a/drivers/irqchip/irq-mbigen.c ++++ b/drivers/irqchip/irq-mbigen.c +@@ -161,6 +161,9 @@ static void mbigen_write_msg(struct msi_desc *desc, struct msi_msg *msg) + void __iomem *base = d->chip_data; + u32 val; + ++ if (!msg->address_lo && !msg->address_hi) ++ return; ++ + base += get_mbigen_vec_reg(d->hwirq); + val = readl_relaxed(base); + +diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c +index a93296b9b45d..7bd1d4cb2e19 100644 +--- a/drivers/irqchip/irq-stm32-exti.c ++++ b/drivers/irqchip/irq-stm32-exti.c +@@ -716,7 +716,6 @@ stm32_exti_chip_data *stm32_exti_chip_init(struct stm32_exti_host_data *h_data, + const struct stm32_exti_bank *stm32_bank; + struct stm32_exti_chip_data *chip_data; + void __iomem *base = h_data->base; +- u32 irqs_mask; + + stm32_bank = h_data->drv_data->exti_banks[bank_idx]; + chip_data = &h_data->chips_data[bank_idx]; +@@ -725,21 +724,12 @@ stm32_exti_chip_data *stm32_exti_chip_init(struct stm32_exti_host_data *h_data, + + raw_spin_lock_init(&chip_data->rlock); + +- /* Determine number of irqs supported */ +- writel_relaxed(~0UL, base + stm32_bank->rtsr_ofst); +- irqs_mask = readl_relaxed(base + stm32_bank->rtsr_ofst); +- + /* + * This IP has no reset, so after hot reboot we should + * clear registers to avoid residue + */ + writel_relaxed(0, base + stm32_bank->imr_ofst); + writel_relaxed(0, base + stm32_bank->emr_ofst); +- writel_relaxed(0, base + stm32_bank->rtsr_ofst); +- writel_relaxed(0, base + stm32_bank->ftsr_ofst); +- writel_relaxed(~0UL, base + stm32_bank->rpr_ofst); +- if (stm32_bank->fpr_ofst != UNDEF_REG) +- writel_relaxed(~0UL, base + stm32_bank->fpr_ofst); + + pr_info("%pOF: bank%d\n", h_data->node, bank_idx); + +diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c +index 2837dc77478e..f0f9eb30bd2b 100644 +--- a/drivers/misc/lkdtm/core.c ++++ b/drivers/misc/lkdtm/core.c +@@ -152,7 +152,9 @@ static const struct crashtype crashtypes[] = { + CRASHTYPE(EXEC_VMALLOC), + CRASHTYPE(EXEC_RODATA), + CRASHTYPE(EXEC_USERSPACE), ++ CRASHTYPE(EXEC_NULL), + CRASHTYPE(ACCESS_USERSPACE), ++ CRASHTYPE(ACCESS_NULL), + CRASHTYPE(WRITE_RO), + CRASHTYPE(WRITE_RO_AFTER_INIT), + CRASHTYPE(WRITE_KERN), +diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h +index 3c6fd327e166..b69ee004a3f7 100644 +--- a/drivers/misc/lkdtm/lkdtm.h ++++ b/drivers/misc/lkdtm/lkdtm.h +@@ -45,7 +45,9 @@ void lkdtm_EXEC_KMALLOC(void); + void lkdtm_EXEC_VMALLOC(void); + void lkdtm_EXEC_RODATA(void); + void lkdtm_EXEC_USERSPACE(void); ++void lkdtm_EXEC_NULL(void); + void lkdtm_ACCESS_USERSPACE(void); ++void lkdtm_ACCESS_NULL(void); + + /* lkdtm_refcount.c */ + void lkdtm_REFCOUNT_INC_OVERFLOW(void); +diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c +index 53b85c9d16b8..62f76d506f04 100644 +--- a/drivers/misc/lkdtm/perms.c ++++ b/drivers/misc/lkdtm/perms.c +@@ -47,7 +47,7 @@ static noinline void execute_location(void *dst, bool write) + { + void (*func)(void) = dst; + +- pr_info("attempting ok execution at %p\n", do_nothing); ++ pr_info("attempting ok execution at %px\n", do_nothing); + do_nothing(); + + if (write == CODE_WRITE) { +@@ -55,7 +55,7 @@ static noinline void execute_location(void *dst, bool write) + flush_icache_range((unsigned long)dst, + (unsigned long)dst + EXEC_SIZE); + } +- pr_info("attempting bad execution at %p\n", func); ++ pr_info("attempting bad execution at %px\n", func); + func(); + } + +@@ -66,14 +66,14 @@ static void execute_user_location(void *dst) + /* Intentionally crossing kernel/user memory boundary. */ + void (*func)(void) = dst; + +- pr_info("attempting ok execution at %p\n", do_nothing); ++ pr_info("attempting ok execution at %px\n", do_nothing); + do_nothing(); + + copied = access_process_vm(current, (unsigned long)dst, do_nothing, + EXEC_SIZE, FOLL_WRITE); + if (copied < EXEC_SIZE) + return; +- pr_info("attempting bad execution at %p\n", func); ++ pr_info("attempting bad execution at %px\n", func); + func(); + } + +@@ -82,7 +82,7 @@ void lkdtm_WRITE_RO(void) + /* Explicitly cast away "const" for the test. */ + unsigned long *ptr = (unsigned long *)&rodata; + +- pr_info("attempting bad rodata write at %p\n", ptr); ++ pr_info("attempting bad rodata write at %px\n", ptr); + *ptr ^= 0xabcd1234; + } + +@@ -100,7 +100,7 @@ void lkdtm_WRITE_RO_AFTER_INIT(void) + return; + } + +- pr_info("attempting bad ro_after_init write at %p\n", ptr); ++ pr_info("attempting bad ro_after_init write at %px\n", ptr); + *ptr ^= 0xabcd1234; + } + +@@ -112,7 +112,7 @@ void lkdtm_WRITE_KERN(void) + size = (unsigned long)do_overwritten - (unsigned long)do_nothing; + ptr = (unsigned char *)do_overwritten; + +- pr_info("attempting bad %zu byte write at %p\n", size, ptr); ++ pr_info("attempting bad %zu byte write at %px\n", size, ptr); + memcpy(ptr, (unsigned char *)do_nothing, size); + flush_icache_range((unsigned long)ptr, (unsigned long)(ptr + size)); + +@@ -164,6 +164,11 @@ void lkdtm_EXEC_USERSPACE(void) + vm_munmap(user_addr, PAGE_SIZE); + } + ++void lkdtm_EXEC_NULL(void) ++{ ++ execute_location(NULL, CODE_AS_IS); ++} ++ + void lkdtm_ACCESS_USERSPACE(void) + { + unsigned long user_addr, tmp = 0; +@@ -185,16 +190,29 @@ void lkdtm_ACCESS_USERSPACE(void) + + ptr = (unsigned long *)user_addr; + +- pr_info("attempting bad read at %p\n", ptr); ++ pr_info("attempting bad read at %px\n", ptr); + tmp = *ptr; + tmp += 0xc0dec0de; + +- pr_info("attempting bad write at %p\n", ptr); ++ pr_info("attempting bad write at %px\n", ptr); + *ptr = tmp; + + vm_munmap(user_addr, PAGE_SIZE); + } + ++void lkdtm_ACCESS_NULL(void) ++{ ++ unsigned long tmp; ++ unsigned long *ptr = (unsigned long *)NULL; ++ ++ pr_info("attempting bad read at %px\n", ptr); ++ tmp = *ptr; ++ tmp += 0xc0dec0de; ++ ++ pr_info("attempting bad write at %px\n", ptr); ++ *ptr = tmp; ++} ++ + void __init lkdtm_perms_init(void) + { + /* Make sure we can write to __ro_after_init values during __init */ +diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c +index 9e68c3645e22..e6f14257a7d0 100644 +--- a/drivers/mmc/host/davinci_mmc.c ++++ b/drivers/mmc/host/davinci_mmc.c +@@ -1117,7 +1117,7 @@ static inline void mmc_davinci_cpufreq_deregister(struct mmc_davinci_host *host) + { + } + #endif +-static void __init init_mmcsd_host(struct mmc_davinci_host *host) ++static void init_mmcsd_host(struct mmc_davinci_host *host) + { + + mmc_davinci_reset_ctrl(host, 1); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +index 09c774fe8853..854a55d4332a 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -463,6 +463,8 @@ struct hnae3_ae_ops { + int (*set_gro_en)(struct hnae3_handle *handle, int enable); + u16 (*get_global_queue_id)(struct hnae3_handle *handle, u16 queue_id); + void (*set_timer_task)(struct hnae3_handle *handle, bool enable); ++ int (*mac_connect_phy)(struct hnae3_handle *handle); ++ void (*mac_disconnect_phy)(struct hnae3_handle *handle); + }; + + struct hnae3_dcb_ops { +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index d84c50068f66..40b69eaf2cb3 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -3519,6 +3519,25 @@ static int hns3_init_mac_addr(struct net_device *netdev, bool init) + return ret; + } + ++static int hns3_init_phy(struct net_device *netdev) ++{ ++ struct hnae3_handle *h = hns3_get_handle(netdev); ++ int ret = 0; ++ ++ if (h->ae_algo->ops->mac_connect_phy) ++ ret = h->ae_algo->ops->mac_connect_phy(h); ++ ++ return ret; ++} ++ ++static void hns3_uninit_phy(struct net_device *netdev) ++{ ++ struct hnae3_handle *h = hns3_get_handle(netdev); ++ ++ if (h->ae_algo->ops->mac_disconnect_phy) ++ h->ae_algo->ops->mac_disconnect_phy(h); ++} ++ + static int hns3_restore_fd_rules(struct net_device *netdev) + { + struct hnae3_handle *h = hns3_get_handle(netdev); +@@ -3627,6 +3646,10 @@ static int hns3_client_init(struct hnae3_handle *handle) + goto out_init_ring_data; + } + ++ ret = hns3_init_phy(netdev); ++ if (ret) ++ goto out_init_phy; ++ + ret = register_netdev(netdev); + if (ret) { + dev_err(priv->dev, "probe register netdev fail!