diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2020-12-02 07:50:56 -0500 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2020-12-02 07:50:56 -0500 |
| commit | 54f932d5566957b4eb41aea06e6febb1c65245bd (patch) | |
| tree | 18afccec2e73269d1db509a5761416466f4afc5b | |
| parent | Linux patch 5.9.11 (diff) | |
| download | linux-patches-54f932d5.tar.gz linux-patches-54f932d5.tar.bz2 linux-patches-54f932d5.zip | |
Linux patch 5.9.125.9-12
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1011_linux-5.9.12.patch | 6940 |
2 files changed, 6944 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 7528f5d2..22fb04bb 100644 --- a/0000_README +++ b/0000_README @@ -87,6 +87,10 @@ Patch: 1010_linux-5.9.11.patch From: http://www.kernel.org Desc: Linux 5.9.11 +Patch: 1011_linux-5.9.12.patch +From: http://www.kernel.org +Desc: Linux 5.9.12 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1011_linux-5.9.12.patch b/1011_linux-5.9.12.patch new file mode 100644 index 00000000..42674143 --- /dev/null +++ b/1011_linux-5.9.12.patch @@ -0,0 +1,6940 @@ +diff --git a/Makefile b/Makefile +index bacb52fac2a54..1dd088b0ac993 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 9 +-SUBLEVEL = 11 ++SUBLEVEL = 12 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h +index f1ed17edb085b..163641726a2b9 100644 +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -134,8 +134,10 @@ + + #ifdef CONFIG_ARC_HAS_PAE40 + #define PTE_BITS_NON_RWX_IN_PD1 (0xff00000000 | PAGE_MASK | _PAGE_CACHEABLE) ++#define MAX_POSSIBLE_PHYSMEM_BITS 40 + #else + #define PTE_BITS_NON_RWX_IN_PD1 (PAGE_MASK | _PAGE_CACHEABLE) ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #endif + + /************************************************************************** +diff --git a/arch/arm/boot/dts/dra76x.dtsi b/arch/arm/boot/dts/dra76x.dtsi +index b69c7d40f5d82..2f326151116b7 100644 +--- a/arch/arm/boot/dts/dra76x.dtsi ++++ b/arch/arm/boot/dts/dra76x.dtsi +@@ -32,8 +32,8 @@ + interrupts = <GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "int0", "int1"; +- clocks = <&mcan_clk>, <&l3_iclk_div>; +- clock-names = "cclk", "hclk"; ++ clocks = <&l3_iclk_div>, <&mcan_clk>; ++ clock-names = "hclk", "cclk"; + bosch,mram-cfg = <0x0 0 0 32 0 0 1 1>; + }; + }; +diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h +index 3502c2f746ca7..baf7d0204eb5a 100644 +--- a/arch/arm/include/asm/pgtable-2level.h ++++ b/arch/arm/include/asm/pgtable-2level.h +@@ -75,6 +75,8 @@ + #define PTE_HWTABLE_OFF (PTE_HWTABLE_PTRS * sizeof(pte_t)) + #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u32)) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 ++ + /* + * PMD_SHIFT determines the size of the area a second-level page table can map + * PGDIR_SHIFT determines what a third-level page table entry can map +diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h +index fbb6693c33528..2b85d175e9996 100644 +--- a/arch/arm/include/asm/pgtable-3level.h ++++ b/arch/arm/include/asm/pgtable-3level.h +@@ -25,6 +25,8 @@ + #define PTE_HWTABLE_OFF (0) + #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u64)) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 40 ++ + /* + * PGDIR_SHIFT determines the size a top-level page table entry can map. + */ +diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c +index a92d277f81a08..c8d317fafe2ea 100644 +--- a/arch/arm/mach-omap2/cpuidle44xx.c ++++ b/arch/arm/mach-omap2/cpuidle44xx.c +@@ -175,8 +175,11 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, + if (mpuss_can_lose_context) { + error = cpu_cluster_pm_enter(); + if (error) { +- omap_set_pwrdm_state(mpu_pd, PWRDM_POWER_ON); +- goto cpu_cluster_pm_out; ++ index = 0; ++ cx = state_ptr + index; ++ pwrdm_set_logic_retst(mpu_pd, cx->mpu_logic_state); ++ omap_set_pwrdm_state(mpu_pd, cx->mpu_state); ++ mpuss_can_lose_context = 0; + } + } + } +@@ -184,7 +187,6 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, + omap4_enter_lowpower(dev->cpu, cx->cpu_state); + cpu_done[dev->cpu] = true; + +-cpu_cluster_pm_out: + /* Wakeup CPU1 only if it is not offlined */ + if (dev->cpu == 0 && cpumask_test_cpu(1, cpu_online_mask)) { + +diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p3668-0000.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p3668-0000.dtsi +index 10cb836aea7ea..e970d8860a1fd 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra194-p3668-0000.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra194-p3668-0000.dtsi +@@ -54,7 +54,7 @@ + status = "okay"; + }; + +- serial@c280000 { ++ serial@3100000 { + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +index ca5cb6aef5ee4..6f6d460c931aa 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +@@ -924,7 +924,7 @@ + + hsp_aon: hsp@c150000 { + compatible = "nvidia,tegra194-hsp", "nvidia,tegra186-hsp"; +- reg = <0x0c150000 0xa0000>; ++ reg = <0x0c150000 0x90000>; + interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>, +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +index e18e1a9a30113..a9caaf7c0d67e 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +@@ -1663,16 +1663,6 @@ + vin-supply = <&vdd_5v0_sys>; + }; + +- vdd_usb_vbus_otg: regulator@11 { +- compatible = "regulator-fixed"; +- regulator-name = "USB_VBUS_EN0"; +- regulator-min-microvolt = <5000000>; +- regulator-max-microvolt = <5000000>; +- gpio = <&gpio TEGRA_GPIO(CC, 4) GPIO_ACTIVE_HIGH>; +- enable-active-high; +- vin-supply = <&vdd_5v0_sys>; +- }; +- + vdd_hdmi: regulator@10 { + compatible = "regulator-fixed"; + regulator-name = "VDD_HDMI_5V0"; +@@ -1712,4 +1702,14 @@ + enable-active-high; + vin-supply = <&vdd_3v3_sys>; + }; ++ ++ vdd_usb_vbus_otg: regulator@14 { ++ compatible = "regulator-fixed"; ++ regulator-name = "USB_VBUS_EN0"; ++ regulator-min-microvolt = <5000000>; ++ regulator-max-microvolt = <5000000>; ++ gpio = <&gpio TEGRA_GPIO(CC, 4) GPIO_ACTIVE_HIGH>; ++ enable-active-high; ++ vin-supply = <&vdd_5v0_sys>; ++ }; + }; +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 88233d42d9c29..db16919a53e4a 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -108,8 +108,6 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; + #define pte_valid(pte) (!!(pte_val(pte) & PTE_VALID)) + #define pte_valid_not_user(pte) \ + ((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID) +-#define pte_valid_young(pte) \ +- ((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF)) + #define pte_valid_user(pte) \ + ((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER)) + +@@ -117,9 +115,12 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; + * Could the pte be present in the TLB? We must check mm_tlb_flush_pending + * so that we don't erroneously return false for pages that have been + * remapped as PROT_NONE but are yet to be flushed from the TLB. ++ * Note that we can't make any assumptions based on the state of the access ++ * flag, since ptep_clear_flush_young() elides a DSB when invalidating the ++ * TLB. + */ + #define pte_accessible(mm, pte) \ +- (mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid_young(pte)) ++ (mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid(pte)) + + /* + * p??_access_permitted() is true for valid user mappings (subject to the +@@ -145,13 +146,6 @@ static inline pte_t set_pte_bit(pte_t pte, pgprot_t prot) + return pte; + } + +-static inline pte_t pte_wrprotect(pte_t pte) +-{ +- pte = clear_pte_bit(pte, __pgprot(PTE_WRITE)); +- pte = set_pte_bit(pte, __pgprot(PTE_RDONLY)); +- return pte; +-} +- + static inline pte_t pte_mkwrite(pte_t pte) + { + pte = set_pte_bit(pte, __pgprot(PTE_WRITE)); +@@ -177,6 +171,20 @@ static inline pte_t pte_mkdirty(pte_t pte) + return pte; + } + ++static inline pte_t pte_wrprotect(pte_t pte) ++{ ++ /* ++ * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY ++ * clear), set the PTE_DIRTY bit. ++ */ ++ if (pte_hw_dirty(pte)) ++ pte = pte_mkdirty(pte); ++ ++ pte = clear_pte_bit(pte, __pgprot(PTE_WRITE)); ++ pte = set_pte_bit(pte, __pgprot(PTE_RDONLY)); ++ return pte; ++} ++ + static inline pte_t pte_mkold(pte_t pte) + { + return clear_pte_bit(pte, __pgprot(PTE_AF)); +@@ -798,12 +806,6 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres + pte = READ_ONCE(*ptep); + do { + old_pte = pte; +- /* +- * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY +- * clear), set the PTE_DIRTY bit. +- */ +- if (pte_hw_dirty(pte)) +- pte = pte_mkdirty(pte); + pte = pte_wrprotect(pte); + pte_val(pte) = cmpxchg_relaxed(&pte_val(*ptep), + pte_val(old_pte), pte_val(pte)); +diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c +index 5c786b915cd34..39c34d92b6017 100644 +--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c ++++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c +@@ -273,6 +273,23 @@ static unsigned long vgic_mmio_read_v3r_typer(struct kvm_vcpu *vcpu, + return extract_bytes(value, addr & 7, len); + } + ++static unsigned long vgic_uaccess_read_v3r_typer(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len) ++{ ++ unsigned long mpidr = kvm_vcpu_get_mpidr_aff(vcpu); ++ int target_vcpu_id = vcpu->vcpu_id; ++ u64 value; ++ ++ value = (u64)(mpidr & GENMASK(23, 0)) << 32; ++ value |= ((target_vcpu_id & 0xffff) << 8); ++ ++ if (vgic_has_its(vcpu->kvm)) ++ value |= GICR_TYPER_PLPIS; ++ ++ /* reporting of the Last bit is not supported for userspace */ ++ return extract_bytes(value, addr & 7, len); ++} ++ + static unsigned long vgic_mmio_read_v3r_iidr(struct kvm_vcpu *vcpu, + gpa_t addr, unsigned int len) + { +@@ -593,8 +610,9 @@ static const struct vgic_register_region vgic_v3_rd_registers[] = { + REGISTER_DESC_WITH_LENGTH(GICR_IIDR, + vgic_mmio_read_v3r_iidr, vgic_mmio_write_wi, 4, + VGIC_ACCESS_32bit), +- REGISTER_DESC_WITH_LENGTH(GICR_TYPER, +- vgic_mmio_read_v3r_typer, vgic_mmio_write_wi, 8, ++ REGISTER_DESC_WITH_LENGTH_UACCESS(GICR_TYPER, ++ vgic_mmio_read_v3r_typer, vgic_mmio_write_wi, ++ vgic_uaccess_read_v3r_typer, vgic_mmio_uaccess_write_wi, 8, + VGIC_ACCESS_64bit | VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_LENGTH(GICR_WAKER, + vgic_mmio_read_raz, vgic_mmio_write_wi, 4, +diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h +index a950fc1ddb4da..6c0532d7b2119 100644 +--- a/arch/mips/include/asm/pgtable-32.h ++++ b/arch/mips/include/asm/pgtable-32.h +@@ -154,6 +154,7 @@ static inline void pmd_clear(pmd_t *pmdp) + + #if defined(CONFIG_XPA) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 40 + #define pte_pfn(x) (((unsigned long)((x).pte_high >> _PFN_SHIFT)) | (unsigned long)((x).pte_low << _PAGE_PRESENT_SHIFT)) + static inline pte_t + pfn_pte(unsigned long pfn, pgprot_t prot) +@@ -169,6 +170,7 @@ pfn_pte(unsigned long pfn, pgprot_t prot) + + #elif defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 36 + #define pte_pfn(x) ((unsigned long)((x).pte_high >> 6)) + + static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot) +@@ -183,6 +185,7 @@ static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot) + + #else + ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #ifdef CONFIG_CPU_VR41XX + #define pte_pfn(x) ((unsigned long)((x).pte >> (PAGE_SHIFT + 2))) + #define pfn_pte(pfn, prot) __pte(((pfn) << (PAGE_SHIFT + 2)) | pgprot_val(prot)) +diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h +index 36443cda8dcf2..1376be95e975f 100644 +--- a/arch/powerpc/include/asm/book3s/32/pgtable.h ++++ b/arch/powerpc/include/asm/book3s/32/pgtable.h +@@ -36,8 +36,10 @@ static inline bool pte_user(pte_t pte) + */ + #ifdef CONFIG_PTE_64BIT + #define PTE_RPN_MASK (~((1ULL << PTE_RPN_SHIFT) - 1)) ++#define MAX_POSSIBLE_PHYSMEM_BITS 36 + #else + #define PTE_RPN_MASK (~((1UL << PTE_RPN_SHIFT) - 1)) ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #endif + + /* +diff --git a/arch/powerpc/include/asm/book3s/64/kup-radix.h b/arch/powerpc/include/asm/book3s/64/kup-radix.h +index 28716e2f13e31..a39e2d193fdc1 100644 +--- a/arch/powerpc/include/asm/book3s/64/kup-radix.h ++++ b/arch/powerpc/include/asm/book3s/64/kup-radix.h +@@ -63,6 +63,8 @@ + + #else /* !__ASSEMBLY__ */ + ++#include <linux/jump_label.h> ++ + DECLARE_STATIC_KEY_FALSE(uaccess_flush_key); + + #ifdef CONFIG_PPC_KUAP +diff --git a/arch/powerpc/include/asm/nohash/32/pgtable.h b/arch/powerpc/include/asm/nohash/32/pgtable.h +index b9e134d0f03ad..5f5049c1ddb7f 100644 +--- a/arch/powerpc/include/asm/nohash/32/pgtable.h ++++ b/arch/powerpc/include/asm/nohash/32/pgtable.h +@@ -153,8 +153,10 @@ int map_kernel_page(unsigned long va, phys_addr_t pa, pgprot_t prot); + */ + #if defined(CONFIG_PPC32) && defined(CONFIG_PTE_64BIT) + #define PTE_RPN_MASK (~((1ULL << PTE_RPN_SHIFT) - 1)) ++#define MAX_POSSIBLE_PHYSMEM_BITS 36 + #else + #define PTE_RPN_MASK (~((1UL << PTE_RPN_SHIFT) - 1)) ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #endif + + /* +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index f63a3d3bca3d3..4d01f09ecf808 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -1000,8 +1000,6 @@ TRAMP_REAL_BEGIN(system_reset_idle_wake) + * Vectors for the FWNMI option. Share common code. + */ + TRAMP_REAL_BEGIN(system_reset_fwnmi) +- /* XXX: fwnmi guest could run a nested/PR guest, so why no test? */ +- __IKVM_REAL(system_reset)=0 + GEN_INT_ENTRY system_reset, virt=0 + + #endif /* CONFIG_PPC_PSERIES */ +@@ -1412,6 +1410,11 @@ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE) + * If none is found, do a Linux page fault. Linux page faults can happen in + * kernel mode due to user copy operations of course. + * ++ * KVM: The KVM HDSI handler may perform a load with MSR[DR]=1 in guest ++ * MMU context, which may cause a DSI in the host, which must go to the ++ * KVM handler. MSR[IR] is not enabled, so the real-mode handler will ++ * always be used regardless of AIL setting. ++ * + * - Radix MMU + * The hardware loads from the Linux page table directly, so a fault goes + * immediately to Linux page fault. +@@ -1422,10 +1425,8 @@ INT_DEFINE_BEGIN(data_access) + IVEC=0x300 + IDAR=1 + IDSISR=1 +-#ifdef CONFIG_KVM_BOOK3S_PR_POSSIBLE + IKVM_SKIP=1 + IKVM_REAL=1 +-#endif + INT_DEFINE_END(data_access) + + EXC_REAL_BEGIN(data_access, 0x300, 0x80) +@@ -1464,6 +1465,8 @@ ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX) + * ppc64_bolted_size (first segment). The kernel handler must avoid stomping + * on user-handler data structures. + * ++ * KVM: Same as 0x300, DSLB must test for KVM guest. ++ * + * A dedicated save area EXSLB is used (XXX: but it actually need not be + * these days, we could use EXGEN). + */ +@@ -1472,10 +1475,8 @@ INT_DEFINE_BEGIN(data_access_slb) + IAREA=PACA_EXSLB + IRECONCILE=0 + IDAR=1 +-#ifdef CONFIG_KVM_BOOK3S_PR_POSSIBLE + IKVM_SKIP=1 + IKVM_REAL=1 +-#endif + INT_DEFINE_END(data_access_slb) + + EXC_REAL_BEGIN(data_access_slb, 0x380, 0x80) +diff --git a/arch/powerpc/kvm/book3s_xive_native.c b/arch/powerpc/kvm/book3s_xive_native.c +index bdea91df14974..eed17b1ef7728 100644 +--- a/arch/powerpc/kvm/book3s_xive_native.c ++++ b/arch/powerpc/kvm/book3s_xive_native.c +@@ -251,6 +251,13 @@ static vm_fault_t xive_native_esb_fault(struct vm_fault *vmf) + } + + state = &sb->irq_state[src]; ++ ++ /* Some sanity checking */ ++ if (!state->valid) { ++ pr_devel("%s: source %lx invalid !\n", __func__, irq); ++ return VM_FAULT_SIGBUS; ++ } ++ + kvmppc_xive_select_irq(state, &hw_num, &xd); + + arch_spin_lock(&sb->lock); +diff --git a/arch/riscv/include/asm/pgtable-32.h b/arch/riscv/include/asm/pgtable-32.h +index b0ab66e5fdb1d..5b2e79e5bfa5b 100644 +--- a/arch/riscv/include/asm/pgtable-32.h ++++ b/arch/riscv/include/asm/pgtable-32.h +@@ -14,4 +14,6 @@ + #define PGDIR_SIZE (_AC(1, UL) << PGDIR_SHIFT) + #define PGDIR_MASK (~(PGDIR_SIZE - 1)) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 34 ++ + #endif /* _ASM_RISCV_PGTABLE_32_H */ +diff --git a/arch/riscv/include/asm/vdso/processor.h b/arch/riscv/include/asm/vdso/processor.h +index 82a5693b18614..134388cbaaa1d 100644 +--- a/arch/riscv/include/asm/vdso/processor.h ++++ b/arch/riscv/include/asm/vdso/processor.h +@@ -4,6 +4,8 @@ + + #ifndef __ASSEMBLY__ + ++#include <asm/barrier.h> ++ + static inline void cpu_relax(void) + { + #ifdef __riscv_muldiv +diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c +index 2c6dd329312bd..3de5234b6de5b 100644 +--- a/arch/riscv/kernel/setup.c ++++ b/arch/riscv/kernel/setup.c +@@ -69,6 +69,7 @@ void __init setup_arch(char **cmdline_p) + + *cmdline_p = boot_command_line; + ++ jump_label_init(); + parse_early_param(); + + setup_bootmem(); +diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile +index cb8f9e4cfcbf8..0cfd6da784f84 100644 +--- a/arch/riscv/kernel/vdso/Makefile ++++ b/arch/riscv/kernel/vdso/Makefile +@@ -44,7 +44,7 @@ SYSCFLAGS_vdso.so.dbg = $(c_flags) + $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE + $(call if_changed,vdsold) + SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \ +- -Wl,--build-id -Wl,--hash-style=both ++ -Wl,--build-id=sha1 -Wl,--hash-style=both + + # We also create a special relocatable object that should mirror the symbol + # table and layout of the linked DSO. With ld --just-symbols we can then +diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c +index 5d8cc1864566d..62a18dee4c36d 100644 +--- a/arch/s390/kernel/asm-offsets.c ++++ b/arch/s390/kernel/asm-offsets.c +@@ -53,11 +53,11 @@ int main(void) + /* stack_frame offsets */ + OFFSET(__SF_BACKCHAIN, stack_frame, back_chain); + OFFSET(__SF_GPRS, stack_frame, gprs); +- OFFSET(__SF_EMPTY, stack_frame, empty1); +- OFFSET(__SF_SIE_CONTROL, stack_frame, empty1[0]); +- OFFSET(__SF_SIE_SAVEAREA, stack_frame, empty1[1]); +- OFFSET(__SF_SIE_REASON, stack_frame, empty1[2]); +- OFFSET(__SF_SIE_FLAGS, stack_frame, empty1[3]); ++ OFFSET(__SF_EMPTY, stack_frame, empty1[0]); ++ OFFSET(__SF_SIE_CONTROL, stack_frame, empty1[1]); ++ OFFSET(__SF_SIE_SAVEAREA, stack_frame, empty1[2]); ++ OFFSET(__SF_SIE_REASON, stack_frame, empty1[3]); ++ OFFSET(__SF_SIE_FLAGS, stack_frame, empty1[4]); + BLANK(); + /* timeval/timezone offsets for use by vdso */ + OFFSET(__VDSO_UPD_COUNT, vdso_data, tb_update_count); +diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S +index 3349750f930ee..ca55db0823534 100644 +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -1072,6 +1072,7 @@ EXPORT_SYMBOL(save_fpu_regs) + * %r4 + */ + load_fpu_regs: ++ stnsm __SF_EMPTY(%r15),0xfc + lg %r4,__LC_CURRENT + aghi %r4,__TASK_thread + TSTMSK __LC_CPU_FLAGS,_CIF_FPU +@@ -1103,6 +1104,7 @@ load_fpu_regs: + .Lload_fpu_regs_done: + ni __LC_CPU_FLAGS+7,255-_CIF_FPU + .Lload_fpu_regs_exit: ++ ssm __SF_EMPTY(%r15) + BR_EX %r14 + .Lload_fpu_regs_end: + ENDPROC(load_fpu_regs) +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 6b74b92c1a586..425d3d75320bf 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -2312,7 +2312,7 @@ static int kvm_s390_handle_pv(struct kvm *kvm, struct kvm_pv_cmd *cmd) + struct kvm_s390_pv_unp unp = {}; + + r = -EINVAL; +- if (!kvm_s390_pv_is_protected(kvm)) ++ if (!kvm_s390_pv_is_protected(kvm) || !mm_is_protected(kvm->mm)) + break; + + r = -EFAULT; +@@ -3564,7 +3564,6 @@ static void kvm_arch_vcpu_ioctl_initial_reset(struct kvm_vcpu *vcpu) + vcpu->arch.sie_block->pp = 0; + vcpu->arch.sie_block->fpf &= ~FPF_BPBC; + vcpu->arch.sie_block->todpr = 0; +- vcpu->arch.sie_block->cpnc = 0; + } + } + +@@ -3582,7 +3581,6 @@ static void kvm_arch_vcpu_ioctl_clear_reset(struct kvm_vcpu *vcpu) + + regs->etoken = 0; + regs->etoken_extension = 0; +- regs->diag318 = 0; + } + + int kvm_arch_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs) +diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c +index eb99e2f95ebed..f5847f9dec7c9 100644 +--- a/arch/s390/kvm/pv.c ++++ b/arch/s390/kvm/pv.c +@@ -208,7 +208,6 @@ int kvm_s390_pv_init_vm(struct kvm *kvm, u16 *rc, u16 *rrc) + return -EIO; + } + kvm->arch.gmap->guest_handle = uvcb.guest_handle; +- atomic_set(&kvm->mm->context.is_protected, 1); + return 0; + } + +@@ -228,6 +227,8 @@ int kvm_s390_pv_set_sec_parms(struct kvm *kvm, void *hdr, u64 length, u16 *rc, + *rrc = uvcb.header.rrc; + KVM_UV_EVENT(kvm, 3, "PROTVIRT VM SET PARMS: rc %x rrc %x", + *rc, *rrc); ++ if (!cc) ++ atomic_set(&kvm->mm->context.is_protected, 1); + return cc ? -EINVAL : 0; + } + +diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c +index 373542ca1113e..78dbba6a4500c 100644 +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -2690,6 +2690,8 @@ static const struct mm_walk_ops reset_acc_walk_ops = { + #include <linux/sched/mm.h> + void s390_reset_acc(struct mm_struct *mm) + { ++ if (!mm_is_protected(mm)) ++ return; + /* + * we might be called during + * reset: we walk the pages and clear +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 442e1ed4acd49..4eb7ee5fed72d 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -107,14 +107,14 @@ + MODULE_LICENSE("GPL"); + + #define DEFINE_CSTATE_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __cstate_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ ++static ssize_t __cstate_##_var##_show(struct device *dev, \ ++ struct device_attribute *attr, \ + char *page) \ + { \ + BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ + return sprintf(page, _format "\n"); \ + } \ +-static struct kobj_attribute format_attr_##_var = \ ++static struct device_attribute format_attr_##_var = \ + __ATTR(_name, 0444, __cstate_##_var##_show, NULL) + + static ssize_t cstate_get_attr_cpumask(struct device *dev, +diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c +index d5c6d3b340c50..803601baa753d 100644 +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -92,8 +92,8 @@ end: + return map; + } + +-ssize_t uncore_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf) ++ssize_t uncore_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf) + { + struct uncore_event_desc *event = + container_of(attr, struct uncore_event_desc, attr); +diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h +index 105fdc69825eb..c5744783e05d0 100644 +--- a/arch/x86/events/intel/uncore.h ++++ b/arch/x86/events/intel/uncore.h +@@ -157,7 +157,7 @@ struct intel_uncore_box { + #define UNCORE_BOX_FLAG_CFL8_CBOX_MSR_OFFS 2 + + struct uncore_event_desc { +- struct kobj_attribute attr; ++ struct device_attribute attr; + const char *config; + }; + +@@ -179,8 +179,8 @@ struct pci2phy_map { + struct pci2phy_map *__find_pci2phy_map(int segment); + int uncore_pcibus_to_physid(struct pci_bus *bus); + +-ssize_t uncore_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf); ++ssize_t uncore_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf); + + static inline struct intel_uncore_pmu *dev_to_uncore_pmu(struct device *dev) + { +@@ -201,14 +201,14 @@ extern int __uncore_max_dies; + } + + #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __uncore_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ ++static ssize_t __uncore_##_var##_show(struct device *dev, \ ++ struct device_attribute *attr, \ + char *page) \ + { \ + BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ + return sprintf(page, _format "\n"); \ + } \ +-static struct kobj_attribute format_attr_##_var = \ ++static struct device_attribute format_attr_##_var = \ + __ATTR(_name, 0444, __uncore_##_var##_show, NULL) + + static inline bool uncore_pmc_fixed(int idx) +diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c +index 67b411f7e8c41..abaed36212250 100644 +--- a/arch/x86/events/rapl.c ++++ b/arch/x86/events/rapl.c +@@ -93,18 +93,6 @@ static const char *const rapl_domain_names[NR_RAPL_DOMAINS] __initconst = { + * any other bit is reserved + */ + #define RAPL_EVENT_MASK 0xFFULL +- +-#define DEFINE_RAPL_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __rapl_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ +- char *page) \ +-{ \ +- BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ +- return sprintf(page, _format "\n"); \ +-} \ +-static struct kobj_attribute format_attr_##_var = \ +- __ATTR(_name, 0444, __rapl_##_var##_show, NULL) +- + #define RAPL_CNTR_WIDTH 32 + + #define RAPL_EVENT_ATTR_STR(_name, v, str) \ +@@ -441,7 +429,7 @@ static struct attribute_group rapl_pmu_events_group = { + .attrs = attrs_empty, + }; + +-DEFINE_RAPL_FORMAT_ATTR(event, event, "config:0-7"); ++PMU_FORMAT_ATTR(event, "config:0-7"); + static struct attribute *rapl_formats_attr[] = { + &format_attr_event.attr, + NULL, +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 5303dbc5c9bce..7b54213551c6f 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -1603,6 +1603,7 @@ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); + int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); + int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v); + int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu); ++int kvm_cpu_has_extint(struct kvm_vcpu *v); + int kvm_arch_interrupt_allowed(struct kvm_vcpu *vcpu); + int kvm_cpu_get_interrupt(struct kvm_vcpu *v); + void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event); +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 581fb7223ad0e..d41b70fe4918e 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -739,11 +739,13 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) + if (boot_cpu_has(X86_FEATURE_IBPB)) { + setup_force_cpu_cap(X86_FEATURE_USE_IBPB); + ++ spectre_v2_user_ibpb = mode; + switch (cmd) { + case SPECTRE_V2_USER_CMD_FORCE: + case SPECTRE_V2_USER_CMD_PRCTL_IBPB: + case SPECTRE_V2_USER_CMD_SECCOMP_IBPB: + static_branch_enable(&switch_mm_always_ibpb); ++ spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT; + break; + case SPECTRE_V2_USER_CMD_PRCTL: + case SPECTRE_V2_USER_CMD_AUTO: +@@ -757,8 +759,6 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) + pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n", + static_key_enabled(&switch_mm_always_ibpb) ? + "always-on" : "conditional"); +- +- spectre_v2_user_ibpb = mode; + } + + /* +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index de29c4a267c05..35a6eb03a6a02 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -1363,8 +1363,10 @@ noinstr void do_machine_check(struct pt_regs *regs) + * When there's any problem use only local no_way_out state. + */ + if (!lmce) { +- if (mce_end(order) < 0) +- no_way_out = worst >= MCE_PANIC_SEVERITY; ++ if (mce_end(order) < 0) { ++ if (!no_way_out) ++ no_way_out = worst >= MCE_PANIC_SEVERITY; ++ } + } else { + /* + * If there was a fatal machine check we should have +diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c +index 3f844f14fc0a6..799b60c9f8927 100644 +--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c ++++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c +@@ -507,6 +507,24 @@ unlock: + return ret ?: nbytes; + } + ++/** ++ * rdtgroup_remove - the helper to remove resource group safely ++ * @rdtgrp: resource group to remove ++ * ++ * On resource group creation via a mkdir, an extra kernfs_node reference is ++ * taken to ensure that the rdtgroup structure remains accessible for the ++ * rdtgroup_kn_unlock() calls where it is removed. ++ * ++ * Drop the extra reference here, then free the rdtgroup structure. ++ * ++ * Return: void ++ */ ++static void rdtgroup_remove(struct rdtgroup *rdtgrp) ++{ ++ kernfs_put(rdtgrp->kn); ++ kfree(rdtgrp); ++} ++ + struct task_move_callback { + struct callback_head work; + struct rdtgroup *rdtgrp; +@@ -529,7 +547,7 @@ static void move_myself(struct callback_head *head) + (rdtgrp->flags & RDT_DELETED)) { + current->closid = 0; + current->rmid = 0; +- kfree(rdtgrp); ++ rdtgroup_remove(rdtgrp); + } + + if (unlikely(current->flags & PF_EXITING)) +@@ -1708,7 +1726,6 @@ static int rdtgroup_mkdir_info_resdir(struct rdt_resource *r, char *name, + if (IS_ERR(kn_subdir)) + return PTR_ERR(kn_subdir); + +- kernfs_get(kn_subdir); + ret = rdtgroup_kn_set_ugid(kn_subdir); + if (ret) + return ret; +@@ -1731,7 +1748,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn) + kn_info = kernfs_create_dir(parent_kn, "info", parent_kn->mode, NULL); + if (IS_ERR(kn_info)) + return PTR_ERR(kn_info); +- kernfs_get(kn_info); + + ret = rdtgroup_add_files(kn_info, RF_TOP_INFO); + if (ret) +@@ -1752,12 +1768,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn) + goto out_destroy; + } + +- /* +- * This extra ref will be put in kernfs_remove() and