diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2020-06-22 10:47:04 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2020-06-22 10:47:04 -0400 |
| commit | 6209421e45223d6aa85060dca4d113d6815139d1 (patch) | |
| tree | 8bc124b4a1f93e112ee12673eaaaaa5919f7b288 | |
| parent | Linux patch 4.19.128 (diff) | |
| download | linux-patches-6209421e45223d6aa85060dca4d113d6815139d1.tar.gz linux-patches-6209421e45223d6aa85060dca4d113d6815139d1.tar.bz2 linux-patches-6209421e45223d6aa85060dca4d113d6815139d1.zip | |
Linux patch 4.19.1294.19-128
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1128_linux-4.19.129.patch | 9428 |
2 files changed, 9432 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 123365d0..afec7d26 100644 --- a/0000_README +++ b/0000_README @@ -551,6 +551,10 @@ Patch: 1127_linux-4.19.128.patch From: https://www.kernel.org Desc: Linux 4.19.128 +Patch: 1128_linux-4.19.129.patch +From: https://www.kernel.org +Desc: Linux 4.19.129 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1128_linux-4.19.129.patch b/1128_linux-4.19.129.patch new file mode 100644 index 00000000..37c6b1f0 --- /dev/null +++ b/1128_linux-4.19.129.patch @@ -0,0 +1,9428 @@ +diff --git a/Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt b/Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt +index b6a7e7397b8b..b944fe067188 100644 +--- a/Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt ++++ b/Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt +@@ -16,6 +16,9 @@ Required properties: + Documentation/devicetree/bindings/graph.txt. This port should be connected + to the input port of an attached HDMI or LVDS encoder chip. + ++Optional properties: ++- pinctrl-names: Contain "default" and "sleep". ++ + Example: + + dpi0: dpi@1401d000 { +@@ -26,6 +29,9 @@ dpi0: dpi@1401d000 { + <&mmsys CLK_MM_DPI_ENGINE>, + <&apmixedsys CLK_APMIXED_TVDPLL>; + clock-names = "pixel", "engine", "pll"; ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&dpi_pin_func>; ++ pinctrl-1 = <&dpi_pin_idle>; + + port { + dpi0_out: endpoint { +diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt +index 8e16017ff397..d2f265a9dc0d 100644 +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -3999,9 +3999,11 @@ EOI was received. + #define KVM_EXIT_HYPERV_SYNIC 1 + #define KVM_EXIT_HYPERV_HCALL 2 + __u32 type; ++ __u32 pad1; + union { + struct { + __u32 msr; ++ __u32 pad2; + __u64 control; + __u64 evt_page; + __u64 msg_page; +diff --git a/Makefile b/Makefile +index af0558a79c41..e6066502e9cc 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 128 ++SUBLEVEL = 129 + EXTRAVERSION = + NAME = "People's Front" + +@@ -554,12 +554,8 @@ KBUILD_MODULES := + KBUILD_BUILTIN := 1 + + # If we have only "make modules", don't compile built-in objects. +-# When we're building modules with modversions, we need to consider +-# the built-in objects during the descend as well, in order to +-# make sure the checksums are up to date before we record them. +- + ifeq ($(MAKECMDGOALS),modules) +- KBUILD_BUILTIN := $(if $(CONFIG_MODVERSIONS),1) ++ KBUILD_BUILTIN := + endif + + # If we have "make <whatever> modules", compile modules +@@ -1229,6 +1225,13 @@ ifdef CONFIG_MODULES + + all: modules + ++# When we're building modules with modversions, we need to consider ++# the built-in objects during the descend as well, in order to ++# make sure the checksums are up to date before we record them. ++ifdef CONFIG_MODVERSIONS ++ KBUILD_BUILTIN := 1 ++endif ++ + # Build modules + # + # A module can be listed more than once in obj-m resulting in +diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h +index 4c533fc94d62..eb09d5aee910 100644 +--- a/arch/alpha/include/asm/io.h ++++ b/arch/alpha/include/asm/io.h +@@ -327,14 +327,18 @@ static inline int __is_mmio(const volatile void __iomem *addr) + #if IO_CONCAT(__IO_PREFIX,trivial_io_bw) + extern inline unsigned int ioread8(void __iomem *addr) + { +- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr); ++ unsigned int ret; ++ mb(); ++ ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr); + mb(); + return ret; + } + + extern inline unsigned int ioread16(void __iomem *addr) + { +- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr); ++ unsigned int ret; ++ mb(); ++ ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr); + mb(); + return ret; + } +@@ -375,7 +379,9 @@ extern inline void outw(u16 b, unsigned long port) + #if IO_CONCAT(__IO_PREFIX,trivial_io_lq) + extern inline unsigned int ioread32(void __iomem *addr) + { +- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr); ++ unsigned int ret; ++ mb(); ++ ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr); + mb(); + return ret; + } +@@ -420,14 +426,18 @@ extern inline void __raw_writew(u16 b, volatile void __iomem *addr) + + extern inline u8 readb(const volatile void __iomem *addr) + { +- u8 ret = __raw_readb(addr); ++ u8 ret; ++ mb(); ++ ret = __raw_readb(addr); + mb(); + return ret; + } + + extern inline u16 readw(const volatile void __iomem *addr) + { +- u16 ret = __raw_readw(addr); ++ u16 ret; ++ mb(); ++ ret = __raw_readw(addr); + mb(); + return ret; + } +@@ -468,14 +478,18 @@ extern inline void __raw_writeq(u64 b, volatile void __iomem *addr) + + extern inline u32 readl(const volatile void __iomem *addr) + { +- u32 ret = __raw_readl(addr); ++ u32 ret; ++ mb(); ++ ret = __raw_readl(addr); + mb(); + return ret; + } + + extern inline u64 readq(const volatile void __iomem *addr) + { +- u64 ret = __raw_readq(addr); ++ u64 ret; ++ mb(); ++ ret = __raw_readq(addr); + mb(); + return ret; + } +@@ -504,14 +518,44 @@ extern inline void writeq(u64 b, volatile void __iomem *addr) + #define outb_p outb + #define outw_p outw + #define outl_p outl +-#define readb_relaxed(addr) __raw_readb(addr) +-#define readw_relaxed(addr) __raw_readw(addr) +-#define readl_relaxed(addr) __raw_readl(addr) +-#define readq_relaxed(addr) __raw_readq(addr) +-#define writeb_relaxed(b, addr) __raw_writeb(b, addr) +-#define writew_relaxed(b, addr) __raw_writew(b, addr) +-#define writel_relaxed(b, addr) __raw_writel(b, addr) +-#define writeq_relaxed(b, addr) __raw_writeq(b, addr) ++ ++extern u8 readb_relaxed(const volatile void __iomem *addr); ++extern u16 readw_relaxed(const volatile void __iomem *addr); ++extern u32 readl_relaxed(const volatile void __iomem *addr); ++extern u64 readq_relaxed(const volatile void __iomem *addr); ++ ++#if IO_CONCAT(__IO_PREFIX,trivial_io_bw) ++extern inline u8 readb_relaxed(const volatile void __iomem *addr) ++{ ++ mb(); ++ return __raw_readb(addr); ++} ++ ++extern inline u16 readw_relaxed(const volatile void __iomem *addr) ++{ ++ mb(); ++ return __raw_readw(addr); ++} ++#endif ++ ++#if IO_CONCAT(__IO_PREFIX,trivial_io_lq) ++extern inline u32 readl_relaxed(const volatile void __iomem *addr) ++{ ++ mb(); ++ return __raw_readl(addr); ++} ++ ++extern inline u64 readq_relaxed(const volatile void __iomem *addr) ++{ ++ mb(); ++ return __raw_readq(addr); ++} ++#endif ++ ++#define writeb_relaxed writeb ++#define writew_relaxed writew ++#define writel_relaxed writel ++#define writeq_relaxed writeq + + #define mmiowb() + +diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h +index 87d8c4f0307d..7295967b5028 100644 +--- a/arch/alpha/include/asm/uaccess.h ++++ b/arch/alpha/include/asm/uaccess.h +@@ -30,11 +30,13 @@ + * Address valid if: + * - "addr" doesn't have any high-bits set + * - AND "size" doesn't have any high-bits set +- * - AND "addr+size" doesn't have any high-bits set ++ * - AND "addr+size-(size != 0)" doesn't have any high-bits set + * - OR we are in kernel mode. + */ +-#define __access_ok(addr, size) \ +- ((get_fs().seg & (addr | size | (addr+size))) == 0) ++#define __access_ok(addr, size) ({ \ ++ unsigned long __ao_a = (addr), __ao_b = (size); \ ++ unsigned long __ao_end = __ao_a + __ao_b - !!__ao_b; \ ++ (get_fs().seg & (__ao_a | __ao_b | __ao_end)) == 0; }) + + #define access_ok(type, addr, size) \ + ({ \ +diff --git a/arch/alpha/kernel/io.c b/arch/alpha/kernel/io.c +index c025a3e5e357..938de13adfbf 100644 +--- a/arch/alpha/kernel/io.c ++++ b/arch/alpha/kernel/io.c +@@ -16,21 +16,27 @@ + unsigned int + ioread8(void __iomem *addr) + { +- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr); ++ unsigned int ret; ++ mb(); ++ ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr); + mb(); + return ret; + } + + unsigned int ioread16(void __iomem *addr) + { +- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr); ++ unsigned int ret; ++ mb(); ++ ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr); + mb(); + return ret; + } + + unsigned int ioread32(void __iomem *addr) + { +- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr); ++ unsigned int ret; ++ mb(); ++ ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr); + mb(); + return ret; + } +@@ -148,28 +154,36 @@ EXPORT_SYMBOL(__raw_writeq); + + u8 readb(const volatile void __iomem *addr) + { +- u8 ret = __raw_readb(addr); ++ u8 ret; ++ mb(); ++ ret = __raw_readb(addr); + mb(); + return ret; + } + + u16 readw(const volatile void __iomem *addr) + { +- u16 ret = __raw_readw(addr); ++ u16 ret; ++ mb(); ++ ret = __raw_readw(addr); + mb(); + return ret; + } + + u32 readl(const volatile void __iomem *addr) + { +- u32 ret = __raw_readl(addr); ++ u32 ret; ++ mb(); ++ ret = __raw_readl(addr); + mb(); + return ret; + } + + u64 readq(const volatile void __iomem *addr) + { +- u64 ret = __raw_readq(addr); ++ u64 ret; ++ mb(); ++ ret = __raw_readq(addr); + mb(); + return ret; + } +@@ -207,6 +221,38 @@ EXPORT_SYMBOL(writew); + EXPORT_SYMBOL(writel); + EXPORT_SYMBOL(writeq); + ++/* ++ * The _relaxed functions must be ordered w.r.t. each other, but they don't ++ * have to be ordered w.r.t. other memory accesses. ++ */ ++u8 readb_relaxed(const volatile void __iomem *addr) ++{ ++ mb(); ++ return __raw_readb(addr); ++} ++ ++u16 readw_relaxed(const volatile void __iomem *addr) ++{ ++ mb(); ++ return __raw_readw(addr); ++} ++ ++u32 readl_relaxed(const volatile void __iomem *addr) ++{ ++ mb(); ++ return __raw_readl(addr); ++} ++ ++u64 readq_relaxed(const volatile void __iomem *addr) ++{ ++ mb(); ++ return __raw_readq(addr); ++} ++ ++EXPORT_SYMBOL(readb_relaxed); ++EXPORT_SYMBOL(readw_relaxed); ++EXPORT_SYMBOL(readl_relaxed); ++EXPORT_SYMBOL(readq_relaxed); + + /* + * Read COUNT 8-bit bytes from port PORT into memory starting at SRC. +diff --git a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts +index 2214bfe7aa20..7c611f5555a4 100644 +--- a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts ++++ b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts +@@ -40,7 +40,7 @@ + + ahb { + usb0: gadget@300000 { +- atmel,vbus-gpio = <&pioA PIN_PA27 GPIO_ACTIVE_HIGH>; ++ atmel,vbus-gpio = <&pioA PIN_PB11 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usba_vbus>; + status = "okay"; +@@ -125,8 +125,6 @@ + bus-width = <8>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sdmmc0_default>; +- non-removable; +- mmc-ddr-1_8v; + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi b/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi +index 30eee5942eff..945ee8f55e65 100644 +--- a/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi ++++ b/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi +@@ -50,7 +50,7 @@ + + i2c_cm36651: i2c-gpio-2 { + compatible = "i2c-gpio"; +- gpios = <&gpf0 0 GPIO_ACTIVE_LOW>, <&gpf0 1 GPIO_ACTIVE_LOW>; ++ gpios = <&gpf0 0 GPIO_ACTIVE_HIGH>, <&gpf0 1 GPIO_ACTIVE_HIGH>; + i2c-gpio,delay-us = <2>; + #address-cells = <1>; + #size-cells = <0>; +diff --git a/arch/arm/boot/dts/s5pv210-aries.dtsi b/arch/arm/boot/dts/s5pv210-aries.dtsi +index 575094ea7024..7b62c381d3c8 100644 +--- a/arch/arm/boot/dts/s5pv210-aries.dtsi ++++ b/arch/arm/boot/dts/s5pv210-aries.dtsi +@@ -374,6 +374,7 @@ + pinctrl-names = "default"; + cap-sd-highspeed; + cap-mmc-highspeed; ++ keep-power-in-suspend; + + mmc-pwrseq = <&wifi_pwrseq>; + non-removable; +diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h +index d0d0227fc70d..c9128bb187f9 100644 +--- a/arch/arm/include/asm/kvm_host.h ++++ b/arch/arm/include/asm/kvm_host.h +@@ -364,4 +364,6 @@ static inline void kvm_vcpu_put_sysregs(struct kvm_vcpu *vcpu) {} + struct kvm *kvm_arch_alloc_vm(void); + void kvm_arch_free_vm(struct kvm *kvm); + ++#define kvm_arm_vcpu_loaded(vcpu) (false) ++ + #endif /* __ARM_KVM_HOST_H__ */ +diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c +index 36718a424358..492ac74a63f4 100644 +--- a/arch/arm/kernel/ptrace.c ++++ b/arch/arm/kernel/ptrace.c +@@ -229,8 +229,8 @@ static struct undef_hook arm_break_hook = { + }; + + static struct undef_hook thumb_break_hook = { +- .instr_mask = 0xffff, +- .instr_val = 0xde01, ++ .instr_mask = 0xffffffff, ++ .instr_val = 0x0000de01, + .cpsr_mask = PSR_T_BIT, + .cpsr_val = PSR_T_BIT, + .fn = break_trap, +diff --git a/arch/arm/mach-tegra/tegra.c b/arch/arm/mach-tegra/tegra.c +index f9587be48235..37a2aaeb44cc 100644 +--- a/arch/arm/mach-tegra/tegra.c ++++ b/arch/arm/mach-tegra/tegra.c +@@ -112,8 +112,8 @@ static const char * const tegra_dt_board_compat[] = { + }; + + DT_MACHINE_START(TEGRA_DT, "NVIDIA Tegra SoC (Flattened Device Tree)") +- .l2c_aux_val = 0x3c400001, +- .l2c_aux_mask = 0xc20fc3fe, ++ .l2c_aux_val = 0x3c400000, ++ .l2c_aux_mask = 0xc20fc3ff, + .smp = smp_ops(tegra_smp_ops), + .map_io = tegra_map_common_io, + .init_early = tegra_init_early, +diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S +index 5461d589a1e2..60ac7c5999a9 100644 +--- a/arch/arm/mm/proc-macros.S ++++ b/arch/arm/mm/proc-macros.S +@@ -5,6 +5,7 @@ + * VMA_VM_FLAGS + * VM_EXEC + */ ++#include <linux/const.h> + #include <asm/asm-offsets.h> + #include <asm/thread_info.h> + +@@ -30,7 +31,7 @@ + * act_mm - get current->active_mm + */ + .macro act_mm, rd +- bic \rd, sp, #8128 ++ bic \rd, sp, #(THREAD_SIZE - 1) & ~63 + bic \rd, \rd, #63 + ldr \rd, [\rd, #TI_TASK] + .if (TSK_ACTIVE_MM > IMM12_MASK) +diff --git a/arch/arm64/include/asm/cacheflush.h b/arch/arm64/include/asm/cacheflush.h +index 19844211a4e6..a449a1c602d3 100644 +--- a/arch/arm64/include/asm/cacheflush.h ++++ b/arch/arm64/include/asm/cacheflush.h +@@ -90,7 +90,7 @@ static inline void flush_icache_range(unsigned long start, unsigned long end) + * IPI all online CPUs so that they undergo a context synchronization + * event and are forced to refetch the new instructions. + */ +-#ifdef CONFIG_KGDB ++ + /* + * KGDB performs cache maintenance with interrupts disabled, so we + * will deadlock trying to IPI the secondary CPUs. In theory, we can +@@ -100,9 +100,9 @@ static inline void flush_icache_range(unsigned long start, unsigned long end) + * the patching operation, so we don't need extra IPIs here anyway. + * In which case, add a KGDB-specific bodge and return early. + */ +- if (kgdb_connected && irqs_disabled()) ++ if (in_dbg_master()) + return; +-#endif ++ + kick_all_cpus_sync(); + } + +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index 367b2e0b6d76..e9afdfcb8403 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -335,8 +335,10 @@ void vcpu_write_sys_reg(struct kvm_vcpu *vcpu, u64 val, int reg); + * CP14 and CP15 live in the same array, as they are backed by the + * same system registers. + */ +-#define vcpu_cp14(v,r) ((v)->arch.ctxt.copro[(r)]) +-#define vcpu_cp15(v,r) ((v)->arch.ctxt.copro[(r)]) ++#define CPx_BIAS IS_ENABLED(CONFIG_CPU_BIG_ENDIAN) ++ ++#define vcpu_cp14(v,r) ((v)->arch.ctxt.copro[(r) ^ CPx_BIAS]) ++#define vcpu_cp15(v,r) ((v)->arch.ctxt.copro[(r) ^ CPx_BIAS]) + + struct kvm_vm_stat { + ulong remote_tlb_flush; +@@ -535,4 +537,6 @@ void kvm_vcpu_put_sysregs(struct kvm_vcpu *vcpu); + struct kvm *kvm_arch_alloc_vm(void); + void kvm_arch_free_vm(struct kvm *kvm); + ++#define kvm_arm_vcpu_loaded(vcpu) ((vcpu)->arch.sysregs_loaded_on_cpu) ++ + #endif /* __ARM64_KVM_HOST_H__ */ +diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c +index 3e6229e30109..cd37edbdedcb 100644 +--- a/arch/arm64/kernel/insn.c ++++ b/arch/arm64/kernel/insn.c +@@ -1490,16 +1490,10 @@ static u32 aarch64_encode_immediate(u64 imm, + u32 insn) + { + unsigned int immr, imms, n, ones, ror, esz, tmp; +- u64 mask = ~0UL; +- +- /* Can't encode full zeroes or full ones */ +- if (!imm || !~imm) +- return AARCH64_BREAK_FAULT; ++ u64 mask; + + switch (variant) { + case AARCH64_INSN_VARIANT_32BIT: +- if (upper_32_bits(imm)) +- return AARCH64_BREAK_FAULT; + esz = 32; + break; + case AARCH64_INSN_VARIANT_64BIT: +@@ -1511,6 +1505,12 @@ static u32 aarch64_encode_immediate(u64 imm, + return AARCH64_BREAK_FAULT; + } + ++ mask = GENMASK(esz - 1, 0); ++ ++ /* Can't encode full zeroes, full ones, or value wider than the mask */ ++ if (!imm || imm == mask || imm & ~mask) ++ return AARCH64_BREAK_FAULT; ++ + /* + * Inverse of Replicate(). Try to spot a repeating pattern + * with a pow2 stride. +diff --git a/arch/m68k/include/asm/mac_via.h b/arch/m68k/include/asm/mac_via.h +index de1470c4d829..1149251ea58d 100644 +--- a/arch/m68k/include/asm/mac_via.h ++++ b/arch/m68k/include/asm/mac_via.h +@@ -257,6 +257,7 @@ extern int rbv_present,via_alt_mapping; + + struct irq_desc; + ++extern void via_l2_flush(int writeback); + extern void via_register_interrupts(void); + extern void via_irq_enable(int); + extern void via_irq_disable(int); +diff --git a/arch/m68k/mac/config.c b/arch/m68k/mac/config.c +index cd9317d53276..a4f91bea6c88 100644 +--- a/arch/m68k/mac/config.c ++++ b/arch/m68k/mac/config.c +@@ -61,7 +61,6 @@ extern void iop_preinit(void); + extern void iop_init(void); + extern void via_init(void); + extern void via_init_clock(irq_handler_t func); +-extern void via_flush_cache(void); + extern void oss_init(void); + extern void psc_init(void); + extern void baboon_init(void); +@@ -132,21 +131,6 @@ int __init mac_parse_bootinfo(const struct bi_record *record) + return unknown; + } + +-/* +- * Flip into 24bit mode for an instant - flushes the L2 cache card. We +- * have to disable interrupts for this. Our IRQ handlers will crap +- * themselves if they take an IRQ in 24bit mode! +- */ +- +-static void mac_cache_card_flush(int writeback) +-{ +- unsigned long flags; +- +- local_irq_save(flags); +- via_flush_cache(); +- local_irq_restore(flags); +-} +- + void __init config_mac(void) + { + if (!MACH_IS_MAC) +@@ -178,9 +162,8 @@ void __init config_mac(void) + * not. + */ + +- if (macintosh_config->ident == MAC_MODEL_IICI +- || macintosh_config->ident == MAC_MODEL_IIFX) +- mach_l2_flush = mac_cache_card_flush; ++ if (macintosh_config->ident == MAC_MODEL_IICI) ++ mach_l2_flush = via_l2_flush; + } + + +diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c +index 038d5a1c4d48..8307da441a10 100644 +--- a/arch/m68k/mac/via.c ++++ b/arch/m68k/mac/via.c +@@ -289,10 +289,14 @@ void via_debug_dump(void) + * the system into 24-bit mode for an instant. + */ + +-void via_flush_cache(void) ++void via_l2_flush(int writeback) + { ++ unsigned long flags; ++ ++ local_irq_save(flags); + via2[gBufB] &= ~VIA2B_vMode32; + via2[gBufB] |= VIA2B_vMode32; ++ local_irq_restore(flags); + } + + /* +diff --git a/arch/mips/Makefile b/arch/mips/Makefile +index ad0a92f95af1..63e2ad43bd6a 100644 +--- a/arch/mips/Makefile ++++ b/arch/mips/Makefile +@@ -290,12 +290,23 @@ ifdef CONFIG_64BIT + endif + endif + ++# When linking a 32-bit executable the LLVM linker cannot cope with a ++# 32-bit load address that has been sign-extended to 64 bits. Simply ++# remove the upper 32 bits then, as it is safe to do so with other ++# linkers. ++ifdef CONFIG_64BIT ++ load-ld = $(load-y) ++else ++ load-ld = $(subst 0xffffffff,0x,$(load-y)) ++endif ++ + KBUILD_AFLAGS += $(cflags-y) + KBUILD_CFLAGS += $(cflags-y) +-KBUILD_CPPFLAGS += -DVMLINUX_LOAD_ADDRESS=$(load-y) ++KBUILD_CPPFLAGS += -DVMLINUX_LOAD_ADDRESS=$(load-y) -DLINKER_LOAD_ADDRESS=$(load-ld) + KBUILD_CPPFLAGS += -DDATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0) + + bootvars-y = VMLINUX_LOAD_ADDRESS=$(load-y) \ ++ LINKER_LOAD_ADDRESS=$(load-ld) \ + VMLINUX_ENTRY_ADDRESS=$(entry-y) \ + PLATFORM="$(platform-y)" \ + ITS_INPUTS="$(its-y)" +diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile +index d859f079b771..378cbfb31ee7 100644 +--- a/arch/mips/boot/compressed/Makefile ++++ b/arch/mips/boot/compressed/Makefile +@@ -90,7 +90,7 @@ ifneq ($(zload-y),) + VMLINUZ_LOAD_ADDRESS := $(zload-y) + else + VMLINUZ_LOAD_ADDRESS = $(shell $(obj)/calc_vmlinuz_load_addr \ +- $(obj)/vmlinux.bin $(VMLINUX_LOAD_ADDRESS)) ++ $(obj)/vmlinux.bin $(LINKER_LOAD_ADDRESS)) + endif + UIMAGE_LOADADDR = $(VMLINUZ_LOAD_ADDRESS) + +diff --git a/arch/mips/configs/loongson3_defconfig b/arch/mips/configs/loongson3_defconfig +index 324dfee23dfb..c871e40b8878 100644 +--- a/arch/mips/configs/loongson3_defconfig ++++ b/arch/mips/configs/loongson3_defconfig +@@ -250,7 +250,7 @@ CONFIG_MEDIA_CAMERA_SUPPORT=y + CONFIG_MEDIA_USB_SUPPORT=y + CONFIG_USB_VIDEO_CLASS=m + CONFIG_DRM=y +-CONFIG_DRM_RADEON=y ++CONFIG_DRM_RADEON=m + CONFIG_FB_RADEON=y + CONFIG_LCD_CLASS_DEVICE=y + CONFIG_LCD_PLATFORM=m +diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h +index f567ace7a9e9..2b3fdfc9e0e7 100644 +--- a/arch/mips/include/asm/kvm_host.h ++++ b/arch/mips/include/asm/kvm_host.h +@@ -274,8 +274,12 @@ enum emulation_result { + #define MIPS3_PG_SHIFT 6 + #define MIPS3_PG_FRAME 0x3fffffc0 + ++#if defined(CONFIG_64BIT) ++#define VPN2_MASK GENMASK(cpu_vmbits - 1, 13) ++#else + #define VPN2_MASK 0xffffe000 +-#define KVM_ENTRYHI_ASID MIPS_ENTRYHI_ASID ++#endif ++#define KVM_ENTRYHI_ASID cpu_asid_mask(&boot_cpu_data) + #define TLB_IS_GLOBAL(x) ((x).tlb_lo[0] & (x).tlb_lo[1] & ENTRYLO_G) + #define TLB_VPN2(x) ((x).tlb_hi & VPN2_MASK) + #define TLB_ASID(x) ((x).tlb_hi & KVM_ENTRYHI_ASID) +diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h +index 1bb9448777c5..f9a7c137be9f 100644 +--- a/arch/mips/include/asm/mipsregs.h ++++ b/arch/mips/include/asm/mipsregs.h +@@ -749,7 +749,7 @@ + + /* MAAR bit definitions */ + #define MIPS_MAAR_VH (_U64CAST_(1) << 63) +-#define MIPS_MAAR_ADDR ((BIT_ULL(BITS_PER_LONG - 12) - 1) << 12) ++#define MIPS_MAAR_ADDR GENMASK_ULL(55, 12) + #define MIPS_MAAR_ADDR_SHIFT 12 + #define MIPS_MAAR_S (_ULCAST_(1) << 1) + #define MIPS_MAAR_VL (_ULCAST_(1) << 0) +diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S +index 6c257b52f57f..7fad007fe025 100644 +--- a/arch/mips/kernel/genex.S ++++ b/arch/mips/kernel/genex.S +@@ -477,20 +477,20 @@ NESTED(nmi_handler, PT_SIZE, sp) + .endm + + .macro __build_clear_fpe ++ CLI ++ TRACE_IRQS_OFF + .set push + /* gas fails to assemble cfc1 for some archs (octeon).*/ \ + .set mips1 + SET_HARDFLOAT + cfc1 a1, fcr31 + .set pop +- CLI +- TRACE_IRQS_OFF + .endm + + .macro __build_clear_msa_fpe +- _cfcmsa a1, MSA_CSR + CLI + TRACE_IRQS_OFF ++ _cfcmsa a1, MSA_CSR + .endm + + .macro __build_clear_ade +diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c +index 7f3f136572de..50d3d74001cb 100644 +--- a/arch/mips/kernel/mips-cm.c ++++ b/arch/mips/kernel/mips-cm.c +@@ -123,9 +123,9 @@ static char *cm2_causes[32] = { + "COH_RD_ERR", "MMIO_WR_ERR", "MMIO_RD_ERR", "0x07", + "0x08", "0x09", "0x0a", "0x0b", + "0x0c", "0x0d", "0x0e", "0x0f", +- "0x10", "0x11", "0x12", "0x13", +- "0x14", "0x15", "0x16", "INTVN_WR_ERR", +- "INTVN_RD_ERR", "0x19", "0x1a", "0x1b", ++ "0x10", "INTVN_WR_ERR", "INTVN_RD_ERR", "0x13", ++ "0x14", "0x15", "0x16", "0x17", ++ "0x18", "0x19", "0x1a", "0x1b", + "0x1c", "0x1d", "0x1e", "0x1f" + }; + +diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c +index e87c98b8a72c..2c2480be3f36 100644 +--- a/arch/mips/kernel/setup.c ++++ b/arch/mips/kernel/setup.c +@@ -933,7 +933,17 @@ static void __init arch_mem_init(char **cmdline_p) + BOOTMEM_DEFAULT); + #endif + device_tree_init(); ++ ++ /* ++ * In order to reduce the possibility of kernel panic when failed to ++ * get IO TLB memory under CONFIG_SWIOTLB, it is better to allocate ++ * low memory as small as possible before plat_swiotlb_setup(), so ++ * make sparse_init() using top-down allocation. ++ */ ++ memblock_set_bottom_up(false); + sparse_init(); ++ memblock_set_bottom_up(true); ++ + plat_swiotlb_setup(); + + dma_contiguous_reserve(PFN_PHYS(max_low_pfn)); +diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c +index bfe02ded25d1..1e631a484ddf 100644 +--- a/arch/mips/kernel/time.c ++++ b/arch/mips/kernel/time.c +@@ -22,12 +22,82 @@ + #include <linux/smp.h> + #include <linux/spinlock.h> + #include <linux/export.h> ++#include <linux/cpufreq.h> ++#include <linux/delay.h> + + #include <asm/cpu-features.h> + #include <asm/cpu-type.h> + #include <asm/div64.h> + #include <asm/time.h> + ++#ifdef CONFIG_CPU_FREQ ++ ++static DEFINE_PER_CPU(unsigned long, pcp_lpj_ref); ++static DEFINE_PER_CPU(unsigned long, pcp_lpj_ref_freq); ++static unsigned long glb_lpj_ref; ++static unsigned long glb_lpj_ref_freq; ++ ++static int cpufreq_callback(struct notifier_block *nb, ++ unsigned long val, void *data) ++{ ++ struct cpufreq_freqs *freq = data; ++ struct cpumask *cpus = freq->policy->cpus; ++ unsigned long lpj; ++ int cpu; ++ ++ /* ++ * Skip lpj numbers adjustment if the CPU-freq transition is safe for ++ * the loops delay. (Is this possible?) ++ */ ++ if (freq->flags & CPUFREQ_CONST_LOOPS) ++ return NOTIFY_OK; ++ ++ /* Save the initial values of the lpjes for future scaling. */ ++ if (!glb_lpj_ref) { ++ glb_lpj_ref = boot_cpu_data.udelay_val; ++ glb_lpj_ref_freq = freq->old; ++ ++ for_each_online_cpu(cpu) { ++ per_cpu(pcp_lpj_ref, cpu) = ++ cpu_data[cpu].udelay_val; ++ per_cpu(pcp_lpj_ref_freq, cpu) = freq->old; ++ } ++ } ++ ++ /* ++ * Adjust global lpj variable and per-CPU udelay_val number in ++ * accordance with the new CPU frequency. ++ */ ++ if ((val == CPUFREQ_PRECHANGE && freq->old < freq->new) || ++ (val == CPUFREQ_POSTCHANGE && freq->old > freq->new)) { ++ loops_per_jiffy = cpufreq_scale(glb_lpj_ref, ++ glb_lpj_ref_freq, ++ freq->new); ++ ++ for_each_cpu(cpu, cpus) { ++ lpj = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu), ++ per_cpu(pcp_lpj_ref_freq, cpu), ++ freq->new); ++ cpu_data[cpu].udelay_val = (unsigned int)lpj; ++ } ++ } ++ ++ return NOTIFY_OK; ++} ++ ++static struct notifier_block cpufreq_notifier = { ++ .notifier_call = cpufreq_callback, ++}; ++ ++static int __init register_cpufreq_notifier(void) ++{ ++ return cpufreq_register_notifier(&cpufreq_notifier, ++ CPUFREQ_TRANSITION_NOTIFIER); ++} ++core_initcall(register_cpufreq_notifier); ++ ++#endif /* CONFIG_CPU_FREQ */ ++ + /* + * forward reference + */ +diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S +index 36f2e860ba3e..be63fff95b2a 100644 +--- a/arch/mips/kernel/vmlinux.lds.S ++++ b/arch/mips/kernel/vmlinux.lds.S +@@ -50,7 +50,7 @@ SECTIONS + /* . = 0xa800000000300000; */ + . = 0xffffffff80300000; + #endif +- . = VMLINUX_LOAD_ADDRESS; ++ . = LINKER_LOAD_ADDRESS; + /* read-only */ + _text = .; /* Text and read-only data */ + .text : { +diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h +index bbf5c79cce7a..8b204cd1f531 100644 +--- a/arch/openrisc/include/asm/uaccess.h ++++ b/arch/openrisc/include/asm/uaccess.h +@@ -58,8 +58,12 @@ + /* Ensure that addr is below task's addr_limit */ + #define __addr_ok(addr) ((unsigned long) addr < get_fs()) + +-#define access_ok(type, addr, size) \ +- __range_ok((unsigned long)addr, (unsigned long)size) ++#define access_ok(type, addr, size) \ ++({ \ ++ unsigned long __ao_addr = (unsigned long)(addr); \ ++ unsigned long __ao_size = (unsigned long)(size); \ ++ __range_ok(__ao_addr, __ao_size); \ ++}) + + /* + * These are the main single-value transfer routines. They automatically +diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c +index a4b31e17492d..5195a4fc3e41 100644 +--- a/arch/powerpc/kernel/dt_cpu_ftrs.c ++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c +@@ -346,6 +346,14 @@ static int __init feat_enable_dscr(struct dt_cpu_feature *f) + { + u64 lpcr; + ++ /* ++ * Linux relies on FSCR[DSCR] being clear, so that we can take the ++ * facility unavailable interrupt and track the task's usage of DSCR. ++ * See facility_unavailable_exception(). ++ * Clear the bit here so that feat_enable() doesn't set it. ++ */ ++ f->fscr_bit_nr = -1; ++ + feat_enable(f); + + lpcr = mfspr(SPRN_LPCR); +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 8e88f78e57db..fd04692412db 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -685,6 +685,23 @@ static void __init tm_init(void) + static void tm_init(void) { } + #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */ + ++#ifdef CONFIG_PPC64 ++static void __init save_fscr_to_task(void) ++{ ++ /* ++ * Ensure the init_task (pid 0, aka swapper) uses the value of FSCR we ++ * have configured via the device tree features or via __init_FSCR(). ++ * That value will then be propagated to pid 1 (init) and all future ++ * processes. ++ */ ++ if (early_cpu_has_feature(CPU_FTR_ARCH_207S)) ++ init_task.thread.fscr = mfspr(SPRN_FSCR); ++} ++#else ++static inline void save_fscr_to_task(void) {}; ++#endif ++ ++ + void __init early_init_devtree(void *params) + { + phys_addr_t limit; +@@ -770,6 +787,8 @@ void __init early_init_devtree(void *params) + BUG(); + } + ++ save_fscr_to_task(); ++ + #if defined(CONFIG_SMP) && defined(CONFIG_PPC64) + /* We'll later wait for secondaries to check in; there are + * NCPUS-1 non-boot CPUs :-) +diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c +index 43e7b93f27c7..d16adcd93921 100644 +--- a/arch/powerpc/platforms/cell/spufs/file.c ++++ b/arch/powerpc/platforms/cell/spufs/file.c +@@ -1991,8 +1991,9 @@ static ssize_t __spufs_mbox_info_read(struct spu_context *ctx, + static ssize_t spufs_mbox_info_read(struct file *file, char __user *buf, + size_t len, loff_t *pos) + { +- int ret; + struct spu_context *ctx = file->private_data; ++ u32 stat, data; ++ int ret; + + if (!access_ok(VERIFY_WRITE, buf, len)) + return -EFAULT; +@@ -2001,11 +2002,16 @@ static ssize_t spufs_mbox_info_read(struct file *file, char __user *buf, + if (ret) + return ret; + spin_lock(&ctx->csa.register_lock); +- ret = __spufs_mbox_info_read(ctx, buf, len, pos); ++ stat = ctx->csa.prob.mb_stat_R; ++ data = ctx->csa.prob.pu_mb_R; + spin_unlock(&ctx->csa.register_lock); + spu_release_saved(ctx); + +- return ret; ++ /* EOF if there's no entry in the mbox */ ++ if (!(stat & 0x0000ff)) ++ return 0; ++ ++ return simple_read_from_buffer(buf, len, pos, &data, sizeof(data)); + } + + static const struct file_operations spufs_mbox_info_fops = { +@@ -2032,6 +2038,7 @@ static ssize_t spufs_ibox_info_read(struct file *file, char __user *buf, + size_t len, loff_t *pos) + { + struct spu_context *ctx = file->private_data; ++ u32 stat, data; + int ret; + + if (!access_ok(VERIFY_WRITE, buf, len)) +@@ -2041,11 +2048,16 @@ static ssize_t spufs_ibox_info_read(struct file *file, char __user *buf, + if (ret) + return ret; + spin_lock(&ctx->csa.register_lock); +- ret = __spufs_ibox_info_read(ctx, buf, len, pos); ++ stat = ctx->csa.prob.mb_stat_R; ++ data = ctx->csa.priv2.puint_mb_R; + spin_unlock(&ctx->csa.register_lock); + spu_release_saved(ctx); + +- return ret; ++ /* EOF if there's no entry in the ibox */ ++ if (!(stat & 0xff0000)) ++ return 0; ++ ++ return simple_read_from_buffer(buf, len, pos, &data, sizeof(data)); + } + + static const struct file_operations spufs_ibox_info_fops = { +@@ -2054,6 +2066,11 @@ static const struct file_operations spufs_ibox_info_fops = { + .llseek = generic_file_llseek, + }; + ++static size_t spufs_wbox_info_cnt(struct spu_context *ctx) ++{ ++ return (4 - ((ctx->csa.prob.mb_stat_R & 0x00ff00) >> 8)) * sizeof(u32); ++} ++ + static ssize_t __spufs_wbox_info_read(struct spu_context *ctx, + char __user *buf, size_t len, loff_t *pos) + { +@@ -2062,7 +2079,7 @@ static ssize_t __spufs_wbox_info_read(struct spu_context *ctx, + u32 wbox_stat; + + wbox_stat = ctx->csa.prob.mb_stat_R; +- cnt = 4 - ((wbox_stat & 0x00ff00) >> 8); ++ cnt = spufs_wbox_info_cnt(ctx); + for (i = 0; i < cnt; i++) { + data[i] = ctx->csa.spu_mailbox_data[i]; + } +@@ -2075,7 +2092,8 @@ static ssize_t spufs_wbox_info_read(struct file *file, char __user *buf, + size_t len, loff_t *pos) + { + struct spu_context *ctx = file->private_data; +- int ret; ++ u32 data[ARRAY_SIZE(ctx->csa.spu_mailbox_data)]; ++ int ret, count; + + if (!access_ok(VERIFY_WRITE, buf, len)) + return -EFAULT; +@@ -2084,11 +2102,13 @@ static ssize_t spufs_wbox_info_read(struct file *file, char __user *buf, + if (ret) + return ret; + spin_lock(&ctx->csa.register_lock); +- ret = __spufs_wbox_info_read(ctx, buf, len, pos); ++ count = spufs_wbox_info_cnt(ctx); ++ memcpy(&data, &ctx->csa.spu_mailbox_data, sizeof(data)); + spin_unlock(&ctx->csa.register_lock); + spu_release_saved(ctx); + +- return ret; ++ return simple_read_from_buffer(buf, len, pos, &data, ++ count * sizeof(u32)); + } + + static const struct file_operations spufs_wbox_info_fops = { +@@ -2097,27 +2117,33 @@ static const struct file_operations spufs_wbox_info_fops = { + .llseek = generic_file_llseek, + }; + +-static ssize_t __spufs_dma_info_read(struct spu_context *ctx, +- char __user *buf, size_t len, loff_t *pos) ++static void spufs_get_dma_info(struct spu_context *ctx, ++ struct spu_dma_info *info) + { +- struct spu_dma_info info; +- struct mfc_cq_sr *qp, *spuqp; + int i; + +- info.dma_info_type = ctx->csa.priv2.spu_tag_status_query_RW; +- info.dma_info_mask = ctx->csa.lscsa->tag_mask.slot[0]; +- info.dma_info_status = ctx->csa.spu_chnldata_RW[24]; +- info.dma_info_stall_and_notify = ctx->csa.spu_chnldata_RW[25]; +- info.dma_info_atomic_command_status = ctx->csa.spu_chnldata_RW[27]; ++ info->dma_info_type = ctx->csa.priv2.spu_tag_status_query_RW; ++ info->dma_info_mask = ctx->csa.lscsa->tag_mask.slot[0]; ++ info->dma_info_status = ctx->csa.spu_chnldata_RW[24]; ++ info->dma_info_stall_and_notify = ctx->csa.spu_chnldata_RW[25]; ++ info->dma_info_atomic_command_status = ctx->csa.spu_chnldata_RW[27]; + for (i = 0; i < 16; i++) { +- qp = &info.dma_info_command_data[i]; +- spuqp = &ctx->csa.priv2.spuq[i]; ++ struct mfc_cq_sr *qp = &info->dma_info_command_data[i]; ++ struct mfc_cq_sr *spuqp = &ctx->csa.priv2.spuq[i]; + + qp->mfc_cq_data0_RW = spuqp->mfc_cq_data0_RW; + qp->mfc_cq_data1_RW = spuqp->mfc_cq_data1_RW; + qp->mfc_cq_data2_RW = spuqp->mfc_cq_data2_RW; + qp->mfc_cq_data3_RW = spuqp->mfc_cq_data3_RW; + } ++} ++ ++static ssize_t __spufs_dma_info_read(struct spu_context *ctx, ++ char __user *buf, size_t len, loff_t *pos) ++{ ++ struct spu_dma_info info; ++ ++ spufs_get_dma_info(ctx, &info); + + return simple_read_from_buffer(buf, len, pos, &info, + sizeof info); +@@ -2127,6 +2153,7 @@ static ssize_t spufs_dma_info_read(struct file *file, char __user *buf, + size_t len, loff_t *pos) + { + struct spu_context *ctx = file->private_data; ++ struct spu_dma_info info; + int ret; + + if (!access_ok(VERIFY_WRITE, buf, len)) +@@ -2136,11 +2163,12 @@ static ssize_t spufs_dma_info_read(struct file *file, char __user *buf, + if (ret) + return ret; + spin_lock(&ctx->csa.register_lock); +- ret = __spufs_dma_info_read(ctx, buf, len, pos); ++ spufs_get_dma_info(ctx, &info); + spin_unlock(&ctx->csa.register_lock); + spu_release_saved(ctx); + +- return ret; ++ return simple_read_from_buffer(buf, len, pos, &info, ++ sizeof(info)); + } + + static const struct file_operations spufs_dma_info_fops = { +@@ -2149,13 +2177,31 @@ static const struct file_operations spufs_dma_info_fops = { + .llseek = no_llseek, + }; + ++static void spufs_get_proxydma_info(struct spu_context *ctx, ++ struct spu_proxydma_info *info) ++{ ++ int i; ++ ++ info->proxydma_info_type = ctx->csa.prob.dma_querytype_RW; ++ info->proxydma_info_mask = ctx->csa.prob.dma_querymask_RW; ++ info->proxydma_info_status = ctx->csa.prob.dma_tagstatus_R; ++ ++ for (i = 0; i < 8; i++) { ++ struct mfc_cq_sr *qp = &info->proxydma_info_command_data[i]; ++ struct mfc_cq_sr *puqp = &ctx->csa.priv2.puq[i]; ++ ++ qp->mfc_cq_data0_RW = puqp->mfc_cq_data0_RW; ++ qp->mfc_cq_data1_RW = puqp->mfc_cq_data1_RW; ++ qp->mfc_cq_data2_RW = puqp->mfc_cq_data2_RW; ++ qp->mfc_cq_data3_RW = puqp->mfc_cq_data3_RW; ++ } ++} ++ + static ssize_t __spufs_proxydma_info_read(struct spu_context *ctx, + char __user *buf, size_t len, loff_t *pos) + { + struct spu_proxydma_info info; +- struct mfc_cq_sr *qp, *puqp; + int ret = sizeof info; +- int i; + + if (len < ret) + return -EINVAL; +@@ -2163,18 +2209,7 @@ static ssize_t __spufs_proxydma_info_read(struct spu_context *ctx, + if (!access_ok(VERIFY_WRITE, buf, len)) + return -EFAULT; + +- info.proxydma_info_type = ctx->csa.prob.dma_querytype_RW; +- info.proxydma_info_mask = ctx->csa.prob.dma_querymask_RW; +- info.proxydma_info_status = ctx->csa.prob.dma_tagstatus_R; +- for (i = 0; i < 8; i++) { +- qp = &info.proxydma_info_command_data[i]; +- puqp = &ctx->csa.priv2.puq[i]; +- +- qp->mfc_cq_data0_RW = puqp->mfc_cq_data0_RW; +- qp->mfc_cq_data1_RW = puqp->mfc_cq_data1_RW; +- qp->mfc_cq_data2_RW = puqp->mfc_cq_data2_RW; +- qp->mfc_cq_data3_RW = puqp->mfc_cq_data3_RW; +- } ++ spufs_get_proxydma_info(ctx, &info); + + return simple_read_from_buffer(buf, len, pos, &info, + sizeof info); +@@ -2184,17 +2219,19 @@ static ssize_t spufs_proxydma_info_read(struct file *file, char __user *buf, + size_t len, loff_t *pos) + { + struct spu_context *ctx = file->private_data; ++ struct spu_proxydma_info info; + int ret; + + ret = spu_acquire_saved(ctx); + if (ret) + return ret; + spin_lock(&ctx->csa.register_lock); +- ret = __spufs_proxydma_info_read(ctx, buf, len, pos); ++ spufs_get_proxydma_info(ctx, &info); + spin_unlock(&ctx->csa.register_lock); + spu_release_saved(ctx); + +- return ret; ++ return simple_read_from_buffer(buf, len, pos, &info, ++ sizeof(info)); + } + + static const struct file_operations spufs_proxydma_info_fops = { +diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c +index 3d3c989e44dd..8d49ba370c50 100644 +--- a/arch/powerpc/platforms/powernv/smp.c ++++ b/arch/powerpc/platforms/powernv/smp.c +@@ -171,7 +171,6 @@ static void pnv_smp_cpu_kill_self(void) + /* Standard hot unplug procedure */ + + idle_task_exit(); +- current->active_mm = NULL; /* for sanity */ + cpu = smp_processor_id(); + DBG("CPU%d offline\n", cpu); + generic_set_cpu_dead(cpu); +diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c +index 1c31a08cdd54..2aa9f3de223c 100644 +--- a/arch/powerpc/sysdev/xive/common.c ++++ b/arch/powerpc/sysdev/xive/common.c +@@ -23,6 +23,7 @@ + #include <linux/slab.h> + #include <linux/spinlock.h> + #include <linux/msi.h> ++#include <linux/vmalloc.h> + + #include <asm/prom.h> + #include <asm/io.h> +@@ -933,12 +934,16 @@ EXPORT_SYMBOL_GPL(is_xive_irq); + void xive_cleanup_irq_data(struct xive_irq_data *xd) + { + if (xd->eoi_mmio) { ++ unmap_kernel_range((unsigned long)xd->eoi_mmio, ++ 1u << xd->esb_shift); + iounmap(xd->eoi_mmio); + if (xd->eoi_mmio == xd->trig_mmio) + xd->trig_mmio = NULL; + xd->eoi_mmio = NULL; + } + if (xd->trig_mmio) { ++ unmap_kernel_range((unsigned long)xd->trig_mmio, ++ 1u << xd->esb_shift); + iounmap(xd->trig_mmio); + xd->trig_mmio = NULL; + } +diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h +index 32eb56e00c11..6e7816360a75 100644 +--- a/arch/sh/include/asm/uaccess.h ++++ b/arch/sh/include/asm/uaccess.h +@@ -16,8 +16,11 @@ + * sum := addr + size; carry? --> flag = true; + * if (sum >= addr_limit) flag = true; + */ +-#define __access_ok(addr, size) \ +- (__addr_ok((addr) + (size))) ++#define __access_ok(addr, size) ({ \ ++ unsigned long __ao_a = (addr), __ao_b = (size); \ ++ unsigned long __ao_end = __ao_a + __ao_b - !!