From b26efad04742a06c9f81f13bc604b153ec1c21bd Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Mon, 14 Aug 2023 09:00:20 +0200 Subject: [PATCH] Remove deprecated patches --- .../odroidxu4-5.4/patch-5.4.249-250.patch | 323 - .../odroidxu4-5.4/patch-5.4.250-251.patch | 12655 ---------------- .../odroidxu4-5.4/patch-5.4.251-252.patch | 2163 --- .../odroidxu4-5.4/patch-5.4.252-253.patch | 5694 ------- 4 files changed, 20835 deletions(-) delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.249-250.patch delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.250-251.patch delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.251-252.patch delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.252-253.patch diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.249-250.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.249-250.patch deleted file mode 100644 index 43c7db75c..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.249-250.patch +++ /dev/null @@ -1,323 +0,0 @@ -diff --git a/Makefile b/Makefile -index 26a05e73de78f..43d62b7b0a001 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 249 -+SUBLEVEL = 250 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h -index 509cc0262fdc2..394605e59f2bf 100644 ---- a/arch/x86/include/asm/microcode.h -+++ b/arch/x86/include/asm/microcode.h -@@ -5,6 +5,7 @@ - #include - #include - #include -+#include - - struct ucode_patch { - struct list_head plist; -diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h -index a645b25ee442a..403a8e76b310c 100644 ---- a/arch/x86/include/asm/microcode_amd.h -+++ b/arch/x86/include/asm/microcode_amd.h -@@ -48,11 +48,13 @@ extern void __init load_ucode_amd_bsp(unsigned int family); - extern void load_ucode_amd_ap(unsigned int family); - extern int __init save_microcode_in_initrd_amd(unsigned int family); - void reload_ucode_amd(unsigned int cpu); -+extern void amd_check_microcode(void); - #else - static inline void __init load_ucode_amd_bsp(unsigned int family) {} - static inline void load_ucode_amd_ap(unsigned int family) {} - static inline int __init - save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } - static inline void reload_ucode_amd(unsigned int cpu) {} -+static inline void amd_check_microcode(void) {} - #endif - #endif /* _ASM_X86_MICROCODE_AMD_H */ -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index 67d43645a2b6b..f3fa903c5b297 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -462,6 +462,7 @@ - #define MSR_AMD64_DE_CFG 0xc0011029 - #define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT 1 - #define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE BIT_ULL(MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT) -+#define MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT 9 - - #define MSR_AMD64_BU_CFG2 0xc001102a - #define MSR_AMD64_IBSFETCHCTL 0xc0011030 -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index b212771df0226..3f182c06b305c 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -26,11 +26,6 @@ - - #include "cpu.h" - --static const int amd_erratum_383[]; --static const int amd_erratum_400[]; --static const int amd_erratum_1054[]; --static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum); -- - /* - * nodes_per_socket: Stores the number of nodes per socket. - * Refer to Fam15h Models 00-0fh BKDG - CPUID Fn8000_001E_ECX -@@ -38,6 +33,78 @@ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum); - */ - static u32 nodes_per_socket = 1; - -+/* -+ * AMD errata checking -+ * -+ * Errata are defined as arrays of ints using the AMD_LEGACY_ERRATUM() or -+ * AMD_OSVW_ERRATUM() macros. The latter is intended for newer errata that -+ * have an OSVW id assigned, which it takes as first argument. Both take a -+ * variable number of family-specific model-stepping ranges created by -+ * AMD_MODEL_RANGE(). -+ * -+ * Example: -+ * -+ * const int amd_erratum_319[] = -+ * AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0x4, 0x2), -+ * AMD_MODEL_RANGE(0x10, 0x8, 0x0, 0x8, 0x0), -+ * AMD_MODEL_RANGE(0x10, 0x9, 0x0, 0x9, 0x0)); -+ */ -+ -+#define AMD_LEGACY_ERRATUM(...) { -1, __VA_ARGS__, 0 } -+#define AMD_OSVW_ERRATUM(osvw_id, ...) { osvw_id, __VA_ARGS__, 0 } -+#define AMD_MODEL_RANGE(f, m_start, s_start, m_end, s_end) \ -+ ((f << 24) | (m_start << 16) | (s_start << 12) | (m_end << 4) | (s_end)) -+#define AMD_MODEL_RANGE_FAMILY(range) (((range) >> 24) & 0xff) -+#define AMD_MODEL_RANGE_START(range) (((range) >> 12) & 0xfff) -+#define AMD_MODEL_RANGE_END(range) ((range) & 0xfff) -+ -+static const int amd_erratum_400[] = -+ AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf), -+ AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf)); -+ -+static const int amd_erratum_383[] = -+ AMD_OSVW_ERRATUM(3, AMD_MODEL_RANGE(0x10, 0, 0, 0xff, 0xf)); -+ -+/* #1054: Instructions Retired Performance Counter May Be Inaccurate */ -+static const int amd_erratum_1054[] = -+ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0, 0, 0x2f, 0xf)); -+ -+static const int amd_zenbleed[] = -+ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0x30, 0x0, 0x4f, 0xf), -+ AMD_MODEL_RANGE(0x17, 0x60, 0x0, 0x7f, 0xf), -+ AMD_MODEL_RANGE(0x17, 0xa0, 0x0, 0xaf, 0xf)); -+ -+static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum) -+{ -+ int osvw_id = *erratum++; -+ u32 range; -+ u32 ms; -+ -+ if (osvw_id >= 0 && osvw_id < 65536 && -+ cpu_has(cpu, X86_FEATURE_OSVW)) { -+ u64 osvw_len; -+ -+ rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, osvw_len); -+ if (osvw_id < osvw_len) { -+ u64 osvw_bits; -+ -+ rdmsrl(MSR_AMD64_OSVW_STATUS + (osvw_id >> 6), -+ osvw_bits); -+ return osvw_bits & (1ULL << (osvw_id & 0x3f)); -+ } -+ } -+ -+ /* OSVW unavailable or ID unknown, match family-model-stepping range */ -+ ms = (cpu->x86_model << 4) | cpu->x86_stepping; -+ while ((range = *erratum++)) -+ if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) && -+ (ms >= AMD_MODEL_RANGE_START(range)) && -+ (ms <= AMD_MODEL_RANGE_END(range))) -+ return true; -+ -+ return false; -+} -+ - static inline int rdmsrl_amd_safe(unsigned msr, unsigned long long *p) - { - u32 gprs[8] = { 0 }; -@@ -918,6 +985,47 @@ static void init_amd_zn(struct cpuinfo_x86 *c) - } - } - -+static bool cpu_has_zenbleed_microcode(void) -+{ -+ u32 good_rev = 0; -+ -+ switch (boot_cpu_data.x86_model) { -+ case 0x30 ... 0x3f: good_rev = 0x0830107a; break; -+ case 0x60 ... 0x67: good_rev = 0x0860010b; break; -+ case 0x68 ... 0x6f: good_rev = 0x08608105; break; -+ case 0x70 ... 0x7f: good_rev = 0x08701032; break; -+ case 0xa0 ... 0xaf: good_rev = 0x08a00008; break; -+ -+ default: -+ return false; -+ break; -+ } -+ -+ if (boot_cpu_data.microcode < good_rev) -+ return false; -+ -+ return true; -+} -+ -+static void zenbleed_check(struct cpuinfo_x86 *c) -+{ -+ if (!cpu_has_amd_erratum(c, amd_zenbleed)) -+ return; -+ -+ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) -+ return; -+ -+ if (!cpu_has(c, X86_FEATURE_AVX)) -+ return; -+ -+ if (!cpu_has_zenbleed_microcode()) { -+ pr_notice_once("Zenbleed: please update your microcode for the most optimal fix\n"); -+ msr_set_bit(MSR_AMD64_DE_CFG, MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT); -+ } else { -+ msr_clear_bit(MSR_AMD64_DE_CFG, MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT); -+ } -+} -+ - static void init_amd(struct cpuinfo_x86 *c) - { - early_init_amd(c); -@@ -1005,6 +1113,8 @@ static void init_amd(struct cpuinfo_x86 *c) - msr_set_bit(MSR_K7_HWCR, MSR_K7_HWCR_IRPERF_EN_BIT); - - check_null_seg_clears_base(c); -+ -+ zenbleed_check(c); - } - - #ifdef CONFIG_X86_32 -@@ -1100,73 +1210,6 @@ static const struct cpu_dev amd_cpu_dev = { - - cpu_dev_register(amd_cpu_dev); - --/* -- * AMD errata checking -- * -- * Errata are defined as arrays of ints using the AMD_LEGACY_ERRATUM() or -- * AMD_OSVW_ERRATUM() macros. The latter is intended for newer errata that -- * have an OSVW id assigned, which it takes as first argument. Both take a -- * variable number of family-specific model-stepping ranges created by -- * AMD_MODEL_RANGE(). -- * -- * Example: -- * -- * const int amd_erratum_319[] = -- * AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0x4, 0x2), -- * AMD_MODEL_RANGE(0x10, 0x8, 0x0, 0x8, 0x0), -- * AMD_MODEL_RANGE(0x10, 0x9, 0x0, 0x9, 0x0)); -- */ -- --#define AMD_LEGACY_ERRATUM(...) { -1, __VA_ARGS__, 0 } --#define AMD_OSVW_ERRATUM(osvw_id, ...) { osvw_id, __VA_ARGS__, 0 } --#define AMD_MODEL_RANGE(f, m_start, s_start, m_end, s_end) \ -- ((f << 24) | (m_start << 16) | (s_start << 12) | (m_end << 4) | (s_end)) --#define AMD_MODEL_RANGE_FAMILY(range) (((range) >> 24) & 0xff) --#define AMD_MODEL_RANGE_START(range) (((range) >> 12) & 0xfff) --#define AMD_MODEL_RANGE_END(range) ((range) & 0xfff) -- --static const int amd_erratum_400[] = -- AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf), -- AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf)); -- --static const int amd_erratum_383[] = -- AMD_OSVW_ERRATUM(3, AMD_MODEL_RANGE(0x10, 0, 0, 0xff, 0xf)); -- --/* #1054: Instructions Retired Performance Counter May Be Inaccurate */ --static const int amd_erratum_1054[] = -- AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0, 0, 0x2f, 0xf)); -- --static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum) --{ -- int osvw_id = *erratum++; -- u32 range; -- u32 ms; -- -- if (osvw_id >= 0 && osvw_id < 65536 && -- cpu_has(cpu, X86_FEATURE_OSVW)) { -- u64 osvw_len; -- -- rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, osvw_len); -- if (osvw_id < osvw_len) { -- u64 osvw_bits; -- -- rdmsrl(MSR_AMD64_OSVW_STATUS + (osvw_id >> 6), -- osvw_bits); -- return osvw_bits & (1ULL << (osvw_id & 0x3f)); -- } -- } -- -- /* OSVW unavailable or ID unknown, match family-model-stepping range */ -- ms = (cpu->x86_model << 4) | cpu->x86_stepping; -- while ((range = *erratum++)) -- if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) && -- (ms >= AMD_MODEL_RANGE_START(range)) && -- (ms <= AMD_MODEL_RANGE_END(range))) -- return true; -- -- return false; --} -- - void set_dr_addr_mask(unsigned long mask, int dr) - { - if (!boot_cpu_has(X86_FEATURE_BPEXT)) -@@ -1185,3 +1228,15 @@ void set_dr_addr_mask(unsigned long mask, int dr) - break; - } - } -+ -+static void zenbleed_check_cpu(void *unused) -+{ -+ struct cpuinfo_x86 *c = &cpu_data(smp_processor_id()); -+ -+ zenbleed_check(c); -+} -+ -+void amd_check_microcode(void) -+{ -+ on_each_cpu(zenbleed_check_cpu, NULL, 1); -+} -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index 5e1e32f1086ba..c8ccf5bfd5341 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -2125,6 +2125,8 @@ void microcode_check(void) - - perf_check_microcode(); - -+ amd_check_microcode(); -+ - /* Reload CPUID max function as it might've changed. */ - info.cpuid_level = cpuid_eax(0); - -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index 7fff0afa52466..2852c99196fa7 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -700,7 +700,7 @@ static enum ucode_state apply_microcode_amd(int cpu) - rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy); - - /* need to apply patch? */ -- if (rev >= mc_amd->hdr.patch_id) { -+ if (rev > mc_amd->hdr.patch_id) { - ret = UCODE_OK; - goto out; - } diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.250-251.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.250-251.patch deleted file mode 100644 index d038023a2..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.250-251.patch +++ /dev/null @@ -1,12655 +0,0 @@ -diff --git a/Documentation/filesystems/directory-locking.rst b/Documentation/filesystems/directory-locking.rst -index de12016ee4198..e59fc830c9af4 100644 ---- a/Documentation/filesystems/directory-locking.rst -+++ b/Documentation/filesystems/directory-locking.rst -@@ -22,12 +22,11 @@ exclusive. - 3) object removal. Locking rules: caller locks parent, finds victim, - locks victim and calls the method. Locks are exclusive. - --4) rename() that is _not_ cross-directory. Locking rules: caller locks --the parent and finds source and target. In case of exchange (with --RENAME_EXCHANGE in flags argument) lock both. In any case, --if the target already exists, lock it. If the source is a non-directory, --lock it. If we need to lock both, lock them in inode pointer order. --Then call the method. All locks are exclusive. -+4) rename() that is _not_ cross-directory. Locking rules: caller locks the -+parent and finds source and target. We lock both (provided they exist). If we -+need to lock two inodes of different type (dir vs non-dir), we lock directory -+first. If we need to lock two inodes of the same type, lock them in inode -+pointer order. Then call the method. All locks are exclusive. - NB: we might get away with locking the the source (and target in exchange - case) shared. - -@@ -44,15 +43,17 @@ All locks are exclusive. - rules: - - * lock the filesystem -- * lock parents in "ancestors first" order. -+ * lock parents in "ancestors first" order. If one is not ancestor of -+ the other, lock them in inode pointer order. - * find source and target. - * if old parent is equal to or is a descendent of target - fail with -ENOTEMPTY - * if new parent is equal to or is a descendent of source - fail with -ELOOP -- * If it's an exchange, lock both the source and the target. -- * If the target exists, lock it. If the source is a non-directory, -- lock it. If we need to lock both, do so in inode pointer order. -+ * Lock both the source and the target provided they exist. If we -+ need to lock two inodes of different type (dir vs non-dir), we lock -+ the directory first. If we need to lock two inodes of the same type, -+ lock them in inode pointer order. - * call the method. - - All ->i_rwsem are taken exclusive. Again, we might get away with locking -@@ -66,8 +67,9 @@ If no directory is its own ancestor, the scheme above is deadlock-free. - - Proof: - -- First of all, at any moment we have a partial ordering of the -- objects - A < B iff A is an ancestor of B. -+ First of all, at any moment we have a linear ordering of the -+ objects - A < B iff (A is an ancestor of B) or (B is not an ancestor -+ of A and ptr(A) < ptr(B)). - - That ordering can change. However, the following is true: - -diff --git a/Documentation/networking/af_xdp.rst b/Documentation/networking/af_xdp.rst -index 83f7ae5fc045e..09b3943b3b719 100644 ---- a/Documentation/networking/af_xdp.rst -+++ b/Documentation/networking/af_xdp.rst -@@ -40,13 +40,13 @@ allocates memory for this UMEM using whatever means it feels is most - appropriate (malloc, mmap, huge pages, etc). This memory area is then - registered with the kernel using the new setsockopt XDP_UMEM_REG. The - UMEM also has two rings: the FILL ring and the COMPLETION ring. The --fill ring is used by the application to send down addr for the kernel -+FILL ring is used by the application to send down addr for the kernel - to fill in with RX packet data. References to these frames will then - appear in the RX ring once each packet has been received. The --completion ring, on the other hand, contains frame addr that the -+COMPLETION ring, on the other hand, contains frame addr that the - kernel has transmitted completely and can now be used again by user - space, for either TX or RX. Thus, the frame addrs appearing in the --completion ring are addrs that were previously transmitted using the -+COMPLETION ring are addrs that were previously transmitted using the - TX ring. In summary, the RX and FILL rings are used for the RX path - and the TX and COMPLETION rings are used for the TX path. - -@@ -91,11 +91,16 @@ Concepts - ======== - - In order to use an AF_XDP socket, a number of associated objects need --to be setup. -+to be setup. These objects and their options are explained in the -+following sections. - --Jonathan Corbet has also written an excellent article on LWN, --"Accelerating networking with AF_XDP". It can be found at --https://lwn.net/Articles/750845/. -+For an overview on how AF_XDP works, you can also take a look at the -+Linux Plumbers paper from 2018 on the subject: -+http://vger.kernel.org/lpc_net2018_talks/lpc18_paper_af_xdp_perf-v2.pdf. Do -+NOT consult the paper from 2017 on "AF_PACKET v4", the first attempt -+at AF_XDP. Nearly everything changed since then. Jonathan Corbet has -+also written an excellent article on LWN, "Accelerating networking -+with AF_XDP". It can be found at https://lwn.net/Articles/750845/. - - UMEM - ---- -@@ -113,22 +118,22 @@ the next socket B can do this by setting the XDP_SHARED_UMEM flag in - struct sockaddr_xdp member sxdp_flags, and passing the file descriptor - of A to struct sockaddr_xdp member sxdp_shared_umem_fd. - --The UMEM has two single-producer/single-consumer rings, that are used -+The UMEM has two single-producer/single-consumer rings that are used - to transfer ownership of UMEM frames between the kernel and the - user-space application. - - Rings - ----- - --There are a four different kind of rings: Fill, Completion, RX and -+There are a four different kind of rings: FILL, COMPLETION, RX and - TX. All rings are single-producer/single-consumer, so the user-space - application need explicit synchronization of multiple - processes/threads are reading/writing to them. - --The UMEM uses two rings: Fill and Completion. Each socket associated -+The UMEM uses two rings: FILL and COMPLETION. Each socket associated - with the UMEM must have an RX queue, TX queue or both. Say, that there - is a setup with four sockets (all doing TX and RX). Then there will be --one Fill ring, one Completion ring, four TX rings and four RX rings. -+one FILL ring, one COMPLETION ring, four TX rings and four RX rings. - - The rings are head(producer)/tail(consumer) based rings. A producer - writes the data ring at the index pointed out by struct xdp_ring -@@ -146,7 +151,7 @@ The size of the rings need to be of size power of two. - UMEM Fill Ring - ~~~~~~~~~~~~~~ - --The Fill ring is used to transfer ownership of UMEM frames from -+The FILL ring is used to transfer ownership of UMEM frames from - user-space to kernel-space. The UMEM addrs are passed in the ring. As - an example, if the UMEM is 64k and each chunk is 4k, then the UMEM has - 16 chunks and can pass addrs between 0 and 64k. -@@ -164,8 +169,8 @@ chunks mode, then the incoming addr will be left untouched. - UMEM Completion Ring - ~~~~~~~~~~~~~~~~~~~~ - --The Completion Ring is used transfer ownership of UMEM frames from --kernel-space to user-space. Just like the Fill ring, UMEM indicies are -+The COMPLETION Ring is used transfer ownership of UMEM frames from -+kernel-space to user-space. Just like the FILL ring, UMEM indices are - used. - - Frames passed from the kernel to user-space are frames that has been -@@ -181,7 +186,7 @@ The RX ring is the receiving side of a socket. Each entry in the ring - is a struct xdp_desc descriptor. The descriptor contains UMEM offset - (addr) and the length of the data (len). - --If no frames have been passed to kernel via the Fill ring, no -+If no frames have been passed to kernel via the FILL ring, no - descriptors will (or can) appear on the RX ring. - - The user application consumes struct xdp_desc descriptors from this -@@ -199,8 +204,24 @@ be relaxed in the future. - The user application produces struct xdp_desc descriptors to this - ring. - -+Libbpf -+====== -+ -+Libbpf is a helper library for eBPF and XDP that makes using these -+technologies a lot simpler. It also contains specific helper functions -+in tools/lib/bpf/xsk.h for facilitating the use of AF_XDP. It -+contains two types of functions: those that can be used to make the -+setup of AF_XDP socket easier and ones that can be used in the data -+plane to access the rings safely and quickly. To see an example on how -+to use this API, please take a look at the sample application in -+samples/bpf/xdpsock_usr.c which uses libbpf for both setup and data -+plane operations. -+ -+We recommend that you use this library unless you have become a power -+user. It will make your program a lot simpler. -+ - XSKMAP / BPF_MAP_TYPE_XSKMAP ------------------------------ -+============================ - - On XDP side there is a BPF map type BPF_MAP_TYPE_XSKMAP (XSKMAP) that - is used in conjunction with bpf_redirect_map() to pass the ingress -@@ -216,21 +237,193 @@ queue 17. Only the XDP program executing for eth0 and queue 17 will - successfully pass data to the socket. Please refer to the sample - application (samples/bpf/) in for an example. - -+Configuration Flags and Socket Options -+====================================== -+ -+These are the various configuration flags that can be used to control -+and monitor the behavior of AF_XDP sockets. -+ -+XDP_COPY and XDP_ZERO_COPY bind flags -+------------------------------------- -+ -+When you bind to a socket, the kernel will first try to use zero-copy -+copy. If zero-copy is not supported, it will fall back on using copy -+mode, i.e. copying all packets out to user space. But if you would -+like to force a certain mode, you can use the following flags. If you -+pass the XDP_COPY flag to the bind call, the kernel will force the -+socket into copy mode. If it cannot use copy mode, the bind call will -+fail with an error. Conversely, the XDP_ZERO_COPY flag will force the -+socket into zero-copy mode or fail. -+ -+XDP_SHARED_UMEM bind flag -+------------------------- -+ -+This flag enables you to bind multiple sockets to the same UMEM, but -+only if they share the same queue id. In this mode, each socket has -+their own RX and TX rings, but the UMEM (tied to the fist socket -+created) only has a single FILL ring and a single COMPLETION -+ring. To use this mode, create the first socket and bind it in the normal -+way. Create a second socket and create an RX and a TX ring, or at -+least one of them, but no FILL or COMPLETION rings as the ones from -+the first socket will be used. In the bind call, set he -+XDP_SHARED_UMEM option and provide the initial socket's fd in the -+sxdp_shared_umem_fd field. You can attach an arbitrary number of extra -+sockets this way. -+ -+What socket will then a packet arrive on? This is decided by the XDP -+program. Put all the sockets in the XSK_MAP and just indicate which -+index in the array you would like to send each packet to. A simple -+round-robin example of distributing packets is shown below: -+ -+.. code-block:: c -+ -+ #include -+ #include "bpf_helpers.h" -+ -+ #define MAX_SOCKS 16 -+ -+ struct { -+ __uint(type, BPF_MAP_TYPE_XSKMAP); -+ __uint(max_entries, MAX_SOCKS); -+ __uint(key_size, sizeof(int)); -+ __uint(value_size, sizeof(int)); -+ } xsks_map SEC(".maps"); -+ -+ static unsigned int rr; -+ -+ SEC("xdp_sock") int xdp_sock_prog(struct xdp_md *ctx) -+ { -+ rr = (rr + 1) & (MAX_SOCKS - 1); -+ -+ return bpf_redirect_map(&xsks_map, rr, 0); -+ } -+ -+Note, that since there is only a single set of FILL and COMPLETION -+rings, and they are single producer, single consumer rings, you need -+to make sure that multiple processes or threads do not use these rings -+concurrently. There are no synchronization primitives in the -+libbpf code that protects multiple users at this point in time. -+ -+XDP_USE_NEED_WAKEUP bind flag -+----------------------------- -+ -+This option adds support for a new flag called need_wakeup that is -+present in the FILL ring and the TX ring, the rings for which user -+space is a producer. When this option is set in the bind call, the -+need_wakeup flag will be set if the kernel needs to be explicitly -+woken up by a syscall to continue processing packets. If the flag is -+zero, no syscall is needed. -+ -+If the flag is set on the FILL ring, the application needs to call -+poll() to be able to continue to receive packets on the RX ring. This -+can happen, for example, when the kernel has detected that there are no -+more buffers on the FILL ring and no buffers left on the RX HW ring of -+the NIC. In this case, interrupts are turned off as the NIC cannot -+receive any packets (as there are no buffers to put them in), and the -+need_wakeup flag is set so that user space can put buffers on the -+FILL ring and then call poll() so that the kernel driver can put these -+buffers on the HW ring and start to receive packets. -+ -+If the flag is set for the TX ring, it means that the application -+needs to explicitly notify the kernel to send any packets put on the -+TX ring. This can be accomplished either by a poll() call, as in the -+RX path, or by calling sendto(). -+ -+An example of how to use this flag can be found in -+samples/bpf/xdpsock_user.c. An example with the use of libbpf helpers -+would look like this for the TX path: -+ -+.. code-block:: c -+ -+ if (xsk_ring_prod__needs_wakeup(&my_tx_ring)) -+ sendto(xsk_socket__fd(xsk_handle), NULL, 0, MSG_DONTWAIT, NULL, 0); -+ -+I.e., only use the syscall if the flag is set. -+ -+We recommend that you always enable this mode as it usually leads to -+better performance especially if you run the application and the -+driver on the same core, but also if you use different cores for the -+application and the kernel driver, as it reduces the number of -+syscalls needed for the TX path. -+ -+XDP_{RX|TX|UMEM_FILL|UMEM_COMPLETION}_RING setsockopts -+------------------------------------------------------ -+ -+These setsockopts sets the number of descriptors that the RX, TX, -+FILL, and COMPLETION rings respectively should have. It is mandatory -+to set the size of at least one of the RX and TX rings. If you set -+both, you will be able to both receive and send traffic from your -+application, but if you only want to do one of them, you can save -+resources by only setting up one of them. Both the FILL ring and the -+COMPLETION ring are mandatory if you have a UMEM tied to your socket, -+which is the normal case. But if the XDP_SHARED_UMEM flag is used, any -+socket after the first one does not have a UMEM and should in that -+case not have any FILL or COMPLETION rings created. -+ -+XDP_UMEM_REG setsockopt -+----------------------- -+ -+This setsockopt registers a UMEM to a socket. This is the area that -+contain all the buffers that packet can recide in. The call takes a -+pointer to the beginning of this area and the size of it. Moreover, it -+also has parameter called chunk_size that is the size that the UMEM is -+divided into. It can only be 2K or 4K at the moment. If you have an -+UMEM area that is 128K and a chunk size of 2K, this means that you -+will be able to hold a maximum of 128K / 2K = 64 packets in your UMEM -+area and that your largest packet size can be 2K. -+ -+There is also an option to set the headroom of each single buffer in -+the UMEM. If you set this to N bytes, it means that the packet will -+start N bytes into the buffer leaving the first N bytes for the -+application to use. The final option is the flags field, but it will -+be dealt with in separate sections for each UMEM flag. -+ -+SO_BINDTODEVICE setsockopt -+-------------------------- -+ -+This is a generic SOL_SOCKET option that can be used to tie AF_XDP -+socket to a particular network interface. It is useful when a socket -+is created by a privileged process and passed to a non-privileged one. -+Once the option is set, kernel will refuse attempts to bind that socket -+to a different interface. Updating the value requires CAP_NET_RAW. -+ -+XDP_STATISTICS getsockopt -+------------------------- -+ -+Gets drop statistics of a socket that can be useful for debug -+purposes. The supported statistics are shown below: -+ -+.. code-block:: c -+ -+ struct xdp_statistics { -+ __u64 rx_dropped; /* Dropped for reasons other than invalid desc */ -+ __u64 rx_invalid_descs; /* Dropped due to invalid descriptor */ -+ __u64 tx_invalid_descs; /* Dropped due to invalid descriptor */ -+ }; -+ -+XDP_OPTIONS getsockopt -+---------------------- -+ -+Gets options from an XDP socket. The only one supported so far is -+XDP_OPTIONS_ZEROCOPY which tells you if zero-copy is on or not. -+ - Usage - ===== - --In order to use AF_XDP sockets there are two parts needed. The -+In order to use AF_XDP sockets two parts are needed. The - user-space application and the XDP program. For a complete setup and - usage example, please refer to the sample application. The user-space - side is xdpsock_user.c and the XDP side is part of libbpf. - --The XDP code sample included in tools/lib/bpf/xsk.c is the following:: -+The XDP code sample included in tools/lib/bpf/xsk.c is the following: -+ -+.. code-block:: c - - SEC("xdp_sock") int xdp_sock_prog(struct xdp_md *ctx) - { - int index = ctx->rx_queue_index; - -- // A set entry here means that the correspnding queue_id -+ // A set entry here means that the corresponding queue_id - // has an active AF_XDP socket bound to it. - if (bpf_map_lookup_elem(&xsks_map, &index)) - return bpf_redirect_map(&xsks_map, index, 0); -@@ -238,7 +431,10 @@ The XDP code sample included in tools/lib/bpf/xsk.c is the following:: - return XDP_PASS; - } - --Naive ring dequeue and enqueue could look like this:: -+A simple but not so performance ring dequeue and enqueue could look -+like this: -+ -+.. code-block:: c - - // struct xdp_rxtx_ring { - // __u32 *producer; -@@ -287,17 +483,16 @@ Naive ring dequeue and enqueue could look like this:: - return 0; - } - -- --For a more optimized version, please refer to the sample application. -+But please use the libbpf functions as they are optimized and ready to -+use. Will make your life easier. - - Sample application - ================== - - There is a xdpsock benchmarking/test application included that --demonstrates how to use AF_XDP sockets with both private and shared --UMEMs. Say that you would like your UDP traffic from port 4242 to end --up in queue 16, that we will enable AF_XDP on. Here, we use ethtool --for this:: -+demonstrates how to use AF_XDP sockets with private UMEMs. Say that -+you would like your UDP traffic from port 4242 to end up in queue 16, -+that we will enable AF_XDP on. Here, we use ethtool for this:: - - ethtool -N p3p2 rx-flow-hash udp4 fn - ethtool -N p3p2 flow-type udp4 src-port 4242 dst-port 4242 \ -@@ -311,13 +506,18 @@ using:: - For XDP_SKB mode, use the switch "-S" instead of "-N" and all options - can be displayed with "-h", as usual. - -+This sample application uses libbpf to make the setup and usage of -+AF_XDP simpler. If you want to know how the raw uapi of AF_XDP is -+really used to make something more advanced, take a look at the libbpf -+code in tools/lib/bpf/xsk.[ch]. -+ - FAQ - ======= - - Q: I am not seeing any traffic on the socket. What am I doing wrong? - - A: When a netdev of a physical NIC is initialized, Linux usually -- allocates one Rx and Tx queue pair per core. So on a 8 core system, -+ allocates one RX and TX queue pair per core. So on a 8 core system, - queue ids 0 to 7 will be allocated, one per core. In the AF_XDP - bind call or the xsk_socket__create libbpf function call, you - specify a specific queue id to bind to and it is only the traffic -@@ -343,9 +543,21 @@ A: When a netdev of a physical NIC is initialized, Linux usually - sudo ethtool -N flow-type udp4 src-port 4242 dst-port \ - 4242 action 2 - -- A number of other ways are possible all up to the capabilitites of -+ A number of other ways are possible all up to the capabilities of - the NIC you have. - -+Q: Can I use the XSKMAP to implement a switch betwen different umems -+ in copy mode? -+ -+A: The short answer is no, that is not supported at the moment. The -+ XSKMAP can only be used to switch traffic coming in on queue id X -+ to sockets bound to the same queue id X. The XSKMAP can contain -+ sockets bound to different queue ids, for example X and Y, but only -+ traffic goming in from queue id Y can be directed to sockets bound -+ to the same queue id Y. In zero-copy mode, you should use the -+ switch, or other distribution mechanism, in your NIC to direct -+ traffic to the correct queue id and socket. -+ - Credits - ======= - -diff --git a/Makefile b/Makefile -index 43d62b7b0a001..0b17d6936c2f9 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 250 -+SUBLEVEL = 251 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h -index fe19f1d412e71..284fd513d7c67 100644 ---- a/arch/arc/include/asm/linkage.h -+++ b/arch/arc/include/asm/linkage.h -@@ -8,6 +8,10 @@ - - #include - -+#define ASM_NL ` /* use '`' to mark new line in macro */ -+#define __ALIGN .align 4 -+#define __ALIGN_STR __stringify(__ALIGN) -+ - #ifdef __ASSEMBLY__ - - .macro ST2 e, o, off -@@ -28,10 +32,6 @@ - #endif - .endm - --#define ASM_NL ` /* use '`' to mark new line in macro */ --#define __ALIGN .align 4 --#define __ALIGN_STR __stringify(__ALIGN) -- - /* annotation for data we want in DCCM - if enabled in .config */ - .macro ARCFP_DATA nm - #ifdef CONFIG_ARC_HAS_DCCM -diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi -index 05d67f9769118..bf8154aa203a7 100644 ---- a/arch/arm/boot/dts/bcm5301x.dtsi -+++ b/arch/arm/boot/dts/bcm5301x.dtsi -@@ -511,7 +511,6 @@ - "spi_lr_session_done", - "spi_lr_overread"; - clocks = <&iprocmed>; -- clock-names = "iprocmed"; - num-cs = <2>; - #address-cells = <1>; - #size-cells = <0>; -diff --git a/arch/arm/boot/dts/omap3-gta04a5one.dts b/arch/arm/boot/dts/omap3-gta04a5one.dts -index 9db9fe67cd63b..95df45cc70c09 100644 ---- a/arch/arm/boot/dts/omap3-gta04a5one.dts -+++ b/arch/arm/boot/dts/omap3-gta04a5one.dts -@@ -5,9 +5,11 @@ - - #include "omap3-gta04a5.dts" - --&omap3_pmx_core { -+/ { - model = "Goldelico GTA04A5/Letux 2804 with OneNAND"; -+}; - -+&omap3_pmx_core { - gpmc_pins: pinmux_gpmc_pins { - pinctrl-single,pins = < - -diff --git a/arch/arm/mach-ep93xx/timer-ep93xx.c b/arch/arm/mach-ep93xx/timer-ep93xx.c -index de998830f534f..b07956883e165 100644 ---- a/arch/arm/mach-ep93xx/timer-ep93xx.c -+++ b/arch/arm/mach-ep93xx/timer-ep93xx.c -@@ -9,6 +9,7 @@ - #include - #include - #include "soc.h" -+#include "platform.h" - - /************************************************************************* - * Timer handling for EP93xx -@@ -60,7 +61,7 @@ static u64 notrace ep93xx_read_sched_clock(void) - return ret; - } - --u64 ep93xx_clocksource_read(struct clocksource *c) -+static u64 ep93xx_clocksource_read(struct clocksource *c) - { - u64 ret; - -diff --git a/arch/arm/mach-orion5x/board-dt.c b/arch/arm/mach-orion5x/board-dt.c -index 3d36f1d951964..3f651df3a71cf 100644 ---- a/arch/arm/mach-orion5x/board-dt.c -+++ b/arch/arm/mach-orion5x/board-dt.c -@@ -63,6 +63,9 @@ static void __init orion5x_dt_init(void) - if (of_machine_is_compatible("maxtor,shared-storage-2")) - mss2_init(); - -+ if (of_machine_is_compatible("lacie,d2-network")) -+ d2net_init(); -+ - of_platform_default_populate(NULL, orion5x_auxdata_lookup, NULL); - } - -diff --git a/arch/arm/mach-orion5x/common.h b/arch/arm/mach-orion5x/common.h -index eb96009e21c4c..b9cfdb4564568 100644 ---- a/arch/arm/mach-orion5x/common.h -+++ b/arch/arm/mach-orion5x/common.h -@@ -75,6 +75,12 @@ extern void mss2_init(void); - static inline void mss2_init(void) {} - #endif - -+#ifdef CONFIG_MACH_D2NET_DT -+void d2net_init(void); -+#else -+static inline void d2net_init(void) {} -+#endif -+ - /***************************************************************************** - * Helpers to access Orion registers - ****************************************************************************/ -diff --git a/arch/arm/probes/kprobes/checkers-common.c b/arch/arm/probes/kprobes/checkers-common.c -index 4d720990cf2a3..eba7ac4725c02 100644 ---- a/arch/arm/probes/kprobes/checkers-common.c -+++ b/arch/arm/probes/kprobes/checkers-common.c -@@ -40,7 +40,7 @@ enum probes_insn checker_stack_use_imm_0xx(probes_opcode_t insn, - * Different from other insn uses imm8, the real addressing offset of - * STRD in T32 encoding should be imm8 * 4. See ARMARM description. - */ --enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn, -+static enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn, - struct arch_probes_insn *asi, - const struct decode_header *h) - { -diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c -index 0a783bd4641c5..44b5f7dbcc00f 100644 ---- a/arch/arm/probes/kprobes/core.c -+++ b/arch/arm/probes/kprobes/core.c -@@ -231,7 +231,7 @@ singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb) - * kprobe, and that level is reserved for user kprobe handlers, so we can't - * risk encountering a new kprobe in an interrupt handler. - */ --void __kprobes kprobe_handler(struct pt_regs *regs) -+static void __kprobes kprobe_handler(struct pt_regs *regs) - { - struct kprobe *p, *cur; - struct kprobe_ctlblk *kcb; -diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c -index c78180172120f..e20304f1d8bc9 100644 ---- a/arch/arm/probes/kprobes/opt-arm.c -+++ b/arch/arm/probes/kprobes/opt-arm.c -@@ -145,8 +145,6 @@ __arch_remove_optimized_kprobe(struct optimized_kprobe *op, int dirty) - } - } - --extern void kprobe_handler(struct pt_regs *regs); -- - static void - optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs) - { -diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c -index c562832b86272..171c7076b89f4 100644 ---- a/arch/arm/probes/kprobes/test-core.c -+++ b/arch/arm/probes/kprobes/test-core.c -@@ -720,7 +720,7 @@ static const char coverage_register_lookup[16] = { - [REG_TYPE_NOSPPCX] = COVERAGE_ANY_REG | COVERAGE_SP, - }; - --unsigned coverage_start_registers(const struct decode_header *h) -+static unsigned coverage_start_registers(const struct decode_header *h) - { - unsigned regs = 0; - int i; -diff --git a/arch/arm/probes/kprobes/test-core.h b/arch/arm/probes/kprobes/test-core.h -index 19a5b2add41e1..805116c2ec27c 100644 ---- a/arch/arm/probes/kprobes/test-core.h -+++ b/arch/arm/probes/kprobes/test-core.h -@@ -453,3 +453,7 @@ void kprobe_thumb32_test_cases(void); - #else - void kprobe_arm_test_cases(void); - #endif -+ -+void __kprobes_test_case_start(void); -+void __kprobes_test_case_end_16(void); -+void __kprobes_test_case_end_32(void); -diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi -index 301c1c467c0b7..bf40500adef73 100644 ---- a/arch/arm64/boot/dts/qcom/msm8916.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi -@@ -1451,7 +1451,7 @@ - }; - }; - -- camss: camss@1b00000 { -+ camss: camss@1b0ac00 { - compatible = "qcom,msm8916-camss"; - reg = <0x1b0ac00 0x200>, - <0x1b00030 0x4>, -diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi -index 202177706cdeb..df00acb35263d 100644 ---- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi -+++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi -@@ -269,7 +269,7 @@ - }; - - scif1_pins: scif1 { -- groups = "scif1_data_b", "scif1_ctrl"; -+ groups = "scif1_data_b"; - function = "scif1"; - }; - -@@ -329,7 +329,6 @@ - &scif1 { - pinctrl-0 = <&scif1_pins>; - pinctrl-names = "default"; -- uart-has-rtscts; - - status = "okay"; - }; -diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c -index 5cf575f23af28..8e934bb44f12e 100644 ---- a/arch/arm64/mm/mmu.c -+++ b/arch/arm64/mm/mmu.c -@@ -399,7 +399,7 @@ static phys_addr_t pgd_pgtable_alloc(int shift) - static void __init create_mapping_noalloc(phys_addr_t phys, unsigned long virt, - phys_addr_t size, pgprot_t prot) - { -- if ((virt >= PAGE_END) && (virt < VMALLOC_START)) { -+ if (virt < PAGE_OFFSET) { - pr_warn("BUG: not creating mapping for %pa at 0x%016lx - outside kernel range\n", - &phys, virt); - return; -@@ -426,7 +426,7 @@ void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys, - static void update_mapping_prot(phys_addr_t phys, unsigned long virt, - phys_addr_t size, pgprot_t prot) - { -- if ((virt >= PAGE_END) && (virt < VMALLOC_START)) { -+ if (virt < PAGE_OFFSET) { - pr_warn("BUG: not updating mapping for %pa at 0x%016lx - outside kernel range\n", - &phys, virt); - return; -diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug -index 2ca9114fcf002..0c8436b06c494 100644 ---- a/arch/powerpc/Kconfig.debug -+++ b/arch/powerpc/Kconfig.debug -@@ -234,7 +234,7 @@ config PPC_EARLY_DEBUG_40x - - config PPC_EARLY_DEBUG_CPM - bool "Early serial debugging for Freescale CPM-based serial ports" -- depends on SERIAL_CPM -+ depends on SERIAL_CPM=y - help - Select this to enable early debugging for Freescale chips - using a CPM-based serial port. This assumes that the bootwrapper -diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile -index 6c32ea6dc7558..77649f4cc9453 100644 ---- a/arch/powerpc/Makefile -+++ b/arch/powerpc/Makefile -@@ -425,3 +425,11 @@ checkbin: - echo -n '*** Please use a different binutils version.' ; \ - false ; \ - fi -+ @if test "x${CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT}" = "xy" -a \ -+ "x${CONFIG_LD_IS_BFD}" = "xy" -a \ -+ "${CONFIG_LD_VERSION}" = "23700" ; then \ -+ echo -n '*** binutils 2.37 drops unused section symbols, which recordmcount ' ; \ -+ echo 'is unable to handle.' ; \ -+ echo '*** Please use a different binutils version.' ; \ -+ false ; \ -+ fi -diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c -index 210f1c28b8e41..e4fb5ab41e2d3 100644 ---- a/arch/powerpc/mm/init_64.c -+++ b/arch/powerpc/mm/init_64.c -@@ -178,7 +178,7 @@ static bool altmap_cross_boundary(struct vmem_altmap *altmap, unsigned long star - unsigned long nr_pfn = page_size / sizeof(struct page); - unsigned long start_pfn = page_to_pfn((struct page *)start); - -- if ((start_pfn + nr_pfn) > altmap->end_pfn) -+ if ((start_pfn + nr_pfn - 1) > altmap->end_pfn) - return true; - - if (start_pfn < altmap->base_pfn) -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index 9ade970b4232c..b11eb11e2f499 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -1982,6 +1982,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots, - ms = slots->memslots + slotidx; - ofs = 0; - } -+ -+ if (cur_gfn < ms->base_gfn) -+ ofs = 0; -+ - ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs); - while ((slotidx > 0) && (ofs >= ms->npages)) { - slotidx--; -diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c -index 2021946176de8..596b2a2cd837d 100644 ---- a/arch/s390/kvm/vsie.c -+++ b/arch/s390/kvm/vsie.c -@@ -168,7 +168,8 @@ static int setup_apcb00(struct kvm_vcpu *vcpu, unsigned long *apcb_s, - sizeof(struct kvm_s390_apcb0))) - return -EFAULT; - -- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb0)); -+ bitmap_and(apcb_s, apcb_s, apcb_h, -+ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb0)); - - return 0; - } -@@ -190,7 +191,8 @@ static int setup_apcb11(struct kvm_vcpu *vcpu, unsigned long *apcb_s, - sizeof(struct kvm_s390_apcb1))) - return -EFAULT; - -- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb1)); -+ bitmap_and(apcb_s, apcb_s, apcb_h, -+ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb1)); - - return 0; - } -diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c -index 96c626c2cd0a4..306fba1564e5e 100644 ---- a/arch/sh/drivers/dma/dma-sh.c -+++ b/arch/sh/drivers/dma/dma-sh.c -@@ -18,6 +18,18 @@ - #include - #include - -+/* -+ * Some of the SoCs feature two DMAC modules. In such a case, the channels are -+ * distributed equally among them. -+ */ -+#ifdef SH_DMAC_BASE1 -+#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2) -+#else -+#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS -+#endif -+ -+#define SH_DMAC_CH_SZ 0x10 -+ - /* - * Define the default configuration for dual address memory-memory transfer. - * The 0x400 value represents auto-request, external->external. -@@ -29,7 +41,7 @@ static unsigned long dma_find_base(unsigned int chan) - unsigned long base = SH_DMAC_BASE0; - - #ifdef SH_DMAC_BASE1 -- if (chan >= 6) -+ if (chan >= SH_DMAC_NR_MD_CH) - base = SH_DMAC_BASE1; - #endif - -@@ -40,13 +52,13 @@ static unsigned long dma_base_addr(unsigned int chan) - { - unsigned long base = dma_find_base(chan); - -- /* Normalize offset calculation */ -- if (chan >= 9) -- chan -= 6; -- if (chan >= 4) -- base += 0x10; -+ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ; -+ -+ /* DMAOR is placed inside the channel register space. Step over it. */ -+ if (chan >= DMAOR) -+ base += SH_DMAC_CH_SZ; - -- return base + (chan * 0x10); -+ return base + chan; - } - - #ifdef CONFIG_SH_DMA_IRQ_MULTI -@@ -250,12 +262,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan) - #define NR_DMAOR 1 - #endif - --/* -- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages -- * channels 0 - 5, DMAOR1 6 - 11 (optional). -- */ --#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6)) --#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6) -+#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \ -+ SH_DMAC_NR_MD_CH) + DMAOR) -+#define dmaor_write_reg(n, data) __raw_writew(data, \ -+ dma_find_base((n) * \ -+ SH_DMAC_NR_MD_CH) + DMAOR) - - static inline int dmaor_reset(int no) - { -diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c -index d342ea08843f6..70a07f4f2142f 100644 ---- a/arch/sh/kernel/cpu/sh2/probe.c -+++ b/arch/sh/kernel/cpu/sh2/probe.c -@@ -21,7 +21,7 @@ static int __init scan_cache(unsigned long node, const char *uname, - if (!of_flat_dt_is_compatible(node, "jcore,cache")) - return 0; - -- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node); -+ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4); - - return 1; - } -diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c -index 0e4f14dae1c05..91016bb18d4f9 100644 ---- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c -+++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c -@@ -593,6 +593,18 @@ static int __rdtgroup_move_task(struct task_struct *tsk, - return 0; - } - -+static bool is_closid_match(struct task_struct *t, struct rdtgroup *r) -+{ -+ return (rdt_alloc_capable && -+ (r->type == RDTCTRL_GROUP) && (t->closid == r->closid)); -+} -+ -+static bool is_rmid_match(struct task_struct *t, struct rdtgroup *r) -+{ -+ return (rdt_mon_capable && -+ (r->type == RDTMON_GROUP) && (t->rmid == r->mon.rmid)); -+} -+ - /** - * rdtgroup_tasks_assigned - Test if tasks have been assigned to resource group - * @r: Resource group -@@ -608,8 +620,7 @@ int rdtgroup_tasks_assigned(struct rdtgroup *r) - - rcu_read_lock(); - for_each_process_thread(p, t) { -- if ((r->type == RDTCTRL_GROUP && t->closid == r->closid) || -- (r->type == RDTMON_GROUP && t->rmid == r->mon.rmid)) { -+ if (is_closid_match(t, r) || is_rmid_match(t, r)) { - ret = 1; - break; - } -@@ -704,12 +715,15 @@ unlock: - static void show_rdt_tasks(struct rdtgroup *r, struct seq_file *s) - { - struct task_struct *p, *t; -+ pid_t pid; - - rcu_read_lock(); - for_each_process_thread(p, t) { -- if ((r->type == RDTCTRL_GROUP && t->closid == r->closid) || -- (r->type == RDTMON_GROUP && t->rmid == r->mon.rmid)) -- seq_printf(s, "%d\n", t->pid); -+ if (is_closid_match(t, r) || is_rmid_match(t, r)) { -+ pid = task_pid_vnr(t); -+ if (pid) -+ seq_printf(s, "%d\n", pid); -+ } - } - rcu_read_unlock(); - } -@@ -2148,18 +2162,6 @@ static int reset_all_ctrls(struct rdt_resource *r) - return 0; - } - --static bool is_closid_match(struct task_struct *t, struct rdtgroup *r) --{ -- return (rdt_alloc_capable && -- (r->type == RDTCTRL_GROUP) && (t->closid == r->closid)); --} -- --static bool is_rmid_match(struct task_struct *t, struct rdtgroup *r) --{ -- return (rdt_mon_capable && -- (r->type == RDTMON_GROUP) && (t->rmid == r->mon.rmid)); --} -- - /* - * Move tasks from one to the other group. If @from is NULL, then all tasks - * in the systems are moved unconditionally (used for teardown). -diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index 1699d18bd1548..45e5ecb43393b 100644 ---- a/arch/x86/kernel/smpboot.c -+++ b/arch/x86/kernel/smpboot.c -@@ -99,6 +99,17 @@ DEFINE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_llc_shared_map); - DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info); - EXPORT_PER_CPU_SYMBOL(cpu_info); - -+struct mwait_cpu_dead { -+ unsigned int control; -+ unsigned int status; -+}; -+ -+/* -+ * Cache line aligned data for mwait_play_dead(). Separate on purpose so -+ * that it's unlikely to be touched by other CPUs. -+ */ -+static DEFINE_PER_CPU_ALIGNED(struct mwait_cpu_dead, mwait_cpu_dead); -+ - /* Logical package management. We might want to allocate that dynamically */ - unsigned int __max_logical_packages __read_mostly; - EXPORT_SYMBOL(__max_logical_packages); -@@ -1675,10 +1686,10 @@ static bool wakeup_cpu0(void) - */ - static inline void mwait_play_dead(void) - { -+ struct mwait_cpu_dead *md = this_cpu_ptr(&mwait_cpu_dead); - unsigned int eax, ebx, ecx, edx; - unsigned int highest_cstate = 0; - unsigned int highest_subcstate = 0; -- void *mwait_ptr; - int i; - - if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD || -@@ -1713,13 +1724,6 @@ static inline void mwait_play_dead(void) - (highest_subcstate - 1); - } - -- /* -- * This should be a memory location in a cache line which is -- * unlikely to be touched by other processors. The actual -- * content is immaterial as it is not actually modified in any way. -- */ -- mwait_ptr = ¤t_thread_info()->flags; -- - wbinvd(); - - while (1) { -@@ -1731,9 +1735,9 @@ static inline void mwait_play_dead(void) - * case where we return around the loop. - */ - mb(); -- clflush(mwait_ptr); -+ clflush(md); - mb(); -- __monitor(mwait_ptr, 0, 0); -+ __monitor(md, 0, 0); - mb(); - __mwait(eax, 0); - /* -diff --git a/arch/xtensa/platforms/iss/network.c b/arch/xtensa/platforms/iss/network.c -index fa9f3893b0021..cbca91bb5334a 100644 ---- a/arch/xtensa/platforms/iss/network.c -+++ b/arch/xtensa/platforms/iss/network.c -@@ -231,7 +231,7 @@ static int tuntap_probe(struct iss_net_private *lp, int index, char *init) - - init += sizeof(TRANSPORT_TUNTAP_NAME) - 1; - if (*init == ',') { -- rem = split_if_spec(init + 1, &mac_str, &dev_name); -+ rem = split_if_spec(init + 1, &mac_str, &dev_name, NULL); - if (rem != NULL) { - pr_err("%s: extra garbage on specification : '%s'\n", - dev->name, rem); -diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c -index 560936617d9c1..484a51bce39b5 100644 ---- a/block/partitions/amiga.c -+++ b/block/partitions/amiga.c -@@ -11,11 +11,19 @@ - #define pr_fmt(fmt) fmt - - #include -+#include -+#include - #include - - #include "check.h" - #include "amiga.h" - -+/* magic offsets in partition DosEnvVec */ -+#define NR_HD 3 -+#define NR_SECT 5 -+#define LO_CYL 9 -+#define HI_CYL 10 -+ - static __inline__ u32 - checksum_block(__be32 *m, int size) - { -@@ -32,8 +40,12 @@ int amiga_partition(struct parsed_partitions *state) - unsigned char *data; - struct RigidDiskBlock *rdb; - struct PartitionBlock *pb; -- int start_sect, nr_sects, blk, part, res = 0; -- int blksize = 1; /* Multiplier for disk block size */ -+ u64 start_sect, nr_sects; -+ sector_t blk, end_sect; -+ u32 cylblk; /* rdb_CylBlocks = nr_heads*sect_per_track */ -+ u32 nr_hd, nr_sect, lo_cyl, hi_cyl; -+ int part, res = 0; -+ unsigned int blksize = 1; /* Multiplier for disk block size */ - int slot = 1; - char b[BDEVNAME_SIZE]; - -@@ -43,7 +55,7 @@ int amiga_partition(struct parsed_partitions *state) - data = read_part_sector(state, blk, §); - if (!data) { - if (warn_no_part) -- pr_err("Dev %s: unable to read RDB block %d\n", -+ pr_err("Dev %s: unable to read RDB block %llu\n", - bdevname(state->bdev, b), blk); - res = -1; - goto rdb_done; -@@ -60,12 +72,12 @@ int amiga_partition(struct parsed_partitions *state) - *(__be32 *)(data+0xdc) = 0; - if (checksum_block((__be32 *)data, - be32_to_cpu(rdb->rdb_SummedLongs) & 0x7F)==0) { -- pr_err("Trashed word at 0xd0 in block %d ignored in checksum calculation\n", -+ pr_err("Trashed word at 0xd0 in block %llu ignored in checksum calculation\n", - blk); - break; - } - -- pr_err("Dev %s: RDB in block %d has bad checksum\n", -+ pr_err("Dev %s: RDB in block %llu has bad checksum\n", - bdevname(state->bdev, b), blk); - } - -@@ -81,12 +93,17 @@ int amiga_partition(struct parsed_partitions *state) - } - blk = be32_to_cpu(rdb->rdb_PartitionList); - put_dev_sector(sect); -- for (part = 1; blk>0 && part<=16; part++, put_dev_sector(sect)) { -- blk *= blksize; /* Read in terms partition table understands */ -+ for (part = 1; (s32) blk>0 && part<=16; part++, put_dev_sector(sect)) { -+ /* Read in terms partition table understands */ -+ if (check_mul_overflow(blk, (sector_t) blksize, &blk)) { -+ pr_err("Dev %s: overflow calculating partition block %llu! Skipping partitions %u and beyond\n", -+ bdevname(state->bdev, b), blk, part); -+ break; -+ } - data = read_part_sector(state, blk, §); - if (!data) { - if (warn_no_part) -- pr_err("Dev %s: unable to read partition block %d\n", -+ pr_err("Dev %s: unable to read partition block %llu\n", - bdevname(state->bdev, b), blk); - res = -1; - goto rdb_done; -@@ -98,19 +115,70 @@ int amiga_partition(struct parsed_partitions *state) - if (checksum_block((__be32 *)pb, be32_to_cpu(pb->pb_SummedLongs) & 0x7F) != 0 ) - continue; - -- /* Tell Kernel about it */ -+ /* RDB gives us more than enough rope to hang ourselves with, -+ * many times over (2^128 bytes if all fields max out). -+ * Some careful checks are in order, so check for potential -+ * overflows. -+ * We are multiplying four 32 bit numbers to one sector_t! -+ */ -+ -+ nr_hd = be32_to_cpu(pb->pb_Environment[NR_HD]); -+ nr_sect = be32_to_cpu(pb->pb_Environment[NR_SECT]); -+ -+ /* CylBlocks is total number of blocks per cylinder */ -+ if (check_mul_overflow(nr_hd, nr_sect, &cylblk)) { -+ pr_err("Dev %s: heads*sects %u overflows u32, skipping partition!\n", -+ bdevname(state->bdev, b), cylblk); -+ continue; -+ } -+ -+ /* check for consistency with RDB defined CylBlocks */ -+ if (cylblk > be32_to_cpu(rdb->rdb_CylBlocks)) { -+ pr_warn("Dev %s: cylblk %u > rdb_CylBlocks %u!\n", -+ bdevname(state->bdev, b), cylblk, -+ be32_to_cpu(rdb->rdb_CylBlocks)); -+ } -+ -+ /* RDB allows for variable logical block size - -+ * normalize to 512 byte blocks and check result. -+ */ -+ -+ if (check_mul_overflow(cylblk, blksize, &cylblk)) { -+ pr_err("Dev %s: partition %u bytes per cyl. overflows u32, skipping partition!\n", -+ bdevname(state->bdev, b), part); -+ continue; -+ } -+ -+ /* Calculate partition start and end. Limit of 32 bit on cylblk -+ * guarantees no overflow occurs if LBD support is enabled. -+ */ -+ -+ lo_cyl = be32_to_cpu(pb->pb_Environment[LO_CYL]); -+ start_sect = ((u64) lo_cyl * cylblk); -+ -+ hi_cyl = be32_to_cpu(pb->pb_Environment[HI_CYL]); -+ nr_sects = (((u64) hi_cyl - lo_cyl + 1) * cylblk); - -- nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 - -- be32_to_cpu(pb->pb_Environment[9])) * -- be32_to_cpu(pb->pb_Environment[3]) * -- be32_to_cpu(pb->pb_Environment[5]) * -- blksize; - if (!nr_sects) - continue; -- start_sect = be32_to_cpu(pb->pb_Environment[9]) * -- be32_to_cpu(pb->pb_Environment[3]) * -- be32_to_cpu(pb->pb_Environment[5]) * -- blksize; -+ -+ /* Warn user if partition end overflows u32 (AmigaDOS limit) */ -+ -+ if ((start_sect + nr_sects) > UINT_MAX) { -+ pr_warn("Dev %s: partition %u (%llu-%llu) needs 64 bit device support!\n", -+ bdevname(state->bdev, b), part, -+ start_sect, start_sect + nr_sects); -+ } -+ -+ if (check_add_overflow(start_sect, nr_sects, &end_sect)) { -+ pr_err("Dev %s: partition %u (%llu-%llu) needs LBD device support, skipping partition!\n", -+ bdevname(state->bdev, b), part, -+ start_sect, end_sect); -+ continue; -+ } -+ -+ /* Tell Kernel about it */ -+ - put_partition(state,slot++,start_sect,nr_sects); - { - /* Be even more informative to aid mounting */ -diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c -index edb791354421b..5be76197bc361 100644 ---- a/drivers/base/power/domain.c -+++ b/drivers/base/power/domain.c -@@ -2596,10 +2596,10 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state, - - err = of_property_read_u32(state_node, "min-residency-us", &residency); - if (!err) -- genpd_state->residency_ns = 1000 * residency; -+ genpd_state->residency_ns = 1000LL * residency; - -- genpd_state->power_on_latency_ns = 1000 * exit_latency; -- genpd_state->power_off_latency_ns = 1000 * entry_latency; -+ genpd_state->power_on_latency_ns = 1000LL * exit_latency; -+ genpd_state->power_off_latency_ns = 1000LL * entry_latency; - genpd_state->fwnode = &state_node->fwnode; - - return 0; -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 218aa7e419700..37994a7a1b6f4 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -1708,7 +1708,8 @@ static int nbd_dev_add(int index) - if (err == -ENOSPC) - err = -EEXIST; - } else { -- err = idr_alloc(&nbd_index_idr, nbd, 0, 0, GFP_KERNEL); -+ err = idr_alloc(&nbd_index_idr, nbd, 0, -+ (MINORMASK >> part_shift) + 1, GFP_KERNEL); - if (err >= 0) - index = err; - } -diff --git a/drivers/char/hw_random/imx-rngc.c b/drivers/char/hw_random/imx-rngc.c -index 0576801944fdd..2e902419601de 100644 ---- a/drivers/char/hw_random/imx-rngc.c -+++ b/drivers/char/hw_random/imx-rngc.c -@@ -99,7 +99,7 @@ static int imx_rngc_self_test(struct imx_rngc *rngc) - cmd = readl(rngc->base + RNGC_COMMAND); - writel(cmd | RNGC_CMD_SELF_TEST, rngc->base + RNGC_COMMAND); - -- ret = wait_for_completion_timeout(&rngc->rng_op_done, RNGC_TIMEOUT); -+ ret = wait_for_completion_timeout(&rngc->rng_op_done, msecs_to_jiffies(RNGC_TIMEOUT)); - if (!ret) { - imx_rngc_irq_mask_clear(rngc); - return -ETIMEDOUT; -@@ -182,9 +182,7 @@ static int imx_rngc_init(struct hwrng *rng) - cmd = readl(rngc->base + RNGC_COMMAND); - writel(cmd | RNGC_CMD_SEED, rngc->base + RNGC_COMMAND); - -- ret = wait_for_completion_timeout(&rngc->rng_op_done, -- RNGC_TIMEOUT); -- -+ ret = wait_for_completion_timeout(&rngc->rng_op_done, msecs_to_jiffies(RNGC_TIMEOUT)); - if (!ret) { - imx_rngc_irq_mask_clear(rngc); - return -ETIMEDOUT; -diff --git a/drivers/char/hw_random/st-rng.c b/drivers/char/hw_random/st-rng.c -index 863448360a7da..f708a99619ecb 100644 ---- a/drivers/char/hw_random/st-rng.c -+++ b/drivers/char/hw_random/st-rng.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -41,7 +42,6 @@ - - struct st_rng_data { - void __iomem *base; -- struct clk *clk; - struct hwrng ops; - }; - -@@ -86,26 +86,18 @@ static int st_rng_probe(struct platform_device *pdev) - if (IS_ERR(base)) - return PTR_ERR(base); - -- clk = devm_clk_get(&pdev->dev, NULL); -+ clk = devm_clk_get_enabled(&pdev->dev, NULL); - if (IS_ERR(clk)) - return PTR_ERR(clk); - -- ret = clk_prepare_enable(clk); -- if (ret) -- return ret; -- - ddata->ops.priv = (unsigned long)ddata; - ddata->ops.read = st_rng_read; - ddata->ops.name = pdev->name; - ddata->base = base; -- ddata->clk = clk; -- -- dev_set_drvdata(&pdev->dev, ddata); - - ret = devm_hwrng_register(&pdev->dev, &ddata->ops); - if (ret) { - dev_err(&pdev->dev, "Failed to register HW RNG\n"); -- clk_disable_unprepare(clk); - return ret; - } - -@@ -114,16 +106,7 @@ static int st_rng_probe(struct platform_device *pdev) - return 0; - } - --static int st_rng_remove(struct platform_device *pdev) --{ -- struct st_rng_data *ddata = dev_get_drvdata(&pdev->dev); -- -- clk_disable_unprepare(ddata->clk); -- -- return 0; --} -- --static const struct of_device_id st_rng_match[] = { -+static const struct of_device_id st_rng_match[] __maybe_unused = { - { .compatible = "st,rng" }, - {}, - }; -@@ -135,7 +118,6 @@ static struct platform_driver st_rng_driver = { - .of_match_table = of_match_ptr(st_rng_match), - }, - .probe = st_rng_probe, -- .remove = st_rng_remove - }; - - module_platform_driver(st_rng_driver); -diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c -index 718d8c0876506..145d7b1055c07 100644 ---- a/drivers/char/hw_random/virtio-rng.c -+++ b/drivers/char/hw_random/virtio-rng.c -@@ -4,6 +4,7 @@ - * Copyright (C) 2007, 2008 Rusty Russell IBM Corporation - */ - -+#include - #include - #include - #include -@@ -17,71 +18,111 @@ static DEFINE_IDA(rng_index_ida); - struct virtrng_info { - struct hwrng hwrng; - struct virtqueue *vq; -- struct completion have_data; - char name[25]; -- unsigned int data_avail; - int index; -- bool busy; - bool hwrng_register_done; - bool hwrng_removed; -+ /* data transfer */ -+ struct completion have_data; -+ unsigned int data_avail; -+ unsigned int data_idx; -+ /* minimal size returned by rng_buffer_size() */ -+#if SMP_CACHE_BYTES < 32 -+ u8 data[32]; -+#else -+ u8 data[SMP_CACHE_BYTES]; -+#endif - }; - - static void random_recv_done(struct virtqueue *vq) - { - struct virtrng_info *vi = vq->vdev->priv; -+ unsigned int len; - - /* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */ -- if (!virtqueue_get_buf(vi->vq, &vi->data_avail)) -+ if (!virtqueue_get_buf(vi->vq, &len)) - return; - -+ smp_store_release(&vi->data_avail, len); - complete(&vi->have_data); - } - --/* The host will fill any buffer we give it with sweet, sweet randomness. */ --static void register_buffer(struct virtrng_info *vi, u8 *buf, size_t size) -+static void request_entropy(struct virtrng_info *vi) - { - struct scatterlist sg; - -- sg_init_one(&sg, buf, size); -+ reinit_completion(&vi->have_data); -+ vi->data_idx = 0; -+ -+ sg_init_one(&sg, vi->data, sizeof(vi->data)); - - /* There should always be room for one buffer. */ -- virtqueue_add_inbuf(vi->vq, &sg, 1, buf, GFP_KERNEL); -+ virtqueue_add_inbuf(vi->vq, &sg, 1, vi->data, GFP_KERNEL); - - virtqueue_kick(vi->vq); - } - -+static unsigned int copy_data(struct virtrng_info *vi, void *buf, -+ unsigned int size) -+{ -+ size = min_t(unsigned int, size, vi->data_avail); -+ memcpy(buf, vi->data + vi->data_idx, size); -+ vi->data_idx += size; -+ vi->data_avail -= size; -+ if (vi->data_avail == 0) -+ request_entropy(vi); -+ return size; -+} -+ - static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) - { - int ret; - struct virtrng_info *vi = (struct virtrng_info *)rng->priv; -+ unsigned int chunk; -+ size_t read; - - if (vi->hwrng_removed) - return -ENODEV; - -- if (!vi->busy) { -- vi->busy = true; -- reinit_completion(&vi->have_data); -- register_buffer(vi, buf, size); -+ read = 0; -+ -+ /* copy available data */ -+ if (smp_load_acquire(&vi->data_avail)) { -+ chunk = copy_data(vi, buf, size); -+ size -= chunk; -+ read += chunk; - } - - if (!wait) -- return 0; -- -- ret = wait_for_completion_killable(&vi->have_data); -- if (ret < 0) -- return ret; -+ return read; -+ -+ /* We have already copied available entropy, -+ * so either size is 0 or data_avail is 0 -+ */ -+ while (size != 0) { -+ /* data_avail is 0 but a request is pending */ -+ ret = wait_for_completion_killable(&vi->have_data); -+ if (ret < 0) -+ return ret; -+ /* if vi->data_avail is 0, we have been interrupted -+ * by a cleanup, but buffer stays in the queue -+ */ -+ if (vi->data_avail == 0) -+ return read; - -- vi->busy = false; -+ chunk = copy_data(vi, buf + read, size); -+ size -= chunk; -+ read += chunk; -+ } - -- return vi->data_avail; -+ return read; - } - - static void virtio_cleanup(struct hwrng *rng) - { - struct virtrng_info *vi = (struct virtrng_info *)rng->priv; - -- if (vi->busy) -- wait_for_completion(&vi->have_data); -+ complete(&vi->have_data); - } - - static int probe_common(struct virtio_device *vdev) -@@ -117,6 +158,9 @@ static int probe_common(struct virtio_device *vdev) - goto err_find; - } - -+ /* we always have a pending entropy request */ -+ request_entropy(vi); -+ - return 0; - - err_find: -@@ -132,9 +176,9 @@ static void remove_common(struct virtio_device *vdev) - - vi->hwrng_removed = true; - vi->data_avail = 0; -+ vi->data_idx = 0; - complete(&vi->have_data); - vdev->config->reset(vdev); -- vi->busy = false; - if (vi->hwrng_register_done) - hwrng_unregister(&vi->hwrng); - vdev->config->del_vqs(vdev); -diff --git a/drivers/char/tpm/tpm_vtpm_proxy.c b/drivers/char/tpm/tpm_vtpm_proxy.c -index 2f6e087ec4965..ff6b88fa4f47b 100644 ---- a/drivers/char/tpm/tpm_vtpm_proxy.c -+++ b/drivers/char/tpm/tpm_vtpm_proxy.c -@@ -693,37 +693,21 @@ static struct miscdevice vtpmx_miscdev = { - .fops = &vtpmx_fops, - }; - --static int vtpmx_init(void) --{ -- return misc_register(&vtpmx_miscdev); --} -- --static void vtpmx_cleanup(void) --{ -- misc_deregister(&vtpmx_miscdev); --} -- - static int __init vtpm_module_init(void) - { - int rc; - -- rc = vtpmx_init(); -- if (rc) { -- pr_err("couldn't create vtpmx device\n"); -- return rc; -- } -- - workqueue = create_workqueue("tpm-vtpm"); - if (!workqueue) { - pr_err("couldn't create workqueue\n"); -- rc = -ENOMEM; -- goto err_vtpmx_cleanup; -+ return -ENOMEM; - } - -- return 0; -- --err_vtpmx_cleanup: -- vtpmx_cleanup(); -+ rc = misc_register(&vtpmx_miscdev); -+ if (rc) { -+ pr_err("couldn't create vtpmx device\n"); -+ destroy_workqueue(workqueue); -+ } - - return rc; - } -@@ -731,7 +715,7 @@ err_vtpmx_cleanup: - static void __exit vtpm_module_exit(void) - { - destroy_workqueue(workqueue); -- vtpmx_cleanup(); -+ misc_deregister(&vtpmx_miscdev); - } - - module_init(vtpm_module_init); -diff --git a/drivers/clk/clk-cdce925.c b/drivers/clk/clk-cdce925.c -index 308b353815e17..470d91d7314db 100644 ---- a/drivers/clk/clk-cdce925.c -+++ b/drivers/clk/clk-cdce925.c -@@ -705,6 +705,10 @@ static int cdce925_probe(struct i2c_client *client, - for (i = 0; i < data->chip_info->num_plls; ++i) { - pll_clk_name[i] = kasprintf(GFP_KERNEL, "%pOFn.pll%d", - client->dev.of_node, i); -+ if (!pll_clk_name[i]) { -+ err = -ENOMEM; -+ goto error; -+ } - init.name = pll_clk_name[i]; - data->pll[i].chip = data; - data->pll[i].hw.init = &init; -@@ -746,6 +750,10 @@ static int cdce925_probe(struct i2c_client *client, - init.num_parents = 1; - init.parent_names = &parent_name; /* Mux Y1 to input */ - init.name = kasprintf(GFP_KERNEL, "%pOFn.Y1", client->dev.of_node); -+ if (!init.name) { -+ err = -ENOMEM; -+ goto error; -+ } - data->clk[0].chip = data; - data->clk[0].hw.init = &init; - data->clk[0].index = 0; -@@ -764,6 +772,10 @@ static int cdce925_probe(struct i2c_client *client, - for (i = 1; i < data->chip_info->num_outputs; ++i) { - init.name = kasprintf(GFP_KERNEL, "%pOFn.Y%d", - client->dev.of_node, i+1); -+ if (!init.name) { -+ err = -ENOMEM; -+ goto error; -+ } - data->clk[i].chip = data; - data->clk[i].hw.init = &init; - data->clk[i].index = i; -diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c -index 64ea895f1a7df..8e28e3489ded3 100644 ---- a/drivers/clk/keystone/sci-clk.c -+++ b/drivers/clk/keystone/sci-clk.c -@@ -287,6 +287,8 @@ static int _sci_clk_build(struct sci_clk_provider *provider, - - name = kasprintf(GFP_KERNEL, "clk:%d:%d", sci_clk->dev_id, - sci_clk->clk_id); -+ if (!name) -+ return -ENOMEM; - - init.name = name; - -diff --git a/drivers/clk/tegra/clk-emc.c b/drivers/clk/tegra/clk-emc.c -index 0c1b83bedb73d..eb2411a4cd783 100644 ---- a/drivers/clk/tegra/clk-emc.c -+++ b/drivers/clk/tegra/clk-emc.c -@@ -459,6 +459,7 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra, - err = load_one_timing_from_dt(tegra, timing, child); - if (err) { - of_node_put(child); -+ kfree(tegra->timings); - return err; - } - -@@ -510,6 +511,7 @@ struct clk *tegra_clk_register_emc(void __iomem *base, struct device_node *np, - err = load_timings_from_dt(tegra, node, node_ram_code); - if (err) { - of_node_put(node); -+ kfree(tegra); - return ERR_PTR(err); - } - } -diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c -index 160bc6597de5b..bd49385178d0f 100644 ---- a/drivers/clocksource/timer-cadence-ttc.c -+++ b/drivers/clocksource/timer-cadence-ttc.c -@@ -15,6 +15,8 @@ - #include - #include - #include -+#include -+#include - - /* - * This driver configures the 2 16/32-bit count-up timers as follows: -@@ -464,13 +466,7 @@ out_kfree: - return err; - } - --/** -- * ttc_timer_init - Initialize the timer -- * -- * Initializes the timer hardware and register the clock source and clock event -- * timers with Linux kernal timer framework -- */ --static int __init ttc_timer_init(struct device_node *timer) -+static int __init ttc_timer_probe(struct platform_device *pdev) - { - unsigned int irq; - void __iomem *timer_baseaddr; -@@ -478,6 +474,7 @@ static int __init ttc_timer_init(struct device_node *timer) - static int initialized; - int clksel, ret; - u32 timer_width = 16; -+ struct device_node *timer = pdev->dev.of_node; - - if (initialized) - return 0; -@@ -489,10 +486,10 @@ static int __init ttc_timer_init(struct device_node *timer) - * and use it. Note that the event timer uses the interrupt and it's the - * 2nd TTC hence the irq_of_parse_and_map(,1) - */ -- timer_baseaddr = of_iomap(timer, 0); -- if (!timer_baseaddr) { -+ timer_baseaddr = devm_of_iomap(&pdev->dev, timer, 0, NULL); -+ if (IS_ERR(timer_baseaddr)) { - pr_err("ERROR: invalid timer base address\n"); -- return -ENXIO; -+ return PTR_ERR(timer_baseaddr); - } - - irq = irq_of_parse_and_map(timer, 1); -@@ -516,20 +513,40 @@ static int __init ttc_timer_init(struct device_node *timer) - clk_ce = of_clk_get(timer, clksel); - if (IS_ERR(clk_ce)) { - pr_err("ERROR: timer input clock not found\n"); -- return PTR_ERR(clk_ce); -+ ret = PTR_ERR(clk_ce); -+ goto put_clk_cs; - } - - ret = ttc_setup_clocksource(clk_cs, timer_baseaddr, timer_width); - if (ret) -- return ret; -+ goto put_clk_ce; - - ret = ttc_setup_clockevent(clk_ce, timer_baseaddr + 4, irq); - if (ret) -- return ret; -+ goto put_clk_ce; - - pr_info("%pOFn #0 at %p, irq=%d\n", timer, timer_baseaddr, irq); - - return 0; -+ -+put_clk_ce: -+ clk_put(clk_ce); -+put_clk_cs: -+ clk_put(clk_cs); -+ return ret; - } - --TIMER_OF_DECLARE(ttc, "cdns,ttc", ttc_timer_init); -+static const struct of_device_id ttc_timer_of_match[] = { -+ {.compatible = "cdns,ttc"}, -+ {}, -+}; -+ -+MODULE_DEVICE_TABLE(of, ttc_timer_of_match); -+ -+static struct platform_driver ttc_timer_driver = { -+ .driver = { -+ .name = "cdns_ttc_timer", -+ .of_match_table = ttc_timer_of_match, -+ }, -+}; -+builtin_platform_driver_probe(ttc_timer_driver, ttc_timer_probe); -diff --git a/drivers/crypto/marvell/cipher.c b/drivers/crypto/marvell/cipher.c -index 708dc63b2f099..c7d433d1cd99d 100644 ---- a/drivers/crypto/marvell/cipher.c -+++ b/drivers/crypto/marvell/cipher.c -@@ -287,7 +287,7 @@ static int mv_cesa_des_setkey(struct crypto_skcipher *cipher, const u8 *key, - static int mv_cesa_des3_ede_setkey(struct crypto_skcipher *cipher, - const u8 *key, unsigned int len) - { -- struct mv_cesa_des_ctx *ctx = crypto_skcipher_ctx(cipher); -+ struct mv_cesa_des3_ctx *ctx = crypto_skcipher_ctx(cipher); - int err; - - err = verify_skcipher_des3_key(cipher, key); -diff --git a/drivers/crypto/nx/Makefile b/drivers/crypto/nx/Makefile -index 015155da59c29..76139865d7fa1 100644 ---- a/drivers/crypto/nx/Makefile -+++ b/drivers/crypto/nx/Makefile -@@ -1,7 +1,6 @@ - # SPDX-License-Identifier: GPL-2.0 - obj-$(CONFIG_CRYPTO_DEV_NX_ENCRYPT) += nx-crypto.o - nx-crypto-objs := nx.o \ -- nx_debugfs.o \ - nx-aes-cbc.o \ - nx-aes-ecb.o \ - nx-aes-gcm.o \ -@@ -11,6 +10,7 @@ nx-crypto-objs := nx.o \ - nx-sha256.o \ - nx-sha512.o - -+nx-crypto-$(CONFIG_DEBUG_FS) += nx_debugfs.o - obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_PSERIES) += nx-compress-pseries.o nx-compress.o - obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_POWERNV) += nx-compress-powernv.o nx-compress.o - nx-compress-objs := nx-842.o -diff --git a/drivers/crypto/nx/nx.h b/drivers/crypto/nx/nx.h -index 7ecca168f8c48..5c77aba450cf8 100644 ---- a/drivers/crypto/nx/nx.h -+++ b/drivers/crypto/nx/nx.h -@@ -169,8 +169,8 @@ struct nx_sg *nx_walk_and_build(struct nx_sg *, unsigned int, - void nx_debugfs_init(struct nx_crypto_driver *); - void nx_debugfs_fini(struct nx_crypto_driver *); - #else --#define NX_DEBUGFS_INIT(drv) (0) --#define NX_DEBUGFS_FINI(drv) (0) -+#define NX_DEBUGFS_INIT(drv) do {} while (0) -+#define NX_DEBUGFS_FINI(drv) do {} while (0) - #endif - - #define NX_PAGE_NUM(x) ((u64)(x) & 0xfffffffffffff000ULL) -diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c -index 6b905c3d30f4f..12f9ae2aac113 100644 ---- a/drivers/extcon/extcon.c -+++ b/drivers/extcon/extcon.c -@@ -196,6 +196,14 @@ static const struct __extcon_info { - * @attr_name: "name" sysfs entry - * @attr_state: "state" sysfs entry - * @attrs: the array pointing to attr_name and attr_state for attr_g -+ * @usb_propval: the array of USB connector properties -+ * @chg_propval: the array of charger connector properties -+ * @jack_propval: the array of jack connector properties -+ * @disp_propval: the array of display connector properties -+ * @usb_bits: the bit array of the USB connector property capabilities -+ * @chg_bits: the bit array of the charger connector property capabilities -+ * @jack_bits: the bit array of the jack connector property capabilities -+ * @disp_bits: the bit array of the display connector property capabilities - */ - struct extcon_cable { - struct extcon_dev *edev; -diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c -index 7122bc6ea796b..2da2aa79c87e2 100644 ---- a/drivers/firmware/stratix10-svc.c -+++ b/drivers/firmware/stratix10-svc.c -@@ -615,7 +615,7 @@ svc_create_memory_pool(struct platform_device *pdev, - end = rounddown(sh_memory->addr + sh_memory->size, PAGE_SIZE); - paddr = begin; - size = end - begin; -- va = memremap(paddr, size, MEMREMAP_WC); -+ va = devm_memremap(dev, paddr, size, MEMREMAP_WC); - if (!va) { - dev_err(dev, "fail to remap shared memory\n"); - return ERR_PTR(-EINVAL); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c -index fb47ddc6f7f4e..dcf23b43f323c 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c -@@ -3076,6 +3076,10 @@ int amdgpu_vm_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) - struct amdgpu_fpriv *fpriv = filp->driver_priv; - int r; - -+ /* No valid flags defined yet */ -+ if (args->in.flags) -+ return -EINVAL; -+ - switch (args->in.op) { - case AMDGPU_VM_OP_RESERVE_VMID: - /* current, we only have requirement to reserve vmid from gfxhub */ -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c -index d3380c5bdbdea..d978fcac26651 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c -@@ -101,18 +101,19 @@ static struct kfd_mem_obj *allocate_mqd(struct kfd_dev *kfd, - &(mqd_mem_obj->gtt_mem), - &(mqd_mem_obj->gpu_addr), - (void *)&(mqd_mem_obj->cpu_ptr), true); -+ -+ if (retval) { -+ kfree(mqd_mem_obj); -+ return NULL; -+ } - } else { - retval = kfd_gtt_sa_allocate(kfd, sizeof(struct v9_mqd), - &mqd_mem_obj); -- } -- -- if (retval) { -- kfree(mqd_mem_obj); -- return NULL; -+ if (retval) -+ return NULL; - } - - return mqd_mem_obj; -- - } - - static void init_mqd(struct mqd_manager *mm, void **mqd, -diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c -index 2fc0f221fb4e2..47649186fed70 100644 ---- a/drivers/gpu/drm/drm_atomic.c -+++ b/drivers/gpu/drm/drm_atomic.c -@@ -97,6 +97,12 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state) - if (!state->planes) - goto fail; - -+ /* -+ * Because drm_atomic_state can be committed asynchronously we need our -+ * own reference and cannot rely on the on implied by drm_file in the -+ * ioctl call. -+ */ -+ drm_dev_get(dev); - state->dev = dev; - - DRM_DEBUG_ATOMIC("Allocated atomic state %p\n", state); -@@ -256,7 +262,8 @@ EXPORT_SYMBOL(drm_atomic_state_clear); - void __drm_atomic_state_free(struct kref *ref) - { - struct drm_atomic_state *state = container_of(ref, typeof(*state), ref); -- struct drm_mode_config *config = &state->dev->mode_config; -+ struct drm_device *dev = state->dev; -+ struct drm_mode_config *config = &dev->mode_config; - - drm_atomic_state_clear(state); - -@@ -268,6 +275,8 @@ void __drm_atomic_state_free(struct kref *ref) - drm_atomic_state_default_release(state); - kfree(state); - } -+ -+ drm_dev_put(dev); - } - EXPORT_SYMBOL(__drm_atomic_state_free); - -diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c -index 62b77f3a950b8..d91d6c063a1d2 100644 ---- a/drivers/gpu/drm/drm_atomic_helper.c -+++ b/drivers/gpu/drm/drm_atomic_helper.c -@@ -1086,7 +1086,16 @@ disable_outputs(struct drm_device *dev, struct drm_atomic_state *old_state) - continue; - - ret = drm_crtc_vblank_get(crtc); -- WARN_ONCE(ret != -EINVAL, "driver forgot to call drm_crtc_vblank_off()\n"); -+ /* -+ * Self-refresh is not a true "disable"; ensure vblank remains -+ * enabled. -+ */ -+ if (new_crtc_state->self_refresh_active) -+ WARN_ONCE(ret != 0, -+ "driver disabled vblank in self-refresh\n"); -+ else -+ WARN_ONCE(ret != -EINVAL, -+ "driver forgot to call drm_crtc_vblank_off()\n"); - if (ret == 0) - drm_crtc_vblank_put(crtc); - } -diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c -index bf1bdb0aac19b..10769efaf7cb3 100644 ---- a/drivers/gpu/drm/drm_client_modeset.c -+++ b/drivers/gpu/drm/drm_client_modeset.c -@@ -281,6 +281,9 @@ static bool drm_client_target_cloned(struct drm_device *dev, - can_clone = true; - dmt_mode = drm_mode_find_dmt(dev, 1024, 768, 60, false); - -+ if (!dmt_mode) -+ goto fail; -+ - for (i = 0; i < connector_count; i++) { - if (!enabled[i]) - continue; -@@ -296,11 +299,13 @@ static bool drm_client_target_cloned(struct drm_device *dev, - if (!modes[i]) - can_clone = false; - } -+ kfree(dmt_mode); - - if (can_clone) { - DRM_DEBUG_KMS("can clone using 1024x768\n"); - return true; - } -+fail: - DRM_INFO("kms: can't enable cloning when we probably wanted to.