guarantees +- * that @rdtgrp->kn is always accessible. +- */ +- kernfs_get(kn_info); +- + ret = rdtgroup_kn_set_ugid(kn_info); + if (ret) + goto out_destroy; +@@ -1786,12 +1796,6 @@ mongroup_create_dir(struct kernfs_node *parent_kn, struct rdtgroup *prgrp, + if (dest_kn) + *dest_kn = kn; + +- /* +- * This extra ref will be put in kernfs_remove() and guarantees +- * that @rdtgrp->kn is always accessible. +- */ +- kernfs_get(kn); +- + ret = rdtgroup_kn_set_ugid(kn); + if (ret) + goto out_destroy; +@@ -2018,8 +2022,7 @@ void rdtgroup_kn_unlock(struct kernfs_node *kn) + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) + rdtgroup_pseudo_lock_remove(rdtgrp); + kernfs_unbreak_active_protection(kn); +- kernfs_put(rdtgrp->kn); +- kfree(rdtgrp); ++ rdtgroup_remove(rdtgrp); + } else { + kernfs_unbreak_active_protection(kn); + } +@@ -2078,13 +2081,11 @@ static int rdt_get_tree(struct fs_context *fc) + &kn_mongrp); + if (ret < 0) + goto out_info; +- kernfs_get(kn_mongrp); + + ret = mkdir_mondata_all(rdtgroup_default.kn, + &rdtgroup_default, &kn_mondata); + if (ret < 0) + goto out_mongrp; +- kernfs_get(kn_mondata); + rdtgroup_default.mon.mon_data_kn = kn_mondata; + } + +@@ -2308,7 +2309,7 @@ static void free_all_child_rdtgrp(struct rdtgroup *rdtgrp) + if (atomic_read(&sentry->waitcount) != 0) + sentry->flags = RDT_DELETED; + else +- kfree(sentry); ++ rdtgroup_remove(sentry); + } + } + +@@ -2350,7 +2351,7 @@ static void rmdir_all_sub(void) + if (atomic_read(&rdtgrp->waitcount) != 0) + rdtgrp->flags = RDT_DELETED; + else +- kfree(rdtgrp); ++ rdtgroup_remove(rdtgrp); + } + /* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */ + update_closid_rmid(cpu_online_mask, &rdtgroup_default); +@@ -2450,11 +2451,6 @@ static int mkdir_mondata_subdir(struct kernfs_node *parent_kn, + if (IS_ERR(kn)) + return PTR_ERR(kn); + +- /* +- * This extra ref will be put in kernfs_remove() and guarantees +- * that kn is always accessible. +- */ +- kernfs_get(kn); + ret = rdtgroup_kn_set_ugid(kn); + if (ret) + goto out_destroy; +@@ -2789,8 +2785,8 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, + /* + * kernfs_remove() will drop the reference count on "kn" which + * will free it. But we still need it to stick around for the +- * rdtgroup_kn_unlock(kn} call below. Take one extra reference +- * here, which will be dropped inside rdtgroup_kn_unlock(). ++ * rdtgroup_kn_unlock(kn) call. Take one extra reference here, ++ * which will be dropped by kernfs_put() in rdtgroup_remove(). + */ + kernfs_get(kn); + +@@ -2831,6 +2827,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, + out_idfree: + free_rmid(rdtgrp->mon.rmid); + out_destroy: ++ kernfs_put(rdtgrp->kn); + kernfs_remove(rdtgrp->kn); + out_free_rgrp: + kfree(rdtgrp); +@@ -2843,7 +2840,7 @@ static void mkdir_rdt_prepare_clean(struct rdtgroup *rgrp) + { + kernfs_remove(rgrp->kn); + free_rmid(rgrp->mon.rmid); +- kfree(rgrp); ++ rdtgroup_remove(rgrp); + } + + /* +@@ -3000,11 +2997,6 @@ static int rdtgroup_rmdir_mon(struct kernfs_node *kn, struct rdtgroup *rdtgrp, + WARN_ON(list_empty(&prdtgrp->mon.crdtgrp_list)); + list_del(&rdtgrp->mon.crdtgrp_list); + +- /* +- * one extra hold on this, will drop when we kfree(rdtgrp) +- * in rdtgroup_kn_unlock() +- */ +- kernfs_get(kn); + kernfs_remove(rdtgrp->kn); + + return 0; +@@ -3016,11 +3008,6 @@ static int rdtgroup_ctrl_remove(struct kernfs_node *kn, + rdtgrp->flags = RDT_DELETED; + list_del(&rdtgrp->rdtgroup_list); + +- /* +- * one extra hold on this, will drop when we kfree(rdtgrp) +- * in rdtgroup_kn_unlock() +- */ +- kernfs_get(kn); + kernfs_remove(rdtgrp->kn); + return 0; + } +diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c +index ea8d51ec251bb..4da8345d34bb0 100644 +--- a/arch/x86/kernel/dumpstack.c ++++ b/arch/x86/kernel/dumpstack.c +@@ -77,6 +77,9 @@ static int copy_code(struct pt_regs *regs, u8 *buf, unsigned long src, + if (!user_mode(regs)) + return copy_from_kernel_nofault(buf, (u8 *)src, nbytes); + ++ /* The user space code from other tasks cannot be accessed. */ ++ if (regs != task_pt_regs(current)) ++ return -EPERM; + /* + * Make sure userspace isn't trying to trick us into dumping kernel + * memory by pointing the userspace instruction pointer at it. +@@ -84,6 +87,12 @@ static int copy_code(struct pt_regs *regs, u8 *buf, unsigned long src, + if (__chk_range_not_ok(src, nbytes, TASK_SIZE_MAX)) + return -EINVAL; + ++ /* ++ * Even if named copy_from_user_nmi() this can be invoked from ++ * other contexts and will not try to resolve a pagefault, which is ++ * the correct thing to do here as this code can be called from any ++ * context. ++ */ + return copy_from_user_nmi(buf, (void __user *)src, nbytes); + } + +@@ -114,13 +123,19 @@ void show_opcodes(struct pt_regs *regs, const char *loglvl) + u8 opcodes[OPCODE_BUFSIZE]; + unsigned long prologue = regs->ip - PROLOGUE_SIZE; + +- if (copy_code(regs, opcodes, prologue, sizeof(opcodes))) { +- printk("%sCode: Unable to access opcode bytes at RIP 0x%lx.\n", +- loglvl, prologue); +- } else { ++ switch (copy_code(regs, opcodes, prologue, sizeof(opcodes))) { ++ case 0: + printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %" + __stringify(EPILOGUE_SIZE) "ph\n", loglvl, opcodes, + opcodes[PROLOGUE_SIZE], opcodes + PROLOGUE_SIZE + 1); ++ break; ++ case -EPERM: ++ /* No access to the user space stack of other tasks. Ignore. */ ++ break; ++ default: ++ printk("%sCode: Unable to access opcode bytes at RIP 0x%lx.\n", ++ loglvl, prologue); ++ break; + } + } + +diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c +index 420be871d9d45..ae64f98ec2ab6 100644 +--- a/arch/x86/kernel/tboot.c ++++ b/arch/x86/kernel/tboot.c +@@ -514,13 +514,10 @@ int tboot_force_iommu(void) + if (!tboot_enabled()) + return 0; + +- if (no_iommu || swiotlb || dmar_disabled) ++ if (no_iommu || dmar_disabled) + pr_warn("Forcing Intel-IOMMU to enabled\n"); + + dmar_disabled = 0; +-#ifdef CONFIG_SWIOTLB +- swiotlb = 0; +-#endif + no_iommu = 0; + + return 1; +diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c +index 99d118ffc67db..814698e5b1526 100644 +--- a/arch/x86/kvm/irq.c ++++ b/arch/x86/kvm/irq.c +@@ -40,29 +40,10 @@ static int pending_userspace_extint(struct kvm_vcpu *v) + * check if there is pending interrupt from + * non-APIC source without intack. + */ +-static int kvm_cpu_has_extint(struct kvm_vcpu *v) +-{ +- u8 accept = kvm_apic_accept_pic_intr(v); +- +- if (accept) { +- if (irqchip_split(v->kvm)) +- return pending_userspace_extint(v); +- else +- return v->kvm->arch.vpic->output; +- } else +- return 0; +-} +- +-/* +- * check if there is injectable interrupt: +- * when virtual interrupt delivery enabled, +- * interrupt from apic will handled by hardware, +- * we don't need to check it here. +- */ +-int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v) ++int kvm_cpu_has_extint(struct kvm_vcpu *v) + { + /* +- * FIXME: interrupt.injected represents an interrupt that it's ++ * FIXME: interrupt.injected represents an interrupt whose + * side-effects have already been applied (e.g. bit from IRR + * already moved to ISR). Therefore, it is incorrect to rely + * on interrupt.injected to know if there is a pending +@@ -75,6 +56,23 @@ int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v) + if (!lapic_in_kernel(v)) + return v->arch.interrupt.injected; + ++ if (!kvm_apic_accept_pic_intr(v)) ++ return 0; ++ ++ if (irqchip_split(v->kvm)) ++ return pending_userspace_extint(v); ++ else ++ return v->kvm->arch.vpic->output; ++} ++ ++/* ++ * check if there is injectable interrupt: ++ * when virtual interrupt delivery enabled, ++ * interrupt from apic will handled by hardware, ++ * we don't need to check it here. ++ */ ++int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v) ++{ + if (kvm_cpu_has_extint(v)) + return 1; + +@@ -91,20 +89,6 @@ EXPORT_SYMBOL_GPL(kvm_cpu_has_injectable_intr); + */ + int kvm_cpu_has_interrupt(struct kvm_vcpu *v) + { +- /* +- * FIXME: interrupt.injected represents an interrupt that it's +- * side-effects have already been applied (e.g. bit from IRR +- * already moved to ISR). Therefore, it is incorrect to rely +- * on interrupt.injected to know if there is a pending +- * interrupt in the user-mode LAPIC. +- * This leads to nVMX/nSVM not be able to distinguish +- * if it should exit from L2 to L1 on EXTERNAL_INTERRUPT on +- * pending interrupt or should re-inject an injected +- * interrupt. +- */ +- if (!lapic_in_kernel(v)) +- return v->arch.interrupt.injected; +- + if (kvm_cpu_has_extint(v)) + return 1; + +@@ -118,16 +102,21 @@ EXPORT_SYMBOL_GPL(kvm_cpu_has_interrupt); + */ + static int kvm_cpu_get_extint(struct kvm_vcpu *v) + { +- if (kvm_cpu_has_extint(v)) { +- if (irqchip_split(v->kvm)) { +- int vector = v->arch.pending_external_vector; +- +- v->arch.pending_external_vector = -1; +- return vector; +- } else +- return kvm_pic_read_irq(v->kvm); /* PIC */ +- } else ++ if (!kvm_cpu_has_extint(v)) { ++ WARN_ON(!lapic_in_kernel(v)); + return -1; ++ } ++ ++ if (!lapic_in_kernel(v)) ++ return v->arch.interrupt.nr; ++ ++ if (irqchip_split(v->kvm)) { ++ int vector = v->arch.pending_external_vector; ++ ++ v->arch.pending_external_vector = -1; ++ return vector; ++ } else ++ return kvm_pic_read_irq(v->kvm); /* PIC */ + } + + /* +@@ -135,13 +124,7 @@ static int kvm_cpu_get_extint(struct kvm_vcpu *v) + */ + int kvm_cpu_get_interrupt(struct kvm_vcpu *v) + { +- int vector; +- +- if (!lapic_in_kernel(v)) +- return v->arch.interrupt.nr; +- +- vector = kvm_cpu_get_extint(v); +- ++ int vector = kvm_cpu_get_extint(v); + if (vector != -1) + return vector; /* PIC */ + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 8055a486d843d..1fc1a8e8cce02 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2461,7 +2461,7 @@ int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu) + struct kvm_lapic *apic = vcpu->arch.apic; + u32 ppr; + +- if (!kvm_apic_hw_enabled(apic)) ++ if (!kvm_apic_present(vcpu)) + return -1; + + __apic_update_ppr(apic, &ppr); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index bacfc9e94a62b..6e5ed3dc4f298 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3839,21 +3839,23 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu, + + static int kvm_cpu_accept_dm_intr(struct kvm_vcpu *vcpu) + { ++ /* ++ * We can accept userspace's request for interrupt injection ++ * as long as we have a place to store the interrupt number. ++ * The actual injection will happen when the CPU is able to ++ * deliver the interrupt. ++ */ ++ if (kvm_cpu_has_extint(vcpu)) ++ return false; ++ ++ /* Acknowledging ExtINT does not happen if LINT0 is masked. */ + return (!lapic_in_kernel(vcpu) || + kvm_apic_accept_pic_intr(vcpu)); + } + +-/* +- * if userspace requested an interrupt window, check that the +- * interrupt window is open. +- * +- * No need to exit to userspace if we already have an interrupt queued. +- */ + static int kvm_vcpu_ready_for_interrupt_injection(struct kvm_vcpu *vcpu) + { + return kvm_arch_interrupt_allowed(vcpu) && +- !kvm_cpu_has_interrupt(vcpu) && +- !kvm_event_needs_reinjection(vcpu) && + kvm_cpu_accept_dm_intr(vcpu); + } + +diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c +index 799f4eba0a621..043c73dfd2c98 100644 +--- a/arch/x86/xen/spinlock.c ++++ b/arch/x86/xen/spinlock.c +@@ -93,10 +93,20 @@ void xen_init_lock_cpu(int cpu) + + void xen_uninit_lock_cpu(int cpu) + { ++ int irq; ++ + if (!xen_pvspin) + return; + +- unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL); ++ /* ++ * When booting the kernel with 'mitigations=auto,nosmt', the secondary ++ * CPUs are not activated, and lock_kicker_irq is not initialized. ++ */ ++ irq = per_cpu(lock_kicker_irq, cpu); ++ if (irq == -1) ++ return; ++ ++ unbind_from_irqhandler(irq, NULL); + per_cpu(lock_kicker_irq, cpu) = -1; + kfree(per_cpu(irq_name, cpu)); + per_cpu(irq_name, cpu) = NULL; +diff --git a/arch/xtensa/include/asm/uaccess.h b/arch/xtensa/include/asm/uaccess.h +index b9758119feca1..5c9fb8005aa89 100644 +--- a/arch/xtensa/include/asm/uaccess.h ++++ b/arch/xtensa/include/asm/uaccess.h +@@ -302,7 +302,7 @@ strncpy_from_user(char *dst, const char __user *src, long count) + return -EFAULT; + } + #else +-long strncpy_from_user(char *dst, const char *src, long count); ++long strncpy_from_user(char *dst, const char __user *src, long count); + #endif + + /* +diff --git a/block/keyslot-manager.c b/block/keyslot-manager.c +index 35abcb1ec051d..86f8195d8039e 100644 +--- a/block/keyslot-manager.c ++++ b/block/keyslot-manager.c +@@ -103,6 +103,13 @@ int blk_ksm_init(struct blk_keyslot_manager *ksm, unsigned int num_slots) + spin_lock_init(&ksm->idle_slots_lock); + + slot_hashtable_size = roundup_pow_of_two(num_slots); ++ /* ++ * hash_ptr() assumes bits != 0, so ensure the hash table has at least 2 ++ * buckets. This only makes a difference when there is only 1 keyslot. ++ */ ++ if (slot_hashtable_size < 2) ++ slot_hashtable_size = 2; ++ + ksm->log_slot_ht_size = ilog2(slot_hashtable_size); + ksm->slot_hashtable = kvmalloc_array(slot_hashtable_size, + sizeof(ksm->slot_hashtable[0]), +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index efb088df12766..92ecf1a78ec73 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -227,6 +227,9 @@ static int sysc_wait_softreset(struct sysc *ddata) + u32 sysc_mask, syss_done, rstval; + int syss_offset, error = 0; + ++ if (ddata->cap->regbits->srst_shift < 0) ++ return 0; ++ + syss_offset = ddata->offsets[SYSC_SYSSTATUS]; + sysc_mask = BIT(ddata->cap->regbits->srst_shift); + +@@ -970,9 +973,15 @@ static int sysc_enable_module(struct device *dev) + return error; + } + } +- error = sysc_wait_softreset(ddata); +- if (error) +- dev_warn(ddata->dev, "OCP softreset timed out\n"); ++ /* ++ * Some modules like i2c and hdq1w have unusable reset status unless ++ * the module reset quirk is enabled. Skip status check on enable. ++ */ ++ if (!(ddata->cfg.quirks & SYSC_MODULE_QUIRK_ENA_RESETDONE)) { ++ error = sysc_wait_softreset(ddata); ++ if (error) ++ dev_warn(ddata->dev, "OCP softreset timed out\n"); ++ } + if (ddata->cfg.quirks & SYSC_QUIRK_OPT_CLKS_IN_RESET) + sysc_disable_opt_clocks(ddata); + +@@ -1373,17 +1382,17 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { + SYSC_QUIRK("hdmi", 0, 0, 0x10, -ENODEV, 0x50030200, 0xffffffff, + SYSC_QUIRK_OPT_CLKS_NEEDED), + SYSC_QUIRK("hdq1w", 0, 0, 0x14, 0x18, 0x00000006, 0xffffffff, +- SYSC_MODULE_QUIRK_HDQ1W), ++ SYSC_MODULE_QUIRK_HDQ1W | SYSC_MODULE_QUIRK_ENA_RESETDONE), + SYSC_QUIRK("hdq1w", 0, 0, 0x14, 0x18, 0x0000000a, 0xffffffff, +- SYSC_MODULE_QUIRK_HDQ1W), ++ SYSC_MODULE_QUIRK_HDQ1W | SYSC_MODULE_QUIRK_ENA_RESETDONE), + SYSC_QUIRK("i2c", 0, 0, 0x20, 0x10, 0x00000036, 0x000000ff, +- SYSC_MODULE_QUIRK_I2C), ++ SYSC_MODULE_QUIRK_I2C | SYSC_MODULE_QUIRK_ENA_RESETDONE), + SYSC_QUIRK("i2c", 0, 0, 0x20, 0x10, 0x0000003c, 0x000000ff, +- SYSC_MODULE_QUIRK_I2C), ++ SYSC_MODULE_QUIRK_I2C | SYSC_MODULE_QUIRK_ENA_RESETDONE), + SYSC_QUIRK("i2c", 0, 0, 0x20, 0x10, 0x00000040, 0x000000ff, +- SYSC_MODULE_QUIRK_I2C), ++ SYSC_MODULE_QUIRK_I2C | SYSC_MODULE_QUIRK_ENA_RESETDONE), + SYSC_QUIRK("i2c", 0, 0, 0x10, 0x90, 0x5040000a, 0xfffff0f0, +- SYSC_MODULE_QUIRK_I2C), ++ SYSC_MODULE_QUIRK_I2C | SYSC_MODULE_QUIRK_ENA_RESETDONE), + SYSC_QUIRK("gpu", 0x50000000, 0x14, -ENODEV, -ENODEV, 0x00010201, 0xffffffff, 0), + SYSC_QUIRK("gpu", 0x50000000, 0xfe00, 0xfe10, -ENODEV, 0x40000000 , 0xffffffff, + SYSC_MODULE_QUIRK_SGX), +@@ -2880,7 +2889,7 @@ static int sysc_check_active_timer(struct sysc *ddata) + + if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) && + (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE)) +- return -EBUSY; ++ return -ENXIO; + + return 0; + } +diff --git a/drivers/cpuidle/cpuidle-tegra.c b/drivers/cpuidle/cpuidle-tegra.c +index e8956706a2917..191966dc8d023 100644 +--- a/drivers/cpuidle/cpuidle-tegra.c ++++ b/drivers/cpuidle/cpuidle-tegra.c +@@ -189,7 +189,7 @@ static int tegra_cpuidle_state_enter(struct cpuidle_device *dev, + } + + local_fiq_disable(); +- tegra_pm_set_cpu_in_lp2(); ++ RCU_NONIDLE(tegra_pm_set_cpu_in_lp2()); + cpu_pm_enter(); + + switch (index) { +@@ -207,7 +207,7 @@ static int tegra_cpuidle_state_enter(struct cpuidle_device *dev, + } + + cpu_pm_exit(); +- tegra_pm_clear_cpu_in_lp2(); ++ RCU_NONIDLE(tegra_pm_clear_cpu_in_lp2()); + local_fiq_enable(); + + return err ?: index; +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 5274a0704d960..2c3c47e4f7770 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2802,7 +2802,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + * If burst size is smaller than bus width then make sure we only + * transfer one at a time to avoid a burst stradling an MFIFO entry. + */ +- if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) ++ if (burst * 8 < pl330->pcfg.data_bus_width) + desc->rqcfg.brst_len = 1; + + desc->bytes_requested = len; +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 0fc432567b857..993297d585c01 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -517,8 +517,8 @@ struct xilinx_dma_device { + #define to_dma_tx_descriptor(tx) \ + container_of(tx, struct xilinx_dma_tx_descriptor, async_tx) + #define xilinx_dma_poll_timeout(chan, reg, val, cond, delay_us, timeout_us) \ +- readl_poll_timeout(chan->xdev->regs + chan->ctrl_offset + reg, val, \ +- cond, delay_us, timeout_us) ++ readl_poll_timeout_atomic(chan->xdev->regs + chan->ctrl_offset + reg, \ ++ val, cond, delay_us, timeout_us) + + /* IO accessors */ + static inline u32 dma_read(struct xilinx_dma_chan *chan, u32 reg) +diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig +index 3939699e62fe0..929d6f05b6bb1 100644 +--- a/drivers/firmware/efi/Kconfig ++++ b/drivers/firmware/efi/Kconfig +@@ -275,7 +275,7 @@ config EFI_DEV_PATH_PARSER + + config EFI_EARLYCON + def_bool y +- depends on SERIAL_EARLYCON && !ARM && !IA64 ++ depends on EFI && SERIAL_EARLYCON && !ARM && !IA64 + select FONT_SUPPORT + select ARCH_USE_MEMREMAP_PROT + +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index 3aa07c3b51369..8ead4379e6e85 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -387,10 +387,10 @@ static int __init efisubsys_init(void) + + if (efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE | + EFI_RT_SUPPORTED_GET_NEXT_VARIABLE_NAME)) { +- efivar_ssdt_load(); + error = generic_ops_register(); + if (error) + goto err_put; ++ efivar_ssdt_load(); + platform_device_register_simple("efivars", 0, NULL, 0); + } + +diff --git a/drivers/firmware/xilinx/zynqmp.c b/drivers/firmware/xilinx/zynqmp.c +index efb8a66efc684..d08ac824c993c 100644 +--- a/drivers/firmware/xilinx/zynqmp.c ++++ b/drivers/firmware/xilinx/zynqmp.c +@@ -20,12 +20,28 @@ + #include <linux/of_platform.h> + #include <linux/slab.h> + #include <linux/uaccess.h> ++#include <linux/hashtable.h> + + #include <linux/firmware/xlnx-zynqmp.h> + #include "zynqmp-debug.h" + ++/* Max HashMap Order for PM API feature check (1<<7 = 128) */ ++#define PM_API_FEATURE_CHECK_MAX_ORDER 7 ++ + static bool feature_check_enabled; +-static u32 zynqmp_pm_features[PM_API_MAX]; ++DEFINE_HASHTABLE(pm_api_features_map, PM_API_FEATURE_CHECK_MAX_ORDER); ++ ++/** ++ * struct pm_api_feature_data - PM API Feature data ++ * @pm_api_id: PM API Id, used as key to index into hashmap ++ * @feature_status: status of PM API feature: valid, invalid ++ * @hentry: hlist_node that hooks this entry into hashtable ++ */ ++struct pm_api_feature_data { ++ u32 pm_api_id; ++ int feature_status; ++ struct hlist_node hentry; ++}; + + static const struct mfd_cell firmware_devs[] = { + { +@@ -142,29 +158,37 @@ static int zynqmp_pm_feature(u32 api_id) + int ret; + u32 ret_payload[PAYLOAD_ARG_CNT]; + u64 smc_arg[2]; ++ struct pm_api_feature_data *feature_data; + + if (!feature_check_enabled) + return 0; + +- /* Return value if feature is already checked */ +- if (api_id > ARRAY_SIZE(zynqmp_pm_features)) +- return PM_FEATURE_INVALID; ++ /* Check for existing entry in hash table for given api */ ++ hash_for_each_possible(pm_api_features_map, feature_data, hentry, ++ api_id) { ++ if (feature_data->pm_api_id == api_id) ++ return feature_data->feature_status; ++ } + +- if (zynqmp_pm_features[api_id] != PM_FEATURE_UNCHECKED) +- return zynqmp_pm_features[api_id]; ++ /* Add new entry if not present */ ++ feature_data = kmalloc(sizeof(*feature_data), GFP_KERNEL); ++ if (!feature_data) ++ return -ENOMEM; + ++ feature_data->pm_api_id = api_id; + smc_arg[0] = PM_SIP_SVC | PM_FEATURE_CHECK; + smc_arg[1] = api_id; + + ret = do_fw_call(smc_arg[0], smc_arg[1], 0, ret_payload); +- if (ret) { +- zynqmp_pm_features[api_id] = PM_FEATURE_INVALID; +- return PM_FEATURE_INVALID; +- } ++ if (ret) ++ ret = -EOPNOTSUPP; ++ else ++ ret = ret_payload[1]; + +- zynqmp_pm_features[api_id] = ret_payload[1]; ++ feature_data->feature_status = ret; ++ hash_add(pm_api_features_map, &feature_data->hentry, api_id); + +- return zynqmp_pm_features[api_id]; ++ return ret; + } + + /** +@@ -200,9 +224,12 @@ int zynqmp_pm_invoke_fn(u32 pm_api_id, u32 arg0, u32 arg1, + * Make sure to stay in x0 register + */ + u64 smc_arg[4]; ++ int ret; + +- if (zynqmp_pm_feature(pm_api_id) == PM_FEATURE_INVALID) +- return -ENOTSUPP; ++ /* Check if feature is supported or not */ ++ ret = zynqmp_pm_feature(pm_api_id); ++ if (ret < 0) ++ return ret; + + smc_arg[0] = PM_SIP_SVC | pm_api_id; + smc_arg[1] = ((u64)arg1 << 32) | arg0; +@@ -615,7 +642,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_set_sd_tapdelay); + */ + int zynqmp_pm_sd_dll_reset(u32 node_id, u32 type) + { +- return zynqmp_pm_invoke_fn(PM_IOCTL, node_id, IOCTL_SET_SD_TAPDELAY, ++ return zynqmp_pm_invoke_fn(PM_IOCTL, node_id, IOCTL_SD_DLL_RESET, + type, 0, NULL); + } + EXPORT_SYMBOL_GPL(zynqmp_pm_sd_dll_reset); +@@ -1252,9 +1279,17 @@ static int zynqmp_firmware_probe(struct platform_device *pdev) + + static int zynqmp_firmware_remove(struct platform_device *pdev) + { ++ struct pm_api_feature_data *feature_data; ++ int i; ++ + mfd_remove_devices(&pdev->dev); + zynqmp_pm_api_debugfs_exit(); + ++ hash_for_each(pm_api_features_map, i, feature_data, hentry) { ++ hash_del(&feature_data->hentry); ++ kfree(feature_data); ++ } ++ + return 0; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index b4a8da8fc8fd7..1595b124c1457 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4593,7 +4593,7 @@ int amdgpu_device_baco_enter(struct drm_device *dev) + if (!amdgpu_device_supports_baco(adev->ddev)) + return -ENOTSUPP; + +- if (ras && ras->supported) ++ if (ras && ras->supported && adev->nbio.funcs->enable_doorbell_interrupt) + adev->nbio.funcs->enable_doorbell_interrupt(adev, false); + + return amdgpu_dpm_baco_enter(adev); +@@ -4612,7 +4612,7 @@ int amdgpu_device_baco_exit(struct drm_device *dev) + if (ret) + return ret; + +- if (ras && ras->supported) ++ if (ras && ras->supported && adev->nbio.funcs->enable_doorbell_interrupt) + adev->nbio.funcs->enable_doorbell_interrupt(adev, true); + + return 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 7c787ec598f18..d5e95e4ea5bd2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -1571,6 +1571,12 @@ static int psp_get_fw_type(struct amdgpu_firmware_info *ucode, + case AMDGPU_UCODE_ID_RLC_RESTORE_LIST_SRM_MEM: + *type = GFX_FW_TYPE_RLC_RESTORE_LIST_SRM_MEM; + break; ++ case AMDGPU_UCODE_ID_RLC_IRAM: ++ *type = GFX_FW_TYPE_RLC_IRAM; ++ break; ++ case AMDGPU_UCODE_ID_RLC_DRAM: ++ *type = GFX_FW_TYPE_RLC_DRAM_BOOT; ++ break; + case AMDGPU_UCODE_ID_SMC: + *type = GFX_FW_TYPE_SMU; + break; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.h +index 60bb3e8b31188..aeaaae713c59d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.h +@@ -168,12 +168,16 @@ struct amdgpu_rlc { + u32 save_restore_list_cntl_size_bytes; + u32 save_restore_list_gpm_size_bytes; + u32 save_restore_list_srm_size_bytes; ++ u32 rlc_iram_ucode_size_bytes; ++ u32 rlc_dram_ucode_size_bytes; + + u32 *register_list_format; + u32 *register_restore; + u8 *save_restore_list_cntl; + u8 *save_restore_list_gpm; + u8 *save_restore_list_srm; ++ u8 *rlc_iram_ucode; ++ u8 *rlc_dram_ucode; + + bool is_rlc_v2_1; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +index 183743c5fb7bf..c3cc2e8b24064 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +@@ -500,6 +500,8 @@ static int amdgpu_ucode_init_single_fw(struct amdgpu_device *adev, + ucode->ucode_id != AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL && + ucode->ucode_id != AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM && + ucode->ucode_id != AMDGPU_UCODE_ID_RLC_RESTORE_LIST_SRM_MEM && ++ ucode->ucode_id != AMDGPU_UCODE_ID_RLC_IRAM && ++ ucode->ucode_id != AMDGPU_UCODE_ID_RLC_DRAM && + ucode->ucode_id != AMDGPU_UCODE_ID_DMCU_ERAM && + ucode->ucode_id != AMDGPU_UCODE_ID_DMCU_INTV && + ucode->ucode_id != AMDGPU_UCODE_ID_DMCUB)) { +@@ -556,6 +558,14 @@ static int amdgpu_ucode_init_single_fw(struct amdgpu_device *adev, + ucode->ucode_size = adev->gfx.rlc.save_restore_list_srm_size_bytes; + memcpy(ucode->kaddr, adev->gfx.rlc.save_restore_list_srm, + ucode->ucode_size); ++ } else if (ucode->ucode_id == AMDGPU_UCODE_ID_RLC_IRAM) { ++ ucode->ucode_size = adev->gfx.rlc.rlc_iram_ucode_size_bytes; ++ memcpy(ucode->kaddr, adev->gfx.rlc.rlc_iram_ucode, ++ ucode->ucode_size); ++ } else if (ucode->ucode_id == AMDGPU_UCODE_ID_RLC_DRAM) { ++ ucode->ucode_size = adev->gfx.rlc.rlc_dram_ucode_size_bytes; ++ memcpy(ucode->kaddr, adev->gfx.rlc.rlc_dram_ucode, ++ ucode->ucode_size); + } else if (ucode->ucode_id == AMDGPU_UCODE_ID_CP_MES) { + ucode->ucode_size = le32_to_cpu(mes_hdr->mes_ucode_size_bytes); + memcpy(ucode->kaddr, (void *)((uint8_t *)adev->mes.fw->data + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h +index 12a8bc8fca0b0..97c78d91fc2fa 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h +@@ -221,6 +221,15 @@ struct rlc_firmware_header_v2_1 { + uint32_t save_restore_list_srm_offset_bytes; + }; + ++/* version_major=2, version_minor=1 */ ++struct rlc_firmware_header_v2_2 { ++ struct rlc_firmware_header_v2_1 v2_1; ++ uint32_t rlc_iram_ucode_size_bytes; ++ uint32_t rlc_iram_ucode_offset_bytes; ++ uint32_t rlc_dram_ucode_size_bytes; ++ uint32_t rlc_dram_ucode_offset_bytes; ++}; ++ + /* version_major=1, version_minor=0 */ + struct sdma_firmware_header_v1_0 { + struct common_firmware_header header; +@@ -338,6 +347,8 @@ enum AMDGPU_UCODE_ID { + AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL, + AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM, + AMDGPU_UCODE_ID_RLC_RESTORE_LIST_SRM_MEM, ++ AMDGPU_UCODE_ID_RLC_IRAM, ++ AMDGPU_UCODE_ID_RLC_DRAM, + AMDGPU_UCODE_ID_RLC_G, + AMDGPU_UCODE_ID_STORAGE, + AMDGPU_UCODE_ID_SMC, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h +index 5eb63288d1574..edbb8194ee81b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h +@@ -67,6 +67,7 @@ struct amdgpu_uvd { + unsigned harvest_config; + /* store image width to adjust nb memory state */ + unsigned decode_image_width; ++ uint32_t keyselect; + }; + + int amdgpu_uvd_sw_init(struct amdgpu_device *adev); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 3a2af95f2bf0d..514cb4b1e537a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -3105,6 +3105,8 @@ static const struct soc15_reg_golden golden_settings_gc_10_3[] = + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0xffffffff, 0x00000280), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x00800000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_EXCEPTION_CONTROL, 0x7fff0f1f, 0x00b80000), ++ SOC15_REG_GOLDEN_VALUE(GC, 0 ,mmGCEA_SDP_TAG_RESERVE0, 0xffffffff, 0x10100100), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmGCEA_SDP_TAG_RESERVE1, 0xffffffff, 0x17000088), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGCR_GENERAL_CNTL_Sienna_Cichlid, 0x1ff1ffff, 0x00000500), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGE_PC_CNTL, 0x003fffff, 0x00280400), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGL2A_ADDR_MATCH_MASK, 0xffffffff, 0xffffffcf), +@@ -3594,6 +3596,17 @@ static void gfx_v10_0_init_rlc_ext_microcode(struct amdgpu_device *adev) + le32_to_cpu(rlc_hdr->reg_list_format_direct_reg_list_length); + } + ++static void gfx_v10_0_init_rlc_iram_dram_microcode(struct