__ao_b; \ ++ __ao_end >= __ao_a && __addr_ok(__ao_end); }) ++ + #define access_ok(type, addr, size) \ + (__chk_user_ptr(addr), \ + __access_ok((unsigned long __force)(addr), (size))) +diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c +index 16b50afe7b52..60f7205ebe40 100644 +--- a/arch/sparc/kernel/ptrace_32.c ++++ b/arch/sparc/kernel/ptrace_32.c +@@ -46,82 +46,79 @@ enum sparc_regset { + REGSET_FP, + }; + ++static int regwindow32_get(struct task_struct *target, ++ const struct pt_regs *regs, ++ u32 *uregs) ++{ ++ unsigned long reg_window = regs->u_regs[UREG_I6]; ++ int size = 16 * sizeof(u32); ++ ++ if (target == current) { ++ if (copy_from_user(uregs, (void __user *)reg_window, size)) ++ return -EFAULT; ++ } else { ++ if (access_process_vm(target, reg_window, uregs, size, ++ FOLL_FORCE) != size) ++ return -EFAULT; ++ } ++ return 0; ++} ++ ++static int regwindow32_set(struct task_struct *target, ++ const struct pt_regs *regs, ++ u32 *uregs) ++{ ++ unsigned long reg_window = regs->u_regs[UREG_I6]; ++ int size = 16 * sizeof(u32); ++ ++ if (target == current) { ++ if (copy_to_user((void __user *)reg_window, uregs, size)) ++ return -EFAULT; ++ } else { ++ if (access_process_vm(target, reg_window, uregs, size, ++ FOLL_FORCE | FOLL_WRITE) != size) ++ return -EFAULT; ++ } ++ return 0; ++} ++ + static int genregs32_get(struct task_struct *target, + const struct user_regset *regset, + unsigned int pos, unsigned int count, + void *kbuf, void __user *ubuf) + { + const struct pt_regs *regs = target->thread.kregs; +- unsigned long __user *reg_window; +- unsigned long *k = kbuf; +- unsigned long __user *u = ubuf; +- unsigned long reg; ++ u32 uregs[16]; ++ int ret; + + if (target == current) + flush_user_windows(); + +- pos /= sizeof(reg); +- count /= sizeof(reg); +- +- if (kbuf) { +- for (; count > 0 && pos < 16; count--) +- *k++ = regs->u_regs[pos++]; +- +- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6]; +- reg_window -= 16; +- for (; count > 0 && pos < 32; count--) { +- if (get_user(*k++, ®_window[pos++])) +- return -EFAULT; +- } +- } else { +- for (; count > 0 && pos < 16; count--) { +- if (put_user(regs->u_regs[pos++], u++)) +- return -EFAULT; +- } +- +- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6]; +- reg_window -= 16; +- for (; count > 0 && pos < 32; count--) { +- if (get_user(reg, ®_window[pos++]) || +- put_user(reg, u++)) +- return -EFAULT; +- } +- } +- while (count > 0) { +- switch (pos) { +- case 32: /* PSR */ +- reg = regs->psr; +- break; +- case 33: /* PC */ +- reg = regs->pc; +- break; +- case 34: /* NPC */ +- reg = regs->npc; +- break; +- case 35: /* Y */ +- reg = regs->y; +- break; +- case 36: /* WIM */ +- case 37: /* TBR */ +- reg = 0; +- break; +- default: +- goto finish; +- } ++ ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, ++ regs->u_regs, ++ 0, 16 * sizeof(u32)); ++ if (ret || !count) ++ return ret; + +- if (kbuf) +- *k++ = reg; +- else if (put_user(reg, u++)) ++ if (pos < 32 * sizeof(u32)) { ++ if (regwindow32_get(target, regs, uregs)) + return -EFAULT; +- pos++; +- count--; ++ ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, ++ uregs, ++ 16 * sizeof(u32), 32 * sizeof(u32)); ++ if (ret || !count) ++ return ret; + } +-finish: +- pos *= sizeof(reg); +- count *= sizeof(reg); + +- return user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf, +- 38 * sizeof(reg), -1); ++ uregs[0] = regs->psr; ++ uregs[1] = regs->pc; ++ uregs[2] = regs->npc; ++ uregs[3] = regs->y; ++ uregs[4] = 0; /* WIM */ ++ uregs[5] = 0; /* TBR */ ++ return user_regset_copyout(&pos, &count, &kbuf, &ubuf, ++ uregs, ++ 32 * sizeof(u32), 38 * sizeof(u32)); + } + + static int genregs32_set(struct task_struct *target, +@@ -130,82 +127,53 @@ static int genregs32_set(struct task_struct *target, + const void *kbuf, const void __user *ubuf) + { + struct pt_regs *regs = target->thread.kregs; +- unsigned long __user *reg_window; +- const unsigned long *k = kbuf; +- const unsigned long __user *u = ubuf; +- unsigned long reg; ++ u32 uregs[16]; ++ u32 psr; ++ int ret; + + if (target == current) + flush_user_windows(); + +- pos /= sizeof(reg); +- count /= sizeof(reg); +- +- if (kbuf) { +- for (; count > 0 && pos < 16; count--) +- regs->u_regs[pos++] = *k++; +- +- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6]; +- reg_window -= 16; +- for (; count > 0 && pos < 32; count--) { +- if (put_user(*k++, ®_window[pos++])) +- return -EFAULT; +- } +- } else { +- for (; count > 0 && pos < 16; count--) { +- if (get_user(reg, u++)) +- return -EFAULT; +- regs->u_regs[pos++] = reg; +- } +- +- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6]; +- reg_window -= 16; +- for (; count > 0 && pos < 32; count--) { +- if (get_user(reg, u++) || +- put_user(reg, ®_window[pos++])) +- return -EFAULT; +- } +- } +- while (count > 0) { +- unsigned long psr; ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ++ regs->u_regs, ++ 0, 16 * sizeof(u32)); ++ if (ret || !count) ++ return ret; + +- if (kbuf) +- reg = *k++; +- else if (get_user(reg, u++)) ++ if (pos < 32 * sizeof(u32)) { ++ if (regwindow32_get(target, regs, uregs)) + return -EFAULT; +- +- switch (pos) { +- case 32: /* PSR */ +- psr = regs->psr; +- psr &= ~(PSR_ICC | PSR_SYSCALL); +- psr |= (reg & (PSR_ICC | PSR_SYSCALL)); +- regs->psr = psr; +- break; +- case 33: /* PC */ +- regs->pc = reg; +- break; +- case 34: /* NPC */ +- regs->npc = reg; +- break; +- case 35: /* Y */ +- regs->y = reg; +- break; +- case 36: /* WIM */ +- case 37: /* TBR */ +- break; +- default: +- goto finish; +- } +- +- pos++; +- count--; ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ++ uregs, ++ 16 * sizeof(u32), 32 * sizeof(u32)); ++ if (ret) ++ return ret; ++ if (regwindow32_set(target, regs, uregs)) ++ return -EFAULT; ++ if (!count) ++ return 0; + } +-finish: +- pos *= sizeof(reg); +- count *= sizeof(reg); +- ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ++ &psr, ++ 32 * sizeof(u32), 33 * sizeof(u32)); ++ if (ret) ++ return ret; ++ regs->psr = (regs->psr & ~(PSR_ICC | PSR_SYSCALL)) | ++ (psr & (PSR_ICC | PSR_SYSCALL)); ++ if (!count) ++ return 0; ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ++ ®s->pc, ++ 33 * sizeof(u32), 34 * sizeof(u32)); ++ if (ret || !count) ++ return ret; ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ++ ®s->y, ++ 34 * sizeof(u32), 35 * sizeof(u32)); ++ if (ret || !count) ++ return ret; + return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, +- 38 * sizeof(reg), -1); ++ 35 * sizeof(u32), 38 * sizeof(u32)); + } + + static int fpregs32_get(struct task_struct *target, +diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c +index e1d965e90e16..0c478c85e380 100644 +--- a/arch/sparc/kernel/ptrace_64.c ++++ b/arch/sparc/kernel/ptrace_64.c +@@ -571,19 +571,13 @@ static int genregs32_get(struct task_struct *target, + for (; count > 0 && pos < 32; count--) { + if (access_process_vm(target, + (unsigned long) +- ®_window[pos], ++ ®_window[pos++], + ®, sizeof(reg), + FOLL_FORCE) + != sizeof(reg)) + return -EFAULT; +- if (access_process_vm(target, +- (unsigned long) u, +- ®, sizeof(reg), +- FOLL_FORCE | FOLL_WRITE) +- != sizeof(reg)) ++ if (put_user(reg, u++)) + return -EFAULT; +- pos++; +- u++; + } + } + } +@@ -683,12 +677,7 @@ static int genregs32_set(struct task_struct *target, + } + } else { + for (; count > 0 && pos < 32; count--) { +- if (access_process_vm(target, +- (unsigned long) +- u, +- ®, sizeof(reg), +- FOLL_FORCE) +- != sizeof(reg)) ++ if (get_user(reg, u++)) + return -EFAULT; + if (access_process_vm(target, + (unsigned long) +diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S +index 01d628ea3402..c6c4b877f3d2 100644 +--- a/arch/x86/boot/compressed/head_32.S ++++ b/arch/x86/boot/compressed/head_32.S +@@ -49,16 +49,17 @@ + * Position Independent Executable (PIE) so that linker won't optimize + * R_386_GOT32X relocation to its fixed symbol address. Older + * linkers generate R_386_32 relocations against locally defined symbols, +- * _bss, _ebss, _got and _egot, in PIE. It isn't wrong, just less ++ * _bss, _ebss, _got, _egot and _end, in PIE. It isn't wrong, just less + * optimal than R_386_RELATIVE. But the x86 kernel fails to properly handle + * R_386_32 relocations when relocating the kernel. To generate +- * R_386_RELATIVE relocations, we mark _bss, _ebss, _got and _egot as ++ * R_386_RELATIVE relocations, we mark _bss, _ebss, _got, _egot and _end as + * hidden: + */ + .hidden _bss + .hidden _ebss + .hidden _got + .hidden _egot ++ .hidden _end + + __HEAD + ENTRY(startup_32) +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index 9fa644c62839..474733f8b330 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -42,6 +42,7 @@ + .hidden _ebss + .hidden _got + .hidden _egot ++ .hidden _end + + __HEAD + .code32 +diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h +index 9f03ac233566..f7f9604b10cc 100644 +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -291,6 +291,7 @@ + #define X86_FEATURE_AMD_IBPB (13*32+12) /* "" Indirect Branch Prediction Barrier */ + #define X86_FEATURE_AMD_IBRS (13*32+14) /* "" Indirect Branch Restricted Speculation */ + #define X86_FEATURE_AMD_STIBP (13*32+15) /* "" Single Thread Indirect Branch Predictors */ ++#define X86_FEATURE_AMD_STIBP_ALWAYS_ON (13*32+17) /* "" Single Thread Indirect Branch Predictors always-on preferred */ + #define X86_FEATURE_AMD_SSBD (13*32+24) /* "" Speculative Store Bypass Disable */ + #define X86_FEATURE_VIRT_SSBD (13*32+25) /* Virtualized Speculative Store Bypass Disable */ + #define X86_FEATURE_AMD_SSB_NO (13*32+26) /* "" Speculative Store Bypass is fixed in hardware. */ +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index 09c7466c4880..e3f70c60e8cc 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -232,6 +232,7 @@ enum spectre_v2_mitigation { + enum spectre_v2_user_mitigation { + SPECTRE_V2_USER_NONE, + SPECTRE_V2_USER_STRICT, ++ SPECTRE_V2_USER_STRICT_PREFERRED, + SPECTRE_V2_USER_PRCTL, + SPECTRE_V2_USER_SECCOMP, + }; +diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h +index 07a25753e85c..bc97b8c0fdf7 100644 +--- a/arch/x86/include/asm/set_memory.h ++++ b/arch/x86/include/asm/set_memory.h +@@ -90,28 +90,35 @@ void set_kernel_text_rw(void); + void set_kernel_text_ro(void); + + #ifdef CONFIG_X86_64 +-static inline int set_mce_nospec(unsigned long pfn) ++/* ++ * Prevent speculative access to the page by either unmapping ++ * it (if we do not require access to any part of the page) or ++ * marking it uncacheable (if we want to try to retrieve data ++ * from non-poisoned lines in the page). ++ */ ++static inline int set_mce_nospec(unsigned long pfn, bool unmap) + { + unsigned long decoy_addr; + int rc; + + /* +- * Mark the linear address as UC to make sure we don't log more +- * errors because of speculative access to the page. + * We would like to just call: +- * set_memory_uc((unsigned long)pfn_to_kaddr(pfn), 1); ++ * set_memory_XX((unsigned long)pfn_to_kaddr(pfn), 1); + * but doing that would radically increase the odds of a + * speculative access to the poison page because we'd have + * the virtual address of the kernel 1:1 mapping sitting + * around in registers. + * Instead we get tricky. We create a non-canonical address + * that looks just like the one we want, but has bit 63 flipped. +- * This relies on set_memory_uc() properly sanitizing any __pa() ++ * This relies on set_memory_XX() properly sanitizing any __pa() + * results with __PHYSICAL_MASK or PTE_PFN_MASK. + */ + decoy_addr = (pfn << PAGE_SHIFT) + (PAGE_OFFSET ^ BIT(63)); + +- rc = set_memory_uc(decoy_addr, 1); ++ if (unmap) ++ rc = set_memory_np(decoy_addr, 1); ++ else ++ rc = set_memory_uc(decoy_addr, 1); + if (rc) + pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn); + return rc; +diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h +index 971830341061..82b0ff6cac97 100644 +--- a/arch/x86/include/asm/uaccess.h ++++ b/arch/x86/include/asm/uaccess.h +@@ -711,7 +711,17 @@ extern struct movsl_mask { + * checking before using them, but you have to surround them with the + * user_access_begin/end() pair. + */ +-#define user_access_begin() __uaccess_begin() ++static __must_check inline bool user_access_begin(int type, ++ const void __user *ptr, ++ size_t len) ++{ ++ if (unlikely(!access_ok(type, ptr, len))) ++ return 0; ++ __uaccess_begin_nospec(); ++ return 1; ++} ++ ++#define user_access_begin(a, b, c) user_access_begin(a, b, c) + #define user_access_end() __uaccess_end() + + #define unsafe_put_user(x, ptr, err_label) \ +diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c +index b481b95bd8f6..923b4bac9613 100644 +--- a/arch/x86/kernel/amd_nb.c ++++ b/arch/x86/kernel/amd_nb.c +@@ -11,14 +11,17 @@ + #include <linux/errno.h> + #include <linux/export.h> + #include <linux/spinlock.h> ++#include <linux/pci_ids.h> + #include <asm/amd_nb.h> + + #define PCI_DEVICE_ID_AMD_17H_ROOT 0x1450 + #define PCI_DEVICE_ID_AMD_17H_M10H_ROOT 0x15d0 +-#define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463 ++#define PCI_DEVICE_ID_AMD_17H_M30H_ROOT 0x1480 + #define PCI_DEVICE_ID_AMD_17H_DF_F4 0x1464 +-#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F3 0x15eb + #define PCI_DEVICE_ID_AMD_17H_M10H_DF_F4 0x15ec ++#define PCI_DEVICE_ID_AMD_17H_M30H_DF_F4 0x1494 ++#define PCI_DEVICE_ID_AMD_17H_M70H_DF_F4 0x1444 ++#define PCI_DEVICE_ID_AMD_19H_DF_F4 0x1654 + + /* Protect the PCI config register pairs used for SMN and DF indirect access. */ + static DEFINE_MUTEX(smn_mutex); +@@ -28,9 +31,11 @@ static u32 *flush_words; + static const struct pci_device_id amd_root_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_ROOT) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_ROOT) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M30H_ROOT) }, + {} + }; + ++ + #define PCI_DEVICE_ID_AMD_CNB17H_F4 0x1704 + + const struct pci_device_id amd_nb_misc_ids[] = { +@@ -44,7 +49,10 @@ const struct pci_device_id amd_nb_misc_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F3) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M30H_DF_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M70H_DF_F3) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_DF_F3) }, + {} + }; + EXPORT_SYMBOL_GPL(amd_nb_misc_ids); +@@ -57,6 +65,9 @@ static const struct pci_device_id amd_nb_link_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F4) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F4) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M30H_DF_F4) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M70H_DF_F4) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_DF_F4) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F4) }, + {} + }; +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index 120769955687..de69090ca142 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -1122,8 +1122,7 @@ static const int amd_erratum_383[] = + + /* #1054: Instructions Retired Performance Counter May Be Inaccurate */ + static const int amd_erratum_1054[] = +- AMD_OSVW_ERRATUM(0, AMD_MODEL_RANGE(0x17, 0, 0, 0x2f, 0xf)); +- ++ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0, 0, 0x2f, 0xf)); + + static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum) + { +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index cf07437cd106..bf554ed2fd51 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -61,7 +61,7 @@ static u64 __ro_after_init x86_spec_ctrl_mask = SPEC_CTRL_IBRS; + u64 __ro_after_init x86_amd_ls_cfg_base; + u64 __ro_after_init x86_amd_ls_cfg_ssbd_mask; + +-/* Control conditional STIPB in switch_to() */ ++/* Control conditional STIBP in switch_to() */ + DEFINE_STATIC_KEY_FALSE(switch_to_cond_stibp); + /* Control conditional IBPB in switch_mm() */ + DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb); +@@ -581,7 +581,9 @@ early_param("nospectre_v1", nospectre_v1_cmdline); + static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init = + SPECTRE_V2_NONE; + +-static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init = ++static enum spectre_v2_user_mitigation spectre_v2_user_stibp __ro_after_init = ++ SPECTRE_V2_USER_NONE; ++static enum spectre_v2_user_mitigation spectre_v2_user_ibpb __ro_after_init = + SPECTRE_V2_USER_NONE; + + #ifdef CONFIG_RETPOLINE +@@ -633,10 +635,11 @@ enum spectre_v2_user_cmd { + }; + + static const char * const spectre_v2_user_strings[] = { +- [SPECTRE_V2_USER_NONE] = "User space: Vulnerable", +- [SPECTRE_V2_USER_STRICT] = "User space: Mitigation: STIBP protection", +- [SPECTRE_V2_USER_PRCTL] = "User space: Mitigation: STIBP via prctl", +- [SPECTRE_V2_USER_SECCOMP] = "User space: Mitigation: STIBP via seccomp and prctl", ++ [SPECTRE_V2_USER_NONE] = "User space: Vulnerable", ++ [SPECTRE_V2_USER_STRICT] = "User space: Mitigation: STIBP protection", ++ [SPECTRE_V2_USER_STRICT_PREFERRED] = "User space: Mitigation: STIBP always-on protection", ++ [SPECTRE_V2_USER_PRCTL] = "User space: Mitigation: STIBP via prctl", ++ [SPECTRE_V2_USER_SECCOMP] = "User space: Mitigation: STIBP via seccomp and prctl", + }; + + static const struct { +@@ -748,23 +751,36 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) + pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n", + static_key_enabled(&switch_mm_always_ibpb) ? + "always-on" : "conditional"); ++ ++ spectre_v2_user_ibpb = mode; + } + +- /* If enhanced IBRS is enabled no STIPB required */ +- if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED) ++ /* ++ * If enhanced IBRS is enabled or SMT impossible, STIBP is not ++ * required. ++ */ ++ if (!smt_possible || spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED) + return; + + /* +- * If SMT is not possible or STIBP is not available clear the STIPB +- * mode. ++ * At this point, an STIBP mode other than "off" has been set. ++ * If STIBP support is not being forced, check if STIBP always-on ++ * is preferred. + */ +- if (!smt_possible || !boot_cpu_has(X86_FEATURE_STIBP)) ++ if (mode != SPECTRE_V2_USER_STRICT && ++ boot_cpu_has(X86_FEATURE_AMD_STIBP_ALWAYS_ON)) ++ mode = SPECTRE_V2_USER_STRICT_PREFERRED; ++ ++ /* ++ * If STIBP is not available, clear the STIBP mode. ++ */ ++ if (!boot_cpu_has(X86_FEATURE_STIBP)) + mode = SPECTRE_V2_USER_NONE; ++ ++ spectre_v2_user_stibp = mode; ++ + set_mode: +- spectre_v2_user = mode; +- /* Only print the STIBP mode when SMT possible */ +- if (smt_possible) +- pr_info("%s\n", spectre_v2_user_strings[mode]); ++ pr_info("%s\n", spectre_v2_user_strings[mode]); + } + + static const char * const spectre_v2_strings[] = { +@@ -995,10 +1011,11 @@ void arch_smt_update(void) + { + mutex_lock(&spec_ctrl_mutex); + +- switch (spectre_v2_user) { ++ switch (spectre_v2_user_stibp) { + case SPECTRE_V2_USER_NONE: + break; + case SPECTRE_V2_USER_STRICT: ++ case SPECTRE_V2_USER_STRICT_PREFERRED: + update_stibp_strict(); + break; + case SPECTRE_V2_USER_PRCTL: +@@ -1227,13 +1244,19 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl) + { + switch (ctrl) { + case PR_SPEC_ENABLE: +- if (spectre_v2_user == SPECTRE_V2_USER_NONE) ++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE && ++ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE) + return 0; + /* + * Indirect branch speculation is always disabled in strict +- * mode. ++ * mode. It can neither be enabled if it was force-disabled ++ * by a previous prctl call. ++ + */ +- if (spectre_v2_user == SPECTRE_V2_USER_STRICT) ++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT || ++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT || ++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED || ++ task_spec_ib_force_disable(task)) + return -EPERM; + task_clear_spec_ib_disable(task); + task_update_spec_tif(task); +@@ -1244,9 +1267,12 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl) + * Indirect branch speculation is always allowed when + * mitigation is force disabled. + */ +- if (spectre_v2_user == SPECTRE_V2_USER_NONE) ++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE && ++ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE) + return -EPERM; +- if (spectre_v2_user == SPECTRE_V2_USER_STRICT) ++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT || ++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT || ++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED) + return 0; + task_set_spec_ib_disable(task); + if (ctrl == PR_SPEC_FORCE_DISABLE) +@@ -1277,7 +1303,8 @@ void arch_seccomp_spec_mitigate(struct task_struct *task) + { + if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP) + ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE); +- if (spectre_v2_user == SPECTRE_V2_USER_SECCOMP) ++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP || ++ spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP) + ib_prctl_set(task, PR_SPEC_FORCE_DISABLE); + } + #endif +@@ -1306,21 +1333,24 @@ static int ib_prctl_get(struct task_struct *task) + if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) + return PR_SPEC_NOT_AFFECTED; + +- switch (spectre_v2_user) { +- case SPECTRE_V2_USER_NONE: ++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE && ++ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE) + return PR_SPEC_ENABLE; +- case SPECTRE_V2_USER_PRCTL: +- case SPECTRE_V2_USER_SECCOMP: ++ else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT || ++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT || ++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED) ++ return PR_SPEC_DISABLE; ++ else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_PRCTL || ++ spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP || ++ spectre_v2_user_stibp == SPECTRE_V2_USER_PRCTL || ++ spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP) { + if (task_spec_ib_force_disable(task)) + return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE; + if (task_spec_ib_disable(task)) + return PR_SPEC_PRCTL | PR_SPEC_DISABLE; + return PR_SPEC_PRCTL | PR_SPEC_ENABLE; +- case SPECTRE_V2_USER_STRICT: +- return PR_SPEC_DISABLE; +- default: ++ } else + return PR_SPEC_NOT_AFFECTED; +- } + } + + int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which) +@@ -1559,11 +1589,13 @@ static char *stibp_state(void) + if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED) + return ""; + +- switch (spectre_v2_user) { ++ switch (spectre_v2_user_stibp) { + case SPECTRE_V2_USER_NONE: + return ", STIBP: disabled"; + case SPECTRE_V2_USER_STRICT: + return ", STIBP: forced"; ++ case SPECTRE_V2_USER_STRICT_PREFERRED: ++ return ", STIBP: always-on"; + case SPECTRE_V2_USER_PRCTL: + case SPECTRE_V2_USER_SECCOMP: + if (static_key_enabled(&switch_to_cond_stibp)) +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 1f69b12d5bb8..2a13468f8773 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -535,6 +535,13 @@ bool mce_is_memory_error(struct mce *m) + } + EXPORT_SYMBOL_GPL(mce_is_memory_error); + ++static bool whole_page(struct mce *m) ++{ ++ if (!mca_cfg.ser || !(m->status & MCI_STATUS_MISCV)) ++ return true; ++ return MCI_MISC_ADDR_LSB(m->misc) >= PAGE_SHIFT; ++} ++ + bool mce_is_correctable(struct mce *m) + { + if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED) +@@ -600,7 +607,7 @@ static int srao_decode_notifier(struct notifier_block *nb, unsigned long val, + if (mce_usable_address(mce) && (mce->severity == MCE_AO_SEVERITY)) { + pfn = mce->addr >> PAGE_SHIFT; + if (!memory_failure(pfn, 0)) +- set_mce_nospec(pfn); ++ set_mce_nospec(pfn, whole_page(mce)); + } + + return NOTIFY_OK; +@@ -1101,7 +1108,7 @@ static int do_memory_failure(struct mce *m) + if (ret) + pr_err("Memory error not recovered"); + else +- set_mce_nospec(m->addr >> PAGE_SHIFT); ++ set_mce_nospec(m->addr >> PAGE_SHIFT, whole_page(m)); + return ret; + } + +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index b8b08e61ac73..cd138bfd926c 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -413,28 +413,20 @@ static __always_inline void __speculation_ctrl_update(unsigned long tifp, + + lockdep_assert_irqs_disabled(); + +- /* +- * If TIF_SSBD is different, select the proper mitigation +- * method. Note that if SSBD mitigation is disabled or permanentely +- * enabled this branch can't be taken because nothing can set +- * TIF_SSBD. +- */ +- if (tif_diff & _TIF_SSBD) { +- if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) { ++ /* Handle change of TIF_SSBD depending on the mitigation method. */ ++ if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) { ++ if (tif_diff & _TIF_SSBD) + amd_set_ssb_virt_state(tifn); +- } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) { ++ } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) { ++ if (tif_diff & _TIF_SSBD) + amd_set_core_ssb_state(tifn); +- } else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) || +- static_cpu_has(X86_FEATURE_AMD_SSBD)) { +- msr |= ssbd_tif_to_spec_ctrl(tifn); +- updmsr = true; +- } ++ } else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) || ++ static_cpu_has(X86_FEATURE_AMD_SSBD)) { ++ updmsr |= !!(tif_diff & _TIF_SSBD); ++ msr |= ssbd_tif_to_spec_ctrl(tifn); + } + +- /* +- * Only evaluate TIF_SPEC_IB if conditional STIBP is enabled, +- * otherwise avoid the MSR write. +- */ ++ /* Only evaluate TIF_SPEC_IB if conditional STIBP is enabled. */ + if (IS_ENABLED(CONFIG_SMP) && + static_branch_unlikely(&switch_to_cond_stibp)) { + updmsr |= !!(tif_diff & _TIF_SPEC_IB); +diff --git a/arch/x86/kernel/process.h b/arch/x86/kernel/process.h +index 898e97cf6629..320ab978fb1f 100644 +--- a/arch/x86/kernel/process.h ++++ b/arch/x86/kernel/process.h +@@ -19,7 +19,7 @@ static inline void switch_to_extra(struct task_struct *prev, + if (IS_ENABLED(CONFIG_SMP)) { + /* + * Avoid __switch_to_xtra() invocation when conditional +- * STIPB is disabled and the only different bit is ++ * STIBP is disabled and the only different bit is + * TIF_SPEC_IB. For CONFIG_SMP=n TIF_SPEC_IB is not + * in the TIF_WORK_CTXSW masks. + */ +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index 8fd3cedd9acc..39f3cad58b6c 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -197,6 +197,14 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "MacBook5"), + }, + }, ++ { /* Handle problems with rebooting on Apple MacBook6,1 */ ++ .callback = set_pci_reboot, ++ .ident = "Apple MacBook6,1", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBook6,1"), ++ }, ++ }, + { /* Handle problems with rebooting on Apple MacBookPro5 */ + .callback = set_pci_reboot, + .ident = "Apple MacBookPro5", +diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c +index fddaefc51fb6..0680a2e9e06b 100644 +--- a/arch/x86/kernel/time.c ++++ b/arch/x86/kernel/time.c +@@ -24,10 +24,6 @@ + #include <asm/hpet.h> + #include <asm/time.h> + +-#ifdef CONFIG_X86_64 +-__visible volatile unsigned long jiffies __cacheline_aligned_in_smp = INITIAL_JIFFIES; +-#endif +- + unsigned long profile_pc(struct pt_regs *regs) + { + unsigned long pc = instruction_pointer(regs); +diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S +index 85e6d5620188..36593fd7dbe3 100644 +--- a/arch/x86/kernel/vmlinux.lds.S ++++ b/arch/x86/kernel/vmlinux.lds.S +@@ -36,13 +36,13 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT) + #ifdef CONFIG_X86_32 + OUTPUT_ARCH(i386) + ENTRY(phys_startup_32) +-jiffies = jiffies_64; + #else + OUTPUT_ARCH(i386:x86-64) + ENTRY(phys_startup_64) +-jiffies_64 = jiffies; + #endif + ++jiffies = jiffies_64; ++ + #if defined(CONFIG_X86_64) + /* + * On 64-bit, align RODATA to 2MB so we retain large page mappings for +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 62f1e4663bc3..18632f15b29f 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -294,11 +294,18 @@ kvm_mmu_calc_root_page_role(struct kvm_vcpu *vcpu); + void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask, u64 mmio_value) + { + BUG_ON((mmio_mask & mmio_value) != mmio_value); ++ WARN_ON(mmio_value & (shadow_nonpresent_or_rsvd_mask << shadow_nonpresent_or_rsvd_mask_len)); ++ WARN_ON(mmio_value & shadow_nonpresent_or_rsvd_lower_gfn_mask); + shadow_mmio_value = mmio_value | SPTE_SPECIAL_MASK; + shadow_mmio_mask = mmio_mask | SPTE_SPECIAL_MASK; + } + EXPORT_SYMBOL_GPL(kvm_mmu_set_mmio_spte_mask); + ++static bool is_mmio_spte(u64 spte) ++{ ++ return (spte & shadow_mmio_mask) == shadow_mmio_value; ++} ++ + static inline bool sp_ad_disabled(struct kvm_mmu_page *sp) + { + return sp->role.ad_disabled; +@@ -306,7 +313,7 @@ static inline bool sp_ad_disabled(struct kvm_mmu_page *sp) + + static inline bool spte_ad_enabled(u64 spte) + { +- MMU_WARN_ON((spte & shadow_mmio_mask) == shadow_mmio_value); ++ MMU_WARN_ON(is_mmio_spte(spte)); + return !(spte & shadow_acc_track_value); + } + +@@ -317,13 +324,13 @@ static bool is_nx_huge_page_enabled(void) + + static inline u64 spte_shadow_accessed_mask(u64 spte) + { +- MMU_WARN_ON((spte & shadow_mmio_mask) == shadow_mmio_value); ++ MMU_WARN_ON(is_mmio_spte(spte)); + return spte_ad_enabled(spte) ? shadow_accessed_mask : 0; + } + + static inline u64 spte_shadow_dirty_mask(u64 spte) + { +- MMU_WARN_ON((spte & shadow_mmio_mask) == shadow_mmio_value); ++ MMU_WARN_ON(is_mmio_spte(spte)); + return spte_ad_enabled(spte) ? shadow_dirty_mask : 0; + } + +@@ -393,11 +400,6 @@ static void mark_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, u64 gfn, + mmu_spte_set(sptep, mask); + } + +-static bool is_mmio_spte(u64 spte) +-{ +- return (spte & shadow_mmio_mask) == shadow_mmio_value; +-} +- + static gfn_t get_mmio_spte_gfn(u64 spte) + { + u64 gpa = spte & shadow_nonpresent_or_rsvd_lower_gfn_mask; +@@ -479,16 +481,23 @@ static void kvm_mmu_reset_all_pte_masks(void) + * If the CPU has 46 or less physical address bits, then set an + * appropriate mask to guard against L1TF attacks. Otherwise, it is + * assumed that the CPU is not vulnerable to L1TF. ++ * ++ * Some Intel CPUs address the L1 cache using more PA bits than are ++ * reported by CPUID. Use the PA width of the L1 cache when possible ++ * to achieve more effective mitigation, e.g. if system RAM overlaps ++ * the most significant bits of legal physical address space. + */ ++ shadow_nonpresent_or_rsvd_mask = 0; + low_phys_bits = boot_cpu_data.x86_phys_bits; +- if (boot_cpu_data.x86_phys_bits < +- 52 - shadow_nonpresent_or_rsvd_mask_len) { ++ if (boot_cpu_has_bug(X86_BUG_L1TF) && ++ !WARN_ON_ONCE(boot_cpu_data.x86_cache_bits >= ++ 52 - shadow_nonpresent_or_rsvd_mask_len)) { ++ low_phys_bits = boot_cpu_data.x86_cache_bits ++ - shadow_nonpresent_or_rsvd_mask_len; + shadow_nonpresent_or_rsvd_mask = +- rsvd_bits(boot_cpu_data.x86_phys_bits - +- shadow_nonpresent_or_rsvd_mask_len, +- boot_cpu_data.x86_phys_bits - 1); +- low_phys_bits -= shadow_nonpresent_or_rsvd_mask_len; ++ rsvd_bits(low_phys_bits, boot_cpu_data.x86_cache_bits - 1); + } ++ + shadow_nonpresent_or_rsvd_lower_gfn_mask = + GENMASK_ULL(low_phys_bits - 1, PAGE_SHIFT); + } +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 226db3dc490b..2aafb6c79134 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -3229,8 +3229,8 @@ static int nested_svm_exit_special(struct vcpu_svm *svm) + return NESTED_EXIT_HOST; + break; + case SVM_EXIT_EXCP_BASE + PF_VECTOR: +- /* When we're shadowing, trap PFs, but not async PF */ +- if (!npt_enabled && svm->vcpu.arch.apf.host_apf_reason == 0) ++ /* Trap async PF even if not shadowing */ ++ if (!npt_enabled || svm->vcpu.arch.apf.host_apf_reason) + return NESTED_EXIT_HOST; + break; + default: +@@ -3319,7 +3319,7 @@ static inline void copy_vmcb_control_area(struct vmcb *dst_vmcb, struct vmcb *fr + dst->iopm_base_pa = from->iopm_base_pa; + dst->msrpm_base_pa = from->msrpm_base_pa; + dst->tsc_offset = from->tsc_offset; +- dst->asid = from->asid; ++ /* asid not copied, it is handled manually for svm->vmcb. */ + dst->tlb_ctl = from->tlb_ctl; + dst->int_ctl = from->int_ctl; + dst->int_vector = from->int_vector; +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index f08c287b6242..2c4baff7553b 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -9683,7 +9683,7 @@ static bool nested_vmx_exit_reflected(struct kvm_vcpu *vcpu, u32 exit_reason) + vmcs_read32(VM_EXIT_INTR_ERROR_CODE), + KVM_ISA_VMX); + +- switch (exit_reason) { ++ switch ((u16)exit_reason) { + case EXIT_REASON_EXCEPTION_NMI: + if (is_nmi(intr_info)) + return false; +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index b0fd24ee08d2..c53df0b95385 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -7525,9 +7525,8 @@ static void vcpu_load_eoi_exitmap(struct kvm_vcpu *vcpu) + kvm_x86_ops->load_eoi_exitmap(vcpu, eoi_exit_bitmap); + } + +-int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, +- unsigned long start, unsigned long end, +- bool blockable) ++void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, ++ unsigned long start, unsigned long end) + { + unsigned long apic_address; + +@@ -7538,8 +7537,6 @@ int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, + apic_address = gfn_to_hva(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT); + if (start <= apic_address && apic_address < end) + kvm_make_all_cpus_request(kvm, KVM_REQ_APIC_PAGE_RELOAD); +- +- return 0; + } + + void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c +index fb5f29c60019..b1dba0987565 100644 +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -120,8 +120,6 @@ __ref void *alloc_low_pages(unsigned int num) + } else { + pfn = pgt_buf_end; + pgt_buf_end += num; +- printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n", +- pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1); + } + + for (i = 0; i < num; i++) { +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index e723559c386a..0c67a5a94de3 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -572,6 +572,10 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2fc0, pci_invalid_bar); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_invalid_bar); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_invalid_bar); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_invalid_bar); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0xa1ec, pci_invalid_bar); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0xa1ed, pci_invalid_bar); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0xa26c, pci_invalid_bar); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0xa26d, pci_invalid_bar); + + /* + * Device [1022:7808] +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 41228e545e82..5c6ecbb66608 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -869,6 +869,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + "acpi_cppc"); + if (ret) { + per_cpu(cpc_desc_ptr, pr->id) = NULL; ++ kobject_put(&cpc_ptr->kobj); + goto out_free; + } + +diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c +index 3837cad94f35..ca735dc24d37 100644 +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -172,7 +172,7 @@ int acpi_device_set_power(struct acpi_device *device, int state) + * possibly drop references to the power resources in use. + */ + state = ACPI_STATE_D3_HOT; +- /* If _PR3 is not available, use D3hot as the target state. */ ++ /* If D3cold is not supported, use D3hot as the target state. */ + if (!device->power.states[ACPI_STATE_D3_COLD].flags.valid) + target_state = state; + } else if (!device->power.states[state].flags.valid) { +diff --git a/drivers/acpi/evged.c b/drivers/acpi/evged.c +index f13ba2c07667..73f6093a5c16 100644 +--- a/drivers/acpi/evged.c ++++ b/drivers/acpi/evged.c +@@ -88,6 +88,8 @@ static acpi_status acpi_ged_request_interrupt(struct acpi_resource *ares, + struct resource r; + struct acpi_resource_irq *p = &ares->data.irq; + struct acpi_resource_extended_irq *pext = &ares->data.extended_irq; ++ char ev_name[5]; ++ u8 trigger; + + if (ares->type == ACPI_RESOURCE_TYPE_END_TAG) + return AE_OK; +@@ -96,14 +98,28 @@ static acpi_status acpi_ged_request_interrupt(struct acpi_resource *ares, + dev_err(dev, "unable to parse IRQ resource\n"); + return AE_ERROR; + } +- if (ares->type == ACPI_RESOURCE_TYPE_IRQ) ++ if (ares->type == ACPI_RESOURCE_TYPE_IRQ) { + gsi = p->interrupts[0]; +- else ++ trigger = p->triggering; ++ } else { + gsi = pext->interrupts[0]; ++ trigger = pext->triggering; ++ } + + irq = r.start; + +- if (ACPI_FAILURE(acpi_get_handle(handle, "_EVT", &evt_handle))) { ++ switch (gsi) { ++ case 0 ... 255: ++ sprintf(ev_name, "_%c%02hhX", ++ trigger == ACPI_EDGE_SENSITIVE ? 