diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1018_linux-4.17.19.patch | 10954 |
2 files changed, 10958 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 18871875..b1dd52b9 100644 --- a/0000_README +++ b/0000_README @@ -115,6 +115,10 @@ Patch: 1017_linux-4.17.18.patch From: http://www.kernel.org Desc: Linux 4.17.18 +Patch: 1018_linux-4.17.19.patch +From: http://www.kernel.org +Desc: Linux 4.17.19 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1018_linux-4.17.19.patch b/1018_linux-4.17.19.patch new file mode 100644 index 00000000..aac0886e --- /dev/null +++ b/1018_linux-4.17.19.patch @@ -0,0 +1,10954 @@ +diff --git a/Makefile b/Makefile +index 429a1fe0b40b..32c83a163544 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 17 +-SUBLEVEL = 18 ++SUBLEVEL = 19 + EXTRAVERSION = + NAME = Merciless Moray + +@@ -356,9 +356,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ + else if [ -x /bin/bash ]; then echo /bin/bash; \ + else echo sh; fi ; fi) + +-HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS) +-HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS) +-HOST_LFS_LIBS := $(shell getconf LFS_LIBS) ++HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS 2>/dev/null) ++HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS 2>/dev/null) ++HOST_LFS_LIBS := $(shell getconf LFS_LIBS 2>/dev/null) + + HOSTCC = gcc + HOSTCXX = g++ +diff --git a/arch/arc/Makefile b/arch/arc/Makefile +index d37f49d6a27f..6c1b20dd76ad 100644 +--- a/arch/arc/Makefile ++++ b/arch/arc/Makefile +@@ -16,7 +16,7 @@ endif + + KBUILD_DEFCONFIG := nsim_700_defconfig + +-cflags-y += -fno-common -pipe -fno-builtin -D__linux__ ++cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ + cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7 + cflags-$(CONFIG_ISA_ARCV2) += -mcpu=archs + +@@ -140,16 +140,3 @@ dtbs: scripts + + archclean: + $(Q)$(MAKE) $(clean)=$(boot) +- +-# Hacks to enable final link due to absence of link-time branch relexation +-# and gcc choosing optimal(shorter) branches at -O3 +-# +-# vineetg Feb 2010: -mlong-calls switched off for overall kernel build +-# However lib/decompress_inflate.o (.init.text) calls +-# zlib_inflate_workspacesize (.text) causing relocation errors. +-# Thus forcing all exten calls in this file to be long calls +-export CFLAGS_decompress_inflate.o = -mmedium-calls +-export CFLAGS_initramfs.o = -mmedium-calls +-ifdef CONFIG_SMP +-export CFLAGS_core.o = -mmedium-calls +-endif +diff --git a/arch/arc/include/asm/mach_desc.h b/arch/arc/include/asm/mach_desc.h +index c28e6c347b49..871f3cb16af9 100644 +--- a/arch/arc/include/asm/mach_desc.h ++++ b/arch/arc/include/asm/mach_desc.h +@@ -34,9 +34,7 @@ struct machine_desc { + const char *name; + const char **dt_compat; + void (*init_early)(void); +-#ifdef CONFIG_SMP + void (*init_per_cpu)(unsigned int); +-#endif + void (*init_machine)(void); + void (*init_late)(void); + +diff --git a/arch/arc/kernel/irq.c b/arch/arc/kernel/irq.c +index 538b36afe89e..62b185057c04 100644 +--- a/arch/arc/kernel/irq.c ++++ b/arch/arc/kernel/irq.c +@@ -31,10 +31,10 @@ void __init init_IRQ(void) + /* a SMP H/w block could do IPI IRQ request here */ + if (plat_smp_ops.init_per_cpu) + plat_smp_ops.init_per_cpu(smp_processor_id()); ++#endif + + if (machine_desc->init_per_cpu) + machine_desc->init_per_cpu(smp_processor_id()); +-#endif + } + + /* +diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c +index 5ac3b547453f..4674541eba3f 100644 +--- a/arch/arc/kernel/process.c ++++ b/arch/arc/kernel/process.c +@@ -47,7 +47,8 @@ SYSCALL_DEFINE0(arc_gettls) + SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new) + { + struct pt_regs *regs = current_pt_regs(); +- int uval = -EFAULT; ++ u32 uval; ++ int ret; + + /* + * This is only for old cores lacking LLOCK/SCOND, which by defintion +@@ -60,23 +61,47 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new) + /* Z indicates to userspace if operation succeded */ + regs->status32 &= ~STATUS_Z_MASK; + +- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int))) +- return -EFAULT; ++ ret = access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr)); ++ if (!ret) ++ goto fail; + ++again: + preempt_disable(); + +- if (__get_user(uval, uaddr)) +- goto done; ++ ret = __get_user(uval, uaddr); ++ if (ret) ++ goto fault; + +- if (uval == expected) { +- if (!__put_user(new, uaddr)) +- regs->status32 |= STATUS_Z_MASK; +- } ++ if (uval != expected) ++ goto out; + +-done: +- preempt_enable(); ++ ret = __put_user(new, uaddr); ++ if (ret) ++ goto fault; ++ ++ regs->status32 |= STATUS_Z_MASK; + ++out: ++ preempt_enable(); + return uval; ++ ++fault: ++ preempt_enable(); ++ ++ if (unlikely(ret != -EFAULT)) ++ goto fail; ++ ++ down_read(¤t->mm->mmap_sem); ++ ret = fixup_user_fault(current, current->mm, (unsigned long) uaddr, ++ FAULT_FLAG_WRITE, NULL); ++ up_read(¤t->mm->mmap_sem); ++ ++ if (likely(!ret)) ++ goto again; ++ ++fail: ++ force_sig(SIGSEGV, current); ++ return ret; + } + + #ifdef CONFIG_ISA_ARCV2 +diff --git a/arch/arc/plat-hsdk/platform.c b/arch/arc/plat-hsdk/platform.c +index 2958aedb649a..2588b842407c 100644 +--- a/arch/arc/plat-hsdk/platform.c ++++ b/arch/arc/plat-hsdk/platform.c +@@ -42,6 +42,66 @@ static void __init hsdk_init_per_cpu(unsigned int cpu) + #define SDIO_UHS_REG_EXT (SDIO_BASE + 0x108) + #define SDIO_UHS_REG_EXT_DIV_2 (2 << 30) + ++#define HSDK_GPIO_INTC (ARC_PERIPHERAL_BASE + 0x3000) ++ ++static void __init hsdk_enable_gpio_intc_wire(void) ++{ ++ /* ++ * Peripherals on CPU Card are wired to cpu intc via intermediate ++ * DW APB GPIO blocks (mainly for debouncing) ++ * ++ * --------------------- ++ * | snps,archs-intc | ++ * --------------------- ++ * | ++ * ---------------------- ++ * | snps,archs-idu-intc | ++ * ---------------------- ++ * | | | | | ++ * | [eth] [USB] [... other peripherals] ++ * | ++ * ------------------- ++ * | snps,dw-apb-intc | ++ * ------------------- ++ * | | | | ++ * [Bt] [HAPS] [... other peripherals] ++ * ++ * Current implementation of "irq-dw-apb-ictl" driver doesn't work well ++ * with stacked INTCs. In particular problem happens if its master INTC ++ * not yet instantiated. See discussion here - ++ * https://lkml.org/lkml/2015/3/4/755 ++ * ++ * So setup the first gpio block as a passive pass thru and hide it from ++ * DT hardware topology - connect intc directly to cpu intc ++ * The GPIO "wire" needs to be init nevertheless (here) ++ * ++ * One side adv is that peripheral interrupt handling avoids one nested ++ * intc ISR hop ++ * ++ * According to HSDK User's Manual [1], "Table 2 Interrupt Mapping" ++ * we have the following GPIO input lines used as sources of interrupt: ++ * - GPIO[0] - Bluetooth interrupt of RS9113 module ++ * - GPIO[2] - HAPS interrupt (on HapsTrak 3 connector) ++ * - GPIO[3] - Audio codec (MAX9880A) interrupt ++ * - GPIO[8-23] - Available on Arduino and PMOD_x headers ++ * For now there's no use of Arduino and PMOD_x headers in Linux ++ * use-case so we only enable lines 0, 2 and 3. ++ * ++ * [1] https://github.com/foss-for-synopsys-dwc-arc-processors/ARC-Development-Systems-Forum/wiki/docs/ARC_HSDK_User_Guide.pdf ++ */ ++#define GPIO_INTEN (HSDK_GPIO_INTC + 0x30) ++#define GPIO_INTMASK (HSDK_GPIO_INTC + 0x34) ++#define GPIO_INTTYPE_LEVEL (HSDK_GPIO_INTC + 0x38) ++#define GPIO_INT_POLARITY (HSDK_GPIO_INTC + 0x3c) ++#define GPIO_INT_CONNECTED_MASK 0x0d ++ ++ iowrite32(0xffffffff, (void __iomem *) GPIO_INTMASK); ++ iowrite32(~GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTMASK); ++ iowrite32(0x00000000, (void __iomem *) GPIO_INTTYPE_LEVEL); ++ iowrite32(0xffffffff, (void __iomem *) GPIO_INT_POLARITY); ++ iowrite32(GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTEN); ++} ++ + static void __init hsdk_init_early(void) + { + /* +@@ -62,6 +122,8 @@ static void __init hsdk_init_early(void) + * minimum possible div-by-2. + */ + iowrite32(SDIO_UHS_REG_EXT_DIV_2, (void __iomem *) SDIO_UHS_REG_EXT); ++ ++ hsdk_enable_gpio_intc_wire(); + } + + static const char *hsdk_compat[] __initconst = { +diff --git a/arch/arm/boot/dts/am3517.dtsi b/arch/arm/boot/dts/am3517.dtsi +index 4b6062b631b1..23ea381d363f 100644 +--- a/arch/arm/boot/dts/am3517.dtsi ++++ b/arch/arm/boot/dts/am3517.dtsi +@@ -91,6 +91,11 @@ + }; + }; + ++/* Table Table 5-79 of the TRM shows 480ab000 is reserved */ ++&usb_otg_hs { ++ status = "disabled"; ++}; ++ + &iva { + status = "disabled"; + }; +diff --git a/arch/arm/boot/dts/am437x-sk-evm.dts b/arch/arm/boot/dts/am437x-sk-evm.dts +index 4118802b7fea..f17ed89da06b 100644 +--- a/arch/arm/boot/dts/am437x-sk-evm.dts ++++ b/arch/arm/boot/dts/am437x-sk-evm.dts +@@ -537,6 +537,8 @@ + + touchscreen-size-x = <480>; + touchscreen-size-y = <272>; ++ ++ wakeup-source; + }; + + tlv320aic3106: tlv320aic3106@1b { +diff --git a/arch/arm/boot/dts/armada-385-synology-ds116.dts b/arch/arm/boot/dts/armada-385-synology-ds116.dts +index 6782ce481ac9..d8769956cbfc 100644 +--- a/arch/arm/boot/dts/armada-385-synology-ds116.dts ++++ b/arch/arm/boot/dts/armada-385-synology-ds116.dts +@@ -139,7 +139,7 @@ + 3700 5 + 3900 6 + 4000 7>; +- cooling-cells = <2>; ++ #cooling-cells = <2>; + }; + + gpio-leds { +diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi +index 9fe4f5a6379e..2c4df2d2d4a6 100644 +--- a/arch/arm/boot/dts/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi +@@ -216,7 +216,7 @@ + reg = <0x18008000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 85 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -245,7 +245,7 @@ + reg = <0x1800b000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 86 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -256,7 +256,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -278,10 +278,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>, +- <GIC_SPI 97 IRQ_TYPE_NONE>, +- <GIC_SPI 98 IRQ_TYPE_NONE>, +- <GIC_SPI 99 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>; + }; + }; + +@@ -291,7 +291,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <1>; + +@@ -313,10 +313,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 102 IRQ_TYPE_NONE>, +- <GIC_SPI 103 IRQ_TYPE_NONE>, +- <GIC_SPI 104 IRQ_TYPE_NONE>, +- <GIC_SPI 105 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>; + }; + }; + +diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi +index 3f9cedd8011f..3084a7c95733 100644 +--- a/arch/arm/boot/dts/bcm-hr2.dtsi ++++ b/arch/arm/boot/dts/bcm-hr2.dtsi +@@ -264,7 +264,7 @@ + reg = <0x38000 0x50>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 95 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + }; + +@@ -279,7 +279,7 @@ + reg = <0x3b000 0x50>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + }; + }; +@@ -300,7 +300,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -322,10 +322,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 182 IRQ_TYPE_NONE>, +- <GIC_SPI 183 IRQ_TYPE_NONE>, +- <GIC_SPI 184 IRQ_TYPE_NONE>, +- <GIC_SPI 185 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 183 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 185 IRQ_TYPE_LEVEL_HIGH>; + brcm,pcie-msi-inten; + }; + }; +@@ -336,7 +336,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <1>; + +@@ -358,10 +358,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 188 IRQ_TYPE_NONE>, +- <GIC_SPI 189 IRQ_TYPE_NONE>, +- <GIC_SPI 190 IRQ_TYPE_NONE>, +- <GIC_SPI 191 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>; + brcm,pcie-msi-inten; + }; + }; +diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi +index dcc55aa84583..09ba85046322 100644 +--- a/arch/arm/boot/dts/bcm-nsp.dtsi ++++ b/arch/arm/boot/dts/bcm-nsp.dtsi +@@ -391,7 +391,7 @@ + reg = <0x38000 0x50>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 89 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + dma-coherent; + status = "disabled"; +@@ -496,7 +496,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -519,10 +519,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 127 IRQ_TYPE_NONE>, +- <GIC_SPI 128 IRQ_TYPE_NONE>, +- <GIC_SPI 129 IRQ_TYPE_NONE>, +- <GIC_SPI 130 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 128 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 129 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>; + brcm,pcie-msi-inten; + }; + }; +@@ -533,7 +533,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <1>; + +@@ -556,10 +556,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 133 IRQ_TYPE_NONE>, +- <GIC_SPI 134 IRQ_TYPE_NONE>, +- <GIC_SPI 135 IRQ_TYPE_NONE>, +- <GIC_SPI 136 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>; + brcm,pcie-msi-inten; + }; + }; +@@ -570,7 +570,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <2>; + +@@ -593,10 +593,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 139 IRQ_TYPE_NONE>, +- <GIC_SPI 140 IRQ_TYPE_NONE>, +- <GIC_SPI 141 IRQ_TYPE_NONE>, +- <GIC_SPI 142 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>; + brcm,pcie-msi-inten; + }; + }; +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 9a076c409f4e..ef995e50ee12 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -365,7 +365,7 @@ + i2c0: i2c@18009000 { + compatible = "brcm,iproc-i2c"; + reg = <0x18009000 0x50>; +- interrupts = <GIC_SPI 121 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>; + #address-cells = <1>; + #size-cells = <0>; + clock-frequency = <100000>; +diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi +index 12010002dbdb..a8500f062706 100644 +--- a/arch/arm/boot/dts/da850.dtsi ++++ b/arch/arm/boot/dts/da850.dtsi +@@ -539,11 +539,7 @@ + gpio-controller; + #gpio-cells = <2>; + reg = <0x226000 0x1000>; +- interrupts = <42 IRQ_TYPE_EDGE_BOTH +- 43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH +- 45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH +- 47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH +- 49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>; ++ interrupts = <42 43 44 45 46 47 48 49 50>; + ti,ngpio = <144>; + ti,davinci-gpio-unbanked = <0>; + status = "disabled"; +diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi +index 911f7f0e3cea..e000e27f595b 100644 +--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi +@@ -672,7 +672,7 @@ + dsa,member = <0 0>; + eeprom-length = <512>; + interrupt-parent = <&gpio6>; +- interrupts = <3 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; + #interrupt-cells = <2>; + +diff --git a/arch/arm/boot/dts/omap4-droid4-xt894.dts b/arch/arm/boot/dts/omap4-droid4-xt894.dts +index bdf73cbcec3a..e7c3c563ff8f 100644 +--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts ++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts +@@ -159,13 +159,7 @@ + + dais = <&mcbsp2_port>, <&mcbsp3_port>; + }; +-}; +- +-&dss { +- status = "okay"; +-}; + +-&gpio6 { + pwm8: dmtimer-pwm-8 { + pinctrl-names = "default"; + pinctrl-0 = <&vibrator_direction_pin>; +@@ -192,7 +186,10 @@ + pwm-names = "enable", "direction"; + direction-duty-cycle-ns = <10000000>; + }; ++}; + ++&dss { ++ status = "okay"; + }; + + &dsi1 { +diff --git a/arch/arm/configs/imx_v4_v5_defconfig b/arch/arm/configs/imx_v4_v5_defconfig +index 054591dc9a00..4cd2f4a2bff4 100644 +--- a/arch/arm/configs/imx_v4_v5_defconfig ++++ b/arch/arm/configs/imx_v4_v5_defconfig +@@ -141,9 +141,11 @@ CONFIG_USB_STORAGE=y + CONFIG_USB_CHIPIDEA=y + CONFIG_USB_CHIPIDEA_UDC=y + CONFIG_USB_CHIPIDEA_HOST=y ++CONFIG_USB_CHIPIDEA_ULPI=y + CONFIG_NOP_USB_XCEIV=y + CONFIG_USB_GADGET=y + CONFIG_USB_ETH=m ++CONFIG_USB_ULPI_BUS=y + CONFIG_MMC=y + CONFIG_MMC_SDHCI=y + CONFIG_MMC_SDHCI_PLTFM=y +diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig +index 3a308437b088..19c924de353b 100644 +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -294,6 +294,7 @@ CONFIG_USB_STORAGE=y + CONFIG_USB_CHIPIDEA=y + CONFIG_USB_CHIPIDEA_UDC=y + CONFIG_USB_CHIPIDEA_HOST=y ++CONFIG_USB_CHIPIDEA_ULPI=y + CONFIG_USB_SERIAL=m + CONFIG_USB_SERIAL_GENERIC=y + CONFIG_USB_SERIAL_FTDI_SIO=m +@@ -330,6 +331,7 @@ CONFIG_USB_GADGETFS=m + CONFIG_USB_FUNCTIONFS=m + CONFIG_USB_MASS_STORAGE=m + CONFIG_USB_G_SERIAL=m ++CONFIG_USB_ULPI_BUS=y + CONFIG_MMC=y + CONFIG_MMC_SDHCI=y + CONFIG_MMC_SDHCI_PLTFM=y +diff --git a/arch/arm/crypto/speck-neon-core.S b/arch/arm/crypto/speck-neon-core.S +index 3c1e203e53b9..57caa742016e 100644 +--- a/arch/arm/crypto/speck-neon-core.S ++++ b/arch/arm/crypto/speck-neon-core.S +@@ -272,9 +272,11 @@ + * Allocate stack space to store 128 bytes worth of tweaks. For + * performance, this space is aligned to a 16-byte boundary so that we + * can use the load/store instructions that declare 16-byte alignment. ++ * For Thumb2 compatibility, don't do the 'bic' directly on 'sp'. + */ +- sub sp, #128 +- bic sp, #0xf ++ sub r12, sp, #128 ++ bic r12, #0xf ++ mov sp, r12 + + .if \n == 64 + // Load first tweak +diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c +index 158ed9a1483f..826bd634d098 100644 +--- a/arch/arm/mach-davinci/board-da850-evm.c ++++ b/arch/arm/mach-davinci/board-da850-evm.c +@@ -773,7 +773,7 @@ static struct gpiod_lookup_table mmc_gpios_table = { + GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd", + GPIO_ACTIVE_LOW), + GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp", +- GPIO_ACTIVE_LOW), ++ GPIO_ACTIVE_HIGH), + }, + }; + +diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c +index 69df3620eca5..1c73694c871a 100644 +--- a/arch/arm/mach-omap2/omap-smp.c ++++ b/arch/arm/mach-omap2/omap-smp.c +@@ -109,6 +109,45 @@ void omap5_erratum_workaround_801819(void) + static inline void omap5_erratum_workaround_801819(void) { } + #endif + ++#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR ++/* ++ * Configure ACR and enable ACTLR[0] (Enable invalidates of BTB with ++ * ICIALLU) to activate the workaround for secondary Core. ++ * NOTE: it is assumed that the primary core's configuration is done ++ * by the boot loader (kernel will detect a misconfiguration and complain ++ * if this is not done). ++ * ++ * In General Purpose(GP) devices, ACR bit settings can only be done ++ * by ROM code in "secure world" using the smc call and there is no ++ * option to update the "firmware" on such devices. This also works for ++ * High security(HS) devices, as a backup option in case the ++ * "update" is not done in the "security firmware". ++ */ ++static void omap5_secondary_harden_predictor(void) ++{ ++ u32 acr, acr_mask; ++ ++ asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr)); ++ ++ /* ++ * ACTLR[0] (Enable invalidates of BTB with ICIALLU) ++ */ ++ acr_mask = BIT(0); ++ ++ /* Do we already have it done.. if yes, skip expensive smc */ ++ if ((acr & acr_mask) == acr_mask) ++ return; ++ ++ acr |= acr_mask; ++ omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr); ++ ++ pr_debug("%s: ARM ACR setup for CVE_2017_5715 applied on CPU%d\n", ++ __func__, smp_processor_id()); ++} ++#else ++static inline void omap5_secondary_harden_predictor(void) { } ++#endif ++ + static void omap4_secondary_init(unsigned int cpu) + { + /* +@@ -131,6 +170,8 @@ static void omap4_secondary_init(unsigned int cpu) + set_cntfreq(); + /* Configure ACR to disable streaming WA for 801819 */ + omap5_erratum_workaround_801819(); ++ /* Enable ACR to allow for ICUALLU workaround */ ++ omap5_secondary_harden_predictor(); + } + + /* +diff --git a/arch/arm/mach-pxa/irq.c b/arch/arm/mach-pxa/irq.c +index 9c10248fadcc..4e8c2116808e 100644 +--- a/arch/arm/mach-pxa/irq.c ++++ b/arch/arm/mach-pxa/irq.c +@@ -185,7 +185,7 @@ static int pxa_irq_suspend(void) + { + int i; + +- for (i = 0; i < pxa_internal_irq_nr / 32; i++) { ++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) { + void __iomem *base = irq_base(i); + + saved_icmr[i] = __raw_readl(base + ICMR); +@@ -204,7 +204,7 @@ static void pxa_irq_resume(void) + { + int i; + +- for (i = 0; i < pxa_internal_irq_nr / 32; i++) { ++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) { + void __iomem *base = irq_base(i); + + __raw_writel(saved_icmr[i], base + ICMR); +diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c +index c186474422f3..0cc8e04295a4 100644 +--- a/arch/arm/mm/init.c ++++ b/arch/arm/mm/init.c +@@ -736,20 +736,29 @@ static int __mark_rodata_ro(void *unused) + return 0; + } + ++static int kernel_set_to_readonly __read_mostly; ++ + void mark_rodata_ro(void) + { ++ kernel_set_to_readonly = 1; + stop_machine(__mark_rodata_ro, NULL, NULL); + debug_checkwx(); + } + + void set_kernel_text_rw(void) + { ++ if (!kernel_set_to_readonly) ++ return; ++ + set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), false, + current->active_mm); + } + + void set_kernel_text_ro(void) + { ++ if (!kernel_set_to_readonly) ++ return; ++ + set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), true, + current->active_mm); + } +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts +index 57eedced5a51..f7300cb6970f 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts +@@ -19,9 +19,22 @@ + + ðmac { + status = "okay"; +- phy-mode = "rgmii"; + pinctrl-0 = <ð_rgmii_y_pins>; + pinctrl-names = "default"; ++ phy-handle = <ð_phy0>; ++ phy-mode = "rgmii"; ++ ++ mdio { ++ compatible = "snps,dwmac-mdio"; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ eth_phy0: ethernet-phy@0 { ++ /* Realtek RTL8211F (0x001cc916) */ ++ reg = <0>; ++ eee-broken-1000t; ++ }; ++ }; + }; + + &uart_A { +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi +index eb327664a4d8..6aaafff674f9 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi +@@ -6,7 +6,7 @@ + + &apb { + mali: gpu@c0000 { +- compatible = "amlogic,meson-gxbb-mali", "arm,mali-450"; ++ compatible = "amlogic,meson-gxl-mali", "arm,mali-450"; + reg = <0x0 0xc0000 0x0 0x40000>; + interrupts = <GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 161 IRQ_TYPE_LEVEL_HIGH>, +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +index 4a2a6af8e752..4057197048dc 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -118,7 +118,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -149,7 +149,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <4>; + +@@ -566,7 +566,7 @@ + reg = <0x66080000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 394 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -594,7 +594,7 @@ + reg = <0x660b0000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 395 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +diff --git a/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts b/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts +index eb6f08cdbd79..77efa28c4dd5 100644 +--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts ++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts +@@ -43,6 +43,10 @@ + enet-phy-lane-swap; + }; + ++&sdio0 { ++ mmc-ddr-1_8v; ++}; ++ + &uart2 { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts b/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts +index 5084b037320f..55ba495ef56e 100644 +--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts ++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts +@@ -42,3 +42,7 @@ + &gphy0 { + enet-phy-lane-swap; + }; ++ ++&sdio0 { ++ mmc-ddr-1_8v; ++}; +diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi +index 99aaff0b6d72..b203152ad67c 100644 +--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi ++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi +@@ -409,7 +409,7 @@ + reg = <0x000b0000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 177 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 177 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -453,7 +453,7 @@ + reg = <0x000e0000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 178 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 178 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 66b318e1de80..aef814b2dc9e 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1191,14 +1191,14 @@ + + port@0 { + reg = <0>; +- etf_out: endpoint { ++ etf_in: endpoint { + slave-mode; + remote-endpoint = <&funnel0_out>; + }; + }; + port@1 { + reg = <0>; +- etf_in: endpoint { ++ etf_out: endpoint { + remote-endpoint = <&replicator_in>; + }; + }; +diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts b/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts +index 9b4dc41703e3..ae3b5adf32df 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts ++++ b/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts +@@ -54,7 +54,7 @@ + sound { + compatible = "audio-graph-card"; + label = "UniPhier LD11"; +- widgets = "Headphone", "Headphone Jack"; ++ widgets = "Headphone", "Headphones"; + dais = <&i2s_port2 + &i2s_port3 + &i2s_port4 +diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts b/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts +index fe6608ea3277..7919233c9ce2 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts ++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts +@@ -54,7 +54,7 @@ + sound { + compatible = "audio-graph-card"; + label = "UniPhier LD20"; +- widgets = "Headphone", "Headphone Jack"; ++ widgets = "Headphone", "Headphones"; + dais = <&i2s_port2 + &i2s_port3 + &i2s_port4 +diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h +index a91933b1e2e6..4b650ec1d7dd 100644 +--- a/arch/arm64/include/asm/alternative.h ++++ b/arch/arm64/include/asm/alternative.h +@@ -28,7 +28,12 @@ typedef void (*alternative_cb_t)(struct alt_instr *alt, + __le32 *origptr, __le32 *updptr, int nr_inst); + + void __init apply_alternatives_all(void); +-void apply_alternatives(void *start, size_t length); ++ ++#ifdef CONFIG_MODULES ++void apply_alternatives_module(void *start, size_t length); ++#else ++static inline void apply_alternatives_module(void *start, size_t length) { } ++#endif + + #define ALTINSTR_ENTRY(feature,cb) \ + " .word 661b - .\n" /* label */ \ +diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c +index 5c4bce4ac381..36fb069fd049 100644 +--- a/arch/arm64/kernel/alternative.c ++++ b/arch/arm64/kernel/alternative.c +@@ -122,7 +122,30 @@ static void patch_alternative(struct alt_instr *alt, + } + } + +-static void __apply_alternatives(void *alt_region, bool use_linear_alias) ++/* ++ * We provide our own, private D-cache cleaning function so that we don't ++ * accidentally call into the cache.S code, which is patched by us at ++ * runtime. ++ */ ++static void clean_dcache_range_nopatch(u64 start, u64 end) ++{ ++ u64 cur, d_size, ctr_el0; ++ ++ ctr_el0 = read_sanitised_ftr_reg(SYS_CTR_EL0); ++ d_size = 4 << cpuid_feature_extract_unsigned_field(ctr_el0, ++ CTR_DMINLINE_SHIFT); ++ cur = start & ~(d_size - 1); ++ do { ++ /* ++ * We must clean+invalidate to the PoC in order to avoid ++ * Cortex-A53 errata 826319, 827319, 824069 and 819472 ++ * (this corresponds to ARM64_WORKAROUND_CLEAN_CACHE) ++ */ ++ asm volatile("dc civac, %0" : : "r" (cur) : "memory"); ++ } while (cur += d_size, cur < end); ++} ++ ++static void __apply_alternatives(void *alt_region, bool is_module) + { + struct alt_instr *alt; + struct alt_region *region = alt_region; +@@ -145,7 +168,7 @@ static void __apply_alternatives(void *alt_region, bool use_linear_alias) + pr_info_once("patching kernel code\n"); + + origptr = ALT_ORIG_PTR(alt); +- updptr = use_linear_alias ? lm_alias(origptr) : origptr; ++ updptr = is_module ? origptr : lm_alias(origptr); + nr_inst = alt->orig_len / AARCH64_INSN_SIZE; + + if (alt->cpufeature < ARM64_CB_PATCH) +@@ -155,8 +178,20 @@ static void __apply_alternatives(void *alt_region, bool use_linear_alias) + + alt_cb(alt, origptr, updptr, nr_inst); + +- flush_icache_range((uintptr_t)origptr, +- (uintptr_t)(origptr + nr_inst)); ++ if (!is_module) { ++ clean_dcache_range_nopatch((u64)origptr, ++ (u64)(origptr + nr_inst)); ++ } ++ } ++ ++ /* ++ * The core module code takes care of cache maintenance in ++ * flush_module_icache(). ++ */ ++ if (!is_module) { ++ dsb(ish); ++ __flush_icache_all(); ++ isb(); + } + } + +@@ -178,7 +213,7 @@ static int __apply_alternatives_multi_stop(void *unused) + isb(); + } else { + BUG_ON(alternatives_applied); +- __apply_alternatives(®ion, true); ++ __apply_alternatives(®ion, false); + /* Barriers provided by the cache flushing */ + WRITE_ONCE(alternatives_applied, 1); + } +@@ -192,12 +227,14 @@ void __init apply_alternatives_all(void) + stop_machine(__apply_alternatives_multi_stop, NULL, cpu_online_mask); + } + +-void apply_alternatives(void *start, size_t length) ++#ifdef CONFIG_MODULES ++void apply_alternatives_module(void *start, size_t length) + { + struct alt_region region = { + .begin = start, + .end = start + length, + }; + +- __apply_alternatives(®ion, false); ++ __apply_alternatives(®ion, true); + } ++#endif +diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c +index 155fd91e78f4..f0f27aeefb73 100644 +--- a/arch/arm64/kernel/module.c ++++ b/arch/arm64/kernel/module.c +@@ -448,9 +448,8 @@ int module_finalize(const Elf_Ehdr *hdr, + const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; + + for (s = sechdrs, se = sechdrs + hdr->e_shnum; s < se; s++) { +- if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) { +- apply_alternatives((void *)s->sh_addr, s->sh_size); +- } ++ if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) ++ apply_alternatives_module((void *)s->sh_addr, s->sh_size); + #ifdef CONFIG_ARM64_MODULE_PLTS + if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) && + !strcmp(".text.ftrace_trampoline", secstrs + s->sh_name)) +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index f3e2e3aec0b0..2faa9863d2e5 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -179,7 +179,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) + * This is the secondary CPU boot entry. We're using this CPUs + * idle thread stack, but a set of temporary page tables. + */ +-asmlinkage void secondary_start_kernel(void) ++asmlinkage notrace void secondary_start_kernel(void) + { + u64 mpidr = read_cpuid_mpidr() & MPIDR_HWID_BITMASK; + struct mm_struct *mm = &init_mm; +diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c +index a96ec0181818..4ed7ffa26d27 100644 +--- a/arch/arm64/mm/dma-mapping.c ++++ b/arch/arm64/mm/dma-mapping.c +@@ -588,13 +588,14 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size, + size >> PAGE_SHIFT); + return NULL; + } +- if (!coherent) +- __dma_flush_area(page_to_virt(page), iosize); +- + addr = dma_common_contiguous_remap(page, size, VM_USERMAP, + prot, + __builtin_return_address(0)); +- if (!addr) { ++ if (addr) { ++ memset(addr, 0, size); ++ if (!coherent) ++ __dma_flush_area(page_to_virt(page), iosize); ++ } else { + iommu_dma_unmap_page(dev, *handle, iosize, 0, attrs); + dma_release_from_contiguous(dev, page, + size >> PAGE_SHIFT); +diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c +index 8fb280e33114..b483152875b5 100644 +--- a/arch/ia64/kernel/perfmon.c ++++ b/arch/ia64/kernel/perfmon.c +@@ -2278,17 +2278,15 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t + DPRINT(("smpl_buf @%p\n", smpl_buf)); + + /* allocate vma */ +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(mm); + if (!vma) { + DPRINT(("Cannot allocate vma\n")); + goto error_kmem; + } +- INIT_LIST_HEAD(&vma->anon_vma_chain); + + /* + * partially initialize the vma for the sampling buffer + */ +- vma->vm_mm = mm; + vma->vm_file = get_file(filp); + vma->vm_flags = VM_READ|VM_MAYREAD|VM_DONTEXPAND|VM_DONTDUMP; + vma->vm_page_prot = PAGE_READONLY; /* XXX may need to change */ +@@ -2346,7 +2344,7 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t + return 0; + + error: +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + error_kmem: + pfm_rvfree(smpl_buf, size); + +diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c +index 18278b448530..bdb14a369137 100644 +--- a/arch/ia64/mm/init.c ++++ b/arch/ia64/mm/init.c +@@ -114,10 +114,8 @@ ia64_init_addr_space (void) + * the problem. When the process attempts to write to the register backing store + * for the first time, it will get a SEGFAULT in this case. + */ +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(current->mm); + if (vma) { +- INIT_LIST_HEAD(&vma->anon_vma_chain); +- vma->vm_mm = current->mm; + vma->vm_start = current->thread.rbs_bot & PAGE_MASK; + vma->vm_end = vma->vm_start + PAGE_SIZE; + vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT; +@@ -125,7 +123,7 @@ ia64_init_addr_space (void) + down_write(¤t->mm->mmap_sem); + if (insert_vm_struct(current->mm, vma)) { + up_write(¤t->mm->mmap_sem); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return; + } + up_write(¤t->mm->mmap_sem); +@@ -133,10 +131,8 @@ ia64_init_addr_space (void) + + /* map NaT-page at address zero to speed up speculative dereferencing of NULL: */ + if (!(current->personality & MMAP_PAGE_ZERO)) { +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(current->mm); + if (vma) { +- INIT_LIST_HEAD(&vma->anon_vma_chain); +- vma->vm_mm = current->mm; + vma->vm_end = PAGE_SIZE; + vma->vm_page_prot = __pgprot(pgprot_val(PAGE_READONLY) | _PAGE_MA_NAT); + vma->vm_flags = VM_READ | VM_MAYREAD | VM_IO | +@@ -144,7 +140,7 @@ ia64_init_addr_space (void) + down_write(¤t->mm->mmap_sem); + if (insert_vm_struct(current->mm, vma)) { + up_write(¤t->mm->mmap_sem); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return; + } + up_write(¤t->mm->mmap_sem); +diff --git a/arch/m68k/include/asm/mcf_pgalloc.h b/arch/m68k/include/asm/mcf_pgalloc.h +index 8b707c249026..12fe700632f4 100644 +--- a/arch/m68k/include/asm/mcf_pgalloc.h ++++ b/arch/m68k/include/asm/mcf_pgalloc.h +@@ -44,6 +44,7 @@ extern inline pmd_t *pmd_alloc_kernel(pgd_t *pgd, unsigned long address) + static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page, + unsigned long address) + { ++ pgtable_page_dtor(page); + __free_page(page); + } + +@@ -74,8 +75,9 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm, + return page; + } + +-extern inline void pte_free(struct mm_struct *mm, struct page *page) ++static inline void pte_free(struct mm_struct *mm, struct page *page) + { ++ pgtable_page_dtor(page); + __free_page(page); + } + +diff --git a/arch/nds32/kernel/setup.c b/arch/nds32/kernel/setup.c +index 2f5b2ccebe47..63a1a5ef5219 100644 +--- a/arch/nds32/kernel/setup.c ++++ b/arch/nds32/kernel/setup.c +@@ -278,7 +278,8 @@ static void __init setup_memory(void) + + void __init setup_arch(char **cmdline_p) + { +- early_init_devtree( __dtb_start); ++ early_init_devtree(__atags_pointer ? \ ++ phys_to_virt(__atags_pointer) : __dtb_start); + + setup_cpuinfo(); + +diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S +index 690d55272ba6..0c826ad6e994 100644 +--- a/arch/openrisc/kernel/entry.S ++++ b/arch/openrisc/kernel/entry.S +@@ -277,12 +277,6 @@ EXCEPTION_ENTRY(_data_page_fault_handler) + l.addi r3,r1,0 // pt_regs + /* r4 set be EXCEPTION_HANDLE */ // effective address of fault + +- /* +- * __PHX__: TODO +- * +- * all this can be written much simpler. look at +- * DTLB miss handler in the CONFIG_GUARD_PROTECTED_CORE part +- */ + #ifdef CONFIG_OPENRISC_NO_SPR_SR_DSX + l.lwz r6,PT_PC(r3) // address of an offending insn + l.lwz r6,0(r6) // instruction that caused pf +@@ -314,7 +308,7 @@ EXCEPTION_ENTRY(_data_page_fault_handler) + + #else + +- l.lwz r6,PT_SR(r3) // SR ++ l.mfspr r6,r0,SPR_SR // SR + l.andi r6,r6,SPR_SR_DSX // check for delay slot exception + l.sfne r6,r0 // exception happened in delay slot + l.bnf 7f +diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S +index fb02b2a1d6f2..9fc6b60140f0 100644 +--- a/arch/openrisc/kernel/head.S ++++ b/arch/openrisc/kernel/head.S +@@ -210,8 +210,7 @@ + * r4 - EEAR exception EA + * r10 - current pointing to current_thread_info struct + * r12 - syscall 0, since we didn't come from syscall +- * r13 - temp it actually contains new SR, not needed anymore +- * r31 - handler address of the handler we'll jump to ++ * r30 - handler address of the handler we'll jump to + * + * handler has to save remaining registers to the exception + * ksp frame *before* tainting them! +@@ -244,6 +243,7 @@ + /* r1 is KSP, r30 is __pa(KSP) */ ;\ + tophys (r30,r1) ;\ + l.sw PT_GPR12(r30),r12 ;\ ++ /* r4 use for tmp before EA */ ;\ + l.mfspr r12,r0,SPR_EPCR_BASE ;\ + l.sw PT_PC(r30),r12 ;\ + l.mfspr r12,r0,SPR_ESR_BASE ;\ +@@ -263,7 +263,10 @@ + /* r12 == 1 if we come from syscall */ ;\ + CLEAR_GPR(r12) ;\ + /* ----- turn on MMU ----- */ ;\ +- l.ori r30,r0,(EXCEPTION_SR) ;\ ++ /* Carry DSX into exception SR */ ;\ ++ l.mfspr r30,r0,SPR_SR ;\ ++ l.andi r30,r30,SPR_SR_DSX ;\ ++ l.ori r30,r30,(EXCEPTION_SR) ;\ + l.mtspr r0,r30,SPR_ESR_BASE ;\ + /* r30: EA address of handler */ ;\ + LOAD_SYMBOL_2_GPR(r30,handler) ;\ +diff --git a/arch/openrisc/kernel/traps.c b/arch/openrisc/kernel/traps.c +index 113c175fe469..f35b485555db 100644 +--- a/arch/openrisc/kernel/traps.c ++++ b/arch/openrisc/kernel/traps.c +@@ -317,7 +317,7 @@ static inline int in_delay_slot(struct pt_regs *regs) + return 0; + } + #else +- return regs->sr & SPR_SR_DSX; ++ return mfspr(SPR_SR) & SPR_SR_DSX; + #endif + } + +diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h +index 6f84b6acc86e..8a63515f03bf 100644 +--- a/arch/parisc/include/asm/spinlock.h ++++ b/arch/parisc/include/asm/spinlock.h +@@ -20,7 +20,6 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *x, + { + volatile unsigned int *a; + +- mb(); + a = __ldcw_align(x); + while (__ldcw(a) == 0) + while (*a == 0) +@@ -30,17 +29,16 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *x, + local_irq_disable(); + } else + cpu_relax(); +- mb(); + } + #define arch_spin_lock_flags arch_spin_lock_flags + + static inline void arch_spin_unlock(arch_spinlock_t *x) + { + volatile unsigned int *a; +- mb(); ++ + a = __ldcw_align(x); +- *a = 1; + mb(); ++ *a = 1; + } + + static inline int arch_spin_trylock(arch_spinlock_t *x) +@@ -48,10 +46,8 @@ static inline int arch_spin_trylock(arch_spinlock_t *x) + volatile unsigned int *a; + int ret; + +- mb(); + a = __ldcw_align(x); + ret = __ldcw(a) != 0; +- mb(); + + return ret; + } +diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S +index 4886a6db42e9..5f7e57fcaeef 100644 +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -629,12 +629,12 @@ cas_action: + stw %r1, 4(%sr2,%r20) + #endif + /* The load and store could fail */ +-1: ldw,ma 0(%r26), %r28 ++1: ldw 0(%r26), %r28 + sub,<> %r28, %r25, %r0 +-2: stw,ma %r24, 0(%r26) ++2: stw %r24, 0(%r26) + /* Free lock */ + sync +- stw,ma %r20, 0(%sr2,%r20) ++ stw %r20, 0(%sr2,%r20) + #if ENABLE_LWS_DEBUG + /* Clear thread register indicator */ + stw %r0, 4(%sr2,%r20) +@@ -798,30 +798,30 @@ cas2_action: + ldo 1(%r0),%r28 + + /* 8bit CAS */ +-13: ldb,ma 0(%r26), %r29 ++13: ldb 0(%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +-14: stb,ma %r24, 0(%r26) ++14: stb %r24, 0(%r26) + b cas2_end + copy %r0, %r28 + nop + nop + + /* 16bit CAS */ +-15: ldh,ma 0(%r26), %r29 ++15: ldh 0(%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +-16: sth,ma %r24, 0(%r26) ++16: sth %r24, 0(%r26) + b cas2_end + copy %r0, %r28 + nop + nop + + /* 32bit CAS */ +-17: ldw,ma 0(%r26), %r29 ++17: ldw 0(%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +-18: stw,ma %r24, 0(%r26) ++18: stw %r24, 0(%r26) + b cas2_end + copy %r0, %r28 + nop +@@ -829,10 +829,10 @@ cas2_action: + + /* 64bit CAS */ + #ifdef CONFIG_64BIT +-19: ldd,ma 0(%r26), %r29 ++19: ldd 0(%r26), %r29 + sub,*= %r29, %r25, %r0 + b,n cas2_end +-20: std,ma %r24, 0(%r26) ++20: std %r24, 0(%r26) + copy %r0, %r28 + #else + /* Compare first word */ +@@ -851,7 +851,7 @@ cas2_action: + cas2_end: + /* Free lock */ + sync +- stw,ma %r20, 0(%sr2,%r20) ++ stw %r20, 0(%sr2,%r20) + /* Enable interrupts */ + ssm PSW_SM_I, %r0 + /* Return to userspace, set no error */ +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index 9ca7148b5881..6d6cf14009cf 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -579,9 +579,6 @@ static void nmi_stop_this_cpu(struct pt_regs *regs) + nmi_ipi_busy_count--; + nmi_ipi_unlock(); + +- /* Remove this CPU */ +- set_cpu_online(smp_processor_id(), false); +- + spin_begin(); + while (1) + spin_cpu_relax(); +@@ -596,9 +593,6 @@ void smp_send_stop(void) + + static void stop_this_cpu(void *dummy) + { +- /* Remove this CPU */ +- set_cpu_online(smp_processor_id(), false); +- + hard_irq_disable(); + spin_begin(); + while (1) +diff --git a/arch/riscv/kernel/irq.c b/arch/riscv/kernel/irq.c +index b74cbfbce2d0..7bcdaed15703 100644 +--- a/arch/riscv/kernel/irq.c ++++ b/arch/riscv/kernel/irq.c +@@ -16,10 +16,6 @@ + #include <linux/irqchip.h> + #include <linux/irqdomain.h> + +-#ifdef CONFIG_RISCV_INTC +-#include <linux/irqchip/irq-riscv-intc.h> +-#endif +- + void __init init_IRQ(void) + { + irqchip_init(); +diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c +index 5dddba301d0a..ac7600b8709a 100644 +--- a/arch/riscv/kernel/module.c ++++ b/arch/riscv/kernel/module.c +@@ -252,14 +252,14 @@ static int apply_r_riscv_align_rela(struct module *me, u32 *location, + static int apply_r_riscv_add32_rela(struct module *me, u32 *location, + Elf_Addr v) + { +- *(u32 *)location += (*(u32 *)v); ++ *(u32 *)location += (u32)v; + return 0; + } + + static int apply_r_riscv_sub32_rela(struct module *me, u32 *location, + Elf_Addr v) + { +- *(u32 *)location -= (*(u32 *)v); ++ *(u32 *)location -= (u32)v; + return 0; + } + +diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c +index ba3e80712797..9f82a7e34c64 100644 +--- a/arch/riscv/kernel/ptrace.c ++++ b/arch/riscv/kernel/ptrace.c +@@ -50,7 +50,7 @@ static int riscv_gpr_set(struct task_struct *target, + struct pt_regs *regs; + + regs = task_pt_regs(target); +- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ®s, 0, -1); ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, regs, 0, -1); + return ret; + } + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index dd2bcf0e7d00..7b08b0ffa2c7 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1391,6 +1391,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + goto free_addrs; + } + if (bpf_jit_prog(&jit, fp)) { ++ bpf_jit_binary_free(header); + fp = orig_fp; + goto free_addrs; + } +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index d7a9dea8563d..377d50509653 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -980,6 +980,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves) + + extern unsigned long arch_align_stack(unsigned long sp); + extern void free_init_pages(char *what, unsigned long begin, unsigned long end); ++extern void free_kernel_image_pages(void *begin, void *end); + + void default_idle(void); + #ifdef CONFIG_XEN +diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h +index bd090367236c..34cffcef7375 100644 +--- a/arch/x86/include/asm/set_memory.h ++++ b/arch/x86/include/asm/set_memory.h +@@ -46,6 +46,7 @@ int set_memory_np(unsigned long addr, int numpages); + int set_memory_4k(unsigned long addr, int numpages); + int set_memory_encrypted(unsigned long addr, int numpages); + int set_memory_decrypted(unsigned long addr, int numpages); ++int set_memory_np_noalias(unsigned long addr, int numpages); + + int set_memory_array_uc(unsigned long *addr, int addrinarray); + int set_memory_array_wc(unsigned long *addr, int addrinarray); +diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c +index 1c2cfa0644aa..97ccf4c3b45b 100644 +--- a/arch/x86/kernel/cpu/microcode/intel.c ++++ b/arch/x86/kernel/cpu/microcode/intel.c +@@ -190,8 +190,11 @@ static void save_microcode_patch(void *data, unsigned int size) + p = memdup_patch(data, size); + if (!p) + pr_err("Error allocating buffer %p\n", data); +- else ++ else { + list_replace(&iter->plist, &p->plist); ++ kfree(iter->data); ++ kfree(iter); ++ } + } + } + +diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c +index d79a18b4cf9d..4c53d12ca933 100644 +--- a/arch/x86/kernel/kvmclock.c ++++ b/arch/x86/kernel/kvmclock.c +@@ -138,6 +138,7 @@ static unsigned long kvm_get_tsc_khz(void) + src = &hv_clock[cpu].pvti; + tsc_khz = pvclock_tsc_khz(src); + put_cpu(); ++ setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ); + return tsc_khz; + } + +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index f5d30c68fd09..f02ecaf97904 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -222,6 +222,11 @@ static void notrace start_secondary(void *unused) + #ifdef CONFIG_X86_32 + /* switch away from the initial page table */ + load_cr3(swapper_pg_dir); ++ /* ++ * Initialize the CR4 shadow before doing anything that could ++ * try to read it. ++ */ ++ cr4_init_shadow(); + __flush_tlb_all(); + #endif + load_current_idt(); +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 12cad70acc3b..71dd00a140d2 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -11791,7 +11791,6 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry) + { + struct vcpu_vmx *vmx = to_vmx(vcpu); + struct vmcs12 *vmcs12 = get_vmcs12(vcpu); +- u32 msr_entry_idx; + u32 exit_qual; + int r; + +@@ -11813,10 +11812,10 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry) + nested_get_vmcs12_pages(vcpu, vmcs12); + + r = EXIT_REASON_MSR_LOAD_FAIL; +- msr_entry_idx = nested_vmx_load_msr(vcpu, +- vmcs12->vm_entry_msr_load_addr, +- vmcs12->vm_entry_msr_load_count); +- if (msr_entry_idx) ++ exit_qual = nested_vmx_load_msr(vcpu, ++ vmcs12->vm_entry_msr_load_addr, ++ vmcs12->vm_entry_msr_load_count); ++ if (exit_qual) + goto fail; + + /* +diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c +index 83241eb71cd4..acfab322fbe0 100644 +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -775,13 +775,44 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) + } + } + ++/* ++ * begin/end can be in the direct map or the "high kernel mapping" ++ * used for the kernel image only. free_init_pages() will do the ++ * right thing for either kind of address. ++ */ ++void free_kernel_image_pages(void *begin, void *end) ++{ ++ unsigned long begin_ul = (unsigned long)begin; ++ unsigned long end_ul = (unsigned long)end; ++ unsigned long len_pages = (end_ul - begin_ul) >> PAGE_SHIFT; ++ ++ ++ free_init_pages("unused kernel image", begin_ul, end_ul); ++ ++ /* ++ * PTI maps some of the kernel into userspace. For performance, ++ * this includes some kernel areas that do not contain secrets. ++ * Those areas might be adjacent to the parts of the kernel image ++ * being freed, which may contain secrets. Remove the "high kernel ++ * image mapping" for these freed areas, ensuring they are not even ++ * potentially vulnerable to Meltdown regardless of the specific ++ * optimizations PTI is currently using. ++ * ++ * The "noalias" prevents unmapping the direct map alias which is ++ * needed to access the freed pages. ++ * ++ * This is only valid for 64bit kernels. 