amdgpu_device *adev) ++{ ++ const struct rlc_firmware_header_v2_2 *rlc_hdr; ++ ++ rlc_hdr = (const struct rlc_firmware_header_v2_2 *)adev->gfx.rlc_fw->data; ++ adev->gfx.rlc.rlc_iram_ucode_size_bytes = le32_to_cpu(rlc_hdr->rlc_iram_ucode_size_bytes); ++ adev->gfx.rlc.rlc_iram_ucode = (u8 *)rlc_hdr + le32_to_cpu(rlc_hdr->rlc_iram_ucode_offset_bytes); ++ adev->gfx.rlc.rlc_dram_ucode_size_bytes = le32_to_cpu(rlc_hdr->rlc_dram_ucode_size_bytes); ++ adev->gfx.rlc.rlc_dram_ucode = (u8 *)rlc_hdr + le32_to_cpu(rlc_hdr->rlc_dram_ucode_offset_bytes); ++} ++ + static bool gfx_v10_0_navi10_gfxoff_should_enable(struct amdgpu_device *adev) + { + bool ret = false; +@@ -3709,8 +3722,6 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev) + rlc_hdr = (const struct rlc_firmware_header_v2_0 *)adev->gfx.rlc_fw->data; + version_major = le16_to_cpu(rlc_hdr->header.header_version_major); + version_minor = le16_to_cpu(rlc_hdr->header.header_version_minor); +- if (version_major == 2 && version_minor == 1) +- adev->gfx.rlc.is_rlc_v2_1 = true; + + adev->gfx.rlc_fw_version = le32_to_cpu(rlc_hdr->header.ucode_version); + adev->gfx.rlc_feature_version = le32_to_cpu(rlc_hdr->ucode_feature_version); +@@ -3752,8 +3763,12 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev) + for (i = 0 ; i < (rlc_hdr->reg_list_size_bytes >> 2); i++) + adev->gfx.rlc.register_restore[i] = le32_to_cpu(tmp[i]); + +- if (adev->gfx.rlc.is_rlc_v2_1) +- gfx_v10_0_init_rlc_ext_microcode(adev); ++ if (version_major == 2) { ++ if (version_minor >= 1) ++ gfx_v10_0_init_rlc_ext_microcode(adev); ++ if (version_minor == 2) ++ gfx_v10_0_init_rlc_iram_dram_microcode(adev); ++ } + } + + snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec%s.bin", chip_name, wks); +@@ -3814,8 +3829,7 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev) + adev->firmware.fw_size += + ALIGN(le32_to_cpu(header->ucode_size_bytes), PAGE_SIZE); + } +- if (adev->gfx.rlc.is_rlc_v2_1 && +- adev->gfx.rlc.save_restore_list_cntl_size_bytes && ++ if (adev->gfx.rlc.save_restore_list_cntl_size_bytes && + adev->gfx.rlc.save_restore_list_gpm_size_bytes && + adev->gfx.rlc.save_restore_list_srm_size_bytes) { + info = &adev->firmware.ucode[AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL]; +@@ -3835,6 +3849,21 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev) + info->fw = adev->gfx.rlc_fw; + adev->firmware.fw_size += + ALIGN(adev->gfx.rlc.save_restore_list_srm_size_bytes, PAGE_SIZE); ++ ++ if (adev->gfx.rlc.rlc_iram_ucode_size_bytes && ++ adev->gfx.rlc.rlc_dram_ucode_size_bytes) { ++ info = &adev->firmware.ucode[AMDGPU_UCODE_ID_RLC_IRAM]; ++ info->ucode_id = AMDGPU_UCODE_ID_RLC_IRAM; ++ info->fw = adev->gfx.rlc_fw; ++ adev->firmware.fw_size += ++ ALIGN(adev->gfx.rlc.rlc_iram_ucode_size_bytes, PAGE_SIZE); ++ ++ info = &adev->firmware.ucode[AMDGPU_UCODE_ID_RLC_DRAM]; ++ info->ucode_id = AMDGPU_UCODE_ID_RLC_DRAM; ++ info->fw = adev->gfx.rlc_fw; ++ adev->firmware.fw_size += ++ ALIGN(adev->gfx.rlc.rlc_dram_ucode_size_bytes, PAGE_SIZE); ++ } + } + + info = &adev->firmware.ucode[AMDGPU_UCODE_ID_CP_MEC1]; +diff --git a/drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h b/drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h +index cbc04a5c0fe1d..baf994627b0d7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h ++++ b/drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h +@@ -214,7 +214,7 @@ enum psp_gfx_fw_type { + GFX_FW_TYPE_UVD1 = 23, /* UVD1 VG-20 */ + GFX_FW_TYPE_TOC = 24, /* TOC NV-10 */ + GFX_FW_TYPE_RLC_P = 25, /* RLC P NV */ +- GFX_FW_TYPE_RLX6 = 26, /* RLX6 NV */ ++ GFX_FW_TYPE_RLC_IRAM = 26, /* RLC_IRAM NV */ + GFX_FW_TYPE_GLOBAL_TAP_DELAYS = 27, /* GLOBAL TAP DELAYS NV */ + GFX_FW_TYPE_SE0_TAP_DELAYS = 28, /* SE0 TAP DELAYS NV */ + GFX_FW_TYPE_SE1_TAP_DELAYS = 29, /* SE1 TAP DELAYS NV */ +@@ -236,7 +236,7 @@ enum psp_gfx_fw_type { + GFX_FW_TYPE_ACCUM_CTRL_RAM = 45, /* ACCUM CTRL RAM NV */ + GFX_FW_TYPE_RLCP_CAM = 46, /* RLCP CAM NV */ + GFX_FW_TYPE_RLC_SPP_CAM_EXT = 47, /* RLC SPP CAM EXT NV */ +- GFX_FW_TYPE_RLX6_DRAM_BOOT = 48, /* RLX6 DRAM BOOT NV */ ++ GFX_FW_TYPE_RLC_DRAM_BOOT = 48, /* RLC DRAM BOOT NV */ + GFX_FW_TYPE_VCN0_RAM = 49, /* VCN_RAM NV + RN */ + GFX_FW_TYPE_VCN1_RAM = 50, /* VCN_RAM NV + RN */ + GFX_FW_TYPE_DMUB = 51, /* DMUB RN */ +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +index 7cf4b11a65c5c..41800fcad4102 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +@@ -277,15 +277,8 @@ static void uvd_v3_1_mc_resume(struct amdgpu_device *adev) + */ + static int uvd_v3_1_fw_validate(struct amdgpu_device *adev) + { +- void *ptr; +- uint32_t ucode_len, i; +- uint32_t keysel; +- +- ptr = adev->uvd.inst[0].cpu_addr; +- ptr += 192 + 16; +- memcpy(&ucode_len, ptr, 4); +- ptr += ucode_len; +- memcpy(&keysel, ptr, 4); ++ int i; ++ uint32_t keysel = adev->uvd.keyselect; + + WREG32(mmUVD_FW_START, keysel); + +@@ -550,6 +543,8 @@ static int uvd_v3_1_sw_init(void *handle) + struct amdgpu_ring *ring; + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + int r; ++ void *ptr; ++ uint32_t ucode_len; + + /* UVD TRAP */ + r = amdgpu_irq_add_id(adev, AMDGPU_IRQ_CLIENTID_LEGACY, 124, &adev->uvd.inst->irq); +@@ -571,6 +566,13 @@ static int uvd_v3_1_sw_init(void *handle) + if (r) + return r; + ++ /* Retrieval firmware validate key */ ++ ptr = adev->uvd.inst[0].cpu_addr; ++ ptr += 192 + 16; ++ memcpy(&ucode_len, ptr, 4); ++ ptr += ucode_len; ++ memcpy(&adev->uvd.keyselect, ptr, 4); ++ + r = amdgpu_uvd_entity_init(adev); + + return r; +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 6beccd5a0941a..640cbafdde101 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -960,7 +960,7 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + amdgpu_dm_init_color_mod(); + + #ifdef CONFIG_DRM_AMD_DC_HDCP +- if (adev->asic_type >= CHIP_RAVEN) { ++ if (adev->dm.dc->caps.max_links > 0 && adev->asic_type >= CHIP_RAVEN) { + adev->dm.hdcp_workqueue = hdcp_create_workqueue(adev, &init_params.cp_psp, adev->dm.dc); + + if (!adev->dm.hdcp_workqueue) +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 80b7a082e8740..d6e0a29ea6b28 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -444,7 +444,10 @@ static void mtk_dsi_config_vdo_timing(struct mtk_dsi *dsi) + u32 horizontal_sync_active_byte; + u32 horizontal_backporch_byte; + u32 horizontal_frontporch_byte; ++ u32 horizontal_front_back_byte; ++ u32 data_phy_cycles_byte; + u32 dsi_tmp_buf_bpp, data_phy_cycles; ++ u32 delta; + struct mtk_phy_timing *timing = &dsi->phy_timing; + + struct videomode *vm = &dsi->vm; +@@ -466,50 +469,30 @@ static void mtk_dsi_config_vdo_timing(struct mtk_dsi *dsi) + horizontal_sync_active_byte = (vm->hsync_len * dsi_tmp_buf_bpp - 10); + + if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_SYNC_PULSE) +- horizontal_backporch_byte = vm->hback_porch * dsi_tmp_buf_bpp; ++ horizontal_backporch_byte = vm->hback_porch * dsi_tmp_buf_bpp - 10; + else + horizontal_backporch_byte = (vm->hback_porch + vm->hsync_len) * +- dsi_tmp_buf_bpp; ++ dsi_tmp_buf_bpp - 10; + + data_phy_cycles = timing->lpx + timing->da_hs_prepare + +- timing->da_hs_zero + timing->da_hs_exit; +- +- if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_BURST) { +- if ((vm->hfront_porch + vm->hback_porch) * dsi_tmp_buf_bpp > +- data_phy_cycles * dsi->lanes + 18) { +- horizontal_frontporch_byte = +- vm->hfront_porch * dsi_tmp_buf_bpp - +- (data_phy_cycles * dsi->lanes + 18) * +- vm->hfront_porch / +- (vm->hfront_porch + vm->hback_porch); +- +- horizontal_backporch_byte = +- horizontal_backporch_byte - +- (data_phy_cycles * dsi->lanes + 18) * +- vm->hback_porch / +- (vm->hfront_porch + vm->hback_porch); +- } else { +- DRM_WARN("HFP less than d-phy, FPS will under 60Hz\n"); +- horizontal_frontporch_byte = vm->hfront_porch * +- dsi_tmp_buf_bpp; +- } ++ timing->da_hs_zero + timing->da_hs_exit + 3; ++ ++ delta = dsi->mode_flags & MIPI_DSI_MODE_VIDEO_BURST ? 18 : 12; ++ ++ horizontal_frontporch_byte = vm->hfront_porch * dsi_tmp_buf_bpp; ++ horizontal_front_back_byte = horizontal_frontporch_byte + horizontal_backporch_byte; ++ data_phy_cycles_byte = data_phy_cycles * dsi->lanes + delta; ++ ++ if (horizontal_front_back_byte > data_phy_cycles_byte) { ++ horizontal_frontporch_byte -= data_phy_cycles_byte * ++ horizontal_frontporch_byte / ++ horizontal_front_back_byte; ++ ++ horizontal_backporch_byte -= data_phy_cycles_byte * ++ horizontal_backporch_byte / ++ horizontal_front_back_byte; + } else { +- if ((vm->hfront_porch + vm->hback_porch) * dsi_tmp_buf_bpp > +- data_phy_cycles * dsi->lanes + 12) { +- horizontal_frontporch_byte = +- vm->hfront_porch * dsi_tmp_buf_bpp - +- (data_phy_cycles * dsi->lanes + 12) * +- vm->hfront_porch / +- (vm->hfront_porch + vm->hback_porch); +- horizontal_backporch_byte = horizontal_backporch_byte - +- (data_phy_cycles * dsi->lanes + 12) * +- vm->hback_porch / +- (vm->hfront_porch + vm->hback_porch); +- } else { +- DRM_WARN("HFP less than d-phy, FPS will under 60Hz\n"); +- horizontal_frontporch_byte = vm->hfront_porch * +- dsi_tmp_buf_bpp; +- } ++ DRM_WARN("HFP + HBP less than d-phy, FPS will under 60Hz\n"); + } + + writel(horizontal_sync_active_byte, dsi->regs + DSI_HSA_WC); +diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c +index 124d3dcc5c590..98e99aa8a547e 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -570,8 +570,10 @@ nouveau_gem_pushbuf_validate(struct nouveau_channel *chan, + NV_PRINTK(err, cli, "validating bo list\n"); + validate_fini(op, chan, NULL, NULL); + return ret; ++ } else if (ret > 0) { ++ *apply_relocs = true; + } +- *apply_relocs = ret; ++ + return 0; + } + +@@ -674,7 +676,6 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, + nouveau_bo_wr32(nvbo, r->reloc_bo_offset >> 2, data); + } + +- u_free(reloc); + return ret; + } + +@@ -884,9 +885,10 @@ out: + break; + } + } +- u_free(reloc); + } + out_prevalid: ++ if (!IS_ERR(reloc)) ++ u_free(reloc); + u_free(bo); + u_free(push); + +diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c +index a50ba4a4a1d71..b88f889b3932e 100644 +--- a/drivers/hid/hid-cypress.c ++++ b/drivers/hid/hid-cypress.c +@@ -23,19 +23,17 @@ + #define CP_2WHEEL_MOUSE_HACK 0x02 + #define CP_2WHEEL_MOUSE_HACK_ON 0x04 + ++#define VA_INVAL_LOGICAL_BOUNDARY 0x08 ++ + /* + * Some USB barcode readers from cypress have usage min and usage max in + * the wrong order + */ +-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { +- unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); + unsigned int i; + +- if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX)) +- return rdesc; +- + if (*rsize < 4) + return rdesc; + +@@ -48,6 +46,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, + return rdesc; + } + ++static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ /* ++ * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly ++ * reports Logical Minimum of its Consumer Control device as 572 ++ * (0x02 0x3c). Fix this by setting its Logical Minimum to zero. ++ */ ++ if (*rsize == 25 && ++ rdesc[0] == 0x05 && rdesc[1] == 0x0c && ++ rdesc[2] == 0x09 && rdesc[3] == 0x01 && ++ rdesc[6] == 0x19 && rdesc[7] == 0x00 && ++ rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) { ++ hid_info(hdev, ++ "fixing up varmilo VA104M consumer control report descriptor\n"); ++ rdesc[12] = 0x00; ++ rdesc[13] = 0x00; ++ } ++ return rdesc; ++} ++ ++static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); ++ ++ if (quirks & CP_RDESC_SWAPPED_MIN_MAX) ++ rdesc = cp_rdesc_fixup(hdev, rdesc, rsize); ++ if (quirks & VA_INVAL_LOGICAL_BOUNDARY) ++ rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize); ++ ++ return rdesc; ++} ++ + static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) +@@ -128,6 +160,8 @@ static const struct hid_device_id cp_devices[] = { + .driver_data = CP_RDESC_SWAPPED_MIN_MAX }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE), + .driver_data = CP_2WHEEL_MOUSE_HACK }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1), ++ .driver_data = VA_INVAL_LOGICAL_BOUNDARY }, + { } + }; + MODULE_DEVICE_TABLE(hid, cp_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 79495e218b7fc..a6d63a7590434 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -331,6 +331,8 @@ + #define USB_DEVICE_ID_CYPRESS_BARCODE_4 0xed81 + #define USB_DEVICE_ID_CYPRESS_TRUETOUCH 0xc001 + ++#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1 0X07b1 ++ + #define USB_VENDOR_ID_DATA_MODUL 0x7374 + #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH 0x1201 + +@@ -443,6 +445,10 @@ + #define USB_VENDOR_ID_FRUCTEL 0x25B6 + #define USB_DEVICE_ID_GAMETEL_MT_MODE 0x0002 + ++#define USB_VENDOR_ID_GAMEVICE 0x27F8 ++#define USB_DEVICE_ID_GAMEVICE_GV186 0x0BBE ++#define USB_DEVICE_ID_GAMEVICE_KISHI 0x0BBF ++ + #define USB_VENDOR_ID_GAMERON 0x0810 + #define USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR 0x0001 + #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR 0x0002 +@@ -485,6 +491,7 @@ + #define USB_DEVICE_ID_PENPOWER 0x00f4 + + #define USB_VENDOR_ID_GREENASIA 0x0e8f ++#define USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR 0x3010 + #define USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD 0x3013 + + #define USB_VENDOR_ID_GRETAGMACBETH 0x0971 +@@ -742,6 +749,7 @@ + #define USB_VENDOR_ID_LOGITECH 0x046d + #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e + #define USB_DEVICE_ID_LOGITECH_T651 0xb00c ++#define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD 0xb309 + #define USB_DEVICE_ID_LOGITECH_C007 0xc007 + #define USB_DEVICE_ID_LOGITECH_C077 0xc077 + #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101 +@@ -1297,6 +1305,7 @@ + + #define USB_VENDOR_ID_UGTIZER 0x2179 + #define USB_DEVICE_ID_UGTIZER_TABLET_GP0610 0x0053 ++#define USB_DEVICE_ID_UGTIZER_TABLET_GT5040 0x0077 + + #define USB_VENDOR_ID_VIEWSONIC 0x0543 + #define USB_DEVICE_ID_VIEWSONIC_PD1011 0xe621 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 9770db624bfaf..4dca113924593 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -319,6 +319,9 @@ static const struct hid_device_id hid_battery_quirks[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK, + USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, ++ USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD), ++ HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c +index 044a93f3c1178..742c052b0110a 100644 +--- a/drivers/hid/hid-ite.c ++++ b/drivers/hid/hid-ite.c +@@ -11,6 +11,48 @@ + + #include "hid-ids.h" + ++#define QUIRK_TOUCHPAD_ON_OFF_REPORT BIT(0) ++ ++static __u8 *ite_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) ++{ ++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); ++ ++ if (quirks & QUIRK_TOUCHPAD_ON_OFF_REPORT) { ++ if (*rsize == 188 && rdesc[162] == 0x81 && rdesc[163] == 0x02) { ++ hid_info(hdev, "Fixing up ITE keyboard report descriptor\n"); ++ rdesc[163] = HID_MAIN_ITEM_RELATIVE; ++ } ++ } ++ ++ return rdesc; ++} ++ ++static int ite_input_mapping(struct hid_device *hdev, ++ struct hid_input *hi, struct hid_field *field, ++ struct hid_usage *usage, unsigned long **bit, ++ int *max) ++{ ++ ++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); ++ ++ if ((quirks & QUIRK_TOUCHPAD_ON_OFF_REPORT) && ++ (usage->hid & HID_USAGE_PAGE) == 0x00880000) { ++ if (usage->hid == 0x00880078) { ++ /* Touchpad on, userspace expects F22 for this */ ++ hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_F22); ++ return 1; ++ } ++ if (usage->hid == 0x00880079) { ++ /* Touchpad off, userspace expects F23 for this */ ++ hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_F23); ++ return 1; ++ } ++ return -1; ++ } ++ ++ return 0; ++} ++ + static int ite_event(struct hid_device *hdev, struct hid_field *field, + struct hid_usage *usage, __s32 value) + { +@@ -37,13 +79,27 @@ static int ite_event(struct hid_device *hdev, struct hid_field *field, + return 0; + } + ++static int ite_probe(struct hid_device *hdev, const struct hid_device_id *id) ++{ ++ int ret; ++ ++ hid_set_drvdata(hdev, (void *)id->driver_data); ++ ++ ret = hid_open_report(hdev); ++ if (ret) ++ return ret; ++ ++ return hid_hw_start(hdev, HID_CONNECT_DEFAULT); ++} ++ + static const struct hid_device_id ite_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) }, + { HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) }, + /* ITE8595 USB kbd ctlr, with Synaptics touchpad connected to it. */ + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_SYNAPTICS, +- USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012) }, ++ USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012), ++ .driver_data = QUIRK_TOUCHPAD_ON_OFF_REPORT }, + /* ITE8910 USB kbd ctlr, with Synaptics touchpad connected to it. */ + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_SYNAPTICS, +@@ -55,6 +111,9 @@ MODULE_DEVICE_TABLE(hid, ite_devices); + static struct hid_driver ite_driver = { + .name = "itetech", + .id_table = ite_devices, ++ .probe = ite_probe, ++ .report_fixup = ite_report_fixup, ++ .input_mapping = ite_input_mapping, + .event = ite_event, + }; + module_hid_driver(ite_driver); +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index a2991622702ae..0ca7231195473 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -3997,6 +3997,9 @@ static const struct hid_device_id hidpp_devices[] = { + { /* Keyboard MX5000 (Bluetooth-receiver in HID proxy mode) */ + LDJ_DEVICE(0xb305), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, ++ { /* Dinovo Edge (Bluetooth-receiver in HID proxy mode) */ ++ LDJ_DEVICE(0xb309), ++ .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, + { /* Keyboard MX5500 (Bluetooth-receiver in HID proxy mode) */ + LDJ_DEVICE(0xb30b), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, +@@ -4039,6 +4042,9 @@ static const struct hid_device_id hidpp_devices[] = { + { /* MX5000 keyboard over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb305), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, ++ { /* Dinovo Edge keyboard over Bluetooth */ ++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb309), ++ .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, + { /* MX5500 keyboard over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb30b), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 7a2be0205dfd1..bf7ecab5d9e5e 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -83,7 +83,12 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_FUTABA, USB_DEVICE_ID_LED_DISPLAY), HID_QUIRK_NO_INIT_REPORTS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD), HID_QUIRK_MULTI_INPUT }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_GV186), ++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_KISHI), ++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, +diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c +index 94c7398b5c279..3dd7d32467378 100644 +--- a/drivers/hid/hid-sensor-hub.c ++++ b/drivers/hid/hid-sensor-hub.c +@@ -483,7 +483,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev, + return 1; + + ptr = raw_data; +- ptr++; /* Skip report id */ ++ if (report->id) ++ ptr++; /* Skip report id */ + + spin_lock_irqsave(&pdata->lock, flags); + +diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c +index 86b568037cb8a..8e9c9e646cb7d 100644 +--- a/drivers/hid/hid-uclogic-core.c ++++ b/drivers/hid/hid-uclogic-core.c +@@ -385,6 +385,8 @@ static const struct hid_device_id uclogic_devices[] = { + USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, + USB_DEVICE_ID_UGTIZER_TABLET_GP0610) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, ++ USB_DEVICE_ID_UGTIZER_TABLET_GT5040) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_TABLET_G5) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 7d20d1fcf8d20..d26d8cd98efcf 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -997,6 +997,8 @@ int uclogic_params_init(struct uclogic_params *params, + break; + case VID_PID(USB_VENDOR_ID_UGTIZER, + USB_DEVICE_ID_UGTIZER_TABLET_GP0610): ++ case VID_PID(USB_VENDOR_ID_UGTIZER, ++ USB_DEVICE_ID_UGTIZER_TABLET_GT5040): + case VID_PID(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_G540): + case VID_PID(USB_VENDOR_ID_UGEE, +diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c +index 8ca51e43cf530..329ee4f48d957 100644 +--- a/drivers/infiniband/hw/hfi1/file_ops.c ++++ b/drivers/infiniband/hw/hfi1/file_ops.c +@@ -1,4 +1,5 @@ + /* ++ * Copyright(c) 2020 Cornelis Networks, Inc. + * Copyright(c) 2015-2020 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or +@@ -206,8 +207,6 @@ static int hfi1_file_open(struct inode *inode, struct file *fp) + spin_lock_init(&fd->tid_lock); + spin_lock_init(&fd->invalid_lock); + fd->rec_cpu_num = -1; /* no cpu affinity by default */ +- fd->mm = current->mm; +- mmgrab(fd->mm); + fd->dd = dd; + fp->private_data = fd; + return 0; +@@ -711,7 +710,6 @@ static int hfi1_file_close(struct inode *inode, struct file *fp) + + deallocate_ctxt(uctxt); + done: +- mmdrop(fdata->mm); + + if (atomic_dec_and_test(&dd->user_refcount)) + complete(&dd->user_comp); +diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h +index b4c6bff60a4e8..e09e8244a94c4 100644 +--- a/drivers/infiniband/hw/hfi1/hfi.h ++++ b/drivers/infiniband/hw/hfi1/hfi.h +@@ -1,6 +1,7 @@ + #ifndef _HFI1_KERNEL_H + #define _HFI1_KERNEL_H + /* ++ * Copyright(c) 2020 Cornelis Networks, Inc. + * Copyright(c) 2015-2020 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or +@@ -1451,7 +1452,6 @@ struct hfi1_filedata { + u32 invalid_tid_idx; + /* protect invalid_tids array and invalid_tid_idx */ + spinlock_t invalid_lock; +- struct mm_struct *mm; + }; + + extern struct xarray hfi1_dev_table; +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index 24ca17b77b72b..f3fb28e3d5d74 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -1,4 +1,5 @@ + /* ++ * Copyright(c) 2020 Cornelis Networks, Inc. + * Copyright(c) 2016 - 2017 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or +@@ -48,23 +49,11 @@ + #include <linux/rculist.h> + #include <linux/mmu_notifier.h> + #include <linux/interval_tree_generic.h> ++#include <linux/sched/mm.h> + + #include "mmu_rb.h" + #include "trace.h" + +-struct mmu_rb_handler { +- struct mmu_notifier mn; +- struct rb_root_cached root; +- void *ops_arg; +- spinlock_t lock; /* protect the RB tree */ +- struct mmu_rb_ops *ops; +- struct mm_struct *mm; +- struct list_head lru_list; +- struct work_struct del_work; +- struct list_head del_list; +- struct workqueue_struct *wq; +-}; +- + static unsigned long mmu_node_start(struct mmu_rb_node *); + static unsigned long mmu_node_last(struct mmu_rb_node *); + static int mmu_notifier_range_start(struct mmu_notifier *, +@@ -92,37 +81,36 @@ static unsigned long mmu_node_last(struct mmu_rb_node *node) + return PAGE_ALIGN(node->addr + node->len) - 1; + } + +-int hfi1_mmu_rb_register(void *ops_arg, struct mm_struct *mm, ++int hfi1_mmu_rb_register(void *ops_arg, + struct mmu_rb_ops *ops, + struct workqueue_struct *wq, + struct mmu_rb_handler **handler) + { +- struct mmu_rb_handler *handlr; ++ struct mmu_rb_handler *h; + int ret; + +- handlr = kmalloc(sizeof(*handlr), GFP_KERNEL); +- if (!handlr) ++ h = kmalloc(sizeof(*h), GFP_KERNEL); ++ if (!h) + return -ENOMEM; + +- handlr->root = RB_ROOT_CACHED; +- handlr->ops = ops; +- handlr->ops_arg = ops_arg; +- INIT_HLIST_NODE(&handlr->mn.hlist); +- spin_lock_init(&handlr->lock); +- handlr->mn.ops = &mn_opts; +- handlr->mm = mm; +- INIT_WORK(&handlr->del_work, handle_remove); +- INIT_LIST_HEAD(&handlr->del_list); +- INIT_LIST_HEAD(&handlr->lru_list); +- handlr->wq = wq; +- +- ret = mmu_notifier_register(&handlr->mn, handlr->mm); ++ h->root = RB_ROOT_CACHED; ++ h->ops = ops; ++ h->ops_arg = ops_arg; ++ INIT_HLIST_NODE(&h->mn.hlist); ++ spin_lock_init(&h->lock); ++ h->mn.ops = &mn_opts; ++ INIT_WORK(&h->del_work, handle_remove); ++ INIT_LIST_HEAD(&h->del_list); ++ INIT_LIST_HEAD(&h->lru_list); ++ h->wq = wq; ++ ++ ret = mmu_notifier_register(&h->mn, current->mm); + if (ret) { +- kfree(handlr); ++ kfree(h); + return ret; + } + +- *handler = handlr; ++ *handler = h; + return 0; + } + +@@ -134,7 +122,7 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler) + struct list_head del_list; + + /* Unregister first so we don't get any more notifications. */ +- mmu_notifier_unregister(&handler->mn, handler->mm); ++ mmu_notifier_unregister(&handler->mn, handler->mn.mm); + + /* + * Make sure the wq delete handler is finished running. It will not +@@ -166,6 +154,10 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + int ret = 0; + + trace_hfi1_mmu_rb_insert(mnode->addr, mnode->len); ++ ++ if (current->mm != handler->mn.mm) ++ return -EPERM; ++ + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, mnode->addr, mnode->len); + if (node) { +@@ -180,6 +172,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + __mmu_int_rb_remove(mnode, &handler->root); + list_del(&mnode->list); /* remove from LRU list */ + } ++ mnode->handler = handler; + unlock: + spin_unlock_irqrestore(&handler->lock, flags); + return ret; +@@ -217,6 +210,9 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, + unsigned long flags; + bool ret = false; + ++ if (current->mm != handler->mn.mm) ++ return ret; ++ + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, addr, len); + if (node) { +@@ -239,6 +235,9 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + unsigned long flags; + bool stop = false; + ++ if (current->mm != handler->mn.mm) ++ return; ++ + INIT_LIST_HEAD(&del_list); + + spin_lock_irqsave(&handler->lock, flags); +@@ -272,6 +271,9 @@ void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler, + { + unsigned long flags; + ++ if (current->mm != handler->mn.mm) ++ return; ++ + /* Validity of handler and node pointers has been checked by caller. */ + trace_hfi1_mmu_rb_remove(node->addr, node->len); + spin_lock_irqsave(&handler->lock, flags); +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h +index f04cec1e99d11..423aacc67e948 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.h ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h +@@ -1,4 +1,5 @@ + /* ++ * Copyright(c) 2020 Cornelis Networks, Inc. + * Copyright(c) 2016 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or +@@ -54,6 +55,7 @@ struct mmu_rb_node { + unsigned long len; + unsigned long __last; + struct rb_node node; ++ struct mmu_rb_handler *handler; + struct list_head list; + }; + +@@ -71,7 +73,19 @@ struct mmu_rb_ops { + void *evict_arg, bool *stop); + }; + +-int hfi1_mmu_rb_register(void *ops_arg, struct mm_struct *mm, ++struct mmu_rb_handler { ++ struct mmu_notifier mn; ++ struct rb_root_cached root; ++ void *ops_arg; ++ spinlock_t lock; /* protect the RB tree */ ++ struct mmu_rb_ops *ops; ++ struct list_head lru_list; ++ struct work_struct del_work; ++ struct list_head del_list; ++ struct workqueue_struct *wq; ++}; ++ ++int hfi1_mmu_rb_register(void *ops_arg, + struct mmu_rb_ops *ops, + struct workqueue_struct *wq, + struct mmu_rb_handler **handler); +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index f81ca20f4b693..b94fc7fd75a96 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -1,4 +1,5 @@ + /* ++ * Copyright(c) 2020 Cornelis Networks, Inc. + * Copyright(c) 2015-2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or +@@ -173,15 +174,18 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd, + { + struct page **pages; + struct hfi1_devdata *dd = fd->uctxt->dd; ++ struct mm_struct *mm; + + if (mapped) { + pci_unmap_single(dd->pcidev, node->dma_addr, + node->npages * PAGE_SIZE, PCI_DMA_FROMDEVICE); + pages = &node->pages[idx]; ++ mm = mm_from_tid_node(node); + } else { + pages = &tidbuf->pages[idx]; ++ mm = current->mm; + } +- hfi1_release_user_pages(fd->mm, pages, npages, mapped); ++ hfi1_release_user_pages(mm, pages, npages, mapped); + fd->tid_n_pinned -= npages; + } + +@@ -216,12 +220,12 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) + * pages, accept the amount pinned so far and program only that. + * User space knows how to deal with partially programmed buffers. + */ +- if (!hfi1_can_pin_pages(dd, fd->mm, fd->tid_n_pinned, npages)) { ++ if (!hfi1_can_pin_pages(dd, current->mm, fd->tid_n_pinned, npages)) { + kfree(pages); + return -ENOMEM; + } + +- pinned = hfi1_acquire_user_pages(fd->mm, vaddr, npages, true, pages); ++ pinned = hfi1_acquire_user_pages(current->mm, vaddr, npages, true, pages); + if (pinned <= 0) { + kfree(pages); + return pinned; +@@ -756,7 +760,7 @@ static int set_rcvarray_entry(struct hfi1_filedata *fd, + + if (fd->use_mn) { + ret = mmu_interval_notifier_insert( +- &node->notifier, fd->mm, ++ &node->notifier, current->mm, + tbuf->vaddr + (pageidx * PAGE_SIZE), npages * PAGE_SIZE, + &tid_mn_ops); + if (ret) +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.h b/drivers/infiniband/hw/hfi1/user_exp_rcv.h +index 332abb446861a..d45c7b6988d4d 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.h ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.h +@@ -1,6 +1,7 @@ + #ifndef _HFI1_USER_EXP_RCV_H + #define _HFI1_USER_EXP_RCV_H + /* ++ * Copyright(c) 2020 - Cornelis Networks, Inc. + * Copyright(c) 2015 - 2017 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or +@@ -95,4 +96,9 @@ int hfi1_user_exp_rcv_clear(struct hfi1_filedata *fd, + int hfi1_user_exp_rcv_invalid(struct hfi1_filedata *fd, + struct hfi1_tid_info *tinfo); + ++static inline struct mm_struct *mm_from_tid_node(struct tid_rb_node *node) ++{ ++ return node->notifier.mm; ++} ++ + #endif /* _HFI1_USER_EXP_RCV_H */ +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index a92346e88628b..4a4956f96a7eb 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -1,4 +1,5 @@ + /* ++ * Copyright(c) 2020 - Cornelis Networks, Inc. + * Copyright(c) 2015 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or +@@ -188,7 +189,6 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt, + atomic_set(&pq->n_reqs, 0); + init_waitqueue_head(&pq->wait); + atomic_set(&pq->n_locked, 0); +- pq->mm = fd->mm; + + iowait_init(&pq->busy, 0, NULL, NULL, defer_packet_queue, + activate_packet_queue, NULL, NULL); +@@ -230,7 +230,7 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt, + + cq->nentries = hfi1_sdma_comp_ring_size; + +- ret = hfi1_mmu_rb_register(pq, pq->mm, &sdma_rb_ops, dd->pport->hfi1_wq, ++ ret = hfi1_mmu_rb_register(pq, &sdma_rb_ops, dd->pport->hfi1_wq, + &pq->handler); + if (ret) { + dd_dev_err(dd, "Failed to register with MMU %d", ret); +@@ -980,13 +980,13 @@ static int pin_sdma_pages(struct user_sdma_request *req, + + npages -= node->npages; + retry: +- if (!hfi1_can_pin_pages(pq->dd, pq->mm, ++ if (!hfi1_can_pin_pages(pq->dd, current->mm, + atomic_read(&pq->n_locked), npages)) { + cleared = sdma_cache_evict(pq, npages); + if (cleared >= npages) + goto retry; + } +- pinned = hfi1_acquire_user_pages(pq->mm, ++ pinned = hfi1_acquire_user_pages(current->mm, + ((unsigned long)iovec->iov.iov_base + + (node->npages * PAGE_SIZE)), npages, 0, + pages + node->npages); +@@ -995,7 +995,7 @@ retry: + return pinned; + } + if (pinned != npages) { +- unpin_vector_pages(pq->mm, pages, node->npages, pinned); ++ unpin_vector_pages(current->mm, pages, node->npages, pinned); + return -EFAULT; + } + kfree(node->pages); +@@ -1008,7 +1008,8 @@ retry: + static void unpin_sdma_pages(struct sdma_mmu_node *node) + { + if (node->npages) { +- unpin_vector_pages(node->pq->mm, node->pages, 0, node->npages); ++ unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0, ++ node->npages); + atomic_sub(node->npages, &node->pq->n_locked); + } + } +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h +index 9972e0e6545e8..1e8c02fe8ad1d 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.h ++++ b/drivers/infiniband/hw/hfi1/user_sdma.h +@@ -1,6 +1,7 @@ + #ifndef _HFI1_USER_SDMA_H + #define _HFI1_USER_SDMA_H + /* ++ * Copyright(c) 2020 - Cornelis Networks, Inc. + * Copyright(c) 2015 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or +@@ -133,7 +134,6 @@ struct hfi1_user_sdma_pkt_q { + unsigned long unpinned; + struct mmu_rb_handler *handler; + atomic_t n_locked; +- struct mm_struct *mm; + }; + + struct hfi1_user_sdma_comp_q { +@@ -250,4 +250,9 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + struct iovec *iovec, unsigned long dim, + unsigned long *count); + ++static inline struct mm_struct *mm_from_sdma_node(struct sdma_mmu_node *node) ++{ ++ return node->rb.handler->mn.mm; ++} ++ + #endif /* _HFI1_USER_SDMA_H */ +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index cee140920c579..4c02839b7b418 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -2738,6 +2738,7 @@ static int hns_roce_v2_mw_write_mtpt(void *mb_buf, struct hns_roce_mw *mw) + + roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_R_INV_EN_S, 1); + roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_L_INV_EN_S, 1); ++ roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S, 1); + + roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_PA_S, 0); + roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_MR_MW_S, 1); +@@ -4771,11 +4772,11 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, + V2_QPC_BYTE_28_AT_M, + V2_QPC_BYTE_28_AT_S); + qp_attr->retry_cnt = roce_get_field(context.byte_212_lsn, +- V2_QPC_BYTE_212_RETRY_CNT_M, +- V2_QPC_BYTE_212_RETRY_CNT_S); ++ V2_QPC_BYTE_212_RETRY_NUM_INIT_M, ++ V2_QPC_BYTE_212_RETRY_NUM_INIT_S); + qp_attr->rnr_retry = roce_get_field(context.byte_244_rnr_rxack, +- V2_QPC_BYTE_244_RNR_CNT_M, +- V2_QPC_BYTE_244_RNR_CNT_S); ++ V2_QPC_BYTE_244_RNR_NUM_INIT_M, ++ V2_QPC_BYTE_244_RNR_NUM_INIT_S); + + done: + qp_attr->cur_qp_state = qp_attr->qp_state; +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +index 17f35f91f4ad2..9d27dfe86821b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +@@ -1639,7 +1639,7 @@ struct hns_roce_query_pf_caps_d { + __le32 rsv_uars_rsv_qps; + }; + #define V2_QUERY_PF_CAPS_D_NUM_SRQS_S 0 +-#define V2_QUERY_PF_CAPS_D_NUM_SRQS_M GENMASK(20, 0) ++#define V2_QUERY_PF_CAPS_D_NUM_SRQS_M GENMASK(19, 0) + + #define V2_QUERY_PF_CAPS_D_RQWQE_HOP_NUM_S 20 + #define V2_QUERY_PF_CAPS_D_RQWQE_HOP_NUM_M GENMASK(21, 20) +diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c +index 58a433135a038..9023ad9c30182 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_main.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_main.c +@@ -54,10 +54,6 @@ + #define DRV_VERSION __stringify(DRV_VERSION_MAJOR) "." \ + __stringify(DRV_VERSION_MINOR) "." __stringify(DRV_VERSION_BUILD) + +-static int push_mode; +-module_param(push_mode, int, 0644); +-MODULE_PARM_DESC(push_mode, "Low latency mode: 0=disabled (default), 1=enabled)"); +- + static int debug; + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "debug flags: 0=disabled (default), 0x7fffffff=all"); +@@ -1580,7 +1576,6 @@ static enum i40iw_status_code i40iw_setup_init_state(struct i40iw_handler *hdl, + if (status) + goto exit; + iwdev->obj_next = iwdev->obj_mem; +- iwdev->push_mode = push_mode; + + init_waitqueue_head(&iwdev->vchnl_waitq); + init_waitqueue_head(&dev->vf_reqs); +diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +index 09caad228aa4f..e40c505196645 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +@@ -167,39 +167,16 @@ static void i40iw_dealloc_ucontext(struct ib_ucontext *context) + */ + static int i40iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma) + { +- struct i40iw_ucontext *ucontext; +- u64 db_addr_offset, push_offset, pfn; +- +- ucontext = to_ucontext(context); +- if (ucontext->iwdev->sc_dev.is_pf) { +- db_addr_offset = I40IW_DB_ADDR_OFFSET; +- push_offset = I40IW_PUSH_OFFSET; +- if (vma->vm_pgoff) +- vma->vm_pgoff += I40IW_PF_FIRST_PUSH_PAGE_INDEX - 1; +- } else { +- db_addr_offset = I40IW_VF_DB_ADDR_OFFSET; +- push_offset = I40IW_VF_PUSH_OFFSET; +- if (vma->vm_pgoff) +- vma->vm_pgoff += I40IW_VF_FIRST_PUSH_PAGE_INDEX - 1; +- } ++ struct i40iw_ucontext *ucontext = to_ucontext(context); ++ u64 dbaddr; + +- vma->vm_pgoff += db_addr_offset >> PAGE_SHIFT; +- +- if (vma->vm_pgoff == (db_addr_offset >> PAGE_SHIFT)) { +- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); +- } else { +- if ((vma->vm_pgoff - (push_offset >> PAGE_SHIFT)) % 2) +- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); +- else +- vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot); +- } ++ if (vma->vm_pgoff || vma->vm_end - vma->vm_start != PAGE_SIZE) ++ return -EINVAL; + +- pfn = vma->vm_pgoff + +- (pci_resource_start(ucontext->iwdev->ldev->pcidev, 0) >> +- PAGE_SHIFT); ++ dbaddr = I40IW_DB_ADDR_OFFSET + pci_resource_start(ucontext->iwdev->ldev->pcidev, 0); + +- return rdma_user_mmap_io(context, vma, pfn, PAGE_SIZE, +- vma->vm_page_prot, NULL); ++ return rdma_user_mmap_io(context, vma, dbaddr >> PAGE_SHIFT, PAGE_SIZE, ++ pgprot_noncached(vma->vm_page_prot), NULL); + } + + /** +diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c +index c3cfea243af8c..119b2573c9a08 100644 +--- a/drivers/infiniband/hw/mthca/mthca_cq.c ++++ b/drivers/infiniband/hw/mthca/mthca_cq.c +@@ -803,8 +803,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL); +- if (IS_ERR(mailbox)) ++ if (IS_ERR(mailbox)) { ++ err = PTR_ERR(mailbox); + goto err_out_arm; ++ } + + cq_context = mailbox->buf; + +@@ -846,9 +848,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + spin_lock_irq(&dev->cq_table.lock); +- if (mthca_array_set(&dev->cq_table.cq, +- cq->cqn & (dev->limits.num_cqs - 1), +- cq)) { ++ err = mthca_array_set(&dev->cq_table.cq, ++ cq->cqn & (dev->limits.num_cqs - 1), cq); ++ if (err) { + spin_unlock_irq(&dev->cq_table.lock); + goto err_out_free_mr; + } +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index d3eda48032e39..944cbb519c6d7 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -122,6 +122,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600); + MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]"); + #endif + ++static bool i8042_present; + static bool i8042_bypass_aux_irq_test; + static char i8042_kbd_firmware_id[128]; + static char i8042_aux_firmware_id[128]; +@@ -343,6 +344,9 @@ int i8042_command(unsigned char *param, int command) + unsigned long flags; + int retval; + ++ if (!i8042_present) ++ return -1; ++ + spin_lock_irqsave(&i8042_lock, flags); + retval = __i8042_command(param, command); + spin_unlock_irqrestore(&i8042_lock, flags); +@@ -1612,12 +1616,15 @@ static int __init i8042_init(void) + + err = i8042_platform_init(); + if (err) +- return err; ++ return (err == -ENODEV) ? 0 : err; + + err = i8042_controller_check(); + if (err) + goto err_platform_exit; + ++ /* Set this before creating the dev to allow i8042_command to work right away */ ++ i8042_present = true; ++ + pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0); + if (IS_ERR(pdev)) { + err = PTR_ERR(pdev); +@@ -1636,6 +1643,9 @@ static int __init i8042_init(void) + + static void __exit i8042_exit(void) + { ++ if (!i8042_present) ++ return; ++ + platform_device_unregister(i8042_platform_device); + platform_driver_unregister(&i8042_driver); + i8042_platform_exit(); +diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c +index 93e6345f3414f..48cda86f43a2c 100644 +--- a/drivers/iommu/intel/dmar.c ++++ b/drivers/iommu/intel/dmar.c +@@ -964,7 +964,8 @@ static int map_iommu(struct intel_iommu *iommu, u64 phys_addr) + warn_invalid_dmar(phys_addr, " returns all ones"); + goto unmap; + } +- iommu->vccap = dmar_readq(iommu->reg + DMAR_VCCAP_REG); ++ if (ecap_vcs(iommu->ecap)) ++ iommu->vccap = dmar_readq(iommu->reg + DMAR_VCCAP_REG); + + /* the registers might be more than one page */ + map_size = max_t(int, ecap_max_iotlb_offset(iommu->ecap), +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index f67b7e6ddf1bc..7e790655c1ab5 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -1798,7 +1798,7 @@ static void free_dmar_iommu(struct intel_iommu *iommu) + if (ecap_prs(iommu->ecap)) + intel_svm_finish_prq(iommu); + } +- if (ecap_vcs(iommu->ecap) && vccap_pasid(iommu->vccap)) ++ if (vccap_pasid(iommu->vccap)) + ioasid_unregister_allocator(&iommu->pasid_allocator); + + #endif +@@ -3177,7 +3177,7 @@ static void register_pasid_allocator(struct intel_iommu *iommu) + * is active. All vIOMMU allocators will eventually be calling the same + * host allocator. + */ +- if (!ecap_vcs(iommu->ecap) || !vccap_pasid(iommu->vccap)) ++ if (!vccap_pasid(iommu->vccap)) + return; + + pr_info("Register custom PASID allocator\n"); +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 609bd25bf154b..6a0a79e3f5641 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -264,16 +264,18 @@ int iommu_probe_device(struct device *dev) + */ + iommu_alloc_default_domain(group, dev); + +- if (group->default_domain) ++ if (group->default_domain) { + ret = __iommu_attach_device(group->default_domain, dev); ++ if (ret) { ++ iommu_group_put(group); ++ goto err_release; ++ } ++ } + + iommu_create_device_direct_mappings(group, dev); + + iommu_group_put(group); + +- if (ret) +- goto err_release; +- + if (ops->probe_finalize) + ops->probe_finalize(dev); + +diff --git a/drivers/irqchip/irq-sni-exiu.c b/drivers/irqchip/irq-sni-exiu.c +index 1d027623c7760..abd011fcecf4a 100644 +--- a/drivers/irqchip/irq-sni-exiu.c ++++ b/drivers/irqchip/irq-sni-exiu.c +@@ -136,7 +136,7 @@ static int exiu_domain_translate(struct irq_domain *domain, + if (fwspec->param_count != 2) + return -EINVAL; + *hwirq = fwspec->param[0]; +- *type = fwspec->param[2] & IRQ_TYPE_SENSE_MASK; ++ *type = fwspec->param[1] & IRQ_TYPE_SENSE_MASK; + } + return 0; + } +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 84ecbc6fa0ff2..47afc5938c26b 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1460,7 +1460,39 @@ static void bond_upper_dev_unlink(struct bonding *bond, struct slave *slave) + slave->dev->flags &= ~IFF_SLAVE; + } + +-static struct slave *bond_alloc_slave(struct bonding *bond) ++static void slave_kobj_release(struct kobject *kobj) ++{ ++ struct slave *slave = to_slave(kobj); ++ struct bonding *bond = bond_get_bond_by_slave(slave); ++ ++ cancel_delayed_work_sync(&slave->notify_work); ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) ++ kfree(SLAVE_AD_INFO(slave)); ++ ++ kfree(slave); ++} ++ ++static struct kobj_type slave_ktype = { ++ .release = slave_kobj_release, ++#ifdef CONFIG_SYSFS ++ .sysfs_ops = &slave_sysfs_ops, ++#endif ++}; ++ ++static int bond_kobj_init(struct slave *slave) ++{ ++ int err; ++ ++ err = kobject_init_and_add(&slave->kobj, &slave_ktype, ++ &(slave->dev->dev.kobj), "bonding_slave"); ++ if (err) ++ kobject_put(&slave->kobj); ++ ++ return err; ++} ++ ++static struct slave *bond_alloc_slave(struct bonding *bond, ++ struct net_device *slave_dev) + { + struct slave *slave = NULL; + +@@ -1468,11 +1500,17 @@ static struct slave *bond_alloc_slave(struct bonding *bond) + if (!slave) + return NULL; + ++ slave->bond = bond; ++ slave->dev = slave_dev; ++ ++ if (bond_kobj_init(slave)) ++ return NULL; ++ + if (BOND_MODE(bond) == BOND_MODE_8023AD) { + SLAVE_AD_INFO(slave) = kzalloc(sizeof(struct ad_slave_info), + GFP_KERNEL); + if (!SLAVE_AD_INFO(slave)) { +- kfree(slave); ++ kobject_put(&slave->kobj); + return NULL; + } + } +@@ -1481,17 +1519,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond) + return slave; + } + +-static void bond_free_slave(struct slave *slave) +-{ +- struct bonding *bond = bond_get_bond_by_slave(slave); +- +- cancel_delayed_work_sync(&slave->notify_work); +- if (BOND_MODE(bond) == BOND_MODE_8023AD) +- kfree(SLAVE_AD_INFO(slave)); +- +- kfree(slave); +-} +- + static void bond_fill_ifbond(struct bonding *bond, struct ifbond *info) + { + info->bond_mode = BOND_MODE(bond); +@@ -1678,14 +1705,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, + goto err_undo_flags; + } + +- new_slave = bond_alloc_slave(bond); ++ new_slave = bond_alloc_slave(bond, slave_dev); + if (!new_slave) { + res = -ENOMEM; + goto err_undo_flags; + } + +- new_slave->bond = bond; +- new_slave->dev = slave_dev; + /* Set the new_slave's queue_id to be zero. Queue ID mapping + * is set via sysfs or module option if desired. + */ +@@ -2007,7 +2032,7 @@ err_restore_mtu: + dev_set_mtu(slave_dev, new_slave->original_mtu); + + err_free: +- bond_free_slave(new_slave); ++ kobject_put(&new_slave->kobj); + + err_undo_flags: + /* Enslave of first slave has failed and we need to fix master's mac */ +@@ -2187,7 +2212,7 @@ static int __bond_release_one(struct net_device *bond_dev, + if (!netif_is_bond_master(slave_dev)) + slave_dev->priv_flags &= ~IFF_BONDING; + +- bond_free_slave(slave); ++ kobject_put(&slave->kobj); + + return 0; + } +diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c +index 9b8346638f697..fd07561da0348 100644 +--- a/drivers/net/bonding/bond_sysfs_slave.c ++++ b/drivers/net/bonding/bond_sysfs_slave.c +@@ -121,7 +121,6 @@ static const struct slave_attribute *slave_attrs[] = { + }; + + #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr) +-#define to_slave(obj) container_of(obj, struct slave, kobj) + + static ssize_t slave_show(struct kobject *kobj, + struct attribute *attr, char *buf) +@@ -132,28 +131,15 @@ static ssize_t slave_show(struct kobject *kobj, + return slave_attr->show(slave, buf); + } + +-static const struct sysfs_ops slave_sysfs_ops = { ++const struct sysfs_ops slave_sysfs_ops = { + .show = slave_show, + }; + +-static struct kobj_type slave_ktype = { +-#ifdef CONFIG_SYSFS +- .sysfs_ops = &slave_sysfs_ops, +-#endif +-}; +- + int bond_sysfs_slave_add(struct slave *slave) + { + const struct slave_attribute **a; + int err; + +- err = kobject_init_and_add(&slave->kobj, &slave_ktype, +- &(slave->dev->dev.kobj), "bonding_slave"); +- if (err) { +- kobject_put(&slave->kobj); +- return err; +- } +- + for (a = slave_attrs; *a; ++a) { + err = sysfs_create_file(&slave->kobj, &((*a)->attr)); + if (err) { +@@ -171,6 +157,4 @@ void bond_sysfs_slave_del(struct slave *slave) + + for (a = slave_attrs; *a; ++a) + sysfs_remove_file(&slave->kobj, &((*a)->attr)); +- +- kobject_put(&slave->kobj); + } +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index f3fc37e96b087..d4030abad935d 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1033,7 +1033,7 @@ static const struct can_bittiming_const m_can_bittiming_const_31X = { + .name = KBUILD_MODNAME, + .tseg1_min = 2, /* Time segment 1 = prop_seg + phase_seg1 */ + .tseg1_max = 256, +- .tseg2_min = 1, /* Time segment 2 = phase_seg2 */ ++ .tseg2_min = 2, /* Time segment 2 = phase_seg2 */ + .tseg2_max = 128, + .sjw_max = 128, + .brp_min = 1, +@@ -1653,7 +1653,7 @@ static int m_can_open(struct net_device *dev) + INIT_WORK(&cdev->tx_work, m_can_tx_work_queue); + + err = request_threaded_irq(dev->irq, NULL, m_can_isr, +- IRQF_ONESHOT | IRQF_TRIGGER_FALLING, ++ IRQF_ONESHOT, + dev->name, dev); + } else { + err = request_irq(dev->irq, m_can_isr, IRQF_SHARED, dev->name, +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index a4b4b742c80c3..0ad13d78815c5 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -63,21 +63,27 @@ enum gs_can_identify_mode { + }; + + /* data types passed between host and device */ ++ ++/* The firmware on the original USB2CAN by Geschwister Schneider ++ * Technologie Entwicklungs- und Vertriebs UG exchanges all data ++ * between the host and the device in host byte order. This is done ++ * with the struct gs_host_config::byte_order member, which is sent ++ * first to indicate the desired byte order. ++ * ++ * The widely used open source firmware candleLight doesn't support ++ * this feature and exchanges the data in little endian byte order. ++ */ + struct gs_host_config { +- u32 byte_order; ++ __le32 byte_order; + } __packed; +-/* All data exchanged between host and device is exchanged in host byte order, +- * thanks to the struct gs_host_config byte_order member, which is sent first +- * to indicate the desired byte order. +- */ + + struct gs_device_config { + u8 reserved1; + u8 reserved2; + u8 reserved3; + u8 icount; +- u32 sw_version; +- u32 hw_version; ++ __le32 sw_version; ++ __le32 hw_version; + } __packed; + + #define GS_CAN_MODE_NORMAL 0 +@@ -87,26 +93,26 @@ struct gs_device_config { + #define GS_CAN_MODE_ONE_SHOT BIT(3) + + struct gs_device_mode { +- u32 mode; +- u32 flags; ++ __le32 mode; ++ __le32 flags; + } __packed; + + struct gs_device_state { +- u32 state; +- u32 rxerr; +- u32 txerr; ++ __le32 state; ++ __le32 rxerr; ++ __le32 txerr; + } __packed; + + struct gs_device_bittiming { +- u32 prop_seg; +- u32 phase_seg1; +- u32 phase_seg2; +- u32 sjw; +- u32 brp; ++ __le32 prop_seg; ++ __le32 phase_seg1; ++ __le32 phase_seg2; ++ __le32 sjw; ++ __le32 brp; + } __packed; + + struct gs_identify_mode { +- u32 mode; ++ __le32 mode; + } __packed; + + #define GS_CAN_FEATURE_LISTEN_ONLY BIT(0) +@@ -117,23 +123,23 @@ struct gs_identify_mode { + #define GS_CAN_FEATURE_IDENTIFY BIT(5) + + struct gs_device_bt_const { +- u32 feature; +- u32 fclk_can; +- u32 tseg1_min; +- u32 tseg1_max; +- u32 tseg2_min; +- u32 tseg2_max; +- u32 sjw_max; +- u32 brp_min; +- u32 brp_max; +- u32 brp_inc; ++ __le32 feature; ++ __le32 fclk_can; ++ __le32 tseg1_min; ++ __le32 tseg1_max; ++ __le32 tseg2_min; ++ __le32 tseg2_max; ++ __le32 sjw_max; ++ __le32 brp_min; ++ __le32 brp_max; ++ __le32 brp_inc; + } __packed; + + #define GS_CAN_FLAG_OVERFLOW 1 + + struct gs_host_frame { + u32 echo_id; +- u32 can_id; ++ __le32 can_id; + + u8 can_dlc; + u8 channel; +@@ -329,13 +335,13 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + if (!skb) + return; + +- cf->can_id = hf->can_id; ++ cf->can_id = le32_to_cpu(hf->can_id); + + cf->can_dlc = get_can_dlc(hf->can_dlc); + memcpy(cf->data, hf->data, 8); + + /* ERROR frames tell us information about the controller */ +- if (hf->can_id & CAN_ERR_FLAG) ++ if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG) + gs_update_state(dev, cf); + + netdev->stats.rx_packets++; +@@ -418,11 +424,11 @@ static int gs_usb_set_bittiming(struct net_device *netdev) + if (!dbt) + return -ENOMEM; + +- dbt->prop_seg = bt->prop_seg; +- dbt->phase_seg1 = bt->phase_seg1; +- dbt->phase_seg2 = bt->phase_seg2; +- dbt->sjw = bt->sjw; +- dbt->brp = bt->brp; ++ dbt->prop_seg = cpu_to_le32(bt->prop_seg); ++ dbt->phase_seg1 = cpu_to_le32(bt->phase_seg1); ++ dbt->phase_seg2 = cpu_to_le32(bt->phase_seg2); ++ dbt->sjw = cpu_to_le32(bt->sjw); ++ dbt->brp = cpu_to_le32(bt->brp); + + /* request bit timings */ + rc = usb_control_msg(interface_to_usbdev(intf), +@@ -503,7 +509,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, + + cf = (struct can_frame *)skb->data; + +- hf->can_id = cf->can_id; ++ hf->can_id = cpu_to_le32(cf->can_id); + hf->can_dlc = cf->can_dlc; + memcpy(hf->data, cf->data, cf->can_dlc); + +@@ -573,6 +579,7 @@ static int gs_can_open(struct net_device *netdev) + int rc, i; + struct gs_device_mode *dm; + u32 ctrlmode; ++ u32 flags = 0; + + rc = open_candev(netdev); + if (rc) +@@ -640,24 +647,24 @@ static int gs_can_open(struct net_device *netdev) + + /* flags */ + ctrlmode = dev->can.ctrlmode; +- dm->flags = 0; + + if (ctrlmode & CAN_CTRLMODE_LOOPBACK) +- dm->flags |= GS_CAN_MODE_LOOP_BACK; ++ flags |= GS_CAN_MODE_LOOP_BACK; + else if (ctrlmode & CAN_CTRLMODE_LISTENONLY) +- dm->flags |= GS_CAN_MODE_LISTEN_ONLY; ++ flags |= GS_CAN_MODE_LISTEN_ONLY; + + /* Controller is not allowed to retry TX + * this mode is unavailable on atmels uc3c hardware + */ + if (ctrlmode & CAN_CTRLMODE_ONE_SHOT) +- dm->flags |= GS_CAN_MODE_ONE_SHOT; ++ flags |= GS_CAN_MODE_ONE_SHOT; + + if (ctrlmode & CAN_CTRLMODE_3_SAMPLES) +- dm->flags |= GS_CAN_MODE_TRIPLE_SAMPLE; ++ flags |= GS_CAN_MODE_TRIPLE_SAMPLE; + + /* finally start device */ +- dm->mode = GS_CAN_MODE_START; ++ dm->mode = cpu_to_le32(GS_CAN_MODE_START); ++ dm->flags = cpu_to_le32(flags); + rc = usb_control_msg(interface_to_usbdev(dev->iface), + usb_sndctrlpipe(interface_to_usbdev(dev->iface), 0), + GS_USB_BREQ_MODE, +@@ -737,9 +744,9 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify) + return -ENOMEM; + + if (do_identify) +- imode->mode = GS_CAN_IDENTIFY_ON; ++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_ON); + else +- imode->mode = GS_CAN_IDENTIFY_OFF; ++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_OFF); + + rc = usb_control_msg(interface_to_usbdev(dev->iface), + usb_sndctrlpipe(interface_to_usbdev(dev->iface), +@@ -790,6 +797,7 @@ static struct gs_can *gs_make_candev(unsigned int channel, + struct net_device *netdev; + int rc; + struct gs_device_bt_const *bt_const; ++ u32 feature; + + bt_const = kmalloc(sizeof(*bt_const), GFP_KERNEL); + if (!bt_const) +@@ -830,14 +838,14 @@ static struct gs_can *gs_make_candev(unsigned int channel, + + /* dev settup */ + strcpy(dev->bt_const.name, "gs_usb"); +- dev->bt_const.tseg1_min = bt_const->tseg1_min; +- dev->bt_const.tseg1_max = bt_const->tseg1_max; +- dev->bt_const.tseg2_min = bt_const->tseg2_min; +- dev->bt_const.tseg2_max = bt_const->tseg2_max; +- dev->bt_const.sjw_max = bt_const->sjw_max; +- dev->bt_const.brp_min = bt_const->brp_min; +- dev->bt_const.brp_max = bt_const->brp_max; +- dev->bt_const.brp_inc = bt_const->brp_inc; ++ dev->bt_const.tseg1_min = le32_to_cpu(bt_const->tseg1_min); ++ dev->bt_const.tseg1_max = le32_to_cpu(bt_const->tseg1_max); ++ dev->bt_const.tseg2_min = le32_to_cpu(bt_const->tseg2_min); ++ dev->bt_const.tseg2_max = le32_to_cpu(bt_const->tseg2_max); ++ dev->bt_const.sjw_max = le32_to_cpu(bt_const->sjw_max); ++ dev->bt_const.brp_min = le32_to_cpu(bt_const->brp_min); ++ dev->bt_const.brp_max = le32_to_cpu(bt_const->brp_max); ++ dev->bt_const.brp_inc = le32_to_cpu(bt_const->brp_inc); + + dev->udev = interface_to_usbdev(intf); + dev->iface = intf; +@@ -854,28 +862,29 @@ static struct gs_can *gs_make_candev(unsigned int channel, + + /* can settup */ + dev->can.state = CAN_STATE_STOPPED; +- dev->can.clock.freq = bt_const->fclk_can; ++ dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can); + dev->can.bittiming_const = &dev->bt_const; + dev->can.do_set_bittiming = gs_usb_set_bittiming; + + dev->can.ctrlmode_supported = 0; + +- if (bt_const->feature & GS_CAN_FEATURE_LISTEN_ONLY) ++ feature = le32_to_cpu(bt_const->feature); ++ if (feature & GS_CAN_FEATURE_LISTEN_ONLY) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY; + +- if (bt_const->feature & GS_CAN_FEATURE_LOOP_BACK) ++ if (feature & GS_CAN_FEATURE_LOOP_BACK) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_LOOPBACK; + +- if (bt_const->feature & GS_CAN_FEATURE_TRIPLE_SAMPLE) ++ if (feature & GS_CAN_FEATURE_TRIPLE_SAMPLE) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES; + +- if (bt_const->feature & GS_CAN_FEATURE_ONE_SHOT) ++ if (feature & GS_CAN_FEATURE_ONE_SHOT) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_ONE_SHOT; + + SET_NETDEV_DEV(netdev, &intf->dev); + +- if (dconf->sw_version > 1) +- if (bt_const->feature & GS_CAN_FEATURE_IDENTIFY) ++ if (le32_to_cpu(dconf->sw_version) > 1) ++ if (feature & GS_CAN_FEATURE_IDENTIFY) + netdev->ethtool_ops = &gs_usb_ethtool_ops; + + kfree(bt_const); +@@ -910,7 +919,7 @@ static int gs_usb_probe(struct usb_interface *intf, + if (!hconf) + return -ENOMEM; + +- hconf->byte_order = 0x0000beef; ++ hconf->byte_order = cpu_to_le32(0x0000beef); + + /* send host config */ + rc = usb_control_msg(interface_to_usbdev(intf), +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index f0dbc05e30a4d..16040b13579ef 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2299,6 +2299,8 @@ static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip) + usleep_range(10000, 20000); + gpiod_set_value_cansleep(gpiod, 0); + usleep_range(10000, 20000); ++ ++ mv88e6xxx_g1_wait_eeprom_done(chip); + } + } + +diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c +index f62aa83ca08d4..33d443a37efc4 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.c ++++ b/drivers/net/dsa/mv88e6xxx/global1.c +@@ -75,6 +75,37 @@ static int mv88e6xxx_g1_wait_init_ready(struct mv88e6xxx_chip *chip) + return mv88e6xxx_g1_wait_bit(chip, MV88E6XXX_G1_STS, bit, 1); + } + ++void mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip) ++{ ++ const unsigned long timeout = jiffies + 1 * HZ; ++ u16 val; ++ int err; ++ ++ /* Wait up to 1 second for the switch to finish reading the ++ * EEPROM. ++ */ ++ while (time_before(jiffies, timeout)) { ++ err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, &val); ++ if (err) { ++ dev_err(chip->dev, "Error reading status"); ++ return; ++ } ++ ++ /* If the switch is still resetting, it may not ++ * respond on the bus, and so MDIO read returns ++ * 0xffff. Differentiate between that, and waiting for ++ * the EEPROM to be done by bit 0 being set. ++ */ ++ if (val != 0xffff && ++ val & BIT(MV88E6XXX_G1_STS_IRQ_EEPROM_DONE)) ++ return; ++ ++ usleep_range(1000, 2000); ++ } ++ ++ dev_err(chip->dev, "Timeout waiting for EEPROM done"); ++} ++ + /* Offset 0x01: Switch MAC Address Register Bytes 0 & 1 + * Offset 0x02: Switch MAC Address Register Bytes 2 & 3 + * Offset 0x03: Switch MAC Address Register Bytes 4 & 5 +diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h +index 1e3546f8b0727..e05abe61fa114 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.h ++++ b/drivers/net/dsa/mv88e6xxx/global1.h +@@ -278,6 +278,7 @@ int mv88e6xxx_g1_set_switch_mac(struct mv88e6xxx_chip *chip, u8 *addr); + int mv88e6185_g1_reset(struct mv88e6xxx_chip *chip); + int mv88e6352_g1_reset(struct mv88e6xxx_chip *chip); + int mv88e6250_g1_reset(struct mv88e6xxx_chip *chip); ++void mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip); + + int mv88e6185_g1_ppu_enable(struct mv88e6xxx_chip *chip); + int mv88e6185_g1_ppu_disable(struct mv88e6xxx_chip *chip); +diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c +index ccd4405895651..336f115e8091f 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c ++++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c +@@ -538,6 +538,7 @@ int ena_com_rx_pkt(struct ena_com_io_cq *io_cq, + { + struct ena_com_rx_buf_info *ena_buf = &ena_rx_ctx->ena_bufs[0]; + struct ena_eth_io_rx_cdesc_base *cdesc = NULL; ++ u16 q_depth = io_cq->q_depth; + u16 cdesc_idx = 0; + u16 nb_hw_desc; + u16 i = 0; +@@ -565,6 +566,8 @@ int ena_com_rx_pkt(struct ena_com_io_cq *io_cq, + do { + ena_buf[i].len = cdesc->length; + ena_buf[i].req_id = cdesc->req_id; ++ if (unlikely(ena_buf[i].req_id >= q_depth)) ++ return -EIO; + + if (++i >= nb_hw_desc) + break; +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index a3a8edf9a734d..36134fc3e9197 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -801,24 +801,6 @@ static void ena_free_all_io_tx_resources(struct ena_adapter *adapter) + adapter->num_io_queues); + } + +-static int validate_rx_req_id(struct ena_ring *rx_ring, u16 req_id) +-{ +- if (likely(req_id < rx_ring->ring_size)) +- return 0; +- +- netif_err(rx_ring->adapter, rx_err, rx_ring->netdev, +- "Invalid rx req_id: %hu\n", req_id); +- +- u64_stats_update_begin(&rx_ring->syncp); +- rx_ring->rx_stats.bad_req_id++; +- u64_stats_update_end(&rx_ring->syncp); +- +- /* Trigger device reset */ +- rx_ring->adapter->reset_reason = ENA_REGS_RESET_INV_RX_REQ_ID; +- set_bit(ENA_FLAG_TRIGGER_RESET, &rx_ring->adapter->flags); +- return -EFAULT; +-} +- + /* ena_setup_rx_resources - allocate I/O Rx resources (Descriptors) + * @adapter: network interface device structure + * @qid: queue index +@@ -938,10 +920,14 @@ static void ena_free_all_io_rx_resources(struct ena_adapter *adapter) + static int ena_alloc_rx_page(struct ena_ring *rx_ring, + struct ena_rx_buffer *rx_info, gfp_t gfp) + { ++ int headroom = rx_ring->rx_headroom; + struct ena_com_buf *ena_buf; + struct page *page; + dma_addr_t dma; + ++ /* restore page offset value in case it has been changed by device */ ++ rx_info->page_offset = headroom; ++ + /* if previous allocated page is not used */ + if (unlikely(rx_info->page)) + return 0; +@@ -971,10 +957,9 @@ static int ena_alloc_rx_page(struct ena_ring *rx_ring, + "alloc page %p, rx_info %p\n", page, rx_info); + + rx_info->page = page; +- rx_info->page_offset = 0; + ena_buf = &rx_info->ena_buf; +- ena_buf->paddr = dma + rx_ring->rx_headroom; +- ena_buf->len = ENA_PAGE_SIZE - rx_ring->rx_headroom; ++ ena_buf->paddr = dma + headroom; ++ ena_buf->len = ENA_PAGE_SIZE - headroom; + + return 0; + } +@@ -1368,15 +1353,10 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring, + struct ena_rx_buffer *rx_info; + u16 len, req_id, buf = 0; + void *va; +- int rc; + + len = ena_bufs[buf].len; + req_id = ena_bufs[buf].req_id; + +- rc = validate_rx_req_id(rx_ring, req_id); +- if (unlikely(rc < 0)) +- return NULL; +- + rx_info = &rx_ring->rx_buffer_info[req_id]; + + if (unlikely(!rx_info->page)) { +@@ -1391,7 +1371,8 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring, + + /* save virt address of first buffer */ + va = page_address(rx_info->page) + rx_info->page_offset; +- prefetch(va + NET_IP_ALIGN); ++ ++ prefetch(va); + + if (len <= rx_ring->rx_copybreak) { + skb = ena_alloc_skb(rx_ring, false); +@@ -1432,8 +1413,6 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring, + + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, rx_info->page, + rx_info->page_offset, len, ENA_PAGE_SIZE); +- /* The offset is non zero only for the first buffer */ +- rx_info->page_offset = 0; + + netif_dbg(rx_ring->adapter, rx_status, rx_ring->netdev, + "rx skb updated. len %d. data_len %d\n", +@@ -1452,10 +1431,6 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring, + len = ena_bufs[buf].len; + req_id = ena_bufs[buf].req_id; + +- rc = validate_rx_req_id(rx_ring, req_id); +- if (unlikely(rc < 0)) +- return NULL; +- + rx_info = &rx_ring->rx_buffer_info[req_id]; + } while (1); + +@@ -1556,8 +1531,7 @@ static int ena_xdp_handle_buff(struct ena_ring *rx_ring, struct xdp_buff *xdp) + int ret; + + rx_info = &rx_ring->rx_buffer_info[rx_ring->ena_bufs[0].req_id]; +- xdp->data = page_address(rx_info->page) + +- rx_info->page_offset + rx_ring->rx_headroom; ++ xdp->data = page_address(rx_info->page) + rx_info->page_offset; + xdp_set_data_meta_invalid(xdp); + xdp->data_hard_start = page_address(rx_info->page); + xdp->data_end = xdp->data + rx_ring->ena_bufs[0].len; +@@ -1624,8 +1598,9 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi, + if (unlikely(ena_rx_ctx.descs == 0)) + break; + ++ /* First descriptor might have an offset set by the device */ + rx_info = &rx_ring->rx_buffer_info[rx_ring->ena_bufs[0].req_id]; +- rx_info->page_offset = ena_rx_ctx.pkt_offset; ++ rx_info->page_offset += ena_rx_ctx.pkt_offset; + + netif_dbg(rx_ring->adapter, rx_status, rx_ring->netdev, + "rx_poll: q %d got packet from ena. descs #: %d l3 proto %d l4 proto %d hash: %x\n", +@@ -1704,12 +1679,18 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi, + error: + adapter = netdev_priv(rx_ring->netdev); + +- u64_stats_update_begin(&rx_ring->syncp); +- rx_ring->rx_stats.bad_desc_num++; +- u64_stats_update_end(&rx_ring->syncp); ++ if (rc == -ENOSPC) { ++ u64_stats_update_begin(&rx_ring->syncp); ++ rx_ring->rx_stats.bad_desc_num++; ++ u64_stats_update_end(&rx_ring->syncp); ++ adapter->reset_reason = ENA_REGS_RESET_TOO_MANY_RX_DESCS; ++ } else { ++ u64_stats_update_begin(&rx_ring->syncp); ++ rx_ring->rx_stats.bad_req_id++; ++ u64_stats_update_end(&rx_ring->syncp); ++ adapter->reset_reason = ENA_REGS_RESET_INV_RX_REQ_ID; ++ } + +- /* Too many desc from the device. Trigger reset */ +- adapter->reset_reason = ENA_REGS_RESET_TOO_MANY_RX_DESCS; + set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags); + + return 0; +@@ -3378,16 +3359,9 @@ static int ena_device_init(struct ena_com_dev *ena_dev, struct pci_dev *pdev, + goto err_mmio_read_less; + } + +- rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_width)); ++ rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(dma_width)); + if (rc) { +- dev_err(dev, "pci_set_dma_mask failed 0x%x\n", rc); +- goto err_mmio_read_less; +- } +- +- rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(dma_width)); +- if (rc) { +- dev_err(dev, "err_pci_set_consistent_dma_mask failed 0x%x\n", +- rc); ++ dev_err(dev, "dma_set_mask_and_coherent failed %d\n", rc); + goto err_mmio_read_less; + } + +@@ -4157,6 +4131,12 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + return rc; + } + ++ rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(ENA_MAX_PHYS_ADDR_SIZE_BITS)); ++ if (rc) { ++ dev_err(&pdev->dev, "dma_set_mask_and_coherent failed %d\n", rc); ++ goto err_disable_device; ++ } ++ + pci_set_master(pdev); + + ena_dev = vzalloc(sizeof(*ena_dev)); +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index 4f913658eea46..24122ccda614c 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -413,85 +413,63 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + buff->rxdata.pg_off, + buff->len, DMA_FROM_DEVICE); + +- /* for single fragment packets use build_skb() */ +- if (buff->is_eop && +- buff->len <= AQ_CFG_RX_FRAME_MAX - AQ_SKB_ALIGN) { +- skb = build_skb(aq_buf_vaddr(&buff->rxdata), ++ skb = napi_alloc_skb(napi, AQ_CFG_RX_HDR_SIZE); ++ if (unlikely(!skb)) { ++ u64_stats_update_begin(&self->stats.rx.syncp); ++ self->stats.rx.skb_alloc_fails++; ++ u64_stats_update_end(&self->stats.rx.syncp); ++ err = -ENOMEM; ++ goto err_exit; ++ } ++ if (is_ptp_ring) ++ buff->len -= ++ aq_ptp_extract_ts(self->aq_nic, skb, ++ aq_buf_vaddr(&buff->rxdata), ++ buff->len); ++ ++ hdr_len = buff->len; ++ if (hdr_len > AQ_CFG_RX_HDR_SIZE) ++ hdr_len = eth_get_headlen(skb->dev, ++ aq_buf_vaddr(&buff->rxdata), ++ AQ_CFG_RX_HDR_SIZE); ++ ++ memcpy(__skb_put(skb, hdr_len), aq_buf_vaddr(&buff->rxdata), ++ ALIGN(hdr_len, sizeof(long))); ++ ++ if (buff->len - hdr_len > 0) { ++ skb_add_rx_frag(skb, 0, buff->rxdata.page, ++ buff->rxdata.pg_off + hdr_len, ++ buff->len - hdr_len, + AQ_CFG_RX_FRAME_MAX); +- if (unlikely(!skb)) { +- u64_stats_update_begin(&self->stats.rx.syncp); +- self->stats.rx.skb_alloc_fails++; +- u64_stats_update_end(&self->stats.rx.syncp); +- err = -ENOMEM; +- goto err_exit; +- } +- if (is_ptp_ring) +- buff->len -= +- aq_ptp_extract_ts(self->aq_nic, skb, +- aq_buf_vaddr(&buff->rxdata), +- buff->len); +- skb_put(skb, buff->len); + page_ref_inc(buff->rxdata.page); +- } else { +- skb = napi_alloc_skb(napi, AQ_CFG_RX_HDR_SIZE); +- if (unlikely(!skb)) { +- u64_stats_update_begin(&self->stats.rx.syncp); +- self->stats.rx.skb_alloc_fails++; +- u64_stats_update_end(&self->stats.rx.syncp); +- err = -ENOMEM; +- goto err_exit; +- } +- if (is_ptp_ring) +- buff->len -= +- aq_ptp_extract_ts(self->aq_nic, skb, +- aq_buf_vaddr(&buff->rxdata), +- buff->len); +- +- hdr_len = buff->len; +- if (hdr_len > AQ_CFG_RX_HDR_SIZE) +- hdr_len = eth_get_headlen(skb->dev, +- aq_buf_vaddr(&buff->rxdata), +- AQ_CFG_RX_HDR_SIZE); +- +- memcpy(__skb_put(skb, hdr_len), aq_buf_vaddr(&buff->rxdata), +- ALIGN(hdr_len, sizeof(long))); +- +- if (buff->len - hdr_len > 0) { +- skb_add_rx_frag(skb, 0, buff->rxdata.page, +- buff->rxdata.pg_off + hdr_len, +- buff->len - hdr_len, +- AQ_CFG_RX_FRAME_MAX); +- page_ref_inc(buff->rxdata.page); +- } ++ } + +- if (!buff->is_eop) { +- buff_ = buff; +- i = 1U; +- do { +- next_ = buff_->next, +- buff_ = &self->buff_ring[next_]; ++ if (!buff->is_eop) { ++ buff_ = buff; ++ i = 1U; ++ do { ++ next_ = buff_->next; ++ buff_ = &self->buff_ring[next_]; + +- dma_sync_single_range_for_cpu( +- aq_nic_get_dev(self->aq_nic), +- buff_->rxdata.daddr, +- buff_->rxdata.pg_off, +- buff_->len, +- DMA_FROM_DEVICE); +- skb_add_rx_frag(skb, i++, +- buff_->rxdata.page, +- buff_->rxdata.pg_off, +- buff_->len, +- AQ_CFG_RX_FRAME_MAX); +- page_ref_inc(buff_->rxdata.page); +- buff_->is_cleaned = 1; +- +- buff->is_ip_cso &= buff_->is_ip_cso; +- buff->is_udp_cso &= buff_->is_udp_cso; +- buff->is_tcp_cso &= buff_->is_tcp_cso; +- buff->is_cso_err |= buff_->is_cso_err; ++ dma_sync_single_range_for_cpu(aq_nic_get_dev(self->aq_nic), ++ buff_->rxdata.daddr, ++ buff_->rxdata.pg_off, ++ buff_->len, ++ DMA_FROM_DEVICE); ++ skb_add_rx_frag(skb, i++, ++ buff_->rxdata.page, ++ buff_->rxdata.pg_off, ++ buff_->len, ++ AQ_CFG_RX_FRAME_MAX); ++ page_ref_inc(buff_->rxdata.page); ++ buff_->is_cleaned = 1; + +- } while (!buff_->is_eop); +- } ++ buff->is_ip_cso &= buff_->is_ip_cso; ++ buff->is_udp_cso &= buff_->is_udp_cso; ++ buff->is_tcp_cso &= buff_->is_tcp_cso; ++ buff->is_cso_err |= buff_->is_cso_err; ++ ++ } while (!buff_->is_eop); + } + + if (buff->is_vlan) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 2326571e8c84a..50efdcf681083 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -11273,7 +11273,8 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev) + if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 && + dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) { + dev_err(&pdev->dev, "System does not support DMA, aborting\n"); +- goto init_err_disable; ++ rc = -EIO; ++ goto init_err_release; + } + + pci_set_master(pdev); +@@ -12353,6 +12354,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + create_singlethread_workqueue("bnxt_pf_wq"); + if (!bnxt_pf_wq) { + dev_err(&pdev->dev, "Unable to create workqueue.\n"); ++ rc = -ENOMEM; + goto init_err_pci_clean; + } + } +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +index 8eb976106d0c8..7e7537eabf000 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -883,7 +883,8 @@ int set_filter_wr(struct adapter *adapter, int fidx) + FW_FILTER_WR_OVLAN_VLD_V(f->fs.val.ovlan_vld) | + FW_FILTER_WR_IVLAN_VLDM_V(f->fs.mask.ivlan_vld) | + FW_FILTER_WR_OVLAN_VLDM_V(f->fs.mask.ovlan_vld)); +- fwr->smac_sel = f->smt->idx; ++ if (f->fs.newsmac) ++ fwr->smac_sel = f->smt->idx; + fwr->rx_chan_rx_rpl_iq = + htons(FW_FILTER_WR_RX_CHAN_V(0) | + FW_FILTER_WR_RX_RPL_IQ_V(adapter->sge.fw_evtq.abs_id)); +diff --git a/drivers/net/ethernet/freescale/dpaa2/Kconfig b/drivers/net/ethernet/freescale/dpaa2/Kconfig +index feea797cde022..70aabd2343371 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/Kconfig ++++ b/drivers/net/ethernet/freescale/dpaa2/Kconfig +@@ -3,6 +3,7 @@ config FSL_DPAA2_ETH + tristate "Freescale DPAA2 Ethernet" + depends on FSL_MC_BUS && FSL_MC_DPIO + select PHYLINK ++ select FSL_XGMAC_MDIO + help + This is the DPAA2 Ethernet driver supporting Freescale SoCs + with DPAA2 (DataPath Acceleration Architecture v2). +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c +index 1c4a535890dac..9a91e3568adbf 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c +@@ -95,18 +95,8 @@ static int enetc_setup_taprio(struct net_device *ndev, + gcl_config->atc = 0xff; + gcl_config->acl_len = cpu_to_le16(gcl_len); + +- if (!admin_conf->base_time) { +- gcl_data->btl = +- cpu_to_le32(enetc_rd(&priv->si->hw, ENETC_SICTR0)); +- gcl_data->bth = +- cpu_to_le32(enetc_rd(&priv->si->hw, ENETC_SICTR1)); +- } else { +- gcl_data->btl = +- cpu_to_le32(lower_32_bits(admin_conf->base_time)); +- gcl_data->bth = +- cpu_to_le32(upper_32_bits(admin_conf->base_time)); +- } +- ++ gcl_data->btl = cpu_to_le32(lower_32_bits(admin_conf->base_time)); ++ gcl_data->bth = cpu_to_le32(upper_32_bits(admin_conf->base_time)); + gcl_data->ct = cpu_to_le32(admin_conf->cycle_time); + gcl_data->cte = cpu_to_le32(admin_conf->cycle_time_extension); + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index c6ee42278fdcf..81ec233926acb 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2087,8 +2087,11 @@ static int do_reset(struct ibmvnic_adapter *adapter, + for (i = 0; i < adapter->req_rx_queues; i++) + napi_schedule(&adapter->napi[i]); + +- if (adapter->reset_reason != VNIC_RESET_FAILOVER) ++ if (adapter->reset_reason == VNIC_RESET_FAILOVER || ++ adapter->reset_reason == VNIC_RESET_MOBILITY) { + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); ++ call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev); ++ } + + rc = 0; + +@@ -2158,6 +2161,9 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter, + if (rc) + return IBMVNIC_OPEN_FAILED; + ++ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); ++ call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev); ++ + return 0; + } + +@@ -2222,7 +2228,6 @@ static void __ibmvnic_reset(struct work_struct *work) + + if (!saved_state) { + reset_state = adapter->state; +- adapter->state = VNIC_RESETTING; + saved_state = true; + } + spin_unlock_irqrestore(&adapter->state_lock, flags); +@@ -2881,6 +2886,9 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter) + { + int i, rc; + ++ if (!adapter->tx_scrq || !adapter->rx_scrq) ++ return -EINVAL; ++ + for (i = 0; i < adapter->req_tx_queues; i++) { + netdev_dbg(adapter->netdev, "Re-setting tx_scrq[%d]\n", i); + rc = reset_one_sub_crq_queue(adapter, adapter->tx_scrq[i]); +@@ -4910,6 +4918,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter) + } while (rc == H_BUSY || H_IS_LONG_BUSY(rc)); + + /* Clean out the queue */ ++ if (!crq->msgs) ++ return -EINVAL; ++ + memset(crq->msgs, 0, PAGE_SIZE); + crq->cur = 0; + crq->active = false; +@@ -5249,7 +5260,7 @@ static int ibmvnic_remove(struct vio_dev *dev) + unsigned long flags; + + spin_lock_irqsave(&adapter->state_lock, flags); +- if (adapter->state == VNIC_RESETTING) { ++ if (test_bit(0, &adapter->resetting)) { + spin_unlock_irqrestore(&adapter->state_lock, flags); + return -EBUSY; + } +diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h +index 43feb96b0a68a..31d604fc7bde7 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.h ++++ b/drivers/net/ethernet/ibm/ibmvnic.h +@@ -941,8 +941,7 @@ enum vnic_state {VNIC_PROBING = 1, + VNIC_CLOSING, + VNIC_CLOSED, + VNIC_REMOVING, +- VNIC_REMOVED, +- VNIC_RESETTING}; ++ VNIC_REMOVED}; + + enum ibmvnic_reset_reason {VNIC_RESET_FAILOVER = 1, + VNIC_RESET_MOBILITY, +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index a7e212d1caa22..6c1290137cbba 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -140,6 +140,7 @@ enum i40e_state_t { + __I40E_CLIENT_RESET, + __I40E_VIRTCHNL_OP_PENDING, + __I40E_RECOVERY_MODE, ++ __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */ + /* This must be last as it determines the size of the BITMAP */ + __I40E_STATE_SIZE__, + }; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 2e433fdbf2c36..da80dccad1dd3 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -4006,8 +4006,16 @@ static irqreturn_t i40e_intr(int irq, void *data) + } + + if (icr0 & I40E_PFINT_ICR0_VFLR_MASK) { +- ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK; +- set_bit(__I40E_VFLR_EVENT_PENDING, pf->state); ++ /* disable any further VFLR event notifications */ ++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) { ++ u32 reg = rd32(hw, I40E_PFINT_ICR0_ENA); ++ ++ reg &= ~I40E_PFINT_ICR0_VFLR_MASK; ++ wr32(hw, I40E_PFINT_ICR0_ENA, reg); ++ } else { ++ ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK; ++ set_bit(__I40E_VFLR_EVENT_PENDING, pf->state); ++ } + } + + if (icr0 & I40E_PFINT_ICR0_GRST_MASK) { +@@ -15466,6 +15474,11 @@ static void i40e_remove(struct pci_dev *pdev) + while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) + usleep_range(1000, 2000); + ++ if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { ++ set_bit(__I40E_VF_RESETS_DISABLED, pf->state); ++ i40e_free_vfs(pf); ++ pf->flags &= ~I40E_FLAG_SRIOV_ENABLED; ++ } + /* no more scheduling of any task */ + set_bit(__I40E_SUSPENDED, pf->state); + set_bit(__I40E_DOWN, pf->state); +@@ -15492,11 +15505,6 @@ static void i40e_remove(struct pci_dev *pdev) + */ + i40e_notify_client_of_netdev_close(pf->vsi[pf->lan_vsi], false); + +- if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { +- i40e_free_vfs(pf); +- pf->flags &= ~I40E_FLAG_SRIOV_ENABLED; +- } +- + i40e_fdir_teardown(pf); + + /* If there is a switch structure or any orphans, remove them. +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 343177d71f70a..0d76b8c79f4da 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1403,7 +1403,8 @@ static void i40e_cleanup_reset_vf(struct i40e_vf *vf) + * @vf: pointer to the VF structure + * @flr: VFLR was issued or not + * +- * Returns true if the VF is reset, false otherwise. ++ * Returns true if the VF is in reset, resets successfully, or resets ++ * are disabled and false otherwise. + **/ + bool i40e_reset_vf(struct i40e_vf *vf, bool flr) + { +@@ -1413,11 +1414,14 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr) + u32 reg; + int i; + ++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) ++ return true; ++ + /* If the VFs have been disabled, this means something else is + * resetting the VF, so we shouldn't continue. + */ + if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) +- return false; ++ return true; + + i40e_trigger_vf_reset(vf, flr); + +@@ -1581,6 +1585,15 @@ void i40e_free_vfs(struct i40e_pf *pf) + + i40e_notify_client_of_vf_enable(pf, 0); + ++ /* Disable IOV before freeing resources. This lets any VF drivers ++ * running in the host get themselves cleaned up before we yank ++ * the carpet out from underneath their feet. ++ */ ++ if (!pci_vfs_assigned(pf->pdev)) ++ pci_disable_sriov(pf->pdev); ++ else ++ dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n"); ++ + /* Amortize wait time by stopping all VFs at the same time */ + for (i = 0; i < pf->num_alloc_vfs; i++) { + if (test_bit(I40E_VF_STATE_INIT, &pf->vf[i].vf_states)) +@@ -1596,15 +1609,6 @@ void i40e_free_vfs(struct i40e_pf *pf) + i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[i].lan_vsi_idx]); + } + +- /* Disable IOV before freeing resources. This lets any VF drivers +- * running in the host get themselves cleaned up before we yank +- * the carpet out from underneath their feet. +- */ +- if (!pci_vfs_assigned(pf->pdev)) +- pci_disable_sriov(pf->pdev); +- else +- dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n"); +- + /* free up VF resources */ + tmp = pf->num_alloc_vfs; + pf->num_alloc_vfs = 0; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index ecd834e0e1216..72a5408a44d61 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -1160,7 +1160,6 @@ const struct stmmac_ops dwmac4_ops = { + .pcs_get_adv_lp = dwmac4_get_adv_lp, + .debug = dwmac4_debug, + .set_filter = dwmac4_set_filter, +- .flex_pps_config = dwmac5_flex_pps_config, + .set_mac_loopback = dwmac4_set_mac_loopback, + .update_vlan_hash = dwmac4_update_vlan_hash, + .sarc_configure = dwmac4_sarc_configure, +@@ -1202,6 +1201,7 @@ const struct stmmac_ops dwmac410_ops = { + .pcs_get_adv_lp = dwmac4_get_adv_lp, + .debug = dwmac4_debug, + .set_filter = dwmac4_set_filter, ++ .flex_pps_config = dwmac5_flex_pps_config, + .set_mac_loopback = dwmac4_set_mac_loopback, + .update_vlan_hash = dwmac4_update_vlan_hash, + .sarc_configure = dwmac4_sarc_configure, +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c +index cb87d31a99dfb..57a53a600aa55 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c +@@ -23,7 +23,7 @@ int dwmac_dma_reset(void __iomem *ioaddr) + + return readl_poll_timeout(ioaddr + DMA_BUS_MODE, value, + !(value & DMA_BUS_MODE_SFT_RESET), +- 10000, 100000); ++ 10000, 200000); + } + + /* CSR1 enables the transmit DMA to check for new descriptor */ +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h +index a731f28e101a6..53b438d709dbe 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h +@@ -8,7 +8,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH +- * Copyright(c) 2018 - 2019 Intel Corporation ++ * Copyright(c) 2018 - 2020 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -31,7 +31,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH +- * Copyright(c) 2018 - 2019 Intel Corporation ++ * Copyright(c) 2018 - 2020 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -421,12 +421,14 @@ struct iwl_hs20_roc_res { + * able to run the GO Negotiation. Will not be fragmented and not + * repetitive. Valid only on the P2P Device MAC. Only the duration will + * be taken into account. ++ * @SESSION_PROTECT_CONF_MAX_ID: not used + */ + enum iwl_mvm_session_prot_conf_id { + SESSION_PROTECT_CONF_ASSOC, + SESSION_PROTECT_CONF_GO_CLIENT_ASSOC, + SESSION_PROTECT_CONF_P2P_DEVICE_DISCOV, + SESSION_PROTECT_CONF_P2P_GO_NEGOTIATION, ++ SESSION_PROTECT_CONF_MAX_ID, + }; /* SESSION_PROTECTION_CONF_ID_E_VER_1 */ + + /** +@@ -459,7 +461,7 @@ struct iwl_mvm_session_prot_cmd { + * @mac_id: the mac id for which the session protection started / ended + * @status: 1 means success, 0 means failure + * @start: 1 means the session protection started, 0 means it ended +- * @conf_id: the configuration id of the session that started / eneded ++ * @conf_id: see &enum iwl_mvm_session_prot_conf_id + * + * Note that any session protection will always get two notifications: start + * and end even the firmware could not schedule it. +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index c918c0887ed01..34362dc0d4612 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -3104,6 +3104,9 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw, + goto out_unlock; + } + ++ if (vif->type == NL80211_IFTYPE_STATION) ++ vif->bss_conf.he_support = sta->he_cap.has_he; ++ + if (sta->tdls && + (vif->p2p || + iwl_mvm_tdls_sta_count(mvm, NULL) == +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +index 1babc4bb5194b..6ca45e89a820c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +@@ -638,11 +638,32 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm, + } + } + ++static void iwl_mvm_cancel_session_protection(struct iwl_mvm *mvm, ++ struct iwl_mvm_vif *mvmvif) ++{ ++ struct iwl_mvm_session_prot_cmd cmd = { ++ .id_and_color = ++ cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, ++ mvmvif->color)), ++ .action = cpu_to_le32(FW_CTXT_ACTION_REMOVE), ++ .conf_id = cpu_to_le32(mvmvif->time_event_data.id), ++ }; ++ int ret; ++ ++ ret = iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(SESSION_PROTECTION_CMD, ++ MAC_CONF_GROUP, 0), ++ 0, sizeof(cmd), &cmd); ++ if (ret) ++ IWL_ERR(mvm, ++ "Couldn't send the SESSION_PROTECTION_CMD: %d\n", ret); ++} ++ + static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm, + struct iwl_mvm_time_event_data *te_data, + u32 *uid) + { + u32 id; ++ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif); + + /* + * It is possible that by the time we got to this point the time +@@ -660,14 +681,29 @@ static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm, + iwl_mvm_te_clear_data(mvm, te_data); + spin_unlock_bh(&mvm->time_event_lock); + +- /* +- * It is possible that by the time we try to remove it, the time event +- * has already ended and removed. In such a case there is no need to +- * send a removal command. ++ /* When session protection is supported, the te_data->id field ++ * is reused to save session protection's configuration. + */ +- if (id == TE_MAX) { +- IWL_DEBUG_TE(mvm, "TE 0x%x has already ended\n", *uid); ++ if (fw_has_capa(&mvm->fw->ucode_capa, ++ IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) { ++ if (mvmvif && id < SESSION_PROTECT_CONF_MAX_ID) { ++ /* Session protection is still ongoing. Cancel it */ ++ iwl_mvm_cancel_session_protection(mvm, mvmvif); ++ if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) { ++ set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status); ++ iwl_mvm_roc_finished(mvm); ++ } ++ } + return false; ++ } else { ++ /* It is possible that by the time we try to remove it, the ++ * time event has already ended and removed. In such a case ++ * there is no need to send a removal command. ++ */ ++ if (id == TE_MAX) { ++ IWL_DEBUG_TE(mvm, "TE 0x%x has already ended\n", *uid); ++ return false; ++ } + } + + return true; +@@ -768,6 +804,7 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm, + struct iwl_rx_packet *pkt = rxb_addr(rxb); + struct iwl_mvm_session_prot_notif *notif = (void *)pkt->data; + struct ieee80211_vif *vif; ++ struct iwl_mvm_vif *mvmvif; + + rcu_read_lock(); + vif = iwl_mvm_rcu_dereference_vif_id(mvm, le32_to_cpu(notif->mac_id), +@@ -776,9 +813,10 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm, + if (!vif) + goto out_unlock; + ++ mvmvif = iwl_mvm_vif_from_mac80211(vif); ++ + /* The vif is not a P2P_DEVICE, maintain its time_event_data */ + if (vif->type != NL80211_IFTYPE_P2P_DEVICE) { +- struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); + struct iwl_mvm_time_event_data *te_data = + &mvmvif->time_event_data; + +@@ -813,10 +851,14 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm, + + if (!le32_to_cpu(notif->status) || !le32_to_cpu(notif->start)) { + /* End TE, notify mac80211 */ ++ mvmvif->time_event_data.id = SESSION_PROTECT_CONF_MAX_ID; + ieee80211_remain_on_channel_expired(mvm->hw); + set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status); + iwl_mvm_roc_finished(mvm); + } else if (le32_to_cpu(notif->start)) { ++ if (WARN_ON(mvmvif->time_event_data.id != ++ le32_to_cpu(notif->conf_id))) ++ goto