'E' : 'L', gsi); ++ ++ if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle))) ++ break; ++ /* fall through */ ++ default: ++ if (ACPI_SUCCESS(acpi_get_handle(handle, "_EVT", &evt_handle))) ++ break; ++ + dev_err(dev, "cannot locate _EVT method\n"); + return AE_ERROR; + } +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 1dcc48b9d33c..1cfa3ac1d91f 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -921,12 +921,9 @@ static void acpi_bus_init_power_state(struct acpi_device *device, int state) + + if (buffer.length && package + && package->type == ACPI_TYPE_PACKAGE +- && package->package.count) { +- int err = acpi_extract_power_resources(package, 0, +- &ps->resources); +- if (!err) +- device->power.flags.power_resources = 1; +- } ++ && package->package.count) ++ acpi_extract_power_resources(package, 0, &ps->resources); ++ + ACPI_FREE(buffer.pointer); + } + +@@ -973,14 +970,27 @@ static void acpi_bus_get_power_flags(struct acpi_device *device) + acpi_bus_init_power_state(device, i); + + INIT_LIST_HEAD(&device->power.states[ACPI_STATE_D3_COLD].resources); +- if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources)) +- device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1; + +- /* Set defaults for D0 and D3hot states (always valid) */ ++ /* Set the defaults for D0 and D3hot (always supported). */ + device->power.states[ACPI_STATE_D0].flags.valid = 1; + device->power.states[ACPI_STATE_D0].power = 100; + device->power.states[ACPI_STATE_D3_HOT].flags.valid = 1; + ++ /* ++ * Use power resources only if the D0 list of them is populated, because ++ * some platforms may provide _PR3 only to indicate D3cold support and ++ * in those cases the power resources list returned by it may be bogus. ++ */ ++ if (!list_empty(&device->power.states[ACPI_STATE_D0].resources)) { ++ device->power.flags.power_resources = 1; ++ /* ++ * D3cold is supported if the D3hot list of power resources is ++ * not empty. ++ */ ++ if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources)) ++ device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1; ++ } ++ + if (acpi_bus_init_power(device)) + device->flags.power_manageable = 0; + } +diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c +index f8150c7bfe88..0a8eb8961770 100644 +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -990,8 +990,10 @@ void acpi_sysfs_add_hotplug_profile(struct acpi_hotplug_profile *hotplug, + + error = kobject_init_and_add(&hotplug->kobj, + &acpi_hotplug_profile_ktype, hotplug_kobj, "%s", name); +- if (error) ++ if (error) { ++ kobject_put(&hotplug->kobj); + goto err_out; ++ } + + kobject_uevent(&hotplug->kobj, KOBJ_ADD); + return; +diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c +index e3e4d929e74f..ff6203c331ff 100644 +--- a/drivers/bluetooth/btbcm.c ++++ b/drivers/bluetooth/btbcm.c +@@ -324,6 +324,7 @@ static const struct bcm_subver_table bcm_uart_subver_table[] = { + { 0x4103, "BCM4330B1" }, /* 002.001.003 */ + { 0x410e, "BCM43341B0" }, /* 002.001.014 */ + { 0x4406, "BCM4324B3" }, /* 002.004.006 */ ++ { 0x4606, "BCM4324B5" }, /* 002.006.006 */ + { 0x6109, "BCM4335C0" }, /* 003.001.009 */ + { 0x610c, "BCM4354" }, /* 003.001.012 */ + { 0x2122, "BCM4343A0" }, /* 001.001.034 */ +@@ -334,6 +335,7 @@ static const struct bcm_subver_table bcm_uart_subver_table[] = { + }; + + static const struct bcm_subver_table bcm_usb_subver_table[] = { ++ { 0x2105, "BCM20703A1" }, /* 001.001.005 */ + { 0x210b, "BCM43142A0" }, /* 001.001.011 */ + { 0x2112, "BCM4314A0" }, /* 001.001.018 */ + { 0x2118, "BCM20702A0" }, /* 001.001.024 */ +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index 59e5fc5eec8f..3e386f68faa0 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -115,6 +115,7 @@ struct bcm_device { + u32 oper_speed; + int irq; + bool irq_active_low; ++ bool irq_acquired; + + #ifdef CONFIG_PM + struct hci_uart *hu; +@@ -288,6 +289,8 @@ static int bcm_request_irq(struct bcm_data *bcm) + goto unlock; + } + ++ bdev->irq_acquired = true; ++ + device_init_wakeup(bdev->dev, true); + + pm_runtime_set_autosuspend_delay(bdev->dev, +@@ -456,7 +459,7 @@ static int bcm_close(struct hci_uart *hu) + } + + if (bdev) { +- if (IS_ENABLED(CONFIG_PM) && bdev->irq > 0) { ++ if (IS_ENABLED(CONFIG_PM) && bdev->irq_acquired) { + devm_free_irq(bdev->dev, bdev->irq, bdev); + device_init_wakeup(bdev->dev, false); + pm_runtime_disable(bdev->dev); +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index c6271ce250b3..b161bdf60000 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -846,6 +846,7 @@ void intel_gtt_insert_page(dma_addr_t addr, + unsigned int flags) + { + intel_private.driver->write_entry(addr, pg, flags); ++ readl(intel_private.gtt + pg); + if (intel_private.driver->chipset_flush) + intel_private.driver->chipset_flush(); + } +@@ -871,7 +872,7 @@ void intel_gtt_insert_sg_entries(struct sg_table *st, + j++; + } + } +- wmb(); ++ readl(intel_private.gtt + j - 1); + if (intel_private.driver->chipset_flush) + intel_private.driver->chipset_flush(); + } +@@ -1105,6 +1106,7 @@ static void i9xx_cleanup(void) + + static void i9xx_chipset_flush(void) + { ++ wmb(); + if (intel_private.i9xx_flush_page) + writel(1, intel_private.i9xx_flush_page); + } +diff --git a/drivers/char/ipmi/ipmi_si_pci.c b/drivers/char/ipmi/ipmi_si_pci.c +index 022e03634ce2..9e9700b1a8e6 100644 +--- a/drivers/char/ipmi/ipmi_si_pci.c ++++ b/drivers/char/ipmi/ipmi_si_pci.c +@@ -18,11 +18,6 @@ module_param_named(trypci, si_trypci, bool, 0); + MODULE_PARM_DESC(trypci, "Setting this to zero will disable the" + " default scan of the interfaces identified via pci"); + +-#define PCI_CLASS_SERIAL_IPMI 0x0c07 +-#define PCI_CLASS_SERIAL_IPMI_SMIC 0x0c0700 +-#define PCI_CLASS_SERIAL_IPMI_KCS 0x0c0701 +-#define PCI_CLASS_SERIAL_IPMI_BT 0x0c0702 +- + #define PCI_DEVICE_ID_HP_MMC 0x121A + + static void ipmi_pci_cleanup(struct si_sm_io *io) +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index a102eb1abe4b..8353ab9bd31b 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -101,7 +101,11 @@ static int clk_pm_runtime_get(struct clk_core *core) + return 0; + + ret = pm_runtime_get_sync(core->dev); +- return ret < 0 ? ret : 0; ++ if (ret < 0) { ++ pm_runtime_put_noidle(core->dev); ++ return ret; ++ } ++ return 0; + } + + static void clk_pm_runtime_put(struct clk_core *core) +diff --git a/drivers/clocksource/dw_apb_timer.c b/drivers/clocksource/dw_apb_timer.c +index 1f5f734e4919..a018199575e3 100644 +--- a/drivers/clocksource/dw_apb_timer.c ++++ b/drivers/clocksource/dw_apb_timer.c +@@ -225,7 +225,8 @@ static int apbt_next_event(unsigned long delta, + /** + * dw_apb_clockevent_init() - use an APB timer as a clock_event_device + * +- * @cpu: The CPU the events will be targeted at. ++ * @cpu: The CPU the events will be targeted at or -1 if CPU affiliation ++ * isn't required. + * @name: The name used for the timer and the IRQ for it. + * @rating: The rating to give the timer. + * @base: I/O base for the timer registers. +@@ -260,7 +261,7 @@ dw_apb_clockevent_init(int cpu, const char *name, unsigned rating, + dw_ced->ced.max_delta_ticks = 0x7fffffff; + dw_ced->ced.min_delta_ns = clockevent_delta2ns(5000, &dw_ced->ced); + dw_ced->ced.min_delta_ticks = 5000; +- dw_ced->ced.cpumask = cpumask_of(cpu); ++ dw_ced->ced.cpumask = cpu < 0 ? cpu_possible_mask : cpumask_of(cpu); + dw_ced->ced.features = CLOCK_EVT_FEAT_PERIODIC | + CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_DYNIRQ; + dw_ced->ced.set_state_shutdown = apbt_shutdown; +diff --git a/drivers/clocksource/dw_apb_timer_of.c b/drivers/clocksource/dw_apb_timer_of.c +index 69866cd8f4bb..3e4d0e5733d3 100644 +--- a/drivers/clocksource/dw_apb_timer_of.c ++++ b/drivers/clocksource/dw_apb_timer_of.c +@@ -146,10 +146,6 @@ static int num_called; + static int __init dw_apb_timer_init(struct device_node *timer) + { + switch (num_called) { +- case 0: +- pr_debug("%s: found clockevent timer\n", __func__); +- add_clockevent(timer); +- break; + case 1: + pr_debug("%s: found clocksource timer\n", __func__); + add_clocksource(timer); +@@ -160,6 +156,8 @@ static int __init dw_apb_timer_init(struct device_node *timer) + #endif + break; + default: ++ pr_debug("%s: found clockevent timer\n", __func__); ++ add_clockevent(timer); + break; + } + +diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c +index e754c7aae7f7..66979dc33680 100644 +--- a/drivers/cpuidle/sysfs.c ++++ b/drivers/cpuidle/sysfs.c +@@ -467,7 +467,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device) + ret = kobject_init_and_add(&kobj->kobj, &ktype_state_cpuidle, + &kdev->kobj, "state%d", i); + if (ret) { +- kfree(kobj); ++ kobject_put(&kobj->kobj); + goto error_state; + } + cpuidle_add_s2idle_attr_group(kobj); +@@ -598,7 +598,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev) + ret = kobject_init_and_add(&kdrv->kobj, &ktype_driver_cpuidle, + &kdev->kobj, "driver"); + if (ret) { +- kfree(kdrv); ++ kobject_put(&kdrv->kobj); + return ret; + } + +@@ -692,7 +692,7 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev) + error = kobject_init_and_add(&kdev->kobj, &ktype_cpuidle, &cpu_dev->kobj, + "cpuidle"); + if (error) { +- kfree(kdev); ++ kobject_put(&kdev->kobj); + return error; + } + +diff --git a/drivers/crypto/cavium/nitrox/nitrox_main.c b/drivers/crypto/cavium/nitrox/nitrox_main.c +index fee7cb2ce747..a81f3c7e941d 100644 +--- a/drivers/crypto/cavium/nitrox/nitrox_main.c ++++ b/drivers/crypto/cavium/nitrox/nitrox_main.c +@@ -183,7 +183,7 @@ static void nitrox_remove_from_devlist(struct nitrox_device *ndev) + + struct nitrox_device *nitrox_get_first_device(void) + { +- struct nitrox_device *ndev = NULL; ++ struct nitrox_device *ndev; + + mutex_lock(&devlist_lock); + list_for_each_entry(ndev, &ndevlist, list) { +@@ -191,7 +191,7 @@ struct nitrox_device *nitrox_get_first_device(void) + break; + } + mutex_unlock(&devlist_lock); +- if (!ndev) ++ if (&ndev->list == &ndevlist) + return NULL; + + refcount_inc(&ndev->refcnt); +diff --git a/drivers/crypto/ccp/Kconfig b/drivers/crypto/ccp/Kconfig +index b9dfae47aefd..7f5fc705503d 100644 +--- a/drivers/crypto/ccp/Kconfig ++++ b/drivers/crypto/ccp/Kconfig +@@ -9,10 +9,9 @@ config CRYPTO_DEV_CCP_DD + config CRYPTO_DEV_SP_CCP + bool "Cryptographic Coprocessor device" + default y +- depends on CRYPTO_DEV_CCP_DD ++ depends on CRYPTO_DEV_CCP_DD && DMADEVICES + select HW_RANDOM + select DMA_ENGINE +- select DMADEVICES + select CRYPTO_SHA1 + select CRYPTO_SHA256 + help +diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c +index c435f89f34e3..9b3c259f081d 100644 +--- a/drivers/crypto/chelsio/chcr_algo.c ++++ b/drivers/crypto/chelsio/chcr_algo.c +@@ -2764,7 +2764,7 @@ static void fill_sec_cpl_for_aead(struct cpl_tx_sec_pdu *sec_cpl, + unsigned int mac_mode = CHCR_SCMD_AUTH_MODE_CBCMAC; + unsigned int c_id = a_ctx(tfm)->dev->rx_channel_id; + unsigned int ccm_xtra; +- unsigned char tag_offset = 0, auth_offset = 0; ++ unsigned int tag_offset = 0, auth_offset = 0; + unsigned int assoclen; + + if (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_RFC4309) +diff --git a/drivers/crypto/stm32/stm32_crc32.c b/drivers/crypto/stm32/stm32_crc32.c +index 29d2095d9dfd..47d31335c2d4 100644 +--- a/drivers/crypto/stm32/stm32_crc32.c ++++ b/drivers/crypto/stm32/stm32_crc32.c +@@ -28,8 +28,10 @@ + + /* Registers values */ + #define CRC_CR_RESET BIT(0) +-#define CRC_CR_REVERSE (BIT(7) | BIT(6) | BIT(5)) +-#define CRC_INIT_DEFAULT 0xFFFFFFFF ++#define CRC_CR_REV_IN_WORD (BIT(6) | BIT(5)) ++#define CRC_CR_REV_IN_BYTE BIT(5) ++#define CRC_CR_REV_OUT BIT(7) ++#define CRC32C_INIT_DEFAULT 0xFFFFFFFF + + #define CRC_AUTOSUSPEND_DELAY 50 + +@@ -38,8 +40,6 @@ struct stm32_crc { + struct device *dev; + void __iomem *regs; + struct clk *clk; +- u8 pending_data[sizeof(u32)]; +- size_t nb_pending_bytes; + }; + + struct stm32_crc_list { +@@ -59,14 +59,13 @@ struct stm32_crc_ctx { + + struct stm32_crc_desc_ctx { + u32 partial; /* crc32c: partial in first 4 bytes of that struct */ +- struct stm32_crc *crc; + }; + + static int stm32_crc32_cra_init(struct crypto_tfm *tfm) + { + struct stm32_crc_ctx *mctx = crypto_tfm_ctx(tfm); + +- mctx->key = CRC_INIT_DEFAULT; ++ mctx->key = 0; + mctx->poly = CRC32_POLY_LE; + return 0; + } +@@ -75,7 +74,7 @@ static int stm32_crc32c_cra_init(struct crypto_tfm *tfm) + { + struct stm32_crc_ctx *mctx = crypto_tfm_ctx(tfm); + +- mctx->key = CRC_INIT_DEFAULT; ++ mctx->key = CRC32C_INIT_DEFAULT; + mctx->poly = CRC32C_POLY_LE; + return 0; + } +@@ -94,32 +93,42 @@ static int stm32_crc_setkey(struct crypto_shash *tfm, const u8 *key, + return 0; + } + ++static struct stm32_crc *stm32_crc_get_next_crc(void) ++{ ++ struct stm32_crc *crc; ++ ++ spin_lock_bh(&crc_list.lock); ++ crc = list_first_entry(&crc_list.dev_list, struct stm32_crc, list); ++ if (crc) ++ list_move_tail(&crc->list, &crc_list.dev_list); ++ spin_unlock_bh(&crc_list.lock); ++ ++ return crc; ++} ++ + static int stm32_crc_init(struct shash_desc *desc) + { + struct stm32_crc_desc_ctx *ctx = shash_desc_ctx(desc); + struct stm32_crc_ctx *mctx = crypto_shash_ctx(desc->tfm); + struct stm32_crc *crc; + +- spin_lock_bh(&crc_list.lock); +- list_for_each_entry(crc, &crc_list.dev_list, list) { +- ctx->crc = crc; +- break; +- } +- spin_unlock_bh(&crc_list.lock); ++ crc = stm32_crc_get_next_crc(); ++ if (!crc) ++ return -ENODEV; + +- pm_runtime_get_sync(ctx->crc->dev); ++ pm_runtime_get_sync(crc->dev); + + /* Reset, set key, poly and configure in bit reverse mode */ +- writel_relaxed(bitrev32(mctx->key), ctx->crc->regs + CRC_INIT); +- writel_relaxed(bitrev32(mctx->poly), ctx->crc->regs + CRC_POL); +- writel_relaxed(CRC_CR_RESET | CRC_CR_REVERSE, ctx->crc->regs + CRC_CR); ++ writel_relaxed(bitrev32(mctx->key), crc->regs + CRC_INIT); ++ writel_relaxed(bitrev32(mctx->poly), crc->regs + CRC_POL); ++ writel_relaxed(CRC_CR_RESET | CRC_CR_REV_IN_WORD | CRC_CR_REV_OUT, ++ crc->regs + CRC_CR); + + /* Store partial result */ +- ctx->partial = readl_relaxed(ctx->crc->regs + CRC_DR); +- ctx->crc->nb_pending_bytes = 0; ++ ctx->partial = readl_relaxed(crc->regs + CRC_DR); + +- pm_runtime_mark_last_busy(ctx->crc->dev); +- pm_runtime_put_autosuspend(ctx->crc->dev); ++ pm_runtime_mark_last_busy(crc->dev); ++ pm_runtime_put_autosuspend(crc->dev); + + return 0; + } +@@ -128,31 +137,49 @@ static int stm32_crc_update(struct shash_desc *desc, const u8 *d8, + unsigned int length) + { + struct stm32_crc_desc_ctx *ctx = shash_desc_ctx(desc); +- struct stm32_crc *crc = ctx->crc; +- u32 *d32; +- unsigned int i; ++ struct stm32_crc_ctx *mctx = crypto_shash_ctx(desc->tfm); ++ struct stm32_crc *crc; ++ ++ crc = stm32_crc_get_next_crc(); ++ if (!crc) ++ return -ENODEV; + + pm_runtime_get_sync(crc->dev); + +- if (unlikely(crc->nb_pending_bytes)) { +- while (crc->nb_pending_bytes != sizeof(u32) && length) { +- /* Fill in pending data */ +- crc->pending_data[crc->nb_pending_bytes++] = *(d8++); ++ /* ++ * Restore previously calculated CRC for this context as init value ++ * Restore polynomial configuration ++ * Configure in register for word input data, ++ * Configure out register in reversed bit mode data. ++ */ ++ writel_relaxed(bitrev32(ctx->partial), crc->regs + CRC_INIT); ++ writel_relaxed(bitrev32(mctx->poly), crc->regs + CRC_POL); ++ writel_relaxed(CRC_CR_RESET | CRC_CR_REV_IN_WORD | CRC_CR_REV_OUT, ++ crc->regs + CRC_CR); ++ ++ if (d8 != PTR_ALIGN(d8, sizeof(u32))) { ++ /* Configure for byte data */ ++ writel_relaxed(CRC_CR_REV_IN_BYTE | CRC_CR_REV_OUT, ++ crc->regs + CRC_CR); ++ while (d8 != PTR_ALIGN(d8, sizeof(u32)) && length) { ++ writeb_relaxed(*d8++, crc->regs + CRC_DR); + length--; + } +- +- if (crc->nb_pending_bytes == sizeof(u32)) { +- /* Process completed pending data */ +- writel_relaxed(*(u32 *)crc->pending_data, +- crc->regs + CRC_DR); +- crc->nb_pending_bytes = 0; +- } ++ /* Configure for word data */ ++ writel_relaxed(CRC_CR_REV_IN_WORD | CRC_CR_REV_OUT, ++ crc->regs + CRC_CR); + } + +- d32 = (u32 *)d8; +- for (i = 0; i < length >> 2; i++) +- /* Process 32 bits data */ +- writel_relaxed(*(d32++), crc->regs + CRC_DR); ++ for (; length >= sizeof(u32); d8 += sizeof(u32), length -= sizeof(u32)) ++ writel_relaxed(*((u32 *)d8), crc->regs + CRC_DR); ++ ++ if (length) { ++ /* Configure for byte data */ ++ writel_relaxed(CRC_CR_REV_IN_BYTE | CRC_CR_REV_OUT, ++ crc->regs + CRC_CR); ++ while (length--) ++ writeb_relaxed(*d8++, crc->regs + CRC_DR); ++ } + + /* Store partial result */ + ctx->partial = readl_relaxed(crc->regs + CRC_DR); +@@ -160,22 +187,6 @@ static int stm32_crc_update(struct shash_desc *desc, const u8 *d8, + pm_runtime_mark_last_busy(crc->dev); + pm_runtime_put_autosuspend(crc->dev); + +- /* Check for pending data (non 32 bits) */ +- length &= 3; +- if (likely(!length)) +- return 0; +- +- if ((crc->nb_pending_bytes + length) >= sizeof(u32)) { +- /* Shall not happen */ +- dev_err(crc->dev, "Pending data overflow\n"); +- return -EINVAL; +- } +- +- d8 = (const u8 *)d32; +- for (i = 0; i < length; i++) +- /* Store pending data */ +- crc->pending_data[crc->nb_pending_bytes++] = *(d8++); +- + return 0; + } + +@@ -204,6 +215,8 @@ static int stm32_crc_digest(struct shash_desc *desc, const u8 *data, + return stm32_crc_init(desc) ?: stm32_crc_finup(desc, data, length, out); + } + ++static unsigned int refcnt; ++static DEFINE_MUTEX(refcnt_lock); + static struct shash_alg algs[] = { + /* CRC-32 */ + { +@@ -296,12 +309,18 @@ static int stm32_crc_probe(struct platform_device *pdev) + list_add(&crc->list, &crc_list.dev_list); + spin_unlock(&crc_list.lock); + +- ret = crypto_register_shashes(algs, ARRAY_SIZE(algs)); +- if (ret) { +- dev_err(dev, "Failed to register\n"); +- clk_disable_unprepare(crc->clk); +- return ret; ++ mutex_lock(&refcnt_lock); ++ if (!refcnt) { ++ ret = crypto_register_shashes(algs, ARRAY_SIZE(algs)); ++ if (ret) { ++ mutex_unlock(&refcnt_lock); ++ dev_err(dev, "Failed to register\n"); ++ clk_disable_unprepare(crc->clk); ++ return ret; ++ } + } ++ refcnt++; ++ mutex_unlock(&refcnt_lock); + + dev_info(dev, "Initialized\n"); + +@@ -322,7 +341,10 @@ static int stm32_crc_remove(struct platform_device *pdev) + list_del(&crc->list); + spin_unlock(&crc_list.lock); + +- crypto_unregister_shashes(algs, ARRAY_SIZE(algs)); ++ mutex_lock(&refcnt_lock); ++ if (!--refcnt) ++ crypto_unregister_shashes(algs, ARRAY_SIZE(algs)); ++ mutex_unlock(&refcnt_lock); + + pm_runtime_disable(crc->dev); + pm_runtime_put_noidle(crc->dev); +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index db5f939f5aa3..ea16308fae0a 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -2670,7 +2670,6 @@ static struct talitos_alg_template driver_algs[] = { + .cra_ablkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, +- .ivsize = AES_BLOCK_SIZE, + } + }, + .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU | +@@ -2704,6 +2703,7 @@ static struct talitos_alg_template driver_algs[] = { + .cra_ablkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, ++ .ivsize = AES_BLOCK_SIZE, + .setkey = ablkcipher_aes_setkey, + } + }, +diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c +index 38432721069f..ab4700e4b409 100644 +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -367,13 +367,18 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req, + int err; + unsigned long flags; + struct scatterlist outhdr, iv_sg, status_sg, **sgs; +- int i; + u64 dst_len; + unsigned int num_out = 0, num_in = 0; + int sg_total; + uint8_t *iv; ++ struct scatterlist *sg; + + src_nents = sg_nents_for_len(req->src, req->nbytes); ++ if (src_nents < 0) { ++ pr_err("Invalid number of src SG.\n"); ++ return src_nents; ++ } ++ + dst_nents = sg_nents(req->dst); + + pr_debug("virtio_crypto: Number of sgs (src_nents: %d, dst_nents: %d)\n", +@@ -419,6 +424,7 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req, + goto free; + } + ++ dst_len = min_t(unsigned int, req->nbytes, dst_len); + pr_debug("virtio_crypto: src_len: %u, dst_len: %llu\n", + req->nbytes, dst_len); + +@@ -459,12 +465,12 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req, + vc_sym_req->iv = iv; + + /* Source data */ +- for (i = 0; i < src_nents; i++) +- sgs[num_out++] = &req->src[i]; ++ for (sg = req->src; src_nents; sg = sg_next(sg), src_nents--) ++ sgs[num_out++] = sg; + + /* Destination data */ +- for (i = 0; i < dst_nents; i++) +- sgs[num_out + num_in++] = &req->dst[i]; ++ for (sg = req->dst; sg; sg = sg_next(sg)) ++ sgs[num_out + num_in++] = sg; + + /* Status */ + sg_init_one(&status_sg, &vc_req->status, sizeof(vc_req->status)); +@@ -594,10 +600,11 @@ static void virtio_crypto_ablkcipher_finalize_req( + scatterwalk_map_and_copy(req->info, req->dst, + req->nbytes - AES_BLOCK_SIZE, + AES_BLOCK_SIZE, 0); +- crypto_finalize_ablkcipher_request(vc_sym_req->base.dataq->engine, +- req, err); + kzfree(vc_sym_req->iv); + virtcrypto_clear_request(&vc_sym_req->base); ++ ++ crypto_finalize_ablkcipher_request(vc_sym_req->base.dataq->engine, ++ req, err); + } + + static struct virtio_crypto_algo virtio_crypto_algs[] = { { +diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c +index 6e91584c3677..47c6e3ceac4d 100644 +--- a/drivers/dma/pch_dma.c ++++ b/drivers/dma/pch_dma.c +@@ -972,7 +972,6 @@ static void pch_dma_remove(struct pci_dev *pdev) + } + + /* PCI Device ID of DMA device */ +-#define PCI_VENDOR_ID_ROHM 0x10DB + #define PCI_DEVICE_ID_EG20T_PCH_DMA_8CH 0x8810 + #define PCI_DEVICE_ID_EG20T_PCH_DMA_4CH 0x8815 + #define PCI_DEVICE_ID_ML7213_DMA1_8CH 0x8026 +diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c +index 1c65f5ac4368..6529addd1e82 100644 +--- a/drivers/firmware/efi/efivars.c ++++ b/drivers/firmware/efi/efivars.c +@@ -586,8 +586,10 @@ efivar_create_sysfs_entry(struct efivar_entry *new_var) + ret = kobject_init_and_add(&new_var->kobj, &efivar_ktype, + NULL, "%s", short_name); + kfree(short_name); +- if (ret) ++ if (ret) { ++ kobject_put(&new_var->kobj); + return ret; ++ } + + kobject_uevent(&new_var->kobj, KOBJ_ADD); + if (efivar_entry_add(new_var, &efivar_sysfs_list)) { +diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile +index d9845099635e..d3777d754984 100644 +--- a/drivers/firmware/efi/libstub/Makefile ++++ b/drivers/firmware/efi/libstub/Makefile +@@ -28,6 +28,7 @@ KBUILD_CFLAGS := $(cflags-y) -DDISABLE_BRANCH_PROFILING \ + -D__NO_FORTIFY \ + $(call cc-option,-ffreestanding) \ + $(call cc-option,-fno-stack-protector) \ ++ $(call cc-option,-fno-addrsig) \ + -D__DISABLE_EXPORTS + + GCOV_PROFILE := n +diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c +index 4596fde16dfe..3e88e79d1053 100644 +--- a/drivers/gnss/sirf.c ++++ b/drivers/gnss/sirf.c +@@ -292,14 +292,18 @@ static int sirf_probe(struct serdev_device *serdev) + + data->on_off = devm_gpiod_get_optional(dev, "sirf,onoff", + GPIOD_OUT_LOW); +- if (IS_ERR(data->on_off)) ++ if (IS_ERR(data->on_off)) { ++ ret = PTR_ERR(data->on_off); + goto err_put_device; ++ } + + if (data->on_off) { + data->wakeup = devm_gpiod_get_optional(dev, "sirf,wakeup", + GPIOD_IN); +- if (IS_ERR(data->wakeup)) ++ if (IS_ERR(data->wakeup)) { ++ ret = PTR_ERR(data->wakeup); + goto err_put_device; ++ } + + /* + * Configurations where WAKEUP has been left not connected, +diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c +index 51c7d1b84c2e..0c076dce9e17 100644 +--- a/drivers/gpio/gpio-ml-ioh.c ++++ b/drivers/gpio/gpio-ml-ioh.c +@@ -31,8 +31,6 @@ + + #define IOH_IRQ_BASE 0 + +-#define PCI_VENDOR_ID_ROHM 0x10DB +- + struct ioh_reg_comn { + u32 ien; + u32 istatus; +diff --git a/drivers/gpio/gpio-pch.c b/drivers/gpio/gpio-pch.c +index ffce0ab912ed..8c7f3d20e30e 100644 +--- a/drivers/gpio/gpio-pch.c ++++ b/drivers/gpio/gpio-pch.c +@@ -524,7 +524,6 @@ static int pch_gpio_resume(struct pci_dev *pdev) + #define pch_gpio_resume NULL + #endif + +-#define PCI_VENDOR_ID_ROHM 0x10DB + static const struct pci_device_id pch_gpio_pcidev_id[] = { + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8803) }, + { PCI_DEVICE(PCI_VENDOR_ID_ROHM, 0x8014) }, +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c +index 1b4783d45c53..3a218b56a008 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c +@@ -20,13 +20,15 @@ static void adv7511_calc_cts_n(unsigned int f_tmds, unsigned int fs, + { + switch (fs) { + case 32000: +- *n = 4096; ++ case 48000: ++ case 96000: ++ case 192000: ++ *n = fs * 128 / 1000; + break; + case 44100: +- *n = 6272; +- break; +- case 48000: +- *n = 6144; ++ case 88200: ++ case 176400: ++ *n = fs * 128 / 900; + break; + } + +diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +index f08c54740cbe..52894816167c 100644 +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -1604,7 +1604,9 @@ static int eb_copy_relocations(const struct i915_execbuffer *eb) + * happened we would make the mistake of assuming that the + * relocations were valid. + */ +- user_access_begin(); ++ if (!user_access_begin(VERIFY_WRITE, urelocs, size)) ++ goto end_user; ++ + for (copied = 0; copied < nreloc; copied++) + unsafe_put_user(-1, + &urelocs[copied].presumed_offset, +@@ -2649,7 +2651,17 @@ i915_gem_execbuffer2_ioctl(struct drm_device *dev, void *data, + unsigned int i; + + /* Copy the new buffer offsets back to the user's exec list. */ +- user_access_begin(); ++ /* ++ * Note: count * sizeof(*user_exec_list) does not overflow, ++ * because we checked 'count' in check_buffer_count(). ++ * ++ * And this range already got effectively checked earlier ++ * when we did the "copy_from_user()" above. ++ */ ++ if (!user_access_begin(VERIFY_WRITE, user_exec_list, ++ count * sizeof(*user_exec_list))) ++ goto end_user; ++ + for (i = 0; i < args->buffer_count; i++) { + if (!(exec2_list[i].offset & UPDATE)) + continue; +diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h +index e018752d57bb..b46c31e25c27 100644 +--- a/drivers/gpu/drm/vkms/vkms_drv.h ++++ b/drivers/gpu/drm/vkms/vkms_drv.h +@@ -62,11 +62,6 @@ int vkms_output_init(struct vkms_device *vkmsdev); + struct drm_plane *vkms_plane_init(struct vkms_device *vkmsdev); + + /* Gem stuff */ +-struct drm_gem_object *vkms_gem_create(struct drm_device *dev, +- struct drm_file *file, +- u32 *handle, +- u64 size); +- + int vkms_gem_fault(struct vm_fault *vmf); + + int vkms_dumb_create(struct drm_file *file, struct drm_device *dev, +diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c +index ce394009a36c..f731683c932e 100644 +--- a/drivers/gpu/drm/vkms/vkms_gem.c ++++ b/drivers/gpu/drm/vkms/vkms_gem.c +@@ -93,10 +93,10 @@ int vkms_gem_fault(struct vm_fault *vmf) + return ret; + } + +-struct drm_gem_object *vkms_gem_create(struct drm_device *dev, +- struct drm_file *file, +- u32 *handle, +- u64 size) ++static struct drm_gem_object *vkms_gem_create(struct drm_device *dev, ++ struct drm_file *file, ++ u32 *handle, ++ u64 size) + { + struct vkms_gem_object *obj; + int ret; +@@ -109,7 +109,6 @@ struct drm_gem_object *vkms_gem_create(struct drm_device *dev, + return ERR_CAST(obj); + + ret = drm_gem_handle_create(file, &obj->gem, handle); +- drm_gem_object_put_unlocked(&obj->gem); + if (ret) + return ERR_PTR(ret); + +@@ -138,6 +137,8 @@ int vkms_dumb_create(struct drm_file *file, struct drm_device *dev, + args->size = gem_obj->size; + args->pitch = pitch; + ++ drm_gem_object_put_unlocked(gem_obj); ++ + DRM_DEBUG_DRIVER("Created object of size %lld\n", size); + + return 0; +diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c +index 2cef0c37ff6f..bc6871c8dd4e 100644 +--- a/drivers/hwmon/k10temp.c ++++ b/drivers/hwmon/k10temp.c +@@ -23,6 +23,7 @@ + #include <linux/init.h> + #include <linux/module.h> + #include <linux/pci.h> ++#include <linux/pci_ids.h> + #include <asm/amd_nb.h> + #include <asm/processor.h> + +@@ -41,14 +42,6 @@ static DEFINE_MUTEX(nb_smu_ind_mutex); + #define PCI_DEVICE_ID_AMD_15H_M70H_NB_F3 0x15b3 + #endif + +-#ifndef PCI_DEVICE_ID_AMD_17H_DF_F3 +-#define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463 +-#endif +- +-#ifndef PCI_DEVICE_ID_AMD_17H_M10H_DF_F3 +-#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F3 0x15eb +-#endif +- + /* CPUID function 0x80000001, ebx */ + #define CPUID_PKGTYPE_MASK 0xf0000000 + #define CPUID_PKGTYPE_F 0x00000000 +diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c +index 835d54ac2971..231675b10376 100644 +--- a/drivers/i2c/busses/i2c-eg20t.c ++++ b/drivers/i2c/busses/i2c-eg20t.c +@@ -177,7 +177,6 @@ static wait_queue_head_t pch_event; + static DEFINE_MUTEX(pch_mutex); + + /* Definition for ML7213 by LAPIS Semiconductor */ +-#define PCI_VENDOR_ID_ROHM 0x10DB + #define PCI_DEVICE_ID_ML7213_I2C 0x802D + #define PCI_DEVICE_ID_ML7223_I2C 0x8010 + #define PCI_DEVICE_ID_ML7831_I2C 0x8817 +diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c +index 5404717998b0..fc4b46258c75 100644 +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -360,6 +360,8 @@ static __poll_t ib_uverbs_event_poll(struct ib_uverbs_event_queue *ev_queue, + spin_lock_irq(&ev_queue->lock); + if (!list_empty(&ev_queue->event_list)) + pollflags = EPOLLIN | EPOLLRDNORM; ++ else if (ev_queue->is_closed) ++ pollflags = EPOLLERR; + spin_unlock_irq(&ev_queue->lock); + + return pollflags; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index d9042d0566ab..671e018eb363 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -173,6 +173,7 @@ static const char * const smbus_pnp_ids[] = { + "LEN005b", /* P50 */ + "LEN005e", /* T560 */ + "LEN006c", /* T470s */ ++ "LEN007a", /* T470s */ + "LEN0071", /* T480 */ + "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */ + "LEN0073", /* X1 Carbon G5 (Elantech) */ +diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c +index a5ab774da4cc..fca908ba4841 100644 +--- a/drivers/input/touchscreen/mms114.c ++++ b/drivers/input/touchscreen/mms114.c +@@ -91,15 +91,15 @@ static int __mms114_read_reg(struct mms114_data *data, unsigned int reg, + if (reg <= MMS114_MODE_CONTROL && reg + len > MMS114_MODE_CONTROL) + BUG(); + +- /* Write register: use repeated start */ ++ /* Write register */ + xfer[0].addr = client->addr; +- xfer[0].flags = I2C_M_TEN | I2C_M_NOSTART; ++ xfer[0].flags = client->flags & I2C_M_TEN; + xfer[0].len = 1; + xfer[0].buf = &buf; + + /* Read data */ + xfer[1].addr = client->addr; +- xfer[1].flags = I2C_M_RD; ++ xfer[1].flags = (client->flags & I2C_M_TEN) | I2C_M_RD; + xfer[1].len = len; + xfer[1].buf = val; + +@@ -428,10 +428,8 @@ static int mms114_probe(struct i2c_client *client, + const void *match_data; + int error; + +- if (!i2c_check_functionality(client->adapter, +- I2C_FUNC_PROTOCOL_MANGLING)) { +- dev_err(&client->dev, +- "Need i2c bus that supports protocol mangling\n"); ++ if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) { ++ dev_err(&client->dev, "Not supported I2C adapter\n"); + return -ENODEV; + } + +diff --git a/drivers/isdn/hardware/mISDN/w6692.c b/drivers/isdn/hardware/mISDN/w6692.c +index 5acf6ab67cd3..6f60aced11c5 100644 +--- a/drivers/isdn/hardware/mISDN/w6692.c ++++ b/drivers/isdn/hardware/mISDN/w6692.c +@@ -52,10 +52,7 @@ static const struct w6692map w6692_map[] = + {W6692_USR, "USR W6692"} + }; + +-#ifndef PCI_VENDOR_ID_USR +-#define PCI_VENDOR_ID_USR 0x16ec + #define PCI_DEVICE_ID_USR_6692 0x3409 +-#endif + + struct w6692_ch { + struct bchannel bch; +diff --git a/drivers/macintosh/windfarm_pm112.c b/drivers/macintosh/windfarm_pm112.c +index fec91db1142e..6ece5c1a7840 100644 +--- a/drivers/macintosh/windfarm_pm112.c ++++ b/drivers/macintosh/windfarm_pm112.c +@@ -133,14 +133,6 @@ static int create_cpu_loop(int cpu) + s32 tmax; + int fmin; + +- /* Get PID params from the appropriate SAT */ +- hdr = smu_sat_get_sdb_partition(chip, 0xC8 + core, NULL); +- if (hdr == NULL) { +- printk(KERN_WARNING"windfarm: can't get CPU PID fan config\n"); +- return -EINVAL; +- } +- piddata = (struct smu_sdbp_cpupiddata *)&hdr[1]; +- + /* Get FVT params to get Tmax; if not found, assume default */ + hdr = smu_sat_get_sdb_partition(chip, 0xC4 + core, NULL); + if (hdr) { +@@ -153,6 +145,16 @@ static int create_cpu_loop(int cpu) + if (tmax < cpu_all_tmax) + cpu_all_tmax = tmax; + ++ kfree(hdr); ++ ++ /* Get PID params from the appropriate SAT */ ++ hdr = smu_sat_get_sdb_partition(chip, 0xC8 + core, NULL); ++ if (hdr == NULL) { ++ printk(KERN_WARNING"windfarm: can't get CPU PID fan config\n"); ++ return -EINVAL; ++ } ++ piddata = (struct smu_sdbp_cpupiddata *)&hdr[1]; ++ + /* + * Darwin has a minimum fan speed of 1000 rpm for the 4-way and + * 515 for the 2-way. That appears to be overkill, so for now, +@@ -175,6 +177,9 @@ static int create_cpu_loop(int cpu) + pid.min = fmin; + + wf_cpu_pid_init(&cpu_pid[cpu], &pid); ++ ++ kfree(hdr); ++ + return 0; + } + +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 5b5cbfadd003..68ebc2759c2e 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -775,7 +775,9 @@ static void bcache_device_free(struct bcache_device *d) + bcache_device_detach(d); + + if (disk) { +- if (disk->flags & GENHD_FL_UP) ++ bool disk_added = (disk->flags & GENHD_FL_UP) != 0; ++ ++ if (disk_added) + del_gendisk(disk); + + if (disk->queue) +@@ -783,7 +785,8 @@ static void bcache_device_free(struct bcache_device *d) + + ida_simple_remove(&bcache_device_idx, + first_minor_to_idx(disk->first_minor)); +- put_disk(disk); ++ if (disk_added) ++ put_disk(disk); + } + + bioset_exit(&d->bio_split); +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 750f8b34e693..07661c3c1513 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -3078,7 +3078,7 @@ static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits) + limits->max_segment_size = PAGE_SIZE; + + limits->logical_block_size = +- max_t(unsigned short, limits->logical_block_size, cc->sector_size); ++ max_t(unsigned, limits->logical_block_size, cc->sector_size); + limits->physical_block_size = + max_t(unsigned, limits->physical_block_size, cc->sector_size); + limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size); +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 9426976e0860..a6db4fd267aa 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7438,7 +7438,8 @@ static int md_open(struct block_device *bdev, fmode_t mode) + */ + mddev_put(mddev); + /* Wait until bdev->bd_disk is definitely gone */ +- flush_workqueue(md_misc_wq); ++ if (work_pending(&mddev->del_work)) ++ flush_workqueue(md_misc_wq); + /* Then retry the open from the top */ + return -ERESTARTSYS; + } +diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c +index ba7e976bf6dc..60b20ae02b05 100644 +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -1668,6 +1668,10 @@ int __cec_s_log_addrs(struct cec_adapter *adap, + unsigned j; + + log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID; ++ if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) { ++ dprintk(1, "unknown logical address type\n"); ++ return -EINVAL; ++ } + if (type_mask & (1 << log_addrs->log_addr_type[i])) { + dprintk(1, "duplicate logical address type\n"); + return -EINVAL; +@@ -1688,10 +1692,6 @@ int __cec_s_log_addrs(struct cec_adapter *adap, + dprintk(1, "invalid primary device type\n"); + return -EINVAL; + } +- if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) { +- dprintk(1, "unknown logical address type\n"); +- return -EINVAL; +- } + for (j = 0; j < feature_sz; j++) { + if ((features[j] & 0x80) == 0) { + if (op_is_dev_features) +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 2023df14f828..aa9c0b7ee7a2 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -2829,8 +2829,8 @@ static int ov5640_probe(struct i2c_client *client, + free_ctrls: + v4l2_ctrl_handler_free(&sensor->ctrls.handler); + entity_cleanup: +- mutex_destroy(&sensor->lock); + media_entity_cleanup(&sensor->sd.entity); ++ mutex_destroy(&sensor->lock); + return ret; + } + +@@ -2840,9 +2840,9 @@ static int ov5640_remove(struct i2c_client *client) + struct ov5640_dev *sensor = to_ov5640_dev(sd); + + v4l2_async_unregister_subdev(&sensor->sd); +- mutex_destroy(&sensor->lock); + media_entity_cleanup(&sensor->sd.entity); + v4l2_ctrl_handler_free(&sensor->ctrls.handler); ++ mutex_destroy(&sensor->lock); + + return 0; + } +diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c +index 43c78620c9d8..5c6b00737fe7 100644 +--- a/drivers/media/platform/rcar-fcp.c ++++ b/drivers/media/platform/rcar-fcp.c +@@ -8,6 +8,7 @@ + */ + + #include <linux/device.h> ++#include <linux/dma-mapping.h> + #include <linux/list.h> + #include <linux/module.h> + #include <linux/mod_devicetable.h> +@@ -21,6 +22,7 @@ + struct rcar_fcp_device { + struct list_head list; + struct device *dev; ++ struct device_dma_parameters dma_parms; + }; + + static LIST_HEAD(fcp_devices); +@@ -136,6 +138,9 @@ static int rcar_fcp_probe(struct platform_device *pdev) + + fcp->dev = &pdev->dev; + ++ fcp->dev->dma_parms = &fcp->dma_parms; ++ dma_set_max_seg_size(fcp->dev, DMA_BIT_MASK(32)); ++ + pm_runtime_enable(&pdev->dev); + + mutex_lock(&fcp_lock); +diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c +index a08d8fe2bb1b..13770b038048 100644 +--- a/drivers/media/tuners/si2157.c ++++ b/drivers/media/tuners/si2157.c +@@ -84,24 +84,23 @@ static int si2157_init(struct dvb_frontend *fe) + struct si2157_cmd cmd; + const struct firmware *fw; + const char *fw_name; +- unsigned int uitmp, chip_id; ++ unsigned int chip_id, xtal_trim; + + dev_dbg(&client->dev, "\n"); + +- /* Returned IF frequency is garbage when firmware is not running */ +- memcpy(cmd.args, "\x15\x00\x06\x07", 4); ++ /* Try to get Xtal trim property, to verify tuner still running */ ++ memcpy(cmd.args, "\x15\x00\x04\x02", 4); + cmd.wlen = 4; + cmd.rlen = 4; + ret = si2157_cmd_execute(client, &cmd); +- if (ret) +- goto err; + +- uitmp = cmd.args[2] << 0 | cmd.args[3] << 8; +- dev_dbg(&client->dev, "if_frequency kHz=%u\n", uitmp); ++ xtal_trim = cmd.args[2] | (cmd.args[3] << 8); + +- if (uitmp == dev->if_frequency / 1000) ++ if (ret == 0 && xtal_trim < 16) + goto warm; + ++ dev->if_frequency = 0; /* we no longer know current tuner state */ ++ + /* power up */ + if (dev->chiptype == SI2157_CHIPTYPE_SI2146) { + memcpy(cmd.args, "\xc0\x05\x01\x00\x00\x0b\x00\x00\x01", 9); +diff --git a/drivers/media/usb/dvb-usb/dibusb-mb.c b/drivers/media/usb/dvb-usb/dibusb-mb.c +index 408920577716..94f59c7765dc 100644 +--- a/drivers/media/usb/dvb-usb/dibusb-mb.c ++++ b/drivers/media/usb/dvb-usb/dibusb-mb.c +@@ -84,7 +84,7 @@ static int dibusb_tuner_probe_and_attach(struct dvb_usb_adapter *adap) + + if (i2c_transfer(&adap->dev->i2c_adap, msg, 2) != 2) { + err("tuner i2c write failed."); +- ret = -EREMOTEIO; ++ return -EREMOTEIO; + } + + if (adap->fe_adap[0].fe->ops.i2c_gate_ctrl) +diff --git a/drivers/media/usb/go7007/snd-go7007.c b/drivers/media/usb/go7007/snd-go7007.c +index 137fc253b122..96c37a131deb 100644 +--- a/drivers/media/usb/go7007/snd-go7007.c ++++ b/drivers/media/usb/go7007/snd-go7007.c +@@ -244,22 +244,18 @@ int go7007_snd_init(struct go7007 *go) + gosnd->capturing = 0; + ret = snd_card_new(go->dev, index[dev], id[dev], THIS_MODULE, 0, + &gosnd->card); +- if (ret < 0) { +- kfree(gosnd); +- return ret; +- } ++ if (ret < 0) ++ goto free_snd; ++ + ret = snd_device_new(gosnd->card, SNDRV_DEV_LOWLEVEL, go, + &go7007_snd_device_ops); +- if (ret < 0) { +- kfree(gosnd); +- return ret; +- } ++ if (ret < 0) ++ goto free_card; ++ + ret = snd_pcm_new(gosnd->card, "go7007", 0, 0, 1, &gosnd->pcm); +- if (ret < 0) { +- snd_card_free(gosnd->card); +- kfree(gosnd); +- return ret; +- } ++ if (ret < 0) ++ goto free_card; ++ + strlcpy(gosnd->card->driver, "go7007", sizeof(gosnd->card->driver)); + strlcpy(gosnd->card->shortname, go->name, sizeof(gosnd->card->driver)); + strlcpy(gosnd->card->longname, gosnd->card->shortname, +@@ -270,11 +266,8 @@ int go7007_snd_init(struct go7007 *go) + &go7007_snd_capture_ops); + + ret = snd_card_register(gosnd->card); +- if (ret < 0) { +- snd_card_free(gosnd->card); +- kfree(gosnd); +- return ret; +- } ++ if (ret < 0) ++ goto free_card; + + gosnd->substream = NULL; + go->snd_context = gosnd; +@@ -282,6 +275,12 @@ int go7007_snd_init(struct go7007 *go) + ++dev; + + return 0; ++ ++free_card: ++ snd_card_free(gosnd->card); ++free_snd: ++ kfree(gosnd); ++ return ret; + } + EXPORT_SYMBOL(go7007_snd_init); + +diff --git a/drivers/misc/pch_phub.c b/drivers/misc/pch_phub.c +index 540845651b8c..309703e9c42e 100644 +--- a/drivers/misc/pch_phub.c ++++ b/drivers/misc/pch_phub.c +@@ -64,7 +64,6 @@ + #define CLKCFG_UARTCLKSEL (1 << 18) + + /* Macros for ML7213 */ +-#define PCI_VENDOR_ID_ROHM 0x10db + #define PCI_DEVICE_ID_ROHM_ML7213_PHUB 0x801A + + /* Macros for ML7223 */ +diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c +index 727dc6ec427d..7d166f57f624 100644 +--- a/drivers/misc/pci_endpoint_test.c ++++ b/drivers/misc/pci_endpoint_test.c +@@ -75,6 +75,11 @@ + #define PCI_ENDPOINT_TEST_IRQ_TYPE 0x24 + #define PCI_ENDPOINT_TEST_IRQ_NUMBER 0x28 + ++#define PCI_DEVICE_ID_TI_AM654 0xb00c ++ ++#define is_am654_pci_dev(pdev) \ ++ ((pdev)->device == PCI_DEVICE_ID_TI_AM654) ++ + static DEFINE_IDA(pci_endpoint_test_ida); + + #define to_endpoint_test(priv) container_of((priv), struct pci_endpoint_test, \ +@@ -593,6 +598,7 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd, + int ret = -EINVAL; + enum pci_barno bar; + struct pci_endpoint_test *test = to_endpoint_test(file->private_data); ++ struct pci_dev *pdev = test->pdev; + + mutex_lock(&test->mutex); + switch (cmd) { +@@ -600,6 +606,8 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd, + bar = arg; + if (bar < 0 || bar > 5) + goto ret; ++ if (is_am654_pci_dev(pdev) && bar == BAR_0) ++ goto ret; + ret = pci_endpoint_test_bar(test, bar); + break; + case PCITEST_LEGACY_IRQ: +@@ -792,10 +800,20 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev) + pci_disable_device(pdev); + } + ++static const struct pci_endpoint_test_data am654_data = { ++ .test_reg_bar = BAR_2, ++ .alignment = SZ_64K, ++ .irq_type = IRQ_TYPE_MSI, ++}; ++ + static const struct pci_device_id pci_endpoint_test_tbl[] = { + { PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_DRA74x) }, + { PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_DRA72x) }, +- { PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS, 0xedda) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x81c0) }, ++ { PCI_DEVICE_DATA(SYNOPSYS, EDDA, NULL) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_AM654), ++ .driver_data = (kernel_ulong_t)&am654_data ++ }, + { } + }; + MODULE_DEVICE_TABLE(pci, pci_endpoint_test_tbl); +diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c +index 0aa99694b937..4e72ad24322f 100644 +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -720,9 +720,8 @@ try_again: + /* Retry init sequence, but without R4_18V_PRESENT. */ + retries = 0; + goto try_again; +- } else { +- goto remove; + } ++ return err; + } + + /* +diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c +index 1c062473b1c2..27837a794e7b 100644 +--- a/drivers/mmc/host/meson-mx-sdio.c ++++ b/drivers/mmc/host/meson-mx-sdio.c +@@ -249,6 +249,9 @@ static void meson_mx_mmc_request_done(struct meson_mx_mmc_host *host) + + mrq = host->mrq; + ++ if (host->cmd->error) ++ meson_mx_mmc_soft_reset(host); ++ + host->mrq = NULL; + host->cmd = NULL; + +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index 629860f7327c..bd502f4f4704 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -82,7 +82,7 @@ + #define ESDHC_STD_TUNING_EN (1 << 24) + /* NOTE: the minimum valid tuning start tap for mx6sl is 1 */ + #define ESDHC_TUNING_START_TAP_DEFAULT 0x1 +-#define ESDHC_TUNING_START_TAP_MASK 0xff ++#define ESDHC_TUNING_START_TAP_MASK 0x7f + #define ESDHC_TUNING_STEP_MASK 0x00070000 + #define ESDHC_TUNING_STEP_SHIFT 16 + +diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c +index 19ae527ecc72..643fd1a1b88b 100644 +--- a/drivers/mmc/host/sdhci-msm.c ++++ b/drivers/mmc/host/sdhci-msm.c +@@ -1083,6 +1083,12 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode) + /* Clock-Data-Recovery used to dynamically adjust RX sampling point */ + msm_host->use_cdr = true; + ++ /* ++ * Clear tuning_done flag before tuning to ensure proper ++ * HS400 settings. ++ */ ++ msm_host->tuning_done = 0; ++ + /* + * For HS400 tuning in HS200 timing requires: + * - select MCLK/2 in VENDOR_SPEC +@@ -1700,7 +1706,9 @@ static const struct sdhci_ops sdhci_msm_ops = { + static const struct sdhci_pltfm_data sdhci_msm_pdata = { + .quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION | + SDHCI_QUIRK_SINGLE_POWER_WRITE | +- SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN, ++ SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN | ++ SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12, ++ + .