\n"); - return false; - } -@@ -785,6 +790,7 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, - break; - } - -+ kfree(modeset->mode); - modeset->mode = drm_mode_duplicate(dev, mode); - drm_connector_get(connector); - modeset->connectors[modeset->num_connectors++] = connector; -diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c -index 6b0bf42039cfa..ed7985c0535a2 100644 ---- a/drivers/gpu/drm/drm_panel.c -+++ b/drivers/gpu/drm/drm_panel.c -@@ -44,13 +44,21 @@ static LIST_HEAD(panel_list); - /** - * drm_panel_init - initialize a panel - * @panel: DRM panel -+ * @dev: parent device of the panel -+ * @funcs: panel operations -+ * @connector_type: the connector type (DRM_MODE_CONNECTOR_*) corresponding to -+ * the panel interface - * -- * Sets up internal fields of the panel so that it can subsequently be added -- * to the registry. -+ * Initialize the panel structure for subsequent registration with -+ * drm_panel_add(). - */ --void drm_panel_init(struct drm_panel *panel) -+void drm_panel_init(struct drm_panel *panel, struct device *dev, -+ const struct drm_panel_funcs *funcs, int connector_type) - { - INIT_LIST_HEAD(&panel->list); -+ panel->dev = dev; -+ panel->funcs = funcs; -+ panel->connector_type = connector_type; - } - EXPORT_SYMBOL(drm_panel_init); - -diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c -index dae6b33fc4c4a..dc5483b31c1ba 100644 ---- a/drivers/gpu/drm/i915/intel_uncore.c -+++ b/drivers/gpu/drm/i915/intel_uncore.c -@@ -1926,13 +1926,14 @@ int __intel_wait_for_register_fw(struct intel_uncore *uncore, - unsigned int slow_timeout_ms, - u32 *out_value) - { -- u32 reg_value; -+ u32 reg_value = 0; - #define done (((reg_value = intel_uncore_read_fw(uncore, reg)) & mask) == value) - int ret; - - /* Catch any overuse of this function */ - might_sleep_if(slow_timeout_ms); - GEM_BUG_ON(fast_timeout_us > 20000); -+ GEM_BUG_ON(!fast_timeout_us && !slow_timeout_ms); - - ret = -ETIMEDOUT; - if (fast_timeout_us && fast_timeout_us <= 20000) -diff --git a/drivers/gpu/drm/panel/panel-arm-versatile.c b/drivers/gpu/drm/panel/panel-arm-versatile.c -index 5f72c922a04b1..a0574dc03e16f 100644 ---- a/drivers/gpu/drm/panel/panel-arm-versatile.c -+++ b/drivers/gpu/drm/panel/panel-arm-versatile.c -@@ -350,9 +350,8 @@ static int versatile_panel_probe(struct platform_device *pdev) - dev_info(dev, "panel mounted on IB2 daughterboard\n"); - } - -- drm_panel_init(&vpanel->panel); -- vpanel->panel.dev = dev; -- vpanel->panel.funcs = &versatile_panel_drm_funcs; -+ drm_panel_init(&vpanel->panel, dev, &versatile_panel_drm_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - return drm_panel_add(&vpanel->panel); - } -diff --git a/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c b/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c -index dabf59e0f56fa..98f184b811873 100644 ---- a/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c -+++ b/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c -@@ -204,9 +204,8 @@ static int feiyang_dsi_probe(struct mipi_dsi_device *dsi) - mipi_dsi_set_drvdata(dsi, ctx); - ctx->dsi = dsi; - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = &dsi->dev; -- ctx->panel.funcs = &feiyang_funcs; -+ drm_panel_init(&ctx->panel, &dsi->dev, &feiyang_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - ctx->dvdd = devm_regulator_get(&dsi->dev, "dvdd"); - if (IS_ERR(ctx->dvdd)) { -diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9322.c b/drivers/gpu/drm/panel/panel-ilitek-ili9322.c -index 3c58f63adbf7e..24955bec1958b 100644 ---- a/drivers/gpu/drm/panel/panel-ilitek-ili9322.c -+++ b/drivers/gpu/drm/panel/panel-ilitek-ili9322.c -@@ -895,9 +895,8 @@ static int ili9322_probe(struct spi_device *spi) - ili->input = ili->conf->input; - } - -- drm_panel_init(&ili->panel); -- ili->panel.dev = dev; -- ili->panel.funcs = &ili9322_drm_funcs; -+ drm_panel_init(&ili->panel, dev, &ili9322_drm_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - return drm_panel_add(&ili->panel); - } -diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c -index 3ad4a46c4e945..e8789e460a169 100644 ---- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c -+++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c -@@ -433,9 +433,8 @@ static int ili9881c_dsi_probe(struct mipi_dsi_device *dsi) - mipi_dsi_set_drvdata(dsi, ctx); - ctx->dsi = dsi; - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = &dsi->dev; -- ctx->panel.funcs = &ili9881c_funcs; -+ drm_panel_init(&ctx->panel, &dsi->dev, &ili9881c_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - ctx->power = devm_regulator_get(&dsi->dev, "power"); - if (IS_ERR(ctx->power)) { -diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c -index df90b66079816..327fca97977ee 100644 ---- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c -+++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c -@@ -487,9 +487,8 @@ static int innolux_panel_add(struct mipi_dsi_device *dsi, - if (IS_ERR(innolux->backlight)) - return PTR_ERR(innolux->backlight); - -- drm_panel_init(&innolux->base); -- innolux->base.funcs = &innolux_panel_funcs; -- innolux->base.dev = dev; -+ drm_panel_init(&innolux->base, dev, &innolux_panel_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - err = drm_panel_add(&innolux->base); - if (err < 0) -diff --git a/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c b/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c -index ff3e89e61e3fc..56364a93f0b81 100644 ---- a/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c -+++ b/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c -@@ -437,9 +437,8 @@ static int jdi_panel_add(struct jdi_panel *jdi) - return ret; - } - -- drm_panel_init(&jdi->base); -- jdi->base.funcs = &jdi_panel_funcs; -- jdi->base.dev = &jdi->dsi->dev; -+ drm_panel_init(&jdi->base, &jdi->dsi->dev, &jdi_panel_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - ret = drm_panel_add(&jdi->base); - -diff --git a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c -index 1e7fecab72a9f..2c576e7eee72f 100644 ---- a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c -+++ b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c -@@ -391,9 +391,8 @@ static int kingdisplay_panel_add(struct kingdisplay_panel *kingdisplay) - if (IS_ERR(kingdisplay->backlight)) - return PTR_ERR(kingdisplay->backlight); - -- drm_panel_init(&kingdisplay->base); -- kingdisplay->base.funcs = &kingdisplay_panel_funcs; -- kingdisplay->base.dev = &kingdisplay->link->dev; -+ drm_panel_init(&kingdisplay->base, &kingdisplay->link->dev, -+ &kingdisplay_panel_funcs, DRM_MODE_CONNECTOR_DSI); - - return drm_panel_add(&kingdisplay->base); - } -diff --git a/drivers/gpu/drm/panel/panel-lg-lb035q02.c b/drivers/gpu/drm/panel/panel-lg-lb035q02.c -index ee4379729a5b8..7a1385e834f0e 100644 ---- a/drivers/gpu/drm/panel/panel-lg-lb035q02.c -+++ b/drivers/gpu/drm/panel/panel-lg-lb035q02.c -@@ -196,9 +196,8 @@ static int lb035q02_probe(struct spi_device *spi) - if (ret < 0) - return ret; - -- drm_panel_init(&lcd->panel); -- lcd->panel.dev = &lcd->spi->dev; -- lcd->panel.funcs = &lb035q02_funcs; -+ drm_panel_init(&lcd->panel, &lcd->spi->dev, &lb035q02_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - return drm_panel_add(&lcd->panel); - } -diff --git a/drivers/gpu/drm/panel/panel-lg-lg4573.c b/drivers/gpu/drm/panel/panel-lg-lg4573.c -index 41bf02d122a1f..db4865a4c2b98 100644 ---- a/drivers/gpu/drm/panel/panel-lg-lg4573.c -+++ b/drivers/gpu/drm/panel/panel-lg-lg4573.c -@@ -259,9 +259,8 @@ static int lg4573_probe(struct spi_device *spi) - return ret; - } - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = &spi->dev; -- ctx->panel.funcs = &lg4573_drm_funcs; -+ drm_panel_init(&ctx->panel, &spi->dev, &lg4573_drm_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - return drm_panel_add(&ctx->panel); - } -diff --git a/drivers/gpu/drm/panel/panel-lvds.c b/drivers/gpu/drm/panel/panel-lvds.c -index bf5fcc3e53791..2405f26e5d31f 100644 ---- a/drivers/gpu/drm/panel/panel-lvds.c -+++ b/drivers/gpu/drm/panel/panel-lvds.c -@@ -254,9 +254,8 @@ static int panel_lvds_probe(struct platform_device *pdev) - */ - - /* Register the panel. */ -- drm_panel_init(&lvds->panel); -- lvds->panel.dev = lvds->dev; -- lvds->panel.funcs = &panel_lvds_funcs; -+ drm_panel_init(&lvds->panel, lvds->dev, &panel_lvds_funcs, -+ DRM_MODE_CONNECTOR_LVDS); - - ret = drm_panel_add(&lvds->panel); - if (ret < 0) -diff --git a/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c b/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c -index 20f17e46e65da..fd593532ab23c 100644 ---- a/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c -+++ b/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c -@@ -205,9 +205,8 @@ static int nl8048_probe(struct spi_device *spi) - if (ret < 0) - return ret; - -- drm_panel_init(&lcd->panel); -- lcd->panel.dev = &lcd->spi->dev; -- lcd->panel.funcs = &nl8048_funcs; -+ drm_panel_init(&lcd->panel, &lcd->spi->dev, &nl8048_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - return drm_panel_add(&lcd->panel); - } -diff --git a/drivers/gpu/drm/panel/panel-novatek-nt39016.c b/drivers/gpu/drm/panel/panel-novatek-nt39016.c -index 2ad1063b068d5..60ccedce530c2 100644 ---- a/drivers/gpu/drm/panel/panel-novatek-nt39016.c -+++ b/drivers/gpu/drm/panel/panel-novatek-nt39016.c -@@ -292,9 +292,8 @@ static int nt39016_probe(struct spi_device *spi) - return err; - } - -- drm_panel_init(&panel->drm_panel); -- panel->drm_panel.dev = dev; -- panel->drm_panel.funcs = &nt39016_funcs; -+ drm_panel_init(&panel->drm_panel, dev, &nt39016_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - err = drm_panel_add(&panel->drm_panel); - if (err < 0) { -diff --git a/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c b/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c -index 2bae1db3ff344..f2a72ee6ee07d 100644 ---- a/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c -+++ b/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c -@@ -288,9 +288,8 @@ static int lcd_olinuxino_probe(struct i2c_client *client, - if (IS_ERR(lcd->backlight)) - return PTR_ERR(lcd->backlight); - -- drm_panel_init(&lcd->panel); -- lcd->panel.dev = dev; -- lcd->panel.funcs = &lcd_olinuxino_funcs; -+ drm_panel_init(&lcd->panel, dev, &lcd_olinuxino_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - return drm_panel_add(&lcd->panel); - } -diff --git a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c -index 3ee265f1755f4..938826f326658 100644 ---- a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c -+++ b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c -@@ -455,9 +455,8 @@ static int otm8009a_probe(struct mipi_dsi_device *dsi) - dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST | - MIPI_DSI_MODE_LPM; - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = dev; -- ctx->panel.funcs = &otm8009a_drm_funcs; -+ drm_panel_init(&ctx->panel, dev, &otm8009a_drm_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - ctx->bl_dev = devm_backlight_device_register(dev, dev_name(dev), - dev, ctx, -diff --git a/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c b/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c -index e0e20ecff916d..2b40913899d88 100644 ---- a/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c -+++ b/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c -@@ -166,9 +166,8 @@ static int osd101t2587_panel_add(struct osd101t2587_panel *osd101t2587) - if (IS_ERR(osd101t2587->backlight)) - return PTR_ERR(osd101t2587->backlight); - -- drm_panel_init(&osd101t2587->base); -- osd101t2587->base.funcs = &osd101t2587_panel_funcs; -- osd101t2587->base.dev = &osd101t2587->dsi->dev; -+ drm_panel_init(&osd101t2587->base, &osd101t2587->dsi->dev, -+ &osd101t2587_panel_funcs, DRM_MODE_CONNECTOR_DSI); - - return drm_panel_add(&osd101t2587->base); - } -diff --git a/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c b/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c -index 3dff0b3f73c23..664605071d342 100644 ---- a/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c -+++ b/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c -@@ -223,9 +223,8 @@ static int wuxga_nt_panel_add(struct wuxga_nt_panel *wuxga_nt) - return -EPROBE_DEFER; - } - -- drm_panel_init(&wuxga_nt->base); -- wuxga_nt->base.funcs = &wuxga_nt_panel_funcs; -- wuxga_nt->base.dev = &wuxga_nt->dsi->dev; -+ drm_panel_init(&wuxga_nt->base, &wuxga_nt->dsi->dev, -+ &wuxga_nt_panel_funcs, DRM_MODE_CONNECTOR_DSI); - - ret = drm_panel_add(&wuxga_nt->base); - if (ret < 0) -diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c -index a621dd28ff70d..2ccb74debc8ab 100644 ---- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c -+++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c -@@ -433,9 +433,8 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c, - return PTR_ERR(ts->dsi); - } - -- drm_panel_init(&ts->base); -- ts->base.dev = dev; -- ts->base.funcs = &rpi_touchscreen_funcs; -+ drm_panel_init(&ts->base, dev, &rpi_touchscreen_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - /* This appears last, as it's what will unblock the DSI host - * driver's component bind function. -diff --git a/drivers/gpu/drm/panel/panel-raydium-rm67191.c b/drivers/gpu/drm/panel/panel-raydium-rm67191.c -index 6a5d37006103e..fd67fc6185c4f 100644 ---- a/drivers/gpu/drm/panel/panel-raydium-rm67191.c -+++ b/drivers/gpu/drm/panel/panel-raydium-rm67191.c -@@ -606,9 +606,8 @@ static int rad_panel_probe(struct mipi_dsi_device *dsi) - if (ret) - return ret; - -- drm_panel_init(&panel->panel); -- panel->panel.funcs = &rad_panel_funcs; -- panel->panel.dev = dev; -+ drm_panel_init(&panel->panel, dev, &rad_panel_funcs, -+ DRM_MODE_CONNECTOR_DSI); - dev_set_drvdata(dev, panel); - - ret = drm_panel_add(&panel->panel); -diff --git a/drivers/gpu/drm/panel/panel-raydium-rm68200.c b/drivers/gpu/drm/panel/panel-raydium-rm68200.c -index ba889625ad435..994e855721f4b 100644 ---- a/drivers/gpu/drm/panel/panel-raydium-rm68200.c -+++ b/drivers/gpu/drm/panel/panel-raydium-rm68200.c -@@ -404,9 +404,8 @@ static int rm68200_probe(struct mipi_dsi_device *dsi) - dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST | - MIPI_DSI_MODE_LPM; - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = dev; -- ctx->panel.funcs = &rm68200_drm_funcs; -+ drm_panel_init(&ctx->panel, dev, &rm68200_drm_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - drm_panel_add(&ctx->panel); - -diff --git a/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c b/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c -index b9109922397ff..31234b79d3b1a 100644 ---- a/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c -+++ b/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c -@@ -343,9 +343,8 @@ static int jh057n_probe(struct mipi_dsi_device *dsi) - return ret; - } - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = dev; -- ctx->panel.funcs = &jh057n_drm_funcs; -+ drm_panel_init(&ctx->panel, dev, &jh057n_drm_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - drm_panel_add(&ctx->panel); - -diff --git a/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c b/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c -index 3c15764f0c039..170a5cda21b93 100644 ---- a/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c -+++ b/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c -@@ -173,9 +173,8 @@ static int rb070d30_panel_dsi_probe(struct mipi_dsi_device *dsi) - mipi_dsi_set_drvdata(dsi, ctx); - ctx->dsi = dsi; - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = &dsi->dev; -- ctx->panel.funcs = &rb070d30_panel_funcs; -+ drm_panel_init(&ctx->panel, &dsi->dev, &rb070d30_panel_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - ctx->gpios.reset = devm_gpiod_get(&dsi->dev, "reset", GPIOD_OUT_LOW); - if (IS_ERR(ctx->gpios.reset)) { -diff --git a/drivers/gpu/drm/panel/panel-samsung-ld9040.c b/drivers/gpu/drm/panel/panel-samsung-ld9040.c -index 3be902dcedc02..250809ba37c7e 100644 ---- a/drivers/gpu/drm/panel/panel-samsung-ld9040.c -+++ b/drivers/gpu/drm/panel/panel-samsung-ld9040.c -@@ -351,9 +351,8 @@ static int ld9040_probe(struct spi_device *spi) - return ret; - } - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = dev; -- ctx->panel.funcs = &ld9040_drm_funcs; -+ drm_panel_init(&ctx->panel, dev, &ld9040_drm_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - return drm_panel_add(&ctx->panel); - } -diff --git a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c -index f75bef24e0504..e3a0397e953ee 100644 ---- a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c -+++ b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c -@@ -215,9 +215,8 @@ static int s6d16d0_probe(struct mipi_dsi_device *dsi) - return ret; - } - -- drm_panel_init(&s6->panel); -- s6->panel.dev = dev; -- s6->panel.funcs = &s6d16d0_drm_funcs; -+ drm_panel_init(&s6->panel, dev, &s6d16d0_drm_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - ret = drm_panel_add(&s6->panel); - if (ret < 0) -diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c -index b923de23ed654..938ab72c55404 100644 ---- a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c -+++ b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c -@@ -732,9 +732,8 @@ static int s6e3ha2_probe(struct mipi_dsi_device *dsi) - ctx->bl_dev->props.brightness = S6E3HA2_DEFAULT_BRIGHTNESS; - ctx->bl_dev->props.power = FB_BLANK_POWERDOWN; - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = dev; -- ctx->panel.funcs = &s6e3ha2_drm_funcs; -+ drm_panel_init(&ctx->panel, dev, &s6e3ha2_drm_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - ret = drm_panel_add(&ctx->panel); - if (ret < 0) -diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c -index cd90fa700c493..a60635e9226da 100644 ---- a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c -+++ b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c -@@ -466,9 +466,8 @@ static int s6e63j0x03_probe(struct mipi_dsi_device *dsi) - return PTR_ERR(ctx->reset_gpio); - } - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = dev; -- ctx->panel.funcs = &s6e63j0x03_funcs; -+ drm_panel_init(&ctx->panel, dev, &s6e63j0x03_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - ctx->bl_dev = backlight_device_register("s6e63j0x03", dev, ctx, - &s6e63j0x03_bl_ops, NULL); -diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c -index 142d395ea5129..ba01af0b14fd3 100644 ---- a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c -+++ b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c -@@ -473,9 +473,8 @@ static int s6e63m0_probe(struct spi_device *spi) - return ret; - } - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = dev; -- ctx->panel.funcs = &s6e63m0_drm_funcs; -+ drm_panel_init(&ctx->panel, dev, &s6e63m0_drm_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - ret = s6e63m0_backlight_register(ctx); - if (ret < 0) -diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c -index 81858267723ad..dbced65012045 100644 ---- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c -+++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c -@@ -1017,9 +1017,8 @@ static int s6e8aa0_probe(struct mipi_dsi_device *dsi) - - ctx->brightness = GAMMA_LEVEL_NUM - 1; - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = dev; -- ctx->panel.funcs = &s6e8aa0_drm_funcs; -+ drm_panel_init(&ctx->panel, dev, &s6e8aa0_drm_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - ret = drm_panel_add(&ctx->panel); - if (ret < 0) -diff --git a/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c b/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c -index 18b22b1294fbc..b3619ba443bd2 100644 ---- a/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c -+++ b/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c -@@ -274,9 +274,8 @@ static int seiko_panel_probe(struct device *dev, - return -EPROBE_DEFER; - } - -- drm_panel_init(&panel->base); -- panel->base.dev = dev; -- panel->base.funcs = &seiko_panel_funcs; -+ drm_panel_init(&panel->base, dev, &seiko_panel_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - err = drm_panel_add(&panel->base); - if (err < 0) -diff --git a/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c b/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c -index e910b4ad13104..5e136c3ba1850 100644 ---- a/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c -+++ b/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c -@@ -329,9 +329,8 @@ static int sharp_panel_add(struct sharp_panel *sharp) - if (IS_ERR(sharp->backlight)) - return PTR_ERR(sharp->backlight); - -- drm_panel_init(&sharp->base); -- sharp->base.funcs = &sharp_panel_funcs; -- sharp->base.dev = &sharp->link1->dev; -+ drm_panel_init(&sharp->base, &sharp->link1->dev, &sharp_panel_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - return drm_panel_add(&sharp->base); - } -diff --git a/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c b/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c -index 46cd9a2501298..eeab7998c7de4 100644 ---- a/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c -+++ b/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c -@@ -185,9 +185,8 @@ static int ls037v7dw01_probe(struct platform_device *pdev) - return PTR_ERR(lcd->ud_gpio); - } - -- drm_panel_init(&lcd->panel); -- lcd->panel.dev = &pdev->dev; -- lcd->panel.funcs = &ls037v7dw01_funcs; -+ drm_panel_init(&lcd->panel, &pdev->dev, &ls037v7dw01_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - return drm_panel_add(&lcd->panel); - } -diff --git a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c -index c39abde9f9f10..b963ba4ab5898 100644 ---- a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c -+++ b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c -@@ -264,9 +264,8 @@ static int sharp_nt_panel_add(struct sharp_nt_panel *sharp_nt) - if (IS_ERR(sharp_nt->backlight)) - return PTR_ERR(sharp_nt->backlight); - -- drm_panel_init(&sharp_nt->base); -- sharp_nt->base.funcs = &sharp_nt_panel_funcs; -- sharp_nt->base.dev = &sharp_nt->dsi->dev; -+ drm_panel_init(&sharp_nt->base, &sharp_nt->dsi->dev, -+ &sharp_nt_panel_funcs, DRM_MODE_CONNECTOR_DSI); - - return drm_panel_add(&sharp_nt->base); - } -diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c -index 312a3c4e23318..a87b79c8d76f7 100644 ---- a/drivers/gpu/drm/panel/panel-simple.c -+++ b/drivers/gpu/drm/panel/panel-simple.c -@@ -94,6 +94,7 @@ struct panel_desc { - - u32 bus_format; - u32 bus_flags; -+ int connector_type; - }; - - struct panel_simple { -@@ -464,9 +465,8 @@ static int panel_simple_probe(struct device *dev, const struct panel_desc *desc) - if (!of_get_display_timing(dev->of_node, "panel-timing", &dt)) - panel_simple_parse_panel_timing_node(dev, panel, &dt); - -- drm_panel_init(&panel->base); -- panel->base.dev = dev; -- panel->base.funcs = &panel_simple_funcs; -+ drm_panel_init(&panel->base, dev, &panel_simple_funcs, -+ desc->connector_type); - - err = drm_panel_add(&panel->base); - if (err < 0) -@@ -531,8 +531,8 @@ static const struct panel_desc ampire_am_480272h3tmqw_t01h = { - .num_modes = 1, - .bpc = 8, - .size = { -- .width = 105, -- .height = 67, -+ .width = 99, -+ .height = 58, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X24, - }; -@@ -833,6 +833,7 @@ static const struct panel_desc auo_g133han01 = { - .unprepare = 1000, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing auo_g185han01_timings = { -@@ -862,6 +863,7 @@ static const struct panel_desc auo_g185han01 = { - .unprepare = 1000, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing auo_p320hvn03_timings = { -@@ -890,6 +892,7 @@ static const struct panel_desc auo_p320hvn03 = { - .unprepare = 500, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode auo_t215hvn01_mode = { -@@ -1205,6 +1208,7 @@ static const struct panel_desc dlc_dlc0700yzg_1 = { - .disable = 200, - }, - .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing dlc_dlc1010gig_timing = { -@@ -1235,6 +1239,7 @@ static const struct panel_desc dlc_dlc1010gig = { - .unprepare = 60, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode edt_et035012dm6_mode = { -@@ -1501,6 +1506,7 @@ static const struct panel_desc hannstar_hsd070pww1 = { - .height = 94, - }, - .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing hannstar_hsd100pxn1_timing = { -@@ -1525,6 +1531,7 @@ static const struct panel_desc hannstar_hsd100pxn1 = { - .height = 152, - }, - .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode hitachi_tx23d38vm0caa_mode = { -@@ -1577,6 +1584,7 @@ static const struct panel_desc innolux_at043tn24 = { - .height = 54, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X24, -+ .connector_type = DRM_MODE_CONNECTOR_DPI, - .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE, - }; - -@@ -1631,6 +1639,7 @@ static const struct panel_desc innolux_g070y2_l01 = { - .unprepare = 800, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing innolux_g101ice_l01_timing = { -@@ -1659,6 +1668,7 @@ static const struct panel_desc innolux_g101ice_l01 = { - .disable = 200, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing innolux_g121i1_l01_timing = { -@@ -1686,6 +1696,7 @@ static const struct panel_desc innolux_g121i1_l01 = { - .disable = 20, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode innolux_g121x1_l03_mode = { -@@ -1869,6 +1880,7 @@ static const struct panel_desc koe_tx31d200vm0baa = { - .height = 109, - }, - .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing kyo_tcg121xglp_timing = { -@@ -1893,6 +1905,7 @@ static const struct panel_desc kyo_tcg121xglp = { - .height = 184, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode lemaker_bl035_rgb_002_mode = { -@@ -1941,6 +1954,7 @@ static const struct panel_desc lg_lb070wv8 = { - .height = 91, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode lg_lp079qx1_sp0v_mode = { -@@ -2097,6 +2111,7 @@ static const struct panel_desc mitsubishi_aa070mc01 = { - .disable = 400, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - .bus_flags = DRM_BUS_FLAG_DE_HIGH, - }; - -@@ -2125,6 +2140,7 @@ static const struct panel_desc nec_nl12880bc20_05 = { - .disable = 50, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode nec_nl4827hc19_05b_mode = { -@@ -2227,6 +2243,7 @@ static const struct panel_desc nlt_nl192108ac18_02d = { - .unprepare = 500, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode nvd_9128_mode = { -@@ -2250,6 +2267,7 @@ static const struct panel_desc nvd_9128 = { - .height = 88, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing okaya_rs800480t_7x0gp_timing = { -@@ -2662,6 +2680,7 @@ static const struct panel_desc sharp_lq101k1ly04 = { - .height = 136, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing sharp_lq123p1jx31_timing = { -@@ -2841,6 +2860,7 @@ static const struct panel_desc tianma_tm070jdhg30 = { - .height = 95, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct display_timing tianma_tm070rvhg71_timing = { -@@ -2865,6 +2885,7 @@ static const struct panel_desc tianma_tm070rvhg71 = { - .height = 86, - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode ti_nspire_cx_lcd_mode[] = { -@@ -2947,6 +2968,7 @@ static const struct panel_desc toshiba_lt089ac29000 = { - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X24, - .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct drm_display_mode tpk_f07a_0102_mode = { -@@ -3017,6 +3039,7 @@ static const struct panel_desc urt_umsh_8596md_lvds = { - .height = 91, - }, - .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, -+ .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - - static const struct panel_desc urt_umsh_8596md_parallel = { -diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7701.c b/drivers/gpu/drm/panel/panel-sitronix-st7701.c -index 638f605acb2db..1d2fd6cc66740 100644 ---- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c -+++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c -@@ -369,7 +369,8 @@ static int st7701_dsi_probe(struct mipi_dsi_device *dsi) - if (IS_ERR(st7701->backlight)) - return PTR_ERR(st7701->backlight); - -- drm_panel_init(&st7701->panel); -+ drm_panel_init(&st7701->panel, &dsi->dev, &st7701_funcs, -+ DRM_MODE_CONNECTOR_DSI); - - /** - * Once sleep out has been issued, ST7701 IC required to wait 120ms -@@ -381,8 +382,6 @@ static int st7701_dsi_probe(struct mipi_dsi_device *dsi) - * ts8550b and there is no valid documentation for that. - */ - st7701->sleep_delay = 120 + desc->panel_sleep_delay; -- st7701->panel.funcs = &st7701_funcs; -- st7701->panel.dev = &dsi->dev; - - ret = drm_panel_add(&st7701->panel); - if (ret < 0) -diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c -index 3b2612ae931e8..108a85bb66672 100644 ---- a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c -+++ b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c -@@ -381,9 +381,8 @@ static int st7789v_probe(struct spi_device *spi) - spi_set_drvdata(spi, ctx); - ctx->spi = spi; - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = &spi->dev; -- ctx->panel.funcs = &st7789v_drm_funcs; -+ drm_panel_init(&ctx->panel, &spi->dev, &st7789v_drm_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - ctx->power = devm_regulator_get(&spi->dev, "power"); - if (IS_ERR(ctx->power)) -diff --git a/drivers/gpu/drm/panel/panel-sony-acx565akm.c b/drivers/gpu/drm/panel/panel-sony-acx565akm.c -index 3d5b9c4f68d98..d6387d8f88a3f 100644 ---- a/drivers/gpu/drm/panel/panel-sony-acx565akm.c -+++ b/drivers/gpu/drm/panel/panel-sony-acx565akm.c -@@ -648,9 +648,8 @@ static int acx565akm_probe(struct spi_device *spi) - return ret; - } - -- drm_panel_init(&lcd->panel); -- lcd->panel.dev = &lcd->spi->dev; -- lcd->panel.funcs = &acx565akm_funcs; -+ drm_panel_init(&lcd->panel, &lcd->spi->dev, &acx565akm_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - ret = drm_panel_add(&lcd->panel); - if (ret < 0) { -diff --git a/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c b/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c -index f2baff827f507..c44d6a65c0aa2 100644 ---- a/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c -+++ b/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c -@@ -347,9 +347,8 @@ static int td028ttec1_probe(struct spi_device *spi) - return ret; - } - -- drm_panel_init(&lcd->panel); -- lcd->panel.dev = &lcd->spi->dev; -- lcd->panel.funcs = &td028ttec1_funcs; -+ drm_panel_init(&lcd->panel, &lcd->spi->dev, &td028ttec1_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - return drm_panel_add(&lcd->panel); - } -diff --git a/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c b/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c -index ba163c779084c..621b65feec070 100644 ---- a/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c -+++ b/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c -@@ -458,9 +458,8 @@ static int td043mtea1_probe(struct spi_device *spi) - return ret; - } - -- drm_panel_init(&lcd->panel); -- lcd->panel.dev = &lcd->spi->dev; -- lcd->panel.funcs = &td043mtea1_funcs; -+ drm_panel_init(&lcd->panel, &lcd->spi->dev, &td043mtea1_funcs, -+ DRM_MODE_CONNECTOR_DPI); - - ret = drm_panel_add(&lcd->panel); - if (ret < 0) { -diff --git a/drivers/gpu/drm/panel/panel-tpo-tpg110.c b/drivers/gpu/drm/panel/panel-tpo-tpg110.c -index 71591e5f59383..1a5418ae2ccf3 100644 ---- a/drivers/gpu/drm/panel/panel-tpo-tpg110.c -+++ b/drivers/gpu/drm/panel/panel-tpo-tpg110.c -@@ -457,9 +457,8 @@ static int tpg110_probe(struct spi_device *spi) - if (ret) - return ret; - -- drm_panel_init(&tpg->panel); -- tpg->panel.dev = dev; -- tpg->panel.funcs = &tpg110_drm_funcs; -+ drm_panel_init(&tpg->panel, dev, &tpg110_drm_funcs, -+ DRM_MODE_CONNECTOR_DPI); - spi_set_drvdata(spi, tpg); - - return drm_panel_add(&tpg->panel); -diff --git a/drivers/gpu/drm/panel/panel-truly-nt35597.c b/drivers/gpu/drm/panel/panel-truly-nt35597.c -index 77e1311b7c692..0feea2456e14b 100644 ---- a/drivers/gpu/drm/panel/panel-truly-nt35597.c -+++ b/drivers/gpu/drm/panel/panel-truly-nt35597.c -@@ -518,9 +518,8 @@ static int truly_nt35597_panel_add(struct truly_nt35597 *ctx) - /* dual port */ - gpiod_set_value(ctx->mode_gpio, 0); - -- drm_panel_init(&ctx->panel); -- ctx->panel.dev = dev; -- ctx->panel.funcs = &truly_nt35597_drm_funcs; -+ drm_panel_init(&ctx->panel, dev, &truly_nt35597_drm_funcs, -+ DRM_MODE_CONNECTOR_DSI); - drm_panel_add(&ctx->panel); - - return 0; -diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c -index 1e62e7bbf1b1d..5403f4c902b64 100644 ---- a/drivers/gpu/drm/radeon/ci_dpm.c -+++ b/drivers/gpu/drm/radeon/ci_dpm.c -@@ -5556,6 +5556,7 @@ static int ci_parse_power_table(struct radeon_device *rdev) - u8 frev, crev; - u8 *power_state_offset; - struct ci_ps *ps; -+ int ret; - - if (!atom_parse_data_header(mode_info->atom_context, index, NULL, - &frev, &crev, &data_offset)) -@@ -5585,11 +5586,15 @@ static int ci_parse_power_table(struct radeon_device *rdev) - non_clock_array_index = power_state->v2.nonClockInfoIndex; - non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) - &non_clock_info_array->nonClockInfo[non_clock_array_index]; -- if (!rdev->pm.power_state[i].clock_info) -- return -EINVAL; -+ if (!rdev->pm.power_state[i].clock_info) { -+ ret = -EINVAL; -+ goto err_free_ps; -+ } - ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL); -- if (ps == NULL) -- return -ENOMEM; -+ if (ps == NULL) { -+ ret = -ENOMEM; -+ goto err_free_ps; -+ } - rdev->pm.dpm.ps[i].ps_priv = ps; - ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], - non_clock_info, -@@ -5629,6 +5634,12 @@ static int ci_parse_power_table(struct radeon_device *rdev) - } - - return 0; -+ -+err_free_ps: -+ for (i = 0; i < rdev->pm.dpm.num_ps; i++) -+ kfree(rdev->pm.dpm.ps[i].ps_priv); -+ kfree(rdev->pm.dpm.ps); -+ return ret; - } - - static int ci_get_vbios_boot_values(struct radeon_device *rdev, -@@ -5717,25 +5728,26 @@ int ci_dpm_init(struct radeon_device *rdev) - - ret = ci_get_vbios_boot_values(rdev, &pi->vbios_boot_state); - if (ret) { -- ci_dpm_fini(rdev); -+ kfree(rdev->pm.dpm.priv); - return ret; - } - - ret = r600_get_platform_caps(rdev); - if (ret) { -- ci_dpm_fini(rdev); -+ kfree(rdev->pm.dpm.priv); - return ret; - } - - ret = r600_parse_extended_power_table(rdev); - if (ret) { -- ci_dpm_fini(rdev); -+ kfree(rdev->pm.dpm.priv); - return ret; - } - - ret = ci_parse_power_table(rdev); - if (ret) { -- ci_dpm_fini(rdev); -+ kfree(rdev->pm.dpm.priv); -+ r600_free_extended_power_table(rdev); - return ret; - } - -diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c -index 32ed60f1048bd..b31d65a6752f1 100644 ---- a/drivers/gpu/drm/radeon/cypress_dpm.c -+++ b/drivers/gpu/drm/radeon/cypress_dpm.c -@@ -559,8 +559,12 @@ static int cypress_populate_mclk_value(struct radeon_device *rdev, - ASIC_INTERNAL_MEMORY_SS, vco_freq)) { - u32 reference_clock = rdev->clock.mpll.reference_freq; - u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div); -- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate); -- u32 clk_v = ss.percentage * -+ u32 clk_s, clk_v; -+ -+ if (!decoded_ref) -+ return -EINVAL; -+ clk_s = reference_clock * 5 / (decoded_ref * ss.rate); -+ clk_v = ss.percentage * - (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625); - - mpll_ss1 &= ~CLKV_MASK; -diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c -index 288ec3039bc2c..cad7a73a551f7 100644 ---- a/drivers/gpu/drm/radeon/ni_dpm.c -+++ b/drivers/gpu/drm/radeon/ni_dpm.c -@@ -2241,8 +2241,12 @@ static int ni_populate_mclk_value(struct radeon_device *rdev, - ASIC_INTERNAL_MEMORY_SS, vco_freq)) { - u32 reference_clock = rdev->clock.mpll.reference_freq; - u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div); -- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate); -- u32 clk_v = ss.percentage * -+ u32 clk_s, clk_v; -+ -+ if (!decoded_ref) -+ return -EINVAL; -+ clk_s = reference_clock * 5 / (decoded_ref * ss.rate); -+ clk_v = ss.percentage * - (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625); - - mpll_ss1 &= ~CLKV_MASK; -diff --git a/drivers/gpu/drm/radeon/rv740_dpm.c b/drivers/gpu/drm/radeon/rv740_dpm.c -index 327d65a76e1f4..79b2de65e905e 100644 ---- a/drivers/gpu/drm/radeon/rv740_dpm.c -+++ b/drivers/gpu/drm/radeon/rv740_dpm.c -@@ -250,8 +250,12 @@ int rv740_populate_mclk_value(struct radeon_device *rdev, - ASIC_INTERNAL_MEMORY_SS, vco_freq)) { - u32 reference_clock = rdev->clock.mpll.reference_freq; - u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div); -- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate); -- u32 clk_v = 0x40000 * ss.percentage * -+ u32 clk_s, clk_v; -+ -+ if (!decoded_ref) -+ return -EINVAL; -+ clk_s = reference_clock * 5 / (decoded_ref * ss.rate); -+ clk_v = 0x40000 * ss.percentage * - (dividers.whole_fb_div + (dividers.frac_fb_div / 8)) / (clk_s * 10000); - - mpll_ss1 &= ~CLKV_MASK; -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -index 57e0396662c34..1795adbd81d38 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -@@ -654,13 +654,13 @@ static void vop_crtc_atomic_disable(struct drm_crtc *crtc, - if (crtc->state->self_refresh_active) - rockchip_drm_set_win_enabled(crtc, false); - -+ if (crtc->state->self_refresh_active) -+ goto out; -+ - mutex_lock(&vop->vop_lock); - - drm_crtc_vblank_off(crtc); - -- if (crtc->state->self_refresh_active) -- goto out; -- - /* - * Vop standby will take effect at end of current frame, - * if dsp hold valid irq happen, it means standby complete. -@@ -692,9 +692,9 @@ static void vop_crtc_atomic_disable(struct drm_crtc *crtc, - vop_core_clks_disable(vop); - pm_runtime_put(vop->dev); - --out: - mutex_unlock(&vop->vop_lock); - -+out: - if (crtc->state->event && !crtc->state->active) { - spin_lock_irq(&crtc->dev->event_lock); - drm_crtc_send_vblank_event(crtc, crtc->state->event); -diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c -index eb3b2350687fb..193c7f979bcaa 100644 ---- a/drivers/gpu/drm/sun4i/sun4i_tcon.c -+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c -@@ -753,21 +753,19 @@ static irqreturn_t sun4i_tcon_handler(int irq, void *private) - static int sun4i_tcon_init_clocks(struct device *dev, - struct sun4i_tcon *tcon) - { -- tcon->clk = devm_clk_get(dev, "ahb"); -+ tcon->clk = devm_clk_get_enabled(dev, "ahb"); - if (IS_ERR(tcon->clk)) { - dev_err(dev, "Couldn't get the TCON bus clock\n"); - return PTR_ERR(tcon->clk); - } -- clk_prepare_enable(tcon->clk); - - if (tcon->quirks->has_channel_0) { -- tcon->sclk0 = devm_clk_get(dev, "tcon-ch0"); -+ tcon->sclk0 = devm_clk_get_enabled(dev, "tcon-ch0"); - if (IS_ERR(tcon->sclk0)) { - dev_err(dev, "Couldn't get the TCON channel 0 clock\n"); - return PTR_ERR(tcon->sclk0); - } - } -- clk_prepare_enable(tcon->sclk0); - - if (tcon->quirks->has_channel_1) { - tcon->sclk1 = devm_clk_get(dev, "tcon-ch1"); -@@ -780,12 +778,6 @@ static int sun4i_tcon_init_clocks(struct device *dev, - return 0; - } - --static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon) --{ -- clk_disable_unprepare(tcon->sclk0); -- clk_disable_unprepare(tcon->clk); --} -- - static int sun4i_tcon_init_irq(struct device *dev, - struct sun4i_tcon *tcon) - { -@@ -1202,14 +1194,14 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master, - ret = sun4i_tcon_init_regmap(dev, tcon); - if (ret) { - dev_err(dev, "Couldn't init our TCON regmap\n"); -- goto err_free_clocks; -+ goto err_assert_reset; - } - - if (tcon->quirks->has_channel_0) { - ret = sun4i_dclk_create(dev, tcon); - if (ret) { - dev_err(dev, "Couldn't create our TCON dot clock\n"); -- goto err_free_clocks; -+ goto err_assert_reset; - } - } - -@@ -1272,8 +1264,6 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master, - err_free_dotclock: - if (tcon->quirks->has_channel_0) - sun4i_dclk_free(tcon); --err_free_clocks: -- sun4i_tcon_free_clocks(tcon); - err_assert_reset: - reset_control_assert(tcon->lcd_rst); - return ret; -@@ -1287,7 +1277,6 @@ static void sun4i_tcon_unbind(struct device *dev, struct device *master, - list_del(&tcon->list); - if (tcon->quirks->has_channel_0) - sun4i_dclk_free(tcon); -- sun4i_tcon_free_clocks(tcon); - } - - static const struct component_ops sun4i_tcon_ops = { -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 75761939f02bd..28da9b4087c3b 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -1307,7 +1307,7 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom) - struct input_dev *pen_input = wacom->pen_input; - unsigned char *data = wacom->data; - int number_of_valid_frames = 0; -- int time_interval = 15000000; -+ ktime_t time_interval = 15000000; - ktime_t time_packet_received = ktime_get(); - int i; - -@@ -1341,7 +1341,7 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom) - if (number_of_valid_frames) { - if (wacom->hid_data.time_delayed) - time_interval = ktime_get() - wacom->hid_data.time_delayed; -- time_interval /= number_of_valid_frames; -+ time_interval = div_u64(time_interval, number_of_valid_frames); - wacom->hid_data.time_delayed = time_packet_received; - } - -@@ -1352,7 +1352,7 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom) - bool range = frame[0] & 0x20; - bool invert = frame[0] & 0x10; - int frames_number_reversed = number_of_valid_frames - i - 1; -- int event_timestamp = time_packet_received - frames_number_reversed * time_interval; -+ ktime_t event_timestamp = time_packet_received - frames_number_reversed * time_interval; - - if (!valid) - continue; -diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h -index 88badfbae999c..166731292c359 100644 ---- a/drivers/hid/wacom_wac.h -+++ b/drivers/hid/wacom_wac.h -@@ -320,7 +320,7 @@ struct hid_data { - int bat_connected; - int ps_connected; - bool pad_input_event_flag; -- int time_delayed; -+ ktime_t time_delayed; - }; - - struct wacom_remote_data { -diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c -index c92ea6990ec69..6bcb46cc28cdf 100644 ---- a/drivers/i2c/busses/i2c-xiic.c -+++ b/drivers/i2c/busses/i2c-xiic.c -@@ -353,6 +353,9 @@ static irqreturn_t xiic_process(int irq, void *dev_id) - struct xiic_i2c *i2c = dev_id; - u32 pend, isr, ier; - u32 clr = 0; -+ int xfer_more = 0; -+ int wakeup_req = 0; -+ int wakeup_code = 0; - - /* Get the interrupt Status from the IPIF. There is no clearing of - * interrupts in the IPIF. Interrupts must be cleared at the source. -@@ -389,10 +392,16 @@ static irqreturn_t xiic_process(int irq, void *dev_id) - */ - xiic_reinit(i2c); - -- if (i2c->rx_msg) -- xiic_wakeup(i2c, STATE_ERROR); -- if (i2c->tx_msg) -- xiic_wakeup(i2c, STATE_ERROR); -+ if (i2c->rx_msg) { -+ wakeup_req = 1; -+ wakeup_code = STATE_ERROR; -+ } -+ if (i2c->tx_msg) { -+ wakeup_req = 1; -+ wakeup_code = STATE_ERROR; -+ } -+ /* don't try to handle other events */ -+ goto out; - } - if (pend & XIIC_INTR_RX_FULL_MASK) { - /* Receive register/FIFO is full */ -@@ -426,8 +435,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id) - i2c->tx_msg++; - dev_dbg(i2c->adap.dev.parent, - "%s will start next...\n", __func__); -- -- __xiic_start_xfer(i2c); -+ xfer_more = 1; - } - } - } -@@ -441,11 +449,13 @@ static irqreturn_t xiic_process(int irq, void *dev_id) - if (!i2c->tx_msg) - goto out; - -- if ((i2c->nmsgs == 1) && !i2c->rx_msg && -- xiic_tx_space(i2c) == 0) -- xiic_wakeup(i2c, STATE_DONE); -+ wakeup_req = 1; -+ -+ if (i2c->nmsgs == 1 && !i2c->rx_msg && -+ xiic_tx_space(i2c) == 0) -+ wakeup_code = STATE_DONE; - else -- xiic_wakeup(i2c, STATE_ERROR); -+ wakeup_code = STATE_ERROR; - } - if (pend & (XIIC_INTR_TX_EMPTY_MASK | XIIC_INTR_TX_HALF_MASK)) { - /* Transmit register/FIFO is empty or ½ empty */ -@@ -469,7 +479,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id) - if (i2c->nmsgs > 1) { - i2c->nmsgs--; - i2c->tx_msg++; -- __xiic_start_xfer(i2c); -+ xfer_more = 1; - } else { - xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK); - -@@ -487,6 +497,13 @@ out: - dev_dbg(i2c->adap.dev.parent, "%s clr: 0x%x\n", __func__, clr); - - xiic_setreg32(i2c, XIIC_IISR_OFFSET, clr); -+ if (xfer_more) -+ __xiic_start_xfer(i2c); -+ if (wakeup_req) -+ xiic_wakeup(i2c, wakeup_code); -+ -+ WARN_ON(xfer_more && wakeup_req); -+ - mutex_unlock(&i2c->lock); - return IRQ_HANDLED; - } -diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c -index 7b27306330a35..1a82be03624cb 100644 ---- a/drivers/iio/adc/meson_saradc.c -+++ b/drivers/iio/adc/meson_saradc.c -@@ -71,7 +71,7 @@ - #define MESON_SAR_ADC_REG3_PANEL_DETECT_COUNT_MASK GENMASK(20, 18) - #define MESON_SAR_ADC_REG3_PANEL_DETECT_FILTER_TB_MASK GENMASK(17, 16) - #define MESON_SAR_ADC_REG3_ADC_CLK_DIV_SHIFT 10 -- #define MESON_SAR_ADC_REG3_ADC_CLK_DIV_WIDTH 5 -+ #define MESON_SAR_ADC_REG3_ADC_CLK_DIV_WIDTH 6 - #define MESON_SAR_ADC_REG3_BLOCK_DLY_SEL_MASK GENMASK(9, 8) - #define MESON_SAR_ADC_REG3_BLOCK_DLY_MASK GENMASK(7, 0) - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index 5fc5ab7813c0f..18b579c8a8c55 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -2606,11 +2606,8 @@ static int bnxt_qplib_cq_process_terminal(struct bnxt_qplib_cq *cq, - - qp = (struct bnxt_qplib_qp *)((unsigned long) - le64_to_cpu(hwcqe->qp_handle)); -- if (!qp) { -- dev_err(&cq->hwq.pdev->dev, -- "FP: CQ Process terminal qp is NULL\n"); -+ if (!qp) - return -EINVAL; -- } - - /* Must block new posting of SQ and RQ */ - qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR; -diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c -index 2a684fc6056e1..057c9ffcd02e1 100644 ---- a/drivers/infiniband/hw/hfi1/sdma.c -+++ b/drivers/infiniband/hw/hfi1/sdma.c -@@ -3203,8 +3203,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) - { - int rval = 0; - -- tx->num_desc++; -- if ((unlikely(tx->num_desc == tx->desc_limit))) { -+ if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) { - rval = _extend_sdma_tx_descs(dd, tx); - if (rval) { - __sdma_txclean(dd, tx); -@@ -3217,6 +3216,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) - SDMA_MAP_NONE, - dd->sdma_pad_phys, - sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1))); -+ tx->num_desc++; - _sdma_close_tx(dd, tx); - return rval; - } -diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h -index 1e2e40f79cb20..6ac00755848db 100644 ---- a/drivers/infiniband/hw/hfi1/sdma.h -+++ b/drivers/infiniband/hw/hfi1/sdma.h -@@ -672,14 +672,13 @@ static inline void sdma_txclean(struct hfi1_devdata *dd, struct sdma_txreq *tx) - static inline void _sdma_close_tx(struct hfi1_devdata *dd, - struct sdma_txreq *tx) - { -- tx->descp[tx->num_desc].qw[0] |= -- SDMA_DESC0_LAST_DESC_FLAG; -- tx->descp[tx->num_desc].qw[1] |= -- dd->default_desc1; -+ u16 last_desc = tx->num_desc - 1; -+ -+ tx->descp[last_desc].qw[0] |= SDMA_DESC0_LAST_DESC_FLAG; -+ tx->descp[last_desc].qw[1] |= dd->default_desc1; - if (tx->flags & SDMA_TXREQ_F_URGENT) -- tx->descp[tx->num_desc].qw[1] |= -- (SDMA_DESC1_HEAD_TO_HOST_FLAG | -- SDMA_DESC1_INT_REQ_FLAG); -+ tx->descp[last_desc].qw[1] |= (SDMA_DESC1_HEAD_TO_HOST_FLAG | -+ SDMA_DESC1_INT_REQ_FLAG); - } - - static inline int _sdma_txadd_daddr( -@@ -696,6 +695,7 @@ static inline int _sdma_txadd_daddr( - type, - addr, len); - WARN_ON(len > tx->tlen); -+ tx->num_desc++; - tx->tlen -= len; - /* special cases for last */ - if (!tx->tlen) { -@@ -707,7 +707,6 @@ static inline int _sdma_txadd_daddr( - _sdma_close_tx(dd, tx); - } - } -- tx->num_desc++; - return rval; - } - -diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c -index 4cc4e8ff42b33..ad035c342cd3b 100644 ---- a/drivers/input/misc/adxl34x.c -+++ b/drivers/input/misc/adxl34x.c -@@ -811,8 +811,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq, - AC_WRITE(ac, POWER_CTL, 0); - - err = request_threaded_irq(ac->irq, NULL, adxl34x_irq, -- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, -- dev_name(dev), ac); -+ IRQF_ONESHOT, dev_name(dev), ac); - if (err) { - dev_err(dev, "irq %d busy?\n", ac->irq); - goto err_free_mem; -diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c -index 79d7fa710a714..54002d1a446b7 100644 ---- a/drivers/input/misc/drv260x.c -+++ b/drivers/input/misc/drv260x.c -@@ -435,6 +435,7 @@ static int drv260x_init(struct drv260x_data *haptics) - } - - do { -+ usleep_range(15000, 15500); - error = regmap_read(haptics->regmap, DRV260X_GO, &cal_buf); - if (error) { - dev_err(&haptics->client->dev, -diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c -index 033bccb41455c..b9dcc8e78c750 100644 ---- a/drivers/irqchip/irq-jcore-aic.c -+++ b/drivers/irqchip/irq-jcore-aic.c -@@ -68,6 +68,7 @@ static int __init aic_irq_of_init(struct device_node *node, - unsigned min_irq = JCORE_AIC2_MIN_HWIRQ; - unsigned dom_sz = JCORE_AIC_MAX_HWIRQ+1; - struct irq_domain *domain; -+ int ret; - - pr_info("Initializing J-Core AIC\n"); - -@@ -100,11 +101,17 @@ static int __init aic_irq_of_init(struct device_node *node, - jcore_aic.irq_unmask = noop; - jcore_aic.name = "AIC"; - -- domain = irq_domain_add_linear(node, dom_sz, &jcore_aic_irqdomain_ops, -+ ret = irq_alloc_descs(-1, min_irq, dom_sz - min_irq, -+ of_node_to_nid(node)); -+ -+ if (ret < 0) -+ return ret; -+ -+ domain = irq_domain_add_legacy(node, dom_sz - min_irq, min_irq, min_irq, -+ &jcore_aic_irqdomain_ops, - &jcore_aic); - if (!domain) - return -ENOMEM; -- irq_create_strict_mappings(domain, min_irq, min_irq, dom_sz - min_irq); - - return 0; - } -diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c -index 88047d835211c..75f14b624ca22 100644 ---- a/drivers/mailbox/ti-msgmgr.c -+++ b/drivers/mailbox/ti-msgmgr.c -@@ -385,14 +385,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data) - /* Ensure all unused data is 0 */ - data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes)); - writel(data_trail, data_reg); -- data_reg++; -+ data_reg += sizeof(u32); - } -+ - /* - * 'data_reg' indicates next register to write. If we did not already - * write on tx complete reg(last reg), we must do so for transmit -+ * In addition, we also need to make sure all intermediate data -+ * registers(if any required), are reset to 0 for TISCI backward -+ * compatibility to be maintained. - */ -- if (data_reg <= qinst->queue_buff_end) -- writel(0, qinst->queue_buff_end); -+ while (data_reg <= qinst->queue_buff_end) { -+ writel(0, data_reg); -+ data_reg += sizeof(u32); -+ } - - return 0; - } -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 5a33910aea788..b7fea84d19ad9 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -1186,7 +1186,7 @@ static struct btree *btree_node_alloc_replacement(struct btree *b, - { - struct btree *n = bch_btree_node_alloc(b->c, op, b->level, b->parent); - -- if (!IS_ERR_OR_NULL(n)) { -+ if (!IS_ERR(n)) { - mutex_lock(&n->write_lock); - bch_btree_sort_into(&b->keys, &n->keys, &b->c->sort); - bkey_copy_key(&n->key, &b->key); -@@ -1389,7 +1389,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op, - memset(new_nodes, 0, sizeof(new_nodes)); - closure_init_stack(&cl); - -- while (nodes < GC_MERGE_NODES && !IS_ERR_OR_NULL(r[nodes].b)) -+ while (nodes < GC_MERGE_NODES && !IS_ERR(r[nodes].b)) - keys += r[nodes++].keys; - - blocks = btree_default_blocks(b->c) * 2 / 3; -@@ -1401,7 +1401,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op, - - for (i = 0; i < nodes; i++) { - new_nodes[i] = btree_node_alloc_replacement(r[i].b, NULL); -- if (IS_ERR_OR_NULL(new_nodes[i])) -+ if (IS_ERR(new_nodes[i])) - goto out_nocoalesce; - } - -@@ -1536,7 +1536,7 @@ out_nocoalesce: - bch_keylist_free(&keylist); - - for (i = 0; i < nodes; i++) -- if (!IS_ERR_OR_NULL(new_nodes[i])) { -+ if (!IS_ERR(new_nodes[i])) { - btree_node_free(new_nodes[i]); - rw_unlock(true, new_nodes[i]); - } -@@ -1718,7 +1718,7 @@ static int bch_btree_gc_root(struct btree *b, struct btree_op *op, - if (should_rewrite) { - n = btree_node_alloc_replacement(b, NULL); - -- if (!IS_ERR_OR_NULL(n)) { -+ if (!IS_ERR(n)) { - bch_btree_node_write_sync(n); - - bch_btree_set_root(n); -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index efdf6ce0443ea..70e46e0d2f1ac 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1633,7 +1633,7 @@ static void cache_set_flush(struct closure *cl) - if (!IS_ERR_OR_NULL(c->gc_thread)) - kthread_stop(c->gc_thread); - -- if (!IS_ERR_OR_NULL(c->root)) -+ if (!IS_ERR(c->root)) - list_add(&c->root->list, &c->btree_cache); - - /* -@@ -2000,7 +2000,7 @@ static int run_cache_set(struct cache_set *c) - - err = "cannot allocate new btree root"; - c->root = __bch_btree_node_alloc(c, NULL, 0, true, NULL); -- if (IS_ERR_OR_NULL(c->root)) -+ if (IS_ERR(c->root)) - goto err; - - mutex_lock(&c->root->write_lock); -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index 0545cdccf6369..bea8265ce9b8e 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -54,14 +54,7 @@ __acquires(bitmap->lock) - { - unsigned char *mappage; - -- if (page >= bitmap->pages) { -- /* This can happen if bitmap_start_sync goes beyond -- * End-of-device while looking for a whole page. -- * It is harmless. -- */ -- return -EINVAL; -- } -- -+ WARN_ON_ONCE(page >= bitmap->pages); - if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */ - return 0; - -@@ -1369,6 +1362,14 @@ __acquires(bitmap->lock) - sector_t csize; - int err; - -+ if (page >= bitmap->pages) { -+ /* -+ * This can happen if bitmap_start_sync goes beyond -+ * End-of-device while looking for a whole page or -+ * user set a huge number to sysfs bitmap_set_bits. -+ */ -+ return NULL; -+ } - err = md_bitmap_checkpage(bitmap, page, create, 0); - - if (bitmap->bp[page].hijacked || -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 64558991ce0a0..a006f3a9554bf 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -3766,8 +3766,9 @@ int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale) - static ssize_t - safe_delay_show(struct mddev *mddev, char *page) - { -- int msec = (mddev->safemode_delay*1000)/HZ; -- return sprintf(page, "%d.%03d\n", msec/1000, msec%1000); -+ unsigned int msec = ((unsigned long)mddev->safemode_delay*1000)/HZ; -+ -+ return sprintf(page, "%u.%03u\n", msec/1000, msec%1000); - } - static ssize_t - safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len) -@@ -3779,7 +3780,7 @@ safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len) - return -EINVAL; - } - -- if (strict_strtoul_scaled(cbuf, &msec, 3) < 0) -+ if (strict_strtoul_scaled(cbuf, &msec, 3) < 0 || msec > UINT_MAX / HZ) - return -EINVAL; - if (msec == 0) - mddev->safemode_delay = 0; -@@ -4440,6 +4441,8 @@ max_corrected_read_errors_store(struct mddev *mddev, const char *buf, size_t len - rv = kstrtouint(buf, 10, &n); - if (rv < 0) - return rv; -+ if (n > INT_MAX) -+ return -EINVAL; - atomic_set(&mddev->max_corr_read_errors, n); - return len; - } -@@ -4740,11 +4743,21 @@ action_store(struct mddev *mddev, const char *page, size_t len) - return -EINVAL; - err = mddev_lock(mddev); - if (!err) { -- if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) -+ if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) { - err = -EBUSY; -- else { -+ } else if (mddev->reshape_position == MaxSector || -+ mddev->pers->check_reshape == NULL || -+ mddev->pers->check_reshape(mddev)) { - clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); - err = mddev->pers->start_reshape(mddev); -+ } else { -+ /* -+ * If reshape is still in progress, and -+ * md_check_recovery() can continue to reshape, -+ * don't restart reshape because data can be -+ * corrupted for raid456. -+ */ -+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); - } - mddev_unlock(mddev); - } -diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c -index 8cbaa99e5b98e..7f80e86459b19 100644 ---- a/drivers/md/raid0.c -+++ b/drivers/md/raid0.c -@@ -289,6 +289,18 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf) - goto abort; - } - -+ if (conf->layout == RAID0_ORIG_LAYOUT) { -+ for (i = 1; i < conf->nr_strip_zones; i++) { -+ sector_t first_sector = conf->strip_zone[i-1].zone_end; -+ -+ sector_div(first_sector, mddev->chunk_sectors); -+ zone = conf->strip_zone + i; -+ /* disk_shift is first disk index used in the zone */ -+ zone->disk_shift = sector_div(first_sector, -+ zone->nb_dev); -+ } -+ } -+ - pr_debug("md/raid0:%s: done.\n", mdname(mddev)); - *private_conf = conf; - -@@ -475,6 +487,20 @@ static inline int is_io_in_chunk_boundary(struct mddev *mddev, - } - } - -+/* -+ * Convert disk_index to the disk order in which it is read/written. -+ * For example, if we have 4 disks, they are numbered 0,1,2,3. If we -+ * write the disks starting at disk 3, then the read/write order would -+ * be disk 3, then 0, then 1, and then disk 2 and we want map_disk_shift() -+ * to map the disks as follows 0,1,2,3 => 1,2,3,0. So disk 0 would map -+ * to 1, 1 to 2, 2 to 3, and 3 to 0. That way we can compare disks in -+ * that 'output' space to understand the read/write disk ordering. -+ */ -+static int map_disk_shift(int disk_index, int num_disks, int disk_shift) -+{ -+ return ((disk_index + num_disks - disk_shift) % num_disks); -+} -+ - static void raid0_handle_discard(struct mddev *mddev, struct bio *bio) - { - struct r0conf *conf = mddev->private; -@@ -488,7 +514,9 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio) - sector_t end_disk_offset; - unsigned int end_disk_index; - unsigned int disk; -+ sector_t orig_start, orig_end; - -+ orig_start = start; - zone = find_zone(conf, &start); - - if (bio_end_sector(bio) > zone->zone_end) { -@@ -502,6 +530,7 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio) - } else - end = bio_end_sector(bio); - -+ orig_end = end; - if (zone != conf->strip_zone) - end = end - zone[-1].zone_end; - -@@ -513,13 +542,26 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio) - last_stripe_index = end; - sector_div(last_stripe_index, stripe_size); - -- start_disk_index = (int)(start - first_stripe_index * stripe_size) / -- mddev->chunk_sectors; -+ /* In the first zone the original and alternate layouts are the same */ -+ if ((conf->layout == RAID0_ORIG_LAYOUT) && (zone != conf->strip_zone)) { -+ sector_div(orig_start, mddev->chunk_sectors); -+ start_disk_index = sector_div(orig_start, zone->nb_dev); -+ start_disk_index = map_disk_shift(start_disk_index, -+ zone->nb_dev, -+ zone->disk_shift); -+ sector_div(orig_end, mddev->chunk_sectors); -+ end_disk_index = sector_div(orig_end, zone->nb_dev); -+ end_disk_index = map_disk_shift(end_disk_index, -+ zone->nb_dev, zone->disk_shift); -+ } else { -+ start_disk_index = (int)(start - first_stripe_index * stripe_size) / -+ mddev->chunk_sectors; -+ end_disk_index = (int)(end - last_stripe_index * stripe_size) / -+ mddev->chunk_sectors; -+ } - start_disk_offset = ((int)(start - first_stripe_index * stripe_size) % - mddev->chunk_sectors) + - first_stripe_index * mddev->chunk_sectors; -- end_disk_index = (int)(end - last_stripe_index * stripe_size) / -- mddev->chunk_sectors; - end_disk_offset = ((int)(end - last_stripe_index * stripe_size) % - mddev->chunk_sectors) + - last_stripe_index * mddev->chunk_sectors; -@@ -528,18 +570,22 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio) - sector_t dev_start, dev_end; - struct bio *discard_bio = NULL; - struct md_rdev *rdev; -+ int compare_disk; -+ -+ compare_disk = map_disk_shift(disk, zone->nb_dev, -+ zone->disk_shift); - -- if (disk < start_disk_index) -+ if (compare_disk < start_disk_index) - dev_start = (first_stripe_index + 1) * - mddev->chunk_sectors; -- else if (disk > start_disk_index) -+ else if (compare_disk > start_disk_index) - dev_start = first_stripe_index * mddev->chunk_sectors; - else - dev_start = start_disk_offset; - -- if (disk < end_disk_index) -+ if (compare_disk < end_disk_index) - dev_end = (last_stripe_index + 1) * mddev->chunk_sectors; -- else if (disk > end_disk_index) -+ else if (compare_disk > end_disk_index) - dev_end = last_stripe_index * mddev->chunk_sectors; - else - dev_end = end_disk_offset; -diff --git a/drivers/md/raid0.h b/drivers/md/raid0.h -index 3816e5477db1e..8cc761ca74230 100644 ---- a/drivers/md/raid0.h -+++ b/drivers/md/raid0.h -@@ -6,6 +6,7 @@ struct strip_zone { - sector_t zone_end; /* Start of the next zone (in sectors) */ - sector_t dev_start; /* Zone offset in real dev (in sectors) */ - int nb_dev; /* # of devices attached to the zone */ -+ int disk_shift; /* start disk for the original layout */ - }; - - /* Linux 3.14 (20d0189b101) made an unintended change to -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index aee429ab114a5..3983d5c8b5cd2 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -751,8 +751,16 @@ static struct md_rdev *read_balance(struct r10conf *conf, - disk = r10_bio->devs[slot].devnum; - rdev = rcu_dereference(conf->mirrors[disk].replacement); - if (rdev == NULL || test_bit(Faulty, &rdev->flags) || -- r10_bio->devs[slot].addr + sectors > rdev->recovery_offset) -+ r10_bio->devs[slot].addr + sectors > -+ rdev->recovery_offset) { -+ /* -+ * Read replacement first to prevent reading both rdev -+ * and replacement as NULL during replacement replace -+ * rdev. -+ */ -+ smp_mb(); - rdev = rcu_dereference(conf->mirrors[disk].rdev); -+ } - if (rdev == NULL || - test_bit(Faulty, &rdev->flags)) - continue; -@@ -919,6 +927,7 @@ static void flush_pending_writes(struct r10conf *conf) - else - generic_make_request(bio); - bio = next; -+ cond_resched(); - } - blk_finish_plug(&plug); - } else -@@ -1104,6 +1113,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule) - else - generic_make_request(bio); - bio = next; -+ cond_resched(); - } - kfree(plug); - } -@@ -1363,9 +1373,15 @@ retry_write: - - for (i = 0; i < conf->copies; i++) { - int d = r10_bio->devs[i].devnum; -- struct md_rdev *rdev = rcu_dereference(conf->mirrors[d].rdev); -- struct md_rdev *rrdev = rcu_dereference( -- conf->mirrors[d].replacement); -+ struct md_rdev *rdev, *rrdev; -+ -+ rrdev = rcu_dereference(conf->mirrors[d].replacement); -+ /* -+ * Read replacement first to prevent reading both rdev and -+ * replacement as NULL during replacement replace rdev. -+ */ -+ smp_mb(); -+ rdev = rcu_dereference(conf->mirrors[d].rdev); - if (rdev == rrdev) - rrdev = NULL; - if (rdev && unlikely(test_bit(Blocked, &rdev->flags))) { -@@ -3054,7 +3070,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, - int must_sync; - int any_working; - int need_recover = 0; -- int need_replace = 0; - struct raid10_info *mirror = &conf->mirrors[i]; - struct md_rdev *mrdev, *mreplace; - -@@ -3066,11 +3081,10 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, - !test_bit(Faulty, &mrdev->flags) && - !test_bit(In_sync, &mrdev->flags)) - need_recover = 1; -- if (mreplace != NULL && -- !test_bit(Faulty, &mreplace->flags)) -- need_replace = 1; -+ if (mreplace && test_bit(Faulty, &mreplace->flags)) -+ mreplace = NULL; - -- if (!need_recover && !need_replace) { -+ if (!need_recover && !mreplace) { - rcu_read_unlock(); - continue; - } -@@ -3086,8 +3100,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, - rcu_read_unlock(); - continue; - } -- if (mreplace && test_bit(Faulty, &mreplace->flags)) -- mreplace = NULL; - /* Unless we are doing a full sync, or a replacement - * we only need to recover the block if it is set in - * the bitmap -@@ -3210,11 +3222,11 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, - bio = r10_bio->devs[1].repl_bio; - if (bio) - bio->bi_end_io = NULL; -- /* Note: if need_replace, then bio -+ /* Note: if replace is not NULL, then bio - * cannot be NULL as r10buf_pool_alloc will - * have allocated it. - */ -- if (!need_replace) -+ if (!mreplace) - break; - bio->bi_next = biolist; - biolist = bio; -diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c -index 62ee09f28a0bc..7524c90f5da61 100644 ---- a/drivers/media/usb/dvb-usb-v2/az6007.c -+++ b/drivers/media/usb/dvb-usb-v2/az6007.c -@@ -202,7 +202,8 @@ static int az6007_rc_query(struct dvb_usb_device *d) - unsigned code; - enum rc_proto proto; - -- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10); -+ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0) -+ return -EIO; - - if (st->data[1] == 0x44) - return 0; -diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c -index 1db232a1063b9..0358cd1043877 100644 ---- a/drivers/media/usb/siano/smsusb.c -+++ b/drivers/media/usb/siano/smsusb.c -@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) - - for (i = 0; i < MAX_URBS; i++) { - usb_kill_urb(&dev->surbs[i].urb); -- cancel_work_sync(&dev->surbs[i].wq); -+ if (dev->surbs[i].wq.func) -+ cancel_work_sync(&dev->surbs[i].wq); - - if (dev->surbs[i].cb) { - smscore_putbuffer(dev->coredev, dev->surbs[i].cb); -diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c -index 6827ed4847507..127a9bffdbca8 100644 ---- a/drivers/memory/brcmstb_dpfe.c -+++ b/drivers/memory/brcmstb_dpfe.c -@@ -398,15 +398,17 @@ static void __finalize_command(struct private_data *priv) - static int __send_command(struct private_data *priv, unsigned int cmd, - u32 result[]) - { -- const u32 *msg = priv->dpfe_api->command[cmd]; - void __iomem *regs = priv->regs; - unsigned int i, chksum, chksum_idx; -+ const u32 *msg; - int ret = 0; - u32 resp; - - if (cmd >= DPFE_CMD_MAX) - return -1; - -+ msg = priv->dpfe_api->command[cmd]; -+ - mutex_lock(&priv->lock); - - /* Wait for DCPU to become ready */ -diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c -index dd06c18495eb6..0e37c6a5ee36c 100644 ---- a/drivers/memstick/host/r592.c -+++ b/drivers/memstick/host/r592.c -@@ -44,12 +44,10 @@ static const char *tpc_names[] = { - * memstick_debug_get_tpc_name - debug helper that returns string for - * a TPC number - */ --const char *memstick_debug_get_tpc_name(int tpc) -+static __maybe_unused const char *memstick_debug_get_tpc_name(int tpc) - { - return tpc_names[tpc-1]; - } --EXPORT_SYMBOL(memstick_debug_get_tpc_name); -- - - /* Read a register*/ - static inline u32 r592_read_reg(struct r592_device *dev, int address) -diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c -index 045cbf0cbe53a..993e305a232c5 100644 ---- a/drivers/mfd/intel-lpss-acpi.c -+++ b/drivers/mfd/intel-lpss-acpi.c -@@ -114,6 +114,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev) - return -ENOMEM; - - info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ if (!info->mem) -+ return -ENODEV; -+ - info->irq = platform_get_irq(pdev, 0); - - ret = intel_lpss_probe(&pdev->dev, info); -diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c -index 48381d9bf7403..302115dabff4b 100644 ---- a/drivers/mfd/rt5033.c -+++ b/drivers/mfd/rt5033.c -@@ -41,9 +41,6 @@ static const struct mfd_cell rt5033_devs[] = { - { - .name = "rt5033-charger", - .of_compatible = "richtek,rt5033-charger", -- }, { -- .name = "rt5033-battery", -- .of_compatible = "richtek,rt5033-battery", - }, { - .name = "rt5033-led", - .of_compatible = "richtek,rt5033-led", -diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c -index 711979afd90a0..887c92342b7f1 100644 ---- a/drivers/mfd/stmfx.c -+++ b/drivers/mfd/stmfx.c -@@ -389,7 +389,7 @@ static int stmfx_chip_init(struct i2c_client *client) - - err: - if (stmfx->vdd) -- return regulator_disable(stmfx->vdd); -+ regulator_disable(stmfx->vdd); - - return ret; - } -diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c -index 508349399f8af..7f758fb60c1fa 100644 ---- a/drivers/mfd/stmpe.c -+++ b/drivers/mfd/stmpe.c -@@ -1494,9 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum) - - int stmpe_remove(struct stmpe *stmpe) - { -- if (!IS_ERR(stmpe->vio)) -+ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio)) - regulator_disable(stmpe->vio); -- if (!IS_ERR(stmpe->vcc)) -+ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc)) - regulator_disable(stmpe->vcc); - - __stmpe_disable(stmpe, STMPE_BLOCK_ADC); -diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c -index 10fec109bbd33..9bbbeec4cd02c 100644 ---- a/drivers/misc/fastrpc.c -+++ b/drivers/misc/fastrpc.c -@@ -1074,7 +1074,7 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, - - sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE, 4, 0); - if (init.attrs) -- sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_ATTR, 6, 0); -+ sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_ATTR, 4, 0); - - err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, - sc, args); -diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c -index 1154f0435b0ac..478d6118550e5 100644 ---- a/drivers/misc/pci_endpoint_test.c -+++ b/drivers/misc/pci_endpoint_test.c -@@ -590,6 +590,10 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd, - struct pci_dev *pdev = test->pdev; - - mutex_lock(&test->mutex); -+ -+ reinit_completion(&test->irq_raised); -+ test->last_irq = -ENODATA; -+ - switch (cmd) { - case PCITEST_BAR: - bar = arg; -@@ -774,6 +778,9 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev) - if (id < 0) - return; - -+ pci_endpoint_test_release_irq(test); -+ pci_endpoint_test_free_irq_vectors(test); -+ - misc_deregister(&test->miscdev); - kfree(misc_device->name); - ida_simple_remove(&pci_endpoint_test_ida, id); -@@ -782,9 +789,6 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev) - pci_iounmap(pdev, test->bar[bar]); - } - -- pci_endpoint_test_release_irq(test); -- pci_endpoint_test_free_irq_vectors(test); -- - pci_release_regions(pdev); - pci_disable_device(pdev); - } -diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h -index 3dba15bccce25..9a253324c95a1 100644 ---- a/drivers/mmc/core/quirks.h -+++ b/drivers/mmc/core/quirks.h -@@ -90,6 +90,20 @@ static const struct mmc_fixup mmc_blk_fixups[] = { - MMC_FIXUP("VZL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc, - MMC_QUIRK_SEC_ERASE_TRIM_BROKEN), - -+ /* -+ * Kingston EMMC04G-M627 advertises TRIM but it does not seems to -+ * support being used to offload WRITE_ZEROES. -+ */ -+ MMC_FIXUP("M62704", CID_MANFID_KINGSTON, 0x0100, add_quirk_mmc, -+ MMC_QUIRK_TRIM_BROKEN), -+ -+ /* -+ * Micron MTFC4GACAJCN-1M advertises TRIM but it does not seems to -+ * support being used to offload WRITE_ZEROES. -+ */ -+ MMC_FIXUP("Q2J54A", CID_MANFID_MICRON, 0x014e, add_quirk_mmc, -+ MMC_QUIRK_TRIM_BROKEN), -+ - /* - * On Some Kingston eMMCs, performing trim can result in - * unrecoverable data conrruption occasionally due to a firmware bug. -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index ae3cbf792d7b1..8d97451bbd289 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -1104,6 +1104,8 @@ static void sdhci_prepare_data(struct sdhci_host *host, struct mmc_command *cmd) - } - } - -+ sdhci_config_dma(host); -+ - if (host->flags & SDHCI_REQ_USE_DMA) { - int sg_cnt = sdhci_pre_dma_transfer(host, data, COOKIE_MAPPED); - -@@ -1123,8 +1125,6 @@ static void sdhci_prepare_data(struct sdhci_host *host, struct mmc_command *cmd) - } - } - -- sdhci_config_dma(host); -- - if (!(host->flags & SDHCI_REQ_USE_DMA)) { - int flags; - -diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c -index 312738124ea10..8339c020c1a13 100644 ---- a/drivers/mtd/nand/raw/meson_nand.c -+++ b/drivers/mtd/nand/raw/meson_nand.c -@@ -72,6 +72,7 @@ - #define GENCMDIADDRH(aih, addr) ((aih) | (((addr) >> 16) & 0xffff)) - - #define DMA_DIR(dir) ((dir) ? NFC_CMD_N2M : NFC_CMD_M2N) -+#define DMA_ADDR_ALIGN 8 - - #define ECC_CHECK_RETURN_FF (-1) - -@@ -838,6 +839,9 @@ static int meson_nfc_read_oob(struct nand_chip *nand, int page) - - static bool meson_nfc_is_buffer_dma_safe(const void *buffer) - { -+ if ((uintptr_t)buffer % DMA_ADDR_ALIGN) -+ return false; -+ - if (virt_addr_valid(buffer) && (!object_is_on_stack(buffer))) - return true; - return false; -diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c -index 193722334d931..89a63fdbe0e39 100644 ---- a/drivers/net/ethernet/broadcom/bgmac.c -+++ b/drivers/net/ethernet/broadcom/bgmac.c -@@ -890,13 +890,13 @@ static void bgmac_chip_reset_idm_config(struct bgmac *bgmac) - - if (iost & BGMAC_BCMA_IOST_ATTACHED) { - flags = BGMAC_BCMA_IOCTL_SW_CLKEN; -- if (!bgmac->has_robosw) -+ if (bgmac->in_init || !bgmac->has_robosw) - flags |= BGMAC_BCMA_IOCTL_SW_RESET; - } - bgmac_clk_enable(bgmac, flags); - } - -- if (iost & BGMAC_BCMA_IOST_ATTACHED && !bgmac->has_robosw) -+ if (iost & BGMAC_BCMA_IOST_ATTACHED && (bgmac->in_init || !bgmac->has_robosw)) - bgmac_idm_write(bgmac, BCMA_IOCTL, - bgmac_idm_read(bgmac, BCMA_IOCTL) & - ~BGMAC_BCMA_IOCTL_SW_RESET); -@@ -1489,6 +1489,8 @@ int bgmac_enet_probe(struct bgmac *bgmac) - struct net_device *net_dev = bgmac->net_dev; - int err; - -+ bgmac->in_init = true; -+ - bgmac_chip_intrs_off(bgmac); - - net_dev->irq = bgmac->irq; -@@ -1538,6 +1540,8 @@ int bgmac_enet_probe(struct bgmac *bgmac) - net_dev->hw_features = net_dev->features; - net_dev->vlan_features = net_dev->features; - -+ bgmac->in_init = false; -+ - err = register_netdev(bgmac->net_dev); - if (err) { - dev_err(bgmac->dev, "Cannot register net device\n"); -diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h -index 40d02fec27472..76930b8353d60 100644 ---- a/drivers/net/ethernet/broadcom/bgmac.h -+++ b/drivers/net/ethernet/broadcom/bgmac.h -@@ -511,6 +511,8 @@ struct bgmac { - int irq; - u32 int_mask; - -+ bool in_init; -+ - /* Current MAC state */ - int mac_speed; - int mac_duplex; -diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c -index ce569b7d3b353..53495d39cc9c5 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmmii.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c -@@ -618,5 +618,7 @@ void bcmgenet_mii_exit(struct net_device *dev) - if (of_phy_is_fixed_link(dn)) - of_phy_deregister_fixed_link(dn); - of_node_put(priv->phy_dn); -+ clk_prepare_enable(priv->clk); - platform_device_unregister(priv->mii_pdev); -+ clk_disable_unprepare(priv->clk); - } -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index d0cd86af29d9f..b16517d162cfd 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -230,6 +230,7 @@ MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver"); - MODULE_LICENSE("GPL"); - MODULE_VERSION(DRV_MODULE_VERSION); - MODULE_FIRMWARE(FIRMWARE_TG3); -+MODULE_FIRMWARE(FIRMWARE_TG357766); - MODULE_FIRMWARE(FIRMWARE_TG3TSO); - MODULE_FIRMWARE(FIRMWARE_TG3TSO5); - -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index 838cd7881f2f7..9cf556fedc704 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -1389,19 +1389,16 @@ static int iavf_alloc_q_vectors(struct iavf_adapter *adapter) - static void iavf_free_q_vectors(struct iavf_adapter *adapter) - { - int q_idx, num_q_vectors; -- int napi_vectors; - - if (!adapter->q_vectors) - return; - - num_q_vectors = adapter->num_msix_vectors - NONQ_VECS; -- napi_vectors = adapter->num_active_queues; - - for (q_idx = 0; q_idx < num_q_vectors; q_idx++) { - struct iavf_q_vector *q_vector = &adapter->q_vectors[q_idx]; - -- if (q_idx < napi_vectors) -- netif_napi_del(&q_vector->napi); -+ netif_napi_del(&q_vector->napi); - } - kfree(adapter->q_vectors); - adapter->q_vectors = NULL; -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index 00d66a6e5c6e5..8c6c0d9c7f766 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -9028,6 +9028,11 @@ static pci_ers_result_t igb_io_error_detected(struct pci_dev *pdev, - struct net_device *netdev = pci_get_drvdata(pdev); - struct igb_adapter *adapter = netdev_priv(netdev); - -+ if (state == pci_channel_io_normal) { -+ dev_warn(&pdev->dev, "Non-correctable non-fatal error reported.\n"); -+ return PCI_ERS_RESULT_CAN_RECOVER; -+ } -+ - netif_device_detach(netdev); - - if (state == pci_channel_io_perm_failure) -diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c -index cbcb8611ab50d..0a4e7f5f292ac 100644 ---- a/drivers/net/ethernet/intel/igc/igc_ethtool.c -+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c -@@ -1668,6 +1668,8 @@ static int igc_get_link_ksettings(struct net_device *netdev, - /* twisted pair */ - cmd->base.port = PORT_TP; - cmd->base.phy_address = hw->phy.addr; -+ ethtool_link_ksettings_add_link_mode(cmd, supported, TP); -+ ethtool_link_ksettings_add_link_mode(cmd, advertising, TP); - - /* advertising link modes */ - if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF) -diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c -index b8297a63a7fd2..3839ca8bdf6dd 100644 ---- a/drivers/net/ethernet/intel/igc/igc_main.c -+++ b/drivers/net/ethernet/intel/igc/igc_main.c -@@ -610,7 +610,6 @@ static void igc_configure_tx_ring(struct igc_adapter *adapter, - /* disable the queue */ - wr32(IGC_TXDCTL(reg_idx), 0); - wrfl(); -- mdelay(10); - - wr32(IGC_TDLEN(reg_idx), - ring->count * sizeof(union igc_adv_tx_desc)); -diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c -index 977c2961aa2c2..110221a16bf6d 100644 ---- a/drivers/net/ethernet/marvell/mvneta.c -+++ b/drivers/net/ethernet/marvell/mvneta.c -@@ -1422,7 +1422,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp) - */ - if (txq_number == 1) - txq_map = (cpu == pp->rxq_def) ? -- MVNETA_CPU_TXQ_ACCESS(1) : 0; -+ MVNETA_CPU_TXQ_ACCESS(0) : 0; - - } else { - txq_map = MVNETA_CPU_TXQ_ACCESS_ALL_MASK; -@@ -3762,7 +3762,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp) - */ - if (txq_number == 1) - txq_map = (cpu == elected_cpu) ? -- MVNETA_CPU_TXQ_ACCESS(1) : 0; -+ MVNETA_CPU_TXQ_ACCESS(0) : 0; - else - txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) & - MVNETA_CPU_TXQ_ACCESS_ALL_MASK; -diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c -index c69ffcfe61689..6458dbd6c631a 100644 ---- a/drivers/net/ethernet/microchip/lan743x_main.c -+++ b/drivers/net/ethernet/microchip/lan743x_main.c -@@ -80,6 +80,18 @@ static int lan743x_csr_light_reset(struct lan743x_adapter *adapter) - !(data & HW_CFG_LRST_), 100000, 10000000); - } - -+static int lan743x_csr_wait_for_bit_atomic(struct lan743x_adapter *adapter, -+ int offset, u32 bit_mask, -+ int target_value, int udelay_min, -+ int udelay_max, int count) -+{ -+ u32 data; -+ -+ return readx_poll_timeout_atomic(LAN743X_CSR_READ_OP, offset, data, -+ target_value == !!(data & bit_mask), -+ udelay_max, udelay_min * count); -+} -+ - static int lan743x_csr_wait_for_bit(struct lan743x_adapter *adapter, - int offset, u32 bit_mask, - int target_value, int usleep_min, -@@ -675,8 +687,8 @@ static int lan743x_dp_write(struct lan743x_adapter *adapter, - u32 dp_sel; - int i; - -- if (lan743x_csr_wait_for_bit(adapter, DP_SEL, DP_SEL_DPRDY_, -- 1, 40, 100, 100)) -+ if (lan743x_csr_wait_for_bit_atomic(adapter, DP_SEL, DP_SEL_DPRDY_, -+ 1, 40, 100, 100)) - return -EIO; - dp_sel = lan743x_csr_read(adapter, DP_SEL); - dp_sel &= ~DP_SEL_MASK_; -@@ -687,8 +699,9 @@ static int lan743x_dp_write(struct lan743x_adapter *adapter, - lan743x_csr_write(adapter, DP_ADDR, addr + i); - lan743x_csr_write(adapter, DP_DATA_0, buf[i]); - lan743x_csr_write(adapter, DP_CMD, DP_CMD_WRITE_); -- if (lan743x_csr_wait_for_bit(adapter, DP_SEL, DP_SEL_DPRDY_, -- 1, 40, 100, 100)) -+ if (lan743x_csr_wait_for_bit_atomic(adapter, DP_SEL, -+ DP_SEL_DPRDY_, -+ 1, 40, 100, 100)) - return -EIO; - } - -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -index d0841836cf705..d718c1a6d5fc7 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -@@ -167,10 +167,10 @@ static int ionic_intr_alloc(struct ionic_lif *lif, struct ionic_intr_info *intr) - return 0; - } - --static void ionic_intr_free(struct ionic_lif *lif, int index) -+static void ionic_intr_free(struct ionic *ionic, int index) - { -- if (index != INTR_INDEX_NOT_ASSIGNED && index < lif->ionic->nintrs) -- clear_bit(index, lif->ionic->intrs); -+ if (index != INTR_INDEX_NOT_ASSIGNED && index < ionic->nintrs) -+ clear_bit(index, ionic->intrs); - } - - static int ionic_qcq_enable(struct ionic_qcq *qcq) -@@ -256,7 +256,6 @@ static int ionic_qcq_disable(struct ionic_qcq *qcq) - static void ionic_lif_qcq_deinit(struct ionic_lif *lif, struct ionic_qcq *qcq) - { - struct ionic_dev *idev = &lif->ionic->idev; -- struct device *dev = lif->ionic->dev; - - if (!qcq) - return; -@@ -269,7 +268,6 @@ static void ionic_lif_qcq_deinit(struct ionic_lif *lif, struct ionic_qcq *qcq) - if (qcq->flags & IONIC_QCQ_F_INTR) { - ionic_intr_mask(idev->intr_ctrl, qcq->intr.index, - IONIC_INTR_MASK_SET); -- devm_free_irq(dev, qcq->intr.vector, &qcq->napi); - netif_napi_del(&qcq->napi); - } - -@@ -287,8 +285,12 @@ static void ionic_qcq_free(struct ionic_lif *lif, struct ionic_qcq *qcq) - qcq->base = NULL; - qcq->base_pa = 0; - -- if (qcq->flags & IONIC_QCQ_F_INTR) -- ionic_intr_free(lif, qcq->intr.index); -+ if (qcq->flags & IONIC_QCQ_F_INTR) { -+ irq_set_affinity_hint(qcq->intr.vector, NULL); -+ devm_free_irq(dev, qcq->intr.vector, &qcq->napi); -+ qcq->intr.vector = 0; -+ ionic_intr_free(lif->ionic, qcq->intr.index); -+ } - - devm_kfree(dev, qcq->cq.info); - qcq->cq.info = NULL; -@@ -330,11 +332,6 @@ static void ionic_qcqs_free(struct ionic_lif *lif) - static void ionic_link_qcq_interrupts(struct ionic_qcq *src_qcq, - struct ionic_qcq *n_qcq) - { -- if (WARN_ON(n_qcq->flags & IONIC_QCQ_F_INTR)) { -- ionic_intr_free(n_qcq->cq.lif, n_qcq->intr.index); -- n_qcq->flags &= ~IONIC_QCQ_F_INTR; -- } -- - n_qcq->intr.vector = src_qcq->intr.vector; - n_qcq->intr.index = src_qcq->intr.index; - } -@@ -418,8 +415,15 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type, - ionic_intr_mask_assert(idev->intr_ctrl, new->intr.index, - IONIC_INTR_MASK_SET); - -- new->intr.cpu = new->intr.index % num_online_cpus(); -- if (cpu_online(new->intr.cpu)) -+ err = ionic_request_irq(lif, new); -+ if (err) { -+ netdev_warn(lif->netdev, "irq request failed %d\n", err); -+ goto err_out_free_intr; -+ } -+ -+ new->intr.cpu = cpumask_local_spread(new->intr.index, -+ dev_to_node(dev)); -+ if (new->intr.cpu != -1) - cpumask_set_cpu(new->intr.cpu, - &new->intr.affinity_mask); - } else { -@@ -431,13 +435,13 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type, - if (!new->cq.info) { - netdev_err(lif->netdev, "Cannot allocate completion queue info\n"); - err = -ENOMEM; -- goto err_out_free_intr; -+ goto err_out_free_irq; - } - - err = ionic_cq_init(lif, &new->cq, &new->intr, num_descs, cq_desc_size); - if (err) { - netdev_err(lif->netdev, "Cannot initialize completion queue\n"); -- goto err_out_free_intr; -+ goto err_out_free_irq; - } - - new->base = dma_alloc_coherent(dev, total_size, &new->base_pa, -@@ -445,7 +449,7 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type, - if (!new->base) { - netdev_err(lif->netdev, "Cannot allocate queue DMA memory\n"); - err = -ENOMEM; -- goto err_out_free_intr; -+ goto err_out_free_irq; - } - - new->total_size = total_size; -@@ -471,8 +475,12 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type, - - return 0; - -+err_out_free_irq: -+ if (flags & IONIC_QCQ_F_INTR) -+ devm_free_irq(dev, new->intr.vector, &new->napi); - err_out_free_intr: -- ionic_intr_free(lif, new->intr.index); -+ if (flags & IONIC_QCQ_F_INTR) -+ ionic_intr_free(lif->ionic, new->intr.index); - err_out: - dev_err(dev, "qcq alloc of %s%d failed %d\n", name, index, err); - return err; -@@ -647,12 +655,6 @@ static int ionic_lif_rxq_init(struct ionic_lif *lif, struct ionic_qcq *qcq) - netif_napi_add(lif->netdev, &qcq->napi, ionic_rx_napi, - NAPI_POLL_WEIGHT); - -- err = ionic_request_irq(lif, qcq); -- if (err) { -- netif_napi_del(&qcq->napi); -- return err; -- } -- - qcq->flags |= IONIC_QCQ_F_INITED; - - ionic_debugfs_add_qcq(lif, qcq); -@@ -1870,13 +1872,6 @@ static int ionic_lif_adminq_init(struct ionic_lif *lif) - netif_napi_add(lif->netdev, &qcq->napi, ionic_adminq_napi, - NAPI_POLL_WEIGHT); - -- err = ionic_request_irq(lif, qcq); -- if (err) { -- netdev_warn(lif->netdev, "adminq irq request failed %d\n", err); -- netif_napi_del(&qcq->napi); -- return err; -- } -- - napi_enable(&qcq->napi); - - if (qcq->flags & IONIC_QCQ_F_INTR) -diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c -index e7c24396933e9..f17619c545ae5 100644 ---- a/drivers/net/ethernet/ti/cpsw_ale.c -+++ b/drivers/net/ethernet/ti/cpsw_ale.c -@@ -60,23 +60,37 @@ - - static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits) - { -- int idx; -+ int idx, idx2; -+ u32 hi_val = 0; - - idx = start / 32; -+ idx2 = (start + bits - 1) / 32; -+ /* Check if bits to be fetched exceed a word */ -+ if (idx != idx2) { -+ idx2 = 2 - idx2; /* flip */ -+ hi_val = ale_entry[idx2] << ((idx2 * 32) - start); -+ } - start -= idx * 32; - idx = 2 - idx; /* flip */ -- return (ale_entry[idx] >> start) & BITMASK(bits); -+ return (hi_val + (ale_entry[idx] >> start)) & BITMASK(bits); - } - - static inline void cpsw_ale_set_field(u32 *ale_entry, u32 start, u32 bits, - u32 value) - { -- int idx; -+ int idx, idx2; - - value &= BITMASK(bits); -- idx = start / 32; -+ idx = start / 32; -+ idx2 = (start + bits - 1) / 32; -+ /* Check if bits to be set exceed a word */ -+ if (idx != idx2) { -+ idx2 = 2 - idx2; /* flip */ -+ ale_entry[idx2] &= ~(BITMASK(bits + start - (idx2 * 32))); -+ ale_entry[idx2] |= (value >> ((idx2 * 32) - start)); -+ } - start -= idx * 32; -- idx = 2 - idx; /* flip */ -+ idx = 2 - idx; /* flip */ - ale_entry[idx] &= ~(BITMASK(bits) << start); - ale_entry[idx] |= (value << start); - } -diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c -index d0653babab923..0409afe9a53d6 100644 ---- a/drivers/net/gtp.c -+++ b/drivers/net/gtp.c -@@ -297,7 +297,9 @@ static void __gtp_encap_destroy(struct sock *sk) - gtp->sk1u = NULL; - udp_sk(sk)->encap_type = 0; - rcu_assign_sk_user_data(sk, NULL); -+ release_sock(sk); - sock_put(sk); -+ return; - } - release_sock(sk); - } -diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c -index 0a5b5ff597c6f..ab09d110760ec 100644 ---- a/drivers/net/ipvlan/ipvlan_core.c -+++ b/drivers/net/ipvlan/ipvlan_core.c -@@ -586,7 +586,8 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev) - consume_skb(skb); - return NET_XMIT_DROP; - } -- return ipvlan_rcv_frame(addr, &skb, true); -+ ipvlan_rcv_frame(addr, &skb, true); -+ return NET_XMIT_SUCCESS; - } - } - out: -@@ -612,7 +613,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) - consume_skb(skb); - return NET_XMIT_DROP; - } -- return ipvlan_rcv_frame(addr, &skb, true); -+ ipvlan_rcv_frame(addr, &skb, true); -+ return NET_XMIT_SUCCESS; - } - } - skb = skb_share_check(skb, GFP_ATOMIC); -@@ -624,7 +626,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) - * the skb for the main-dev. At the RX side we just return - * RX_PASS for it to be processed further on the stack. - */ -- return dev_forward_skb(ipvlan->phy_dev, skb); -+ dev_forward_skb(ipvlan->phy_dev, skb); -+ return NET_XMIT_SUCCESS; - - } else if (is_multicast_ether_addr(eth->h_dest)) { - skb_reset_mac_header(skb); -diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c -index 2fe12b0de5b4f..dea8a998fb622 100644 ---- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c -+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c -@@ -1099,17 +1099,22 @@ static bool ath9k_hw_verify_hang(struct ath_hw *ah, unsigned int queue) - { - u32 dma_dbg_chain, dma_dbg_complete; - u8 dcu_chain_state, dcu_complete_state; -+ unsigned int dbg_reg, reg_offset; - int i; - -- for (i = 0; i < NUM_STATUS_READS; i++) { -- if (queue < 6) -- dma_dbg_chain = REG_READ(ah, AR_DMADBG_4); -- else -- dma_dbg_chain = REG_READ(ah, AR_DMADBG_5); -+ if (queue < 6) { -+ dbg_reg = AR_DMADBG_4; -+ reg_offset = queue * 5; -+ } else { -+ dbg_reg = AR_DMADBG_5; -+ reg_offset = (queue - 6) * 5; -+ } - -+ for (i = 0; i < NUM_STATUS_READS; i++) { -+ dma_dbg_chain = REG_READ(ah, dbg_reg); - dma_dbg_complete = REG_READ(ah, AR_DMADBG_6); - -- dcu_chain_state = (dma_dbg_chain >> (5 * queue)) & 0x1f; -+ dcu_chain_state = (dma_dbg_chain >> reg_offset) & 0x1f; - dcu_complete_state = dma_dbg_complete & 0x3; - - if ((dcu_chain_state != 0x6) || (dcu_complete_state != 0x1)) -@@ -1128,6 +1133,7 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah) - u8 dcu_chain_state, dcu_complete_state; - bool dcu_wait_frdone = false; - unsigned long chk_dcu = 0; -+ unsigned int reg_offset; - unsigned int i = 0; - - dma_dbg_4 = REG_READ(ah, AR_DMADBG_4); -@@ -1139,12 +1145,15 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah) - goto exit; - - for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) { -- if (i < 6) -+ if (i < 6) { - chk_dbg = dma_dbg_4; -- else -+ reg_offset = i * 5; -+ } else { - chk_dbg = dma_dbg_5; -+ reg_offset = (i - 6) * 5; -+ } - -- dcu_chain_state = (chk_dbg >> (5 * i)) & 0x1f; -+ dcu_chain_state = (chk_dbg >> reg_offset) & 0x1f; - if (dcu_chain_state == 0x6) { - dcu_wait_frdone = true; - chk_dcu |= BIT(i); -diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c -index fe62ff668f757..99667aba289df 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_hst.c -+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c -@@ -114,7 +114,13 @@ static void htc_process_conn_rsp(struct htc_target *target, - - if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) { - epid = svc_rspmsg->endpoint_id; -- if (epid < 0 || epid >= ENDPOINT_MAX) -+ -+ /* Check that the received epid for the endpoint to attach -+ * a new service is valid. ENDPOINT0 can't be used here as it -+ * is already reserved for HTC_CTRL_RSVD_SVC service and thus -+ * should not be modified. -+ */ -+ if (epid <= ENDPOINT0 || epid >= ENDPOINT_MAX) - return; - - service_id = be16_to_cpu(svc_rspmsg->service_id); -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index eb5751a45f266..5968fcec11737 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -200,7 +200,7 @@ void ath_cancel_work(struct ath_softc *sc) - void ath_restart_work(struct ath_softc *sc) - { - ieee80211_queue_delayed_work(sc->hw, &sc->hw_check_work, -- ATH_HW_CHECK_POLL_INT); -+ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT)); - - if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah)) - ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work, -@@ -847,7 +847,7 @@ static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix) - static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix) - { - struct ath_hw *ah = sc->sc_ah; -- int i; -+ int i, j; - struct ath_txq *txq; - bool key_in_use = false; - -@@ -865,8 +865,9 @@ static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix) - if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) { - int idx = txq->txq_tailidx; - -- while (!key_in_use && -- !list_empty(&txq->txq_fifo[idx])) { -+ for (j = 0; !key_in_use && -+ !list_empty(&txq->txq_fifo[idx]) && -+ j < ATH_TXFIFO_DEPTH; j++) { - key_in_use = ath9k_txq_list_has_key( - &txq->txq_fifo[idx], keyix); - INCR(idx, ATH_TXFIFO_DEPTH); -@@ -2227,7 +2228,7 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop, - } - - ieee80211_queue_delayed_work(hw, &sc->hw_check_work, -- ATH_HW_CHECK_POLL_INT); -+ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT)); - } - - static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw) -diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c -index deb22b8c2065f..ef861b19fd477 100644 ---- a/drivers/net/wireless/ath/ath9k/wmi.c -+++ b/drivers/net/wireless/ath/ath9k/wmi.c -@@ -218,6 +218,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb, - if (unlikely(wmi->stopped)) - goto free_skb; - -+ /* Validate the obtained SKB. */ -+ if (unlikely(skb->len < sizeof(struct wmi_cmd_hdr))) -+ goto free_skb; -+ - hdr = (struct wmi_cmd_hdr *) skb->data; - cmd_id = be16_to_cpu(hdr->command_id); - -diff --git a/drivers/net/wireless/atmel/atmel_cs.c b/drivers/net/wireless/atmel/atmel_cs.c -index 7afc9c5329fb1..f5fa1a95b0c15 100644 ---- a/drivers/net/wireless/atmel/atmel_cs.c -+++ b/drivers/net/wireless/atmel/atmel_cs.c -@@ -73,6 +73,7 @@ struct local_info { - static int atmel_probe(struct pcmcia_device *p_dev) - { - struct local_info *local; -+ int ret; - - dev_dbg(&p_dev->dev, "atmel_attach()\n"); - -@@ -83,8 +84,16 @@ static int atmel_probe(struct pcmcia_device *p_dev) - - p_dev->priv = local; - -- return atmel_config(p_dev); --} /* atmel_attach */ -+ ret = atmel_config(p_dev); -+ if (ret) -+ goto err_free_priv; -+ -+ return 0; -+ -+err_free_priv: -+ kfree(p_dev->priv); -+ return ret; -+} - - static void atmel_detach(struct pcmcia_device *link) - { -diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c -index da0d3834b5f01..ebf0d3072290e 100644 ---- a/drivers/net/wireless/cisco/airo.c -+++ b/drivers/net/wireless/cisco/airo.c -@@ -6104,8 +6104,11 @@ static int airo_get_rate(struct net_device *dev, - { - struct airo_info *local = dev->ml_priv; - StatusRid status_rid; /* Card status info */ -+ int ret; - -- readStatusRid(local, &status_rid, 1); -+ ret = readStatusRid(local, &status_rid, 1); -+ if (ret) -+ return -EBUSY; - - vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000; - /* If more than one rate, set auto */ -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -index 5973eecbc0378..18c5975d7c037 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -@@ -1167,8 +1167,11 @@ static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode, - mvmtxq = iwl_mvm_txq_from_mac80211(txq); - mvmtxq->stopped = !start; - -- if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST) -+ if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST) { -+ local_bh_disable(); - iwl_mvm_mac_itxq_xmit(mvm->hw, txq); -+ local_bh_enable(); -+ } - } - - out: -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -index a3255100e3fee..7befb92b5159c 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -@@ -2557,7 +2557,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta, - } - - if (iwl_mvm_has_new_rx_api(mvm) && start) { -- u16 reorder_buf_size = buf_size * sizeof(baid_data->entries[0]); -+ u32 reorder_buf_size = buf_size * sizeof(baid_data->entries[0]); - - /* sparse doesn't like the __align() so don't check */ - #ifndef __CHECKER__ -diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c -index a956f965a1e5e..03bfd2482656c 100644 ---- a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c -+++ b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c -@@ -96,6 +96,7 @@ orinoco_cs_probe(struct pcmcia_device *link) - { - struct orinoco_private *priv; - struct orinoco_pccard *card; -+ int ret; - - priv = alloc_orinocodev(sizeof(*card), &link->dev, - orinoco_cs_hard_reset, NULL); -@@ -107,8 +108,16 @@ orinoco_cs_probe(struct pcmcia_device *link) - card->p_dev = link; - link->priv = priv; - -- return orinoco_cs_config(link); --} /* orinoco_cs_attach */ -+ ret = orinoco_cs_config(link); -+ if (ret) -+ goto err_free_orinocodev; -+ -+ return 0; -+ -+err_free_orinocodev: -+ free_orinocodev(priv); -+ return ret; -+} - - static void orinoco_cs_detach(struct pcmcia_device *link) - { -diff --git a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c -index b60048c95e0a8..011c86e55923e 100644 ---- a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c -+++ b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c -@@ -157,6 +157,7 @@ spectrum_cs_probe(struct pcmcia_device *link) - { - struct orinoco_private *priv; - struct orinoco_pccard *card; -+ int ret; - - priv = alloc_orinocodev(sizeof(*card), &link->dev, - spectrum_cs_hard_reset, -@@ -169,8 +170,16 @@ spectrum_cs_probe(struct pcmcia_device *link) - card->p_dev = link; - link->priv = priv; - -- return spectrum_cs_config(link); --} /* spectrum_cs_attach */ -+ ret = spectrum_cs_config(link); -+ if (ret) -+ goto err_free_orinocodev; -+ -+ return 0; -+ -+err_free_orinocodev: -+ free_orinocodev(priv); -+ return ret; -+} - - static void spectrum_cs_detach(struct pcmcia_device *link) - { -diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c -index 629af26675cf1..1ab04adc53dcd 100644 ---- a/drivers/net/wireless/marvell/mwifiex/scan.c -+++ b/drivers/net/wireless/marvell/mwifiex/scan.c -@@ -2202,9 +2202,9 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv, - - if (nd_config) { - adapter->nd_info = -- kzalloc(sizeof(struct cfg80211_wowlan_nd_match) + -- sizeof(struct cfg80211_wowlan_nd_match *) * -- scan_rsp->number_of_sets, GFP_ATOMIC); -+ kzalloc(struct_size(adapter->nd_info, matches, -+ scan_rsp->number_of_sets), -+ GFP_ATOMIC); - - if (adapter->nd_info) - adapter->nd_info->n_matches = scan_rsp->number_of_sets; -diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c -index 3836d6ac53049..d9c1ac5cb5626 100644 ---- a/drivers/net/wireless/ray_cs.c -+++ b/drivers/net/wireless/ray_cs.c -@@ -270,13 +270,14 @@ static int ray_probe(struct pcmcia_device *p_dev) - { - ray_dev_t *local; - struct net_device *dev; -+ int ret; - - dev_dbg(&p_dev->dev, "ray_attach()\n"); - - /* Allocate space for private device-specific data */ - dev = alloc_etherdev(sizeof(ray_dev_t)); - if (!dev) -- goto fail_alloc_dev; -+ return -ENOMEM; - - local = netdev_priv(dev); - local->finder = p_dev; -@@ -313,11 +314,16 @@ static int ray_probe(struct pcmcia_device *p_dev) - timer_setup(&local->timer, NULL, 0); - - this_device = p_dev; -- return ray_config(p_dev); -+ ret = ray_config(p_dev); -+ if (ret) -+ goto err_free_dev; -+ -+ return 0; - --fail_alloc_dev: -- return -ENOMEM; --} /* ray_attach */ -+err_free_dev: -+ free_netdev(dev); -+ return ret; -+} - - static void ray_detach(struct pcmcia_device *link) - { -@@ -1641,38 +1647,34 @@ static void authenticate_timeout(struct timer_list *t) - /*===========================================================================*/ - static int parse_addr(char *in_str, UCHAR *out) - { -+ int i, k; - int len; -- int i, j, k; -- int status; - - if (in_str == NULL) - return 0; -- if ((len = strlen(in_str)) < 2) -+ len = strnlen(in_str, ADDRLEN * 2 + 1) - 1; -+ if (len < 1) - return 0; - memset(out, 0, ADDRLEN); - -- status = 1; -- j = len - 1; -- if (j > 12) -- j = 12; - i = 5; - -- while (j > 0) { -- if ((k = hex_to_bin(in_str[j--])) != -1) -+ while (len > 0) { -+ if ((k = hex_to_bin(in_str[len--])) != -1) - out[i] = k; - else - return 0; - -- if (j == 0) -+ if (len == 0) - break; -- if ((k = hex_to_bin(in_str[j--])) != -1) -+ if ((k = hex_to_bin(in_str[len--])) != -1) - out[i] += k << 4; - else - return 0; - if (!i--) - break; - } -- return status; -+ return 1; - } - - /*===========================================================================*/ -diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c -index 4fe837090cdae..22b0567ad8261 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_sdio.c -+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c -@@ -1479,9 +1479,6 @@ static void rsi_shutdown(struct device *dev) - if (sdev->write_fail) - rsi_dbg(INFO_ZONE, "###### Device is not ready #######\n"); - -- if (rsi_set_sdio_pm_caps(adapter)) -- rsi_dbg(INFO_ZONE, "Setting power management caps failed\n"); -- - rsi_dbg(INFO_ZONE, "***** RSI module shut down *****\n"); - } - -diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c -index 8638c7c72bc30..e6505624f0c28 100644 ---- a/drivers/net/wireless/wl3501_cs.c -+++ b/drivers/net/wireless/wl3501_cs.c -@@ -134,8 +134,8 @@ static const struct { - - /** - * iw_valid_channel - validate channel in regulatory domain -- * @reg_comain - regulatory domain -- * @channel - channel to validate -+ * @reg_domain: regulatory domain -+ * @channel: channel to validate - * - * Returns 0 if invalid in the specified regulatory domain, non-zero if valid. - */ -@@ -154,7 +154,7 @@ static int iw_valid_channel(int reg_domain, int channel) - - /** - * iw_default_channel - get default channel for a regulatory domain -- * @reg_comain - regulatory domain -+ * @reg_domain: regulatory domain - * - * Returns the default channel for a regulatory domain - */ -@@ -237,6 +237,7 @@ static int wl3501_get_flash_mac_addr(struct wl3501_card *this) - - /** - * wl3501_set_to_wla - Move 'size' bytes from PC to card -+ * @this: Card - * @dest: Card addressing space - * @src: PC addressing space - * @size: Bytes to move -@@ -259,6 +260,7 @@ static void wl3501_set_to_wla(struct wl3501_card *this, u16 dest, void *src, - - /** - * wl3501_get_from_wla - Move 'size' bytes from card to PC -+ * @this: Card - * @src: Card addressing space - * @dest: PC addressing space - * @size: Bytes to move -@@ -455,12 +457,10 @@ out: - - /** - * wl3501_send_pkt - Send a packet. -- * @this - card -- * -- * Send a packet. -- * -- * data = Ethernet raw frame. (e.g. data[0] - data[5] is Dest MAC Addr, -+ * @this: Card -+ * @data: Ethernet raw frame. (e.g. data[0] - data[5] is Dest MAC Addr, - * data[6] - data[11] is Src MAC Addr) -+ * @len: Packet length - * Ref: IEEE 802.11 - */ - static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len) -@@ -723,7 +723,7 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr) - - /** - * wl3501_block_interrupt - Mask interrupt from SUTRO -- * @this - card -+ * @this: Card - * - * Mask interrupt from SUTRO. (i.e. SUTRO cannot interrupt the HOST) - * Return: 1 if interrupt is originally enabled -@@ -740,7 +740,7 @@ static int wl3501_block_interrupt(struct wl3501_card *this) - - /** - * wl3501_unblock_interrupt - Enable interrupt from SUTRO -- * @this - card -+ * @this: Card - * - * Enable interrupt from SUTRO. (i.e. SUTRO can interrupt the HOST) - * Return: 1 if interrupt is originally enabled -@@ -1114,8 +1114,8 @@ static inline void wl3501_ack_interrupt(struct wl3501_card *this) - - /** - * wl3501_interrupt - Hardware interrupt from card. -- * @irq - Interrupt number -- * @dev_id - net_device -+ * @irq: Interrupt number -+ * @dev_id: net_device - * - * We must acknowledge the interrupt as soon as possible, and block the - * interrupt from the same card immediately to prevent re-entry. -@@ -1251,7 +1251,7 @@ static int wl3501_close(struct net_device *dev) - - /** - * wl3501_reset - Reset the SUTRO. -- * @dev - network device -+ * @dev: network device - * - * It is almost the same as wl3501_open(). In fact, we may just wl3501_close() - * and wl3501_open() again, but I wouldn't like to free_irq() when the driver -@@ -1414,7 +1414,7 @@ static struct iw_statistics *wl3501_get_wireless_stats(struct net_device *dev) - - /** - * wl3501_detach - deletes a driver "instance" -- * @link - FILL_IN -+ * @link: FILL_IN - * - * This deletes a driver "instance". The device is de-registered with Card - * Services. If it has been released, all local data structures are freed. -@@ -1435,9 +1435,7 @@ static void wl3501_detach(struct pcmcia_device *link) - wl3501_release(link); - - unregister_netdev(dev); -- -- if (link->priv) -- free_netdev(link->priv); -+ free_netdev(dev); - } - - static int wl3501_get_name(struct net_device *dev, struct iw_request_info *info, -@@ -1864,6 +1862,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev) - { - struct net_device *dev; - struct wl3501_card *this; -+ int ret; - - /* The io structure describes IO port mapping */ - p_dev->resource[0]->end = 16; -@@ -1875,8 +1874,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev) - - dev = alloc_etherdev(sizeof(struct wl3501_card)); - if (!dev) -- goto out_link; -- -+ return -ENOMEM; - - dev->netdev_ops = &wl3501_netdev_ops; - dev->watchdog_timeo = 5 * HZ; -@@ -1889,9 +1887,15 @@ static int wl3501_probe(struct pcmcia_device *p_dev) - netif_stop_queue(dev); - p_dev->priv = dev; - -- return wl3501_config(p_dev); --out_link: -- return -ENOMEM; -+ ret = wl3501_config(p_dev); -+ if (ret) -+ goto out_free_etherdev; -+ -+ return 0; -+ -+out_free_etherdev: -+ free_netdev(dev); -+ return ret; - } - - static int wl3501_config(struct pcmcia_device *link) -@@ -1947,8 +1951,7 @@ static int wl3501_config(struct pcmcia_device *link) - goto failed; - } - -- for (i = 0; i < 6; i++) -- dev->dev_addr[i] = ((char *)&this->mac_addr)[i]; -+ eth_hw_addr_set(dev, this->mac_addr); - - /* print probe information */ - printk(KERN_INFO "%s: wl3501 @ 0x%3.3x, IRQ %d, " -diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c -index abb37659de343..50983d77329ea 100644 ---- a/drivers/ntb/hw/amd/ntb_hw_amd.c -+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c -@@ -1153,12 +1153,17 @@ static struct pci_driver amd_ntb_pci_driver = { - - static int __init amd_ntb_pci_driver_init(void) - { -+ int ret; - pr_info("%s %s\n", NTB_DESC, NTB_VER); - - if (debugfs_initialized()) - debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL); - -- return pci_register_driver(&amd_ntb_pci_driver); -+ ret = pci_register_driver(&amd_ntb_pci_driver); -+ if (ret) -+ debugfs_remove_recursive(debugfs_dir); -+ -+ return ret; - } - module_init(amd_ntb_pci_driver_init); - -diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c -index dcf2346805350..a0091900b0cfb 100644 ---- a/drivers/ntb/hw/idt/ntb_hw_idt.c -+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c -@@ -2908,6 +2908,7 @@ static struct pci_driver idt_pci_driver = { - - static int __init idt_pci_driver_init(void) - { -+ int ret; - pr_info("%s %s\n", NTB_DESC, NTB_VER); - - /* Create the top DebugFS directory if the FS is initialized */ -@@ -2915,7 +2916,11 @@ static int __init idt_pci_driver_init(void) - dbgfs_topdir = debugfs_create_dir(KBUILD_MODNAME, NULL); - - /* Register the NTB hardware driver to handle the PCI device */ -- return pci_register_driver(&idt_pci_driver); -+ ret = pci_register_driver(&idt_pci_driver); -+ if (ret) -+ debugfs_remove_recursive(dbgfs_topdir); -+ -+ return ret; - } - module_init(idt_pci_driver_init); - -diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c -index bb57ec2390299..8d8739bff9f3c 100644 ---- a/drivers/ntb/hw/intel/ntb_hw_gen1.c -+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c -@@ -2065,12 +2065,17 @@ static struct pci_driver intel_ntb_pci_driver = { - - static int __init intel_ntb_pci_driver_init(void) - { -+ int ret; - pr_info("%s %s\n", NTB_DESC, NTB_VER); - - if (debugfs_initialized()) - debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL); - -- return pci_register_driver(&intel_ntb_pci_driver); -+ ret = pci_register_driver(&intel_ntb_pci_driver); -+ if (ret) -+ debugfs_remove_recursive(debugfs_dir); -+ -+ return ret; - } - module_init(intel_ntb_pci_driver_init); - -diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c -index 00a5d5764993c..3cc0e8ebcdd5c 100644 ---- a/drivers/ntb/ntb_transport.c -+++ b/drivers/ntb/ntb_transport.c -@@ -412,7 +412,7 @@ int ntb_transport_register_client_dev(char *device_name) - - rc = device_register(dev); - if (rc) { -- kfree(client_dev); -+ put_device(dev); - goto err; - } - -diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c -index 6301aa413c3b8..1f64146546221 100644 ---- a/drivers/ntb/test/ntb_tool.c -+++ b/drivers/ntb/test/ntb_tool.c -@@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc) - tc->peers[pidx].outmws = - devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt, - sizeof(*tc->peers[pidx].outmws), GFP_KERNEL); -+ if (tc->peers[pidx].outmws == NULL) -+ return -ENOMEM; - - for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) { - tc->peers[pidx].outmws[widx].pidx = pidx; -diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c -index 17f411772f0ca..24dbb69688316 100644 ---- a/drivers/pci/controller/dwc/pcie-qcom.c -+++ b/drivers/pci/controller/dwc/pcie-qcom.c -@@ -807,6 +807,8 @@ static int qcom_pcie_get_resources_2_4_0(struct qcom_pcie *pcie) - return PTR_ERR(res->phy_ahb_reset); - } - -+ dw_pcie_dbi_ro_wr_dis(pci); -+ - return 0; - } - -diff --git a/drivers/pci/controller/pci-ftpci100.c b/drivers/pci/controller/pci-ftpci100.c -index bf5ece5d9291f..88983fd0c1bdd 100644 ---- a/drivers/pci/controller/pci-ftpci100.c -+++ b/drivers/pci/controller/pci-ftpci100.c -@@ -458,22 +458,12 @@ static int faraday_pci_probe(struct platform_device *pdev) - p->dev = dev; - - /* Retrieve and enable optional clocks */ -- clk = devm_clk_get(dev, "PCLK"); -+ clk = devm_clk_get_enabled(dev, "PCLK"); - if (IS_ERR(clk)) - return PTR_ERR(clk); -- ret = clk_prepare_enable(clk); -- if (ret) { -- dev_err(dev, "could not prepare PCLK\n"); -- return ret; -- } -- p->bus_clk = devm_clk_get(dev, "PCICLK"); -+ p->bus_clk = devm_clk_get_enabled(dev, "PCICLK"); - if (IS_ERR(p->bus_clk)) - return PTR_ERR(p->bus_clk); -- ret = clk_prepare_enable(p->bus_clk); -- if (ret) { -- dev_err(dev, "could not prepare PCICLK\n"); -- return ret; -- } - - regs = platform_get_resource(pdev, IORESOURCE_MEM, 0); - p->base = devm_ioremap_resource(dev, regs); -diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c -index b82edefffd15f..d7ab669b1b0d0 100644 ---- a/drivers/pci/controller/pcie-rockchip-ep.c -+++ b/drivers/pci/controller/pcie-rockchip-ep.c -@@ -124,6 +124,7 @@ static void rockchip_pcie_prog_ep_ob_atu(struct rockchip_pcie *rockchip, u8 fn, - static int rockchip_pcie_ep_write_header(struct pci_epc *epc, u8 fn, - struct pci_epf_header *hdr) - { -+ u32 reg; - struct rockchip_pcie_ep *ep = epc_get_drvdata(epc); - struct rockchip_pcie *rockchip = &ep->rockchip; - -@@ -136,8 +137,9 @@ static int rockchip_pcie_ep_write_header(struct pci_epc *epc, u8 fn, - PCIE_CORE_CONFIG_VENDOR); - } - -- rockchip_pcie_write(rockchip, hdr->deviceid << 16, -- ROCKCHIP_PCIE_EP_FUNC_BASE(fn) + PCI_VENDOR_ID); -+ reg = rockchip_pcie_read(rockchip, PCIE_EP_CONFIG_DID_VID); -+ reg = (reg & 0xFFFF) | (hdr->deviceid << 16); -+ rockchip_pcie_write(rockchip, reg, PCIE_EP_CONFIG_DID_VID); - - rockchip_pcie_write(rockchip, - hdr->revid | -@@ -311,15 +313,15 @@ static int rockchip_pcie_ep_set_msi(struct pci_epc *epc, u8 fn, - { - struct rockchip_pcie_ep *ep = epc_get_drvdata(epc); - struct rockchip_pcie *rockchip = &ep->rockchip; -- u16 flags; -+ u32 flags; - - flags = rockchip_pcie_read(rockchip, - ROCKCHIP_PCIE_EP_FUNC_BASE(fn) + - ROCKCHIP_PCIE_EP_MSI_CTRL_REG); - flags &= ~ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_MASK; - flags |= -- ((multi_msg_cap << 1) << ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_OFFSET) | -- PCI_MSI_FLAGS_64BIT; -+ (multi_msg_cap << ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_OFFSET) | -+ (PCI_MSI_FLAGS_64BIT << ROCKCHIP_PCIE_EP_MSI_FLAGS_OFFSET); - flags &= ~ROCKCHIP_PCIE_EP_MSI_CTRL_MASK_MSI_CAP; - rockchip_pcie_write(rockchip, flags, - ROCKCHIP_PCIE_EP_FUNC_BASE(fn) + -@@ -331,7 +333,7 @@ static int rockchip_pcie_ep_get_msi(struct pci_epc *epc, u8 fn) - { - struct rockchip_pcie_ep *ep = epc_get_drvdata(epc); - struct rockchip_pcie *rockchip = &ep->rockchip; -- u16 flags; -+ u32 flags; - - flags = rockchip_pcie_read(rockchip, - ROCKCHIP_PCIE_EP_FUNC_BASE(fn) + -@@ -344,48 +346,25 @@ static int rockchip_pcie_ep_get_msi(struct pci_epc *epc, u8 fn) - } - - static void rockchip_pcie_ep_assert_intx(struct rockchip_pcie_ep *ep, u8 fn, -- u8 intx, bool is_asserted) -+ u8 intx, bool do_assert) - { - struct rockchip_pcie *rockchip = &ep->rockchip; -- u32 r = ep->max_regions - 1; -- u32 offset; -- u32 status; -- u8 msg_code; -- -- if (unlikely(ep->irq_pci_addr != ROCKCHIP_PCIE_EP_PCI_LEGACY_IRQ_ADDR || -- ep->irq_pci_fn != fn)) { -- rockchip_pcie_prog_ep_ob_atu(rockchip, fn, r, -- AXI_WRAPPER_NOR_MSG, -- ep->irq_phys_addr, 0, 0); -- ep->irq_pci_addr = ROCKCHIP_PCIE_EP_PCI_LEGACY_IRQ_ADDR; -- ep->irq_pci_fn = fn; -- } - - intx &= 3; -- if (is_asserted) { -+ -+ if (do_assert) { - ep->irq_pending |= BIT(intx); -- msg_code = ROCKCHIP_PCIE_MSG_CODE_ASSERT_INTA + intx; -+ rockchip_pcie_write(rockchip, -+ PCIE_CLIENT_INT_IN_ASSERT | -+ PCIE_CLIENT_INT_PEND_ST_PEND, -+ PCIE_CLIENT_LEGACY_INT_CTRL); - } else { - ep->irq_pending &= ~BIT(intx); -- msg_code = ROCKCHIP_PCIE_MSG_CODE_DEASSERT_INTA + intx; -+ rockchip_pcie_write(rockchip, -+ PCIE_CLIENT_INT_IN_DEASSERT | -+ PCIE_CLIENT_INT_PEND_ST_NORMAL, -+ PCIE_CLIENT_LEGACY_INT_CTRL); - } -- -- status = rockchip_pcie_read(rockchip, -- ROCKCHIP_PCIE_EP_FUNC_BASE(fn) + -- ROCKCHIP_PCIE_EP_CMD_STATUS); -- status &= ROCKCHIP_PCIE_EP_CMD_STATUS_IS; -- -- if ((status != 0) ^ (ep->irq_pending != 0)) { -- status ^= ROCKCHIP_PCIE_EP_CMD_STATUS_IS; -- rockchip_pcie_write(rockchip, status, -- ROCKCHIP_PCIE_EP_FUNC_BASE(fn) + -- ROCKCHIP_PCIE_EP_CMD_STATUS); -- } -- -- offset = -- ROCKCHIP_PCIE_MSG_ROUTING(ROCKCHIP_PCIE_MSG_ROUTING_LOCAL_INTX) | -- ROCKCHIP_PCIE_MSG_CODE(msg_code) | ROCKCHIP_PCIE_MSG_NO_DATA; -- writel(0, ep->irq_cpu_addr + offset); - } - - static int rockchip_pcie_ep_send_legacy_irq(struct rockchip_pcie_ep *ep, u8 fn, -@@ -415,7 +394,7 @@ static int rockchip_pcie_ep_send_msi_irq(struct rockchip_pcie_ep *ep, u8 fn, - u8 interrupt_num) - { - struct rockchip_pcie *rockchip = &ep->rockchip; -- u16 flags, mme, data, data_mask; -+ u32 flags, mme, data, data_mask; - u8 msi_count; - u64 pci_addr, pci_addr_mask = 0xff; - -@@ -505,6 +484,7 @@ static const struct pci_epc_features rockchip_pcie_epc_features = { - .linkup_notifier = false, - .msi_capable = true, - .msix_capable = false, -+ .align = 256, - }; - - static const struct pci_epc_features* -@@ -630,6 +610,9 @@ static int rockchip_pcie_ep_probe(struct platform_device *pdev) - - ep->irq_pci_addr = ROCKCHIP_PCIE_EP_DUMMY_IRQ_ADDR; - -+ rockchip_pcie_write(rockchip, PCIE_CLIENT_CONF_ENABLE, -+ PCIE_CLIENT_CONFIG); -+ - return 0; - err_epc_mem_exit: - pci_epc_mem_exit(epc); -diff --git a/drivers/pci/controller/pcie-rockchip.c b/drivers/pci/controller/pcie-rockchip.c -index c53d1322a3d6c..b047437605cb2 100644 ---- a/drivers/pci/controller/pcie-rockchip.c -+++ b/drivers/pci/controller/pcie-rockchip.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -154,6 +155,12 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip) - } - EXPORT_SYMBOL_GPL(rockchip_pcie_parse_dt); - -+#define rockchip_pcie_read_addr(addr) rockchip_pcie_read(rockchip, addr) -+/* 100 ms max wait time for PHY PLLs to lock */ -+#define RK_PHY_PLL_LOCK_TIMEOUT_US 100000 -+/* Sleep should be less than 20ms */ -+#define RK_PHY_PLL_LOCK_SLEEP_US 1000 -+ - int rockchip_pcie_init_port(struct rockchip_pcie *rockchip) - { - struct device *dev = rockchip->dev; -@@ -255,6 +262,16 @@ int rockchip_pcie_init_port(struct rockchip_pcie *rockchip) - } - } - -+ err = readx_poll_timeout(rockchip_pcie_read_addr, -+ PCIE_CLIENT_SIDE_BAND_STATUS, -+ regs, !(regs & PCIE_CLIENT_PHY_ST), -+ RK_PHY_PLL_LOCK_SLEEP_US, -+ RK_PHY_PLL_LOCK_TIMEOUT_US); -+ if (err) { -+ dev_err(dev, "PHY PLLs could not lock, %d\n", err); -+ goto err_power_off_phy; -+ } -+ - /* - * Please don't reorder the deassert sequence of the following - * four reset pins. -diff --git a/drivers/pci/controller/pcie-rockchip.h b/drivers/pci/controller/pcie-rockchip.h -index 8e87a059ce73d..1c45b3c32151c 100644 ---- a/drivers/pci/controller/pcie-rockchip.h -+++ b/drivers/pci/controller/pcie-rockchip.h -@@ -37,6 +37,13 @@ - #define PCIE_CLIENT_MODE_EP HIWORD_UPDATE(0x0040, 0) - #define PCIE_CLIENT_GEN_SEL_1 HIWORD_UPDATE(0x0080, 0) - #define PCIE_CLIENT_GEN_SEL_2 HIWORD_UPDATE_BIT(0x0080) -+#define PCIE_CLIENT_LEGACY_INT_CTRL (PCIE_CLIENT_BASE + 0x0c) -+#define PCIE_CLIENT_INT_IN_ASSERT HIWORD_UPDATE_BIT(0x0002) -+#define PCIE_CLIENT_INT_IN_DEASSERT HIWORD_UPDATE(0x0002, 0) -+#define PCIE_CLIENT_INT_PEND_ST_PEND HIWORD_UPDATE_BIT(0x0001) -+#define PCIE_CLIENT_INT_PEND_ST_NORMAL HIWORD_UPDATE(0x0001, 0) -+#define PCIE_CLIENT_SIDE_BAND_STATUS (PCIE_CLIENT_BASE + 0x20) -+#define PCIE_CLIENT_PHY_ST BIT(12) - #define PCIE_CLIENT_DEBUG_OUT_0 (PCIE_CLIENT_BASE + 0x3c) - #define PCIE_CLIENT_DEBUG_LTSSM_MASK GENMASK(5, 0) - #define PCIE_CLIENT_DEBUG_LTSSM_L1 0x18 -@@ -132,6 +139,8 @@ - #define PCIE_RC_RP_ATS_BASE 0x400000 - #define PCIE_RC_CONFIG_NORMAL_BASE 0x800000 - #define PCIE_RC_CONFIG_BASE 0xa00000 -+#define PCIE_EP_CONFIG_BASE 0xa00000 -+#define PCIE_EP_CONFIG_DID_VID (PCIE_EP_CONFIG_BASE + 0x00) - #define PCIE_RC_CONFIG_RID_CCR (PCIE_RC_CONFIG_BASE + 0x08) - #define PCIE_RC_CONFIG_SCC_SHIFT 16 - #define PCIE_RC_CONFIG_DCR (PCIE_RC_CONFIG_BASE + 0xc4) -@@ -223,6 +232,7 @@ - #define ROCKCHIP_PCIE_EP_CMD_STATUS 0x4 - #define ROCKCHIP_PCIE_EP_CMD_STATUS_IS BIT(19) - #define ROCKCHIP_PCIE_EP_MSI_CTRL_REG 0x90 -+#define ROCKCHIP_PCIE_EP_MSI_FLAGS_OFFSET 16 - #define ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_OFFSET 17 - #define ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_MASK GENMASK(19, 17) - #define ROCKCHIP_PCIE_EP_MSI_CTRL_MME_OFFSET 20 -@@ -230,7 +240,6 @@ - #define ROCKCHIP_PCIE_EP_MSI_CTRL_ME BIT(16) - #define ROCKCHIP_PCIE_EP_MSI_CTRL_MASK_MSI_CAP BIT(24) - #define ROCKCHIP_PCIE_EP_DUMMY_IRQ_ADDR 0x1 --#define ROCKCHIP_PCIE_EP_PCI_LEGACY_IRQ_ADDR 0x3 - #define ROCKCHIP_PCIE_EP_FUNC_BASE(fn) (((fn) << 12) & GENMASK(19, 12)) - #define ROCKCHIP_PCIE_AT_IB_EP_FUNC_BAR_ADDR0(fn, bar) \ - (PCIE_RC_RP_ATS_BASE + 0x0840 + (fn) * 0x0040 + (bar) * 0x0008) -diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c -index 6503d15effbbd..45d0f63707158 100644 ---- a/drivers/pci/hotplug/pciehp_ctrl.c -+++ b/drivers/pci/hotplug/pciehp_ctrl.c -@@ -258,6 +258,14 @@ void pciehp_handle_presence_or_link_change(struct controller *ctrl, u32 events) - present = pciehp_card_present(ctrl); - link_active = pciehp_check_link_active(ctrl); - if (present <= 0 && link_active <= 0) { -+ if (ctrl->state == BLINKINGON_STATE) { -+ ctrl->state = OFF_STATE; -+ cancel_delayed_work(&ctrl->button_work); -+ pciehp_set_indicators(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF, -+ INDICATOR_NOOP); -+ ctrl_info(ctrl, "Slot(%s): Card not present\n", -+ slot_name(ctrl)); -+ } - mutex_unlock(&ctrl->state_lock); - return; - } -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index f8c730b6701b6..64c89b23e99f7 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -2617,13 +2617,13 @@ static const struct dmi_system_id bridge_d3_blacklist[] = { - { - /* - * Downstream device is not accessible after putting a root port -- * into D3cold and back into D0 on Elo i2. -+ * into D3cold and back into D0 on Elo Continental Z2 board - */ -- .ident = "Elo i2", -+ .ident = "Elo Continental Z2", - .matches = { -- DMI_MATCH(DMI_SYS_VENDOR, "Elo Touch Solutions"), -- DMI_MATCH(DMI_PRODUCT_NAME, "Elo i2"), -- DMI_MATCH(DMI_PRODUCT_VERSION, "RevB"), -+ DMI_MATCH(DMI_BOARD_VENDOR, "Elo Touch Solutions"), -+ DMI_MATCH(DMI_BOARD_NAME, "Geminilake"), -+ DMI_MATCH(DMI_BOARD_VERSION, "Continental Z2"), - }, - }, - #endif -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index 7624c71011c6e..d8d27b11b48c4 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -991,21 +991,24 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) - - down_read(&pci_bus_sem); - mutex_lock(&aspm_lock); -- /* -- * All PCIe functions are in one slot, remove one function will remove -- * the whole slot, so just wait until we are the last function left. -- */ -- if (!list_empty(&parent->subordinate->devices)) -- goto out; - - link = parent->link_state; - root = link->root; - parent_link = link->parent; - -- /* All functions are removed, so just disable ASPM for the link */ -+ /* -+ * link->downstream is a pointer to the pci_dev of function 0. If -+ * we remove that function, the pci_dev is about to be deallocated, -+ * so we can't use link->downstream again. Free the link state to -+ * avoid this. -+ * -+ * If we're removing a non-0 function, it's possible we could -+ * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends -+ * programming the same ASPM Control value for all functions of -+ * multi-function devices, so disable ASPM for all of them. -+ */ - pcie_config_aspm_link(link, 0); - list_del(&link->sibling); -- /* Clock PM is for endpoint device */ - free_link_state(link); - - /* Recheck latencies and configure upstream links */ -@@ -1013,7 +1016,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) - pcie_update_aspm_capable(root); - pcie_config_aspm_path(parent_link); - } --out: -+ - mutex_unlock(&aspm_lock); - up_read(&pci_bus_sem); - } -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 449d4ed611a68..73260bd217278 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -4168,6 +4168,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9220, - /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c49 */ - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230, - quirk_dma_func1_alias); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9235, -+ quirk_dma_func1_alias); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0642, - quirk_dma_func1_alias); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0645, -diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c -index 8f06445a8e39c..2b48901f1b2af 100644 ---- a/drivers/pinctrl/intel/pinctrl-cherryview.c -+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c -@@ -1021,11 +1021,6 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin, - - break; - -- case PIN_CONFIG_DRIVE_OPEN_DRAIN: -- if (!(ctrl1 & CHV_PADCTRL1_ODEN)) -- return -EINVAL; -- break; -- - case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: { - u32 cfg; - -@@ -1035,6 +1030,16 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin, - return -EINVAL; - - break; -+ -+ case PIN_CONFIG_DRIVE_PUSH_PULL: -+ if (ctrl1 & CHV_PADCTRL1_ODEN) -+ return -EINVAL; -+ break; -+ -+ case PIN_CONFIG_DRIVE_OPEN_DRAIN: -+ if (!(ctrl1 & CHV_PADCTRL1_ODEN)) -+ return -EINVAL; -+ break; - } - - default: -diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c -index 887dc57704402..2415085eadeda 100644 ---- a/drivers/pinctrl/pinctrl-amd.c -+++ b/drivers/pinctrl/pinctrl-amd.c -@@ -123,6 +123,14 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset, - struct amd_gpio *gpio_dev = gpiochip_get_data(gc); - - raw_spin_lock_irqsave(&gpio_dev->lock, flags); -+ -+ /* Use special handling for Pin0 debounce */ -+ if (offset == 0) { -+ pin_reg = readl(gpio_dev->base + WAKE_INT_MASTER_REG); -+ if (pin_reg & INTERNAL_GPIO0_DEBOUNCE) -+ debounce = 0; -+ } -+ - pin_reg = readl(gpio_dev->base + offset * 4); - - if (debounce) { -@@ -178,18 +186,6 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset, - return ret; - } - --static int amd_gpio_set_config(struct gpio_chip *gc, unsigned offset, -- unsigned long config) --{ -- u32 debounce; -- -- if (pinconf_to_config_param(config) != PIN_CONFIG_INPUT_DEBOUNCE) -- return -ENOTSUPP; -- -- debounce = pinconf_to_config_argument(config); -- return amd_gpio_set_debounce(gc, offset, debounce); --} -- - #ifdef CONFIG_DEBUG_FS - static void amd_gpio_dbg_show(struct seq_file *s, struct gpio_chip *gc) - { -@@ -212,6 +208,7 @@ static void amd_gpio_dbg_show(struct seq_file *s, struct gpio_chip *gc) - char *output_value; - char *output_enable; - -+ seq_printf(s, "WAKE_INT_MASTER_REG: 0x%08x\n", readl(gpio_dev->base + WAKE_INT_MASTER_REG)); - for (bank = 0; bank < gpio_dev->hwbank_num; bank++) { - seq_printf(s, "GPIO bank%d\t", bank); - -@@ -673,7 +670,7 @@ static int amd_pinconf_get(struct pinctrl_dev *pctldev, - } - - static int amd_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, -- unsigned long *configs, unsigned num_configs) -+ unsigned long *configs, unsigned int num_configs) - { - int i; - u32 arg; -@@ -763,6 +760,20 @@ static int amd_pinconf_group_set(struct pinctrl_dev *pctldev, - return 0; - } - -+static int amd_gpio_set_config(struct gpio_chip *gc, unsigned int pin, -+ unsigned long config) -+{ -+ struct amd_gpio *gpio_dev = gpiochip_get_data(gc); -+ -+ if (pinconf_to_config_param(config) == PIN_CONFIG_INPUT_DEBOUNCE) { -+ u32 debounce = pinconf_to_config_argument(config); -+ -+ return amd_gpio_set_debounce(gc, pin, debounce); -+ } -+ -+ return amd_pinconf_set(gpio_dev->pctrl, pin, &config, 1); -+} -+ - static const struct pinconf_ops amd_pinconf_ops = { - .pin_config_get = amd_pinconf_get, - .pin_config_set = amd_pinconf_set, -@@ -790,9 +801,9 @@ static void amd_gpio_irq_init(struct amd_gpio *gpio_dev) - - raw_spin_lock_irqsave(&gpio_dev->lock, flags); - -- pin_reg = readl(gpio_dev->base + i * 4); -+ pin_reg = readl(gpio_dev->base + pin * 4); - pin_reg &= ~mask; -- writel(pin_reg, gpio_dev->base + i * 4); -+ writel(pin_reg, gpio_dev->base + pin * 4); - - raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); - } -diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h -index d4a192df5fabd..55ff463bb9960 100644 ---- a/drivers/pinctrl/pinctrl-amd.h -+++ b/drivers/pinctrl/pinctrl-amd.h -@@ -17,6 +17,7 @@ - #define AMD_GPIO_PINS_BANK3 32 - - #define WAKE_INT_MASTER_REG 0xfc -+#define INTERNAL_GPIO0_DEBOUNCE (1 << 15) - #define EOI_MASK (1 << 29) - - #define WAKE_INT_STATUS_REG0 0x2f8 -diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c -index 064b7c3c942a9..9c225256e3f4e 100644 ---- a/drivers/pinctrl/pinctrl-at91-pio4.c -+++ b/drivers/pinctrl/pinctrl-at91-pio4.c -@@ -1013,6 +1013,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev) - /* Pin naming convention: P(bank_name)(bank_pin_number). */ - pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d", - bank + 'A', line); -+ if (!pin_desc[i].name) -+ return -ENOMEM; - - group->name = group_names[i] = pin_desc[i].name; - group->pin = pin_desc[i].number; -diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c -index cb029126a68c6..67c4ec554ada8 100644 ---- a/drivers/platform/x86/wmi.c -+++ b/drivers/platform/x86/wmi.c -@@ -39,7 +39,7 @@ MODULE_LICENSE("GPL"); - static LIST_HEAD(wmi_block_list); - - struct guid_block { -- char guid[16]; -+ guid_t guid; - union { - char object_id[2]; - struct { -@@ -110,17 +110,17 @@ static struct platform_driver acpi_wmi_driver = { - - static bool find_guid(const char *guid_string, struct wmi_block **out) - { -- uuid_le guid_input; -+ guid_t guid_input; - struct wmi_block *wblock; - struct guid_block *block; - -- if (uuid_le_to_bin(guid_string, &guid_input)) -+ if (guid_parse(guid_string, &guid_input)) - return false; - - list_for_each_entry(wblock, &wmi_block_list, list) { - block = &wblock->gblock; - -- if (memcmp(block->guid, &guid_input, 16) == 0) { -+ if (guid_equal(&block->guid, &guid_input)) { - if (out) - *out = wblock; - return true; -@@ -129,11 +129,20 @@ static bool find_guid(const char *guid_string, struct wmi_block **out) - return false; - } - -+static bool guid_parse_and_compare(const char *string, const guid_t *guid) -+{ -+ guid_t guid_input; -+ -+ if (guid_parse(string, &guid_input)) -+ return false; -+ -+ return guid_equal(&guid_input, guid); -+} -+ - static const void *find_guid_context(struct wmi_block *wblock, - struct wmi_driver *wdriver) - { - const struct wmi_device_id *id; -- uuid_le guid_input; - - if (wblock == NULL || wdriver == NULL) - return NULL; -@@ -142,9 +151,7 @@ static const void *find_guid_context(struct wmi_block *wblock, - - id = wdriver->id_table; - while (*id->guid_string) { -- if (uuid_le_to_bin(id->guid_string, &guid_input)) -- continue; -- if (!memcmp(wblock->gblock.guid, &guid_input, 16)) -+ if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid)) - return id->context; - id++; - } -@@ -456,7 +463,7 @@ EXPORT_SYMBOL_GPL(wmi_set_block); - - static void wmi_dump_wdg(const struct guid_block *g) - { -- pr_info("%pUL:\n", g->guid); -+ pr_info("%pUL:\n", &g->guid); - if (g->flags & ACPI_WMI_EVENT) - pr_info("\tnotify_id: 0x%02X\n", g->notify_id); - else -@@ -526,18 +533,18 @@ wmi_notify_handler handler, void *data) - { - struct wmi_block *block; - acpi_status status = AE_NOT_EXIST; -- uuid_le guid_input; -+ guid_t guid_input; - - if (!guid || !handler) - return AE_BAD_PARAMETER; - -- if (uuid_le_to_bin(guid, &guid_input)) -+ if (guid_parse(guid, &guid_input)) - return AE_BAD_PARAMETER; - - list_for_each_entry(block, &wmi_block_list, list) { - acpi_status wmi_status; - -- if (memcmp(block->gblock.guid, &guid_input, 16) == 0) { -+ if (guid_equal(&block->gblock.guid, &guid_input)) { - if (block->handler && - block->handler != wmi_notify_debug) - return AE_ALREADY_ACQUIRED; -@@ -565,18 +572,18 @@ acpi_status wmi_remove_notify_handler(const char *guid) - { - struct wmi_block *block; - acpi_status status = AE_NOT_EXIST; -- uuid_le guid_input; -+ guid_t guid_input; - - if (!guid) - return AE_BAD_PARAMETER; - -- if (uuid_le_to_bin(guid, &guid_input)) -+ if (guid_parse(guid, &guid_input)) - return AE_BAD_PARAMETER; - - list_for_each_entry(block, &wmi_block_list, list) { - acpi_status wmi_status; - -- if (memcmp(block->gblock.guid, &guid_input, 16) == 0) { -+ if (guid_equal(&block->gblock.guid, &guid_input)) { - if (!block->handler || - block->handler == wmi_notify_debug) - return AE_NULL_ENTRY; -@@ -612,7 +619,6 @@ acpi_status wmi_get_event_data(u32 event, struct acpi_buffer *out) - { - struct acpi_object_list input; - union acpi_object params[1]; -- struct guid_block *gblock; - struct wmi_block *wblock; - - input.count = 1; -@@ -621,7 +627,7 @@ acpi_status wmi_get_event_data(u32 event, struct acpi_buffer *out) - params[0].integer.value = event; - - list_for_each_entry(wblock, &wmi_block_list, list) { -- gblock = &wblock->gblock; -+ struct guid_block *gblock = &wblock->gblock; - - if ((gblock->flags & ACPI_WMI_EVENT) && - (gblock->notify_id == event)) -@@ -682,7 +688,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr, - { - struct wmi_block *wblock = dev_to_wblock(dev); - -- return sprintf(buf, "wmi:%pUL\n", wblock->gblock.guid); -+ return sprintf(buf, "wmi:%pUL\n", &wblock->gblock.guid); - } - static DEVICE_ATTR_RO(modalias); - -@@ -691,7 +697,7 @@ static ssize_t guid_show(struct device *dev, struct device_attribute *attr, - { - struct wmi_block *wblock = dev_to_wblock(dev); - -- return sprintf(buf, "%pUL\n", wblock->gblock.guid); -+ return sprintf(buf, "%pUL\n", &wblock->gblock.guid); - } - static DEVICE_ATTR_RO(guid); - -@@ -774,10 +780,10 @@ static int wmi_dev_uevent(struct device *dev, struct kobj_uevent_env *env) - { - struct wmi_block *wblock = dev_to_wblock(dev); - -- if (add_uevent_var(env, "MODALIAS=wmi:%pUL", wblock->gblock.guid)) -+ if (add_uevent_var(env, "MODALIAS=wmi:%pUL", &wblock->gblock.guid)) - return -ENOMEM; - -- if (add_uevent_var(env, "WMI_GUID=%pUL", wblock->gblock.guid)) -+ if (add_uevent_var(env, "WMI_GUID=%pUL", &wblock->gblock.guid)) - return -ENOMEM; - - return 0; -@@ -801,11 +807,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver) - return 0; - - while (*id->guid_string) { -- uuid_le driver_guid; -- -- if (WARN_ON(uuid_le_to_bin(id->guid_string, &driver_guid))) -- continue; -- if (!memcmp(&driver_guid, wblock->gblock.guid, 16)) -+ if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid)) - return 1; - - id++; -@@ -1039,7 +1041,6 @@ static const struct device_type wmi_type_data = { - }; - - static int wmi_create_device(struct device *wmi_bus_dev, -- const struct guid_block *gblock, - struct wmi_block *wblock, - struct acpi_device *device) - { -@@ -1047,12 +1048,12 @@ static int wmi_create_device(struct device *wmi_bus_dev, - char method[5]; - int result; - -- if (gblock->flags & ACPI_WMI_EVENT) { -+ if (wblock->gblock.flags & ACPI_WMI_EVENT) { - wblock->dev.dev.type = &wmi_type_event; - goto out_init; - } - -- if (gblock->flags & ACPI_WMI_METHOD) { -+ if (wblock->gblock.flags & ACPI_WMI_METHOD) { - wblock->dev.dev.type = &wmi_type_method; - mutex_init(&wblock->char_mutex); - goto out_init; -@@ -1102,7 +1103,7 @@ static int wmi_create_device(struct device *wmi_bus_dev, - wblock->dev.dev.bus = &wmi_bus_type; - wblock->dev.dev.parent = wmi_bus_dev; - -- dev_set_name(&wblock->dev.dev, "%pUL", gblock->guid); -+ dev_set_name(&wblock->dev.dev, "%pUL", &wblock->gblock.guid); - - device_initialize(&wblock->dev.dev); - -@@ -1122,13 +1123,12 @@ static void wmi_free_devices(struct acpi_device *device) - } - } - --static bool guid_already_parsed(struct acpi_device *device, -- const u8 *guid) -+static bool guid_already_parsed(struct acpi_device *device, const guid_t *guid) - { - struct wmi_block *wblock; - - list_for_each_entry(wblock, &wmi_block_list, list) { -- if (memcmp(wblock->gblock.guid, guid, 16) == 0) { -+ if (guid_equal(&wblock->gblock.guid, guid)) { - /* - * Because we historically didn't track the relationship - * between GUIDs and ACPI nodes, we don't know whether -@@ -1183,7 +1183,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device) - * case yet, so for now, we'll just ignore the duplicate - * for device creation. - */ -- if (guid_already_parsed(device, gblock[i].guid)) -+ if (guid_already_parsed(device, &gblock[i].guid)) - continue; - - wblock = kzalloc(sizeof(struct wmi_block), GFP_KERNEL); -@@ -1195,7 +1195,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device) - wblock->acpi_device = device; - wblock->gblock = gblock[i]; - -- retval = wmi_create_device(wmi_bus_dev, &gblock[i], wblock, device); -+ retval = wmi_create_device(wmi_bus_dev, wblock, device); - if (retval) { - kfree(wblock); - continue; -@@ -1220,7 +1220,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device) - retval = device_add(&wblock->dev.dev); - if (retval) { - dev_err(wmi_bus_dev, "failed to register %pUL\n", -- wblock->gblock.guid); -+ &wblock->gblock.guid); - if (debug_event) - wmi_method_enable(wblock, 0); - list_del(&wblock->list); -@@ -1280,12 +1280,11 @@ acpi_wmi_ec_space_handler(u32 function, acpi_physical_address address, - static void acpi_wmi_notify_handler(acpi_handle handle, u32 event, - void *context) - { -- struct guid_block *block; - struct wmi_block *wblock; - bool found_it = false; - - list_for_each_entry(wblock, &wmi_block_list, list) { -- block = &wblock->gblock; -+ struct guid_block *block = &wblock->gblock; - - if (wblock->acpi_device->handle == handle && - (block->flags & ACPI_WMI_EVENT) && -@@ -1333,10 +1332,8 @@ static void acpi_wmi_notify_handler(acpi_handle handle, u32 event, - wblock->handler(event, wblock->handler_data); - } - -- if (debug_event) { -- pr_info("DEBUG Event GUID: %pUL\n", -- wblock->gblock.guid); -- } -+ if (debug_event) -+ pr_info("DEBUG Event GUID: %pUL\n", &wblock->gblock.guid); - - acpi_bus_generate_netlink_event( - wblock->acpi_device->pnp.device_class, -diff --git a/drivers/powercap/Kconfig b/drivers/powercap/Kconfig -index dc1c1381d7fa9..61fd5dfaf7a0f 100644 ---- a/drivers/powercap/Kconfig -+++ b/drivers/powercap/Kconfig -@@ -18,10 +18,12 @@ if POWERCAP - # Client driver configurations go here. - config INTEL_RAPL_CORE - tristate -+ depends on PCI -+ select IOSF_MBI - - config INTEL_RAPL - tristate "Intel RAPL Support via MSR Interface" -- depends on X86 && IOSF_MBI -+ depends on X86 && PCI - select INTEL_RAPL_CORE - ---help--- - This enables support for the Intel Running Average Power Limit (RAPL) -diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c -index d5487965bdfe9..6091e462626a4 100644 ---- a/drivers/powercap/intel_rapl_msr.c -+++ b/drivers/powercap/intel_rapl_msr.c -@@ -22,7 +22,6 @@ - #include - #include - --#include - #include - #include - -diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c -index 9145f61606497..85aad55b7a8f0 100644 ---- a/drivers/pwm/pwm-imx-tpm.c -+++ b/drivers/pwm/pwm-imx-tpm.c -@@ -405,6 +405,13 @@ static int __maybe_unused pwm_imx_tpm_suspend(struct device *dev) - if (tpm->enable_count > 0) - return -EBUSY; - -+ /* -+ * Force 'real_period' to be zero to force period update code -+ * can be executed after system resume back, since suspend causes -+ * the period related registers to become their reset values. -+ */ -+ tpm->real_period = 0; -+ - clk_disable_unprepare(tpm->clk); - - return 0; -diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c -index 2389b86698468..986f3a29a13d5 100644 ---- a/drivers/pwm/sysfs.c -+++ b/drivers/pwm/sysfs.c -@@ -424,6 +424,13 @@ static int pwm_class_resume_npwm(struct device *parent, unsigned int npwm) - if (!export) - continue; - -+ /* If pwmchip was not enabled before suspend, do nothing. */ -+ if (!export->suspend.enabled) { -+ /* release lock taken in pwm_class_get_state */ -+ mutex_unlock(&export->lock); -+ continue; -+ } -+ - state.enabled = export->suspend.enabled; - ret = pwm_class_apply_state(export, pwm, &state); - if (ret < 0) -@@ -448,7 +455,17 @@ static int __maybe_unused pwm_class_suspend(struct device *parent) - if (!export) - continue; - -+ /* -+ * If pwmchip was not enabled before suspend, save -+ * state for resume time and do nothing else. -+ */ - export->suspend = state; -+ if (!state.enabled) { -+ /* release lock taken in pwm_class_get_state */ -+ mutex_unlock(&export->lock); -+ continue; -+ } -+ - state.enabled = false; - ret = pwm_class_apply_state(export, pwm, &state); - if (ret < 0) { -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index cc9aa95d69691..fe4b666edd037 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -1710,19 +1710,17 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, - - if (err != -EEXIST) - regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs); -- if (!regulator->debugfs) { -+ if (IS_ERR(regulator->debugfs)) - rdev_dbg(rdev, "Failed to create debugfs directory\n"); -- } else { -- debugfs_create_u32("uA_load", 0444, regulator->debugfs, -- ®ulator->uA_load); -- debugfs_create_u32("min_uV", 0444, regulator->debugfs, -- ®ulator->voltage[PM_SUSPEND_ON].min_uV); -- debugfs_create_u32("max_uV", 0444, regulator->debugfs, -- ®ulator->voltage[PM_SUSPEND_ON].max_uV); -- debugfs_create_file("constraint_flags", 0444, -- regulator->debugfs, regulator, -- &constraint_flags_fops); -- } -+ -+ debugfs_create_u32("uA_load", 0444, regulator->debugfs, -+ ®ulator->uA_load); -+ debugfs_create_u32("min_uV", 0444, regulator->debugfs, -+ ®ulator->voltage[PM_SUSPEND_ON].min_uV); -+ debugfs_create_u32("max_uV", 0444, regulator->debugfs, -+ ®ulator->voltage[PM_SUSPEND_ON].max_uV); -+ debugfs_create_file("constraint_flags", 0444, regulator->debugfs, -+ regulator, &constraint_flags_fops); - - /* - * Check now if the regulator is an always on regulator - if -@@ -4906,10 +4904,8 @@ static void rdev_init_debugfs(struct regulator_dev *rdev) - } - - rdev->debugfs = debugfs_create_dir(rname, debugfs_root); -- if (IS_ERR(rdev->debugfs)) { -- rdev_warn(rdev, "Failed to create debugfs directory\n"); -- return; -- } -+ if (IS_ERR(rdev->debugfs)) -+ rdev_dbg(rdev, "Failed to create debugfs directory\n"); - - debugfs_create_u32("use_count", 0444, rdev->debugfs, - &rdev->use_count); -@@ -5797,7 +5793,7 @@ static int __init regulator_init(void) - - debugfs_root = debugfs_create_dir("regulator", NULL); - if (IS_ERR(debugfs_root)) -- pr_warn("regulator: Failed to create debugfs directory\n"); -+ pr_debug("regulator: Failed to create debugfs directory\n"); - - #ifdef CONFIG_DEBUG_FS - debugfs_create_file("supply_map", 0444, debugfs_root, NULL, -diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c -index 27261b020f8dd..2031d042c5e44 100644 ---- a/drivers/rtc/rtc-st-lpc.c -+++ b/drivers/rtc/rtc-st-lpc.c -@@ -231,7 +231,7 @@ static int st_rtc_probe(struct platform_device *pdev) - enable_irq_wake(rtc->irq); - disable_irq(rtc->irq); - -- rtc->clk = clk_get(&pdev->dev, NULL); -+ rtc->clk = devm_clk_get(&pdev->dev, NULL); - if (IS_ERR(rtc->clk)) { - dev_err(&pdev->dev, "Unable to request clock\n"); - return PTR_ERR(rtc->clk); -diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c -index 2b1e0d5030201..75290aabd543b 100644 ---- a/drivers/scsi/3w-xxxx.c -+++ b/drivers/scsi/3w-xxxx.c -@@ -2310,8 +2310,10 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) - TW_DISABLE_INTERRUPTS(tw_dev); - - /* Initialize the card */ -- if (tw_reset_sequence(tw_dev)) -+ if (tw_reset_sequence(tw_dev)) { -+ retval = -EINVAL; - goto out_release_mem_region; -+ } - - /* Set host specific parameters */ - host->max_id = TW_MAX_UNITS; -diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c -index f864ef059d29e..858058f228191 100644 ---- a/drivers/scsi/qedf/qedf_main.c -+++ b/drivers/scsi/qedf/qedf_main.c -@@ -2914,9 +2914,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) - * addresses of our queues - */ - if (!qedf->p_cpuq) { -- status = -EINVAL; - QEDF_ERR(&qedf->dbg_ctx, "p_cpuq is NULL.\n"); -- goto mem_alloc_failure; -+ return -EINVAL; - } - - qedf->global_queues = kzalloc((sizeof(struct global_queue *) -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index 59f5dc9876cc5..be3525d17fc92 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -2574,6 +2574,7 @@ static void - qla2x00_terminate_rport_io(struct fc_rport *rport) - { - fc_port_t *fcport = *(fc_port_t **)rport->dd_data; -+ scsi_qla_host_t *vha; - - if (!fcport) - return; -@@ -2583,9 +2584,12 @@ qla2x00_terminate_rport_io(struct fc_rport *rport) - - if (test_bit(ABORT_ISP_ACTIVE, &fcport->vha->dpc_flags)) - return; -+ vha = fcport->vha; - - if (unlikely(pci_channel_offline(fcport->vha->hw->pdev))) { - qla2x00_abort_all_cmds(fcport->vha, DID_NO_CONNECT << 16); -+ qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24, -+ 0, WAIT_TARGET); - return; - } - /* -@@ -2600,6 +2604,15 @@ qla2x00_terminate_rport_io(struct fc_rport *rport) - else - qla2x00_port_logout(fcport->vha, fcport); - } -+ -+ /* check for any straggling io left behind */ -+ if (qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24, 0, WAIT_TARGET)) { -+ ql_log(ql_log_warn, vha, 0x300b, -+ "IO not return. Resetting. \n"); -+ set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); -+ qla2xxx_wake_dpc(vha); -+ qla2x00_wait_for_chip_reset(vha); -+ } - } - - static int -diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c -index ce55121910e89..e584d39dc9821 100644 ---- a/drivers/scsi/qla2xxx/qla_bsg.c -+++ b/drivers/scsi/qla2xxx/qla_bsg.c -@@ -259,6 +259,10 @@ qla2x00_process_els(struct bsg_job *bsg_job) - - if (bsg_request->msgcode == FC_BSG_RPT_ELS) { - rport = fc_bsg_to_rport(bsg_job); -+ if (!rport) { -+ rval = -ENOMEM; -+ goto done; -+ } - fcport = *(fc_port_t **) rport->dd_data; - host = rport_to_shost(rport); - vha = shost_priv(host); -@@ -2526,6 +2530,8 @@ qla24xx_bsg_request(struct bsg_job *bsg_job) - - if (bsg_request->msgcode == FC_BSG_RPT_ELS) { - rport = fc_bsg_to_rport(bsg_job); -+ if (!rport) -+ return ret; - host = rport_to_shost(rport); - vha = shost_priv(host); - } else { -diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h -index a8272d4290754..2ef6277244f57 100644 ---- a/drivers/scsi/qla2xxx/qla_def.h -+++ b/drivers/scsi/qla2xxx/qla_def.h -@@ -593,7 +593,6 @@ typedef struct srb { - uint8_t pad[3]; - struct kref cmd_kref; /* need to migrate ref_count over to this */ - void *priv; -- wait_queue_head_t nvme_ls_waitq; - struct fc_port *fcport; - struct scsi_qla_host *vha; - unsigned int start_timer:1; -diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h -index 477b0b8a5f4bc..c54b987d1f11d 100644 ---- a/drivers/scsi/qla2xxx/qla_inline.h -+++ b/drivers/scsi/qla2xxx/qla_inline.h -@@ -110,11 +110,13 @@ qla2x00_set_fcport_disc_state(fc_port_t *fcport, int state) - { - int old_val; - uint8_t shiftbits, mask; -+ uint8_t port_dstate_str_sz; - - /* This will have to change when the max no. of states > 16 */ - shiftbits = 4; - mask = (1 << shiftbits) - 1; - -+ port_dstate_str_sz = sizeof(port_dstate_str) / sizeof(char *); - fcport->disc_state = state; - while (1) { - old_val = atomic_read(&fcport->shadow_disc_state); -@@ -122,7 +124,8 @@ qla2x00_set_fcport_disc_state(fc_port_t *fcport, int state) - old_val, (old_val << shiftbits) | state)) { - ql_dbg(ql_dbg_disc, fcport->vha, 0x2134, - "FCPort %8phC disc_state transition: %s to %s - portid=%06x.\n", -- fcport->port_name, port_dstate_str[old_val & mask], -+ fcport->port_name, (old_val & mask) < port_dstate_str_sz ? -+ port_dstate_str[old_val & mask] : "Unknown", - port_dstate_str[state], fcport->d_id.b24); - return; - } -diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c -index 103288b0377e0..716f46a67bcda 100644 ---- a/drivers/scsi/qla2xxx/qla_iocb.c -+++ b/drivers/scsi/qla2xxx/qla_iocb.c -@@ -601,7 +601,8 @@ qla24xx_build_scsi_type_6_iocbs(srb_t *sp, struct cmd_type_6 *cmd_pkt, - put_unaligned_le32(COMMAND_TYPE_6, &cmd_pkt->entry_type); - - /* No data transfer */ -- if (!scsi_bufflen(cmd) || cmd->sc_data_direction == DMA_NONE) { -+ if (!scsi_bufflen(cmd) || cmd->sc_data_direction == DMA_NONE || -+ tot_dsds == 0) { - cmd_pkt->byte_count = cpu_to_le32(0); - return 0; - } -@@ -3665,7 +3666,7 @@ qla2x00_start_sp(srb_t *sp) - spin_lock_irqsave(qp->qp_lock_ptr, flags); - pkt = __qla2x00_alloc_iocbs(sp->qpair, sp); - if (!pkt) { -- rval = EAGAIN; -+ rval = -EAGAIN; - ql_log(ql_log_warn, vha, 0x700c, - "qla2x00_alloc_iocbs failed.\n"); - goto done; -diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c -index ab9dcbd2006c2..b67480456f45c 100644 ---- a/drivers/scsi/qla2xxx/qla_nvme.c -+++ b/drivers/scsi/qla2xxx/qla_nvme.c -@@ -318,7 +318,6 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, - if (rval != QLA_SUCCESS) { - ql_log(ql_log_warn, vha, 0x700e, - "qla2x00_start_sp failed = %d\n", rval); -- wake_up(&sp->nvme_ls_waitq); - sp->priv = NULL; - priv->sp = NULL; - qla2x00_rel_sp(sp); -@@ -563,7 +562,6 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport, - if (!sp) - return -EBUSY; - -- init_waitqueue_head(&sp->nvme_ls_waitq); - kref_init(&sp->cmd_kref); - spin_lock_init(&priv->cmd_lock); - sp->priv = (void *)priv; -@@ -581,7 +579,6 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport, - if (rval != QLA_SUCCESS) { - ql_log(ql_log_warn, vha, 0x212d, - "qla2x00_start_nvme_mq failed = %d\n", rval); -- wake_up(&sp->nvme_ls_waitq); - sp->priv = NULL; - priv->sp = NULL; - qla2xxx_rel_qpair_sp(sp->qpair, sp); -diff --git a/drivers/soc/fsl/qe/Kconfig b/drivers/soc/fsl/qe/Kconfig -index cfa4b2939992c..3ed0838607647 100644 ---- a/drivers/soc/fsl/qe/Kconfig -+++ b/drivers/soc/fsl/qe/Kconfig -@@ -38,6 +38,7 @@ config QE_TDM - - config QE_USB - bool -+ depends on QUICC_ENGINE - default y if USB_FSL_QE - help - QE USB Controller support -diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c -index d933a6eda5fdc..118d9161a7886 100644 ---- a/drivers/spi/spi-bcm-qspi.c -+++ b/drivers/spi/spi-bcm-qspi.c -@@ -1250,13 +1250,9 @@ int bcm_qspi_probe(struct platform_device *pdev, - res = platform_get_resource_byname(pdev, IORESOURCE_MEM, - "mspi"); - -- if (res) { -- qspi->base[MSPI] = devm_ioremap_resource(dev, res); -- if (IS_ERR(qspi->base[MSPI])) -- return PTR_ERR(qspi->base[MSPI]); -- } else { -- return 0; -- } -+ qspi->base[MSPI] = devm_ioremap_resource(dev, res); -+ if (IS_ERR(qspi->base[MSPI])) -+ return PTR_ERR(qspi->base[MSPI]); - - res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi"); - if (res) { -diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c -index fdd7eaa0b8ede..ff27596168732 100644 ---- a/drivers/spi/spi-bcm63xx.c -+++ b/drivers/spi/spi-bcm63xx.c -@@ -125,7 +125,7 @@ enum bcm63xx_regs_spi { - SPI_MSG_DATA_SIZE, - }; - --#define BCM63XX_SPI_MAX_PREPEND 15 -+#define BCM63XX_SPI_MAX_PREPEND 7 - - #define BCM63XX_SPI_MAX_CS 8 - #define BCM63XX_SPI_BUS_NUM 0 -diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c -index 01b53d816497c..ae1cbc3215366 100644 ---- a/drivers/spi/spi-geni-qcom.c -+++ b/drivers/spi/spi-geni-qcom.c -@@ -32,7 +32,7 @@ - #define CS_DEMUX_OUTPUT_SEL GENMASK(3, 0) - - #define SE_SPI_TRANS_CFG 0x25c --#define CS_TOGGLE BIT(0) -+#define CS_TOGGLE BIT(1) - - #define SE_SPI_WORD_LEN 0x268 - #define WORD_LEN_MSK GENMASK(9, 0) -diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h -index e50af46f8c198..04bf2b297fdc0 100644 ---- a/drivers/tty/serial/8250/8250.h -+++ b/drivers/tty/serial/8250/8250.h -@@ -87,7 +87,6 @@ struct serial8250_config { - #define UART_BUG_TXEN (1 << 1) /* UART has buggy TX IIR status */ - #define UART_BUG_NOMSR (1 << 2) /* UART has buggy MSR status bits (Au1x00) */ - #define UART_BUG_THRE (1 << 3) /* UART has buggy THRE reassertion */ --#define UART_BUG_PARITY (1 << 4) /* UART mishandles parity if FIFO enabled */ - - - #ifdef CONFIG_SERIAL_8250_SHARE_IRQ -diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c -index 928b35b87dcf3..a2db055278a17 100644 ---- a/drivers/tty/serial/8250/8250_omap.c -+++ b/drivers/tty/serial/8250/8250_omap.c -@@ -1314,25 +1314,35 @@ static int omap8250_suspend(struct device *dev) - { - struct omap8250_priv *priv = dev_get_drvdata(dev); - struct uart_8250_port *up = serial8250_get_port(priv->line); -+ int err; - - serial8250_suspend_port(priv->line); - -- pm_runtime_get_sync(dev); -+ err = pm_runtime_resume_and_get(dev); -+ if (err) -+ return err; - if (!device_may_wakeup(dev)) - priv->wer = 0; - serial_out(up, UART_OMAP_WER, priv->wer); -- pm_runtime_mark_last_busy(dev); -- pm_runtime_put_autosuspend(dev); -- -+ err = pm_runtime_force_suspend(dev); - flush_work(&priv->qos_work); -- return 0; -+ -+ return err; - } - - static int omap8250_resume(struct device *dev) - { - struct omap8250_priv *priv = dev_get_drvdata(dev); -+ int err; - -+ err = pm_runtime_force_resume(dev); -+ if (err) -+ return err; - serial8250_resume_port(priv->line); -+ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */ -+ pm_runtime_mark_last_busy(dev); -+ pm_runtime_put_autosuspend(dev); -+ - return 0; - } - #else -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 4a3991ac2dd06..5c7a2145b9454 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -1068,14 +1068,6 @@ static int pci_oxsemi_tornado_init(struct pci_dev *dev) - return number_uarts; - } - --static int pci_asix_setup(struct serial_private *priv, -- const struct pciserial_board *board, -- struct uart_8250_port *port, int idx) --{ -- port->bugs |= UART_BUG_PARITY; -- return pci_default_setup(priv, board, port, idx); --} -- - /* Quatech devices have their own extra interface features */ - - struct quatech_feature { -@@ -1872,7 +1864,6 @@ pci_moxa_setup(struct serial_private *priv, - #define PCI_DEVICE_ID_WCH_CH355_4S 0x7173 - #define PCI_VENDOR_ID_AGESTAR 0x5372 - #define PCI_DEVICE_ID_AGESTAR_9375 0x6872 --#define PCI_VENDOR_ID_ASIX 0x9710 - #define PCI_DEVICE_ID_BROADCOM_TRUMANAGE 0x160a - #define PCI_DEVICE_ID_AMCC_ADDIDATA_APCI7800 0x818e - -@@ -2671,16 +2662,6 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = { - .subdevice = PCI_ANY_ID, - .setup = pci_wch_ch38x_setup, - }, -- /* -- * ASIX devices with FIFO bug -- */ -- { -- .vendor = PCI_VENDOR_ID_ASIX, -- .device = PCI_ANY_ID, -- .subvendor = PCI_ANY_ID, -- .subdevice = PCI_ANY_ID, -- .setup = pci_asix_setup, -- }, - /* - * Broadcom TruManage (NetXtreme) - */ -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index 96ae6c6031d4d..f49f3b017206c 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -2535,11 +2535,8 @@ static unsigned char serial8250_compute_lcr(struct uart_8250_port *up, - - if (c_cflag & CSTOPB) - cval |= UART_LCR_STOP; -- if (c_cflag & PARENB) { -+ if (c_cflag & PARENB) - cval |= UART_LCR_PARITY; -- if (up->bugs & UART_BUG_PARITY) -- up->fifo_bug = true; -- } - if (!(c_cflag & PARODD)) - cval |= UART_LCR_EPAR; - #ifdef CMSPAR -@@ -2646,8 +2643,7 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios, - up->lcr = cval; /* Save computed LCR */ - - if (up->capabilities & UART_CAP_FIFO && port->fifosize > 1) { -- /* NOTE: If fifo_bug is not set, a user can set RX_trigger. */ -- if ((baud < 2400 && !up->dma) || up->fifo_bug) { -+ if (baud < 2400 && !up->dma) { - up->fcr &= ~UART_FCR_TRIGGER_MASK; - up->fcr |= UART_FCR_TRIGGER_1; - } -@@ -2983,8 +2979,7 @@ static int do_set_rxtrig(struct tty_port *port, unsigned char bytes) - struct uart_8250_port *up = up_to_u8250p(uport); - int rxtrig; - -- if (!(up->capabilities & UART_CAP_FIFO) || uport->fifosize <= 1 || -- up->fifo_bug) -+ if (!(up->capabilities & UART_CAP_FIFO) || uport->fifosize <= 1) - return -EINVAL; - - rxtrig = bytes_to_fcr_rxtrig(up, bytes); -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index 6c0628c58efd9..8d0838c904c8a 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -884,11 +884,11 @@ static void atmel_complete_tx_dma(void *arg) - - port->icount.tx += atmel_port->tx_len; - -- spin_lock_irq(&atmel_port->lock_tx); -+ spin_lock(&atmel_port->lock_tx); - async_tx_ack(atmel_port->desc_tx); - atmel_port->cookie_tx = -EINVAL; - atmel_port->desc_tx = NULL; -- spin_unlock_irq(&atmel_port->lock_tx); -+ spin_unlock(&atmel_port->lock_tx); - - if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) - uart_write_wakeup(port); -diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c -index 1d0124126eb22..88c8357969220 100644 ---- a/drivers/tty/serial/fsl_lpuart.c -+++ b/drivers/tty/serial/fsl_lpuart.c -@@ -2409,6 +2409,7 @@ static int __init lpuart32_imx_early_console_setup(struct earlycon_device *devic - OF_EARLYCON_DECLARE(lpuart, "fsl,vf610-lpuart", lpuart_early_console_setup); - OF_EARLYCON_DECLARE(lpuart32, "fsl,ls1021a-lpuart", lpuart32_early_console_setup); - OF_EARLYCON_DECLARE(lpuart32, "fsl,imx7ulp-lpuart", lpuart32_imx_early_console_setup); -+OF_EARLYCON_DECLARE(lpuart32, "fsl,imx8ulp-lpuart", lpuart32_imx_early_console_setup); - OF_EARLYCON_DECLARE(lpuart32, "fsl,imx8qxp-lpuart", lpuart32_imx_early_console_setup); - EARLYCON_DECLARE(lpuart, lpuart_early_console_setup); - EARLYCON_DECLARE(lpuart32, lpuart32_early_console_setup); -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index 1df74bad10630..24f9bd9101662 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -1199,8 +1199,12 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport, - continue; - - rate = clk_get_rate(clk); -- if (!rate) -+ if (!rate) { -+ dev_err(ourport->port.dev, -+ "Failed to get clock rate for %s.\n", clkname); -+ clk_put(clk); - continue; -+ } - - if (ourport->info->has_divslot) { - unsigned long div = rate / req_baud; -@@ -1226,10 +1230,18 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport, - calc_deviation = -calc_deviation; - - if (calc_deviation < deviation) { -+ /* -+ * If we find a better clk, release the previous one, if -+ * any. -+ */ -+ if (!IS_ERR(*best_clk)) -+ clk_put(*best_clk); - *best_clk = clk; - best_quot = quot; - *clk_num = cnt; - deviation = calc_deviation; -+ } else { -+ clk_put(clk); - } - } - -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 44922e6381da6..087ab22488552 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -734,6 +734,7 @@ static int driver_resume(struct usb_interface *intf) - return 0; - } - -+#ifdef CONFIG_PM - /* The following routines apply to the entire device, not interfaces */ - void usbfs_notify_suspend(struct usb_device *udev) - { -@@ -752,6 +753,7 @@ void usbfs_notify_resume(struct usb_device *udev) - } - mutex_unlock(&usbfs_mutex); - } -+#endif - - struct usb_driver usbfs_driver = { - .name = "usbfs", -diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c -index 2dcdeb52fc293..2d7cfa8825aa8 100644 ---- a/drivers/usb/dwc3/dwc3-qcom.c -+++ b/drivers/usb/dwc3/dwc3-qcom.c -@@ -574,6 +574,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) - struct device *dev = &pdev->dev; - struct dwc3_qcom *qcom; - struct resource *res, *parent_res = NULL; -+ struct resource local_res; - int ret, i; - bool ignore_pipe_clk; - -@@ -624,9 +625,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev) - if (np) { - parent_res = res; - } else { -- parent_res = kmemdup(res, sizeof(struct resource), GFP_KERNEL); -- if (!parent_res) -- return -ENOMEM; -+ memcpy(&local_res, res, sizeof(struct resource)); -+ parent_res = &local_res; - - parent_res->start = res->start + - qcom->acpi_pdata->qscratch_base_offset; -@@ -704,10 +704,14 @@ reset_assert: - static int dwc3_qcom_remove(struct platform_device *pdev) - { - struct dwc3_qcom *qcom = platform_get_drvdata(pdev); -+ struct device_node *np = pdev->dev.of_node; - struct device *dev = &pdev->dev; - int i; - -- of_platform_depopulate(dev); -+ if (np) -+ of_platform_depopulate(&pdev->dev); -+ else -+ platform_device_put(pdev); - - for (i = qcom->num_clocks - 1; i >= 0; i--) { - clk_disable_unprepare(qcom->clks[i]); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 12d8a50d24ba9..bda9fd7157e47 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -2077,7 +2077,9 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) - ret = pm_runtime_get_sync(dwc->dev); - if (!ret || ret < 0) { - pm_runtime_put(dwc->dev); -- return 0; -+ if (ret < 0) -+ pm_runtime_set_suspended(dwc->dev); -+ return ret; - } - - if (dwc->pullups_connected == is_on) { -diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c -index a3e043e3e4aae..d0672b6712985 100644 ---- a/drivers/usb/phy/phy-tahvo.c -+++ b/drivers/usb/phy/phy-tahvo.c -@@ -395,7 +395,7 @@ static int tahvo_usb_probe(struct platform_device *pdev) - - tu->irq = ret = platform_get_irq(pdev, 0); - if (ret < 0) -- return ret; -+ goto err_remove_phy; - ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt, - IRQF_ONESHOT, - "tahvo-vbus", tu); -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 7d9f9c0cb2eab..939bcbb5404fb 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1151,6 +1151,10 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa), - .driver_info = RSVD(3) }, - /* u-blox products */ -+ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1311) }, /* u-blox LARA-R6 01B */ -+ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1312), /* u-blox LARA-R6 01B (RMNET) */ -+ .driver_info = RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(UBLOX_VENDOR_ID, 0x1313, 0xff) }, /* u-blox LARA-R6 01B (ECM) */ - { USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */ - { USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */ - .driver_info = RSVD(4) }, -diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c -index 43a4dddaafd52..d0335d4d5ab54 100644 ---- a/drivers/video/fbdev/au1200fb.c -+++ b/drivers/video/fbdev/au1200fb.c -@@ -1732,6 +1732,9 @@ static int au1200fb_drv_probe(struct platform_device *dev) - - /* Now hook interrupt too */ - irq = platform_get_irq(dev, 0); -+ if (irq < 0) -+ return irq; -+ - ret = request_irq(irq, au1200fb_handle_irq, - IRQF_SHARED, "lcd", (void *)dev); - if (ret) { -diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c -index 5f610d4929ddb..9670e5b5fe326 100644 ---- a/drivers/video/fbdev/imsttfb.c -+++ b/drivers/video/fbdev/imsttfb.c -@@ -1346,7 +1346,7 @@ static struct fb_ops imsttfb_ops = { - .fb_ioctl = imsttfb_ioctl, - }; - --static void init_imstt(struct fb_info *info) -+static int init_imstt(struct fb_info *info) - { - struct imstt_par *par = info->par; - __u32 i, tmp, *ip, *end; -@@ -1419,7 +1419,7 @@ static void init_imstt(struct fb_info *info) - || !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) { - printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel); - framebuffer_release(info); -- return; -+ return -ENODEV; - } - - sprintf(info->fix.id, "IMS TT (%s)", par->ramdac == IBM ? "IBM" : "TVP"); -@@ -1455,12 +1455,13 @@ static void init_imstt(struct fb_info *info) - - if (register_framebuffer(info) < 0) { - framebuffer_release(info); -- return; -+ return -ENODEV; - } - - tmp = (read_reg_le32(par->dc_regs, SSTATUS) & 0x0f00) >> 8; - fb_info(info, "%s frame buffer; %uMB vram; chip version %u\n", - info->fix.id, info->fix.smem_len >> 20, tmp); -+ return 0; - } - - static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) -@@ -1469,6 +1470,7 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - struct imstt_par *par; - struct fb_info *info; - struct device_node *dp; -+ int ret = -ENOMEM; - - dp = pci_device_to_OF_node(pdev); - if(dp) -@@ -1504,23 +1506,37 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - default: - printk(KERN_INFO "imsttfb: Device 0x%x unknown, " - "contact maintainer.\n", pdev->device); -- release_mem_region(addr, size); -- framebuffer_release(info); -- return -ENODEV; -+ ret = -ENODEV; -+ goto error; - } - - info->fix.smem_start = addr; - info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ? - 0x400000 : 0x800000); -+ if (!info->screen_base) -+ goto error; - info->fix.mmio_start = addr + 0x800000; - par->dc_regs = ioremap(addr + 0x800000, 0x1000); -+ if (!par->dc_regs) -+ goto error; - par->cmap_regs_phys = addr + 0x840000; - par->cmap_regs = (__u8 *)ioremap(addr + 0x840000, 0x1000); -+ if (!par->cmap_regs) -+ goto error; - info->pseudo_palette = par->palette; -- init_imstt(info); -- -- pci_set_drvdata(pdev, info); -- return 0; -+ ret = init_imstt(info); -+ if (!ret) -+ pci_set_drvdata(pdev, info); -+ return ret; -+ -+error: -+ if (par->dc_regs) -+ iounmap(par->dc_regs); -+ if (info->screen_base) -+ iounmap(info->screen_base); -+ release_mem_region(addr, size); -+ framebuffer_release(info); -+ return ret; - } - - static void imsttfb_remove(struct pci_dev *pdev) -diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c -index ffde3107104bc..dbc8808b093a5 100644 ---- a/drivers/video/fbdev/imxfb.c -+++ b/drivers/video/fbdev/imxfb.c -@@ -601,10 +601,10 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf - if (var->hsync_len < 1 || var->hsync_len > 64) - printk(KERN_ERR "%s: invalid hsync_len %d\n", - info->fix.id, var->hsync_len); -- if (var->left_margin > 255) -+ if (var->left_margin < 3 || var->left_margin > 255) - printk(KERN_ERR "%s: invalid left_margin %d\n", - info->fix.id, var->left_margin); -- if (var->right_margin > 255) -+ if (var->right_margin < 1 || var->right_margin > 255) - printk(KERN_ERR "%s: invalid right_margin %d\n", - info->fix.id, var->right_margin); - if (var->yres < 1 || var->yres > ymax_mask) -diff --git a/drivers/video/fbdev/omap/lcd_mipid.c b/drivers/video/fbdev/omap/lcd_mipid.c -index a75ae0c9b14c7..d1cd8785d011d 100644 ---- a/drivers/video/fbdev/omap/lcd_mipid.c -+++ b/drivers/video/fbdev/omap/lcd_mipid.c -@@ -563,11 +563,15 @@ static int mipid_spi_probe(struct spi_device *spi) - - r = mipid_detect(md); - if (r < 0) -- return r; -+ goto free_md; - - omapfb_register_panel(&md->panel); - - return 0; -+ -+free_md: -+ kfree(md); -+ return r; - } - - static int mipid_spi_remove(struct spi_device *spi) -diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c -index 2a7970a10533e..e08f40c9d54c9 100644 ---- a/drivers/w1/w1.c -+++ b/drivers/w1/w1.c -@@ -1228,10 +1228,10 @@ err_out_exit_init: - - static void __exit w1_fini(void) - { -- struct w1_master *dev; -+ struct w1_master *dev, *n; - - /* Set netlink removal messages and some cleanup */ -- list_for_each_entry(dev, &w1_masters, w1_master_entry) -+ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry) - __w1_remove_master_device(dev); - - w1_fini_netlink(); -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index 353e89efdebf8..db8f83ab55f63 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -1189,7 +1189,9 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) - goto out; - } - -+ spin_lock(&fs_info->trans_lock); - list_del("a_root->dirty_list); -+ spin_unlock(&fs_info->trans_lock); - - btrfs_tree_lock(quota_root->node); - btrfs_clean_tree_block(quota_root->node); -@@ -4283,4 +4285,5 @@ void btrfs_qgroup_destroy_extent_records(struct btrfs_transaction *trans) - ulist_free(entry->old_roots); - kfree(entry); - } -+ *root = RB_ROOT; - } -diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index 7def75d5b00cb..243e246cb5046 100644 ---- a/fs/ceph/caps.c -+++ b/fs/ceph/caps.c -@@ -3340,6 +3340,15 @@ static void handle_cap_grant(struct inode *inode, - } - BUG_ON(cap->issued & ~cap->implemented); - -+ /* don't let check_caps skip sending a response to MDS for revoke msgs */ -+ if (le32_to_cpu(grant->op) == CEPH_CAP_OP_REVOKE) { -+ cap->mds_wanted = 0; -+ if (cap == ci->i_auth_cap) -+ check_caps = 1; /* check auth cap only */ -+ else -+ check_caps = 2; /* check all caps */ -+ } -+ - if (extra_info->inline_version > 0 && - extra_info->inline_version >= ci->i_inline_version) { - ci->i_inline_version = extra_info->inline_version; -diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c -index a10d2bcfe75a8..edce0b25cd90e 100644 ---- a/fs/dlm/plock.c -+++ b/fs/dlm/plock.c -@@ -363,7 +363,9 @@ int dlm_posix_get(dlm_lockspace_t *lockspace, u64 number, struct file *file, - locks_init_lock(fl); - fl->fl_type = (op->info.ex) ? F_WRLCK : F_RDLCK; - fl->fl_flags = FL_POSIX; -- fl->fl_pid = -op->info.pid; -+ fl->fl_pid = op->info.pid; -+ if (op->info.nodeid != dlm_our_nodeid()) -+ fl->fl_pid = -fl->fl_pid; - fl->fl_start = op->info.start; - fl->fl_end = op->info.end; - rv = 0; -diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c -index fdd18c2508115..dcc377094f90b 100644 ---- a/fs/erofs/zdata.c -+++ b/fs/erofs/zdata.c -@@ -636,7 +636,7 @@ hitted: - tight &= (clt->mode >= COLLECT_PRIMARY_HOOKED && - clt->mode != COLLECT_PRIMARY_FOLLOWED_NOINPLACE); - -- cur = end - min_t(unsigned int, offset + end - map->m_la, end); -+ cur = end - min_t(erofs_off_t, offset + end - map->m_la, end); - if (!(map->m_flags & EROFS_MAP_MAPPED)) { - zero_user_segment(page, cur, end); - goto next_part; -diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c -index b5ee58fdd82f3..6553f58fb2898 100644 ---- a/fs/erofs/zmap.c -+++ b/fs/erofs/zmap.c -@@ -215,7 +215,7 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, - int i; - u8 *in, type; - -- if (1 << amortizedshift == 4) -+ if (1 << amortizedshift == 4 && lclusterbits <= 14) - vcnt = 2; - else if (1 << amortizedshift == 2 && lclusterbits == 12) - vcnt = 16; -@@ -273,7 +273,6 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m, - { - struct inode *const inode = m->inode; - struct erofs_inode *const vi = EROFS_I(inode); -- const unsigned int lclusterbits = vi->z_logical_clusterbits; - const erofs_off_t ebase = ALIGN(iloc(EROFS_I_SB(inode), vi->nid) + - vi->inode_isize + vi->xattr_isize, 8) + - sizeof(struct z_erofs_map_header); -@@ -283,9 +282,6 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m, - erofs_off_t pos; - int err; - -- if (lclusterbits != 12) -- return -EOPNOTSUPP; -- - if (lcn >= totalidx) - return -EINVAL; - -diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c -index a131d2781342b..25532bac77771 100644 ---- a/fs/ext4/indirect.c -+++ b/fs/ext4/indirect.c -@@ -636,6 +636,14 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, - - ext4_update_inode_fsync_trans(handle, inode, 1); - count = ar.len; -+ -+ /* -+ * Update reserved blocks/metadata blocks after successful block -+ * allocation which had been deferred till now. -+ */ -+ if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) -+ ext4_da_update_reserve_space(inode, count, 1); -+ - got_it: - map->m_flags |= EXT4_MAP_MAPPED; - map->m_pblk = le32_to_cpu(chain[depth-1].key); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 51c67418ed020..8a0bca3b653bc 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -669,16 +669,6 @@ found: - */ - ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE); - } -- -- /* -- * Update reserved blocks/metadata blocks after successful -- * block allocation which had been deferred till now. We don't -- * support fallocate for non extent files. So we can update -- * reserve space here. -- */ -- if ((retval > 0) && -- (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)) -- ext4_da_update_reserve_space(inode, retval, 1); - } - - if (retval > 0) { -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 92c37fbbabc15..be5c2e53b636e 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -4950,8 +4950,8 @@ do_more: - * them with group lock_held - */ - if (test_opt(sb, DISCARD)) { -- err = ext4_issue_discard(sb, block_group, bit, count, -- NULL); -+ err = ext4_issue_discard(sb, block_group, bit, -+ count_clusters, NULL); - if (err && err != -EOPNOTSUPP) - ext4_msg(sb, KERN_WARNING, "discard request in" - " group:%d block:%d count:%lu failed" -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index d3804975e82bb..3da931a5c9556 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -3795,19 +3795,10 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, - return retval; - } - -- /* -- * We need to protect against old.inode directory getting converted -- * from inline directory format into a normal one. -- */ -- if (S_ISDIR(old.inode->i_mode)) -- inode_lock_nested(old.inode, I_MUTEX_NONDIR2); -- - old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, - &old.inlined); -- if (IS_ERR(old.bh)) { -- retval = PTR_ERR(old.bh); -- goto unlock_moved_dir; -- } -+ if (IS_ERR(old.bh)) -+ return PTR_ERR(old.bh); - - /* - * Check for inode number is _not_ due to possible IO errors. -@@ -3968,10 +3959,6 @@ release_bh: - brelse(old.bh); - brelse(new.bh); - --unlock_moved_dir: -- if (S_ISDIR(old.inode->i_mode)) -- inode_unlock(old.inode); -- - return retval; - } - -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index 79d13811c5be2..cd371ac25f840 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -1742,6 +1742,20 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i, - memmove(here, (void *)here + size, - (void *)last - (void *)here + sizeof(__u32)); - memset(last, 0, size); -+ -+ /* -+ * Update i_inline_off - moved ibody region might contain -+ * system.data attribute. Handling a failure here won't -+ * cause other complications for setting an xattr. -+ */ -+ if (!is_block && ext4_has_inline_data(inode)) { -+ ret = ext4_find_inline_data_nolock(inode); -+ if (ret) { -+ ext4_warning_inode(inode, -+ "unable to update i_inline_off"); -+ goto out; -+ } -+ } - } else if (s->not_found) { - /* Insert new name. */ - size_t size = EXT4_XATTR_LEN(name_len); -diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c -index 9cb2a87247b21..ed95c27e93026 100644 ---- a/fs/f2fs/namei.c -+++ b/fs/f2fs/namei.c -@@ -892,20 +892,12 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, - goto out; - } - -- /* -- * Copied from ext4_rename: we need to protect against old.inode -- * directory getting converted from inline directory format into -- * a normal one. -- */ -- if (S_ISDIR(old_inode->i_mode)) -- inode_lock_nested(old_inode, I_MUTEX_NONDIR2); -- - err = -ENOENT; - old_entry = f2fs_find_entry(old_dir, &old_dentry->d_name, &old_page); - if (!old_entry) { - if (IS_ERR(old_page)) - err = PTR_ERR(old_page); -- goto out_unlock_old; -+ goto out; - } - - if (S_ISDIR(old_inode->i_mode)) { -@@ -1033,9 +1025,6 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, - - f2fs_unlock_op(sbi); - -- if (S_ISDIR(old_inode->i_mode)) -- inode_unlock(old_inode); -- - if (IS_DIRSYNC(old_dir) || IS_DIRSYNC(new_dir)) - f2fs_sync_fs(sbi->sb, 1); - -@@ -1051,9 +1040,6 @@ out_dir: - f2fs_put_page(old_dir_page, 0); - out_old: - f2fs_put_page(old_page, 0); --out_unlock_old: -- if (S_ISDIR(old_inode->i_mode)) -- inode_unlock(old_inode); - out: - if (whiteout) - iput(whiteout); -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index b080d5c58f6cb..8256a2dedae8c 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -889,8 +889,10 @@ static int truncate_dnode(struct dnode_of_data *dn) - dn->ofs_in_node = 0; - f2fs_truncate_data_blocks(dn); - err = truncate_node(dn); -- if (err) -+ if (err) { -+ f2fs_put_page(page, 1); - return err; -+ } - - return 1; - } -diff --git a/fs/fs_context.c b/fs/fs_context.c -index e492a83fa100e..412712eb59ee1 100644 ---- a/fs/fs_context.c -+++ b/fs/fs_context.c -@@ -598,7 +598,8 @@ static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param) - return -ENOMEM; - } - -- ctx->legacy_data[size++] = ','; -+ if (size) -+ ctx->legacy_data[size++] = ','; - len = strlen(param->key); - memcpy(ctx->legacy_data + size, param->key, len); - size += len; -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 34487bf1d7914..b2f37809fa9bd 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -246,7 +246,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags) - spin_unlock(&fi->lock); - } - kfree(forget); -- if (ret == -ENOMEM) -+ if (ret == -ENOMEM || ret == -EINTR) - goto out; - if (ret || fuse_invalid_attr(&outarg.attr) || - (outarg.attr.mode ^ inode->i_mode) & S_IFMT) -diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c -index 9c593fd50c6a5..baf0a70460c03 100644 ---- a/fs/gfs2/super.c -+++ b/fs/gfs2/super.c -@@ -1258,6 +1258,14 @@ static void gfs2_evict_inode(struct inode *inode) - if (inode->i_nlink || sb_rdonly(sb)) - goto out; - -+ /* -+ * In case of an incomplete mount, gfs2_evict_inode() may be called for -+ * system files without having an active journal to write to. In that -+ * case, skip the filesystem evict. -+ */ -+ if (!sdp->sd_jdesc) -+ goto out; -+ - if (test_bit(GIF_ALLOC_FAILED, &ip->i_flags)) { - BUG_ON(!gfs2_glock_is_locked_by_me(ip->i_gl)); - gfs2_holder_mark_uninitialized(&gh); -diff --git a/fs/inode.c b/fs/inode.c -index 140a62e5382cb..f7c8c0fe11d44 100644 ---- a/fs/inode.c -+++ b/fs/inode.c -@@ -1012,6 +1012,48 @@ void discard_new_inode(struct inode *inode) - } - EXPORT_SYMBOL(discard_new_inode); - -+/** -+ * lock_two_inodes - lock two inodes (may be regular files but also dirs) -+ * -+ * Lock any non-NULL argument. The caller must make sure that if he is passing -+ * in two directories, one is not ancestor of the other. Zero, one or two -+ * objects may be locked by this function. -+ * -+ * @inode1: first inode to lock -+ * @inode2: second inode to lock -+ * @subclass1: inode lock subclass for the first lock obtained -+ * @subclass2: inode lock subclass for the second lock obtained -+ */ -+void lock_two_inodes(struct inode *inode1, struct inode *inode2, -+ unsigned subclass1, unsigned subclass2) -+{ -+ if (!inode1 || !inode2) { -+ /* -+ * Make sure @subclass1 will be used for the acquired lock. -+ * This is not strictly necessary (no current caller cares) but -+ * let's keep things consistent. -+ */ -+ if (!inode1) -+ swap(inode1, inode2); -+ goto lock; -+ } -+ -+ /* -+ * If one object is directory and the other is not, we must make sure -+ * to lock directory first as the other object may be its child. -+ */ -+ if (S_ISDIR(inode2->i_mode) == S_ISDIR(inode1->i_mode)) { -+ if (inode1 > inode2) -+ swap(inode1, inode2); -+ } else if (!S_ISDIR(inode1->i_mode)) -+ swap(inode1, inode2); -+lock: -+ if (inode1) -+ inode_lock_nested(inode1, subclass1); -+ if (inode2 && inode2 != inode1) -+ inode_lock_nested(inode2, subclass2); -+} -+ - /** - * lock_two_nondirectories - take two i_mutexes on non-directory objects - * -diff --git a/fs/internal.h b/fs/internal.h -index 61aed95f83d1e..377f984e92267 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -138,6 +138,8 @@ extern int vfs_open(const struct path *, struct file *); - extern long prune_icache_sb(struct super_block *sb, struct shrink_control *sc); - extern void inode_add_lru(struct inode *inode); - extern int dentry_needs_remove_privs(struct dentry *dentry); -+void lock_two_inodes(struct inode *inode1, struct inode *inode2, -+ unsigned subclass1, unsigned subclass2); - - /* - * fs-writeback.c -diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c -index 837cd55fd4c5e..6ae9d6fefb861 100644 ---- a/fs/jffs2/build.c -+++ b/fs/jffs2/build.c -@@ -211,7 +211,10 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c) - ic->scan_dents = NULL; - cond_resched(); - } -- jffs2_build_xattr_subsystem(c); -+ ret = jffs2_build_xattr_subsystem(c); -+ if (ret) -+ goto exit; -+ - c->flags &= ~JFFS2_SB_FLAG_BUILDING; - - dbg_fsbuild("FS build complete\n"); -diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c -index da3e18503c658..acb4492f5970c 100644 ---- a/fs/jffs2/xattr.c -+++ b/fs/jffs2/xattr.c -@@ -772,10 +772,10 @@ void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c) - } - - #define XREF_TMPHASH_SIZE (128) --void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c) -+int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c) - { - struct jffs2_xattr_ref *ref, *_ref; -- struct jffs2_xattr_ref *xref_tmphash[XREF_TMPHASH_SIZE]; -+ struct jffs2_xattr_ref **xref_tmphash; - struct jffs2_xattr_datum *xd, *_xd; - struct jffs2_inode_cache *ic; - struct jffs2_raw_node_ref *raw; -@@ -784,9 +784,12 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c) - - BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING)); - -+ xref_tmphash = kcalloc(XREF_TMPHASH_SIZE, -+ sizeof(struct jffs2_xattr_ref *), GFP_KERNEL); -+ if (!xref_tmphash) -+ return -ENOMEM; -+ - /* Phase.1 : Merge same xref */ -- for (i=0; i < XREF_TMPHASH_SIZE; i++) -- xref_tmphash[i] = NULL; - for (ref=c->xref_temp; ref; ref=_ref) { - struct jffs2_xattr_ref *tmp; - -@@ -884,6 +887,8 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c) - "%u of xref (%u dead, %u orphan) found.