out_unlock; + set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status); + ieee80211_ready_on_channel(mvm->hw); /* Start TE */ + } +@@ -842,20 +884,24 @@ iwl_mvm_start_p2p_roc_session_protection(struct iwl_mvm *mvm, + + lockdep_assert_held(&mvm->mutex); + ++ /* The time_event_data.id field is reused to save session ++ * protection's configuration. ++ */ + switch (type) { + case IEEE80211_ROC_TYPE_NORMAL: +- cmd.conf_id = +- cpu_to_le32(SESSION_PROTECT_CONF_P2P_DEVICE_DISCOV); ++ mvmvif->time_event_data.id = ++ SESSION_PROTECT_CONF_P2P_DEVICE_DISCOV; + break; + case IEEE80211_ROC_TYPE_MGMT_TX: +- cmd.conf_id = +- cpu_to_le32(SESSION_PROTECT_CONF_P2P_GO_NEGOTIATION); ++ mvmvif->time_event_data.id = ++ SESSION_PROTECT_CONF_P2P_GO_NEGOTIATION; + break; + default: + WARN_ONCE(1, "Got an invalid ROC type\n"); + return -EINVAL; + } + ++ cmd.conf_id = cpu_to_le32(mvmvif->time_event_data.id); + return iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(SESSION_PROTECTION_CMD, + MAC_CONF_GROUP, 0), + 0, sizeof(cmd), &cmd); +@@ -957,25 +1003,6 @@ void iwl_mvm_cleanup_roc_te(struct iwl_mvm *mvm) + __iwl_mvm_remove_time_event(mvm, te_data, &uid); + } + +-static void iwl_mvm_cancel_session_protection(struct iwl_mvm *mvm, +- struct iwl_mvm_vif *mvmvif) +-{ +- struct iwl_mvm_session_prot_cmd cmd = { +- .id_and_color = +- cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, +- mvmvif->color)), +- .action = cpu_to_le32(FW_CTXT_ACTION_REMOVE), +- }; +- int ret; +- +- ret = iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(SESSION_PROTECTION_CMD, +- MAC_CONF_GROUP, 0), +- 0, sizeof(cmd), &cmd); +- if (ret) +- IWL_ERR(mvm, +- "Couldn't send the SESSION_PROTECTION_CMD: %d\n", ret); +-} +- + void iwl_mvm_stop_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif) + { + struct iwl_mvm_vif *mvmvif; +@@ -985,10 +1012,13 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif) + IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) { + mvmvif = iwl_mvm_vif_from_mac80211(vif); + +- iwl_mvm_cancel_session_protection(mvm, mvmvif); +- +- if (vif->type == NL80211_IFTYPE_P2P_DEVICE) ++ if (vif->type == NL80211_IFTYPE_P2P_DEVICE) { ++ iwl_mvm_cancel_session_protection(mvm, mvmvif); + set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status); ++ } else { ++ iwl_mvm_remove_aux_roc_te(mvm, mvmvif, ++ &mvmvif->time_event_data); ++ } + + iwl_mvm_roc_finished(mvm); + +@@ -1101,10 +1131,15 @@ void iwl_mvm_schedule_session_protection(struct iwl_mvm *mvm, + cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, + mvmvif->color)), + .action = cpu_to_le32(FW_CTXT_ACTION_ADD), +- .conf_id = cpu_to_le32(SESSION_PROTECT_CONF_ASSOC), + .duration_tu = cpu_to_le32(MSEC_TO_TU(duration)), + }; + ++ /* The time_event_data.id field is reused to save session ++ * protection's configuration. ++ */ ++ mvmvif->time_event_data.id = SESSION_PROTECT_CONF_ASSOC; ++ cmd.conf_id = cpu_to_le32(mvmvif->time_event_data.id); ++ + lockdep_assert_held(&mvm->mutex); + + spin_lock_bh(&mvm->time_event_lock); +diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c +index b4eb926d220ac..d7ecff0b1c662 100644 +--- a/drivers/nfc/s3fwrn5/i2c.c ++++ b/drivers/nfc/s3fwrn5/i2c.c +@@ -26,8 +26,8 @@ struct s3fwrn5_i2c_phy { + struct i2c_client *i2c_dev; + struct nci_dev *ndev; + +- unsigned int gpio_en; +- unsigned int gpio_fw_wake; ++ int gpio_en; ++ int gpio_fw_wake; + + struct mutex mutex; + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index a6af96aaa0eb7..3448f7ac209a0 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -292,9 +292,21 @@ static void nvme_dbbuf_init(struct nvme_dev *dev, + nvmeq->dbbuf_cq_ei = &dev->dbbuf_eis[cq_idx(qid, dev->db_stride)]; + } + ++static void nvme_dbbuf_free(struct nvme_queue *nvmeq) ++{ ++ if (!nvmeq->qid) ++ return; ++ ++ nvmeq->dbbuf_sq_db = NULL; ++ nvmeq->dbbuf_cq_db = NULL; ++ nvmeq->dbbuf_sq_ei = NULL; ++ nvmeq->dbbuf_cq_ei = NULL; ++} ++ + static void nvme_dbbuf_set(struct nvme_dev *dev) + { + struct nvme_command c; ++ unsigned int i; + + if (!dev->dbbuf_dbs) + return; +@@ -308,6 +320,9 @@ static void nvme_dbbuf_set(struct nvme_dev *dev) + dev_warn(dev->ctrl.device, "unable to set dbbuf\n"); + /* Free memory and continue on */ + nvme_dbbuf_dma_free(dev); ++ ++ for (i = 1; i <= dev->online_queues; i++) ++ nvme_dbbuf_free(&dev->queues[i]); + } + } + +diff --git a/drivers/phy/qualcomm/Kconfig b/drivers/phy/qualcomm/Kconfig +index 928db510b86c6..7f6fcb8ec5bab 100644 +--- a/drivers/phy/qualcomm/Kconfig ++++ b/drivers/phy/qualcomm/Kconfig +@@ -87,7 +87,7 @@ config PHY_QCOM_USB_HSIC + + config PHY_QCOM_USB_HS_28NM + tristate "Qualcomm 28nm High-Speed PHY" +- depends on ARCH_QCOM || COMPILE_TEST ++ depends on OF && (ARCH_QCOM || COMPILE_TEST) + depends on EXTCON || !EXTCON # if EXTCON=m, this cannot be built-in + select GENERIC_PHY + help +@@ -98,7 +98,7 @@ config PHY_QCOM_USB_HS_28NM + + config PHY_QCOM_USB_SS + tristate "Qualcomm USB Super-Speed PHY driver" +- depends on ARCH_QCOM || COMPILE_TEST ++ depends on OF && (ARCH_QCOM || COMPILE_TEST) + depends on EXTCON || !EXTCON # if EXTCON=m, this cannot be built-in + select GENERIC_PHY + help +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index de4a46fe17630..ad88d74c18842 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -1242,6 +1242,7 @@ power_down: + reset: + reset_control_assert(padctl->rst); + remove: ++ platform_set_drvdata(pdev, NULL); + soc->ops->remove(padctl); + return err; + } +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index eae3579f106f3..017f090a90f68 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -4220,6 +4220,7 @@ static void hotkey_resume(void) + pr_err("error while attempting to reset the event firmware interface\n"); + + tpacpi_send_radiosw_update(); ++ tpacpi_input_send_tabletsw(); + hotkey_tablet_mode_notify_change(); + hotkey_wakeup_reason_notify_change(); + hotkey_wakeup_hotunplug_complete_notify_change(); +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index e557d757c6470..fa7232ad8c395 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -1478,7 +1478,7 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf, + struct toshiba_acpi_dev *dev = PDE_DATA(file_inode(file)); + char *buffer; + char *cmd; +- int lcd_out, crt_out, tv_out; ++ int lcd_out = -1, crt_out = -1, tv_out = -1; + int remain = count; + int value; + int ret; +@@ -1510,7 +1510,6 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf, + + kfree(cmd); + +- lcd_out = crt_out = tv_out = -1; + ret = get_video_status(dev, &video_out); + if (!ret) { + unsigned int new_video_out = video_out; +diff --git a/drivers/ptp/ptp_clockmatrix.c b/drivers/ptp/ptp_clockmatrix.c +index e020faff7da53..663255774c0b0 100644 +--- a/drivers/ptp/ptp_clockmatrix.c ++++ b/drivers/ptp/ptp_clockmatrix.c +@@ -103,43 +103,26 @@ static int timespec_to_char_array(struct timespec64 const *ts, + return 0; + } + +-static int idtcm_strverscmp(const char *ver1, const char *ver2) ++static int idtcm_strverscmp(const char *version1, const char *version2) + { +- u8 num1; +- u8 num2; +- int result = 0; +- +- /* loop through each level of the version string */ +- while (result == 0) { +- /* extract leading version numbers */ +- if (kstrtou8(ver1, 10, &num1) < 0) +- return -1; ++ u8 ver1[3], ver2[3]; ++ int i; + +- if (kstrtou8(ver2, 10, &num2) < 0) +- return -1; ++ if (sscanf(version1, "%hhu.%hhu.%hhu", ++ &ver1[0], &ver1[1], &ver1[2]) != 3) ++ return -1; ++ if (sscanf(version2, "%hhu.%hhu.%hhu", ++ &ver2[0], &ver2[1], &ver2[2]) != 3) ++ return -1; + +- /* if numbers differ, then set the result */ +- if (num1 < num2) +- result = -1; +- else if (num1 > num2) +- result = 1; +- else { +- /* if numbers are the same, go to next level */ +- ver1 = strchr(ver1, '.'); +- ver2 = strchr(ver2, '.'); +- if (!ver1 && !ver2) +- break; +- else if (!ver1) +- result = -1; +- else if (!ver2) +- result = 1; +- else { +- ver1++; +- ver2++; +- } +- } ++ for (i = 0; i < 3; i++) { ++ if (ver1[i] > ver2[i]) ++ return 1; ++ if (ver1[i] < ver2[i]) ++ return -1; + } +- return result; ++ ++ return 0; + } + + static int idtcm_xfer_read(struct idtcm *idtcm, +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index ed6316992cbb8..07a5630ec841f 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -559,7 +559,7 @@ static int pcf2127_probe(struct device *dev, struct regmap *regmap, + pcf2127->rtc->set_start_time = true; /* Sets actual start to 1970 */ + pcf2127->rtc->uie_unsupported = 1; + +- if (alarm_irq >= 0) { ++ if (alarm_irq > 0) { + ret = devm_request_threaded_irq(dev, alarm_irq, NULL, + pcf2127_rtc_irq, + IRQF_TRIGGER_LOW | IRQF_ONESHOT, +@@ -570,7 +570,7 @@ static int pcf2127_probe(struct device *dev, struct regmap *regmap, + } + } + +- if (alarm_irq >= 0 || device_property_read_bool(dev, "wakeup-source")) { ++ if (alarm_irq > 0 || device_property_read_bool(dev, "wakeup-source")) { + device_init_wakeup(dev, true); + pcf2127->rtc->ops = &pcf2127_rtc_alrm_ops; + } +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 6b5cf9ba03e5b..757d6ba817ee1 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -397,10 +397,13 @@ enum qeth_qdio_out_buffer_state { + QETH_QDIO_BUF_EMPTY, + /* Filled by driver; owned by hardware in order to be sent. */ + QETH_QDIO_BUF_PRIMED, +- /* Identified to be pending in TPQ. */ ++ /* Discovered by the TX completion code: */ + QETH_QDIO_BUF_PENDING, +- /* Found in completion queue. */ +- QETH_QDIO_BUF_IN_CQ, ++ /* Finished by the TX completion code: */ ++ QETH_QDIO_BUF_NEED_QAOB, ++ /* Received QAOB notification on CQ: */ ++ QETH_QDIO_BUF_QAOB_OK, ++ QETH_QDIO_BUF_QAOB_ERROR, + /* Handled via transfer pending / completion queue. */ + QETH_QDIO_BUF_HANDLED_DELAYED, + }; +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 6a73982514237..e3666232a19a8 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -32,6 +32,7 @@ + + #include <net/iucv/af_iucv.h> + #include <net/dsfield.h> ++#include <net/sock.h> + + #include <asm/ebcdic.h> + #include <asm/chpid.h> +@@ -500,18 +501,13 @@ static void qeth_cleanup_handled_pending(struct qeth_qdio_out_q *q, int bidx, + + } + } +- if (forced_cleanup && (atomic_read(&(q->bufs[bidx]->state)) == +- QETH_QDIO_BUF_HANDLED_DELAYED)) { +- /* for recovery situations */ +- qeth_init_qdio_out_buf(q, bidx); +- QETH_CARD_TEXT(q->card, 2, "clprecov"); +- } + } + + + static void qeth_qdio_handle_aob(struct qeth_card *card, + unsigned long phys_aob_addr) + { ++ enum qeth_qdio_out_buffer_state new_state = QETH_QDIO_BUF_QAOB_OK; + struct qaob *aob; + struct qeth_qdio_out_buffer *buffer; + enum iucv_tx_notify notification; +@@ -523,22 +519,6 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, + buffer = (struct qeth_qdio_out_buffer *) aob->user1; + QETH_CARD_TEXT_(card, 5, "%lx", aob->user1); + +- if (atomic_cmpxchg(&buffer->state, QETH_QDIO_BUF_PRIMED, +- QETH_QDIO_BUF_IN_CQ) == QETH_QDIO_BUF_PRIMED) { +- notification = TX_NOTIFY_OK; +- } else { +- WARN_ON_ONCE(atomic_read(&buffer->state) != +- QETH_QDIO_BUF_PENDING); +- atomic_set(&buffer->state, QETH_QDIO_BUF_IN_CQ); +- notification = TX_NOTIFY_DELAYED_OK; +- } +- +- if (aob->aorc != 0) { +- QETH_CARD_TEXT_(card, 2, "aorc%02X", aob->aorc); +- notification = qeth_compute_cq_notification(aob->aorc, 1); +- } +- qeth_notify_skbs(buffer->q, buffer, notification); +- + /* Free dangling allocations. The attached skbs are handled by + * qeth_cleanup_handled_pending(). + */ +@@ -550,7 +530,33 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, + if (data && buffer->is_header[i]) + kmem_cache_free(qeth_core_header_cache, data); + } +- atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED); ++ ++ if (aob->aorc) { ++ QETH_CARD_TEXT_(card, 2, "aorc%02X", aob->aorc); ++ new_state = QETH_QDIO_BUF_QAOB_ERROR; ++ } ++ ++ switch (atomic_xchg(&buffer->state, new_state)) { ++ case QETH_QDIO_BUF_PRIMED: ++ /* Faster than TX completion code. */ ++ notification = qeth_compute_cq_notification(aob->aorc, 0); ++ qeth_notify_skbs(buffer->q, buffer, notification); ++ atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED); ++ break; ++ case QETH_QDIO_BUF_PENDING: ++ /* TX completion code is active and will handle the async ++ * completion for us. ++ */ ++ break; ++ case QETH_QDIO_BUF_NEED_QAOB: ++ /* TX completion code is already finished. */ ++ notification = qeth_compute_cq_notification(aob->aorc, 1); ++ qeth_notify_skbs(buffer->q, buffer, notification); ++ atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED); ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ } + + qdio_release_aob(aob); + } +@@ -1408,7 +1414,7 @@ static void qeth_notify_skbs(struct qeth_qdio_out_q *q, + skb_queue_walk(&buf->skb_list, skb) { + QETH_CARD_TEXT_(q->card, 5, "skbn%d", notification); + QETH_CARD_TEXT_(q->card, 5, "%lx", (long) skb); +- if (skb->protocol == htons(ETH_P_AF_IUCV) && skb->sk) ++ if (skb->sk && skb->sk->sk_family == PF_IUCV) + iucv_sk(skb->sk)->sk_txnotify(skb, notification); + } + } +@@ -1419,9 +1425,6 @@ static void qeth_tx_complete_buf(struct qeth_qdio_out_buffer *buf, bool error, + struct qeth_qdio_out_q *queue = buf->q; + struct sk_buff *skb; + +- /* release may never happen from within CQ tasklet scope */ +- WARN_ON_ONCE(atomic_read(&buf->state) == QETH_QDIO_BUF_IN_CQ); +- + if (atomic_read(&buf->state) == QETH_QDIO_BUF_PENDING) + qeth_notify_skbs(queue, buf, TX_NOTIFY_GENERALERROR); + +@@ -5846,9 +5849,32 @@ static void qeth_iqd_tx_complete(struct qeth_qdio_out_q *queue, + + if (atomic_cmpxchg(&buffer->state, QETH_QDIO_BUF_PRIMED, + QETH_QDIO_BUF_PENDING) == +- QETH_QDIO_BUF_PRIMED) ++ QETH_QDIO_BUF_PRIMED) { + qeth_notify_skbs(queue, buffer, TX_NOTIFY_PENDING); + ++ /* Handle race with qeth_qdio_handle_aob(): */ ++ switch (atomic_xchg(&buffer->state, ++ QETH_QDIO_BUF_NEED_QAOB)) { ++ case QETH_QDIO_BUF_PENDING: ++ /* No concurrent QAOB notification. */ ++ break; ++ case QETH_QDIO_BUF_QAOB_OK: ++ qeth_notify_skbs(queue, buffer, ++ TX_NOTIFY_DELAYED_OK); ++ atomic_set(&buffer->state, ++ QETH_QDIO_BUF_HANDLED_DELAYED); ++ break; ++ case QETH_QDIO_BUF_QAOB_ERROR: ++ qeth_notify_skbs(queue, buffer, ++ TX_NOTIFY_DELAYED_GENERALERROR); ++ atomic_set(&buffer->state, ++ QETH_QDIO_BUF_HANDLED_DELAYED); ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ } ++ } ++ + QETH_CARD_TEXT_(card, 5, "pel%u", bidx); + + /* prepare the queue slot for re-use: */ +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 1e9c3171fa9f4..f9314f1393fbd 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -533,8 +533,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state) + if (conn->task == task) + conn->task = NULL; + +- if (conn->ping_task == task) +- conn->ping_task = NULL; ++ if (READ_ONCE(conn->ping_task) == task) ++ WRITE_ONCE(conn->ping_task, NULL); + + /* release get from queueing */ + __iscsi_put_task(task); +@@ -738,6 +738,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr, + task->conn->session->age); + } + ++ if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK)) ++ WRITE_ONCE(conn->ping_task, task); ++ + if (!ihost->workq) { + if (iscsi_prep_mgmt_task(conn, task)) + goto free_task; +@@ -941,8 +944,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) + struct iscsi_nopout hdr; + struct iscsi_task *task; + +- if (!rhdr && conn->ping_task) +- return -EINVAL; ++ if (!rhdr) { ++ if (READ_ONCE(conn->ping_task)) ++ return -EINVAL; ++ WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK); ++ } + + memset(&hdr, 0, sizeof(struct iscsi_nopout)); + hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE; +@@ -957,11 +963,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) + + task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0); + if (!task) { ++ if (!rhdr) ++ WRITE_ONCE(conn->ping_task, NULL); + iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n"); + return -EIO; + } else if (!rhdr) { + /* only track our nops */ +- conn->ping_task = task; + conn->last_ping = jiffies; + } + +@@ -984,7 +991,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task, + struct iscsi_conn *conn = task->conn; + int rc = 0; + +- if (conn->ping_task != task) { ++ if (READ_ONCE(conn->ping_task) != task) { + /* + * If this is not in response to one of our + * nops then it must be from userspace. +@@ -1923,7 +1930,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn) + */ + static int iscsi_has_ping_timed_out(struct iscsi_conn *conn) + { +- if (conn->ping_task && ++ if (READ_ONCE(conn->ping_task) && + time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) + + (conn->ping_timeout * HZ), jiffies)) + return 1; +@@ -2058,7 +2065,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + * Checking the transport already or nop from a cmd timeout still + * running + */ +- if (conn->ping_task) { ++ if (READ_ONCE(conn->ping_task)) { + task->have_checked_conn = true; + rc = BLK_EH_RESET_TIMER; + goto done; +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 54928a837dad0..9dd32bb0ff2be 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -8677,11 +8677,7 @@ int ufshcd_shutdown(struct ufs_hba *hba) + if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba)) + goto out; + +- if (pm_runtime_suspended(hba->dev)) { +- ret = ufshcd_runtime_resume(hba); +- if (ret) +- goto out; +- } ++ pm_runtime_get_sync(hba->dev); + + ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM); + out: +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 9cfa15ec8b08c..5743e727b5f78 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -1334,7 +1334,7 @@ int bcm_qspi_probe(struct platform_device *pdev, + + data = of_id->data; + +- master = spi_alloc_master(dev, sizeof(struct bcm_qspi)); ++ master = devm_spi_alloc_master(dev, sizeof(struct bcm_qspi)); + if (!master) { + dev_err(dev, "error allocating spi_master\n"); + return -ENOMEM; +@@ -1374,21 +1374,17 @@ int bcm_qspi_probe(struct platform_device *pdev, + + if (res) { + qspi->base[MSPI] = devm_ioremap_resource(dev, res); +- if (IS_ERR(qspi->base[MSPI])) { +- ret = PTR_ERR(qspi->base[MSPI]); +- goto qspi_resource_err; +- } ++ if (IS_ERR(qspi->base[MSPI])) ++ return PTR_ERR(qspi->base[MSPI]); + } else { +- goto qspi_resource_err; ++ return 0; + } + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi"); + if (res) { + qspi->base[BSPI] = devm_ioremap_resource(dev, res); +- if (IS_ERR(qspi->base[BSPI])) { +- ret = PTR_ERR(qspi->base[BSPI]); +- goto qspi_resource_err; +- } ++ if (IS_ERR(qspi->base[BSPI])) ++ return PTR_ERR(qspi->base[BSPI]); + qspi->bspi_mode = true; + } else { + qspi->bspi_mode = false; +@@ -1399,18 +1395,14 @@ int bcm_qspi_probe(struct platform_device *pdev, + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "cs_reg"); + if (res) { + qspi->base[CHIP_SELECT] = devm_ioremap_resource(dev, res); +- if (IS_ERR(qspi->base[CHIP_SELECT])) { +- ret = PTR_ERR(qspi->base[CHIP_SELECT]); +- goto qspi_resource_err; +- } ++ if (IS_ERR(qspi->base[CHIP_SELECT])) ++ return PTR_ERR(qspi->base[CHIP_SELECT]); + } + + qspi->dev_ids = kcalloc(num_irqs, sizeof(struct bcm_qspi_dev_id), + GFP_KERNEL); +- if (!qspi->dev_ids) { +- ret = -ENOMEM; +- goto qspi_resource_err; +- } ++ if (!qspi->dev_ids) ++ return -ENOMEM; + + for (val = 0; val < num_irqs; val++) { + irq = -1; +@@ -1491,7 +1483,7 @@ int bcm_qspi_probe(struct platform_device *pdev, + qspi->xfer_mode.addrlen = -1; + qspi->xfer_mode.hp = -1; + +- ret = devm_spi_register_master(&pdev->dev, master); ++ ret = spi_register_master(master); + if (ret < 0) { + dev_err(dev, "can't register master\n"); + goto qspi_reg_err; +@@ -1504,8 +1496,6 @@ qspi_reg_err: + clk_disable_unprepare(qspi->clk); + qspi_probe_err: + kfree(qspi->dev_ids); +-qspi_resource_err: +- spi_master_put(master); + return ret; + } + /* probe function to be called by SoC specific platform driver probe */ +@@ -1515,10 +1505,10 @@ int bcm_qspi_remove(struct platform_device *pdev) + { + struct bcm_qspi *qspi = platform_get_drvdata(pdev); + ++ spi_unregister_master(qspi->master); + bcm_qspi_hw_uninit(qspi); + clk_disable_unprepare(qspi->clk); + kfree(qspi->dev_ids); +- spi_unregister_master(qspi->master); + + return 0; + } +diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c +index 9605abaaec670..197485f2c2b22 100644 +--- a/drivers/spi/spi-bcm2835.c ++++ b/drivers/spi/spi-bcm2835.c +@@ -1278,7 +1278,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev) + struct bcm2835_spi *bs; + int err; + +- ctlr = spi_alloc_master(&pdev->dev, ALIGN(sizeof(*bs), ++ ctlr = devm_spi_alloc_master(&pdev->dev, ALIGN(sizeof(*bs), + dma_get_cache_alignment())); + if (!ctlr) + return -ENOMEM; +@@ -1299,26 +1299,17 @@ static int bcm2835_spi_probe(struct platform_device *pdev) + bs->ctlr = ctlr; + + bs->regs = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(bs->regs)) { +- err = PTR_ERR(bs->regs); +- goto out_controller_put; +- } ++ if (IS_ERR(bs->regs)) ++ return PTR_ERR(bs->regs); + + bs->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(bs->clk)) { +- err = PTR_ERR(bs->clk); +- if (err == -EPROBE_DEFER) +- dev_dbg(&pdev->dev, "could not get clk: %d\n", err); +- else +- dev_err(&pdev->dev, "could not get clk: %d\n", err); +- goto out_controller_put; +- } ++ if (IS_ERR(bs->clk)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(bs->clk), ++ "could not get clk\n"); + + bs->irq = platform_get_irq(pdev, 0); +- if (bs->irq <= 0) { +- err = bs->irq ? bs->irq : -ENODEV; +- goto out_controller_put; +- } ++ if (bs->irq <= 0) ++ return bs->irq ? bs->irq : -ENODEV; + + clk_prepare_enable(bs->clk); + +@@ -1352,8 +1343,6 @@ out_dma_release: + bcm2835_dma_release(ctlr, bs); + out_clk_disable: + clk_disable_unprepare(bs->clk); +-out_controller_put: +- spi_controller_put(ctlr); + return err; + } + +diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c +index fd58547110e68..1a26865c42f83 100644 +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -529,8 +529,9 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev) + + bs->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(bs->clk)) { ++ err = PTR_ERR(bs->clk); + dev_err(&pdev->dev, "could not get clk: %d\n", err); +- return PTR_ERR(bs->clk); ++ return err; + } + + bs->irq = platform_get_irq(pdev, 0); +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 9aac515b718c8..91578103a3ca9 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1684,6 +1684,7 @@ static int spi_imx_probe(struct platform_device *pdev) + + pm_runtime_set_autosuspend_delay(spi_imx->dev, MXC_RPM_TIMEOUT); + pm_runtime_use_autosuspend(spi_imx->dev); ++ pm_runtime_get_noresume(spi_imx->dev); + pm_runtime_set_active(spi_imx->dev); + pm_runtime_enable(spi_imx->dev); + +diff --git a/drivers/staging/ralink-gdma/Kconfig b/drivers/staging/ralink-gdma/Kconfig +index 54e8029e6b1af..0017376234e28 100644 +--- a/drivers/staging/ralink-gdma/Kconfig ++++ b/drivers/staging/ralink-gdma/Kconfig +@@ -2,6 +2,7 @@ + config DMA_RALINK + tristate "RALINK DMA support" + depends on RALINK && !SOC_RT288X ++ depends on DMADEVICES + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 7b56fe9f10628..2e18ec42c7045 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -483,8 +483,7 @@ EXPORT_SYMBOL(iscsit_queue_rsp); + void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd) + { + spin_lock_bh(&conn->cmd_lock); +- if (!list_empty(&cmd->i_conn_node) && +- !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP)) ++ if (!list_empty(&cmd->i_conn_node)) + list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + +@@ -4083,12 +4082,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + spin_lock_bh(&conn->cmd_lock); + list_splice_init(&conn->conn_cmd_list, &tmp_list); + +- list_for_each_entry(cmd, &tmp_list, i_conn_node) { ++ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { + struct se_cmd *se_cmd = &cmd->se_cmd; + + if (se_cmd->se_tfo != NULL) { + spin_lock_irq(&se_cmd->t_state_lock); +- se_cmd->transport_state |= CMD_T_FABRIC_STOP; ++ if (se_cmd->transport_state & CMD_T_ABORTED) { ++ /* ++ * LIO's abort path owns the cleanup for this, ++ * so put it back on the list and let ++ * aborted_task handle it. ++ */ ++ list_move_tail(&cmd->i_conn_node, ++ &conn->conn_cmd_list); ++ } else { ++ se_cmd->transport_state |= CMD_T_FABRIC_STOP; ++ } + spin_unlock_irq(&se_cmd->t_state_lock); + } + } +diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c +index 20b6fd7383c54..c981757ba0d40 100644 +--- a/drivers/tee/optee/call.c ++++ b/drivers/tee/optee/call.c +@@ -534,7 +534,8 @@ void optee_free_pages_list(void *list, size_t num_entries) + static bool is_normal_memory(pgprot_t p) + { + #if defined(CONFIG_ARM) +- return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC; ++ return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) || ++ ((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK)); + #elif defined(CONFIG_ARM64) + return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL); + #else +diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c +index e0e1cb907ffd8..6af6343c7c65a 100644 +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -261,8 +261,8 @@ int cdns3_allocate_trb_pool(struct cdns3_endpoint *priv_ep) + */ + link_trb->control = 0; + } else { +- link_trb->buffer = TRB_BUFFER(priv_ep->trb_pool_dma); +- link_trb->control = TRB_CYCLE | TRB_TYPE(TRB_LINK) | TRB_TOGGLE; ++ link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma)); ++ link_trb->control = cpu_to_le32(TRB_CYCLE | TRB_TYPE(TRB_LINK) | TRB_TOGGLE); + } + return 0; + } +@@ -853,10 +853,10 @@ static void cdns3_wa1_restore_cycle_bit(struct cdns3_endpoint *priv_ep) + priv_ep->wa1_trb_index = 0xFFFF; + if (priv_ep->wa1_cycle_bit) { + priv_ep->wa1_trb->control = +- priv_ep->wa1_trb->control | 0x1; ++ priv_ep->wa1_trb->control | cpu_to_le32(0x1); + } else { + priv_ep->wa1_trb->control = +- priv_ep->wa1_trb->control & ~0x1; ++ priv_ep->wa1_trb->control & cpu_to_le32(~0x1); + } + } + } +@@ -1014,17 +1014,16 @@ static int cdns3_ep_run_stream_transfer(struct cdns3_endpoint *priv_ep, + TRB_STREAM_ID(priv_req->request.stream_id) | TRB_ISP; + + if (!request->num_sgs) { +- trb->buffer = TRB_BUFFER(trb_dma); ++ trb->buffer = cpu_to_le32(TRB_BUFFER(trb_dma)); + length = request->length; + } else { +- trb->buffer = TRB_BUFFER(request->sg[sg_idx].dma_address); ++ trb->buffer = cpu_to_le32(TRB_BUFFER(request->sg[sg_idx].dma_address)); + length = request->sg[sg_idx].length; + } + + tdl = DIV_ROUND_UP(length, priv_ep->endpoint.maxpacket); + +- trb->length = TRB_BURST_LEN(16 /*priv_ep->trb_burst_size*/) | +- TRB_LEN(length); ++ trb->length = cpu_to_le32(TRB_BURST_LEN(16) | TRB_LEN(length)); + + /* + * For DEV_VER_V2 controller version we have enabled +@@ -1033,11 +1032,11 @@ static int cdns3_ep_run_stream_transfer(struct cdns3_endpoint *priv_ep, + */ + if (priv_dev->dev_ver >= DEV_VER_V2) { + if (priv_dev->gadget.speed == USB_SPEED_SUPER) +- trb->length |= TRB_TDL_SS_SIZE(tdl); ++ trb->length |= cpu_to_le32(TRB_TDL_SS_SIZE(tdl)); + } + priv_req->flags |= REQUEST_PENDING; + +- trb->control = control; ++ trb->control = cpu_to_le32(control); + + trace_cdns3_prepare_trb(priv_ep, priv_req->trb); + +@@ -1162,8 +1161,8 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, + TRBS_PER_SEGMENT > 2) + ch_bit = TRB_CHAIN; + +- link_trb->control = ((priv_ep->pcs) ? TRB_CYCLE : 0) | +- TRB_TYPE(TRB_LINK) | TRB_TOGGLE | ch_bit; ++ link_trb->control = cpu_to_le32(((priv_ep->pcs) ? TRB_CYCLE : 0) | ++ TRB_TYPE(TRB_LINK) | TRB_TOGGLE | ch_bit); + } + + if (priv_dev->dev_ver <= DEV_VER_V2) +@@ -1171,35 +1170,37 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, + + /* set incorrect Cycle Bit for first trb*/ + control = priv_ep->pcs ? 