\n"); +@@ -3651,6 +3674,9 @@ static int hns3_client_init(struct hnae3_handle *handle) + return ret; + + out_reg_netdev_fail: ++ hns3_uninit_phy(netdev); ++out_init_phy: ++ hns3_uninit_all_ring(priv); + out_init_ring_data: + (void)hns3_nic_uninit_vector_data(priv); + out_init_vector_data: +@@ -3685,6 +3711,8 @@ static void hns3_client_uninit(struct hnae3_handle *handle, bool reset) + + hns3_force_clear_all_rx_ring(handle); + ++ hns3_uninit_phy(netdev); ++ + ret = hns3_nic_uninit_vector_data(priv); + if (ret) + netdev_err(netdev, "uninit vector error\n"); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index f7637c08bb3a..cb7571747af7 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -6959,16 +6959,6 @@ static void hclge_get_mdix_mode(struct hnae3_handle *handle, + *tp_mdix = ETH_TP_MDI; + } + +-static int hclge_init_instance_hw(struct hclge_dev *hdev) +-{ +- return hclge_mac_connect_phy(hdev); +-} +- +-static void hclge_uninit_instance_hw(struct hclge_dev *hdev) +-{ +- hclge_mac_disconnect_phy(hdev); +-} +- + static int hclge_init_client_instance(struct hnae3_client *client, + struct hnae3_ae_dev *ae_dev) + { +@@ -6988,13 +6978,6 @@ static int hclge_init_client_instance(struct hnae3_client *client, + if (ret) + goto clear_nic; + +- ret = hclge_init_instance_hw(hdev); +- if (ret) { +- client->ops->uninit_instance(&vport->nic, +- 0); +- goto clear_nic; +- } +- + hnae3_set_client_init_flag(client, ae_dev, 1); + + if (hdev->roce_client && +@@ -7079,7 +7062,6 @@ static void hclge_uninit_client_instance(struct hnae3_client *client, + if (client->type == HNAE3_CLIENT_ROCE) + return; + if (hdev->nic_client && client->ops->uninit_instance) { +- hclge_uninit_instance_hw(hdev); + client->ops->uninit_instance(&vport->nic, 0); + hdev->nic_client = NULL; + vport->nic.client = NULL; +@@ -8012,6 +7994,8 @@ static const struct hnae3_ae_ops hclge_ops = { + .set_gro_en = hclge_gro_en, + .get_global_queue_id = hclge_covert_handle_qid_global, + .set_timer_task = hclge_set_timer_task, ++ .mac_connect_phy = hclge_mac_connect_phy, ++ .mac_disconnect_phy = hclge_mac_disconnect_phy, + }; + + static struct hnae3_ae_algo ae_algo = { +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c +index dabb8437f8dc..84f28785ba28 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c +@@ -195,8 +195,10 @@ static void hclge_mac_adjust_link(struct net_device *netdev) + netdev_err(netdev, "failed to configure flow control.\n"); + } + +-int hclge_mac_connect_phy(struct hclge_dev *hdev) ++int hclge_mac_connect_phy(struct hnae3_handle *handle) + { ++ struct hclge_vport *vport = hclge_get_vport(handle); ++ struct hclge_dev *hdev = vport->back; + struct net_device *netdev = hdev->vport[0].nic.netdev; + struct phy_device *phydev = hdev->hw.mac.phydev; + __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, }; +@@ -229,8 +231,10 @@ int hclge_mac_connect_phy(struct hclge_dev *hdev) + return 0; + } + +-void hclge_mac_disconnect_phy(struct hclge_dev *hdev) ++void hclge_mac_disconnect_phy(struct hnae3_handle *handle) + { ++ struct hclge_vport *vport = hclge_get_vport(handle); ++ struct hclge_dev *hdev = vport->back; + struct phy_device *phydev = hdev->hw.mac.phydev; + + if (!phydev) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h +index 5fbf7dddb5d9..ef095d9c566f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h +@@ -5,8 +5,8 @@ + #define __HCLGE_MDIO_H + + int hclge_mac_mdio_config(struct hclge_dev *hdev); +-int hclge_mac_connect_phy(struct hclge_dev *hdev); +-void hclge_mac_disconnect_phy(struct hclge_dev *hdev); ++int hclge_mac_connect_phy(struct hnae3_handle *handle); ++void hclge_mac_disconnect_phy(struct hnae3_handle *handle); + void hclge_mac_start_phy(struct hclge_dev *hdev); + void hclge_mac_stop_phy(struct hclge_dev *hdev); + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index c25acace7d91..e91005d0f20c 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1233,7 +1233,6 @@ static void pci_restore_pcie_state(struct pci_dev *dev) + pcie_capability_write_word(dev, PCI_EXP_SLTCTL2, cap[i++]); + } + +- + static int pci_save_pcix_state(struct pci_dev *dev) + { + int pos; +@@ -1270,6 +1269,45 @@ static void pci_restore_pcix_state(struct pci_dev *dev) + pci_write_config_word(dev, pos + PCI_X_CMD, cap[i++]); + } + ++static void pci_save_ltr_state(struct pci_dev *dev) ++{ ++ int ltr; ++ struct pci_cap_saved_state *save_state; ++ u16 *cap; ++ ++ if (!pci_is_pcie(dev)) ++ return; ++ ++ ltr = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_LTR); ++ if (!ltr) ++ return; ++ ++ save_state = pci_find_saved_ext_cap(dev, PCI_EXT_CAP_ID_LTR); ++ if (!save_state) { ++ pci_err(dev, "no suspend buffer for LTR; ASPM issues possible after resume\n"); ++ return; ++ } ++ ++ cap = (u16 *)&save_state->cap.data[0]; ++ pci_read_config_word(dev, ltr + PCI_LTR_MAX_SNOOP_LAT, cap++); ++ pci_read_config_word(dev, ltr + PCI_LTR_MAX_NOSNOOP_LAT, cap++); ++} ++ ++static void pci_restore_ltr_state(struct pci_dev *dev) ++{ ++ struct pci_cap_saved_state *save_state; ++ int ltr; ++ u16 *cap; ++ ++ save_state = pci_find_saved_ext_cap(dev, PCI_EXT_CAP_ID_LTR); ++ ltr = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_LTR); ++ if (!save_state || !ltr) ++ return; ++ ++ cap = (u16 *)&save_state->cap.data[0]; ++ pci_write_config_word(dev, ltr + PCI_LTR_MAX_SNOOP_LAT, *cap++); ++ pci_write_config_word(dev, ltr + PCI_LTR_MAX_NOSNOOP_LAT, *cap++); ++} + + /** + * pci_save_state - save the PCI configuration space of a device before suspending +@@ -1291,6 +1329,7 @@ int pci_save_state(struct pci_dev *dev) + if (i != 0) + return i; + ++ pci_save_ltr_state(dev); + pci_save_dpc_state(dev); + return pci_save_vc_state(dev); + } +@@ -1390,7 +1429,12 @@ void pci_restore_state(struct pci_dev *dev) + if (!dev->state_saved) + return; + +- /* PCI Express register must be restored first */ ++ /* ++ * Restore max latencies (in the LTR capability) before enabling ++ * LTR itself (in the PCIe capability). ++ */ ++ pci_restore_ltr_state(dev); ++ + pci_restore_pcie_state(dev); + pci_restore_pasid_state(dev); + pci_restore_pri_state(dev); +@@ -2501,6 +2545,25 @@ void pci_config_pm_runtime_put(struct pci_dev *pdev) + pm_runtime_put_sync(parent); + } + ++static const struct dmi_system_id bridge_d3_blacklist[] = { ++#ifdef CONFIG_X86 ++ { ++ /* ++ * Gigabyte X299 root port is not marked as hotplug capable ++ * which allows Linux to power manage it. However, this ++ * confuses the BIOS SMI handler so don't power manage root ++ * ports on that system. ++ */ ++ .ident = "X299 DESIGNARE EX-CF", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."), ++ DMI_MATCH(DMI_BOARD_NAME, "X299 DESIGNARE EX-CF"), ++ }, ++ }, ++#endif ++ { } ++}; ++ + /** + * pci_bridge_d3_possible - Is it possible to put the bridge into D3 + * @bridge: Bridge to check +@@ -2546,6 +2609,9 @@ bool pci_bridge_d3_possible(struct pci_dev *bridge) + if (bridge->is_hotplug_bridge) + return false; + ++ if (dmi_check_system(bridge_d3_blacklist)) ++ return false; ++ + /* + * It should be safe to put PCIe ports from 2015 or newer + * to D3. +@@ -2998,6 +3064,11 @@ void pci_allocate_cap_save_buffers(struct pci_dev *dev) + if (error) + pci_err(dev, "unable to preallocate PCI-X save buffer\n"); + ++ error = pci_add_ext_cap_save_buffer(dev, PCI_EXT_CAP_ID_LTR, ++ 2 * sizeof(u16)); ++ if (error) ++ pci_err(dev, "unable to allocate suspend buffer for LTR\n"); ++ + pci_allocate_vc_save_buffers(dev); + } + +diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c +index c37e74ee609d..a9cbe5be277b 100644 +--- a/drivers/platform/x86/intel_pmc_core.c ++++ b/drivers/platform/x86/intel_pmc_core.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -139,6 +140,7 @@ static const struct pmc_reg_map spt_reg_map = { + .pm_cfg_offset = SPT_PMC_PM_CFG_OFFSET, + .pm_read_disable_bit = SPT_PMC_READ_DISABLE_BIT, + .ltr_ignore_max = SPT_NUM_IP_IGN_ALLOWED, ++ .pm_vric1_offset = SPT_PMC_VRIC1_OFFSET, + }; + + /* Cannonlake: PGD PFET Enable Ack Status Register(s) bitmap */ +@@ -751,6 +753,37 @@ static const struct pci_device_id pmc_pci_ids[] = { + { 0, }, + }; + ++/* ++ * This quirk can be used on those platforms where ++ * the platform BIOS enforces 24Mhx Crystal to shutdown ++ * before PMC can assert SLP_S0#. ++ */ ++int quirk_xtal_ignore(const struct dmi_system_id *id) ++{ ++ struct pmc_dev *pmcdev = &pmc; ++ u32 value; ++ ++ value = pmc_core_reg_read(pmcdev, pmcdev->map->pm_vric1_offset); ++ /* 24MHz Crystal Shutdown Qualification Disable */ ++ value |= SPT_PMC_VRIC1_XTALSDQDIS; ++ /* Low Voltage Mode Enable */ ++ value &= ~SPT_PMC_VRIC1_SLPS0LVEN; ++ pmc_core_reg_write(pmcdev, pmcdev->map->pm_vric1_offset, value); ++ return 0; ++} ++ ++static const struct dmi_system_id pmc_core_dmi_table[] = { ++ { ++ .callback = quirk_xtal_ignore, ++ .ident = "HP Elite x2 1013 G3", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite x2 1013 G3"), ++ }, ++ }, ++ {} ++}; ++ + static int __init pmc_core_probe(void) + { + struct pmc_dev *pmcdev = &pmc; +@@ -792,6 +825,7 @@ static int __init pmc_core_probe(void) + return err; + } + ++ dmi_check_system(pmc_core_dmi_table); + pr_info(" initialized\n"); + return 0; + } +diff --git a/drivers/platform/x86/intel_pmc_core.h b/drivers/platform/x86/intel_pmc_core.h +index 1a0104d2cbf0..9bc16d7d2917 100644 +--- a/drivers/platform/x86/intel_pmc_core.h ++++ b/drivers/platform/x86/intel_pmc_core.h +@@ -25,6 +25,7 @@ + #define SPT_PMC_MTPMC_OFFSET 0x20 + #define SPT_PMC_MFPMC_OFFSET 0x38 + #define SPT_PMC_LTR_IGNORE_OFFSET 0x30C ++#define SPT_PMC_VRIC1_OFFSET 0x31c + #define SPT_PMC_MPHY_CORE_STS_0 0x1143 + #define SPT_PMC_MPHY_CORE_STS_1 0x1142 + #define SPT_PMC_MPHY_COM_STS_0 0x1155 +@@ -135,6 +136,9 @@ enum ppfear_regs { + #define SPT_PMC_BIT_MPHY_CMN_LANE2 BIT(2) + #define SPT_PMC_BIT_MPHY_CMN_LANE3 BIT(3) + ++#define SPT_PMC_VRIC1_SLPS0LVEN BIT(13) ++#define SPT_PMC_VRIC1_XTALSDQDIS BIT(22) ++ + /* Cannonlake Power Management Controller register offsets */ + #define CNP_PMC_SLPS0_DBG_OFFSET 0x10B4 + #define CNP_PMC_PM_CFG_OFFSET 0x1818 +@@ -217,6 +221,7 @@ struct pmc_reg_map { + const int pm_read_disable_bit; + const u32 slps0_dbg_offset; + const u32 ltr_ignore_max; ++ const u32 pm_vric1_offset; + }; + + /** +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 7e35ce2162d0..503fda4e7e8e 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -1459,7 +1459,7 @@ __qla2xxx_eh_generic_reset(char *name, enum nexus_wait_type type, + goto eh_reset_failed; + } + err = 2; +- if (do_reset(fcport, cmd->device->lun, blk_mq_rq_cpu(cmd->request) + 1) ++ if (do_reset(fcport, cmd->device->lun, 1) + != QLA_SUCCESS) { + ql_log(ql_log_warn, vha, 0x800c, + "do_reset failed for cmd=%p.\n", cmd); +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 5a6e8e12701a..655ad26106e4 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -598,9 +598,16 @@ static bool scsi_end_request(struct request *req, blk_status_t error, + if (!blk_rq_is_scsi(req)) { + WARN_ON_ONCE(!(cmd->flags & SCMD_INITIALIZED)); + cmd->flags &= ~SCMD_INITIALIZED; +- destroy_rcu_head(&cmd->rcu); + } + ++ /* ++ * Calling rcu_barrier() is not necessary here because the ++ * SCSI error handler guarantees that the function called by ++ * call_rcu() has been called before scsi_end_request() is ++ * called. ++ */ ++ destroy_rcu_head(&cmd->rcu); ++ + /* + * In the MQ case the command gets freed by __blk_mq_end_request, + * so we have to do all cleanup that depends on it earlier. +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 0508831d6fb9..0a82e93566dc 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2200,6 +2200,8 @@ void iscsi_remove_session(struct iscsi_cls_session *session) + scsi_target_unblock(&session->dev, SDEV_TRANSPORT_OFFLINE); + /* flush running scans then delete devices */ + flush_work(&session->scan_work); ++ /* flush running unbind operations */ ++ flush_work(&session->unbind_work); + __iscsi_unbind_session(&session->unbind_work); + + /* hw iscsi may not have removed all connections from session */ +diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c +index 720760cd493f..ba39647a690c 100644 +--- a/drivers/thermal/broadcom/bcm2835_thermal.c ++++ b/drivers/thermal/broadcom/bcm2835_thermal.c +@@ -119,8 +119,7 @@ static const struct debugfs_reg32 bcm2835_thermal_regs[] = { + + static void bcm2835_thermal_debugfs(struct platform_device *pdev) + { +- struct thermal_zone_device *tz = platform_get_drvdata(pdev); +- struct bcm2835_thermal_data *data = tz->devdata; ++ struct bcm2835_thermal_data *data = platform_get_drvdata(pdev); + struct debugfs_regset32 *regset; + + data->debugfsdir = debugfs_create_dir("bcm2835_thermal", NULL); +@@ -266,7 +265,7 @@ static int bcm2835_thermal_probe(struct platform_device *pdev) + + data->tz = tz; + +- platform_set_drvdata(pdev, tz); ++ platform_set_drvdata(pdev, data); + + /* + * Thermal_zone doesn't enable hwmon as default, +@@ -290,8 +289,8 @@ err_clk: + + static int bcm2835_thermal_remove(struct platform_device *pdev) + { +- struct thermal_zone_device *tz = platform_get_drvdata(pdev); +- struct bcm2835_thermal_data *data = tz->devdata; ++ struct bcm2835_thermal_data *data = platform_get_drvdata(pdev); ++ struct thermal_zone_device *tz = data->tz; + + debugfs_remove_recursive(data->debugfsdir); + thermal_zone_of_sensor_unregister(&pdev->dev, tz); +diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +index 61ca7ce3624e..5f3ed24e26ec 100644 +--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +@@ -22,6 +22,13 @@ enum int3400_thermal_uuid { + INT3400_THERMAL_PASSIVE_1, + INT3400_THERMAL_ACTIVE, + INT3400_THERMAL_CRITICAL, ++ INT3400_THERMAL_ADAPTIVE_PERFORMANCE, ++ INT3400_THERMAL_EMERGENCY_CALL_MODE, ++ INT3400_THERMAL_PASSIVE_2, ++ INT3400_THERMAL_POWER_BOSS, ++ INT3400_THERMAL_VIRTUAL_SENSOR, ++ INT3400_THERMAL_COOLING_MODE, ++ INT3400_THERMAL_HARDWARE_DUTY_CYCLING, + INT3400_THERMAL_MAXIMUM_UUID, + }; + +@@ -29,6 +36,13 @@ static char *int3400_thermal_uuids[INT3400_THERMAL_MAXIMUM_UUID] = { + "42A441D6-AE6A-462b-A84B-4A8CE79027D3", + "3A95C389-E4B8-4629-A526-C52C88626BAE", + "97C68AE7-15FA-499c-B8C9-5DA81D606E0A", ++ "63BE270F-1C11-48FD-A6F7-3AF253FF3E2D", ++ "5349962F-71E6-431D-9AE8-0A635B710AEE", ++ "9E04115A-AE87-4D1C-9500-0F3E340BFE75", ++ "F5A35014-C209-46A4-993A-EB56DE7530A1", ++ "6ED722A7-9240-48A5-B479-31EEF723D7CF", ++ "16CAF1B7-DD38-40ED-B1C1-1B8A1913D531", ++ "BE84BABF-C4D4-403D-B495-3128FD44dAC1", + }; + + struct int3400_thermal_priv { +@@ -299,10 +313,9 @@ static int int3400_thermal_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, priv); + +- if (priv->uuid_bitmap & 1 << INT3400_THERMAL_PASSIVE_1) { +- int3400_thermal_ops.get_mode = int3400_thermal_get_mode; +- int3400_thermal_ops.set_mode = int3400_thermal_set_mode; +- } ++ int3400_thermal_ops.get_mode = int3400_thermal_get_mode; ++ int3400_thermal_ops.set_mode = int3400_thermal_set_mode; ++ + priv->thermal = thermal_zone_device_register("INT3400 Thermal", 0, 0, + priv, &int3400_thermal_ops, + &int3400_thermal_params, 0, 0); +diff --git a/drivers/thermal/intel/intel_powerclamp.c b/drivers/thermal/intel/intel_powerclamp.c +index 7571f7c2e7c9..ac7256b5f020 100644 +--- a/drivers/thermal/intel/intel_powerclamp.c ++++ b/drivers/thermal/intel/intel_powerclamp.c +@@ -101,7 +101,7 @@ struct powerclamp_worker_data { + bool clamping; + }; + +-static struct powerclamp_worker_data * __percpu worker_data; ++static struct powerclamp_worker_data __percpu *worker_data; + static struct thermal_cooling_device *cooling_dev; + static unsigned long *cpu_clamping_mask; /* bit map for tracking per cpu + * clamping kthread worker +@@ -494,7 +494,7 @@ static void start_power_clamp_worker(unsigned long cpu) + struct powerclamp_worker_data *w_data = per_cpu_ptr(worker_data, cpu); + struct kthread_worker *worker; + +- worker = kthread_create_worker_on_cpu(cpu, 0, "kidle_inject/%ld", cpu); ++ worker = kthread_create_worker_on_cpu(cpu, 0, "kidle_inj/%ld", cpu); + if (IS_ERR(worker)) + return; + +diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c +index 48eef552cba4..fc9399d9c082 100644 +--- a/drivers/thermal/samsung/exynos_tmu.c ++++ b/drivers/thermal/samsung/exynos_tmu.c +@@ -666,7 +666,7 @@ static int exynos_get_temp(void *p, int *temp) + struct exynos_tmu_data *data = p; + int value, ret = 0; + +- if (!data || !data->tmu_read || !data->enabled) ++ if (!data || !data->tmu_read) + return -EINVAL; + else if (!data->enabled) + /* +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 07cad54b84f1..e8e125acd712 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -1010,7 +1010,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, + unsigned int xid; + int rc; + +- if (remap_flags & ~REMAP_FILE_ADVISORY) ++ if (remap_flags & ~(REMAP_FILE_DEDUP | REMAP_FILE_ADVISORY)) + return -EINVAL; + + cifs_dbg(FYI, "clone range\n"); +diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c +index 924269cec135..e32c264e3adb 100644 +--- a/fs/cifs/smb2maperror.c ++++ b/fs/cifs/smb2maperror.c +@@ -1036,7 +1036,8 @@ static const struct status_to_posix_error smb2_error_map_table[] = { + {STATUS_UNFINISHED_CONTEXT_DELETED, -EIO, + "STATUS_UNFINISHED_CONTEXT_DELETED"}, + {STATUS_NO_TGT_REPLY, -EIO, "STATUS_NO_TGT_REPLY"}, +- {STATUS_OBJECTID_NOT_FOUND, -EIO, "STATUS_OBJECTID_NOT_FOUND"}, ++ /* Note that ENOATTTR and ENODATA are the same errno */ ++ {STATUS_OBJECTID_NOT_FOUND, -ENODATA, "STATUS_OBJECTID_NOT_FOUND"}, + {STATUS_NO_IP_ADDRESSES, -EIO, "STATUS_NO_IP_ADDRESSES"}, + {STATUS_WRONG_CREDENTIAL_HANDLE, -EIO, + "STATUS_WRONG_CREDENTIAL_HANDLE"}, +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index b29f711ab965..ea56b1cdbdde 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -949,6 +949,16 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + resp_buftype[0] = resp_buftype[1] = resp_buftype[2] = CIFS_NO_BUFFER; + memset(rsp_iov, 0, sizeof(rsp_iov)); + ++ if (ses->server->ops->query_all_EAs) { ++ if (!ea_value) { ++ rc = ses->server->ops->query_all_EAs(xid, tcon, path, ++ ea_name, NULL, 0, ++ cifs_sb); ++ if (rc == -ENODATA) ++ goto