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, + .ops = &sdhci_msm_ops, + }; +diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c +index 32c4211506fc..246dc6255e69 100644 +--- a/drivers/mmc/host/via-sdmmc.c ++++ b/drivers/mmc/host/via-sdmmc.c +@@ -323,6 +323,8 @@ struct via_crdr_mmc_host { + /* some devices need a very long delay for power to stabilize */ + #define VIA_CRDR_QUIRK_300MS_PWRDELAY 0x0001 + ++#define VIA_CMD_TIMEOUT_MS 1000 ++ + static const struct pci_device_id via_ids[] = { + {PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_9530, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0,}, +@@ -555,14 +557,17 @@ static void via_sdc_send_command(struct via_crdr_mmc_host *host, + { + void __iomem *addrbase; + struct mmc_data *data; ++ unsigned int timeout_ms; + u32 cmdctrl = 0; + + WARN_ON(host->cmd); + + data = cmd->data; +- mod_timer(&host->timer, jiffies + HZ); + host->cmd = cmd; + ++ timeout_ms = cmd->busy_timeout ? cmd->busy_timeout : VIA_CMD_TIMEOUT_MS; ++ mod_timer(&host->timer, jiffies + msecs_to_jiffies(timeout_ms)); ++ + /*Command index*/ + cmdctrl = cmd->opcode << 8; + +diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +index 4b90d5b380c2..8002a2a390e5 100644 +--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +@@ -911,11 +911,14 @@ static int brcmnand_hamming_ooblayout_free(struct mtd_info *mtd, int section, + if (!section) { + /* + * Small-page NAND use byte 6 for BBI while large-page +- * NAND use byte 0. ++ * NAND use bytes 0 and 1. + */ +- if (cfg->page_size > 512) +- oobregion->offset++; +- oobregion->length--; ++ if (cfg->page_size > 512) { ++ oobregion->offset += 2; ++ oobregion->length -= 2; ++ } else { ++ oobregion->length--; ++ } + } + } + +diff --git a/drivers/mtd/nand/raw/pasemi_nand.c b/drivers/mtd/nand/raw/pasemi_nand.c +index a47a7e4bd25a..d69e5bae541e 100644 +--- a/drivers/mtd/nand/raw/pasemi_nand.c ++++ b/drivers/mtd/nand/raw/pasemi_nand.c +@@ -163,7 +163,7 @@ static int pasemi_nand_probe(struct platform_device *ofdev) + if (mtd_device_register(pasemi_nand_mtd, NULL, 0)) { + dev_err(dev, "Unable to register MTD device\n"); + err = -ENODEV; +- goto out_lpc; ++ goto out_cleanup_nand; + } + + dev_info(dev, "PA Semi NAND flash at %pR, control at I/O %x\n", &res, +@@ -171,6 +171,8 @@ static int pasemi_nand_probe(struct platform_device *ofdev) + + return 0; + ++ out_cleanup_nand: ++ nand_cleanup(chip); + out_lpc: + release_region(lpcctl, 4); + out_ior: +diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c +index 3143de45baaa..c458b81ba63a 100644 +--- a/drivers/net/ethernet/allwinner/sun4i-emac.c ++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c +@@ -433,7 +433,7 @@ static void emac_timeout(struct net_device *dev) + /* Hardware start transmission. + * Send a packet to media from the upper layer. + */ +-static int emac_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t emac_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct emac_board_info *db = netdev_priv(dev); + unsigned long channel; +@@ -441,7 +441,7 @@ static int emac_start_xmit(struct sk_buff *skb, struct net_device *dev) + + channel = db->tx_fifo_stat & 3; + if (channel == 3) +- return 1; ++ return NETDEV_TX_BUSY; + + channel = (channel == 1 ? 1 : 0); + +diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c +index 3afc0e59a2bd..d07f7f65169a 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_com.c ++++ b/drivers/net/ethernet/amazon/ena/ena_com.c +@@ -2137,6 +2137,9 @@ int ena_com_get_hash_function(struct ena_com_dev *ena_dev, + rss->hash_key; + int rc; + ++ if (unlikely(!func)) ++ return -EINVAL; ++ + rc = ena_com_get_feature_ex(ena_dev, &get_resp, + ENA_ADMIN_RSS_HASH_FUNCTION, + rss->hash_key_dma_addr, +@@ -2149,8 +2152,7 @@ int ena_com_get_hash_function(struct ena_com_dev *ena_dev, + if (rss->hash_func) + rss->hash_func--; + +- if (func) +- *func = rss->hash_func; ++ *func = rss->hash_func; + + if (key) + memcpy(key, hash_key->key, (size_t)(hash_key->keys_num) << 2); +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index 15dcfb6704e5..adac5df0d6b4 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -620,6 +620,9 @@ int aq_nic_get_regs(struct aq_nic_s *self, struct ethtool_regs *regs, void *p) + u32 *regs_buff = p; + int err = 0; + ++ if (unlikely(!self->aq_hw_ops->hw_get_regs)) ++ return -EOPNOTSUPP; ++ + regs->version = 1; + + err = self->aq_hw_ops->hw_get_regs(self->aq_hw, +@@ -634,6 +637,9 @@ err_exit: + + int aq_nic_get_regs_count(struct aq_nic_s *self) + { ++ if (unlikely(!self->aq_hw_ops->hw_get_regs)) ++ return 0; ++ + return self->aq_nic_cfg.aq_hw_caps->mac_regs_count; + } + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 047fc0cf0263..40e8ef984b62 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -72,6 +72,9 @@ + #define GENET_RDMA_REG_OFF (priv->hw_params->rdma_offset + \ + TOTAL_DESC * DMA_DESC_SIZE) + ++/* Forward declarations */ ++static void bcmgenet_set_rx_mode(struct net_device *dev); ++ + static inline void bcmgenet_writel(u32 value, void __iomem *offset) + { + /* MIPS chips strapped for BE will automagically configure the +@@ -2859,6 +2862,7 @@ static void bcmgenet_netif_start(struct net_device *dev) + struct bcmgenet_priv *priv = netdev_priv(dev); + + /* Start the network engine */ ++ bcmgenet_set_rx_mode(dev); + bcmgenet_enable_rx_napi(priv); + + umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, true); +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index abfd990ba4d8..645298628b6f 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -4295,12 +4295,10 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq, + dev_err(dev, "Error %ld in VERSION_EXCHG_RSP\n", rc); + break; + } +- dev_info(dev, "Partner protocol version is %d\n", +- crq->version_exchange_rsp.version); +- if (be16_to_cpu(crq->version_exchange_rsp.version) < +- ibmvnic_version) +- ibmvnic_version = ++ ibmvnic_version = + be16_to_cpu(crq->version_exchange_rsp.version); ++ dev_info(dev, "Partner protocol version is %d\n", ++ ibmvnic_version); + send_cap_queries(adapter); + break; + case QUERY_CAPABILITY_RSP: +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index 2110d5f2da19..47b867c64b14 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -3144,8 +3144,9 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb, + hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb); + if (skb->data_len && hdr_len == len) { + switch (hw->mac_type) { ++ case e1000_82544: { + unsigned int pull_size; +- case e1000_82544: ++ + /* Make sure we have room to chop off 4 bytes, + * and that the end alignment will work out to + * this hardware's requirements +@@ -3166,6 +3167,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb, + } + len = skb_headlen(skb); + break; ++ } + default: + /* do nothing */ + break; +diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h +index c760dc72c520..c5a119daa7f3 100644 +--- a/drivers/net/ethernet/intel/e1000e/e1000.h ++++ b/drivers/net/ethernet/intel/e1000e/e1000.h +@@ -574,7 +574,6 @@ static inline u32 __er32(struct e1000_hw *hw, unsigned long reg) + + #define er32(reg) __er32(hw, E1000_##reg) + +-s32 __ew32_prepare(struct e1000_hw *hw); + void __ew32(struct e1000_hw *hw, unsigned long reg, u32 val); + + #define ew32(reg, val) __ew32(hw, E1000_##reg, (val)) +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index a7b5a47ab83d..589a5296da4b 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -119,14 +119,12 @@ static const struct e1000_reg_info e1000_reg_info_tbl[] = { + * has bit 24 set while ME is accessing MAC CSR registers, wait if it is set + * and try again a number of times. + **/ +-s32 __ew32_prepare(struct e1000_hw *hw) ++static void __ew32_prepare(struct e1000_hw *hw) + { + s32 i = E1000_ICH_FWSM_PCIM2PCI_COUNT; + + while ((er32(FWSM) & E1000_ICH_FWSM_PCIM2PCI) && --i) + udelay(50); +- +- return i; + } + + void __ew32(struct e1000_hw *hw, unsigned long reg, u32 val) +@@ -607,11 +605,11 @@ static void e1000e_update_rdt_wa(struct e1000_ring *rx_ring, unsigned int i) + { + struct e1000_adapter *adapter = rx_ring->adapter; + struct e1000_hw *hw = &adapter->hw; +- s32 ret_val = __ew32_prepare(hw); + ++ __ew32_prepare(hw); + writel(i, rx_ring->tail); + +- if (unlikely(!ret_val && (i != readl(rx_ring->tail)))) { ++ if (unlikely(i != readl(rx_ring->tail))) { + u32 rctl = er32(RCTL); + + ew32(RCTL, rctl & ~E1000_RCTL_EN); +@@ -624,11 +622,11 @@ static void e1000e_update_tdt_wa(struct e1000_ring *tx_ring, unsigned int i) + { + struct e1000_adapter *adapter = tx_ring->adapter; + struct e1000_hw *hw = &adapter->hw; +- s32 ret_val = __ew32_prepare(hw); + ++ __ew32_prepare(hw); + writel(i, tx_ring->tail); + +- if (unlikely(!ret_val && (i != readl(tx_ring->tail)))) { ++ if (unlikely(i != readl(tx_ring->tail))) { + u32 tctl = er32(TCTL); + + ew32(TCTL, tctl & ~E1000_TCTL_EN); +@@ -5251,6 +5249,10 @@ static void e1000_watchdog_task(struct work_struct *work) + /* oops */ + break; + } ++ if (hw->mac.type == e1000_pch_spt) { ++ netdev->features &= ~NETIF_F_TSO; ++ netdev->features &= ~NETIF_F_TSO6; ++ } + } + + /* enable transmits in the hardware, need to do this +diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c +index 50954e444985..2e17625e6c35 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c ++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c +@@ -143,7 +143,8 @@ static int igb_get_link_ksettings(struct net_device *netdev, + u32 speed; + u32 supported, advertising; + +- status = rd32(E1000_STATUS); ++ status = pm_runtime_suspended(&adapter->pdev->dev) ? ++ 0 : rd32(E1000_STATUS); + if (hw->phy.media_type == e1000_media_type_copper) { + + supported = (SUPPORTED_10baseT_Half | +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c +index 0bd1294ba517..39c5e6fdb72c 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c +@@ -2243,7 +2243,7 @@ s32 ixgbe_fc_enable_generic(struct ixgbe_hw *hw) + } + + /* Configure pause time (2 TCs per register) */ +- reg = hw->fc.pause_time * 0x00010001; ++ reg = hw->fc.pause_time * 0x00010001U; + for (i = 0; i < (MAX_TRAFFIC_CLASS / 2); i++) + IXGBE_WRITE_REG(hw, IXGBE_FCTTV(i), reg); + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 8177276500f5..7d723b70fcf6 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -2258,7 +2258,8 @@ static void ixgbe_rx_buffer_flip(struct ixgbe_ring *rx_ring, + rx_buffer->page_offset ^= truesize; + #else + unsigned int truesize = ring_uses_build_skb(rx_ring) ? +- SKB_DATA_ALIGN(IXGBE_SKB_PAD + size) : ++ SKB_DATA_ALIGN(IXGBE_SKB_PAD + size) + ++ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) : + SKB_DATA_ALIGN(size); + + rx_buffer->page_offset += truesize; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +index 044687a1f27c..9d86e49a7f44 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -1314,6 +1314,7 @@ out: + + #ifdef CONFIG_MLX5_CORE_IPOIB + ++#define MLX5_IB_GRH_SGID_OFFSET 8 + #define MLX5_IB_GRH_DGID_OFFSET 24 + #define MLX5_GID_SIZE 16 + +@@ -1327,6 +1328,7 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq, + struct net_device *netdev; + struct mlx5e_priv *priv; + char *pseudo_header; ++ u32 flags_rqpn; + u32 qpn; + u8 *dgid; + u8 g; +@@ -1347,7 +1349,8 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq, + priv = mlx5i_epriv(netdev); + tstamp = &priv->tstamp; + +- g = (be32_to_cpu(cqe->flags_rqpn) >> 28) & 3; ++ flags_rqpn = be32_to_cpu(cqe->flags_rqpn); ++ g = (flags_rqpn >> 28) & 3; + dgid = skb->data + MLX5_IB_GRH_DGID_OFFSET; + if ((!g) || dgid[0] != 0xff) + skb->pkt_type = PACKET_HOST; +@@ -1356,9 +1359,15 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq, + else + skb->pkt_type = PACKET_MULTICAST; + +- /* TODO: IB/ipoib: Allow mcast packets from other VFs +- * 68996a6e760e5c74654723eeb57bf65628ae87f4 ++ /* Drop packets that this interface sent, ie multicast packets ++ * that the HCA has replicated. + */ ++ if (g && (qpn == (flags_rqpn & 0xffffff)) && ++ (memcmp(netdev->dev_addr + 4, skb->data + MLX5_IB_GRH_SGID_OFFSET, ++ MLX5_GID_SIZE) == 0)) { ++ skb->dev = NULL; ++ return; ++ } + + skb_pull(skb, MLX5_IB_GRH_BYTES); + +diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c +index 41d30f55c946..6bd6c261f2ba 100644 +--- a/drivers/net/ethernet/nxp/lpc_eth.c ++++ b/drivers/net/ethernet/nxp/lpc_eth.c +@@ -845,7 +845,8 @@ static int lpc_mii_init(struct netdata_local *pldat) + if (mdiobus_register(pldat->mii_bus)) + goto err_out_unregister_bus; + +- if (lpc_mii_probe(pldat->ndev) != 0) ++ err = lpc_mii_probe(pldat->ndev); ++ if (err) + goto err_out_unregister_bus; + + return 0; +diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +index 43c0c10dfeb7..3a4225837049 100644 +--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c ++++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +@@ -27,7 +27,6 @@ + #define DRV_VERSION "1.01" + const char pch_driver_version[] = DRV_VERSION; + +-#define PCI_DEVICE_ID_INTEL_IOH1_GBE 0x8802 /* Pci device ID */ + #define PCH_GBE_MAR_ENTRIES 16 + #define PCH_GBE_SHORT_PKT 64 + #define DSC_INIT16 0xC000 +@@ -37,11 +36,9 @@ const char pch_driver_version[] = DRV_VERSION; + #define PCH_GBE_PCI_BAR 1 + #define PCH_GBE_RESERVE_MEMORY 0x200000 /* 2MB */ + +-/* Macros for ML7223 */ +-#define PCI_VENDOR_ID_ROHM 0x10db +-#define PCI_DEVICE_ID_ROHM_ML7223_GBE 0x8013 ++#define PCI_DEVICE_ID_INTEL_IOH1_GBE 0x8802 + +-/* Macros for ML7831 */ ++#define PCI_DEVICE_ID_ROHM_ML7223_GBE 0x8013 + #define PCI_DEVICE_ID_ROHM_ML7831_GBE 0x8802 + + #define PCH_GBE_TX_WEIGHT 64 +diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h +index dc3be8a4acf4..2bdc410d1144 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede.h ++++ b/drivers/net/ethernet/qlogic/qede/qede.h +@@ -550,12 +550,14 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, + #define RX_RING_SIZE ((u16)BIT(RX_RING_SIZE_POW)) + #define NUM_RX_BDS_MAX (RX_RING_SIZE - 1) + #define NUM_RX_BDS_MIN 128 ++#define NUM_RX_BDS_KDUMP_MIN 63 + #define NUM_RX_BDS_DEF ((u16)BIT(10) - 1) + + #define TX_RING_SIZE_POW 13 + #define TX_RING_SIZE ((u16)BIT(TX_RING_SIZE_POW)) + #define NUM_TX_BDS_MAX (TX_RING_SIZE - 1) + #define NUM_TX_BDS_MIN 128 ++#define NUM_TX_BDS_KDUMP_MIN 63 + #define NUM_TX_BDS_DEF NUM_TX_BDS_MAX + + #define QEDE_MIN_PKT_LEN 64 +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index 0d8e39ffbcd1..1aabb2e7a38b 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -29,6 +29,7 @@ + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ ++#include <linux/crash_dump.h> + #include <linux/module.h> + #include <linux/pci.h> + #include <linux/version.h> +@@ -730,8 +731,14 @@ static struct qede_dev *qede_alloc_etherdev(struct qed_dev *cdev, + edev->dp_module = dp_module; + edev->dp_level = dp_level; + edev->ops = qed_ops; +- edev->q_num_rx_buffers = NUM_RX_BDS_DEF; +- edev->q_num_tx_buffers = NUM_TX_BDS_DEF; ++ ++ if (is_kdump_kernel()) { ++ edev->q_num_rx_buffers = NUM_RX_BDS_KDUMP_MIN; ++ edev->q_num_tx_buffers = NUM_TX_BDS_KDUMP_MIN; ++ } else { ++ edev->q_num_rx_buffers = NUM_RX_BDS_DEF; ++ edev->q_num_tx_buffers = NUM_TX_BDS_DEF; ++ } + + DP_INFO(edev, "Allocated netdev with %d tx queues and %d rx queues\n", + info->num_queues, info->num_queues); +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 807ef43a3cda..6df404e3dd27 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -229,7 +229,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = { + { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4300), 0, 0, RTL_CFG_0 }, + { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4302), 0, 0, RTL_CFG_0 }, + { PCI_DEVICE(PCI_VENDOR_ID_AT, 0xc107), 0, 0, RTL_CFG_0 }, +- { PCI_DEVICE(0x16ec, 0x0116), 0, 0, RTL_CFG_0 }, ++ { PCI_DEVICE(PCI_VENDOR_ID_USR, 0x0116), 0, 0, RTL_CFG_0 }, + { PCI_VENDOR_ID_LINKSYS, 0x1032, + PCI_ANY_ID, 0x0024, 0, 0, RTL_CFG_0 }, + { 0x0001, 0x8168, +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 225bfc808112..349123592af0 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -451,6 +451,10 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) + int ret; + rx_handler_result_t handle_res; + ++ /* Packets from dev_loopback_xmit() do not have L2 header, bail out */ ++ if (unlikely(skb->pkt_type == PACKET_LOOPBACK)) ++ return RX_HANDLER_PASS; ++ + port = macvlan_port_get_rcu(skb->dev); + if (is_multicast_ether_addr(eth->h_dest)) { + unsigned int hash; +diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c +index beeb7eb76ca3..57273188b71e 100644 +--- a/drivers/net/net_failover.c ++++ b/drivers/net/net_failover.c +@@ -62,7 +62,8 @@ static int net_failover_open(struct net_device *dev) + return 0; + + err_standby_open: +- dev_close(primary_dev); ++ if (primary_dev) ++ dev_close(primary_dev); + err_primary_open: + netif_tx_disable(dev); + return err; +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 09c444d3b496..d84a09172ddb 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1870,8 +1870,11 @@ drop: + skb->dev = tun->dev; + break; + case IFF_TAP: +- if (!frags) +- skb->protocol = eth_type_trans(skb, tun->dev); ++ if (frags && !pskb_may_pull(skb, ETH_HLEN)) { ++ err = -ENOMEM; ++ goto drop; ++ } ++ skb->protocol = eth_type_trans(skb, tun->dev); + break; + } + +@@ -1927,8 +1930,11 @@ drop: + } + + if (frags) { ++ u32 headlen; ++ + /* Exercise flow dissector code path. */ +- u32 headlen = eth_get_headlen(skb->data, skb_headlen(skb)); ++ skb_push(skb, ETH_HLEN); ++ headlen = eth_get_headlen(skb->data, skb_headlen(skb)); + + if (unlikely(headlen > skb_headlen(skb))) { + this_cpu_inc(tun->pcpu_stats->rx_dropped); +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 41a00cd76955..2abbad1abaf2 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -377,13 +377,15 @@ static struct sk_buff *veth_xdp_rcv_one(struct veth_rq *rq, + unsigned int *xdp_xmit) + { + void *hard_start = frame->data - frame->headroom; +- void *head = hard_start - sizeof(struct xdp_frame); + int len = frame->len, delta = 0; + struct xdp_frame orig_frame; + struct bpf_prog *xdp_prog; + unsigned int headroom; + struct sk_buff *skb; + ++ /* bpf_xdp_adjust_head() assures BPF cannot access xdp_frame area */ ++ hard_start -= sizeof(struct xdp_frame); ++ + rcu_read_lock(); + xdp_prog = rcu_dereference(rq->xdp_prog); + if (likely(xdp_prog)) { +@@ -405,7 +407,6 @@ static struct sk_buff *veth_xdp_rcv_one(struct veth_rq *rq, + break; + case XDP_TX: + orig_frame = *frame; +- xdp.data_hard_start = head; + xdp.rxq->mem = frame->mem; + if (unlikely(veth_xdp_tx(rq->dev, &xdp) < 0)) { + trace_xdp_exception(rq->dev, xdp_prog, act); +@@ -417,7 +418,6 @@ static struct sk_buff *veth_xdp_rcv_one(struct veth_rq *rq, + goto xdp_xmit; + case XDP_REDIRECT: + orig_frame = *frame; +- xdp.data_hard_start = head; + xdp.rxq->mem = frame->mem; + if (xdp_do_redirect(rq->dev, &xdp, xdp_prog)) { + frame = &orig_frame; +@@ -437,7 +437,7 @@ static struct sk_buff *veth_xdp_rcv_one(struct veth_rq *rq, + rcu_read_unlock(); + + headroom = sizeof(struct xdp_frame) + frame->headroom - delta; +- skb = veth_build_skb(head, headroom, len, 0); ++ skb = veth_build_skb(hard_start, headroom, len, 0); + if (!skb) { + xdp_return_frame(frame); + goto err; +diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c +index 559db051a500..88d18ab83e54 100644 +--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c ++++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c +@@ -692,6 +692,8 @@ vmxnet3_get_rss(struct net_device *netdev, u32 *p, u8 *key, u8 *hfunc) + *hfunc = ETH_RSS_HASH_TOP; + if (!p) + return 0; ++ if (n > UPT1_RSS_MAX_IND_TABLE_SIZE) ++ return 0; + while (n--) + p[n] = rssConf->indTable[n]; + return 0; +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 7ee0bad18466..09f0b53b2b77 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -1611,6 +1611,10 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request, + ns_olen = request->len - skb_network_offset(request) - + sizeof(struct ipv6hdr) - sizeof(*ns); + for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) { ++ if (!ns->opt[i + 1]) { ++ kfree_skb(reply); ++ return NULL; ++ } + if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) { + daddr = ns->opt + i + sizeof(struct nd_opt_hdr); + break; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index a09d7a07e90a..81af403c19c2 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3852,6 +3852,9 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work) + if (ret) { + ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n", + ret); ++ /* remove this msdu from idr tracking */ ++ ath10k_wmi_cleanup_mgmt_tx_send(ar, skb); ++ + dma_unmap_single(ar->dev, paddr, skb->len, + DMA_TO_DEVICE); + ieee80211_free_txskb(ar->hw, skb); +diff --git a/drivers/net/wireless/ath/ath10k/wmi-ops.h b/drivers/net/wireless/ath/ath10k/wmi-ops.h +index 7fd63bbf8e24..b6cd33fa79f8 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-ops.h ++++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h +@@ -139,6 +139,7 @@ struct wmi_ops { + struct sk_buff *(*gen_mgmt_tx_send)(struct ath10k *ar, + struct sk_buff *skb, + dma_addr_t paddr); ++ int (*cleanup_mgmt_tx_send)(struct ath10k *ar, struct sk_buff *msdu); + struct sk_buff *(*gen_dbglog_cfg)(struct ath10k *ar, u64 module_enable, + u32 log_level); + struct sk_buff *(*gen_pktlog_enable)(struct ath10k *ar, u32 filter); +@@ -431,6 +432,15 @@ ath10k_wmi_get_txbf_conf_scheme(struct ath10k *ar) + return ar->wmi.ops->get_txbf_conf_scheme(ar); + } + ++static inline int ++ath10k_wmi_cleanup_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu) ++{ ++ if (!ar->wmi.ops->cleanup_mgmt_tx_send) ++ return -EOPNOTSUPP; ++ ++ return ar->wmi.ops->cleanup_mgmt_tx_send(ar, msdu); ++} ++ + static inline int + ath10k_wmi_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu, + dma_addr_t paddr) +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 248decb494c2..7f435fa29f75 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -2638,6 +2638,18 @@ ath10k_wmi_tlv_op_gen_request_stats(struct ath10k *ar, u32 stats_mask) + return skb; + } + ++static int ++ath10k_wmi_tlv_op_cleanup_mgmt_tx_send(struct ath10k *ar, ++ struct sk_buff *msdu) ++{ ++ struct ath10k_skb_cb *cb = ATH10K_SKB_CB(msdu); ++ struct ath10k_wmi *wmi = &ar->wmi; ++ ++ idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); ++ ++ return 0; ++} ++ + static int + ath10k_wmi_mgmt_tx_alloc_msdu_id(struct ath10k *ar, struct sk_buff *skb, + dma_addr_t paddr) +@@ -2710,6 +2722,8 @@ ath10k_wmi_tlv_op_gen_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu, + if (desc_id < 0) + goto err_free_skb; + ++ cb->msdu_id = desc_id; ++ + ptr = (void *)skb->data; + tlv = ptr; + tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_MGMT_TX_CMD); +@@ -3949,6 +3963,7 @@ static const struct wmi_ops wmi_tlv_ops = { + .gen_force_fw_hang = ath10k_wmi_tlv_op_gen_force_fw_hang, + /* .gen_mgmt_tx = not implemented; HTT is used */ + .gen_mgmt_tx_send = ath10k_wmi_tlv_op_gen_mgmt_tx_send, ++ .cleanup_mgmt_tx_send = ath10k_wmi_tlv_op_cleanup_mgmt_tx_send, + .gen_dbglog_cfg = ath10k_wmi_tlv_op_gen_dbglog_cfg, + .gen_pktlog_enable = ath10k_wmi_tlv_op_gen_pktlog_enable, + .gen_pktlog_disable = ath10k_wmi_tlv_op_gen_pktlog_disable, +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index dd0c32379375..4ed21dad6a8e 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -612,6 +612,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + hif_dev->remain_skb = nskb; + spin_unlock(&hif_dev->rx_lock); + } else { ++ if (pool_index == MAX_PKT_NUM_IN_TRANSFER) { ++ dev_err(&hif_dev->udev->dev, ++ "ath9k_htc: over RX MAX_PKT_NUM\n"); ++ goto err; ++ } + nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC); + if (!nskb) { + dev_err(&hif_dev->udev->dev, +@@ -638,9 +643,9 @@ err: + + static void ath9k_hif_usb_rx_cb(struct urb *urb) + { +- struct sk_buff *skb = (struct sk_buff *) urb->context; +- struct hif_device_usb *hif_dev = +- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); ++ struct rx_buf *rx_buf = (struct rx_buf *)urb->context; ++ struct hif_device_usb *hif_dev = rx_buf->hif_dev; ++ struct sk_buff *skb = rx_buf->skb; + int ret; + + if (!skb) +@@ -680,14 +685,15 @@ resubmit: + return; + free: + kfree_skb(skb); ++ kfree(rx_buf); + } + + static void ath9k_hif_usb_reg_in_cb(struct urb *urb) + { +- struct sk_buff *skb = (struct sk_buff *) urb->context; ++ struct rx_buf *rx_buf = (struct rx_buf *)urb->context; ++ struct hif_device_usb *hif_dev = rx_buf->hif_dev; ++ struct sk_buff *skb = rx_buf->skb; + struct sk_buff *nskb; +- struct hif_device_usb *hif_dev = +- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); + int ret; + + if (!skb) +@@ -745,6 +751,7 @@ resubmit: + return; + free: + kfree_skb(skb); ++ kfree(rx_buf); + urb->context = NULL; + } + +@@ -790,7 +797,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) + init_usb_anchor(&hif_dev->mgmt_submitted); + + for (i = 0; i < MAX_TX_URB_NUM; i++) { +- tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL); ++ tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL); + if (!tx_buf) + goto err; + +@@ -827,8 +834,9 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) + + static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) + { +- struct urb *urb = NULL; ++ struct rx_buf *rx_buf = NULL; + struct sk_buff *skb = NULL; ++ struct urb *urb = NULL; + int i, ret; + + init_usb_anchor(&hif_dev->rx_submitted); +@@ -836,6 +844,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) + + for (i = 0; i < MAX_RX_URB_NUM; i++) { + ++ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); ++ if (!rx_buf) { ++ ret = -ENOMEM; ++ goto err_rxb; ++ } ++ + /* Allocate URB */ + urb = usb_alloc_urb(0, GFP_KERNEL); + if (urb == NULL) { +@@ -850,11 +864,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) + goto err_skb; + } + ++ rx_buf->hif_dev = hif_dev; ++ rx_buf->skb = skb; ++ + usb_fill_bulk_urb(urb, hif_dev->udev, + usb_rcvbulkpipe(hif_dev->udev, + USB_WLAN_RX_PIPE), + skb->data, MAX_RX_BUF_SIZE, +- ath9k_hif_usb_rx_cb, skb); ++ ath9k_hif_usb_rx_cb, rx_buf); + + /* Anchor URB */ + usb_anchor_urb(urb, &hif_dev->rx_submitted); +@@ -880,6 +897,8 @@ err_submit: + err_skb: + usb_free_urb(urb); + err_urb: ++ kfree(rx_buf); ++err_rxb: + ath9k_hif_usb_dealloc_rx_urbs(hif_dev); + return ret; + } +@@ -891,14 +910,21 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev) + + static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) + { +- struct urb *urb = NULL; ++ struct rx_buf *rx_buf = NULL; + struct sk_buff *skb = NULL; ++ struct urb *urb = NULL; + int i, ret; + + init_usb_anchor(&hif_dev->reg_in_submitted); + + for (i = 0; i < MAX_REG_IN_URB_NUM; i++) { + ++ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); ++ if (!rx_buf) { ++ ret = -ENOMEM; ++ goto err_rxb; ++ } ++ + /* Allocate URB */ + urb = usb_alloc_urb(0, GFP_KERNEL); + if (urb == NULL) { +@@ -913,11 +939,14 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) + goto err_skb; + } + ++ rx_buf->hif_dev = hif_dev; ++ rx_buf->skb = skb; ++ + usb_fill_int_urb(urb, hif_dev->udev, + usb_rcvintpipe(hif_dev->udev, + USB_REG_IN_PIPE), + skb->data, MAX_REG_IN_BUF_SIZE, +- ath9k_hif_usb_reg_in_cb, skb, 1); ++ ath9k_hif_usb_reg_in_cb, rx_buf, 1); + + /* Anchor URB */ + usb_anchor_urb(urb, &hif_dev->reg_in_submitted); +@@ -943,6 +972,8 @@ err_submit: + err_skb: + usb_free_urb(urb); + err_urb: ++ kfree(rx_buf); ++err_rxb: + ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev); + return ret; + } +@@ -973,7 +1004,7 @@ err: + return -ENOMEM; + } + +-static void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev) ++void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev) + { + usb_kill_anchored_urbs(&hif_dev->regout_submitted); + ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev); +@@ -1341,8 +1372,9 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface) + + if (hif_dev->flags & HIF_USB_READY) { + ath9k_htc_hw_deinit(hif_dev->htc_handle, unplugged); +- ath9k_htc_hw_free(hif_dev->htc_handle); + ath9k_hif_usb_dev_deinit(hif_dev); ++ ath9k_destoy_wmi(hif_dev->htc_handle->drv_priv); ++ ath9k_htc_hw_free(hif_dev->htc_handle); + } + + usb_set_intfdata(interface, NULL); +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h +index 7846916aa01d..5985aa15ca93 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.h ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h +@@ -86,6 +86,11 @@ struct tx_buf { + struct list_head list; + }; + ++struct rx_buf { ++ struct sk_buff *skb; ++ struct hif_device_usb *hif_dev; ++}; ++ + #define HIF_USB_TX_STOP BIT(0) + #define HIF_USB_TX_FLUSH BIT(1) + +@@ -133,5 +138,6 @@ struct hif_device_usb { + + int ath9k_hif_usb_init(void); + void ath9k_hif_usb_exit(void); ++void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev); + + #endif /* HTC_USB_H */ +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index 214c68269a69..27d9fe6799f5 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -933,8 +933,9 @@ err_init: + int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, + u16 devid, char *product, u32 drv_info) + { +- struct ieee80211_hw *hw; ++ struct hif_device_usb *hif_dev; + struct ath9k_htc_priv *priv; ++ struct ieee80211_hw *hw; + int ret; + + hw = ieee80211_alloc_hw(sizeof(struct ath9k_htc_priv), &ath9k_htc_ops); +@@ -969,7 +970,10 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, + return 0; + + err_init: +- ath9k_deinit_wmi(priv); ++ ath9k_stop_wmi(priv); ++ hif_dev = (struct hif_device_usb *)htc_handle->hif_dev; ++ ath9k_hif_usb_dealloc_urbs(hif_dev); ++ ath9k_destoy_wmi(priv); + err_free: + ieee80211_free_hw(hw); + return ret; +@@ -984,7 +988,7 @@ void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug) + htc_handle->drv_priv->ah->ah_flags |= AH_UNPLUGGED; + + ath9k_deinit_device(htc_handle->drv_priv); +- ath9k_deinit_wmi(htc_handle->drv_priv); ++ ath9k_stop_wmi(htc_handle->drv_priv); + ieee80211_free_hw(htc_handle->drv_priv->hw); + } + } +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +index b5d7ef4da17f..f19393e584dc 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -999,9 +999,9 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + * which are not PHY_ERROR (short radar pulses have a length of 3) + */ + if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) { +- ath_warn(common, +- "Short RX data len, dropping (dlen: %d)\n", +- rs_datalen); ++ ath_dbg(common, ANY, ++ "Short RX data len, dropping (dlen: %d)\n", ++ rs_datalen); + goto rx_next; + } + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index 1bf63a4efb4c..d2e062eaf561 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -113,6 +113,9 @@ static void htc_process_conn_rsp(struct htc_target *target, + + if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) { + epid = svc_rspmsg->endpoint_id; ++ if (epid < 0 || epid >= ENDPOINT_MAX) ++ return; ++ + service_id = be16_to_cpu(svc_rspmsg->service_id); + max_msglen = be16_to_cpu(svc_rspmsg->max_msg_len); + endpoint = &target->endpoint[epid]; +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index d1f6710ca63b..e7a3127395be 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -112,14 +112,17 @@ struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv) + return wmi; + } + +-void ath9k_deinit_wmi(struct ath9k_htc_priv *priv) ++void ath9k_stop_wmi(struct ath9k_htc_priv *priv) + { + struct wmi *wmi = priv->wmi; + + mutex_lock(&wmi->op_mutex); + wmi->stopped = true; + mutex_unlock(&wmi->op_mutex); ++} + ++void ath9k_destoy_wmi(struct ath9k_htc_priv *priv) ++{ + kfree(priv->wmi); + } + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h +index 380175d5ecd7..d8b912206232 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.h ++++ b/drivers/net/wireless/ath/ath9k/wmi.h +@@ -179,7 +179,6 @@ struct wmi { + }; + + struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv); +-void ath9k_deinit_wmi(struct ath9k_htc_priv *priv); + int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi, + enum htc_endpoint_id *wmi_ctrl_epid); + int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, +@@ -189,6 +188,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + void ath9k_wmi_event_tasklet(unsigned long data); + void ath9k_fatal_work(struct work_struct *work); + void ath9k_wmi_event_drain(struct ath9k_htc_priv *priv); ++void ath9k_stop_wmi(struct ath9k_htc_priv *priv); ++void ath9k_destoy_wmi(struct ath9k_htc_priv *priv); + + #define WMI_CMD(_wmi_cmd) \ + do { \ +diff --git a/drivers/net/wireless/ath/carl9170/fw.c b/drivers/net/wireless/ath/carl9170/fw.c +index 88045f93a76c..62ed0977f32c 100644 +--- a/drivers/net/wireless/ath/carl9170/fw.c ++++ b/drivers/net/wireless/ath/carl9170/fw.c +@@ -351,9 +351,7 @@ static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len) + ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC); + + if (SUPP(CARL9170FW_WLANTX_CAB)) { +- if_comb_types |= +- BIT(NL80211_IFTYPE_AP) | +- BIT(NL80211_IFTYPE_P2P_GO); ++ if_comb_types |= BIT(NL80211_IFTYPE_AP); + + #ifdef CONFIG_MAC80211_MESH + if_comb_types |= +diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c +index 7f1bdea742b8..7064e6fc5dbb 100644 +--- a/drivers/net/wireless/ath/carl9170/main.c ++++ b/drivers/net/wireless/ath/carl9170/main.c +@@ -582,11 +582,10 @@ static int carl9170_init_interface(struct ar9170 *ar, + ar->disable_offload |= ((vif->type != NL80211_IFTYPE_STATION) && + (vif->type != NL80211_IFTYPE_AP)); + +- /* While the driver supports HW offload in a single +- * P2P client configuration, it doesn't support HW +- * offload in the favourit, concurrent P2P GO+CLIENT +- * configuration. Hence, HW offload will always be +- * disabled for P2P. ++ /* The driver used to have P2P GO+CLIENT support, ++ * but since this was dropped and we don't know if ++ * there are any gremlins lurking in the shadows, ++ * so best we keep HW offload disabled for P2P. + */ + ar->disable_offload |= vif->p2p; + +@@ -639,18 +638,6 @@ static int carl9170_op_add_interface(struct ieee80211_hw *hw, + if (vif->type == NL80211_IFTYPE_STATION) + break; + +- /* P2P GO [master] use-case +- * Because the P2P GO station is selected dynamically +- * by all participating peers of a WIFI Direct network, +- * the driver has be able to change the main interface +- * operating mode on the fly. +- */ +- if (main_vif->p2p && vif->p2p && +- vif->type == NL80211_IFTYPE_AP) { +- old_main = main_vif; +- break; +- } +- + err = -EBUSY; + rcu_read_unlock(); + +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c +index 79998a3ddb7a..ad051f34e65b 100644 +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -1341,7 +1341,7 @@ static int wcn36xx_probe(struct platform_device *pdev) + if (addr && ret != ETH_ALEN) { + wcn36xx_err("invalid local-mac-address\n"); + ret = -EINVAL; +- goto out_wq; ++ goto out_destroy_ept; + } else if (addr) { + wcn36xx_info("mac address: %pM\n", addr); + SET_IEEE80211_PERM_ADDR(wcn->hw, addr); +@@ -1349,7 +1349,7 @@ static int wcn36xx_probe(struct platform_device *pdev) + + ret = wcn36xx_platform_get_resources(wcn, pdev); + if (ret) +- goto out_wq; ++ goto out_destroy_ept; + + wcn36xx_init_ieee80211(wcn); + ret = ieee80211_register_hw(wcn->hw); +@@ -1361,6 +1361,8 @@ static int wcn36xx_probe(struct platform_device *pdev) + out_unmap: + iounmap(wcn->ccu_base); + iounmap(wcn->dxe_base); ++out_destroy_ept: ++ rpmsg_destroy_ept(wcn->smd_channel); + out_wq: + ieee80211_free_hw(hw); + out_err: +diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c +index b37e7391f55d..8a226a9d755e 100644 +--- a/drivers/net/wireless/broadcom/b43/main.c ++++ b/drivers/net/wireless/broadcom/b43/main.c +@@ -5596,7 +5596,7 @@ static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev) + /* fill hw info */ + ieee80211_hw_set(hw, RX_INCLUDES_FCS); + ieee80211_hw_set(hw, SIGNAL_DBM); +- ++ ieee80211_hw_set(hw, MFP_CAPABLE); + hw->wiphy->interface_modes = + BIT(NL80211_IFTYPE_AP) | + BIT(NL80211_IFTYPE_MESH_POINT) | +diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c +index 770cc218ca4b..ef1f1b5d63b1 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/main.c ++++ b/drivers/net/wireless/broadcom/b43legacy/main.c +@@ -3835,6 +3835,7 @@ static int b43legacy_wireless_init(struct ssb_device *dev) + /* fill hw info */ + ieee80211_hw_set(hw, RX_INCLUDES_FCS); + ieee80211_hw_set(hw, SIGNAL_DBM); ++ ieee80211_hw_set(hw, MFP_CAPABLE); /* Allow WPA3 in software */ + + hw->wiphy->interface_modes = + BIT(NL80211_IFTYPE_AP) | +diff --git a/drivers/net/wireless/broadcom/b43legacy/xmit.c b/drivers/net/wireless/broadcom/b43legacy/xmit.c +index 35ccf400b02c..87045e30e585 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/xmit.c ++++ b/drivers/net/wireless/broadcom/b43legacy/xmit.c +@@ -571,6 +571,7 @@ void b43legacy_rx(struct b43legacy_wldev *dev, + default: + b43legacywarn(dev->wl, "Unexpected value for chanstat (0x%X)\n", + chanstat); ++ goto drop; + } + + memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status)); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c +index 4c5a3995dc35..d7f41caa0b0b 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c +@@ -281,13 +281,14 @@ void brcmf_feat_attach(struct brcmf_pub *drvr) + if (!err) + ifp->drvr->feat_flags |= BIT(BRCMF_FEAT_SCAN_RANDOM_MAC); + ++ brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_FWSUP, "sup_wpa"); ++ + if (drvr->settings->feature_disable) { + brcmf_dbg(INFO, "Features: 0x%02x, disable: 0x%02x\n", + ifp->drvr->feat_flags, + drvr->settings->feature_disable); + ifp->drvr->feat_flags &= ~drvr->settings->feature_disable; + } +- brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_FWSUP, "sup_wpa"); + + brcmf_feat_firmware_overrides(drvr); + +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 7b74ef71bef1..650191db25cb 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -1468,7 +1468,8 @@ mwifiex_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *dev, + int idx, u8 *mac, struct station_info *sinfo) + { + struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev); +- static struct mwifiex_sta_node *node; ++ struct mwifiex_sta_node *node; ++ int i; + + if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA) && + priv->media_connected && idx == 0) { +@@ -1478,13 +1479,10 @@ mwifiex_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *dev, + mwifiex_send_cmd(priv, HOST_CMD_APCMD_STA_LIST, + HostCmd_ACT_GEN_GET, 0, NULL, true); + +- if (node && (&node->list == &priv->sta_list)) { +- node = NULL; +- return -ENOENT; +- } +- +- node = list_prepare_entry(node, &priv->sta_list, list); +- list_for_each_entry_continue(node, &priv->sta_list, list) { ++ i = 0; ++ list_for_each_entry(node, &priv->sta_list, list) { ++ if (i++ != idx) ++ continue; + ether_addr_copy(mac, node->mac_addr); + return mwifiex_dump_station_info(priv, node, sinfo); + } +diff --git a/drivers/net/wireless/mediatek/mt76/agg-rx.c b/drivers/net/wireless/mediatek/mt76/agg-rx.c +index 73c8b2805c97..d44d57e6eb27 100644 +--- a/drivers/net/wireless/mediatek/mt76/agg-rx.c ++++ b/drivers/net/wireless/mediatek/mt76/agg-rx.c +@@ -154,8 +154,8 @@ void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames) + struct ieee80211_sta *sta; + struct mt76_rx_tid *tid; + bool sn_less; +- u16 seqno, head, size; +- u8 ackp, idx; ++ u16 seqno, head, size, idx; ++ u8 ackp; + + __skb_queue_tail(frames, skb); + +@@ -240,7 +240,7 @@ out: + } + + int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno, +- u16 ssn, u8 size) ++ u16 ssn, u16 size) + { + struct mt76_rx_tid *tid; + +@@ -264,7 +264,7 @@ EXPORT_SYMBOL_GPL(mt76_rx_aggr_start); + + static void mt76_rx_aggr_shutdown(struct mt76_dev *dev, struct mt76_rx_tid *tid) + { +- u8 size = tid->size; ++ u16 size = tid->size; + int i; + + cancel_delayed_work(&tid->reorder_work); +diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h +index 2eab35879163..7b1667ec619e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76.h +@@ -193,8 +193,8 @@ struct mt76_rx_tid { + struct delayed_work reorder_work; + + u16 head; +- u8 size; +- u8 nframes; ++ u16 size; ++ u16 nframes; + + u8 started:1, stopped:1, timer_pending:1; + +@@ -537,7 +537,7 @@ int mt76_get_survey(struct ieee80211_hw *hw, int idx, + void mt76_set_stream_caps(struct mt76_dev *dev, bool vht); + + int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tid, +- u16 ssn, u8 size); ++ u16 ssn, u16 size); + void mt76_rx_aggr_stop(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tid); + + void mt76_wcid_key_setup(struct mt76_dev *dev, struct mt76_wcid *wcid, +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 1181b725f503..1893640555c1 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -910,10 +910,8 @@ static struct urb *_rtl_usb_tx_urb_setup(struct ieee80211_hw *hw, + + WARN_ON(NULL == skb); + _urb = usb_alloc_urb(0, GFP_ATOMIC); +- if (!_urb) { +- kfree_skb(skb); ++ if (!_urb) + return NULL; +- } + _rtl_install_trx_info(rtlusb, skb, ep_num); + usb_fill_bulk_urb(_urb, rtlusb->udev, usb_sndbulkpipe(rtlusb->udev, + ep_num), skb->data, skb->len, _rtl_tx_complete, skb); +@@ -927,7 +925,6 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb, + struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw)); + u32 ep_num; + struct urb *_urb = NULL; +- struct sk_buff *_skb = NULL; + + WARN_ON(NULL == rtlusb->usb_tx_aggregate_hdl); + if (unlikely(IS_USB_STOP(rtlusb))) { +@@ -936,8 +933,7 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb, + return; + } + ep_num = rtlusb->ep_map.ep_mapping[qnum]; +- _skb = skb; +- _urb = _rtl_usb_tx_urb_setup(hw, _skb, ep_num); ++ _urb = _rtl_usb_tx_urb_setup(hw, skb, ep_num); + if (unlikely(!_urb)) { + pr_err("Can't allocate urb. Drop skb!\n"); + kfree_skb(skb); +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index d5359c7c811a..0d60f2f8f3ee 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -926,6 +926,19 @@ void nvme_stop_keep_alive(struct nvme_ctrl *ctrl) + } + EXPORT_SYMBOL_GPL(nvme_stop_keep_alive); + ++/* ++ * In NVMe 1.0 the CNS field was just a binary controller or namespace ++ * flag, thus sending any new CNS opcodes has a big chance of not working. ++ * Qemu unfortunately had that bug after reporting a 1.1 version compliance ++ * (but not for any later version). ++ */ ++static bool nvme_ctrl_limited_cns(struct nvme_ctrl *ctrl) ++{ ++ if (ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS) ++ return ctrl->vs < NVME_VS(1, 2, 0); ++ return ctrl->vs < NVME_VS(1, 1, 0); ++} ++ + static int nvme_identify_ctrl(struct nvme_ctrl *dev, struct nvme_id_ctrl **id) + { + struct nvme_command c = { }; +@@ -3368,8 +3381,7 @@ static void nvme_scan_work(struct work_struct *work) + + mutex_lock(&ctrl->scan_lock); + nn = le32_to_cpu(id->nn); +- if (ctrl->vs >= NVME_VS(1, 1, 0) && +- !(ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)) { ++ if (!nvme_ctrl_limited_cns(ctrl)) { + if (!nvme_scan_ns_list(ctrl, nn)) + goto out_free_id; + } +diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c +index 1bfbceb9f445..ca06d8bc01e7 100644 +--- a/drivers/pci/controller/pcie-mediatek.c ++++ b/drivers/pci/controller/pcie-mediatek.c +@@ -72,6 +72,7 @@ + #define PCIE_MSI_VECTOR 0x0c0 + + #define PCIE_CONF_VEND_ID 0x100 ++#define PCIE_CONF_DEVICE_ID 0x102 + #define PCIE_CONF_CLASS_ID 0x106 + + #define PCIE_INT_MASK 0x420 +@@ -134,12 +135,16 @@ struct mtk_pcie_port; + /** + * struct mtk_pcie_soc - differentiate between host generations + * @need_fix_class_id: whether this host's class ID needed to be fixed or not ++ * @need_fix_device_id: whether this host's device ID needed to be fixed or not ++ * @device_id: device ID which this host need to be fixed + * @ops: pointer to configuration access functions + * @startup: pointer to controller setting functions + * @setup_irq: pointer to initialize IRQ functions + */ + struct mtk_pcie_soc { + bool need_fix_class_id; ++ bool need_fix_device_id; ++ unsigned int device_id; + struct pci_ops *ops; + int (*startup)(struct mtk_pcie_port *port); + int (*setup_irq)(struct mtk_pcie_port *port, struct device_node *node); +@@ -678,6 +683,9 @@ static int mtk_pcie_startup_port_v2(struct mtk_pcie_port *port) + writew(val, port->base + PCIE_CONF_CLASS_ID); + } + ++ if (soc->need_fix_device_id) ++ writew(soc->device_id, port->base + PCIE_CONF_DEVICE_ID); ++ + /* 100ms timeout value should be enough for Gen1/2 training */ + err = readl_poll_timeout(port->base + PCIE_LINK_STATUS_V2, val, + !!(val & PCIE_PORT_LINKUP_V2), 20, +@@ -1213,11 +1221,21 @@ static const struct mtk_pcie_soc mtk_pcie_soc_mt7622 = { + .setup_irq = mtk_pcie_setup_irq, + }; + ++static const struct mtk_pcie_soc mtk_pcie_soc_mt7629 = { ++ .need_fix_class_id = true, ++ .need_fix_device_id = true, ++ .device_id = PCI_DEVICE_ID_MEDIATEK_7629, ++ .ops = &mtk_pcie_ops_v2, ++ .startup = mtk_pcie_startup_port_v2, ++ .setup_irq = mtk_pcie_setup_irq, ++}; ++ + static const struct of_device_id mtk_pcie_ids[] = { + { .compatible = "mediatek,mt2701-pcie", .data = &mtk_pcie_soc_v1 }, + { .compatible = "mediatek,mt7623-pcie", .data = &mtk_pcie_soc_v1 }, + { .compatible = "mediatek,mt2712-pcie", .data = &mtk_pcie_soc_mt2712 }, + { .compatible = "mediatek,mt7622-pcie", .data = &mtk_pcie_soc_mt7622 }, ++ { .compatible = "mediatek,mt7629-pcie", .data = &mtk_pcie_soc_mt7629 }, + {}, + }; + +diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c +index ab36e5ca1aca..b52885020c85 100644 +--- a/drivers/pci/controller/vmd.c ++++ b/drivers/pci/controller/vmd.c +@@ -866,6 +866,8 @@ static const struct pci_device_id vmd_ids[] = { + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_VMD_28C0), + .driver_data = VMD_FEAT_HAS_MEMBAR_SHADOW | + VMD_FEAT_HAS_BUS_RESTRICTIONS,}, ++ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_VMD_9A0B), ++ .driver_data = VMD_FEAT_HAS_BUS_RESTRICTIONS,}, + {0,} + }; + MODULE_DEVICE_TABLE(pci, vmd_ids); +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index fa4c386c8cd8..243b65f3c282 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1634,7 +1634,7 @@ int pci_setup_device(struct pci_dev *dev) + /* Device class may be changed after fixup */ + class = dev->class >> 8; + +- if (dev->non_compliant_bars) { ++ if (dev->non_compliant_bars && !dev->mmio_always_on) { + pci_read_config_word(dev, PCI_COMMAND, &cmd); + if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) { + pci_info(dev, "device has non-compliant BARs; disabling IO/MEM decoding\n"); +@@ -1748,13 +1748,33 @@ static void pci_configure_mps(struct pci_dev *dev) + struct pci_dev *bridge = pci_upstream_bridge(dev); + int mps, mpss, p_mps, rc; + +- if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge)) ++ if (!pci_is_pcie(dev)) + return; + + /* MPS and MRRS fields are of type 'RsvdP' for VFs, short-circuit out */ + if (dev->is_virtfn) + return; + ++ /* ++ * For Root Complex Integrated Endpoints, program the maximum ++ * supported value unless limited by the PCIE_BUS_PEER2PEER case. ++ */ ++ if (pci_pcie_type(dev) == PCI_EXP_TYPE_RC_END) { ++ if (pcie_bus_config == PCIE_BUS_PEER2PEER) ++ mps = 128; ++ else ++ mps = 128 << dev->pcie_mpss; ++ rc = pcie_set_mps(dev, mps); ++ if (rc) { ++ pci_warn(dev, "can't set Max Payload Size to %d; if necessary, use \"pci=pcie_bus_safe\" and report a bug\n", ++ mps); ++ } ++ return; ++ } ++ ++ if (!bridge || !pci_is_pcie(bridge)) ++ return; ++ + mps = pcie_get_mps(dev); + p_mps = pcie_get_mps(bridge); + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index ca41cff2e68c..0862cb633849 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4263,6 +4263,24 @@ static void quirk_chelsio_T5_disable_root_port_attributes(struct pci_dev *pdev) + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID, + quirk_chelsio_T5_disable_root_port_attributes); + ++/* ++ * pci_acs_ctrl_enabled - compare desired ACS controls with those provided ++ * by a device ++ * @acs_ctrl_req: Bitmask of desired ACS controls ++ * @acs_ctrl_ena: Bitmask of ACS controls enabled or provided implicitly by ++ * the hardware design ++ * ++ * Return 1 if all ACS controls in the @acs_ctrl_req bitmask are included ++ * in @acs_ctrl_ena, i.e., the device provides all the access controls the ++ * caller desires. Return 0 otherwise. ++ */ ++static int pci_acs_ctrl_enabled(u16 acs_ctrl_req, u16 acs_ctrl_ena) ++{ ++ if ((acs_ctrl_req & acs_ctrl_ena) == acs_ctrl_req) ++ return 1; ++ return 0; ++} ++ + /* + * AMD has indicated that the devices below do not support peer-to-peer + * in any system where they are found in the southbridge with an AMD +@@ -4306,7 +4324,7 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags) + /* Filter out flags not applicable to multifunction */ + acs_flags &= (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_EC | PCI_ACS_DT); + +- return acs_flags & ~(PCI_ACS_RR | PCI_ACS_CR) ? 0 : 1; ++ return pci_acs_ctrl_enabled(acs_flags, PCI_ACS_RR | PCI_ACS_CR); + #else + return -ENODEV; + #endif +@@ -4333,20 +4351,19 @@ static bool pci_quirk_cavium_acs_match(struct pci_dev *dev) + + static int pci_quirk_cavium_acs(struct pci_dev *dev, u16 acs_flags) + { ++ if (!pci_quirk_cavium_acs_match(dev)) ++ return -ENOTTY; ++ + /* +- * Cavium root ports don't advertise an ACS capability. However, ++ * Cavium Root Ports don't advertise an ACS capability. However, + * the RTL internally implements similar protection as if ACS had +- * Request Redirection, Completion Redirection, Source Validation, ++ * Source Validation, Request Redirection, Completion Redirection, + * and Upstream Forwarding features enabled. Assert that the + * hardware implements and enables equivalent ACS functionality for + * these flags. + */ +- acs_flags &= ~(PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_SV | PCI_ACS_UF); +- +- if (!pci_quirk_cavium_acs_match(dev)) +- return -ENOTTY; +- +- return acs_flags ? 0 : 1; ++ return pci_acs_ctrl_enabled(acs_flags, ++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); + } + + static int pci_quirk_xgene_acs(struct pci_dev *dev, u16 acs_flags) +@@ -4356,13 +4373,12 @@ static int pci_quirk_xgene_acs(struct pci_dev *dev, u16 acs_flags) + * transactions with others, allowing masking out these bits as if they + * were unimplemented in the ACS capability. + */ +- acs_flags &= ~(PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); +- +- return acs_flags ? 0 : 1; ++ return pci_acs_ctrl_enabled(acs_flags, ++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); + } + + /* +- * Many Intel PCH root ports do provide ACS-like features to disable peer ++ * Many Intel PCH Root Ports do provide ACS-like features to disable peer + * transactions and validate bus numbers in requests, but do not provide an + * actual PCIe ACS capability. This is the list of device IDs known to fall + * into that category as provided by Intel in Red Hat bugzilla 1037684. +@@ -4410,37 +4426,32 @@ static bool pci_quirk_intel_pch_acs_match(struct pci_dev *dev) + return false; + } + +-#define INTEL_PCH_ACS_FLAGS (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_SV) +- + static int pci_quirk_intel_pch_acs(struct pci_dev *dev, u16 acs_flags) + { +- u16 flags = dev->dev_flags & PCI_DEV_FLAGS_ACS_ENABLED_QUIRK ? +- INTEL_PCH_ACS_FLAGS : 0; +- + if (!pci_quirk_intel_pch_acs_match(dev)) + return -ENOTTY; + +- return acs_flags & ~flags ? 0 : 1; ++ if (dev->dev_flags & PCI_DEV_FLAGS_ACS_ENABLED_QUIRK) ++ return pci_acs_ctrl_enabled(acs_flags, ++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); ++ ++ return pci_acs_ctrl_enabled(acs_flags, 0); + } + + /* +- * These QCOM root ports do provide ACS-like features to disable peer ++ * These QCOM Root Ports do provide ACS-like features to disable peer + * transactions and validate bus numbers in requests, but do not provide an + * actual PCIe ACS capability. Hardware supports source validation but it + * will report the issue as Completer Abort instead of ACS Violation. +- * Hardware doesn't support peer-to-peer and each root port is a root +- * complex with unique segment numbers. It is not possible for one root +- * port to pass traffic to another root port. All PCIe transactions are +- * terminated inside the root port. ++ * Hardware doesn't support peer-to-peer and each Root Port is a Root ++ * Complex with unique segment numbers. It is not possible for one Root ++ * Port to pass traffic to another Root Port. All PCIe transactions are ++ * terminated inside the Root Port. + */ + static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags) + { +- u16 flags = (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_SV); +- int ret = acs_flags & ~flags ? 0 : 1; +- +- pci_info(dev, "Using QCOM ACS Quirk (%d)\n", ret); +- +- return ret; ++ return pci_acs_ctrl_enabled(acs_flags, ++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); + } + + /* +@@ -4523,7 +4534,7 @@ static int pci_quirk_intel_spt_pch_acs(struct pci_dev *dev, u16 acs_flags) + + pci_read_config_dword(dev, pos + INTEL_SPT_ACS_CTRL, &ctrl); + +- return acs_flags & ~ctrl ? 0 : 1; ++ return pci_acs_ctrl_enabled(acs_flags, ctrl); + } + + static int pci_quirk_mf_endpoint_acs(struct pci_dev *dev, u16 acs_flags) +@@ -4537,10 +4548,35 @@ static int pci_quirk_mf_endpoint_acs(struct pci_dev *dev, u16 acs_flags) + * perform peer-to-peer with other functions, allowing us to mask out + * these bits as if they were unimplemented in the ACS capability. + */ +- acs_flags &= ~(PCI_ACS_SV | PCI_ACS_TB | PCI_ACS_RR | +- PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_DT); ++ return pci_acs_ctrl_enabled(acs_flags, ++ PCI_ACS_SV | PCI_ACS_TB | PCI_ACS_RR | ++ PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_DT); ++} ++ ++static int pci_quirk_rciep_acs(struct pci_dev *dev, u16 acs_flags) ++{ ++ /* ++ * Intel RCiEP's are required to allow p2p only on translated ++ * addresses. Refer to Intel VT-d specification, r3.1, sec 3.16, ++ * "Root-Complex Peer to Peer Considerations". ++ */ ++ if (pci_pcie_type(dev) != PCI_EXP_TYPE_RC_END) ++ return -ENOTTY; + +- return acs_flags ? 0 : 1; ++ return pci_acs_ctrl_enabled(acs_flags, ++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); ++} ++ ++static int pci_quirk_brcm_acs(struct pci_dev *dev, u16 acs_flags) ++{ ++ /* ++ * iProc PAXB Root Ports don't advertise an ACS capability, but ++ * they do not allow peer-to-peer transactions between Root Ports. ++ * Allow each Root Port to be in a separate IOMMU group by masking ++ * SV/RR/CR/UF bits. ++ */ ++ return pci_acs_ctrl_enabled(acs_flags, ++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); + } + + static const struct pci_dev_acs_enabled { +@@ -4613,6 +4649,7 @@ static const struct pci_dev_acs_enabled { + /* I219 */ + { PCI_VENDOR_ID_INTEL, 0x15b7, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_INTEL, 0x15b8, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_INTEL, PCI_ANY_ID, pci_quirk_rciep_acs }, + /* QCOM QDF2xxx root ports */ + { PCI_VENDOR_ID_QCOM, 0x0400, pci_quirk_qcom_rp_acs }, + { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, +@@ -4634,9 +4671,21 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_AMPERE, 0xE00A, pci_quirk_xgene_acs }, + { PCI_VENDOR_ID_AMPERE, 0xE00B, pci_quirk_xgene_acs }, + { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, + { 0 } + }; + ++/* ++ * pci_dev_specific_acs_enabled - check whether device provides ACS controls ++ * @dev: PCI device ++ * @acs_flags: Bitmask of desired ACS controls ++ * ++ * Returns: ++ * -ENOTTY: No quirk applies to this device; we can't tell whether the ++ * device provides the desired controls ++ * 0: Device does not provide all the desired controls ++ * >0: Device provides all the controls in @acs_flags ++ */ + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags) + { + const struct pci_dev_acs_enabled *i; +@@ -4956,13 +5005,25 @@ static void quirk_intel_qat_vf_cap(struct pci_dev *pdev) + } + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x443, quirk_intel_qat_vf_cap); + +-/* FLR may cause some 82579 devices to hang */ +-static void quirk_intel_no_flr(struct pci_dev *dev) ++/* ++ * FLR may cause the following to devices to hang: ++ * ++ * AMD Starship/Matisse HD Audio Controller 0x1487 ++ * AMD Starship USB 3.0 Host Controller 0x148c ++ * AMD Matisse USB 3.0 Host Controller 0x149c ++ * Intel 82579LM Gigabit Ethernet Controller 0x1502 ++ * Intel 82579V Gigabit Ethernet Controller 0x1503 ++ * ++ */ ++static void quirk_no_flr(struct pci_dev *dev) + { + dev->dev_flags |= PCI_DEV_FLAGS_NO_FLR_RESET; + } +-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_intel_no_flr); +-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_intel_no_flr); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1487, quirk_no_flr); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x148c, quirk_no_flr); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x149c, quirk_no_flr); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr); + + static void quirk_no_ext_tags(struct pci_dev *pdev) + { +@@ -5016,35 +5077,49 @@ static void quirk_fsl_no_msi(struct pci_dev *pdev) + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_FREESCALE, PCI_ANY_ID, quirk_fsl_no_msi); + + /* +- * GPUs with integrated HDA controller for streaming audio to attached displays +- * need a device link from the HDA controller (consumer) to the GPU (supplier) +- * so that the GPU is powered up whenever the HDA controller is accessed. +- * The GPU and HDA controller are functions 0 and 1 of the same PCI device. +- * The device link stays in place until shutdown (or removal of the PCI device +- * if it's hotplugged). Runtime PM is allowed by default on the HDA controller +- * to prevent it from permanently keeping the GPU awake. ++ * Although not allowed by the spec, some multi-function devices have ++ * dependencies of one function (consumer) on another (supplier). For the ++ * consumer to work in D0, the supplier must also be in D0. Create a ++ * device link from the consumer to the supplier to enforce this ++ * dependency. Runtime PM is allowed by default on the consumer to prevent ++ * it from permanently keeping the supplier awake. + */ +-static void quirk_gpu_hda(struct pci_dev *hda) ++static void pci_create_device_link(struct pci_dev *pdev, unsigned int consumer, ++ unsigned int supplier, unsigned int class, ++ unsigned int class_shift) + { +- struct pci_dev *gpu; ++ struct pci_dev *supplier_pdev; + +- if (PCI_FUNC(hda->devfn) != 1) ++ if (PCI_FUNC(pdev->devfn) != consumer) + return; + +- gpu = pci_get_domain_bus_and_slot(pci_domain_nr(hda->bus), +- hda->bus->number, +- PCI_DEVFN(PCI_SLOT(hda->devfn), 0)); +- if (!gpu || (gpu->class >> 16) != PCI_BASE_CLASS_DISPLAY) { +- pci_dev_put(gpu); ++ supplier_pdev = pci_get_domain_bus_and_slot(pci_domain_nr(pdev->bus), ++ pdev->bus->number, ++ PCI_DEVFN(PCI_SLOT(pdev->devfn), supplier)); ++ if (!supplier_pdev || (supplier_pdev->class >> class_shift) != class) { ++ pci_dev_put(supplier_pdev); + return; + } + +- if (!device_link_add(&hda->dev, &gpu->dev, +- DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME)) +- pci_err(hda, "cannot link HDA to GPU %s\n", pci_name(gpu)); ++ if (device_link_add(&pdev->dev, &supplier_pdev->dev, ++ DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME)) ++ pci_info(pdev, "D0 power state depends on %s\n", ++ pci_name(supplier_pdev)); ++ else ++ pci_err(pdev, "Cannot enforce power dependency on %s\n", ++ pci_name(supplier_pdev)); + +- pm_runtime_allow(&hda->dev); +- pci_dev_put(gpu); ++ pm_runtime_allow(&pdev->dev); ++ pci_dev_put(supplier_pdev); ++} ++ ++/* ++ * Create device link for GPUs with integrated HDA controller for streaming ++ * audio to attached displays. ++ */ ++static void quirk_gpu_hda(struct pci_dev *hda) ++{ ++ pci_create_device_link(hda, 1, 0, PCI_BASE_CLASS_DISPLAY, 16); + } + DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, PCI_ANY_ID, + PCI_CLASS_MULTIMEDIA_HD_AUDIO, 8, quirk_gpu_hda); +@@ -5053,6 +5128,62 @@ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_AMD, PCI_ANY_ID, + DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, + PCI_CLASS_MULTIMEDIA_HD_AUDIO, 8, quirk_gpu_hda); + ++/* ++ * Create device link for NVIDIA GPU with integrated USB xHCI Host ++ * controller to VGA. ++ */ ++static void quirk_gpu_usb(struct pci_dev *usb) ++{ ++ pci_create_device_link(usb, 2, 0, PCI_BASE_CLASS_DISPLAY, 16); ++} ++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, ++ PCI_CLASS_SERIAL_USB, 8, quirk_gpu_usb); ++ ++/* ++ * Create device link for NVIDIA GPU with integrated Type-C UCSI controller ++ * to VGA. Currently there is no class code defined for UCSI device over PCI ++ * so using UNKNOWN class for now and it will be updated when UCSI ++ * over PCI gets a class code. ++ */ ++#define PCI_CLASS_SERIAL_UNKNOWN 0x0c80 ++static void quirk_gpu_usb_typec_ucsi(struct pci_dev *ucsi) ++{ ++ pci_create_device_link(ucsi, 3, 0, PCI_BASE_CLASS_DISPLAY, 16); ++} ++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, ++ PCI_CLASS_SERIAL_UNKNOWN, 8, ++ quirk_gpu_usb_typec_ucsi); ++ ++/* ++ * Enable the NVIDIA GPU integrated HDA controller if the BIOS left it ++ * disabled. https://devtalk.nvidia.com/default/topic/1024022 ++ */ ++static void quirk_nvidia_hda(struct pci_dev *gpu) ++{ ++ u8 hdr_type; ++ u32 val; ++ ++ /* There was no integrated HDA controller before MCP89 */ ++ if (gpu->device < PCI_DEVICE_ID_NVIDIA_GEFORCE_320M) ++ return; ++ ++ /* Bit 25 at offset 0x488 enables the HDA controller */ ++ pci_read_config_dword(gpu, 0x488, &val); ++ if (val & BIT(25)) ++ return; ++ ++ pci_info(gpu, "Enabling HDA controller\n"); ++ pci_write_config_dword(gpu, 0x488, val | BIT(25)); ++ ++ /* The GPU becomes a multi-function device when the HDA is enabled */ ++ pci_read_config_byte(gpu, PCI_HEADER_TYPE, &hdr_type); ++ gpu->multifunction = !!(hdr_type & 0x80); ++} ++DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, ++ PCI_BASE_CLASS_DISPLAY, 16, quirk_nvidia_hda); ++DECLARE_PCI_FIXUP_CLASS_RESUME_EARLY(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, ++ PCI_BASE_CLASS_DISPLAY, 16, quirk_nvidia_hda); ++ + /* + * Some IDT switches incorrectly flag an ACS Source Validation error on + * completions for config read requests even though PCIe r4.0, sec +@@ -5294,6 +5425,19 @@ static void pci_fixup_no_d0_pme(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x2142, pci_fixup_no_d0_pme); + ++/* ++ * Device [12d8:0x400e] and [12d8:0x400f] ++ * These devices advertise PME# support in all power states but don't ++ * reliably assert it. ++ */ ++static void pci_fixup_no_pme(struct pci_dev *dev) ++{ ++ pci_info(dev, "PME# is unreliable, disabling it\n"); ++ dev->pme_support = 0; ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400e, pci_fixup_no_pme); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400f, pci_fixup_no_pme); ++ + static void apex_pci_fixup_class(struct pci_dev *pdev) + { + pdev->class = (PCI_CLASS_SYSTEM_OTHER << 8) | pdev->class; +diff --git a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +index 443906e0aff3..0393c4471227 100644 +--- a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c ++++ b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +@@ -290,7 +290,7 @@ static struct attribute *hisi_hha_pmu_events_attr[] = { + HISI_PMU_EVENT_ATTR(rx_wbip, 0x05), + HISI_PMU_EVENT_ATTR(rx_wtistash, 0x11), + HISI_PMU_EVENT_ATTR(rd_ddr_64b, 0x1c), +- HISI_PMU_EVENT_ATTR(wr_dr_64b, 0x1d), ++ HISI_PMU_EVENT_ATTR(wr_ddr_64b, 0x1d), + HISI_PMU_EVENT_ATTR(rd_ddr_128b, 0x1e), + HISI_PMU_EVENT_ATTR(wr_ddr_128b, 0x1f), + HISI_PMU_EVENT_ATTR(spill_num, 0x20), +diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c +index e87ee43efa16..24956f6c6324 100644 +--- a/drivers/pinctrl/samsung/pinctrl-exynos.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c +@@ -40,6 +40,8 @@ struct exynos_irq_chip { + u32 eint_pend; + u32 eint_wake_mask_value; + u32 eint_wake_mask_reg; ++ void (*set_eint_wakeup_mask)(struct samsung_pinctrl_drv_data *drvdata, ++ struct exynos_irq_chip *irq_chip); + }; + + static inline struct exynos_irq_chip *to_exynos_irq_chip(struct irq_chip *chip) +@@ -265,6 +267,7 @@ struct exynos_eint_gpio_save { + u32 eint_con; + u32 eint_fltcon0; + u32 eint_fltcon1; ++ u32 eint_mask; + }; + + /* +@@ -350,6 +353,47 @@ static int exynos_wkup_irq_set_wake(struct irq_data *irqd, unsigned int on) + return 0; + } + ++static void ++exynos_pinctrl_set_eint_wakeup_mask(struct samsung_pinctrl_drv_data *drvdata, ++ struct exynos_irq_chip *irq_chip) ++{ ++ struct regmap *pmu_regs; ++ ++ if (!drvdata->retention_ctrl || !drvdata->retention_ctrl->priv) { ++ dev_warn(drvdata->dev, ++ "No retention data configured bank with external wakeup interrupt. Wake-up mask will not be set.\n"); ++ return; ++ } ++ ++ pmu_regs = drvdata->retention_ctrl->priv; ++ dev_info(drvdata->dev, ++ "Setting external wakeup interrupt mask: 0x%x\n", ++ irq_chip->eint_wake_mask_value); ++ ++ regmap_write(pmu_regs, irq_chip->eint_wake_mask_reg, ++ irq_chip->eint_wake_mask_value); ++} ++ ++static void ++s5pv210_pinctrl_set_eint_wakeup_mask(struct samsung_pinctrl_drv_data *drvdata, ++ struct exynos_irq_chip *irq_chip) ++ ++{ ++ void __iomem *clk_base; ++ ++ if (!drvdata->retention_ctrl || !drvdata->retention_ctrl->priv) { ++ dev_warn(drvdata->dev, ++ "No retention data configured bank with external wakeup interrupt. Wake-up mask will not be set.\n"); ++ return; ++ } ++ ++ ++ clk_base = (void __iomem *) drvdata->retention_ctrl->priv; ++ ++ __raw_writel(irq_chip->eint_wake_mask_value, ++ clk_base + irq_chip->eint_wake_mask_reg); ++} ++ + /* + * irq_chip for wakeup interrupts + */ +@@ -368,8 +412,9 @@ static const struct exynos_irq_chip s5pv210_wkup_irq_chip __initconst = { + .eint_mask = EXYNOS_WKUP_EMASK_OFFSET, + .eint_pend = EXYNOS_WKUP_EPEND_OFFSET, + .eint_wake_mask_value = EXYNOS_EINT_WAKEUP_MASK_DISABLED, +- /* Only difference with exynos4210_wkup_irq_chip: */ ++ /* Only differences with exynos4210_wkup_irq_chip: */ + .eint_wake_mask_reg = S5PV210_EINT_WAKEUP_MASK, ++ .set_eint_wakeup_mask = s5pv210_pinctrl_set_eint_wakeup_mask, + }; + + static const struct exynos_irq_chip exynos4210_wkup_irq_chip __initconst = { +@@ -388,6 +433,7 @@ static const struct exynos_irq_chip exynos4210_wkup_irq_chip __initconst = { + .eint_pend = EXYNOS_WKUP_EPEND_OFFSET, + .eint_wake_mask_value = EXYNOS_EINT_WAKEUP_MASK_DISABLED, + .eint_wake_mask_reg = EXYNOS_EINT_WAKEUP_MASK, ++ .set_eint_wakeup_mask = exynos_pinctrl_set_eint_wakeup_mask, + }; + + static const struct exynos_irq_chip exynos7_wkup_irq_chip __initconst = { +@@ -406,6 +452,7 @@ static const struct exynos_irq_chip exynos7_wkup_irq_chip __initconst = { + .eint_pend = EXYNOS7_WKUP_EPEND_OFFSET, + .eint_wake_mask_value = EXYNOS_EINT_WAKEUP_MASK_DISABLED, + .eint_wake_mask_reg = EXYNOS5433_EINT_WAKEUP_MASK, ++ .set_eint_wakeup_mask = exynos_pinctrl_set_eint_wakeup_mask, + }; + + /* list of external wakeup controllers supported */ +@@ -582,27 +629,6 @@ int exynos_eint_wkup_init(struct samsung_pinctrl_drv_data *d) + return 0; + } + +-static void +-exynos_pinctrl_set_eint_wakeup_mask(struct samsung_pinctrl_drv_data *drvdata, +- struct exynos_irq_chip *irq_chip) +-{ +- struct regmap *pmu_regs; +- +- if (!drvdata->retention_ctrl || !drvdata->retention_ctrl->priv) { +- dev_warn(drvdata->dev, +- "No retention data configured bank with external wakeup interrupt. Wake-up mask will not be set.\n"); +- return; +- } +- +- pmu_regs = drvdata->retention_ctrl->priv; +- dev_info(drvdata->dev, +- "Setting external wakeup interrupt mask: 0x%x\n", +- irq_chip->eint_wake_mask_value); +- +- regmap_write(pmu_regs, irq_chip->eint_wake_mask_reg, +- irq_chip->eint_wake_mask_value); +-} +- + static void exynos_pinctrl_suspend_bank( + struct samsung_pinctrl_drv_data *drvdata, + struct samsung_pin_bank *bank) +@@ -616,10 +642,13 @@ static void exynos_pinctrl_suspend_bank( + + 2 * bank->eint_offset); + save->eint_fltcon1 = readl(regs + EXYNOS_GPIO_EFLTCON_OFFSET + + 2 * bank->eint_offset + 4); ++ save->eint_mask = readl(regs + bank->irq_chip->eint_mask ++ + bank->eint_offset); + + pr_debug("%s: save con %#010x\n", bank->name, save->eint_con); + pr_debug("%s: save fltcon0 %#010x\n", bank->name, save->eint_fltcon0); + pr_debug("%s: save fltcon1 %#010x\n", bank->name, save->eint_fltcon1); ++ pr_debug("%s: save mask %#010x\n", bank->name, save->eint_mask); + } + + void exynos_pinctrl_suspend(struct samsung_pinctrl_drv_data *drvdata) +@@ -634,8 +663,8 @@ void exynos_pinctrl_suspend(struct samsung_pinctrl_drv_data *drvdata) + else if (bank->eint_type == EINT_TYPE_WKUP) { + if (!irq_chip) { + irq_chip = bank->irq_chip; +- exynos_pinctrl_set_eint_wakeup_mask(drvdata, +- irq_chip); ++ irq_chip->set_eint_wakeup_mask(drvdata, ++ irq_chip); + } else if (bank->irq_chip != irq_chip) { + dev_warn(drvdata->dev, + "More than one external wakeup interrupt chip configured (bank: %s). This is not supported by hardware nor by driver.\n", +@@ -661,6 +690,9 @@ static void exynos_pinctrl_resume_bank( + pr_debug("%s: fltcon1 %#010x => %#010x\n", bank->name, + readl(regs + EXYNOS_GPIO_EFLTCON_OFFSET + + 2 * bank->eint_offset + 4), save->eint_fltcon1); ++ pr_debug("%s: mask %#010x => %#010x\n", bank->name, ++ readl(regs + bank->irq_chip->eint_mask ++ + bank->eint_offset), save->eint_mask); + + writel(save->eint_con, regs + EXYNOS_GPIO_ECON_OFFSET + + bank->eint_offset); +@@ -668,6 +700,8 @@ static void exynos_pinctrl_resume_bank( + + 2 * bank->eint_offset); + writel(save->eint_fltcon1, regs + EXYNOS_GPIO_EFLTCON_OFFSET + + 2 * bank->eint_offset + 4); ++ writel(save->eint_mask, regs + bank->irq_chip->eint_mask ++ + bank->eint_offset); + } + + void exynos_pinctrl_resume(struct samsung_pinctrl_drv_data *drvdata) +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index 06a3c1ef8eee..952544ca0d84 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -474,8 +474,14 @@ static ssize_t postcode_show(struct device *dev, struct device_attribute *attr, + static ssize_t als_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count) + { +- u32 tmp = simple_strtoul(buf, NULL, 10); +- int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, HPWMI_WRITE, &tmp, ++ u32 tmp; ++ int ret; ++ ++ ret = kstrtou32(buf, 10, &tmp); ++ if (ret) ++ return ret; ++ ++ ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, HPWMI_WRITE, &tmp, + sizeof(tmp), sizeof(tmp)); + if (ret) + return ret < 0 ? ret : -EINVAL; +diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c +index 3201a83073b5..c514cb73bb50 100644 +--- a/drivers/platform/x86/intel-hid.c ++++ b/drivers/platform/x86/intel-hid.c +@@ -87,6 +87,13 @@ static const struct dmi_system_id button_array_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Wacom MobileStudio Pro 16"), + }, + }, ++ { ++ .ident = "HP Spectre x2 (2015)", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x2 Detachable"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c +index a0d0cecff55f..d122f33d43ac 100644 +--- a/drivers/platform/x86/intel-vbtn.c ++++ b/drivers/platform/x86/intel-vbtn.c +@@ -39,28 +39,51 @@ static const struct key_entry intel_vbtn_keymap[] = { + { KE_IGNORE, 0xC7, { KEY_VOLUMEDOWN } }, /* volume-down key release */ + { KE_KEY, 0xC8, { KEY_ROTATE_LOCK_TOGGLE } }, /* rotate-lock key press */ + { KE_KEY, 0xC9, { KEY_ROTATE_LOCK_TOGGLE } }, /* rotate-lock key release */ ++}; ++ ++static const struct key_entry intel_vbtn_switchmap[] = { + { KE_SW, 0xCA, { .sw = { SW_DOCK, 1 } } }, /* Docked */ + { KE_SW, 0xCB, { .sw = { SW_DOCK, 0 } } }, /* Undocked */ + { KE_SW, 0xCC, { .sw = { SW_TABLET_MODE, 1 } } }, /* Tablet */ + { KE_SW, 0xCD, { .sw = { SW_TABLET_MODE, 0 } } }, /* Laptop */ +- { KE_END }, + }; + ++#define KEYMAP_LEN \ ++ (ARRAY_SIZE(intel_vbtn_keymap) + ARRAY_SIZE(intel_vbtn_switchmap) + 1) ++ + struct intel_vbtn_priv { ++ struct key_entry keymap[KEYMAP_LEN]; + struct input_dev *input_dev; ++ bool has_switches; + bool wakeup_mode; + }; + + static int intel_vbtn_input_setup(struct platform_device *device) + { + struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev); +- int ret; ++ int ret, keymap_len = 0; ++ ++ if (true) { ++ memcpy(&priv->keymap[keymap_len], intel_vbtn_keymap, ++ ARRAY_SIZE(intel_vbtn_keymap) * ++ sizeof(struct key_entry)); ++ keymap_len += ARRAY_SIZE(intel_vbtn_keymap); ++ } ++ ++ if (priv->has_switches) { ++ memcpy(&priv->keymap[keymap_len], intel_vbtn_switchmap, ++ ARRAY_SIZE(intel_vbtn_switchmap) * ++ sizeof(struct key_entry)); ++ keymap_len += ARRAY_SIZE(intel_vbtn_switchmap); ++ } ++ ++ priv->keymap[keymap_len].type = KE_END; + + priv->input_dev = devm_input_allocate_device(&device->dev); + if (!priv->input_dev) + return -ENOMEM; + +- ret = sparse_keymap_setup(priv->input_dev, intel_vbtn_keymap, NULL); ++ ret = sparse_keymap_setup(priv->input_dev, priv->keymap, NULL); + if (ret) + return ret; + +@@ -115,31 +138,40 @@ out_unknown: + + static void detect_tablet_mode(struct platform_device *device) + { +- const char *chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE); + struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev); + acpi_handle handle = ACPI_HANDLE(&device->dev); +- struct acpi_buffer vgbs_output = { ACPI_ALLOCATE_BUFFER, NULL }; +- union acpi_object *obj; ++ unsigned long long vgbs; + acpi_status status; + int m; + +- if (!(chassis_type && strcmp(chassis_type, "31") == 0)) +- goto out; +- +- status = acpi_evaluate_object(handle, "VGBS", NULL, &vgbs_output); ++ status = acpi_evaluate_integer(handle, "VGBS", NULL, &vgbs); + if (ACPI_FAILURE(status)) +- goto out; +- +- obj = vgbs_output.pointer; +- if (!