\n", - xdatum_count, xdatum_unchecked_count, xdatum_orphan_count, - xref_count, xref_dead_count, xref_orphan_count); -+ kfree(xref_tmphash); -+ return 0; - } - - struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c, -diff --git a/fs/jffs2/xattr.h b/fs/jffs2/xattr.h -index 720007b2fd65d..1b5030a3349db 100644 ---- a/fs/jffs2/xattr.h -+++ b/fs/jffs2/xattr.h -@@ -71,7 +71,7 @@ static inline int is_xattr_ref_dead(struct jffs2_xattr_ref *ref) - #ifdef CONFIG_JFFS2_FS_XATTR - - extern void jffs2_init_xattr_subsystem(struct jffs2_sb_info *c); --extern void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c); -+extern int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c); - extern void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c); - - extern struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c, -@@ -103,7 +103,7 @@ extern ssize_t jffs2_listxattr(struct dentry *, char *, size_t); - #else - - #define jffs2_init_xattr_subsystem(c) --#define jffs2_build_xattr_subsystem(c) -+#define jffs2_build_xattr_subsystem(c) (0) - #define jffs2_clear_xattr_subsystem(c) - - #define jffs2_xattr_do_crccheck_inode(c, ic) -diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c -index cc1fed285b2d6..dac67ee1879be 100644 ---- a/fs/jfs/jfs_dmap.c -+++ b/fs/jfs/jfs_dmap.c -@@ -178,7 +178,13 @@ int dbMount(struct inode *ipbmap) - dbmp_le = (struct dbmap_disk *) mp->data; - bmp->db_mapsize = le64_to_cpu(dbmp_le->dn_mapsize); - bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree); -+ - bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); -+ if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE) { -+ err = -EINVAL; -+ goto err_release_metapage; -+ } -+ - bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); - if (!bmp->db_numag) { - err = -EINVAL; -diff --git a/fs/jfs/jfs_filsys.h b/fs/jfs/jfs_filsys.h -index b5d702df7111a..33ef13a0b1108 100644 ---- a/fs/jfs/jfs_filsys.h -+++ b/fs/jfs/jfs_filsys.h -@@ -122,7 +122,9 @@ - #define NUM_INODE_PER_IAG INOSPERIAG - - #define MINBLOCKSIZE 512 -+#define L2MINBLOCKSIZE 9 - #define MAXBLOCKSIZE 4096 -+#define L2MAXBLOCKSIZE 12 - #define MAXFILESIZE ((s64)1 << 52) - - #define JFS_LINK_MAX 0xffffffff -diff --git a/fs/namei.c b/fs/namei.c -index d220df830c499..14e600711f504 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -2870,8 +2870,8 @@ struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) - return p; - } - -- inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); -- inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2); -+ lock_two_inodes(p1->d_inode, p2->d_inode, -+ I_MUTEX_PARENT, I_MUTEX_PARENT2); - return NULL; - } - EXPORT_SYMBOL(lock_rename); -@@ -4367,7 +4367,7 @@ SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname - * sb->s_vfs_rename_mutex. We might be more accurate, but that's another - * story. - * c) we have to lock _four_ objects - parents and victim (if it exists), -- * and source (if it is not a directory). -+ * and source. - * And that - after we got ->i_mutex on parents (until then we don't know - * whether the target exists). Solution: try to be smart with locking - * order for inodes. We rely on the fact that tree topology may change -@@ -4444,10 +4444,16 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, - - take_dentry_name_snapshot(&old_name, old_dentry); - dget(new_dentry); -- if (!is_dir || (flags & RENAME_EXCHANGE)) -- lock_two_nondirectories(source, target); -- else if (target) -- inode_lock(target); -+ /* -+ * Lock all moved children. Moved directories may need to change parent -+ * pointer so they need the lock to prevent against concurrent -+ * directory changes moving parent pointer. For regular files we've -+ * historically always done this. The lockdep locking subclasses are -+ * somewhat arbitrary but RENAME_EXCHANGE in particular can swap -+ * regular files and directories so it's difficult to tell which -+ * subclasses to use. -+ */ -+ lock_two_inodes(source, target, I_MUTEX_NORMAL, I_MUTEX_NONDIR2); - - error = -EBUSY; - if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry)) -@@ -4491,9 +4497,8 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, - d_exchange(old_dentry, new_dentry); - } - out: -- if (!is_dir || (flags & RENAME_EXCHANGE)) -- unlock_two_nondirectories(source, target); -- else if (target) -+ inode_unlock(source); -+ if (target) - inode_unlock(target); - dput(new_dentry); - if (!error) { -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index c54dd49c993c5..231da9fadf098 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -915,6 +915,7 @@ out: - out_noaction: - return ret; - session_recover: -+ set_bit(NFS4_SLOT_TBL_DRAINING, &session->fc_slot_table.slot_tbl_state); - nfs4_schedule_session_recovery(session, status); - dprintk("%s ERROR: %d Reset session\n", __func__, status); - nfs41_sequence_free_slot(res); -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index a4f2c0cc6a49e..ff95a08574721 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -3409,7 +3409,7 @@ nfsd4_encode_open(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_op - p = xdr_reserve_space(xdr, 32); - if (!p) - return nfserr_resource; -- *p++ = cpu_to_be32(0); -+ *p++ = cpu_to_be32(open->op_recall); - - /* - * TODO: space_limit's in delegations -diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c -index 8508ab5750174..ec4eadf459ae8 100644 ---- a/fs/notify/fanotify/fanotify_user.c -+++ b/fs/notify/fanotify/fanotify_user.c -@@ -928,8 +928,11 @@ static int fanotify_test_fid(struct path *path, __kernel_fsid_t *fsid) - return 0; - } - --static int fanotify_events_supported(struct path *path, __u64 mask) -+static int fanotify_events_supported(struct path *path, __u64 mask, -+ unsigned int flags) - { -+ unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; -+ - /* - * Some filesystems such as 'proc' acquire unusual locks when opening - * files. For them fanotify permission events have high chances of -@@ -941,6 +944,21 @@ static int fanotify_events_supported(struct path *path, __u64 mask) - if (mask & FANOTIFY_PERM_EVENTS && - path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) - return -EINVAL; -+ -+ /* -+ * mount and sb marks are not allowed on kernel internal pseudo fs, -+ * like pipe_mnt, because that would subscribe to events on all the -+ * anonynous pipes in the system. -+ * -+ * SB_NOUSER covers all of the internal pseudo fs whose objects are not -+ * exposed to user's mount namespace, but there are other SB_KERNMOUNT -+ * fs, like nsfs, debugfs, for which the value of allowing sb and mount -+ * mark is questionable. For now we leave them alone. -+ */ -+ if (mark_type != FAN_MARK_INODE && -+ path->mnt->mnt_sb->s_flags & SB_NOUSER) -+ return -EINVAL; -+ - return 0; - } - -@@ -1050,7 +1068,7 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, - goto fput_and_out; - - if (flags & FAN_MARK_ADD) { -- ret = fanotify_events_supported(&path, mask); -+ ret = fanotify_events_supported(&path, mask, flags); - if (ret) - goto path_put_and_out; - } -diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c -index 286340f312dcb..73aed51447b9a 100644 ---- a/fs/pstore/ram_core.c -+++ b/fs/pstore/ram_core.c -@@ -579,6 +579,8 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size, - raw_spin_lock_init(&prz->buffer_lock); - prz->flags = flags; - prz->label = kstrdup(label, GFP_KERNEL); -+ if (!prz->label) -+ goto err; - - ret = persistent_ram_buffer_map(start, size, prz, memtype); - if (ret) -diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h -index 624bd15ecfab6..ce8da64022b43 100644 ---- a/include/drm/drm_panel.h -+++ b/include/drm/drm_panel.h -@@ -139,6 +139,15 @@ struct drm_panel { - */ - const struct drm_panel_funcs *funcs; - -+ /** -+ * @connector_type: -+ * -+ * Type of the panel as a DRM_MODE_CONNECTOR_* value. This is used to -+ * initialise the drm_connector corresponding to the panel with the -+ * correct connector type. -+ */ -+ int connector_type; -+ - /** - * @list: - * -@@ -147,7 +156,9 @@ struct drm_panel { - struct list_head list; - }; - --void drm_panel_init(struct drm_panel *panel); -+void drm_panel_init(struct drm_panel *panel, struct device *dev, -+ const struct drm_panel_funcs *funcs, -+ int connector_type); - - int drm_panel_add(struct drm_panel *panel); - void drm_panel_remove(struct drm_panel *panel); -diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h -index 0f1e95240c0c0..66b89189a1e2e 100644 ---- a/include/linux/etherdevice.h -+++ b/include/linux/etherdevice.h -@@ -288,6 +288,18 @@ static inline void ether_addr_copy(u8 *dst, const u8 *src) - #endif - } - -+/** -+ * eth_hw_addr_set - Assign Ethernet address to a net_device -+ * @dev: pointer to net_device structure -+ * @addr: address to assign -+ * -+ * Assign given address to the net_device, addr_assign_type is not changed. -+ */ -+static inline void eth_hw_addr_set(struct net_device *dev, const u8 *addr) -+{ -+ ether_addr_copy(dev->dev_addr, addr); -+} -+ - /** - * eth_hw_addr_inherit - Copy dev_addr from another net_device - * @dst: pointer to net_device to copy dev_addr to -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 8dea4b53d664d..bf623f0e04d64 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -4189,6 +4189,24 @@ void __hw_addr_unsync_dev(struct netdev_hw_addr_list *list, - void __hw_addr_init(struct netdev_hw_addr_list *list); - - /* Functions used for device addresses handling */ -+static inline void -+__dev_addr_set(struct net_device *dev, const u8 *addr, size_t len) -+{ -+ memcpy(dev->dev_addr, addr, len); -+} -+ -+static inline void dev_addr_set(struct net_device *dev, const u8 *addr) -+{ -+ __dev_addr_set(dev, addr, dev->addr_len); -+} -+ -+static inline void -+dev_addr_mod(struct net_device *dev, unsigned int offset, -+ const u8 *addr, size_t len) -+{ -+ memcpy(&dev->dev_addr[offset], addr, len); -+} -+ - int dev_addr_add(struct net_device *dev, const unsigned char *addr, - unsigned char addr_type); - int dev_addr_del(struct net_device *dev, const unsigned char *addr, -diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h -index 41de4156540a9..0518ca72b7616 100644 ---- a/include/linux/netfilter/nfnetlink.h -+++ b/include/linux/netfilter/nfnetlink.h -@@ -56,6 +56,33 @@ static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type) - return subsys << 8 | msg_type; - } - -+static inline void nfnl_fill_hdr(struct nlmsghdr *nlh, u8 family, u8 version, -+ __be16 res_id) -+{ -+ struct nfgenmsg *nfmsg; -+ -+ nfmsg = nlmsg_data(nlh); -+ nfmsg->nfgen_family = family; -+ nfmsg->version = version; -+ nfmsg->res_id = res_id; -+} -+ -+static inline struct nlmsghdr *nfnl_msg_put(struct sk_buff *skb, u32 portid, -+ u32 seq, int type, int flags, -+ u8 family, u8 version, -+ __be16 res_id) -+{ -+ struct nlmsghdr *nlh; -+ -+ nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags); -+ if (!nlh) -+ return NULL; -+ -+ nfnl_fill_hdr(nlh, family, version, res_id); -+ -+ return nlh; -+} -+ - void nfnl_lock(__u8 subsys_id); - void nfnl_unlock(__u8 subsys_id); - #ifdef CONFIG_PROVE_LOCKING -diff --git a/include/linux/nmi.h b/include/linux/nmi.h -index e972d1ae1ee63..6cb593d9ed08a 100644 ---- a/include/linux/nmi.h -+++ b/include/linux/nmi.h -@@ -197,7 +197,7 @@ u64 hw_nmi_get_sample_period(int watchdog_thresh); - #endif - - #if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \ -- defined(CONFIG_HARDLOCKUP_DETECTOR) -+ defined(CONFIG_HARDLOCKUP_DETECTOR_PERF) - void watchdog_update_hrtimer_threshold(u64 period); - #else - static inline void watchdog_update_hrtimer_threshold(u64 period) { } -diff --git a/include/linux/pci.h b/include/linux/pci.h -index fc343d123127b..1cd5caa567cf5 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -1687,6 +1687,7 @@ static inline struct pci_dev *pci_get_class(unsigned int class, - #define pci_dev_put(dev) do { } while (0) - - static inline void pci_set_master(struct pci_dev *dev) { } -+static inline void pci_clear_master(struct pci_dev *dev) { } - static inline int pci_enable_device(struct pci_dev *dev) { return -EIO; } - static inline void pci_disable_device(struct pci_dev *dev) { } - static inline int pci_assign_resource(struct pci_dev *dev, int i) -diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h -index b3f88470cbb58..2f355c3c0d15f 100644 ---- a/include/linux/sched/signal.h -+++ b/include/linux/sched/signal.h -@@ -123,7 +123,7 @@ struct signal_struct { - #ifdef CONFIG_POSIX_TIMERS - - /* POSIX.1b Interval Timers */ -- int posix_timer_id; -+ unsigned int next_posix_timer_id; - struct list_head posix_timers; - - /* ITIMER_REAL timer for the process */ -diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h -index bb2bc99388cae..432fdabd00e4b 100644 ---- a/include/linux/serial_8250.h -+++ b/include/linux/serial_8250.h -@@ -95,7 +95,6 @@ struct uart_8250_port { - struct list_head list; /* ports on this IRQ */ - u32 capabilities; /* port capabilities */ - unsigned short bugs; /* port bugs */ -- bool fifo_bug; /* min RX trigger if enabled */ - unsigned int tx_loadsz; /* transmit fifo load size */ - unsigned char acr; - unsigned char fcr; -diff --git a/include/linux/tcp.h b/include/linux/tcp.h -index 89751c89f11f4..68dacc1994376 100644 ---- a/include/linux/tcp.h -+++ b/include/linux/tcp.h -@@ -458,7 +458,7 @@ static inline void fastopen_queue_tune(struct sock *sk, int backlog) - struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; - int somaxconn = READ_ONCE(sock_net(sk)->core.sysctl_somaxconn); - -- queue->fastopenq.max_qlen = min_t(unsigned int, backlog, somaxconn); -+ WRITE_ONCE(queue->fastopenq.max_qlen, min_t(unsigned int, backlog, somaxconn)); - } - - static inline void tcp_move_syn(struct tcp_sock *tp, -diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h -index 4261d1c6e87b1..887f0b94d6e99 100644 ---- a/include/linux/workqueue.h -+++ b/include/linux/workqueue.h -@@ -73,7 +73,6 @@ enum { - WORK_OFFQ_FLAG_BASE = WORK_STRUCT_COLOR_SHIFT, - - __WORK_OFFQ_CANCELING = WORK_OFFQ_FLAG_BASE, -- WORK_OFFQ_CANCELING = (1 << __WORK_OFFQ_CANCELING), - - /* - * When a work item is off queue, its high bits point to the last -@@ -84,12 +83,6 @@ enum { - WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_FLAG_BASE + WORK_OFFQ_FLAG_BITS, - WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT, - WORK_OFFQ_POOL_BITS = WORK_OFFQ_LEFT <= 31 ? WORK_OFFQ_LEFT : 31, -- WORK_OFFQ_POOL_NONE = (1LU << WORK_OFFQ_POOL_BITS) - 1, -- -- /* convenience constants */ -- WORK_STRUCT_FLAG_MASK = (1UL << WORK_STRUCT_FLAG_BITS) - 1, -- WORK_STRUCT_WQ_DATA_MASK = ~WORK_STRUCT_FLAG_MASK, -- WORK_STRUCT_NO_POOL = (unsigned long)WORK_OFFQ_POOL_NONE << WORK_OFFQ_POOL_SHIFT, - - /* bit mask for work_busy() return values */ - WORK_BUSY_PENDING = 1 << 0, -@@ -99,6 +92,14 @@ enum { - WORKER_DESC_LEN = 24, - }; - -+/* Convenience constants - of type 'unsigned long', not 'enum'! */ -+#define WORK_OFFQ_CANCELING (1ul << __WORK_OFFQ_CANCELING) -+#define WORK_OFFQ_POOL_NONE ((1ul << WORK_OFFQ_POOL_BITS) - 1) -+#define WORK_STRUCT_NO_POOL (WORK_OFFQ_POOL_NONE << WORK_OFFQ_POOL_SHIFT) -+ -+#define WORK_STRUCT_FLAG_MASK ((1ul << WORK_STRUCT_FLAG_BITS) - 1) -+#define WORK_STRUCT_WQ_DATA_MASK (~WORK_STRUCT_FLAG_MASK) -+ - struct work_struct { - atomic_long_t data; - struct list_head entry; -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index a8cc2750990f9..7ab13f515749d 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -756,6 +756,7 @@ struct nft_expr_type { - - enum nft_trans_phase { - NFT_TRANS_PREPARE, -+ NFT_TRANS_PREPARE_ERROR, - NFT_TRANS_ABORT, - NFT_TRANS_COMMIT, - NFT_TRANS_RELEASE -@@ -1363,6 +1364,7 @@ static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext) - * struct nft_trans - nf_tables object update in transaction - * - * @list: used internally -+ * @binding_list: list of objects with possible bindings - * @msg_type: message type - * @put_net: ctx->net needs to be put - * @ctx: transaction context -@@ -1370,6 +1372,7 @@ static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext) - */ - struct nft_trans { - struct list_head list; -+ struct list_head binding_list; - int msg_type; - bool put_net; - struct nft_ctx ctx; -@@ -1472,4 +1475,15 @@ void nf_tables_trans_destroy_flush_work(void); - int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result); - __be64 nf_jiffies64_to_msecs(u64 input); - -+struct nftables_pernet { -+ struct list_head tables; -+ struct list_head commit_list; -+ struct list_head binding_list; -+ struct list_head module_list; -+ struct list_head notify_list; -+ struct mutex commit_mutex; -+ unsigned int base_seq; -+ u8 validate_state; -+}; -+ - #endif /* _NET_NF_TABLES_H */ -diff --git a/include/net/netns/nftables.h b/include/net/netns/nftables.h -index a1a8d45adb42a..8c77832d02404 100644 ---- a/include/net/netns/nftables.h -+++ b/include/net/netns/nftables.h -@@ -5,13 +5,7 @@ - #include - - struct netns_nftables { -- struct list_head tables; -- struct list_head commit_list; -- struct list_head module_list; -- struct mutex commit_mutex; -- unsigned int base_seq; - u8 gencursor; -- u8 validate_state; - }; - - #endif -diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h -index 5d277d68fd8d9..c55e72474eb2b 100644 ---- a/include/net/nfc/nfc.h -+++ b/include/net/nfc/nfc.h -@@ -266,7 +266,7 @@ struct sk_buff *nfc_alloc_send_skb(struct nfc_dev *dev, struct sock *sk, - struct sk_buff *nfc_alloc_recv_skb(unsigned int size, gfp_t gfp); - - int nfc_set_remote_general_bytes(struct nfc_dev *dev, -- u8 *gt, u8 gt_len); -+ const u8 *gt, u8 gt_len); - u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len); - - int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name, -@@ -280,7 +280,7 @@ int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx, - u8 comm_mode, u8 rf_mode); - - int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode, -- u8 *gb, size_t gb_len); -+ const u8 *gb, size_t gb_len); - int nfc_tm_deactivated(struct nfc_dev *dev); - int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb); - -diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h -index 2d932834ed5bf..fd99650a2e229 100644 ---- a/include/net/pkt_sched.h -+++ b/include/net/pkt_sched.h -@@ -131,7 +131,7 @@ extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1]; - */ - static inline unsigned int psched_mtu(const struct net_device *dev) - { -- return dev->mtu + dev->hard_header_len; -+ return READ_ONCE(dev->mtu) + dev->hard_header_len; - } - - static inline struct net *qdisc_net(struct Qdisc *q) -diff --git a/include/net/sock.h b/include/net/sock.h -index 87e57f81ee82b..ee8630d6abc16 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -1863,6 +1863,7 @@ static inline void sock_graft(struct sock *sk, struct socket *parent) - } - - kuid_t sock_i_uid(struct sock *sk); -+unsigned long __sock_i_ino(struct sock *sk); - unsigned long sock_i_ino(struct sock *sk); - - static inline kuid_t sock_net_uid(const struct net *net, const struct sock *sk) -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 077feeca6c99e..4e909148fce39 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -125,6 +125,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo); - * to combine FIN-WAIT-2 timeout with - * TIME-WAIT timer. - */ -+#define TCP_FIN_TIMEOUT_MAX (120 * HZ) /* max TCP_LINGER2 value (two minutes) */ - - #define TCP_DELACK_MAX ((unsigned)(HZ/5)) /* maximal time to delay before sending an ACK */ - #if HZ >= 100 -@@ -1952,7 +1953,11 @@ void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr, __be32 daddr); - static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp) - { - struct net *net = sock_net((struct sock *)tp); -- return tp->notsent_lowat ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat); -+ u32 val; -+ -+ val = READ_ONCE(tp->notsent_lowat); -+ -+ return val ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat); - } - - /* @wake is one when sk_stream_write_space() calls us. -diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h -index 295517f109d71..1b5371f0317af 100644 ---- a/include/trace/events/timer.h -+++ b/include/trace/events/timer.h -@@ -156,7 +156,11 @@ DEFINE_EVENT(timer_class, timer_cancel, - { HRTIMER_MODE_ABS_SOFT, "ABS|SOFT" }, \ - { HRTIMER_MODE_REL_SOFT, "REL|SOFT" }, \ - { HRTIMER_MODE_ABS_PINNED_SOFT, "ABS|PINNED|SOFT" }, \ -- { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" }) -+ { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" }, \ -+ { HRTIMER_MODE_ABS_HARD, "ABS|HARD" }, \ -+ { HRTIMER_MODE_REL_HARD, "REL|HARD" }, \ -+ { HRTIMER_MODE_ABS_PINNED_HARD, "ABS|PINNED|HARD" }, \ -+ { HRTIMER_MODE_REL_PINNED_HARD, "REL|PINNED|HARD" }) - - /** - * hrtimer_init - called when the hrtimer is initialized -diff --git a/include/uapi/linux/affs_hardblocks.h b/include/uapi/linux/affs_hardblocks.h -index 5e2fb8481252a..a5aff2eb5f708 100644 ---- a/include/uapi/linux/affs_hardblocks.h -+++ b/include/uapi/linux/affs_hardblocks.h -@@ -7,42 +7,42 @@ - /* Just the needed definitions for the RDB of an Amiga HD. */ - - struct RigidDiskBlock { -- __u32 rdb_ID; -+ __be32 rdb_ID; - __be32 rdb_SummedLongs; -- __s32 rdb_ChkSum; -- __u32 rdb_HostID; -+ __be32 rdb_ChkSum; -+ __be32 rdb_HostID; - __be32 rdb_BlockBytes; -- __u32 rdb_Flags; -- __u32 rdb_BadBlockList; -+ __be32 rdb_Flags; -+ __be32 rdb_BadBlockList; - __be32 rdb_PartitionList; -- __u32 rdb_FileSysHeaderList; -- __u32 rdb_DriveInit; -- __u32 rdb_Reserved1[6]; -- __u32 rdb_Cylinders; -- __u32 rdb_Sectors; -- __u32 rdb_Heads; -- __u32 rdb_Interleave; -- __u32 rdb_Park; -- __u32 rdb_Reserved2[3]; -- __u32 rdb_WritePreComp; -- __u32 rdb_ReducedWrite; -- __u32 rdb_StepRate; -- __u32 rdb_Reserved3[5]; -- __u32 rdb_RDBBlocksLo; -- __u32 rdb_RDBBlocksHi; -- __u32 rdb_LoCylinder; -- __u32 rdb_HiCylinder; -- __u32 rdb_CylBlocks; -- __u32 rdb_AutoParkSeconds; -- __u32 rdb_HighRDSKBlock; -- __u32 rdb_Reserved4; -+ __be32 rdb_FileSysHeaderList; -+ __be32 rdb_DriveInit; -+ __be32 rdb_Reserved1[6]; -+ __be32 rdb_Cylinders; -+ __be32 rdb_Sectors; -+ __be32 rdb_Heads; -+ __be32 rdb_Interleave; -+ __be32 rdb_Park; -+ __be32 rdb_Reserved2[3]; -+ __be32 rdb_WritePreComp; -+ __be32 rdb_ReducedWrite; -+ __be32 rdb_StepRate; -+ __be32 rdb_Reserved3[5]; -+ __be32 rdb_RDBBlocksLo; -+ __be32 rdb_RDBBlocksHi; -+ __be32 rdb_LoCylinder; -+ __be32 rdb_HiCylinder; -+ __be32 rdb_CylBlocks; -+ __be32 rdb_AutoParkSeconds; -+ __be32 rdb_HighRDSKBlock; -+ __be32 rdb_Reserved4; - char rdb_DiskVendor[8]; - char rdb_DiskProduct[16]; - char rdb_DiskRevision[4]; - char rdb_ControllerVendor[8]; - char rdb_ControllerProduct[16]; - char rdb_ControllerRevision[4]; -- __u32 rdb_Reserved5[10]; -+ __be32 rdb_Reserved5[10]; - }; - - #define IDNAME_RIGIDDISK 0x5244534B /* "RDSK" */ -@@ -50,16 +50,16 @@ struct RigidDiskBlock { - struct PartitionBlock { - __be32 pb_ID; - __be32 pb_SummedLongs; -- __s32 pb_ChkSum; -- __u32 pb_HostID; -+ __be32 pb_ChkSum; -+ __be32 pb_HostID; - __be32 pb_Next; -- __u32 pb_Flags; -- __u32 pb_Reserved1[2]; -- __u32 pb_DevFlags; -+ __be32 pb_Flags; -+ __be32 pb_Reserved1[2]; -+ __be32 pb_DevFlags; - __u8 pb_DriveName[32]; -- __u32 pb_Reserved2[15]; -+ __be32 pb_Reserved2[15]; - __be32 pb_Environment[17]; -- __u32 pb_EReserved[15]; -+ __be32 pb_EReserved[15]; - }; - - #define IDNAME_PARTITION 0x50415254 /* "PART" */ -diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h -index 9c89429f31130..895c5ba8b6ac2 100644 ---- a/include/uapi/linux/videodev2.h -+++ b/include/uapi/linux/videodev2.h -@@ -1588,7 +1588,7 @@ struct v4l2_input { - __u8 name[32]; /* Label */ - __u32 type; /* Type of input */ - __u32 audioset; /* Associated audios (bitfield) */ -- __u32 tuner; /* enum v4l2_tuner_type */ -+ __u32 tuner; /* Tuner index */ - v4l2_std_id std; - __u32 status; - __u32 capabilities; -diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c -index d99e89f113c43..3dabdd137d102 100644 ---- a/kernel/bpf/bpf_lru_list.c -+++ b/kernel/bpf/bpf_lru_list.c -@@ -41,7 +41,12 @@ static struct list_head *local_pending_list(struct bpf_lru_locallist *loc_l) - /* bpf_lru_node helpers */ - static bool bpf_lru_node_is_ref(const struct bpf_lru_node *node) - { -- return node->ref; -+ return READ_ONCE(node->ref); -+} -+ -+static void bpf_lru_node_clear_ref(struct bpf_lru_node *node) -+{ -+ WRITE_ONCE(node->ref, 0); - } - - static void bpf_lru_list_count_inc(struct bpf_lru_list *l, -@@ -89,7 +94,7 @@ static void __bpf_lru_node_move_in(struct bpf_lru_list *l, - - bpf_lru_list_count_inc(l, tgt_type); - node->type = tgt_type; -- node->ref = 0; -+ bpf_lru_node_clear_ref(node); - list_move(&node->list, &l->lists[tgt_type]); - } - -@@ -110,7 +115,7 @@ static void __bpf_lru_node_move(struct bpf_lru_list *l, - bpf_lru_list_count_inc(l, tgt_type); - node->type = tgt_type; - } -- node->ref = 0; -+ bpf_lru_node_clear_ref(node); - - /* If the moving node is the next_inactive_rotation candidate, - * move the next_inactive_rotation pointer also. -@@ -353,7 +358,7 @@ static void __local_list_add_pending(struct bpf_lru *lru, - *(u32 *)((void *)node + lru->hash_offset) = hash; - node->cpu = cpu; - node->type = BPF_LRU_LOCAL_LIST_T_PENDING; -- node->ref = 0; -+ bpf_lru_node_clear_ref(node); - list_add(&node->list, local_pending_list(loc_l)); - } - -@@ -419,7 +424,7 @@ static struct bpf_lru_node *bpf_percpu_lru_pop_free(struct bpf_lru *lru, - if (!list_empty(free_list)) { - node = list_first_entry(free_list, struct bpf_lru_node, list); - *(u32 *)((void *)node + lru->hash_offset) = hash; -- node->ref = 0; -+ bpf_lru_node_clear_ref(node); - __bpf_lru_node_move(l, node, BPF_LRU_LIST_T_INACTIVE); - } - -@@ -522,7 +527,7 @@ static void bpf_common_lru_push_free(struct bpf_lru *lru, - } - - node->type = BPF_LRU_LOCAL_LIST_T_FREE; -- node->ref = 0; -+ bpf_lru_node_clear_ref(node); - list_move(&node->list, local_free_list(loc_l)); - - raw_spin_unlock_irqrestore(&loc_l->lock, flags); -@@ -568,7 +573,7 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf, - - node = (struct bpf_lru_node *)(buf + node_offset); - node->type = BPF_LRU_LIST_T_FREE; -- node->ref = 0; -+ bpf_lru_node_clear_ref(node); - list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]); - buf += elem_size; - } -@@ -594,7 +599,7 @@ again: - node = (struct bpf_lru_node *)(buf + node_offset); - node->cpu = cpu; - node->type = BPF_LRU_LIST_T_FREE; -- node->ref = 0; -+ bpf_lru_node_clear_ref(node); - list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]); - i++; - buf += elem_size; -diff --git a/kernel/bpf/bpf_lru_list.h b/kernel/bpf/bpf_lru_list.h -index f02504640e185..41f8fea530c8d 100644 ---- a/kernel/bpf/bpf_lru_list.h -+++ b/kernel/bpf/bpf_lru_list.h -@@ -63,11 +63,8 @@ struct bpf_lru { - - static inline void bpf_lru_node_set_ref(struct bpf_lru_node *node) - { -- /* ref is an approximation on access frequency. It does not -- * have to be very accurate. Hence, no protection is used. -- */ -- if (!node->ref) -- node->ref = 1; -+ if (!READ_ONCE(node->ref)) -+ WRITE_ONCE(node->ref, 1); - } - - int bpf_lru_init(struct bpf_lru *lru, bool percpu, u32 hash_offset, -diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c -index d65b0fc8fb48b..3694d90c3722f 100644 ---- a/kernel/kexec_core.c -+++ b/kernel/kexec_core.c -@@ -1019,6 +1019,7 @@ int crash_shrink_memory(unsigned long new_size) - start = crashk_res.start; - end = crashk_res.end; - old_size = (end == 0) ? 0 : end - start + 1; -+ new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN); - if (new_size >= old_size) { - ret = (new_size == old_size) ? 0 : -EINVAL; - goto unlock; -@@ -1030,9 +1031,7 @@ int crash_shrink_memory(unsigned long new_size) - goto unlock; - } - -- start = roundup(start, KEXEC_CRASH_MEM_ALIGN); -- end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN); -- -+ end = start + new_size; - crash_free_reserved_phys_range(end, crashk_res.end); - - if ((start == end) && (crashk_res.parent != NULL)) -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 9fcba0d2ab19b..2680216234ff2 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -8938,7 +8938,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, - .sd = sd, - .dst_cpu = this_cpu, - .dst_rq = this_rq, -- .dst_grpmask = sched_group_span(sd->groups), -+ .dst_grpmask = group_balance_mask(sd->groups), - .idle = idle, - .loop_break = sched_nr_migrate_break, - .cpus = cpus, -diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c -index efe3873021a37..f3b8313475acd 100644 ---- a/kernel/time/posix-timers.c -+++ b/kernel/time/posix-timers.c -@@ -138,25 +138,30 @@ static struct k_itimer *posix_timer_by_id(timer_t id) - static int posix_timer_add(struct k_itimer *timer) - { - struct signal_struct *sig = current->signal; -- int first_free_id = sig->posix_timer_id; - struct hlist_head *head; -- int ret = -ENOENT; -+ unsigned int cnt, id; - -- do { -+ /* -+ * FIXME: Replace this by a per signal struct xarray once there is -+ * a plan to handle the resulting CRIU regression gracefully. -+ */ -+ for (cnt = 0; cnt <= INT_MAX; cnt++) { - spin_lock(&hash_lock); -- head = &posix_timers_hashtable[hash(sig, sig->posix_timer_id)]; -- if (!__posix_timers_find(head, sig, sig->posix_timer_id)) { -+ id = sig->next_posix_timer_id; -+ -+ /* Write the next ID back. Clamp it to the positive space */ -+ sig->next_posix_timer_id = (id + 1) & INT_MAX; -+ -+ head = &posix_timers_hashtable[hash(sig, id)]; -+ if (!__posix_timers_find(head, sig, id)) { - hlist_add_head_rcu(&timer->t_hash, head); -- ret = sig->posix_timer_id; -+ spin_unlock(&hash_lock); -+ return id; - } -- if (++sig->posix_timer_id < 0) -- sig->posix_timer_id = 0; -- if ((sig->posix_timer_id == first_free_id) && (ret == -ENOENT)) -- /* Loop over all possible ids completed */ -- ret = -EAGAIN; - spin_unlock(&hash_lock); -- } while (ret == -ENOENT); -- return ret; -+ } -+ /* POSIX return code when no timer ID could be allocated */ -+ return -EAGAIN; - } - - static inline void unlock_timer(struct k_itimer *timr, unsigned long flags) -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index c24039c4d75ab..afd7f3a51485e 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -4487,28 +4487,34 @@ unsigned long ring_buffer_size(struct ring_buffer *buffer, int cpu) - } - EXPORT_SYMBOL_GPL(ring_buffer_size); - -+static void rb_clear_buffer_page(struct buffer_page *page) -+{ -+ local_set(&page->write, 0); -+ local_set(&page->entries, 0); -+ rb_init_page(page->page); -+ page->read = 0; -+} -+ - static void - rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) - { -+ struct buffer_page *page; -+ - rb_head_page_deactivate(cpu_buffer); - - cpu_buffer->head_page - = list_entry(cpu_buffer->pages, struct buffer_page, list); -- local_set(&cpu_buffer->head_page->write, 0); -- local_set(&cpu_buffer->head_page->entries, 0); -- local_set(&cpu_buffer->head_page->page->commit, 0); -- -- cpu_buffer->head_page->read = 0; -+ rb_clear_buffer_page(cpu_buffer->head_page); -+ list_for_each_entry(page, cpu_buffer->pages, list) { -+ rb_clear_buffer_page(page); -+ } - - cpu_buffer->tail_page = cpu_buffer->head_page; - cpu_buffer->commit_page = cpu_buffer->head_page; - - INIT_LIST_HEAD(&cpu_buffer->reader_page->list); - INIT_LIST_HEAD(&cpu_buffer->new_pages); -- local_set(&cpu_buffer->reader_page->write, 0); -- local_set(&cpu_buffer->reader_page->entries, 0); -- local_set(&cpu_buffer->reader_page->page->commit, 0); -- cpu_buffer->reader_page->read = 0; -+ rb_clear_buffer_page(cpu_buffer->reader_page); - - local_set(&cpu_buffer->entries_bytes, 0); - local_set(&cpu_buffer->overrun, 0); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 219cd2c819369..7f7c700a61560 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -7263,7 +7263,7 @@ static const struct file_operations tracing_err_log_fops = { - .open = tracing_err_log_open, - .write = tracing_err_log_write, - .read = seq_read, -- .llseek = seq_lseek, -+ .llseek = tracing_lseek, - .release = tracing_err_log_release, - }; - -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index 3cb937c17ce04..1ede6d41ab8da 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -6423,13 +6423,16 @@ static int event_hist_trigger_func(struct event_command *cmd_ops, - if (get_named_trigger_data(trigger_data)) - goto enable; - -- if (has_hist_vars(hist_data)) -- save_hist_vars(hist_data); -- - ret = create_actions(hist_data); - if (ret) - goto out_unreg; - -+ if (has_hist_vars(hist_data) || hist_data->n_var_refs) { -+ ret = save_hist_vars(hist_data); -+ if (ret) -+ goto out_unreg; -+ } -+ - ret = tracing_map_init(hist_data->map); - if (ret) - goto out_unreg; -diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h -index e5282828f4a60..29348874ebde7 100644 ---- a/kernel/trace/trace_probe_tmpl.h -+++ b/kernel/trace/trace_probe_tmpl.h -@@ -143,6 +143,8 @@ stage3: - array: - /* the last stage: Loop on array */ - if (code->op == FETCH_OP_LP_ARRAY) { -+ if (ret < 0) -+ ret = 0; - total += ret; - if (++i < code->param) { - code = s3; -diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c -index 247bf0b1582ca..1e8a49dc956e2 100644 ---- a/kernel/watchdog_hld.c -+++ b/kernel/watchdog_hld.c -@@ -114,14 +114,14 @@ static void watchdog_overflow_callback(struct perf_event *event, - /* Ensure the watchdog never gets throttled */ - event->hw.interrupts = 0; - -+ if (!watchdog_check_timestamp()) -+ return; -+ - if (__this_cpu_read(watchdog_nmi_touch) == true) { - __this_cpu_write(watchdog_nmi_touch, false); - return; - } - -- if (!watchdog_check_timestamp()) -- return; -- - /* check for a hardlockup - * This is done by making sure our timer interrupt - * is incrementing. The timer interrupt should have -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index dd96391b44de0..856188b0681af 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -684,12 +684,17 @@ static void clear_work_data(struct work_struct *work) - set_work_data(work, WORK_STRUCT_NO_POOL, 0); - } - -+static inline struct pool_workqueue *work_struct_pwq(unsigned long data) -+{ -+ return (struct pool_workqueue *)(data & WORK_STRUCT_WQ_DATA_MASK); -+} -+ - static struct pool_workqueue *get_work_pwq(struct work_struct *work) - { - unsigned long data = atomic_long_read(&work->data); - - if (data & WORK_STRUCT_PWQ) -- return (void *)(data & WORK_STRUCT_WQ_DATA_MASK); -+ return work_struct_pwq(data); - else - return NULL; - } -@@ -717,8 +722,7 @@ static struct worker_pool *get_work_pool(struct work_struct *work) - assert_rcu_or_pool_mutex(); - - if (data & WORK_STRUCT_PWQ) -- return ((struct pool_workqueue *) -- (data & WORK_STRUCT_WQ_DATA_MASK))->pool; -+ return work_struct_pwq(data)->pool; - - pool_id = data >> WORK_OFFQ_POOL_SHIFT; - if (pool_id == WORK_OFFQ_POOL_NONE) -@@ -739,8 +743,7 @@ static int get_work_pool_id(struct work_struct *work) - unsigned long data = atomic_long_read(&work->data); - - if (data & WORK_STRUCT_PWQ) -- return ((struct pool_workqueue *) -- (data & WORK_STRUCT_WQ_DATA_MASK))->pool->id; -+ return work_struct_pwq(data)->pool->id; - - return data >> WORK_OFFQ_POOL_SHIFT; - } -diff --git a/lib/debugobjects.c b/lib/debugobjects.c -index 26fa04335537b..b0e4301d74954 100644 ---- a/lib/debugobjects.c -+++ b/lib/debugobjects.c -@@ -474,6 +474,15 @@ static void debug_print_object(struct debug_obj *obj, char *msg) - struct debug_obj_descr *descr = obj->descr; - static int limit; - -+ /* -+ * Don't report if lookup_object_or_alloc() by the current thread -+ * failed because lookup_object_or_alloc()/debug_objects_oom() by a -+ * concurrent thread turned off debug_objects_enabled and cleared -+ * the hash buckets. -+ */ -+ if (!debug_objects_enabled) -+ return; -+ - if (limit < 5 && descr != descr_test) { - void *hint = descr->debug_hint ? - descr->debug_hint(obj->object) : NULL; -diff --git a/lib/ts_bm.c b/lib/ts_bm.c -index b352903c50e38..0a22ae48af61f 100644 ---- a/lib/ts_bm.c -+++ b/lib/ts_bm.c -@@ -60,10 +60,12 @@ static unsigned int bm_find(struct ts_config *conf, struct ts_state *state) - struct ts_bm *bm = ts_config_priv(conf); - unsigned int i, text_len, consumed = state->offset; - const u8 *text; -- int shift = bm->patlen - 1, bs; -+ int bs; - const u8 icase = conf->flags & TS_IGNORECASE; - - for (;;) { -+ int shift = bm->patlen - 1; -+ - text_len = conf->get_next_block(consumed, &text, conf, state); - - if (unlikely(text_len == 0)) -diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c -index e2a999890d05e..6b650dfc084dc 100644 ---- a/net/bridge/br_if.c -+++ b/net/bridge/br_if.c -@@ -157,8 +157,9 @@ void br_manage_promisc(struct net_bridge *br) - * This lets us disable promiscuous mode and write - * this config to hw. - */ -- if (br->auto_cnt == 0 || -- (br->auto_cnt == 1 && br_auto_port(p))) -+ if ((p->dev->priv_flags & IFF_UNICAST_FLT) && -+ (br->auto_cnt == 0 || -+ (br->auto_cnt == 1 && br_auto_port(p)))) - br_port_clear_promisc(p); - else - br_port_set_promisc(p); -diff --git a/net/can/bcm.c b/net/can/bcm.c -index 23c7d5f896bd2..5cb4b6129263c 100644 ---- a/net/can/bcm.c -+++ b/net/can/bcm.c -@@ -1523,6 +1523,12 @@ static int bcm_release(struct socket *sock) - - lock_sock(sk); - -+#if IS_ENABLED(CONFIG_PROC_FS) -+ /* remove procfs entry */ -+ if (net->can.bcmproc_dir && bo->bcm_proc_read) -+ remove_proc_entry(bo->procname, net->can.bcmproc_dir); -+#endif /* CONFIG_PROC_FS */ -+ - list_for_each_entry_safe(op, next, &bo->tx_ops, list) - bcm_remove_op(op); - -@@ -1558,12 +1564,6 @@ static int bcm_release(struct socket *sock) - list_for_each_entry_safe(op, next, &bo->rx_ops, list) - bcm_remove_op(op); - --#if IS_ENABLED(CONFIG_PROC_FS) -- /* remove procfs entry */ -- if (net->can.bcmproc_dir && bo->bcm_proc_read) -- remove_proc_entry(bo->procname, net->can.bcmproc_dir); --#endif /* CONFIG_PROC_FS */ -- - /* remove device reference */ - if (bo->bound) { - bo->bound = 0; -diff --git a/net/core/devlink.c b/net/core/devlink.c -index 2dd354d869cd7..b4dabe5d89f72 100644 ---- a/net/core/devlink.c -+++ b/net/core/devlink.c -@@ -6299,7 +6299,10 @@ EXPORT_SYMBOL_GPL(devlink_free); - - static void devlink_port_type_warn(struct work_struct *work) - { -- WARN(true, "Type was not set for devlink port."); -+ struct devlink_port *port = container_of(to_delayed_work(work), -+ struct devlink_port, -+ type_warn_dw); -+ dev_warn(port->devlink->dev, "Type was not set for devlink port."); - } - - static bool devlink_port_type_should_warn(struct devlink_port *devlink_port) -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index da1ef00fc9cc2..1db92a44548f0 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -922,24 +922,27 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev, - nla_total_size(sizeof(struct ifla_vf_rate)) + - nla_total_size(sizeof(struct ifla_vf_link_state)) + - nla_total_size(sizeof(struct ifla_vf_rss_query_en)) + -- nla_total_size(0) + /* nest IFLA_VF_STATS */ -- /* IFLA_VF_STATS_RX_PACKETS */ -- nla_total_size_64bit(sizeof(__u64)) + -- /* IFLA_VF_STATS_TX_PACKETS */ -- nla_total_size_64bit(sizeof(__u64)) + -- /* IFLA_VF_STATS_RX_BYTES */ -- nla_total_size_64bit(sizeof(__u64)) + -- /* IFLA_VF_STATS_TX_BYTES */ -- nla_total_size_64bit(sizeof(__u64)) + -- /* IFLA_VF_STATS_BROADCAST */ -- nla_total_size_64bit(sizeof(__u64)) + -- /* IFLA_VF_STATS_MULTICAST */ -- nla_total_size_64bit(sizeof(__u64)) + -- /* IFLA_VF_STATS_RX_DROPPED */ -- nla_total_size_64bit(sizeof(__u64)) + -- /* IFLA_VF_STATS_TX_DROPPED */ -- nla_total_size_64bit(sizeof(__u64)) + - nla_total_size(sizeof(struct ifla_vf_trust))); -+ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) { -+ size += num_vfs * -+ (nla_total_size(0) + /* nest IFLA_VF_STATS */ -+ /* IFLA_VF_STATS_RX_PACKETS */ -+ nla_total_size_64bit(sizeof(__u64)) + -+ /* IFLA_VF_STATS_TX_PACKETS */ -+ nla_total_size_64bit(sizeof(__u64)) + -+ /* IFLA_VF_STATS_RX_BYTES */ -+ nla_total_size_64bit(sizeof(__u64)) + -+ /* IFLA_VF_STATS_TX_BYTES */ -+ nla_total_size_64bit(sizeof(__u64)) + -+ /* IFLA_VF_STATS_BROADCAST */ -+ nla_total_size_64bit(sizeof(__u64)) + -+ /* IFLA_VF_STATS_MULTICAST */ -+ nla_total_size_64bit(sizeof(__u64)) + -+ /* IFLA_VF_STATS_RX_DROPPED */ -+ nla_total_size_64bit(sizeof(__u64)) + -+ /* IFLA_VF_STATS_TX_DROPPED */ -+ nla_total_size_64bit(sizeof(__u64))); -+ } - return size; - } else - return 0; -@@ -1189,7 +1192,8 @@ static noinline_for_stack int rtnl_fill_stats(struct sk_buff *skb, - static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, - struct net_device *dev, - int vfs_num, -- struct nlattr *vfinfo) -+ struct nlattr *vfinfo, -+ u32 ext_filter_mask) - { - struct ifla_vf_rss_query_en vf_rss_query_en; - struct nlattr *vf, *vfstats, *vfvlanlist; -@@ -1279,33 +1283,35 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, - goto nla_put_vf_failure; - } - nla_nest_end(skb, vfvlanlist); -- memset(&vf_stats, 0, sizeof(vf_stats)); -- if (dev->netdev_ops->ndo_get_vf_stats) -- dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num, -- &vf_stats); -- vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS); -- if (!vfstats) -- goto nla_put_vf_failure; -- if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS, -- vf_stats.rx_packets, IFLA_VF_STATS_PAD) || -- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS, -- vf_stats.tx_packets, IFLA_VF_STATS_PAD) || -- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES, -- vf_stats.rx_bytes, IFLA_VF_STATS_PAD) || -- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES, -- vf_stats.tx_bytes, IFLA_VF_STATS_PAD) || -- nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST, -- vf_stats.broadcast, IFLA_VF_STATS_PAD) || -- nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST, -- vf_stats.multicast, IFLA_VF_STATS_PAD) || -- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED, -- vf_stats.rx_dropped, IFLA_VF_STATS_PAD) || -- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED, -- vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) { -- nla_nest_cancel(skb, vfstats); -- goto nla_put_vf_failure; -+ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) { -+ memset(&vf_stats, 0, sizeof(vf_stats)); -+ if (dev->netdev_ops->ndo_get_vf_stats) -+ dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num, -+ &vf_stats); -+ vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS); -+ if (!vfstats) -+ goto nla_put_vf_failure; -+ if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS, -+ vf_stats.rx_packets, IFLA_VF_STATS_PAD) || -+ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS, -+ vf_stats.tx_packets, IFLA_VF_STATS_PAD) || -+ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES, -+ vf_stats.rx_bytes, IFLA_VF_STATS_PAD) || -+ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES, -+ vf_stats.tx_bytes, IFLA_VF_STATS_PAD) || -+ nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST, -+ vf_stats.broadcast, IFLA_VF_STATS_PAD) || -+ nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST, -+ vf_stats.multicast, IFLA_VF_STATS_PAD) || -+ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED, -+ vf_stats.rx_dropped, IFLA_VF_STATS_PAD) || -+ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED, -+ vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) { -+ nla_nest_cancel(skb, vfstats); -+ goto nla_put_vf_failure; -+ } -+ nla_nest_end(skb, vfstats); - } -- nla_nest_end(skb, vfstats); - nla_nest_end(skb, vf); - return 0; - -@@ -1338,7 +1344,7 @@ static noinline_for_stack int rtnl_fill_vf(struct sk_buff *skb, - return -EMSGSIZE; - - for (i = 0; i < num_vfs; i++) { -- if (rtnl_fill_vfinfo(skb, dev, i, vfinfo)) -+ if (rtnl_fill_vfinfo(skb, dev, i, vfinfo, ext_filter_mask)) - return -EMSGSIZE; - } - -@@ -3580,7 +3586,7 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb, - ndm->ndm_ifindex = dev->ifindex; - ndm->ndm_state = ndm_state; - -- if (nla_put(skb, NDA_LLADDR, ETH_ALEN, addr)) -+ if (nla_put(skb, NDA_LLADDR, dev->addr_len, addr)) - goto nla_put_failure; - if (vid) - if (nla_put(skb, NDA_VLAN, sizeof(u16), &vid)) -@@ -3594,10 +3600,10 @@ nla_put_failure: - return -EMSGSIZE; - } - --static inline size_t rtnl_fdb_nlmsg_size(void) -+static inline size_t rtnl_fdb_nlmsg_size(const struct net_device *dev) - { - return NLMSG_ALIGN(sizeof(struct ndmsg)) + -- nla_total_size(ETH_ALEN) + /* NDA_LLADDR */ -+ nla_total_size(dev->addr_len) + /* NDA_LLADDR */ - nla_total_size(sizeof(u16)) + /* NDA_VLAN */ - 0; - } -@@ -3609,7 +3615,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, u16 vid, int type, - struct sk_buff *skb; - int err = -ENOBUFS; - -- skb = nlmsg_new(rtnl_fdb_nlmsg_size(), GFP_ATOMIC); -+ skb = nlmsg_new(rtnl_fdb_nlmsg_size(dev), GFP_ATOMIC); - if (!skb) - goto errout; - -diff --git a/net/core/sock.c b/net/core/sock.c -index 5e1dccbd61a60..d55eea5538bce 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -2085,13 +2085,24 @@ kuid_t sock_i_uid(struct sock *sk) - } - EXPORT_SYMBOL(sock_i_uid); - --unsigned long sock_i_ino(struct sock *sk) -+unsigned long __sock_i_ino(struct sock *sk) - { - unsigned long ino; - -- read_lock_bh(&sk->sk_callback_lock); -+ read_lock(&sk->sk_callback_lock); - ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0; -- read_unlock_bh(&sk->sk_callback_lock); -+ read_unlock(&sk->sk_callback_lock); -+ return ino; -+} -+EXPORT_SYMBOL(__sock_i_ino); -+ -+unsigned long sock_i_ino(struct sock *sk) -+{ -+ unsigned long ino; -+ -+ local_bh_disable(); -+ ino = __sock_i_ino(sk); -+ local_bh_enable(); - return ino; - } - EXPORT_SYMBOL(sock_i_ino); -diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c -index 12f3ce52e62eb..836a75030a520 100644 ---- a/net/dsa/tag_sja1105.c -+++ b/net/dsa/tag_sja1105.c -@@ -48,8 +48,8 @@ static void sja1105_meta_unpack(const struct sk_buff *skb, - * a unified unpacking command for both device series. - */ - packing(buf, &meta->tstamp, 31, 0, 4, UNPACK, 0); -- packing(buf + 4, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); -- packing(buf + 5, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); -+ packing(buf + 4, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); -+ packing(buf + 5, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); - packing(buf + 6, &meta->source_port, 7, 0, 1, UNPACK, 0); - packing(buf + 7, &meta->switch_id, 7, 0, 1, UNPACK, 0); - } -diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c -index 9d14b3289f003..e4f2790fd6410 100644 ---- a/net/ipv4/inet_hashtables.c -+++ b/net/ipv4/inet_hashtables.c -@@ -536,20 +536,8 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) - spin_lock(lock); - if (osk) { - WARN_ON_ONCE(sk->sk_hash != osk->sk_hash); -- ret = sk_hashed(osk); -- if (ret) { -- /* Before deleting the node, we insert a new one to make -- * sure that the look-up-sk process would not miss either -- * of them and that at least one node would exist in ehash -- * table all the time. Otherwise there's a tiny chance -- * that lookup process could find nothing in ehash table. -- */ -- __sk_nulls_add_node_tail_rcu(sk, list); -- sk_nulls_del_node_init_rcu(osk); -- } -- goto unlock; -- } -- if (found_dup_sk) { -+ ret = sk_nulls_del_node_init_rcu(osk); -+ } else if (found_dup_sk) { - *found_dup_sk = inet_ehash_lookup_by_sk(sk, list); - if (*found_dup_sk) - ret = false; -@@ -558,7 +546,6 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) - if (ret) - __sk_nulls_add_node_rcu(sk, list); - --unlock: - spin_unlock(lock); - - return ret; -diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c -index a00102d7c7fd4..c411c87ae865f 100644 ---- a/net/ipv4/inet_timewait_sock.c -+++ b/net/ipv4/inet_timewait_sock.c -@@ -81,10 +81,10 @@ void inet_twsk_put(struct inet_timewait_sock *tw) - } - EXPORT_SYMBOL_GPL(inet_twsk_put); - --static void inet_twsk_add_node_tail_rcu(struct inet_timewait_sock *tw, -- struct hlist_nulls_head *list) -+static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw, -+ struct hlist_nulls_head *list) - { -- hlist_nulls_add_tail_rcu(&tw->tw_node, list); -+ hlist_nulls_add_head_rcu(&tw->tw_node, list); - } - - static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw, -@@ -120,7 +120,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, - - spin_lock(lock); - -- inet_twsk_add_node_tail_rcu(tw, &ehead->chain); -+ inet_twsk_add_node_rcu(tw, &ehead->chain); - - /* Step 3: Remove SK from hash chain */ - if (__sk_nulls_del_node_init_rcu(sk)) -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index fdf2ddc4864df..647cb664c2ad0 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -3066,18 +3066,18 @@ static int do_tcp_setsockopt(struct sock *sk, int level, - - case TCP_LINGER2: - if (val < 0) -- tp->linger2 = -1; -- else if (val > net->ipv4.sysctl_tcp_fin_timeout / HZ) -- tp->linger2 = 0; -+ WRITE_ONCE(tp->linger2, -1); -+ else if (val > TCP_FIN_TIMEOUT_MAX / HZ) -+ WRITE_ONCE(tp->linger2, TCP_FIN_TIMEOUT_MAX); - else -- tp->linger2 = val * HZ; -+ WRITE_ONCE(tp->linger2, val * HZ); - break; - - case TCP_DEFER_ACCEPT: - /* Translate value in seconds to number of retransmits */ -- icsk->icsk_accept_queue.rskq_defer_accept = -- secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ, -- TCP_RTO_MAX / HZ); -+ WRITE_ONCE(icsk->icsk_accept_queue.rskq_defer_accept, -+ secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ, -+ TCP_RTO_MAX / HZ)); - break; - - case TCP_WINDOW_CLAMP: -@@ -3165,7 +3165,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, - err = tcp_repair_set_window(tp, optval, optlen); - break; - case TCP_NOTSENT_LOWAT: -- tp->notsent_lowat = val; -+ WRITE_ONCE(tp->notsent_lowat, val); - sk->sk_write_space(sk); - break; - case TCP_INQ: -@@ -3177,7 +3177,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, - case TCP_TX_DELAY: - if (val) - tcp_enable_tx_delay(); -- tp->tcp_tx_delay = val; -+ WRITE_ONCE(tp->tcp_tx_delay, val); - break; - default: - err = -ENOPROTOOPT; -@@ -3476,13 +3476,14 @@ static int do_tcp_getsockopt(struct sock *sk, int level, - val = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_syn_retries; - break; - case TCP_LINGER2: -- val = tp->linger2; -+ val = READ_ONCE(tp->linger2); - if (val >= 0) - val = (val ? : READ_ONCE(net->ipv4.sysctl_tcp_fin_timeout)) / HZ; - break; - case TCP_DEFER_ACCEPT: -- val = retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept, -- TCP_TIMEOUT_INIT / HZ, TCP_RTO_MAX / HZ); -+ val = READ_ONCE(icsk->icsk_accept_queue.rskq_defer_accept); -+ val = retrans_to_secs(val, TCP_TIMEOUT_INIT / HZ, -+ TCP_RTO_MAX / HZ); - break; - case TCP_WINDOW_CLAMP: - val = tp->window_clamp; -@@ -3622,7 +3623,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level, - break; - - case TCP_FASTOPEN: -- val = icsk->icsk_accept_queue.fastopenq.max_qlen; -+ val = READ_ONCE(icsk->icsk_accept_queue.fastopenq.max_qlen); - break; - - case TCP_FASTOPEN_CONNECT: -@@ -3634,14 +3635,14 @@ static int do_tcp_getsockopt(struct sock *sk, int level, - break; - - case TCP_TX_DELAY: -- val = tp->tcp_tx_delay; -+ val = READ_ONCE(tp->tcp_tx_delay); - break; - - case TCP_TIMESTAMP: - val = tcp_time_stamp_raw() + tp->tsoffset; - break; - case TCP_NOTSENT_LOWAT: -- val = tp->notsent_lowat; -+ val = READ_ONCE(tp->notsent_lowat); - break; - case TCP_INQ: - val = tp->recvmsg_inq; -diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c -index 21705b2ddaffa..35088cd30840d 100644 ---- a/net/ipv4/tcp_fastopen.c -+++ b/net/ipv4/tcp_fastopen.c -@@ -312,6 +312,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, - static bool tcp_fastopen_queue_check(struct sock *sk) - { - struct fastopen_queue *fastopenq; -+ int max_qlen; - - /* Make sure the listener has enabled fastopen, and we don't - * exceed the max # of pending TFO requests allowed before trying -@@ -324,10 +325,11 @@ static bool tcp_fastopen_queue_check(struct sock *sk) - * temporarily vs a server not supporting Fast Open at all. - */ - fastopenq = &inet_csk(sk)->icsk_accept_queue.fastopenq; -- if (fastopenq->max_qlen == 0) -+ max_qlen = READ_ONCE(fastopenq->max_qlen); -+ if (max_qlen == 0) - return false; - -- if (fastopenq->qlen >= fastopenq->max_qlen) { -+ if (fastopenq->qlen >= max_qlen) { - struct request_sock *req1; - spin_lock(&fastopenq->lock); - req1 = fastopenq->rskq_rst_head; -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 44398317f033a..8308c3c3a6e46 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -3445,8 +3445,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32 - static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, - u32 *last_oow_ack_time) - { -- if (*last_oow_ack_time) { -- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time); -+ /* Paired with the WRITE_ONCE() in this function. */ -+ u32 val = READ_ONCE(*last_oow_ack_time); -+ -+ if (val) { -+ s32 elapsed = (s32)(tcp_jiffies32 - val); - - if (0 <= elapsed && - elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) { -@@ -3455,7 +3458,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, - } - } - -- *last_oow_ack_time = tcp_jiffies32; -+ /* Paired with the prior READ_ONCE() and with itself, -+ * as we might be lockless. -+ */ -+ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32); - - return false; /* not rate-limited: go ahead, send dupack now! */ - } -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index a0123760fb2c7..46e3c939958bb 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -313,9 +313,8 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp) - static void addrconf_mod_rs_timer(struct inet6_dev *idev, - unsigned long when) - { -- if (!timer_pending(&idev->rs_timer)) -+ if (!mod_timer(&idev->rs_timer, jiffies + when)) - in6_dev_hold(idev); -- mod_timer(&idev->rs_timer, jiffies + when); - } - - static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp, -diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c -index 3db10cae7b178..169467b5c98a6 100644 ---- a/net/ipv6/icmp.c -+++ b/net/ipv6/icmp.c -@@ -410,7 +410,10 @@ static struct net_device *icmp6_dev(const struct sk_buff *skb) - if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) { - const struct rt6_info *rt6 = skb_rt6_info(skb); - -- if (rt6) -+ /* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.), -+ * and ip6_null_entry could be set to skb if no route is found. -+ */ -+ if (rt6 && rt6->rt6i_idev) - dev = rt6->rt6i_idev->dev; - } - -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index 0977137b00dc4..2d34bd98fccea 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -941,7 +941,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, - goto tx_err; - - if (skb->len > dev->mtu + dev->hard_header_len) { -- pskb_trim(skb, dev->mtu + dev->hard_header_len); -+ if (pskb_trim(skb, dev->mtu + dev->hard_header_len)) -+ goto tx_err; - truncate = true; - } - -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 797d45ceb2c74..93eb622219756 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -87,7 +87,7 @@ static u32 udp6_ehashfn(const struct net *net, - fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret); - - return __inet6_ehashfn(lhash, lport, fhash, fport, -- udp_ipv6_hash_secret + net_hash_mix(net)); -+ udp6_ehash_secret + net_hash_mix(net)); - } - - int udp_v6_get_port(struct sock *sk, unsigned short snum) -diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c -index 82cb93f66b9bd..f9e801cc50f5e 100644 ---- a/net/llc/llc_input.c -+++ b/net/llc/llc_input.c -@@ -162,9 +162,6 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev, - void (*sta_handler)(struct sk_buff *skb); - void (*sap_handler)(struct llc_sap *sap, struct sk_buff *skb); - -- if (!net_eq(dev_net(dev), &init_net)) -- goto drop; -- - /* - * When the interface is in promisc. mode, drop all the crap that it - * receives, do not try to analyse it. -diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c -index e3c14f8890a89..1cf143f5df2e9 100644 ---- a/net/netfilter/ipset/ip_set_core.c -+++ b/net/netfilter/ipset/ip_set_core.c -@@ -811,20 +811,9 @@ static struct nlmsghdr * - start_msg(struct sk_buff *skb, u32 portid, u32 seq, unsigned int flags, - enum ipset_cmd cmd) - { -- struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; -- -- nlh = nlmsg_put(skb, portid, seq, nfnl_msg_type(NFNL_SUBSYS_IPSET, cmd), -- sizeof(*nfmsg), flags); -- if (!nlh) -- return NULL; -- -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = NFPROTO_IPV4; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- -- return nlh; -+ return nfnl_msg_put(skb, portid, seq, -+ nfnl_msg_type(NFNL_SUBSYS_IPSET, cmd), flags, -+ NFPROTO_IPV4, NFNETLINK_V0, 0); - } - - /* Create a set */ -diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c -index 118f415928aef..32cc91f5ba99f 100644 ---- a/net/netfilter/nf_conntrack_helper.c -+++ b/net/netfilter/nf_conntrack_helper.c -@@ -404,6 +404,9 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me) - BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES); - BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1); - -+ if (!nf_ct_helper_hash) -+ return -ENOENT; -+ - if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) - return -EINVAL; - -@@ -587,4 +590,5 @@ void nf_conntrack_helper_fini(void) - { - nf_ct_extend_unregister(&helper_extend); - kvfree(nf_ct_helper_hash); -+ nf_ct_helper_hash = NULL; - } -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index 4328d10ad1bc3..45d02185f4b92 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -515,20 +515,15 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, - { - const struct nf_conntrack_zone *zone; - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - struct nlattr *nest_parms; - unsigned int flags = portid ? NLM_F_MULTI : 0, event; - - event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_NEW); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, nf_ct_l3num(ct), -+ NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = nf_ct_l3num(ct); -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - zone = nf_ct_zone(ct); - - nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); -@@ -685,7 +680,6 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item) - const struct nf_conntrack_zone *zone; - struct net *net; - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - struct nlattr *nest_parms; - struct nf_conn *ct = item->ct; - struct sk_buff *skb; -@@ -715,15 +709,11 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item) - goto errout; - - type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, type); -- nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, nf_ct_l3num(ct), -+ NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = nf_ct_l3num(ct); -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - zone = nf_ct_zone(ct); - - nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); -@@ -2200,20 +2190,15 @@ ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq, - __u16 cpu, const struct ip_conntrack_stat *st) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - unsigned int flags = portid ? NLM_F_MULTI : 0, event; - - event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, - IPCTNL_MSG_CT_GET_STATS_CPU); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, -+ NFNETLINK_V0, htons(cpu)); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = AF_UNSPEC; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(cpu); -- - if (nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) || - nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) || - nla_put_be32(skb, CTA_STATS_IGNORE, htonl(st->ignore)) || -@@ -2284,20 +2269,15 @@ ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, - struct net *net) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - unsigned int flags = portid ? NLM_F_MULTI : 0, event; - unsigned int nr_conntracks = atomic_read(&net->ct.count); - - event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_GET_STATS); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, -+ NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = AF_UNSPEC; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks))) - goto nla_put_failure; - -@@ -2803,19 +2783,14 @@ ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq, - int event, const struct nf_conntrack_expect *exp) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - unsigned int flags = portid ? NLM_F_MULTI : 0; - - event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, -+ exp->tuple.src.l3num, NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = exp->tuple.src.l3num; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - if (ctnetlink_exp_dump_expect(skb, exp) < 0) - goto nla_put_failure; - -@@ -2835,7 +2810,6 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item) - struct nf_conntrack_expect *exp = item->exp; - struct net *net = nf_ct_exp_net(exp); - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - struct sk_buff *skb; - unsigned int type, group; - int flags = 0; -@@ -2858,15 +2832,11 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item) - goto errout; - - type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, type); -- nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, -+ exp->tuple.src.l3num, NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = exp->tuple.src.l3num; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - if (ctnetlink_exp_dump_expect(skb, exp) < 0) - goto nla_put_failure; - -@@ -3436,20 +3406,15 @@ ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu, - const struct ip_conntrack_stat *st) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - unsigned int flags = portid ? NLM_F_MULTI : 0, event; - - event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, - IPCTNL_MSG_EXP_GET_STATS_CPU); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, -+ NFNETLINK_V0, htons(cpu)); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = AF_UNSPEC; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(cpu); -- - if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) || - nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) || - nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete))) -diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c -index b3f4a334f9d78..67b8dedef2935 100644 ---- a/net/netfilter/nf_conntrack_proto_dccp.c -+++ b/net/netfilter/nf_conntrack_proto_dccp.c -@@ -430,9 +430,19 @@ static bool dccp_error(const struct dccp_hdr *dh, - struct sk_buff *skb, unsigned int dataoff, - const struct nf_hook_state *state) - { -+ static const unsigned long require_seq48 = 1 << DCCP_PKT_REQUEST | -+ 1 << DCCP_PKT_RESPONSE | -+ 1 << DCCP_PKT_CLOSEREQ | -+ 1 << DCCP_PKT_CLOSE | -+ 1 << DCCP_PKT_RESET | -+ 1 << DCCP_PKT_SYNC | -+ 1 << DCCP_PKT_SYNCACK; - unsigned int dccp_len = skb->len - dataoff; - unsigned int cscov; - const char *msg; -+ u8 type; -+ -+ BUILD_BUG_ON(DCCP_PKT_INVALID >= BITS_PER_LONG); - - if (dh->dccph_doff * 4 < sizeof(struct dccp_hdr) || - dh->dccph_doff * 4 > dccp_len) { -@@ -457,10 +467,17 @@ static bool dccp_error(const struct dccp_hdr *dh, - goto out_invalid; - } - -- if (dh->dccph_type >= DCCP_PKT_INVALID) { -+ type = dh->dccph_type; -+ if (type >= DCCP_PKT_INVALID) { - msg = "nf_ct_dccp: reserved packet type "; - goto out_invalid; - } -+ -+ if (test_bit(type, &require_seq48) && !dh->dccph_x) { -+ msg = "nf_ct_dccp: type lacks 48bit sequence numbers"; -+ goto out_invalid; -+ } -+ - return false; - out_invalid: - nf_l4proto_log_invalid(skb, state->net, state->pf, -@@ -468,24 +485,53 @@ out_invalid: - return true; - } - -+struct nf_conntrack_dccp_buf { -+ struct dccp_hdr dh; /* generic header part */ -+ struct dccp_hdr_ext ext; /* optional depending dh->dccph_x */ -+ union { /* depends on header type */ -+ struct dccp_hdr_ack_bits ack; -+ struct dccp_hdr_request req; -+ struct dccp_hdr_response response; -+ struct dccp_hdr_reset rst; -+ } u; -+}; -+ -+static struct dccp_hdr * -+dccp_header_pointer(const struct sk_buff *skb, int offset, const struct dccp_hdr *dh, -+ struct nf_conntrack_dccp_buf *buf) -+{ -+ unsigned int hdrlen = __dccp_hdr_len(dh); -+ -+ if (hdrlen > sizeof(*buf)) -+ return NULL; -+ -+ return skb_header_pointer(skb, offset, hdrlen, buf); -+} -+ - int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, - unsigned int dataoff, - enum ip_conntrack_info ctinfo, - const struct nf_hook_state *state) - { - enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); -- struct dccp_hdr _dh, *dh; -+ struct nf_conntrack_dccp_buf _dh; - u_int8_t type, old_state, new_state; - enum ct_dccp_roles role; - unsigned int *timeouts; -+ struct dccp_hdr *dh; - -- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); -+ dh = skb_header_pointer(skb, dataoff, sizeof(*dh), &_dh.dh); - if (!dh) - return NF_DROP; - - if (dccp_error(dh, skb, dataoff, state)) - return -NF_ACCEPT; - -+ /* pull again, including possible 48 bit sequences and subtype header */ -+ dh = dccp_header_pointer(skb, dataoff, dh, &_dh); -+ if (!dh) -+ return NF_DROP; -+ - type = dh->dccph_type; - if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh)) - return -NF_ACCEPT; -diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c -index 78fd9122b70c7..751df19fe0f8a 100644 ---- a/net/netfilter/nf_conntrack_sip.c -+++ b/net/netfilter/nf_conntrack_sip.c -@@ -611,7 +611,7 @@ int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr, - start += strlen(name); - *val = simple_strtoul(start, &end, 0); - if (start == end) -- return 0; -+ return -1; - if (matchoff && matchlen) { - *matchoff = start - dptr; - *matchlen = end - start; -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 914fbd9ecef96..7d22bc8aa2787 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -20,10 +20,13 @@ - #include - #include - #include -+#include - #include - - #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-")) - -+unsigned int nf_tables_net_id __read_mostly; -+ - static LIST_HEAD(nf_tables_expressions); - static LIST_HEAD(nf_tables_objects); - static LIST_HEAD(nf_tables_flowtables); -@@ -67,7 +70,9 @@ static const struct rhashtable_params nft_objname_ht_params = { - - static void nft_validate_state_update(struct net *net, u8 new_validate_state) - { -- switch (net->nft.validate_state) { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); -+ -+ switch (nft_net->validate_state) { - case NFT_VALIDATE_SKIP: - WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO); - break; -@@ -78,7 +83,7 @@ static void nft_validate_state_update(struct net *net, u8 new_validate_state) - return; - } - -- net->nft.validate_state = new_validate_state; -+ nft_net->validate_state = new_validate_state; - } - static void nf_tables_trans_destroy_work(struct work_struct *w); - static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work); -@@ -114,6 +119,7 @@ static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx, - return NULL; - - INIT_LIST_HEAD(&trans->list); -+ INIT_LIST_HEAD(&trans->binding_list); - trans->msg_type = msg_type; - trans->ctx = *ctx; - -@@ -126,34 +132,67 @@ static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx, - return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL); - } - --static void nft_trans_destroy(struct nft_trans *trans) -+static void nft_trans_list_del(struct nft_trans *trans) - { - list_del(&trans->list); -+ list_del(&trans->binding_list); -+} -+ -+static void nft_trans_destroy(struct nft_trans *trans) -+{ -+ nft_trans_list_del(trans); - kfree(trans); - } - --static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) -+static void __nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set, -+ bool bind) - { -+ struct nftables_pernet *nft_net; - struct net *net = ctx->net; - struct nft_trans *trans; - - if (!nft_set_is_anonymous(set)) - return; - -- list_for_each_entry_reverse(trans, &net->nft.commit_list, list) { -+ nft_net = net_generic(net, nf_tables_net_id); -+ list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { - switch (trans->msg_type) { - case NFT_MSG_NEWSET: - if (nft_trans_set(trans) == set) -- nft_trans_set_bound(trans) = true; -+ nft_trans_set_bound(trans) = bind; - break; - case NFT_MSG_NEWSETELEM: - if (nft_trans_elem_set(trans) == set) -- nft_trans_elem_set_bound(trans) = true; -+ nft_trans_elem_set_bound(trans) = bind; - break; - } - } - } - -+static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) -+{ -+ return __nft_set_trans_bind(ctx, set, true); -+} -+ -+static void nft_set_trans_unbind(const struct nft_ctx *ctx, struct nft_set *set) -+{ -+ return __nft_set_trans_bind(ctx, set, false); -+} -+ -+static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans) -+{ -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); -+ -+ switch (trans->msg_type) { -+ case NFT_MSG_NEWSET: -+ if (nft_set_is_anonymous(nft_trans_set(trans))) -+ list_add_tail(&trans->binding_list, &nft_net->binding_list); -+ break; -+ } -+ -+ list_add_tail(&trans->list, &nft_net->commit_list); -+} -+ - static int nf_tables_register_hook(struct net *net, - const struct nft_table *table, - struct nft_chain *chain) -@@ -204,7 +243,7 @@ static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) - if (msg_type == NFT_MSG_NEWTABLE) - nft_activate_next(ctx->net, ctx->table); - -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - return 0; - } - -@@ -231,7 +270,7 @@ static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) - if (msg_type == NFT_MSG_NEWCHAIN) - nft_activate_next(ctx->net, ctx->chain); - -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - return trans; - } - -@@ -304,7 +343,7 @@ static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type, - ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID])); - } - nft_trans_rule(trans) = rule; -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - - return trans; - } -@@ -359,7 +398,7 @@ static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, - nft_activate_next(ctx->net, set); - } - nft_trans_set(trans) = set; -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - - return 0; - } -@@ -391,7 +430,7 @@ static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type, - nft_activate_next(ctx->net, obj); - - nft_trans_obj(trans) = obj; -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - - return 0; - } -@@ -424,7 +463,7 @@ static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type, - nft_activate_next(ctx->net, flowtable); - - nft_trans_flowtable(trans) = flowtable; -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - - return 0; - } -@@ -452,13 +491,15 @@ static struct nft_table *nft_table_lookup(const struct net *net, - const struct nlattr *nla, - u8 family, u8 genmask) - { -+ struct nftables_pernet *nft_net; - struct nft_table *table; - - if (nla == NULL) - return ERR_PTR(-EINVAL); - -- list_for_each_entry_rcu(table, &net->nft.tables, list, -- lockdep_is_held(&net->nft.commit_mutex)) { -+ nft_net = net_generic(net, nf_tables_net_id); -+ list_for_each_entry_rcu(table, &nft_net->tables, list, -+ lockdep_is_held(&nft_net->commit_mutex)) { - if (!nla_strcmp(nla, table->name) && - table->family == family && - nft_active_genmask(table, genmask)) -@@ -472,9 +513,11 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net, - const struct nlattr *nla, - u8 genmask) - { -+ struct nftables_pernet *nft_net; - struct nft_table *table; - -- list_for_each_entry(table, &net->nft.tables, list) { -+ nft_net = net_generic(net, nf_tables_net_id); -+ list_for_each_entry(table, &nft_net->tables, list) { - if (be64_to_cpu(nla_get_be64(nla)) == table->handle && - nft_active_genmask(table, genmask)) - return table; -@@ -526,6 +569,7 @@ struct nft_module_request { - static int nft_request_module(struct net *net, const char *fmt, ...) - { - char module_name[MODULE_NAME_LEN]; -+ struct nftables_pernet *nft_net; - struct nft_module_request *req; - va_list args; - int ret; -@@ -536,7 +580,8 @@ static int nft_request_module(struct net *net, const char *fmt, ...) - if (ret >= MODULE_NAME_LEN) - return 0; - -- list_for_each_entry(req, &net->nft.module_list, list) { -+ nft_net = net_generic(net, nf_tables_net_id); -+ list_for_each_entry(req, &nft_net->module_list, list) { - if (!strcmp(req->module, module_name)) { - if (req->done) - return 0; -@@ -552,7 +597,7 @@ static int nft_request_module(struct net *net, const char *fmt, ...) - - req->done = false; - strlcpy(req->module, module_name, MODULE_NAME_LEN); -- list_add_tail(&req->list, &net->nft.module_list); -+ list_add_tail(&req->list, &nft_net->module_list); - - return -EAGAIN; - } -@@ -588,6 +633,13 @@ nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla, - return ERR_PTR(-ENOENT); - } - -+static __be16 nft_base_seq(const struct net *net) -+{ -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); -+ -+ return htons(nft_net->base_seq & 0xffff); -+} -+ - static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { - [NFTA_TABLE_NAME] = { .type = NLA_STRING, - .len = NFT_TABLE_MAXNAMELEN - 1 }, -@@ -600,18 +652,13 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, - int family, const struct nft_table *table) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - - event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, -+ NFNETLINK_V0, nft_base_seq(net)); -+ if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); -- - if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || - nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) || - nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || -@@ -658,15 +705,17 @@ static int nf_tables_dump_tables(struct sk_buff *skb, - struct netlink_callback *cb) - { - const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); -+ struct nftables_pernet *nft_net; - const struct nft_table *table; - unsigned int idx = 0, s_idx = cb->args[0]; - struct net *net = sock_net(skb->sk); - int family = nfmsg->nfgen_family; - - rcu_read_lock(); -- cb->seq = net->nft.base_seq; -+ nft_net = net_generic(net, nf_tables_net_id); -+ cb->seq = nft_net->base_seq; - -- list_for_each_entry_rcu(table, &net->nft.tables, list) { -+ list_for_each_entry_rcu(table, &nft_net->tables, list) { - if (family != NFPROTO_UNSPEC && family != table->family) - continue; - -@@ -770,7 +819,7 @@ static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) - if (cnt && i++ == cnt) - break; - -- nf_unregister_net_hook(net, &nft_base_chain(chain)->ops); -+ nf_tables_unregister_hook(net, table, chain); - } - } - -@@ -785,7 +834,7 @@ static int nf_tables_table_enable(struct net *net, struct nft_table *table) - if (!nft_is_base_chain(chain)) - continue; - -- err = nf_register_net_hook(net, &nft_base_chain(chain)->ops); -+ err = nf_tables_register_hook(net, table, chain); - if (err < 0) - goto err; - -@@ -829,17 +878,18 @@ static int nf_tables_updtable(struct nft_ctx *ctx) - nft_trans_table_enable(trans) = false; - } else if (!(flags & NFT_TABLE_F_DORMANT) && - ctx->table->flags & NFT_TABLE_F_DORMANT) { -+ ctx->table->flags &= ~NFT_TABLE_F_DORMANT; - ret = nf_tables_table_enable(ctx->net, ctx->table); -- if (ret >= 0) { -- ctx->table->flags &= ~NFT_TABLE_F_DORMANT; -+ if (ret >= 0) - nft_trans_table_enable(trans) = true; -- } -+ else -+ ctx->table->flags |= NFT_TABLE_F_DORMANT; - } - if (ret < 0) - goto err; - - nft_trans_table_update(trans) = true; -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - return 0; - err: - nft_trans_destroy(trans); -@@ -902,6 +952,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk, - const struct nlattr * const nla[], - struct netlink_ext_ack *extack) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - const struct nfgenmsg *nfmsg = nlmsg_data(nlh); - u8 genmask = nft_genmask_next(net); - int family = nfmsg->nfgen_family; -@@ -911,7 +962,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk, - struct nft_ctx ctx; - int err; - -- lockdep_assert_held(&net->nft.commit_mutex); -+ lockdep_assert_held(&nft_net->commit_mutex); - attr = nla[NFTA_TABLE_NAME]; - table = nft_table_lookup(net, attr, family, genmask); - if (IS_ERR(table)) { -@@ -961,7 +1012,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk, - if (err < 0) - goto err_trans; - -- list_add_tail_rcu(&table->list, &net->nft.tables); -+ list_add_tail_rcu(&table->list, &nft_net->tables); - return 0; - err_trans: - rhltable_destroy(&table->chains_ht); -@@ -1041,11 +1092,12 @@ out: - - static int nft_flush(struct nft_ctx *ctx, int family) - { -+ struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id); - struct nft_table *table, *nt; - const struct nlattr * const *nla = ctx->nla; - int err = 0; - -- list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) { -+ list_for_each_entry_safe(table, nt, &nft_net->tables, list) { - if (family != AF_UNSPEC && table->family != family) - continue; - -@@ -1159,7 +1211,9 @@ nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask) - static bool lockdep_commit_lock_is_held(const struct net *net) - { - #ifdef CONFIG_PROVE_LOCKING -- return lockdep_is_held(&net->nft.commit_mutex); -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); -+ -+ return lockdep_is_held(&nft_net->commit_mutex); - #else - return true; - #endif -@@ -1263,18 +1317,13 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, - const struct nft_chain *chain) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - - event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, -+ NFNETLINK_V0, nft_base_seq(net)); -+ if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); -- - if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name)) - goto nla_put_failure; - if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle), -@@ -1367,11 +1416,13 @@ static int nf_tables_dump_chains(struct sk_buff *skb, - unsigned int idx = 0, s_idx = cb->args[0]; - struct net *net = sock_net(skb->sk); - int family = nfmsg->nfgen_family; -+ struct nftables_pernet *nft_net; - - rcu_read_lock(); -- cb->seq = net->nft.base_seq; -+ nft_net = net_generic(net, nf_tables_net_id); -+ cb->seq = nft_net->base_seq; - -- list_for_each_entry_rcu(table, &net->nft.tables, list) { -+ list_for_each_entry_rcu(table, &nft_net->tables, list) { - if (family != NFPROTO_UNSPEC && family != table->family) - continue; - -@@ -1557,12 +1608,13 @@ static int nft_chain_parse_hook(struct net *net, - struct nft_chain_hook *hook, u8 family, - bool autoload) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nlattr *ha[NFTA_HOOK_MAX + 1]; - const struct nft_chain_type *type; - struct net_device *dev; - int err; - -- lockdep_assert_held(&net->nft.commit_mutex); -+ lockdep_assert_held(&nft_net->commit_mutex); - lockdep_nfnl_nft_mutex_not_held(); - - err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX, -@@ -1847,6 +1899,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, - - if (nla[NFTA_CHAIN_HANDLE] && - nla[NFTA_CHAIN_NAME]) { -+ struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id); - struct nft_trans *tmp; - char *name; - -@@ -1856,7 +1909,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, - goto err; - - err = -EEXIST; -- list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) { -+ list_for_each_entry(tmp, &nft_net->commit_list, list) { - if (tmp->msg_type == NFT_MSG_NEWCHAIN && - tmp->ctx.table == table && - nft_trans_chain_update(tmp) && -@@ -1869,7 +1922,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, - - nft_trans_chain_name(trans) = name; - } -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - - return 0; - err: -@@ -1883,6 +1936,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk, - const struct nlattr * const nla[], - struct netlink_ext_ack *extack) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - const struct nfgenmsg *nfmsg = nlmsg_data(nlh); - u8 genmask = nft_genmask_next(net); - int family = nfmsg->nfgen_family; -@@ -1894,7 +1948,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk, - u64 handle = 0; - u32 flags = 0; - -- lockdep_assert_held(&net->nft.commit_mutex); -+ lockdep_assert_held(&nft_net->commit_mutex); - - table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask); - if (IS_ERR(table)) { -@@ -2353,20 +2407,15 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, - const struct nft_rule *prule) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - const struct nft_expr *expr, *next; - struct nlattr *list; - u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); - -- nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0, -+ nft_base_seq(net)); -+ if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); -- - if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) - goto nla_put_failure; - if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) -@@ -2487,11 +2536,13 @@ static int nf_tables_dump_rules(struct sk_buff *skb, - unsigned int idx = 0; - struct net *net = sock_net(skb->sk); - int family = nfmsg->nfgen_family; -+ struct nftables_pernet *nft_net; - - rcu_read_lock(); -- cb->seq = net->nft.base_seq; -+ nft_net = net_generic(net, nf_tables_net_id); -+ cb->seq = nft_net->base_seq; - -- list_for_each_entry_rcu(table, &net->nft.tables, list) { -+ list_for_each_entry_rcu(table, &nft_net->tables, list) { - if (family != NFPROTO_UNSPEC && family != table->family) - continue; - -@@ -2708,6 +2759,8 @@ static int nft_table_validate(struct net *net, const struct nft_table *table) - err = nft_chain_validate(&ctx, chain); - if (err < 0) - return err; -+ -+ cond_resched(); - } - - return 0; -@@ -2724,6 +2777,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, - const struct nlattr * const nla[], - struct netlink_ext_ack *extack) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - const struct nfgenmsg *nfmsg = nlmsg_data(nlh); - u8 genmask = nft_genmask_next(net); - struct nft_expr_info *info = NULL; -@@ -2741,7 +2795,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, - int err, rem; - u64 handle, pos_handle; - -- lockdep_assert_held(&net->nft.commit_mutex); -+ lockdep_assert_held(&nft_net->commit_mutex); - - table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask); - if (IS_ERR(table)) { -@@ -2896,7 +2950,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, - kvfree(info); - chain->use++; - -- if (net->nft.validate_state == NFT_VALIDATE_DO) -+ if (nft_net->validate_state == NFT_VALIDATE_DO) - return nft_table_validate(net, table); - - if (chain->flags & NFT_CHAIN_HW_OFFLOAD) { -@@ -2909,7 +2963,8 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, - - return 0; - err2: -- nf_tables_rule_release(&ctx, rule); -+ nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR); -+ nf_tables_rule_destroy(&ctx, rule); - err1: - for (i = 0; i < n; i++) { - if (info[i].ops) { -@@ -2926,10 +2981,11 @@ static struct nft_rule *nft_rule_lookup_byid(const struct net *net, - const struct nft_chain *chain, - const struct nlattr *nla) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - u32 id = ntohl(nla_get_be32(nla)); - struct nft_trans *trans; - -- list_for_each_entry(trans, &net->nft.commit_list, list) { -+ list_for_each_entry(trans, &nft_net->commit_list, list) { - struct nft_rule *rule = nft_trans_rule(trans); - - if (trans->msg_type == NFT_MSG_NEWRULE && -@@ -3048,12 +3104,13 @@ nft_select_set_ops(const struct nft_ctx *ctx, - const struct nft_set_desc *desc, - enum nft_set_policies policy) - { -+ struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id); - const struct nft_set_ops *ops, *bops; - struct nft_set_estimate est, best; - const struct nft_set_type *type; - u32 flags = 0; - -- lockdep_assert_held(&ctx->net->nft.commit_mutex); -+ lockdep_assert_held(&nft_net->commit_mutex); - lockdep_nfnl_nft_mutex_not_held(); - #ifdef CONFIG_MODULES - if (list_empty(&nf_tables_set_types)) { -@@ -3198,10 +3255,11 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, - const struct nft_table *table, - const struct nlattr *nla, u8 genmask) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_trans *trans; - u32 id = ntohl(nla_get_be32(nla)); - -- list_for_each_entry(trans, &net->nft.commit_list, list) { -+ list_for_each_entry(trans, &nft_net->commit_list, list) { - if (trans->msg_type == NFT_MSG_NEWSET) { - struct nft_set *set = nft_trans_set(trans); - -@@ -3309,23 +3367,17 @@ __be64 nf_jiffies64_to_msecs(u64 input) - static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, - const struct nft_set *set, u16 event, u16 flags) - { -- struct nfgenmsg *nfmsg; - struct nlmsghdr *nlh; - struct nlattr *desc; - u32 portid = ctx->portid; - u32 seq = ctx->seq; - - event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), -- flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, -+ NFNETLINK_V0, nft_base_seq(ctx->net)); -+ if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = ctx->family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); -- - if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) - goto nla_put_failure; - if (nla_put_string(skb, NFTA_SET_NAME, set->name)) -@@ -3421,14 +3473,16 @@ static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb) - struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; - struct net *net = sock_net(skb->sk); - struct nft_ctx *ctx = cb->data, ctx_set; -+ struct nftables_pernet *nft_net; - - if (cb->args[1]) - return skb->len; - - rcu_read_lock(); -- cb->seq = net->nft.base_seq; -+ nft_net = net_generic(net, nf_tables_net_id); -+ cb->seq = nft_net->base_seq; - -- list_for_each_entry_rcu(table, &net->nft.tables, list) { -+ list_for_each_entry_rcu(table, &nft_net->tables, list) { - if (ctx->family != NFPROTO_UNSPEC && - ctx->family != table->family) - continue; -@@ -3929,6 +3983,15 @@ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, - enum nft_trans_phase phase) - { - switch (phase) { -+ case NFT_TRANS_PREPARE_ERROR: -+ nft_set_trans_unbind(ctx, set); -+ if (nft_set_is_anonymous(set)) -+ nft_deactivate_next(ctx->net, set); -+ else -+ list_del_rcu(&binding->list); -+ -+ set->use--; -+ break; - case NFT_TRANS_PREPARE: - if (nft_set_is_anonymous(set)) - nft_deactivate_next(ctx->net, set); -@@ -4134,18 +4197,19 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) - { - struct nft_set_dump_ctx *dump_ctx = cb->data; - struct net *net = sock_net(skb->sk); -+ struct nftables_pernet *nft_net; - struct nft_table *table; - struct nft_set *set; - struct nft_set_dump_args args; - bool set_found = false; -- struct nfgenmsg *nfmsg; - struct nlmsghdr *nlh; - struct nlattr *nest; - u32 portid, seq; - int event; - - rcu_read_lock(); -- list_for_each_entry_rcu(table, &net->nft.tables, list) { -+ nft_net = net_generic(net, nf_tables_net_id); -+ list_for_each_entry_rcu(table, &nft_net->tables, list) { - if (dump_ctx->ctx.family != NFPROTO_UNSPEC && - dump_ctx->ctx.family != table->family) - continue; -@@ -4171,16 +4235,11 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) - portid = NETLINK_CB(cb->skb).portid; - seq = cb->nlh->nlmsg_seq; - -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), -- NLM_F_MULTI); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI, -+ table->family, NFNETLINK_V0, nft_base_seq(net)); -+ if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = table->family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); -- - if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) - goto nla_put_failure; - if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) -@@ -4237,22 +4296,16 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb, - const struct nft_set *set, - const struct nft_set_elem *elem) - { -- struct nfgenmsg *nfmsg; - struct nlmsghdr *nlh; - struct nlattr *nest; - int err; - - event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), -- flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, -+ NFNETLINK_V0, nft_base_seq(ctx->net)); -+ if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = ctx->family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); -- - if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) - goto nla_put_failure; - if (nla_put_string(skb, NFTA_SET_NAME, set->name)) -@@ -4760,7 +4813,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, - } - - nft_trans_elem(trans) = elem; -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - return 0; - - err6: -@@ -4785,6 +4838,7 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk, - const struct nlattr * const nla[], - struct netlink_ext_ack *extack) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - u8 genmask = nft_genmask_next(net); - const struct nlattr *attr; - struct nft_set *set; -@@ -4814,7 +4868,7 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk, - return err; - } - -- if (net->nft.validate_state == NFT_VALIDATE_DO) -+ if (nft_net->validate_state == NFT_VALIDATE_DO) - return nft_table_validate(net, ctx.table); - - return 0; -@@ -4927,7 +4981,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, - nft_set_elem_deactivate(ctx->net, set, &elem); - - nft_trans_elem(trans) = elem; -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - return 0; - - fail_ops: -@@ -4961,7 +5015,7 @@ static int nft_flush_set(const struct nft_ctx *ctx, - nft_set_elem_deactivate(ctx->net, set, elem); - nft_trans_elem_set(trans) = set; - nft_trans_elem(trans) = *elem; -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - - return 