32bit has only one mapping ++ * which can't be treated in this way for obvious reasons. ++ */ ++ if (IS_ENABLED(CONFIG_X86_64) && cpu_feature_enabled(X86_FEATURE_PTI)) ++ set_memory_np_noalias(begin_ul, len_pages); ++} ++ + void __ref free_initmem(void) + { + e820__reallocate_tables(); + +- free_init_pages("unused kernel", +- (unsigned long)(&__init_begin), +- (unsigned long)(&__init_end)); ++ free_kernel_image_pages(&__init_begin, &__init_end); + } + + #ifdef CONFIG_BLK_DEV_INITRD +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index 20d8bf5fbceb..3060e1dda2ad 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -1283,12 +1283,8 @@ void mark_rodata_ro(void) + set_memory_ro(start, (end-start) >> PAGE_SHIFT); + #endif + +- free_init_pages("unused kernel", +- (unsigned long) __va(__pa_symbol(text_end)), +- (unsigned long) __va(__pa_symbol(rodata_start))); +- free_init_pages("unused kernel", +- (unsigned long) __va(__pa_symbol(rodata_end)), +- (unsigned long) __va(__pa_symbol(_sdata))); ++ free_kernel_image_pages((void *)text_end, (void *)rodata_start); ++ free_kernel_image_pages((void *)rodata_end, (void *)_sdata); + + debug_checkwx(); + +diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c +index 29505724202a..8d6c34fe49be 100644 +--- a/arch/x86/mm/pageattr.c ++++ b/arch/x86/mm/pageattr.c +@@ -53,6 +53,7 @@ static DEFINE_SPINLOCK(cpa_lock); + #define CPA_FLUSHTLB 1 + #define CPA_ARRAY 2 + #define CPA_PAGES_ARRAY 4 ++#define CPA_NO_CHECK_ALIAS 8 /* Do not search for aliases */ + + #ifdef CONFIG_PROC_FS + static unsigned long direct_pages_count[PG_LEVEL_NUM]; +@@ -1486,6 +1487,9 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages, + + /* No alias checking for _NX bit modifications */ + checkalias = (pgprot_val(mask_set) | pgprot_val(mask_clr)) != _PAGE_NX; ++ /* Has caller explicitly disabled alias checking? */ ++ if (in_flag & CPA_NO_CHECK_ALIAS) ++ checkalias = 0; + + ret = __change_page_attr_set_clr(&cpa, checkalias); + +@@ -1772,6 +1776,15 @@ int set_memory_np(unsigned long addr, int numpages) + return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_PRESENT), 0); + } + ++int set_memory_np_noalias(unsigned long addr, int numpages) ++{ ++ int cpa_flags = CPA_NO_CHECK_ALIAS; ++ ++ return change_page_attr_set_clr(&addr, numpages, __pgprot(0), ++ __pgprot(_PAGE_PRESENT), 0, ++ cpa_flags, NULL); ++} ++ + int set_memory_4k(unsigned long addr, int numpages) + { + return change_page_attr_set_clr(&addr, numpages, __pgprot(0), +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index 3080e18cb859..62b5f3f21b4b 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -357,7 +357,7 @@ static const char *const blk_mq_rq_state_name_array[] = { + + static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state) + { +- if (WARN_ON_ONCE((unsigned int)rq_state > ++ if (WARN_ON_ONCE((unsigned int)rq_state >= + ARRAY_SIZE(blk_mq_rq_state_name_array))) + return "(?)"; + return blk_mq_rq_state_name_array[rq_state]; +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 90ffd8151c57..ed9b11e6b997 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1174,6 +1174,9 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx **hctx, + + #define BLK_MQ_RESOURCE_DELAY 3 /* ms units */ + ++/* ++ * Returns true if we did some work AND can potentially do more. ++ */ + bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + bool got_budget) + { +@@ -1304,8 +1307,17 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + blk_mq_run_hw_queue(hctx, true); + else if (needs_restart && (ret == BLK_STS_RESOURCE)) + blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY); ++ ++ return false; + } + ++ /* ++ * If the host/device is unable to accept more work, inform the ++ * caller of that. ++ */ ++ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) ++ return false; ++ + return (queued + errors) != 0; + } + +diff --git a/block/sed-opal.c b/block/sed-opal.c +index 945f4b8610e0..e0de4dd448b3 100644 +--- a/block/sed-opal.c ++++ b/block/sed-opal.c +@@ -877,7 +877,7 @@ static size_t response_get_string(const struct parsed_resp *resp, int n, + return 0; + } + +- if (n > resp->num) { ++ if (n >= resp->num) { + pr_debug("Response has %d tokens. Can't access %d\n", + resp->num, n); + return 0; +@@ -916,7 +916,7 @@ static u64 response_get_u64(const struct parsed_resp *resp, int n) + return 0; + } + +- if (n > resp->num) { ++ if (n >= resp->num) { + pr_debug("Response has %d tokens. Can't access %d\n", + resp->num, n); + return 0; +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 30a572956557..70a0f8b2f6c1 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -2031,6 +2031,17 @@ static inline void acpi_ec_query_exit(void) + } + } + ++static const struct dmi_system_id acpi_ec_no_wakeup[] = { ++ { ++ .ident = "Thinkpad X1 Carbon 6th", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"), ++ }, ++ }, ++ { }, ++}; ++ + int __init acpi_ec_init(void) + { + int result; +@@ -2041,6 +2052,15 @@ int __init acpi_ec_init(void) + if (result) + return result; + ++ /* ++ * Disable EC wakeup on following systems to prevent periodic ++ * wakeup from EC GPE. ++ */ ++ if (dmi_check_system(acpi_ec_no_wakeup)) { ++ ec_no_wakeup = true; ++ pr_debug("Disabling EC wakeup on suspend-to-idle\n"); ++ } ++ + /* Drivers must be started after acpi_ec_query_init() */ + dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver); + /* +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 964106d173bd..3b1651426e12 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -408,6 +408,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, + const guid_t *guid; + int rc, i; + ++ if (cmd_rc) ++ *cmd_rc = -EINVAL; + func = cmd; + if (cmd == ND_CMD_CALL) { + call_pkg = buf; +@@ -518,6 +520,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, + * If we return an error (like elsewhere) then caller wouldn't + * be able to rely upon data returned to make calculation. + */ ++ if (cmd_rc) ++ *cmd_rc = 0; + return 0; + } + +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index e5d90977caec..5e4befdd8562 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -35,6 +35,7 @@ + #include <linux/kernel.h> + #include <linux/gfp.h> + #include <linux/module.h> ++#include <linux/nospec.h> + #include <linux/blkdev.h> + #include <linux/delay.h> + #include <linux/interrupt.h> +@@ -1146,10 +1147,12 @@ static ssize_t ahci_led_store(struct ata_port *ap, const char *buf, + + /* get the slot number from the message */ + pmp = (state & EM_MSG_LED_PMP_SLOT) >> 8; +- if (pmp < EM_MAX_SLOTS) ++ if (pmp < EM_MAX_SLOTS) { ++ pmp = array_index_nospec(pmp, EM_MAX_SLOTS); + emp = &pp->em_priv[pmp]; +- else ++ } else { + return -EINVAL; ++ } + + /* mask off the activity bits if we are in sw_activity + * mode, user should turn off sw_activity before setting +diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c +index a500e738d929..f0ccb0a2b3bf 100644 +--- a/drivers/block/drbd/drbd_req.c ++++ b/drivers/block/drbd/drbd_req.c +@@ -1244,8 +1244,8 @@ drbd_request_prepare(struct drbd_device *device, struct bio *bio, unsigned long + _drbd_start_io_acct(device, req); + + /* process discards always from our submitter thread */ +- if ((bio_op(bio) & REQ_OP_WRITE_ZEROES) || +- (bio_op(bio) & REQ_OP_DISCARD)) ++ if (bio_op(bio) == REQ_OP_WRITE_ZEROES || ++ bio_op(bio) == REQ_OP_DISCARD) + goto queue_for_submitter_thread; + + if (rw == WRITE && req->private_bio && req->i.size +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 64278f472efe..a1c0c1d1f264 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -76,6 +76,7 @@ struct link_dead_args { + #define NBD_HAS_CONFIG_REF 4 + #define NBD_BOUND 5 + #define NBD_DESTROY_ON_DISCONNECT 6 ++#define NBD_DISCONNECT_ON_CLOSE 7 + + struct nbd_config { + u32 flags; +@@ -138,6 +139,7 @@ static void nbd_config_put(struct nbd_device *nbd); + static void nbd_connect_reply(struct genl_info *info, int index); + static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info); + static void nbd_dead_link_work(struct work_struct *work); ++static void nbd_disconnect_and_put(struct nbd_device *nbd); + + static inline struct device *nbd_to_dev(struct nbd_device *nbd) + { +@@ -1291,6 +1293,12 @@ out: + static void nbd_release(struct gendisk *disk, fmode_t mode) + { + struct nbd_device *nbd = disk->private_data; ++ struct block_device *bdev = bdget_disk(disk, 0); ++ ++ if (test_bit(NBD_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) && ++ bdev->bd_openers == 0) ++ nbd_disconnect_and_put(nbd); ++ + nbd_config_put(nbd); + nbd_put(nbd); + } +@@ -1690,6 +1698,10 @@ again: + &config->runtime_flags); + put_dev = true; + } ++ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) { ++ set_bit(NBD_DISCONNECT_ON_CLOSE, ++ &config->runtime_flags); ++ } + } + + if (info->attrs[NBD_ATTR_SOCKETS]) { +@@ -1734,6 +1746,16 @@ out: + return ret; + } + ++static void nbd_disconnect_and_put(struct nbd_device *nbd) ++{ ++ mutex_lock(&nbd->config_lock); ++ nbd_disconnect(nbd); ++ mutex_unlock(&nbd->config_lock); ++ if (test_and_clear_bit(NBD_HAS_CONFIG_REF, ++ &nbd->config->runtime_flags)) ++ nbd_config_put(nbd); ++} ++ + static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info) + { + struct nbd_device *nbd; +@@ -1766,12 +1788,7 @@ static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info) + nbd_put(nbd); + return 0; + } +- mutex_lock(&nbd->config_lock); +- nbd_disconnect(nbd); +- mutex_unlock(&nbd->config_lock); +- if (test_and_clear_bit(NBD_HAS_CONFIG_REF, +- &nbd->config->runtime_flags)) +- nbd_config_put(nbd); ++ nbd_disconnect_and_put(nbd); + nbd_config_put(nbd); + nbd_put(nbd); + return 0; +@@ -1782,7 +1799,7 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info) + struct nbd_device *nbd = NULL; + struct nbd_config *config; + int index; +- int ret = -EINVAL; ++ int ret = 0; + bool put_dev = false; + + if (!netlink_capable(skb, CAP_SYS_ADMIN)) +@@ -1822,6 +1839,7 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info) + !nbd->task_recv) { + dev_err(nbd_to_dev(nbd), + "not configured, cannot reconfigure\n"); ++ ret = -EINVAL; + goto out; + } + +@@ -1846,6 +1864,14 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info) + &config->runtime_flags)) + refcount_inc(&nbd->refs); + } ++ ++ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) { ++ set_bit(NBD_DISCONNECT_ON_CLOSE, ++ &config->runtime_flags); ++ } else { ++ clear_bit(NBD_DISCONNECT_ON_CLOSE, ++ &config->runtime_flags); ++ } + } + + if (info->attrs[NBD_ATTR_SOCKETS]) { +diff --git a/drivers/char/ipmi/kcs_bmc.c b/drivers/char/ipmi/kcs_bmc.c +index fbfc05e3f3d1..bb882ab161fe 100644 +--- a/drivers/char/ipmi/kcs_bmc.c ++++ b/drivers/char/ipmi/kcs_bmc.c +@@ -210,34 +210,23 @@ static void kcs_bmc_handle_cmd(struct kcs_bmc *kcs_bmc) + int kcs_bmc_handle_event(struct kcs_bmc *kcs_bmc) + { + unsigned long flags; +- int ret = 0; ++ int ret = -ENODATA; + u8 status; + + spin_lock_irqsave(&kcs_bmc->lock, flags); + +- if (!kcs_bmc->running) { +- kcs_force_abort(kcs_bmc); +- ret = -ENODEV; +- goto out_unlock; +- } +- +- status = read_status(kcs_bmc) & (KCS_STATUS_IBF | KCS_STATUS_CMD_DAT); +- +- switch (status) { +- case KCS_STATUS_IBF | KCS_STATUS_CMD_DAT: +- kcs_bmc_handle_cmd(kcs_bmc); +- break; +- +- case KCS_STATUS_IBF: +- kcs_bmc_handle_data(kcs_bmc); +- break; ++ status = read_status(kcs_bmc); ++ if (status & KCS_STATUS_IBF) { ++ if (!kcs_bmc->running) ++ kcs_force_abort(kcs_bmc); ++ else if (status & KCS_STATUS_CMD_DAT) ++ kcs_bmc_handle_cmd(kcs_bmc); ++ else ++ kcs_bmc_handle_data(kcs_bmc); + +- default: +- ret = -ENODATA; +- break; ++ ret = 0; + } + +-out_unlock: + spin_unlock_irqrestore(&kcs_bmc->lock, flags); + + return ret; +diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile +index de6d06ac790b..23a7fdcfc4e0 100644 +--- a/drivers/clk/Makefile ++++ b/drivers/clk/Makefile +@@ -94,7 +94,7 @@ obj-$(CONFIG_ARCH_SPRD) += sprd/ + obj-$(CONFIG_ARCH_STI) += st/ + obj-$(CONFIG_ARCH_STRATIX10) += socfpga/ + obj-$(CONFIG_ARCH_SUNXI) += sunxi/ +-obj-$(CONFIG_ARCH_SUNXI) += sunxi-ng/ ++obj-$(CONFIG_SUNXI_CCU) += sunxi-ng/ + obj-$(CONFIG_ARCH_TEGRA) += tegra/ + obj-y += ti/ + obj-$(CONFIG_CLK_UNIPHIER) += uniphier/ +diff --git a/drivers/clk/davinci/da8xx-cfgchip.c b/drivers/clk/davinci/da8xx-cfgchip.c +index c971111d2601..20a120aa147e 100644 +--- a/drivers/clk/davinci/da8xx-cfgchip.c ++++ b/drivers/clk/davinci/da8xx-cfgchip.c +@@ -672,7 +672,7 @@ static int of_da8xx_usb_phy_clk_init(struct device *dev, struct regmap *regmap) + + usb1 = da8xx_cfgchip_register_usb1_clk48(dev, regmap); + if (IS_ERR(usb1)) { +- if (PTR_ERR(usb0) == -EPROBE_DEFER) ++ if (PTR_ERR(usb1) == -EPROBE_DEFER) + return -EPROBE_DEFER; + + dev_warn(dev, "Failed to register usb1_clk48 (%ld)\n", +diff --git a/drivers/clk/sunxi-ng/Makefile b/drivers/clk/sunxi-ng/Makefile +index 128a40ee5c5e..9ac0fb948101 100644 +--- a/drivers/clk/sunxi-ng/Makefile ++++ b/drivers/clk/sunxi-ng/Makefile +@@ -1,24 +1,24 @@ + # SPDX-License-Identifier: GPL-2.0 + # Common objects +-lib-$(CONFIG_SUNXI_CCU) += ccu_common.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_mmc_timing.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_reset.o ++obj-y += ccu_common.o ++obj-y += ccu_mmc_timing.o ++obj-y += ccu_reset.o + + # Base clock types +-lib-$(CONFIG_SUNXI_CCU) += ccu_div.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_frac.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_gate.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_mux.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_mult.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_phase.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_sdm.o ++obj-y += ccu_div.o ++obj-y += ccu_frac.o ++obj-y += ccu_gate.o ++obj-y += ccu_mux.o ++obj-y += ccu_mult.o ++obj-y += ccu_phase.o ++obj-y += ccu_sdm.o + + # Multi-factor clocks +-lib-$(CONFIG_SUNXI_CCU) += ccu_nk.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_nkm.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_nkmp.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_nm.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_mp.o ++obj-y += ccu_nk.o ++obj-y += ccu_nkm.o ++obj-y += ccu_nkmp.o ++obj-y += ccu_nm.o ++obj-y += ccu_mp.o + + # SoC support + obj-$(CONFIG_SUN50I_A64_CCU) += ccu-sun50i-a64.o +@@ -37,12 +37,3 @@ obj-$(CONFIG_SUN8I_R40_CCU) += ccu-sun8i-r40.o + obj-$(CONFIG_SUN9I_A80_CCU) += ccu-sun9i-a80.o + obj-$(CONFIG_SUN9I_A80_CCU) += ccu-sun9i-a80-de.o + obj-$(CONFIG_SUN9I_A80_CCU) += ccu-sun9i-a80-usb.o +- +-# The lib-y file goals is supposed to work only in arch/*/lib or lib/. In our +-# case, we want to use that goal, but even though lib.a will be properly +-# generated, it will not be linked in, eventually resulting in a linker error +-# for missing symbols. +-# +-# We can work around that by explicitly adding lib.a to the obj-y goal. This is +-# an undocumented behaviour, but works well for now. +-obj-$(CONFIG_SUNXI_CCU) += lib.a +diff --git a/drivers/clocksource/timer-stm32.c b/drivers/clocksource/timer-stm32.c +index e5cdc3af684c..2717f88c7904 100644 +--- a/drivers/clocksource/timer-stm32.c ++++ b/drivers/clocksource/timer-stm32.c +@@ -304,8 +304,10 @@ static int __init stm32_timer_init(struct device_node *node) + + to->private_data = kzalloc(sizeof(struct stm32_timer_private), + GFP_KERNEL); +- if (!to->private_data) ++ if (!to->private_data) { ++ ret = -ENOMEM; + goto deinit; ++ } + + rstc = of_reset_control_get(node, NULL); + if (!IS_ERR(rstc)) { +diff --git a/drivers/dax/device.c b/drivers/dax/device.c +index aff2c1594220..a26b7016367a 100644 +--- a/drivers/dax/device.c ++++ b/drivers/dax/device.c +@@ -189,14 +189,16 @@ static int check_vma(struct dev_dax *dev_dax, struct vm_area_struct *vma, + + /* prevent private mappings from being established */ + if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) { +- dev_info(dev, "%s: %s: fail, attempted private mapping\n", ++ dev_info_ratelimited(dev, ++ "%s: %s: fail, attempted private mapping\n", + current->comm, func); + return -EINVAL; + } + + mask = dax_region->align - 1; + if (vma->vm_start & mask || vma->vm_end & mask) { +- dev_info(dev, "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n", ++ dev_info_ratelimited(dev, ++ "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n", + current->comm, func, vma->vm_start, vma->vm_end, + mask); + return -EINVAL; +@@ -204,13 +206,15 @@ static int check_vma(struct dev_dax *dev_dax, struct vm_area_struct *vma, + + if ((dax_region->pfn_flags & (PFN_DEV|PFN_MAP)) == PFN_DEV + && (vma->vm_flags & VM_DONTCOPY) == 0) { +- dev_info(dev, "%s: %s: fail, dax range requires MADV_DONTFORK\n", ++ dev_info_ratelimited(dev, ++ "%s: %s: fail, dax range requires MADV_DONTFORK\n", + current->comm, func); + return -EINVAL; + } + + if (!vma_is_dax(vma)) { +- dev_info(dev, "%s: %s: fail, vma is not DAX capable\n", ++ dev_info_ratelimited(dev, ++ "%s: %s: fail, vma is not DAX capable\n", + current->comm, func); + return -EINVAL; + } +diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c +index 26b67455208f..e27adc4ab59d 100644 +--- a/drivers/dma/k3dma.c ++++ b/drivers/dma/k3dma.c +@@ -794,7 +794,7 @@ static struct dma_chan *k3_of_dma_simple_xlate(struct of_phandle_args *dma_spec, + struct k3_dma_dev *d = ofdma->of_dma_data; + unsigned int request = dma_spec->args[0]; + +- if (request > d->dma_requests) ++ if (request >= d->dma_requests) + return NULL; + + return dma_get_slave_channel(&(d->chans[request].vc.chan)); +diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c +index d21c19822feb..56399bd45179 100644 +--- a/drivers/dma/omap-dma.c ++++ b/drivers/dma/omap-dma.c +@@ -1485,7 +1485,11 @@ static int omap_dma_probe(struct platform_device *pdev) + od->ddev.src_addr_widths = OMAP_DMA_BUSWIDTHS; + od->ddev.dst_addr_widths = OMAP_DMA_BUSWIDTHS; + od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); +- od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; ++ if (__dma_omap15xx(od->plat->dma_attr)) ++ od->ddev.residue_granularity = ++ DMA_RESIDUE_GRANULARITY_DESCRIPTOR; ++ else ++ od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; + od->ddev.max_burst = SZ_16M - 1; /* CCEN: 24bit unsigned */ + od->ddev.dev = &pdev->dev; + INIT_LIST_HEAD(&od->ddev.channels); +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index de1fd59fe136..96a8ab3cec27 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2924,7 +2924,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) + pd->src_addr_widths = PL330_DMA_BUSWIDTHS; + pd->dst_addr_widths = PL330_DMA_BUSWIDTHS; + pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); +- pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT; ++ pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; + pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ? + 1 : PL330_MAX_BURST); + +diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c +index 3bb82e511eca..7d3edd713932 100644 +--- a/drivers/edac/edac_mc.c ++++ b/drivers/edac/edac_mc.c +@@ -215,6 +215,7 @@ const char * const edac_mem_types[] = { + [MEM_LRDDR3] = "Load-Reduced-DDR3-RAM", + [MEM_DDR4] = "Unbuffered-DDR4", + [MEM_RDDR4] = "Registered-DDR4", ++ [MEM_LRDDR4] = "Load-Reduced-DDR4-RAM", + [MEM_NVDIMM] = "Non-volatile-RAM", + }; + EXPORT_SYMBOL_GPL(edac_mem_types); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +index 361975cf45a9..11e7eadf1166 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +@@ -31,7 +31,7 @@ + #include <linux/power_supply.h> + #include <linux/hwmon.h> + #include <linux/hwmon-sysfs.h> +- ++#include <linux/nospec.h> + + static int amdgpu_debugfs_pm_init(struct amdgpu_device *adev); + +@@ -309,6 +309,7 @@ static ssize_t amdgpu_set_pp_force_state(struct device *dev, + count = -EINVAL; + goto fail; + } ++ idx = array_index_nospec(idx, ARRAY_SIZE(data.states)); + + amdgpu_dpm_get_pp_num_states(adev, &data); + state = data.states[idx]; +diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c +index ac9617269a2f..085f0ba564df 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c +@@ -899,7 +899,7 @@ static const struct amdgpu_ring_funcs vce_v3_0_ring_phys_funcs = { + .emit_frame_size = + 4 + /* vce_v3_0_emit_pipeline_sync */ + 6, /* amdgpu_vce_ring_emit_fence x1 no user fence */ +- .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */ ++ .emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */ + .emit_ib = amdgpu_vce_ring_emit_ib, + .emit_fence = amdgpu_vce_ring_emit_fence, + .test_ring = amdgpu_vce_ring_test_ring, +@@ -923,7 +923,7 @@ static const struct amdgpu_ring_funcs vce_v3_0_ring_vm_funcs = { + 6 + /* vce_v3_0_emit_vm_flush */ + 4 + /* vce_v3_0_emit_pipeline_sync */ + 6 + 6, /* amdgpu_vce_ring_emit_fence x2 vm fence */ +- .emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */ ++ .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */ + .emit_ib = vce_v3_0_ring_emit_ib, + .emit_vm_flush = vce_v3_0_emit_vm_flush, + .emit_pipeline_sync = vce_v3_0_emit_pipeline_sync, +diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c +index 3092f76bdb75..6531ee7f3af4 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c +@@ -678,9 +678,22 @@ bool dce100_validate_bandwidth( + struct dc *dc, + struct dc_state *context) + { +- /* TODO implement when needed but for now hardcode max value*/ +- context->bw.dce.dispclk_khz = 681000; +- context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER; ++ int i; ++ bool at_least_one_pipe = false; ++ ++ for (i = 0; i < dc->res_pool->pipe_count; i++) { ++ if (context->res_ctx.pipe_ctx[i].stream) ++ at_least_one_pipe = true; ++ } ++ ++ if (at_least_one_pipe) { ++ /* TODO implement when needed but for now hardcode max value*/ ++ context->bw.dce.dispclk_khz = 681000; ++ context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER; ++ } else { ++ context->bw.dce.dispclk_khz = 0; ++ context->bw.dce.yclk_khz = 0; ++ } + + return true; + } +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c +index 200de46bd06b..0d497d0f6056 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c +@@ -82,6 +82,7 @@ static void vega12_set_default_registry_data(struct pp_hwmgr *hwmgr) + + data->registry_data.disallowed_features = 0x0; + data->registry_data.od_state_in_dc_support = 0; ++ data->registry_data.thermal_support = 1; + data->registry_data.skip_baco_hardware = 0; + + data->registry_data.log_avfs_param = 0; +diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c +index 8d20faa198cf..0a788d76ed5f 100644 +--- a/drivers/gpu/drm/arm/malidp_drv.c ++++ b/drivers/gpu/drm/arm/malidp_drv.c +@@ -278,7 +278,6 @@ static int malidp_init(struct drm_device *drm) + + static void malidp_fini(struct drm_device *drm) + { +- drm_atomic_helper_shutdown(drm); + drm_mode_config_cleanup(drm); + } + +@@ -646,6 +645,7 @@ vblank_fail: + malidp_de_irq_fini(drm); + drm->irq_enabled = false; + irq_init_fail: ++ drm_atomic_helper_shutdown(drm); + component_unbind_all(dev, drm); + bind_fail: + of_node_put(malidp->crtc.port); +@@ -681,6 +681,7 @@ static void malidp_unbind(struct device *dev) + malidp_se_irq_fini(drm); + malidp_de_irq_fini(drm); + drm->irq_enabled = false; ++ drm_atomic_helper_shutdown(drm); + component_unbind_all(dev, drm); + of_node_put(malidp->crtc.port); + malidp->crtc.port = NULL; +diff --git a/drivers/gpu/drm/arm/malidp_hw.c b/drivers/gpu/drm/arm/malidp_hw.c +index d789b46dc817..069783e715f1 100644 +--- a/drivers/gpu/drm/arm/malidp_hw.c ++++ b/drivers/gpu/drm/arm/malidp_hw.c +@@ -634,7 +634,8 @@ const struct malidp_hw malidp_device[MALIDP_MAX_DEVICES] = { + .vsync_irq = MALIDP500_DE_IRQ_VSYNC, + }, + .se_irq_map = { +- .irq_mask = MALIDP500_SE_IRQ_CONF_MODE, ++ .irq_mask = MALIDP500_SE_IRQ_CONF_MODE | ++ MALIDP500_SE_IRQ_GLOBAL, + .vsync_irq = 0, + }, + .dc_irq_map = { +diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c +index 7a44897c50fe..29409a65d864 100644 +--- a/drivers/gpu/drm/arm/malidp_planes.c ++++ b/drivers/gpu/drm/arm/malidp_planes.c +@@ -23,6 +23,7 @@ + + /* Layer specific register offsets */ + #define MALIDP_LAYER_FORMAT 0x000 ++#define LAYER_FORMAT_MASK 0x3f + #define MALIDP_LAYER_CONTROL 0x004 + #define LAYER_ENABLE (1 << 0) + #define LAYER_FLOWCFG_MASK 7 +@@ -235,8 +236,8 @@ static int malidp_de_plane_check(struct drm_plane *plane, + if (state->rotation & MALIDP_ROTATED_MASK) { + int val; + +- val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_h, +- state->crtc_w, ++ val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_w, ++ state->crtc_h, + fb->format->format); + if (val < 0) + return val; +@@ -337,7 +338,9 @@ static void malidp_de_plane_update(struct drm_plane *plane, + dest_w = plane->state->crtc_w; + dest_h = plane->state->crtc_h; + +- malidp_hw_write(mp->hwdev, ms->format, mp->layer->base); ++ val = malidp_hw_read(mp->hwdev, mp->layer->base); ++ val = (val & ~LAYER_FORMAT_MASK) | ms->format; ++ malidp_hw_write(mp->hwdev, val, mp->layer->base); + + for (i = 0; i < ms->n_planes; i++) { + /* calculate the offset for the layer's plane registers */ +diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c +index 03eeee11dd5b..42a40daff132 100644 +--- a/drivers/gpu/drm/armada/armada_crtc.c ++++ b/drivers/gpu/drm/armada/armada_crtc.c +@@ -519,8 +519,9 @@ static irqreturn_t armada_drm_irq(int irq, void *arg) + u32 v, stat = readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR); + + /* +- * This is rediculous - rather than writing bits to clear, we +- * have to set the actual status register value. This is racy. ++ * Reading the ISR appears to clear bits provided CLEAN_SPU_IRQ_ISR ++ * is set. Writing has some other effect to acknowledge the IRQ - ++ * without this, we only get a single IRQ. + */ + writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR); + +@@ -1116,16 +1117,22 @@ armada_drm_crtc_set_property(struct drm_crtc *crtc, + static int armada_drm_crtc_enable_vblank(struct drm_crtc *crtc) + { + struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc); ++ unsigned long flags; + ++ spin_lock_irqsave(&dcrtc->irq_lock, flags); + armada_drm_crtc_enable_irq(dcrtc, VSYNC_IRQ_ENA); ++ spin_unlock_irqrestore(&dcrtc->irq_lock, flags); + return 0; + } + + static void armada_drm_crtc_disable_vblank(struct drm_crtc *crtc) + { + struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc); ++ unsigned long flags; + ++ spin_lock_irqsave(&dcrtc->irq_lock, flags); + armada_drm_crtc_disable_irq(dcrtc, VSYNC_IRQ_ENA); ++ spin_unlock_irqrestore(&dcrtc->irq_lock, flags); + } + + static const struct drm_crtc_funcs armada_crtc_funcs = { +@@ -1415,6 +1422,7 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev, + CFG_PDWN64x66, dcrtc->base + LCD_SPU_SRAM_PARA1); + writel_relaxed(0x2032ff81, dcrtc->base + LCD_SPU_DMA_CTRL1); + writel_relaxed(dcrtc->irq_ena, dcrtc->base + LCD_SPU_IRQ_ENA); ++ readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR); + writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR); + + ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc", +diff --git a/drivers/gpu/drm/armada/armada_hw.h b/drivers/gpu/drm/armada/armada_hw.h +index 27319a8335e2..345dc4d0851e 100644 +--- a/drivers/gpu/drm/armada/armada_hw.h ++++ b/drivers/gpu/drm/armada/armada_hw.h +@@ -160,6 +160,7 @@ enum { + CFG_ALPHAM_GRA = 0x1 << 16, + CFG_ALPHAM_CFG = 0x2 << 16, + CFG_ALPHA_MASK = 0xff << 8, ++#define CFG_ALPHA(x) ((x) << 8) + CFG_PIXCMD_MASK = 0xff, + }; + +diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c +index c391955009d6..afa7ded3ae31 100644 +--- a/drivers/gpu/drm/armada/armada_overlay.c ++++ b/drivers/gpu/drm/armada/armada_overlay.c +@@ -28,6 +28,7 @@ struct armada_ovl_plane_properties { + uint16_t contrast; + uint16_t saturation; + uint32_t colorkey_mode; ++ uint32_t colorkey_enable; + }; + + struct armada_ovl_plane { +@@ -54,11 +55,13 @@ armada_ovl_update_attr(struct armada_ovl_plane_properties *prop, + writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE); + + spin_lock_irq(&dcrtc->irq_lock); +- armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA, +- CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK, +- dcrtc->base + LCD_SPU_DMA_CTRL1); +- +- armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG); ++ armada_updatel(prop->colorkey_mode, ++ CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK, ++ dcrtc->base + LCD_SPU_DMA_CTRL1); ++ if (dcrtc->variant->has_spu_adv_reg) ++ armada_updatel(prop->colorkey_enable, ++ ADV_GRACOLORKEY | ADV_VIDCOLORKEY, ++ dcrtc->base + LCD_SPU_ADV_REG); + spin_unlock_irq(&dcrtc->irq_lock); + } + +@@ -321,8 +324,17 @@ static int armada_ovl_plane_set_property(struct drm_plane *plane, + dplane->prop.colorkey_vb |= K2B(val); + update_attr = true; + } else if (property == priv->colorkey_mode_prop) { +- dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK; +- dplane->prop.colorkey_mode |= CFG_CKMODE(val); ++ if (val == CKMODE_DISABLE) { ++ dplane->prop.colorkey_mode = ++ CFG_CKMODE(CKMODE_DISABLE) | ++ CFG_ALPHAM_CFG | CFG_ALPHA(255); ++ dplane->prop.colorkey_enable = 0; ++ } else { ++ dplane->prop.colorkey_mode = ++ CFG_CKMODE(val) | ++ CFG_ALPHAM_GRA | CFG_ALPHA(0); ++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY; ++ } + update_attr = true; + } else if (property == priv->brightness_prop) { + dplane->prop.brightness = val - 256; +@@ -453,7 +465,9 @@ int armada_overlay_plane_create(struct drm_device *dev, unsigned long crtcs) + dplane->prop.colorkey_yr = 0xfefefe00; + dplane->prop.colorkey_ug = 0x01010100; + dplane->prop.colorkey_vb = 0x01010100; +- dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB); ++ dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) | ++ CFG_ALPHAM_GRA | CFG_ALPHA(0); ++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY; + dplane->prop.brightness = 0; + dplane->prop.contrast = 0x4000; + dplane->prop.saturation = 0x4000; +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index 7ab36042a822..f1b33fc79fbb 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -36,8 +36,11 @@ + + #define SII8620_BURST_BUF_LEN 288 + #define VAL_RX_HDMI_CTRL2_DEFVAL VAL_RX_HDMI_CTRL2_IDLE_CNT(3) +-#define MHL1_MAX_LCLK 225000 +-#define MHL3_MAX_LCLK 600000 ++ ++#define MHL1_MAX_PCLK 75000 ++#define MHL1_MAX_PCLK_PP_MODE 150000 ++#define MHL3_MAX_PCLK 200000 ++#define MHL3_MAX_PCLK_PP_MODE 300000 + + enum sii8620_mode { + CM_DISCONNECTED, +@@ -807,6 +810,7 @@ static void sii8620_burst_rx_all(struct sii8620 *ctx) + static void sii8620_fetch_edid(struct sii8620 *ctx) + { + u8 lm_ddc, ddc_cmd, int3, cbus; ++ unsigned long timeout; + int fetched, i; + int edid_len = EDID_LENGTH; + u8 *edid; +@@ -856,23 +860,31 @@ static void sii8620_fetch_edid(struct sii8620 *ctx) + REG_DDC_CMD, ddc_cmd | VAL_DDC_CMD_ENH_DDC_READ_NO_ACK + ); + +- do { +- int3 = sii8620_readb(ctx, REG_INTR3); ++ int3 = 0; ++ timeout = jiffies + msecs_to_jiffies(200); ++ for (;;) { + cbus = sii8620_readb(ctx, REG_CBUS_STATUS); +- +- if (int3 & BIT_DDC_CMD_DONE) +- break; +- +- if (!(cbus & BIT_CBUS_STATUS_CBUS_CONNECTED)) { ++ if (~cbus & BIT_CBUS_STATUS_CBUS_CONNECTED) { ++ kfree(edid); ++ edid = NULL; ++ goto end; ++ } ++ if (int3 & BIT_DDC_CMD_DONE) { ++ if (sii8620_readb(ctx, REG_DDC_DOUT_CNT) ++ >= FETCH_SIZE) ++ break; ++ } else { ++ int3 = sii8620_readb(ctx, REG_INTR3); ++ } ++ if (time_is_before_jiffies(timeout)) { ++ ctx->error = -ETIMEDOUT; ++ dev_err(ctx->dev, "timeout during EDID read\n"); + kfree(edid); + edid = NULL; + goto end; + } +- } while (1); +- +- sii8620_readb(ctx, REG_DDC_STATUS); +- while (sii8620_readb(ctx, REG_DDC_DOUT_CNT) < FETCH_SIZE) + usleep_range(10, 20); ++ } + + sii8620_read_buf(ctx, REG_DDC_DATA, edid + fetched, FETCH_SIZE); + if (fetched + FETCH_SIZE == EDID_LENGTH) { +@@ -1055,23 +1067,23 @@ static void sii8620_set_format(struct sii8620 *ctx) + BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED, + ctx->use_packed_pixel ? ~0 : 0); + } else { +- if (ctx->use_packed_pixel) ++ if (ctx->use_packed_pixel) { + sii8620_write_seq_static(ctx, + REG_VID_MODE, BIT_VID_MODE_M1080P, + REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1, + REG_MHLTX_CTL6, 0x60 + ); +- else ++ } else { + sii8620_write_seq_static(ctx, + REG_VID_MODE, 0, + REG_MHL_TOP_CTL, 1, + REG_MHLTX_CTL6, 0xa0 + ); ++ } + } + + if (ctx->use_packed_pixel) +- out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL) | +- BIT_TPI_OUTPUT_CSCMODE709; ++ out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL); + else + out_fmt = VAL_TPI_FORMAT(RGB, FULL); + +@@ -1216,7 +1228,7 @@ static void sii8620_start_video(struct sii8620 *ctx) + int clk = ctx->pixel_clock * (ctx->use_packed_pixel ? 2 : 3); + int i; + +- for (i = 0; i < ARRAY_SIZE(clk_spec); ++i) ++ for (i = 0; i < ARRAY_SIZE(clk_spec) - 1; ++i) + if (clk < clk_spec[i].max_clk) + break; + +@@ -2268,17 +2280,43 @@ static void sii8620_detach(struct drm_bridge *bridge) + rc_unregister_device(ctx->rc_dev); + } + ++static int sii8620_is_packing_required(struct sii8620 *ctx, ++ const struct drm_display_mode *mode) ++{ ++ int max_pclk, max_pclk_pp_mode; ++ ++ if (sii8620_is_mhl3(ctx)) { ++ max_pclk = MHL3_MAX_PCLK; ++ max_pclk_pp_mode = MHL3_MAX_PCLK_PP_MODE; ++ } else { ++ max_pclk = MHL1_MAX_PCLK; ++ max_pclk_pp_mode = MHL1_MAX_PCLK_PP_MODE; ++ } ++ ++ if (mode->clock < max_pclk) ++ return 0; ++ else if (mode->clock < max_pclk_pp_mode) ++ return 1; ++ else ++ return -1; ++} ++ + static enum drm_mode_status sii8620_mode_valid(struct drm_bridge *bridge, + const struct drm_display_mode *mode) + { + struct sii8620 *ctx = bridge_to_sii8620(bridge); ++ int pack_required = sii8620_is_packing_required(ctx, mode); + bool can_pack = ctx->devcap[MHL_DCAP_VID_LINK_MODE] & + MHL_DCAP_VID_LINK_PPIXEL; +- unsigned int max_pclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK : +- MHL1_MAX_LCLK; +- max_pclk /= can_pack ? 