0 : TRB_CYCLE; ++ trb->length = 0; ++ if (priv_dev->dev_ver >= DEV_VER_V2) { ++ u16 td_size; ++ ++ td_size = DIV_ROUND_UP(request->length, ++ priv_ep->endpoint.maxpacket); ++ if (priv_dev->gadget.speed == USB_SPEED_SUPER) ++ trb->length = TRB_TDL_SS_SIZE(td_size); ++ else ++ control |= TRB_TDL_HS_SIZE(td_size); ++ } + + do { + u32 length; +- u16 td_size = 0; + + /* fill TRB */ + control |= TRB_TYPE(TRB_NORMAL); +- trb->buffer = TRB_BUFFER(request->num_sgs == 0 +- ? trb_dma : request->sg[sg_iter].dma_address); ++ trb->buffer = cpu_to_le32(TRB_BUFFER(request->num_sgs == 0 ++ ? trb_dma : request->sg[sg_iter].dma_address)); + + if (likely(!request->num_sgs)) + length = request->length; + else + length = request->sg[sg_iter].length; + +- if (likely(priv_dev->dev_ver >= DEV_VER_V2)) +- td_size = DIV_ROUND_UP(length, +- priv_ep->endpoint.maxpacket); +- else if (priv_ep->flags & EP_TDLCHK_EN) ++ if (priv_ep->flags & EP_TDLCHK_EN) + total_tdl += DIV_ROUND_UP(length, + priv_ep->endpoint.maxpacket); + +- trb->length = TRB_BURST_LEN(priv_ep->trb_burst_size) | +- TRB_LEN(length); +- if (priv_dev->gadget.speed == USB_SPEED_SUPER) +- trb->length |= TRB_TDL_SS_SIZE(td_size); +- else +- control |= TRB_TDL_HS_SIZE(td_size); +- ++ trb->length |= cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) | ++ TRB_LEN(length)); + pcs = priv_ep->pcs ? TRB_CYCLE : 0; + + /* +@@ -1218,9 +1219,9 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, + } + + if (sg_iter) +- trb->control = control; ++ trb->control = cpu_to_le32(control); + else +- priv_req->trb->control = control; ++ priv_req->trb->control = cpu_to_le32(control); + + control = 0; + ++sg_iter; +@@ -1234,7 +1235,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, + priv_req->flags |= REQUEST_PENDING; + + if (sg_iter == 1) +- trb->control |= TRB_IOC | TRB_ISP; ++ trb->control |= cpu_to_le32(TRB_IOC | TRB_ISP); + + if (priv_dev->dev_ver < DEV_VER_V2 && + (priv_ep->flags & EP_TDLCHK_EN)) { +@@ -1260,7 +1261,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, + + /* give the TD to the consumer*/ + if (togle_pcs) +- trb->control = trb->control ^ 1; ++ trb->control = trb->control ^ cpu_to_le32(1); + + if (priv_dev->dev_ver <= DEV_VER_V2) + cdns3_wa1_tray_restore_cycle_bit(priv_dev, priv_ep); +@@ -1399,7 +1400,7 @@ static bool cdns3_request_handled(struct cdns3_endpoint *priv_ep, + + trb = &priv_ep->trb_pool[priv_req->start_trb]; + +- if ((trb->control & TRB_CYCLE) != priv_ep->ccs) ++ if ((le32_to_cpu(trb->control) & TRB_CYCLE) != priv_ep->ccs) + goto finish; + + if (doorbell == 1 && current_index == priv_ep->dequeue) +@@ -1448,7 +1449,7 @@ static void cdns3_transfer_completed(struct cdns3_device *priv_dev, + trb = priv_ep->trb_pool + priv_ep->dequeue; + + /* Request was dequeued and TRB was changed to TRB_LINK. */ +- if (TRB_FIELD_TO_TYPE(trb->control) == TRB_LINK) { ++ if (TRB_FIELD_TO_TYPE(le32_to_cpu(trb->control)) == TRB_LINK) { + trace_cdns3_complete_trb(priv_ep, trb); + cdns3_move_deq_to_next_trb(priv_req); + } +@@ -1580,7 +1581,7 @@ static int cdns3_check_ep_interrupt_proceed(struct cdns3_endpoint *priv_ep) + * that host ignore the ERDY packet and driver has to send it + * again. + */ +- if (tdl && (dbusy | !EP_STS_BUFFEMPTY(ep_sts_reg) | ++ if (tdl && (dbusy || !EP_STS_BUFFEMPTY(ep_sts_reg) || + EP_STS_HOSTPP(ep_sts_reg))) { + writel(EP_CMD_ERDY | + EP_CMD_ERDY_SID(priv_ep->last_stream_id), +@@ -2564,10 +2565,10 @@ found: + + /* Update ring only if removed request is on pending_req_list list */ + if (req_on_hw_ring && link_trb) { +- link_trb->buffer = TRB_BUFFER(priv_ep->trb_pool_dma + +- ((priv_req->end_trb + 1) * TRB_SIZE)); +- link_trb->control = (link_trb->control & TRB_CYCLE) | +- TRB_TYPE(TRB_LINK) | TRB_CHAIN; ++ link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma + ++ ((priv_req->end_trb + 1) * TRB_SIZE))); ++ link_trb->control = cpu_to_le32((le32_to_cpu(link_trb->control) & TRB_CYCLE) | ++ TRB_TYPE(TRB_LINK) | TRB_CHAIN); + + if (priv_ep->wa1_trb == priv_req->trb) + cdns3_wa1_restore_cycle_bit(priv_ep); +@@ -2622,7 +2623,7 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep) + priv_req = to_cdns3_request(request); + trb = priv_req->trb; + if (trb) +- trb->control = trb->control ^ TRB_CYCLE; ++ trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE); + } + + writel(EP_CMD_CSTALL | EP_CMD_EPRST, &priv_dev->regs->ep_cmd); +@@ -2637,7 +2638,8 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep) + + if (request) { + if (trb) +- trb->control = trb->control ^ TRB_CYCLE; ++ trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE); ++ + cdns3_rearm_transfer(priv_ep, 1); + } + +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index e96a858a12185..533236366a03b 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -482,11 +482,11 @@ static void snoop_urb(struct usb_device *udev, + + if (userurb) { /* Async */ + if (when == SUBMIT) +- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " ++ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, " + "length %u\n", + userurb, ep, t, d, length); + else +- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " ++ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, " + "actual_length %u status %d\n", + userurb, ep, t, d, length, + timeout_or_status); +@@ -1997,7 +1997,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg) + if (as) { + int retval; + +- snoop(&ps->dev->dev, "reap %pK\n", as->userurb); ++ snoop(&ps->dev->dev, "reap %px\n", as->userurb); + retval = processcompl(as, (void __user * __user *)arg); + free_async(as); + return retval; +@@ -2014,7 +2014,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg) + + as = async_getcompleted(ps); + if (as) { +- snoop(&ps->dev->dev, "reap %pK\n", as->userurb); ++ snoop(&ps->dev->dev, "reap %px\n", as->userurb); + retval = processcompl(as, (void __user * __user *)arg); + free_async(as); + } else { +@@ -2142,7 +2142,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg) + if (as) { + int retval; + +- snoop(&ps->dev->dev, "reap %pK\n", as->userurb); ++ snoop(&ps->dev->dev, "reap %px\n", as->userurb); + retval = processcompl_compat(as, (void __user * __user *)arg); + free_async(as); + return retval; +@@ -2159,7 +2159,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar + + as = async_getcompleted(ps); + if (as) { +- snoop(&ps->dev->dev, "reap %pK\n", as->userurb); ++ snoop(&ps->dev->dev, "reap %px\n", as->userurb); + retval = processcompl_compat(as, (void __user * __user *)arg); + free_async(as); + } else { +@@ -2624,7 +2624,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, + #endif + + case USBDEVFS_DISCARDURB: +- snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p); ++ snoop(&dev->dev, "%s: DISCARDURB %px\n", __func__, p); + ret = proc_unlinkurb(ps, p); + break; + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index a1e3a037a2892..fad31ccd1fa83 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -348,6 +348,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Guillemot Webcam Hercules Dualpix Exchange*/ + { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Guillemot Hercules DJ Console audio card (BZ 208357) */ ++ { USB_DEVICE(0x06f8, 0xb000), .driver_info = ++ USB_QUIRK_ENDPOINT_IGNORE }, ++ + /* Midiman M-Audio Keystation 88es */ + { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME }, + +@@ -421,6 +425,10 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1532, 0x0116), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + ++ /* Lenovo ThinkCenter A630Z TI024Gen3 usb-audio */ ++ { USB_DEVICE(0x17ef, 0xa012), .driver_info = ++ USB_QUIRK_DISCONNECT_SUSPEND }, ++ + /* BUILDWIN Photo Frame */ + { USB_DEVICE(0x1908, 0x1315), .driver_info = + USB_QUIRK_HONOR_BNUMINTERFACES }, +@@ -521,6 +529,8 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = { + * Matched for devices with USB_QUIRK_ENDPOINT_IGNORE. + */ + static const struct usb_device_id usb_endpoint_ignore[] = { ++ { USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x01 }, ++ { USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x81 }, + { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 }, + { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 }, + { } +diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c +index 46af0aa07e2e3..b2b5b0689667b 100644 +--- a/drivers/usb/gadget/function/f_midi.c ++++ b/drivers/usb/gadget/function/f_midi.c +@@ -1315,7 +1315,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi) + midi->id = kstrdup(opts->id, GFP_KERNEL); + if (opts->id && !midi->id) { + status = -ENOMEM; +- goto setup_fail; ++ goto midi_free; + } + midi->in_ports = opts->in_ports; + midi->out_ports = opts->out_ports; +@@ -1327,7 +1327,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi) + + status = kfifo_alloc(&midi->in_req_fifo, midi->qlen, GFP_KERNEL); + if (status) +- goto setup_fail; ++ goto midi_free; + + spin_lock_init(&midi->transmit_lock); + +@@ -1343,9 +1343,13 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi) + + return &midi->func; + ++midi_free: ++ if (midi) ++ kfree(midi->id); ++ kfree(midi); + setup_fail: + mutex_unlock(&opts->lock); +- kfree(midi); ++ + return ERR_PTR(status); + } + +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 1b430b36d0a6b..71e7d10dd76b9 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -2039,6 +2039,9 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc) + return 0; + + Enomem: ++ kfree(CHIP); ++ CHIP = NULL; ++ + return -ENOMEM; + } + +diff --git a/drivers/vdpa/Kconfig b/drivers/vdpa/Kconfig +index d7d32b6561021..358f6048dd3ce 100644 +--- a/drivers/vdpa/Kconfig ++++ b/drivers/vdpa/Kconfig +@@ -13,6 +13,7 @@ config VDPA_SIM + depends on RUNTIME_TESTING_MENU && HAS_DMA + select DMA_OPS + select VHOST_RING ++ select GENERIC_NET_UTILS + default n + help + vDPA networking device simulator which loop TX traffic back +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index b22adf03f5842..5d8850f5aef16 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -52,7 +52,6 @@ + #define VHOST_SCSI_VERSION "v0.1" + #define VHOST_SCSI_NAMELEN 256 + #define VHOST_SCSI_MAX_CDB_SIZE 32 +-#define VHOST_SCSI_DEFAULT_TAGS 256 + #define VHOST_SCSI_PREALLOC_SGLS 2048 + #define VHOST_SCSI_PREALLOC_UPAGES 2048 + #define VHOST_SCSI_PREALLOC_PROT_SGLS 2048 +@@ -189,6 +188,9 @@ struct vhost_scsi_virtqueue { + * Writers must also take dev mutex and flush under it. + */ + int inflight_idx; ++ struct vhost_scsi_cmd *scsi_cmds; ++ struct sbitmap scsi_tags; ++ int max_cmds; + }; + + struct vhost_scsi { +@@ -320,11 +322,13 @@ static u32 vhost_scsi_tpg_get_inst_index(struct se_portal_group *se_tpg) + return 1; + } + +-static void vhost_scsi_release_cmd(struct se_cmd *se_cmd) ++static void vhost_scsi_release_cmd_res(struct se_cmd *se_cmd) + { + struct vhost_scsi_cmd *tv_cmd = container_of(se_cmd, + struct vhost_scsi_cmd, tvc_se_cmd); +- struct se_session *se_sess = tv_cmd->tvc_nexus->tvn_se_sess; ++ struct vhost_scsi_virtqueue *svq = container_of(tv_cmd->tvc_vq, ++ struct vhost_scsi_virtqueue, vq); ++ struct vhost_scsi_inflight *inflight = tv_cmd->inflight; + int i; + + if (tv_cmd->tvc_sgl_count) { +@@ -336,8 +340,18 @@ static void vhost_scsi_release_cmd(struct se_cmd *se_cmd) + put_page(sg_page(&tv_cmd->tvc_prot_sgl[i])); + } + +- vhost_scsi_put_inflight(tv_cmd->inflight); +- target_free_tag(se_sess, se_cmd); ++ sbitmap_clear_bit(&svq->scsi_tags, se_cmd->map_tag); ++ vhost_scsi_put_inflight(inflight); ++} ++ ++static void vhost_scsi_release_cmd(struct se_cmd *se_cmd) ++{ ++ struct vhost_scsi_cmd *cmd = container_of(se_cmd, ++ struct vhost_scsi_cmd, tvc_se_cmd); ++ struct vhost_scsi *vs = cmd->tvc_vhost; ++ ++ llist_add(&cmd->tvc_completion_list, &vs->vs_completion_list); ++ vhost_work_queue(&vs->dev, &vs->vs_completion_work); + } + + static u32 vhost_scsi_sess_get_index(struct se_session *se_sess) +@@ -362,28 +376,15 @@ static int vhost_scsi_get_cmd_state(struct se_cmd *se_cmd) + return 0; + } + +-static void vhost_scsi_complete_cmd(struct vhost_scsi_cmd *cmd) +-{ +- struct vhost_scsi *vs = cmd->tvc_vhost; +- +- llist_add(&cmd->tvc_completion_list, &vs->vs_completion_list); +- +- vhost_work_queue(&vs->dev, &vs->vs_completion_work); +-} +- + static int vhost_scsi_queue_data_in(struct se_cmd *se_cmd) + { +- struct vhost_scsi_cmd *cmd = container_of(se_cmd, +- struct vhost_scsi_cmd, tvc_se_cmd); +- vhost_scsi_complete_cmd(cmd); ++ transport_generic_free_cmd(se_cmd, 0); + return 0; + } + + static int vhost_scsi_queue_status(struct se_cmd *se_cmd) + { +- struct vhost_scsi_cmd *cmd = container_of(se_cmd, +- struct vhost_scsi_cmd, tvc_se_cmd); +- vhost_scsi_complete_cmd(cmd); ++ transport_generic_free_cmd(se_cmd, 0); + return 0; + } + +@@ -429,15 +430,6 @@ vhost_scsi_allocate_evt(struct vhost_scsi *vs, + return evt; + } + +-static void vhost_scsi_free_cmd(struct vhost_scsi_cmd *cmd) +-{ +- struct se_cmd *se_cmd = &cmd->tvc_se_cmd; +- +- /* TODO locking against target/backend threads? */ +- transport_generic_free_cmd(se_cmd, 0); +- +-} +- + static int vhost_scsi_check_stop_free(struct se_cmd *se_cmd) + { + return target_put_sess_cmd(se_cmd); +@@ -556,7 +548,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) + } else + pr_err("Faulted on virtio_scsi_cmd_resp\n"); + +- vhost_scsi_free_cmd(cmd); ++ vhost_scsi_release_cmd_res(se_cmd); + } + + vq = -1; +@@ -566,31 +558,31 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) + } + + static struct vhost_scsi_cmd * +-vhost_scsi_get_tag(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg, ++vhost_scsi_get_cmd(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg, + unsigned char *cdb, u64 scsi_tag, u16 lun, u8 task_attr, + u32 exp_data_len, int data_direction) + { ++ struct vhost_scsi_virtqueue *svq = container_of(vq, ++ struct vhost_scsi_virtqueue, vq); + struct vhost_scsi_cmd *cmd; + struct vhost_scsi_nexus *tv_nexus; +- struct se_session *se_sess; + struct scatterlist *sg, *prot_sg; + struct page **pages; +- int tag, cpu; ++ int tag; + + tv_nexus = tpg->tpg_nexus; + if (!tv_nexus) { + pr_err("Unable to locate active struct vhost_scsi_nexus\n"); + return ERR_PTR(-EIO); + } +- se_sess = tv_nexus->tvn_se_sess; + +- tag = sbitmap_queue_get(&se_sess->sess_tag_pool, &cpu); ++ tag = sbitmap_get(&svq->scsi_tags, 0, false); + if (tag < 0) { + pr_err("Unable to obtain tag for vhost_scsi_cmd\n"); + return ERR_PTR(-ENOMEM); + } + +- cmd = &((struct vhost_scsi_cmd *)se_sess->sess_cmd_map)[tag]; ++ cmd = &svq->scsi_cmds[tag]; + sg = cmd->tvc_sgl; + prot_sg = cmd->tvc_prot_sgl; + pages = cmd->tvc_upages; +@@ -599,7 +591,6 @@ vhost_scsi_get_tag(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg, + cmd->tvc_prot_sgl = prot_sg; + cmd->tvc_upages = pages; + cmd->tvc_se_cmd.map_tag = tag; +- cmd->tvc_se_cmd.map_cpu = cpu; + cmd->tvc_tag = scsi_tag; + cmd->tvc_lun = lun; + cmd->tvc_task_attr = task_attr; +@@ -1065,11 +1056,11 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + scsi_command_size(cdb), VHOST_SCSI_MAX_CDB_SIZE); + goto err; + } +- cmd = vhost_scsi_get_tag(vq, tpg, cdb, tag, lun, task_attr, ++ cmd = vhost_scsi_get_cmd(vq, tpg, cdb, tag, lun, task_attr, + exp_data_len + prot_bytes, + data_direction); + if (IS_ERR(cmd)) { +- vq_err(vq, "vhost_scsi_get_tag failed %ld\n", ++ vq_err(vq, "vhost_scsi_get_cmd failed %ld\n", + PTR_ERR(cmd)); + goto err; + } +@@ -1088,7 +1079,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + &prot_iter, exp_data_len, + &data_iter))) { + vq_err(vq, "Failed to map iov to sgl\n"); +- vhost_scsi_release_cmd(&cmd->tvc_se_cmd); ++ vhost_scsi_release_cmd_res(&cmd->tvc_se_cmd); + goto err; + } + } +@@ -1373,6 +1364,83 @@ static void vhost_scsi_flush(struct vhost_scsi *vs) + wait_for_completion(&old_inflight[i]->comp); + } + ++static void vhost_scsi_destroy_vq_cmds(struct vhost_virtqueue *vq) ++{ ++ struct vhost_scsi_virtqueue *svq = container_of(vq, ++ struct vhost_scsi_virtqueue, vq); ++ struct vhost_scsi_cmd *tv_cmd; ++ unsigned int i; ++ ++ if (!svq->scsi_cmds) ++ return; ++ ++ for (i = 0; i < svq->max_cmds; i++) { ++ tv_cmd = &svq->scsi_cmds[i]; ++ ++ kfree(tv_cmd->tvc_sgl); ++ kfree(tv_cmd->tvc_prot_sgl); ++ kfree(tv_cmd->tvc_upages); ++ } ++ ++ sbitmap_free(&svq->scsi_tags); ++ kfree(svq->scsi_cmds); ++ svq->scsi_cmds = NULL; ++} ++ ++static int vhost_scsi_setup_vq_cmds(struct vhost_virtqueue *vq, int max_cmds) ++{ ++ struct vhost_scsi_virtqueue *svq = container_of(vq, ++ struct vhost_scsi_virtqueue, vq); ++ struct vhost_scsi_cmd *tv_cmd; ++ unsigned int i; ++ ++ if (svq->scsi_cmds) ++ return 0; ++ ++ if (sbitmap_init_node(&svq->scsi_tags, max_cmds, -1, GFP_KERNEL, ++ NUMA_NO_NODE)) ++ return -ENOMEM; ++ svq->max_cmds = max_cmds; ++ ++ svq->scsi_cmds = kcalloc(max_cmds, sizeof(*tv_cmd), GFP_KERNEL); ++ if (!svq->scsi_cmds) { ++ sbitmap_free(&svq->scsi_tags); ++ return -ENOMEM; ++ } ++ ++ for (i = 0; i < max_cmds; i++) { ++ tv_cmd = &svq->scsi_cmds[i]; ++ ++ tv_cmd->tvc_sgl = kcalloc(VHOST_SCSI_PREALLOC_SGLS, ++ sizeof(struct scatterlist), ++ GFP_KERNEL); ++ if (!tv_cmd->tvc_sgl) { ++ pr_err("Unable to allocate tv_cmd->tvc_sgl\n"); ++ goto out; ++ } ++ ++ tv_cmd->tvc_upages = kcalloc(VHOST_SCSI_PREALLOC_UPAGES, ++ sizeof(struct page *), ++ GFP_KERNEL); ++ if (!tv_cmd->tvc_upages) { ++ pr_err("Unable to allocate tv_cmd->tvc_upages\n"); ++ goto out; ++ } ++ ++ tv_cmd->tvc_prot_sgl = kcalloc(VHOST_SCSI_PREALLOC_PROT_SGLS, ++ sizeof(struct scatterlist), ++ GFP_KERNEL); ++ if (!tv_cmd->tvc_prot_sgl) { ++ pr_err("Unable to allocate tv_cmd->tvc_prot_sgl\n"); ++ goto out; ++ } ++ } ++ return 0; ++out: ++ vhost_scsi_destroy_vq_cmds(vq); ++ return -ENOMEM; ++} ++ + /* + * Called from vhost_scsi_ioctl() context to walk the list of available + * vhost_scsi_tpg with an active struct vhost_scsi_nexus +@@ -1427,10 +1495,9 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, + + if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) { + if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { +- kfree(vs_tpg); + mutex_unlock(&tpg->tv_tpg_mutex); + ret = -EEXIST; +- goto out; ++ goto undepend; + } + /* + * In order to ensure individual vhost-scsi configfs +@@ -1442,9 +1509,8 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, + ret = target_depend_item(&se_tpg->tpg_group.cg_item); + if (ret) { + pr_warn("target_depend_item() failed: %d\n", ret); +- kfree(vs_tpg); + mutex_unlock(&tpg->tv_tpg_mutex); +- goto out; ++ goto undepend; + } + tpg->tv_tpg_vhost_count++; + tpg->vhost_scsi = vs; +@@ -1457,6 +1523,16 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, + if (match) { + memcpy(vs->vs_vhost_wwpn, t->vhost_wwpn, + sizeof(vs->vs_vhost_wwpn)); ++ ++ for (i = VHOST_SCSI_VQ_IO; i < VHOST_SCSI_MAX_VQ; i++) { ++ vq = &vs->vqs[i].vq; ++ if (!vhost_vq_is_setup(vq)) ++ continue; ++ ++ if (vhost_scsi_setup_vq_cmds(vq, vq->num)) ++ goto destroy_vq_cmds; ++ } ++ + for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) { + vq = &vs->vqs[i].vq; + mutex_lock(&vq->mutex); +@@ -1476,7 +1552,22 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, + vhost_scsi_flush(vs); + kfree(vs->vs_tpg); + vs->vs_tpg = vs_tpg; ++ goto out; + ++destroy_vq_cmds: ++ for (i--; i >= VHOST_SCSI_VQ_IO; i--) { ++ if (!vhost_vq_get_backend(&vs->vqs[i].vq)) ++ vhost_scsi_destroy_vq_cmds(&vs->vqs[i].vq); ++ } ++undepend: ++ for (i = 0; i < VHOST_SCSI_MAX_TARGET; i++) { ++ tpg = vs_tpg[i]; ++ if (tpg) { ++ tpg->tv_tpg_vhost_count--; ++ target_undepend_item(&tpg->se_tpg.tpg_group.cg_item); ++ } ++ } ++ kfree(vs_tpg); + out: + mutex_unlock(&vs->dev.mutex); + mutex_unlock(&vhost_scsi_mutex); +@@ -1549,6 +1640,12 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs, + mutex_lock(&vq->mutex); + vhost_vq_set_backend(vq, NULL); + mutex_unlock(&vq->mutex); ++ /* ++ * Make sure cmds are not running before tearing them ++ * down. ++ */ ++ vhost_scsi_flush(vs); ++ vhost_scsi_destroy_vq_cmds(vq); + } + } + /* +@@ -1842,23 +1939,6 @@ static void vhost_scsi_port_unlink(struct se_portal_group *se_tpg, + mutex_unlock(&vhost_scsi_mutex); + } + +-static void vhost_scsi_free_cmd_map_res(struct se_session *se_sess) +-{ +- struct vhost_scsi_cmd *tv_cmd; +- unsigned int i; +- +- if (!se_sess->sess_cmd_map) +- return; +- +- for (i = 0; i < VHOST_SCSI_DEFAULT_TAGS; i++) { +- tv_cmd = &((struct vhost_scsi_cmd *)se_sess->sess_cmd_map)[i]; +- +- kfree(tv_cmd->tvc_sgl); +- kfree(tv_cmd->tvc_prot_sgl); +- kfree(tv_cmd->tvc_upages); +- } +-} +- + static ssize_t vhost_scsi_tpg_attrib_fabric_prot_type_store( + struct config_item *item, const char *page, size_t count) + { +@@ -1898,45 +1978,6 @@ static struct configfs_attribute *vhost_scsi_tpg_attrib_attrs[] = { + NULL, + }; + +-static int vhost_scsi_nexus_cb(struct se_portal_group *se_tpg, +- struct se_session *se_sess, void *p) +-{ +- struct vhost_scsi_cmd *tv_cmd; +- unsigned int i; +- +- for (i = 0; i < VHOST_SCSI_DEFAULT_TAGS; i++) { +- tv_cmd = &((struct vhost_scsi_cmd *)se_sess->sess_cmd_map)[i]; +- +- tv_cmd->tvc_sgl = kcalloc(VHOST_SCSI_PREALLOC_SGLS, +- sizeof(struct scatterlist), +- GFP_KERNEL); +- if (!tv_cmd->tvc_sgl) { +- pr_err("Unable to allocate tv_cmd->tvc_sgl\n"); +- goto out; +- } +- +- tv_cmd->tvc_upages = kcalloc(VHOST_SCSI_PREALLOC_UPAGES, +- sizeof(struct page *), +- GFP_KERNEL); +- if (!tv_cmd->tvc_upages) { +- pr_err("Unable to allocate tv_cmd->tvc_upages\n"); +- goto out; +- } +- +- tv_cmd->tvc_prot_sgl = kcalloc(VHOST_SCSI_PREALLOC_PROT_SGLS, +- sizeof(struct scatterlist), +- GFP_KERNEL); +- if (!tv_cmd->tvc_prot_sgl) { +- pr_err("Unable to allocate tv_cmd->tvc_prot_sgl\n"); +- goto out; +- } +- } +- return 0; +-out: +- vhost_scsi_free_cmd_map_res(se_sess); +- return -ENOMEM; +-} +- + static int vhost_scsi_make_nexus(struct vhost_scsi_tpg *tpg, + const char *name) + { +@@ -1960,12 +2001,9 @@ static int vhost_scsi_make_nexus(struct vhost_scsi_tpg *tpg, + * struct se_node_acl for the vhost_scsi struct se_portal_group with + * the SCSI Initiator port name of the passed configfs group 'name'. + */ +- tv_nexus->tvn_se_sess = target_setup_session(&tpg->se_tpg, +- VHOST_SCSI_DEFAULT_TAGS, +- sizeof(struct vhost_scsi_cmd), ++ tv_nexus->tvn_se_sess = target_setup_session(&tpg->se_tpg, 0, 0, + TARGET_PROT_DIN_PASS | TARGET_PROT_DOUT_PASS, +- (unsigned char *)name, tv_nexus, +- vhost_scsi_nexus_cb); ++ (unsigned char *)name, tv_nexus, NULL); + if (IS_ERR(tv_nexus->tvn_se_sess)) { + mutex_unlock(&tpg->tv_tpg_mutex); + kfree(tv_nexus); +@@ -2015,7 +2053,6 @@ static int vhost_scsi_drop_nexus(struct vhost_scsi_tpg *tpg) + " %s Initiator Port: %s\n", vhost_scsi_dump_proto_id(tpg->tport), + tv_nexus->tvn_se_sess->se_node_acl->initiatorname); + +- vhost_scsi_free_cmd_map_res(se_sess); + /* + * Release the SCSI I_T Nexus to the emulated vhost Target Port + */ +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 9ad45e1d27f0f..23e7b2d624511 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -305,6 +305,12 @@ static void vhost_vring_call_reset(struct vhost_vring_call *call_ctx) + spin_lock_init(&call_ctx->ctx_lock); + } + ++bool vhost_vq_is_setup(struct vhost_virtqueue *vq) ++{ ++ return vq->avail && vq->desc && vq->used && vhost_vq_access_ok(vq); ++} ++EXPORT_SYMBOL_GPL(vhost_vq_is_setup); ++ + static void vhost_vq_reset(struct vhost_dev *dev, + struct vhost_virtqueue *vq) + { +diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h +index 9032d3c2a9f48..3d30b3da7bcf5 100644 +--- a/drivers/vhost/vhost.h ++++ b/drivers/vhost/vhost.h +@@ -190,6 +190,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *, + struct vhost_log *log, unsigned int *log_num); + void vhost_discard_vq_desc(struct vhost_virtqueue *, int n); + ++bool vhost_vq_is_setup(struct vhost_virtqueue *vq); + int vhost_vq_init_access(struct vhost_virtqueue *); + int vhost_add_used(struct vhost_virtqueue *, unsigned int head, int len); + int vhost_add_used_n(struct vhost_virtqueue *, struct vring_used_elem *heads, +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index e36fb1a0ecdbd..19b3f3416d31c 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -1092,7 +1092,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + goto err1; + } + +- fb_virt = ioremap(par->mem->start, screen_fb_size); ++ /* ++ * Map the VRAM cacheable for performance. This is also required for ++ * VM Connect to display properly for ARM64 Linux VM, as the host also ++ * maps the VRAM cacheable. ++ */ ++ fb_virt = ioremap_cache(par->mem->start, screen_fb_size); + if (!fb_virt) + goto err2; + +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 4507c3d093994..dcafe09be8dca 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -452,46 +452,6 @@ static void btrfs_drop_pages(struct page **pages, size_t num_pages) + } + } + +-static int btrfs_find_new_delalloc_bytes(struct btrfs_inode *inode, +- const u64 start, +- const u64 len, +- struct extent_state **cached_state) +-{ +- u64 search_start = start; +- const u64 end = start + len - 1; +- +- while (search_start < end) { +- const u64 search_len = end - search_start + 1; +- struct extent_map *em; +- u64 em_len; +- int ret = 0; +- +- em = btrfs_get_extent(inode, NULL, 0, search_start, search_len); +- if (IS_ERR(em)) +- return PTR_ERR(em); +- +- if (em->block_start != EXTENT_MAP_HOLE) +- goto next; +- +- em_len = em->len; +- if (em->start < search_start) +- em_len -= search_start - em->start; +- if (em_len > search_len) +- em_len = search_len; +- +- ret = set_extent_bit(&inode->io_tree, search_start, +- search_start + em_len - 1, +- EXTENT_DELALLOC_NEW, +- NULL, cached_state, GFP_NOFS); +-next: +- search_start = extent_map_end(em); +- free_extent_map(em); +- if (ret) +- return ret; +- } +- return 0; +-} +- + /* + * after copy_from_user, pages need to be dirtied and we need to make + * sure holes are created between the current EOF and the start of +@@ -528,23 +488,6 @@ int btrfs_dirty_pages(struct btrfs_inode *inode, struct page **pages, + EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING | EXTENT_DEFRAG, + 0, 0, cached); + +- if (!btrfs_is_free_space_inode(inode)) { +- if (start_pos >= isize && +- !(inode->flags & BTRFS_INODE_PREALLOC)) { +- /* +- * There can't be any extents following eof in this case +- * so just set the delalloc new bit for the range +- * directly. +- */ +- extra_bits |= EXTENT_DELALLOC_NEW; +- } else { +- err = btrfs_find_new_delalloc_bytes(inode, start_pos, +- num_bytes, cached); +- if (err) +- return err; +- } +- } +- + err = btrfs_set_extent_delalloc(inode, start_pos, end_of_last_block, + extra_bits, cached); + if (err) +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 11d132bc2679c..4708ea05449b9 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2262,11 +2262,69 @@ static noinline int add_pending_csums(struct btrfs_trans_handle *trans, + return 0; + } + ++static int btrfs_find_new_delalloc_bytes(struct btrfs_inode *inode, ++ const u64 start, ++ const u64 len, ++ struct extent_state **cached_state) ++{ ++ u64 search_start = start; ++ const u64 end = start + len - 1; ++ ++ while (search_start < end) { ++ const u64 search_len = end - search_start + 1; ++ struct extent_map *em; ++ u64 em_len; ++ int ret = 0; ++ ++ em = btrfs_get_extent(inode, NULL, 0, search_start, search_len); ++ if (IS_ERR(em)) ++ return PTR_ERR(em); ++ ++ if (em->block_start != EXTENT_MAP_HOLE) ++ goto next; ++ ++ em_len = em->len; ++ if (em->start < search_start) ++ em_len -= search_start - em->start; ++ if (em_len > search_len) ++ em_len = search_len; ++ ++ ret = set_extent_bit(&inode->io_tree, search_start, ++ search_start + em_len - 1, ++ EXTENT_DELALLOC_NEW, ++ NULL, cached_state, GFP_NOFS); ++next: ++ search_start = extent_map_end(em); ++ free_extent_map(em); ++ if (ret) ++ return ret; ++ } ++ return 0; ++} ++ + int btrfs_set_extent_delalloc(struct btrfs_inode *inode, u64 start, u64 end, + unsigned int extra_bits, + struct extent_state **cached_state) + { + WARN_ON(PAGE_ALIGNED(end)); ++ ++ if (start >= i_size_read(&inode->vfs_inode) && ++ !