(obj && obj->type == ACPI_TYPE_INTEGER)) +- goto out; ++ return; + +- m = !(obj->integer.value & TABLET_MODE_FLAG); ++ m = !(vgbs & TABLET_MODE_FLAG); + input_report_switch(priv->input_dev, SW_TABLET_MODE, m); +- m = (obj->integer.value & DOCK_MODE_FLAG) ? 1 : 0; ++ m = (vgbs & DOCK_MODE_FLAG) ? 1 : 0; + input_report_switch(priv->input_dev, SW_DOCK, m); +-out: +- kfree(vgbs_output.pointer); ++} ++ ++static bool intel_vbtn_has_switches(acpi_handle handle) ++{ ++ const char *chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE); ++ unsigned long long vgbs; ++ acpi_status status; ++ ++ /* ++ * Some normal laptops have a VGBS method despite being non-convertible ++ * and their VGBS method always returns 0, causing detect_tablet_mode() ++ * to report SW_TABLET_MODE=1 to userspace, which causes issues. ++ * These laptops have a DMI chassis_type of 9 ("Laptop"), do not report ++ * switches on any devices with a DMI chassis_type of 9. ++ */ ++ if (chassis_type && strcmp(chassis_type, "9") == 0) ++ return false; ++ ++ status = acpi_evaluate_integer(handle, "VGBS", NULL, &vgbs); ++ return ACPI_SUCCESS(status); + } + + static int intel_vbtn_probe(struct platform_device *device) +@@ -160,13 +192,16 @@ static int intel_vbtn_probe(struct platform_device *device) + return -ENOMEM; + dev_set_drvdata(&device->dev, priv); + ++ priv->has_switches = intel_vbtn_has_switches(handle); ++ + err = intel_vbtn_input_setup(device); + if (err) { + pr_err("Failed to setup Intel Virtual Button\n"); + return err; + } + +- detect_tablet_mode(device); ++ if (priv->has_switches) ++ detect_tablet_mode(device); + + status = acpi_install_notify_handler(handle, + ACPI_DEVICE_NOTIFY, +diff --git a/drivers/power/reset/vexpress-poweroff.c b/drivers/power/reset/vexpress-poweroff.c +index e9e749f87517..8fb43c4438e6 100644 +--- a/drivers/power/reset/vexpress-poweroff.c ++++ b/drivers/power/reset/vexpress-poweroff.c +@@ -150,6 +150,7 @@ static struct platform_driver vexpress_reset_driver = { + .driver = { + .name = "vexpress-reset", + .of_match_table = vexpress_reset_of_match, ++ .suppress_bind_attrs = true, + }, + }; + +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 81bd824bb9d9..bdb12bf0d5c7 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -3940,6 +3940,7 @@ void megasas_refire_mgmt_cmd(struct megasas_instance *instance) + struct fusion_context *fusion; + struct megasas_cmd *cmd_mfi; + union MEGASAS_REQUEST_DESCRIPTOR_UNION *req_desc; ++ struct MPI2_RAID_SCSI_IO_REQUEST *scsi_io_req; + u16 smid; + bool refire_cmd = 0; + u8 result; +@@ -3990,6 +3991,11 @@ void megasas_refire_mgmt_cmd(struct megasas_instance *instance) + break; + } + ++ scsi_io_req = (struct MPI2_RAID_SCSI_IO_REQUEST *) ++ cmd_fusion->io_request; ++ if (scsi_io_req->Function == MPI2_FUNCTION_SCSI_TASK_MGMT) ++ result = RETURN_CMD; ++ + switch (result) { + case REFIRE_CMD: + megasas_fire_cmd_fusion(instance, req_desc); +@@ -4187,7 +4193,6 @@ megasas_issue_tm(struct megasas_instance *instance, u16 device_handle, + if (!timeleft) { + dev_err(&instance->pdev->dev, + "task mgmt type 0x%x timed out\n", type); +- cmd_mfi->flags |= DRV_DCMD_SKIP_REFIRE; + mutex_unlock(&instance->reset_mutex); + rc = megasas_reset_fusion(instance->host, MFI_IO_TIMEOUT_OCR); + mutex_lock(&instance->reset_mutex); +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 285a6f463013..2145a70dac69 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -681,7 +681,7 @@ static void read_from_hw(struct bcm_qspi *qspi, int slots) + if (buf) + buf[tp.byte] = read_rxram_slot_u8(qspi, slot); + dev_dbg(&qspi->pdev->dev, "RD %02x\n", +- buf ? buf[tp.byte] : 0xff); ++ buf ? buf[tp.byte] : 0x0); + } else { + u16 *buf = tp.trans->rx_buf; + +@@ -689,7 +689,7 @@ static void read_from_hw(struct bcm_qspi *qspi, int slots) + buf[tp.byte / 2] = read_rxram_slot_u16(qspi, + slot); + dev_dbg(&qspi->pdev->dev, "RD %04x\n", +- buf ? buf[tp.byte] : 0xffff); ++ buf ? buf[tp.byte / 2] : 0x0); + } + + update_qspi_trans_byte_count(qspi, &tp, +@@ -744,13 +744,13 @@ static int write_to_hw(struct bcm_qspi *qspi, struct spi_device *spi) + while (!tstatus && slot < MSPI_NUM_CDRAM) { + if (tp.trans->bits_per_word <= 8) { + const u8 *buf = tp.trans->tx_buf; +- u8 val = buf ? buf[tp.byte] : 0xff; ++ u8 val = buf ? buf[tp.byte] : 0x00; + + write_txram_slot_u8(qspi, slot, val); + dev_dbg(&qspi->pdev->dev, "WR %02x\n", val); + } else { + const u16 *buf = tp.trans->tx_buf; +- u16 val = buf ? buf[tp.byte / 2] : 0xffff; ++ u16 val = buf ? buf[tp.byte / 2] : 0x0000; + + write_txram_slot_u16(qspi, slot, val); + dev_dbg(&qspi->pdev->dev, "WR %04x\n", val); +diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c +index eab27d41ba83..df6abc75bc16 100644 +--- a/drivers/spi/spi-bcm2835.c ++++ b/drivers/spi/spi-bcm2835.c +@@ -793,7 +793,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev) + goto out_clk_disable; + } + +- err = devm_spi_register_master(&pdev->dev, master); ++ err = spi_register_master(master); + if (err) { + dev_err(&pdev->dev, "could not register SPI master: %d\n", err); + goto out_clk_disable; +@@ -813,6 +813,8 @@ static int bcm2835_spi_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct bcm2835_spi *bs = spi_master_get_devdata(master); + ++ spi_unregister_master(master); ++ + /* Clear FIFOs, and disable the HW block */ + bcm2835_wr(bs, BCM2835_SPI_CS, + BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX); +diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c +index c63ed402cf86..11895c98aae3 100644 +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -485,7 +485,7 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev) + goto out_clk_disable; + } + +- err = devm_spi_register_master(&pdev->dev, master); ++ err = spi_register_master(master); + if (err) { + dev_err(&pdev->dev, "could not register SPI master: %d\n", err); + goto out_clk_disable; +@@ -505,6 +505,8 @@ static int bcm2835aux_spi_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct bcm2835aux_spi *bs = spi_master_get_devdata(master); + ++ spi_unregister_master(master); ++ + bcm2835aux_spi_reset_hw(bs); + + /* disable the HW block by releasing the clock */ +diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c +index 3db905f5f345..10f328558d55 100644 +--- a/drivers/spi/spi-dw-mid.c ++++ b/drivers/spi/spi-dw-mid.c +@@ -155,6 +155,7 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws, + if (!xfer->tx_buf) + return NULL; + ++ memset(&txconf, 0, sizeof(txconf)); + txconf.direction = DMA_MEM_TO_DEV; + txconf.dst_addr = dws->dma_addr; + txconf.dst_maxburst = 16; +@@ -201,6 +202,7 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws, + if (!xfer->rx_buf) + return NULL; + ++ memset(&rxconf, 0, sizeof(rxconf)); + rxconf.direction = DMA_DEV_TO_MEM; + rxconf.src_addr = dws->dma_addr; + rxconf.src_maxburst = 16; +@@ -226,19 +228,23 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws, + + static int mid_spi_dma_setup(struct dw_spi *dws, struct spi_transfer *xfer) + { +- u16 dma_ctrl = 0; ++ u16 imr = 0, dma_ctrl = 0; + + dw_writel(dws, DW_SPI_DMARDLR, 0xf); + dw_writel(dws, DW_SPI_DMATDLR, 0x10); + +- if (xfer->tx_buf) ++ if (xfer->tx_buf) { + dma_ctrl |= SPI_DMA_TDMAE; +- if (xfer->rx_buf) ++ imr |= SPI_INT_TXOI; ++ } ++ if (xfer->rx_buf) { + dma_ctrl |= SPI_DMA_RDMAE; ++ imr |= SPI_INT_RXUI | SPI_INT_RXOI; ++ } + dw_writel(dws, DW_SPI_DMACR, dma_ctrl); + + /* Set the interrupt mask */ +- spi_umask_intr(dws, SPI_INT_TXOI | SPI_INT_RXUI | SPI_INT_RXOI); ++ spi_umask_intr(dws, imr); + + dws->transfer_handler = dma_transfer; + +@@ -268,7 +274,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, struct spi_transfer *xfer) + dma_async_issue_pending(dws->txchan); + } + +- return 0; ++ return 1; + } + + static void mid_spi_dma_stop(struct dw_spi *dws) +diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c +index 6f0f6b99953d..b1c137261d0f 100644 +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -383,11 +383,8 @@ static int dw_spi_transfer_one(struct spi_controller *master, + + spi_enable_chip(dws, 1); + +- if (dws->dma_mapped) { +- ret = dws->dma_ops->dma_transfer(dws, transfer); +- if (ret < 0) +- return ret; +- } ++ if (dws->dma_mapped) ++ return dws->dma_ops->dma_transfer(dws, transfer); + + if (chip->poll_mode) + return poll_transfer(dws); +@@ -533,10 +530,11 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws) + dws->dma_inited = 0; + } else { + master->can_dma = dws->dma_ops->can_dma; ++ master->flags |= SPI_CONTROLLER_MUST_TX; + } + } + +- ret = devm_spi_register_controller(dev, master); ++ ret = spi_register_controller(master); + if (ret) { + dev_err(&master->dev, "problem registering spi master\n"); + goto err_dma_exit; +@@ -560,6 +558,8 @@ void dw_spi_remove_host(struct dw_spi *dws) + { + dw_spi_debugfs_remove(dws); + ++ spi_unregister_controller(dws->master); ++ + if (dws->dma_ops && dws->dma_ops->dma_exit) + dws->dma_ops->dma_exit(dws); + +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index e4482823d8d7..eafd0c2135a1 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -156,6 +156,7 @@ static const struct lpss_config lpss_platforms[] = { + .tx_threshold_hi = 48, + .cs_sel_shift = 8, + .cs_sel_mask = 3 << 8, ++ .cs_clk_stays_gated = true, + }, + { /* LPSS_CNL_SSP */ + .offset = 0x200, +@@ -1739,17 +1740,18 @@ static int pxa2xx_spi_probe(struct platform_device *pdev) + + /* Register with the SPI framework */ + platform_set_drvdata(pdev, drv_data); +- status = devm_spi_register_controller(&pdev->dev, master); ++ status = spi_register_controller(master); + if (status != 0) { + dev_err(&pdev->dev, "problem registering spi master\n"); +- goto out_error_clock_enabled; ++ goto out_error_pm_runtime_enabled; + } + + return status; + +-out_error_clock_enabled: +- pm_runtime_put_noidle(&pdev->dev); ++out_error_pm_runtime_enabled: + pm_runtime_disable(&pdev->dev); ++ ++out_error_clock_enabled: + clk_disable_unprepare(ssp->clk); + + out_error_dma_irq_alloc: +@@ -1773,6 +1775,8 @@ static int pxa2xx_spi_remove(struct platform_device *pdev) + + pm_runtime_get_sync(&pdev->dev); + ++ spi_unregister_controller(drv_data->master); ++ + /* Disable the SSP at the peripheral and SOC level */ + pxa2xx_spi_write(drv_data, SSCR0, 0); + clk_disable_unprepare(ssp->clk); +diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c +index fa730a871d25..8a5966963834 100644 +--- a/drivers/spi/spi-topcliff-pch.c ++++ b/drivers/spi/spi-topcliff-pch.c +@@ -92,7 +92,6 @@ + #define PCH_MAX_SPBR 1023 + + /* Definition for ML7213/ML7223/ML7831 by LAPIS Semiconductor */ +-#define PCI_VENDOR_ID_ROHM 0x10DB + #define PCI_DEVICE_ID_ML7213_SPI 0x802c + #define PCI_DEVICE_ID_ML7223_SPI 0x800F + #define PCI_DEVICE_ID_ML7831_SPI 0x8816 +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 88a8a8edd44b..f589d8100e95 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2305,7 +2305,8 @@ void spi_unregister_controller(struct spi_controller *ctlr) + { + struct spi_controller *found; + int id = ctlr->bus_num; +- int dummy; ++ ++ device_for_each_child(&ctlr->dev, NULL, __unregister); + + /* First make sure that this controller was ever added */ + mutex_lock(&board_lock); +@@ -2319,7 +2320,6 @@ void spi_unregister_controller(struct spi_controller *ctlr) + list_del(&ctlr->list); + mutex_unlock(&board_lock); + +- dummy = device_for_each_child(&ctlr->dev, NULL, __unregister); + device_unregister(&ctlr->dev); + /* free bus id */ + mutex_lock(&board_lock); +diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c +index 31db510018a9..6babcdb4d7d2 100644 +--- a/drivers/staging/android/ion/ion_heap.c ++++ b/drivers/staging/android/ion/ion_heap.c +@@ -97,12 +97,12 @@ int ion_heap_map_user(struct ion_heap *heap, struct ion_buffer *buffer, + + static int ion_heap_clear_pages(struct page **pages, int num, pgprot_t pgprot) + { +- void *addr = vm_map_ram(pages, num, -1, pgprot); ++ void *addr = vmap(pages, num, VM_MAP, pgprot); + + if (!addr) + return -ENOMEM; + memset(addr, 0, PAGE_SIZE * num); +- vm_unmap_ram(addr, num); ++ vunmap(addr); + + return 0; + } +diff --git a/drivers/staging/greybus/sdio.c b/drivers/staging/greybus/sdio.c +index 38e85033fc4b..afb2e5e5111a 100644 +--- a/drivers/staging/greybus/sdio.c ++++ b/drivers/staging/greybus/sdio.c +@@ -411,6 +411,7 @@ static int gb_sdio_command(struct gb_sdio_host *host, struct mmc_command *cmd) + struct gb_sdio_command_request request = {0}; + struct gb_sdio_command_response response; + struct mmc_data *data = host->mrq->data; ++ unsigned int timeout_ms; + u8 cmd_flags; + u8 cmd_type; + int i; +@@ -469,9 +470,12 @@ static int gb_sdio_command(struct gb_sdio_host *host, struct mmc_command *cmd) + request.data_blksz = cpu_to_le16(data->blksz); + } + +- ret = gb_operation_sync(host->connection, GB_SDIO_TYPE_COMMAND, +- &request, sizeof(request), &response, +- sizeof(response)); ++ timeout_ms = cmd->busy_timeout ? cmd->busy_timeout : ++ GB_OPERATION_TIMEOUT_DEFAULT; ++ ++ ret = gb_operation_sync_timeout(host->connection, GB_SDIO_TYPE_COMMAND, ++ &request, sizeof(request), &response, ++ sizeof(response), timeout_ms); + if (ret < 0) + goto out; + +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index bbe5cba21522..02091782bc1e 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1690,12 +1690,6 @@ pci_wch_ch38x_setup(struct serial_private *priv, + #define PCIE_DEVICE_ID_WCH_CH384_4S 0x3470 + #define PCIE_DEVICE_ID_WCH_CH382_2S 0x3253 + +-#define PCI_VENDOR_ID_PERICOM 0x12D8 +-#define PCI_DEVICE_ID_PERICOM_PI7C9X7951 0x7951 +-#define PCI_DEVICE_ID_PERICOM_PI7C9X7952 0x7952 +-#define PCI_DEVICE_ID_PERICOM_PI7C9X7954 0x7954 +-#define PCI_DEVICE_ID_PERICOM_PI7C9X7958 0x7958 +- + #define PCI_VENDOR_ID_ACCESIO 0x494f + #define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB 0x1051 + #define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S 0x1053 +diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c +index 3245cdbf9116..e5ff30544bd0 100644 +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -192,8 +192,6 @@ enum { + #define PCH_UART_HAL_LOOP (PCH_UART_MCR_LOOP) + #define PCH_UART_HAL_AFE (PCH_UART_MCR_AFE) + +-#define PCI_VENDOR_ID_ROHM 0x10DB +- + #define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE) + + #define DEFAULT_UARTCLK 1843200 /* 1.8432 MHz */ +diff --git a/drivers/usb/dwc3/dwc3-haps.c b/drivers/usb/dwc3/dwc3-haps.c +index c9cc33881bef..02d57d98ef9b 100644 +--- a/drivers/usb/dwc3/dwc3-haps.c ++++ b/drivers/usb/dwc3/dwc3-haps.c +@@ -15,10 +15,6 @@ + #include <linux/platform_device.h> + #include <linux/property.h> + +-#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd +-#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3_AXI 0xabce +-#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB31 0xabcf +- + /** + * struct dwc3_haps - Driver private structure + * @dwc3: child dwc3 platform_device +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 991184b8bb41..667011c99372 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -368,7 +368,6 @@ struct pch_udc_dev { + #define PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC 0x0939 + #define PCI_DEVICE_ID_INTEL_EG20T_UDC 0x8808 + +-#define PCI_VENDOR_ID_ROHM 0x10DB + #define PCI_DEVICE_ID_ML7213_IOH_UDC 0x801D + #define PCI_DEVICE_ID_ML7831_IOH_UDC 0x8808 + +diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c +index 696106ecdff0..967030176d87 100644 +--- a/drivers/video/fbdev/w100fb.c ++++ b/drivers/video/fbdev/w100fb.c +@@ -583,6 +583,7 @@ static void w100fb_restore_vidmem(struct w100fb_par *par) + memsize=par->mach->mem->size; + memcpy_toio(remapped_fbuf + (W100_FB_BASE-MEM_WINDOW_BASE), par->saved_extmem, memsize); + vfree(par->saved_extmem); ++ par->saved_extmem = NULL; + } + if (par->saved_intmem) { + memsize=MEM_INT_SIZE; +@@ -591,6 +592,7 @@ static void w100fb_restore_vidmem(struct w100fb_par *par) + else + memcpy_toio(remapped_fbuf + (W100_FB_BASE-MEM_WINDOW_BASE), par->saved_intmem, memsize); + vfree(par->saved_intmem); ++ par->saved_intmem = NULL; + } + } + +diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c +index 3099052e1243..0667bc6e7d23 100644 +--- a/drivers/w1/masters/omap_hdq.c ++++ b/drivers/w1/masters/omap_hdq.c +@@ -176,7 +176,7 @@ static int hdq_write_byte(struct hdq_data *hdq_data, u8 val, u8 *status) + /* check irqstatus */ + if (!(*status & OMAP_HDQ_INT_STATUS_TXCOMPLETE)) { + dev_dbg(hdq_data->dev, "timeout waiting for" +- " TXCOMPLETE/RXCOMPLETE, %x", *status); ++ " TXCOMPLETE/RXCOMPLETE, %x\n", *status); + ret = -ETIMEDOUT; + goto out; + } +@@ -187,7 +187,7 @@ static int hdq_write_byte(struct hdq_data *hdq_data, u8 val, u8 *status) + OMAP_HDQ_FLAG_CLEAR, &tmp_status); + if (ret) { + dev_dbg(hdq_data->dev, "timeout waiting GO bit" +- " return to zero, %x", tmp_status); ++ " return to zero, %x\n", tmp_status); + } + + out: +@@ -203,7 +203,7 @@ static irqreturn_t hdq_isr(int irq, void *_hdq) + spin_lock_irqsave(&hdq_data->hdq_spinlock, irqflags); + hdq_data->hdq_irqstatus = hdq_reg_in(hdq_data, OMAP_HDQ_INT_STATUS); + spin_unlock_irqrestore(&hdq_data->hdq_spinlock, irqflags); +- dev_dbg(hdq_data->dev, "hdq_isr: %x", hdq_data->hdq_irqstatus); ++ dev_dbg(hdq_data->dev, "hdq_isr: %x\n", hdq_data->hdq_irqstatus); + + if (hdq_data->hdq_irqstatus & + (OMAP_HDQ_INT_STATUS_TXCOMPLETE | OMAP_HDQ_INT_STATUS_RXCOMPLETE +@@ -311,7 +311,7 @@ static int omap_hdq_break(struct hdq_data *hdq_data) + tmp_status = hdq_data->hdq_irqstatus; + /* check irqstatus */ + if (!(tmp_status & OMAP_HDQ_INT_STATUS_TIMEOUT)) { +- dev_dbg(hdq_data->dev, "timeout waiting for TIMEOUT, %x", ++ dev_dbg(hdq_data->dev, "timeout waiting for TIMEOUT, %x\n", + tmp_status); + ret = -ETIMEDOUT; + goto out; +@@ -338,7 +338,7 @@ static int omap_hdq_break(struct hdq_data *hdq_data) + &tmp_status); + if (ret) + dev_dbg(hdq_data->dev, "timeout waiting INIT&GO bits" +- " return to zero, %x", tmp_status); ++ " return to zero, %x\n", tmp_status); + + out: + mutex_unlock(&hdq_data->hdq_mutex); +diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c +index b3fbfed28682..398fd8b1639d 100644 +--- a/drivers/xen/pvcalls-back.c ++++ b/drivers/xen/pvcalls-back.c +@@ -1096,7 +1096,8 @@ static void set_backend_state(struct xenbus_device *dev, + case XenbusStateInitialised: + switch (state) { + case XenbusStateConnected: +- backend_connect(dev); ++ if (backend_connect(dev)) ++ return; + xenbus_switch_state(dev, XenbusStateConnected); + break; + case XenbusStateClosing: +diff --git a/fs/aio.c b/fs/aio.c +index b5fbf2061868..413ec289bfa1 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -169,6 +169,7 @@ struct fsync_iocb { + struct file *file; + struct work_struct work; + bool datasync; ++ struct cred *creds; + }; + + struct poll_iocb { +@@ -1579,8 +1580,11 @@ static ssize_t aio_write(struct kiocb *req, const struct iocb *iocb, + static void aio_fsync_work(struct work_struct *work) + { + struct aio_kiocb *iocb = container_of(work, struct aio_kiocb, fsync.work); ++ const struct cred *old_cred = override_creds(iocb->fsync.creds); + + iocb->ki_res.res = vfs_fsync(iocb->fsync.file, iocb->fsync.datasync); ++ revert_creds(old_cred); ++ put_cred(iocb->fsync.creds); + iocb_put(iocb); + } + +@@ -1594,6 +1598,10 @@ static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb, + if (unlikely(!req->file->f_op->fsync)) + return -EINVAL; + ++ req->creds = prepare_creds(); ++ if (!req->creds) ++ return -ENOMEM; ++ + req->datasync = datasync; + INIT_WORK(&req->work, aio_fsync_work); + schedule_work(&req->work); +diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c +index 96763805787e..1b9c8ffb038f 100644 +--- a/fs/btrfs/dev-replace.c ++++ b/fs/btrfs/dev-replace.c +@@ -112,11 +112,11 @@ no_valid_dev_replace_entry_found: + break; + case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED: + case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED: +- dev_replace->srcdev = btrfs_find_device(fs_info, src_devid, +- NULL, NULL); +- dev_replace->tgtdev = btrfs_find_device(fs_info, ++ dev_replace->srcdev = btrfs_find_device(fs_info->fs_devices, ++ src_devid, NULL, NULL, true); ++ dev_replace->tgtdev = btrfs_find_device(fs_info->fs_devices, + BTRFS_DEV_REPLACE_DEVID, +- NULL, NULL); ++ NULL, NULL, true); + /* + * allow 'btrfs dev replace_cancel' if src/tgt device is + * missing +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index da7a2a530647..9740f7b5d4fb 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -438,6 +438,16 @@ int btrfs_verify_level_key(struct btrfs_fs_info *fs_info, + */ + if (btrfs_header_generation(eb) > fs_info->last_trans_committed) + return 0; ++ ++ /* We have @first_key, so this @eb must have at least one item */ ++ if (btrfs_header_nritems(eb) == 0) { ++ btrfs_err(fs_info, ++ "invalid tree nritems, bytenr=%llu nritems=0 expect >0", ++ eb->start); ++ WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG)); ++ return -EUCLEAN; ++ } ++ + if (found_level) + btrfs_node_key_to_cpu(eb, &found_key, 0); + else +diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c +index f9e280d0b44f..1b8a04b767ff 100644 +--- a/fs/btrfs/file-item.c ++++ b/fs/btrfs/file-item.c +@@ -785,10 +785,12 @@ again: + nritems = btrfs_header_nritems(path->nodes[0]); + if (!nritems || (path->slots[0] >= nritems - 1)) { + ret = btrfs_next_leaf(root, path); +- if (ret == 1) ++ if (ret < 0) { ++ goto out; ++ } else if (ret > 0) { + found_next = 1; +- if (ret != 0) + goto insert; ++ } + slot = path->slots[0]; + } + btrfs_item_key_to_cpu(path->nodes[0], &found_key, slot); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index c69e5b255745..887f9ebc2bc2 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1136,8 +1136,8 @@ out_unlock: + */ + if (extent_reserved) { + extent_clear_unlock_delalloc(inode, start, +- start + cur_alloc_size, +- start + cur_alloc_size, ++ start + cur_alloc_size - 1, ++ start + cur_alloc_size - 1, + locked_page, + clear_bits, + page_ops); +@@ -8399,7 +8399,6 @@ static int btrfs_submit_direct_hook(struct btrfs_dio_private *dip) + + /* bio split */ + ASSERT(map_length <= INT_MAX); +- atomic_inc(&dip->pending_bios); + do { + clone_len = min_t(int, submit_len, map_length); + +@@ -8450,7 +8449,8 @@ submit: + if (!status) + return 0; + +- bio_put(bio); ++ if (bio != orig_bio) ++ bio_put(bio); + out_err: + dip->errors = 1; + /* +@@ -8491,7 +8491,7 @@ static void btrfs_submit_direct(struct bio *dio_bio, struct inode *inode, + bio->bi_private = dip; + dip->orig_bio = bio; + dip->dio_bio = dio_bio; +- atomic_set(&dip->pending_bios, 0); ++ atomic_set(&dip->pending_bios, 1); + io_bio = btrfs_io_bio(bio); + io_bio->logical = file_offset; + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 199c70b8f7d8..a5ae02bf3652 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -1642,7 +1642,7 @@ static noinline int btrfs_ioctl_resize(struct file *file, + btrfs_info(fs_info, "resizing devid %llu", devid); + } + +- device = btrfs_find_device(fs_info, devid, NULL, NULL); ++ device = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true); + if (!device) { + btrfs_info(fs_info, "resizer unable to find device %llu", + devid); +@@ -3178,7 +3178,8 @@ static long btrfs_ioctl_dev_info(struct btrfs_fs_info *fs_info, + s_uuid = di_args->uuid; + + rcu_read_lock(); +- dev = btrfs_find_device(fs_info, di_args->devid, s_uuid, NULL); ++ dev = btrfs_find_device(fs_info->fs_devices, di_args->devid, s_uuid, ++ NULL, true); + + if (!dev) { + ret = -ENODEV; +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index cbd40826f5dc..c8ed4db73b84 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2259,6 +2259,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid, + struct btrfs_root *quota_root; + struct btrfs_qgroup *srcgroup; + struct btrfs_qgroup *dstgroup; ++ bool need_rescan = false; + u32 level_size = 0; + u64 nums; + +@@ -2402,6 +2403,13 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid, + goto unlock; + } + ++i_qgroups; ++ ++ /* ++ * If we're doing a snapshot, and adding the snapshot to a new ++ * qgroup, the numbers are guaranteed to be incorrect. ++ */ ++ if (srcid) ++ need_rescan = true; + } + + for (i = 0; i < inherit->num_ref_copies; ++i, i_qgroups += 2) { +@@ -2421,6 +2429,9 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid, + + dst->rfer = src->rfer - level_size; + dst->rfer_cmpr = src->rfer_cmpr - level_size; ++ ++ /* Manually tweaking numbers certainly needs a rescan */ ++ need_rescan = true; + } + for (i = 0; i < inherit->num_excl_copies; ++i, i_qgroups += 2) { + struct btrfs_qgroup *src; +@@ -2439,6 +2450,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid, + + dst->excl = src->excl + level_size; + dst->excl_cmpr = src->excl_cmpr + level_size; ++ need_rescan = true; + } + + unlock: +@@ -2446,6 +2458,8 @@ unlock: + out: + if (!committing) + mutex_unlock(&fs_info->qgroup_ioctl_lock); ++ if (need_rescan) ++ fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT; + return ret; + } + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index 6b6008db3e03..fee8995c9a0c 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -3835,7 +3835,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, + return PTR_ERR(sctx); + + mutex_lock(&fs_info->fs_devices->device_list_mutex); +- dev = btrfs_find_device(fs_info, devid, NULL, NULL); ++ dev = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true); + if (!dev || (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state) && + !is_dev_replace)) { + mutex_unlock(&fs_info->fs_devices->device_list_mutex); +@@ -4019,7 +4019,7 @@ int btrfs_scrub_progress(struct btrfs_fs_info *fs_info, u64 devid, + struct scrub_ctx *sctx = NULL; + + mutex_lock(&fs_info->fs_devices->device_list_mutex); +- dev = btrfs_find_device(fs_info, devid, NULL, NULL); ++ dev = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true); + if (dev) + sctx = dev->scrub_ctx; + if (sctx) +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 931a7d1ddc95..2bc80d0b56db 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -23,6 +23,7 @@ + #include "btrfs_inode.h" + #include "transaction.h" + #include "compression.h" ++#include "xattr.h" + + /* + * Maximum number of references an extent can have in order for us to attempt to +@@ -4543,6 +4544,10 @@ static int __process_new_xattr(int num, struct btrfs_key *di_key, + struct fs_path *p; + struct posix_acl_xattr_header dummy_acl; + ++ /* Capabilities are emitted by finish_inode_if_needed */ ++ if (!strncmp(name, XATTR_NAME_CAPS, name_len)) ++ return 0; ++ + p = fs_path_alloc(); + if (!p) + return -ENOMEM; +@@ -5105,6 +5110,64 @@ static int send_extent_data(struct send_ctx *sctx, + return 0; + } + ++/* ++ * Search for a capability xattr related to sctx->cur_ino. If the capability is ++ * found, call send_set_xattr function to emit it. ++ * ++ * Return 0 if there isn't a capability, or when the capability was emitted ++ * successfully, or < 0 if an error occurred. ++ */ ++static int send_capabilities(struct send_ctx *sctx) ++{ ++ struct fs_path *fspath = NULL; ++ struct btrfs_path *path; ++ struct btrfs_dir_item *di; ++ struct extent_buffer *leaf; ++ unsigned long data_ptr; ++ char *buf = NULL; ++ int buf_len; ++ int ret = 0; ++ ++ path = alloc_path_for_send(); ++ if (!path) ++ return -ENOMEM; ++ ++ di = btrfs_lookup_xattr(NULL, sctx->send_root, path, sctx->cur_ino, ++ XATTR_NAME_CAPS, strlen(XATTR_NAME_CAPS), 0); ++ if (!di) { ++ /* There is no xattr for this inode */ ++ goto out; ++ } else if (IS_ERR(di)) { ++ ret = PTR_ERR(di); ++ goto out; ++ } ++ ++ leaf = path->nodes[0]; ++ buf_len = btrfs_dir_data_len(leaf, di); ++ ++ fspath = fs_path_alloc(); ++ buf = kmalloc(buf_len, GFP_KERNEL); ++ if (!fspath || !buf) { ++ ret = -ENOMEM; ++ goto out; ++ } ++ ++ ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, fspath); ++ if (ret < 0) ++ goto out; ++ ++ data_ptr = (unsigned long)(di + 1) + btrfs_dir_name_len(leaf, di); ++ read_extent_buffer(leaf, buf, data_ptr, buf_len); ++ ++ ret = send_set_xattr(sctx, fspath, XATTR_NAME_CAPS, ++ strlen(XATTR_NAME_CAPS), buf, buf_len); ++out: ++ kfree(buf); ++ fs_path_free(fspath); ++ btrfs_free_path(path); ++ return ret; ++} ++ + static int clone_range(struct send_ctx *sctx, + struct clone_root *clone_root, + const u64 disk_byte, +@@ -5936,6 +5999,10 @@ static int finish_inode_if_needed(struct send_ctx *sctx, int at_end) + goto out; + } + ++ ret = send_capabilities(sctx); ++ if (ret < 0) ++ goto out; ++ + /* + * If other directory inodes depended on our current directory + * inode's move/rename, now do their move/rename operations. +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index 3ec712cba58e..d98ec885b72a 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -485,6 +485,13 @@ static int check_leaf(struct btrfs_fs_info *fs_info, struct extent_buffer *leaf, + u32 nritems = btrfs_header_nritems(leaf); + int slot; + ++ if (btrfs_header_level(leaf) != 0) { ++ generic_err(fs_info, leaf, 0, ++ "invalid level for leaf, have %d expect 0", ++ btrfs_header_level(leaf)); ++ return -EUCLEAN; ++ } ++ + /* + * Extent buffers from a relocation tree have a owner field that + * corresponds to the subvolume tree they are based on. So just from an +@@ -509,6 +516,12 @@ static int check_leaf(struct btrfs_fs_info *fs_info, struct extent_buffer *leaf, + owner); + return -EUCLEAN; + } ++ /* Unknown tree */ ++ if (owner == 0) { ++ generic_err(fs_info, leaf, 0, ++ "invalid owner, root 0 is not defined"); ++ return -EUCLEAN; ++ } + key.objectid = owner; + key.type = BTRFS_ROOT_ITEM_KEY; + key.offset = (u64)-1; +@@ -643,9 +656,16 @@ int btrfs_check_node(struct btrfs_fs_info *fs_info, struct extent_buffer *node) + unsigned long nr = btrfs_header_nritems(node); + struct btrfs_key key, next_key; + int slot; ++ int level = btrfs_header_level(node); + u64 bytenr; + int ret = 0; + ++ if (level <= 0 || level >= BTRFS_MAX_LEVEL) { ++ generic_err(fs_info, node, 0, ++ "invalid level for node, have %d expect [1, %d]", ++ level, BTRFS_MAX_LEVEL - 1); ++ return -EUCLEAN; ++ } + if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(fs_info)) { + btrfs_crit(fs_info, + "corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%u]", +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 9c3b394b99fa..b9ce42877e46 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -347,27 +347,6 @@ static struct btrfs_device *__alloc_device(void) + return dev; + } + +-/* +- * Find a device specified by @devid or @uuid in the list of @fs_devices, or +- * return NULL. +- * +- * If devid and uuid are both specified, the match must be exact, otherwise +- * only devid is used. +- */ +-static struct btrfs_device *find_device(struct btrfs_fs_devices *fs_devices, +- u64 devid, const u8 *uuid) +-{ +- struct btrfs_device *dev; +- +- list_for_each_entry(dev, &fs_devices->devices, dev_list) { +- if (dev->devid == devid && +- (!uuid || !memcmp(dev->uuid, uuid, BTRFS_UUID_SIZE))) { +- return dev; +- } +- } +- return NULL; +-} +- + static noinline struct btrfs_fs_devices *find_fsid(u8 *fsid) + { + struct btrfs_fs_devices *fs_devices; +@@ -772,8 +751,8 @@ static noinline struct btrfs_device *device_list_add(const char *path, + device = NULL; + } else { + mutex_lock(&fs_devices->device_list_mutex); +- device = find_device(fs_devices, devid, +- disk_super->dev_item.uuid); ++ device = btrfs_find_device(fs_devices, devid, ++ disk_super->dev_item.uuid, NULL, false); + } + + if (!device) { +@@ -972,6 +951,8 @@ again: + &device->dev_state)) { + if (!test_bit(BTRFS_DEV_STATE_REPLACE_TGT, + &device->dev_state) && ++ !test_bit(BTRFS_DEV_STATE_MISSING, ++ &device->dev_state) && + (!latest_dev || + device->generation > latest_dev->generation)) { + latest_dev = device; +@@ -2144,7 +2125,8 @@ static int btrfs_find_device_by_path(struct btrfs_fs_info *fs_info, + disk_super = (struct btrfs_super_block *)bh->b_data; + devid = btrfs_stack_device_id(&disk_super->dev_item); + dev_uuid = disk_super->dev_item.uuid; +- *device = btrfs_find_device(fs_info, devid, dev_uuid, disk_super->fsid); ++ *device = btrfs_find_device(fs_info->fs_devices, devid, dev_uuid, ++ disk_super->fsid, true); + brelse(bh); + if (!*device) + ret = -ENOENT; +@@ -2190,7 +2172,8 @@ int btrfs_find_device_by_devspec(struct btrfs_fs_info *fs_info, u64 devid, + + if (devid) { + ret = 0; +- *device = btrfs_find_device(fs_info, devid, NULL, NULL); ++ *device = btrfs_find_device(fs_info->fs_devices, devid, ++ NULL, NULL, true); + if (!*device) + ret = -ENOENT; + } else { +@@ -2322,7 +2305,8 @@ next_slot: + BTRFS_UUID_SIZE); + read_extent_buffer(leaf, fs_uuid, btrfs_device_fsid(dev_item), + BTRFS_FSID_SIZE); +- device = btrfs_find_device(fs_info, devid, dev_uuid, fs_uuid); ++ device = btrfs_find_device(fs_info->fs_devices, devid, dev_uuid, ++ fs_uuid, true); + BUG_ON(!device); /* Logic error */ + + if (device->fs_devices->seeding) { +@@ -6254,21 +6238,36 @@ blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio, + return BLK_STS_OK; + } + +-struct btrfs_device *btrfs_find_device(struct btrfs_fs_info *fs_info, u64 devid, +- u8 *uuid, u8 *fsid) ++/* ++ * Find a device specified by @devid or @uuid in the list of @fs_devices, or ++ * return NULL. ++ * ++ * If devid and uuid are both specified, the match must be exact, otherwise ++ * only devid is used. ++ * ++ * If @seed is true, traverse through the seed devices. ++ */ ++struct btrfs_device *btrfs_find_device(struct btrfs_fs_devices *fs_devices, ++ u64 devid, u8 *uuid, u8 *fsid, ++ bool seed) + { + struct btrfs_device *device; +- struct btrfs_fs_devices *cur_devices; + +- cur_devices = fs_info->fs_devices; +- while (cur_devices) { ++ while (fs_devices) { + if (!fsid || +- !memcmp(cur_devices->fsid, fsid, BTRFS_FSID_SIZE)) { +- device = find_device(cur_devices, devid, uuid); +- if (device) +- return device; ++ !memcmp(fs_devices->fsid, fsid, BTRFS_FSID_SIZE)) { ++ list_for_each_entry(device, &fs_devices->devices, ++ dev_list) { ++ if (device->devid == devid && ++ (!uuid || memcmp(device->uuid, uuid, ++ BTRFS_UUID_SIZE) == 0)) ++ return device; ++ } + } +- cur_devices = cur_devices->seed; ++ if (seed) ++ fs_devices = fs_devices->seed; ++ else ++ return NULL; + } + return NULL; + } +@@ -6513,8 +6512,8 @@ static int read_one_chunk(struct btrfs_fs_info *fs_info, struct btrfs_key *key, + read_extent_buffer(leaf, uuid, (unsigned long) + btrfs_stripe_dev_uuid_nr(chunk, i), + BTRFS_UUID_SIZE); +- map->stripes[i].dev = btrfs_find_device(fs_info, devid, +- uuid, NULL); ++ map->stripes[i].dev = btrfs_find_device(fs_info->fs_devices, ++ devid, uuid, NULL, true); + if (!map->stripes[i].dev && + !btrfs_test_opt(fs_info, DEGRADED)) { + free_extent_map(em); +@@ -6653,7 +6652,8 @@ static int read_one_dev(struct btrfs_fs_info *fs_info, + return PTR_ERR(fs_devices); + } + +- device = btrfs_find_device(fs_info, devid, dev_uuid, fs_uuid); ++ device = btrfs_find_device(fs_info->fs_devices, devid, dev_uuid, ++ fs_uuid, true); + if (!device) { + if (!btrfs_test_opt(fs_info, DEGRADED)) { + btrfs_report_missing_device(fs_info, devid, +@@ -7243,7 +7243,8 @@ int btrfs_get_dev_stats(struct btrfs_fs_info *fs_info, + int i; + + mutex_lock(&fs_devices->device_list_mutex); +- dev = btrfs_find_device(fs_info, stats->devid, NULL, NULL); ++ dev = btrfs_find_device(fs_info->fs_devices, stats->devid, ++ NULL, NULL, true); + mutex_unlock(&fs_devices->device_list_mutex); + + if (!dev) { +@@ -7460,7 +7461,7 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info, + } + + /* Make sure no dev extent is beyond device bondary */ +- dev = btrfs_find_device(fs_info, devid, NULL, NULL); ++ dev = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true); + if (!dev) { + btrfs_err(fs_info, "failed to find devid %llu", devid); + ret = -EUCLEAN; +@@ -7469,7 +7470,8 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info, + + /* It's possible this device is a dummy for seed device */ + if (dev->disk_total_bytes == 0) { +- dev = find_device(fs_info->fs_devices->seed, devid, NULL); ++ dev = btrfs_find_device(fs_info->fs_devices->seed, devid, ++ NULL, NULL, false); + if (!dev) { + btrfs_err(fs_info, "failed to find seed devid %llu", + devid); +diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h +index ac703b15d679..8e8bf3246de1 100644 +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -430,8 +430,8 @@ void __exit btrfs_cleanup_fs_uuids(void); + int btrfs_num_copies(struct btrfs_fs_info *fs_info, u64 logical, u64 len); + int btrfs_grow_device(struct btrfs_trans_handle *trans, + struct btrfs_device *device, u64 new_size); +-struct btrfs_device *btrfs_find_device(struct btrfs_fs_info *fs_info, u64 devid, +- u8 *uuid, u8 *fsid); ++struct btrfs_device *btrfs_find_device(struct btrfs_fs_devices *fs_devices, ++ u64 devid, u8 *uuid, u8 *fsid, bool seed); + int btrfs_shrink_device(struct btrfs_device *device, u64 new_size); + int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *path); + int btrfs_balance(struct btrfs_fs_info *fs_info, +diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h +index adf6668b596f..c5794ff64a01 100644 +--- a/fs/ext4/ext4_extents.h ++++ b/fs/ext4/ext4_extents.h +@@ -157,10 +157,13 @@ struct ext4_ext_path { + (EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1) + #define EXT_LAST_INDEX(__hdr__) \ + (EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1) +-#define EXT_MAX_EXTENT(__hdr__) \ +- (EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1) ++#define EXT_MAX_EXTENT(__hdr__) \ ++ ((le16_to_cpu((__hdr__)->eh_max)) ? \ ++ ((EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) \ ++ : 0) + #define EXT_MAX_INDEX(__hdr__) \ +- (EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1) ++ ((le16_to_cpu((__hdr__)->eh_max)) ? \ ++ ((EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) : 0) + + static inline struct ext4_extent_header *ext_inode_hdr(struct inode *inode) + { +diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c +index 5508baa11bb6..8a28d47bd502 100644 +--- a/fs/ext4/fsync.c ++++ b/fs/ext4/fsync.c +@@ -44,30 +44,28 @@ + */ + static int ext4_sync_parent(struct inode *inode) + { +- struct dentry *dentry = NULL; +- struct inode *next; ++ struct dentry *dentry, *next; + int ret = 0; + + if (!ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) + return 0; +- inode = igrab(inode); ++ dentry = d_find_any_alias(inode); ++ if (!dentry) ++ return 0; + while (ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) { + ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY); +- dentry = d_find_any_alias(inode); +- if (!dentry) +- break; +- next = igrab(d_inode(dentry->d_parent)); ++ ++ next = dget_parent(dentry); + dput(dentry); +- if (!next) +- break; +- iput(inode); +- inode = next; ++ dentry = next; ++ inode = dentry->d_inode; ++ + /* + * The directory inode may have gone through rmdir by now. But + * the inode itself and its blocks are still allocated (we hold +- * a reference to the inode so it didn't go through +- * ext4_evict_inode()) and so we are safe to flush metadata +- * blocks and the inode. ++ * a reference to the inode via its dentry), so it didn't go ++ * through ext4_evict_inode()) and so we are safe to flush ++ * metadata blocks and the inode. + */ + ret = sync_mapping_buffers(inode->i_mapping); + if (ret) +@@ -76,7 +74,7 @@ static int ext4_sync_parent(struct inode *inode) + if (ret) + break; + } +- iput(inode); ++ dput(dentry); + return ret; + } + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index f73fc90e5daa..899567d74c2a 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1824,8 +1824,11 @@ ext4_xattr_block_find(struct inode *inode, struct ext4_xattr_info *i, + if (EXT4_I(inode)->i_file_acl) { + /* The inode already has an extended attribute block. */ + bs->bh = ext4_sb_bread(sb, EXT4_I(inode)->i_file_acl, REQ_PRIO); +- if (IS_ERR(bs->bh)) +- return PTR_ERR(bs->bh); ++ if (IS_ERR(bs->bh)) { ++ error = PTR_ERR(bs->bh); ++ bs->bh = NULL; ++ return error; ++ } + ea_bdebug(bs->bh, "b_count=%d, refcount=%d", + atomic_read(&(bs->bh->b_count)), + le32_to_cpu(BHDR(bs->bh)->h_refcount)); +diff --git a/fs/fat/inode.c b/fs/fat/inode.c +index 70d37a5fd72c..607e1d124062 100644 +--- a/fs/fat/inode.c ++++ b/fs/fat/inode.c +@@ -1519,6 +1519,12 @@ static int fat_read_bpb(struct super_block *sb, struct fat_boot_sector *b, + goto out; + } + ++ if (bpb->fat_fat_length == 0 && bpb->fat32_length == 0) { ++ if (!silent) ++ fat_msg(sb, KERN_ERR, "bogus number of FAT sectors"); ++ goto out; ++ } ++ + error = 0; + + out: +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index a89e27367e34..7bfeb1643c1f 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -269,6 +269,7 @@ void __inode_attach_wb(struct inode *inode, struct page *page) + if (unlikely(cmpxchg(&inode->i_wb, NULL, wb))) + wb_put(wb); + } ++EXPORT_SYMBOL_GPL(__inode_attach_wb); + + /** + * locked_inode_to_wb_and_lock_list - determine a locked inode's wb and lock it +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 445eef41bfaf..91b58c897f92 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -2780,6 +2780,8 @@ int nilfs_attach_log_writer(struct super_block *sb, struct nilfs_root *root) + if (!nilfs->ns_writer) + return -ENOMEM; + ++ inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL); ++ + err = nilfs_segctor_start_thread(nilfs->ns_writer); + if (err) { + kfree(nilfs->ns_writer); +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index ffc73600216b..6eb0b882ad23 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -43,7 +43,7 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new) + { + ssize_t list_size, size, value_size = 0; + char *buf, *name, *value = NULL; +- int uninitialized_var(error); ++ int error = 0; + size_t slen; + + if (!(old->d_inode->i_opflags & IOP_XATTR) || +diff --git a/fs/proc/inode.c b/fs/proc/inode.c +index fc5306a31a1d..31bf3bb8ddae 100644 +--- a/fs/proc/inode.c ++++ b/fs/proc/inode.c +@@ -451,7 +451,7 @@ const struct inode_operations proc_link_inode_operations = { + + struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) + { +- struct inode *inode = new_inode_pseudo(sb); ++ struct inode *inode = new_inode(sb); + + if (inode) { + inode->i_ino = de->low_ino; +diff --git a/fs/proc/self.c b/fs/proc/self.c +index 127265e5c55f..cc6d4253399d 100644 +--- a/fs/proc/self.c ++++ b/fs/proc/self.c +@@ -42,7 +42,7 @@ int proc_setup_self(struct super_block *s) + inode_lock(root_inode); + self = d_alloc_name(s->s_root, "self"); + if (self) { +- struct inode *inode = new_inode_pseudo(s); ++ struct inode *inode = new_inode(s); + if (inode) { + inode->i_ino = self_inum; + inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); +diff --git a/fs/proc/thread_self.c b/fs/proc/thread_self.c +index b905010ca9eb..ed009aa135dd 100644 +--- a/fs/proc/thread_self.c ++++ b/fs/proc/thread_self.c +@@ -42,7 +42,7 @@ int proc_setup_thread_self(struct super_block *s) + inode_lock(root_inode); + thread_self = d_alloc_name(s->s_root, "thread-self"); + if (thread_self) { +- struct inode *inode = new_inode_pseudo(s); ++ struct inode *inode = new_inode(s); + if (inode) { + inode->i_ino = thread_self_inum; + inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); +diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c +index e638740f1681..3e1dd66bd676 100644 +--- a/fs/xfs/xfs_bmap_util.c ++++ b/fs/xfs/xfs_bmap_util.c +@@ -1823,7 +1823,7 @@ xfs_swap_extents( + if (xfs_inode_has_cow_data(tip)) { + error = xfs_reflink_cancel_cow_range(tip, 0, NULLFILEOFF, true); + if (error) +- return error; ++ goto out_unlock; + } + + /* +diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c +index c1f7c0d5d608..b33a9cd4fe94 100644 +--- a/fs/xfs/xfs_buf.c ++++ b/fs/xfs/xfs_buf.c +@@ -1202,8 +1202,10 @@ xfs_buf_ioend( + bp->b_ops->verify_read(bp); + } + +- if (!bp->b_error) ++ if (!bp->b_error) { ++ bp->b_flags &= ~XBF_WRITE_FAIL; + bp->b_flags |= XBF_DONE; ++ } + + if (bp->b_iodone) + (*(bp->b_iodone))(bp); +@@ -1263,7 +1265,7 @@ xfs_bwrite( + + bp->b_flags |= XBF_WRITE; + bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q | +- XBF_WRITE_FAIL | XBF_DONE); ++ XBF_DONE); + + error = xfs_buf_submit(bp); + if (error) { +@@ -2000,7 +2002,7 @@ xfs_buf_delwri_submit_buffers( + * synchronously. Otherwise, drop the buffer from the delwri + * queue and submit async. + */ +- bp->b_flags &= ~(_XBF_DELWRI_Q | XBF_WRITE_FAIL); ++ bp->b_flags &= ~_XBF_DELWRI_Q; + bp->b_flags |= XBF_WRITE; + if (wait_list) { + bp->b_flags &= ~XBF_ASYNC; +diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c +index a1af984e4913..59b2b29542f4 100644 +--- a/fs/xfs/xfs_dquot.c ++++ b/fs/xfs/xfs_dquot.c +@@ -1120,13 +1120,12 @@ xfs_qm_dqflush( + dqb = bp->b_addr + dqp->q_bufoffset; + ddqp = &dqb->dd_diskdq; + +- /* +- * A simple sanity check in case we got a corrupted dquot. +- */ +- fa = xfs_dqblk_verify(mp, dqb, be32_to_cpu(ddqp->d_id), 0); ++ /* sanity check the in-core structure before we flush */ ++ fa = xfs_dquot_verify(mp, &dqp->q_core, be32_to_cpu(dqp->q_core.d_id), ++ 0); + if (fa) { + xfs_alert(mp, "corrupt dquot ID 0x%x in memory at %pS", +- be32_to_cpu(ddqp->d_id), fa); ++ be32_to_cpu(dqp->q_core.d_id), fa); + xfs_buf_relse(bp); + xfs_dqfunlock(dqp); + xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE); +diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h +index e465bb15912d..6be5545d3584 100644 +--- a/include/linux/kgdb.h ++++ b/include/linux/kgdb.h +@@ -317,7 +317,7 @@ extern void gdbstub_exit(int status); + extern int kgdb_single_step; + extern atomic_t kgdb_active; + #define in_dbg_master() \ +- (raw_smp_processor_id() == atomic_read(&kgdb_active)) ++ (irqs_disabled() && (smp_processor_id() == atomic_read(&kgdb_active))) + extern bool dbg_is_early; + extern void __init dbg_late_init(void); + #else /* ! CONFIG_KGDB */ +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 92c6f80e6327..a0de4c7dc9d3 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -1327,8 +1327,8 @@ static inline long kvm_arch_vcpu_async_ioctl(struct file *filp, + } + #endif /* CONFIG_HAVE_KVM_VCPU_ASYNC_IOCTL */ + +-int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, +- unsigned long start, unsigned long end, bool blockable); ++void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, ++ unsigned long start, unsigned long end); + + #ifdef CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE + int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu); +diff --git a/include/linux/mm.h b/include/linux/mm.h +index b1092046ebef..05bc5f25ab85 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -601,6 +601,7 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags) + } + + extern void kvfree(const void *addr); ++extern void kvfree_sensitive(const void *addr, size_t len); + + /* + * Mapcount of compound page as a whole, does not include mapped sub-pages. +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index d6791e2df30a..fdd93a39f1fa 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -638,6 +638,8 @@ typedef struct pglist_data { + /* + * Must be held any time you expect node_start_pfn, node_present_pages + * or node_spanned_pages stay constant. ++ * Also synchronizes pgdat->first_deferred_pfn during deferred page ++ * init. + * + * pgdat_resize_lock() and pgdat_resize_unlock() are provided to + * manipulate node_size_lock without checking for CONFIG_MEMORY_HOTPLUG +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index d157983b84cf..c0dd2f749d3f 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -117,6 +117,10 @@ + #define PCI_CLASS_SERIAL_USB_DEVICE 0x0c03fe + #define PCI_CLASS_SERIAL_FIBER 0x0c04 + #define PCI_CLASS_SERIAL_SMBUS 0x0c05 ++#define PCI_CLASS_SERIAL_IPMI 0x0c07 ++#define PCI_CLASS_SERIAL_IPMI_SMIC 0x0c0700 ++#define PCI_CLASS_SERIAL_IPMI_KCS 0x0c0701 ++#define PCI_CLASS_SERIAL_IPMI_BT 0x0c0702 + + #define PCI_BASE_CLASS_WIRELESS 0x0d + #define PCI_CLASS_WIRELESS_RF_CONTROLLER 0x0d10 +@@ -144,6 +148,8 @@ + + /* Vendors and devices. Sort key: vendor first, device next. */ + ++#define PCI_VENDOR_ID_LOONGSON 0x0014 ++ + #define PCI_VENDOR_ID_TTTECH 0x0357 + #define PCI_DEVICE_ID_TTTECH_MC322 0x000a + +@@ -541,6 +547,11 @@ + #define PCI_DEVICE_ID_AMD_16H_NB_F4 0x1534 + #define PCI_DEVICE_ID_AMD_16H_M30H_NB_F3 0x1583 + #define PCI_DEVICE_ID_AMD_16H_M30H_NB_F4 0x1584 ++#define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463 ++#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F3 0x15eb ++#define PCI_DEVICE_ID_AMD_17H_M30H_DF_F3 0x1493 ++#define PCI_DEVICE_ID_AMD_17H_M70H_DF_F3 0x1443 ++#define PCI_DEVICE_ID_AMD_19H_DF_F3 0x1653 + #define PCI_DEVICE_ID_AMD_CNB17H_F3 0x1703 + #define PCI_DEVICE_ID_AMD_LANCE 0x2000 + #define PCI_DEVICE_ID_AMD_LANCE_HOME 0x2001 +@@ -1133,6 +1144,8 @@ + #define PCI_VENDOR_ID_TCONRAD 0x10da + #define PCI_DEVICE_ID_TCONRAD_TOKENRING 0x0508 + ++#define PCI_VENDOR_ID_ROHM 0x10db ++ + #define PCI_VENDOR_ID_NVIDIA 0x10de + #define PCI_DEVICE_ID_NVIDIA_TNT 0x0020 + #define PCI_DEVICE_ID_NVIDIA_TNT2 0x0028 +@@ -1327,6 +1340,7 @@ + #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP78S_SMBUS 0x0752 + #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE 0x0759 + #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_SMBUS 0x07D8 ++#define PCI_DEVICE_ID_NVIDIA_GEFORCE_320M 0x08A0 + #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS 0x0AA2 + #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA 0x0D85 + +@@ -1819,6 +1833,12 @@ + #define PCI_VENDOR_ID_NVIDIA_SGS 0x12d2 + #define PCI_DEVICE_ID_NVIDIA_SGS_RIVA128 0x0018 + ++#define PCI_VENDOR_ID_PERICOM 0x12D8 ++#define PCI_DEVICE_ID_PERICOM_PI7C9X7951 0x7951 ++#define PCI_DEVICE_ID_PERICOM_PI7C9X7952 0x7952 ++#define PCI_DEVICE_ID_PERICOM_PI7C9X7954 0x7954 ++#define PCI_DEVICE_ID_PERICOM_PI7C9X7958 0x7958 ++ + #define PCI_SUBVENDOR_ID_CHASE_PCIFAST 0x12E0 + #define PCI_SUBDEVICE_ID_CHASE_PCIFAST4 0x0031 + #define PCI_SUBDEVICE_ID_CHASE_PCIFAST8 0x0021 +@@ -1941,6 +1961,8 @@ + #define PCI_VENDOR_ID_DIGIGRAM 0x1369 + #define PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ES_SERIAL_SUBSYSTEM 0xc001 + #define PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ES_CAE_SERIAL_SUBSYSTEM 0xc002 ++#define PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ESE_SERIAL_SUBSYSTEM 0xc021 ++#define PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ESE_CAE_SERIAL_SUBSYSTEM 0xc022 + + #define PCI_VENDOR_ID_KAWASAKI 0x136b + #define PCI_DEVICE_ID_MCHIP_KL5A72002 0xff01 +@@ -2122,6 +2144,7 @@ + #define PCI_VENDOR_ID_MYRICOM 0x14c1 + + #define PCI_VENDOR_ID_MEDIATEK 0x14c3 ++#define PCI_DEVICE_ID_MEDIATEK_7629 0x7629 + + #define PCI_VENDOR_ID_TITAN 0x14D2 + #define PCI_DEVICE_ID_TITAN_010L 0x8001 +@@ -2354,6 +2377,12 @@ + #define PCI_DEVICE_ID_CENATEK_IDE 0x0001 + + #define PCI_VENDOR_ID_SYNOPSYS 0x16c3 ++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd ++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3_AXI 0xabce ++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB31 0xabcf ++#define PCI_DEVICE_ID_SYNOPSYS_EDDA 0xedda ++ ++#define PCI_VENDOR_ID_USR 0x16ec + + #define PCI_VENDOR_ID_VITESSE 0x1725 + #define PCI_DEVICE_ID_VITESSE_VSC7174 0x7174 +@@ -2389,6 +2418,8 @@ + #define PCI_DEVICE_ID_RDC_R6061 0x6061 + #define PCI_DEVICE_ID_RDC_D1010 0x1010 + ++#define PCI_VENDOR_ID_GLI 0x17a0 ++ + #define PCI_VENDOR_ID_LENOVO 0x17aa + + #define PCI_VENDOR_ID_QCOM 0x17cb +@@ -2539,8 +2570,6 @@ + #define PCI_VENDOR_ID_HUAWEI 0x19e5 + + #define PCI_VENDOR_ID_NETRONOME 0x19ee +-#define PCI_DEVICE_ID_NETRONOME_NFP3200 0x3200 +-#define PCI_DEVICE_ID_NETRONOME_NFP3240 0x3240 + #define PCI_DEVICE_ID_NETRONOME_NFP4000 0x4000 + #define PCI_DEVICE_ID_NETRONOME_NFP5000 0x5000 + #define PCI_DEVICE_ID_NETRONOME_NFP6000 0x6000 +@@ -2556,6 +2585,8 @@ + + #define PCI_VENDOR_ID_ASMEDIA 0x1b21 + ++#define PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS 0x1c36 ++ + #define PCI_VENDOR_ID_CIRCUITCO 0x1cc8 + #define PCI_SUBSYSTEM_ID_CIRCUITCO_MINNOWBOARD 0x0001 + +@@ -2981,6 +3012,7 @@ + #define PCI_DEVICE_ID_INTEL_84460GX 0x84ea + #define PCI_DEVICE_ID_INTEL_IXP4XX 0x8500 + #define PCI_DEVICE_ID_INTEL_IXP2800 0x9004 ++#define PCI_DEVICE_ID_INTEL_VMD_9A0B 0x9a0b + #define PCI_DEVICE_ID_INTEL_S21152BB 0xb152 + + #define PCI_VENDOR_ID_SCALEMP 0x8686 +diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h +index e9d4e389aed9..766bbe813861 100644 +--- a/include/linux/sched/mm.h ++++ b/include/linux/sched/mm.h +@@ -49,6 +49,8 @@ static inline void mmdrop(struct mm_struct *mm) + __mmdrop(mm); + } + ++void mmdrop(struct mm_struct *mm); ++ + /* + * This has to be called after a get_task_mm()/mmget_not_zero() + * followed by taking the mmap_sem for writing before modifying the +diff --git a/include/linux/set_memory.h b/include/linux/set_memory.h +index 2a986d282a97..a0e15e7b0b99 100644 +--- a/include/linux/set_memory.h ++++ b/include/linux/set_memory.h +@@ -18,7 +18,7 @@ static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; } + #endif + + #ifndef set_mce_nospec +-static inline int set_mce_nospec(unsigned long pfn) ++static inline int set_mce_nospec(unsigned long pfn, bool unmap) + { + return 0; + } +diff --git a/include/linux/string.h b/include/linux/string.h +index f58e1ef76572..4db285b83f44 100644 +--- a/include/linux/string.h ++++ b/include/linux/string.h +@@ -239,6 +239,31 @@ void __read_overflow3(void) __compiletime_error("detected read beyond size of ob + void __write_overflow(void) __compiletime_error("detected write beyond size of object passed as 1st parameter"); + + #if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE) ++ ++#ifdef CONFIG_KASAN ++extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr); ++extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp); ++extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy); ++extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove); ++extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset); ++extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat); ++extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy); ++extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen); ++extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat); ++extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy); ++#else ++#define __underlying_memchr __builtin_memchr ++#define __underlying_memcmp __builtin_memcmp ++#define __underlying_memcpy __builtin_memcpy ++#define __underlying_memmove __builtin_memmove ++#define __underlying_memset __builtin_memset ++#define __underlying_strcat __builtin_strcat ++#define __underlying_strcpy __builtin_strcpy ++#define __underlying_strlen __builtin_strlen ++#define __underlying_strncat __builtin_strncat ++#define __underlying_strncpy __builtin_strncpy ++#endif ++ + __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size) + { + size_t p_size = __builtin_object_size(p, 0); +@@ -246,14 +271,14 @@ __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size) + __write_overflow(); + if (p_size < size) + fortify_panic(__func__); +- return __builtin_strncpy(p, q, size); ++ return __underlying_strncpy(p, q, size); + } + + __FORTIFY_INLINE char *strcat(char *p, const char *q) + { + size_t p_size = __builtin_object_size(p, 0); + if (p_size == (size_t)-1) +- return __builtin_strcat(p, q); ++ return __underlying_strcat(p, q); + if (strlcat(p, q, p_size) >= p_size) + fortify_panic(__func__); + return p; +@@ -267,7 +292,7 @@ __FORTIFY_INLINE __kernel_size_t strlen(const char *p) + /* Work around gcc excess stack consumption issue */ + if (p_size == (size_t)-1 || + (__builtin_constant_p(p[p_size - 1]) && p[p_size - 1] == '\0')) +- return __builtin_strlen(p); ++ return __underlying_strlen(p); + ret = strnlen(p, p_size); + if (p_size <= ret) + fortify_panic(__func__); +@@ -300,7 +325,7 @@ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size) + __write_overflow(); + if (len >= p_size) + fortify_panic(__func__); +- __builtin_memcpy(p, q, len); ++ __underlying_memcpy(p, q, len); + p[len] = '\0'; + } + return ret; +@@ -313,12 +338,12 @@ __FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count) + size_t p_size = __builtin_object_size(p, 0); + size_t q_size = __builtin_object_size(q, 0); + if (p_size == (size_t)-1 && q_size == (size_t)-1) +- return __builtin_strncat(p, q, count); ++ return __underlying_strncat(p, q, count); + p_len = strlen(p); + copy_len = strnlen(q, count); + if (p_size < p_len + copy_len + 1) + fortify_panic(__func__); +- __builtin_memcpy(p + p_len, q, copy_len); ++ __underlying_memcpy(p + p_len, q, copy_len); + p[p_len + copy_len] = '\0'; + return p; + } +@@ -330,7 +355,7 @@ __FORTIFY_INLINE void *memset(void *p, int c, __kernel_size_t size) + __write_overflow(); + if (p_size < size) + fortify_panic(__func__); +- return __builtin_memset(p, c, size); ++ return __underlying_memset(p, c, size); + } + + __FORTIFY_INLINE void *memcpy(void *p, const void *q, __kernel_size_t size) +@@ -345,7 +370,7 @@ __FORTIFY_INLINE void *memcpy(void *p, const void *q, __kernel_size_t size) + } + if (p_size < size || q_size < size) + fortify_panic(__func__); +- return __builtin_memcpy(p, q, size); ++ return __underlying_memcpy(p, q, size); + } + + __FORTIFY_INLINE void *memmove(void *p, const void *q, __kernel_size_t size) +@@ -360,7 +385,7 @@ __FORTIFY_INLINE void *memmove(void *p, const void *q, __kernel_size_t size) + } + if (p_size < size || q_size < size) + fortify_panic(__func__); +- return __builtin_memmove(p, q, size); ++ return __underlying_memmove(p, q, size); + } + + extern void *__real_memscan(void *, int, __kernel_size_t) __RENAME(memscan); +@@ -386,7 +411,7 @@ __FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size) + } + if (p_size < size || q_size < size) + fortify_panic(__func__); +- return __builtin_memcmp(p, q, size); ++ return __underlying_memcmp(p, q, size); + } + + __FORTIFY_INLINE void *memchr(const void *p, int c, __kernel_size_t size) +@@ -396,7 +421,7 @@ __FORTIFY_INLINE void *memchr(const void *p, int c, __kernel_size_t size) + __read_overflow(); + if (p_size < size) + fortify_panic(__func__); +- return __builtin_memchr(p, c, size); ++ return __underlying_memchr(p, c, size); + } + + void *__real_memchr_inv(const void *s, int c, size_t n) __RENAME(memchr_inv); +@@ -427,11 +452,22 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q) + size_t p_size = __builtin_object_size(p, 0); + size_t q_size = __builtin_object_size(q, 0); + if (p_size == (size_t)-1 && q_size == (size_t)-1) +- return __builtin_strcpy(p, q); ++ return __underlying_strcpy(p, q); + memcpy(p, q, strlen(q) + 1); + return p; + } + ++/* Don't use these outside the FORITFY_SOURCE implementation */ ++#undef __underlying_memchr ++#undef __underlying_memcmp ++#undef __underlying_memcpy ++#undef __underlying_memmove ++#undef __underlying_memset ++#undef __underlying_strcat ++#undef __underlying_strcpy ++#undef __underlying_strlen ++#undef __underlying_strncat ++#undef __underlying_strncpy + #endif + + /** +diff --git a/include/linux/sunrpc/gss_api.h b/include/linux/sunrpc/gss_api.h +index 5ac5db4d295f..566d5f547567 100644 +--- a/include/linux/sunrpc/gss_api.h ++++ b/include/linux/sunrpc/gss_api.h +@@ -83,6 +83,7 @@ struct pf_desc { + u32 service; + char *name; + char *auth_domain_name; ++ struct auth_domain *domain; + bool datatouch; + }; + +diff --git a/include/linux/sunrpc/svcauth_gss.h b/include/linux/sunrpc/svcauth_gss.h +index a4528b26c8aa..d229d27ab19e 100644 +--- a/include/linux/sunrpc/svcauth_gss.h ++++ b/include/linux/sunrpc/svcauth_gss.h +@@ -21,7 +21,8 @@ int gss_svc_init(void); + void gss_svc_shutdown(void); + int gss_svc_init_net(struct net *net); + void gss_svc_shutdown_net(struct net *net); +-int svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name); ++struct auth_domain *svcauth_gss_register_pseudoflavor(u32 pseudoflavor, ++ char *name); + u32 svcauth_gss_flavor(struct auth_domain *dom); + + #endif /* __KERNEL__ */ +diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h +index efe79c1cdd47..d55b68b113de 100644 +--- a/include/linux/uaccess.h ++++ b/include/linux/uaccess.h +@@ -267,7 +267,7 @@ extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count); + probe_kernel_read(&retval, addr, sizeof(retval)) + + #ifndef user_access_begin +-#define user_access_begin() do { } while (0) ++#define user_access_begin(type, ptr, len) access_ok(type, ptr, len) + #define user_access_end() do { } while (0) + #define unsafe_get_user(x, ptr, err) do { if (unlikely(__get_user(x, ptr))) goto err; } while (0) + #define unsafe_put_user(x, ptr, err) do { if (unlikely(__put_user(x, ptr))) goto err; } while (0) +diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h +index 251be353f950..66ce6659ecb6 100644 +--- a/include/uapi/linux/kvm.h ++++ b/include/uapi/linux/kvm.h +@@ -189,9 +189,11 @@ struct kvm_hyperv_exit { + #define KVM_EXIT_HYPERV_SYNIC 1 + #define KVM_EXIT_HYPERV_HCALL 2 + __u32 type; ++ __u32 pad1; + union { + struct { + __u32 msr; ++ __u32 pad2; + __u64 control; + __u64 evt_page; + __u64 msg_page; +diff --git a/kernel/audit.c b/kernel/audit.c +index 7afec5f43c63..45741c3c48a4 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -893,7 +893,7 @@ main_queue: + return 0; + } + +-int audit_send_list(void *_dest) ++int audit_send_list_thread(void *_dest) + { + struct audit_netlink_list *dest = _dest; + struct sk_buff *skb; +@@ -937,19 +937,30 @@ out_kfree_skb: + return NULL; + } + ++static void audit_free_reply(struct audit_reply *reply) ++{ ++ if (!reply) ++ return; ++ ++ if (reply->skb) ++ kfree_skb(reply->skb); ++ if (reply->net) ++ put_net(reply->net); ++ kfree(reply); ++} ++ + static int audit_send_reply_thread(void *arg) + { + struct audit_reply *reply = (struct audit_reply *)arg; +- struct sock *sk = audit_get_sk(reply->net); + + audit_ctl_lock(); + audit_ctl_unlock(); + + /* Ignore failure. It'll only happen if the sender goes away, + because our timeout is set to infinite. */ +- netlink_unicast(sk, reply->skb, reply->portid, 0); +- put_net(reply->net); +- kfree(reply); ++ netlink_unicast(audit_get_sk(reply->net), reply->skb, reply->portid, 0); ++ reply->skb = NULL; ++ audit_free_reply(reply); + return 0; + } + +@@ -963,35 +974,32 @@ static int audit_send_reply_thread(void *arg) + * @payload: payload data + * @size: payload size + * +- * Allocates an skb, builds the netlink message, and sends it to the port id. +- * No failure notifications. ++ * Allocates a skb, builds the netlink message, and sends it to the port id. + */ + static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done, + int multi, const void *payload, int size) + { +- struct net *net = sock_net(NETLINK_CB(request_skb).sk); +- struct sk_buff *skb; + struct task_struct *tsk; +- struct audit_reply *reply = kmalloc(sizeof(struct audit_reply), +- GFP_KERNEL); ++ struct audit_reply *reply; + ++ reply = kzalloc(sizeof(*reply), GFP_KERNEL); + if (!reply) + return; + +- skb = audit_make_reply(seq, type, done, multi, payload, size); +- if (!skb) +- goto out; +- +- reply->net = get_net(net); ++ reply->skb = audit_make_reply(seq, type, done, multi, payload, size); ++ if (!reply->skb) ++ goto err; ++ reply->net = get_net(sock_net(NETLINK_CB(request_skb).sk)); + reply->portid = NETLINK_CB(request_skb).portid; +- reply->skb = skb; + + tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply"); +- if (!IS_ERR(tsk)) +- return; +- kfree_skb(skb); +-out: +- kfree(reply); ++ if (IS_ERR(tsk)) ++ goto err; ++ ++ return; ++ ++err: ++ audit_free_reply(reply); + } + + /* +diff --git a/kernel/audit.h b/kernel/audit.h +index 214e14948370..99badd7ba56f 100644 +--- a/kernel/audit.h ++++ b/kernel/audit.h +@@ -248,7 +248,7 @@ struct audit_netlink_list { + struct sk_buff_head q; + }; + +-int audit_send_list(void *_dest); ++int audit_send_list_thread(void *_dest); + + extern int selinux_audit_rule_update(void); + +diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c +index 1c8a48abda80..b2cc63ca0068 100644 +--- a/kernel/auditfilter.c ++++ b/kernel/auditfilter.c +@@ -1157,11 +1157,8 @@ int audit_rule_change(int type, int seq, void *data, size_t datasz) + */ + int audit_list_rules_send(struct sk_buff *request_skb, int seq) + { +- u32 portid = NETLINK_CB(request_skb).portid; +- struct net *net = sock_net(NETLINK_CB(request_skb).sk); + struct task_struct *tsk; + struct audit_netlink_list *dest; +- int err = 0; + + /* We can't just spew out the rules here because we might fill + * the available socket buffer space and deadlock waiting for +@@ -1169,25 +1166,26 @@ int audit_list_rules_send(struct sk_buff *request_skb, int seq) + * happen if we're actually running in the context of auditctl + * trying to _send_ the stuff */ + +- dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL); ++ dest = kmalloc(sizeof(*dest), GFP_KERNEL); + if (!dest) + return -ENOMEM; +- dest->net = get_net(net); +- dest->portid = portid; ++ dest->net = get_net(sock_net(NETLINK_CB(request_skb).sk)); ++ dest->portid = NETLINK_CB(request_skb).portid; + skb_queue_head_init(&dest->q); + + mutex_lock(&audit_filter_mutex); + audit_list_rules(seq, &dest->q); + mutex_unlock(&audit_filter_mutex); + +- tsk = kthread_run(audit_send_list, dest, "audit_send_list"); ++ tsk = kthread_run(audit_send_list_thread, dest, "audit_send_list"); + if (IS_ERR(tsk)) { + skb_queue_purge(&dest->q); ++ put_net(dest->net); + kfree(dest); +- err = PTR_ERR(tsk); ++ return PTR_ERR(tsk); + } + +- return err; ++ return 0; + } + + int audit_comparator(u32 left, u32 op, u32 right) +diff --git a/kernel/compat.c b/kernel/compat.c +index 8e40efc2928a..e4548a9e9c52 100644 +--- a/kernel/compat.c ++++ b/kernel/compat.c +@@ -354,10 +354,9 @@ long compat_get_bitmap(unsigned long *mask, const compat_ulong_t __user *umask, + bitmap_size = ALIGN(bitmap_size, BITS_PER_COMPAT_LONG); + nr_compat_longs = BITS_TO_COMPAT_LONGS(bitmap_size); + +- if (!access_ok(VERIFY_READ, umask, bitmap_size / 8)) ++ if (!user_access_begin(VERIFY_READ, umask, bitmap_size / 8)) + return -EFAULT; + +- user_access_begin(); + while (nr_compat_longs > 1) { + compat_ulong_t l1, l2; + unsafe_get_user(l1, umask++, Efault); +@@ -384,10 +383,9 @@ long compat_put_bitmap(compat_ulong_t __user *umask, unsigned long *mask, + bitmap_size = ALIGN(bitmap_size, BITS_PER_COMPAT_LONG); + nr_compat_longs = BITS_TO_COMPAT_LONGS(bitmap_size); + +- if (!access_ok(VERIFY_WRITE, umask, bitmap_size / 8)) ++ if (!user_access_begin(VERIFY_WRITE, umask, bitmap_size / 8)) + return -EFAULT; + +- user_access_begin(); + while (nr_compat_longs > 1) { + unsigned long m = *mask++; + unsafe_put_user((compat_ulong_t)m, umask++, Efault); +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 6d6c106a495c..08b9d6ba0807 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -3,6 +3,7 @@ + * + * This code is licenced under the GPL. + */ ++#include <linux/sched/mm.h> + #include <linux/proc_fs.h> + #include <linux/smp.h> + #include <linux/init.h> +@@ -532,6 +533,21 @@ static int bringup_cpu(unsigned int cpu) + return bringup_wait_for_ap(cpu); + } + ++static int finish_cpu(unsigned int cpu) ++{ ++ struct task_struct *idle = idle_thread_get(cpu); ++ struct mm_struct *mm = idle->active_mm; ++ ++ /* ++ * idle_task_exit() will have switched to &init_mm, now ++ * clean up any remaining active_mm state. ++ */ ++ if (mm != &init_mm) ++ idle->active_mm = &init_mm; ++ mmdrop(mm); ++ return 0; ++} ++ + /* + * Hotplug state machine related functions + */ +@@ -1379,7 +1395,7 @@ static struct cpuhp_step cpuhp_hp_states[] = { + [CPUHP_BRINGUP_CPU] = { + .name = "cpu:bringup", + .startup.single = bringup_cpu, +- .teardown.single = NULL, ++ .teardown.single = finish_cpu, + .cant_stop = true, + }, + /* Final state before CPU kills itself */ +diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c +index 67b02e138a47..2ed6351e2a7e 100644 +--- a/kernel/cpu_pm.c ++++ b/kernel/cpu_pm.c +@@ -89,7 +89,7 @@ EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier); + */ + int cpu_pm_enter(void) + { +- int nr_calls; ++ int nr_calls = 0; + int ret = 0; + + ret = cpu_pm_notify(CPU_PM_ENTER, -1, &nr_calls); +@@ -140,7 +140,7 @@ EXPORT_SYMBOL_GPL(cpu_pm_exit); + */ + int cpu_cluster_pm_enter(void) + { +- int nr_calls; ++ int nr_calls = 0; + int ret = 0; + + ret = cpu_pm_notify(CPU_CLUSTER_PM_ENTER, -1, &nr_calls); +diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c +index 94aa9ae0007a..6a1dc2613bb9 100644 +--- a/kernel/debug/debug_core.c ++++ b/kernel/debug/debug_core.c +@@ -444,6 +444,7 @@ static int kgdb_reenter_check(struct kgdb_state *ks) + + if (exception_level > 1) { + dump_stack(); ++ kgdb_io_module_registered = false; + panic("Recursive entry to debugger"); + } + +@@ -577,6 +578,8 @@ return_normal: + if (kgdb_skipexception(ks->ex_vector, ks->linux_regs)) + goto kgdb_restore; + ++ atomic_inc(&ignore_console_lock_warning); ++ + /* Call the I/O driver's pre_exception routine */ + if (dbg_io_ops->pre_exception) + dbg_io_ops->pre_exception(); +@@ -649,6 +652,8 @@ cpu_master_loop: + if (dbg_io_ops->post_exception) + dbg_io_ops->post_exception(); + ++ atomic_dec(&ignore_console_lock_warning); ++ + if (!kgdb_single_step) { + raw_spin_unlock(&dbg_slave_lock); + /* Wait till all the CPUs have quit from the debugger. */ +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 21e3c65abc76..a17e6302ded5 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -94,11 +94,11 @@ static void remote_function(void *data) + * @info: the function call argument + * + * Calls the function @func when the task is currently running. This might +- * be on the current CPU, which just calls the function directly ++ * be on the current CPU, which just calls the function directly. This will ++ * retry due to any failures in smp_call_function_single(), such as if the ++ * task_cpu() goes offline concurrently. + * +- * returns: @func return value, or +- * -ESRCH - when the process isn't running +- * -EAGAIN - when the process moved away ++ * returns @func return value or -ESRCH when the process isn't running + */ + static int + task_function_call(struct task_struct *p, remote_function_f func, void *info) +@@ -111,11 +111,16 @@ task_function_call(struct task_struct *p, remote_function_f func, void *info) + }; + int ret; + +- do { +- ret = smp_call_function_single(task_cpu(p), remote_function, &data, 1); +- if (!ret) +- ret = data.ret; +- } while (ret == -EAGAIN); ++ for (;;) { ++ ret = smp_call_function_single(task_cpu(p), remote_function, ++ &data, 1); ++ ret = !ret ? data.ret : -EAGAIN; ++ ++ if (ret != -EAGAIN) ++ break; ++ ++ cond_resched(); ++ } + + return ret; + } +diff --git a/kernel/exit.c b/kernel/exit.c +index 54c3269b8dda..eeaafd4064c9 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -772,8 +772,12 @@ void __noreturn do_exit(long code) + struct task_struct *tsk = current; + int group_dead; + +- profile_task_exit(tsk); +- kcov_task_exit(tsk); ++ /* ++ * We can get here from a kernel oops, sometimes with preemption off. ++ * Start by checking for critical errors. ++ * Then fix up important state like USER_DS and preemption. ++ * Then do everything else. ++ */ + + WARN_ON(blk_needs_flush_plug(tsk)); + +@@ -791,6 +795,16 @@ void __noreturn do_exit(long code) + */ + set_fs(USER_DS); + ++ if (unlikely(in_atomic())) { ++ pr_info("note: %s[%d] exited with preempt_count %d\n", ++ current->comm, task_pid_nr(current), ++ preempt_count()); ++ preempt_count_set(PREEMPT_ENABLED); ++ } ++ ++ profile_task_exit(tsk); ++ kcov_task_exit(tsk); ++ + ptrace_event(PTRACE_EVENT_EXIT, code); + + validate_creds_for_do_exit(tsk); +@@ -828,13 +842,6 @@ void __noreturn do_exit(long code) + raw_spin_lock_irq(&tsk->pi_lock); + raw_spin_unlock_irq(&tsk->pi_lock); + +- if (unlikely(in_atomic())) { +- pr_info("note: %s[%d] exited with preempt_count %d\n", +- current->comm, task_pid_nr(current), +- preempt_count()); +- preempt_count_set(PREEMPT_ENABLED); +- } +- + /* sync mm's RSS info before statistics gathering */ + if (tsk->mm) + sync_mm_rss(tsk->mm); +@@ -1617,10 +1624,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, + if (!infop) + return err; + +- if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop))) ++ if (!user_access_begin(VERIFY_WRITE, infop, sizeof(*infop))) + return -EFAULT; + +- user_access_begin(); + unsafe_put_user(signo, &infop->si_signo, Efault); + unsafe_put_user(0, &infop->si_errno, Efault); + unsafe_put_user(info.cause, &infop->si_code, Efault); +@@ -1745,10 +1751,9 @@ COMPAT_SYSCALL_DEFINE5(waitid, + if (!infop) + return err; + +- if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop))) ++ if (!user_access_begin(VERIFY_WRITE, infop, sizeof(*infop))) + return -EFAULT; + +- user_access_begin(); + unsafe_put_user(signo, &infop->si_signo, Efault); + unsafe_put_user(0, &infop->si_errno, Efault); + unsafe_put_user(info.cause, &infop->si_code, Efault); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 2befd2c4ce9e..0325ccf3a8e4 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5571,13 +5571,14 @@ void idle_task_exit(void) + struct mm_struct *mm = current->active_mm; + + BUG_ON(cpu_online(smp_processor_id())); ++ BUG_ON(current != this_rq()->idle); + + if (mm != &init_mm) { + switch_mm(mm, &init_mm, current); +- current->active_mm = &init_mm; + finish_arch_post_lock_switch(); + } +- mmdrop(mm); ++ ++ /* finish_cpu(), as ran on the BP, will clean up the active_mm state */ + } + + /* +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 86ccaaf0c1bf..92b1e71f13c8 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -2697,7 +2697,7 @@ void task_tick_numa(struct rq *rq, struct task_struct *curr) + /* + * We don't care about NUMA placement if we don't have memory. + */ +- if (!curr->mm || (curr->flags & PF_EXITING) || work->next != work) ++ if ((curr->flags & (PF_EXITING | PF_KTHREAD)) || work->next != work) + return; + + /* +diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h +index e01b705556aa..6c5229f98c9e 100644 +--- a/lib/mpi/longlong.h ++++ b/lib/mpi/longlong.h +@@ -671,7 +671,7 @@ do { \ + ************** MIPS/64 ************** + ***************************************/ + #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64 +-#if defined(__mips_isa_rev) && __mips_isa_rev >= 6 ++#if defined(__mips_isa_rev) && __mips_isa_rev >= 6 && defined(CONFIG_CC_IS_GCC) + /* + * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C + * code below, so we special case MIPS64r6 until the compiler can do better. +diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c +index e304b54c9c7d..fc5b1e2d997d 100644 +--- a/lib/strncpy_from_user.c ++++ b/lib/strncpy_from_user.c +@@ -29,13 +29,6 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src, + const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; + unsigned long res = 0; + +- /* +- * Truncate 'max' to the user-specified limit, so that +- * we only have one limit we need to check in the loop +- */ +- if (max > count) +- max = count; +- + if (IS_UNALIGNED(src, dst)) + goto byte_at_a_time; + +@@ -113,12 +106,20 @@ long strncpy_from_user(char *dst, const char __user *src, long count) + unsigned long max = max_addr - src_addr; + long retval; + ++ /* ++ * Truncate 'max' to the user-specified limit, so that ++ * we only have one limit we need to check in the loop ++ */ ++ if (max > count) ++ max = count; ++ + kasan_check_write(dst, count); + check_object_size(dst, count, false); +- user_access_begin(); +- retval = do_strncpy_from_user(dst, src, count, max); +- user_access_end(); +- return retval; ++ if (user_access_begin(VERIFY_READ, src, max)) { ++ retval = do_strncpy_from_user(dst, src, count, max); ++ user_access_end(); ++ return retval; ++ } + } + return -EFAULT; + } +diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c +index 184f80f7bacf..0bf7c06ebdad 100644 +--- a/lib/strnlen_user.c ++++ b/lib/strnlen_user.c +@@ -31,13 +31,6 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count, + unsigned long align, res = 0; + unsigned long c; + +- /* +- * Truncate 'max' to the user-specified limit, so that +- * we only have one limit we need to check in the loop +- */ +- if (max > count) +- max = count; +- + /* + * Do everything aligned. But that means that we + * need to also expand the maximum.. +@@ -114,10 +107,18 @@ long strnlen_user(const char __user *str, long count) + unsigned long max = max_addr - src_addr; + long retval; + +- user_access_begin(); +- retval = do_strnlen_user(str, count, max); +- user_access_end(); +- return retval; ++ /* ++ * Truncate 'max' to the user-specified limit, so that ++ * we only have one limit we need to check in the loop ++ */ ++ if (max > count) ++ max = count; ++ ++ if (user_access_begin(VERIFY_READ, str, max)) { ++ retval = do_strnlen_user(str, count, max); ++ user_access_end(); ++ return retval; ++ } + } + return 0; + } +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 280b0e71b783..1443ae6fee9b 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2273,6 +2273,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, + spinlock_t *ptl; + struct mm_struct *mm = vma->vm_mm; + unsigned long haddr = address & HPAGE_PMD_MASK; ++ bool was_locked = false; ++ pmd_t _pmd; + + mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE); + ptl = pmd_lock(mm, pmd); +@@ -2282,11 +2284,32 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, + * pmd against. Otherwise we can end up replacing wrong page. + */ + VM_BUG_ON(freeze && !page); +- if (page && page != pmd_page(*pmd)) +- goto out; ++ if (page) { ++ VM_WARN_ON_ONCE(!PageLocked(page)); ++ was_locked = true; ++ if (page != pmd_page(*pmd)) ++ goto out; ++ } + ++repeat: + if (pmd_trans_huge(*pmd)) { +- page = pmd_page(*pmd); ++ if (!page) { ++ page = pmd_page(*pmd); ++ if (unlikely(!trylock_page(page))) { ++ get_page(page); ++ _pmd = *pmd; ++ spin_unlock(ptl); ++ lock_page(page); ++ spin_lock(ptl); ++ if (unlikely(!pmd_same(*pmd, _pmd))) { ++ unlock_page(page); ++ put_page(page); ++ page = NULL; ++ goto repeat; ++ } ++ put_page(page); ++ } ++ } + if (PageMlocked(page)) + clear_page_mlock(page); + } else if (!