2 : 3; + +- return (mode->clock > max_pclk) ? MODE_CLOCK_HIGH : MODE_OK; ++ switch (pack_required) { ++ case 0: ++ return MODE_OK; ++ case 1: ++ return (can_pack) ? MODE_OK : MODE_CLOCK_HIGH; ++ default: ++ return MODE_CLOCK_HIGH; ++ } + } + + static bool sii8620_mode_fixup(struct drm_bridge *bridge, +@@ -2286,43 +2324,16 @@ static bool sii8620_mode_fixup(struct drm_bridge *bridge, + struct drm_display_mode *adjusted_mode) + { + struct sii8620 *ctx = bridge_to_sii8620(bridge); +- int max_lclk; +- bool ret = true; + + mutex_lock(&ctx->lock); + +- max_lclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK : MHL1_MAX_LCLK; +- if (max_lclk > 3 * adjusted_mode->clock) { +- ctx->use_packed_pixel = 0; +- goto end; +- } +- if ((ctx->devcap[MHL_DCAP_VID_LINK_MODE] & MHL_DCAP_VID_LINK_PPIXEL) && +- max_lclk > 2 * adjusted_mode->clock) { +- ctx->use_packed_pixel = 1; +- goto end; +- } +- ret = false; +-end: +- if (ret) { +- u8 vic = drm_match_cea_mode(adjusted_mode); +- +- if (!vic) { +- union hdmi_infoframe frm; +- u8 mhl_vic[] = { 0, 95, 94, 93, 98 }; +- +- /* FIXME: We need the connector here */ +- drm_hdmi_vendor_infoframe_from_display_mode( +- &frm.vendor.hdmi, NULL, adjusted_mode); +- vic = frm.vendor.hdmi.vic; +- if (vic >= ARRAY_SIZE(mhl_vic)) +- vic = 0; +- vic = mhl_vic[vic]; +- } +- ctx->video_code = vic; +- ctx->pixel_clock = adjusted_mode->clock; +- } ++ ctx->use_packed_pixel = sii8620_is_packing_required(ctx, adjusted_mode); ++ ctx->video_code = drm_match_cea_mode(adjusted_mode); ++ ctx->pixel_clock = adjusted_mode->clock; ++ + mutex_unlock(&ctx->lock); +- return ret; ++ ++ return true; + } + + static const struct drm_bridge_funcs sii8620_bridge_funcs = { +diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +index 1c330f2a7a5d..7acfd0ed79cb 100644 +--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +@@ -260,7 +260,7 @@ static void decon_win_set_pixfmt(struct decon_context *ctx, unsigned int win, + unsigned long val; + + val = readl(ctx->addr + DECON_WINCONx(win)); +- val &= ~WINCONx_BPPMODE_MASK; ++ val &= WINCONx_ENWIN_F; + + switch (fb->format->format) { + case DRM_FORMAT_XRGB1555: +@@ -351,8 +351,8 @@ static void decon_update_plane(struct exynos_drm_crtc *crtc, + writel(val, ctx->addr + DECON_VIDOSDxB(win)); + } + +- val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) | +- VIDOSD_Wx_ALPHA_B_F(0x0); ++ val = VIDOSD_Wx_ALPHA_R_F(0xff) | VIDOSD_Wx_ALPHA_G_F(0xff) | ++ VIDOSD_Wx_ALPHA_B_F(0xff); + writel(val, ctx->addr + DECON_VIDOSDxC(win)); + + val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) | +diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +index 0506b2b17ac1..48f913d8208c 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +@@ -532,21 +532,25 @@ static int gsc_src_set_fmt(struct device *dev, u32 fmt) + GSC_IN_CHROMA_ORDER_CRCB); + break; + case DRM_FORMAT_NV21: ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P); ++ break; + case DRM_FORMAT_NV61: +- cfg |= (GSC_IN_CHROMA_ORDER_CRCB | +- GSC_IN_YUV420_2P); ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P); + break; + case DRM_FORMAT_YUV422: + cfg |= GSC_IN_YUV422_3P; + break; + case DRM_FORMAT_YUV420: ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P); ++ break; + case DRM_FORMAT_YVU420: +- cfg |= GSC_IN_YUV420_3P; ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P); + break; + case DRM_FORMAT_NV12: ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P); ++ break; + case DRM_FORMAT_NV16: +- cfg |= (GSC_IN_CHROMA_ORDER_CBCR | +- GSC_IN_YUV420_2P); ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P); + break; + default: + dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt); +@@ -806,18 +810,25 @@ static int gsc_dst_set_fmt(struct device *dev, u32 fmt) + GSC_OUT_CHROMA_ORDER_CRCB); + break; + case DRM_FORMAT_NV21: +- case DRM_FORMAT_NV61: + cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P); + break; ++ case DRM_FORMAT_NV61: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P); ++ break; + case DRM_FORMAT_YUV422: ++ cfg |= GSC_OUT_YUV422_3P; ++ break; + case DRM_FORMAT_YUV420: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P); ++ break; + case DRM_FORMAT_YVU420: +- cfg |= GSC_OUT_YUV420_3P; ++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P); + break; + case DRM_FORMAT_NV12: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P); ++ break; + case DRM_FORMAT_NV16: +- cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | +- GSC_OUT_YUV420_2P); ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P); + break; + default: + dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt); +diff --git a/drivers/gpu/drm/exynos/regs-gsc.h b/drivers/gpu/drm/exynos/regs-gsc.h +index 4704a993cbb7..16b39734115c 100644 +--- a/drivers/gpu/drm/exynos/regs-gsc.h ++++ b/drivers/gpu/drm/exynos/regs-gsc.h +@@ -138,6 +138,7 @@ + #define GSC_OUT_YUV420_3P (3 << 4) + #define GSC_OUT_YUV422_1P (4 << 4) + #define GSC_OUT_YUV422_2P (5 << 4) ++#define GSC_OUT_YUV422_3P (6 << 4) + #define GSC_OUT_YUV444 (7 << 4) + #define GSC_OUT_TILE_TYPE_MASK (1 << 2) + #define GSC_OUT_TILE_C_16x8 (0 << 2) +diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c +index 1466d8769ec9..857a647fabf2 100644 +--- a/drivers/gpu/drm/i915/gvt/kvmgt.c ++++ b/drivers/gpu/drm/i915/gvt/kvmgt.c +@@ -43,6 +43,8 @@ + #include <linux/mdev.h> + #include <linux/debugfs.h> + ++#include <linux/nospec.h> ++ + #include "i915_drv.h" + #include "gvt.h" + +@@ -1064,7 +1066,8 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd, + } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) { + struct vfio_region_info info; + struct vfio_info_cap caps = { .buf = NULL, .size = 0 }; +- int i, ret; ++ unsigned int i; ++ int ret; + struct vfio_region_info_cap_sparse_mmap *sparse = NULL; + size_t size; + int nr_areas = 1; +@@ -1149,6 +1152,10 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd, + if (info.index >= VFIO_PCI_NUM_REGIONS + + vgpu->vdev.num_regions) + return -EINVAL; ++ info.index = ++ array_index_nospec(info.index, ++ VFIO_PCI_NUM_REGIONS + ++ vgpu->vdev.num_regions); + + i = info.index - VFIO_PCI_NUM_REGIONS; + +diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c +index 707e02c80f18..95dfd169ef57 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -617,7 +617,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, + struct nouveau_bo *nvbo; + uint32_t data; + +- if (unlikely(r->bo_index > req->nr_buffers)) { ++ if (unlikely(r->bo_index >= req->nr_buffers)) { + NV_PRINTK(err, cli, "reloc bo index invalid\n"); + ret = -EINVAL; + break; +@@ -627,7 +627,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, + if (b->presumed.valid) + continue; + +- if (unlikely(r->reloc_bo_index > req->nr_buffers)) { ++ if (unlikely(r->reloc_bo_index >= req->nr_buffers)) { + NV_PRINTK(err, cli, "reloc container bo index invalid\n"); + ret = -EINVAL; + break; +diff --git a/drivers/gpu/drm/sun4i/Makefile b/drivers/gpu/drm/sun4i/Makefile +index 330843ce4280..a27ade6cf2bf 100644 +--- a/drivers/gpu/drm/sun4i/Makefile ++++ b/drivers/gpu/drm/sun4i/Makefile +@@ -29,7 +29,10 @@ obj-$(CONFIG_DRM_SUN4I) += sun4i-tcon.o + obj-$(CONFIG_DRM_SUN4I) += sun4i_tv.o + obj-$(CONFIG_DRM_SUN4I) += sun6i_drc.o + +-obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o sun4i-frontend.o ++obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o ++ifdef CONFIG_DRM_SUN4I_BACKEND ++obj-$(CONFIG_DRM_SUN4I) += sun4i-frontend.o ++endif + obj-$(CONFIG_DRM_SUN4I_HDMI) += sun4i-drm-hdmi.o + obj-$(CONFIG_DRM_SUN8I_DW_HDMI) += sun8i-drm-hdmi.o + obj-$(CONFIG_DRM_SUN8I_MIXER) += sun8i-mixer.o +diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c +index 7afe2f635f74..500b7c5b6672 100644 +--- a/drivers/gpu/drm/tegra/drm.c ++++ b/drivers/gpu/drm/tegra/drm.c +@@ -436,7 +436,7 @@ int tegra_drm_submit(struct tegra_drm_context *context, + * unaligned offset is malformed and cause commands stream + * corruption on the buffer address relocation. + */ +- if (offset & 3 || offset >= obj->gem.size) { ++ if (offset & 3 || offset > obj->gem.size) { + err = -EINVAL; + goto fail; + } +diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c +index f1d5f76e9c33..d88073e7d22d 100644 +--- a/drivers/gpu/host1x/dev.c ++++ b/drivers/gpu/host1x/dev.c +@@ -218,6 +218,9 @@ static int host1x_probe(struct platform_device *pdev) + return err; + } + ++ if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) ++ goto skip_iommu; ++ + host->group = iommu_group_get(&pdev->dev); + if (host->group) { + struct iommu_domain_geometry *geometry; +diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c +index db509ab8874e..acd99783bbca 100644 +--- a/drivers/gpu/host1x/job.c ++++ b/drivers/gpu/host1x/job.c +@@ -686,7 +686,8 @@ void host1x_job_unpin(struct host1x_job *job) + for (i = 0; i < job->num_unpins; i++) { + struct host1x_job_unpin_data *unpin = &job->unpins[i]; + +- if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) { ++ if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && ++ unpin->size && host->domain) { + iommu_unmap(host->domain, job->addr_phys[i], + unpin->size); + free_iova(&host->iova, +diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c +index 7b8e17b03cb8..6bf4da7ad63a 100644 +--- a/drivers/hid/hid-google-hammer.c ++++ b/drivers/hid/hid-google-hammer.c +@@ -124,6 +124,8 @@ static const struct hid_device_id hammer_devices[] = { + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_STAFF) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WAND) }, ++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, ++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WHISKERS) }, + { } + }; + MODULE_DEVICE_TABLE(hid, hammer_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 46f5ecd11bf7..5a8b3362cf65 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -452,6 +452,7 @@ + #define USB_DEVICE_ID_GOOGLE_TOUCH_ROSE 0x5028 + #define USB_DEVICE_ID_GOOGLE_STAFF 0x502b + #define USB_DEVICE_ID_GOOGLE_WAND 0x502d ++#define USB_DEVICE_ID_GOOGLE_WHISKERS 0x5030 + + #define USB_VENDOR_ID_GOTOP 0x08f2 + #define USB_DEVICE_ID_SUPER_Q2 0x007f +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 5f947ec20dcb..815a7b0b88cd 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -3361,8 +3361,14 @@ void wacom_setup_device_quirks(struct wacom *wacom) + if (features->type >= INTUOSHT && features->type <= BAMBOO_PT) + features->device_type |= WACOM_DEVICETYPE_PAD; + +- features->x_max = 4096; +- features->y_max = 4096; ++ if (features->type == INTUOSHT2) { ++ features->x_max = features->x_max / 10; ++ features->y_max = features->y_max / 10; ++ } ++ else { ++ features->x_max = 4096; ++ features->y_max = 4096; ++ } + } + else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) { + features->device_type |= WACOM_DEVICETYPE_PAD; +diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c +index bf3bb7e1adab..9d3ef879dc51 100644 +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -1074,6 +1074,13 @@ static struct dmi_system_id i8k_blacklist_fan_support_dmi_table[] __initdata = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Vostro 3360"), + }, + }, ++ { ++ .ident = "Dell XPS13 9333", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS13 9333"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c +index aebce560bfaf..b14eb73bc3c9 100644 +--- a/drivers/hwmon/nct6775.c ++++ b/drivers/hwmon/nct6775.c +@@ -4175,7 +4175,7 @@ static int nct6775_probe(struct platform_device *pdev) + * The temperature is already monitored if the respective bit in <mask> + * is set. + */ +- for (i = 0; i < 32; i++) { ++ for (i = 0; i < 31; i++) { + if (!(data->temp_mask & BIT(i + 1))) + continue; + if (!reg_temp_alternate[i]) +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index 6fca5e64cffb..f83405d3e8c2 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -677,9 +677,6 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx, + struct imx_i2c_dma *dma = i2c_imx->dma; + struct device *dev = &i2c_imx->adapter.dev; + +- temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR); +- temp |= I2CR_DMAEN; +- imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR); + + dma->chan_using = dma->chan_rx; + dma->dma_transfer_dir = DMA_DEV_TO_MEM; +@@ -792,6 +789,7 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo + int i, result; + unsigned int temp; + int block_data = msgs->flags & I2C_M_RECV_LEN; ++ int use_dma = i2c_imx->dma && msgs->len >= DMA_THRESHOLD && !block_data; + + dev_dbg(&i2c_imx->adapter.dev, + "<%s> write slave address: addr=0x%x\n", +@@ -818,12 +816,14 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo + */ + if ((msgs->len - 1) || block_data) + temp &= ~I2CR_TXAK; ++ if (use_dma) ++ temp |= I2CR_DMAEN; + imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR); + imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); /* dummy read */ + + dev_dbg(&i2c_imx->adapter.dev, "<%s> read data\n", __func__); + +- if (i2c_imx->dma && msgs->len >= DMA_THRESHOLD && !block_data) ++ if (use_dma) + return i2c_imx_dma_read(i2c_imx, msgs, is_lastmsg); + + /* read data */ +diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c +index 7c3b4740b94b..b8f303dea305 100644 +--- a/drivers/i2c/i2c-core-acpi.c ++++ b/drivers/i2c/i2c-core-acpi.c +@@ -482,11 +482,16 @@ static int acpi_gsb_i2c_write_bytes(struct i2c_client *client, + msgs[0].buf = buffer; + + ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs)); +- if (ret < 0) +- dev_err(&client->adapter->dev, "i2c write failed\n"); + + kfree(buffer); +- return ret; ++ ++ if (ret < 0) { ++ dev_err(&client->adapter->dev, "i2c write failed: %d\n", ret); ++ return ret; ++ } ++ ++ /* 1 transfer must have completed successfully */ ++ return (ret == 1) ? 0 : -EIO; + } + + static acpi_status +diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c +index 5ec3e41b65f2..fe87d27779d9 100644 +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -415,10 +415,9 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2) + } + comp_humidity = bmp280_compensate_humidity(data, adc_humidity); + +- *val = comp_humidity; +- *val2 = 1024; ++ *val = comp_humidity * 1000 / 1024; + +- return IIO_VAL_FRACTIONAL; ++ return IIO_VAL_INT; + } + + static int bmp280_read_raw(struct iio_dev *indio_dev, +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index ed1f253faf97..c7c85c22e4e3 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -486,8 +486,11 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, + } + + if (flags & IB_MR_REREG_ACCESS) { +- if (ib_access_writable(mr_access_flags) && !mmr->umem->writable) +- return -EPERM; ++ if (ib_access_writable(mr_access_flags) && ++ !mmr->umem->writable) { ++ err = -EPERM; ++ goto release_mpt_entry; ++ } + + err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry, + convert_access(mr_access_flags)); +diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c +index 3c7522d025f2..93d67d97c279 100644 +--- a/drivers/infiniband/hw/mlx5/srq.c ++++ b/drivers/infiniband/hw/mlx5/srq.c +@@ -266,18 +266,24 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd, + + desc_size = sizeof(struct mlx5_wqe_srq_next_seg) + + srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg); +- if (desc_size == 0 || srq->msrq.max_gs > desc_size) +- return ERR_PTR(-EINVAL); ++ if (desc_size == 0 || srq->msrq.max_gs > desc_size) { ++ err = -EINVAL; ++ goto err_srq; ++ } + desc_size = roundup_pow_of_two(desc_size); + desc_size = max_t(size_t, 32, desc_size); +- if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) +- return ERR_PTR(-EINVAL); ++ if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) { ++ err = -EINVAL; ++ goto err_srq; ++ } + srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) / + sizeof(struct mlx5_wqe_data_seg); + srq->msrq.wqe_shift = ilog2(desc_size); + buf_size = srq->msrq.max * desc_size; +- if (buf_size < desc_size) +- return ERR_PTR(-EINVAL); ++ if (buf_size < desc_size) { ++ err = -EINVAL; ++ goto err_srq; ++ } + in.type = init_attr->srq_type; + + if (pd->uobject) +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 3f9afc02d166..f86223aca7b8 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1957,6 +1957,9 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + } + + if (attr_mask & (IB_QP_AV | IB_QP_PATH_MTU)) { ++ if (rdma_protocol_iwarp(&dev->ibdev, 1)) ++ return -EINVAL; ++ + if (attr_mask & IB_QP_PATH_MTU) { + if (attr->path_mtu < IB_MTU_256 || + attr->path_mtu > IB_MTU_4096) { +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 785199990457..d048ac13e65b 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -645,6 +645,9 @@ next_wqe: + } else { + goto exit; + } ++ if ((wqe->wr.send_flags & IB_SEND_SIGNALED) || ++ qp->sq_sig_type == IB_SIGNAL_ALL_WR) ++ rxe_run_task(&qp->comp.task, 1); + qp->req.wqe_index = next_index(qp->sq.queue, + qp->req.wqe_index); + goto next_wqe; +@@ -709,6 +712,7 @@ next_wqe: + + if (fill_packet(qp, wqe, &pkt, skb, payload)) { + pr_debug("qp#%d Error during fill packet\n", qp_num(qp)); ++ kfree_skb(skb); + goto err; + } + +@@ -740,7 +744,6 @@ next_wqe: + goto next_wqe; + + err: +- kfree_skb(skb); + wqe->status = IB_WC_LOC_PROT_ERR; + wqe->state = wqe_state_error; + __rxe_do_task(&qp->comp.task); +diff --git a/drivers/input/rmi4/rmi_2d_sensor.c b/drivers/input/rmi4/rmi_2d_sensor.c +index 8bb866c7b985..8eeffa066022 100644 +--- a/drivers/input/rmi4/rmi_2d_sensor.c ++++ b/drivers/input/rmi4/rmi_2d_sensor.c +@@ -32,15 +32,15 @@ void rmi_2d_sensor_abs_process(struct rmi_2d_sensor *sensor, + if (obj->type == RMI_2D_OBJECT_NONE) + return; + +- if (axis_align->swap_axes) +- swap(obj->x, obj->y); +- + if (axis_align->flip_x) + obj->x = sensor->max_x - obj->x; + + if (axis_align->flip_y) + obj->y = sensor->max_y - obj->y; + ++ if (axis_align->swap_axes) ++ swap(obj->x, obj->y); ++ + /* + * Here checking if X offset or y offset are specified is + * redundant. We just add the offsets or clip the values. +@@ -120,15 +120,15 @@ void rmi_2d_sensor_rel_report(struct rmi_2d_sensor *sensor, int x, int y) + x = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)x)); + y = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)y)); + +- if (axis_align->swap_axes) +- swap(x, y); +- + if (axis_align->flip_x) + x = min(RMI_2D_REL_POS_MAX, -x); + + if (axis_align->flip_y) + y = min(RMI_2D_REL_POS_MAX, -y); + ++ if (axis_align->swap_axes) ++ swap(x, y); ++ + if (x || y) { + input_report_rel(sensor->input, REL_X, x); + input_report_rel(sensor->input, REL_Y, y); +@@ -141,17 +141,10 @@ static void rmi_2d_sensor_set_input_params(struct rmi_2d_sensor *sensor) + struct input_dev *input = sensor->input; + int res_x; + int res_y; ++ int max_x, max_y; + int input_flags = 0; + + if (sensor->report_abs) { +- if (sensor->axis_align.swap_axes) { +- swap(sensor->max_x, sensor->max_y); +- swap(sensor->axis_align.clip_x_low, +- sensor->axis_align.clip_y_low); +- swap(sensor->axis_align.clip_x_high, +- sensor->axis_align.clip_y_high); +- } +- + sensor->min_x = sensor->axis_align.clip_x_low; + if (sensor->axis_align.clip_x_high) + sensor->max_x = min(sensor->max_x, +@@ -163,14 +156,19 @@ static void rmi_2d_sensor_set_input_params(struct rmi_2d_sensor *sensor) + sensor->axis_align.clip_y_high); + + set_bit(EV_ABS, input->evbit); +- input_set_abs_params(input, ABS_MT_POSITION_X, 0, sensor->max_x, +- 0, 0); +- input_set_abs_params(input, ABS_MT_POSITION_Y, 0, sensor->max_y, +- 0, 0); ++ ++ max_x = sensor->max_x; ++ max_y = sensor->max_y; ++ if (sensor->axis_align.swap_axes) ++ swap(max_x, max_y); ++ input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0); ++ input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0); + + if (sensor->x_mm && sensor->y_mm) { + res_x = (sensor->max_x - sensor->min_x) / sensor->x_mm; + res_y = (sensor->max_y - sensor->min_y) / sensor->y_mm; ++ if (sensor->axis_align.swap_axes) ++ swap(res_x, res_y); + + input_abs_set_res(input, ABS_X, res_x); + input_abs_set_res(input, ABS_Y, res_y); +diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c +index 1ff38aff9f29..29dd8a9939b1 100644 +--- a/drivers/irqchip/irq-gic-v2m.c ++++ b/drivers/irqchip/irq-gic-v2m.c +@@ -199,7 +199,7 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, + + fail: + irq_domain_free_irqs_parent(domain, virq, nr_irqs); +- gicv2m_unalloc_msi(v2m, hwirq, get_count_order(nr_irqs)); ++ gicv2m_unalloc_msi(v2m, hwirq, nr_irqs); + return err; + } + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index ab16968fced8..bb1580077054 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -3405,6 +3405,16 @@ static int redist_disable_lpis(void) + u64 timeout = USEC_PER_SEC; + u64 val; + ++ /* ++ * If coming via a CPU hotplug event, we don't need to disable ++ * LPIs before trying to re-enable them. They are already ++ * configured and all is well in the world. Detect this case ++ * by checking the allocation of the pending table for the ++ * current CPU. ++ */ ++ if (gic_data_rdist()->pend_page) ++ return 0; ++ + if (!gic_rdists_supports_plpis()) { + pr_info("CPU%d: LPIs not supported\n", smp_processor_id()); + return -ENXIO; +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 3c60774c8430..61dffc7bf6bf 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3892,6 +3892,13 @@ static int raid10_run(struct mddev *mddev) + disk->rdev->saved_raid_disk < 0) + conf->fullsync = 1; + } ++ ++ if (disk->replacement && ++ !test_bit(In_sync, &disk->replacement->flags) && ++ disk->replacement->saved_raid_disk < 0) { ++ conf->fullsync = 1; ++ } ++ + disk->recovery_disabled = mddev->recovery_disabled - 1; + } + +diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c +index aaaeaae01e1d..eeff2285fb8b 100644 +--- a/drivers/mtd/devices/mtd_dataflash.c ++++ b/drivers/mtd/devices/mtd_dataflash.c +@@ -733,8 +733,8 @@ static struct flash_info dataflash_data[] = { + { "AT45DB642x", 0x1f2800, 8192, 1056, 11, SUP_POW2PS}, + { "at45db642d", 0x1f2800, 8192, 1024, 10, SUP_POW2PS | IS_POW2PS}, + +- { "AT45DB641E", 0x1f28000100, 32768, 264, 9, SUP_EXTID | SUP_POW2PS}, +- { "at45db641e", 0x1f28000100, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS}, ++ { "AT45DB641E", 0x1f28000100ULL, 32768, 264, 9, SUP_EXTID | SUP_POW2PS}, ++ { "at45db641e", 0x1f28000100ULL, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS}, + }; + + static struct flash_info *jedec_lookup(struct spi_device *spi, +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +index d847e1b9c37b..be1506169076 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +@@ -1533,6 +1533,7 @@ struct bnx2x { + struct link_vars link_vars; + u32 link_cnt; + struct bnx2x_link_report_data last_reported_link; ++ bool force_link_down; + + struct mdio_if_info mdio; + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 95871576ab92..e7b305efa3fe 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -1261,6 +1261,11 @@ void __bnx2x_link_report(struct bnx2x *bp) + { + struct bnx2x_link_report_data cur_data; + ++ if (bp->force_link_down) { ++ bp->link_vars.link_up = 0; ++ return; ++ } ++ + /* reread mf_cfg */ + if (IS_PF(bp) && !CHIP_IS_E1(bp)) + bnx2x_read_mf_cfg(bp); +@@ -2817,6 +2822,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode) + bp->pending_max = 0; + } + ++ bp->force_link_down = false; + if (bp->port.pmf) { + rc = bnx2x_initial_phy_init(bp, load_mode); + if (rc) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index c766ae23bc74..89484efbaba4 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -10279,6 +10279,12 @@ static void bnx2x_sp_rtnl_task(struct work_struct *work) + bp->sp_rtnl_state = 0; + smp_mb(); + ++ /* Immediately indicate link as down */ ++ bp->link_vars.link_up = 0; ++ bp->force_link_down = true; ++ netif_carrier_off(bp->dev); ++ BNX2X_ERR("Indicating link is down due to Tx-timeout\n"); ++ + bnx2x_nic_unload(bp, UNLOAD_NORMAL, true); + /* When ret value shows failure of allocation failure, + * the nic is rebooted again. If open still fails, a error +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 401e58939795..cb026e500127 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -5915,7 +5915,7 @@ unsigned int bnxt_get_max_func_irqs(struct bnxt *bp) + return min_t(unsigned int, hw_resc->max_irqs, hw_resc->max_cp_rings); + } + +-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs) ++static void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs) + { + bp->hw_resc.max_irqs = max_irqs; + } +@@ -6875,7 +6875,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + rc = bnxt_request_irq(bp); + if (rc) { + netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc); +- goto open_err; ++ goto open_err_irq; + } + } + +@@ -6913,6 +6913,8 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + + open_err: + bnxt_disable_napi(bp); ++ ++open_err_irq: + bnxt_del_napi(bp); + + open_err_free_mem: +@@ -8467,11 +8469,11 @@ int bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx, bool shared) + int rx, tx, cp; + + _bnxt_get_max_rings(bp, &rx, &tx, &cp); ++ *max_rx = rx; ++ *max_tx = tx; + if (!rx || !tx || !cp) + return -ENOMEM; + +- *max_rx = rx; +- *max_tx = tx; + return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared); + } + +@@ -8485,8 +8487,11 @@ static int bnxt_get_dflt_rings(struct bnxt *bp, int *max_rx, int *max_tx, + /* Not enough rings, try disabling agg rings. */ + bp->flags &= ~BNXT_FLAG_AGG_RINGS; + rc = bnxt_get_max_rings(bp, max_rx, max_tx, shared); +- if (rc) ++ if (rc) { ++ /* set BNXT_FLAG_AGG_RINGS back for consistency */ ++ bp->flags |= BNXT_FLAG_AGG_RINGS; + return rc; ++ } + bp->flags |= BNXT_FLAG_NO_AGG_RINGS; + bp->dev->hw_features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW); + bp->dev->features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 3d55d3b56865..79bce5dcf7fe 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1455,7 +1455,6 @@ void bnxt_set_max_func_stat_ctxs(struct bnxt *bp, unsigned int max); + unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp); + void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max); + unsigned int bnxt_get_max_func_irqs(struct bnxt *bp); +-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max); + int bnxt_get_avail_msix(struct bnxt *bp, int num); + int bnxt_reserve_rings(struct bnxt *bp); + void bnxt_tx_disable(struct bnxt *bp); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +index 795f45024c20..491bd40a254d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +@@ -27,6 +27,15 @@ + #define BNXT_FID_INVALID 0xffff + #define VLAN_TCI(vid, prio) ((vid) | ((prio) << VLAN_PRIO_SHIFT)) + ++#define is_vlan_pcp_wildcarded(vlan_tci_mask) \ ++ ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == 0x0000) ++#define is_vlan_pcp_exactmatch(vlan_tci_mask) \ ++ ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == VLAN_PRIO_MASK) ++#define is_vlan_pcp_zero(vlan_tci) \ ++ ((ntohs(vlan_tci) & VLAN_PRIO_MASK) == 0x0000) ++#define is_vid_exactmatch(vlan_tci_mask) \ ++ ((ntohs(vlan_tci_mask) & VLAN_VID_MASK) == VLAN_VID_MASK) ++ + /* Return the dst fid of the func for flow forwarding + * For PFs: src_fid is the fid of the PF + * For VF-reps: src_fid the fid of the VF +@@ -389,6 +398,21 @@ static bool is_exactmatch(void *mask, int len) + return true; + } + ++static bool is_vlan_tci_allowed(__be16 vlan_tci_mask, ++ __be16 vlan_tci) ++{ ++ /* VLAN priority must be either exactly zero or fully wildcarded and ++ * VLAN id must be exact match. ++ */ ++ if (is_vid_exactmatch(vlan_tci_mask) && ++ ((is_vlan_pcp_exactmatch(vlan_tci_mask) && ++ is_vlan_pcp_zero(vlan_tci)) || ++ is_vlan_pcp_wildcarded(vlan_tci_mask))) ++ return true; ++ ++ return false; ++} ++ + static bool bits_set(void *key, int len) + { + const u8 *p = key; +@@ -803,9 +827,9 @@ static bool bnxt_tc_can_offload(struct bnxt *bp, struct bnxt_tc_flow *flow) + /* Currently VLAN fields cannot be partial wildcard */ + if (bits_set(&flow->l2_key.inner_vlan_tci, + sizeof(flow->l2_key.inner_vlan_tci)) && +- !is_exactmatch(&flow->l2_mask.inner_vlan_tci, +- sizeof(flow->l2_mask.inner_vlan_tci))) { +- netdev_info(bp->dev, "Wildcard match unsupported for VLAN TCI\n"); ++ !is_vlan_tci_allowed(flow->l2_mask.inner_vlan_tci, ++ flow->l2_key.inner_vlan_tci)) { ++ netdev_info(bp->dev, "Unsupported VLAN TCI\n"); + return false; + } + if (bits_set(&flow->l2_key.inner_vlan_tpid, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +index 347e4f946eb2..840f6e505f73 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id, + edev->ulp_tbl[ulp_id].msix_requested = avail_msix; + } + bnxt_fill_msix_vecs(bp, ent); +- bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) - avail_msix); + bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix); + edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED; + return avail_msix; +@@ -192,7 +191,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id) + msix_requested = edev->ulp_tbl[ulp_id].msix_requested; + bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested); + edev->ulp_tbl[ulp_id].msix_requested = 0; +- bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) + msix_requested); + edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED; + if (netif_running(dev)) { + bnxt_close_nic(bp, true, false); +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 068f991395dc..01032f37a308 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -1818,13 +1818,7 @@ static void macb_free_consistent(struct macb *bp) + struct macb_queue *queue; + unsigned int q; + +- queue = &bp->queues[0]; + bp->macbgem_ops.mog_free_rx_buffers(bp); +- if (queue->rx_ring) { +- dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp), +- queue->rx_ring, queue->rx_ring_dma); +- queue->rx_ring = NULL; +- } + + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { + kfree(queue->tx_skb); +@@ -1834,6 +1828,11 @@ static void macb_free_consistent(struct macb *bp) + queue->tx_ring, queue->tx_ring_dma); + queue->tx_ring = NULL; + } ++ if (queue->rx_ring) { ++ dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp), ++ queue->rx_ring, queue->rx_ring_dma); ++ queue->rx_ring = NULL; ++ } + } + } + +diff --git a/drivers/net/ethernet/cavium/Kconfig b/drivers/net/ethernet/cavium/Kconfig +index 043e3c11c42b..92d88c5f76fb 100644 +--- a/drivers/net/ethernet/cavium/Kconfig ++++ b/drivers/net/ethernet/cavium/Kconfig +@@ -15,7 +15,7 @@ if NET_VENDOR_CAVIUM + + config THUNDER_NIC_PF + tristate "Thunder Physical function driver" +- depends on 64BIT ++ depends on 64BIT && PCI + select THUNDER_NIC_BGX + ---help--- + This driver supports Thunder's NIC physical function. +@@ -28,13 +28,13 @@ config THUNDER_NIC_PF + config THUNDER_NIC_VF + tristate "Thunder Virtual function driver" + imply CAVIUM_PTP +- depends on 64BIT ++ depends on 64BIT && PCI + ---help--- + This driver supports Thunder's NIC virtual function + + config THUNDER_NIC_BGX + tristate "Thunder MAC interface driver (BGX)" +- depends on 64BIT ++ depends on 64BIT && PCI + select PHYLIB + select MDIO_THUNDER + select THUNDER_NIC_RGX +@@ -44,7 +44,7 @@ config THUNDER_NIC_BGX + + config THUNDER_NIC_RGX + tristate "Thunder MAC interface driver (RGX)" +- depends on 64BIT ++ depends on 64BIT && PCI + select PHYLIB + select MDIO_THUNDER + ---help--- +@@ -53,7 +53,7 @@ config THUNDER_NIC_RGX + + config CAVIUM_PTP + tristate "Cavium PTP coprocessor as PTP clock" +- depends on 64BIT ++ depends on 64BIT && PCI + imply PTP_1588_CLOCK + default y + ---help--- +@@ -65,7 +65,7 @@ config CAVIUM_PTP + + config LIQUIDIO + tristate "Cavium LiquidIO support" +- depends on 64BIT ++ depends on 64BIT && PCI + depends on MAY_USE_DEVLINK + imply PTP_1588_CLOCK + select FW_LOADER +diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c +index 3f6afb54a5eb..bb43ddb7539e 100644 +--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c ++++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c +@@ -643,13 +643,21 @@ static int octeon_mgmt_set_mac_address(struct net_device *netdev, void *addr) + static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu) + { + struct octeon_mgmt *p = netdev_priv(netdev); +- int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM; ++ int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN; + + netdev->mtu = new_mtu; + +- cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs); ++ /* HW lifts the limit if the frame is VLAN tagged ++ * (+4 bytes per each tag, up to two tags) ++ */ ++ cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet); ++ /* Set the hardware to truncate packets larger than the MTU. The jabber ++ * register must be set to a multiple of 8 bytes, so round up. JABBER is ++ * an unconditional limit, so we need to account for two possible VLAN ++ * tags. ++ */ + cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER, +- (size_without_fcs + 7) & 0xfff8); ++ (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8); + + return 0; + } +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +index 72c83496e01f..da73bf702e15 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +@@ -263,7 +263,7 @@ static void dcb_tx_queue_prio_enable(struct net_device *dev, int enable) + "Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n", + enable ? "set" : "unset", pi->port_id, i, -err); + else +- txq->dcb_prio = value; ++ txq->dcb_prio = enable ? value : 0; + } + } + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index 7cb3ef466cc7..c7a94aacc664 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -8526,7 +8526,7 @@ static int t4_get_flash_params(struct adapter *adap) + }; + + unsigned int part, manufacturer; +- unsigned int density, size; ++ unsigned int density, size = 0; + u32 flashid = 0; + int ret; + +@@ -8596,11 +8596,6 @@ static int t4_get_flash_params(struct adapter *adap) + case 0x22: /* 256MB */ + size = 1 << 28; + break; +- +- default: +- dev_err(adap->pdev_dev, "Micron Flash Part has bad size, ID = %#x, Density code = %#x\n", +- flashid, density); +- return -EINVAL; + } + break; + } +@@ -8616,10 +8611,6 @@ static int t4_get_flash_params(struct adapter *adap) + case 0x17: /* 64MB */ + size = 1 << 26; + break; +- default: +- dev_err(adap->pdev_dev, "ISSI Flash Part has bad size, ID = %#x, Density code = %#x\n", +- flashid, density); +- return -EINVAL; + } + break; + } +@@ -8635,10 +8626,6 @@ static int t4_get_flash_params(struct adapter *adap) + case 0x18: /* 16MB */ + size = 1 << 24; + break; +- default: +- dev_err(adap->pdev_dev, "Macronix Flash Part has bad size, ID = %#x, Density code = %#x\n", +- flashid, density); +- return -EINVAL; + } + break; + } +@@ -8654,17 +8641,21 @@ static int t4_get_flash_params(struct adapter *adap) + case 0x18: /* 16MB */ + size = 1 << 24; + break; +- default: +- dev_err(adap->pdev_dev, "Winbond Flash Part has bad size, ID = %#x, Density code = %#x\n", +- flashid, density); +- return -EINVAL; + } + break; + } +- default: +- dev_err(adap->pdev_dev, "Unsupported Flash Part, ID = %#x\n", +- flashid); +- return -EINVAL; ++ } ++ ++ /* If we didn't recognize the FLASH part, that's no real issue: the ++ * Hardware/Software contract says that Hardware will _*ALWAYS*_ ++ * use a FLASH part which is at least 4MB in size and has 64KB ++ * sectors. The unrecognized FLASH part is likely to be much larger ++ * than 4MB, but that's all we really need. ++ */ ++ if (size == 0) { ++ dev_warn(adap->pdev_dev, "Unknown Flash Part, ID = %#x, assuming 4MB\n", ++ flashid); ++ size = 1 << 22; + } + + /* Store decoded Flash size and fall through into vetting code. */ +diff --git a/drivers/net/ethernet/cisco/enic/enic_clsf.c b/drivers/net/ethernet/cisco/enic/enic_clsf.c +index 973c1fb70d09..99038dfc7fbe 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c ++++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c +@@ -79,7 +79,6 @@ void enic_rfs_flw_tbl_init(struct enic *enic) + enic->rfs_h.max = enic->config.num_arfs; + enic->rfs_h.free = enic->rfs_h.max; + enic->rfs_h.toclean = 0; +- enic_rfs_timer_start(enic); + } + + void enic_rfs_flw_tbl_free(struct enic *enic) +@@ -88,7 +87,6 @@ void enic_rfs_flw_tbl_free(struct enic *enic) + + enic_rfs_timer_stop(enic); + spin_lock_bh(&enic->rfs_h.lock); +- enic->rfs_h.free = 0; + for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) { + struct hlist_head *hhead; + struct hlist_node *tmp; +@@ -99,6 +97,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic) + enic_delfltr(enic, n->fltr_id); + hlist_del(&n->node); + kfree(n); ++ enic->rfs_h.free++; + } + } + spin_unlock_bh(&enic->rfs_h.lock); +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index 454e57ef047a..84eac2b0837d 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1971,7 +1971,7 @@ static int enic_open(struct net_device *netdev) + vnic_intr_unmask(&enic->intr[i]); + + enic_notify_timer_start(enic); +- enic_rfs_flw_tbl_init(enic); ++ enic_rfs_timer_start(enic); + + return 0; + +@@ -2895,6 +2895,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + timer_setup(&enic->notify_timer, enic_notify_timer, 0); + ++ enic_rfs_flw_tbl_init(enic); + enic_set_rx_coal_setting(enic); + INIT_WORK(&enic->reset, enic_reset); + INIT_WORK(&enic->tx_hang_reset, enic_tx_hang_reset); +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index fd43f98ddbe7..38498cfa405e 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -125,6 +125,9 @@ MODULE_PARM_DESC(tx_timeout, "The Tx timeout in ms"); + /* Default alignment for start of data in an Rx FD */ + #define DPAA_FD_DATA_ALIGNMENT 16 + ++/* The DPAA requires 256 bytes reserved and mapped for the SGT */ ++#define DPAA_SGT_SIZE 256 ++ + /* Values for the L3R field of the FM Parse Results + */ + /* L3 Type field: First IP Present IPv4 */ +@@ -1617,8 +1620,8 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv, + + if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) { + nr_frags = skb_shinfo(skb)->nr_frags; +- dma_unmap_single(dev, addr, qm_fd_get_offset(fd) + +- sizeof(struct qm_sg_entry) * (1 + nr_frags), ++ dma_unmap_single(dev, addr, ++ qm_fd_get_offset(fd) + DPAA_SGT_SIZE, + dma_dir); + + /* The sgt buffer has been allocated with netdev_alloc_frag(), +@@ -1903,8 +1906,7 @@ static int skb_to_sg_fd(struct dpaa_priv *priv, + void *sgt_buf; + + /* get a page frag to store the SGTable */ +- sz = SKB_DATA_ALIGN(priv->tx_headroom + +- sizeof(struct qm_sg_entry) * (1 + nr_frags)); ++ sz = SKB_DATA_ALIGN(priv->tx_headroom + DPAA_SGT_SIZE); + sgt_buf = netdev_alloc_frag(sz); + if (unlikely(!sgt_buf)) { + netdev_err(net_dev, "netdev_alloc_frag() failed for size %d\n", +@@ -1972,9 +1974,8 @@ static int skb_to_sg_fd(struct dpaa_priv *priv, + skbh = (struct sk_buff **)buffer_start; + *skbh = skb; + +- addr = dma_map_single(dev, buffer_start, priv->tx_headroom + +- sizeof(struct qm_sg_entry) * (1 + nr_frags), +- dma_dir); ++ addr = dma_map_single(dev, buffer_start, ++ priv->tx_headroom + DPAA_SGT_SIZE, dma_dir); + if (unlikely(dma_mapping_error(dev, addr))) { + dev_err(dev, "DMA mapping failed"); + err = -EINVAL; +diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c +index 6552d68ea6e1..4aa47bc8b02f 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_port.c ++++ b/drivers/net/ethernet/freescale/fman/fman_port.c +@@ -324,6 +324,10 @@ struct fman_port_qmi_regs { + #define HWP_HXS_PHE_REPORT 0x00000800 + #define HWP_HXS_PCAC_PSTAT 0x00000100 + #define HWP_HXS_PCAC_PSTOP 0x00000001 ++#define HWP_HXS_TCP_OFFSET 0xA ++#define HWP_HXS_UDP_OFFSET 0xB ++#define HWP_HXS_SH_PAD_REM 0x80000000 ++ + struct fman_port_hwp_regs { + struct { + u32 ssa; /* Soft Sequence Attachment */ +@@ -728,6 +732,10 @@ static void init_hwp(struct fman_port *port) + iowrite32be(0xffffffff, ®s->pmda[i].lcv); + } + ++ /* Short packet padding removal from checksum calculation */ ++ iowrite32be(HWP_HXS_SH_PAD_REM, ®s->pmda[HWP_HXS_TCP_OFFSET].ssa); ++ iowrite32be(HWP_HXS_SH_PAD_REM, ®s->pmda[HWP_HXS_UDP_OFFSET].ssa); ++ + start_port_hwp(port); + } + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 5ec1185808e5..65aa7a6e33a2 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -319,7 +319,8 @@ static void replenish_rx_pool(struct ibmvnic_adapter *adapter, + return; + + failure: +- dev_info(dev, "replenish pools failure\n"); ++ if (lpar_rc != H_PARAMETER && lpar_rc != H_CLOSED) ++ dev_err_ratelimited(dev, "rx: replenish packet buffer failed\n"); + pool->free_map[pool->next_free] = index; + pool->rx_buff[index].skb = NULL; + +@@ -1594,7 +1595,8 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + &tx_crq); + } + if (lpar_rc != H_SUCCESS) { +- dev_err(dev, "tx failed with code %ld\n", lpar_rc); ++ if (lpar_rc != H_CLOSED && lpar_rc != H_PARAMETER) ++ dev_err_ratelimited(dev, "tx: send failed\n"); + dev_kfree_skb_any(skb); + tx_buff->skb = NULL; + +@@ -1799,8 +1801,8 @@ static int do_reset(struct ibmvnic_adapter *adapter, + + rc = ibmvnic_login(netdev); + if (rc) { +- adapter->state = VNIC_PROBED; +- return 0; ++ adapter->state = reset_state; ++ return rc; + } + + if (adapter->reset_reason == VNIC_RESET_CHANGE_PARAM || +@@ -3085,6 +3087,25 @@ static union ibmvnic_crq *ibmvnic_next_crq(struct ibmvnic_adapter *adapter) + return crq; + } + ++static void print_subcrq_error(struct device *dev, int rc, const char *func) ++{ ++ switch (rc) { ++ case H_PARAMETER: ++ dev_warn_ratelimited(dev, ++ "%s failed: Send request is malformed or adapter failover pending. (rc=%d)\n", ++ func, rc); ++ break; ++ case H_CLOSED: ++ dev_warn_ratelimited(dev, ++ "%s failed: Backing queue closed. Adapter is down or failover pending. (rc=%d)\n", ++ func, rc); ++ break; ++ default: ++ dev_err_ratelimited(dev, "%s failed: (rc=%d)\n", func, rc); ++ break; ++ } ++} ++ + static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle, + union sub_crq *sub_crq) + { +@@ -3111,11 +3132,8 @@ static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle, + cpu_to_be64(u64_crq[2]), + cpu_to_be64(u64_crq[3])); + +- if (rc) { +- if (rc == H_CLOSED) +- dev_warn(dev, "CRQ Queue closed\n"); +- dev_err(dev, "Send error (rc=%d)\n", rc); +- } ++ if (rc) ++ print_subcrq_error(dev, rc, __func__); + + return rc; + } +@@ -3133,11 +3151,8 @@ static int send_subcrq_indirect(struct ibmvnic_adapter *adapter, + cpu_to_be64(remote_handle), + ioba, num_entries); + +- if (rc) { +- if (rc == H_CLOSED) +- dev_warn(dev, "CRQ Queue closed\n"); +- dev_err(dev, "Send (indirect) error (rc=%d)\n", rc); +- } ++ if (rc) ++ print_subcrq_error(dev, rc, __func__); + + return rc; + } +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c +index 633be93f3dbb..b8f1f904e5c2 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c +@@ -1897,7 +1897,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq, + if (enable_addr != 0) + rar_high |= IXGBE_RAH_AV; + ++ /* Record lower 32 bits of MAC address and then make ++ * sure that write is flushed to hardware before writing ++ * the upper 16 bits and setting the valid bit. ++ */ + IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low); ++ IXGBE_WRITE_FLUSH(hw); + IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high); + + return 0; +@@ -1929,8 +1934,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index) + rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index)); + rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV); + +- IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0); ++ /* Clear the address valid bit and upper 16 bits of the address ++ * before clearing the lower bits. This way we aren't updating ++ * a live filter. ++ */ + IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high); ++ IXGBE_WRITE_FLUSH(hw); ++ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0); + + /* clear VMDq pool/queue selection for this RAR */ + hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL); +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +index cead23e3db0c..eea4b6f0efe5 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +@@ -759,7 +759,7 @@ int ixgbe_ipsec_tx(struct ixgbe_ring *tx_ring, + } + + itd->sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX; +- if (unlikely(itd->sa_idx > IXGBE_IPSEC_MAX_SA_COUNT)) { ++ if (unlikely(itd->sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) { + netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n", + __func__, itd->sa_idx, xs->xso.offload_handle); + return 0; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 4f52f87cf210..b6624e218962 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1594,17 +1594,15 @@ static void esw_disable_vport(struct mlx5_eswitch *esw, int vport_num) + } + + /* Public E-Switch API */ +-#define ESW_ALLOWED(esw) ((esw) && MLX5_VPORT_MANAGER((esw)->dev)) ++#define ESW_ALLOWED(esw) ((esw) && MLX5_ESWITCH_MANAGER((esw)->dev)) ++ + + int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode) + { + int err; + int i, enabled_events; + +- if (!ESW_ALLOWED(esw)) +- return 0; +- +- if (!MLX5_ESWITCH_MANAGER(esw->dev) || ++ if (!ESW_ALLOWED(esw) || + !MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, ft_support)) { + esw_warn(esw->dev, "E-Switch FDB is not supported, aborting ...