(inode->flags & BTRFS_INODE_PREALLOC)) { ++ /* ++ * There can't be any extents following eof in this case so just ++ * set the delalloc new bit for the range directly. ++ */ ++ extra_bits |= EXTENT_DELALLOC_NEW; ++ } else { ++ int ret; ++ ++ ret = btrfs_find_new_delalloc_bytes(inode, start, ++ end + 1 - start, ++ cached_state); ++ if (ret) ++ return ret; ++ } ++ + return set_extent_delalloc(&inode->io_tree, start, end, extra_bits, + cached_state); + } +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index db953cb947bc4..9205a88f2a881 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -497,13 +497,13 @@ next2: + break; + } + out: ++ btrfs_free_path(path); + fs_info->qgroup_flags |= flags; + if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON)) + clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); + else if (fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN && + ret >= 0) + ret = qgroup_rescan_init(fs_info, rescan_progress, 0); +- btrfs_free_path(path); + + if (ret < 0) { + ulist_free(fs_info->qgroup_ulist); +@@ -3516,6 +3516,7 @@ static int try_flush_qgroup(struct btrfs_root *root) + { + struct btrfs_trans_handle *trans; + int ret; ++ bool can_commit = true; + + /* + * We don't want to run flush again and again, so if there is a running +@@ -3527,6 +3528,20 @@ static int try_flush_qgroup(struct btrfs_root *root) + return 0; + } + ++ /* ++ * If current process holds a transaction, we shouldn't flush, as we ++ * assume all space reservation happens before a transaction handle is ++ * held. ++ * ++ * But there are cases like btrfs_delayed_item_reserve_metadata() where ++ * we try to reserve space with one transction handle already held. ++ * In that case we can't commit transaction, but at least try to end it ++ * and hope the started data writes can free some space. ++ */ ++ if (current->journal_info && ++ current->journal_info != BTRFS_SEND_TRANS_STUB) ++ can_commit = false; ++ + ret = btrfs_start_delalloc_snapshot(root); + if (ret < 0) + goto out; +@@ -3538,7 +3553,10 @@ static int try_flush_qgroup(struct btrfs_root *root) + goto out; + } + +- ret = btrfs_commit_transaction(trans); ++ if (can_commit) ++ ret = btrfs_commit_transaction(trans); ++ else ++ ret = btrfs_end_transaction(trans); + out: + clear_bit(BTRFS_ROOT_QGROUP_FLUSHING, &root->state); + wake_up(&root->qgroup_flush_wait); +diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c +index 894a63a92236e..a6539500a8828 100644 +--- a/fs/btrfs/tests/inode-tests.c ++++ b/fs/btrfs/tests/inode-tests.c +@@ -986,7 +986,8 @@ static int test_extent_accounting(u32 sectorsize, u32 nodesize) + ret = clear_extent_bit(&BTRFS_I(inode)->io_tree, + BTRFS_MAX_EXTENT_SIZE >> 1, + (BTRFS_MAX_EXTENT_SIZE >> 1) + sectorsize - 1, +- EXTENT_DELALLOC | EXTENT_UPTODATE, 0, 0, NULL); ++ EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | ++ EXTENT_UPTODATE, 0, 0, NULL); + if (ret) { + test_err("clear_extent_bit returned %d", ret); + goto out; +@@ -1053,7 +1054,8 @@ static int test_extent_accounting(u32 sectorsize, u32 nodesize) + ret = clear_extent_bit(&BTRFS_I(inode)->io_tree, + BTRFS_MAX_EXTENT_SIZE + sectorsize, + BTRFS_MAX_EXTENT_SIZE + 2 * sectorsize - 1, +- EXTENT_DELALLOC | EXTENT_UPTODATE, 0, 0, NULL); ++ EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | ++ EXTENT_UPTODATE, 0, 0, NULL); + if (ret) { + test_err("clear_extent_bit returned %d", ret); + goto out; +@@ -1085,7 +1087,8 @@ static int test_extent_accounting(u32 sectorsize, u32 nodesize) + + /* Empty */ + ret = clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1, +- EXTENT_DELALLOC | EXTENT_UPTODATE, 0, 0, NULL); ++ EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | ++ EXTENT_UPTODATE, 0, 0, NULL); + if (ret) { + test_err("clear_extent_bit returned %d", ret); + goto out; +@@ -1100,7 +1103,8 @@ static int test_extent_accounting(u32 sectorsize, u32 nodesize) + out: + if (ret) + clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1, +- EXTENT_DELALLOC | EXTENT_UPTODATE, 0, 0, NULL); ++ EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | ++ EXTENT_UPTODATE, 0, 0, NULL); + iput(inode); + btrfs_free_dummy_root(root); + btrfs_free_dummy_fs_info(fs_info); +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index 8784b74f5232e..ea2bb4cb58909 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -1068,6 +1068,7 @@ static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key, + "invalid root item size, have %u expect %zu or %u", + btrfs_item_size_nr(leaf, slot), sizeof(ri), + btrfs_legacy_root_item_size()); ++ return -EUCLEAN; + } + + /* +@@ -1423,6 +1424,7 @@ static int check_extent_data_ref(struct extent_buffer *leaf, + "invalid item size, have %u expect aligned to %zu for key type %u", + btrfs_item_size_nr(leaf, slot), + sizeof(*dref), key->type); ++ return -EUCLEAN; + } + if (!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize)) { + generic_err(leaf, slot, +@@ -1451,6 +1453,7 @@ static int check_extent_data_ref(struct extent_buffer *leaf, + extent_err(leaf, slot, + "invalid extent data backref offset, have %llu expect aligned to %u", + offset, leaf->fs_info->sectorsize); ++ return -EUCLEAN; + } + } + return 0; +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 578bbe544c8b5..7c703f9c3eda7 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -941,7 +941,13 @@ static noinline struct btrfs_device *device_list_add(const char *path, + if (device->bdev != path_bdev) { + bdput(path_bdev); + mutex_unlock(&fs_devices->device_list_mutex); +- btrfs_warn_in_rcu(device->fs_info, ++ /* ++ * device->fs_info may not be reliable here, so ++ * pass in a NULL instead. This avoids a ++ * possible use-after-free when the fs_info and ++ * fs_info->sb are already torn down. ++ */ ++ btrfs_warn_in_rcu(NULL, + "duplicate device %s devid %llu generation %llu scanned by %s (%d)", + path, devid, found_transid, + current->comm, +diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c +index 23b21e9436528..ef4784e72b1d5 100644 +--- a/fs/cifs/cifsacl.c ++++ b/fs/cifs/cifsacl.c +@@ -1266,6 +1266,7 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr, + cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc); + } else if (mode_from_special_sid) { + rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr, true); ++ kfree(pntsd); + } else { + /* get approximated mode from ACL */ + rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr, false); +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index e2e53652193e6..475c2b9e799d8 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -262,7 +262,7 @@ smb2_revert_current_mid(struct TCP_Server_Info *server, const unsigned int val) + } + + static struct mid_q_entry * +-smb2_find_mid(struct TCP_Server_Info *server, char *buf) ++__smb2_find_mid(struct TCP_Server_Info *server, char *buf, bool dequeue) + { + struct mid_q_entry *mid; + struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf; +@@ -279,6 +279,10 @@ smb2_find_mid(struct TCP_Server_Info *server, char *buf) + (mid->mid_state == MID_REQUEST_SUBMITTED) && + (mid->command == shdr->Command)) { + kref_get(&mid->refcount); ++ if (dequeue) { ++ list_del_init(&mid->qhead); ++ mid->mid_flags |= MID_DELETED; ++ } + spin_unlock(&GlobalMid_Lock); + return mid; + } +@@ -287,6 +291,18 @@ smb2_find_mid(struct TCP_Server_Info *server, char *buf) + return NULL; + } + ++static struct mid_q_entry * ++smb2_find_mid(struct TCP_Server_Info *server, char *buf) ++{ ++ return __smb2_find_mid(server, buf, false); ++} ++ ++static struct mid_q_entry * ++smb2_find_dequeue_mid(struct TCP_Server_Info *server, char *buf) ++{ ++ return __smb2_find_mid(server, buf, true); ++} ++ + static void + smb2_dump_detail(void *buf, struct TCP_Server_Info *server) + { +@@ -4212,7 +4228,8 @@ init_read_bvec(struct page **pages, unsigned int npages, unsigned int data_size, + static int + handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + char *buf, unsigned int buf_len, struct page **pages, +- unsigned int npages, unsigned int page_data_size) ++ unsigned int npages, unsigned int page_data_size, ++ bool is_offloaded) + { + unsigned int data_offset; + unsigned int data_len; +@@ -4234,7 +4251,8 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + + if (server->ops->is_session_expired && + server->ops->is_session_expired(buf)) { +- cifs_reconnect(server); ++ if (!is_offloaded) ++ cifs_reconnect(server); + return -1; + } + +@@ -4258,7 +4276,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + cifs_dbg(FYI, "%s: server returned error %d\n", + __func__, rdata->result); + /* normal error on read response */ +- dequeue_mid(mid, false); ++ if (is_offloaded) ++ mid->mid_state = MID_RESPONSE_RECEIVED; ++ else ++ dequeue_mid(mid, false); + return 0; + } + +@@ -4282,7 +4303,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + cifs_dbg(FYI, "%s: data offset (%u) beyond end of smallbuf\n", + __func__, data_offset); + rdata->result = -EIO; +- dequeue_mid(mid, rdata->result); ++ if (is_offloaded) ++ mid->mid_state = MID_RESPONSE_MALFORMED; ++ else ++ dequeue_mid(mid, rdata->result); + return 0; + } + +@@ -4298,21 +4322,30 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + cifs_dbg(FYI, "%s: data offset (%u) beyond 1st page of response\n", + __func__, data_offset); + rdata->result = -EIO; +- dequeue_mid(mid, rdata->result); ++ if (is_offloaded) ++ mid->mid_state = MID_RESPONSE_MALFORMED; ++ else ++ dequeue_mid(mid, rdata->result); + return 0; + } + + if (data_len > page_data_size - pad_len) { + /* data_len is corrupt -- discard frame */ + rdata->result = -EIO; +- dequeue_mid(mid, rdata->result); ++ if (is_offloaded) ++ mid->mid_state = MID_RESPONSE_MALFORMED; ++ else ++ dequeue_mid(mid, rdata->result); + return 0; + } + + rdata->result = init_read_bvec(pages, npages, page_data_size, + cur_off, &bvec); + if (rdata->result != 0) { +- dequeue_mid(mid, rdata->result); ++ if (is_offloaded) ++ mid->mid_state = MID_RESPONSE_MALFORMED; ++ else ++ dequeue_mid(mid, rdata->result); + return 0; + } + +@@ -4327,7 +4360,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + /* read response payload cannot be in both buf and pages */ + WARN_ONCE(1, "buf can not contain only a part of read data"); + rdata->result = -EIO; +- dequeue_mid(mid, rdata->result); ++ if (is_offloaded) ++ mid->mid_state = MID_RESPONSE_MALFORMED; ++ else ++ dequeue_mid(mid, rdata->result); + return 0; + } + +@@ -4338,7 +4374,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + if (length < 0) + return length; + +- dequeue_mid(mid, false); ++ if (is_offloaded) ++ mid->mid_state = MID_RESPONSE_RECEIVED; ++ else ++ dequeue_mid(mid, false); + return length; + } + +@@ -4367,15 +4406,34 @@ static void smb2_decrypt_offload(struct work_struct *work) + } + + dw->server->lstrp = jiffies; +- mid = smb2_find_mid(dw->server, dw->buf); ++ mid = smb2_find_dequeue_mid(dw->server, dw->buf); + if (mid == NULL) + cifs_dbg(FYI, "mid not found\n"); + else { + mid->decrypted = true; + rc = handle_read_data(dw->server, mid, dw->buf, + dw->server->vals->read_rsp_size, +- dw->ppages, dw->npages, dw->len); +- mid->callback(mid); ++ dw->ppages, dw->npages, dw->len, ++ true); ++ if (rc >= 0) { ++#ifdef CONFIG_CIFS_STATS2 ++ mid->when_received = jiffies; ++#endif ++ mid->callback(mid); ++ } else { ++ spin_lock(&GlobalMid_Lock); ++ if (dw->server->tcpStatus == CifsNeedReconnect) { ++ mid->mid_state = MID_RETRY_NEEDED; ++ spin_unlock(&GlobalMid_Lock); ++ mid->callback(mid); ++ } else { ++ mid->mid_state = MID_REQUEST_SUBMITTED; ++ mid->mid_flags &= ~(MID_DELETED); ++ list_add_tail(&mid->qhead, ++ &dw->server->pending_mid_q); ++ spin_unlock(&GlobalMid_Lock); ++ } ++ } + cifs_mid_q_entry_release(mid); + } + +@@ -4478,7 +4536,7 @@ non_offloaded_decrypt: + (*mid)->decrypted = true; + rc = handle_read_data(server, *mid, buf, + server->vals->read_rsp_size, +- pages, npages, len); ++ pages, npages, len, false); + } + + free_pages: +@@ -4621,7 +4679,7 @@ smb3_handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid) + char *buf = server->large_buf ? server->bigbuf : server->smallbuf; + + return handle_read_data(server, mid, buf, server->pdu_size, +- NULL, 0, 0); ++ NULL, 0, 0, false); + } + + static int +diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c +index 96c0c86f3fffe..0297ad95eb5cc 100644 +--- a/fs/efivarfs/inode.c ++++ b/fs/efivarfs/inode.c +@@ -7,6 +7,7 @@ + #include <linux/efi.h> + #include <linux/fs.h> + #include <linux/ctype.h> ++#include <linux/kmemleak.h> + #include <linux/slab.h> + #include <linux/uuid.h> + +@@ -103,6 +104,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry, + var->var.VariableName[i] = '\0'; + + inode->i_private = var; ++ kmemleak_ignore(var); + + err = efivar_entry_add(var, &efivarfs_list); + if (err) +diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c +index f943fd0b0699c..15880a68faadc 100644 +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -21,7 +21,6 @@ LIST_HEAD(efivarfs_list); + static void efivarfs_evict_inode(struct inode *inode) + { + clear_inode(inode); +- kfree(inode->i_private); + } + + static const struct super_operations efivarfs_ops = { +diff --git a/fs/io_uring.c b/fs/io_uring.c +index e74a56f6915c0..6d729a278535e 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -200,6 +200,7 @@ struct fixed_file_ref_node { + struct list_head file_list; + struct fixed_file_data *file_data; + struct llist_node llist; ++ bool done; + }; + + struct fixed_file_data { +@@ -435,6 +436,7 @@ struct io_sr_msg { + struct io_open { + struct file *file; + int dfd; ++ bool ignore_nonblock; + struct filename *filename; + struct open_how how; + unsigned long nofile; +@@ -2990,7 +2992,7 @@ static void io_req_map_rw(struct io_kiocb *req, const struct iovec *iovec, + rw->free_iovec = NULL; + rw->bytes_done = 0; + /* can only be fixed buffers, no need to do anything */ +- if (iter->type == ITER_BVEC) ++ if (iov_iter_is_bvec(iter)) + return; + if (!iovec) { + unsigned iov_off = 0; +@@ -3590,6 +3592,7 @@ static int __io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe + return ret; + } + req->open.nofile = rlimit(RLIMIT_NOFILE); ++ req->open.ignore_nonblock = false; + req->flags |= REQ_F_NEED_CLEANUP; + return 0; + } +@@ -3637,7 +3640,7 @@ static int io_openat2(struct io_kiocb *req, bool force_nonblock) + struct file *file; + int ret; + +- if (force_nonblock) ++ if (force_nonblock && !req->open.ignore_nonblock) + return -EAGAIN; + + ret = build_open_flags(&req->open.how, &op); +@@ -3652,6 +3655,21 @@ static int io_openat2(struct io_kiocb *req, bool force_nonblock) + if (IS_ERR(file)) { + put_unused_fd(ret); + ret = PTR_ERR(file); ++ /* ++ * A work-around to ensure that /proc/self works that way ++ * that it should - if we get -EOPNOTSUPP back, then assume ++ * that proc_self_get_link() failed us because we're in async ++ * context. We should be safe to retry this from the task ++ * itself with force_nonblock == false set, as it should not ++ * block on lookup. Would be nice to know this upfront and ++ * avoid the async dance, but doesn't seem feasible. ++ */ ++ if (ret == -EOPNOTSUPP && io_wq_current_is_worker()) { ++ req->open.ignore_nonblock = true; ++ refcount_inc(&req->refs); ++ io_req_task_queue(req); ++ return 0; ++ } + } else { + fsnotify_open(file); + fd_install(ret, file); +@@ -6854,9 +6872,8 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx) + return -ENXIO; + + spin_lock(&data->lock); +- if (!list_empty(&data->ref_list)) +- ref_node = list_first_entry(&data->ref_list, +- struct fixed_file_ref_node, node); ++ ref_node = container_of(data->cur_refs, struct fixed_file_ref_node, ++ refs); + spin_unlock(&data->lock); + if (ref_node) + percpu_ref_kill(&ref_node->refs); +@@ -7107,10 +7124,6 @@ static void __io_file_put_work(struct fixed_file_ref_node *ref_node) + kfree(pfile); + } + +- spin_lock(&file_data->lock); +- list_del(&ref_node->node); +- spin_unlock(&file_data->lock); +- + percpu_ref_exit(&ref_node->refs); + kfree(ref_node); + percpu_ref_put(&file_data->refs); +@@ -7137,17 +7150,33 @@ static void io_file_put_work(struct work_struct *work) + static void io_file_data_ref_zero(struct percpu_ref *ref) + { + struct fixed_file_ref_node *ref_node; ++ struct fixed_file_data *data; + struct io_ring_ctx *ctx; +- bool first_add; ++ bool first_add = false; + int delay = HZ; + + ref_node = container_of(ref, struct fixed_file_ref_node, refs); +- ctx = ref_node->file_data->ctx; ++ data = ref_node->file_data; ++ ctx = data->ctx; ++ ++ spin_lock(&data->lock); ++ ref_node->done = true; + +- if (percpu_ref_is_dying(&ctx->file_data->refs)) ++ while (!list_empty(&data->ref_list)) { ++ ref_node = list_first_entry(&data->ref_list, ++ struct fixed_file_ref_node, node); ++ /* recycle ref nodes in order */ ++ if (!ref_node->done) ++ break; ++ list_del(&ref_node->node); ++ first_add |= llist_add(&ref_node->llist, &ctx->file_put_llist); ++ } ++ spin_unlock(&data->lock); ++ ++ ++ if (percpu_ref_is_dying(&data->refs)) + delay = 0; + +- first_add = llist_add(&ref_node->llist, &ctx->file_put_llist); + if (!delay) + mod_delayed_work(system_wq, &ctx->file_put_work, 0); + else if (first_add) +@@ -7171,6 +7200,7 @@ static struct fixed_file_ref_node *alloc_fixed_file_ref_node( + INIT_LIST_HEAD(&ref_node->node); + INIT_LIST_HEAD(&ref_node->file_list); + ref_node->file_data = ctx->file_data; ++ ref_node->done = false; + return ref_node; + } + +@@ -7298,7 +7328,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg, + + ctx->file_data->cur_refs = &ref_node->refs; + spin_lock(&ctx->file_data->lock); +- list_add(&ref_node->node, &ctx->file_data->ref_list); ++ list_add_tail(&ref_node->node, &ctx->file_data->ref_list); + spin_unlock(&ctx->file_data->lock); + percpu_ref_get(&ctx->file_data->refs); + return ret; +@@ -7443,7 +7473,7 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx, + if (needs_switch) { + percpu_ref_kill(data->cur_refs); + spin_lock(&data->lock); +- list_add(&ref_node->node, &data->ref_list); ++ list_add_tail(&ref_node->node, &data->ref_list); + data->cur_refs = &ref_node->refs; + spin_unlock(&data->lock); + percpu_ref_get(&ctx->file_data->refs); +@@ -8877,14 +8907,16 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p, + * to a power-of-two, if it isn't already. We do NOT impose + * any cq vs sq ring sizing. + */ +- p->cq_entries = roundup_pow_of_two(p->cq_entries); +- if (p->cq_entries < p->sq_entries) ++ if (!p->cq_entries) + return -EINVAL; + if (p->cq_entries > IORING_MAX_CQ_ENTRIES) { + if (!(p->flags & IORING_SETUP_CLAMP)) + return -EINVAL; + p->cq_entries = IORING_MAX_CQ_ENTRIES; + } ++ p->cq_entries = roundup_pow_of_two(p->cq_entries); ++ if (p->cq_entries < p->sq_entries) ++ return -EINVAL; + } else { + p->cq_entries = 2 * p->sq_entries; + } +diff --git a/fs/proc/self.c b/fs/proc/self.c +index 72cd69bcaf4ad..cc71ce3466dc0 100644 +--- a/fs/proc/self.c ++++ b/fs/proc/self.c +@@ -16,6 +16,13 @@ static const char *proc_self_get_link(struct dentry *dentry, + pid_t tgid = task_tgid_nr_ns(current, ns); + char *name; + ++ /* ++ * Not currently supported. Once we can inherit all of struct pid, ++ * we can allow this. ++ */ ++ if (current->flags & PF_KTHREAD) ++ return ERR_PTR(-EOPNOTSUPP); ++ + if (!tgid) + return ERR_PTR(-ENOENT); + /* max length of unsigned int in decimal + NULL term */ +diff --git a/include/kunit/test.h b/include/kunit/test.h +index 59f3144f009a5..b68ba33c16937 100644 +--- a/include/kunit/test.h ++++ b/include/kunit/test.h +@@ -1064,7 +1064,7 @@ do { \ + KUNIT_ASSERTION(test, \ + strcmp(__left, __right) op 0, \ + kunit_binary_str_assert, \ +- KUNIT_INIT_BINARY_ASSERT_STRUCT(test, \ ++ KUNIT_INIT_BINARY_STR_ASSERT_STRUCT(test, \ + assert_type, \ + #op, \ + #left, \ +diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h +index 5968df82b9912..41a1bab98b7e1 100644 +--- a/include/linux/firmware/xlnx-zynqmp.h ++++ b/include/linux/firmware/xlnx-zynqmp.h +@@ -50,10 +50,6 @@ + #define ZYNQMP_PM_CAPABILITY_WAKEUP 0x4U + #define ZYNQMP_PM_CAPABILITY_UNUSABLE 0x8U + +-/* Feature check status */ +-#define PM_FEATURE_INVALID -1 +-#define PM_FEATURE_UNCHECKED 0 +- + /* + * Firmware FPGA Manager flags + * XILINX_ZYNQMP_PM_FPGA_FULL: FPGA full reconfiguration +diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h +index 0cb5fe3afd164..cd5aa875245b4 100644 +--- a/include/linux/pgtable.h ++++ b/include/linux/pgtable.h +@@ -1399,6 +1399,19 @@ typedef unsigned int pgtbl_mod_mask; + + #endif /* !__ASSEMBLY__ */ + ++#if !defined(MAX_POSSIBLE_PHYSMEM_BITS) && !defined(CONFIG_64BIT) ++#ifdef CONFIG_PHYS_ADDR_T_64BIT ++/* ++ * ZSMALLOC needs to know the highest PFN on 32-bit architectures ++ * with physical address space extension, but falls back to ++ * BITS_PER_LONG otherwise. ++ */ ++#error Missing MAX_POSSIBLE_PHYSMEM_BITS definition ++#else ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 ++#endif ++#endif ++ + #ifndef has_transparent_hugepage + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + #define has_transparent_hugepage() 1 +diff --git a/include/linux/platform_data/ti-sysc.h b/include/linux/platform_data/ti-sysc.h +index c59999ce044e5..240dce553a0bd 100644 +--- a/include/linux/platform_data/ti-sysc.h ++++ b/include/linux/platform_data/ti-sysc.h +@@ -50,6 +50,7 @@ struct sysc_regbits { + s8 emufree_shift; + }; + ++#define SYSC_MODULE_QUIRK_ENA_RESETDONE BIT(25) + #define SYSC_MODULE_QUIRK_PRUSS BIT(24) + #define SYSC_MODULE_QUIRK_DSS_RESET BIT(23) + #define SYSC_MODULE_QUIRK_RTC_UNLOCK BIT(22) +diff --git a/include/net/bonding.h b/include/net/bonding.h +index 7d132cc1e5848..d9d0ff3b0ad32 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -185,6 +185,11 @@ struct slave { + struct rtnl_link_stats64 slave_stats; + }; + ++static inline struct slave *to_slave(struct kobject *kobj) ++{ ++ return container_of(kobj, struct slave, kobj); ++} ++ + struct bond_up_slave { + unsigned int count; + struct rcu_head rcu; +@@ -750,6 +755,9 @@ extern struct bond_parm_tbl ad_select_tbl[]; + /* exported from bond_netlink.c */ + extern struct rtnl_link_ops bond_link_ops; + ++/* exported from bond_sysfs_slave.c */ ++extern const struct sysfs_ops slave_sysfs_ops; ++ + static inline netdev_tx_t bond_tx_drop(struct net_device *dev, struct sk_buff *skb) + { + atomic_long_inc(&dev->tx_dropped); +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index c25fb86ffae95..b3bbd10eb3f07 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -132,6 +132,9 @@ struct iscsi_task { + void *dd_data; /* driver/transport data */ + }; + ++/* invalid scsi_task pointer */ ++#define INVALID_SCSI_TASK (struct iscsi_task *)-1l ++ + static inline int iscsi_task_has_unsol_data(struct iscsi_task *task) + { + return task->unsol_r2t.data_length > task->unsol_r2t.sent; +diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h +index e7cbccc7c14cc..57d795365987d 100644 +--- a/include/trace/events/writeback.h ++++ b/include/trace/events/writeback.h +@@ -190,7 +190,7 @@ TRACE_EVENT(inode_foreign_history, + ), + + TP_fast_assign( +- strncpy(__entry->name, bdi_dev_name(inode_to_bdi(inode)), 32); ++ strscpy_pad(__entry->name, bdi_dev_name(inode_to_bdi(inode)), 32); + __entry->ino = inode->i_ino; + __entry->cgroup_ino = __trace_wbc_assign_cgroup(wbc); + __entry->history = history; +@@ -219,7 +219,7 @@ TRACE_EVENT(inode_switch_wbs, + ), + + TP_fast_assign( +- strncpy(__entry->name, bdi_dev_name(old_wb->bdi), 32); ++ strscpy_pad(__entry->name, bdi_dev_name(old_wb->bdi), 32); + __entry->ino = inode->i_ino; + __entry->old_cgroup_ino = __trace_wb_assign_cgroup(old_wb); + __entry->new_cgroup_ino = __trace_wb_assign_cgroup(new_wb); +@@ -252,7 +252,7 @@ TRACE_EVENT(track_foreign_dirty, + struct address_space *mapping = page_mapping(page); + struct inode *inode = mapping ? mapping->host : NULL; + +- strncpy(__entry->name, bdi_dev_name(wb->bdi), 32); ++ strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32); + __entry->bdi_id = wb->bdi->id; + __entry->ino = inode ? inode->i_ino : 0; + __entry->memcg_id = wb->memcg_css->id; +@@ -285,7 +285,7 @@ TRACE_EVENT(flush_foreign, + ), + + TP_fast_assign( +- strncpy(__entry->name, bdi_dev_name(wb->bdi), 32); ++ strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32); + __entry->cgroup_ino = __trace_wb_assign_cgroup(wb); + __entry->frn_bdi_id = frn_bdi_id; + __entry->frn_memcg_id = frn_memcg_id; +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 3eb35ad1b5241..04134a242f3d5 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -108,19 +108,21 @@ static inline void lockdep_lock(void) + { + DEBUG_LOCKS_WARN_ON(!irqs_disabled()); + ++ __this_cpu_inc(lockdep_recursion); + arch_spin_lock(&__lock); + __owner = current; +- __this_cpu_inc(lockdep_recursion); + } + + static inline void lockdep_unlock(void) + { ++ DEBUG_LOCKS_WARN_ON(!irqs_disabled()); ++ + if (debug_locks && DEBUG_LOCKS_WARN_ON(__owner != current)) + return; + +- __this_cpu_dec(lockdep_recursion); + __owner = NULL; + arch_spin_unlock(&__lock); ++ __this_cpu_dec(lockdep_recursion); + } + + static inline bool lockdep_assert_locked(void) +diff --git a/mm/filemap.c b/mm/filemap.c +index 6024d15998a43..abc1a1dcce97b 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -1464,11 +1464,19 @@ void end_page_writeback(struct page *page) + rotate_reclaimable_page(page); + } + ++ /* ++ * Writeback does not hold a page reference of its own, relying ++ * on truncation to wait for the clearing of PG_writeback. ++ * But here we must make sure that the page is not freed and ++ * reused before the wake_up_page(). ++ */ ++ get_page(page); + if (!test_clear_page_writeback(page)) + BUG(); + + smp_mb__after_atomic(); + wake_up_page(page, PG_writeback); ++ put_page(page); + } + EXPORT_SYMBOL(end_page_writeback); + +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index 4e4ddd67b71e5..a28dcf672e81a 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -2754,12 +2754,6 @@ int test_clear_page_writeback(struct page *page) + } else { + ret = TestClearPageWriteback(page); + } +- /* +- * NOTE: Page might be free now! Writeback doesn't hold a page +- * reference on its own, it relies on truncation to wait for +- * the clearing of PG_writeback. The below can only access +- * page state that is static across allocation cycles. +- */ + if (ret) { + dec_lruvec_state(lruvec, NR_WRITEBACK); + dec_zone_page_state(page, NR_ZONE_WRITE_PENDING); +diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c +index a67b2b0914478..c0ca5fbe5b081 100644 +--- a/net/batman-adv/log.c ++++ b/net/batman-adv/log.c +@@ -180,6 +180,7 @@ static const struct file_operations batadv_log_fops = { + .read = batadv_log_read, + .poll = batadv_log_poll, + .llseek = no_llseek, ++ .owner = THIS_MODULE, + }; + + /** +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 86a23e4a6a50f..b87140a1fa284 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -696,7 +696,7 @@ int fib_gw_from_via(struct fib_config *cfg, struct nlattr *nla, + cfg->fc_gw4 = *((__be32 *)via->rtvia_addr); + break; + case AF_INET6: +-#ifdef CONFIG_IPV6 ++#if IS_ENABLED(CONFIG_IPV6) + if (alen != sizeof(struct in6_addr)) { + NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_VIA"); + return -EINVAL; +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index aa898014ad12f..03c1a39c312a8 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -373,6 +373,7 @@ bool die_is_func_def(Dwarf_Die *dw_die) + int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) + { + Dwarf_Addr base, end; ++ Dwarf_Attribute attr; + + if (!addr) + return -EINVAL; +@@ -380,6 +381,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) + if (dwarf_entrypc(dw_die, addr) == 0) + return 0; + ++ /* ++ * Since the dwarf_ranges() will return 0 if there is no ++ * DW_AT_ranges attribute, we should check it first. ++ */ ++ if (!dwarf_attr(dw_die, DW_AT_ranges, &attr)) ++ return -ENOENT; ++ + return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; + } + +diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c +index 493ec372fdec4..f2709879bad96 100644 +--- a/tools/perf/util/stat-display.c ++++ b/tools/perf/util/stat-display.c +@@ -324,13 +324,10 @@ static int first_shadow_cpu(struct perf_stat_config *config, + struct evlist *evlist = evsel->evlist; + int i; + +- if (!config->aggr_get_id) +- return 0; +- + if (config->aggr_mode == AGGR_NONE) + return id; + +- if (config->aggr_mode == AGGR_GLOBAL) ++ if (!config->aggr_get_id) + return 0; + + for (i = 0; i < evsel__nr_cpus(evsel); i++) { +diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c +index 89b390623b63d..54ca751a2b3b3 100644 +--- a/tools/perf/util/synthetic-events.c ++++ b/tools/perf/util/synthetic-events.c +@@ -563,6 +563,9 @@ int perf_event__synthesize_cgroups(struct perf_tool *tool, + char cgrp_root[PATH_MAX]; + size_t mount_len; /* length of mount point in the path */ + ++ if (!tool || !tool->cgroup_events) ++ return 0; ++ + if (cgroupfs_find_mountpoint(cgrp_root, PATH_MAX, "perf_event") < 0) { + pr_debug("cannot find cgroup mount point\n"); + return -1; |