sea_exit; ++ } ++ } ++ + /* Open */ + memset(&open_iov, 0, sizeof(open_iov)); + rqst[0].rq_iov = open_iov; +diff --git a/fs/cifs/trace.h b/fs/cifs/trace.h +index 59be48206932..b49bc925fb4f 100644 +--- a/fs/cifs/trace.h ++++ b/fs/cifs/trace.h +@@ -378,19 +378,19 @@ DECLARE_EVENT_CLASS(smb3_tcon_class, + __field(unsigned int, xid) + __field(__u32, tid) + __field(__u64, sesid) +- __field(const char *, unc_name) ++ __string(name, unc_name) + __field(int, rc) + ), + TP_fast_assign( + __entry->xid = xid; + __entry->tid = tid; + __entry->sesid = sesid; +- __entry->unc_name = unc_name; ++ __assign_str(name, unc_name); + __entry->rc = rc; + ), + TP_printk("xid=%u sid=0x%llx tid=0x%x unc_name=%s rc=%d", + __entry->xid, __entry->sesid, __entry->tid, +- __entry->unc_name, __entry->rc) ++ __get_str(name), __entry->rc) + ) + + #define DEFINE_SMB3_TCON_EVENT(name) \ +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 2e76fb55d94a..5f24fdc140ad 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -999,6 +999,13 @@ resizefs_out: + if (!blk_queue_discard(q)) + return -EOPNOTSUPP; + ++ /* ++ * We haven't replayed the journal, so we cannot use our ++ * block-bitmap-guided storage zapping commands. ++ */ ++ if (test_opt(sb, NOLOAD) && ext4_has_feature_journal(sb)) ++ return -EROFS; ++ + if (copy_from_user(&range, (struct fstrim_range __user *)arg, + sizeof(range))) + return -EFAULT; +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 3d9b18505c0c..e7ae26e36c9c 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -932,11 +932,18 @@ static int add_new_gdb_meta_bg(struct super_block *sb, + memcpy(n_group_desc, o_group_desc, + EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *)); + n_group_desc[gdb_num] = gdb_bh; ++ ++ BUFFER_TRACE(gdb_bh, "get_write_access"); ++ err = ext4_journal_get_write_access(handle, gdb_bh); ++ if (err) { ++ kvfree(n_group_desc); ++ brelse(gdb_bh); ++ return err; ++ } ++ + EXT4_SB(sb)->s_group_desc = n_group_desc; + EXT4_SB(sb)->s_gdb_count++; + kvfree(o_group_desc); +- BUFFER_TRACE(gdb_bh, "get_write_access"); +- err = ext4_journal_get_write_access(handle, gdb_bh); + return err; + } + +@@ -2073,6 +2080,10 @@ out: + free_flex_gd(flex_gd); + if (resize_inode != NULL) + iput(resize_inode); +- ext4_msg(sb, KERN_INFO, "resized filesystem to %llu", n_blocks_count); ++ if (err) ++ ext4_warning(sb, "error (%d) occurred during " ++ "file system resize", err); ++ ext4_msg(sb, KERN_INFO, "resized filesystem to %llu", ++ ext4_blocks_count(es)); + return err; + } +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index fb12d3c17c1b..b9bca7298f96 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -430,6 +430,12 @@ static void ext4_journal_commit_callback(journal_t *journal, transaction_t *txn) + spin_unlock(&sbi->s_md_lock); + } + ++static bool system_going_down(void) ++{ ++ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF ++ || system_state == SYSTEM_RESTART; ++} ++ + /* Deal with the reporting of failure conditions on a filesystem such as + * inconsistencies detected or read IO failures. + * +@@ -460,7 +466,12 @@ static void ext4_handle_error(struct super_block *sb) + if (journal) + jbd2_journal_abort(journal, -EIO); + } +- if (test_opt(sb, ERRORS_RO)) { ++ /* ++ * We force ERRORS_RO behavior when system is rebooting. Otherwise we ++ * could panic during 'reboot -f' as the underlying device got already ++ * disabled. ++ */ ++ if (test_opt(sb, ERRORS_RO) || system_going_down()) { + ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); + /* + * Make sure updated value of ->s_mount_flags will be visible +@@ -468,8 +479,7 @@ static void ext4_handle_error(struct super_block *sb) + */ + smp_wmb(); + sb->s_flags |= SB_RDONLY; +- } +- if (test_opt(sb, ERRORS_PANIC)) { ++ } else if (test_opt(sb, ERRORS_PANIC)) { + if (EXT4_SB(sb)->s_journal && + !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR)) + return; +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index f955cd3e0677..7743fa83b895 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -306,8 +306,9 @@ static int f2fs_write_meta_pages(struct address_space *mapping, + goto skip_write; + + /* collect a number of dirty meta pages and write together */ +- if (wbc->for_kupdate || +- get_pages(sbi, F2FS_DIRTY_META) < nr_pages_to_skip(sbi, META)) ++ if (wbc->sync_mode != WB_SYNC_ALL && ++ get_pages(sbi, F2FS_DIRTY_META) < ++ nr_pages_to_skip(sbi, META)) + goto skip_write; + + /* if locked failed, cp will flush dirty pages instead */ +@@ -405,7 +406,7 @@ static int f2fs_set_meta_page_dirty(struct page *page) + if (!PageDirty(page)) { + __set_page_dirty_nobuffers(page); + inc_page_count(F2FS_P_SB(page), F2FS_DIRTY_META); +- SetPagePrivate(page); ++ f2fs_set_page_private(page, 0); + f2fs_trace_pid(page); + return 1; + } +@@ -956,7 +957,7 @@ void f2fs_update_dirty_page(struct inode *inode, struct page *page) + inode_inc_dirty_pages(inode); + spin_unlock(&sbi->inode_lock[type]); + +- SetPagePrivate(page); ++ f2fs_set_page_private(page, 0); + f2fs_trace_pid(page); + } + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index f91d8630c9a2..c99aab23efea 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2711,8 +2711,7 @@ void f2fs_invalidate_page(struct page *page, unsigned int offset, + if (IS_ATOMIC_WRITTEN_PAGE(page)) + return f2fs_drop_inmem_page(inode, page); + +- set_page_private(page, 0); +- ClearPagePrivate(page); ++ f2fs_clear_page_private(page); + } + + int f2fs_release_page(struct page *page, gfp_t wait) +@@ -2726,8 +2725,7 @@ int f2fs_release_page(struct page *page, gfp_t wait) + return 0; + + clear_cold_data(page); +- set_page_private(page, 0); +- ClearPagePrivate(page); ++ f2fs_clear_page_private(page); + return 1; + } + +@@ -2795,12 +2793,8 @@ int f2fs_migrate_page(struct address_space *mapping, + return -EAGAIN; + } + +- /* +- * A reference is expected if PagePrivate set when move mapping, +- * however F2FS breaks this for maintaining dirty page counts when +- * truncating pages. So here adjusting the 'extra_count' make it work. +- */ +- extra_count = (atomic_written ? 1 : 0) - page_has_private(page); ++ /* one extra reference was held for atomic_write page */ ++ extra_count = atomic_written ? 1 : 0; + rc = migrate_page_move_mapping(mapping, newpage, + page, mode, extra_count); + if (rc != MIGRATEPAGE_SUCCESS) { +@@ -2821,9 +2815,10 @@ int f2fs_migrate_page(struct address_space *mapping, + get_page(newpage); + } + +- if (PagePrivate(page)) +- SetPagePrivate(newpage); +- set_page_private(newpage, page_private(page)); ++ if (PagePrivate(page)) { ++ f2fs_set_page_private(newpage, page_private(page)); ++ f2fs_clear_page_private(page); ++ } + + if (mode != MIGRATE_SYNC_NO_COPY) + migrate_page_copy(newpage, page); +diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c +index 50d0d36280fa..99a6063c2327 100644 +--- a/fs/f2fs/dir.c ++++ b/fs/f2fs/dir.c +@@ -728,7 +728,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page, + !f2fs_truncate_hole(dir, page->index, page->index + 1)) { + f2fs_clear_page_cache_dirty_tag(page); + clear_page_dirty_for_io(page); +- ClearPagePrivate(page); ++ f2fs_clear_page_private(page); + ClearPageUptodate(page); + clear_cold_data(page); + inode_dec_dirty_pages(dir); +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 279bc00489cc..6d9186a6528c 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -2825,6 +2825,27 @@ static inline bool is_valid_data_blkaddr(struct f2fs_sb_info *sbi, + return true; + } + ++static inline void f2fs_set_page_private(struct page *page, ++ unsigned long data) ++{ ++ if (PagePrivate(page)) ++ return; ++ ++ get_page(page); ++ SetPagePrivate(page); ++ set_page_private(page, data); ++} ++ ++static inline void f2fs_clear_page_private(struct page *page) ++{ ++ if (!PagePrivate(page)) ++ return; ++ ++ set_page_private(page, 0); ++ ClearPagePrivate(page); ++ f2fs_put_page(page, 0); ++} ++ + /* + * file.c + */ +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index ae2b45e75847..30ed43bce110 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -768,7 +768,6 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr) + { + struct inode *inode = d_inode(dentry); + int err; +- bool size_changed = false; + + if (unlikely(f2fs_cp_error(F2FS_I_SB(inode)))) + return -EIO; +@@ -843,8 +842,6 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr) + down_write(&F2FS_I(inode)->i_sem); + F2FS_I(inode)->last_disk_size = i_size_read(inode); + up_write(&F2FS_I(inode)->i_sem); +- +- size_changed = true; + } + + __setattr_copy(inode, attr); +@@ -858,7 +855,7 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr) + } + + /* file size may changed here */ +- f2fs_mark_inode_dirty_sync(inode, size_changed); ++ f2fs_mark_inode_dirty_sync(inode, true); + + /* inode change will produce dirty node pages flushed by checkpoint */ + f2fs_balance_fs(F2FS_I_SB(inode), true); +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 4f450e573312..3f99ab288695 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1920,7 +1920,9 @@ static int f2fs_write_node_pages(struct address_space *mapping, + f2fs_balance_fs_bg(sbi); + + /* collect a number of dirty node pages and write together */ +- if (get_pages(sbi, F2FS_DIRTY_NODES) < nr_pages_to_skip(sbi, NODE)) ++ if (wbc->sync_mode != WB_SYNC_ALL && ++ get_pages(sbi, F2FS_DIRTY_NODES) < ++ nr_pages_to_skip(sbi, NODE)) + goto skip_write; + + if (wbc->sync_mode == WB_SYNC_ALL) +@@ -1959,7 +1961,7 @@ static int f2fs_set_node_page_dirty(struct page *page) + if (!PageDirty(page)) { + __set_page_dirty_nobuffers(page); + inc_page_count(F2FS_P_SB(page), F2FS_DIRTY_NODES); +- SetPagePrivate(page); ++ f2fs_set_page_private(page, 0); + f2fs_trace_pid(page); + return 1; + } +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index e1b1d390b329..b6c8b0696ef6 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -191,8 +191,7 @@ void f2fs_register_inmem_page(struct inode *inode, struct page *page) + + f2fs_trace_pid(page); + +- set_page_private(page, (unsigned long)ATOMIC_WRITTEN_PAGE); +- SetPagePrivate(page); ++ f2fs_set_page_private(page, (unsigned long)ATOMIC_WRITTEN_PAGE); + + new = f2fs_kmem_cache_alloc(inmem_entry_slab, GFP_NOFS); + +@@ -280,8 +279,7 @@ next: + ClearPageUptodate(page); + clear_cold_data(page); + } +- set_page_private(page, 0); +- ClearPagePrivate(page); ++ f2fs_clear_page_private(page); + f2fs_put_page(page, 1); + + list_del(&cur->list); +@@ -370,8 +368,7 @@ void f2fs_drop_inmem_page(struct inode *inode, struct page *page) + kmem_cache_free(inmem_entry_slab, cur); + + ClearPageUptodate(page); +- set_page_private(page, 0); +- ClearPagePrivate(page); ++ f2fs_clear_page_private(page); + f2fs_put_page(page, 0); + + trace_f2fs_commit_inmem_page(page, INMEM_INVALIDATE); +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 5892fa3c885f..144ffba3ec5a 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1460,9 +1460,16 @@ static int f2fs_enable_quotas(struct super_block *sb); + + static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi) + { ++ unsigned int s_flags = sbi->sb->s_flags; + struct cp_control cpc; +- int err; ++ int err = 0; ++ int ret; + ++ if (s_flags & SB_RDONLY) { ++ f2fs_msg(sbi->sb, KERN_ERR, ++ "checkpoint=disable on readonly fs"); ++ return -EINVAL; ++ } + sbi->sb->s_flags |= SB_ACTIVE; + + f2fs_update_time(sbi, DISABLE_TIME); +@@ -1470,18 +1477,24 @@ static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi) + while (!f2fs_time_over(sbi, DISABLE_TIME)) { + mutex_lock(&sbi->gc_mutex); + err = f2fs_gc(sbi, true, false, NULL_SEGNO); +- if (err == -ENODATA) ++ if (err == -ENODATA) { ++ err = 0; + break; ++ } + if (err && err != -EAGAIN) +- return err; ++ break; + } + +- err = sync_filesystem(sbi->sb); +- if (err) +- return err; ++ ret = sync_filesystem(sbi->sb); ++ if (ret || err) { ++ err = ret ? ret: err; ++ goto restore_flag; ++ } + +- if (f2fs_disable_cp_again(sbi)) +- return -EAGAIN; ++ if (f2fs_disable_cp_again(sbi)) { ++ err = -EAGAIN; ++ goto restore_flag; ++ } + + mutex_lock(&sbi->gc_mutex); + cpc.reason = CP_PAUSE; +@@ -1490,7 +1503,9 @@ static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi) + + sbi->unusable_block_count = 0; + mutex_unlock(&sbi->gc_mutex); +- return 0; ++restore_flag: ++ sbi->sb->s_flags = s_flags; /* Restore MS_RDONLY status */ ++ return err; + } + + static void f2fs_enable_checkpoint(struct f2fs_sb_info *sbi) +@@ -3359,7 +3374,7 @@ skip_recovery: + if (test_opt(sbi, DISABLE_CHECKPOINT)) { + err = f2fs_disable_checkpoint(sbi); + if (err) +- goto free_meta; ++ goto sync_free_meta; + } else if (is_set_ckpt_flags(sbi, CP_DISABLED_FLAG)) { + f2fs_enable_checkpoint(sbi); + } +@@ -3372,7 +3387,7 @@ skip_recovery: + /* After POR, we can run background GC thread.*/ + err = f2fs_start_gc_thread(sbi); + if (err) +- goto free_meta; ++ goto sync_free_meta; + } + kvfree(options); + +@@ -3394,6 +3409,11 @@ skip_recovery: + f2fs_update_time(sbi, REQ_TIME); + return 0; + ++sync_free_meta: ++ /* safe to flush all the data */ ++ sync_filesystem(sbi->sb); ++ retry = false; ++ + free_meta: + #ifdef CONFIG_QUOTA + f2fs_truncate_quota_inode_pages(sb); +@@ -3407,6 +3427,8 @@ free_meta: + * falls into an infinite loop in f2fs_sync_meta_pages(). + */ + truncate_inode_pages_final(META_MAPPING(sbi)); ++ /* evict some inodes being cached by GC */ ++ evict_inodes(sb); + f2fs_unregister_sysfs(sbi); + free_root_inode: + dput(sb->s_root); +diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c +index 73b92985198b..6b6fe6431a64 100644 +--- a/fs/f2fs/xattr.c ++++ b/fs/f2fs/xattr.c +@@ -347,7 +347,7 @@ check: + *base_addr = txattr_addr; + return 0; + out: +- kzfree(txattr_addr); ++ kvfree(txattr_addr); + return err; + } + +@@ -390,7 +390,7 @@ static int read_all_xattrs(struct inode *inode, struct page *ipage, + *base_addr = txattr_addr; + return 0; + fail: +- kzfree(txattr_addr); ++ kvfree(txattr_addr); + return err; + } + +@@ -517,7 +517,7 @@ int f2fs_getxattr(struct inode *inode, int index, const char *name, + } + error = size; + out: +- kzfree(base_addr); ++ kvfree(base_addr); + return error; + } + +@@ -563,7 +563,7 @@ ssize_t f2fs_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size) + } + error = buffer_size - rest; + cleanup: +- kzfree(base_addr); ++ kvfree(base_addr); + return error; + } + +@@ -694,7 +694,7 @@ static int __f2fs_setxattr(struct inode *inode, int index, + if (!error && S_ISDIR(inode->i_mode)) + set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_CP); + exit: +- kzfree(base_addr); ++ kvfree(base_addr); + return error; + } + +diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c +index 798f1253141a..3b7b8e95c98a 100644 +--- a/fs/notify/inotify/inotify_user.c ++++ b/fs/notify/inotify/inotify_user.c +@@ -519,8 +519,10 @@ static int inotify_update_existing_watch(struct fsnotify_group *group, + fsn_mark = fsnotify_find_mark(&inode->i_fsnotify_marks, group); + if (!fsn_mark) + return -ENOENT; +- else if (create) +- return -EEXIST; ++ else if (create) { ++ ret = -EEXIST; ++ goto out; ++ } + + i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark); + +@@ -548,6 +550,7 @@ static int inotify_update_existing_watch(struct fsnotify_group *group, + /* return the wd */ + ret = i_mark->wd; + ++out: + /* match the get from fsnotify_find_mark() */ + fsnotify_put_mark(fsn_mark); + +diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c +index bbcc185062bb..d29d869abec1 100644 +--- a/fs/proc/kcore.c ++++ b/fs/proc/kcore.c +@@ -54,6 +54,28 @@ static LIST_HEAD(kclist_head); + static DECLARE_RWSEM(kclist_lock); + static int kcore_need_update = 1; + ++/* ++ * Returns > 0 for RAM pages, 0 for non-RAM pages, < 0 on error ++ * Same as oldmem_pfn_is_ram in vmcore ++ */ ++static int (*mem_pfn_is_ram)(unsigned long pfn); ++ ++int __init register_mem_pfn_is_ram(int (*fn)(unsigned long pfn)) ++{ ++ if (mem_pfn_is_ram) ++ return -EBUSY; ++ mem_pfn_is_ram = fn; ++ return 0; ++} ++ ++static int pfn_is_ram(unsigned long pfn) ++{ ++ if (mem_pfn_is_ram) ++ return mem_pfn_is_ram(pfn); ++ else ++ return 1; ++} ++ + /* This doesn't grab kclist_lock, so it should only be used at init time. */ + void __init kclist_add(struct kcore_list *new, void *addr, size_t size, + int type) +@@ -465,6 +487,11 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos) + goto out; + } + m = NULL; /* skip the list anchor */ ++ } else if (!pfn_is_ram(__pa(start) >> PAGE_SHIFT)) { ++ if (clear_user(buffer, tsz)) { ++ ret = -EFAULT; ++ goto out; ++ } + } else if (m->type == KCORE_VMALLOC) { + vread(buf, (char *)start, tsz); + /* we have to zero-fill user buffer even if no read */ +diff --git a/include/linux/atalk.h b/include/linux/atalk.h +index 840cf92307ba..d5cfc0b15b76 100644 +--- a/include/linux/atalk.h ++++ b/include/linux/atalk.h +@@ -158,7 +158,7 @@ extern int sysctl_aarp_retransmit_limit; + extern int sysctl_aarp_resolve_time; + + #ifdef CONFIG_SYSCTL +-extern void atalk_register_sysctl(void); ++extern int atalk_register_sysctl(void); + extern void atalk_unregister_sysctl(void); + #else + static inline int atalk_register_sysctl(void) +diff --git a/include/linux/kcore.h b/include/linux/kcore.h +index 8c3f8c14eeaa..c843f4a9c512 100644 +--- a/include/linux/kcore.h ++++ b/include/linux/kcore.h +@@ -44,6 +44,8 @@ void kclist_add_remap(struct kcore_list *m, void *addr, void *vaddr, size_t sz) + m->vaddr = (unsigned long)vaddr; + kclist_add(m, addr, sz, KCORE_REMAP); + } ++ ++extern int __init register_mem_pfn_is_ram(int (*fn)(unsigned long pfn)); + #else + static inline + void kclist_add(struct kcore_list *new, void *addr, size_t size, int type) +diff --git a/include/linux/swap.h b/include/linux/swap.h +index 622025ac1461..f1146ed21062 100644 +--- a/include/linux/swap.h ++++ b/include/linux/swap.h +@@ -157,9 +157,9 @@ struct swap_extent { + /* + * Max bad pages in the new format.. + */ +-#define __swapoffset(x) ((unsigned long)&((union swap_header *)0)->x) + #define MAX_SWAP_BADPAGES \ +- ((__swapoffset(magic.magic) - __swapoffset(info.badpages)) / sizeof(int)) ++ ((offsetof(union swap_header, magic.magic) - \ ++ offsetof(union swap_header, info.badpages)) / sizeof(int)) + + enum { + SWP_USED = (1 << 0), /* is slot in swap_info[] used? */ +diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h +index 5b50fe4906d2..7b60fd186cfe 100644 +--- a/include/trace/events/rxrpc.h ++++ b/include/trace/events/rxrpc.h +@@ -76,6 +76,7 @@ enum rxrpc_client_trace { + rxrpc_client_chan_disconnect, + rxrpc_client_chan_pass, + rxrpc_client_chan_unstarted, ++ rxrpc_client_chan_wait_failed, + rxrpc_client_cleanup, + rxrpc_client_count, + rxrpc_client_discard, +@@ -276,6 +277,7 @@ enum rxrpc_tx_point { + EM(rxrpc_client_chan_disconnect, "ChDisc") \ + EM(rxrpc_client_chan_pass, "ChPass") \ + EM(rxrpc_client_chan_unstarted, "ChUnst") \ ++ EM(rxrpc_client_chan_wait_failed, "ChWtFl") \ + EM(rxrpc_client_cleanup, "Clean ") \ + EM(rxrpc_client_count, "Count ") \ + EM(rxrpc_client_discard, "Discar") \ +diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c +index 2ada5e21dfa6..4a8f390a2b82 100644 +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -554,19 +554,6 @@ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type typ + } + EXPORT_SYMBOL(bpf_prog_get_type_path); + +-static void bpf_evict_inode(struct inode *inode) +-{ +- enum bpf_type type; +- +- truncate_inode_pages_final(&inode->i_data); +- clear_inode(inode); +- +- if (S_ISLNK(inode->i_mode)) +- kfree(inode->i_link); +- if (!bpf_inode_type(inode, &type)) +- bpf_any_put(inode->i_private, type); +-} +- + /* + * Display the mount options in /proc/mounts. + */ +@@ -579,11 +566,28 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) + return 0; + } + ++static void bpf_destroy_inode_deferred(struct rcu_head *head) ++{ ++ struct inode *inode = container_of(head, struct inode, i_rcu); ++ enum bpf_type type; ++ ++ if (S_ISLNK(inode->i_mode)) ++ kfree(inode->i_link); ++ if (!bpf_inode_type(inode, &type)) ++ bpf_any_put(inode->i_private, type); ++ free_inode_nonrcu(inode); ++} ++ ++static void bpf_destroy_inode(struct inode *inode) ++{ ++ call_rcu(&inode->i_rcu, bpf_destroy_inode_deferred); ++} ++ + static const struct super_operations bpf_super_ops = { + .statfs = simple_statfs, + .drop_inode = generic_delete_inode, + .show_options = bpf_show_options, +- .evict_inode = bpf_evict_inode, ++ .destroy_inode = bpf_destroy_inode, + }; + + enum { +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 26d6edab051a..2e2305a81047 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -7178,6 +7178,7 @@ static void perf_event_mmap_output(struct perf_event *event, + struct perf_output_handle handle; + struct perf_sample_data sample; + int size = mmap_event->event_id.header.size; ++ u32 type = mmap_event->event_id.header.type; + int ret; + + if (!perf_event_mmap_match(event, data)) +@@ -7221,6 +7222,7 @@ static void perf_event_mmap_output(struct perf_event *event, + perf_output_end(&handle); + out: + mmap_event->event_id.header.size = size; ++ mmap_event->event_id.header.type = type; + } + + static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 01a2489de94e..62cc29364fba 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -6942,7 +6942,7 @@ static int __maybe_unused cpu_period_quota_parse(char *buf, + { + char tok[21]; /* U64_MAX */ + +- if (!sscanf(buf, "%s %llu", tok, periodp)) ++ if (sscanf(buf, "%20s %llu", tok, periodp) < 1) + return -EINVAL; + + *periodp *= NSEC_PER_USEC; +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index 033ec7c45f13..1ccf77f6d346 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -48,10 +48,10 @@ struct sugov_cpu { + + bool iowait_boost_pending; + unsigned int iowait_boost; +- unsigned int iowait_boost_max; + u64 last_update; + + unsigned long bw_dl; ++ unsigned long min; + unsigned long max; + + /* The field below is for single-CPU policies only: */ +@@ -303,8 +303,7 @@ static bool sugov_iowait_reset(struct sugov_cpu *sg_cpu, u64 time, + if (delta_ns <= TICK_NSEC) + return false; + +- sg_cpu->iowait_boost = set_iowait_boost +- ? sg_cpu->sg_policy->policy->min : 0; ++ sg_cpu->iowait_boost = set_iowait_boost ? sg_cpu->min : 0; + sg_cpu->iowait_boost_pending = set_iowait_boost; + + return true; +@@ -344,14 +343,13 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, u64 time, + + /* Double the boost at each request */ + if (sg_cpu->iowait_boost) { +- sg_cpu->iowait_boost <<= 1; +- if (sg_cpu->iowait_boost > sg_cpu->iowait_boost_max) +- sg_cpu->iowait_boost = sg_cpu->iowait_boost_max; ++ sg_cpu->iowait_boost = ++ min_t(unsigned int, sg_cpu->iowait_boost << 1, SCHED_CAPACITY_SCALE); + return; + } + + /* First wakeup after IO: start with minimum boost */ +- sg_cpu->iowait_boost = sg_cpu->sg_policy->policy->min; ++ sg_cpu->iowait_boost = sg_cpu->min; + } + + /** +@@ -373,47 +371,38 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, u64 time, + * This mechanism is designed to boost high frequently IO waiting tasks, while + * being more conservative on tasks which does sporadic IO operations. + */ +-static void sugov_iowait_apply(struct sugov_cpu *sg_cpu, u64 time, +- unsigned long *util, unsigned long *max) ++static unsigned long sugov_iowait_apply(struct sugov_cpu *sg_cpu, u64 time, ++ unsigned long util, unsigned long max) + { +- unsigned int boost_util, boost_max; ++ unsigned long boost; + + /* No boost currently required */ + if (!sg_cpu->iowait_boost) +- return; ++ return util; + + /* Reset boost if the CPU appears to have been idle enough */ + if (sugov_iowait_reset(sg_cpu, time, false)) +- return; ++ return util; + +- /* +- * An IO waiting task has just woken up: +- * allow to further double the boost value +- */ +- if (sg_cpu->iowait_boost_pending) { +- sg_cpu->iowait_boost_pending = false; +- } else { ++ if (!sg_cpu->iowait_boost_pending) { + /* +- * Otherwise: reduce the boost value and disable it when we +- * reach the minimum. ++ * No boost pending; reduce the boost value. + */ + sg_cpu->iowait_boost >>= 1; +- if (sg_cpu->iowait_boost < sg_cpu->sg_policy->policy->min) { ++ if (sg_cpu->iowait_boost < sg_cpu->min) { + sg_cpu->iowait_boost = 0; +- return; ++ return util; + } + } + ++ sg_cpu->iowait_boost_pending = false; ++ + /* +- * Apply the current boost value: a CPU is boosted only if its current +- * utilization is smaller then the current IO boost level. ++ * @util is already in capacity scale; convert iowait_boost ++ * into the same scale so we can compare. + */ +- boost_util = sg_cpu->iowait_boost; +- boost_max = sg_cpu->iowait_boost_max; +- if (*util * boost_max < *max * boost_util) { +- *util = boost_util; +- *max = boost_max; +- } ++ boost = (sg_cpu->iowait_boost * max) >> SCHED_CAPACITY_SHIFT; ++ return max(boost, util); + } + + #ifdef CONFIG_NO_HZ_COMMON +@@ -460,7 +449,7 @@ static void sugov_update_single(struct update_util_data *hook, u64 time, + + util = sugov_get_util(sg_cpu); + max = sg_cpu->max; +- sugov_iowait_apply(sg_cpu, time, &util, &max); ++ util = sugov_iowait_apply(sg_cpu, time, util, max); + next_f = get_next_freq(sg_policy, util, max); + /* + * Do not reduce the frequency if the CPU has not been idle +@@ -500,7 +489,7 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu, u64 time) + + j_util = sugov_get_util(j_sg_cpu); + j_max = j_sg_cpu->max; +- sugov_iowait_apply(j_sg_cpu, time, &j_util, &j_max); ++ j_util = sugov_iowait_apply(j_sg_cpu, time, j_util, j_max); + + if (j_util * max > j_max * util) { + util = j_util; +@@ -837,7 +826,9 @@ static int sugov_start(struct cpufreq_policy *policy) + memset(sg_cpu, 0, sizeof(*sg_cpu)); + sg_cpu->cpu = cpu; + sg_cpu->sg_policy = sg_policy; +- sg_cpu->iowait_boost_max = policy->cpuinfo.max_freq; ++ sg_cpu->min = ++ (SCHED_CAPACITY_SCALE * policy->cpuinfo.min_freq) / ++ policy->cpuinfo.max_freq; + } + + for_each_cpu(cpu, policy->cpus) { +diff --git a/lib/div64.c b/lib/div64.c +index 01c8602bb6ff..ee146bb4c558 100644 +--- a/lib/div64.c ++++ b/lib/div64.c +@@ -109,7 +109,7 @@ u64 div64_u64_rem(u64 dividend, u64 divisor, u64 *remainder) + quot = div_u64_rem(dividend, divisor, &rem32); + *remainder = rem32; + } else { +- int n = 1 + fls(high); ++ int n = fls(high); + quot = div_u64(dividend >> n, divisor >> n); + + if (quot != 0) +@@ -147,7 +147,7 @@ u64 div64_u64(u64 dividend, u64 divisor) + if (high == 0) { + quot = div_u64(dividend, divisor); + } else { +- int n = 1 + fls(high); ++ int n = fls(high); + quot = div_u64(dividend >> n, divisor >> n); + + if (quot != 0) +diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c +index 8006295f8bd7..dda73991bb54 100644 +--- a/net/appletalk/atalk_proc.c ++++ b/net/appletalk/atalk_proc.c +@@ -255,7 +255,7 @@ out_interface: + goto out; + } + +-void __exit atalk_proc_exit(void) ++void atalk_proc_exit(void) + { + remove_proc_entry("interface", atalk_proc_dir); + remove_proc_entry("route", atalk_proc_dir); +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index 9b6bc5abe946..795fbc6c06aa 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -1910,12 +1910,16 @@ static const char atalk_err_snap[] __initconst = + /* Called by proto.c on kernel start up */ + static int __init atalk_init(void) + { +- int rc = proto_register(&ddp_proto, 0); ++ int rc; + +- if (rc != 0) ++ rc = proto_register(&ddp_proto, 0); ++ if (rc) + goto out; + +- (void)sock_register(&atalk_family_ops); ++ rc = sock_register(&atalk_family_ops); ++ if (rc) ++ goto out_proto; ++ + ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv); + if (!ddp_dl) + printk(atalk_err_snap); +@@ -1923,12 +1927,33 @@ static int __init atalk_init(void) + dev_add_pack(<alk_packet_type); + dev_add_pack(&ppptalk_packet_type); + +- register_netdevice_notifier(&ddp_notifier); ++ rc = register_netdevice_notifier(&ddp_notifier); ++ if (rc) ++ goto out_sock; ++ + aarp_proto_init(); +- atalk_proc_init(); +- atalk_register_sysctl(); ++ rc = atalk_proc_init(); ++ if (rc) ++ goto out_aarp; ++ ++ rc = atalk_register_sysctl(); ++ if (rc) ++ goto out_proc; + out: + return rc; ++out_proc: ++ atalk_proc_exit(); ++out_aarp: ++ aarp_cleanup_module(); ++ unregister_netdevice_notifier(&ddp_notifier); ++out_sock: ++ dev_remove_pack(&ppptalk_packet_type); ++ dev_remove_pack(<alk_packet_type); ++ unregister_snap_client(ddp_dl); ++ sock_unregister(PF_APPLETALK); ++out_proto: ++ proto_unregister(&ddp_proto); ++ goto out; + } + module_init(atalk_init); + +diff --git a/net/appletalk/sysctl_net_atalk.c b/net/appletalk/sysctl_net_atalk.c +index c744a853fa5f..d945b7c0176d 100644 +--- a/net/appletalk/sysctl_net_atalk.c ++++ b/net/appletalk/sysctl_net_atalk.c +@@ -45,9 +45,12 @@ static struct ctl_table atalk_table[] = { + + static struct ctl_table_header *atalk_table_header; + +-void atalk_register_sysctl(void) ++int __init atalk_register_sysctl(void) + { + atalk_table_header = register_net_sysctl(&init_net, "net/appletalk", atalk_table); ++ if (!atalk_table_header) ++ return -ENOMEM; ++ return 0; + } + + void atalk_unregister_sysctl(void) +diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c +index 5cf6d9f4761d..83797b3949e2 100644 +--- a/net/rxrpc/conn_client.c ++++ b/net/rxrpc/conn_client.c +@@ -704,6 +704,7 @@ int rxrpc_connect_call(struct rxrpc_sock *rx, + + ret = rxrpc_wait_for_channel(call, gfp); + if (ret < 0) { ++ trace_rxrpc_client(call->conn, ret, rxrpc_client_chan_wait_failed); + rxrpc_disconnect_client_call(call); + goto out; + } +@@ -774,16 +775,22 @@ static void rxrpc_set_client_reap_timer(struct rxrpc_net *rxnet) + */ + void rxrpc_disconnect_client_call(struct rxrpc_call *call) + { +- unsigned int channel = call->cid & RXRPC_CHANNELMASK; + struct rxrpc_connection *conn = call->conn; +- struct rxrpc_channel *chan = &conn->channels[channel]; ++ struct rxrpc_channel *chan = NULL; + struct rxrpc_net *rxnet = conn->params.local->rxnet; ++ unsigned int channel = -1; ++ u32 cid; + ++ spin_lock(&conn->channel_lock); ++ ++ cid = call->cid; ++ if (cid) { ++ channel = cid & RXRPC_CHANNELMASK; ++ chan = &conn->channels[channel]; ++ } + trace_rxrpc_client(conn, channel, rxrpc_client_chan_disconnect); + call->conn = NULL; + +- spin_lock(&conn->channel_lock); +- + /* Calls that have never actually been assigned a channel can simply be + * discarded. If the conn didn't get used either, it will follow + * immediately unless someone else grabs it in the meantime. +@@ -807,7 +814,10 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *call) + goto out; + } + +- ASSERTCMP(rcu_access_pointer(chan->call), ==, call); ++ if (rcu_access_pointer(chan->call) != call) { ++ spin_unlock(&conn->channel_lock); ++ BUG(); ++ } + + /* If a client call was exposed to the world, we save the result for + * retransmission. +diff --git a/sound/drivers/opl3/opl3_voice.h b/sound/drivers/opl3/opl3_voice.h +index 5b02bd49fde4..4e4ecc21760b 100644 +--- a/sound/drivers/opl3/opl3_voice.h ++++ b/sound/drivers/opl3/opl3_voice.h +@@ -41,7 +41,7 @@ void snd_opl3_timer_func(struct timer_list *t); + + /* Prototypes for opl3_drums.c */ + void snd_opl3_load_drums(struct snd_opl3 *opl3); +-void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int on_off, int vel, struct snd_midi_channel *chan); ++void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int vel, int on_off, struct snd_midi_channel *chan); + + /* Prototypes for opl3_oss.c */ + #if IS_ENABLED(CONFIG_SND_SEQUENCER_OSS) +diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c +index d77dcba276b5..1eb8b61a185b 100644 +--- a/sound/isa/sb/sb8.c ++++ b/sound/isa/sb/sb8.c +@@ -111,6 +111,10 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) + + /* block the 0x388 port to avoid PnP conflicts */ + acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); ++ if (!acard->fm_res) { ++ err = -EBUSY; ++ goto _err; ++ } + + if (port[dev] != SNDRV_AUTO_PORT) { + if ((err = snd_sbdsp_create(card, port[dev], irq[dev], +diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c +index 907cf1a46712..3ef2b27ebbe8 100644 +--- a/sound/pci/echoaudio/echoaudio.c ++++ b/sound/pci/echoaudio/echoaudio.c +@@ -1954,6 +1954,11 @@ static int snd_echo_create(struct snd_card *card, + } + chip->dsp_registers = (volatile u32 __iomem *) + ioremap_nocache(chip->dsp_registers_phys, sz); ++ if (!chip->dsp_registers) { ++ dev_err(chip->card->dev, "ioremap failed\n"); ++ snd_echo_free(chip); ++ return -ENOMEM; ++ } + + if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED, + KBUILD_MODNAME, chip)) { +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 169e347c76f6..9ba1a2e1ed7a 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -627,7 +627,7 @@ bpf_object__init_maps(struct bpf_object *obj, int flags) + bool strict = !(flags & MAPS_RELAX_COMPAT); + int i, map_idx, map_def_sz, nr_maps = 0; + Elf_Scn *scn; +- Elf_Data *data; ++ Elf_Data *data = NULL; + Elf_Data *symbols = obj->efile.symbols; + + if (obj->efile.maps_shndx < 0) +diff --git a/tools/perf/Documentation/perf-config.txt b/tools/perf/Documentation/perf-config.txt +index 4ac7775fbc11..4851285ba00c 100644 +--- a/tools/perf/Documentation/perf-config.txt ++++ b/tools/perf/Documentation/perf-config.txt +@@ -114,7 +114,7 @@ Given a $HOME/.perfconfig like this: + + [report] + # Defaults +- sort-order = comm,dso,symbol ++ sort_order = comm,dso,symbol + percent-limit = 0 + queue-size = 0 + children = true +diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt +index 4bc2085e5197..39c05f89104e 100644 +--- a/tools/perf/Documentation/perf-stat.txt ++++ b/tools/perf/Documentation/perf-stat.txt +@@ -72,9 +72,8 @@ report:: + --all-cpus:: + system-wide collection from all CPUs (default if no target is specified) + +--c:: +---scale:: +- scale/normalize counter values ++--no-scale:: ++ Don't scale/normalize counter values + + -d:: + --detailed:: +diff --git a/tools/perf/bench/epoll-ctl.c b/tools/perf/bench/epoll-ctl.c +index 0c0a6e824934..2af067859966 100644 +--- a/tools/perf/bench/epoll-ctl.c ++++ b/tools/perf/bench/epoll-ctl.c +@@ -224,7 +224,7 @@ static int do_threads(struct worker *worker, struct cpu_map *cpu) + pthread_attr_t thread_attr, *attrp = NULL; + cpu_set_t cpuset; + unsigned int i, j; +- int ret; ++ int ret = 0; + + if (!noaffinity) + pthread_attr_init(&thread_attr); +diff --git a/tools/perf/bench/epoll-wait.c b/tools/perf/bench/epoll-wait.c +index 5a11534e96a0..fe85448abd45 100644 +--- a/tools/perf/bench/epoll-wait.c ++++ b/tools/perf/bench/epoll-wait.c +@@ -293,7 +293,7 @@ static int do_threads(struct worker *worker, struct cpu_map *cpu) + pthread_attr_t thread_attr, *attrp = NULL; + cpu_set_t cpuset; + unsigned int i, j; +- int ret, events = EPOLLIN; ++ int ret = 0, events = EPOLLIN; + + if (oneshot) + events |= EPOLLONESHOT; +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 63a3afc7f32b..a52295dbad2b 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -728,7 +728,8 @@ static