\n"); + return -EOPNOTSUPP; +@@ -1806,7 +1804,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw, + u64 node_guid; + int err = 0; + +- if (!ESW_ALLOWED(esw)) ++ if (!MLX5_CAP_GEN(esw->dev, vport_group_manager)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac)) + return -EINVAL; +@@ -1883,7 +1881,7 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw, + { + struct mlx5_vport *evport; + +- if (!ESW_ALLOWED(esw)) ++ if (!MLX5_CAP_GEN(esw->dev, vport_group_manager)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport)) + return -EINVAL; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c +index 177e076b8d17..1f3ccb435b06 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c +@@ -549,8 +549,6 @@ int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev, + return -EINVAL; + if (!MLX5_CAP_GEN(mdev, vport_group_manager)) + return -EACCES; +- if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify)) +- return -EOPNOTSUPP; + + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) +diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c +index 1a781281c57a..a86ae1318043 100644 +--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c ++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c +@@ -73,10 +73,10 @@ nfp_bpf_xdp_offload(struct nfp_app *app, struct nfp_net *nn, + + ret = nfp_net_bpf_offload(nn, prog, running, extack); + /* Stop offload if replace not possible */ +- if (ret && prog) +- nfp_bpf_xdp_offload(app, nn, NULL, extack); ++ if (ret) ++ return ret; + +- nn->dp.bpf_offload_xdp = prog && !ret; ++ nn->dp.bpf_offload_xdp = !!prog; + return ret; + } + +diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c +index cd34097b79f1..37a6d7822a38 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c ++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c +@@ -232,7 +232,7 @@ struct nfp_nffw_info *nfp_nffw_info_open(struct nfp_cpp *cpp) + err = nfp_cpp_read(cpp, nfp_resource_cpp_id(state->res), + nfp_resource_address(state->res), + fwinf, sizeof(*fwinf)); +- if (err < sizeof(*fwinf)) ++ if (err < (int)sizeof(*fwinf)) + goto err_release; + + if (!nffw_res_flg_init_get(fwinf)) +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c +index e82986df9b8e..6292c38ef597 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c +@@ -255,9 +255,8 @@ qed_dcbx_get_app_protocol_type(struct qed_hwfn *p_hwfn, + *type = DCBX_PROTOCOL_ROCE_V2; + } else { + *type = DCBX_MAX_PROTOCOL_TYPE; +- DP_ERR(p_hwfn, +- "No action required, App TLV id = 0x%x app_prio_bitmap = 0x%x\n", +- id, app_prio_bitmap); ++ DP_ERR(p_hwfn, "No action required, App TLV entry = 0x%x\n", ++ app_prio_bitmap); + return false; + } + +@@ -1469,8 +1468,8 @@ static u8 qed_dcbnl_getcap(struct qed_dev *cdev, int capid, u8 *cap) + *cap = 0x80; + break; + case DCB_CAP_ATTR_DCBX: +- *cap = (DCB_CAP_DCBX_LLD_MANAGED | DCB_CAP_DCBX_VER_CEE | +- DCB_CAP_DCBX_VER_IEEE | DCB_CAP_DCBX_STATIC); ++ *cap = (DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_VER_IEEE | ++ DCB_CAP_DCBX_STATIC); + break; + default: + *cap = false; +@@ -1538,8 +1537,6 @@ static u8 qed_dcbnl_getdcbx(struct qed_dev *cdev) + if (!dcbx_info) + return 0; + +- if (dcbx_info->operational.enabled) +- mode |= DCB_CAP_DCBX_LLD_MANAGED; + if (dcbx_info->operational.ieee) + mode |= DCB_CAP_DCBX_VER_IEEE; + if (dcbx_info->operational.cee) +diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c +index 4926c5532fba..13641096a002 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c +@@ -6663,7 +6663,7 @@ static enum dbg_status qed_parse_mcp_trace_buf(u8 *trace_buf, + format_idx = header & MFW_TRACE_EVENTID_MASK; + + /* Skip message if its index doesn't exist in the meta data */ +- if (format_idx > s_mcp_trace_meta.formats_num) { ++ if (format_idx >= s_mcp_trace_meta.formats_num) { + u8 format_size = + (u8)((header & MFW_TRACE_PRM_SIZE_MASK) >> + MFW_TRACE_PRM_SIZE_SHIFT); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +index 468c59d2e491..fa0598cf0ad6 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +@@ -201,8 +201,9 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data) + + skb = build_skb(buffer->data, 0); + if (!skb) { +- rc = -ENOMEM; +- goto out_post; ++ DP_INFO(cdev, "Failed to build SKB\n"); ++ kfree(buffer->data); ++ goto out_post1; + } + + data->u.placement_offset += NET_SKB_PAD; +@@ -224,8 +225,14 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data) + cdev->ll2->cbs->rx_cb(cdev->ll2->cb_cookie, skb, + data->opaque_data_0, + data->opaque_data_1); ++ } else { ++ DP_VERBOSE(p_hwfn, (NETIF_MSG_RX_STATUS | NETIF_MSG_PKTDATA | ++ QED_MSG_LL2 | QED_MSG_STORAGE), ++ "Dropping the packet\n"); ++ kfree(buffer->data); + } + ++out_post1: + /* Update Buffer information and update FW producer */ + buffer->data = new_data; + buffer->phys_addr = new_phys_addr; +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index 261f21d6b0b0..30e9718fefbb 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -566,8 +566,16 @@ static irqreturn_t qed_single_int(int irq, void *dev_instance) + /* Fastpath interrupts */ + for (j = 0; j < 64; j++) { + if ((0x2ULL << j) & status) { +- hwfn->simd_proto_handler[j].func( +- hwfn->simd_proto_handler[j].token); ++ struct qed_simd_fp_handler *p_handler = ++ &hwfn->simd_proto_handler[j]; ++ ++ if (p_handler->func) ++ p_handler->func(p_handler->token); ++ else ++ DP_NOTICE(hwfn, ++ "Not calling fastpath handler as it is NULL [handler #%d, status 0x%llx]\n", ++ j, status); ++ + status &= ~(0x2ULL << j); + rc = IRQ_HANDLED; + } +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c +index 891f03a7a33d..8d7b9bb910f2 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c +@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_write_handler(struct file *filp, + struct qlcnic_adapter *adapter = dev_get_drvdata(dev); + + ret = kstrtoul(buf, 16, &data); ++ if (ret) ++ return ret; + + switch (data) { + case QLC_83XX_FLASH_SECTOR_ERASE_CMD: +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 5803cd6db406..206f0266463e 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -658,7 +658,7 @@ qcaspi_netdev_open(struct net_device *dev) + return ret; + } + +- netif_start_queue(qca->net_dev); ++ /* SPI thread takes care of TX queue */ + + return 0; + } +@@ -760,6 +760,9 @@ qcaspi_netdev_tx_timeout(struct net_device *dev) + qca->net_dev->stats.tx_errors++; + /* Trigger tx queue flush and QCA7000 reset */ + qca->sync = QCASPI_SYNC_UNKNOWN; ++ ++ if (qca->spi_thread) ++ wake_up_process(qca->spi_thread); + } + + static int +@@ -878,22 +881,22 @@ qca_spi_probe(struct spi_device *spi) + + if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) || + (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) { +- dev_info(&spi->dev, "Invalid clkspeed: %d\n", +- qcaspi_clkspeed); ++ dev_err(&spi->dev, "Invalid clkspeed: %d\n", ++ qcaspi_clkspeed); + return -EINVAL; + } + + if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) || + (qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) { +- dev_info(&spi->dev, "Invalid burst len: %d\n", +- qcaspi_burst_len); ++ dev_err(&spi->dev, "Invalid burst len: %d\n", ++ qcaspi_burst_len); + return -EINVAL; + } + + if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) || + (qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) { +- dev_info(&spi->dev, "Invalid pluggable: %d\n", +- qcaspi_pluggable); ++ dev_err(&spi->dev, "Invalid pluggable: %d\n", ++ qcaspi_pluggable); + return -EINVAL; + } + +@@ -955,8 +958,8 @@ qca_spi_probe(struct spi_device *spi) + } + + if (register_netdev(qcaspi_devs)) { +- dev_info(&spi->dev, "Unable to register net device %s\n", +- qcaspi_devs->name); ++ dev_err(&spi->dev, "Unable to register net device %s\n", ++ qcaspi_devs->name); + free_netdev(qcaspi_devs); + return -EFAULT; + } +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index d3c6ce074571..07cc71cc9b76 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -8345,6 +8345,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + NETIF_F_HW_VLAN_CTAG_RX; + dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO | + NETIF_F_HIGHDMA; ++ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; + + tp->cp_cmd |= RxChkSum | RxVlan; + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 68f122140966..40266fe01186 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -980,6 +980,13 @@ static void ravb_adjust_link(struct net_device *ndev) + struct ravb_private *priv = netdev_priv(ndev); + struct phy_device *phydev = ndev->phydev; + bool new_state = false; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&priv->lock, flags); ++ ++ /* Disable TX and RX right over here, if E-MAC change is ignored */ ++ if (priv->no_avb_link) ++ ravb_rcv_snd_disable(ndev); + + if (phydev->link) { + if (phydev->duplex != priv->duplex) { +@@ -997,18 +1004,21 @@ static void ravb_adjust_link(struct net_device *ndev) + ravb_modify(ndev, ECMR, ECMR_TXF, 0); + new_state = true; + priv->link = phydev->link; +- if (priv->no_avb_link) +- ravb_rcv_snd_enable(ndev); + } + } else if (priv->link) { + new_state = true; + priv->link = 0; + priv->speed = 0; + priv->duplex = -1; +- if (priv->no_avb_link) +- ravb_rcv_snd_disable(ndev); + } + ++ /* Enable TX and RX right over here, if E-MAC change is ignored */ ++ if (priv->no_avb_link && phydev->link) ++ ravb_rcv_snd_enable(ndev); ++ ++ mmiowb(); ++ spin_unlock_irqrestore(&priv->lock, flags); ++ + if (new_state && netif_msg_link(priv)) + phy_print_status(phydev); + } +@@ -1115,52 +1125,18 @@ static int ravb_get_link_ksettings(struct net_device *ndev, + static int ravb_set_link_ksettings(struct net_device *ndev, + const struct ethtool_link_ksettings *cmd) + { +- struct ravb_private *priv = netdev_priv(ndev); +- unsigned long flags; +- int error; +- + if (!ndev->phydev) + return -ENODEV; + +- spin_lock_irqsave(&priv->lock, flags); +- +- /* Disable TX and RX */ +- ravb_rcv_snd_disable(ndev); +- +- error = phy_ethtool_ksettings_set(ndev->phydev, cmd); +- if (error) +- goto error_exit; +- +- if (cmd->base.duplex == DUPLEX_FULL) +- priv->duplex = 1; +- else +- priv->duplex = 0; +- +- ravb_set_duplex(ndev); +- +-error_exit: +- mdelay(1); +- +- /* Enable TX and RX */ +- ravb_rcv_snd_enable(ndev); +- +- mmiowb(); +- spin_unlock_irqrestore(&priv->lock, flags); +- +- return error; ++ return phy_ethtool_ksettings_set(ndev->phydev, cmd); + } + + static int ravb_nway_reset(struct net_device *ndev) + { +- struct ravb_private *priv = netdev_priv(ndev); + int error = -ENODEV; +- unsigned long flags; + +- if (ndev->phydev) { +- spin_lock_irqsave(&priv->lock, flags); ++ if (ndev->phydev) + error = phy_start_aneg(ndev->phydev); +- spin_unlock_irqrestore(&priv->lock, flags); +- } + + return error; + } +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index b6b90a6314e3..d14914495a65 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -1855,8 +1855,15 @@ static void sh_eth_adjust_link(struct net_device *ndev) + { + struct sh_eth_private *mdp = netdev_priv(ndev); + struct phy_device *phydev = ndev->phydev; ++ unsigned long flags; + int new_state = 0; + ++ spin_lock_irqsave(&mdp->lock, flags); ++ ++ /* Disable TX and RX right over here, if E-MAC change is ignored */ ++ if (mdp->cd->no_psr || mdp->no_ether_link) ++ sh_eth_rcv_snd_disable(ndev); ++ + if (phydev->link) { + if (phydev->duplex != mdp->duplex) { + new_state = 1; +@@ -1875,18 +1882,21 @@ static void sh_eth_adjust_link(struct net_device *ndev) + sh_eth_modify(ndev, ECMR, ECMR_TXF, 0); + new_state = 1; + mdp->link = phydev->link; +- if (mdp->cd->no_psr || mdp->no_ether_link) +- sh_eth_rcv_snd_enable(ndev); + } + } else if (mdp->link) { + new_state = 1; + mdp->link = 0; + mdp->speed = 0; + mdp->duplex = -1; +- if (mdp->cd->no_psr || mdp->no_ether_link) +- sh_eth_rcv_snd_disable(ndev); + } + ++ /* Enable TX and RX right over here, if E-MAC change is ignored */ ++ if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link) ++ sh_eth_rcv_snd_enable(ndev); ++ ++ mmiowb(); ++ spin_unlock_irqrestore(&mdp->lock, flags); ++ + if (new_state && netif_msg_link(mdp)) + phy_print_status(phydev); + } +@@ -1977,39 +1987,10 @@ static int sh_eth_get_link_ksettings(struct net_device *ndev, + static int sh_eth_set_link_ksettings(struct net_device *ndev, + const struct ethtool_link_ksettings *cmd) + { +- struct sh_eth_private *mdp = netdev_priv(ndev); +- unsigned long flags; +- int ret; +- + if (!ndev->phydev) + return -ENODEV; + +- spin_lock_irqsave(&mdp->lock, flags); +- +- /* disable tx and rx */ +- sh_eth_rcv_snd_disable(ndev); +- +- ret = phy_ethtool_ksettings_set(ndev->phydev, cmd); +- if (ret) +- goto error_exit; +- +- if (cmd->base.duplex == DUPLEX_FULL) +- mdp->duplex = 1; +- else +- mdp->duplex = 0; +- +- if (mdp->cd->set_duplex) +- mdp->cd->set_duplex(ndev); +- +-error_exit: +- mdelay(1); +- +- /* enable tx and rx */ +- sh_eth_rcv_snd_enable(ndev); +- +- spin_unlock_irqrestore(&mdp->lock, flags); +- +- return ret; ++ return phy_ethtool_ksettings_set(ndev->phydev, cmd); + } + + /* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the +@@ -2193,18 +2174,10 @@ static void sh_eth_get_regs(struct net_device *ndev, struct ethtool_regs *regs, + + static int sh_eth_nway_reset(struct net_device *ndev) + { +- struct sh_eth_private *mdp = netdev_priv(ndev); +- unsigned long flags; +- int ret; +- + if (!ndev->phydev) + return -ENODEV; + +- spin_lock_irqsave(&mdp->lock, flags); +- ret = phy_start_aneg(ndev->phydev); +- spin_unlock_irqrestore(&mdp->lock, flags); +- +- return ret; ++ return phy_start_aneg(ndev->phydev); + } + + static u32 sh_eth_get_msglevel(struct net_device *ndev) +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index d90a7b1f4088..56ff390e6795 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -4288,9 +4288,9 @@ static int efx_ef10_filter_pri(struct efx_ef10_filter_table *table, + return -EPROTONOSUPPORT; + } + +-static s32 efx_ef10_filter_insert(struct efx_nic *efx, +- struct efx_filter_spec *spec, +- bool replace_equal) ++static s32 efx_ef10_filter_insert_locked(struct efx_nic *efx, ++ struct efx_filter_spec *spec, ++ bool replace_equal) + { + DECLARE_BITMAP(mc_rem_map, EFX_EF10_FILTER_SEARCH_LIMIT); + struct efx_ef10_nic_data *nic_data = efx->nic_data; +@@ -4307,7 +4307,7 @@ static s32 efx_ef10_filter_insert(struct efx_nic *efx, + bool is_mc_recip; + s32 rc; + +- down_read(&efx->filter_sem); ++ WARN_ON(!rwsem_is_locked(&efx->filter_sem)); + table = efx->filter_state; + down_write(&table->lock); + +@@ -4498,10 +4498,22 @@ out_unlock: + if (rss_locked) + mutex_unlock(&efx->rss_lock); + up_write(&table->lock); +- up_read(&efx->filter_sem); + return rc; + } + ++static s32 efx_ef10_filter_insert(struct efx_nic *efx, ++ struct efx_filter_spec *spec, ++ bool replace_equal) ++{ ++ s32 ret; ++ ++ down_read(&efx->filter_sem); ++ ret = efx_ef10_filter_insert_locked(efx, spec, replace_equal); ++ up_read(&efx->filter_sem); ++ ++ return ret; ++} ++ + static void efx_ef10_filter_update_rx_scatter(struct efx_nic *efx) + { + /* no need to do anything here on EF10 */ +@@ -5284,7 +5296,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx, + EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID); + efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0); + efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr); +- rc = efx_ef10_filter_insert(efx, &spec, true); ++ rc = efx_ef10_filter_insert_locked(efx, &spec, true); + if (rc < 0) { + if (rollback) { + netif_info(efx, drv, efx->net_dev, +@@ -5313,7 +5325,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx, + efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0); + eth_broadcast_addr(baddr); + efx_filter_set_eth_local(&spec, vlan->vid, baddr); +- rc = efx_ef10_filter_insert(efx, &spec, true); ++ rc = efx_ef10_filter_insert_locked(efx, &spec, true); + if (rc < 0) { + netif_warn(efx, drv, efx->net_dev, + "Broadcast filter insert failed rc=%d\n", rc); +@@ -5369,7 +5381,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx, + if (vlan->vid != EFX_FILTER_VID_UNSPEC) + efx_filter_set_eth_local(&spec, vlan->vid, NULL); + +- rc = efx_ef10_filter_insert(efx, &spec, true); ++ rc = efx_ef10_filter_insert_locked(efx, &spec, true); + if (rc < 0) { + const char *um = multicast ? "Multicast" : "Unicast"; + const char *encap_name = ""; +@@ -5429,7 +5441,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx, + filter_flags, 0); + eth_broadcast_addr(baddr); + efx_filter_set_eth_local(&spec, vlan->vid, baddr); +- rc = efx_ef10_filter_insert(efx, &spec, true); ++ rc = efx_ef10_filter_insert_locked(efx, &spec, true); + if (rc < 0) { + netif_warn(efx, drv, efx->net_dev, + "Broadcast filter insert failed rc=%d\n", +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index a4ebd8715494..bf41157cc712 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -1840,12 +1840,6 @@ static void efx_remove_filters(struct efx_nic *efx) + up_write(&efx->filter_sem); + } + +-static void efx_restore_filters(struct efx_nic *efx) +-{ +- down_read(&efx->filter_sem); +- efx->type->filter_table_restore(efx); +- up_read(&efx->filter_sem); +-} + + /************************************************************************** + * +@@ -2657,6 +2651,7 @@ void efx_reset_down(struct efx_nic *efx, enum reset_type method) + efx_disable_interrupts(efx); + + mutex_lock(&efx->mac_lock); ++ down_write(&efx->filter_sem); + mutex_lock(&efx->rss_lock); + if (efx->port_initialized && method != RESET_TYPE_INVISIBLE && + method != RESET_TYPE_DATAPATH) +@@ -2714,9 +2709,8 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok) + if (efx->type->rx_restore_rss_contexts) + efx->type->rx_restore_rss_contexts(efx); + mutex_unlock(&efx->rss_lock); +- down_read(&efx->filter_sem); +- efx_restore_filters(efx); +- up_read(&efx->filter_sem); ++ efx->type->filter_table_restore(efx); ++ up_write(&efx->filter_sem); + if (efx->type->sriov_reset) + efx->type->sriov_reset(efx); + +@@ -2733,6 +2727,7 @@ fail: + efx->port_initialized = false; + + mutex_unlock(&efx->rss_lock); ++ up_write(&efx->filter_sem); + mutex_unlock(&efx->mac_lock); + + return rc; +@@ -3440,7 +3435,9 @@ static int efx_pci_probe_main(struct efx_nic *efx) + + efx_init_napi(efx); + ++ down_write(&efx->filter_sem); + rc = efx->type->init(efx); ++ up_write(&efx->filter_sem); + if (rc) { + netif_err(efx, probe, efx->net_dev, + "failed to initialise NIC\n"); +@@ -3729,7 +3726,9 @@ static int efx_pm_resume(struct device *dev) + rc = efx->type->reset(efx, RESET_TYPE_ALL); + if (rc) + return rc; ++ down_write(&efx->filter_sem); + rc = efx->type->init(efx); ++ up_write(&efx->filter_sem); + if (rc) + return rc; + rc = efx_pm_thaw(dev); +diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig +index e28c0d2c58e9..bf4acebb6bcd 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig ++++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig +@@ -111,7 +111,7 @@ config DWMAC_ROCKCHIP + config DWMAC_SOCFPGA + tristate "SOCFPGA dwmac support" + default ARCH_SOCFPGA +- depends on OF && (ARCH_SOCFPGA || COMPILE_TEST) ++ depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST) + select MFD_SYSCON + help + Support for ethernet controller on Altera SOCFPGA +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +index 6e359572b9f0..5b3b06a0a3bf 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +@@ -55,6 +55,7 @@ struct socfpga_dwmac { + struct device *dev; + struct regmap *sys_mgr_base_addr; + struct reset_control *stmmac_rst; ++ struct reset_control *stmmac_ocp_rst; + void __iomem *splitter_base; + bool f2h_ptp_ref_clk; + struct tse_pcs pcs; +@@ -262,8 +263,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac) + val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII; + + /* Assert reset to the enet controller before changing the phy mode */ +- if (dwmac->stmmac_rst) +- reset_control_assert(dwmac->stmmac_rst); ++ reset_control_assert(dwmac->stmmac_ocp_rst); ++ reset_control_assert(dwmac->stmmac_rst); + + regmap_read(sys_mgr_base_addr, reg_offset, &ctrl); + ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift); +@@ -288,8 +289,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac) + /* Deassert reset for the phy configuration to be sampled by + * the enet controller, and operation to start in requested mode + */ +- if (dwmac->stmmac_rst) +- reset_control_deassert(dwmac->stmmac_rst); ++ reset_control_deassert(dwmac->stmmac_ocp_rst); ++ reset_control_deassert(dwmac->stmmac_rst); + if (phymode == PHY_INTERFACE_MODE_SGMII) { + if (tse_pcs_init(dwmac->pcs.tse_pcs_base, &dwmac->pcs) != 0) { + dev_err(dwmac->dev, "Unable to initialize TSE PCS"); +@@ -324,6 +325,15 @@ static int socfpga_dwmac_probe(struct platform_device *pdev) + goto err_remove_config_dt; + } + ++ dwmac->stmmac_ocp_rst = devm_reset_control_get_optional(dev, "stmmaceth-ocp"); ++ if (IS_ERR(dwmac->stmmac_ocp_rst)) { ++ ret = PTR_ERR(dwmac->stmmac_ocp_rst); ++ dev_err(dev, "error getting reset control of ocp %d\n", ret); ++ goto err_remove_config_dt; ++ } ++ ++ reset_control_deassert(dwmac->stmmac_ocp_rst); ++ + ret = socfpga_dwmac_parse_data(dwmac, dev); + if (ret) { + dev_err(dev, "Unable to parse OF data\n"); +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index 1480c094b57d..a817fad26a7b 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1387,6 +1387,10 @@ static int emac_devioctl(struct net_device *ndev, struct ifreq *ifrq, int cmd) + + static int match_first_device(struct device *dev, void *data) + { ++ if (dev->parent && dev->parent->of_node) ++ return of_device_is_compatible(dev->parent->of_node, ++ "ti,davinci_mdio"); ++ + return !strncmp(dev_name(dev), "davinci_mdio", 12); + } + +diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c +index dfabbae72efd..4a22e169b5a5 100644 +--- a/drivers/net/hamradio/bpqether.c ++++ b/drivers/net/hamradio/bpqether.c +@@ -89,10 +89,6 @@ + static const char banner[] __initconst = KERN_INFO \ + "AX.25: bpqether driver version 004\n"; + +-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; +- +-static char bpq_eth_addr[6]; +- + static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *); + static int bpq_device_event(struct notifier_block *, unsigned long, void *); + +@@ -515,8 +511,8 @@ static int bpq_new_device(struct net_device *edev) + bpq->ethdev = edev; + bpq->axdev = ndev; + +- memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr)); +- memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr)); ++ eth_broadcast_addr(bpq->dest_addr); ++ eth_broadcast_addr(bpq->acpt_addr); + + err = register_netdevice(ndev); + if (err) +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index f362cda85425..fde0cddac71a 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -1307,6 +1307,7 @@ out: + /* setting up multiple channels failed */ + net_device->max_chn = 1; + net_device->num_chn = 1; ++ return 0; + + err_dev_remv: + rndis_filter_device_remove(dev, net_device); +diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c +index 64f1b1e77bc0..23a52b9293f3 100644 +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -275,6 +275,8 @@ struct adf7242_local { + struct spi_message stat_msg; + struct spi_transfer stat_xfer; + struct dentry *debugfs_root; ++ struct delayed_work work; ++ struct workqueue_struct *wqueue; + unsigned long flags; + int tx_stat; + bool promiscuous; +@@ -575,10 +577,26 @@ static int adf7242_cmd_rx(struct adf7242_local *lp) + /* Wait until the ACK is sent */ + adf7242_wait_status(lp, RC_STATUS_PHY_RDY, RC_STATUS_MASK, __LINE__); + adf7242_clear_irqstat(lp); ++ mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400)); + + return adf7242_cmd(lp, CMD_RC_RX); + } + ++static void adf7242_rx_cal_work(struct work_struct *work) ++{ ++ struct adf7242_local *lp = ++ container_of(work, struct adf7242_local, work.work); ++ ++ /* Reissuing RC_RX every 400ms - to adjust for offset ++ * drift in receiver (datasheet page 61, OCL section) ++ */ ++ ++ if (!test_bit(FLAG_XMIT, &lp->flags)) { ++ adf7242_cmd(lp, CMD_RC_PHY_RDY); ++ adf7242_cmd_rx(lp); ++ } ++} ++ + static int adf7242_set_txpower(struct ieee802154_hw *hw, int mbm) + { + struct adf7242_local *lp = hw->priv; +@@ -686,7 +704,7 @@ static int adf7242_start(struct ieee802154_hw *hw) + enable_irq(lp->spi->irq); + set_bit(FLAG_START, &lp->flags); + +- return adf7242_cmd(lp, CMD_RC_RX); ++ return adf7242_cmd_rx(lp); + } + + static void adf7242_stop(struct ieee802154_hw *hw) +@@ -694,6 +712,7 @@ static void adf7242_stop(struct ieee802154_hw *hw) + struct adf7242_local *lp = hw->priv; + + disable_irq(lp->spi->irq); ++ cancel_delayed_work_sync(&lp->work); + adf7242_cmd(lp, CMD_RC_IDLE); + clear_bit(FLAG_START, &lp->flags); + adf7242_clear_irqstat(lp); +@@ -719,7 +738,10 @@ static int adf7242_channel(struct ieee802154_hw *hw, u8 page, u8 channel) + adf7242_write_reg(lp, REG_CH_FREQ1, freq >> 8); + adf7242_write_reg(lp, REG_CH_FREQ2, freq >> 16); + +- return adf7242_cmd(lp, CMD_RC_RX); ++ if (test_bit(FLAG_START, &lp->flags)) ++ return adf7242_cmd_rx(lp); ++ else ++ return adf7242_cmd(lp, CMD_RC_PHY_RDY); + } + + static int adf7242_set_hw_addr_filt(struct ieee802154_hw *hw, +@@ -814,6 +836,7 @@ static int adf7242_xmit(struct ieee802154_hw *hw, struct sk_buff *skb) + /* ensure existing instances of the IRQ handler have completed */ + disable_irq(lp->spi->irq); + set_bit(FLAG_XMIT, &lp->flags); ++ cancel_delayed_work_sync(&lp->work); + reinit_completion(&lp->tx_complete); + adf7242_cmd(lp, CMD_RC_PHY_RDY); + adf7242_clear_irqstat(lp); +@@ -952,6 +975,7 @@ static irqreturn_t adf7242_isr(int irq, void *data) + unsigned int xmit; + u8 irq1; + ++ mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400)); + adf7242_read_reg(lp, REG_IRQ1_SRC1, &irq1); + + if (!(irq1 & (IRQ_RX_PKT_RCVD | IRQ_CSMA_CA))) +@@ -1241,6 +1265,9 @@ static int adf7242_probe(struct spi_device *spi) + spi_message_add_tail(&lp->stat_xfer, &lp->stat_msg); + + spi_set_drvdata(spi, lp); ++ INIT_DELAYED_WORK(&lp->work, adf7242_rx_cal_work); ++ lp->wqueue = alloc_ordered_workqueue(dev_name(&spi->dev), ++ WQ_MEM_RECLAIM); + + ret = adf7242_hw_init(lp); + if (ret) +@@ -1284,6 +1311,9 @@ static int adf7242_remove(struct spi_device *spi) + if (!IS_ERR_OR_NULL(lp->debugfs_root)) + debugfs_remove_recursive(lp->debugfs_root); + ++ cancel_delayed_work_sync(&lp->work); ++ destroy_workqueue(lp->wqueue); ++ + ieee802154_unregister_hw(lp->hw); + mutex_destroy(&lp->bmux); + ieee802154_free_hw(lp->hw); +diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c +index 77abedf0b524..3d9e91579866 100644 +--- a/drivers/net/ieee802154/at86rf230.c ++++ b/drivers/net/ieee802154/at86rf230.c +@@ -940,7 +940,7 @@ at86rf230_xmit(struct ieee802154_hw *hw, struct sk_buff *skb) + static int + at86rf230_ed(struct ieee802154_hw *hw, u8 *level) + { +- BUG_ON(!level); ++ WARN_ON(!level); + *level = 0xbe; + return 0; + } +@@ -1121,8 +1121,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw, + if (changed & IEEE802154_AFILT_SADDR_CHANGED) { + u16 addr = le16_to_cpu(filt->short_addr); + +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for saddr\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__); + __at86rf230_write(lp, RG_SHORT_ADDR_0, addr); + __at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8); + } +@@ -1130,8 +1129,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw, + if (changed & IEEE802154_AFILT_PANID_CHANGED) { + u16 pan = le16_to_cpu(filt->pan_id); + +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for pan id\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__); + __at86rf230_write(lp, RG_PAN_ID_0, pan); + __at86rf230_write(lp, RG_PAN_ID_1, pan >> 8); + } +@@ -1140,15 +1138,13 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw, + u8 i, addr[8]; + + memcpy(addr, &filt->ieee_addr, 8); +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for IEEE addr\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__); + for (i = 0; i < 8; i++) + __at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]); + } + + if (changed & IEEE802154_AFILT_PANC_CHANGED) { +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for panc change\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__); + if (filt->pan_coord) + at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1); + else +@@ -1252,7 +1248,6 @@ at86rf230_set_cca_mode(struct ieee802154_hw *hw, + return at86rf230_write_subreg(lp, SR_CCA_MODE, val); + } + +- + static int + at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm) + { +diff --git a/drivers/net/ieee802154/fakelb.c b/drivers/net/ieee802154/fakelb.c +index 0d673f7682ee..176395e4b7bb 100644 +--- a/drivers/net/ieee802154/fakelb.c ++++ b/drivers/net/ieee802154/fakelb.c +@@ -49,7 +49,7 @@ struct fakelb_phy { + + static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level) + { +- BUG_ON(!level); ++ WARN_ON(!level); + *level = 0xbe; + + return 0; +diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c +index de0d7f28a181..e428277781ac 100644 +--- a/drivers/net/ieee802154/mcr20a.c ++++ b/drivers/net/ieee802154/mcr20a.c +@@ -15,10 +15,11 @@ + */ + #include <linux/kernel.h> + #include <linux/module.h> +-#include <linux/gpio.h> ++#include <linux/gpio/consumer.h> + #include <linux/spi/spi.h> + #include <linux/workqueue.h> + #include <linux/interrupt.h> ++#include <linux/irq.h> + #include <linux/skbuff.h> + #include <linux/of_gpio.h> + #include <linux/regmap.h> +diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c +index 6641fd5355e0..6511b1309940 100644 +--- a/drivers/net/ipvlan/ipvlan_main.c ++++ b/drivers/net/ipvlan/ipvlan_main.c +@@ -75,10 +75,23 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval) + { + struct ipvl_dev *ipvlan; + struct net_device *mdev = port->dev; +- int err = 0; ++ unsigned int flags; ++ int err; + + ASSERT_RTNL(); + if (port->mode != nval) { ++ list_for_each_entry(ipvlan, &port->ipvlans, pnode) { ++ flags = ipvlan->dev->flags; ++ if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) { ++ err = dev_change_flags(ipvlan->dev, ++ flags | IFF_NOARP); ++ } else { ++ err = dev_change_flags(ipvlan->dev, ++ flags & ~IFF_NOARP); ++ } ++ if (unlikely(err)) ++ goto fail; ++ } + if (nval == IPVLAN_MODE_L3S) { + /* New mode is L3S */ + err = ipvlan_register_nf_hook(read_pnet(&port->pnet)); +@@ -86,21 +99,28 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval) + mdev->l3mdev_ops = &ipvl_l3mdev_ops; + mdev->priv_flags |= IFF_L3MDEV_MASTER; + } else +- return err; ++ goto fail; + } else if (port->mode == IPVLAN_MODE_L3S) { + /* Old mode was L3S */ + mdev->priv_flags &= ~IFF_L3MDEV_MASTER; + ipvlan_unregister_nf_hook(read_pnet(&port->pnet)); + mdev->l3mdev_ops = NULL; + } +- list_for_each_entry(ipvlan, &port->ipvlans, pnode) { +- if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) +- ipvlan->dev->flags |= IFF_NOARP; +- else +- ipvlan->dev->flags &= ~IFF_NOARP; +- } + port->mode = nval; + } ++ return 0; ++ ++fail: ++ /* Undo the flags changes that have been done so far. */ ++ list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) { ++ flags = ipvlan->dev->flags; ++ if (port->mode == IPVLAN_MODE_L3 || ++ port->mode == IPVLAN_MODE_L3S) ++ dev_change_flags(ipvlan->dev, flags | IFF_NOARP); ++ else ++ dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP); ++ } ++ + return err; + } + +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index 25e2a099b71c..adb2ec74ffc0 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -130,8 +130,9 @@ + #define MII_88E1318S_PHY_WOL_CTRL_CLEAR_WOL_STATUS BIT(12) + #define MII_88E1318S_PHY_WOL_CTRL_MAGIC_PACKET_MATCH_ENABLE BIT(14) + +-#define MII_88E1121_PHY_LED_CTRL 16 ++#define MII_PHY_LED_CTRL 16 + #define MII_88E1121_PHY_LED_DEF 0x0030 ++#define MII_88E1510_PHY_LED_DEF 0x1177 + + #define MII_M1011_PHY_STATUS 0x11 + #define MII_M1011_PHY_STATUS_1000 0x8000 +@@ -632,8 +633,40 @@ error: + return err; + } + ++static void marvell_config_led(struct phy_device *phydev) ++{ ++ u16 def_config; ++ int err; ++ ++ switch (MARVELL_PHY_FAMILY_ID(phydev->phy_id)) { ++ /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */ ++ case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1121R): ++ case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1318S): ++ def_config = MII_88E1121_PHY_LED_DEF; ++ break; ++ /* Default PHY LED config: ++ * LED[0] .. 1000Mbps Link ++ * LED[1] .. 100Mbps Link ++ * LED[2] .. Blink, Activity ++ */ ++ case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1510): ++ def_config = MII_88E1510_PHY_LED_DEF; ++ break; ++ default: ++ return; ++ } ++ ++ err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE, MII_PHY_LED_CTRL, ++ def_config); ++ if (err < 0) ++ pr_warn("Fail to config marvell phy LED.\n"); ++} ++ + static int marvell_config_init(struct phy_device *phydev) + { ++ /* Set defalut LED */ ++ marvell_config_led(phydev); ++ + /* Set registers from marvell,reg-init DT property */ + return marvell_of_reg_init(phydev); + } +@@ -813,21 +846,6 @@ static int m88e1111_config_init(struct phy_device *phydev) + return genphy_soft_reset(phydev); + } + +-static int m88e1121_config_init(struct phy_device *phydev) +-{ +- int err; +- +- /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */ +- err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE, +- MII_88E1121_PHY_LED_CTRL, +- MII_88E1121_PHY_LED_DEF); +- if (err < 0) +- return err; +- +- /* Set marvell,reg-init configuration from device tree */ +- return marvell_config_init(phydev); +-} +- + static int m88e1318_config_init(struct phy_device *phydev) + { + if (phy_interrupt_is_valid(phydev)) { +@@ -841,7 +859,7 @@ static int m88e1318_config_init(struct phy_device *phydev) + return err; + } + +- return m88e1121_config_init(phydev); ++ return marvell_config_init(phydev); + } + + static int m88e1510_config_init(struct phy_device *phydev) +@@ -2090,7 +2108,7 @@ static struct phy_driver marvell_drivers[] = { + .features = PHY_GBIT_FEATURES, + .flags = PHY_HAS_INTERRUPT, + .probe = &m88e1121_probe, +- .config_init = &m88e1121_config_init, ++ .config_init = &marvell_config_init, + .config_aneg = &m88e1121_config_aneg, + .read_status = &marvell_read_status, + .ack_interrupt = &marvell_ack_interrupt, +diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c +index d437f4f5ed52..740655261e5b 100644 +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -349,7 +349,6 @@ static int sfp_register_bus(struct sfp_bus *bus) + } + if (bus->started) + bus->socket_ops->start(bus->sfp); +- bus->netdev->sfp_bus = bus; + bus->registered = true; + return 0; + } +@@ -364,7 +363,6 @@ static void sfp_unregister_bus(struct sfp_bus *bus) + if (bus->phydev && ops && ops->disconnect_phy) + ops->disconnect_phy(bus->upstream); + } +- bus->netdev->sfp_bus = NULL; + bus->registered = false; + } + +@@ -436,6 +434,14 @@ void sfp_upstream_stop(struct sfp_bus *bus) + } + EXPORT_SYMBOL_GPL(sfp_upstream_stop); + ++static void sfp_upstream_clear(struct sfp_bus *bus) ++{ ++ bus->upstream_ops = NULL; ++ bus->upstream = NULL; ++ bus->netdev->sfp_bus = NULL; ++ bus->netdev = NULL; ++} ++ + /** + * sfp_register_upstream() - Register the neighbouring device + * @fwnode: firmware node for the SFP bus +@@ -461,9 +467,13 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode, + bus->upstream_ops = ops; + bus->upstream = upstream; + bus->netdev = ndev; ++ ndev->sfp_bus = bus; + +- if (bus->sfp) ++ if (bus->sfp) { + ret = sfp_register_bus(bus); ++ if (ret) ++ sfp_upstream_clear(bus); ++ } + rtnl_unlock(); + } + +@@ -488,8 +498,7 @@ void sfp_unregister_upstream(struct sfp_bus *bus) + rtnl_lock(); + if (bus->sfp) + sfp_unregister_bus(bus); +- bus->upstream = NULL; +- bus->netdev = NULL; ++ sfp_upstream_clear(bus); + rtnl_unlock(); + + sfp_bus_put(bus); +@@ -561,6 +570,13 @@ void sfp_module_remove(struct sfp_bus *bus) + } + EXPORT_SYMBOL_GPL(sfp_module_remove); + ++static void sfp_socket_clear(struct sfp_bus *bus) ++{ ++ bus->sfp_dev = NULL; ++ bus->sfp = NULL; ++ bus->socket_ops = NULL; ++} ++ + struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp, + const struct sfp_socket_ops *ops) + { +@@ -573,8 +589,11 @@ struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp, + bus->sfp = sfp; + bus->socket_ops = ops; + +- if (bus->netdev) ++ if (bus->netdev) { + ret = sfp_register_bus(bus); ++ if (ret) ++ sfp_socket_clear(bus); ++ } + rtnl_unlock(); + } + +@@ -592,9 +611,7 @@ void sfp_unregister_socket(struct sfp_bus *bus) + rtnl_lock(); + if (bus->netdev) + sfp_unregister_bus(bus); +- bus->sfp_dev = NULL; +- bus->sfp = NULL; +- bus->socket_ops = NULL; ++ sfp_socket_clear(bus); + rtnl_unlock(); + + sfp_bus_put(bus); +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index 5f565bd574da..48ba80a8ca5c 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct net_device *netdev) + (netdev->flags & IFF_ALLMULTI)) { + rx_creg &= 0xfffe; + rx_creg |= 0x0002; +- dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name); ++ dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name); + } else { + /* ~RX_MULTICAST, ~RX_PROMISCUOUS */ + rx_creg &= 0x00fc; +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index 7a6a1fe79309..05553d252446 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -82,6 +82,9 @@ static bool turbo_mode = true; + module_param(turbo_mode, bool, 0644); + MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction"); + ++static int smsc75xx_link_ok_nopm(struct usbnet *dev); ++static int smsc75xx_phy_gig_workaround(struct usbnet *dev); ++ + static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index, + u32 *data, int in_pm) + { +@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struct usbnet *dev) + return -EIO; + } + ++ /* phy workaround for gig link */ ++ smsc75xx_phy_gig_workaround(dev); ++ + smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE, + ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP | + ADVERTISE_PAUSE_ASYM); +@@ -987,6 +993,62 @@ static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm) + return -EIO; + } + ++static int smsc75xx_phy_gig_workaround(struct usbnet *dev) ++{ ++ struct mii_if_info *mii = &dev->mii; ++ int ret = 0, timeout = 0; ++ u32 buf, link_up = 0; ++ ++ /* Set the phy in Gig loopback */ ++ smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040); ++ ++ /* Wait for the link up */ ++ do { ++ link_up = smsc75xx_link_ok_nopm(dev); ++ usleep_range(10000, 20000); ++ timeout++; ++ } while ((!link_up) && (timeout < 1000)); ++ ++ if (timeout >= 1000) { ++ netdev_warn(dev->net, "Timeout waiting for PHY link up\n"); ++ return -EIO; ++ } ++ ++ /* phy reset */ ++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret); ++ return ret; ++ } ++ ++ buf |= PMT_CTL_PHY_RST; ++ ++ ret = smsc75xx_write_reg(dev, PMT_CTL, buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret); ++ return ret; ++ } ++ ++ timeout = 0; ++ do { ++ usleep_range(10000, 20000); ++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ++ ret); ++ return ret; ++ } ++ timeout++; ++ } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100)); ++ ++ if (timeout >= 100) { ++ netdev_warn(dev->net, "timeout waiting for PHY Reset\n"); ++ return -EIO; ++ } ++ ++ return 0; ++} ++ + static int smsc75xx_reset(struct usbnet *dev) + { + struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index bf05a3689558..9fb89f3b8c59 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -6018,8 +6018,19 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk) + ath10k_mac_max_vht_nss(vht_mcs_mask))); + + if (changed & IEEE80211_RC_BW_CHANGED) { +- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d\n", +- sta->addr, bw); ++ enum wmi_phy_mode mode; ++ ++ mode = chan_to_phymode(&def); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d phymode %d\n", ++ sta->addr, bw, mode); ++ ++ err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr, ++ WMI_PEER_PHYMODE, mode); ++ if (err) { ++ ath10k_warn(ar, "failed to update STA %pM peer phymode %d: %d\n", ++ sta->addr, mode, err); ++ goto exit; ++ } + + err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr, + WMI_PEER_CHAN_WIDTH, bw); +@@ -6060,6 +6071,7 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk) + sta->addr); + } + ++exit: + mutex_unlock(&ar->conf_mutex); + } + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h +index 7fde22ea2ffa..d0a380d81d74 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -6098,6 +6098,7 @@ enum wmi_peer_param { + WMI_PEER_NSS = 0x5, + WMI_PEER_USE_4ADDR = 0x6, + WMI_PEER_DEBUG = 0xa, ++ WMI_PEER_PHYMODE = 0xd, + WMI_PEER_DUMMY_VAR = 0xff, /* dummy parameter for STA PS workaround */ + }; + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +index 1037df7297bb..32f2f8b63970 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4294,6 +4294,13 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus) + brcmf_dbg(TRACE, "Enter\n"); + + if (bus) { ++ /* Stop watchdog task */ ++ if (bus->watchdog_tsk) { ++ send_sig(SIGTERM, bus->watchdog_tsk, 1); ++ kthread_stop(bus->watchdog_tsk); ++ bus->watchdog_tsk = NULL; ++ } ++ + /* De-register interrupt handler */ + brcmf_sdiod_intr_unregister(bus->sdiodev); + +diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c +index d5553c47014f..5d823e965883 100644 +--- a/drivers/nfc/pn533/usb.c ++++ b/drivers/nfc/pn533/usb.c +@@ -74,7 +74,7 @@ static void pn533_recv_response(struct urb *urb) + struct sk_buff *skb = NULL; + + if (!urb->status) { +- skb = alloc_skb(urb->actual_length, GFP_KERNEL); ++ skb = alloc_skb(urb->actual_length, GFP_ATOMIC); + if (!skb) { + nfc_err(&phy->udev->dev, "failed to alloc memory\n"); + } else { +@@ -186,7 +186,7 @@ static int pn533_usb_send_frame(struct pn533 *dev, + + if (dev->protocol_type == PN533_PROTO_REQ_RESP) { + /* request for response for sent packet directly */ +- rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC); ++ rc = pn533_submit_urb_for_response(phy, GFP_KERNEL); + if (rc) + goto error; + } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) { +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index b9ca782fe82d..620f837c1234 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -100,6 +100,22 @@ static struct class *nvme_subsys_class; + static void nvme_ns_remove(struct nvme_ns *ns); + static int nvme_revalidate_disk(struct gendisk *disk); + static void nvme_put_subsystem(struct nvme_subsystem *subsys); ++static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl, ++ unsigned nsid); ++ ++static void nvme_set_queue_dying(struct nvme_ns *ns) ++{ ++ /* ++ * Revalidating a dead namespace sets capacity to 0. This will end ++ * buffered writers dirtying pages that can't be synced. ++ */ ++ if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags)) ++ return; ++ revalidate_disk(ns->disk); ++ blk_set_queue_dying(ns->queue); ++ /* Forcibly unquiesce queues to avoid blocking dispatch */ ++ blk_mq_unquiesce_queue(ns->queue); ++} + + int nvme_reset_ctrl(struct nvme_ctrl *ctrl) + { +@@ -1130,19 +1146,15 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns, + + static void nvme_update_formats(struct nvme_ctrl *ctrl) + { +- struct nvme_ns *ns, *next; +- LIST_HEAD(rm_list); ++ struct nvme_ns *ns; + +- down_write(&ctrl->namespaces_rwsem); +- list_for_each_entry(ns, &ctrl->namespaces, list) { +- if (ns->disk && nvme_revalidate_disk(ns->disk)) { +- list_move_tail(&ns->list, &rm_list); +- } +- } +- up_write(&ctrl->namespaces_rwsem); ++ down_read(&ctrl->namespaces_rwsem); ++ list_for_each_entry(ns, &ctrl->namespaces, list) ++ if (ns->disk && nvme_revalidate_disk(ns->disk)) ++ nvme_set_queue_dying(ns); ++ up_read(&ctrl->namespaces_rwsem); + +- list_for_each_entry_safe(ns, next, &rm_list, list) +- nvme_ns_remove(ns); ++ nvme_remove_invalid_namespaces(ctrl, NVME_NSID_ALL); + } + + static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects) +@@ -1197,7 +1209,7 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns, + effects = nvme_passthru_start(ctrl, ns, cmd.opcode); + status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c, + (void __user *)(uintptr_t)cmd.addr, cmd.data_len, +- (void __user *)(uintptr_t)cmd.metadata, cmd.metadata, ++ (void __user *)(uintptr_t)cmd.metadata, cmd.metadata_len, + 0, &cmd.result, timeout); + nvme_passthru_end(ctrl, effects); + +@@ -3110,7 +3122,7 @@ static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl, + + down_write(&ctrl->namespaces_rwsem); + list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) { +- if (ns->head->ns_id > nsid) ++ if (ns->head->ns_id > nsid || test_bit(NVME_NS_DEAD, &ns->flags)) + list_move_tail(&ns->list, &rm_list); + } + up_write(&ctrl->namespaces_rwsem); +@@ -3488,19 +3500,9 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl) + if (ctrl->admin_q) + blk_mq_unquiesce_queue(ctrl->admin_q); + +- list_for_each_entry(ns, &ctrl->namespaces, list) { +- /* +- * Revalidating a dead namespace sets capacity to 0. This will +- * end buffered writers dirtying pages that can't be synced. +- */ +- if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags)) +- continue; +- revalidate_disk(ns->disk); +- blk_set_queue_dying(ns->queue); ++ list_for_each_entry(ns, &ctrl->namespaces, list) ++ nvme_set_queue_dying(ns); + +- /* Forcibly unquiesce queues to avoid blocking dispatch */ +- blk_mq_unquiesce_queue(ns->queue); +- } + up_read(&ctrl->namespaces_rwsem); + } + EXPORT_SYMBOL_GPL(nvme_kill_queues); +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 0483c33a3567..de9c3762a994 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2291,6 +2291,7 @@ static void nvme_remove_dead_ctrl(struct nvme_dev *dev, int status) + + nvme_get_ctrl(&dev->ctrl); + nvme_dev_disable(dev, false); ++ nvme_kill_queues(&dev->ctrl); + if (!queue_work(nvme_wq, &dev->remove_work)) + nvme_put_ctrl(&dev->ctrl); + } +@@ -2407,7 +2408,6 @@ static void nvme_remove_dead_ctrl_work(struct work_struct *work) + struct nvme_dev *dev = container_of(work, struct nvme_dev, remove_work); + struct pci_dev *pdev = to_pci_dev(dev->dev); + +- nvme_kill_queues(&dev->ctrl); + if (pci_get_drvdata(pdev)) + device_release_driver(&pdev->dev); + nvme_put_ctrl(&dev->ctrl); +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 2181299ce8f5..d1e8aa04d313 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -734,7 +734,6 @@ out: + static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, + bool remove) + { +- nvme_rdma_stop_queue(&ctrl->queues[0]); + if (remove) { + blk_cleanup_queue(ctrl->ctrl.admin_q); + nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); +@@ -819,7 +818,6 @@ out_free_queue: + static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl, + bool remove) + { +- nvme_rdma_stop_io_queues(ctrl); + if (remove) { + blk_cleanup_queue(ctrl->ctrl.connect_q); + nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); +@@ -888,9 +886,9 @@ static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl) + list_del(&ctrl->list); + mutex_unlock(&nvme_rdma_ctrl_mutex); + +- kfree(ctrl->queues); + nvmf_free_options(nctrl->opts); + free_ctrl: ++ kfree(ctrl->queues); + kfree(ctrl); + } + +@@ -949,6 +947,7 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work) + return; + + destroy_admin: ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + nvme_rdma_destroy_admin_queue(ctrl, false); + requeue: + dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n", +@@ -965,12 +964,14 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work) + + if (ctrl->ctrl.queue_count > 1) { + nvme_stop_queues(&ctrl->ctrl); ++ nvme_rdma_stop_io_queues(ctrl); + blk_mq_tagset_busy_iter(&ctrl->tag_set, + nvme_cancel_request, &ctrl->ctrl); + nvme_rdma_destroy_io_queues(ctrl, false); + } + + blk_mq_quiesce_queue(ctrl->ctrl.admin_q); ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + blk_mq_tagset_busy_iter(&ctrl->admin_tag_set, + nvme_cancel_request, &ctrl->ctrl); + nvme_rdma_destroy_admin_queue(ctrl, false); +@@ -1720,6 +1721,7 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl, bool shutdown) + { + if (ctrl->ctrl.queue_count > 1) { + nvme_stop_queues(&ctrl->ctrl); ++ nvme_rdma_stop_io_queues(ctrl); + blk_mq_tagset_busy_iter(&ctrl->tag_set, + nvme_cancel_request, &ctrl->ctrl); + nvme_rdma_destroy_io_queues(ctrl, shutdown); +@@ -1731,6 +1733,7 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl, bool shutdown) + nvme_disable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap); + + blk_mq_quiesce_queue(ctrl->ctrl.admin_q); ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + blk_mq_tagset_busy_iter(&ctrl->admin_tag_set, + nvme_cancel_request, &ctrl->ctrl); + blk_mq_unquiesce_queue(ctrl->ctrl.admin_q); +@@ -1916,11 +1919,6 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev, + goto out_free_ctrl; + } + +- ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops, +- 0 /* no quirks, we're perfect! */); +- if (ret) +- goto out_free_ctrl; +- + INIT_DELAYED_WORK(&ctrl->reconnect_work, + nvme_rdma_reconnect_ctrl_work); + INIT_WORK(&ctrl->err_work, nvme_rdma_error_recovery_work); +@@ -1934,14 +1932,19 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev, + ctrl->queues = kcalloc(ctrl->ctrl.queue_count, sizeof(*ctrl->queues), + GFP_KERNEL); + if (!ctrl->queues) +- goto out_uninit_ctrl; ++ goto out_free_ctrl; ++ ++ ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops, ++ 0 /* no quirks, we're perfect! */); ++ if (ret) ++ goto out_kfree_queues; + + changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING); + WARN_ON_ONCE(!changed); + + ret = nvme_rdma_configure_admin_queue(ctrl, true); + if (ret) +- goto out_kfree_queues; ++ goto out_uninit_ctrl; + + /* sanity check icdoff */ + if (ctrl->ctrl.icdoff) { +@@ -1996,15 +1999,16 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev, + return &ctrl->ctrl; + + out_remove_admin_queue: ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + nvme_rdma_destroy_admin_queue(ctrl, true); +-out_kfree_queues: +- kfree(ctrl->queues); + out_uninit_ctrl: + nvme_uninit_ctrl(&ctrl->ctrl); + nvme_put_ctrl(&ctrl->ctrl); + if (ret > 0) + ret = -EIO; + return ERR_PTR(ret); ++out_kfree_queues: ++ kfree(ctrl->queues); + out_free_ctrl: + kfree(ctrl); + return ERR_PTR(ret); +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index e95424f172fd..0547d5f7d3ba 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -624,6 +624,14 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl) + } + + ctrl->csts = NVME_CSTS_RDY; ++ ++ /* ++ * Controllers that are not yet enabled should not really enforce the ++ * keep alive timeout, but we still want to track a timeout and cleanup ++ * in case a host died before it enabled the controller. Hence, simply ++ * reset the keep alive timer when the controller is enabled. ++ */ ++ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); + } + + static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl) +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index 1e28597138c8..2d23479b9053 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -924,6 +924,10 @@ struct nvmem_cell *nvmem_cell_get(struct device *dev, const char *cell_id) + return cell; + } + ++ /* NULL cell_id only allowed for device tree; invalid otherwise */ ++ if (!cell_id) ++ return ERR_PTR(-EINVAL); ++ + return nvmem_cell_get_from_list(cell_id); + } + EXPORT_SYMBOL_GPL(nvmem_cell_get); +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 848f549164cd..466e3c8582f0 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -102,7 +102,7 @@ static u32 phandle_cache_mask; + * - the phandle lookup overhead reduction provided by the cache + * will likely be less + */ +-static void of_populate_phandle_cache(void) ++void of_populate_phandle_cache(void) + { + unsigned long flags; + u32 cache_entries; +@@ -134,8 +134,7 @@ out: + raw_spin_unlock_irqrestore(&devtree_lock, flags); + } + +-#ifndef CONFIG_MODULES +-static int __init of_free_phandle_cache(void) ++int of_free_phandle_cache(void) + { + unsigned long flags; + +@@ -148,6 +147,7 @@ static int __init of_free_phandle_cache(void) + + return 0; + } ++#if !defined(CONFIG_MODULES) + late_initcall_sync(of_free_phandle_cache); + #endif + +diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h +index 891d780c076a..216175d11d3d 100644 +--- a/drivers/of/of_private.h ++++ b/drivers/of/of_private.h +@@ -79,6 +79,8 @@ int of_resolve_phandles(struct device_node *tree); + #if defined(CONFIG_OF_OVERLAY) + void of_overlay_mutex_lock(void); + void of_overlay_mutex_unlock(void); ++int of_free_phandle_cache(void); ++void of_populate_phandle_cache(void); + #else + static inline void of_overlay_mutex_lock(void) {}; + static inline void of_overlay_mutex_unlock(void) {}; +diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c +index 7baa53e5b1d7..eda57ef12fd0 100644 +--- a/drivers/of/overlay.c ++++ b/drivers/of/overlay.c +@@ -804,6 +804,8 @@ static int of_overlay_apply(const void *fdt, struct device_node *tree, + goto err_free_overlay_changeset; + } + ++ of_populate_phandle_cache(); ++ + ret = __of_changeset_apply_notify(&ovcs->cset); + if (ret) + pr_err("overlay changeset entry notify error %d\n", ret); +@@ -1046,8 +1048,17 @@ int of_overlay_remove(int *ovcs_id) + + list_del(&ovcs->ovcs_list); + ++ /* ++ * Disable phandle cache. Avoids race condition that would arise ++ * from removing cache entry when the associated node is deleted. ++ */ ++ of_free_phandle_cache(); ++ + ret_apply = 0; + ret = __of_changeset_revert_entries(&ovcs->cset, &ret_apply); ++ ++ of_populate_phandle_cache(); ++ + if (ret) { + if (ret_apply) + devicetree_state_flags |= DTSF_REVERT_FAIL; +diff --git a/drivers/pci/dwc/pcie-designware-host.c b/drivers/pci/dwc/pcie-designware-host.c +index 6c409079d514..35a2df4ddf20 100644 +--- a/drivers/pci/dwc/pcie-designware-host.c ++++ b/drivers/pci/dwc/pcie-designware-host.c +@@ -355,7 +355,8 @@ int dw_pcie_host_init(struct pcie_port *pp) + resource_list_for_each_entry_safe(win, tmp, &bridge->windows) { + switch (resource_type(win->res)) { + case IORESOURCE_IO: +- ret = pci_remap_iospace(win->res, pp->io_base); ++ ret = devm_pci_remap_iospace(dev, win->res, ++ pp->io_base); + if (ret) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + ret, win->res); +diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c +index 9abf549631b4..d0867a311f42 100644 +--- a/drivers/pci/host/pci-aardvark.c ++++ b/drivers/pci/host/pci-aardvark.c +@@ -848,7 +848,7 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie) + 0, 0xF8000000, 0, + lower_32_bits(res->start), + OB_PCIE_IO); +- err = pci_remap_iospace(res, iobase); ++ err = devm_pci_remap_iospace(dev, res, iobase); + if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); +diff --git a/drivers/pci/host/pci-ftpci100.c b/drivers/pci/host/pci-ftpci100.c +index 5008fd87956a..0e966219d66d 100644 +--- a/drivers/pci/host/pci-ftpci100.c ++++ b/drivers/pci/host/pci-ftpci100.c +@@ -353,11 +353,13 @@ static int faraday_pci_setup_cascaded_irq(struct faraday_pci *p) + irq = of_irq_get(intc, 0); + if (irq <= 0) { + dev_err(p->dev, "failed to get parent IRQ\n"); ++ of_node_put(intc); + return irq ?: -EINVAL; + } + + p->irqdomain = irq_domain_add_linear(intc, PCI_NUM_INTX, + &faraday_pci_irqdomain_ops, p); ++ of_node_put(intc); + if (!p->irqdomain) { + dev_err(p->dev, "failed to create Gemini PCI IRQ domain\n"); + return -EINVAL; +@@ -499,7 +501,7 @@ static int faraday_pci_probe(struct platform_device *pdev) + dev_err(dev, "illegal IO mem size\n"); + return -EINVAL; + } +- ret = pci_remap_iospace(io, io_base); ++ ret = devm_pci_remap_iospace(dev, io, io_base); + if (ret) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + ret, io); +diff --git a/drivers/pci/host/pci-v3-semi.c b/drivers/pci/host/pci-v3-semi.c +index 0a4dea796663..3381bf29b59f 100644 +--- a/drivers/pci/host/pci-v3-semi.c ++++ b/drivers/pci/host/pci-v3-semi.c +@@ -535,7 +535,7 @@ static int v3_pci_setup_resource(struct v3_pci *v3, + v3->io_bus_addr = io->start - win->offset; + dev_dbg(dev, "I/O window %pR, bus addr %pap\n", + io, &v3->io_bus_addr); +- ret = pci_remap_iospace(io, io_base); ++ ret = devm_pci_remap_iospace(dev, io, io_base); + if (ret) { + dev_warn(dev, + "error %d: failed to map resource %pR\n", +diff --git a/drivers/pci/host/pci-versatile.c b/drivers/pci/host/pci-versatile.c +index 5b3876f5312b..df9408c4873a 100644 +--- a/drivers/pci/host/pci-versatile.c ++++ b/drivers/pci/host/pci-versatile.c +@@ -81,7 +81,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev, + + switch (resource_type(res)) { + case IORESOURCE_IO: +- err = pci_remap_iospace(res, iobase); ++ err = devm_pci_remap_iospace(dev, res, iobase); + if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); +diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c +index 0a0d7ee6d3c9..e256d94cafb3 100644 +--- a/drivers/pci/host/pci-xgene.c ++++ b/drivers/pci/host/pci-xgene.c +@@ -421,7 +421,7 @@ static int xgene_pcie_map_ranges(struct xgene_pcie_port *port, + case IORESOURCE_IO: + xgene_pcie_setup_ob_reg(port, res, OMR3BARL, io_base, + res->start - window->offset); +- ret = pci_remap_iospace(res, io_base); ++ ret = devm_pci_remap_iospace(dev, res, io_base); + if (ret < 0) + return ret; + break; +diff --git a/drivers/pci/host/pcie-mediatek.c b/drivers/pci/host/pcie-mediatek.c +index a8b20c5012a9..35e9fd028da4 100644 +--- a/drivers/pci/host/pcie-mediatek.c ++++ b/drivers/pci/host/pcie-mediatek.c +@@ -1063,7 +1063,7 @@ static int mtk_pcie_request_resources(struct mtk_pcie *pcie) + if (err < 0) + return err; + +- pci_remap_iospace(&pcie->pio, pcie->io.start); ++ devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start); + + return 0; + } +diff --git a/drivers/pci/host/pcie-xilinx-nwl.c b/drivers/pci/host/pcie-xilinx-nwl.c +index 4839ae578711..62545e510389 100644 +--- a/drivers/pci/host/pcie-xilinx-nwl.c ++++ b/drivers/pci/host/pcie-xilinx-nwl.c +@@ -557,7 +557,7 @@ static int nwl_pcie_init_irq_domain(struct nwl_pcie *pcie) + PCI_NUM_INTX, + &legacy_domain_ops, + pcie); +- ++ of_node_put(legacy_intc_node); + if (!pcie->legacy_irq_domain) { + dev_err(dev, "failed to create IRQ domain\n"); + return -ENOMEM; +diff --git a/drivers/pci/host/pcie-xilinx.c b/drivers/pci/host/pcie-xilinx.c +index 0ad188effc09..fd9c73dd347b 100644 +--- a/drivers/pci/host/pcie-xilinx.c ++++ b/drivers/pci/host/pcie-xilinx.c +@@ -507,6 +507,7 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie_port *port) + port->leg_domain = irq_domain_add_linear(pcie_intc_node, PCI_NUM_INTX, + &intx_domain_ops, + port); ++ of_node_put(pcie_intc_node); + if (!port->leg_domain) { + dev_err(dev, "Failed to get a INTx IRQ domain\n"); + return -ENODEV; +diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c +index af92fed46ab7..fd93783a87b0 100644 +--- a/drivers/pci/hotplug/pci_hotplug_core.c ++++ b/drivers/pci/hotplug/pci_hotplug_core.c +@@ -438,8 +438,17 @@ int __pci_hp_register(struct hotplug_slot *slot, struct pci_bus *bus, + list_add(&slot->slot_list, &pci_hotplug_slot_list); + + result = fs_add_slot(pci_slot); ++ if (result) ++ goto err_list_del; ++ + kobject_uevent(&pci_slot->kobj, KOBJ_ADD); + dbg("Added slot %s to the list\n", name); ++ goto out; ++ ++err_list_del: ++ list_del(&slot->slot_list); ++ pci_slot->hotplug = NULL; ++ pci_destroy_slot(pci_slot); + out: + mutex_unlock(&pci_hp_mutex); + return result; +diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h +index 5f892065585e..fca87a1a2b22 100644 +--- a/drivers/pci/hotplug/pciehp.h ++++ b/drivers/pci/hotplug/pciehp.h +@@ -119,6 +119,7 @@ int pciehp_unconfigure_device(struct slot *p_slot); + void pciehp_queue_pushbutton_work(struct work_struct *work); + struct controller *pcie_init(struct pcie_device *dev); + int pcie_init_notification(struct controller *ctrl); ++void pcie_shutdown_notification(struct controller *ctrl); + int pciehp_enable_slot(struct slot *p_slot); + int pciehp_disable_slot(struct slot *p_slot); + void pcie_reenable_notification(struct controller *ctrl); +diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c +index 44a6a63802d5..2ba59fc94827 100644 +--- a/drivers/pci/hotplug/pciehp_core.c ++++ b/drivers/pci/hotplug/pciehp_core.c +@@ -62,6 +62,12 @@ static int reset_slot(struct hotplug_slot *slot, int probe); + */ + static void release_slot(struct hotplug_slot *hotplug_slot) + { ++ struct slot *slot = hotplug_slot->private; ++ ++ /* queued work needs hotplug_slot name */ ++ cancel_delayed_work(&slot->work); ++ drain_workqueue(slot->wq); ++ + kfree(hotplug_slot->ops); + kfree(hotplug_slot->info); + kfree(hotplug_slot); +@@ -264,6 +270,7 @@ static void pciehp_remove(struct pcie_device *dev) + { + struct controller *ctrl = get_service_data(dev); + ++ pcie_shutdown_notification(ctrl); + cleanup_slot(ctrl); + pciehp_release_ctrl(ctrl); + } +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 98ea75aa32c7..6635ae13962f 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -545,8 +545,6 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id) + { + struct controller *ctrl = (struct controller *)dev_id; + struct pci_dev *pdev = ctrl_dev(ctrl); +- struct pci_bus *subordinate = pdev->subordinate; +- struct pci_dev *dev; + struct slot *slot = ctrl->slot; + u16 status, events; + u8 present; +@@ -594,14 +592,9 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id) + wake_up(&ctrl->queue); + } + +- if (subordinate) { +- list_for_each_entry(dev, &subordinate->devices, bus_list) { +- if (dev->ignore_hotplug) { +- ctrl_dbg(ctrl, "ignoring hotplug event %#06x (%s requested no hotplug)\n", +- events, pci_name(dev)); +- return IRQ_HANDLED; +- } +- } ++ if (pdev->ignore_hotplug) { ++ ctrl_dbg(ctrl, "ignoring hotplug event %#06x\n", events); ++ return IRQ_HANDLED; + } + + /* Check Attention Button Pressed */ +@@ -771,7 +764,7 @@ int pcie_init_notification(struct controller *ctrl) + return 0; + } + +-static void pcie_shutdown_notification(struct controller *ctrl) ++void pcie_shutdown_notification(struct controller *ctrl) + { + if (ctrl->notification_enabled) { + pcie_disable_notification(ctrl); +@@ -806,7 +799,7 @@ abort: + static void pcie_cleanup_slot(struct controller *ctrl) + { + struct slot *slot = ctrl->slot; +- cancel_delayed_work(&slot->work); ++ + destroy_workqueue(slot->wq); + kfree(slot); + } +@@ -898,7 +891,6 @@ abort: + + void pciehp_release_ctrl(struct controller *ctrl) + { +- pcie_shutdown_notification(ctrl); + pcie_cleanup_slot(ctrl); + kfree(ctrl); + } +diff --git a/drivers/pci/of.c b/drivers/pci/of.c +index a28355c273ae..f8bcfe209464 100644 +--- a/drivers/pci/of.c ++++ b/drivers/pci/of.c +@@ -617,7 +617,7 @@ int pci_parse_request_of_pci_ranges(struct device *dev, + + switch (resource_type(res)) { + case IORESOURCE_IO: +- err = pci_remap_iospace(res, iobase); ++ err = devm_pci_remap_iospace(dev, res, iobase); + if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); +diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c +index 054974055ea4..41d24b273d6f 100644 +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -601,13 +601,11 @@ static bool acpi_pci_need_resume(struct pci_dev *dev) + /* + * In some cases (eg. Samsung 305V4A) leaving a bridge in suspend over + * system-wide suspend/resume confuses the platform firmware, so avoid +- * doing that, unless the bridge has a driver that should take care of +- * the PM handling. According to Section 16.1.6 of ACPI 6.2, endpoint ++ * doing that. According to Section 16.1.6 of ACPI 6.2, endpoint + * devices are expected to be in D3 before invoking the S3 entry path + * from the firmware, so they should not be affected by this issue. + */ +- if (pci_is_bridge(dev) && !dev->driver && +- acpi_target_system_state() != ACPI_STATE_S0) ++ if (pci_is_bridge(dev) && acpi_target_system_state() != ACPI_STATE_S0) + return true; + + if (!adev || !acpi_device_power_manageable(adev)) +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index dbfe7c4f3776..04ce05f9c2cb 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1163,6 +1163,33 @@ static void pci_restore_config_space(struct pci_dev *pdev) + } + } + ++static void pci_restore_rebar_state(struct pci_dev *pdev) ++{ ++ unsigned int pos, nbars, i; ++ u32 ctrl; ++ ++ pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_REBAR); ++ if (!pos) ++ return; ++ ++ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl); ++ nbars = (ctrl & PCI_REBAR_CTRL_NBAR_MASK) >> ++ PCI_REBAR_CTRL_NBAR_SHIFT; ++ ++ for (i = 0; i < nbars; i++, pos += 8) { ++ struct resource *res; ++ int bar_idx, size; ++ ++ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl); ++ bar_idx = ctrl & PCI_REBAR_CTRL_BAR_IDX; ++ res = pdev->resource + bar_idx; ++ size = order_base_2((resource_size(res) >> 20) | 1) - 1; ++ ctrl &= ~PCI_REBAR_CTRL_BAR_SIZE; ++ ctrl |= size << 8; ++ pci_write_config_dword(pdev, pos + PCI_REBAR_CTRL, ctrl); ++ } ++} ++ + /** + * pci_restore_state - Restore the saved state of a PCI device + * @dev: - PCI device that we're dealing with +@@ -1178,6 +1205,7 @@ void pci_restore_state(struct pci_dev *dev) + pci_restore_pri_state(dev); + pci_restore_ats_state(dev); + pci_restore_vc_state(dev); ++ pci_restore_rebar_state(dev); + + pci_cleanup_aer_error_status_regs(dev); + +@@ -3573,6 +3601,44 @@ void pci_unmap_iospace(struct resource *res) + } + EXPORT_SYMBOL(pci_unmap_iospace); + ++static void devm_pci_unmap_iospace(struct device *dev, void *ptr) ++{ ++ struct resource **res = ptr; ++ ++ pci_unmap_iospace(*res); ++} ++ ++/** ++ * devm_pci_remap_iospace - Managed pci_remap_iospace() ++ * @dev: Generic device to remap IO address for ++ * @res: Resource describing the I/O space ++ * @phys_addr: physical address of range to be mapped ++ * ++ * Managed pci_remap_iospace(). Map is automatically unmapped on driver ++ * detach. ++ */ ++int devm_pci_remap_iospace(struct device *dev, const struct resource *res, ++ phys_addr_t phys_addr) ++{ ++ const struct resource **ptr; ++ int error; ++ ++ ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL); ++ if (!ptr) ++ return -ENOMEM; ++ ++ error = pci_remap_iospace(res, phys_addr); ++ if (error) { ++ devres_free(ptr); ++ } else { ++ *ptr = res; ++ devres_add(dev, ptr); ++ } ++ ++ return error; ++} ++EXPORT_SYMBOL(devm_pci_remap_iospace); ++ + /** + * devm_pci_remap_cfgspace - Managed pci_remap_cfgspace() + * @dev: Generic device to remap IO address for +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index d21686ad3ce5..979fd599fc66 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1677,6 +1677,10 @@ static void pci_configure_mps(struct pci_dev *dev) + if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge)) + return; + ++ /* MPS and MRRS fields are of type 'RsvdP' for VFs, short-circuit out */ ++ if (dev->is_virtfn) ++ return; ++ + mps = pcie_get_mps(dev); + p_mps = pcie_get_mps(bridge); + +diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c +index 6bdb1dad805f..0e31f1392a53 100644 +--- a/drivers/perf/xgene_pmu.c ++++ b/drivers/perf/xgene_pmu.c +@@ -1463,7 +1463,7 @@ static char *xgene_pmu_dev_name(struct device *dev, u32 type, int id) + case PMU_TYPE_IOB: + return devm_kasprintf(dev, GFP_KERNEL, "iob%d", id); + case PMU_TYPE_IOB_SLOW: +- return devm_kasprintf(dev, GFP_KERNEL, "iob-slow%d", id); ++ return devm_kasprintf(dev, GFP_KERNEL, "iob_slow%d", id); + case PMU_TYPE_MCB: + return devm_kasprintf(dev, GFP_KERNEL, "mcb%d", id); + case PMU_TYPE_MC: +diff --git a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c +index 35c17653c694..87618a4e90e4 100644 +--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c ++++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c +@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinctrl_dev *pctrl_dev, + const struct nsp_pin_function *func; + const struct nsp_pin_group *grp; + +- if (grp_select > pinctrl->num_groups || +- func_select > pinctrl->num_functions) ++ if (grp_select >= pinctrl->num_groups || ++ func_select >= pinctrl->num_functions) + return -EINVAL; + + func = &pinctrl->functions[func_select]; +@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platform_device *pdev) + return PTR_ERR(pinctrl->base0); + + res = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ if (!res) ++ return -EINVAL; + pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start, + resource_size(res)); + if (!pinctrl->base1) { +diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c +index ac38a3f9f86b..4699b55a0990 100644 +--- a/drivers/pinctrl/pinctrl-ingenic.c ++++ b/drivers/pinctrl/pinctrl-ingenic.c +@@ -536,7 +536,7 @@ static int ingenic_pinmux_gpio_set_direction(struct pinctrl_dev *pctldev, + ingenic_config_pin(jzpc, pin, JZ4770_GPIO_PAT1, input); + } else { + ingenic_config_pin(jzpc, pin, JZ4740_GPIO_SELECT, false); +- ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, input); ++ ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, !input); + ingenic_config_pin(jzpc, pin, JZ4740_GPIO_FUNC, false); + } + +diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c +index c52c6723374b..d3f4b6e91f49 100644 +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -2170,7 +2170,7 @@ static int __init dell_init(void) + dell_fill_request(&buffer, token->location, 0, 0, 0); + ret = dell_send_request(&buffer, + CLASS_TOKEN_READ, SELECT_TOKEN_AC); +- if (ret) ++ if (ret == 0) + max_intensity = buffer.output[3]; + } + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 6d4012dd6922..bac1eeb3d312 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -265,8 +265,10 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + return err; + + /* full-function RTCs won't have such missing fields */ +- if (rtc_valid_tm(&alarm->time) == 0) ++ if (rtc_valid_tm(&alarm->time) == 0) { ++ rtc_add_offset(rtc, &alarm->time); + return 0; ++ } + + /* get the "after" timestamp, to detect wrapped fields */ + err = rtc_read_time(rtc, &now); +@@ -409,7 +411,6 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + if (err) + return err; + +- rtc_subtract_offset(rtc, &alarm->time); + scheduled = rtc_tm_to_time64(&alarm->time); + + /* Make sure we're not setting alarms in the past */ +@@ -426,6 +427,8 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + * over right here, before we set the alarm. + */ + ++ rtc_subtract_offset(rtc, &alarm->time); ++ + if (!rtc->ops) + err = -ENODEV; + else if (!rtc->ops->set_alarm) +@@ -467,7 +470,6 @@ int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + + mutex_unlock(&rtc->ops_lock); + +- rtc_add_offset(rtc, &alarm->time); + return err; + } + EXPORT_SYMBOL_GPL(rtc_set_alarm); +diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c +index ea6a2d0b2894..770fa9cfc310 100644 +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -177,6 +177,7 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process) + { + struct vfio_ccw_private *private = dev_get_drvdata(&sch->dev); + unsigned long flags; ++ int rc = -EAGAIN; + + spin_lock_irqsave(sch->lock, flags); + if (!device_is_registered(&sch->dev)) +@@ -187,6 +188,7 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process) + + if (cio_update_schib(sch)) { + vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); ++ rc = 0; + goto out_unlock; + } + +@@ -195,11 +197,12 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process) + private->state = private->mdev ? VFIO_CCW_STATE_IDLE : + VFIO_CCW_STATE_STANDBY; + } ++ rc = 0; + + out_unlock: + spin_unlock_irqrestore(sch->lock, flags); + +- return 0; ++ return rc; + } + + static struct css_device_id vfio_ccw_sch_ids[] = { +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index b7f75339683e..a05c53a44973 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -1003,7 +1003,7 @@ struct qeth_cmd_buffer *qeth_get_setassparms_cmd(struct qeth_card *, + __u16, __u16, + enum qeth_prot_versions); + int qeth_set_features(struct net_device *, netdev_features_t); +-void qeth_recover_features(struct net_device *dev); ++void qeth_enable_hw_features(struct net_device *dev); + netdev_features_t qeth_fix_features(struct net_device *, netdev_features_t); + netdev_features_t qeth_features_check(struct sk_buff *skb, + struct net_device *dev, +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index b2eebcffd502..32075de2f1e5 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -6432,28 +6432,27 @@ static int qeth_set_ipa_tso(struct qeth_card *card, int on) + #define QETH_HW_FEATURES (NETIF_F_RXCSUM | NETIF_F_IP_CSUM | NETIF_F_TSO) + + /** +- * qeth_recover_features() - Restore device features after recovery +- * @dev: the recovering net_device +- * +- * Caller must hold rtnl lock. ++ * qeth_enable_hw_features() - (Re-)Enable HW functions for device features ++ * @dev: a net_device + */ +-void qeth_recover_features(struct net_device *dev) ++void qeth_enable_hw_features(struct net_device *dev) + { +- netdev_features_t features = dev->features; + struct qeth_card *card = dev->ml_priv; ++ netdev_features_t features; + ++ rtnl_lock(); ++ features = dev->features; + /* force-off any feature that needs an IPA sequence. + * netdev_update_features() will restart them. + */ + dev->features &= ~QETH_HW_FEATURES; + netdev_update_features(dev); +- +- if (features == dev->features) +- return; +- dev_warn(&card->gdev->dev, +- "Device recovery failed to restore all offload features\n"); ++ if (features != dev->features) ++ dev_warn(&card->gdev->dev, ++ "Device recovery failed to restore all offload features\n"); ++ rtnl_unlock(); + } +-EXPORT_SYMBOL_GPL(qeth_recover_features); ++EXPORT_SYMBOL_GPL(qeth_enable_hw_features); + + int qeth_set_features(struct net_device *dev, netdev_features_t features) + { +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 16dc8b83ca6f..525c82ba923c 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -1130,6 +1130,8 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode) + netif_carrier_off(card->dev); + + qeth_set_allowed_threads(card, 0xffffffff, 0); ++ ++ qeth_enable_hw_features(card->dev); + if (recover_flag == CARD_STATE_RECOVER) { + if (recovery_mode && + card->info.type != QETH_CARD_TYPE_OSN) { +@@ -1141,9 +1143,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode) + } + /* this also sets saved unicast addresses */ + qeth_l2_set_rx_mode(card->dev); +- rtnl_lock(); +- qeth_recover_features(card->dev); +- rtnl_unlock(); + } + /* let user_space know that device is online */ + kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE); +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index c1a16a74aa83..8de498befde2 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -2792,6 +2792,8 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode) + netif_carrier_on(card->dev); + else + netif_carrier_off(card->dev); ++ ++ qeth_enable_hw_features(card->dev); + if (recover_flag == CARD_STATE_RECOVER) { + rtnl_lock(); + if (recovery_mode) +@@ -2799,7 +2801,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode) + else + dev_open(card->dev); + qeth_l3_set_rx_mode(card->dev); +- qeth_recover_features(card->dev); + rtnl_unlock(); + } + qeth_trace_features(card); +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index b92f86acb8bb..d37e8dd538f2 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -3438,11 +3438,11 @@ static void hpsa_get_enclosure_info(struct ctlr_info *h, + struct ext_report_lun_entry *rle = &rlep->LUN[rle_index]; + u16 bmic_device_index = 0; + +- bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]); +- +- encl_dev->sas_address = ++ encl_dev->eli = + hpsa_get_enclosure_logical_identifier(h, scsi3addr); + ++ bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]); ++ + if (encl_dev->target == -1 || encl_dev->lun == -1) { + rc = IO_OK; + goto out; +@@ -9695,7 +9695,24 @@ hpsa_sas_get_linkerrors(struct sas_phy *phy) + static int + hpsa_sas_get_enclosure_identifier(struct sas_rphy *rphy, u64 *identifier) + { +- *identifier = rphy->identify.sas_address; ++ struct Scsi_Host *shost = phy_to_shost(rphy); ++ struct ctlr_info *h; ++ struct hpsa_scsi_dev_t *sd; ++ ++ if (!shost) ++ return -ENXIO; ++ ++ h = shost_to_hba(shost); ++ ++ if (!h) ++ return -ENXIO; ++ ++ sd = hpsa_find_device_by_sas_rphy(h, rphy); ++ if (!sd) ++ return -ENXIO; ++ ++ *identifier = sd->eli; ++ + return 0; + } + +diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h +index fb9f5e7f8209..59e023696fff 100644 +--- a/drivers/scsi/hpsa.h ++++ b/drivers/scsi/hpsa.h +@@ -68,6 +68,7 @@ struct hpsa_scsi_dev_t { + #define RAID_CTLR_LUNID "\0\0\0\0\0\0\0\0" + unsigned char device_id[16]; /* from inquiry pg. 0x83 */ + u64 sas_address; ++ u64 eli; /* from report diags. */ + unsigned char vendor[8]; /* bytes 8-15 of inquiry data */ + unsigned char model[16]; /* bytes 16-31 of inquiry data */ + unsigned char rev; /* byte 2 of inquiry data */ +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 5015b8fbbfc5..b62239b548c4 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -3241,6 +3241,11 @@ static int __qedf_probe(struct pci_dev *pdev, int mode) + + init_completion(&qedf->flogi_compl); + ++ status = qed_ops->common->update_drv_state(qedf->cdev, true); ++ if (status) ++ QEDF_ERR(&(qedf->dbg_ctx), ++ "Failed to send drv state to MFW.\n"); ++ + memset(&link_params, 0, sizeof(struct qed_link_params)); + link_params.link_up = true; + status = qed_ops->common->set_link(qedf->cdev, &link_params); +@@ -3289,6 +3294,7 @@ static int qedf_probe(struct pci_dev *pdev, const struct pci_device_id *id) + static void __qedf_remove(struct pci_dev *pdev, int mode) + { + struct qedf_ctx *qedf; ++ int rc; + + if (!pdev) { + QEDF_ERR(NULL, "pdev is NULL.\n"); +@@ -3383,6 +3389,12 @@ static void __qedf_remove(struct pci_dev *pdev, int mode) + qed_ops->common->set_power_state(qedf->cdev, PCI_D0); + pci_set_drvdata(pdev, NULL); + } ++ ++ rc = qed_ops->common->update_drv_state(qedf->cdev, false); ++ if (rc) ++ QEDF_ERR(&(qedf->dbg_ctx), ++ "Failed to send drv state to MFW.\n"); ++ + qed_ops->common->slowpath_stop(qedf->cdev); + qed_ops->common->remove(qedf->cdev); + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 4da3592aec0f..1e674eb6dd17 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -2075,6 +2075,7 @@ kset_free: + static void __qedi_remove(struct pci_dev *pdev, int mode) + { + struct qedi_ctx *qedi = pci_get_drvdata(pdev); ++ int rval; + + if (qedi->tmf_thread) { + flush_workqueue(qedi->tmf_thread); +@@ -2104,6 +2105,10 @@ static void __qedi_remove(struct pci_dev *pdev, int mode) + if (mode == QEDI_MODE_NORMAL) + qedi_free_iscsi_pf_param(qedi); + ++ rval = qedi_ops->common->update_drv_state(qedi->cdev, false); ++ if (rval) ++ QEDI_ERR(&qedi->dbg_ctx, "Failed to send drv state to MFW\n"); ++ + if (!test_bit(QEDI_IN_OFFLINE, &qedi->flags)) { + qedi_ops->common->slowpath_stop(qedi->cdev); + qedi_ops->common->remove(qedi->cdev); +@@ -2378,6 +2383,12 @@ static int __qedi_probe(struct pci_dev *pdev, int mode) + if (qedi_setup_boot_info(qedi)) + QEDI_ERR(&qedi->dbg_ctx, + "No iSCSI boot target configured\n"); ++ ++ rc = qedi_ops->common->update_drv_state(qedi->cdev, true); ++ if (rc) ++ QEDI_ERR(&qedi->dbg_ctx, ++ "Failed to send drv state to MFW\n"); ++ + } + + return 0; +diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c +index 36f59a1be7e9..61389bdc7926 100644 +--- a/drivers/scsi/xen-scsifront.c ++++ b/drivers/scsi/xen-scsifront.c +@@ -654,10 +654,17 @@ static int scsifront_dev_reset_handler(struct scsi_cmnd *sc) + static int scsifront_sdev_configure(struct scsi_device *sdev) + { + struct vscsifrnt_info *info = shost_priv(sdev->host); ++ int err; + +- if (info && current == info->curr) +- xenbus_printf(XBT_NIL, info->dev->nodename, ++ if (info && current == info->curr) { ++ err = xenbus_printf(XBT_NIL, info->dev->nodename, + info->dev_state_path, "%d", XenbusStateConnected); ++ if (err) { ++ xenbus_dev_error(info->dev, err, ++ "%s: writing dev_state_path", __func__); ++ return err; ++ } ++ } + + return 0; + } +@@ -665,10 +672,15 @@ static int scsifront_sdev_configure(struct scsi_device *sdev) + static void scsifront_sdev_destroy(struct scsi_device *sdev) + { + struct vscsifrnt_info *info = shost_priv(sdev->host); ++ int err; + +- if (info && current == info->curr) +- xenbus_printf(XBT_NIL, info->dev->nodename, ++ if (info && current == info->curr) { ++ err = xenbus_printf(XBT_NIL, info->dev->nodename, + info->dev_state_path, "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing dev_state_path", __func__); ++ } + } + + static struct scsi_host_template scsifront_sht = { +@@ -1003,9 +1015,12 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op) + + if (scsi_add_device(info->host, chn, tgt, lun)) { + dev_err(&dev->dev, "scsi_add_device\n"); +- xenbus_printf(XBT_NIL, dev->nodename, ++ err = xenbus_printf(XBT_NIL, dev->nodename, + info->dev_state_path, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(dev, err, ++ "%s: writing dev_state_path", __func__); + } + break; + case VSCSIFRONT_OP_DEL_LUN: +@@ -1019,10 +1034,14 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op) + } + break; + case VSCSIFRONT_OP_READD_LUN: +- if (device_state == XenbusStateConnected) +- xenbus_printf(XBT_NIL, dev->nodename, ++ if (device_state == XenbusStateConnected) { ++ err = xenbus_printf(XBT_NIL, dev->nodename, + info->dev_state_path, + "%d", XenbusStateConnected); ++ if (err) ++ xenbus_dev_error(dev, err, ++ "%s: writing dev_state_path", __func__); ++ } + break; + default: + break; +diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c +index c4d35f32af8d..f86f0ebab06a 100644 +--- a/drivers/soc/imx/gpc.c ++++ b/drivers/soc/imx/gpc.c +@@ -27,9 +27,16 @@ + #define GPC_PGC_SW2ISO_SHIFT 0x8 + #define GPC_PGC_SW_SHIFT 0x0 + ++#define GPC_PGC_PCI_PDN 0x200 ++#define GPC_PGC_PCI_SR 0x20c ++ + #define GPC_PGC_GPU_PDN 0x260 + #define GPC_PGC_GPU_PUPSCR 0x264 + #define GPC_PGC_GPU_PDNSCR 0x268 ++#define GPC_PGC_GPU_SR 0x26c ++ ++#define GPC_PGC_DISP_PDN 0x240 ++#define GPC_PGC_DISP_SR 0x24c + + #define GPU_VPU_PUP_REQ BIT(1) + #define GPU_VPU_PDN_REQ BIT(0) +@@ -318,10 +325,24 @@ static const struct of_device_id imx_gpc_dt_ids[] = { + { } + }; + ++static const struct regmap_range yes_ranges[] = { ++ regmap_reg_range(GPC_CNTR, GPC_CNTR), ++ regmap_reg_range(GPC_PGC_PCI_PDN, GPC_PGC_PCI_SR), ++ regmap_reg_range(GPC_PGC_GPU_PDN, GPC_PGC_GPU_SR), ++ regmap_reg_range(GPC_PGC_DISP_PDN, GPC_PGC_DISP_SR), ++}; ++ ++static const struct regmap_access_table access_table = { ++ .yes_ranges = yes_ranges, ++ .n_yes_ranges = ARRAY_SIZE(yes_ranges), ++}; ++ + static const struct regmap_config imx_gpc_regmap_config = { + .reg_bits = 32, + .val_bits = 32, + .reg_stride = 4, ++ .rd_table = &access_table, ++ .wr_table = &access_table, + .max_register = 0x2ac, + }; + +diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c +index f4e3bd40c72e..6ef18cf8f243 100644 +--- a/drivers/soc/imx/gpcv2.c ++++ b/drivers/soc/imx/gpcv2.c +@@ -39,10 +39,15 @@ + + #define GPC_M4_PU_PDN_FLG 0x1bc + +- +-#define PGC_MIPI 4 +-#define PGC_PCIE 5 +-#define PGC_USB_HSIC 8 ++/* ++ * The PGC offset values in Reference Manual ++ * (Rev. 1, 01/2018 and the older ones) GPC chapter's ++ * GPC_PGC memory map are incorrect, below offset ++ * values are from design RTL. ++ */ ++#define PGC_MIPI 16 ++#define PGC_PCIE 17 ++#define PGC_USB_HSIC 20 + #define GPC_PGC_CTRL(n) (0x800 + (n) * 0x40) + #define GPC_PGC_SR(n) (GPC_PGC_CTRL(n) + 0xc) + +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c +index b0e2c4847a5d..678406e0948b 100644 +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -625,7 +625,7 @@ int ptm_open_peer(struct file *master, struct tty_struct *tty, int flags) + if (tty->driver != ptm_driver) + return -EIO; + +- fd = get_unused_fd_flags(0); ++ fd = get_unused_fd_flags(flags); + if (fd < 0) { + retval = fd; + goto err; +diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c +index af45aa3222b5..4638d9b066be 100644 +--- a/drivers/usb/chipidea/host.c ++++ b/drivers/usb/chipidea/host.c +@@ -124,8 +124,11 @@ static int host_start(struct ci_hdrc *ci) + + hcd->power_budget = ci->platdata->power_budget; + hcd->tpl_support = ci->platdata->tpl_support; +- if (ci->phy || ci->usb_phy) ++ if (ci->phy || ci->usb_phy) { + hcd->skip_phy_initialization = 1; ++ if (ci->usb_phy) ++ hcd->usb_phy = ci->usb_phy; ++ } + + ehci = hcd_to_ehci(hcd); + ehci->caps = ci->hw_bank.cap; +diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h +index a666e0758a99..143309341e11 100644 +--- a/drivers/usb/dwc2/core.h ++++ b/drivers/usb/dwc2/core.h +@@ -915,6 +915,7 @@ struct dwc2_hregs_backup { + * @frame_list_sz: Frame list size + * @desc_gen_cache: Kmem cache for generic descriptors + * @desc_hsisoc_cache: Kmem cache for hs isochronous descriptors ++ * @unaligned_cache: Kmem cache for DMA mode to handle non-aligned buf + * + * These are for peripheral mode: + * +@@ -1061,6 +1062,8 @@ struct dwc2_hsotg { + u32 frame_list_sz; + struct kmem_cache *desc_gen_cache; + struct kmem_cache *desc_hsisoc_cache; ++ struct kmem_cache *unaligned_cache; ++#define DWC2_KMEM_UNALIGNED_BUF_SIZE 1024 + + #endif /* CONFIG_USB_DWC2_HOST || CONFIG_USB_DWC2_DUAL_ROLE */ + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 83cb5577a52f..22240f8fe4ad 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -808,6 +808,7 @@ static int dwc2_gadget_fill_isoc_desc(struct dwc2_hsotg_ep *hs_ep, + u32 index; + u32 maxsize = 0; + u32 mask = 0; ++ u8 pid = 0; + + maxsize = dwc2_gadget_get_desc_params(hs_ep, &mask); + if (len > maxsize) { +@@ -853,7 +854,11 @@ static int dwc2_gadget_fill_isoc_desc(struct dwc2_hsotg_ep *hs_ep, + ((len << DEV_DMA_NBYTES_SHIFT) & mask)); + + if (hs_ep->dir_in) { +- desc->status |= ((hs_ep->mc << DEV_DMA_ISOC_PID_SHIFT) & ++ if (len) ++ pid = DIV_ROUND_UP(len, hs_ep->ep.maxpacket); ++ else ++ pid = 1; ++ desc->status |= ((pid << DEV_DMA_ISOC_PID_SHIFT) & + DEV_DMA_ISOC_PID_MASK) | + ((len % hs_ep->ep.maxpacket) ? + DEV_DMA_SHORT : 0) | +@@ -892,6 +897,7 @@ static void dwc2_gadget_start_isoc_ddma(struct dwc2_hsotg_ep *hs_ep) + u32 ctrl; + + if (list_empty(&hs_ep->queue)) { ++ hs_ep->target_frame = TARGET_FRAME_INITIAL; + dev_dbg(hsotg->dev, "%s: No requests in queue\n", __func__); + return; + } +@@ -4720,9 +4726,11 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg) + } + + ret = usb_add_gadget_udc(dev, &hsotg->gadget); +- if (ret) ++ if (ret) { ++ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, ++ hsotg->ctrl_req); + return ret; +- ++ } + dwc2_hsotg_dump(hsotg); + + return 0; +@@ -4735,6 +4743,7 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg) + int dwc2_hsotg_remove(struct dwc2_hsotg *hsotg) + { + usb_del_gadget_udc(&hsotg->gadget); ++ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, hsotg->ctrl_req); + + return 0; + } +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index 3a5f0005fae5..0d66ec3f59a2 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -1567,11 +1567,20 @@ static void dwc2_hc_start_transfer(struct dwc2_hsotg *hsotg, + } + + if (hsotg->params.host_dma) { +- dwc2_writel((u32)chan->xfer_dma, +- hsotg->regs + HCDMA(chan->hc_num)); ++ dma_addr_t dma_addr; ++ ++ if (chan->align_buf) { ++ if (dbg_hc(chan)) ++ dev_vdbg(hsotg->dev, "align_buf\n"); ++ dma_addr = chan->align_buf; ++ } else { ++ dma_addr = chan->xfer_dma; ++ } ++ dwc2_writel((u32)dma_addr, hsotg->regs + HCDMA(chan->hc_num)); ++ + if (dbg_hc(chan)) + dev_vdbg(hsotg->dev, "Wrote %08lx to HCDMA(%d)\n", +- (unsigned long)chan->xfer_dma, chan->hc_num); ++ (unsigned long)dma_addr, chan->hc_num); + } + + /* Start the split */ +@@ -2625,6 +2634,35 @@ static void dwc2_hc_init_xfer(struct dwc2_hsotg *hsotg, + } + } + ++static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg, ++ struct dwc2_qh *qh, ++ struct dwc2_host_chan *chan) ++{ ++ if (!hsotg->unaligned_cache || ++ chan->max_packet > DWC2_KMEM_UNALIGNED_BUF_SIZE) ++ return -ENOMEM; ++ ++ if (!qh->dw_align_buf) { ++ qh->dw_align_buf = kmem_cache_alloc(hsotg->unaligned_cache, ++ GFP_ATOMIC | GFP_DMA); ++ if (!qh->dw_align_buf) ++ return -ENOMEM; ++ } ++ ++ qh->dw_align_buf_dma = dma_map_single(hsotg->dev, qh->dw_align_buf, ++ DWC2_KMEM_UNALIGNED_BUF_SIZE, ++ DMA_FROM_DEVICE); ++ ++ if (dma_mapping_error(hsotg->dev, qh->dw_align_buf_dma)) { ++ dev_err(hsotg->dev, "can't map align_buf\n"); ++ chan->align_buf = 0; ++ return -EINVAL; ++ } ++ ++ chan->align_buf = qh->dw_align_buf_dma; ++ return 0; ++} ++ + #define DWC2_USB_DMA_ALIGN 4 + + static void dwc2_free_dma_aligned_buffer(struct urb *urb) +@@ -2804,6 +2842,32 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh) + /* Set the transfer attributes */ + dwc2_hc_init_xfer(hsotg, chan, qtd); + ++ /* For non-dword aligned buffers */ ++ if (hsotg->params.host_dma && qh->do_split && ++ chan->ep_is_in && (chan->xfer_dma & 0x3)) { ++ dev_vdbg(hsotg->dev, "Non-aligned buffer\n"); ++ if (dwc2_alloc_split_dma_aligned_buf(hsotg, qh, chan)) { ++ dev_err(hsotg->dev, ++ "Failed to allocate memory to handle non-aligned buffer\n"); ++ /* Add channel back to free list */ ++ chan->align_buf = 0; ++ chan->multi_count = 0; ++ list_add_tail(&chan->hc_list_entry, ++ &hsotg->free_hc_list); ++ qtd->in_process = 0; ++ qh->channel = NULL; ++ return -ENOMEM; ++ } ++ } else { ++ /* ++ * We assume that DMA is always aligned in non-split ++ * case or split out case. Warn if not. ++ */ ++ WARN_ON_ONCE(hsotg->params.host_dma && ++ (chan->xfer_dma & 0x3)); ++ chan->align_buf = 0; ++ } ++ + if (chan->ep_type == USB_ENDPOINT_XFER_INT || + chan->ep_type == USB_ENDPOINT_XFER_ISOC) + /* +@@ -5248,6 +5312,19 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg) + } + } + ++ if (hsotg->params.host_dma) { ++ /* ++ * Create kmem caches to handle non-aligned buffer ++ * in Buffer DMA mode. ++ */ ++ hsotg->unaligned_cache = kmem_cache_create("dwc2-unaligned-dma", ++ DWC2_KMEM_UNALIGNED_BUF_SIZE, 4, ++ SLAB_CACHE_DMA, NULL); ++ if (!hsotg->unaligned_cache) ++ dev_err(hsotg->dev, ++ "unable to create dwc2 unaligned cache\n"); ++ } ++ + hsotg->otg_port = 1; + hsotg->frame_list = NULL; + hsotg->frame_list_dma = 0; +@@ -5282,8 +5359,9 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg) + return 0; + + error4: +- kmem_cache_destroy(hsotg->desc_gen_cache); ++ kmem_cache_destroy(hsotg->unaligned_cache); + kmem_cache_destroy(hsotg->desc_hsisoc_cache); ++ kmem_cache_destroy(hsotg->desc_gen_cache); + error3: + dwc2_hcd_release(hsotg); + error2: +@@ -5324,8 +5402,9 @@ void dwc2_hcd_remove(struct dwc2_hsotg *hsotg) + usb_remove_hcd(hcd); + hsotg->priv = NULL; + +- kmem_cache_destroy(hsotg->desc_gen_cache); ++ kmem_cache_destroy(hsotg->unaligned_cache); + kmem_cache_destroy(hsotg->desc_hsisoc_cache); ++ kmem_cache_destroy(hsotg->desc_gen_cache); + + dwc2_hcd_release(hsotg); + usb_put_hcd(hcd); +@@ -5437,7 +5516,7 @@ int dwc2_host_enter_hibernation(struct dwc2_hsotg *hsotg) + dwc2_writel(hprt0, hsotg->regs + HPRT0); + + /* Wait for the HPRT0.PrtSusp register field to be set */ +- if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 300)) ++ if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 3000)) + dev_warn(hsotg->dev, "Suspend wasn't generated\n"); + + /* +@@ -5618,6 +5697,8 @@ int dwc2_host_exit_hibernation(struct dwc2_hsotg *hsotg, int rem_wakeup, + return ret; + } + ++ dwc2_hcd_rem_wakeup(hsotg); ++ + hsotg->hibernated = 0; + hsotg->bus_suspended = 0; + hsotg->lx_state = DWC2_L0; +diff --git a/drivers/usb/dwc2/hcd.h b/drivers/usb/dwc2/hcd.h +index 96a9da5fb202..5b5b9e6f2feb 100644 +--- a/drivers/usb/dwc2/hcd.h ++++ b/drivers/usb/dwc2/hcd.h +@@ -76,6 +76,8 @@ struct dwc2_qh; + * (micro)frame + * @xfer_buf: Pointer to current transfer buffer position + * @xfer_dma: DMA address of xfer_buf ++ * @align_buf: In Buffer DMA mode this will be used if xfer_buf is not ++ * DWORD aligned + * @xfer_len: Total number of bytes to transfer + * @xfer_count: Number of bytes transferred so far + * @start_pkt_count: Packet count at start of transfer +@@ -133,6 +135,7 @@ struct dwc2_host_chan { + + u8 *xfer_buf; + dma_addr_t xfer_dma; ++ dma_addr_t align_buf; + u32 xfer_len; + u32 xfer_count; + u16 start_pkt_count; +@@ -303,6 +306,9 @@ struct dwc2_hs_transfer_time { + * is tightly packed. + * @ls_duration_us: Duration on the low speed bus schedule. + * @ntd: Actual number of transfer descriptors in a list ++ * @dw_align_buf: Used instead of original buffer if its physical address ++ * is not dword-aligned ++ * @dw_align_buf_dma: DMA address for dw_align_buf + * @qtd_list: List of QTDs for this QH + * @channel: Host channel currently processing transfers for this QH + * @qh_list_entry: Entry for QH in either the periodic or non-periodic +@@ -350,6 +356,8 @@ struct dwc2_qh { + struct dwc2_hs_transfer_time hs_transfers[DWC2_HS_SCHEDULE_UFRAMES]; + u32 ls_start_schedule_slice; + u16 ntd; ++ u8 *dw_align_buf; ++ dma_addr_t dw_align_buf_dma; + struct list_head qtd_list; + struct dwc2_host_chan *channel; + struct list_head qh_list_entry; +diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c +index a5dfd9d8bd9a..9751785ec561 100644 +--- a/drivers/usb/dwc2/hcd_intr.c ++++ b/drivers/usb/dwc2/hcd_intr.c +@@ -930,14 +930,21 @@ static int dwc2_xfercomp_isoc_split_in(struct dwc2_hsotg *hsotg, + frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index]; + len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd, + DWC2_HC_XFER_COMPLETE, NULL); +- if (!len) { ++ if (!len && !qtd->isoc_split_offset) { + qtd->complete_split = 0; +- qtd->isoc_split_offset = 0; + return 0; + } + + frame_desc->actual_length += len; + ++ if (chan->align_buf) { ++ dev_vdbg(hsotg->dev, "non-aligned buffer\n"); ++ dma_unmap_single(hsotg->dev, chan->qh->dw_align_buf_dma, ++ DWC2_KMEM_UNALIGNED_BUF_SIZE, DMA_FROM_DEVICE); ++ memcpy(qtd->urb->buf + (chan->xfer_dma - qtd->urb->dma), ++ chan->qh->dw_align_buf, len); ++ } ++ + qtd->isoc_split_offset += len; + + hctsiz = dwc2_readl(hsotg->regs + HCTSIZ(chnum)); +diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c +index 6baa75da7907..7995106c98e8 100644 +--- a/drivers/usb/dwc2/hcd_queue.c ++++ b/drivers/usb/dwc2/hcd_queue.c +@@ -1695,6 +1695,9 @@ void dwc2_hcd_qh_free(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh) + + if (qh->desc_list) + dwc2_hcd_qh_free_ddma(hsotg, qh); ++ else if (hsotg->unaligned_cache && qh->dw_align_buf) ++ kmem_cache_free(hsotg->unaligned_cache, qh->dw_align_buf); ++ + kfree(qh); + } + +diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c +index cb2ee96fd3e8..048922d549dd 100644 +--- a/drivers/usb/dwc3/dwc3-of-simple.c ++++ b/drivers/usb/dwc3/dwc3-of-simple.c +@@ -165,8 +165,9 @@ static int dwc3_of_simple_remove(struct platform_device *pdev) + + reset_control_put(simple->resets); + +- pm_runtime_put_sync(dev); + pm_runtime_disable(dev); ++ pm_runtime_put_noidle(dev); ++ pm_runtime_set_suspended(dev); + + return 0; + } +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index c961a94d136b..f57e7c94b8e5 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -34,6 +34,7 @@ + #define PCI_DEVICE_ID_INTEL_GLK 0x31aa + #define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee + #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e ++#define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -289,6 +290,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICLLP), }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), }, + { } /* Terminating Entry */ + }; +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 330c591fd7d6..afd6c977beec 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1719,6 +1719,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + */ + if (w_value && !f->get_alt) + break; ++ ++ spin_lock(&cdev->lock); + value = f->set_alt(f, w_index, w_value); + if (value == USB_GADGET_DELAYED_STATUS) { + DBG(cdev, +@@ -1728,6 +1730,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + DBG(cdev, "delayed_status count %d\n", + cdev->delayed_status); + } ++ spin_unlock(&cdev->lock); + break; + case USB_REQ_GET_INTERFACE: + if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE)) +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 7e57439ac282..32fdc79cd73b 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -215,6 +215,7 @@ struct ffs_io_data { + + struct mm_struct *mm; + struct work_struct work; ++ struct work_struct cancellation_work; + + struct usb_ep *ep; + struct usb_request *req; +@@ -1072,22 +1073,31 @@ ffs_epfile_open(struct inode *inode, struct file *file) + return 0; + } + ++static void ffs_aio_cancel_worker(struct work_struct *work) ++{ ++ struct ffs_io_data *io_data = container_of(work, struct ffs_io_data, ++ cancellation_work); ++ ++ ENTER(); ++ ++ usb_ep_dequeue(io_data->ep, io_data->req); ++} ++ + static int ffs_aio_cancel(struct kiocb *kiocb) + { + struct ffs_io_data *io_data = kiocb->private; +- struct ffs_epfile *epfile = kiocb->ki_filp->private_data; ++ struct ffs_data *ffs = io_data->ffs; + int value; + + ENTER(); + +- spin_lock_irq(&epfile->ffs->eps_lock); +- +- if (likely(io_data && io_data->ep && io_data->req)) +- value = usb_ep_dequeue(io_data->ep, io_data->req); +- else ++ if (likely(io_data && io_data->ep && io_data->req)) { ++ INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker); ++ queue_work(ffs->io_completion_wq, &io_data->cancellation_work); ++ value = -EINPROGRESS; ++ } else { + value = -EINVAL; +- +- spin_unlock_irq(&epfile->ffs->eps_lock); ++ } + + return value; + } +diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c +index c359bae7b754..18925c0dde59 100644 +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -507,16 +507,18 @@ static int xhci_do_dbc_start(struct xhci_hcd *xhci) + return 0; + } + +-static void xhci_do_dbc_stop(struct xhci_hcd *xhci) ++static int xhci_do_dbc_stop(struct xhci_hcd *xhci) + { + struct xhci_dbc *dbc = xhci->dbc; + + if (dbc->state == DS_DISABLED) +- return; ++ return -1; + + writel(0, &dbc->regs->control); + xhci_dbc_mem_cleanup(xhci); + dbc->state = DS_DISABLED; ++ ++ return 0; + } + + static int xhci_dbc_start(struct xhci_hcd *xhci) +@@ -543,6 +545,7 @@ static int xhci_dbc_start(struct xhci_hcd *xhci) + + static void xhci_dbc_stop(struct xhci_hcd *xhci) + { ++ int ret; + unsigned long flags; + struct xhci_dbc *dbc = xhci->dbc; + struct dbc_port *port = &dbc->port; +@@ -555,10 +558,11 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci) + xhci_dbc_tty_unregister_device(xhci); + + spin_lock_irqsave(&dbc->lock, flags); +- xhci_do_dbc_stop(xhci); ++ ret = xhci_do_dbc_stop(xhci); + spin_unlock_irqrestore(&dbc->lock, flags); + +- pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller); ++ if (!ret) ++ pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller); + } + + static void +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index 2c076ea80522..1ed87cee8d21 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -479,7 +479,7 @@ static void tegra_xusb_mbox_handle(struct tegra_xusb *tegra, + unsigned long mask; + unsigned int port; + bool idle, enable; +- int err; ++ int err = 0; + + memset(&rsp, 0, sizeof(rsp)); + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 5fb4319d7fd1..ae56eac34fc7 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1014,8 +1014,13 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + command = readl(&xhci->op_regs->command); + command |= CMD_CRS; + writel(command, &xhci->op_regs->command); ++ /* ++ * Some controllers take up to 55+ ms to complete the controller ++ * restore so setting the timeout to 100ms. Xhci specification ++ * doesn't mention any timeout value. ++ */ + if (xhci_handshake(&xhci->op_regs->status, +- STS_RESTORE, 0, 10 * 1000)) { ++ STS_RESTORE, 0, 100 * 1000)) { + xhci_warn(xhci, "WARN: xHC restore state timeout\n"); + spin_unlock_irq(&xhci->lock); + return -ETIMEDOUT; +diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c +index 9b29b67191bc..58b6598f8e10 100644 +--- a/drivers/usb/typec/tcpm.c ++++ b/drivers/usb/typec/tcpm.c +@@ -2543,7 +2543,8 @@ static void run_state_machine(struct tcpm_port *port) + tcpm_port_is_sink(port) && + time_is_after_jiffies(port->delayed_runtime)) { + tcpm_set_state(port, SNK_DISCOVERY, +- port->delayed_runtime - jiffies); ++ jiffies_to_msecs(port->delayed_runtime - ++ jiffies)); + break; + } + tcpm_set_state(port, unattached_state(port), 0); +diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c +index 8835065029d3..c93d8ef8df34 100644 +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -289,8 +289,15 @@ static void sysrq_handler(struct xenbus_watch *watch, const char *path, + return; + } + +- if (sysrq_key != '\0') +- xenbus_printf(xbt, "control", "sysrq", "%c", '\0'); ++ if (sysrq_key != '\0') { ++ err = xenbus_printf(xbt, "control", "sysrq", "%c", '\0'); ++ if (err) { ++ pr_err("%s: Error %d writing sysrq in control/sysrq\n", ++ __func__, err); ++ xenbus_transaction_end(xbt, 1); ++ return; ++ } ++ } + + err = xenbus_transaction_end(xbt, 0); + if (err == -EAGAIN) +@@ -342,7 +349,12 @@ static int setup_shutdown_watcher(void) + continue; + snprintf(node, FEATURE_PATH_SIZE, "feature-%s", + shutdown_handlers[idx].command); +- xenbus_printf(XBT_NIL, "control", node, "%u", 1); ++ err = xenbus_printf(XBT_NIL, "control", node, "%u", 1); ++ if (err) { ++ pr_err("%s: Error %d writing %s\n", __func__, ++ err, node); ++ return err; ++ } + } + + return 0; +diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c +index 7bc88fd43cfc..e2f3e8b0fba9 100644 +--- a/drivers/xen/xen-scsiback.c ++++ b/drivers/xen/xen-scsiback.c +@@ -1012,6 +1012,7 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state, + { + struct v2p_entry *entry; + unsigned long flags; ++ int err; + + if (try) { + spin_lock_irqsave(&info->v2p_lock, flags); +@@ -1027,8 +1028,11 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state, + scsiback_del_translation_entry(info, vir); + } + } else if (!try) { +- xenbus_printf(XBT_NIL, info->dev->nodename, state, ++ err = xenbus_printf(XBT_NIL, info->dev->nodename, state, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing %s", __func__, state); + } + } + +@@ -1067,8 +1071,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op, + snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent); + val = xenbus_read(XBT_NIL, dev->nodename, str, NULL); + if (IS_ERR(val)) { +- xenbus_printf(XBT_NIL, dev->nodename, state, ++ err = xenbus_printf(XBT_NIL, dev->nodename, state, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing %s", __func__, state); + return; + } + strlcpy(phy, val, VSCSI_NAMELEN); +@@ -1079,8 +1086,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op, + err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u", + &vir.hst, &vir.chn, &vir.tgt, &vir.lun); + if (XENBUS_EXIST_ERR(err)) { +- xenbus_printf(XBT_NIL, dev->nodename, state, ++ err = xenbus_printf(XBT_NIL, dev->nodename, state, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing %s", __func__, state); + return; + } + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index ad8a69ba7f13..7391b123a17a 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -1151,11 +1151,6 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) + return ret; + } + +- if (sctx->is_dev_replace && !is_metadata && !have_csum) { +- sblocks_for_recheck = NULL; +- goto nodatasum_case; +- } +- + /* + * read all mirrors one after the other. This includes to + * re-read the extent or metadata block that failed (that was +@@ -1268,13 +1263,19 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) + goto out; + } + +- if (!is_metadata && !have_csum) { ++ /* ++ * NOTE: Even for nodatasum case, it's still possible that it's a ++ * compressed data extent, thus scrub_fixup_nodatasum(), which write ++ * inode page cache onto disk, could cause serious data corruption. ++ * ++ * So here we could only read from disk, and hope our recovery could ++ * reach disk before the newer write. ++ */ ++ if (0 && !is_metadata && !have_csum) { + struct scrub_fixup_nodatasum *fixup_nodatasum; + + WARN_ON(sctx->is_dev_replace); + +-nodatasum_case: +- + /* + * !is_metadata and !have_csum, this means that the data + * might not be COWed, that it might be modified +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index ae056927080d..6b6868d0cdcc 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1123,6 +1123,7 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in) + if (IS_ERR(realdn)) { + pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n", + PTR_ERR(realdn), dn, in, ceph_vinop(in)); ++ dput(dn); + dn = realdn; /* note realdn contains the error */ + goto out; + } else if (realdn) { +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 71013c5268b9..9c8d5f12546b 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -923,8 +923,9 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) + req->PreviousSessionId = sess_data->previous_session; + + req->Flags = 0; /* MBZ */ +- /* to enable echos and oplocks */ +- req->sync_hdr.CreditRequest = cpu_to_le16(3); ++ ++ /* enough to enable echos and oplocks and one max size write */ ++ req->sync_hdr.CreditRequest = cpu_to_le16(130); + + /* only one of SMB2 signing flags may be set in SMB2 request */ + if (server->sign) +diff --git a/fs/exec.c b/fs/exec.c +index 183059c427b9..7d00f8ceba3f 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -290,7 +290,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm) + struct vm_area_struct *vma = NULL; + struct mm_struct *mm = bprm->mm; + +- bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ bprm->vma = vma = vm_area_alloc(mm); + if (!vma) + return -ENOMEM; + +@@ -298,7 +298,6 @@ static int __bprm_mm_init(struct linux_binprm *bprm) + err = -EINTR; + goto err_free; + } +- vma->vm_mm = mm; + + /* + * Place the stack at the largest stack address the architecture +@@ -311,7 +310,6 @@ static int __bprm_mm_init(struct linux_binprm *bprm) + vma->vm_start = vma->vm_end - PAGE_SIZE; + vma->vm_flags = VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP; + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); +- INIT_LIST_HEAD(&vma->anon_vma_chain); + + err = insert_vm_struct(mm, vma); + if (err) +@@ -326,7 +324,7 @@ err: + up_write(&mm->mmap_sem); + err_free: + bprm->vma = NULL; +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return err; + } + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 39187e7b3748..050838f03328 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -14,6 +14,7 @@ + #include <linux/log2.h> + #include <linux/module.h> + #include <linux/slab.h> ++#include <linux/nospec.h> + #include <linux/backing-dev.h> + #include <trace/events/ext4.h> + +@@ -2140,7 +2141,8 @@ ext4_mb_regular_allocator(struct ext4_allocation_context *ac) + * This should tell if fe_len is exactly power of 2 + */ + if ((ac->ac_g_ex.fe_len & (~(1 << (i - 1)))) == 0) +- ac->ac_2order = i - 1; ++ ac->ac_2order = array_index_nospec(i - 1, ++ sb->s_blocksize_bits + 2); + } + + /* if stream allocation is enabled, use global goal */ +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 2d94eb9cd386..0f6291675123 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -8620,6 +8620,8 @@ nfs4_layoutget_handle_exception(struct rpc_task *task, + + dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status); + ++ nfs4_sequence_free_slot(&lgp->res.seq_res); ++ + switch (nfs4err) { + case 0: + goto out; +@@ -8684,7 +8686,6 @@ nfs4_layoutget_handle_exception(struct rpc_task *task, + goto out; + } + +- nfs4_sequence_free_slot(&lgp->res.seq_res); + err = nfs4_handle_exception(server, nfs4err, exception); + if (!status) { + if (exception->retry) +@@ -8810,20 +8811,22 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags) + if (IS_ERR(task)) + return ERR_CAST(task); + status = rpc_wait_for_completion_task(task); +- if (status == 0) { ++ if (status != 0) ++ goto out; ++ ++ /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */ ++ if (task->tk_status < 0 || lgp->res.layoutp->len == 0) { + status = nfs4_layoutget_handle_exception(task, lgp, &exception); + *timeout = exception.timeout; +- } +- ++ } else ++ lseg = pnfs_layout_process(lgp); ++out: + trace_nfs4_layoutget(lgp->args.ctx, + &lgp->args.range, + &lgp->res.range, + &lgp->res.stateid, + status); + +- /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */ +- if (status == 0 && lgp->res.layoutp->len) +- lseg = pnfs_layout_process(lgp); + rpc_put_task(task); + dprintk("<-- %s status=%d\n", __func__, status); + if (status) +diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c +index 5dbf5324bdda..8fb367c5bdd7 100644 +--- a/fs/reiserfs/xattr.c ++++ b/fs/reiserfs/xattr.c +@@ -792,8 +792,10 @@ static int listxattr_filler(struct dir_context *ctx, const char *name, + return 0; + size = namelen + 1; + if (b->buf) { +- if (size > b->size) ++ if (b->pos + size > b->size) { ++ b->pos = -ERANGE; + return -ERANGE; ++ } + memcpy(b->buf + b->pos, name, namelen); + b->buf[b->pos + namelen] = 0; + } +diff --git a/include/linux/fsl/guts.h b/include/linux/fsl/guts.h +index 3efa3b861d44..941b11811f85 100644 +--- a/include/linux/fsl/guts.h ++++ b/include/linux/fsl/guts.h +@@ -16,6 +16,7 @@ + #define __FSL_GUTS_H__ + + #include <linux/types.h> ++#include <linux/io.h> + + /** + * Global Utility Registers. +diff --git a/include/linux/kthread.h b/include/linux/kthread.h +index 2803264c512f..c1961761311d 100644 +--- a/include/linux/kthread.h ++++ b/include/linux/kthread.h +@@ -62,7 +62,6 @@ void *kthread_probe_data(struct task_struct *k); + int kthread_park(struct task_struct *k); + void kthread_unpark(struct task_struct *k); + void kthread_parkme(void); +-void kthread_park_complete(struct task_struct *k); + + int kthreadd(void *unused); + extern struct task_struct *kthreadd_task; +diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h +index 4f5f8c21e283..1eb6f244588d 100644 +--- a/include/linux/marvell_phy.h ++++ b/include/linux/marvell_phy.h +@@ -27,6 +27,8 @@ + */ + #define MARVELL_PHY_ID_88E6390 0x01410f90 + ++#define MARVELL_PHY_FAMILY_ID(id) ((id) >> 4) ++ + /* struct phy_device dev_flags definitions */ + #define MARVELL_PHY_M1145_FLAGS_RESISTANCE 0x00000001 + #define MARVELL_PHY_M1118_DNS323_LEDS 0x00000002 +diff --git a/include/linux/mm.h b/include/linux/mm.h +index edab43d2bec8..28477ff9cf04 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -154,7 +154,9 @@ extern int overcommit_kbytes_handler(struct ctl_table *, int, void __user *, + * mmap() functions). + */ + +-extern struct kmem_cache *vm_area_cachep; ++struct vm_area_struct *vm_area_alloc(struct mm_struct *); ++struct vm_area_struct *vm_area_dup(struct vm_area_struct *); ++void vm_area_free(struct vm_area_struct *); + + #ifndef CONFIG_MMU + extern struct rb_root nommu_region_tree; +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 73178a2fcee0..27f9bdd7e46d 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1236,6 +1236,8 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr, + unsigned long pci_address_to_pio(phys_addr_t addr); + phys_addr_t pci_pio_to_address(unsigned long pio); + int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr); ++int devm_pci_remap_iospace(struct device *dev, const struct resource *res, ++ phys_addr_t phys_addr); + void pci_unmap_iospace(struct resource *res); + void __iomem *devm_pci_remap_cfgspace(struct device *dev, + resource_size_t offset, +diff --git a/include/linux/sched.h b/include/linux/sched.h +index ca3f3eae8980..5c32faa4af99 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -117,7 +117,7 @@ struct task_group; + * the comment with set_special_state(). + */ + #define is_special_task_state(state) \ +- ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_DEAD)) ++ ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_PARKED | TASK_DEAD)) + + #define __set_current_state(state_value) \ + do { \ +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index aeebbbb9e0bd..62b6bfcce152 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -354,14 +354,7 @@ struct ipv6_txoptions *ipv6_dup_options(struct sock *sk, + struct ipv6_txoptions *ipv6_renew_options(struct sock *sk, + struct ipv6_txoptions *opt, + int newtype, +- struct ipv6_opt_hdr __user *newopt, +- int newoptlen); +-struct ipv6_txoptions * +-ipv6_renew_options_kern(struct sock *sk, +- struct ipv6_txoptions *opt, +- int newtype, +- struct ipv6_opt_hdr *newopt, +- int newoptlen); ++ struct ipv6_opt_hdr *newopt); + struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, + struct ipv6_txoptions *opt); + +diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h +index 47e35cce3b64..a71264d75d7f 100644 +--- a/include/net/net_namespace.h ++++ b/include/net/net_namespace.h +@@ -128,6 +128,7 @@ struct net { + #endif + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + struct netns_nf_frag nf_frag; ++ struct ctl_table_header *nf_frag_frags_hdr; + #endif + struct sock *nfnl; + struct sock *nfnl_stash; +diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h +index c29f09cfc9d7..5ce433f9e88a 100644 +--- a/include/net/netns/ipv6.h ++++ b/include/net/netns/ipv6.h +@@ -107,7 +107,6 @@ struct netns_ipv6 { + + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + struct netns_nf_frag { +- struct netns_sysctl_ipv6 sysctl; + struct netns_frags frags; + }; + #endif +diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h +index 9470fd7e4350..32d2454c0479 100644 +--- a/include/net/tc_act/tc_csum.h ++++ b/include/net/tc_act/tc_csum.h +@@ -7,7 +7,6 @@ + #include <linux/tc_act/tc_csum.h> + + struct tcf_csum_params { +- int action; + u32 update_flags; + struct rcu_head rcu; + }; +diff --git a/include/net/tc_act/tc_tunnel_key.h b/include/net/tc_act/tc_tunnel_key.h +index efef0b4b1b2b..46b8c7f1c8d5 100644 +--- a/include/net/tc_act/tc_tunnel_key.h ++++ b/include/net/tc_act/tc_tunnel_key.h +@@ -18,7 +18,6 @@ + struct tcf_tunnel_key_params { + struct rcu_head rcu; + int tcft_action; +- int action; + struct metadata_dst *tcft_enc_metadata; + }; + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 5ccc4ec646cb..b0639f336976 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -907,8 +907,6 @@ enum tcp_ca_event { + CA_EVENT_LOSS, /* loss timeout */ + CA_EVENT_ECN_NO_CE, /* ECT set, but not CE marked */ + CA_EVENT_ECN_IS_CE, /* received CE marked IP packet */ +- CA_EVENT_DELAYED_ACK, /* Delayed ack is sent */ +- CA_EVENT_NON_DELAYED_ACK, + }; + + /* Information about inbound ACK, passed to cong_ops->in_ack_event() */ +diff --git a/include/uapi/linux/nbd.h b/include/uapi/linux/nbd.h +index 85a3fb65e40a..20d6cc91435d 100644 +--- a/include/uapi/linux/nbd.h ++++ b/include/uapi/linux/nbd.h +@@ -53,6 +53,9 @@ enum { + /* These are client behavior specific flags. */ + #define NBD_CFLAG_DESTROY_ON_DISCONNECT (1 << 0) /* delete the nbd device on + disconnect. */ ++#define NBD_CFLAG_DISCONNECT_ON_CLOSE (1 << 1) /* disconnect the nbd device on ++ * close by last opener. ++ */ + + /* userspace doesn't need the nbd_device structure */ + +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index b76828f23b49..3bd61b004418 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -743,13 +743,15 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, + * old element will be freed immediately. + * Otherwise return an error + */ +- atomic_dec(&htab->count); +- return ERR_PTR(-E2BIG); ++ l_new = ERR_PTR(-E2BIG); ++ goto dec_count; + } + l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN, + htab->map.numa_node); +- if (!l_new) +- return ERR_PTR(-ENOMEM); ++ if (!l_new) { ++ l_new = ERR_PTR(-ENOMEM); ++ goto dec_count; ++ } + } + + memcpy(l_new->key, key, key_size); +@@ -762,7 +764,8 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, + GFP_ATOMIC | __GFP_NOWARN); + if (!pptr) { + kfree(l_new); +- return ERR_PTR(-ENOMEM); ++ l_new = ERR_PTR(-ENOMEM); ++ goto dec_count; + } + } + +@@ -776,6 +779,9 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, + + l_new->hash = hash; + return l_new; ++dec_count: ++ atomic_dec(&htab->count); ++ return l_new; + } + + static int check_flags(struct bpf_htab *htab, struct htab_elem *l_old, +diff --git a/kernel/fork.c b/kernel/fork.c +index 5ad558e6f8fe..b9d9b39d4afc 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -303,11 +303,38 @@ struct kmem_cache *files_cachep; + struct kmem_cache *fs_cachep; + + /* SLAB cache for vm_area_struct structures */ +-struct kmem_cache *vm_area_cachep; ++static struct kmem_cache *vm_area_cachep; + + /* SLAB cache for mm_struct structures (tsk->mm) */ + static struct kmem_cache *mm_cachep; + ++struct vm_area_struct *vm_area_alloc(struct mm_struct *mm) ++{ ++ struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ ++ if (vma) { ++ vma->vm_mm = mm; ++ INIT_LIST_HEAD(&vma->anon_vma_chain); ++ } ++ return vma; ++} ++ ++struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) ++{ ++ struct vm_area_struct *new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ ++ if (new) { ++ *new = *orig; ++ INIT_LIST_HEAD(&new->anon_vma_chain); ++ } ++ return new; ++} ++ ++void vm_area_free(struct vm_area_struct *vma) ++{ ++ kmem_cache_free(vm_area_cachep, vma); ++} ++ + static void account_kernel_stack(struct task_struct *tsk, int account) + { + void *stack = task_stack_page(tsk); +@@ -455,11 +482,9 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, + goto fail_nomem; + charge = len; + } +- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ tmp = vm_area_dup(mpnt); + if (!tmp) + goto fail_nomem; +- *tmp = *mpnt; +- INIT_LIST_HEAD(&tmp->anon_vma_chain); + retval = vma_dup_policy(mpnt, tmp); + if (retval) + goto fail_nomem_policy; +@@ -539,7 +564,7 @@ fail_uprobe_end: + fail_nomem_anon_vma_fork: + mpol_put(vma_policy(tmp)); + fail_nomem_policy: +- kmem_cache_free(vm_area_cachep, tmp); ++ vm_area_free(tmp); + fail_nomem: + retval = -ENOMEM; + vm_unacct_memory(charge); +diff --git a/kernel/kthread.c b/kernel/kthread.c +index 1a481ae12dec..486dedbd9af5 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -177,9 +177,20 @@ void *kthread_probe_data(struct task_struct *task) + static void __kthread_parkme(struct kthread *self) + { + for (;;) { +- set_current_state(TASK_PARKED); ++ /* ++ * TASK_PARKED is a special state; we must serialize against ++ * possible pending wakeups to avoid store-store collisions on ++ * task->state. ++ * ++ * Such a collision might possibly result in the task state ++ * changin from TASK_PARKED and us failing the ++ * wait_task_inactive() in kthread_park(). ++ */ ++ set_special_state(TASK_PARKED); + if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags)) + break; ++ ++ complete_all(&self->parked); + schedule(); + } + __set_current_state(TASK_RUNNING); +@@ -191,11 +202,6 @@ void kthread_parkme(void) + } + EXPORT_SYMBOL_GPL(kthread_parkme); + +-void kthread_park_complete(struct task_struct *k) +-{ +- complete_all(&to_kthread(k)->parked); +-} +- + static int kthread(void *_create) + { + /* Copy data: it's on kthread's stack */ +@@ -467,6 +473,9 @@ void kthread_unpark(struct task_struct *k) + + reinit_completion(&kthread->parked); + clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags); ++ /* ++ * __kthread_parkme() will either see !SHOULD_PARK or get the wakeup. ++ */ + wake_up_state(k, TASK_PARKED); + } + EXPORT_SYMBOL_GPL(kthread_unpark); +@@ -493,7 +502,16 @@ int kthread_park(struct task_struct *k) + set_bit(KTHREAD_SHOULD_PARK, &kthread->flags); + if (k != current) { + wake_up_process(k); ++ /* ++ * Wait for __kthread_parkme() to complete(), this means we ++ * _will_ have TASK_PARKED and are about to call schedule(). ++ */ + wait_for_completion(&kthread->parked); ++ /* ++ * Now wait for that schedule() to complete and the task to ++ * get scheduled out. ++ */ ++ WARN_ON_ONCE(!wait_task_inactive(k, TASK_PARKED)); + } + + return 0; +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 023386338269..7184cea3ca10 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -1261,11 +1261,11 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class) + this.parent = NULL; + this.class = class; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + arch_spin_lock(&lockdep_lock); + ret = __lockdep_count_forward_deps(&this); + arch_spin_unlock(&lockdep_lock); +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + + return ret; + } +@@ -1288,11 +1288,11 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class) + this.parent = NULL; + this.class = class; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + arch_spin_lock(&lockdep_lock); + ret = __lockdep_count_backward_deps(&this); + arch_spin_unlock(&lockdep_lock); +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + + return ret; + } +@@ -4407,7 +4407,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len) + if (unlikely(!debug_locks)) + return; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + for (i = 0; i < curr->lockdep_depth; i++) { + hlock = curr->held_locks + i; + +@@ -4418,7 +4418,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len) + print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock); + break; + } +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + } + EXPORT_SYMBOL_GPL(debug_check_no_locks_freed); + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index ec945451b9ef..0b817812f17f 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -7,7 +7,6 @@ + */ + #include "sched.h" + +-#include <linux/kthread.h> + #include <linux/nospec.h> + + #include <asm/switch_to.h> +@@ -2738,28 +2737,20 @@ static struct rq *finish_task_switch(struct task_struct *prev) + membarrier_mm_sync_core_before_usermode(mm); + mmdrop(mm); + } +- if (unlikely(prev_state & (TASK_DEAD|TASK_PARKED))) { +- switch (prev_state) { +- case TASK_DEAD: +- if (prev->sched_class->task_dead) +- prev->sched_class->task_dead(prev); ++ if (unlikely(prev_state == TASK_DEAD)) { ++ if (prev->sched_class->task_dead) ++ prev->sched_class->task_dead(prev); + +- /* +- * Remove function-return probe instances associated with this +- * task and put them back on the free list. +- */ +- kprobe_flush_task(prev); +- +- /* Task is done with its stack. */ +- put_task_stack(prev); ++ /* ++ * Remove function-return probe instances associated with this ++ * task and put them back on the free list. ++ */ ++ kprobe_flush_task(prev); + +- put_task_struct(prev); +- break; ++ /* Task is done with its stack. */ ++ put_task_stack(prev); + +- case TASK_PARKED: +- kthread_park_complete(prev); +- break; +- } ++ put_task_struct(prev); + } + + tick_nohz_task_switch(); +@@ -3127,7 +3118,9 @@ static void sched_tick_remote(struct work_struct *work) + struct tick_work *twork = container_of(dwork, struct tick_work, work); + int cpu = twork->cpu; + struct rq *rq = cpu_rq(cpu); ++ struct task_struct *curr; + struct rq_flags rf; ++ u64 delta; + + /* + * Handle the tick only if it appears the remote CPU is running in full +@@ -3136,24 +3129,28 @@ static void sched_tick_remote(struct work_struct *work) + * statistics and checks timeslices in a time-independent way, regardless + * of when exactly it is running. + */ +- if (!idle_cpu(cpu) && tick_nohz_tick_stopped_cpu(cpu)) { +- struct task_struct *curr; +- u64 delta; ++ if (idle_cpu(cpu) || !tick_nohz_tick_stopped_cpu(cpu)) ++ goto out_requeue; + +- rq_lock_irq(rq, &rf); +- update_rq_clock(rq); +- curr = rq->curr; +- delta = rq_clock_task(rq) - curr->se.exec_start; ++ rq_lock_irq(rq, &rf); ++ curr = rq->curr; ++ if (is_idle_task(curr)) ++ goto out_unlock; + +- /* +- * Make sure the next tick runs within a reasonable +- * amount of time. +- */ +- WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3); +- curr->sched_class->task_tick(rq, curr, 0); +- rq_unlock_irq(rq, &rf); +- } ++ update_rq_clock(rq); ++ delta = rq_clock_task(rq) - curr->se.exec_start; ++ ++ /* ++ * Make sure the next tick runs within a reasonable ++ * amount of time. ++ */ ++ WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3); ++ curr->sched_class->task_tick(rq, curr, 0); ++ ++out_unlock: ++ rq_unlock_irq(rq, &rf); + ++out_requeue: + /* + * Run the remote tick once per second (1Hz). This arbitrary + * frequency is large enough to avoid overload but short enough +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 8b50eea4b607..b5fbdde6afa9 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2296,8 +2296,17 @@ static void switched_from_dl(struct rq *rq, struct task_struct *p) + if (task_on_rq_queued(p) && p->dl.dl_runtime) + task_non_contending(p); + +- if (!task_on_rq_queued(p)) ++ if (!task_on_rq_queued(p)) { ++ /* ++ * Inactive timer is armed. However, p is leaving DEADLINE and ++ * might migrate away from this rq while continuing to run on ++ * some other class. We need to remove its contribution from ++ * this rq running_bw now, or sub_rq_bw (below) will complain. ++ */ ++ if (p->dl.dl_non_contending) ++ sub_running_bw(&p->dl, &rq->dl); + sub_rq_bw(&p->dl, &rq->dl); ++ } + + /* + * We cannot use inactive_task_timer() to invoke sub_running_bw() +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 183068d22849..9b0c02ec7517 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3941,18 +3941,10 @@ util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep) + if (!sched_feat(UTIL_EST)) + return; + +- /* +- * Update root cfs_rq's estimated utilization +- * +- * If *p is the last task then the root cfs_rq's estimated utilization +- * of a CPU is 0 by definition. +- */ +- ue.enqueued = 0; +- if (cfs_rq->nr_running) { +- ue.enqueued = cfs_rq->avg.util_est.enqueued; +- ue.enqueued -= min_t(unsigned int, ue.enqueued, +- (_task_util_est(p) | UTIL_AVG_UNCHANGED)); +- } ++ /* Update root cfs_rq's estimated utilization */ ++ ue.enqueued = cfs_rq->avg.util_est.enqueued; ++ ue.enqueued -= min_t(unsigned int, ue.enqueued, ++ (_task_util_est(p) | UTIL_AVG_UNCHANGED)); + WRITE_ONCE(cfs_rq->avg.util_est.enqueued, ue.enqueued); + + /* +@@ -4549,6 +4541,7 @@ void __refill_cfs_bandwidth_runtime(struct cfs_bandwidth *cfs_b) + now = sched_clock_cpu(smp_processor_id()); + cfs_b->runtime = cfs_b->quota; + cfs_b->runtime_expires = now + ktime_to_ns(cfs_b->period); ++ cfs_b->expires_seq++; + } + + static inline struct cfs_bandwidth *tg_cfs_bandwidth(struct task_group *tg) +@@ -4571,6 +4564,7 @@ static int assign_cfs_rq_runtime(struct cfs_rq *cfs_rq) + struct task_group *tg = cfs_rq->tg; + struct cfs_bandwidth *cfs_b = tg_cfs_bandwidth(tg); + u64 amount = 0, min_amount, expires; ++ int expires_seq; + + /* note: this is a positive sum as runtime_remaining <= 0 */ + min_amount = sched_cfs_bandwidth_slice() - cfs_rq->runtime_remaining; +@@ -4587,6 +4581,7 @@ static int assign_cfs_rq_runtime(struct cfs_rq *cfs_rq) + cfs_b->idle = 0; + } + } ++ expires_seq = cfs_b->expires_seq; + expires = cfs_b->runtime_expires; + raw_spin_unlock(&cfs_b->lock); + +@@ -4596,8 +4591,10 @@ static int assign_cfs_rq_runtime(struct cfs_rq *cfs_rq) + * spread between our sched_clock and the one on which runtime was + * issued. + */ +- if ((s64)(expires - cfs_rq->runtime_expires) > 0) ++ if (cfs_rq->expires_seq != expires_seq) { ++ cfs_rq->expires_seq = expires_seq; + cfs_rq->runtime_expires = expires; ++ } + + return cfs_rq->runtime_remaining > 0; + } +@@ -4623,12 +4620,9 @@ static void expire_cfs_rq_runtime(struct cfs_rq *cfs_rq) + * has not truly expired. + * + * Fortunately we can check determine whether this the case by checking +- * whether the global deadline has advanced. It is valid to compare +- * cfs_b->runtime_expires without any locks since we only care about +- * exact equality, so a partial write will still work. ++ * whether the global deadline(cfs_b->expires_seq) has advanced. + */ +- +- if (cfs_rq->runtime_expires != cfs_b->runtime_expires) { ++ if (cfs_rq->expires_seq == cfs_b->expires_seq) { + /* extend local deadline, drift is bounded above by 2 ticks */ + cfs_rq->runtime_expires += TICK_NSEC; + } else { +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index cb467c221b15..7548b373d1c5 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -334,9 +334,10 @@ struct cfs_bandwidth { + u64 runtime; + s64 hierarchical_quota; + u64 runtime_expires; ++ int expires_seq; + +- int idle; +- int period_active; ++ short idle; ++ short period_active; + struct hrtimer period_timer; + struct hrtimer slack_timer; + struct list_head throttled_cfs_rq; +@@ -551,6 +552,7 @@ struct cfs_rq { + + #ifdef CONFIG_CFS_BANDWIDTH + int runtime_enabled; ++ int expires_seq; + u64 runtime_expires; + s64 runtime_remaining; + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index a583b6494b95..214820a14edf 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -2962,6 +2962,7 @@ out_nobuffer: + } + EXPORT_SYMBOL_GPL(trace_vbprintk); + ++__printf(3, 0) + static int + __trace_array_vprintk(struct ring_buffer *buffer, + unsigned long ip, const char *fmt, va_list args) +@@ -3016,12 +3017,14 @@ out_nobuffer: + return len; + } + ++__printf(3, 0) + int trace_array_vprintk(struct trace_array *tr, + unsigned long ip, const char *fmt, va_list args) + { + return __trace_array_vprintk(tr->trace_buffer.buffer, ip, fmt, args); + } + ++__printf(3, 0) + int trace_array_printk(struct trace_array *tr, + unsigned long ip, const char *fmt, ...) + { +@@ -3037,6 +3040,7 @@ int trace_array_printk(struct trace_array *tr, + return ret; + } + ++__printf(3, 4) + int trace_array_printk_buf(struct ring_buffer *buffer, + unsigned long ip, const char *fmt, ...) + { +@@ -3052,6 +3056,7 @@ int trace_array_printk_buf(struct ring_buffer *buffer, + return ret; + } + ++__printf(2, 0) + int trace_vprintk(unsigned long ip, const char *fmt, va_list args) + { + return trace_array_vprintk(&global_trace, ip, fmt, args); +diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c +index f185455b3406..c3bd5209da38 100644 +--- a/mm/kasan/kasan.c ++++ b/mm/kasan/kasan.c +@@ -619,12 +619,13 @@ void kasan_kfree_large(void *ptr, unsigned long ip) + int kasan_module_alloc(void *addr, size_t size) + { + void *ret; ++ size_t scaled_size; + size_t shadow_size; + unsigned long shadow_start; + + shadow_start = (unsigned long)kasan_mem_to_shadow(addr); +- shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT, +- PAGE_SIZE); ++ scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT; ++ shadow_size = round_up(scaled_size, PAGE_SIZE); + + if (WARN_ON(!PAGE_ALIGNED(shadow_start))) + return -EINVAL; +diff --git a/mm/mmap.c b/mm/mmap.c +index 540cfab8c2c4..55d68c24e742 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -182,7 +182,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma) + if (vma->vm_file) + fput(vma->vm_file); + mpol_put(vma_policy(vma)); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return next; + } + +@@ -911,7 +911,7 @@ again: + anon_vma_merge(vma, next); + mm->map_count--; + mpol_put(vma_policy(next)); +- kmem_cache_free(vm_area_cachep, next); ++ vm_area_free(next); + /* + * In mprotect's case 6 (see comments on vma_merge), + * we must remove another next too. It would clutter +@@ -1729,19 +1729,17 @@ unsigned long mmap_region(struct file *file, unsigned long addr, + * specific mapper. the address has already been validated, but + * not unmapped, but the maps