0; - err1: -@@ -5260,7 +5314,7 @@ static int nf_tables_updobj(const struct nft_ctx *ctx, - nft_trans_obj(trans) = obj; - nft_trans_obj_update(trans) = true; - nft_trans_obj_newobj(trans) = newobj; -- list_add_tail(&trans->list, &ctx->net->nft.commit_list); -+ nft_trans_commit_list_add_tail(ctx->net, trans); - - return 0; - -@@ -5371,19 +5425,14 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, - int family, const struct nft_table *table, - struct nft_object *obj, bool reset) - { -- struct nfgenmsg *nfmsg; - struct nlmsghdr *nlh; - - event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, -+ NFNETLINK_V0, nft_base_seq(net)); -+ if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); -- - if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || - nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) || - nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || -@@ -5414,6 +5463,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) - struct nft_obj_filter *filter = cb->data; - struct net *net = sock_net(skb->sk); - int family = nfmsg->nfgen_family; -+ struct nftables_pernet *nft_net; - struct nft_object *obj; - bool reset = false; - -@@ -5421,9 +5471,10 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) - reset = true; - - rcu_read_lock(); -- cb->seq = net->nft.base_seq; -+ nft_net = net_generic(net, nf_tables_net_id); -+ cb->seq = nft_net->base_seq; - -- list_for_each_entry_rcu(table, &net->nft.tables, list) { -+ list_for_each_entry_rcu(table, &nft_net->tables, list) { - if (family != NFPROTO_UNSPEC && family != table->family) - continue; - -@@ -5706,6 +5757,7 @@ void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx, - enum nft_trans_phase phase) - { - switch (phase) { -+ case NFT_TRANS_PREPARE_ERROR: - case NFT_TRANS_PREPARE: - case NFT_TRANS_ABORT: - case NFT_TRANS_RELEASE: -@@ -6046,20 +6098,15 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, - struct nft_flowtable *flowtable) - { - struct nlattr *nest, *nest_devs; -- struct nfgenmsg *nfmsg; - struct nlmsghdr *nlh; - int i; - - event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, -+ NFNETLINK_V0, nft_base_seq(net)); -+ if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); -- - if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || - nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || - nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || -@@ -6108,13 +6155,15 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb, - unsigned int idx = 0, s_idx = cb->args[0]; - struct net *net = sock_net(skb->sk); - int family = nfmsg->nfgen_family; -+ struct nftables_pernet *nft_net; - struct nft_flowtable *flowtable; - const struct nft_table *table; - - rcu_read_lock(); -- cb->seq = net->nft.base_seq; -+ nft_net = net_generic(net, nf_tables_net_id); -+ cb->seq = nft_net->base_seq; - -- list_for_each_entry_rcu(table, &net->nft.tables, list) { -+ list_for_each_entry_rcu(table, &nft_net->tables, list) { - if (family != NFPROTO_UNSPEC && family != table->family) - continue; - -@@ -6284,21 +6333,17 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) - static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, - u32 portid, u32 seq) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - char buf[TASK_COMM_LEN]; - int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN); - -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC, -+ NFNETLINK_V0, nft_base_seq(net)); -+ if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = AF_UNSPEC; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); -- -- if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) || -+ if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_net->base_seq)) || - nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || - nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current))) - goto nla_put_failure; -@@ -6331,6 +6376,7 @@ static int nf_tables_flowtable_event(struct notifier_block *this, - { - struct net_device *dev = netdev_notifier_info_to_dev(ptr); - struct nft_flowtable *flowtable; -+ struct nftables_pernet *nft_net; - struct nft_table *table; - struct net *net; - -@@ -6338,13 +6384,14 @@ static int nf_tables_flowtable_event(struct notifier_block *this, - return 0; - - net = dev_net(dev); -- mutex_lock(&net->nft.commit_mutex); -- list_for_each_entry(table, &net->nft.tables, list) { -+ nft_net = net_generic(net, nf_tables_net_id); -+ mutex_lock(&nft_net->commit_mutex); -+ list_for_each_entry(table, &nft_net->tables, list) { - list_for_each_entry(flowtable, &table->flowtables, list) { - nft_flowtable_event(event, dev, flowtable); - } - } -- mutex_unlock(&net->nft.commit_mutex); -+ mutex_unlock(&nft_net->commit_mutex); - - return NOTIFY_DONE; - } -@@ -6525,16 +6572,17 @@ static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { - - static int nf_tables_validate(struct net *net) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_table *table; - -- switch (net->nft.validate_state) { -+ switch (nft_net->validate_state) { - case NFT_VALIDATE_SKIP: - break; - case NFT_VALIDATE_NEED: - nft_validate_state_update(net, NFT_VALIDATE_DO); - /* fall through */ - case NFT_VALIDATE_DO: -- list_for_each_entry(table, &net->nft.tables, list) { -+ list_for_each_entry(table, &nft_net->tables, list) { - if (nft_table_validate(net, table) < 0) - return -EAGAIN; - } -@@ -6664,7 +6712,7 @@ static void nf_tables_trans_destroy_work(struct work_struct *w) - synchronize_rcu(); - - list_for_each_entry_safe(trans, next, &head, list) { -- list_del(&trans->list); -+ nft_trans_list_del(trans); - nft_commit_release(trans); - } - } -@@ -6708,9 +6756,10 @@ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *cha - - static void nf_tables_commit_chain_prepare_cancel(struct net *net) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_trans *trans, *next; - -- list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { -+ list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { - struct nft_chain *chain = trans->ctx.chain; - - if (trans->msg_type == NFT_MSG_NEWRULE || -@@ -6808,10 +6857,11 @@ static void nft_chain_del(struct nft_chain *chain) - - static void nf_tables_module_autoload_cleanup(struct net *net) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_module_request *req, *next; - -- WARN_ON_ONCE(!list_empty(&net->nft.commit_list)); -- list_for_each_entry_safe(req, next, &net->nft.module_list, list) { -+ WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); -+ list_for_each_entry_safe(req, next, &nft_net->module_list, list) { - WARN_ON_ONCE(!req->done); - list_del(&req->list); - kfree(req); -@@ -6820,6 +6870,7 @@ static void nf_tables_module_autoload_cleanup(struct net *net) - - static void nf_tables_commit_release(struct net *net) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_trans *trans; - - /* all side effects have to be made visible. -@@ -6829,41 +6880,54 @@ static void nf_tables_commit_release(struct net *net) - * Memory reclaim happens asynchronously from work queue - * to prevent expensive synchronize_rcu() in commit phase. - */ -- if (list_empty(&net->nft.commit_list)) { -+ if (list_empty(&nft_net->commit_list)) { - nf_tables_module_autoload_cleanup(net); -- mutex_unlock(&net->nft.commit_mutex); -+ mutex_unlock(&nft_net->commit_mutex); - return; - } - -- trans = list_last_entry(&net->nft.commit_list, -+ trans = list_last_entry(&nft_net->commit_list, - struct nft_trans, list); - get_net(trans->ctx.net); - WARN_ON_ONCE(trans->put_net); - - trans->put_net = true; - spin_lock(&nf_tables_destroy_list_lock); -- list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list); -+ list_splice_tail_init(&nft_net->commit_list, &nf_tables_destroy_list); - spin_unlock(&nf_tables_destroy_list_lock); - - nf_tables_module_autoload_cleanup(net); - schedule_work(&trans_destroy_work); - -- mutex_unlock(&net->nft.commit_mutex); -+ mutex_unlock(&nft_net->commit_mutex); - } - - static int nf_tables_commit(struct net *net, struct sk_buff *skb) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_trans *trans, *next; - struct nft_trans_elem *te; - struct nft_chain *chain; - struct nft_table *table; - int err; - -- if (list_empty(&net->nft.commit_list)) { -- mutex_unlock(&net->nft.commit_mutex); -+ if (list_empty(&nft_net->commit_list)) { -+ mutex_unlock(&nft_net->commit_mutex); - return 0; - } - -+ list_for_each_entry(trans, &nft_net->binding_list, binding_list) { -+ switch (trans->msg_type) { -+ case NFT_MSG_NEWSET: -+ if (nft_set_is_anonymous(nft_trans_set(trans)) && -+ !nft_trans_set_bound(trans)) { -+ pr_warn_once("nftables ruleset with unbound set\n"); -+ return -EINVAL; -+ } -+ break; -+ } -+ } -+ - /* 0. Validate ruleset, otherwise roll back for error reporting. */ - if (nf_tables_validate(net) < 0) - return -EAGAIN; -@@ -6873,7 +6937,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) - return err; - - /* 1. Allocate space for next generation rules_gen_X[] */ -- list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { -+ list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { - int ret; - - if (trans->msg_type == NFT_MSG_NEWRULE || -@@ -6889,7 +6953,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) - } - - /* step 2. Make rules_gen_X visible to packet path */ -- list_for_each_entry(table, &net->nft.tables, list) { -+ list_for_each_entry(table, &nft_net->tables, list) { - list_for_each_entry(chain, &table->chains, list) - nf_tables_commit_chain(net, chain); - } -@@ -6898,12 +6962,13 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) - * Bump generation counter, invalidate any dump in progress. - * Cannot fail after this point. - */ -- while (++net->nft.base_seq == 0); -+ while (++nft_net->base_seq == 0) -+ ; - - /* step 3. Start new generation, rules_gen_X now in use. */ - net->nft.gencursor = nft_gencursor_next(net); - -- list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { -+ list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { - switch (trans->msg_type) { - case NFT_MSG_NEWTABLE: - if (nft_trans_table_update(trans)) { -@@ -7045,17 +7110,18 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) - - static void nf_tables_module_autoload(struct net *net) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_module_request *req, *next; - LIST_HEAD(module_list); - -- list_splice_init(&net->nft.module_list, &module_list); -- mutex_unlock(&net->nft.commit_mutex); -+ list_splice_init(&nft_net->module_list, &module_list); -+ mutex_unlock(&nft_net->commit_mutex); - list_for_each_entry_safe(req, next, &module_list, list) { - request_module("%s", req->module); - req->done = true; - } -- mutex_lock(&net->nft.commit_mutex); -- list_splice(&module_list, &net->nft.module_list); -+ mutex_lock(&nft_net->commit_mutex); -+ list_splice(&module_list, &nft_net->module_list); - } - - static void nf_tables_abort_release(struct nft_trans *trans) -@@ -7089,6 +7155,7 @@ static void nf_tables_abort_release(struct nft_trans *trans) - - static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_trans *trans, *next; - struct nft_trans_elem *te; - -@@ -7096,7 +7163,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) - nf_tables_validate(net) < 0) - return -EAGAIN; - -- list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list, -+ list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, - list) { - switch (trans->msg_type) { - case NFT_MSG_NEWTABLE: -@@ -7208,8 +7275,8 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) - synchronize_rcu(); - - list_for_each_entry_safe_reverse(trans, next, -- &net->nft.commit_list, list) { -- list_del(&trans->list); -+ &nft_net->commit_list, list) { -+ nft_trans_list_del(trans); - nf_tables_abort_release(trans); - } - -@@ -7224,22 +7291,24 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) - static int nf_tables_abort(struct net *net, struct sk_buff *skb, - enum nfnl_abort_action action) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - int ret = __nf_tables_abort(net, action); - -- mutex_unlock(&net->nft.commit_mutex); -+ mutex_unlock(&nft_net->commit_mutex); - - return ret; - } - - static bool nf_tables_valid_genid(struct net *net, u32 genid) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - bool genid_ok; - -- mutex_lock(&net->nft.commit_mutex); -+ mutex_lock(&nft_net->commit_mutex); - -- genid_ok = genid == 0 || net->nft.base_seq == genid; -+ genid_ok = genid == 0 || nft_net->base_seq == genid; - if (!genid_ok) -- mutex_unlock(&net->nft.commit_mutex); -+ mutex_unlock(&nft_net->commit_mutex); - - /* else, commit mutex has to be released by commit or abort function */ - return genid_ok; -@@ -7586,6 +7655,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, - - if (!tb[NFTA_VERDICT_CODE]) - return -EINVAL; -+ -+ /* zero padding hole for memcmp */ -+ memset(data, 0, sizeof(*data)); - data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); - - switch (data->verdict.code) { -@@ -7796,19 +7868,19 @@ EXPORT_SYMBOL_GPL(__nft_release_basechain); - - static void __nft_release_hooks(struct net *net) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_table *table; - struct nft_chain *chain; - -- list_for_each_entry(table, &net->nft.tables, list) { -+ list_for_each_entry(table, &nft_net->tables, list) { - list_for_each_entry(chain, &table->chains, list) - nf_tables_unregister_hook(net, table, chain); - } - } - --static void __nft_release_tables(struct net *net) -+static void __nft_release_table(struct net *net, struct nft_table *table) - { - struct nft_flowtable *flowtable, *nf; -- struct nft_table *table, *nt; - struct nft_chain *chain, *nc; - struct nft_object *obj, *ne; - struct nft_rule *rule, *nr; -@@ -7818,77 +7890,94 @@ static void __nft_release_tables(struct net *net) - .family = NFPROTO_NETDEV, - }; - -- list_for_each_entry_safe(table, nt, &net->nft.tables, list) { -- ctx.family = table->family; -- ctx.table = table; -- list_for_each_entry(chain, &table->chains, list) { -- ctx.chain = chain; -- list_for_each_entry_safe(rule, nr, &chain->rules, list) { -- list_del(&rule->list); -- chain->use--; -- nf_tables_rule_release(&ctx, rule); -- } -- } -- list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { -- list_del(&flowtable->list); -- table->use--; -- nf_tables_flowtable_destroy(flowtable); -- } -- list_for_each_entry_safe(set, ns, &table->sets, list) { -- list_del(&set->list); -- table->use--; -- nft_set_destroy(set); -- } -- list_for_each_entry_safe(obj, ne, &table->objects, list) { -- nft_obj_del(obj); -- table->use--; -- nft_obj_destroy(&ctx, obj); -- } -- list_for_each_entry_safe(chain, nc, &table->chains, list) { -- ctx.chain = chain; -- nft_chain_del(chain); -- table->use--; -- nf_tables_chain_destroy(&ctx); -+ ctx.family = table->family; -+ ctx.table = table; -+ list_for_each_entry(chain, &table->chains, list) { -+ ctx.chain = chain; -+ list_for_each_entry_safe(rule, nr, &chain->rules, list) { -+ list_del(&rule->list); -+ chain->use--; -+ nf_tables_rule_release(&ctx, rule); - } -- list_del(&table->list); -- nf_tables_table_destroy(&ctx); - } -+ list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { -+ list_del(&flowtable->list); -+ table->use--; -+ nf_tables_flowtable_destroy(flowtable); -+ } -+ list_for_each_entry_safe(set, ns, &table->sets, list) { -+ list_del(&set->list); -+ table->use--; -+ nft_set_destroy(set); -+ } -+ list_for_each_entry_safe(obj, ne, &table->objects, list) { -+ nft_obj_del(obj); -+ table->use--; -+ nft_obj_destroy(&ctx, obj); -+ } -+ list_for_each_entry_safe(chain, nc, &table->chains, list) { -+ ctx.chain = chain; -+ nft_chain_del(chain); -+ table->use--; -+ nf_tables_chain_destroy(&ctx); -+ } -+ list_del(&table->list); -+ nf_tables_table_destroy(&ctx); -+} -+ -+static void __nft_release_tables(struct net *net) -+{ -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); -+ struct nft_table *table, *nt; -+ -+ list_for_each_entry_safe(table, nt, &nft_net->tables, list) -+ __nft_release_table(net, table); - } - - static int __net_init nf_tables_init_net(struct net *net) - { -- INIT_LIST_HEAD(&net->nft.tables); -- INIT_LIST_HEAD(&net->nft.commit_list); -- INIT_LIST_HEAD(&net->nft.module_list); -- mutex_init(&net->nft.commit_mutex); -- net->nft.base_seq = 1; -- net->nft.validate_state = NFT_VALIDATE_SKIP; -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); -+ -+ INIT_LIST_HEAD(&nft_net->tables); -+ INIT_LIST_HEAD(&nft_net->commit_list); -+ INIT_LIST_HEAD(&nft_net->binding_list); -+ INIT_LIST_HEAD(&nft_net->module_list); -+ INIT_LIST_HEAD(&nft_net->notify_list); -+ mutex_init(&nft_net->commit_mutex); -+ nft_net->base_seq = 1; -+ nft_net->validate_state = NFT_VALIDATE_SKIP; - - return 0; - } - - static void __net_exit nf_tables_pre_exit_net(struct net *net) - { -- mutex_lock(&net->nft.commit_mutex); -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); -+ -+ mutex_lock(&nft_net->commit_mutex); - __nft_release_hooks(net); -- mutex_unlock(&net->nft.commit_mutex); -+ mutex_unlock(&nft_net->commit_mutex); - } - - static void __net_exit nf_tables_exit_net(struct net *net) - { -- mutex_lock(&net->nft.commit_mutex); -- if (!list_empty(&net->nft.commit_list)) -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); -+ -+ mutex_lock(&nft_net->commit_mutex); -+ if (!list_empty(&nft_net->commit_list)) - __nf_tables_abort(net, NFNL_ABORT_NONE); - __nft_release_tables(net); -- mutex_unlock(&net->nft.commit_mutex); -- WARN_ON_ONCE(!list_empty(&net->nft.tables)); -- WARN_ON_ONCE(!list_empty(&net->nft.module_list)); -+ mutex_unlock(&nft_net->commit_mutex); -+ WARN_ON_ONCE(!list_empty(&nft_net->tables)); -+ WARN_ON_ONCE(!list_empty(&nft_net->module_list)); - } - - static struct pernet_operations nf_tables_net_ops = { - .init = nf_tables_init_net, - .pre_exit = nf_tables_pre_exit_net, - .exit = nf_tables_exit_net, -+ .id = &nf_tables_net_id, -+ .size = sizeof(struct nftables_pernet), - }; - - static int __init nf_tables_module_init(void) -diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c -index 2d3bc22c855c7..1e691eff1c40d 100644 ---- a/net/netfilter/nf_tables_offload.c -+++ b/net/netfilter/nf_tables_offload.c -@@ -7,6 +7,8 @@ - #include - #include - -+extern unsigned int nf_tables_net_id; -+ - static struct nft_flow_rule *nft_flow_rule_alloc(int num_actions) - { - struct nft_flow_rule *flow; -@@ -345,11 +347,12 @@ static int nft_flow_offload_chain(struct nft_chain *chain, - - int nft_flow_rule_offload_commit(struct net *net) - { -+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); - struct nft_trans *trans; - int err = 0; - u8 policy; - -- list_for_each_entry(trans, &net->nft.commit_list, list) { -+ list_for_each_entry(trans, &nft_net->commit_list, list) { - if (trans->ctx.family != NFPROTO_NETDEV) - continue; - -@@ -400,7 +403,7 @@ int nft_flow_rule_offload_commit(struct net *net) - break; - } - -- list_for_each_entry(trans, &net->nft.commit_list, list) { -+ list_for_each_entry(trans, &nft_net->commit_list, list) { - if (trans->ctx.family != NFPROTO_NETDEV) - continue; - -@@ -419,14 +422,14 @@ int nft_flow_rule_offload_commit(struct net *net) - return err; - } - --static struct nft_chain *__nft_offload_get_chain(struct net_device *dev) -+static struct nft_chain *__nft_offload_get_chain(const struct nftables_pernet *nft_net, -+ struct net_device *dev) - { - struct nft_base_chain *basechain; -- struct net *net = dev_net(dev); - const struct nft_table *table; - struct nft_chain *chain; - -- list_for_each_entry(table, &net->nft.tables, list) { -+ list_for_each_entry(table, &nft_net->tables, list) { - if (table->family != NFPROTO_NETDEV) - continue; - -@@ -450,18 +453,20 @@ static void nft_indr_block_cb(struct net_device *dev, - flow_indr_block_bind_cb_t *cb, void *cb_priv, - enum flow_block_command cmd) - { -+ struct nftables_pernet *nft_net; - struct net *net = dev_net(dev); - struct nft_chain *chain; - -- mutex_lock(&net->nft.commit_mutex); -- chain = __nft_offload_get_chain(dev); -+ nft_net = net_generic(net, nf_tables_net_id); -+ mutex_lock(&nft_net->commit_mutex); -+ chain = __nft_offload_get_chain(nft_net, dev); - if (chain && chain->flags & NFT_CHAIN_HW_OFFLOAD) { - struct nft_base_chain *basechain; - - basechain = nft_base_chain(chain); - nft_indr_block_ing_cmd(dev, basechain, cb, cb_priv, cmd); - } -- mutex_unlock(&net->nft.commit_mutex); -+ mutex_unlock(&nft_net->commit_mutex); - } - - static void nft_offload_chain_clean(struct nft_chain *chain) -@@ -480,17 +485,19 @@ static int nft_offload_netdev_event(struct notifier_block *this, - unsigned long event, void *ptr) - { - struct net_device *dev = netdev_notifier_info_to_dev(ptr); -+ struct nftables_pernet *nft_net; - struct net *net = dev_net(dev); - struct nft_chain *chain; - - if (event != NETDEV_UNREGISTER) - return NOTIFY_DONE; - -- mutex_lock(&net->nft.commit_mutex); -- chain = __nft_offload_get_chain(dev); -+ nft_net = net_generic(net, nf_tables_net_id); -+ mutex_lock(&nft_net->commit_mutex); -+ chain = __nft_offload_get_chain(nft_net, dev); - if (chain) - nft_offload_chain_clean(chain); -- mutex_unlock(&net->nft.commit_mutex); -+ mutex_unlock(&nft_net->commit_mutex); - - return NOTIFY_DONE; - } -diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c -index 87b36da5cd985..0cf3278007ba5 100644 ---- a/net/netfilter/nf_tables_trace.c -+++ b/net/netfilter/nf_tables_trace.c -@@ -183,7 +183,6 @@ static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info) - void nft_trace_notify(struct nft_traceinfo *info) - { - const struct nft_pktinfo *pkt = info->pkt; -- struct nfgenmsg *nfmsg; - struct nlmsghdr *nlh; - struct sk_buff *skb; - unsigned int size; -@@ -219,15 +218,11 @@ void nft_trace_notify(struct nft_traceinfo *info) - return; - - event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_TRACE); -- nlh = nlmsg_put(skb, 0, 0, event, sizeof(struct nfgenmsg), 0); -+ nlh = nfnl_msg_put(skb, 0, 0, event, 0, info->basechain->type->family, -+ NFNETLINK_V0, 0); - if (!nlh) - goto nla_put_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = info->basechain->type->family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - if (nla_put_be32(skb, NFTA_TRACE_NFPROTO, htonl(nft_pf(pkt)))) - goto nla_put_failure; - -diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c -index 2481470dec368..4b46421c5e17a 100644 ---- a/net/netfilter/nfnetlink_acct.c -+++ b/net/netfilter/nfnetlink_acct.c -@@ -132,21 +132,16 @@ nfnl_acct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, - int event, struct nf_acct *acct) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - unsigned int flags = portid ? NLM_F_MULTI : 0; - u64 pkts, bytes; - u32 old_flags; - - event = nfnl_msg_type(NFNL_SUBSYS_ACCT, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, -+ NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = AF_UNSPEC; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - if (nla_put_string(skb, NFACCT_NAME, acct->name)) - goto nla_put_failure; - -diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c -index 3d5fc07b2530b..cb9c2e9559962 100644 ---- a/net/netfilter/nfnetlink_cthelper.c -+++ b/net/netfilter/nfnetlink_cthelper.c -@@ -530,20 +530,15 @@ nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, - int event, struct nf_conntrack_helper *helper) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - unsigned int flags = portid ? NLM_F_MULTI : 0; - int status; - - event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, -+ NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = AF_UNSPEC; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - if (nla_put_string(skb, NFCTH_NAME, helper->name)) - goto nla_put_failure; - -diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c -index da915c224a82d..a854e1560cc1f 100644 ---- a/net/netfilter/nfnetlink_cttimeout.c -+++ b/net/netfilter/nfnetlink_cttimeout.c -@@ -160,22 +160,17 @@ ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, - int event, struct ctnl_timeout *timeout) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - unsigned int flags = portid ? NLM_F_MULTI : 0; - const struct nf_conntrack_l4proto *l4proto = timeout->timeout.l4proto; - struct nlattr *nest_parms; - int ret; - - event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, -+ NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = AF_UNSPEC; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) || - nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, - htons(timeout->timeout.l3num)) || -@@ -382,21 +377,16 @@ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid, - const unsigned int *timeouts) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - unsigned int flags = portid ? NLM_F_MULTI : 0; - struct nlattr *nest_parms; - int ret; - - event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, -+ NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = AF_UNSPEC; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l3num)) || - nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto)) - goto nla_put_failure; -diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c -index 33c13edbca4bb..f087baa95b07b 100644 ---- a/net/netfilter/nfnetlink_log.c -+++ b/net/netfilter/nfnetlink_log.c -@@ -452,20 +452,15 @@ __build_packet_message(struct nfnl_log_net *log, - { - struct nfulnl_msg_packet_hdr pmsg; - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - sk_buff_data_t old_tail = inst->skb->tail; - struct sock *sk; - const unsigned char *hwhdrp; - -- nlh = nlmsg_put(inst->skb, 0, 0, -- nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET), -- sizeof(struct nfgenmsg), 0); -+ nlh = nfnl_msg_put(inst->skb, 0, 0, -+ nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET), -+ 0, pf, NFNETLINK_V0, htons(inst->group_num)); - if (!nlh) - return -1; -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = pf; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(inst->group_num); - - memset(&pmsg, 0, sizeof(pmsg)); - pmsg.hw_protocol = skb->protocol; -diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c -index ad88904ee3f90..772f8c69818c6 100644 ---- a/net/netfilter/nfnetlink_queue.c -+++ b/net/netfilter/nfnetlink_queue.c -@@ -383,7 +383,6 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, - struct nlattr *nla; - struct nfqnl_msg_packet_hdr *pmsg; - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - struct sk_buff *entskb = entry->skb; - struct net_device *indev; - struct net_device *outdev; -@@ -469,18 +468,15 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, - goto nlmsg_failure; - } - -- nlh = nlmsg_put(skb, 0, 0, -- nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET), -- sizeof(struct nfgenmsg), 0); -+ nlh = nfnl_msg_put(skb, 0, 0, -+ nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET), -+ 0, entry->state.pf, NFNETLINK_V0, -+ htons(queue->queue_num)); - if (!nlh) { - skb_tx_error(entskb); - kfree_skb(skb); - goto nlmsg_failure; - } -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = entry->state.pf; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = htons(queue->queue_num); - - nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg)); - pmsg = nla_data(nla); -diff --git a/net/netfilter/nft_byteorder.c b/net/netfilter/nft_byteorder.c -index 9d5947ab8d4ef..7b0b8fecb2205 100644 ---- a/net/netfilter/nft_byteorder.c -+++ b/net/netfilter/nft_byteorder.c -@@ -30,11 +30,11 @@ void nft_byteorder_eval(const struct nft_expr *expr, - const struct nft_byteorder *priv = nft_expr_priv(expr); - u32 *src = ®s->data[priv->sreg]; - u32 *dst = ®s->data[priv->dreg]; -- union { u32 u32; u16 u16; } *s, *d; -+ u16 *s16, *d16; - unsigned int i; - -- s = (void *)src; -- d = (void *)dst; -+ s16 = (void *)src; -+ d16 = (void *)dst; - - switch (priv->size) { - case 8: { -@@ -61,11 +61,11 @@ void nft_byteorder_eval(const struct nft_expr *expr, - switch (priv->op) { - case NFT_BYTEORDER_NTOH: - for (i = 0; i < priv->len / 4; i++) -- d[i].u32 = ntohl((__force __be32)s[i].u32); -+ dst[i] = ntohl((__force __be32)src[i]); - break; - case NFT_BYTEORDER_HTON: - for (i = 0; i < priv->len / 4; i++) -- d[i].u32 = (__force __u32)htonl(s[i].u32); -+ dst[i] = (__force __u32)htonl(src[i]); - break; - } - break; -@@ -73,11 +73,11 @@ void nft_byteorder_eval(const struct nft_expr *expr, - switch (priv->op) { - case NFT_BYTEORDER_NTOH: - for (i = 0; i < priv->len / 2; i++) -- d[i].u16 = ntohs((__force __be16)s[i].u16); -+ d16[i] = ntohs((__force __be16)s16[i]); - break; - case NFT_BYTEORDER_HTON: - for (i = 0; i < priv->len / 2; i++) -- d[i].u16 = (__force __u16)htons(s[i].u16); -+ d16[i] = (__force __u16)htons(s16[i]); - break; - } - break; -diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c -index b5d5d071d7655..04824d7dcc220 100644 ---- a/net/netfilter/nft_chain_filter.c -+++ b/net/netfilter/nft_chain_filter.c -@@ -2,6 +2,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -10,6 +11,8 @@ - #include - #include - -+extern unsigned int nf_tables_net_id; -+ - #ifdef CONFIG_NF_TABLES_IPV4 - static unsigned int nft_do_chain_ipv4(void *priv, - struct sk_buff *skb, -@@ -315,6 +318,7 @@ static int nf_tables_netdev_event(struct notifier_block *this, - unsigned long event, void *ptr) - { - struct net_device *dev = netdev_notifier_info_to_dev(ptr); -+ struct nftables_pernet *nft_net; - struct nft_table *table; - struct nft_chain *chain, *nr; - struct nft_ctx ctx = { -@@ -325,8 +329,9 @@ static int nf_tables_netdev_event(struct notifier_block *this, - event != NETDEV_CHANGENAME) - return NOTIFY_DONE; - -- mutex_lock(&ctx.net->nft.commit_mutex); -- list_for_each_entry(table, &ctx.net->nft.tables, list) { -+ nft_net = net_generic(ctx.net, nf_tables_net_id); -+ mutex_lock(&nft_net->commit_mutex); -+ list_for_each_entry(table, &nft_net->tables, list) { - if (table->family != NFPROTO_NETDEV) - continue; - -@@ -340,7 +345,7 @@ static int nf_tables_netdev_event(struct notifier_block *this, - nft_netdev_event(event, dev, &ctx); - } - } -- mutex_unlock(&ctx.net->nft.commit_mutex); -+ mutex_unlock(&nft_net->commit_mutex); - - return NOTIFY_DONE; - } -diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index bbe03b9a03b12..1c975e1d3fea2 100644 ---- a/net/netfilter/nft_compat.c -+++ b/net/netfilter/nft_compat.c -@@ -591,19 +591,14 @@ nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, - int rev, int target) - { - struct nlmsghdr *nlh; -- struct nfgenmsg *nfmsg; - unsigned int flags = portid ? NLM_F_MULTI : 0; - - event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event); -- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); -- if (nlh == NULL) -+ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, -+ NFNETLINK_V0, 0); -+ if (!nlh) - goto nlmsg_failure; - -- nfmsg = nlmsg_data(nlh); -- nfmsg->nfgen_family = family; -- nfmsg->version = NFNETLINK_V0; -- nfmsg->res_id = 0; -- - if (nla_put_string(skb, NFTA_COMPAT_NAME, name) || - nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) || - nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target))) -diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c -index 9f064f7b31d6d..8aca2fdc0664c 100644 ---- a/net/netfilter/nft_dynset.c -+++ b/net/netfilter/nft_dynset.c -@@ -11,6 +11,9 @@ - #include - #include - #include -+#include -+ -+extern unsigned int nf_tables_net_id; - - struct nft_dynset { - struct nft_set *set; -@@ -129,13 +132,14 @@ static int nft_dynset_init(const struct nft_ctx *ctx, - const struct nft_expr *expr, - const struct nlattr * const tb[]) - { -+ struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id); - struct nft_dynset *priv = nft_expr_priv(expr); - u8 genmask = nft_genmask_next(ctx->net); - struct nft_set *set; - u64 timeout; - int err; - -- lockdep_assert_held(&ctx->net->nft.commit_mutex); -+ lockdep_assert_held(&nft_net->commit_mutex); - - if (tb[NFTA_DYNSET_SET_NAME] == NULL || - tb[NFTA_DYNSET_OP] == NULL || -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index bf7e300e8c25d..29eabd45b832a 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -1601,6 +1601,7 @@ out: - int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code) - { - struct netlink_set_err_data info; -+ unsigned long flags; - struct sock *sk; - int ret = 0; - -@@ -1610,12 +1611,12 @@ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code) - /* sk->sk_err wants a positive error value */ - info.code = -code; - -- read_lock(&nl_table_lock); -+ read_lock_irqsave(&nl_table_lock, flags); - - sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list) - ret += do_one_set_err(sk, &info); - -- read_unlock(&nl_table_lock); -+ read_unlock_irqrestore(&nl_table_lock, flags); - return ret; - } - EXPORT_SYMBOL(netlink_set_err); -diff --git a/net/netlink/diag.c b/net/netlink/diag.c -index c6255eac305c7..e4f21b1067bcc 100644 ---- a/net/netlink/diag.c -+++ b/net/netlink/diag.c -@@ -94,6 +94,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, - struct net *net = sock_net(skb->sk); - struct netlink_diag_req *req; - struct netlink_sock *nlsk; -+ unsigned long flags; - struct sock *sk; - int num = 2; - int ret = 0; -@@ -152,7 +153,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, - num++; - - mc_list: -- read_lock(&nl_table_lock); -+ read_lock_irqsave(&nl_table_lock, flags); - sk_for_each_bound(sk, &tbl->mc_list) { - if (sk_hashed(sk)) - continue; -@@ -167,13 +168,13 @@ mc_list: - NETLINK_CB(cb->skb).portid, - cb->nlh->nlmsg_seq, - NLM_F_MULTI, -- sock_i_ino(sk)) < 0) { -+ __sock_i_ino(sk)) < 0) { - ret = 1; - break; - } - num++; - } -- read_unlock(&nl_table_lock); -+ read_unlock_irqrestore(&nl_table_lock, flags); - - done: - cb->args[0] = num; -diff --git a/net/nfc/core.c b/net/nfc/core.c -index 2d4729d1f0eb9..fef112fb49930 100644 ---- a/net/nfc/core.c -+++ b/net/nfc/core.c -@@ -634,7 +634,7 @@ error: - return rc; - } - --int nfc_set_remote_general_bytes(struct nfc_dev *dev, u8 *gb, u8 gb_len) -+int nfc_set_remote_general_bytes(struct nfc_dev *dev, const u8 *gb, u8 gb_len) - { - pr_debug("dev_name=%s gb_len=%d\n", dev_name(&dev->dev), gb_len); - -@@ -663,7 +663,7 @@ int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb) - EXPORT_SYMBOL(nfc_tm_data_received); - - int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode, -- u8 *gb, size_t gb_len) -+ const u8 *gb, size_t gb_len) - { - int rc; - -diff --git a/net/nfc/hci/llc_shdlc.c b/net/nfc/hci/llc_shdlc.c -index 0eb4ddc056e78..02909e3e91ef1 100644 ---- a/net/nfc/hci/llc_shdlc.c -+++ b/net/nfc/hci/llc_shdlc.c -@@ -123,7 +123,7 @@ static bool llc_shdlc_x_lteq_y_lt_z(int x, int y, int z) - return ((y >= x) || (y < z)) ? true : false; - } - --static struct sk_buff *llc_shdlc_alloc_skb(struct llc_shdlc *shdlc, -+static struct sk_buff *llc_shdlc_alloc_skb(const struct llc_shdlc *shdlc, - int payload_len) - { - struct sk_buff *skb; -@@ -137,7 +137,7 @@ static struct sk_buff *llc_shdlc_alloc_skb(struct llc_shdlc *shdlc, - } - - /* immediately sends an S frame. */ --static int llc_shdlc_send_s_frame(struct llc_shdlc *shdlc, -+static int llc_shdlc_send_s_frame(const struct llc_shdlc *shdlc, - enum sframe_type sframe_type, int nr) - { - int r; -@@ -159,7 +159,7 @@ static int llc_shdlc_send_s_frame(struct llc_shdlc *shdlc, - } - - /* immediately sends an U frame. skb may contain optional payload */ --static int llc_shdlc_send_u_frame(struct llc_shdlc *shdlc, -+static int llc_shdlc_send_u_frame(const struct llc_shdlc *shdlc, - struct sk_buff *skb, - enum uframe_modifier uframe_modifier) - { -@@ -361,7 +361,7 @@ static void llc_shdlc_connect_complete(struct llc_shdlc *shdlc, int r) - wake_up(shdlc->connect_wq); - } - --static int llc_shdlc_connect_initiate(struct llc_shdlc *shdlc) -+static int llc_shdlc_connect_initiate(const struct llc_shdlc *shdlc) - { - struct sk_buff *skb; - -@@ -377,7 +377,7 @@ static int llc_shdlc_connect_initiate(struct llc_shdlc *shdlc) - return llc_shdlc_send_u_frame(shdlc, skb, U_FRAME_RSET); - } - --static int llc_shdlc_connect_send_ua(struct llc_shdlc *shdlc) -+static int llc_shdlc_connect_send_ua(const struct llc_shdlc *shdlc) - { - struct sk_buff *skb; - -diff --git a/net/nfc/llcp.h b/net/nfc/llcp.h -index 97853c9cefc70..a81893bc06ce8 100644 ---- a/net/nfc/llcp.h -+++ b/net/nfc/llcp.h -@@ -202,7 +202,6 @@ void nfc_llcp_sock_link(struct llcp_sock_list *l, struct sock *s); - void nfc_llcp_sock_unlink(struct llcp_sock_list *l, struct sock *s); - void nfc_llcp_socket_remote_param_init(struct nfc_llcp_sock *sock); - struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev); --struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local); - int nfc_llcp_local_put(struct nfc_llcp_local *local); - u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, - struct nfc_llcp_sock *sock); -@@ -221,15 +220,15 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *sk, struct socket *newsock); - - /* TLV API */ - int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local, -- u8 *tlv_array, u16 tlv_array_len); -+ const u8 *tlv_array, u16 tlv_array_len); - int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock, -- u8 *tlv_array, u16 tlv_array_len); -+ const u8 *tlv_array, u16 tlv_array_len); - - /* Commands API */ - void nfc_llcp_recv(void *data, struct sk_buff *skb, int err); --u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length); -+u8 *nfc_llcp_build_tlv(u8 type, const u8 *value, u8 value_length, u8 *tlv_length); - struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap); --struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri, -+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, const char *uri, - size_t uri_len); - void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp); - void nfc_llcp_free_sdp_tlv_list(struct hlist_head *sdp_head); -diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c -index 475061c79c442..5b8754ae7d3af 100644 ---- a/net/nfc/llcp_commands.c -+++ b/net/nfc/llcp_commands.c -@@ -15,7 +15,7 @@ - #include "nfc.h" - #include "llcp.h" - --static u8 llcp_tlv_length[LLCP_TLV_MAX] = { -+static const u8 llcp_tlv_length[LLCP_TLV_MAX] = { - 0, - 1, /* VERSION */ - 2, /* MIUX */ -@@ -29,7 +29,7 @@ static u8 llcp_tlv_length[LLCP_TLV_MAX] = { - - }; - --static u8 llcp_tlv8(u8 *tlv, u8 type) -+static u8 llcp_tlv8(const u8 *tlv, u8 type) - { - if (tlv[0] != type || tlv[1] != llcp_tlv_length[tlv[0]]) - return 0; -@@ -37,7 +37,7 @@ static u8 llcp_tlv8(u8 *tlv, u8 type) - return tlv[2]; - } - --static u16 llcp_tlv16(u8 *tlv, u8 type) -+static u16 llcp_tlv16(const u8 *tlv, u8 type) - { - if (tlv[0] != type || tlv[1] != llcp_tlv_length[tlv[0]]) - return 0; -@@ -46,37 +46,37 @@ static u16 llcp_tlv16(u8 *tlv, u8 type) - } - - --static u8 llcp_tlv_version(u8 *tlv) -+static u8 llcp_tlv_version(const u8 *tlv) - { - return llcp_tlv8(tlv, LLCP_TLV_VERSION); - } - --static u16 llcp_tlv_miux(u8 *tlv) -+static u16 llcp_tlv_miux(const u8 *tlv) - { - return llcp_tlv16(tlv, LLCP_TLV_MIUX) & 0x7ff; - } - --static u16 llcp_tlv_wks(u8 *tlv) -+static u16 llcp_tlv_wks(const u8 *tlv) - { - return llcp_tlv16(tlv, LLCP_TLV_WKS); - } - --static u16 llcp_tlv_lto(u8 *tlv) -+static u16 llcp_tlv_lto(const u8 *tlv) - { - return llcp_tlv8(tlv, LLCP_TLV_LTO); - } - --static u8 llcp_tlv_opt(u8 *tlv) -+static u8 llcp_tlv_opt(const u8 *tlv) - { - return llcp_tlv8(tlv, LLCP_TLV_OPT); - } - --static u8 llcp_tlv_rw(u8 *tlv) -+static u8 llcp_tlv_rw(const u8 *tlv) - { - return llcp_tlv8(tlv, LLCP_TLV_RW) & 0xf; - } - --u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length) -+u8 *nfc_llcp_build_tlv(u8 type, const u8 *value, u8 value_length, u8 *tlv_length) - { - u8 *tlv, length; - -@@ -130,7 +130,7 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap) - return sdres; - } - --struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri, -+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, const char *uri, - size_t uri_len) - { - struct nfc_llcp_sdp_tlv *sdreq; -@@ -190,9 +190,10 @@ void nfc_llcp_free_sdp_tlv_list(struct hlist_head *head) - } - - int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local, -- u8 *tlv_array, u16 tlv_array_len) -+ const u8 *tlv_array, u16 tlv_array_len) - { -- u8 *tlv = tlv_array, type, length, offset = 0; -+ const u8 *tlv = tlv_array; -+ u8 type, length, offset = 0; - - pr_debug("TLV array length %d\n", tlv_array_len); - -@@ -239,9 +240,10 @@ int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local, - } - - int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock, -- u8 *tlv_array, u16 tlv_array_len) -+ const u8 *tlv_array, u16 tlv_array_len) - { -- u8 *tlv = tlv_array, type, length, offset = 0; -+ const u8 *tlv = tlv_array; -+ u8 type, length, offset = 0; - - pr_debug("TLV array length %d\n", tlv_array_len); - -@@ -295,7 +297,7 @@ static struct sk_buff *llcp_add_header(struct sk_buff *pdu, - return pdu; - } - --static struct sk_buff *llcp_add_tlv(struct sk_buff *pdu, u8 *tlv, -+static struct sk_buff *llcp_add_tlv(struct sk_buff *pdu, const u8 *tlv, - u8 tlv_length) - { - /* XXX Add an skb length check */ -@@ -359,6 +361,7 @@ int nfc_llcp_send_symm(struct nfc_dev *dev) - struct sk_buff *skb; - struct nfc_llcp_local *local; - u16 size = 0; -+ int err; - - pr_debug("Sending SYMM\n"); - -@@ -370,8 +373,10 @@ int nfc_llcp_send_symm(struct nfc_dev *dev) - size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE; - - skb = alloc_skb(size, GFP_KERNEL); -- if (skb == NULL) -- return -ENOMEM; -+ if (skb == NULL) { -+ err = -ENOMEM; -+ goto out; -+ } - - skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE); - -@@ -381,17 +386,22 @@ int nfc_llcp_send_symm(struct nfc_dev *dev) - - nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_TX); - -- return nfc_data_exchange(dev, local->target_idx, skb, -+ err = nfc_data_exchange(dev, local->target_idx, skb, - nfc_llcp_recv, local); -+out: -+ nfc_llcp_local_put(local); -+ return err; - } - - int nfc_llcp_send_connect(struct nfc_llcp_sock *sock) - { - struct nfc_llcp_local *local; - struct sk_buff *skb; -- u8 *service_name_tlv = NULL, service_name_tlv_length; -- u8 *miux_tlv = NULL, miux_tlv_length; -- u8 *rw_tlv = NULL, rw_tlv_length, rw; -+ const u8 *service_name_tlv = NULL; -+ const u8 *miux_tlv = NULL; -+ const u8 *rw_tlv = NULL; -+ u8 service_name_tlv_length = 0; -+ u8 miux_tlv_length, rw_tlv_length, rw; - int err; - u16 size = 0; - __be16 miux; -@@ -465,8 +475,9 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock) - { - struct nfc_llcp_local *local; - struct sk_buff *skb; -- u8 *miux_tlv = NULL, miux_tlv_length; -- u8 *rw_tlv = NULL, rw_tlv_length, rw; -+ const u8 *miux_tlv = NULL; -+ const u8 *rw_tlv = NULL; -+ u8 miux_tlv_length, rw_tlv_length, rw; - int err; - u16 size = 0; - __be16 miux; -diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c -index edadebb3efd2a..ddfd159f64e13 100644 ---- a/net/nfc/llcp_core.c -+++ b/net/nfc/llcp_core.c -@@ -17,6 +17,8 @@ - static u8 llcp_magic[3] = {0x46, 0x66, 0x6d}; - - static LIST_HEAD(llcp_devices); -+/* Protects llcp_devices list */ -+static DEFINE_SPINLOCK(llcp_devices_lock); - - static void nfc_llcp_rx_skb(struct nfc_llcp_local *local, struct sk_buff *skb); - -@@ -143,7 +145,7 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device, - write_unlock(&local->raw_sockets.lock); - } - --struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) -+static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) - { - kref_get(&local->ref); - -@@ -171,7 +173,6 @@ static void local_release(struct kref *ref) - - local = container_of(ref, struct nfc_llcp_local, ref); - -- list_del(&local->list); - local_cleanup(local); - kfree(local); - } -@@ -284,12 +285,33 @@ static void nfc_llcp_sdreq_timer(struct timer_list *t) - struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev) - { - struct nfc_llcp_local *local; -+ struct nfc_llcp_local *res = NULL; - -+ spin_lock(&llcp_devices_lock); - list_for_each_entry(local, &llcp_devices, list) -- if (local->dev == dev) -+ if (local->dev == dev) { -+ res = nfc_llcp_local_get(local); -+ break; -+ } -+ spin_unlock(&llcp_devices_lock); -+ -+ return res; -+} -+ -+static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev) -+{ -+ struct nfc_llcp_local *local, *tmp; -+ -+ spin_lock(&llcp_devices_lock); -+ list_for_each_entry_safe(local, tmp, &llcp_devices, list) -+ if (local->dev == dev) { -+ list_del(&local->list); -+ spin_unlock(&llcp_devices_lock); - return local; -+ } -+ spin_unlock(&llcp_devices_lock); - -- pr_debug("No device found\n"); -+ pr_warn("Shutting down device not found\n"); - - return NULL; - } -@@ -302,7 +324,7 @@ static char *wks[] = { - "urn:nfc:sn:snep", - }; - --static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len) -+static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len) - { - int sap, num_wks; - -@@ -326,7 +348,7 @@ static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len) - - static - struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, -- u8 *sn, size_t sn_len) -+ const u8 *sn, size_t sn_len) - { - struct sock *sk; - struct nfc_llcp_sock *llcp_sock, *tmp_sock; -@@ -523,7 +545,7 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local) - { - u8 *gb_cur, version, version_length; - u8 lto_length, wks_length, miux_length; -- u8 *version_tlv = NULL, *lto_tlv = NULL, -+ const u8 *version_tlv = NULL, *lto_tlv = NULL, - *wks_tlv = NULL, *miux_tlv = NULL; - __be16 wks = cpu_to_be16(local->local_wks); - u8 gb_len = 0; -@@ -610,12 +632,15 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len) - - *general_bytes_len = local->gb_len; - -+ nfc_llcp_local_put(local); -+ - return local->gb; - } - --int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len) -+int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len) - { - struct nfc_llcp_local *local; -+ int err; - - if (gb_len < 3 || gb_len > NFC_MAX_GT_LEN) - return -EINVAL; -@@ -632,35 +657,39 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len) - - if (memcmp(local->remote_gb, llcp_magic, 3)) { - pr_err("MAC does not support LLCP\n"); -- return -EINVAL; -+ err = -EINVAL; -+ goto out; - } - -- return nfc_llcp_parse_gb_tlv(local, -+ err = nfc_llcp_parse_gb_tlv(local, - &local->remote_gb[3], - local->remote_gb_len - 3); -+out: -+ nfc_llcp_local_put(local); -+ return err; - } - --static u8 nfc_llcp_dsap(struct sk_buff *pdu) -+static u8 nfc_llcp_dsap(const struct sk_buff *pdu) - { - return (pdu->data[0] & 0xfc) >> 2; - } - --static u8 nfc_llcp_ptype(struct sk_buff *pdu) -+static u8 nfc_llcp_ptype(const struct sk_buff *pdu) - { - return ((pdu->data[0] & 0x03) << 2) | ((pdu->data[1] & 0xc0) >> 6); - } - --static u8 nfc_llcp_ssap(struct sk_buff *pdu) -+static u8 nfc_llcp_ssap(const struct sk_buff *pdu) - { - return pdu->data[1] & 0x3f; - } - --static u8 nfc_llcp_ns(struct sk_buff *pdu) -+static u8 nfc_llcp_ns(const struct sk_buff *pdu) - { - return pdu->data[2] >> 4; - } - --static u8 nfc_llcp_nr(struct sk_buff *pdu) -+static u8 nfc_llcp_nr(const struct sk_buff *pdu) - { - return pdu->data[2] & 0xf; - } -@@ -802,7 +831,7 @@ out: - } - - static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local, -- u8 *sn, size_t sn_len) -+ const u8 *sn, size_t sn_len) - { - struct nfc_llcp_sock *llcp_sock; - -@@ -816,9 +845,10 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local, - return llcp_sock; - } - --static u8 *nfc_llcp_connect_sn(struct sk_buff *skb, size_t *sn_len) -+static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len) - { -- u8 *tlv = &skb->data[2], type, length; -+ u8 type, length; -+ const u8 *tlv = &skb->data[2]; - size_t tlv_array_len = skb->len - LLCP_HEADER_SIZE, offset = 0; - - while (offset < tlv_array_len) { -@@ -876,7 +906,7 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local, - } - - static void nfc_llcp_recv_connect(struct nfc_llcp_local *local, -- struct sk_buff *skb) -+ const struct sk_buff *skb) - { - struct sock *new_sk, *parent; - struct nfc_llcp_sock *sock, *new_sock; -@@ -894,7 +924,7 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local, - goto fail; - } - } else { -- u8 *sn; -+ const u8 *sn; - size_t sn_len; - - sn = nfc_llcp_connect_sn(skb, &sn_len); -@@ -1113,7 +1143,7 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local, - } - - static void nfc_llcp_recv_disc(struct nfc_llcp_local *local, -- struct sk_buff *skb) -+ const struct sk_buff *skb) - { - struct nfc_llcp_sock *llcp_sock; - struct sock *sk; -@@ -1156,7 +1186,8 @@ static void nfc_llcp_recv_disc(struct nfc_llcp_local *local, - nfc_llcp_sock_put(llcp_sock); - } - --static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb) -+static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, -+ const struct sk_buff *skb) - { - struct nfc_llcp_sock *llcp_sock; - struct sock *sk; -@@ -1189,7 +1220,8 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb) - nfc_llcp_sock_put(llcp_sock); - } - --static void nfc_llcp_recv_dm(struct nfc_llcp_local *local, struct sk_buff *skb) -+static void nfc_llcp_recv_dm(struct nfc_llcp_local *local, -+ const struct sk_buff *skb) - { - struct nfc_llcp_sock *llcp_sock; - struct sock *sk; -@@ -1227,12 +1259,13 @@ static void nfc_llcp_recv_dm(struct nfc_llcp_local *local, struct sk_buff *skb) - } - - static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, -- struct sk_buff *skb) -+ const struct sk_buff *skb) - { - struct nfc_llcp_sock *llcp_sock; -- u8 dsap, ssap, *tlv, type, length, tid, sap; -+ u8 dsap, ssap, type, length, tid, sap; -+ const u8 *tlv; - u16 tlv_len, offset; -- char *service_name; -+ const char *service_name; - size_t service_name_len; - struct nfc_llcp_sdp_tlv *sdp; - HLIST_HEAD(llc_sdres_list); -@@ -1523,6 +1556,8 @@ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb) - - __nfc_llcp_recv(local, skb); - -+ nfc_llcp_local_put(local); -+ - return 0; - } - -@@ -1539,6 +1574,8 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev) - - /* Close and purge all existing sockets */ - nfc_llcp_socket_release(local, true, 0); -+ -+ nfc_llcp_local_put(local); - } - - void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx, -@@ -1564,6 +1601,8 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx, - mod_timer(&local->link_timer, - jiffies + msecs_to_jiffies(local->remote_lto)); - } -+ -+ nfc_llcp_local_put(local); - } - - int nfc_llcp_register_device(struct nfc_dev *ndev) -@@ -1614,7 +1653,7 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) - - void nfc_llcp_unregister_device(struct nfc_dev *dev) - { -- struct nfc_llcp_local *local = nfc_llcp_find_local(dev); -+ struct nfc_llcp_local *local = nfc_llcp_remove_local(dev); - - if (local == NULL) { - pr_debug("No such device\n"); -diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c -index bd2174699af97..aea337d817025 100644 ---- a/net/nfc/llcp_sock.c -+++ b/net/nfc/llcp_sock.c -@@ -99,7 +99,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) - } - - llcp_sock->dev = dev; -- llcp_sock->local = nfc_llcp_local_get(local); -+ llcp_sock->local = local; - llcp_sock->nfc_protocol = llcp_addr.nfc_protocol; - llcp_sock->service_name_len = min_t(unsigned int, - llcp_addr.service_name_len, -@@ -181,7 +181,7 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr, - } - - llcp_sock->dev = dev; -- llcp_sock->local = nfc_llcp_local_get(local); -+ llcp_sock->local = local; - llcp_sock->nfc_protocol = llcp_addr.nfc_protocol; - - nfc_llcp_sock_link(&local->raw_sockets, sk); -@@ -698,24 +698,22 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, - if (dev->dep_link_up == false) { - ret = -ENOLINK; - device_unlock(&dev->dev); -- goto put_dev; -+ goto sock_llcp_put_local; - } - device_unlock(&dev->dev); - - if (local->rf_mode == NFC_RF_INITIATOR && - addr->target_idx != local->target_idx) { - ret = -ENOLINK; -- goto put_dev; -+ goto sock_llcp_put_local; - } - - llcp_sock->dev = dev; -- llcp_sock->local = nfc_llcp_local_get(local); -+ llcp_sock->local = local; - llcp_sock->ssap = nfc_llcp_get_local_ssap(local); - if (llcp_sock->ssap == LLCP_SAP_MAX) { -- nfc_llcp_local_put(llcp_sock->local); -- llcp_sock->local = NULL; - ret = -ENOMEM; -- goto put_dev; -+ goto sock_llcp_nullify; - } - - llcp_sock->reserved_ssap = llcp_sock->ssap; -@@ -760,8 +758,13 @@ sock_unlink: - - sock_llcp_release: - nfc_llcp_put_ssap(local, llcp_sock->ssap); -- nfc_llcp_local_put(llcp_sock->local); -+ -+sock_llcp_nullify: - llcp_sock->local = NULL; -+ llcp_sock->dev = NULL; -+ -+sock_llcp_put_local: -+ nfc_llcp_local_put(local); - - put_dev: - nfc_put_device(dev); -diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c -index 66ab97131fd24..5b55466fe315a 100644 ---- a/net/nfc/netlink.c -+++ b/net/nfc/netlink.c -@@ -1047,11 +1047,14 @@ static int nfc_genl_llc_get_params(struct sk_buff *skb, struct genl_info *info) - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (!msg) { - rc = -ENOMEM; -- goto exit; -+ goto put_local; - } - - rc = nfc_genl_send_params(msg, local, info->snd_portid, info->snd_seq); - -+put_local: -+ nfc_llcp_local_put(local); -+ - exit: - device_unlock(&dev->dev); - -@@ -1113,7 +1116,7 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info) - if (info->attrs[NFC_ATTR_LLC_PARAM_LTO]) { - if (dev->dep_link_up) { - rc = -EINPROGRESS; -- goto exit; -+ goto put_local; - } - - local->lto = nla_get_u8(info->attrs[NFC_ATTR_LLC_PARAM_LTO]); -@@ -1125,6 +1128,9 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info) - if (info->attrs[NFC_ATTR_LLC_PARAM_MIUX]) - local->miux = cpu_to_be16(miux); - -+put_local: -+ nfc_llcp_local_put(local); -+ - exit: - device_unlock(&dev->dev); - -@@ -1180,7 +1186,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) - - if (rc != 0) { - rc = -EINVAL; -- goto exit; -+ goto put_local; - } - - if (!sdp_attrs[NFC_SDP_ATTR_URI]) -@@ -1199,7 +1205,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) - sdreq = nfc_llcp_build_sdreq_tlv(tid, uri, uri_len); - if (sdreq == NULL) { - rc = -ENOMEM; -- goto exit; -+ goto put_local; - } - - tlvs_len += sdreq->tlv_len; -@@ -1209,10 +1215,14 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) - - if (hlist_empty(&sdreq_list)) { - rc = -EINVAL; -- goto exit; -+ goto put_local; - } - - rc = nfc_llcp_send_snl_sdreq(local, &sdreq_list, tlvs_len); -+ -+put_local: -+ nfc_llcp_local_put(local); -+ - exit: - device_unlock(&dev->dev); - -diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h -index 889fefd64e56b..0b1e6466f4fbf 100644 ---- a/net/nfc/nfc.h -+++ b/net/nfc/nfc.h -@@ -48,10 +48,11 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx, - u8 comm_mode, u8 rf_mode); - int nfc_llcp_register_device(struct nfc_dev *dev); - void nfc_llcp_unregister_device(struct nfc_dev *dev); --int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len); -+int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len); - u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len); - int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb); - struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev); -+int nfc_llcp_local_put(struct nfc_llcp_local *local); - int __init nfc_llcp_init(void); - void nfc_llcp_exit(void); - void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp); -diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c -index f095a0fb75c6d..bf74f3f4c7522 100644 ---- a/net/sched/act_pedit.c -+++ b/net/sched/act_pedit.c -@@ -26,6 +26,7 @@ static struct tc_action_ops act_pedit_ops; - - static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = { - [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) }, -+ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) }, - [TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED }, - }; - -diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c -index f21c97f02d361..c92318f68f92d 100644 ---- a/net/sched/cls_flower.c -+++ b/net/sched/cls_flower.c -@@ -719,7 +719,8 @@ static void fl_set_key_val(struct nlattr **tb, - } - - static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key, -- struct fl_flow_key *mask) -+ struct fl_flow_key *mask, -+ struct netlink_ext_ack *extack) - { - fl_set_key_val(tb, &key->tp_range.tp_min.dst, - TCA_FLOWER_KEY_PORT_DST_MIN, &mask->tp_range.tp_min.dst, -@@ -734,13 +735,32 @@ static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key, - TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_range.tp_max.src, - TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src)); - -- if ((mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst && -- htons(key->tp_range.tp_max.dst) <= -- htons(key->tp_range.tp_min.dst)) || -- (mask->tp_range.tp_min.src && mask->tp_range.tp_max.src && -- htons(key->tp_range.tp_max.src) <= -- htons(key->tp_range.tp_min.src))) -+ if (mask->tp_range.tp_min.dst != mask->tp_range.tp_max.dst) { -+ NL_SET_ERR_MSG(extack, -+ "Both min and max destination ports must be specified"); - return -EINVAL; -+ } -+ if (mask->tp_range.tp_min.src != mask->tp_range.tp_max.src) { -+ NL_SET_ERR_MSG(extack, -+ "Both min and max source ports must be specified"); -+ return -EINVAL; -+ } -+ if (mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst && -+ htons(key->tp_range.tp_max.dst) <= -+ htons(key->tp_range.tp_min.dst)) { -+ NL_SET_ERR_MSG_ATTR(extack, -+ tb[TCA_FLOWER_KEY_PORT_DST_MIN], -+ "Invalid destination port range (min must be strictly smaller than max)"); -+ return -EINVAL; -+ } -+ if (mask->tp_range.tp_min.src && mask->tp_range.tp_max.src && -+ htons(key->tp_range.tp_max.src) <= -+ htons(key->tp_range.tp_min.src)) { -+ NL_SET_ERR_MSG_ATTR(extack, -+ tb[TCA_FLOWER_KEY_PORT_SRC_MIN], -+ "Invalid source port range (min must be strictly smaller than max)"); -+ return -EINVAL; -+ } - - return 0; - } -@@ -1211,7 +1231,7 @@ static int fl_set_key(struct net *net, struct nlattr **tb, - if (key->basic.ip_proto == IPPROTO_TCP || - key->basic.ip_proto == IPPROTO_UDP || - key->basic.ip_proto == IPPROTO_SCTP) { -- ret = fl_set_key_port_range(tb, key, mask); -+ ret = fl_set_key_port_range(tb, key, mask, extack); - if (ret) - return ret; - } -diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c -index ec945294626a8..41f0898a5a565 100644 ---- a/net/sched/cls_fw.c -+++ b/net/sched/cls_fw.c -@@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, - if (err < 0) - return err; - -- if (tb[TCA_FW_CLASSID]) { -- f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); -- tcf_bind_filter(tp, &f->res, base); -- } -- - if (tb[TCA_FW_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack); -@@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, - } else if (head->mask != 0xFFFFFFFF) - return err; - -+ if (tb[TCA_FW_CLASSID]) { -+ f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); -+ tcf_bind_filter(tp, &f->res, base); -+ } -+ - return 0; - } - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index bf3fed5b91d2b..7cff1a031f761 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -362,9 +362,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp) - struct net *net = sock_net(&sp->inet.sk); - - if (net->sctp.default_auto_asconf) { -- spin_lock(&net->sctp.addr_wq_lock); -+ spin_lock_bh(&net->sctp.addr_wq_lock); - list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist); -- spin_unlock(&net->sctp.addr_wq_lock); -+ spin_unlock_bh(&net->sctp.addr_wq_lock); - sp->do_auto_asconf = 1; - } - } -diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c -index d52abde51f1b4..aeb0b3e48ad59 100644 ---- a/net/sunrpc/svcsock.c -+++ b/net/sunrpc/svcsock.c -@@ -728,12 +728,6 @@ static void svc_tcp_listen_data_ready(struct sock *sk) - dprintk("svc: socket %p TCP (listen) state change %d\n", - sk, sk->sk_state); - -- if (svsk) { -- /* Refer to svc_setup_socket() for details. */ -- rmb(); -- svsk->sk_odata(sk); -- } -- - /* - * This callback may called twice when a new connection - * is established as a child socket inherits everything -@@ -742,15 +736,20 @@ static void svc_tcp_listen_data_ready(struct sock *sk) - * when one of child sockets become ESTABLISHED. - * 2) data_ready method of the child socket may be called - * when it receives data before the socket is accepted. -- * In case of 2, we should ignore it silently. -+ * In case of 2, we should ignore it silently and DO NOT -+ * dereference svsk. - */ -- if (sk->sk_state == TCP_LISTEN) { -- if (svsk) { -- set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags); -- svc_xprt_enqueue(&svsk->sk_xprt); -- } else -- printk("svc: socket %p: no user data\n", sk); -- } -+ if (sk->sk_state != TCP_LISTEN) -+ return; -+ -+ if (svsk) { -+ /* Refer to svc_setup_socket() for details. */ -+ rmb(); -+ svsk->sk_odata(sk); -+ set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags); -+ svc_xprt_enqueue(&svsk->sk_xprt); -+ } else -+ printk("svc: socket %p: no user data\n", sk); - } - - /* -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index c4c124cb5332b..e35c54ba2fd56 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -223,117 +223,152 @@ bool cfg80211_is_element_inherited(const struct element *elem, - } - EXPORT_SYMBOL(cfg80211_is_element_inherited); - --static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, -- const u8 *subelement, size_t subie_len, -- u8 *new_ie, gfp_t gfp) -+static size_t cfg80211_copy_elem_with_frags(const struct element *elem, -+ const u8 *ie, size_t ie_len, -+ u8 **pos, u8 *buf, size_t buf_len) - { -- u8 *pos, *tmp; -- const u8 *tmp_old, *tmp_new; -- const struct element *non_inherit_elem; -- u8 *sub_copy; -+ if (WARN_ON((u8 *)elem < ie || elem->data > ie + ie_len || -+ elem->data + elem->datalen > ie + ie_len)) -+ return 0; - -- /* copy subelement as we need to change its content to -- * mark an ie after it is processed. -- */ -- sub_copy = kmemdup(subelement, subie_len, gfp); -- if (!sub_copy) -+ if (elem->datalen + 2 > buf + buf_len - *pos) - return 0; - -- pos = &new_ie[0]; -+ memcpy(*pos, elem, elem->datalen + 2); -+ *pos += elem->datalen + 2; - -- /* set new ssid */ -- tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len); -- if (tmp_new) { -- memcpy(pos, tmp_new, tmp_new[1] + 2); -- pos += (tmp_new[1] + 2); -+ /* Finish if it is not fragmented */ -+ if (elem->datalen != 255) -+ return *pos - buf; -+ -+ ie_len = ie + ie_len - elem->data - elem->datalen; -+ ie = (const u8 *)elem->data + elem->datalen; -+ -+ for_each_element(elem, ie, ie_len) { -+ if (elem->id != WLAN_EID_FRAGMENT) -+ break; -+ -+ if (elem->datalen + 2 > buf + buf_len - *pos) -+ return 0; -+ -+ memcpy(*pos, elem, elem->datalen + 2); -+ *pos += elem->datalen + 2; -+ -+ if (elem->datalen != 255) -+ break; - } - -- /* get non inheritance list if exists */ -- non_inherit_elem = -- cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, -- sub_copy, subie_len); -+ return *pos - buf; -+} - -- /* go through IEs in ie (skip SSID) and subelement, -- * merge them into new_ie -+static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, -+ const u8 *subie, size_t subie_len, -+ u8 *new_ie, size_t new_ie_len) -+{ -+ const struct element *non_inherit_elem, *parent, *sub; -+ u8 *pos = new_ie; -+ u8 id, ext_id; -+ unsigned int match_len; -+ -+ non_inherit_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, -+ subie, subie_len); -+ -+ /* We copy the elements one by one from the parent to the generated -+ * elements. -+ * If they are not inherited (included in subie or in the non -+ * inheritance element), then we copy all occurrences the first time -+ * we see this element type. - */ -- tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen); -- tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie; -- -- while (tmp_old + 2 - ie <= ielen && -- tmp_old + tmp_old[1] + 2 - ie <= ielen) { -- if (tmp_old[0] == 0) { -- tmp_old++; -+ for_each_element(parent, ie, ielen) { -+ if (parent->id == WLAN_EID_FRAGMENT) - continue; -+ -+ if (parent->id == WLAN_EID_EXTENSION) { -+ if (parent->datalen < 1) -+ continue; -+ -+ id = WLAN_EID_EXTENSION; -+ ext_id = parent->data[0]; -+ match_len = 1; -+ } else { -+ id = parent->id; -+ match_len = 0; - } - -- if (tmp_old[0] == WLAN_EID_EXTENSION) -- tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy, -- subie_len); -- else -- tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy, -- subie_len); -+ /* Find first occurrence in subie */ -+ sub = cfg80211_find_elem_match(id, subie, subie_len, -+ &ext_id, match_len, 0); - -- if (!tmp) { -- const struct element *old_elem = (void *)tmp_old; -+ /* Copy from parent if not in subie and inherited */ -+ if (!sub && -+ cfg80211_is_element_inherited(parent, non_inherit_elem)) { -+ if (!cfg80211_copy_elem_with_frags(parent, -+ ie, ielen, -+ &pos, new_ie, -+ new_ie_len)) -+ return 0; - -- /* ie in old ie but not in subelement */ -- if (cfg80211_is_element_inherited(old_elem, -- non_inherit_elem)) { -- memcpy(pos, tmp_old, tmp_old[1] + 2); -- pos += tmp_old[1] + 2; -- } -- } else { -- /* ie in transmitting ie also in subelement, -- * copy from subelement and flag the ie in subelement -- * as copied (by setting eid field to WLAN_EID_SSID, -- * which is skipped anyway). -- * For vendor ie, compare OUI + type + subType to -- * determine if they are the same ie. -- */ -- if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) { -- if (tmp_old[1] >= 5 && tmp[1] >= 5 && -- !memcmp(tmp_old + 2, tmp + 2, 5)) { -- /* same vendor ie, copy from -- * subelement -- */ -- memcpy(pos, tmp, tmp[1] + 2); -- pos += tmp[1] + 2; -- tmp[0] = WLAN_EID_SSID; -- } else { -- memcpy(pos, tmp_old, tmp_old[1] + 2); -- pos += tmp_old[1] + 2; -- } -- } else { -- /* copy ie from subelement into new ie */ -- memcpy(pos, tmp, tmp[1] + 2); -- pos += tmp[1] + 2; -- tmp[0] = WLAN_EID_SSID; -- } -+ continue; - } - -- if (tmp_old + tmp_old[1] + 2 - ie == ielen) -- break; -+ /* Already copied if an earlier element had the same type */ -+ if (cfg80211_find_elem_match(id, ie, (u8 *)parent - ie, -+ &ext_id, match_len, 0)) -+ continue; - -- tmp_old += tmp_old[1] + 2; -+ /* Not inheriting, copy all similar elements from subie */ -+ while (sub) { -+ if (!cfg80211_copy_elem_with_frags(sub, -+ subie, subie_len, -+ &pos, new_ie, -+ new_ie_len)) -+ return 0; -+ -+ sub = cfg80211_find_elem_match(id, -+ sub->data + sub->datalen, -+ subie_len + subie - -+ (sub->data + -+ sub->datalen), -+ &ext_id, match_len, 0); -+ } - } - -- /* go through subelement again to check if there is any ie not -- * copied to new ie, skip ssid, capability, bssid-index ie -+ /* The above misses elements that are included in subie but not in the -+ * parent, so do a pass over subie and append those. -+ * Skip the non-tx BSSID caps and non-inheritance element. - */ -- tmp_new = sub_copy; -- while (tmp_new + 2 - sub_copy <= subie_len && -- tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) { -- if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP || -- tmp_new[0] == WLAN_EID_SSID)) { -- memcpy(pos, tmp_new, tmp_new[1] + 2); -- pos += tmp_new[1] + 2; -+ for_each_element(sub, subie, subie_len) { -+ if (sub->id == WLAN_EID_NON_TX_BSSID_CAP) -+ continue; -+ -+ if (sub->id == WLAN_EID_FRAGMENT) -+ continue; -+ -+ if (sub->id == WLAN_EID_EXTENSION) { -+ if (sub->datalen < 1) -+ continue; -+ -+ id = WLAN_EID_EXTENSION; -+ ext_id = sub->data[0]; -+ match_len = 1; -+ -+ if (ext_id == WLAN_EID_EXT_NON_INHERITANCE) -+ continue; -+ } else { -+ id = sub->id; -+ match_len = 0; - } -- if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len) -- break; -- tmp_new += tmp_new[1] + 2; -+ -+ /* Processed if one was included in the parent */ -+ if (cfg80211_find_elem_match(id, ie, ielen, -+ &ext_id, match_len, 0)) -+ continue; -+ -+ if (!cfg80211_copy_elem_with_frags(sub, subie, subie_len, -+ &pos, new_ie, new_ie_len)) -+ return 0; - } - -- kfree(sub_copy); - return pos - new_ie; - } - -@@ -1659,7 +1694,7 @@ static void cfg80211_parse_mbssid_data(struct wiphy *wiphy, - new_ie_len = cfg80211_gen_new_ie(ie, ielen, - profile, - profile_len, new_ie, -- gfp); -+ IEEE80211_MAX_DATA_LEN); - if (!new_ie_len) - continue; - -diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c -index 76a80a41615be..a57f54bc0e1a7 100644 ---- a/net/wireless/wext-core.c -+++ b/net/wireless/wext-core.c -@@ -796,6 +796,12 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, - } - } - -+ /* Sanity-check to ensure we never end up _allocating_ zero -+ * bytes of data for extra. -+ */ -+ if (extra_size <= 0) -+ return -EFAULT; -+ - /* kzalloc() ensures NULL-termination for essid_compat. */ - extra = kzalloc(extra_size, GFP_KERNEL); - if (!extra) -diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c -index 2bc0d6e3e124c..d04a2345bc3f5 100644 ---- a/net/xdp/xsk.c -+++ b/net/xdp/xsk.c -@@ -613,6 +613,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) - struct sock *sk = sock->sk; - struct xdp_sock *xs = xdp_sk(sk); - struct net_device *dev; -+ int bound_dev_if; - u32 flags, qid; - int err = 0; - -@@ -626,6 +627,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) - XDP_USE_NEED_WAKEUP)) - return -EINVAL; - -+ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if); -+ if (bound_dev_if && bound_dev_if != sxdp->sxdp_ifindex) -+ return -EINVAL; -+ - rtnl_lock(); - mutex_lock(&xs->mutex); - if (xs->state != XSK_READY) { -diff --git a/samples/bpf/tcp_basertt_kern.c b/samples/bpf/tcp_basertt_kern.c -index 9dba48c2b9207..66dd58f78d528 100644 ---- a/samples/bpf/tcp_basertt_kern.c -+++ b/samples/bpf/tcp_basertt_kern.c -@@ -47,7 +47,7 @@ int bpf_basertt(struct bpf_sock_ops *skops) - case BPF_SOCK_OPS_BASE_RTT: - n = bpf_getsockopt(skops, SOL_TCP, TCP_CONGESTION, - cong, sizeof(cong)); -- if (!n && !__builtin_memcmp(cong, nv, sizeof(nv)+1)) { -+ if (!n && !__builtin_memcmp(cong, nv, sizeof(nv))) { - /* Set base_rtt to 80us */ - rv = 80; - } else if (n) { -diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c -index e5aeaf72dcdb8..53e276bb24acd 100644 ---- a/scripts/mod/modpost.c -+++ b/scripts/mod/modpost.c -@@ -1325,6 +1325,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, - if (relsym->st_name != 0) - return relsym; - -+ /* -+ * Strive to find a better symbol name, but the resulting name may not -+ * match the symbol referenced in the original code. -+ */ - relsym_secindex = get_secindex(elf, relsym); - for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { - if (get_secindex(elf, sym) != relsym_secindex) -@@ -1629,7 +1633,7 @@ static void default_mismatch_handler(const char *modname, struct elf_info *elf, - - static int is_executable_section(struct elf_info* elf, unsigned int section_index) - { -- if (section_index > elf->num_sections) -+ if (section_index >= elf->num_sections) - fatal("section_index is outside elf->num_sections!\n"); - - return ((elf->sechdrs[section_index].sh_flags & SHF_EXECINSTR) == SHF_EXECINSTR); -@@ -1808,19 +1812,33 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) - #define R_ARM_THM_JUMP19 51 - #endif - -+static int32_t sign_extend32(int32_t value, int index) -+{ -+ uint8_t shift = 31 - index; -+ -+ return (int32_t)(value << shift) >> shift; -+} -+ - static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) - { - unsigned int r_typ = ELF_R_TYPE(r->r_info); -+ Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info); -+ void *loc = reloc_location(elf, sechdr, r); -+ uint32_t inst; -+ int32_t offset; - - switch (r_typ) { - case R_ARM_ABS32: -- /* From ARM ABI: (S + A) | T */ -- r->r_addend = (int)(long) -- (elf->symtab_start + ELF_R_SYM(r->r_info)); -+ inst = TO_NATIVE(*(uint32_t *)loc); -+ r->r_addend = inst + sym->st_value; - break; - case R_ARM_PC24: - case R_ARM_CALL: - case R_ARM_JUMP24: -+ inst = TO_NATIVE(*(uint32_t *)loc); -+ offset = sign_extend32((inst & 0x00ffffff) << 2, 25); -+ r->r_addend = offset + sym->st_value + 8; -+ break; - case R_ARM_THM_CALL: - case R_ARM_THM_JUMP24: - case R_ARM_THM_JUMP19: -diff --git a/scripts/tags.sh b/scripts/tags.sh -index 4e18ae5282a69..f667527ddff5c 100755 ---- a/scripts/tags.sh -+++ b/scripts/tags.sh -@@ -28,6 +28,13 @@ fi - # ignore userspace tools - ignore="$ignore ( -path ${tree}tools ) -prune -o" - -+# gtags(1) refuses to index any file outside of its current working dir. -+# If gtags indexing is requested and the build output directory is not -+# the kernel source tree, index all files in absolute-path form. -+if [[ "$1" == "gtags" && -n "${tree}" ]]; then -+ tree=$(realpath "$tree")/ -+fi -+ - # Detect if ALLSOURCE_ARCHS is set. If not, we assume SRCARCH - if [ "${ALLSOURCE_ARCHS}" = "" ]; then - ALLSOURCE_ARCHS=${SRCARCH} -@@ -134,7 +141,7 @@ docscope() - - dogtags() - { -- all_target_sources | gtags -i -f - -+ all_target_sources | gtags -i -C "${tree:-.}" -f - "$PWD" - } - - # Basic regular expressions with an optional /kind-spec/ for ctags and -diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c -index b82291d10e730..cc7e4e4439b0f 100644 ---- a/security/integrity/evm/evm_main.c -+++ b/security/integrity/evm/evm_main.c -@@ -471,7 +471,9 @@ void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name) - - /** - * evm_inode_setattr - prevent updating an invalid EVM extended attribute -+ * @idmap: idmap of the mount - * @dentry: pointer to the affected dentry -+ * @attr: iattr structure containing the new file attributes - * - * Permit update of file attributes when files have a valid EVM signature, - * except in the case of them having an immutable portable signature. -diff --git a/security/integrity/iint.c b/security/integrity/iint.c -index 0b9cb639a0ed0..ff37143000b4c 100644 ---- a/security/integrity/iint.c -+++ b/security/integrity/iint.c -@@ -43,12 +43,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) - else if (inode > iint->inode) - n = n->rb_right; - else -- break; -+ return iint; - } -- if (!n) -- return NULL; - -- return iint; -+ return NULL; - } - - /* -@@ -121,10 +119,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode) - parent = *p; - test_iint = rb_entry(parent, struct integrity_iint_cache, - rb_node); -- if (inode < test_iint->inode) -+ if (inode < test_iint->inode) { - p = &(*p)->rb_left; -- else -+ } else if (inode > test_iint->inode) { - p = &(*p)->rb_right; -+ } else { -+ write_unlock(&integrity_iint_lock); -+ kmem_cache_free(iint_cache, iint); -+ return test_iint; -+ } - } - - iint->inode = inode; -diff --git a/security/integrity/ima/ima_modsig.c b/security/integrity/ima/ima_modsig.c -index d106885cc4955..5fb971efc6e10 100644 ---- a/security/integrity/ima/ima_modsig.c -+++ b/security/integrity/ima/ima_modsig.c -@@ -109,6 +109,9 @@ int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len, - - /** - * ima_collect_modsig - Calculate the file hash without the appended signature. -+ * @modsig: parsed module signature -+ * @buf: data to verify the signature on -+ * @size: data size - * - * Since the modsig is part of the file contents, the hash used in its signature - * isn't the same one ordinarily calculated by IMA. Therefore PKCS7 code -diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c -index 6df0436462ab7..e749403f07a8b 100644 ---- a/security/integrity/ima/ima_policy.c -+++ b/security/integrity/ima/ima_policy.c -@@ -500,6 +500,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) - * @secid: LSM secid of the task to be validated - * @func: IMA hook identifier - * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) -+ * @flags: IMA actions to consider (e.g. IMA_MEASURE | IMA_APPRAISE) - * @pcr: set the pcr to extend - * @template_desc: the template that should be used for this rule - * -@@ -1266,7 +1267,7 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) - - /** - * ima_parse_add_rule - add a rule to ima_policy_rules -- * @rule - ima measurement policy rule -+ * @rule: ima measurement policy rule - * - * Avoid locking by allowing just one writer at a time in ima_write_policy() - * Returns the length of the rule parsed, an error code on failure -diff --git a/sound/core/jack.c b/sound/core/jack.c -index e7ac82d468216..c2022b13fddc9 100644 ---- a/sound/core/jack.c -+++ b/sound/core/jack.c -@@ -364,6 +364,7 @@ void snd_jack_report(struct snd_jack *jack, int status) - { - struct snd_jack_kctl *jack_kctl; - #ifdef CONFIG_SND_JACK_INPUT_DEV -+ struct input_dev *idev; - int i; - #endif - -@@ -375,30 +376,28 @@ void snd_jack_report(struct snd_jack *jack, int status) - status & jack_kctl->mask_bits); - - #ifdef CONFIG_SND_JACK_INPUT_DEV -- mutex_lock(&jack->input_dev_lock); -- if (!jack->input_dev) { -- mutex_unlock(&jack->input_dev_lock); -+ idev = input_get_device(jack->input_dev); -+ if (!idev) - return; -- } - - for (i = 0; i < ARRAY_SIZE(jack->key); i++) { - int testbit = SND_JACK_BTN_0 >> i; - - if (jack->type & testbit) -- input_report_key(jack->input_dev, jack->key[i], -+ input_report_key(idev, jack->key[i], - status & testbit); - } - - for (i = 0; i < ARRAY_SIZE(jack_switch_types); i++) { - int testbit = 1 << i; - if (jack->type & testbit) -- input_report_switch(jack->input_dev, -+ input_report_switch(idev, - jack_switch_types[i], - status & testbit); - } - -- input_sync(jack->input_dev); -- mutex_unlock(&jack->input_dev_lock); -+ input_sync(idev); -+ input_put_device(idev); - #endif /* CONFIG_SND_JACK_INPUT_DEV */ - } - EXPORT_SYMBOL(snd_jack_report); -diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c -index 83bb086bf9757..b920c739d6863 100644 ---- a/sound/pci/ac97/ac97_codec.c -+++ b/sound/pci/ac97/ac97_codec.c -@@ -2006,8 +2006,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, - .dev_disconnect = snd_ac97_dev_disconnect, - }; - -- if (rac97) -- *rac97 = NULL; -+ if (!rac97) -+ return -EINVAL; - if (snd_BUG_ON(!bus || !template)) - return -EINVAL; - if (snd_BUG_ON(template->num >= 4)) -diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c -index efeffa0bf2d78..131f41cccbe65 100644 ---- a/sound/soc/codecs/es8316.c -+++ b/sound/soc/codecs/es8316.c -@@ -52,7 +52,12 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(dac_vol_tlv, -9600, 50, 1); - static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1); - static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0); - static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0); --static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0); -+ -+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(alc_target_tlv, -+ 0, 10, TLV_DB_SCALE_ITEM(-1650, 150, 0), -+ 11, 11, TLV_DB_SCALE_ITEM(-150, 0, 0), -+); -+ - static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpmixer_gain_tlv, - 0, 4, TLV_DB_SCALE_ITEM(-1200, 150, 0), - 8, 11, TLV_DB_SCALE_ITEM(-450, 150, 0), -@@ -115,7 +120,7 @@ static const struct snd_kcontrol_new es8316_snd_controls[] = { - alc_max_gain_tlv), - SOC_SINGLE_TLV("ALC Capture Min Volume", ES8316_ADC_ALC2, 0, 28, 0, - alc_min_gain_tlv), -- SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 10, 0, -+ SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 11, 0, - alc_target_tlv), - SOC_SINGLE("ALC Capture Hold Time", ES8316_ADC_ALC3, 0, 10, 0), - SOC_SINGLE("ALC Capture Decay Time", ES8316_ADC_ALC4, 4, 10, 0), -@@ -364,13 +369,11 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai, - int count = 0; - - es8316->sysclk = freq; -+ es8316->sysclk_constraints.list = NULL; -+ es8316->sysclk_constraints.count = 0; - -- if (freq == 0) { -- es8316->sysclk_constraints.list = NULL; -- es8316->sysclk_constraints.count = 0; -- -+ if (freq == 0) - return 0; -- } - - ret = clk_set_rate(es8316->mclk, freq); - if (ret) -@@ -386,8 +389,10 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai, - es8316->allowed_rates[count++] = freq / ratio; - } - -- es8316->sysclk_constraints.list = es8316->allowed_rates; -- es8316->sysclk_constraints.count = count; -+ if (count) { -+ es8316->sysclk_constraints.list = es8316->allowed_rates; -+ es8316->sysclk_constraints.count = count; -+ } - - return 0; - } -diff --git a/sound/soc/fsl/imx-audmix.c b/sound/soc/fsl/imx-audmix.c -index 71590ca6394b9..08c044a72250a 100644 ---- a/sound/soc/fsl/imx-audmix.c -+++ b/sound/soc/fsl/imx-audmix.c -@@ -230,6 +230,8 @@ static int imx_audmix_probe(struct platform_device *pdev) - - dai_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%s", - fe_name_pref, args.np->full_name + 1); -+ if (!dai_name) -+ return -ENOMEM; - - dev_info(pdev->dev.parent, "DAI FE name:%s\n", dai_name); - -@@ -238,6 +240,8 @@ static int imx_audmix_probe(struct platform_device *pdev) - capture_dai_name = - devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s", - dai_name, "CPU-Capture"); -+ if (!capture_dai_name) -+ return -ENOMEM; - } - - priv->dai[i].cpus = &dlc[0]; -@@ -268,6 +272,8 @@ static int imx_audmix_probe(struct platform_device *pdev) - "AUDMIX-Playback-%d", i); - be_cp = devm_kasprintf(&pdev->dev, GFP_KERNEL, - "AUDMIX-Capture-%d", i); -+ if (!be_name || !be_pb || !be_cp) -+ return -ENOMEM; - - priv->dai[num_dai + i].cpus = &dlc[3]; - priv->dai[num_dai + i].codecs = &dlc[4]; -@@ -295,6 +301,9 @@ static int imx_audmix_probe(struct platform_device *pdev) - priv->dapm_routes[i].source = - devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s", - dai_name, "CPU-Playback"); -+ if (!priv->dapm_routes[i].source) -+ return -ENOMEM; -+ - priv->dapm_routes[i].sink = be_pb; - priv->dapm_routes[num_dai + i].source = be_pb; - priv->dapm_routes[num_dai + i].sink = be_cp; -diff --git a/tools/perf/tests/shell/test_uprobe_from_different_cu.sh b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh -new file mode 100644 -index 0000000000000..00d2e0e2e0c28 ---- /dev/null -+++ b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh -@@ -0,0 +1,77 @@ -+#!/bin/bash -+# test perf probe of function from different CU -+# SPDX-License-Identifier: GPL-2.0 -+ -+set -e -+ -+temp_dir=$(mktemp -d /tmp/perf-uprobe-different-cu-sh.XXXXXXXXXX) -+ -+cleanup() -+{ -+ trap - EXIT TERM INT -+ if [[ "${temp_dir}" =~ ^/tmp/perf-uprobe-different-cu-sh.*$ ]]; then -+ echo "--- Cleaning up ---" -+ perf probe -x ${temp_dir}/testfile -d foo -+ rm -f "${temp_dir}/"* -+ rmdir "${temp_dir}" -+ fi -+} -+ -+trap_cleanup() -+{ -+ cleanup -+ exit 1 -+} -+ -+trap trap_cleanup EXIT TERM INT -+ -+cat > ${temp_dir}/testfile-foo.h << EOF -+struct t -+{ -+ int *p; -+ int c; -+}; -+ -+extern int foo (int i, struct t *t); -+EOF -+ -+cat > ${temp_dir}/testfile-foo.c << EOF -+#include "testfile-foo.h" -+ -+int -+foo (int i, struct t *t) -+{ -+ int j, res = 0; -+ for (j = 0; j < i && j < t->c; j++) -+ res += t->p[j]; -+ -+ return res; -+} -+EOF -+ -+cat > ${temp_dir}/testfile-main.c << EOF -+#include "testfile-foo.h" -+ -+static struct t g; -+ -+int -+main (int argc, char **argv) -+{ -+ int i; -+ int j[argc]; -+ g.c = argc; -+ g.p = j; -+ for (i = 0; i < argc; i++) -+ j[i] = (int) argv[i][0]; -+ return foo (3, &g); -+} -+EOF -+ -+gcc -g -Og -flto -c ${temp_dir}/testfile-foo.c -o ${temp_dir}/testfile-foo.o -+gcc -g -Og -c ${temp_dir}/testfile-main.c -o ${temp_dir}/testfile-main.o -+gcc -g -Og -o ${temp_dir}/testfile ${temp_dir}/testfile-foo.o ${temp_dir}/testfile-main.o -+ -+perf probe -x ${temp_dir}/testfile --funcs foo -+perf probe -x ${temp_dir}/testfile foo -+ -+cleanup -diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c -index f1e2f566ce6fc..1d51aa88f4cb6 100644 ---- a/tools/perf/util/dwarf-aux.c -+++ b/tools/perf/util/dwarf-aux.c -@@ -1007,7 +1007,7 @@ int die_get_varname(Dwarf_Die *vr_die, struct strbuf *buf) - ret = die_get_typename(vr_die, buf); - if (ret < 0) { - pr_debug("Failed to get type, make it unknown.\n"); -- ret = strbuf_add(buf, " (unknown_type)", 14); -+ ret = strbuf_add(buf, "(unknown_type)", 14); - } - - return ret < 0 ? ret : strbuf_addf(buf, "\t%s", dwarf_diename(vr_die)); -diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh -index 911c549f186fb..3b929e031f59c 100755 ---- a/tools/testing/selftests/net/rtnetlink.sh -+++ b/tools/testing/selftests/net/rtnetlink.sh -@@ -833,6 +833,7 @@ EOF - fi - - # clean up any leftovers -+ echo 0 > /sys/bus/netdevsim/del_device - $probed && rmmod netdevsim - - if [ $ret -ne 0 ]; then -diff --git a/tools/testing/selftests/tc-testing/settings b/tools/testing/selftests/tc-testing/settings -new file mode 100644 -index 0000000000000..e2206265f67c7 ---- /dev/null -+++ b/tools/testing/selftests/tc-testing/settings -@@ -0,0 +1 @@ -+timeout=900 diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.251-252.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.251-252.patch deleted file mode 100644 index c230d38f9..