(pmd_devmap(*pmd) || is_pmd_migration_entry(*pmd))) +@@ -2294,6 +2317,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, + __split_huge_pmd_locked(vma, pmd, haddr, freeze); + out: + spin_unlock(ptl); ++ if (!was_locked && page) ++ unlock_page(page); + /* + * No need to double call mmu_notifier->invalidate_range() callback. + * They are 3 cases to consider inside __split_huge_pmd_locked(): +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index d8c3051387d1..7181dfe76440 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1586,6 +1586,13 @@ static int __init deferred_init_memmap(void *data) + BUG_ON(pgdat->first_deferred_pfn > pgdat_end_pfn(pgdat)); + pgdat->first_deferred_pfn = ULONG_MAX; + ++ /* ++ * Once we unlock here, the zone cannot be grown anymore, thus if an ++ * interrupt thread must allocate this early in boot, zone must be ++ * pre-grown prior to start of deferred page initialization. ++ */ ++ pgdat_resize_unlock(pgdat, &flags); ++ + /* Only the highest zone is deferred so find it */ + for (zid = 0; zid < MAX_NR_ZONES; zid++) { + zone = pgdat->node_zones + zid; +@@ -1610,7 +1617,6 @@ static int __init deferred_init_memmap(void *data) + epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); + deferred_free_pages(nid, zid, spfn, epfn); + } +- pgdat_resize_unlock(pgdat, &flags); + + /* Sanity check that the next zone really is unpopulated */ + WARN_ON(++zid < MAX_NR_ZONES && populated_zone(++zone)); +@@ -1656,17 +1662,6 @@ deferred_grow_zone(struct zone *zone, unsigned int order) + + pgdat_resize_lock(pgdat, &flags); + +- /* +- * If deferred pages have been initialized while we were waiting for +- * the lock, return true, as the zone was grown. The caller will retry +- * this zone. We won't return to this function since the caller also +- * has this static branch. +- */ +- if (!static_branch_unlikely(&deferred_pages)) { +- pgdat_resize_unlock(pgdat, &flags); +- return true; +- } +- + /* + * If someone grew this zone while we were waiting for spinlock, return + * true, as there might be enough pages already. +diff --git a/mm/slub.c b/mm/slub.c +index d8116a43a287..b94ba8d35a02 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -5738,8 +5738,10 @@ static int sysfs_slab_add(struct kmem_cache *s) + + s->kobj.kset = kset; + err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", name); +- if (err) ++ if (err) { ++ kobject_put(&s->kobj); + goto out; ++ } + + err = sysfs_create_group(&s->kobj, &slab_attr_group); + if (err) +diff --git a/mm/util.c b/mm/util.c +index 6a24a1025d77..621afcea2bfa 100644 +--- a/mm/util.c ++++ b/mm/util.c +@@ -453,6 +453,24 @@ void kvfree(const void *addr) + } + EXPORT_SYMBOL(kvfree); + ++/** ++ * kvfree_sensitive - Free a data object containing sensitive information. ++ * @addr: address of the data object to be freed. ++ * @len: length of the data object. ++ * ++ * Use the special memzero_explicit() function to clear the content of a ++ * kvmalloc'ed object containing sensitive data to make sure that the ++ * compiler won't optimize out the data clearing. ++ */ ++void kvfree_sensitive(const void *addr, size_t len) ++{ ++ if (likely(!ZERO_OR_NULL_PTR(addr))) { ++ memzero_explicit((void *)addr, len); ++ kvfree(addr); ++ } ++} ++EXPORT_SYMBOL(kvfree_sensitive); ++ + static inline void *__page_rmapping(struct page *page) + { + unsigned long mapping; +diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c +index 5da183b2f4c9..af3da6cdfc79 100644 +--- a/net/batman-adv/bat_v_elp.c ++++ b/net/batman-adv/bat_v_elp.c +@@ -132,20 +132,7 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh) + rtnl_lock(); + ret = __ethtool_get_link_ksettings(hard_iface->net_dev, &link_settings); + rtnl_unlock(); +- +- /* Virtual interface drivers such as tun / tap interfaces, VLAN, etc +- * tend to initialize the interface throughput with some value for the +- * sake of having a throughput number to export via ethtool. This +- * exported throughput leaves batman-adv to conclude the interface +- * throughput is genuine (reflecting reality), thus no measurements +- * are necessary. +- * +- * Based on the observation that those interface types also tend to set +- * the link auto-negotiation to 'off', batman-adv shall check this +- * setting to differentiate between genuine link throughput information +- * and placeholders installed by virtual interfaces. +- */ +- if (ret == 0 && link_settings.base.autoneg == AUTONEG_ENABLE) { ++ if (ret == 0) { + /* link characteristics might change over time */ + if (link_settings.base.duplex == DUPLEX_FULL) + hard_iface->bat_v.flags |= BATADV_FULL_DUPLEX; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 3e7badb3ac2d..a044e6bb12b8 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4097,6 +4097,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, + case 0x11: /* Unsupported Feature or Parameter Value */ + case 0x1c: /* SCO interval rejected */ + case 0x1a: /* Unsupported Remote Feature */ ++ case 0x1e: /* Invalid LMP Parameters */ + case 0x1f: /* Unspecified error */ + case 0x20: /* Unsupported LMP Parameter value */ + if (conn->out) { +diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c +index d42e3904b498..eb44ae05abaa 100644 +--- a/net/bridge/br_arp_nd_proxy.c ++++ b/net/bridge/br_arp_nd_proxy.c +@@ -277,6 +277,10 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, + ns_olen = request->len - (skb_network_offset(request) + + sizeof(struct ipv6hdr)) - sizeof(*ns); + for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) { ++ if (!ns->opt[i + 1]) { ++ kfree_skb(reply); ++ return; ++ } + if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) { + daddr = ns->opt + i + sizeof(struct nd_opt_hdr); + break; +diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c +index 231c489128e4..aa54303c43a6 100644 +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -185,14 +185,15 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + retv = -EBUSY; + break; + } +- } +- if (sk->sk_protocol == IPPROTO_TCP && +- sk->sk_prot != &tcpv6_prot) { +- retv = -EBUSY; ++ } else if (sk->sk_protocol == IPPROTO_TCP) { ++ if (sk->sk_prot != &tcpv6_prot) { ++ retv = -EBUSY; ++ break; ++ } ++ } else { + break; + } +- if (sk->sk_protocol != IPPROTO_TCP) +- break; ++ + if (sk->sk_state != TCP_ESTABLISHED) { + retv = -ENOTCONN; + break; +diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c +index c15807d10b91..3e82a7d0df2a 100644 +--- a/net/netfilter/nft_nat.c ++++ b/net/netfilter/nft_nat.c +@@ -135,7 +135,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + priv->type = NF_NAT_MANIP_DST; + break; + default: +- return -EINVAL; ++ return -EOPNOTSUPP; + } + + if (tb[NFTA_NAT_FAMILY] == NULL) +@@ -202,7 +202,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + if (tb[NFTA_NAT_FLAGS]) { + priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS])); + if (priv->flags & ~NF_NAT_RANGE_MASK) +- return -EINVAL; ++ return -EOPNOTSUPP; + } + + return nf_ct_netns_get(ctx->net, family); +diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c +index 5fec3abbe19b..c7d88f979c56 100644 +--- a/net/sunrpc/auth_gss/gss_mech_switch.c ++++ b/net/sunrpc/auth_gss/gss_mech_switch.c +@@ -61,6 +61,8 @@ gss_mech_free(struct gss_api_mech *gm) + + for (i = 0; i < gm->gm_pf_num; i++) { + pf = &gm->gm_pfs[i]; ++ if (pf->domain) ++ auth_domain_put(pf->domain); + kfree(pf->auth_domain_name); + pf->auth_domain_name = NULL; + } +@@ -83,6 +85,7 @@ make_auth_domain_name(char *name) + static int + gss_mech_svc_setup(struct gss_api_mech *gm) + { ++ struct auth_domain *dom; + struct pf_desc *pf; + int i, status; + +@@ -92,10 +95,13 @@ gss_mech_svc_setup(struct gss_api_mech *gm) + status = -ENOMEM; + if (pf->auth_domain_name == NULL) + goto out; +- status = svcauth_gss_register_pseudoflavor(pf->pseudoflavor, +- pf->auth_domain_name); +- if (status) ++ dom = svcauth_gss_register_pseudoflavor( ++ pf->pseudoflavor, pf->auth_domain_name); ++ if (IS_ERR(dom)) { ++ status = PTR_ERR(dom); + goto out; ++ } ++ pf->domain = dom; + } + return 0; + out: +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index 68830e88b6e9..68259eec6afd 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -779,7 +779,7 @@ u32 svcauth_gss_flavor(struct auth_domain *dom) + + EXPORT_SYMBOL_GPL(svcauth_gss_flavor); + +-int ++struct auth_domain * + svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name) + { + struct gss_domain *new; +@@ -796,21 +796,23 @@ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name) + new->h.flavour = &svcauthops_gss; + new->pseudoflavor = pseudoflavor; + +- stat = 0; + test = auth_domain_lookup(name, &new->h); +- if (test != &new->h) { /* Duplicate registration */ ++ if (test != &new->h) { ++ pr_warn("svc: duplicate registration of gss pseudo flavour %s.\n", ++ name); ++ stat = -EADDRINUSE; + auth_domain_put(test); +- kfree(new->h.name); +- goto out_free_dom; ++ goto out_free_name; + } +- return 0; ++ return test; + ++out_free_name: ++ kfree(new->h.name); + out_free_dom: + kfree(new); + out: +- return stat; ++ return ERR_PTR(stat); + } +- + EXPORT_SYMBOL_GPL(svcauth_gss_register_pseudoflavor); + + static inline int +diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c +index d20f5792761c..fc142d04d365 100644 +--- a/security/integrity/evm/evm_crypto.c ++++ b/security/integrity/evm/evm_crypto.c +@@ -249,7 +249,7 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry, + + /* Portable EVM signatures must include an IMA hash */ + if (type == EVM_XATTR_PORTABLE_DIGSIG && !ima_present) +- return -EPERM; ++ error = -EPERM; + out: + kfree(xattr_value); + kfree(desc); +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index 67db9d9454ca..d12b07eb3a58 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -40,7 +40,7 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; + #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE + #define IMA_EVENT_NAME_LEN_MAX 255 + +-#define IMA_HASH_BITS 9 ++#define IMA_HASH_BITS 10 + #define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS) + + #define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16 +@@ -56,6 +56,7 @@ extern int ima_policy_flag; + extern int ima_hash_algo; + extern int ima_appraise; + extern struct tpm_chip *ima_tpm_chip; ++extern const char boot_aggregate_name[]; + + /* IMA event related data */ + struct ima_event_data { +@@ -139,7 +140,7 @@ int ima_calc_buffer_hash(const void *buf, loff_t len, + int ima_calc_field_array_hash(struct ima_field_data *field_data, + struct ima_template_desc *desc, int num_fields, + struct ima_digest_data *hash); +-int __init ima_calc_boot_aggregate(struct ima_digest_data *hash); ++int ima_calc_boot_aggregate(struct ima_digest_data *hash); + void ima_add_violation(struct file *file, const unsigned char *filename, + struct integrity_iint_cache *iint, + const char *op, const char *cause); +@@ -166,9 +167,10 @@ struct ima_h_table { + }; + extern struct ima_h_table ima_htable; + +-static inline unsigned long ima_hash_key(u8 *digest) ++static inline unsigned int ima_hash_key(u8 *digest) + { +- return hash_long(*digest, IMA_HASH_BITS); ++ /* there is no point in taking a hash of part of a digest */ ++ return (digest[0] | digest[1] << 8) % IMA_MEASURE_HTABLE_SIZE; + } + + #define __ima_hooks(hook) \ +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c +index 6a6d19ada66a..c5dd05ace28c 100644 +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -663,8 +663,8 @@ static void __init ima_pcrread(int idx, u8 *pcr) + /* + * Calculate the boot aggregate hash + */ +-static int __init ima_calc_boot_aggregate_tfm(char *digest, +- struct crypto_shash *tfm) ++static int ima_calc_boot_aggregate_tfm(char *digest, ++ struct crypto_shash *tfm) + { + u8 pcr_i[TPM_DIGEST_SIZE]; + int rc, i; +@@ -688,7 +688,7 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest, + return rc; + } + +-int __init ima_calc_boot_aggregate(struct ima_digest_data *hash) ++int ima_calc_boot_aggregate(struct ima_digest_data *hash) + { + struct crypto_shash *tfm; + int rc; +diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c +index faac9ecaa0ae..a2bc4cb4482a 100644 +--- a/security/integrity/ima/ima_init.c ++++ b/security/integrity/ima/ima_init.c +@@ -25,7 +25,7 @@ + #include "ima.h" + + /* name for boot aggregate entry */ +-static const char *boot_aggregate_name = "boot_aggregate"; ++const char boot_aggregate_name[] = "boot_aggregate"; + struct tpm_chip *ima_tpm_chip; + + /* Add the boot aggregate to the IMA measurement list and extend +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index 93babb60b05a..2d5a3daa02f9 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -196,7 +196,7 @@ static struct ima_rule_entry secure_boot_rules[] __ro_after_init = { + static LIST_HEAD(ima_default_rules); + static LIST_HEAD(ima_policy_rules); + static LIST_HEAD(ima_temp_rules); +-static struct list_head *ima_rules; ++static struct list_head *ima_rules = &ima_default_rules; + + static int ima_policy __initdata; + +@@ -544,7 +544,6 @@ void __init ima_init_policy(void) + temp_ima_appraise |= IMA_APPRAISE_POLICY; + } + +- ima_rules = &ima_default_rules; + ima_update_policy_flag(); + } + +diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c +index 43752002c222..48c5a1be88ac 100644 +--- a/security/integrity/ima/ima_template_lib.c ++++ b/security/integrity/ima/ima_template_lib.c +@@ -284,6 +284,24 @@ int ima_eventdigest_init(struct ima_event_data *event_data, + goto out; + } + ++ if ((const char *)event_data->filename == boot_aggregate_name) { ++ if (ima_tpm_chip) { ++ hash.hdr.algo = HASH_ALGO_SHA1; ++ result = ima_calc_boot_aggregate(&hash.hdr); ++ ++ /* algo can change depending on available PCR banks */ ++ if (!result && hash.hdr.algo != HASH_ALGO_SHA1) ++ result = -EINVAL; ++ ++ if (result < 0) ++ memset(&hash, 0, sizeof(hash)); ++ } ++ ++ cur_digest = hash.hdr.digest; ++ cur_digestsize = hash_digest_size[HASH_ALGO_SHA1]; ++ goto out; ++ } ++ + if (!event_data->file) /* missing info to re-calculate the digest */ + return -EINVAL; + +diff --git a/security/keys/internal.h b/security/keys/internal.h +index eb50212fbbf8..d1b9c5957000 100644 +--- a/security/keys/internal.h ++++ b/security/keys/internal.h +@@ -306,15 +306,4 @@ static inline void key_check(const struct key *key) + #define key_check(key) do {} while(0) + + #endif +- +-/* +- * Helper function to clear and free a kvmalloc'ed memory object. +- */ +-static inline void __kvzfree(const void *addr, size_t len) +-{ +- if (addr) { +- memset((void *)addr, 0, len); +- kvfree(addr); +- } +-} + #endif /* _INTERNAL_H */ +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index c07c2e2b2478..9394d72a77e8 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -133,10 +133,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type, + + key_ref_put(keyring_ref); + error3: +- if (payload) { +- memzero_explicit(payload, plen); +- kvfree(payload); +- } ++ kvfree_sensitive(payload, plen); + error2: + kfree(description); + error: +@@ -351,7 +348,7 @@ long keyctl_update_key(key_serial_t id, + + key_ref_put(key_ref); + error2: +- __kvzfree(payload, plen); ++ kvfree_sensitive(payload, plen); + error: + return ret; + } +@@ -859,7 +856,7 @@ can_read_key: + */ + if (ret > key_data_len) { + if (unlikely(key_data)) +- __kvzfree(key_data, key_data_len); ++ kvfree_sensitive(key_data, key_data_len); + key_data_len = ret; + continue; /* Allocate buffer */ + } +@@ -868,7 +865,7 @@ can_read_key: + ret = -EFAULT; + break; + } +- __kvzfree(key_data, key_data_len); ++ kvfree_sensitive(key_data, key_data_len); + + key_put_out: + key_put(key); +@@ -1170,10 +1167,7 @@ long keyctl_instantiate_key_common(key_serial_t id, + keyctl_change_reqkey_auth(NULL); + + error2: +- if (payload) { +- memzero_explicit(payload, plen); +- kvfree(payload); +- } ++ kvfree_sensitive(payload, plen); + error: + return ret; + } +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index f6482e53d55a..371ae368da35 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -906,11 +906,21 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + else + rule += strlen(skp->smk_known) + 1; + ++ if (rule > data + count) { ++ rc = -EOVERFLOW; ++ goto out; ++ } ++ + ret = sscanf(rule, "%d", &maplevel); + if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL) + goto out; + + rule += SMK_DIGITLEN; ++ if (rule > data + count) { ++ rc = -EOVERFLOW; ++ goto out; ++ } ++ + ret = sscanf(rule, "%d", &catlen); + if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM) + goto out; +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index f03ceaff75b5..7c12b0deb4eb 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -1982,6 +1982,11 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd) + } + pcm_file = f.file->private_data; + substream1 = pcm_file->substream; ++ if (substream == substream1) { ++ res = -EINVAL; ++ goto _badf; ++ } ++ + group = kmalloc(sizeof(*group), GFP_KERNEL); + if (!group) { + res = -ENOMEM; +diff --git a/sound/isa/es1688/es1688.c b/sound/isa/es1688/es1688.c +index 3dfe7e592c25..5a69314413b6 100644 +--- a/sound/isa/es1688/es1688.c ++++ b/sound/isa/es1688/es1688.c +@@ -282,8 +282,10 @@ static int snd_es968_pnp_detect(struct pnp_card_link *pcard, + return error; + } + error = snd_es1688_probe(card, dev); +- if (error < 0) ++ if (error < 0) { ++ snd_card_free(card); + return error; ++ } + pnp_set_card_drvdata(pcard, card); + snd_es968_pnp_is_probed = 1; + return 0; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b06f7d52faad..b4f802013f74 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7694,6 +7694,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + ALC225_STANDARD_PINS, + {0x12, 0xb7a60130}, + {0x17, 0x90170110}), ++ SND_HDA_PIN_QUIRK(0x10ec0623, 0x17aa, "Lenovo", ALC283_FIXUP_HEADSET_MIC, ++ {0x14, 0x01014010}, ++ {0x17, 0x90170120}, ++ {0x18, 0x02a11030}, ++ {0x19, 0x02a1103f}, ++ {0x21, 0x0221101f}), + {} + }; + +diff --git a/sound/pci/lx6464es/lx6464es.c b/sound/pci/lx6464es/lx6464es.c +index 54f6252faca6..daf25655f635 100644 +--- a/sound/pci/lx6464es/lx6464es.c ++++ b/sound/pci/lx6464es/lx6464es.c +@@ -65,6 +65,14 @@ static const struct pci_device_id snd_lx6464es_ids[] = { + PCI_VENDOR_ID_DIGIGRAM, + PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ES_CAE_SERIAL_SUBSYSTEM), + }, /* LX6464ES-CAE */ ++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_LX6464ES, ++ PCI_VENDOR_ID_DIGIGRAM, ++ PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ESE_SERIAL_SUBSYSTEM), ++ }, /* LX6464ESe */ ++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_LX6464ES, ++ PCI_VENDOR_ID_DIGIGRAM, ++ PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ESE_CAE_SERIAL_SUBSYSTEM), ++ }, /* LX6464ESe-CAE */ + { 0, }, + }; + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 746a72e23cf9..2644a5ae2b75 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -806,9 +806,6 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message) + if (chip == (void *)-1L) + return 0; + +- chip->autosuspended = !!PMSG_IS_AUTO(message); +- if (!chip->autosuspended) +- snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot); + if (!chip->num_suspended_intf++) { + list_for_each_entry(as, &chip->pcm_list, list) { + snd_pcm_suspend_all(as->pcm); +@@ -822,6 +819,11 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message) + snd_usb_mixer_suspend(mixer); + } + ++ if (!PMSG_IS_AUTO(message) && !chip->system_suspend) { ++ snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot); ++ chip->system_suspend = chip->num_suspended_intf; ++ } ++ + return 0; + } + +@@ -835,10 +837,10 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume) + + if (chip == (void *)-1L) + return 0; +- if (--chip->num_suspended_intf) +- return 0; + + atomic_inc(&chip->active); /* avoid autopm */ ++ if (chip->num_suspended_intf > 1) ++ goto out; + + list_for_each_entry(as, &chip->pcm_list, list) { + err = snd_usb_pcm_resume(as); +@@ -860,9 +862,12 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume) + snd_usbmidi_resume(p); + } + +- if (!chip->autosuspended) ++ out: ++ if (chip->num_suspended_intf == chip->system_suspend) { + snd_power_change_state(chip->card, SNDRV_CTL_POWER_D0); +- chip->autosuspended = 0; ++ chip->system_suspend = 0; ++ } ++ chip->num_suspended_intf--; + + err_out: + atomic_dec(&chip->active); /* allow autopm after this point */ +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index b798eae0a785..e2725ab4d985 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -39,6 +39,26 @@ + .idProduct = prod, \ + .bInterfaceClass = USB_CLASS_VENDOR_SPEC + ++/* HP Thunderbolt Dock Audio Headset */ ++{ ++ USB_DEVICE(0x03f0, 0x0269), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .vendor_name = "HP", ++ .product_name = "Thunderbolt Dock Audio Headset", ++ .profile_name = "HP-Thunderbolt-Dock-Audio-Headset", ++ .ifnum = QUIRK_NO_INTERFACE ++ } ++}, ++/* HP Thunderbolt Dock Audio Module */ ++{ ++ USB_DEVICE(0x03f0, 0x0567), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .vendor_name = "HP", ++ .product_name = "Thunderbolt Dock Audio Module", ++ .profile_name = "HP-Thunderbolt-Dock-Audio-Module", ++ .ifnum = QUIRK_NO_INTERFACE ++ } ++}, + /* FTDI devices */ + { + USB_DEVICE(0x0403, 0xb8d8), +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index 4a0a5a071d51..0d620c267e7a 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -37,7 +37,7 @@ struct snd_usb_audio { + struct usb_interface *pm_intf; + u32 usb_id; + struct mutex mutex; +- unsigned int autosuspended:1; ++ unsigned int system_suspend; + atomic_t active; + atomic_t shutdown; + atomic_t usage_count; +diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c +index bd021a0eeef8..4cc69675c2a9 100644 +--- a/tools/lib/api/fs/fs.c ++++ b/tools/lib/api/fs/fs.c +@@ -90,6 +90,7 @@ struct fs { + const char * const *mounts; + char path[PATH_MAX]; + bool found; ++ bool checked; + long magic; + }; + +@@ -111,31 +112,37 @@ static struct fs fs__entries[] = { + .name = "sysfs", + .mounts = sysfs__fs_known_mountpoints, + .magic = SYSFS_MAGIC, ++ .checked = false, + }, + [FS__PROCFS] = { + .name = "proc", + .mounts = procfs__known_mountpoints, + .magic = PROC_SUPER_MAGIC, ++ .checked = false, + }, + [FS__DEBUGFS] = { + .name = "debugfs", + .mounts = debugfs__known_mountpoints, + .magic = DEBUGFS_MAGIC, ++ .checked = false, + }, + [FS__TRACEFS] = { + .name = "tracefs", + .mounts = tracefs__known_mountpoints, + .magic = TRACEFS_MAGIC, ++ .checked = false, + }, + [FS__HUGETLBFS] = { + .name = "hugetlbfs", + .mounts = hugetlbfs__known_mountpoints, + .magic = HUGETLBFS_MAGIC, ++ .checked = false, + }, + [FS__BPF_FS] = { + .name = "bpf", + .mounts = bpf_fs__known_mountpoints, + .magic = BPF_FS_MAGIC, ++ .checked = false, + }, + }; + +@@ -158,6 +165,7 @@ static bool fs__read_mounts(struct fs *fs) + } + + fclose(fp); ++ fs->checked = true; + return fs->found = found; + } + +@@ -220,6 +228,7 @@ static bool fs__env_override(struct fs *fs) + return false; + + fs->found = true; ++ fs->checked = true; + strncpy(fs->path, override_path, sizeof(fs->path) - 1); + fs->path[sizeof(fs->path) - 1] = '\0'; + return true; +@@ -246,6 +255,14 @@ static const char *fs__mountpoint(int idx) + if (fs->found) + return (const char *)fs->path; + ++ /* the mount point was already checked for the mount point ++ * but and did not exist, so return NULL to avoid scanning again. ++ * This makes the found and not found paths cost equivalent ++ * in case of multiple calls. ++ */ ++ if (fs->checked) ++ return NULL; ++ + return fs__get_mountpoint(fs); + } + +diff --git a/tools/lib/api/fs/fs.h b/tools/lib/api/fs/fs.h +index 92d03b8396b1..3b70003e7cfb 100644 +--- a/tools/lib/api/fs/fs.h ++++ b/tools/lib/api/fs/fs.h +@@ -18,6 +18,18 @@ + const char *name##__mount(void); \ + bool name##__configured(void); \ + ++/* ++ * The xxxx__mountpoint() entry points find the first match mount point for each ++ * filesystems listed below, where xxxx is the filesystem type. ++ * ++ * The interface is as follows: ++ * ++ * - If a mount point is found on first call, it is cached and used for all ++ * subsequent calls. ++ * ++ * - If a mount point is not found, NULL is returned on first call and all ++ * subsequent calls. ++ */ + FS(sysfs) + FS(procfs) + FS(debugfs) +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 4d509734b695..fd3071d83dea 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -801,6 +801,12 @@ static int add_special_section_alts(struct objtool_file *file) + } + + if (special_alt->group) { ++ if (!special_alt->orig_len) { ++ WARN_FUNC("empty alternative entry", ++ orig_insn->sec, orig_insn->offset); ++ continue; ++ } ++ + ret = handle_group_alt(file, special_alt, orig_insn, + &new_insn); + if (ret) +diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c +index 0bdb34fee9d8..215da628d60b 100644 +--- a/tools/perf/builtin-probe.c ++++ b/tools/perf/builtin-probe.c +@@ -376,6 +376,9 @@ static int perf_add_probe_events(struct perf_probe_event *pevs, int npevs) + + for (k = 0; k < pev->ntevs; k++) { + struct probe_trace_event *tev = &pev->tevs[k]; ++ /* Skipped events have no event name */ ++ if (!tev->event) ++ continue; + + /* We use tev's name for showing new events */ + show_perf_probe_event(tev->group, tev->event, pev, +diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c +index cee717a3794f..56f86317694d 100644 +--- a/tools/perf/util/dso.c ++++ b/tools/perf/util/dso.c +@@ -38,6 +38,7 @@ char dso__symtab_origin(const struct dso *dso) + [DSO_BINARY_TYPE__BUILD_ID_CACHE_DEBUGINFO] = 'D', + [DSO_BINARY_TYPE__FEDORA_DEBUGINFO] = 'f', + [DSO_BINARY_TYPE__UBUNTU_DEBUGINFO] = 'u', ++ [DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO] = 'x', + [DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO] = 'o', + [DSO_BINARY_TYPE__BUILDID_DEBUGINFO] = 'b', + [DSO_BINARY_TYPE__SYSTEM_PATH_DSO] = 'd', +@@ -120,6 +121,21 @@ int dso__read_binary_type_filename(const struct dso *dso, + snprintf(filename + len, size - len, "%s", dso->long_name); + break; + ++ case DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO: ++ /* ++ * Ubuntu can mixup /usr/lib with /lib, putting debuginfo in ++ * /usr/lib/debug/lib when it is expected to be in ++ * /usr/lib/debug/usr/lib ++ */ ++ if (strlen(dso->long_name) < 9 || ++ strncmp(dso->long_name, "/usr/lib/", 9)) { ++ ret = -1; ++ break; ++ } ++ len = __symbol__join_symfs(filename, size, "/usr/lib/debug"); ++ snprintf(filename + len, size - len, "%s", dso->long_name + 4); ++ break; ++ + case DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO: + { + const char *last_slash; +diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h +index c5380500bed4..0b474c7ef1e1 100644 +--- a/tools/perf/util/dso.h ++++ b/tools/perf/util/dso.h +@@ -25,6 +25,7 @@ enum dso_binary_type { + DSO_BINARY_TYPE__BUILD_ID_CACHE_DEBUGINFO, + DSO_BINARY_TYPE__FEDORA_DEBUGINFO, + DSO_BINARY_TYPE__UBUNTU_DEBUGINFO, ++ DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO, + DSO_BINARY_TYPE__BUILDID_DEBUGINFO, + DSO_BINARY_TYPE__SYSTEM_PATH_DSO, + DSO_BINARY_TYPE__GUEST_KMODULE, +diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c +index a22e1f538aea..4ac3c89bfac8 100644 +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -111,7 +111,7 @@ void exit_probe_symbol_maps(void) + symbol__exit(); + } + +-static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void) ++static struct ref_reloc_sym *kernel_get_ref_reloc_sym(struct map **pmap) + { + /* kmap->ref_reloc_sym should be set if host_machine is initialized */ + struct kmap *kmap; +@@ -123,6 +123,10 @@ static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void) + kmap = map__kmap(map); + if (!kmap) + return NULL; ++ ++ if (pmap) ++ *pmap = map; ++ + return kmap->ref_reloc_sym; + } + +@@ -134,7 +138,7 @@ static int kernel_get_symbol_address_by_name(const char *name, u64 *addr, + struct map *map; + + /* ref_reloc_sym is just a label. Need a special fix*/ +- reloc_sym = kernel_get_ref_reloc_sym(); ++ reloc_sym = kernel_get_ref_reloc_sym(NULL); + if (reloc_sym && strcmp(name, reloc_sym->name) == 0) + *addr = (reloc) ? reloc_sym->addr : reloc_sym->unrelocated_addr; + else { +@@ -241,21 +245,22 @@ static void clear_probe_trace_events(struct probe_trace_event *tevs, int ntevs) + static bool kprobe_blacklist__listed(unsigned long address); + static bool kprobe_warn_out_range(const char *symbol, unsigned long address) + { +- u64 etext_addr = 0; +- int ret; +- +- /* Get the address of _etext for checking non-probable text symbol */ +- ret = kernel_get_symbol_address_by_name("_etext", &etext_addr, +- false, false); ++ struct map *map; ++ bool ret = false; + +- if (ret == 0 && etext_addr < address) +- pr_warning("%s is out of .text, skip it.\n", symbol); +- else if (kprobe_blacklist__listed(address)) ++ map = kernel_get_module_map(NULL); ++ if (map) { ++ ret = address <= map->start || map->end < address; ++ if (ret) ++ pr_warning("%s is out of .text, skip it.\n", symbol); ++ map__put(map); ++ } ++ if (!ret && kprobe_blacklist__listed(address)) { + pr_warning("%s is blacklisted function, skip it.\n", symbol); +- else +- return false; ++ ret = true; ++ } + +- return true; ++ return ret; + } + + /* +@@ -751,6 +756,7 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs, + int ntevs) + { + struct ref_reloc_sym *reloc_sym; ++ struct map *map; + char *tmp; + int i, skipped = 0; + +@@ -759,7 +765,7 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs, + return post_process_offline_probe_trace_events(tevs, ntevs, + symbol_conf.vmlinux_name); + +- reloc_sym = kernel_get_ref_reloc_sym(); ++ reloc_sym = kernel_get_ref_reloc_sym(&map); + if (!reloc_sym) { + pr_warning("Relocated base symbol is not found!\n"); + return -EINVAL; +@@ -770,9 +776,13 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs, + continue; + if (tevs[i].point.retprobe && !kretprobe_offset_is_supported()) + continue; +- /* If we found a wrong one, mark it by NULL symbol */ ++ /* ++ * If we found a wrong one, mark it by NULL symbol. ++ * Since addresses in debuginfo is same as objdump, we need ++ * to convert it to addresses on memory. ++ */ + if (kprobe_warn_out_range(tevs[i].point.symbol, +- tevs[i].point.address)) { ++ map__objdump_2mem(map, tevs[i].point.address))) { + tmp = NULL; + skipped++; + } else { +@@ -1753,8 +1763,7 @@ int parse_probe_trace_command(const char *cmd, struct probe_trace_event *tev) + fmt1_str = strtok_r(argv0_str, ":", &fmt); + fmt2_str = strtok_r(NULL, "/", &fmt); + fmt3_str = strtok_r(NULL, " \t", &fmt); +- if (fmt1_str == NULL || strlen(fmt1_str) != 1 || fmt2_str == NULL +- || fmt3_str == NULL) { ++ if (fmt1_str == NULL || fmt2_str == NULL || fmt3_str == NULL) { + semantic_error("Failed to parse event name: %s\n", argv[0]); + ret = -EINVAL; + goto out; +@@ -2888,7 +2897,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev, + /* Note that the symbols in the kmodule are not relocated */ + if (!pev->uprobes && !pev->target && + (!pp->retprobe || kretprobe_offset_is_supported())) { +- reloc_sym = kernel_get_ref_reloc_sym(); ++ reloc_sym = kernel_get_ref_reloc_sym(NULL); + if (!reloc_sym) { + pr_warning("Relocated base symbol is not found!\n"); + ret = -EINVAL; +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index 876787de7959..60169196b948 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -114,6 +114,7 @@ enum dso_binary_type distro_dwarf_types[] = { + DSO_BINARY_TYPE__UBUNTU_DEBUGINFO, + DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO, + DSO_BINARY_TYPE__BUILDID_DEBUGINFO, ++ DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO, + DSO_BINARY_TYPE__NOT_FOUND, + }; + +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index 91404bacc3df..b6f8349abc67 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -65,6 +65,7 @@ static enum dso_binary_type binary_type_symtab[] = { + DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE, + DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE_COMP, + DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO, ++ DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO, + DSO_BINARY_TYPE__NOT_FOUND, + }; + +@@ -1419,6 +1420,7 @@ static bool dso__is_compatible_symtab_type(struct dso *dso, bool kmod, + case DSO_BINARY_TYPE__SYSTEM_PATH_DSO: + case DSO_BINARY_TYPE__FEDORA_DEBUGINFO: + case DSO_BINARY_TYPE__UBUNTU_DEBUGINFO: ++ case DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO: + case DSO_BINARY_TYPE__BUILDID_DEBUGINFO: + case DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO: + return !kmod && dso->kernel == DSO_TYPE_USER; +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index 89f8b0dae7ef..bad3505d66e0 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -1118,6 +1118,7 @@ static int extract_build_id(char *build_id, size_t size) + len = size; + memcpy(build_id, line, len); + build_id[len] = '\0'; ++ free(line); + return 0; + err: + fclose(fp); +diff --git a/tools/testing/selftests/bpf/test_select_reuseport.c b/tools/testing/selftests/bpf/test_select_reuseport.c +index cdbbdab2725f..b14d25bfa830 100644 +--- a/tools/testing/selftests/bpf/test_select_reuseport.c ++++ b/tools/testing/selftests/bpf/test_select_reuseport.c +@@ -616,13 +616,13 @@ static void cleanup_per_test(void) + + for (i = 0; i < NR_RESULTS; i++) { + err = bpf_map_update_elem(result_map, &i, &zero, BPF_ANY); +- RET_IF(err, "reset elem in result_map", +- "i:%u err:%d errno:%d\n", i, err, errno); ++ CHECK(err, "reset elem in result_map", ++ "i:%u err:%d errno:%d\n", i, err, errno); + } + + err = bpf_map_update_elem(linum_map, &zero, &zero, BPF_ANY); +- RET_IF(err, "reset line number in linum_map", "err:%d errno:%d\n", +- err, errno); ++ CHECK(err, "reset line number in linum_map", "err:%d errno:%d\n", ++ err, errno); + + for (i = 0; i < REUSEPORT_ARRAY_SIZE; i++) + close(sk_fds[i]); +diff --git a/tools/testing/selftests/networking/timestamping/rxtimestamp.c b/tools/testing/selftests/networking/timestamping/rxtimestamp.c +index dd4162fc0419..7a573fb4c1c4 100644 +--- a/tools/testing/selftests/networking/timestamping/rxtimestamp.c ++++ b/tools/testing/selftests/networking/timestamping/rxtimestamp.c +@@ -114,6 +114,7 @@ static struct option long_options[] = { + { "tcp", no_argument, 0, 't' }, + { "udp", no_argument, 0, 'u' }, + { "ip", no_argument, 0, 'i' }, ++ { NULL, 0, NULL, 0 }, + }; + + static int next_port = 19999; +diff --git a/virt/kvm/arm/aarch32.c b/virt/kvm/arm/aarch32.c +index 18d6d5124397..92c9ad6c0182 100644 +--- a/virt/kvm/arm/aarch32.c ++++ b/virt/kvm/arm/aarch32.c +@@ -44,6 +44,26 @@ static const u8 return_offsets[8][2] = { + [7] = { 4, 4 }, /* FIQ, unused */ + }; + ++static bool pre_fault_synchronize(struct kvm_vcpu *vcpu) ++{ ++ preempt_disable(); ++ if (kvm_arm_vcpu_loaded(vcpu)) { ++ kvm_arch_vcpu_put(vcpu); ++ return true; ++ } ++ ++ preempt_enable(); ++ return false; ++} ++ ++static void post_fault_synchronize(struct kvm_vcpu *vcpu, bool loaded) ++{ ++ if (loaded) { ++ kvm_arch_vcpu_load(vcpu, smp_processor_id()); ++ preempt_enable(); ++ } ++} ++ + /* + * When an exception is taken, most CPSR fields are left unchanged in the + * handler. However, some are explicitly overridden (e.g. M[4:0]). +@@ -166,7 +186,10 @@ static void prepare_fault32(struct kvm_vcpu *vcpu, u32 mode, u32 vect_offset) + + void kvm_inject_undef32(struct kvm_vcpu *vcpu) + { ++ bool loaded = pre_fault_synchronize(vcpu); ++ + prepare_fault32(vcpu, PSR_AA32_MODE_UND, 4); ++ post_fault_synchronize(vcpu, loaded); + } + + /* +@@ -179,6 +202,9 @@ static void inject_abt32(struct kvm_vcpu *vcpu, bool is_pabt, + u32 vect_offset; + u32 *far, *fsr; + bool is_lpae; ++ bool loaded; ++ ++ loaded = pre_fault_synchronize(vcpu); + + if (is_pabt) { + vect_offset = 12; +@@ -202,6 +228,8 @@ static void inject_abt32(struct kvm_vcpu *vcpu, bool is_pabt, + /* no need to shuffle FS[4] into DFSR[10] as its 0 */ + *fsr = DFSR_FSC_EXTABT_nLPAE; + } ++ ++ post_fault_synchronize(vcpu, loaded); + } + + void kvm_inject_dabt32(struct kvm_vcpu *vcpu, unsigned long addr) +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index aca15bd1cc4c..1218ea663c6d 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -141,10 +141,9 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm); + static unsigned long long kvm_createvm_count; + static unsigned long long kvm_active_vms; + +-__weak int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, +- unsigned long start, unsigned long end, bool blockable) ++__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, ++ unsigned long start, unsigned long end) + { +- return 0; + } + + bool kvm_is_zone_device_pfn(kvm_pfn_t pfn) +@@ -366,6 +365,18 @@ static inline struct kvm *mmu_notifier_to_kvm(struct mmu_notifier *mn) + return container_of(mn, struct kvm, mmu_notifier); + } + ++static void kvm_mmu_notifier_invalidate_range(struct mmu_notifier *mn, ++ struct mm_struct *mm, ++ unsigned long start, unsigned long end) ++{ ++ struct kvm *kvm = mmu_notifier_to_kvm(mn); ++ int idx; ++ ++ idx = srcu_read_lock(&kvm->srcu); ++ kvm_arch_mmu_notifier_invalidate_range(kvm, start, end); ++ srcu_read_unlock(&kvm->srcu, idx); ++} ++ + static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn, + struct mm_struct *mm, + unsigned long address, +@@ -390,7 +401,6 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn, + { + struct kvm *kvm = mmu_notifier_to_kvm(mn); + int need_tlb_flush = 0, idx; +- int ret; + + idx = srcu_read_lock(&kvm->srcu); + spin_lock(&kvm->mmu_lock); +@@ -407,12 +417,9 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn, + kvm_flush_remote_tlbs(kvm); + + spin_unlock(&kvm->mmu_lock); +- +- ret = kvm_arch_mmu_notifier_invalidate_range(kvm, start, end, blockable); +- + srcu_read_unlock(&kvm->srcu, idx); + +- return ret; ++ return 0; + } + + static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn, +@@ -521,6 +528,7 @@ static void kvm_mmu_notifier_release(struct mmu_notifier *mn, + + static const struct mmu_notifier_ops kvm_mmu_notifier_ops = { + .flags = MMU_INVALIDATE_DOES_NOT_BLOCK, ++ .invalidate_range = kvm_mmu_notifier_invalidate_range, + .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start, + .invalidate_range_end = kvm_mmu_notifier_invalidate_range_end, + .clear_flush_young = kvm_mmu_notifier_clear_flush_young, |