are removed from the list. + */ +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(mm); + if (!vma) { + error = -ENOMEM; + goto unacct_error; + } + +- vma->vm_mm = mm; + vma->vm_start = addr; + vma->vm_end = addr + len; + vma->vm_flags = vm_flags; + vma->vm_page_prot = vm_get_page_prot(vm_flags); + vma->vm_pgoff = pgoff; +- INIT_LIST_HEAD(&vma->anon_vma_chain); + + if (file) { + if (vm_flags & VM_DENYWRITE) { +@@ -1832,7 +1830,7 @@ allow_write_and_free_vma: + if (vm_flags & VM_DENYWRITE) + allow_write_access(file); + free_vma: +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + unacct_error: + if (charged) + vm_unacct_memory(charged); +@@ -2620,15 +2618,10 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, + return err; + } + +- new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ new = vm_area_dup(vma); + if (!new) + return -ENOMEM; + +- /* most fields are the same, copy all, and then fixup */ +- *new = *vma; +- +- INIT_LIST_HEAD(&new->anon_vma_chain); +- + if (new_below) + new->vm_end = addr; + else { +@@ -2669,7 +2662,7 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, + out_free_mpol: + mpol_put(vma_policy(new)); + out_free_vma: +- kmem_cache_free(vm_area_cachep, new); ++ vm_area_free(new); + return err; + } + +@@ -2984,14 +2977,12 @@ static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long fla + /* + * create a vma struct for an anonymous mapping + */ +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(mm); + if (!vma) { + vm_unacct_memory(len >> PAGE_SHIFT); + return -ENOMEM; + } + +- INIT_LIST_HEAD(&vma->anon_vma_chain); +- vma->vm_mm = mm; + vma->vm_start = addr; + vma->vm_end = addr + len; + vma->vm_pgoff = pgoff; +@@ -3202,16 +3193,14 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, + } + *need_rmap_locks = (new_vma->vm_pgoff <= vma->vm_pgoff); + } else { +- new_vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ new_vma = vm_area_dup(vma); + if (!new_vma) + goto out; +- *new_vma = *vma; + new_vma->vm_start = addr; + new_vma->vm_end = addr + len; + new_vma->vm_pgoff = pgoff; + if (vma_dup_policy(vma, new_vma)) + goto out_free_vma; +- INIT_LIST_HEAD(&new_vma->anon_vma_chain); + if (anon_vma_clone(new_vma, vma)) + goto out_free_mempol; + if (new_vma->vm_file) +@@ -3226,7 +3215,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, + out_free_mempol: + mpol_put(vma_policy(new_vma)); + out_free_vma: +- kmem_cache_free(vm_area_cachep, new_vma); ++ vm_area_free(new_vma); + out: + return NULL; + } +@@ -3350,12 +3339,10 @@ static struct vm_area_struct *__install_special_mapping( + int ret; + struct vm_area_struct *vma; + +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(mm); + if (unlikely(vma == NULL)) + return ERR_PTR(-ENOMEM); + +- INIT_LIST_HEAD(&vma->anon_vma_chain); +- vma->vm_mm = mm; + vma->vm_start = addr; + vma->vm_end = addr + len; + +@@ -3376,7 +3363,7 @@ static struct vm_area_struct *__install_special_mapping( + return vma; + + out: +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return ERR_PTR(ret); + } + +diff --git a/mm/nommu.c b/mm/nommu.c +index 13723736d38f..b7a2aa7f7c0f 100644 +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -769,7 +769,7 @@ static void delete_vma(struct mm_struct *mm, struct vm_area_struct *vma) + if (vma->vm_file) + fput(vma->vm_file); + put_nommu_region(vma->vm_region); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + } + + /* +@@ -1204,7 +1204,7 @@ unsigned long do_mmap(struct file *file, + if (!region) + goto error_getting_region; + +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(current->mm); + if (!vma) + goto error_getting_vma; + +@@ -1212,7 +1212,6 @@ unsigned long do_mmap(struct file *file, + region->vm_flags = vm_flags; + region->vm_pgoff = pgoff; + +- INIT_LIST_HEAD(&vma->anon_vma_chain); + vma->vm_flags = vm_flags; + vma->vm_pgoff = pgoff; + +@@ -1368,7 +1367,7 @@ error: + kmem_cache_free(vm_region_jar, region); + if (vma->vm_file) + fput(vma->vm_file); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return ret; + + sharing_violation: +@@ -1469,14 +1468,13 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma, + if (!region) + return -ENOMEM; + +- new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ new = vm_area_dup(vma); + if (!new) { + kmem_cache_free(vm_region_jar, region); + return -ENOMEM; + } + + /* most fields are the same, copy all, and then fixup */ +- *new = *vma; + *region = *vma->vm_region; + new->vm_region = region; + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 7b841a764dd0..e27bc10467c4 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -6933,9 +6933,21 @@ unsigned long free_reserved_area(void *start, void *end, int poison, char *s) + start = (void *)PAGE_ALIGN((unsigned long)start); + end = (void *)((unsigned long)end & PAGE_MASK); + for (pos = start; pos < end; pos += PAGE_SIZE, pages++) { ++ struct page *page = virt_to_page(pos); ++ void *direct_map_addr; ++ ++ /* ++ * 'direct_map_addr' might be different from 'pos' ++ * because some architectures' virt_to_page() ++ * work with aliases. Getting the direct map ++ * address ensures that we get a _writeable_ ++ * alias for the memset(). ++ */ ++ direct_map_addr = page_address(page); + if ((unsigned int)poison <= 0xFF) +- memset(pos, poison, PAGE_SIZE); +- free_reserved_page(virt_to_page(pos)); ++ memset(direct_map_addr, poison, PAGE_SIZE); ++ ++ free_reserved_page(page); + } + + if (pages && s) +diff --git a/net/9p/client.c b/net/9p/client.c +index 21e6df1cc70f..0ad6993aaa9b 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -228,7 +228,8 @@ static int parse_opts(char *opts, struct p9_client *clnt) + } + + free_and_return: +- v9fs_put_trans(clnt->trans_mod); ++ if (ret) ++ v9fs_put_trans(clnt->trans_mod); + kfree(tmp_options); + return ret; + } +diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c +index be09a9883825..73bf6a93a3cf 100644 +--- a/net/batman-adv/bat_iv_ogm.c ++++ b/net/batman-adv/bat_iv_ogm.c +@@ -2732,7 +2732,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + { + struct batadv_neigh_ifinfo *router_ifinfo = NULL; + struct batadv_neigh_node *router; +- struct batadv_gw_node *curr_gw; ++ struct batadv_gw_node *curr_gw = NULL; + int ret = 0; + void *hdr; + +@@ -2780,6 +2780,8 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + ret = 0; + + out: ++ if (curr_gw) ++ batadv_gw_node_put(curr_gw); + if (router_ifinfo) + batadv_neigh_ifinfo_put(router_ifinfo); + if (router) +diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c +index ec93337ee259..6baec4e68898 100644 +--- a/net/batman-adv/bat_v.c ++++ b/net/batman-adv/bat_v.c +@@ -927,7 +927,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + { + struct batadv_neigh_ifinfo *router_ifinfo = NULL; + struct batadv_neigh_node *router; +- struct batadv_gw_node *curr_gw; ++ struct batadv_gw_node *curr_gw = NULL; + int ret = 0; + void *hdr; + +@@ -995,6 +995,8 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + ret = 0; + + out: ++ if (curr_gw) ++ batadv_gw_node_put(curr_gw); + if (router_ifinfo) + batadv_neigh_ifinfo_put(router_ifinfo); + if (router) +diff --git a/net/batman-adv/debugfs.c b/net/batman-adv/debugfs.c +index 4229b01ac7b5..87479c60670e 100644 +--- a/net/batman-adv/debugfs.c ++++ b/net/batman-adv/debugfs.c +@@ -19,6 +19,7 @@ + #include "debugfs.h" + #include "main.h" + ++#include <linux/dcache.h> + #include <linux/debugfs.h> + #include <linux/err.h> + #include <linux/errno.h> +@@ -343,6 +344,25 @@ out: + return -ENOMEM; + } + ++/** ++ * batadv_debugfs_rename_hardif() - Fix debugfs path for renamed hardif ++ * @hard_iface: hard interface which was renamed ++ */ ++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface) ++{ ++ const char *name = hard_iface->net_dev->name; ++ struct dentry *dir; ++ struct dentry *d; ++ ++ dir = hard_iface->debug_dir; ++ if (!dir) ++ return; ++ ++ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name); ++ if (!d) ++ pr_err("Can't rename debugfs dir to %s\n", name); ++} ++ + /** + * batadv_debugfs_del_hardif() - delete the base directory for a hard interface + * in debugfs. +@@ -413,6 +433,26 @@ out: + return -ENOMEM; + } + ++/** ++ * batadv_debugfs_rename_meshif() - Fix debugfs path for renamed softif ++ * @dev: net_device which was renamed ++ */ ++void batadv_debugfs_rename_meshif(struct net_device *dev) ++{ ++ struct batadv_priv *bat_priv = netdev_priv(dev); ++ const char *name = dev->name; ++ struct dentry *dir; ++ struct dentry *d; ++ ++ dir = bat_priv->debug_dir; ++ if (!dir) ++ return; ++ ++ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name); ++ if (!d) ++ pr_err("Can't rename debugfs dir to %s\n", name); ++} ++ + /** + * batadv_debugfs_del_meshif() - Remove interface dependent debugfs entries + * @dev: netdev struct of the soft interface +diff --git a/net/batman-adv/debugfs.h b/net/batman-adv/debugfs.h +index 37b069698b04..08a592ffbee5 100644 +--- a/net/batman-adv/debugfs.h ++++ b/net/batman-adv/debugfs.h +@@ -30,8 +30,10 @@ struct net_device; + void batadv_debugfs_init(void); + void batadv_debugfs_destroy(void); + int batadv_debugfs_add_meshif(struct net_device *dev); ++void batadv_debugfs_rename_meshif(struct net_device *dev); + void batadv_debugfs_del_meshif(struct net_device *dev); + int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface); ++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface); + void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface); + + #else +@@ -49,6 +51,10 @@ static inline int batadv_debugfs_add_meshif(struct net_device *dev) + return 0; + } + ++static inline void batadv_debugfs_rename_meshif(struct net_device *dev) ++{ ++} ++ + static inline void batadv_debugfs_del_meshif(struct net_device *dev) + { + } +@@ -59,6 +65,11 @@ int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface) + return 0; + } + ++static inline ++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface) ++{ ++} ++ + static inline + void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface) + { +diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c +index c405d15befd6..2f0d42f2f913 100644 +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -989,6 +989,32 @@ void batadv_hardif_remove_interfaces(void) + rtnl_unlock(); + } + ++/** ++ * batadv_hard_if_event_softif() - Handle events for soft interfaces ++ * @event: NETDEV_* event to handle ++ * @net_dev: net_device which generated an event ++ * ++ * Return: NOTIFY_* result ++ */ ++static int batadv_hard_if_event_softif(unsigned long event, ++ struct net_device *net_dev) ++{ ++ struct batadv_priv *bat_priv; ++ ++ switch (event) { ++ case NETDEV_REGISTER: ++ batadv_sysfs_add_meshif(net_dev); ++ bat_priv = netdev_priv(net_dev); ++ batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS); ++ break; ++ case NETDEV_CHANGENAME: ++ batadv_debugfs_rename_meshif(net_dev); ++ break; ++ } ++ ++ return NOTIFY_DONE; ++} ++ + static int batadv_hard_if_event(struct notifier_block *this, + unsigned long event, void *ptr) + { +@@ -997,12 +1023,8 @@ static int batadv_hard_if_event(struct notifier_block *this, + struct batadv_hard_iface *primary_if = NULL; + struct batadv_priv *bat_priv; + +- if (batadv_softif_is_valid(net_dev) && event == NETDEV_REGISTER) { +- batadv_sysfs_add_meshif(net_dev); +- bat_priv = netdev_priv(net_dev); +- batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS); +- return NOTIFY_DONE; +- } ++ if (batadv_softif_is_valid(net_dev)) ++ return batadv_hard_if_event_softif(event, net_dev); + + hard_iface = batadv_hardif_get_by_netdev(net_dev); + if (!hard_iface && (event == NETDEV_REGISTER || +@@ -1051,6 +1073,9 @@ static int batadv_hard_if_event(struct notifier_block *this, + if (batadv_is_wifi_hardif(hard_iface)) + hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS; + break; ++ case NETDEV_CHANGENAME: ++ batadv_debugfs_rename_hardif(hard_iface); ++ break; + default: + break; + } +diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c +index 3986551397ca..12a2b7d21376 100644 +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -1705,7 +1705,9 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv, + ether_addr_copy(common->addr, tt_addr); + common->vid = vid; + +- common->flags = flags; ++ if (!is_multicast_ether_addr(common->addr)) ++ common->flags = flags & (~BATADV_TT_SYNC_MASK); ++ + tt_global_entry->roam_at = 0; + /* node must store current time in case of roaming. This is + * needed to purge this entry out on timeout (if nobody claims +@@ -1768,7 +1770,8 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv, + * TT_CLIENT_TEMP, therefore they have to be copied in the + * client entry + */ +- common->flags |= flags & (~BATADV_TT_SYNC_MASK); ++ if (!is_multicast_ether_addr(common->addr)) ++ common->flags |= flags & (~BATADV_TT_SYNC_MASK); + + /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only + * one originator left in the list and we previously received a +diff --git a/net/core/dev.c b/net/core/dev.c +index 1ccc2a2ac2e9..2d6b23e39833 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -8608,7 +8608,8 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char + /* We get here if we can't use the current device name */ + if (!pat) + goto out; +- if (dev_get_valid_name(net, dev, pat) < 0) ++ err = dev_get_valid_name(net, dev, pat); ++ if (err < 0) + goto out; + } + +@@ -8620,7 +8621,6 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char + dev_close(dev); + + /* And unlink it from device chain */ +- err = -ENODEV; + unlist_netdevice(dev); + + synchronize_net(); +diff --git a/net/core/filter.c b/net/core/filter.c +index 201ff36b17a8..a491dbb0a955 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2516,7 +2516,8 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff) + + static u32 __bpf_skb_max_len(const struct sk_buff *skb) + { +- return skb->dev->mtu + skb->dev->hard_header_len; ++ return skb->dev ? skb->dev->mtu + skb->dev->hard_header_len : ++ SKB_MAX_ALLOC; + } + + static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff) +diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c +index 275449b0d633..3297e7fa9945 100644 +--- a/net/ieee802154/6lowpan/core.c ++++ b/net/ieee802154/6lowpan/core.c +@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct net_device *dev, struct neighbour *n) + return 0; + } + ++static int lowpan_get_iflink(const struct net_device *dev) ++{ ++ return lowpan_802154_dev(dev)->wdev->ifindex; ++} ++ + static const struct net_device_ops lowpan_netdev_ops = { + .ndo_init = lowpan_dev_init, + .ndo_start_xmit = lowpan_xmit, + .ndo_open = lowpan_open, + .ndo_stop = lowpan_stop, + .ndo_neigh_construct = lowpan_neigh_construct, ++ .ndo_get_iflink = lowpan_get_iflink, + }; + + static void lowpan_setup(struct net_device *ldev) +diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c +index eeb6646aa892..0d70608cc2e1 100644 +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -90,7 +90,7 @@ static void inet_frags_free_cb(void *ptr, void *arg) + + void inet_frags_exit_net(struct netns_frags *nf) + { +- nf->low_thresh = 0; /* prevent creation of new frags */ ++ nf->high_thresh = 0; /* prevent creation of new frags */ + + rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL); + } +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index f6130704f052..1bf71e36f545 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1895,6 +1895,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = { + .checkentry = icmp_checkentry, + .proto = IPPROTO_ICMP, + .family = NFPROTO_IPV4, ++ .me = THIS_MODULE, + }, + }; + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 58e316cf6607..14c26a747e50 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1845,7 +1845,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock, + * shouldn't happen. + */ + if (WARN(before(*seq, TCP_SKB_CB(skb)->seq), +- "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n", ++ "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n", + *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, + flags)) + break; +@@ -1860,7 +1860,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock, + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) + goto found_fin_ok; + WARN(!(flags & MSG_PEEK), +- "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n", ++ "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n", + *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags); + } + +diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c +index 1a9b88c8cf72..8b637f9f23a2 100644 +--- a/net/ipv4/tcp_dctcp.c ++++ b/net/ipv4/tcp_dctcp.c +@@ -55,7 +55,6 @@ struct dctcp { + u32 dctcp_alpha; + u32 next_seq; + u32 ce_state; +- u32 delayed_ack_reserved; + u32 loss_cwnd; + }; + +@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk) + + ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA); + +- ca->delayed_ack_reserved = 0; + ca->loss_cwnd = 0; + ca->ce_state = 0; + +@@ -230,25 +228,6 @@ static void dctcp_state(struct sock *sk, u8 new_state) + } + } + +-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev) +-{ +- struct dctcp *ca = inet_csk_ca(sk); +- +- switch (ev) { +- case CA_EVENT_DELAYED_ACK: +- if (!ca->delayed_ack_reserved) +- ca->delayed_ack_reserved = 1; +- break; +- case CA_EVENT_NON_DELAYED_ACK: +- if (ca->delayed_ack_reserved) +- ca->delayed_ack_reserved = 0; +- break; +- default: +- /* Don't care for the rest. */ +- break; +- } +-} +- + static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev) + { + switch (ev) { +@@ -258,10 +237,6 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev) + case CA_EVENT_ECN_NO_CE: + dctcp_ce_state_1_to_0(sk); + break; +- case CA_EVENT_DELAYED_ACK: +- case CA_EVENT_NON_DELAYED_ACK: +- dctcp_update_ack_reserved(sk, ev); +- break; + default: + /* Don't care for the rest. */ + break; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 3049d10a1476..5a689b07bad7 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3545,8 +3545,6 @@ void tcp_send_delayed_ack(struct sock *sk) + int ato = icsk->icsk_ack.ato; + unsigned long timeout; + +- tcp_ca_event(sk, CA_EVENT_DELAYED_ACK); +- + if (ato > TCP_DELACK_MIN) { + const struct tcp_sock *tp = tcp_sk(sk); + int max_ato = HZ / 2; +@@ -3603,8 +3601,6 @@ void __tcp_send_ack(struct sock *sk, u32 rcv_nxt) + if (sk->sk_state == TCP_CLOSE) + return; + +- tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK); +- + /* We are not putting this on the write queue, so + * tcp_transmit_skb() will set the ownership to this + * sock. +diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c +index 1323b9679cf7..1c0bb9fb76e6 100644 +--- a/net/ipv6/calipso.c ++++ b/net/ipv6/calipso.c +@@ -799,8 +799,7 @@ static int calipso_opt_update(struct sock *sk, struct ipv6_opt_hdr *hop) + { + struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts; + +- txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS, +- hop, hop ? ipv6_optlen(hop) : 0); ++ txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop); + txopt_put(old); + if (IS_ERR(txopts)) + return PTR_ERR(txopts); +@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct request_sock *req, + if (IS_ERR(new)) + return PTR_ERR(new); + +- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, +- new, new ? ipv6_optlen(new) : 0); ++ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new); + + kfree(new); + +@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct request_sock *req) + if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new)) + return; /* Nothing to do */ + +- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, +- new, new ? ipv6_optlen(new) : 0); ++ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new); + + if (!IS_ERR(txopts)) { + txopts = xchg(&req_inet->ipv6_opt, txopts); +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index bc68eb661970..07a4d4232231 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -1028,29 +1028,21 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt) + } + EXPORT_SYMBOL_GPL(ipv6_dup_options); + +-static int ipv6_renew_option(void *ohdr, +- struct ipv6_opt_hdr __user *newopt, int newoptlen, +- int inherit, +- struct ipv6_opt_hdr **hdr, +- char **p) ++static void ipv6_renew_option(int renewtype, ++ struct ipv6_opt_hdr **dest, ++ struct ipv6_opt_hdr *old, ++ struct ipv6_opt_hdr *new, ++ int newtype, char **p) + { +- if (inherit) { +- if (ohdr) { +- memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr)); +- *hdr = (struct ipv6_opt_hdr *)*p; +- *p += CMSG_ALIGN(ipv6_optlen(*hdr)); +- } +- } else { +- if (newopt) { +- if (copy_from_user(*p, newopt, newoptlen)) +- return -EFAULT; +- *hdr = (struct ipv6_opt_hdr *)*p; +- if (ipv6_optlen(*hdr) > newoptlen) +- return -EINVAL; +- *p += CMSG_ALIGN(newoptlen); +- } +- } +- return 0; ++ struct ipv6_opt_hdr *src; ++ ++ src = (renewtype == newtype ? new : old); ++ if (!src) ++ return; ++ ++ memcpy(*p, src, ipv6_optlen(src)); ++ *dest = (struct ipv6_opt_hdr *)*p; ++ *p += CMSG_ALIGN(ipv6_optlen(*dest)); + } + + /** +@@ -1076,13 +1068,11 @@ static int ipv6_renew_option(void *ohdr, + */ + struct ipv6_txoptions * + ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, +- int newtype, +- struct ipv6_opt_hdr __user *newopt, int newoptlen) ++ int newtype, struct ipv6_opt_hdr *newopt) + { + int tot_len = 0; + char *p; + struct ipv6_txoptions *opt2; +- int err; + + if (opt) { + if (newtype != IPV6_HOPOPTS && opt->hopopt) +@@ -1095,8 +1085,8 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, + tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt)); + } + +- if (newopt && newoptlen) +- tot_len += CMSG_ALIGN(newoptlen); ++ if (newopt) ++ tot_len += CMSG_ALIGN(ipv6_optlen(newopt)); + + if (!tot_len) + return NULL; +@@ -1111,29 +1101,19 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, + opt2->tot_len = tot_len; + p = (char *)(opt2 + 1); + +- err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen, +- newtype != IPV6_HOPOPTS, +- &opt2->hopopt, &p); +- if (err) +- goto out; +- +- err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen, +- newtype != IPV6_RTHDRDSTOPTS, +- &opt2->dst0opt, &p); +- if (err) +- goto out; +- +- err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen, +- newtype != IPV6_RTHDR, +- (struct ipv6_opt_hdr **)&opt2->srcrt, &p); +- if (err) +- goto out; +- +- err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen, +- newtype != IPV6_DSTOPTS, +- &opt2->dst1opt, &p); +- if (err) +- goto out; ++ ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt, ++ (opt ? opt->hopopt : NULL), ++ newopt, newtype, &p); ++ ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt, ++ (opt ? opt->dst0opt : NULL), ++ newopt, newtype, &p); ++ ipv6_renew_option(IPV6_RTHDR, ++ (struct ipv6_opt_hdr **)&opt2->srcrt, ++ (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL), ++ newopt, newtype, &p); ++ ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt, ++ (opt ? opt->dst1opt : NULL), ++ newopt, newtype, &p); + + opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) + + (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) + +@@ -1141,37 +1121,6 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, + opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0); + + return opt2; +-out: +- sock_kfree_s(sk, opt2, opt2->tot_len); +- return ERR_PTR(err); +-} +- +-/** +- * ipv6_renew_options_kern - replace a specific ext hdr with a new one. +- * +- * @sk: sock from which to allocate memory +- * @opt: original options +- * @newtype: option type to replace in @opt +- * @newopt: new option of type @newtype to replace (kernel-mem) +- * @newoptlen: length of @newopt +- * +- * See ipv6_renew_options(). The difference is that @newopt is +- * kernel memory, rather than user memory. +- */ +-struct ipv6_txoptions * +-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt, +- int newtype, struct ipv6_opt_hdr *newopt, +- int newoptlen) +-{ +- struct ipv6_txoptions *ret_val; +- const mm_segment_t old_fs = get_fs(); +- +- set_fs(KERNEL_DS); +- ret_val = ipv6_renew_options(sk, opt, newtype, +- (struct ipv6_opt_hdr __user *)newopt, +- newoptlen); +- set_fs(old_fs); +- return ret_val; + } + + struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, +diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c +index 4d780c7f0130..c95c3486d904 100644 +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -398,6 +398,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + case IPV6_DSTOPTS: + { + struct ipv6_txoptions *opt; ++ struct ipv6_opt_hdr *new = NULL; ++ ++ /* hop-by-hop / destination options are privileged option */ ++ retv = -EPERM; ++ if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW)) ++ break; + + /* remove any sticky options header with a zero option + * length, per RFC3542. +@@ -409,17 +415,22 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + else if (optlen < sizeof(struct ipv6_opt_hdr) || + optlen & 0x7 || optlen > 8 * 255) + goto e_inval; +- +- /* hop-by-hop / destination options are privileged option */ +- retv = -EPERM; +- if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW)) +- break; ++ else { ++ new = memdup_user(optval, optlen); ++ if (IS_ERR(new)) { ++ retv = PTR_ERR(new); ++ break; ++ } ++ if (unlikely(ipv6_optlen(new) > optlen)) { ++ kfree(new); ++ goto e_inval; ++ } ++ } + + opt = rcu_dereference_protected(np->opt, + lockdep_sock_is_held(sk)); +- opt = ipv6_renew_options(sk, opt, optname, +- (struct ipv6_opt_hdr __user *)optval, +- optlen); ++ opt = ipv6_renew_options(sk, opt, optname, new); ++ kfree(new); + if (IS_ERR(opt)) { + retv = PTR_ERR(opt); + break; +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 0604a737eecf..a23cfd922509 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -2081,7 +2081,8 @@ void ipv6_mc_dad_complete(struct inet6_dev *idev) + mld_send_initial_cr(idev); + idev->mc_dad_count--; + if (idev->mc_dad_count) +- mld_dad_start_timer(idev, idev->mc_maxdelay); ++ mld_dad_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + } + +@@ -2093,7 +2094,8 @@ static void mld_dad_timer_expire(struct timer_list *t) + if (idev->mc_dad_count) { + idev->mc_dad_count--; + if (idev->mc_dad_count) +- mld_dad_start_timer(idev, idev->mc_maxdelay); ++ mld_dad_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + in6_dev_put(idev); + } +@@ -2451,7 +2453,8 @@ static void mld_ifc_timer_expire(struct timer_list *t) + if (idev->mc_ifc_count) { + idev->mc_ifc_count--; + if (idev->mc_ifc_count) +- mld_ifc_start_timer(idev, idev->mc_maxdelay); ++ mld_ifc_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + in6_dev_put(idev); + } +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 685c2168f524..1e518cedffea 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1907,6 +1907,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = { + .checkentry = icmp6_checkentry, + .proto = IPPROTO_ICMPV6, + .family = NFPROTO_IPV6, ++ .me = THIS_MODULE, + }, + }; + +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index eeb4d3098ff4..e4d9e6976d3c 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -107,7 +107,7 @@ static int nf_ct_frag6_sysctl_register(struct net *net) + if (hdr == NULL) + goto err_reg; + +- net->nf_frag.sysctl.frags_hdr = hdr; ++ net->nf_frag_frags_hdr = hdr; + return 0; + + err_reg: +@@ -121,8 +121,8 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net) + { + struct ctl_table *table; + +- table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg; +- unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr); ++ table = net->nf_frag_frags_hdr->ctl_table_arg; ++ unregister_net_sysctl_table(net->nf_frag_frags_hdr); + if (!net_eq(net, &init_net)) + kfree(table); + } +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 05a265cd573d..7404a5114597 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -4800,7 +4800,9 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev, + skb_reset_network_header(skb); + skb_reset_mac_header(skb); + ++ local_bh_disable(); + __ieee80211_subif_start_xmit(skb, skb->dev, flags); ++ local_bh_enable(); + + return 0; + } +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 41ff04ee2554..6b2fa4870237 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1972,7 +1972,7 @@ int nf_conntrack_set_hashsize(const char *val, const struct kernel_param *kp) + return -EOPNOTSUPP; + + /* On boot, we can set this without any fancy locking. */ +- if (!nf_conntrack_htable_size) ++ if (!nf_conntrack_hash) + return param_set_uint(val, kp); + + rc = kstrtouint(val, 0, &hashsize); +diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c +index 551a1eddf0fa..a75b11c39312 100644 +--- a/net/netfilter/nf_conntrack_helper.c ++++ b/net/netfilter/nf_conntrack_helper.c +@@ -465,6 +465,11 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) + + nf_ct_expect_iterate_destroy(expect_iter_me, NULL); + nf_ct_iterate_destroy(unhelp, me); ++ ++ /* Maybe someone has gotten the helper already when unhelp above. ++ * So need to wait it. ++ */ ++ synchronize_rcu(); + } + EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); + +diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c +index abe647d5b8c6..9ce6336d1e55 100644 +--- a/net/netfilter/nf_conntrack_proto_dccp.c ++++ b/net/netfilter/nf_conntrack_proto_dccp.c +@@ -243,14 +243,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] = + * We currently ignore Sync packets + * + * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ +- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, ++ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + }, + [DCCP_PKT_SYNCACK] = { + /* + * We currently ignore SyncAck packets + * + * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ +- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, ++ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + }, + }, + [CT_DCCP_ROLE_SERVER] = { +@@ -371,14 +371,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] = + * We currently ignore Sync packets + * + * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ +- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, ++ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + }, + [DCCP_PKT_SYNCACK] = { + /* + * We currently ignore SyncAck packets + * + * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ +- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, ++ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + }, + }, + }; +diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c +index a82dfb8f8790..d60589747afb 100644 +--- a/net/netfilter/nf_log.c ++++ b/net/netfilter/nf_log.c +@@ -439,6 +439,10 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write, + if (write) { + struct ctl_table tmp = *table; + ++ /* proc_dostring() can append to existing strings, so we need to ++ * initialize it as an empty string. ++ */ ++ buf[0] = '\0'; + tmp.data = buf; + r = proc_dostring(&tmp, write, buffer, lenp, ppos); + if (r) +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index 1d99a1efdafc..0210b40a529a 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -825,10 +825,18 @@ nft_target_select_ops(const struct nft_ctx *ctx, + rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); + family = ctx->family; + ++ if (strcmp(tg_name, XT_ERROR_TARGET) == 0 || ++ strcmp(tg_name, XT_STANDARD_TARGET) == 0 || ++ strcmp(tg_name, "standard") == 0) ++ return ERR_PTR(-EINVAL); ++ + /* Re-use the existing target if it's already loaded. */ + list_for_each_entry(nft_target, &nft_target_list, head) { + struct xt_target *target = nft_target->ops.data; + ++ if (!target->target) ++ continue; ++ + if (nft_target_cmp(target, tg_name, rev, family)) + return &nft_target->ops; + } +@@ -837,6 +845,11 @@ nft_target_select_ops(const struct nft_ctx *ctx, + if (IS_ERR(target)) + return ERR_PTR(-ENOENT); + ++ if (!target->target) { ++ err = -EINVAL; ++ goto err; ++ } ++ + if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) { + err = -EINVAL; + goto err; +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index cb0f02785749..af663a27c191 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2910,6 +2910,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + goto out_free; + } else if (reserve) { + skb_reserve(skb, -reserve); ++ if (len < reserve) ++ skb_reset_network_header(skb); + } + + /* Returns -EFAULT on error */ +@@ -4256,6 +4258,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + } + + if (req->tp_block_nr) { ++ unsigned int min_frame_size; ++ + /* Sanity tests and some calculations */ + err = -EBUSY; + if (unlikely(rb->pg_vec)) +@@ -4278,12 +4282,12 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + goto out; + if (unlikely(!PAGE_ALIGNED(req->tp_block_size))) + goto out; ++ min_frame_size = po->tp_hdrlen + po->tp_reserve; + if (po->tp_version >= TPACKET_V3 && +- req->tp_block_size <= +- BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr)) ++ req->tp_block_size < ++ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size) + goto out; +- if (unlikely(req->tp_frame_size < po->tp_hdrlen + +- po->tp_reserve)) ++ if (unlikely(req->tp_frame_size < min_frame_size)) + goto out; + if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) + goto out; +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c +index 2aa07b547b16..86e1e37eb4e8 100644 +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -191,8 +191,13 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb, + hdr->type = cpu_to_le32(type); + hdr->src_node_id = cpu_to_le32(from->sq_node); + hdr->src_port_id = cpu_to_le32(from->sq_port); +- hdr->dst_node_id = cpu_to_le32(to->sq_node); +- hdr->dst_port_id = cpu_to_le32(to->sq_port); ++ if (to->sq_port == QRTR_PORT_CTRL) { ++ hdr->dst_node_id = cpu_to_le32(node->nid); ++ hdr->dst_port_id = cpu_to_le32(QRTR_NODE_BCAST); ++ } else { ++ hdr->dst_node_id = cpu_to_le32(to->sq_node); ++ hdr->dst_port_id = cpu_to_le32(to->sq_port); ++ } + + hdr->size = cpu_to_le32(len); + hdr->confirm_rx = 0; +@@ -764,6 +769,10 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + node = NULL; + if (addr->sq_node == QRTR_NODE_BCAST) { + enqueue_fn = qrtr_bcast_enqueue; ++ if (addr->sq_port != QRTR_PORT_CTRL) { ++ release_sock(sk); ++ return -ENOTCONN; ++ } + } else if (addr->sq_node == ipc->us.sq_node) { + enqueue_fn = qrtr_local_enqueue; + } else { +diff --git a/net/rds/connection.c b/net/rds/connection.c +index abef75da89a7..cfb05953b0e5 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -659,11 +659,19 @@ static void rds_conn_info(struct socket *sock, unsigned int len, + + int rds_conn_init(void) + { ++ int ret; ++ ++ ret = rds_loop_net_init(); /* register pernet callback */ ++ if (ret) ++ return ret; ++ + rds_conn_slab = kmem_cache_create("rds_connection", + sizeof(struct rds_connection), + 0, 0, NULL); +- if (!rds_conn_slab) ++ if (!rds_conn_slab) { ++ rds_loop_net_exit(); + return -ENOMEM; ++ } + + rds_info_register_func(RDS_INFO_CONNECTIONS, rds_conn_info); + rds_info_register_func(RDS_INFO_SEND_MESSAGES, +@@ -676,6 +684,7 @@ int rds_conn_init(void) + + void rds_conn_exit(void) + { ++ rds_loop_net_exit(); /* unregister pernet callback */ + rds_loop_exit(); + + WARN_ON(!hlist_empty(rds_conn_hash)); +diff --git a/net/rds/loop.c b/net/rds/loop.c +index dac6218a460e..feea1f96ee2a 100644 +--- a/net/rds/loop.c ++++ b/net/rds/loop.c +@@ -33,6 +33,8 @@ + #include <linux/kernel.h> + #include <linux/slab.h> + #include <linux/in.h> ++#include <net/net_namespace.h> ++#include <net/netns/generic.h> + + #include "rds_single_path.h" + #include "rds.h" +@@ -40,6 +42,17 @@ + + static DEFINE_SPINLOCK(loop_conns_lock); + static LIST_HEAD(loop_conns); ++static atomic_t rds_loop_unloading = ATOMIC_INIT(0); ++ ++static void rds_loop_set_unloading(void) ++{ ++ atomic_set(&rds_loop_unloading, 1); ++} ++ ++static bool rds_loop_is_unloading(struct rds_connection *conn) ++{ ++ return atomic_read(&rds_loop_unloading) != 0; ++} + + /* + * This 'loopback' transport is a special case for flows that originate +@@ -165,6 +178,8 @@ void rds_loop_exit(void) + struct rds_loop_connection *lc, *_lc; + LIST_HEAD(tmp_list); + ++ rds_loop_set_unloading(); ++ synchronize_rcu(); + /* avoid calling conn_destroy with irqs off */ + spin_lock_irq(&loop_conns_lock); + list_splice(&loop_conns, &tmp_list); +@@ -177,6 +192,46 @@ void rds_loop_exit(void) + } + } + ++static void rds_loop_kill_conns(struct net *net) ++{ ++ struct rds_loop_connection *lc, *_lc; ++ LIST_HEAD(tmp_list); ++ ++ spin_lock_irq(&loop_conns_lock); ++ list_for_each_entry_safe(lc, _lc, &loop_conns, loop_node) { ++ struct net *c_net = read_pnet(&lc->conn->c_net); ++ ++ if (net != c_net) ++ continue; ++ list_move_tail(&lc->loop_node, &tmp_list); ++ } ++ spin_unlock_irq(&loop_conns_lock); ++ ++ list_for_each_entry_safe(lc, _lc, &tmp_list, loop_node) { ++ WARN_ON(lc->conn->c_passive); ++ rds_conn_destroy(lc->conn); ++ } ++} ++ ++static void __net_exit rds_loop_exit_net(struct net *net) ++{ ++ rds_loop_kill_conns(net); ++} ++ ++static struct pernet_operations rds_loop_net_ops = { ++ .exit = rds_loop_exit_net, ++}; ++ ++int rds_loop_net_init(void) ++{ ++ return register_pernet_device(&rds_loop_net_ops); ++} ++ ++void rds_loop_net_exit(void) ++{ ++ unregister_pernet_device(&rds_loop_net_ops); ++} ++ + /* + * This is missing .xmit_* because loop doesn't go through generic + * rds_send_xmit() and doesn't call rds_recv_incoming(). .listen_stop and +@@ -194,4 +249,5 @@ struct rds_transport rds_loop_transport = { + .inc_free = rds_loop_inc_free, + .t_name = "loopback", + .t_type = RDS_TRANS_LOOP, ++ .t_unloading = rds_loop_is_unloading, + }; +diff --git a/net/rds/loop.h b/net/rds/loop.h +index 469fa4b2da4f..bbc8cdd030df 100644 +--- a/net/rds/loop.h ++++ b/net/rds/loop.h +@@ -5,6 +5,8 @@ + /* loop.c */ + extern struct rds_transport rds_loop_transport; + ++int rds_loop_net_init(void); ++void rds_loop_net_exit(void); + void rds_loop_exit(void); + + #endif +diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c +index 7e28b2ce1437..e65cc4d35cee 100644 +--- a/net/sched/act_csum.c ++++ b/net/sched/act_csum.c +@@ -91,7 +91,7 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla, + } + params_old = rtnl_dereference(p->params); + +- params_new->action = parm->action; ++ p->tcf_action = parm->action; + params_new->update_flags = parm->update_flags; + rcu_assign_pointer(p->params, params_new); + if (params_old) +@@ -561,7 +561,7 @@ static int tcf_csum(struct sk_buff *skb, const struct tc_action *a, + tcf_lastuse_update(&p->tcf_tm); + bstats_cpu_update(this_cpu_ptr(p->common.cpu_bstats), skb); + +- action = params->action; ++ action = READ_ONCE(p->tcf_action); + if (unlikely(action == TC_ACT_SHOT)) + goto drop_stats; + +@@ -599,11 +599,11 @@ static int tcf_csum_dump(struct sk_buff *skb, struct tc_action *a, int bind, + .index = p->tcf_index, + .refcnt = p->tcf_refcnt - ref, + .bindcnt = p->tcf_bindcnt - bind, ++ .action = p->tcf_action, + }; + struct tcf_t t; + + params = rtnl_dereference(p->params); +- opt.action = params->action; + opt.update_flags = params->update_flags; + + if (nla_put(skb, TCA_CSUM_PARMS, sizeof(opt), &opt)) +diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c +index 626dac81a48a..9bc6c2ae98a5 100644 +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -36,7 +36,7 @@ static int tunnel_key_act(struct sk_buff *skb, const struct tc_action *a, + + tcf_lastuse_update(&t->tcf_tm); + bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb); +- action = params->action; ++ action = READ_ONCE(t->tcf_action); + + switch (params->tcft_action) { + case TCA_TUNNEL_KEY_ACT_RELEASE: +@@ -182,7 +182,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla, + + params_old = rtnl_dereference(t->params); + +- params_new->action = parm->action; ++ t->tcf_action = parm->action; + params_new->tcft_action = parm->t_action; + params_new->tcft_enc_metadata = metadata; + +@@ -254,13 +254,13 @@ static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a, + .index = t->tcf_index, + .refcnt = t->tcf_refcnt - ref, + .bindcnt = t->tcf_bindcnt - bind, ++ .action = t->tcf_action, + }; + struct tcf_t tm; + + params = rtnl_dereference(t->params); + + opt.t_action = params->tcft_action; +- opt.action = params->action; + + if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt)) + goto nla_put_failure; +diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c +index be296d633e95..ded86c449c49 100644 +--- a/net/sctp/chunk.c ++++ b/net/sctp/chunk.c +@@ -247,7 +247,9 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc, + /* Account for a different sized first fragment */ + if (msg_len >= first_len) { + msg->can_delay = 0; +- SCTP_INC_STATS(sock_net(asoc->base.sk), SCTP_MIB_FRAGUSRMSGS); ++ if (msg_len > first_len) ++ SCTP_INC_STATS(sock_net(asoc->base.sk), ++ SCTP_MIB_FRAGUSRMSGS); + } else { + /* Which may be the only one... */ + first_len = msg_len; +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 544bab42f925..9c5f447fa366 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1231,8 +1231,7 @@ static int smc_shutdown(struct socket *sock, int how) + lock_sock(sk); + + rc = -ENOTCONN; +- if ((sk->sk_state != SMC_LISTEN) && +- (sk->sk_state != SMC_ACTIVE) && ++ if ((sk->sk_state != SMC_ACTIVE) && + (sk->sk_state != SMC_PEERCLOSEWAIT1) && + (sk->sk_state != SMC_PEERCLOSEWAIT2) && + (sk->sk_state != SMC_APPCLOSEWAIT1) && +diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c +index 3a988c22f627..49062e752cbf 100644 +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -250,6 +250,7 @@ out: + int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, + u8 expected_type) + { ++ long rcvtimeo = smc->clcsock->sk->sk_rcvtimeo; + struct sock *clc_sk = smc->clcsock->sk; + struct smc_clc_msg_hdr *clcm = buf; + struct msghdr msg = {NULL, 0}; +@@ -306,7 +307,6 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, + memset(&msg, 0, sizeof(struct msghdr)); + iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &vec, 1, datlen); + krflags = MSG_WAITALL; +- smc->clcsock->sk->sk_rcvtimeo = CLC_WAIT_TIME; + len = sock_recvmsg(smc->clcsock, &msg, krflags); + if (len < datlen || !smc_clc_msg_hdr_valid(clcm)) { + smc->sk.sk_err = EPROTO; +@@ -322,6 +322,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, + } + + out: ++ smc->clcsock->sk->sk_rcvtimeo = rcvtimeo; + return reason_code; + } + +diff --git a/net/tipc/discover.c b/net/tipc/discover.c +index 9f666e0650e2..2830709957bd 100644 +--- a/net/tipc/discover.c ++++ b/net/tipc/discover.c +@@ -133,6 +133,8 @@ static void disc_dupl_alert(struct tipc_bearer *b, u32 node_addr, + } + + /* tipc_disc_addr_trial(): - handle an address uniqueness trial from peer ++ * Returns true if message should be dropped by caller, i.e., if it is a ++ * trial message or we are inside