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.251-252.patch +++ /dev/null @@ -1,2163 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu -index 726ac2e01b777..08e153614e094 100644 ---- a/Documentation/ABI/testing/sysfs-devices-system-cpu -+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu -@@ -480,16 +480,17 @@ Description: information about CPUs heterogeneity. - cpu_capacity: capacity of cpu#. - - What: /sys/devices/system/cpu/vulnerabilities -+ /sys/devices/system/cpu/vulnerabilities/gather_data_sampling -+ /sys/devices/system/cpu/vulnerabilities/itlb_multihit -+ /sys/devices/system/cpu/vulnerabilities/l1tf -+ /sys/devices/system/cpu/vulnerabilities/mds - /sys/devices/system/cpu/vulnerabilities/meltdown -+ /sys/devices/system/cpu/vulnerabilities/mmio_stale_data -+ /sys/devices/system/cpu/vulnerabilities/spec_store_bypass - /sys/devices/system/cpu/vulnerabilities/spectre_v1 - /sys/devices/system/cpu/vulnerabilities/spectre_v2 -- /sys/devices/system/cpu/vulnerabilities/spec_store_bypass -- /sys/devices/system/cpu/vulnerabilities/l1tf -- /sys/devices/system/cpu/vulnerabilities/mds - /sys/devices/system/cpu/vulnerabilities/srbds - /sys/devices/system/cpu/vulnerabilities/tsx_async_abort -- /sys/devices/system/cpu/vulnerabilities/itlb_multihit -- /sys/devices/system/cpu/vulnerabilities/mmio_stale_data - Date: January 2018 - Contact: Linux kernel mailing list - Description: Information about CPU vulnerabilities -diff --git a/Documentation/admin-guide/hw-vuln/gather_data_sampling.rst b/Documentation/admin-guide/hw-vuln/gather_data_sampling.rst -new file mode 100644 -index 0000000000000..264bfa937f7de ---- /dev/null -+++ b/Documentation/admin-guide/hw-vuln/gather_data_sampling.rst -@@ -0,0 +1,109 @@ -+.. SPDX-License-Identifier: GPL-2.0 -+ -+GDS - Gather Data Sampling -+========================== -+ -+Gather Data Sampling is a hardware vulnerability which allows unprivileged -+speculative access to data which was previously stored in vector registers. -+ -+Problem -+------- -+When a gather instruction performs loads from memory, different data elements -+are merged into the destination vector register. However, when a gather -+instruction that is transiently executed encounters a fault, stale data from -+architectural or internal vector registers may get transiently forwarded to the -+destination vector register instead. This will allow a malicious attacker to -+infer stale data using typical side channel techniques like cache timing -+attacks. GDS is a purely sampling-based attack. -+ -+The attacker uses gather instructions to infer the stale vector register data. -+The victim does not need to do anything special other than use the vector -+registers. The victim does not need to use gather instructions to be -+vulnerable. -+ -+Because the buffers are shared between Hyper-Threads cross Hyper-Thread attacks -+are possible. -+ -+Attack scenarios -+---------------- -+Without mitigation, GDS can infer stale data across virtually all -+permission boundaries: -+ -+ Non-enclaves can infer SGX enclave data -+ Userspace can infer kernel data -+ Guests can infer data from hosts -+ Guest can infer guest from other guests -+ Users can infer data from other users -+ -+Because of this, it is important to ensure that the mitigation stays enabled in -+lower-privilege contexts like guests and when running outside SGX enclaves. -+ -+The hardware enforces the mitigation for SGX. Likewise, VMMs should ensure -+that guests are not allowed to disable the GDS mitigation. If a host erred and -+allowed this, a guest could theoretically disable GDS mitigation, mount an -+attack, and re-enable it. -+ -+Mitigation mechanism -+-------------------- -+This issue is mitigated in microcode. The microcode defines the following new -+bits: -+ -+ ================================ === ============================ -+ IA32_ARCH_CAPABILITIES[GDS_CTRL] R/O Enumerates GDS vulnerability -+ and mitigation support. -+ IA32_ARCH_CAPABILITIES[GDS_NO] R/O Processor is not vulnerable. -+ IA32_MCU_OPT_CTRL[GDS_MITG_DIS] R/W Disables the mitigation -+ 0 by default. -+ IA32_MCU_OPT_CTRL[GDS_MITG_LOCK] R/W Locks GDS_MITG_DIS=0. Writes -+ to GDS_MITG_DIS are ignored -+ Can't be cleared once set. -+ ================================ === ============================ -+ -+GDS can also be mitigated on systems that don't have updated microcode by -+disabling AVX. This can be done by setting gather_data_sampling="force" or -+"clearcpuid=avx" on the kernel command-line. -+ -+If used, these options will disable AVX use by turning off XSAVE YMM support. -+However, the processor will still enumerate AVX support. Userspace that -+does not follow proper AVX enumeration to check both AVX *and* XSAVE YMM -+support will break. -+ -+Mitigation control on the kernel command line -+--------------------------------------------- -+The mitigation can be disabled by setting "gather_data_sampling=off" or -+"mitigations=off" on the kernel command line. Not specifying either will default -+to the mitigation being enabled. Specifying "gather_data_sampling=force" will -+use the microcode mitigation when available or disable AVX on affected systems -+where the microcode hasn't been updated to include the mitigation. -+ -+GDS System Information -+------------------------ -+The kernel provides vulnerability status information through sysfs. For -+GDS this can be accessed by the following sysfs file: -+ -+/sys/devices/system/cpu/vulnerabilities/gather_data_sampling -+ -+The possible values contained in this file are: -+ -+ ============================== ============================================= -+ Not affected Processor not vulnerable. -+ Vulnerable Processor vulnerable and mitigation disabled. -+ Vulnerable: No microcode Processor vulnerable and microcode is missing -+ mitigation. -+ Mitigation: AVX disabled, -+ no microcode Processor is vulnerable and microcode is missing -+ mitigation. AVX disabled as mitigation. -+ Mitigation: Microcode Processor is vulnerable and mitigation is in -+ effect. -+ Mitigation: Microcode (locked) Processor is vulnerable and mitigation is in -+ effect and cannot be disabled. -+ Unknown: Dependent on -+ hypervisor status Running on a virtual guest processor that is -+ affected but with no way to know if host -+ processor is mitigated or vulnerable. -+ ============================== ============================================= -+ -+GDS Default mitigation -+---------------------- -+The updated microcode will enable the mitigation by default. The kernel's -+default action is to leave the mitigation enabled. -diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst -index 2adec1e6520a6..245468b0f2be8 100644 ---- a/Documentation/admin-guide/hw-vuln/index.rst -+++ b/Documentation/admin-guide/hw-vuln/index.rst -@@ -16,3 +16,4 @@ are configurable at compile, boot or run time. - multihit.rst - special-register-buffer-data-sampling.rst - processor_mmio_stale_data.rst -+ gather_data_sampling.rst -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index 9d2185616d1ab..51f845419b9c7 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -1336,6 +1336,26 @@ - Format: off | on - default: on - -+ gather_data_sampling= -+ [X86,INTEL] Control the Gather Data Sampling (GDS) -+ mitigation. -+ -+ Gather Data Sampling is a hardware vulnerability which -+ allows unprivileged speculative access to data which was -+ previously stored in vector registers. -+ -+ This issue is mitigated by default in updated microcode. -+ The mitigation may have a performance impact but can be -+ disabled. On systems without the microcode mitigation -+ disabling AVX serves as a mitigation. -+ -+ force: Disable AVX to mitigate systems without -+ microcode mitigation. No effect if the microcode -+ mitigation is present. Known to cause crashes in -+ userspace with buggy AVX enumeration. -+ -+ off: Disable GDS mitigation. -+ - gcov_persist= [GCOV] When non-zero (default), profiling data for - kernel modules is saved and remains accessible via - debugfs, even when the module is unloaded/reloaded. -@@ -2696,21 +2716,22 @@ - Disable all optional CPU mitigations. This - improves system performance, but it may also - expose users to several CPU vulnerabilities. -- Equivalent to: nopti [X86,PPC] -+ Equivalent to: gather_data_sampling=off [X86] - kpti=0 [ARM64] -- nospectre_v1 [X86,PPC] -+ kvm.nx_huge_pages=off [X86] -+ l1tf=off [X86] -+ mds=off [X86] -+ mmio_stale_data=off [X86] -+ no_entry_flush [PPC] -+ no_uaccess_flush [PPC] - nobp=0 [S390] -+ nopti [X86,PPC] -+ nospectre_v1 [X86,PPC] - nospectre_v2 [X86,PPC,S390,ARM64] -- spectre_v2_user=off [X86] - spec_store_bypass_disable=off [X86,PPC] -+ spectre_v2_user=off [X86] - ssbd=force-off [ARM64] -- l1tf=off [X86] -- mds=off [X86] - tsx_async_abort=off [X86] -- kvm.nx_huge_pages=off [X86] -- no_entry_flush [PPC] -- no_uaccess_flush [PPC] -- mmio_stale_data=off [X86] - - Exceptions: - This does not have any effect on -diff --git a/Makefile b/Makefile -index 0b17d6936c2f9..be75dc3ae8de0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 251 -+SUBLEVEL = 252 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/Kconfig b/arch/Kconfig -index 2219a07dca1ef..4d03616bf5970 100644 ---- a/arch/Kconfig -+++ b/arch/Kconfig -@@ -271,6 +271,9 @@ config ARCH_HAS_UNCACHED_SEGMENT - select ARCH_HAS_DMA_PREP_COHERENT - bool - -+config ARCH_HAS_CPU_FINALIZE_INIT -+ bool -+ - # Select if arch init_task must go in the __init_task_data section - config ARCH_TASK_STRUCT_ON_STACK - bool -diff --git a/arch/alpha/include/asm/bugs.h b/arch/alpha/include/asm/bugs.h -deleted file mode 100644 -index 78030d1c7e7e0..0000000000000 ---- a/arch/alpha/include/asm/bugs.h -+++ /dev/null -@@ -1,20 +0,0 @@ --/* -- * include/asm-alpha/bugs.h -- * -- * Copyright (C) 1994 Linus Torvalds -- */ -- --/* -- * This is included by init/main.c to check for architecture-dependent bugs. -- * -- * Needs: -- * void check_bugs(void); -- */ -- --/* -- * I don't know of any alpha bugs yet.. Nice chip -- */ -- --static void check_bugs(void) --{ --} -diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig -index a70696a95b795..2feb5dade1214 100644 ---- a/arch/arm/Kconfig -+++ b/arch/arm/Kconfig -@@ -5,6 +5,7 @@ config ARM - select ARCH_32BIT_OFF_T - select ARCH_CLOCKSOURCE_DATA - select ARCH_HAS_BINFMT_FLAT -+ select ARCH_HAS_CPU_FINALIZE_INIT if MMU - select ARCH_HAS_DEBUG_VIRTUAL if MMU - select ARCH_HAS_DEVMEM_IS_ALLOWED - select ARCH_HAS_DMA_COHERENT_TO_PFN if SWIOTLB -diff --git a/arch/arm/include/asm/bugs.h b/arch/arm/include/asm/bugs.h -index 97a312ba08401..fe385551edeca 100644 ---- a/arch/arm/include/asm/bugs.h -+++ b/arch/arm/include/asm/bugs.h -@@ -1,7 +1,5 @@ - /* SPDX-License-Identifier: GPL-2.0-only */ - /* -- * arch/arm/include/asm/bugs.h -- * - * Copyright (C) 1995-2003 Russell King - */ - #ifndef __ASM_BUGS_H -@@ -10,10 +8,8 @@ - extern void check_writebuffer_bugs(void); - - #ifdef CONFIG_MMU --extern void check_bugs(void); - extern void check_other_bugs(void); - #else --#define check_bugs() do { } while (0) - #define check_other_bugs() do { } while (0) - #endif - -diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c -index 14c8dbbb7d2df..087bce6ec8e9b 100644 ---- a/arch/arm/kernel/bugs.c -+++ b/arch/arm/kernel/bugs.c -@@ -1,5 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0 - #include -+#include - #include - #include - -@@ -11,7 +12,7 @@ void check_other_bugs(void) - #endif - } - --void __init check_bugs(void) -+void __init arch_cpu_finalize_init(void) - { - check_writebuffer_bugs(); - check_other_bugs(); -diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig -index 6a6036f16abe6..72dc0ac46d6b4 100644 ---- a/arch/ia64/Kconfig -+++ b/arch/ia64/Kconfig -@@ -8,6 +8,7 @@ menu "Processor type and features" - - config IA64 - bool -+ select ARCH_HAS_CPU_FINALIZE_INIT - select ARCH_MIGHT_HAVE_PC_PARPORT - select ARCH_MIGHT_HAVE_PC_SERIO - select ACPI -diff --git a/arch/ia64/include/asm/bugs.h b/arch/ia64/include/asm/bugs.h -deleted file mode 100644 -index 0d6b9bded56c6..0000000000000 ---- a/arch/ia64/include/asm/bugs.h -+++ /dev/null -@@ -1,20 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/* -- * This is included by init/main.c to check for architecture-dependent bugs. -- * -- * Needs: -- * void check_bugs(void); -- * -- * Based on . -- * -- * Modified 1998, 1999, 2003 -- * David Mosberger-Tang , Hewlett-Packard Co. -- */ --#ifndef _ASM_IA64_BUGS_H --#define _ASM_IA64_BUGS_H -- --#include -- --extern void check_bugs (void); -- --#endif /* _ASM_IA64_BUGS_H */ -diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c -index bb320c6d0cc98..6700f066f59c9 100644 ---- a/arch/ia64/kernel/setup.c -+++ b/arch/ia64/kernel/setup.c -@@ -1073,8 +1073,7 @@ cpu_init (void) - } - } - --void __init --check_bugs (void) -+void __init arch_cpu_finalize_init(void) - { - ia64_patch_mckinley_e9((unsigned long) __start___mckinley_e9_bundles, - (unsigned long) __end___mckinley_e9_bundles); -diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig -index 6663f1741798e..d84a6a63d36a1 100644 ---- a/arch/m68k/Kconfig -+++ b/arch/m68k/Kconfig -@@ -4,6 +4,7 @@ config M68K - default y - select ARCH_32BIT_OFF_T - select ARCH_HAS_BINFMT_FLAT -+ select ARCH_HAS_CPU_FINALIZE_INIT if MMU - select ARCH_HAS_DMA_PREP_COHERENT if HAS_DMA && MMU && !COLDFIRE - select ARCH_HAS_SYNC_DMA_FOR_DEVICE if HAS_DMA - select ARCH_MIGHT_HAVE_PC_PARPORT if ISA -diff --git a/arch/m68k/include/asm/bugs.h b/arch/m68k/include/asm/bugs.h -deleted file mode 100644 -index 745530651e0bf..0000000000000 ---- a/arch/m68k/include/asm/bugs.h -+++ /dev/null -@@ -1,21 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/* -- * include/asm-m68k/bugs.h -- * -- * Copyright (C) 1994 Linus Torvalds -- */ -- --/* -- * This is included by init/main.c to check for architecture-dependent bugs. -- * -- * Needs: -- * void check_bugs(void); -- */ -- --#ifdef CONFIG_MMU --extern void check_bugs(void); /* in arch/m68k/kernel/setup.c */ --#else --static void check_bugs(void) --{ --} --#endif -diff --git a/arch/m68k/kernel/setup_mm.c b/arch/m68k/kernel/setup_mm.c -index 528484feff800..a9ef8b6b01bc0 100644 ---- a/arch/m68k/kernel/setup_mm.c -+++ b/arch/m68k/kernel/setup_mm.c -@@ -10,6 +10,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -527,7 +528,7 @@ static int __init proc_hardware_init(void) - module_init(proc_hardware_init); - #endif - --void check_bugs(void) -+void __init arch_cpu_finalize_init(void) - { - #if defined(CONFIG_FPU) && !defined(CONFIG_M68KFPU_EMU) - if (m68k_fputype == 0) { -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 2811ecc1f3c71..a353d1d1b4571 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -5,6 +5,7 @@ config MIPS - select ARCH_32BIT_OFF_T if !64BIT - select ARCH_BINFMT_ELF_STATE if MIPS_FP_SUPPORT - select ARCH_CLOCKSOURCE_DATA -+ select ARCH_HAS_CPU_FINALIZE_INIT - select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST - select ARCH_HAS_UBSAN_SANITIZE_ALL - select ARCH_SUPPORTS_UPROBES -diff --git a/arch/mips/include/asm/bugs.h b/arch/mips/include/asm/bugs.h -index d8ab8b7129b53..6d04d7d3a8f2d 100644 ---- a/arch/mips/include/asm/bugs.h -+++ b/arch/mips/include/asm/bugs.h -@@ -1,17 +1,11 @@ - /* SPDX-License-Identifier: GPL-2.0 */ - /* -- * This is included by init/main.c to check for architecture-dependent bugs. -- * - * Copyright (C) 2007 Maciej W. Rozycki -- * -- * Needs: -- * void check_bugs(void); - */ - #ifndef _ASM_BUGS_H - #define _ASM_BUGS_H - - #include --#include - #include - - #include -@@ -31,17 +25,6 @@ static inline void check_bugs_early(void) - #endif - } - --static inline void check_bugs(void) --{ -- unsigned int cpu = smp_processor_id(); -- -- cpu_data[cpu].udelay_val = loops_per_jiffy; -- check_bugs32(); --#ifdef CONFIG_64BIT -- check_bugs64(); --#endif --} -- - static inline int r4k_daddiu_bug(void) - { - #ifdef CONFIG_64BIT -diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c -index d91b772214b5d..1c4114f8f9aa1 100644 ---- a/arch/mips/kernel/setup.c -+++ b/arch/mips/kernel/setup.c -@@ -11,6 +11,8 @@ - * Copyright (C) 2000, 2001, 2002, 2007 Maciej W. Rozycki - */ - #include -+#include -+#include - #include - #include - #include -@@ -812,3 +814,14 @@ static int __init setnocoherentio(char *str) - } - early_param("nocoherentio", setnocoherentio); - #endif -+ -+void __init arch_cpu_finalize_init(void) -+{ -+ unsigned int cpu = smp_processor_id(); -+ -+ cpu_data[cpu].udelay_val = loops_per_jiffy; -+ check_bugs32(); -+ -+ if (IS_ENABLED(CONFIG_CPU_R4X00_BUGS64)) -+ check_bugs64(); -+} -diff --git a/arch/parisc/include/asm/bugs.h b/arch/parisc/include/asm/bugs.h -deleted file mode 100644 -index 0a7f9db6bd1c7..0000000000000 ---- a/arch/parisc/include/asm/bugs.h -+++ /dev/null -@@ -1,20 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/* -- * include/asm-parisc/bugs.h -- * -- * Copyright (C) 1999 Mike Shaver -- */ -- --/* -- * This is included by init/main.c to check for architecture-dependent bugs. -- * -- * Needs: -- * void check_bugs(void); -- */ -- --#include -- --static inline void check_bugs(void) --{ --// identify_cpu(&boot_cpu_data); --} -diff --git a/arch/powerpc/include/asm/bugs.h b/arch/powerpc/include/asm/bugs.h -deleted file mode 100644 -index 01b8f6ca4dbbc..0000000000000 ---- a/arch/powerpc/include/asm/bugs.h -+++ /dev/null -@@ -1,15 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0-or-later */ --#ifndef _ASM_POWERPC_BUGS_H --#define _ASM_POWERPC_BUGS_H -- --/* -- */ -- --/* -- * This file is included by 'init/main.c' to check for -- * architecture-dependent bugs. -- */ -- --static inline void check_bugs(void) { } -- --#endif /* _ASM_POWERPC_BUGS_H */ -diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig -index f356ee674d89b..671897a680cae 100644 ---- a/arch/sh/Kconfig -+++ b/arch/sh/Kconfig -@@ -2,6 +2,7 @@ - config SUPERH - def_bool y - select ARCH_HAS_BINFMT_FLAT if !MMU -+ select ARCH_HAS_CPU_FINALIZE_INIT - select ARCH_HAS_PTE_SPECIAL - select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST - select ARCH_MIGHT_HAVE_PC_PARPORT -diff --git a/arch/sh/include/asm/bugs.h b/arch/sh/include/asm/bugs.h -deleted file mode 100644 -index 030df56bfdb20..0000000000000 ---- a/arch/sh/include/asm/bugs.h -+++ /dev/null -@@ -1,78 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --#ifndef __ASM_SH_BUGS_H --#define __ASM_SH_BUGS_H -- --/* -- * This is included by init/main.c to check for architecture-dependent bugs. -- * -- * Needs: -- * void check_bugs(void); -- */ -- --/* -- * I don't know of any Super-H bugs yet. -- */ -- --#include -- --extern void select_idle_routine(void); -- --static void __init check_bugs(void) --{ -- extern unsigned long loops_per_jiffy; -- char *p = &init_utsname()->machine[2]; /* "sh" */ -- -- select_idle_routine(); -- -- current_cpu_data.loops_per_jiffy = loops_per_jiffy; -- -- switch (current_cpu_data.family) { -- case CPU_FAMILY_SH2: -- *p++ = '2'; -- break; -- case CPU_FAMILY_SH2A: -- *p++ = '2'; -- *p++ = 'a'; -- break; -- case CPU_FAMILY_SH3: -- *p++ = '3'; -- break; -- case CPU_FAMILY_SH4: -- *p++ = '4'; -- break; -- case CPU_FAMILY_SH4A: -- *p++ = '4'; -- *p++ = 'a'; -- break; -- case CPU_FAMILY_SH4AL_DSP: -- *p++ = '4'; -- *p++ = 'a'; -- *p++ = 'l'; -- *p++ = '-'; -- *p++ = 'd'; -- *p++ = 's'; -- *p++ = 'p'; -- break; -- case CPU_FAMILY_SH5: -- *p++ = '6'; -- *p++ = '4'; -- break; -- case CPU_FAMILY_UNKNOWN: -- /* -- * Specifically use CPU_FAMILY_UNKNOWN rather than -- * default:, so we're able to have the compiler whine -- * about unhandled enumerations. -- */ -- break; -- } -- -- printk("CPU: %s\n", get_cpu_subtype(¤t_cpu_data)); -- --#ifndef __LITTLE_ENDIAN__ -- /* 'eb' means 'Endian Big' */ -- *p++ = 'e'; -- *p++ = 'b'; --#endif -- *p = '\0'; --} --#endif /* __ASM_SH_BUGS_H */ -diff --git a/arch/sh/include/asm/processor.h b/arch/sh/include/asm/processor.h -index 6fbf8c80e4981..386786b1594ab 100644 ---- a/arch/sh/include/asm/processor.h -+++ b/arch/sh/include/asm/processor.h -@@ -173,6 +173,8 @@ extern unsigned int instruction_size(unsigned int insn); - #define instruction_size(insn) (4) - #endif - -+void select_idle_routine(void); -+ - #endif /* __ASSEMBLY__ */ - - #ifdef CONFIG_SUPERH32 -diff --git a/arch/sh/kernel/idle.c b/arch/sh/kernel/idle.c -index c20fc5487e051..bcb8eabd76185 100644 ---- a/arch/sh/kernel/idle.c -+++ b/arch/sh/kernel/idle.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - #include - -diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c -index c25ee383cb83a..2221e057e6b41 100644 ---- a/arch/sh/kernel/setup.c -+++ b/arch/sh/kernel/setup.c -@@ -43,6 +43,7 @@ - #include - #include - #include -+#include - #include - - /* -@@ -362,3 +363,57 @@ int test_mode_pin(int pin) - { - return sh_mv.mv_mode_pins() & pin; - } -+ -+void __init arch_cpu_finalize_init(void) -+{ -+ char *p = &init_utsname()->machine[2]; /* "sh" */ -+ -+ select_idle_routine(); -+ -+ current_cpu_data.loops_per_jiffy = loops_per_jiffy; -+ -+ switch (current_cpu_data.family) { -+ case CPU_FAMILY_SH2: -+ *p++ = '2'; -+ break; -+ case CPU_FAMILY_SH2A: -+ *p++ = '2'; -+ *p++ = 'a'; -+ break; -+ case CPU_FAMILY_SH3: -+ *p++ = '3'; -+ break; -+ case CPU_FAMILY_SH4: -+ *p++ = '4'; -+ break; -+ case CPU_FAMILY_SH4A: -+ *p++ = '4'; -+ *p++ = 'a'; -+ break; -+ case CPU_FAMILY_SH4AL_DSP: -+ *p++ = '4'; -+ *p++ = 'a'; -+ *p++ = 'l'; -+ *p++ = '-'; -+ *p++ = 'd'; -+ *p++ = 's'; -+ *p++ = 'p'; -+ break; -+ case CPU_FAMILY_UNKNOWN: -+ /* -+ * Specifically use CPU_FAMILY_UNKNOWN rather than -+ * default:, so we're able to have the compiler whine -+ * about unhandled enumerations. -+ */ -+ break; -+ } -+ -+ pr_info("CPU: %s\n", get_cpu_subtype(¤t_cpu_data)); -+ -+#ifndef __LITTLE_ENDIAN__ -+ /* 'eb' means 'Endian Big' */ -+ *p++ = 'e'; -+ *p++ = 'b'; -+#endif -+ *p = '\0'; -+} -diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig -index 8cb5bb020b4b6..881f6a8491486 100644 ---- a/arch/sparc/Kconfig -+++ b/arch/sparc/Kconfig -@@ -52,6 +52,7 @@ config SPARC - config SPARC32 - def_bool !64BIT - select ARCH_32BIT_OFF_T -+ select ARCH_HAS_CPU_FINALIZE_INIT if !SMP - select ARCH_HAS_SYNC_DMA_FOR_CPU - select GENERIC_ATOMIC64 - select CLZ_TAB -diff --git a/arch/sparc/include/asm/bugs.h b/arch/sparc/include/asm/bugs.h -deleted file mode 100644 -index 02fa369b9c21f..0000000000000 ---- a/arch/sparc/include/asm/bugs.h -+++ /dev/null -@@ -1,18 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/* include/asm/bugs.h: Sparc probes for various bugs. -- * -- * Copyright (C) 1996, 2007 David S. Miller (davem@davemloft.net) -- */ -- --#ifdef CONFIG_SPARC32 --#include --#endif -- --extern unsigned long loops_per_jiffy; -- --static void __init check_bugs(void) --{ --#if defined(CONFIG_SPARC32) && !defined(CONFIG_SMP) -- cpu_data(0).udelay_val = loops_per_jiffy; --#endif --} -diff --git a/arch/sparc/kernel/setup_32.c b/arch/sparc/kernel/setup_32.c -index afe1592a6d085..4373c1d64ab85 100644 ---- a/arch/sparc/kernel/setup_32.c -+++ b/arch/sparc/kernel/setup_32.c -@@ -422,3 +422,10 @@ static int __init topology_init(void) - } - - subsys_initcall(topology_init); -+ -+#if defined(CONFIG_SPARC32) && !defined(CONFIG_SMP) -+void __init arch_cpu_finalize_init(void) -+{ -+ cpu_data(0).udelay_val = loops_per_jiffy; -+} -+#endif -diff --git a/arch/um/Kconfig b/arch/um/Kconfig -index c56d3526a3bd7..468a5d63ef269 100644 ---- a/arch/um/Kconfig -+++ b/arch/um/Kconfig -@@ -5,6 +5,7 @@ menu "UML-specific options" - config UML - bool - default y -+ select ARCH_HAS_CPU_FINALIZE_INIT - select ARCH_HAS_KCOV - select ARCH_NO_PREEMPT - select HAVE_ARCH_AUDITSYSCALL -diff --git a/arch/um/include/asm/bugs.h b/arch/um/include/asm/bugs.h -deleted file mode 100644 -index 4473942a08397..0000000000000 ---- a/arch/um/include/asm/bugs.h -+++ /dev/null -@@ -1,7 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --#ifndef __UM_BUGS_H --#define __UM_BUGS_H -- --void check_bugs(void); -- --#endif -diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c -index 640c8e178502e..004ef4ebb57d4 100644 ---- a/arch/um/kernel/um_arch.c -+++ b/arch/um/kernel/um_arch.c -@@ -3,6 +3,7 @@ - * Copyright (C) 2000 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com) - */ - -+#include - #include - #include - #include -@@ -353,7 +354,7 @@ void __init setup_arch(char **cmdline_p) - setup_hostinfo(host_info, sizeof host_info); - } - --void __init check_bugs(void) -+void __init arch_cpu_finalize_init(void) - { - arch_check_bugs(); - os_check_bugs(); -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 6002252692af4..df0a3a1b08ae0 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -60,6 +60,7 @@ config X86 - select ARCH_CLOCKSOURCE_DATA - select ARCH_CLOCKSOURCE_INIT - select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI -+ select ARCH_HAS_CPU_FINALIZE_INIT - select ARCH_HAS_DEBUG_VIRTUAL - select ARCH_HAS_DEVMEM_IS_ALLOWED - select ARCH_HAS_ELF_RANDOMIZE -@@ -2500,6 +2501,25 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK - def_bool y - depends on X86_64 || X86_PAE - -+config GDS_FORCE_MITIGATION -+ bool "Force GDS Mitigation" -+ depends on CPU_SUP_INTEL -+ default n -+ help -+ Gather Data Sampling (GDS) is a hardware vulnerability which allows -+ unprivileged speculative access to data which was previously stored in -+ vector registers. -+ -+ This option is equivalent to setting gather_data_sampling=force on the -+ command line. The microcode mitigation is used if present, otherwise -+ AVX is disabled as a mitigation. On affected systems that are missing -+ the microcode any userspace code that unconditionally uses AVX will -+ break with this option set. -+ -+ Setting this option on systems not vulnerable to GDS has no effect. -+ -+ If in doubt, say N. -+ - config ARCH_ENABLE_HUGEPAGE_MIGRATION - def_bool y - depends on X86_64 && HUGETLB_PAGE && MIGRATION -diff --git a/arch/x86/include/asm/bugs.h b/arch/x86/include/asm/bugs.h -index 794eb2129bc6b..6554ddb2ad49e 100644 ---- a/arch/x86/include/asm/bugs.h -+++ b/arch/x86/include/asm/bugs.h -@@ -4,8 +4,6 @@ - - #include - --extern void check_bugs(void); -- - #if defined(CONFIG_CPU_SUP_INTEL) - void check_mpx_erratum(struct cpuinfo_x86 *c); - #else -diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h -index 619c1f80a2abe..4466a47b76080 100644 ---- a/arch/x86/include/asm/cpufeature.h -+++ b/arch/x86/include/asm/cpufeature.h -@@ -30,6 +30,8 @@ enum cpuid_leafs - CPUID_7_ECX, - CPUID_8000_0007_EBX, - CPUID_7_EDX, -+ CPUID_8000_001F_EAX, -+ CPUID_8000_0021_EAX, - }; - - #ifdef CONFIG_X86_FEATURE_NAMES -@@ -88,8 +90,10 @@ extern const char * const x86_bug_flags[NBUGINTS*32]; - CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 16, feature_bit) || \ - CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 17, feature_bit) || \ - CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 18, feature_bit) || \ -+ CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 19, feature_bit) || \ -+ CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 20, feature_bit) || \ - REQUIRED_MASK_CHECK || \ -- BUILD_BUG_ON_ZERO(NCAPINTS != 19)) -+ BUILD_BUG_ON_ZERO(NCAPINTS != 21)) - - #define DISABLED_MASK_BIT_SET(feature_bit) \ - ( CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 0, feature_bit) || \ -@@ -111,8 +115,10 @@ extern const char * const x86_bug_flags[NBUGINTS*32]; - CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 16, feature_bit) || \ - CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 17, feature_bit) || \ - CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 18, feature_bit) || \ -+ CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 19, feature_bit) || \ -+ CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 20, feature_bit) || \ - DISABLED_MASK_CHECK || \ -- BUILD_BUG_ON_ZERO(NCAPINTS != 19)) -+ BUILD_BUG_ON_ZERO(NCAPINTS != 21)) - - #define cpu_has(c, bit) \ - (__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 : \ -diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h -index 3e360dc07bae0..f42286e9a2b16 100644 ---- a/arch/x86/include/asm/cpufeatures.h -+++ b/arch/x86/include/asm/cpufeatures.h -@@ -13,8 +13,8 @@ - /* - * Defines x86 CPU feature bits - */ --#define NCAPINTS 19 /* N 32-bit words worth of info */ --#define NBUGINTS 1 /* N 32-bit bug flags */ -+#define NCAPINTS 21 /* N 32-bit words worth of info */ -+#define NBUGINTS 2 /* N 32-bit bug flags */ - - /* - * Note: If the comment begins with a quoted string, that string is used -@@ -96,7 +96,7 @@ - #define X86_FEATURE_SYSCALL32 ( 3*32+14) /* "" syscall in IA32 userspace */ - #define X86_FEATURE_SYSENTER32 ( 3*32+15) /* "" sysenter in IA32 userspace */ - #define X86_FEATURE_REP_GOOD ( 3*32+16) /* REP microcode works well */ --#define X86_FEATURE_SME_COHERENT ( 3*32+17) /* "" AMD hardware-enforced cache coherency */ -+/* FREE! ( 3*32+17) */ - #define X86_FEATURE_LFENCE_RDTSC ( 3*32+18) /* "" LFENCE synchronizes RDTSC */ - #define X86_FEATURE_ACC_POWER ( 3*32+19) /* AMD Accumulated Power Mechanism */ - #define X86_FEATURE_NOPL ( 3*32+20) /* The NOPL (0F 1F) instructions */ -@@ -201,7 +201,7 @@ - #define X86_FEATURE_INVPCID_SINGLE ( 7*32+ 7) /* Effectively INVPCID && CR4.PCIDE=1 */ - #define X86_FEATURE_HW_PSTATE ( 7*32+ 8) /* AMD HW-PState */ - #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */ --#define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */ -+/* FREE! ( 7*32+10) */ - #define X86_FEATURE_PTI ( 7*32+11) /* Kernel Page Table Isolation enabled */ - #define X86_FEATURE_KERNEL_IBRS ( 7*32+12) /* "" Set/clear IBRS on kernel entry/exit */ - #define X86_FEATURE_RSB_VMEXIT ( 7*32+13) /* "" Fill RSB on VM-Exit */ -@@ -211,7 +211,7 @@ - #define X86_FEATURE_SSBD ( 7*32+17) /* Speculative Store Bypass Disable */ - #define X86_FEATURE_MBA ( 7*32+18) /* Memory Bandwidth Allocation */ - #define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* "" Fill RSB on context switches */ --#define X86_FEATURE_SEV ( 7*32+20) /* AMD Secure Encrypted Virtualization */ -+/* FREE! ( 7*32+20) */ - #define X86_FEATURE_USE_IBPB ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */ - #define X86_FEATURE_USE_IBRS_FW ( 7*32+22) /* "" Use IBRS during runtime firmware calls */ - #define X86_FEATURE_SPEC_STORE_BYPASS_DISABLE ( 7*32+23) /* "" Disable Speculative Store Bypass. */ -@@ -375,6 +375,13 @@ - #define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */ - #define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */ - -+/* AMD-defined memory encryption features, CPUID level 0x8000001f (EAX), word 19 */ -+#define X86_FEATURE_SME (19*32+ 0) /* AMD Secure Memory Encryption */ -+#define X86_FEATURE_SEV (19*32+ 1) /* AMD Secure Encrypted Virtualization */ -+#define X86_FEATURE_VM_PAGE_FLUSH (19*32+ 2) /* "" VM Page Flush MSR is supported */ -+#define X86_FEATURE_SEV_ES (19*32+ 3) /* AMD Secure Encrypted Virtualization - Encrypted State */ -+#define X86_FEATURE_SME_COHERENT (19*32+10) /* "" AMD hardware-enforced cache coherency */ -+ - /* - * BUG word(s) - */ -@@ -415,5 +422,6 @@ - #define X86_BUG_RETBLEED X86_BUG(26) /* CPU is affected by RETBleed */ - #define X86_BUG_EIBRS_PBRSB X86_BUG(27) /* EIBRS is vulnerable to Post Barrier RSB Predictions */ - #define X86_BUG_MMIO_UNKNOWN X86_BUG(28) /* CPU is too old and its MMIO Stale Data status is unknown */ -+#define X86_BUG_GDS X86_BUG(29) /* CPU is affected by Gather Data Sampling */ - - #endif /* _ASM_X86_CPUFEATURES_H */ -diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h -index a5ea841cc6d22..8453260f6d9f9 100644 ---- a/arch/x86/include/asm/disabled-features.h -+++ b/arch/x86/include/asm/disabled-features.h -@@ -84,6 +84,8 @@ - #define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP) - #define DISABLED_MASK17 0 - #define DISABLED_MASK18 0 --#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19) -+#define DISABLED_MASK19 0 -+#define DISABLED_MASK20 0 -+#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 21) - - #endif /* _ASM_X86_DISABLED_FEATURES_H */ -diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h -index 5ed702e2c55f4..330841bad6167 100644 ---- a/arch/x86/include/asm/fpu/internal.h -+++ b/arch/x86/include/asm/fpu/internal.h -@@ -41,7 +41,7 @@ extern int dump_fpu(struct pt_regs *ptregs, struct user_i387_struct *fpstate); - extern void fpu__init_cpu(void); - extern void fpu__init_system_xstate(void); - extern void fpu__init_cpu_xstate(void); --extern void fpu__init_system(struct cpuinfo_x86 *c); -+extern void fpu__init_system(void); - extern void fpu__init_check_bugs(void); - extern void fpu__resume_cpu(void); - extern u64 fpu__get_supported_xfeatures_mask(void); -diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h -index 848ce43b9040d..190c5ca537e9e 100644 ---- a/arch/x86/include/asm/mem_encrypt.h -+++ b/arch/x86/include/asm/mem_encrypt.h -@@ -77,6 +77,8 @@ early_set_memory_decrypted(unsigned long vaddr, unsigned long size) { return 0; - static inline int __init - early_set_memory_encrypted(unsigned long vaddr, unsigned long size) { return 0; } - -+static inline void mem_encrypt_init(void) { } -+ - #define __bss_decrypted - - #endif /* CONFIG_AMD_MEM_ENCRYPT */ -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index f3fa903c5b297..7137256f2c31d 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -147,6 +147,15 @@ - * Not susceptible to Post-Barrier - * Return Stack Buffer Predictions. - */ -+#define ARCH_CAP_GDS_CTRL BIT(25) /* -+ * CPU is vulnerable to Gather -+ * Data Sampling (GDS) and -+ * has controls for mitigation. -+ */ -+#define ARCH_CAP_GDS_NO BIT(26) /* -+ * CPU is not vulnerable to Gather -+ * Data Sampling (GDS). -+ */ - - #define MSR_IA32_FLUSH_CMD 0x0000010b - #define L1D_FLUSH BIT(0) /* -@@ -165,6 +174,8 @@ - #define MSR_IA32_MCU_OPT_CTRL 0x00000123 - #define RNGDS_MITG_DIS BIT(0) - #define FB_CLEAR_DIS BIT(3) /* CPU Fill buffer clear disable */ -+#define GDS_MITG_DIS BIT(4) /* Disable GDS mitigation */ -+#define GDS_MITG_LOCKED BIT(5) /* GDS mitigation locked */ - - #define MSR_IA32_SYSENTER_CS 0x00000174 - #define MSR_IA32_SYSENTER_ESP 0x00000175 -@@ -484,6 +495,7 @@ - #define MSR_AMD64_ICIBSEXTDCTL 0xc001103c - #define MSR_AMD64_IBSOPDATA4 0xc001103d - #define MSR_AMD64_IBS_REG_COUNT_MAX 8 /* includes MSR_AMD64_IBSBRTARGET */ -+#define MSR_AMD64_VM_PAGE_FLUSH 0xc001011e - #define MSR_AMD64_SEV 0xc0010131 - #define MSR_AMD64_SEV_ENABLED_BIT 0 - #define MSR_AMD64_SEV_ENABLED BIT_ULL(MSR_AMD64_SEV_ENABLED_BIT) -diff --git a/arch/x86/include/asm/required-features.h b/arch/x86/include/asm/required-features.h -index 6847d85400a8b..fb3d81347e333 100644 ---- a/arch/x86/include/asm/required-features.h -+++ b/arch/x86/include/asm/required-features.h -@@ -101,6 +101,8 @@ - #define REQUIRED_MASK16 0 - #define REQUIRED_MASK17 0 - #define REQUIRED_MASK18 0 --#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19) -+#define REQUIRED_MASK19 0 -+#define REQUIRED_MASK20 0 -+#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 21) - - #endif /* _ASM_X86_REQUIRED_FEATURES_H */ -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 3f182c06b305c..11f09df72f51a 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -663,7 +663,7 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c) - * If BIOS has not enabled SME then don't advertise the - * SME feature (set in scattered.c). - * For SEV: If BIOS has not enabled SEV then don't advertise the -- * SEV feature (set in scattered.c). -+ * SEV and SEV_ES feature (set in scattered.c). - * - * In all cases, since support for SME and SEV requires long mode, - * don't advertise the feature under CONFIG_X86_32. -@@ -694,6 +694,7 @@ clear_all: - setup_clear_cpu_cap(X86_FEATURE_SME); - clear_sev: - setup_clear_cpu_cap(X86_FEATURE_SEV); -+ setup_clear_cpu_cap(X86_FEATURE_SEV_ES); - } - } - -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 75ca28bb267c4..48ae44cf77951 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -9,7 +9,6 @@ - * - Andrew D. Balsa (code cleanup). - */ - #include --#include - #include - #include - #include -@@ -25,9 +24,7 @@ - #include - #include - #include --#include - #include --#include - #include - #include - #include -@@ -47,6 +44,7 @@ static void __init md_clear_select_mitigation(void); - static void __init taa_select_mitigation(void); - static void __init mmio_select_mitigation(void); - static void __init srbds_select_mitigation(void); -+static void __init gds_select_mitigation(void); - - /* The base value of the SPEC_CTRL MSR without task-specific bits set */ - u64 x86_spec_ctrl_base; -@@ -115,21 +113,8 @@ EXPORT_SYMBOL_GPL(mds_idle_clear); - DEFINE_STATIC_KEY_FALSE(mmio_stale_data_clear); - EXPORT_SYMBOL_GPL(mmio_stale_data_clear); - --void __init check_bugs(void) -+void __init cpu_select_mitigations(void) - { -- identify_boot_cpu(); -- -- /* -- * identify_boot_cpu() initialized SMT support information, let the -- * core code know. -- */ -- cpu_smt_check_topology(); -- -- if (!IS_ENABLED(CONFIG_SMP)) { -- pr_info("CPU: "); -- print_cpu_info(&boot_cpu_data); -- } -- - /* - * Read the SPEC_CTRL MSR to account for reserved bits which may - * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD -@@ -165,39 +150,7 @@ void __init check_bugs(void) - l1tf_select_mitigation(); - md_clear_select_mitigation(); - srbds_select_mitigation(); -- -- arch_smt_update(); -- --#ifdef CONFIG_X86_32 -- /* -- * Check whether we are able to run this kernel safely on SMP. -- * -- * - i386 is no longer supported. -- * - In order to run on anything without a TSC, we need to be -- * compiled for a i486. -- */ -- if (boot_cpu_data.x86 < 4) -- panic("Kernel requires i486+ for 'invlpg' and other features"); -- -- init_utsname()->machine[1] = -- '0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86); -- alternative_instructions(); -- -- fpu__init_check_bugs(); --#else /* CONFIG_X86_64 */ -- alternative_instructions(); -- -- /* -- * Make sure the first 2MB area is not mapped by huge pages -- * There are typically fixed size MTRRs in there and overlapping -- * MTRRs into large pages causes slow downs. -- * -- * Right now we don't do that with gbpages because there seems -- * very little benefit for that case. -- */ -- if (!direct_gbpages) -- set_memory_4k((unsigned long)__va(0), 1); --#endif -+ gds_select_mitigation(); - } - - /* -@@ -648,6 +601,149 @@ static int __init srbds_parse_cmdline(char *str) - } - early_param("srbds", srbds_parse_cmdline); - -+#undef pr_fmt -+#define pr_fmt(fmt) "GDS: " fmt -+ -+enum gds_mitigations { -+ GDS_MITIGATION_OFF, -+ GDS_MITIGATION_UCODE_NEEDED, -+ GDS_MITIGATION_FORCE, -+ GDS_MITIGATION_FULL, -+ GDS_MITIGATION_FULL_LOCKED, -+ GDS_MITIGATION_HYPERVISOR, -+}; -+ -+#if IS_ENABLED(CONFIG_GDS_FORCE_MITIGATION) -+static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FORCE; -+#else -+static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL; -+#endif -+ -+static const char * const gds_strings[] = { -+ [GDS_MITIGATION_OFF] = "Vulnerable", -+ [GDS_MITIGATION_UCODE_NEEDED] = "Vulnerable: No microcode", -+ [GDS_MITIGATION_FORCE] = "Mitigation: AVX disabled, no microcode", -+ [GDS_MITIGATION_FULL] = "Mitigation: Microcode", -+ [GDS_MITIGATION_FULL_LOCKED] = "Mitigation: Microcode (locked)", -+ [GDS_MITIGATION_HYPERVISOR] = "Unknown: Dependent on hypervisor status", -+}; -+ -+bool gds_ucode_mitigated(void) -+{ -+ return (gds_mitigation == GDS_MITIGATION_FULL || -+ gds_mitigation == GDS_MITIGATION_FULL_LOCKED); -+} -+EXPORT_SYMBOL_GPL(gds_ucode_mitigated); -+ -+void update_gds_msr(void) -+{ -+ u64 mcu_ctrl_after; -+ u64 mcu_ctrl; -+ -+ switch (gds_mitigation) { -+ case GDS_MITIGATION_OFF: -+ rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl); -+ mcu_ctrl |= GDS_MITG_DIS; -+ break; -+ case GDS_MITIGATION_FULL_LOCKED: -+ /* -+ * The LOCKED state comes from the boot CPU. APs might not have -+ * the same state. Make sure the mitigation is enabled on all -+ * CPUs. -+ */ -+ case GDS_MITIGATION_FULL: -+ rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl); -+ mcu_ctrl &= ~GDS_MITG_DIS; -+ break; -+ case GDS_MITIGATION_FORCE: -+ case GDS_MITIGATION_UCODE_NEEDED: -+ case GDS_MITIGATION_HYPERVISOR: -+ return; -+ }; -+ -+ wrmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl); -+ -+ /* -+ * Check to make sure that the WRMSR value was not ignored. Writes to -+ * GDS_MITG_DIS will be ignored if this processor is locked but the boot -+ * processor was not. -+ */ -+ rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl_after); -+ WARN_ON_ONCE(mcu_ctrl != mcu_ctrl_after); -+} -+ -+static void __init gds_select_mitigation(void) -+{ -+ u64 mcu_ctrl; -+ -+ if (!boot_cpu_has_bug(X86_BUG_GDS)) -+ return; -+ -+ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) { -+ gds_mitigation = GDS_MITIGATION_HYPERVISOR; -+ goto out; -+ } -+ -+ if (cpu_mitigations_off()) -+ gds_mitigation = GDS_MITIGATION_OFF; -+ /* Will verify below that mitigation _can_ be disabled */ -+ -+ /* No microcode */ -+ if (!(x86_read_arch_cap_msr() & ARCH_CAP_GDS_CTRL)) { -+ if (gds_mitigation == GDS_MITIGATION_FORCE) { -+ /* -+ * This only needs to be done on the boot CPU so do it -+ * here rather than in update_gds_msr() -+ */ -+ setup_clear_cpu_cap(X86_FEATURE_AVX); -+ pr_warn("Microcode update needed! Disabling AVX as mitigation.\n"); -+ } else { -+ gds_mitigation = GDS_MITIGATION_UCODE_NEEDED; -+ } -+ goto out; -+ } -+ -+ /* Microcode has mitigation, use it */ -+ if (gds_mitigation == GDS_MITIGATION_FORCE) -+ gds_mitigation = GDS_MITIGATION_FULL; -+ -+ rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl); -+ if (mcu_ctrl & GDS_MITG_LOCKED) { -+ if (gds_mitigation == GDS_MITIGATION_OFF) -+ pr_warn("Mitigation locked. Disable failed.\n"); -+ -+ /* -+ * The mitigation is selected from the boot CPU. All other CPUs -+ * _should_ have the same state. If the boot CPU isn't locked -+ * but others are then update_gds_msr() will WARN() of the state -+ * mismatch. If the boot CPU is locked update_gds_msr() will -+ * ensure the other CPUs have the mitigation enabled. -+ */ -+ gds_mitigation = GDS_MITIGATION_FULL_LOCKED; -+ } -+ -+ update_gds_msr(); -+out: -+ pr_info("%s\n", gds_strings[gds_mitigation]); -+} -+ -+static int __init gds_parse_cmdline(char *str) -+{ -+ if (!str) -+ return -EINVAL; -+ -+ if (!boot_cpu_has_bug(X86_BUG_GDS)) -+ return 0; -+ -+ if (!strcmp(str, "off")) -+ gds_mitigation = GDS_MITIGATION_OFF; -+ else if (!strcmp(str, "force")) -+ gds_mitigation = GDS_MITIGATION_FORCE; -+ -+ return 0; -+} -+early_param("gather_data_sampling", gds_parse_cmdline); -+ - #undef pr_fmt - #define pr_fmt(fmt) "Spectre V1 : " fmt - -@@ -2207,6 +2303,11 @@ static ssize_t retbleed_show_state(char *buf) - return sprintf(buf, "%s\n", retbleed_strings[retbleed_mitigation]); - } - -+static ssize_t gds_show_state(char *buf) -+{ -+ return sysfs_emit(buf, "%s\n", gds_strings[gds_mitigation]); -+} -+ - static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, - char *buf, unsigned int bug) - { -@@ -2256,6 +2357,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr - case X86_BUG_RETBLEED: - return retbleed_show_state(buf); - -+ case X86_BUG_GDS: -+ return gds_show_state(buf); -+ - default: - break; - } -@@ -2320,4 +2424,9 @@ ssize_t cpu_show_retbleed(struct device *dev, struct device_attribute *attr, cha - { - return cpu_show_common(dev, attr, buf, X86_BUG_RETBLEED); - } -+ -+ssize_t cpu_show_gds(struct device *dev, struct device_attribute *attr, char *buf) -+{ -+ return cpu_show_common(dev, attr, buf, X86_BUG_GDS); -+} - #endif -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index c8ccf5bfd5341..fcfe891c1e8e5 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -17,11 +17,16 @@ - #include - #include - #include -+#include - #include -+#include - #include - #include - - #include -+#include -+ -+#include - #include - #include - #include -@@ -57,6 +62,7 @@ - #ifdef CONFIG_X86_LOCAL_APIC - #include - #endif -+#include - - #include "cpu.h" - -@@ -961,6 +967,12 @@ void get_cpu_cap(struct cpuinfo_x86 *c) - if (c->extended_cpuid_level >= 0x8000000a) - c->x86_capability[CPUID_8000_000A_EDX] = cpuid_edx(0x8000000a); - -+ if (c->extended_cpuid_level >= 0x8000001f) -+ c->x86_capability[CPUID_8000_001F_EAX] = cpuid_eax(0x8000001f); -+ -+ if (c->extended_cpuid_level >= 0x80000021) -+ c->x86_capability[CPUID_8000_0021_EAX] = cpuid_eax(0x80000021); -+ - init_scattered_cpuid_features(c); - init_speculation_control(c); - init_cqm(c); -@@ -1123,6 +1135,12 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { - #define MMIO_SBDS BIT(2) - /* CPU is affected by RETbleed, speculating where you would not expect it */ - #define RETBLEED BIT(3) -+/* CPU is affected by SMT (cross-thread) return predictions */ -+#define SMT_RSB BIT(4) -+/* CPU is affected by SRSO */ -+#define SRSO BIT(5) -+/* CPU is affected by GDS */ -+#define GDS BIT(6) - - static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { - VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS), -@@ -1135,19 +1153,21 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { - VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO), - VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS), - VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), -- VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED), -+ VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS), - VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), -- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), -- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS), - VULNBL_INTEL_STEPPINGS(CANNONLAKE_L, X86_STEPPING_ANY, RETBLEED), -- VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED), -- VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPING_ANY, MMIO), -- VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO), -- VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED), -+ VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS), -+ VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPING_ANY, MMIO | GDS), -+ VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO | GDS), -+ VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS), - VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO | RETBLEED), -- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED), -+ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS), -+ VULNBL_INTEL_STEPPINGS(TIGERLAKE_L, X86_STEPPING_ANY, GDS), -+ VULNBL_INTEL_STEPPINGS(TIGERLAKE, X86_STEPPING_ANY, GDS), - VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED), -- VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED), -+ VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS), - VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPING_ANY, MMIO | MMIO_SBDS), - VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO), - VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS), -@@ -1273,6 +1293,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) - !(ia32_cap & ARCH_CAP_PBRSB_NO)) - setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB); - -+ /* -+ * Check if CPU is vulnerable to GDS. If running in a virtual machine on -+ * an affected processor, the VMM may have disabled the use of GATHER by -+ * disabling AVX2. The only way to do this in HW is to clear XCR0[2], -+ * which means that AVX will be disabled. -+ */ -+ if (cpu_matches(cpu_vuln_blacklist, GDS) && !(ia32_cap & ARCH_CAP_GDS_NO) && -+ boot_cpu_has(X86_FEATURE_AVX)) -+ setup_force_cpu_bug(X86_BUG_GDS); -+ - if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) - return; - -@@ -1358,8 +1388,6 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c) - - cpu_set_bug_bits(c); - -- fpu__init_system(c); -- - #ifdef CONFIG_X86_32 - /* - * Regardless of whether PCID is enumerated, the SDM says -@@ -1751,6 +1779,8 @@ void identify_secondary_cpu(struct cpuinfo_x86 *c) - validate_apic_and_package_id(c); - x86_spec_ctrl_setup_ap(); - update_srbds_msr(); -+ if (boot_cpu_has_bug(X86_BUG_GDS)) -+ update_gds_msr(); - } - - static __init int setup_noclflush(char *arg) -@@ -2049,8 +2079,6 @@ void cpu_init(void) - clear_all_debug_regs(); - dbg_restore_debug_regs(); - -- fpu__init_cpu(); -- - if (is_uv_system()) - uv_cpu_init(); - -@@ -2108,8 +2136,6 @@ void cpu_init(void) - clear_all_debug_regs(); - dbg_restore_debug_regs(); - -- fpu__init_cpu(); -- - load_fixmap_gdt(cpu); - } - #endif -@@ -2156,3 +2182,69 @@ void arch_smt_update(void) - /* Check whether IPI broadcasting can be enabled */ - apic_smt_update(); - } -+ -+void __init arch_cpu_finalize_init(void) -+{ -+ identify_boot_cpu(); -+ -+ /* -+ * identify_boot_cpu() initialized SMT support information, let the -+ * core code know. -+ */ -+ cpu_smt_check_topology(); -+ -+ if (!IS_ENABLED(CONFIG_SMP)) { -+ pr_info("CPU: "); -+ print_cpu_info(&boot_cpu_data); -+ } -+ -+ cpu_select_mitigations(); -+ -+ arch_smt_update(); -+ -+ if (IS_ENABLED(CONFIG_X86_32)) { -+ /* -+ * Check whether this is a real i386 which is not longer -+ * supported and fixup the utsname. -+ */ -+ if (boot_cpu_data.x86 < 4) -+ panic("Kernel requires i486+ for 'invlpg' and other features"); -+ -+ init_utsname()->machine[1] = -+ '0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86); -+ } -+ -+ /* -+ * Must be before alternatives because it might set or clear -+ * feature bits. -+ */ -+ fpu__init_system(); -+ fpu__init_cpu(); -+ -+ alternative_instructions(); -+ -+ if (IS_ENABLED(CONFIG_X86_64)) { -+ /* -+ * Make sure the first 2MB area is not mapped by huge pages -+ * There are typically fixed size MTRRs in there and overlapping -+ * MTRRs into large pages causes slow downs. -+ * -+ * Right now we don't do that with gbpages because there seems -+ * very little benefit for that case. -+ */ -+ if (!direct_gbpages) -+ set_memory_4k((unsigned long)__va(0), 1); -+ } else { -+ fpu__init_check_bugs(); -+ } -+ -+ /* -+ * This needs to be called before any devices perform DMA -+ * operations that might use the SWIOTLB bounce buffers. It will -+ * mark the bounce buffers as decrypted so that their usage will -+ * not cause "plain-text" data to be decrypted when accessed. It -+ * must be called after late_time_init() so that Hyper-V x86/x64 -+ * hypercalls work when the SWIOTLB bounce buffers are decrypted. -+ */ -+ mem_encrypt_init(); -+} -diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h -index 4d04c127c4a79..8a64520b53104 100644 ---- a/arch/x86/kernel/cpu/cpu.h -+++ b/arch/x86/kernel/cpu/cpu.h -@@ -76,9 +76,11 @@ extern void detect_ht(struct cpuinfo_x86 *c); - extern void check_null_seg_clears_base(struct cpuinfo_x86 *c); - - unsigned int aperfmperf_get_khz(int cpu); -+void cpu_select_mitigations(void); - - extern void x86_spec_ctrl_setup_ap(void); - extern void update_srbds_msr(void); -+extern void update_gds_msr(void); - - extern u64 x86_read_arch_cap_msr(void); - -diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c -index a03e309a0ac5f..37f716eaf0e6d 100644 ---- a/arch/x86/kernel/cpu/scattered.c -+++ b/arch/x86/kernel/cpu/scattered.c -@@ -40,9 +40,6 @@ static const struct cpuid_bit cpuid_bits[] = { - { X86_FEATURE_CPB, CPUID_EDX, 9, 0x80000007, 0 }, - { X86_FEATURE_PROC_FEEDBACK, CPUID_EDX, 11, 0x80000007, 0 }, - { X86_FEATURE_MBA, CPUID_EBX, 6, 0x80000008, 0 }, -- { X86_FEATURE_SME, CPUID_EAX, 0, 0x8000001f, 0 }, -- { X86_FEATURE_SEV, CPUID_EAX, 1, 0x8000001f, 0 }, -- { X86_FEATURE_SME_COHERENT, CPUID_EAX, 10, 0x8000001f, 0 }, - { 0, 0, 0, 0, 0 } - }; - -diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c -index 17d092eb1934c..5e710ad6a3c0a 100644 ---- a/arch/x86/kernel/fpu/init.c -+++ b/arch/x86/kernel/fpu/init.c -@@ -50,7 +50,7 @@ void fpu__init_cpu(void) - fpu__init_cpu_xstate(); - } - --static bool fpu__probe_without_cpuid(void) -+static bool __init fpu__probe_without_cpuid(void) - { - unsigned long cr0; - u16 fsw, fcw; -@@ -68,7 +68,7 @@ static bool fpu__probe_without_cpuid(void) - return fsw == 0 && (fcw & 0x103f) == 0x003f; - } - --static void fpu__init_system_early_generic(struct cpuinfo_x86 *c) -+static void __init fpu__init_system_early_generic(void) - { - if (!boot_cpu_has(X86_FEATURE_CPUID) && - !test_bit(X86_FEATURE_FPU, (unsigned long *)cpu_caps_cleared)) { -@@ -290,10 +290,10 @@ static void __init fpu__init_parse_early_param(void) - * Called on the boot CPU once per system bootup, to set up the initial - * FPU state that is later cloned into all processes: - */ --void __init fpu__init_system(struct cpuinfo_x86 *c) -+void __init fpu__init_system(void) - { - fpu__init_parse_early_param(); -- fpu__init_system_early_generic(c); -+ fpu__init_system_early_generic(); - - /* - * The FPU has to be operational for some of the -diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index 45e5ecb43393b..d6a8efff9c617 100644 ---- a/arch/x86/kernel/smpboot.c -+++ b/arch/x86/kernel/smpboot.c -@@ -235,6 +235,7 @@ static void notrace start_secondary(void *unused) - #endif - load_current_idt(); - cpu_init(); -+ fpu__init_cpu(); - rcu_cpu_starting(raw_smp_processor_id()); - x86_cpuinit.early_percpu_clock_init(); - preempt_disable(); -diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h -index 7dec43b2c4205..defae8082789f 100644 ---- a/arch/x86/kvm/cpuid.h -+++ b/arch/x86/kvm/cpuid.h -@@ -53,6 +53,7 @@ static const struct cpuid_reg reverse_cpuid[] = { - [CPUID_7_ECX] = { 7, 0, CPUID_ECX}, - [CPUID_8000_0007_EBX] = {0x80000007, 0, CPUID_EBX}, - [CPUID_7_EDX] = { 7, 0, CPUID_EDX}, -+ [CPUID_8000_0021_EAX] = {0x80000021, 0, CPUID_EAX}, - }; - - static __always_inline struct cpuid_reg x86_feature_cpuid(unsigned x86_feature) -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index d152afdfa8b4f..2ee3da99bc1d7 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -226,6 +226,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { - - u64 __read_mostly host_xcr0; - -+extern bool gds_ucode_mitigated(void); -+ - struct kmem_cache *x86_fpu_cache; - EXPORT_SYMBOL_GPL(x86_fpu_cache); - -@@ -1409,6 +1411,9 @@ static u64 kvm_get_arch_capabilities(void) - /* Guests don't need to know "Fill buffer clear control" exists */ - data &= ~ARCH_CAP_FB_CLEAR_CTRL; - -+ if (!boot_cpu_has_bug(X86_BUG_GDS) || gds_ucode_mitigated()) -+ data |= ARCH_CAP_GDS_NO; -+ - return data; - } - -diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 38e6798ce44fc..086b274fa60f6 100644 ---- a/arch/x86/mm/init.c -+++ b/arch/x86/mm/init.c -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -26,6 +27,7 @@ - #include - #include - #include -+#include - - /* - * We need to define the tracepoints somewhere, and tlb.c -@@ -735,9 +737,12 @@ void __init poking_init(void) - spinlock_t *ptl; - pte_t *ptep; - -- poking_mm = copy_init_mm(); -+ poking_mm = mm_alloc(); - BUG_ON(!poking_mm); - -+ /* Xen PV guests need the PGD to be pinned. */ -+ paravirt_arch_dup_mmap(NULL, poking_mm); -+ - /* - * Randomize the poking address, but make sure that the following page - * will be mapped at the same PMD. We need 2 pages, so find space for 3, -diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c -index 928fbe63c96f8..3a0a27d94c05d 100644 ---- a/arch/x86/xen/smp_pv.c -+++ b/arch/x86/xen/smp_pv.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -61,6 +62,7 @@ static void cpu_bringup(void) - - cr4_init(); - cpu_init(); -+ fpu__init_cpu(); - touch_softlockup_watchdog(); - preempt_disable(); - -diff --git a/arch/xtensa/include/asm/bugs.h b/arch/xtensa/include/asm/bugs.h -deleted file mode 100644 -index 69b29d1982494..0000000000000 ---- a/arch/xtensa/include/asm/bugs.h -+++ /dev/null -@@ -1,18 +0,0 @@ --/* -- * include/asm-xtensa/bugs.h -- * -- * This is included by init/main.c to check for architecture-dependent bugs. -- * -- * Xtensa processors don't have any bugs. :) -- * -- * This file is subject to the terms and conditions of the GNU General -- * Public License. See the file "COPYING" in the main directory of -- * this archive for more details. -- */ -- --#ifndef _XTENSA_BUGS_H --#define _XTENSA_BUGS_H -- --static void check_bugs(void) { } -- --#endif /* _XTENSA_BUGS_H */ -diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c -index 980e9a76e1723..5e0c1fd27720e 100644 ---- a/drivers/base/cpu.c -+++ b/drivers/base/cpu.c -@@ -581,6 +581,12 @@ ssize_t __weak cpu_show_retbleed(struct device *dev, - return sysfs_emit(buf, "Not affected\n"); - } - -+ssize_t __weak cpu_show_gds(struct device *dev, -+ struct device_attribute *attr, char *buf) -+{ -+ return sysfs_emit(buf, "Not affected\n"); -+} -+ - static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); - static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); - static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); -@@ -592,6 +598,7 @@ static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL); - static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL); - static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL); - static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL); -+static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL); - - static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_meltdown.attr, -@@ -605,6 +612,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_srbds.attr, - &dev_attr_mmio_stale_data.attr, - &dev_attr_retbleed.attr, -+ &dev_attr_gather_data_sampling.attr, - NULL - }; - -diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index a3078755939e3..c3eadac893d88 100644 ---- a/drivers/net/xen-netback/netback.c -+++ b/drivers/net/xen-netback/netback.c -@@ -389,7 +389,7 @@ static void xenvif_get_requests(struct xenvif_queue *queue, - struct gnttab_map_grant_ref *gop = queue->tx_map_ops + *map_ops; - struct xen_netif_tx_request *txp = first; - -- nr_slots = shinfo->nr_frags + 1; -+ nr_slots = shinfo->nr_frags + frag_overflow + 1; - - copy_count(skb) = 0; - XENVIF_TX_CB(skb)->split_mask = 0; -@@ -455,8 +455,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue, - } - } - -- for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; -- shinfo->nr_frags++, gop++) { -+ for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS; -+ shinfo->nr_frags++, gop++, nr_slots--) { - index = pending_index(queue->pending_cons++); - pending_idx = queue->pending_ring[index]; - xenvif_tx_create_map_op(queue, pending_idx, txp, -@@ -469,12 +469,12 @@ static void xenvif_get_requests(struct xenvif_queue *queue, - txp++; - } - -- if (frag_overflow) { -+ if (nr_slots > 0) { - - shinfo = skb_shinfo(nskb); - frags = shinfo->frags; - -- for (shinfo->nr_frags = 0; shinfo->nr_frags < frag_overflow; -+ for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; - shinfo->nr_frags++, txp++, gop++) { - index = pending_index(queue->pending_cons++); - pending_idx = queue->pending_ring[index]; -@@ -485,6 +485,11 @@ static void xenvif_get_requests(struct xenvif_queue *queue, - } - - skb_shinfo(skb)->frag_list = nskb; -+ } else if (nskb) { -+ /* A frag_list skb was allocated but it is no longer needed -+ * because enough slots were converted to copy ops above. -+ */ -+ kfree_skb(nskb); - } - - (*copy_ops) = cop - queue->tx_copy_ops; -diff --git a/include/asm-generic/bugs.h b/include/asm-generic/bugs.h -deleted file mode 100644 -index 69021830f078d..0000000000000 ---- a/include/asm-generic/bugs.h -+++ /dev/null -@@ -1,11 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --#ifndef __ASM_GENERIC_BUGS_H --#define __ASM_GENERIC_BUGS_H --/* -- * This file is included by 'init/main.c' to check for -- * architecture-dependent bugs. -- */ -- --static inline void check_bugs(void) { } -- --#endif /* __ASM_GENERIC_BUGS_H */ -diff --git a/include/linux/cpu.h b/include/linux/cpu.h -index b42e9c4134475..782491dd19998 100644 ---- a/include/linux/cpu.h -+++ b/include/linux/cpu.h -@@ -193,6 +193,12 @@ void arch_cpu_idle_enter(void); - void arch_cpu_idle_exit(void); - void arch_cpu_idle_dead(void); - -+#ifdef CONFIG_ARCH_HAS_CPU_FINALIZE_INIT -+void arch_cpu_finalize_init(void); -+#else -+static inline void arch_cpu_finalize_init(void) { } -+#endif -+ - int cpu_report_state(int cpu); - int cpu_check_up_prepare(int cpu); - void cpu_set_state_online(int cpu); -diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h -index 6f33a07858cf6..853ab403e77b8 100644 ---- a/include/linux/sched/task.h -+++ b/include/linux/sched/task.h -@@ -53,6 +53,7 @@ extern void sched_dead(struct task_struct *p); - void __noreturn do_task_dead(void); - void __noreturn make_task_dead(int signr); - -+extern void mm_cache_init(void); - extern void proc_caches_init(void); - - extern void fork_init(void); -@@ -93,7 +94,6 @@ extern long _do_fork(struct kernel_clone_args *kargs); - extern bool legacy_clone_args_valid(const struct kernel_clone_args *kargs); - extern long do_fork(unsigned long, unsigned long, unsigned long, int __user *, int __user *); - struct task_struct *fork_idle(int); --struct mm_struct *copy_init_mm(void); - extern pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags); - extern long kernel_wait4(pid_t, int __user *, int, struct rusage *); - -diff --git a/init/main.c b/init/main.c -index a17a111d93362..1db844b388103 100644 ---- a/init/main.c -+++ b/init/main.c -@@ -93,10 +93,8 @@ - #include - #include - #include --#include - - #include --#include - #include - #include - #include -@@ -504,8 +502,6 @@ void __init __weak thread_stack_cache_init(void) - } - #endif - --void __init __weak mem_encrypt_init(void) { } -- - void __init __weak poking_init(void) { } - - void __init __weak pgtable_cache_init(void) { } -@@ -567,6 +563,7 @@ static void __init mm_init(void) - init_espfix_bsp(); - /* Should be run after espfix64 is set up. */ - pti_init(); -+ mm_cache_init(); - } - - void __init __weak arch_call_rest_init(void) -@@ -627,7 +624,7 @@ asmlinkage __visible void __init start_kernel(void) - sort_main_extable(); - trap_init(); - mm_init(); -- -+ poking_init(); - ftrace_init(); - - /* trace_printk can be enabled here */ -@@ -721,14 +718,6 @@ asmlinkage __visible void __init start_kernel(void) - */ - locking_selftest(); - -- /* -- * This needs to be called before any devices perform DMA -- * operations that might use the SWIOTLB bounce buffers. It will -- * mark the bounce buffers as decrypted so that their usage will -- * not cause "plain-text" data to be decrypted when accessed. -- */ -- mem_encrypt_init(); -- - #ifdef CONFIG_BLK_DEV_INITRD - if (initrd_start && !initrd_below_start_ok && - page_to_pfn(virt_to_page((void *)initrd_start)) < min_low_pfn) { -@@ -745,6 +734,9 @@ asmlinkage __visible void __init start_kernel(void) - late_time_init(); - sched_clock_init(); - calibrate_delay(); -+ -+ arch_cpu_finalize_init(); -+ - pid_idr_init(); - anon_vma_init(); - #ifdef CONFIG_X86 -@@ -771,9 +763,6 @@ asmlinkage __visible void __init start_kernel(void) - taskstats_init_early(); - delayacct_init(); - -- poking_init(); -- check_bugs(); -- - acpi_subsystem_init(); - arch_post_acpi_subsys_init(); - sfi_init_late(); -diff --git a/kernel/fork.c b/kernel/fork.c -index 5b4a19682207a..39134effb2bff 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -2335,11 +2335,6 @@ struct task_struct *fork_idle(int cpu) - return task; - } - --struct mm_struct *copy_init_mm(void) --{ -- return dup_mm(NULL, &init_mm); --} -- - /* - * Ok, this is the main fork-routine. - * -@@ -2710,10 +2705,27 @@ static void sighand_ctor(void *data) - init_waitqueue_head(&sighand->signalfd_wqh); - } - --void __init proc_caches_init(void) -+void __init mm_cache_init(void) - { - unsigned int mm_size; - -+ /* -+ * The mm_cpumask is located at the end of mm_struct, and is -+ * dynamically sized based on the maximum CPU number this system -+ * can have, taking hotplug into account (nr_cpu_ids). -+ */ -+ mm_size = sizeof(struct mm_struct) + cpumask_size(); -+ -+ mm_cachep = kmem_cache_create_usercopy("mm_struct", -+ mm_size, ARCH_MIN_MMSTRUCT_ALIGN, -+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, -+ offsetof(struct mm_struct, saved_auxv), -+ sizeof_field(struct mm_struct, saved_auxv), -+ NULL); -+} -+ -+void __init proc_caches_init(void) -+{ - sighand_cachep = kmem_cache_create("sighand_cache", - sizeof(struct sighand_struct), 0, - SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_TYPESAFE_BY_RCU| -@@ -2731,19 +2743,6 @@ void __init proc_caches_init(void) - SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, - NULL); - -- /* -- * The mm_cpumask is located at the end of mm_struct, and is -- * dynamically sized based on the maximum CPU number this system -- * can have, taking hotplug into account (nr_cpu_ids). -- */ -- mm_size = sizeof(struct mm_struct) + cpumask_size(); -- -- mm_cachep = kmem_cache_create_usercopy("mm_struct", -- mm_size, ARCH_MIN_MMSTRUCT_ALIGN, -- SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, -- offsetof(struct mm_struct, saved_auxv), -- sizeof_field(struct mm_struct, saved_auxv), -- NULL); - vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT); - mmap_init(); - nsproxy_cache_init(); -diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h -index 3efaf338d3257..eea52cb0e6ab1 100644 ---- a/tools/arch/x86/include/asm/cpufeatures.h -+++ b/tools/arch/x86/include/asm/cpufeatures.h -@@ -13,8 +13,8 @@ - /* - * Defines x86 CPU feature bits - */ --#define NCAPINTS 19 /* N 32-bit words worth of info */ --#define NBUGINTS 1 /* N 32-bit bug flags */ -+#define NCAPINTS 20 /* N 32-bit words worth of info */ -+#define NBUGINTS 2 /* N 32-bit bug flags */ - - /* - * Note: If the comment begins with a quoted string, that string is used -@@ -96,6 +96,7 @@ - #define X86_FEATURE_SYSCALL32 ( 3*32+14) /* "" syscall in IA32 userspace */ - #define X86_FEATURE_SYSENTER32 ( 3*32+15) /* "" sysenter in IA32 userspace */ - #define X86_FEATURE_REP_GOOD ( 3*32+16) /* REP microcode works well */ -+/* FREE! ( 3*32+17) */ - #define X86_FEATURE_LFENCE_RDTSC ( 3*32+18) /* "" LFENCE synchronizes RDTSC */ - #define X86_FEATURE_ACC_POWER ( 3*32+19) /* AMD Accumulated Power Mechanism */ - #define X86_FEATURE_NOPL ( 3*32+20) /* The NOPL (0F 1F) instructions */ -@@ -199,7 +200,7 @@ - #define X86_FEATURE_INVPCID_SINGLE ( 7*32+ 7) /* Effectively INVPCID && CR4.PCIDE=1 */ - #define X86_FEATURE_HW_PSTATE ( 7*32+ 8) /* AMD HW-PState */ - #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */ --#define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */ -+/* FREE! ( 7*32+10) */ - #define X86_FEATURE_PTI ( 7*32+11) /* Kernel Page Table Isolation enabled */ - #define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */ - #define X86_FEATURE_RETPOLINE_LFENCE ( 7*32+13) /* "" Use LFENCEs for Spectre variant 2 */ -@@ -209,7 +210,7 @@ - #define X86_FEATURE_SSBD ( 7*32+17) /* Speculative Store Bypass Disable */ - #define X86_FEATURE_MBA ( 7*32+18) /* Memory Bandwidth Allocation */ - #define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* "" Fill RSB on context switches */ --#define X86_FEATURE_SEV ( 7*32+20) /* AMD Secure Encrypted Virtualization */ -+/* FREE! ( 7*32+20) */ - #define X86_FEATURE_USE_IBPB ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */ - #define X86_FEATURE_USE_IBRS_FW ( 7*32+22) /* "" Use IBRS during runtime firmware calls */ - #define X86_FEATURE_SPEC_STORE_BYPASS_DISABLE ( 7*32+23) /* "" Disable Speculative Store Bypass. */ -@@ -287,6 +288,7 @@ - #define X86_FEATURE_RSB_VMEXIT_LITE (11*32+17) /* "" Fill RSB on VM-Exit when EIBRS is enabled */ - - /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ -+#define X86_FEATURE_AVX_VNNI (12*32+ 4) /* AVX VNNI instructions */ - #define X86_FEATURE_AVX512_BF16 (12*32+ 5) /* AVX512 BFLOAT16 instructions */ - - /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */ -@@ -328,6 +330,7 @@ - #define X86_FEATURE_AVIC (15*32+13) /* Virtual Interrupt Controller */ - #define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */ - #define X86_FEATURE_VGIF (15*32+16) /* Virtual GIF */ -+#define X86_FEATURE_SVME_ADDR_CHK (15*32+28) /* "" SVME addr check */ - - /* Intel-defined CPU features, CPUID level 0x00000007:0 (ECX), word 16 */ - #define X86_FEATURE_AVX512VBMI (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/ -@@ -367,6 +370,13 @@ - #define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */ - #define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */ - -+/* AMD-defined memory encryption features, CPUID level 0x8000001f (EAX), word 19 */ -+#define X86_FEATURE_SME (19*32+ 0) /* AMD Secure Memory Encryption */ -+#define X86_FEATURE_SEV (19*32+ 1) /* AMD Secure Encrypted Virtualization */ -+#define X86_FEATURE_VM_PAGE_FLUSH (19*32+ 2) /* "" VM Page Flush MSR is supported */ -+#define X86_FEATURE_SEV_ES (19*32+ 3) /* AMD Secure Encrypted Virtualization - Encrypted State */ -+#define X86_FEATURE_SME_COHERENT (19*32+10) /* "" AMD hardware-enforced cache coherency */ -+ - /* - * BUG word(s) - */ -diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h -index a5ea841cc6d22..f0f935f8d9174 100644 ---- a/tools/arch/x86/include/asm/disabled-features.h -+++ b/tools/arch/x86/include/asm/disabled-features.h -@@ -84,6 +84,7 @@ - #define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP) - #define DISABLED_MASK17 0 - #define DISABLED_MASK18 0 --#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19) -+#define DISABLED_MASK19 0 -+#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20) - - #endif /* _ASM_X86_DISABLED_FEATURES_H */ -diff --git a/tools/arch/x86/include/asm/required-features.h b/tools/arch/x86/include/asm/required-features.h -index 6847d85400a8b..fa5700097f647 100644 ---- a/tools/arch/x86/include/asm/required-features.h -+++ b/tools/arch/x86/include/asm/required-features.h -@@ -101,6 +101,7 @@ - #define REQUIRED_MASK16 0 - #define REQUIRED_MASK17 0 - #define REQUIRED_MASK18 0 --#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19) -+#define REQUIRED_MASK19 0 -+#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20) - - #endif /* _ASM_X86_REQUIRED_FEATURES_H */ diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.252-253.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.252-253.patch deleted file mode 100644 index b4bef8ffa..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.252-253.patch +++ /dev/null @@ -1,5694 +0,0 @@ -diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst -index dcd6c93c7aacb..521acda367aee 100644 ---- a/Documentation/admin-guide/security-bugs.rst -+++ b/Documentation/admin-guide/security-bugs.rst -@@ -56,31 +56,28 @@ information submitted to the security list and any followup discussions - of the report are treated confidentially even after the embargo has been - lifted, in perpetuity. - --Coordination -------------- -- --Fixes for sensitive bugs, such as those that might lead to privilege --escalations, may need to be coordinated with the private -- mailing list so that distribution vendors --are well prepared to issue a fixed kernel upon public disclosure of the --upstream fix. Distros will need some time to test the proposed patch and --will generally request at least a few days of embargo, and vendor update --publication prefers to happen Tuesday through Thursday. When appropriate, --the security team can assist with this coordination, or the reporter can --include linux-distros from the start. In this case, remember to prefix --the email Subject line with "[vs]" as described in the linux-distros wiki: -- -+Coordination with other groups -+------------------------------ -+ -+The kernel security team strongly recommends that reporters of potential -+security issues NEVER contact the "linux-distros" mailing list until -+AFTER discussing it with the kernel security team. Do not Cc: both -+lists at once. You may contact the linux-distros mailing list after a -+fix has been agreed on and you fully understand the requirements that -+doing so will impose on you and the kernel community. -+ -+The different lists have different goals and the linux-distros rules do -+not contribute to actually fixing any potential security problems. - - CVE assignment - -------------- - --The security team does not normally assign CVEs, nor do we require them --for reports or fixes, as this can needlessly complicate the process and --may delay the bug handling. If a reporter wishes to have a CVE identifier --assigned ahead of public disclosure, they will need to contact the private --linux-distros list, described above. When such a CVE identifier is known --before a patch is provided, it is desirable to mention it in the commit --message if the reporter agrees. -+The security team does not assign CVEs, nor do we require them for -+reports or fixes, as this can needlessly complicate the process and may -+delay the bug handling. If a reporter wishes to have a CVE identifier -+assigned, they should find one by themselves, for example by contacting -+MITRE directly. However under no circumstances will a patch inclusion -+be delayed to wait for a CVE identifier to arrive. - - Non-disclosure agreements - ------------------------- -diff --git a/Makefile b/Makefile -index be75dc3ae8de0..a0e3daefb01d9 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 252 -+SUBLEVEL = 253 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi -index 9cbdc1a15cda2..d326b18333d15 100644 ---- a/arch/arm/boot/dts/imx35.dtsi -+++ b/arch/arm/boot/dts/imx35.dtsi -@@ -59,7 +59,7 @@ - interrupt-parent = <&avic>; - ranges; - -- L2: l2-cache@30000000 { -+ L2: cache-controller@30000000 { - compatible = "arm,l210-cache"; - reg = <0x30000000 0x1000>; - cache-unified; -diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi -index e9955ef12e02d..bb02923bc2e5b 100644 ---- a/arch/arm/boot/dts/imx6qdl.dtsi -+++ b/arch/arm/boot/dts/imx6qdl.dtsi -@@ -45,6 +45,10 @@ - spi1 = &ecspi2; - spi2 = &ecspi3; - spi3 = &ecspi4; -+ usb0 = &usbotg; -+ usb1 = &usbh1; -+ usb2 = &usbh2; -+ usb3 = &usbh3; - usbphy0 = &usbphy1; - usbphy1 = &usbphy2; - }; -@@ -255,7 +259,7 @@ - interrupt-parent = <&intc>; - }; - -- L2: l2-cache@a02000 { -+ L2: cache-controller@a02000 { - compatible = "arm,pl310-cache"; - reg = <0x00a02000 0x1000>; - interrupts = <0 92 IRQ_TYPE_LEVEL_HIGH>; -diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi -index 852f66944c7d4..3cf1da06e7f04 100644 ---- a/arch/arm/boot/dts/imx6sl.dtsi -+++ b/arch/arm/boot/dts/imx6sl.dtsi -@@ -39,6 +39,9 @@ - spi1 = &ecspi2; - spi2 = &ecspi3; - spi3 = &ecspi4; -+ usb0 = &usbotg1; -+ usb1 = &usbotg2; -+ usb2 = &usbh; - usbphy0 = &usbphy1; - usbphy1 = &usbphy2; - }; -@@ -136,7 +139,7 @@ - interrupt-parent = <&intc>; - }; - -- L2: l2-cache@a02000 { -+ L2: cache-controller@a02000 { - compatible = "arm,pl310-cache"; - reg = <0x00a02000 0x1000>; - interrupts = <0 92 IRQ_TYPE_LEVEL_HIGH>; -diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi -index 39500b84673b9..ad3deb82a50ac 100644 ---- a/arch/arm/boot/dts/imx6sll.dtsi -+++ b/arch/arm/boot/dts/imx6sll.dtsi -@@ -36,6 +36,8 @@ - spi1 = &ecspi2; - spi3 = &ecspi3; - spi4 = &ecspi4; -+ usb0 = &usbotg1; -+ usb1 = &usbotg2; - usbphy0 = &usbphy1; - usbphy1 = &usbphy2; - }; -@@ -49,20 +51,18 @@ - device_type = "cpu"; - reg = <0>; - next-level-cache = <&L2>; -- operating-points = < -+ operating-points = - /* kHz uV */ -- 996000 1275000 -- 792000 1175000 -- 396000 1075000 -- 198000 975000 -- >; -- fsl,soc-operating-points = < -+ <996000 1275000>, -+ <792000 1175000>, -+ <396000 1075000>, -+ <198000 975000>; -+ fsl,soc-operating-points = - /* ARM kHz SOC-PU uV */ -- 996000 1175000 -- 792000 1175000 -- 396000 1175000 -- 198000 1175000 -- >; -+ <996000 1175000>, -+ <792000 1175000>, -+ <396000 1175000>, -+ <198000 1175000>; - clock-latency = <61036>; /* two CLK32 periods */ - #cooling-cells = <2>; - clocks = <&clks IMX6SLL_CLK_ARM>, -@@ -137,7 +137,7 @@ - interrupt-parent = <&intc>; - }; - -- L2: l2-cache@a02000 { -+ L2: cache-controller@a02000 { - compatible = "arm,pl310-cache"; - reg = <0x00a02000 0x1000>; - interrupts = ; -@@ -272,7 +272,7 @@ - status = "disabled"; - }; - -- ssi1: ssi-controller@2028000 { -+ ssi1: ssi@2028000 { - compatible = "fsl,imx6sl-ssi", "fsl,imx51-ssi"; - reg = <0x02028000 0x4000>; - interrupts = ; -@@ -285,7 +285,7 @@ - status = "disabled"; - }; - -- ssi2: ssi-controller@202c000 { -+ ssi2: ssi@202c000 { - compatible = "fsl,imx6sl-ssi", "fsl,imx51-ssi"; - reg = <0x0202c000 0x4000>; - interrupts = ; -@@ -298,7 +298,7 @@ - status = "disabled"; - }; - -- ssi3: ssi-controller@2030000 { -+ ssi3: ssi@2030000 { - compatible = "fsl,imx6sl-ssi", "fsl,imx51-ssi"; - reg = <0x02030000 0x4000>; - interrupts = ; -@@ -550,7 +550,7 @@ - reg = <0x020ca000 0x1000>; - interrupts = ; - clocks = <&clks IMX6SLL_CLK_USBPHY2>; -- phy-reg_3p0-supply = <®_3p0>; -+ phy-3p0-supply = <®_3p0>; - fsl,anatop = <&anatop>; - }; - -diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi -index b3e24d8bd2994..790cc88c8b1ae 100644 ---- a/arch/arm/boot/dts/imx6sx.dtsi -+++ b/arch/arm/boot/dts/imx6sx.dtsi -@@ -49,6 +49,9 @@ - spi2 = &ecspi3; - spi3 = &ecspi4; - spi4 = &ecspi5; -+ usb0 = &usbotg1; -+ usb1 = &usbotg2; -+ usb2 = &usbh; - usbphy0 = &usbphy1; - usbphy1 = &usbphy2; - }; -@@ -187,7 +190,7 @@ - interrupt-parent = <&intc>; - }; - -- L2: l2-cache@a02000 { -+ L2: cache-controller@a02000 { - compatible = "arm,pl310-cache"; - reg = <0x00a02000 0x1000>; - interrupts = ; -diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi -index ae0722b93b9d7..05390cc2a3b3b 100644 ---- a/arch/arm/boot/dts/imx6ul.dtsi -+++ b/arch/arm/boot/dts/imx6ul.dtsi -@@ -47,6 +47,8 @@ - spi1 = &ecspi2; - spi2 = &ecspi3; - spi3 = &ecspi4; -+ usb0 = &usbotg1; -+ usb1 = &usbotg2; - usbphy0 = &usbphy1; - usbphy1 = &usbphy2; - }; -diff --git a/arch/arm/boot/dts/imx7d.dtsi b/arch/arm/boot/dts/imx7d.dtsi -index 9c8dd32cc035f..8b65ca8b5f30f 100644 ---- a/arch/arm/boot/dts/imx7d.dtsi -+++ b/arch/arm/boot/dts/imx7d.dtsi -@@ -7,6 +7,12 @@ - #include - - / { -+ aliases { -+ usb0 = &usbotg1; -+ usb1 = &usbotg2; -+ usb2 = &usbh; -+ }; -+ - cpus { - cpu0: cpu@0 { - clock-frequency = <996000000>; -diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi -index 1ef076b64de26..e5151a7849d6b 100644 ---- a/arch/arm/boot/dts/imx7s.dtsi -+++ b/arch/arm/boot/dts/imx7s.dtsi -@@ -47,6 +47,8 @@ - spi1 = &ecspi2; - spi2 = &ecspi3; - spi3 = &ecspi4; -+ usb0 = &usbotg1; -+ usb1 = &usbh; - }; - - cpus { -diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts -index 2c8c2b322c727..33f1fb9fd161f 100644 ---- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts -+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts -@@ -129,7 +129,7 @@ - status = "okay"; - clock-frequency = <100000>; - i2c-sda-falling-time-ns = <890>; /* hcnt */ -- i2c-sdl-falling-time-ns = <890>; /* lcnt */ -+ i2c-scl-falling-time-ns = <890>; /* lcnt */ - - adc@14 { - compatible = "lltc,ltc2497"; -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index f0165df489a38..892fc0ceccb85 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -41,7 +41,7 @@ - (((midr) & MIDR_IMPLEMENTOR_MASK) >> MIDR_IMPLEMENTOR_SHIFT) - - #define MIDR_CPU_MODEL(imp, partnum) \ -- (((imp) << MIDR_IMPLEMENTOR_SHIFT) | \ -+ ((_AT(u32, imp) << MIDR_IMPLEMENTOR_SHIFT) | \ - (0xf << MIDR_ARCHITECTURE_SHIFT) | \ - ((partnum) << MIDR_PARTNUM_SHIFT)) - -@@ -59,6 +59,7 @@ - #define ARM_CPU_IMP_NVIDIA 0x4E - #define ARM_CPU_IMP_FUJITSU 0x46 - #define ARM_CPU_IMP_HISI 0x48 -+#define ARM_CPU_IMP_AMPERE 0xC0 - - #define ARM_CPU_PART_AEM_V8 0xD0F - #define ARM_CPU_PART_FOUNDATION 0xD00 -@@ -101,6 +102,8 @@ - - #define HISI_CPU_PART_TSV110 0xD01 - -+#define AMPERE_CPU_PART_AMPERE1 0xAC3 -+ - #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) - #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) - #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) -@@ -131,6 +134,7 @@ - #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) - #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) - #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) -+#define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1) - - /* Fujitsu Erratum 010001 affects A64FX 1.0 and 1.1, (v0r0 and v1r0) */ - #define MIDR_FUJITSU_ERRATUM_010001 MIDR_FUJITSU_A64FX -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index b18f307a3c599..342cba2ae9820 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -1145,6 +1145,10 @@ u8 spectre_bhb_loop_affected(int scope) - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), - {}, - }; -+ static const struct midr_range spectre_bhb_k11_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_AMPERE1), -+ {}, -+ }; - static const struct midr_range spectre_bhb_k8_list[] = { - MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), - MIDR_ALL_VERSIONS(MIDR_CORTEX_A57), -@@ -1155,6 +1159,8 @@ u8 spectre_bhb_loop_affected(int scope) - k = 32; - else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k24_list)) - k = 24; -+ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k11_list)) -+ k = 11; - else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k8_list)) - k = 8; - -diff --git a/arch/powerpc/include/asm/word-at-a-time.h b/arch/powerpc/include/asm/word-at-a-time.h -index f3f4710d4ff52..99129b0cd8b8a 100644 ---- a/arch/powerpc/include/asm/word-at-a-time.h -+++ b/arch/powerpc/include/asm/word-at-a-time.h -@@ -34,7 +34,7 @@ static inline long find_zero(unsigned long mask) - return leading_zero_bits >> 3; - } - --static inline bool has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c) -+static inline unsigned long has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c) - { - unsigned long rhs = val | c->low_bits; - *data = rhs; -diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c -index e4fb5ab41e2d3..cfb97fabd5320 100644 ---- a/arch/powerpc/mm/init_64.c -+++ b/arch/powerpc/mm/init_64.c -@@ -279,8 +279,7 @@ void __ref vmemmap_free(unsigned long start, unsigned long end, - start = _ALIGN_DOWN(start, page_size); - if (altmap) { - alt_start = altmap->base_pfn; -- alt_end = altmap->base_pfn + altmap->reserve + -- altmap->free + altmap->alloc + altmap->align; -+ alt_end = altmap->base_pfn + altmap->reserve + altmap->free; - } - - pr_debug("vmemmap_free %lx...