struct option stat_options[] = { + "system-wide collection from all CPUs"), + OPT_BOOLEAN('g', "group", &group, + "put the counters into a counter group"), +- OPT_BOOLEAN('c', "scale", &stat_config.scale, "scale/normalize counters"), ++ OPT_BOOLEAN(0, "scale", &stat_config.scale, ++ "Use --no-scale to disable counter scaling for multiplexing"), + OPT_INCR('v', "verbose", &verbose, + "be more verbose (show counter open errors, etc)"), + OPT_INTEGER('r', "repeat", &stat_config.run_count, +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index f64e312db787..616408251e25 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -1633,8 +1633,9 @@ int cmd_top(int argc, const char **argv) + annotation_config__init(); + + symbol_conf.try_vmlinux_path = (symbol_conf.vmlinux_name == NULL); +- if (symbol__init(NULL) < 0) +- return -1; ++ status = symbol__init(NULL); ++ if (status < 0) ++ goto out_delete_evlist; + + sort__setup_elide(stdout); + +diff --git a/tools/perf/tests/backward-ring-buffer.c b/tools/perf/tests/backward-ring-buffer.c +index 6d598cc071ae..1a9c3becf5ff 100644 +--- a/tools/perf/tests/backward-ring-buffer.c ++++ b/tools/perf/tests/backward-ring-buffer.c +@@ -18,7 +18,7 @@ static void testcase(void) + int i; + + for (i = 0; i < NR_ITERS; i++) { +- char proc_name[10]; ++ char proc_name[15]; + + snprintf(proc_name, sizeof(proc_name), "p:%d\n", i); + prctl(PR_SET_NAME, proc_name); +diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c +index ea7acf403727..71f60c0f9faa 100644 +--- a/tools/perf/tests/evsel-tp-sched.c ++++ b/tools/perf/tests/evsel-tp-sched.c +@@ -85,5 +85,6 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes + if (perf_evsel__test_field(evsel, "target_cpu", 4, true)) + ret = -1; + ++ perf_evsel__delete(evsel); + return ret; + } +diff --git a/tools/perf/tests/expr.c b/tools/perf/tests/expr.c +index 01f0706995a9..9acc1e80b936 100644 +--- a/tools/perf/tests/expr.c ++++ b/tools/perf/tests/expr.c +@@ -19,7 +19,7 @@ int test__expr(struct test *t __maybe_unused, int subtest __maybe_unused) + const char *p; + const char **other; + double val; +- int ret; ++ int i, ret; + struct parse_ctx ctx; + int num_other; + +@@ -56,6 +56,9 @@ int test__expr(struct test *t __maybe_unused, int subtest __maybe_unused) + TEST_ASSERT_VAL("find other", !strcmp(other[1], "BAZ")); + TEST_ASSERT_VAL("find other", !strcmp(other[2], "BOZO")); + TEST_ASSERT_VAL("find other", other[3] == NULL); ++ ++ for (i = 0; i < num_other; i++) ++ free((void *)other[i]); + free((void *)other); + + return 0; +diff --git a/tools/perf/tests/openat-syscall-all-cpus.c b/tools/perf/tests/openat-syscall-all-cpus.c +index c531e6deb104..493ecb611540 100644 +--- a/tools/perf/tests/openat-syscall-all-cpus.c ++++ b/tools/perf/tests/openat-syscall-all-cpus.c +@@ -45,7 +45,7 @@ int test__openat_syscall_event_on_all_cpus(struct test *test __maybe_unused, int + if (IS_ERR(evsel)) { + tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "syscalls", "sys_enter_openat"); + pr_debug("%s\n", errbuf); +- goto out_thread_map_delete; ++ goto out_cpu_map_delete; + } + + if (perf_evsel__open(evsel, cpus, threads) < 0) { +@@ -119,6 +119,8 @@ out_close_fd: + perf_evsel__close_fd(evsel); + out_evsel_delete: + perf_evsel__delete(evsel); ++out_cpu_map_delete: ++ cpu_map__put(cpus); + out_thread_map_delete: + thread_map__put(threads); + return err; +diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c +index 04b1d53e4bf9..1d352621bd48 100644 +--- a/tools/perf/util/build-id.c ++++ b/tools/perf/util/build-id.c +@@ -183,6 +183,7 @@ char *build_id_cache__linkname(const char *sbuild_id, char *bf, size_t size) + return bf; + } + ++/* The caller is responsible to free the returned buffer. */ + char *build_id_cache__origname(const char *sbuild_id) + { + char *linkname; +diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c +index 1ea8f898f1a1..9ecdbd5986b3 100644 +--- a/tools/perf/util/config.c ++++ b/tools/perf/util/config.c +@@ -632,11 +632,10 @@ static int collect_config(const char *var, const char *value, + } + + ret = set_value(item, value); +- return ret; + + out_free: + free(key); +- return -1; ++ return ret; + } + + int perf_config_set__collect(struct perf_config_set *set, const char *file_name, +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index dbc0466db368..50c933044f88 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -1289,6 +1289,7 @@ void perf_evsel__exit(struct perf_evsel *evsel) + { + assert(list_empty(&evsel->node)); + assert(evsel->evlist == NULL); ++ perf_evsel__free_counts(evsel); + perf_evsel__free_fd(evsel); + perf_evsel__free_id(evsel); + perf_evsel__free_config_terms(evsel); +@@ -1341,8 +1342,7 @@ void perf_counts_values__scale(struct perf_counts_values *count, + scaled = 1; + count->val = (u64)((double) count->val * count->ena / count->run + 0.5); + } +- } else +- count->ena = count->run = 0; ++ } + + if (pscaled) + *pscaled = scaled; +diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c +index 8aad8330e392..e416e76f5600 100644 +--- a/tools/perf/util/hist.c ++++ b/tools/perf/util/hist.c +@@ -1048,8 +1048,10 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, + + err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent, + iter->evsel, al, max_stack_depth); +- if (err) ++ if (err) { ++ map__put(alm); + return err; ++ } + + err = iter->ops->prepare_entry(iter, al); + if (err) +diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c +index 6751301a755c..2b37f56f0549 100644 +--- a/tools/perf/util/map.c ++++ b/tools/perf/util/map.c +@@ -571,10 +571,25 @@ static void __maps__purge(struct maps *maps) + } + } + ++static void __maps__purge_names(struct maps *maps) ++{ ++ struct rb_root *root = &maps->names; ++ struct rb_node *next = rb_first(root); ++ ++ while (next) { ++ struct map *pos = rb_entry(next, struct map, rb_node_name); ++ ++ next = rb_next(&pos->rb_node_name); ++ rb_erase_init(&pos->rb_node_name, root); ++ map__put(pos); ++ } ++} ++ + static void maps__exit(struct maps *maps) + { + down_write(&maps->lock); + __maps__purge(maps); ++ __maps__purge_names(maps); + up_write(&maps->lock); + } + +@@ -911,6 +926,9 @@ static void __maps__remove(struct maps *maps, struct map *map) + { + rb_erase_init(&map->rb_node, &maps->entries); + map__put(map); ++ ++ rb_erase_init(&map->rb_node_name, &maps->names); ++ map__put(map); + } + + void maps__remove(struct maps *maps, struct map *map) +diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c +index ea523d3b248f..989fed6f43b5 100644 +--- a/tools/perf/util/ordered-events.c ++++ b/tools/perf/util/ordered-events.c +@@ -270,6 +270,8 @@ static int __ordered_events__flush(struct ordered_events *oe, enum oe_flush how, + "FINAL", + "ROUND", + "HALF ", ++ "TOP ", ++ "TIME ", + }; + int err; + bool show_progress = false; +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 920e1e6551dd..03860313313c 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -2271,6 +2271,7 @@ static bool is_event_supported(u8 type, unsigned config) + perf_evsel__delete(evsel); + } + ++ thread_map__put(tmap); + return ret; + } + +@@ -2341,6 +2342,7 @@ void print_sdt_events(const char *subsys_glob, const char *event_glob, + printf(" %-50s [%s]\n", buf, "SDT event"); + free(buf); + } ++ free(path); + } else + printf(" %-50s [%s]\n", nd->s, "SDT event"); + if (nd2) { +diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c +index 4d40515307b8..2856cc9d5a31 100644 +--- a/tools/perf/util/stat.c ++++ b/tools/perf/util/stat.c +@@ -291,10 +291,8 @@ process_counter_values(struct perf_stat_config *config, struct perf_evsel *evsel + break; + case AGGR_GLOBAL: + aggr->val += count->val; +- if (config->scale) { +- aggr->ena += count->ena; +- aggr->run += count->run; +- } ++ aggr->ena += count->ena; ++ aggr->run += count->run; + case AGGR_UNSET: + default: + break; +@@ -442,10 +440,8 @@ int create_perf_stat_counter(struct perf_evsel *evsel, + struct perf_event_attr *attr = &evsel->attr; + struct perf_evsel *leader = evsel->leader; + +- if (config->scale) { +- attr->read_format = PERF_FORMAT_TOTAL_TIME_ENABLED | +- PERF_FORMAT_TOTAL_TIME_RUNNING; +- } ++ attr->read_format = PERF_FORMAT_TOTAL_TIME_ENABLED | ++ PERF_FORMAT_TOTAL_TIME_RUNNING; + + /* + * The event is part of non trivial group, let's enable +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 9327c0ddc3a5..c3fad065c89c 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -5077,6 +5077,9 @@ int fork_it(char **argv) + signal(SIGQUIT, SIG_IGN); + if (waitpid(child_pid, &status, 0) == -1) + err(status, "waitpid"); ++ ++ if (WIFEXITED(status)) ++ status = WEXITSTATUS(status); + } + /* + * n.b. fork_it() does not check for errors from for_all_cpus()