trial period. Otherwise false. + */ + static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d, + struct tipc_media_addr *maddr, +@@ -168,8 +170,9 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d, + msg_set_type(buf_msg(d->skb), DSC_REQ_MSG); + } + ++ /* Accept regular link requests/responses only after trial period */ + if (mtyp != DSC_TRIAL_MSG) +- return false; ++ return trial; + + sugg_addr = tipc_node_try_addr(net, peer_id, src); + if (sugg_addr) +@@ -284,7 +287,6 @@ static void tipc_disc_timeout(struct timer_list *t) + { + struct tipc_discoverer *d = from_timer(d, t, timer); + struct tipc_net *tn = tipc_net(d->net); +- u32 self = tipc_own_addr(d->net); + struct tipc_media_addr maddr; + struct sk_buff *skb = NULL; + struct net *net = d->net; +@@ -298,12 +300,14 @@ static void tipc_disc_timeout(struct timer_list *t) + goto exit; + } + +- /* Did we just leave the address trial period ? */ +- if (!self && !time_before(jiffies, tn->addr_trial_end)) { +- self = tn->trial_addr; +- tipc_net_finalize(net, self); +- msg_set_prevnode(buf_msg(d->skb), self); ++ /* Trial period over ? */ ++ if (!time_before(jiffies, tn->addr_trial_end)) { ++ /* Did we just leave it ? */ ++ if (!tipc_own_addr(net)) ++ tipc_net_finalize(net, tn->trial_addr); ++ + msg_set_type(buf_msg(d->skb), DSC_REQ_MSG); ++ msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net)); + } + + /* Adjust timeout interval according to discovery phase */ +diff --git a/net/tipc/net.c b/net/tipc/net.c +index 4fbaa0464405..a7f6964c3a4b 100644 +--- a/net/tipc/net.c ++++ b/net/tipc/net.c +@@ -121,12 +121,17 @@ int tipc_net_init(struct net *net, u8 *node_id, u32 addr) + + void tipc_net_finalize(struct net *net, u32 addr) + { +- tipc_set_node_addr(net, addr); +- smp_mb(); +- tipc_named_reinit(net); +- tipc_sk_reinit(net); +- tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr, +- TIPC_CLUSTER_SCOPE, 0, addr); ++ struct tipc_net *tn = tipc_net(net); ++ ++ spin_lock_bh(&tn->node_list_lock); ++ if (!tipc_own_addr(net)) { ++ tipc_set_node_addr(net, addr); ++ tipc_named_reinit(net); ++ tipc_sk_reinit(net); ++ tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr, ++ TIPC_CLUSTER_SCOPE, 0, addr); ++ } ++ spin_unlock_bh(&tn->node_list_lock); + } + + void tipc_net_stop(struct net *net) +diff --git a/net/tipc/node.c b/net/tipc/node.c +index f29549de9245..aa09c515775f 100644 +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -776,6 +776,7 @@ static u32 tipc_node_suggest_addr(struct net *net, u32 addr) + } + + /* tipc_node_try_addr(): Check if addr can be used by peer, suggest other if not ++ * Returns suggested address if any, otherwise 0 + */ + u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr) + { +@@ -798,12 +799,14 @@ u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr) + if (n) { + addr = n->addr; + tipc_node_put(n); ++ return addr; + } +- /* Even this node may be in trial phase */ ++ ++ /* Even this node may be in conflict */ + if (tn->trial_addr == addr) + return tipc_node_suggest_addr(net, addr); + +- return addr; ++ return 0; + } + + void tipc_node_check_dest(struct net *net, u32 addr, +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 60708a4ebed4..237e227c9707 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -705,6 +705,10 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb, + nsg = skb_to_sgvec(skb, &sgin[1], + rxm->offset + tls_ctx->rx.prepend_size, + rxm->full_len - tls_ctx->rx.prepend_size); ++ if (nsg < 0) { ++ ret = nsg; ++ goto out; ++ } + + tls_make_aad(ctx->rx_aad_ciphertext, + rxm->full_len - tls_ctx->rx.overhead_size, +@@ -716,6 +720,7 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb, + rxm->full_len - tls_ctx->rx.overhead_size, + skb, sk->sk_allocation); + ++out: + if (sgin != &sgin_arr[0]) + kfree(sgin); + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 7c5135a92d76..f8e4371a1129 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -6061,7 +6061,7 @@ do { \ + nl80211_check_s32); + /* + * Check HT operation mode based on +- * IEEE 802.11 2012 8.4.2.59 HT Operation element. ++ * IEEE 802.11-2016 9.4.2.57 HT Operation element. + */ + if (tb[NL80211_MESHCONF_HT_OPMODE]) { + ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); +@@ -6071,22 +6071,9 @@ do { \ + IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) + return -EINVAL; + +- if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) && +- (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) +- return -EINVAL; ++ /* NON_HT_STA bit is reserved, but some programs set it */ ++ ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; + +- switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) { +- case IEEE80211_HT_OP_MODE_PROTECTION_NONE: +- case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ: +- if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT) +- return -EINVAL; +- break; +- case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER: +- case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED: +- if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) +- return -EINVAL; +- break; +- } + cfg->ht_opmode = ht_opmode; + mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); + } +@@ -10716,9 +10703,12 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) + rem) { + u8 *mask_pat; + +- nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, +- nl80211_packet_pattern_policy, +- info->extack); ++ err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, ++ nl80211_packet_pattern_policy, ++ info->extack); ++ if (err) ++ goto error; ++ + err = -EINVAL; + if (!pat_tb[NL80211_PKTPAT_MASK] || + !pat_tb[NL80211_PKTPAT_PATTERN]) +@@ -10967,8 +10957,11 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, + rem) { + u8 *mask_pat; + +- nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, +- nl80211_packet_pattern_policy, NULL); ++ err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, ++ nl80211_packet_pattern_policy, NULL); ++ if (err) ++ return err; ++ + if (!pat_tb[NL80211_PKTPAT_MASK] || + !pat_tb[NL80211_PKTPAT_PATTERN]) + return -EINVAL; +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 080035f056d9..1e50b70ad668 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1671,9 +1671,11 @@ static inline unsigned int userpolicy_type_attrsize(void) + #ifdef CONFIG_XFRM_SUB_POLICY + static int copy_to_user_policy_type(u8 type, struct sk_buff *skb) + { +- struct xfrm_userpolicy_type upt = { +- .type = type, +- }; ++ struct xfrm_userpolicy_type upt; ++ ++ /* Sadly there are two holes in struct xfrm_userpolicy_type */ ++ memset(&upt, 0, sizeof(upt)); ++ upt.type = type; + + return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt); + } +diff --git a/samples/bpf/parse_varlen.c b/samples/bpf/parse_varlen.c +index 95c16324760c..0b6f22feb2c9 100644 +--- a/samples/bpf/parse_varlen.c ++++ b/samples/bpf/parse_varlen.c +@@ -6,6 +6,7 @@ + */ + #define KBUILD_MODNAME "foo" + #include <linux/if_ether.h> ++#include <linux/if_vlan.h> + #include <linux/ip.h> + #include <linux/ipv6.h> + #include <linux/in.h> +@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64_t nh_off, void *data_end) + return 0; + } + +-struct vlan_hdr { +- uint16_t h_vlan_TCI; +- uint16_t h_vlan_encapsulated_proto; +-}; +- + SEC("varlen") + int handle_ingress(struct __sk_buff *skb) + { +diff --git a/samples/bpf/test_overhead_user.c b/samples/bpf/test_overhead_user.c +index e1d35e07a10e..da71dcc21634 100644 +--- a/samples/bpf/test_overhead_user.c ++++ b/samples/bpf/test_overhead_user.c +@@ -6,6 +6,7 @@ + */ + #define _GNU_SOURCE + #include <sched.h> ++#include <errno.h> + #include <stdio.h> + #include <sys/types.h> + #include <asm/unistd.h> +@@ -44,8 +45,13 @@ static void test_task_rename(int cpu) + exit(1); + } + start_time = time_get_ns(); +- for (i = 0; i < MAX_CNT; i++) +- write(fd, buf, sizeof(buf)); ++ for (i = 0; i < MAX_CNT; i++) { ++ if (write(fd, buf, sizeof(buf)) < 0) { ++ printf("task rename failed: %s\n", strerror(errno)); ++ close(fd); ++ return; ++ } ++ } + printf("task_rename:%d: %lld events per sec\n", + cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time)); + close(fd); +@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu) + exit(1); + } + start_time = time_get_ns(); +- for (i = 0; i < MAX_CNT; i++) +- read(fd, buf, sizeof(buf)); ++ for (i = 0; i < MAX_CNT; i++) { ++ if (read(fd, buf, sizeof(buf)) < 0) { ++ printf("failed to read from /dev/urandom: %s\n", strerror(errno)); ++ close(fd); ++ return; ++ } ++ } + printf("urandom_read:%d: %lld events per sec\n", + cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time)); + close(fd); +diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c +index 56f7a259a7c9..ff2b8dae25ec 100644 +--- a/samples/bpf/trace_event_user.c ++++ b/samples/bpf/trace_event_user.c +@@ -121,6 +121,16 @@ static void print_stacks(void) + } + } + ++static inline int generate_load(void) ++{ ++ if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) { ++ printf("failed to generate some load with dd: %s\n", strerror(errno)); ++ return -1; ++ } ++ ++ return 0; ++} ++ + static void test_perf_event_all_cpu(struct perf_event_attr *attr) + { + int nr_cpus = sysconf(_SC_NPROCESSORS_CONF); +@@ -141,7 +151,11 @@ static void test_perf_event_all_cpu(struct perf_event_attr *attr) + assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0); + assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_ENABLE) == 0); + } +- system("dd if=/dev/zero of=/dev/null count=5000k status=none"); ++ ++ if (generate_load() < 0) { ++ error = 1; ++ goto all_cpu_err; ++ } + print_stacks(); + all_cpu_err: + for (i--; i >= 0; i--) { +@@ -155,7 +169,7 @@ all_cpu_err: + + static void test_perf_event_task(struct perf_event_attr *attr) + { +- int pmu_fd; ++ int pmu_fd, error = 0; + + /* per task perf event, enable inherit so the "dd ..." command can be traced properly. + * Enabling inherit will cause bpf_perf_prog_read_time helper failure. +@@ -170,10 +184,17 @@ static void test_perf_event_task(struct perf_event_attr *attr) + } + assert(ioctl(pmu_fd, PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0); + assert(ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE) == 0); +- system("dd if=/dev/zero of=/dev/null count=5000k status=none"); ++ ++ if (generate_load() < 0) { ++ error = 1; ++ goto err; ++ } + print_stacks(); ++err: + ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE); + close(pmu_fd); ++ if (error) ++ int_exit(0); + } + + static void test_bpf_perf_event(void) +diff --git a/samples/bpf/xdp2skb_meta.sh b/samples/bpf/xdp2skb_meta.sh +index b9c9549c4c27..4bde9d066c46 100755 +--- a/samples/bpf/xdp2skb_meta.sh ++++ b/samples/bpf/xdp2skb_meta.sh +@@ -16,8 +16,8 @@ + BPF_FILE=xdp2skb_meta_kern.o + DIR=$(dirname $0) + +-export TC=/usr/sbin/tc +-export IP=/usr/sbin/ip ++[ -z "$TC" ] && TC=tc ++[ -z "$IP" ] && IP=ip + + function usage() { + echo "" +@@ -53,7 +53,7 @@ function _call_cmd() { + local allow_fail="$2" + shift 2 + if [[ -n "$VERBOSE" ]]; then +- echo "$(basename $cmd) $@" ++ echo "$cmd $@" + fi + if [[ -n "$DRYRUN" ]]; then + return +diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y +index ad6305b0f40c..f8f7cea86d7a 100644 +--- a/scripts/kconfig/zconf.y ++++ b/scripts/kconfig/zconf.y +@@ -31,7 +31,7 @@ struct symbol *symbol_hash[SYMBOL_HASHSIZE]; + static struct menu *current_menu, *current_entry; + + %} +-%expect 32 ++%expect 31 + + %union + { +@@ -345,7 +345,7 @@ choice_block: + + /* if entry */ + +-if_entry: T_IF expr nl ++if_entry: T_IF expr T_EOL + { + printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno()); + menu_add_entry(NULL); +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 0b414836bebd..60419cc2b7b8 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2296,6 +2296,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode) + struct smack_known *skp = smk_of_task_struct(p); + + isp->smk_inode = skp; ++ isp->smk_flags |= SMK_INODE_INSTANT; + } + + /* +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index ee8d0d86f0df..6fd4b074b206 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -2004,7 +2004,8 @@ static int snd_seq_ioctl_query_next_client(struct snd_seq_client *client, + struct snd_seq_client *cptr = NULL; + + /* search for next client */ +- info->client++; ++ if (info->client < INT_MAX) ++ info->client++; + if (info->client < 0) + info->client = 0; + for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) { +diff --git a/tools/build/Build.include b/tools/build/Build.include +index d9048f145f97..950c1504ca37 100644 +--- a/tools/build/Build.include ++++ b/tools/build/Build.include +@@ -98,4 +98,4 @@ cxx_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(CXXFLAGS) -D"BUILD_STR(s)=\#s" $(CXX + ### + ## HOSTCC C flags + +-host_c_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(CHOSTFLAGS) -D"BUILD_STR(s)=\#s" $(CHOSTFLAGS_$(basetarget).o) $(CHOSTFLAGS_$(obj)) ++host_c_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(HOSTCFLAGS) -D"BUILD_STR(s)=\#s" $(HOSTCFLAGS_$(basetarget).o) $(HOSTCFLAGS_$(obj)) +diff --git a/tools/build/Makefile b/tools/build/Makefile +index 5eb4b5ad79cb..5edf65e684ab 100644 +--- a/tools/build/Makefile ++++ b/tools/build/Makefile +@@ -43,7 +43,7 @@ $(OUTPUT)fixdep-in.o: FORCE + $(Q)$(MAKE) $(build)=fixdep + + $(OUTPUT)fixdep: $(OUTPUT)fixdep-in.o +- $(QUIET_LINK)$(HOSTCC) $(LDFLAGS) -o $@ $< ++ $(QUIET_LINK)$(HOSTCC) $(HOSTLDFLAGS) -o $@ $< + + FORCE: + +diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c +index 4e60e105583e..0d1acb704f64 100644 +--- a/tools/objtool/elf.c ++++ b/tools/objtool/elf.c +@@ -302,19 +302,34 @@ static int read_symbols(struct elf *elf) + continue; + sym->pfunc = sym->cfunc = sym; + coldstr = strstr(sym->name, ".cold."); +- if (coldstr) { +- coldstr[0] = '\0'; +- pfunc = find_symbol_by_name(elf, sym->name); +- coldstr[0] = '.'; +- +- if (!pfunc) { +- WARN("%s(): can't find parent function", +- sym->name); +- goto err; +- } +- +- sym->pfunc = pfunc; +- pfunc->cfunc = sym; ++ if (!coldstr) ++ continue; ++ ++ coldstr[0] = '\0'; ++ pfunc = find_symbol_by_name(elf, sym->name); ++ coldstr[0] = '.'; ++ ++ if (!pfunc) { ++ WARN("%s(): can't find parent function", ++ sym->name); ++ goto err; ++ } ++ ++ sym->pfunc = pfunc; ++ pfunc->cfunc = sym; ++ ++ /* ++ * Unfortunately, -fnoreorder-functions puts the child ++ * inside the parent. Remove the overlap so we can ++ * have sane assumptions. ++ * ++ * Note that pfunc->len now no longer matches ++ * pfunc->sym.st_size. ++ */ ++ if (sym->sec == pfunc->sec && ++ sym->offset >= pfunc->offset && ++ sym->offset + sym->len == pfunc->offset + pfunc->len) { ++ pfunc->len -= sym->len; + } + } + } +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index ae7dc46e8f8a..46d69c5d2ec3 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -207,8 +207,7 @@ ifdef PYTHON_CONFIG + PYTHON_EMBED_LDOPTS := $(shell $(PYTHON_CONFIG_SQ) --ldflags 2>/dev/null) + PYTHON_EMBED_LDFLAGS := $(call strip-libs,$(PYTHON_EMBED_LDOPTS)) + PYTHON_EMBED_LIBADD := $(call grep-libs,$(PYTHON_EMBED_LDOPTS)) -lutil +- PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --cflags 2>/dev/null) +- PYTHON_EMBED_CCOPTS := $(filter-out -specs=%,$(PYTHON_EMBED_CCOPTS)) ++ PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --includes 2>/dev/null) + FLAGS_PYTHON_EMBED := $(PYTHON_EMBED_CCOPTS) $(PYTHON_EMBED_LDOPTS) + endif + +diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +index 0c370f81e002..bd630c222e65 100644 +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) + u64 ip; + u64 skip_slot = -1; + +- if (chain->nr < 3) ++ if (!chain || chain->nr < 3) + return skip_slot; + + ip = chain->ips[2]; +diff --git a/tools/perf/arch/x86/util/perf_regs.c b/tools/perf/arch/x86/util/perf_regs.c +index 4b2caf6d48e7..fead6b3b4206 100644 +--- a/tools/perf/arch/x86/util/perf_regs.c ++++ b/tools/perf/arch/x86/util/perf_regs.c +@@ -226,7 +226,7 @@ int arch_sdt_arg_parse_op(char *old_op, char **new_op) + else if (rm[2].rm_so != rm[2].rm_eo) + prefix[0] = '+'; + else +- strncpy(prefix, "+0", 2); ++ scnprintf(prefix, sizeof(prefix), "+0"); + } + + /* Rename register */ +diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c +index 63eb49082774..44195514b19e 100644 +--- a/tools/perf/bench/numa.c ++++ b/tools/perf/bench/numa.c +@@ -1098,7 +1098,7 @@ static void *worker_thread(void *__tdata) + u8 *global_data; + u8 *process_data; + u8 *thread_data; +- u64 bytes_done; ++ u64 bytes_done, secs; + long work_done; + u32 l; + struct rusage rusage; +@@ -1254,7 +1254,8 @@ static void *worker_thread(void *__tdata) + timersub(&stop, &start0, &diff); + td->runtime_ns = diff.tv_sec * NSEC_PER_SEC; + td->runtime_ns += diff.tv_usec * NSEC_PER_USEC; +- td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9; ++ secs = td->runtime_ns / NSEC_PER_SEC; ++ td->speed_gbs = secs ? bytes_done / secs / 1e9 : 0; + + getrusage(RUSAGE_THREAD, &rusage); + td->system_time_ns = rusage.ru_stime.tv_sec * NSEC_PER_SEC; +diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c +index 51709a961496..3eeb6420ceea 100644 +--- a/tools/perf/builtin-annotate.c ++++ b/tools/perf/builtin-annotate.c +@@ -283,6 +283,15 @@ out_put: + return ret; + } + ++static int process_feature_event(struct perf_tool *tool, ++ union perf_event *event, ++ struct perf_session *session) ++{ ++ if (event->feat.feat_id < HEADER_LAST_FEATURE) ++ return perf_event__process_feature(tool, event, session); ++ return 0; ++} ++ + static int hist_entry__tty_annotate(struct hist_entry *he, + struct perf_evsel *evsel, + struct perf_annotate *ann) +@@ -471,7 +480,7 @@ int cmd_annotate(int argc, const char **argv) + .attr = perf_event__process_attr, + .build_id = perf_event__process_build_id, + .tracing_data = perf_event__process_tracing_data, +- .feature = perf_event__process_feature, ++ .feature = process_feature_event, + .ordered_events = true, + .ordering_requires_timestamps = true, + }, +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index 0f198f6d9b77..e5f0782b225d 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -226,7 +226,8 @@ static int process_feature_event(struct perf_tool *tool, + } + + /* +- * All features are received, we can force the ++ * (feat_id = HEADER_LAST_FEATURE) is the end marker which ++ * means all features are received, now we can force the + * group if needed. + */ + setup_forced_leader(rep, session->evlist); +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index e0a9845b6cbc..553715ac8320 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -1832,6 +1832,7 @@ static int process_attr(struct perf_tool *tool, union perf_event *event, + struct perf_evlist *evlist; + struct perf_evsel *evsel, *pos; + int err; ++ static struct perf_evsel_script *es; + + err = perf_event__process_attr(tool, event, pevlist); + if (err) +@@ -1840,6 +1841,19 @@ static int process_attr(struct perf_tool *tool, union perf_event *event, + evlist = *pevlist; + evsel = perf_evlist__last(*pevlist); + ++ if (!evsel->priv) { ++ if (scr->per_event_dump) { ++ evsel->priv = perf_evsel_script__new(evsel, ++ scr->session->data); ++ } else { ++ es = zalloc(sizeof(*es)); ++ if (!es) ++ return -ENOMEM; ++ es->fp = stdout; ++ evsel->priv = es; ++ } ++ } ++ + if (evsel->attr.type >= PERF_TYPE_MAX && + evsel->attr.type != PERF_TYPE_SYNTH) + return 0; +@@ -3028,6 +3042,15 @@ int process_cpu_map_event(struct perf_tool *tool __maybe_unused, + return set_maps(script); + } + ++static int process_feature_event(struct perf_tool *tool, ++ union perf_event *event, ++ struct perf_session *session) ++{ ++ if (event->feat.feat_id < HEADER_LAST_FEATURE) ++ return perf_event__process_feature(tool, event, session); ++ return 0; ++} ++ + #ifdef HAVE_AUXTRACE_SUPPORT + static int perf_script__process_auxtrace_info(struct perf_tool *tool, + union perf_event *event, +@@ -3072,7 +3095,7 @@ int cmd_script(int argc, const char **argv) + .attr = process_attr, + .event_update = perf_event__process_event_update, + .tracing_data = perf_event__process_tracing_data, +- .feature = perf_event__process_feature, ++ .feature = process_feature_event, + .build_id = perf_event__process_build_id, + .id_index = perf_event__process_id_index, + .auxtrace_info = perf_script__process_auxtrace_info, +diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c +index 0c6d1002b524..ac1bcdc17dae 100644 +--- a/tools/perf/jvmti/jvmti_agent.c ++++ b/tools/perf/jvmti/jvmti_agent.c +@@ -35,6 +35,7 @@ + #include <sys/mman.h> + #include <syscall.h> /* for gettid() */ + #include <err.h> ++#include <linux/kernel.h> + + #include "jvmti_agent.h" + #include "../util/jitdump.h" +@@ -249,7 +250,7 @@ void *jvmti_open(void) + /* + * jitdump file name + */ +- snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid()); ++ scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid()); + + fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666); + if (fd == -1) +diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build +index 17783913d330..215ba30b8534 100644 +--- a/tools/perf/pmu-events/Build ++++ b/tools/perf/pmu-events/Build +@@ -1,7 +1,7 @@ + hostprogs := jevents + + jevents-y += json.o jsmn.o jevents.o +-CHOSTFLAGS_jevents.o = -I$(srctree)/tools/include ++HOSTCFLAGS_jevents.o = -I$(srctree)/tools/include + pmu-events-y += pmu-events.o + JDIR = pmu-events/arch/$(SRCARCH) + JSON = $(shell [ -d $(JDIR) ] && \ +diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c +index cac8f8889bc3..6a858355091d 100644 +--- a/tools/perf/tests/builtin-test.c ++++ b/tools/perf/tests/builtin-test.c +@@ -422,7 +422,7 @@ static const char *shell_test__description(char *description, size_t size, + + #define for_each_shell_test(dir, base, ent) \ + while ((ent = readdir(dir)) != NULL) \ +- if (!is_directory(base, ent)) ++ if (!is_directory(base, ent) && ent->d_name[0] != '.') + + static const char *shell_tests__dir(char *path, size_t size) + { +diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c +index 18b06444f230..1509ef2c10c8 100644 +--- a/tools/perf/tests/parse-events.c ++++ b/tools/perf/tests/parse-events.c +@@ -1672,6 +1672,7 @@ static struct terms_test test__terms[] = { + + static int test_event(struct evlist_test *e) + { ++ struct parse_events_error err = { .idx = 0, }; + struct perf_evlist *evlist; + int ret; + +@@ -1679,10 +1680,11 @@ static int test_event(struct evlist_test *e) + if (evlist == NULL) + return -ENOMEM; + +- ret = parse_events(evlist, e->name, NULL); ++ ret = parse_events(evlist, e->name, &err); + if (ret) { +- pr_debug("failed to parse event '%s', err %d\n", +- e->name, ret); ++ pr_debug("failed to parse event '%s', err %d, str '%s'\n", ++ e->name, ret, err.str); ++ parse_events_print_error(&err, e->name); + } else { + ret = e->check(evlist); + } +diff --git a/tools/perf/tests/topology.c b/tools/perf/tests/topology.c +index 40e30a26b23c..9497d02f69e6 100644 +--- a/tools/perf/tests/topology.c ++++ b/tools/perf/tests/topology.c +@@ -45,6 +45,7 @@ static int session_write_header(char *path) + + perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY); + perf_header__set_feat(&session->header, HEADER_NRCPUS); ++ perf_header__set_feat(&session->header, HEADER_ARCH); + + session->header.data_size += DATA_SIZE; + +diff --git a/tools/perf/util/c++/clang.cpp b/tools/perf/util/c++/clang.cpp +index bf31ceab33bd..89512504551b 100644 +--- a/tools/perf/util/c++/clang.cpp ++++ b/tools/perf/util/c++/clang.cpp +@@ -146,8 +146,15 @@ getBPFObjectFromModule(llvm::Module *Module) + raw_svector_ostream ostream(*Buffer); + + legacy::PassManager PM; +- if (TargetMachine->addPassesToEmitFile(PM, ostream, +- TargetMachine::CGFT_ObjectFile)) { ++ bool NotAdded; ++#if CLANG_VERSION_MAJOR < 7 ++ NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream, ++ TargetMachine::CGFT_ObjectFile); ++#else ++ NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream, nullptr, ++ TargetMachine::CGFT_ObjectFile); ++#endif ++ if (NotAdded) { + llvm::errs() << "TargetMachine can't emit a file of this type\n"; + return std::unique_ptr<llvm::SmallVectorImpl<char>>(nullptr);; + } +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index a8bff2178fbc..9d3907db0802 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -2113,6 +2113,7 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused) + int cpu_nr = ff->ph->env.nr_cpus_avail; + u64 size = 0; + struct perf_header *ph = ff->ph; ++ bool do_core_id_test = true; + + ph->env.cpu = calloc(cpu_nr, sizeof(*ph->env.cpu)); + if (!ph->env.cpu) +@@ -2167,6 +2168,13 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused) + return 0; + } + ++ /* On s390 the socket_id number is not related to the numbers of cpus. ++ * The socket_id number might be higher than the numbers of cpus. ++ * This depends on the configuration. ++ */ ++ if (ph->env.arch && !strncmp(ph->env.arch, "s390", 4)) ++ do_core_id_test = false; ++ + for (i = 0; i < (u32)cpu_nr; i++) { + if (do_read_u32(ff, &nr)) + goto free_cpu; +@@ -2176,7 +2184,7 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused) + if (do_read_u32(ff, &nr)) + goto free_cpu; + +- if (nr != (u32)-1 && nr > (u32)cpu_nr) { ++ if (do_core_id_test && nr != (u32)-1 && nr > (u32)cpu_nr) { + pr_debug("socket_id number is too big." + "You may need to upgrade the perf tool.\n"); + goto free_cpu; +@@ -3442,7 +3450,7 @@ int perf_event__process_feature(struct perf_tool *tool, + pr_warning("invalid record type %d in pipe-mode\n", type); + return 0; + } +- if (feat == HEADER_RESERVED || feat > HEADER_LAST_FEATURE) { ++ if (feat == HEADER_RESERVED || feat >= HEADER_LAST_FEATURE) { + pr_warning("invalid record type %d in pipe-mode\n", type); + return -1; + } +diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c +index 1cca0a2fa641..c3c0ce8cdc55 100644 +--- a/tools/perf/util/llvm-utils.c ++++ b/tools/perf/util/llvm-utils.c +@@ -265,16 +265,16 @@ static const char *kinc_fetch_script = + "#!/usr/bin/env sh\n" + "if ! test -d \"$KBUILD_DIR\"\n" + "then\n" +-" exit -1\n" ++" exit 1\n" + "fi\n" + "if ! test -f \"$KBUILD_DIR/include/generated/autoconf.h\"\n" + "then\n" +-" exit -1\n" ++" exit 1\n" + "fi\n" + "TMPDIR=`mktemp -d`\n" + "if test -z \"$TMPDIR\"\n" + "then\n" +-" exit -1\n" ++" exit 1\n" + "fi\n" + "cat << EOF > $TMPDIR/Makefile\n" + "obj-y := dummy.o\n" +diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y +index 155d2570274f..da8fe57691b8 100644 +--- a/tools/perf/util/parse-events.y ++++ b/tools/perf/util/parse-events.y +@@ -227,11 +227,16 @@ event_def: event_pmu | + event_pmu: + PE_NAME opt_pmu_config + { ++ struct parse_events_state *parse_state = _parse_state; ++ struct parse_events_error *error = parse_state->error; + struct list_head *list, *orig_terms, *terms; + + if (parse_events_copy_term_list($2, &orig_terms)) + YYABORT; + ++ if (error) ++ error->idx = @1.first_column; ++ + ALLOC_LIST(list); + if (parse_events_add_pmu(_parse_state, list, $1, $2, false, false)) { + struct perf_pmu *pmu = NULL; +diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c +index 7f8afacd08ee..39894b96b5d6 100644 +--- a/tools/perf/util/scripting-engines/trace-event-python.c ++++ b/tools/perf/util/scripting-engines/trace-event-python.c +@@ -676,14 +676,11 @@ static void python_process_tracepoint(struct perf_sample *sample, + if (_PyTuple_Resize(&t, n) == -1) + Py_FatalError("error resizing Python tuple"); + +- if (!dict) { ++ if (!dict) + call_object(handler, t, handler_name); +- } else { ++ else + call_object(handler, t, default_handler_name); +- Py_DECREF(dict); +- } + +- Py_XDECREF(all_entries_dict); + Py_DECREF(t); + } + +@@ -1003,7 +1000,6 @@ static void python_process_general_event(struct perf_sample *sample, + + call_object(handler, t, handler_name); + +- Py_DECREF(dict); + Py_DECREF(t); + } + +diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c +index 4ea385be528f..51b7ce7b9ad3 100644 +--- a/tools/testing/nvdimm/test/nfit.c ++++ b/tools/testing/nvdimm/test/nfit.c +@@ -1989,8 +1989,7 @@ static void nfit_test0_setup(struct nfit_test *t) + pcap->header.type = ACPI_NFIT_TYPE_CAPABILITIES; + pcap->header.length = sizeof(*pcap); + pcap->highest_capability = 1; +- pcap->capabilities = ACPI_NFIT_CAPABILITY_CACHE_FLUSH | +- ACPI_NFIT_CAPABILITY_MEM_FLUSH; ++ pcap->capabilities = ACPI_NFIT_CAPABILITY_MEM_FLUSH; + offset += pcap->header.length; + + if (t->setup_hotplug) { +diff --git a/tools/testing/selftests/bpf/test_kmod.sh b/tools/testing/selftests/bpf/test_kmod.sh +index 35669ccd4d23..9df0d2ac45f8 100755 +--- a/tools/testing/selftests/bpf/test_kmod.sh ++++ b/tools/testing/selftests/bpf/test_kmod.sh +@@ -1,6 +1,15 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ ++msg="skip all tests:" ++if [ "$(id -u)" != "0" ]; then ++ echo $msg please run this as root >&2 ++ exit $ksft_skip ++fi ++ + SRC_TREE=../../../../ + + test_run() +diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py +index e78aad0a68bb..be800d0e7a84 100755 +--- a/tools/testing/selftests/bpf/test_offload.py ++++ b/tools/testing/selftests/bpf/test_offload.py +@@ -163,6 +163,10 @@ def bpftool(args, JSON=True, ns="", fail=True): + + def bpftool_prog_list(expected=None, ns=""): + _, progs = bpftool("prog show", JSON=True, ns=ns, fail=True) ++ # Remove the base progs ++ for p in base_progs: ++ if p in progs: ++ progs.remove(p) + if expected is not None: + if len(progs) != expected: + fail(True, "%d BPF programs loaded, expected %d" % +@@ -171,6 +175,10 @@ def bpftool_prog_list(expected=None, ns=""): + + def bpftool_map_list(expected=None, ns=""): + _, maps = bpftool("map show", JSON=True, ns=ns, fail=True) ++ # Remove the base maps ++ for m in base_maps: ++ if m in maps: ++ maps.remove(m) + if expected is not None: + if len(maps) != expected: + fail(True, "%d BPF maps loaded, expected %d" % +@@ -585,8 +593,8 @@ skip(os.getuid() != 0, "test must be run as root") + # Check tools + ret, progs = bpftool("prog", fail=False) + skip(ret != 0, "bpftool not installed") +-# Check no BPF programs are loaded +-skip(len(progs) != 0, "BPF programs already loaded on the system") ++base_progs = progs ++_, base_maps = bpftool("map") + + # Check netdevsim + ret, out = cmd("modprobe netdevsim", fail=False) +diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config +index 7ba089b33e8b..cd3a2f1545b5 100644 +--- a/tools/testing/selftests/net/config ++++ b/tools/testing/selftests/net/config +@@ -12,3 +12,5 @@ CONFIG_NET_IPVTI=y + CONFIG_INET6_XFRM_MODE_TUNNEL=y + CONFIG_IPV6_VTI=y + CONFIG_DUMMY=y ++CONFIG_BRIDGE=y ++CONFIG_VLAN_8021Q=y +diff --git a/tools/testing/selftests/pstore/pstore_post_reboot_tests b/tools/testing/selftests/pstore/pstore_post_reboot_tests +index 6ccb154cb4aa..22f8df1ad7d4 100755 +--- a/tools/testing/selftests/pstore/pstore_post_reboot_tests ++++ b/tools/testing/selftests/pstore/pstore_post_reboot_tests +@@ -7,13 +7,16 @@ + # + # Released under the terms of the GPL v2. + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + . ./common_tests + + if [ -e $REBOOT_FLAG ]; then + rm $REBOOT_FLAG + else + prlog "pstore_crash_test has not been executed yet. we skip further tests." +- exit 0 ++ exit $ksft_skip + fi + + prlog -n "Mounting pstore filesystem ... " +diff --git a/tools/testing/selftests/static_keys/test_static_keys.sh b/tools/testing/selftests/static_keys/test_static_keys.sh +index 24cff498b31a..fc9f8cde7d42 100755 +--- a/tools/testing/selftests/static_keys/test_static_keys.sh ++++ b/tools/testing/selftests/static_keys/test_static_keys.sh +@@ -2,6 +2,19 @@ + # SPDX-License-Identifier: GPL-2.0 + # Runs static keys kernel module tests + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ ++if ! /sbin/modprobe -q -n test_static_key_base; then ++ echo "static_key: module test_static_key_base is not found [SKIP]" ++ exit $ksft_skip ++fi ++ ++if ! /sbin/modprobe -q -n test_static_keys; then ++ echo "static_key: module test_static_keys is not found [SKIP]" ++ exit $ksft_skip ++fi ++ + if /sbin/modprobe -q test_static_key_base; then + if /sbin/modprobe -q test_static_keys; then + echo "static_key: ok" +diff --git a/tools/testing/selftests/sync/config b/tools/testing/selftests/sync/config +new file mode 100644 +index 000000000000..1ab7e8130db2 +--- /dev/null ++++ b/tools/testing/selftests/sync/config +@@ -0,0 +1,4 @@ ++CONFIG_STAGING=y ++CONFIG_ANDROID=y ++CONFIG_SYNC=y ++CONFIG_SW_SYNC=y +diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh +index ec232c3cfcaa..584eb8ea780a 100755 +--- a/tools/testing/selftests/sysctl/sysctl.sh ++++ b/tools/testing/selftests/sysctl/sysctl.sh +@@ -14,6 +14,9 @@ + + # This performs a series tests against the proc sysctl interface. + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + TEST_NAME="sysctl" + TEST_DRIVER="test_${TEST_NAME}" + TEST_DIR=$(dirname $0) +@@ -41,7 +44,7 @@ test_modprobe() + echo "$0: $DIR not present" >&2 + echo "You must have the following enabled in your kernel:" >&2 + cat $TEST_DIR/config >&2 +- exit 1 ++ exit $ksft_skip + fi + } + +@@ -98,28 +101,30 @@ test_reqs() + uid=$(id -u) + if [ $uid -ne 0 ]; then + echo $msg must be run as root >&2 +- exit 0 ++ exit $ksft_skip + fi + + if ! which perl 2> /dev/null > /dev/null; then + echo "$0: You need perl installed" +- exit 1 ++ exit $ksft_skip + fi + if ! which getconf 2> /dev/null > /dev/null; then + echo "$0: You need getconf installed" +- exit 1 ++ exit $ksft_skip + fi + if ! which diff 2> /dev/null > /dev/null; then + echo "$0: You need diff installed" +- exit 1 ++ exit $ksft_skip + fi + } + + function load_req_mod() + { +- trap "test_modprobe" EXIT +- + if [ ! -d $DIR ]; then ++ if ! modprobe -q -n $TEST_DRIVER; then ++ echo "$0: module $TEST_DRIVER not found [SKIP]" ++ exit $ksft_skip ++ fi + modprobe $TEST_DRIVER + if [ $? -ne 0 ]; then + exit +@@ -765,6 +770,7 @@ function parse_args() + test_reqs + allow_user_defaults + check_production_sysctl_writes_strict ++test_modprobe + load_req_mod + + trap "test_finish" EXIT +diff --git a/tools/testing/selftests/user/test_user_copy.sh b/tools/testing/selftests/user/test_user_copy.sh +index d60506fc77f8..f9b31a57439b 100755 +--- a/tools/testing/selftests/user/test_user_copy.sh ++++ b/tools/testing/selftests/user/test_user_copy.sh +@@ -2,6 +2,13 @@ + # SPDX-License-Identifier: GPL-2.0 + # Runs copy_to/from_user infrastructure using test_user_copy kernel module + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ ++if ! /sbin/modprobe -q -n test_user_copy; then ++ echo "user: module test_user_copy is not found [SKIP]" ++ exit $ksft_skip ++fi + if /sbin/modprobe -q test_user_copy; then + /sbin/modprobe -q -r test_user_copy + echo "user_copy: ok" +diff --git a/tools/testing/selftests/vm/compaction_test.c b/tools/testing/selftests/vm/compaction_test.c +index 1097f04e4d80..bcec71250873 100644 +--- a/tools/testing/selftests/vm/compaction_test.c ++++ b/tools/testing/selftests/vm/compaction_test.c +@@ -16,6 +16,8 @@ + #include <unistd.h> + #include <string.h> + ++#include "../kselftest.h" ++ + #define MAP_SIZE 1048576 + + struct map_list { +@@ -169,7 +171,7 @@ int main(int argc, char **argv) + printf("Either the sysctl compact_unevictable_allowed is not\n" + "set to 1 or couldn't read the proc file.\n" + "Skipping the test\n"); +- return 0; ++ return KSFT_SKIP; + } + + lim.rlim_cur = RLIM_INFINITY; +diff --git a/tools/testing/selftests/vm/mlock2-tests.c b/tools/testing/selftests/vm/mlock2-tests.c +index 4997b9222cfa..637b6d0ac0d0 100644 +--- a/tools/testing/selftests/vm/mlock2-tests.c ++++ b/tools/testing/selftests/vm/mlock2-tests.c +@@ -9,6 +9,8 @@ + #include <stdbool.h> + #include "mlock2.h" + ++#include "../kselftest.h" ++ + struct vm_boundaries { + unsigned long start; + unsigned long end; +@@ -303,7 +305,7 @@ static int test_mlock_lock() + if (mlock2_(map, 2 * page_size, 0)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("mlock2(0)"); + goto unmap; +@@ -412,7 +414,7 @@ static int test_mlock_onfault() + if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("mlock2(MLOCK_ONFAULT)"); + goto unmap; +@@ -425,7 +427,7 @@ static int test_mlock_onfault() + if (munlock(map, 2 * page_size)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("munlock()"); + goto unmap; +@@ -457,7 +459,7 @@ static int test_lock_onfault_of_present() + if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("mlock2(MLOCK_ONFAULT)"); + goto unmap; +@@ -583,7 +585,7 @@ static int test_vma_management(bool call_mlock) + if (call_mlock && mlock2_(map, 3 * page_size, MLOCK_ONFAULT)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("mlock(ONFAULT)\n"); + goto out; +diff --git a/tools/testing/selftests/vm/run_vmtests b/tools/testing/selftests/vm/run_vmtests +index 22d564673830..88cbe5575f0c 100755 +--- a/tools/testing/selftests/vm/run_vmtests ++++ b/tools/testing/selftests/vm/run_vmtests +@@ -2,6 +2,9 @@ + # SPDX-License-Identifier: GPL-2.0 + #please run as root + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + mnt=./huge + exitcode=0 + +@@ -36,7 +39,7 @@ if [ -n "$freepgs" ] && [ -n "$hpgsize_KB" ]; then + echo $(( $lackpgs + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages + if [ $? -ne 0 ]; then + echo "Please run this test as root" +- exit 1 ++ exit $ksft_skip + fi + while read name size unit; do + if [ "$name" = "HugePages_Free:" ]; then +diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c +index de2f9ec8a87f..7b8171e3128a 100644 +--- a/tools/testing/selftests/vm/userfaultfd.c ++++ b/tools/testing/selftests/vm/userfaultfd.c +@@ -69,6 +69,8 @@ + #include <setjmp.h> + #include <stdbool.h> + ++#include "../kselftest.h" ++ + #ifdef __NR_userfaultfd + + static unsigned long nr_cpus, nr_pages, nr_pages_per_cpu, page_size; +@@ -1322,7 +1324,7 @@ int main(int argc, char **argv) + int main(void) + { + printf("skip: Skipping userfaultfd test (missing __NR_userfaultfd)\n"); +- return 0; ++ return KSFT_SKIP; + } + + #endif /* __NR_userfaultfd */ +diff --git a/tools/testing/selftests/x86/sigreturn.c b/tools/testing/selftests/x86/sigreturn.c +index 246145b84a12..4d9dc3f2fd70 100644 +--- a/tools/testing/selftests/x86/sigreturn.c ++++ b/tools/testing/selftests/x86/sigreturn.c +@@ -610,21 +610,41 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss) + */ + for (int i = 0; i < NGREG; i++) { + greg_t req = requested_regs[i], res = resulting_regs[i]; ++ + if (i == REG_TRAPNO || i == REG_IP) + continue; /* don't care */ +- if (i == REG_SP) { +- printf("\tSP: %llx -> %llx\n", (unsigned long long)req, +- (unsigned long long)res); + ++ if (i == REG_SP) { + /* +- * In many circumstances, the high 32 bits of rsp +- * are zeroed. For example, we could be a real +- * 32-bit program, or we could hit any of a number +- * of poorly-documented IRET or segmented ESP +- * oddities. If this happens, it's okay. ++ * If we were using a 16-bit stack segment, then ++ * the kernel is a bit stuck: IRET only restores ++ * the low 16 bits of ESP/RSP if SS is 16-bit. ++ * The kernel uses a hack to restore bits 31:16, ++ * but that hack doesn't help with bits 63:32. ++ * On Intel CPUs, bits 63:32 end up zeroed, and, on ++ * AMD CPUs, they leak the high bits of the kernel ++ * espfix64 stack pointer. There's very little that ++ * the kernel can do about it. ++ * ++ * Similarly, if we are returning to a 32-bit context, ++ * the CPU will often lose the high 32 bits of RSP. + */ +- if (res == (req & 0xFFFFFFFF)) +- continue; /* OK; not expected to work */ ++ ++ if (res == req) ++ continue; ++ ++ if (cs_bits != 64 && ((res ^ req) & 0xFFFFFFFF) == 0) { ++ printf("[NOTE]\tSP: %llx -> %llx\n", ++ (unsigned long long)req, ++ (unsigned long long)res); ++ continue; ++ } ++ ++ printf("[FAIL]\tSP mismatch: requested 0x%llx; got 0x%llx\n", ++ (unsigned long long)requested_regs[i], ++ (unsigned long long)resulting_regs[i]); ++ nerrs++; ++ continue; + } + + bool ignore_reg = false; +@@ -654,25 +674,18 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss) + #endif + + /* Sanity check on the kernel */ +- if (i == REG_CX && requested_regs[i] != resulting_regs[i]) { ++ if (i == REG_CX && req != res) { + printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n", +- (unsigned long long)requested_regs[i], +- (unsigned long long)resulting_regs[i]); ++ (unsigned long long)req, ++ (unsigned long long)res); + nerrs++; + continue; + } + +- if (requested_regs[i] != resulting_regs[i] && !ignore_reg) { +- /* +- * SP is particularly interesting here. The +- * usual cause of failures is that we hit the +- * nasty IRET case of returning to a 16-bit SS, +- * in which case bits 16:31 of the *kernel* +- * stack pointer persist in ESP. +- */ ++ if (req != res && !ignore_reg) { + printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n", +- i, (unsigned long long)requested_regs[i], +- (unsigned long long)resulting_regs[i]); ++ i, (unsigned long long)req, ++ (unsigned long long)res); + nerrs++; + } + } +diff --git a/tools/testing/selftests/zram/zram.sh b/tools/testing/selftests/zram/zram.sh +index 754de7da426a..232e958ec454 100755 +--- a/tools/testing/selftests/zram/zram.sh ++++ b/tools/testing/selftests/zram/zram.sh +@@ -2,6 +2,9 @@ + # SPDX-License-Identifier: GPL-2.0 + TCID="zram.sh" + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + . ./zram_lib.sh + + run_zram () { +@@ -24,5 +27,5 @@ elif [ -b /dev/zram0 ]; then + else + echo "$TCID : No zram.ko module or /dev/zram0 device file not found" + echo "$TCID : CONFIG_ZRAM is not set" +- exit 1 ++ exit $ksft_skip + fi +diff --git a/tools/testing/selftests/zram/zram_lib.sh b/tools/testing/selftests/zram/zram_lib.sh +index f6a9c73e7a44..9e73a4fb9b0a 100755 +--- a/tools/testing/selftests/zram/zram_lib.sh ++++ b/tools/testing/selftests/zram/zram_lib.sh +@@ -18,6 +18,9 @@ MODULE=0 + dev_makeswap=-1 + dev_mounted=-1 + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + trap INT + + check_prereqs() +@@ -27,7 +30,7 @@ check_prereqs() + + if [ $uid -ne 0 ]; then + echo $msg must be run as root >&2 +- exit 0 ++ exit $ksft_skip + fi + } + +diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c +index bdcf8e7a6161..72fc688c3e9d 100644 +--- a/virt/kvm/arm/vgic/vgic-v3.c ++++ b/virt/kvm/arm/vgic/vgic-v3.c +@@ -552,11 +552,6 @@ int vgic_v3_probe(const struct gic_kvm_info *info) + pr_warn("GICV physical address 0x%llx not page aligned\n", + (unsigned long long)info->vcpu.start); + kvm_vgic_global_state.vcpu_base = 0; +- } else if (!PAGE_ALIGNED(resource_size(&info->vcpu))) { +- pr_warn("GICV size 0x%llx not a multiple of page size 0x%lx\n", +- (unsigned long long)resource_size(&info->vcpu), +- PAGE_SIZE); +- kvm_vgic_global_state.vcpu_base = 0; + } else { + kvm_vgic_global_state.vcpu_base = info->vcpu.start; + kvm_vgic_global_state.can_emulate_gicv2 = true; |