%lx\n", start, end); -diff --git a/arch/s390/kernel/sthyi.c b/arch/s390/kernel/sthyi.c -index 888cc2f166db7..ce6084e28d904 100644 ---- a/arch/s390/kernel/sthyi.c -+++ b/arch/s390/kernel/sthyi.c -@@ -460,9 +460,9 @@ static int sthyi_update_cache(u64 *rc) - * - * Fills the destination with system information returned by the STHYI - * instruction. The data is generated by emulation or execution of STHYI, -- * if available. The return value is the condition code that would be -- * returned, the rc parameter is the return code which is passed in -- * register R2 + 1. -+ * if available. The return value is either a negative error value or -+ * the condition code that would be returned, the rc parameter is the -+ * return code which is passed in register R2 + 1. - */ - int sthyi_fill(void *dst, u64 *rc) - { -diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c -index a389fa85cca2d..5450d43d26ea5 100644 ---- a/arch/s390/kvm/intercept.c -+++ b/arch/s390/kvm/intercept.c -@@ -360,8 +360,8 @@ static int handle_partial_execution(struct kvm_vcpu *vcpu) - */ - int handle_sthyi(struct kvm_vcpu *vcpu) - { -- int reg1, reg2, r = 0; -- u64 code, addr, cc = 0, rc = 0; -+ int reg1, reg2, cc = 0, r = 0; -+ u64 code, addr, rc = 0; - struct sthyi_sctns *sctns = NULL; - - if (!test_kvm_facility(vcpu->kvm, 74)) -@@ -392,7 +392,10 @@ int handle_sthyi(struct kvm_vcpu *vcpu) - return -ENOMEM; - - cc = sthyi_fill(sctns, &rc); -- -+ if (cc < 0) { -+ free_page((unsigned long)sctns); -+ return cc; -+ } - out: - if (!cc) { - r = write_guest(vcpu, addr, reg2, sctns, PAGE_SIZE); -diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c -index 5909e8fa4013f..6937aedc0a03b 100644 ---- a/drivers/acpi/processor_perflib.c -+++ b/drivers/acpi/processor_perflib.c -@@ -56,6 +56,8 @@ static int acpi_processor_get_platform_limit(struct acpi_processor *pr) - { - acpi_status status = 0; - unsigned long long ppc = 0; -+ s32 qos_value; -+ int index; - int ret; - - if (!pr) -@@ -75,17 +77,30 @@ static int acpi_processor_get_platform_limit(struct acpi_processor *pr) - return -ENODEV; - } - -+ index = ppc; -+ -+ if (pr->performance_platform_limit == index || -+ ppc >= pr->performance->state_count) -+ return 0; -+ - pr_debug("CPU %d: _PPC is %d - frequency %s limited\n", pr->id, -- (int)ppc, ppc ? "" : "not"); -+ index, index ? "is" : "is not"); - -- pr->performance_platform_limit = (int)ppc; -+ pr->performance_platform_limit = index; - -- if (ppc >= pr->performance->state_count || -- unlikely(!freq_qos_request_active(&pr->perflib_req))) -+ if (unlikely(!freq_qos_request_active(&pr->perflib_req))) - return 0; - -- ret = freq_qos_update_request(&pr->perflib_req, -- pr->performance->states[ppc].core_frequency * 1000); -+ /* -+ * If _PPC returns 0, it means that all of the available states can be -+ * used ("no limit"). -+ */ -+ if (index == 0) -+ qos_value = FREQ_QOS_MAX_DEFAULT_VALUE; -+ else -+ qos_value = pr->performance->states[index].core_frequency * 1000; -+ -+ ret = freq_qos_update_request(&pr->perflib_req, qos_value); - if (ret < 0) { - pr_warn("Failed to update perflib freq constraint: CPU%d (%d)\n", - pr->id, ret); -@@ -168,9 +183,16 @@ void acpi_processor_ppc_init(struct cpufreq_policy *policy) - if (!pr) - continue; - -+ /* -+ * Reset performance_platform_limit in case there is a stale -+ * value in it, so as to make it match the "no limit" QoS value -+ * below. -+ */ -+ pr->performance_platform_limit = 0; -+ - ret = freq_qos_add_request(&policy->constraints, -- &pr->perflib_req, -- FREQ_QOS_MAX, INT_MAX); -+ &pr->perflib_req, FREQ_QOS_MAX, -+ FREQ_QOS_MAX_DEFAULT_VALUE); - if (ret < 0) - pr_err("Failed to add freq constraint for CPU%d (%d)\n", - cpu, ret); -diff --git a/drivers/ata/pata_ns87415.c b/drivers/ata/pata_ns87415.c -index 4b2ba813dcaba..491853b9f0856 100644 ---- a/drivers/ata/pata_ns87415.c -+++ b/drivers/ata/pata_ns87415.c -@@ -261,7 +261,7 @@ static u8 ns87560_check_status(struct ata_port *ap) - * LOCKING: - * Inherited from caller. - */ --void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf) -+static void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf) - { - struct ata_ioports *ioaddr = &ap->ioaddr; - -diff --git a/drivers/base/core.c b/drivers/base/core.c -index f8e157ede44f8..6fb31f4894526 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -3399,6 +3399,50 @@ define_dev_printk_level(_dev_info, KERN_INFO); - - #endif - -+/** -+ * dev_err_probe - probe error check and log helper -+ * @dev: the pointer to the struct device -+ * @err: error value to test -+ * @fmt: printf-style format string -+ * @...: arguments as specified in the format string -+ * -+ * This helper implements common pattern present in probe functions for error -+ * checking: print debug or error message depending if the error value is -+ * -EPROBE_DEFER and propagate error upwards. -+ * It replaces code sequence:: -+ * if (err != -EPROBE_DEFER) -+ * dev_err(dev, ...); -+ * else -+ * dev_dbg(dev, ...); -+ * return err; -+ * -+ * with:: -+ * -+ * return dev_err_probe(dev, err, ...); -+ * -+ * Returns @err. -+ * -+ */ -+int dev_err_probe(const struct device *dev, int err, const char *fmt, ...) -+{ -+ struct va_format vaf; -+ va_list args; -+ -+ va_start(args, fmt); -+ vaf.fmt = fmt; -+ vaf.va = &args; -+ -+ if (err != -EPROBE_DEFER) -+ dev_err(dev, "error %pe: %pV", ERR_PTR(err), &vaf); -+ else -+ dev_dbg(dev, "error %pe: %pV", ERR_PTR(err), &vaf); -+ -+ va_end(args); -+ -+ return err; -+} -+EXPORT_SYMBOL_GPL(dev_err_probe); -+ - static inline bool fwnode_is_primary(struct fwnode_handle *fwnode) - { - return fwnode && !IS_ERR(fwnode->secondary); -diff --git a/drivers/base/power/power.h b/drivers/base/power/power.h -index 39a06a0cfdaa8..310abe7251fc3 100644 ---- a/drivers/base/power/power.h -+++ b/drivers/base/power/power.h -@@ -25,8 +25,11 @@ extern u64 pm_runtime_active_time(struct device *dev); - - #define WAKE_IRQ_DEDICATED_ALLOCATED BIT(0) - #define WAKE_IRQ_DEDICATED_MANAGED BIT(1) -+#define WAKE_IRQ_DEDICATED_REVERSE BIT(2) - #define WAKE_IRQ_DEDICATED_MASK (WAKE_IRQ_DEDICATED_ALLOCATED | \ -- WAKE_IRQ_DEDICATED_MANAGED) -+ WAKE_IRQ_DEDICATED_MANAGED | \ -+ WAKE_IRQ_DEDICATED_REVERSE) -+#define WAKE_IRQ_DEDICATED_ENABLED BIT(3) - - struct wake_irq { - struct device *dev; -@@ -39,7 +42,8 @@ extern void dev_pm_arm_wake_irq(struct wake_irq *wirq); - extern void dev_pm_disarm_wake_irq(struct wake_irq *wirq); - extern void dev_pm_enable_wake_irq_check(struct device *dev, - bool can_change_status); --extern void dev_pm_disable_wake_irq_check(struct device *dev); -+extern void dev_pm_disable_wake_irq_check(struct device *dev, bool cond_disable); -+extern void dev_pm_enable_wake_irq_complete(struct device *dev); - - #ifdef CONFIG_PM_SLEEP - -diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c -index 9ee58bf49d133..d5c2d86fbecd4 100644 ---- a/drivers/base/power/runtime.c -+++ b/drivers/base/power/runtime.c -@@ -659,6 +659,8 @@ static int rpm_suspend(struct device *dev, int rpmflags) - if (retval) - goto fail; - -+ dev_pm_enable_wake_irq_complete(dev); -+ - no_callback: - __update_runtime_status(dev, RPM_SUSPENDED); - pm_runtime_deactivate_timer(dev); -@@ -704,7 +706,7 @@ static int rpm_suspend(struct device *dev, int rpmflags) - return retval; - - fail: -- dev_pm_disable_wake_irq_check(dev); -+ dev_pm_disable_wake_irq_check(dev, true); - __update_runtime_status(dev, RPM_ACTIVE); - dev->power.deferred_resume = false; - wake_up_all(&dev->power.wait_queue); -@@ -887,7 +889,7 @@ static int rpm_resume(struct device *dev, int rpmflags) - - callback = RPM_GET_CALLBACK(dev, runtime_resume); - -- dev_pm_disable_wake_irq_check(dev); -+ dev_pm_disable_wake_irq_check(dev, false); - retval = rpm_callback(callback, dev); - if (retval) { - __update_runtime_status(dev, RPM_SUSPENDED); -diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c -index 5ce77d1ef9fc3..46654adf00a10 100644 ---- a/drivers/base/power/wakeirq.c -+++ b/drivers/base/power/wakeirq.c -@@ -145,24 +145,7 @@ static irqreturn_t handle_threaded_wake_irq(int irq, void *_wirq) - return IRQ_HANDLED; - } - --/** -- * dev_pm_set_dedicated_wake_irq - Request a dedicated wake-up interrupt -- * @dev: Device entry -- * @irq: Device wake-up interrupt -- * -- * Unless your hardware has separate wake-up interrupts in addition -- * to the device IO interrupts, you don't need this. -- * -- * Sets up a threaded interrupt handler for a device that has -- * a dedicated wake-up interrupt in addition to the device IO -- * interrupt. -- * -- * The interrupt starts disabled, and needs to be managed for -- * the device by the bus code or the device driver using -- * dev_pm_enable_wake_irq() and dev_pm_disable_wake_irq() -- * functions. -- */ --int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq) -+static int __dev_pm_set_dedicated_wake_irq(struct device *dev, int irq, unsigned int flag) - { - struct wake_irq *wirq; - int err; -@@ -200,7 +183,7 @@ int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq) - if (err) - goto err_free_irq; - -- wirq->status = WAKE_IRQ_DEDICATED_ALLOCATED; -+ wirq->status = WAKE_IRQ_DEDICATED_ALLOCATED | flag; - - return err; - -@@ -213,8 +196,57 @@ err_free: - - return err; - } -+ -+ -+/** -+ * dev_pm_set_dedicated_wake_irq - Request a dedicated wake-up interrupt -+ * @dev: Device entry -+ * @irq: Device wake-up interrupt -+ * -+ * Unless your hardware has separate wake-up interrupts in addition -+ * to the device IO interrupts, you don't need this. -+ * -+ * Sets up a threaded interrupt handler for a device that has -+ * a dedicated wake-up interrupt in addition to the device IO -+ * interrupt. -+ * -+ * The interrupt starts disabled, and needs to be managed for -+ * the device by the bus code or the device driver using -+ * dev_pm_enable_wake_irq*() and dev_pm_disable_wake_irq*() -+ * functions. -+ */ -+int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq) -+{ -+ return __dev_pm_set_dedicated_wake_irq(dev, irq, 0); -+} - EXPORT_SYMBOL_GPL(dev_pm_set_dedicated_wake_irq); - -+/** -+ * dev_pm_set_dedicated_wake_irq_reverse - Request a dedicated wake-up interrupt -+ * with reverse enable ordering -+ * @dev: Device entry -+ * @irq: Device wake-up interrupt -+ * -+ * Unless your hardware has separate wake-up interrupts in addition -+ * to the device IO interrupts, you don't need this. -+ * -+ * Sets up a threaded interrupt handler for a device that has a dedicated -+ * wake-up interrupt in addition to the device IO interrupt. It sets -+ * the status of WAKE_IRQ_DEDICATED_REVERSE to tell rpm_suspend() -+ * to enable dedicated wake-up interrupt after running the runtime suspend -+ * callback for @dev. -+ * -+ * The interrupt starts disabled, and needs to be managed for -+ * the device by the bus code or the device driver using -+ * dev_pm_enable_wake_irq*() and dev_pm_disable_wake_irq*() -+ * functions. -+ */ -+int dev_pm_set_dedicated_wake_irq_reverse(struct device *dev, int irq) -+{ -+ return __dev_pm_set_dedicated_wake_irq(dev, irq, WAKE_IRQ_DEDICATED_REVERSE); -+} -+EXPORT_SYMBOL_GPL(dev_pm_set_dedicated_wake_irq_reverse); -+ - /** - * dev_pm_enable_wake_irq - Enable device wake-up interrupt - * @dev: Device -@@ -285,25 +317,56 @@ void dev_pm_enable_wake_irq_check(struct device *dev, - return; - - enable: -- enable_irq(wirq->irq); -+ if (!can_change_status || !(wirq->status & WAKE_IRQ_DEDICATED_REVERSE)) { -+ enable_irq(wirq->irq); -+ wirq->status |= WAKE_IRQ_DEDICATED_ENABLED; -+ } - } - - /** - * dev_pm_disable_wake_irq_check - Checks and disables wake-up interrupt - * @dev: Device -+ * @cond_disable: if set, also check WAKE_IRQ_DEDICATED_REVERSE - * - * Disables wake-up interrupt conditionally based on status. - * Should be only called from rpm_suspend() and rpm_resume() path. - */ --void dev_pm_disable_wake_irq_check(struct device *dev) -+void dev_pm_disable_wake_irq_check(struct device *dev, bool cond_disable) - { - struct wake_irq *wirq = dev->power.wakeirq; - - if (!wirq || !((wirq->status & WAKE_IRQ_DEDICATED_MASK))) - return; - -- if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED) -+ if (cond_disable && (wirq->status & WAKE_IRQ_DEDICATED_REVERSE)) -+ return; -+ -+ if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED) { -+ wirq->status &= ~WAKE_IRQ_DEDICATED_ENABLED; - disable_irq_nosync(wirq->irq); -+ } -+} -+ -+/** -+ * dev_pm_enable_wake_irq_complete - enable wake IRQ not enabled before -+ * @dev: Device using the wake IRQ -+ * -+ * Enable wake IRQ conditionally based on status, mainly used if want to -+ * enable wake IRQ after running ->runtime_suspend() which depends on -+ * WAKE_IRQ_DEDICATED_REVERSE. -+ * -+ * Should be only called from rpm_suspend() path. -+ */ -+void dev_pm_enable_wake_irq_complete(struct device *dev) -+{ -+ struct wake_irq *wirq = dev->power.wakeirq; -+ -+ if (!wirq || !(wirq->status & WAKE_IRQ_DEDICATED_MASK)) -+ return; -+ -+ if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED && -+ wirq->status & WAKE_IRQ_DEDICATED_REVERSE) -+ enable_irq(wirq->irq); - } - - /** -@@ -320,7 +383,7 @@ void dev_pm_arm_wake_irq(struct wake_irq *wirq) - - if (device_may_wakeup(wirq->dev)) { - if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED && -- !pm_runtime_status_suspended(wirq->dev)) -+ !(wirq->status & WAKE_IRQ_DEDICATED_ENABLED)) - enable_irq(wirq->irq); - - enable_irq_wake(wirq->irq); -@@ -343,7 +406,7 @@ void dev_pm_disarm_wake_irq(struct wake_irq *wirq) - disable_irq_wake(wirq->irq); - - if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED && -- !pm_runtime_status_suspended(wirq->dev)) -+ !(wirq->status & WAKE_IRQ_DEDICATED_ENABLED)) - disable_irq_nosync(wirq->irq); - } - } -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index b8f57b1c2864b..d8821c9cb1700 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -2037,7 +2037,7 @@ static int loop_add(struct loop_device **l, int i) - lo->tag_set.queue_depth = 128; - lo->tag_set.numa_node = NUMA_NO_NODE; - lo->tag_set.cmd_size = sizeof(struct loop_cmd); -- lo->tag_set.flags = BLK_MQ_F_SHOULD_MERGE; -+ lo->tag_set.flags = BLK_MQ_F_SHOULD_MERGE | BLK_MQ_F_NO_SCHED; - lo->tag_set.driver_data = lo; - - err = blk_mq_alloc_tag_set(&lo->tag_set); -diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c -index cb0660304e480..ef47d1d58ac3a 100644 ---- a/drivers/char/tpm/tpm_tis_core.c -+++ b/drivers/char/tpm/tpm_tis_core.c -@@ -266,6 +266,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) - int size = 0; - int status; - u32 expected; -+ int rc; - - if (count < TPM_HEADER_SIZE) { - size = -EIO; -@@ -285,8 +286,13 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) - goto out; - } - -- size += recv_data(chip, &buf[TPM_HEADER_SIZE], -- expected - TPM_HEADER_SIZE); -+ rc = recv_data(chip, &buf[TPM_HEADER_SIZE], -+ expected - TPM_HEADER_SIZE); -+ if (rc < 0) { -+ size = rc; -+ goto out; -+ } -+ size += rc; - if (size < expected) { - dev_err(&chip->dev, "Unable to read remainder of result\n"); - size = -ETIME; -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index 88fe803a044d5..06302eaa3e942 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -442,20 +442,6 @@ static void intel_pstate_init_acpi_perf_limits(struct cpufreq_policy *policy) - (u32) cpu->acpi_perf_data.states[i].control); - } - -- /* -- * The _PSS table doesn't contain whole turbo frequency range. -- * This just contains +1 MHZ above the max non turbo frequency, -- * with control value corresponding to max turbo ratio. But -- * when cpufreq set policy is called, it will call with this -- * max frequency, which will cause a reduced performance as -- * this driver uses real max turbo frequency as the max -- * frequency. So correct this frequency in _PSS table to -- * correct max turbo frequency based on the turbo state. -- * Also need to convert to MHz as _PSS freq is in MHz. -- */ -- if (!global.turbo_disabled) -- cpu->acpi_perf_data.states[0].core_frequency = -- policy->cpuinfo.max_freq / 1000; - cpu->valid_pss_table = true; - pr_debug("_PPC limits will be enforced\n"); - -diff --git a/drivers/gpio/gpio-tps68470.c b/drivers/gpio/gpio-tps68470.c -index aff6e504c6668..9704cff9b4aa3 100644 ---- a/drivers/gpio/gpio-tps68470.c -+++ b/drivers/gpio/gpio-tps68470.c -@@ -91,13 +91,13 @@ static int tps68470_gpio_output(struct gpio_chip *gc, unsigned int offset, - struct tps68470_gpio_data *tps68470_gpio = gpiochip_get_data(gc); - struct regmap *regmap = tps68470_gpio->tps68470_regmap; - -+ /* Set the initial value */ -+ tps68470_gpio_set(gc, offset, value); -+ - /* rest are always outputs */ - if (offset >= TPS68470_N_REGULAR_GPIO) - return 0; - -- /* Set the initial value */ -- tps68470_gpio_set(gc, offset, value); -- - return regmap_update_bits(regmap, TPS68470_GPIO_CTL_REG_A(offset), - TPS68470_GPIO_MODE_MASK, - TPS68470_GPIO_MODE_OUT_CMOS); -diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c -index 593b8d83179c9..65c2c5361e5fc 100644 ---- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c -+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c -@@ -71,7 +71,7 @@ static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit - * since we've already mapped it once in - * submit_reloc() - */ -- if (WARN_ON(!ptr)) -+ if (WARN_ON(IS_ERR_OR_NULL(ptr))) - return; - - for (i = 0; i < dwords; i++) { -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h -index 68cccfa2870a3..9c8eb1ae4acfc 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h -@@ -200,7 +200,7 @@ static const struct a6xx_shader_block { - SHADER(A6XX_SP_LB_3_DATA, 0x800), - SHADER(A6XX_SP_LB_4_DATA, 0x800), - SHADER(A6XX_SP_LB_5_DATA, 0x200), -- SHADER(A6XX_SP_CB_BINDLESS_DATA, 0x2000), -+ SHADER(A6XX_SP_CB_BINDLESS_DATA, 0x800), - SHADER(A6XX_SP_CB_LEGACY_DATA, 0x280), - SHADER(A6XX_SP_UAV_DATA, 0x80), - SHADER(A6XX_SP_INST_TAG, 0x80), -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h -index cf4b9b5964c6c..cd6c3518ba021 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h -@@ -14,19 +14,6 @@ - - #define DPU_PERF_DEFAULT_MAX_CORE_CLK_RATE 412500000 - --/** -- * enum dpu_core_perf_data_bus_id - data bus identifier -- * @DPU_CORE_PERF_DATA_BUS_ID_MNOC: DPU/MNOC data bus -- * @DPU_CORE_PERF_DATA_BUS_ID_LLCC: MNOC/LLCC data bus -- * @DPU_CORE_PERF_DATA_BUS_ID_EBI: LLCC/EBI data bus -- */ --enum dpu_core_perf_data_bus_id { -- DPU_CORE_PERF_DATA_BUS_ID_MNOC, -- DPU_CORE_PERF_DATA_BUS_ID_LLCC, -- DPU_CORE_PERF_DATA_BUS_ID_EBI, -- DPU_CORE_PERF_DATA_BUS_ID_MAX, --}; -- - /** - * struct dpu_core_perf_params - definition of performance parameters - * @max_per_pipe_ib: maximum instantaneous bandwidth request -diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c -index 2e97e56c72c74..5cdc60717006b 100644 ---- a/drivers/hwmon/nct7802.c -+++ b/drivers/hwmon/nct7802.c -@@ -708,7 +708,7 @@ static umode_t nct7802_temp_is_visible(struct kobject *kobj, - if (index >= 38 && index < 46 && !(reg & 0x01)) /* PECI 0 */ - return 0; - -- if (index >= 0x46 && (!(reg & 0x02))) /* PECI 1 */ -+ if (index >= 46 && !(reg & 0x02)) /* PECI 1 */ - return 0; - - return attr->mode; -diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c -index 02caf9a439cf1..395d8a99b12e4 100644 ---- a/drivers/infiniband/hw/mlx4/qp.c -+++ b/drivers/infiniband/hw/mlx4/qp.c -@@ -556,15 +556,15 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx, - return (-EOPNOTSUPP); - } - -- if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4 | -- MLX4_IB_RX_HASH_DST_IPV4 | -- MLX4_IB_RX_HASH_SRC_IPV6 | -- MLX4_IB_RX_HASH_DST_IPV6 | -- MLX4_IB_RX_HASH_SRC_PORT_TCP | -- MLX4_IB_RX_HASH_DST_PORT_TCP | -- MLX4_IB_RX_HASH_SRC_PORT_UDP | -- MLX4_IB_RX_HASH_DST_PORT_UDP | -- MLX4_IB_RX_HASH_INNER)) { -+ if (ucmd->rx_hash_fields_mask & ~(u64)(MLX4_IB_RX_HASH_SRC_IPV4 | -+ MLX4_IB_RX_HASH_DST_IPV4 | -+ MLX4_IB_RX_HASH_SRC_IPV6 | -+ MLX4_IB_RX_HASH_DST_IPV6 | -+ MLX4_IB_RX_HASH_SRC_PORT_TCP | -+ MLX4_IB_RX_HASH_DST_PORT_TCP | -+ MLX4_IB_RX_HASH_SRC_PORT_UDP | -+ MLX4_IB_RX_HASH_DST_PORT_UDP | -+ MLX4_IB_RX_HASH_INNER)) { - pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n", - ucmd->rx_hash_fields_mask); - return (-EOPNOTSUPP); -diff --git a/drivers/irqchip/irq-bcm6345-l1.c b/drivers/irqchip/irq-bcm6345-l1.c -index 1bd0621c4ce2a..4827a11832478 100644 ---- a/drivers/irqchip/irq-bcm6345-l1.c -+++ b/drivers/irqchip/irq-bcm6345-l1.c -@@ -82,6 +82,7 @@ struct bcm6345_l1_chip { - }; - - struct bcm6345_l1_cpu { -+ struct bcm6345_l1_chip *intc; - void __iomem *map_base; - unsigned int parent_irq; - u32 enable_cache[]; -@@ -115,17 +116,11 @@ static inline unsigned int cpu_for_irq(struct bcm6345_l1_chip *intc, - - static void bcm6345_l1_irq_handle(struct irq_desc *desc) - { -- struct bcm6345_l1_chip *intc = irq_desc_get_handler_data(desc); -- struct bcm6345_l1_cpu *cpu; -+ struct bcm6345_l1_cpu *cpu = irq_desc_get_handler_data(desc); -+ struct bcm6345_l1_chip *intc = cpu->intc; - struct irq_chip *chip = irq_desc_get_chip(desc); - unsigned int idx; - --#ifdef CONFIG_SMP -- cpu = intc->cpus[cpu_logical_map(smp_processor_id())]; --#else -- cpu = intc->cpus[0]; --#endif -- - chained_irq_enter(chip, desc); - - for (idx = 0; idx < intc->n_words; idx++) { -@@ -257,6 +252,7 @@ static int __init bcm6345_l1_init_one(struct device_node *dn, - if (!cpu) - return -ENOMEM; - -+ cpu->intc = intc; - cpu->map_base = ioremap(res.start, sz); - if (!cpu->map_base) - return -ENOMEM; -@@ -272,7 +268,7 @@ static int __init bcm6345_l1_init_one(struct device_node *dn, - return -EINVAL; - } - irq_set_chained_handler_and_data(cpu->parent_irq, -- bcm6345_l1_irq_handle, intc); -+ bcm6345_l1_irq_handle, cpu); - - return 0; - } -diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c -index 41ff2e3dc8430..0a683a66fc612 100644 ---- a/drivers/isdn/hardware/mISDN/hfcpci.c -+++ b/drivers/isdn/hardware/mISDN/hfcpci.c -@@ -839,7 +839,7 @@ hfcpci_fill_fifo(struct bchannel *bch) - *z1t = cpu_to_le16(new_z1); /* now send data */ - if (bch->tx_idx < bch->tx_skb->len) - return; -- dev_kfree_skb(bch->tx_skb); -+ dev_kfree_skb_any(bch->tx_skb); - if (get_next_bframe(bch)) - goto next_t_frame; - return; -@@ -895,7 +895,7 @@ hfcpci_fill_fifo(struct bchannel *bch) - } - bz->za[new_f1].z1 = cpu_to_le16(new_z1); /* for next buffer */ - bz->f1 = new_f1; /* next frame */ -- dev_kfree_skb(bch->tx_skb); -+ dev_kfree_skb_any(bch->tx_skb); - get_next_bframe(bch); - } - -@@ -1119,7 +1119,7 @@ tx_birq(struct bchannel *bch) - if (bch->tx_skb && bch->tx_idx < bch->tx_skb->len) - hfcpci_fill_fifo(bch); - else { -- dev_kfree_skb(bch->tx_skb); -+ dev_kfree_skb_any(bch->tx_skb); - if (get_next_bframe(bch)) - hfcpci_fill_fifo(bch); - } -@@ -2272,7 +2272,7 @@ _hfcpci_softirq(struct device *dev, void *unused) - return 0; - - if (hc->hw.int_m2 & HFCPCI_IRQ_ENABLE) { -- spin_lock(&hc->lock); -+ spin_lock_irq(&hc->lock); - bch = Sel_BCS(hc, hc->hw.bswapped ? 2 : 1); - if (bch && bch->state == ISDN_P_B_RAW) { /* B1 rx&tx */ - main_rec_hfcpci(bch); -@@ -2283,7 +2283,7 @@ _hfcpci_softirq(struct device *dev, void *unused) - main_rec_hfcpci(bch); - tx_birq(bch); - } -- spin_unlock(&hc->lock); -+ spin_unlock_irq(&hc->lock); - } - return 0; - } -diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c -index a1df0d95151c6..5310e1f4a2826 100644 ---- a/drivers/md/bcache/alloc.c -+++ b/drivers/md/bcache/alloc.c -@@ -49,7 +49,7 @@ - * - * bch_bucket_alloc() allocates a single bucket from a specific cache. - * -- * bch_bucket_alloc_set() allocates one or more buckets from different caches -+ * bch_bucket_alloc_set() allocates one bucket from different caches - * out of a cache set. - * - * free_some_buckets() drives all the processes described above. It's called -@@ -488,34 +488,29 @@ void bch_bucket_free(struct cache_set *c, struct bkey *k) - } - - int __bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve, -- struct bkey *k, int n, bool wait) -+ struct bkey *k, bool wait) - { -- int i; -+ struct cache *ca; -+ long b; - - /* No allocation if CACHE_SET_IO_DISABLE bit is set */ - if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &c->flags))) - return -1; - - lockdep_assert_held(&c->bucket_lock); -- BUG_ON(!n || n > c->caches_loaded || n > MAX_CACHES_PER_SET); - - bkey_init(k); - -- /* sort by free space/prio of oldest data in caches */ -- -- for (i = 0; i < n; i++) { -- struct cache *ca = c->cache_by_alloc[i]; -- long b = bch_bucket_alloc(ca, reserve, wait); -+ ca = c->cache_by_alloc[0]; -+ b = bch_bucket_alloc(ca, reserve, wait); -+ if (b == -1) -+ goto err; - -- if (b == -1) -- goto err; -+ k->ptr[0] = MAKE_PTR(ca->buckets[b].gen, -+ bucket_to_sector(c, b), -+ ca->sb.nr_this_dev); - -- k->ptr[i] = MAKE_PTR(ca->buckets[b].gen, -- bucket_to_sector(c, b), -- ca->sb.nr_this_dev); -- -- SET_KEY_PTRS(k, i + 1); -- } -+ SET_KEY_PTRS(k, 1); - - return 0; - err: -@@ -525,12 +520,12 @@ err: - } - - int bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve, -- struct bkey *k, int n, bool wait) -+ struct bkey *k, bool wait) - { - int ret; - - mutex_lock(&c->bucket_lock); -- ret = __bch_bucket_alloc_set(c, reserve, k, n, wait); -+ ret = __bch_bucket_alloc_set(c, reserve, k, wait); - mutex_unlock(&c->bucket_lock); - return ret; - } -@@ -638,7 +633,7 @@ bool bch_alloc_sectors(struct cache_set *c, - - spin_unlock(&c->data_bucket_lock); - -- if (bch_bucket_alloc_set(c, watermark, &alloc.key, 1, wait)) -+ if (bch_bucket_alloc_set(c, watermark, &alloc.key, wait)) - return false; - - spin_lock(&c->data_bucket_lock); -diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h -index 36de6f7ddf221..1dd9298cb0e02 100644 ---- a/drivers/md/bcache/bcache.h -+++ b/drivers/md/bcache/bcache.h -@@ -970,9 +970,9 @@ void bch_bucket_free(struct cache_set *c, struct bkey *k); - - long bch_bucket_alloc(struct cache *ca, unsigned int reserve, bool wait); - int __bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve, -- struct bkey *k, int n, bool wait); -+ struct bkey *k, bool wait); - int bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve, -- struct bkey *k, int n, bool wait); -+ struct bkey *k, bool wait); - bool bch_alloc_sectors(struct cache_set *c, struct bkey *k, - unsigned int sectors, unsigned int write_point, - unsigned int write_prio, bool wait); -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index b7fea84d19ad9..cc0c1f2bba45c 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -1137,11 +1137,13 @@ struct btree *__bch_btree_node_alloc(struct cache_set *c, struct btree_op *op, - struct btree *parent) - { - BKEY_PADDED(key) k; -- struct btree *b = ERR_PTR(-EAGAIN); -+ struct btree *b; - - mutex_lock(&c->bucket_lock); - retry: -- if (__bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, 1, wait)) -+ /* return ERR_PTR(-EAGAIN) when it fails */ -+ b = ERR_PTR(-EAGAIN); -+ if (__bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, wait)) - goto err; - - bkey_put(c, &k.key); -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 70e46e0d2f1ac..6afaa5e852837 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -428,7 +428,7 @@ static int __uuid_write(struct cache_set *c) - closure_init_stack(&cl); - lockdep_assert_held(&bch_register_lock); - -- if (bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, 1, true)) -+ if (bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, true)) - return 1; - - SET_KEY_SIZE(&k.key, c->sb.bucket_size); -diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c -index b61aac00ff409..859073193f5b4 100644 ---- a/drivers/md/dm-cache-policy-smq.c -+++ b/drivers/md/dm-cache-policy-smq.c -@@ -854,7 +854,13 @@ struct smq_policy { - - struct background_tracker *bg_work; - -- bool migrations_allowed; -+ bool migrations_allowed:1; -+ -+ /* -+ * If this is set the policy will try and clean the whole cache -+ * even if the device is not idle. -+ */ -+ bool cleaner:1; - }; - - /*----------------------------------------------------------------*/ -@@ -1133,7 +1139,7 @@ static bool clean_target_met(struct smq_policy *mq, bool idle) - * Cache entries may not be populated. So we cannot rely on the - * size of the clean queue. - */ -- if (idle) { -+ if (idle || mq->cleaner) { - /* - * We'd like to clean everything. - */ -@@ -1716,11 +1722,9 @@ static void calc_hotspot_params(sector_t origin_size, - *hotspot_block_size /= 2u; - } - --static struct dm_cache_policy *__smq_create(dm_cblock_t cache_size, -- sector_t origin_size, -- sector_t cache_block_size, -- bool mimic_mq, -- bool migrations_allowed) -+static struct dm_cache_policy * -+__smq_create(dm_cblock_t cache_size, sector_t origin_size, sector_t cache_block_size, -+ bool mimic_mq, bool migrations_allowed, bool cleaner) - { - unsigned i; - unsigned nr_sentinels_per_queue = 2u * NR_CACHE_LEVELS; -@@ -1807,6 +1811,7 @@ static struct dm_cache_policy *__smq_create(dm_cblock_t cache_size, - goto bad_btracker; - - mq->migrations_allowed = migrations_allowed; -+ mq->cleaner = cleaner; - - return &mq->policy; - -@@ -1830,21 +1835,24 @@ static struct dm_cache_policy *smq_create(dm_cblock_t cache_size, - sector_t origin_size, - sector_t cache_block_size) - { -- return __smq_create(cache_size, origin_size, cache_block_size, false, true); -+ return __smq_create(cache_size, origin_size, cache_block_size, -+ false, true, false); - } - - static struct dm_cache_policy *mq_create(dm_cblock_t cache_size, - sector_t origin_size, - sector_t cache_block_size) - { -- return __smq_create(cache_size, origin_size, cache_block_size, true, true); -+ return __smq_create(cache_size, origin_size, cache_block_size, -+ true, true, false); - } - - static struct dm_cache_policy *cleaner_create(dm_cblock_t cache_size, - sector_t origin_size, - sector_t cache_block_size) - { -- return __smq_create(cache_size, origin_size, cache_block_size, false, false); -+ return __smq_create(cache_size, origin_size, cache_block_size, -+ false, false, true); - } - - /*----------------------------------------------------------------*/ -diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c -index 882e83d51ef43..9f05ae2b90191 100644 ---- a/drivers/md/dm-raid.c -+++ b/drivers/md/dm-raid.c -@@ -3284,15 +3284,19 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) - /* Try to adjust the raid4/5/6 stripe cache size to the stripe size */ - if (rs_is_raid456(rs)) { - r = rs_set_raid456_stripe_cache(rs); -- if (r) -+ if (r) { -+ mddev_unlock(&rs->md); - goto bad_stripe_cache; -+ } - } - - /* Now do an early reshape check */ - if (test_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags)) { - r = rs_check_reshape(rs); -- if (r) -+ if (r) { -+ mddev_unlock(&rs->md); - goto bad_check_reshape; -+ } - - /* Restore new, ctr requested layout to perform check */ - rs_config_restore(rs, &rs_layout); -@@ -3301,6 +3305,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) - r = rs->md.pers->check_reshape(&rs->md); - if (r) { - ti->error = "Reshape check failed"; -+ mddev_unlock(&rs->md); - goto bad_check_reshape; - } - } -diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c -index 8339c020c1a13..29f3d39138e84 100644 ---- a/drivers/mtd/nand/raw/meson_nand.c -+++ b/drivers/mtd/nand/raw/meson_nand.c -@@ -1177,7 +1177,6 @@ static int meson_nand_attach_chip(struct nand_chip *nand) - struct meson_nfc *nfc = nand_get_controller_data(nand); - struct meson_nfc_nand_chip *meson_chip = to_meson_nand(nand); - struct mtd_info *mtd = nand_to_mtd(nand); -- int nsectors = mtd->writesize / 1024; - int ret; - - if (!mtd->name) { -@@ -1195,7 +1194,7 @@ static int meson_nand_attach_chip(struct nand_chip *nand) - nand->options |= NAND_NO_SUBPAGE_WRITE; - - ret = nand_ecc_choose_conf(nand, nfc->data->ecc_caps, -- mtd->oobsize - 2 * nsectors); -+ mtd->oobsize - 2); - if (ret) { - dev_err(nfc->dev, "failed to ECC init\n"); - return -EINVAL; -diff --git a/drivers/mtd/nand/raw/omap_elm.c b/drivers/mtd/nand/raw/omap_elm.c -index 6e0e31eab7cce..c4064f8fd6118 100644 ---- a/drivers/mtd/nand/raw/omap_elm.c -+++ b/drivers/mtd/nand/raw/omap_elm.c -@@ -174,17 +174,17 @@ static void elm_load_syndrome(struct elm_info *info, - switch (info->bch_type) { - case BCH8_ECC: - /* syndrome fragment 0 = ecc[9-12B] */ -- val = cpu_to_be32(*(u32 *) &ecc[9]); -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[9]); - elm_write_reg(info, offset, val); - - /* syndrome fragment 1 = ecc[5-8B] */ - offset += 4; -- val = cpu_to_be32(*(u32 *) &ecc[5]); -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[5]); - elm_write_reg(info, offset, val); - - /* syndrome fragment 2 = ecc[1-4B] */ - offset += 4; -- val = cpu_to_be32(*(u32 *) &ecc[1]); -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[1]); - elm_write_reg(info, offset, val); - - /* syndrome fragment 3 = ecc[0B] */ -@@ -194,35 +194,35 @@ static void elm_load_syndrome(struct elm_info *info, - break; - case BCH4_ECC: - /* syndrome fragment 0 = ecc[20-52b] bits */ -- val = (cpu_to_be32(*(u32 *) &ecc[3]) >> 4) | -+ val = ((__force u32)cpu_to_be32(*(u32 *)&ecc[3]) >> 4) | - ((ecc[2] & 0xf) << 28); - elm_write_reg(info, offset, val); - - /* syndrome fragment 1 = ecc[0-20b] bits */ - offset += 4; -- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 12; -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 12; - elm_write_reg(info, offset, val); - break; - case BCH16_ECC: -- val = cpu_to_be32(*(u32 *) &ecc[22]); -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[22]); - elm_write_reg(info, offset, val); - offset += 4; -- val = cpu_to_be32(*(u32 *) &ecc[18]); -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[18]); - elm_write_reg(info, offset, val); - offset += 4; -- val = cpu_to_be32(*(u32 *) &ecc[14]); -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[14]); - elm_write_reg(info, offset, val); - offset += 4; -- val = cpu_to_be32(*(u32 *) &ecc[10]); -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[10]); - elm_write_reg(info, offset, val); - offset += 4; -- val = cpu_to_be32(*(u32 *) &ecc[6]); -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[6]); - elm_write_reg(info, offset, val); - offset += 4; -- val = cpu_to_be32(*(u32 *) &ecc[2]); -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[2]); - elm_write_reg(info, offset, val); - offset += 4; -- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 16; -+ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 16; - elm_write_reg(info, offset, val); - break; - default: -diff --git a/drivers/mtd/nand/spi/toshiba.c b/drivers/mtd/nand/spi/toshiba.c -index 1cb3760ff779f..b3ed6b42a76f6 100644 ---- a/drivers/mtd/nand/spi/toshiba.c -+++ b/drivers/mtd/nand/spi/toshiba.c -@@ -60,7 +60,7 @@ static int tc58cxgxsx_ecc_get_status(struct spinand_device *spinand, - { - struct nand_device *nand = spinand_to_nand(spinand); - u8 mbf = 0; -- struct spi_mem_op op = SPINAND_GET_FEATURE_OP(0x30, &mbf); -+ struct spi_mem_op op = SPINAND_GET_FEATURE_OP(0x30, spinand->scratchbuf); - - switch (status & STATUS_ECC_MASK) { - case STATUS_ECC_NO_BITFLIPS: -@@ -79,7 +79,7 @@ static int tc58cxgxsx_ecc_get_status(struct spinand_device *spinand, - if (spi_mem_exec_op(spinand->spimem, &op)) - return nand->eccreq.strength; - -- mbf >>= 4; -+ mbf = *(spinand->scratchbuf) >> 4; - - if (WARN_ON(mbf > nand->eccreq.strength || !mbf)) - return nand->eccreq.strength; -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index cdb9efae6032d..dcaefb47d1f2d 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1153,6 +1153,11 @@ static void bond_setup_by_slave(struct net_device *bond_dev, - - memcpy(bond_dev->broadcast, slave_dev->broadcast, - slave_dev->addr_len); -+ -+ if (slave_dev->flags & IFF_POINTOPOINT) { -+ bond_dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST); -+ bond_dev->flags |= (IFF_POINTOPOINT | IFF_NOARP); -+ } - } - - /* On bonding slaves other than the currently active slave, suppress -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index abd2a57b18cbb..de5e5385fc110 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -732,6 +732,8 @@ static int gs_can_close(struct net_device *netdev) - usb_kill_anchored_urbs(&dev->tx_submitted); - atomic_set(&dev->active_tx_urbs, 0); - -+ dev->can.state = CAN_STATE_STOPPED; -+ - /* reset the device */ - rc = gs_cmd_reset(dev); - if (rc < 0) -diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c -index 4f7b65825c159..6bdd79a057190 100644 ---- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c -+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c -@@ -1638,8 +1638,11 @@ static int atl1e_tso_csum(struct atl1e_adapter *adapter, - real_len = (((unsigned char *)ip_hdr(skb) - skb->data) - + ntohs(ip_hdr(skb)->tot_len)); - -- if (real_len < skb->len) -- pskb_trim(skb, real_len); -+ if (real_len < skb->len) { -+ err = pskb_trim(skb, real_len); -+ if (err) -+ return err; -+ } - - hdr_len = (skb_transport_offset(skb) + tcp_hdrlen(skb)); - if (unlikely(skb->len == hdr_len)) { -diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c -index f1cce7636722e..a7a3e2ee06768 100644 ---- a/drivers/net/ethernet/emulex/benet/be_main.c -+++ b/drivers/net/ethernet/emulex/benet/be_main.c -@@ -1140,7 +1140,8 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter, - (lancer_chip(adapter) || BE3_chip(adapter) || - skb_vlan_tag_present(skb)) && is_ipv4_pkt(skb)) { - ip = (struct iphdr *)ip_hdr(skb); -- pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len)); -+ if (unlikely(pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len)))) -+ goto tx_drop; - } - - /* If vlan tag is already inlined in the packet, skip HW VLAN -diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c -index 276f04c0e51d6..31f60657f5321 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c -@@ -1755,7 +1755,7 @@ void i40e_dbg_pf_exit(struct i40e_pf *pf) - void i40e_dbg_init(void) - { - i40e_dbg_root = debugfs_create_dir(i40e_driver_name, NULL); -- if (!i40e_dbg_root) -+ if (IS_ERR(i40e_dbg_root)) - pr_info("init of debugfs failed\n"); - } - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index a864b91065e33..567bb7792f8fe 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -8423,7 +8423,7 @@ static void ixgbe_atr(struct ixgbe_ring *ring, - struct ixgbe_adapter *adapter = q_vector->adapter; - - if (unlikely(skb_tail_pointer(skb) < hdr.network + -- VXLAN_HEADROOM)) -+ vxlan_headroom(0))) - return; - - /* verify the port is recognized as VXLAN */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c -index 0dd17514caae8..d212706f1bdea 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c -@@ -121,7 +121,9 @@ static int mlx5e_ipsec_remove_trailer(struct sk_buff *skb, struct xfrm_state *x) - - trailer_len = alen + plen + 2; - -- pskb_trim(skb, skb->len - trailer_len); -+ ret = pskb_trim(skb, skb->len - trailer_len); -+ if (unlikely(ret)) -+ return ret; - if (skb->protocol == htons(ETH_P_IP)) { - ipv4hdr->tot_len = htons(ntohs(ipv4hdr->tot_len) - trailer_len); - ip_send_check(ipv4hdr); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c -index 64f6f529f6eb1..45b90c7698787 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c -@@ -423,11 +423,12 @@ int mlx5dr_cmd_create_reformat_ctx(struct mlx5_core_dev *mdev, - - err = mlx5_cmd_exec(mdev, in, inlen, out, sizeof(out)); - if (err) -- return err; -+ goto err_free_in; - - *reformat_id = MLX5_GET(alloc_packet_reformat_context_out, out, packet_reformat_id); -- kvfree(in); - -+err_free_in: -+ kvfree(in); - return err; - } - -diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c -index a109438f4a78e..86edc95919146 100644 ---- a/drivers/net/ethernet/xilinx/ll_temac_main.c -+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c -@@ -1481,15 +1481,15 @@ static int temac_probe(struct platform_device *pdev) - } - - /* Error handle returned DMA RX and TX interrupts */ -- if (lp->rx_irq < 0) { -- if (lp->rx_irq != -EPROBE_DEFER) -- dev_err(&pdev->dev, "could not get DMA RX irq\n"); -- return lp->rx_irq; -+ if (lp->rx_irq <= 0) { -+ rc = lp->rx_irq ?: -EINVAL; -+ return dev_err_probe(&pdev->dev, rc, -+ "could not get DMA RX irq\n"); - } -- if (lp->tx_irq < 0) { -- if (lp->tx_irq != -EPROBE_DEFER) -- dev_err(&pdev->dev, "could not get DMA TX irq\n"); -- return lp->tx_irq; -+ if (lp->tx_irq <= 0) { -+ rc = lp->tx_irq ?: -EINVAL; -+ return dev_err_probe(&pdev->dev, rc, -+ "could not get DMA TX irq\n"); - } - - if (temac_np) { -diff --git a/drivers/net/tap.c b/drivers/net/tap.c -index 574c17aa4b09a..c299faaf4b2d5 100644 ---- a/drivers/net/tap.c -+++ b/drivers/net/tap.c -@@ -525,7 +525,7 @@ static int tap_open(struct inode *inode, struct file *file) - q->sock.state = SS_CONNECTED; - q->sock.file = file; - q->sock.ops = &tap_socket_ops; -- sock_init_data_uid(&q->sock, &q->sk, inode->i_uid); -+ sock_init_data_uid(&q->sock, &q->sk, current_fsuid()); - q->sk.sk_write_space = tap_sock_write_space; - q->sk.sk_destruct = tap_sock_destruct; - q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP; -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index 227d97b4dc224..5c72e9ac4804d 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -2129,6 +2129,15 @@ static void team_setup_by_port(struct net_device *dev, - dev->mtu = port_dev->mtu; - memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len); - eth_hw_addr_inherit(dev, port_dev); -+ -+ if (port_dev->flags & IFF_POINTOPOINT) { -+ dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST); -+ dev->flags |= (IFF_POINTOPOINT | IFF_NOARP); -+ } else if ((port_dev->flags & (IFF_BROADCAST | IFF_MULTICAST)) == -+ (IFF_BROADCAST | IFF_MULTICAST)) { -+ dev->flags |= (IFF_BROADCAST | IFF_MULTICAST); -+ dev->flags &= ~(IFF_POINTOPOINT | IFF_NOARP); -+ } - } - - static int team_dev_type_check_change(struct net_device *dev, -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index a4e44f98fbc33..309a0dd16bdc1 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -3534,7 +3534,7 @@ static int tun_chr_open(struct inode *inode, struct file * file) - tfile->socket.file = file; - tfile->socket.ops = &tun_socket_ops; - -- sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid); -+ sock_init_data_uid(&tfile->socket, &tfile->sk, current_fsuid()); - - tfile->sk.sk_write_space = tun_sock_write_space; - tfile->sk.sk_sndbuf = INT_MAX; -diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c -index e457fa8c0ca5d..08800f2a7e458 100644 ---- a/drivers/net/usb/cdc_ether.c -+++ b/drivers/net/usb/cdc_ether.c -@@ -605,9 +605,23 @@ static const struct usb_device_id products[] = { - .match_flags = USB_DEVICE_ID_MATCH_INT_INFO - | USB_DEVICE_ID_MATCH_DEVICE, - .idVendor = 0x04DD, -+ .idProduct = 0x8005, /* A-300 */ -+ ZAURUS_FAKE_INTERFACE, -+ .driver_info = 0, -+}, { -+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO -+ | USB_DEVICE_ID_MATCH_DEVICE, -+ .idVendor = 0x04DD, - .idProduct = 0x8006, /* B-500/SL-5600 */ - ZAURUS_MASTER_INTERFACE, - .driver_info = 0, -+}, { -+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO -+ | USB_DEVICE_ID_MATCH_DEVICE, -+ .idVendor = 0x04DD, -+ .idProduct = 0x8006, /* B-500/SL-5600 */ -+ ZAURUS_FAKE_INTERFACE, -+ .driver_info = 0, - }, { - .match_flags = USB_DEVICE_ID_MATCH_INT_INFO - | USB_DEVICE_ID_MATCH_DEVICE, -@@ -615,6 +629,13 @@ static const struct usb_device_id products[] = { - .idProduct = 0x8007, /* C-700 */ - ZAURUS_MASTER_INTERFACE, - .driver_info = 0, -+}, { -+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO -+ | USB_DEVICE_ID_MATCH_DEVICE, -+ .idVendor = 0x04DD, -+ .idProduct = 0x8007, /* C-700 */ -+ ZAURUS_FAKE_INTERFACE, -+ .driver_info = 0, - }, { - .match_flags = USB_DEVICE_ID_MATCH_INT_INFO - | USB_DEVICE_ID_MATCH_DEVICE, -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index 7af8c3a8f3f17..bc37e268a15e7 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -1756,6 +1756,10 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) - } else if (!info->in || !info->out) - status = usbnet_get_endpoints (dev, udev); - else { -+ u8 ep_addrs[3] = { -+ info->in + USB_DIR_IN, info->out + USB_DIR_OUT, 0 -+ }; -+ - dev->in = usb_rcvbulkpipe (xdev, info->in); - dev->out = usb_sndbulkpipe (xdev, info->out); - if (!(info->flags & FLAG_NO_SETINT)) -@@ -1765,6 +1769,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) - else - status = 0; - -+ if (status == 0 && !usb_check_bulk_endpoints(udev, ep_addrs)) -+ status = -EINVAL; - } - if (status >= 0 && dev->status) - status = init_status (dev, udev); -diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c -index 7984f2157d222..df3617c4c44e8 100644 ---- a/drivers/net/usb/zaurus.c -+++ b/drivers/net/usb/zaurus.c -@@ -289,9 +289,23 @@ static const struct usb_device_id products [] = { - .match_flags = USB_DEVICE_ID_MATCH_INT_INFO - | USB_DEVICE_ID_MATCH_DEVICE, - .idVendor = 0x04DD, -+ .idProduct = 0x8005, /* A-300 */ -+ ZAURUS_FAKE_INTERFACE, -+ .driver_info = (unsigned long)&bogus_mdlm_info, -+}, { -+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO -+ | USB_DEVICE_ID_MATCH_DEVICE, -+ .idVendor = 0x04DD, - .idProduct = 0x8006, /* B-500/SL-5600 */ - ZAURUS_MASTER_INTERFACE, - .driver_info = ZAURUS_PXA_INFO, -+}, { -+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO -+ | USB_DEVICE_ID_MATCH_DEVICE, -+ .idVendor = 0x04DD, -+ .idProduct = 0x8006, /* B-500/SL-5600 */ -+ ZAURUS_FAKE_INTERFACE, -+ .driver_info = (unsigned long)&bogus_mdlm_info, - }, { - .match_flags = USB_DEVICE_ID_MATCH_INT_INFO - | USB_DEVICE_ID_MATCH_DEVICE, -@@ -299,6 +313,13 @@ static const struct usb_device_id products [] = { - .idProduct = 0x8007, /* C-700 */ - ZAURUS_MASTER_INTERFACE, - .driver_info = ZAURUS_PXA_INFO, -+}, { -+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO -+ | USB_DEVICE_ID_MATCH_DEVICE, -+ .idVendor = 0x04DD, -+ .idProduct = 0x8007, /* C-700 */ -+ ZAURUS_FAKE_INTERFACE, -+ .driver_info = (unsigned long)&bogus_mdlm_info, - }, { - .match_flags = USB_DEVICE_ID_MATCH_INT_INFO - | USB_DEVICE_ID_MATCH_DEVICE, -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 7922e833620e8..6e520720beb59 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -3265,6 +3265,8 @@ static int virtnet_probe(struct virtio_device *vdev) - } - } - -+ _virtnet_set_queues(vi, vi->curr_queue_pairs); -+ - /* serialize netdev register + virtio_device_ready() with ndo_open() */ - rtnl_lock(); - -@@ -3285,8 +3287,6 @@ static int virtnet_probe(struct virtio_device *vdev) - goto free_unregister_netdev; - } - -- virtnet_set_queues(vi, vi->curr_queue_pairs); -- - /* Assume link up if device can't report link status, - otherwise get link status from config. */ - netif_carrier_off(dev); -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index f4869b1836f30..1e3e075454f33 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -2550,7 +2550,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, - } - - ndst = &rt->dst; -- skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM); -+ skb_tunnel_check_pmtu(skb, ndst, vxlan_headroom(flags & VXLAN_F_GPE)); - - tos = ip_tunnel_ecn_encap(tos, old_iph, skb); - ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); -@@ -2590,7 +2590,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, - goto out_unlock; - } - -- skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM); -+ skb_tunnel_check_pmtu(skb, ndst, vxlan_headroom((flags & VXLAN_F_GPE) | VXLAN_F_IPV6)); - - tos = ip_tunnel_ecn_encap(tos, old_iph, skb); - ttl = ttl ? : ip6_dst_hoplimit(ndst); -@@ -2908,14 +2908,12 @@ static int vxlan_change_mtu(struct net_device *dev, int new_mtu) - struct vxlan_rdst *dst = &vxlan->default_dst; - struct net_device *lowerdev = __dev_get_by_index(vxlan->net, - dst->remote_ifindex); -- bool use_ipv6 = !!(vxlan->cfg.flags & VXLAN_F_IPV6); - - /* This check is different than dev->max_mtu, because it looks at - * the lowerdev->mtu, rather than the static dev->max_mtu - */ - if (lowerdev) { -- int max_mtu = lowerdev->mtu - -- (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM); -+ int max_mtu = lowerdev->mtu - vxlan_headroom(vxlan->cfg.flags); - if (new_mtu > max_mtu) - return -EINVAL; - } -@@ -3514,11 +3512,11 @@ static void vxlan_config_apply(struct net_device *dev, - struct vxlan_dev *vxlan = netdev_priv(dev); - struct vxlan_rdst *dst = &vxlan->default_dst; - unsigned short needed_headroom = ETH_HLEN; -- bool use_ipv6 = !!(conf->flags & VXLAN_F_IPV6); - int max_mtu = ETH_MAX_MTU; -+ u32 flags = conf->flags; - - if (!changelink) { -- if (conf->flags & VXLAN_F_GPE) -+ if (flags & VXLAN_F_GPE) - vxlan_raw_setup(dev); - else - vxlan_ether_setup(dev); -@@ -3544,8 +3542,7 @@ static void vxlan_config_apply(struct net_device *dev, - - dev->needed_tailroom = lowerdev->needed_tailroom; - -- max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : -- VXLAN_HEADROOM); -+ max_mtu = lowerdev->mtu - vxlan_headroom(flags); - if (max_mtu < ETH_MIN_MTU) - max_mtu = ETH_MIN_MTU; - -@@ -3556,10 +3553,9 @@ static void vxlan_config_apply(struct net_device *dev, - if (dev->mtu > max_mtu) - dev->mtu = max_mtu; - -- if (use_ipv6 || conf->flags & VXLAN_F_COLLECT_METADATA) -- needed_headroom += VXLAN6_HEADROOM; -- else -- needed_headroom += VXLAN_HEADROOM; -+ if (flags & VXLAN_F_COLLECT_METADATA) -+ flags |= VXLAN_F_IPV6; -+ needed_headroom += vxlan_headroom(flags); - dev->needed_headroom = needed_headroom; - - memcpy(&vxlan->cfg, conf, sizeof(*conf)); -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index d8d27b11b48c4..55270180ae081 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -200,12 +200,39 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist) - link->clkpm_disable = blacklist ? 1 : 0; - } - --static bool pcie_retrain_link(struct pcie_link_state *link) -+static int pcie_wait_for_retrain(struct pci_dev *pdev) - { -- struct pci_dev *parent = link->pdev; - unsigned long end_jiffies; - u16 reg16; - -+ /* Wait for Link Training to be cleared by hardware */ -+ end_jiffies = jiffies + LINK_RETRAIN_TIMEOUT; -+ do { -+ pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, ®16); -+ if (!(reg16 & PCI_EXP_LNKSTA_LT)) -+ return 0; -+ msleep(1); -+ } while (time_before(jiffies, end_jiffies)); -+ -+ return -ETIMEDOUT; -+} -+ -+static int pcie_retrain_link(struct pcie_link_state *link) -+{ -+ struct pci_dev *parent = link->pdev; -+ int rc; -+ u16 reg16; -+ -+ /* -+ * Ensure the updated LNKCTL parameters are used during link -+ * training by checking that there is no ongoing link training to -+ * avoid LTSSM race as recommended in Implementation Note at the -+ * end of PCIe r6.0.1 sec 7.5.3.7. -+ */ -+ rc = pcie_wait_for_retrain(parent); -+ if (rc) -+ return rc; -+ - pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16); - reg16 |= PCI_EXP_LNKCTL_RL; - pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16); -@@ -219,15 +246,7 @@ static bool pcie_retrain_link(struct pcie_link_state *link) - pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16); - } - -- /* Wait for link training end. Break out after waiting for timeout */ -- end_jiffies = jiffies + LINK_RETRAIN_TIMEOUT; -- do { -- pcie_capability_read_word(parent, PCI_EXP_LNKSTA, ®16); -- if (!(reg16 & PCI_EXP_LNKSTA_LT)) -- break; -- msleep(1); -- } while (time_before(jiffies, end_jiffies)); -- return !(reg16 & PCI_EXP_LNKSTA_LT); -+ return pcie_wait_for_retrain(parent); - } - - /* -@@ -296,15 +315,15 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) - reg16 &= ~PCI_EXP_LNKCTL_CCC; - pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16); - -- if (pcie_retrain_link(link)) -- return; -+ if (pcie_retrain_link(link)) { - -- /* Training failed. Restore common clock configurations */ -- pci_err(parent, "ASPM: Could not configure common clock\n"); -- list_for_each_entry(child, &linkbus->devices, bus_list) -- pcie_capability_write_word(child, PCI_EXP_LNKCTL, -+ /* Training failed. Restore common clock configurations */ -+ pci_err(parent, "ASPM: Could not configure common clock\n"); -+ list_for_each_entry(child, &linkbus->devices, bus_list) -+ pcie_capability_write_word(child, PCI_EXP_LNKCTL, - child_reg[PCI_FUNC(child->devfn)]); -- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg); -+ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg); -+ } - } - - /* Convert L0s latency encoding to ns */ -diff --git a/drivers/phy/hisilicon/phy-hisi-inno-usb2.c b/drivers/phy/hisilicon/phy-hisi-inno-usb2.c -index 9b16f13b5ab29..96162b9a2e53d 100644 ---- a/drivers/phy/hisilicon/phy-hisi-inno-usb2.c -+++ b/drivers/phy/hisilicon/phy-hisi-inno-usb2.c -@@ -155,7 +155,7 @@ static int hisi_inno_phy_probe(struct platform_device *pdev) - phy_set_drvdata(phy, &priv->ports[i]); - i++; - -- if (i > INNO_PHY_PORT_NUM) { -+ if (i >= INNO_PHY_PORT_NUM) { - dev_warn(dev, "Support %d ports in maximum\n", i); - break; - } -diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c -index 0e804b6c2d242..dfb4af759aa75 100644 ---- a/drivers/platform/x86/msi-laptop.c -+++ b/drivers/platform/x86/msi-laptop.c -@@ -210,7 +210,7 @@ static ssize_t set_device_state(const char *buf, size_t count, u8 mask) - return -EINVAL; - - if (quirks->ec_read_only) -- return -EOPNOTSUPP; -+ return 0; - - /* read current device state */ - result = ec_read(MSI_STANDARD_EC_COMMAND_ADDRESS, &rdata); -@@ -841,15 +841,15 @@ static bool msi_laptop_i8042_filter(unsigned char data, unsigned char str, - static void msi_init_rfkill(struct work_struct *ignored) - { - if (rfk_wlan) { -- rfkill_set_sw_state(rfk_wlan, !wlan_s); -+ msi_rfkill_set_state(rfk_wlan, !wlan_s); - rfkill_wlan_set(NULL, !wlan_s); - } - if (rfk_bluetooth) { -- rfkill_set_sw_state(rfk_bluetooth, !bluetooth_s); -+ msi_rfkill_set_state(rfk_bluetooth, !bluetooth_s); - rfkill_bluetooth_set(NULL, !bluetooth_s); - } - if (rfk_threeg) { -- rfkill_set_sw_state(rfk_threeg, !threeg_s); -+ msi_rfkill_set_state(rfk_threeg, !threeg_s); - rfkill_threeg_set(NULL, !threeg_s); - } - } -diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c -index 9fc08d1de34c2..768e6e691c7cc 100644 ---- a/drivers/pwm/pwm-meson.c -+++ b/drivers/pwm/pwm-meson.c -@@ -147,12 +147,13 @@ static int meson_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm) - return err; - } - -- return pwm_set_chip_data(pwm, channel); -+ return 0; - } - - static void meson_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) - { -- struct meson_pwm_channel *channel = pwm_get_chip_data(pwm); -+ struct meson_pwm *meson = to_meson_pwm(chip); -+ struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm]; - - if (channel) - clk_disable_unprepare(channel->clk); -@@ -161,9 +162,10 @@ static void meson_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) - static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm, - const struct pwm_state *state) - { -- struct meson_pwm_channel *channel = pwm_get_chip_data(pwm); -- unsigned int duty, period, pre_div, cnt, duty_cnt; -- unsigned long fin_freq = -1; -+ struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm]; -+ unsigned int pre_div, cnt, duty_cnt; -+ unsigned long fin_freq; -+ u64 duty, period; - - duty = state->duty_cycle; - period = state->period; -@@ -185,19 +187,19 @@ static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm, - - dev_dbg(meson->chip.dev, "fin_freq: %lu Hz\n", fin_freq); - -- pre_div = div64_u64(fin_freq * (u64)period, NSEC_PER_SEC * 0xffffLL); -+ pre_div = div64_u64(fin_freq * period, NSEC_PER_SEC * 0xffffLL); - if (pre_div > MISC_CLK_DIV_MASK) { - dev_err(meson->chip.dev, "unable to get period pre_div\n"); - return -EINVAL; - } - -- cnt = div64_u64(fin_freq * (u64)period, NSEC_PER_SEC * (pre_div + 1)); -+ cnt = div64_u64(fin_freq * period, NSEC_PER_SEC * (pre_div + 1)); - if (cnt > 0xffff) { - dev_err(meson->chip.dev, "unable to get period cnt\n"); - return -EINVAL; - } - -- dev_dbg(meson->chip.dev, "period=%u pre_div=%u cnt=%u\n", period, -+ dev_dbg(meson->chip.dev, "period=%llu pre_div=%u cnt=%u\n", period, - pre_div, cnt); - - if (duty == period) { -@@ -210,14 +212,13 @@ static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm, - channel->lo = cnt; - } else { - /* Then check is we can have the duty with the same pre_div */ -- duty_cnt = div64_u64(fin_freq * (u64)duty, -- NSEC_PER_SEC * (pre_div + 1)); -+ duty_cnt = div64_u64(fin_freq * duty, NSEC_PER_SEC * (pre_div + 1)); - if (duty_cnt > 0xffff) { - dev_err(meson->chip.dev, "unable to get duty cycle\n"); - return -EINVAL; - } - -- dev_dbg(meson->chip.dev, "duty=%u pre_div=%u duty_cnt=%u\n", -+ dev_dbg(meson->chip.dev, "duty=%llu pre_div=%u duty_cnt=%u\n", - duty, pre_div, duty_cnt); - - channel->pre_div = pre_div; -@@ -230,7 +231,7 @@ static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm, - - static void meson_pwm_enable(struct meson_pwm *meson, struct pwm_device *pwm) - { -- struct meson_pwm_channel *channel = pwm_get_chip_data(pwm); -+ struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm]; - struct meson_pwm_channel_data *channel_data; - unsigned long flags; - u32 value; -@@ -273,8 +274,8 @@ static void meson_pwm_disable(struct meson_pwm *meson, struct pwm_device *pwm) - static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, - const struct pwm_state *state) - { -- struct meson_pwm_channel *channel = pwm_get_chip_data(pwm); - struct meson_pwm *meson = to_meson_pwm(chip); -+ struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm]; - int err = 0; - - if (!state) -diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c -index d7aed832910c4..caab2cd2e0bdc 100644 ---- a/drivers/s390/block/dasd_ioctl.c -+++ b/drivers/s390/block/dasd_ioctl.c -@@ -137,6 +137,7 @@ static int dasd_ioctl_resume(struct dasd_block *block) - spin_unlock_irqrestore(get_ccwdev_lock(base->cdev), flags); - - dasd_schedule_block_bh(block); -+ dasd_schedule_device_bh(base); - return 0; - } - -diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c -index 7285e6ca948ff..459eed7aca66c 100644 ---- a/drivers/s390/scsi/zfcp_fc.c -+++ b/drivers/s390/scsi/zfcp_fc.c -@@ -534,8 +534,7 @@ static void zfcp_fc_adisc_handler(void *data) - - /* re-init to undo drop from zfcp_fc_adisc() */ - port->d_id = ntoh24(adisc_resp->adisc_port_id); -- /* port is good, unblock rport without going through erp */ -- zfcp_scsi_schedule_rport_register(port); -+ /* port is still good, nothing to do */ - out: - atomic_andnot(ZFCP_STATUS_PORT_LINK_TEST, &port->status); - put_device(&port->dev); -@@ -595,9 +594,6 @@ void zfcp_fc_link_test_work(struct work_struct *work) - int retval; - - set_worker_desc("zadisc%16llx", port->wwpn); /* < WORKER_DESC_LEN=24 */ -- get_device(&port->dev); -- port->rport_task = RPORT_DEL; -- zfcp_scsi_rport_work(&port->rport_work); - - /* only issue one test command at one time per port */ - if (atomic_read(&port->status) & ZFCP_STATUS_PORT_LINK_TEST) -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index 30a5ca9c5a8d4..99d4bc2ab5a91 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -4831,7 +4831,8 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht, - } - INIT_DELAYED_WORK(&vha->scan.scan_work, qla_scan_work_fn); - -- sprintf(vha->host_str, "%s_%ld", QLA2XXX_DRIVER_NAME, vha->host_no); -+ snprintf(vha->host_str, sizeof(vha->host_str), "%s_%lu", -+ QLA2XXX_DRIVER_NAME, vha->host_no); - ql_dbg(ql_dbg_init, vha, 0x0041, - "Allocated the host=%p hw=%p vha=%p dev_name=%s", - vha->host, vha->hw, vha, -@@ -4961,7 +4962,7 @@ qla2x00_uevent_emit(struct scsi_qla_host *vha, u32 code) - - switch (code) { - case QLA_UEVENT_CODE_FW_DUMP: -- snprintf(event_string, sizeof(event_string), "FW_DUMP=%ld", -+ snprintf(event_string, sizeof(event_string), "FW_DUMP=%lu", - vha->host_no); - break; - default: -diff --git a/drivers/staging/ks7010/ks_wlan_net.c b/drivers/staging/ks7010/ks_wlan_net.c -index e61bd8e1d246f..b565c26ca72fe 100644 ---- a/drivers/staging/ks7010/ks_wlan_net.c -+++ b/drivers/staging/ks7010/ks_wlan_net.c -@@ -1584,8 +1584,10 @@ static int ks_wlan_set_encode_ext(struct net_device *dev, - commit |= SME_WEP_FLAG; - } - if (enc->key_len) { -- memcpy(&key->key_val[0], &enc->key[0], enc->key_len); -- key->key_len = enc->key_len; -+ int key_len = clamp_val(enc->key_len, 0, IW_ENCODING_TOKEN_MAX); -+ -+ memcpy(&key->key_val[0], &enc->key[0], key_len); -+ key->key_len = key_len; - commit |= (SME_WEP_VAL1 << index); - } - break; -diff --git a/drivers/tty/serial/8250/8250_dwlib.c b/drivers/tty/serial/8250/8250_dwlib.c -index 6d6a78eead3ef..1cf229cca5928 100644 ---- a/drivers/tty/serial/8250/8250_dwlib.c -+++ b/drivers/tty/serial/8250/8250_dwlib.c -@@ -80,7 +80,7 @@ static void dw8250_set_divisor(struct uart_port *p, unsigned int baud, - void dw8250_setup_port(struct uart_port *p) - { - struct uart_8250_port *up = up_to_u8250p(p); -- u32 reg; -+ u32 reg, old_dlf; - - /* - * If the Component Version Register returns zero, we know that -@@ -93,9 +93,11 @@ void dw8250_setup_port(struct uart_port *p) - dev_dbg(p->dev, "Designware UART version %c.%c%c\n", - (reg >> 24) & 0xff, (reg >> 16) & 0xff, (reg >> 8) & 0xff); - -+ /* Preserve value written by firmware or bootloader */ -+ old_dlf = dw8250_readl_ext(p, DW_UART_DLF); - dw8250_writel_ext(p, DW_UART_DLF, ~0U); - reg = dw8250_readl_ext(p, DW_UART_DLF); -- dw8250_writel_ext(p, DW_UART_DLF, 0); -+ dw8250_writel_ext(p, DW_UART_DLF, old_dlf); - - if (reg) { - struct dw8250_port_data *d = p->private_data; -diff --git a/drivers/tty/serial/sifive.c b/drivers/tty/serial/sifive.c -index 7015632c49905..e11756a8788bb 100644 ---- a/drivers/tty/serial/sifive.c -+++ b/drivers/tty/serial/sifive.c -@@ -821,7 +821,7 @@ static void sifive_serial_console_write(struct console *co, const char *s, - local_irq_restore(flags); - } - --static int __init sifive_serial_console_setup(struct console *co, char *options) -+static int sifive_serial_console_setup(struct console *co, char *options) - { - struct sifive_serial_port *ssp; - int baud = SIFIVE_DEFAULT_BAUD_RATE; -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 1346c600ebedf..48cda9b7a8f24 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -437,6 +437,10 @@ static const struct usb_device_id usb_quirk_list[] = { - /* novation SoundControl XL */ - { USB_DEVICE(0x1235, 0x0061), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Focusrite Scarlett Solo USB */ -+ { USB_DEVICE(0x1235, 0x8211), .driver_info = -+ USB_QUIRK_DISCONNECT_SUSPEND }, -+ - /* Huawei 4G LTE module */ - { USB_DEVICE(0x12d1, 0x15bb), .driver_info = - USB_QUIRK_DISCONNECT_SUSPEND }, -diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c -index 27b60623c280e..22c1a68e1cc8a 100644 ---- a/drivers/usb/dwc3/core.c -+++ b/drivers/usb/dwc3/core.c -@@ -248,9 +248,9 @@ int dwc3_core_soft_reset(struct dwc3 *dwc) - /* - * We're resetting only the device side because, if we're in host mode, - * XHCI driver will reset the host block. If dwc3 was configured for -- * host-only mode, then we can return early. -+ * host-only mode or current role is host, then we can return early. - */ -- if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST) -+ if (dwc->dr_mode == USB_DR_MODE_HOST || dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST) - return 0; - - reg = dwc3_readl(dwc->regs, DWC3_DCTL); -@@ -1010,22 +1010,6 @@ static int dwc3_core_init(struct dwc3 *dwc) - dwc3_writel(dwc->regs, DWC3_GUCTL1, reg); - } - -- if (dwc->dr_mode == USB_DR_MODE_HOST || -- dwc->dr_mode == USB_DR_MODE_OTG) { -- reg = dwc3_readl(dwc->regs, DWC3_GUCTL); -- -- /* -- * Enable Auto retry Feature to make the controller operating in -- * Host mode on seeing transaction errors(CRC errors or internal -- * overrun scenerios) on IN transfers to reply to the device -- * with a non-terminating retry ACK (i.e, an ACK transcation -- * packet with Retry=1 & Nump != 0) -- */ -- reg |= DWC3_GUCTL_HSTINAUTORETRY; -- -- dwc3_writel(dwc->regs, DWC3_GUCTL, reg); -- } -- - /* - * Must config both number of packets and max burst settings to enable - * RX and/or TX threshold. -diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h -index f320b989abd21..5d497efd2f117 100644 ---- a/drivers/usb/dwc3/core.h -+++ b/drivers/usb/dwc3/core.h -@@ -246,9 +246,6 @@ - #define DWC3_GCTL_GBLHIBERNATIONEN BIT(1) - #define DWC3_GCTL_DSBLCLKGTNG BIT(0) - --/* Global User Control Register */ --#define DWC3_GUCTL_HSTINAUTORETRY BIT(14) -- - /* Global User Control 1 Register */ - #define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17) - #define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS BIT(28) -diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c -index 955bf820f4102..8d4f1b13f4157 100644 ---- a/drivers/usb/dwc3/dwc3-pci.c -+++ b/drivers/usb/dwc3/dwc3-pci.c -@@ -171,10 +171,12 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc) - - /* - * A lot of BYT devices lack ACPI resource entries for -- * the GPIOs, add a fallback mapping to the reference -+ * the GPIOs. If the ACPI entry for the GPIO controller -+ * is present add a fallback mapping to the reference - * design GPIOs which all boards seem to use. - */ -- gpiod_add_lookup_table(&platform_bytcr_gpios); -+ if (acpi_dev_present("INT33FC", NULL, -1)) -+ gpiod_add_lookup_table(&platform_bytcr_gpios); - - /* - * These GPIOs will turn on the USB2 PHY. Note that we have to -diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c -index fc35a7993b7b6..4374dba4e3848 100644 ---- a/drivers/usb/host/ohci-at91.c -+++ b/drivers/usb/host/ohci-at91.c -@@ -645,7 +645,13 @@ ohci_hcd_at91_drv_resume(struct device *dev) - - at91_start_clock(ohci_at91); - -- ohci_resume(hcd, false); -+ /* -+ * According to the comment in ohci_hcd_at91_drv_suspend() -+ * we need to do a reset if the 48Mhz clock was stopped, -+ * that is, if ohci_at91->wakeup is clear. Tell ohci_resume() -+ * to reset in this case by setting its "hibernated" flag. -+ */ -+ ohci_resume(hcd, !ohci_at91->wakeup); - - ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0); - -diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c -index 5c0eb35cd007a..c56c6a0d6222c 100644 ---- a/drivers/usb/host/xhci-mtk.c -+++ b/drivers/usb/host/xhci-mtk.c -@@ -540,6 +540,7 @@ static int xhci_mtk_probe(struct platform_device *pdev) - } - - device_init_wakeup(dev, true); -+ dma_set_max_seg_size(dev, UINT_MAX); - - xhci = hcd_to_xhci(hcd); - xhci->main_hcd = hcd; -diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c -index d53bdb7d297f8..6087b1fa530f8 100644 ---- a/drivers/usb/host/xhci-tegra.c -+++ b/drivers/usb/host/xhci-tegra.c -@@ -933,15 +933,15 @@ static int tegra_xusb_powerdomain_init(struct device *dev, - int err; - - tegra->genpd_dev_host = dev_pm_domain_attach_by_name(dev, "xusb_host"); -- if (IS_ERR_OR_NULL(tegra->genpd_dev_host)) { -- err = PTR_ERR(tegra->genpd_dev_host) ? : -ENODATA; -+ if (IS_ERR(tegra->genpd_dev_host)) { -+ err = PTR_ERR(tegra->genpd_dev_host); - dev_err(dev, "failed to get host pm-domain: %d\n", err); - return err; - } - - tegra->genpd_dev_ss = dev_pm_domain_attach_by_name(dev, "xusb_ss"); -- if (IS_ERR_OR_NULL(tegra->genpd_dev_ss)) { -- err = PTR_ERR(tegra->genpd_dev_ss) ? : -ENODATA; -+ if (IS_ERR(tegra->genpd_dev_ss)) { -+ err = PTR_ERR(tegra->genpd_dev_ss); - dev_err(dev, "failed to get superspeed pm-domain: %d\n", err); - return err; - } -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 939bcbb5404fb..7ab6205ad50cf 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -251,6 +251,7 @@ static void option_instat_callback(struct urb *urb); - #define QUECTEL_PRODUCT_EM061K_LTA 0x0123 - #define QUECTEL_PRODUCT_EM061K_LMS 0x0124 - #define QUECTEL_PRODUCT_EC25 0x0125 -+#define QUECTEL_PRODUCT_EM060K_128 0x0128 - #define QUECTEL_PRODUCT_EG91 0x0191 - #define QUECTEL_PRODUCT_EG95 0x0195 - #define QUECTEL_PRODUCT_BG96 0x0296 -@@ -268,6 +269,7 @@ static void option_instat_callback(struct urb *urb); - #define QUECTEL_PRODUCT_RM520N 0x0801 - #define QUECTEL_PRODUCT_EC200U 0x0901 - #define QUECTEL_PRODUCT_EC200S_CN 0x6002 -+#define QUECTEL_PRODUCT_EC200A 0x6005 - #define QUECTEL_PRODUCT_EM061K_LWW 0x6008 - #define QUECTEL_PRODUCT_EM061K_LCN 0x6009 - #define QUECTEL_PRODUCT_EC200T 0x6026 -@@ -1197,6 +1199,9 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) }, -@@ -1225,6 +1230,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0900, 0xff, 0, 0), /* RM500U-CN */ - .driver_info = ZLP }, -+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200A, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, -diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c -index 4c6747889a194..24b8772a345e2 100644 ---- a/drivers/usb/serial/usb-serial-simple.c -+++ b/drivers/usb/serial/usb-serial-simple.c -@@ -38,16 +38,6 @@ static struct usb_serial_driver vendor##_device = { \ - { USB_DEVICE(0x0a21, 0x8001) } /* MMT-7305WW */ - DEVICE(carelink, CARELINK_IDS); - --/* ZIO Motherboard USB driver */ --#define ZIO_IDS() \ -- { USB_DEVICE(0x1CBE, 0x0103) } --DEVICE(zio, ZIO_IDS); -- --/* Funsoft Serial USB driver */ --#define FUNSOFT_IDS() \ -- { USB_DEVICE(0x1404, 0xcddc) } --DEVICE(funsoft, FUNSOFT_IDS); -- - /* Infineon Flashloader driver */ - #define FLASHLOADER_IDS() \ - { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \ -@@ -55,6 +45,11 @@ DEVICE(funsoft, FUNSOFT_IDS); - { USB_DEVICE(0x8087, 0x0801) } - DEVICE(flashloader, FLASHLOADER_IDS); - -+/* Funsoft Serial USB driver */ -+#define FUNSOFT_IDS() \ -+ { USB_DEVICE(0x1404, 0xcddc) } -+DEVICE(funsoft, FUNSOFT_IDS); -+ - /* Google Serial USB SubClass */ - #define GOOGLE_IDS() \ - { USB_VENDOR_AND_INTERFACE_INFO(0x18d1, \ -@@ -63,16 +58,21 @@ DEVICE(flashloader, FLASHLOADER_IDS); - 0x01) } - DEVICE(google, GOOGLE_IDS); - -+/* HP4x (48/49) Generic Serial driver */ -+#define HP4X_IDS() \ -+ { USB_DEVICE(0x03f0, 0x0121) } -+DEVICE(hp4x, HP4X_IDS); -+ -+/* KAUFMANN RKS+CAN VCP */ -+#define KAUFMANN_IDS() \ -+ { USB_DEVICE(0x16d0, 0x0870) } -+DEVICE(kaufmann, KAUFMANN_IDS); -+ - /* Libtransistor USB console */ - #define LIBTRANSISTOR_IDS() \ - { USB_DEVICE(0x1209, 0x8b00) } - DEVICE(libtransistor, LIBTRANSISTOR_IDS); - --/* ViVOpay USB Serial Driver */ --#define VIVOPAY_IDS() \ -- { USB_DEVICE(0x1d5f, 0x1004) } /* ViVOpay 8800 */ --DEVICE(vivopay, VIVOPAY_IDS); -- - /* Motorola USB Phone driver */ - #define MOTO_IDS() \ - { USB_DEVICE(0x05c6, 0x3197) }, /* unknown Motorola phone */ \ -@@ -101,10 +101,10 @@ DEVICE(nokia, NOKIA_IDS); - { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ - DEVICE_N(novatel_gps, NOVATEL_IDS, 3); - --/* HP4x (48/49) Generic Serial driver */ --#define HP4X_IDS() \ -- { USB_DEVICE(0x03f0, 0x0121) } --DEVICE(hp4x, HP4X_IDS); -+/* Siemens USB/MPI adapter */ -+#define SIEMENS_IDS() \ -+ { USB_DEVICE(0x908, 0x0004) } -+DEVICE(siemens_mpi, SIEMENS_IDS); - - /* Suunto ANT+ USB Driver */ - #define SUUNTO_IDS() \ -@@ -112,45 +112,52 @@ DEVICE(hp4x, HP4X_IDS); - { USB_DEVICE(0x0fcf, 0x1009) } /* Dynastream ANT USB-m Stick */ - DEVICE(suunto, SUUNTO_IDS); - --/* Siemens USB/MPI adapter */ --#define SIEMENS_IDS() \ -- { USB_DEVICE(0x908, 0x0004) } --DEVICE(siemens_mpi, SIEMENS_IDS); -+/* ViVOpay USB Serial Driver */ -+#define VIVOPAY_IDS() \ -+ { USB_DEVICE(0x1d5f, 0x1004) } /* ViVOpay 8800 */ -+DEVICE(vivopay, VIVOPAY_IDS); -+ -+/* ZIO Motherboard USB driver */ -+#define ZIO_IDS() \ -+ { USB_DEVICE(0x1CBE, 0x0103) } -+DEVICE(zio, ZIO_IDS); - - /* All of the above structures mushed into two lists */ - static struct usb_serial_driver * const serial_drivers[] = { - &carelink_device, -- &zio_device, -- &funsoft_device, - &flashloader_device, -+ &funsoft_device, - &google_device, -+ &hp4x_device, -+ &kaufmann_device, - &libtransistor_device, -- &vivopay_device, - &moto_modem_device, - &motorola_tetra_device, - &nokia_device, - &novatel_gps_device, -- &hp4x_device, -- &suunto_device, - &siemens_mpi_device, -+ &suunto_device, -+ &vivopay_device, -+ &zio_device, - NULL - }; - - static const struct usb_device_id id_table[] = { - CARELINK_IDS(), -- ZIO_IDS(), -- FUNSOFT_IDS(), - FLASHLOADER_IDS(), -+ FUNSOFT_IDS(), - GOOGLE_IDS(), -+ HP4X_IDS(), -+ KAUFMANN_IDS(), - LIBTRANSISTOR_IDS(), -- VIVOPAY_IDS(), - MOTO_IDS(), - MOTOROLA_TETRA_IDS(), - NOKIA_IDS(), - NOVATEL_IDS(), -- HP4X_IDS(), -- SUUNTO_IDS(), - SIEMENS_IDS(), -+ SUUNTO_IDS(), -+ VIVOPAY_IDS(), -+ ZIO_IDS(), - { }, - }; - MODULE_DEVICE_TABLE(usb, id_table); -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 1420df997485a..608e41b61689c 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -3589,6 +3589,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans, - - ret = tree_mod_log_eb_copy(split, c, 0, mid, c_nritems - mid); - if (ret) { -+ btrfs_tree_unlock(split); -+ free_extent_buffer(split); - btrfs_abort_transaction(trans, ret); - return ret; - } -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 7e9d914369a02..d98cf8aba753b 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -4106,6 +4106,11 @@ void close_ctree(struct btrfs_fs_info *fs_info) - ASSERT(list_empty(&fs_info->delayed_iputs)); - set_bit(BTRFS_FS_CLOSING_DONE, &fs_info->flags); - -+ if (btrfs_check_quota_leak(fs_info)) { -+ WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG)); -+ btrfs_err(fs_info, "qgroup reserved space leaked"); -+ } -+ - btrfs_free_qgroup_config(fs_info); - ASSERT(list_empty(&fs_info->delalloc_roots)); - -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 22f95a5a58fe1..1197dfdfebbf6 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -4917,7 +4917,9 @@ static long btrfs_ioctl_qgroup_assign(struct file *file, void __user *arg) - } - - /* update qgroup status and info */ -+ mutex_lock(&fs_info->qgroup_ioctl_lock); - err = btrfs_run_qgroups(trans); -+ mutex_unlock(&fs_info->qgroup_ioctl_lock); - if (err < 0) - btrfs_handle_fs_error(fs_info, err, - "failed to update qgroup status and info"); -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index db8f83ab55f63..a743404dce0ce 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -504,6 +504,49 @@ out: - return ret < 0 ? ret : 0; - } - -+static u64 btrfs_qgroup_subvolid(u64 qgroupid) -+{ -+ return (qgroupid & ((1ULL << BTRFS_QGROUP_LEVEL_SHIFT) - 1)); -+} -+ -+/* -+ * Called in close_ctree() when quota is still enabled. This verifies we don't -+ * leak some reserved space. -+ * -+ * Return false if no reserved space is left. -+ * Return true if some reserved space is leaked. -+ */ -+bool btrfs_check_quota_leak(struct btrfs_fs_info *fs_info) -+{ -+ struct rb_node *node; -+ bool ret = false; -+ -+ if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags)) -+ return ret; -+ /* -+ * Since we're unmounting, there is no race and no need to grab qgroup -+ * lock. And here we don't go post-order to provide a more user -+ * friendly sorted result. -+ */ -+ for (node = rb_first(&fs_info->qgroup_tree); node; node = rb_next(node)) { -+ struct btrfs_qgroup *qgroup; -+ int i; -+ -+ qgroup = rb_entry(node, struct btrfs_qgroup, node); -+ for (i = 0; i < BTRFS_QGROUP_RSV_LAST; i++) { -+ if (qgroup->rsv.values[i]) { -+ ret = true; -+ btrfs_warn(fs_info, -+ "qgroup %llu/%llu has unreleased space, type %d rsv %llu", -+ btrfs_qgroup_level(qgroup->qgroupid), -+ btrfs_qgroup_subvolid(qgroup->qgroupid), -+ i, qgroup->rsv.values[i]); -+ } -+ } -+ } -+ return ret; -+} -+ - /* - * This is called from close_ctree() or open_ctree() or btrfs_quota_disable(), - * first two are in single-threaded paths.And for the third one, we have set -@@ -1121,12 +1164,23 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) - int ret = 0; - - /* -- * We need to have subvol_sem write locked, to prevent races between -- * concurrent tasks trying to disable quotas, because we will unlock -- * and relock qgroup_ioctl_lock across BTRFS_FS_QUOTA_ENABLED changes. -+ * We need to have subvol_sem write locked to prevent races with -+ * snapshot creation. - */ - lockdep_assert_held_write(&fs_info->subvol_sem); - -+ /* -+ * Lock the cleaner mutex to prevent races with concurrent relocation, -+ * because relocation may be building backrefs for blocks of the quota -+ * root while we are deleting the root. This is like dropping fs roots -+ * of deleted snapshots/subvolumes, we need the same protection. -+ * -+ * This also prevents races between concurrent tasks trying to disable -+ * quotas, because we will unlock and relock qgroup_ioctl_lock across -+ * BTRFS_FS_QUOTA_ENABLED changes. -+ */ -+ mutex_lock(&fs_info->cleaner_mutex); -+ - mutex_lock(&fs_info->qgroup_ioctl_lock); - if (!fs_info->quota_root) - goto out; -@@ -1208,6 +1262,7 @@ out: - btrfs_end_transaction(trans); - else if (trans) - ret = btrfs_end_transaction(trans); -+ mutex_unlock(&fs_info->cleaner_mutex); - - return ret; - } -@@ -1340,7 +1395,6 @@ int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans, u64 src, - u64 dst) - { - struct btrfs_fs_info *fs_info = trans->fs_info; -- struct btrfs_root *quota_root; - struct btrfs_qgroup *parent; - struct btrfs_qgroup *member; - struct btrfs_qgroup_list *list; -@@ -1356,9 +1410,8 @@ int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans, u64 src, - return -ENOMEM; - - mutex_lock(&fs_info->qgroup_ioctl_lock); -- quota_root = fs_info->quota_root; -- if (!quota_root) { -- ret = -EINVAL; -+ if (!fs_info->quota_root) { -+ ret = -ENOTCONN; - goto out; - } - member = find_qgroup_rb(fs_info, src); -@@ -1404,7 +1457,6 @@ static int __del_qgroup_relation(struct btrfs_trans_handle *trans, u64 src, - u64 dst) - { - struct btrfs_fs_info *fs_info = trans->fs_info; -- struct btrfs_root *quota_root; - struct btrfs_qgroup *parent; - struct btrfs_qgroup *member; - struct btrfs_qgroup_list *list; -@@ -1417,9 +1469,8 @@ static int __del_qgroup_relation(struct btrfs_trans_handle *trans, u64 src, - if (!tmp) - return -ENOMEM; - -- quota_root = fs_info->quota_root; -- if (!quota_root) { -- ret = -EINVAL; -+ if (!fs_info->quota_root) { -+ ret = -ENOTCONN; - goto out; - } - -@@ -1484,11 +1535,11 @@ int btrfs_create_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid) - int ret = 0; - - mutex_lock(&fs_info->qgroup_ioctl_lock); -- quota_root = fs_info->quota_root; -- if (!quota_root) { -- ret = -EINVAL; -+ if (!fs_info->quota_root) { -+ ret = -ENOTCONN; - goto out; - } -+ quota_root = fs_info->quota_root; - qgroup = find_qgroup_rb(fs_info, qgroupid); - if (qgroup) { - ret = -EEXIST; -@@ -1513,15 +1564,13 @@ out: - int btrfs_remove_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid) - { - struct btrfs_fs_info *fs_info = trans->fs_info; -- struct btrfs_root *quota_root; - struct btrfs_qgroup *qgroup; - struct btrfs_qgroup_list *list; - int ret = 0; - - mutex_lock(&fs_info->qgroup_ioctl_lock); -- quota_root = fs_info->quota_root; -- if (!quota_root) { -- ret = -EINVAL; -+ if (!fs_info->quota_root) { -+ ret = -ENOTCONN; - goto out; - } - -@@ -1562,7 +1611,6 @@ int btrfs_limit_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid, - struct btrfs_qgroup_limit *limit) - { - struct btrfs_fs_info *fs_info = trans->fs_info; -- struct btrfs_root *quota_root; - struct btrfs_qgroup *qgroup; - int ret = 0; - /* Sometimes we would want to clear the limit on this qgroup. -@@ -1572,9 +1620,8 @@ int btrfs_limit_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid, - const u64 CLEAR_VALUE = -1; - - mutex_lock(&fs_info->qgroup_ioctl_lock); -- quota_root = fs_info->quota_root; -- if (!quota_root) { -- ret = -EINVAL; -+ if (!fs_info->quota_root) { -+ ret = -ENOTCONN; - goto out; - } - -@@ -2674,15 +2721,23 @@ cleanup: - } - - /* -- * called from commit_transaction. Writes all changed qgroups to disk. -+ * Writes all changed qgroups to disk. -+ * Called by the transaction commit path and the qgroup assign ioctl. - */ - int btrfs_run_qgroups(struct btrfs_trans_handle *trans) - { - struct btrfs_fs_info *fs_info = trans->fs_info; -- struct btrfs_root *quota_root = fs_info->quota_root; - int ret = 0; - -- if (!quota_root) -+ /* -+ * In case we are called from the qgroup assign ioctl, assert that we -+ * are holding the qgroup_ioctl_lock, otherwise we can race with a quota -+ * disable operation (ioctl) and access a freed quota root. -+ */ -+ if (trans->transaction->state != TRANS_STATE_COMMIT_DOING) -+ lockdep_assert_held(&fs_info->qgroup_ioctl_lock); -+ -+ if (!fs_info->quota_root) - return ret; - - spin_lock(&fs_info->qgroup_lock); -@@ -2945,7 +3000,6 @@ static bool qgroup_check_limits(const struct btrfs_qgroup *qg, u64 num_bytes) - static int qgroup_reserve(struct btrfs_root *root, u64 num_bytes, bool enforce, - enum btrfs_qgroup_rsv_type type) - { -- struct btrfs_root *quota_root; - struct btrfs_qgroup *qgroup; - struct btrfs_fs_info *fs_info = root->fs_info; - u64 ref_root = root->root_key.objectid; -@@ -2964,8 +3018,7 @@ static int qgroup_reserve(struct btrfs_root *root, u64 num_bytes, bool enforce, - enforce = false; - - spin_lock(&fs_info->qgroup_lock); -- quota_root = fs_info->quota_root; -- if (!quota_root) -+ if (!fs_info->quota_root) - goto out; - - qgroup = find_qgroup_rb(fs_info, ref_root); -@@ -3032,7 +3085,6 @@ void btrfs_qgroup_free_refroot(struct btrfs_fs_info *fs_info, - u64 ref_root, u64 num_bytes, - enum btrfs_qgroup_rsv_type type) - { -- struct btrfs_root *quota_root; - struct btrfs_qgroup *qgroup; - struct ulist_node *unode; - struct ulist_iterator uiter; -@@ -3050,8 +3102,7 @@ void btrfs_qgroup_free_refroot(struct btrfs_fs_info *fs_info, - } - spin_lock(&fs_info->qgroup_lock); - -- quota_root = fs_info->quota_root; -- if (!quota_root) -+ if (!fs_info->quota_root) - goto out; - - qgroup = find_qgroup_rb(fs_info, ref_root); -@@ -3942,7 +3993,6 @@ void __btrfs_qgroup_free_meta(struct btrfs_root *root, int num_bytes, - static void qgroup_convert_meta(struct btrfs_fs_info *fs_info, u64 ref_root, - int num_bytes) - { -- struct btrfs_root *quota_root = fs_info->quota_root; - struct btrfs_qgroup *qgroup; - struct ulist_node *unode; - struct ulist_iterator uiter; -@@ -3950,7 +4000,7 @@ static void qgroup_convert_meta(struct btrfs_fs_info *fs_info, u64 ref_root, - - if (num_bytes == 0) - return; -- if (!quota_root) -+ if (!fs_info->quota_root) - return; - - spin_lock(&fs_info->qgroup_lock); -diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h -index 0a2659685ad65..94bdfb89505e8 100644 ---- a/fs/btrfs/qgroup.h -+++ b/fs/btrfs/qgroup.h -@@ -416,5 +416,6 @@ int btrfs_qgroup_add_swapped_blocks(struct btrfs_trans_handle *trans, - int btrfs_qgroup_trace_subtree_after_cow(struct btrfs_trans_handle *trans, - struct btrfs_root *root, struct extent_buffer *eb); - void btrfs_qgroup_destroy_extent_records(struct btrfs_transaction *trans); -+bool btrfs_check_quota_leak(struct btrfs_fs_info *fs_info); - - #endif -diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c -index e6cb95b81787f..f2e348d22dc1e 100644 ---- a/fs/btrfs/transaction.c -+++ b/fs/btrfs/transaction.c -@@ -706,8 +706,13 @@ btrfs_attach_transaction_barrier(struct btrfs_root *root) - - trans = start_transaction(root, 0, TRANS_ATTACH, - BTRFS_RESERVE_NO_FLUSH, true); -- if (trans == ERR_PTR(-ENOENT)) -- btrfs_wait_for_commit(root->fs_info, 0); -+ if (trans == ERR_PTR(-ENOENT)) { -+ int ret; -+ -+ ret = btrfs_wait_for_commit(root->fs_info, 0); -+ if (ret) -+ return ERR_PTR(ret); -+ } - - return trans; - } -@@ -771,6 +776,7 @@ int btrfs_wait_for_commit(struct btrfs_fs_info *fs_info, u64 transid) - } - - wait_for_commit(cur_trans); -+ ret = cur_trans->aborted; - btrfs_put_transaction(cur_trans); - out: - return ret; -diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index 243e246cb5046..4e88cb9907230 100644 ---- a/fs/ceph/caps.c -+++ b/fs/ceph/caps.c -@@ -2790,7 +2790,19 @@ int ceph_get_caps(struct file *filp, int need, int want, - if (ret == -EAGAIN) - continue; - if (!ret) { -+ struct ceph_mds_client *mdsc = fsc->mdsc; -+ struct cap_wait cw; - DEFINE_WAIT_FUNC(wait, woken_wake_function); -+ -+ cw.ino = inode->i_ino; -+ cw.tgid = current->tgid; -+ cw.need = need; -+ cw.want = want; -+ -+ spin_lock(&mdsc->caps_list_lock); -+ list_add(&cw.list, &mdsc->cap_wait_list); -+ spin_unlock(&mdsc->caps_list_lock); -+ - add_wait_queue(&ci->i_cap_wq, &wait); - - flags |= NON_BLOCKING; -@@ -2804,6 +2816,11 @@ int ceph_get_caps(struct file *filp, int need, int want, - } - - remove_wait_queue(&ci->i_cap_wq, &wait); -+ -+ spin_lock(&mdsc->caps_list_lock); -+ list_del(&cw.list); -+ spin_unlock(&mdsc->caps_list_lock); -+ - if (ret == -EAGAIN) - continue; - } -diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c -index facb387c27356..c281f32b54f7b 100644 ---- a/fs/ceph/debugfs.c -+++ b/fs/ceph/debugfs.c -@@ -139,6 +139,7 @@ static int caps_show(struct seq_file *s, void *p) - struct ceph_fs_client *fsc = s->private; - struct ceph_mds_client *mdsc = fsc->mdsc; - int total, avail, used, reserved, min, i; -+ struct cap_wait *cw; - - ceph_reservation_status(fsc, &total, &avail, &used, &reserved, &min); - seq_printf(s, "total\t\t%d\n" -@@ -166,6 +167,18 @@ static int caps_show(struct seq_file *s, void *p) - } - mutex_unlock(&mdsc->mutex); - -+ seq_printf(s, "\n\nWaiters:\n--------\n"); -+ seq_printf(s, "tgid ino need want\n"); -+ seq_printf(s, "-----------------------------------------------------\n"); -+ -+ spin_lock(&mdsc->caps_list_lock); -+ list_for_each_entry(cw, &mdsc->cap_wait_list, list) { -+ seq_printf(s, "%-13d0x%-17lx%-17s%-17s\n", cw->tgid, cw->ino, -+ ceph_cap_string(cw->need), -+ ceph_cap_string(cw->want)); -+ } -+ spin_unlock(&mdsc->caps_list_lock); -+ - return 0; - } - -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index 3bf81fe5f10a3..f7acf9680c9b6 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -4074,7 +4074,7 @@ static void delayed_work(struct work_struct *work) - - dout("mdsc delayed_work\n"); - -- if (mdsc->stopping) -+ if (mdsc->stopping >= CEPH_MDSC_STOPPING_FLUSHED) - return; - - mutex_lock(&mdsc->mutex); -@@ -4174,6 +4174,7 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc) - INIT_DELAYED_WORK(&mdsc->delayed_work, delayed_work); - mdsc->last_renew_caps = jiffies; - INIT_LIST_HEAD(&mdsc->cap_delay_list); -+ INIT_LIST_HEAD(&mdsc->cap_wait_list); - spin_lock_init(&mdsc->cap_delay_lock); - INIT_LIST_HEAD(&mdsc->snap_flush_list); - spin_lock_init(&mdsc->snap_flush_lock); -@@ -4245,7 +4246,7 @@ static void wait_requests(struct ceph_mds_client *mdsc) - void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc) - { - dout("pre_umount\n"); -- mdsc->stopping = 1; -+ mdsc->stopping = CEPH_MDSC_STOPPING_BEGIN; - - lock_unlock_sessions(mdsc); - ceph_flush_dirty_caps(mdsc); -diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h -index 5cd131b41d84f..4fbbc33023c97 100644 ---- a/fs/ceph/mds_client.h -+++ b/fs/ceph/mds_client.h -@@ -340,6 +340,19 @@ struct ceph_quotarealm_inode { - struct inode *inode; - }; - -+struct cap_wait { -+ struct list_head list; -+ unsigned long ino; -+ pid_t tgid; -+ int need; -+ int want; -+}; -+ -+enum { -+ CEPH_MDSC_STOPPING_BEGIN = 1, -+ CEPH_MDSC_STOPPING_FLUSHED = 2, -+}; -+ - /* - * mds client state - */ -@@ -416,6 +429,7 @@ struct ceph_mds_client { - spinlock_t caps_list_lock; - struct list_head caps_list; /* unused (reserved or - unreserved) */ -+ struct list_head cap_wait_list; - int caps_total_count; /* total caps allocated */ - int caps_use_count; /* in use */ - int caps_use_max; /* max used caps */ -diff --git a/fs/ceph/super.c b/fs/ceph/super.c -index d40658d5e8089..0e38678d5adda 100644 ---- a/fs/ceph/super.c -+++ b/fs/ceph/super.c -@@ -1174,14 +1174,23 @@ out_final: - static void ceph_kill_sb(struct super_block *s) - { - struct ceph_fs_client *fsc = ceph_sb_to_client(s); -- dev_t dev = s->s_dev; - - dout("kill_sb %p\n", s); - - ceph_mdsc_pre_umount(fsc->mdsc); - flush_fs_workqueues(fsc); - -- generic_shutdown_super(s); -+ /* -+ * Though the kill_anon_super() will finally trigger the -+ * sync_filesystem() anyway, we still need to do it here -+ * and then bump the stage of shutdown to stop the work -+ * queue as earlier as possible. -+ */ -+ sync_filesystem(s); -+ -+ fsc->mdsc->stopping = CEPH_MDSC_STOPPING_FLUSHED; -+ -+ kill_anon_super(s); - - fsc->client->extra_mon_dispatch = NULL; - ceph_fs_debugfs_cleanup(fsc); -@@ -1189,7 +1198,6 @@ static void ceph_kill_sb(struct super_block *s) - ceph_fscache_unregister_fs(fsc); - - destroy_fs_client(fsc); -- free_anon_bdev(dev); - } - - static struct file_system_type ceph_fs_type = { -diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c -index edce0b25cd90e..f3482e936cc25 100644 ---- a/fs/dlm/plock.c -+++ b/fs/dlm/plock.c -@@ -19,20 +19,20 @@ static struct list_head recv_list; - static wait_queue_head_t send_wq; - static wait_queue_head_t recv_wq; - --struct plock_op { -- struct list_head list; -- int done; -- struct dlm_plock_info info; -- int (*callback)(struct file_lock *fl, int result); --}; -- --struct plock_xop { -- struct plock_op xop; -+struct plock_async_data { - void *fl; - void *file; - struct file_lock flc; -+ int (*callback)(struct file_lock *fl, int result); - }; - -+struct plock_op { -+ struct list_head list; -+ int done; -+ struct dlm_plock_info info; -+ /* if set indicates async handling */ -+ struct plock_async_data *data; -+}; - - static inline void set_version(struct dlm_plock_info *info) - { -@@ -58,6 +58,12 @@ static int check_version(struct dlm_plock_info *info) - return 0; - } - -+static void dlm_release_plock_op(struct plock_op *op) -+{ -+ kfree(op->data); -+ kfree(op); -+} -+ - static void send_op(struct plock_op *op) - { - set_version(&op->info); -@@ -101,22 +107,21 @@ static void do_unlock_close(struct dlm_ls *ls, u64 number, - int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, - int cmd, struct file_lock *fl) - { -+ struct plock_async_data *op_data; - struct dlm_ls *ls; - struct plock_op *op; -- struct plock_xop *xop; - int rv; - - ls = dlm_find_lockspace_local(lockspace); - if (!ls) - return -EINVAL; - -- xop = kzalloc(sizeof(*xop), GFP_NOFS); -- if (!xop) { -+ op = kzalloc(sizeof(*op), GFP_NOFS); -+ if (!op) { - rv = -ENOMEM; - goto out; - } - -- op = &xop->xop; - op->info.optype = DLM_PLOCK_OP_LOCK; - op->info.pid = fl->fl_pid; - op->info.ex = (fl->fl_type == F_WRLCK); -@@ -125,35 +130,44 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, - op->info.number = number; - op->info.start = fl->fl_start; - op->info.end = fl->fl_end; -+ /* async handling */ - if (fl->fl_lmops && fl->fl_lmops->lm_grant) { -+ op_data = kzalloc(sizeof(*op_data), GFP_NOFS); -+ if (!op_data) { -+ dlm_release_plock_op(op); -+ rv = -ENOMEM; -+ goto out; -+ } -+ - /* fl_owner is lockd which doesn't distinguish - processes on the nfs client */ - op->info.owner = (__u64) fl->fl_pid; -- op->callback = fl->fl_lmops->lm_grant; -- locks_init_lock(&xop->flc); -- locks_copy_lock(&xop->flc, fl); -- xop->fl = fl; -- xop->file = file; -+ op_data->callback = fl->fl_lmops->lm_grant; -+ locks_init_lock(&op_data->flc); -+ locks_copy_lock(&op_data->flc, fl); -+ op_data->fl = fl; -+ op_data->file = file; -+ -+ op->data = op_data; -+ -+ send_op(op); -+ rv = FILE_LOCK_DEFERRED; -+ goto out; - } else { - op->info.owner = (__u64)(long) fl->fl_owner; - } - - send_op(op); - -- if (!op->callback) { -- rv = wait_event_interruptible(recv_wq, (op->done != 0)); -- if (rv == -ERESTARTSYS) { -- log_debug(ls, "dlm_posix_lock: wait killed %llx", -- (unsigned long long)number); -- spin_lock(&ops_lock); -- list_del(&op->list); -- spin_unlock(&ops_lock); -- kfree(xop); -- do_unlock_close(ls, number, file, fl); -- goto out; -- } -- } else { -- rv = FILE_LOCK_DEFERRED; -+ rv = wait_event_killable(recv_wq, (op->done != 0)); -+ if (rv == -ERESTARTSYS) { -+ log_debug(ls, "%s: wait killed %llx", __func__, -+ (unsigned long long)number); -+ spin_lock(&ops_lock); -+ list_del(&op->list); -+ spin_unlock(&ops_lock); -+ dlm_release_plock_op(op); -+ do_unlock_close(ls, number, file, fl); - goto out; - } - -@@ -173,7 +187,7 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, - (unsigned long long)number); - } - -- kfree(xop); -+ dlm_release_plock_op(op); - out: - dlm_put_lockspace(ls); - return rv; -@@ -183,11 +197,11 @@ EXPORT_SYMBOL_GPL(dlm_posix_lock); - /* Returns failure iff a successful lock operation should be canceled */ - static int dlm_plock_callback(struct plock_op *op) - { -+ struct plock_async_data *op_data = op->data; - struct file *file; - struct file_lock *fl; - struct file_lock *flc; - int (*notify)(struct file_lock *fl, int result) = NULL; -- struct plock_xop *xop = (struct plock_xop *)op; - int rv = 0; - - spin_lock(&ops_lock); -@@ -199,10 +213,10 @@ static int dlm_plock_callback(struct plock_op *op) - spin_unlock(&ops_lock); - - /* check if the following 2 are still valid or make a copy */ -- file = xop->file; -- flc = &xop->flc; -- fl = xop->fl; -- notify = op->callback; -+ file = op_data->file; -+ flc = &op_data->flc; -+ fl = op_data->fl; -+ notify = op_data->callback; - - if (op->info.rv) { - notify(fl, op->info.rv); -@@ -233,7 +247,7 @@ static int dlm_plock_callback(struct plock_op *op) - } - - out: -- kfree(xop); -+ dlm_release_plock_op(op); - return rv; - } - -@@ -303,7 +317,7 @@ int dlm_posix_unlock(dlm_lockspace_t *lockspace, u64 number, struct file *file, - rv = 0; - - out_free: -- kfree(op); -+ dlm_release_plock_op(op); - out: - dlm_put_lockspace(ls); - fl->fl_flags = fl_flags; -@@ -371,7 +385,7 @@ int dlm_posix_get(dlm_lockspace_t *lockspace, u64 number, struct file *file, - rv = 0; - } - -- kfree(op); -+ dlm_release_plock_op(op); - out: - dlm_put_lockspace(ls); - return rv; -@@ -407,7 +421,7 @@ static ssize_t dev_read(struct file *file, char __user *u, size_t count, - (the process did not make an unlock call). */ - - if (op->info.flags & DLM_PLOCK_FL_CLOSE) -- kfree(op); -+ dlm_release_plock_op(op); - - if (copy_to_user(u, &info, sizeof(info))) - return -EFAULT; -@@ -439,7 +453,7 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count, - op->info.owner == info.owner) { - list_del_init(&op->list); - memcpy(&op->info, &info, sizeof(info)); -- if (op->callback) -+ if (op->data) - do_callback = 1; - else - op->done = 1; -diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h -index a89b43d759052..94e39a28bee2e 100644 ---- a/fs/ext2/ext2.h -+++ b/fs/ext2/ext2.h -@@ -68,10 +68,7 @@ struct mb_cache; - * second extended-fs super-block data in memory - */ - struct ext2_sb_info { -- unsigned long s_frag_size; /* Size of a fragment in bytes */ -- unsigned long s_frags_per_block;/* Number of fragments per block */ - unsigned long s_inodes_per_block;/* Number of inodes per block */ -- unsigned long s_frags_per_group;/* Number of fragments in a group */ - unsigned long s_blocks_per_group;/* Number of blocks in a group */ - unsigned long s_inodes_per_group;/* Number of inodes in a group */ - unsigned long s_itb_per_group; /* Number of inode table blocks per group */ -@@ -185,15 +182,6 @@ static inline struct ext2_sb_info *EXT2_SB(struct super_block *sb) - #define EXT2_INODE_SIZE(s) (EXT2_SB(s)->s_inode_size) - #define EXT2_FIRST_INO(s) (EXT2_SB(s)->s_first_ino) - --/* -- * Macro-instructions used to manage fragments -- */ --#define EXT2_MIN_FRAG_SIZE 1024 --#define EXT2_MAX_FRAG_SIZE 4096 --#define EXT2_MIN_FRAG_LOG_SIZE 10 --#define EXT2_FRAG_SIZE(s) (EXT2_SB(s)->s_frag_size) --#define EXT2_FRAGS_PER_BLOCK(s) (EXT2_SB(s)->s_frags_per_block) -- - /* - * Structure of a blocks group descriptor - */ -diff --git a/fs/ext2/super.c b/fs/ext2/super.c -index 6e8e47871fa26..a787f50732b87 100644 ---- a/fs/ext2/super.c -+++ b/fs/ext2/super.c -@@ -681,10 +681,9 @@ static int ext2_setup_super (struct super_block * sb, - es->s_max_mnt_count = cpu_to_le16(EXT2_DFL_MAX_MNT_COUNT); - le16_add_cpu(&es->s_mnt_count, 1); - if (test_opt (sb, DEBUG)) -- ext2_msg(sb, KERN_INFO, "%s, %s, bs=%lu, fs=%lu, gc=%lu, " -+ ext2_msg(sb, KERN_INFO, "%s, %s, bs=%lu, gc=%lu, " - "bpg=%lu, ipg=%lu, mo=%04lx]", - EXT2FS_VERSION, EXT2FS_DATE, sb->s_blocksize, -- sbi->s_frag_size, - sbi->s_groups_count, - EXT2_BLOCKS_PER_GROUP(sb), - EXT2_INODES_PER_GROUP(sb), -@@ -1031,14 +1030,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) - } - } - -- sbi->s_frag_size = EXT2_MIN_FRAG_SIZE << -- le32_to_cpu(es->s_log_frag_size); -- if (sbi->s_frag_size == 0) -- goto cantfind_ext2; -- sbi->s_frags_per_block = sb->s_blocksize / sbi->s_frag_size; -- - sbi->s_blocks_per_group = le32_to_cpu(es->s_blocks_per_group); -- sbi->s_frags_per_group = le32_to_cpu(es->s_frags_per_group); - sbi->s_inodes_per_group = le32_to_cpu(es->s_inodes_per_group); - - sbi->s_inodes_per_block = sb->s_blocksize / EXT2_INODE_SIZE(sb); -@@ -1064,11 +1056,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) - goto failed_mount; - } - -- if (sb->s_blocksize != sbi->s_frag_size) { -+ if (es->s_log_frag_size != es->s_log_block_size) { - ext2_msg(sb, KERN_ERR, -- "error: fragsize %lu != blocksize %lu" -- "(not supported yet)", -- sbi->s_frag_size, sb->s_blocksize); -+ "error: fragsize log %u != blocksize log %u", -+ le32_to_cpu(es->s_log_frag_size), sb->s_blocksize_bits); - goto failed_mount; - } - -@@ -1078,12 +1069,6 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) - sbi->s_blocks_per_group); - goto failed_mount; - } -- if (sbi->s_frags_per_group > sb->s_blocksize * 8) { -- ext2_msg(sb, KERN_ERR, -- "error: #fragments per group too big: %lu", -- sbi->s_frags_per_group); -- goto failed_mount; -- } - if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || - sbi->s_inodes_per_group > sb->s_blocksize * 8) { - ext2_msg(sb, KERN_ERR, -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 9d86cf3a09bf7..604fef3b2ddf4 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -1441,7 +1441,7 @@ struct ext4_sb_info { - unsigned long s_commit_interval; - u32 s_max_batch_time; - u32 s_min_batch_time; -- struct block_device *journal_bdev; -+ struct block_device *s_journal_bdev; - #ifdef CONFIG_QUOTA - /* Names of quota files with journalled quota */ - char __rcu *s_qf_names[EXT4_MAXQUOTAS]; -diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c -index d1ef651948d7e..d18c4cd4c63ff 100644 ---- a/fs/ext4/fsmap.c -+++ b/fs/ext4/fsmap.c -@@ -576,8 +576,8 @@ static bool ext4_getfsmap_is_valid_device(struct super_block *sb, - if (fm->fmr_device == 0 || fm->fmr_device == UINT_MAX || - fm->fmr_device == new_encode_dev(sb->s_bdev->bd_dev)) - return true; -- if (EXT4_SB(sb)->journal_bdev && -- fm->fmr_device == new_encode_dev(EXT4_SB(sb)->journal_bdev->bd_dev)) -+ if (EXT4_SB(sb)->s_journal_bdev && -+ fm->fmr_device == new_encode_dev(EXT4_SB(sb)->s_journal_bdev->bd_dev)) - return true; - return false; - } -@@ -647,9 +647,9 @@ int ext4_getfsmap(struct super_block *sb, struct ext4_fsmap_head *head, - memset(handlers, 0, sizeof(handlers)); - handlers[0].gfd_dev = new_encode_dev(sb->s_bdev->bd_dev); - handlers[0].gfd_fn = ext4_getfsmap_datadev; -- if (EXT4_SB(sb)->journal_bdev) { -+ if (EXT4_SB(sb)->s_journal_bdev) { - handlers[1].gfd_dev = new_encode_dev( -- EXT4_SB(sb)->journal_bdev->bd_dev); -+ EXT4_SB(sb)->s_journal_bdev->bd_dev); - handlers[1].gfd_fn = ext4_getfsmap_logdev; - } - -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index 306ad7d0003bb..ae47505964c4b 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -573,6 +573,7 @@ static int ext4_shutdown(struct super_block *sb, unsigned long arg) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); - __u32 flags; -+ struct super_block *ret; - - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; -@@ -591,7 +592,9 @@ static int ext4_shutdown(struct super_block *sb, unsigned long arg) - - switch (flags) { - case EXT4_GOING_FLAGS_DEFAULT: -- freeze_bdev(sb->s_bdev); -+ ret = freeze_bdev(sb->s_bdev); -+ if (IS_ERR(ret)) -+ return PTR_ERR(ret); - set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags); - thaw_bdev(sb->s_bdev, sb); - break; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 9bbd525086562..8ad3de7846c54 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -906,10 +906,16 @@ static void ext4_blkdev_put(struct block_device *bdev) - static void ext4_blkdev_remove(struct ext4_sb_info *sbi) - { - struct block_device *bdev; -- bdev = sbi->journal_bdev; -+ bdev = sbi->s_journal_bdev; - if (bdev) { -+ /* -+ * Invalidate the journal device's buffers. We don't want them -+ * floating about in memory - the physical journal device may -+ * hotswapped, and it breaks the `ro-after' testing code. -+ */ -+ invalidate_bdev(bdev); - ext4_blkdev_put(bdev); -- sbi->journal_bdev = NULL; -+ sbi->s_journal_bdev = NULL; - } - } - -@@ -1034,14 +1040,8 @@ static void ext4_put_super(struct super_block *sb) - - sync_blockdev(sb->s_bdev); - invalidate_bdev(sb->s_bdev); -- if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) { -- /* -- * Invalidate the journal device's buffers. We don't want them -- * floating about in memory - the physical journal device may -- * hotswapped, and it breaks the `ro-after' testing code. -- */ -- sync_blockdev(sbi->journal_bdev); -- invalidate_bdev(sbi->journal_bdev); -+ if (sbi->s_journal_bdev && sbi->s_journal_bdev != sb->s_bdev) { -+ sync_blockdev(sbi->s_journal_bdev); - ext4_blkdev_remove(sbi); - } - -@@ -3582,7 +3582,7 @@ int ext4_calculate_overhead(struct super_block *sb) - * Add the internal journal blocks whether the journal has been - * loaded or not - */ -- if (sbi->s_journal && !sbi->journal_bdev) -+ if (sbi->s_journal && !sbi->s_journal_bdev) - overhead += EXT4_NUM_B2C(sbi, sbi->s_journal->j_maxlen); - else if (ext4_has_feature_journal(sb) && !sbi->s_journal && j_inum) { - /* j_inum for internal journal is non-zero */ -@@ -4777,6 +4777,7 @@ failed_mount: - ext4_blkdev_remove(sbi); - brelse(bh); - out_fail: -+ invalidate_bdev(sb->s_bdev); - sb->s_fs_info = NULL; - kfree(sbi->s_blockgroup_lock); - out_free_base: -@@ -4952,7 +4953,7 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb, - be32_to_cpu(journal->j_superblock->s_nr_users)); - goto out_journal; - } -- EXT4_SB(sb)->journal_bdev = bdev; -+ EXT4_SB(sb)->s_journal_bdev = bdev; - ext4_init_journal_params(sb, journal); - return journal; - -diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c -index 5ef99b9ec8be7..edb17822f8e6b 100644 ---- a/fs/jbd2/checkpoint.c -+++ b/fs/jbd2/checkpoint.c -@@ -57,28 +57,6 @@ static inline void __buffer_unlink(struct journal_head *jh) - } - } - --/* -- * Move a buffer from the checkpoint list to the checkpoint io list -- * -- * Called with j_list_lock held -- */ --static inline void __buffer_relink_io(struct journal_head *jh) --{ -- transaction_t *transaction = jh->b_cp_transaction; -- -- __buffer_unlink_first(jh); -- -- if (!transaction->t_checkpoint_io_list) { -- jh->b_cpnext = jh->b_cpprev = jh; -- } else { -- jh->b_cpnext = transaction->t_checkpoint_io_list; -- jh->b_cpprev = transaction->t_checkpoint_io_list->b_cpprev; -- jh->b_cpprev->b_cpnext = jh; -- jh->b_cpnext->b_cpprev = jh; -- } -- transaction->t_checkpoint_io_list = jh; --} -- - /* - * Try to release a checkpointed buffer from its transaction. - * Returns 1 if we released it and 2 if we also released the -@@ -91,8 +69,7 @@ static int __try_to_free_cp_buf(struct journal_head *jh) - int ret = 0; - struct buffer_head *bh = jh2bh(jh); - -- if (jh->b_transaction == NULL && !buffer_locked(bh) && -- !buffer_dirty(bh) && !buffer_write_io_error(bh)) { -+ if (!jh->b_transaction && !buffer_locked(bh) && !buffer_dirty(bh)) { - JBUFFER_TRACE(jh, "remove from checkpoint list"); - ret = __jbd2_journal_remove_checkpoint(jh) + 1; - } -@@ -191,6 +168,7 @@ __flush_batch(journal_t *journal, int *batch_count) - struct buffer_head *bh = journal->j_chkpt_bhs[i]; - BUFFER_TRACE(bh, "brelse"); - __brelse(bh); -+ journal->j_chkpt_bhs[i] = NULL; - } - *batch_count = 0; - } -@@ -228,7 +206,6 @@ int jbd2_log_do_checkpoint(journal_t *journal) - * OK, we need to start writing disk blocks. Take one transaction - * and write it. - */ -- result = 0; - spin_lock(&journal->j_list_lock); - if (!journal->j_checkpoint_transactions) - goto out; -@@ -251,15 +228,6 @@ restart: - jh = transaction->t_checkpoint_list; - bh = jh2bh(jh); - -- if (buffer_locked(bh)) { -- get_bh(bh); -- spin_unlock(&journal->j_list_lock); -- wait_on_buffer(bh); -- /* the journal_head may have gone by now */ -- BUFFER_TRACE(bh, "brelse"); -- __brelse(bh); -- goto retry; -- } - if (jh->b_transaction != NULL) { - transaction_t *t = jh->b_transaction; - tid_t tid = t->t_tid; -@@ -294,32 +262,50 @@ restart: - spin_lock(&journal->j_list_lock); - goto restart; - } -- if (!buffer_dirty(bh)) { -- if (unlikely(buffer_write_io_error(bh)) && !result) -- result = -EIO; -+ if (!trylock_buffer(bh)) { -+ /* -+ * The buffer is locked, it may be writing back, or -+ * flushing out in the last couple of cycles, or -+ * re-adding into a new transaction, need to check -+ * it again until it's unlocked. -+ */ -+ get_bh(bh); -+ spin_unlock(&journal->j_list_lock); -+ wait_on_buffer(bh); -+ /* the journal_head may have gone by now */ -+ BUFFER_TRACE(bh, "brelse"); -+ __brelse(bh); -+ goto retry; -+ } else if (!buffer_dirty(bh)) { -+ unlock_buffer(bh); - BUFFER_TRACE(bh, "remove from checkpoint"); -- if (__jbd2_journal_remove_checkpoint(jh)) -- /* The transaction was released; we're done */ -+ /* -+ * If the transaction was released or the checkpoint -+ * list was empty, we're done. -+ */ -+ if (__jbd2_journal_remove_checkpoint(jh) || -+ !transaction->t_checkpoint_list) - goto out; -- continue; -+ } else { -+ unlock_buffer(bh); -+ /* -+ * We are about to write the buffer, it could be -+ * raced by some other transaction shrink or buffer -+ * re-log logic once we release the j_list_lock, -+ * leave it on the checkpoint list and check status -+ * again to make sure it's clean. -+ */ -+ BUFFER_TRACE(bh, "queue"); -+ get_bh(bh); -+ J_ASSERT_BH(bh, !buffer_jwrite(bh)); -+ journal->j_chkpt_bhs[batch_count++] = bh; -+ transaction->t_chp_stats.cs_written++; -+ transaction->t_checkpoint_list = jh->b_cpnext; - } -- /* -- * Important: we are about to write the buffer, and -- * possibly block, while still holding the journal -- * lock. We cannot afford to let the transaction -- * logic start messing around with this buffer before -- * we write it to disk, as that would break -- * recoverability. -- */ -- BUFFER_TRACE(bh, "queue"); -- get_bh(bh); -- J_ASSERT_BH(bh, !buffer_jwrite(bh)); -- journal->j_chkpt_bhs[batch_count++] = bh; -- __buffer_relink_io(jh); -- transaction->t_chp_stats.cs_written++; -+ - if ((batch_count == JBD2_NR_BATCH) || -- need_resched() || -- spin_needbreak(&journal->j_list_lock)) -+ need_resched() || spin_needbreak(&journal->j_list_lock) || -+ jh2bh(transaction->t_checkpoint_list) == journal->j_chkpt_bhs[0]) - goto unlock_and_flush; - } - -@@ -333,46 +319,9 @@ restart: - goto restart; - } - -- /* -- * Now we issued all of the transaction's buffers, let's deal -- * with the buffers that are out for I/O. -- */ --restart2: -- /* Did somebody clean up the transaction in the meanwhile? */ -- if (journal->j_checkpoint_transactions != transaction || -- transaction->t_tid != this_tid) -- goto out; -- -- while (transaction->t_checkpoint_io_list) { -- jh = transaction->t_checkpoint_io_list; -- bh = jh2bh(jh); -- if (buffer_locked(bh)) { -- get_bh(bh); -- spin_unlock(&journal->j_list_lock); -- wait_on_buffer(bh); -- /* the journal_head may have gone by now */ -- BUFFER_TRACE(bh, "brelse"); -- __brelse(bh); -- spin_lock(&journal->j_list_lock); -- goto restart2; -- } -- if (unlikely(buffer_write_io_error(bh)) && !result) -- result = -EIO; -- -- /* -- * Now in whatever state the buffer currently is, we -- * know that it has been written out and so we can -- * drop it from the list -- */ -- if (__jbd2_journal_remove_checkpoint(jh)) -- break; -- } - out: - spin_unlock(&journal->j_list_lock); -- if (result < 0) -- jbd2_journal_abort(journal, result); -- else -- result = jbd2_cleanup_journal_tail(journal); -+ result = jbd2_cleanup_journal_tail(journal); - - return (result < 0) ? result : 0; - } -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index b7c5819bfc411..eeebe64b7c543 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -562,12 +562,14 @@ static int __jbd2_journal_force_commit(journal_t *journal) - } - - /** -- * Force and wait upon a commit if the calling process is not within -- * transaction. This is used for forcing out undo-protected data which contains -- * bitmaps, when the fs is running out of space. -+ * jbd2_journal_force_commit_nested - Force and wait upon a commit if the -+ * calling process is not within transaction. - * - * @journal: journal to force - * Returns true if progress was made. -+ * -+ * This is used for forcing out undo-protected data which contains -+ * bitmaps, when the fs is running out of space. - */ - int jbd2_journal_force_commit_nested(journal_t *journal) - { -@@ -578,7 +580,7 @@ int jbd2_journal_force_commit_nested(journal_t *journal) - } - - /** -- * int journal_force_commit() - force any uncommitted transactions -+ * jbd2_journal_force_commit() - force any uncommitted transactions - * @journal: journal to force - * - * Caller want unconditional commit. We can only force the running transaction -@@ -1266,7 +1268,7 @@ journal_t *jbd2_journal_init_inode(struct inode *inode) - * superblock as being NULL to prevent the journal destroy from writing - * back a bogus superblock. - */ --static void journal_fail_superblock (journal_t *journal) -+static void journal_fail_superblock(journal_t *journal) - { - struct buffer_head *bh = journal->j_sb_buffer; - brelse(bh); -@@ -1634,7 +1636,7 @@ static int load_superblock(journal_t *journal) - - - /** -- * int jbd2_journal_load() - Read journal from disk. -+ * jbd2_journal_load() - Read journal from disk. - * @journal: Journal to act on. - * - * Given a journal_t structure which tells us which disk blocks contain -@@ -1704,7 +1706,7 @@ recovery_error: - } - - /** -- * void jbd2_journal_destroy() - Release a journal_t structure. -+ * jbd2_journal_destroy() - Release a journal_t structure. - * @journal: Journal to act on. - * - * Release a journal_t structure once it is no longer in use by the -@@ -1780,7 +1782,7 @@ int jbd2_journal_destroy(journal_t *journal) - - - /** -- *int jbd2_journal_check_used_features () - Check if features specified are used. -+ * jbd2_journal_check_used_features() - Check if features specified are used. - * @journal: Journal to check. - * @compat: bitmask of compatible features - * @ro: bitmask of features that force read-only mount -@@ -1790,7 +1792,7 @@ int jbd2_journal_destroy(journal_t *journal) - * features. Return true (non-zero) if it does. - **/ - --int jbd2_journal_check_used_features (journal_t *journal, unsigned long compat, -+int jbd2_journal_check_used_features(journal_t *journal, unsigned long compat, - unsigned long ro, unsigned long incompat) - { - journal_superblock_t *sb; -@@ -1815,7 +1817,7 @@ int jbd2_journal_check_used_features (journal_t *journal, unsigned long compat, - } - - /** -- * int jbd2_journal_check_available_features() - Check feature set in journalling layer -+ * jbd2_journal_check_available_features() - Check feature set in journalling layer - * @journal: Journal to check. - * @compat: bitmask of compatible features - * @ro: bitmask of features that force read-only mount -@@ -1825,7 +1827,7 @@ int jbd2_journal_check_used_features (journal_t *journal, unsigned long compat, - * all of a given set of features on this journal. Return true - * (non-zero) if it can. */ - --int jbd2_journal_check_available_features (journal_t *journal, unsigned long compat, -+int jbd2_journal_check_available_features(journal_t *journal, unsigned long compat, - unsigned long ro, unsigned long incompat) - { - if (!compat && !ro && !incompat) -@@ -1847,7 +1849,7 @@ int jbd2_journal_check_available_features (journal_t *journal, unsigned long com - } - - /** -- * int jbd2_journal_set_features () - Mark a given journal feature in the superblock -+ * jbd2_journal_set_features() - Mark a given journal feature in the superblock - * @journal: Journal to act on. - * @compat: bitmask of compatible features - * @ro: bitmask of features that force read-only mount -@@ -1858,7 +1860,7 @@ int jbd2_journal_check_available_features (journal_t *journal, unsigned long com - * - */ - --int jbd2_journal_set_features (journal_t *journal, unsigned long compat, -+int jbd2_journal_set_features(journal_t *journal, unsigned long compat, - unsigned long ro, unsigned long incompat) - { - #define INCOMPAT_FEATURE_ON(f) \ -@@ -1929,7 +1931,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat, - } - - /* -- * jbd2_journal_clear_features () - Clear a given journal feature in the -+ * jbd2_journal_clear_features() - Clear a given journal feature in the - * superblock - * @journal: Journal to act on. - * @compat: bitmask of compatible features -@@ -1956,7 +1958,7 @@ void jbd2_journal_clear_features(journal_t *journal, unsigned long compat, - EXPORT_SYMBOL(jbd2_journal_clear_features); - - /** -- * int jbd2_journal_flush () - Flush journal -+ * jbd2_journal_flush() - Flush journal - * @journal: Journal to act on. - * - * Flush all data for a given journal to disk and empty the journal. -@@ -2031,7 +2033,7 @@ out: - } - - /** -- * int jbd2_journal_wipe() - Wipe journal contents -+ * jbd2_journal_wipe() - Wipe journal contents - * @journal: Journal to act on. - * @write: flag (see below) - * -@@ -2072,7 +2074,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) - } - - /** -- * void jbd2_journal_abort () - Shutdown the journal immediately. -+ * jbd2_journal_abort () - Shutdown the journal immediately. - * @journal: the journal to shutdown. - * @errno: an error number to record in the journal indicating - * the reason for the shutdown. -@@ -2158,7 +2160,7 @@ void jbd2_journal_abort(journal_t *journal, int errno) - } - - /** -- * int jbd2_journal_errno () - returns the journal's error state. -+ * jbd2_journal_errno() - returns the journal's error state. - * @journal: journal to examine. - * - * This is the errno number set with jbd2_journal_abort(), the last -@@ -2182,7 +2184,7 @@ int jbd2_journal_errno(journal_t *journal) - } - - /** -- * int jbd2_journal_clear_err () - clears the journal's error state -+ * jbd2_journal_clear_err() - clears the journal's error state - * @journal: journal to act on. - * - * An error must be cleared or acked to take a FS out of readonly -@@ -2202,7 +2204,7 @@ int jbd2_journal_clear_err(journal_t *journal) - } - - /** -- * void jbd2_journal_ack_err() - Ack journal err. -+ * jbd2_journal_ack_err() - Ack journal err. - * @journal: journal to act on. - * - * An error must be cleared or acked to take a FS out of readonly -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index 09f4d00fece2f..91c2d3f6d1b3b 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -490,7 +490,7 @@ EXPORT_SYMBOL(jbd2__journal_start); - - - /** -- * handle_t *jbd2_journal_start() - Obtain a new handle. -+ * jbd2_journal_start() - Obtain a new handle. - * @journal: Journal to start transaction on. - * @nblocks: number of block buffer we might modify - * -@@ -525,7 +525,7 @@ void jbd2_journal_free_reserved(handle_t *handle) - EXPORT_SYMBOL(jbd2_journal_free_reserved); - - /** -- * int jbd2_journal_start_reserved() - start reserved handle -+ * jbd2_journal_start_reserved() - start reserved handle - * @handle: handle to start - * @type: for handle statistics - * @line_no: for handle statistics -@@ -579,7 +579,7 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type, - EXPORT_SYMBOL(jbd2_journal_start_reserved); - - /** -- * int jbd2_journal_extend() - extend buffer credits. -+ * jbd2_journal_extend() - extend buffer credits. - * @handle: handle to 'extend' - * @nblocks: nr blocks to try to extend by. - * -@@ -659,7 +659,7 @@ error_out: - - - /** -- * int jbd2_journal_restart() - restart a handle . -+ * jbd2__journal_restart() - restart a handle . - * @handle: handle to restart - * @nblocks: nr credits requested - * @gfp_mask: memory allocation flags (for start_this_handle) -@@ -736,7 +736,7 @@ int jbd2_journal_restart(handle_t *handle, int nblocks) - EXPORT_SYMBOL(jbd2_journal_restart); - - /** -- * void jbd2_journal_lock_updates () - establish a transaction barrier. -+ * jbd2_journal_lock_updates () - establish a transaction barrier. - * @journal: Journal to establish a barrier on. - * - * This locks out any further updates from being started, and blocks -@@ -795,7 +795,7 @@ void jbd2_journal_lock_updates(journal_t *journal) - } - - /** -- * void jbd2_journal_unlock_updates (journal_t* journal) - release barrier -+ * jbd2_journal_unlock_updates () - release barrier - * @journal: Journal to release the barrier on. - * - * Release a transaction barrier obtained with jbd2_journal_lock_updates(). -@@ -1103,7 +1103,8 @@ out: - } - - /** -- * int jbd2_journal_get_write_access() - notify intent to modify a buffer for metadata (not data) update. -+ * jbd2_journal_get_write_access() - notify intent to modify a buffer -+ * for metadata (not data) update. - * @handle: transaction to add buffer modifications to - * @bh: bh to be used for metadata writes - * -@@ -1147,7 +1148,7 @@ int jbd2_journal_get_write_access(handle_t *handle, struct buffer_head *bh) - * unlocked buffer beforehand. */ - - /** -- * int jbd2_journal_get_create_access () - notify intent to use newly created bh -+ * jbd2_journal_get_create_access () - notify intent to use newly created bh - * @handle: transaction to new buffer to - * @bh: new buffer. - * -@@ -1227,7 +1228,7 @@ out: - } - - /** -- * int jbd2_journal_get_undo_access() - Notify intent to modify metadata with -+ * jbd2_journal_get_undo_access() - Notify intent to modify metadata with - * non-rewindable consequences - * @handle: transaction - * @bh: buffer to undo -@@ -1304,7 +1305,7 @@ out: - } - - /** -- * void jbd2_journal_set_triggers() - Add triggers for commit writeout -+ * jbd2_journal_set_triggers() - Add triggers for commit writeout - * @bh: buffer to trigger on - * @type: struct jbd2_buffer_trigger_type containing the trigger(s). - * -@@ -1346,7 +1347,7 @@ void jbd2_buffer_abort_trigger(struct journal_head *jh, - } - - /** -- * int jbd2_journal_dirty_metadata() - mark a buffer as containing dirty metadata -+ * jbd2_journal_dirty_metadata() - mark a buffer as containing dirty metadata - * @handle: transaction to add buffer to. - * @bh: buffer to mark - * -@@ -1524,7 +1525,7 @@ out: - } - - /** -- * void jbd2_journal_forget() - bforget() for potentially-journaled buffers. -+ * jbd2_journal_forget() - bforget() for potentially-journaled buffers. - * @handle: transaction handle - * @bh: bh to 'forget' - * -@@ -1699,7 +1700,7 @@ not_jbd: - } - - /** -- * int jbd2_journal_stop() - complete a transaction -+ * jbd2_journal_stop() - complete a transaction - * @handle: transaction to complete. - * - * All done for a particular handle. -@@ -2047,7 +2048,7 @@ out: - } - - /** -- * int jbd2_journal_try_to_free_buffers() - try to free page buffers. -+ * jbd2_journal_try_to_free_buffers() - try to free page buffers. - * @journal: journal for operation - * @page: to try and free - * @gfp_mask: we use the mask to detect how hard should we try to release -@@ -2386,7 +2387,7 @@ zap_buffer_unlocked: - } - - /** -- * void jbd2_journal_invalidatepage() -+ * jbd2_journal_invalidatepage() - * @journal: journal to use for flush... - * @page: page to flush - * @offset: start of the range to invalidate -diff --git a/fs/super.c b/fs/super.c -index e255c18fa2c88..47ca7dc0e6c3d 100644 ---- a/fs/super.c -+++ b/fs/super.c -@@ -905,6 +905,7 @@ int reconfigure_super(struct fs_context *fc) - struct super_block *sb = fc->root->d_sb; - int retval; - bool remount_ro = false; -+ bool remount_rw = false; - bool force = fc->sb_flags & SB_FORCE; - - if (fc->sb_flags_mask & ~MS_RMT_MASK) -@@ -921,7 +922,7 @@ int reconfigure_super(struct fs_context *fc) - if (!(fc->sb_flags & SB_RDONLY) && bdev_read_only(sb->s_bdev)) - return -EACCES; - #endif -- -+ remount_rw = !(fc->sb_flags & SB_RDONLY) && sb_rdonly(sb); - remount_ro = (fc->sb_flags & SB_RDONLY) && !sb_rdonly(sb); - } - -@@ -951,6 +952,14 @@ int reconfigure_super(struct fs_context *fc) - if (retval) - return retval; - } -+ } else if (remount_rw) { -+ /* -+ * We set s_readonly_remount here to protect filesystem's -+ * reconfigure code from writes from userspace until -+ * reconfigure finishes. -+ */ -+ sb->s_readonly_remount = 1; -+ smp_wmb(); - } - - if (fc->ops->reconfigure) { -diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c -index 31f66053e2393..e3d1673b8ec97 100644 ---- a/fs/sysv/itree.c -+++ b/fs/sysv/itree.c -@@ -145,6 +145,10 @@ static int alloc_branch(struct inode *inode, - */ - parent = block_to_cpu(SYSV_SB(inode->i_sb), branch[n-1].key); - bh = sb_getblk(inode->i_sb, parent); -+ if (!bh) { -+ sysv_free_block(inode->i_sb, branch[n].key); -+ break; -+ } - lock_buffer(bh); - memset(bh->b_data, 0, blocksize); - branch[n].bh = bh; -diff --git a/include/asm-generic/word-at-a-time.h b/include/asm-generic/word-at-a-time.h -index 20c93f08c9933..95a1d214108a5 100644 ---- a/include/asm-generic/word-at-a-time.h -+++ b/include/asm-generic/word-at-a-time.h -@@ -38,7 +38,7 @@ static inline long find_zero(unsigned long mask) - return (mask >> 8) ? byte : byte + 1; - } - --static inline bool has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c) -+static inline unsigned long has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c) - { - unsigned long rhs = val | c->low_bits; - *data = rhs; -diff --git a/include/linux/device.h b/include/linux/device.h -index d74275e2047a4..c7be3a8073ec3 100644 ---- a/include/linux/device.h -+++ b/include/linux/device.h -@@ -1871,6 +1871,9 @@ do { \ - WARN_ONCE(condition, "%s %s: " format, \ - dev_driver_string(dev), dev_name(dev), ## arg) - -+extern __printf(3, 4) -+int dev_err_probe(const struct device *dev, int err, const char *fmt, ...); -+ - /* Create alias, so I can be autoloaded. */ - #define MODULE_ALIAS_CHARDEV(major,minor) \ - MODULE_ALIAS("char-major-" __stringify(major) "-" __stringify(minor)) -diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h -index b0e97e5de8ca4..b60adc4210b57 100644 ---- a/include/linux/jbd2.h -+++ b/include/linux/jbd2.h -@@ -415,7 +415,7 @@ static inline void jbd_unlock_bh_journal_head(struct buffer_head *bh) - #define JI_WAIT_DATA (1 << __JI_WAIT_DATA) - - /** -- * struct jbd_inode - The jbd_inode type is the structure linking inodes in -+ * struct jbd2_inode - The jbd_inode type is the structure linking inodes in - * ordered mode present in a transaction so that we can sync them during commit. - */ - struct jbd2_inode { -diff --git a/include/linux/pm_wakeirq.h b/include/linux/pm_wakeirq.h -index cd5b62db90845..e63a63aa47a37 100644 ---- a/include/linux/pm_wakeirq.h -+++ b/include/linux/pm_wakeirq.h -@@ -17,8 +17,8 @@ - #ifdef CONFIG_PM - - extern int dev_pm_set_wake_irq(struct device *dev, int irq); --extern int dev_pm_set_dedicated_wake_irq(struct device *dev, -- int irq); -+extern int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq); -+extern int dev_pm_set_dedicated_wake_irq_reverse(struct device *dev, int irq); - extern void dev_pm_clear_wake_irq(struct device *dev); - extern void dev_pm_enable_wake_irq(struct device *dev); - extern void dev_pm_disable_wake_irq(struct device *dev); -@@ -35,6 +35,11 @@ static inline int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq) - return 0; - } - -+static inline int dev_pm_set_dedicated_wake_irq_reverse(struct device *dev, int irq) -+{ -+ return 0; -+} -+ - static inline void dev_pm_clear_wake_irq(struct device *dev) - { - } -diff --git a/include/net/ipv6.h b/include/net/ipv6.h -index 0e031a4fef408..8c454509f299f 100644 ---- a/include/net/ipv6.h -+++ b/include/net/ipv6.h -@@ -660,12 +660,8 @@ static inline u32 ipv6_addr_hash(const struct in6_addr *a) - /* more secured version of ipv6_addr_hash() */ - static inline u32 __ipv6_addr_jhash(const struct in6_addr *a, const u32 initval) - { -- u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1]; -- -- return jhash_3words(v, -- (__force u32)a->s6_addr32[2], -- (__force u32)a->s6_addr32[3], -- initval); -+ return jhash2((__force const u32 *)a->s6_addr32, -+ ARRAY_SIZE(a->s6_addr32), initval); - } - - static inline bool ipv6_addr_loopback(const struct in6_addr *a) -diff --git a/include/net/vxlan.h b/include/net/vxlan.h -index 373aadcfea21d..d79ee21d7932a 100644 ---- a/include/net/vxlan.h -+++ b/include/net/vxlan.h -@@ -323,10 +323,15 @@ static inline netdev_features_t vxlan_features_check(struct sk_buff *skb, - return features; - } - --/* IP header + UDP + VXLAN + Ethernet header */ --#define VXLAN_HEADROOM (20 + 8 + 8 + 14) --/* IPv6 header + UDP + VXLAN + Ethernet header */ --#define VXLAN6_HEADROOM (40 + 8 + 8 + 14) -+static inline int vxlan_headroom(u32 flags) -+{ -+ /* VXLAN: IP4/6 header + UDP + VXLAN + Ethernet header */ -+ /* VXLAN-GPE: IP4/6 header + UDP + VXLAN */ -+ return (flags & VXLAN_F_IPV6 ? sizeof(struct ipv6hdr) : -+ sizeof(struct iphdr)) + -+ sizeof(struct udphdr) + sizeof(struct vxlanhdr) + -+ (flags & VXLAN_F_GPE ? 0 : ETH_HLEN); -+} - - static inline struct vxlanhdr *vxlan_hdr(struct sk_buff *skb) - { -diff --git a/include/uapi/linux/blkzoned.h b/include/uapi/linux/blkzoned.h -index 498eec813494c..94649130e3d74 100644 ---- a/include/uapi/linux/blkzoned.h -+++ b/include/uapi/linux/blkzoned.h -@@ -51,13 +51,13 @@ enum blk_zone_type { - * - * The Zone Condition state machine in the ZBC/ZAC standards maps the above - * deinitions as: -- * - ZC1: Empty | BLK_ZONE_EMPTY -+ * - ZC1: Empty | BLK_ZONE_COND_EMPTY - * - ZC2: Implicit Open | BLK_ZONE_COND_IMP_OPEN - * - ZC3: Explicit Open | BLK_ZONE_COND_EXP_OPEN -- * - ZC4: Closed | BLK_ZONE_CLOSED -- * - ZC5: Full | BLK_ZONE_FULL -- * - ZC6: Read Only | BLK_ZONE_READONLY -- * - ZC7: Offline | BLK_ZONE_OFFLINE -+ * - ZC4: Closed | BLK_ZONE_COND_CLOSED -+ * - ZC5: Full | BLK_ZONE_COND_FULL -+ * - ZC6: Read Only | BLK_ZONE_COND_READONLY -+ * - ZC7: Offline | BLK_ZONE_COND_OFFLINE - * - * Conditions 0x5 to 0xC are reserved by the current ZBC/ZAC spec and should - * be considered invalid. -diff --git a/include/uapi/linux/watch_queue.h b/include/uapi/linux/watch_queue.h -new file mode 100644 -index 0000000000000..5f3d21e8a34b0 ---- /dev/null -+++ b/include/uapi/linux/watch_queue.h -@@ -0,0 +1,55 @@ -+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -+#ifndef _UAPI_LINUX_WATCH_QUEUE_H -+#define _UAPI_LINUX_WATCH_QUEUE_H -+ -+#include -+ -+enum watch_notification_type { -+ WATCH_TYPE_META = 0, /* Special record */ -+ WATCH_TYPE__NR = 1 -+}; -+ -+enum watch_meta_notification_subtype { -+ WATCH_META_REMOVAL_NOTIFICATION = 0, /* Watched object was removed */ -+ WATCH_META_LOSS_NOTIFICATION = 1, /* Data loss occurred */ -+}; -+ -+/* -+ * Notification record header. This is aligned to 64-bits so that subclasses -+ * can contain __u64 fields. -+ */ -+struct watch_notification { -+ __u32 type:24; /* enum watch_notification_type */ -+ __u32 subtype:8; /* Type-specific subtype (filterable) */ -+ __u32 info; -+#define WATCH_INFO_LENGTH 0x0000007f /* Length of record */ -+#define WATCH_INFO_LENGTH__SHIFT 0 -+#define WATCH_INFO_ID 0x0000ff00 /* ID of watchpoint */ -+#define WATCH_INFO_ID__SHIFT 8 -+#define WATCH_INFO_TYPE_INFO 0xffff0000 /* Type-specific info */ -+#define WATCH_INFO_TYPE_INFO__SHIFT 16 -+#define WATCH_INFO_FLAG_0 0x00010000 /* Type-specific info, flag bit 0 */ -+#define WATCH_INFO_FLAG_1 0x00020000 /* ... */ -+#define WATCH_INFO_FLAG_2 0x00040000 -+#define WATCH_INFO_FLAG_3 0x00080000 -+#define WATCH_INFO_FLAG_4 0x00100000 -+#define WATCH_INFO_FLAG_5 0x00200000 -+#define WATCH_INFO_FLAG_6 0x00400000 -+#define WATCH_INFO_FLAG_7 0x00800000 -+}; -+ -+ -+/* -+ * Extended watch removal notification. This is used optionally if the type -+ * wants to indicate an identifier for the object being watched, if there is -+ * such. This can be distinguished by the length. -+ * -+ * type -> WATCH_TYPE_META -+ * subtype -> WATCH_META_REMOVAL_NOTIFICATION -+ */ -+struct watch_notification_removal { -+ struct watch_notification watch; -+ __u64 id; /* Type-dependent identifier */ -+}; -+ -+#endif /* _UAPI_LINUX_WATCH_QUEUE_H */ -diff --git a/kernel/events/core.c b/kernel/events/core.c -index c4a44ef836b02..875b3c27eab02 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -1134,6 +1134,11 @@ static int perf_mux_hrtimer_restart(struct perf_cpu_context *cpuctx) - return 0; - } - -+static int perf_mux_hrtimer_restart_ipi(void *arg) -+{ -+ return perf_mux_hrtimer_restart(arg); -+} -+ - void perf_pmu_disable(struct pmu *pmu) - { - int *count = this_cpu_ptr(pmu->pmu_disable_count); -@@ -9997,8 +10002,7 @@ perf_event_mux_interval_ms_store(struct device *dev, - cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu); - cpuctx->hrtimer_interval = ns_to_ktime(NSEC_PER_MSEC * timer); - -- cpu_function_call(cpu, -- (remote_function_f)perf_mux_hrtimer_restart, cpuctx); -+ cpu_function_call(cpu, perf_mux_hrtimer_restart_ipi, cpuctx); - } - cpus_read_unlock(); - mutex_unlock(&mux_interval_mutex); -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 8e3c76dcc0ffe..412505d948651 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -1100,7 +1100,7 @@ struct ftrace_page { - struct ftrace_page *next; - struct dyn_ftrace *records; - int index; -- int size; -+ int order; - }; - - #define ENTRY_SIZE sizeof(struct dyn_ftrace) -@@ -2899,6 +2899,8 @@ static void ftrace_shutdown_sysctl(void) - - static u64 ftrace_update_time; - unsigned long ftrace_update_tot_cnt; -+unsigned long ftrace_number_of_pages; -+unsigned long ftrace_number_of_groups; - - static inline int ops_traces_mod(struct ftrace_ops *ops) - { -@@ -3023,8 +3025,11 @@ static int ftrace_allocate_records(struct ftrace_page *pg, int count) - goto again; - } - -+ ftrace_number_of_pages += 1 << order; -+ ftrace_number_of_groups++; -+ - cnt = (PAGE_SIZE << order) / ENTRY_SIZE; -- pg->size = cnt; -+ pg->order = order; - - if (cnt > count) - cnt = count; -@@ -3032,12 +3037,27 @@ static int ftrace_allocate_records(struct ftrace_page *pg, int count) - return cnt; - } - -+static void ftrace_free_pages(struct ftrace_page *pages) -+{ -+ struct ftrace_page *pg = pages; -+ -+ while (pg) { -+ if (pg->records) { -+ free_pages((unsigned long)pg->records, pg->order); -+ ftrace_number_of_pages -= 1 << pg->order; -+ } -+ pages = pg->next; -+ kfree(pg); -+ pg = pages; -+ ftrace_number_of_groups--; -+ } -+} -+ - static struct ftrace_page * - ftrace_allocate_pages(unsigned long num_to_init) - { - struct ftrace_page *start_pg; - struct ftrace_page *pg; -- int order; - int cnt; - - if (!num_to_init) -@@ -3071,14 +3091,7 @@ ftrace_allocate_pages(unsigned long num_to_init) - return start_pg; - - free_pages: -- pg = start_pg; -- while (pg) { -- order = get_count_order(pg->size / ENTRIES_PER_PAGE); -- free_pages((unsigned long)pg->records, order); -- start_pg = pg->next; -- kfree(pg); -- pg = start_pg; -- } -+ ftrace_free_pages(start_pg); - pr_info("ftrace: FAILED to allocate memory for functions\n"); - return NULL; - } -@@ -5620,9 +5633,11 @@ static int ftrace_process_locs(struct module *mod, - unsigned long *start, - unsigned long *end) - { -+ struct ftrace_page *pg_unuse = NULL; - struct ftrace_page *start_pg; - struct ftrace_page *pg; - struct dyn_ftrace *rec; -+ unsigned long skipped = 0; - unsigned long count; - unsigned long *p; - unsigned long addr; -@@ -5668,6 +5683,7 @@ static int ftrace_process_locs(struct module *mod, - p = start; - pg = start_pg; - while (p < end) { -+ unsigned long end_offset; - addr = ftrace_call_adjust(*p++); - /* - * Some architecture linkers will pad between -@@ -5675,10 +5691,13 @@ static int ftrace_process_locs(struct module *mod, - * object files to satisfy alignments. - * Skip any NULL pointers. - */ -- if (!addr) -+ if (!addr) { -+ skipped++; - continue; -+ } - -- if (pg->index == pg->size) { -+ end_offset = (pg->index+1) * sizeof(pg->records[0]); -+ if (end_offset > PAGE_SIZE << pg->order) { - /* We should have allocated enough */ - if (WARN_ON(!pg->next)) - break; -@@ -5689,8 +5708,10 @@ static int ftrace_process_locs(struct module *mod, - rec->ip = addr; - } - -- /* We should have used all pages */ -- WARN_ON(pg->next); -+ if (pg->next) { -+ pg_unuse = pg->next; -+ pg->next = NULL; -+ } - - /* Assign the last page to ftrace_pages */ - ftrace_pages = pg; -@@ -5712,6 +5733,11 @@ static int ftrace_process_locs(struct module *mod, - out: - mutex_unlock(&ftrace_lock); - -+ /* We should have used all pages unless we skipped some */ -+ if (pg_unuse) { -+ WARN_ON(!skipped); -+ ftrace_free_pages(pg_unuse); -+ } - return ret; - } - -@@ -5818,7 +5844,6 @@ void ftrace_release_mod(struct module *mod) - struct ftrace_page **last_pg; - struct ftrace_page *tmp_page = NULL; - struct ftrace_page *pg; -- int order; - - mutex_lock(&ftrace_lock); - -@@ -5869,10 +5894,13 @@ void ftrace_release_mod(struct module *mod) - /* Needs to be called outside of ftrace_lock */ - clear_mod_from_hashes(pg); - -- order = get_count_order(pg->size / ENTRIES_PER_PAGE); -- free_pages((unsigned long)pg->records, order); -+ if (pg->records) { -+ free_pages((unsigned long)pg->records, pg->order); -+ ftrace_number_of_pages -= 1 << pg->order; -+ } - tmp_page = pg->next; - kfree(pg); -+ ftrace_number_of_groups--; - } - } - -@@ -6174,7 +6202,6 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr) - struct ftrace_mod_map *mod_map = NULL; - struct ftrace_init_func *func, *func_next; - struct list_head clear_hash; -- int order; - - INIT_LIST_HEAD(&clear_hash); - -@@ -6212,8 +6239,11 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr) - ftrace_update_tot_cnt--; - if (!pg->index) { - *last_pg = pg->next; -- order = get_count_order(pg->size / ENTRIES_PER_PAGE); -- free_pages((unsigned long)pg->records, order); -+ if (pg->records) { -+ free_pages((unsigned long)pg->records, pg->order); -+ ftrace_number_of_pages -= 1 << pg->order; -+ } -+ ftrace_number_of_groups--; - kfree(pg); - pg = container_of(last_pg, struct ftrace_page, next); - if (!(*last_pg)) -@@ -6269,6 +6299,9 @@ void __init ftrace_init(void) - __start_mcount_loc, - __stop_mcount_loc); - -+ pr_info("ftrace: allocated %ld pages with %ld groups\n", -+ ftrace_number_of_pages, ftrace_number_of_groups); -+ - set_ftrace_early_filters(); - - return; -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index afd7f3a51485e..445475c229b3a 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -485,6 +485,8 @@ struct ring_buffer_per_cpu { - unsigned long read_bytes; - u64 write_stamp; - u64 read_stamp; -+ /* pages removed since last reset */ -+ unsigned long pages_removed; - /* ring buffer pages to update, > 0 to add, < 0 to remove */ - long nr_pages_to_update; - struct list_head new_pages; /* new pages to add */ -@@ -520,6 +522,7 @@ struct ring_buffer_iter { - struct buffer_page *head_page; - struct buffer_page *cache_reader_page; - unsigned long cache_read; -+ unsigned long cache_pages_removed; - u64 read_stamp; - }; - -@@ -1581,6 +1584,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) - to_remove = rb_list_head(to_remove)->next; - head_bit |= (unsigned long)to_remove & RB_PAGE_HEAD; - } -+ /* Read iterators need to reset themselves when some pages removed */ -+ cpu_buffer->pages_removed += nr_removed; - - next_page = rb_list_head(to_remove)->next; - -@@ -1602,12 +1607,6 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) - cpu_buffer->head_page = list_entry(next_page, - struct buffer_page, list); - -- /* -- * change read pointer to make sure any read iterators reset -- * themselves -- */ -- cpu_buffer->read = 0; -- - /* pages are removed, resume tracing and then free the pages */ - atomic_dec(&cpu_buffer->record_disabled); - raw_spin_unlock_irq(&cpu_buffer->reader_lock); -@@ -3659,6 +3658,7 @@ static void rb_iter_reset(struct ring_buffer_iter *iter) - - iter->cache_reader_page = iter->head_page; - iter->cache_read = cpu_buffer->read; -+ iter->cache_pages_removed = cpu_buffer->pages_removed; - - if (iter->head) - iter->read_stamp = cpu_buffer->read_stamp; -@@ -4101,12 +4101,13 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts) - buffer = cpu_buffer->buffer; - - /* -- * Check if someone performed a consuming read to -- * the buffer. A consuming read invalidates the iterator -- * and we need to reset the iterator in this case. -+ * Check if someone performed a consuming read to the buffer -+ * or removed some pages from the buffer. In these cases, -+ * iterator was invalidated and we need to reset it. - */ - if (unlikely(iter->cache_read != cpu_buffer->read || -- iter->cache_reader_page != cpu_buffer->reader_page)) -+ iter->cache_reader_page != cpu_buffer->reader_page || -+ iter->cache_pages_removed != cpu_buffer->pages_removed)) - rb_iter_reset(iter); - - again: -@@ -4538,6 +4539,7 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) - cpu_buffer->last_overrun = 0; - - rb_head_page_activate(cpu_buffer); -+ cpu_buffer->pages_removed = 0; - } - - /** -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 7f7c700a61560..8006592803e1c 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -7662,14 +7662,23 @@ static ssize_t - tracing_read_dyn_info(struct file *filp, char __user *ubuf, - size_t cnt, loff_t *ppos) - { -- unsigned long *p = filp->private_data; -- char buf[64]; /* Not too big for a shallow stack */ -+ ssize_t ret; -+ char *buf; - int r; - -- r = scnprintf(buf, 63, "%ld", *p); -- buf[r++] = '\n'; -+ /* 256 should be plenty to hold the amount needed */ -+ buf = kmalloc(256, GFP_KERNEL); -+ if (!buf) -+ return -ENOMEM; - -- return simple_read_from_buffer(ubuf, cnt, ppos, buf, r); -+ r = scnprintf(buf, 256, "%ld pages:%ld groups: %ld\n", -+ ftrace_update_tot_cnt, -+ ftrace_number_of_pages, -+ ftrace_number_of_groups); -+ -+ ret = simple_read_from_buffer(ubuf, cnt, ppos, buf, r); -+ kfree(buf); -+ return ret; - } - - static const struct file_operations tracing_dyn_info_fops = { -@@ -8889,7 +8898,7 @@ static __init int tracer_init_tracefs(void) - - #ifdef CONFIG_DYNAMIC_FTRACE - trace_create_file("dyn_ftrace_total_info", 0444, d_tracer, -- &ftrace_update_tot_cnt, &tracing_dyn_info_fops); -+ NULL, &tracing_dyn_info_fops); - #endif - - create_trace_instances(d_tracer); -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index edc17a640ab34..21f85c0bd66ec 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -801,6 +801,8 @@ extern void trace_event_follow_fork(struct trace_array *tr, bool enable); - - #ifdef CONFIG_DYNAMIC_FTRACE - extern unsigned long ftrace_update_tot_cnt; -+extern unsigned long ftrace_number_of_pages; -+extern unsigned long ftrace_number_of_groups; - void ftrace_init_trace_array(struct trace_array *tr); - #else - static inline void ftrace_init_trace_array(struct trace_array *tr) { } -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index a0675ecc8142e..0c21da12b650c 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -365,7 +365,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, - { - struct trace_event_call *call = file->event_call; - struct trace_array *tr = file->tr; -- unsigned long file_flags = file->flags; - int ret = 0; - int disable; - -@@ -389,6 +388,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, - break; - disable = file->flags & EVENT_FILE_FL_SOFT_DISABLED; - clear_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); -+ /* Disable use of trace_buffered_event */ -+ trace_buffered_event_disable(); - } else - disable = !(file->flags & EVENT_FILE_FL_SOFT_MODE); - -@@ -427,6 +428,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, - if (atomic_inc_return(&file->sm_ref) > 1) - break; - set_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); -+ /* Enable use of trace_buffered_event */ -+ trace_buffered_event_enable(); - } - - if (!(file->flags & EVENT_FILE_FL_ENABLED)) { -@@ -466,15 +469,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, - break; - } - -- /* Enable or disable use of trace_buffered_event */ -- if ((file_flags & EVENT_FILE_FL_SOFT_DISABLED) != -- (file->flags & EVENT_FILE_FL_SOFT_DISABLED)) { -- if (file->flags & EVENT_FILE_FL_SOFT_DISABLED) -- trace_buffered_event_enable(); -- else -- trace_buffered_event_disable(); -- } -- - return ret; - } - -diff --git a/lib/test_firmware.c b/lib/test_firmware.c -index 38553944e9675..dd3850ec1dfa1 100644 ---- a/lib/test_firmware.c -+++ b/lib/test_firmware.c -@@ -173,7 +173,7 @@ static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp) - { - *dst = kstrndup(name, count, gfp); - if (!*dst) -- return -ENOSPC; -+ return -ENOMEM; - return count; - } - -@@ -301,16 +301,26 @@ static ssize_t config_test_show_str(char *dst, - return len; - } - --static int test_dev_config_update_bool(const char *buf, size_t size, -- bool *cfg) -+static inline int __test_dev_config_update_bool(const char *buf, size_t size, -+ bool *cfg) - { - int ret; - -- mutex_lock(&test_fw_mutex); - if (strtobool(buf, cfg) < 0) - ret = -EINVAL; - else - ret = size; -+ -+ return ret; -+} -+ -+static int test_dev_config_update_bool(const char *buf, size_t size, -+ bool *cfg) -+{ -+ int ret; -+ -+ mutex_lock(&test_fw_mutex); -+ ret = __test_dev_config_update_bool(buf, size, cfg); - mutex_unlock(&test_fw_mutex); - - return ret; -@@ -340,7 +350,7 @@ static ssize_t test_dev_config_show_int(char *buf, int cfg) - return snprintf(buf, PAGE_SIZE, "%d\n", val); - } - --static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) -+static inline int __test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) - { - int ret; - long new; -@@ -352,14 +362,23 @@ static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) - if (new > U8_MAX) - return -EINVAL; - -- mutex_lock(&test_fw_mutex); - *(u8 *)cfg = new; -- mutex_unlock(&test_fw_mutex); - - /* Always return full write size even if we didn't consume all */ - return size; - } - -+static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) -+{ -+ int ret; -+ -+ mutex_lock(&test_fw_mutex); -+ ret = __test_dev_config_update_u8(buf, size, cfg); -+ mutex_unlock(&test_fw_mutex); -+ -+ return ret; -+} -+ - static ssize_t test_dev_config_show_u8(char *buf, u8 cfg) - { - u8 val; -@@ -392,10 +411,10 @@ static ssize_t config_num_requests_store(struct device *dev, - mutex_unlock(&test_fw_mutex); - goto out; - } -- mutex_unlock(&test_fw_mutex); - -- rc = test_dev_config_update_u8(buf, count, -- &test_fw_config->num_requests); -+ rc = __test_dev_config_update_u8(buf, count, -+ &test_fw_config->num_requests); -+ mutex_unlock(&test_fw_mutex); - - out: - return rc; -@@ -490,7 +509,7 @@ static ssize_t trigger_request_store(struct device *dev, - - name = kstrndup(buf, count, GFP_KERNEL); - if (!name) -- return -ENOSPC; -+ return -ENOMEM; - - pr_info("loading '%s'\n", name); - -@@ -533,7 +552,7 @@ static ssize_t trigger_async_request_store(struct device *dev, - - name = kstrndup(buf, count, GFP_KERNEL); - if (!name) -- return -ENOSPC; -+ return -ENOMEM; - - pr_info("loading '%s'\n", name); - -@@ -578,7 +597,7 @@ static ssize_t trigger_custom_fallback_store(struct device *dev, - - name = kstrndup(buf, count, GFP_KERNEL); - if (!name) -- return -ENOSPC; -+ return -ENOMEM; - - pr_info("loading '%s' using custom fallback mechanism\n", name); - -@@ -629,7 +648,7 @@ static int test_fw_run_batch_request(void *data) - - test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL); - if (!test_buf) -- return -ENOSPC; -+ return -ENOMEM; - - req->rc = request_firmware_into_buf(&req->fw, - req->name, -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index 0fa5ced767a24..712bffa4e8b47 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -45,6 +45,7 @@ static const struct proto_ops l2cap_sock_ops; - static void l2cap_sock_init(struct sock *sk, struct sock *parent); - static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, - int proto, gfp_t prio, int kern); -+static void l2cap_sock_cleanup_listen(struct sock *parent); - - bool l2cap_is_socket(struct socket *sock) - { -@@ -1224,6 +1225,7 @@ static int l2cap_sock_release(struct socket *sock) - if (!sk) - return 0; - -+ l2cap_sock_cleanup_listen(sk); - bt_sock_unlink(&l2cap_sk_list, sk); - - err = l2cap_sock_shutdown(sock, 2); -diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c -index a8481da37f1ad..7412bcc94d1d9 100644 ---- a/net/ceph/osd_client.c -+++ b/net/ceph/osd_client.c -@@ -3249,17 +3249,24 @@ static int linger_reg_commit_wait(struct ceph_osd_linger_request *lreq) - int ret; - - dout("%s lreq %p linger_id %llu\n", __func__, lreq, lreq->linger_id); -- ret = wait_for_completion_interruptible(&lreq->reg_commit_wait); -+ ret = wait_for_completion_killable(&lreq->reg_commit_wait); - return ret ?: lreq->reg_commit_error; - } - --static int linger_notify_finish_wait(struct ceph_osd_linger_request *lreq) -+static int linger_notify_finish_wait(struct ceph_osd_linger_request *lreq, -+ unsigned long timeout) - { -- int ret; -+ long left; - - dout("%s lreq %p linger_id %llu\n", __func__, lreq, lreq->linger_id); -- ret = wait_for_completion_interruptible(&lreq->notify_finish_wait); -- return ret ?: lreq->notify_finish_error; -+ left = wait_for_completion_killable_timeout(&lreq->notify_finish_wait, -+ ceph_timeout_jiffies(timeout)); -+ if (left <= 0) -+ left = left ?: -ETIMEDOUT; -+ else -+ left = lreq->notify_finish_error; /* completed */ -+ -+ return left; - } - - /* -@@ -4875,7 +4882,8 @@ int ceph_osdc_notify(struct ceph_osd_client *osdc, - linger_submit(lreq); - ret = linger_reg_commit_wait(lreq); - if (!ret) -- ret = linger_notify_finish_wait(lreq); -+ ret = linger_notify_finish_wait(lreq, -+ msecs_to_jiffies(2 * timeout * MSEC_PER_SEC)); - else - dout("lreq %p failed to initiate notify %d\n", lreq, ret); - -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 1db92a44548f0..3eaf7c706b0ec 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -4590,13 +4590,17 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, - br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC); - if (br_spec) { - nla_for_each_nested(attr, br_spec, rem) { -- if (nla_type(attr) == IFLA_BRIDGE_FLAGS) { -+ if (nla_type(attr) == IFLA_BRIDGE_FLAGS && !have_flags) { - if (nla_len(attr) < sizeof(flags)) - return -EINVAL; - - have_flags = true; - flags = nla_get_u16(attr); -- break; -+ } -+ -+ if (nla_type(attr) == IFLA_BRIDGE_MODE) { -+ if (nla_len(attr) < sizeof(u16)) -+ return -EINVAL; - } - } - } -diff --git a/net/core/sock.c b/net/core/sock.c -index d55eea5538bce..636427d400d7f 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -1117,7 +1117,8 @@ set_rcvbuf: - cmpxchg(&sk->sk_pacing_status, - SK_PACING_NONE, - SK_PACING_NEEDED); -- sk->sk_max_pacing_rate = ulval; -+ /* Pairs with READ_ONCE() from sk_getsockopt() */ -+ WRITE_ONCE(sk->sk_max_pacing_rate, ulval); - sk->sk_pacing_rate = min(sk->sk_pacing_rate, ulval); - break; - } -@@ -1257,11 +1258,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname, - break; - - case SO_SNDBUF: -- v.val = sk->sk_sndbuf; -+ v.val = READ_ONCE(sk->sk_sndbuf); - break; - - case SO_RCVBUF: -- v.val = sk->sk_rcvbuf; -+ v.val = READ_ONCE(sk->sk_rcvbuf); - break; - - case SO_REUSEADDR: -@@ -1349,7 +1350,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, - break; - - case SO_RCVLOWAT: -- v.val = sk->sk_rcvlowat; -+ v.val = READ_ONCE(sk->sk_rcvlowat); - break; - - case SO_SNDLOWAT: -@@ -1443,7 +1444,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, - if (!sock->ops->set_peek_off) - return -EOPNOTSUPP; - -- v.val = sk->sk_peek_off; -+ v.val = READ_ONCE(sk->sk_peek_off); - break; - case SO_NOFCS: - v.val = sock_flag(sk, SOCK_NOFCS); -@@ -1473,17 +1474,19 @@ int sock_getsockopt(struct socket *sock, int level, int optname, - - #ifdef CONFIG_NET_RX_BUSY_POLL - case SO_BUSY_POLL: -- v.val = sk->sk_ll_usec; -+ v.val = READ_ONCE(sk->sk_ll_usec); - break; - #endif - - case SO_MAX_PACING_RATE: -+ /* The READ_ONCE() pair with the WRITE_ONCE() in sk_setsockopt() */ - if (sizeof(v.ulval) != sizeof(v.val) && len >= sizeof(v.ulval)) { - lv = sizeof(v.ulval); -- v.ulval = sk->sk_max_pacing_rate; -+ v.ulval = READ_ONCE(sk->sk_max_pacing_rate); - } else { - /* 32bit version */ -- v.val = min_t(unsigned long, sk->sk_max_pacing_rate, ~0U); -+ v.val = min_t(unsigned long, ~0U, -+ READ_ONCE(sk->sk_max_pacing_rate)); - } - break; - -@@ -2649,7 +2652,7 @@ EXPORT_SYMBOL(__sk_mem_reclaim); - - int sk_set_peek_off(struct sock *sk, int val) - { -- sk->sk_peek_off = val; -+ WRITE_ONCE(sk->sk_peek_off, val); - return 0; - } - EXPORT_SYMBOL_GPL(sk_set_peek_off); -diff --git a/net/core/sock_map.c b/net/core/sock_map.c -index 5bce6d4d20573..5b82ff0e2680f 100644 ---- a/net/core/sock_map.c -+++ b/net/core/sock_map.c -@@ -115,7 +115,6 @@ static void sock_map_sk_acquire(struct sock *sk) - __acquires(&sk->sk_lock.slock) - { - lock_sock(sk); -- preempt_disable(); - rcu_read_lock(); - } - -@@ -123,7 +122,6 @@ static void sock_map_sk_release(struct sock *sk) - __releases(&sk->sk_lock.slock) - { - rcu_read_unlock(); -- preempt_enable(); - release_sock(sk); - } - -diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c -index b53d5e1d026fe..71e97e2a36845 100644 ---- a/net/dcb/dcbnl.c -+++ b/net/dcb/dcbnl.c -@@ -946,7 +946,7 @@ static int dcbnl_bcn_setcfg(struct net_device *netdev, struct nlmsghdr *nlh, - return -EOPNOTSUPP; - - ret = nla_parse_nested_deprecated(data, DCB_BCN_ATTR_MAX, -- tb[DCB_ATTR_BCN], dcbnl_pfc_up_nest, -+ tb[DCB_ATTR_BCN], dcbnl_bcn_nest, - NULL); - if (ret) - return ret; -diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c -index 0af6249a993af..e89e19a6852ce 100644 ---- a/net/ipv4/tcp_metrics.c -+++ b/net/ipv4/tcp_metrics.c -@@ -40,7 +40,7 @@ struct tcp_fastopen_metrics { - - struct tcp_metrics_block { - struct tcp_metrics_block __rcu *tcpm_next; -- possible_net_t tcpm_net; -+ struct net *tcpm_net; - struct inetpeer_addr tcpm_saddr; - struct inetpeer_addr tcpm_daddr; - unsigned long tcpm_stamp; -@@ -51,34 +51,38 @@ struct tcp_metrics_block { - struct rcu_head rcu_head; - }; - --static inline struct net *tm_net(struct tcp_metrics_block *tm) -+static inline struct net *tm_net(const struct tcp_metrics_block *tm) - { -- return read_pnet(&tm->tcpm_net); -+ /* Paired with the WRITE_ONCE() in tcpm_new() */ -+ return READ_ONCE(tm->tcpm_net); - } - - static bool tcp_metric_locked(struct tcp_metrics_block *tm, - enum tcp_metric_index idx) - { -- return tm->tcpm_lock & (1 << idx); -+ /* Paired with WRITE_ONCE() in tcpm_suck_dst() */ -+ return READ_ONCE(tm->tcpm_lock) & (1 << idx); - } - --static u32 tcp_metric_get(struct tcp_metrics_block *tm, -+static u32 tcp_metric_get(const struct tcp_metrics_block *tm, - enum tcp_metric_index idx) - { -- return tm->tcpm_vals[idx]; -+ /* Paired with WRITE_ONCE() in tcp_metric_set() */ -+ return READ_ONCE(tm->tcpm_vals[idx]); - } - - static void tcp_metric_set(struct tcp_metrics_block *tm, - enum tcp_metric_index idx, - u32 val) - { -- tm->tcpm_vals[idx] = val; -+ /* Paired with READ_ONCE() in tcp_metric_get() */ -+ WRITE_ONCE(tm->tcpm_vals[idx], val); - } - - static bool addr_same(const struct inetpeer_addr *a, - const struct inetpeer_addr *b) - { -- return inetpeer_addr_cmp(a, b) == 0; -+ return (a->family == b->family) && !inetpeer_addr_cmp(a, b); - } - - struct tcpm_hash_bucket { -@@ -89,6 +93,7 @@ static struct tcpm_hash_bucket *tcp_metrics_hash __read_mostly; - static unsigned int tcp_metrics_hash_log __read_mostly; - - static DEFINE_SPINLOCK(tcp_metrics_lock); -+static DEFINE_SEQLOCK(fastopen_seqlock); - - static void tcpm_suck_dst(struct tcp_metrics_block *tm, - const struct dst_entry *dst, -@@ -97,7 +102,7 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm, - u32 msval; - u32 val; - -- tm->tcpm_stamp = jiffies; -+ WRITE_ONCE(tm->tcpm_stamp, jiffies); - - val = 0; - if (dst_metric_locked(dst, RTAX_RTT)) -@@ -110,30 +115,42 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm, - val |= 1 << TCP_METRIC_CWND; - if (dst_metric_locked(dst, RTAX_REORDERING)) - val |= 1 << TCP_METRIC_REORDERING; -- tm->tcpm_lock = val; -+ /* Paired with READ_ONCE() in tcp_metric_locked() */ -+ WRITE_ONCE(tm->tcpm_lock, val); - - msval = dst_metric_raw(dst, RTAX_RTT); -- tm->tcpm_vals[TCP_METRIC_RTT] = msval * USEC_PER_MSEC; -+ tcp_metric_set(tm, TCP_METRIC_RTT, msval * USEC_PER_MSEC); - - msval = dst_metric_raw(dst, RTAX_RTTVAR); -- tm->tcpm_vals[TCP_METRIC_RTTVAR] = msval * USEC_PER_MSEC; -- tm->tcpm_vals[TCP_METRIC_SSTHRESH] = dst_metric_raw(dst, RTAX_SSTHRESH); -- tm->tcpm_vals[TCP_METRIC_CWND] = dst_metric_raw(dst, RTAX_CWND); -- tm->tcpm_vals[TCP_METRIC_REORDERING] = dst_metric_raw(dst, RTAX_REORDERING); -+ tcp_metric_set(tm, TCP_METRIC_RTTVAR, msval * USEC_PER_MSEC); -+ tcp_metric_set(tm, TCP_METRIC_SSTHRESH, -+ dst_metric_raw(dst, RTAX_SSTHRESH)); -+ tcp_metric_set(tm, TCP_METRIC_CWND, -+ dst_metric_raw(dst, RTAX_CWND)); -+ tcp_metric_set(tm, TCP_METRIC_REORDERING, -+ dst_metric_raw(dst, RTAX_REORDERING)); - if (fastopen_clear) { -+ write_seqlock(&fastopen_seqlock); - tm->tcpm_fastopen.mss = 0; - tm->tcpm_fastopen.syn_loss = 0; - tm->tcpm_fastopen.try_exp = 0; - tm->tcpm_fastopen.cookie.exp = false; - tm->tcpm_fastopen.cookie.len = 0; -+ write_sequnlock(&fastopen_seqlock); - } - } - - #define TCP_METRICS_TIMEOUT (60 * 60 * HZ) - --static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst) -+static void tcpm_check_stamp(struct tcp_metrics_block *tm, -+ const struct dst_entry *dst) - { -- if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT))) -+ unsigned long limit; -+ -+ if (!tm) -+ return; -+ limit = READ_ONCE(tm->tcpm_stamp) + TCP_METRICS_TIMEOUT; -+ if (unlikely(time_after(jiffies, limit))) - tcpm_suck_dst(tm, dst, false); - } - -@@ -174,20 +191,23 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst, - oldest = deref_locked(tcp_metrics_hash[hash].chain); - for (tm = deref_locked(oldest->tcpm_next); tm; - tm = deref_locked(tm->tcpm_next)) { -- if (time_before(tm->tcpm_stamp, oldest->tcpm_stamp)) -+ if (time_before(READ_ONCE(tm->tcpm_stamp), -+ READ_ONCE(oldest->tcpm_stamp))) - oldest = tm; - } - tm = oldest; - } else { -- tm = kmalloc(sizeof(*tm), GFP_ATOMIC); -+ tm = kzalloc(sizeof(*tm), GFP_ATOMIC); - if (!tm) - goto out_unlock; - } -- write_pnet(&tm->tcpm_net, net); -+ /* Paired with the READ_ONCE() in tm_net() */ -+ WRITE_ONCE(tm->tcpm_net, net); -+ - tm->tcpm_saddr = *saddr; - tm->tcpm_daddr = *daddr; - -- tcpm_suck_dst(tm, dst, true); -+ tcpm_suck_dst(tm, dst, reclaim); - - if (likely(!reclaim)) { - tm->tcpm_next = tcp_metrics_hash[hash].chain; -@@ -431,7 +451,7 @@ void tcp_update_metrics(struct sock *sk) - tp->reordering); - } - } -- tm->tcpm_stamp = jiffies; -+ WRITE_ONCE(tm->tcpm_stamp, jiffies); - out_unlock: - rcu_read_unlock(); - } -@@ -534,8 +554,6 @@ bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst) - return ret; - } - --static DEFINE_SEQLOCK(fastopen_seqlock); -- - void tcp_fastopen_cache_get(struct sock *sk, u16 *mss, - struct tcp_fastopen_cookie *cookie) - { -@@ -642,7 +660,7 @@ static int tcp_metrics_fill_info(struct sk_buff *msg, - } - - if (nla_put_msecs(msg, TCP_METRICS_ATTR_AGE, -- jiffies - tm->tcpm_stamp, -+ jiffies - READ_ONCE(tm->tcpm_stamp), - TCP_METRICS_ATTR_PAD) < 0) - goto nla_put_failure; - -@@ -653,7 +671,7 @@ static int tcp_metrics_fill_info(struct sk_buff *msg, - if (!nest) - goto nla_put_failure; - for (i = 0; i < TCP_METRIC_MAX_KERNEL + 1; i++) { -- u32 val = tm->tcpm_vals[i]; -+ u32 val = tcp_metric_get(tm, i); - - if (!val) - continue; -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 46e3c939958bb..a4c3cb72bdc6a 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -2541,12 +2541,18 @@ static void manage_tempaddrs(struct inet6_dev *idev, - ipv6_ifa_notify(0, ift); - } - -- if ((create || list_empty(&idev->tempaddr_list)) && -- idev->cnf.use_tempaddr > 0) { -+ /* Also create a temporary address if it's enabled but no temporary -+ * address currently exists. -+ * However, we get called with valid_lft == 0, prefered_lft == 0, create == false -+ * as part of cleanup (ie. deleting the mngtmpaddr). -+ * We don't want that to result in creating a new temporary ip address. -+ */ -+ if (list_empty(&idev->tempaddr_list) && (valid_lft || prefered_lft)) -+ create = true; -+ -+ if (create && idev->cnf.use_tempaddr > 0) { - /* When a new public address is created as described - * in [ADDRCONF], also create a new temporary address. -- * Also create a temporary address if it's enabled but -- * no temporary address currently exists. - */ - read_unlock_bh(&idev->lock); - ipv6_create_tempaddr(ifp, NULL, false); -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index 6248e00c2bf72..6642bc7b9870f 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -1065,7 +1065,7 @@ static int ip6mr_cache_report(struct mr_table *mrt, struct sk_buff *pkt, - And all this only to mangle msg->im6_msgtype and - to set msg->im6_mbz to "mbz" :-) - */ -- skb_push(skb, -skb_network_offset(pkt)); -+ __skb_pull(skb, skb_network_offset(pkt)); - - skb_push(skb, sizeof(*msg)); - skb_reset_transport_header(skb); -diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c -index 41f0898a5a565..08c41f1976c47 100644 ---- a/net/sched/cls_fw.c -+++ b/net/sched/cls_fw.c -@@ -266,7 +266,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb, - return -ENOBUFS; - - fnew->id = f->id; -- fnew->res = f->res; - fnew->ifindex = f->ifindex; - fnew->tp = f->tp; - -diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c -index b775e681cb56e..1ad4b3e60eb3b 100644 ---- a/net/sched/cls_route.c -+++ b/net/sched/cls_route.c -@@ -511,7 +511,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, - if (fold) { - f->id = fold->id; - f->iif = fold->iif; -- f->res = fold->res; - f->handle = fold->handle; - - f->tp = fold->tp; -diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c -index e5cc2b4d38d5a..65598207a2fcb 100644 ---- a/net/sched/cls_u32.c -+++ b/net/sched/cls_u32.c -@@ -814,7 +814,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, - - new->ifindex = n->ifindex; - new->fshift = n->fshift; -- new->res = n->res; - new->flags = n->flags; - RCU_INIT_POINTER(new->ht_down, ht); - -@@ -1004,18 +1003,62 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, - return -EINVAL; - } - -+ /* At this point, we need to derive the new handle that will be used to -+ * uniquely map the identity of this table match entry. The -+ * identity of the entry that we need to construct is 32 bits made of: -+ * htid(12b):bucketid(8b):node/entryid(12b) -+ * -+ * At this point _we have the table(ht)_ in which we will insert this -+ * entry. We carry the table's id in variable "htid". -+ * Note that earlier code picked the ht selection either by a) the user -+ * providing the htid specified via TCA_U32_HASH attribute or b) when -+ * no such attribute is passed then the root ht, is default to at ID -+ * 0x[800][00][000]. Rule: the root table has a single bucket with ID 0. -+ * If OTOH the user passed us the htid, they may also pass a bucketid of -+ * choice. 0 is fine. For example a user htid is 0x[600][01][000] it is -+ * indicating hash bucketid of 1. Rule: the entry/node ID _cannot_ be -+ * passed via the htid, so even if it was non-zero it will be ignored. -+ * -+ * We may also have a handle, if the user passed one. The handle also -+ * carries the same addressing of htid(12b):bucketid(8b):node/entryid(12b). -+ * Rule: the bucketid on the handle is ignored even if one was passed; -+ * rather the value on "htid" is always assumed to be the bucketid. -+ */ - if (handle) { -+ /* Rule: The htid from handle and tableid from htid must match */ - if (TC_U32_HTID(handle) && TC_U32_HTID(handle ^ htid)) { - NL_SET_ERR_MSG_MOD(extack, "Handle specified hash table address mismatch"); - return -EINVAL; - } -- handle = htid | TC_U32_NODE(handle); -- err = idr_alloc_u32(&ht->handle_idr, NULL, &handle, handle, -- GFP_KERNEL); -- if (err) -- return err; -- } else -+ /* Ok, so far we have a valid htid(12b):bucketid(8b) but we -+ * need to finalize the table entry identification with the last -+ * part - the node/entryid(12b)). Rule: Nodeid _cannot be 0_ for -+ * entries. Rule: nodeid of 0 is reserved only for tables(see -+ * earlier code which processes TC_U32_DIVISOR attribute). -+ * Rule: The nodeid can only be derived from the handle (and not -+ * htid). -+ * Rule: if the handle specified zero for the node id example -+ * 0x60000000, then pick a new nodeid from the pool of IDs -+ * this hash table has been allocating from. -+ * If OTOH it is specified (i.e for example the user passed a -+ * handle such as 0x60000123), then we use it generate our final -+ * handle which is used to uniquely identify the match entry. -+ */ -+ if (!TC_U32_NODE(handle)) { -+ handle = gen_new_kid(ht, htid); -+ } else { -+ handle = htid | TC_U32_NODE(handle); -+ err = idr_alloc_u32(&ht->handle_idr, NULL, &handle, -+ handle, GFP_KERNEL); -+ if (err) -+ return err; -+ } -+ } else { -+ /* The user did not give us a handle; lets just generate one -+ * from the table's pool of nodeids. -+ */ - handle = gen_new_kid(ht, htid); -+ } - - if (tb[TCA_U32_SEL] == NULL) { - NL_SET_ERR_MSG_MOD(extack, "Selector not specified"); -diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c -index 50e15add6068f..56d3dc5e95c7c 100644 ---- a/net/sched/sch_mqprio.c -+++ b/net/sched/sch_mqprio.c -@@ -130,6 +130,97 @@ static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla, - return 0; - } - -+static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, -+ struct nlattr *opt, -+ struct netlink_ext_ack *extack) -+{ -+ struct mqprio_sched *priv = qdisc_priv(sch); -+ struct nlattr *tb[TCA_MQPRIO_MAX + 1]; -+ struct nlattr *attr; -+ int i, rem, err; -+ -+ err = parse_attr(tb, TCA_MQPRIO_MAX, opt, mqprio_policy, -+ sizeof(*qopt)); -+ if (err < 0) -+ return err; -+ -+ if (!qopt->hw) { -+ NL_SET_ERR_MSG(extack, -+ "mqprio TCA_OPTIONS can only contain netlink attributes in hardware mode"); -+ return -EINVAL; -+ } -+ -+ if (tb[TCA_MQPRIO_MODE]) { -+ priv->flags |= TC_MQPRIO_F_MODE; -+ priv->mode = *(u16 *)nla_data(tb[TCA_MQPRIO_MODE]); -+ } -+ -+ if (tb[TCA_MQPRIO_SHAPER]) { -+ priv->flags |= TC_MQPRIO_F_SHAPER; -+ priv->shaper = *(u16 *)nla_data(tb[TCA_MQPRIO_SHAPER]); -+ } -+ -+ if (tb[TCA_MQPRIO_MIN_RATE64]) { -+ if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) { -+ NL_SET_ERR_MSG_ATTR(extack, tb[TCA_MQPRIO_MIN_RATE64], -+ "min_rate accepted only when shaper is in bw_rlimit mode"); -+ return -EINVAL; -+ } -+ i = 0; -+ nla_for_each_nested(attr, tb[TCA_MQPRIO_MIN_RATE64], -+ rem) { -+ if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64) { -+ NL_SET_ERR_MSG_ATTR(extack, attr, -+ "Attribute type expected to be TCA_MQPRIO_MIN_RATE64"); -+ return -EINVAL; -+ } -+ -+ if (nla_len(attr) != sizeof(u64)) { -+ NL_SET_ERR_MSG_ATTR(extack, attr, -+ "Attribute TCA_MQPRIO_MIN_RATE64 expected to have 8 bytes length"); -+ return -EINVAL; -+ } -+ -+ if (i >= qopt->num_tc) -+ break; -+ priv->min_rate[i] = *(u64 *)nla_data(attr); -+ i++; -+ } -+ priv->flags |= TC_MQPRIO_F_MIN_RATE; -+ } -+ -+ if (tb[TCA_MQPRIO_MAX_RATE64]) { -+ if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) { -+ NL_SET_ERR_MSG_ATTR(extack, tb[TCA_MQPRIO_MAX_RATE64], -+ "max_rate accepted only when shaper is in bw_rlimit mode"); -+ return -EINVAL; -+ } -+ i = 0; -+ nla_for_each_nested(attr, tb[TCA_MQPRIO_MAX_RATE64], -+ rem) { -+ if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64) { -+ NL_SET_ERR_MSG_ATTR(extack, attr, -+ "Attribute type expected to be TCA_MQPRIO_MAX_RATE64"); -+ return -EINVAL; -+ } -+ -+ if (nla_len(attr) != sizeof(u64)) { -+ NL_SET_ERR_MSG_ATTR(extack, attr, -+ "Attribute TCA_MQPRIO_MAX_RATE64 expected to have 8 bytes length"); -+ return -EINVAL; -+ } -+ -+ if (i >= qopt->num_tc) -+ break; -+ priv->max_rate[i] = *(u64 *)nla_data(attr); -+ i++; -+ } -+ priv->flags |= TC_MQPRIO_F_MAX_RATE; -+ } -+ -+ return 0; -+} -+ - static int mqprio_init(struct Qdisc *sch, struct nlattr *opt, - struct netlink_ext_ack *extack) - { -@@ -139,9 +230,6 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt, - struct Qdisc *qdisc; - int i, err = -EOPNOTSUPP; - struct tc_mqprio_qopt *qopt = NULL; -- struct nlattr *tb[TCA_MQPRIO_MAX + 1]; -- struct nlattr *attr; -- int rem; - int len; - - BUILD_BUG_ON(TC_MAX_QUEUE != TC_QOPT_MAX_QUEUE); -@@ -166,55 +254,9 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt, - - len = nla_len(opt) - NLA_ALIGN(sizeof(*qopt)); - if (len > 0) { -- err = parse_attr(tb, TCA_MQPRIO_MAX, opt, mqprio_policy, -- sizeof(*qopt)); -- if (err < 0) -+ err = mqprio_parse_nlattr(sch, qopt, opt, extack); -+ if (err) - return err; -- -- if (!qopt->hw) -- return -EINVAL; -- -- if (tb[TCA_MQPRIO_MODE]) { -- priv->flags |= TC_MQPRIO_F_MODE; -- priv->mode = *(u16 *)nla_data(tb[TCA_MQPRIO_MODE]); -- } -- -- if (tb[TCA_MQPRIO_SHAPER]) { -- priv->flags |= TC_MQPRIO_F_SHAPER; -- priv->shaper = *(u16 *)nla_data(tb[TCA_MQPRIO_SHAPER]); -- } -- -- if (tb[TCA_MQPRIO_MIN_RATE64]) { -- if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) -- return -EINVAL; -- i = 0; -- nla_for_each_nested(attr, tb[TCA_MQPRIO_MIN_RATE64], -- rem) { -- if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64) -- return -EINVAL; -- if (i >= qopt->num_tc) -- break; -- priv->min_rate[i] = *(u64 *)nla_data(attr); -- i++; -- } -- priv->flags |= TC_MQPRIO_F_MIN_RATE; -- } -- -- if (tb[TCA_MQPRIO_MAX_RATE64]) { -- if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) -- return -EINVAL; -- i = 0; -- nla_for_each_nested(attr, tb[TCA_MQPRIO_MAX_RATE64], -- rem) { -- if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64) -- return -EINVAL; -- if (i >= qopt->num_tc) -- break; -- priv->max_rate[i] = *(u64 *)nla_data(attr); -- i++; -- } -- priv->flags |= TC_MQPRIO_F_MAX_RATE; -- } - } - - /* pre-allocate qdisc, attachment can't fail */ -diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c -index 603bd3097bd84..34a54dcd95f23 100644 ---- a/net/sched/sch_qfq.c -+++ b/net/sched/sch_qfq.c -@@ -375,8 +375,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight, - u32 lmax) - { - struct qfq_sched *q = qdisc_priv(sch); -- struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight); -+ struct qfq_aggregate *new_agg; - -+ /* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */ -+ if (lmax > (1UL << QFQ_MTU_SHIFT)) -+ return -EINVAL; -+ -+ new_agg = qfq_find_agg(q, lmax, weight); - if (new_agg == NULL) { /* create new aggregate */ - new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC); - if (new_agg == NULL) -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 01fd049da104a..f966b64d2939a 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -701,7 +701,7 @@ static int unix_set_peek_off(struct sock *sk, int val) - if (mutex_lock_interruptible(&u->iolock)) - return -EINTR; - -- sk->sk_peek_off = val; -+ WRITE_ONCE(sk->sk_peek_off, val); - mutex_unlock(&u->iolock); - - return 0; -diff --git a/security/keys/request_key.c b/security/keys/request_key.c -index 17c9c0cfb6f59..964e2456f34da 100644 ---- a/security/keys/request_key.c -+++ b/security/keys/request_key.c -@@ -401,17 +401,21 @@ static int construct_alloc_key(struct keyring_search_context *ctx, - set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags); - - if (dest_keyring) { -- ret = __key_link_lock(dest_keyring, &ctx->index_key); -+ ret = __key_link_lock(dest_keyring, &key->index_key); - if (ret < 0) - goto link_lock_failed; -- ret = __key_link_begin(dest_keyring, &ctx->index_key, &edit); -- if (ret < 0) -- goto link_prealloc_failed; - } - -- /* attach the key to the destination keyring under lock, but we do need -+ /* -+ * Attach the key to the destination keyring under lock, but we do need - * to do another check just in case someone beat us to it whilst we -- * waited for locks */ -+ * waited for locks. -+ * -+ * The caller might specify a comparison function which looks for keys -+ * that do not exactly match but are still equivalent from the caller's -+ * perspective. The __key_link_begin() operation must be done only after -+ * an actual key is determined. -+ */ - mutex_lock(&key_construction_mutex); - - rcu_read_lock(); -@@ -420,12 +424,16 @@ static int construct_alloc_key(struct keyring_search_context *ctx, - if (!IS_ERR(key_ref)) - goto key_already_present; - -- if (dest_keyring) -+ if (dest_keyring) { -+ ret = __key_link_begin(dest_keyring, &key->index_key, &edit); -+ if (ret < 0) -+ goto link_alloc_failed; - __key_link(key, &edit); -+ } - - mutex_unlock(&key_construction_mutex); - if (dest_keyring) -- __key_link_end(dest_keyring, &ctx->index_key, edit); -+ __key_link_end(dest_keyring, &key->index_key, edit); - mutex_unlock(&user->cons_lock); - *_key = key; - kleave(" = 0 [%d]", key_serial(key)); -@@ -438,10 +446,13 @@ key_already_present: - mutex_unlock(&key_construction_mutex); - key = key_ref_to_ptr(key_ref); - if (dest_keyring) { -+ ret = __key_link_begin(dest_keyring, &key->index_key, &edit); -+ if (ret < 0) -+ goto link_alloc_failed_unlocked; - ret = __key_link_check_live_key(dest_keyring, key); - if (ret == 0) - __key_link(key, &edit); -- __key_link_end(dest_keyring, &ctx->index_key, edit); -+ __key_link_end(dest_keyring, &key->index_key, edit); - if (ret < 0) - goto link_check_failed; - } -@@ -456,8 +467,10 @@ link_check_failed: - kleave(" = %d [linkcheck]", ret); - return ret; - --link_prealloc_failed: -- __key_link_end(dest_keyring, &ctx->index_key, edit); -+link_alloc_failed: -+ mutex_unlock(&key_construction_mutex); -+link_alloc_failed_unlocked: -+ __key_link_end(dest_keyring, &key->index_key, edit); - link_lock_failed: - mutex_unlock(&user->cons_lock); - key_put(key); -diff --git a/sound/soc/codecs/cs42l51-i2c.c b/sound/soc/codecs/cs42l51-i2c.c -index 70260e0a8f095..3ff73367897d8 100644 ---- a/sound/soc/codecs/cs42l51-i2c.c -+++ b/sound/soc/codecs/cs42l51-i2c.c -@@ -19,6 +19,12 @@ static struct i2c_device_id cs42l51_i2c_id[] = { - }; - MODULE_DEVICE_TABLE(i2c, cs42l51_i2c_id); - -+const struct of_device_id cs42l51_of_match[] = { -+ { .compatible = "cirrus,cs42l51", }, -+ { } -+}; -+MODULE_DEVICE_TABLE(of, cs42l51_of_match); -+ - static int cs42l51_i2c_probe(struct i2c_client *i2c, - const struct i2c_device_id *id) - { -diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c -index cdd7ae90c2b59..07371e32167c8 100644 ---- a/sound/soc/codecs/cs42l51.c -+++ b/sound/soc/codecs/cs42l51.c -@@ -811,13 +811,6 @@ int __maybe_unused cs42l51_resume(struct device *dev) - } - EXPORT_SYMBOL_GPL(cs42l51_resume); - --const struct of_device_id cs42l51_of_match[] = { -- { .compatible = "cirrus,cs42l51", }, -- { } --}; --MODULE_DEVICE_TABLE(of, cs42l51_of_match); --EXPORT_SYMBOL_GPL(cs42l51_of_match); -- - MODULE_AUTHOR("Arnaud Patard "); - MODULE_DESCRIPTION("Cirrus Logic CS42L51 ALSA SoC Codec Driver"); - MODULE_LICENSE("GPL"); -diff --git a/sound/soc/codecs/cs42l51.h b/sound/soc/codecs/cs42l51.h -index 9d06cf7f88768..4f13c38484b7f 100644 ---- a/sound/soc/codecs/cs42l51.h -+++ b/sound/soc/codecs/cs42l51.h -@@ -16,7 +16,6 @@ int cs42l51_probe(struct device *dev, struct regmap *regmap); - int cs42l51_remove(struct device *dev); - int __maybe_unused cs42l51_suspend(struct device *dev); - int __maybe_unused cs42l51_resume(struct device *dev); --extern const struct of_device_id cs42l51_of_match[]; - - #define CS42L51_CHIP_ID 0x1B - #define CS42L51_CHIP_REV_A 0x00 -diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c -index 9e8c564f6e9c4..9787257b69a92 100644 ---- a/sound/soc/codecs/wm8904.c -+++ b/sound/soc/codecs/wm8904.c -@@ -2276,6 +2276,9 @@ static int wm8904_i2c_probe(struct i2c_client *i2c, - regmap_update_bits(wm8904->regmap, WM8904_BIAS_CONTROL_0, - WM8904_POBCTRL, 0); - -+ /* Fill the cache for the ADC test register */ -+ regmap_read(wm8904->regmap, WM8904_ADC_TEST_0, &val); -+ - /* Can leave the device powered off until we need it */ - regcache_cache_only(wm8904->regmap, true); - regulator_bulk_disable(ARRAY_SIZE(wm8904->supplies), wm8904->supplies); -diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c -index 7858a5499ac5d..4fd4ba9972afd 100644 ---- a/sound/soc/fsl/fsl_spdif.c -+++ b/sound/soc/fsl/fsl_spdif.c -@@ -615,6 +615,8 @@ static int fsl_spdif_trigger(struct snd_pcm_substream *substream, - case SNDRV_PCM_TRIGGER_PAUSE_PUSH: - regmap_update_bits(regmap, REG_SPDIF_SCR, dmaen, 0); - regmap_update_bits(regmap, REG_SPDIF_SIE, intr, 0); -+ regmap_write(regmap, REG_SPDIF_STL, 0x0); -+ regmap_write(regmap, REG_SPDIF_STR, 0x0); - break; - default: - return -EINVAL; -diff --git a/tools/perf/tests/shell/test_uprobe_from_different_cu.sh b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh -index 00d2e0e2e0c28..319f36ebb9a40 100644 ---- a/tools/perf/tests/shell/test_uprobe_from_different_cu.sh -+++ b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh -@@ -4,6 +4,12 @@ - - set -e - -+# skip if there's no gcc -+if ! [ -x "$(command -v gcc)" ]; then -+ echo "failed: no gcc compiler" -+ exit 2 -+fi -+ - temp_dir=$(mktemp -d /tmp/perf-uprobe-different-cu-sh.XXXXXXXXXX) - - cleanup() -@@ -11,7 +17,7 @@ cleanup() - trap - EXIT TERM INT - if [[ "${temp_dir}" =~ ^/tmp/perf-uprobe-different-cu-sh.*$ ]]; then - echo "--- Cleaning up ---" -- perf probe -x ${temp_dir}/testfile -d foo -+ perf probe -x ${temp_dir}/testfile -d foo || true - rm -f "${temp_dir}/"* - rmdir "${temp_dir}" - fi -diff --git a/tools/testing/selftests/rseq/rseq.c b/tools/testing/selftests/rseq/rseq.c -index 986b9458efb26..b736a5169aad0 100644 ---- a/tools/testing/selftests/rseq/rseq.c -+++ b/tools/testing/selftests/rseq/rseq.c -@@ -32,9 +32,17 @@ - #include "../kselftest.h" - #include "rseq.h" - --static const ptrdiff_t *libc_rseq_offset_p; --static const unsigned int *libc_rseq_size_p; --static const unsigned int *libc_rseq_flags_p; -+/* -+ * Define weak versions to play nice with binaries that are statically linked -+ * against a libc that doesn't support registering its own rseq. -+ */ -+__weak ptrdiff_t __rseq_offset; -+__weak unsigned int __rseq_size; -+__weak unsigned int __rseq_flags; -+ -+static const ptrdiff_t *libc_rseq_offset_p = &__rseq_offset; -+static const unsigned int *libc_rseq_size_p = &__rseq_size; -+static const unsigned int *libc_rseq_flags_p = &__rseq_flags; - - /* Offset from the thread pointer to the rseq area. */ - ptrdiff_t rseq_offset; -@@ -108,10 +116,19 @@ int rseq_unregister_current_thread(void) - static __attribute__((constructor)) - void rseq_init(void) - { -- libc_rseq_offset_p = dlsym(RTLD_NEXT, "__rseq_offset"); -- libc_rseq_size_p = dlsym(RTLD_NEXT, "__rseq_size"); -- libc_rseq_flags_p = dlsym(RTLD_NEXT, "__rseq_flags"); -- if (libc_rseq_size_p && libc_rseq_offset_p && libc_rseq_flags_p) { -+ /* -+ * If the libc's registered rseq size isn't already valid, it may be -+ * because the binary is dynamically linked and not necessarily due to -+ * libc not having registered a restartable sequence. Try to find the -+ * symbols if that's the case. -+ */ -+ if (!*libc_rseq_size_p) { -+ libc_rseq_offset_p = dlsym(RTLD_NEXT, "__rseq_offset"); -+ libc_rseq_size_p = dlsym(RTLD_NEXT, "__rseq_size"); -+ libc_rseq_flags_p = dlsym(RTLD_NEXT, "__rseq_flags"); -+ } -+ if (libc_rseq_size_p && libc_rseq_offset_p && libc_rseq_flags_p && -+ *libc_rseq_size_p != 0) { - /* rseq registration owned by glibc */ - rseq_offset = *libc_rseq_offset_p; - rseq_size = *libc_rseq_size_p;